Loading ...

Play interactive tourEdit tour

Windows Analysis Report ilnQNBU7NA.exe

Overview

General Information

Sample Name:ilnQNBU7NA.exe
Analysis ID:491982
MD5:76449275538d7041bebeeedf2ab75b1d
SHA1:6dc592eb5c639f79e67d7e1d45b03d15c703ea08
SHA256:bb47883b9a0e02bc3f3df2605176307900ea804ffa9698e35f93ea4909b28dbe
Tags:exe
Infos:

Most interesting Screenshot:

Detection

Score:24
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Machine Learning detection for sample
Uses 32bit PE files
Sample file is different than original file name gathered from version info
PE file contains an invalid checksum
PE file contains strange resources
Contains functionality to shutdown / reboot the system
Detected potential crypto function
Program does not show much activity (idle)
Contains functionality for read data from the clipboard

Classification

Process Tree

  • System is w10x64
  • ilnQNBU7NA.exe (PID: 6316 cmdline: 'C:\Users\user\Desktop\ilnQNBU7NA.exe' MD5: 76449275538D7041BEBEEEDF2AB75B1D)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

barindex
Machine Learning detection for sampleShow sources
Source: ilnQNBU7NA.exeJoe Sandbox ML: detected
Source: ilnQNBU7NA.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: ilnQNBU7NA.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: C:\Users\user\Desktop\ilnQNBU7NA.exeCode function: 1_2_0040646B FindFirstFileA,FindClose,1_2_0040646B
Source: C:\Users\user\Desktop\ilnQNBU7NA.exeCode function: 1_2_004027A1 FindFirstFileA,1_2_004027A1
Source: C:\Users\user\Desktop\ilnQNBU7NA.exeCode function: 1_2_004058BF GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,1_2_004058BF
Source: ilnQNBU7NA.exeString found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: ilnQNBU7NA.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: C:\Users\user\Desktop\ilnQNBU7NA.exeCode function: 1_2_0040535C GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,1_2_0040535C
Source: ilnQNBU7NA.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: ilnQNBU7NA.exe, 00000001.00000000.244825608.0000000000438000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamepestudio.exe2 vs ilnQNBU7NA.exe
Source: ilnQNBU7NA.exeBinary or memory string: OriginalFilenamepestudio.exe2 vs ilnQNBU7NA.exe
Source: ilnQNBU7NA.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C:\Users\user\Desktop\ilnQNBU7NA.exeCode function: 1_2_00403348 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,1_2_00403348
Source: C:\Users\user\Desktop\ilnQNBU7NA.exeCode function: 1_2_004069451_2_00406945
Source: C:\Users\user\Desktop\ilnQNBU7NA.exeCode function: 1_2_0040711C1_2_0040711C
Source: C:\Users\user\Desktop\ilnQNBU7NA.exeFile read: C:\Users\user\Desktop\ilnQNBU7NA.exeJump to behavior
Source: ilnQNBU7NA.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\ilnQNBU7NA.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\ilnQNBU7NA.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: C:\Users\user\Desktop\ilnQNBU7NA.exeCode function: 1_2_00403348 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,1_2_00403348
Source: C:\Users\user\Desktop\ilnQNBU7NA.exeFile created: C:\Users\user\AppData\Local\Temp\nsf5E6D.tmpJump to behavior
Source: classification engineClassification label: sus24.winEXE@1/0@0/0
Source: C:\Users\user\Desktop\ilnQNBU7NA.exeCode function: 1_2_0040216B CoCreateInstance,MultiByteToWideChar,1_2_0040216B
Source: C:\Users\user\Desktop\ilnQNBU7NA.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\ilnQNBU7NA.exeCode function: 1_2_0040460D GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,1_2_0040460D
Source: ilnQNBU7NA.exeStatic file information: File size 3333764 > 1048576
Source: ilnQNBU7NA.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: ilnQNBU7NA.exeStatic PE information: real checksum: 0x502be1 should be: 0x33a921
Source: C:\Users\user\Desktop\ilnQNBU7NA.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\ilnQNBU7NA.exeCode function: 1_2_0040646B FindFirstFileA,FindClose,1_2_0040646B
Source: C:\Users\user\Desktop\ilnQNBU7NA.exeCode function: 1_2_004027A1 FindFirstFileA,1_2_004027A1
Source: C:\Users\user\Desktop\ilnQNBU7NA.exeCode function: 1_2_004058BF GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,1_2_004058BF
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\ilnQNBU7NA.exeCode function: 1_2_00403348 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,1_2_00403348

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationPath InterceptionAccess Token Manipulation1Access Token Manipulation1OS Credential DumpingFile and Directory Discovery2Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationSystem Shutdown/Reboot1
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemorySystem Information Discovery4Remote Desktop ProtocolClipboard Data1Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
ilnQNBU7NA.exe9%ReversingLabs
ilnQNBU7NA.exe100%Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

SourceDetectionScannerLabelLinkDownload
1.2.ilnQNBU7NA.exe.400000.0.unpack100%AviraHEUR/AGEN.1130366Download File
1.0.ilnQNBU7NA.exe.400000.0.unpack100%AviraHEUR/AGEN.1130366Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://nsis.sf.net/NSIS_ErrorilnQNBU7NA.exefalse
    high
    http://nsis.sf.net/NSIS_ErrorErrorilnQNBU7NA.exefalse
      high

      Contacted IPs

      No contacted IP infos

      General Information

      Joe Sandbox Version:33.0.0 White Diamond
      Analysis ID:491982
      Start date:28.09.2021
      Start time:08:42:00
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 5m 11s
      Hypervisor based Inspection enabled:false
      Report type:full
      Sample file name:ilnQNBU7NA.exe
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
      Number of analysed new started processes analysed:22
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • HDC enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Detection:SUS
      Classification:sus24.winEXE@1/0@0/0
      EGA Information:Failed
      HDC Information:
      • Successful, ratio: 100% (good quality ratio 96.5%)
      • Quality average: 83.3%
      • Quality standard deviation: 25%
      HCA Information:Failed
      Cookbook Comments:
      • Adjust boot time
      • Enable AMSI
      • Found application associated with file extension: .exe
      Warnings:
      Show All
      • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
      • Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.211.4.86, 20.50.102.62, 40.112.88.60, 20.82.210.154, 80.67.82.211, 80.67.82.235
      • Excluded domains from analysis (whitelisted): fs.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, store-images.s-microsoft.com, arc.trafficmanager.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net
      • Not all processes where analyzed, report is missing behavior information
      • VT rate limit hit for: /opt/package/joesandbox/database/analysis/491982/sample/ilnQNBU7NA.exe

      Simulations

      Behavior and APIs

      No simulations

      Joe Sandbox View / Context

      IPs

      No context

      Domains

      No context

      ASN

      No context

      JA3 Fingerprints

      No context

      Dropped Files

      No context

      Created / dropped Files

      No created / dropped files found

      Static File Info

      General

      File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
      Entropy (8bit):7.982776725752498
      TrID:
      • Win32 Executable (generic) a (10002005/4) 99.96%
      • Generic Win/DOS Executable (2004/3) 0.02%
      • DOS Executable Generic (2002/1) 0.02%
      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
      File name:ilnQNBU7NA.exe
      File size:3333764
      MD5:76449275538d7041bebeeedf2ab75b1d
      SHA1:6dc592eb5c639f79e67d7e1d45b03d15c703ea08
      SHA256:bb47883b9a0e02bc3f3df2605176307900ea804ffa9698e35f93ea4909b28dbe
      SHA512:935df085c9cc9f04bb7f81051c9f23dbf6614d6a29f8fd13943caac046a3410c562bbad99bdaec50ca7cb1198ce81a9eddbedad7528793e4fb5f58ba18ce5bdc
      SSDEEP:98304:MNwTt3NIxtu9rEjIl7HTelXboTTTncIcTqHSgr+i:zxdInu5EOHTgrmPcIcGygr9
      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG.*_...PG..PF.IPG.*_...PG..sw..PG..VA..PG.Rich.PG.........PE..L...".$_.................f..........H3............@

      File Icon

      Icon Hash:eccce4d6d2f0a7a3

      Static PE Info

      General

      Entrypoint:0x403348
      Entrypoint Section:.text
      Digitally signed:false
      Imagebase:0x400000
      Subsystem:windows gui
      Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
      Time Stamp:0x5F24D722 [Sat Aug 1 02:44:50 2020 UTC]
      TLS Callbacks:
      CLR (.Net) Version:
      OS Version Major:4
      OS Version Minor:0
      File Version Major:4
      File Version Minor:0
      Subsystem Version Major:4
      Subsystem Version Minor:0
      Import Hash:ced282d9b261d1462772017fe2f6972b

      Entrypoint Preview

      Instruction
      sub esp, 00000184h
      push ebx
      push esi
      push edi
      xor ebx, ebx
      push 00008001h
      mov dword ptr [esp+18h], ebx
      mov dword ptr [esp+10h], 0040A198h
      mov dword ptr [esp+20h], ebx
      mov byte ptr [esp+14h], 00000020h
      call dword ptr [004080B8h]
      call dword ptr [004080BCh]
      and eax, BFFFFFFFh
      cmp ax, 00000006h
      mov dword ptr [0042F42Ch], eax
      je 00007F0AC4CA8873h
      push ebx
      call 00007F0AC4CAB9D6h
      cmp eax, ebx
      je 00007F0AC4CA8869h
      push 00000C00h
      call eax
      mov esi, 004082A0h
      push esi
      call 00007F0AC4CAB952h
      push esi
      call dword ptr [004080CCh]
      lea esi, dword ptr [esi+eax+01h]
      cmp byte ptr [esi], bl
      jne 00007F0AC4CA884Dh
      push 0000000Bh
      call 00007F0AC4CAB9AAh
      push 00000009h
      call 00007F0AC4CAB9A3h
      push 00000007h
      mov dword ptr [0042F424h], eax
      call 00007F0AC4CAB997h
      cmp eax, ebx
      je 00007F0AC4CA8871h
      push 0000001Eh
      call eax
      test eax, eax
      je 00007F0AC4CA8869h
      or byte ptr [0042F42Fh], 00000040h
      push ebp
      call dword ptr [00408038h]
      push ebx
      call dword ptr [00408288h]
      mov dword ptr [0042F4F8h], eax
      push ebx
      lea eax, dword ptr [esp+38h]
      push 00000160h
      push eax
      push ebx
      push 00429850h
      call dword ptr [0040816Ch]
      push 0040A188h

      Rich Headers

      Programming Language:
      • [EXP] VC++ 6.0 SP5 build 8804

      Data Directories

      NameVirtual AddressVirtual Size Is in Section
      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IMPORT0x85440xa0.rdata
      IMAGE_DIRECTORY_ENTRY_RESOURCE0x380000x19b44.rsrc
      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IAT0x80000x29c.rdata
      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

      Sections

      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
      .text0x10000x64570x6600False0.66823682598data6.43498570321IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      .rdata0x80000x13800x1400False0.4625data5.26100389731IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
      .data0xa0000x255380x600False0.463541666667data4.133728555IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
      .ndata0x300000x80000x0False0empty0.0IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
      .rsrc0x380000x19b440x19c00False0.330040200243data5.57673300046IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

      Resources

      NameRVASizeTypeLanguageCountry
      RT_ICON0x382c80x10828dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 33554432, next used block 16777216EnglishUnited States
      RT_ICON0x48af00x4228dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 4177526783, next used block 4294901760EnglishUnited States
      RT_ICON0x4cd180x25a8dataEnglishUnited States
      RT_ICON0x4f2c00x10a8dataEnglishUnited States
      RT_ICON0x503680x988dataEnglishUnited States
      RT_ICON0x50cf00x468GLS_BINARY_LSB_FIRSTEnglishUnited States
      RT_DIALOG0x511580x100dataEnglishUnited States
      RT_DIALOG0x512580x11cdataEnglishUnited States
      RT_DIALOG0x513740x60dataEnglishUnited States
      RT_GROUP_ICON0x513d40x5adataEnglishUnited States
      RT_VERSION0x514300x3d4dataEnglishUnited States
      RT_MANIFEST0x518040x340XML 1.0 document, ASCII text, with very long lines, with no line terminatorsEnglishUnited States

      Imports

      DLLImport
      ADVAPI32.dllRegCreateKeyExA, RegEnumKeyA, RegQueryValueExA, RegSetValueExA, RegCloseKey, RegDeleteValueA, RegDeleteKeyA, AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken, SetFileSecurityA, RegOpenKeyExA, RegEnumValueA
      SHELL32.dllSHGetFileInfoA, SHFileOperationA, SHGetPathFromIDListA, ShellExecuteExA, SHGetSpecialFolderLocation, SHBrowseForFolderA
      ole32.dllIIDFromString, OleInitialize, OleUninitialize, CoCreateInstance, CoTaskMemFree
      COMCTL32.dllImageList_Create, ImageList_Destroy, ImageList_AddMasked
      USER32.dllSetClipboardData, CharPrevA, CallWindowProcA, PeekMessageA, DispatchMessageA, MessageBoxIndirectA, GetDlgItemTextA, SetDlgItemTextA, GetSystemMetrics, CreatePopupMenu, AppendMenuA, TrackPopupMenu, FillRect, EmptyClipboard, LoadCursorA, GetMessagePos, CheckDlgButton, GetSysColor, SetCursor, GetWindowLongA, SetClassLongA, SetWindowPos, IsWindowEnabled, GetWindowRect, GetSystemMenu, EnableMenuItem, RegisterClassA, ScreenToClient, EndDialog, GetClassInfoA, SystemParametersInfoA, CreateWindowExA, ExitWindowsEx, DialogBoxParamA, CharNextA, SetTimer, DestroyWindow, CreateDialogParamA, SetForegroundWindow, SetWindowTextA, PostQuitMessage, SendMessageTimeoutA, ShowWindow, wsprintfA, GetDlgItem, FindWindowExA, IsWindow, GetDC, SetWindowLongA, LoadImageA, InvalidateRect, ReleaseDC, EnableWindow, BeginPaint, SendMessageA, DefWindowProcA, DrawTextA, GetClientRect, EndPaint, IsWindowVisible, CloseClipboard, OpenClipboard
      GDI32.dllSetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectA, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
      KERNEL32.dllGetExitCodeProcess, WaitForSingleObject, GetProcAddress, GetSystemDirectoryA, WideCharToMultiByte, MoveFileExA, ReadFile, GetTempFileNameA, WriteFile, RemoveDirectoryA, CreateProcessA, CreateFileA, GetLastError, CreateThread, CreateDirectoryA, GlobalUnlock, GetDiskFreeSpaceA, GlobalLock, SetErrorMode, GetVersion, lstrcpynA, GetCommandLineA, GetTempPathA, lstrlenA, SetEnvironmentVariableA, ExitProcess, GetWindowsDirectoryA, GetCurrentProcess, GetModuleFileNameA, CopyFileA, GetTickCount, Sleep, GetFileSize, GetFileAttributesA, SetCurrentDirectoryA, SetFileAttributesA, GetFullPathNameA, GetShortPathNameA, MoveFileA, CompareFileTime, SetFileTime, SearchPathA, lstrcmpiA, lstrcmpA, CloseHandle, GlobalFree, GlobalAlloc, ExpandEnvironmentStringsA, LoadLibraryExA, FreeLibrary, lstrcpyA, lstrcatA, FindClose, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, SetFilePointer, GetModuleHandleA, FindNextFileA, FindFirstFileA, DeleteFileA, MulDiv

      Version Infos

      DescriptionData
      LegalCopyrightCopyright 2009-2018 Marc Ochsenmeier
      InternalNamepestudio.exe
      FileVersion8, 81, 0, 0
      CompanyNamewww.winitor.com
      LegalTrademarkswww.winitor.com
      CommentsMalware Initial Assessment
      ProductNamepestudio
      ProductVersion8, 81, 0, 0
      FileDescriptionMalware Initial Assessment - www.winitor.com
      OriginalFilenamepestudio.exe
      Translation0x0000 0x04b0

      Possible Origin

      Language of compilation systemCountry where language is spokenMap
      EnglishUnited States

      Network Behavior

      Network Port Distribution

      UDP Packets

      TimestampSource PortDest PortSource IPDest IP
      Sep 28, 2021 08:42:53.684315920 CEST6206053192.168.2.58.8.8.8
      Sep 28, 2021 08:42:53.719696045 CEST53620608.8.8.8192.168.2.5
      Sep 28, 2021 08:43:08.279125929 CEST6180553192.168.2.58.8.8.8
      Sep 28, 2021 08:43:08.300370932 CEST53618058.8.8.8192.168.2.5
      Sep 28, 2021 08:43:25.203932047 CEST5479553192.168.2.58.8.8.8
      Sep 28, 2021 08:43:25.237371922 CEST53547958.8.8.8192.168.2.5
      Sep 28, 2021 08:43:42.366636038 CEST4955753192.168.2.58.8.8.8
      Sep 28, 2021 08:43:42.398636103 CEST53495578.8.8.8192.168.2.5
      Sep 28, 2021 08:43:59.870799065 CEST6173353192.168.2.58.8.8.8
      Sep 28, 2021 08:43:59.890093088 CEST53617338.8.8.8192.168.2.5
      Sep 28, 2021 08:44:06.138354063 CEST6544753192.168.2.58.8.8.8
      Sep 28, 2021 08:44:06.159024000 CEST53654478.8.8.8192.168.2.5
      Sep 28, 2021 08:44:35.627495050 CEST5244153192.168.2.58.8.8.8
      Sep 28, 2021 08:44:35.661778927 CEST53524418.8.8.8192.168.2.5
      Sep 28, 2021 08:44:37.902513981 CEST6217653192.168.2.58.8.8.8
      Sep 28, 2021 08:44:37.931077003 CEST53621768.8.8.8192.168.2.5

      Code Manipulations

      Statistics

      CPU Usage

      Click to jump to process

      Memory Usage

      Click to jump to process

      System Behavior

      General

      Start time:08:42:58
      Start date:28/09/2021
      Path:C:\Users\user\Desktop\ilnQNBU7NA.exe
      Wow64 process (32bit):true
      Commandline:'C:\Users\user\Desktop\ilnQNBU7NA.exe'
      Imagebase:0x400000
      File size:3333764 bytes
      MD5 hash:76449275538D7041BEBEEEDF2AB75B1D
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:C, C++ or other language
      Reputation:low

      Disassembly

      Code Analysis

      Reset < >

        Executed Functions

        C-Code - Quality: 86%
        			_entry_() {
        				signed int _t42;
        				intOrPtr* _t47;
        				CHAR* _t51;
        				char* _t53;
        				CHAR* _t55;
        				void* _t59;
        				intOrPtr _t61;
        				int _t63;
        				int _t66;
        				signed int _t67;
        				int _t68;
        				signed int _t70;
        				void* _t94;
        				signed int _t110;
        				void* _t113;
        				void* _t118;
        				intOrPtr* _t119;
        				char _t122;
        				signed int _t141;
        				signed int _t142;
        				int _t150;
        				void* _t151;
        				intOrPtr* _t153;
        				CHAR* _t156;
        				CHAR* _t157;
        				void* _t159;
        				char* _t160;
        				void* _t163;
        				void* _t164;
        				intOrPtr _t189;
        
        				 *(_t164 + 0x18) = 0;
        				 *((intOrPtr*)(_t164 + 0x10)) = "Error writing temporary file. Make sure your temp folder is valid.";
        				 *(_t164 + 0x20) = 0;
        				 *(_t164 + 0x14) = 0x20;
        				SetErrorMode(0x8001); // executed
        				_t42 = GetVersion() & 0xbfffffff;
        				 *0x42f42c = _t42;
        				if(_t42 != 6) {
        					_t119 = E00406500(0);
        					if(_t119 != 0) {
        						 *_t119(0xc00);
        					}
        				}
        				_t156 = "UXTHEME";
        				do {
        					E00406492(_t156); // executed
        					_t156 =  &(_t156[lstrlenA(_t156) + 1]);
        				} while ( *_t156 != 0);
        				E00406500(0xb);
        				 *0x42f424 = E00406500(9);
        				_t47 = E00406500(7);
        				if(_t47 != 0) {
        					_t47 =  *_t47(0x1e);
        					if(_t47 != 0) {
        						 *0x42f42f =  *0x42f42f | 0x00000040;
        					}
        				}
        				__imp__#17(_t159);
        				__imp__OleInitialize(0); // executed
        				 *0x42f4f8 = _t47;
        				SHGetFileInfoA(0x429850, 0, _t164 + 0x38, 0x160, 0); // executed
        				E004060F7(0x42ec20, "NSIS Error");
        				_t51 = GetCommandLineA();
        				_t160 = "\"C:\\Users\\alfons\\Desktop\\ilnQNBU7NA.exe\" ";
        				E004060F7(_t160, _t51);
        				 *0x42f420 = 0x400000;
        				_t53 = _t160;
        				if("\"C:\\Users\\alfons\\Desktop\\ilnQNBU7NA.exe\" " == 0x22) {
        					 *(_t164 + 0x14) = 0x22;
        					_t53 =  &M00435001;
        				}
        				_t55 = CharNextA(E00405ABA(_t53,  *(_t164 + 0x14)));
        				 *(_t164 + 0x1c) = _t55;
        				while(1) {
        					_t122 =  *_t55;
        					_t172 = _t122;
        					if(_t122 == 0) {
        						break;
        					}
        					__eflags = _t122 - 0x20;
        					if(_t122 != 0x20) {
        						L13:
        						__eflags =  *_t55 - 0x22;
        						 *(_t164 + 0x14) = 0x20;
        						if( *_t55 == 0x22) {
        							_t55 =  &(_t55[1]);
        							__eflags = _t55;
        							 *(_t164 + 0x14) = 0x22;
        						}
        						__eflags =  *_t55 - 0x2f;
        						if( *_t55 != 0x2f) {
        							L25:
        							_t55 = E00405ABA(_t55,  *(_t164 + 0x14));
        							__eflags =  *_t55 - 0x22;
        							if(__eflags == 0) {
        								_t55 =  &(_t55[1]);
        								__eflags = _t55;
        							}
        							continue;
        						} else {
        							_t55 =  &(_t55[1]);
        							__eflags =  *_t55 - 0x53;
        							if( *_t55 != 0x53) {
        								L20:
        								__eflags =  *_t55 - ((( *0x40a183 << 0x00000008 |  *0x40a182) << 0x00000008 |  *0x40a181) << 0x00000008 | "NCRC");
        								if( *_t55 != ((( *0x40a183 << 0x00000008 |  *0x40a182) << 0x00000008 |  *0x40a181) << 0x00000008 | "NCRC")) {
        									L24:
        									__eflags =  *((intOrPtr*)(_t55 - 2)) - ((( *0x40a17b << 0x00000008 |  *0x40a17a) << 0x00000008 |  *0x40a179) << 0x00000008 | " /D=");
        									if( *((intOrPtr*)(_t55 - 2)) == ((( *0x40a17b << 0x00000008 |  *0x40a17a) << 0x00000008 |  *0x40a179) << 0x00000008 | " /D=")) {
        										 *((char*)(_t55 - 2)) = 0;
        										__eflags =  &(_t55[2]);
        										E004060F7(0x435400,  &(_t55[2]));
        										L30:
        										_t157 = "C:\\Users\\alfons\\AppData\\Local\\Temp\\";
        										GetTempPathA(0x400, _t157);
        										_t59 = E00403317(_t172);
        										_t173 = _t59;
        										if(_t59 != 0) {
        											L33:
        											DeleteFileA("C:\\Users\\alfons\\AppData\\Local\\Temp\\nsf5E6D.tmp"); // executed
        											_t61 = E00402EA1(_t175,  *(_t164 + 0x20)); // executed
        											 *((intOrPtr*)(_t164 + 0x10)) = _t61;
        											if(_t61 != 0) {
        												L43:
        												E00403830(); // executed
        												__imp__OleUninitialize(); // executed
        												_t185 =  *((intOrPtr*)(_t164 + 0x10));
        												if( *((intOrPtr*)(_t164 + 0x10)) == 0) {
        													__eflags =  *0x42f4d4;
        													if( *0x42f4d4 == 0) {
        														L67:
        														_t63 =  *0x42f4ec;
        														__eflags = _t63 - 0xffffffff;
        														if(_t63 != 0xffffffff) {
        															 *(_t164 + 0x14) = _t63;
        														}
        														ExitProcess( *(_t164 + 0x14));
        													}
        													_t66 = OpenProcessToken(GetCurrentProcess(), 0x28, _t164 + 0x18);
        													__eflags = _t66;
        													_t150 = 2;
        													if(_t66 != 0) {
        														LookupPrivilegeValueA(0, "SeShutdownPrivilege", _t164 + 0x24);
        														 *(_t164 + 0x38) = 1;
        														 *(_t164 + 0x44) = _t150;
        														AdjustTokenPrivileges( *(_t164 + 0x2c), 0, _t164 + 0x28, 0, 0, 0);
        													}
        													_t67 = E00406500(4);
        													__eflags = _t67;
        													if(_t67 == 0) {
        														L65:
        														_t68 = ExitWindowsEx(_t150, 0x80040002);
        														__eflags = _t68;
        														if(_t68 != 0) {
        															goto L67;
        														}
        														goto L66;
        													} else {
        														_t70 =  *_t67(0, 0, 0, 0x25, 0x80040002);
        														__eflags = _t70;
        														if(_t70 == 0) {
        															L66:
        															E0040140B(9);
        															goto L67;
        														}
        														goto L65;
        													}
        												}
        												E00405813( *((intOrPtr*)(_t164 + 0x10)), 0x200010);
        												ExitProcess(2); // executed
        											}
        											if( *0x42f440 == 0) {
        												L42:
        												 *0x42f4ec =  *0x42f4ec | 0xffffffff;
        												 *(_t164 + 0x18) = E0040390A( *0x42f4ec);
        												goto L43;
        											}
        											_t153 = E00405ABA(_t160, 0);
        											if(_t153 < _t160) {
        												L39:
        												_t182 = _t153 - _t160;
        												 *((intOrPtr*)(_t164 + 0x10)) = "Error launching installer";
        												if(_t153 < _t160) {
        													_t151 = E0040577E(_t185);
        													lstrcatA(_t157, "~nsu");
        													if(_t151 != 0) {
        														lstrcatA(_t157, "A");
        													}
        													lstrcatA(_t157, ".tmp");
        													_t162 = "C:\\Users\\alfons\\Desktop";
        													if(lstrcmpiA(_t157, "C:\\Users\\alfons\\Desktop") != 0) {
        														_push(_t157);
        														if(_t151 == 0) {
        															E00405761();
        														} else {
        															E004056E4();
        														}
        														SetCurrentDirectoryA(_t157);
        														_t189 =  *0x435400; // 0x0
        														if(_t189 == 0) {
        															E004060F7(0x435400, _t162);
        														}
        														E004060F7(0x430000,  *(_t164 + 0x1c));
        														_t137 = "A";
        														_t163 = 0x1a;
        														 *0x430400 = "A";
        														do {
        															E0040618A(0, 0x429450, _t157, 0x429450,  *((intOrPtr*)( *0x42f434 + 0x120)));
        															DeleteFileA(0x429450);
        															if( *((intOrPtr*)(_t164 + 0x10)) != 0 && CopyFileA("C:\\Users\\alfons\\Desktop\\ilnQNBU7NA.exe", 0x429450, 1) != 0) {
        																E00405ED6(_t137, 0x429450, 0);
        																E0040618A(0, 0x429450, _t157, 0x429450,  *((intOrPtr*)( *0x42f434 + 0x124)));
        																_t94 = E00405796(0x429450);
        																if(_t94 != 0) {
        																	CloseHandle(_t94);
        																	 *((intOrPtr*)(_t164 + 0x10)) = 0;
        																}
        															}
        															 *0x430400 =  *0x430400 + 1;
        															_t163 = _t163 - 1;
        														} while (_t163 != 0);
        														E00405ED6(_t137, _t157, 0);
        													}
        													goto L43;
        												}
        												 *_t153 = 0;
        												_t154 = _t153 + 4;
        												if(E00405B7D(_t182, _t153 + 4) == 0) {
        													goto L43;
        												}
        												E004060F7(0x435400, _t154);
        												E004060F7(0x435800, _t154);
        												 *((intOrPtr*)(_t164 + 0x10)) = 0;
        												goto L42;
        											}
        											_t110 = (( *0x40a15b << 0x00000008 |  *0x40a15a) << 0x00000008 |  *0x40a159) << 0x00000008 | " _?=";
        											while( *_t153 != _t110) {
        												_t153 = _t153 - 1;
        												if(_t153 >= _t160) {
        													continue;
        												}
        												goto L39;
        											}
        											goto L39;
        										}
        										GetWindowsDirectoryA(_t157, 0x3fb);
        										lstrcatA(_t157, "\\Temp");
        										_t113 = E00403317(_t173);
        										_t174 = _t113;
        										if(_t113 != 0) {
        											goto L33;
        										}
        										GetTempPathA(0x3fc, _t157);
        										lstrcatA(_t157, "Low");
        										SetEnvironmentVariableA("TEMP", _t157);
        										SetEnvironmentVariableA("TMP", _t157);
        										_t118 = E00403317(_t174);
        										_t175 = _t118;
        										if(_t118 == 0) {
        											goto L43;
        										}
        										goto L33;
        									}
        									goto L25;
        								}
        								_t141 = _t55[4];
        								__eflags = _t141 - 0x20;
        								if(_t141 == 0x20) {
        									L23:
        									_t15 = _t164 + 0x20;
        									 *_t15 =  *(_t164 + 0x20) | 0x00000004;
        									__eflags =  *_t15;
        									goto L24;
        								}
        								__eflags = _t141;
        								if(_t141 != 0) {
        									goto L24;
        								}
        								goto L23;
        							}
        							_t142 = _t55[1];
        							__eflags = _t142 - 0x20;
        							if(_t142 == 0x20) {
        								L19:
        								 *0x42f4e0 = 1;
        								goto L20;
        							}
        							__eflags = _t142;
        							if(_t142 != 0) {
        								goto L20;
        							}
        							goto L19;
        						}
        					} else {
        						goto L12;
        					}
        					do {
        						L12:
        						_t55 =  &(_t55[1]);
        						__eflags =  *_t55 - 0x20;
        					} while ( *_t55 == 0x20);
        					goto L13;
        				}
        				goto L30;
        			}

































        0x00403358
        0x0040335c
        0x00403364
        0x00403368
        0x0040336d
        0x00403379
        0x00403382
        0x00403387
        0x0040338a
        0x00403391
        0x00403398
        0x00403398
        0x00403391
        0x0040339a
        0x0040339f
        0x004033a0
        0x004033ac
        0x004033b0
        0x004033b6
        0x004033c4
        0x004033c9
        0x004033d0
        0x004033d4
        0x004033d8
        0x004033da
        0x004033da
        0x004033d8
        0x004033e2
        0x004033e9
        0x004033ef
        0x00403405
        0x00403415
        0x0040341a
        0x00403420
        0x00403427
        0x00403433
        0x0040343d
        0x0040343f
        0x00403441
        0x00403446
        0x00403446
        0x00403456
        0x0040345c
        0x00403525
        0x00403525
        0x00403527
        0x00403529
        0x00000000
        0x00000000
        0x00403465
        0x00403468
        0x00403470
        0x00403470
        0x00403473
        0x00403478
        0x0040347a
        0x0040347a
        0x0040347b
        0x0040347b
        0x00403480
        0x00403483
        0x00403515
        0x0040351a
        0x0040351f
        0x00403522
        0x00403524
        0x00403524
        0x00403524
        0x00000000
        0x00403489
        0x00403489
        0x0040348a
        0x0040348d
        0x004034a5
        0x004034d0
        0x004034d2
        0x004034e5
        0x00403510
        0x00403513
        0x00403531
        0x00403534
        0x0040353d
        0x00403542
        0x00403548
        0x00403553
        0x00403555
        0x0040355a
        0x0040355c
        0x004035b4
        0x004035b9
        0x004035c3
        0x004035ca
        0x004035ce
        0x00403662
        0x00403662
        0x00403667
        0x0040366d
        0x00403672
        0x00403796
        0x0040379c
        0x00403818
        0x00403818
        0x0040381d
        0x00403820
        0x00403822
        0x00403822
        0x0040382a
        0x0040382a
        0x004037ac
        0x004037b4
        0x004037b6
        0x004037b7
        0x004037c4
        0x004037d7
        0x004037df
        0x004037e3
        0x004037e3
        0x004037eb
        0x004037f0
        0x004037f7
        0x00403805
        0x00403807
        0x0040380d
        0x0040380f
        0x00000000
        0x00000000
        0x00000000
        0x004037f9
        0x004037ff
        0x00403801
        0x00403803
        0x00403811
        0x00403813
        0x00000000
        0x00403813
        0x00000000
        0x00403803
        0x004037f7
        0x00403681
        0x00403688
        0x00403688
        0x004035da
        0x00403652
        0x00403652
        0x0040365e
        0x00000000
        0x0040365e
        0x004035e3
        0x004035e7
        0x0040361d
        0x0040361d
        0x0040361f
        0x00403627
        0x00403699
        0x0040369b
        0x004036a2
        0x004036aa
        0x004036aa
        0x004036b5
        0x004036ba
        0x004036c9
        0x004036cd
        0x004036ce
        0x004036d7
        0x004036d0
        0x004036d0
        0x004036d0
        0x004036dd
        0x004036e3
        0x004036e9
        0x004036f1
        0x004036f1
        0x004036ff
        0x00403704
        0x00403716
        0x0040371e
        0x00403724
        0x00403730
        0x00403736
        0x00403740
        0x00403756
        0x00403767
        0x0040376d
        0x00403774
        0x00403777
        0x0040377d
        0x0040377d
        0x00403774
        0x00403781
        0x00403787
        0x00403787
        0x0040378c
        0x0040378c
        0x00000000
        0x004036c9
        0x00403629
        0x0040362b
        0x00403636
        0x00000000
        0x00000000
        0x0040363e
        0x00403649
        0x0040364e
        0x00000000
        0x0040364e
        0x00403612
        0x00403614
        0x00403618
        0x0040361b
        0x00000000
        0x00000000
        0x00000000
        0x0040361b
        0x00000000
        0x00403614
        0x00403564
        0x00403570
        0x00403575
        0x0040357a
        0x0040357c
        0x00000000
        0x00000000
        0x00403584
        0x0040358c
        0x0040359d
        0x004035a5
        0x004035a7
        0x004035ac
        0x004035ae
        0x00000000
        0x00000000
        0x00000000
        0x004035ae
        0x00000000
        0x00403513
        0x004034d4
        0x004034d7
        0x004034da
        0x004034e0
        0x004034e0
        0x004034e0
        0x004034e0
        0x00000000
        0x004034e0
        0x004034dc
        0x004034de
        0x00000000
        0x00000000
        0x00000000
        0x004034de
        0x0040348f
        0x00403492
        0x00403495
        0x0040349b
        0x0040349b
        0x00000000
        0x0040349b
        0x00403497
        0x00403499
        0x00000000
        0x00000000
        0x00000000
        0x00403499
        0x00000000
        0x00000000
        0x00000000
        0x0040346a
        0x0040346a
        0x0040346a
        0x0040346b
        0x0040346b
        0x00000000
        0x0040346a
        0x00000000

        APIs
        • SetErrorMode.KERNELBASE ref: 0040336D
        • GetVersion.KERNEL32 ref: 00403373
        • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033A6
        • #17.COMCTL32(?,00000007,00000009,0000000B), ref: 004033E2
        • OleInitialize.OLE32(00000000), ref: 004033E9
        • SHGetFileInfoA.SHELL32(00429850,00000000,?,00000160,00000000,?,00000007,00000009,0000000B), ref: 00403405
        • GetCommandLineA.KERNEL32(0042EC20,NSIS Error,?,00000007,00000009,0000000B), ref: 0040341A
        • CharNextA.USER32(00000000,"C:\Users\user\Desktop\ilnQNBU7NA.exe" ,00000020,"C:\Users\user\Desktop\ilnQNBU7NA.exe" ,00000000,?,00000007,00000009,0000000B), ref: 00403456
        • GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000007,00000009,0000000B), ref: 00403553
        • GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000007,00000009,0000000B), ref: 00403564
        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 00403570
        • GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 00403584
        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 0040358C
        • SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 0040359D
        • SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 004035A5
        • DeleteFileA.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsf5E6D.tmp,?,00000007,00000009,0000000B), ref: 004035B9
          • Part of subcall function 00406500: GetModuleHandleA.KERNEL32(?,?,?,004033BB,0000000B), ref: 00406512
          • Part of subcall function 00406500: GetProcAddress.KERNEL32(00000000,?), ref: 0040652D
          • Part of subcall function 0040390A: lstrlenA.KERNEL32(0042E3C0,?,?,?,0042E3C0,00000000,00435400,C:\Users\user\AppData\Local\Temp\nsf5E6D.tmp,0042A890,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A890,00000000,00000002,7519FA90), ref: 004039FA
          • Part of subcall function 0040390A: lstrcmpiA.KERNEL32(?,.exe,0042E3C0,?,?,?,0042E3C0,00000000,00435400,C:\Users\user\AppData\Local\Temp\nsf5E6D.tmp,0042A890,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A890,00000000), ref: 00403A0D
          • Part of subcall function 0040390A: GetFileAttributesA.KERNEL32(0042E3C0), ref: 00403A18
          • Part of subcall function 0040390A: LoadImageA.USER32 ref: 00403A61
          • Part of subcall function 0040390A: RegisterClassA.USER32 ref: 00403A9E
          • Part of subcall function 00403830: FindCloseChangeNotification.KERNELBASE(FFFFFFFF,00403667,?,?,00000007,00000009,0000000B), ref: 0040383B
        • OleUninitialize.OLE32(?,?,00000007,00000009,0000000B), ref: 00403667
        • ExitProcess.KERNEL32 ref: 00403688
        • GetCurrentProcess.KERNEL32(00000028,?,00000007,00000009,0000000B), ref: 004037A5
        • OpenProcessToken.ADVAPI32(00000000), ref: 004037AC
        • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004037C4
        • AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 004037E3
        • ExitWindowsEx.USER32 ref: 00403807
        • ExitProcess.KERNEL32 ref: 0040382A
          • Part of subcall function 00405813: MessageBoxIndirectA.USER32 ref: 0040586E
        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: Process$ExitFile$EnvironmentPathTempTokenVariableWindowslstrcatlstrlen$AddressAdjustAttributesChangeCharClassCloseCommandCurrentDeleteDirectoryErrorFindHandleImageIndirectInfoInitializeLineLoadLookupMessageModeModuleNextNotificationOpenPrivilegePrivilegesProcRegisterUninitializeValueVersionlstrcmpi
        • String ID: "$"C:\Users\user\Desktop\ilnQNBU7NA.exe" $.tmp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsf5E6D.tmp$C:\Users\user\Desktop$C:\Users\user\Desktop\ilnQNBU7NA.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
        • API String ID: 3490464366-1424940635
        • Opcode ID: 520eba296a76736c95e98810596d94e1fa3a0794d64f3a9ffa8c42336c5515cb
        • Instruction ID: 2464a3ec660faf4d6335bd380e0cd13b62da1685a36c15adf6e00eeeb0483762
        • Opcode Fuzzy Hash: 520eba296a76736c95e98810596d94e1fa3a0794d64f3a9ffa8c42336c5515cb
        • Instruction Fuzzy Hash: 49C107705047416AD7216F759D89B2F3EACAB4530AF45443FF181BA2E2CB7C8A058B2F
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E00406492(intOrPtr _a4) {
        				char _v292;
        				int _t10;
        				struct HINSTANCE__* _t14;
        				void* _t16;
        				void* _t21;
        
        				_t10 = GetSystemDirectoryA( &_v292, 0x104);
        				if(_t10 > 0x104) {
        					_t10 = 0;
        				}
        				if(_t10 == 0 ||  *((char*)(_t21 + _t10 - 0x121)) == 0x5c) {
        					_t16 = 1;
        				} else {
        					_t16 = 0;
        				}
        				_t5 = _t16 + 0x40a014; // 0x5c
        				wsprintfA(_t21 + _t10 - 0x120, "%s%s.dll", _t5, _a4);
        				_t14 = LoadLibraryExA( &_v292, 0, 8); // executed
        				return _t14;
        			}








