File Information hashes and primary classification
File name
6b08010bf6a5148ea64abdea3edfac0ed11a27137def1f8f6e6c7a996870a8e8
File size
2.7 MiB
Architecture
X64
- MD5
- 109451d265aae647565d10eb9e591569
- SHA1
- 89a64a719da47d46cdd0248d940751b1283f6032
- SHA256
- 6b08010bf6a5148ea64abdea3edfac0ed11a27137def1f8f6e6c7a996870a8e8
- TLSH
- T1aed5334672d490b2d0b4a73984f347935b36bde427342a6f7284f17a6d33ac5a1b0f92
- Imphash
- 4cea7ae85c87ddc7295d39ff9cda31d1
- Rich header
- b6989cad4924050662ea91c22ada1464
Metadata parser-extracted fields
YARA Signatures 3 matching rules
Type.UNCOMMON
persistence
AutorunKey
lateral movement
ElevatePrivileges
Type.INFO
sfx
CabSelfExtractor
Kesakode similarity verdict
No Kesakode verdict available.
Anomalies signals worth reviewing
resources:
BigResourceHighEntropy
RcdataNoDelphi
strings:
BigStringHiScore
time:
DebugTimeDifferentThanTimeDateStamp
entropy:
HighEntropy
code:
HighXrefLoopingFunction
SpaghettiFunction
integrity:
InvalidChecksum
sections:
SectionMostlyVirtual
Constants identified constants and patterns
registry:
HKEY_LOCAL_MACHINE
6
autorun
1
HKEY_CURRENT_USER
1
Strings highest-value extracted strings
| Address | String | Refs | Encoding | Score |
|---|---|---|---|---|
| 0x14000C088 | Software\Microsoft\Windows\CurrentVersion\RunOnce | 3 | ASCII | 234 |
| 0x1402BB3E0 | <?xml version="1.0" encoding="UTF-8" standalone="yes"?>\r\n<!-- Copyright (c) Microsoft Corporation -->\r\n<assembly ... | 1 | ASCII | 225 |
| 0x1400098E8 | POSTRUNPROGRAM | 1 | ASCII | 203 |
| 0x140009958 | PACKINSTSPACE | 1 | ASCII | 203 |
| 0x14000C0C0 | wextract_cleanup%d | 1 | ASCII | 199 |
| 0x1400099D0 | UPDFILE%lu | 1 | ASCII | 187 |
| 0x14000C160 | System\CurrentControlSet\Control\Session Manager\FileRenameOperations | 1 | ASCII | 172 |
| 0x14000C020 | System\CurrentControlSet\Control\Session Manager | 1 | ASCII | 168 |
| 0x1400097E8 | Software\Microsoft\Windows\CurrentVersion\App Paths | 1 | ASCII | 167 |
| 0x14003F538 | MSCF | 1 | ASCII | 161 |
| 0x140009820 | Kernel32.dll | 1 | UTF16 | 157 |
| 0x1400097D8 | wininit.ini | 1 | ASCII | 157 |
| 0x140009A7C | wextract.pdb | 0 | ASCII | 148 |
| 0x14000C1B0 | SHELL32.DLL | 1 | ASCII | 147 |
| 0x140009908 | LoadString() Error. Could not load string resource. | 1 | ASCII | 146 |
| 0x14003ED14 | ;Command line option syntax error. Type Command /? for Help. | 1 | UTF16 | 144 |
| 0x140009778 | setupapi.dll | 1 | ASCII | 143 |
| 0x1400099A0 | msdownld.tmp | 1 | ASCII | 143 |
| 0x1400099E0 | Control Panel\Desktop\ResourceLocale | 1 | ASCII | 142 |
| 0x14003DD78 | CFailed to get disk space information from: %s.\n\nSystem Message: %s.&A required resource cannot be located. Are you... | 1 | UTF16 | 140 |
| 0x1400097A8 | advpack.dll | 4 | ASCII | 139 |
