Play interactive tour

Edit tour

Windows Analysis Report Adobe-GenP-2.7.exe

Overview

General Information

Sample Name:	Adobe-GenP-2.7.exe
Analysis ID:	499864
MD5:	6467e9dd5d86c741aed49060e6d3fcd2
SHA1:	a3c784836d993cc2cd9a9087a23559fa05567d02
SHA256:	7b8d9ff34315e1787cdb62e682b3ba8dedd9f28d7cd374afe057babaf335edd4
Infos:
Most interesting Screenshot:

Detection

Score:	36
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Binary is likely a compiled AutoIt script file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Contains functionality to execute programs as a different user

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to communicate with device drivers

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to read the clipboard data

Contains functionality to simulate keystroke presses

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

PE file contains strange resources

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to launch a program with higher privileges

Contains functionality to retrieve information about pressed keystrokes

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality to simulate mouse events

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality for read data from the clipboard

Classification

Analysis Advice

Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior

Sample monitors window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook

Process Tree

System is w10x64

Adobe-GenP-2.7.exe (PID: 6332 cmdline: 'C:\Users\user\Desktop\Adobe-GenP-2.7.exe' MD5: 6467E9DD5D86C741AED49060E6D3FCD2)

HotKeySet.exe (PID: 4648 cmdline: 'C:\Users\user\Desktop\HotKeySet.exe' MD5: 3662DF73D4E4C757C131F8C861C8D0CA)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

Source: Adobe-GenP-2.7.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E989E424 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,_swprintf,_swprintf,_swprintf,_swprintf,_swprintf,_swprintf,_swprintf,	1_2_00007FF6E989E424
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E9894364 GetFileAttributesW,FindFirstFileW,FindClose,	1_2_00007FF6E9894364
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E989E378 FindFirstFileW,FindClose,	1_2_00007FF6E989E378
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98932C8 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_00007FF6E98932C8
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98A11F0 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	1_2_00007FF6E98A11F0
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98A1390 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	1_2_00007FF6E98A1390
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98936C4 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_00007FF6E98936C4
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98A1724 FindFirstFileW,Sleep,FindNextFileW,FindClose,	1_2_00007FF6E98A1724
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E989D650 FindFirstFileW,FindNextFileW,FindClose,	1_2_00007FF6E989D650
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD4E424 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,_swprintf,_swprintf,_swprintf,_swprintf,_swprintf,_swprintf,_swprintf,	3_2_00007FF7CBD4E424
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD4E378 FindFirstFileW,FindClose,	3_2_00007FF7CBD4E378
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD44364 GetFileAttributesW,FindFirstFileW,FindClose,	3_2_00007FF7CBD44364
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD51390 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	3_2_00007FF7CBD51390
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD432C8 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_00007FF7CBD432C8
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD511F0 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	3_2_00007FF7CBD511F0
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD51724 FindFirstFileW,Sleep,FindNextFileW,FindClose,	3_2_00007FF7CBD51724
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD436C4 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_00007FF7CBD436C4
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD4D650 FindFirstFileW,FindNextFileW,FindClose,	3_2_00007FF7CBD4D650

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E98A5690 InternetQueryDataAvailable,InternetReadFile,

1_2_00007FF6E98A5690

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E98A7764 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

1_2_00007FF6E98A7764

Source: Adobe-GenP-2.7.exe, 00000001.00000002.551146439.000002CA607EC000.00000004.00000001.sdmp

Binary or memory string: _WINAPI_REGISTERRAWINPUTDEVICES

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E988F0A8 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

1_2_00007FF6E988F0A8

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E98A7A2C OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

1_2_00007FF6E98A7A2C

System Summary:

Binary is likely a compiled AutoIt script file

Show sources

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: This is a third-party compiled AutoIt script.	1_2_00007FF6E983AB60
Source: Adobe-GenP-2.7.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Adobe-GenP-2.7.exe, 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: This is a third-party compiled AutoIt script.	3_2_00007FF7CBCEAB60
Source: HotKeySet.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: HotKeySet.exe, 00000003.00000000.284302937.00007FF7CBD9B000.00000002.00020000.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer
Source: Adobe-GenP-2.7.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Adobe-GenP-2.7.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E9895344 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		1_2_00007FF6E9895344
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD45344 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		3_2_00007FF7CBD45344

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98C2E60	1_2_00007FF6E98C2E60
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E985E4E0	1_2_00007FF6E985E4E0
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98C1A80	1_2_00007FF6E98C1A80
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E983A0C4	1_2_00007FF6E983A0C4
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E982FFD0	1_2_00007FF6E982FFD0
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E9821F98	1_2_00007FF6E9821F98
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98473F8	1_2_00007FF6E98473F8
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98C6AB0	1_2_00007FF6E98C6AB0
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E988CA18	1_2_00007FF6E988CA18
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E989894C	1_2_00007FF6E989894C
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98C0CD4	1_2_00007FF6E98C0CD4
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98B6D30	1_2_00007FF6E98B6D30
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98AEC68	1_2_00007FF6E98AEC68
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98A8C68	1_2_00007FF6E98A8C68
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E982EC00	1_2_00007FF6E982EC00
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E984EB4C	1_2_00007FF6E984EB4C
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E982EE80	1_2_00007FF6E982EE80
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E9852DDC	1_2_00007FF6E9852DDC
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E982EC00	1_2_00007FF6E982EC00
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E985ED80	1_2_00007FF6E985ED80
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E9857050	1_2_00007FF6E9857050
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98BC30C	1_2_00007FF6E98BC30C
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98C2248	1_2_00007FF6E98C2248
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98AA228	1_2_00007FF6E98AA228
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98AC174	1_2_00007FF6E98AC174
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E9860168	1_2_00007FF6E9860168
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98224E8	1_2_00007FF6E98224E8
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E982A3C0	1_2_00007FF6E982A3C0
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E984E840	1_2_00007FF6E984E840
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E982C790	1_2_00007FF6E982C790
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98AE778	1_2_00007FF6E98AE778
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98219E4	1_2_00007FF6E98219E4
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E9855C48	1_2_00007FF6E9855C48
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E983FC50	1_2_00007FF6E983FC50
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E9859C64	1_2_00007FF6E9859C64
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E984DBF4	1_2_00007FF6E984DBF4
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E9853B40	1_2_00007FF6E9853B40
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E9827EF4	1_2_00007FF6E9827EF4
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98A9EB4	1_2_00007FF6E98A9EB4
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98A9EA4	1_2_00007FF6E98A9EA4
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98B5DC0	1_2_00007FF6E98B5DC0
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E985A0C8	1_2_00007FF6E985A0C8
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E9852028	1_2_00007FF6E9852028
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98B72C8	1_2_00007FF6E98B72C8
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E985D250	1_2_00007FF6E985D250
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98591D0	1_2_00007FF6E98591D0
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E985D518	1_2_00007FF6E985D518
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E9855454	1_2_00007FF6E9855454
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E9895474	1_2_00007FF6E9895474
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E989F410	1_2_00007FF6E989F410
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E984B34C	1_2_00007FF6E984B34C
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E9899638	1_2_00007FF6E9899638
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E9859678	1_2_00007FF6E9859678
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E983F6B0	1_2_00007FF6E983F6B0
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E984955A	1_2_00007FF6E984955A
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98AD5B4	1_2_00007FF6E98AD5B4
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E985D8C8	1_2_00007FF6E985D8C8
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98BF84C	1_2_00007FF6E98BF84C
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD0E4E0	3_2_00007FF7CBD0E4E0
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCF73F8	3_2_00007FF7CBCF73F8
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD70CD4	3_2_00007FF7CBD70CD4
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD5EC68	3_2_00007FF7CBD5EC68
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD58C68	3_2_00007FF7CBD58C68
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCDEC00	3_2_00007FF7CBCDEC00
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCFEB4C	3_2_00007FF7CBCFEB4C
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD76AB0	3_2_00007FF7CBD76AB0
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD3CA18	3_2_00007FF7CBD3CA18
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD4894C	3_2_00007FF7CBD4894C
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD07050	3_2_00007FF7CBD07050
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD72E60	3_2_00007FF7CBD72E60
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCDEE80	3_2_00007FF7CBCDEE80
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD02DDC	3_2_00007FF7CBD02DDC
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD0ED80	3_2_00007FF7CBD0ED80
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCDEC00	3_2_00007FF7CBCDEC00
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD66D30	3_2_00007FF7CBD66D30
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCD24E8	3_2_00007FF7CBCD24E8
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCDA3C0	3_2_00007FF7CBCDA3C0
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD6C30C	3_2_00007FF7CBD6C30C
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD72248	3_2_00007FF7CBD72248
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD5A228	3_2_00007FF7CBD5A228
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD10168	3_2_00007FF7CBD10168
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD5C174	3_2_00007FF7CBD5C174
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCFE840	3_2_00007FF7CBCFE840
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD5E778	3_2_00007FF7CBD5E778
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCDC790	3_2_00007FF7CBCDC790
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD09C64	3_2_00007FF7CBD09C64
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCEFC50	3_2_00007FF7CBCEFC50
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD05C48	3_2_00007FF7CBD05C48
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCFDBF4	3_2_00007FF7CBCFDBF4
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD03B40	3_2_00007FF7CBD03B40
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD71A80	3_2_00007FF7CBD71A80
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCD19E4	3_2_00007FF7CBCD19E4
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD0A0C8	3_2_00007FF7CBD0A0C8
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCEA0C4	3_2_00007FF7CBCEA0C4
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD02028	3_2_00007FF7CBD02028
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCD1F98	3_2_00007FF7CBCD1F98
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCDFFD0	3_2_00007FF7CBCDFFD0
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCD7EF4	3_2_00007FF7CBCD7EF4
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD59EA4	3_2_00007FF7CBD59EA4
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD59EB4	3_2_00007FF7CBD59EB4
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD65DC0	3_2_00007FF7CBD65DC0
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD45474	3_2_00007FF7CBD45474
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD05454	3_2_00007FF7CBD05454
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD4F410	3_2_00007FF7CBD4F410
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCFB34C	3_2_00007FF7CBCFB34C
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD672C8	3_2_00007FF7CBD672C8
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD0D250	3_2_00007FF7CBD0D250
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD091D0	3_2_00007FF7CBD091D0
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD0D8C8	3_2_00007FF7CBD0D8C8
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD6F84C	3_2_00007FF7CBD6F84C
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCEF6B0	3_2_00007FF7CBCEF6B0
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD09678	3_2_00007FF7CBD09678
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD49638	3_2_00007FF7CBD49638
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD5D5B4	3_2_00007FF7CBD5D5B4
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCF955A	3_2_00007FF7CBCF955A
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD0D518	3_2_00007FF7CBD0D518

Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: String function: 00007FF7CBCF6070 appears 72 times
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: String function: 00007FF7CBCEF0BC appears 37 times
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: String function: 00007FF6E983F0BC appears 37 times
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: String function: 00007FF6E9846070 appears 72 times

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E9885D84 GetCurrentProcess,OpenProcessToken,CreateEnvironmentBlock,CloseHandle,CreateProcessWithLogonW,DestroyEnvironmentBlock,

1_2_00007FF6E9885D84

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E9893AA4: CreateFileW,DeviceIoControl,CloseHandle,

1_2_00007FF6E9893AA4

Source: Adobe-GenP-2.7.exe, 00000001.00000002.552096088.000002CA60A7C000.00000004.00000001.sdmp	Binary or memory string: FV_ORIGINALFILENAME^ vs Adobe-GenP-2.7.exe
Source: Adobe-GenP-2.7.exe, 00000001.00000002.549721401.000002CA5E906000.00000004.00000001.sdmp	Binary or memory string: FV_ORIGINALFILENAME vs Adobe-GenP-2.7.exe
Source: Adobe-GenP-2.7.exe, 00000001.00000002.549721401.000002CA5E906000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameg vs Adobe-GenP-2.7.exe

Source: Adobe-GenP-2.7.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Adobe-GenP-2.7.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Adobe-GenP-2.7.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Adobe-GenP-2.7.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Adobe-GenP-2.7.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Adobe-GenP-2.7.exe 'C:\Users\user\Desktop\Adobe-GenP-2.7.exe'
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Process created: C:\Users\user\Desktop\HotKeySet.exe 'C:\Users\user\Desktop\HotKeySet.exe'
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Process created: C:\Users\user\Desktop\HotKeySet.exe 'C:\Users\user\Desktop\HotKeySet.exe'	Jump to behavior

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E988609C LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	1_2_00007FF6E988609C
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98857A8 AdjustTokenPrivileges,CloseHandle,	1_2_00007FF6E98857A8
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD3609C LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	3_2_00007FF7CBD3609C
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD357A8 AdjustTokenPrivileges,CloseHandle,	3_2_00007FF7CBD357A8

Source: classification engine

Classification label: sus36.evad.winEXE@3/0@0/0

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E98AD06C CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

1_2_00007FF6E98AD06C

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E989CAF0 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

1_2_00007FF6E989CAF0

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E989B364 GetLastError,FormatMessageW,

1_2_00007FF6E989B364

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E9893854 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,

1_2_00007FF6E9893854

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Mutant created: \Sessions\1\BaseNamedObjects\Adobe-GenP-2.7
Source: C:\Users\user\Desktop\HotKeySet.exe	Mutant created: \Sessions\1\BaseNamedObjects\HotKeySet

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E983B390 ftell,CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

1_2_00007FF6E983B390

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Window detected: Number of UI elements: 32

Source: Adobe-GenP-2.7.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Adobe-GenP-2.7.exe

Static file information: File size 1378304 > 1048576

Source: Adobe-GenP-2.7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Adobe-GenP-2.7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Adobe-GenP-2.7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Adobe-GenP-2.7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Adobe-GenP-2.7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Adobe-GenP-2.7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Adobe-GenP-2.7.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source: Adobe-GenP-2.7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: Adobe-GenP-2.7.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Adobe-GenP-2.7.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Adobe-GenP-2.7.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Adobe-GenP-2.7.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Adobe-GenP-2.7.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E9846709 push 8B490002h; ret	1_2_00007FF6E9846716
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E984DBCD push rdi; ret	1_2_00007FF6E984DBD4
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E984D6B9 push rdi; ret	1_2_00007FF6E984D6C2
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E982D68C push rax; retf 0000h	1_2_00007FF6E982D68D
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E982D690 push rax; retf 0000h	1_2_00007FF6E982D691
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCF6709 push 8B490002h; ret	3_2_00007FF7CBCF6716
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCFDBCD push rdi; ret	3_2_00007FF7CBCFDBD4
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCFD6B9 push rdi; ret	3_2_00007FF7CBCFD6C2
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCDD690 push rax; retf 0000h	3_2_00007FF7CBCDD691
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCDD68C push rax; retf 0000h	3_2_00007FF7CBCDD68D

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E988AC80 LoadLibraryA,GetProcAddress,

1_2_00007FF6E988AC80

Source: Adobe-GenP-2.7.exe

Static PE information: real checksum: 0x15b2c4 should be: 0x151757

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E983A0C4 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,	1_2_00007FF6E983A0C4
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98BD0D4 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	1_2_00007FF6E98BD0D4
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD6D0D4 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	3_2_00007FF7CBD6D0D4
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBCEA0C4 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,	3_2_00007FF7CBCEA0C4

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E98473F8 RtlEncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00007FF6E98473F8

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HotKeySet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HotKeySet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe TID: 2328	Thread sleep time: -75170s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HotKeySet.exe TID: 4964	Thread sleep count: 7493 > 30	Jump to behavior
Source: C:\Users\user\Desktop\HotKeySet.exe TID: 4964	Thread sleep time: -74930s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\HotKeySet.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\HotKeySet.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Window / User API: threadDelayed 7517	Jump to behavior
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Window / User API: foregroundWindowGot 1491	Jump to behavior
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Window / User API: foregroundWindowGot 497	Jump to behavior
Source: C:\Users\user\Desktop\HotKeySet.exe	Window / User API: threadDelayed 7493	Jump to behavior

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	API coverage: 7.6 %
Source: C:\Users\user\Desktop\HotKeySet.exe	API coverage: 5.1 %

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E9839ED8 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,

1_2_00007FF6E9839ED8

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E989E424 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,_swprintf,_swprintf,_swprintf,_swprintf,_swprintf,_swprintf,_swprintf,	1_2_00007FF6E989E424
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E9894364 GetFileAttributesW,FindFirstFileW,FindClose,	1_2_00007FF6E9894364
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E989E378 FindFirstFileW,FindClose,	1_2_00007FF6E989E378
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98932C8 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_00007FF6E98932C8
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98A11F0 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	1_2_00007FF6E98A11F0
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98A1390 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	1_2_00007FF6E98A1390
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98936C4 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_00007FF6E98936C4
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98A1724 FindFirstFileW,Sleep,FindNextFileW,FindClose,	1_2_00007FF6E98A1724
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E989D650 FindFirstFileW,FindNextFileW,FindClose,	1_2_00007FF6E989D650
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD4E424 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,_swprintf,_swprintf,_swprintf,_swprintf,_swprintf,_swprintf,_swprintf,	3_2_00007FF7CBD4E424
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD4E378 FindFirstFileW,FindClose,	3_2_00007FF7CBD4E378
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD44364 GetFileAttributesW,FindFirstFileW,FindClose,	3_2_00007FF7CBD44364
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD51390 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	3_2_00007FF7CBD51390
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD432C8 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_00007FF7CBD432C8
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD511F0 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	3_2_00007FF7CBD511F0
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD51724 FindFirstFileW,Sleep,FindNextFileW,FindClose,	3_2_00007FF7CBD51724
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD436C4 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_00007FF7CBD436C4
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD4D650 FindFirstFileW,FindNextFileW,FindClose,	3_2_00007FF7CBD4D650

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	API call chain: ExitProcess graph end node			graph_1-104306
Source: C:\Users\user\Desktop\HotKeySet.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E983AB60 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

1_2_00007FF6E983AB60

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E985BD0C EncodePointer,__crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

1_2_00007FF6E985BD0C

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E988AC80 LoadLibraryA,GetProcAddress,

1_2_00007FF6E988AC80

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E9886258 GetProcessHeap,HeapAlloc,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,CreateThread,

1_2_00007FF6E9886258

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E98A76F8 BlockInput,

1_2_00007FF6E98A76F8

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E985AA9C terminate,SetUnhandledExceptionFilter,	1_2_00007FF6E985AA9C
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E9851F94 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF6E9851F94
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD0AA9C terminate,SetUnhandledExceptionFilter,	3_2_00007FF7CBD0AA9C
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD01F94 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF7CBD01F94

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E9885924 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

1_2_00007FF6E9885924

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E983A0C4 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

1_2_00007FF6E983A0C4

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E983AB60 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

1_2_00007FF6E983AB60

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Process created: C:\Users\user\Desktop\HotKeySet.exe 'C:\Users\user\Desktop\HotKeySet.exe'

Jump to behavior

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E9894D60 mouse_event,

1_2_00007FF6E9894D60

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E98850BC GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

1_2_00007FF6E98850BC

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E98949B0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

1_2_00007FF6E98949B0

Source: Adobe-GenP-2.7.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Adobe-GenP-2.7.exe, 00000001.00000002.550258072.000002CA5F030000.00000002.00020000.sdmp, HotKeySet.exe, 00000003.00000002.550216629.000001D78F100000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: Adobe-GenP-2.7.exe, HotKeySet.exe	Binary or memory string: Shell_TrayWnd
Source: Adobe-GenP-2.7.exe, 00000001.00000002.550258072.000002CA5F030000.00000002.00020000.sdmp, HotKeySet.exe, 00000003.00000002.550216629.000001D78F100000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: Adobe-GenP-2.7.exe, 00000001.00000002.550258072.000002CA5F030000.00000002.00020000.sdmp, HotKeySet.exe, 00000003.00000002.550216629.000001D78F100000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E9857600 cpuid

1_2_00007FF6E9857600

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E984ABD4 GetSystemTimeAsFileTime,

1_2_00007FF6E984ABD4

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E9859C64 _lock,_get_daylight,_get_daylight,_get_daylight,___lc_codepage_func,free,_malloc_crt,_invoke_watson,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,

1_2_00007FF6E9859C64

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E9839ED8 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,

1_2_00007FF6E9839ED8

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe

Code function: 1_2_00007FF6E9869B1D GetUserNameW,

1_2_00007FF6E9869B1D

Source: HotKeySet.exe, 00000003.00000003.285231709.000001D78E96C000.00000004.00000001.sdmp	Binary or memory string: WIN_XPB
Source: HotKeySet.exe	Binary or memory string: WIN_81
Source: HotKeySet.exe	Binary or memory string: WIN_XP
Source: HotKeySet.exe	Binary or memory string: WIN_XPe
Source: HotKeySet.exe	Binary or memory string: WIN_VISTA
Source: HotKeySet.exe	Binary or memory string: WIN_7
Source: HotKeySet.exe	Binary or memory string: WIN_8
Source: Adobe-GenP-2.7.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98AAC1C socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	1_2_00007FF6E98AAC1C
Source: C:\Users\user\Desktop\Adobe-GenP-2.7.exe	Code function: 1_2_00007FF6E98AA524 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	1_2_00007FF6E98AA524
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD5AC1C socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	3_2_00007FF7CBD5AC1C
Source: C:\Users\user\Desktop\HotKeySet.exe	Code function: 3_2_00007FF7CBD5A524 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	3_2_00007FF7CBD5A524

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts2	Native API1	Valid Accounts2	Valid Accounts2	Valid Accounts2	Input Capture21	System Time Discovery2	Remote Services	Input Capture21	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Scheduled Task/Job	Application Shimming1	Exploitation for Privilege Escalation1	Virtualization/Sandbox Evasion1	LSASS Memory	Security Software Discovery3	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Access Token Manipulation21	Disable or Modify Tools1	Security Account Manager	Virtualization/Sandbox Evasion1	SMB/Windows Admin Shares	Clipboard Data2	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Process Injection12	Access Token Manipulation21	NTDS	Process Discovery3	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Application Shimming1	Process Injection12	LSA Secrets	Application Window Discovery11	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Deobfuscate/Decode Files or Information1	Cached Domain Credentials	Account Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information2	DCSync	System Owner/User Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	File and Directory Discovery2	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Information Discovery15	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
Adobe-GenP-2.7.exe	0%	Virustotal	Browse
Adobe-GenP-2.7.exe	6%	Metadefender	Browse
Adobe-GenP-2.7.exe	4%	ReversingLabs

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	499864
Start date:	09.10.2021
Start time:	20:30:51
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Adobe-GenP-2.7.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus36.evad.winEXE@3/0@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 27.4% (good quality ratio 20.5%) Quality average: 43.8% Quality standard deviation: 30.8%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 95.100.218.79, 20.82.210.154, 52.251.79.25, 40.112.88.60, 20.54.110.249, 13.107.4.50, 20.199.120.182, 20.199.120.151, 20.199.120.85 Excluded domains from analysis (whitelisted): client.wns.windows.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, wu-shim.trafficmanager.net, consumer-displaycatalogrp-aks2aks-useast.md.mp.microsoft.com.akadns.net, eus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, ctldl.windowsupdate.com, c-0001.c-msedge.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, b1ns.c-0001.c-msedge.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, displaycatalog-rp-useast.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net, b1ns.au-msedge.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.674686219381882
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Adobe-GenP-2.7.exe
File size:	1378304
MD5:	6467e9dd5d86c741aed49060e6d3fcd2
SHA1:	a3c784836d993cc2cd9a9087a23559fa05567d02
SHA256:	7b8d9ff34315e1787cdb62e682b3ba8dedd9f28d7cd374afe057babaf335edd4
SHA512:	9f3b46f4b4c2839e2cd6c6ca2fb2b859af0e22a9c8276b26b32c83ca5f9d95c3cefb44cd82dc78cbe427de04e92e86ceface836f45c3263a8a5a1ca7c1dc48e7
SSDEEP:	24576:fRaZROMOm8FN7TjsPnzt2heeRhQbJEOeamXHeqtGHXR0LSeIU6:5kxOm+7TjsPnztyDMmaSHeqtyX8Sg
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v.bi2..:2..:2..:.b.:3..:t..:...:t..:+..:t..:...:;..::..:;..:3..:;..:...:2..:...:.\.:b..:.\.:3..:?..:3..:2..:3..:.\.:3..:Rich2..

File Icon


Icon Hash:	32f0cc8cc8f434c0

Static PE Info

General
Entrypoint:	0x14002fb2c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x5FB7091B [Fri Nov 20 00:08:59 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	161c85364c462057ba28801ac1ad5404

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F0E3C7FCAC4h
dec eax
add esp, 28h
jmp 00007F0E3C7F153Bh
int3
int3
mov eax, dword ptr [000AC89Ah]
inc esp
mov eax, edx
and ecx, edx
inc ecx
not eax
inc esp
and eax, eax
inc esp
or eax, ecx
inc esp
mov dword ptr [000AC885h], eax
ret
dec eax
sub esp, 28h
call 00007F0E3C7F3F8Ch
dec eax
test eax, eax
je 00007F0E3C7F170Ch
mov ecx, 00000016h
call 00007F0E3C7F3FADh
test byte ptr [000AC865h], 00000002h
je 00007F0E3C7F172Bh
mov ecx, 00000017h
call 00007F0E3C80342Ah
test eax, eax
je 00007F0E3C7F1709h
mov ecx, 00000007h
int 29h
inc ecx
mov eax, 00000001h
mov edx, 40000015h
inc ecx
lea ecx, dword ptr [eax+02h]
call 00007F0E3C7F2057h
mov ecx, 00000003h
call 00007F0E3C7E8F41h
int3
int3
int3
int3
dec eax
mov dword ptr [000B22B5h], ecx
ret
dec eax
lea eax, dword ptr [00080AB5h]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, dword ptr [edx]
mov byte ptr [ecx+10h], 00000000h
dec eax
mov dword ptr [ecx+08h], eax
dec eax
mov eax, ecx
ret
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
and dword ptr [ecx+08h], 00000000h
dec eax
lea eax, dword ptr [00080A8Eh]
dec eax
mov ebx, ecx
dec eax
mov dword ptr [ecx], eax
mov byte ptr [ecx+10h], 00000000h

Rich Headers

Programming Language:

[LNK] VS2013 UPD5 build 40629
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd8268	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xef000	0x691fc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xe8000	0x699c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x159000	0xa7c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xae890	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xba280	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xaa000	0x1120	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa8285	0xa8400	False	0.549565262816	data	6.51159091106	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0xaa000	0x31808	0x31a00	False	0.289377361461	data	5.29127439186	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xdc000	0xb230	0x5e00	False	0.0889710771277	data	1.15891733596	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0xe8000	0x699c	0x6a00	False	0.495688384434	data	5.87141014565	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xef000	0x691fc	0x69200	False	0.715131725624	data	6.94813819419	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x159000	0xa7c	0xc00	False	0.4833984375	data	5.15455256996	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0xef5d8	0x128	GLS_BINARY_LSB_FIRST	English	Great Britain
RT_ICON	0xef700	0x128	GLS_BINARY_LSB_FIRST	English	Great Britain
RT_ICON	0xef828	0x128	GLS_BINARY_LSB_FIRST	English	Great Britain
RT_ICON	0xef950	0xb2e3	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Great Britain
RT_ICON	0xfac34	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0	English	Great Britain
RT_ICON	0x10b45c	0x94a8	data	English	Great Britain
RT_ICON	0x114904	0x5488	data	English	Great Britain
RT_ICON	0x119d8c	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 4294967295, next used block 4294967295	English	Great Britain
RT_ICON	0x11dfb4	0x25a8	data	English	Great Britain
RT_ICON	0x12055c	0x10a8	data	English	Great Britain
RT_ICON	0x121604	0x988	data	English	Great Britain
RT_ICON	0x121f8c	0x468	GLS_BINARY_LSB_FIRST	English	Great Britain
RT_MENU	0x1223f4	0x50	data	English	Great Britain
RT_STRING	0x122444	0x594	data	English	Great Britain
RT_STRING	0x1229d8	0x68a	data	English	Great Britain
RT_STRING	0x123064	0x490	data	English	Great Britain
RT_STRING	0x1234f4	0x5fc	data	English	Great Britain
RT_STRING	0x123af0	0x65c	data	English	Great Britain
RT_STRING	0x12414c	0x466	data	English	Great Britain
RT_STRING	0x1245b4	0x158	data	English	Great Britain
RT_RCDATA	0x12470c	0x333ce	data
RT_GROUP_ICON	0x157adc	0x84	data	English	Great Britain
RT_GROUP_ICON	0x157b60	0x14	data	English	Great Britain
RT_GROUP_ICON	0x157b74	0x14	data	English	Great Britain
RT_GROUP_ICON	0x157b88	0x14	data	English	Great Britain
RT_VERSION	0x157b9c	0x264	data	English	Great Britain
RT_MANIFEST	0x157e00	0x3fa	ASCII text, with CRLF line terminators	English	Great Britain

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, CloseHandle, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, CreateThread, LeaveCriticalSection, GetStdHandle, CreatePipe, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, EncodePointer, DuplicateHandle, GetCurrentProcess, EnterCriticalSection, GetCurrentThread, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, RtlPcToFileHeader, RtlUnwindEx, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, DeleteFileW, SetEnvironmentVariableA
USER32.dll	RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetWindowLongW, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongPtrW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, SetWindowLongPtrW, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, GetCursorInfo, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, TranslateMessage, SystemParametersInfoW, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongPtrW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, TrackPopupMenuEx, DispatchMessageW, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, FindWindowW, PeekMessageW, ScreenToClient
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, CreateCompatibleBitmap, CreateCompatibleDC, Ellipse, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, CreateDispTypeInfo, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysAllocString, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, SafeArrayAccessData, VariantInit

Version Infos

Description	Data
LegalCopyright	2.0.0
FileVersion	2.0.0.0
CompanyName	2.0.0
LegalTradeMarks	2.0.0
Comments	2.0.0
ProductName	2.0.0
ProductVersion	2.0.0
FileDescription	Adobe-GenP-2.7
Translation	0x0809 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Static AutoIT Info

General

Code:

#RequireAdmin #Region #AutoIt3Wrapper_Icon=ICONS\Skull.ico #AutoIt3Wrapper_Res_Comment=2.0.0 #AutoIt3Wrapper_Res_Description=Adobe-GenP-2.7 #AutoIt3Wrapper_Res_Fileversion=2.0.0.0 #AutoIt3Wrapper_Res_ProductName=2.0.0 #AutoIt3Wrapper_Res_ProductVersion=2.0.0 #AutoIt3Wrapper_Res_CompanyName=2.0.0 #AutoIt3Wrapper_Res_LegalCopyright=2.0.0 #AutoIt3Wrapper_Res_LegalTradeMarks=2.0.0 #EndRegion GLOBAL CONST $HGDI_ERROR = PTR (+ 4294967295 ) GLOBAL CONST $INVALID_HANDLE_VALUE = PTR (+ 4294967295 ) GLOBAL CONST $CLR_INVALID = + 4294967295 GLOBAL CONST $MB_PRECOMPOSED = 1 GLOBAL CONST $MB_COMPOSITE = 2 GLOBAL CONST $MB_USEGLYPHCHARS = 4 GLOBAL CONST $ULW_ALPHA = 2 GLOBAL CONST $ULW_COLORKEY = 1 GLOBAL CONST $ULW_OPAQUE = 4 GLOBAL CONST $ULW_EX_NORESIZE = 8 GLOBAL CONST $WH_CALLWNDPROC = 4 GLOBAL CONST $WH_CALLWNDPROCRET = 12 GLOBAL CONST $WH_CBT = 5 GLOBAL CONST $WH_DEBUG = 9 GLOBAL CONST $WH_FOREGROUNDIDLE = 11 GLOBAL CONST $WH_GETMESSAGE = 3 GLOBAL CONST $WH_JOURNALPLAYBACK = 1 GLOBAL CONST $WH_JOURNALRECORD = 0 GLOBAL CONST $WH_KEYBOARD = 2 GLOBAL CONST $WH_KEYBOARD_LL = 13 GLOBAL CONST $WH_MOUSE = 7 GLOBAL CONST $WH_MOUSE_LL = 14 GLOBAL CONST $WH_MSGFILTER = + 4294967295 GLOBAL CONST $WH_SHELL = 10 GLOBAL CONST $WH_SYSMSGFILTER = 6 GLOBAL CONST $WPF_ASYNCWINDOWPLACEMENT = 4 GLOBAL CONST $WPF_RESTORETOMAXIMIZED = 2 GLOBAL CONST $WPF_SETMINPOSITION = 1 GLOBAL CONST $KF_EXTENDED = 256 GLOBAL CONST $KF_ALTDOWN = 8192 GLOBAL CONST $KF_UP = 32768 GLOBAL CONST $LLKHF_EXTENDED = BITSHIFT ($KF_EXTENDED , 8 ) GLOBAL CONST $LLKHF_INJECTED = 16 GLOBAL CONST $LLKHF_ALTDOWN = BITSHIFT ($KF_ALTDOWN , 8 ) GLOBAL CONST $LLKHF_UP = BITSHIFT ($KF_UP , 8 ) GLOBAL CONST $OFN_ALLOWMULTISELECT = 512 GLOBAL CONST $OFN_CREATEPROMPT = 8192 GLOBAL CONST $OFN_DONTADDTORECENT = 33554432 GLOBAL CONST $OFN_ENABLEHOOK = 32 GLOBAL CONST $OFN_ENABLEINCLUDENOTIFY = 4194304 GLOBAL CONST $OFN_ENABLESIZING = 8388608 GLOBAL CONST $OFN_ENABLETEMPLATE = 64 GLOBAL CONST $OFN_ENABLETEMPLATEHANDLE = 128 GLOBAL CONST $OFN_EXPLORER = 524288 GLOBAL CONST $OFN_EXTENSIONDIFFERENT = 1024 GLOBAL CONST $OFN_FILEMUSTEXIST = 4096 GLOBAL CONST $OFN_FORCESHOWHIDDEN = 268435456 GLOBAL CONST $OFN_HIDEREADONLY = 4 GLOBAL CONST $OFN_LONGNAMES = 2097152 GLOBAL CONST $OFN_NOCHANGEDIR = 8 GLOBAL CONST $OFN_NODEREFERENCELINKS = 1048576 GLOBAL CONST $OFN_NOLONGNAMES = 262144 GLOBAL CONST $OFN_NONETWORKBUTTON = 131072 GLOBAL CONST $OFN_NOREADONLYRETURN = 32768 GLOBAL CONST $OFN_NOTESTFILECREATE = 65536 GLOBAL CONST $OFN_NOVALIDATE = 256 GLOBAL CONST $OFN_OVERWRITEPROMPT = 2 GLOBAL CONST $OFN_PATHMUSTEXIST = 2048 GLOBAL CONST $OFN_READONLY = 1 GLOBAL CONST $OFN_SHAREAWARE = 16384 GLOBAL CONST $OFN_SHOWHELP = 16 GLOBAL CONST $OFN_EX_NOPLACESBAR = 1 GLOBAL CONST $STD_CUT = 0 GLOBAL CONST $STD_COPY = 1 GLOBAL CONST $STD_PASTE = 2 GLOBAL CONST $STD_UNDO = 3 GLOBAL CONST $STD_REDOW = 4 GLOBAL CONST $STD_DELETE = 5 GLOBAL CONST $STD_FILENEW = 6 GLOBAL CONST $STD_FILEOPEN = 7 GLOBAL CONST $STD_FILESAVE = 8 GLOBAL CONST $STD_PRINTPRE = 9 GLOBAL CONST $STD_PROPERTIES = 10 GLOBAL CONST $STD_HELP = 11 GLOBAL CONST $STD_FIND = 12 GLOBAL CONST $STD_REPLACE = 13 GLOBAL CONST $STD_PRINT = 14 GLOBAL CONST $KB_SENDSPECIAL = 0 GLOBAL CONST $KB_SENDRAW = 1 GLOBAL CONST $KB_CAPSOFF = 0 GLOBAL CONST $KB_CAPSON = 1 GLOBAL CONST $S_OK = 0 GLOBAL CONST $E_ABORT = 2147500036 GLOBAL CONST $E_ACCESSDENIED = 2147942405 GLOBAL CONST $E_FAIL = 2147500037 GLOBAL CONST $E_HANDLE = 2147942406 GLOBAL CONST $E_INVALIDARG = 2147942487 GLOBAL CONST $E_NOINTERFACE = 2147500034 GLOBAL CONST $E_NOTIMPL = 2147500033 GLOBAL CONST $E_OUTOFMEMORY = 2147942414 GLOBAL CONST $E_POINTER = 2147500035 GLOBAL CONST $E_UNEXPECTED = 2147549183 GLOBAL CONST $BS_GROUPBOX = 7 GLOBAL CONST $BS_BOTTOM = 2048 GLOBAL CONST $BS_CENTER = 768 GLOBAL CONST $BS_DEFPUSHBUTTON = 1 GLOBAL CONST $BS_LEFT = 256 GLOBAL CONST $BS_MULTILINE = 8192 GLOBAL CONST $BS_PUSHBOX = 10 GLOBAL CONST $BS_PUSHLIKE = 4096 GLOBAL CONST $BS_RIGHT = 512 GLOBAL CONST $BS_RIGHTBUTTON = 32 GLOBAL CONST $BS_TOP = 1024 GLOBAL CONST $BS_VCENTER = 3072 GLOBAL CONST $BS_FLAT = 32768 GLOBAL CONST $BS_ICON = 64 GLOBAL CONST $BS_BITMAP = 128 GLOBAL CONST $BS_NOTIFY = 16384 GLOBAL CONST $BS_SPLITBUTTON = 12 GLOBAL CONST $BS_DEFSPLITBUTTON = 13 GLOBAL CONST $BS_COMMANDLINK = 14 GLOBAL CONST $BS_DEFCOMMANDLINK = 15 GLOBAL CONST $BCSIF_GLYPH = 1 GLOBAL CONST $BCSIF_IMAGE = 2 GLOBAL CONST $BCSIF_STYLE = 4 GLOBAL CONST $BCSIF_SIZE = 8 GLOBAL CONST $BCSS_NOSPLIT = 1 GLOBAL CONST $BCSS_STRETCH = 2 GLOBAL CONST $BCSS_ALIGNLEFT = 4 GLOBAL CONST $BCSS_IMAGE = 8 GLOBAL CONST $BUTTON_IMAGELIST_ALIGN_LEFT = 0 GLOBAL CONST $BUTTON_IMAGELIST_ALIGN_RIGHT = 1 GLOBAL CONST $BUTTON_IMAGELIST_ALIGN_TOP = 2 GLOBAL CONST $BUTTON_IMAGELIST_ALIGN_BOTTOM = 3 GLOBAL CONST $BUTTON_IMAGELIST_ALIGN_CENTER = 4 GLOBAL CONST $BS_3STATE = 5 GLOBAL CONST $BS_AUTO3STATE = 6 GLOBAL CONST $BS_AUTOCHECKBOX = 3 GLOBAL CONST $BS_CHECKBOX = 2 GLOBAL CONST $BS_RADIOBUTTON = 4 GLOBAL CONST $BS_AUTORADIOBUTTON = 9 GLOBAL CONST $BS_OWNERDRAW = 11 GLOBAL CONST $GUI_SS_DEFAULT_BUTTON = 0 GLOBAL CONST $GUI_SS_DEFAULT_CHECKBOX = 0 GLOBAL CONST $GUI_SS_DEFAULT_GROUP = 0 GLOBAL CONST $GUI_SS_DEFAULT_RADIO = 0 GLOBAL CONST $BCM_FIRST = 5632 GLOBAL CONST $BCM_GETIDEALSIZE = ($BCM_FIRST + 1 ) GLOBAL CONST $BCM_GETIMAGELIST = ($BCM_FIRST + 3 ) GLOBAL CONST $BCM_GETNOTE = ($BCM_FIRST + 10 ) GLOBAL CONST $BCM_GETNOTELENGTH = ($BCM_FIRST + 11 ) GLOBAL CONST $BCM_GETSPLITINFO = ($BCM_FIRST + 8 ) GLOBAL CONST $BCM_GETTEXTMARGIN = ($BCM_FIRST + 5 ) GLOBAL CONST $BCM_SETDROPDOWNSTATE = ($BCM_FIRST + 6 ) GLOBAL CONST $BCM_SETIMAGELIST = ($BCM_FIRST + 2 ) GLOBAL CONST $BCM_SETNOTE = ($BCM_FIRST + 9 ) GLOBAL CONST $BCM_SETSHIELD = ($BCM_FIRST + 12 ) GLOBAL CONST $BCM_SETSPLITINFO = ($BCM_FIRST + 7 ) GLOBAL CONST $BCM_SETTEXTMARGIN = ($BCM_FIRST + 4 ) GLOBAL CONST $BM_CLICK = 245 GLOBAL CONST $BM_GETCHECK = 240 GLOBAL CONST $BM_GETIMAGE = 246 GLOBAL CONST $BM_GETSTATE = 242 GLOBAL CONST $BM_SETCHECK = 241 GLOBAL CONST $BM_SETDONTCLICK = 248 GLOBAL CONST $BM_SETIMAGE = 247 GLOBAL CONST $BM_SETSTATE = 243 GLOBAL CONST $BM_SETSTYLE = 244 GLOBAL CONST $BCN_FIRST = + 4294966046 GLOBAL CONST $BCN_DROPDOWN = ($BCN_FIRST + 2 ) GLOBAL CONST $BCN_HOTITEMCHANGE = ($BCN_FIRST + 1 ) GLOBAL CONST $BN_CLICKED = 0 GLOBAL CONST $BN_PAINT = 1 GLOBAL CONST $BN_HILITE = 2 GLOBAL CONST $BN_UNHILITE = 3 GLOBAL CONST $BN_DISABLE = 4 GLOBAL CONST $BN_DOUBLECLICKED = 5 GLOBAL CONST $BN_SETFOCUS = 6 GLOBAL CONST $BN_KILLFOCUS = 7 GLOBAL CONST $BN_PUSHED = $BN_HILITE GLOBAL CONST $BN_UNPUSHED = $BN_UNHILITE GLOBAL CONST $BN_DBLCLK = $BN_DOUBLECLICKED GLOBAL CONST $BST_CHECKED = 1 GLOBAL CONST $BST_INDETERMINATE = 2 GLOBAL CONST $BST_UNCHECKED = 0 GLOBAL CONST $BST_FOCUS = 8 GLOBAL CONST $BST_PUSHED = 4 GLOBAL CONST $BST_DONTCLICK = 128 GLOBAL CONST $ES_LEFT = 0 GLOBAL CONST $ES_CENTER = 1 GLOBAL CONST $ES_RIGHT = 2 GLOBAL CONST $ES_MULTILINE = 4 GLOBAL CONST $ES_UPPERCASE = 8 GLOBAL CONST $ES_LOWERCASE = 16 GLOBAL CONST $ES_PASSWORD = 32 GLOBAL CONST $ES_AUTOVSCROLL = 64 GLOBAL CONST $ES_AUTOHSCROLL = 128 GLOBAL CONST $ES_NOHIDESEL = 256 GLOBAL CONST $ES_OEMCONVERT = 1024 GLOBAL CONST $ES_READONLY = 2048 GLOBAL CONST $ES_WANTRETURN = 4096 GLOBAL CONST $ES_NUMBER = 8192 GLOBAL CONST $EC_ERR = + 4294967295 GLOBAL CONST $ECM_FIRST = 5376 GLOBAL CONST $EM_CANUNDO = 198 GLOBAL CONST $EM_CHARFROMPOS = 215 GLOBAL CONST $EM_EMPTYUNDOBUFFER = 205 GLOBAL CONST $EM_FMTLINES = 200 GLOBAL CONST $EM_GETCUEBANNER = ($ECM_FIRST + 2 ) GLOBAL CONST $EM_GETFIRSTVISIBLELINE = 206 GLOBAL CONST $EM_GETHANDLE = 189 GLOBAL CONST $EM_GETIMESTATUS = 217 GLOBAL CONST $EM_GETLIMITTEXT = 213 GLOBAL CONST $EM_GETLINE = 196 GLOBAL CONST $EM_GETLINECOUNT = 186 GLOBAL CONST $EM_GETMARGINS = 212 GLOBAL CONST $EM_GETMODIFY = 184 GLOBAL CONST $EM_GETPASSWORDCHAR = 210 GLOBAL CONST $EM_GETRECT = 178 GLOBAL CONST $EM_GETSEL = 176 GLOBAL CONST $EM_GETTHUMB = 190 GLOBAL CONST $EM_GETWORDBREAKPROC = 209 GLOBAL CONST $EM_HIDEBALLOONTIP = ($ECM_FIRST + 4 ) GLOBAL CONST $EM_LIMITTEXT = 197 GLOBAL CONST $EM_LINEFROMCHAR = 201 GLOBAL CONST $EM_LINEINDEX = 187 GLOBAL CONST $EM_LINELENGTH = 193 GLOBAL CONST $EM_LINESCROLL = 182 GLOBAL CONST $EM_POSFROMCHAR = 214 GLOBAL CONST $EM_REPLACESEL = 194 GLOBAL CONST $EM_SCROLL = 181 GLOBAL CONST $EM_SCROLLCARET = 183 GLOBAL CONST $EM_SETCUEBANNER = ($ECM_FIRST + 1 ) GLOBAL CONST $EM_SETHANDLE = 188 GLOBAL CONST $EM_SETIMESTATUS = 216 GLOBAL CONST $EM_SETLIMITTEXT = $EM_LIMITTEXT GLOBAL CONST $EM_SETMARGINS = 211 GLOBAL CONST $EM_SETMODIFY = 185 GLOBAL CONST $EM_SETPASSWORDCHAR = 204 GLOBAL CONST $EM_SETREADONLY = 207 GLOBAL CONST $EM_SETRECT = 179 GLOBAL CONST $EM_SETRECTNP = 180 GLOBAL CONST $EM_SETSEL = 177 GLOBAL CONST $EM_SETTABSTOPS = 203 GLOBAL CONST $EM_SETWORDBREAKPROC = 208 GLOBAL CONST $EM_SHOWBALLOONTIP = ($ECM_FIRST + 3 ) GLOBAL CONST $EM_UNDO = 199 GLOBAL CONST $EC_LEFTMARGIN = 1 GLOBAL CONST $EC_RIGHTMARGIN = 2 GLOBAL CONST $EC_USEFONTINFO = 65535 GLOBAL CONST $EMSIS_COMPOSITIONSTRING = 1 GLOBAL CONST $EIMES_GETCOMPSTRATONCE = 1 GLOBAL CONST $EIMES_CANCELCOMPSTRINFOCUS = 2 GLOBAL CONST $EIMES_COMPLETECOMPSTRKILLFOCUS = 4 GLOBAL CONST $EN_ALIGN_LTR_EC = 1792 GLOBAL CONST $EN_ALIGN_RTL_EC = 1793 GLOBAL CONST $EN_CHANGE = 768 GLOBAL CONST $EN_ERRSPACE = 1280 GLOBAL CONST $EN_HSCROLL = 1537 GLOBAL CONST $EN_KILLFOCUS = 512 GLOBAL CONST $EN_MAXTEXT = 1281 GLOBAL CONST $EN_SETFOCUS = 256 GLOBAL CONST $EN_UPDATE = 1024 GLOBAL CONST $EN_VSCROLL = 1538 GLOBAL CONST $GUI_SS_DEFAULT_EDIT = 3150016 GLOBAL CONST $GUI_SS_DEFAULT_INPUT = 128 OPT ("TrayAutoPause" , 0 ) OPT ("TrayIconHide" , 1 ) GLOBAL CONST $GMEM_FIXED = 0 GLOBAL CONST $GMEM_MOVEABLE = 2 GLOBAL CONST $GMEM_NOCOMPACT = 16 GLOBAL CONST $GMEM_NODISCARD = 32 GLOBAL CONST $GMEM_ZEROINIT = 64 GLOBAL CONST $GMEM_MODIFY = 128 GLOBAL CONST $GMEM_DISCARDABLE = 256 GLOBAL CONST $GMEM_NOT_BANKED = 4096 GLOBAL CONST $GMEM_SHARE = 8192 GLOBAL CONST $GMEM_DDESHARE = 8192 GLOBAL CONST $GMEM_NOTIFY = 16384 GLOBAL CONST $GMEM_LOWER = 4096 GLOBAL CONST $GMEM_VALID_FLAGS = 32626 GLOBAL CONST $GMEM_INVALID_HANDLE = 32768 GLOBAL CONST $GPTR = BITOR ($GMEM_FIXED , $GMEM_ZEROINIT ) GLOBAL CONST $GHND = BITOR ($GMEM_MOVEABLE , $GMEM_ZEROINIT ) GLOBAL CONST $MEM_COMMIT = 4096 GLOBAL CONST $MEM_RESERVE = 8192 GLOBAL CONST $MEM_TOP_DOWN = 1048576 GLOBAL CONST $MEM_SHARED = 134217728 GLOBAL CONST $PAGE_NOACCESS = 1 GLOBAL CONST $PAGE_READONLY = 2 GLOBAL CONST $PAGE_READWRITE = 4 GLOBAL CONST $PAGE_EXECUTE = 16 GLOBAL CONST $PAGE_EXECUTE_READ = 32 GLOBAL CONST $PAGE_EXECUTE_READWRITE = 64 GLOBAL CONST $PAGE_EXECUTE_WRITECOPY = 128 GLOBAL CONST $PAGE_GUARD = 256 GLOBAL CONST $PAGE_NOCACHE = 512 GLOBAL CONST $PAGE_WRITECOMBINE = 1024 GLOBAL CONST $PAGE_WRITECOPY = 8 GLOBAL CONST $MEM_DECOMMIT = 16384 GLOBAL CONST $MEM_RELEASE = 32768 GLOBAL ENUM $MEM_LOAD , $MEM_TOTALPHYSRAM , $MEM_AVAILPHYSRAM , $MEM_TOTALPAGEFILE , $MEM_AVAILPAGEFILE , $MEM_TOTALVIRTUAL , $MEM_AVAILVIRTUAL GLOBAL CONST $PROCESS_TERMINATE = 1 GLOBAL CONST $PROCESS_CREATE_THREAD = 2 GLOBAL CONST $PROCESS_SET_SESSIONID = 4 GLOBAL CONST $PROCESS_VM_OPERATION = 8 GLOBAL CONST $PROCESS_VM_READ = 16 GLOBAL CONST $PROCESS_VM_WRITE = 32 GLOBAL CONST $PROCESS_DUP_HANDLE = 64 GLOBAL CONST $PROCESS_CREATE_PROCESS = 128 GLOBAL CONST $PROCESS_SET_QUOTA = 256 GLOBAL CONST $PROCESS_SET_INFORMATION = 512 GLOBAL CONST $PROCESS_QUERY_INFORMATION = 1024 GLOBAL CONST $PROCESS_QUERY_LIMITED_INFORMATION = 4096 GLOBAL CONST $PROCESS_SUSPEND_RESUME = 2048 GLOBAL CONST $PROCESS_ALL_ACCESS = 2035711 GLOBAL CONST $SE_ASSIGNPRIMARYTOKEN_NAME = "SeAssignPrimaryTokenPrivilege" GLOBAL CONST $SE_AUDIT_NAME = "SeAuditPrivilege" GLOBAL CONST $SE_BACKUP_NAME = "SeBackupPrivilege" GLOBAL CONST $SE_CHANGE_NOTIFY_NAME = "SeChangeNotifyPrivilege" GLOBAL CONST $SE_CREATE_GLOBAL_NAME = "SeCreateGlobalPrivilege" GLOBAL CONST $SE_CREATE_PAGEFILE_NAME = "SeCreatePagefilePrivilege" GLOBAL CONST $SE_CREATE_PERMANENT_NAME = "SeCreatePermanentPrivilege" GLOBAL CONST $SE_CREATE_SYMBOLIC_LINK_NAME = "SeCreateSymbolicLinkPrivilege" GLOBAL CONST $SE_CREATE_TOKEN_NAME = "SeCreateTokenPrivilege" GLOBAL CONST $SE_DEBUG_NAME = "SeDebugPrivilege" GLOBAL CONST $SE_ENABLE_DELEGATION_NAME = "SeEnableDelegationPrivilege" GLOBAL CONST $SE_IMPERSONATE_NAME = "SeImpersonatePrivilege" GLOBAL CONST $SE_INC_BASE_PRIORITY_NAME = "SeIncreaseBasePriorityPrivilege" GLOBAL CONST $SE_INC_WORKING_SET_NAME = "SeIncreaseWorkingSetPrivilege" GLOBAL CONST $SE_INCREASE_QUOTA_NAME = "SeIncreaseQuotaPrivilege" GLOBAL CONST $SE_LOAD_DRIVER_NAME = "SeLoadDriverPrivilege" GLOBAL CONST $SE_LOCK_MEMORY_NAME = "SeLockMemoryPrivilege" GLOBAL CONST $SE_MACHINE_ACCOUNT_NAME = "SeMachineAccountPrivilege" GLOBAL CONST $SE_MANAGE_VOLUME_NAME = "SeManageVolumePrivilege" GLOBAL CONST $SE_PROF_SINGLE_PROCESS_NAME = "SeProfileSingleProcessPrivilege" GLOBAL CONST $SE_RELABEL_NAME = "SeRelabelPrivilege" GLOBAL CONST $SE_REMOTE_SHUTDOWN_NAME = "SeRemoteShutdownPrivilege" GLOBAL CONST $SE_RESTORE_NAME = "SeRestorePrivilege" GLOBAL CONST $SE_SECURITY_NAME = "SeSecurityPrivilege" GLOBAL CONST $SE_SHUTDOWN_NAME = "SeShutdownPrivilege" GLOBAL CONST $SE_SYNC_AGENT_NAME = "SeSyncAgentPrivilege" GLOBAL CONST $SE_SYSTEM_ENVIRONMENT_NAME = "SeSystemEnvironmentPrivilege" GLOBAL CONST $SE_SYSTEM_PROFILE_NAME = "SeSystemProfilePrivilege" GLOBAL CONST $SE_SYSTEMTIME_NAME = "SeSystemtimePrivilege" GLOBAL CONST $SE_TAKE_OWNERSHIP_NAME = "SeTakeOwnershipPrivilege" GLOBAL CONST $SE_TCB_NAME = "SeTcbPrivilege" GLOBAL CONST $SE_TIME_ZONE_NAME = "SeTimeZonePrivilege" GLOBAL CONST $SE_TRUSTED_CREDMAN_ACCESS_NAME = "SeTrustedCredManAccessPrivilege" GLOBAL CONST $SE_UNSOLICITED_INPUT_NAME = "SeUnsolicitedInputPrivilege" GLOBAL CONST $SE_UNDOCK_NAME = "SeUndockPrivilege" GLOBAL CONST $SE_PRIVILEGE_ENABLED_BY_DEFAULT = 1 GLOBAL CONST $SE_PRIVILEGE_ENABLED = 2 GLOBAL CONST $SE_PRIVILEGE_REMOVED = 4 GLOBAL CONST $SE_PRIVILEGE_USED_FOR_ACCESS = 2147483648 GLOBAL CONST $SE_GROUP_MANDATORY = 1 GLOBAL CONST $SE_GROUP_ENABLED_BY_DEFAULT = 2 GLOBAL CONST $SE_GROUP_ENABLED = 4 GLOBAL CONST $SE_GROUP_OWNER = 8 GLOBAL CONST $SE_GROUP_USE_FOR_DENY_ONLY = 16 GLOBAL CONST $SE_GROUP_INTEGRITY = 32 GLOBAL CONST $SE_GROUP_INTEGRITY_ENABLED = 64 GLOBAL CONST $SE_GROUP_RESOURCE = 536870912 GLOBAL CONST $SE_GROUP_LOGON_ID = 3221225472 GLOBAL ENUM $TOKENPRIMARY = 1 , $TOKENIMPERSONATION GLOBAL ENUM $SECURITYANONYMOUS = 0 , $SECURITYIDENTIFICATION , $SECURITYIMPERSONATION , $SECURITYDELEGATION GLOBAL ENUM $TOKENUSER = 1 , $TOKENGROUPS , $TOKENPRIVILEGES , $TOKENOWNER , $TOKENPRIMARYGROUP , $TOKENDEFAULTDACL , $TOKENSOURCE , $TOKENTYPE , $TOKENIMPERSONATIONLEVEL , $TOKENSTATISTICS , $TOKENRESTRICTEDSIDS , $TOKENSESSIONID , $TOKENGROUPSANDPRIVILEGES , $TOKENSESSIONREFERENCE , $TOKENSANDBOXINERT , $TOKENAUDITPOLICY , $TOKENORIGIN , $TOKENELEVATIONTYPE , $TOKENLINKEDTOKEN , $TOKENELEVATION , $TOKENHASRESTRICTIONS , $TOKENACCESSINFORMATION , $TOKENVIRTUALIZATIONALLOWED , $TOKENVIRTUALIZATIONENABLED , $TOKENINTEGRITYLEVEL , $TOKENUIACCESS , $TOKENMANDATORYPOLICY , $TOKENLOGONSID GLOBAL CONST $TOKEN_ASSIGN_PRIMARY = 1 GLOBAL CONST $TOKEN_DUPLICATE = 2 GLOBAL CONST $TOKEN_IMPERSONATE = 4 GLOBAL CONST $TOKEN_QUERY = 8 GLOBAL CONST $TOKEN_QUERY_SOURCE = 16 GLOBAL CONST $TOKEN_ADJUST_PRIVILEGES = 32 GLOBAL CONST $TOKEN_ADJUST_GROUPS = 64 GLOBAL CONST $TOKEN_ADJUST_DEFAULT = 128 GLOBAL CONST $TOKEN_ADJUST_SESSIONID = 256 GLOBAL CONST $TOKEN_ALL_ACCESS = 983551 GLOBAL CONST $TOKEN_READ = 131080 GLOBAL CONST $TOKEN_WRITE = 131296 GLOBAL CONST $TOKEN_EXECUTE = 131072 GLOBAL CONST $TOKEN_HAS_TRAVERSE_PRIVILEGE = 1 GLOBAL CONST $TOKEN_HAS_BACKUP_PRIVILEGE = 2 GLOBAL CONST $TOKEN_HAS_RESTORE_PRIVILEGE = 4 GLOBAL CONST $TOKEN_HAS_ADMIN_GROUP = 8 GLOBAL CONST $TOKEN_IS_RESTRICTED = 16 GLOBAL CONST $TOKEN_SESSION_NOT_REFERENCED = 32 GLOBAL CONST $TOKEN_SANDBOX_INERT = 64 GLOBAL CONST $TOKEN_HAS_IMPERSONATE_PRIVILEGE = 128 GLOBAL CONST $RIGHTS_DELETE = 65536 GLOBAL CONST $READ_CONTROL = 131072 GLOBAL CONST $WRITE_DAC = 262144 GLOBAL CONST $WRITE_OWNER = 524288 GLOBAL CONST $SYNCHRONIZE = 1048576 GLOBAL CONST $ACCESS_SYSTEM_SECURITY = 16777216 GLOBAL CONST $STANDARD_RIGHTS_REQUIRED = 983040 GLOBAL CONST $STANDARD_RIGHTS_READ = $READ_CONTROL GLOBAL CONST $STANDARD_RIGHTS_WRITE = $READ_CONTROL GLOBAL CONST $STANDARD_RIGHTS_EXECUTE = $READ_CONTROL GLOBAL CONST $STANDARD_RIGHTS_ALL = 2031616 GLOBAL CONST $SPECIFIC_RIGHTS_ALL = 65535 GLOBAL ENUM $NOT_USED_ACCESS = 0 , $GRANT_ACCESS , $SET_ACCESS , $DENY_ACCESS , $REVOKE_ACCESS , $SET_AUDIT_SUCCESS , $SET_AUDIT_FAILURE GLOBAL ENUM $TRUSTEE_IS_UNKNOWN = 0 , $TRUSTEE_IS_USER , $TRUSTEE_IS_GROUP , $TRUSTEE_IS_DOMAIN , $TRUSTEE_IS_ALIAS , $TRUSTEE_IS_WELL_KNOWN_GROUP , $TRUSTEE_IS_DELETED , $TRUSTEE_IS_INVALID , $TRUSTEE_IS_COMPUTER GLOBAL CONST $LOGON_WITH_PROFILE = 1 GLOBAL CONST $LOGON_NETCREDENTIALS_ONLY = 2 GLOBAL ENUM $SIDTYPEUSER = 1 , $SIDTYPEGROUP , $SIDTYPEDOMAIN , $SIDTYPEALIAS , $SIDTYPEWELLKNOWNGROUP , $SIDTYPEDELETEDACCOUNT , $SIDTYPEINVALID , $SIDTYPEUNKNOWN , $SIDTYPECOMPUTER , $SIDTYPELABEL GLOBAL CONST $SID_ADMINISTRATORS = "S-1-5-32-544" GLOBAL CONST $SID_USERS = "S-1-5-32-545" GLOBAL CONST $SID_GUESTS = "S-1-5-32-546" GLOBAL CONST $SID_ACCOUNT_OPERATORS = "S-1-5-32-548" GLOBAL CONST $SID_SERVER_OPERATORS = "S-1-5-32-549" GLOBAL CONST $SID_PRINT_OPERATORS = "S-1-5-32-550" GLOBAL CONST $SID_BACKUP_OPERATORS = "S-1-5-32-551" GLOBAL CONST $SID_REPLICATOR = "S-1-5-32-552" GLOBAL CONST $SID_OWNER = "S-1-3-0" GLOBAL CONST $SID_EVERYONE = "S-1-1-0" GLOBAL CONST $SID_NETWORK = "S-1-5-2" GLOBAL CONST $SID_INTERACTIVE = "S-1-5-4" GLOBAL CONST $SID_SYSTEM = "S-1-5-18" GLOBAL CONST $SID_AUTHENTICATED_USERS = "S-1-5-11" GLOBAL CONST $SID_SCHANNEL_AUTHENTICATION = "S-1-5-64-14" GLOBAL CONST $SID_DIGEST_AUTHENTICATION = "S-1-5-64-21" GLOBAL CONST $SID_NT_SERVICE = "S-1-5-80" GLOBAL CONST $SID_UNTRUSTED_MANDATORY_LEVEL = "S-1-16-0" GLOBAL CONST $SID_LOW_MANDATORY_LEVEL = "S-1-16-4096" GLOBAL CONST $SID_MEDIUM_MANDATORY_LEVEL = "S-1-16-8192" GLOBAL CONST $SID_MEDIUM_PLUS_MANDATORY_LEVEL = "S-1-16-8448" GLOBAL CONST $SID_HIGH_MANDATORY_LEVEL = "S-1-16-12288" GLOBAL CONST $SID_SYSTEM_MANDATORY_LEVEL = "S-1-16-16384" GLOBAL CONST $SID_PROTECTED_PROCESS_MANDATORY_LEVEL = "S-1-16-20480" GLOBAL CONST $SID_SECURE_PROCESS_MANDATORY_LEVEL = "S-1-16-28672" GLOBAL CONST $SID_ALL_SERVICES = "S-1-5-80-0" GLOBAL CONST $MB_OK = 0 GLOBAL CONST $MB_OKCANCEL = 1 GLOBAL CONST $MB_ABORTRETRYIGNORE = 2 GLOBAL CONST $MB_YESNOCANCEL = 3 GLOBAL CONST $MB_YESNO = 4 GLOBAL CONST $MB_RETRYCANCEL = 5 GLOBAL CONST $MB_CANCELTRYCONTINUE = 6 GLOBAL CONST $MB_HELP = 16384 GLOBAL CONST $MB_ICONSTOP = 16 GLOBAL CONST $MB_ICONERROR = 16 GLOBAL CONST $MB_ICONHAND = 16 GLOBAL CONST $MB_ICONQUESTION = 32 GLOBAL CONST $MB_ICONEXCLAMATION = 48 GLOBAL CONST $MB_ICONWARNING = 48 GLOBAL CONST $MB_ICONINFORMATION = 64 GLOBAL CONST $MB_ICONASTERISK = 64 GLOBAL CONST $MB_USERICON = 128 GLOBAL CONST $MB_DEFBUTTON1 = 0 GLOBAL CONST $MB_DEFBUTTON2 = 256 GLOBAL CONST $MB_DEFBUTTON3 = 512 GLOBAL CONST $MB_DEFBUTTON4 = 768 GLOBAL CONST $MB_APPLMODAL = 0 GLOBAL CONST $MB_SYSTEMMODAL = 4096 GLOBAL CONST $MB_TASKMODAL = 8192 GLOBAL CONST $MB_DEFAULT_DESKTOP_ONLY = 131072 GLOBAL CONST $MB_RIGHT = 524288 GLOBAL CONST $MB_RTLREADING = 1048576 GLOBAL CONST $MB_SETFOREGROUND = 65536 GLOBAL CONST $MB_TOPMOST = 262144 GLOBAL CONST $MB_SERVICE_NOTIFICATION = 2097152 GLOBAL CONST $MB_RIGHTJUSTIFIED = $MB_RIGHT GLOBAL CONST $IDTIMEOUT = + 4294967295 GLOBAL CONST $IDOK = 1 GLOBAL CONST $IDCANCEL = 2 GLOBAL CONST $IDABORT = 3 GLOBAL CONST $IDRETRY = 4 GLOBAL CONST $IDIGNORE = 5 GLOBAL CONST $IDYES = 6 GLOBAL CONST $IDNO = 7 GLOBAL CONST $IDCLOSE = 8 GLOBAL CONST $IDHELP = 9 GLOBAL CONST $IDTRYAGAIN = 10 GLOBAL CONST $IDCONTINUE = 11 GLOBAL CONST $STR_NOCASESENSE = 0 GLOBAL CONST $STR_CASESENSE = 1 GLOBAL CONST $STR_NOCASESENSEBASIC = 2 GLOBAL CONST $STR_STRIPLEADING = 1 GLOBAL CONST $STR_STRIPTRAILING = 2 GLOBAL CONST $STR_STRIPSPACES = 4 GLOBAL CONST $STR_STRIPALL = 8 GLOBAL CONST $STR_CHRSPLIT = 0 GLOBAL CONST $STR_ENTIRESPLIT = 1 GLOBAL CONST $STR_NOCOUNT = 2 GLOBAL CONST $STR_REGEXPMATCH = 0 GLOBAL CONST $STR_REGEXPARRAYMATCH = 1 GLOBAL CONST $STR_REGEXPARRAYFULLMATCH = 2 GLOBAL CONST $STR_REGEXPARRAYGLOBALMATCH = 3 GLOBAL CONST $STR_REGEXPARRAYGLOBALFULLMATCH = 4 GLOBAL CONST $STR_ENDISSTART = 0 GLOBAL CONST $STR_ENDNOTSTART = 1 GLOBAL CONST $SB_ANSI = 1 GLOBAL CONST $SB_UTF16LE = 2 GLOBAL CONST $SB_UTF16BE = 3 GLOBAL CONST $SB_UTF8 = 4 GLOBAL CONST $SE_UTF16 = 0 GLOBAL CONST $SE_ANSI = 1 GLOBAL CONST $SE_UTF8 = 2 GLOBAL CONST $STR_UTF16 = 0 GLOBAL CONST $STR_UCS2 = 1 #Region Global Variables and Constants GLOBAL CONST $FORMAT_MESSAGE_ALLOCATE_BUFFER = 256 GLOBAL CONST $FORMAT_MESSAGE_IGNORE_INSERTS = 512 GLOBAL CONST $FORMAT_MESSAGE_FROM_STRING = 1024 GLOBAL CONST $FORMAT_MESSAGE_FROM_HMODULE = 2048 GLOBAL CONST $FORMAT_MESSAGE_FROM_SYSTEM = 4096 GLOBAL CONST $FORMAT_MESSAGE_ARGUMENT_ARRAY = 8192 #EndRegion Global Variables and Constants FUNC _WINAPI_BEEP ($IFREQ = 500 , $IDURATION = 1000 ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "bool" , "Beep" , "dword" , $IFREQ , "dword" , $IDURATION ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_FORMATMESSAGE ($IFLAGS , $PSOURCE , $IMESSAGEID , $ILANGUAGEID , BYREF $PBUFFER , $ISIZE , $VARGUMENTS ) LOCAL $SBUFFERTYPE = "struct*" IF ISSTRING ($PBUFFER ) THEN $SBUFFERTYPE = "wstr" LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "dword" , "FormatMessageW" , "dword" , $IFLAGS , "struct*" , $PSOURCE , "dword" , $IMESSAGEID , "dword" , $ILANGUAGEID , $SBUFFERTYPE , $PBUFFER , "dword" , $ISIZE , "ptr" , $VARGUMENTS ) IF @ERROR OR NOT $ARESULT [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) IF $SBUFFERTYPE = "wstr" THEN $PBUFFER = $ARESULT [5 ] RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETERRORMESSAGE ($ICODE , $ILANGUAGE = 0 , CONST $_ICURRENTERROR = @ERROR , CONST $_ICURRENTEXTENDED = @EXTENDED ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "dword" , "FormatMessageW" , "dword" , 4096 , "ptr" , 0 , "dword" , $ICODE , "dword" , $ILANGUAGE , "wstr" , "" , "dword" , 4096 , "ptr" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN SETERROR ($_ICURRENTERROR , $_ICURRENTEXTENDED , STRINGREGEXPREPLACE ($ARET [5 ] , "[" & @LF & "," & @CR & "]*\Z" , "" ) ) ENDFUNC FUNC _WINAPI_GETLASTERROR (CONST $_ICURRENTERROR = @ERROR , CONST $_ICURRENTEXTENDED = @EXTENDED ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "dword" , "GetLastError" ) RETURN SETERROR ($_ICURRENTERROR , $_ICURRENTEXTENDED , $ARESULT [0 ] ) ENDFUNC FUNC _WINAPI_GETLASTERRORMESSAGE (CONST $_ICURRENTERROR = @ERROR , CONST $_ICURRENTEXTENDED = @EXTENDED ) LOCAL $ILASTERROR = _WINAPI_GETLASTERROR () LOCAL $TBUFFERPTR = DLLSTRUCTCREATE ("ptr" ) LOCAL $NCOUNT = _WINAPI_FORMATMESSAGE (BITOR ($FORMAT_MESSAGE_ALLOCATE_BUFFER , $FORMAT_MESSAGE_FROM_SYSTEM ) , 0 , $ILASTERROR , 0 , $TBUFFERPTR , 0 , 0 ) IF @ERROR THEN RETURN SETERROR (- @ERROR , @EXTENDED , "" ) LOCAL $STEXT = "" LOCAL $PBUFFER = DLLSTRUCTGETDATA ($TBUFFERPTR , 1 ) IF $PBUFFER THEN IF $NCOUNT > 0 THEN LOCAL $TBUFFER = DLLSTRUCTCREATE ("wchar[" & ($NCOUNT + 1 ) & "]" , $PBUFFER ) $STEXT = DLLSTRUCTGETDATA ($TBUFFER , 1 ) IF STRINGRIGHT ($STEXT , 2 ) = @CRLF THEN $STEXT = STRINGTRIMRIGHT ($STEXT , 2 ) ENDIF DLLCALL ("kernel32.dll" , "handle" , "LocalFree" , "handle" , $PBUFFER ) ENDIF RETURN SETERROR ($_ICURRENTERROR , $_ICURRENTEXTENDED , $STEXT ) ENDFUNC FUNC _WINAPI_MESSAGEBEEP ($ITYPE = 1 ) LOCAL $ISOUND SWITCH $ITYPE CASE 1 $ISOUND = 0 CASE 2 $ISOUND = 16 CASE 3 $ISOUND = 32 CASE 4 $ISOUND = 48 CASE 5 $ISOUND = 64 CASE ELSE $ISOUND = + 4294967295 ENDSWITCH LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "MessageBeep" , "uint" , $ISOUND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_MSGBOX ($IFLAGS , $STITLE , $STEXT ) BLOCKINPUT (0 ) MSGBOX ($IFLAGS , $STITLE , $STEXT & " " ) ENDFUNC FUNC _WINAPI_SETLASTERROR ($IERRORCODE , CONST $_ICURRENTERROR = @ERROR , CONST $_ICURRENTEXTENDED = @EXTENDED ) DLLCALL ("kernel32.dll" , "none" , "SetLastError" , "dword" , $IERRORCODE ) RETURN SETERROR ($_ICURRENTERROR , $_ICURRENTEXTENDED , NULL ) ENDFUNC FUNC _WINAPI_SHOWERROR ($STEXT , $BEXIT = TRUE ) BLOCKINPUT (0 ) MSGBOX ($MB_SYSTEMMODAL , "Error" , $STEXT & " " ) IF $BEXIT THEN EXIT ENDFUNC FUNC _WINAPI_SHOWLASTERROR ($STEXT = "" , $BABORT = FALSE , $ILANGUAGE = 0 , CONST $_ICURRENTERROR = @ERROR , CONST $_ICURRENTEXTENDED = @EXTENDED ) LOCAL $SERROR LOCAL $ILASTERROR = _WINAPI_GETLASTERROR () WHILE 1 $SERROR = _WINAPI_GETERRORMESSAGE ($ILASTERROR , $ILANGUAGE ) IF @ERROR AND $ILANGUAGE THEN $ILANGUAGE = 0 ELSE EXITLOOP ENDIF WEND IF STRINGSTRIPWS ($STEXT , $STR_STRIPLEADING + $STR_STRIPTRAILING ) THEN $STEXT &= @CRLF & @CRLF ELSE $STEXT = "" ENDIF _WINAPI_MSGBOX (BITOR (262144 , BITSHIFT (16 , + 4294967294 * (NOT $ILASTERROR ) ) ) , $ILASTERROR , $STEXT & $SERROR ) IF $ILASTERROR THEN _WINAPI_SETLASTERROR ($ILASTERROR ) IF $BABORT THEN EXIT $ILASTERROR ENDIF ENDIF RETURN SETERROR ($_ICURRENTERROR , $_ICURRENTEXTENDED , 1 ) ENDFUNC FUNC _WINAPI_SHOWMSG ($STEXT ) _WINAPI_MSGBOX ($MB_SYSTEMMODAL , "Information" , $STEXT ) ENDFUNC FUNC __COMERRORFORMATING (BYREF $OCOMERROR , $SPREFIX = @TAB ) LOCAL CONST $STR_STRIPTRAILING = 2 LOCAL $SERROR = "COM Error encountered in " & @SCRIPTNAME & " (" & $OCOMERROR.Scriptline & ") :" & @CRLF & $SPREFIX & "Number " & @TAB & "= 0x" & HEX ($OCOMERROR.Number , 8 ) & " (" & $OCOMERROR.Number & ")" & @CRLF & $SPREFIX & "WinDescription" & @TAB & "= " & STRINGSTRIPWS ($OCOMERROR.WinDescription , $STR_STRIPTRAILING ) & @CRLF & $SPREFIX & "Description " & @TAB & "= " & STRINGSTRIPWS ($OCOMERROR.Description , $STR_STRIPTRAILING ) & @CRLF & $SPREFIX & "Source " & @TAB & "= " & $OCOMERROR.Source & @CRLF & $SPREFIX & "HelpFile " & @TAB & "= " & $OCOMERROR.HelpFile & @CRLF & $SPREFIX & "HelpContext " & @TAB & "= " & $OCOMERROR.HelpContext & @CRLF & $SPREFIX & "LastDllError " & @TAB & "= " & $OCOMERROR.LastDllError & @CRLF & $SPREFIX & "Retcode " & @TAB & "= 0x" & HEX ($OCOMERROR.retcode ) RETURN $SERROR ENDFUNC FUNC _SECURITY__ADJUSTTOKENPRIVILEGES ($HTOKEN , $BDISABLEALL , $TNEWSTATE , $IBUFFERLEN , $TPREVSTATE = 0 , $PREQUIRED = 0 ) LOCAL $ACALL = DLLCALL ("advapi32.dll" , "bool" , "AdjustTokenPrivileges" , "handle" , $HTOKEN , "bool" , $BDISABLEALL , "struct*" , $TNEWSTATE , "dword" , $IBUFFERLEN , "struct*" , $TPREVSTATE , "struct*" , $PREQUIRED ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN NOT ($ACALL [0 ] = 0 ) ENDFUNC FUNC _SECURITY__CREATEPROCESSWITHTOKEN ($HTOKEN , $ILOGONFLAGS , $SCOMMANDLINE , $ICREATIONFLAGS , $SCURDIR , $TSTARTUPINFO , $TPROCESS_INFORMATION ) LOCAL $ACALL = DLLCALL ("advapi32.dll" , "bool" , "CreateProcessWithTokenW" , "handle" , $HTOKEN , "dword" , $ILOGONFLAGS , "ptr" , 0 , "wstr" , $SCOMMANDLINE , "dword" , $ICREATIONFLAGS , "struct*" , 0 , "wstr" , $SCURDIR , "struct*" , $TSTARTUPINFO , "struct*" , $TPROCESS_INFORMATION ) IF @ERROR OR NOT $ACALL [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN TRUE ENDFUNC FUNC _SECURITY__DUPLICATETOKENEX ($HEXISTINGTOKEN , $IDESIREDACCESS , $IIMPERSONATIONLEVEL , $ITOKENTYPE ) LOCAL $ACALL = DLLCALL ("advapi32.dll" , "bool" , "DuplicateTokenEx" , "handle" , $HEXISTINGTOKEN , "dword" , $IDESIREDACCESS , "struct*" , 0 , "int" , $IIMPERSONATIONLEVEL , "int" , $ITOKENTYPE , "handle*" , 0 ) IF @ERROR OR NOT $ACALL [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ACALL [6 ] ENDFUNC FUNC _SECURITY__GETACCOUNTSID ($SACCOUNT , $SSYSTEM = "" ) LOCAL $AACCT = _SECURITY__LOOKUPACCOUNTNAME ($SACCOUNT , $SSYSTEM ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF ISARRAY ($AACCT ) THEN RETURN _SECURITY__STRINGSIDTOSID ($AACCT [0 ] ) RETURN "" ENDFUNC FUNC _SECURITY__GETLENGTHSID ($PSID ) IF NOT _SECURITY__ISVALIDSID ($PSID ) THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $ACALL = DLLCALL ("advapi32.dll" , "dword" , "GetLengthSid" , "struct*" , $PSID ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ACALL [0 ] ENDFUNC FUNC _SECURITY__GETTOKENINFORMATION ($HTOKEN , $ICLASS ) LOCAL $ACALL = DLLCALL ("advapi32.dll" , "bool" , "GetTokenInformation" , "handle" , $HTOKEN , "int" , $ICLASS , "struct*" , 0 , "dword" , 0 , "dword*" , 0 ) IF @ERROR OR NOT $ACALL [5 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $ILEN = $ACALL [5 ] LOCAL $TBUFFER = DLLSTRUCTCREATE ("byte[" & $ILEN & "]" ) $ACALL = DLLCALL ("advapi32.dll" , "bool" , "GetTokenInformation" , "handle" , $HTOKEN , "int" , $ICLASS , "struct*" , $TBUFFER , "dword" , DLLSTRUCTGETSIZE ($TBUFFER ) , "dword*" , 0 ) IF @ERROR OR NOT $ACALL [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $TBUFFER ENDFUNC FUNC _SECURITY__IMPERSONATESELF ($ILEVEL = $SECURITYIMPERSONATION ) LOCAL $ACALL = DLLCALL ("advapi32.dll" , "bool" , "ImpersonateSelf" , "int" , $ILEVEL ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN NOT ($ACALL [0 ] = 0 ) ENDFUNC FUNC _SECURITY__ISVALIDSID ($PSID ) LOCAL $ACALL = DLLCALL ("advapi32.dll" , "bool" , "IsValidSid" , "struct*" , $PSID ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN NOT ($ACALL [0 ] = 0 ) ENDFUNC FUNC _SECURITY__LOOKUPACCOUNTNAME ($SACCOUNT , $SSYSTEM = "" ) LOCAL $TDATA = DLLSTRUCTCREATE ("byte SID[256]" ) LOCAL $ACALL = DLLCALL ("advapi32.dll" , "bool" , "LookupAccountNameW" , "wstr" , $SSYSTEM , "wstr" , $SACCOUNT , "struct*" , $TDATA , "dword*" , DLLSTRUCTGETSIZE ($TDATA ) , "wstr" , "" , "dword*" , DLLSTRUCTGETSIZE ($TDATA ) , "int*" , 0 ) IF @ERROR OR NOT $ACALL [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) LOCAL $AACCT [3 ] $AACCT [0 ] = _SECURITY__SIDTOSTRINGSID (DLLSTRUCTGETPTR ($TDATA , "SID" ) ) $AACCT [1 ] = $ACALL [5 ] $AACCT [2 ] = $ACALL [7 ] RETURN $AACCT ENDFUNC FUNC _SECURITY__LOOKUPACCOUNTSID ($VSID , $SSYSTEM = "" ) LOCAL $PSID , $AACCT [3 ] IF ISSTRING ($VSID ) THEN $PSID = _SECURITY__STRINGSIDTOSID ($VSID ) ELSE $PSID = $VSID ENDIF IF NOT _SECURITY__ISVALIDSID ($PSID ) THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $STYPESYSTEM = "ptr" IF $SSYSTEM THEN $STYPESYSTEM = "wstr" LOCAL $ACALL = DLLCALL ("advapi32.dll" , "bool" , "LookupAccountSidW" , $STYPESYSTEM , $SSYSTEM , "struct*" , $PSID , "wstr" , "" , "dword*" , 65536 , "wstr" , "" , "dword*" , 65536 , "int*" , 0 ) IF @ERROR OR NOT $ACALL [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) LOCAL $AACCT [3 ] $AACCT [0 ] = $ACALL [3 ] $AACCT [1 ] = $ACALL [5 ] $AACCT [2 ] = $ACALL [7 ] RETURN $AACCT ENDFUNC FUNC _SECURITY__LOOKUPPRIVILEGEVALUE ($SSYSTEM , $SNAME ) LOCAL $ACALL = DLLCALL ("advapi32.dll" , "bool" , "LookupPrivilegeValueW" , "wstr" , $SSYSTEM , "wstr" , $SNAME , "int64*" , 0 ) IF @ERROR OR NOT $ACALL [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ACALL [3 ] ENDFUNC FUNC _SECURITY__OPENPROCESSTOKEN ($HPROCESS , $IACCESS ) LOCAL $ACALL = DLLCALL ("advapi32.dll" , "bool" , "OpenProcessToken" , "handle" , $HPROCESS , "dword" , $IACCESS , "handle*" , 0 ) IF @ERROR OR NOT $ACALL [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ACALL [3 ] ENDFUNC FUNC _SECURITY__OPENTHREADTOKEN ($IACCESS , $HTHREAD = 0 , $BOPENASSELF = FALSE ) IF $HTHREAD = 0 THEN LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "handle" , "GetCurrentThread" ) IF @ERROR THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) $HTHREAD = $ARESULT [0 ] ENDIF LOCAL $ACALL = DLLCALL ("advapi32.dll" , "bool" , "OpenThreadToken" , "handle" , $HTHREAD , "dword" , $IACCESS , "bool" , $BOPENASSELF , "handle*" , 0 ) IF @ERROR OR NOT $ACALL [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ACALL [4 ] ENDFUNC FUNC _SECURITY__OPENTHREADTOKENEX ($IACCESS , $HTHREAD = 0 , $BOPENASSELF = FALSE ) LOCAL $HTOKEN = _SECURITY__OPENTHREADTOKEN ($IACCESS , $HTHREAD , $BOPENASSELF ) IF $HTOKEN = 0 THEN LOCAL CONST $ERROR_NO_TOKEN = 1008 IF _WINAPI_GETLASTERROR () <> $ERROR_NO_TOKEN THEN RETURN SETERROR (20 , _WINAPI_GETLASTERROR () , 0 ) IF NOT _SECURITY__IMPERSONATESELF () THEN RETURN SETERROR (@ERROR + 10 , _WINAPI_GETLASTERROR () , 0 ) $HTOKEN = _SECURITY__OPENTHREADTOKEN ($IACCESS , $HTHREAD , $BOPENASSELF ) IF $HTOKEN = 0 THEN RETURN SETERROR (@ERROR , _WINAPI_GETLASTERROR () , 0 ) ENDIF RETURN $HTOKEN ENDFUNC FUNC _SECURITY__SETPRIVILEGE ($HTOKEN , $SPRIVILEGE , $BENABLE ) LOCAL $ILUID = _SECURITY__LOOKUPPRIVILEGEVALUE ("" , $SPRIVILEGE ) IF $ILUID = 0 THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , FALSE ) LOCAL CONST $TAGTOKEN_PRIVILEGES = "dword Count;align 4;int64 LUID;dword Attributes" LOCAL $TCURRSTATE = DLLSTRUCTCREATE ($TAGTOKEN_PRIVILEGES ) LOCAL $ICURRSTATE = DLLSTRUCTGETSIZE ($TCURRSTATE ) LOCAL $TPREVSTATE = DLLSTRUCTCREATE ($TAGTOKEN_PRIVILEGES ) LOCAL $IPREVSTATE = DLLSTRUCTGETSIZE ($TPREVSTATE ) LOCAL $TREQUIRED = DLLSTRUCTCREATE ("int Data" ) DLLSTRUCTSETDATA ($TCURRSTATE , "Count" , 1 ) DLLSTRUCTSETDATA ($TCURRSTATE , "LUID" , $ILUID ) IF NOT _SECURITY__ADJUSTTOKENPRIVILEGES ($HTOKEN , FALSE , $TCURRSTATE , $ICURRSTATE , $TPREVSTATE , $TREQUIRED ) THEN RETURN SETERROR (2 , @ERROR , FALSE ) DLLSTRUCTSETDATA ($TPREVSTATE , "Count" , 1 ) DLLSTRUCTSETDATA ($TPREVSTATE , "LUID" , $ILUID ) LOCAL $IATTRIBUTES = DLLSTRUCTGETDATA ($TPREVSTATE , "Attributes" ) IF $BENABLE THEN $IATTRIBUTES = BITOR ($IATTRIBUTES , $SE_PRIVILEGE_ENABLED ) ELSE $IATTRIBUTES = BITAND ($IATTRIBUTES , BITNOT ($SE_PRIVILEGE_ENABLED ) ) ENDIF DLLSTRUCTSETDATA ($TPREVSTATE , "Attributes" , $IATTRIBUTES ) IF NOT _SECURITY__ADJUSTTOKENPRIVILEGES ($HTOKEN , FALSE , $TPREVSTATE , $IPREVSTATE , $TCURRSTATE , $TREQUIRED ) THEN RETURN SETERROR (3 , @ERROR , FALSE ) RETURN TRUE ENDFUNC FUNC _SECURITY__SETTOKENINFORMATION ($HTOKEN , $ITOKENINFORMATION , $VTOKENINFORMATION , $ITOKENINFORMATIONLENGTH ) LOCAL $ACALL = DLLCALL ("advapi32.dll" , "bool" , "SetTokenInformation" , "handle" , $HTOKEN , "int" , $ITOKENINFORMATION , "struct*" , $VTOKENINFORMATION , "dword" , $ITOKENINFORMATIONLENGTH ) IF @ERROR OR NOT $ACALL [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN TRUE ENDFUNC FUNC _SECURITY__SIDTOSTRINGSID ($PSID ) IF NOT _SECURITY__ISVALIDSID ($PSID ) THEN RETURN SETERROR (@ERROR + 10 , 0 , "" ) LOCAL $ACALL = DLLCALL ("advapi32.dll" , "bool" , "ConvertSidToStringSidW" , "struct*" , $PSID , "ptr*" , 0 ) IF @ERROR OR NOT $ACALL [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) LOCAL $PSTRINGSID = $ACALL [2 ] LOCAL $ALEN = DLLCALL ("kernel32.dll" , "int" , "lstrlenW" , "struct*" , $PSTRINGSID ) LOCAL $SSID = DLLSTRUCTGETDATA (DLLSTRUCTCREATE ("wchar Text[" & $ALEN [0 ] + 1 & "]" , $PSTRINGSID ) , "Text" ) DLLCALL ("kernel32.dll" , "handle" , "LocalFree" , "handle" , $PSTRINGSID ) RETURN $SSID ENDFUNC FUNC _SECURITY__SIDTYPESTR ($ITYPE ) SWITCH $ITYPE CASE $SIDTYPEUSER RETURN "User" CASE $SIDTYPEGROUP RETURN "Group" CASE $SIDTYPEDOMAIN RETURN "Domain" CASE $SIDTYPEALIAS RETURN "Alias" CASE $SIDTYPEWELLKNOWNGROUP RETURN "Well Known Group" CASE $SIDTYPEDELETEDACCOUNT RETURN "Deleted Account" CASE $SIDTYPEINVALID RETURN "Invalid" CASE $SIDTYPEUNKNOWN RETURN "Unknown Type" CASE $SIDTYPECOMPUTER RETURN "Computer" CASE $SIDTYPELABEL RETURN "A mandatory integrity label SID" CASE ELSE RETURN "Unknown SID Type" ENDSWITCH ENDFUNC FUNC _SECURITY__STRINGSIDTOSID ($SSID ) LOCAL $ACALL = DLLCALL ("advapi32.dll" , "bool" , "ConvertStringSidToSidW" , "wstr" , $SSID , "ptr*" , 0 ) IF @ERROR OR NOT $ACALL [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) LOCAL $PSID = $ACALL [2 ] LOCAL $TBUFFER = DLLSTRUCTCREATE ("byte Data[" & _SECURITY__GETLENGTHSID ($PSID ) & "]" , $PSID ) LOCAL $TSID = DLLSTRUCTCREATE ("byte Data[" & DLLSTRUCTGETSIZE ($TBUFFER ) & "]" ) DLLSTRUCTSETDATA ($TSID , "Data" , DLLSTRUCTGETDATA ($TBUFFER , "Data" ) ) DLLCALL ("kernel32.dll" , "handle" , "LocalFree" , "handle" , $PSID ) RETURN $TSID ENDFUNC GLOBAL CONST $TAGPOINT = "struct;long X;long Y;endstruct" GLOBAL CONST $TAGRECT = "struct;long Left;long Top;long Right;long Bottom;endstruct" GLOBAL CONST $TAGSIZE = "struct;long X;long Y;endstruct" GLOBAL CONST $TAGMARGINS = "int cxLeftWidth;int cxRightWidth;int cyTopHeight;int cyBottomHeight" GLOBAL CONST $TAGFILETIME = "struct;dword Lo;dword Hi;endstruct" GLOBAL CONST $TAGSYSTEMTIME = "struct;word Year;word Month;word Dow;word Day;word Hour;word Minute;word Second;word MSeconds;endstruct" GLOBAL CONST $TAGTIME_ZONE_INFORMATION = "struct;long Bias;wchar StdName[32];word StdDate[8];long StdBias;wchar DayName[32];word DayDate[8];long DayBias;endstruct" GLOBAL CONST $TAGNMHDR = "struct;hwnd hWndFrom;uint_ptr IDFrom;INT Code;endstruct" GLOBAL CONST $TAGCOMBOBOXEXITEM = "uint Mask;int_ptr Item;ptr Text;int TextMax;int Image;int SelectedImage;int OverlayImage;" & "int Indent;lparam Param" GLOBAL CONST $TAGNMCBEDRAGBEGIN = $TAGNMHDR & ";int ItemID;wchar szText[260]" GLOBAL CONST $TAGNMCBEENDEDIT = $TAGNMHDR & ";bool fChanged;int NewSelection;wchar szText[260];int Why" GLOBAL CONST $TAGNMCOMBOBOXEX = $TAGNMHDR & ";uint Mask;int_ptr Item;ptr Text;int TextMax;int Image;" & "int SelectedImage;int OverlayImage;int Indent;lparam Param" GLOBAL CONST $TAGDTPRANGE = "word MinYear;word MinMonth;word MinDOW;word MinDay;word MinHour;word MinMinute;" & "word MinSecond;word MinMSecond;word MaxYear;word MaxMonth;word MaxDOW;word MaxDay;word MaxHour;" & "word MaxMinute;word MaxSecond;word MaxMSecond;bool MinValid;bool MaxValid" GLOBAL CONST $TAGNMDATETIMECHANGE = $TAGNMHDR & ";dword Flag;" & $TAGSYSTEMTIME GLOBAL CONST $TAGNMDATETIMEFORMAT = $TAGNMHDR & ";ptr Format;" & $TAGSYSTEMTIME & ";ptr pDisplay;wchar Display[64]" GLOBAL CONST $TAGNMDATETIMEFORMATQUERY = $TAGNMHDR & ";ptr Format;struct;long SizeX;long SizeY;endstruct" GLOBAL CONST $TAGNMDATETIMEKEYDOWN = $TAGNMHDR & ";int VirtKey;ptr Format;" & $TAGSYSTEMTIME GLOBAL CONST $TAGNMDATETIMESTRING = $TAGNMHDR & ";ptr UserString;" & $TAGSYSTEMTIME & ";dword Flags" GLOBAL CONST $TAGEVENTLOGRECORD = "dword Length;dword Reserved;dword RecordNumber;dword TimeGenerated;dword TimeWritten;dword EventID;" & "word EventType;word NumStrings;word EventCategory;word ReservedFlags;dword ClosingRecordNumber;dword StringOffset;" & "dword UserSidLength;dword UserSidOffset;dword DataLength;dword DataOffset" GLOBAL CONST $TAGGDIP_EFFECTPARAMS_BLUR = "float Radius; bool ExpandEdge" GLOBAL CONST $TAGGDIP_EFFECTPARAMS_BRIGHTNESSCONTRAST = "int BrightnessLevel; int ContrastLevel" GLOBAL CONST $TAGGDIP_EFFECTPARAMS_COLORBALANCE = "int CyanRed; int MagentaGreen; int YellowBlue" GLOBAL CONST $TAGGDIP_EFFECTPARAMS_COLORCURVE = "int Adjustment; int Channel; int AdjustValue" GLOBAL CONST $TAGGDIP_EFFECTPARAMS_COLORLUT = "byte LutB[256]; byte LutG[256]; byte LutR[256]; byte LutA[256]" GLOBAL CONST $TAGGDIP_EFFECTPARAMS_HUESATURATIONLIGHTNESS = "int HueLevel; int SaturationLevel; int LightnessLevel" GLOBAL CONST $TAGGDIP_EFFECTPARAMS_LEVELS = "int Highlight; int Midtone; int Shadow" GLOBAL CONST $TAGGDIP_EFFECTPARAMS_REDEYECORRECTION = "uint NumberOfAreas; ptr Areas" GLOBAL CONST $TAGGDIP_EFFECTPARAMS_SHARPEN = "float Radius; float Amount" GLOBAL CONST $TAGGDIP_EFFECTPARAMS_TINT = "int Hue; int Amount" GLOBAL CONST $TAGGDIPBITMAPDATA = "uint Width;uint Height;int Stride;int Format;ptr Scan0;uint_ptr Reserved" GLOBAL CONST $TAGGDIPCOLORMATRIX = "float m[25]" GLOBAL CONST $TAGGDIPENCODERPARAM = "struct;byte GUID[16];ulong NumberOfValues;ulong Type;ptr Values;endstruct" GLOBAL CONST $TAGGDIPENCODERPARAMS = "uint Count;" & $TAGGDIPENCODERPARAM GLOBAL CONST $TAGGDIPRECTF = "struct;float X;float Y;float Width;float Height;endstruct" GLOBAL CONST $TAGGDIPSTARTUPINPUT = "uint Version;ptr Callback;bool NoThread;bool NoCodecs" GLOBAL CONST $TAGGDIPSTARTUPOUTPUT = "ptr HookProc;ptr UnhookProc" GLOBAL CONST $TAGGDIPIMAGECODECINFO = "byte CLSID[16];byte FormatID[16];ptr CodecName;ptr DllName;ptr FormatDesc;ptr FileExt;" & "ptr MimeType;dword Flags;dword Version;dword SigCount;dword SigSize;ptr SigPattern;ptr SigMask" GLOBAL CONST $TAGGDIPPENCODERPARAMS = "uint Count;byte Params[1]" GLOBAL CONST $TAGHDITEM = "uint Mask;int XY;ptr Text;handle hBMP;int TextMax;int Fmt;lparam Param;int Image;int Order;uint Type;ptr pFilter;uint State" GLOBAL CONST $TAGNMHDDISPINFO = $TAGNMHDR & ";int Item;uint Mask;ptr Text;int TextMax;int Image;lparam lParam" GLOBAL CONST $TAGNMHDFILTERBTNCLICK = $TAGNMHDR & ";int Item;" & $TAGRECT GLOBAL CONST $TAGNMHEADER = $TAGNMHDR & ";int Item;int Button;ptr pItem" GLOBAL CONST $TAGGETIPADDRESS = "byte Field4;byte Field3;byte Field2;byte Field1" GLOBAL CONST $TAGNMIPADDRESS = $TAGNMHDR & ";int Field;int Value" GLOBAL CONST $TAGLVFINDINFO = "struct;uint Flags;ptr Text;lparam Param;" & $TAGPOINT & ";uint Direction;endstruct" GLOBAL CONST $TAGLVHITTESTINFO = $TAGPOINT & ";uint Flags;int Item;int SubItem;int iGroup" GLOBAL CONST $TAGLVITEM = "struct;uint Mask;int Item;int SubItem;uint State;uint StateMask;ptr Text;int TextMax;int Image;lparam Param;" & "int Indent;int GroupID;uint Columns;ptr pColumns;ptr piColFmt;int iGroup;endstruct" GLOBAL CONST $TAGNMLISTVIEW = $TAGNMHDR & ";int Item;int SubItem;uint NewState;uint OldState;uint Changed;" & "struct;long ActionX;long ActionY;endstruct;lparam Param" GLOBAL CONST $TAGNMLVCUSTOMDRAW = "struct;" & $TAGNMHDR & ";dword dwDrawStage;handle hdc;" & $TAGRECT & ";dword_ptr dwItemSpec;uint uItemState;lparam lItemlParam;endstruct" & ";dword clrText;dword clrTextBk;int iSubItem;dword dwItemType;dword clrFace;int iIconEffect;" & "int iIconPhase;int iPartID;int iStateID;struct;long TextLeft;long TextTop;long TextRight;long TextBottom;endstruct;uint uAlign" GLOBAL CONST $TAGNMLVDISPINFO = $TAGNMHDR & ";" & $TAGLVITEM GLOBAL CONST $TAGNMLVFINDITEM = $TAGNMHDR & ";int Start;" & $TAGLVFINDINFO GLOBAL CONST $TAGNMLVGETINFOTIP = $TAGNMHDR & ";dword Flags;ptr Text;int TextMax;int Item;int SubItem;lparam lParam" GLOBAL CONST $TAGNMITEMACTIVATE = $TAGNMHDR & ";int Index;int SubItem;uint NewState;uint OldState;uint Changed;" & $TAGPOINT & ";lparam lParam;uint KeyFlags" GLOBAL CONST $TAGNMLVKEYDOWN = "align 1;" & $TAGNMHDR & ";word VKey;uint Flags" GLOBAL CONST $TAGNMLVSCROLL = $TAGNMHDR & ";int DX;int DY" GLOBAL CONST $TAGMCHITTESTINFO = "uint Size;" & $TAGPOINT & ";uint Hit;" & $TAGSYSTEMTIME & ";" & $TAGRECT & ";int iOffset;int iRow;int iCol" GLOBAL CONST $TAGMCMONTHRANGE = "word MinYear;word MinMonth;word MinDOW;word MinDay;word MinHour;word MinMinute;word MinSecond;" & "word MinMSeconds;word MaxYear;word MaxMonth;word MaxDOW;word MaxDay;word MaxHour;word MaxMinute;word MaxSecond;" & "word MaxMSeconds;short Span" GLOBAL CONST $TAGMCRANGE = "word MinYear;word MinMonth;word MinDOW;word MinDay;word MinHour;word MinMinute;word MinSecond;" & "word MinMSeconds;word MaxYear;word MaxMonth;word MaxDOW;word MaxDay;word MaxHour;word MaxMinute;word MaxSecond;" & "word MaxMSeconds;short MinSet;short MaxSet" GLOBAL CONST $TAGMCSELRANGE = "word MinYear;word MinMonth;word MinDOW;word MinDay;word MinHour;word MinMinute;word MinSecond;" & "word MinMSeconds;word MaxYear;word MaxMonth;word MaxDOW;word MaxDay;word MaxHour;word MaxMinute;word MaxSecond;" & "word MaxMSeconds" GLOBAL CONST $TAGNMDAYSTATE = $TAGNMHDR & ";" & $TAGSYSTEMTIME & ";int DayState;ptr pDayState" GLOBAL CONST $TAGNMSELCHANGE = $TAGNMHDR & ";struct;word BegYear;word BegMonth;word BegDOW;word BegDay;word BegHour;word BegMinute;word BegSecond;word BegMSeconds;endstruct;" & "struct;word EndYear;word EndMonth;word EndDOW;word EndDay;word EndHour;word EndMinute;word EndSecond;word EndMSeconds;endstruct" GLOBAL CONST $TAGNMOBJECTNOTIFY = $TAGNMHDR & ";int Item;ptr piid;ptr pObject;long Result;dword dwFlags" GLOBAL CONST $TAGNMTCKEYDOWN = "align 1;" & $TAGNMHDR & ";word VKey;uint Flags" GLOBAL CONST $TAGTVITEM = "struct;uint Mask;handle hItem;uint State;uint StateMask;ptr Text;int TextMax;int Image;int SelectedImage;" & "int Children;lparam Param;endstruct" GLOBAL CONST $TAGTVITEMEX = "struct;" & $TAGTVITEM & ";int Integral;uint uStateEx;hwnd hwnd;int iExpandedImage;int iReserved;endstruct" GLOBAL CONST $TAGNMTREEVIEW = $TAGNMHDR & ";uint Action;" & "struct;uint OldMask;handle OldhItem;uint OldState;uint OldStateMask;" & "ptr OldText;int OldTextMax;int OldImage;int OldSelectedImage;int OldChildren;lparam OldParam;endstruct;" & "struct;uint NewMask;handle NewhItem;uint NewState;uint NewStateMask;" & "ptr NewText;int NewTextMax;int NewImage;int NewSelectedImage;int NewChildren;lparam NewParam;endstruct;" & "struct;long PointX;long PointY;endstruct" GLOBAL CONST $TAGNMTVCUSTOMDRAW = "struct;" & $TAGNMHDR & ";dword DrawStage;handle HDC;" & $TAGRECT & ";dword_ptr ItemSpec;uint ItemState;lparam ItemParam;endstruct" & ";dword ClrText;dword ClrTextBk;int Level" GLOBAL CONST $TAGNMTVDISPINFO = $TAGNMHDR & ";" & $TAGTVITEM GLOBAL CONST $TAGNMTVGETINFOTIP = $TAGNMHDR & ";ptr Text;int TextMax;handle hItem;lparam lParam" GLOBAL CONST $TAGNMTVITEMCHANGE = $TAGNMHDR & ";uint Changed;handle hItem;uint StateNew;uint StateOld;lparam lParam;" GLOBAL CONST $TAGTVHITTESTINFO = $TAGPOINT & ";uint Flags;handle Item" GLOBAL CONST $TAGNMTVKEYDOWN = "align 1;" & $TAGNMHDR & ";word VKey;uint Flags" GLOBAL CONST $TAGNMMOUSE = $TAGNMHDR & ";dword_ptr ItemSpec;dword_ptr ItemData;" & $TAGPOINT & ";lparam HitInfo" GLOBAL CONST $TAGTOKEN_PRIVILEGES = "dword Count;align 4;int64 LUID;dword Attributes" GLOBAL CONST $TAGIMAGEINFO = "handle hBitmap;handle hMask;int Unused1;int Unused2;" & $TAGRECT GLOBAL CONST $TAGMENUINFO = "dword Size;INT Mask;dword Style;uint YMax;handle hBack;dword ContextHelpID;ulong_ptr MenuData" GLOBAL CONST $TAGMENUITEMINFO = "uint Size;uint Mask;uint Type;uint State;uint ID;handle SubMenu;handle BmpChecked;handle BmpUnchecked;" & "ulong_ptr ItemData;ptr TypeData;uint CCH;handle BmpItem" GLOBAL CONST $TAGREBARBANDINFO = "uint cbSize;uint fMask;uint fStyle;dword clrFore;dword clrBack;ptr lpText;uint cch;" & "int iImage;hwnd hwndChild;uint cxMinChild;uint cyMinChild;uint cx;handle hbmBack;uint wID;uint cyChild;uint cyMaxChild;" & "uint cyIntegral;uint cxIdeal;lparam lParam;uint cxHeader" & ((@OSVERSION = "WIN_XP" ) "" ";" & $TAGRECT & ";uint uChevronState" ) GLOBAL CONST $TAGNMREBARAUTOBREAK = $TAGNMHDR & ";uint uBand;uint wID;lparam lParam;uint uMsg;uint fStyleCurrent;bool fAutoBreak" GLOBAL CONST $TAGNMRBAUTOSIZE = $TAGNMHDR & ";bool fChanged;" & "struct;long TargetLeft;long TargetTop;long TargetRight;long TargetBottom;endstruct;" & "struct;long ActualLeft;long ActualTop;long ActualRight;long ActualBottom;endstruct" GLOBAL CONST $TAGNMREBAR = $TAGNMHDR & ";dword dwMask;uint uBand;uint fStyle;uint wID;lparam lParam" GLOBAL CONST $TAGNMREBARCHEVRON = $TAGNMHDR & ";uint uBand;uint wID;lparam lParam;" & $TAGRECT & ";lparam lParamNM" GLOBAL CONST $TAGNMREBARCHILDSIZE = $TAGNMHDR & ";uint uBand;uint wID;" & "struct;long CLeft;long CTop;long CRight;long CBottom;endstruct;" & "struct;long BLeft;long BTop;long BRight;long BBottom;endstruct" GLOBAL CONST $TAGCOLORSCHEME = "dword Size;dword BtnHighlight;dword BtnShadow" GLOBAL CONST $TAGNMTOOLBAR = $TAGNMHDR & ";int iItem;" & "struct;int iBitmap;int idCommand;byte fsState;byte fsStyle;dword_ptr dwData;int_ptr iString;endstruct" & ";int cchText;ptr pszText;" & $TAGRECT GLOBAL CONST $TAGNMTBHOTITEM = $TAGNMHDR & ";int idOld;int idNew;dword dwFlags" GLOBAL CONST $TAGTBBUTTON = "int Bitmap;int Command;byte State;byte Style;dword_ptr Param;int_ptr String" GLOBAL CONST $TAGTBBUTTONINFO = "uint Size;dword Mask;int Command;int Image;byte State;byte Style;word CX;dword_ptr Param;ptr Text;int TextMax" GLOBAL CONST $TAGNETRESOURCE = "dword Scope;dword Type;dword DisplayType;dword Usage;ptr LocalName;ptr RemoteName;ptr Comment;ptr Provider" GLOBAL CONST $TAGOVERLAPPED = "ulong_ptr Internal;ulong_ptr InternalHigh;struct;dword Offset;dword OffsetHigh;endstruct;handle hEvent" GLOBAL CONST $TAGOPENFILENAME = "dword StructSize;hwnd hwndOwner;handle hInstance;ptr lpstrFilter;ptr lpstrCustomFilter;" & "dword nMaxCustFilter;dword nFilterIndex;ptr lpstrFile;dword nMaxFile;ptr lpstrFileTitle;dword nMaxFileTitle;" & "ptr lpstrInitialDir;ptr lpstrTitle;dword Flags;word nFileOffset;word nFileExtension;ptr lpstrDefExt;lparam lCustData;" & "ptr lpfnHook;ptr lpTemplateName;ptr pvReserved;dword dwReserved;dword FlagsEx" GLOBAL CONST $TAGBITMAPINFOHEADER = "struct;dword biSize;long biWidth;long biHeight;word biPlanes;word biBitCount;" & "dword biCompression;dword biSizeImage;long biXPelsPerMeter;long biYPelsPerMeter;dword biClrUsed;dword biClrImportant;endstruct" GLOBAL CONST $TAGBITMAPINFO = $TAGBITMAPINFOHEADER & ";dword biRGBQuad[1]" GLOBAL CONST $TAGBLENDFUNCTION = "byte Op;byte Flags;byte Alpha;byte Format" GLOBAL CONST $TAGGUID = "struct;ulong Data1;ushort Data2;ushort Data3;byte Data4[8];endstruct" GLOBAL CONST $TAGWINDOWPLACEMENT = "uint length;uint flags;uint showCmd;long ptMinPosition[2];long ptMaxPosition[2];long rcNormalPosition[4]" GLOBAL CONST $TAGWINDOWPOS = "hwnd hWnd;hwnd InsertAfter;int X;int Y;int CX;int CY;uint Flags" GLOBAL CONST $TAGSCROLLINFO = "uint cbSize;uint fMask;int nMin;int nMax;uint nPage;int nPos;int nTrackPos" GLOBAL CONST $TAGSCROLLBARINFO = "dword cbSize;" & $TAGRECT & ";int dxyLineButton;int xyThumbTop;" & "int xyThumbBottom;int reserved;dword rgstate[6]" GLOBAL CONST $TAGLOGFONT = "struct;long Height;long Width;long Escapement;long Orientation;long Weight;byte Italic;byte Underline;" & "byte Strikeout;byte CharSet;byte OutPrecision;byte ClipPrecision;byte Quality;byte PitchAndFamily;wchar FaceName[32];endstruct" GLOBAL CONST $TAGKBDLLHOOKSTRUCT = "dword vkCode;dword scanCode;dword flags;dword time;ulong_ptr dwExtraInfo" GLOBAL CONST $TAGPROCESS_INFORMATION = "handle hProcess;handle hThread;dword ProcessID;dword ThreadID" GLOBAL CONST $TAGSTARTUPINFO = "dword Size;ptr Reserved1;ptr Desktop;ptr Title;dword X;dword Y;dword XSize;dword YSize;dword XCountChars;" & "dword YCountChars;dword FillAttribute;dword Flags;word ShowWindow;word Reserved2;ptr Reserved3;handle StdInput;" & "handle StdOutput;handle StdError" GLOBAL CONST $TAGSECURITY_ATTRIBUTES = "dword Length;ptr Descriptor;bool InheritHandle" GLOBAL CONST $TAGWIN32_FIND_DATA = "dword dwFileAttributes;dword ftCreationTime[2];dword ftLastAccessTime[2];dword ftLastWriteTime[2];dword nFileSizeHigh;dword nFileSizeLow;dword dwReserved0;dword dwReserved1;wchar cFileName[260];wchar cAlternateFileName[14]" GLOBAL CONST $TAGTEXTMETRIC = "long tmHeight;long tmAscent;long tmDescent;long tmInternalLeading;long tmExternalLeading;" & "long tmAveCharWidth;long tmMaxCharWidth;long tmWeight;long tmOverhang;long tmDigitizedAspectX;long tmDigitizedAspectY;" & "wchar tmFirstChar;wchar tmLastChar;wchar tmDefaultChar;wchar tmBreakChar;byte tmItalic;byte tmUnderlined;byte tmStruckOut;" & "byte tmPitchAndFamily;byte tmCharSet" GLOBAL CONST $TAGMEMMAP = "handle hProc;ulong_ptr Size;ptr Mem" FUNC _MEMFREE (BYREF $TMEMMAP ) LOCAL $PMEMORY = DLLSTRUCTGETDATA ($TMEMMAP , "Mem" ) LOCAL $HPROCESS = DLLSTRUCTGETDATA ($TMEMMAP , "hProc" ) LOCAL $BRESULT = _MEMVIRTUALFREEEX ($HPROCESS , $PMEMORY , 0 , $MEM_RELEASE ) DLLCALL ("kernel32.dll" , "bool" , "CloseHandle" , "handle" , $HPROCESS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $BRESULT ENDFUNC FUNC _MEMGLOBALALLOC ($IBYTES , $IFLAGS = 0 ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "handle" , "GlobalAlloc" , "uint" , $IFLAGS , "ulong_ptr" , $IBYTES ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _MEMGLOBALFREE ($HMEMORY ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "ptr" , "GlobalFree" , "handle" , $HMEMORY ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _MEMGLOBALLOCK ($HMEMORY ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "ptr" , "GlobalLock" , "handle" , $HMEMORY ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _MEMGLOBALSIZE ($HMEMORY ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "ulong_ptr" , "GlobalSize" , "handle" , $HMEMORY ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _MEMGLOBALUNLOCK ($HMEMORY ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "bool" , "GlobalUnlock" , "handle" , $HMEMORY ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _MEMINIT ($HWND , $ISIZE , BYREF $TMEMMAP ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "dword" , "GetWindowThreadProcessId" , "hwnd" , $HWND , "dword*" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $IPROCESSID = $ARESULT [2 ] IF $IPROCESSID = 0 THEN RETURN SETERROR (1 , 0 , 0 ) LOCAL $IACCESS = BITOR ($PROCESS_VM_OPERATION , $PROCESS_VM_READ , $PROCESS_VM_WRITE ) LOCAL $HPROCESS = __MEM_OPENPROCESS ($IACCESS , FALSE , $IPROCESSID , TRUE ) LOCAL $IALLOC = BITOR ($MEM_RESERVE , $MEM_COMMIT ) LOCAL $PMEMORY = _MEMVIRTUALALLOCEX ($HPROCESS , 0 , $ISIZE , $IALLOC , $PAGE_READWRITE ) IF $PMEMORY = 0 THEN RETURN SETERROR (2 , 0 , 0 ) $TMEMMAP = DLLSTRUCTCREATE ($TAGMEMMAP ) DLLSTRUCTSETDATA ($TMEMMAP , "hProc" , $HPROCESS ) DLLSTRUCTSETDATA ($TMEMMAP , "Size" , $ISIZE ) DLLSTRUCTSETDATA ($TMEMMAP , "Mem" , $PMEMORY ) RETURN $PMEMORY ENDFUNC FUNC _MEMMOVEMEMORY ($PSOURCE , $PDEST , $ILENGTH ) DLLCALL ("kernel32.dll" , "none" , "RtlMoveMemory" , "struct*" , $PDEST , "struct*" , $PSOURCE , "ulong_ptr" , $ILENGTH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED ) ENDFUNC FUNC _MEMREAD (BYREF $TMEMMAP , $PSRCE , $PDEST , $ISIZE ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "bool" , "ReadProcessMemory" , "handle" , DLLSTRUCTGETDATA ($TMEMMAP , "hProc" ) , "ptr" , $PSRCE , "struct*" , $PDEST , "ulong_ptr" , $ISIZE , "ulong_ptr*" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _MEMWRITE (BYREF $TMEMMAP , $PSRCE , $PDEST = 0 , $ISIZE = 0 , $SSRCE = "struct*" ) IF $PDEST = 0 THEN $PDEST = DLLSTRUCTGETDATA ($TMEMMAP , "Mem" ) IF $ISIZE = 0 THEN $ISIZE = DLLSTRUCTGETDATA ($TMEMMAP , "Size" ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "bool" , "WriteProcessMemory" , "handle" , DLLSTRUCTGETDATA ($TMEMMAP , "hProc" ) , "ptr" , $PDEST , $SSRCE , $PSRCE , "ulong_ptr" , $ISIZE , "ulong_ptr*" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _MEMVIRTUALALLOC ($PADDRESS , $ISIZE , $IALLOCATION , $IPROTECT ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "ptr" , "VirtualAlloc" , "ptr" , $PADDRESS , "ulong_ptr" , $ISIZE , "dword" , $IALLOCATION , "dword" , $IPROTECT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _MEMVIRTUALALLOCEX ($HPROCESS , $PADDRESS , $ISIZE , $IALLOCATION , $IPROTECT ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "ptr" , "VirtualAllocEx" , "handle" , $HPROCESS , "ptr" , $PADDRESS , "ulong_ptr" , $ISIZE , "dword" , $IALLOCATION , "dword" , $IPROTECT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _MEMVIRTUALFREE ($PADDRESS , $ISIZE , $IFREETYPE ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "bool" , "VirtualFree" , "ptr" , $PADDRESS , "ulong_ptr" , $ISIZE , "dword" , $IFREETYPE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _MEMVIRTUALFREEEX ($HPROCESS , $PADDRESS , $ISIZE , $IFREETYPE ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "bool" , "VirtualFreeEx" , "handle" , $HPROCESS , "ptr" , $PADDRESS , "ulong_ptr" , $ISIZE , "dword" , $IFREETYPE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC __MEM_OPENPROCESS ($IACCESS , $BINHERIT , $IPID , $BDEBUGPRIV = FALSE ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "handle" , "OpenProcess" , "dword" , $IACCESS , "bool" , $BINHERIT , "dword" , $IPID ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF $ARESULT [0 ] THEN RETURN $ARESULT [0 ] IF NOT $BDEBUGPRIV THEN RETURN SETERROR (100 , 0 , 0 ) LOCAL $HTOKEN = _SECURITY__OPENTHREADTOKENEX (BITOR ($TOKEN_ADJUST_PRIVILEGES , $TOKEN_QUERY ) ) IF @ERROR THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) _SECURITY__SETPRIVILEGE ($HTOKEN , "SeDebugPrivilege" , TRUE ) LOCAL $IERROR = @ERROR LOCAL $IEXTENDED = @EXTENDED LOCAL $IRET = 0 IF NOT @ERROR THEN $ARESULT = DLLCALL ("kernel32.dll" , "handle" , "OpenProcess" , "dword" , $IACCESS , "bool" , $BINHERIT , "dword" , $IPID ) $IERROR = @ERROR $IEXTENDED = @EXTENDED IF $ARESULT [0 ] THEN $IRET = $ARESULT [0 ] _SECURITY__SETPRIVILEGE ($HTOKEN , "SeDebugPrivilege" , FALSE ) IF @ERROR THEN $IERROR = @ERROR + 20 $IEXTENDED = @EXTENDED ENDIF ELSE $IERROR = @ERROR + 30 ENDIF DLLCALL ("kernel32.dll" , "bool" , "CloseHandle" , "handle" , $HTOKEN ) RETURN SETERROR ($IERROR , $IEXTENDED , $IRET ) ENDFUNC FUNC _SENDMESSAGE ($HWND , $IMSG , $WPARAM = 0 , $LPARAM = 0 , $IRETURN = 0 , $WPARAMTYPE = "wparam" , $LPARAMTYPE = "lparam" , $SRETURNTYPE = "lresult" ) LOCAL $ARESULT = DLLCALL ("user32.dll" , $SRETURNTYPE , "SendMessageW" , "hwnd" , $HWND , "uint" , $IMSG , $WPARAMTYPE , $WPARAM , $LPARAMTYPE , $LPARAM ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) IF $IRETURN >= 0 AND $IRETURN <= 4 THEN RETURN $ARESULT [$IRETURN ] RETURN $ARESULT ENDFUNC FUNC _SENDMESSAGEA ($HWND , $IMSG , $WPARAM = 0 , $LPARAM = 0 , $IRETURN = 0 , $WPARAMTYPE = "wparam" , $LPARAMTYPE = "lparam" , $SRETURNTYPE = "lresult" ) LOCAL $ARESULT = DLLCALL ("user32.dll" , $SRETURNTYPE , "SendMessageA" , "hwnd" , $HWND , "uint" , $IMSG , $WPARAMTYPE , $WPARAM , $LPARAMTYPE , $LPARAM ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) IF $IRETURN >= 0 AND $IRETURN <= 4 THEN RETURN $ARESULT [$IRETURN ] RETURN $ARESULT ENDFUNC GLOBAL CONST $SBARS_SIZEGRIP = 256 GLOBAL CONST $SBT_TOOLTIPS = 2048 GLOBAL CONST $SBARS_TOOLTIPS = 2048 GLOBAL CONST $SBT_SUNKEN = 0 GLOBAL CONST $SBT_NOBORDERS = 256 GLOBAL CONST $SBT_POPOUT = 512 GLOBAL CONST $SBT_RTLREADING = 1024 GLOBAL CONST $SBT_NOTABPARSING = 2048 GLOBAL CONST $SBT_OWNERDRAW = 4096 GLOBAL CONST $__STATUSBARCONSTANT_WM_USER = 1024 GLOBAL CONST $SB_GETBORDERS = ($__STATUSBARCONSTANT_WM_USER + 7 ) GLOBAL CONST $SB_GETICON = ($__STATUSBARCONSTANT_WM_USER + 20 ) GLOBAL CONST $SB_GETPARTS = ($__STATUSBARCONSTANT_WM_USER + 6 ) GLOBAL CONST $SB_GETRECT = ($__STATUSBARCONSTANT_WM_USER + 10 ) GLOBAL CONST $SB_GETTEXTA = ($__STATUSBARCONSTANT_WM_USER + 2 ) GLOBAL CONST $SB_GETTEXTW = ($__STATUSBARCONSTANT_WM_USER + 13 ) GLOBAL CONST $SB_GETTEXT = $SB_GETTEXTA GLOBAL CONST $SB_GETTEXTLENGTHA = ($__STATUSBARCONSTANT_WM_USER + 3 ) GLOBAL CONST $SB_GETTEXTLENGTHW = ($__STATUSBARCONSTANT_WM_USER + 12 ) GLOBAL CONST $SB_GETTEXTLENGTH = $SB_GETTEXTLENGTHA GLOBAL CONST $SB_GETTIPTEXTA = ($__STATUSBARCONSTANT_WM_USER + 18 ) GLOBAL CONST $SB_GETTIPTEXTW = ($__STATUSBARCONSTANT_WM_USER + 19 ) GLOBAL CONST $SB_GETUNICODEFORMAT = 8192 + 6 GLOBAL CONST $SB_ISSIMPLE = ($__STATUSBARCONSTANT_WM_USER + 14 ) GLOBAL CONST $SB_SETBKCOLOR = 8192 + 1 GLOBAL CONST $SB_SETICON = ($__STATUSBARCONSTANT_WM_USER + 15 ) GLOBAL CONST $SB_SETMINHEIGHT = ($__STATUSBARCONSTANT_WM_USER + 8 ) GLOBAL CONST $SB_SETPARTS = ($__STATUSBARCONSTANT_WM_USER + 4 ) GLOBAL CONST $SB_SETTEXTA = ($__STATUSBARCONSTANT_WM_USER + 1 ) GLOBAL CONST $SB_SETTEXTW = ($__STATUSBARCONSTANT_WM_USER + 11 ) GLOBAL CONST $SB_SETTEXT = $SB_SETTEXTA GLOBAL CONST $SB_SETTIPTEXTA = ($__STATUSBARCONSTANT_WM_USER + 16 ) GLOBAL CONST $SB_SETTIPTEXTW = ($__STATUSBARCONSTANT_WM_USER + 17 ) GLOBAL CONST $SB_SETUNICODEFORMAT = 8192 + 5 GLOBAL CONST $SB_SIMPLE = ($__STATUSBARCONSTANT_WM_USER + 9 ) GLOBAL CONST $SB_SIMPLEID = 255 GLOBAL CONST $SBN_FIRST = + 4294966416 GLOBAL CONST $SBN_SIMPLEMODECHANGE = $SBN_FIRST + 0 GLOBAL CONST $OPT_COORDSRELATIVE = 0 GLOBAL CONST $OPT_COORDSABSOLUTE = 1 GLOBAL CONST $OPT_COORDSCLIENT = 2 GLOBAL CONST $OPT_ERRORSILENT = 0 GLOBAL CONST $OPT_ERRORFATAL = 1 GLOBAL CONST $OPT_CAPSNOSTORE = 0 GLOBAL CONST $OPT_CAPSSTORE = 1 GLOBAL CONST $OPT_MATCHSTART = 1 GLOBAL CONST $OPT_MATCHANY = 2 GLOBAL CONST $OPT_MATCHEXACT = 3 GLOBAL CONST $OPT_MATCHADVANCED = 4 GLOBAL CONST $CCS_TOP = 1 GLOBAL CONST $CCS_NOMOVEY = 2 GLOBAL CONST $CCS_BOTTOM = 3 GLOBAL CONST $CCS_NORESIZE = 4 GLOBAL CONST $CCS_NOPARENTALIGN = 8 GLOBAL CONST $CCS_NOHILITE = 16 GLOBAL CONST $CCS_ADJUSTABLE = 32 GLOBAL CONST $CCS_NODIVIDER = 64 GLOBAL CONST $CCS_VERT = 128 GLOBAL CONST $CCS_LEFT = 129 GLOBAL CONST $CCS_NOMOVEX = 130 GLOBAL CONST $CCS_RIGHT = 131 GLOBAL CONST $DT_DRIVETYPE = 1 GLOBAL CONST $DT_SSDSTATUS = 2 GLOBAL CONST $DT_BUSTYPE = 3 GLOBAL CONST $PROXY_IE = 0 GLOBAL CONST $PROXY_NONE = 1 GLOBAL CONST $PROXY_SPECIFIED = 2 GLOBAL CONST $OBJID_WINDOW = 0 GLOBAL CONST $OBJID_TITLEBAR = 4294967294 GLOBAL CONST $OBJID_SIZEGRIP = 4294967289 GLOBAL CONST $OBJID_CARET = 4294967288 GLOBAL CONST $OBJID_CURSOR = 4294967287 GLOBAL CONST $OBJID_ALERT = 4294967286 GLOBAL CONST $OBJID_SOUND = 4294967285 GLOBAL CONST $DLG_CENTERONTOP = 0 GLOBAL CONST $DLG_NOTITLE = 1 GLOBAL CONST $DLG_NOTONTOP = 2 GLOBAL CONST $DLG_TEXTLEFT = 4 GLOBAL CONST $DLG_TEXTRIGHT = 8 GLOBAL CONST $DLG_MOVEABLE = 16 GLOBAL CONST $DLG_TEXTVCENTER = 32 GLOBAL CONST $IDC_UNKNOWN = 0 GLOBAL CONST $IDC_APPSTARTING = 1 GLOBAL CONST $IDC_ARROW = 2 GLOBAL CONST $IDC_CROSS = 3 GLOBAL CONST $IDC_HAND = 32649 GLOBAL CONST $IDC_HELP = 4 GLOBAL CONST $IDC_IBEAM = 5 GLOBAL CONST $IDC_ICON = 6 GLOBAL CONST $IDC_NO = 7 GLOBAL CONST $IDC_SIZE = 8 GLOBAL CONST $IDC_SIZEALL = 9 GLOBAL CONST $IDC_SIZENESW = 10 GLOBAL CONST $IDC_SIZENS = 11 GLOBAL CONST $IDC_SIZENWSE = 12 GLOBAL CONST $IDC_SIZEWE = 13 GLOBAL CONST $IDC_UPARROW = 14 GLOBAL CONST $IDC_WAIT = 15 GLOBAL CONST $IDI_APPLICATION = 32512 GLOBAL CONST $IDI_ASTERISK = 32516 GLOBAL CONST $IDI_EXCLAMATION = 32515 GLOBAL CONST $IDI_HAND = 32513 GLOBAL CONST $IDI_QUESTION = 32514 GLOBAL CONST $IDI_WINLOGO = 32517 GLOBAL CONST $IDI_SHIELD = 32518 GLOBAL CONST $IDI_ERROR = $IDI_HAND GLOBAL CONST $IDI_INFORMATION = $IDI_ASTERISK GLOBAL CONST $IDI_WARNING = $IDI_EXCLAMATION GLOBAL CONST $SD_LOGOFF = 0 GLOBAL CONST $SD_SHUTDOWN = 1 GLOBAL CONST $SD_REBOOT = 2 GLOBAL CONST $SD_FORCE = 4 GLOBAL CONST $SD_POWERDOWN = 8 GLOBAL CONST $SD_FORCEHUNG = 16 GLOBAL CONST $SD_STANDBY = 32 GLOBAL CONST $SD_HIBERNATE = 64 GLOBAL CONST $STDIN_CHILD = 1 GLOBAL CONST $STDOUT_CHILD = 2 GLOBAL CONST $STDERR_CHILD = 4 GLOBAL CONST $STDERR_MERGED = 8 GLOBAL CONST $STDIO_INHERIT_PARENT = 16 GLOBAL CONST $RUN_CREATE_NEW_CONSOLE = 65536 GLOBAL CONST $UBOUND_DIMENSIONS = 0 GLOBAL CONST $UBOUND_ROWS = 1 GLOBAL CONST $UBOUND_COLUMNS = 2 GLOBAL CONST $MOUSEEVENTF_ABSOLUTE = 32768 GLOBAL CONST $MOUSEEVENTF_MOVE = 1 GLOBAL CONST $MOUSEEVENTF_LEFTDOWN = 2 GLOBAL CONST $MOUSEEVENTF_LEFTUP = 4 GLOBAL CONST $MOUSEEVENTF_RIGHTDOWN = 8 GLOBAL CONST $MOUSEEVENTF_RIGHTUP = 16 GLOBAL CONST $MOUSEEVENTF_MIDDLEDOWN = 32 GLOBAL CONST $MOUSEEVENTF_MIDDLEUP = 64 GLOBAL CONST $MOUSEEVENTF_WHEEL = 2048 GLOBAL CONST $MOUSEEVENTF_XDOWN = 128 GLOBAL CONST $MOUSEEVENTF_XUP = 256 GLOBAL CONST $REG_NONE = 0 GLOBAL CONST $REG_SZ = 1 GLOBAL CONST $REG_EXPAND_SZ = 2 GLOBAL CONST $REG_BINARY = 3 GLOBAL CONST $REG_DWORD = 4 GLOBAL CONST $REG_DWORD_LITTLE_ENDIAN = 4 GLOBAL CONST $REG_DWORD_BIG_ENDIAN = 5 GLOBAL CONST $REG_LINK = 6 GLOBAL CONST $REG_MULTI_SZ = 7 GLOBAL CONST $REG_RESOURCE_LIST = 8 GLOBAL CONST $REG_FULL_RESOURCE_DESCRIPTOR = 9 GLOBAL CONST $REG_RESOURCE_REQUIREMENTS_LIST = 10 GLOBAL CONST $REG_QWORD = 11 GLOBAL CONST $REG_QWORD_LITTLE_ENDIAN = 11 GLOBAL CONST $HWND_BOTTOM = 1 GLOBAL CONST $HWND_NOTOPMOST = + 4294967294 GLOBAL CONST $HWND_TOP = 0 GLOBAL CONST $HWND_TOPMOST = + 4294967295 GLOBAL CONST $SWP_NOSIZE = 1 GLOBAL CONST $SWP_NOMOVE = 2 GLOBAL CONST $SWP_NOZORDER = 4 GLOBAL CONST $SWP_NOREDRAW = 8 GLOBAL CONST $SWP_NOACTIVATE = 16 GLOBAL CONST $SWP_FRAMECHANGED = 32 GLOBAL CONST $SWP_DRAWFRAME = 32 GLOBAL CONST $SWP_SHOWWINDOW = 64 GLOBAL CONST $SWP_HIDEWINDOW = 128 GLOBAL CONST $SWP_NOCOPYBITS = 256 GLOBAL CONST $SWP_NOOWNERZORDER = 512 GLOBAL CONST $SWP_NOREPOSITION = 512 GLOBAL CONST $SWP_NOSENDCHANGING = 1024 GLOBAL CONST $SWP_DEFERERASE = 8192 GLOBAL CONST $SWP_ASYNCWINDOWPOS = 16384 GLOBAL CONST $KEYWORD_DEFAULT = 1 GLOBAL CONST $KEYWORD_NULL = 2 GLOBAL CONST $DECLARED_LOCAL = + 4294967295 GLOBAL CONST $DECLARED_UNKNOWN = 0 GLOBAL CONST $DECLARED_GLOBAL = 1 GLOBAL CONST $ASSIGN_CREATE = 0 GLOBAL CONST $ASSIGN_FORCELOCAL = 1 GLOBAL CONST $ASSIGN_FORCEGLOBAL = 2 GLOBAL CONST $ASSIGN_EXISTFAIL = 4 GLOBAL CONST $BI_ENABLE = 0 GLOBAL CONST $BI_DISABLE = 1 GLOBAL CONST $BREAK_ENABLE = 1 GLOBAL CONST $BREAK_DISABLE = 0 GLOBAL CONST $CDTRAY_OPEN = "open" GLOBAL CONST $CDTRAY_CLOSED = "closed" GLOBAL CONST $SEND_DEFAULT = 0 GLOBAL CONST $SEND_RAW = 1 GLOBAL CONST $DIR_DEFAULT = 0 GLOBAL CONST $DIR_EXTENDED = 1 GLOBAL CONST $DIR_NORECURSE = 2 GLOBAL CONST $DIR_REMOVE = 1 GLOBAL CONST $DT_ALL = "ALL" GLOBAL CONST $DT_CDROM = "CDROM" GLOBAL CONST $DT_REMOVABLE = "REMOVABLE" GLOBAL CONST $DT_FIXED = "FIXED" GLOBAL CONST $DT_NETWORK = "NETWORK" GLOBAL CONST $DT_RAMDISK = "RAMDISK" GLOBAL CONST $DT_UNKNOWN = "UNKNOWN" GLOBAL CONST $DT_UNDEFINED = 1 GLOBAL CONST $DT_FAT = "FAT" GLOBAL CONST $DT_FAT32 = "FAT32" GLOBAL CONST $DT_EXFAT = "exFAT" GLOBAL CONST $DT_NTFS = "NTFS" GLOBAL CONST $DT_NWFS = "NWFS" GLOBAL CONST $DT_CDFS = "CDFS" GLOBAL CONST $DT_UDF = "UDF" GLOBAL CONST $DMA_DEFAULT = 0 GLOBAL CONST $DMA_PERSISTENT = 1 GLOBAL CONST $DMA_AUTHENTICATION = 8 GLOBAL CONST $DS_UNKNOWN = "UNKNOWN" GLOBAL CONST $DS_READY = "READY" GLOBAL CONST $DS_NOTREADY = "NOTREADY" GLOBAL CONST $DS_INVALID = "INVALID" GLOBAL CONST $MOUSE_CLICK_LEFT = "left" GLOBAL CONST $MOUSE_CLICK_RIGHT = "right" GLOBAL CONST $MOUSE_CLICK_MIDDLE = "middle" GLOBAL CONST $MOUSE_CLICK_MAIN = "main" GLOBAL CONST $MOUSE_CLICK_MENU = "menu" GLOBAL CONST $MOUSE_CLICK_PRIMARY = "primary" GLOBAL CONST $MOUSE_CLICK_SECONDARY = "secondary" GLOBAL CONST $MOUSE_WHEEL_UP = "up" GLOBAL CONST $MOUSE_WHEEL_DOWN = "down" GLOBAL CONST $NUMBER_AUTO = 0 GLOBAL CONST $NUMBER_32BIT = 1 GLOBAL CONST $NUMBER_64BIT = 2 GLOBAL CONST $NUMBER_DOUBLE = 3 GLOBAL CONST $OBJ_NAME = 1 GLOBAL CONST $OBJ_STRING = 2 GLOBAL CONST $OBJ_PROGID = 3 GLOBAL CONST $OBJ_FILE = 4 GLOBAL CONST $OBJ_MODULE = 5 GLOBAL CONST $OBJ_CLSID = 6 GLOBAL CONST $OBJ_IID = 7 GLOBAL CONST $EXITCLOSE_NORMAL = 0 GLOBAL CONST $EXITCLOSE_BYEXIT = 1 GLOBAL CONST $EXITCLOSE_BYCLICK = 2 GLOBAL CONST $EXITCLOSE_BYLOGOFF = 3 GLOBAL CONST $EXITCLOSE_BYSHUTDOWN = 4 GLOBAL CONST $PROCESS_STATS_MEMORY = 0 GLOBAL CONST $PROCESS_STATS_IO = 1 GLOBAL CONST $PROCESS_LOW = 0 GLOBAL CONST $PROCESS_BELOWNORMAL = 1 GLOBAL CONST $PROCESS_NORMAL = 2 GLOBAL CONST $PROCESS_ABOVENORMAL = 3 GLOBAL CONST $PROCESS_HIGH = 4 GLOBAL CONST $PROCESS_REALTIME = 5 GLOBAL CONST $RUN_LOGON_NOPROFILE = 0 GLOBAL CONST $RUN_LOGON_PROFILE = 1 GLOBAL CONST $RUN_LOGON_NETWORK = 2 GLOBAL CONST $RUN_LOGON_INHERIT = 4 GLOBAL CONST $SOUND_NOWAIT = 0 GLOBAL CONST $SOUND_WAIT = 1 GLOBAL CONST $SHEX_OPEN = "open" GLOBAL CONST $SHEX_EDIT = "edit" GLOBAL CONST $SHEX_PRINT = "print" GLOBAL CONST $SHEX_PROPERTIES = "properties" GLOBAL CONST $TCP_DATA_DEFAULT = 0 GLOBAL CONST $TCP_DATA_BINARY = 1 GLOBAL CONST $UDP_OPEN_DEFAULT = 0 GLOBAL CONST $UDP_OPEN_BROADCAST = 1 GLOBAL CONST $UDP_DATA_DEFAULT = 0 GLOBAL CONST $UDP_DATA_BINARY = 1 GLOBAL CONST $UDP_DATA_ARRAY = 2 GLOBAL CONST $TIP_NOICON = 0 GLOBAL CONST $TIP_INFOICON = 1 GLOBAL CONST $TIP_WARNINGICON = 2 GLOBAL CONST $TIP_ERRORICON = 3 GLOBAL CONST $TIP_BALLOON = 1 GLOBAL CONST $TIP_CENTER = 2 GLOBAL CONST $TIP_FORCEVISIBLE = 4 GLOBAL CONST $WINDOWS_NOONTOP = 0 GLOBAL CONST $WINDOWS_ONTOP = 1 GLOBAL CONST $WIN_STATE_EXISTS = 1 GLOBAL CONST $WIN_STATE_VISIBLE = 2 GLOBAL CONST $WIN_STATE_ENABLED = 4 GLOBAL CONST $WIN_STATE_ACTIVE = 8 GLOBAL CONST $WIN_STATE_MINIMIZED = 16 GLOBAL CONST $WIN_STATE_MAXIMIZED = 32 GLOBAL CONST $_UDF_GLOBALIDS_OFFSET = 2 GLOBAL CONST $_UDF_GLOBALID_MAX_WIN = 16 GLOBAL CONST $_UDF_STARTID = 10000 GLOBAL CONST $_UDF_GLOBALID_MAX_IDS = 55535 GLOBAL CONST $__UDFGUICONSTANT_WS_TABSTOP = 65536 GLOBAL CONST $__UDFGUICONSTANT_WS_VISIBLE = 268435456 GLOBAL CONST $__UDFGUICONSTANT_WS_CHILD = 1073741824 GLOBAL $__G_AUDF_GLOBALIDS_USED [$_UDF_GLOBALID_MAX_WIN ] [$_UDF_GLOBALID_MAX_IDS + $_UDF_GLOBALIDS_OFFSET + 1 ] FUNC __UDF_GETNEXTGLOBALID ($HWND ) LOCAL $NCTRLID , $IUSEDINDEX = + 4294967295 , $BALLUSED = TRUE IF NOT WINEXISTS ($HWND ) THEN RETURN SETERROR (+ 4294967295 , + 4294967295 , 0 ) FOR $IINDEX = 0 TO $_UDF_GLOBALID_MAX_WIN + 4294967295 IF $__G_AUDF_GLOBALIDS_USED [$IINDEX ] [0 ] <> 0 THEN IF NOT WINEXISTS ($__G_AUDF_GLOBALIDS_USED [$IINDEX ] [0 ] ) THEN FOR $X = 0 TO UBOUND ($__G_AUDF_GLOBALIDS_USED , $UBOUND_COLUMNS ) + 4294967295 $__G_AUDF_GLOBALIDS_USED [$IINDEX ] [$X ] = 0 NEXT $__G_AUDF_GLOBALIDS_USED [$IINDEX ] [1 ] = $_UDF_STARTID $BALLUSED = FALSE ENDIF ENDIF NEXT FOR $IINDEX = 0 TO $_UDF_GLOBALID_MAX_WIN + 4294967295 IF $__G_AUDF_GLOBALIDS_USED [$IINDEX ] [0 ] = $HWND THEN $IUSEDINDEX = $IINDEX EXITLOOP ENDIF NEXT IF $IUSEDINDEX = + 4294967295 THEN FOR $IINDEX = 0 TO $_UDF_GLOBALID_MAX_WIN + 4294967295 IF $__G_AUDF_GLOBALIDS_USED [$IINDEX ] [0 ] = 0 THEN $__G_AUDF_GLOBALIDS_USED [$IINDEX ] [0 ] = $HWND $__G_AUDF_GLOBALIDS_USED [$IINDEX ] [1 ] = $_UDF_STARTID $BALLUSED = FALSE $IUSEDINDEX = $IINDEX EXITLOOP ENDIF NEXT ENDIF IF $IUSEDINDEX = + 4294967295 AND $BALLUSED THEN RETURN SETERROR (16 , 0 , 0 ) IF $__G_AUDF_GLOBALIDS_USED [$IUSEDINDEX ] [1 ] = $_UDF_STARTID + $_UDF_GLOBALID_MAX_IDS THEN FOR $IIDINDEX = $_UDF_GLOBALIDS_OFFSET TO UBOUND ($__G_AUDF_GLOBALIDS_USED , $UBOUND_COLUMNS ) + 4294967295 IF $__G_AUDF_GLOBALIDS_USED [$IUSEDINDEX ] [$IIDINDEX ] = 0 THEN $NCTRLID = ($IIDINDEX - $_UDF_GLOBALIDS_OFFSET ) + 10000 $__G_AUDF_GLOBALIDS_USED [$IUSEDINDEX ] [$IIDINDEX ] = $NCTRLID RETURN $NCTRLID ENDIF NEXT RETURN SETERROR (+ 4294967295 , $_UDF_GLOBALID_MAX_IDS , 0 ) ENDIF $NCTRLID = $__G_AUDF_GLOBALIDS_USED [$IUSEDINDEX ] [1 ] $__G_AUDF_GLOBALIDS_USED [$IUSEDINDEX ] [1 ] += 1 $__G_AUDF_GLOBALIDS_USED [$IUSEDINDEX ] [($NCTRLID + 4294957296 ) + $_UDF_GLOBALIDS_OFFSET ] = $NCTRLID RETURN $NCTRLID ENDFUNC FUNC __UDF_FREEGLOBALID ($HWND , $IGLOBALID ) IF $IGLOBALID - $_UDF_STARTID < 0 OR $IGLOBALID - $_UDF_STARTID > $_UDF_GLOBALID_MAX_IDS THEN RETURN SETERROR (+ 4294967295 , 0 , FALSE ) FOR $IINDEX = 0 TO $_UDF_GLOBALID_MAX_WIN + 4294967295 IF $__G_AUDF_GLOBALIDS_USED [$IINDEX ] [0 ] = $HWND THEN FOR $X = $_UDF_GLOBALIDS_OFFSET TO UBOUND ($__G_AUDF_GLOBALIDS_USED , $UBOUND_COLUMNS ) + 4294967295 IF $__G_AUDF_GLOBALIDS_USED [$IINDEX ] [$X ] = $IGLOBALID THEN $__G_AUDF_GLOBALIDS_USED [$IINDEX ] [$X ] = 0 RETURN TRUE ENDIF NEXT RETURN SETERROR (+ 4294967293 , 0 , FALSE ) ENDIF NEXT RETURN SETERROR (+ 4294967294 , 0 , FALSE ) ENDFUNC GLOBAL CONST $FC_NOOVERWRITE = 0 GLOBAL CONST $FC_OVERWRITE = 1 GLOBAL CONST $FC_CREATEPATH = 8 GLOBAL CONST $FT_MODIFIED = 0 GLOBAL CONST $FT_CREATED = 1 GLOBAL CONST $FT_ACCESSED = 2 GLOBAL CONST $FT_ARRAY = 0 GLOBAL CONST $FT_STRING = 1 GLOBAL CONST $FSF_CREATEBUTTON = 1 GLOBAL CONST $FSF_NEWDIALOG = 2 GLOBAL CONST $FSF_EDITCONTROL = 4 GLOBAL CONST $FT_NONRECURSIVE = 0 GLOBAL CONST $FT_RECURSIVE = 1 GLOBAL CONST $FO_READ = 0 GLOBAL CONST $FO_APPEND = 1 GLOBAL CONST $FO_OVERWRITE = 2 GLOBAL CONST $FO_CREATEPATH = 8 GLOBAL CONST $FO_BINARY = 16 GLOBAL CONST $FO_UNICODE = 32 GLOBAL CONST $FO_UTF16_LE = 32 GLOBAL CONST $FO_UTF16_BE = 64 GLOBAL CONST $FO_UTF8 = 128 GLOBAL CONST $FO_UTF8_NOBOM = 256 GLOBAL CONST $FO_ANSI = 512 GLOBAL CONST $FO_UTF16_LE_NOBOM = 1024 GLOBAL CONST $FO_UTF16_BE_NOBOM = 2048 GLOBAL CONST $FO_UTF8_FULL = 16384 GLOBAL CONST $FO_FULLFILE_DETECT = 16384 GLOBAL CONST $EOF = + 4294967295 GLOBAL CONST $FD_FILEMUSTEXIST = 1 GLOBAL CONST $FD_PATHMUSTEXIST = 2 GLOBAL CONST $FD_MULTISELECT = 4 GLOBAL CONST $FD_PROMPTCREATENEW = 8 GLOBAL CONST $FD_PROMPTOVERWRITE = 16 GLOBAL CONST $CREATE_NEW = 1 GLOBAL CONST $CREATE_ALWAYS = 2 GLOBAL CONST $OPEN_EXISTING = 3 GLOBAL CONST $OPEN_ALWAYS = 4 GLOBAL CONST $TRUNCATE_EXISTING = 5 GLOBAL CONST $INVALID_SET_FILE_POINTER = + 4294967295 GLOBAL CONST $FILE_BEGIN = 0 GLOBAL CONST $FILE_CURRENT = 1 GLOBAL CONST $FILE_END = 2 GLOBAL CONST $FILE_ATTRIBUTE_READONLY = 1 GLOBAL CONST $FILE_ATTRIBUTE_HIDDEN = 2 GLOBAL CONST $FILE_ATTRIBUTE_SYSTEM = 4 GLOBAL CONST $FILE_ATTRIBUTE_DIRECTORY = 16 GLOBAL CONST $FILE_ATTRIBUTE_ARCHIVE = 32 GLOBAL CONST $FILE_ATTRIBUTE_DEVICE = 64 GLOBAL CONST $FILE_ATTRIBUTE_NORMAL = 128 GLOBAL CONST $FILE_ATTRIBUTE_TEMPORARY = 256 GLOBAL CONST $FILE_ATTRIBUTE_SPARSE_FILE = 512 GLOBAL CONST $FILE_ATTRIBUTE_REPARSE_POINT = 1024 GLOBAL CONST $FILE_ATTRIBUTE_COMPRESSED = 2048 GLOBAL CONST $FILE_ATTRIBUTE_OFFLINE = 4096 GLOBAL CONST $FILE_ATTRIBUTE_NOT_CONTENT_INDEXED = 8192 GLOBAL CONST $FILE_ATTRIBUTE_ENCRYPTED = 16384 GLOBAL CONST $FILE_SHARE_READ = 1 GLOBAL CONST $FILE_SHARE_WRITE = 2 GLOBAL CONST $FILE_SHARE_DELETE = 4 GLOBAL CONST $FILE_SHARE_READWRITE = BITOR ($FILE_SHARE_READ , $FILE_SHARE_WRITE ) GLOBAL CONST $FILE_SHARE_ANY = BITOR ($FILE_SHARE_READ , $FILE_SHARE_WRITE , $FILE_SHARE_DELETE ) GLOBAL CONST $GENERIC_ALL = 268435456 GLOBAL CONST $GENERIC_EXECUTE = 536870912 GLOBAL CONST $GENERIC_WRITE = 1073741824 GLOBAL CONST $GENERIC_READ = 2147483648 GLOBAL CONST $GENERIC_READWRITE = BITOR ($GENERIC_READ , $GENERIC_WRITE ) GLOBAL CONST $FILE_ENCODING_UTF16LE = 32 GLOBAL CONST $FE_ENTIRE_UTF8 = 1 GLOBAL CONST $FE_PARTIALFIRST_UTF8 = 2 GLOBAL CONST $FN_FULLPATH = 0 GLOBAL CONST $FN_RELATIVEPATH = 1 GLOBAL CONST $FV_COMMENTS = "Comments" GLOBAL CONST $FV_COMPANYNAME = "CompanyName" GLOBAL CONST $FV_FILEDESCRIPTION = "FileDescription" GLOBAL CONST $FV_FILEVERSION = "FileVersion" GLOBAL CONST $FV_INTERNALNAME = "InternalName" GLOBAL CONST $FV_LEGALCOPYRIGHT = "LegalCopyright" GLOBAL CONST $FV_LEGALTRADEMARKS = "LegalTrademarks" GLOBAL CONST $FV_ORIGINALFILENAME = "OriginalFilename" GLOBAL CONST $FV_PRODUCTNAME = "ProductName" GLOBAL CONST $FV_PRODUCTVERSION = "ProductVersion" GLOBAL CONST $FV_PRIVATEBUILD = "PrivateBuild" GLOBAL CONST $FV_SPECIALBUILD = "SpecialBuild" GLOBAL CONST $FRTA_NOCOUNT = 0 GLOBAL CONST $FRTA_COUNT = 1 GLOBAL CONST $FRTA_INTARRAYS = 2 GLOBAL CONST $FRTA_ENTIRESPLIT = 4 GLOBAL CONST $FLTA_FILESFOLDERS = 0 GLOBAL CONST $FLTA_FILES = 1 GLOBAL CONST $FLTA_FOLDERS = 2 GLOBAL CONST $FLTAR_FILESFOLDERS = 0 GLOBAL CONST $FLTAR_FILES = 1 GLOBAL CONST $FLTAR_FOLDERS = 2 GLOBAL CONST $FLTAR_NOHIDDEN = 4 GLOBAL CONST $FLTAR_NOSYSTEM = 8 GLOBAL CONST $FLTAR_NOLINK = 16 GLOBAL CONST $FLTAR_NORECUR = 0 GLOBAL CONST $FLTAR_RECUR = 1 GLOBAL CONST $FLTAR_NOSORT = 0 GLOBAL CONST $FLTAR_SORT = 1 GLOBAL CONST $FLTAR_FASTSORT = 2 GLOBAL CONST $FLTAR_NOPATH = 0 GLOBAL CONST $FLTAR_RELPATH = 1 GLOBAL CONST $FLTAR_FULLPATH = 2 GLOBAL CONST $PATH_ORIGINAL = 0 GLOBAL CONST $PATH_DRIVE = 1 GLOBAL CONST $PATH_DIRECTORY = 2 GLOBAL CONST $PATH_FILENAME = 3 GLOBAL CONST $PATH_EXTENSION = 4 #Region Global Variables and Constants GLOBAL $__G_VENUM , $__G_VEXT = 0 GLOBAL $__G_IRGBMODE = 1 GLOBAL CONST $TAGOSVERSIONINFO = "struct;dword OSVersionInfoSize;dword MajorVersion;dword MinorVersion;dword BuildNumber;dword PlatformId;wchar CSDVersion[128];endstruct" GLOBAL CONST $IMAGE_BITMAP = 0 GLOBAL CONST $IMAGE_ICON = 1 GLOBAL CONST $IMAGE_CURSOR = 2 GLOBAL CONST $IMAGE_ENHMETAFILE = 3 GLOBAL CONST $LR_DEFAULTCOLOR = 0 GLOBAL CONST $LR_MONOCHROME = 1 GLOBAL CONST $LR_COLOR = 2 GLOBAL CONST $LR_COPYRETURNORG = 4 GLOBAL CONST $LR_COPYDELETEORG = 8 GLOBAL CONST $LR_LOADFROMFILE = 16 GLOBAL CONST $LR_LOADTRANSPARENT = 32 GLOBAL CONST $LR_DEFAULTSIZE = 64 GLOBAL CONST $LR_VGACOLOR = 128 GLOBAL CONST $LR_LOADMAP3DCOLORS = 4096 GLOBAL CONST $LR_CREATEDIBSECTION = 8192 GLOBAL CONST $LR_COPYFROMRESOURCE = 16384 GLOBAL CONST $LR_SHARED = 32768 GLOBAL CONST $__TAGCURSORINFO = "dword Size;dword Flags;handle hCursor;" & "struct;long X;long Y;endstruct" GLOBAL CONST $__WINVER = __WINVER () #EndRegion Global Variables and Constants #Region Functions list #EndRegion Functions list #Region Public Functions FUNC _WINAPI_CREATEFILE ($SFILENAME , $ICREATION , $IACCESS = 4 , $ISHARE = 0 , $IATTRIBUTES = 0 , $TSECURITY = 0 ) LOCAL $IDA = 0 , $ISM = 0 , $ICD = 0 , $IFA = 0 IF BITAND ($IACCESS , 1 ) <> 0 THEN $IDA = BITOR ($IDA , $GENERIC_EXECUTE ) IF BITAND ($IACCESS , 2 ) <> 0 THEN $IDA = BITOR ($IDA , $GENERIC_READ ) IF BITAND ($IACCESS , 4 ) <> 0 THEN $IDA = BITOR ($IDA , $GENERIC_WRITE ) IF BITAND ($ISHARE , 1 ) <> 0 THEN $ISM = BITOR ($ISM , $FILE_SHARE_DELETE ) IF BITAND ($ISHARE , 2 ) <> 0 THEN $ISM = BITOR ($ISM , $FILE_SHARE_READ ) IF BITAND ($ISHARE , 4 ) <> 0 THEN $ISM = BITOR ($ISM , $FILE_SHARE_WRITE ) SWITCH $ICREATION CASE 0 $ICD = $CREATE_NEW CASE 1 $ICD = $CREATE_ALWAYS CASE 2 $ICD = $OPEN_EXISTING CASE 3 $ICD = $OPEN_ALWAYS CASE 4 $ICD = $TRUNCATE_EXISTING ENDSWITCH IF BITAND ($IATTRIBUTES , 1 ) <> 0 THEN $IFA = BITOR ($IFA , $FILE_ATTRIBUTE_ARCHIVE ) IF BITAND ($IATTRIBUTES , 2 ) <> 0 THEN $IFA = BITOR ($IFA , $FILE_ATTRIBUTE_HIDDEN ) IF BITAND ($IATTRIBUTES , 4 ) <> 0 THEN $IFA = BITOR ($IFA , $FILE_ATTRIBUTE_READONLY ) IF BITAND ($IATTRIBUTES , 8 ) <> 0 THEN $IFA = BITOR ($IFA , $FILE_ATTRIBUTE_SYSTEM ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "handle" , "CreateFileW" , "wstr" , $SFILENAME , "dword" , $IDA , "dword" , $ISM , "struct*" , $TSECURITY , "dword" , $ICD , "dword" , $IFA , "ptr" , 0 ) IF @ERROR OR ($ARESULT [0 ] = PTR (+ 4294967295 ) ) THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_FREELIBRARY ($HMODULE ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "bool" , "FreeLibrary" , "handle" , $HMODULE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETCURSORINFO () LOCAL $TCURSOR = DLLSTRUCTCREATE ($__TAGCURSORINFO ) LOCAL $ICURSOR = DLLSTRUCTGETSIZE ($TCURSOR ) DLLSTRUCTSETDATA ($TCURSOR , "Size" , $ICURSOR ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "GetCursorInfo" , "struct*" , $TCURSOR ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $ACURSOR [5 ] $ACURSOR [0 ] = TRUE $ACURSOR [1 ] = DLLSTRUCTGETDATA ($TCURSOR , "Flags" ) <> 0 $ACURSOR [2 ] = DLLSTRUCTGETDATA ($TCURSOR , "hCursor" ) $ACURSOR [3 ] = DLLSTRUCTGETDATA ($TCURSOR , "X" ) $ACURSOR [4 ] = DLLSTRUCTGETDATA ($TCURSOR , "Y" ) RETURN $ACURSOR ENDFUNC FUNC _WINAPI_GETDLGCTRLID ($HWND ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "int" , "GetDlgCtrlID" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETMODULEHANDLE ($SMODULENAME ) LOCAL $SMODULENAMETYPE = "wstr" IF $SMODULENAME = "" THEN $SMODULENAME = 0 $SMODULENAMETYPE = "ptr" ENDIF LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "handle" , "GetModuleHandleW" , $SMODULENAMETYPE , $SMODULENAME ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETSTRING ($PSTRING , $BUNICODE = TRUE ) LOCAL $ILENGTH = _WINAPI_STRLEN ($PSTRING , $BUNICODE ) IF @ERROR OR NOT $ILENGTH THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , "" ) LOCAL $TSTRING = DLLSTRUCTCREATE (($BUNICODE "wchar" "char" ) & "[" & ($ILENGTH + 1 ) & "]" , $PSTRING ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN SETEXTENDED ($ILENGTH , DLLSTRUCTGETDATA ($TSTRING , 1 ) ) ENDFUNC FUNC _WINAPI_ISWOW64PROCESS ($IPID = 0 ) IF NOT $IPID THEN $IPID = @AUTOITPID LOCAL $HPROCESS = DLLCALL ("kernel32.dll" , "handle" , "OpenProcess" , "dword" , ($__WINVER < 1536 1024 4096 ) , "bool" , 0 , "dword" , $IPID ) IF @ERROR OR NOT $HPROCESS [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , FALSE ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "IsWow64Process" , "handle" , $HPROCESS [0 ] , "bool*" , 0 ) IF __CHECKERRORCLOSEHANDLE ($ARET , $HPROCESS [0 ] ) THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_LOADIMAGE ($HINSTANCE , $SIMAGE , $ITYPE , $IXDESIRED , $IYDESIRED , $ILOAD ) LOCAL $ARESULT , $SIMAGETYPE = "int" IF ISSTRING ($SIMAGE ) THEN $SIMAGETYPE = "wstr" $ARESULT = DLLCALL ("user32.dll" , "handle" , "LoadImageW" , "handle" , $HINSTANCE , $SIMAGETYPE , $SIMAGE , "uint" , $ITYPE , "int" , $IXDESIRED , "int" , $IYDESIRED , "uint" , $ILOAD ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_LOADLIBRARY ($SFILENAME ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "handle" , "LoadLibraryW" , "wstr" , $SFILENAME ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_PATHISDIRECTORY ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathIsDirectoryW" , "wstr" , $SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_READFILE ($HFILE , $PBUFFER , $ITOREAD , BYREF $IREAD , $TOVERLAPPED = 0 ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "bool" , "ReadFile" , "handle" , $HFILE , "struct*" , $PBUFFER , "dword" , $ITOREAD , "dword*" , 0 , "struct*" , $TOVERLAPPED ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) $IREAD = $ARESULT [4 ] RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_STRLEN ($PSTRING , $BUNICODE = TRUE ) LOCAL $W = "" IF $BUNICODE THEN $W = "W" LOCAL $ARET = DLLCALL ("kernel32.dll" , "int" , "lstrlen" & $W , "struct*" , $PSTRING ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SWITCHCOLOR ($ICOLOR ) IF $ICOLOR = + 4294967295 THEN RETURN $ICOLOR RETURN BITOR (BITAND ($ICOLOR , 65280 ) , BITSHIFT (BITAND ($ICOLOR , 255 ) , + 4294967280 ) , BITSHIFT (BITAND ($ICOLOR , 16711680 ) , 16 ) ) ENDFUNC FUNC _WINAPI_WRITEFILE ($HFILE , $PBUFFER , $ITOWRITE , BYREF $IWRITTEN , $TOVERLAPPED = 0 ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "bool" , "WriteFile" , "handle" , $HFILE , "struct*" , $PBUFFER , "dword" , $ITOWRITE , "dword*" , 0 , "struct*" , $TOVERLAPPED ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) $IWRITTEN = $ARESULT [4 ] RETURN $ARESULT [0 ] ENDFUNC #EndRegion Public Functions #Region Internal Functions FUNC __CHECKERRORARRAYBOUNDS (CONST BYREF $ADATA , BYREF $ISTART , BYREF $IEND , $NDIM = 1 , $IDIM = $UBOUND_DIMENSIONS ) IF NOT ISARRAY ($ADATA ) THEN RETURN SETERROR (1 , 0 , 1 ) IF UBOUND ($ADATA , $IDIM ) <> $NDIM THEN RETURN SETERROR (2 , 0 , 1 ) IF $ISTART < 0 THEN $ISTART = 0 LOCAL $IUBOUND = UBOUND ($ADATA ) + 4294967295 IF $IEND < 1 OR $IEND > $IUBOUND THEN $IEND = $IUBOUND IF $ISTART > $IEND THEN RETURN SETERROR (4 , 0 , 1 ) RETURN 0 ENDFUNC FUNC __CHECKERRORCLOSEHANDLE ($ARET , $HFILE , $BLASTERROR = FALSE , $ICURERR = @ERROR , $ICUREXT = @EXTENDED ) IF NOT $ICURERR AND NOT $ARET [0 ] THEN $ICURERR = 10 LOCAL $ALASTERROR = DLLCALL ("kernel32.dll" , "dword" , "GetLastError" ) DLLCALL ("kernel32.dll" , "bool" , "CloseHandle" , "handle" , $HFILE ) IF $ICURERR THEN DLLCALL ("kernel32.dll" , "none" , "SetLastError" , "dword" , $ALASTERROR [0 ] ) IF $BLASTERROR THEN $ICUREXT = $ALASTERROR [0 ] RETURN SETERROR ($ICURERR , $ICUREXT , $ICURERR ) ENDFUNC FUNC __DLL ($SPATH , $BPIN = FALSE ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "GetModuleHandleExW" , "dword" , ($BPIN 1 2 ) , "wstr" , $SPATH , "ptr*" , 0 ) IF NOT $ARET [3 ] THEN LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "handle" , "LoadLibraryW" , "wstr" , $SPATH ) IF NOT $ARESULT [0 ] THEN RETURN 0 ENDIF RETURN 1 ENDFUNC FUNC __ENUMWINDOWSPROC ($HWND , $BVISIBLE ) LOCAL $ARESULT IF $BVISIBLE THEN $ARESULT = DLLCALL ("user32.dll" , "bool" , "IsWindowVisible" , "hwnd" , $HWND ) IF NOT $ARESULT [0 ] THEN RETURN 1 ENDIF ENDIF __INC ($__G_VENUM ) $__G_VENUM [$__G_VENUM [0 ] [0 ] ] [0 ] = $HWND $ARESULT = DLLCALL ("user32.dll" , "int" , "GetClassNameW" , "hwnd" , $HWND , "wstr" , "" , "int" , 4096 ) $__G_VENUM [$__G_VENUM [0 ] [0 ] ] [1 ] = $ARESULT [2 ] RETURN 1 ENDFUNC FUNC __FATALEXIT ($ICODE , $STEXT = "" ) IF $STEXT THEN MSGBOX ($MB_SYSTEMMODAL , "AutoIt" , $STEXT ) DLLCALL ("kernel32.dll" , "none" , "FatalExit" , "int" , $ICODE ) ENDFUNC FUNC __INC (BYREF $ADATA , $IINCREMENT = 100 ) SELECT CASE UBOUND ($ADATA , $UBOUND_COLUMNS ) IF $IINCREMENT < 0 THEN REDIM $ADATA [$ADATA [0 ] [0 ] + 1 ] [UBOUND ($ADATA , $UBOUND_COLUMNS ) ] ELSE $ADATA [0 ] [0 ] += 1 IF $ADATA [0 ] [0 ] > UBOUND ($ADATA ) + 4294967295 THEN REDIM $ADATA [$ADATA [0 ] [0 ] + $IINCREMENT ] [UBOUND ($ADATA , $UBOUND_COLUMNS ) ] ENDIF ENDIF CASE UBOUND ($ADATA , $UBOUND_ROWS ) IF $IINCREMENT < 0 THEN REDIM $ADATA [$ADATA [0 ] + 1 ] ELSE $ADATA [0 ] += 1 IF $ADATA [0 ] > UBOUND ($ADATA ) + 4294967295 THEN REDIM $ADATA [$ADATA [0 ] + $IINCREMENT ] ENDIF ENDIF CASE ELSE RETURN 0 ENDSELECT RETURN 1 ENDFUNC FUNC __RGB ($ICOLOR ) IF $__G_IRGBMODE THEN $ICOLOR = _WINAPI_SWITCHCOLOR ($ICOLOR ) ENDIF RETURN $ICOLOR ENDFUNC FUNC __WINVER () LOCAL $TOSVI = DLLSTRUCTCREATE ($TAGOSVERSIONINFO ) DLLSTRUCTSETDATA ($TOSVI , 1 , DLLSTRUCTGETSIZE ($TOSVI ) ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "GetVersionExW" , "struct*" , $TOSVI ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN BITOR (BITSHIFT (DLLSTRUCTGETDATA ($TOSVI , 2 ) , + 4294967288 ) , DLLSTRUCTGETDATA ($TOSVI , 3 ) ) ENDFUNC #EndRegion Internal Functions #Region Global Variables and Constants #EndRegion Global Variables and Constants #Region Functions list #EndRegion Functions list #Region Public Functions FUNC _WINAPI_CHARTOOEM ($SSTR ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "CharToOemW" , "wstr" , $SSTR , "wstr" , "" ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , "" ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_CLIENTTOSCREEN ($HWND , BYREF $TPOINT ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "ClientToScreen" , "hwnd" , $HWND , "struct*" , $TPOINT ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN $TPOINT ENDFUNC FUNC _WINAPI_DWORDTOFLOAT ($IVALUE ) LOCAL $TDWORD = DLLSTRUCTCREATE ("dword" ) LOCAL $TFLOAT = DLLSTRUCTCREATE ("float" , DLLSTRUCTGETPTR ($TDWORD ) ) DLLSTRUCTSETDATA ($TDWORD , 1 , $IVALUE ) RETURN DLLSTRUCTGETDATA ($TFLOAT , 1 ) ENDFUNC FUNC _WINAPI_DWORDTOINT ($IVALUE ) LOCAL $TDATA = DLLSTRUCTCREATE ("int" ) DLLSTRUCTSETDATA ($TDATA , 1 , $IVALUE ) RETURN DLLSTRUCTGETDATA ($TDATA , 1 ) ENDFUNC FUNC _WINAPI_FLOATTODWORD ($IVALUE ) LOCAL $TFLOAT = DLLSTRUCTCREATE ("float" ) LOCAL $TDWORD = DLLSTRUCTCREATE ("dword" , DLLSTRUCTGETPTR ($TFLOAT ) ) DLLSTRUCTSETDATA ($TFLOAT , 1 , $IVALUE ) RETURN DLLSTRUCTGETDATA ($TDWORD , 1 ) ENDFUNC FUNC _WINAPI_FLOATTOINT ($NFLOAT ) LOCAL $TFLOAT = DLLSTRUCTCREATE ("float" ) LOCAL $TINT = DLLSTRUCTCREATE ("int" , DLLSTRUCTGETPTR ($TFLOAT ) ) DLLSTRUCTSETDATA ($TFLOAT , 1 , $NFLOAT ) RETURN DLLSTRUCTGETDATA ($TINT , 1 ) ENDFUNC FUNC _WINAPI_GETXYFROMPOINT (BYREF $TPOINT , BYREF $IX , BYREF $IY ) $IX = DLLSTRUCTGETDATA ($TPOINT , "X" ) $IY = DLLSTRUCTGETDATA ($TPOINT , "Y" ) ENDFUNC FUNC _WINAPI_GUIDFROMSTRING ($SGUID ) LOCAL $TGUID = DLLSTRUCTCREATE ($TAGGUID ) _WINAPI_GUIDFROMSTRINGEX ($SGUID , $TGUID ) IF @ERROR THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN $TGUID ENDFUNC FUNC _WINAPI_GUIDFROMSTRINGEX ($SGUID , $TGUID ) LOCAL $ARESULT = DLLCALL ("ole32.dll" , "long" , "CLSIDFromString" , "wstr" , $SGUID , "struct*" , $TGUID ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_HASHDATA ($PMEMORY , $ISIZE , $ILENGTH = 32 ) IF ($ILENGTH <= 0 ) OR ($ILENGTH > 256 ) THEN RETURN SETERROR (11 , 0 , 0 ) LOCAL $TDATA = DLLSTRUCTCREATE ("byte[" & $ILENGTH & "]" ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "uint" , "HashData" , "struct*" , $PMEMORY , "dword" , $ISIZE , "struct*" , $TDATA , "dword" , $ILENGTH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF $ARET [0 ] THEN RETURN SETERROR (10 , $ARET [0 ] , 0 ) RETURN DLLSTRUCTGETDATA ($TDATA , 1 ) ENDFUNC FUNC _WINAPI_HASHSTRING ($SSTRING , $BCASESENSITIVE = TRUE , $ILENGTH = 32 ) LOCAL $ILENGTHS = STRINGLEN ($SSTRING ) IF NOT $ILENGTHS OR ($ILENGTH > 256 ) THEN RETURN SETERROR (12 , 0 , 0 ) LOCAL $TSTRING = DLLSTRUCTCREATE ("wchar[" & ($ILENGTHS + 1 ) & "]" ) IF NOT $BCASESENSITIVE THEN $SSTRING = STRINGLOWER ($SSTRING ) ENDIF DLLSTRUCTSETDATA ($TSTRING , 1 , $SSTRING ) LOCAL $SHASH = _WINAPI_HASHDATA ($TSTRING , 2 * $ILENGTHS , $ILENGTH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $SHASH ENDFUNC FUNC _WINAPI_HIBYTE ($IVALUE ) RETURN BITAND (BITSHIFT ($IVALUE , 8 ) , 255 ) ENDFUNC FUNC _WINAPI_HIDWORD ($IVALUE ) LOCAL $TINT64 = DLLSTRUCTCREATE ("int64" ) LOCAL $TQWORD = DLLSTRUCTCREATE ("dword;dword" , DLLSTRUCTGETPTR ($TINT64 ) ) DLLSTRUCTSETDATA ($TINT64 , 1 , $IVALUE ) RETURN DLLSTRUCTGETDATA ($TQWORD , 2 ) ENDFUNC FUNC _WINAPI_HIWORD ($ILONG ) RETURN BITSHIFT ($ILONG , 16 ) ENDFUNC FUNC _WINAPI_INTTODWORD ($IVALUE ) LOCAL $TDATA = DLLSTRUCTCREATE ("dword" ) DLLSTRUCTSETDATA ($TDATA , 1 , $IVALUE ) RETURN DLLSTRUCTGETDATA ($TDATA , 1 ) ENDFUNC FUNC _WINAPI_INTTOFLOAT ($IINT ) LOCAL $TINT = DLLSTRUCTCREATE ("int" ) LOCAL $TFLOAT = DLLSTRUCTCREATE ("float" , DLLSTRUCTGETPTR ($TINT ) ) DLLSTRUCTSETDATA ($TINT , 1 , $IINT ) RETURN DLLSTRUCTGETDATA ($TFLOAT , 1 ) ENDFUNC FUNC _WINAPI_LOBYTE ($IVALUE ) RETURN BITAND ($IVALUE , 255 ) ENDFUNC FUNC _WINAPI_LODWORD ($IVALUE ) LOCAL $TINT64 = DLLSTRUCTCREATE ("int64" ) LOCAL $TQWORD = DLLSTRUCTCREATE ("dword;dword" , DLLSTRUCTGETPTR ($TINT64 ) ) DLLSTRUCTSETDATA ($TINT64 , 1 , $IVALUE ) RETURN DLLSTRUCTGETDATA ($TQWORD , 1 ) ENDFUNC FUNC _WINAPI_LOWORD ($ILONG ) RETURN BITAND ($ILONG , 65535 ) ENDFUNC FUNC _WINAPI_LONGMID ($IVALUE , $ISTART , $ICOUNT ) RETURN BITAND (BITSHIFT ($IVALUE , $ISTART ) , BITOR (BITSHIFT (BITSHIFT (2147483647 , 32 - ($ICOUNT + 1 ) ) , 1 ) , BITSHIFT (1 , - ($ICOUNT + 4294967295 ) ) ) ) ENDFUNC FUNC _WINAPI_MAKELANGID ($ILNGIDPRIMARY , $ILNGIDSUB ) RETURN BITOR (BITSHIFT ($ILNGIDSUB , + 4294967286 ) , $ILNGIDPRIMARY ) ENDFUNC FUNC _WINAPI_MAKELCID ($ILNGID , $ISORTID ) RETURN BITOR (BITSHIFT ($ISORTID , + 4294967280 ) , $ILNGID ) ENDFUNC FUNC _WINAPI_MAKELONG ($ILO , $IHI ) RETURN BITOR (BITSHIFT ($IHI , + 4294967280 ) , BITAND ($ILO , 65535 ) ) ENDFUNC FUNC _WINAPI_MAKEQWORD ($ILODWORD , $IHIDWORD ) LOCAL $TINT64 = DLLSTRUCTCREATE ("uint64" ) LOCAL $TDWORDS = DLLSTRUCTCREATE ("dword;dword" , DLLSTRUCTGETPTR ($TINT64 ) ) DLLSTRUCTSETDATA ($TDWORDS , 1 , $ILODWORD ) DLLSTRUCTSETDATA ($TDWORDS , 2 , $IHIDWORD ) RETURN DLLSTRUCTGETDATA ($TINT64 , 1 ) ENDFUNC FUNC _WINAPI_MAKEWORD ($ILO , $IHI ) LOCAL $TWORD = DLLSTRUCTCREATE ("ushort" ) LOCAL $TBYTE = DLLSTRUCTCREATE ("byte;byte" , DLLSTRUCTGETPTR ($TWORD ) ) DLLSTRUCTSETDATA ($TBYTE , 1 , $IHI ) DLLSTRUCTSETDATA ($TBYTE , 2 , $ILO ) RETURN DLLSTRUCTGETDATA ($TWORD , 1 ) ENDFUNC FUNC _WINAPI_MULTIBYTETOWIDECHAR ($VTEXT , $ICODEPAGE = 0 , $IFLAGS = 0 , $BRETSTRING = FALSE ) LOCAL $STEXTTYPE = "str" IF NOT ISSTRING ($VTEXT ) THEN $STEXTTYPE = "struct*" LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "int" , "MultiByteToWideChar" , "uint" , $ICODEPAGE , "dword" , $IFLAGS , $STEXTTYPE , $VTEXT , "int" , + 4294967295 , "ptr" , 0 , "int" , 0 ) IF @ERROR OR NOT $ARESULT [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $IOUT = $ARESULT [0 ] LOCAL $TOUT = DLLSTRUCTCREATE ("wchar[" & $IOUT & "]" ) $ARESULT = DLLCALL ("kernel32.dll" , "int" , "MultiByteToWideChar" , "uint" , $ICODEPAGE , "dword" , $IFLAGS , $STEXTTYPE , $VTEXT , "int" , + 4294967295 , "struct*" , $TOUT , "int" , $IOUT ) IF @ERROR OR NOT $ARESULT [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , 0 ) IF $BRETSTRING THEN RETURN DLLSTRUCTGETDATA ($TOUT , 1 ) RETURN $TOUT ENDFUNC FUNC _WINAPI_MULTIBYTETOWIDECHAREX ($STEXT , $PTEXT , $ICODEPAGE = 0 , $IFLAGS = 0 ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "int" , "MultiByteToWideChar" , "uint" , $ICODEPAGE , "dword" , $IFLAGS , "STR" , $STEXT , "int" , + 4294967295 , "struct*" , $PTEXT , "int" , (STRINGLEN ($STEXT ) + 1 ) * 2 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_OEMTOCHAR ($SSTR ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "OemToChar" , "str" , $SSTR , "str" , "" ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , "" ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_POINTFROMRECT (BYREF $TRECT , $BCENTER = TRUE ) LOCAL $IX1 = DLLSTRUCTGETDATA ($TRECT , "Left" ) LOCAL $IY1 = DLLSTRUCTGETDATA ($TRECT , "Top" ) LOCAL $IX2 = DLLSTRUCTGETDATA ($TRECT , "Right" ) LOCAL $IY2 = DLLSTRUCTGETDATA ($TRECT , "Bottom" ) IF $BCENTER THEN $IX1 = $IX1 + (($IX2 - $IX1 ) / 2 ) $IY1 = $IY1 + (($IY2 - $IY1 ) / 2 ) ENDIF LOCAL $TPOINT = DLLSTRUCTCREATE ($TAGPOINT ) DLLSTRUCTSETDATA ($TPOINT , "X" , $IX1 ) DLLSTRUCTSETDATA ($TPOINT , "Y" , $IY1 ) RETURN $TPOINT ENDFUNC FUNC _WINAPI_PRIMARYLANGID ($ILNGID ) RETURN BITAND ($ILNGID , 1023 ) ENDFUNC FUNC _WINAPI_SCREENTOCLIENT ($HWND , BYREF $TPOINT ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "ScreenToClient" , "hwnd" , $HWND , "struct*" , $TPOINT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_SHORTTOWORD ($IVALUE ) RETURN BITAND ($IVALUE , 65535 ) ENDFUNC FUNC _WINAPI_STRFORMATBYTESIZE ($ISIZE ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "ptr" , "StrFormatByteSizeW" , "int64" , $ISIZE , "wstr" , "" , "uint" , 1024 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , "" ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_STRFORMATBYTESIZEEX ($ISIZE ) LOCAL $ASYMBOL = DLLCALL ("kernel32.dll" , "int" , "GetLocaleInfoW" , "dword" , 1024 , "dword" , 15 , "wstr" , "" , "int" , 2048 ) IF @ERROR THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , "" ) LOCAL $SSIZE = _WINAPI_STRFORMATBYTESIZE (0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN STRINGREPLACE ($SSIZE , "0" , STRINGREGEXPREPLACE (NUMBER ($ISIZE ) , "(?<=\d)(?=(\d{3})+\z)" , $ASYMBOL [3 ] ) ) ENDFUNC FUNC _WINAPI_STRFORMATKBSIZE ($ISIZE ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "ptr" , "StrFormatKBSizeW" , "int64" , $ISIZE , "wstr" , "" , "uint" , 1024 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , "" ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_STRFROMTIMEINTERVAL ($ITIME , $IDIGITS = 7 ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "int" , "StrFromTimeIntervalW" , "wstr" , "" , "uint" , 1024 , "dword" , $ITIME , "int" , $IDIGITS ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , "" ) RETURN STRINGSTRIPWS ($ARET [1 ] , $STR_STRIPLEADING + $STR_STRIPTRAILING ) ENDFUNC FUNC _WINAPI_STRINGFROMGUID ($TGUID ) LOCAL $ARESULT = DLLCALL ("ole32.dll" , "int" , "StringFromGUID2" , "struct*" , $TGUID , "wstr" , "" , "int" , 40 ) IF @ERROR OR NOT $ARESULT [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN SETEXTENDED ($ARESULT [0 ] , $ARESULT [2 ] ) ENDFUNC FUNC _WINAPI_SUBLANGID ($ILNGID ) RETURN BITSHIFT ($ILNGID , 10 ) ENDFUNC FUNC _WINAPI_SWAPDWORD ($IVALUE ) LOCAL $TSTRUCT1 = DLLSTRUCTCREATE ("dword;dword" ) LOCAL $TSTRUCT2 = DLLSTRUCTCREATE ("byte[4];byte[4]" , DLLSTRUCTGETPTR ($TSTRUCT1 ) ) DLLSTRUCTSETDATA ($TSTRUCT1 , 1 , $IVALUE ) FOR $I = 1 TO 4 DLLSTRUCTSETDATA ($TSTRUCT2 , 2 , DLLSTRUCTGETDATA ($TSTRUCT2 , 1 , 5 - $I ) , $I ) NEXT RETURN DLLSTRUCTGETDATA ($TSTRUCT1 , 2 ) ENDFUNC FUNC _WINAPI_SWAPQWORD ($IVALUE ) LOCAL $TSTRUCT1 = DLLSTRUCTCREATE ("int64;int64" ) LOCAL $TSTRUCT2 = DLLSTRUCTCREATE ("byte[8];byte[8]" , DLLSTRUCTGETPTR ($TSTRUCT1 ) ) DLLSTRUCTSETDATA ($TSTRUCT1 , 1 , $IVALUE ) FOR $I = 1 TO 8 DLLSTRUCTSETDATA ($TSTRUCT2 , 2 , DLLSTRUCTGETDATA ($TSTRUCT2 , 1 , 9 - $I ) , $I ) NEXT RETURN DLLSTRUCTGETDATA ($TSTRUCT1 , 2 ) ENDFUNC FUNC _WINAPI_SWAPWORD ($IVALUE ) LOCAL $TSTRUCT1 = DLLSTRUCTCREATE ("word;word" ) LOCAL $TSTRUCT2 = DLLSTRUCTCREATE ("byte[2];byte[2]" , DLLSTRUCTGETPTR ($TSTRUCT1 ) ) DLLSTRUCTSETDATA ($TSTRUCT1 , 1 , $IVALUE ) FOR $I = 1 TO 2 DLLSTRUCTSETDATA ($TSTRUCT2 , 2 , DLLSTRUCTGETDATA ($TSTRUCT2 , 1 , 3 - $I ) , $I ) NEXT RETURN DLLSTRUCTGETDATA ($TSTRUCT1 , 2 ) ENDFUNC FUNC _WINAPI_WIDECHARTOMULTIBYTE ($VUNICODE , $ICODEPAGE = 0 , $BRETNOSTRUCT = TRUE , $BRETBINARY = FALSE ) LOCAL $SUNICODETYPE = "wstr" IF NOT ISSTRING ($VUNICODE ) THEN $SUNICODETYPE = "struct*" LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "int" , "WideCharToMultiByte" , "uint" , $ICODEPAGE , "dword" , 0 , $SUNICODETYPE , $VUNICODE , "int" , + 4294967295 , "ptr" , 0 , "int" , 0 , "ptr" , 0 , "ptr" , 0 ) IF @ERROR OR NOT $ARESULT [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , "" ) LOCAL $TMULTIBYTE = DLLSTRUCTCREATE ((($BRETBINARY ) ("byte" ) ("char" ) ) & "[" & $ARESULT [0 ] & "]" ) $ARESULT = DLLCALL ("kernel32.dll" , "int" , "WideCharToMultiByte" , "uint" , $ICODEPAGE , "dword" , 0 , $SUNICODETYPE , $VUNICODE , "int" , + 4294967295 , "struct*" , $TMULTIBYTE , "int" , $ARESULT [0 ] , "ptr" , 0 , "ptr" , 0 ) IF @ERROR OR NOT $ARESULT [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , "" ) IF $BRETNOSTRUCT THEN RETURN DLLSTRUCTGETDATA ($TMULTIBYTE , 1 ) RETURN $TMULTIBYTE ENDFUNC FUNC _WINAPI_WORDTOSHORT ($IVALUE ) IF BITAND ($IVALUE , 32768 ) THEN RETURN BITOR ($IVALUE , 4294934528 ) ENDIF RETURN BITAND ($IVALUE , 32767 ) ENDFUNC #EndRegion Public Functions #Region Global Variables and Constants GLOBAL $__G_AINPROCESS_WINAPI [64 ] [2 ] = [[0 , 0 ] ] GLOBAL $__G_AWINLIST_WINAPI [64 ] [2 ] = [[0 , 0 ] ] GLOBAL CONST $GW_HWNDFIRST = 0 GLOBAL CONST $GW_HWNDLAST = 1 GLOBAL CONST $GW_HWNDNEXT = 2 GLOBAL CONST $GW_HWNDPREV = 3 GLOBAL CONST $GW_OWNER = 4 GLOBAL CONST $GW_CHILD = 5 GLOBAL CONST $GW_ENABLEDPOPUP = 6 GLOBAL CONST $GWL_WNDPROC = 4294967292 GLOBAL CONST $GWL_HINSTANCE = 4294967290 GLOBAL CONST $GWL_HWNDPARENT = 4294967288 GLOBAL CONST $GWL_ID = 4294967284 GLOBAL CONST $GWL_STYLE = 4294967280 GLOBAL CONST $GWL_EXSTYLE = 4294967276 GLOBAL CONST $GWL_USERDATA = 4294967275 GLOBAL CONST $__WINAPICONSTANT_WM_SETFONT = 48 #EndRegion Global Variables and Constants #Region Functions list #EndRegion Functions list #Region Public Functions FUNC _WINAPI_CREATEWINDOWEX ($IEXSTYLE , $SCLASS , $SNAME , $ISTYLE , $IX , $IY , $IWIDTH , $IHEIGHT , $HPARENT , $HMENU = 0 , $HINSTANCE = 0 , $PPARAM = 0 ) IF $HINSTANCE = 0 THEN $HINSTANCE = _WINAPI_GETMODULEHANDLE ("" ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "hwnd" , "CreateWindowExW" , "dword" , $IEXSTYLE , "wstr" , $SCLASS , "wstr" , $SNAME , "dword" , $ISTYLE , "int" , $IX , "int" , $IY , "int" , $IWIDTH , "int" , $IHEIGHT , "hwnd" , $HPARENT , "handle" , $HMENU , "handle" , $HINSTANCE , "struct*" , $PPARAM ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETCLIENTRECT ($HWND ) LOCAL $TRECT = DLLSTRUCTCREATE ($TAGRECT ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "GetClientRect" , "hwnd" , $HWND , "struct*" , $TRECT ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN $TRECT ENDFUNC FUNC _WINAPI_GETDESKTOPWINDOW () LOCAL $ARESULT = DLLCALL ("user32.dll" , "hwnd" , "GetDesktopWindow" ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_DESTROYWINDOW ($HWND ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "DestroyWindow" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_ENABLEWINDOW ($HWND , $BENABLE = TRUE ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "EnableWindow" , "hwnd" , $HWND , "bool" , $BENABLE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_ENUMWINDOWS ($BVISIBLE = TRUE , $HWND = DEFAULT ) __WINAPI_ENUMWINDOWSINIT () IF $HWND = DEFAULT THEN $HWND = _WINAPI_GETDESKTOPWINDOW () __WINAPI_ENUMWINDOWSCHILD ($HWND , $BVISIBLE ) RETURN $__G_AWINLIST_WINAPI ENDFUNC FUNC _WINAPI_ENUMWINDOWSPOPUP () __WINAPI_ENUMWINDOWSINIT () LOCAL $HWND = _WINAPI_GETWINDOW (_WINAPI_GETDESKTOPWINDOW () , $GW_CHILD ) LOCAL $SCLASS WHILE $HWND <> 0 IF _WINAPI_ISWINDOWVISIBLE ($HWND ) THEN $SCLASS = _WINAPI_GETCLASSNAME ($HWND ) IF $SCLASS = "#32768" THEN __WINAPI_ENUMWINDOWSADD ($HWND ) ELSEIF $SCLASS = "ToolbarWindow32" THEN __WINAPI_ENUMWINDOWSADD ($HWND ) ELSEIF $SCLASS = "ToolTips_Class32" THEN __WINAPI_ENUMWINDOWSADD ($HWND ) ELSEIF $SCLASS = "BaseBar" THEN __WINAPI_ENUMWINDOWSCHILD ($HWND ) ENDIF ENDIF $HWND = _WINAPI_GETWINDOW ($HWND , $GW_HWNDNEXT ) WEND RETURN $__G_AWINLIST_WINAPI ENDFUNC FUNC _WINAPI_ENUMWINDOWSTOP () __WINAPI_ENUMWINDOWSINIT () LOCAL $HWND = _WINAPI_GETWINDOW (_WINAPI_GETDESKTOPWINDOW () , $GW_CHILD ) WHILE $HWND <> 0 IF _WINAPI_ISWINDOWVISIBLE ($HWND ) THEN __WINAPI_ENUMWINDOWSADD ($HWND ) $HWND = _WINAPI_GETWINDOW ($HWND , $GW_HWNDNEXT ) WEND RETURN $__G_AWINLIST_WINAPI ENDFUNC FUNC _WINAPI_GETCLASSNAME ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "int" , "GetClassNameW" , "hwnd" , $HWND , "wstr" , "" , "int" , 4096 ) IF @ERROR OR NOT $ARESULT [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN SETEXTENDED ($ARESULT [0 ] , $ARESULT [2 ] ) ENDFUNC FUNC _WINAPI_GETFOCUS () LOCAL $ARESULT = DLLCALL ("user32.dll" , "hwnd" , "GetFocus" ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETPARENT ($HWND ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "hwnd" , "GetParent" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETSYSCOLOR ($IINDEX ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "INT" , "GetSysColor" , "int" , $IINDEX ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETSYSTEMMETRICS ($IINDEX ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "int" , "GetSystemMetrics" , "int" , $IINDEX ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETWINDOW ($HWND , $ICMD ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "hwnd" , "GetWindow" , "hwnd" , $HWND , "uint" , $ICMD ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETWINDOWHEIGHT ($HWND ) LOCAL $TRECT = _WINAPI_GETWINDOWRECT ($HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN DLLSTRUCTGETDATA ($TRECT , "Bottom" ) - DLLSTRUCTGETDATA ($TRECT , "Top" ) ENDFUNC FUNC _WINAPI_GETWINDOWLONG ($HWND , $IINDEX ) LOCAL $SFUNCNAME = "GetWindowLongW" IF @AUTOITX64 THEN $SFUNCNAME = "GetWindowLongPtrW" LOCAL $ARESULT = DLLCALL ("user32.dll" , "long_ptr" , $SFUNCNAME , "hwnd" , $HWND , "int" , $IINDEX ) IF @ERROR OR NOT $ARESULT [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETWINDOWRECT ($HWND ) LOCAL $TRECT = DLLSTRUCTCREATE ($TAGRECT ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "GetWindowRect" , "hwnd" , $HWND , "struct*" , $TRECT ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN $TRECT ENDFUNC FUNC _WINAPI_GETWINDOWTEXT ($HWND ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "int" , "GetWindowTextW" , "hwnd" , $HWND , "wstr" , "" , "int" , 4096 ) IF @ERROR OR NOT $ARESULT [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , "" ) RETURN SETEXTENDED ($ARESULT [0 ] , $ARESULT [2 ] ) ENDFUNC FUNC _WINAPI_GETWINDOWTHREADPROCESSID ($HWND , BYREF $IPID ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "dword" , "GetWindowThreadProcessId" , "hwnd" , $HWND , "dword*" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) $IPID = $ARESULT [2 ] RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETWINDOWWIDTH ($HWND ) LOCAL $TRECT = _WINAPI_GETWINDOWRECT ($HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN DLLSTRUCTGETDATA ($TRECT , "Right" ) - DLLSTRUCTGETDATA ($TRECT , "Left" ) ENDFUNC FUNC _WINAPI_INPROCESS ($HWND , BYREF $HLASTWND ) IF $HWND = $HLASTWND THEN RETURN TRUE FOR $II = $__G_AINPROCESS_WINAPI [0 ] [0 ] TO 1 STEP + 4294967295 IF $HWND = $__G_AINPROCESS_WINAPI [$II ] [0 ] THEN IF $__G_AINPROCESS_WINAPI [$II ] [1 ] THEN $HLASTWND = $HWND RETURN TRUE ELSE RETURN FALSE ENDIF ENDIF NEXT LOCAL $IPID _WINAPI_GETWINDOWTHREADPROCESSID ($HWND , $IPID ) LOCAL $ICOUNT = $__G_AINPROCESS_WINAPI [0 ] [0 ] + 1 IF $ICOUNT >= 64 THEN $ICOUNT = 1 $__G_AINPROCESS_WINAPI [0 ] [0 ] = $ICOUNT $__G_AINPROCESS_WINAPI [$ICOUNT ] [0 ] = $HWND $__G_AINPROCESS_WINAPI [$ICOUNT ] [1 ] = ($IPID = @AUTOITPID ) RETURN $__G_AINPROCESS_WINAPI [$ICOUNT ] [1 ] ENDFUNC FUNC _WINAPI_INVALIDATERECT ($HWND , $TRECT = 0 , $BERASE = TRUE ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "InvalidateRect" , "hwnd" , $HWND , "struct*" , $TRECT , "bool" , $BERASE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_ISCLASSNAME ($HWND , $SCLASSNAME ) LOCAL $SSEPARATOR = OPT ("GUIDataSeparatorChar" ) LOCAL $ACLASSNAME = STRINGSPLIT ($SCLASSNAME , $SSEPARATOR ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $SCLASSCHECK = _WINAPI_GETCLASSNAME ($HWND ) FOR $X = 1 TO UBOUND ($ACLASSNAME ) + 4294967295 IF STRINGUPPER (STRINGMID ($SCLASSCHECK , 1 , STRINGLEN ($ACLASSNAME [$X ] ) ) ) = STRINGUPPER ($ACLASSNAME [$X ] ) THEN RETURN TRUE NEXT RETURN FALSE ENDFUNC FUNC _WINAPI_ISWINDOW ($HWND ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "IsWindow" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_ISWINDOWVISIBLE ($HWND ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "IsWindowVisible" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_MOVEWINDOW ($HWND , $IX , $IY , $IWIDTH , $IHEIGHT , $BREPAINT = TRUE ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "MoveWindow" , "hwnd" , $HWND , "int" , $IX , "int" , $IY , "int" , $IWIDTH , "int" , $IHEIGHT , "bool" , $BREPAINT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_SETFOCUS ($HWND ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "hwnd" , "SetFocus" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_SETFONT ($HWND , $HFONT , $BREDRAW = TRUE ) _SENDMESSAGE ($HWND , $__WINAPICONSTANT_WM_SETFONT , $HFONT , $BREDRAW , 0 , "hwnd" ) ENDFUNC FUNC _WINAPI_SETPARENT ($HWNDCHILD , $HWNDPARENT ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "hwnd" , "SetParent" , "hwnd" , $HWNDCHILD , "hwnd" , $HWNDPARENT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_SETWINDOWPOS ($HWND , $HAFTER , $IX , $IY , $ICX , $ICY , $IFLAGS ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "SetWindowPos" , "hwnd" , $HWND , "hwnd" , $HAFTER , "int" , $IX , "int" , $IY , "int" , $ICX , "int" , $ICY , "uint" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_SETWINDOWTEXT ($HWND , $STEXT ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "SetWindowTextW" , "hwnd" , $HWND , "wstr" , $STEXT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_SHOWWINDOW ($HWND , $ICMDSHOW = 5 ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "ShowWindow" , "hwnd" , $HWND , "int" , $ICMDSHOW ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_UPDATEWINDOW ($HWND ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "UpdateWindow" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC #EndRegion Public Functions #Region Internal Functions FUNC __WINAPI_ENUMWINDOWSADD ($HWND , $SCLASS = "" ) IF $SCLASS = "" THEN $SCLASS = _WINAPI_GETCLASSNAME ($HWND ) $__G_AWINLIST_WINAPI [0 ] [0 ] += 1 LOCAL $ICOUNT = $__G_AWINLIST_WINAPI [0 ] [0 ] IF $ICOUNT >= $__G_AWINLIST_WINAPI [0 ] [1 ] THEN REDIM $__G_AWINLIST_WINAPI [$ICOUNT + 64 ] [2 ] $__G_AWINLIST_WINAPI [0 ] [1 ] += 64 ENDIF $__G_AWINLIST_WINAPI [$ICOUNT ] [0 ] = $HWND $__G_AWINLIST_WINAPI [$ICOUNT ] [1 ] = $SCLASS ENDFUNC FUNC __WINAPI_ENUMWINDOWSCHILD ($HWND , $BVISIBLE = TRUE ) $HWND = _WINAPI_GETWINDOW ($HWND , $GW_CHILD ) WHILE $HWND <> 0 IF (NOT $BVISIBLE ) OR _WINAPI_ISWINDOWVISIBLE ($HWND ) THEN __WINAPI_ENUMWINDOWSADD ($HWND ) __WINAPI_ENUMWINDOWSCHILD ($HWND , $BVISIBLE ) ENDIF $HWND = _WINAPI_GETWINDOW ($HWND , $GW_HWNDNEXT ) WEND ENDFUNC FUNC __WINAPI_ENUMWINDOWSINIT () REDIM $__G_AWINLIST_WINAPI [64 ] [2 ] $__G_AWINLIST_WINAPI [0 ] [0 ] = 0 $__G_AWINLIST_WINAPI [0 ] [1 ] = 64 ENDFUNC #EndRegion Internal Functions GLOBAL $__G_HSBLASTWND GLOBAL CONST $__STATUSBARCONSTANT_CLASSNAME = "msctls_statusbar32" GLOBAL CONST $__STATUSBARCONSTANT_WM_SIZE = 5 GLOBAL CONST $__STATUSBARCONSTANT_CLR_DEFAULT = 4278190080 GLOBAL CONST $TAGBORDERS = "int BX;int BY;int RX" FUNC _GUICTRLSTATUSBAR_CREATE ($HWND , $VPARTEDGE = + 4294967295 , $VPARTTEXT = "" , $ISTYLES = + 4294967295 , $IEXSTYLES = 0 ) IF NOT ISHWND ($HWND ) THEN RETURN SETERROR (1 , 0 , 0 ) LOCAL $ISTYLE = BITOR ($__UDFGUICONSTANT_WS_CHILD , $__UDFGUICONSTANT_WS_VISIBLE ) IF $ISTYLES = + 4294967295 THEN $ISTYLES = 0 IF $IEXSTYLES = + 4294967295 THEN $IEXSTYLES = 0 LOCAL $APARTWIDTH [1 ] , $APARTTEXT [1 ] IF @NUMPARAMS > 1 THEN IF ISARRAY ($VPARTEDGE ) THEN $APARTWIDTH = $VPARTEDGE ELSE $APARTWIDTH [0 ] = $VPARTEDGE ENDIF IF @NUMPARAMS = 2 THEN REDIM $APARTTEXT [UBOUND ($APARTWIDTH ) ] ELSE IF ISARRAY ($VPARTTEXT ) THEN $APARTTEXT = $VPARTTEXT ELSE $APARTTEXT [0 ] = $VPARTTEXT ENDIF IF UBOUND ($APARTWIDTH ) <> UBOUND ($APARTTEXT ) THEN LOCAL $ILAST IF UBOUND ($APARTWIDTH ) > UBOUND ($APARTTEXT ) THEN $ILAST = UBOUND ($APARTTEXT ) REDIM $APARTTEXT [UBOUND ($APARTWIDTH ) ] ELSE $ILAST = UBOUND ($APARTWIDTH ) REDIM $APARTWIDTH [UBOUND ($APARTTEXT ) ] FOR $X = $ILAST TO UBOUND ($APARTWIDTH ) + 4294967295 $APARTWIDTH [$X ] = $APARTWIDTH [$X + 4294967295 ] + 75 NEXT $APARTWIDTH [UBOUND ($APARTTEXT ) + 4294967295 ] = + 4294967295 ENDIF ENDIF ENDIF IF NOT ISHWND ($HWND ) THEN $HWND = HWND ($HWND ) IF @NUMPARAMS > 3 THEN $ISTYLE = BITOR ($ISTYLE , $ISTYLES ) ENDIF LOCAL $NCTRLID = __UDF_GETNEXTGLOBALID ($HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) LOCAL $HWNDSBAR = _WINAPI_CREATEWINDOWEX ($IEXSTYLES , $__STATUSBARCONSTANT_CLASSNAME , "" , $ISTYLE , 0 , 0 , 0 , 0 , $HWND , $NCTRLID ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF @NUMPARAMS > 1 THEN _GUICTRLSTATUSBAR_SETPARTS ($HWNDSBAR , UBOUND ($APARTWIDTH ) , $APARTWIDTH ) FOR $X = 0 TO UBOUND ($APARTTEXT ) + 4294967295 _GUICTRLSTATUSBAR_SETTEXT ($HWNDSBAR , $APARTTEXT [$X ] , $X ) NEXT ENDIF RETURN $HWNDSBAR ENDFUNC FUNC _GUICTRLSTATUSBAR_DESTROY (BYREF $HWND ) IF NOT _WINAPI_ISCLASSNAME ($HWND , $__STATUSBARCONSTANT_CLASSNAME ) THEN RETURN SETERROR (2 , 2 , FALSE ) LOCAL $IDESTROYED = 0 IF ISHWND ($HWND ) THEN IF _WINAPI_INPROCESS ($HWND , $__G_HSBLASTWND ) THEN LOCAL $NCTRLID = _WINAPI_GETDLGCTRLID ($HWND ) LOCAL $HPARENT = _WINAPI_GETPARENT ($HWND ) $IDESTROYED = _WINAPI_DESTROYWINDOW ($HWND ) LOCAL $IRET = __UDF_FREEGLOBALID ($HPARENT , $NCTRLID ) IF NOT $IRET THEN ENDIF ELSE RETURN SETERROR (1 , 1 , FALSE ) ENDIF ENDIF IF $IDESTROYED THEN $HWND = 0 RETURN $IDESTROYED <> 0 ENDFUNC FUNC _GUICTRLSTATUSBAR_EMBEDCONTROL ($HWND , $IPART , $HCONTROL , $IFIT = 4 ) LOCAL $ARECT = _GUICTRLSTATUSBAR_GETRECT ($HWND , $IPART ) LOCAL $IBARX = $ARECT [0 ] LOCAL $IBARY = $ARECT [1 ] LOCAL $IBARW = $ARECT [2 ] - $IBARX LOCAL $IBARH = $ARECT [3 ] - $IBARY LOCAL $ICONX = $IBARX LOCAL $ICONY = $IBARY LOCAL $ICONW = _WINAPI_GETWINDOWWIDTH ($HCONTROL ) LOCAL $ICONH = _WINAPI_GETWINDOWHEIGHT ($HCONTROL ) IF $ICONW > $IBARW THEN $ICONW = $IBARW IF $ICONH > $IBARH THEN $ICONH = $IBARH LOCAL $IPADX = ($IBARW - $ICONW ) / 2 LOCAL $IPADY = ($IBARH - $ICONH ) / 2 IF $IPADX < 0 THEN $IPADX = 0 IF $IPADY < 0 THEN $IPADY = 0 IF BITAND ($IFIT , 1 ) = 1 THEN $ICONX = $IBARX + $IPADX IF BITAND ($IFIT , 2 ) = 2 THEN $ICONY = $IBARY + $IPADY IF BITAND ($IFIT , 4 ) = 4 THEN $IPADX = _GUICTRLSTATUSBAR_GETBORDERSRECT ($HWND ) $IPADY = _GUICTRLSTATUSBAR_GETBORDERSVERT ($HWND ) $ICONX = $IBARX IF _GUICTRLSTATUSBAR_ISSIMPLE ($HWND ) THEN $ICONX += $IPADX $ICONY = $IBARY + $IPADY $ICONW = $IBARW - ($IPADX * 2 ) $ICONH = $IBARH - ($IPADY * 2 ) ENDIF _WINAPI_SETPARENT ($HCONTROL , $HWND ) _WINAPI_MOVEWINDOW ($HCONTROL , $ICONX , $ICONY , $ICONW , $ICONH ) ENDFUNC FUNC _GUICTRLSTATUSBAR_GETBORDERS ($HWND ) LOCAL $TBORDERS = DLLSTRUCTCREATE ($TAGBORDERS ) LOCAL $IRET IF _WINAPI_INPROCESS ($HWND , $__G_HSBLASTWND ) THEN $IRET = _SENDMESSAGE ($HWND , $SB_GETBORDERS , 0 , $TBORDERS , 0 , "wparam" , "struct*" ) ELSE LOCAL $ISIZE = DLLSTRUCTGETSIZE ($TBORDERS ) LOCAL $TMEMMAP LOCAL $PMEMORY = _MEMINIT ($HWND , $ISIZE , $TMEMMAP ) $IRET = _SENDMESSAGE ($HWND , $SB_GETBORDERS , 0 , $PMEMORY , 0 , "wparam" , "ptr" ) _MEMREAD ($TMEMMAP , $PMEMORY , $TBORDERS , $ISIZE ) _MEMFREE ($TMEMMAP ) ENDIF LOCAL $ABORDERS [3 ] IF $IRET = 0 THEN RETURN SETERROR (+ 4294967295 , + 4294967295 , $ABORDERS ) $ABORDERS [0 ] = DLLSTRUCTGETDATA ($TBORDERS , "BX" ) $ABORDERS [1 ] = DLLSTRUCTGETDATA ($TBORDERS , "BY" ) $ABORDERS [2 ] = DLLSTRUCTGETDATA ($TBORDERS , "RX" ) RETURN $ABORDERS ENDFUNC FUNC _GUICTRLSTATUSBAR_GETBORDERSHORZ ($HWND ) LOCAL $ABORDERS = _GUICTRLSTATUSBAR_GETBORDERS ($HWND ) RETURN SETERROR (@ERROR , @EXTENDED , $ABORDERS [0 ] ) ENDFUNC FUNC _GUICTRLSTATUSBAR_GETBORDERSRECT ($HWND ) LOCAL $ABORDERS = _GUICTRLSTATUSBAR_GETBORDERS ($HWND ) RETURN SETERROR (@ERROR , @EXTENDED , $ABORDERS [2 ] ) ENDFUNC FUNC _GUICTRLSTATUSBAR_GETBORDERSVERT ($HWND ) LOCAL $ABORDERS = _GUICTRLSTATUSBAR_GETBORDERS ($HWND ) RETURN SETERROR (@ERROR , @EXTENDED , $ABORDERS [1 ] ) ENDFUNC FUNC _GUICTRLSTATUSBAR_GETCOUNT ($HWND ) RETURN _SENDMESSAGE ($HWND , $SB_GETPARTS ) ENDFUNC FUNC _GUICTRLSTATUSBAR_GETHEIGHT ($HWND ) LOCAL $TRECT = _GUICTRLSTATUSBAR_GETRECTEX ($HWND , 0 ) RETURN DLLSTRUCTGETDATA ($TRECT , "Bottom" ) - DLLSTRUCTGETDATA ($TRECT , "Top" ) - (_GUICTRLSTATUSBAR_GETBORDERSVERT ($HWND ) * 2 ) ENDFUNC FUNC _GUICTRLSTATUSBAR_GETICON ($HWND , $IINDEX = 0 ) RETURN _SENDMESSAGE ($HWND , $SB_GETICON , $IINDEX , 0 , 0 , "wparam" , "lparam" , "handle" ) ENDFUNC FUNC _GUICTRLSTATUSBAR_GETPARTS ($HWND ) LOCAL $ICOUNT = _GUICTRLSTATUSBAR_GETCOUNT ($HWND ) LOCAL $TPARTS = DLLSTRUCTCREATE ("int[" & $ICOUNT & "]" ) LOCAL $APARTS [$ICOUNT + 1 ] IF _WINAPI_INPROCESS ($HWND , $__G_HSBLASTWND ) THEN $APARTS [0 ] = _SENDMESSAGE ($HWND , $SB_GETPARTS , $ICOUNT , $TPARTS , 0 , "wparam" , "struct*" ) ELSE LOCAL $IPARTS = DLLSTRUCTGETSIZE ($TPARTS ) LOCAL $TMEMMAP LOCAL $PMEMORY = _MEMINIT ($HWND , $IPARTS , $TMEMMAP ) $APARTS [0 ] = _SENDMESSAGE ($HWND , $SB_GETPARTS , $ICOUNT , $PMEMORY , 0 , "wparam" , "ptr" ) _MEMREAD ($TMEMMAP , $PMEMORY , $TPARTS , $IPARTS ) _MEMFREE ($TMEMMAP ) ENDIF FOR $II = 1 TO $ICOUNT $APARTS [$II ] = DLLSTRUCTGETDATA ($TPARTS , 1 , $II ) NEXT RETURN $APARTS ENDFUNC FUNC _GUICTRLSTATUSBAR_GETRECT ($HWND , $IPART ) LOCAL $TRECT = _GUICTRLSTATUSBAR_GETRECTEX ($HWND , $IPART ) IF @ERROR THEN RETURN SETERROR (@ERROR , 0 , 0 ) LOCAL $ARECT [4 ] $ARECT [0 ] = DLLSTRUCTGETDATA ($TRECT , "Left" ) $ARECT [1 ] = DLLSTRUCTGETDATA ($TRECT , "Top" ) $ARECT [2 ] = DLLSTRUCTGETDATA ($TRECT , "Right" ) $ARECT [3 ] = DLLSTRUCTGETDATA ($TRECT , "Bottom" ) RETURN $ARECT ENDFUNC FUNC _GUICTRLSTATUSBAR_GETRECTEX ($HWND , $IPART ) LOCAL $TRECT = DLLSTRUCTCREATE ($TAGRECT ) LOCAL $IRET IF _WINAPI_INPROCESS ($HWND , $__G_HSBLASTWND ) THEN $IRET = _SENDMESSAGE ($HWND , $SB_GETRECT , $IPART , $TRECT , 0 , "wparam" , "struct*" ) ELSE LOCAL $IRECT = DLLSTRUCTGETSIZE ($TRECT ) LOCAL $TMEMMAP LOCAL $PMEMORY = _MEMINIT ($HWND , $IRECT , $TMEMMAP ) $IRET = _SENDMESSAGE ($HWND , $SB_GETRECT , $IPART , $PMEMORY , 0 , "wparam" , "ptr" ) _MEMREAD ($TMEMMAP , $PMEMORY , $TRECT , $IRECT ) _MEMFREE ($TMEMMAP ) ENDIF RETURN SETERROR ($IRET = 0 , 0 , $TRECT ) ENDFUNC FUNC _GUICTRLSTATUSBAR_GETTEXT ($HWND , $IPART ) LOCAL $BUNICODE = _GUICTRLSTATUSBAR_GETUNICODEFORMAT ($HWND ) LOCAL $IBUFFER = _GUICTRLSTATUSBAR_GETTEXTLENGTH ($HWND , $IPART ) + 1 IF $IBUFFER = 1 THEN RETURN SETERROR (1 , 0 , "" ) LOCAL $TBUFFER IF $BUNICODE THEN $TBUFFER = DLLSTRUCTCREATE ("wchar Text[" & $IBUFFER & "]" ) $IBUFFER *= 2 ELSE $TBUFFER = DLLSTRUCTCREATE ("char Text[" & $IBUFFER & "]" ) ENDIF IF _WINAPI_INPROCESS ($HWND , $__G_HSBLASTWND ) THEN _SENDMESSAGE ($HWND , $SB_GETTEXTW , $IPART , $TBUFFER , 0 , "wparam" , "struct*" ) ELSE LOCAL $TMEMMAP LOCAL $PMEMORY = _MEMINIT ($HWND , $IBUFFER , $TMEMMAP ) IF $BUNICODE THEN _SENDMESSAGE ($HWND , $SB_GETTEXTW , $IPART , $PMEMORY , 0 , "wparam" , "ptr" ) ELSE _SENDMESSAGE ($HWND , $SB_GETTEXT , $IPART , $PMEMORY , 0 , "wparam" , "ptr" ) ENDIF _MEMREAD ($TMEMMAP , $PMEMORY , $TBUFFER , $IBUFFER ) _MEMFREE ($TMEMMAP ) ENDIF RETURN DLLSTRUCTGETDATA ($TBUFFER , "Text" ) ENDFUNC FUNC _GUICTRLSTATUSBAR_GETTEXTFLAGS ($HWND , $IPART ) IF _GUICTRLSTATUSBAR_GETUNICODEFORMAT ($HWND ) THEN RETURN _SENDMESSAGE ($HWND , $SB_GETTEXTLENGTHW , $IPART ) ELSE RETURN _SENDMESSAGE ($HWND , $SB_GETTEXTLENGTH , $IPART ) ENDIF ENDFUNC FUNC _GUICTRLSTATUSBAR_GETTEXTLENGTH ($HWND , $IPART ) RETURN _WINAPI_LOWORD (_GUICTRLSTATUSBAR_GETTEXTFLAGS ($HWND , $IPART ) ) ENDFUNC FUNC _GUICTRLSTATUSBAR_GETTEXTLENGTHEX ($HWND , $IPART ) RETURN _WINAPI_HIWORD (_GUICTRLSTATUSBAR_GETTEXTFLAGS ($HWND , $IPART ) ) ENDFUNC FUNC _GUICTRLSTATUSBAR_GETTIPTEXT ($HWND , $IPART ) LOCAL $BUNICODE = _GUICTRLSTATUSBAR_GETUNICODEFORMAT ($HWND ) LOCAL $TBUFFER IF $BUNICODE THEN $TBUFFER = DLLSTRUCTCREATE ("wchar Text[4096]" ) ELSE $TBUFFER = DLLSTRUCTCREATE ("char Text[4096]" ) ENDIF IF _WINAPI_INPROCESS ($HWND , $__G_HSBLASTWND ) THEN _SENDMESSAGE ($HWND , $SB_GETTIPTEXTW , _WINAPI_MAKELONG ($IPART , 4096 ) , $TBUFFER , 0 , "wparam" , "struct*" ) ELSE LOCAL $TMEMMAP LOCAL $PMEMORY = _MEMINIT ($HWND , 4096 , $TMEMMAP ) IF $BUNICODE THEN _SENDMESSAGE ($HWND , $SB_GETTIPTEXTW , _WINAPI_MAKELONG ($IPART , 4096 ) , $PMEMORY , 0 , "wparam" , "ptr" ) ELSE _SENDMESSAGE ($HWND , $SB_GETTIPTEXTA , _WINAPI_MAKELONG ($IPART , 4096 ) , $PMEMORY , 0 , "wparam" , "ptr" ) ENDIF _MEMREAD ($TMEMMAP , $PMEMORY , $TBUFFER , 4096 ) _MEMFREE ($TMEMMAP ) ENDIF RETURN DLLSTRUCTGETDATA ($TBUFFER , "Text" ) ENDFUNC FUNC _GUICTRLSTATUSBAR_GETUNICODEFORMAT ($HWND ) RETURN _SENDMESSAGE ($HWND , $SB_GETUNICODEFORMAT ) <> 0 ENDFUNC FUNC _GUICTRLSTATUSBAR_GETWIDTH ($HWND , $IPART ) LOCAL $TRECT = _GUICTRLSTATUSBAR_GETRECTEX ($HWND , $IPART ) RETURN DLLSTRUCTGETDATA ($TRECT , "Right" ) - DLLSTRUCTGETDATA ($TRECT , "Left" ) - (_GUICTRLSTATUSBAR_GETBORDERSHORZ ($HWND ) * 2 ) ENDFUNC FUNC _GUICTRLSTATUSBAR_ISSIMPLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $SB_ISSIMPLE ) <> 0 ENDFUNC FUNC _GUICTRLSTATUSBAR_RESIZE ($HWND ) _SENDMESSAGE ($HWND , $__STATUSBARCONSTANT_WM_SIZE ) ENDFUNC FUNC _GUICTRLSTATUSBAR_SETBKCOLOR ($HWND , $ICOLOR ) $ICOLOR = _SENDMESSAGE ($HWND , $SB_SETBKCOLOR , 0 , $ICOLOR ) ENDFUNC FUNC _GUICTRLSTATUSBAR_SETICON ($HWND , $IPART , $HICON = + 4294967295 , $SICONFILE = "" ) IF $HICON = + 4294967295 THEN RETURN _SENDMESSAGE ($HWND , $SB_SETICON , $IPART , $HICON , 0 , "wparam" , "handle" ) <> 0 IF STRINGLEN ($SICONFILE ) <= 0 THEN RETURN _SENDMESSAGE ($HWND , $SB_SETICON , $IPART , $HICON ) <> 0 LOCAL $TICON = DLLSTRUCTCREATE ("handle" ) LOCAL $VRESULT = DLLCALL ("shell32.dll" , "uint" , "ExtractIconExW" , "wstr" , $SICONFILE , "int" , $HICON , "ptr" , 0 , "struct*" , $TICON , "uint" , 1 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) $VRESULT = $VRESULT [0 ] IF $VRESULT > 0 THEN $VRESULT = _SENDMESSAGE ($HWND , $SB_SETICON , $IPART , DLLSTRUCTGETDATA ($TICON , 1 ) , 0 , "wparam" , "handle" ) DLLCALL ("user32.dll" , "bool" , "DestroyIcon" , "handle" , DLLSTRUCTGETDATA ($TICON , 1 ) ) RETURN $VRESULT ENDFUNC FUNC _GUICTRLSTATUSBAR_SETMINHEIGHT ($HWND , $IMINHEIGHT ) _SENDMESSAGE ($HWND , $SB_SETMINHEIGHT , $IMINHEIGHT ) _GUICTRLSTATUSBAR_RESIZE ($HWND ) ENDFUNC FUNC _GUICTRLSTATUSBAR_SETPARTS ($HWND , $VPARTEDGE = + 4294967295 , $VPARTWIDTH = 25 ) IF ISARRAY ($VPARTEDGE ) AND ISARRAY ($VPARTWIDTH ) THEN RETURN FALSE LOCAL $TPARTS , $IPARTS IF ISARRAY ($VPARTEDGE ) THEN $VPARTEDGE [UBOUND ($VPARTEDGE ) + 4294967295 ] = + 4294967295 $IPARTS = UBOUND ($VPARTEDGE ) $TPARTS = DLLSTRUCTCREATE ("int[" & $IPARTS & "]" ) FOR $X = 0 TO $IPARTS + 4294967294 DLLSTRUCTSETDATA ($TPARTS , 1 , $VPARTEDGE [$X ] , $X + 1 ) NEXT DLLSTRUCTSETDATA ($TPARTS , 1 , + 4294967295 , $IPARTS ) ELSE IF $VPARTEDGE < + 4294967295 THEN RETURN FALSE IF ISARRAY ($VPARTWIDTH ) THEN $IPARTS = UBOUND ($VPARTWIDTH ) $TPARTS = DLLSTRUCTCREATE ("int[" & $IPARTS & "]" ) LOCAL $IPARTRIGHTEDGE = 0 FOR $X = 0 TO $IPARTS + 4294967294 $IPARTRIGHTEDGE += $VPARTWIDTH [$X ] IF $VPARTWIDTH [$X ] <= 0 THEN RETURN FALSE DLLSTRUCTSETDATA ($TPARTS , 1 , $IPARTRIGHTEDGE , $X + 1 ) NEXT DLLSTRUCTSETDATA ($TPARTS , 1 , + 4294967295 , $IPARTS ) ELSEIF $VPARTEDGE > 1 THEN $IPARTS = $VPARTEDGE $TPARTS = DLLSTRUCTCREATE ("int[" & $IPARTS & "]" ) FOR $X = 1 TO $IPARTS + 4294967295 DLLSTRUCTSETDATA ($TPARTS , 1 , $VPARTWIDTH * $X , $X ) NEXT DLLSTRUCTSETDATA ($TPARTS , 1 , + 4294967295 , $IPARTS ) ELSE $IPARTS = 1 $TPARTS = DLLSTRUCTCREATE ("int" ) DLLSTRUCTSETDATA ($TPARTS , 1 , + 4294967295 ) ENDIF ENDIF IF _WINAPI_INPROCESS ($HWND , $__G_HSBLASTWND ) THEN _SENDMESSAGE ($HWND , $SB_SETPARTS , $IPARTS , $TPARTS , 0 , "wparam" , "struct*" ) ELSE LOCAL $ISIZE = DLLSTRUCTGETSIZE ($TPARTS ) LOCAL $TMEMMAP LOCAL $PMEMORY = _MEMINIT ($HWND , $ISIZE , $TMEMMAP ) _MEMWRITE ($TMEMMAP , $TPARTS ) _SENDMESSAGE ($HWND , $SB_SETPARTS , $IPARTS , $PMEMORY , 0 , "wparam" , "ptr" ) _MEMFREE ($TMEMMAP ) ENDIF _GUICTRLSTATUSBAR_RESIZE ($HWND ) RETURN TRUE ENDFUNC FUNC _GUICTRLSTATUSBAR_SETSIMPLE ($HWND , $BSIMPLE = TRUE ) _SENDMESSAGE ($HWND , $SB_SIMPLE , $BSIMPLE ) ENDFUNC FUNC _GUICTRLSTATUSBAR_SETTEXT ($HWND , $STEXT = "" , $IPART = 0 , $IUFLAG = 0 ) LOCAL $BUNICODE = _GUICTRLSTATUSBAR_GETUNICODEFORMAT ($HWND ) LOCAL $IBUFFER = STRINGLEN ($STEXT ) + 1 LOCAL $TTEXT IF $BUNICODE THEN $TTEXT = DLLSTRUCTCREATE ("wchar Text[" & $IBUFFER & "]" ) $IBUFFER *= 2 ELSE $TTEXT = DLLSTRUCTCREATE ("char Text[" & $IBUFFER & "]" ) ENDIF DLLSTRUCTSETDATA ($TTEXT , "Text" , $STEXT ) IF _GUICTRLSTATUSBAR_ISSIMPLE ($HWND ) THEN $IPART = $SB_SIMPLEID LOCAL $IRET IF _WINAPI_INPROCESS ($HWND , $__G_HSBLASTWND ) THEN $IRET = _SENDMESSAGE ($HWND , $SB_SETTEXTW , BITOR ($IPART , $IUFLAG ) , $TTEXT , 0 , "wparam" , "struct*" ) ELSE LOCAL $TMEMMAP LOCAL $PMEMORY = _MEMINIT ($HWND , $IBUFFER , $TMEMMAP ) _MEMWRITE ($TMEMMAP , $TTEXT ) IF $BUNICODE THEN $IRET = _SENDMESSAGE ($HWND , $SB_SETTEXTW , BITOR ($IPART , $IUFLAG ) , $PMEMORY , 0 , "wparam" , "ptr" ) ELSE $IRET = _SENDMESSAGE ($HWND , $SB_SETTEXT , BITOR ($IPART , $IUFLAG ) , $PMEMORY , 0 , "wparam" , "ptr" ) ENDIF _MEMFREE ($TMEMMAP ) ENDIF RETURN $IRET <> 0 ENDFUNC FUNC _GUICTRLSTATUSBAR_SETTIPTEXT ($HWND , $IPART , $STEXT ) LOCAL $BUNICODE = _GUICTRLSTATUSBAR_GETUNICODEFORMAT ($HWND ) LOCAL $IBUFFER = STRINGLEN ($STEXT ) + 1 LOCAL $TTEXT IF $BUNICODE THEN $TTEXT = DLLSTRUCTCREATE ("wchar TipText[" & $IBUFFER & "]" ) $IBUFFER *= 2 ELSE $TTEXT = DLLSTRUCTCREATE ("char TipText[" & $IBUFFER & "]" ) ENDIF DLLSTRUCTSETDATA ($TTEXT , "TipText" , $STEXT ) IF _WINAPI_INPROCESS ($HWND , $__G_HSBLASTWND ) THEN _SENDMESSAGE ($HWND , $SB_SETTIPTEXTW , $IPART , $TTEXT , 0 , "wparam" , "struct*" ) ELSE LOCAL $TMEMMAP LOCAL $PMEMORY = _MEMINIT ($HWND , $IBUFFER , $TMEMMAP ) _MEMWRITE ($TMEMMAP , $TTEXT , $PMEMORY , $IBUFFER ) IF $BUNICODE THEN _SENDMESSAGE ($HWND , $SB_SETTIPTEXTW , $IPART , $PMEMORY , 0 , "wparam" , "ptr" ) ELSE _SENDMESSAGE ($HWND , $SB_SETTIPTEXTA , $IPART , $PMEMORY , 0 , "wparam" , "ptr" ) ENDIF _MEMFREE ($TMEMMAP ) ENDIF ENDFUNC FUNC _GUICTRLSTATUSBAR_SETUNICODEFORMAT ($HWND , $BUNICODE = TRUE ) RETURN _SENDMESSAGE ($HWND , $SB_SETUNICODEFORMAT , $BUNICODE ) ENDFUNC FUNC _GUICTRLSTATUSBAR_SHOWHIDE ($HWND , $ISTATE ) IF $ISTATE <> @SW_HIDE AND $ISTATE <> @SW_SHOW THEN RETURN SETERROR (1 , 1 , FALSE ) RETURN _WINAPI_SHOWWINDOW ($HWND , $ISTATE ) ENDFUNC GLOBAL CONST $TTF_IDISHWND = 1 GLOBAL CONST $TTF_CENTERTIP = 2 GLOBAL CONST $TTF_RTLREADING = 4 GLOBAL CONST $TTF_SUBCLASS = 16 GLOBAL CONST $TTF_TRACK = 32 GLOBAL CONST $TTF_ABSOLUTE = 128 GLOBAL CONST $TTF_TRANSPARENT = 256 GLOBAL CONST $TTF_PARSELINKS = 4096 GLOBAL CONST $TTF_DI_SETITEM = 32768 GLOBAL CONST $__TOOLTIPCONSTANTS_WM_USER = 1024 GLOBAL CONST $TTM_ACTIVATE = $__TOOLTIPCONSTANTS_WM_USER + 1 GLOBAL CONST $TTM_SETDELAYTIME = $__TOOLTIPCONSTANTS_WM_USER + 3 GLOBAL CONST $TTM_ADDTOOL = $__TOOLTIPCONSTANTS_WM_USER + 4 GLOBAL CONST $TTM_DELTOOL = $__TOOLTIPCONSTANTS_WM_USER + 5 GLOBAL CONST $TTM_NEWTOOLRECT = $__TOOLTIPCONSTANTS_WM_USER + 6 GLOBAL CONST $TTM_GETTOOLINFO = $__TOOLTIPCONSTANTS_WM_USER + 8 GLOBAL CONST $TTM_SETTOOLINFO = $__TOOLTIPCONSTANTS_WM_USER + 9 GLOBAL CONST $TTM_HITTEST = $__TOOLTIPCONSTANTS_WM_USER + 10 GLOBAL CONST $TTM_GETTEXT = $__TOOLTIPCONSTANTS_WM_USER + 11 GLOBAL CONST $TTM_UPDATETIPTEXT = $__TOOLTIPCONSTANTS_WM_USER + 12 GLOBAL CONST $TTM_GETTOOLCOUNT = $__TOOLTIPCONSTANTS_WM_USER + 13 GLOBAL CONST $TTM_ENUMTOOLS = $__TOOLTIPCONSTANTS_WM_USER + 14 GLOBAL CONST $TTM_GETCURRENTTOOL = $__TOOLTIPCONSTANTS_WM_USER + 15 GLOBAL CONST $TTM_WINDOWFROMPOINT = $__TOOLTIPCONSTANTS_WM_USER + 16 GLOBAL CONST $TTM_TRACKACTIVATE = $__TOOLTIPCONSTANTS_WM_USER + 17 GLOBAL CONST $TTM_TRACKPOSITION = $__TOOLTIPCONSTANTS_WM_USER + 18 GLOBAL CONST $TTM_SETTIPBKCOLOR = $__TOOLTIPCONSTANTS_WM_USER + 19 GLOBAL CONST $TTM_SETTIPTEXTCOLOR = $__TOOLTIPCONSTANTS_WM_USER + 20 GLOBAL CONST $TTM_GETDELAYTIME = $__TOOLTIPCONSTANTS_WM_USER + 21 GLOBAL CONST $TTM_GETTIPBKCOLOR = $__TOOLTIPCONSTANTS_WM_USER + 22 GLOBAL CONST $TTM_GETTIPTEXTCOLOR = $__TOOLTIPCONSTANTS_WM_USER + 23 GLOBAL CONST $TTM_SETMAXTIPWIDTH = $__TOOLTIPCONSTANTS_WM_USER + 24 GLOBAL CONST $TTM_GETMAXTIPWIDTH = $__TOOLTIPCONSTANTS_WM_USER + 25 GLOBAL CONST $TTM_SETMARGIN = $__TOOLTIPCONSTANTS_WM_USER + 26 GLOBAL CONST $TTM_GETMARGIN = $__TOOLTIPCONSTANTS_WM_USER + 27 GLOBAL CONST $TTM_POP = $__TOOLTIPCONSTANTS_WM_USER + 28 GLOBAL CONST $TTM_UPDATE = $__TOOLTIPCONSTANTS_WM_USER + 29 GLOBAL CONST $TTM_GETBUBBLESIZE = $__TOOLTIPCONSTANTS_WM_USER + 30 GLOBAL CONST $TTM_ADJUSTRECT = $__TOOLTIPCONSTANTS_WM_USER + 31 GLOBAL CONST $TTM_SETTITLE = $__TOOLTIPCONSTANTS_WM_USER + 32 GLOBAL CONST $TTM_SETTITLEW = $__TOOLTIPCONSTANTS_WM_USER + 33 GLOBAL CONST $TTM_POPUP = $__TOOLTIPCONSTANTS_WM_USER + 34 GLOBAL CONST $TTM_GETTITLE = $__TOOLTIPCONSTANTS_WM_USER + 35 GLOBAL CONST $TTM_ADDTOOLW = $__TOOLTIPCONSTANTS_WM_USER + 50 GLOBAL CONST $TTM_DELTOOLW = $__TOOLTIPCONSTANTS_WM_USER + 51 GLOBAL CONST $TTM_NEWTOOLRECTW = $__TOOLTIPCONSTANTS_WM_USER + 52 GLOBAL CONST $TTM_GETTOOLINFOW = $__TOOLTIPCONSTANTS_WM_USER + 53 GLOBAL CONST $TTM_SETTOOLINFOW = $__TOOLTIPCONSTANTS_WM_USER + 54 GLOBAL CONST $TTM_HITTESTW = $__TOOLTIPCONSTANTS_WM_USER + 55 GLOBAL CONST $TTM_GETTEXTW = $__TOOLTIPCONSTANTS_WM_USER + 56 GLOBAL CONST $TTM_UPDATETIPTEXTW = $__TOOLTIPCONSTANTS_WM_USER + 57 GLOBAL CONST $TTM_ENUMTOOLSW = $__TOOLTIPCONSTANTS_WM_USER + 58 GLOBAL CONST $TTM_GETCURRENTTOOLW = $__TOOLTIPCONSTANTS_WM_USER + 59 GLOBAL CONST $TTM_SETWINDOWTHEME = 8192 + 11 GLOBAL CONST $TTN_FIRST = + 4294966776 GLOBAL CONST $TTN_GETDISPINFO = $TTN_FIRST + 0 GLOBAL CONST $TTN_SHOW = $TTN_FIRST + 4294967295 GLOBAL CONST $TTN_POP = $TTN_FIRST + 4294967294 GLOBAL CONST $TTN_LINKCLICK = $TTN_FIRST + 4294967293 GLOBAL CONST $TTN_GETDISPINFOW = $TTN_FIRST + 4294967286 GLOBAL CONST $TTS_ALWAYSTIP = 1 GLOBAL CONST $TTS_NOPREFIX = 2 GLOBAL CONST $TTS_NOANIMATE = 16 GLOBAL CONST $TTS_NOFADE = 32 GLOBAL CONST $TTS_BALLOON = 64 GLOBAL CONST $TTS_CLOSE = 128 GLOBAL CONST $TTS_USEVISUALSTYLE = 256 GLOBAL CONST $TTDT_AUTOMATIC = 0 GLOBAL CONST $TTDT_RESHOW = 1 GLOBAL CONST $TTDT_AUTOPOP = 2 GLOBAL CONST $TTDT_INITIAL = 3 GLOBAL ENUM $TTI_NONE , $TTI_INFO , $TTI_WARNING , $TTI_ERROR , $TTI_INFO_LARGE , $TTI_WARNING_LARGE , $TTI_ERROR_LARGE #Region Global Variables and Constants GLOBAL CONST $DUPLICATE_CLOSE_SOURCE = 1 GLOBAL CONST $DUPLICATE_SAME_ACCESS = 2 GLOBAL CONST $OBJ_BITMAP = 7 GLOBAL CONST $OBJ_BRUSH = 2 GLOBAL CONST $OBJ_COLORSPACE = 14 GLOBAL CONST $OBJ_DC = 3 GLOBAL CONST $OBJ_ENHMETADC = 12 GLOBAL CONST $OBJ_ENHMETAFILE = 13 GLOBAL CONST $OBJ_EXTPEN = 11 GLOBAL CONST $OBJ_FONT = 6 GLOBAL CONST $OBJ_MEMDC = 10 GLOBAL CONST $OBJ_METADC = 4 GLOBAL CONST $OBJ_METAFILE = 9 GLOBAL CONST $OBJ_PAL = 5 GLOBAL CONST $OBJ_PEN = 1 GLOBAL CONST $OBJ_REGION = 8 GLOBAL CONST $NULL_BRUSH = 5 GLOBAL CONST $NULL_PEN = 8 GLOBAL CONST $BLACK_BRUSH = 4 GLOBAL CONST $DKGRAY_BRUSH = 3 GLOBAL CONST $DC_BRUSH = 18 GLOBAL CONST $GRAY_BRUSH = 2 GLOBAL CONST $HOLLOW_BRUSH = $NULL_BRUSH GLOBAL CONST $LTGRAY_BRUSH = 1 GLOBAL CONST $WHITE_BRUSH = 0 GLOBAL CONST $BLACK_PEN = 7 GLOBAL CONST $DC_PEN = 19 GLOBAL CONST $WHITE_PEN = 6 GLOBAL CONST $ANSI_FIXED_FONT = 11 GLOBAL CONST $ANSI_VAR_FONT = 12 GLOBAL CONST $DEVICE_DEFAULT_FONT = 14 GLOBAL CONST $DEFAULT_GUI_FONT = 17 GLOBAL CONST $OEM_FIXED_FONT = 10 GLOBAL CONST $SYSTEM_FONT = 13 GLOBAL CONST $SYSTEM_FIXED_FONT = 16 GLOBAL CONST $DEFAULT_PALETTE = 15 #EndRegion Global Variables and Constants #Region Functions list #EndRegion Functions list #Region Public Functions FUNC _WINAPI_CLOSEHANDLE ($HOBJECT ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "bool" , "CloseHandle" , "handle" , $HOBJECT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_DELETEOBJECT ($HOBJECT ) LOCAL $ARESULT = DLLCALL ("gdi32.dll" , "bool" , "DeleteObject" , "handle" , $HOBJECT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_DUPLICATEHANDLE ($HSOURCEPROCESSHANDLE , $HSOURCEHANDLE , $HTARGETPROCESSHANDLE , $IDESIREDACCESS , $IINHERITHANDLE , $IOPTIONS ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "bool" , "DuplicateHandle" , "handle" , $HSOURCEPROCESSHANDLE , "handle" , $HSOURCEHANDLE , "handle" , $HTARGETPROCESSHANDLE , "handle*" , 0 , "dword" , $IDESIREDACCESS , "bool" , $IINHERITHANDLE , "dword" , $IOPTIONS ) IF @ERROR OR NOT $ARESULT [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [4 ] ENDFUNC FUNC _WINAPI_GETCURRENTOBJECT ($HDC , $ITYPE ) LOCAL $ARET = DLLCALL ("gdi32.dll" , "handle" , "GetCurrentObject" , "handle" , $HDC , "uint" , $ITYPE ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETCURRENTPROCESS () LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "handle" , "GetCurrentProcess" ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETOBJECT ($HOBJECT , $ISIZE , $POBJECT ) LOCAL $ARESULT = DLLCALL ("gdi32.dll" , "int" , "GetObjectW" , "handle" , $HOBJECT , "int" , $ISIZE , "struct*" , $POBJECT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETOBJECTINFOBYHANDLE ($HOBJECT ) LOCAL $TAGPUBLIC_OBJECT_BASIC_INFORMATION = "ulong Attributes;ulong GrantedAcess;ulong HandleCount;ulong PointerCount;ulong Reserved[10]" LOCAL $TPOBI = DLLSTRUCTCREATE ($TAGPUBLIC_OBJECT_BASIC_INFORMATION ) LOCAL $ARET = DLLCALL ("ntdll.dll" , "long" , "ZwQueryObject" , "handle" , $HOBJECT , "uint" , 0 , "struct*" , $TPOBI , "ulong" , DLLSTRUCTGETSIZE ($TPOBI ) , "ptr" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF $ARET [0 ] THEN RETURN SETERROR (10 , $ARET [0 ] , 0 ) LOCAL $ARESULT [4 ] FOR $I = 0 TO 3 $ARESULT [$I ] = DLLSTRUCTGETDATA ($TPOBI , $I + 1 ) NEXT RETURN $ARESULT ENDFUNC FUNC _WINAPI_GETOBJECTNAMEBYHANDLE ($HOBJECT ) LOCAL $TAGUNICODE_STRING = "struct;ushort Length;ushort MaximumLength;ptr Buffer;endstruct" LOCAL $TAGPUBLIC_OBJECT_TYPE_INFORMATION = "struct;" & $TAGUNICODE_STRING & ";ulong Reserved[22];endstruct" LOCAL $TPOTI = DLLSTRUCTCREATE ($TAGPUBLIC_OBJECT_TYPE_INFORMATION & ";byte[32]" ) LOCAL $ARET = DLLCALL ("ntdll.dll" , "long" , "ZwQueryObject" , "handle" , $HOBJECT , "uint" , 2 , "struct*" , $TPOTI , "ulong" , DLLSTRUCTGETSIZE ($TPOTI ) , "ulong*" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) IF $ARET [0 ] THEN RETURN SETERROR (10 , $ARET [0 ] , "" ) LOCAL $PDATA = DLLSTRUCTGETDATA ($TPOTI , 3 ) IF NOT $PDATA THEN RETURN SETERROR (11 , 0 , "" ) RETURN _WINAPI_GETSTRING ($PDATA ) ENDFUNC FUNC _WINAPI_GETOBJECTTYPE ($HOBJECT ) LOCAL $ARET = DLLCALL ("gdi32.dll" , "dword" , "GetObjectType" , "handle" , $HOBJECT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETSTDHANDLE ($ISTDHANDLE ) IF $ISTDHANDLE < 0 OR $ISTDHANDLE > 2 THEN RETURN SETERROR (2 , 0 , + 4294967295 ) LOCAL CONST $AHANDLE [3 ] = [+ 4294967286 , + 4294967285 , + 4294967284 ] LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "handle" , "GetStdHandle" , "dword" , $AHANDLE [$ISTDHANDLE ] ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , + 4294967295 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETSTOCKOBJECT ($IOBJECT ) LOCAL $ARESULT = DLLCALL ("gdi32.dll" , "handle" , "GetStockObject" , "int" , $IOBJECT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_SELECTOBJECT ($HDC , $HGDIOBJ ) LOCAL $ARESULT = DLLCALL ("gdi32.dll" , "handle" , "SelectObject" , "handle" , $HDC , "handle" , $HGDIOBJ ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_SETHANDLEINFORMATION ($HOBJECT , $IMASK , $IFLAGS ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "bool" , "SetHandleInformation" , "handle" , $HOBJECT , "dword" , $IMASK , "dword" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC #EndRegion Public Functions GLOBAL $__G_HEDITLASTWND GLOBAL CONST $__EDITCONSTANT_CLASSNAME = "Edit" GLOBAL CONST $__EDITCONSTANT_GUI_CHECKED = 1 GLOBAL CONST $__EDITCONSTANT_GUI_HIDE = 32 GLOBAL CONST $__EDITCONSTANT_GUI_EVENT_CLOSE = + 4294967293 GLOBAL CONST $__EDITCONSTANT_GUI_ENABLE = 64 GLOBAL CONST $__EDITCONSTANT_GUI_DISABLE = 128 GLOBAL CONST $__EDITCONSTANT_SS_CENTER = 1 GLOBAL CONST $__EDITCONSTANT_WM_SETREDRAW = 11 GLOBAL CONST $__EDITCONSTANT_WS_CAPTION = 12582912 GLOBAL CONST $__EDITCONSTANT_WS_POPUP = 2147483648 GLOBAL CONST $__EDITCONSTANT_WS_SYSMENU = 524288 GLOBAL CONST $__EDITCONSTANT_WS_MINIMIZEBOX = 131072 GLOBAL CONST $__EDITCONSTANT_DEFAULT_GUI_FONT = 17 GLOBAL CONST $__EDITCONSTANT_WM_SETFONT = 48 GLOBAL CONST $__EDITCONSTANT_WM_GETTEXTLENGTH = 14 GLOBAL CONST $__EDITCONSTANT_WM_GETTEXT = 13 GLOBAL CONST $__EDITCONSTANT_WM_SETTEXT = 12 GLOBAL CONST $__EDITCONSTANT_SB_LINEUP = 0 GLOBAL CONST $__EDITCONSTANT_SB_LINEDOWN = 1 GLOBAL CONST $__EDITCONSTANT_SB_PAGEDOWN = 3 GLOBAL CONST $__EDITCONSTANT_SB_PAGEUP = 2 GLOBAL CONST $__EDITCONSTANT_SB_SCROLLCARET = 4 GLOBAL CONST $__TAGEDITBALLOONTIP = "dword Size;ptr Title;ptr Text;int Icon" FUNC _GUICTRLEDIT_APPENDTEXT ($HWND , $STEXT ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $ILENGTH = _GUICTRLEDIT_GETTEXTLEN ($HWND ) _GUICTRLEDIT_SETSEL ($HWND , $ILENGTH , $ILENGTH ) _SENDMESSAGE ($HWND , $EM_REPLACESEL , TRUE , $STEXT , 0 , "wparam" , "wstr" ) ENDFUNC FUNC _GUICTRLEDIT_BEGINUPDATE ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $__EDITCONSTANT_WM_SETREDRAW , FALSE ) = 0 ENDFUNC FUNC _GUICTRLEDIT_CANUNDO ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $EM_CANUNDO ) <> 0 ENDFUNC FUNC _GUICTRLEDIT_CHARFROMPOS ($HWND , $IX , $IY ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $ARETURN [2 ] LOCAL $IRET = _SENDMESSAGE ($HWND , $EM_CHARFROMPOS , 0 , _WINAPI_MAKELONG ($IX , $IY ) ) $ARETURN [0 ] = _WINAPI_LOWORD ($IRET ) $ARETURN [1 ] = _WINAPI_HIWORD ($IRET ) RETURN $ARETURN ENDFUNC FUNC _GUICTRLEDIT_CREATE ($HWND , $STEXT , $IX , $IY , $IWIDTH = 150 , $IHEIGHT = 150 , $ISTYLE = 3150020 , $IEXSTYLE = 512 ) IF NOT ISHWND ($HWND ) THEN RETURN SETERROR (1 , 0 , 0 ) IF NOT ISSTRING ($STEXT ) THEN RETURN SETERROR (2 , 0 , 0 ) IF $IWIDTH = + 4294967295 THEN $IWIDTH = 150 IF $IHEIGHT = + 4294967295 THEN $IHEIGHT = 150 IF $ISTYLE = + 4294967295 THEN $ISTYLE = 3150020 IF $IEXSTYLE = + 4294967295 THEN $IEXSTYLE = 512 IF BITAND ($ISTYLE , $ES_READONLY ) = $ES_READONLY THEN $ISTYLE = BITOR ($__UDFGUICONSTANT_WS_CHILD , $__UDFGUICONSTANT_WS_VISIBLE , $ISTYLE ) ELSE $ISTYLE = BITOR ($__UDFGUICONSTANT_WS_CHILD , $__UDFGUICONSTANT_WS_VISIBLE , $__UDFGUICONSTANT_WS_TABSTOP , $ISTYLE ) ENDIF LOCAL $NCTRLID = __UDF_GETNEXTGLOBALID ($HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) LOCAL $HEDIT = _WINAPI_CREATEWINDOWEX ($IEXSTYLE , $__EDITCONSTANT_CLASSNAME , "" , $ISTYLE , $IX , $IY , $IWIDTH , $IHEIGHT , $HWND , $NCTRLID ) _SENDMESSAGE ($HEDIT , $__EDITCONSTANT_WM_SETFONT , _WINAPI_GETSTOCKOBJECT ($__EDITCONSTANT_DEFAULT_GUI_FONT ) , TRUE ) _GUICTRLEDIT_SETTEXT ($HEDIT , $STEXT ) _GUICTRLEDIT_SETLIMITTEXT ($HEDIT , 0 ) RETURN $HEDIT ENDFUNC FUNC _GUICTRLEDIT_DESTROY (BYREF $HWND ) IF NOT _WINAPI_ISCLASSNAME ($HWND , $__EDITCONSTANT_CLASSNAME ) THEN RETURN SETERROR (2 , 2 , FALSE ) LOCAL $IDESTROYED = 0 IF ISHWND ($HWND ) THEN IF _WINAPI_INPROCESS ($HWND , $__G_HEDITLASTWND ) THEN LOCAL $NCTRLID = _WINAPI_GETDLGCTRLID ($HWND ) LOCAL $HPARENT = _WINAPI_GETPARENT ($HWND ) $IDESTROYED = _WINAPI_DESTROYWINDOW ($HWND ) LOCAL $IRET = __UDF_FREEGLOBALID ($HPARENT , $NCTRLID ) IF NOT $IRET THEN ENDIF ELSE RETURN SETERROR (1 , 1 , FALSE ) ENDIF ELSE $IDESTROYED = GUICTRLDELETE ($HWND ) ENDIF IF $IDESTROYED THEN $HWND = 0 RETURN $IDESTROYED <> 0 ENDFUNC FUNC _GUICTRLEDIT_EMPTYUNDOBUFFER ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) _SENDMESSAGE ($HWND , $EM_EMPTYUNDOBUFFER ) ENDFUNC FUNC _GUICTRLEDIT_ENDUPDATE ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $__EDITCONSTANT_WM_SETREDRAW , TRUE ) = 0 ENDFUNC FUNC _GUICTRLEDIT_FMTLINES ($HWND , $BSOFTBREAK = FALSE ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $EM_FMTLINES , $BSOFTBREAK ) ENDFUNC FUNC _GUICTRLEDIT_FIND ($HWND , $BREPLACE = FALSE ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $IPOS = 0 , $ICASE , $IOCCURANCE = 0 , $IREPLACEMENTS = 0 LOCAL $APARTSRIGHTEDGE [3 ] = [125 , 225 , + 4294967295 ] LOCAL $IOLDMODE = OPT ("GUIOnEventMode" , 0 ) LOCAL $ASEL = _GUICTRLEDIT_GETSEL ($HWND ) LOCAL $STEXT = _GUICTRLEDIT_GETTEXT ($HWND ) LOCAL $HGUISEARCH = GUICREATE ("Find" , 349 , 177 , + 4294967295 , + 4294967295 , BITOR ($__UDFGUICONSTANT_WS_CHILD , $__EDITCONSTANT_WS_MINIMIZEBOX , $__EDITCONSTANT_WS_CAPTION , $__EDITCONSTANT_WS_POPUP , $__EDITCONSTANT_WS_SYSMENU ) ) LOCAL $IDSTATUSBAR1 = _GUICTRLSTATUSBAR_CREATE ($HGUISEARCH , $APARTSRIGHTEDGE ) _GUICTRLSTATUSBAR_SETTEXT ($IDSTATUSBAR1 , "Find: " ) GUISETICON (@SYSTEMDIR & "\shell32.dll" , 22 , $HGUISEARCH ) GUICTRLCREATELABEL ("Find what:" , 9 , 10 , 53 , 16 , $__EDITCONSTANT_SS_CENTER ) LOCAL $IDINPUTSEARCH = GUICTRLCREATEINPUT ("" , 80 , 8 , 257 , 21 ) LOCAL $IDLBLREPLACE = GUICTRLCREATELABEL ("Replace with:" , 9 , 42 , 69 , 17 , $__EDITCONSTANT_SS_CENTER ) LOCAL $IDINPUTREPLACE = GUICTRLCREATEINPUT ("" , 80 , 40 , 257 , 21 ) LOCAL $IDCHKWHOLEONLY = GUICTRLCREATECHECKBOX ("Match whole word only" , 9 , 72 , 145 , 17 ) LOCAL $IDCHKMATCHCASE = GUICTRLCREATECHECKBOX ("Match case" , 9 , 96 , 145 , 17 ) LOCAL $IDBTNFINDNEXT = GUICTRLCREATEBUTTON ("Find Next" , 168 , 72 , 161 , 21 , 0 ) LOCAL $IDBTNREPLACE = GUICTRLCREATEBUTTON ("Replace" , 168 , 96 , 161 , 21 , 0 ) LOCAL $IDBTNCLOSE = GUICTRLCREATEBUTTON ("Close" , 104 , 130 , 161 , 21 , 0 ) IF (ISARRAY ($ASEL ) AND $ASEL <> $EC_ERR ) THEN GUICTRLSETDATA ($IDINPUTSEARCH , STRINGMID ($STEXT , $ASEL [0 ] + 1 , $ASEL [1 ] - $ASEL [0 ] ) ) IF $ASEL [0 ] <> $ASEL [1 ] THEN $IPOS = $ASEL [0 ] IF BITAND (GUICTRLREAD ($IDCHKMATCHCASE ) , $__EDITCONSTANT_GUI_CHECKED ) = $__EDITCONSTANT_GUI_CHECKED THEN $ICASE = 1 $IOCCURANCE = 1 LOCAL $ITPOSE WHILE 1 $ITPOSE = STRINGINSTR ($STEXT , GUICTRLREAD ($IDINPUTSEARCH ) , $ICASE , $IOCCURANCE ) IF NOT $ITPOSE THEN $IOCCURANCE = 0 EXITLOOP ELSEIF $ITPOSE = $IPOS + 1 THEN EXITLOOP ENDIF $IOCCURANCE += 1 WEND ENDIF _GUICTRLSTATUSBAR_SETTEXT ($IDSTATUSBAR1 , "Find: " & GUICTRLREAD ($IDINPUTSEARCH ) ) ENDIF IF $BREPLACE = FALSE THEN GUICTRLSETSTATE ($IDLBLREPLACE , $__EDITCONSTANT_GUI_HIDE ) GUICTRLSETSTATE ($IDINPUTREPLACE , $__EDITCONSTANT_GUI_HIDE ) GUICTRLSETSTATE ($IDBTNREPLACE , $__EDITCONSTANT_GUI_HIDE ) ELSE _GUICTRLSTATUSBAR_SETTEXT ($IDSTATUSBAR1 , "Replacements: " & $IREPLACEMENTS , 1 ) _GUICTRLSTATUSBAR_SETTEXT ($IDSTATUSBAR1 , "With: " , 2 ) ENDIF GUISETSTATE (@SW_SHOW ) LOCAL $IMSGFIND WHILE 1 $IMSGFIND = GUIGETMSG () SELECT CASE $IMSGFIND = $__EDITCONSTANT_GUI_EVENT_CLOSE OR $IMSGFIND = $IDBTNCLOSE EXITLOOP CASE $IMSGFIND = $IDBTNFINDNEXT GUICTRLSETSTATE ($IDBTNFINDNEXT , $__EDITCONSTANT_GUI_DISABLE ) GUICTRLSETCURSOR ($IDBTNFINDNEXT , 15 ) SLEEP (100 ) _GUICTRLSTATUSBAR_SETTEXT ($IDSTATUSBAR1 , "Find: " & GUICTRLREAD ($IDINPUTSEARCH ) ) IF $BREPLACE = TRUE THEN _GUICTRLSTATUSBAR_SETTEXT ($IDSTATUSBAR1 , "Find: " & GUICTRLREAD ($IDINPUTSEARCH ) ) _GUICTRLSTATUSBAR_SETTEXT ($IDSTATUSBAR1 , "With: " & GUICTRLREAD ($IDINPUTREPLACE ) , 2 ) ENDIF __GUICTRLEDIT_FINDTEXT ($HWND , $IDINPUTSEARCH , $IDCHKMATCHCASE , $IDCHKWHOLEONLY , $IPOS , $IOCCURANCE , $IREPLACEMENTS ) SLEEP (100 ) GUICTRLSETSTATE ($IDBTNFINDNEXT , $__EDITCONSTANT_GUI_ENABLE ) GUICTRLSETCURSOR ($IDBTNFINDNEXT , 2 ) CASE $IMSGFIND = $IDBTNREPLACE GUICTRLSETSTATE ($IDBTNREPLACE , $__EDITCONSTANT_GUI_DISABLE ) GUICTRLSETCURSOR ($IDBTNREPLACE , 15 ) SLEEP (100 ) _GUICTRLSTATUSBAR_SETTEXT ($IDSTATUSBAR1 , "Find: " & GUICTRLREAD ($IDINPUTSEARCH ) ) _GUICTRLSTATUSBAR_SETTEXT ($IDSTATUSBAR1 , "With: " & GUICTRLREAD ($IDINPUTREPLACE ) , 2 ) IF $IPOS THEN _GUICTRLEDIT_REPLACESEL ($HWND , GUICTRLREAD ($IDINPUTREPLACE ) ) $IREPLACEMENTS += 1 $IOCCURANCE -= 1 _GUICTRLSTATUSBAR_SETTEXT ($IDSTATUSBAR1 , "Replacements: " & $IREPLACEMENTS , 1 ) ENDIF __GUICTRLEDIT_FINDTEXT ($HWND , $IDINPUTSEARCH , $IDCHKMATCHCASE , $IDCHKWHOLEONLY , $IPOS , $IOCCURANCE , $IREPLACEMENTS ) SLEEP (100 ) GUICTRLSETSTATE ($IDBTNREPLACE , $__EDITCONSTANT_GUI_ENABLE ) GUICTRLSETCURSOR ($IDBTNREPLACE , 2 ) ENDSELECT WEND GUIDELETE ($HGUISEARCH ) OPT ("GUIOnEventMode" , $IOLDMODE ) ENDFUNC FUNC _GUICTRLEDIT_GETCUEBANNER ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $TTEXT = DLLSTRUCTCREATE ("wchar[4096]" ) IF _SENDMESSAGE ($HWND , $EM_GETCUEBANNER , $TTEXT , 4096 , 0 , "struct*" ) <> 1 THEN RETURN SETERROR (+ 4294967295 , 0 , "" ) RETURN _WINAPI_WIDECHARTOMULTIBYTE ($TTEXT ) ENDFUNC FUNC __GUICTRLEDIT_FINDTEXT ($HWND , $IDINPUTSEARCH , $IDCHKMATCHCASE , $IDCHKWHOLEONLY , BYREF $IPOS , BYREF $IOCCURANCE , BYREF $IREPLACEMENTS ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $ICASE = 0 , $IWHOLE = 0 LOCAL $BEXACT = FALSE LOCAL $SFIND = GUICTRLREAD ($IDINPUTSEARCH ) LOCAL $STEXT = _GUICTRLEDIT_GETTEXT ($HWND ) IF BITAND (GUICTRLREAD ($IDCHKMATCHCASE ) , $__EDITCONSTANT_GUI_CHECKED ) = $__EDITCONSTANT_GUI_CHECKED THEN $ICASE = 1 IF BITAND (GUICTRLREAD ($IDCHKWHOLEONLY ) , $__EDITCONSTANT_GUI_CHECKED ) = $__EDITCONSTANT_GUI_CHECKED THEN $IWHOLE = 1 IF $SFIND <> "" THEN $IOCCURANCE += 1 $IPOS = STRINGINSTR ($STEXT , $SFIND , $ICASE , $IOCCURANCE ) IF $IWHOLE AND $IPOS THEN LOCAL $S_COMPARE2 = STRINGMID ($STEXT , $IPOS + STRINGLEN ($SFIND ) , 1 ) IF $IPOS = 1 THEN IF ($IPOS + STRINGLEN ($SFIND ) ) + 4294967295 = STRINGLEN ($STEXT ) OR ($S_COMPARE2 = " " OR $S_COMPARE2 = @LF OR $S_COMPARE2 = @CR OR $S_COMPARE2 = @CRLF OR $S_COMPARE2 = @TAB ) THEN $BEXACT = TRUE ELSE LOCAL $S_COMPARE1 = STRINGMID ($STEXT , $IPOS + 4294967295 , 1 ) IF ($IPOS + STRINGLEN ($SFIND ) ) + 4294967295 = STRINGLEN ($STEXT ) THEN IF ($S_COMPARE1 = " " OR $S_COMPARE1 = @LF OR $S_COMPARE1 = @CR OR $S_COMPARE1 = @CRLF OR $S_COMPARE1 = @TAB ) THEN $BEXACT = TRUE ELSE IF ($S_COMPARE1 = " " OR $S_COMPARE1 = @LF OR $S_COMPARE1 = @CR OR $S_COMPARE1 = @CRLF OR $S_COMPARE1 = @TAB ) AND ($S_COMPARE2 = " " OR $S_COMPARE2 = @LF OR $S_COMPARE2 = @CR OR $S_COMPARE2 = @CRLF OR $S_COMPARE2 = @TAB ) THEN $BEXACT = TRUE ENDIF ENDIF IF $BEXACT = FALSE THEN __GUICTRLEDIT_FINDTEXT ($HWND , $IDINPUTSEARCH , $IDCHKMATCHCASE , $IDCHKWHOLEONLY , $IPOS , $IOCCURANCE , $IREPLACEMENTS ) ELSE _GUICTRLEDIT_SETSEL ($HWND , $IPOS + 4294967295 , ($IPOS + STRINGLEN ($SFIND ) ) + 4294967295 ) _GUICTRLEDIT_SCROLL ($HWND , $__EDITCONSTANT_SB_SCROLLCARET ) ENDIF ELSEIF $IWHOLE AND NOT $IPOS THEN $IOCCURANCE = 0 MSGBOX ($MB_SYSTEMMODAL , "Find" , "Reached End of document, Can not find the string '" & $SFIND & "'" ) ELSEIF NOT $IWHOLE THEN IF NOT $IPOS THEN $IOCCURANCE = 1 _GUICTRLEDIT_SETSEL ($HWND , + 4294967295 , 0 ) _GUICTRLEDIT_SCROLL ($HWND , $__EDITCONSTANT_SB_SCROLLCARET ) $IPOS = STRINGINSTR ($STEXT , $SFIND , $ICASE , $IOCCURANCE ) IF NOT $IPOS THEN $IOCCURANCE = 0 MSGBOX ($MB_SYSTEMMODAL , "Find" , "Reached End of document, Can not find the string '" & $SFIND & "'" ) ELSE _GUICTRLEDIT_SETSEL ($HWND , $IPOS + 4294967295 , ($IPOS + STRINGLEN ($SFIND ) ) + 4294967295 ) _GUICTRLEDIT_SCROLL ($HWND , $__EDITCONSTANT_SB_SCROLLCARET ) ENDIF ELSE _GUICTRLEDIT_SETSEL ($HWND , $IPOS + 4294967295 , ($IPOS + STRINGLEN ($SFIND ) ) + 4294967295 ) _GUICTRLEDIT_SCROLL ($HWND , $__EDITCONSTANT_SB_SCROLLCARET ) ENDIF ENDIF ENDIF ENDFUNC FUNC _GUICTRLEDIT_GETFIRSTVISIBLELINE ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $EM_GETFIRSTVISIBLELINE ) ENDFUNC FUNC _GUICTRLEDIT_GETHANDLE ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN PTR (_SENDMESSAGE ($HWND , $EM_GETHANDLE ) ) ENDFUNC FUNC _GUICTRLEDIT_GETIMESTATUS ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $EM_GETIMESTATUS , $EMSIS_COMPOSITIONSTRING ) ENDFUNC FUNC _GUICTRLEDIT_GETLIMITTEXT ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $EM_GETLIMITTEXT ) ENDFUNC FUNC _GUICTRLEDIT_GETLINE ($HWND , $ILINE ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $ILENGTH = _GUICTRLEDIT_LINELENGTH ($HWND , $ILINE ) IF $ILENGTH = 0 THEN RETURN "" LOCAL $TBUFFER = DLLSTRUCTCREATE ("short Len;wchar Text[" & $ILENGTH & "]" ) DLLSTRUCTSETDATA ($TBUFFER , "Len" , $ILENGTH + 1 ) LOCAL $IRET = _SENDMESSAGE ($HWND , $EM_GETLINE , $ILINE , $TBUFFER , 0 , "wparam" , "struct*" ) IF $IRET = 0 THEN RETURN SETERROR ($EC_ERR , $EC_ERR , "" ) LOCAL $TTEXT = DLLSTRUCTCREATE ("wchar Text[" & $ILENGTH & "]" , DLLSTRUCTGETPTR ($TBUFFER ) ) RETURN DLLSTRUCTGETDATA ($TTEXT , "Text" ) ENDFUNC FUNC _GUICTRLEDIT_GETLINECOUNT ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $EM_GETLINECOUNT ) ENDFUNC FUNC _GUICTRLEDIT_GETMARGINS ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $AMARGINS [2 ] LOCAL $IMARGINS = _SENDMESSAGE ($HWND , $EM_GETMARGINS ) $AMARGINS [0 ] = _WINAPI_LOWORD ($IMARGINS ) $AMARGINS [1 ] = _WINAPI_HIWORD ($IMARGINS ) RETURN $AMARGINS ENDFUNC FUNC _GUICTRLEDIT_GETMODIFY ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $EM_GETMODIFY ) <> 0 ENDFUNC FUNC _GUICTRLEDIT_GETPASSWORDCHAR ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $EM_GETPASSWORDCHAR ) ENDFUNC FUNC _GUICTRLEDIT_GETRECT ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $ARECT [4 ] LOCAL $TRECT = _GUICTRLEDIT_GETRECTEX ($HWND ) $ARECT [0 ] = DLLSTRUCTGETDATA ($TRECT , "Left" ) $ARECT [1 ] = DLLSTRUCTGETDATA ($TRECT , "Top" ) $ARECT [2 ] = DLLSTRUCTGETDATA ($TRECT , "Right" ) $ARECT [3 ] = DLLSTRUCTGETDATA ($TRECT , "Bottom" ) RETURN $ARECT ENDFUNC FUNC _GUICTRLEDIT_GETRECTEX ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $TRECT = DLLSTRUCTCREATE ($TAGRECT ) _SENDMESSAGE ($HWND , $EM_GETRECT , 0 , $TRECT , 0 , "wparam" , "struct*" ) RETURN $TRECT ENDFUNC FUNC _GUICTRLEDIT_GETSEL ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $ASEL [2 ] LOCAL $TSTART = DLLSTRUCTCREATE ("uint Start" ) LOCAL $TEND = DLLSTRUCTCREATE ("uint End" ) _SENDMESSAGE ($HWND , $EM_GETSEL , $TSTART , $TEND , 0 , "struct*" , "struct*" ) $ASEL [0 ] = DLLSTRUCTGETDATA ($TSTART , "Start" ) $ASEL [1 ] = DLLSTRUCTGETDATA ($TEND , "End" ) RETURN $ASEL ENDFUNC FUNC _GUICTRLEDIT_GETTEXT ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $ITEXTLEN = _GUICTRLEDIT_GETTEXTLEN ($HWND ) + 1 LOCAL $TTEXT = DLLSTRUCTCREATE ("wchar Text[" & $ITEXTLEN & "]" ) _SENDMESSAGE ($HWND , $__EDITCONSTANT_WM_GETTEXT , $ITEXTLEN , $TTEXT , 0 , "wparam" , "struct*" ) RETURN DLLSTRUCTGETDATA ($TTEXT , "Text" ) ENDFUNC FUNC _GUICTRLEDIT_GETTEXTLEN ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $__EDITCONSTANT_WM_GETTEXTLENGTH ) ENDFUNC FUNC _GUICTRLEDIT_GETTHUMB ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $EM_GETTHUMB ) ENDFUNC FUNC _GUICTRLEDIT_GETWORDBREAKPROC ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $EM_GETWORDBREAKPROC ) ENDFUNC FUNC _GUICTRLEDIT_HIDEBALLOONTIP ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $EM_HIDEBALLOONTIP ) <> 0 ENDFUNC FUNC _GUICTRLEDIT_INSERTTEXT ($HWND , $STEXT , $IINDEX = + 4294967295 ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) IF $IINDEX = + 4294967295 THEN _GUICTRLEDIT_APPENDTEXT ($HWND , $STEXT ) ELSE _GUICTRLEDIT_SETSEL ($HWND , $IINDEX , $IINDEX ) _SENDMESSAGE ($HWND , $EM_REPLACESEL , TRUE , $STEXT , 0 , "wparam" , "wstr" ) ENDIF ENDFUNC FUNC _GUICTRLEDIT_LINEFROMCHAR ($HWND , $IINDEX = + 4294967295 ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $EM_LINEFROMCHAR , $IINDEX ) ENDFUNC FUNC _GUICTRLEDIT_LINEINDEX ($HWND , $IINDEX = + 4294967295 ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $EM_LINEINDEX , $IINDEX ) ENDFUNC FUNC _GUICTRLEDIT_LINELENGTH ($HWND , $IINDEX = + 4294967295 ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $ICHARINDEX = _GUICTRLEDIT_LINEINDEX ($HWND , $IINDEX ) RETURN _SENDMESSAGE ($HWND , $EM_LINELENGTH , $ICHARINDEX ) ENDFUNC FUNC _GUICTRLEDIT_LINESCROLL ($HWND , $IHORIZ , $IVERT ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $EM_LINESCROLL , $IHORIZ , $IVERT ) <> 0 ENDFUNC FUNC _GUICTRLEDIT_POSFROMCHAR ($HWND , $IINDEX ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $ACOORD [2 ] LOCAL $IRET = _SENDMESSAGE ($HWND , $EM_POSFROMCHAR , $IINDEX ) $ACOORD [0 ] = _WINAPI_LOWORD ($IRET ) $ACOORD [1 ] = _WINAPI_HIWORD ($IRET ) RETURN $ACOORD ENDFUNC FUNC _GUICTRLEDIT_REPLACESEL ($HWND , $STEXT , $BUNDO = TRUE ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) _SENDMESSAGE ($HWND , $EM_REPLACESEL , $BUNDO , $STEXT , 0 , "wparam" , "wstr" ) ENDFUNC FUNC _GUICTRLEDIT_SCROLL ($HWND , $IDIRECTION ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) IF BITAND ($IDIRECTION , $__EDITCONSTANT_SB_LINEDOWN ) <> $__EDITCONSTANT_SB_LINEDOWN AND BITAND ($IDIRECTION , $__EDITCONSTANT_SB_LINEUP ) <> $__EDITCONSTANT_SB_LINEUP AND BITAND ($IDIRECTION , $__EDITCONSTANT_SB_PAGEDOWN ) <> $__EDITCONSTANT_SB_PAGEDOWN AND BITAND ($IDIRECTION , $__EDITCONSTANT_SB_PAGEUP ) <> $__EDITCONSTANT_SB_PAGEUP AND BITAND ($IDIRECTION , $__EDITCONSTANT_SB_SCROLLCARET ) <> $__EDITCONSTANT_SB_SCROLLCARET THEN RETURN 0 IF $IDIRECTION == $__EDITCONSTANT_SB_SCROLLCARET THEN RETURN _SENDMESSAGE ($HWND , $EM_SCROLLCARET ) ELSE RETURN _SENDMESSAGE ($HWND , $EM_SCROLL , $IDIRECTION ) ENDIF ENDFUNC FUNC _GUICTRLEDIT_SETCUEBANNER ($HWND , $STEXT , $BONFOCUS = FALSE ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $TTEXT = _WINAPI_MULTIBYTETOWIDECHAR ($STEXT ) RETURN _SENDMESSAGE ($HWND , $EM_SETCUEBANNER , $BONFOCUS , $TTEXT , 0 , "wparam" , "struct*" ) = 1 ENDFUNC FUNC _GUICTRLEDIT_SETHANDLE ($HWND , $HMEMORY ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) _SENDMESSAGE ($HWND , $EM_SETHANDLE , $HMEMORY , 0 , 0 , "handle" ) ENDFUNC FUNC _GUICTRLEDIT_SETIMESTATUS ($HWND , $ICOMPOSITION ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $EM_SETIMESTATUS , $EMSIS_COMPOSITIONSTRING , $ICOMPOSITION ) ENDFUNC FUNC _GUICTRLEDIT_SETLIMITTEXT ($HWND , $ILIMIT ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) _SENDMESSAGE ($HWND , $EM_SETLIMITTEXT , $ILIMIT ) ENDFUNC FUNC _GUICTRLEDIT_SETMARGINS ($HWND , $IMARGIN = 1 , $ILEFT = 65535 , $IRIGHT = 65535 ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) _SENDMESSAGE ($HWND , $EM_SETMARGINS , $IMARGIN , _WINAPI_MAKELONG ($ILEFT , $IRIGHT ) ) ENDFUNC FUNC _GUICTRLEDIT_SETMODIFY ($HWND , $BMODIFIED ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) _SENDMESSAGE ($HWND , $EM_SETMODIFY , $BMODIFIED ) ENDFUNC FUNC _GUICTRLEDIT_SETPASSWORDCHAR ($HWND , $SDISPLAYCHAR = "0" ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) $SDISPLAYCHAR = STRINGLEFT ($SDISPLAYCHAR , 1 ) IF ASC ($SDISPLAYCHAR ) = 48 THEN _SENDMESSAGE ($HWND , $EM_SETPASSWORDCHAR ) ELSE _SENDMESSAGE ($HWND , $EM_SETPASSWORDCHAR , ASC ($SDISPLAYCHAR ) ) ENDIF ENDFUNC FUNC _GUICTRLEDIT_SETREADONLY ($HWND , $BREADONLY ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $EM_SETREADONLY , $BREADONLY ) <> 0 ENDFUNC FUNC _GUICTRLEDIT_SETRECT ($HWND , $ARECT ) LOCAL $TRECT = DLLSTRUCTCREATE ($TAGRECT ) DLLSTRUCTSETDATA ($TRECT , "Left" , $ARECT [0 ] ) DLLSTRUCTSETDATA ($TRECT , "Top" , $ARECT [1 ] ) DLLSTRUCTSETDATA ($TRECT , "Right" , $ARECT [2 ] ) DLLSTRUCTSETDATA ($TRECT , "Bottom" , $ARECT [3 ] ) _GUICTRLEDIT_SETRECTEX ($HWND , $TRECT ) ENDFUNC FUNC _GUICTRLEDIT_SETRECTEX ($HWND , $TRECT ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) _SENDMESSAGE ($HWND , $EM_SETRECT , 0 , $TRECT , 0 , "wparam" , "struct*" ) ENDFUNC FUNC _GUICTRLEDIT_SETRECTNP ($HWND , $ARECT ) LOCAL $TRECT = DLLSTRUCTCREATE ($TAGRECT ) DLLSTRUCTSETDATA ($TRECT , "Left" , $ARECT [0 ] ) DLLSTRUCTSETDATA ($TRECT , "Top" , $ARECT [1 ] ) DLLSTRUCTSETDATA ($TRECT , "Right" , $ARECT [2 ] ) DLLSTRUCTSETDATA ($TRECT , "Bottom" , $ARECT [3 ] ) _GUICTRLEDIT_SETRECTNPEX ($HWND , $TRECT ) ENDFUNC FUNC _GUICTRLEDIT_SETRECTNPEX ($HWND , $TRECT ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) _SENDMESSAGE ($HWND , $EM_SETRECTNP , 0 , $TRECT , 0 , "wparam" , "struct*" ) ENDFUNC FUNC _GUICTRLEDIT_SETSEL ($HWND , $ISTART , $IEND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) _SENDMESSAGE ($HWND , $EM_SETSEL , $ISTART , $IEND ) ENDFUNC FUNC _GUICTRLEDIT_SETTABSTOPS ($HWND , $ATABSTOPS ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) IF NOT ISARRAY ($ATABSTOPS ) THEN RETURN SETERROR (+ 4294967295 , + 4294967295 , FALSE ) LOCAL $STABSTOPS = "" LOCAL $INUMTABSTOPS = UBOUND ($ATABSTOPS ) FOR $X = 0 TO $INUMTABSTOPS + 4294967295 $STABSTOPS &= "int;" NEXT $STABSTOPS = STRINGTRIMRIGHT ($STABSTOPS , 1 ) LOCAL $TTABSTOPS = DLLSTRUCTCREATE ($STABSTOPS ) FOR $X = 0 TO $INUMTABSTOPS + 4294967295 DLLSTRUCTSETDATA ($TTABSTOPS , $X + 1 , $ATABSTOPS [$X ] ) NEXT LOCAL $IRET = _SENDMESSAGE ($HWND , $EM_SETTABSTOPS , $INUMTABSTOPS , $TTABSTOPS , 0 , "wparam" , "struct*" ) <> 0 _WINAPI_INVALIDATERECT ($HWND ) RETURN $IRET ENDFUNC FUNC _GUICTRLEDIT_SETTEXT ($HWND , $STEXT ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) _SENDMESSAGE ($HWND , $__EDITCONSTANT_WM_SETTEXT , 0 , $STEXT , 0 , "wparam" , "wstr" ) ENDFUNC FUNC _GUICTRLEDIT_SETWORDBREAKPROC ($HWND , $IADDRESSFUNC ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) _SENDMESSAGE ($HWND , $EM_SETWORDBREAKPROC , 0 , $IADDRESSFUNC ) ENDFUNC FUNC _GUICTRLEDIT_SHOWBALLOONTIP ($HWND , $STITLE , $STEXT , $IICON ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $TTITLE = _WINAPI_MULTIBYTETOWIDECHAR ($STITLE ) LOCAL $TTEXT = _WINAPI_MULTIBYTETOWIDECHAR ($STEXT ) LOCAL $TTT = DLLSTRUCTCREATE ($__TAGEDITBALLOONTIP ) DLLSTRUCTSETDATA ($TTT , "Size" , DLLSTRUCTGETSIZE ($TTT ) ) DLLSTRUCTSETDATA ($TTT , "Title" , DLLSTRUCTGETPTR ($TTITLE ) ) DLLSTRUCTSETDATA ($TTT , "Text" , DLLSTRUCTGETPTR ($TTEXT ) ) DLLSTRUCTSETDATA ($TTT , "Icon" , $IICON ) RETURN _SENDMESSAGE ($HWND , $EM_SHOWBALLOONTIP , 0 , $TTT , 0 , "wparam" , "struct*" ) <> 0 ENDFUNC FUNC _GUICTRLEDIT_UNDO ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $EM_UNDO ) <> 0 ENDFUNC GLOBAL CONST $RT_ACCELERATOR = 9 GLOBAL CONST $RT_ANICURSOR = 21 GLOBAL CONST $RT_ANIICON = 22 GLOBAL CONST $RT_BITMAP = 2 GLOBAL CONST $RT_CURSOR = 1 GLOBAL CONST $RT_DIALOG = 5 GLOBAL CONST $RT_DLGINCLUDE = 17 GLOBAL CONST $RT_FONT = 8 GLOBAL CONST $RT_FONTDIR = 7 GLOBAL CONST $RT_GROUP_CURSOR = 12 GLOBAL CONST $RT_GROUP_ICON = 14 GLOBAL CONST $RT_HTML = 23 GLOBAL CONST $RT_ICON = 3 GLOBAL CONST $RT_MANIFEST = 24 GLOBAL CONST $RT_MENU = 4 GLOBAL CONST $RT_MESSAGETABLE = 11 GLOBAL CONST $RT_PLUGPLAY = 19 GLOBAL CONST $RT_RCDATA = 10 GLOBAL CONST $RT_STRING = 6 GLOBAL CONST $RT_VERSION = 16 GLOBAL CONST $RT_VXD = 20 GLOBAL CONST $FILE_VER_GET_LOCALISED = 1 GLOBAL CONST $FILE_VER_GET_NEUTRAL = 2 GLOBAL CONST $FILE_VER_GET_PREFETCHED = 4 GLOBAL CONST $OBM_TRTYPE = 32732 GLOBAL CONST $OBM_LFARROWI = 32734 GLOBAL CONST $OBM_RGARROWI = 32735 GLOBAL CONST $OBM_DNARROWI = 32736 GLOBAL CONST $OBM_UPARROWI = 32737 GLOBAL CONST $OBM_COMBO = 32738 GLOBAL CONST $OBM_MNARROW = 32739 GLOBAL CONST $OBM_LFARROWD = 32740 GLOBAL CONST $OBM_RGARROWD = 32741 GLOBAL CONST $OBM_DNARROWD = 32742 GLOBAL CONST $OBM_UPARROWD = 32743 GLOBAL CONST $OBM_RESTORED = 32744 GLOBAL CONST $OBM_ZOOMD = 32745 GLOBAL CONST $OBM_REDUCED = 32746 GLOBAL CONST $OBM_RESTORE = 32747 GLOBAL CONST $OBM_ZOOM = 32748 GLOBAL CONST $OBM_REDUCE = 32749 GLOBAL CONST $OBM_LFARROW = 32750 GLOBAL CONST $OBM_RGARROW = 32751 GLOBAL CONST $OBM_DNARROW = 32752 GLOBAL CONST $OBM_UPARROW = 32753 GLOBAL CONST $OBM_CLOSE = 32754 GLOBAL CONST $OBM_OLD_RESTORE = 32755 GLOBAL CONST $OBM_OLD_ZOOM = 32756 GLOBAL CONST $OBM_OLD_REDUCE = 32757 GLOBAL CONST $OBM_BTNCORNERS = 32758 GLOBAL CONST $OBM_CHECKBOXES = 32759 GLOBAL CONST $OBM_CHECK = 32760 GLOBAL CONST $OBM_BTSIZE = 32761 GLOBAL CONST $OBM_OLD_LFARROW = 32762 GLOBAL CONST $OBM_OLD_RGARROW = 32763 GLOBAL CONST $OBM_OLD_DNARROW = 32764 GLOBAL CONST $OBM_OLD_UPARROW = 32765 GLOBAL CONST $OBM_SIZE = 32766 GLOBAL CONST $OBM_OLD_CLOSE = 32767 GLOBAL CONST $OIC_SAMPLE = 32512 GLOBAL CONST $OIC_HAND = 32513 GLOBAL CONST $OIC_QUES = 32514 GLOBAL CONST $OIC_BANG = 32515 GLOBAL CONST $OIC_NOTE = 32516 GLOBAL CONST $OIC_WINLOGO = 32517 GLOBAL CONST $OIC_WARNING = $OIC_BANG GLOBAL CONST $OIC_ERROR = $OIC_HAND GLOBAL CONST $OIC_INFORMATION = $OIC_NOTE GLOBAL CONST $DONT_RESOLVE_DLL_REFERENCES = 1 GLOBAL CONST $LOAD_LIBRARY_AS_DATAFILE = 2 GLOBAL CONST $LOAD_WITH_ALTERED_SEARCH_PATH = 8 GLOBAL CONST $LOAD_IGNORE_CODE_AUTHZ_LEVEL = 16 GLOBAL CONST $LOAD_LIBRARY_AS_DATAFILE_EXCLUSIVE = 64 GLOBAL CONST $LOAD_LIBRARY_AS_IMAGE_RESOURCE = 32 GLOBAL CONST $LOAD_LIBRARY_SEARCH_APPLICATION_DIR = 512 GLOBAL CONST $LOAD_LIBRARY_SEARCH_DEFAULT_DIRS = 4096 GLOBAL CONST $LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR = 256 GLOBAL CONST $LOAD_LIBRARY_SEARCH_SYSTEM32 = 2048 GLOBAL CONST $LOAD_LIBRARY_SEARCH_USER_DIRS = 1024 GLOBAL CONST $OCR_NORMAL = 32512 GLOBAL CONST $OCR_IBEAM = 32513 GLOBAL CONST $OCR_WAIT = 32514 GLOBAL CONST $OCR_CROSS = 32515 GLOBAL CONST $OCR_UP = 32516 GLOBAL CONST $OCR_SIZE = 32640 GLOBAL CONST $OCR_ICON = 32641 GLOBAL CONST $OCR_SIZENWSE = 32642 GLOBAL CONST $OCR_SIZENESW = 32643 GLOBAL CONST $OCR_SIZEWE = 32644 GLOBAL CONST $OCR_SIZENS = 32645 GLOBAL CONST $OCR_SIZEALL = 32646 GLOBAL CONST $OCR_ICOCUR = 32647 GLOBAL CONST $OCR_NO = 32648 GLOBAL CONST $OCR_HAND = 32649 GLOBAL CONST $OCR_APPSTARTING = 32650 GLOBAL CONST $OCR_HELP = 32651 GLOBAL CONST $VS_FF_DEBUG = 1 GLOBAL CONST $VS_FF_INFOINFERRED = 16 GLOBAL CONST $VS_FF_PATCHED = 4 GLOBAL CONST $VS_FF_PRERELEASE = 2 GLOBAL CONST $VS_FF_PRIVATEBUILD = 8 GLOBAL CONST $VS_FF_SPECIALBUILD = 32 GLOBAL CONST $VOS_DOS = 65536 GLOBAL CONST $VOS_NT = 262144 GLOBAL CONST $VOS__WINDOWS16 = 1 GLOBAL CONST $VOS__WINDOWS32 = 4 GLOBAL CONST $VOS_OS216 = 131072 GLOBAL CONST $VOS_OS232 = 196608 GLOBAL CONST $VOS__PM16 = 2 GLOBAL CONST $VOS__PM32 = 3 GLOBAL CONST $VOS_UNKNOWN = 0 GLOBAL CONST $VOS_DOS_WINDOWS16 = 65537 GLOBAL CONST $VOS_DOS_WINDOWS32 = 65540 GLOBAL CONST $VOS_NT_WINDOWS32 = 262148 GLOBAL CONST $VOS_OS216_PM16 = 131074 GLOBAL CONST $VOS_OS232_PM32 = 196611 GLOBAL CONST $VFT_APP = 1 GLOBAL CONST $VFT_DLL = 2 GLOBAL CONST $VFT_DRV = 3 GLOBAL CONST $VFT_FONT = 4 GLOBAL CONST $VFT_STATIC_LIB = 7 GLOBAL CONST $VFT_UNKNOWN = 0 GLOBAL CONST $VFT_VXD = 5 GLOBAL CONST $VFT2_DRV_COMM = 10 GLOBAL CONST $VFT2_DRV_DISPLAY = 4 GLOBAL CONST $VFT2_DRV_INSTALLABLE = 8 GLOBAL CONST $VFT2_DRV_KEYBOARD = 2 GLOBAL CONST $VFT2_DRV_LANGUAGE = 3 GLOBAL CONST $VFT2_DRV_MOUSE = 5 GLOBAL CONST $VFT2_DRV_NETWORK = 6 GLOBAL CONST $VFT2_DRV_PRINTER = 1 GLOBAL CONST $VFT2_DRV_SOUND = 9 GLOBAL CONST $VFT2_DRV_SYSTEM = 7 GLOBAL CONST $VFT2_DRV_VERSIONED_PRINTER = 12 GLOBAL CONST $VFT2_UNKNOWN = 0 GLOBAL CONST $VFT2_FONT_RASTER = 1 GLOBAL CONST $VFT2_FONT_TRUETYPE = 3 GLOBAL CONST $VFT2_FONT_VECTOR = 2 #Region Global Variables and Constants GLOBAL $__G_HHEAP = 0 #EndRegion Global Variables and Constants #Region Functions list #EndRegion Functions list #Region Public Functions FUNC _WINAPI_CREATEBUFFER ($ILENGTH , $PBUFFER = 0 , $BABORT = TRUE ) $PBUFFER = __HEAPREALLOC ($PBUFFER , $ILENGTH , 0 , $BABORT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $PBUFFER ENDFUNC FUNC _WINAPI_CREATEBUFFERFROMSTRUCT ($TSTRUCT , $PBUFFER = 0 , $BABORT = TRUE ) IF NOT ISDLLSTRUCT ($TSTRUCT ) THEN RETURN SETERROR (1 , 0 , 0 ) $PBUFFER = __HEAPREALLOC ($PBUFFER , DLLSTRUCTGETSIZE ($TSTRUCT ) , 0 , $BABORT ) IF @ERROR THEN RETURN SETERROR (@ERROR + 100 , @EXTENDED , 0 ) _WINAPI_MOVEMEMORY ($PBUFFER , $TSTRUCT , DLLSTRUCTGETSIZE ($TSTRUCT ) ) RETURN $PBUFFER ENDFUNC FUNC _WINAPI_CREATESTRING ($SSTRING , $PSTRING = 0 , $ILENGTH = + 4294967295 , $BUNICODE = TRUE , $BABORT = TRUE ) $ILENGTH = NUMBER ($ILENGTH ) IF $ILENGTH >= 0 THEN $SSTRING = STRINGLEFT ($SSTRING , $ILENGTH ) ELSE $ILENGTH = STRINGLEN ($SSTRING ) ENDIF LOCAL $ISIZE = $ILENGTH + 1 IF $BUNICODE THEN $ISIZE *= 2 ENDIF $PSTRING = __HEAPREALLOC ($PSTRING , $ISIZE , 0 , $BABORT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) DLLSTRUCTSETDATA (DLLSTRUCTCREATE (($BUNICODE "wchar" "char" ) & "[" & ($ILENGTH + 1 ) & "]" , $PSTRING ) , 1 , $SSTRING ) RETURN SETEXTENDED ($ILENGTH , $PSTRING ) ENDFUNC FUNC _WINAPI_EQUALMEMORY ($PSOURCE1 , $PSOURCE2 , $ILENGTH ) IF _WINAPI_ISBADREADPTR ($PSOURCE1 , $ILENGTH ) THEN RETURN SETERROR (11 , @EXTENDED , 0 ) IF _WINAPI_ISBADREADPTR ($PSOURCE2 , $ILENGTH ) THEN RETURN SETERROR (12 , @EXTENDED , 0 ) LOCAL $ARET = DLLCALL ("ntdll.dll" , "ulong_ptr" , "RtlCompareMemory" , "struct*" , $PSOURCE1 , "struct*" , $PSOURCE2 , "ulong_ptr" , $ILENGTH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN NUMBER ($ARET [0 ] = $ILENGTH ) ENDFUNC FUNC _WINAPI_FILLMEMORY ($PMEMORY , $ILENGTH , $IVALUE = 0 ) IF _WINAPI_ISBADWRITEPTR ($PMEMORY , $ILENGTH ) THEN RETURN SETERROR (11 , @EXTENDED , 0 ) DLLCALL ("ntdll.dll" , "none" , "RtlFillMemory" , "struct*" , $PMEMORY , "ulong_ptr" , $ILENGTH , "byte" , $IVALUE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN 1 ENDFUNC FUNC _WINAPI_FREEMEMORY ($PMEMORY ) IF NOT __HEAPFREE ($PMEMORY , 1 ) THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN 1 ENDFUNC FUNC _WINAPI_GETMEMORYSIZE ($PMEMORY ) LOCAL $IRESULT = __HEAPSIZE ($PMEMORY , 1 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $IRESULT ENDFUNC FUNC _WINAPI_GLOBALMEMORYSTATUS () LOCAL CONST $TAGMEMORYSTATUSEX = "dword Length;dword MemoryLoad;" & "uint64 TotalPhys;uint64 AvailPhys;uint64 TotalPageFile;uint64 AvailPageFile;" & "uint64 TotalVirtual;uint64 AvailVirtual;uint64 AvailExtendedVirtual" LOCAL $TMEM = DLLSTRUCTCREATE ($TAGMEMORYSTATUSEX ) DLLSTRUCTSETDATA ($TMEM , 1 , DLLSTRUCTGETSIZE ($TMEM ) ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "GlobalMemoryStatusEx" , "struct*" , $TMEM ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $AMEM [7 ] $AMEM [0 ] = DLLSTRUCTGETDATA ($TMEM , 2 ) $AMEM [1 ] = DLLSTRUCTGETDATA ($TMEM , 3 ) $AMEM [2 ] = DLLSTRUCTGETDATA ($TMEM , 4 ) $AMEM [3 ] = DLLSTRUCTGETDATA ($TMEM , 5 ) $AMEM [4 ] = DLLSTRUCTGETDATA ($TMEM , 6 ) $AMEM [5 ] = DLLSTRUCTGETDATA ($TMEM , 7 ) $AMEM [6 ] = DLLSTRUCTGETDATA ($TMEM , 8 ) RETURN $AMEM ENDFUNC FUNC _WINAPI_ISBADCODEPTR ($PADDRESS ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "IsBadCodePtr" , "struct*" , $PADDRESS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_ISBADREADPTR ($PADDRESS , $ILENGTH ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "IsBadReadPtr" , "struct*" , $PADDRESS , "uint_ptr" , $ILENGTH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_ISBADSTRINGPTR ($PADDRESS , $ILENGTH ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "IsBadStringPtr" , "struct*" , $PADDRESS , "uint_ptr" , $ILENGTH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_ISBADWRITEPTR ($PADDRESS , $ILENGTH ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "IsBadWritePtr" , "struct*" , $PADDRESS , "uint_ptr" , $ILENGTH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_ISMEMORY ($PMEMORY ) LOCAL $BRESULT = __HEAPVALIDATE ($PMEMORY ) RETURN SETERROR (@ERROR , @EXTENDED , $BRESULT ) ENDFUNC FUNC _WINAPI_LOCALFREE ($HMEMORY ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "handle" , "LocalFree" , "handle" , $HMEMORY ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_MOVEMEMORY ($PDESTINATION , $PSOURCE , $ILENGTH ) IF _WINAPI_ISBADREADPTR ($PSOURCE , $ILENGTH ) THEN RETURN SETERROR (10 , @EXTENDED , 0 ) IF _WINAPI_ISBADWRITEPTR ($PDESTINATION , $ILENGTH ) THEN RETURN SETERROR (11 , @EXTENDED , 0 ) DLLCALL ("ntdll.dll" , "none" , "RtlMoveMemory" , "struct*" , $PDESTINATION , "struct*" , $PSOURCE , "ulong_ptr" , $ILENGTH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN 1 ENDFUNC FUNC _WINAPI_READPROCESSMEMORY ($HPROCESS , $PBASEADDRESS , $PBUFFER , $ISIZE , BYREF $IREAD ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "bool" , "ReadProcessMemory" , "handle" , $HPROCESS , "ptr" , $PBASEADDRESS , "struct*" , $PBUFFER , "ulong_ptr" , $ISIZE , "ulong_ptr*" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) $IREAD = $ARESULT [5 ] RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_WRITEPROCESSMEMORY ($HPROCESS , $PBASEADDRESS , $PBUFFER , $ISIZE , BYREF $IWRITTEN , $SBUFFER = "ptr" ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "bool" , "WriteProcessMemory" , "handle" , $HPROCESS , "ptr" , $PBASEADDRESS , $SBUFFER , $PBUFFER , "ulong_ptr" , $ISIZE , "ulong_ptr*" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) $IWRITTEN = $ARESULT [5 ] RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_ZEROMEMORY ($PMEMORY , $ILENGTH ) IF _WINAPI_ISBADWRITEPTR ($PMEMORY , $ILENGTH ) THEN RETURN SETERROR (11 , @EXTENDED , 0 ) DLLCALL ("ntdll.dll" , "none" , "RtlZeroMemory" , "struct*" , $PMEMORY , "ulong_ptr" , $ILENGTH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN 1 ENDFUNC #EndRegion Public Functions #Region Internal Functions FUNC __HEAPALLOC ($ISIZE , $BABORT = FALSE ) LOCAL $ARET IF NOT $__G_HHEAP THEN $ARET = DLLCALL ("kernel32.dll" , "handle" , "HeapCreate" , "dword" , 0 , "ulong_ptr" , 0 , "ulong_ptr" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN __FATALEXIT (1 , "Error allocating memory." ) $__G_HHEAP = $ARET [0 ] ENDIF $ARET = DLLCALL ("kernel32.dll" , "ptr" , "HeapAlloc" , "handle" , $__G_HHEAP , "dword" , 8 , "ulong_ptr" , $ISIZE ) IF @ERROR OR NOT $ARET [0 ] THEN IF $BABORT THEN __FATALEXIT (1 , "Error allocating memory." ) RETURN SETERROR (@ERROR + 30 , @EXTENDED , 0 ) ENDIF RETURN $ARET [0 ] ENDFUNC FUNC __HEAPFREE (BYREF $PMEMORY , $BCHECK = FALSE , $ICURERR = @ERROR , $ICUREXT = @EXTENDED ) IF $BCHECK AND (NOT __HEAPVALIDATE ($PMEMORY ) ) THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "int" , "HeapFree" , "handle" , $__G_HHEAP , "dword" , 0 , "ptr" , $PMEMORY ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 40 , @EXTENDED , 0 ) $PMEMORY = 0 RETURN SETERROR ($ICURERR , $ICUREXT , 1 ) ENDFUNC FUNC __HEAPREALLOC ($PMEMORY , $ISIZE , $BAMOUNT = FALSE , $BABORT = FALSE ) LOCAL $ARET , $PRET IF __HEAPVALIDATE ($PMEMORY ) THEN IF $BAMOUNT AND (__HEAPSIZE ($PMEMORY ) >= $ISIZE ) THEN RETURN SETEXTENDED (1 , PTR ($PMEMORY ) ) $ARET = DLLCALL ("kernel32.dll" , "ptr" , "HeapReAlloc" , "handle" , $__G_HHEAP , "dword" , 8 , "ptr" , $PMEMORY , "ulong_ptr" , $ISIZE ) IF @ERROR OR NOT $ARET [0 ] THEN IF $BABORT THEN __FATALEXIT (1 , "Error allocating memory." ) RETURN SETERROR (@ERROR + 20 , @EXTENDED , PTR ($PMEMORY ) ) ENDIF $PRET = $ARET [0 ] ELSE $PRET = __HEAPALLOC ($ISIZE , $BABORT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) ENDIF RETURN $PRET ENDFUNC FUNC __HEAPSIZE ($PMEMORY , $BCHECK = FALSE ) IF $BCHECK AND (NOT __HEAPVALIDATE ($PMEMORY ) ) THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "ulong_ptr" , "HeapSize" , "handle" , $__G_HHEAP , "dword" , 0 , "ptr" , $PMEMORY ) IF @ERROR OR ($ARET [0 ] = PTR (+ 4294967295 ) ) THEN RETURN SETERROR (@ERROR + 50 , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC __HEAPVALIDATE ($PMEMORY ) IF (NOT $__G_HHEAP ) OR (NOT PTR ($PMEMORY ) ) THEN RETURN SETERROR (9 , 0 , FALSE ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "int" , "HeapValidate" , "handle" , $__G_HHEAP , "dword" , 0 , "ptr" , $PMEMORY ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC #EndRegion Internal Functions GLOBAL CONST $SND_APPLICATION = 128 GLOBAL CONST $SND_ALIAS = 65536 GLOBAL CONST $SND_ALIAS_ID = 1114112 GLOBAL CONST $SND_ASYNC = 1 GLOBAL CONST $SND_FILENAME = 131072 GLOBAL CONST $SND_LOOP = 8 GLOBAL CONST $SND_MEMORY = 4 GLOBAL CONST $SND_NODEFAULT = 2 GLOBAL CONST $SND_NOSTOP = 16 GLOBAL CONST $SND_NOWAIT = 8192 GLOBAL CONST $SND_PURGE = 64 GLOBAL CONST $SND_RESOURCE = 262148 GLOBAL CONST $SND_SENTRY = 524288 GLOBAL CONST $SND_SYNC = 0 GLOBAL CONST $SND_SYSTEM = 2097152 GLOBAL CONST $SND_SYSTEM_NOSTOP = 2097168 GLOBAL CONST $SND_ALIAS_SYSTEMASTERISK = "SystemAsterisk" GLOBAL CONST $SND_ALIAS_SYSTEMDEFAULT = "SystemDefault" GLOBAL CONST $SND_ALIAS_SYSTEMEXCLAMATION = "SystemExclamation" GLOBAL CONST $SND_ALIAS_SYSTEMEXIT = "SystemExit" GLOBAL CONST $SND_ALIAS_SYSTEMHAND = "SystemHand" GLOBAL CONST $SND_ALIAS_SYSTEMQUESTION = "SystemQuestion" GLOBAL CONST $SND_ALIAS_SYSTEMSTART = "SystemStart" GLOBAL CONST $SND_ALIAS_SYSTEMWELCOME = "SystemWelcome" #Region Global Variables and Constants #EndRegion Global Variables and Constants #Region Functions list #EndRegion Functions list #Region Public Functions FUNC _WINAPI_ARRAYTOSTRUCT (CONST BYREF $ADATA , $ISTART = 0 , $IEND = + 4294967295 ) IF __CHECKERRORARRAYBOUNDS ($ADATA , $ISTART , $IEND ) THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $TAGSTRUCT = "" FOR $I = $ISTART TO $IEND $TAGSTRUCT &= "wchar[" & (STRINGLEN ($ADATA [$I ] ) + 1 ) & "];" NEXT LOCAL $TDATA = DLLSTRUCTCREATE ($TAGSTRUCT & "wchar[1]" ) LOCAL $ICOUNT = 1 FOR $I = $ISTART TO $IEND DLLSTRUCTSETDATA ($TDATA , $ICOUNT , $ADATA [$I ] ) $ICOUNT += 1 NEXT DLLSTRUCTSETDATA ($TDATA , $ICOUNT , CHRW (0 ) ) RETURN $TDATA ENDFUNC FUNC _WINAPI_CREATEMARGINS ($ILEFTWIDTH , $IRIGHTWIDTH , $ITOPHEIGHT , $IBOTTOMHEIGHT ) LOCAL $TMARGINS = DLLSTRUCTCREATE ($TAGMARGINS ) DLLSTRUCTSETDATA ($TMARGINS , 1 , $ILEFTWIDTH ) DLLSTRUCTSETDATA ($TMARGINS , 2 , $IRIGHTWIDTH ) DLLSTRUCTSETDATA ($TMARGINS , 3 , $ITOPHEIGHT ) DLLSTRUCTSETDATA ($TMARGINS , 4 , $IBOTTOMHEIGHT ) RETURN $TMARGINS ENDFUNC FUNC _WINAPI_CREATEPOINT ($IX , $IY ) LOCAL $TPOINT = DLLSTRUCTCREATE ($TAGPOINT ) DLLSTRUCTSETDATA ($TPOINT , 1 , $IX ) DLLSTRUCTSETDATA ($TPOINT , 2 , $IY ) RETURN $TPOINT ENDFUNC FUNC _WINAPI_CREATERECT ($ILEFT , $ITOP , $IRIGHT , $IBOTTOM ) LOCAL $TRECT = DLLSTRUCTCREATE ($TAGRECT ) DLLSTRUCTSETDATA ($TRECT , 1 , $ILEFT ) DLLSTRUCTSETDATA ($TRECT , 2 , $ITOP ) DLLSTRUCTSETDATA ($TRECT , 3 , $IRIGHT ) DLLSTRUCTSETDATA ($TRECT , 4 , $IBOTTOM ) RETURN $TRECT ENDFUNC FUNC _WINAPI_CREATERECTEX ($IX , $IY , $IWIDTH , $IHEIGHT ) LOCAL $TRECT = DLLSTRUCTCREATE ($TAGRECT ) DLLSTRUCTSETDATA ($TRECT , 1 , $IX ) DLLSTRUCTSETDATA ($TRECT , 2 , $IY ) DLLSTRUCTSETDATA ($TRECT , 3 , $IX + $IWIDTH ) DLLSTRUCTSETDATA ($TRECT , 4 , $IY + $IHEIGHT ) RETURN $TRECT ENDFUNC FUNC _WINAPI_CREATESIZE ($IWIDTH , $IHEIGHT ) LOCAL $TSIZE = DLLSTRUCTCREATE ($TAGSIZE ) DLLSTRUCTSETDATA ($TSIZE , 1 , $IWIDTH ) DLLSTRUCTSETDATA ($TSIZE , 2 , $IHEIGHT ) RETURN $TSIZE ENDFUNC FUNC _WINAPI_COPYSTRUCT ($TSTRUCT , $SSTRUCT = "" ) LOCAL $ISIZE = DLLSTRUCTGETSIZE ($TSTRUCT ) IF NOT $ISIZE THEN RETURN SETERROR (1 , 0 , 0 ) LOCAL $TRESULT IF NOT STRINGSTRIPWS ($SSTRUCT , $STR_STRIPLEADING + $STR_STRIPTRAILING + $STR_STRIPSPACES ) THEN $TRESULT = DLLSTRUCTCREATE ("byte[" & $ISIZE & "]" ) ELSE $TRESULT = DLLSTRUCTCREATE ($SSTRUCT ) ENDIF IF DLLSTRUCTGETSIZE ($TRESULT ) < $ISIZE THEN RETURN SETERROR (2 , 0 , 0 ) _WINAPI_MOVEMEMORY ($TRESULT , $TSTRUCT , $ISIZE ) RETURN $TRESULT ENDFUNC FUNC _WINAPI_GETEXTENDED () RETURN $__G_VEXT ENDFUNC FUNC _WINAPI_GETMOUSEPOS ($BTOCLIENT = FALSE , $HWND = 0 ) LOCAL $IMODE = OPT ("MouseCoordMode" , 1 ) LOCAL $APOS = MOUSEGETPOS () OPT ("MouseCoordMode" , $IMODE ) LOCAL $TPOINT = DLLSTRUCTCREATE ($TAGPOINT ) DLLSTRUCTSETDATA ($TPOINT , "X" , $APOS [0 ] ) DLLSTRUCTSETDATA ($TPOINT , "Y" , $APOS [1 ] ) IF $BTOCLIENT AND NOT _WINAPI_SCREENTOCLIENT ($HWND , $TPOINT ) THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , 0 ) RETURN $TPOINT ENDFUNC FUNC _WINAPI_GETMOUSEPOSX ($BTOCLIENT = FALSE , $HWND = 0 ) LOCAL $TPOINT = _WINAPI_GETMOUSEPOS ($BTOCLIENT , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN DLLSTRUCTGETDATA ($TPOINT , "X" ) ENDFUNC FUNC _WINAPI_GETMOUSEPOSY ($BTOCLIENT = FALSE , $HWND = 0 ) LOCAL $TPOINT = _WINAPI_GETMOUSEPOS ($BTOCLIENT , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN DLLSTRUCTGETDATA ($TPOINT , "Y" ) ENDFUNC FUNC _WINAPI_MULDIV ($INUMBER , $INUMERATOR , $IDENOMINATOR ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "int" , "MulDiv" , "int" , $INUMBER , "int" , $INUMERATOR , "int" , $IDENOMINATOR ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , + 4294967295 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_PLAYSOUND ($SSOUND , $IFLAGS = $SND_SYSTEM_NOSTOP , $HINSTANCE = 0 ) LOCAL $STYPEOFSOUND = "ptr" IF $SSOUND THEN IF ISSTRING ($SSOUND ) THEN $STYPEOFSOUND = "wstr" ENDIF ELSE $SSOUND = 0 $IFLAGS = 0 ENDIF LOCAL $ARET = DLLCALL ("winmm.dll" , "bool" , "PlaySoundW" , $STYPEOFSOUND , $SSOUND , "handle" , $HINSTANCE , "dword" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_STRINGLENA (CONST BYREF $TSTRING ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "int" , "lstrlenA" , "struct*" , $TSTRING ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_STRINGLENW (CONST BYREF $TSTRING ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "int" , "lstrlenW" , "struct*" , $TSTRING ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_STRUCTTOARRAY (BYREF $TSTRUCT , $IITEMS = 0 ) LOCAL $ISIZE = 2 * FLOOR (DLLSTRUCTGETSIZE ($TSTRUCT ) / 2 ) LOCAL $PSTRUCT = DLLSTRUCTGETPTR ($TSTRUCT ) IF NOT $ISIZE OR NOT $PSTRUCT THEN RETURN SETERROR (1 , 0 , 0 ) LOCAL $TDATA , $ILENGTH , $IOFFSET = 0 LOCAL $ARESULT [101 ] = [0 ] WHILE 1 $ILENGTH = _WINAPI_STRLEN ($PSTRUCT + $IOFFSET ) IF NOT $ILENGTH THEN EXITLOOP ENDIF IF 2 * (1 + $ILENGTH ) + $IOFFSET > $ISIZE THEN RETURN SETERROR (3 , 0 , 0 ) $TDATA = DLLSTRUCTCREATE ("wchar[" & (1 + $ILENGTH ) & "]" , $PSTRUCT + $IOFFSET ) IF @ERROR THEN RETURN SETERROR (@ERROR + 10 , 0 , 0 ) __INC ($ARESULT ) $ARESULT [$ARESULT [0 ] ] = DLLSTRUCTGETDATA ($TDATA , 1 ) IF $ARESULT [0 ] = $IITEMS THEN EXITLOOP ENDIF $IOFFSET += 2 * (1 + $ILENGTH ) IF $IOFFSET >= $ISIZE THEN RETURN SETERROR (3 , 0 , 0 ) WEND IF NOT $ARESULT [0 ] THEN RETURN SETERROR (2 , 0 , 0 ) __INC ($ARESULT , + 4294967295 ) RETURN $ARESULT ENDFUNC FUNC _WINAPI_UNIONSTRUCT ($TSTRUCT1 , $TSTRUCT2 , $SSTRUCT = "" ) LOCAL $ASIZE [2 ] = [DLLSTRUCTGETSIZE ($TSTRUCT1 ) , DLLSTRUCTGETSIZE ($TSTRUCT2 ) ] IF NOT $ASIZE [0 ] OR NOT $ASIZE [1 ] THEN RETURN SETERROR (1 , 0 , 0 ) LOCAL $TRESULT IF NOT STRINGSTRIPWS ($SSTRUCT , $STR_STRIPLEADING + $STR_STRIPTRAILING + $STR_STRIPSPACES ) THEN $TRESULT = DLLSTRUCTCREATE ("byte[" & ($ASIZE [0 ] + $ASIZE [1 ] ) & "]" ) ELSE $TRESULT = DLLSTRUCTCREATE ($SSTRUCT ) ENDIF IF DLLSTRUCTGETSIZE ($TRESULT ) < ($ASIZE [0 ] + $ASIZE [1 ] ) THEN RETURN SETERROR (2 , 0 , 0 ) _WINAPI_MOVEMEMORY ($TRESULT , $TSTRUCT1 , $ASIZE [0 ] ) _WINAPI_MOVEMEMORY (DLLSTRUCTGETPTR ($TRESULT ) + $ASIZE [0 ] , $TSTRUCT2 , $ASIZE [1 ] ) RETURN $TRESULT ENDFUNC #EndRegion Public Functions #Region Global Variables and Constants GLOBAL CONST $TAGBITMAP = "struct;long bmType;long bmWidth;long bmHeight;long bmWidthBytes;ushort bmPlanes;ushort bmBitsPixel;ptr bmBits;endstruct" GLOBAL CONST $TAGBITMAPV5HEADER = "struct;dword bV5Size;long bV5Width;long bV5Height;ushort bV5Planes;ushort bV5BitCount;dword bV5Compression;dword bV5SizeImage;long bV5XPelsPerMeter;long bV5YPelsPerMeter;dword bV5ClrUsed;dword bV5ClrImportant;dword bV5RedMask;dword bV5GreenMask;dword bV5BlueMask;dword bV5AlphaMask;dword bV5CSType;int bV5Endpoints[9];dword bV5GammaRed;dword bV5GammaGreen;dword bV5GammaBlue;dword bV5Intent;dword bV5ProfileData;dword bV5ProfileSize;dword bV5Reserved;endstruct" GLOBAL CONST $TAGDIBSECTION = $TAGBITMAP & ";" & $TAGBITMAPINFOHEADER & ";dword dsBitfields[3];ptr dshSection;dword dsOffset" GLOBAL CONST $TMPF_FIXED_PITCH = 1 GLOBAL CONST $TMPF_VECTOR = 2 GLOBAL CONST $TMPF_TRUETYPE = 4 GLOBAL CONST $TMPF_DEVICE = 8 GLOBAL CONST $__WINAPICONSTANT_FW_NORMAL = 400 GLOBAL CONST $__WINAPICONSTANT_DEFAULT_CHARSET = 1 GLOBAL CONST $__WINAPICONSTANT_OUT_DEFAULT_PRECIS = 0 GLOBAL CONST $__WINAPICONSTANT_CLIP_DEFAULT_PRECIS = 0 GLOBAL CONST $__WINAPICONSTANT_DEFAULT_QUALITY = 0 #EndRegion Global Variables and Constants #Region Functions list #EndRegion Functions list #Region Public Functions FUNC _WINAPI_BITBLT ($HDESTDC , $IXDEST , $IYDEST , $IWIDTH , $IHEIGHT , $HSRCDC , $IXSRC , $IYSRC , $IROP ) LOCAL $ARESULT = DLLCALL ("gdi32.dll" , "bool" , "BitBlt" , "handle" , $HDESTDC , "int" , $IXDEST , "int" , $IYDEST , "int" , $IWIDTH , "int" , $IHEIGHT , "handle" , $HSRCDC , "int" , $IXSRC , "int" , $IYSRC , "dword" , $IROP ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_COMBINERGN ($HRGNDEST , $HRGNSRC1 , $HRGNSRC2 , $ICOMBINEMODE ) LOCAL $ARESULT = DLLCALL ("gdi32.dll" , "int" , "CombineRgn" , "handle" , $HRGNDEST , "handle" , $HRGNSRC1 , "handle" , $HRGNSRC2 , "int" , $ICOMBINEMODE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_COPYBITMAP ($HBITMAP ) $HBITMAP = _WINAPI_COPYIMAGE ($HBITMAP , 0 , 0 , 0 , 8192 ) RETURN SETERROR (@ERROR , @EXTENDED , $HBITMAP ) ENDFUNC FUNC _WINAPI_COPYIMAGE ($HIMAGE , $ITYPE = 0 , $IXDESIREDPIXELS = 0 , $IYDESIREDPIXELS = 0 , $IFLAGS = 0 ) LOCAL $ARET = DLLCALL ("user32.dll" , "handle" , "CopyImage" , "handle" , $HIMAGE , "uint" , $ITYPE , "int" , $IXDESIREDPIXELS , "int" , $IYDESIREDPIXELS , "uint" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_CREATEANDBITMAP ($HBITMAP ) LOCAL $IERROR = 0 , $HDIB = 0 $HBITMAP = _WINAPI_COPYBITMAP ($HBITMAP ) IF NOT $HBITMAP THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , 0 ) DO LOCAL $ATDIB [2 ] $ATDIB [0 ] = DLLSTRUCTCREATE ($TAGDIBSECTION ) IF (NOT _WINAPI_GETOBJECT ($HBITMAP , DLLSTRUCTGETSIZE ($ATDIB [0 ] ) , $ATDIB [0 ] ) ) OR (DLLSTRUCTGETDATA ($ATDIB [0 ] , "bmBitsPixel" ) <> 32 ) OR (DLLSTRUCTGETDATA ($ATDIB [0 ] , "biCompression" ) ) THEN $IERROR = 10 EXITLOOP ENDIF $ATDIB [1 ] = DLLSTRUCTCREATE ($TAGBITMAP ) $HDIB = _WINAPI_CREATEDIB (DLLSTRUCTGETDATA ($ATDIB [0 ] , "bmWidth" ) , DLLSTRUCTGETDATA ($ATDIB [0 ] , "bmHeight" ) , 1 ) IF NOT _WINAPI_GETOBJECT ($HDIB , DLLSTRUCTGETSIZE ($ATDIB [1 ] ) , $ATDIB [1 ] ) THEN $IERROR = 11 EXITLOOP ENDIF LOCAL $ARET = DLLCALL ("user32.dll" , "lresult" , "CallWindowProc" , "ptr" , __ANDPROC () , "ptr" , 0 , "uint" , 0 , "wparam" , DLLSTRUCTGETPTR ($ATDIB [0 ] ) , "lparam" , DLLSTRUCTGETPTR ($ATDIB [1 ] ) ) IF @ERROR THEN $IERROR = @ERROR EXITLOOP ENDIF IF NOT $ARET [0 ] THEN $IERROR = 12 EXITLOOP ENDIF $IERROR = 0 UNTIL 1 _WINAPI_DELETEOBJECT ($HBITMAP ) IF $IERROR THEN IF $HDIB THEN _WINAPI_DELETEOBJECT ($HDIB ) ENDIF $HDIB = 0 ENDIF RETURN SETERROR ($IERROR , 0 , $HDIB ) ENDFUNC FUNC _WINAPI_CREATEBITMAP ($IWIDTH , $IHEIGHT , $IPLANES = 1 , $IBITSPERPEL = 1 , $PBITS = 0 ) LOCAL $ARESULT = DLLCALL ("gdi32.dll" , "handle" , "CreateBitmap" , "int" , $IWIDTH , "int" , $IHEIGHT , "uint" , $IPLANES , "uint" , $IBITSPERPEL , "struct*" , $PBITS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_CREATECOMPATIBLEBITMAP ($HDC , $IWIDTH , $IHEIGHT ) LOCAL $ARESULT = DLLCALL ("gdi32.dll" , "handle" , "CreateCompatibleBitmap" , "handle" , $HDC , "int" , $IWIDTH , "int" , $IHEIGHT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_CREATEDIB ($IWIDTH , $IHEIGHT , $IBITSPERPEL = 32 , $TCOLORTABLE = 0 , $ICOLORCOUNT = 0 ) LOCAL $ARGBQ [2 ] , $ICOLORS , $TAGRGBQ SWITCH $IBITSPERPEL CASE 1 $ICOLORS = 2 CASE 4 $ICOLORS = 16 CASE 8 $ICOLORS = 256 CASE ELSE $ICOLORS = 0 ENDSWITCH IF $ICOLORS THEN IF NOT ISDLLSTRUCT ($TCOLORTABLE ) THEN SWITCH $IBITSPERPEL CASE 1 $ARGBQ [0 ] = 0 $ARGBQ [1 ] = 16777215 $TCOLORTABLE = _WINAPI_CREATEDIBCOLORTABLE ($ARGBQ ) CASE ELSE ENDSWITCH ELSE IF $ICOLORS > $ICOLORCOUNT THEN $ICOLORS = $ICOLORCOUNT ENDIF IF (NOT $ICOLORS ) OR ((4 * $ICOLORS ) > DLLSTRUCTGETSIZE ($TCOLORTABLE ) ) THEN RETURN SETERROR (20 , 0 , 0 ) ENDIF ENDIF $TAGRGBQ = ";dword aRGBQuad[" & $ICOLORS & "]" ELSE $TAGRGBQ = "" ENDIF LOCAL $TBITMAPINFO = DLLSTRUCTCREATE ($TAGBITMAPINFOHEADER & $TAGRGBQ ) DLLSTRUCTSETDATA ($TBITMAPINFO , "biSize" , 40 ) DLLSTRUCTSETDATA ($TBITMAPINFO , "biWidth" , $IWIDTH ) DLLSTRUCTSETDATA ($TBITMAPINFO , "biHeight" , $IHEIGHT ) DLLSTRUCTSETDATA ($TBITMAPINFO , "biPlanes" , 1 ) DLLSTRUCTSETDATA ($TBITMAPINFO , "biBitCount" , $IBITSPERPEL ) DLLSTRUCTSETDATA ($TBITMAPINFO , "biCompression" , 0 ) DLLSTRUCTSETDATA ($TBITMAPINFO , "biSizeImage" , 0 ) DLLSTRUCTSETDATA ($TBITMAPINFO , "biXPelsPerMeter" , 0 ) DLLSTRUCTSETDATA ($TBITMAPINFO , "biYPelsPerMeter" , 0 ) DLLSTRUCTSETDATA ($TBITMAPINFO , "biClrUsed" , $ICOLORS ) DLLSTRUCTSETDATA ($TBITMAPINFO , "biClrImportant" , 0 ) IF $ICOLORS THEN IF ISDLLSTRUCT ($TCOLORTABLE ) THEN _WINAPI_MOVEMEMORY (DLLSTRUCTGETPTR ($TBITMAPINFO , "aRGBQuad" ) , $TCOLORTABLE , 4 * $ICOLORS ) ELSE _WINAPI_ZEROMEMORY (DLLSTRUCTGETPTR ($TBITMAPINFO , "aRGBQuad" ) , 4 * $ICOLORS ) ENDIF ENDIF LOCAL $HBITMAP = _WINAPI_CREATEDIBSECTION (0 , $TBITMAPINFO , 0 , $__G_VEXT ) IF NOT $HBITMAP THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $HBITMAP ENDFUNC FUNC _WINAPI_CREATEDIBSECTION ($HDC , $TBITMAPINFO , $IUSAGE , BYREF $PBITS , $HSECTION = 0 , $IOFFSET = 0 ) $PBITS = 0 LOCAL $ARET = DLLCALL ("gdi32.dll" , "handle" , "CreateDIBSection" , "handle" , $HDC , "struct*" , $TBITMAPINFO , "uint" , $IUSAGE , "ptr*" , 0 , "handle" , $HSECTION , "dword" , $IOFFSET ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) $PBITS = $ARET [4 ] RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_CREATEDIBCOLORTABLE (CONST BYREF $ACOLORTABLE , $ISTART = 0 , $IEND = + 4294967295 ) IF __CHECKERRORARRAYBOUNDS ($ACOLORTABLE , $ISTART , $IEND ) THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $TCOLORTABLE = DLLSTRUCTCREATE ("dword[" & ($IEND - $ISTART + 1 ) & "]" ) LOCAL $ICOUNT = 1 FOR $I = $ISTART TO $IEND DLLSTRUCTSETDATA ($TCOLORTABLE , 1 , _WINAPI_SWITCHCOLOR (__RGB ($ACOLORTABLE [$I ] ) ) , $ICOUNT ) $ICOUNT += 1 NEXT RETURN $TCOLORTABLE ENDFUNC FUNC _WINAPI_CREATEFONT ($IHEIGHT , $IWIDTH , $IESCAPE = 0 , $IORIENTN = 0 , $IWEIGHT = $__WINAPICONSTANT_FW_NORMAL , $BITALIC = FALSE , $BUNDERLINE = FALSE , $BSTRIKEOUT = FALSE , $ICHARSET = $__WINAPICONSTANT_DEFAULT_CHARSET , $IOUTPUTPREC = $__WINAPICONSTANT_OUT_DEFAULT_PRECIS , $ICLIPPREC = $__WINAPICONSTANT_CLIP_DEFAULT_PRECIS , $IQUALITY = $__WINAPICONSTANT_DEFAULT_QUALITY , $IPITCH = 0 , $SFACE = "Arial" ) LOCAL $ARESULT = DLLCALL ("gdi32.dll" , "handle" , "CreateFontW" , "int" , $IHEIGHT , "int" , $IWIDTH , "int" , $IESCAPE , "int" , $IORIENTN , "int" , $IWEIGHT , "dword" , $BITALIC , "dword" , $BUNDERLINE , "dword" , $BSTRIKEOUT , "dword" , $ICHARSET , "dword" , $IOUTPUTPREC , "dword" , $ICLIPPREC , "dword" , $IQUALITY , "dword" , $IPITCH , "wstr" , $SFACE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_CREATEFONTINDIRECT ($TLOGFONT ) LOCAL $ARESULT = DLLCALL ("gdi32.dll" , "handle" , "CreateFontIndirectW" , "struct*" , $TLOGFONT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_CREATERECTRGN ($ILEFTRECT , $ITOPRECT , $IRIGHTRECT , $IBOTTOMRECT ) LOCAL $ARESULT = DLLCALL ("gdi32.dll" , "handle" , "CreateRectRgn" , "int" , $ILEFTRECT , "int" , $ITOPRECT , "int" , $IRIGHTRECT , "int" , $IBOTTOMRECT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_CREATEROUNDRECTRGN ($ILEFTRECT , $ITOPRECT , $IRIGHTRECT , $IBOTTOMRECT , $IWIDTHELLIPSE , $IHEIGHTELLIPSE ) LOCAL $ARESULT = DLLCALL ("gdi32.dll" , "handle" , "CreateRoundRectRgn" , "int" , $ILEFTRECT , "int" , $ITOPRECT , "int" , $IRIGHTRECT , "int" , $IBOTTOMRECT , "int" , $IWIDTHELLIPSE , "int" , $IHEIGHTELLIPSE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_CREATESOLIDBRUSH ($ICOLOR ) LOCAL $ARESULT = DLLCALL ("gdi32.dll" , "handle" , "CreateSolidBrush" , "INT" , $ICOLOR ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETBITMAPDIMENSION ($HBITMAP ) LOCAL $TOBJ = DLLSTRUCTCREATE ($TAGBITMAP ) LOCAL $ARET = DLLCALL ("gdi32.dll" , "int" , "GetObject" , "handle" , $HBITMAP , "int" , DLLSTRUCTGETSIZE ($TOBJ ) , "struct*" , $TOBJ ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN _WINAPI_CREATESIZE (DLLSTRUCTGETDATA ($TOBJ , "bmWidth" ) , DLLSTRUCTGETDATA ($TOBJ , "bmHeight" ) ) ENDFUNC FUNC _WINAPI_GETSYSCOLORBRUSH ($IINDEX ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "handle" , "GetSysColorBrush" , "int" , $IINDEX ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETTEXTEXTENTPOINT32 ($HDC , $STEXT ) LOCAL $TSIZE = DLLSTRUCTCREATE ($TAGSIZE ) LOCAL $ISIZE = STRINGLEN ($STEXT ) LOCAL $ARET = DLLCALL ("gdi32.dll" , "bool" , "GetTextExtentPoint32W" , "handle" , $HDC , "wstr" , $STEXT , "int" , $ISIZE , "struct*" , $TSIZE ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN $TSIZE ENDFUNC FUNC _WINAPI_GETTEXTMETRICS ($HDC ) LOCAL $TTEXTMETRIC = DLLSTRUCTCREATE ($TAGTEXTMETRIC ) LOCAL $ARET = DLLCALL ("gdi32.dll" , "bool" , "GetTextMetricsW" , "handle" , $HDC , "struct*" , $TTEXTMETRIC ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN $TTEXTMETRIC ENDFUNC FUNC _WINAPI_GETWINDOWRGN ($HWND , $HRGN ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "int" , "GetWindowRgn" , "hwnd" , $HWND , "handle" , $HRGN ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_ISALPHABITMAP ($HBITMAP ) $HBITMAP = _WINAPI_COPYBITMAP ($HBITMAP ) IF NOT $HBITMAP THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , 0 ) LOCAL $ARET , $IERROR = 0 DO LOCAL $TDIB = DLLSTRUCTCREATE ($TAGDIBSECTION ) IF (NOT _WINAPI_GETOBJECT ($HBITMAP , DLLSTRUCTGETSIZE ($TDIB ) , $TDIB ) ) OR (DLLSTRUCTGETDATA ($TDIB , "bmBitsPixel" ) <> 32 ) OR (DLLSTRUCTGETDATA ($TDIB , "biCompression" ) ) THEN $IERROR = 1 EXITLOOP ENDIF $ARET = DLLCALL ("user32.dll" , "int" , "CallWindowProc" , "ptr" , __ALPHAPROC () , "ptr" , 0 , "uint" , 0 , "struct*" , $TDIB , "ptr" , 0 ) IF @ERROR OR ($ARET [0 ] = + 4294967295 ) THEN $IERROR = @ERROR + 10 EXITLOOP ENDIF UNTIL 1 _WINAPI_DELETEOBJECT ($HBITMAP ) IF $IERROR THEN RETURN SETERROR ($IERROR , 0 , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_PTINRECT (BYREF $TRECT , BYREF $TPOINT ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "PtInRect" , "struct*" , $TRECT , "struct" , $TPOINT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_REDRAWWINDOW ($HWND , $TRECT = 0 , $HREGION = 0 , $IFLAGS = 5 ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "RedrawWindow" , "hwnd" , $HWND , "struct*" , $TRECT , "handle" , $HREGION , "uint" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_SETWINDOWRGN ($HWND , $HRGN , $BREDRAW = TRUE ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "int" , "SetWindowRgn" , "hwnd" , $HWND , "handle" , $HRGN , "bool" , $BREDRAW ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC #EndRegion Public Functions #Region Embedded DLL Functions FUNC __ALPHAPROC () STATIC $PPROC = 0 IF NOT $PPROC THEN IF @AUTOITX64 THEN $PPROC = __INIT (BINARY ("0x48894C240848895424104C894424184C894C24205541574831C050504883EC28" & "48837C24600074054831C0EB0748C7C0010000004821C0751F488B6C24604883" & "7D180074054831C0EB0748C7C0010000004821C07502EB0948C7C001000000EB" & "034831C04821C0740C48C7C0FFFFFFFF4863C0EB6F48C744242800000000488B" & "6C24604C637D04488B6C2460486345084C0FAFF849C1E7024983C7FC4C3B7C24" & "287C36488B6C24604C8B7D184C037C24284983C7034C897C2430488B6C243080" & "7D0000740C48C7C0010000004863C0EB1348834424280471A54831C04863C0EB" & "034831C04883C438415F5DC3" ) ) ELSE $PPROC = __INIT (BINARY ("0x555331C05050837C241C00740431C0EB05B80100000021C075198B6C241C837D" & "1400740431C0EB05B80100000021C07502EB07B801000000EB0231C021C07407" & "B8FFFFFFFFEB4FC70424000000008B6C241C8B5D048B6C241C0FAF5D08C1E302" & "83C3FC3B1C247C288B6C241C8B5D14031C2483C303895C24048B6C2404807D00" & "007407B801000000EB0C8304240471BE31C0EB0231C083C4085B5DC21000" ) ) ENDIF ENDIF RETURN $PPROC ENDFUNC FUNC __ANDPROC () STATIC $PPROC = 0 IF NOT $PPROC THEN IF @AUTOITX64 THEN $PPROC = __INIT (BINARY ("0x48894C240848895424104C894424184C894C2420554157415648C7C009000000" & "4883EC0848C704240000000048FFC875EF4883EC284883BC24A0000000007405" & "4831C0EB0748C7C0010000004821C00F85840000004883BC24A8000000007405" & "4831C0EB0748C7C0010000004821C07555488BAC24A000000048837D18007405" & "4831C0EB0748C7C0010000004821C07522488BAC24A800000048837D18007405" & "4831C0EB0748C7C0010000004821C07502EB0948C7C001000000EB034831C048" & "21C07502EB0948C7C001000000EB034831C04821C07502EB0948C7C001000000" & "EB034831C04821C0740B4831C04863C0E9D701000048C74424280000000048C7" & "44243000000000488BAC24A00000004C637D0849FFCF4C3B7C24300F8C9C0100" & "0048C74424380000000048C74424400000000048C744244800000000488BAC24" & "A00000004C637D0449FFCF4C3B7C24480F8CDB000000488BAC24A00000004C8B" & "7D184C037C24284983C7034C897C2450488B6C2450807D000074264C8B7C2440" & "4C8B74243849F7DE4983C61F4C89F148C7C00100000048D3E04909C74C897C24" & "4048FF4424384C8B7C24384983FF1F7E6F4C8B7C244049F7D74C897C244048C7" & "442458180000004831C0483B4424587F3D488BAC24A80000004C8B7D184C037C" & "24604C897C24504C8B7C2440488B4C245849D3FF4C89F850488B6C2458588845" & "0048FF4424604883442458F871B948C74424380000000048C744244000000000" & "48834424280448FF4424480F810BFFFFFF48837C24380074794C8B7C244049F7" & "D74C8B74243849F7DE4983C6204C89F148C7C0FFFFFFFF48D3E04921C74C897C" & "244048C7442458180000004831C0483B4424587F3D488BAC24A80000004C8B7D" & "184C037C24604C897C24504C8B7C2440488B4C245849D3FF4C89F850488B6C24" & "585888450048FF4424604883442458F871B948FF4424300F814AFEFFFF48C7C0" & "010000004863C0EB034831C04883C470415E415F5DC3" ) ) ELSE $PPROC = __INIT (BINARY ("0x555357BA0800000083EC04C70424000000004A75F3837C243800740431C0EB05" & "B80100000021C07562837C243C00740431C0EB05B80100000021C0753F8B6C24" & "38837D1400740431C0EB05B80100000021C075198B6C243C837D1400740431C0" & "EB05B80100000021C07502EB07B801000000EB0231C021C07502EB07B8010000" & "00EB0231C021C07502EB07B801000000EB0231C021C0740731C0E969010000C7" & "042400000000C7442404000000008B6C24388B5D084B3B5C24040F8C3F010000" & "C744240800000000C744240C00000000C7442410000000008B6C24388B5D044B" & "3B5C24100F8CA90000008B6C24388B5D14031C2483C303895C24148B6C241480" & "7D0000741C8B5C240C8B7C2408F7DF83C71F89F9B801000000D3E009C3895C24" & "0CFF4424088B5C240883FB1F7E578B5C240CF7D3895C240CC744241818000000" & "31C03B4424187F2D8B6C243C8B5D14035C241C895C24148B5C240C8B4C2418D3" & "FB538B6C241858884500FF44241C83442418F871CBC744240800000000C74424" & "0C0000000083042404FF4424100F8145FFFFFF837C240800745B8B5C240CF7D3" & "8B7C2408F7DF83C72089F9B8FFFFFFFFD3E021C3895C240CC744241818000000" & "31C03B4424187F2D8B6C243C8B5D14035C241C895C24148B5C240C8B4C2418D3" & "FB538B6C241858884500FF44241C83442418F871CBFF4424040F81AFFEFFFFB8" & "01000000EB0231C083C4205F5B5DC21000" ) ) ENDIF ENDIF RETURN $PPROC ENDFUNC FUNC __XORPROC () STATIC $PPROC = 0 IF NOT $PPROC THEN IF @AUTOITX64 THEN $PPROC = __INIT (BINARY ("0x48894C240848895424104C894424184C894C24205541574831C050504883EC28" & "48837C24600074054831C0EB0748C7C0010000004821C0751B48837C24680074" & "054831C0EB0748C7C0010000004821C07502EB0948C7C001000000EB034831C0" & "4821C074084831C04863C0EB7748C7442428000000004C637C24584983C7FC4C" & "3B7C24287C4F4C8B7C24604C037C24284C897C2430488B6C2430807D00007405" & "4831C0EB0748C7C0010000004821C0741C4C8B7C24684C037C24284983C7034C" & "897C2430488B6C2430C64500FF48834424280471A148C7C0010000004863C0EB" & "034831C04883C438415F5DC3" ) ) ELSE $PPROC = __INIT (BINARY ("0x555331C05050837C241C00740431C0EB05B80100000021C07516837C24200074" & "0431C0EB05B80100000021C07502EB07B801000000EB0231C021C0740431C0EB" & "5AC70424000000008B5C241883C3FC3B1C247C3E8B5C241C031C24895C24048B" & "6C2404807D0000740431C0EB05B80100000021C074168B5C2420031C2483C303" & "895C24048B6C2404C64500FF8304240471B6B801000000EB0231C083C4085B5D" & "C21000" ) ) ENDIF ENDIF RETURN $PPROC ENDFUNC #EndRegion Embedded DLL Functions #Region Internal Functions FUNC __INIT ($DDATA ) LOCAL $ILENGTH = BINARYLEN ($DDATA ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "ptr" , "VirtualAlloc" , "ptr" , 0 , "ulong_ptr" , $ILENGTH , "dword" , 4096 , "dword" , 64 ) IF @ERROR OR NOT $ARET [0 ] THEN __FATALEXIT (1 , "Error allocating memory." ) LOCAL $TDATA = DLLSTRUCTCREATE ("byte[" & $ILENGTH & "]" , $ARET [0 ] ) DLLSTRUCTSETDATA ($TDATA , 1 , $DDATA ) RETURN $ARET [0 ] ENDFUNC #EndRegion Internal Functions #Region Global Variables and Constants GLOBAL CONST $DI_MASK = 1 GLOBAL CONST $DI_IMAGE = 2 GLOBAL CONST $DI_NORMAL = 3 GLOBAL CONST $DI_COMPAT = 4 GLOBAL CONST $DI_DEFAULTSIZE = 8 GLOBAL CONST $DI_NOMIRROR = 16 GLOBAL CONST $DISPLAY_DEVICE_ATTACHED_TO_DESKTOP = 1 GLOBAL CONST $DISPLAY_DEVICE_MULTI_DRIVER = 2 GLOBAL CONST $DISPLAY_DEVICE_PRIMARY_DEVICE = 4 GLOBAL CONST $DISPLAY_DEVICE_MIRRORING_DRIVER = 8 GLOBAL CONST $DISPLAY_DEVICE_VGA_COMPATIBLE = 16 GLOBAL CONST $DISPLAY_DEVICE_REMOVABLE = 32 GLOBAL CONST $DISPLAY_DEVICE_DISCONNECT = 33554432 GLOBAL CONST $DISPLAY_DEVICE_REMOTE = 67108864 GLOBAL CONST $DISPLAY_DEVICE_MODESPRUNED = 134217728 #EndRegion Global Variables and Constants #Region Functions list #EndRegion Functions list #Region Public Functions FUNC _WINAPI_CREATECOMPATIBLEDC ($HDC ) LOCAL $ARESULT = DLLCALL ("gdi32.dll" , "handle" , "CreateCompatibleDC" , "handle" , $HDC ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_DELETEDC ($HDC ) LOCAL $ARESULT = DLLCALL ("gdi32.dll" , "bool" , "DeleteDC" , "handle" , $HDC ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_DRAWEDGE ($HDC , $TRECT , $IEDGETYPE , $IFLAGS ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "DrawEdge" , "handle" , $HDC , "struct*" , $TRECT , "uint" , $IEDGETYPE , "uint" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_DRAWFRAMECONTROL ($HDC , $TRECT , $ITYPE , $ISTATE ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "DrawFrameControl" , "handle" , $HDC , "struct*" , $TRECT , "uint" , $ITYPE , "uint" , $ISTATE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_DRAWICON ($HDC , $IX , $IY , $HICON ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "DrawIcon" , "handle" , $HDC , "int" , $IX , "int" , $IY , "handle" , $HICON ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_DRAWICONEX ($HDC , $IX , $IY , $HICON , $IWIDTH = 0 , $IHEIGHT = 0 , $ISTEP = 0 , $HBRUSH = 0 , $IFLAGS = 3 ) LOCAL $IOPTIONS SWITCH $IFLAGS CASE 1 $IOPTIONS = $DI_MASK CASE 2 $IOPTIONS = $DI_IMAGE CASE 3 $IOPTIONS = $DI_NORMAL CASE 4 $IOPTIONS = $DI_COMPAT CASE 5 $IOPTIONS = $DI_DEFAULTSIZE CASE ELSE $IOPTIONS = $DI_NOMIRROR ENDSWITCH LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "DrawIconEx" , "handle" , $HDC , "int" , $IX , "int" , $IY , "handle" , $HICON , "int" , $IWIDTH , "int" , $IHEIGHT , "uint" , $ISTEP , "handle" , $HBRUSH , "uint" , $IOPTIONS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_DRAWTEXT ($HDC , $STEXT , BYREF $TRECT , $IFLAGS ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "int" , "DrawTextW" , "handle" , $HDC , "wstr" , $STEXT , "int" , + 4294967295 , "struct*" , $TRECT , "uint" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_ENUMDISPLAYDEVICES ($SDEVICE , $IDEVNUM ) LOCAL $TNAME = 0 , $IFLAGS = 0 , $ADEVICE [5 ] IF $SDEVICE <> "" THEN $TNAME = DLLSTRUCTCREATE ("wchar Text[" & STRINGLEN ($SDEVICE ) + 1 & "]" ) DLLSTRUCTSETDATA ($TNAME , "Text" , $SDEVICE ) ENDIF LOCAL CONST $TAGDISPLAY_DEVICE = "dword Size;wchar Name[32];wchar String[128];dword Flags;wchar ID[128];wchar Key[128]" LOCAL $TDEVICE = DLLSTRUCTCREATE ($TAGDISPLAY_DEVICE ) LOCAL $IDEVICE = DLLSTRUCTGETSIZE ($TDEVICE ) DLLSTRUCTSETDATA ($TDEVICE , "Size" , $IDEVICE ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "EnumDisplayDevicesW" , "struct*" , $TNAME , "dword" , $IDEVNUM , "struct*" , $TDEVICE , "dword" , 1 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $IN = DLLSTRUCTGETDATA ($TDEVICE , "Flags" ) IF BITAND ($IN , $DISPLAY_DEVICE_ATTACHED_TO_DESKTOP ) <> 0 THEN $IFLAGS = BITOR ($IFLAGS , 1 ) IF BITAND ($IN , $DISPLAY_DEVICE_PRIMARY_DEVICE ) <> 0 THEN $IFLAGS = BITOR ($IFLAGS , 2 ) IF BITAND ($IN , $DISPLAY_DEVICE_MIRRORING_DRIVER ) <> 0 THEN $IFLAGS = BITOR ($IFLAGS , 4 ) IF BITAND ($IN , $DISPLAY_DEVICE_VGA_COMPATIBLE ) <> 0 THEN $IFLAGS = BITOR ($IFLAGS , 8 ) IF BITAND ($IN , $DISPLAY_DEVICE_REMOVABLE ) <> 0 THEN $IFLAGS = BITOR ($IFLAGS , 16 ) IF BITAND ($IN , $DISPLAY_DEVICE_MODESPRUNED ) <> 0 THEN $IFLAGS = BITOR ($IFLAGS , 32 ) $ADEVICE [0 ] = TRUE $ADEVICE [1 ] = DLLSTRUCTGETDATA ($TDEVICE , "Name" ) $ADEVICE [2 ] = DLLSTRUCTGETDATA ($TDEVICE , "String" ) $ADEVICE [3 ] = $IFLAGS $ADEVICE [4 ] = DLLSTRUCTGETDATA ($TDEVICE , "ID" ) RETURN $ADEVICE ENDFUNC FUNC _WINAPI_FILLRECT ($HDC , $TRECT , $HBRUSH ) LOCAL $ARESULT IF ISPTR ($HBRUSH ) THEN $ARESULT = DLLCALL ("user32.dll" , "int" , "FillRect" , "handle" , $HDC , "struct*" , $TRECT , "handle" , $HBRUSH ) ELSE $ARESULT = DLLCALL ("user32.dll" , "int" , "FillRect" , "handle" , $HDC , "struct*" , $TRECT , "dword_ptr" , $HBRUSH ) ENDIF IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_FRAMERECT ($HDC , $TRECT , $HBRUSH ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "int" , "FrameRect" , "handle" , $HDC , "struct*" , $TRECT , "handle" , $HBRUSH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETBKMODE ($HDC ) LOCAL $ARESULT = DLLCALL ("gdi32.dll" , "int" , "GetBkMode" , "handle" , $HDC ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETDC ($HWND ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "handle" , "GetDC" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETDCEX ($HWND , $HRGN , $IFLAGS ) LOCAL $ARET = DLLCALL ("user32.dll" , "handle" , "GetDCEx" , "hwnd" , $HWND , "handle" , $HRGN , "dword" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETDEVICECAPS ($HDC , $IINDEX ) LOCAL $ARESULT = DLLCALL ("gdi32.dll" , "int" , "GetDeviceCaps" , "handle" , $HDC , "int" , $IINDEX ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETTEXTCOLOR ($HDC ) LOCAL $ARET = DLLCALL ("gdi32.dll" , "dword" , "GetTextColor" , "handle" , $HDC ) IF @ERROR OR ($ARET [0 ] = 0xFFFFFFFF ) THEN RETURN SETERROR (@ERROR , @EXTENDED , + 4294967295 ) RETURN __RGB ($ARET [0 ] ) ENDFUNC FUNC _WINAPI_GETWINDOWDC ($HWND ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "handle" , "GetWindowDC" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_PRINTWINDOW ($HWND , $HDC , $BCLIENT = FALSE ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "PrintWindow" , "hwnd" , $HWND , "handle" , $HDC , "uint" , $BCLIENT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_RELEASEDC ($HWND , $HDC ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "int" , "ReleaseDC" , "hwnd" , $HWND , "handle" , $HDC ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_RESTOREDC ($HDC , $IID ) LOCAL $ARET = DLLCALL ("gdi32.dll" , "bool" , "RestoreDC" , "handle" , $HDC , "int" , $IID ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SAVEDC ($HDC ) LOCAL $ARET = DLLCALL ("gdi32.dll" , "int" , "SaveDC" , "handle" , $HDC ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SETBKCOLOR ($HDC , $ICOLOR ) LOCAL $ARESULT = DLLCALL ("gdi32.dll" , "INT" , "SetBkColor" , "handle" , $HDC , "INT" , $ICOLOR ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , + 4294967295 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_SETBKMODE ($HDC , $IBKMODE ) LOCAL $ARESULT = DLLCALL ("gdi32.dll" , "int" , "SetBkMode" , "handle" , $HDC , "int" , $IBKMODE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_SETTEXTCOLOR ($HDC , $ICOLOR ) LOCAL $ARESULT = DLLCALL ("gdi32.dll" , "INT" , "SetTextColor" , "handle" , $HDC , "INT" , $ICOLOR ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , + 4294967295 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_TWIPSPERPIXELX () LOCAL $HDC , $ITWIPSPERPIXELX $HDC = _WINAPI_GETDC (0 ) LOCAL CONST $__WINAPICONSTANT_LOGPIXELSX = 88 $ITWIPSPERPIXELX = 1440 / _WINAPI_GETDEVICECAPS ($HDC , $__WINAPICONSTANT_LOGPIXELSX ) _WINAPI_RELEASEDC (0 , $HDC ) RETURN $ITWIPSPERPIXELX ENDFUNC FUNC _WINAPI_TWIPSPERPIXELY () LOCAL $HDC , $ITWIPSPERPIXELY $HDC = _WINAPI_GETDC (0 ) LOCAL CONST $__WINAPICONSTANT_LOGPIXELSY = 90 $ITWIPSPERPIXELY = 1440 / _WINAPI_GETDEVICECAPS ($HDC , $__WINAPICONSTANT_LOGPIXELSY ) _WINAPI_RELEASEDC (0 , $HDC ) RETURN $ITWIPSPERPIXELY ENDFUNC #EndRegion Public Functions #Region Internal Functions #EndRegion Internal Functions #Region Global Variables and Constants #EndRegion Global Variables and Constants #Region Functions list #EndRegion Functions list #Region Public Functions GLOBAL CONST $TAGICONINFO = "bool Icon;dword XHotSpot;dword YHotSpot;handle hMask;handle hColor" FUNC _WINAPI_ADDICONTRANSPARENCY ($HICON , $IPERCENT = 50 , $BDELETE = FALSE ) LOCAL $TBITMAP , $HDIB = 0 , $HRESULT = 0 LOCAL $AHBITMAP [2 ] LOCAL $TICONINFO = DLLSTRUCTCREATE ($TAGICONINFO ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "GetIconInfo" , "handle" , $HICON , "struct*" , $TICONINFO ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) FOR $I = 0 TO 1 $AHBITMAP [$I ] = DLLSTRUCTGETDATA ($TICONINFO , $I + 4 ) NEXT LOCAL $IERROR = 0 DO $HDIB = _WINAPI_COPYBITMAP ($AHBITMAP [1 ] ) IF NOT $HDIB THEN $IERROR = 20 EXITLOOP ENDIF $TBITMAP = DLLSTRUCTCREATE ($TAGBITMAP ) IF (NOT _WINAPI_GETOBJECT ($HDIB , DLLSTRUCTGETSIZE ($TBITMAP ) , $TBITMAP ) ) OR (DLLSTRUCTGETDATA ($TBITMAP , "bmBitsPixel" ) <> 32 ) THEN $IERROR = 21 EXITLOOP ENDIF $ARET = DLLCALL ("user32.dll" , "lresult" , "CallWindowProc" , "PTR" , __TRANSPARENCYPROC () , "hwnd" , 0 , "uint" , $IPERCENT , "wparam" , DLLSTRUCTGETPTR ($TBITMAP ) , "lparam" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN $IERROR = @ERROR + 30 EXITLOOP ENDIF IF $ARET [0 ] = + 4294967295 THEN $HRESULT = _WINAPI_CREATEEMPTYICON (DLLSTRUCTGETDATA ($TBITMAP , "bmWidth" ) , DLLSTRUCTGETDATA ($TBITMAP , "bmHeight" ) ) ELSE $HRESULT = _WINAPI_CREATEICONINDIRECT ($HDIB , $AHBITMAP [0 ] ) ENDIF IF NOT $HRESULT THEN $IERROR = 22 UNTIL 1 IF $HDIB THEN _WINAPI_DELETEOBJECT ($HDIB ) ENDIF FOR $I = 0 TO 1 IF $AHBITMAP [$I ] THEN _WINAPI_DELETEOBJECT ($AHBITMAP [$I ] ) ENDIF NEXT IF $IERROR THEN RETURN SETERROR ($IERROR , 0 , 0 ) IF $BDELETE THEN _WINAPI_DESTROYICON ($HICON ) ENDIF RETURN $HRESULT ENDFUNC FUNC _WINAPI_COPYICON ($HICON ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "handle" , "CopyIcon" , "handle" , $HICON ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_CREATE32BITHICON ($HICON , $BDELETE = FALSE ) LOCAL $AHBITMAP [2 ] , $HRESULT = 0 LOCAL $ADIB [2 ] [2 ] = [[0 , 0 ] , [0 , 0 ] ] LOCAL $TICONINFO = DLLSTRUCTCREATE ($TAGICONINFO ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "GetIconInfo" , "handle" , $HICON , "struct*" , $TICONINFO ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF NOT $ARET [0 ] THEN RETURN SETERROR (10 , 0 , 0 ) FOR $I = 0 TO 1 $AHBITMAP [$I ] = DLLSTRUCTGETDATA ($TICONINFO , $I + 4 ) NEXT IF _WINAPI_ISALPHABITMAP ($AHBITMAP [1 ] ) THEN $ADIB [0 ] [0 ] = _WINAPI_CREATEANDBITMAP ($AHBITMAP [1 ] ) IF NOT @ERROR THEN $HRESULT = _WINAPI_CREATEICONINDIRECT ($AHBITMAP [1 ] , $ADIB [0 ] [0 ] ) ENDIF ELSE LOCAL $TSIZE = _WINAPI_GETBITMAPDIMENSION ($AHBITMAP [1 ] ) LOCAL $ASIZE [2 ] FOR $I = 0 TO 1 $ASIZE [$I ] = DLLSTRUCTGETDATA ($TSIZE , $I + 1 ) NEXT LOCAL $HSRCDC = _WINAPI_CREATECOMPATIBLEDC (0 ) LOCAL $HDSTDC = _WINAPI_CREATECOMPATIBLEDC (0 ) LOCAL $HSRCSV , $HDSTSV FOR $I = 0 TO 1 $ADIB [$I ] [0 ] = _WINAPI_CREATEDIB ($ASIZE [0 ] , $ASIZE [1 ] ) $ADIB [$I ] [1 ] = $__G_VEXT $HSRCSV = _WINAPI_SELECTOBJECT ($HSRCDC , $AHBITMAP [$I ] ) $HDSTSV = _WINAPI_SELECTOBJECT ($HDSTDC , $ADIB [$I ] [0 ] ) _WINAPI_BITBLT ($HDSTDC , 0 , 0 , $ASIZE [0 ] , $ASIZE [1 ] , $HSRCDC , 0 , 0 , 12583114 ) _WINAPI_SELECTOBJECT ($HSRCDC , $HSRCSV ) _WINAPI_SELECTOBJECT ($HDSTDC , $HDSTSV ) NEXT _WINAPI_DELETEDC ($HSRCDC ) _WINAPI_DELETEDC ($HDSTDC ) $ARET = DLLCALL ("user32.dll" , "lresult" , "CallWindowProc" , "ptr" , __XORPROC () , "ptr" , 0 , "uint" , $ASIZE [0 ] * $ASIZE [1 ] * 4 , "wparam" , $ADIB [0 ] [1 ] , "lparam" , $ADIB [1 ] [1 ] ) IF NOT @ERROR AND $ARET [0 ] THEN $HRESULT = _WINAPI_CREATEICONINDIRECT ($ADIB [1 ] [0 ] , $AHBITMAP [0 ] ) ENDIF ENDIF FOR $I = 0 TO 1 _WINAPI_DELETEOBJECT ($AHBITMAP [$I ] ) IF $ADIB [$I ] [0 ] THEN _WINAPI_DELETEOBJECT ($ADIB [$I ] [0 ] ) ENDIF NEXT IF NOT $HRESULT THEN RETURN SETERROR (11 , 0 , 0 ) IF $BDELETE THEN _WINAPI_DESTROYICON ($HICON ) ENDIF RETURN $HRESULT ENDFUNC FUNC _WINAPI_CREATEEMPTYICON ($IWIDTH , $IHEIGHT , $IBITSPERPEL = 32 ) LOCAL $HXOR = _WINAPI_CREATEDIB ($IWIDTH , $IHEIGHT , $IBITSPERPEL ) LOCAL $HAND = _WINAPI_CREATEDIB ($IWIDTH , $IHEIGHT , 1 ) LOCAL $HDC = _WINAPI_CREATECOMPATIBLEDC (0 ) LOCAL $HSV = _WINAPI_SELECTOBJECT ($HDC , $HAND ) LOCAL $HBRUSH = _WINAPI_CREATESOLIDBRUSH (16777215 ) LOCAL $TRECT = _WINAPI_CREATERECT (0 , 0 , $IWIDTH , $IHEIGHT ) _WINAPI_FILLRECT ($HDC , $TRECT , $HBRUSH ) _WINAPI_DELETEOBJECT ($HBRUSH ) _WINAPI_SELECTOBJECT ($HDC , $HSV ) _WINAPI_DELETEDC ($HDC ) LOCAL $HICON = _WINAPI_CREATEICONINDIRECT ($HXOR , $HAND ) LOCAL $IERROR = @ERROR IF $HXOR THEN _WINAPI_DELETEOBJECT ($HXOR ) ENDIF IF $HAND THEN _WINAPI_DELETEOBJECT ($HAND ) ENDIF IF NOT $HICON THEN RETURN SETERROR ($IERROR + 10 , 0 , 0 ) RETURN $HICON ENDFUNC FUNC _WINAPI_CREATEICON ($HINSTANCE , $IWIDTH , $IHEIGHT , $IPLANES , $IBITSPIXEL , $PANDBITS , $PXORBITS ) LOCAL $ARET = DLLCALL ("user32.dll" , "handle" , "CreateIcon" , "handle" , $HINSTANCE , "int" , $IWIDTH , "int" , $IHEIGHT , "byte" , $IPLANES , "byte" , $IBITSPIXEL , "struct*" , $PANDBITS , "struct*" , $PXORBITS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_CREATEICONFROMRESOURCEEX ($PDATA , $ISIZE , $BICON = TRUE , $IXDESIREDPIXELS = 0 , $IYDESIREDPIXELS = 0 , $IFLAGS = 0 ) LOCAL $ARET = DLLCALL ("user32.dll" , "handle" , "CreateIconFromResourceEx" , "ptr" , $PDATA , "dword" , $ISIZE , "bool" , $BICON , "dword" , 196608 , "int" , $IXDESIREDPIXELS , "int" , $IYDESIREDPIXELS , "uint" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_CREATEICONINDIRECT ($HBITMAP , $HMASK , $IXHOTSPOT = 0 , $IYHOTSPOT = 0 , $BICON = TRUE ) LOCAL $TICONINFO = DLLSTRUCTCREATE ($TAGICONINFO ) DLLSTRUCTSETDATA ($TICONINFO , 1 , $BICON ) DLLSTRUCTSETDATA ($TICONINFO , 2 , $IXHOTSPOT ) DLLSTRUCTSETDATA ($TICONINFO , 3 , $IYHOTSPOT ) DLLSTRUCTSETDATA ($TICONINFO , 4 , $HMASK ) DLLSTRUCTSETDATA ($TICONINFO , 5 , $HBITMAP ) LOCAL $ARET = DLLCALL ("user32.dll" , "handle" , "CreateIconIndirect" , "struct*" , $TICONINFO ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_DESTROYICON ($HICON ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "DestroyIcon" , "handle" , $HICON ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_EXTRACTICON ($SICON , $IINDEX , $BSMALL = FALSE ) LOCAL $PLARGE , $PSMALL , $TPTR = DLLSTRUCTCREATE ("ptr" ) IF $BSMALL THEN $PLARGE = 0 $PSMALL = DLLSTRUCTGETPTR ($TPTR ) ELSE $PLARGE = DLLSTRUCTGETPTR ($TPTR ) $PSMALL = 0 ENDIF DLLCALL ("shell32.dll" , "uint" , "ExtractIconExW" , "wstr" , $SICON , "int" , $IINDEX , "ptr" , $PLARGE , "ptr" , $PSMALL , "uint" , 1 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN DLLSTRUCTGETDATA ($TPTR , 1 ) ENDFUNC FUNC _WINAPI_EXTRACTICONEX ($SFILEPATH , $IINDEX , $PALARGE , $PASMALL , $IICONS ) LOCAL $ARESULT = DLLCALL ("shell32.dll" , "uint" , "ExtractIconExW" , "wstr" , $SFILEPATH , "int" , $IINDEX , "struct*" , $PALARGE , "struct*" , $PASMALL , "uint" , $IICONS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_FILEICONINIT ($BRESTORE = TRUE ) LOCAL $ARET = DLLCALL ("shell32.dll" , "int" , 660 , "int" , $BRESTORE ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN 1 ENDFUNC FUNC _WINAPI_GETICONDIMENSION ($HICON ) LOCAL $TICONINFO = DLLSTRUCTCREATE ($TAGICONINFO ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "GetIconInfo" , "handle" , $HICON , "struct*" , $TICONINFO ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $TSIZE = _WINAPI_GETBITMAPDIMENSION (DLLSTRUCTGETDATA ($TICONINFO , 5 ) ) FOR $I = 4 TO 5 _WINAPI_DELETEOBJECT (DLLSTRUCTGETDATA ($TICONINFO , $I ) ) NEXT IF NOT ISDLLSTRUCT ($TSIZE ) THEN RETURN SETERROR (20 , 0 , 0 ) RETURN $TSIZE ENDFUNC FUNC _WINAPI_GETICONINFO ($HICON ) LOCAL $TINFO = DLLSTRUCTCREATE ($TAGICONINFO ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "GetIconInfo" , "handle" , $HICON , "struct*" , $TINFO ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $AICON [6 ] $AICON [0 ] = TRUE $AICON [1 ] = DLLSTRUCTGETDATA ($TINFO , "Icon" ) <> 0 $AICON [2 ] = DLLSTRUCTGETDATA ($TINFO , "XHotSpot" ) $AICON [3 ] = DLLSTRUCTGETDATA ($TINFO , "YHotSpot" ) $AICON [4 ] = DLLSTRUCTGETDATA ($TINFO , "hMask" ) $AICON [5 ] = DLLSTRUCTGETDATA ($TINFO , "hColor" ) RETURN $AICON ENDFUNC FUNC _WINAPI_GETICONINFOEX ($HICON ) LOCAL $TIIEX = DLLSTRUCTCREATE ("dword;int;dword;dword;ptr;ptr;ushort;wchar[260];wchar[260]" ) DLLSTRUCTSETDATA ($TIIEX , 1 , DLLSTRUCTGETSIZE ($TIIEX ) ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "GetIconInfoExW" , "handle" , $HICON , "struct*" , $TIIEX ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $ARESULT [8 ] FOR $I = 0 TO 7 $ARESULT [$I ] = DLLSTRUCTGETDATA ($TIIEX , $I + 2 ) NEXT RETURN $ARESULT ENDFUNC FUNC _WINAPI_LOADICON ($HINSTANCE , $SNAME ) LOCAL $STYPEOFNAME = "int" IF ISSTRING ($SNAME ) THEN $STYPEOFNAME = "wstr" ENDIF LOCAL $ARET = DLLCALL ("user32.dll" , "handle" , "LoadIconW" , "handle" , $HINSTANCE , $STYPEOFNAME , $SNAME ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_LOADICONMETRIC ($HINSTANCE , $SNAME , $IMETRIC ) LOCAL $STYPEOFNAME = "int" IF ISSTRING ($SNAME ) THEN $STYPEOFNAME = "wstr" ENDIF LOCAL $ARET = DLLCALL ("comctl32.dll" , "long" , "LoadIconMetric" , "handle" , $HINSTANCE , $STYPEOFNAME , $SNAME , "int" , $IMETRIC , "handle*" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF $ARET [0 ] THEN RETURN SETERROR (10 , $ARET [0 ] , 0 ) RETURN $ARET [4 ] ENDFUNC FUNC _WINAPI_LOADICONWITHSCALEDOWN ($HINSTANCE , $SNAME , $IWIDTH , $IHEIGHT ) LOCAL $STYPEOFNAME = "int" IF ISSTRING ($SNAME ) THEN $STYPEOFNAME = "wstr" ENDIF LOCAL $ARET = DLLCALL ("comctl32.dll" , "long" , "LoadIconWithScaleDown" , "handle" , $HINSTANCE , $STYPEOFNAME , $SNAME , "int" , $IWIDTH , "int" , $IHEIGHT , "handle*" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF $ARET [0 ] THEN RETURN SETERROR (10 , $ARET [0 ] , 0 ) RETURN $ARET [5 ] ENDFUNC FUNC _WINAPI_LOADSHELL32ICON ($IICONID ) LOCAL $TICONS = DLLSTRUCTCREATE ("ptr Data" ) LOCAL $IICONS = _WINAPI_EXTRACTICONEX ("shell32.dll" , $IICONID , 0 , $TICONS , 1 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF $IICONS <= 0 THEN RETURN SETERROR (10 , 0 , 0 ) RETURN DLLSTRUCTGETDATA ($TICONS , "Data" ) ENDFUNC FUNC _WINAPI_LOOKUPICONIDFROMDIRECTORYEX ($PDATA , $BICON = TRUE , $IXDESIREDPIXELS = 0 , $IYDESIREDPIXELS = 0 , $IFLAGS = 0 ) LOCAL $ARET = DLLCALL ("user32.dll" , "int" , "LookupIconIdFromDirectoryEx" , "ptr" , $PDATA , "bool" , $BICON , "int" , $IXDESIREDPIXELS , "int" , $IYDESIREDPIXELS , "uint" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_MIRRORICON ($HICON , $BDELETE = FALSE ) IF NOT $BDELETE THEN $HICON = _WINAPI_COPYICON ($HICON ) ENDIF LOCAL $ARET = DLLCALL ("comctl32.dll" , "int" , 414 , "ptr" , 0 , "ptr*" , $HICON ) IF @ERROR OR NOT $ARET [0 ] THEN LOCAL $IERROR = @ERROR + 10 IF $HICON AND NOT $BDELETE THEN _WINAPI_DESTROYICON ($HICON ) ENDIF RETURN SETERROR ($IERROR , 0 , 0 ) ENDIF RETURN $ARET [2 ] ENDFUNC #EndRegion Public Functions #Region Embedded DLL Functions FUNC __TRANSPARENCYPROC () STATIC $PPROC = 0 IF NOT $PPROC THEN IF @AUTOITX64 THEN $PPROC = __INIT (BINARY ("0x48894C240848895424104C894424184C894C24205541574831C0505050505050" & "4883EC284883BC24800000000074054831C0EB0748C7C0010000004821C07522" & "488BAC248000000048837D180074054831C0EB0748C7C0010000004821C07502" & "EB0948C7C001000000EB034831C04821C0740B4831C04863C0E93C0100004C63" & "7C24784983FF647E0F48C7C0010000004863C0E9220100004C637C24784D21FF" & "7D08C74424780000000048C74424280100000048C74424300000000048C74424" & "3800000000488BAC24800000004C637D04488BAC2480000000486345084C0FAF" & "F849C1E7024983C7FC4C3B7C24380F8C88000000488BAC24800000004C8B7D18" & "4C037C24384983C7034C897C2440488B6C2440480FB64500505888442448807C" & "244800744B4C0FB67C244848634424784C0FAFF84C89F848C7C1640000004899" & "48F7F94989C74C89F850488B6C244858884500488B6C2440807D0000740948C7" & "4424280000000048C7442430010000004883442438040F8149FFFFFF48837C24" & "3000741148837C242800740948C7C001000000EB034831C04821C0740E48C7C0" & "FFFFFFFF4863C0EB11EB0C48C7C0010000004863C0EB034831C04883C458415F" & "5DC3" ) ) ELSE $PPROC = __INIT (BINARY ("0x555331C05050505050837C242800740431C0EB05B80100000021C075198B6C24" & "28837D1400740431C0EB05B80100000021C07502EB07B801000000EB0231C021" & "C0740731C0E9E50000008B5C242483FB647E0AB801000000E9D20000008B5C24" & "2421DB7D08C744242400000000C7042401000000C744240400000000C7442408" & "000000008B6C24288B5D048B6C24280FAF5D08C1E30283C3FC3B5C24087C648B" & "6C24288B5D14035C240883C303895C240C8B6C240C0FB6450088442410807C24" & "100074380FB65C24100FAF5C242489D8B96400000099F7F989C3538B6C241058" & "8845008B6C240C807D00007407C7042400000000C74424040100000083442408" & "047181837C240400740D833C24007407B801000000EB0231C021C07409B8FFFF" & "FFFFEB0BEB07B801000000EB0231C083C4145B5DC21000" ) ) ENDIF ENDIF RETURN $PPROC ENDFUNC #EndRegion Embedded DLL Functions GLOBAL $__G_HBUTTONLASTWND GLOBAL CONST $TAGBUTTON_IMAGELIST = "ptr ImageList;" & $TAGRECT & ";uint Align" GLOBAL CONST $TAGBUTTON_SPLITINFO = "uint mask;handle himlGlyph;uint uSplitStyle;" & $TAGSIZE GLOBAL CONST $__BUTTONCONSTANT_CLASSNAME = "Button" GLOBAL CONST $__BUTTONCONSTANT_GWL_STYLE = 4294967280 GLOBAL CONST $__BUTTONCONSTANT_WM_SETFONT = 48 GLOBAL CONST $__BUTTONCONSTANT_DEFAULT_GUI_FONT = 17 FUNC _GUICTRLBUTTON_CLICK ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) _SENDMESSAGE ($HWND , $BM_CLICK ) ENDFUNC FUNC _GUICTRLBUTTON_CREATE ($HWND , $STEXT , $IX , $IY , $IWIDTH , $IHEIGHT , $ISTYLE = + 4294967295 , $IEXSTYLE = + 4294967295 ) IF NOT ISHWND ($HWND ) THEN RETURN SETERROR (1 , 0 , 0 ) ENDIF IF NOT ISSTRING ($STEXT ) THEN RETURN SETERROR (2 , 0 , 0 ) ENDIF LOCAL $IFORCEDSTYLE = BITOR ($__UDFGUICONSTANT_WS_TABSTOP , $__UDFGUICONSTANT_WS_VISIBLE , $__UDFGUICONSTANT_WS_CHILD , $BS_NOTIFY ) IF $ISTYLE = + 4294967295 THEN $ISTYLE = $IFORCEDSTYLE ELSE $ISTYLE = BITOR ($ISTYLE , $IFORCEDSTYLE ) ENDIF IF $IEXSTYLE = + 4294967295 THEN $IEXSTYLE = 0 LOCAL $NCTRLID = __UDF_GETNEXTGLOBALID ($HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) LOCAL $HBUTTON = _WINAPI_CREATEWINDOWEX ($IEXSTYLE , $__BUTTONCONSTANT_CLASSNAME , $STEXT , $ISTYLE , $IX , $IY , $IWIDTH , $IHEIGHT , $HWND , $NCTRLID ) _SENDMESSAGE ($HBUTTON , $__BUTTONCONSTANT_WM_SETFONT , _WINAPI_GETSTOCKOBJECT ($__BUTTONCONSTANT_DEFAULT_GUI_FONT ) , TRUE ) RETURN $HBUTTON ENDFUNC FUNC _GUICTRLBUTTON_DESTROY (BYREF $HWND ) IF NOT _WINAPI_ISCLASSNAME ($HWND , $__BUTTONCONSTANT_CLASSNAME ) THEN RETURN SETERROR (2 , 2 , FALSE ) LOCAL $IDESTROYED = 0 IF ISHWND ($HWND ) THEN IF _WINAPI_INPROCESS ($HWND , $__G_HBUTTONLASTWND ) THEN LOCAL $NCTRLID = _WINAPI_GETDLGCTRLID ($HWND ) LOCAL $HPARENT = _WINAPI_GETPARENT ($HWND ) $IDESTROYED = _WINAPI_DESTROYWINDOW ($HWND ) LOCAL $IRET = __UDF_FREEGLOBALID ($HPARENT , $NCTRLID ) IF NOT $IRET THEN ENDIF ELSE RETURN SETERROR (1 , 1 , FALSE ) ENDIF ELSE $IDESTROYED = GUICTRLDELETE ($HWND ) ENDIF IF $IDESTROYED THEN $HWND = 0 RETURN $IDESTROYED <> 0 ENDFUNC FUNC _GUICTRLBUTTON_ENABLE ($HWND , $BENABLE = TRUE ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) IF _WINAPI_ISCLASSNAME ($HWND , $__BUTTONCONSTANT_CLASSNAME ) THEN RETURN _WINAPI_ENABLEWINDOW ($HWND , $BENABLE ) = $BENABLE ENDFUNC FUNC _GUICTRLBUTTON_GETCHECK ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $BM_GETCHECK ) ENDFUNC FUNC _GUICTRLBUTTON_GETFOCUS ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) IF _WINAPI_ISCLASSNAME ($HWND , $__BUTTONCONSTANT_CLASSNAME ) THEN RETURN _WINAPI_GETFOCUS () = $HWND ENDFUNC FUNC _GUICTRLBUTTON_GETIDEALSIZE ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $TSIZE = DLLSTRUCTCREATE ($TAGSIZE ) , $ASIZE [2 ] LOCAL $IRET = _SENDMESSAGE ($HWND , $BCM_GETIDEALSIZE , 0 , $TSIZE , 0 , "wparam" , "struct*" ) IF NOT $IRET THEN RETURN SETERROR (+ 4294967295 , + 4294967295 , $ASIZE ) $ASIZE [0 ] = DLLSTRUCTGETDATA ($TSIZE , "X" ) $ASIZE [1 ] = DLLSTRUCTGETDATA ($TSIZE , "Y" ) RETURN $ASIZE ENDFUNC FUNC _GUICTRLBUTTON_GETIMAGE ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $IRET = _SENDMESSAGE ($HWND , $BM_GETIMAGE , 0 , 0 , 0 , "wparam" , "lparam" , "hwnd" ) IF $IRET <> 0 THEN RETURN $IRET $IRET = _SENDMESSAGE ($HWND , $BM_GETIMAGE , 1 , 0 , 0 , "wparam" , "lparam" , "hwnd" ) IF $IRET = 0 THEN RETURN 0 RETURN $IRET ENDFUNC FUNC _GUICTRLBUTTON_GETIMAGELIST ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $TBUTTON_IMAGELIST = DLLSTRUCTCREATE ($TAGBUTTON_IMAGELIST ) , $AIMAGELIST [6 ] IF NOT _SENDMESSAGE ($HWND , $BCM_GETIMAGELIST , 0 , $TBUTTON_IMAGELIST , 0 , "wparam" , "struct*" ) THEN RETURN SETERROR (+ 4294967295 , + 4294967295 , $AIMAGELIST ) $AIMAGELIST [0 ] = DLLSTRUCTGETDATA ($TBUTTON_IMAGELIST , "ImageList" ) $AIMAGELIST [1 ] = DLLSTRUCTGETDATA ($TBUTTON_IMAGELIST , "Left" ) $AIMAGELIST [2 ] = DLLSTRUCTGETDATA ($TBUTTON_IMAGELIST , "Right" ) $AIMAGELIST [3 ] = DLLSTRUCTGETDATA ($TBUTTON_IMAGELIST , "Top" ) $AIMAGELIST [4 ] = DLLSTRUCTGETDATA ($TBUTTON_IMAGELIST , "Bottom" ) $AIMAGELIST [5 ] = DLLSTRUCTGETDATA ($TBUTTON_IMAGELIST , "Align" ) RETURN $AIMAGELIST ENDFUNC FUNC _GUICTRLBUTTON_GETNOTE ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $ILEN = _GUICTRLBUTTON_GETNOTELENGTH ($HWND ) + 1 LOCAL $TNOTE = DLLSTRUCTCREATE ("wchar Note[" & $ILEN & "]" ) LOCAL $TLEN = DLLSTRUCTCREATE ("dword" ) DLLSTRUCTSETDATA ($TLEN , 1 , $ILEN ) IF NOT _SENDMESSAGE ($HWND , $BCM_GETNOTE , $TLEN , $TNOTE , 0 , "struct*" , "struct*" ) THEN RETURN SETERROR (+ 4294967295 , 0 , "" ) RETURN _WINAPI_WIDECHARTOMULTIBYTE ($TNOTE ) ENDFUNC FUNC _GUICTRLBUTTON_GETNOTELENGTH ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $BCM_GETNOTELENGTH ) ENDFUNC FUNC _GUICTRLBUTTON_GETSPLITINFO ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $TSPLITINFO = DLLSTRUCTCREATE ($TAGBUTTON_SPLITINFO ) , $AINFO [4 ] DLLSTRUCTSETDATA ($TSPLITINFO , "mask" , BITOR ($BCSIF_GLYPH , $BCSIF_IMAGE , $BCSIF_SIZE , $BCSIF_STYLE ) ) IF NOT _SENDMESSAGE ($HWND , $BCM_GETSPLITINFO , 0 , $TSPLITINFO , 0 , "wparam" , "struct*" ) THEN RETURN SETERROR (+ 4294967295 , 0 , $AINFO ) $AINFO [0 ] = DLLSTRUCTGETDATA ($TSPLITINFO , "himlGlyph" ) $AINFO [1 ] = DLLSTRUCTGETDATA ($TSPLITINFO , "uSplitStyle" ) $AINFO [2 ] = DLLSTRUCTGETDATA ($TSPLITINFO , "X" ) $AINFO [3 ] = DLLSTRUCTGETDATA ($TSPLITINFO , "Y" ) RETURN $AINFO ENDFUNC FUNC _GUICTRLBUTTON_GETSTATE ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $BM_GETSTATE ) ENDFUNC FUNC _GUICTRLBUTTON_GETTEXT ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) IF _WINAPI_ISCLASSNAME ($HWND , $__BUTTONCONSTANT_CLASSNAME ) THEN RETURN _WINAPI_GETWINDOWTEXT ($HWND ) RETURN "" ENDFUNC FUNC _GUICTRLBUTTON_GETTEXTMARGIN ($HWND ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $TRECT = DLLSTRUCTCREATE ($TAGRECT ) , $ARECT [4 ] IF NOT _SENDMESSAGE ($HWND , $BCM_GETTEXTMARGIN , 0 , $TRECT , 0 , "wparam" , "struct*" ) THEN RETURN SETERROR (+ 4294967295 , + 4294967295 , $ARECT ) $ARECT [0 ] = DLLSTRUCTGETDATA ($TRECT , "Left" ) $ARECT [1 ] = DLLSTRUCTGETDATA ($TRECT , "Top" ) $ARECT [2 ] = DLLSTRUCTGETDATA ($TRECT , "Right" ) $ARECT [3 ] = DLLSTRUCTGETDATA ($TRECT , "Bottom" ) RETURN $ARECT ENDFUNC FUNC _GUICTRLBUTTON_SETCHECK ($HWND , $ISTATE = $BST_CHECKED ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) _SENDMESSAGE ($HWND , $BM_SETCHECK , $ISTATE ) ENDFUNC FUNC _GUICTRLBUTTON_SETDONTCLICK ($HWND , $BSTATE = TRUE ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) _SENDMESSAGE ($HWND , $BM_SETDONTCLICK , $BSTATE ) ENDFUNC FUNC _GUICTRLBUTTON_SETDROPDOWNSTATE ($HWND , $BSTATE = TRUE ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $BCM_SETDROPDOWNSTATE , $BSTATE ) <> 0 ENDFUNC FUNC _GUICTRLBUTTON_SETFOCUS ($HWND , $BFOCUS = TRUE ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) IF _WINAPI_ISCLASSNAME ($HWND , $__BUTTONCONSTANT_CLASSNAME ) THEN IF $BFOCUS THEN RETURN _WINAPI_SETFOCUS ($HWND ) <> 0 ELSE RETURN _WINAPI_SETFOCUS (_WINAPI_GETPARENT ($HWND ) ) <> 0 ENDIF ENDIF ENDFUNC FUNC _GUICTRLBUTTON_SETIMAGE ($HWND , $SIMAGEFILE , $IICONID = + 4294967295 , $BLARGE = FALSE ) LOCAL $HIMAGE , $HPREVIMAGE IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) IF STRINGUPPER (STRINGMID ($SIMAGEFILE , STRINGLEN ($SIMAGEFILE ) + 4294967294 ) ) = "BMP" THEN IF BITAND (_WINAPI_GETWINDOWLONG ($HWND , $__BUTTONCONSTANT_GWL_STYLE ) , $BS_BITMAP ) = $BS_BITMAP THEN $HIMAGE = _WINAPI_LOADIMAGE (0 , $SIMAGEFILE , 0 , 0 , 0 , BITOR ($LR_LOADFROMFILE , $LR_CREATEDIBSECTION ) ) IF NOT $HIMAGE THEN RETURN SETERROR (+ 4294967295 , + 4294967295 , FALSE ) $HPREVIMAGE = _SENDMESSAGE ($HWND , $BM_SETIMAGE , 0 , $HIMAGE ) IF $HPREVIMAGE THEN IF NOT _WINAPI_DELETEOBJECT ($HPREVIMAGE ) THEN _WINAPI_DESTROYICON ($HPREVIMAGE ) ENDIF _WINAPI_UPDATEWINDOW ($HWND ) RETURN TRUE ENDIF ELSE IF $IICONID = + 4294967295 THEN $HIMAGE = _WINAPI_LOADIMAGE (0 , $SIMAGEFILE , 1 , 0 , 0 , BITOR ($LR_LOADFROMFILE , $LR_CREATEDIBSECTION ) ) IF NOT $HIMAGE THEN RETURN SETERROR (+ 4294967295 , + 4294967295 , FALSE ) $HPREVIMAGE = _SENDMESSAGE ($HWND , $BM_SETIMAGE , 1 , $HIMAGE ) IF $HPREVIMAGE THEN IF NOT _WINAPI_DELETEOBJECT ($HPREVIMAGE ) THEN _WINAPI_DESTROYICON ($HPREVIMAGE ) ENDIF _WINAPI_UPDATEWINDOW ($HWND ) RETURN TRUE ELSE LOCAL $TICON = DLLSTRUCTCREATE ("handle Handle" ) LOCAL $IRET IF $BLARGE THEN $IRET = _WINAPI_EXTRACTICONEX ($SIMAGEFILE , $IICONID , $TICON , 0 , 1 ) ELSE $IRET = _WINAPI_EXTRACTICONEX ($SIMAGEFILE , $IICONID , 0 , $TICON , 1 ) ENDIF IF NOT $IRET THEN RETURN SETERROR (+ 4294967295 , + 4294967295 , FALSE ) $HPREVIMAGE = _SENDMESSAGE ($HWND , $BM_SETIMAGE , 1 , DLLSTRUCTGETDATA ($TICON , "Handle" ) ) IF $HPREVIMAGE THEN IF NOT _WINAPI_DELETEOBJECT ($HPREVIMAGE ) THEN _WINAPI_DESTROYICON ($HPREVIMAGE ) ENDIF _WINAPI_UPDATEWINDOW ($HWND ) RETURN TRUE ENDIF ENDIF RETURN FALSE ENDFUNC FUNC _GUICTRLBUTTON_SETIMAGELIST ($HWND , $HIMAGE , $IALIGN = 0 , $ILEFT = 1 , $ITOP = 1 , $IRIGHT = 1 , $IBOTTOM = 1 ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) IF $IALIGN < 0 OR $IALIGN > 4 THEN $IALIGN = 0 LOCAL $TBUTTON_IMAGELIST = DLLSTRUCTCREATE ($TAGBUTTON_IMAGELIST ) DLLSTRUCTSETDATA ($TBUTTON_IMAGELIST , "ImageList" , $HIMAGE ) DLLSTRUCTSETDATA ($TBUTTON_IMAGELIST , "Left" , $ILEFT ) DLLSTRUCTSETDATA ($TBUTTON_IMAGELIST , "Top" , $ITOP ) DLLSTRUCTSETDATA ($TBUTTON_IMAGELIST , "Right" , $IRIGHT ) DLLSTRUCTSETDATA ($TBUTTON_IMAGELIST , "Bottom" , $IBOTTOM ) DLLSTRUCTSETDATA ($TBUTTON_IMAGELIST , "Align" , $IALIGN ) LOCAL $BENABLED = _GUICTRLBUTTON_ENABLE ($HWND , FALSE ) LOCAL $IRET = _SENDMESSAGE ($HWND , $BCM_SETIMAGELIST , 0 , $TBUTTON_IMAGELIST , 0 , "wparam" , "struct*" ) <> 0 _GUICTRLBUTTON_ENABLE ($HWND ) IF NOT $BENABLED THEN _GUICTRLBUTTON_ENABLE ($HWND , FALSE ) RETURN $IRET ENDFUNC FUNC _GUICTRLBUTTON_SETNOTE ($HWND , $SNOTE ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $TNOTE = _WINAPI_MULTIBYTETOWIDECHAR ($SNOTE ) RETURN _SENDMESSAGE ($HWND , $BCM_SETNOTE , 0 , $TNOTE , 0 , "wparam" , "struct*" ) <> 0 ENDFUNC FUNC _GUICTRLBUTTON_SETSHIELD ($HWND , $BREQUIRED = TRUE ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) RETURN _SENDMESSAGE ($HWND , $BCM_SETSHIELD , 0 , $BREQUIRED ) = 1 ENDFUNC FUNC _GUICTRLBUTTON_SETSIZE ($HWND , $IWIDTH , $IHEIGHT ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) IF NOT _WINAPI_ISCLASSNAME ($HWND , $__BUTTONCONSTANT_CLASSNAME ) THEN RETURN SETERROR (+ 4294967295 , + 4294967295 , FALSE ) LOCAL $HPARENT = _WINAPI_GETPARENT ($HWND ) IF NOT $HPARENT THEN RETURN SETERROR (+ 4294967295 , + 4294967295 , FALSE ) LOCAL $APOS = WINGETPOS ($HWND ) IF NOT ISARRAY ($APOS ) THEN RETURN SETERROR (+ 4294967295 , + 4294967295 , FALSE ) LOCAL $TPOINT = DLLSTRUCTCREATE ($TAGPOINT ) DLLSTRUCTSETDATA ($TPOINT , "X" , $APOS [0 ] ) DLLSTRUCTSETDATA ($TPOINT , "Y" , $APOS [1 ] ) IF NOT _WINAPI_SCREENTOCLIENT ($HPARENT , $TPOINT ) THEN RETURN SETERROR (+ 4294967295 , + 4294967295 , FALSE ) LOCAL $IRET = WINMOVE ($HWND , "" , DLLSTRUCTGETDATA ($TPOINT , "X" ) , DLLSTRUCTGETDATA ($TPOINT , "Y" ) , $IWIDTH , $IHEIGHT ) RETURN SETERROR ($IRET + 4294967295 , $IRET + 4294967295 , $IRET <> 0 ) ENDFUNC FUNC _GUICTRLBUTTON_SETSPLITINFO ($HWND , $HIMLGLYPH = + 4294967295 , $ISPLITSTYLE = $BCSS_ALIGNLEFT , $IWIDTH = 0 , $IHEIGHT = 0 ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $TSPLITINFO = DLLSTRUCTCREATE ($TAGBUTTON_SPLITINFO ) , $IMASK = 0 IF $HIMLGLYPH <> + 4294967295 THEN $IMASK = BITOR ($IMASK , $BCSIF_GLYPH ) DLLSTRUCTSETDATA ($TSPLITINFO , "himlGlyph" , $HIMLGLYPH ) ENDIF $IMASK = BITOR ($IMASK , $BCSIF_STYLE ) IF BITAND ($ISPLITSTYLE , $BCSS_IMAGE ) = $BCSS_IMAGE THEN $IMASK = BITOR ($IMASK , $BCSIF_IMAGE ) DLLSTRUCTSETDATA ($TSPLITINFO , "uSplitStyle" , $ISPLITSTYLE ) IF $IWIDTH > 0 OR $IHEIGHT > 0 THEN $IMASK = BITOR ($IMASK , $BCSIF_SIZE ) DLLSTRUCTSETDATA ($TSPLITINFO , "X" , $IWIDTH ) DLLSTRUCTSETDATA ($TSPLITINFO , "Y" , $IHEIGHT ) ENDIF DLLSTRUCTSETDATA ($TSPLITINFO , "mask" , $IMASK ) RETURN _SENDMESSAGE ($HWND , $BCM_SETSPLITINFO , 0 , $TSPLITINFO , 0 , "wparam" , "struct*" ) <> 0 ENDFUNC FUNC _GUICTRLBUTTON_SETSTATE ($HWND , $BHIGHLIGHTED = TRUE ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) _SENDMESSAGE ($HWND , $BM_SETSTATE , $BHIGHLIGHTED ) ENDFUNC FUNC _GUICTRLBUTTON_SETSTYLE ($HWND , $ISTYLE ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) _SENDMESSAGE ($HWND , $BM_SETSTYLE , $ISTYLE , TRUE ) _WINAPI_UPDATEWINDOW ($HWND ) ENDFUNC FUNC _GUICTRLBUTTON_SETTEXT ($HWND , $STEXT ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) IF _WINAPI_ISCLASSNAME ($HWND , $__BUTTONCONSTANT_CLASSNAME ) THEN RETURN _WINAPI_SETWINDOWTEXT ($HWND , $STEXT ) ENDFUNC FUNC _GUICTRLBUTTON_SETTEXTMARGIN ($HWND , $ILEFT = 1 , $ITOP = 1 , $IRIGHT = 1 , $IBOTTOM = 1 ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $TRECT = DLLSTRUCTCREATE ($TAGRECT ) DLLSTRUCTSETDATA ($TRECT , "Left" , $ILEFT ) DLLSTRUCTSETDATA ($TRECT , "Top" , $ITOP ) DLLSTRUCTSETDATA ($TRECT , "Right" , $IRIGHT ) DLLSTRUCTSETDATA ($TRECT , "Bottom" , $IBOTTOM ) RETURN _SENDMESSAGE ($HWND , $BCM_SETTEXTMARGIN , 0 , $TRECT , 0 , "wparam" , "struct*" ) <> 0 ENDFUNC FUNC _GUICTRLBUTTON_SHOW ($HWND , $BSHOW = TRUE ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) IF _WINAPI_ISCLASSNAME ($HWND , $__BUTTONCONSTANT_CLASSNAME ) THEN IF $BSHOW THEN RETURN _WINAPI_SHOWWINDOW ($HWND , @SW_SHOW ) ELSE RETURN _WINAPI_SHOWWINDOW ($HWND , @SW_HIDE ) ENDIF ENDIF ENDFUNC GLOBAL CONST $GUI_EVENT_SINGLE = 0 GLOBAL CONST $GUI_EVENT_ARRAY = 1 GLOBAL CONST $GUI_EVENT_NONE = 0 GLOBAL CONST $GUI_EVENT_CLOSE = + 4294967293 GLOBAL CONST $GUI_EVENT_MINIMIZE = + 4294967292 GLOBAL CONST $GUI_EVENT_RESTORE = + 4294967291 GLOBAL CONST $GUI_EVENT_MAXIMIZE = + 4294967290 GLOBAL CONST $GUI_EVENT_PRIMARYDOWN = + 4294967289 GLOBAL CONST $GUI_EVENT_PRIMARYUP = + 4294967288 GLOBAL CONST $GUI_EVENT_SECONDARYDOWN = + 4294967287 GLOBAL CONST $GUI_EVENT_SECONDARYUP = + 4294967286 GLOBAL CONST $GUI_EVENT_MOUSEMOVE = + 4294967285 GLOBAL CONST $GUI_EVENT_RESIZED = + 4294967284 GLOBAL CONST $GUI_EVENT_DROPPED = + 4294967283 GLOBAL CONST $GUI_RUNDEFMSG = "GUI_RUNDEFMSG" GLOBAL CONST $GUI_AVISTOP = 0 GLOBAL CONST $GUI_AVISTART = 1 GLOBAL CONST $GUI_AVICLOSE = 2 GLOBAL CONST $GUI_CHECKED = 1 GLOBAL CONST $GUI_INDETERMINATE = 2 GLOBAL CONST $GUI_UNCHECKED = 4 GLOBAL CONST $GUI_DROPACCEPTED = 8 GLOBAL CONST $GUI_NODROPACCEPTED = 4096 GLOBAL CONST $GUI_ACCEPTFILES = $GUI_DROPACCEPTED GLOBAL CONST $GUI_SHOW = 16 GLOBAL CONST $GUI_HIDE = 32 GLOBAL CONST $GUI_ENABLE = 64 GLOBAL CONST $GUI_DISABLE = 128 GLOBAL CONST $GUI_FOCUS = 256 GLOBAL CONST $GUI_NOFOCUS = 8192 GLOBAL CONST $GUI_DEFBUTTON = 512 GLOBAL CONST $GUI_EXPAND = 1024 GLOBAL CONST $GUI_ONTOP = 2048 GLOBAL CONST $GUI_FONTNORMAL = 0 GLOBAL CONST $GUI_FONTITALIC = 2 GLOBAL CONST $GUI_FONTUNDER = 4 GLOBAL CONST $GUI_FONTSTRIKE = 8 GLOBAL CONST $GUI_DOCKAUTO = 1 GLOBAL CONST $GUI_DOCKLEFT = 2 GLOBAL CONST $GUI_DOCKRIGHT = 4 GLOBAL CONST $GUI_DOCKHCENTER = 8 GLOBAL CONST $GUI_DOCKTOP = 32 GLOBAL CONST $GUI_DOCKBOTTOM = 64 GLOBAL CONST $GUI_DOCKVCENTER = 128 GLOBAL CONST $GUI_DOCKWIDTH = 256 GLOBAL CONST $GUI_DOCKHEIGHT = 512 GLOBAL CONST $GUI_DOCKSIZE = 768 GLOBAL CONST $GUI_DOCKMENUBAR = 544 GLOBAL CONST $GUI_DOCKSTATEBAR = 576 GLOBAL CONST $GUI_DOCKALL = 802 GLOBAL CONST $GUI_DOCKBORDERS = 102 GLOBAL CONST $GUI_GR_CLOSE = 1 GLOBAL CONST $GUI_GR_LINE = 2 GLOBAL CONST $GUI_GR_BEZIER = 4 GLOBAL CONST $GUI_GR_MOVE = 6 GLOBAL CONST $GUI_GR_COLOR = 8 GLOBAL CONST $GUI_GR_RECT = 10 GLOBAL CONST $GUI_GR_ELLIPSE = 12 GLOBAL CONST $GUI_GR_PIE = 14 GLOBAL CONST $GUI_GR_DOT = 16 GLOBAL CONST $GUI_GR_PIXEL = 18 GLOBAL CONST $GUI_GR_HINT = 20 GLOBAL CONST $GUI_GR_REFRESH = 22 GLOBAL CONST $GUI_GR_PENSIZE = 24 GLOBAL CONST $GUI_GR_NOBKCOLOR = + 4294967294 GLOBAL CONST $GUI_BKCOLOR_DEFAULT = + 4294967295 GLOBAL CONST $GUI_BKCOLOR_TRANSPARENT = + 4294967294 GLOBAL CONST $GUI_BKCOLOR_LV_ALTERNATE = 4261412864 GLOBAL CONST $GUI_READ_DEFAULT = 0 GLOBAL CONST $GUI_READ_EXTENDED = 1 GLOBAL CONST $GUI_CURSOR_NOOVERRIDE = 0 GLOBAL CONST $GUI_CURSOR_OVERRIDE = 1 GLOBAL CONST $GUI_WS_EX_PARENTDRAG = 1048576 GLOBAL CONST $PBS_MARQUEE = 8 GLOBAL CONST $PBS_SMOOTH = 1 GLOBAL CONST $PBS_SMOOTHREVERSE = 16 GLOBAL CONST $PBS_VERTICAL = 4 GLOBAL CONST $GUI_SS_DEFAULT_PROGRESS = 0 GLOBAL CONST $__PROGRESSBARCONSTANT_WM_USER = 1024 GLOBAL CONST $PBM_DELTAPOS = $__PROGRESSBARCONSTANT_WM_USER + 3 GLOBAL CONST $PBM_GETBARCOLOR = 1039 GLOBAL CONST $PBM_GETBKCOLOR = 1038 GLOBAL CONST $PBM_GETPOS = $__PROGRESSBARCONSTANT_WM_USER + 8 GLOBAL CONST $PBM_GETRANGE = $__PROGRESSBARCONSTANT_WM_USER + 7 GLOBAL CONST $PBM_GETSTATE = 1041 GLOBAL CONST $PBM_GETSTEP = 1037 GLOBAL CONST $PBM_SETBARCOLOR = $__PROGRESSBARCONSTANT_WM_USER + 9 GLOBAL CONST $PBM_SETBKCOLOR = 8192 + 1 GLOBAL CONST $PBM_SETMARQUEE = $__PROGRESSBARCONSTANT_WM_USER + 10 GLOBAL CONST $PBM_SETPOS = $__PROGRESSBARCONSTANT_WM_USER + 2 GLOBAL CONST $PBM_SETRANGE = $__PROGRESSBARCONSTANT_WM_USER + 1 GLOBAL CONST $PBM_SETRANGE32 = $__PROGRESSBARCONSTANT_WM_USER + 6 GLOBAL CONST $PBM_SETSTATE = 1040 GLOBAL CONST $PBM_SETSTEP = $__PROGRESSBARCONSTANT_WM_USER + 4 GLOBAL CONST $PBM_STEPIT = $__PROGRESSBARCONSTANT_WM_USER + 5 GLOBAL CONST $WC_ANIMATE = "SysAnimate32" GLOBAL CONST $WC_BUTTON = "Button" GLOBAL CONST $WC_COMBOBOX = "ComboBox" GLOBAL CONST $WC_COMBOBOXEX = "ComboBoxEx32" GLOBAL CONST $WC_DATETIMEPICK = "SysDateTimePick32" GLOBAL CONST $WC_EDIT = "Edit" GLOBAL CONST $WC_HEADER = "SysHeader32" GLOBAL CONST $WC_HOTKEY = "msctls_hotkey32" GLOBAL CONST $WC_IPADDRESS = "SysIPAddress32" GLOBAL CONST $WC_LINK = "SysLink" GLOBAL CONST $WC_LISTBOX = "ListBox" GLOBAL CONST $WC_LISTVIEW = "SysListView32" GLOBAL CONST $WC_MONTHCAL = "SysMonthCal32" GLOBAL CONST $WC_NATIVEFONTCTL = "NativeFontCtl" GLOBAL CONST $WC_PAGESCROLLER = "SysPager" GLOBAL CONST $WC_PROGRESS = "msctls_progress32" GLOBAL CONST $WC_REBAR = "ReBarWindow32" GLOBAL CONST $WC_SCROLLBAR = "ScrollBar" GLOBAL CONST $WC_STATIC = "Static" GLOBAL CONST $WC_STATUSBAR = "msctls_statusbar32" GLOBAL CONST $WC_TABCONTROL = "SysTabControl32" GLOBAL CONST $WC_TOOLBAR = "ToolbarWindow32" GLOBAL CONST $WC_TOOLTIPS = "tooltips_class32" GLOBAL CONST $WC_TRACKBAR = "msctls_trackbar32" GLOBAL CONST $WC_TREEVIEW = "SysTreeView32" GLOBAL CONST $WC_UPDOWN = "msctls_updown32" GLOBAL CONST $WS_OVERLAPPED = 0 GLOBAL CONST $WS_TILED = $WS_OVERLAPPED GLOBAL CONST $WS_MAXIMIZEBOX = 65536 GLOBAL CONST $WS_MINIMIZEBOX = 131072 GLOBAL CONST $WS_TABSTOP = 65536 GLOBAL CONST $WS_GROUP = 131072 GLOBAL CONST $WS_SIZEBOX = 262144 GLOBAL CONST $WS_THICKFRAME = $WS_SIZEBOX GLOBAL CONST $WS_SYSMENU = 524288 GLOBAL CONST $WS_HSCROLL = 1048576 GLOBAL CONST $WS_VSCROLL = 2097152 GLOBAL CONST $WS_DLGFRAME = 4194304 GLOBAL CONST $WS_BORDER = 8388608 GLOBAL CONST $WS_CAPTION = 12582912 GLOBAL CONST $WS_OVERLAPPEDWINDOW = BITOR ($WS_CAPTION , $WS_MAXIMIZEBOX , $WS_MINIMIZEBOX , $WS_OVERLAPPED , $WS_SYSMENU , $WS_THICKFRAME ) GLOBAL CONST $WS_TILEDWINDOW = $WS_OVERLAPPEDWINDOW GLOBAL CONST $WS_MAXIMIZE = 16777216 GLOBAL CONST $WS_CLIPCHILDREN = 33554432 GLOBAL CONST $WS_CLIPSIBLINGS = 67108864 GLOBAL CONST $WS_DISABLED = 134217728 GLOBAL CONST $WS_VISIBLE = 268435456 GLOBAL CONST $WS_MINIMIZE = 536870912 GLOBAL CONST $WS_ICONIC = $WS_MINIMIZE GLOBAL CONST $WS_CHILD = 1073741824 GLOBAL CONST $WS_CHILDWINDOW = $WS_CHILD GLOBAL CONST $WS_POPUP = 2147483648 GLOBAL CONST $WS_POPUPWINDOW = 2156396544 GLOBAL CONST $DS_3DLOOK = 4 GLOBAL CONST $DS_ABSALIGN = 1 GLOBAL CONST $DS_CENTER = 2048 GLOBAL CONST $DS_CENTERMOUSE = 4096 GLOBAL CONST $DS_CONTEXTHELP = 8192 GLOBAL CONST $DS_CONTROL = 1024 GLOBAL CONST $DS_FIXEDSYS = 8 GLOBAL CONST $DS_LOCALEDIT = 32 GLOBAL CONST $DS_MODALFRAME = 128 GLOBAL CONST $DS_NOFAILCREATE = 16 GLOBAL CONST $DS_NOIDLEMSG = 256 GLOBAL CONST $DS_SETFONT = 64 GLOBAL CONST $DS_SETFOREGROUND = 512 GLOBAL CONST $DS_SHELLFONT = BITOR ($DS_FIXEDSYS , $DS_SETFONT ) GLOBAL CONST $DS_SYSMODAL = 2 GLOBAL CONST $WS_EX_ACCEPTFILES = 16 GLOBAL CONST $WS_EX_APPWINDOW = 262144 GLOBAL CONST $WS_EX_COMPOSITED = 33554432 GLOBAL CONST $WS_EX_CONTROLPARENT = 65536 GLOBAL CONST $WS_EX_CLIENTEDGE = 512 GLOBAL CONST $WS_EX_CONTEXTHELP = 1024 GLOBAL CONST $WS_EX_DLGMODALFRAME = 1 GLOBAL CONST $WS_EX_LAYERED = 524288 GLOBAL CONST $WS_EX_LAYOUTRTL = 4194304 GLOBAL CONST $WS_EX_LEFT = 0 GLOBAL CONST $WS_EX_LEFTSCROLLBAR = 16384 GLOBAL CONST $WS_EX_LTRREADING = 0 GLOBAL CONST $WS_EX_MDICHILD = 64 GLOBAL CONST $WS_EX_NOACTIVATE = 134217728 GLOBAL CONST $WS_EX_NOINHERITLAYOUT = 1048576 GLOBAL CONST $WS_EX_NOPARENTNOTIFY = 4 GLOBAL CONST $WS_EX_RIGHT = 4096 GLOBAL CONST $WS_EX_RIGHTSCROLLBAR = 0 GLOBAL CONST $WS_EX_RTLREADING = 8192 GLOBAL CONST $WS_EX_STATICEDGE = 131072 GLOBAL CONST $WS_EX_TOOLWINDOW = 128 GLOBAL CONST $WS_EX_TOPMOST = 8 GLOBAL CONST $WS_EX_TRANSPARENT = 32 GLOBAL CONST $WS_EX_WINDOWEDGE = 256 GLOBAL CONST $WS_EX_OVERLAPPEDWINDOW = BITOR ($WS_EX_CLIENTEDGE , $WS_EX_WINDOWEDGE ) GLOBAL CONST $WS_EX_PALETTEWINDOW = BITOR ($WS_EX_TOOLWINDOW , $WS_EX_TOPMOST , $WS_EX_WINDOWEDGE ) GLOBAL CONST $WM_NULL = 0 GLOBAL CONST $WM_CREATE = 1 GLOBAL CONST $WM_DESTROY = 2 GLOBAL CONST $WM_MOVE = 3 GLOBAL CONST $WM_SIZEWAIT = 4 GLOBAL CONST $WM_SIZE = 5 GLOBAL CONST $WM_ACTIVATE = 6 GLOBAL CONST $WM_SETFOCUS = 7 GLOBAL CONST $WM_KILLFOCUS = 8 GLOBAL CONST $WM_SETVISIBLE = 9 GLOBAL CONST $WM_ENABLE = 10 GLOBAL CONST $WM_SETREDRAW = 11 GLOBAL CONST $WM_SETTEXT = 12 GLOBAL CONST $WM_GETTEXT = 13 GLOBAL CONST $WM_GETTEXTLENGTH = 14 GLOBAL CONST $WM_PAINT = 15 GLOBAL CONST $WM_CLOSE = 16 GLOBAL CONST $WM_QUERYENDSESSION = 17 GLOBAL CONST $WM_QUIT = 18 GLOBAL CONST $WM_ERASEBKGND = 20 GLOBAL CONST $WM_QUERYOPEN = 19 GLOBAL CONST $WM_SYSCOLORCHANGE = 21 GLOBAL CONST $WM_ENDSESSION = 22 GLOBAL CONST $WM_SYSTEMERROR = 23 GLOBAL CONST $WM_SHOWWINDOW = 24 GLOBAL CONST $WM_CTLCOLOR = 25 GLOBAL CONST $WM_SETTINGCHANGE = 26 GLOBAL CONST $WM_WININICHANGE = 26 GLOBAL CONST $WM_DEVMODECHANGE = 27 GLOBAL CONST $WM_ACTIVATEAPP = 28 GLOBAL CONST $WM_FONTCHANGE = 29 GLOBAL CONST $WM_TIMECHANGE = 30 GLOBAL CONST $WM_CANCELMODE = 31 GLOBAL CONST $WM_SETCURSOR = 32 GLOBAL CONST $WM_MOUSEACTIVATE = 33 GLOBAL CONST $WM_CHILDACTIVATE = 34 GLOBAL CONST $WM_QUEUESYNC = 35 GLOBAL CONST $WM_GETMINMAXINFO = 36 GLOBAL CONST $WM_LOGOFF = 37 GLOBAL CONST $WM_PAINTICON = 38 GLOBAL CONST $WM_ICONERASEBKGND = 39 GLOBAL CONST $WM_NEXTDLGCTL = 40 GLOBAL CONST $WM_ALTTABACTIVE = 41 GLOBAL CONST $WM_SPOOLERSTATUS = 42 GLOBAL CONST $WM_DRAWITEM = 43 GLOBAL CONST $WM_MEASUREITEM = 44 GLOBAL CONST $WM_DELETEITEM = 45 GLOBAL CONST $WM_VKEYTOITEM = 46 GLOBAL CONST $WM_CHARTOITEM = 47 GLOBAL CONST $WM_SETFONT = 48 GLOBAL CONST $WM_GETFONT = 49 GLOBAL CONST $WM_SETHOTKEY = 50 GLOBAL CONST $WM_GETHOTKEY = 51 GLOBAL CONST $WM_FILESYSCHANGE = 52 GLOBAL CONST $WM_ISACTIVEICON = 53 GLOBAL CONST $WM_QUERYPARKICON = 54 GLOBAL CONST $WM_QUERYDRAGICON = 55 GLOBAL CONST $WM_WINHELP = 56 GLOBAL CONST $WM_COMPAREITEM = 57 GLOBAL CONST $WM_FULLSCREEN = 58 GLOBAL CONST $WM_CLIENTSHUTDOWN = 59 GLOBAL CONST $WM_DDEMLEVENT = 60 GLOBAL CONST $WM_GETOBJECT = 61 GLOBAL CONST $WM_CALCSCROLL = 63 GLOBAL CONST $WM_TESTING = 64 GLOBAL CONST $WM_COMPACTING = 65 GLOBAL CONST $WM_OTHERWINDOWCREATED = 66 GLOBAL CONST $WM_OTHERWINDOWDESTROYED = 67 GLOBAL CONST $WM_COMMNOTIFY = 68 GLOBAL CONST $WM_MEDIASTATUSCHANGE = 69 GLOBAL CONST $WM_WINDOWPOSCHANGING = 70 GLOBAL CONST $WM_WINDOWPOSCHANGED = 71 GLOBAL CONST $WM_POWER = 72 GLOBAL CONST $WM_COPYGLOBALDATA = 73 GLOBAL CONST $WM_COPYDATA = 74 GLOBAL CONST $WM_CANCELJOURNAL = 75 GLOBAL CONST $WM_LOGONNOTIFY = 76 GLOBAL CONST $WM_KEYF1 = 77 GLOBAL CONST $WM_NOTIFY = 78 GLOBAL CONST $WM_ACCESS_WINDOW = 79 GLOBAL CONST $WM_INPUTLANGCHANGEREQUEST = 80 GLOBAL CONST $WM_INPUTLANGCHANGE = 81 GLOBAL CONST $WM_TCARD = 82 GLOBAL CONST $WM_HELP = 83 GLOBAL CONST $WM_USERCHANGED = 84 GLOBAL CONST $WM_NOTIFYFORMAT = 85 GLOBAL CONST $WM_QM_ACTIVATE = 96 GLOBAL CONST $WM_HOOK_DO_CALLBACK = 97 GLOBAL CONST $WM_SYSCOPYDATA = 98 GLOBAL CONST $WM_FINALDESTROY = 112 GLOBAL CONST $WM_MEASUREITEM_CLIENTDATA = 113 GLOBAL CONST $WM_CONTEXTMENU = 123 GLOBAL CONST $WM_STYLECHANGING = 124 GLOBAL CONST $WM_STYLECHANGED = 125 GLOBAL CONST $WM_DISPLAYCHANGE = 126 GLOBAL CONST $WM_GETICON = 127 GLOBAL CONST $WM_SETICON = 128 GLOBAL CONST $WM_NCCREATE = 129 GLOBAL CONST $WM_NCDESTROY = 130 GLOBAL CONST $WM_NCCALCSIZE = 131 GLOBAL CONST $WM_NCHITTEST = 132 GLOBAL CONST $WM_NCPAINT = 133 GLOBAL CONST $WM_NCACTIVATE = 134 GLOBAL CONST $WM_GETDLGCODE = 135 GLOBAL CONST $WM_SYNCPAINT = 136 GLOBAL CONST $WM_SYNCTASK = 137 GLOBAL CONST $WM_KLUDGEMINRECT = 139 GLOBAL CONST $WM_LPKDRAWSWITCHWND = 140 GLOBAL CONST $WM_UAHDESTROYWINDOW = 144 GLOBAL CONST $WM_UAHDRAWMENU = 145 GLOBAL CONST $WM_UAHDRAWMENUITEM = 146 GLOBAL CONST $WM_UAHINITMENU = 147 GLOBAL CONST $WM_UAHMEASUREMENUITEM = 148 GLOBAL CONST $WM_UAHNCPAINTMENUPOPUP = 149 GLOBAL CONST $WM_NCMOUSEMOVE = 160 GLOBAL CONST $WM_NCLBUTTONDOWN = 161 GLOBAL CONST $WM_NCLBUTTONUP = 162 GLOBAL CONST $WM_NCLBUTTONDBLCLK = 163 GLOBAL CONST $WM_NCRBUTTONDOWN = 164 GLOBAL CONST $WM_NCRBUTTONUP = 165 GLOBAL CONST $WM_NCRBUTTONDBLCLK = 166 GLOBAL CONST $WM_NCMBUTTONDOWN = 167 GLOBAL CONST $WM_NCMBUTTONUP = 168 GLOBAL CONST $WM_NCMBUTTONDBLCLK = 169 GLOBAL CONST $WM_NCXBUTTONDOWN = 171 GLOBAL CONST $WM_NCXBUTTONUP = 172 GLOBAL CONST $WM_NCXBUTTONDBLCLK = 173 GLOBAL CONST $WM_NCUAHDRAWCAPTION = 174 GLOBAL CONST $WM_NCUAHDRAWFRAME = 175 GLOBAL CONST $WM_INPUT_DEVICE_CHANGE = 254 GLOBAL CONST $WM_INPUT = 255 GLOBAL CONST $WM_KEYDOWN = 256 GLOBAL CONST $WM_KEYFIRST = 256 GLOBAL CONST $WM_KEYUP = 257 GLOBAL CONST $WM_CHAR = 258 GLOBAL CONST $WM_DEADCHAR = 259 GLOBAL CONST $WM_SYSKEYDOWN = 260 GLOBAL CONST $WM_SYSKEYUP = 261 GLOBAL CONST $WM_SYSCHAR = 262 GLOBAL CONST $WM_SYSDEADCHAR = 263 GLOBAL CONST $WM_YOMICHAR = 264 GLOBAL CONST $WM_KEYLAST = 265 GLOBAL CONST $WM_UNICHAR = 265 GLOBAL CONST $WM_CONVERTREQUEST = 266 GLOBAL CONST $WM_CONVERTRESULT = 267 GLOBAL CONST $WM_IM_INFO = 268 GLOBAL CONST $WM_IME_STARTCOMPOSITION = 269 GLOBAL CONST $WM_IME_ENDCOMPOSITION = 270 GLOBAL CONST $WM_IME_COMPOSITION = 271 GLOBAL CONST $WM_IME_KEYLAST = 271 GLOBAL CONST $WM_INITDIALOG = 272 GLOBAL CONST $WM_COMMAND = 273 GLOBAL CONST $WM_SYSCOMMAND = 274 GLOBAL CONST $WM_TIMER = 275 GLOBAL CONST $WM_HSCROLL = 276 GLOBAL CONST $WM_VSCROLL = 277 GLOBAL CONST $WM_INITMENU = 278 GLOBAL CONST $WM_INITMENUPOPUP = 279 GLOBAL CONST $WM_SYSTIMER = 280 GLOBAL CONST $WM_GESTURE = 281 GLOBAL CONST $WM_GESTURENOTIFY = 282 GLOBAL CONST $WM_GESTUREINPUT = 283 GLOBAL CONST $WM_GESTURENOTIFIED = 284 GLOBAL CONST $WM_MENUSELECT = 287 GLOBAL CONST $WM_MENUCHAR = 288 GLOBAL CONST $WM_ENTERIDLE = 289 GLOBAL CONST $WM_MENURBUTTONUP = 290 GLOBAL CONST $WM_MENUDRAG = 291 GLOBAL CONST $WM_MENUGETOBJECT = 292 GLOBAL CONST $WM_UNINITMENUPOPUP = 293 GLOBAL CONST $WM_MENUCOMMAND = 294 GLOBAL CONST $WM_CHANGEUISTATE = 295 GLOBAL CONST $WM_UPDATEUISTATE = 296 GLOBAL CONST $WM_QUERYUISTATE = 297 GLOBAL CONST $WM_LBTRACKPOINT = 305 GLOBAL CONST $WM_CTLCOLORMSGBOX = 306 GLOBAL CONST $WM_CTLCOLOREDIT = 307 GLOBAL CONST $WM_CTLCOLORLISTBOX = 308 GLOBAL CONST $WM_CTLCOLORBTN = 309 GLOBAL CONST $WM_CTLCOLORDLG = 310 GLOBAL CONST $WM_CTLCOLORSCROLLBAR = 311 GLOBAL CONST $WM_CTLCOLORSTATIC = 312 GLOBAL CONST $MN_GETHMENU = 481 GLOBAL CONST $WM_PARENTNOTIFY = 528 GLOBAL CONST $WM_ENTERMENULOOP = 529 GLOBAL CONST $WM_EXITMENULOOP = 530 GLOBAL CONST $WM_NEXTMENU = 531 GLOBAL CONST $WM_SIZING = 532 GLOBAL CONST $WM_CAPTURECHANGED = 533 GLOBAL CONST $WM_MOVING = 534 GLOBAL CONST $WM_POWERBROADCAST = 536 GLOBAL CONST $WM_DEVICECHANGE = 537 GLOBAL CONST $WM_MDICREATE = 544 GLOBAL CONST $WM_MDIDESTROY = 545 GLOBAL CONST $WM_MDIACTIVATE = 546 GLOBAL CONST $WM_MDIRESTORE = 547 GLOBAL CONST $WM_MDINEXT = 548 GLOBAL CONST $WM_MDIMAXIMIZE = 549 GLOBAL CONST $WM_MDITILE = 550 GLOBAL CONST $WM_MDICASCADE = 551 GLOBAL CONST $WM_MDIICONARRANGE = 552 GLOBAL CONST $WM_MDIGETACTIVE = 553 GLOBAL CONST $WM_DROPOBJECT = 554 GLOBAL CONST $WM_QUERYDROPOBJECT = 555 GLOBAL CONST $WM_BEGINDRAG = 556 GLOBAL CONST $WM_DRAGLOOP = 557 GLOBAL CONST $WM_DRAGSELECT = 558 GLOBAL CONST $WM_DRAGMOVE = 559 GLOBAL CONST $WM_MDISETMENU = 560 GLOBAL CONST $WM_ENTERSIZEMOVE = 561 GLOBAL CONST $WM_EXITSIZEMOVE = 562 GLOBAL CONST $WM_DROPFILES = 563 GLOBAL CONST $WM_MDIREFRESHMENU = 564 GLOBAL CONST $WM_TOUCH = 576 GLOBAL CONST $WM_IME_SETCONTEXT = 641 GLOBAL CONST $WM_IME_NOTIFY = 642 GLOBAL CONST $WM_IME_CONTROL = 643 GLOBAL CONST $WM_IME_COMPOSITIONFULL = 644 GLOBAL CONST $WM_IME_SELECT = 645 GLOBAL CONST $WM_IME_CHAR = 646 GLOBAL CONST $WM_IME_SYSTEM = 647 GLOBAL CONST $WM_IME_REQUEST = 648 GLOBAL CONST $WM_IME_KEYDOWN = 656 GLOBAL CONST $WM_IME_KEYUP = 657 GLOBAL CONST $WM_NCMOUSEHOVER = 672 GLOBAL CONST $WM_MOUSEHOVER = 673 GLOBAL CONST $WM_NCMOUSELEAVE = 674 GLOBAL CONST $WM_MOUSELEAVE = 675 GLOBAL CONST $WM_WTSSESSION_CHANGE = 689 GLOBAL CONST $WM_TABLET_FIRST = 704 GLOBAL CONST $WM_TABLET_LAST = 735 GLOBAL CONST $WM_CUT = 768 GLOBAL CONST $WM_COPY = 769 GLOBAL CONST $WM_PASTE = 770 GLOBAL CONST $WM_CLEAR = 771 GLOBAL CONST $WM_UNDO = 772 GLOBAL CONST $WM_PALETTEISCHANGING = 784 GLOBAL CONST $WM_HOTKEY = 786 GLOBAL CONST $WM_PALETTECHANGED = 785 GLOBAL CONST $WM_SYSMENU = 787 GLOBAL CONST $WM_HOOKMSG = 788 GLOBAL CONST $WM_EXITPROCESS = 789 GLOBAL CONST $WM_WAKETHREAD = 790 GLOBAL CONST $WM_PRINT = 791 GLOBAL CONST $WM_PRINTCLIENT = 792 GLOBAL CONST $WM_APPCOMMAND = 793 GLOBAL CONST $WM_QUERYNEWPALETTE = 783 GLOBAL CONST $WM_THEMECHANGED = 794 GLOBAL CONST $WM_UAHINIT = 795 GLOBAL CONST $WM_DESKTOPNOTIFY = 796 GLOBAL CONST $WM_CLIPBOARDUPDATE = 797 GLOBAL CONST $WM_DWMCOMPOSITIONCHANGED = 798 GLOBAL CONST $WM_DWMNCRENDERINGCHANGED = 799 GLOBAL CONST $WM_DWMCOLORIZATIONCOLORCHANGED = 800 GLOBAL CONST $WM_DWMWINDOWMAXIMIZEDCHANGE = 801 GLOBAL CONST $WM_DWMEXILEFRAME = 802 GLOBAL CONST $WM_DWMSENDICONICTHUMBNAIL = 803 GLOBAL CONST $WM_MAGNIFICATION_STARTED = 804 GLOBAL CONST $WM_MAGNIFICATION_ENDED = 805 GLOBAL CONST $WM_DWMSENDICONICLIVEPREVIEWBITMAP = 806 GLOBAL CONST $WM_DWMTHUMBNAILSIZECHANGED = 807 GLOBAL CONST $WM_MAGNIFICATION_OUTPUT = 808 GLOBAL CONST $WM_MEASURECONTROL = 816 GLOBAL CONST $WM_GETACTIONTEXT = 817 GLOBAL CONST $WM_FORWARDKEYDOWN = 819 GLOBAL CONST $WM_FORWARDKEYUP = 820 GLOBAL CONST $WM_GETTITLEBARINFOEX = 831 GLOBAL CONST $WM_NOTIFYWOW = 832 GLOBAL CONST $WM_HANDHELDFIRST = 856 GLOBAL CONST $WM_HANDHELDLAST = 863 GLOBAL CONST $WM_AFXFIRST = 864 GLOBAL CONST $WM_AFXLAST = 895 GLOBAL CONST $WM_PENWINFIRST = 896 GLOBAL CONST $WM_PENWINLAST = 911 GLOBAL CONST $WM_DDE_INITIATE = 992 GLOBAL CONST $WM_DDE_TERMINATE = 993 GLOBAL CONST $WM_DDE_ADVISE = 994 GLOBAL CONST $WM_DDE_UNADVISE = 995 GLOBAL CONST $WM_DDE_ACK = 996 GLOBAL CONST $WM_DDE_DATA = 997 GLOBAL CONST $WM_DDE_REQUEST = 998 GLOBAL CONST $WM_DDE_POKE = 999 GLOBAL CONST $WM_DDE_EXECUTE = 1000 GLOBAL CONST $WM_DBNOTIFICATION = 1021 GLOBAL CONST $WM_NETCONNECT = 1022 GLOBAL CONST $WM_HIBERNATE = 1023 GLOBAL CONST $WM_USER = 1024 GLOBAL CONST $WM_APP = 32768 GLOBAL CONST $NM_FIRST = 0 GLOBAL CONST $NM_OUTOFMEMORY = $NM_FIRST + 4294967295 GLOBAL CONST $NM_CLICK = $NM_FIRST + 4294967294 GLOBAL CONST $NM_DBLCLK = $NM_FIRST + 4294967293 GLOBAL CONST $NM_RETURN = $NM_FIRST + 4294967292 GLOBAL CONST $NM_RCLICK = $NM_FIRST + 4294967291 GLOBAL CONST $NM_RDBLCLK = $NM_FIRST + 4294967290 GLOBAL CONST $NM_SETFOCUS = $NM_FIRST + 4294967289 GLOBAL CONST $NM_KILLFOCUS = $NM_FIRST + 4294967288 GLOBAL CONST $NM_CUSTOMDRAW = $NM_FIRST + 4294967284 GLOBAL CONST $NM_HOVER = $NM_FIRST + 4294967283 GLOBAL CONST $NM_NCHITTEST = $NM_FIRST + 4294967282 GLOBAL CONST $NM_KEYDOWN = $NM_FIRST + 4294967281 GLOBAL CONST $NM_RELEASEDCAPTURE = $NM_FIRST + 4294967280 GLOBAL CONST $NM_SETCURSOR = $NM_FIRST + 4294967279 GLOBAL CONST $NM_CHAR = $NM_FIRST + 4294967278 GLOBAL CONST $NM_TOOLTIPSCREATED = $NM_FIRST + 4294967277 GLOBAL CONST $NM_LDOWN = $NM_FIRST + 4294967276 GLOBAL CONST $NM_RDOWN = $NM_FIRST + 4294967275 GLOBAL CONST $NM_THEMECHANGED = $NM_FIRST + 4294967274 GLOBAL CONST $WM_MOUSEFIRST = 512 GLOBAL CONST $WM_MOUSEMOVE = 512 GLOBAL CONST $WM_LBUTTONDOWN = 513 GLOBAL CONST $WM_LBUTTONUP = 514 GLOBAL CONST $WM_LBUTTONDBLCLK = 515 GLOBAL CONST $WM_RBUTTONDOWN = 516 GLOBAL CONST $WM_RBUTTONUP = 517 GLOBAL CONST $WM_RBUTTONDBLCLK = 518 GLOBAL CONST $WM_MBUTTONDOWN = 519 GLOBAL CONST $WM_MBUTTONUP = 520 GLOBAL CONST $WM_MBUTTONDBLCLK = 521 GLOBAL CONST $WM_MOUSEWHEEL = 522 GLOBAL CONST $WM_XBUTTONDOWN = 523 GLOBAL CONST $WM_XBUTTONUP = 524 GLOBAL CONST $WM_XBUTTONDBLCLK = 525 GLOBAL CONST $WM_MOUSEHWHEEL = 526 GLOBAL CONST $PS_SOLID = 0 GLOBAL CONST $PS_DASH = 1 GLOBAL CONST $PS_DOT = 2 GLOBAL CONST $PS_DASHDOT = 3 GLOBAL CONST $PS_DASHDOTDOT = 4 GLOBAL CONST $PS_NULL = 5 GLOBAL CONST $PS_INSIDEFRAME = 6 GLOBAL CONST $PS_USERSTYLE = 7 GLOBAL CONST $PS_ALTERNATE = 8 GLOBAL CONST $PS_ENDCAP_ROUND = 0 GLOBAL CONST $PS_ENDCAP_SQUARE = 256 GLOBAL CONST $PS_ENDCAP_FLAT = 512 GLOBAL CONST $PS_JOIN_BEVEL = 4096 GLOBAL CONST $PS_JOIN_MITER = 8192 GLOBAL CONST $PS_JOIN_ROUND = 0 GLOBAL CONST $PS_GEOMETRIC = 65536 GLOBAL CONST $PS_COSMETIC = 0 GLOBAL CONST $LWA_ALPHA = 2 GLOBAL CONST $LWA_COLORKEY = 1 GLOBAL CONST $RGN_AND = 1 GLOBAL CONST $RGN_OR = 2 GLOBAL CONST $RGN_XOR = 3 GLOBAL CONST $RGN_DIFF = 4 GLOBAL CONST $RGN_COPY = 5 GLOBAL CONST $ERRORREGION = 0 GLOBAL CONST $NULLREGION = 1 GLOBAL CONST $SIMPLEREGION = 2 GLOBAL CONST $COMPLEXREGION = 3 GLOBAL CONST $TRANSPARENT = 1 GLOBAL CONST $OPAQUE = 2 GLOBAL CONST $CCM_FIRST = 8192 GLOBAL CONST $CCM_GETUNICODEFORMAT = ($CCM_FIRST + 6 ) GLOBAL CONST $CCM_SETUNICODEFORMAT = ($CCM_FIRST + 5 ) GLOBAL CONST $CCM_SETBKCOLOR = $CCM_FIRST + 1 GLOBAL CONST $CCM_SETCOLORSCHEME = $CCM_FIRST + 2 GLOBAL CONST $CCM_GETCOLORSCHEME = $CCM_FIRST + 3 GLOBAL CONST $CCM_GETDROPTARGET = $CCM_FIRST + 4 GLOBAL CONST $CCM_SETWINDOWTHEME = $CCM_FIRST + 11 GLOBAL CONST $GA_PARENT = 1 GLOBAL CONST $GA_ROOT = 2 GLOBAL CONST $GA_ROOTOWNER = 3 GLOBAL CONST $SM_CXSCREEN = 0 GLOBAL CONST $SM_CYSCREEN = 1 GLOBAL CONST $SM_CXVSCROLL = 2 GLOBAL CONST $SM_CYHSCROLL = 3 GLOBAL CONST $SM_CYCAPTION = 4 GLOBAL CONST $SM_CXBORDER = 5 GLOBAL CONST $SM_CYBORDER = 6 GLOBAL CONST $SM_CXFIXEDFRAME = 7 GLOBAL CONST $SM_CXDLGFRAME = $SM_CXFIXEDFRAME GLOBAL CONST $SM_CYFIXEDFRAME = 8 GLOBAL CONST $SM_CYDLGFRAME = $SM_CYFIXEDFRAME GLOBAL CONST $SM_CYVTHUMB = 9 GLOBAL CONST $SM_CXHTHUMB = 10 GLOBAL CONST $SM_CXICON = 11 GLOBAL CONST $SM_CYICON = 12 GLOBAL CONST $SM_CXCURSOR = 13 GLOBAL CONST $SM_CYCURSOR = 14 GLOBAL CONST $SM_CYMENU = 15 GLOBAL CONST $SM_CXFULLSCREEN = 16 GLOBAL CONST $SM_CYFULLSCREEN = 17 GLOBAL CONST $SM_CYKANJIWINDOW = 18 GLOBAL CONST $SM_MOUSEPRESENT = 19 GLOBAL CONST $SM_CYVSCROLL = 20 GLOBAL CONST $SM_CXHSCROLL = 21 GLOBAL CONST $SM_DEBUG = 22 GLOBAL CONST $SM_SWAPBUTTON = 23 GLOBAL CONST $SM_RESERVED1 = 24 GLOBAL CONST $SM_RESERVED2 = 25 GLOBAL CONST $SM_RESERVED3 = 26 GLOBAL CONST $SM_RESERVED4 = 27 GLOBAL CONST $SM_CXMIN = 28 GLOBAL CONST $SM_CYMIN = 29 GLOBAL CONST $SM_CXSIZE = 30 GLOBAL CONST $SM_CYSIZE = 31 GLOBAL CONST $SM_CXSIZEFRAME = 32 GLOBAL CONST $SM_CXFRAME = $SM_CXSIZEFRAME GLOBAL CONST $SM_CYSIZEFRAME = 33 GLOBAL CONST $SM_CYFRAME = $SM_CYSIZEFRAME GLOBAL CONST $SM_CXMINTRACK = 34 GLOBAL CONST $SM_CYMINTRACK = 35 GLOBAL CONST $SM_CXDOUBLECLK = 36 GLOBAL CONST $SM_CYDOUBLECLK = 37 GLOBAL CONST $SM_CXICONSPACING = 38 GLOBAL CONST $SM_CYICONSPACING = 39 GLOBAL CONST $SM_MENUDROPALIGNMENT = 40 GLOBAL CONST $SM_PENWINDOWS = 41 GLOBAL CONST $SM_DBCSENABLED = 42 GLOBAL CONST $SM_CMOUSEBUTTONS = 43 GLOBAL CONST $SM_SECURE = 44 GLOBAL CONST $SM_CXEDGE = 45 GLOBAL CONST $SM_CYEDGE = 46 GLOBAL CONST $SM_CXMINSPACING = 47 GLOBAL CONST $SM_CYMINSPACING = 48 GLOBAL CONST $SM_CXSMICON = 49 GLOBAL CONST $SM_CYSMICON = 50 GLOBAL CONST $SM_CYSMCAPTION = 51 GLOBAL CONST $SM_CXSMSIZE = 52 GLOBAL CONST $SM_CYSMSIZE = 53 GLOBAL CONST $SM_CXMENUSIZE = 54 GLOBAL CONST $SM_CYMENUSIZE = 55 GLOBAL CONST $SM_ARRANGE = 56 GLOBAL CONST $SM_CXMINIMIZED = 57 GLOBAL CONST $SM_CYMINIMIZED = 58 GLOBAL CONST $SM_CXMAXTRACK = 59 GLOBAL CONST $SM_CYMAXTRACK = 60 GLOBAL CONST $SM_CXMAXIMIZED = 61 GLOBAL CONST $SM_CYMAXIMIZED = 62 GLOBAL CONST $SM_NETWORK = 63 GLOBAL CONST $SM_CLEANBOOT = 67 GLOBAL CONST $SM_CXDRAG = 68 GLOBAL CONST $SM_CYDRAG = 69 GLOBAL CONST $SM_SHOWSOUNDS = 70 GLOBAL CONST $SM_CXMENUCHECK = 71 GLOBAL CONST $SM_CYMENUCHECK = 72 GLOBAL CONST $SM_SLOWMACHINE = 73 GLOBAL CONST $SM_MIDEASTENABLED = 74 GLOBAL CONST $SM_MOUSEWHEELPRESENT = 75 GLOBAL CONST $SM_XVIRTUALSCREEN = 76 GLOBAL CONST $SM_YVIRTUALSCREEN = 77 GLOBAL CONST $SM_CXVIRTUALSCREEN = 78 GLOBAL CONST $SM_CYVIRTUALSCREEN = 79 GLOBAL CONST $SM_CMONITORS = 80 GLOBAL CONST $SM_SAMEDISPLAYFORMAT = 81 GLOBAL CONST $SM_IMMENABLED = 82 GLOBAL CONST $SM_CXFOCUSBORDER = 83 GLOBAL CONST $SM_CYFOCUSBORDER = 84 GLOBAL CONST $SM_TABLETPC = 86 GLOBAL CONST $SM_MEDIACENTER = 87 GLOBAL CONST $SM_STARTER = 88 GLOBAL CONST $SM_SERVERR2 = 89 GLOBAL CONST $SM_CMETRICS = 90 GLOBAL CONST $SM_REMOTESESSION = 4096 GLOBAL CONST $SM_SHUTTINGDOWN = 8192 GLOBAL CONST $SM_REMOTECONTROL = 8193 GLOBAL CONST $SM_CARETBLINKINGENABLED = 8194 GLOBAL CONST $BLACKNESS = 66 GLOBAL CONST $CAPTUREBLT = 1073741824 GLOBAL CONST $DSTINVERT = 5570569 GLOBAL CONST $MERGECOPY = 12583114 GLOBAL CONST $MERGEPAINT = 12255782 GLOBAL CONST $NOMIRRORBITMAP = 2147483648 GLOBAL CONST $NOTSRCCOPY = 3342344 GLOBAL CONST $NOTSRCERASE = 1114278 GLOBAL CONST $PATCOPY = 15728673 GLOBAL CONST $PATINVERT = 5898313 GLOBAL CONST $PATPAINT = 16452105 GLOBAL CONST $SRCAND = 8913094 GLOBAL CONST $SRCCOPY = 13369376 GLOBAL CONST $SRCERASE = 4457256 GLOBAL CONST $SRCINVERT = 6684742 GLOBAL CONST $SRCPAINT = 15597702 GLOBAL CONST $WHITENESS = 16711778 GLOBAL CONST $DT_BOTTOM = 8 GLOBAL CONST $DT_CALCRECT = 1024 GLOBAL CONST $DT_CENTER = 1 GLOBAL CONST $DT_EDITCONTROL = 8192 GLOBAL CONST $DT_END_ELLIPSIS = 32768 GLOBAL CONST $DT_EXPANDTABS = 64 GLOBAL CONST $DT_EXTERNALLEADING = 512 GLOBAL CONST $DT_HIDEPREFIX = 1048576 GLOBAL CONST $DT_INTERNAL = 4096 GLOBAL CONST $DT_LEFT = 0 GLOBAL CONST $DT_MODIFYSTRING = 65536 GLOBAL CONST $DT_NOCLIP = 256 GLOBAL CONST $DT_NOFULLWIDTHCHARBREAK = 524288 GLOBAL CONST $DT_NOPREFIX = 2048 GLOBAL CONST $DT_PATH_ELLIPSIS = 16384 GLOBAL CONST $DT_PREFIXONLY = 2097152 GLOBAL CONST $DT_RIGHT = 2 GLOBAL CONST $DT_RTLREADING = 131072 GLOBAL CONST $DT_SINGLELINE = 32 GLOBAL CONST $DT_TABSTOP = 128 GLOBAL CONST $DT_TOP = 0 GLOBAL CONST $DT_VCENTER = 4 GLOBAL CONST $DT_WORDBREAK = 16 GLOBAL CONST $DT_WORD_ELLIPSIS = 262144 GLOBAL CONST $RDW_ERASE = 4 GLOBAL CONST $RDW_FRAME = 1024 GLOBAL CONST $RDW_INTERNALPAINT = 2 GLOBAL CONST $RDW_INVALIDATE = 1 GLOBAL CONST $RDW_NOERASE = 32 GLOBAL CONST $RDW_NOFRAME = 2048 GLOBAL CONST $RDW_NOINTERNALPAINT = 16 GLOBAL CONST $RDW_VALIDATE = 8 GLOBAL CONST $RDW_ERASENOW = 512 GLOBAL CONST $RDW_UPDATENOW = 256 GLOBAL CONST $RDW_ALLCHILDREN = 128 GLOBAL CONST $RDW_NOCHILDREN = 64 GLOBAL CONST $WM_RENDERFORMAT = 773 GLOBAL CONST $WM_RENDERALLFORMATS = 774 GLOBAL CONST $WM_DESTROYCLIPBOARD = 775 GLOBAL CONST $WM_DRAWCLIPBOARD = 776 GLOBAL CONST $WM_PAINTCLIPBOARD = 777 GLOBAL CONST $WM_VSCROLLCLIPBOARD = 778 GLOBAL CONST $WM_SIZECLIPBOARD = 779 GLOBAL CONST $WM_ASKCBFORMATNAME = 780 GLOBAL CONST $WM_CHANGECBCHAIN = 781 GLOBAL CONST $WM_HSCROLLCLIPBOARD = 782 GLOBAL CONST $HTERROR = + 4294967294 GLOBAL CONST $HTTRANSPARENT = + 4294967295 GLOBAL CONST $HTNOWHERE = 0 GLOBAL CONST $HTCLIENT = 1 GLOBAL CONST $HTCAPTION = 2 GLOBAL CONST $HTSYSMENU = 3 GLOBAL CONST $HTGROWBOX = 4 GLOBAL CONST $HTSIZE = $HTGROWBOX GLOBAL CONST $HTMENU = 5 GLOBAL CONST $HTHSCROLL = 6 GLOBAL CONST $HTVSCROLL = 7 GLOBAL CONST $HTMINBUTTON = 8 GLOBAL CONST $HTMAXBUTTON = 9 GLOBAL CONST $HTLEFT = 10 GLOBAL CONST $HTRIGHT = 11 GLOBAL CONST $HTTOP = 12 GLOBAL CONST $HTTOPLEFT = 13 GLOBAL CONST $HTTOPRIGHT = 14 GLOBAL CONST $HTBOTTOM = 15 GLOBAL CONST $HTBOTTOMLEFT = 16 GLOBAL CONST $HTBOTTOMRIGHT = 17 GLOBAL CONST $HTBORDER = 18 GLOBAL CONST $HTREDUCE = $HTMINBUTTON GLOBAL CONST $HTZOOM = $HTMAXBUTTON GLOBAL CONST $HTSIZEFIRST = $HTLEFT GLOBAL CONST $HTSIZELAST = $HTBOTTOMRIGHT GLOBAL CONST $HTOBJECT = 19 GLOBAL CONST $HTCLOSE = 20 GLOBAL CONST $HTHELP = 21 GLOBAL CONST $COLOR_SCROLLBAR = 0 GLOBAL CONST $COLOR_BACKGROUND = 1 GLOBAL CONST $COLOR_ACTIVECAPTION = 2 GLOBAL CONST $COLOR_INACTIVECAPTION = 3 GLOBAL CONST $COLOR_MENU = 4 GLOBAL CONST $COLOR_WINDOW = 5 GLOBAL CONST $COLOR_WINDOWFRAME = 6 GLOBAL CONST $COLOR_MENUTEXT = 7 GLOBAL CONST $COLOR_WINDOWTEXT = 8 GLOBAL CONST $COLOR_CAPTIONTEXT = 9 GLOBAL CONST $COLOR_ACTIVEBORDER = 10 GLOBAL CONST $COLOR_INACTIVEBORDER = 11 GLOBAL CONST $COLOR_APPWORKSPACE = 12 GLOBAL CONST $COLOR_HIGHLIGHT = 13 GLOBAL CONST $COLOR_HIGHLIGHTTEXT = 14 GLOBAL CONST $COLOR_BTNFACE = 15 GLOBAL CONST $COLOR_BTNSHADOW = 16 GLOBAL CONST $COLOR_GRAYTEXT = 17 GLOBAL CONST $COLOR_BTNTEXT = 18 GLOBAL CONST $COLOR_INACTIVECAPTIONTEXT = 19 GLOBAL CONST $COLOR_BTNHIGHLIGHT = 20 GLOBAL CONST $COLOR_3DDKSHADOW = 21 GLOBAL CONST $COLOR_3DLIGHT = 22 GLOBAL CONST $COLOR_INFOTEXT = 23 GLOBAL CONST $COLOR_INFOBK = 24 GLOBAL CONST $COLOR_HOTLIGHT = 26 GLOBAL CONST $COLOR_GRADIENTACTIVECAPTION = 27 GLOBAL CONST $COLOR_GRADIENTINACTIVECAPTION = 28 GLOBAL CONST $COLOR_MENUHILIGHT = 29 GLOBAL CONST $COLOR_MENUBAR = 30 GLOBAL CONST $COLOR_DESKTOP = 1 GLOBAL CONST $COLOR_3DFACE = 15 GLOBAL CONST $COLOR_3DSHADOW = 16 GLOBAL CONST $COLOR_3DHIGHLIGHT = 20 GLOBAL CONST $COLOR_3DHILIGHT = 20 GLOBAL CONST $COLOR_BTNHILIGHT = 20 GLOBAL CONST $HINST_COMMCTRL = + 4294967295 GLOBAL CONST $IDB_STD_SMALL_COLOR = 0 GLOBAL CONST $IDB_STD_LARGE_COLOR = 1 GLOBAL CONST $IDB_VIEW_SMALL_COLOR = 4 GLOBAL CONST $IDB_VIEW_LARGE_COLOR = 5 GLOBAL CONST $IDB_HIST_SMALL_COLOR = 8 GLOBAL CONST $IDB_HIST_LARGE_COLOR = 9 GLOBAL CONST $STARTF_FORCEOFFFEEDBACK = 128 GLOBAL CONST $STARTF_FORCEONFEEDBACK = 64 GLOBAL CONST $STARTF_PREVENTPINNING = 8192 GLOBAL CONST $STARTF_RUNFULLSCREEN = 32 GLOBAL CONST $STARTF_TITLEISAPPID = 4096 GLOBAL CONST $STARTF_TITLEISLINKNAME = 2048 GLOBAL CONST $STARTF_USECOUNTCHARS = 8 GLOBAL CONST $STARTF_USEFILLATTRIBUTE = 16 GLOBAL CONST $STARTF_USEHOTKEY = 512 GLOBAL CONST $STARTF_USEPOSITION = 4 GLOBAL CONST $STARTF_USESHOWWINDOW = 1 GLOBAL CONST $STARTF_USESIZE = 2 GLOBAL CONST $STARTF_USESTDHANDLES = 256 GLOBAL CONST $CDDS_PREPAINT = 1 GLOBAL CONST $CDDS_POSTPAINT = 2 GLOBAL CONST $CDDS_PREERASE = 3 GLOBAL CONST $CDDS_POSTERASE = 4 GLOBAL CONST $CDDS_ITEM = 65536 GLOBAL CONST $CDDS_ITEMPREPAINT = 65537 GLOBAL CONST $CDDS_ITEMPOSTPAINT = 65538 GLOBAL CONST $CDDS_ITEMPREERASE = 65539 GLOBAL CONST $CDDS_ITEMPOSTERASE = 65540 GLOBAL CONST $CDDS_SUBITEM = 131072 GLOBAL CONST $CDIS_SELECTED = 1 GLOBAL CONST $CDIS_GRAYED = 2 GLOBAL CONST $CDIS_DISABLED = 4 GLOBAL CONST $CDIS_CHECKED = 8 GLOBAL CONST $CDIS_FOCUS = 16 GLOBAL CONST $CDIS_DEFAULT = 32 GLOBAL CONST $CDIS_HOT = 64 GLOBAL CONST $CDIS_MARKED = 128 GLOBAL CONST $CDIS_INDETERMINATE = 256 GLOBAL CONST $CDIS_SHOWKEYBOARDCUES = 512 GLOBAL CONST $CDIS_NEARHOT = 1024 GLOBAL CONST $CDIS_OTHERSIDEHOT = 2048 GLOBAL CONST $CDIS_DROPHILITED = 4096 GLOBAL CONST $CDRF_DODEFAULT = 0 GLOBAL CONST $CDRF_NEWFONT = 2 GLOBAL CONST $CDRF_SKIPDEFAULT = 4 GLOBAL CONST $CDRF_NOTIFYPOSTPAINT = 16 GLOBAL CONST $CDRF_NOTIFYITEMDRAW = 32 GLOBAL CONST $CDRF_NOTIFYSUBITEMDRAW = 32 GLOBAL CONST $CDRF_NOTIFYPOSTERASE = 64 GLOBAL CONST $CDRF_DOERASE = 8 GLOBAL CONST $CDRF_SKIPPOSTPAINT = 256 GLOBAL CONST $GUI_SS_DEFAULT_GUI = BITOR ($WS_MINIMIZEBOX , $WS_CAPTION , $WS_POPUP , $WS_SYSMENU ) #Region Global Variables and Constants GLOBAL CONST $_ARRAYCONSTANT_SORTINFOSIZE = 11 GLOBAL $__G_AARRAYDISPLAY_SORTINFO [$_ARRAYCONSTANT_SORTINFOSIZE ] GLOBAL CONST $ARRAYDISPLAY_COLALIGNLEFT = 0 GLOBAL CONST $ARRAYDISPLAY_TRANSPOSE = 1 GLOBAL CONST $ARRAYDISPLAY_COLALIGNRIGHT = 2 GLOBAL CONST $ARRAYDISPLAY_COLALIGNCENTER = 4 GLOBAL CONST $ARRAYDISPLAY_VERBOSE = 8 GLOBAL CONST $ARRAYDISPLAY_NOROW = 64 GLOBAL CONST $_ARRAYCONSTANT_TAGHDITEM = "uint Mask;int XY;ptr Text;handle hBMP;int TextMax;int Fmt;lparam Param;int Image;int Order;uint Type;ptr pFilter;uint State" GLOBAL CONST $_ARRAYCONSTANT_TAGLVITEM = "struct;uint Mask;int Item;int SubItem;uint State;uint StateMask;ptr Text;int TextMax;int Image;lparam Param;" & "int Indent;int GroupID;uint Columns;ptr pColumns;ptr piColFmt;int iGroup;endstruct" #EndRegion Global Variables and Constants #Region Functions list #EndRegion Functions list FUNC __ARRAYDISPLAY_SHARE (CONST BYREF $AARRAY , $STITLE = DEFAULT , $SARRAYRANGE = DEFAULT , $IFLAGS = DEFAULT , $VUSER_SEPARATOR = DEFAULT , $SHEADER = DEFAULT , $IMAX_COLWIDTH = DEFAULT , $HUSER_FUNCTION = DEFAULT , $BDEBUG = TRUE ) LOCAL $VTMP , $SMSGBOXTITLE = (($BDEBUG ) ("DebugArray" ) ("ArrayDisplay" ) ) IF $STITLE = DEFAULT THEN $STITLE = $SMSGBOXTITLE IF $SARRAYRANGE = DEFAULT THEN $SARRAYRANGE = "" IF $IFLAGS = DEFAULT THEN $IFLAGS = 0 IF $VUSER_SEPARATOR = DEFAULT THEN $VUSER_SEPARATOR = "" IF $SHEADER = DEFAULT THEN $SHEADER = "" IF $IMAX_COLWIDTH = DEFAULT THEN $IMAX_COLWIDTH = 350 IF $HUSER_FUNCTION = DEFAULT THEN $HUSER_FUNCTION = 0 LOCAL $ITRANSPOSE = BITAND ($IFLAGS , $ARRAYDISPLAY_TRANSPOSE ) LOCAL $ICOLALIGN = BITAND ($IFLAGS , 6 ) LOCAL $IVERBOSE = BITAND ($IFLAGS , $ARRAYDISPLAY_VERBOSE ) LOCAL $INOROW = BITAND ($IFLAGS , $ARRAYDISPLAY_NOROW ) LOCAL $IBUTTONBORDER = (($BDEBUG ) (40 ) (20 ) ) LOCAL $SMSG = "" , $IRET = 1 IF ISARRAY ($AARRAY ) THEN LOCAL $IDIMENSION = UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) , $IROWCOUNT = UBOUND ($AARRAY , $UBOUND_ROWS ) , $ICOLCOUNT = UBOUND ($AARRAY , $UBOUND_COLUMNS ) IF $IDIMENSION > 2 THEN $SMSG = "Larger than 2D array passed to function" $IRET = 2 ENDIF IF $IDIMENSION = 1 THEN $ITRANSPOSE = 0 ENDIF ELSE $SMSG = "No array variable passed to function" ENDIF IF $SMSG THEN IF $IVERBOSE AND MSGBOX ($MB_SYSTEMMODAL + $MB_ICONERROR + $MB_YESNO , $SMSGBOXTITLE & " Error: " & $STITLE , $SMSG & @CRLF & @CRLF & "Exit the script?" ) = $IDYES THEN EXIT ELSE RETURN SETERROR ($IRET , 0 , 0 ) ENDIF ENDIF LOCAL $ICW_COLWIDTH = NUMBER ($VUSER_SEPARATOR ) LOCAL $SCURR_SEPARATOR = OPT ("GUIDataSeparatorChar" ) IF $VUSER_SEPARATOR = "" THEN $VUSER_SEPARATOR = $SCURR_SEPARATOR LOCAL $IITEM_START = 0 , $IITEM_END = $IROWCOUNT + 4294967295 , $ISUBITEM_START = 0 , $ISUBITEM_END = (($IDIMENSION = 2 ) ($ICOLCOUNT + 4294967295 ) (0 ) ) LOCAL $BRANGE_FLAG = FALSE , $AVRANGESPLIT IF $SARRAYRANGE THEN LOCAL $AARRAY_RANGE = STRINGREGEXP ($SARRAYRANGE & "||" , "(?U)(.*)\|" , 3 ) IF $AARRAY_RANGE [0 ] THEN $AVRANGESPLIT = STRINGSPLIT ($AARRAY_RANGE [0 ] , ":" ) IF @ERROR THEN $IITEM_END = NUMBER ($AVRANGESPLIT [1 ] ) ELSE $IITEM_START = NUMBER ($AVRANGESPLIT [1 ] ) IF $AVRANGESPLIT [2 ] <> "" THEN $IITEM_END = NUMBER ($AVRANGESPLIT [2 ] ) ENDIF ENDIF ENDIF IF $IITEM_START < 0 THEN $IITEM_START = 0 IF $IITEM_END > $IROWCOUNT + 4294967295 THEN $IITEM_END = $IROWCOUNT + 4294967295 IF $IITEM_START > $IITEM_END THEN $VTMP = $IITEM_START $IITEM_START = $IITEM_END $IITEM_END = $VTMP ENDIF IF $IITEM_START <> 0 OR $IITEM_END <> $IROWCOUNT + 4294967295 THEN $BRANGE_FLAG = TRUE IF $IDIMENSION = 2 AND $AARRAY_RANGE [1 ] THEN $AVRANGESPLIT = STRINGSPLIT ($AARRAY_RANGE [1 ] , ":" ) IF @ERROR THEN $ISUBITEM_END = NUMBER ($AVRANGESPLIT [1 ] ) ELSE $ISUBITEM_START = NUMBER ($AVRANGESPLIT [1 ] ) IF $AVRANGESPLIT [2 ] <> "" THEN $ISUBITEM_END = NUMBER ($AVRANGESPLIT [2 ] ) ENDIF ENDIF IF $ISUBITEM_START > $ISUBITEM_END THEN $VTMP = $ISUBITEM_START $ISUBITEM_START = $ISUBITEM_END $ISUBITEM_END = $VTMP ENDIF IF $ISUBITEM_START < 0 THEN $ISUBITEM_START = 0 IF $ISUBITEM_END > $ICOLCOUNT + 4294967295 THEN $ISUBITEM_END = $ICOLCOUNT + 4294967295 IF $ISUBITEM_START <> 0 OR $ISUBITEM_END <> $ICOLCOUNT + 4294967295 THEN $BRANGE_FLAG = TRUE ENDIF ENDIF LOCAL $SDISPLAYDATA = "[" & $IROWCOUNT & "]" IF $IDIMENSION = 2 THEN $SDISPLAYDATA &= " [" & $ICOLCOUNT & "]" ENDIF LOCAL $STIPDATA = "" IF $BRANGE_FLAG THEN IF $STIPDATA THEN $STIPDATA &= " - " $STIPDATA &= "Range set" ENDIF IF $ITRANSPOSE THEN IF $STIPDATA THEN $STIPDATA &= " - " $STIPDATA &= "Transposed" ENDIF LOCAL $ASHEADER = STRINGSPLIT ($SHEADER , $SCURR_SEPARATOR , $STR_NOCOUNT ) IF UBOUND ($ASHEADER ) = 0 THEN LOCAL $ASHEADER [1 ] = ["" ] $SHEADER = "Row" LOCAL $IINDEX = $ISUBITEM_START IF $ITRANSPOSE THEN $SHEADER = "Col" FOR $J = $IITEM_START TO $IITEM_END $SHEADER &= $SCURR_SEPARATOR & "Row " & $J NEXT ELSE IF $ASHEADER [0 ] THEN FOR $IINDEX = $ISUBITEM_START TO $ISUBITEM_END IF $IINDEX >= UBOUND ($ASHEADER ) THEN EXITLOOP $SHEADER &= $SCURR_SEPARATOR & $ASHEADER [$IINDEX ] NEXT ENDIF FOR $J = $IINDEX TO $ISUBITEM_END $SHEADER &= $SCURR_SEPARATOR & "Col " & $J NEXT ENDIF IF $INOROW THEN $SHEADER = STRINGTRIMLEFT ($SHEADER , 4 ) IF $IVERBOSE AND ($IITEM_END - $IITEM_START + 1 ) * ($ISUBITEM_END - $ISUBITEM_START + 1 ) > 10000 THEN SPLASHTEXTON ($SMSGBOXTITLE , "Preparing display" & @CRLF & @CRLF & "Please be patient" , 300 , 100 ) ENDIF LOCAL CONST $_ARRAYCONSTANT_GUI_DOCKBOTTOM = 64 LOCAL CONST $_ARRAYCONSTANT_GUI_DOCKBORDERS = 102 LOCAL CONST $_ARRAYCONSTANT_GUI_DOCKHEIGHT = 512 LOCAL CONST $_ARRAYCONSTANT_GUI_DOCKLEFT = 2 LOCAL CONST $_ARRAYCONSTANT_GUI_DOCKRIGHT = 4 LOCAL CONST $_ARRAYCONSTANT_GUI_DOCKHCENTER = 8 LOCAL CONST $_ARRAYCONSTANT_GUI_EVENT_CLOSE = + 4294967293 LOCAL CONST $_ARRAYCONSTANT_GUI_FOCUS = 256 LOCAL CONST $_ARRAYCONSTANT_SS_CENTER = 1 LOCAL CONST $_ARRAYCONSTANT_SS_CENTERIMAGE = 512 LOCAL CONST $_ARRAYCONSTANT_LVM_GETITEMCOUNT = (4096 + 4 ) LOCAL CONST $_ARRAYCONSTANT_LVM_GETITEMRECT = (4096 + 14 ) LOCAL CONST $_ARRAYCONSTANT_LVM_GETCOLUMNWIDTH = (4096 + 29 ) LOCAL CONST $_ARRAYCONSTANT_LVM_SETCOLUMNWIDTH = (4096 + 30 ) LOCAL CONST $_ARRAYCONSTANT_LVM_GETITEMSTATE = (4096 + 44 ) LOCAL CONST $_ARRAYCONSTANT_LVM_GETSELECTEDCOUNT = (4096 + 50 ) LOCAL CONST $_ARRAYCONSTANT_LVM_SETEXTENDEDLISTVIEWSTYLE = (4096 + 54 ) LOCAL CONST $_ARRAYCONSTANT_LVS_EX_GRIDLINES = 1 LOCAL CONST $_ARRAYCONSTANT_LVIS_SELECTED = 2 LOCAL CONST $_ARRAYCONSTANT_LVS_SHOWSELALWAYS = 8 LOCAL CONST $_ARRAYCONSTANT_LVS_EX_FULLROWSELECT = 32 LOCAL CONST $_ARRAYCONSTANT_WS_EX_CLIENTEDGE = 512 LOCAL CONST $_ARRAYCONSTANT_WS_MAXIMIZEBOX = 65536 LOCAL CONST $_ARRAYCONSTANT_WS_MINIMIZEBOX = 131072 LOCAL CONST $_ARRAYCONSTANT_WS_SIZEBOX = 262144 LOCAL CONST $_ARRAYCONSTANT_WM_SETREDRAW = 11 LOCAL CONST $_ARRAYCONSTANT_LVSCW_AUTOSIZE = + 4294967295 LOCAL CONST $_ARRAYCONSTANT_LVSCW_AUTOSIZE_USEHEADER = + 4294967294 LOCAL $ICOORDMODE = OPT ("GUICoordMode" , 1 ) LOCAL $IORGWIDTH = 210 , $IHEIGHT = 200 , $IMINSIZE = 250 LOCAL $HGUI = GUICREATE ($STITLE , $IORGWIDTH , $IHEIGHT , DEFAULT , DEFAULT , BITOR ($_ARRAYCONSTANT_WS_SIZEBOX , $_ARRAYCONSTANT_WS_MINIMIZEBOX , $_ARRAYCONSTANT_WS_MAXIMIZEBOX ) ) LOCAL $AIGUISIZE = WINGETCLIENTSIZE ($HGUI ) LOCAL $IBUTTONWIDTH_1 = $AIGUISIZE [0 ] / 2 LOCAL $IBUTTONWIDTH_2 = $AIGUISIZE [0 ] / 3 LOCAL $IDLISTVIEW = GUICTRLCREATELISTVIEW ($SHEADER , 0 , 0 , $AIGUISIZE [0 ] , $AIGUISIZE [1 ] - $IBUTTONBORDER , $_ARRAYCONSTANT_LVS_SHOWSELALWAYS ) GUICTRLSENDMSG ($IDLISTVIEW , $_ARRAYCONSTANT_LVM_SETEXTENDEDLISTVIEWSTYLE , $_ARRAYCONSTANT_LVS_EX_GRIDLINES , $_ARRAYCONSTANT_LVS_EX_GRIDLINES ) GUICTRLSENDMSG ($IDLISTVIEW , $_ARRAYCONSTANT_LVM_SETEXTENDEDLISTVIEWSTYLE , $_ARRAYCONSTANT_LVS_EX_FULLROWSELECT , $_ARRAYCONSTANT_LVS_EX_FULLROWSELECT ) GUICTRLSENDMSG ($IDLISTVIEW , $_ARRAYCONSTANT_LVM_SETEXTENDEDLISTVIEWSTYLE , $_ARRAYCONSTANT_WS_EX_CLIENTEDGE , $_ARRAYCONSTANT_WS_EX_CLIENTEDGE ) LOCAL $IDCOPY_ID = 9999 , $IDCOPY_DATA = 99999 , $IDDATA_LABEL = 99999 , $IDUSER_FUNC = 99999 , $IDEXIT_SCRIPT = 99999 IF $BDEBUG THEN $IDCOPY_ID = GUICTRLCREATEBUTTON ("Copy Data && Hdr/Row" , 0 , $AIGUISIZE [1 ] - $IBUTTONBORDER , $IBUTTONWIDTH_1 , 20 ) $IDCOPY_DATA = GUICTRLCREATEBUTTON ("Copy Data Only" , $IBUTTONWIDTH_1 , $AIGUISIZE [1 ] - $IBUTTONBORDER , $IBUTTONWIDTH_1 , 20 ) LOCAL $IBUTTONWIDTH_VAR = $IBUTTONWIDTH_1 LOCAL $IOFFSET = $IBUTTONWIDTH_1 IF ISFUNC ($HUSER_FUNCTION ) THEN $IDUSER_FUNC = GUICTRLCREATEBUTTON ("Run User Func" , $IBUTTONWIDTH_2 , $AIGUISIZE [1 ] + 4294967276 , $IBUTTONWIDTH_2 , 20 ) $IBUTTONWIDTH_VAR = $IBUTTONWIDTH_2 $IOFFSET = $IBUTTONWIDTH_2 * 2 ENDIF $IDEXIT_SCRIPT = GUICTRLCREATEBUTTON ("Exit Script" , $IOFFSET , $AIGUISIZE [1 ] + 4294967276 , $IBUTTONWIDTH_VAR , 20 ) $IDDATA_LABEL = GUICTRLCREATELABEL ($SDISPLAYDATA , 0 , $AIGUISIZE [1 ] + 4294967276 , $IBUTTONWIDTH_VAR , 18 , BITOR ($_ARRAYCONSTANT_SS_CENTER , $_ARRAYCONSTANT_SS_CENTERIMAGE ) ) ELSE $IDDATA_LABEL = GUICTRLCREATELABEL ($SDISPLAYDATA , 0 , $AIGUISIZE [1 ] + 4294967276 , $AIGUISIZE [0 ] , 18 , BITOR ($_ARRAYCONSTANT_SS_CENTER , $_ARRAYCONSTANT_SS_CENTERIMAGE ) ) ENDIF SELECT CASE $ITRANSPOSE OR $BRANGE_FLAG GUICTRLSETCOLOR ($IDDATA_LABEL , 16711680 ) GUICTRLSETTIP ($IDDATA_LABEL , $STIPDATA ) ENDSELECT GUICTRLSETRESIZING ($IDLISTVIEW , $_ARRAYCONSTANT_GUI_DOCKBORDERS ) GUICTRLSETRESIZING ($IDCOPY_ID , $_ARRAYCONSTANT_GUI_DOCKLEFT + $_ARRAYCONSTANT_GUI_DOCKBOTTOM + $_ARRAYCONSTANT_GUI_DOCKHEIGHT ) GUICTRLSETRESIZING ($IDCOPY_DATA , $_ARRAYCONSTANT_GUI_DOCKRIGHT + $_ARRAYCONSTANT_GUI_DOCKBOTTOM + $_ARRAYCONSTANT_GUI_DOCKHEIGHT ) GUICTRLSETRESIZING ($IDDATA_LABEL , $_ARRAYCONSTANT_GUI_DOCKLEFT + $_ARRAYCONSTANT_GUI_DOCKBOTTOM + $_ARRAYCONSTANT_GUI_DOCKHEIGHT ) GUICTRLSETRESIZING ($IDUSER_FUNC , $_ARRAYCONSTANT_GUI_DOCKHCENTER + $_ARRAYCONSTANT_GUI_DOCKBOTTOM + $_ARRAYCONSTANT_GUI_DOCKHEIGHT ) GUICTRLSETRESIZING ($IDEXIT_SCRIPT , $_ARRAYCONSTANT_GUI_DOCKRIGHT + $_ARRAYCONSTANT_GUI_DOCKBOTTOM + $_ARRAYCONSTANT_GUI_DOCKHEIGHT ) GUICTRLSENDMSG ($IDLISTVIEW , $_ARRAYCONSTANT_WM_SETREDRAW , 0 , 0 ) LOCAL $IROWINDEX , $ICOLFILL IF $ITRANSPOSE THEN FOR $I = $ISUBITEM_START TO $ISUBITEM_END $IROWINDEX = __ARRAYDISPLAY_ADDITEM ($IDLISTVIEW , "NULL" ) IF $INOROW THEN $ICOLFILL = 0 ELSE __ARRAYDISPLAY_ADDSUBITEM ($IDLISTVIEW , $IROWINDEX , "Col " & $I , 0 ) $ICOLFILL = 1 ENDIF FOR $J = $IITEM_START TO $IITEM_END IF $IDIMENSION = 2 THEN $VTMP = $AARRAY [$J ] [$I ] ELSE $VTMP = $AARRAY [$J ] ENDIF SWITCH VARGETTYPE ($VTMP ) CASE "Array" __ARRAYDISPLAY_ADDSUBITEM ($IDLISTVIEW , $IROWINDEX , "{Array}" , $ICOLFILL ) CASE ELSE __ARRAYDISPLAY_ADDSUBITEM ($IDLISTVIEW , $IROWINDEX , $VTMP , $ICOLFILL ) ENDSWITCH $ICOLFILL += 1 NEXT NEXT ELSE FOR $I = $IITEM_START TO $IITEM_END $IROWINDEX = __ARRAYDISPLAY_ADDITEM ($IDLISTVIEW , "NULL" ) IF $INOROW THEN $ICOLFILL = 0 ELSE __ARRAYDISPLAY_ADDSUBITEM ($IDLISTVIEW , $IROWINDEX , "Row " & $I , 0 ) $ICOLFILL = 1 ENDIF FOR $J = $ISUBITEM_START TO $ISUBITEM_END IF $IDIMENSION = 2 THEN $VTMP = $AARRAY [$I ] [$J ] ELSE $VTMP = $AARRAY [$I ] ENDIF SWITCH VARGETTYPE ($VTMP ) CASE "Array" __ARRAYDISPLAY_ADDSUBITEM ($IDLISTVIEW , $IROWINDEX , "{Array}" , $ICOLFILL ) CASE ELSE __ARRAYDISPLAY_ADDSUBITEM ($IDLISTVIEW , $IROWINDEX , $VTMP , $ICOLFILL ) ENDSWITCH $ICOLFILL += 1 NEXT NEXT ENDIF IF $ICOLALIGN THEN FOR $I = 0 TO $ICOLFILL + 4294967295 __ARRAYDISPLAY_JUSTIFYCOLUMN ($IDLISTVIEW , $I , $ICOLALIGN / 2 ) NEXT ENDIF GUICTRLSENDMSG ($IDLISTVIEW , $_ARRAYCONSTANT_WM_SETREDRAW , 1 , 0 ) LOCAL $IBORDER = (($IROWINDEX > 19 ) (65 ) (45 ) ) LOCAL $IWIDTH = $IBORDER , $ICOLWIDTH = 0 , $AICOLWIDTH [$ICOLFILL ] , $IMIN_COLWIDTH = 55 FOR $I = 0 TO UBOUND ($AICOLWIDTH ) + 4294967295 GUICTRLSENDMSG ($IDLISTVIEW , $_ARRAYCONSTANT_LVM_SETCOLUMNWIDTH , $I , $_ARRAYCONSTANT_LVSCW_AUTOSIZE ) $ICOLWIDTH = GUICTRLSENDMSG ($IDLISTVIEW , $_ARRAYCONSTANT_LVM_GETCOLUMNWIDTH , $I , 0 ) IF $SHEADER <> "" THEN GUICTRLSENDMSG ($IDLISTVIEW , $_ARRAYCONSTANT_LVM_SETCOLUMNWIDTH , $I , $_ARRAYCONSTANT_LVSCW_AUTOSIZE_USEHEADER ) LOCAL $ICOLWIDTHHEADER = GUICTRLSENDMSG ($IDLISTVIEW , $_ARRAYCONSTANT_LVM_GETCOLUMNWIDTH , $I , 0 ) IF $ICOLWIDTH < $IMIN_COLWIDTH AND $ICOLWIDTHHEADER < $IMIN_COLWIDTH THEN GUICTRLSENDMSG ($IDLISTVIEW , $_ARRAYCONSTANT_LVM_SETCOLUMNWIDTH , $I , $IMIN_COLWIDTH ) $ICOLWIDTH = $IMIN_COLWIDTH ELSEIF $ICOLWIDTHHEADER < $ICOLWIDTH THEN GUICTRLSENDMSG ($IDLISTVIEW , $_ARRAYCONSTANT_LVM_SETCOLUMNWIDTH , $I , $ICOLWIDTH ) ELSE $ICOLWIDTH = $ICOLWIDTHHEADER ENDIF ELSE IF $ICOLWIDTH < $IMIN_COLWIDTH THEN GUICTRLSENDMSG ($IDLISTVIEW , $_ARRAYCONSTANT_LVM_SETCOLUMNWIDTH , $I , $IMIN_COLWIDTH ) $ICOLWIDTH = $IMIN_COLWIDTH ENDIF ENDIF $IWIDTH += $ICOLWIDTH $AICOLWIDTH [$I ] = $ICOLWIDTH NEXT IF $IWIDTH > @DESKTOPWIDTH + 4294967196 THEN $IWIDTH = $IBORDER FOR $I = 0 TO UBOUND ($AICOLWIDTH ) + 4294967295 IF $AICOLWIDTH [$I ] > $IMAX_COLWIDTH THEN GUICTRLSENDMSG ($IDLISTVIEW , $_ARRAYCONSTANT_LVM_SETCOLUMNWIDTH , $I , $IMAX_COLWIDTH ) $IWIDTH += $IMAX_COLWIDTH ELSE $IWIDTH += $AICOLWIDTH [$I ] ENDIF NEXT ENDIF IF $IWIDTH > @DESKTOPWIDTH + 4294967196 THEN $IWIDTH = @DESKTOPWIDTH + 4294967196 ELSEIF $IWIDTH < $IMINSIZE THEN $IWIDTH = $IMINSIZE ENDIF LOCAL $TRECT = DLLSTRUCTCREATE ("struct; long Left;long Top;long Right;long Bottom; endstruct" ) DLLCALL ("user32.dll" , "struct*" , "SendMessageW" , "hwnd" , GUICTRLGETHANDLE ($IDLISTVIEW ) , "uint" , $_ARRAYCONSTANT_LVM_GETITEMRECT , "wparam" , 0 , "struct*" , $TRECT ) LOCAL $AIWIN_POS = WINGETPOS ($HGUI ) LOCAL $AILV_POS = CONTROLGETPOS ($HGUI , "" , $IDLISTVIEW ) $IHEIGHT = (($IROWINDEX + 4 ) * (DLLSTRUCTGETDATA ($TRECT , "Bottom" ) - DLLSTRUCTGETDATA ($TRECT , "Top" ) ) ) + $AIWIN_POS [3 ] - $AILV_POS [3 ] IF $IHEIGHT > @DESKTOPHEIGHT + 4294967196 THEN $IHEIGHT = @DESKTOPHEIGHT + 4294967196 ELSEIF $IHEIGHT < $IMINSIZE THEN $IHEIGHT = $IMINSIZE ENDIF IF $IVERBOSE THEN SPLASHOFF () GUISETSTATE (@SW_HIDE , $HGUI ) WINMOVE ($HGUI , "" , (@DESKTOPWIDTH - $IWIDTH ) / 2 , (@DESKTOPHEIGHT - $IHEIGHT ) / 2 , $IWIDTH , $IHEIGHT ) GUISETSTATE (@SW_SHOW , $HGUI ) LOCAL $IONEVENTMODE = OPT ("GUIOnEventMode" , 0 ) , $IMSG __ARRAYDISPLAY_REGISTERSORTCALLBACK ($IDLISTVIEW , 2 , TRUE , "__ArrayDisplay_SortCallBack" ) WHILE 1 $IMSG = GUIGETMSG () SWITCH $IMSG CASE $_ARRAYCONSTANT_GUI_EVENT_CLOSE EXITLOOP CASE $IDCOPY_ID , $IDCOPY_DATA LOCAL $ISEL_COUNT = GUICTRLSENDMSG ($IDLISTVIEW , $_ARRAYCONSTANT_LVM_GETSELECTEDCOUNT , 0 , 0 ) IF $IVERBOSE AND (NOT $ISEL_COUNT ) AND ($IITEM_END - $IITEM_START ) * ($ISUBITEM_END - $ISUBITEM_START ) > 10000 THEN SPLASHTEXTON ($SMSGBOXTITLE , "Copying data" & @CRLF & @CRLF & "Please be patient" , 300 , 100 ) ENDIF LOCAL $SCLIP = "" , $SITEM , $ASPLIT FOR $I = 0 TO GUICTRLSENDMSG ($IDLISTVIEW , $_ARRAYCONSTANT_LVM_GETITEMCOUNT , 0 , 0 ) + 4294967295 IF $ISEL_COUNT AND NOT (GUICTRLSENDMSG ($IDLISTVIEW , $_ARRAYCONSTANT_LVM_GETITEMSTATE , $I , $_ARRAYCONSTANT_LVIS_SELECTED ) <> 0 ) THEN CONTINUELOOP ENDIF $SITEM = __ARRAYDISPLAY_GETITEMTEXTSTRING ($IDLISTVIEW , $I ) IF $IMSG = $IDCOPY_ID AND $INOROW THEN $SITEM = "Row " & ($I + (($ITRANSPOSE ) ($ISUBITEM_START ) ($IITEM_START ) ) ) & $SCURR_SEPARATOR & $SITEM ENDIF IF $IMSG = $IDCOPY_DATA AND NOT $INOROW THEN $SITEM = STRINGREGEXPREPLACE ($SITEM , "^Row\s\d+\|(.*)$" , "$1" ) ENDIF IF $ICW_COLWIDTH THEN $ASPLIT = STRINGSPLIT ($SITEM , $SCURR_SEPARATOR ) $SITEM = "" FOR $J = 1 TO $ASPLIT [0 ] $SITEM &= STRINGFORMAT ("%-" & $ICW_COLWIDTH + 1 & "s" , STRINGLEFT ($ASPLIT [$J ] , $ICW_COLWIDTH ) ) NEXT ELSE $SITEM = STRINGREPLACE ($SITEM , $SCURR_SEPARATOR , $VUSER_SEPARATOR ) ENDIF $SCLIP &= $SITEM & @CRLF NEXT $SITEM = $SHEADER IF $IMSG = $IDCOPY_ID THEN $SITEM = $SHEADER IF $INOROW THEN $SITEM = "Row|" & $SITEM ENDIF IF $ICW_COLWIDTH THEN $ASPLIT = STRINGSPLIT ($SITEM , $SCURR_SEPARATOR ) $SITEM = "" FOR $J = 1 TO $ASPLIT [0 ] $SITEM &= STRINGFORMAT ("%-" & $ICW_COLWIDTH + 1 & "s" , STRINGLEFT ($ASPLIT [$J ] , $ICW_COLWIDTH ) ) NEXT ELSE $SITEM = STRINGREPLACE ($SITEM , $SCURR_SEPARATOR , $VUSER_SEPARATOR ) ENDIF $SCLIP = $SITEM & @CRLF & $SCLIP ENDIF CLIPPUT ($SCLIP ) SPLASHOFF () GUICTRLSETSTATE ($IDLISTVIEW , $_ARRAYCONSTANT_GUI_FOCUS ) CASE $IDLISTVIEW __ARRAYDISPLAY_SORTITEMS ($IDLISTVIEW , GUICTRLGETSTATE ($IDLISTVIEW ) ) CASE $IDUSER_FUNC LOCAL $AISELITEMS [1 ] = [0 ] FOR $I = 0 TO GUICTRLSENDMSG ($IDLISTVIEW , $_ARRAYCONSTANT_LVM_GETITEMCOUNT , 0 , 0 ) + 4294967295 IF (GUICTRLSENDMSG ($IDLISTVIEW , $_ARRAYCONSTANT_LVM_GETITEMSTATE , $I , $_ARRAYCONSTANT_LVIS_SELECTED ) <> 0 ) THEN $AISELITEMS [0 ] += 1 REDIM $AISELITEMS [$AISELITEMS [0 ] + 1 ] $AISELITEMS [$AISELITEMS [0 ] ] = $I + $IITEM_START ENDIF NEXT $HUSER_FUNCTION ($AARRAY , $AISELITEMS ) GUICTRLSETSTATE ($IDLISTVIEW , $_ARRAYCONSTANT_GUI_FOCUS ) CASE $IDEXIT_SCRIPT GUIDELETE ($HGUI ) EXIT ENDSWITCH WEND GUIDELETE ($HGUI ) OPT ("GUICoordMode" , $ICOORDMODE ) OPT ("GUIOnEventMode" , $IONEVENTMODE ) RETURN 1 ENDFUNC FUNC __ARRAYDISPLAY_REGISTERSORTCALLBACK ($HWND , $VCOMPARETYPE = 2 , $BARROWS = TRUE , $SSORT_CALLBACK = "__ArrayDisplay_SortCallBack" ) #Au3Stripper_Ignore_Funcs=$sSort_Callback IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $HHEADER = HWND (GUICTRLSENDMSG ($HWND , 4127 , 0 , 0 ) ) $__G_AARRAYDISPLAY_SORTINFO [1 ] = $HWND $__G_AARRAYDISPLAY_SORTINFO [2 ] = DLLCALLBACKREGISTER ($SSORT_CALLBACK , "int" , "int;int;hwnd" ) $__G_AARRAYDISPLAY_SORTINFO [3 ] = + 4294967295 $__G_AARRAYDISPLAY_SORTINFO [4 ] = + 4294967295 $__G_AARRAYDISPLAY_SORTINFO [5 ] = 1 $__G_AARRAYDISPLAY_SORTINFO [6 ] = + 4294967295 $__G_AARRAYDISPLAY_SORTINFO [7 ] = 0 $__G_AARRAYDISPLAY_SORTINFO [8 ] = $VCOMPARETYPE $__G_AARRAYDISPLAY_SORTINFO [9 ] = $BARROWS $__G_AARRAYDISPLAY_SORTINFO [10 ] = $HHEADER RETURN $__G_AARRAYDISPLAY_SORTINFO [2 ] <> 0 ENDFUNC #Au3Stripper_Ignore_Funcs=__ArrayDisplay_SortCallBack FUNC __ARRAYDISPLAY_SORTCALLBACK ($NITEM1 , $NITEM2 , $HWND ) IF $__G_AARRAYDISPLAY_SORTINFO [3 ] = $__G_AARRAYDISPLAY_SORTINFO [4 ] THEN IF NOT $__G_AARRAYDISPLAY_SORTINFO [7 ] THEN $__G_AARRAYDISPLAY_SORTINFO [5 ] *= + 4294967295 $__G_AARRAYDISPLAY_SORTINFO [7 ] = 1 ENDIF ELSE $__G_AARRAYDISPLAY_SORTINFO [7 ] = 1 ENDIF $__G_AARRAYDISPLAY_SORTINFO [6 ] = $__G_AARRAYDISPLAY_SORTINFO [3 ] LOCAL $SVAL1 = __ARRAYDISPLAY_GETITEMTEXT ($HWND , $NITEM1 , $__G_AARRAYDISPLAY_SORTINFO [3 ] ) LOCAL $SVAL2 = __ARRAYDISPLAY_GETITEMTEXT ($HWND , $NITEM2 , $__G_AARRAYDISPLAY_SORTINFO [3 ] ) IF $__G_AARRAYDISPLAY_SORTINFO [8 ] = 1 THEN IF (STRINGISFLOAT ($SVAL1 ) OR STRINGISINT ($SVAL1 ) ) THEN $SVAL1 = NUMBER ($SVAL1 ) IF (STRINGISFLOAT ($SVAL2 ) OR STRINGISINT ($SVAL2 ) ) THEN $SVAL2 = NUMBER ($SVAL2 ) ENDIF LOCAL $NRESULT IF $__G_AARRAYDISPLAY_SORTINFO [8 ] < 2 THEN $NRESULT = 0 IF $SVAL1 < $SVAL2 THEN $NRESULT = + 4294967295 ELSEIF $SVAL1 > $SVAL2 THEN $NRESULT = 1 ENDIF ELSE $NRESULT = DLLCALL ("shlwapi.dll" , "int" , "StrCmpLogicalW" , "wstr" , $SVAL1 , "wstr" , $SVAL2 ) [0 ] ENDIF $NRESULT = $NRESULT * $__G_AARRAYDISPLAY_SORTINFO [5 ] RETURN $NRESULT ENDFUNC FUNC __ARRAYDISPLAY_SORTITEMS ($HWND , $ICOL ) IF NOT ISHWND ($HWND ) THEN $HWND = GUICTRLGETHANDLE ($HWND ) LOCAL $PFUNCTION = DLLCALLBACKGETPTR ($__G_AARRAYDISPLAY_SORTINFO [2 ] ) $__G_AARRAYDISPLAY_SORTINFO [3 ] = $ICOL $__G_AARRAYDISPLAY_SORTINFO [7 ] = 0 $__G_AARRAYDISPLAY_SORTINFO [4 ] = $__G_AARRAYDISPLAY_SORTINFO [6 ] LOCAL $ARESULT = DLLCALL ("user32.dll" , "lresult" , "SendMessageW" , "hwnd" , $HWND , "uint" , 4177 , "hwnd" , $HWND , "ptr" , $PFUNCTION ) IF $ARESULT [0 ] <> 0 THEN IF $__G_AARRAYDISPLAY_SORTINFO [9 ] THEN LOCAL $HHEADER = $__G_AARRAYDISPLAY_SORTINFO [10 ] , $IFORMAT FOR $X = 0 TO __ARRAYDISPLAY_GETITEMCOUNT ($HHEADER ) + 4294967295 $IFORMAT = __ARRAYDISPLAY_GETITEMFORMAT ($HHEADER , $X ) IF BITAND ($IFORMAT , 512 ) THEN __ARRAYDISPLAY_SETITEMFORMAT ($HHEADER , $X , BITXOR ($IFORMAT , 512 ) ) ELSEIF BITAND ($IFORMAT , 1024 ) THEN __ARRAYDISPLAY_SETITEMFORMAT ($HHEADER , $X , BITXOR ($IFORMAT , 1024 ) ) ENDIF NEXT $IFORMAT = __ARRAYDISPLAY_GETITEMFORMAT ($HHEADER , $ICOL ) IF $__G_AARRAYDISPLAY_SORTINFO [5 ] = 1 THEN __ARRAYDISPLAY_SETITEMFORMAT ($HHEADER , $ICOL , BITOR ($IFORMAT , 1024 ) ) ELSE __ARRAYDISPLAY_SETITEMFORMAT ($HHEADER , $ICOL , BITOR ($IFORMAT , 512 ) ) ENDIF ENDIF RETURN TRUE ENDIF RETURN FALSE ENDFUNC FUNC __ARRAYDISPLAY_ADDITEM ($HWND , $STEXT ) LOCAL $TITEM = DLLSTRUCTCREATE ($_ARRAYCONSTANT_TAGLVITEM ) DLLSTRUCTSETDATA ($TITEM , "Param" , 0 ) LOCAL $IBUFFER = STRINGLEN ($STEXT ) + 1 LOCAL $TBUFFER = DLLSTRUCTCREATE ("wchar Text[" & $IBUFFER & "]" ) $IBUFFER *= 2 DLLSTRUCTSETDATA ($TBUFFER , "Text" , $STEXT ) DLLSTRUCTSETDATA ($TITEM , "Text" , DLLSTRUCTGETPTR ($TBUFFER ) ) DLLSTRUCTSETDATA ($TITEM , "TextMax" , $IBUFFER ) LOCAL $IMASK = 5 DLLSTRUCTSETDATA ($TITEM , "Mask" , $IMASK ) DLLSTRUCTSETDATA ($TITEM , "Item" , 999999999 ) DLLSTRUCTSETDATA ($TITEM , "Image" , + 4294967295 ) LOCAL $PITEM = DLLSTRUCTGETPTR ($TITEM ) LOCAL $IRET = GUICTRLSENDMSG ($HWND , 4173 , 0 , $PITEM ) RETURN $IRET ENDFUNC FUNC __ARRAYDISPLAY_ADDSUBITEM ($HWND , $IINDEX , $STEXT , $ISUBITEM ) LOCAL $IBUFFER = STRINGLEN ($STEXT ) + 1 LOCAL $TBUFFER = DLLSTRUCTCREATE ("wchar Text[" & $IBUFFER & "]" ) $IBUFFER *= 2 LOCAL $PBUFFER = DLLSTRUCTGETPTR ($TBUFFER ) LOCAL $TITEM = DLLSTRUCTCREATE ($_ARRAYCONSTANT_TAGLVITEM ) LOCAL $IMASK = 1 DLLSTRUCTSETDATA ($TBUFFER , "Text" , $STEXT ) DLLSTRUCTSETDATA ($TITEM , "Mask" , $IMASK ) DLLSTRUCTSETDATA ($TITEM , "Item" , $IINDEX ) DLLSTRUCTSETDATA ($TITEM , "SubItem" , $ISUBITEM ) DLLSTRUCTSETDATA ($TITEM , "Image" , + 4294967295 ) LOCAL $PITEM = DLLSTRUCTGETPTR ($TITEM ) DLLSTRUCTSETDATA ($TITEM , "Text" , $PBUFFER ) LOCAL $IRET = GUICTRLSENDMSG ($HWND , 4172 , 0 , $PITEM ) RETURN $IRET <> 0 ENDFUNC FUNC __ARRAYDISPLAY_GETCOLUMNCOUNT ($HWND ) LOCAL $HHEADER = HWND (GUICTRLSENDMSG ($HWND , 4127 , 0 , 0 ) ) RETURN __ARRAYDISPLAY_GETITEMCOUNT ($HHEADER ) ENDFUNC FUNC __ARRAYDISPLAY_GETHEADER ($HWND ) RETURN HWND (GUICTRLSENDMSG ($HWND , 4127 , 0 , 0 ) ) ENDFUNC FUNC __ARRAYDISPLAY_GETITEM ($HWND , $IINDEX , BYREF $TITEM ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "lresult" , "SendMessageW" , "hwnd" , $HWND , "uint" , 4619 , "wparam" , $IINDEX , "struct*" , $TITEM ) RETURN $ARESULT [0 ] <> 0 ENDFUNC FUNC __ARRAYDISPLAY_GETITEMCOUNT ($HWND ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "lresult" , "SendMessageW" , "hwnd" , $HWND , "uint" , 4608 , "wparam" , 0 , "lparam" , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC __ARRAYDISPLAY_GETITEMFORMAT ($HWND , $IINDEX ) LOCAL $TITEM = DLLSTRUCTCREATE ($_ARRAYCONSTANT_TAGHDITEM ) DLLSTRUCTSETDATA ($TITEM , "Mask" , 4 ) __ARRAYDISPLAY_GETITEM ($HWND , $IINDEX , $TITEM ) RETURN DLLSTRUCTGETDATA ($TITEM , "Fmt" ) ENDFUNC FUNC __ARRAYDISPLAY_GETITEMTEXT ($HWND , $IINDEX , $ISUBITEM = 0 ) LOCAL $TBUFFER = DLLSTRUCTCREATE ("wchar Text[4096]" ) LOCAL $PBUFFER = DLLSTRUCTGETPTR ($TBUFFER ) LOCAL $TITEM = DLLSTRUCTCREATE ($_ARRAYCONSTANT_TAGLVITEM ) DLLSTRUCTSETDATA ($TITEM , "SubItem" , $ISUBITEM ) DLLSTRUCTSETDATA ($TITEM , "TextMax" , 4096 ) DLLSTRUCTSETDATA ($TITEM , "Text" , $PBUFFER ) IF ISHWND ($HWND ) THEN DLLCALL ("user32.dll" , "lresult" , "SendMessageW" , "hwnd" , $HWND , "uint" , 4211 , "wparam" , $IINDEX , "struct*" , $TITEM ) ELSE LOCAL $PITEM = DLLSTRUCTGETPTR ($TITEM ) GUICTRLSENDMSG ($HWND , 4211 , $IINDEX , $PITEM ) ENDIF RETURN DLLSTRUCTGETDATA ($TBUFFER , "Text" ) ENDFUNC FUNC __ARRAYDISPLAY_GETITEMTEXTSTRING ($HWND , $IITEM ) LOCAL $SROW = "" , $SSEPARATORCHAR = OPT ("GUIDataSeparatorChar" ) LOCAL $ISELECTED = $IITEM FOR $X = 0 TO __ARRAYDISPLAY_GETCOLUMNCOUNT ($HWND ) + 4294967295 $SROW &= __ARRAYDISPLAY_GETITEMTEXT ($HWND , $ISELECTED , $X ) & $SSEPARATORCHAR NEXT RETURN STRINGTRIMRIGHT ($SROW , 1 ) ENDFUNC FUNC __ARRAYDISPLAY_JUSTIFYCOLUMN ($IDLISTVIEW , $IINDEX , $IALIGN = + 4294967295 ) LOCAL $TCOLUMN = DLLSTRUCTCREATE ("uint Mask;int Fmt;int CX;ptr Text;int TextMax;int SubItem;int Image;int Order;int cxMin;int cxDefault;int cxIdeal" ) IF $IALIGN < 0 OR $IALIGN > 2 THEN $IALIGN = 0 DLLSTRUCTSETDATA ($TCOLUMN , "Mask" , 1 ) DLLSTRUCTSETDATA ($TCOLUMN , "Fmt" , $IALIGN ) LOCAL $PCOLUMN = DLLSTRUCTGETPTR ($TCOLUMN ) LOCAL $IRET = GUICTRLSENDMSG ($IDLISTVIEW , 4192 , $IINDEX , $PCOLUMN ) RETURN $IRET <> 0 ENDFUNC FUNC __ARRAYDISPLAY_SETITEMFORMAT ($HWND , $IINDEX , $IFORMAT ) LOCAL $TITEM = DLLSTRUCTCREATE ($_ARRAYCONSTANT_TAGHDITEM ) DLLSTRUCTSETDATA ($TITEM , "Mask" , 4 ) DLLSTRUCTSETDATA ($TITEM , "Fmt" , $IFORMAT ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "lresult" , "SendMessageW" , "hwnd" , $HWND , "uint" , 4620 , "wparam" , $IINDEX , "struct*" , $TITEM ) RETURN $ARESULT [0 ] <> 0 ENDFUNC GLOBAL ENUM $ARRAYFILL_FORCE_DEFAULT , $ARRAYFILL_FORCE_SINGLEITEM , $ARRAYFILL_FORCE_INT , $ARRAYFILL_FORCE_NUMBER , $ARRAYFILL_FORCE_PTR , $ARRAYFILL_FORCE_HWND , $ARRAYFILL_FORCE_STRING , $ARRAYFILL_FORCE_BOOLEAN GLOBAL ENUM $ARRAYUNIQUE_NOCOUNT , $ARRAYUNIQUE_COUNT GLOBAL ENUM $ARRAYUNIQUE_AUTO , $ARRAYUNIQUE_FORCE32 , $ARRAYUNIQUE_FORCE64 , $ARRAYUNIQUE_MATCH , $ARRAYUNIQUE_DISTINCT FUNC _ARRAYADD (BYREF $AARRAY , $VVALUE , $ISTART = 0 , $SDELIM_ITEM = "|" , $SDELIM_ROW = @CRLF , $IFORCE = $ARRAYFILL_FORCE_DEFAULT ) IF $ISTART = DEFAULT THEN $ISTART = 0 IF $SDELIM_ITEM = DEFAULT THEN $SDELIM_ITEM = "|" IF $SDELIM_ROW = DEFAULT THEN $SDELIM_ROW = @CRLF IF $IFORCE = DEFAULT THEN $IFORCE = $ARRAYFILL_FORCE_DEFAULT IF NOT ISARRAY ($AARRAY ) THEN RETURN SETERROR (1 , 0 , + 4294967295 ) LOCAL $IDIM_1 = UBOUND ($AARRAY , $UBOUND_ROWS ) LOCAL $HDATATYPE = 0 SWITCH $IFORCE CASE $ARRAYFILL_FORCE_INT $HDATATYPE = INT CASE $ARRAYFILL_FORCE_NUMBER $HDATATYPE = NUMBER CASE $ARRAYFILL_FORCE_PTR $HDATATYPE = PTR CASE $ARRAYFILL_FORCE_HWND $HDATATYPE = HWND CASE $ARRAYFILL_FORCE_STRING $HDATATYPE = STRING CASE $ARRAYFILL_FORCE_BOOLEAN $HDATATYPE = "Boolean" ENDSWITCH SWITCH UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) CASE 1 IF $IFORCE = $ARRAYFILL_FORCE_SINGLEITEM THEN REDIM $AARRAY [$IDIM_1 + 1 ] $AARRAY [$IDIM_1 ] = $VVALUE RETURN $IDIM_1 ENDIF IF ISARRAY ($VVALUE ) THEN IF UBOUND ($VVALUE , $UBOUND_DIMENSIONS ) <> 1 THEN RETURN SETERROR (5 , 0 , + 4294967295 ) $HDATATYPE = 0 ELSE LOCAL $ATMP = STRINGSPLIT ($VVALUE , $SDELIM_ITEM , $STR_NOCOUNT + $STR_ENTIRESPLIT ) IF UBOUND ($ATMP , $UBOUND_ROWS ) = 1 THEN $ATMP [0 ] = $VVALUE ENDIF $VVALUE = $ATMP ENDIF LOCAL $IADD = UBOUND ($VVALUE , $UBOUND_ROWS ) REDIM $AARRAY [$IDIM_1 + $IADD ] FOR $I = 0 TO $IADD + 4294967295 IF STRING ($HDATATYPE ) = "Boolean" THEN SWITCH $VVALUE [$I ] CASE "True" , "1" $AARRAY [$IDIM_1 + $I ] = TRUE CASE "False" , "0" , "" $AARRAY [$IDIM_1 + $I ] = FALSE ENDSWITCH ELSEIF ISFUNC ($HDATATYPE ) THEN $AARRAY [$IDIM_1 + $I ] = $HDATATYPE ($VVALUE [$I ] ) ELSE $AARRAY [$IDIM_1 + $I ] = $VVALUE [$I ] ENDIF NEXT RETURN $IDIM_1 + $IADD + 4294967295 CASE 2 LOCAL $IDIM_2 = UBOUND ($AARRAY , $UBOUND_COLUMNS ) IF $ISTART < 0 OR $ISTART > $IDIM_2 + 4294967295 THEN RETURN SETERROR (4 , 0 , + 4294967295 ) LOCAL $IVALDIM_1 , $IVALDIM_2 = 0 , $ICOLCOUNT IF ISARRAY ($VVALUE ) THEN IF UBOUND ($VVALUE , $UBOUND_DIMENSIONS ) <> 2 THEN RETURN SETERROR (5 , 0 , + 4294967295 ) $IVALDIM_1 = UBOUND ($VVALUE , $UBOUND_ROWS ) $IVALDIM_2 = UBOUND ($VVALUE , $UBOUND_COLUMNS ) $HDATATYPE = 0 ELSE LOCAL $ASPLIT_1 = STRINGSPLIT ($VVALUE , $SDELIM_ROW , $STR_NOCOUNT + $STR_ENTIRESPLIT ) $IVALDIM_1 = UBOUND ($ASPLIT_1 , $UBOUND_ROWS ) LOCAL $ATMP [$IVALDIM_1 ] [0 ] , $ASPLIT_2 FOR $I = 0 TO $IVALDIM_1 + 4294967295 $ASPLIT_2 = STRINGSPLIT ($ASPLIT_1 [$I ] , $SDELIM_ITEM , $STR_NOCOUNT + $STR_ENTIRESPLIT ) $ICOLCOUNT = UBOUND ($ASPLIT_2 ) IF $ICOLCOUNT > $IVALDIM_2 THEN $IVALDIM_2 = $ICOLCOUNT REDIM $ATMP [$IVALDIM_1 ] [$IVALDIM_2 ] ENDIF FOR $J = 0 TO $ICOLCOUNT + 4294967295 $ATMP [$I ] [$J ] = $ASPLIT_2 [$J ] NEXT NEXT $VVALUE = $ATMP ENDIF IF UBOUND ($VVALUE , $UBOUND_COLUMNS ) + $ISTART > UBOUND ($AARRAY , $UBOUND_COLUMNS ) THEN RETURN SETERROR (3 , 0 , + 4294967295 ) REDIM $AARRAY [$IDIM_1 + $IVALDIM_1 ] [$IDIM_2 ] FOR $IWRITETO_INDEX = 0 TO $IVALDIM_1 + 4294967295 FOR $J = 0 TO $IDIM_2 + 4294967295 IF $J < $ISTART THEN $AARRAY [$IWRITETO_INDEX + $IDIM_1 ] [$J ] = "" ELSEIF $J - $ISTART > $IVALDIM_2 + 4294967295 THEN $AARRAY [$IWRITETO_INDEX + $IDIM_1 ] [$J ] = "" ELSE IF STRING ($HDATATYPE ) = "Boolean" THEN SWITCH $VVALUE [$IWRITETO_INDEX ] [$J - $ISTART ] CASE "True" , "1" $AARRAY [$IWRITETO_INDEX + $IDIM_1 ] [$J ] = TRUE CASE "False" , "0" , "" $AARRAY [$IWRITETO_INDEX + $IDIM_1 ] [$J ] = FALSE ENDSWITCH ELSEIF ISFUNC ($HDATATYPE ) THEN $AARRAY [$IWRITETO_INDEX + $IDIM_1 ] [$J ] = $HDATATYPE ($VVALUE [$IWRITETO_INDEX ] [$J - $ISTART ] ) ELSE $AARRAY [$IWRITETO_INDEX + $IDIM_1 ] [$J ] = $VVALUE [$IWRITETO_INDEX ] [$J - $ISTART ] ENDIF ENDIF NEXT NEXT CASE ELSE RETURN SETERROR (2 , 0 , + 4294967295 ) ENDSWITCH RETURN UBOUND ($AARRAY , $UBOUND_ROWS ) + 4294967295 ENDFUNC FUNC _ARRAYBINARYSEARCH (CONST BYREF $AARRAY , $VVALUE , $ISTART = 0 , $IEND = 0 , $ICOLUMN = 0 ) IF $ISTART = DEFAULT THEN $ISTART = 0 IF $IEND = DEFAULT THEN $IEND = 0 IF $ICOLUMN = DEFAULT THEN $ICOLUMN = 0 IF NOT ISARRAY ($AARRAY ) THEN RETURN SETERROR (1 , 0 , + 4294967295 ) LOCAL $IDIM_1 = UBOUND ($AARRAY , $UBOUND_ROWS ) IF $IDIM_1 = 0 THEN RETURN SETERROR (6 , 0 , + 4294967295 ) IF $IEND < 1 OR $IEND > $IDIM_1 + 4294967295 THEN $IEND = $IDIM_1 + 4294967295 IF $ISTART < 0 THEN $ISTART = 0 IF $ISTART > $IEND THEN RETURN SETERROR (4 , 0 , + 4294967295 ) LOCAL $IMID = INT (($IEND + $ISTART ) / 2 ) SWITCH UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) CASE 1 IF $AARRAY [$ISTART ] > $VVALUE OR $AARRAY [$IEND ] < $VVALUE THEN RETURN SETERROR (2 , 0 , + 4294967295 ) WHILE $ISTART <= $IMID AND $VVALUE <> $AARRAY [$IMID ] IF $VVALUE < $AARRAY [$IMID ] THEN $IEND = $IMID + 4294967295 ELSE $ISTART = $IMID + 1 ENDIF $IMID = INT (($IEND + $ISTART ) / 2 ) WEND IF $ISTART > $IEND THEN RETURN SETERROR (3 , 0 , + 4294967295 ) CASE 2 LOCAL $IDIM_2 = UBOUND ($AARRAY , $UBOUND_COLUMNS ) + 4294967295 IF $ICOLUMN < 0 OR $ICOLUMN > $IDIM_2 THEN RETURN SETERROR (7 , 0 , + 4294967295 ) IF $AARRAY [$ISTART ] [$ICOLUMN ] > $VVALUE OR $AARRAY [$IEND ] [$ICOLUMN ] < $VVALUE THEN RETURN SETERROR (2 , 0 , + 4294967295 ) WHILE $ISTART <= $IMID AND $VVALUE <> $AARRAY [$IMID ] [$ICOLUMN ] IF $VVALUE < $AARRAY [$IMID ] [$ICOLUMN ] THEN $IEND = $IMID + 4294967295 ELSE $ISTART = $IMID + 1 ENDIF $IMID = INT (($IEND + $ISTART ) / 2 ) WEND IF $ISTART > $IEND THEN RETURN SETERROR (3 , 0 , + 4294967295 ) CASE ELSE RETURN SETERROR (5 , 0 , + 4294967295 ) ENDSWITCH RETURN $IMID ENDFUNC FUNC _ARRAYCOLDELETE (BYREF $AARRAY , $ICOLUMN , $BCONVERT = FALSE ) IF $BCONVERT = DEFAULT THEN $BCONVERT = FALSE IF NOT ISARRAY ($AARRAY ) THEN RETURN SETERROR (1 , 0 , + 4294967295 ) LOCAL $IDIM_1 = UBOUND ($AARRAY , $UBOUND_ROWS ) IF UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) <> 2 THEN RETURN SETERROR (2 , 0 , + 4294967295 ) LOCAL $IDIM_2 = UBOUND ($AARRAY , $UBOUND_COLUMNS ) SWITCH $IDIM_2 CASE 2 IF $ICOLUMN < 0 OR $ICOLUMN > 1 THEN RETURN SETERROR (3 , 0 , + 4294967295 ) IF $BCONVERT THEN LOCAL $ATEMPARRAY [$IDIM_1 ] FOR $I = 0 TO $IDIM_1 + 4294967295 $ATEMPARRAY [$I ] = $AARRAY [$I ] [(NOT $ICOLUMN ) ] NEXT $AARRAY = $ATEMPARRAY ELSE CONTINUECASE ENDIF CASE ELSE IF $ICOLUMN < 0 OR $ICOLUMN > $IDIM_2 + 4294967295 THEN RETURN SETERROR (3 , 0 , + 4294967295 ) FOR $I = 0 TO $IDIM_1 + 4294967295 FOR $J = $ICOLUMN TO $IDIM_2 + 4294967294 $AARRAY [$I ] [$J ] = $AARRAY [$I ] [$J + 1 ] NEXT NEXT REDIM $AARRAY [$IDIM_1 ] [$IDIM_2 + 4294967295 ] ENDSWITCH RETURN UBOUND ($AARRAY , $UBOUND_COLUMNS ) ENDFUNC FUNC _ARRAYCOLINSERT (BYREF $AARRAY , $ICOLUMN ) IF NOT ISARRAY ($AARRAY ) THEN RETURN SETERROR (1 , 0 , + 4294967295 ) LOCAL $IDIM_1 = UBOUND ($AARRAY , $UBOUND_ROWS ) SWITCH UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) CASE 1 LOCAL $ATEMPARRAY [$IDIM_1 ] [2 ] SWITCH $ICOLUMN CASE 0 , 1 FOR $I = 0 TO $IDIM_1 + 4294967295 $ATEMPARRAY [$I ] [(NOT $ICOLUMN ) ] = $AARRAY [$I ] NEXT CASE ELSE RETURN SETERROR (3 , 0 , + 4294967295 ) ENDSWITCH $AARRAY = $ATEMPARRAY CASE 2 LOCAL $IDIM_2 = UBOUND ($AARRAY , $UBOUND_COLUMNS ) IF $ICOLUMN < 0 OR $ICOLUMN > $IDIM_2 THEN RETURN SETERROR (3 , 0 , + 4294967295 ) REDIM $AARRAY [$IDIM_1 ] [$IDIM_2 + 1 ] FOR $I = 0 TO $IDIM_1 + 4294967295 FOR $J = $IDIM_2 TO $ICOLUMN + 1 STEP + 4294967295 $AARRAY [$I ] [$J ] = $AARRAY [$I ] [$J + 4294967295 ] NEXT $AARRAY [$I ] [$ICOLUMN ] = "" NEXT CASE ELSE RETURN SETERROR (2 , 0 , + 4294967295 ) ENDSWITCH RETURN UBOUND ($AARRAY , $UBOUND_COLUMNS ) ENDFUNC FUNC _ARRAYCOMBINATIONS (CONST BYREF $AARRAY , $ISET , $SDELIMITER = "" ) IF $SDELIMITER = DEFAULT THEN $SDELIMITER = "" IF NOT ISARRAY ($AARRAY ) THEN RETURN SETERROR (1 , 0 , 0 ) IF UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) <> 1 THEN RETURN SETERROR (2 , 0 , 0 ) LOCAL $IN = UBOUND ($AARRAY ) LOCAL $IR = $ISET LOCAL $AIDX [$IR ] FOR $I = 0 TO $IR + 4294967295 $AIDX [$I ] = $I NEXT LOCAL $ITOTAL = __ARRAY_COMBINATIONS ($IN , $IR ) LOCAL $ILEFT = $ITOTAL LOCAL $ARESULT [$ITOTAL + 1 ] $ARESULT [0 ] = $ITOTAL LOCAL $ICOUNT = 1 WHILE $ILEFT > 0 __ARRAY_GETNEXT ($IN , $IR , $ILEFT , $ITOTAL , $AIDX ) FOR $I = 0 TO $ISET + 4294967295 $ARESULT [$ICOUNT ] &= $AARRAY [$AIDX [$I ] ] & $SDELIMITER NEXT IF $SDELIMITER <> "" THEN $ARESULT [$ICOUNT ] = STRINGTRIMRIGHT ($ARESULT [$ICOUNT ] , 1 ) $ICOUNT += 1 WEND RETURN $ARESULT ENDFUNC FUNC _ARRAYCONCATENATE (BYREF $AARRAYTARGET , CONST BYREF $AARRAYSOURCE , $ISTART = 0 ) IF $ISTART = DEFAULT THEN $ISTART = 0 IF NOT ISARRAY ($AARRAYTARGET ) THEN RETURN SETERROR (1 , 0 , + 4294967295 ) IF NOT ISARRAY ($AARRAYSOURCE ) THEN RETURN SETERROR (2 , 0 , + 4294967295 ) LOCAL $IDIM_TOTAL_TGT = UBOUND ($AARRAYTARGET , $UBOUND_DIMENSIONS ) LOCAL $IDIM_TOTAL_SRC = UBOUND ($AARRAYSOURCE , $UBOUND_DIMENSIONS ) LOCAL $IDIM_1_TGT = UBOUND ($AARRAYTARGET , $UBOUND_ROWS ) LOCAL $IDIM_1_SRC = UBOUND ($AARRAYSOURCE , $UBOUND_ROWS ) IF $ISTART < 0 OR $ISTART > $IDIM_1_SRC + 4294967295 THEN RETURN SETERROR (6 , 0 , + 4294967295 ) SWITCH $IDIM_TOTAL_TGT CASE 1 IF $IDIM_TOTAL_SRC <> 1 THEN RETURN SETERROR (4 , 0 , + 4294967295 ) REDIM $AARRAYTARGET [$IDIM_1_TGT + $IDIM_1_SRC - $ISTART ] FOR $I = $ISTART TO $IDIM_1_SRC + 4294967295 $AARRAYTARGET [$IDIM_1_TGT + $I - $ISTART ] = $AARRAYSOURCE [$I ] NEXT CASE 2 IF $IDIM_TOTAL_SRC <> 2 THEN RETURN SETERROR (4 , 0 , + 4294967295 ) LOCAL $IDIM_2_TGT = UBOUND ($AARRAYTARGET , $UBOUND_COLUMNS ) IF UBOUND ($AARRAYSOURCE , $UBOUND_COLUMNS ) <> $IDIM_2_TGT THEN RETURN SETERROR (5 , 0 , + 4294967295 ) REDIM $AARRAYTARGET [$IDIM_1_TGT + $IDIM_1_SRC - $ISTART ] [$IDIM_2_TGT ] FOR $I = $ISTART TO $IDIM_1_SRC + 4294967295 FOR $J = 0 TO $IDIM_2_TGT + 4294967295 $AARRAYTARGET [$IDIM_1_TGT + $I - $ISTART ] [$J ] = $AARRAYSOURCE [$I ] [$J ] NEXT NEXT CASE ELSE RETURN SETERROR (3 , 0 , + 4294967295 ) ENDSWITCH RETURN UBOUND ($AARRAYTARGET , $UBOUND_ROWS ) ENDFUNC FUNC _ARRAYDELETE (BYREF $AARRAY , $VRANGE ) IF NOT ISARRAY ($AARRAY ) THEN RETURN SETERROR (1 , 0 , + 4294967295 ) LOCAL $IDIM_1 = UBOUND ($AARRAY , $UBOUND_ROWS ) + 4294967295 IF ISARRAY ($VRANGE ) THEN IF UBOUND ($VRANGE , $UBOUND_DIMENSIONS ) <> 1 OR UBOUND ($VRANGE , $UBOUND_ROWS ) < 2 THEN RETURN SETERROR (4 , 0 , + 4294967295 ) ELSE LOCAL $INUMBER , $ASPLIT_1 , $ASPLIT_2 $VRANGE = STRINGSTRIPWS ($VRANGE , 8 ) $ASPLIT_1 = STRINGSPLIT ($VRANGE , ";" ) $VRANGE = "" FOR $I = 1 TO $ASPLIT_1 [0 ] IF NOT STRINGREGEXP ($ASPLIT_1 [$I ] , "^\d+(-\d+)?$" ) THEN RETURN SETERROR (3 , 0 , + 4294967295 ) $ASPLIT_2 = STRINGSPLIT ($ASPLIT_1 [$I ] , "-" ) SWITCH $ASPLIT_2 [0 ] CASE 1 $VRANGE &= $ASPLIT_2 [1 ] & ";" CASE 2 IF NUMBER ($ASPLIT_2 [2 ] ) >= NUMBER ($ASPLIT_2 [1 ] ) THEN $INUMBER = $ASPLIT_2 [1 ] + 4294967295 DO $INUMBER += 1 $VRANGE &= $INUMBER & ";" UNTIL $INUMBER = $ASPLIT_2 [2 ] ENDIF ENDSWITCH NEXT $VRANGE = STRINGSPLIT (STRINGTRIMRIGHT ($VRANGE , 1 ) , ";" ) ENDIF IF $VRANGE [1 ] < 0 OR $VRANGE [$VRANGE [0 ] ] > $IDIM_1 THEN RETURN SETERROR (5 , 0 , + 4294967295 ) LOCAL $ICOPYTO_INDEX = 0 SWITCH UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) CASE 1 FOR $I = 1 TO $VRANGE [0 ] $AARRAY [$VRANGE [$I ] ] = CHRW (64177 ) NEXT FOR $IREADFROM_INDEX = 0 TO $IDIM_1 IF $AARRAY [$IREADFROM_INDEX ] == CHRW (64177 ) THEN CONTINUELOOP ELSE IF $IREADFROM_INDEX <> $ICOPYTO_INDEX THEN $AARRAY [$ICOPYTO_INDEX ] = $AARRAY [$IREADFROM_INDEX ] ENDIF $ICOPYTO_INDEX += 1 ENDIF NEXT REDIM $AARRAY [$IDIM_1 - $VRANGE [0 ] + 1 ] CASE 2 LOCAL $IDIM_2 = UBOUND ($AARRAY , $UBOUND_COLUMNS ) + 4294967295 FOR $I = 1 TO $VRANGE [0 ] $AARRAY [$VRANGE [$I ] ] [0 ] = CHRW (64177 ) NEXT FOR $IREADFROM_INDEX = 0 TO $IDIM_1 IF $AARRAY [$IREADFROM_INDEX ] [0 ] == CHRW (64177 ) THEN CONTINUELOOP ELSE IF $IREADFROM_INDEX <> $ICOPYTO_INDEX THEN FOR $J = 0 TO $IDIM_2 $AARRAY [$ICOPYTO_INDEX ] [$J ] = $AARRAY [$IREADFROM_INDEX ] [$J ] NEXT ENDIF $ICOPYTO_INDEX += 1 ENDIF NEXT REDIM $AARRAY [$IDIM_1 - $VRANGE [0 ] + 1 ] [$IDIM_2 + 1 ] CASE ELSE RETURN SETERROR (2 , 0 , FALSE ) ENDSWITCH RETURN UBOUND ($AARRAY , $UBOUND_ROWS ) ENDFUNC FUNC _ARRAYDISPLAY (CONST BYREF $AARRAY , $STITLE = DEFAULT , $SARRAYRANGE = DEFAULT , $IFLAGS = DEFAULT , $VUSER_SEPARATOR = DEFAULT , $SHEADER = DEFAULT , $IMAX_COLWIDTH = DEFAULT ) #forceref $vUser_Separator LOCAL $IRET = __ARRAYDISPLAY_SHARE ($AARRAY , $STITLE , $SARRAYRANGE , $IFLAGS , DEFAULT , $SHEADER , $IMAX_COLWIDTH , 0 , FALSE ) RETURN SETERROR (@ERROR , @EXTENDED , $IRET ) ENDFUNC FUNC _ARRAYEXTRACT (CONST BYREF $AARRAY , $ISTART_ROW = + 4294967295 , $IEND_ROW = + 4294967295 , $ISTART_COL = + 4294967295 , $IEND_COL = + 4294967295 ) IF $ISTART_ROW = DEFAULT THEN $ISTART_ROW = + 4294967295 IF $IEND_ROW = DEFAULT THEN $IEND_ROW = + 4294967295 IF $ISTART_COL = DEFAULT THEN $ISTART_COL = + 4294967295 IF $IEND_COL = DEFAULT THEN $IEND_COL = + 4294967295 IF NOT ISARRAY ($AARRAY ) THEN RETURN SETERROR (1 , 0 , + 4294967295 ) LOCAL $IDIM_1 = UBOUND ($AARRAY , $UBOUND_ROWS ) + 4294967295 IF $IEND_ROW = + 4294967295 THEN $IEND_ROW = $IDIM_1 IF $ISTART_ROW = + 4294967295 THEN $ISTART_ROW = 0 IF $ISTART_ROW < + 4294967295 OR $IEND_ROW < + 4294967295 THEN RETURN SETERROR (3 , 0 , + 4294967295 ) IF $ISTART_ROW > $IDIM_1 OR $IEND_ROW > $IDIM_1 THEN RETURN SETERROR (3 , 0 , + 4294967295 ) IF $ISTART_ROW > $IEND_ROW THEN RETURN SETERROR (4 , 0 , + 4294967295 ) SWITCH UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) CASE 1 LOCAL $ARETARRAY [$IEND_ROW - $ISTART_ROW + 1 ] FOR $I = 0 TO $IEND_ROW - $ISTART_ROW $ARETARRAY [$I ] = $AARRAY [$I + $ISTART_ROW ] NEXT RETURN $ARETARRAY CASE 2 LOCAL $IDIM_2 = UBOUND ($AARRAY , $UBOUND_COLUMNS ) + 4294967295 IF $IEND_COL = + 4294967295 THEN $IEND_COL = $IDIM_2 IF $ISTART_COL = + 4294967295 THEN $ISTART_COL = 0 IF $ISTART_COL < + 4294967295 OR $IEND_COL < + 4294967295 THEN RETURN SETERROR (5 , 0 , + 4294967295 ) IF $ISTART_COL > $IDIM_2 OR $IEND_COL > $IDIM_2 THEN RETURN SETERROR (5 , 0 , + 4294967295 ) IF $ISTART_COL > $IEND_COL THEN RETURN SETERROR (6 , 0 , + 4294967295 ) IF $ISTART_COL = $IEND_COL THEN LOCAL $ARETARRAY [$IEND_ROW - $ISTART_ROW + 1 ] ELSE LOCAL $ARETARRAY [$IEND_ROW - $ISTART_ROW + 1 ] [$IEND_COL - $ISTART_COL + 1 ] ENDIF FOR $I = 0 TO $IEND_ROW - $ISTART_ROW FOR $J = 0 TO $IEND_COL - $ISTART_COL IF $ISTART_COL = $IEND_COL THEN $ARETARRAY [$I ] = $AARRAY [$I + $ISTART_ROW ] [$J + $ISTART_COL ] ELSE $ARETARRAY [$I ] [$J ] = $AARRAY [$I + $ISTART_ROW ] [$J + $ISTART_COL ] ENDIF NEXT NEXT RETURN $ARETARRAY CASE ELSE RETURN SETERROR (2 , 0 , + 4294967295 ) ENDSWITCH RETURN 1 ENDFUNC FUNC _ARRAYFINDALL (CONST BYREF $AARRAY , $VVALUE , $ISTART = 0 , $IEND = 0 , $ICASE = 0 , $ICOMPARE = 0 , $ISUBITEM = 0 , $BROW = FALSE ) IF $ISTART = DEFAULT THEN $ISTART = 0 IF $IEND = DEFAULT THEN $IEND = 0 IF $ICASE = DEFAULT THEN $ICASE = 0 IF $ICOMPARE = DEFAULT THEN $ICOMPARE = 0 IF $ISUBITEM = DEFAULT THEN $ISUBITEM = 0 IF $BROW = DEFAULT THEN $BROW = FALSE $ISTART = _ARRAYSEARCH ($AARRAY , $VVALUE , $ISTART , $IEND , $ICASE , $ICOMPARE , 1 , $ISUBITEM , $BROW ) IF @ERROR THEN RETURN SETERROR (@ERROR , 0 , + 4294967295 ) LOCAL $IINDEX = 0 , $AVRESULT [UBOUND ($AARRAY , ($BROW $UBOUND_COLUMNS $UBOUND_ROWS ) ) ] DO $AVRESULT [$IINDEX ] = $ISTART $IINDEX += 1 $ISTART = _ARRAYSEARCH ($AARRAY , $VVALUE , $ISTART + 1 , $IEND , $ICASE , $ICOMPARE , 1 , $ISUBITEM , $BROW ) UNTIL @ERROR REDIM $AVRESULT [$IINDEX ] RETURN $AVRESULT ENDFUNC FUNC _ARRAYINSERT (BYREF $AARRAY , $VRANGE , $VVALUE = "" , $ISTART = 0 , $SDELIM_ITEM = "|" , $SDELIM_ROW = @CRLF , $IFORCE = $ARRAYFILL_FORCE_DEFAULT ) IF $VVALUE = DEFAULT THEN $VVALUE = "" IF $ISTART = DEFAULT THEN $ISTART = 0 IF $SDELIM_ITEM = DEFAULT THEN $SDELIM_ITEM = "|" IF $SDELIM_ROW = DEFAULT THEN $SDELIM_ROW = @CRLF IF $IFORCE = DEFAULT THEN $IFORCE = $ARRAYFILL_FORCE_DEFAULT IF NOT ISARRAY ($AARRAY ) THEN RETURN SETERROR (1 , 0 , + 4294967295 ) LOCAL $IDIM_1 = UBOUND ($AARRAY , $UBOUND_ROWS ) + 4294967295 LOCAL $HDATATYPE = 0 SWITCH $IFORCE CASE $ARRAYFILL_FORCE_INT $HDATATYPE = INT CASE $ARRAYFILL_FORCE_NUMBER $HDATATYPE = NUMBER CASE $ARRAYFILL_FORCE_PTR $HDATATYPE = PTR CASE $ARRAYFILL_FORCE_HWND $HDATATYPE = HWND CASE $ARRAYFILL_FORCE_STRING $HDATATYPE = STRING ENDSWITCH LOCAL $ASPLIT_1 , $ASPLIT_2 IF ISARRAY ($VRANGE ) THEN IF UBOUND ($VRANGE , $UBOUND_DIMENSIONS ) <> 1 OR UBOUND ($VRANGE , $UBOUND_ROWS ) < 2 THEN RETURN SETERROR (4 , 0 , + 4294967295 ) ELSE LOCAL $INUMBER $VRANGE = STRINGSTRIPWS ($VRANGE , 8 ) $ASPLIT_1 = STRINGSPLIT ($VRANGE , ";" ) $VRANGE = "" FOR $I = 1 TO $ASPLIT_1 [0 ] IF NOT STRINGREGEXP ($ASPLIT_1 [$I ] , "^\d+(-\d+)?$" ) THEN RETURN SETERROR (3 , 0 , + 4294967295 ) $ASPLIT_2 = STRINGSPLIT ($ASPLIT_1 [$I ] , "-" ) SWITCH $ASPLIT_2 [0 ] CASE 1 $VRANGE &= $ASPLIT_2 [1 ] & ";" CASE 2 IF NUMBER ($ASPLIT_2 [2 ] ) >= NUMBER ($ASPLIT_2 [1 ] ) THEN $INUMBER = $ASPLIT_2 [1 ] + 4294967295 DO $INUMBER += 1 $VRANGE &= $INUMBER & ";" UNTIL $INUMBER = $ASPLIT_2 [2 ] ENDIF ENDSWITCH NEXT $VRANGE = STRINGSPLIT (STRINGTRIMRIGHT ($VRANGE , 1 ) , ";" ) ENDIF IF $VRANGE [1 ] < 0 OR $VRANGE [$VRANGE [0 ] ] > $IDIM_1 THEN RETURN SETERROR (5 , 0 , + 4294967295 ) FOR $I = 2 TO $VRANGE [0 ] IF $VRANGE [$I ] < $VRANGE [$I + 4294967295 ] THEN RETURN SETERROR (3 , 0 , + 4294967295 ) NEXT LOCAL $ICOPYTO_INDEX = $IDIM_1 + $VRANGE [0 ] LOCAL $IINSERTPOINT_INDEX = $VRANGE [0 ] LOCAL $IINSERT_INDEX = $VRANGE [$IINSERTPOINT_INDEX ] SWITCH UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) CASE 1 IF $IFORCE = $ARRAYFILL_FORCE_SINGLEITEM THEN REDIM $AARRAY [$IDIM_1 + $VRANGE [0 ] + 1 ] FOR $IREADFROMINDEX = $IDIM_1 TO 0 STEP + 4294967295 $AARRAY [$ICOPYTO_INDEX ] = $AARRAY [$IREADFROMINDEX ] $ICOPYTO_INDEX -= 1 $IINSERT_INDEX = $VRANGE [$IINSERTPOINT_INDEX ] WHILE $IREADFROMINDEX = $IINSERT_INDEX $AARRAY [$ICOPYTO_INDEX ] = $VVALUE $ICOPYTO_INDEX -= 1 $IINSERTPOINT_INDEX -= 1 IF $IINSERTPOINT_INDEX < 1 THEN EXITLOOP 2 $IINSERT_INDEX = $VRANGE [$IINSERTPOINT_INDEX ] WEND NEXT RETURN $IDIM_1 + $VRANGE [0 ] + 1 ENDIF REDIM $AARRAY [$IDIM_1 + $VRANGE [0 ] + 1 ] IF ISARRAY ($VVALUE ) THEN IF UBOUND ($VVALUE , $UBOUND_DIMENSIONS ) <> 1 THEN RETURN SETERROR (5 , 0 , + 4294967295 ) $HDATATYPE = 0 ELSE LOCAL $ATMP = STRINGSPLIT ($VVALUE , $SDELIM_ITEM , $STR_NOCOUNT + $STR_ENTIRESPLIT ) IF UBOUND ($ATMP , $UBOUND_ROWS ) = 1 THEN $ATMP [0 ] = $VVALUE $HDATATYPE = 0 ENDIF $VVALUE = $ATMP ENDIF FOR $IREADFROMINDEX = $IDIM_1 TO 0 STEP + 4294967295 $AARRAY [$ICOPYTO_INDEX ] = $AARRAY [$IREADFROMINDEX ] $ICOPYTO_INDEX -= 1 $IINSERT_INDEX = $VRANGE [$IINSERTPOINT_INDEX ] WHILE $IREADFROMINDEX = $IINSERT_INDEX IF $IINSERTPOINT_INDEX <= UBOUND ($VVALUE , $UBOUND_ROWS ) THEN IF ISFUNC ($HDATATYPE ) THEN $AARRAY [$ICOPYTO_INDEX ] = $HDATATYPE ($VVALUE [$IINSERTPOINT_INDEX + 4294967295 ] ) ELSE $AARRAY [$ICOPYTO_INDEX ] = $VVALUE [$IINSERTPOINT_INDEX + 4294967295 ] ENDIF ELSE $AARRAY [$ICOPYTO_INDEX ] = "" ENDIF $ICOPYTO_INDEX -= 1 $IINSERTPOINT_INDEX -= 1 IF $IINSERTPOINT_INDEX = 0 THEN EXITLOOP 2 $IINSERT_INDEX = $VRANGE [$IINSERTPOINT_INDEX ] WEND NEXT CASE 2 LOCAL $IDIM_2 = UBOUND ($AARRAY , $UBOUND_COLUMNS ) IF $ISTART < 0 OR $ISTART > $IDIM_2 + 4294967295 THEN RETURN SETERROR (6 , 0 , + 4294967295 ) LOCAL $IVALDIM_1 , $IVALDIM_2 IF ISARRAY ($VVALUE ) THEN IF UBOUND ($VVALUE , $UBOUND_DIMENSIONS ) <> 2 THEN RETURN SETERROR (7 , 0 , + 4294967295 ) $IVALDIM_1 = UBOUND ($VVALUE , $UBOUND_ROWS ) $IVALDIM_2 = UBOUND ($VVALUE , $UBOUND_COLUMNS ) $HDATATYPE = 0 ELSE $ASPLIT_1 = STRINGSPLIT ($VVALUE , $SDELIM_ROW , $STR_NOCOUNT + $STR_ENTIRESPLIT ) $IVALDIM_1 = UBOUND ($ASPLIT_1 , $UBOUND_ROWS ) STRINGREPLACE ($ASPLIT_1 [0 ] , $SDELIM_ITEM , "" ) $IVALDIM_2 = @EXTENDED + 1 LOCAL $ATMP [$IVALDIM_1 ] [$IVALDIM_2 ] FOR $I = 0 TO $IVALDIM_1 + 4294967295 $ASPLIT_2 = STRINGSPLIT ($ASPLIT_1 [$I ] , $SDELIM_ITEM , $STR_NOCOUNT + $STR_ENTIRESPLIT ) FOR $J = 0 TO $IVALDIM_2 + 4294967295 $ATMP [$I ] [$J ] = $ASPLIT_2 [$J ] NEXT NEXT $VVALUE = $ATMP ENDIF IF UBOUND ($VVALUE , $UBOUND_COLUMNS ) + $ISTART > UBOUND ($AARRAY , $UBOUND_COLUMNS ) THEN RETURN SETERROR (8 , 0 , + 4294967295 ) REDIM $AARRAY [$IDIM_1 + $VRANGE [0 ] + 1 ] [$IDIM_2 ] FOR $IREADFROMINDEX = $IDIM_1 TO 0 STEP + 4294967295 FOR $J = 0 TO $IDIM_2 + 4294967295 $AARRAY [$ICOPYTO_INDEX ] [$J ] = $AARRAY [$IREADFROMINDEX ] [$J ] NEXT $ICOPYTO_INDEX -= 1 $IINSERT_INDEX = $VRANGE [$IINSERTPOINT_INDEX ] WHILE $IREADFROMINDEX = $IINSERT_INDEX FOR $J = 0 TO $IDIM_2 + 4294967295 IF $J < $ISTART THEN $AARRAY [$ICOPYTO_INDEX ] [$J ] = "" ELSEIF $J - $ISTART > $IVALDIM_2 + 4294967295 THEN $AARRAY [$ICOPYTO_INDEX ] [$J ] = "" ELSE IF $IINSERTPOINT_INDEX + 4294967295 < $IVALDIM_1 THEN IF ISFUNC ($HDATATYPE ) THEN $AARRAY [$ICOPYTO_INDEX ] [$J ] = $HDATATYPE ($VVALUE [$IINSERTPOINT_INDEX + 4294967295 ] [$J - $ISTART ] ) ELSE $AARRAY [$ICOPYTO_INDEX ] [$J ] = $VVALUE [$IINSERTPOINT_INDEX + 4294967295 ] [$J - $ISTART ] ENDIF ELSE $AARRAY [$ICOPYTO_INDEX ] [$J ] = "" ENDIF ENDIF NEXT $ICOPYTO_INDEX -= 1 $IINSERTPOINT_INDEX -= 1 IF $IINSERTPOINT_INDEX = 0 THEN EXITLOOP 2 $IINSERT_INDEX = $VRANGE [$IINSERTPOINT_INDEX ] WEND NEXT CASE ELSE RETURN SETERROR (2 , 0 , + 4294967295 ) ENDSWITCH RETURN UBOUND ($AARRAY , $UBOUND_ROWS ) ENDFUNC FUNC _ARRAYMAX (CONST BYREF $AARRAY , $ICOMPNUMERIC = 0 , $ISTART = + 4294967295 , $IEND = + 4294967295 , $ISUBITEM = 0 ) LOCAL $IRESULT = _ARRAYMAXINDEX ($AARRAY , $ICOMPNUMERIC , $ISTART , $IEND , $ISUBITEM ) IF @ERROR THEN RETURN SETERROR (@ERROR , 0 , "" ) IF UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) = 1 THEN RETURN $AARRAY [$IRESULT ] ELSE RETURN $AARRAY [$IRESULT ] [$ISUBITEM ] ENDIF ENDFUNC FUNC _ARRAYMAXINDEX (CONST BYREF $AARRAY , $ICOMPNUMERIC = 0 , $ISTART = + 4294967295 , $IEND = + 4294967295 , $ISUBITEM = 0 ) IF $ICOMPNUMERIC = DEFAULT THEN $ICOMPNUMERIC = 0 IF $ISTART = DEFAULT THEN $ISTART = + 4294967295 IF $IEND = DEFAULT THEN $IEND = + 4294967295 IF $ISUBITEM = DEFAULT THEN $ISUBITEM = 0 LOCAL $IRET = __ARRAY_MINMAXINDEX ($AARRAY , $ICOMPNUMERIC , $ISTART , $IEND , $ISUBITEM , __ARRAY_GREATERTHAN ) RETURN SETERROR (@ERROR , 0 , $IRET ) ENDFUNC FUNC _ARRAYMIN (CONST BYREF $AARRAY , $ICOMPNUMERIC = 0 , $ISTART = + 4294967295 , $IEND = + 4294967295 , $ISUBITEM = 0 ) LOCAL $IRESULT = _ARRAYMININDEX ($AARRAY , $ICOMPNUMERIC , $ISTART , $IEND , $ISUBITEM ) IF @ERROR THEN RETURN SETERROR (@ERROR , 0 , "" ) IF UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) = 1 THEN RETURN $AARRAY [$IRESULT ] ELSE RETURN $AARRAY [$IRESULT ] [$ISUBITEM ] ENDIF ENDFUNC FUNC _ARRAYMININDEX (CONST BYREF $AARRAY , $ICOMPNUMERIC = 0 , $ISTART = + 4294967295 , $IEND = + 4294967295 , $ISUBITEM = 0 ) IF $ICOMPNUMERIC = DEFAULT THEN $ICOMPNUMERIC = 0 IF $ISTART = DEFAULT THEN $ISTART = + 4294967295 IF $IEND = DEFAULT THEN $IEND = + 4294967295 IF $ISUBITEM = DEFAULT THEN $ISUBITEM = 0 LOCAL $IRET = __ARRAY_MINMAXINDEX ($AARRAY , $ICOMPNUMERIC , $ISTART , $IEND , $ISUBITEM , __ARRAY_LESSTHAN ) RETURN SETERROR (@ERROR , 0 , $IRET ) ENDFUNC FUNC _ARRAYPERMUTE (BYREF $AARRAY , $SDELIMITER = "" ) IF $SDELIMITER = DEFAULT THEN $SDELIMITER = "" IF NOT ISARRAY ($AARRAY ) THEN RETURN SETERROR (1 , 0 , 0 ) IF UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) <> 1 THEN RETURN SETERROR (2 , 0 , 0 ) LOCAL $ISIZE = UBOUND ($AARRAY ) , $IFACTORIAL = 1 , $AIDX [$ISIZE ] , $ARESULT [1 ] , $ICOUNT = 1 IF UBOUND ($AARRAY ) THEN FOR $I = 0 TO $ISIZE + 4294967295 $AIDX [$I ] = $I NEXT FOR $I = $ISIZE TO 1 STEP + 4294967295 $IFACTORIAL *= $I NEXT REDIM $ARESULT [$IFACTORIAL + 1 ] $ARESULT [0 ] = $IFACTORIAL __ARRAY_EXETERINTERNAL ($AARRAY , 0 , $ISIZE , $SDELIMITER , $AIDX , $ARESULT , $ICOUNT ) ELSE $ARESULT [0 ] = 0 ENDIF RETURN $ARESULT ENDFUNC FUNC _ARRAYPOP (BYREF $AARRAY ) IF (NOT ISARRAY ($AARRAY ) ) THEN RETURN SETERROR (1 , 0 , "" ) IF UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) <> 1 THEN RETURN SETERROR (2 , 0 , "" ) LOCAL $IUBOUND = UBOUND ($AARRAY ) + 4294967295 IF $IUBOUND = + 4294967295 THEN RETURN SETERROR (3 , 0 , "" ) LOCAL $SLASTVAL = $AARRAY [$IUBOUND ] IF $IUBOUND > + 4294967295 THEN REDIM $AARRAY [$IUBOUND ] ENDIF RETURN $SLASTVAL ENDFUNC FUNC _ARRAYPUSH (BYREF $AARRAY , $VVALUE , $IDIRECTION = 0 ) IF $IDIRECTION = DEFAULT THEN $IDIRECTION = 0 IF (NOT ISARRAY ($AARRAY ) ) THEN RETURN SETERROR (1 , 0 , 0 ) IF UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) <> 1 THEN RETURN SETERROR (3 , 0 , 0 ) LOCAL $IUBOUND = UBOUND ($AARRAY ) + 4294967295 IF ISARRAY ($VVALUE ) THEN LOCAL $IUBOUNDS = UBOUND ($VVALUE ) IF ($IUBOUNDS + 4294967295 ) > $IUBOUND THEN RETURN SETERROR (2 , 0 , 0 ) IF $IDIRECTION THEN FOR $I = $IUBOUND TO $IUBOUNDS STEP + 4294967295 $AARRAY [$I ] = $AARRAY [$I - $IUBOUNDS ] NEXT FOR $I = 0 TO $IUBOUNDS + 4294967295 $AARRAY [$I ] = $VVALUE [$I ] NEXT ELSE FOR $I = 0 TO $IUBOUND - $IUBOUNDS $AARRAY [$I ] = $AARRAY [$I + $IUBOUNDS ] NEXT FOR $I = 0 TO $IUBOUNDS + 4294967295 $AARRAY [$I + $IUBOUND - $IUBOUNDS + 1 ] = $VVALUE [$I ] NEXT ENDIF ELSE IF $IUBOUND > + 4294967295 THEN IF $IDIRECTION THEN FOR $I = $IUBOUND TO 1 STEP + 4294967295 $AARRAY [$I ] = $AARRAY [$I + 4294967295 ] NEXT $AARRAY [0 ] = $VVALUE ELSE FOR $I = 0 TO $IUBOUND + 4294967295 $AARRAY [$I ] = $AARRAY [$I + 1 ] NEXT $AARRAY [$IUBOUND ] = $VVALUE ENDIF ENDIF ENDIF RETURN 1 ENDFUNC FUNC _ARRAYREVERSE (BYREF $AARRAY , $ISTART = 0 , $IEND = 0 ) IF $ISTART = DEFAULT THEN $ISTART = 0 IF $IEND = DEFAULT THEN $IEND = 0 IF NOT ISARRAY ($AARRAY ) THEN RETURN SETERROR (1 , 0 , 0 ) IF UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) <> 1 THEN RETURN SETERROR (3 , 0 , 0 ) IF NOT UBOUND ($AARRAY ) THEN RETURN SETERROR (4 , 0 , 0 ) LOCAL $VTMP , $IUBOUND = UBOUND ($AARRAY ) + 4294967295 IF $IEND < 1 OR $IEND > $IUBOUND THEN $IEND = $IUBOUND IF $ISTART < 0 THEN $ISTART = 0 IF $ISTART > $IEND THEN RETURN SETERROR (2 , 0 , 0 ) FOR $I = $ISTART TO INT (($ISTART + $IEND + 4294967295 ) / 2 ) $VTMP = $AARRAY [$I ] $AARRAY [$I ] = $AARRAY [$IEND ] $AARRAY [$IEND ] = $VTMP $IEND -= 1 NEXT RETURN 1 ENDFUNC FUNC _ARRAYSEARCH (CONST BYREF $AARRAY , $VVALUE , $ISTART = 0 , $IEND = 0 , $ICASE = 0 , $ICOMPARE = 0 , $IFORWARD = 1 , $ISUBITEM = + 4294967295 , $BROW = FALSE ) IF $ISTART = DEFAULT THEN $ISTART = 0 IF $IEND = DEFAULT THEN $IEND = 0 IF $ICASE = DEFAULT THEN $ICASE = 0 IF $ICOMPARE = DEFAULT THEN $ICOMPARE = 0 IF $IFORWARD = DEFAULT THEN $IFORWARD = 1 IF $ISUBITEM = DEFAULT THEN $ISUBITEM = + 4294967295 IF $BROW = DEFAULT THEN $BROW = FALSE IF NOT ISARRAY ($AARRAY ) THEN RETURN SETERROR (1 , 0 , + 4294967295 ) LOCAL $IDIM_1 = UBOUND ($AARRAY ) + 4294967295 IF $IDIM_1 = + 4294967295 THEN RETURN SETERROR (3 , 0 , + 4294967295 ) LOCAL $IDIM_2 = UBOUND ($AARRAY , $UBOUND_COLUMNS ) + 4294967295 LOCAL $BCOMPTYPE = FALSE IF $ICOMPARE = 2 THEN $ICOMPARE = 0 $BCOMPTYPE = TRUE ENDIF IF $BROW THEN IF UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) = 1 THEN RETURN SETERROR (5 , 0 , + 4294967295 ) IF $IEND < 1 OR $IEND > $IDIM_2 THEN $IEND = $IDIM_2 IF $ISTART < 0 THEN $ISTART = 0 IF $ISTART > $IEND THEN RETURN SETERROR (4 , 0 , + 