        0x004064a9
        0x004064b2
        0x004064b4
        0x004064b4
        0x004064b8
        0x004064ca
        0x004064c4
        0x004064c4
        0x004064c4
        0x004064ce
        0x004064e2
        0x004064f6
        0x004064fd

        APIs
        • GetSystemDirectoryA.KERNEL32 ref: 004064A9
        • wsprintfA.USER32 ref: 004064E2
        • LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 004064F6
        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: DirectoryLibraryLoadSystemwsprintf
        • String ID: %s%s.dll$UXTHEME$\
        • API String ID: 2200240437-4240819195
        • Opcode ID: 265ca81b40b881dab18d3809a90e9c8d4eed5c2f9756e13f598d1e00e091b07b
        • Instruction ID: 03f82d29dddd483449b3488b7c2e1daaa1831c8d2f1a72e13e07ee25955ceb49
        • Opcode Fuzzy Hash: 265ca81b40b881dab18d3809a90e9c8d4eed5c2f9756e13f598d1e00e091b07b
        • Instruction Fuzzy Hash: DDF0213051020A6BDB55D764DD0DFFB375CEB08304F14017AA58AF11C1DA78D5398B6D
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E00405CBF(char _a4, intOrPtr _a6, CHAR* _a8) {
        				char _t11;
        				signed int _t12;
        				int _t15;
        				signed int _t17;
        				void* _t20;
        				CHAR* _t21;
        
        				_t21 = _a4;
        				_t20 = 0x64;
        				while(1) {
        					_t11 =  *0x40a3d4; // 0x61736e
        					_t20 = _t20 - 1;
        					_a4 = _t11;
        					_t12 = GetTickCount();
        					_t17 = 0x1a;
        					_a6 = _a6 + _t12 % _t17;
        					_t15 = GetTempFileNameA(_a8,  &_a4, 0, _t21); // executed
        					if(_t15 != 0) {
        						break;
        					}
        					if(_t20 != 0) {
        						continue;
        					}
        					 *_t21 =  *_t21 & 0x00000000;
        					return _t15;
        				}
        				return _t21;
        			}









        0x00405cc3
        0x00405cc9
        0x00405cca
        0x00405cca
        0x00405ccf
        0x00405cd0
        0x00405cd3
        0x00405cdd
        0x00405cea
        0x00405ced
        0x00405cf5
        0x00000000
        0x00000000
        0x00405cf9
        0x00000000
        0x00000000
        0x00405cfb
        0x00000000
        0x00405cfb
        0x00000000

        APIs
        • GetTickCount.KERNEL32 ref: 00405CD3
        • GetTempFileNameA.KERNELBASE(?,?,00000000,?,?,00000007,00000009,0000000B), ref: 00405CED
        Strings
        • nsa, xrefs: 00405CCA
        • "C:\Users\user\Desktop\ilnQNBU7NA.exe" , xrefs: 00405CBF
        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405CC2
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: CountFileNameTempTick
        • String ID: "C:\Users\user\Desktop\ilnQNBU7NA.exe" $C:\Users\user\AppData\Local\Temp\$nsa
        • API String ID: 1716503409-1322044328
        • Opcode ID: 3d6f8019ec5f34494dc3b68805de6783e4b5f3688fe49378b00e43b1512e0d50
        • Instruction ID: e7aa094648ebfea3bacdca9f43850832113df4cf88f6c4d01cd72ac7e01032f8
        • Opcode Fuzzy Hash: 3d6f8019ec5f34494dc3b68805de6783e4b5f3688fe49378b00e43b1512e0d50
        • Instruction Fuzzy Hash: 0AF08236308308ABEB108F56ED04B9B7BACDF91750F10C03BFA44EB290D6B499548758
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E00406500(signed int _a4) {
        				struct HINSTANCE__* _t5;
        				signed int _t10;
        
        				_t10 = _a4 << 3;
        				_t8 =  *(_t10 + 0x40a240);
        				_t5 = GetModuleHandleA( *(_t10 + 0x40a240));
        				if(_t5 != 0) {
        					L2:
        					return GetProcAddress(_t5,  *(_t10 + 0x40a244));
        				}
        				_t5 = E00406492(_t8); // executed
        				if(_t5 == 0) {
        					return 0;
        				}
        				goto L2;
        			}





        0x00406508
        0x0040650b
        0x00406512
        0x0040651a
        0x00406526
        0x00000000
        0x0040652d
        0x0040651d
        0x00406524
        0x00000000
        0x00406535
        0x00000000

        APIs
        • GetModuleHandleA.KERNEL32(?,?,?,004033BB,0000000B), ref: 00406512
        • GetProcAddress.KERNEL32(00000000,?), ref: 0040652D
          • Part of subcall function 00406492: GetSystemDirectoryA.KERNEL32 ref: 004064A9
          • Part of subcall function 00406492: wsprintfA.USER32 ref: 004064E2
          • Part of subcall function 00406492: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 004064F6
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
        • String ID:
        • API String ID: 2547128583-0
        • Opcode ID: 86a36fe79f27c55ffb4f68e9eb19a7d4fc21bb30cdd0e1b9c8c3d4c34093b0ac
        • Instruction ID: acae0596759e2787f84b09bdc6f4b17f60683fab7501ae0ee02ebffea3798694
        • Opcode Fuzzy Hash: 86a36fe79f27c55ffb4f68e9eb19a7d4fc21bb30cdd0e1b9c8c3d4c34093b0ac
        • Instruction Fuzzy Hash: F7E08672A0421177D2105A74BE0893B72A8DE89740302043EF546F2144D7389C71966D
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 68%
        			E00405C90(CHAR* _a4, long _a8, long _a12) {
        				signed int _t5;
        				void* _t6;
        
        				_t5 = GetFileAttributesA(_a4); // executed
        				asm("sbb ecx, ecx");
        				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
        				return _t6;
        			}





        0x00405c94
        0x00405ca1
        0x00405cb6
        0x00405cbc

        APIs
        • GetFileAttributesA.KERNELBASE(00000003,00402EE1,C:\Users\user\Desktop\ilnQNBU7NA.exe,80000000,00000003), ref: 00405C94
        • CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405CB6
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: File$AttributesCreate
        • String ID:
        • API String ID: 415043291-0
        • Opcode ID: 495096ec3bada98d59396949f3e5d8db788c55d9a14f95543a77051fd5c04aa8
        • Instruction ID: ee59d6d0e1d409ab4f08bbdf592326cff3c7222ef74ae4255e7f212f1854b30f
        • Opcode Fuzzy Hash: 495096ec3bada98d59396949f3e5d8db788c55d9a14f95543a77051fd5c04aa8
        • Instruction Fuzzy Hash: F5D09E31654201AFEF0D8F20DE16F2E7AA2EB84B00F11952CB782941E1DA715819AB19
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E00405761(CHAR* _a4) {
        				int _t2;
        
        				_t2 = CreateDirectoryA(_a4, 0); // executed
        				if(_t2 == 0) {
        					return GetLastError();
        				}
        				return 0;
        			}




        0x00405767
        0x0040576f
        0x00000000
        0x00405775
        0x00000000

        APIs
        • CreateDirectoryA.KERNELBASE(?,00000000,0040333B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040355A,?,00000007,00000009,0000000B), ref: 00405767
        • GetLastError.KERNEL32(?,00000007,00000009,0000000B), ref: 00405775
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: CreateDirectoryErrorLast
        • String ID:
        • API String ID: 1375471231-0
        • Opcode ID: 16e4c654e9ce22ade12b11bcec0acffe1e0d8e5e5550dff24455bfee17a8caa2
        • Instruction ID: 5acf30d11c51c39224c83c09ee2e5989404a14e094893e30e7ab7d3df00569a4
        • Opcode Fuzzy Hash: 16e4c654e9ce22ade12b11bcec0acffe1e0d8e5e5550dff24455bfee17a8caa2
        • Instruction Fuzzy Hash: 21C04C31244505EFD6105B30AE08F177A90AB50741F1644396186E10B0EA388455E96D
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E00405D08(void* _a4, void* _a8, long _a12) {
        				int _t7;
        				long _t11;
        
        				_t11 = _a12;
        				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
        				if(_t7 == 0 || _t11 != _a12) {
        					return 0;
        				} else {
        					return 1;
        				}
        			}





        0x00405d0c
        0x00405d1c
        0x00405d24
        0x00000000
        0x00405d2b
        0x00000000
        0x00405d2d

        APIs
        • ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004032FD,00000000,00000000,00403127,000000FF,00000004,00000000,00000000,00000000), ref: 00405D1C
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: FileRead
        • String ID:
        • API String ID: 2738559852-0
        • Opcode ID: da94c88c01f32db49c143d41d40f73f2c481f3bafd85dc9fd8b917d4e0158b31
        • Instruction ID: 6bc3b1048b15a49576125e72cb6f14b4cec2b2626e36b687d4021167e808d8fe
        • Opcode Fuzzy Hash: da94c88c01f32db49c143d41d40f73f2c481f3bafd85dc9fd8b917d4e0158b31
        • Instruction Fuzzy Hash: 2BE08C3221021EABCF109E608C08EEB3B6CEF00360F048833FD54E2140D234E8209BA4
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E00403830() {
        				void* _t1;
        				signed int _t6;
        
        				_t1 =  *0x40a018; // 0xffffffff
        				if(_t1 != 0xffffffff) {
        					FindCloseChangeNotification(_t1); // executed
        					 *0x40a018 =  *0x40a018 | 0xffffffff;
        					_t6 =  *0x40a018;
        				}
        				E00403875();
        				return E004058BF(_t6, 0x436800, 7);
        			}





        0x00403830
        0x00403838
        0x0040383b
        0x00403841
        0x00403841
        0x00403841
        0x00403848
        0x00403859

        APIs
        • FindCloseChangeNotification.KERNELBASE(FFFFFFFF,00403667,?,?,00000007,00000009,0000000B), ref: 0040383B
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: ChangeCloseFindNotification
        • String ID:
        • API String ID: 2591292051-0
        • Opcode ID: 83a8e34a36ec992e53eb10e28b6b1173665ca16798591da3225f5f7867e87012
        • Instruction ID: 504de9a345f4e041b5d785333e0db00fbf57b3530eebac313f647de5124f4253
        • Opcode Fuzzy Hash: 83a8e34a36ec992e53eb10e28b6b1173665ca16798591da3225f5f7867e87012
        • Instruction Fuzzy Hash: D3C01231540704B6D1247F759D4F9093A58AB45736B608775B0F5B00F1D73C8669456D
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E00405ABA(CHAR* _a4, intOrPtr _a8) {
        				CHAR* _t3;
        				char _t4;
        
        				_t3 = _a4;
        				while(1) {
        					_t4 =  *_t3;
        					if(_t4 == 0) {
        						break;
        					}
        					if(_t4 != _a8) {
        						_t3 = CharNextA(_t3); // executed
        						continue;
        					}
        					break;
        				}
        				return _t3;
        			}





        0x00405aba
        0x00405acd
        0x00405acd
        0x00405ad1
        0x00000000
        0x00000000
        0x00405ac4
        0x00405ac7
        0x00000000
        0x00405ac7
        0x00000000
        0x00405ac4
        0x00405ad3

        APIs
        • CharNextA.USER32(?,00403455,"C:\Users\user\Desktop\ilnQNBU7NA.exe" ,00000020,"C:\Users\user\Desktop\ilnQNBU7NA.exe" ,00000000,?,00000007,00000009,0000000B), ref: 00405AC7
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: CharNext
        • String ID:
        • API String ID: 3213498283-0
        • Opcode ID: 1083c57b7f4745178c71a6651c3ca9c923e8efe26efc9521b350556c87d1c9f6
        • Instruction ID: e7db52908d3e8830c535cfb70526cc2daabbcaa08dbe50b4a99c3e39ed970d4a
        • Opcode Fuzzy Hash: 1083c57b7f4745178c71a6651c3ca9c923e8efe26efc9521b350556c87d1c9f6
        • Instruction Fuzzy Hash: 00C08030208F8057CB10571091644677FF0FAD1700F7C496BF0C163150D13458408F36
        Uniqueness

        Uniqueness Score: -1.00%

        Non-executed Functions

        C-Code - Quality: 95%
        			E0040535C(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
        				struct HWND__* _v8;
        				struct tagRECT _v24;
        				void* _v32;
        				signed int _v36;
        				int _v40;
        				int _v44;
        				signed int _v48;
        				int _v52;
        				void* _v56;
        				void* _v64;
        				void* __ebx;
        				void* __edi;
        				void* __esi;
        				struct HWND__* _t89;
        				long _t90;
        				int _t95;
        				void* _t102;
        				intOrPtr _t124;
        				struct HWND__* _t128;
        				int _t150;
        				int _t153;
        				long _t157;
        				struct HWND__* _t161;
        				struct HMENU__* _t163;
        				long _t165;
        				void* _t166;
        				char* _t167;
        				char* _t168;
        				int _t169;
        
        				_t157 = _a8;
        				_t150 = 0;
        				_v8 =  *0x42ec04;
        				if(_t157 != 0x110) {
        					if(_t157 == 0x405) {
        						CloseHandle(CreateThread(0, 0, E004052F0, GetDlgItem(_a4, 0x3ec), 0,  &_a8));
        					}
        					if(_t157 != 0x111) {
        						L17:
        						if(_t157 != 0x404) {
        							L25:
        							if(_t157 != 0x7b) {
        								goto L20;
        							}
        							_t89 = _v8;
        							if(_a12 != _t89) {
        								goto L20;
        							}
        							_t90 = SendMessageA(_t89, 0x1004, _t150, _t150);
        							_a12 = _t90;
        							if(_t90 <= _t150) {
        								L36:
        								return 0;
        							}
        							_t163 = CreatePopupMenu();
        							AppendMenuA(_t163, _t150, 1, E0040618A(_t150, _t157, _t163, _t150, 0xffffffe1));
        							_t95 = _a16;
        							_t153 = _a16 >> 0x10;
        							if(_a16 == 0xffffffff) {
        								GetWindowRect(_v8,  &_v24);
        								_t95 = _v24.left;
        								_t153 = _v24.top;
        							}
        							if(TrackPopupMenu(_t163, 0x180, _t95, _t153, _t150, _a4, _t150) == 1) {
        								_t165 = 1;
        								_v56 = _t150;
        								_v44 = 0x42a890;
        								_v40 = 0x1000;
        								_a4 = _a12;
        								do {
        									_a4 = _a4 - 1;
        									_t165 = _t165 + SendMessageA(_v8, 0x102d, _a4,  &_v64) + 2;
        								} while (_a4 != _t150);
        								OpenClipboard(_t150);
        								EmptyClipboard();
        								_t102 = GlobalAlloc(0x42, _t165);
        								_a4 = _t102;
        								_t166 = GlobalLock(_t102);
        								do {
        									_v44 = _t166;
        									_t167 = _t166 + SendMessageA(_v8, 0x102d, _t150,  &_v64);
        									 *_t167 = 0xd;
        									_t168 = _t167 + 1;
        									 *_t168 = 0xa;
        									_t166 = _t168 + 1;
        									_t150 = _t150 + 1;
        								} while (_t150 < _a12);
        								GlobalUnlock(_a4);
        								SetClipboardData(1, _a4);
        								CloseClipboard();
        							}
        							goto L36;
        						}
        						if( *0x42ebec == _t150) {
        							ShowWindow( *0x42f428, 8);
        							if( *0x42f4cc == _t150) {
        								E0040521E( *((intOrPtr*)( *0x42a068 + 0x34)), _t150);
        							}
        							E00404154(1);
        							goto L25;
        						}
        						 *0x429c60 = 2;
        						E00404154(0x78);
        						goto L20;
        					} else {
        						if(_a12 != 0x403) {
        							L20:
        							return E004041E2(_t157, _a12, _a16);
        						}
        						ShowWindow( *0x42ebf0, _t150);
        						ShowWindow(_v8, 8);
        						E004041B0(_v8);
        						goto L17;
        					}
        				}
        				_v48 = _v48 | 0xffffffff;
        				_v36 = _v36 | 0xffffffff;
        				_t169 = 2;
        				_v56 = _t169;
        				_v52 = 0;
        				_v44 = 0;
        				_v40 = 0;
        				asm("stosd");
        				asm("stosd");
        				_t124 =  *0x42f434;
        				_a12 =  *((intOrPtr*)(_t124 + 0x5c));
        				_a8 =  *((intOrPtr*)(_t124 + 0x60));
        				 *0x42ebf0 = GetDlgItem(_a4, 0x403);
        				 *0x42ebe8 = GetDlgItem(_a4, 0x3ee);
        				_t128 = GetDlgItem(_a4, 0x3f8);
        				 *0x42ec04 = _t128;
        				_v8 = _t128;
        				E004041B0( *0x42ebf0);
        				 *0x42ebf4 = E00404AA1(4);
        				 *0x42ec0c = 0;
        				GetClientRect(_v8,  &_v24);
        				_v48 = _v24.right - GetSystemMetrics(_t169);
        				SendMessageA(_v8, 0x101b, 0,  &_v56);
        				SendMessageA(_v8, 0x1036, 0x4000, 0x4000);
        				if(_a12 >= 0) {
        					SendMessageA(_v8, 0x1001, 0, _a12);
        					SendMessageA(_v8, 0x1026, 0, _a12);
        				}
        				if(_a8 >= _t150) {
        					SendMessageA(_v8, 0x1024, _t150, _a8);
        				}
        				_push( *((intOrPtr*)(_a16 + 0x30)));
        				_push(0x1b);
        				E0040417B(_a4);
        				if(( *0x42f43c & 0x00000003) != 0) {
        					ShowWindow( *0x42ebf0, _t150);
        					if(( *0x42f43c & 0x00000002) != 0) {
        						 *0x42ebf0 = _t150;
        					} else {
        						ShowWindow(_v8, 8);
        					}
        					E004041B0( *0x42ebe8);
        				}
        				_t161 = GetDlgItem(_a4, 0x3ec);
        				SendMessageA(_t161, 0x401, _t150, 0x75300000);
        				if(( *0x42f43c & 0x00000004) != 0) {
        					SendMessageA(_t161, 0x409, _t150, _a8);
        					SendMessageA(_t161, 0x2001, _t150, _a12);
        				}
        				goto L36;
        			}
































        0x0040536a
        0x0040536d
        0x00405375
        0x00405378
        0x0040550d
        0x00405531
        0x00405531
        0x00405543
        0x00405565
        0x0040556b
        0x004055c0
        0x004055c3
        0x00000000
        0x00000000
        0x004055c5
        0x004055cb
        0x00000000
        0x00000000
        0x004055d5
        0x004055dd
        0x004055e0
        0x004056dd
        0x00000000
        0x004056dd
        0x004055ef
        0x004055fb
        0x00405604
        0x0040560f
        0x00405612
        0x0040561b
        0x00405621
        0x00405624
        0x00405624
        0x0040563d
        0x00405648
        0x00405649
        0x0040564c
        0x00405653
        0x0040565a
        0x00405662
        0x00405662
        0x00405679
        0x00405679
        0x00405680
        0x00405686
        0x0040568f
        0x00405696
        0x0040569f
        0x004056a1
        0x004056a4
        0x004056b3
        0x004056b5
        0x004056b8
        0x004056b9
        0x004056bc
        0x004056bd
        0x004056be
        0x004056c6
        0x004056d1
        0x004056d7
        0x004056d7
        0x00000000
        0x0040563d
        0x00405573
        0x004055a1
        0x004055a9
        0x004055b4
        0x004055b4
        0x004055bb
        0x00000000
        0x004055bb
        0x00405577
        0x00405581
        0x00000000
        0x00405545
        0x0040554b
        0x00405586
        0x00000000
        0x0040558d
        0x00405554
        0x0040555b
        0x00405560
        0x00000000
        0x00405560
        0x00405543
        0x0040537e
        0x00405382
        0x0040538a
        0x0040538e
        0x00405391
        0x00405394
        0x00405397
        0x0040539a
        0x0040539b
        0x0040539c
        0x004053b5
        0x004053b8
        0x004053c2
        0x004053d1
        0x004053d9
        0x004053e1
        0x004053e6
        0x004053e9
        0x004053f5
        0x004053fe
        0x00405407
        0x00405429
        0x0040542f
        0x00405440
        0x00405445
        0x00405453
        0x00405461
        0x00405461
        0x00405466
        0x00405474
        0x00405474
        0x00405479
        0x0040547c
        0x00405481
        0x0040548d
        0x00405496
        0x004054a3
        0x004054b2
        0x004054a5
        0x004054aa
        0x004054aa
        0x004054be
        0x004054be
        0x004054d2
        0x004054db
        0x004054e4
        0x004054f4
        0x00405500
        0x00405500
        0x00000000

        APIs
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
        • String ID:
        • API String ID: 590372296-0
        • Opcode ID: 97abd2f5be5f2dae788b800ab975af2d24296fb55a7b09bb9be2c01580a4233f
        • Instruction ID: ad896caeff922a337f51dbee0e8d50556c939e1053927b0f1ec287220421205b
        • Opcode Fuzzy Hash: 97abd2f5be5f2dae788b800ab975af2d24296fb55a7b09bb9be2c01580a4233f
        • Instruction Fuzzy Hash: 3DA14A70900608BFDB119F61DD89EAE7FB9FB08354F50403AFA45BA1A0CB754E519F68
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 78%
        			E0040460D(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
        				signed int _v8;
        				signed int _v12;
        				long _v16;
        				long _v20;
        				long _v24;
        				char _v28;
        				intOrPtr _v32;
        				long _v36;
        				char _v40;
        				unsigned int _v44;
        				signed int _v48;
        				CHAR* _v56;
        				intOrPtr _v60;
        				intOrPtr _v64;
        				intOrPtr _v68;
        				CHAR* _v72;
        				void _v76;
        				struct HWND__* _v80;
        				void* __ebx;
        				void* __edi;
        				void* __esi;
        				intOrPtr _t82;
        				long _t87;
        				signed char* _t89;
        				void* _t95;
        				signed int _t96;
        				int _t109;
        				signed char _t114;
        				signed int _t118;
        				struct HWND__** _t122;
        				intOrPtr* _t138;
        				CHAR* _t146;
        				unsigned int _t150;
        				signed int _t152;
        				unsigned int _t156;
        				signed int _t158;
        				signed int* _t159;
        				signed char* _t160;
        				struct HWND__* _t165;
        				struct HWND__* _t166;
        				int _t168;
        				unsigned int _t197;
        
        				_t156 = __edx;
        				_t82 =  *0x42a068;
        				_v32 = _t82;
        				_t146 = ( *(_t82 + 0x3c) << 0xa) + 0x430000;
        				_v12 =  *((intOrPtr*)(_t82 + 0x38));
        				if(_a8 == 0x40b) {
        					E004057F7(0x3fb, _t146);
        					E004063D2(_t146);
        				}
        				_t166 = _a4;
        				if(_a8 != 0x110) {
        					L8:
        					if(_a8 != 0x111) {
        						L20:
        						if(_a8 == 0x40f) {
        							L22:
        							_v8 = _v8 & 0x00000000;
        							_v12 = _v12 & 0x00000000;
        							E004057F7(0x3fb, _t146);
        							if(E00405B7D(_t185, _t146) == 0) {
        								_v8 = 1;
        							}
        							E004060F7(0x429860, _t146);
        							_t87 = E00406500(1);
        							_v16 = _t87;
        							if(_t87 == 0) {
        								L30:
        								E004060F7(0x429860, _t146);
        								_t89 = E00405B28(0x429860);
        								_t158 = 0;
        								if(_t89 != 0) {
        									 *_t89 =  *_t89 & 0x00000000;
        								}
        								if(GetDiskFreeSpaceA(0x429860,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
        									goto L35;
        								} else {
        									_t168 = 0x400;
        									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
        									asm("cdq");
        									_v48 = _t109;
        									_v44 = _t156;
        									_v12 = 1;
        									goto L36;
        								}
        							} else {
        								_t159 = 0;
        								if(0 == 0x429860) {
        									goto L30;
        								} else {
        									goto L26;
        								}
        								while(1) {
        									L26:
        									_t114 = _v16(0x429860,  &_v48,  &_v28,  &_v40);
        									if(_t114 != 0) {
        										break;
        									}
        									if(_t159 != 0) {
        										 *_t159 =  *_t159 & _t114;
        									}
        									_t160 = E00405AD6(0x429860);
        									 *_t160 =  *_t160 & 0x00000000;
        									_t159 = _t160 - 1;
        									 *_t159 = 0x5c;
        									if(_t159 != 0x429860) {
        										continue;
        									} else {
        										goto L30;
        									}
        								}
        								_t150 = _v44;
        								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
        								_v44 = _t150 >> 0xa;
        								_v12 = 1;
        								_t158 = 0;
        								__eflags = 0;
        								L35:
        								_t168 = 0x400;
        								L36:
        								_t95 = E00404AA1(5);
        								if(_v12 != _t158) {
        									_t197 = _v44;
        									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
        										_v8 = 2;
        									}
        								}
        								if( *((intOrPtr*)( *0x42ebfc + 0x10)) != _t158) {
        									E00404A89(0x3ff, 0xfffffffb, _t95);
        									if(_v12 == _t158) {
        										SetDlgItemTextA(_a4, _t168, 0x429850);
        									} else {
        										E004049C4(_t168, 0xfffffffc, _v48, _v44);
        									}
        								}
        								_t96 = _v8;
        								 *0x42f4e4 = _t96;
        								if(_t96 == _t158) {
        									_v8 = E0040140B(7);
        								}
        								if(( *(_v32 + 0x14) & _t168) != 0) {
        									_v8 = _t158;
        								}
        								E0040419D(0 | _v8 == _t158);
        								if(_v8 == _t158 &&  *0x42a880 == _t158) {
        									E00404566();
        								}
        								 *0x42a880 = _t158;
        								goto L53;
        							}
        						}
        						_t185 = _a8 - 0x405;
        						if(_a8 != 0x405) {
        							goto L53;
        						}
        						goto L22;
        					}
        					_t118 = _a12 & 0x0000ffff;
        					if(_t118 != 0x3fb) {
        						L12:
        						if(_t118 == 0x3e9) {
        							_t152 = 7;
        							memset( &_v76, 0, _t152 << 2);
        							_v80 = _t166;
        							_v72 = 0x42a890;
        							_v60 = E0040495E;
        							_v56 = _t146;
        							_v68 = E0040618A(_t146, 0x42a890, _t166, 0x429c68, _v12);
        							_t122 =  &_v80;
        							_v64 = 0x41;
        							__imp__SHBrowseForFolderA(_t122);
        							if(_t122 == 0) {
        								_a8 = 0x40f;
        							} else {
        								__imp__CoTaskMemFree(_t122);
        								E00405A8F(_t146);
        								_t125 =  *((intOrPtr*)( *0x42f434 + 0x11c));
        								if( *((intOrPtr*)( *0x42f434 + 0x11c)) != 0 && _t146 == 0x435400) {
        									E0040618A(_t146, 0x42a890, _t166, 0, _t125);
        									if(lstrcmpiA(0x42e3c0, 0x42a890) != 0) {
        										lstrcatA(_t146, 0x42e3c0);
        									}
        								}
        								 *0x42a880 =  *0x42a880 + 1;
        								SetDlgItemTextA(_t166, 0x3fb, _t146);
        							}
        						}
        						goto L20;
        					}
        					if(_a12 >> 0x10 != 0x300) {
        						goto L53;
        					}
        					_a8 = 0x40f;
        					goto L12;
        				} else {
        					_t165 = GetDlgItem(_t166, 0x3fb);
        					if(E00405AFC(_t146) != 0 && E00405B28(_t146) == 0) {
        						E00405A8F(_t146);
        					}
        					 *0x42ebf8 = _t166;
        					SetWindowTextA(_t165, _t146);
        					_push( *((intOrPtr*)(_a16 + 0x34)));
        					_push(1);
        					E0040417B(_t166);
        					_push( *((intOrPtr*)(_a16 + 0x30)));
        					_push(0x14);
        					E0040417B(_t166);
        					E004041B0(_t165);
        					_t138 = E00406500(8);
        					if(_t138 == 0) {
        						L53:
        						return E004041E2(_a8, _a12, _a16);
        					} else {
        						 *_t138(_t165, 1);
        						goto L8;
        					}
        				}
        			}













































        0x0040460d
        0x00404613
        0x00404619
        0x00404626
        0x00404634
        0x00404637
        0x0040463f
        0x00404645
        0x00404645
        0x00404651
        0x00404654
        0x004046c2
        0x004046c9
        0x004047a0
        0x004047a7
        0x004047b6
        0x004047b6
        0x004047ba
        0x004047c4
        0x004047d1
        0x004047d3
        0x004047d3
        0x004047e1
        0x004047e8
        0x004047ef
        0x004047f2
        0x00404829
        0x0040482b
        0x00404831
        0x00404836
        0x0040483a
        0x0040483c
        0x0040483c
        0x00404858
        0x00000000
        0x0040485a
        0x0040485d
        0x0040486b
        0x00404871
        0x00404872
        0x00404875
        0x00404878
        0x00000000
        0x00404878
        0x004047f4
        0x004047f6
        0x004047fa
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x004047fc
        0x004047fc
        0x00404809
        0x0040480e
        0x00000000
        0x00000000
        0x00404812
        0x00404814
        0x00404814
        0x0040481c
        0x0040481e
        0x00404821
        0x00404824
        0x00404827
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x00404827
        0x00404884
        0x0040488e
        0x00404891
        0x00404894
        0x0040489b
        0x0040489b
        0x0040489d
        0x0040489d
        0x004048a2
        0x004048a4
        0x004048ac
        0x004048b3
        0x004048b5
        0x004048c0
        0x004048c0
        0x004048b5
        0x004048d0
        0x004048da
        0x004048e2
        0x004048fd
        0x004048e4
        0x004048ed
        0x004048ed
        0x004048e2
        0x00404902
        0x00404907
        0x0040490c
        0x00404915
        0x00404915
        0x0040491e
        0x00404920
        0x00404920
        0x0040492c
        0x00404934
        0x0040493e
        0x0040493e
        0x00404943
        0x00000000
        0x00404943
        0x004047f2
        0x004047a9
        0x004047b0
        0x00000000
        0x00000000
        0x00000000
        0x004047b0
        0x004046cf
        0x004046d8
        0x004046f2
        0x004046f7
        0x00404701
        0x00404708
        0x00404714
        0x00404717
        0x0040471a
        0x00404721
        0x00404729
        0x0040472c
        0x00404730
        0x00404737
        0x0040473f
        0x00404799
        0x00404741
        0x00404742
        0x00404749
        0x00404753
        0x0040475b
        0x00404768
        0x0040477c
        0x00404780
        0x00404780
        0x0040477c
        0x00404785
        0x00404792
        0x00404792
        0x0040473f
        0x00000000
        0x004046f7
        0x004046e5
        0x00000000
        0x00000000
        0x004046eb
        0x00000000
        0x00404656
        0x00404663
        0x0040466c
        0x00404679
        0x00404679
        0x00404680
        0x00404686
        0x0040468f
        0x00404692
        0x00404695
        0x0040469d
        0x004046a0
        0x004046a3
        0x004046a9
        0x004046b0
        0x004046b7
        0x00404949
        0x0040495b
        0x004046bd
        0x004046c0
        0x00000000
        0x004046c0
        0x004046b7

        APIs
        • GetDlgItem.USER32 ref: 0040465C
        • SetWindowTextA.USER32(00000000,?), ref: 00404686
        • SHBrowseForFolderA.SHELL32(?,00429C68,?), ref: 00404737
        • CoTaskMemFree.OLE32(00000000), ref: 00404742
        • lstrcmpiA.KERNEL32(0042E3C0,0042A890,00000000,?,?), ref: 00404774
        • lstrcatA.KERNEL32(?,0042E3C0), ref: 00404780
        • SetDlgItemTextA.USER32 ref: 00404792
          • Part of subcall function 004057F7: GetDlgItemTextA.USER32 ref: 0040580A
          • Part of subcall function 004063D2: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\ilnQNBU7NA.exe" ,7519FA90,C:\Users\user\AppData\Local\Temp\,00000000,00403323,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040355A,?,00000007,00000009,0000000B), ref: 0040642A
          • Part of subcall function 004063D2: CharNextA.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 00406437
          • Part of subcall function 004063D2: CharNextA.USER32(?,"C:\Users\user\Desktop\ilnQNBU7NA.exe" ,7519FA90,C:\Users\user\AppData\Local\Temp\,00000000,00403323,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040355A,?,00000007,00000009,0000000B), ref: 0040643C
          • Part of subcall function 004063D2: CharPrevA.USER32(?,?,7519FA90,C:\Users\user\AppData\Local\Temp\,00000000,00403323,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040355A,?,00000007,00000009,0000000B), ref: 0040644C
        • GetDiskFreeSpaceA.KERNEL32(00429860,?,?,0000040F,?,00429860,00429860,?,00000001,00429860,?,?,000003FB,?), ref: 00404850
        • MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040486B
          • Part of subcall function 004049C4: lstrlenA.KERNEL32(0042A890,0042A890,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004048DF,000000DF,00000000,00000400,?), ref: 00404A62
          • Part of subcall function 004049C4: wsprintfA.USER32 ref: 00404A6A
          • Part of subcall function 004049C4: SetDlgItemTextA.USER32 ref: 00404A7D
        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
        • String ID: A
        • API String ID: 2624150263-3554254475
        • Opcode ID: e2093240277334122aeb027a85fba7e6720a3e9e52d6b68153c58a68e5512187
        • Instruction ID: 02b07c61478aeb9ac600f99876a590f4236d4304051c708c1213a6c52027fc1c
        • Opcode Fuzzy Hash: e2093240277334122aeb027a85fba7e6720a3e9e52d6b68153c58a68e5512187
        • Instruction Fuzzy Hash: CAA16FB1900209ABDB11EFA6DD45AAF77B8EF84314F14843BF601B62D1DB7C89418B69
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 98%
        			E004058BF(void* __eflags, signed int _a4, signed int _a8) {
        				signed int _v8;
        				void* _v12;
        				signed int _v16;
        				struct _WIN32_FIND_DATAA _v336;
        				signed int _t40;
        				char* _t53;
        				signed int _t55;
        				signed int _t58;
        				signed int _t64;
        				signed int _t66;
        				void* _t68;
        				signed char _t69;
        				CHAR* _t71;
        				void* _t72;
        				CHAR* _t73;
        				char* _t76;
        
        				_t69 = _a8;
        				_t73 = _a4;
        				_v8 = _t69 & 0x00000004;
        				_t40 = E00405B7D(__eflags, _t73);
        				_v16 = _t40;
        				if((_t69 & 0x00000008) != 0) {
        					_t66 = DeleteFileA(_t73);
        					asm("sbb eax, eax");
        					_t68 =  ~_t66 + 1;
        					 *0x42f4c8 =  *0x42f4c8 + _t68;
        					return _t68;
        				}
        				_a4 = _t69;
        				_t8 =  &_a4;
        				 *_t8 = _a4 & 0x00000001;
        				__eflags =  *_t8;
        				if( *_t8 == 0) {
        					L5:
        					E004060F7(0x42b898, _t73);
        					__eflags = _a4;
        					if(_a4 == 0) {
        						E00405AD6(_t73);
        					} else {
        						lstrcatA(0x42b898, "\*.*");
        					}
        					__eflags =  *_t73;
        					if( *_t73 != 0) {
        						L10:
        						lstrcatA(_t73, 0x40a014);
        						L11:
        						_t71 =  &(_t73[lstrlenA(_t73)]);
        						_t40 = FindFirstFileA(0x42b898,  &_v336);
        						__eflags = _t40 - 0xffffffff;
        						_v12 = _t40;
        						if(_t40 == 0xffffffff) {
        							L29:
        							__eflags = _a4;
        							if(_a4 != 0) {
        								_t32 = _t71 - 1;
        								 *_t32 =  *(_t71 - 1) & 0x00000000;
        								__eflags =  *_t32;
        							}
        							goto L31;
        						} else {
        							goto L12;
        						}
        						do {
        							L12:
        							_t76 =  &(_v336.cFileName);
        							_t53 = E00405ABA( &(_v336.cFileName), 0x3f);
        							__eflags =  *_t53;
        							if( *_t53 != 0) {
        								__eflags = _v336.cAlternateFileName;
        								if(_v336.cAlternateFileName != 0) {
        									_t76 =  &(_v336.cAlternateFileName);
        								}
        							}
        							__eflags =  *_t76 - 0x2e;
        							if( *_t76 != 0x2e) {
        								L19:
        								E004060F7(_t71, _t76);
        								__eflags = _v336.dwFileAttributes & 0x00000010;
        								if(__eflags == 0) {
        									_t55 = E00405877(__eflags, _t73, _v8);
        									__eflags = _t55;
        									if(_t55 != 0) {
        										E0040521E(0xfffffff2, _t73);
        									} else {
        										__eflags = _v8 - _t55;
        										if(_v8 == _t55) {
        											 *0x42f4c8 =  *0x42f4c8 + 1;
        										} else {
        											E0040521E(0xfffffff1, _t73);
        											E00405ED6(_t72, _t73, 0);
        										}
        									}
        								} else {
        									__eflags = (_a8 & 0x00000003) - 3;
        									if(__eflags == 0) {
        										E004058BF(__eflags, _t73, _a8);
        									}
        								}
        								goto L27;
        							}
        							_t64 =  *((intOrPtr*)(_t76 + 1));
        							__eflags = _t64;
        							if(_t64 == 0) {
        								goto L27;
        							}
        							__eflags = _t64 - 0x2e;
        							if(_t64 != 0x2e) {
        								goto L19;
        							}
        							__eflags =  *((char*)(_t76 + 2));
        							if( *((char*)(_t76 + 2)) == 0) {
        								goto L27;
        							}
        							goto L19;
        							L27:
        							_t58 = FindNextFileA(_v12,  &_v336);
        							__eflags = _t58;
        						} while (_t58 != 0);
        						_t40 = FindClose(_v12);
        						goto L29;
        					}
        					__eflags =  *0x42b898 - 0x5c;
        					if( *0x42b898 != 0x5c) {
        						goto L11;
        					}
        					goto L10;
        				} else {
        					__eflags = _t40;
        					if(_t40 == 0) {
        						L31:
        						__eflags = _a4;
        						if(_a4 == 0) {
        							L39:
        							return _t40;
        						}
        						__eflags = _v16;
        						if(_v16 != 0) {
        							_t40 = E0040646B(_t73);
        							__eflags = _t40;
        							if(_t40 == 0) {
        								goto L39;
        							}
        							E00405A8F(_t73);
        							_t40 = E00405877(__eflags, _t73, _v8 | 0x00000001);
        							__eflags = _t40;
        							if(_t40 != 0) {
        								return E0040521E(0xffffffe5, _t73);
        							}
        							__eflags = _v8;
        							if(_v8 == 0) {
        								goto L33;
        							}
        							E0040521E(0xfffffff1, _t73);
        							return E00405ED6(_t72, _t73, 0);
        						}
        						L33:
        						 *0x42f4c8 =  *0x42f4c8 + 1;
        						return _t40;
        					}
        					__eflags = _t69 & 0x00000002;
        					if((_t69 & 0x00000002) == 0) {
        						goto L31;
        					}
        					goto L5;
        				}
        			}



