| 0x140009708 | advapi32.dll | 2 | ASCII | 138 |
| 0x14000C0D8 | rundll32.exe %s,InstallHinfSection %s 128 %s | 1 | ASCII | 137 |
| 0x14000C108 | PendingFileRenameOperations | 1 | ASCII | 137 |
| 0x140009970 | IXP%03d.TMP | 1 | ASCII | 137 |
| 0x14000A902 | AdjustTokenPrivileges | 0 | ASCII | 136 |
| 0x14000C058 | rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s" | 2 | ASCII | 134 |
| 0x14000C1D0 | SHBrowseForFolder | 1 | ASCII | 133 |
| 0x140009768 | setupx.dll | 2 | ASCII | 132 |
| 0x140009840 | HeapSetInformation | 1 | ASCII | 131 |
| 0x1402BA9EC | cmd /v /c Set wDveSp=cmd & !wDveSp! < Crap.aac | 1 | ASCII | 130 |
| 0x140009718 | CheckTokenMembership | 1 | ASCII | 130 |
| 0x140009870 | INSTANCECHECK | 1 | ASCII | 130 |
| 0x140009948 | FILESIZES | 1 | ASCII | 130 |
| 0x1400099C0 | RegServer | 1 | ASCII | 130 |
| 0x1400098B8 | SHOWWINDOW | 1 | ASCII | 129 |
| 0x140009790 | SeShutdownPrivilege | 1 | ASCII | 128 |
| 0x1400098C8 | ADMQCMD | 1 | ASCII | 128 |
| 0x1400097B8 | DelNodeRunDLL32 | 1 | ASCII | 127 |
| 0x140009880 | VERCHECK | 1 | ASCII | 127 |
| 0x14000C1E8 | SHGetPathFromIDList | 1 | ASCII | 125 |
| 0x1400099B0 | TMP4351$.TMP | 1 | ASCII | 125 |
| 0x140009860 | EXTRACTOPT | 1 | ASCII | 125 |
| 0x140009990 | alpha | 1 | ASCII | 124 |
| 0x140009854 | TITLE | 1 | ASCII | 124 |
| 0x140009748 | Reboot | 1 | ASCII | 123 |
| 0x1400098B0 | REBOOT | 1 | ASCII | 123 |
| 0x14000C128 | DefaultInstall | 2 | ASCII | 122 |
| 0x140009890 | DecryptFileA | 1 | ASCII | 122 |
| 0x140009750 | AdvancedINF | 1 | ASCII | 122 |
| 0x1402BAA4C | Incl Writing Laid Limiting Colorado Indication Disaster Basket | 1 | ASCII | 120 |
| 0x14000C1C0 | DoInfInstall | 2 | ASCII | 120 |
| 0x1400098D8 | RUNPROGRAM | 3 | ASCII | 118 |
| 0x1400098F8 | FINISHMSG | 2 | ASCII | 118 |
| 0x14000C138 | Command.com /c %s | 2 | ASCII | 117 |
| 0x140009760 | Version | 1 | ASCII | 117 |
| 0x1400098D0 | USRQCMD | 1 | ASCII | 117 |
| 0x140009980 | i386 | 1 | ASCII | 116 |
| 0x140009988 | mips | 1 | ASCII | 116 |
| 0x140009788 | .BAT | 1 | ASCII | 116 |
| 0x140009738 | .INF | 1 | ASCII | 116 |
| 0x14000B0E6 | COMCTL32.dll | 1 | ASCII | 115 |
| 0x14000A918 | ADVAPI32.dll | 1 | ASCII | 115 |
| 0x14000ADD4 | KERNEL32.dll | 1 | ASCII | 115 |
| 0x1400098A0 | LICENSE | 2 | ASCII | 115 |
| 0x140009968 | UPROMPT | 2 | ASCII | 115 |
| 0x14000C150 | %s /D:%s | 1 | ASCII | 113 |
| 0x14000B0F4 | Cabinet.dll | 1 | ASCII | 112 |
| 0x14000B142 | VERSION.dll | 1 | ASCII | 112 |
| 0x14000AFE2 | USER32.dll | 1 | ASCII | 112 |
| 0x14000B0C6 | msvcrt.dll | 1 | ASCII | 112 |
| 0x14000ADF2 | GDI32.dll | 1 | ASCII | 112 |
| 0x140009940 | CABINET | 2 | ASCII | 109 |
| 0x14000C200 | *MEMCAB | 3 | ASCII | 109 |
| 0x1400098A8 | <None> | 6 | ASCII | 109 |