4294967295 ) ELSE IF $IEND < 1 OR $IEND > $IDIM_1 THEN $IEND = $IDIM_1 IF $ISTART < 0 THEN $ISTART = 0 IF $ISTART > $IEND THEN RETURN SETERROR (4 , 0 , + 4294967295 ) ENDIF LOCAL $ISTEP = 1 IF NOT $IFORWARD THEN LOCAL $ITMP = $ISTART $ISTART = $IEND $IEND = $ITMP $ISTEP = + 4294967295 ENDIF SWITCH UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) CASE 1 IF NOT $ICOMPARE THEN IF NOT $ICASE THEN FOR $I = $ISTART TO $IEND STEP $ISTEP IF $BCOMPTYPE AND VARGETTYPE ($AARRAY [$I ] ) <> VARGETTYPE ($VVALUE ) THEN CONTINUELOOP IF $AARRAY [$I ] = $VVALUE THEN RETURN $I NEXT ELSE FOR $I = $ISTART TO $IEND STEP $ISTEP IF $BCOMPTYPE AND VARGETTYPE ($AARRAY [$I ] ) <> VARGETTYPE ($VVALUE ) THEN CONTINUELOOP IF $AARRAY [$I ] == $VVALUE THEN RETURN $I NEXT ENDIF ELSE FOR $I = $ISTART TO $IEND STEP $ISTEP IF $ICOMPARE = 3 THEN IF STRINGREGEXP ($AARRAY [$I ] , $VVALUE ) THEN RETURN $I ELSE IF STRINGINSTR ($AARRAY [$I ] , $VVALUE , $ICASE ) > 0 THEN RETURN $I ENDIF NEXT ENDIF CASE 2 LOCAL $IDIM_SUB IF $BROW THEN $IDIM_SUB = $IDIM_1 IF $ISUBITEM > $IDIM_SUB THEN $ISUBITEM = $IDIM_SUB IF $ISUBITEM < 0 THEN $ISUBITEM = 0 ELSE $IDIM_SUB = $ISUBITEM ENDIF ELSE $IDIM_SUB = $IDIM_2 IF $ISUBITEM > $IDIM_SUB THEN $ISUBITEM = $IDIM_SUB IF $ISUBITEM < 0 THEN $ISUBITEM = 0 ELSE $IDIM_SUB = $ISUBITEM ENDIF ENDIF FOR $J = $ISUBITEM TO $IDIM_SUB IF NOT $ICOMPARE THEN IF NOT $ICASE THEN FOR $I = $ISTART TO $IEND STEP $ISTEP IF $BROW THEN IF $BCOMPTYPE AND VARGETTYPE ($AARRAY [$J ] [$I ] ) <> VARGETTYPE ($VVALUE ) THEN CONTINUELOOP IF $AARRAY [$J ] [$I ] = $VVALUE THEN RETURN $I ELSE IF $BCOMPTYPE AND VARGETTYPE ($AARRAY [$I ] [$J ] ) <> VARGETTYPE ($VVALUE ) THEN CONTINUELOOP IF $AARRAY [$I ] [$J ] = $VVALUE THEN RETURN $I ENDIF NEXT ELSE FOR $I = $ISTART TO $IEND STEP $ISTEP IF $BROW THEN IF $BCOMPTYPE AND VARGETTYPE ($AARRAY [$J ] [$I ] ) <> VARGETTYPE ($VVALUE ) THEN CONTINUELOOP IF $AARRAY [$J ] [$I ] == $VVALUE THEN RETURN $I ELSE IF $BCOMPTYPE AND VARGETTYPE ($AARRAY [$I ] [$J ] ) <> VARGETTYPE ($VVALUE ) THEN CONTINUELOOP IF $AARRAY [$I ] [$J ] == $VVALUE THEN RETURN $I ENDIF NEXT ENDIF ELSE FOR $I = $ISTART TO $IEND STEP $ISTEP IF $ICOMPARE = 3 THEN IF $BROW THEN IF STRINGREGEXP ($AARRAY [$J ] [$I ] , $VVALUE ) THEN RETURN $I ELSE IF STRINGREGEXP ($AARRAY [$I ] [$J ] , $VVALUE ) THEN RETURN $I ENDIF ELSE IF $BROW THEN IF STRINGINSTR ($AARRAY [$J ] [$I ] , $VVALUE , $ICASE ) > 0 THEN RETURN $I ELSE IF STRINGINSTR ($AARRAY [$I ] [$J ] , $VVALUE , $ICASE ) > 0 THEN RETURN $I ENDIF ENDIF NEXT ENDIF NEXT CASE ELSE RETURN SETERROR (2 , 0 , + 4294967295 ) ENDSWITCH RETURN SETERROR (6 , 0 , + 4294967295 ) ENDFUNC FUNC _ARRAYSHUFFLE (BYREF $AARRAY , $ISTART_ROW = 0 , $IEND_ROW = 0 , $ICOL = + 4294967295 ) IF $ISTART_ROW = DEFAULT THEN $ISTART_ROW = 0 IF $IEND_ROW = DEFAULT THEN $IEND_ROW = 0 IF $ICOL = DEFAULT THEN $ICOL = + 4294967295 IF NOT ISARRAY ($AARRAY ) THEN RETURN SETERROR (1 , 0 , + 4294967295 ) LOCAL $IDIM_1 = UBOUND ($AARRAY , $UBOUND_ROWS ) IF $IEND_ROW = 0 THEN $IEND_ROW = $IDIM_1 + 4294967295 IF $ISTART_ROW < 0 OR $ISTART_ROW > $IDIM_1 + 4294967295 THEN RETURN SETERROR (3 , 0 , + 4294967295 ) IF $IEND_ROW < 1 OR $IEND_ROW > $IDIM_1 + 4294967295 THEN RETURN SETERROR (3 , 0 , + 4294967295 ) IF $ISTART_ROW > $IEND_ROW THEN RETURN SETERROR (4 , 0 , + 4294967295 ) LOCAL $VTMP , $IRAND SWITCH UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) CASE 1 FOR $I = $IEND_ROW TO $ISTART_ROW + 1 STEP + 4294967295 $IRAND = RANDOM ($ISTART_ROW , $I , 1 ) $VTMP = $AARRAY [$I ] $AARRAY [$I ] = $AARRAY [$IRAND ] $AARRAY [$IRAND ] = $VTMP NEXT RETURN 1 CASE 2 LOCAL $IDIM_2 = UBOUND ($AARRAY , $UBOUND_COLUMNS ) IF $ICOL < + 4294967295 OR $ICOL > $IDIM_2 + 4294967295 THEN RETURN SETERROR (5 , 0 , + 4294967295 ) LOCAL $ICOL_START , $ICOL_END IF $ICOL = + 4294967295 THEN $ICOL_START = 0 $ICOL_END = $IDIM_2 + 4294967295 ELSE $ICOL_START = $ICOL $ICOL_END = $ICOL ENDIF FOR $I = $IEND_ROW TO $ISTART_ROW + 1 STEP + 4294967295 $IRAND = RANDOM ($ISTART_ROW , $I , 1 ) FOR $J = $ICOL_START TO $ICOL_END $VTMP = $AARRAY [$I ] [$J ] $AARRAY [$I ] [$J ] = $AARRAY [$IRAND ] [$J ] $AARRAY [$IRAND ] [$J ] = $VTMP NEXT NEXT RETURN 1 CASE ELSE RETURN SETERROR (2 , 0 , + 4294967295 ) ENDSWITCH ENDFUNC FUNC _ARRAYSORT (BYREF $AARRAY , $IDESCENDING = 0 , $ISTART = 0 , $IEND = 0 , $ISUBITEM = 0 , $IPIVOT = 0 ) IF $IDESCENDING = DEFAULT THEN $IDESCENDING = 0 IF $ISTART = DEFAULT THEN $ISTART = 0 IF $IEND = DEFAULT THEN $IEND = 0 IF $ISUBITEM = DEFAULT THEN $ISUBITEM = 0 IF $IPIVOT = DEFAULT THEN $IPIVOT = 0 IF NOT ISARRAY ($AARRAY ) THEN RETURN SETERROR (1 , 0 , 0 ) LOCAL $IUBOUND = UBOUND ($AARRAY ) + 4294967295 IF $IUBOUND = + 4294967295 THEN RETURN SETERROR (5 , 0 , 0 ) IF $IEND = DEFAULT THEN $IEND = 0 IF $IEND < 1 OR $IEND > $IUBOUND OR $IEND = DEFAULT THEN $IEND = $IUBOUND IF $ISTART < 0 OR $ISTART = DEFAULT THEN $ISTART = 0 IF $ISTART > $IEND THEN RETURN SETERROR (2 , 0 , 0 ) SWITCH UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) CASE 1 IF $IPIVOT THEN __ARRAYDUALPIVOTSORT ($AARRAY , $ISTART , $IEND ) ELSE __ARRAYQUICKSORT1D ($AARRAY , $ISTART , $IEND ) ENDIF IF $IDESCENDING THEN _ARRAYREVERSE ($AARRAY , $ISTART , $IEND ) CASE 2 IF $IPIVOT THEN RETURN SETERROR (6 , 0 , 0 ) LOCAL $ISUBMAX = UBOUND ($AARRAY , $UBOUND_COLUMNS ) + 4294967295 IF $ISUBITEM > $ISUBMAX THEN RETURN SETERROR (3 , 0 , 0 ) IF $IDESCENDING THEN $IDESCENDING = + 4294967295 ELSE $IDESCENDING = 1 ENDIF __ARRAYQUICKSORT2D ($AARRAY , $IDESCENDING , $ISTART , $IEND , $ISUBITEM , $ISUBMAX ) CASE ELSE RETURN SETERROR (4 , 0 , 0 ) ENDSWITCH RETURN 1 ENDFUNC FUNC __ARRAYQUICKSORT1D (BYREF $AARRAY , CONST BYREF $ISTART , CONST BYREF $IEND ) IF $IEND <= $ISTART THEN RETURN LOCAL $VTMP IF ($IEND - $ISTART ) < 15 THEN LOCAL $VCUR FOR $I = $ISTART + 1 TO $IEND $VTMP = $AARRAY [$I ] IF ISNUMBER ($VTMP ) THEN FOR $J = $I + 4294967295 TO $ISTART STEP + 4294967295 $VCUR = $AARRAY [$J ] IF ($VTMP >= $VCUR AND ISNUMBER ($VCUR ) ) OR (NOT ISNUMBER ($VCUR ) AND STRINGCOMPARE ($VTMP , $VCUR ) >= 0 ) THEN EXITLOOP $AARRAY [$J + 1 ] = $VCUR NEXT ELSE FOR $J = $I + 4294967295 TO $ISTART STEP + 4294967295 IF (STRINGCOMPARE ($VTMP , $AARRAY [$J ] ) >= 0 ) THEN EXITLOOP $AARRAY [$J + 1 ] = $AARRAY [$J ] NEXT ENDIF $AARRAY [$J + 1 ] = $VTMP NEXT RETURN ENDIF LOCAL $L = $ISTART , $R = $IEND , $VPIVOT = $AARRAY [INT (($ISTART + $IEND ) / 2 ) ] , $BNUM = ISNUMBER ($VPIVOT ) DO IF $BNUM THEN WHILE ($AARRAY [$L ] < $VPIVOT AND ISNUMBER ($AARRAY [$L ] ) ) OR (NOT ISNUMBER ($AARRAY [$L ] ) AND STRINGCOMPARE ($AARRAY [$L ] , $VPIVOT ) < 0 ) $L += 1 WEND WHILE ($AARRAY [$R ] > $VPIVOT AND ISNUMBER ($AARRAY [$R ] ) ) OR (NOT ISNUMBER ($AARRAY [$R ] ) AND STRINGCOMPARE ($AARRAY [$R ] , $VPIVOT ) > 0 ) $R -= 1 WEND ELSE WHILE (STRINGCOMPARE ($AARRAY [$L ] , $VPIVOT ) < 0 ) $L += 1 WEND WHILE (STRINGCOMPARE ($AARRAY [$R ] , $VPIVOT ) > 0 ) $R -= 1 WEND ENDIF IF $L <= $R THEN $VTMP = $AARRAY [$L ] $AARRAY [$L ] = $AARRAY [$R ] $AARRAY [$R ] = $VTMP $L += 1 $R -= 1 ENDIF UNTIL $L > $R __ARRAYQUICKSORT1D ($AARRAY , $ISTART , $R ) __ARRAYQUICKSORT1D ($AARRAY , $L , $IEND ) ENDFUNC FUNC __ARRAYQUICKSORT2D (BYREF $AARRAY , CONST BYREF $ISTEP , CONST BYREF $ISTART , CONST BYREF $IEND , CONST BYREF $ISUBITEM , CONST BYREF $ISUBMAX ) IF $IEND <= $ISTART THEN RETURN LOCAL $VTMP , $L = $ISTART , $R = $IEND , $VPIVOT = $AARRAY [INT (($ISTART + $IEND ) / 2 ) ] [$ISUBITEM ] , $BNUM = ISNUMBER ($VPIVOT ) DO IF $BNUM THEN WHILE ($ISTEP * ($AARRAY [$L ] [$ISUBITEM ] - $VPIVOT ) < 0 AND ISNUMBER ($AARRAY [$L ] [$ISUBITEM ] ) ) OR (NOT ISNUMBER ($AARRAY [$L ] [$ISUBITEM ] ) AND $ISTEP * STRINGCOMPARE ($AARRAY [$L ] [$ISUBITEM ] , $VPIVOT ) < 0 ) $L += 1 WEND WHILE ($ISTEP * ($AARRAY [$R ] [$ISUBITEM ] - $VPIVOT ) > 0 AND ISNUMBER ($AARRAY [$R ] [$ISUBITEM ] ) ) OR (NOT ISNUMBER ($AARRAY [$R ] [$ISUBITEM ] ) AND $ISTEP * STRINGCOMPARE ($AARRAY [$R ] [$ISUBITEM ] , $VPIVOT ) > 0 ) $R -= 1 WEND ELSE WHILE ($ISTEP * STRINGCOMPARE ($AARRAY [$L ] [$ISUBITEM ] , $VPIVOT ) < 0 ) $L += 1 WEND WHILE ($ISTEP * STRINGCOMPARE ($AARRAY [$R ] [$ISUBITEM ] , $VPIVOT ) > 0 ) $R -= 1 WEND ENDIF IF $L <= $R THEN FOR $I = 0 TO $ISUBMAX $VTMP = $AARRAY [$L ] [$I ] $AARRAY [$L ] [$I ] = $AARRAY [$R ] [$I ] $AARRAY [$R ] [$I ] = $VTMP NEXT $L += 1 $R -= 1 ENDIF UNTIL $L > $R __ARRAYQUICKSORT2D ($AARRAY , $ISTEP , $ISTART , $R , $ISUBITEM , $ISUBMAX ) __ARRAYQUICKSORT2D ($AARRAY , $ISTEP , $L , $IEND , $ISUBITEM , $ISUBMAX ) ENDFUNC FUNC __ARRAYDUALPIVOTSORT (BYREF $AARRAY , $IPIVOT_LEFT , $IPIVOT_RIGHT , $BLEFTMOST = TRUE ) IF $IPIVOT_LEFT > $IPIVOT_RIGHT THEN RETURN LOCAL $ILENGTH = $IPIVOT_RIGHT - $IPIVOT_LEFT + 1 LOCAL $I , $J , $K , $IAI , $IAK , $IA1 , $IA2 , $ILAST IF $ILENGTH < 45 THEN IF $BLEFTMOST THEN $I = $IPIVOT_LEFT WHILE $I < $IPIVOT_RIGHT $J = $I $IAI = $AARRAY [$I + 1 ] WHILE $IAI < $AARRAY [$J ] $AARRAY [$J + 1 ] = $AARRAY [$J ] $J -= 1 IF $J + 1 = $IPIVOT_LEFT THEN EXITLOOP WEND $AARRAY [$J + 1 ] = $IAI $I += 1 WEND ELSE WHILE 1 IF $IPIVOT_LEFT >= $IPIVOT_RIGHT THEN RETURN 1 $IPIVOT_LEFT += 1 IF $AARRAY [$IPIVOT_LEFT ] < $AARRAY [$IPIVOT_LEFT + 4294967295 ] THEN EXITLOOP WEND WHILE 1 $K = $IPIVOT_LEFT $IPIVOT_LEFT += 1 IF $IPIVOT_LEFT > $IPIVOT_RIGHT THEN EXITLOOP $IA1 = $AARRAY [$K ] $IA2 = $AARRAY [$IPIVOT_LEFT ] IF $IA1 < $IA2 THEN $IA2 = $IA1 $IA1 = $AARRAY [$IPIVOT_LEFT ] ENDIF $K -= 1 WHILE $IA1 < $AARRAY [$K ] $AARRAY [$K + 2 ] = $AARRAY [$K ] $K -= 1 WEND $AARRAY [$K + 2 ] = $IA1 WHILE $IA2 < $AARRAY [$K ] $AARRAY [$K + 1 ] = $AARRAY [$K ] $K -= 1 WEND $AARRAY [$K + 1 ] = $IA2 $IPIVOT_LEFT += 1 WEND $ILAST = $AARRAY [$IPIVOT_RIGHT ] $IPIVOT_RIGHT -= 1 WHILE $ILAST < $AARRAY [$IPIVOT_RIGHT ] $AARRAY [$IPIVOT_RIGHT + 1 ] = $AARRAY [$IPIVOT_RIGHT ] $IPIVOT_RIGHT -= 1 WEND $AARRAY [$IPIVOT_RIGHT + 1 ] = $ILAST ENDIF RETURN 1 ENDIF LOCAL $ISEVENTH = BITSHIFT ($ILENGTH , 3 ) + BITSHIFT ($ILENGTH , 6 ) + 1 LOCAL $IE1 , $IE2 , $IE3 , $IE4 , $IE5 , $T $IE3 = CEILING (($IPIVOT_LEFT + $IPIVOT_RIGHT ) / 2 ) $IE2 = $IE3 - $ISEVENTH $IE1 = $IE2 - $ISEVENTH $IE4 = $IE3 + $ISEVENTH $IE5 = $IE4 + $ISEVENTH IF $AARRAY [$IE2 ] < $AARRAY [$IE1 ] THEN $T = $AARRAY [$IE2 ] $AARRAY [$IE2 ] = $AARRAY [$IE1 ] $AARRAY [$IE1 ] = $T ENDIF IF $AARRAY [$IE3 ] < $AARRAY [$IE2 ] THEN $T = $AARRAY [$IE3 ] $AARRAY [$IE3 ] = $AARRAY [$IE2 ] $AARRAY [$IE2 ] = $T IF $T < $AARRAY [$IE1 ] THEN $AARRAY [$IE2 ] = $AARRAY [$IE1 ] $AARRAY [$IE1 ] = $T ENDIF ENDIF IF $AARRAY [$IE4 ] < $AARRAY [$IE3 ] THEN $T = $AARRAY [$IE4 ] $AARRAY [$IE4 ] = $AARRAY [$IE3 ] $AARRAY [$IE3 ] = $T IF $T < $AARRAY [$IE2 ] THEN $AARRAY [$IE3 ] = $AARRAY [$IE2 ] $AARRAY [$IE2 ] = $T IF $T < $AARRAY [$IE1 ] THEN $AARRAY [$IE2 ] = $AARRAY [$IE1 ] $AARRAY [$IE1 ] = $T ENDIF ENDIF ENDIF IF $AARRAY [$IE5 ] < $AARRAY [$IE4 ] THEN $T = $AARRAY [$IE5 ] $AARRAY [$IE5 ] = $AARRAY [$IE4 ] $AARRAY [$IE4 ] = $T IF $T < $AARRAY [$IE3 ] THEN $AARRAY [$IE4 ] = $AARRAY [$IE3 ] $AARRAY [$IE3 ] = $T IF $T < $AARRAY [$IE2 ] THEN $AARRAY [$IE3 ] = $AARRAY [$IE2 ] $AARRAY [$IE2 ] = $T IF $T < $AARRAY [$IE1 ] THEN $AARRAY [$IE2 ] = $AARRAY [$IE1 ] $AARRAY [$IE1 ] = $T ENDIF ENDIF ENDIF ENDIF LOCAL $ILESS = $IPIVOT_LEFT LOCAL $IGREATER = $IPIVOT_RIGHT IF (($AARRAY [$IE1 ] <> $AARRAY [$IE2 ] ) AND ($AARRAY [$IE2 ] <> $AARRAY [$IE3 ] ) AND ($AARRAY [$IE3 ] <> $AARRAY [$IE4 ] ) AND ($AARRAY [$IE4 ] <> $AARRAY [$IE5 ] ) ) THEN LOCAL $IPIVOT_1 = $AARRAY [$IE2 ] LOCAL $IPIVOT_2 = $AARRAY [$IE4 ] $AARRAY [$IE2 ] = $AARRAY [$IPIVOT_LEFT ] $AARRAY [$IE4 ] = $AARRAY [$IPIVOT_RIGHT ] DO $ILESS += 1 UNTIL $AARRAY [$ILESS ] >= $IPIVOT_1 DO $IGREATER -= 1 UNTIL $AARRAY [$IGREATER ] <= $IPIVOT_2 $K = $ILESS WHILE $K <= $IGREATER $IAK = $AARRAY [$K ] IF $IAK < $IPIVOT_1 THEN $AARRAY [$K ] = $AARRAY [$ILESS ] $AARRAY [$ILESS ] = $IAK $ILESS += 1 ELSEIF $IAK > $IPIVOT_2 THEN WHILE $AARRAY [$IGREATER ] > $IPIVOT_2 $IGREATER -= 1 IF $IGREATER + 1 = $K THEN EXITLOOP 2 WEND IF $AARRAY [$IGREATER ] < $IPIVOT_1 THEN $AARRAY [$K ] = $AARRAY [$ILESS ] $AARRAY [$ILESS ] = $AARRAY [$IGREATER ] $ILESS += 1 ELSE $AARRAY [$K ] = $AARRAY [$IGREATER ] ENDIF $AARRAY [$IGREATER ] = $IAK $IGREATER -= 1 ENDIF $K += 1 WEND $AARRAY [$IPIVOT_LEFT ] = $AARRAY [$ILESS + 4294967295 ] $AARRAY [$ILESS + 4294967295 ] = $IPIVOT_1 $AARRAY [$IPIVOT_RIGHT ] = $AARRAY [$IGREATER + 1 ] $AARRAY [$IGREATER + 1 ] = $IPIVOT_2 __ARRAYDUALPIVOTSORT ($AARRAY , $IPIVOT_LEFT , $ILESS + 4294967294 , TRUE ) __ARRAYDUALPIVOTSORT ($AARRAY , $IGREATER + 2 , $IPIVOT_RIGHT , FALSE ) IF ($ILESS < $IE1 ) AND ($IE5 < $IGREATER ) THEN WHILE $AARRAY [$ILESS ] = $IPIVOT_1 $ILESS += 1 WEND WHILE $AARRAY [$IGREATER ] = $IPIVOT_2 $IGREATER -= 1 WEND $K = $ILESS WHILE $K <= $IGREATER $IAK = $AARRAY [$K ] IF $IAK = $IPIVOT_1 THEN $AARRAY [$K ] = $AARRAY [$ILESS ] $AARRAY [$ILESS ] = $IAK $ILESS += 1 ELSEIF $IAK = $IPIVOT_2 THEN WHILE $AARRAY [$IGREATER ] = $IPIVOT_2 $IGREATER -= 1 IF $IGREATER + 1 = $K THEN EXITLOOP 2 WEND IF $AARRAY [$IGREATER ] = $IPIVOT_1 THEN $AARRAY [$K ] = $AARRAY [$ILESS ] $AARRAY [$ILESS ] = $IPIVOT_1 $ILESS += 1 ELSE $AARRAY [$K ] = $AARRAY [$IGREATER ] ENDIF $AARRAY [$IGREATER ] = $IAK $IGREATER -= 1 ENDIF $K += 1 WEND ENDIF __ARRAYDUALPIVOTSORT ($AARRAY , $ILESS , $IGREATER , FALSE ) ELSE LOCAL $IPIVOT = $AARRAY [$IE3 ] $K = $ILESS WHILE $K <= $IGREATER IF $AARRAY [$K ] = $IPIVOT THEN $K += 1 CONTINUELOOP ENDIF $IAK = $AARRAY [$K ] IF $IAK < $IPIVOT THEN $AARRAY [$K ] = $AARRAY [$ILESS ] $AARRAY [$ILESS ] = $IAK $ILESS += 1 ELSE WHILE $AARRAY [$IGREATER ] > $IPIVOT $IGREATER -= 1 WEND IF $AARRAY [$IGREATER ] < $IPIVOT THEN $AARRAY [$K ] = $AARRAY [$ILESS ] $AARRAY [$ILESS ] = $AARRAY [$IGREATER ] $ILESS += 1 ELSE $AARRAY [$K ] = $IPIVOT ENDIF $AARRAY [$IGREATER ] = $IAK $IGREATER -= 1 ENDIF $K += 1 WEND __ARRAYDUALPIVOTSORT ($AARRAY , $IPIVOT_LEFT , $ILESS + 4294967295 , TRUE ) __ARRAYDUALPIVOTSORT ($AARRAY , $IGREATER + 1 , $IPIVOT_RIGHT , FALSE ) ENDIF ENDFUNC FUNC _ARRAYSWAP (BYREF $AARRAY , $IINDEX_1 , $IINDEX_2 , $BCOL = FALSE , $ISTART = + 4294967295 , $IEND = + 4294967295 ) IF $BCOL = DEFAULT THEN $BCOL = FALSE IF $ISTART = DEFAULT THEN $ISTART = + 4294967295 IF $IEND = DEFAULT THEN $IEND = + 4294967295 IF NOT ISARRAY ($AARRAY ) THEN RETURN SETERROR (1 , 0 , + 4294967295 ) LOCAL $IDIM_1 = UBOUND ($AARRAY , $UBOUND_ROWS ) + 4294967295 LOCAL $IDIM_2 = UBOUND ($AARRAY , $UBOUND_COLUMNS ) + 4294967295 IF $IDIM_2 = + 4294967295 THEN $BCOL = FALSE $ISTART = + 4294967295 $IEND = + 4294967295 ENDIF IF $ISTART > $IEND THEN RETURN SETERROR (5 , 0 , + 4294967295 ) IF $BCOL THEN IF $IINDEX_1 < 0 OR $IINDEX_2 > $IDIM_2 THEN RETURN SETERROR (3 , 0 , + 4294967295 ) IF $ISTART = + 4294967295 THEN $ISTART = 0 IF $IEND = + 4294967295 THEN $IEND = $IDIM_1 ELSE IF $IINDEX_1 < 0 OR $IINDEX_2 > $IDIM_1 THEN RETURN SETERROR (3 , 0 , + 4294967295 ) IF $ISTART = + 4294967295 THEN $ISTART = 0 IF $IEND = + 4294967295 THEN $IEND = $IDIM_2 ENDIF LOCAL $VTMP SWITCH UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) CASE 1 $VTMP = $AARRAY [$IINDEX_1 ] $AARRAY [$IINDEX_1 ] = $AARRAY [$IINDEX_2 ] $AARRAY [$IINDEX_2 ] = $VTMP CASE 2 IF $ISTART < + 4294967295 OR $IEND < + 4294967295 THEN RETURN SETERROR (4 , 0 , + 4294967295 ) IF $BCOL THEN IF $ISTART > $IDIM_1 OR $IEND > $IDIM_1 THEN RETURN SETERROR (4 , 0 , + 4294967295 ) FOR $J = $ISTART TO $IEND $VTMP = $AARRAY [$J ] [$IINDEX_1 ] $AARRAY [$J ] [$IINDEX_1 ] = $AARRAY [$J ] [$IINDEX_2 ] $AARRAY [$J ] [$IINDEX_2 ] = $VTMP NEXT ELSE IF $ISTART > $IDIM_2 OR $IEND > $IDIM_2 THEN RETURN SETERROR (4 , 0 , + 4294967295 ) FOR $J = $ISTART TO $IEND $VTMP = $AARRAY [$IINDEX_1 ] [$J ] $AARRAY [$IINDEX_1 ] [$J ] = $AARRAY [$IINDEX_2 ] [$J ] $AARRAY [$IINDEX_2 ] [$J ] = $VTMP NEXT ENDIF CASE ELSE RETURN SETERROR (2 , 0 , + 4294967295 ) ENDSWITCH RETURN 1 ENDFUNC FUNC _ARRAYTOCLIP (CONST BYREF $AARRAY , $SDELIM_COL = "|" , $ISTART_ROW = + 4294967295 , $IEND_ROW = + 4294967295 , $SDELIM_ROW = @CRLF , $ISTART_COL = + 4294967295 , $IEND_COL = + 4294967295 ) LOCAL $SRESULT = _ARRAYTOSTRING ($AARRAY , $SDELIM_COL , $ISTART_ROW , $IEND_ROW , $SDELIM_ROW , $ISTART_COL , $IEND_COL ) IF @ERROR THEN RETURN SETERROR (@ERROR , 0 , 0 ) IF CLIPPUT ($SRESULT ) THEN RETURN 1 RETURN SETERROR (+ 4294967295 , 0 , 0 ) ENDFUNC FUNC _ARRAYTOSTRING (CONST BYREF $AARRAY , $SDELIM_COL = "|" , $ISTART_ROW = + 4294967295 , $IEND_ROW = + 4294967295 , $SDELIM_ROW = @CRLF , $ISTART_COL = + 4294967295 , $IEND_COL = + 4294967295 ) IF $SDELIM_COL = DEFAULT THEN $SDELIM_COL = "|" IF $SDELIM_ROW = DEFAULT THEN $SDELIM_ROW = @CRLF IF $ISTART_ROW = DEFAULT THEN $ISTART_ROW = + 4294967295 IF $IEND_ROW = DEFAULT THEN $IEND_ROW = + 4294967295 IF $ISTART_COL = DEFAULT THEN $ISTART_COL = + 4294967295 IF $IEND_COL = DEFAULT THEN $IEND_COL = + 4294967295 IF NOT ISARRAY ($AARRAY ) THEN RETURN SETERROR (1 , 0 , + 4294967295 ) LOCAL $IDIM_1 = UBOUND ($AARRAY , $UBOUND_ROWS ) + 4294967295 IF $ISTART_ROW = + 4294967295 THEN $ISTART_ROW = 0 IF $IEND_ROW = + 4294967295 THEN $IEND_ROW = $IDIM_1 IF $ISTART_ROW < + 4294967295 OR $IEND_ROW < + 4294967295 THEN RETURN SETERROR (3 , 0 , + 4294967295 ) IF $ISTART_ROW > $IDIM_1 OR $IEND_ROW > $IDIM_1 THEN RETURN SETERROR (3 , 0 , "" ) IF $ISTART_ROW > $IEND_ROW THEN RETURN SETERROR (4 , 0 , + 4294967295 ) LOCAL $SRET = "" SWITCH UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) CASE 1 FOR $I = $ISTART_ROW TO $IEND_ROW $SRET &= $AARRAY [$I ] & $SDELIM_COL NEXT RETURN STRINGTRIMRIGHT ($SRET , STRINGLEN ($SDELIM_COL ) ) CASE 2 LOCAL $IDIM_2 = UBOUND ($AARRAY , $UBOUND_COLUMNS ) + 4294967295 IF $ISTART_COL = + 4294967295 THEN $ISTART_COL = 0 IF $IEND_COL = + 4294967295 THEN $IEND_COL = $IDIM_2 IF $ISTART_COL < + 4294967295 OR $IEND_COL < + 4294967295 THEN RETURN SETERROR (5 , 0 , + 4294967295 ) IF $ISTART_COL > $IDIM_2 OR $IEND_COL > $IDIM_2 THEN RETURN SETERROR (5 , 0 , + 4294967295 ) IF $ISTART_COL > $IEND_COL THEN RETURN SETERROR (6 , 0 , + 4294967295 ) FOR $I = $ISTART_ROW TO $IEND_ROW FOR $J = $ISTART_COL TO $IEND_COL $SRET &= $AARRAY [$I ] [$J ] & $SDELIM_COL NEXT $SRET = STRINGTRIMRIGHT ($SRET , STRINGLEN ($SDELIM_COL ) ) & $SDELIM_ROW NEXT RETURN STRINGTRIMRIGHT ($SRET , STRINGLEN ($SDELIM_ROW ) ) CASE ELSE RETURN SETERROR (2 , 0 , + 4294967295 ) ENDSWITCH RETURN 1 ENDFUNC FUNC _ARRAYTRANSPOSE (BYREF $AARRAY ) SWITCH UBOUND ($AARRAY , 0 ) CASE 0 RETURN SETERROR (2 , 0 , 0 ) CASE 1 LOCAL $ATEMP [1 ] [UBOUND ($AARRAY ) ] FOR $I = 0 TO UBOUND ($AARRAY ) + 4294967295 $ATEMP [0 ] [$I ] = $AARRAY [$I ] NEXT $AARRAY = $ATEMP CASE 2 LOCAL $IDIM_1 = UBOUND ($AARRAY , 1 ) , $IDIM_2 = UBOUND ($AARRAY , 2 ) IF $IDIM_1 <> $IDIM_2 THEN LOCAL $ATEMP [$IDIM_2 ] [$IDIM_1 ] FOR $I = 0 TO $IDIM_1 + 4294967295 FOR $J = 0 TO $IDIM_2 + 4294967295 $ATEMP [$J ] [$I ] = $AARRAY [$I ] [$J ] NEXT NEXT $AARRAY = $ATEMP ELSE LOCAL $VELEMENT FOR $I = 0 TO $IDIM_1 + 4294967295 FOR $J = $I + 1 TO $IDIM_2 + 4294967295 $VELEMENT = $AARRAY [$I ] [$J ] $AARRAY [$I ] [$J ] = $AARRAY [$J ] [$I ] $AARRAY [$J ] [$I ] = $VELEMENT NEXT NEXT ENDIF CASE ELSE RETURN SETERROR (1 , 0 , 0 ) ENDSWITCH RETURN 1 ENDFUNC FUNC _ARRAYTRIM (BYREF $AARRAY , $ITRIMNUM , $IDIRECTION = 0 , $ISTART = 0 , $IEND = 0 , $ISUBITEM = 0 ) IF $IDIRECTION = DEFAULT THEN $IDIRECTION = 0 IF $ISTART = DEFAULT THEN $ISTART = 0 IF $IEND = DEFAULT THEN $IEND = 0 IF $ISUBITEM = DEFAULT THEN $ISUBITEM = 0 IF NOT ISARRAY ($AARRAY ) THEN RETURN SETERROR (1 , 0 , 0 ) LOCAL $IDIM_1 = UBOUND ($AARRAY , $UBOUND_ROWS ) + 4294967295 IF $IEND = 0 THEN $IEND = $IDIM_1 IF $ISTART > $IEND THEN RETURN SETERROR (3 , 0 , + 4294967295 ) IF $ISTART < 0 OR $IEND < 0 THEN RETURN SETERROR (3 , 0 , + 4294967295 ) IF $ISTART > $IDIM_1 OR $IEND > $IDIM_1 THEN RETURN SETERROR (3 , 0 , + 4294967295 ) IF $ISTART > $IEND THEN RETURN SETERROR (4 , 0 , + 4294967295 ) SWITCH UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) CASE 1 IF $IDIRECTION THEN FOR $I = $ISTART TO $IEND $AARRAY [$I ] = STRINGTRIMRIGHT ($AARRAY [$I ] , $ITRIMNUM ) NEXT ELSE FOR $I = $ISTART TO $IEND $AARRAY [$I ] = STRINGTRIMLEFT ($AARRAY [$I ] , $ITRIMNUM ) NEXT ENDIF CASE 2 LOCAL $IDIM_2 = UBOUND ($AARRAY , $UBOUND_COLUMNS ) + 4294967295 IF $ISUBITEM < 0 OR $ISUBITEM > $IDIM_2 THEN RETURN SETERROR (5 , 0 , + 4294967295 ) IF $IDIRECTION THEN FOR $I = $ISTART TO $IEND $AARRAY [$I ] [$ISUBITEM ] = STRINGTRIMRIGHT ($AARRAY [$I ] [$ISUBITEM ] , $ITRIMNUM ) NEXT ELSE FOR $I = $ISTART TO $IEND $AARRAY [$I ] [$ISUBITEM ] = STRINGTRIMLEFT ($AARRAY [$I ] [$ISUBITEM ] , $ITRIMNUM ) NEXT ENDIF CASE ELSE RETURN SETERROR (2 , 0 , 0 ) ENDSWITCH RETURN 1 ENDFUNC FUNC _ARRAYUNIQUE (CONST BYREF $AARRAY , $ICOLUMN = 0 , $IBASE = 0 , $ICASE = 0 , $ICOUNT = $ARRAYUNIQUE_COUNT , $IINTTYPE = $ARRAYUNIQUE_AUTO ) IF $ICOLUMN = DEFAULT THEN $ICOLUMN = 0 IF $IBASE = DEFAULT THEN $IBASE = 0 IF $ICASE = DEFAULT THEN $ICASE = 0 IF $ICOUNT = DEFAULT THEN $ICOUNT = $ARRAYUNIQUE_COUNT IF UBOUND ($AARRAY , $UBOUND_ROWS ) = 0 THEN RETURN SETERROR (1 , 0 , 0 ) LOCAL $IDIMS = UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) , $INUMCOLUMNS = UBOUND ($AARRAY , $UBOUND_COLUMNS ) IF $IDIMS > 2 THEN RETURN SETERROR (2 , 0 , 0 ) IF $IBASE < 0 OR $IBASE > 1 OR (NOT ISINT ($IBASE ) ) THEN RETURN SETERROR (3 , 0 , 0 ) IF $ICASE < 0 OR $ICASE > 1 OR (NOT ISINT ($ICASE ) ) THEN RETURN SETERROR (3 , 0 , 0 ) IF $ICOUNT < 0 OR $ICOUNT > 1 OR (NOT ISINT ($ICOUNT ) ) THEN RETURN SETERROR (4 , 0 , 0 ) IF $IINTTYPE < 0 OR $IINTTYPE > 4 OR (NOT ISINT ($IINTTYPE ) ) THEN RETURN SETERROR (5 , 0 , 0 ) IF $ICOLUMN < 0 OR ($INUMCOLUMNS = 0 AND $ICOLUMN > 0 ) OR ($INUMCOLUMNS > 0 AND $ICOLUMN >= $INUMCOLUMNS ) THEN RETURN SETERROR (6 , 0 , 0 ) IF $IINTTYPE = $ARRAYUNIQUE_AUTO THEN LOCAL $BINT , $SVARTYPE IF $IDIMS = 1 THEN $BINT = ISINT ($AARRAY [$IBASE ] ) $SVARTYPE = VARGETTYPE ($AARRAY [$IBASE ] ) ELSE $BINT = ISINT ($AARRAY [$IBASE ] [$ICOLUMN ] ) $SVARTYPE = VARGETTYPE ($AARRAY [$IBASE ] [$ICOLUMN ] ) ENDIF IF $BINT AND $SVARTYPE = "Int64" THEN $IINTTYPE = $ARRAYUNIQUE_FORCE64 ELSE $IINTTYPE = $ARRAYUNIQUE_FORCE32 ENDIF ENDIF OBJEVENT ("AutoIt.Error" , __ARRAYUNIQUE_AUTOERRFUNC ) LOCAL $ODICTIONARY = OBJCREATE ("Scripting.Dictionary" ) $ODICTIONARY.CompareMode = NUMBER (NOT $ICASE ) LOCAL $VELEM , $STYPE , $VKEY , $BCOMERROR = FALSE FOR $I = $IBASE TO UBOUND ($AARRAY ) + 4294967295 IF $IDIMS = 1 THEN $VELEM = $AARRAY [$I ] ELSE $VELEM = $AARRAY [$I ] [$ICOLUMN ] ENDIF SWITCH $IINTTYPE CASE $ARRAYUNIQUE_FORCE32 $ODICTIONARY.Item ($VELEM ) IF @ERROR THEN $BCOMERROR = TRUE EXITLOOP ENDIF CASE $ARRAYUNIQUE_FORCE64 $STYPE = VARGETTYPE ($VELEM ) IF $STYPE = "Int32" THEN $BCOMERROR = TRUE EXITLOOP ENDIF $VKEY = "#" & $STYPE & "#" & STRING ($VELEM ) IF NOT $ODICTIONARY.Item ($VKEY ) THEN $ODICTIONARY ($VKEY ) = $VELEM ENDIF CASE $ARRAYUNIQUE_MATCH $STYPE = VARGETTYPE ($VELEM ) IF STRINGLEFT ($STYPE , 3 ) = "Int" THEN $VKEY = "#Int#" & STRING ($VELEM ) ELSE $VKEY = "#" & $STYPE & "#" & STRING ($VELEM ) ENDIF IF NOT $ODICTIONARY.Item ($VKEY ) THEN $ODICTIONARY ($VKEY ) = $VELEM ENDIF CASE $ARRAYUNIQUE_DISTINCT $VKEY = "#" & VARGETTYPE ($VELEM ) & "#" & STRING ($VELEM ) IF NOT $ODICTIONARY.Item ($VKEY ) THEN $ODICTIONARY ($VKEY ) = $VELEM ENDIF ENDSWITCH NEXT LOCAL $AVALUES , $J = 0 IF $BCOMERROR THEN RETURN SETERROR (7 , 0 , 0 ) ELSEIF $IINTTYPE <> $ARRAYUNIQUE_FORCE32 THEN LOCAL $AVALUES [$ODICTIONARY.Count ] FOR $VKEY IN $ODICTIONARY.Keys () $AVALUES [$J ] = $ODICTIONARY ($VKEY ) IF STRINGLEFT ($VKEY , 5 ) = "#Ptr#" THEN $AVALUES [$J ] = PTR ($AVALUES [$J ] ) ENDIF $J += 1 NEXT ELSE $AVALUES = $ODICTIONARY.Keys () ENDIF IF $ICOUNT THEN _ARRAYINSERT ($AVALUES , 0 , $ODICTIONARY.Count ) ENDIF RETURN $AVALUES ENDFUNC FUNC _ARRAY1DTOHISTOGRAM ($AARRAY , $ISIZING = 100 ) IF UBOUND ($AARRAY , 0 ) > 1 THEN RETURN SETERROR (1 , 0 , "" ) $ISIZING = $ISIZING * 8 LOCAL $T , $N , $IMIN = 0 , $IMAX = 0 , $IOFFSET = 0 FOR $I = 0 TO UBOUND ($AARRAY ) + 4294967295 $T = $AARRAY [$I ] $T = ISNUMBER ($T ) ROUND ($T ) 0 IF $T < $IMIN THEN $IMIN = $T IF $T > $IMAX THEN $IMAX = $T NEXT LOCAL $IRANGE = INT (ROUND (($IMAX - $IMIN ) / 8 ) ) * 8 LOCAL $ISPACERATIO = 4 FOR $I = 0 TO UBOUND ($AARRAY ) + 4294967295 $T = $AARRAY [$I ] IF $T THEN $N = ABS (ROUND (($ISIZING * $T ) / $IRANGE ) / 8 ) $AARRAY [$I ] = "" IF $T > 0 THEN IF $IMIN THEN $IOFFSET = INT (ABS (ROUND (($ISIZING * $IMIN ) / $IRANGE ) / 8 ) / 8 * $ISPACERATIO ) $AARRAY [$I ] = __ARRAY_STRINGREPEAT (CHRW (32 ) , $IOFFSET ) ENDIF ELSE IF $IMIN <> $T THEN $IOFFSET = INT (ABS (ROUND (($ISIZING * ($T - $IMIN ) ) / $IRANGE ) / 8 ) / 8 * $ISPACERATIO ) $AARRAY [$I ] = __ARRAY_STRINGREPEAT (CHRW (32 ) , $IOFFSET ) ENDIF ENDIF $AARRAY [$I ] &= __ARRAY_STRINGREPEAT (CHRW (9608 ) , INT ($N / 8 ) ) $N = MOD ($N , 8 ) IF $N > 0 THEN $AARRAY [$I ] &= CHRW (9608 + 8 - $N ) $AARRAY [$I ] &= " " & $T ELSE $AARRAY [$I ] = "" ENDIF NEXT RETURN $AARRAY ENDFUNC FUNC __ARRAY_STRINGREPEAT ($SSTRING , $IREPEATCOUNT ) $IREPEATCOUNT = INT ($IREPEATCOUNT ) IF STRINGLEN ($SSTRING ) < 1 OR $IREPEATCOUNT <= 0 THEN RETURN SETERROR (1 , 0 , "" ) LOCAL $SRESULT = "" WHILE $IREPEATCOUNT > 1 IF BITAND ($IREPEATCOUNT , 1 ) THEN $SRESULT &= $SSTRING $SSTRING &= $SSTRING $IREPEATCOUNT = BITSHIFT ($IREPEATCOUNT , 1 ) WEND RETURN $SSTRING & $SRESULT ENDFUNC FUNC __ARRAY_EXETERINTERNAL (BYREF $AARRAY , $ISTART , $ISIZE , $SDELIMITER , BYREF $AIDX , BYREF $ARESULT , BYREF $ICOUNT ) IF $ISTART == $ISIZE + 4294967295 THEN FOR $I = 0 TO $ISIZE + 4294967295 $ARESULT [$ICOUNT ] &= $AARRAY [$AIDX [$I ] ] & $SDELIMITER NEXT IF $SDELIMITER <> "" THEN $ARESULT [$ICOUNT ] = STRINGTRIMRIGHT ($ARESULT [$ICOUNT ] , STRINGLEN ($SDELIMITER ) ) $ICOUNT += 1 ELSE LOCAL $ITEMP FOR $I = $ISTART TO $ISIZE + 4294967295 $ITEMP = $AIDX [$I ] $AIDX [$I ] = $AIDX [$ISTART ] $AIDX [$ISTART ] = $ITEMP __ARRAY_EXETERINTERNAL ($AARRAY , $ISTART + 1 , $ISIZE , $SDELIMITER , $AIDX , $ARESULT , $ICOUNT ) $AIDX [$ISTART ] = $AIDX [$I ] $AIDX [$I ] = $ITEMP NEXT ENDIF ENDFUNC FUNC __ARRAY_COMBINATIONS ($IN , $IR ) LOCAL $I_TOTAL = 1 FOR $I = $IR TO 1 STEP + 4294967295 $I_TOTAL *= ($IN / $I ) $IN -= 1 NEXT RETURN ROUND ($I_TOTAL ) ENDFUNC FUNC __ARRAY_GETNEXT ($IN , $IR , BYREF $ILEFT , $ITOTAL , BYREF $AIDX ) IF $ILEFT == $ITOTAL THEN $ILEFT -= 1 RETURN ENDIF LOCAL $I = $IR + 4294967295 WHILE $AIDX [$I ] == $IN - $IR + $I $I -= 1 WEND $AIDX [$I ] += 1 FOR $J = $I + 1 TO $IR + 4294967295 $AIDX [$J ] = $AIDX [$I ] + $J - $I NEXT $ILEFT -= 1 ENDFUNC FUNC __ARRAY_MINMAXINDEX (CONST BYREF $AARRAY , $ICOMPNUMERIC , $ISTART , $IEND , $ISUBITEM , $FUCOMPARISON ) IF $ICOMPNUMERIC = DEFAULT THEN $ICOMPNUMERIC = 0 IF $ICOMPNUMERIC <> 1 THEN $ICOMPNUMERIC = 0 IF $ISTART = DEFAULT THEN $ISTART = 0 IF $IEND = DEFAULT THEN $IEND = 0 IF $ISUBITEM = DEFAULT THEN $ISUBITEM = 0 IF NOT ISARRAY ($AARRAY ) THEN RETURN SETERROR (1 , 0 , + 4294967295 ) LOCAL $IDIM_1 = UBOUND ($AARRAY , $UBOUND_ROWS ) + 4294967295 IF $IDIM_1 < 0 THEN RETURN SETERROR (1 , 0 , + 4294967295 ) IF $IEND = + 4294967295 THEN $IEND = $IDIM_1 IF $ISTART = + 4294967295 THEN $ISTART = 0 IF $ISTART < + 4294967295 OR $IEND < + 4294967295 THEN RETURN SETERROR (3 , 0 , + 4294967295 ) IF $ISTART > $IDIM_1 OR $IEND > $IDIM_1 THEN RETURN SETERROR (3 , 0 , + 4294967295 ) IF $ISTART > $IEND THEN RETURN SETERROR (4 , 0 , + 4294967295 ) IF $IDIM_1 < 0 THEN RETURN SETERROR (5 , 0 , + 4294967295 ) LOCAL $IMAXMININDEX = $ISTART SWITCH UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) CASE 1 IF $ICOMPNUMERIC THEN FOR $I = $ISTART TO $IEND IF $FUCOMPARISON (NUMBER ($AARRAY [$I ] ) , NUMBER ($AARRAY [$IMAXMININDEX ] ) ) THEN $IMAXMININDEX = $I NEXT ELSE FOR $I = $ISTART TO $IEND IF $FUCOMPARISON ($AARRAY [$I ] , $AARRAY [$IMAXMININDEX ] ) THEN $IMAXMININDEX = $I NEXT ENDIF CASE 2 IF $ISUBITEM < 0 OR $ISUBITEM > UBOUND ($AARRAY , $UBOUND_COLUMNS ) + 4294967295 THEN RETURN SETERROR (6 , 0 , + 4294967295 ) IF $ICOMPNUMERIC THEN FOR $I = $ISTART TO $IEND IF $FUCOMPARISON (NUMBER ($AARRAY [$I ] [$ISUBITEM ] ) , NUMBER ($AARRAY [$IMAXMININDEX ] [$ISUBITEM ] ) ) THEN $IMAXMININDEX = $I NEXT ELSE FOR $I = $ISTART TO $IEND IF $FUCOMPARISON ($AARRAY [$I ] [$ISUBITEM ] , $AARRAY [$IMAXMININDEX ] [$ISUBITEM ] ) THEN $IMAXMININDEX = $I NEXT ENDIF CASE ELSE RETURN SETERROR (2 , 0 , + 4294967295 ) ENDSWITCH RETURN $IMAXMININDEX ENDFUNC FUNC __ARRAY_GREATERTHAN ($VVALUE1 , $VVALUE2 ) RETURN $VVALUE1 > $VVALUE2 ENDFUNC FUNC __ARRAY_LESSTHAN ($VVALUE1 , $VVALUE2 ) RETURN $VVALUE1 < $VVALUE2 ENDFUNC FUNC __ARRAYUNIQUE_AUTOERRFUNC () ENDFUNC GLOBAL CONST $FW_DONTCARE = 0 GLOBAL CONST $FW_THIN = 100 GLOBAL CONST $FW_EXTRALIGHT = 200 GLOBAL CONST $FW_ULTRALIGHT = 200 GLOBAL CONST $FW_LIGHT = 300 GLOBAL CONST $FW_NORMAL = 400 GLOBAL CONST $FW_REGULAR = 400 GLOBAL CONST $FW_MEDIUM = 500 GLOBAL CONST $FW_SEMIBOLD = 600 GLOBAL CONST $FW_DEMIBOLD = 600 GLOBAL CONST $FW_BOLD = 700 GLOBAL CONST $FW_EXTRABOLD = 800 GLOBAL CONST $FW_ULTRABOLD = 800 GLOBAL CONST $FW_HEAVY = 900 GLOBAL CONST $FW_BLACK = 900 GLOBAL CONST $CF_EFFECTS = 256 GLOBAL CONST $CF_PRINTERFONTS = 2 GLOBAL CONST $CF_SCREENFONTS = 1 GLOBAL CONST $CF_NOSCRIPTSEL = 8388608 GLOBAL CONST $CF_INITTOLOGFONTSTRUCT = 64 GLOBAL CONST $LOGPIXELSX = 88 GLOBAL CONST $LOGPIXELSY = 90 GLOBAL CONST $ANSI_CHARSET = 0 GLOBAL CONST $ARABIC_CHARSET = 178 GLOBAL CONST $BALTIC_CHARSET = 186 GLOBAL CONST $CHINESEBIG5_CHARSET = 136 GLOBAL CONST $DEFAULT_CHARSET = 1 GLOBAL CONST $EASTEUROPE_CHARSET = 238 GLOBAL CONST $GB2312_CHARSET = 134 GLOBAL CONST $GREEK_CHARSET = 161 GLOBAL CONST $HANGEUL_CHARSET = 129 GLOBAL CONST $HEBREW_CHARSET = 177 GLOBAL CONST $JOHAB_CHARSET = 130 GLOBAL CONST $MAC_CHARSET = 77 GLOBAL CONST $OEM_CHARSET = 255 GLOBAL CONST $RUSSIAN_CHARSET = 204 GLOBAL CONST $SHIFTJIS_CHARSET = 128 GLOBAL CONST $SYMBOL_CHARSET = 2 GLOBAL CONST $THAI_CHARSET = 222 GLOBAL CONST $TURKISH_CHARSET = 162 GLOBAL CONST $VIETNAMESE_CHARSET = 163 GLOBAL CONST $OUT_CHARACTER_PRECIS = 2 GLOBAL CONST $OUT_DEFAULT_PRECIS = 0 GLOBAL CONST $OUT_DEVICE_PRECIS = 5 GLOBAL CONST $OUT_OUTLINE_PRECIS = 8 GLOBAL CONST $OUT_PS_ONLY_PRECIS = 10 GLOBAL CONST $OUT_RASTER_PRECIS = 6 GLOBAL CONST $OUT_STRING_PRECIS = 1 GLOBAL CONST $OUT_STROKE_PRECIS = 3 GLOBAL CONST $OUT_TT_ONLY_PRECIS = 7 GLOBAL CONST $OUT_TT_PRECIS = 4 GLOBAL CONST $CLIP_CHARACTER_PRECIS = 1 GLOBAL CONST $CLIP_DEFAULT_PRECIS = 0 GLOBAL CONST $CLIP_DFA_DISABLE = 48 GLOBAL CONST $CLIP_EMBEDDED = 128 GLOBAL CONST $CLIP_LH_ANGLES = 16 GLOBAL CONST $CLIP_MASK = 15 GLOBAL CONST $CLIP_DFA_OVERRIDE = 64 GLOBAL CONST $CLIP_STROKE_PRECIS = 2 GLOBAL CONST $CLIP_TT_ALWAYS = 32 GLOBAL CONST $ANTIALIASED_QUALITY = 4 GLOBAL CONST $DEFAULT_QUALITY = 0 GLOBAL CONST $DRAFT_QUALITY = 1 GLOBAL CONST $NONANTIALIASED_QUALITY = 3 GLOBAL CONST $PROOF_QUALITY = 2 GLOBAL CONST $CLEARTYPE_QUALITY = 5 GLOBAL CONST $DEFAULT_PITCH = 0 GLOBAL CONST $FIXED_PITCH = 1 GLOBAL CONST $VARIABLE_PITCH = 2 GLOBAL CONST $FF_DECORATIVE = 80 GLOBAL CONST $FF_DONTCARE = 0 GLOBAL CONST $FF_MODERN = 48 GLOBAL CONST $FF_ROMAN = 16 GLOBAL CONST $FF_SCRIPT = 64 GLOBAL CONST $FF_SWISS = 32 GLOBAL CONST $FS_REGULAR = 0 GLOBAL CONST $FS_BOLD = 1 GLOBAL CONST $FS_ITALIC = 2 GLOBAL CONST $__MISCCONSTANT_CC_ANYCOLOR = 256 GLOBAL CONST $__MISCCONSTANT_CC_FULLOPEN = 2 GLOBAL CONST $__MISCCONSTANT_CC_RGBINIT = 1 GLOBAL CONST $TAGCHOOSECOLOR = "dword Size;hwnd hWndOwnder;handle hInstance;dword rgbResult;ptr CustColors;dword Flags;lparam lCustData;" & "ptr lpfnHook;ptr lpTemplateName" GLOBAL CONST $TAGCHOOSEFONT = "dword Size;hwnd hWndOwner;handle hDC;ptr LogFont;int PointSize;dword Flags;dword rgbColors;lparam CustData;" & "ptr fnHook;ptr TemplateName;handle hInstance;ptr szStyle;word FontType;int SizeMin;int SizeMax" FUNC _CHOOSECOLOR ($IRETURNTYPE = 0 , $ICOLORREF = 0 , $IREFTYPE = 0 , $HWNDOWNDER = 0 ) LOCAL $TAGCUSTCOLORS = "dword[16]" LOCAL $TCHOOSE = DLLSTRUCTCREATE ($TAGCHOOSECOLOR ) LOCAL $TCC = DLLSTRUCTCREATE ($TAGCUSTCOLORS ) IF $IREFTYPE = 1 THEN $ICOLORREF = INT ($ICOLORREF ) ELSEIF $IREFTYPE = 2 THEN $ICOLORREF = HEX (STRING ($ICOLORREF ) , 6 ) $ICOLORREF = "0x" & STRINGMID ($ICOLORREF , 5 , 2 ) & STRINGMID ($ICOLORREF , 3 , 2 ) & STRINGMID ($ICOLORREF , 1 , 2 ) ENDIF DLLSTRUCTSETDATA ($TCHOOSE , "Size" , DLLSTRUCTGETSIZE ($TCHOOSE ) ) DLLSTRUCTSETDATA ($TCHOOSE , "hWndOwnder" , $HWNDOWNDER ) DLLSTRUCTSETDATA ($TCHOOSE , "rgbResult" , $ICOLORREF ) DLLSTRUCTSETDATA ($TCHOOSE , "CustColors" , DLLSTRUCTGETPTR ($TCC ) ) DLLSTRUCTSETDATA ($TCHOOSE , "Flags" , BITOR ($__MISCCONSTANT_CC_ANYCOLOR , $__MISCCONSTANT_CC_FULLOPEN , $__MISCCONSTANT_CC_RGBINIT ) ) LOCAL $ARESULT = DLLCALL ("comdlg32.dll" , "bool" , "ChooseColor" , "struct*" , $TCHOOSE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , + 4294967295 ) IF $ARESULT [0 ] = 0 THEN RETURN SETERROR (+ 4294967293 , + 4294967293 , + 4294967295 ) LOCAL $SCOLOR_PICKED = DLLSTRUCTGETDATA ($TCHOOSE , "rgbResult" ) IF $IRETURNTYPE = 1 THEN RETURN "0x" & HEX (STRING ($SCOLOR_PICKED ) , 6 ) ELSEIF $IRETURNTYPE = 2 THEN $SCOLOR_PICKED = HEX (STRING ($SCOLOR_PICKED ) , 6 ) RETURN "0x" & STRINGMID ($SCOLOR_PICKED , 5 , 2 ) & STRINGMID ($SCOLOR_PICKED , 3 , 2 ) & STRINGMID ($SCOLOR_PICKED , 1 , 2 ) ELSEIF $IRETURNTYPE = 0 THEN RETURN $SCOLOR_PICKED ELSE RETURN SETERROR (+ 4294967292 , + 4294967292 , + 4294967295 ) ENDIF ENDFUNC FUNC _CHOOSEFONT ($SFONTNAME = "Courier New" , $IPOINTSIZE = 10 , $IFONTCOLORREF = 0 , $IFONTWEIGHT = 0 , $BITALIC = FALSE , $BUNDERLINE = FALSE , $BSTRIKETHRU = FALSE , $HWNDOWNER = 0 ) LOCAL $IITALIC = 0 , $IUNDERLINE = 0 , $ISTRIKEOUT = 0 $IFONTCOLORREF = BITOR (BITSHIFT (BITAND ($IFONTCOLORREF , 255 ) , + 4294967280 ) , BITAND ($IFONTCOLORREF , 65280 ) , BITSHIFT (BITAND ($IFONTCOLORREF , 16711680 ) , 16 ) ) LOCAL $HDC = __MISC_GETDC (0 ) LOCAL $IHEIGHT = ROUND (($IPOINTSIZE * __MISC_GETDEVICECAPS ($HDC , $LOGPIXELSX ) ) / 72 , 0 ) __MISC_RELEASEDC (0 , $HDC ) LOCAL $TCHOOSEFONT = DLLSTRUCTCREATE ($TAGCHOOSEFONT ) LOCAL $TLOGFONT = DLLSTRUCTCREATE ($TAGLOGFONT ) DLLSTRUCTSETDATA ($TCHOOSEFONT , "Size" , DLLSTRUCTGETSIZE ($TCHOOSEFONT ) ) DLLSTRUCTSETDATA ($TCHOOSEFONT , "hWndOwner" , $HWNDOWNER ) DLLSTRUCTSETDATA ($TCHOOSEFONT , "LogFont" , DLLSTRUCTGETPTR ($TLOGFONT ) ) DLLSTRUCTSETDATA ($TCHOOSEFONT , "PointSize" , $IPOINTSIZE ) DLLSTRUCTSETDATA ($TCHOOSEFONT , "Flags" , BITOR ($CF_SCREENFONTS , $CF_PRINTERFONTS , $CF_EFFECTS , $CF_INITTOLOGFONTSTRUCT , $CF_NOSCRIPTSEL ) ) DLLSTRUCTSETDATA ($TCHOOSEFONT , "rgbColors" , $IFONTCOLORREF ) DLLSTRUCTSETDATA ($TCHOOSEFONT , "FontType" , 0 ) DLLSTRUCTSETDATA ($TLOGFONT , "Height" , $IHEIGHT ) DLLSTRUCTSETDATA ($TLOGFONT , "Weight" , $IFONTWEIGHT ) DLLSTRUCTSETDATA ($TLOGFONT , "Italic" , $BITALIC ) DLLSTRUCTSETDATA ($TLOGFONT , "Underline" , $BUNDERLINE ) DLLSTRUCTSETDATA ($TLOGFONT , "Strikeout" , $BSTRIKETHRU ) DLLSTRUCTSETDATA ($TLOGFONT , "FaceName" , $SFONTNAME ) LOCAL $ARESULT = DLLCALL ("comdlg32.dll" , "bool" , "ChooseFontW" , "struct*" , $TCHOOSEFONT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , + 4294967295 ) IF $ARESULT [0 ] = 0 THEN RETURN SETERROR (+ 4294967293 , + 4294967293 , + 4294967295 ) LOCAL $SFACENAME = DLLSTRUCTGETDATA ($TLOGFONT , "FaceName" ) IF STRINGLEN ($SFACENAME ) = 0 AND STRINGLEN ($SFONTNAME ) > 0 THEN $SFACENAME = $SFONTNAME IF DLLSTRUCTGETDATA ($TLOGFONT , "Italic" ) THEN $IITALIC = 2 IF DLLSTRUCTGETDATA ($TLOGFONT , "Underline" ) THEN $IUNDERLINE = 4 IF DLLSTRUCTGETDATA ($TLOGFONT , "Strikeout" ) THEN $ISTRIKEOUT = 8 LOCAL $IATTRIBUTES = BITOR ($IITALIC , $IUNDERLINE , $ISTRIKEOUT ) LOCAL $ISIZE = DLLSTRUCTGETDATA ($TCHOOSEFONT , "PointSize" ) / 10 LOCAL $ICOLORREF = DLLSTRUCTGETDATA ($TCHOOSEFONT , "rgbColors" ) LOCAL $IWEIGHT = DLLSTRUCTGETDATA ($TLOGFONT , "Weight" ) LOCAL $SCOLOR_PICKED = HEX (STRING ($ICOLORREF ) , 6 ) RETURN STRINGSPLIT ($IATTRIBUTES & "," & $SFACENAME & "," & $ISIZE & "," & $IWEIGHT & "," & $ICOLORREF & "," & "0x" & $SCOLOR_PICKED & "," & "0x" & STRINGMID ($SCOLOR_PICKED , 5 , 2 ) & STRINGMID ($SCOLOR_PICKED , 3 , 2 ) & STRINGMID ($SCOLOR_PICKED , 1 , 2 ) , "," ) ENDFUNC FUNC _CLIPPUTFILE ($SFILEPATH , $SDELIMITER = "|" ) LOCAL CONST $GMEM_MOVEABLE = 2 , $CF_HDROP = 15 $SFILEPATH &= $SDELIMITER & $SDELIMITER LOCAL $NGLOBMEMSIZE = 2 * (STRINGLEN ($SFILEPATH ) + 20 ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "OpenClipboard" , "hwnd" , 0 ) IF @ERROR OR $ARESULT [0 ] = 0 THEN RETURN SETERROR (1 , _WINAPI_GETLASTERROR () , FALSE ) LOCAL $IERROR = 0 , $ILASTERROR = 0 $ARESULT = DLLCALL ("user32.dll" , "bool" , "EmptyClipboard" ) IF @ERROR OR NOT $ARESULT [0 ] THEN $IERROR = 2 $ILASTERROR = _WINAPI_GETLASTERROR () ELSE $ARESULT = DLLCALL ("kernel32.dll" , "handle" , "GlobalAlloc" , "uint" , $GMEM_MOVEABLE , "ulong_ptr" , $NGLOBMEMSIZE ) IF @ERROR OR NOT $ARESULT [0 ] THEN $IERROR = 3 $ILASTERROR = _WINAPI_GETLASTERROR () ELSE LOCAL $HGLOBAL = $ARESULT [0 ] $ARESULT = DLLCALL ("kernel32.dll" , "ptr" , "GlobalLock" , "handle" , $HGLOBAL ) IF @ERROR OR NOT $ARESULT [0 ] THEN $IERROR = 4 $ILASTERROR = _WINAPI_GETLASTERROR () ELSE LOCAL $HLOCK = $ARESULT [0 ] LOCAL $TDROPFILES = DLLSTRUCTCREATE ("dword pFiles;" & $TAGPOINT & ";bool fNC;bool fWide;wchar[" & STRINGLEN ($SFILEPATH ) + 1 & "]" , $HLOCK ) IF @ERROR THEN RETURN SETERROR (5 , 6 , FALSE ) LOCAL $TSTRUCT = DLLSTRUCTCREATE ("dword;long;long;bool;bool" ) DLLSTRUCTSETDATA ($TDROPFILES , "pFiles" , DLLSTRUCTGETSIZE ($TSTRUCT ) ) DLLSTRUCTSETDATA ($TDROPFILES , "X" , 0 ) DLLSTRUCTSETDATA ($TDROPFILES , "Y" , 0 ) DLLSTRUCTSETDATA ($TDROPFILES , "fNC" , 0 ) DLLSTRUCTSETDATA ($TDROPFILES , "fWide" , 1 ) DLLSTRUCTSETDATA ($TDROPFILES , 6 , $SFILEPATH ) FOR $I = 1 TO STRINGLEN ($SFILEPATH ) IF DLLSTRUCTGETDATA ($TDROPFILES , 6 , $I ) = $SDELIMITER THEN DLLSTRUCTSETDATA ($TDROPFILES , 6 , CHR (0 ) , $I ) NEXT $ARESULT = DLLCALL ("user32.dll" , "handle" , "SetClipboardData" , "uint" , $CF_HDROP , "handle" , $HGLOBAL ) IF @ERROR OR NOT $ARESULT [0 ] THEN $IERROR = 6 $ILASTERROR = _WINAPI_GETLASTERROR () ENDIF $ARESULT = DLLCALL ("kernel32.dll" , "bool" , "GlobalUnlock" , "handle" , $HGLOBAL ) IF (@ERROR OR NOT $ARESULT [0 ] ) AND NOT $IERROR AND _WINAPI_GETLASTERROR () THEN $IERROR = 8 $ILASTERROR = _WINAPI_GETLASTERROR () ENDIF ENDIF $ARESULT = DLLCALL ("kernel32.dll" , "ptr" , "GlobalFree" , "handle" , $HGLOBAL ) IF (@ERROR OR $ARESULT [0 ] ) AND NOT $IERROR THEN $IERROR = 9 $ILASTERROR = _WINAPI_GETLASTERROR () ENDIF ENDIF ENDIF $ARESULT = DLLCALL ("user32.dll" , "bool" , "CloseClipboard" ) IF (@ERROR OR NOT $ARESULT [0 ] ) AND NOT $IERROR THEN RETURN SETERROR (7 , _WINAPI_GETLASTERROR () , FALSE ) IF $IERROR THEN RETURN SETERROR ($IERROR , $ILASTERROR , FALSE ) RETURN TRUE ENDFUNC FUNC _MOUSETRAP ($ILEFT = 0 , $ITOP = 0 , $IRIGHT = 0 , $IBOTTOM = 0 ) LOCAL $ARETURN = 0 IF $ILEFT = DEFAULT THEN $ILEFT = 0 IF $ITOP = DEFAULT THEN $ITOP = 0 IF $IRIGHT = DEFAULT THEN $IRIGHT = 0 IF $IBOTTOM = DEFAULT THEN $IBOTTOM = 0 IF @NUMPARAMS = 0 THEN $ARETURN = DLLCALL ("user32.dll" , "bool" , "ClipCursor" , "ptr" , 0 ) IF @ERROR OR NOT $ARETURN [0 ] THEN RETURN SETERROR (1 , _WINAPI_GETLASTERROR () , FALSE ) ELSE IF @NUMPARAMS = 2 THEN $IRIGHT = $ILEFT + 1 $IBOTTOM = $ITOP + 1 ENDIF LOCAL $TRECT = DLLSTRUCTCREATE ($TAGRECT ) DLLSTRUCTSETDATA ($TRECT , "Left" , $ILEFT ) DLLSTRUCTSETDATA ($TRECT , "Top" , $ITOP ) DLLSTRUCTSETDATA ($TRECT , "Right" , $IRIGHT ) DLLSTRUCTSETDATA ($TRECT , "Bottom" , $IBOTTOM ) $ARETURN = DLLCALL ("user32.dll" , "bool" , "ClipCursor" , "struct*" , $TRECT ) IF @ERROR OR NOT $ARETURN [0 ] THEN RETURN SETERROR (2 , _WINAPI_GETLASTERROR () , FALSE ) ENDIF RETURN TRUE ENDFUNC FUNC _SINGLETON ($SOCCURRENCENAME , $IFLAG = 0 ) LOCAL CONST $ERROR_ALREADY_EXISTS = 183 LOCAL CONST $SECURITY_DESCRIPTOR_REVISION = 1 LOCAL $TSECURITYATTRIBUTES = 0 IF BITAND ($IFLAG , 2 ) THEN LOCAL $TSECURITYDESCRIPTOR = DLLSTRUCTCREATE ("byte;byte;word;ptr[4]" ) LOCAL $ARET = DLLCALL ("advapi32.dll" , "bool" , "InitializeSecurityDescriptor" , "struct*" , $TSECURITYDESCRIPTOR , "dword" , $SECURITY_DESCRIPTOR_REVISION ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF $ARET [0 ] THEN $ARET = DLLCALL ("advapi32.dll" , "bool" , "SetSecurityDescriptorDacl" , "struct*" , $TSECURITYDESCRIPTOR , "bool" , 1 , "ptr" , 0 , "bool" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF $ARET [0 ] THEN $TSECURITYATTRIBUTES = DLLSTRUCTCREATE ($TAGSECURITY_ATTRIBUTES ) DLLSTRUCTSETDATA ($TSECURITYATTRIBUTES , 1 , DLLSTRUCTGETSIZE ($TSECURITYATTRIBUTES ) ) DLLSTRUCTSETDATA ($TSECURITYATTRIBUTES , 2 , DLLSTRUCTGETPTR ($TSECURITYDESCRIPTOR ) ) DLLSTRUCTSETDATA ($TSECURITYATTRIBUTES , 3 , 0 ) ENDIF ENDIF ENDIF LOCAL $AHANDLE = DLLCALL ("kernel32.dll" , "handle" , "CreateMutexW" , "struct*" , $TSECURITYATTRIBUTES , "bool" , 1 , "wstr" , $SOCCURRENCENAME ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) LOCAL $ALASTERROR = DLLCALL ("kernel32.dll" , "dword" , "GetLastError" ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF $ALASTERROR [0 ] = $ERROR_ALREADY_EXISTS THEN IF BITAND ($IFLAG , 1 ) THEN DLLCALL ("kernel32.dll" , "bool" , "CloseHandle" , "handle" , $AHANDLE [0 ] ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN SETERROR ($ALASTERROR [0 ] , $ALASTERROR [0 ] , 0 ) ELSE EXIT + 4294967295 ENDIF ENDIF RETURN $AHANDLE [0 ] ENDFUNC FUNC _ISPRESSED ($SHEXKEY , $VDLL = "user32.dll" ) LOCAL $ARETURN = DLLCALL ($VDLL , "short" , "GetAsyncKeyState" , "int" , "0x" & $SHEXKEY ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN BITAND ($ARETURN [0 ] , 32768 ) <> 0 ENDFUNC FUNC _VERSIONCOMPARE ($SVERSION1 , $SVERSION2 ) IF $SVERSION1 = $SVERSION2 THEN RETURN 0 LOCAL $SSUBVERSION1 = "" , $SSUBVERSION2 = "" IF STRINGISALPHA (STRINGRIGHT ($SVERSION1 , 1 ) ) THEN $SSUBVERSION1 = STRINGRIGHT ($SVERSION1 , 1 ) $SVERSION1 = STRINGTRIMRIGHT ($SVERSION1 , 1 ) ENDIF IF STRINGISALPHA (STRINGRIGHT ($SVERSION2 , 1 ) ) THEN $SSUBVERSION2 = STRINGRIGHT ($SVERSION2 , 1 ) $SVERSION2 = STRINGTRIMRIGHT ($SVERSION2 , 1 ) ENDIF LOCAL $AVERSION1 = STRINGSPLIT ($SVERSION1 , ".," ) , $AVERSION2 = STRINGSPLIT ($SVERSION2 , ".," ) LOCAL $IPARTDIFFERENCE = ($AVERSION1 [0 ] - $AVERSION2 [0 ] ) IF $IPARTDIFFERENCE < 0 THEN REDIM $AVERSION1 [UBOUND ($AVERSION2 ) ] $AVERSION1 [0 ] = UBOUND ($AVERSION1 ) + 4294967295 FOR $I = (UBOUND ($AVERSION1 ) - ABS ($IPARTDIFFERENCE ) ) TO $AVERSION1 [0 ] $AVERSION1 [$I ] = "0" NEXT ELSEIF $IPARTDIFFERENCE > 0 THEN REDIM $AVERSION2 [UBOUND ($AVERSION1 ) ] $AVERSION2 [0 ] = UBOUND ($AVERSION2 ) + 4294967295 FOR $I = (UBOUND ($AVERSION2 ) - ABS ($IPARTDIFFERENCE ) ) TO $AVERSION2 [0 ] $AVERSION2 [$I ] = "0" NEXT ENDIF FOR $I = 1 TO $AVERSION1 [0 ] IF STRINGISDIGIT ($AVERSION1 [$I ] ) AND STRINGISDIGIT ($AVERSION2 [$I ] ) THEN IF NUMBER ($AVERSION1 [$I ] ) > NUMBER ($AVERSION2 [$I ] ) THEN RETURN SETEXTENDED (2 , 1 ) ELSEIF NUMBER ($AVERSION1 [$I ] ) < NUMBER ($AVERSION2 [$I ] ) THEN RETURN SETEXTENDED (2 , + 4294967295 ) ELSEIF $I = $AVERSION1 [0 ] THEN IF $SSUBVERSION1 > $SSUBVERSION2 THEN RETURN SETEXTENDED (3 , 1 ) ELSEIF $SSUBVERSION1 < $SSUBVERSION2 THEN RETURN SETEXTENDED (3 , + 4294967295 ) ENDIF ENDIF ELSE IF $AVERSION1 [$I ] > $AVERSION2 [$I ] THEN RETURN SETEXTENDED (1 , 1 ) ELSEIF $AVERSION1 [$I ] < $AVERSION2 [$I ] THEN RETURN SETEXTENDED (1 , + 4294967295 ) ENDIF ENDIF NEXT RETURN SETEXTENDED (ABS ($IPARTDIFFERENCE ) , 0 ) ENDFUNC FUNC __MISC_GETDC ($HWND ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "handle" , "GetDC" , "hwnd" , $HWND ) IF @ERROR OR NOT $ARESULT [0 ] THEN RETURN SETERROR (1 , _WINAPI_GETLASTERROR () , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC __MISC_GETDEVICECAPS ($HDC , $IINDEX ) LOCAL $ARESULT = DLLCALL ("gdi32.dll" , "int" , "GetDeviceCaps" , "handle" , $HDC , "int" , $IINDEX ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC __MISC_RELEASEDC ($HWND , $HDC ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "int" , "ReleaseDC" , "hwnd" , $HWND , "handle" , $HDC ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] <> 0 ENDFUNC GLOBAL CONST $CREATE_BREAKAWAY_FROM_JOB = 16777216 GLOBAL CONST $CREATE_DEFAULT_ERROR_MODE = 67108864 GLOBAL CONST $CREATE_NEW_CONSOLE = 16 GLOBAL CONST $CREATE_NEW_PROCESS_GROUP = 512 GLOBAL CONST $CREATE_NO_WINDOW = 134217728 GLOBAL CONST $CREATE_PROTECTED_PROCESS = 262144 GLOBAL CONST $CREATE_PRESERVE_CODE_AUTHZ_LEVEL = 33554432 GLOBAL CONST $CREATE_SEPARATE_WOW_VDM = 2048 GLOBAL CONST $CREATE_SHARED_WOW_VDM = 4096 GLOBAL CONST $CREATE_SUSPENDED = 4 GLOBAL CONST $CREATE_UNICODE_ENVIRONMENT = 1024 GLOBAL CONST $LIST_MODULES_32BIT = 1 GLOBAL CONST $LIST_MODULES_64BIT = 2 GLOBAL CONST $LIST_MODULES_ALL = 3 GLOBAL CONST $LIST_MODULES_DEFAULT = 0 GLOBAL CONST $ABOVE_NORMAL_PRIORITY_CLASS = 32768 GLOBAL CONST $BELOW_NORMAL_PRIORITY_CLASS = 16384 GLOBAL CONST $HIGH_PRIORITY_CLASS = 128 GLOBAL CONST $IDLE_PRIORITY_CLASS = 64 GLOBAL CONST $NORMAL_PRIORITY_CLASS = 32 GLOBAL CONST $REALTIME_PRIORITY_CLASS = 256 GLOBAL CONST $PROCESS_MODE_BACKGROUND_BEGIN = 1048576 GLOBAL CONST $PROCESS_MODE_BACKGROUND_END = 2097152 GLOBAL CONST $MUTEX_MODIFY_STATE = 1 GLOBAL CONST $MUTEX_ALL_ACCESS = 2031617 GLOBAL CONST $JOB_OBJECT_ASSIGN_PROCESS = 1 GLOBAL CONST $JOB_OBJECT_QUERY = 4 GLOBAL CONST $JOB_OBJECT_SET_ATTRIBUTES = 2 GLOBAL CONST $JOB_OBJECT_SET_SECURITY_ATTRIBUTES = 16 GLOBAL CONST $JOB_OBJECT_TERMINATE = 8 GLOBAL CONST $JOB_OBJECT_ALL_ACCESS = 2031647 GLOBAL CONST $JOB_OBJECT_LIMIT_ACTIVE_PROCESS = 8 GLOBAL CONST $JOB_OBJECT_LIMIT_AFFINITY = 16 GLOBAL CONST $JOB_OBJECT_LIMIT_BREAKAWAY_OK = 2048 GLOBAL CONST $JOB_OBJECT_LIMIT_DIE_ON_UNHANDLED_EXCEPTION = 1024 GLOBAL CONST $JOB_OBJECT_LIMIT_JOB_MEMORY = 512 GLOBAL CONST $JOB_OBJECT_LIMIT_JOB_TIME = 4 GLOBAL CONST $JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE = 8192 GLOBAL CONST $JOB_OBJECT_LIMIT_PRESERVE_JOB_TIME = 64 GLOBAL CONST $JOB_OBJECT_LIMIT_PRIORITY_CLASS = 32 GLOBAL CONST $JOB_OBJECT_LIMIT_PROCESS_MEMORY = 256 GLOBAL CONST $JOB_OBJECT_LIMIT_PROCESS_TIME = 2 GLOBAL CONST $JOB_OBJECT_LIMIT_SCHEDULING_CLASS = 128 GLOBAL CONST $JOB_OBJECT_LIMIT_SILENT_BREAKAWAY_OK = 4096 GLOBAL CONST $JOB_OBJECT_LIMIT_WORKINGSET = 1 GLOBAL CONST $JOB_OBJECT_UILIMIT_DESKTOP = 64 GLOBAL CONST $JOB_OBJECT_UILIMIT_DISPLAYSETTINGS = 16 GLOBAL CONST $JOB_OBJECT_UILIMIT_EXITWINDOWS = 128 GLOBAL CONST $JOB_OBJECT_UILIMIT_GLOBALATOMS = 32 GLOBAL CONST $JOB_OBJECT_UILIMIT_HANDLES = 1 GLOBAL CONST $JOB_OBJECT_UILIMIT_READCLIPBOARD = 2 GLOBAL CONST $JOB_OBJECT_UILIMIT_SYSTEMPARAMETERS = 8 GLOBAL CONST $JOB_OBJECT_UILIMIT_WRITECLIPBOARD = 4 GLOBAL CONST $JOB_OBJECT_SECURITY_FILTER_TOKENS = 8 GLOBAL CONST $JOB_OBJECT_SECURITY_NO_ADMIN = 1 GLOBAL CONST $JOB_OBJECT_SECURITY_ONLY_TOKEN = 4 GLOBAL CONST $JOB_OBJECT_SECURITY_RESTRICTED_TOKEN = 2 GLOBAL CONST $JOB_OBJECT_TERMINATE_AT_END_OF_JOB = 0 GLOBAL CONST $JOB_OBJECT_POST_AT_END_OF_JOB = 1 GLOBAL CONST $SEMAPHORE_MODIFY_STATE = 2 GLOBAL CONST $SEMAPHORE_QUERY_STATE = 1 GLOBAL CONST $SEMAPHORE_ALL_ACCESS = 2031619 GLOBAL CONST $ES_AWAYMODE_REQUIRED = 64 GLOBAL CONST $ES_CONTINUOUS = 2147483648 GLOBAL CONST $ES_DISPLAY_REQUIRED = 2 GLOBAL CONST $ES_SYSTEM_REQUIRED = 1 GLOBAL CONST $ES_USER_PRESENT = 4 GLOBAL CONST $COINIT_APARTMENTTHREADED = 2 GLOBAL CONST $COINIT_DISABLE_OLE1DDE = 4 GLOBAL CONST $COINIT_MULTITHREADED = 0 GLOBAL CONST $COINIT_SPEED_OVER_MEMORY = 8 #Region Global Variables and Constants GLOBAL CONST $__TAGWINAPICOM_GUID = "struct;ulong Data1;ushort Data2;ushort Data3;byte Data4[8];endstruct" #EndRegion Global Variables and Constants #Region Functions list #EndRegion Functions list #Region Public Functions FUNC _WINAPI_CLSIDFROMPROGID ($SPROGID ) LOCAL $TGUID = DLLSTRUCTCREATE ($__TAGWINAPICOM_GUID ) LOCAL $ARETURN = DLLCALL ("ole32.dll" , "long" , "CLSIDFromProgID" , "wstr" , $SPROGID , "struct*" , $TGUID ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) IF $ARETURN [0 ] THEN RETURN SETERROR (10 , $ARETURN [0 ] , "" ) $ARETURN = DLLCALL ("ole32.dll" , "int" , "StringFromGUID2" , "struct*" , $TGUID , "wstr" , "" , "int" , 39 ) IF @ERROR OR NOT $ARETURN [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , "" ) RETURN $ARETURN [2 ] ENDFUNC FUNC _WINAPI_COINITIALIZE ($IFLAGS = 0 ) LOCAL $ARETURN = DLLCALL ("ole32.dll" , "long" , "CoInitializeEx" , "ptr" , 0 , "dword" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF $ARETURN [0 ] THEN RETURN SETERROR (10 , $ARETURN [0 ] , 0 ) RETURN 1 ENDFUNC FUNC _WINAPI_COTASKMEMALLOC ($ISIZE ) LOCAL $ARETURN = DLLCALL ("ole32.dll" , "ptr" , "CoTaskMemAlloc" , "uint_ptr" , $ISIZE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARETURN [0 ] ENDFUNC FUNC _WINAPI_COTASKMEMFREE ($PMEMORY ) DLLCALL ("ole32.dll" , "none" , "CoTaskMemFree" , "ptr" , $PMEMORY ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN 1 ENDFUNC FUNC _WINAPI_COTASKMEMREALLOC ($PMEMORY , $ISIZE ) LOCAL $ARETURN = DLLCALL ("ole32.dll" , "ptr" , "CoTaskMemRealloc" , "ptr" , $PMEMORY , "ulong_ptr" , $ISIZE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARETURN [0 ] ENDFUNC FUNC _WINAPI_COUNINITIALIZE () DLLCALL ("ole32.dll" , "none" , "CoUninitialize" ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN 1 ENDFUNC FUNC _WINAPI_CREATEGUID () LOCAL $TGUID = DLLSTRUCTCREATE ($__TAGWINAPICOM_GUID ) LOCAL $ARETURN = DLLCALL ("ole32.dll" , "long" , "CoCreateGuid" , "struct*" , $TGUID ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) IF $ARETURN [0 ] THEN RETURN SETERROR (10 , $ARETURN [0 ] , "" ) $ARETURN = DLLCALL ("ole32.dll" , "int" , "StringFromGUID2" , "struct*" , $TGUID , "wstr" , "" , "int" , 65536 ) IF @ERROR OR NOT $ARETURN [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , "" ) RETURN $ARETURN [2 ] ENDFUNC FUNC _WINAPI_CREATESTREAMONHGLOBAL ($HGLOBAL = 0 , $BDELETEONRELEASE = TRUE ) LOCAL $ARETURN = DLLCALL ("ole32.dll" , "long" , "CreateStreamOnHGlobal" , "handle" , $HGLOBAL , "bool" , $BDELETEONRELEASE , "ptr*" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF $ARETURN [0 ] THEN RETURN SETERROR (10 , $ARETURN [0 ] , 0 ) RETURN $ARETURN [3 ] ENDFUNC FUNC _WINAPI_GETHGLOBALFROMSTREAM ($PSTREAM ) LOCAL $ARETURN = DLLCALL ("ole32.dll" , "uint" , "GetHGlobalFromStream" , "ptr" , $PSTREAM , "ptr*" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF $ARETURN [0 ] THEN RETURN SETERROR (10 , $ARETURN [0 ] , 0 ) RETURN $ARETURN [2 ] ENDFUNC FUNC _WINAPI_PROGIDFROMCLSID ($SCLSID ) LOCAL $TGUID = DLLSTRUCTCREATE ($__TAGWINAPICOM_GUID ) LOCAL $ARETURN = DLLCALL ("ole32.dll" , "uint" , "CLSIDFromString" , "wstr" , $SCLSID , "struct*" , $TGUID ) IF @ERROR OR $ARETURN [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , "" ) $ARETURN = DLLCALL ("ole32.dll" , "uint" , "ProgIDFromCLSID" , "struct*" , $TGUID , "ptr*" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) IF $ARETURN [0 ] THEN RETURN SETERROR (10 , $ARETURN [0 ] , "" ) LOCAL $SID = _WINAPI_GETSTRING ($ARETURN [2 ] ) _WINAPI_COTASKMEMFREE ($ARETURN [2 ] ) RETURN $SID ENDFUNC FUNC _WINAPI_RELEASESTREAM ($PSTREAM ) LOCAL $ARETURN = DLLCALL ("oleaut32.dll" , "long" , "DispCallFunc" , "ptr" , $PSTREAM , "ulong_ptr" , 8 * (1 + @AUTOITX64 ) , "uint" , 4 , "ushort" , 23 , "uint" , 0 , "ptr" , 0 , "ptr" , 0 , "str" , "" ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF $ARETURN [0 ] THEN RETURN SETERROR (10 , $ARETURN [0 ] , 0 ) RETURN 1 ENDFUNC #EndRegion Public Functions GLOBAL CONST $URL_SCHEME_INVALID = + 4294967295 GLOBAL CONST $URL_SCHEME_UNKNOWN = 0 GLOBAL CONST $URL_SCHEME_FTP = 1 GLOBAL CONST $URL_SCHEME_HTTP = 2 GLOBAL CONST $URL_SCHEME_GOPHER = 3 GLOBAL CONST $URL_SCHEME_MAILTO = 4 GLOBAL CONST $URL_SCHEME_NEWS = 5 GLOBAL CONST $URL_SCHEME_NNTP = 6 GLOBAL CONST $URL_SCHEME_TELNET = 7 GLOBAL CONST $URL_SCHEME_WAIS = 8 GLOBAL CONST $URL_SCHEME_FILE = 9 GLOBAL CONST $URL_SCHEME_MK = 10 GLOBAL CONST $URL_SCHEME_HTTPS = 11 GLOBAL CONST $URL_SCHEME_SHELL = 12 GLOBAL CONST $URL_SCHEME_SNEWS = 13 GLOBAL CONST $URL_SCHEME_LOCAL = 14 GLOBAL CONST $URL_SCHEME_JAVASCRIPT = 15 GLOBAL CONST $URL_SCHEME_VBSCRIPT = 16 GLOBAL CONST $URL_SCHEME_ABOUT = 17 GLOBAL CONST $URL_SCHEME_RES = 18 GLOBAL CONST $URL_SCHEME_MSSHELLROOTED = 19 GLOBAL CONST $URL_SCHEME_MSSHELLIDLIST = 20 GLOBAL CONST $URL_SCHEME_MSHELP = 21 GLOBAL CONST $URL_SCHEME_MSSHELLDEVICE = 22 GLOBAL CONST $URL_SCHEME_WILDCARD = 23 GLOBAL CONST $URL_SCHEME_SEARCH_MS = 24 GLOBAL CONST $URL_SCHEME_SEARCH = 25 GLOBAL CONST $URL_SCHEME_KNOWNFOLDER = 26 GLOBAL CONST $GCT_INVALID = 0 GLOBAL CONST $GCT_LFNCHAR = 1 GLOBAL CONST $GCT_SEPARATOR = 8 GLOBAL CONST $GCT_SHORTCHAR = 2 GLOBAL CONST $GCT_WILD = 4 GLOBAL CONST $URL_APPLY_DEFAULT = 1 GLOBAL CONST $URL_APPLY_GUESSSCHEME = 2 GLOBAL CONST $URL_APPLY_GUESSFILE = 4 GLOBAL CONST $URL_APPLY_FORCEAPPLY = 8 GLOBAL CONST $URL_DONT_SIMPLIFY = 134217728 GLOBAL CONST $URL_ESCAPE_AS_UTF8 = 262144 GLOBAL CONST $URL_ESCAPE_PERCENT = 4096 GLOBAL CONST $URL_ESCAPE_SPACES_ONLY = 67108864 GLOBAL CONST $URL_ESCAPE_UNSAFE = 536870912 GLOBAL CONST $URL_NO_META = 134217728 GLOBAL CONST $URL_PLUGGABLE_PROTOCOL = 1073741824 GLOBAL CONST $URL_UNESCAPE = 268435456 GLOBAL CONST $URL_PART_HOSTNAME = 2 GLOBAL CONST $URL_PART_PASSWORD = 4 GLOBAL CONST $URL_PART_PORT = 5 GLOBAL CONST $URL_PART_QUERY = 6 GLOBAL CONST $URL_PART_SCHEME = 1 GLOBAL CONST $URL_PART_USERNAME = 3 GLOBAL CONST $URLIS_APPLIABLE = 4 GLOBAL CONST $URLIS_DIRECTORY = 5 GLOBAL CONST $URLIS_FILEURL = 3 GLOBAL CONST $URLIS_HASQUERY = 6 GLOBAL CONST $URLIS_NOHISTORY = 2 GLOBAL CONST $URLIS_OPAQUE = 1 GLOBAL CONST $URLIS_URL = 0 #Region Functions list #EndRegion Functions list #Region Public Functions FUNC _WINAPI_COMMANDLINETOARGV ($SCMD ) LOCAL $ARESULT [1 ] = [0 ] $SCMD = STRINGSTRIPWS ($SCMD , $STR_STRIPLEADING + $STR_STRIPTRAILING ) IF NOT $SCMD THEN RETURN $ARESULT ENDIF LOCAL $ARET = DLLCALL ("shell32.dll" , "ptr" , "CommandLineToArgvW" , "wstr" , $SCMD , "int*" , 0 ) IF @ERROR OR NOT $ARET [0 ] OR (NOT $ARET [2 ] ) THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $TPTR = DLLSTRUCTCREATE ("ptr[" & $ARET [2 ] & "]" , $ARET [0 ] ) DIM $ARESULT [$ARET [2 ] + 1 ] = [$ARET [2 ] ] FOR $I = 1 TO $ARET [2 ] $ARESULT [$I ] = _WINAPI_GETSTRING (DLLSTRUCTGETDATA ($TPTR , 1 , $I ) ) NEXT DLLCALL ("kernel32.dll" , "handle" , "LocalFree" , "handle" , $ARET [0 ] ) RETURN $ARESULT ENDFUNC FUNC _WINAPI_ISNAMEINEXPRESSION ($SSTRING , $SPATTERN , $BCASESENSITIVE = FALSE ) IF NOT $BCASESENSITIVE THEN $SPATTERN = STRINGUPPER ($SPATTERN ) LOCAL $TUS1 = __US ($SPATTERN ) LOCAL $TUS2 = __US ($SSTRING ) LOCAL $ARET = DLLCALL ("ntdll.dll" , "boolean" , "RtlIsNameInExpression" , "struct*" , $TUS1 , "struct*" , $TUS2 , "boolean" , NOT $BCASESENSITIVE , "ptr" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_PARSEURL ($SURL ) LOCAL $TAGPARSEDURL = "dword Size;ptr Protocol;uint cchProtocol;ptr Suffix;uint cchSuffix;uint Scheme" LOCAL $TPURL = DLLSTRUCTCREATE ($TAGPARSEDURL ) DLLSTRUCTSETDATA ($TPURL , 1 , DLLSTRUCTGETSIZE ($TPURL ) ) LOCAL $TURL = DLLSTRUCTCREATE ("wchar[4096]" ) DLLSTRUCTSETDATA ($TURL , 1 , $SURL ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "long" , "ParseURLW" , "struct*" , $TURL , "struct*" , $TPURL ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) IF $ARET [0 ] THEN RETURN SETERROR (10 , $ARET [0 ] , "" ) LOCAL $ARESULT [3 ] $ARESULT [0 ] = DLLSTRUCTGETDATA (DLLSTRUCTCREATE ("wchar[" & DLLSTRUCTGETDATA ($TPURL , 3 ) & "]" , DLLSTRUCTGETDATA ($TPURL , 2 ) ) , 1 ) $ARESULT [1 ] = DLLSTRUCTGETDATA (DLLSTRUCTCREATE ("wchar[" & DLLSTRUCTGETDATA ($TPURL , 5 ) & "]" , DLLSTRUCTGETDATA ($TPURL , 4 ) ) , 1 ) $ARESULT [2 ] = DLLSTRUCTGETDATA ($TPURL , 6 ) RETURN $ARESULT ENDFUNC FUNC _WINAPI_PARSEUSERNAME ($SUSER ) IF NOT __DLL ("credui.dll" ) THEN RETURN SETERROR (103 , 0 , 0 ) LOCAL $ARET = DLLCALL ("credui.dll" , "dword" , "CredUIParseUserNameW" , "wstr" , $SUSER , "wstr" , "" , "ulong" , 4096 , "wstr" , "" , "ulong" , 4096 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) SWITCH $ARET [0 ] CASE 0 CASE 1315 IF STRINGSTRIPWS ($SUSER , $STR_STRIPLEADING + $STR_STRIPTRAILING ) THEN $ARET [2 ] = $SUSER $ARET [4 ] = "" ELSE CONTINUECASE ENDIF CASE ELSE RETURN SETERROR (10 , $ARET [0 ] , 0 ) ENDSWITCH LOCAL $ARESULT [2 ] $ARESULT [0 ] = $ARET [4 ] $ARESULT [1 ] = $ARET [2 ] RETURN $ARESULT ENDFUNC FUNC _WINAPI_PATHADDBACKSLASH ($SFILEPATH ) LOCAL $TPATH = DLLSTRUCTCREATE ("wchar[260]" ) DLLSTRUCTSETDATA ($TPATH , 1 , $SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "ptr" , "PathAddBackslashW" , "struct*" , $TPATH ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN DLLSTRUCTGETDATA ($TPATH , 1 ) ENDFUNC FUNC _WINAPI_PATHADDEXTENSION ($SFILEPATH , $SEXT = "" ) LOCAL $TPATH = DLLSTRUCTCREATE ("wchar[260]" ) DLLSTRUCTSETDATA ($TPATH , 1 , $SFILEPATH ) LOCAL $STYPEOFEXT = "wstr" IF NOT STRINGSTRIPWS ($SEXT , $STR_STRIPLEADING + $STR_STRIPTRAILING ) THEN $STYPEOFEXT = "ptr" $SEXT = 0 ENDIF LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathAddExtensionW" , "struct*" , $TPATH , $STYPEOFEXT , $SEXT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN SETEXTENDED ($ARET [0 ] , DLLSTRUCTGETDATA ($TPATH , 1 ) ) ENDFUNC FUNC _WINAPI_PATHAPPEND ($SFILEPATH , $SMORE ) LOCAL $TPATH = DLLSTRUCTCREATE ("wchar[260]" ) DLLSTRUCTSETDATA ($TPATH , 1 , $SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathAppendW" , "struct*" , $TPATH , "wstr" , $SMORE ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN DLLSTRUCTGETDATA ($TPATH , 1 ) ENDFUNC FUNC _WINAPI_PATHBUILDROOT ($IDRIVE ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "ptr" , "PathBuildRootW" , "wstr" , "" , "int" , $IDRIVE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN $ARET [1 ] ENDFUNC FUNC _WINAPI_PATHCANONICALIZE ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathCanonicalizeW" , "wstr" , "" , "wstr" , $SFILEPATH ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , $SFILEPATH ) RETURN $ARET [1 ] ENDFUNC FUNC _WINAPI_PATHCOMMONPREFIX ($SPATH1 , $SPATH2 ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "int" , "PathCommonPrefixW" , "wstr" , $SPATH1 , "wstr" , $SPATH2 , "wstr" , "" ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN SETEXTENDED ($ARET [0 ] , $ARET [3 ] ) ENDFUNC FUNC _WINAPI_PATHCOMPACTPATH ($HWND , $SFILEPATH , $IWIDTH = 0 ) IF $IWIDTH < 1 THEN LOCAL $TRECT = DLLSTRUCTCREATE ($TAGRECT ) DLLCALL ("user32.dll" , "bool" , "GetClientRect" , "hwnd" , $HWND , "struct*" , $TRECT ) $IWIDTH += DLLSTRUCTGETDATA ($TRECT , "Right" ) - DLLSTRUCTGETDATA ($TRECT , "Left" ) ENDIF LOCAL $ARET = DLLCALL ("user32.dll" , "handle" , "GetDC" , "hwnd" , $HWND ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , $SFILEPATH ) LOCAL $HDC = $ARET [0 ] LOCAL CONST $WM_GETFONT = 49 $ARET = DLLCALL ("user32.dll" , "ptr" , "SendMessage" , "hwnd" , $HWND , "uint" , $WM_GETFONT , "wparam" , 0 , "lparam" , 0 ) LOCAL $HBACK = DLLCALL ("gdi32.dll" , "handle" , "SelectObject" , "handle" , $HDC , "handle" , $ARET [0 ] ) LOCAL $IERROR = 0 $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathCompactPathW" , "handle" , $HDC , "wstr" , $SFILEPATH , "int" , $IWIDTH ) IF @ERROR OR NOT $ARET [0 ] THEN $IERROR = @ERROR + 10 DLLCALL ("gdi32.dll" , "handle" , "SelectObject" , "handle" , $HDC , "handle" , $HBACK [0 ] ) DLLCALL ("user32.dll" , "int" , "ReleaseDC" , "hwnd" , $HWND , "handle" , $HDC ) IF $IERROR THEN RETURN SETERROR ($IERROR , 0 , $SFILEPATH ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_PATHCOMPACTPATHEX ($SFILEPATH , $IMAX ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathCompactPathExW" , "wstr" , "" , "wstr" , $SFILEPATH , "uint" , $IMAX + 1 , "dword" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , $SFILEPATH ) RETURN $ARET [1 ] ENDFUNC FUNC _WINAPI_PATHCREATEFROMURL ($SURL ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "long" , "PathCreateFromUrlW" , "wstr" , $SURL , "wstr" , "" , "dword*" , 4096 , "dword" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) IF $ARET [0 ] THEN RETURN SETERROR (10 , $ARET [0 ] , "" ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_PATHFINDEXTENSION ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "wstr" , "PathFindExtensionW" , "wstr" , $SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_PATHFINDFILENAME ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "wstr" , "PathFindFileNameW" , "wstr" , $SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , $SFILEPATH ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_PATHFINDNEXTCOMPONENT ($SFILEPATH ) LOCAL $TPATH = DLLSTRUCTCREATE ("wchar[" & (STRINGLEN ($SFILEPATH ) + 1 ) & "]" ) DLLSTRUCTSETDATA ($TPATH , 1 , $SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "ptr" , "PathFindNextComponentW" , "struct*" , $TPATH ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , "" ) RETURN _WINAPI_GETSTRING ($ARET [0 ] ) ENDFUNC FUNC _WINAPI_PATHFINDONPATH (CONST $SFILEPATH , $AEXTRAPATHS = "" , CONST $SPATHDELIMITER = @LF ) LOCAL $IEXTRACOUNT = 0 IF ISSTRING ($AEXTRAPATHS ) THEN IF STRINGLEN ($AEXTRAPATHS ) THEN $AEXTRAPATHS = STRINGSPLIT ($AEXTRAPATHS , $SPATHDELIMITER , $STR_ENTIRESPLIT + $STR_NOCOUNT ) $IEXTRACOUNT = UBOUND ($AEXTRAPATHS , $UBOUND_ROWS ) ENDIF ELSEIF ISARRAY ($AEXTRAPATHS ) THEN $IEXTRACOUNT = UBOUND ($AEXTRAPATHS ) ENDIF LOCAL $TPATHS , $TPATHPTRS IF $IEXTRACOUNT THEN LOCAL $TAGSTRUCT = "" FOR $PATH IN $AEXTRAPATHS $TAGSTRUCT &= "wchar[" & STRINGLEN ($PATH ) + 1 & "];" NEXT $TPATHS = DLLSTRUCTCREATE ($TAGSTRUCT ) $TPATHPTRS = DLLSTRUCTCREATE ("ptr[" & $IEXTRACOUNT + 1 & "]" ) FOR $I = 1 TO $IEXTRACOUNT DLLSTRUCTSETDATA ($TPATHS , $I , $AEXTRAPATHS [$I + 4294967295 ] ) DLLSTRUCTSETDATA ($TPATHPTRS , 1 , DLLSTRUCTGETPTR ($TPATHS , $I ) , $I ) NEXT