        0x004058c9
        0x004058ce
        0x004058d7
        0x004058da
        0x004058e2
        0x004058e5
        0x004058e8
        0x004058f0
        0x004058f2
        0x004058f3
        0x00000000
        0x004058f3
        0x004058fe
        0x00405901
        0x00405901
        0x00405901
        0x00405905
        0x00405918
        0x0040591f
        0x00405924
        0x00405928
        0x00405938
        0x0040592a
        0x00405930
        0x00405930
        0x0040593d
        0x00405940
        0x0040594b
        0x00405951
        0x00405956
        0x00405966
        0x00405968
        0x0040596e
        0x00405971
        0x00405974
        0x00405a2c
        0x00405a2c
        0x00405a30
        0x00405a32
        0x00405a32
        0x00405a32
        0x00405a32
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x0040597a
        0x0040597a
        0x00405983
        0x00405989
        0x0040598e
        0x00405991
        0x00405993
        0x00405997
        0x00405999
        0x00405999
        0x00405997
        0x0040599c
        0x0040599f
        0x004059b2
        0x004059b4
        0x004059b9
        0x004059c0
        0x004059db
        0x004059e0
        0x004059e2
        0x00405a06
        0x004059e4
        0x004059e4
        0x004059e7
        0x004059fb
        0x004059e9
        0x004059ec
        0x004059f4
        0x004059f4
        0x004059e7
        0x004059c2
        0x004059c8
        0x004059ca
        0x004059d0
        0x004059d0
        0x004059ca
        0x00000000
        0x004059c0
        0x004059a1
        0x004059a4
        0x004059a6
        0x00000000
        0x00000000
        0x004059a8
        0x004059aa
        0x00000000
        0x00000000
        0x004059ac
        0x004059b0
        0x00000000
        0x00000000
        0x00000000
        0x00405a0b
        0x00405a15
        0x00405a1b
        0x00405a1b
        0x00405a26
        0x00000000
        0x00405a26
        0x00405942
        0x00405949
        0x00000000
        0x00000000
        0x00000000
        0x00405907
        0x00405907
        0x00405909
        0x00405a36
        0x00405a38
        0x00405a3b
        0x00405a8c
        0x00405a8c
        0x00405a8c
        0x00405a3d
        0x00405a40
        0x00405a4b
        0x00405a50
        0x00405a52
        0x00000000
        0x00000000
        0x00405a55
        0x00405a61
        0x00405a66
        0x00405a68
        0x00000000
        0x00405a83
        0x00405a6a
        0x00405a6d
        0x00000000
        0x00000000
        0x00405a72
        0x00000000
        0x00405a79
        0x00405a42
        0x00405a42
        0x00000000
        0x00405a42
        0x0040590f
        0x00405912
        0x00000000
        0x00000000
        0x00000000
        0x00405912

        APIs
        • DeleteFileA.KERNEL32(?,?,7519FA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058E8
        • lstrcatA.KERNEL32(0042B898,\*.*,0042B898,?,?,7519FA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405930
        • lstrcatA.KERNEL32(?,0040A014,?,0042B898,?,?,7519FA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405951
        • lstrlenA.KERNEL32(?,?,0040A014,?,0042B898,?,?,7519FA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405957
        • FindFirstFileA.KERNEL32(0042B898,?,?,?,0040A014,?,0042B898,?,?,7519FA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405968
        • FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405A15
        • FindClose.KERNEL32(00000000), ref: 00405A26
        Strings
        • \*.*, xrefs: 0040592A
        • "C:\Users\user\Desktop\ilnQNBU7NA.exe" , xrefs: 004058BF
        • C:\Users\user\AppData\Local\Temp\, xrefs: 004058CC
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
        • String ID: "C:\Users\user\Desktop\ilnQNBU7NA.exe" $C:\Users\user\AppData\Local\Temp\$\*.*
        • API String ID: 2035342205-2673129365
        • Opcode ID: 4def77bb891c7b3960c154a2ad73ead010234d10b8a13dea3fc18deabcd134ba
        • Instruction ID: 53fbf83e18d3e9f22f7fd61ce8145b7df245fbcc76992db59ab4b54644bc6f5f
        • Opcode Fuzzy Hash: 4def77bb891c7b3960c154a2ad73ead010234d10b8a13dea3fc18deabcd134ba
        • Instruction Fuzzy Hash: 4251C470A00A49AADB21AB618D85BBF7A78DF52314F14427FF841711D2C73C8942DF6A
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 74%
        			E0040216B() {
        				signed int _t55;
        				void* _t59;
        				intOrPtr* _t63;
        				intOrPtr _t64;
        				intOrPtr* _t65;
        				intOrPtr* _t67;
        				intOrPtr* _t69;
        				intOrPtr* _t71;
        				intOrPtr* _t73;
        				intOrPtr* _t75;
        				intOrPtr* _t78;
        				intOrPtr* _t80;
        				intOrPtr* _t82;
        				intOrPtr* _t84;
        				int _t87;
        				intOrPtr* _t95;
        				signed int _t105;
        				signed int _t109;
        				void* _t111;
        
        				 *(_t111 - 0x38) = E00402BCE(0xfffffff0);
        				 *(_t111 - 0xc) = E00402BCE(0xffffffdf);
        				 *((intOrPtr*)(_t111 - 0x88)) = E00402BCE(2);
        				 *((intOrPtr*)(_t111 - 0x34)) = E00402BCE(0xffffffcd);
        				 *((intOrPtr*)(_t111 - 0x78)) = E00402BCE(0x45);
        				_t55 =  *(_t111 - 0x18);
        				 *(_t111 - 0x90) = _t55 & 0x00000fff;
        				_t105 = _t55 & 0x00008000;
        				_t109 = _t55 >> 0x0000000c & 0x00000007;
        				 *(_t111 - 0x74) = _t55 >> 0x00000010 & 0x0000ffff;
        				if(E00405AFC( *(_t111 - 0xc)) == 0) {
        					E00402BCE(0x21);
        				}
        				_t59 = _t111 + 8;
        				__imp__CoCreateInstance(0x408524, _t87, 1, 0x408514, _t59);
        				if(_t59 < _t87) {
        					L15:
        					 *((intOrPtr*)(_t111 - 4)) = 1;
        					_push(0xfffffff0);
        				} else {
        					_t63 =  *((intOrPtr*)(_t111 + 8));
        					_t64 =  *((intOrPtr*)( *_t63))(_t63, 0x408534, _t111 - 0x30);
        					 *((intOrPtr*)(_t111 - 8)) = _t64;
        					if(_t64 >= _t87) {
        						_t67 =  *((intOrPtr*)(_t111 + 8));
        						 *((intOrPtr*)(_t111 - 8)) =  *((intOrPtr*)( *_t67 + 0x50))(_t67,  *(_t111 - 0xc));
        						if(_t105 == _t87) {
        							_t84 =  *((intOrPtr*)(_t111 + 8));
        							 *((intOrPtr*)( *_t84 + 0x24))(_t84, 0x435800);
        						}
        						if(_t109 != _t87) {
        							_t82 =  *((intOrPtr*)(_t111 + 8));
        							 *((intOrPtr*)( *_t82 + 0x3c))(_t82, _t109);
        						}
        						_t69 =  *((intOrPtr*)(_t111 + 8));
        						 *((intOrPtr*)( *_t69 + 0x34))(_t69,  *(_t111 - 0x74));
        						_t95 =  *((intOrPtr*)(_t111 - 0x34));
        						if( *_t95 != _t87) {
        							_t80 =  *((intOrPtr*)(_t111 + 8));
        							 *((intOrPtr*)( *_t80 + 0x44))(_t80, _t95,  *(_t111 - 0x90));
        						}
        						_t71 =  *((intOrPtr*)(_t111 + 8));
        						 *((intOrPtr*)( *_t71 + 0x2c))(_t71,  *((intOrPtr*)(_t111 - 0x88)));
        						_t73 =  *((intOrPtr*)(_t111 + 8));
        						 *((intOrPtr*)( *_t73 + 0x1c))(_t73,  *((intOrPtr*)(_t111 - 0x78)));
        						if( *((intOrPtr*)(_t111 - 8)) >= _t87) {
        							 *((intOrPtr*)(_t111 - 8)) = 0x80004005;
        							if(MultiByteToWideChar(_t87, _t87,  *(_t111 - 0x38), 0xffffffff,  *(_t111 - 0xc), 0x400) != 0) {
        								_t78 =  *((intOrPtr*)(_t111 - 0x30));
        								 *((intOrPtr*)(_t111 - 8)) =  *((intOrPtr*)( *_t78 + 0x18))(_t78,  *(_t111 - 0xc), 1);
        							}
        						}
        						_t75 =  *((intOrPtr*)(_t111 - 0x30));
        						 *((intOrPtr*)( *_t75 + 8))(_t75);
        					}
        					_t65 =  *((intOrPtr*)(_t111 + 8));
        					 *((intOrPtr*)( *_t65 + 8))(_t65);
        					if( *((intOrPtr*)(_t111 - 8)) >= _t87) {
        						_push(0xfffffff4);
        					} else {
        						goto L15;
        					}
        				}
        				E00401423();
        				 *0x42f4c8 =  *0x42f4c8 +  *((intOrPtr*)(_t111 - 4));
        				return 0;
        			}






















        0x00402174
        0x0040217e
        0x00402188
        0x00402195
        0x004021a0
        0x004021a3
        0x004021bd
        0x004021c3
        0x004021c9
        0x004021cc
        0x004021d6
        0x004021da
        0x004021da
        0x004021df
        0x004021f0
        0x004021f8
        0x004022d4
        0x004022d4
        0x004022db
        0x004021fe
        0x004021fe
        0x0040220d
        0x00402211
        0x00402214
        0x0040221a
        0x00402228
        0x0040222b
        0x0040222d
        0x00402238
        0x00402238
        0x0040223d
        0x0040223f
        0x00402246
        0x00402246
        0x00402249
        0x00402252
        0x00402255
        0x0040225a
        0x0040225c
        0x00402269
        0x00402269
        0x0040226c
        0x00402278
        0x0040227b
        0x00402284
        0x0040228a
        0x00402291
        0x004022aa
        0x004022ac
        0x004022ba
        0x004022ba
        0x004022aa
        0x004022bd
        0x004022c3
        0x004022c3
        0x004022c6
        0x004022cc
        0x004022d2
        0x004022e7
        0x00000000
        0x00000000
        0x00000000
        0x004022d2
        0x004022dd
        0x00402a5d
        0x00402a69

        APIs
        • CoCreateInstance.OLE32(00408524,?,00000001,00408514,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F0
        • MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00408514,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004022A2
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: ByteCharCreateInstanceMultiWide
        • String ID:
        • API String ID: 123533781-0
        • Opcode ID: 163f96e7a228f668ad01f6fff9a08a3bf5921adb224fce9e1f45b383d9424720
        • Instruction ID: cfd0f9f97044ed47efa98841b374527745dcc5d1cf4597a5ef188e8ddd78f045
        • Opcode Fuzzy Hash: 163f96e7a228f668ad01f6fff9a08a3bf5921adb224fce9e1f45b383d9424720
        • Instruction Fuzzy Hash: DF510671A00208AFCB50DFE4C989E9D7BB6FF48314F2041AAF515EB2D1DA799981CB54
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E0040646B(CHAR* _a4) {
        				void* _t2;
        
        				_t2 = FindFirstFileA(_a4, 0x42c0e0);
        				if(_t2 == 0xffffffff) {
        					return 0;
        				}
        				FindClose(_t2);
        				return 0x42c0e0;
        			}




        0x00406476
        0x0040647f
        0x00000000
        0x0040648c
        0x00406482
        0x00000000

        APIs
        • FindFirstFileA.KERNEL32(7519FA90,0042C0E0,0042BC98,00405BC0,0042BC98,0042BC98,00000000,0042BC98,0042BC98,7519FA90,?,C:\Users\user\AppData\Local\Temp\,004058DF,?,7519FA90,C:\Users\user\AppData\Local\Temp\), ref: 00406476
        • FindClose.KERNEL32(00000000), ref: 00406482
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: Find$CloseFileFirst
        • String ID:
        • API String ID: 2295610775-0
        • Opcode ID: 834111d6c5cf34f6f1a5acdd2360b111687db49f4aa82fd60f9155d80f0d726b
        • Instruction ID: 43645372537bfa69987f3f85d1e9d0a1072f39b89fcefe97c81bac3be47e5bfd
        • Opcode Fuzzy Hash: 834111d6c5cf34f6f1a5acdd2360b111687db49f4aa82fd60f9155d80f0d726b
        • Instruction Fuzzy Hash: 9AD01231514120DFC3502B786D4C84F7A589F05330321CB36F86AF22E0C7348C2296EC
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 39%
        			E004027A1(char __ebx, char* __edi, char* __esi) {
        				void* _t19;
        
        				if(FindFirstFileA(E00402BCE(2), _t19 - 0x1d0) != 0xffffffff) {
        					E00406055(__edi, _t6);
        					_push(_t19 - 0x1a4);
        					_push(__esi);
        					E004060F7();
        				} else {
        					 *__edi = __ebx;
        					 *__esi = __ebx;
        					 *((intOrPtr*)(_t19 - 4)) = 1;
        				}
        				 *0x42f4c8 =  *0x42f4c8 +  *((intOrPtr*)(_t19 - 4));
        				return 0;
        			}




        0x004027b9
        0x004027cd
        0x004027d8
        0x004027d9
        0x00402918
        0x004027bb
        0x004027bb
        0x004027bd
        0x004027bf
        0x004027bf
        0x00402a5d
        0x00402a69

        APIs
        • FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 004027B0
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: FileFindFirst
        • String ID:
        • API String ID: 1974802433-0
        • Opcode ID: fe0c6c70d9fc1c67409d165531832ab6862d9141dea2be007ff0faa3f611277f
        • Instruction ID: cbd12963852304709d998dbd60bf7e8f33587a64a337c4fd13578998f516bfb3
        • Opcode Fuzzy Hash: fe0c6c70d9fc1c67409d165531832ab6862d9141dea2be007ff0faa3f611277f
        • Instruction Fuzzy Hash: 3EF0A072604110DED711EBA49A49AFEB768AF61314F60457FF112B20C1D7B889469B3A
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 79%
        			E00406945(signed int __ebx, signed int* __esi) {
        				signed int _t396;
        				signed int _t425;
        				signed int _t442;
        				signed int _t443;
        				signed int* _t446;
        				void* _t448;
        
        				L0:
        				while(1) {
        					L0:
        					_t446 = __esi;
        					_t425 = __ebx;
        					if( *(_t448 - 0x34) == 0) {
        						break;
        					}
        					L55:
        					__eax =  *(__ebp - 0x38);
        					 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
        					__ecx = __ebx;
        					 *( *(__ebp - 0x38)) & 0x000000ff = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
        					 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
        					 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
        					__ebx = __ebx + 8;
        					while(1) {
        						L56:
        						if(__ebx < 0xe) {
        							goto L0;
        						}
        						L57:
        						__eax =  *(__ebp - 0x40);
        						__eax =  *(__ebp - 0x40) & 0x00003fff;
        						__ecx = __eax;
        						__esi[1] = __eax;
        						__ecx = __eax & 0x0000001f;
        						if(__cl > 0x1d) {
        							L9:
        							_t443 = _t442 | 0xffffffff;
        							 *_t446 = 0x11;
        							L10:
        							_t446[0x147] =  *(_t448 - 0x40);
        							_t446[0x146] = _t425;
        							( *(_t448 + 8))[1] =  *(_t448 - 0x34);
        							L11:
        							 *( *(_t448 + 8)) =  *(_t448 - 0x38);
        							_t446[0x26ea] =  *(_t448 - 0x30);
        							E004070B4( *(_t448 + 8));
        							return _t443;
        						}
        						L58:
        						__eax = __eax & 0x000003e0;
        						if(__eax > 0x3a0) {
        							goto L9;
        						}
        						L59:
        						 *(__ebp - 0x40) =  *(__ebp - 0x40) >> 0xe;
        						__ebx = __ebx - 0xe;
        						_t94 =  &(__esi[2]);
        						 *_t94 = __esi[2] & 0x00000000;
        						 *__esi = 0xc;
        						while(1) {
        							L60:
        							__esi[1] = __esi[1] >> 0xa;
        							__eax = (__esi[1] >> 0xa) + 4;
        							if(__esi[2] >= (__esi[1] >> 0xa) + 4) {
        								goto L68;
        							}
        							L61:
        							while(1) {
        								L64:
        								if(__ebx >= 3) {
        									break;
        								}
        								L62:
        								if( *(__ebp - 0x34) == 0) {
        									goto L182;
        								}
        								L63:
        								__eax =  *(__ebp - 0x38);
        								 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
        								__ecx = __ebx;
        								 *( *(__ebp - 0x38)) & 0x000000ff = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
        								 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
        								 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
        								__ebx = __ebx + 8;
        							}
        							L65:
        							__ecx = __esi[2];
        							 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000007;
        							__ebx = __ebx - 3;
        							_t108 = __ecx + 0x408408; // 0x121110
        							__ecx =  *_t108;
        							 *(__ebp - 0x40) =  *(__ebp - 0x40) >> 3;
        							 *(__esi + 0xc +  *_t108 * 4) =  *(__ebp - 0x40) & 0x00000007;
        							__ecx = __esi[1];
        							__esi[2] = __esi[2] + 1;
        							__eax = __esi[2];
        							__esi[1] >> 0xa = (__esi[1] >> 0xa) + 4;
        							if(__esi[2] < (__esi[1] >> 0xa) + 4) {
        								goto L64;
        							}
        							L66:
        							while(1) {
        								L68:
        								if(__esi[2] >= 0x13) {
        									break;
        								}
        								L67:
        								_t119 = __esi[2] + 0x408408; // 0x4000300
        								__eax =  *_t119;
        								 *(__esi + 0xc +  *_t119 * 4) =  *(__esi + 0xc +  *_t119 * 4) & 0x00000000;
        								_t126 =  &(__esi[2]);
        								 *_t126 = __esi[2] + 1;
        							}
        							L69:
        							__ecx = __ebp - 8;
        							__edi =  &(__esi[0x143]);
        							 &(__esi[0x148]) =  &(__esi[0x144]);
        							__eax = 0;
        							 *(__ebp - 8) = 0;
        							__eax =  &(__esi[3]);
        							 *__edi = 7;
        							__eax = E0040711C( &(__esi[3]), 0x13, 0x13, 0, 0,  &(__esi[0x144]), __edi,  &(__esi[0x148]), __ebp - 8);
        							if(__eax != 0) {
        								L72:
        								 *__esi = 0x11;
        								while(1) {
        									L180:
        									_t396 =  *_t446;
        									if(_t396 > 0xf) {
        										break;
        									}
        									L1:
        									switch( *((intOrPtr*)(_t396 * 4 +  &M00407074))) {
        										case 0:
        											L101:
        											__eax = __esi[4] & 0x000000ff;
        											__esi[3] = __esi[4] & 0x000000ff;
        											__eax = __esi[5];
        											__esi[2] = __esi[5];
        											 *__esi = 1;
        											goto L102;
        										case 1:
        											L102:
        											__eax = __esi[3];
        											while(1) {
        												L105:
        												__eflags = __ebx - __eax;
        												if(__ebx >= __eax) {
        													break;
        												}
        												L103:
        												__eflags =  *(__ebp - 0x34);
        												if( *(__ebp - 0x34) == 0) {
        													goto L182;
        												}
        												L104:
        												__ecx =  *(__ebp - 0x38);
        												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
        												__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
        												__ecx = __ebx;
        												__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
        												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
        												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
        												__ebx = __ebx + 8;
        												__eflags = __ebx;
        											}
        											L106:
        											__eax =  *(0x40a408 + __eax * 2) & 0x0000ffff;
        											__eax = __eax &  *(__ebp - 0x40);
        											__ecx = __esi[2];
        											__eax = __esi[2] + __eax * 4;
        											__ecx =  *(__eax + 1) & 0x000000ff;
        											 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
        											__ebx = __ebx - ( *(__eax + 1) & 0x000000ff);
        											__ecx =  *__eax & 0x000000ff;
        											__eflags = __ecx;
        											if(__ecx != 0) {
        												L108:
        												__eflags = __cl & 0x00000010;
        												if((__cl & 0x00000010) == 0) {
        													L110:
        													__eflags = __cl & 0x00000040;
        													if((__cl & 0x00000040) == 0) {
        														goto L125;
        													}
        													L111:
        													__eflags = __cl & 0x00000020;
        													if((__cl & 0x00000020) == 0) {
        														goto L9;
        													}
        													L112:
        													 *__esi = 7;
        													goto L180;
        												}
        												L109:
        												__esi[2] = __ecx;
        												__esi[1] = __eax;
        												 *__esi = 2;
        												goto L180;
        											}
        											L107:
        											__esi[2] = __eax;
        											 *__esi = 6;
        											goto L180;
        										case 2:
        											L113:
        											__eax = __esi[2];
        											while(1) {
        												L116:
        												__eflags = __ebx - __eax;
        												if(__ebx >= __eax) {
        													break;
        												}
        												L114:
        												__eflags =  *(__ebp - 0x34);
        												if( *(__ebp - 0x34) == 0) {
        													goto L182;
        												}
        												L115:
        												__ecx =  *(__ebp - 0x38);
        												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
        												__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
        												__ecx = __ebx;
        												__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
        												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
        												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
        												__ebx = __ebx + 8;
        												__eflags = __ebx;
        											}
        											L117:
        											 *(0x40a408 + __eax * 2) & 0x0000ffff =  *(0x40a408 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40);
        											__esi[1] = __esi[1] + ( *(0x40a408 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40));
        											__ecx = __eax;
        											 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
        											__ebx = __ebx - __eax;
        											__eflags = __ebx;
        											__eax = __esi[4] & 0x000000ff;
        											__esi[3] = __esi[4] & 0x000000ff;
        											__eax = __esi[6];
        											__esi[2] = __esi[6];
        											 *__esi = 3;
        											goto L118;
        										case 3:
        											L118:
        											__eax = __esi[3];
        											while(1) {
        												L121:
        												__eflags = __ebx - __eax;
        												if(__ebx >= __eax) {
        													break;
        												}
        												L119:
        												__eflags =  *(__ebp - 0x34);
        												if( *(__ebp - 0x34) == 0) {
        													goto L182;
        												}
        												L120:
        												__ecx =  *(__ebp - 0x38);
        												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
        												__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
        												__ecx = __ebx;
        												__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
        												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
        												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
        												__ebx = __ebx + 8;
        												__eflags = __ebx;
        											}
        											L122:
        											__eax =  *(0x40a408 + __eax * 2) & 0x0000ffff;
        											__eax = __eax &  *(__ebp - 0x40);
        											__ecx = __esi[2];
        											__eax = __esi[2] + __eax * 4;
        											__ecx =  *(__eax + 1) & 0x000000ff;
        											 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
        											__ebx = __ebx - ( *(__eax + 1) & 0x000000ff);
        											__ecx =  *__eax & 0x000000ff;
        											__eflags = __cl & 0x00000010;
        											if((__cl & 0x00000010) == 0) {
        												L124:
        												__eflags = __cl & 0x00000040;
        												if((__cl & 0x00000040) != 0) {
        													goto L9;
        												}
        												L125:
        												__esi[3] = __ecx;
        												__ecx =  *(__eax + 2) & 0x0000ffff;
        												__esi[2] = __eax;
        												goto L180;
        											}
        											L123:
        											__esi[2] = __ecx;
        											__esi[3] = __eax;
        											 *__esi = 4;
        											goto L180;
        										case 4:
        											L126:
        											__eax = __esi[2];
        											while(1) {
        												L129:
        												__eflags = __ebx - __eax;
        												if(__ebx >= __eax) {
        													break;
        												}
        												L127:
        												__eflags =  *(__ebp - 0x34);
        												if( *(__ebp - 0x34) == 0) {
        													goto L182;
        												}
        												L128:
        												__ecx =  *(__ebp - 0x38);
        												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
        												__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
        												__ecx = __ebx;
        												__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
        												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
        												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
        												__ebx = __ebx + 8;
        												__eflags = __ebx;
        											}
        											L130:
        											 *(0x40a408 + __eax * 2) & 0x0000ffff =  *(0x40a408 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40);
        											__esi[3] = __esi[3] + ( *(0x40a408 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40));
        											__ecx = __eax;
        											 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
        											__ebx = __ebx - __eax;
        											__eflags = __ebx;
        											 *__esi = 5;
        											goto L131;
        										case 5:
        											L131:
        											__eax =  *(__ebp - 0x30);
        											__edx = __esi[3];
        											__eax = __eax - __esi;
        											__ecx = __eax - __esi - 0x1ba0;
        											__eflags = __eax - __esi - 0x1ba0 - __edx;
        											if(__eax - __esi - 0x1ba0 >= __edx) {
        												__ecx = __eax;
        												__ecx = __eax - __edx;
        												__eflags = __ecx;
        											} else {
        												__esi[0x26e8] = __esi[0x26e8] - __edx;
        												__ecx = __esi[0x26e8] - __edx - __esi;
        												__ecx = __esi[0x26e8] - __edx - __esi + __eax - 0x1ba0;
        											}
        											__eflags = __esi[1];
        											 *(__ebp - 0x20) = __ecx;
        											if(__esi[1] != 0) {
        												L135:
        												__edi =  *(__ebp - 0x2c);
        												do {
        													L136:
        													__eflags = __edi;
        													if(__edi != 0) {
        														goto L152;
        													}
        													L137:
        													__edi = __esi[0x26e8];
        													__eflags = __eax - __edi;
        													if(__eax != __edi) {
        														L143:
        														__esi[0x26ea] = __eax;
        														__eax = E004070B4( *((intOrPtr*)(__ebp + 8)));
        														__eax = __esi[0x26ea];
        														__ecx = __esi[0x26e9];
        														__eflags = __eax - __ecx;
        														 *(__ebp - 0x30) = __eax;
        														if(__eax >= __ecx) {
        															__edi = __esi[0x26e8];
        															__edi = __esi[0x26e8] - __eax;
        															__eflags = __edi;
        														} else {
        															__ecx = __ecx - __eax;
        															__edi = __ecx - __eax - 1;
        														}
        														__edx = __esi[0x26e8];
        														__eflags = __eax - __edx;
        														 *(__ebp - 8) = __edx;
        														if(__eax == __edx) {
        															__edx =  &(__esi[0x6e8]);
        															__eflags = __ecx - __edx;
        															if(__ecx != __edx) {
        																__eax = __edx;
        																__eflags = __eax - __ecx;
        																 *(__ebp - 0x30) = __eax;
        																if(__eax >= __ecx) {
        																	__edi =  *(__ebp - 8);
        																	__edi =  *(__ebp - 8) - __eax;
        																	__eflags = __edi;
        																} else {
        																	__ecx = __ecx - __eax;
        																	__edi = __ecx;
        																}
        															}
        														}
        														__eflags = __edi;
        														if(__edi == 0) {
        															goto L183;
        														} else {
        															goto L152;
        														}
        													}
        													L138:
        													__ecx = __esi[0x26e9];
        													__edx =  &(__esi[0x6e8]);
        													__eflags = __ecx - __edx;
        													if(__ecx == __edx) {
        														goto L143;
        													}
        													L139:
        													__eax = __edx;
        													__eflags = __eax - __ecx;
        													if(__eax >= __ecx) {
        														__edi = __edi - __eax;
        														__eflags = __edi;
        													} else {
        														__ecx = __ecx - __eax;
        														__edi = __ecx;
        													}
        													__eflags = __edi;
        													if(__edi == 0) {
        														goto L143;
        													}
        													L152:
        													__ecx =  *(__ebp - 0x20);
        													 *__eax =  *__ecx;
        													__eax = __eax + 1;
        													__ecx = __ecx + 1;
        													__edi = __edi - 1;
        													__eflags = __ecx - __esi[0x26e8];
        													 *(__ebp - 0x30) = __eax;
        													 *(__ebp - 0x20) = __ecx;
        													 *(__ebp - 0x2c) = __edi;
        													if(__ecx == __esi[0x26e8]) {
        														__ecx =  &(__esi[0x6e8]);
        														 *(__ebp - 0x20) =  &(__esi[0x6e8]);
        													}
        													_t357 =  &(__esi[1]);
        													 *_t357 = __esi[1] - 1;
        													__eflags =  *_t357;
        												} while ( *_t357 != 0);
        											}
        											goto L23;
        										case 6:
        											L156:
        											__eax =  *(__ebp - 0x2c);
        											__edi =  *(__ebp - 0x30);
        											__eflags = __eax;
        											if(__eax != 0) {
        												L172:
        												__cl = __esi[2];
        												 *__edi = __cl;
        												__edi = __edi + 1;
        												__eax = __eax - 1;
        												 *(__ebp - 0x30) = __edi;
        												 *(__ebp - 0x2c) = __eax;
        												goto L23;
        											}
        											L157:
        											__ecx = __esi[0x26e8];
        											__eflags = __edi - __ecx;
        											if(__edi != __ecx) {
        												L163:
        												__esi[0x26ea] = __edi;
        												__eax = E004070B4( *((intOrPtr*)(__ebp + 8)));
        												__edi = __esi[0x26ea];
        												__ecx = __esi[0x26e9];
        												__eflags = __edi - __ecx;
        												 *(__ebp - 0x30) = __edi;
        												if(__edi >= __ecx) {
        													__eax = __esi[0x26e8];
        													__eax = __esi[0x26e8] - __edi;
        													__eflags = __eax;
        												} else {
        													__ecx = __ecx - __edi;
        													__eax = __ecx - __edi - 1;
        												}
        												__edx = __esi[0x26e8];
        												__eflags = __edi - __edx;
        												 *(__ebp - 8) = __edx;
        												if(__edi == __edx) {
        													__edx =  &(__esi[0x6e8]);
        													__eflags = __ecx - __edx;
        													if(__ecx != __edx) {
        														__edi = __edx;
        														__eflags = __edi - __ecx;
        														 *(__ebp - 0x30) = __edi;
        														if(__edi >= __ecx) {
        															__eax =  *(__ebp - 8);
        															__eax =  *(__ebp - 8) - __edi;
        															__eflags = __eax;
        														} else {
        															__ecx = __ecx - __edi;
        															__eax = __ecx;
        														}
        													}
        												}
        												__eflags = __eax;
        												if(__eax == 0) {
        													goto L183;
        												} else {
        													goto L172;
        												}
        											}
        											L158:
        											__eax = __esi[0x26e9];
        											__edx =  &(__esi[0x6e8]);
        											__eflags = __eax - __edx;
        											if(__eax == __edx) {
        												goto L163;
        											}
        											L159:
        											__edi = __edx;
        											__eflags = __edi - __eax;
        											if(__edi >= __eax) {
        												__ecx = __ecx - __edi;
        												__eflags = __ecx;
        												__eax = __ecx;
        											} else {
        												__eax = __eax - __edi;
        												__eax = __eax - 1;
        											}
        											__eflags = __eax;
        											if(__eax != 0) {
        												goto L172;
        											} else {
        												goto L163;
        											}
        										case 7:
        											L173:
        											__eflags = __ebx - 7;
        											if(__ebx > 7) {
        												__ebx = __ebx - 8;
        												 *(__ebp - 0x34) =  *(__ebp - 0x34) + 1;
        												_t380 = __ebp - 0x38;
        												 *_t380 =  *(__ebp - 0x38) - 1;
        												__eflags =  *_t380;
        											}
        											goto L175;
        										case 8:
        											L4:
        											while(_t425 < 3) {
        												if( *(_t448 - 0x34) == 0) {
        													goto L182;
        												} else {
        													 *(_t448 - 0x34) =  *(_t448 - 0x34) - 1;
        													 *(_t448 - 0x40) =  *(_t448 - 0x40) | ( *( *(_t448 - 0x38)) & 0x000000ff) << _t425;
        													 *(_t448 - 0x38) =  &(( *(_t448 - 0x38))[1]);
        													_t425 = _t425 + 8;
        													continue;
        												}
        											}
        											_t425 = _t425 - 3;
        											 *(_t448 - 0x40) =  *(_t448 - 0x40) >> 3;
        											_t406 =  *(_t448 - 0x40) & 0x00000007;
        											asm("sbb ecx, ecx");
        											_t408 = _t406 >> 1;
        											_t446[0x145] = ( ~(_t406 & 0x00000001) & 0x00000007) + 8;
        											if(_t408 == 0) {
        												L24:
        												 *_t446 = 9;
        												_t436 = _t425 & 0x00000007;
        												 *(_t448 - 0x40) =  *(_t448 - 0x40) >> _t436;
        												_t425 = _t425 - _t436;
        												goto L180;
        											}
        											L6:
        											_t411 = _t408 - 1;
        											if(_t411 == 0) {
        												L13:
        												__eflags =  *0x42e3a8;
        												if( *0x42e3a8 != 0) {
        													L22:
        													_t412 =  *0x40a42c; // 0x9
        													_t446[4] = _t412;
        													_t413 =  *0x40a430; // 0x5
        													_t446[4] = _t413;
        													_t414 =  *0x42d224; // 0x0
        													_t446[5] = _t414;
        													_t415 =  *0x42d220; // 0x0
        													_t446[6] = _t415;
        													L23:
        													 *_t446 =  *_t446 & 0x00000000;
        													goto L180;
        												} else {
        													_t26 = _t448 - 8;
        													 *_t26 =  *(_t448 - 8) & 0x00000000;
        													__eflags =  *_t26;
        													_t416 = 0x42d228;
        													goto L15;
        													L20:
        													 *_t416 = _t438;
        													_t416 = _t416 + 4;
        													__eflags = _t416 - 0x42d6a8;
        													if(_t416 < 0x42d6a8) {
        														L15:
        														__eflags = _t416 - 0x42d464;
        														_t438 = 8;
        														if(_t416 > 0x42d464) {
        															__eflags = _t416 - 0x42d628;
        															if(_t416 >= 0x42d628) {
        																__eflags = _t416 - 0x42d688;
        																if(_t416 < 0x42d688) {
        																	_t438 = 7;
        																}
        															} else {
        																_t438 = 9;
        															}
        														}
        														goto L20;
        													} else {
        														E0040711C(0x42d228, 0x120, 0x101, 0x40841c, 0x40845c, 0x42d224, 0x40a42c, 0x42db28, _t448 - 8);
        														_push(0x1e);
        														_pop(_t440);
        														_push(5);
        														_pop(_t419);
        														memset(0x42d228, _t419, _t440 << 2);
        														_t450 = _t450 + 0xc;
        														_t442 = 0x42d228 + _t440;
        														E0040711C(0x42d228, 0x1e, 0, 0x40849c, 0x4084d8, 0x42d220, 0x40a430, 0x42db28, _t448 - 8);
        														 *0x42e3a8 =  *0x42e3a8 + 1;
        														__eflags =  *0x42e3a8;
        														goto L22;
        													}
        												}
        											}
        											L7:
        											_t423 = _t411 - 1;
        											if(_t423 == 0) {
        												 *_t446 = 0xb;
        												goto L180;
        											}
        											L8:
        											if(_t423 != 1) {
        												goto L180;
        											}
        											goto L9;
        										case 9:
        											while(1) {
        												L27:
        												__eflags = __ebx - 0x20;
        												if(__ebx >= 0x20) {
        													break;
        												}
        												L25:
        												__eflags =  *(__ebp - 0x34);
        												if( *(__ebp - 0x34) == 0) {
        													goto L182;
        												}
        												L26:
        												__eax =  *(__ebp - 0x38);
        												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
        												__ecx = __ebx;
        												 *( *(__ebp - 0x38)) & 0x000000ff = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
        												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
        												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
        												__ebx = __ebx + 8;
        												__eflags = __ebx;
        											}
        											L28:
        											__eax =  *(__ebp - 0x40);
        											__ebx = 0;
        											__eax =  *(__ebp - 0x40) & 0x0000ffff;
        											 *(__ebp - 0x40) = 0;
        											__eflags = __eax;
        											__esi[1] = __eax;
        											if(__eax == 0) {
        												goto L53;
        											}
        											L29:
        											_push(0xa);
        											_pop(__eax);
        											goto L54;
        										case 0xa:
        											L30:
        											__eflags =  *(__ebp - 0x34);
        											if( *(__ebp - 0x34) == 0) {
        												goto L182;
        											}
        											L31:
        											__eax =  *(__ebp - 0x2c);
        											__eflags = __eax;
        											if(__eax != 0) {
        												L48:
        												__eflags = __eax -  *(__ebp - 0x34);
        												if(__eax >=  *(__ebp - 0x34)) {
        													__eax =  *(__ebp - 0x34);
        												}
        												__ecx = __esi[1];
        												__eflags = __ecx - __eax;
        												__edi = __ecx;
        												if(__ecx >= __eax) {
        													__edi = __eax;
        												}
        												__eax = E00405C4B( *(__ebp - 0x30),  *(__ebp - 0x38), __edi);
        												 *(__ebp - 0x38) =  *(__ebp - 0x38) + __edi;
        												 *(__ebp - 0x34) =  *(__ebp - 0x34) - __edi;
        												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __edi;
        												 *(__ebp - 0x2c) =  *(__ebp - 0x2c) - __edi;
        												_t80 =  &(__esi[1]);
        												 *_t80 = __esi[1] - __edi;
        												__eflags =  *_t80;
        												if( *_t80 == 0) {
        													L53:
        													__eax = __esi[0x145];
        													L54:
        													 *__esi = __eax;
        												}
        												goto L180;
        											}
        											L32:
        											__ecx = __esi[0x26e8];
        											__edx =  *(__ebp - 0x30);
        											__eflags = __edx - __ecx;
        											if(__edx != __ecx) {
        												L38:
        												__esi[0x26ea] = __edx;
        												__eax = E004070B4( *((intOrPtr*)(__ebp + 8)));
        												__edx = __esi[0x26ea];
        												__ecx = __esi[0x26e9];
        												__eflags = __edx - __ecx;
        												 *(__ebp - 0x30) = __edx;
        												if(__edx >= __ecx) {
        													__eax = __esi[0x26e8];
        													__eax = __esi[0x26e8] - __edx;
        													__eflags = __eax;
        												} else {
        													__ecx = __ecx - __edx;
        													__eax = __ecx - __edx - 1;
        												}
        												__edi = __esi[0x26e8];
        												 *(__ebp - 0x2c) = __eax;
        												__eflags = __edx - __edi;
        												if(__edx == __edi) {
        													__edx =  &(__esi[0x6e8]);
        													__eflags = __edx - __ecx;
        													if(__eflags != 0) {
        														 *(__ebp - 0x30) = __edx;
        														if(__eflags >= 0) {
        															__edi = __edi - __edx;
        															__eflags = __edi;
        															__eax = __edi;
        														} else {
        															__ecx = __ecx - __edx;
        															__eax = __ecx;
        														}
        														 *(__ebp - 0x2c) = __eax;
        													}
        												}
        												__eflags = __eax;
        												if(__eax == 0) {
        													goto L183;
        												} else {
        													goto L48;
        												}
        											}
        											L33:
        											__eax = __esi[0x26e9];
        											__edi =  &(__esi[0x6e8]);
        											__eflags = __eax - __edi;
        											if(__eax == __edi) {
        												goto L38;
        											}
        											L34:
        											__edx = __edi;
        											__eflags = __edx - __eax;
        											 *(__ebp - 0x30) = __edx;
        											if(__edx >= __eax) {
        												__ecx = __ecx - __edx;
        												__eflags = __ecx;
        												__eax = __ecx;
        											} else {
        												__eax = __eax - __edx;
        												__eax = __eax - 1;
        											}
        											__eflags = __eax;
        											 *(__ebp - 0x2c) = __eax;
        											if(__eax != 0) {
        												goto L48;
        											} else {
        												goto L38;
        											}
        										case 0xb:
        											goto L56;
        										case 0xc:
        											L60:
        											__esi[1] = __esi[1] >> 0xa;
        											__eax = (__esi[1] >> 0xa) + 4;
        											if(__esi[2] >= (__esi[1] >> 0xa) + 4) {
        												goto L68;
        											}
        											goto L61;
        										case 0xd:
        											while(1) {
        												L93:
        												__eax = __esi[1];
        												__ecx = __esi[2];
        												__edx = __eax;
        												__eax = __eax & 0x0000001f;
        												__edx = __edx >> 5;
        												__eax = __edx + __eax + 0x102;
        												__eflags = __esi[2] - __eax;
        												if(__esi[2] >= __eax) {
        													break;
        												}
        												L73:
        												__eax = __esi[0x143];
        												while(1) {
        													L76:
        													__eflags = __ebx - __eax;
        													if(__ebx >= __eax) {
        														break;
        													}
        													L74:
        													__eflags =  *(__ebp - 0x34);
        													if( *(__ebp - 0x34) == 0) {
        														goto L182;
        													}
        													L75:
        													__ecx =  *(__ebp - 0x38);
        													 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
        													__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
        													__ecx = __ebx;
        													__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
        													 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
        													 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
        													__ebx = __ebx + 8;
        													__eflags = __ebx;
        												}
        												L77:
        												__eax =  *(0x40a408 + __eax * 2) & 0x0000ffff;
        												__eax = __eax &  *(__ebp - 0x40);
        												__ecx = __esi[0x144];
        												__eax = __esi[0x144] + __eax * 4;
        												__edx =  *(__eax + 1) & 0x000000ff;
        												__eax =  *(__eax + 2) & 0x0000ffff;
        												__eflags = __eax - 0x10;
        												 *(__ebp - 0x14) = __eax;
        												if(__eax >= 0x10) {
        													L79:
        													__eflags = __eax - 0x12;
        													if(__eax != 0x12) {
        														__eax = __eax + 0xfffffff2;
        														 *(__ebp - 8) = 3;
        													} else {
        														_push(7);
        														 *(__ebp - 8) = 0xb;
        														_pop(__eax);
        													}
        													while(1) {
        														L84:
        														__ecx = __eax + __edx;
        														__eflags = __ebx - __eax + __edx;
        														if(__ebx >= __eax + __edx) {
        															break;
        														}
        														L82:
        														__eflags =  *(__ebp - 0x34);
        														if( *(__ebp - 0x34) == 0) {
        															goto L182;
        														}
        														L83:
        														__ecx =  *(__ebp - 0x38);
        														 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
        														__edi =  *( *(__ebp - 0x38)) & 0x000000ff;
        														__ecx = __ebx;
        														__edi = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
        														 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
        														 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
        														__ebx = __ebx + 8;
        														__eflags = __ebx;
        													}
        													L85:
        													__ecx = __edx;
        													__ebx = __ebx - __edx;
        													 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
        													 *(0x40a408 + __eax * 2) & 0x0000ffff =  *(0x40a408 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40);
        													__edx =  *(__ebp - 8);
        													__ebx = __ebx - __eax;
        													__edx =  *(__ebp - 8) + ( *(0x40a408 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40));
        													__ecx = __eax;
        													__eax = __esi[1];
        													 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
        													__ecx = __esi[2];
        													__eax = __eax >> 5;
        													__edi = __eax >> 0x00000005 & 0x0000001f;
        													__eax = __eax & 0x0000001f;
        													__eax = __edi + __eax + 0x102;
        													__edi = __edx + __ecx;
        													__eflags = __edx + __ecx - __eax;
        													if(__edx + __ecx > __eax) {
        														goto L9;
        													}
        													L86:
        													__eflags =  *(__ebp - 0x14) - 0x10;
        													if( *(__ebp - 0x14) != 0x10) {
        														L89:
        														__edi = 0;
        														__eflags = 0;
        														L90:
        														__eax = __esi + 0xc + __ecx * 4;
        														do {
        															L91:
        															 *__eax = __edi;
        															__ecx = __ecx + 1;
        															__eax = __eax + 4;
        															__edx = __edx - 1;
        															__eflags = __edx;
        														} while (__edx != 0);
        														__esi[2] = __ecx;
        														continue;
        													}
        													L87:
        													__eflags = __ecx - 1;
        													if(__ecx < 1) {
        														goto L9;
        													}
        													L88:
        													__edi =  *(__esi + 8 + __ecx * 4);
        													goto L90;
        												}
        												L78:
        												__ecx = __edx;
        												__ebx = __ebx - __edx;
        												 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
        												__ecx = __esi[2];
        												 *(__esi + 0xc + __esi[2] * 4) = __eax;
        												__esi[2] = __esi[2] + 1;
        											}
        											L94:
        											__eax = __esi[1];
        											__esi[0x144] = __esi[0x144] & 0x00000000;
        											 *(__ebp - 0xc) =  *(__ebp - 0xc) & 0x00000000;
        											__edi = __eax;
        											__eax = __eax >> 5;
        											__edi = __edi & 0x0000001f;
        											__ecx = 0x101;
        											__eax = __eax & 0x0000001f;
        											__edi = __edi + 0x101;
        											__eax = __eax + 1;
        											__edx = __ebp - 0xc;
        											 *(__ebp - 0x14) = __eax;
        											 &(__esi[0x148]) = __ebp - 4;
        											 *(__ebp - 4) = 9;
        											__ebp - 0x18 =  &(__esi[3]);
        											 *(__ebp - 0x10) = 6;
        											__eax = E0040711C( &(__esi[3]), __edi, 0x101, 0x40841c, 0x40845c, __ebp - 0x18, __ebp - 4,  &(__esi[0x148]), __ebp - 0xc);
        											__eflags =  *(__ebp - 4);
        											if( *(__ebp - 4) == 0) {
        												__eax = __eax | 0xffffffff;
        												__eflags = __eax;
        											}
        											__eflags = __eax;
        											if(__eax != 0) {
        												goto L9;
        											} else {
        												L97:
        												__ebp - 0xc =  &(__esi[0x148]);
        												__ebp - 0x10 = __ebp - 0x1c;
        												__eax = __esi + 0xc + __edi * 4;
        												__eax = E0040711C(__esi + 0xc + __edi * 4,  *(__ebp - 0x14), 0, 0x40849c, 0x4084d8, __ebp - 0x1c, __ebp - 0x10,  &(__esi[0x148]), __ebp - 0xc);
        												__eflags = __eax;
        												if(__eax != 0) {
        													goto L9;
        												}
        												L98:
        												__eax =  *(__ebp - 0x10);
        												__eflags =  *(__ebp - 0x10);
        												if( *(__ebp - 0x10) != 0) {
        													L100:
        													__cl =  *(__ebp - 4);
        													 *__esi =  *__esi & 0x00000000;
        													__eflags =  *__esi;
        													__esi[4] = __al;
        													__eax =  *(__ebp - 0x18);
        													__esi[5] =  *(__ebp - 0x18);
        													__eax =  *(__ebp - 0x1c);
        													__esi[4] = __cl;
        													__esi[6] =  *(__ebp - 0x1c);
        													goto L101;
        												}
        												L99:
        												__eflags = __edi - 0x101;
        												if(__edi > 0x101) {
        													goto L9;
        												}
        												goto L100;
        											}
        										case 0xe:
        											goto L9;
        										case 0xf:
        											L175:
        											__eax =  *(__ebp - 0x30);
        											__esi[0x26ea] =  *(__ebp - 0x30);
        											__eax = E004070B4( *((intOrPtr*)(__ebp + 8)));
        											__ecx = __esi[0x26ea];
        											__edx = __esi[0x26e9];
        											__eflags = __ecx - __edx;
        											 *(__ebp - 0x30) = __ecx;
        											if(__ecx >= __edx) {
        												__eax = __esi[0x26e8];
        												__eax = __esi[0x26e8] - __ecx;
        												__eflags = __eax;
        											} else {
        												__edx = __edx - __ecx;
        												__eax = __edx - __ecx - 1;
        											}
        											__eflags = __ecx - __edx;
        											 *(__ebp - 0x2c) = __eax;
        											if(__ecx != __edx) {
        												L183:
        												__edi = 0;
        												goto L10;
        											} else {
        												L179:
        												__eax = __esi[0x145];
        												__eflags = __eax - 8;
        												 *__esi = __eax;
        												if(__eax != 8) {
        													L184:
        													0 = 1;
        													goto L10;
        												}
        												goto L180;
        											}
        									}
        								}
        								L181:
        								goto L9;
        							}
        							L70:
        							if( *__edi == __eax) {
        								goto L72;
        							}
        							L71:
        							__esi[2] = __esi[2] & __eax;
        							 *__esi = 0xd;
        							goto L93;
        						}
        					}
        				}
        				L182:
        				_t443 = 0;
        				_t446[0x147] =  *(_t448 - 0x40);
        				_t446[0x146] = _t425;
        				( *(_t448 + 8))[1] = 0;
        				goto L11;
        			}