| 0x14003DE92 | 8Unable to retrieve operating system version information.!Memory allocation request failed. | 0 | UTF16 | 108 |
| 0x1402BAA20 | makecab.exe /jkdhfihu3478yr983834803 | 1 | ASCII | 108 |
| 0x14003D640 | Please type the location where you want to place the extracted files. | 0 | UTF16 | 107 |
| 0x14003D33C | Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement. | 0 | UTF16 | 106 |
| 0x14003DFC4 | Filetable full.%Can not change to destination folder. | 0 | UTF16 | 105 |
| 0x14003E570 | Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being u... | 0 | UTF16 | 104 |
| 0x14003F044 | eAnother copy of the '%s' package is already running on your system. Do you want to run another copy? | 0 | UTF16 | 103 |
| 0x1402BAC38 | Resource consumption tracking for sustainability. | 0 | UTF16 | 103 |
| 0x1402BAD70 | Resource consumption tracking for sustainability. | 0 | UTF16 | 103 |
| 0x14003E8AC | $NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Ext... | 0 | UTF16 | 102 |
| 0x14003ED8E | Command line options:\n\n/Q -- Quiet modes for package,\n\n/T:<full path> -- Specifies temporary working folder,\n\n/... | 0 | UTF16 | 102 |
| 0x14003E3BA | (Error creating process <%s>. Reason: %s1The cluster size in this system is not supported.,A required resource appea... | 0 | UTF16 | 102 |
| 0x14003F170 | You do not have administrator privileges on this machine. Some installations cannot be completed correctly unless the... | 0 | UTF16 | 102 |
| 0x14003D448 | Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install y... | 0 | UTF16 | 102 |
| 0x14003DCFC | 4Please select a folder to store the extracted files. | 0 | UTF16 | 102 |
| 0x14003E030 | Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and p... | 0 | UTF16 | 101 |
| 0x14003E6FE | To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk ... | 0 | UTF16 | 101 |
| 0x14003F29A | :The folder '%s' does not exist. Do you want to create it?hAnother copy of the '%s' package is already running on yo... | 0 | UTF16 | 98 |
| 0x1402BB25A | Microsoft Corporation. All rights reserved. | 0 | UTF16 | 98 |
| 0x1402BB2DC | WEXTRACT.EXE .MUI | 0 | UTF16 | 97 |
| 0x14000FD70 | RIFF | 1 | ASCII | 97 |
| 0x1402BAE5A | EcoOptimize Solutions 2012 All rights reserved. | 0 | UTF16 | 96 |
| 0x1402BB194 | 11.00.22621.1 (WinBuild.160101.0800) | 0 | UTF16 | 95 |
| 0x14000FC72 | CABINET\nEXTRACTOPT FILESIZES FINISHMSG | 0 | UTF16 | 94 |
| 0x14003CC28 | Please wait while Setup is loading... | 0 | UTF16 | 92 |
| 0x14003C5D0 | Please wait while Setup is loading... | 0 | UTF16 | 92 |
| 0x14003D280 | Please wait while Setup is loading... | 0 | UTF16 | 92 |
| 0x14003DF4C | #Unable to create extraction thread. | 0 | UTF16 | 92 |
| 0x14003DB8C | Initializing... Please wait... | 0 | UTF16 | 90 |
| 0x14003D9CC | Initializing... Please wait... | 0 | UTF16 | 90 |
| 0x1402BB0E4 | Win32 Cabinet Self-Extractor | 0 | UTF16 | 89 |
| 0x14003D7EC | Do you want to overwrite the file: | 0 | UTF16 | 89 |
| 0x14003E866 | Error retrieving Windows folder | 0 | UTF16 | 89 |
| 0x14000FD0A | REBOOT\nRUNPROGRAM\nSHOWWINDOW | 0 | UTF16 | 88 |
| 0x14003F530 | <None> | 1 | ASCII | 88 |
| 0x1402BAA8C | <None> | 1 | ASCII | 88 |
| 0x1402BA9E0 | <None> | 1 | ASCII | 88 |
| 0x1402BA9D8 | <None> | 1 | ASCII | 88 |
| 0x1402BAA94 | <None> | 1 | ASCII | 88 |
| 0x14000FCC0 | LICENSE\rPACKINSTSPACE | 0 | UTF16 | 87 |
| 0x1402BB380 | 11.00.22621.1 | 0 | UTF16 | 87 |
| 0x140009A64 | RSDSh\rr | 2 | ASCII | 86 |
| 0x1402BACBC | EcoOptimize Solutions | 0 | UTF16 | 84 |
| 0x14003F6E0 | Intended.aac | 0 | ASCII | 84 |
| 0x14003DCB8 | Do you want to continue? | 0 | UTF16 | 82 |
| 0x1402BB090 | Microsoft Corporation | 0 | UTF16 | 82 |
| 0x14003F112 | Could not find the file: %s. | 0 | UTF16 | 81 |
| 0x1402BAB8E | VS_VERSION_INFO | 0 | UTF16 | 81 |
| 0x1402BAFDE | VS_VERSION_INFO | 0 | UTF16 | 81 |
| 0x14003F5C1 | Fraction.aac | 0 | ASCII | 81 |
| 0x14003F5F9 | Gba.aac | 0 | ASCII | 81 |
| 0x14003E6C4 | Could not create folder '%s' | 0 | UTF16 | 80 |
| 0x1402BB2BA | OriginalFilename | 0 | UTF16 | 80 |
| 0x1402BAC0E | 040904B0 | 0 | UTF16 | 80 |
| 0x1402BB05E | 040904B0 | 0 | UTF16 | 80 |
| 0x14003F590 | Flat.aac | 0 | ASCII | 80 |
| 0x14003F65A | Crap.aac | 0 | ASCII | 80 |
| 0x140009A8C | GCTL | 2 | ASCII | 80 |
| 0x14003F626 | Finite.aac | 0 | ASCII | 79 |
| 0x1402BB338 | Internet Explorer | 0 | UTF16 | 78 |
| 0x14000AC9A | LocalFileTimeToFileTime | 0 | ASCII | 78 |
| 0x14003F6AB | Acquire.aac | 0 | ASCII | 78 |
| 0x14003F673 | Funding.aac | 0 | ASCII | 78 |
| 0x1401C3D8A | /t/3p | 0 | ASCII | 77 |
| 0x14003DF98 | Cabinet is not valid. | 0 | UTF16 | 76 |
| 0x14003CA68 | msctls_progress32 | 0 | UTF16 | 76 |
| 0x14003CA08 | msctls_progress32 | 0 | UTF16 | 76 |
| 0x14003D0C0 | msctls_progress32 | 0 | UTF16 | 76 |
| 0x14003C3D8 | msctls_progress32 | 0 | UTF16 | 76 |
| 0x14003D060 | msctls_progress32 | 0 | UTF16 | 76 |
| 0x14003C438 | msctls_progress32 | 0 | UTF16 | 76 |
| 0x14003DA24 | msctls_progress32 | 0 | UTF16 | 76 |
| 0x14000FCEC | POSTRUNPROGRAM | 0 | UTF16 | 76 |
| 0x140023E44 | J<<BYHHSYHHVXHHCXHH8SDD#RCC | 0 | ASCII | 76 |
| 0x14015CEE0 | /c5/0Kk | 0 | ASCII | 76 |
| 0x14003F68F | Knights.aac | 0 | ASCII | 75 |
| 0x14003F6C7 | Alto.aac | 0 | ASCII | 75 |
| 0x14003F641 | Clip.aac | 0 | ASCII | 75 |
| 0x1400FF2C2 | hhPT.sq0 | 0 | ASCII | 75 |
| 0x14000B240 | GetSystemTimeAsFileTime | 0 | ASCII | 74 |
| 0x14000AD98 | DosDateTimeToFileTime | 0 | ASCII | 74 |
| 0x140014E66 | ExxwwEEx | 0 | ASCII | 74 |