        0x00406945
        0x00406945
        0x00406945
        0x00406945
        0x00406945
        0x00406949
        0x00000000
        0x00000000
        0x0040694f
        0x0040694f
        0x00406952
        0x00406955
        0x0040695a
        0x0040695c
        0x0040695f
        0x00406962
        0x00406965
        0x00406965
        0x00406968
        0x00000000
        0x00000000
        0x0040696a
        0x0040696a
        0x0040696d
        0x00406972
        0x00406974
        0x00406977
        0x0040697d
        0x004066dc
        0x004066dc
        0x004066df
        0x004066e5
        0x004066eb
        0x004066f4
        0x004066fa
        0x004066fd
        0x00406704
        0x00406709
        0x0040670f
        0x0040671a
        0x0040671a
        0x00406983
        0x00406983
        0x0040698d
        0x00000000
        0x00000000
        0x00406993
        0x00406993
        0x00406997
        0x0040699a
        0x0040699a
        0x0040699e
        0x004069a4
        0x004069a4
        0x004069a7
        0x004069aa
        0x004069b0
        0x00000000
        0x00000000
        0x004069b2
        0x004069d4
        0x004069d4
        0x004069d7
        0x00000000
        0x00000000
        0x004069b4
        0x004069b8
        0x00000000
        0x00000000
        0x004069be
        0x004069be
        0x004069c1
        0x004069c4
        0x004069c9
        0x004069cb
        0x004069ce
        0x004069d1
        0x004069d1
        0x004069d9
        0x004069d9
        0x004069df
        0x004069e2
        0x004069e5
        0x004069e5
        0x004069ec
        0x004069f0
        0x004069f4
        0x004069f7
        0x004069fa
        0x00406a00
        0x00406a05
        0x00000000
        0x00000000
        0x00406a07
        0x00406a1b
        0x00406a1b
        0x00406a1f
        0x00000000
        0x00000000
        0x00406a09
        0x00406a0c
        0x00406a0c
        0x00406a13
        0x00406a18
        0x00406a18
        0x00406a18
        0x00406a21
        0x00406a21
        0x00406a24
        0x00406a32
        0x00406a38
        0x00406a3d
        0x00406a43
        0x00406a49
        0x00406a4f
        0x00406a56
        0x00406a6a
        0x00406a6a
        0x00407039
        0x00407039
        0x00407039
        0x0040703e
        0x00000000
        0x00000000
        0x00406676
        0x00406676
        0x00000000
        0x00406c71
        0x00406c71
        0x00406c75
        0x00406c78
        0x00406c7b
        0x00406c7e
        0x00000000
        0x00000000
        0x00406c84
        0x00406c84
        0x00406ca9
        0x00406ca9
        0x00406ca9
        0x00406cab
        0x00000000
        0x00000000
        0x00406c89
        0x00406c89
        0x00406c8d
        0x00000000
        0x00000000
        0x00406c93
        0x00406c93
        0x00406c96
        0x00406c99
        0x00406c9c
        0x00406c9e
        0x00406ca0
        0x00406ca3
        0x00406ca6
        0x00406ca6
        0x00406ca6
        0x00406cad
        0x00406cad
        0x00406cb5
        0x00406cb8
        0x00406cbb
        0x00406cbe
        0x00406cc2
        0x00406cc5
        0x00406cc7
        0x00406cca
        0x00406ccc
        0x00406ce0
        0x00406ce0
        0x00406ce3
        0x00406cfd
        0x00406cfd
        0x00406d00
        0x00000000
        0x00000000
        0x00406d06
        0x00406d06
        0x00406d09
        0x00000000
        0x00000000
        0x00406d0f
        0x00406d0f
        0x00000000
        0x00406d0f
        0x00406ce5
        0x00406ce8
        0x00406cef
        0x00406cf2
        0x00000000
        0x00406cf2
        0x00406cce
        0x00406cd2
        0x00406cd5
        0x00000000
        0x00000000
        0x00406d1a
        0x00406d1a
        0x00406d3f
        0x00406d3f
        0x00406d3f
        0x00406d41
        0x00000000
        0x00000000
        0x00406d1f
        0x00406d1f
        0x00406d23
        0x00000000
        0x00000000
        0x00406d29
        0x00406d29
        0x00406d2c
        0x00406d2f
        0x00406d32
        0x00406d34
        0x00406d36
        0x00406d39
        0x00406d3c
        0x00406d3c
        0x00406d3c
        0x00406d43
        0x00406d4b
        0x00406d4e
        0x00406d51
        0x00406d53
        0x00406d56
        0x00406d56
        0x00406d58
        0x00406d5c
        0x00406d5f
        0x00406d62
        0x00406d65
        0x00000000
        0x00000000
        0x00406d6b
        0x00406d6b
        0x00406d90
        0x00406d90
        0x00406d90
        0x00406d92
        0x00000000
        0x00000000
        0x00406d70
        0x00406d70
        0x00406d74
        0x00000000
        0x00000000
        0x00406d7a
        0x00406d7a
        0x00406d7d
        0x00406d80
        0x00406d83
        0x00406d85
        0x00406d87
        0x00406d8a
        0x00406d8d
        0x00406d8d
        0x00406d8d
        0x00406d94
        0x00406d94
        0x00406d9c
        0x00406d9f
        0x00406da2
        0x00406da5
        0x00406da9
        0x00406dac
        0x00406dae
        0x00406db1
        0x00406db4
        0x00406dce
        0x00406dce
        0x00406dd1
        0x00000000
        0x00000000
        0x00406dd7
        0x00406dd7
        0x00406dda
        0x00406de1
        0x00000000
        0x00406de1
        0x00406db6
        0x00406db9
        0x00406dc0
        0x00406dc3
        0x00000000
        0x00000000
        0x00406de9
        0x00406de9
        0x00406e0e
        0x00406e0e
        0x00406e0e
        0x00406e10
        0x00000000
        0x00000000
        0x00406dee
        0x00406dee
        0x00406df2
        0x00000000
        0x00000000
        0x00406df8
        0x00406df8
        0x00406dfb
        0x00406dfe
        0x00406e01
        0x00406e03
        0x00406e05
        0x00406e08
        0x00406e0b
        0x00406e0b
        0x00406e0b
        0x00406e12
        0x00406e1a
        0x00406e1d
        0x00406e20
        0x00406e22
        0x00406e25
        0x00406e25
        0x00406e27
        0x00000000
        0x00000000
        0x00406e2d
        0x00406e2d
        0x00406e30
        0x00406e35
        0x00406e37
        0x00406e3d
        0x00406e3f
        0x00406e54
        0x00406e56
        0x00406e56
        0x00406e41
        0x00406e47
        0x00406e49
        0x00406e4b
        0x00406e4b
        0x00406e58
        0x00406e5c
        0x00406e5f
        0x00406e65
        0x00406e65
        0x00406e68
        0x00406e68
        0x00406e68
        0x00406e6a
        0x00000000
        0x00000000
        0x00406e70
        0x00406e70
        0x00406e76
        0x00406e78
        0x00406e9d
        0x00406ea0
        0x00406ea6
        0x00406eab
        0x00406eb1
        0x00406eb7
        0x00406eb9
        0x00406ebc
        0x00406ec5
        0x00406ecb
        0x00406ecb
        0x00406ebe
        0x00406ec0
        0x00406ec2
        0x00406ec2
        0x00406ecd
        0x00406ed3
        0x00406ed5
        0x00406ed8
        0x00406eda
        0x00406ee0
        0x00406ee2
        0x00406ee4
        0x00406ee6
        0x00406ee8
        0x00406eeb
        0x00406ef4
        0x00406ef7
        0x00406ef7
        0x00406eed
        0x00406eed
        0x00406ef0
        0x00406ef0
        0x00406eeb
        0x00406ee2
        0x00406ef9
        0x00406efb
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x00406efb
        0x00406e7a
        0x00406e7a
        0x00406e80
        0x00406e86
        0x00406e88
        0x00000000
        0x00000000
        0x00406e8a
        0x00406e8a
        0x00406e8c
        0x00406e8e
        0x00406e97
        0x00406e97
        0x00406e90
        0x00406e90
        0x00406e93
        0x00406e93
        0x00406e99
        0x00406e9b
        0x00000000
        0x00000000
        0x00406f01
        0x00406f01
        0x00406f06
        0x00406f08
        0x00406f09
        0x00406f0a
        0x00406f0b
        0x00406f11
        0x00406f14
        0x00406f17
        0x00406f1a
        0x00406f1c
        0x00406f22
        0x00406f22
        0x00406f25
        0x00406f25
        0x00406f25
        0x00406f25
        0x00406f2e
        0x00000000
        0x00000000
        0x00406f33
        0x00406f33
        0x00406f36
        0x00406f39
        0x00406f3b
        0x00406fd2
        0x00406fd2
        0x00406fd5
        0x00406fd7
        0x00406fd8
        0x00406fd9
        0x00406fdc
        0x00000000
        0x00406fdc
        0x00406f41
        0x00406f41
        0x00406f47
        0x00406f49
        0x00406f6e
        0x00406f71
        0x00406f77
        0x00406f7c
        0x00406f82
        0x00406f88
        0x00406f8a
        0x00406f8d
        0x00406f96
        0x00406f9c
        0x00406f9c
        0x00406f8f
        0x00406f91
        0x00406f93
        0x00406f93
        0x00406f9e
        0x00406fa4
        0x00406fa6
        0x00406fa9
        0x00406fab
        0x00406fb1
        0x00406fb3
        0x00406fb5
        0x00406fb7
        0x00406fb9
        0x00406fbc
        0x00406fc5
        0x00406fc8
        0x00406fc8
        0x00406fbe
        0x00406fbe
        0x00406fc1
        0x00406fc1
        0x00406fbc
        0x00406fb3
        0x00406fca
        0x00406fcc
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x00406fcc
        0x00406f4b
        0x00406f4b
        0x00406f51
        0x00406f57
        0x00406f59
        0x00000000
        0x00000000
        0x00406f5b
        0x00406f5b
        0x00406f5d
        0x00406f5f
        0x00406f66
        0x00406f66
        0x00406f68
        0x00406f61
        0x00406f61
        0x00406f63
        0x00406f63
        0x00406f6a
        0x00406f6c
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x00406fe4
        0x00406fe4
        0x00406fe7
        0x00406fe9
        0x00406fec
        0x00406fef
        0x00406fef
        0x00406fef
        0x00406fef
        0x00000000
        0x00000000
        0x00000000
        0x0040669d
        0x00406681
        0x00000000
        0x00406687
        0x0040668a
        0x00406694
        0x00406697
        0x0040669a
        0x00000000
        0x0040669a
        0x00406681
        0x004066a5
        0x004066a8
        0x004066ac
        0x004066b6
        0x004066c0
        0x004066c3
        0x004066c9
        0x004067fd
        0x004067ff
        0x00406805
        0x00406808
        0x0040680b
        0x00000000
        0x0040680b
        0x004066cf
        0x004066cf
        0x004066d0
        0x00406728
        0x00406728
        0x0040672f
        0x004067d5
        0x004067d5
        0x004067da
        0x004067dd
        0x004067e2
        0x004067e5
        0x004067ea
        0x004067ed
        0x004067f2
        0x004067f5
        0x004067f5
        0x00000000
        0x00406735
        0x00406735
        0x00406735
        0x00406735
        0x00406739
        0x00406739
        0x0040675b
        0x0040675e
        0x00406760
        0x00406763
        0x00406768
        0x0040673e
        0x0040673e
        0x00406743
        0x00406745
        0x00406747
        0x0040674c
        0x00406752
        0x00406757
        0x00406759
        0x00406759
        0x0040674e
        0x0040674e
        0x0040674e
        0x0040674c
        0x00000000
        0x0040676a
        0x00406797
        0x0040679c
        0x0040679e
        0x0040679f
        0x004067a1
        0x004067a2
        0x004067a2
        0x004067a2
        0x004067ca
        0x004067cf
        0x004067cf
        0x00000000
        0x004067cf
        0x00406768
        0x0040672f
        0x004066d2
        0x004066d2
        0x004066d3
        0x0040671d
        0x00000000
        0x0040671d
        0x004066d5
        0x004066d6
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x00406832
        0x00406832
        0x00406832
        0x00406835
        0x00000000
        0x00000000
        0x00406812
        0x00406812
        0x00406816
        0x00000000
        0x00000000
        0x0040681c
        0x0040681c
        0x0040681f
        0x00406822
        0x00406827
        0x00406829
        0x0040682c
        0x0040682f
        0x0040682f
        0x0040682f
        0x00406837
        0x00406837
        0x0040683a
        0x0040683c
        0x00406841
        0x00406844
        0x00406846
        0x00406849
        0x00000000
        0x00000000
        0x0040684f
        0x0040684f
        0x00406851
        0x00000000
        0x00000000
        0x00406857
        0x00406857
        0x0040685b
        0x00000000
        0x00000000
        0x00406861
        0x00406861
        0x00406864
        0x00406866
        0x00406904
        0x00406904
        0x00406907
        0x00406909
        0x00406909
        0x0040690c
        0x0040690f
        0x00406911
        0x00406913
        0x00406915
        0x00406915
        0x0040691e
        0x00406923
        0x00406926
        0x00406929
        0x0040692c
        0x0040692f
        0x0040692f
        0x0040692f
        0x00406932
        0x00406938
        0x00406938
        0x0040693e
        0x0040693e
        0x0040693e
        0x00000000
        0x00406932
        0x0040686c
        0x0040686c
        0x00406872
        0x00406875
        0x00406877
        0x004068a2
        0x004068a5
        0x004068ab
        0x004068b0
        0x004068b6
        0x004068bc
        0x004068be
        0x004068c1
        0x004068ca
        0x004068d0
        0x004068d0
        0x004068c3
        0x004068c5
        0x004068c7
        0x004068c7
        0x004068d2
        0x004068d8
        0x004068db
        0x004068dd
        0x004068df
        0x004068e5
        0x004068e7
        0x004068e9
        0x004068ec
        0x004068f5
        0x004068f5
        0x004068f7
        0x004068ee
        0x004068ee
        0x004068f1
        0x004068f1
        0x004068f9
        0x004068f9
        0x004068e7
        0x004068fc
        0x004068fe
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x004068fe
        0x00406879
        0x00406879
        0x0040687f
        0x00406885
        0x00406887
        0x00000000
        0x00000000
        0x00406889
        0x00406889
        0x0040688b
        0x0040688d
        0x00406890
        0x00406897
        0x00406897
        0x00406899
        0x00406892
        0x00406892
        0x00406894
        0x00406894
        0x0040689b
        0x0040689d
        0x004068a0
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x004069a4
        0x004069a7
        0x004069aa
        0x004069b0
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x00406b87
        0x00406b87
        0x00406b87
        0x00406b8a
        0x00406b8d
        0x00406b8f
        0x00406b92
        0x00406b98
        0x00406b9f
        0x00406ba1
        0x00000000
        0x00000000
        0x00406a75
        0x00406a75
        0x00406a9d
        0x00406a9d
        0x00406a9d
        0x00406a9f
        0x00000000
        0x00000000
        0x00406a7d
        0x00406a7d
        0x00406a81
        0x00000000
        0x00000000
        0x00406a87
        0x00406a87
        0x00406a8a
        0x00406a8d
        0x00406a90
        0x00406a92
        0x00406a94
        0x00406a97
        0x00406a9a
        0x00406a9a
        0x00406a9a
        0x00406aa1
        0x00406aa1
        0x00406aa9
        0x00406aac
        0x00406ab2
        0x00406ab5
        0x00406ab9
        0x00406abd
        0x00406ac0
        0x00406ac3
        0x00406adb
        0x00406adb
        0x00406ade
        0x00406aec
        0x00406aef
        0x00406ae0
        0x00406ae0
        0x00406ae2
        0x00406ae9
        0x00406ae9
        0x00406b18
        0x00406b18
        0x00406b18
        0x00406b1b
        0x00406b1d
        0x00000000
        0x00000000
        0x00406af8
        0x00406af8
        0x00406afc
        0x00000000
        0x00000000
        0x00406b02
        0x00406b02
        0x00406b05
        0x00406b08
        0x00406b0b
        0x00406b0d
        0x00406b0f
        0x00406b12
        0x00406b15
        0x00406b15
        0x00406b15
        0x00406b1f
        0x00406b1f
        0x00406b21
        0x00406b23
        0x00406b2e
        0x00406b31
        0x00406b34
        0x00406b36
        0x00406b38
        0x00406b3a
        0x00406b3d
        0x00406b40
        0x00406b45
        0x00406b48
        0x00406b4b
        0x00406b4e
        0x00406b55
        0x00406b58
        0x00406b5a
        0x00000000
        0x00000000
        0x00406b60
        0x00406b60
        0x00406b64
        0x00406b75
        0x00406b75
        0x00406b75
        0x00406b77
        0x00406b77
        0x00406b7b
        0x00406b7b
        0x00406b7b
        0x00406b7d
        0x00406b7e
        0x00406b81
        0x00406b81
        0x00406b81
        0x00406b84
        0x00000000
        0x00406b84
        0x00406b66
        0x00406b66
        0x00406b69
        0x00000000
        0x00000000
        0x00406b6f
        0x00406b6f
        0x00000000
        0x00406b6f
        0x00406ac5
        0x00406ac5
        0x00406ac7
        0x00406ac9
        0x00406acc
        0x00406acf
        0x00406ad3
        0x00406ad3
        0x00406ba7
        0x00406ba7
        0x00406baa
        0x00406bb1
        0x00406bb5
        0x00406bb7
        0x00406bba
        0x00406bbd
        0x00406bc2
        0x00406bc5
        0x00406bc7
        0x00406bc8
        0x00406bcb
        0x00406bd6
        0x00406bd9
        0x00406bf0
        0x00406bf5
        0x00406bfc
        0x00406c01
        0x00406c05
        0x00406c07
        0x00406c07
        0x00406c07
        0x00406c0a
        0x00406c0c
        0x00000000
        0x00406c12
        0x00406c12
        0x00406c16
        0x00406c21
        0x00406c34
        0x00406c39
        0x00406c3e
        0x00406c40
        0x00000000
        0x00000000
        0x00406c46
        0x00406c46
        0x00406c49
        0x00406c4b
        0x00406c59
        0x00406c59
        0x00406c5c
        0x00406c5c
        0x00406c5f
        0x00406c62
        0x00406c65
        0x00406c68
        0x00406c6b
        0x00406c6e
        0x00000000
        0x00406c6e
        0x00406c4d
        0x00406c4d
        0x00406c53
        0x00000000
        0x00000000
        0x00000000
        0x00406c53
        0x00000000
        0x00000000
        0x00000000
        0x00406ff2
        0x00406ff2
        0x00406ff8
        0x00406ffe
        0x00407003
        0x00407009
        0x0040700f
        0x00407011
        0x00407014
        0x0040701d
        0x00407023
        0x00407023
        0x00407016
        0x00407018
        0x0040701a
        0x0040701a
        0x00407025
        0x00407027
        0x0040702a
        0x00407065
        0x00407065
        0x00000000
        0x0040702c
        0x0040702c
        0x0040702c
        0x00407032
        0x00407035
        0x00407037
        0x0040706c
        0x0040706e
        0x00000000
        0x0040706e
        0x00000000
        0x00407037
        0x00000000
        0x00406676
        0x00407044
        0x00000000
        0x00407044
        0x00406a58
        0x00406a5a
        0x00000000
        0x00000000
        0x00406a5c
        0x00406a5c
        0x00406a5f
        0x00000000
        0x00406a5f
        0x004069a4
        0x00406965
        0x00407049
        0x0040704c
        0x0040704e
        0x00407057
        0x0040705d
        0x00000000

        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 1141b8caf72e3132df9e3aa140a50eda8930c9371ed3a7f86c2d2c6764d1ec0e
        • Instruction ID: f64ed9f862d89b69eb15ddc430260785fe10463149b241517d112065bf602f9e
        • Opcode Fuzzy Hash: 1141b8caf72e3132df9e3aa140a50eda8930c9371ed3a7f86c2d2c6764d1ec0e
        • Instruction Fuzzy Hash: 57E19BB190070ACFDB24CF59C880BAAB7F5EB45305F15892EE497A7291D378AA51CF14
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E0040711C(signed char _a4, char _a5, short _a6, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int* _a24, signed int _a28, intOrPtr _a32, signed int* _a36) {
        				signed int _v8;
        				unsigned int _v12;
        				signed int _v16;
        				intOrPtr _v20;
        				signed int _v24;
        				signed int _v28;
        				intOrPtr* _v32;
        				signed int* _v36;
        				signed int _v40;
        				signed int _v44;
        				intOrPtr _v48;
        				intOrPtr _v52;
        				void _v116;
        				signed int _v176;
        				signed int _v180;
        				signed int _v240;
        				signed int _t166;
        				signed int _t168;
        				intOrPtr _t175;
        				signed int _t181;
        				void* _t182;
        				intOrPtr _t183;
        				signed int* _t184;
        				signed int _t186;
        				signed int _t187;
        				signed int* _t189;
        				signed int _t190;
        				intOrPtr* _t191;
        				intOrPtr _t192;
        				signed int _t193;
        				signed int _t195;
        				signed int _t200;
        				signed int _t205;
        				void* _t207;
        				short _t208;
        				signed char _t222;
        				signed int _t224;
        				signed int _t225;
        				signed int* _t232;
        				signed int _t233;
        				signed int _t234;
        				void* _t235;
        				signed int _t236;
        				signed int _t244;
        				signed int _t246;
        				signed int _t251;
        				signed int _t254;
        				signed int _t256;
        				signed int _t259;
        				signed int _t262;
        				void* _t263;
        				void* _t264;
        				signed int _t267;
        				intOrPtr _t269;
        				intOrPtr _t271;
        				signed int _t274;
        				intOrPtr* _t275;
        				unsigned int _t276;
        				void* _t277;
        				signed int _t278;
        				intOrPtr* _t279;
        				signed int _t281;
        				intOrPtr _t282;
        				intOrPtr _t283;
        				signed int* _t284;
        				signed int _t286;
        				signed int _t287;
        				signed int _t288;
        				signed int _t296;
        				signed int* _t297;
        				intOrPtr _t298;
        				void* _t299;
        
        				_t278 = _a8;
        				_t187 = 0x10;
        				memset( &_v116, 0, _t187 << 2);
        				_t189 = _a4;
        				_t233 = _t278;
        				do {
        					_t166 =  *_t189;
        					_t189 =  &(_t189[1]);
        					 *((intOrPtr*)(_t299 + _t166 * 4 - 0x70)) =  *((intOrPtr*)(_t299 + _t166 * 4 - 0x70)) + 1;
        					_t233 = _t233 - 1;
        				} while (_t233 != 0);
        				if(_v116 != _t278) {
        					_t279 = _a28;
        					_t267 =  *_t279;
        					_t190 = 1;
        					_a28 = _t267;
        					_t234 = 0xf;
        					while(1) {
        						_t168 = 0;
        						if( *((intOrPtr*)(_t299 + _t190 * 4 - 0x70)) != 0) {
        							break;
        						}
        						_t190 = _t190 + 1;
        						if(_t190 <= _t234) {
        							continue;
        						}
        						break;
        					}
        					_v8 = _t190;
        					if(_t267 < _t190) {
        						_a28 = _t190;
        					}
        					while( *((intOrPtr*)(_t299 + _t234 * 4 - 0x70)) == _t168) {
        						_t234 = _t234 - 1;
        						if(_t234 != 0) {
        							continue;
        						}
        						break;
        					}
        					_v28 = _t234;
        					if(_a28 > _t234) {
        						_a28 = _t234;
        					}
        					 *_t279 = _a28;
        					_t181 = 1 << _t190;
        					while(_t190 < _t234) {
        						_t182 = _t181 -  *((intOrPtr*)(_t299 + _t190 * 4 - 0x70));
        						if(_t182 < 0) {
        							L64:
        							return _t168 | 0xffffffff;
        						}
        						_t190 = _t190 + 1;
        						_t181 = _t182 + _t182;
        					}
        					_t281 = _t234 << 2;
        					_t191 = _t299 + _t281 - 0x70;
        					_t269 =  *_t191;
        					_t183 = _t181 - _t269;
        					_v52 = _t183;
        					if(_t183 < 0) {
        						goto L64;
        					}
        					_v176 = _t168;
        					 *_t191 = _t269 + _t183;
        					_t192 = 0;
        					_t235 = _t234 - 1;
        					if(_t235 == 0) {
        						L21:
        						_t184 = _a4;
        						_t271 = 0;
        						do {
        							_t193 =  *_t184;
        							_t184 =  &(_t184[1]);
        							if(_t193 != _t168) {
        								_t232 = _t299 + _t193 * 4 - 0xb0;
        								_t236 =  *_t232;
        								 *((intOrPtr*)(0x42d6a8 + _t236 * 4)) = _t271;
        								 *_t232 = _t236 + 1;
        							}
        							_t271 = _t271 + 1;
        						} while (_t271 < _a8);
        						_v16 = _v16 | 0xffffffff;
        						_v40 = _v40 & 0x00000000;
        						_a8 =  *((intOrPtr*)(_t299 + _t281 - 0xb0));
        						_t195 = _v8;
        						_t186 =  ~_a28;
        						_v12 = _t168;
        						_v180 = _t168;
        						_v36 = 0x42d6a8;
        						_v240 = _t168;
        						if(_t195 > _v28) {
        							L62:
        							_t168 = 0;
        							if(_v52 == 0 || _v28 == 1) {
        								return _t168;
        							} else {
        								goto L64;
        							}
        						}
        						_v44 = _t195 - 1;
        						_v32 = _t299 + _t195 * 4 - 0x70;
        						do {
        							_t282 =  *_v32;
        							if(_t282 == 0) {
        								goto L61;
        							}
        							while(1) {
        								_t283 = _t282 - 1;
        								_t200 = _a28 + _t186;
        								_v48 = _t283;
        								_v24 = _t200;
        								if(_v8 <= _t200) {
        									goto L45;
        								}
        								L31:
        								_v20 = _t283 + 1;
        								do {
        									_v16 = _v16 + 1;
        									_t296 = _v28 - _v24;
        									if(_t296 > _a28) {
        										_t296 = _a28;
        									}
        									_t222 = _v8 - _v24;
        									_t254 = 1 << _t222;
        									if(1 <= _v20) {
        										L40:
        										_t256 =  *_a36;
        										_t168 = 1 << _t222;
        										_v40 = 1;
        										_t274 = _t256 + 1;
        										if(_t274 > 0x5a0) {
        											goto L64;
        										}
        									} else {
        										_t275 = _v32;
        										_t263 = _t254 + (_t168 | 0xffffffff) - _v48;
        										if(_t222 >= _t296) {
        											goto L40;
        										}
        										while(1) {
        											_t222 = _t222 + 1;
        											if(_t222 >= _t296) {
        												goto L40;
        											}
        											_t275 = _t275 + 4;
        											_t264 = _t263 + _t263;
        											_t175 =  *_t275;
        											if(_t264 <= _t175) {
        												goto L40;
        											}
        											_t263 = _t264 - _t175;
        										}
        										goto L40;
        									}
        									_t168 = _a32 + _t256 * 4;
        									_t297 = _t299 + _v16 * 4 - 0xec;
        									 *_a36 = _t274;
        									_t259 = _v16;
        									 *_t297 = _t168;
        									if(_t259 == 0) {
        										 *_a24 = _t168;
        									} else {
        										_t276 = _v12;
        										_t298 =  *((intOrPtr*)(_t297 - 4));
        										 *(_t299 + _t259 * 4 - 0xb0) = _t276;
        										_a5 = _a28;
        										_a4 = _t222;
        										_t262 = _t276 >> _t186;
        										_a6 = (_t168 - _t298 >> 2) - _t262;
        										 *(_t298 + _t262 * 4) = _a4;
        									}
        									_t224 = _v24;
        									_t186 = _t224;
        									_t225 = _t224 + _a28;
        									_v24 = _t225;
        								} while (_v8 > _t225);
        								L45:
        								_t284 = _v36;
        								_a5 = _v8 - _t186;
        								if(_t284 < 0x42d6a8 + _a8 * 4) {
        									_t205 =  *_t284;
        									if(_t205 >= _a12) {
        										_t207 = _t205 - _a12 + _t205 - _a12;
        										_v36 =  &(_v36[1]);
        										_a4 =  *((intOrPtr*)(_t207 + _a20)) + 0x50;
        										_t208 =  *((intOrPtr*)(_t207 + _a16));
        									} else {
        										_a4 = (_t205 & 0xffffff00 | _t205 - 0x00000100 > 0x00000000) - 0x00000001 & 0x00000060;
        										_t208 =  *_t284;
        										_v36 =  &(_t284[1]);
        									}
        									_a6 = _t208;
        								} else {
        									_a4 = 0xc0;
        								}
        								_t286 = 1 << _v8 - _t186;
        								_t244 = _v12 >> _t186;
        								while(_t244 < _v40) {
        									 *(_t168 + _t244 * 4) = _a4;
        									_t244 = _t244 + _t286;
        								}
        								_t287 = _v12;
        								_t246 = 1 << _v44;
        								while((_t287 & _t246) != 0) {
        									_t287 = _t287 ^ _t246;
        									_t246 = _t246 >> 1;
        								}
        								_t288 = _t287 ^ _t246;
        								_v20 = 1;
        								_v12 = _t288;
        								_t251 = _v16;
        								if(((1 << _t186) - 0x00000001 & _t288) ==  *((intOrPtr*)(_t299 + _t251 * 4 - 0xb0))) {
        									L60:
        									if(_v48 != 0) {
        										_t282 = _v48;
        										_t283 = _t282 - 1;
        										_t200 = _a28 + _t186;
        										_v48 = _t283;
        										_v24 = _t200;
        										if(_v8 <= _t200) {
        											goto L45;
        										}
        										goto L31;
        									}
        									break;
        								} else {
        									goto L58;
        								}
        								do {
        									L58:
        									_t186 = _t186 - _a28;
        									_t251 = _t251 - 1;
        								} while (((1 << _t186) - 0x00000001 & _v12) !=  *((intOrPtr*)(_t299 + _t251 * 4 - 0xb0)));
        								_v16 = _t251;
        								goto L60;
        							}
        							L61:
        							_v8 = _v8 + 1;
        							_v32 = _v32 + 4;
        							_v44 = _v44 + 1;
        						} while (_v8 <= _v28);
        						goto L62;
        					}
        					_t277 = 0;
        					do {
        						_t192 = _t192 +  *((intOrPtr*)(_t299 + _t277 - 0x6c));
        						_t277 = _t277 + 4;
        						_t235 = _t235 - 1;
        						 *((intOrPtr*)(_t299 + _t277 - 0xac)) = _t192;
        					} while (_t235 != 0);
        					goto L21;
        				}
        				 *_a24 =  *_a24 & 0x00000000;
        				 *_a28 =  *_a28 & 0x00000000;
        				return 0;
        			}











































