| 0x1400133DF | wvvww | 0 | ASCII | 74 |
| 0x14003D5E2 | Temporary folder | 0 | UTF16 | 73 |
| 0x1402BAD4E | FileDescription | 0 | UTF16 | 73 |
| 0x1402BAF74 | 2.03.6.94523 | 0 | UTF16 | 73 |
| 0x1402BB0C2 | FileDescription | 0 | UTF16 | 73 |
| 0x14003D792 | Overwrite file | 0 | UTF16 | 73 |
| 0x14000AA74 | WritePrivateProfileStringA | 0 | ASCII | 73 |
| 0x1402BB1E6 | InternalName | 0 | UTF16 | 73 |
| 0x140023F04 | H::2UEE:UDD9TEE)SCC"SED | 0 | ASCII | 73 |
| 0x140025EF8 | ZII?XGGKXGG?TDD0SDD | 0 | ASCII | 73 |
| 0x14000B036 | __set_app_type | 0 | ASCII | 73 |
| 0x1400142BB | WPMMMPPUW | 0 | ASCII | 73 |
| 0x1400245F0 | hhh\rCCC | 0 | ASCII | 73 |
| 0x1400246B0 | nnn\rEEE | 0 | ASCII | 73 |
| 0x1400270FC | TTTI444 | 0 | ASCII | 73 |
| 0x140024470 | ttt\nGGG | 0 | ASCII | 73 |
| 0x14002715C | WWWILLL | 0 | ASCII | 73 |
| 0x140026414 | xxx\r::: | 0 | ASCII | 73 |
| 0x140024230 | YYY\n=== | 0 | ASCII | 73 |
| 0x1402BAEDC | GaiaTrack | 0 | UTF16 | 72 |
| 0x14000B1C8 | SetUnhandledExceptionFilter | 0 | ASCII | 72 |
| 0x14000A8B8 | AllocateAndInitializeSid | 0 | ASCII | 72 |
| 0x14000FC62 | ADMQCMD | 0 | UTF16 | 72 |
| 0x140195343 | wwwwwq | 0 | ASCII | 72 |
| 0x140014442 | WWWUWW | 0 | ASCII | 72 |
| 0x1402BB03A | StringFileInfo | 0 | UTF16 | 71 |
| 0x1402BABEA | StringFileInfo | 0 | UTF16 | 71 |
| 0x1402BAF56 | ProductVersion | 0 | UTF16 | 71 |
| 0x1402BB362 | ProductVersion | 0 | UTF16 | 71 |
| 0x14003CAC8 | SysListView32 | 0 | UTF16 | 71 |
| 0x14003D120 | SysListView32 | 0 | UTF16 | 71 |
| 0x14003C498 | SysListView32 | 0 | UTF16 | 71 |
| 0x14000AB56 | GetPrivateProfileStringA | 0 | ASCII | 71 |
| 0x14000B1FA | QueryPerformanceCounter | 0 | ASCII | 71 |
| 0x14000B070 | __setusermatherr | 0 | ASCII | 71 |
| 0x14024F1D5 | Pq8Jy.vg2 | 0 | ASCII | 71 |
| 0x14009882C | |ySDQ.S | 0 | ASCII | 71 |
| - | !This program cannot be run in DOS mode.\r\r\n$ | 0 | ASCII | 70 |
| 0x14003DAD0 | MS Shell Dlg | 0 | UTF16 | 70 |
| 0x14003C9B6 | MS Shell Dlg | 0 | UTF16 | 70 |
| 0x14003D304 | MS Shell Dlg | 0 | UTF16 | 70 |
| 0x14003D910 | MS Shell Dlg | 0 | UTF16 | 70 |
| 0x14003C766 | MS Shell Dlg | 0 | UTF16 | 70 |
| 0x14003D60A | MS Shell Dlg | 0 | UTF16 | 70 |
| 0x14003CBAE | MS Shell Dlg | 0 | UTF16 | 70 |
| 0x14003C646 | MS Shell Dlg | 0 | UTF16 | 70 |
| 0x14003D00E | MS Shell Dlg | 0 | UTF16 | 70 |
| 0x14003DC00 | MS Shell Dlg | 0 | UTF16 | 70 |
| 0x14003CC9E | MS Shell Dlg | 0 | UTF16 | 70 |
| 0x14003CDBE | MS Shell Dlg | 0 | UTF16 | 70 |
| 0x14003D166 | MS Shell Dlg | 0 | UTF16 | 70 |
| 0x14003D7B6 | MS Shell Dlg | 0 | UTF16 | 70 |
| 0x14003CB0E | MS Shell Dlg | 0 | UTF16 | 70 |
| 0x14003D206 | MS Shell Dlg | 0 | UTF16 | 70 |
| 0x140023D84 | J<<Q[IIaZIIfXGGKVFF1WII | 0 | ASCII | 70 |
| 0x1402BB076 | CompanyName | 0 | UTF16 | 70 |
| 0x1402BACA2 | CompanyName | 0 | UTF16 | 70 |
| 0x14000B26A | EnumResourceLanguagesA | 0 | ASCII | 70 |
| 0x1402BADDA | FileVersion | 0 | UTF16 | 70 |
| 0x1402BAFBA | Translation | 0 | UTF16 | 70 |
| 0x1402BB3C2 | Translation | 0 | UTF16 | 70 |
| 0x1402BB17A | FileVersion | 0 | UTF16 | 70 |
| 0x14000AA00 | GetFileAttributesA | 0 | ASCII | 70 |
| 0x14000AABC | SetFileAttributesA | 0 | ASCII | 70 |
| 0x14001372D | wwwwwwp | 0 | ASCII | 70 |
| 0x140013795 | wwwwwwp | 0 | ASCII | 70 |
| 0x140022123 | UUqttt | 0 | ASCII | 70 |
| 0x140012F5C | wgwwxx | 0 | ASCII | 70 |
| 0x14013AC5C | I.ZCM | 0 | ASCII | 70 |
| 0x140238CA3 | 3.kXC | 0 | ASCII | 70 |
| 0x1401D2AB3 | :.ucI | 0 | ASCII | 70 |
| 0x1401C71B2 | Z.bJL | 0 | ASCII | 70 |
| 0x14006D670 | u.MqZ | 0 | ASCII | 70 |
| 0x14008EBFF | g6:.s | 0 | ASCII | 70 |
| 0x140299E09 | R.djQ | 0 | ASCII | 70 |
| 0x1400E7824 | /.GSI | 0 | ASCII | 70 |
| 0x1401E4E4A | U.ul5 | 0 | ASCII | 70 |
| 0x14025C61E | d.mRM | 0 | ASCII | 70 |
| 0x1400F7EEE | A.Ot6 | 0 | ASCII | 70 |
| 0x140247516 | B.gjp | 0 | ASCII | 70 |
| 0x14021E165 | y.Jv3 | 0 | ASCII | 70 |
| 0x1402AB506 | /zo/3 | 0 | ASCII | 70 |
| 0x1402B1B11 | U.jaP | 0 | ASCII | 70 |
| 0x14005ECE2 | i.FOc | 0 | ASCII | 70 |
| 0x1402B27A3 | MOJ.s | 0 | ASCII | 70 |
| 0x1402B2FF2 | w;C.S | 0 | ASCII | 70 |
| 0x140165676 | MT6.s | 0 | ASCII | 70 |
| 0x1401E840E | sNss | 0 | ASCII | 70 |
| 0x1400FAB5B | V/// | 0 | ASCII | 70 |
| 0x14026D2C7 | iU.s | 0 | ASCII | 70 |
| 0x140012D8E | Gwww | 0 | ASCII | 70 |
| 0x140012F48 | wxxw | 0 | ASCII | 70 |
| 0x140226C86 | s.pY | 0 | ASCII | 70 |
| 0x1401EEB50 | fH.S | 0 | ASCII | 70 |
| 0x140070D58 | 6;;; | 0 | ASCII | 70 |
| 0x14009F489 | :O:O | 0 | ASCII | 70 |
| 0x14001979C | [[[x | 0 | ASCII | 70 |
| 0x140022836 | ;;;3 | 0 | ASCII | 70 |
| 0x1400A8650 | \y\y | 0 | ASCII | 70 |
Functions high-value functions
Function listings
0x140004A30 sub_140004a30 str 0 api 1 imm 5 Unknown
sub_140004a30() {
sub rsp, 0x28
cmp edx, 0x01
jnz .1
mov edx, 0x466
mov r8d, 0x01
call [user32.SendMessageA]
nop [rax+rax*1], eax
.1:
xor eax, eax
add rsp, 0x28
ret
}
/* DISPLAY WARNING: Type casts are NOT being printed */
undefined8 sub_140004a30(undefined8 param_1,int32_t param_2)
{
if (param_2 == 1) {
(*user32.SendMessageA)(param_1, 0x466, 1);
}
return 0;
}
0x140007700 sub_140007700 str 0 api 1 imm 5 Unknown
sub_140007700() {
sub rsp, 0x28
call [kernel32.GetLastError]
nop [rax+rax*1], eax
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
add rsp, 0x28
ret
}
/* DISPLAY WARNING: Type casts are NOT being printed */
uint32_t sub_140007700(void)
{
uint32_t uVar1;
uint32_t uVar2;
uVar1 = (*kernel32.GetLastError)();
uVar2 = uVar1 & 0xffff | 0x80070000;
if (uVar1 < 1) {
uVar2 = uVar1;