        0x00407127
        0x0040712f
        0x00407133
        0x00407135
        0x00407138
        0x0040713a
        0x0040713a
        0x0040713c
        0x00407143
        0x00407145
        0x00407145
        0x0040714b
        0x00407160
        0x00407168
        0x0040716a
        0x0040716c
        0x0040716f
        0x00407170
        0x00407170
        0x00407176
        0x00000000
        0x00000000
        0x00407178
        0x0040717b
        0x00000000
        0x00000000
        0x00000000
        0x0040717b
        0x0040717f
        0x00407182
        0x00407184
        0x00407184
        0x00407187
        0x0040718d
        0x0040718e
        0x00000000
        0x00000000
        0x00000000
        0x0040718e
        0x00407193
        0x00407196
        0x00407198
        0x00407198
        0x0040719e
        0x004071a0
        0x004071b1
        0x004071a4
        0x004071a8
        0x0040744d
        0x00000000
        0x0040744d
        0x004071ae
        0x004071af
        0x004071af
        0x004071b7
        0x004071ba
        0x004071be
        0x004071c0
        0x004071c2
        0x004071c5
        0x00000000
        0x00000000
        0x004071cd
        0x004071d3
        0x004071d5
        0x004071d7
        0x004071d8
        0x004071ed
        0x004071ed
        0x004071f0
        0x004071f2
        0x004071f2
        0x004071f4
        0x004071f9
        0x004071fb
        0x00407202
        0x00407204
        0x0040720c
        0x0040720c
        0x0040720e
        0x0040720f
        0x0040721e
        0x00407222
        0x00407226
        0x00407229
        0x0040722c
        0x00407231
        0x00407234
        0x0040723a
        0x00407241
        0x00407247
        0x00407440
        0x00407440
        0x00407445
        0x00407454
        0x00000000
        0x00000000
        0x00000000
        0x00407445
        0x00407254
        0x00407257
        0x0040725a
        0x0040725d
        0x00407261
        0x00000000
        0x00000000
        0x0040726c
        0x0040726f
        0x00407270
        0x00407272
        0x00407278
        0x0040727b
        0x00000000
        0x00000000
        0x00407281
        0x00407282
        0x00407285
        0x00407288
        0x0040728b
        0x00407291
        0x00407293
        0x00407293
        0x0040729b
        0x0040729f
        0x004072a4
        0x004072c9
        0x004072cf
        0x004072d1
        0x004072d3
        0x004072d6
        0x004072df
        0x00000000
        0x00000000
        0x004072a6
        0x004072a6
        0x004072af
        0x004072b3
        0x00000000
        0x00000000
        0x004072c4
        0x004072c4
        0x004072c7
        0x00000000
        0x00000000
        0x004072b7
        0x004072ba
        0x004072bc
        0x004072c0
        0x00000000
        0x00000000
        0x004072c2
        0x004072c2
        0x00000000
        0x004072c4
        0x004072e8
        0x004072ee
        0x004072f8
        0x004072fa
        0x004072ff
        0x00407301
        0x00407337
        0x00407303
        0x00407303
        0x00407306
        0x00407309
        0x00407313
        0x00407316
        0x0040731d
        0x00407328
        0x0040732f
        0x0040732f
        0x00407339
        0x0040733c
        0x0040733e
        0x00407344
        0x00407344
        0x0040734d
        0x00407350
        0x00407355
        0x00407364
        0x0040736c
        0x00407371
        0x00407395
        0x0040739d
        0x004073a1
        0x004073a7
        0x00407373
        0x00407381
        0x00407384
        0x0040738a
        0x0040738a
        0x004073ab
        0x00407366
        0x00407366
        0x00407366
        0x004073bc
        0x004073c0
        0x004073cc
        0x004073c7
        0x004073ca
        0x004073ca
        0x004073d4
        0x004073d9
        0x004073e1
        0x004073dd
        0x004073df
        0x004073df
        0x004073e7
        0x004073e9
        0x004073f0
        0x004073fa
        0x00407404
        0x00407420
        0x00407424
        0x00407269
        0x0040726f
        0x00407270
        0x00407272
        0x00407278
        0x0040727b
        0x00000000
        0x00000000
        0x00000000
        0x0040727b
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x00407406
        0x00407406
        0x00407406
        0x0040740b
        0x00407414
        0x0040741d
        0x00000000
        0x0040741d
        0x0040742a
        0x0040742a
        0x0040742d
        0x00407434
        0x00407437
        0x00000000
        0x0040725a
        0x004071da
        0x004071dc
        0x004071dc
        0x004071e0
        0x004071e3
        0x004071e4
        0x004071e4
        0x00000000
        0x004071dc
        0x00407150
        0x00407156
        0x00000000

        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 99f6c7e6b8620be82bccd3d2e3e98bb61de1be8b453b643f323292903d4af905
        • Instruction ID: 8f207273dfcdbc59f762b6c847d1a58b94b1624b669f9e87ec0d9a9138a8e2bc
        • Opcode Fuzzy Hash: 99f6c7e6b8620be82bccd3d2e3e98bb61de1be8b453b643f323292903d4af905
        • Instruction Fuzzy Hash: 0DC15A31E04259CBCF18CF68D4905EEBBB2BF98314F25826AD8567B380D734A942CF95
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 96%
        			E00404B80(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
        				struct HWND__* _v8;
        				struct HWND__* _v12;
        				long _v16;
        				signed int _v20;
        				signed int _v24;
        				intOrPtr _v28;
        				signed char* _v32;
        				int _v36;
        				signed int _v44;
        				int _v48;
        				signed int* _v60;
        				signed char* _v64;
        				signed int _v68;
        				long _v72;
        				void* _v76;
        				intOrPtr _v80;
        				intOrPtr _v84;
        				void* _v88;
        				void* __ebx;
        				void* __edi;
        				void* __esi;
        				signed int _t203;
        				intOrPtr _t206;
        				long _t212;
        				signed int _t216;
        				signed int _t227;
        				void* _t230;
        				void* _t231;
        				int _t237;
        				long _t242;
        				long _t243;
        				signed int _t244;
        				signed int _t250;
        				signed int _t252;
        				signed char _t253;
        				signed char _t259;
        				void* _t264;
        				void* _t266;
        				signed char* _t284;
        				signed char _t285;
        				long _t290;
        				signed int _t300;
        				signed int _t308;
        				signed char* _t316;
        				int _t320;
        				int _t321;
        				signed int* _t322;
        				int _t323;
        				long _t324;
        				signed int _t325;
        				long _t327;
        				int _t328;
        				signed int _t329;
        				void* _t331;
        
        				_v12 = GetDlgItem(_a4, 0x3f9);
        				_v8 = GetDlgItem(_a4, 0x408);
        				_t331 = SendMessageA;
        				_v24 =  *0x42f468;
        				_v28 =  *0x42f434 + 0x94;
        				_t320 = 0x10;
        				if(_a8 != 0x110) {
        					L23:
        					if(_a8 != 0x405) {
        						_t298 = _a16;
        					} else {
        						_a12 = 0;
        						_t298 = 1;
        						_a8 = 0x40f;
        						_a16 = 1;
        					}
        					if(_a8 == 0x4e || _a8 == 0x413) {
        						_v16 = _t298;
        						if(_a8 == 0x413 ||  *((intOrPtr*)(_t298 + 4)) == 0x408) {
        							if(( *0x42f43d & 0x00000002) != 0) {
        								L41:
        								if(_v16 != 0) {
        									_t242 = _v16;
        									if( *((intOrPtr*)(_t242 + 8)) == 0xfffffe6e) {
        										SendMessageA(_v8, 0x419, 0,  *(_t242 + 0x5c));
        									}
        									_t243 = _v16;
        									if( *((intOrPtr*)(_t243 + 8)) == 0xfffffe6a) {
        										_t298 = _v24;
        										_t244 =  *(_t243 + 0x5c);
        										if( *((intOrPtr*)(_t243 + 0xc)) != 2) {
        											 *(_t244 * 0x418 + _t298 + 8) =  *(_t244 * 0x418 + _t298 + 8) & 0xffffffdf;
        										} else {
        											 *(_t244 * 0x418 + _t298 + 8) =  *(_t244 * 0x418 + _t298 + 8) | 0x00000020;
        										}
        									}
        								}
        								goto L48;
        							}
        							if(_a8 == 0x413) {
        								L33:
        								_t298 = 0 | _a8 != 0x00000413;
        								_t250 = E00404ACE(_v8, _a8 != 0x413);
        								_t325 = _t250;
        								if(_t325 >= 0) {
        									_t99 = _v24 + 8; // 0x8
        									_t298 = _t250 * 0x418 + _t99;
        									_t252 =  *_t298;
        									if((_t252 & 0x00000010) == 0) {
        										if((_t252 & 0x00000040) == 0) {
        											_t253 = _t252 ^ 0x00000001;
        										} else {
        											_t259 = _t252 ^ 0x00000080;
        											if(_t259 >= 0) {
        												_t253 = _t259 & 0x000000fe;
        											} else {
        												_t253 = _t259 | 0x00000001;
        											}
        										}
        										 *_t298 = _t253;
        										E0040117D(_t325);
        										_a12 = _t325 + 1;
        										_a16 =  !( *0x42f43c) >> 0x00000008 & 0x00000001;
        										_a8 = 0x40f;
        									}
        								}
        								goto L41;
        							}
        							_t298 = _a16;
        							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
        								goto L41;
        							}
        							goto L33;
        						} else {
        							goto L48;
        						}
        					} else {
        						L48:
        						if(_a8 != 0x111) {
        							L56:
        							if(_a8 == 0x200) {
        								SendMessageA(_v8, 0x200, 0, 0);
        							}
        							if(_a8 == 0x40b) {
        								_t230 =  *0x42a874;
        								if(_t230 != 0) {
        									ImageList_Destroy(_t230);
        								}
        								_t231 =  *0x42a888;
        								if(_t231 != 0) {
        									GlobalFree(_t231);
        								}
        								 *0x42a874 = 0;
        								 *0x42a888 = 0;
        								 *0x42f4a0 = 0;
        							}
        							if(_a8 != 0x40f) {
        								L90:
        								if(_a8 == 0x420 && ( *0x42f43d & 0x00000001) != 0) {
        									_t321 = (0 | _a16 == 0x00000020) << 3;
        									ShowWindow(_v8, _t321);
        									ShowWindow(GetDlgItem(_a4, 0x3fe), _t321);
        								}
        								goto L93;
        							} else {
        								E004011EF(_t298, 0, 0);
        								_t203 = _a12;
        								if(_t203 != 0) {
        									if(_t203 != 0xffffffff) {
        										_t203 = _t203 - 1;
        									}
        									_push(_t203);
        									_push(8);
        									E00404B4E();
        								}
        								if(_a16 == 0) {
        									L75:
        									E004011EF(_t298, 0, 0);
        									_v36 =  *0x42a888;
        									_t206 =  *0x42f468;
        									_v64 = 0xf030;
        									_v24 = 0;
        									if( *0x42f46c <= 0) {
        										L86:
        										if( *0x42f42c == 4) {
        											InvalidateRect(_v8, 0, 1);
        										}
        										if( *((intOrPtr*)( *0x42ebfc + 0x10)) != 0) {
        											E00404A89(0x3ff, 0xfffffffb, E00404AA1(5));
        										}
        										goto L90;
        									}
        									_t322 = _t206 + 8;
        									do {
        										_t212 =  *((intOrPtr*)(_v36 + _v24 * 4));
        										if(_t212 != 0) {
        											_t300 =  *_t322;
        											_v72 = _t212;
        											_v76 = 8;
        											if((_t300 & 0x00000001) != 0) {
        												_v76 = 9;
        												_v60 =  &(_t322[4]);
        												_t322[0] = _t322[0] & 0x000000fe;
        											}
        											if((_t300 & 0x00000040) == 0) {
        												_t216 = (_t300 & 0x00000001) + 1;
        												if((_t300 & 0x00000010) != 0) {
        													_t216 = _t216 + 3;
        												}
        											} else {
        												_t216 = 3;
        											}
        											_v68 = (_t216 << 0x0000000b | _t300 & 0x00000008) + (_t216 << 0x0000000b | _t300 & 0x00000008) | _t300 & 0x00000020;
        											SendMessageA(_v8, 0x1102, (_t300 >> 0x00000005 & 0x00000001) + 1, _v72);
        											SendMessageA(_v8, 0x110d, 0,  &_v76);
        										}
        										_v24 = _v24 + 1;
        										_t322 =  &(_t322[0x106]);
        									} while (_v24 <  *0x42f46c);
        									goto L86;
        								} else {
        									_t323 = E004012E2( *0x42a888);
        									E00401299(_t323);
        									_t227 = 0;
        									_t298 = 0;
        									if(_t323 <= 0) {
        										L74:
        										SendMessageA(_v12, 0x14e, _t298, 0);
        										_a16 = _t323;
        										_a8 = 0x420;
        										goto L75;
        									} else {
        										goto L71;
        									}
        									do {
        										L71:
        										if( *((intOrPtr*)(_v28 + _t227 * 4)) != 0) {
        											_t298 = _t298 + 1;
        										}
        										_t227 = _t227 + 1;
        									} while (_t227 < _t323);
        									goto L74;
        								}
        							}
        						}
        						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
        							goto L93;
        						} else {
        							_t237 = SendMessageA(_v12, 0x147, 0, 0);
        							if(_t237 == 0xffffffff) {
        								goto L93;
        							}
        							_t324 = SendMessageA(_v12, 0x150, _t237, 0);
        							if(_t324 == 0xffffffff ||  *((intOrPtr*)(_v28 + _t324 * 4)) == 0) {
        								_t324 = 0x20;
        							}
        							E00401299(_t324);
        							SendMessageA(_a4, 0x420, 0, _t324);
        							_a12 = _a12 | 0xffffffff;
        							_a16 = 0;
        							_a8 = 0x40f;
        							goto L56;
        						}
        					}
        				} else {
        					_v36 = 0;
        					 *0x42f4a0 = _a4;
        					_v20 = 2;
        					 *0x42a888 = GlobalAlloc(0x40,  *0x42f46c << 2);
        					_t264 = LoadImageA( *0x42f420, 0x6e, 0, 0, 0, 0);
        					 *0x42a87c =  *0x42a87c | 0xffffffff;
        					_v16 = _t264;
        					 *0x42a884 = SetWindowLongA(_v8, 0xfffffffc, E00405192);
        					_t266 = ImageList_Create(_t320, _t320, 0x21, 6, 0);
        					 *0x42a874 = _t266;
        					ImageList_AddMasked(_t266, _v16, 0xff00ff);
        					SendMessageA(_v8, 0x1109, 2,  *0x42a874);
        					if(SendMessageA(_v8, 0x111c, 0, 0) < _t320) {
        						SendMessageA(_v8, 0x111b, _t320, 0);
        					}
        					DeleteObject(_v16);
        					_t327 = 0;
        					do {
        						_t272 =  *((intOrPtr*)(_v28 + _t327 * 4));
        						if( *((intOrPtr*)(_v28 + _t327 * 4)) != 0) {
        							if(_t327 != 0x20) {
        								_v20 = 0;
        							}
        							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, 0, E0040618A(0, _t327, _t331, 0, _t272)), _t327);
        						}
        						_t327 = _t327 + 1;
        					} while (_t327 < 0x21);
        					_t328 = _a16;
        					_push( *((intOrPtr*)(_t328 + 0x30 + _v20 * 4)));
        					_push(0x15);
        					E0040417B(_a4);
        					_push( *((intOrPtr*)(_t328 + 0x34 + _v20 * 4)));
        					_push(0x16);
        					E0040417B(_a4);
        					_t329 = 0;
        					_v16 = 0;
        					if( *0x42f46c <= 0) {
        						L19:
        						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
        						goto L20;
        					} else {
        						_t316 = _v24 + 8;
        						_v32 = _t316;
        						do {
        							_t284 =  &(_t316[0x10]);
        							if( *_t284 != 0) {
        								_v64 = _t284;
        								_t285 =  *_t316;
        								_v88 = _v16;
        								_t308 = 0x20;
        								_v84 = 0xffff0002;
        								_v80 = 0xd;
        								_v68 = _t308;
        								_v44 = _t329;
        								_v72 = _t285 & _t308;
        								if((_t285 & 0x00000002) == 0) {
        									if((_t285 & 0x00000004) == 0) {
        										 *( *0x42a888 + _t329 * 4) = SendMessageA(_v8, 0x1100, 0,  &_v88);
        									} else {
        										_v16 = SendMessageA(_v8, 0x110a, 3, _v16);
        									}
        								} else {
        									_v80 = 0x4d;
        									_v48 = 1;
        									_t290 = SendMessageA(_v8, 0x1100, 0,  &_v88);
        									_v36 = 1;
        									 *( *0x42a888 + _t329 * 4) = _t290;
        									_v16 =  *( *0x42a888 + _t329 * 4);
        								}
        							}
        							_t329 = _t329 + 1;
        							_t316 =  &(_v32[0x418]);
        							_v32 = _t316;
        						} while (_t329 <  *0x42f46c);
        						if(_v36 != 0) {
        							L20:
        							if(_v20 != 0) {
        								E004041B0(_v8);
        								goto L23;
        							} else {
        								ShowWindow(_v12, 5);
        								E004041B0(_v12);
        								L93:
        								return E004041E2(_a8, _a12, _a16);
        							}
        						}
        						goto L19;
        					}
        				}
        			}

























































        0x00404b9e
        0x00404ba6
        0x00404bae
        0x00404bb4
        0x00404bcc
        0x00404bcf
        0x00404bd0
        0x00404dfd
        0x00404e04
        0x00404e18
        0x00404e06
        0x00404e08
        0x00404e0b
        0x00404e0c
        0x00404e13
        0x00404e13
        0x00404e24
        0x00404e32
        0x00404e35
        0x00404e4b
        0x00404ec0
        0x00404ec3
        0x00404ec5
        0x00404ecf
        0x00404edd
        0x00404edd
        0x00404edf
        0x00404ee9
        0x00404eef
        0x00404ef2
        0x00404ef5
        0x00404f10
        0x00404ef7
        0x00404f01
        0x00404f01
        0x00404ef5
        0x00404ee9
        0x00000000
        0x00404ec3
        0x00404e50
        0x00404e5b
        0x00404e60
        0x00404e67
        0x00404e6c
        0x00404e70
        0x00404e7b
        0x00404e7b
        0x00404e7f
        0x00404e83
        0x00404e87
        0x00404e9a
        0x00404e89
        0x00404e89
        0x00404e90
        0x00404e96
        0x00404e92
        0x00404e92
        0x00404e92
        0x00404e90
        0x00404e9e
        0x00404ea0
        0x00404eb3
        0x00404eb6
        0x00404eb9
        0x00404eb9
        0x00404e83
        0x00000000
        0x00404e70
        0x00404e52
        0x00404e59
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x00404f13
        0x00404f13
        0x00404f1a
        0x00404f8b
        0x00404f93
        0x00404f9b
        0x00404f9b
        0x00404fa4
        0x00404fa6
        0x00404fad
        0x00404fb0
        0x00404fb0
        0x00404fb6
        0x00404fbd
        0x00404fc0
        0x00404fc0
        0x00404fc6
        0x00404fcc
        0x00404fd2
        0x00404fd2
        0x00404fdf
        0x0040513f
        0x00405146
        0x00405163
        0x00405169
        0x0040517b
        0x0040517b
        0x00000000
        0x00404fe5
        0x00404fe7
        0x00404fec
        0x00404ff1
        0x00404ff6
        0x00404ff8
        0x00404ff8
        0x00404ff9
        0x00404ffa
        0x00404ffc
        0x00404ffc
        0x00405004
        0x00405045
        0x00405047
        0x00405057
        0x0040505a
        0x0040505f
        0x00405066
        0x00405069
        0x0040510b
        0x00405113
        0x0040511b
        0x0040511b
        0x00405129
        0x0040513a
        0x0040513a
        0x00000000
        0x00405129
        0x0040506f
        0x00405072
        0x00405078
        0x0040507d
        0x0040507f
        0x00405081
        0x00405087
        0x0040508e
        0x00405093
        0x0040509a
        0x0040509d
        0x0040509d
        0x004050a4
        0x004050b0
        0x004050b4
        0x004050b6
        0x004050b6
        0x004050a6
        0x004050a8
        0x004050a8
        0x004050d6
        0x004050e2
        0x004050f1
        0x004050f1
        0x004050f3
        0x004050f6
        0x004050ff
        0x00000000
        0x00405006
        0x00405011
        0x00405014
        0x00405019
        0x0040501b
        0x0040501f
        0x0040502f
        0x00405039
        0x0040503b
        0x0040503e
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x00405021
        0x00405021
        0x00405027
        0x00405029
        0x00405029
        0x0040502a
        0x0040502b
        0x00000000
        0x00405021
        0x00405004
        0x00404fdf
        0x00404f22
        0x00000000
        0x00404f38
        0x00404f42
        0x00404f47
        0x00000000
        0x00000000
        0x00404f59
        0x00404f5e
        0x00404f6a
        0x00404f6a
        0x00404f6c
        0x00404f7b
        0x00404f7d
        0x00404f81
        0x00404f84
        0x00000000
        0x00404f84
        0x00404f22
        0x00404bd6
        0x00404bd9
        0x00404bdc
        0x00404bec
        0x00404bff
        0x00404c0a
        0x00404c10
        0x00404c1e
        0x00404c31
        0x00404c36
        0x00404c41
        0x00404c4a
        0x00404c60
        0x00404c70
        0x00404c7c
        0x00404c7c
        0x00404c81
        0x00404c87
        0x00404c89
        0x00404c8c
        0x00404c91
        0x00404c96
        0x00404c98
        0x00404c98
        0x00404cb8
        0x00404cb8
        0x00404cba
        0x00404cbb
        0x00404cc0
        0x00404cc6
        0x00404cca
        0x00404ccf
        0x00404cd7
        0x00404cdb
        0x00404ce0
        0x00404ce5
        0x00404ced
        0x00404cf0
        0x00404dbf
        0x00404dd2
        0x00000000
        0x00404cf6
        0x00404cf9
        0x00404cfc
        0x00404cff
        0x00404cff
        0x00404d04
        0x00404d0d
        0x00404d10
        0x00404d14
        0x00404d17
        0x00404d1a
        0x00404d23
        0x00404d2c
        0x00404d2f
        0x00404d32
        0x00404d35
        0x00404d73
        0x00404d9e
        0x00404d75
        0x00404d84
        0x00404d84
        0x00404d37
        0x00404d3a
        0x00404d48
        0x00404d52
        0x00404d5a
        0x00404d61
        0x00404d6c
        0x00404d6c
        0x00404d35
        0x00404da4
        0x00404da5
        0x00404db1
        0x00404db1
        0x00404dbd
        0x00404dd8
        0x00404ddb
        0x00404df8
        0x00000000
        0x00404ddd
        0x00404de2
        0x00404deb
        0x0040517d
        0x0040518f
        0x0040518f
        0x00404ddb
        0x00000000
        0x00404dbd
        0x00404cf0

        APIs
        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
        • String ID: $M$N
        • API String ID: 2564846305-813528018
        • Opcode ID: 05a311050dda4b414fd1261923b8e6b7691581466e425b0fd9ae4ea99a1d7fb6
        • Instruction ID: 99b70255f3faedab1c4ad885451b662392dfc0d6b29454a89b749d4faaca394f
        • Opcode Fuzzy Hash: 05a311050dda4b414fd1261923b8e6b7691581466e425b0fd9ae4ea99a1d7fb6
        • Instruction Fuzzy Hash: 5D027DB0A00209AFDB20DF94DD85AAE7BB5FB44354F50813AF610BA2E0D7798D52CF58
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 83%
        			E00403CA7(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
        				struct HWND__* _v32;
        				void* _v84;
        				void* _v88;
        				void* __ebx;
        				void* __edi;
        				void* __esi;
        				signed int _t35;
        				signed int _t37;
        				signed int _t39;
        				struct HWND__* _t49;
        				signed int _t68;
        				struct HWND__* _t74;
        				signed int _t87;
        				struct HWND__* _t92;
        				signed int _t100;
        				int _t104;
        				signed int _t116;
        				signed int _t117;
        				int _t118;
        				signed int _t123;
        				struct HWND__* _t126;
        				struct HWND__* _t127;
        				int _t128;
        				long _t131;
        				int _t133;
        				int _t134;
        				void* _t135;
        
        				_t116 = _a8;
        				if(_t116 == 0x110 || _t116 == 0x408) {
        					_t35 = _a12;
        					_t126 = _a4;
        					__eflags = _t116 - 0x110;
        					 *0x42a878 = _t35;
        					if(_t116 == 0x110) {
        						 *0x42f428 = _t126;
        						 *0x42a88c = GetDlgItem(_t126, 1);
        						_t92 = GetDlgItem(_t126, 2);
        						_push(0xffffffff);
        						_push(0x1c);
        						 *0x429858 = _t92;
        						E0040417B(_t126);
        						SetClassLongA(_t126, 0xfffffff2,  *0x42ec08);
        						 *0x42ebec = E0040140B(4);
        						_t35 = 1;
        						__eflags = 1;
        						 *0x42a878 = 1;
        					}
        					_t123 =  *0x40a1dc; // 0xffffffff
        					_t134 = 0;
        					_t131 = (_t123 << 6) +  *0x42f460;
        					__eflags = _t123;
        					if(_t123 < 0) {
        						L34:
        						E004041C7(0x40b);
        						while(1) {
        							_t37 =  *0x42a878;
        							 *0x40a1dc =  *0x40a1dc + _t37;
        							_t131 = _t131 + (_t37 << 6);
        							_t39 =  *0x40a1dc; // 0xffffffff
        							__eflags = _t39 -  *0x42f464;
        							if(_t39 ==  *0x42f464) {
        								E0040140B(1);
        							}
        							__eflags =  *0x42ebec - _t134;
        							if( *0x42ebec != _t134) {
        								break;
        							}
        							__eflags =  *0x40a1dc -  *0x42f464; // 0xffffffff
        							if(__eflags >= 0) {
        								break;
        							}
        							_t117 =  *(_t131 + 0x14);
        							E0040618A(_t117, _t126, _t131, 0x437800,  *((intOrPtr*)(_t131 + 0x24)));
        							_push( *((intOrPtr*)(_t131 + 0x20)));
        							_push(0xfffffc19);
        							E0040417B(_t126);
        							_push( *((intOrPtr*)(_t131 + 0x1c)));
        							_push(0xfffffc1b);
        							E0040417B(_t126);
        							_push( *((intOrPtr*)(_t131 + 0x28)));
        							_push(0xfffffc1a);
        							E0040417B(_t126);
        							_t49 = GetDlgItem(_t126, 3);
        							__eflags =  *0x42f4cc - _t134;
        							_v32 = _t49;
        							if( *0x42f4cc != _t134) {
        								_t117 = _t117 & 0x0000fefd | 0x00000004;
        								__eflags = _t117;
        							}
        							ShowWindow(_t49, _t117 & 0x00000008);
        							EnableWindow( *(_t135 + 0x30), _t117 & 0x00000100);
        							E0040419D(_t117 & 0x00000002);
        							_t118 = _t117 & 0x00000004;
        							EnableWindow( *0x429858, _t118);
        							__eflags = _t118 - _t134;
        							if(_t118 == _t134) {
        								_push(1);
        							} else {
        								_push(_t134);
        							}
        							EnableMenuItem(GetSystemMenu(_t126, _t134), 0xf060, ??);
        							SendMessageA( *(_t135 + 0x38), 0xf4, _t134, 1);
        							__eflags =  *0x42f4cc - _t134;
        							if( *0x42f4cc == _t134) {
        								_push( *0x42a88c);
        							} else {
        								SendMessageA(_t126, 0x401, 2, _t134);
        								_push( *0x429858);
        							}
        							E004041B0();
        							E004060F7(0x42a890, E00403C88());
        							E0040618A(0x42a890, _t126, _t131,  &(0x42a890[lstrlenA(0x42a890)]),  *((intOrPtr*)(_t131 + 0x18)));
        							SetWindowTextA(_t126, 0x42a890);
        							_push(_t134);
        							_t68 = E00401389( *((intOrPtr*)(_t131 + 8)));
        							__eflags = _t68;
        							if(_t68 != 0) {
        								continue;
        							} else {
        								__eflags =  *_t131 - _t134;
        								if( *_t131 == _t134) {
        									continue;
        								}
        								__eflags =  *(_t131 + 4) - 5;
        								if( *(_t131 + 4) != 5) {
        									DestroyWindow( *0x42ebf8);
        									 *0x42a068 = _t131;
        									__eflags =  *_t131 - _t134;
        									if( *_t131 <= _t134) {
        										goto L58;
        									}
        									_t74 = CreateDialogParamA( *0x42f420,  *_t131 +  *0x42ec00 & 0x0000ffff, _t126,  *(0x40a1e0 +  *(_t131 + 4) * 4), _t131);
        									__eflags = _t74 - _t134;
        									 *0x42ebf8 = _t74;
        									if(_t74 == _t134) {
        										goto L58;
        									}
        									_push( *((intOrPtr*)(_t131 + 0x2c)));
        									_push(6);
        									E0040417B(_t74);
        									GetWindowRect(GetDlgItem(_t126, 0x3fa), _t135 + 0x10);
        									ScreenToClient(_t126, _t135 + 0x10);
        									SetWindowPos( *0x42ebf8, _t134,  *(_t135 + 0x20),  *(_t135 + 0x20), _t134, _t134, 0x15);
        									_push(_t134);
        									E00401389( *((intOrPtr*)(_t131 + 0xc)));
        									__eflags =  *0x42ebec - _t134;
        									if( *0x42ebec != _t134) {
        										goto L61;
        									}
        									ShowWindow( *0x42ebf8, 8);
        									E004041C7(0x405);
        									goto L58;
        								}
        								__eflags =  *0x42f4cc - _t134;
        								if( *0x42f4cc != _t134) {
        									goto L61;
        								}
        								__eflags =  *0x42f4c0 - _t134;
        								if( *0x42f4c0 != _t134) {
        									continue;
        								}
        								goto L61;
        							}
        						}
        						DestroyWindow( *0x42ebf8);
        						 *0x42f428 = _t134;
        						EndDialog(_t126,  *0x429c60);
        						goto L58;
        					} else {
        						__eflags = _t35 - 1;
        						if(_t35 != 1) {
        							L33:
        							__eflags =  *_t131 - _t134;
        							if( *_t131 == _t134) {
        								goto L61;
        							}
        							goto L34;
        						}
        						_push(0);
        						_t87 = E00401389( *((intOrPtr*)(_t131 + 0x10)));
        						__eflags = _t87;
        						if(_t87 == 0) {
        							goto L33;
        						}
        						SendMessageA( *0x42ebf8, 0x40f, 0, 1);
        						__eflags =  *0x42ebec;
        						return 0 |  *0x42ebec == 0x00000000;
        					}
        				} else {
        					_t126 = _a4;
        					_t134 = 0;
        					if(_t116 == 0x47) {
        						SetWindowPos( *0x42a870, _t126, 0, 0, 0, 0, 0x13);
        					}
        					if(_t116 == 5) {
        						asm("sbb eax, eax");
        						ShowWindow( *0x42a870,  ~(_a12 - 1) & _t116);
        					}
        					if(_t116 != 0x40d) {
        						__eflags = _t116 - 0x11;
        						if(_t116 != 0x11) {
        							__eflags = _t116 - 0x111;
        							if(_t116 != 0x111) {
        								L26:
        								return E004041E2(_t116, _a12, _a16);
        							}
        							_t133 = _a12 & 0x0000ffff;
        							_t127 = GetDlgItem(_t126, _t133);
        							__eflags = _t127 - _t134;
        							if(_t127 == _t134) {
        								L13:
        								__eflags = _t133 - 1;
        								if(_t133 != 1) {
        									__eflags = _t133 - 3;
        									if(_t133 != 3) {
        										_t128 = 2;
        										__eflags = _t133 - _t128;
        										if(_t133 != _t128) {
        											L25:
        											SendMessageA( *0x42ebf8, 0x111, _a12, _a16);
        											goto L26;
        										}
        										__eflags =  *0x42f4cc - _t134;
        										if( *0x42f4cc == _t134) {
        											_t100 = E0040140B(3);
        											__eflags = _t100;
        											if(_t100 != 0) {
        												goto L26;
        											}
        											 *0x429c60 = 1;
        											L21:
        											_push(0x78);
        											L22:
        											E00404154();
        											goto L26;
        										}
        										E0040140B(_t128);
        										 *0x429c60 = _t128;
        										goto L21;
        									}
        									__eflags =  *0x40a1dc - _t134; // 0xffffffff
        									if(__eflags <= 0) {
        										goto L25;
        									}
        									_push(0xffffffff);
        									goto L22;
        								}
        								_push(_t133);
        								goto L22;
        							}
        							SendMessageA(_t127, 0xf3, _t134, _t134);
        							_t104 = IsWindowEnabled(_t127);
        							__eflags = _t104;
        							if(_t104 == 0) {
        								goto L61;
        							}
        							goto L13;
        						}
        						SetWindowLongA(_t126, _t134, _t134);
        						return 1;
        					} else {
        						DestroyWindow( *0x42ebf8);
        						 *0x42ebf8 = _a12;
        						L58:
        						if( *0x42b890 == _t134 &&  *0x42ebf8 != _t134) {
        							ShowWindow(_t126, 0xa);
        							 *0x42b890 = 1;
        						}
        						L61:
        						return 0;
        					}
        				}
        			}






























        0x00403cb0
        0x00403cb9
        0x00403dfa
        0x00403dfe
        0x00403e02
        0x00403e04
        0x00403e09
        0x00403e14
        0x00403e1f
        0x00403e24
        0x00403e26
        0x00403e28
        0x00403e2b
        0x00403e30
        0x00403e3e
        0x00403e4b
        0x00403e52
        0x00403e52
        0x00403e53
        0x00403e53
        0x00403e58
        0x00403e5e
        0x00403e65
        0x00403e6b
        0x00403e6d
        0x00403ead
        0x00403eb2
        0x00403eb7
        0x00403eb7
        0x00403ebc
        0x00403ec5
        0x00403ec7
        0x00403ecc
        0x00403ed2
        0x00403ed6
        0x00403ed6
        0x00403edb
        0x00403ee1
        0x00000000
        0x00000000
        0x00403eec
        0x00403ef2
        0x00000000
        0x00000000
        0x00403efb
        0x00403f03
        0x00403f08
        0x00403f0b
        0x00403f11
        0x00403f16
        0x00403f19
        0x00403f1f
        0x00403f24
        0x00403f27
        0x00403f2d
        0x00403f35
        0x00403f3b
        0x00403f41
        0x00403f45
        0x00403f4c
        0x00403f4c
        0x00403f4c
        0x00403f56
        0x00403f68
        0x00403f74
        0x00403f79
        0x00403f83
        0x00403f89
        0x00403f8b
        0x00403f90
        0x00403f8d
        0x00403f8d
        0x00403f8d
        0x00403fa0
        0x00403fb8
        0x00403fba
        0x00403fc0
        0x00403fd5
        0x00403fc2
        0x00403fcb
        0x00403fcd
        0x00403fcd
        0x00403fdb
        0x00403fec
        0x00403ffd
        0x00404004
        0x0040400a
        0x0040400e
        0x00404013
        0x00404015
        0x00000000
        0x0040401b
        0x0040401b
        0x0040401d
        0x00000000
        0x00000000
        0x00404023
        0x00404027
        0x0040404c
        0x00404052
        0x00404058
        0x0040405a
        0x00000000
        0x00000000
        0x00404080
        0x00404086
        0x00404088
        0x0040408d
        0x00000000
        0x00000000
        0x00404093
        0x00404096
        0x00404099
        0x004040b0
        0x004040bc
        0x004040d5
        0x004040db
        0x004040df
        0x004040e4
        0x004040ea
        0x00000000
        0x00000000
        0x004040f4
        0x004040ff
        0x00000000
        0x004040ff
        0x00404029
        0x0040402f
        0x00000000
        0x00000000
        0x00404035
        0x0040403b
        0x00000000
        0x00000000
        0x00000000
        0x00404041
        0x00404015
        0x0040410c
        0x00404118
        0x0040411f
        0x00000000
        0x00403e6f
        0x00403e6f
        0x00403e72
        0x00403ea5
        0x00403ea5
        0x00403ea7
        0x00000000
        0x00000000
        0x00000000
        0x00403ea7
        0x00403e74
        0x00403e78
        0x00403e7d
        0x00403e7f
        0x00000000
        0x00000000
        0x00403e8f
        0x00403e97
        0x00000000
        0x00403e9d
        0x00403ccb
        0x00403ccb
        0x00403ccf
        0x00403cd4
        0x00403ce3
        0x00403ce3
        0x00403cec
        0x00403cf5
        0x00403d00
        0x00403d00
        0x00403d0c
        0x00403d28
        0x00403d2b
        0x00403d3e
        0x00403d44
        0x00403de7
        0x00000000
        0x00403df0
        0x00403d4a
        0x00403d57
        0x00403d59
        0x00403d5b
        0x00403d7a
        0x00403d7a
        0x00403d7d
        0x00403d82
        0x00403d85
        0x00403d95
        0x00403d96
        0x00403d98
        0x00403dce
        0x00403de1
        0x00000000
        0x00403de1
        0x00403d9a
        0x00403da0
        0x00403db9
        0x00403dbe
        0x00403dc0
        0x00000000
        0x00000000
        0x00403dc2
        0x00403dae
        0x00403dae
        0x00403db0
        0x00403db0
        0x00000000
        0x00403db0
        0x00403da3
        0x00403da8
        0x00000000
        0x00403da8
        0x00403d87
        0x00403d8d
        0x00000000
        0x00000000
        0x00403d8f
        0x00000000
        0x00403d8f
        0x00403d7f
        0x00000000
        0x00403d7f
        0x00403d65
        0x00403d6c
        0x00403d72
        0x00403d74
        0x00000000
        0x00000000
        0x00000000
        0x00403d74
        0x00403d30
        0x00000000
        0x00403d0e
        0x00403d14
        0x00403d1e
        0x00404125
        0x0040412b
        0x00404138
        0x0040413e
        0x0040413e
        0x00404148
        0x00000000
        0x00404148
        0x00403d0c

        APIs
        • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403CE3
        • ShowWindow.USER32(?), ref: 00403D00
        • DestroyWindow.USER32 ref: 00403D14
        • SetWindowLongA.USER32 ref: 00403D30
        • GetDlgItem.USER32 ref: 00403D51
        • SendMessageA.USER32 ref: 00403D65
        • IsWindowEnabled.USER32(00000000), ref: 00403D6C
        • GetDlgItem.USER32 ref: 00403E1A
        • GetDlgItem.USER32 ref: 00403E24
        • SetClassLongA.USER32(?,000000F2,?,0000001C,000000FF), ref: 00403E3E
        • SendMessageA.USER32 ref: 00403E8F
        • GetDlgItem.USER32 ref: 00403F35
        • ShowWindow.USER32(00000000,?), ref: 00403F56
        • EnableWindow.USER32(?,?), ref: 00403F68
        • EnableWindow.USER32(?,?), ref: 00403F83
        • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F99
        • EnableMenuItem.USER32 ref: 00403FA0
        • SendMessageA.USER32 ref: 00403FB8
        • SendMessageA.USER32 ref: 00403FCB
        • lstrlenA.KERNEL32(0042A890,?,0042A890,00000000), ref: 00403FF5
        • SetWindowTextA.USER32(?,0042A890), ref: 00404004
        • ShowWindow.USER32(?,0000000A), ref: 00404138
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
        • String ID:
        • API String ID: 184305955-0
        • Opcode ID: 7a5d9994b8b7d5483664d5ab44f9fe767d237ce2ed75d97b1bae36ca26718a9b
        • Instruction ID: 5e2b37e592d4e435839d8b6e88a40281f914ef55e2ab9fcffeaa2cd4c4a1132c
        • Opcode Fuzzy Hash: 7a5d9994b8b7d5483664d5ab44f9fe767d237ce2ed75d97b1bae36ca26718a9b
        • Instruction Fuzzy Hash: 45C1D271600204AFDB21AF62ED88D2B3ABCEB95706F50053EF641B51F0CB799892DB1D
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 96%
        			E0040390A(void* __eflags) {
        				intOrPtr _v4;
        				intOrPtr _v8;
        				int _v12;
        				void _v16;
        				void* __ebx;
        				void* __edi;
        				void* __esi;
        				intOrPtr* _t17;
        				void* _t25;
        				void* _t27;
        				int _t28;
        				void* _t31;
        				int _t34;
        				int _t35;
        				int _t39;
        				char _t57;
        				CHAR* _t59;
        				signed char _t63;
        				CHAR* _t74;
        				intOrPtr _t76;
        				CHAR* _t81;
        