}
return uVar2;
}
0x1400081B0 sub_1400081b0 str 0 api 1 imm 2 Unknown
sub_1400081b0() {
sub rsp, 0x38
mov eax, [0x14000C7C8]
lea r8, [0x14000C238]
mov r9d, [0x14000C7C4]
lea rdx, [0x14000C230]
mov [0x14000C244], eax
lea rcx, [0x14000C228]
lea rax, [0x14000C244]
mov [rsp+0x20], rax
call [msvcrt.__getmainargs]
mov [0x14000C22C], eax
add rsp, 0x38
ret
}
/* DISPLAY WARNING: Type casts are NOT being printed */
void sub_1400081b0(void)
{
[0x0x14000c244] = [0x0x14000c7c8];
000000014000c22c =
(*msvcrt.__getmainargs)(0x14000c228, 0x14000c230, 0x14000c238, [0x0x14000c7c4], 0x14000c244);
return;
}
0x140008790 sub_140008790 str 0 api 1 imm 2 Unknown
sub_140008790() {
sub rsp, 0x28
lea rcx, [sub_140008750()]
call [kernel32.SetUnhandledExceptionFilter]
xor eax, eax
add rsp, 0x28
ret
}
/* DISPLAY WARNING: Type casts are NOT being printed */
undefined8 sub_140008790(void)
{
(*kernel32.SetUnhandledExceptionFilter)(sub_140008750);
return 0;
}
0x140005870 sub_140005870 str 0 api 1 imm 0 Unknown
sub_140005870() {
mov edx, ecx
xor ecx, ecx
jmp [kernel32.GlobalAlloc]
}
/* DISPLAY WARNING: Type casts are NOT being printed */
void sub_140005870(undefined4 param_1)
{
/* WARNING: Treating indirect jump as call */
(*kernel32.GlobalAlloc)(0, param_1);
return;
}
0x140005890 jmp_kernel32.GlobalFree str 0 api 1 imm 0 Unknown
jmp_kernel32.GlobalFree() {
jmp [kernel32.GlobalFree]
}
/* DISPLAY WARNING: Type casts are NOT being printed */
void jmp_kernel32.GlobalFree(void)
{
/* WARNING: Treating indirect jump as call */
(*kernel32.GlobalFree)();
return;
}
0x1400087AE jmp_msvcrt._XcptFilter str 0 api 1 imm 0 Unknown
jmp_msvcrt._XcptFilter() {
jmp [msvcrt._XcptFilter]
}
/* DISPLAY WARNING: Type casts are NOT being printed */
void jmp_msvcrt._XcptFilter(void)
{
/* WARNING: Treating indirect jump as call */
(*msvcrt._XcptFilter)();
return;
}
0x140008863 jmp_msvcrt._amsg_exit str 0 api 1 imm 0 Unknown
jmp_msvcrt._amsg_exit() {
jmp [msvcrt._amsg_exit]
}
/* DISPLAY WARNING: Type casts are NOT being printed */
void jmp_msvcrt._amsg_exit(void)
{
/* WARNING: Treating indirect jump as call */
(*msvcrt._amsg_exit)();
return;
}
0x140008A3E jmp_msvcrt._initterm str 0 api 1 imm 0 Unknown
jmp_msvcrt._initterm() {
jmp [msvcrt._initterm]
}
/* DISPLAY WARNING: Type casts are NOT being printed */
void jmp_msvcrt._initterm(void)
{
/* WARNING: Treating indirect jump as call */
(*msvcrt._initterm)();
return;
}
0x140008A4A jmp_msvcrt.__C_specific_handler str 0 api 1 imm 0 Unknown
jmp_msvcrt.__C_specific_handler() {
jmp [msvcrt.__C_specific_handler]
}
/* DISPLAY WARNING: Type casts are NOT being printed */
void jmp_msvcrt.__C_specific_handler(void)
{
/* WARNING: Treating indirect jump as call */
(*msvcrt.__C_specific_handler)();
return;
}
0x140008A60 GuardCFCheckFunction str 0 api 1 imm 0 Unknown
GuardCFCheckFunction() {
ret 0x00
}
/* DISPLAY WARNING: Type casts are NOT being printed */
void GuardCFCheckFunction(void)
{
return;
}
0x140008AFD jmp_msvcrt.memcpy str 0 api 1 imm 0 Unknown
jmp_msvcrt.memcpy() {
jmp [msvcrt.memcpy]
}
/* DISPLAY WARNING: Type casts are NOT being printed */
void jmp_msvcrt.memcpy(void)
{
/* WARNING: Treating indirect jump as call */
(*msvcrt.memcpy)();
return;
}
0x140008B09 jmp_msvcrt.memset str 0 api 1 imm 0 Unknown
jmp_msvcrt.memset() {
jmp [msvcrt.memset]
}
/* DISPLAY WARNING: Type casts are NOT being printed */
void jmp_msvcrt.memset(void)
{
/* WARNING: Treating indirect jump as call */
(*msvcrt.memset)();
return;
}
0x140008B20 GuardCFDispatchFunction str 0 api 1 imm 0 Unknown
GuardCFDispatchFunction() {
jmp rax
}
/* DISPLAY WARNING: Type casts are NOT being printed */
void GuardCFDispatchFunction(void)
{
code *UNRECOVERED_JUMPTABLE;
/* WARNING: Could not recover jumptable at 0x000140008b20. Too many branches */
/* WARNING: Treating indirect jump as call */
(*UNRECOVERED_JUMPTABLE)();
return;
}
0x140008470 sub_140008470 str 0 api 0 imm 3 Unknown
sub_140008470() {
cmp rcx, [0x14000C008]
jnz .2
rol rcx, 0x10
test cx, 0xFFFF
jnz .1
ret
.1:
ror rcx, 0x10
.2:
jmp sub_1400084d0()
}
/* DISPLAY WARNING: Type casts are NOT being printed */
void sub_140008470(int64_t param_1)
{
undefined8 uVar1;
int64_t iVar2;
undefined8 uStack_38;
undefined auStack_30 [8];
undefined auStack_28 [8];
int64_t iStack_20;
undefined8 uStack_18;
if ((param_1 == [0x0x14000c008#SecurityCookie]) && (param_1 >> 0x30 == 0)) {
return;
}
(*kernel32.RtlCaptureContext)(0x14000c2f0);
uVar1 = [0x0x14000c3e8];
iVar2 = (*kernel32.RtlLookupFunctionEntry)([0x0x14000c3e8], &uStack_38, 0);
if (iVar2 == 0) {
000000014000c3e8 = *0x14000c388;
puRam000000014000c388 = 0x14000c388 + 1;
}
else {
(*kernel32.RtlVirtualUnwind)(0, uStack_38, uVar1, iVar2, 0x14000c2f0, auStack_28, auStack_30, 0);
}
[0x0x14000c260] = [0x0x14000c3e8];
[0x0x14000c250] = 0xc0000409;
[0x0x14000c254] = 1;
[0x0x14000c268] = 3;
[0x0x14000c270] = 2;
[0x0x14000c278] = [0x0x14000c008#SecurityCookie];
[0x0x14000c280] = [0x0x14000c010];
iStack_20 = [0x0x14000c008#SecurityCookie];
uStack_18 = [0x0x14000c010];
000000014000c370 = param_1;
sub_140008494(0x140009000);
return;
}
0x140008A78 sub_140008a78 str 0 api 0 imm 3 Unknown
sub_140008a78() {
sub rsp, 0x28
mov r8, [r9+0x38]
mov rcx, rdx
mov rdx, r9
call sub_140008a9c()
mov eax, 0x01
add rsp, 0x28
ret
}
/* DISPLAY WARNING: Type casts are NOT being printed */
undefined8 sub_140008a78(undefined8 param_1,undefined8 param_2,undefined8 param_3,int64_t param_4)
{
sub_140008a9c(param_2, param_4, *(param_4 + 0x38));
return 1;
}
No library functions identified.