        				_t76 =  *0x42f434;
        				_t17 = E00406500(2);
        				_t84 = _t17;
        				if(_t17 == 0) {
        					_t74 = 0x42a890;
        					"C:\\Users\\alfons\\AppData\\Local\\Temp\\nsf5E6D.tmp" = 0x30;
        					M00436001 = 0x78;
        					M00436002 = 0;
        					E00405FDE(_t71, __eflags, 0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x42a890, 0);
        					__eflags =  *0x42a890;
        					if(__eflags == 0) {
        						E00405FDE(_t71, __eflags, 0x80000003, ".DEFAULT\\Control Panel\\International",  &M0040836A, 0x42a890, 0);
        					}
        					lstrcatA("C:\\Users\\alfons\\AppData\\Local\\Temp\\nsf5E6D.tmp", _t74);
        				} else {
        					E00406055("C:\\Users\\alfons\\AppData\\Local\\Temp\\nsf5E6D.tmp",  *_t17() & 0x0000ffff);
        				}
        				E00403BCF(_t71, _t84);
        				 *0x42f4c0 =  *0x42f43c & 0x00000020;
        				 *0x42f4dc = 0x10000;
        				if(E00405B7D(_t84, 0x435400) != 0) {
        					L16:
        					if(E00405B7D(_t92, 0x435400) == 0) {
        						E0040618A(0, _t74, _t76, 0x435400,  *((intOrPtr*)(_t76 + 0x118)));
        					}
        					_t25 = LoadImageA( *0x42f420, 0x67, 1, 0, 0, 0x8040);
        					 *0x42ec08 = _t25;
        					if( *((intOrPtr*)(_t76 + 0x50)) == 0xffffffff) {
        						L21:
        						if(E0040140B(0) == 0) {
        							_t27 = E00403BCF(_t71, __eflags);
        							__eflags =  *0x42f4e0;
        							if( *0x42f4e0 != 0) {
        								_t28 = E004052F0(_t27, 0);
        								__eflags = _t28;
        								if(_t28 == 0) {
        									E0040140B(1);
        									goto L33;
        								}
        								__eflags =  *0x42ebec;
        								if( *0x42ebec == 0) {
        									E0040140B(2);
        								}
        								goto L22;
        							}
        							ShowWindow( *0x42a870, 5);
        							_t34 = E00406492("RichEd20");
        							__eflags = _t34;
        							if(_t34 == 0) {
        								E00406492("RichEd32");
        							}
        							_t81 = "RichEdit20A";
        							_t35 = GetClassInfoA(0, _t81, 0x42ebc0);
        							__eflags = _t35;
        							if(_t35 == 0) {
        								GetClassInfoA(0, "RichEdit", 0x42ebc0);
        								 *0x42ebe4 = _t81;
        								RegisterClassA(0x42ebc0);
        							}
        							_t39 = DialogBoxParamA( *0x42f420,  *0x42ec00 + 0x00000069 & 0x0000ffff, 0, E00403CA7, 0);
        							E0040385A(E0040140B(5), 1);
        							return _t39;
        						}
        						L22:
        						_t31 = 2;
        						return _t31;
        					} else {
        						_t71 =  *0x42f420;
        						 *0x42ebc4 = E00401000;
        						 *0x42ebd0 =  *0x42f420;
        						 *0x42ebd4 = _t25;
        						 *0x42ebe4 = 0x40a1f4;
        						if(RegisterClassA(0x42ebc0) == 0) {
        							L33:
        							__eflags = 0;
        							return 0;
        						}
        						SystemParametersInfoA(0x30, 0,  &_v16, 0);
        						 *0x42a870 = CreateWindowExA(0x80, 0x40a1f4, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x42f420, 0);
        						goto L21;
        					}
        				} else {
        					_t71 =  *(_t76 + 0x48);
        					_t86 = _t71;
        					if(_t71 == 0) {
        						goto L16;
        					}
        					_t74 = 0x42e3c0;
        					E00405FDE(_t71, _t86,  *((intOrPtr*)(_t76 + 0x44)), _t71,  *((intOrPtr*)(_t76 + 0x4c)) +  *0x42f478, 0x42e3c0, 0);
        					_t57 =  *0x42e3c0;
        					if(_t57 == 0) {
        						goto L16;
        					}
        					if(_t57 == 0x22) {
        						_t74 = 0x42e3c1;
        						 *((char*)(E00405ABA(0x42e3c1, 0x22))) = 0;
        					}
        					_t59 = lstrlenA(_t74) + _t74 - 4;
        					if(_t59 <= _t74 || lstrcmpiA(_t59, ?str?) != 0) {
        						L15:
        						E004060F7(0x435400, E00405A8F(_t74));
        						goto L16;
        					} else {
        						_t63 = GetFileAttributesA(_t74);
        						if(_t63 == 0xffffffff) {
        							L14:
        							E00405AD6(_t74);
        							goto L15;
        						}
        						_t92 = _t63 & 0x00000010;
        						if((_t63 & 0x00000010) != 0) {
        							goto L15;
        						}
        						goto L14;
        					}
        				}
        			}
























        0x00403910
        0x00403919
        0x00403920
        0x00403922
        0x00403936
        0x00403948
        0x0040394f
        0x00403956
        0x0040395c
        0x00403961
        0x00403967
        0x0040397a
        0x0040397a
        0x00403985
        0x00403924
        0x0040392f
        0x0040392f
        0x0040398a
        0x0040399d
        0x004039a2
        0x004039b3
        0x00403a3a
        0x00403a42
        0x00403a4b
        0x00403a4b
        0x00403a61
        0x00403a67
        0x00403a75
        0x00403af6
        0x00403afe
        0x00403b08
        0x00403b0d
        0x00403b13
        0x00403b9d
        0x00403ba2
        0x00403ba4
        0x00403bc0
        0x00000000
        0x00403bc0
        0x00403ba6
        0x00403bac
        0x00403bb4
        0x00403bb4
        0x00000000
        0x00403bac
        0x00403b21
        0x00403b2c
        0x00403b31
        0x00403b33
        0x00403b3a
        0x00403b3a
        0x00403b45
        0x00403b4d
        0x00403b4f
        0x00403b51
        0x00403b5a
        0x00403b5d
        0x00403b63
        0x00403b63
        0x00403b82
        0x00403b93
        0x00000000
        0x00403b98
        0x00403b00
        0x00403b02
        0x00000000
        0x00403a77
        0x00403a77
        0x00403a83
        0x00403a8d
        0x00403a93
        0x00403a98
        0x00403aa7
        0x00403bc5
        0x00403bc5
        0x00000000
        0x00403bc5
        0x00403ab6
        0x00403af1
        0x00000000
        0x00403af1
        0x004039b9
        0x004039b9
        0x004039bc
        0x004039be
        0x00000000
        0x00000000
        0x004039c8
        0x004039d8
        0x004039dd
        0x004039e4
        0x00000000
        0x00000000
        0x004039e8
        0x004039ea
        0x004039f7
        0x004039f7
        0x004039ff
        0x00403a05
        0x00403a2d
        0x00403a35
        0x00000000
        0x00403a17
        0x00403a18
        0x00403a21
        0x00403a27
        0x00403a28
        0x00000000
        0x00403a28
        0x00403a23
        0x00403a25
        0x00000000
        0x00000000
        0x00000000
        0x00403a25
        0x00403a05

        APIs
          • Part of subcall function 00406500: GetModuleHandleA.KERNEL32(?,?,?,004033BB,0000000B), ref: 00406512
          • Part of subcall function 00406500: GetProcAddress.KERNEL32(00000000,?), ref: 0040652D
        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsf5E6D.tmp,0042A890,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A890,00000000,00000002,7519FA90,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ilnQNBU7NA.exe" ,00000000), ref: 00403985
        • lstrlenA.KERNEL32(0042E3C0,?,?,?,0042E3C0,00000000,00435400,C:\Users\user\AppData\Local\Temp\nsf5E6D.tmp,0042A890,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A890,00000000,00000002,7519FA90), ref: 004039FA
        • lstrcmpiA.KERNEL32(?,.exe,0042E3C0,?,?,?,0042E3C0,00000000,00435400,C:\Users\user\AppData\Local\Temp\nsf5E6D.tmp,0042A890,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A890,00000000), ref: 00403A0D
        • GetFileAttributesA.KERNEL32(0042E3C0), ref: 00403A18
        • LoadImageA.USER32 ref: 00403A61
          • Part of subcall function 00406055: wsprintfA.USER32 ref: 00406062
        • RegisterClassA.USER32 ref: 00403A9E
        • SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403AB6
        • CreateWindowExA.USER32 ref: 00403AEB
        • ShowWindow.USER32(00000005,00000000), ref: 00403B21
        • GetClassInfoA.USER32 ref: 00403B4D
        • GetClassInfoA.USER32 ref: 00403B5A
        • RegisterClassA.USER32 ref: 00403B63
        • DialogBoxParamA.USER32 ref: 00403B82
        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
        • String ID: "C:\Users\user\Desktop\ilnQNBU7NA.exe" $.DEFAULT\Control Panel\International$.exe$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsf5E6D.tmp$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
        • API String ID: 1975747703-374276725
        • Opcode ID: bf4b58a18f8def52aed812ad83ca3b0c7ceda486cf0da5eaf41a6ea4bc3d6bf1
        • Instruction ID: 74cd8b4f7d81cde8c77274d740e3983652abf123a0ec58253698c850822a2f16
        • Opcode Fuzzy Hash: bf4b58a18f8def52aed812ad83ca3b0c7ceda486cf0da5eaf41a6ea4bc3d6bf1
        • Instruction Fuzzy Hash: EC61A5702402016ED220FB669D46F373ABCEB4474DF50403FF995B62E3DA7DA9068A2D
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 91%
        			E004042E6(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
        				intOrPtr _v8;
        				signed int _v12;
        				void* _v16;
        				struct HWND__* _t52;
        				long _t86;
        				int _t98;
        				struct HWND__* _t99;
        				signed int _t100;
        				intOrPtr _t109;
        				int _t110;
        				signed int* _t112;
        				signed int _t113;
        				char* _t114;
        				CHAR* _t115;
        
        				if(_a8 != 0x110) {
        					if(_a8 != 0x111) {
        						L11:
        						if(_a8 != 0x4e) {
        							if(_a8 == 0x40b) {
        								 *0x42985c =  *0x42985c + 1;
        							}
        							L25:
        							_t110 = _a16;
        							L26:
        							return E004041E2(_a8, _a12, _t110);
        						}
        						_t52 = GetDlgItem(_a4, 0x3e8);
        						_t110 = _a16;
        						if( *((intOrPtr*)(_t110 + 8)) == 0x70b &&  *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
        							_t100 =  *((intOrPtr*)(_t110 + 0x1c));
        							_t109 =  *((intOrPtr*)(_t110 + 0x18));
        							_v12 = _t100;
        							_v16 = _t109;
        							_v8 = 0x42e3c0;
        							if(_t100 - _t109 < 0x800) {
        								SendMessageA(_t52, 0x44b, 0,  &_v16);
        								SetCursor(LoadCursorA(0, 0x7f02));
        								_push(1);
        								E0040458A(_a4, _v8);
        								SetCursor(LoadCursorA(0, 0x7f00));
        								_t110 = _a16;
        							}
        						}
        						if( *((intOrPtr*)(_t110 + 8)) != 0x700 ||  *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
        							goto L26;
        						} else {
        							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
        								SendMessageA( *0x42f428, 0x111, 1, 0);
        							}
        							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
        								SendMessageA( *0x42f428, 0x10, 0, 0);
        							}
        							return 1;
        						}
        					}
        					if(_a12 >> 0x10 != 0 ||  *0x42985c != 0) {
        						goto L25;
        					} else {
        						_t112 =  *0x42a068 + 0x14;
        						if(( *_t112 & 0x00000020) == 0) {
        							goto L25;
        						}
        						 *_t112 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
        						E0040419D(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
        						E00404566();
        						goto L11;
        					}
        				}
        				_t98 = _a16;
        				_t113 =  *(_t98 + 0x30);
        				if(_t113 < 0) {
        					_t113 =  *( *0x42ebfc - 4 + _t113 * 4);
        				}
        				_push( *((intOrPtr*)(_t98 + 0x34)));
        				_t114 = _t113 +  *0x42f478;
        				_push(0x22);
        				_a16 =  *_t114;
        				_v12 = _v12 & 0x00000000;
        				_t115 = _t114 + 1;
        				_v16 = _t115;
        				_v8 = E004042B1;
        				E0040417B(_a4);
        				_push( *((intOrPtr*)(_t98 + 0x38)));
        				_push(0x23);
        				E0040417B(_a4);
        				CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
        				E0040419D( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
        				_t99 = GetDlgItem(_a4, 0x3e8);
        				E004041B0(_t99);
        				SendMessageA(_t99, 0x45b, 1, 0);
        				_t86 =  *( *0x42f434 + 0x68);
        				if(_t86 < 0) {
        					_t86 = GetSysColor( ~_t86);
        				}
        				SendMessageA(_t99, 0x443, 0, _t86);
        				SendMessageA(_t99, 0x445, 0, 0x4010000);
        				SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
        				 *0x42985c = 0;
        				SendMessageA(_t99, 0x449, _a16,  &_v16);
        				 *0x42985c = 0;
        				return 0;
        			}

















        0x004042f6
        0x0040441b
        0x00404477
        0x0040447b
        0x00404548
        0x0040454a
        0x0040454a
        0x00404550
        0x00404550
        0x00404553
        0x00000000
        0x0040455a
        0x00404489
        0x0040448b
        0x00404495
        0x004044a0
        0x004044a3
        0x004044a6
        0x004044b1
        0x004044b4
        0x004044bb
        0x004044c9
        0x004044e1
        0x004044e3
        0x004044eb
        0x004044fa
        0x004044fc
        0x004044fc
        0x004044bb
        0x00404506
        0x00000000
        0x00404511
        0x00404515
        0x00404526
        0x00404526
        0x0040452c
        0x0040453a
        0x0040453a
        0x00000000
        0x0040453e
        0x00404506
        0x00404426
        0x00000000
        0x0040443a
        0x00404440
        0x00404446
        0x00000000
        0x00000000
        0x0040446b
        0x0040446d
        0x00404472
        0x00000000
        0x00404472
        0x00404426
        0x004042fc
        0x004042ff
        0x00404304
        0x00404315
        0x00404315
        0x0040431c
        0x0040431f
        0x00404321
        0x00404326
        0x0040432f
        0x00404335
        0x00404341
        0x00404344
        0x0040434d
        0x00404352
        0x00404355
        0x0040435a
        0x00404371
        0x00404378
        0x0040438b
        0x0040438e
        0x004043a3
        0x004043aa
        0x004043af
        0x004043b4
        0x004043b4
        0x004043c3
        0x004043d2
        0x004043e4
        0x004043e9
        0x004043f9
        0x004043fb
        0x00000000

        APIs
        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
        • String ID: N
        • API String ID: 3103080414-1130791706
        • Opcode ID: 745d5685d33c6010513eb6a6e6710873411dad37f80b0c9191fb1ce11dc8c820
        • Instruction ID: 2ba0dcbd17e821031ba3c657239c4b48ae58aa12c0a6ed8defdb88479dfe25c9
        • Opcode Fuzzy Hash: 745d5685d33c6010513eb6a6e6710873411dad37f80b0c9191fb1ce11dc8c820
        • Instruction Fuzzy Hash: CC61C2B1A00209BFDF10AF61DD45F6A3B69EB94754F00803AFB04BA1D1C7B8A951CF98
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 78%
        			E00402EA1(void* __eflags, signed int _a4) {
        				DWORD* _v8;
        				DWORD* _v12;
        				void* _v16;
        				intOrPtr _v20;
        				long _v24;
        				intOrPtr _v28;
        				intOrPtr _v32;
        				intOrPtr _v36;
        				intOrPtr _v40;
        				signed int _v44;
        				long _t43;
        				long _t50;
        				intOrPtr* _t59;
        				long _t70;
        				signed int _t77;
        				intOrPtr _t80;
        				long _t82;
        				void* _t85;
        				void* _t89;
        				long _t90;
        				long _t93;
        				intOrPtr* _t94;
        
        				_t82 = 0;
        				_v12 = 0;
        				_v8 = 0;
        				_t43 = GetTickCount();
        				_t91 = "C:\\Users\\alfons\\Desktop\\ilnQNBU7NA.exe";
        				 *0x42f430 = _t43 + 0x3e8;
        				GetModuleFileNameA(0, "C:\\Users\\alfons\\Desktop\\ilnQNBU7NA.exe", 0x400);
        				_t89 = E00405C90(_t91, 0x80000000, 3);
        				_v16 = _t89;
        				 *0x40a018 = _t89;
        				if(_t89 == 0xffffffff) {
        					return "Error launching installer";
        				}
        				_t92 = "C:\\Users\\alfons\\Desktop";
        				E004060F7("C:\\Users\\alfons\\Desktop", _t91);
        				E004060F7(0x437000, E00405AD6(_t92));
        				_t50 = GetFileSize(_t89, 0);
        				 *0x42944c = _t50;
        				_t93 = _t50;
        				if(_t50 <= 0) {
        					L24:
        					E00402E3D(1);
        					if( *0x42f438 == _t82) {
        						goto L29;
        					}
        					if(_v8 == _t82) {
        						L28:
        						_t94 = GlobalAlloc(0x40, _v24);
        						E00403300( *0x42f438 + 0x1c);
        						_push(_v24);
        						_push(_t94);
        						_push(_t82);
        						_push(0xffffffff);
        						if(E004030D8() == _v24) {
        							 *0x42f434 = _t94;
        							 *0x42f43c =  *_t94;
        							if((_v44 & 0x00000001) != 0) {
        								 *0x42f440 =  *0x42f440 + 1;
        							}
        							_t40 = _t94 + 0x44; // 0x44
        							_t59 = _t40;
        							_t85 = 8;
        							do {
        								_t59 = _t59 - 8;
        								 *_t59 =  *_t59 + _t94;
        								_t85 = _t85 - 1;
        							} while (_t85 != 0);
        							 *((intOrPtr*)(_t94 + 0x3c)) = SetFilePointer(_v16, _t82, _t82, 1);
        							E00405C4B(0x42f460, _t94 + 4, 0x40);
        							return 0;
        						}
        						goto L29;
        					}
        					E00403300( *0x41d440);
        					if(E004032EA( &_a4, 4) == 0 || _v12 != _a4) {
        						goto L29;
        					} else {
        						goto L28;
        					}
        				} else {
        					do {
        						_t90 = _t93;
        						asm("sbb eax, eax");
        						_t70 = ( ~( *0x42f438) & 0x00007e00) + 0x200;
        						if(_t93 >= _t70) {
        							_t90 = _t70;
        						}
        						if(E004032EA(0x415440, _t90) == 0) {
        							E00402E3D(1);
        							L29:
        							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
        						}
        						if( *0x42f438 != 0) {
        							if((_a4 & 0x00000002) == 0) {
        								E00402E3D(0);
        							}
        							goto L20;
        						}
        						E00405C4B( &_v44, 0x415440, 0x1c);
        						_t77 = _v44;
        						if((_t77 & 0xfffffff0) == 0 && _v40 == 0xdeadbeef && _v28 == 0x74736e49 && _v32 == 0x74666f73 && _v36 == 0x6c6c754e) {
        							_a4 = _a4 | _t77;
        							 *0x42f4e0 =  *0x42f4e0 | _a4 & 0x00000002;
        							_t80 = _v20;
        							 *0x42f438 =  *0x41d440;
        							if(_t80 > _t93) {
        								goto L29;
        							}
        							if((_a4 & 0x00000008) != 0 || (_a4 & 0x00000004) == 0) {
        								_v8 = _v8 + 1;
        								_t24 = _t80 - 4; // 0x40a194
        								_t93 = _t24;
        								if(_t90 > _t93) {
        									_t90 = _t93;
        								}
        								goto L20;
        							} else {
        								break;
        							}
        						}
        						L20:
        						if(_t93 <  *0x42944c) {
        							_v12 = E004065B7(_v12, 0x415440, _t90);
        						}
        						 *0x41d440 =  *0x41d440 + _t90;
        						_t93 = _t93 - _t90;
        					} while (_t93 != 0);
        					_t82 = 0;
        					goto L24;
        				}
        			}

























        0x00402ea9
        0x00402eac
        0x00402eaf
        0x00402eb2
        0x00402eb8
        0x00402ec9
        0x00402ece
        0x00402ee1
        0x00402ee6
        0x00402ee9
        0x00402eef
        0x00000000
        0x00402ef1
        0x00402efc
        0x00402f02
        0x00402f13
        0x00402f1a
        0x00402f22
        0x00402f27
        0x00402f29
        0x00403014
        0x00403016
        0x00403022
        0x00000000
        0x00000000
        0x00403027
        0x0040304b
        0x00403056
        0x00403061
        0x00403066
        0x00403069
        0x0040306a
        0x0040306b
        0x00403075
        0x0040308c
        0x00403094
        0x00403099
        0x0040309b
        0x0040309b
        0x004030a3
        0x004030a3
        0x004030a6
        0x004030a7
        0x004030a7
        0x004030aa
        0x004030ac
        0x004030ac
        0x004030bc
        0x004030ca
        0x00000000
        0x004030cf
        0x00000000
        0x00403075
        0x0040302f
        0x00403041
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x00402f2f
        0x00402f34
        0x00402f39
        0x00402f3d
        0x00402f44
        0x00402f4b
        0x00402f4d
        0x00402f4d
        0x00402f58
        0x00403080
        0x00403077
        0x00000000
        0x00403077
        0x00402f65
        0x00402fe5
        0x00402fe9
        0x00402fee
        0x00000000
        0x00402fe5
        0x00402f6e
        0x00402f73
        0x00402f7b
        0x00402fa1
        0x00402fb0
        0x00402fb6
        0x00402fbb
        0x00402fc1
        0x00000000
        0x00000000
        0x00402fcb
        0x00402fd3
        0x00402fd6
        0x00402fd6
        0x00402fdb
        0x00402fdd
        0x00402fdd
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x00402fcb
        0x00402fef
        0x00402ff5
        0x00403001
        0x00403001
        0x00403004
        0x0040300a
        0x0040300a
        0x00403012
        0x00000000
        0x00403012

        APIs
        • GetTickCount.KERNEL32 ref: 00402EB2
        • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\ilnQNBU7NA.exe,00000400), ref: 00402ECE
          • Part of subcall function 00405C90: GetFileAttributesA.KERNELBASE(00000003,00402EE1,C:\Users\user\Desktop\ilnQNBU7NA.exe,80000000,00000003), ref: 00405C94
          • Part of subcall function 00405C90: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405CB6
        • GetFileSize.KERNEL32(00000000,00000000,00437000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\ilnQNBU7NA.exe,C:\Users\user\Desktop\ilnQNBU7NA.exe,80000000,00000003), ref: 00402F1A
        • GlobalAlloc.KERNEL32(00000040,00000020), ref: 00403050
        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
        • String ID: "C:\Users\user\Desktop\ilnQNBU7NA.exe" $@TA$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\ilnQNBU7NA.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
        • API String ID: 2803837635-1993542223
        • Opcode ID: d2642f5c1e57ff917447350ecc80b65a471f1c26fbd3ec2d1bf2d56bf534e989
        • Instruction ID: b77d5a27d8a3a8735664692b17331c00252a13d20c8f5ee7c59d5cd6c332e3a5
        • Opcode Fuzzy Hash: d2642f5c1e57ff917447350ecc80b65a471f1c26fbd3ec2d1bf2d56bf534e989
        • Instruction Fuzzy Hash: B851E471A00204ABDF20AF64DD85FAF7AB8AB14359F60413BF500B22D1C7B89E858B5D
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 90%
        			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
        				struct tagLOGBRUSH _v16;
        				struct tagRECT _v32;
        				struct tagPAINTSTRUCT _v96;
        				struct HDC__* _t70;
        				struct HBRUSH__* _t87;
        				struct HFONT__* _t94;
        				long _t102;
        				signed int _t126;
        				struct HDC__* _t128;
        				intOrPtr _t130;
        
        				if(_a8 == 0xf) {
        					_t130 =  *0x42f434;
        					_t70 = BeginPaint(_a4,  &_v96);
        					_v16.lbStyle = _v16.lbStyle & 0x00000000;
        					_a8 = _t70;
        					GetClientRect(_a4,  &_v32);
        					_t126 = _v32.bottom;
        					_v32.bottom = _v32.bottom & 0x00000000;
        					while(_v32.top < _t126) {
        						_a12 = _t126 - _v32.top;
        						asm("cdq");
        						asm("cdq");
        						asm("cdq");
        						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
        						_t87 = CreateBrushIndirect( &_v16);
        						_v32.bottom = _v32.bottom + 4;
        						_a16 = _t87;
        						FillRect(_a8,  &_v32, _t87);
        						DeleteObject(_a16);
        						_v32.top = _v32.top + 4;
        					}
        					if( *(_t130 + 0x58) != 0xffffffff) {
        						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
        						_a16 = _t94;
        						if(_t94 != 0) {
        							_t128 = _a8;
        							_v32.left = 0x10;
        							_v32.top = 8;
        							SetBkMode(_t128, 1);
        							SetTextColor(_t128,  *(_t130 + 0x58));
        							_a8 = SelectObject(_t128, _a16);
        							DrawTextA(_t128, 0x42ec20, 0xffffffff,  &_v32, 0x820);
        							SelectObject(_t128, _a8);
        							DeleteObject(_a16);
        						}
        					}
        					EndPaint(_a4,  &_v96);
        					return 0;
        				}
        				_t102 = _a16;
        				if(_a8 == 0x46) {
        					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
        					 *((intOrPtr*)(_t102 + 4)) =  *0x42f428;
        				}
        				return DefWindowProcA(_a4, _a8, _a12, _t102);
        			}













        0x0040100a
        0x00401039
        0x00401047
        0x0040104d
        0x00401051
        0x0040105b
        0x00401061
        0x00401064
        0x004010f3
        0x00401089
        0x0040108c
        0x004010a6
        0x004010bd
        0x004010cc
        0x004010cf
        0x004010d5
        0x004010d9
        0x004010e4
        0x004010ed
        0x004010ef
        0x004010ef
        0x00401100
        0x00401105
        0x0040110d
        0x00401110
        0x00401112
        0x00401118
        0x0040111f
        0x00401126
        0x00401130
        0x00401142
        0x00401156
        0x00401160
        0x00401165
        0x00401165
        0x00401110
        0x0040116e
        0x00000000
        0x00401178
        0x00401010
        0x00401013
        0x00401015
        0x0040101f
        0x0040101f
        0x00000000

        APIs
        • DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
        • BeginPaint.USER32(?,?), ref: 00401047
        • GetClientRect.USER32 ref: 0040105B
        • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
        • FillRect.USER32 ref: 004010E4
        • DeleteObject.GDI32(?), ref: 004010ED
        • CreateFontIndirectA.GDI32(?), ref: 00401105
        • SetBkMode.GDI32(00000000,00000001), ref: 00401126
        • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
        • SelectObject.GDI32(00000000,?), ref: 00401140
        • DrawTextA.USER32(00000000,0042EC20,000000FF,00000010,00000820), ref: 00401156
        • SelectObject.GDI32(00000000,00000000), ref: 00401160
        • DeleteObject.GDI32(?), ref: 00401165
        • EndPaint.USER32(?,?), ref: 0040116E
        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
        • String ID: F
        • API String ID: 941294808-1304234792
        • Opcode ID: bb71a3ab4a4fa1f895d534f8b47170c1d9b9c824dc85430c64170ade6c4bb6c2
        • Instruction ID: fc049dc8deed713fddbaab3278265d12b48f61153473f3c5d5e2d7be2f7e1970
        • Opcode Fuzzy Hash: bb71a3ab4a4fa1f895d534f8b47170c1d9b9c824dc85430c64170ade6c4bb6c2
        • Instruction Fuzzy Hash: 33417D71400249AFCF058FA5DE459AFBFB9FF44314F00802AF591AA1A0CB74D955DFA4
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E00405D66(void* __ecx) {
        				void* __ebx;
        				void* __edi;
        				void* __esi;
        				long _t12;
        				long _t24;
        				char* _t31;
        				int _t37;
        				void* _t38;
        				intOrPtr* _t39;
        				long _t42;
        				CHAR* _t44;
        				void* _t46;
        				void* _t48;
        				void* _t49;
        				void* _t52;
        				void* _t53;
        
        				_t38 = __ecx;
        				_t44 =  *(_t52 + 0x14);
        				 *0x42c620 = 0x4c554e;
        				if(_t44 == 0) {
        					L3:
        					_t12 = GetShortPathNameA( *(_t52 + 0x1c), 0x42ca20, 0x400);
        					if(_t12 != 0 && _t12 <= 0x400) {
        						_t37 = wsprintfA(0x42c220, "%s=%s\r\n", 0x42c620, 0x42ca20);
        						_t53 = _t52 + 0x10;
        						E0040618A(_t37, 0x400, 0x42ca20, 0x42ca20,  *((intOrPtr*)( *0x42f434 + 0x128)));
        						_t12 = E00405C90(0x42ca20, 0xc0000000, 4);
        						_t48 = _t12;
        						 *(_t53 + 0x18) = _t48;
        						if(_t48 != 0xffffffff) {
        							_t42 = GetFileSize(_t48, 0);
        							_t6 = _t37 + 0xa; // 0xa
        							_t46 = GlobalAlloc(0x40, _t42 + _t6);
        							if(_t46 == 0 || E00405D08(_t48, _t46, _t42) == 0) {
        								L18:
        								return CloseHandle(_t48);
        							} else {
        								if(E00405BF5(_t38, _t46, "[Rename]\r\n") != 0) {
        									_t49 = E00405BF5(_t38, _t21 + 0xa, 0x40a3d8);
        									if(_t49 == 0) {
        										_t48 =  *(_t53 + 0x18);
        										L16:
        										_t24 = _t42;
        										L17:
        										E00405C4B(_t24 + _t46, 0x42c220, _t37);
        										SetFilePointer(_t48, 0, 0, 0);
        										E00405D37(_t48, _t46, _t42 + _t37);
        										GlobalFree(_t46);
        										goto L18;
        									}
        									_t39 = _t46 + _t42;
        									_t31 = _t39 + _t37;
        									while(_t39 > _t49) {
        										 *_t31 =  *_t39;
        										_t31 = _t31 - 1;
        										_t39 = _t39 - 1;
        									}
        									_t24 = _t49 - _t46 + 1;
        									_t48 =  *(_t53 + 0x18);
        									goto L17;
        								}
        								lstrcpyA(_t46 + _t42, "[Rename]\r\n");
        								_t42 = _t42 + 0xa;
        								goto L16;
        							}
        						}
        					}
        				} else {
        					CloseHandle(E00405C90(_t44, 0, 1));
        					_t12 = GetShortPathNameA(_t44, 0x42c620, 0x400);
        					if(_t12 != 0 && _t12 <= 0x400) {
        						goto L3;
        					}
        				}
        				return _t12;
        			}



















        0x00405d66
        0x00405d6f
        0x00405d76
        0x00405d8a
        0x00405db2
        0x00405dbd
        0x00405dc1
        0x00405de1
        0x00405de8
        0x00405df2
        0x00405dff
        0x00405e04
        0x00405e09
        0x00405e0d
        0x00405e1c
        0x00405e1e
        0x00405e2b
        0x00405e2f
        0x00405eca
        0x00000000
        0x00405e45
        0x00405e52
        0x00405e76
        0x00405e7a
        0x00405e99
        0x00405e9d
        0x00405e9d
        0x00405e9f
        0x00405ea8
        0x00405eb3
        0x00405ebe
        0x00405ec4
        0x00000000
        0x00405ec4
        0x00405e7c
        0x00405e7f
        0x00405e8a
        0x00405e86
        0x00405e88
        0x00405e89
        0x00405e89
        0x00405e91
        0x00405e93
        0x00000000
        0x00405e93
        0x00405e5d
        0x00405e63
        0x00000000
        0x00405e63
        0x00405e2f
        0x00405e0d
        0x00405d8c
        0x00405d97
        0x00405da0
        0x00405da4
        0x00000000
        0x00000000
        0x00405da4
        0x00405ed5

        APIs
        • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00405EF7,?,?), ref: 00405D97
        • GetShortPathNameA.KERNEL32 ref: 00405DA0
          • Part of subcall function 00405BF5: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E50,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405C05
          • Part of subcall function 00405BF5: lstrlenA.KERNEL32(00000000,?,00000000,00405E50,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405C37
        • GetShortPathNameA.KERNEL32 ref: 00405DBD
        • wsprintfA.USER32 ref: 00405DDB
        • GetFileSize.KERNEL32(00000000,00000000,0042CA20,C0000000,00000004,0042CA20,?,?,?,?,?), ref: 00405E16
        • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405E25
        • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E5D
        • SetFilePointer.KERNEL32(0040A3D8,00000000,00000000,00000000,00000000,0042C220,00000000,-0000000A,0040A3D8,00000000,[Rename],00000000,00000000,00000000), ref: 00405EB3
        • GlobalFree.KERNEL32 ref: 00405EC4
        • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405ECB
          • Part of subcall function 00405C90: GetFileAttributesA.KERNELBASE(00000003,00402EE1,C:\Users\user\Desktop\ilnQNBU7NA.exe,80000000,00000003), ref: 00405C94
          • Part of subcall function 00405C90: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405CB6
        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
        • String ID: %s=%s$[Rename]
        • API String ID: 2171350718-1727408572
        • Opcode ID: 9a95bfeda5c53b018fe09f3750e4747cc6a042449e28eeaa199560d843d4c122
        • Instruction ID: 2ccb2bf8dd744840d543bbc1a34bde763c5e5f86f0f2c8118c993f85f4779e4e
        • Opcode Fuzzy Hash: 9a95bfeda5c53b018fe09f3750e4747cc6a042449e28eeaa199560d843d4c122
        • Instruction Fuzzy Hash: 39310531600B15ABC2206B659D48F6B3A5CDF45755F14043BB981F62C2DF7CE9028AFD
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 72%
        			E0040618A(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
        				struct _ITEMIDLIST* _v8;
        				char _v12;
        				signed int _v16;
        				signed char _v20;
        				signed int _v24;
        				signed char _v28;
        				signed int _t38;
        				CHAR* _t39;
        				signed int _t41;
        				char _t52;
        				char _t53;
        				char _t55;
        				char _t57;
        				void* _t65;
        				char* _t66;
        				signed int _t80;
        				char _t88;
        				void* _t89;
        				CHAR* _t90;
        				void* _t92;
        				signed int _t97;
        				signed int _t99;
        				void* _t100;
        
        				_t92 = __esi;
        				_t89 = __edi;
        				_t65 = __ebx;
        				_t38 = _a8;
        				if(_t38 < 0) {
        					_t38 =  *( *0x42ebfc - 4 + _t38 * 4);
        				}
        				_push(_t65);
        				_push(_t92);
        				_push(_t89);
        				_t66 = _t38 +  *0x42f478;
        				_t39 = 0x42e3c0;
        				_t90 = 0x42e3c0;
        				if(_a4 >= 0x42e3c0 && _a4 - 0x42e3c0 < 0x800) {
        					_t90 = _a4;
        					_a4 = _a4 & 0x00000000;
        				}
        				while(1) {
        					_t88 =  *_t66;
        					if(_t88 == 0) {
        						break;
        					}
        					__eflags = _t90 - _t39 - 0x400;
        					if(_t90 - _t39 >= 0x400) {
        						break;
        					}
        					_t66 = _t66 + 1;
        					__eflags = _t88 - 4;
        					_a8 = _t66;
        					if(__eflags >= 0) {
        						if(__eflags != 0) {
        							 *_t90 = _t88;
        							_t90 =  &(_t90[1]);
        							__eflags = _t90;
        						} else {
        							 *_t90 =  *_t66;
        							_t90 =  &(_t90[1]);
        							_t66 = _t66 + 1;
        						}
        						continue;
        					}
        					_t41 =  *((char*)(_t66 + 1));
        					_t80 =  *_t66;
        					_t97 = (_t41 & 0x0000007f) << 0x00000007 | _t80 & 0x0000007f;
        					_v24 = _t80;
        					_v28 = _t80 | 0x00000080;
        					_v16 = _t41;
        					_v20 = _t41 | 0x00000080;
        					_t66 = _a8 + 2;
        					__eflags = _t88 - 2;
        					if(_t88 != 2) {
        						__eflags = _t88 - 3;
        						if(_t88 != 3) {
        							__eflags = _t88 - 1;
        							if(_t88 == 1) {
        								__eflags = (_t41 | 0xffffffff) - _t97;
        								E0040618A(_t66, _t90, _t97, _t90, (_t41 | 0xffffffff) - _t97);
        							}
        							L42:
        							_t90 =  &(_t90[lstrlenA(_t90)]);
        							_t39 = 0x42e3c0;
        							continue;
        						}
        						__eflags = _t97 - 0x1d;
        						if(_t97 != 0x1d) {
        							__eflags = (_t97 << 0xa) + 0x430000;
        							E004060F7(_t90, (_t97 << 0xa) + 0x430000);
        						} else {
        							E00406055(_t90,  *0x42f428);
        						}
        						__eflags = _t97 + 0xffffffeb - 7;
        						if(_t97 + 0xffffffeb < 7) {
        							L33:
        							E004063D2(_t90);
        						}
        						goto L42;
        					}
        					_t52 =  *0x42f42c;
        					__eflags = _t52;
        					_t99 = 2;
        					if(_t52 >= 0) {
        						L13:
        						_a8 = 1;
        						L14:
        						__eflags =  *0x42f4c4;
        						if( *0x42f4c4 != 0) {
        							_t99 = 4;
        						}
        						__eflags = _t80;
        						if(__eflags >= 0) {
        							__eflags = _t80 - 0x25;
        							if(_t80 != 0x25) {
        								__eflags = _t80 - 0x24;
        								if(_t80 == 0x24) {
        									GetWindowsDirectoryA(_t90, 0x400);
        									_t99 = 0;
        								}
        								while(1) {
        									__eflags = _t99;
        									if(_t99 == 0) {
        										goto L30;
        									}
        									_t53 =  *0x42f424;
        									_t99 = _t99 - 1;
        									__eflags = _t53;
        									if(_t53 == 0) {
        										L26:
        										_t55 = SHGetSpecialFolderLocation( *0x42f428,  *(_t100 + _t99 * 4 - 0x18),  &_v8);
        										__eflags = _t55;
        										if(_t55 != 0) {
        											L28:
        											 *_t90 =  *_t90 & 0x00000000;
        											__eflags =  *_t90;
        											continue;
        										}
        										__imp__SHGetPathFromIDListA(_v8, _t90);
        										_v12 = _t55;
        										__imp__CoTaskMemFree(_v8);
        										__eflags = _v12;
        										if(_v12 != 0) {
        											goto L30;
        										}
        										goto L28;
        									}
        									__eflags = _a8;
        									if(_a8 == 0) {
        										goto L26;
        									}
        									_t57 =  *_t53( *0x42f428,  *(_t100 + _t99 * 4 - 0x18), 0, 0, _t90);
        									__eflags = _t57;
        									if(_t57 == 0) {
        										goto L30;
        									}
        									goto L26;
        								}
        								goto L30;
        							}
        							GetSystemDirectoryA(_t90, 0x400);
        							goto L30;
        						} else {
        							E00405FDE((_t80 & 0x0000003f) +  *0x42f478, __eflags, 0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t80 & 0x0000003f) +  *0x42f478, _t90, _t80 & 0x00000040);
        							__eflags =  *_t90;
        							if( *_t90 != 0) {
        								L31:
        								__eflags = _v16 - 0x1a;
        								if(_v16 == 0x1a) {
        									lstrcatA(_t90, "\\Microsoft\\Internet Explorer\\Quick Launch");
        								}
        								goto L33;
        							}
        							E0040618A(_t66, _t90, _t99, _t90, _v16);
        							L30:
        							__eflags =  *_t90;
        							if( *_t90 == 0) {
        								goto L33;
        							}
        							goto L31;
        						}
        					}
        					__eflags = _t52 - 0x5a04;
        					if(_t52 == 0x5a04) {
        						goto L13;
        					}
        					__eflags = _v16 - 0x23;
        					if(_v16 == 0x23) {
        						goto L13;
        					}
        					__eflags = _v16 - 0x2e;
        					if(_v16 == 0x2e) {
        						goto L13;
        					} else {
        						_a8 = _a8 & 0x00000000;
        						goto L14;
        					}
        				}
        				 *_t90 =  *_t90 & 0x00000000;
        				if(_a4 == 0) {
        					return _t39;
        				}
        				return E004060F7(_a4, _t39);
        			}


























        0x0040618a
        0x0040618a
        0x0040618a
        0x00406190
        0x00406195
        0x004061a6
        0x004061a6
        0x004061ae
        0x004061af
        0x004061b0
        0x004061b1
        0x004061b4
        0x004061bc
        0x004061be
        0x004061d5
        0x004061d8
        0x004061d8
        0x004063af
        0x004063af
        0x004063b3
        0x00000000
        0x00000000
        0x004061e5
        0x004061eb
        0x00000000
        0x00000000
        0x004061f1
        0x004061f2
        0x004061f5
        0x004061f8
        0x004063a2
        0x004063ac
        0x004063ae
        0x004063ae
        0x004063a4
        0x004063a6
        0x004063a8
        0x004063a9
        0x004063a9
        0x00000000
        0x004063a2
        0x004061fe
        0x00406202
        0x00406212
        0x00406219
        0x0040621c
        0x00406224
        0x00406227
        0x0040622e
        0x0040622f
        0x00406232
        0x0040634f
        0x00406352
        0x00406382
        0x00406385
        0x0040638a
        0x0040638e
        0x0040638e
        0x00406393
        0x00406399
        0x0040639b
        0x00000000
        0x0040639b
        0x00406354
        0x00406357
        0x0040636c
        0x00406373
        0x00406359
        0x00406360
        0x00406360
        0x0040637b
        0x0040637e
        0x00406347
        0x00406348
        0x00406348
        0x00000000
        0x0040637e
        0x00406238
        0x0040623f
        0x00406241
        0x00406242
        0x0040625c
        0x0040625c
        0x00406263
        0x00406263
        0x0040626a
        0x0040626e
        0x0040626e
        0x0040626f
        0x00406271
        0x004062aa
        0x004062ad
        0x004062bd
        0x004062c0
        0x004062c8
        0x004062ce
        0x004062ce
        0x0040632d
        0x0040632d
        0x0040632f
        0x00000000
        0x00000000
        0x004062d2
        0x004062d9
        0x004062da
        0x004062dc
        0x004062f6
        0x00406304
        0x0040630a
        0x0040630c
        0x0040632a
        0x0040632a
        0x0040632a
        0x00000000
        0x0040632a
        0x00406312
        0x0040631b
        0x0040631e
        0x00406324
        0x00406328
        0x00000000
        0x00000000
        0x00000000
        0x00406328
        0x004062de
        0x004062e1
        0x00000000
        0x00000000
        0x004062f0
        0x004062f2
        0x004062f4
        0x00000000
        0x00000000
        0x00000000
        0x004062f4
        0x00000000
        0x0040632d
        0x004062b5
        0x00000000
        0x00406273
        0x0040628e
        0x00406293
        0x00406296
        0x00406336
        0x00406336
        0x0040633a
        0x00406342
        0x00406342
        0x00000000
        0x0040633a
        0x004062a0
        0x00406331
        0x00406331
        0x00406334
        0x00000000
        0x00000000
        0x00000000
        0x00406334
        0x00406271
        0x00406244
        0x00406248
        0x00000000
        0x00000000
        0x0040624a
        0x0040624e
        0x00000000
        0x00000000
        0x00406250
        0x00406254
        0x00000000
        0x00406256
        0x00406256
        0x00000000
        0x00406256
        0x00406254
        0x004063b9
        0x004063c3
        0x004063cf
        0x004063cf
        0x00000000

        APIs
        • GetSystemDirectoryA.KERNEL32 ref: 004062B5
        • GetWindowsDirectoryA.KERNEL32(0042E3C0,00000400,?,0042A070,00000000,00405256,0042A070,00000000), ref: 004062C8
        • SHGetSpecialFolderLocation.SHELL32(00405256,7519EA30,?,0042A070,00000000,00405256,0042A070,00000000), ref: 00406304
        • SHGetPathFromIDListA.SHELL32(7519EA30,0042E3C0), ref: 00406312
        • CoTaskMemFree.OLE32(7519EA30), ref: 0040631E
        • lstrcatA.KERNEL32(0042E3C0,\Microsoft\Internet Explorer\Quick Launch), ref: 00406342
        • lstrlenA.KERNEL32(0042E3C0,?,0042A070,00000000,00405256,0042A070,00000000,00000000,?,7519EA30), ref: 00406394
        Strings
        • \Microsoft\Internet Explorer\Quick Launch, xrefs: 0040633C
        • Software\Microsoft\Windows\CurrentVersion, xrefs: 00406284
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
        • String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
        • API String ID: 717251189-730719616
        • Opcode ID: b81506d31a7a79703f981676f635a9404e1a7eaaabc2c3c435cbfeb6c21f0a75
        • Instruction ID: 7f70e83a291e570019a42af90a820afb382591873456cc4d5332d159a7ba1b0c
        • Opcode Fuzzy Hash: b81506d31a7a79703f981676f635a9404e1a7eaaabc2c3c435cbfeb6c21f0a75
        • Instruction Fuzzy Hash: 58612470A00110AADF206F65CC90BBE3B75AB55310F52403FE943BA2D1C77C8962DB9E
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E004063D2(CHAR* _a4) {
        				char _t5;
        				char _t7;
        				char* _t15;
        				char* _t16;
        				CHAR* _t17;
        
        				_t17 = _a4;
        				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
        					_t17 =  &(_t17[4]);
        				}
        				if( *_t17 != 0 && E00405AFC(_t17) != 0) {
        					_t17 =  &(_t17[2]);
        				}
        				_t5 =  *_t17;
        				_t15 = _t17;
        				_t16 = _t17;
        				if(_t5 != 0) {
        					do {
        						if(_t5 > 0x1f &&  *((char*)(E00405ABA("*?|<>/\":", _t5))) == 0) {
        							E00405C4B(_t16, _t17, CharNextA(_t17) - _t17);
        							_t16 = CharNextA(_t16);
        						}
        						_t17 = CharNextA(_t17);
        						_t5 =  *_t17;
        					} while (_t5 != 0);
        				}
        				 *_t16 =  *_t16 & 0x00000000;
        				while(1) {
        					_t16 = CharPrevA(_t15, _t16);
        					_t7 =  *_t16;
        					if(_t7 != 0x20 && _t7 != 0x5c) {
        						break;
        					}
        					 *_t16 =  *_t16 & 0x00000000;
        					if(_t15 < _t16) {
        						continue;
        					}
        					break;
        				}
        				return _t7;
        			}








        0x004063d4
        0x004063dc
        0x004063f0
        0x004063f0
        0x004063f6
        0x00406403
        0x00406403
        0x00406404
        0x00406406
        0x0040640a
        0x0040640c
        0x00406415
        0x00406417
        0x00406431
        0x00406439
        0x00406439
        0x0040643e
        0x00406440
        0x00406442
        0x00406446
        0x00406447
        0x0040644a
        0x00406452
        0x00406454
        0x00406458
        0x00000000
        0x00000000
        0x0040645e
        0x00406463
        0x00000000
        0x00000000
        0x00000000
        0x00406463
        0x00406468

        APIs
        • CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\ilnQNBU7NA.exe" ,7519FA90,C:\Users\user\AppData\Local\Temp\,00000000,00403323,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040355A,?,00000007,00000009,0000000B), ref: 0040642A
        • CharNextA.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 00406437
        • CharNextA.USER32(?,"C:\Users\user\Desktop\ilnQNBU7NA.exe" ,7519FA90,C:\Users\user\AppData\Local\Temp\,00000000,00403323,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040355A,?,00000007,00000009,0000000B), ref: 0040643C
        • CharPrevA.USER32(?,?,7519FA90,C:\Users\user\AppData\Local\Temp\,00000000,00403323,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040355A,?,00000007,00000009,0000000B), ref: 0040644C
        Strings
        • *?|<>/":, xrefs: 0040641A
        • C:\Users\user\AppData\Local\Temp\, xrefs: 004063D3
        • "C:\Users\user\Desktop\ilnQNBU7NA.exe" , xrefs: 0040640E
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: Char$Next$Prev
        • String ID: "C:\Users\user\Desktop\ilnQNBU7NA.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
        • API String ID: 589700163-1575197862
        • Opcode ID: 6d9cd5a565d063f7c871d931481108c2ccc59b6be6080685bd61ccbc84ff8956
        • Instruction ID: ed52d7626cbd5fe55056ecced6ac67fd73520a103458dc51ec5e44788bc33e0d
        • Opcode Fuzzy Hash: 6d9cd5a565d063f7c871d931481108c2ccc59b6be6080685bd61ccbc84ff8956
        • Instruction Fuzzy Hash: 6B1104518047A169FB3207380C40B7B7F888B97764F1A447FE8C6722C2C67C5CA796AD
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E004041E2(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
        				struct tagLOGBRUSH _v16;
        				long _t39;
        				long _t41;
        				void* _t44;
        				signed char _t50;
        				long* _t54;
        
        				if(_a4 + 0xfffffecd > 5) {
        					L18:
        					return 0;
        				}
        				_t54 = GetWindowLongA(_a12, 0xffffffeb);
        				if(_t54 == 0 || _t54[2] > 1 || _t54[4] > 2) {
        					goto L18;
        				} else {
        					_t50 = _t54[5];
        					if((_t50 & 0xffffffe0) != 0) {
        						goto L18;
        					}
        					_t39 =  *_t54;
        					if((_t50 & 0x00000002) != 0) {
        						_t39 = GetSysColor(_t39);
        					}
        					if((_t54[5] & 0x00000001) != 0) {
        						SetTextColor(_a8, _t39);
        					}
        					SetBkMode(_a8, _t54[4]);
        					_t41 = _t54[1];
        					_v16.lbColor = _t41;
        					if((_t54[5] & 0x00000008) != 0) {
        						_t41 = GetSysColor(_t41);
        						_v16.lbColor = _t41;
        					}
        					if((_t54[5] & 0x00000004) != 0) {
        						SetBkColor(_a8, _t41);
        					}
        					if((_t54[5] & 0x00000010) != 0) {
        						_v16.lbStyle = _t54[2];
        						_t44 = _t54[3];
        						if(_t44 != 0) {
        							DeleteObject(_t44);
        						}
        						_t54[3] = CreateBrushIndirect( &_v16);
        					}
        					return _t54[3];
        				}
        			}









        0x004041f4
        0x004042aa
        0x00000000
        0x004042aa
        0x00404205
        0x00404209
        0x00000000
        0x00404223
        0x00404223
        0x0040422c
        0x00000000
        0x00000000
        0x0040422e
        0x0040423a
        0x0040423d
        0x0040423d
        0x00404243
        0x00404249
        0x00404249
        0x00404255
        0x0040425b
        0x00404262
        0x00404265
        0x00404268
        0x0040426a
        0x0040426a
        0x00404272
        0x00404278
        0x00404278
        0x00404282
        0x00404287
        0x0040428a
        0x0040428f
        0x00404292
        0x00404292
        0x004042a2
        0x004042a2
        0x00000000
        0x004042a5

        APIs
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
        • String ID:
        • API String ID: 2320649405-0
        • Opcode ID: dc1d3e55db8ec23378b3830e5d111dcc895b5f12cd74b581ce4b7be4d8059b2f
        • Instruction ID: 212a8ad98d70f233ee07b83b669a1ba7ccffb4b50a3226e4c630c70d8ffb5278
        • Opcode Fuzzy Hash: dc1d3e55db8ec23378b3830e5d111dcc895b5f12cd74b581ce4b7be4d8059b2f
        • Instruction Fuzzy Hash: 3B2165716007059BCB309F78DD08B5BBBF4AF85750B04896EFD96A22E0C738E814CB54
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E0040521E(CHAR* _a4, CHAR* _a8) {
        				struct HWND__* _v8;
        				signed int _v12;
        				CHAR* _v32;
        				long _v44;
        				int _v48;
        				void* _v52;
        				void* __ebx;
        				void* __edi;
        				void* __esi;
        				CHAR* _t26;
        				signed int _t27;
        				CHAR* _t28;
        				long _t29;
        				signed int _t39;
        
        				_t26 =  *0x42ec04;
        				_v8 = _t26;
        				if(_t26 != 0) {
        					_t27 =  *0x42f4f4;
        					_v12 = _t27;
        					_t39 = _t27 & 0x00000001;
        					if(_t39 == 0) {
        						E0040618A(0, _t39, 0x42a070, 0x42a070, _a4);
        					}
        					_t26 = lstrlenA(0x42a070);
        					_a4 = _t26;
        					if(_a8 == 0) {
        						L6:
        						if((_v12 & 0x00000004) == 0) {
        							_t26 = SetWindowTextA( *0x42ebe8, 0x42a070);
        						}
        						if((_v12 & 0x00000002) == 0) {
        							_v32 = 0x42a070;
        							_v52 = 1;
        							_t29 = SendMessageA(_v8, 0x1004, 0, 0);
        							_v44 = 0;
        							_v48 = _t29 - _t39;
        							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52);
        							_t26 = SendMessageA(_v8, 0x1013, _v48, 0);
        						}
        						if(_t39 != 0) {
        							_t28 = _a4;
        							 *((char*)(_t28 + 0x42a070)) = 0;
        							return _t28;
        						}
        					} else {
        						_t26 =  &(_a4[lstrlenA(_a8)]);
        						if(_t26 < 0x800) {
        							_t26 = lstrcatA(0x42a070, _a8);
        							goto L6;
        						}
        					}
        				}
        				return _t26;
        			}

















        0x00405224
        0x00405230
        0x00405233
        0x00405239
        0x00405245
        0x00405248
        0x0040524b
        0x00405251
        0x00405251
        0x00405257
        0x0040525f
        0x00405262
        0x0040527f
        0x00405283
        0x0040528c
        0x0040528c
        0x00405296
        0x0040529f
        0x004052ab
        0x004052b2
        0x004052b6
        0x004052b9
        0x004052cc
        0x004052da
        0x004052da
        0x004052de
        0x004052e0
        0x004052e3
        0x00000000
        0x004052e3
        0x00405264
        0x0040526c
        0x00405274
        0x0040527a
        0x00000000
        0x0040527a
        0x00405274
        0x00405262
        0x004052ed

        APIs
        • lstrlenA.KERNEL32(0042A070,00000000,?,7519EA30,?,?,?,?,?,?,?,?,?,00403233,00000000,?), ref: 00405257
        • lstrlenA.KERNEL32(00403233,0042A070,00000000,?,7519EA30,?,?,?,?,?,?,?,?,?,00403233,00000000), ref: 00405267
        • lstrcatA.KERNEL32(0042A070,00403233,00403233,0042A070,00000000,?,7519EA30), ref: 0040527A
        • SetWindowTextA.USER32(0042A070,0042A070), ref: 0040528C
        • SendMessageA.USER32 ref: 004052B2
        • SendMessageA.USER32 ref: 004052CC
        • SendMessageA.USER32 ref: 004052DA
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: MessageSend$lstrlen$TextWindowlstrcat
        • String ID:
        • API String ID: 2531174081-0
        • Opcode ID: d1e8e7ce2c2523d172669f7ce86ee08a3412313cfa29fa6867aa2e5f83f46da0
        • Instruction ID: 52f605d016cfd88bb70700c5a478074e15cc738f975766ab4ed8c3314b346ff2
        • Opcode Fuzzy Hash: d1e8e7ce2c2523d172669f7ce86ee08a3412313cfa29fa6867aa2e5f83f46da0
        • Instruction Fuzzy Hash: C721AC71900518BBDF119FA5DD8599FBFA8EF04354F1480BAF804B6291C7798E50CF98
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E00404ACE(struct HWND__* _a4, intOrPtr _a8) {
        				long _v8;
        				signed char _v12;
        				unsigned int _v16;
        				void* _v20;
        				intOrPtr _v24;
        				long _v56;
        				void* _v60;
        				long _t15;
        				unsigned int _t19;
        				signed int _t25;
        				struct HWND__* _t28;
        
        				_t28 = _a4;
        				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
        				if(_a8 == 0) {
        					L4:
        					_v56 = _t15;
        					_v60 = 4;
        					SendMessageA(_t28, 0x110c, 0,  &_v60);
        					return _v24;
        				}
        				_t19 = GetMessagePos();
        				_v16 = _t19 >> 0x10;
        				_v20 = _t19;
        				ScreenToClient(_t28,  &_v20);
        				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
        				if((_v12 & 0x00000066) != 0) {
        					_t15 = _v8;
        					goto L4;
        				}
        				return _t25 | 0xffffffff;
        			}














        0x00404adc
        0x00404ae9
        0x00404aef
        0x00404b2d
        0x00404b2d
        0x00404b3c
        0x00404b43
        0x00000000
        0x00404b45
        0x00404af1
        0x00404b00
        0x00404b08
        0x00404b0b
        0x00404b1d
        0x00404b23
        0x00404b2a
        0x00000000
        0x00404b2a
        0x00000000

        APIs
        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: Message$Send$ClientScreen
        • String ID: f
        • API String ID: 41195575-1993550816
        • Opcode ID: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
        • Instruction ID: cdc5f22e578355ebae6afd16dcadc4be4e42c2ab1ff41a6041c2d58f87c209b7
        • Opcode Fuzzy Hash: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
        • Instruction Fuzzy Hash: 33014C71900219BADB01DBA4DD85BFEBBBCAF55715F10012ABA40B61D0D6B4A9018BA4
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E00402DBA(struct HWND__* _a4, intOrPtr _a8) {
        				char _v68;
        				int _t11;
        				int _t20;
        
        				if(_a8 == 0x110) {
        					SetTimer(_a4, 1, 0xfa, 0);
        					_a8 = 0x113;
        				}
        				if(_a8 == 0x113) {
        					_t20 =  *0x41d440;
        					_t11 =  *0x42944c;
        					if(_t20 >= _t11) {
        						_t20 = _t11;
        					}
        					wsprintfA( &_v68, "verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
        					SetWindowTextA(_a4,  &_v68);
        					SetDlgItemTextA(_a4, 0x406,  &_v68);
        				}
        				return 0;
        			}






        0x00402dc7
        0x00402dd5
        0x00402ddb
        0x00402ddb
        0x00402de9
        0x00402deb
        0x00402df1
        0x00402df8
        0x00402dfa
        0x00402dfa
        0x00402e10
        0x00402e20
        0x00402e32
        0x00402e32
        0x00402e3a

        APIs
        • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402DD5
        • MulDiv.KERNEL32(?,00000064,?), ref: 00402E00
        • wsprintfA.USER32 ref: 00402E10
        • SetWindowTextA.USER32(?,?), ref: 00402E20
        • SetDlgItemTextA.USER32 ref: 00402E32
        Strings
        • verifying installer: %d%%, xrefs: 00402E0A
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: Text$ItemTimerWindowwsprintf
        • String ID: verifying installer: %d%%
        • API String ID: 1451636040-82062127
        • Opcode ID: 79fc7e6e1ca0acae8e9a75e18e021abc494deab029f93f770ff90eafb88ab8ab
        • Instruction ID: 65898b716c6b5e3943ed5d7f8865a7929710e3ce64d80c757a7a8fa3a9c1cc58
        • Opcode Fuzzy Hash: 79fc7e6e1ca0acae8e9a75e18e021abc494deab029f93f770ff90eafb88ab8ab
        • Instruction Fuzzy Hash: BD01FF70640209FBEF20AF60DE4AEEE3769AB14345F008039FA06A51D0DBB59D55DB59
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E004056E4(CHAR* _a4) {
        				struct _SECURITY_ATTRIBUTES _v16;
        				struct _SECURITY_DESCRIPTOR _v36;
        				long _t23;
        
        				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
        				_v36.Owner = 0x408384;
        				_v36.Group = 0x408384;
        				_v36.Sacl = _v36.Sacl & 0x00000000;
        				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
        				_v16.lpSecurityDescriptor =  &_v36;
        				_v36.Revision = 1;
        				_v36.Control = 4;
        				_v36.Dacl = 0x408374;
        				_v16.nLength = 0xc;
        				if(CreateDirectoryA(_a4,  &_v16) != 0) {
        					L1:
        					return 0;
        				}
        				_t23 = GetLastError();
        				if(_t23 == 0xb7) {
        					if(SetFileSecurityA(_a4, 0x80000007,  &_v36) != 0) {
        						goto L1;
        					}
        					return GetLastError();
        				}
        				return _t23;
        			}






        0x004056ef
        0x004056f3
        0x004056f6
        0x004056fc
        0x00405700
        0x00405704
        0x0040570c
        0x00405713
        0x00405719
        0x00405720
        0x0040572f
        0x00405731
        0x00000000
        0x00405731
        0x0040573b
        0x00405742
        0x00405758
        0x00000000
        0x00000000
        0x00000000
        0x0040575a
        0x0040575e

        APIs
        • CreateDirectoryA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405727
        • GetLastError.KERNEL32 ref: 0040573B
        • SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405750
        • GetLastError.KERNEL32 ref: 0040575A
        Strings
        • C:\Users\user\AppData\Local\Temp\, xrefs: 0040570A
        • C:\Users\user\Desktop, xrefs: 004056E4
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: ErrorLast$CreateDirectoryFileSecurity
        • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop
        • API String ID: 3449924974-1521822154
        • Opcode ID: daf6715ee4a9a889a1accaf74548b3993ec7aecc528708590295bf6406307990
        • Instruction ID: 199f41d5e308de8b96f609cf750b761cce64c3ab1ca85d652f9564a15c89f022
        • Opcode Fuzzy Hash: daf6715ee4a9a889a1accaf74548b3993ec7aecc528708590295bf6406307990
        • Instruction Fuzzy Hash: FF010471C00219EADF019BA0C944BEFBBB8EB04354F00403AD944B6290E7B89A48DBA9
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 37%
        			E004027DF(void* __ebx) {
        				void* _t26;
        				long _t31;
        				void* _t45;
        				void* _t49;
        				void* _t51;
        				void* _t54;
        				void* _t55;
        				void* _t56;
        
        				_t45 = __ebx;
        				 *((intOrPtr*)(_t56 - 0xc)) = 0xfffffd66;
        				_t50 = E00402BCE(0xfffffff0);
        				 *(_t56 - 0x78) = _t23;
        				if(E00405AFC(_t50) == 0) {
        					E00402BCE(0xffffffed);
        				}
        				E00405C6B(_t50);
        				_t26 = E00405C90(_t50, 0x40000000, 2);
        				 *(_t56 + 8) = _t26;
        				if(_t26 != 0xffffffff) {
        					_t31 =  *0x42f438;
        					 *(_t56 - 0x30) = _t31;
        					_t49 = GlobalAlloc(0x40, _t31);
        					if(_t49 != _t45) {
        						E00403300(_t45);
        						E004032EA(_t49,  *(_t56 - 0x30));
        						_t54 = GlobalAlloc(0x40,  *(_t56 - 0x20));
        						 *(_t56 - 0x38) = _t54;
        						if(_t54 != _t45) {
        							_push( *(_t56 - 0x20));
        							_push(_t54);
        							_push(_t45);
        							_push( *((intOrPtr*)(_t56 - 0x24)));
        							E004030D8();
        							while( *_t54 != _t45) {
        								_t47 =  *_t54;
        								_t55 = _t54 + 8;
        								 *(_t56 - 0x8c) =  *_t54;
        								E00405C4B( *((intOrPtr*)(_t54 + 4)) + _t49, _t55, _t47);
        								_t54 = _t55 +  *(_t56 - 0x8c);
        							}
        							GlobalFree( *(_t56 - 0x38));
        						}
        						E00405D37( *(_t56 + 8), _t49,  *(_t56 - 0x30));
        						GlobalFree(_t49);
        						_push(_t45);
        						_push(_t45);
        						_push( *(_t56 + 8));
        						_push(0xffffffff);
        						 *((intOrPtr*)(_t56 - 0xc)) = E004030D8();
        					}
        					CloseHandle( *(_t56 + 8));
        				}
        				_t51 = 0xfffffff3;
        				if( *((intOrPtr*)(_t56 - 0xc)) < _t45) {
        					_t51 = 0xffffffef;
        					DeleteFileA( *(_t56 - 0x78));
        					 *((intOrPtr*)(_t56 - 4)) = 1;
        				}
        				_push(_t51);
        				E00401423();
        				 *0x42f4c8 =  *0x42f4c8 +  *((intOrPtr*)(_t56 - 4));
        				return 0;
        			}











        0x004027df
        0x004027e1
        0x004027ed
        0x004027f0
        0x004027fa
        0x004027fe
        0x004027fe
        0x00402804
        0x00402811
        0x00402819
        0x0040281c
        0x00402822
        0x00402830
        0x00402835
        0x00402839
        0x0040283c
        0x00402845
        0x00402851
        0x00402855
        0x00402858
        0x0040285a
        0x0040285d
        0x0040285e
        0x0040285f
        0x00402862
        0x00402887
        0x00402869
        0x0040286e
        0x00402876
        0x0040287c
        0x00402881
        0x00402881
        0x0040288e
        0x0040288e
        0x0040289b
        0x004028a1
        0x004028a7
        0x004028a8
        0x004028a9
        0x004028ac
        0x004028b3
        0x004028b3
        0x004028b9
        0x004028b9
        0x004028c4
        0x004028c5
        0x004028c9
        0x004028cd
        0x004028d3
        0x004028d3
        0x004028da
        0x004022dd
        0x00402a5d
        0x00402a69

        APIs
        • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402833
        • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 0040284F
        • GlobalFree.KERNEL32 ref: 0040288E
        • GlobalFree.KERNEL32 ref: 004028A1
        • CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 004028B9
        • DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004028CD
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: Global$AllocFree$CloseDeleteFileHandle
        • String ID:
        • API String ID: 2667972263-0
        • Opcode ID: f1d269e6dfcbd70a8fe86ee6d2d0790d6ebe5b5aef851aca50e29501e4bf3e61
        • Instruction ID: 50ad9526884773a844389ca9465edd1da2989015e588fa45899e7f45ead5980e
        • Opcode Fuzzy Hash: f1d269e6dfcbd70a8fe86ee6d2d0790d6ebe5b5aef851aca50e29501e4bf3e61
        • Instruction Fuzzy Hash: 78216D72800128BBDF217FA5CE49D9E7A79EF09364F24423EF550762D1CA794D418FA8
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 95%
        			E004030D8(int _a4, intOrPtr _a8, intOrPtr _a12, int _a16, signed char _a19) {
        				signed int _v8;
        				int _v12;
        				intOrPtr _v16;
        				long _v20;
        				intOrPtr _v24;
        				char _v88;
        				void* _t65;
        				long _t70;
        				intOrPtr _t75;
        				long _t76;
        				int _t88;
        				intOrPtr _t92;
        				intOrPtr _t95;
        				long _t96;
        				signed int _t97;
        				int _t98;
        				int _t99;
        				void* _t101;
        				void* _t102;
        
        				_t97 = _a16;
        				_t92 = _a12;
        				_v12 = _t97;
        				if(_t92 == 0) {
        					_v12 = 0x8000;
        				}
        				_v8 = _v8 & 0x00000000;
        				_v16 = _t92;
        				if(_t92 == 0) {
        					_v16 = 0x421448;
        				}
        				_t62 = _a4;
        				if(_a4 >= 0) {
        					E00403300( *0x42f498 + _t62);
        				}
        				if(E004032EA( &_a16, 4) == 0) {
        					L41:
        					_push(0xfffffffd);
        					goto L42;
        				} else {
        					if((_a19 & 0x00000080) == 0) {
        						if(_t92 != 0) {
        							if(_a16 < _t97) {
        								_t97 = _a16;
        							}
        							if(E004032EA(_t92, _t97) != 0) {
        								_v8 = _t97;
        								L44:
        								return _v8;
        							} else {
        								goto L41;
        							}
        						}
        						if(_a16 <= _t92) {
        							goto L44;
        						}
        						_t88 = _v12;
        						while(1) {
        							_t98 = _a16;
        							if(_a16 >= _t88) {
        								_t98 = _t88;
        							}
        							if(E004032EA(0x41d448, _t98) == 0) {
        								goto L41;
        							}
        							if(E00405D37(_a8, 0x41d448, _t98) == 0) {
        								L28:
        								_push(0xfffffffe);
        								L42:
        								_pop(_t65);
        								return _t65;
        							}
        							_v8 = _v8 + _t98;
        							_a16 = _a16 - _t98;
        							if(_a16 > 0) {
        								continue;
        							}
        							goto L44;
        						}
        						goto L41;
        					}
        					_t70 = GetTickCount();
        					 *0x40bdac =  *0x40bdac & 0x00000000;
        					 *0x40bda8 =  *0x40bda8 & 0x00000000;
        					_t14 =  &_a16;
        					 *_t14 = _a16 & 0x7fffffff;
        					_v20 = _t70;
        					 *0x40b890 = 8;
        					 *0x415438 = 0x40d430;
        					 *0x415434 = 0x40d430;
        					 *0x415430 = 0x415430;
        					_a4 = _a16;
        					if( *_t14 <= 0) {
        						goto L44;
        					} else {
        						goto L9;
        					}
        					while(1) {
        						L9:
        						_t99 = 0x4000;
        						if(_a16 < 0x4000) {
        							_t99 = _a16;
        						}
        						if(E004032EA(0x41d448, _t99) == 0) {
        							goto L41;
        						}
        						_a16 = _a16 - _t99;
        						 *0x40b880 = 0x41d448;
        						 *0x40b884 = _t99;
        						while(1) {
        							_t95 = _v16;
        							 *0x40b888 = _t95;
        							 *0x40b88c = _v12;
        							_t75 = E00406625(0x40b880);
        							_v24 = _t75;
        							if(_t75 < 0) {
        								break;
        							}
        							_t101 =  *0x40b888 - _t95;
        							_t76 = GetTickCount();
        							_t96 = _t76;
        							if(( *0x42f4f4 & 0x00000001) != 0 && (_t76 - _v20 > 0xc8 || _a16 == 0)) {
        								wsprintfA( &_v88, "... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
        								_t102 = _t102 + 0xc;
        								E0040521E(0,  &_v88);
        								_v20 = _t96;
        							}
        							if(_t101 == 0) {
        								if(_a16 > 0) {
        									goto L9;
        								}
        								goto L44;
        							} else {
        								if(_a12 != 0) {
        									_v8 = _v8 + _t101;
        									_v12 = _v12 - _t101;
        									_v16 =  *0x40b888;
        									L23:
        									if(_v24 != 1) {
        										continue;
        									}
        									goto L44;
        								}
        								if(E00405D37(_a8, _v16, _t101) == 0) {
        									goto L28;
        								}
        								_v8 = _v8 + _t101;
        								goto L23;
        							}
        						}
        						_push(0xfffffffc);
        						goto L42;
        					}
        					goto L41;
        				}
        			}






















        0x004030e0
        0x004030e4
        0x004030e7
        0x004030ec
        0x004030ee
        0x004030ee
        0x004030f5
        0x004030f9
        0x004030fe
        0x00403100
        0x00403100
        0x00403107
        0x0040310c
        0x00403117
        0x00403117
        0x00403129
        0x004032d8
        0x004032d8
        0x00000000
        0x0040312f
        0x00403133
        0x00403285
        0x004032c8
        0x004032ca
        0x004032ca
        0x004032d6
        0x004032dd
        0x004032e0
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x004032d6
        0x0040328a
        0x00000000
        0x00000000
        0x0040328c
        0x0040328f
        0x00403292
        0x00403295
        0x00403297
        0x00403297
        0x004032a7
        0x00000000
        0x00000000
        0x004032b5
        0x0040327f
        0x0040327f
        0x004032da
        0x004032da
        0x00000000
        0x004032da
        0x004032b7
        0x004032ba
        0x004032c1
        0x00000000
        0x00000000
        0x00000000
        0x004032c3
        0x00000000
        0x0040328f
        0x0040313f
        0x00403141
        0x00403148
        0x0040314f
        0x0040314f
        0x00403156
        0x0040315e
        0x00403168
        0x0040316d
        0x00403175
        0x0040317f
        0x00403182
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x00403188
        0x00403188
        0x00403188
        0x00403190
        0x00403192
        0x00403192
        0x004031a3
        0x00000000
        0x00000000
        0x004031a9
        0x004031ac
        0x004031b2
        0x004031b8
        0x004031b8
        0x004031c3
        0x004031c9
        0x004031ce
        0x004031d5
        0x004031d8
        0x00000000
        0x00000000
        0x004031e4
        0x004031e6
        0x004031ef
        0x004031f1
        0x0040321f
        0x00403225
        0x0040322e
        0x00403233
        0x00403233
        0x00403238
        0x00403273
        0x00000000
        0x00000000
        0x00000000
        0x0040323a
        0x0040323e
        0x0040325a
        0x0040325d
        0x00403260
        0x00403263
        0x00403267
        0x00000000
        0x00000000
        0x00000000
        0x0040326d
        0x0040324e
        0x00000000
        0x00000000
        0x00403250
        0x00000000
        0x00403250
        0x00403238
        0x0040327b
        0x00000000
        0x0040327b
        0x00000000
        0x00403188

        APIs
        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: CountTick$wsprintf
        • String ID: ... %d%%
        • API String ID: 551687249-2449383134
        • Opcode ID: 6905a7c690b2545ed3291ebbf2f163b7175bb9418d6f22e9ad7a2b62f8869abc
        • Instruction ID: fb515496a62f3aa3a261881475cff076317c99cf113f2c02ef85df511ffa7adb
        • Opcode Fuzzy Hash: 6905a7c690b2545ed3291ebbf2f163b7175bb9418d6f22e9ad7a2b62f8869abc
        • Instruction Fuzzy Hash: 68515C71900219ABCB10DF95DA44A9E7BA8EF54356F1481BFE800B72D0C7789A41CBAD
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 73%
        			E00401759(FILETIME* __ebx, void* __eflags) {
        				void* _t33;
        				void* _t41;
        				void* _t43;
        				FILETIME* _t49;
        				FILETIME* _t62;
        				void* _t64;
        				signed int _t70;
        				FILETIME* _t71;
        				FILETIME* _t75;
        				signed int _t77;
        				void* _t80;
        				CHAR* _t82;
        				void* _t85;
        
        				_t75 = __ebx;
        				_t82 = E00402BCE(0x31);
        				 *(_t85 - 8) = _t82;
        				 *(_t85 + 8) =  *(_t85 - 0x28) & 0x00000007;
        				_t33 = E00405AFC(_t82);
        				_push(_t82);
        				if(_t33 == 0) {
        					lstrcatA(E00405A8F(E004060F7(0x40a438, 0x435800)), ??);
        				} else {
        					_push(0x40a438);
        					E004060F7();
        				}
        				E004063D2(0x40a438);
        				while(1) {
        					__eflags =  *(_t85 + 8) - 3;
        					if( *(_t85 + 8) >= 3) {
        						_t64 = E0040646B(0x40a438);
        						_t77 = 0;
        						__eflags = _t64 - _t75;
        						if(_t64 != _t75) {
        							_t71 = _t64 + 0x14;
        							__eflags = _t71;
        							_t77 = CompareFileTime(_t71, _t85 - 0x1c);
        						}
        						asm("sbb eax, eax");
        						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
        						__eflags = _t70;
        						 *(_t85 + 8) = _t70;
        					}
        					__eflags =  *(_t85 + 8) - _t75;
        					if( *(_t85 + 8) == _t75) {
        						E00405C6B(0x40a438);
        					}
        					__eflags =  *(_t85 + 8) - 1;
        					_t41 = E00405C90(0x40a438, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
        					__eflags = _t41 - 0xffffffff;
        					 *(_t85 - 0xc) = _t41;
        					if(_t41 != 0xffffffff) {
        						break;
        					}
        					__eflags =  *(_t85 + 8) - _t75;
        					if( *(_t85 + 8) != _t75) {
        						E0040521E(0xffffffe2,  *(_t85 - 8));
        						__eflags =  *(_t85 + 8) - 2;
        						if(__eflags == 0) {
        							 *((intOrPtr*)(_t85 - 4)) = 1;
        						}
        						L31:
        						 *0x42f4c8 =  *0x42f4c8 +  *((intOrPtr*)(_t85 - 4));
        						__eflags =  *0x42f4c8;
        						goto L32;
        					} else {
        						E004060F7(0x40ac38, 0x430000);
        						E004060F7(0x430000, 0x40a438);
        						E0040618A(_t75, 0x40ac38, 0x40a438, 0x40a838,  *((intOrPtr*)(_t85 - 0x14)));
        						E004060F7(0x430000, 0x40ac38);
        						_t62 = E00405813(0x40a838,  *(_t85 - 0x28) >> 3) - 4;
        						__eflags = _t62;
        						if(_t62 == 0) {
        							continue;
        						} else {
        							__eflags = _t62 == 1;
        							if(_t62 == 1) {
        								 *0x42f4c8 =  &( *0x42f4c8->dwLowDateTime);
        								L32:
        								_t49 = 0;
        								__eflags = 0;
        							} else {
        								_push(0x40a438);
        								_push(0xfffffffa);
        								E0040521E();
        								L29:
        								_t49 = 0x7fffffff;
        							}
        						}
        					}
        					L33:
        					return _t49;
        				}
        				E0040521E(0xffffffea,  *(_t85 - 8));
        				 *0x42f4f4 =  *0x42f4f4 + 1;
        				_t43 = E004030D8( *((intOrPtr*)(_t85 - 0x20)),  *(_t85 - 0xc), _t75, _t75);
        				 *0x42f4f4 =  *0x42f4f4 - 1;
        				__eflags =  *(_t85 - 0x1c) - 0xffffffff;
        				_t80 = _t43;
        				if( *(_t85 - 0x1c) != 0xffffffff) {
        					L22:
        					SetFileTime( *(_t85 - 0xc), _t85 - 0x1c, _t75, _t85 - 0x1c);
        				} else {
        					__eflags =  *((intOrPtr*)(_t85 - 0x18)) - 0xffffffff;
        					if( *((intOrPtr*)(_t85 - 0x18)) != 0xffffffff) {
        						goto L22;
        					}
        				}
        				CloseHandle( *(_t85 - 0xc));
        				__eflags = _t80 - _t75;
        				if(_t80 >= _t75) {
        					goto L31;
        				} else {
        					__eflags = _t80 - 0xfffffffe;
        					if(_t80 != 0xfffffffe) {
        						E0040618A(_t75, _t80, 0x40a438, 0x40a438, 0xffffffee);
        					} else {
        						E0040618A(_t75, _t80, 0x40a438, 0x40a438, 0xffffffe9);
        						lstrcatA(0x40a438,  *(_t85 - 8));
        					}
        					_push(0x200010);
        					_push(0x40a438);
        					E00405813();
        					goto L29;
        				}
        				goto L33;
        			}
















        0x00401759
        0x00401760
        0x00401769
        0x0040176c
        0x0040176f
        0x00401774
        0x0040177c
        0x00401798
        0x0040177e
        0x0040177e
        0x0040177f
        0x0040177f
        0x0040179e
        0x004017a8
        0x004017a8
        0x004017ac
        0x004017af
        0x004017b4
        0x004017b6
        0x004017b8
        0x004017bd
        0x004017bd
        0x004017c8
        0x004017c8
        0x004017d9
        0x004017db
        0x004017db
        0x004017dc
        0x004017dc
        0x004017df
        0x004017e2
        0x004017e5
        0x004017e5
        0x004017ec
        0x004017fb
        0x00401800
        0x00401803
        0x00401806
        0x00000000
        0x00000000
        0x00401808
        0x0040180b
        0x00401865
        0x0040186a
        0x004015b0
        0x004027bf
        0x004027bf
        0x00402a5a
        0x00402a5d
        0x00402a5d
        0x00000000
        0x0040180d
        0x00401813
        0x0040181e
        0x0040182b
        0x00401836
        0x0040184c
        0x0040184c
        0x0040184f
        0x00000000
        0x00401855
        0x00401855
        0x00401856
        0x00401873
        0x00402a63
        0x00402a63
        0x00402a63
        0x00401858
        0x00401858
        0x00401859
        0x00401492
        0x00402387
        0x00402387
        0x00402387
        0x00401856
        0x0040184f
        0x00402a65
        0x00402a69
        0x00402a69
        0x00401883
        0x00401888
        0x00401896
        0x0040189b
        0x004018a1
        0x004018a5
        0x004018a7
        0x004018af
        0x004018bb
        0x004018a9
        0x004018a9
        0x004018ad
        0x00000000
        0x00000000
        0x004018ad
        0x004018c4
        0x004018ca
        0x004018cc
        0x00000000
        0x004018d2
        0x004018d2
        0x004018d5
        0x004018ed
        0x004018d7
        0x004018da
        0x004018e3
        0x004018e3
        0x004018f2
        0x004018f7
        0x00402382
        0x00000000
        0x00402382
        0x00000000

        APIs
        • lstrcatA.KERNEL32(00000000,00000000,0040A438,00435800,00000000,00000000,00000031), ref: 00401798
        • CompareFileTime.KERNEL32(-00000014,?,0040A438,0040A438,00000000,00000000,0040A438,00435800,00000000,00000000,00000031), ref: 004017C2
          • Part of subcall function 004060F7: lstrcpynA.KERNEL32(?,?,00000400,0040341A,0042EC20,NSIS Error,?,00000007,00000009,0000000B), ref: 00406104
          • Part of subcall function 0040521E: lstrlenA.KERNEL32(0042A070,00000000,?,7519EA30,?,?,?,?,?,?,?,?,?,00403233,00000000,?), ref: 00405257
          • Part of subcall function 0040521E: lstrlenA.KERNEL32(00403233,0042A070,00000000,?,7519EA30,?,?,?,?,?,?,?,?,?,00403233,00000000), ref: 00405267
          • Part of subcall function 0040521E: lstrcatA.KERNEL32(0042A070,00403233,00403233,0042A070,00000000,?,7519EA30), ref: 0040527A
          • Part of subcall function 0040521E: SetWindowTextA.USER32(0042A070,0042A070), ref: 0040528C
          • Part of subcall function 0040521E: SendMessageA.USER32 ref: 004052B2
          • Part of subcall function 0040521E: SendMessageA.USER32 ref: 004052CC
          • Part of subcall function 0040521E: SendMessageA.USER32 ref: 004052DA
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
        • String ID:
        • API String ID: 1941528284-0
        • Opcode ID: f339b6a59adf296648f3f8b3866004a1f68460c5fd538596058490c9e85b0c89
        • Instruction ID: bb6028c3778eb4cec0c6c1d7eb8bf073a5325157b60575559d09146ef789c5eb
        • Opcode Fuzzy Hash: f339b6a59adf296648f3f8b3866004a1f68460c5fd538596058490c9e85b0c89
        • Instruction Fuzzy Hash: D4419A32900515BACB107BB5CC45DAF3678EF05329F20833FF426B51E1DA7C8A529A6D
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 48%
        			E00402CD0(void* __eflags, void* _a4, char* _a8, signed int _a12) {
        				void* _v8;
        				int _v12;
        				char _v276;
        				void* _t27;
        				signed int _t33;
        				intOrPtr* _t35;
        				signed int _t45;
        				signed int _t46;
        				signed int _t47;
        
        				_t46 = _a12;
        				_t47 = _t46 & 0x00000300;
        				_t45 = _t46 & 0x00000001;
        				_t27 = E00405F7D(__eflags, _a4, _a8, _t47 | 0x00000009,  &_v8);
        				if(_t27 == 0) {
        					if((_a12 & 0x00000002) == 0) {
        						L3:
        						_push(0x105);
        						_push( &_v276);
        						_push(0);
        						while(RegEnumKeyA(_v8, ??, ??, ??) == 0) {
        							__eflags = _t45;
        							if(__eflags != 0) {
        								L10:
        								RegCloseKey(_v8);
        								return 0x3eb;
        							}
        							_t33 = E00402CD0(__eflags, _v8,  &_v276, _a12);
        							__eflags = _t33;
        							if(_t33 != 0) {
        								break;
        							}
        							_push(0x105);
        							_push( &_v276);
        							_push(_t45);
        						}
        						RegCloseKey(_v8);
        						_t35 = E00406500(3);
        						if(_t35 != 0) {
        							return  *_t35(_a4, _a8, _t47, 0);
        						}
        						return RegDeleteKeyA(_a4, _a8);
        					}
        					_v12 = 0;
        					if(RegEnumValueA(_v8, 0,  &_v276,  &_v12, 0, 0, 0, 0) != 0x103) {
        						goto L10;
        					}
        					goto L3;
        				}
        				return _t27;
        			}












        0x00402cdb
        0x00402ce4
        0x00402ced
        0x00402cf9
        0x00402d02
        0x00402d0c
        0x00402d31
        0x00402d37
        0x00402d3c
        0x00402d3d
        0x00402d6d
        0x00402d46
        0x00402d48
        0x00402d98
        0x00402d9b
        0x00000000
        0x00402da1
        0x00402d57
        0x00402d5c
        0x00402d5e
        0x00000000
        0x00000000
        0x00402d66
        0x00402d6b
        0x00402d6c
        0x00402d6c
        0x00402d79
        0x00402d81
        0x00402d88
        0x00000000
        0x00402db1
        0x00000000
        0x00402d90
        0x00402d1c
        0x00402d2f
        0x00000000
        0x00000000
        0x00000000
        0x00402d2f
        0x00402db7

        APIs
        • RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402D24
        • RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402D70
        • RegCloseKey.ADVAPI32(?,?,?), ref: 00402D79
        • RegDeleteKeyA.ADVAPI32(?,?), ref: 00402D90
        • RegCloseKey.ADVAPI32(?,?,?), ref: 00402D9B
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: CloseEnum$DeleteValue
        • String ID:
        • API String ID: 1354259210-0
        • Opcode ID: c08e85f7896b9a4561d683b23b3b2dae21a167d845191f4bc040fadce0444681
        • Instruction ID: 1e980c0bf3dfe1ee8e8c0bbb525d6a304c4f3a3ada6f962fb42c7dde8bd75a6e
        • Opcode Fuzzy Hash: c08e85f7896b9a4561d683b23b3b2dae21a167d845191f4bc040fadce0444681
        • Instruction Fuzzy Hash: C6215771900108BBEF129F90CE89EEE7A7DEF44344F100076FA55B11E0E7B48E54AA68
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 77%
        			E00401D65(void* __ebx, void* __edx) {
        				struct HWND__* _t30;
        				CHAR* _t38;
        				void* _t48;
        				void* _t53;
        				signed int _t55;
        				signed int _t58;
        				long _t61;
        				void* _t65;
        
        				_t53 = __ebx;
        				if(( *(_t65 - 0x1b) & 0x00000001) == 0) {
        					_t30 = GetDlgItem( *(_t65 - 8),  *(_t65 - 0x20));
        				} else {
        					E00402BAC(2);
        					 *((intOrPtr*)(__ebp - 0x38)) = __edx;
        				}
        				_t55 =  *(_t65 - 0x1c);
        				 *(_t65 + 8) = _t30;
        				_t58 = _t55 & 0x00000004;
        				 *(_t65 - 0xc) = _t55 & 0x00000003;
        				 *(_t65 - 0x34) = _t55 >> 0x1f;
        				 *(_t65 - 0x30) = _t55 >> 0x0000001e & 0x00000001;
        				if((_t55 & 0x00010000) == 0) {
        					_t38 =  *(_t65 - 0x24) & 0x0000ffff;
        				} else {
        					_t38 = E00402BCE(0x11);
        				}
        				 *(_t65 - 8) = _t38;
        				GetClientRect( *(_t65 + 8), _t65 - 0x84);
        				asm("sbb edi, edi");
        				_t61 = LoadImageA( ~_t58 &  *0x42f420,  *(_t65 - 8),  *(_t65 - 0xc),  *(_t65 - 0x7c) *  *(_t65 - 0x34),  *(_t65 - 0x78) *  *(_t65 - 0x30),  *(_t65 - 0x1c) & 0x0000fef0);
        				_t48 = SendMessageA( *(_t65 + 8), 0x172,  *(_t65 - 0xc), _t61);
        				if(_t48 != _t53 &&  *(_t65 - 0xc) == _t53) {
        					DeleteObject(_t48);
        				}
        				if( *((intOrPtr*)(_t65 - 0x28)) >= _t53) {
        					_push(_t61);
        					E00406055();
        				}
        				 *0x42f4c8 =  *0x42f4c8 +  *((intOrPtr*)(_t65 - 4));
        				return 0;
        			}











        0x00401d65
        0x00401d69
        0x00401d7e
        0x00401d6b
        0x00401d6d
        0x00401d73
        0x00401d73
        0x00401d84
        0x00401d87
        0x00401d91
        0x00401d94
        0x00401d9c
        0x00401dad
        0x00401db0
        0x00401dbb
        0x00401db2
        0x00401db4
        0x00401db4
        0x00401dbf
        0x00401dcc
        0x00401df3
        0x00401e02
        0x00401e10
        0x00401e18
        0x00401e20
        0x00401e20
        0x00401e29
        0x00401e2f
        0x004029a5
        0x004029a5
        0x00402a5d
        0x00402a69

        APIs
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
        • String ID:
        • API String ID: 1849352358-0
        • Opcode ID: 64047181dbb11954f6248d6d4ebce6329301936260590e1bb013e11241bca830
        • Instruction ID: ea2313c62ec258575502bac7b5a91221d1b2f7c42d1e166e88532b570a834240
        • Opcode Fuzzy Hash: 64047181dbb11954f6248d6d4ebce6329301936260590e1bb013e11241bca830
        • Instruction Fuzzy Hash: 02212872A00109AFCB15DFA4DD85AAEBBB5EB48300F24417EF905F62A1DB389941DB54
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 73%
        			E00401E35(intOrPtr __edx) {
        				void* __esi;
        				int _t9;
        				signed char _t15;
        				struct HFONT__* _t18;
        				intOrPtr _t30;
        				struct HDC__* _t31;
        				void* _t33;
        				void* _t35;
        
        				_t30 = __edx;
        				_t31 = GetDC( *(_t35 - 8));
        				_t9 = E00402BAC(2);
        				 *((intOrPtr*)(_t35 - 0x38)) = _t30;
        				0x40b838->lfHeight =  ~(MulDiv(_t9, GetDeviceCaps(_t31, 0x5a), 0x48));
        				ReleaseDC( *(_t35 - 8), _t31);
        				 *0x40b848 = E00402BAC(3);
        				_t15 =  *((intOrPtr*)(_t35 - 0x18));
        				 *((intOrPtr*)(_t35 - 0x38)) = _t30;
        				 *0x40b84f = 1;
        				 *0x40b84c = _t15 & 0x00000001;
        				 *0x40b84d = _t15 & 0x00000002;
        				 *0x40b84e = _t15 & 0x00000004;
        				E0040618A(_t9, _t31, _t33, 0x40b854,  *((intOrPtr*)(_t35 - 0x24)));
        				_t18 = CreateFontIndirectA(0x40b838);
        				_push(_t18);
        				_push(_t33);
        				E00406055();
        				 *0x42f4c8 =  *0x42f4c8 +  *((intOrPtr*)(_t35 - 4));
        				return 0;
        			}











        0x00401e35
        0x00401e40
        0x00401e42
        0x00401e4f
        0x00401e66
        0x00401e6b
        0x00401e78
        0x00401e7d
        0x00401e81
        0x00401e8c
        0x00401e93
        0x00401ea5
        0x00401eab
        0x00401eb0
        0x00401eba
        0x00402620
        0x00401569
        0x004029a5
        0x00402a5d
        0x00402a69

        APIs
        • GetDC.USER32(?), ref: 00401E38
        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E52
        • MulDiv.KERNEL32(00000000,00000000), ref: 00401E5A
        • ReleaseDC.USER32 ref: 00401E6B
        • CreateFontIndirectA.GDI32(0040B838), ref: 00401EBA
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: CapsCreateDeviceFontIndirectRelease
        • String ID:
        • API String ID: 3808545654-0
        • Opcode ID: 2261fe2310d7c5dbb8815f3a1baa88f38d243da1520e0ea6a1dc02d5ce67a812
        • Instruction ID: 5cb61850c30ba341adb392aac0b64178207aa51c0a8ebf491f77c064e1fc76ea
        • Opcode Fuzzy Hash: 2261fe2310d7c5dbb8815f3a1baa88f38d243da1520e0ea6a1dc02d5ce67a812
        • Instruction Fuzzy Hash: A9019E72500240AFE7007BB0AE4AB9A3FF8EB55311F10843EF281B61F2CB7904458B6C
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 59%
        			E00401C2E(intOrPtr __edx) {
        				int _t29;
        				long _t30;
        				signed int _t32;
        				CHAR* _t35;
        				long _t36;
        				int _t41;
        				signed int _t42;
        				int _t46;
        				int _t56;
        				intOrPtr _t57;
        				struct HWND__* _t61;
        				void* _t64;
        
        				_t57 = __edx;
        				_t29 = E00402BAC(3);
        				 *((intOrPtr*)(_t64 - 0x38)) = _t57;
        				 *(_t64 - 8) = _t29;
        				_t30 = E00402BAC(4);
        				 *((intOrPtr*)(_t64 - 0x38)) = _t57;
        				 *(_t64 + 8) = _t30;
        				if(( *(_t64 - 0x14) & 0x00000001) != 0) {
        					 *((intOrPtr*)(__ebp - 8)) = E00402BCE(0x33);
        				}
        				__eflags =  *(_t64 - 0x14) & 0x00000002;
        				if(( *(_t64 - 0x14) & 0x00000002) != 0) {
        					 *(_t64 + 8) = E00402BCE(0x44);
        				}
        				__eflags =  *((intOrPtr*)(_t64 - 0x2c)) - 0x21;
        				_push(1);
        				if(__eflags != 0) {
        					_t59 = E00402BCE();
        					_t32 = E00402BCE();
        					asm("sbb ecx, ecx");
        					asm("sbb eax, eax");
        					_t35 =  ~( *_t31) & _t59;
        					__eflags = _t35;
        					_t36 = FindWindowExA( *(_t64 - 8),  *(_t64 + 8), _t35,  ~( *_t32) & _t32);
        					goto L10;
        				} else {
        					_t61 = E00402BAC();
        					 *((intOrPtr*)(_t64 - 0x38)) = _t57;
        					_t41 = E00402BAC(2);
        					 *((intOrPtr*)(_t64 - 0x38)) = _t57;
        					_t56 =  *(_t64 - 0x14) >> 2;
        					if(__eflags == 0) {
        						_t36 = SendMessageA(_t61, _t41,  *(_t64 - 8),  *(_t64 + 8));
        						L10:
        						 *(_t64 - 0xc) = _t36;
        					} else {
        						_t42 = SendMessageTimeoutA(_t61, _t41,  *(_t64 - 8),  *(_t64 + 8), _t46, _t56, _t64 - 0xc);
        						asm("sbb eax, eax");
        						 *((intOrPtr*)(_t64 - 4)) =  ~_t42 + 1;
        					}
        				}
        				__eflags =  *((intOrPtr*)(_t64 - 0x28)) - _t46;
        				if( *((intOrPtr*)(_t64 - 0x28)) >= _t46) {
        					_push( *(_t64 - 0xc));
        					E00406055();
        				}
        				 *0x42f4c8 =  *0x42f4c8 +  *((intOrPtr*)(_t64 - 4));
        				return 0;
        			}















        0x00401c2e
        0x00401c30
        0x00401c37
        0x00401c3a
        0x00401c3d
        0x00401c47
        0x00401c4b
        0x00401c4e
        0x00401c57
        0x00401c57
        0x00401c5a
        0x00401c5e
        0x00401c67
        0x00401c67
        0x00401c6a
        0x00401c6e
        0x00401c70
        0x00401cc5
        0x00401cc7
        0x00401cd0
        0x00401cd8
        0x00401cdb
        0x00401cdb
        0x00401ce4
        0x00000000
        0x00401c72
        0x00401c79
        0x00401c7b
        0x00401c7e
        0x00401c84
        0x00401c8b
        0x00401c8e
        0x00401cb6
        0x00401cea
        0x00401cea
        0x00401c90
        0x00401c9e
        0x00401ca6
        0x00401ca9
        0x00401ca9
        0x00401c8e
        0x00401ced
        0x00401cf0
        0x00401cf6
        0x004029a5
        0x004029a5
        0x00402a5d
        0x00402a69

        APIs
        • SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C9E
        • SendMessageA.USER32 ref: 00401CB6
        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: MessageSend$Timeout
        • String ID: !
        • API String ID: 1777923405-2657877971
        • Opcode ID: b3808b2228016cded034fddbbda71ccd0a5c26c3e8a9a8fe6146862fd49d124c
        • Instruction ID: ba3ca6c87ae36af76b9178a01453159e8aa8f3f4b54328e0dc7fa76aa85262fd
        • Opcode Fuzzy Hash: b3808b2228016cded034fddbbda71ccd0a5c26c3e8a9a8fe6146862fd49d124c
        • Instruction Fuzzy Hash: 10216071A44208BEEB05AFB5D98AAAD7FB4EF44304F20447FF502B61D1D6B88541DB28
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 77%
        			E004049C4(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
        				char _v36;
        				char _v68;
        				void* __ebx;
        				void* __edi;
        				void* __esi;
        				signed int _t21;
        				signed int _t22;
        				void* _t29;
        				void* _t31;
        				void* _t32;
        				void* _t41;
        				signed int _t43;
        				signed int _t47;
        				signed int _t50;
        				signed int _t51;
        				signed int _t53;
        
        				_t21 = _a16;
        				_t51 = _a12;
        				_t41 = 0xffffffdc;
        				if(_t21 == 0) {
        					_push(0x14);
        					_pop(0);
        					_t22 = _t51;
        					if(_t51 < 0x100000) {
        						_push(0xa);
        						_pop(0);
        						_t41 = 0xffffffdd;
        					}
        					if(_t51 < 0x400) {
        						_t41 = 0xffffffde;
        					}
        					if(_t51 < 0xffff3333) {
        						_t50 = 0x14;
        						asm("cdq");
        						_t22 = 1 / _t50 + _t51;
        					}
        					_t23 = _t22 & 0x00ffffff;
        					_t53 = _t22 >> 0;
        					_t43 = 0xa;
        					_t47 = ((_t22 & 0x00ffffff) + _t23 * 4 + (_t22 & 0x00ffffff) + _t23 * 4 >> 0) % _t43;
        				} else {
        					_t53 = (_t21 << 0x00000020 | _t51) >> 0x14;
        					_t47 = 0;
        				}
        				_t29 = E0040618A(_t41, _t47, _t53,  &_v36, 0xffffffdf);
        				_t31 = E0040618A(_t41, _t47, _t53,  &_v68, _t41);
        				_t32 = E0040618A(_t41, _t47, 0x42a890, 0x42a890, _a8);
        				wsprintfA(_t32 + lstrlenA(0x42a890), "%u.%u%s%s", _t53, _t47, _t31, _t29);
        				return SetDlgItemTextA( *0x42ebf8, _a4, 0x42a890);
        			}



















        0x004049ca
        0x004049cf
        0x004049d7
        0x004049d8
        0x004049e5
        0x004049ed
        0x004049ee
        0x004049f0
        0x004049f2
        0x004049f4
        0x004049f7
        0x004049f7
        0x004049fe
        0x00404a04
        0x00404a04
        0x00404a0b
        0x00404a12
        0x00404a15
        0x00404a18
        0x00404a18
        0x00404a1c
        0x00404a2c
        0x00404a2e
        0x00404a31
        0x004049da
        0x004049da
        0x004049e1
        0x004049e1
        0x00404a39
        0x00404a44
        0x00404a5a
        0x00404a6a
        0x00404a86

        APIs
        • lstrlenA.KERNEL32(0042A890,0042A890,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004048DF,000000DF,00000000,00000400,?), ref: 00404A62
        • wsprintfA.USER32 ref: 00404A6A
        • SetDlgItemTextA.USER32 ref: 00404A7D
        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: ItemTextlstrlenwsprintf
        • String ID: %u.%u%s%s
        • API String ID: 3540041739-3551169577
        • Opcode ID: 8021314119f48bb44e81eea40f1a1f72c99eaec4c6fda177ab528d3e3229a9e8
        • Instruction ID: 22449cd78037b5055574fdfa12b268b27ceb02c465c900d7a820e94443fbddbc
        • Opcode Fuzzy Hash: 8021314119f48bb44e81eea40f1a1f72c99eaec4c6fda177ab528d3e3229a9e8
        • Instruction Fuzzy Hash: 1911E773A041243BDB00A56D9C41EAF3298DF81374F260237FA26F71D1E979CC1246A9
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E00405A8F(CHAR* _a4) {
        				CHAR* _t7;
        
        				_t7 = _a4;
        				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
        					lstrcatA(_t7, 0x40a014);
        				}
        				return _t7;
        			}




        0x00405a90
        0x00405aa7
        0x00405aaf
        0x00405aaf
        0x00405ab7

        APIs
        • lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403335,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040355A,?,00000007,00000009,0000000B), ref: 00405A95
        • CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403335,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040355A,?,00000007,00000009,0000000B), ref: 00405A9E
        • lstrcatA.KERNEL32(?,0040A014,?,00000007,00000009,0000000B), ref: 00405AAF
        Strings
        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405A8F
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: CharPrevlstrcatlstrlen
        • String ID: C:\Users\user\AppData\Local\Temp\
        • API String ID: 2659869361-823278215
        • Opcode ID: 7e3bd0a74015a4b4c7bd8f32b9337ec82444728bd267b6e5413a6877d2367a50
        • Instruction ID: 6078a555604e81c1816c45b3e60b5c3e7c31ed84b02af53c952a19e53ba35867
        • Opcode Fuzzy Hash: 7e3bd0a74015a4b4c7bd8f32b9337ec82444728bd267b6e5413a6877d2367a50
        • Instruction Fuzzy Hash: 68D0A7B26055307AE21126155C06ECB19488F463447060066F500BB193C77C4C114BFD
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 59%
        			E0040209D(void* __ebx, void* __eflags) {
        				void* _t27;
        				struct HINSTANCE__* _t30;
        				CHAR* _t32;
        				intOrPtr* _t33;
        				void* _t34;
        
        				_t27 = __ebx;
        				asm("sbb eax, 0x42f4f8");
        				 *(_t34 - 4) = 1;
        				if(__eflags < 0) {
        					_push(0xffffffe7);
        					L15:
        					E00401423();
        					L16:
        					 *0x42f4c8 =  *0x42f4c8 +  *(_t34 - 4);
        					return 0;
        				}
        				_t32 = E00402BCE(0xfffffff0);
        				 *(_t34 + 8) = E00402BCE(1);
        				if( *((intOrPtr*)(_t34 - 0x18)) == __ebx) {
        					L3:
        					_t30 = LoadLibraryExA(_t32, _t27, 8);
        					if(_t30 == _t27) {
        						_push(0xfffffff6);
        						goto L15;
        					}
        					L4:
        					_t33 = GetProcAddress(_t30,  *(_t34 + 8));
        					if(_t33 == _t27) {
        						E0040521E(0xfffffff7,  *(_t34 + 8));
        					} else {
        						 *(_t34 - 4) = _t27;
        						if( *((intOrPtr*)(_t34 - 0x20)) == _t27) {
        							 *_t33( *((intOrPtr*)(_t34 - 8)), 0x400, 0x430000, 0x40b878, 0x40a000);
        						} else {
        							E00401423( *((intOrPtr*)(_t34 - 0x20)));
        							if( *_t33() != 0) {
        								 *(_t34 - 4) = 1;
        							}
        						}
        					}
        					if( *((intOrPtr*)(_t34 - 0x1c)) == _t27 && E004038AA(_t30) != 0) {
        						FreeLibrary(_t30);
        					}
        					goto L16;
        				}
        				_t30 = GetModuleHandleA(_t32);
        				if(_t30 != __ebx) {
        					goto L4;
        				}
        				goto L3;
        			}








        0x0040209d
        0x0040209d
        0x004020a2
        0x004020a9
        0x00402164
        0x004022dd
        0x004022dd
        0x00402a5a
        0x00402a5d
        0x00402a69
        0x00402a69
        0x004020b8
        0x004020c2
        0x004020c5
        0x004020d4
        0x004020de
        0x004020e2
        0x0040215d
        0x00000000
        0x0040215d
        0x004020e4
        0x004020ed
        0x004020f1
        0x00402135
        0x004020f3
        0x004020f6
        0x004020f9
        0x00402129
        0x004020fb
        0x004020fe
        0x00402107
        0x00402109
        0x00402109
        0x00402107
        0x004020f9
        0x0040213d
        0x00402152
        0x00402152
        0x00000000
        0x0040213d
        0x004020ce
        0x004020d2
        0x00000000
        0x00000000
        0x00000000

        APIs
        • GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 004020C8
          • Part of subcall function 0040521E: lstrlenA.KERNEL32(0042A070,00000000,?,7519EA30,?,?,?,?,?,?,?,?,?,00403233,00000000,?), ref: 00405257
          • Part of subcall function 0040521E: lstrlenA.KERNEL32(00403233,0042A070,00000000,?,7519EA30,?,?,?,?,?,?,?,?,?,00403233,00000000), ref: 00405267
          • Part of subcall function 0040521E: lstrcatA.KERNEL32(0042A070,00403233,00403233,0042A070,00000000,?,7519EA30), ref: 0040527A
          • Part of subcall function 0040521E: SetWindowTextA.USER32(0042A070,0042A070), ref: 0040528C
          • Part of subcall function 0040521E: SendMessageA.USER32 ref: 004052B2
          • Part of subcall function 0040521E: SendMessageA.USER32 ref: 004052CC
          • Part of subcall function 0040521E: SendMessageA.USER32 ref: 004052DA
        • LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 004020D8
        • GetProcAddress.KERNEL32(00000000,?), ref: 004020E8
        • FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402152
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
        • String ID:
        • API String ID: 2987980305-0
        • Opcode ID: cbbca793592133c54db2e53d3555cb6bc9ab1f80129fbdab1f6ba1bcbb37dc43
        • Instruction ID: f7200b9d034bcb950a45a2beb12b39e5fe5f048be62c56950c98b25cd9e943c1
        • Opcode Fuzzy Hash: cbbca793592133c54db2e53d3555cb6bc9ab1f80129fbdab1f6ba1bcbb37dc43
        • Instruction Fuzzy Hash: 7A21C932600115EBCF207FA58F49A5F76B1AF14359F20423BF651B61D1CABC89829A5E
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E00402E3D(intOrPtr _a4) {
        				long _t2;
        				struct HWND__* _t3;
        				struct HWND__* _t6;
        
        				if(_a4 == 0) {
        					if( *0x429448 == 0) {
        						_t2 = GetTickCount();
        						if(_t2 >  *0x42f430) {
        							_t3 = CreateDialogParamA( *0x42f420, 0x6f, 0, E00402DBA, 0);
        							 *0x429448 = _t3;
        							return ShowWindow(_t3, 5);
        						}
        						return _t2;
        					} else {
        						return E0040653C(0);
        					}
        				} else {
        					_t6 =  *0x429448;
        					if(_t6 != 0) {
        						_t6 = DestroyWindow(_t6);
        					}
        					 *0x429448 = 0;
        					return _t6;
        				}
        			}






        0x00402e44
        0x00402e64
        0x00402e6e
        0x00402e7a
        0x00402e8b
        0x00402e94
        0x00000000
        0x00402e99
        0x00402ea0
        0x00402e66
        0x00402e6d
        0x00402e6d
        0x00402e46
        0x00402e46
        0x00402e4d
        0x00402e50
        0x00402e50
        0x00402e56
        0x00402e5d
        0x00402e5d

        APIs
        • DestroyWindow.USER32(?,00000000,0040301B,00000001), ref: 00402E50
        • GetTickCount.KERNEL32 ref: 00402E6E
        • CreateDialogParamA.USER32(0000006F,00000000,00402DBA,00000000), ref: 00402E8B
        • ShowWindow.USER32(00000000,00000005), ref: 00402E99
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: Window$CountCreateDestroyDialogParamShowTick
        • String ID:
        • API String ID: 2102729457-0
        • Opcode ID: 8c1e1bd8efa9ab411d4161537fee885c8283498bc89c51da2617a800704498c9
        • Instruction ID: cc5f9dcce599e9be0c1e5b41ef6f72156ec830c1ee92694e4cf82ced2ffe4824
        • Opcode Fuzzy Hash: 8c1e1bd8efa9ab411d4161537fee885c8283498bc89c51da2617a800704498c9
        • Instruction Fuzzy Hash: B6F05E30A45630EBC6317B64FE4CA8B7B64BB44B45B91047AF045B22E8C6740C83CBED
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 53%
        			E00405B7D(void* __eflags, intOrPtr _a4) {
        				int _t11;
        				signed char* _t12;
        				intOrPtr _t18;
        				intOrPtr* _t21;
        				void* _t22;
        
        				E004060F7(0x42bc98, _a4);
        				_t21 = E00405B28(0x42bc98);
        				if(_t21 != 0) {
        					E004063D2(_t21);
        					if(( *0x42f43c & 0x00000080) == 0) {
        						L5:
        						_t22 = _t21 - 0x42bc98;
        						while(1) {
        							_t11 = lstrlenA(0x42bc98);
        							_push(0x42bc98);
        							if(_t11 <= _t22) {
        								break;
        							}
        							_t12 = E0040646B();
        							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
        								E00405AD6(0x42bc98);
        								continue;
        							} else {
        								goto L1;
        							}
        						}
        						E00405A8F();
        						return 0 | GetFileAttributesA(??) != 0xffffffff;
        					}
        					_t18 =  *_t21;
        					if(_t18 == 0 || _t18 == 0x5c) {
        						goto L1;
        					} else {
        						goto L5;
        					}
        				}
        				L1:
        				return 0;
        			}








        0x00405b89
        0x00405b94
        0x00405b98
        0x00405b9f
        0x00405bab
        0x00405bb7
        0x00405bb7
        0x00405bcf
        0x00405bd0
        0x00405bd7
        0x00405bd8
        0x00000000
        0x00000000
        0x00405bbb
        0x00405bc2
        0x00405bca
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x00405bc2
        0x00405bda
        0x00000000
        0x00405bee
        0x00405bad
        0x00405bb1
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x00405bb1
        0x00405b9a
        0x00000000

        APIs
          • Part of subcall function 004060F7: lstrcpynA.KERNEL32(?,?,00000400,0040341A,0042EC20,NSIS Error,?,00000007,00000009,0000000B), ref: 00406104
          • Part of subcall function 00405B28: CharNextA.USER32(?,?,0042BC98,?,00405B94,0042BC98,0042BC98,7519FA90,?,C:\Users\user\AppData\Local\Temp\,004058DF,?,7519FA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405B36
          • Part of subcall function 00405B28: CharNextA.USER32(00000000), ref: 00405B3B
          • Part of subcall function 00405B28: CharNextA.USER32(00000000), ref: 00405B4F
        • lstrlenA.KERNEL32(0042BC98,00000000,0042BC98,0042BC98,7519FA90,?,C:\Users\user\AppData\Local\Temp\,004058DF,?,7519FA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405BD0
        • GetFileAttributesA.KERNEL32(0042BC98,0042BC98,0042BC98,0042BC98,0042BC98,0042BC98,00000000,0042BC98,0042BC98,7519FA90,?,C:\Users\user\AppData\Local\Temp\,004058DF,?,7519FA90,C:\Users\user\AppData\Local\Temp\), ref: 00405BE0
        Strings
        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405B7D
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: CharNext$AttributesFilelstrcpynlstrlen
        • String ID: C:\Users\user\AppData\Local\Temp\
        • API String ID: 3248276644-823278215
        • Opcode ID: e638d3577084fc0f37fd401aa5ef1a5930802456fef8e272e5ea6ea3ca1dc2da
        • Instruction ID: a7953992a1868a2a025aeaadbe30fe94b9837340da5d1ec43b16535858986a89
        • Opcode Fuzzy Hash: e638d3577084fc0f37fd401aa5ef1a5930802456fef8e272e5ea6ea3ca1dc2da
        • Instruction Fuzzy Hash: 6DF02821105E6116D222323A1C05AAF3A74CE82364715013FF862B22D3CF7CB9139DBE
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 89%
        			E00405192(struct HWND__* _a4, int _a8, int _a12, long _a16) {
        				int _t15;
        				long _t16;
        
        				_t15 = _a8;
        				if(_t15 != 0x102) {
        					if(_t15 != 0x200) {
        						_t16 = _a16;
        						L7:
        						if(_t15 == 0x419 &&  *0x42a87c != _t16) {
        							_push(_t16);
        							_push(6);
        							 *0x42a87c = _t16;
        							E00404B4E();
        						}
        						L11:
        						return CallWindowProcA( *0x42a884, _a4, _t15, _a12, _t16);
        					}
        					if(IsWindowVisible(_a4) == 0) {
        						L10:
        						_t16 = _a16;
        						goto L11;
        					}
        					_t16 = E00404ACE(_a4, 1);
        					_t15 = 0x419;
        					goto L7;
        				}
        				if(_a12 != 0x20) {
        					goto L10;
        				}
        				E004041C7(0x413);
        				return 0;
        			}





        0x00405196
        0x004051a0
        0x004051bc
        0x004051de
        0x004051e1
        0x004051e7
        0x004051f1
        0x004051f2
        0x004051f4
        0x004051fa
        0x004051fa
        0x00405204
        0x00000000
        0x00405212
        0x004051c9
        0x00405201
        0x00405201
        0x00000000
        0x00405201
        0x004051d5
        0x004051d7
        0x00000000
        0x004051d7
        0x004051a6
        0x00000000
        0x00000000
        0x004051ad
        0x00000000

        APIs
        • IsWindowVisible.USER32(?), ref: 004051C1
        • CallWindowProcA.USER32 ref: 00405212
          • Part of subcall function 004041C7: SendMessageA.USER32 ref: 004041D9
        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: Window$CallMessageProcSendVisible
        • String ID:
        • API String ID: 3748168415-3916222277
        • Opcode ID: 9af3a59599e8879c459ffb9579ce68eec3d4baecce8abe749bc9c6a9b619fe8d
        • Instruction ID: 7056b910bbb205cd539ea3acc8ab51e06e0639846daa80cdaddfd33d10a348e5
        • Opcode Fuzzy Hash: 9af3a59599e8879c459ffb9579ce68eec3d4baecce8abe749bc9c6a9b619fe8d
        • Instruction Fuzzy Hash: 47017171200609ABEF20AF11DD80A5B3666EB84354F14413AFB107A1D1C77A8C62DE6E
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E00405796(CHAR* _a4) {
        				struct _PROCESS_INFORMATION _v20;
        				int _t7;
        
        				0x42c098->cb = 0x44;
        				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x42c098,  &_v20);
        				if(_t7 != 0) {
        					CloseHandle(_v20.hThread);
        					return _v20.hProcess;
        				}
        				return _t7;
        			}





        0x0040579f
        0x004057bf
        0x004057c7
        0x004057cc
        0x00000000
        0x004057d2
        0x004057d6

        APIs
        Strings
        • Error launching installer, xrefs: 004057A9
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: CloseCreateHandleProcess
        • String ID: Error launching installer
        • API String ID: 3712363035-66219284
        • Opcode ID: de0eed9ff358aa0300570f89c8dde483a6f9bec5cddf33796de70880124f880f
        • Instruction ID: 4c3df7556a0b034395016ee82922b733160aa74f7bc511f6187c6ec266d632ef
        • Opcode Fuzzy Hash: de0eed9ff358aa0300570f89c8dde483a6f9bec5cddf33796de70880124f880f
        • Instruction Fuzzy Hash: 4DE0B6B4600209BFEB109BA4ED89F7F7BBCEB04604F504525BE59F2290E67498199A7C
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E00403875() {
        				void* _t2;
        				void* _t3;
        				void* _t6;
        				void* _t8;
        
        				_t8 =  *0x429854;
        				_t3 = E0040385A(_t2, 0);
        				if(_t8 != 0) {
        					do {
        						_t6 = _t8;
        						_t8 =  *_t8;
        						FreeLibrary( *(_t6 + 8));
        						_t3 = GlobalFree(_t6);
        					} while (_t8 != 0);
        				}
        				 *0x429854 =  *0x429854 & 0x00000000;
        				return _t3;
        			}







        0x00403876
        0x0040387e
        0x00403885
        0x00403888
        0x00403888
        0x0040388a
        0x0040388f
        0x00403896
        0x0040389c
        0x004038a0
        0x004038a1
        0x004038a9

        APIs
        • FreeLibrary.KERNEL32(?,7519FA90,00000000,C:\Users\user\AppData\Local\Temp\,0040384D,00403667,?,?,00000007,00000009,0000000B), ref: 0040388F
        • GlobalFree.KERNEL32 ref: 00403896
        Strings
        • C:\Users\user\AppData\Local\Temp\, xrefs: 00403875
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: Free$GlobalLibrary
        • String ID: C:\Users\user\AppData\Local\Temp\
        • API String ID: 1100898210-823278215
        • Opcode ID: 7191d99a6f9acf46369f1b571abb68d71f554d24c115b495d4645827db6beddd
        • Instruction ID: eaa0fdc8f68cdeff62b7926931e70464fa678e679eb7ff43971a821d65c68845
        • Opcode Fuzzy Hash: 7191d99a6f9acf46369f1b571abb68d71f554d24c115b495d4645827db6beddd
        • Instruction Fuzzy Hash: 20E08C335110205BC7613F54EA0471A77ECAF59B62F4A017EF8847B26087781C464A88
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E00405AD6(char* _a4) {
        				char* _t3;
        				char* _t5;
        
        				_t5 = _a4;
        				_t3 =  &(_t5[lstrlenA(_t5)]);
        				while( *_t3 != 0x5c) {
        					_t3 = CharPrevA(_t5, _t3);
        					if(_t3 > _t5) {
        						continue;
        					}
        					break;
        				}
        				 *_t3 =  *_t3 & 0x00000000;
        				return  &(_t3[1]);
        			}





        0x00405ad7
        0x00405ae1
        0x00405ae3
        0x00405aea
        0x00405af2
        0x00000000
        0x00000000
        0x00000000
        0x00405af2
        0x00405af4
        0x00405af9

        APIs
        • lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402F0D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\ilnQNBU7NA.exe,C:\Users\user\Desktop\ilnQNBU7NA.exe,80000000,00000003), ref: 00405ADC
        • CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402F0D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\ilnQNBU7NA.exe,C:\Users\user\Desktop\ilnQNBU7NA.exe,80000000,00000003), ref: 00405AEA
        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: CharPrevlstrlen
        • String ID: C:\Users\user\Desktop
        • API String ID: 2709904686-1246513382
        • Opcode ID: 7cfe4fb9fb084f73e38b743788eacbc948a8cb50b3ca3a16f7beb83d38b7a1d7
        • Instruction ID: fbea36dfa466fa1ea2516b65251d52c814037185d06ce8b70eff5ee1363e4df1
        • Opcode Fuzzy Hash: 7cfe4fb9fb084f73e38b743788eacbc948a8cb50b3ca3a16f7beb83d38b7a1d7
        • Instruction Fuzzy Hash: 73D0A7B25089706EFB0352509C00B8F6E88CF17300F0A04A3E080A7191C7B84C424BFD
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E00405BF5(void* __ecx, CHAR* _a4, CHAR* _a8) {
        				int _v8;
        				int _t12;
        				int _t14;
        				int _t15;
        				CHAR* _t17;
        				CHAR* _t27;
        
        				_t12 = lstrlenA(_a8);
        				_t27 = _a4;
        				_v8 = _t12;
        				while(lstrlenA(_t27) >= _v8) {
        					_t14 = _v8;
        					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
        					_t15 = lstrcmpiA(_t27, _a8);
        					_t27[_v8] =  *(_t14 + _t27);
        					if(_t15 == 0) {
        						_t17 = _t27;
        					} else {
        						_t27 = CharNextA(_t27);
        						continue;
        					}
        					L5:
        					return _t17;
        				}
        				_t17 = 0;
        				goto L5;
        			}









        0x00405c05
        0x00405c07
        0x00405c0a
        0x00405c36
        0x00405c0f
        0x00405c18
        0x00405c1d
        0x00405c28
        0x00405c2b
        0x00405c47
        0x00405c2d
        0x00405c34
        0x00000000
        0x00405c34
        0x00405c40
        0x00405c44
        0x00405c44
        0x00405c3e
        0x00000000

        APIs
        • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E50,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405C05
        • lstrcmpiA.KERNEL32(00000000,00000000,?,00000000,00405E50,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405C1D
        • CharNextA.USER32(00000000,?,00000000,00405E50,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405C2E
        • lstrlenA.KERNEL32(00000000,?,00000000,00405E50,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405C37
        Memory Dump Source
        • Source File: 00000001.00000002.245538188.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.245528778.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245550178.0000000000408000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.245564377.000000000040A000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245570466.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245579956.000000000042C000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245593145.0000000000435000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.245611086.0000000000438000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: lstrlen$CharNextlstrcmpi
        • String ID:
        • API String ID: 190613189-0
        • Opcode ID: b2794e6bf21c90d62e2ecb38362cfad12420dfe545fda3f665c5114a80d4c16b
        • Instruction ID: 0c44f0240925c5b75b39479a83fd13515cb2c3d3321eb5bdfbc953cb3faf5d46
        • Opcode Fuzzy Hash: b2794e6bf21c90d62e2ecb38362cfad12420dfe545fda3f665c5114a80d4c16b
        • Instruction Fuzzy Hash: FBF0F631105A18FFDB12DFA4CD00D9EBBA8EF55350B2540B9E840F7210D634DE01AFA8
        Uniqueness

        Uniqueness Score: -1.00%