DLLSTRUCTSETDATA ($TPATHPTRS , 1 , PTR (0 ) , $IEXTRACOUNT + 1 ) ENDIF LOCAL $ARESULT = DLLCALL ("shlwapi.dll" , "bool" , "PathFindOnPathW" , "wstr" , $SFILEPATH , "struct*" , $TPATHPTRS ) IF @ERROR OR NOT $ARESULT [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , $SFILEPATH ) RETURN $ARESULT [1 ] ENDFUNC FUNC _WINAPI_PATHGETARGS ($SFILEPATH ) LOCAL $TPATH = DLLSTRUCTCREATE ("wchar[" & (STRINGLEN ($SFILEPATH ) + 1 ) & "]" ) DLLSTRUCTSETDATA ($TPATH , 1 , $SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "ptr" , "PathGetArgsW" , "struct*" , $TPATH ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN _WINAPI_GETSTRING ($ARET [0 ] ) ENDFUNC FUNC _WINAPI_PATHGETCHARTYPE ($SCHAR ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "uint" , "PathGetCharTypeW" , "word" , ASCW ($SCHAR ) ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , + 4294967295 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_PATHGETDRIVENUMBER ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "int" , "PathGetDriveNumberW" , "wstr" , $SFILEPATH ) IF @ERROR OR ($ARET [0 ] = + 4294967295 ) THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN CHR ($ARET [0 ] + 65 ) & ":" ENDFUNC FUNC _WINAPI_PATHISCONTENTTYPE ($SFILEPATH , $STYPE ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathIsContentTypeW" , "wstr" , $SFILEPATH , "wstr" , $STYPE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_PATHISEXE ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shell32.dll" , "bool" , "PathIsExe" , "wstr" , $SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_PATHISFILESPEC ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathIsFileSpecW" , "wstr" , $SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_PATHISLFNFILESPEC ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathIsLFNFileSpecW" , "wstr" , $SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_PATHISRELATIVE ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathIsRelativeW" , "wstr" , $SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_PATHISROOT ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathIsRootW" , "wstr" , $SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_PATHISSAMEROOT ($SPATH1 , $SPATH2 ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathIsSameRootW" , "wstr" , $SPATH1 , "wstr" , $SPATH2 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_PATHISSYSTEMFOLDER ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathIsSystemFolderW" , "wstr" , $SFILEPATH , "dword" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_PATHISUNC ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathIsUNCW" , "wstr" , $SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_PATHISUNCSERVER ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathIsUNCServerW" , "wstr" , $SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_PATHISUNCSERVERSHARE ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathIsUNCServerShareW" , "wstr" , $SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_PATHMAKESYSTEMFOLDER ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathMakeSystemFolderW" , "wstr" , $SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_PATHMATCHSPEC ($SFILEPATH , $SSPEC ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathMatchSpecW" , "wstr" , $SFILEPATH , "wstr" , $SSPEC ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_PATHPARSEICONLOCATION ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "int" , "PathParseIconLocationW" , "wstr" , $SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) LOCAL $ARESULT [2 ] $ARESULT [0 ] = $ARET [1 ] $ARESULT [1 ] = $ARET [0 ] RETURN $ARESULT ENDFUNC FUNC _WINAPI_PATHRELATIVEPATHTO ($SPATHFROM , $BDIRFROM , $SPATHTO , $BDIRTO ) IF $BDIRFROM THEN $BDIRFROM = 16 ENDIF IF $BDIRTO THEN $BDIRTO = 16 ENDIF LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathRelativePathToW" , "wstr" , "" , "wstr" , $SPATHFROM , "dword" , $BDIRFROM , "wstr" , $SPATHTO , "dword" , $BDIRTO ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN $ARET [1 ] ENDFUNC FUNC _WINAPI_PATHREMOVEARGS ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "none" , "PathRemoveArgsW" , "wstr" , $SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN $ARET [1 ] ENDFUNC FUNC _WINAPI_PATHREMOVEBACKSLASH ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "ptr" , "PathRemoveBackslashW" , "wstr" , $SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN $ARET [1 ] ENDFUNC FUNC _WINAPI_PATHREMOVEEXTENSION ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "none" , "PathRemoveExtensionW" , "wstr" , $SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN $ARET [1 ] ENDFUNC FUNC _WINAPI_PATHREMOVEFILESPEC ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathRemoveFileSpecW" , "wstr" , $SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN SETEXTENDED ($ARET [0 ] , $ARET [1 ] ) ENDFUNC FUNC _WINAPI_PATHRENAMEEXTENSION ($SFILEPATH , $SEXT ) LOCAL $TPATH = DLLSTRUCTCREATE ("wchar[260]" ) DLLSTRUCTSETDATA ($TPATH , 1 , $SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathRenameExtensionW" , "struct*" , $TPATH , "wstr" , $SEXT ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN DLLSTRUCTGETDATA ($TPATH , 1 ) ENDFUNC FUNC _WINAPI_PATHSEARCHANDQUALIFY ($SFILEPATH , $BEXISTS = FALSE ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathSearchAndQualifyW" , "wstr" , $SFILEPATH , "wstr" , "" , "int" , 4096 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , "" ) IF $BEXISTS AND NOT FILEEXISTS ($ARET [2 ] ) THEN RETURN SETERROR (20 , 0 , "" ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_PATHSKIPROOT ($SFILEPATH ) LOCAL $TPATH = DLLSTRUCTCREATE ("wchar[" & (STRINGLEN ($SFILEPATH ) + 1 ) & "]" ) DLLSTRUCTSETDATA ($TPATH , 1 , $SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "ptr" , "PathSkipRootW" , "struct*" , $TPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) IF NOT $ARET [0 ] THEN RETURN $SFILEPATH RETURN _WINAPI_GETSTRING ($ARET [0 ] ) ENDFUNC FUNC _WINAPI_PATHSTRIPPATH ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "none" , "PathStripPathW" , "wstr" , $SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN $ARET [1 ] ENDFUNC FUNC _WINAPI_PATHSTRIPTOROOT ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathStripToRootW" , "wstr" , $SFILEPATH ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN $ARET [1 ] ENDFUNC FUNC _WINAPI_PATHUNDECORATE ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "none" , "PathUndecorateW" , "wstr" , $SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN $ARET [1 ] ENDFUNC FUNC _WINAPI_PATHUNEXPANDENVSTRINGS ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathUnExpandEnvStringsW" , "wstr" , $SFILEPATH , "wstr" , "" , "uint" , 4096 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_PATHUNMAKESYSTEMFOLDER ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "PathUnmakeSystemFolderW" , "wstr" , $SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_PATHUNQUOTESPACES ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "none" , "PathUnquoteSpacesW" , "wstr" , $SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN $ARET [1 ] ENDFUNC FUNC _WINAPI_PATHYETANOTHERMAKEUNIQUENAME ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shell32.dll" , "int" , "PathYetAnotherMakeUniqueName" , "wstr" , "" , "wstr" , $SFILEPATH , "ptr" , 0 , "ptr" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN $ARET [1 ] ENDFUNC FUNC _WINAPI_SHELLGETIMAGELIST ($BSMALL = FALSE ) LOCAL $PLARGE , $PSMALL , $TPTR = DLLSTRUCTCREATE ("ptr" ) IF $BSMALL THEN $PLARGE = 0 $PSMALL = DLLSTRUCTGETPTR ($TPTR ) ELSE $PLARGE = DLLSTRUCTGETPTR ($TPTR ) $PSMALL = 0 ENDIF LOCAL $ARET = DLLCALL ("shell32.dll" , "int" , "Shell_GetImageLists" , "ptr" , $PLARGE , "ptr" , $PSMALL ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN DLLSTRUCTGETDATA ($TPTR , 1 ) ENDFUNC FUNC _WINAPI_URLAPPLYSCHEME ($SURL , $IFLAGS = 1 ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "long" , "UrlApplySchemeW" , "wstr" , $SURL , "wstr" , "" , "dword*" , 4096 , "dword" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) IF $ARET [0 ] THEN RETURN SETERROR (10 , $ARET [0 ] , "" ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_URLCANONICALIZE ($SURL , $IFLAGS ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "long" , "UrlCanonicalizeW" , "wstr" , $SURL , "wstr" , "" , "dword*" , 4096 , "dword" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) IF $ARET [0 ] THEN RETURN SETERROR (10 , $ARET [0 ] , "" ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_URLCOMBINE ($SURL , $SPART , $IFLAGS = 0 ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "long" , "UrlCombineW" , "wstr" , $SURL , "wstr" , $SPART , "wstr" , "" , "dword*" , 4096 , "dword" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) IF $ARET [0 ] THEN RETURN SETERROR (10 , $ARET [0 ] , "" ) RETURN $ARET [3 ] ENDFUNC FUNC _WINAPI_URLCOMPARE ($SURL1 , $SURL2 , $BIGNORESLASH = FALSE ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "int" , "UrlCompareW" , "wstr" , $SURL1 , "wstr" , $SURL2 , "bool" , $BIGNORESLASH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_URLCREATEFROMPATH ($SFILEPATH ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "long" , "UrlCreateFromPathW" , "wstr" , $SFILEPATH , "wstr" , "" , "dword*" , 4096 , "dword" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) IF $ARET [0 ] < 0 OR $ARET [0 ] > 1 THEN RETURN SETERROR (10 , $ARET [0 ] , "" ) ENDIF RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_URLFIXUP ($SURL ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "long" , "UrlFixupW" , "wstr" , $SURL , "wstr" , "" , "dword" , 4096 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) IF $ARET [0 ] THEN RETURN SETERROR (10 , $ARET [0 ] , "" ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_URLGETPART ($SURL , $IPART ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "long" , "UrlGetPartW" , "wstr" , $SURL , "wstr" , "" , "dword*" , 4096 , "dword" , $IPART , "dword" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) IF $ARET [0 ] THEN RETURN SETERROR (10 , $ARET [0 ] , "" ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_URLHASH ($SURL , $ILENGTH = 32 ) IF $ILENGTH <= 0 OR $ILENGTH > 256 THEN RETURN SETERROR (256 , 0 , 0 ) LOCAL $TDATA = DLLSTRUCTCREATE ("byte[" & $ILENGTH & "]" ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "long" , "UrlHashW" , "wstr" , $SURL , "struct*" , $TDATA , "dword" , $ILENGTH ) IF @ERROR THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) IF $ARET [0 ] THEN RETURN SETERROR (10 , $ARET [0 ] , 0 ) RETURN DLLSTRUCTGETDATA ($TDATA , 1 ) ENDFUNC FUNC _WINAPI_URLIS ($SURL , $ITYPE = 0 ) LOCAL $ARET = DLLCALL ("shlwapi.dll" , "bool" , "UrlIsW" , "wstr" , $SURL , "uint" , $ITYPE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC #EndRegion Public Functions #Region Internal Functions FUNC __US ($SSTRING , $ILENGTH = 0 ) IF $ILENGTH THEN $SSTRING = STRINGLEFT ($SSTRING , $ILENGTH ) ELSE $ILENGTH = STRINGLEN ($SSTRING ) ENDIF LOCAL $TUS = DLLSTRUCTCREATE ("ushort;ushort;ptr;wchar[" & ($ILENGTH + 1 ) & "]" ) DLLSTRUCTSETDATA ($TUS , 1 , 2 * STRINGLEN ($SSTRING ) ) DLLSTRUCTSETDATA ($TUS , 2 , 2 * $ILENGTH ) DLLSTRUCTSETDATA ($TUS , 3 , DLLSTRUCTGETPTR ($TUS , 4 ) ) DLLSTRUCTSETDATA ($TUS , 4 , $SSTRING ) RETURN $TUS ENDFUNC #EndRegion Internal Functions #Region Global Variables and Constants GLOBAL CONST $TAGIO_COUNTERS = "struct;uint64 ReadOperationCount;uint64 WriteOperationCount;uint64 OtherOperationCount;uint64 ReadTransferCount;uint64 WriteTransferCount;uint64 OtherTransferCount;endstruct" GLOBAL CONST $TAGJOBOBJECT_ASSOCIATE_COMPLETION_PORT = "ulong_ptr CompletionKey;ptr CompletionPort" GLOBAL CONST $TAGJOBOBJECT_BASIC_ACCOUNTING_INFORMATION = "struct;int64 TotalUserTime;int64 TotalKernelTime;int64 ThisPeriodTotalUserTime;int64 ThisPeriodTotalKernelTime;dword TotalPageFaultCount;dword TotalProcesses;dword ActiveProcesses;dword TotalTerminatedProcesses;endstruct" GLOBAL CONST $TAGJOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION = $TAGJOBOBJECT_BASIC_ACCOUNTING_INFORMATION & ";" & $TAGIO_COUNTERS GLOBAL CONST $TAGJOBOBJECT_BASIC_LIMIT_INFORMATION = "struct;int64 PerProcessUserTimeLimit;int64 PerJobUserTimeLimit;dword LimitFlags;ulong_ptr MinimumWorkingSetSize;ulong_ptr MaximumWorkingSetSize;dword ActiveProcessLimit;ulong_ptr Affinity;dword PriorityClass;dword SchedulingClass;endstruct" GLOBAL CONST $TAGJOBOBJECT_BASIC_PROCESS_ID_LIST = "dword NumberOfAssignedProcesses;dword NumberOfProcessIdsInList" GLOBAL CONST $TAGJOBOBJECT_BASIC_UI_RESTRICTIONS = "dword UIRestrictionsClass" GLOBAL CONST $TAGJOBOBJECT_END_OF_JOB_TIME_INFORMATION = "dword EndOfJobTimeAction" GLOBAL CONST $TAGJOBOBJECT_EXTENDED_LIMIT_INFORMATION = $TAGJOBOBJECT_BASIC_LIMIT_INFORMATION & ";" & $TAGIO_COUNTERS & ";ulong_ptr ProcessMemoryLimit;ulong_ptr JobMemoryLimit;ulong_ptr PeakProcessMemoryUsed;ulong_ptr PeakJobMemoryUsed" GLOBAL CONST $TAGJOBOBJECT_GROUP_INFORMATION = "" GLOBAL CONST $TAGJOBOBJECT_SECURITY_LIMIT_INFORMATION = "dword SecurityLimitFlags;ptr JobToken;ptr SidsToDisable;ptr PrivilegesToDelete;ptr RestrictedSids" GLOBAL CONST $TAGMODULEINFO = "ptr BaseOfDll;dword SizeOfImage;ptr EntryPoint" GLOBAL CONST $TAGPROCESSENTRY32 = "dword Size;dword Usage;dword ProcessID;ulong_ptr DefaultHeapID;dword ModuleID;dword Threads;dword ParentProcessID;long PriClassBase;dword Flags;wchar ExeFile[260]" #EndRegion Global Variables and Constants #Region Functions list #EndRegion Functions list #Region Public Functions FUNC _WINAPI_ADJUSTTOKENPRIVILEGES ($HTOKEN , $APRIVILEGES , $IATTRIBUTES , BYREF $AADJUST ) $AADJUST = 0 IF NOT $APRIVILEGES AND ISNUMBER ($APRIVILEGES ) THEN RETURN 0 LOCAL $TTP1 = 0 , $TTP2 , $ICOUNT , $ARET , $BDISABLE = FALSE IF $APRIVILEGES = + 4294967295 THEN $TTP2 = DLLSTRUCTCREATE ("dword" ) $ARET = DLLCALL ("advapi32.dll" , "bool" , "AdjustTokenPrivileges" , "handle" , $HTOKEN , "bool" , 1 , "ptr" , 0 , "dword" , 0 , "struct*" , $TTP2 , "dword*" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) LOCAL $ILASTERROR = _WINAPI_GETLASTERROR () SWITCH $ILASTERROR CASE 122 $TTP2 = DLLSTRUCTCREATE ("dword;dword[" & ($ARET [6 ] / 4 + 4294967295 ) & "]" ) IF @ERROR THEN CONTINUECASE ENDIF CASE ELSE RETURN SETERROR (10 , $ILASTERROR , 0 ) ENDSWITCH $BDISABLE = TRUE ELSE LOCAL $APREV = 0 IF NOT ISARRAY ($APRIVILEGES ) THEN DIM $APREV [1 ] [2 ] $APREV [0 ] [0 ] = $APRIVILEGES $APREV [0 ] [1 ] = $IATTRIBUTES ELSE IF NOT UBOUND ($APRIVILEGES , $UBOUND_COLUMNS ) THEN $ICOUNT = UBOUND ($APRIVILEGES ) DIM $APREV [$ICOUNT ] [2 ] FOR $I = 0 TO $ICOUNT + 4294967295 $APREV [$I ] [0 ] = $APRIVILEGES [$I ] $APREV [$I ] [1 ] = $IATTRIBUTES NEXT ENDIF ENDIF IF ISARRAY ($APREV ) THEN $APRIVILEGES = $APREV ENDIF LOCAL $TAGSTRUCT = "dword;dword[" & (3 * UBOUND ($APRIVILEGES ) ) & "]" $TTP1 = DLLSTRUCTCREATE ($TAGSTRUCT ) $TTP2 = DLLSTRUCTCREATE ($TAGSTRUCT ) IF @ERROR THEN RETURN SETERROR (@ERROR + 20 , 0 , 0 ) DLLSTRUCTSETDATA ($TTP1 , 1 , UBOUND ($APRIVILEGES ) ) FOR $I = 0 TO UBOUND ($APRIVILEGES ) + 4294967295 DLLSTRUCTSETDATA ($TTP1 , 2 , $APRIVILEGES [$I ] [1 ] , 3 * $I + 3 ) $ARET = DLLCALL ("advapi32.dll" , "bool" , "LookupPrivilegeValueW" , "ptr" , 0 , "wstr" , $APRIVILEGES [$I ] [0 ] , "ptr" , DLLSTRUCTGETPTR ($TTP1 , 2 ) + 12 * $I ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 100 , @EXTENDED , 0 ) NEXT ENDIF $ARET = DLLCALL ("advapi32.dll" , "bool" , "AdjustTokenPrivileges" , "handle" , $HTOKEN , "bool" , $BDISABLE , "struct*" , $TTP1 , "dword" , DLLSTRUCTGETSIZE ($TTP2 ) , "struct*" , $TTP2 , "dword*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 200 , @EXTENDED , 0 ) LOCAL $IRESULT SWITCH _WINAPI_GETLASTERROR () CASE 1300 $IRESULT = 1 CASE ELSE $IRESULT = 0 ENDSWITCH $ICOUNT = DLLSTRUCTGETDATA ($TTP2 , 1 ) IF $ICOUNT THEN LOCAL $TDATA = DLLSTRUCTCREATE ("wchar[128]" ) DIM $APRIVILEGES [$ICOUNT ] [2 ] FOR $I = 0 TO $ICOUNT + 4294967295 $ARET = DLLCALL ("advapi32.dll" , "bool" , "LookupPrivilegeNameW" , "ptr" , 0 , "ptr" , DLLSTRUCTGETPTR ($TTP2 , 2 ) + 12 * $I , "struct*" , $TDATA , "dword*" , 128 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 300 , @EXTENDED , 0 ) $APRIVILEGES [$I ] [1 ] = DLLSTRUCTGETDATA ($TTP2 , 2 , 3 * $I + 3 ) $APRIVILEGES [$I ] [0 ] = DLLSTRUCTGETDATA ($TDATA , 1 ) NEXT $AADJUST = $APRIVILEGES ENDIF RETURN SETEXTENDED ($IRESULT , 1 ) ENDFUNC FUNC _WINAPI_ASSIGNPROCESSTOJOBOBJECT ($HJOB , $HPROCESS ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "AssignProcessToJobObject" , "handle" , $HJOB , "handle" , $HPROCESS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_ATTACHCONSOLE ($IPID = + 4294967295 ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "bool" , "AttachConsole" , "dword" , $IPID ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_ATTACHTHREADINPUT ($IATTACH , $IATTACHTO , $BATTACH ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "AttachThreadInput" , "dword" , $IATTACH , "dword" , $IATTACHTO , "bool" , $BATTACH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_CREATEEVENT ($TATTRIBUTES = 0 , $BMANUALRESET = TRUE , $BINITIALSTATE = TRUE , $SNAME = "" ) LOCAL $SNAMETYPE = "wstr" IF $SNAME = "" THEN $SNAME = 0 $SNAMETYPE = "ptr" ENDIF LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "handle" , "CreateEventW" , "struct*" , $TATTRIBUTES , "bool" , $BMANUALRESET , "bool" , $BINITIALSTATE , $SNAMETYPE , $SNAME ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_CREATEJOBOBJECT ($SNAME = "" , $TSECURITY = 0 ) LOCAL $STYPEOFNAME = "wstr" IF NOT STRINGSTRIPWS ($SNAME , $STR_STRIPLEADING + $STR_STRIPTRAILING ) THEN $STYPEOFNAME = "ptr" $SNAME = 0 ENDIF LOCAL $ARET = DLLCALL ("kernel32.dll" , "handle" , "CreateJobObjectW" , "struct*" , $TSECURITY , $STYPEOFNAME , $SNAME ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_CREATEMUTEX ($SMUTEX , $BINITIAL = TRUE , $TSECURITY = 0 ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "handle" , "CreateMutexW" , "struct*" , $TSECURITY , "bool" , $BINITIAL , "wstr" , $SMUTEX ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_CREATEPROCESS ($SAPPNAME , $SCOMMAND , $TSECURITY , $TTHREAD , $BINHERIT , $IFLAGS , $PENVIRON , $SDIR , $TSTARTUPINFO , $TPROCESS ) LOCAL $TCOMMAND = 0 LOCAL $SAPPNAMETYPE = "wstr" , $SDIRTYPE = "wstr" IF $SAPPNAME = "" THEN $SAPPNAMETYPE = "ptr" $SAPPNAME = 0 ENDIF IF $SCOMMAND <> "" THEN $TCOMMAND = DLLSTRUCTCREATE ("wchar Text[" & 260 + 1 & "]" ) DLLSTRUCTSETDATA ($TCOMMAND , "Text" , $SCOMMAND ) ENDIF IF $SDIR = "" THEN $SDIRTYPE = "ptr" $SDIR = 0 ENDIF LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "bool" , "CreateProcessW" , $SAPPNAMETYPE , $SAPPNAME , "struct*" , $TCOMMAND , "struct*" , $TSECURITY , "struct*" , $TTHREAD , "bool" , $BINHERIT , "dword" , $IFLAGS , "struct*" , $PENVIRON , $SDIRTYPE , $SDIR , "struct*" , $TSTARTUPINFO , "struct*" , $TPROCESS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_CREATEPROCESSWITHTOKEN ($SAPP , $SCMD , $IFLAGS , $TSTARTUPINFO , $TPROCESSINFO , $HTOKEN , $ILOGON = 0 , $PENVIRONMENT = 0 , $SDIR = "" ) LOCAL $STYPEOFAPP = "wstr" , $STYPEOFCMD = "wstr" , $STYPEOFDIR = "wstr" IF NOT STRINGSTRIPWS ($SAPP , $STR_STRIPLEADING + $STR_STRIPTRAILING ) THEN $STYPEOFAPP = "ptr" $SAPP = 0 ENDIF IF NOT STRINGSTRIPWS ($SCMD , $STR_STRIPLEADING + $STR_STRIPTRAILING ) THEN $STYPEOFCMD = "ptr" $SCMD = 0 ENDIF IF NOT STRINGSTRIPWS ($SDIR , $STR_STRIPLEADING + $STR_STRIPTRAILING ) THEN $STYPEOFDIR = "ptr" $SDIR = 0 ENDIF LOCAL $ARET = DLLCALL ("advapi32.dll" , "bool" , "CreateProcessWithTokenW" , "handle" , $HTOKEN , "dword" , $ILOGON , $STYPEOFAPP , $SAPP , $STYPEOFCMD , $SCMD , "dword" , $IFLAGS , "struct*" , $PENVIRONMENT , $STYPEOFDIR , $SDIR , "struct*" , $TSTARTUPINFO , "struct*" , $TPROCESSINFO ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_CREATESEMAPHORE ($SSEMAPHORE , $IINITIAL , $IMAXIMUM , $TSECURITY = 0 ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "handle" , "CreateSemaphoreW" , "struct*" , $TSECURITY , "long" , $IINITIAL , "long" , $IMAXIMUM , "wstr" , $SSEMAPHORE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_DUPLICATETOKENEX ($HTOKEN , $IACCESS , $ILEVEL , $ITYPE = 1 , $TSECURITY = 0 ) LOCAL $ARET = DLLCALL ("advapi32.dll" , "bool" , "DuplicateTokenEx" , "handle" , $HTOKEN , "dword" , $IACCESS , "struct*" , $TSECURITY , "int" , $ILEVEL , "int" , $ITYPE , "handle*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [6 ] ENDFUNC FUNC _WINAPI_EMPTYWORKINGSET ($IPID = 0 ) IF NOT $IPID THEN $IPID = @AUTOITPID LOCAL $HPROCESS = DLLCALL ("kernel32.dll" , "handle" , "OpenProcess" , "dword" , (($__WINVER < 1536 ) 1280 4352 ) , "bool" , 0 , "dword" , $IPID ) IF @ERROR OR NOT $HPROCESS [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , 0 ) LOCAL $ARET = DLLCALL (@SYSTEMDIR & "\psapi.dll" , "bool" , "EmptyWorkingSet" , "handle" , $HPROCESS [0 ] ) IF __CHECKERRORCLOSEHANDLE ($ARET , $HPROCESS [0 ] ) THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN 1 ENDFUNC FUNC _WINAPI_ENUMCHILDPROCESS ($IPID = 0 ) IF NOT $IPID THEN $IPID = @AUTOITPID LOCAL $HSNAPSHOT = DLLCALL ("kernel32.dll" , "handle" , "CreateToolhelp32Snapshot" , "dword" , 2 , "dword" , 0 ) IF @ERROR OR ($HSNAPSHOT [0 ] = PTR (+ 4294967295 ) ) THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $TPROCESSENTRY32 = DLLSTRUCTCREATE ($TAGPROCESSENTRY32 ) LOCAL $ARESULT [101 ] [2 ] = [[0 ] ] $HSNAPSHOT = $HSNAPSHOT [0 ] DLLSTRUCTSETDATA ($TPROCESSENTRY32 , "Size" , DLLSTRUCTGETSIZE ($TPROCESSENTRY32 ) ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "Process32FirstW" , "handle" , $HSNAPSHOT , "struct*" , $TPROCESSENTRY32 ) LOCAL $IERROR = @ERROR WHILE (NOT @ERROR ) AND ($ARET [0 ] ) IF DLLSTRUCTGETDATA ($TPROCESSENTRY32 , "ParentProcessID" ) = $IPID THEN __INC ($ARESULT ) $ARESULT [$ARESULT [0 ] [0 ] ] [0 ] = DLLSTRUCTGETDATA ($TPROCESSENTRY32 , "ProcessID" ) $ARESULT [$ARESULT [0 ] [0 ] ] [1 ] = DLLSTRUCTGETDATA ($TPROCESSENTRY32 , "ExeFile" ) ENDIF $ARET = DLLCALL ("kernel32.dll" , "bool" , "Process32NextW" , "handle" , $HSNAPSHOT , "struct*" , $TPROCESSENTRY32 ) $IERROR = @ERROR WEND DLLCALL ("kernel32.dll" , "bool" , "CloseHandle" , "handle" , $HSNAPSHOT ) IF NOT $ARESULT [0 ] [0 ] THEN RETURN SETERROR ($IERROR + 20 , 0 , 0 ) __INC ($ARESULT , + 4294967295 ) RETURN $ARESULT ENDFUNC FUNC _WINAPI_ENUMDEVICEDRIVERS () LOCAL $ARET = DLLCALL (@SYSTEMDIR & "\psapi.dll" , "bool" , "EnumDeviceDrivers" , "ptr" , 0 , "dword" , 0 , "dword*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $ISIZE IF @AUTOITX64 THEN $ISIZE = $ARET [3 ] / 8 ELSE $ISIZE = $ARET [3 ] / 4 ENDIF LOCAL $TDATA = DLLSTRUCTCREATE ("ptr[" & $ISIZE & "]" ) $ARET = DLLCALL (@SYSTEMDIR & "\psapi.dll" , "bool" , "EnumDeviceDrivers" , "struct*" , $TDATA , "dword" , DLLSTRUCTGETSIZE ($TDATA ) , "dword*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , 0 ) LOCAL $ARESULT [$ISIZE + 1 ] = [$ISIZE ] FOR $I = 1 TO $ISIZE $ARESULT [$I ] = DLLSTRUCTGETDATA ($TDATA , 1 , $I ) NEXT RETURN $ARESULT ENDFUNC FUNC _WINAPI_ENUMPROCESSHANDLES ($IPID = 0 , $ITYPE = 0 ) IF NOT $IPID THEN $IPID = @AUTOITPID LOCAL $ARESULT [101 ] [4 ] = [[0 ] ] LOCAL $TSHI = DLLSTRUCTCREATE ("ulong;byte[4194304]" ) LOCAL $ARET = DLLCALL ("ntdll.dll" , "long" , "ZwQuerySystemInformation" , "uint" , 16 , "struct*" , $TSHI , "ulong" , DLLSTRUCTGETSIZE ($TSHI ) , "ulong*" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF $ARET [0 ] THEN RETURN SETERROR (10 , $ARET [0 ] , 0 ) LOCAL $PDATA = DLLSTRUCTGETPTR ($TSHI , 2 ) LOCAL $THANDLE FOR $I = 1 TO DLLSTRUCTGETDATA ($TSHI , 1 ) $THANDLE = DLLSTRUCTCREATE ("align 4;ulong;byte;byte;ushort;ptr;ulong" , $PDATA + (@AUTOITX64 (4 + ($I + 4294967295 ) * 24 ) (($I + 4294967295 ) * 16 ) ) ) IF (DLLSTRUCTGETDATA ($THANDLE , 1 ) = $IPID ) AND ((NOT $ITYPE ) OR ($ITYPE = DLLSTRUCTGETDATA ($THANDLE , 2 ) ) ) THEN __INC ($ARESULT ) $ARESULT [$ARESULT [0 ] [0 ] ] [0 ] = PTR (DLLSTRUCTGETDATA ($THANDLE , 4 ) ) $ARESULT [$ARESULT [0 ] [0 ] ] [1 ] = DLLSTRUCTGETDATA ($THANDLE , 2 ) $ARESULT [$ARESULT [0 ] [0 ] ] [2 ] = DLLSTRUCTGETDATA ($THANDLE , 3 ) $ARESULT [$ARESULT [0 ] [0 ] ] [3 ] = DLLSTRUCTGETDATA ($THANDLE , 6 ) ENDIF NEXT IF NOT $ARESULT [0 ] [0 ] THEN RETURN SETERROR (11 , 0 , 0 ) __INC ($ARESULT , + 4294967295 ) RETURN $ARESULT ENDFUNC FUNC _WINAPI_ENUMPROCESSMODULES ($IPID = 0 , $IFLAG = 0 ) IF NOT $IPID THEN $IPID = @AUTOITPID LOCAL $HPROCESS = DLLCALL ("kernel32.dll" , "handle" , "OpenProcess" , "dword" , (($__WINVER < 1536 ) 1040 4112 ) , "bool" , 0 , "dword" , $IPID ) IF @ERROR OR NOT $HPROCESS [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , 0 ) LOCAL $ICOUNT , $ARET , $IERROR = 0 DO IF $__WINVER >= 1536 THEN $ARET = DLLCALL (@SYSTEMDIR & "\psapi.dll" , "bool" , "EnumProcessModulesEx" , "handle" , $HPROCESS [0 ] , "ptr" , 0 , "dword" , 0 , "dword*" , 0 , "dword" , $IFLAG ) ELSE $ARET = DLLCALL (@SYSTEMDIR & "\psapi.dll" , "bool" , "EnumProcessModules" , "handle" , $HPROCESS [0 ] , "ptr" , 0 , "dword" , 0 , "dword*" , 0 ) ENDIF IF @ERROR OR NOT $ARET [0 ] THEN $IERROR = @ERROR + 10 EXITLOOP ENDIF IF @AUTOITX64 THEN $ICOUNT = $ARET [4 ] / 8 ELSE $ICOUNT = $ARET [4 ] / 4 ENDIF LOCAL $TPTR = DLLSTRUCTCREATE ("ptr[" & $ICOUNT & "]" ) IF @ERROR THEN $IERROR = @ERROR + 30 EXITLOOP ENDIF IF $__WINVER >= 1536 THEN $ARET = DLLCALL (@SYSTEMDIR & "\psapi.dll" , "bool" , "EnumProcessModulesEx" , "handle" , $HPROCESS [0 ] , "struct*" , $TPTR , "dword" , DLLSTRUCTGETSIZE ($TPTR ) , "dword*" , 0 , "dword" , $IFLAG ) ELSE $ARET = DLLCALL (@SYSTEMDIR & "\psapi.dll" , "bool" , "EnumProcessModules" , "handle" , $HPROCESS [0 ] , "struct*" , $TPTR , "dword" , DLLSTRUCTGETSIZE ($TPTR ) , "dword*" , 0 ) ENDIF IF @ERROR OR NOT $ARET [0 ] THEN $IERROR = @ERROR + 40 EXITLOOP ENDIF LOCAL $ARESULT [$ICOUNT + 1 ] [2 ] = [[$ICOUNT ] ] FOR $I = 1 TO $ICOUNT $ARESULT [$I ] [0 ] = DLLSTRUCTGETDATA ($TPTR , 1 , $I ) $ARESULT [$I ] [1 ] = _WINAPI_GETMODULEFILENAMEEX ($HPROCESS [0 ] , $ARESULT [$I ] [0 ] ) NEXT UNTIL 1 DLLCALL ("kernel32.dll" , "bool" , "CloseHandle" , "handle" , $HPROCESS [0 ] ) IF $IERROR THEN RETURN SETERROR ($IERROR , 0 , 0 ) RETURN $ARESULT ENDFUNC FUNC _WINAPI_ENUMPROCESSTHREADS ($IPID = 0 ) IF NOT $IPID THEN $IPID = @AUTOITPID LOCAL $HSNAPSHOT = DLLCALL ("kernel32.dll" , "handle" , "CreateToolhelp32Snapshot" , "dword" , 4 , "dword" , 0 ) IF @ERROR OR NOT $HSNAPSHOT [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL CONST $TAGTHREADENTRY32 = "dword Size;dword Usage;dword ThreadID;dword OwnerProcessID;long BasePri;long DeltaPri;dword Flags" LOCAL $TTHREADENTRY32 = DLLSTRUCTCREATE ($TAGTHREADENTRY32 ) LOCAL $ARESULT [101 ] = [0 ] $HSNAPSHOT = $HSNAPSHOT [0 ] DLLSTRUCTSETDATA ($TTHREADENTRY32 , "Size" , DLLSTRUCTGETSIZE ($TTHREADENTRY32 ) ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "Thread32First" , "handle" , $HSNAPSHOT , "struct*" , $TTHREADENTRY32 ) WHILE NOT @ERROR AND $ARET [0 ] IF DLLSTRUCTGETDATA ($TTHREADENTRY32 , "OwnerProcessID" ) = $IPID THEN __INC ($ARESULT ) $ARESULT [$ARESULT [0 ] ] = DLLSTRUCTGETDATA ($TTHREADENTRY32 , "ThreadID" ) ENDIF $ARET = DLLCALL ("kernel32.dll" , "bool" , "Thread32Next" , "handle" , $HSNAPSHOT , "struct*" , $TTHREADENTRY32 ) WEND DLLCALL ("kernel32.dll" , "bool" , "CloseHandle" , "handle" , $HSNAPSHOT ) IF NOT $ARESULT [0 ] THEN RETURN SETERROR (1 , 0 , 0 ) __INC ($ARESULT , + 4294967295 ) RETURN $ARESULT ENDFUNC FUNC _WINAPI_ENUMPROCESSWINDOWS ($IPID = 0 , $BVISIBLE = TRUE ) LOCAL $ATHREADS = _WINAPI_ENUMPROCESSTHREADS ($IPID ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) LOCAL $HENUMPROC = DLLCALLBACKREGISTER ("__EnumWindowsProc" , "bool" , "hwnd;lparam" ) DIM $__G_VENUM [101 ] [2 ] = [[0 ] ] FOR $I = 1 TO $ATHREADS [0 ] DLLCALL ("user32.dll" , "bool" , "EnumThreadWindows" , "dword" , $ATHREADS [$I ] , "ptr" , DLLCALLBACKGETPTR ($HENUMPROC ) , "lparam" , $BVISIBLE ) IF @ERROR THEN EXITLOOP ENDIF NEXT DLLCALLBACKFREE ($HENUMPROC ) IF NOT $__G_VENUM [0 ] [0 ] THEN RETURN SETERROR (11 , 0 , 0 ) __INC ($__G_VENUM , + 4294967295 ) RETURN $__G_VENUM ENDFUNC FUNC _WINAPI_FATALAPPEXIT ($SMESSAGE ) DLLCALL ("kernel32.dll" , "none" , "FatalAppExitW" , "uint" , 0 , "wstr" , $SMESSAGE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED ) ENDFUNC FUNC _WINAPI_GETCURRENTPROCESSEXPLICITAPPUSERMODELID () LOCAL $ARET = DLLCALL ("shell32.dll" , "long" , "GetCurrentProcessExplicitAppUserModelID" , "ptr*" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) IF $ARET [0 ] THEN RETURN SETERROR (10 , $ARET [0 ] , "" ) LOCAL $SID = _WINAPI_GETSTRING ($ARET [1 ] ) _WINAPI_COTASKMEMFREE ($ARET [1 ] ) RETURN $SID ENDFUNC FUNC _WINAPI_GETCURRENTPROCESSID () LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "dword" , "GetCurrentProcessId" ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETCURRENTTHREAD () LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "handle" , "GetCurrentThread" ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETCURRENTTHREADID () LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "dword" , "GetCurrentThreadId" ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETDEVICEDRIVERBASENAME ($PDRIVER ) LOCAL $ARET = DLLCALL (@SYSTEMDIR & "\psapi.dll" , "dword" , "GetDeviceDriverBaseNameW" , "ptr" , $PDRIVER , "wstr" , "" , "dword" , 4096 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_GETDEVICEDRIVERFILENAME ($PDRIVER ) LOCAL $ARET = DLLCALL (@SYSTEMDIR & "\psapi.dll" , "dword" , "GetDeviceDriverFileNameW" , "ptr" , $PDRIVER , "wstr" , "" , "dword" , 4096 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_GETEXITCODEPROCESS ($HPROCESS ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "GetExitCodeProcess" , "handle" , $HPROCESS , "dword*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_GETGUIRESOURCES ($IFLAG = 0 , $HPROCESS = + 4294967295 ) IF $HPROCESS = + 4294967295 THEN $HPROCESS = _WINAPI_GETCURRENTPROCESS () LOCAL $ARESULT = DLLCALL ("user32.dll" , "dword" , "GetGuiResources" , "handle" , $HPROCESS , "dword" , $IFLAG ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETMODULEFILENAMEEX ($HPROCESS , $HMODULE = 0 ) LOCAL $ARET = DLLCALL (@SYSTEMDIR & "\psapi.dll" , "dword" , "GetModuleFileNameExW" , "handle" , $HPROCESS , "handle" , $HMODULE , "wstr" , "" , "int" , 4096 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , "" ) RETURN $ARET [3 ] ENDFUNC FUNC _WINAPI_GETMODULEINFORMATION ($HPROCESS , $HMODULE = 0 ) LOCAL $TMODULEINFO = DLLSTRUCTCREATE ($TAGMODULEINFO ) LOCAL $ARET = DLLCALL (@SYSTEMDIR & "\psapi.dll" , "bool" , "GetModuleInformation" , "handle" , $HPROCESS , "handle" , $HMODULE , "struct*" , $TMODULEINFO , "dword" , DLLSTRUCTGETSIZE ($TMODULEINFO ) ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN $TMODULEINFO ENDFUNC FUNC _WINAPI_GETPARENTPROCESS ($IPID = 0 ) IF NOT $IPID THEN $IPID = @AUTOITPID LOCAL $HSNAPSHOT = DLLCALL ("kernel32.dll" , "handle" , "CreateToolhelp32Snapshot" , "dword" , 2 , "dword" , 0 ) IF @ERROR OR NOT $HSNAPSHOT [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $TPROCESSENTRY32 = DLLSTRUCTCREATE ($TAGPROCESSENTRY32 ) LOCAL $IRESULT = 0 $HSNAPSHOT = $HSNAPSHOT [0 ] DLLSTRUCTSETDATA ($TPROCESSENTRY32 , "Size" , DLLSTRUCTGETSIZE ($TPROCESSENTRY32 ) ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "Process32FirstW" , "handle" , $HSNAPSHOT , "struct*" , $TPROCESSENTRY32 ) LOCAL $IERROR = @ERROR WHILE (NOT @ERROR ) AND ($ARET [0 ] ) IF DLLSTRUCTGETDATA ($TPROCESSENTRY32 , "ProcessID" ) = $IPID THEN $IRESULT = DLLSTRUCTGETDATA ($TPROCESSENTRY32 , "ParentProcessID" ) EXITLOOP ENDIF $ARET = DLLCALL ("kernel32.dll" , "bool" , "Process32NextW" , "handle" , $HSNAPSHOT , "struct*" , $TPROCESSENTRY32 ) $IERROR = @ERROR WEND DLLCALL ("kernel32.dll" , "bool" , "CloseHandle" , "handle" , $HSNAPSHOT ) IF NOT $IRESULT THEN RETURN SETERROR ($IERROR , 0 , 0 ) RETURN $IRESULT ENDFUNC FUNC _WINAPI_GETPRIORITYCLASS ($IPID = 0 ) IF NOT $IPID THEN $IPID = @AUTOITPID LOCAL $HPROCESS = DLLCALL ("kernel32.dll" , "handle" , "OpenProcess" , "dword" , (($__WINVER < 1536 ) 1024 4096 ) , "bool" , 0 , "dword" , $IPID ) IF @ERROR OR NOT $HPROCESS [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , 0 ) LOCAL $IERROR = 0 LOCAL $ARET = DLLCALL ("kernel32.dll" , "dword" , "GetPriorityClass" , "handle" , $HPROCESS [0 ] ) IF @ERROR THEN $IERROR = @ERROR DLLCALL ("kernel32.dll" , "bool" , "CloseHandle" , "handle" , $HPROCESS [0 ] ) IF $IERROR THEN RETURN SETERROR ($IERROR , 0 , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETPROCESSAFFINITYMASK ($HPROCESS ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "bool" , "GetProcessAffinityMask" , "handle" , $HPROCESS , "dword_ptr*" , 0 , "dword_ptr*" , 0 ) IF @ERROR OR NOT $ARESULT [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $AMASK [3 ] $AMASK [0 ] = TRUE $AMASK [1 ] = $ARESULT [2 ] $AMASK [2 ] = $ARESULT [3 ] RETURN $AMASK ENDFUNC FUNC _WINAPI_GETPROCESSCOMMANDLINE ($IPID = 0 ) IF NOT $IPID THEN $IPID = @AUTOITPID LOCAL $HPROCESS = DLLCALL ("kernel32.dll" , "handle" , "OpenProcess" , "dword" , (($__WINVER < 1536 ) 1040 4112 ) , "bool" , 0 , "dword" , $IPID ) IF @ERROR OR NOT $HPROCESS [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , "" ) $HPROCESS = $HPROCESS [0 ] LOCAL $TPBI = DLLSTRUCTCREATE ("ulong_ptr ExitStatus;ptr PebBaseAddress;ulong_ptr AffinityMask;ulong_ptr BasePriority;ulong_ptr UniqueProcessId;ulong_ptr InheritedFromUniqueProcessId" ) LOCAL $TPEB = DLLSTRUCTCREATE ("byte InheritedAddressSpace;byte ReadImageFileExecOptions;byte BeingDebugged;byte Spare;ptr Mutant;ptr ImageBaseAddress;ptr LoaderData;ptr ProcessParameters;ptr SubSystemData;ptr ProcessHeap;ptr FastPebLock;ptr FastPebLockRoutine;ptr FastPebUnlockRoutine;ulong EnvironmentUpdateCount;ptr KernelCallbackTable;ptr EventLogSection;ptr EventLog;ptr FreeList;ulong TlsExpansionCounter;ptr TlsBitmap;ulong TlsBitmapBits[2];ptr ReadOnlySharedMemoryBase;ptr ReadOnlySharedMemoryHeap;ptr ReadOnlyStaticServerData;ptr AnsiCodePageData;ptr OemCodePageData;ptr UnicodeCaseTableData;ulong NumberOfProcessors;ulong NtGlobalFlag;byte Spare2[4];int64 CriticalSectionTimeout;ulong HeapSegmentReserve;ulong HeapSegmentCommit;ulong HeapDeCommitTotalFreeThreshold;ulong HeapDeCommitFreeBlockThreshold;ulong NumberOfHeaps;ulong MaximumNumberOfHeaps;ptr ProcessHeaps;ptr GdiSharedHandleTable;ptr ProcessStarterHelper;ptr GdiDCAttributeList;ptr LoaderLock;ulong OSMajorVersion;ulong OSMinorVersion;ulong OSBuildNumber;ulong OSPlatformId;ulong ImageSubSystem;ulong ImageSubSystemMajorVersion;ulong ImageSubSystemMinorVersion;ulong GdiHandleBuffer[34];ulong PostProcessInitRoutine;ulong TlsExpansionBitmap;byte TlsExpansionBitmapBits[128];ulong SessionId" ) LOCAL $TUPP = DLLSTRUCTCREATE ("ulong AllocationSize;ulong ActualSize;ulong Flags;ulong Unknown1;ushort LengthUnknown2;ushort MaxLengthUnknown2;ptr Unknown2;ptr InputHandle;ptr OutputHandle;ptr ErrorHandle;ushort LengthCurrentDirectory;ushort MaxLengthCurrentDirectory;ptr CurrentDirectory;ptr CurrentDirectoryHandle;ushort LengthSearchPaths;ushort MaxLengthSearchPaths;ptr SearchPaths;ushort LengthApplicationName;ushort MaxLengthApplicationName;ptr ApplicationName;ushort LengthCommandLine;ushort MaxLengthCommandLine;ptr CommandLine;ptr EnvironmentBlock;ulong Unknown[9];ushort LengthUnknown3;ushort MaxLengthUnknown3;ptr Unknown3;ushort LengthUnknown4;ushort MaxLengthUnknown4;ptr Unknown4;ushort LengthUnknown5;ushort MaxLengthUnknown5;ptr Unknown5" ) LOCAL $TCMD LOCAL $ARET , $IERROR = 0 DO $ARET = DLLCALL ("ntdll.dll" , "long" , "NtQueryInformationProcess" , "handle" , $HPROCESS , "ulong" , 0 , "struct*" , $TPBI , "ulong" , DLLSTRUCTGETSIZE ($TPBI ) , "ulong*" , 0 ) IF @ERROR OR $ARET [0 ] THEN $IERROR = @ERROR + 30 EXITLOOP ENDIF $ARET = DLLCALL ("kernel32.dll" , "bool" , "ReadProcessMemory" , "handle" , $HPROCESS , "ptr" , DLLSTRUCTGETDATA ($TPBI , "PebBaseAddress" ) , "struct*" , $TPEB , "ulong_ptr" , DLLSTRUCTGETSIZE ($TPEB ) , "ulong_ptr*" , 0 ) IF @ERROR OR NOT $ARET [0 ] OR (NOT $ARET [5 ] ) THEN $IERROR = @ERROR + 40 EXITLOOP ENDIF $ARET = DLLCALL ("kernel32.dll" , "bool" , "ReadProcessMemory" , "handle" , $HPROCESS , "ptr" , DLLSTRUCTGETDATA ($TPEB , "ProcessParameters" ) , "struct*" , $TUPP , "ulong_ptr" , DLLSTRUCTGETSIZE ($TUPP ) , "ulong_ptr*" , 0 ) IF @ERROR OR NOT $ARET [0 ] OR (NOT $ARET [5 ] ) THEN $IERROR = @ERROR + 50 EXITLOOP ENDIF $TCMD = DLLSTRUCTCREATE ("byte[" & DLLSTRUCTGETDATA ($TUPP , "MaxLengthCommandLine" ) & "]" ) IF @ERROR THEN $IERROR = @ERROR + 60 EXITLOOP ENDIF $ARET = DLLCALL ("kernel32.dll" , "bool" , "ReadProcessMemory" , "handle" , $HPROCESS , "ptr" , DLLSTRUCTGETDATA ($TUPP , "CommandLine" ) , "struct*" , $TCMD , "ulong_ptr" , DLLSTRUCTGETSIZE ($TCMD ) , "ulong_ptr*" , 0 ) IF @ERROR OR NOT $ARET [0 ] OR (NOT $ARET [5 ] ) THEN $IERROR = @ERROR + 70 EXITLOOP ENDIF UNTIL 1 DLLCALL ("kernel32.dll" , "bool" , "CloseHandle" , "handle" , $HPROCESS ) IF $IERROR THEN RETURN SETERROR ($IERROR , 0 , "" ) RETURN STRINGSTRIPWS (_WINAPI_PATHGETARGS (_WINAPI_GETSTRING (DLLSTRUCTGETPTR ($TCMD , 1 ) ) ) , $STR_STRIPLEADING + $STR_STRIPTRAILING ) ENDFUNC FUNC _WINAPI_GETPROCESSFILENAME ($IPID = 0 ) IF NOT $IPID THEN $IPID = @AUTOITPID LOCAL $HPROCESS = DLLCALL ("kernel32.dll" , "handle" , "OpenProcess" , "dword" , (($__WINVER < 1536 ) 1040 4112 ) , "bool" , 0 , "dword" , $IPID ) IF @ERROR OR NOT $HPROCESS [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , "" ) LOCAL $SPATH = _WINAPI_GETMODULEFILENAMEEX ($HPROCESS [0 ] ) LOCAL $IERROR = @ERROR DLLCALL ("kernel32.dll" , "bool" , "CloseHandle" , "handle" , $HPROCESS [0 ] ) IF $IERROR THEN RETURN SETERROR (@ERROR , 0 , "" ) RETURN $SPATH ENDFUNC FUNC _WINAPI_GETPROCESSHANDLECOUNT ($IPID = 0 ) IF NOT $IPID THEN $IPID = @AUTOITPID LOCAL $HPROCESS = DLLCALL ("kernel32.dll" , "handle" , "OpenProcess" , "dword" , (($__WINVER < 1536 ) 1024 4096 ) , "bool" , 0 , "dword" , $IPID ) IF @ERROR OR NOT $HPROCESS [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , 0 ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "GetProcessHandleCount" , "handle" , $HPROCESS [0 ] , "dword*" , 0 ) IF __CHECKERRORCLOSEHANDLE ($ARET , $HPROCESS [0 ] ) THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_GETPROCESSID ($HPROCESS ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "dword" , "GetProcessId" , "handle" , $HPROCESS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETPROCESSIOCOUNTERS ($IPID = 0 ) IF NOT $IPID THEN $IPID = @AUTOITPID LOCAL $HPROCESS = DLLCALL ("kernel32.dll" , "handle" , "OpenProcess" , "dword" , (($__WINVER < 1536 ) 1024 4096 ) , "bool" , 0 , "dword" , $IPID ) IF @ERROR OR NOT $HPROCESS [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , 0 ) LOCAL $TIO_COUNTERS = DLLSTRUCTCREATE ("uint64[6]" ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "GetProcessIoCounters" , "handle" , $HPROCESS [0 ] , "struct*" , $TIO_COUNTERS ) IF __CHECKERRORCLOSEHANDLE ($ARET , $HPROCESS [0 ] ) THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) LOCAL $ARESULT [6 ] FOR $I = 0 TO 5 $ARESULT [$I ] = DLLSTRUCTGETDATA ($TIO_COUNTERS , 1 , $I + 1 ) NEXT RETURN $ARESULT ENDFUNC FUNC _WINAPI_GETPROCESSMEMORYINFO ($IPID = 0 ) IF NOT $IPID THEN $IPID = @AUTOITPID LOCAL $HPROCESS = DLLCALL ("kernel32.dll" , "handle" , "OpenProcess" , "dword" , (($__WINVER < 1536 ) 1040 4112 ) , "bool" , 0 , "dword" , $IPID ) IF @ERROR OR NOT $HPROCESS [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , 0 ) LOCAL $TPMC_EX = DLLSTRUCTCREATE ("dword;dword;ulong_ptr;ulong_ptr;ulong_ptr;ulong_ptr;ulong_ptr;ulong_ptr;ulong_ptr;ulong_ptr;ulong_ptr" ) LOCAL $ARET = DLLCALL (@SYSTEMDIR & "\psapi.dll" , "bool" , "GetProcessMemoryInfo" , "handle" , $HPROCESS [0 ] , "struct*" , $TPMC_EX , "int" , DLLSTRUCTGETSIZE ($TPMC_EX ) ) IF __CHECKERRORCLOSEHANDLE ($ARET , $HPROCESS [0 ] ) THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) LOCAL $ARESULT [10 ] FOR $I = 0 TO 9 $ARESULT [$I ] = DLLSTRUCTGETDATA ($TPMC_EX , $I + 2 ) NEXT RETURN $ARESULT ENDFUNC FUNC _WINAPI_GETPROCESSNAME ($IPID = 0 ) IF NOT $IPID THEN $IPID = @AUTOITPID LOCAL $HSNAPSHOT = DLLCALL ("kernel32.dll" , "handle" , "CreateToolhelp32Snapshot" , "dword" , 2 , "dword" , 0 ) IF @ERROR OR NOT $HSNAPSHOT [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , "" ) $HSNAPSHOT = $HSNAPSHOT [0 ] LOCAL $TPROCESSENTRY32 = DLLSTRUCTCREATE ($TAGPROCESSENTRY32 ) DLLSTRUCTSETDATA ($TPROCESSENTRY32 , "Size" , DLLSTRUCTGETSIZE ($TPROCESSENTRY32 ) ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "Process32FirstW" , "handle" , $HSNAPSHOT , "struct*" , $TPROCESSENTRY32 ) LOCAL $IERROR = @ERROR WHILE (NOT @ERROR ) AND ($ARET [0 ] ) IF DLLSTRUCTGETDATA ($TPROCESSENTRY32 , "ProcessID" ) = $IPID THEN EXITLOOP ENDIF $ARET = DLLCALL ("kernel32.dll" , "bool" , "Process32NextW" , "handle" , $HSNAPSHOT , "struct*" , $TPROCESSENTRY32 ) $IERROR = @ERROR WEND DLLCALL ("kernel32.dll" , "bool" , "CloseHandle" , "handle" , $HSNAPSHOT ) IF $IERROR THEN RETURN SETERROR ($IERROR , 0 , "" ) IF NOT $ARET [0 ] THEN SETERROR (10 , 0 , "" ) RETURN DLLSTRUCTGETDATA ($TPROCESSENTRY32 , "ExeFile" ) ENDFUNC FUNC _WINAPI_GETPROCESSTIMES ($IPID = 0 ) IF NOT $IPID THEN $IPID = @AUTOITPID LOCAL $HPROCESS = DLLCALL ("kernel32.dll" , "handle" , "OpenProcess" , "dword" , (($__WINVER < 1536 ) 1024 4096 ) , "bool" , 0 , "dword" , $IPID ) IF @ERROR OR NOT $HPROCESS [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , 0 ) LOCAL $TFILETIME = DLLSTRUCTCREATE ($TAGFILETIME ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "GetProcessTimes" , "handle" , $HPROCESS [0 ] , "struct*" , $TFILETIME , "uint64*" , 0 , "uint64*" , 0 , "uint64*" , 0 ) IF __CHECKERRORCLOSEHANDLE ($ARET , $HPROCESS [0 ] ) THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) LOCAL $ARESULT [3 ] $ARESULT [0 ] = $TFILETIME $ARESULT [1 ] = $ARET [4 ] $ARESULT [2 ] = $ARET [5 ] RETURN $ARESULT ENDFUNC FUNC _WINAPI_GETPROCESSUSER ($IPID = 0 ) IF NOT $IPID THEN $IPID = @AUTOITPID LOCAL $TSID , $HTOKEN , $ARET LOCAL $IERROR = 0 LOCAL $HPROCESS = DLLCALL ("kernel32.dll" , "handle" , "OpenProcess" , "dword" , (($__WINVER < 1536 ) 1024 4096 ) , "bool" , 0 , "dword" , $IPID ) IF @ERROR OR NOT $HPROCESS [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , 0 ) DO $HTOKEN = _WINAPI_OPENPROCESSTOKEN (8 , $HPROCESS [0 ] ) IF NOT $HTOKEN THEN $IERROR = @ERROR + 10 EXITLOOP ENDIF $TSID = DLLSTRUCTCREATE ("ptr;byte[1024]" ) $ARET = DLLCALL ("advapi32.dll" , "bool" , "GetTokenInformation" , "handle" , $HTOKEN , "uint" , 1 , "struct*" , $TSID , "dword" , DLLSTRUCTGETSIZE ($TSID ) , "dword*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN $IERROR = @ERROR + 30 EXITLOOP ENDIF $ARET = DLLCALL ("advapi32.dll" , "bool" , "LookupAccountSidW" , "ptr" , 0 , "ptr" , DLLSTRUCTGETDATA ($TSID , 1 ) , "wstr" , "" , "dword*" , 2048 , "wstr" , "" , "dword*" , 2048 , "uint*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN $IERROR = @ERROR + 40 EXITLOOP ENDIF UNTIL 1 IF $HTOKEN THEN DLLCALL ("kernel32.dll" , "bool" , "CloseHandle" , "handle" , $HTOKEN ) ENDIF DLLCALL ("kernel32.dll" , "bool" , "CloseHandle" , "handle" , $HPROCESS [0 ] ) IF $IERROR THEN RETURN SETERROR ($IERROR , 0 , 0 ) LOCAL $ARESULT [2 ] $ARESULT [0 ] = $ARET [3 ] $ARESULT [1 ] = $ARET [5 ] RETURN $ARESULT ENDFUNC FUNC _WINAPI_GETPROCESSWORKINGDIRECTORY ($IPID = 0 ) IF NOT $IPID THEN $IPID = @AUTOITPID LOCAL $ARET , $IERROR = 0 LOCAL $HPROCESS = DLLCALL ("kernel32.dll" , "handle" , "OpenProcess" , "dword" , (($__WINVER < 1536 ) 1040 4112 ) , "bool" , 0 , "dword" , $IPID ) IF @ERROR OR NOT $HPROCESS [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , "" ) $HPROCESS = $HPROCESS [0 ] LOCAL $TPBI = DLLSTRUCTCREATE ("ulong_ptr ExitStatus;ptr PebBaseAddress;ulong_ptr AffinityMask;ulong_ptr BasePriority;ulong_ptr UniqueProcessId;ulong_ptr InheritedFromUniqueProcessId" ) LOCAL $TPEB = DLLSTRUCTCREATE ("byte InheritedAddressSpace;byte ReadImageFileExecOptions;byte BeingDebugged;byte Spare;ptr Mutant;ptr ImageBaseAddress;ptr LoaderData;ptr ProcessParameters;ptr SubSystemData;ptr ProcessHeap;ptr FastPebLock;ptr FastPebLockRoutine;ptr FastPebUnlockRoutine;ulong EnvironmentUpdateCount;ptr KernelCallbackTable;ptr EventLogSection;ptr EventLog;ptr FreeList;ulong TlsExpansionCounter;ptr TlsBitmap;ulong TlsBitmapBits[2];ptr ReadOnlySharedMemoryBase;ptr ReadOnlySharedMemoryHeap;ptr ReadOnlyStaticServerData;ptr AnsiCodePageData;ptr OemCodePageData;ptr UnicodeCaseTableData;ulong NumberOfProcessors;ulong NtGlobalFlag;byte Spare2[4];int64 CriticalSectionTimeout;ulong HeapSegmentReserve;ulong HeapSegmentCommit;ulong HeapDeCommitTotalFreeThreshold;ulong HeapDeCommitFreeBlockThreshold;ulong NumberOfHeaps;ulong MaximumNumberOfHeaps;ptr ProcessHeaps;ptr GdiSharedHandleTable;ptr ProcessStarterHelper;ptr GdiDCAttributeList;ptr LoaderLock;ulong OSMajorVersion;ulong OSMinorVersion;ulong OSBuildNumber;ulong OSPlatformId;ulong ImageSubSystem;ulong ImageSubSystemMajorVersion;ulong ImageSubSystemMinorVersion;ulong GdiHandleBuffer[34];ulong PostProcessInitRoutine;ulong TlsExpansionBitmap;byte TlsExpansionBitmapBits[128];ulong SessionId" ) LOCAL $TUPP = DLLSTRUCTCREATE ("ulong AllocationSize;ulong ActualSize;ulong Flags;ulong Unknown1;ushort LengthUnknown2;ushort MaxLengthUnknown2;ptr Unknown2;ptr InputHandle;ptr OutputHandle;ptr ErrorHandle;ushort LengthCurrentDirectory;ushort MaxLengthCurrentDirectory;ptr CurrentDirectory;ptr CurrentDirectoryHandle;ushort LengthSearchPaths;ushort MaxLengthSearchPaths;ptr SearchPaths;ushort LengthApplicationName;ushort MaxLengthApplicationName;ptr ApplicationName;ushort LengthCommandLine;ushort MaxLengthCommandLine;ptr CommandLine;ptr EnvironmentBlock;ulong Unknown[9];ushort LengthUnknown3;ushort MaxLengthUnknown3;ptr Unknown3;ushort LengthUnknown4;ushort MaxLengthUnknown4;ptr Unknown4;ushort LengthUnknown5;ushort MaxLengthUnknown5;ptr Unknown5" ) LOCAL $TDIR DO $ARET = DLLCALL ("ntdll.dll" , "long" , "NtQueryInformationProcess" , "handle" , $HPROCESS , "ulong" , 0 , "struct*" , $TPBI , "ulong" , DLLSTRUCTGETSIZE ($TPBI ) , "ulong*" , 0 ) IF @ERROR OR ($ARET [0 ] ) THEN $IERROR = @ERROR + 10 EXITLOOP ENDIF $ARET = DLLCALL ("kernel32.dll" , "bool" , "ReadProcessMemory" , "handle" , $HPROCESS , "ptr" , DLLSTRUCTGETDATA ($TPBI , "PebBaseAddress" ) , "struct*" , $TPEB , "ulong_ptr" , DLLSTRUCTGETSIZE ($TPEB ) , "ulong_ptr*" , 0 ) IF @ERROR OR (NOT $ARET [0 ] ) OR (NOT $ARET [5 ] ) THEN $IERROR = @ERROR + 30 EXITLOOP ENDIF $ARET = DLLCALL ("kernel32.dll" , "bool" , "ReadProcessMemory" , "handle" , $HPROCESS , "ptr" , DLLSTRUCTGETDATA ($TPEB , "ProcessParameters" ) , "struct*" , $TUPP , "ulong_ptr" , DLLSTRUCTGETSIZE ($TUPP ) , "ulong_ptr*" , 0 ) IF @ERROR OR (NOT $ARET [0 ] ) OR (NOT $ARET [5 ] ) THEN $IERROR = @ERROR + 40 EXITLOOP ENDIF $TDIR = DLLSTRUCTCREATE ("byte[" & DLLSTRUCTGETDATA ($TUPP , "MaxLengthCurrentDirectory" ) & "]" ) IF @ERROR THEN $IERROR = @ERROR + 50 EXITLOOP ENDIF $ARET = DLLCALL ("kernel32.dll" , "bool" , "ReadProcessMemory" , "handle" , $HPROCESS , "ptr" , DLLSTRUCTGETDATA ($TUPP , "CurrentDirectory" ) , "struct*" , $TDIR , "ulong_ptr" , DLLSTRUCTGETSIZE ($TDIR ) , "ulong_ptr*" , 0 ) IF @ERROR OR (NOT $ARET [0 ] ) OR (NOT $ARET [5 ] ) THEN $IERROR = @ERROR + 60 EXITLOOP ENDIF $IERROR = 0 UNTIL 1 DLLCALL ("kernel32.dll" , "bool" , "CloseHandle" , "handle" , $HPROCESS ) IF $IERROR THEN RETURN SETERROR ($IERROR , 0 , "" ) RETURN _WINAPI_PATHREMOVEBACKSLASH (_WINAPI_GETSTRING (DLLSTRUCTGETPTR ($TDIR ) ) ) ENDFUNC FUNC _WINAPI_GETTHREADDESKTOP ($ITHREADID ) LOCAL $ARET = DLLCALL ("user32.dll" , "handle" , "GetThreadDesktop" , "dword" , $ITHREADID ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETTHREADERRORMODE () LOCAL $ARET = DLLCALL ("kernel32.dll" , "dword" , "GetThreadErrorMode" ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETWINDOWFILENAME ($HWND ) LOCAL $IPID = 0 LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "IsWindow" , "hwnd" , $HWND ) IF $ARESULT [0 ] THEN $ARESULT = DLLCALL ("user32.dll" , "dword" , "GetWindowThreadProcessId" , "hwnd" , $HWND , "dword*" , 0 ) $IPID = $ARESULT [2 ] ENDIF IF NOT $IPID THEN RETURN SETERROR (1 , 0 , "" ) LOCAL $SRESULT = _WINAPI_GETPROCESSFILENAME ($IPID ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN $SRESULT ENDFUNC FUNC _WINAPI_ISELEVATED () LOCAL $IELEV , $ARET , $IERROR = 0 LOCAL $HTOKEN = _WINAPI_OPENPROCESSTOKEN (8 ) IF NOT $HTOKEN THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , FALSE ) DO $ARET = DLLCALL ("advapi32.dll" , "bool" , "GetTokenInformation" , "handle" , $HTOKEN , "uint" , 20 , "uint*" , 0 , "dword" , 4 , "dword*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN $IERROR = @ERROR + 10 EXITLOOP ENDIF $IELEV = $ARET [3 ] $ARET = DLLCALL ("advapi32.dll" , "bool" , "GetTokenInformation" , "handle" , $HTOKEN , "uint" , 18 , "uint*" , 0 , "dword" , 4 , "dword*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN $IERROR = @ERROR + 20 EXITLOOP ENDIF UNTIL 1 DLLCALL ("kernel32.dll" , "bool" , "CloseHandle" , "handle" , $HTOKEN ) IF $IERROR THEN RETURN SETERROR ($IERROR , 0 , FALSE ) RETURN SETEXTENDED ($ARET [0 ] + 4294967295 , $IELEV ) ENDFUNC FUNC _WINAPI_ISPROCESSINJOB ($HPROCESS , $HJOB = 0 ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "IsProcessInJob" , "handle" , $HPROCESS , "handle" , $HJOB , "bool*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [3 ] ENDFUNC FUNC _WINAPI_OPENJOBOBJECT ($SNAME , $IACCESS = $JOB_OBJECT_ALL_ACCESS , $BINHERIT = FALSE ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "handle" , "OpenJobObjectW" , "dword" , $IACCESS , "bool" , $BINHERIT , "wstr" , $SNAME ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_OPENMUTEX ($SMUTEX , $IACCESS = $MUTEX_ALL_ACCESS , $BINHERIT = FALSE ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "handle" , "OpenMutexW" , "dword" , $IACCESS , "bool" , $BINHERIT , "wstr" , $SMUTEX ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_OPENPROCESS ($IACCESS , $BINHERIT , $IPID , $BDEBUGPRIV = FALSE ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "handle" , "OpenProcess" , "dword" , $IACCESS , "bool" , $BINHERIT , "dword" , $IPID ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF $ARESULT [0 ] THEN RETURN $ARESULT [0 ] IF NOT $BDEBUGPRIV THEN RETURN SETERROR (100 , 0 , 0 ) LOCAL $HTOKEN = _SECURITY__OPENTHREADTOKENEX (BITOR ($TOKEN_ADJUST_PRIVILEGES , $TOKEN_QUERY ) ) IF @ERROR THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) _SECURITY__SETPRIVILEGE ($HTOKEN , "SeDebugPrivilege" , TRUE ) LOCAL $IERROR = @ERROR LOCAL $IEXTENDED = @EXTENDED LOCAL $IRET = 0 IF NOT @ERROR THEN $ARESULT = DLLCALL ("kernel32.dll" , "handle" , "OpenProcess" , "dword" , $IACCESS , "bool" , $BINHERIT , "dword" , $IPID ) $IERROR = @ERROR $IEXTENDED = @EXTENDED IF $ARESULT [0 ] THEN $IRET = $ARESULT [0 ] _SECURITY__SETPRIVILEGE ($HTOKEN , "SeDebugPrivilege" , FALSE ) IF @ERROR THEN $IERROR = @ERROR + 20 $IEXTENDED = @EXTENDED ENDIF ELSE $IERROR = @ERROR + 30 ENDIF DLLCALL ("kernel32.dll" , "bool" , "CloseHandle" , "handle" , $HTOKEN ) RETURN SETERROR ($IERROR , $IEXTENDED , $IRET ) ENDFUNC FUNC _WINAPI_OPENPROCESSTOKEN ($IACCESS , $HPROCESS = 0 ) IF NOT $HPROCESS THEN $HPROCESS = DLLCALL ("kernel32.dll" , "handle" , "GetCurrentProcess" ) $HPROCESS = $HPROCESS [0 ] ENDIF LOCAL $ARET = DLLCALL ("advapi32.dll" , "bool" , "OpenProcessToken" , "handle" , $HPROCESS , "dword" , $IACCESS , "handle*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [3 ] ENDFUNC FUNC _WINAPI_OPENSEMAPHORE ($SSEMAPHORE , $IACCESS = 2031619 , $BINHERIT = FALSE ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "handle" , "OpenSemaphoreW" , "dword" , $IACCESS , "bool" , $BINHERIT , "wstr" , $SSEMAPHORE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_QUERYINFORMATIONJOBOBJECT ($HJOB , $IJOBOBJECTINFOCLASS , BYREF $TJOBOBJECTINFO ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "QueryInformationJobObject" , "handle" , $HJOB , "int" , $IJOBOBJECTINFOCLASS , "struct*" , $TJOBOBJECTINFO , "dword" , DLLSTRUCTGETSIZE ($TJOBOBJECTINFO ) , "dword*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [5 ] ENDFUNC FUNC _WINAPI_RELEASEMUTEX ($HMUTEX ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "ReleaseMutex" , "handle" , $HMUTEX ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_RELEASESEMAPHORE ($HSEMAPHORE , $IINCREASE = 1 ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "ReleaseSemaphore" , "handle" , $HSEMAPHORE , "long" , $IINCREASE , "long*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN $ARET [3 ] ENDFUNC FUNC _WINAPI_RESETEVENT ($HEVENT ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "ResetEvent" , "handle" , $HEVENT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SETEVENT ($HEVENT ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "bool" , "SetEvent" , "handle" , $HEVENT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_SETINFORMATIONJOBOBJECT ($HJOB , $IJOBOBJECTINFOCLASS , $TJOBOBJECTINFO ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "SetInformationJobObject" , "handle" , $HJOB , "int" , $IJOBOBJECTINFOCLASS , "struct*" , $TJOBOBJECTINFO , "dword" , DLLSTRUCTGETSIZE ($TJOBOBJECTINFO ) ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SETPRIORITYCLASS ($IPRIORITY , $IPID = 0 ) IF NOT $IPID THEN $IPID = @AUTOITPID LOCAL $HPROCESS = DLLCALL ("kernel32.dll" , "handle" , "OpenProcess" , "dword" , (($__WINVER < 1536 ) 1536 4608 ) , "bool" , 0 , "dword" , $IPID ) IF @ERROR OR NOT $HPROCESS [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $IERROR = 0 LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "SetPriorityClass" , "handle" , $HPROCESS [0 ] , "dword" , $IPRIORITY ) IF @ERROR THEN $IERROR = @ERROR DLLCALL ("kernel32.dll" , "bool" , "CloseHandle" , "handle" , $HPROCESS [0 ] ) IF $IERROR THEN RETURN SETERROR ($IERROR , 0 , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SETPROCESSAFFINITYMASK ($HPROCESS , $IMASK ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "bool" , "SetProcessAffinityMask" , "handle" , $HPROCESS , "ulong_ptr" , $IMASK ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_SETTHREADDESKTOP ($HDESKTOP ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "SetThreadDesktop" , "handle" , $HDESKTOP ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SETTHREADERRORMODE ($IMODE ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "SetThreadErrorMode" , "dword" , $IMODE , "dword*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_SETTHREADEXECUTIONSTATE ($IFLAGS ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "dword" , "SetThreadExecutionState" , "dword" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_TERMINATEJOBOBJECT ($HJOB , $IEXITCODE = 0 ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "TerminateJobObject" , "handle" , $HJOB , "uint" , $IEXITCODE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_TERMINATEPROCESS ($HPROCESS , $IEXITCODE = 0 ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "TerminateProcess" , "handle" , $HPROCESS , "uint" , $IEXITCODE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_USERHANDLEGRANTACCESS ($HOBJECT , $HJOB , $BGRANT ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "UserHandleGrantAccess" , "handle" , $HOBJECT , "handle" , $HJOB , "bool" , $BGRANT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_WAITFORINPUTIDLE ($HPROCESS , $ITIMEOUT = + 4294967295 ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "dword" , "WaitForInputIdle" , "handle" , $HPROCESS , "dword" , $ITIMEOUT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_WAITFORMULTIPLEOBJECTS ($ICOUNT , $PAHANDLES , $BWAITALL = FALSE , $ITIMEOUT = + 4294967295 ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "INT" , "WaitForMultipleObjects" , "dword" , $ICOUNT , "struct*" , $PAHANDLES , "bool" , $BWAITALL , "dword" , $ITIMEOUT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , + 4294967295 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_WAITFORSINGLEOBJECT ($HHANDLE , $ITIMEOUT = + 4294967295 ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "INT" , "WaitForSingleObject" , "handle" , $HHANDLE , "dword" , $ITIMEOUT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , + 4294967295 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_WRITECONSOLE ($HCONSOLE , $STEXT ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "bool" , "WriteConsoleW" , "handle" , $HCONSOLE , "wstr" , $STEXT , "dword" , STRINGLEN ($STEXT ) , "dword*" , 0 , "ptr" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC #EndRegion Public Functions GLOBAL CONST $KLF_ACTIVATE = 1 GLOBAL CONST $KLF_NOTELLSHELL = 128 GLOBAL CONST $KLF_REORDER = 8 GLOBAL CONST $KLF_REPLACELANG = 16 GLOBAL CONST $KLF_RESET = 1073741824 GLOBAL CONST $KLF_SETFORPROCESS = 256 GLOBAL CONST $KLF_SHIFTLOCK = 65536 GLOBAL CONST $KLF_SUBSTITUTE_OK = 2 GLOBAL CONST $HKL_NEXT = 1 GLOBAL CONST $HKL_PREV = 0 GLOBAL CONST $AW_ACTIVATE = 131072 GLOBAL CONST $AW_BLEND = 524288 GLOBAL CONST $AW_CENTER = 16 GLOBAL CONST $AW_HIDE = 65536 GLOBAL CONST $AW_HOR_NEGATIVE = 2 GLOBAL CONST $AW_HOR_POSITIVE = 1 GLOBAL CONST $AW_SLIDE = 262144 GLOBAL CONST $AW_VER_NEGATIVE = 8 GLOBAL CONST $AW_VER_POSITIVE = 4 GLOBAL CONST $BSF_ALLOWSFW = 128 GLOBAL CONST $BSF_FLUSHDISK = 4 GLOBAL CONST $BSF_FORCEIFHUNG = 32 GLOBAL CONST $BSF_IGNORECURRENTTASK = 2 GLOBAL CONST $BSF_NOHANG = 8 GLOBAL CONST $BSF_NOTIMEOUTIFNOTHUNG = 64 GLOBAL CONST $BSF_POSTMESSAGE = 16 GLOBAL CONST $BSF_QUERY = 1 GLOBAL CONST $BSF_SENDNOTIFYMESSAGE = 256 GLOBAL CONST $BSM_ALLCOMPONENTS = 0 GLOBAL CONST $BSM_ALLDESKTOPS = 8 GLOBAL CONST $BSM_APPLICATIONS = 16 GLOBAL CONST $BSM_INSTALLABLEDRIVERS = 4 GLOBAL CONST $BSM_NETDRIVER = 2 GLOBAL CONST $BSM_VXDS = 1 GLOBAL CONST $MDITILE_HORIZONTAL = 1 GLOBAL CONST $MDITILE_SKIPDISABLED = 2 GLOBAL CONST $MDITILE_VERTICAL = 0 GLOBAL CONST $MDITILE_ZORDER = 4 GLOBAL CONST $MSGFLT_ALLOW = 1 GLOBAL CONST $MSGFLT_DISALLOW = 2 GLOBAL CONST $MSGFLT_RESET = 0 GLOBAL CONST $MSGFLTINFO_ALLOWED_HIGHER = 3 GLOBAL CONST $MSGFLTINFO_ALREADYALLOWED_FORWND = 1 GLOBAL CONST $MSGFLTINFO_ALREADYDISALLOWED_FORWND = 2 GLOBAL CONST $MSGFLTINFO_NONE = 0 GLOBAL CONST $CWP_ALL = 0 GLOBAL CONST $CWP_SKIPINVISIBLE = 1 GLOBAL CONST $CWP_SKIPDISABLED = 2 GLOBAL CONST $CWP_SKIPTRANSPARENT = 4 GLOBAL CONST $COMPRESSION_FORMAT_NONE = 0 GLOBAL CONST $COMPRESSION_FORMAT_DEFAULT = 1 GLOBAL CONST $COMPRESSION_FORMAT_LZNT1 = 2 GLOBAL CONST $COMPRESSION_FORMAT_XPRESS = 3 GLOBAL CONST $COMPRESSION_FORMAT_XPRESS_HUFF = 4 GLOBAL CONST $COMPRESSION_ENGINE_STANDARD = 0 GLOBAL CONST $COMPRESSION_ENGINE_MAXIMUM = 256 GLOBAL CONST $COMPRESSION_ENGINE_HIBER = 512 GLOBAL CONST $WINSTA_ACCESSCLIPBOARD = 4 GLOBAL CONST $WINSTA_ACCESSGLOBALATOMS = 32 GLOBAL CONST $WINSTA_CREATEDESKTOP = 8 GLOBAL CONST $WINSTA_ENUMDESKTOPS = 1 GLOBAL CONST $WINSTA_ENUMERATE = 256 GLOBAL CONST $WINSTA_EXITWINDOWS = 64 GLOBAL CONST $WINSTA_READATTRIBUTES = 2 GLOBAL CONST $WINSTA_READSCREEN = 512 GLOBAL CONST $WINSTA_WRITEATTRIBUTES = 16 GLOBAL CONST $WINSTA_ALL_ACCESS = BITOR ($WINSTA_ACCESSCLIPBOARD , $WINSTA_ACCESSGLOBALATOMS , $WINSTA_CREATEDESKTOP , $WINSTA_ENUMDESKTOPS , $WINSTA_ENUMERATE , $WINSTA_EXITWINDOWS , $WINSTA_READATTRIBUTES , $WINSTA_READSCREEN , $WINSTA_WRITEATTRIBUTES ) GLOBAL CONST $CWF_CREATE_ONLY = 1 GLOBAL CONST $GCL_CBCLSEXTRA = + 4294967276 GLOBAL CONST $GCL_CBWNDEXTRA = + 4294967278 GLOBAL CONST $GCL_HBRBACKGROUND = + 4294967286 GLOBAL CONST $GCL_HCURSOR = + 4294967284 GLOBAL CONST $GCL_HICON = + 4294967282 GLOBAL CONST $GCL_HICONSM = + 4294967262 GLOBAL CONST $GCL_HMODULE = + 4294967280 GLOBAL CONST $GCL_MENUNAME = + 4294967288 GLOBAL CONST $GCL_STYLE = + 4294967270 GLOBAL CONST $GCL_WNDPROC = + 4294967272 GLOBAL CONST $DOCKINFO_DOCKED = 2 GLOBAL CONST $DOCKINFO_UNDOCKED = 1 GLOBAL CONST $DOCKINFO_USER_SUPPLIED = 4 GLOBAL CONST $DOCKINFO_USER_DOCKED = 5 GLOBAL CONST $DOCKINFO_USER_UNDOCKED = 6 GLOBAL CONST $GUI_CARETBLINKING = 1 GLOBAL CONST $GUI_INMENUMODE = 4 GLOBAL CONST $GUI_INMOVESIZE = 2 GLOBAL CONST $GUI_POPUPMENUMODE = 16 GLOBAL CONST $GUI_SYSTEMMENUMODE = 8 GLOBAL CONST $HANDLE_FLAG_INHERIT = 1 GLOBAL CONST $HANDLE_FLAG_PROTECT_FROM_CLOSE = 2 GLOBAL CONST $GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS = 4 GLOBAL CONST $GET_MODULE_HANDLE_EX_FLAG_PIN = 1 GLOBAL CONST $GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT = 2 GLOBAL CONST $GET_MODULE_HANDLE_EX_FLAG_DEFAULT = 0 GLOBAL CONST $PROCESSOR_ARCHITECTURE_AMD64 = 9 GLOBAL CONST $PROCESSOR_ARCHITECTURE_IA64 = 6 GLOBAL CONST $PROCESSOR_ARCHITECTURE_INTEL = 0 GLOBAL CONST $PROCESSOR_ARCHITECTURE_UNKNOWN = 65535 GLOBAL CONST $PROCESSOR_INTEL_386 = 386 GLOBAL CONST $PROCESSOR_INTEL_486 = 486 GLOBAL CONST $PROCESSOR_INTEL_PENTIUM = 586 GLOBAL CONST $PROCESSOR_INTEL_IA64 = 2200 GLOBAL CONST $PROCESSOR_AMD_X8664 = 8664 GLOBAL CONST $UOI_FLAGS = 1 GLOBAL CONST $UOI_HEAPSIZE = 5 GLOBAL CONST $UOI_IO = 6 GLOBAL CONST $UOI_NAME = 2 GLOBAL CONST $UOI_TYPE = 3 GLOBAL CONST $UOI_USER_SID = 4 GLOBAL CONST $DF_ALLOWOTHERACCOUNTHOOK = 1 GLOBAL CONST $WSF_VISIBLE = 1 GLOBAL CONST $VER_SUITE_BACKOFFICE = 4 GLOBAL CONST $VER_SUITE_BLADE = 1024 GLOBAL CONST $VER_SUITE_COMPUTE_SERVER = 16384 GLOBAL CONST $VER_SUITE_DATACENTER = 128 GLOBAL CONST $VER_SUITE_ENTERPRISE = 2 GLOBAL CONST $VER_SUITE_EMBEDDEDNT = 64 GLOBAL CONST $VER_SUITE_PERSONAL = 512 GLOBAL CONST $VER_SUITE_SINGLEUSERTS = 256 GLOBAL CONST $VER_SUITE_SMALLBUSINESS = 1 GLOBAL CONST $VER_SUITE_SMALLBUSINESS_RESTRICTED = 32 GLOBAL CONST $VER_SUITE_STORAGE_SERVER = 8192 GLOBAL CONST $VER_SUITE_TERMINAL = 16 GLOBAL CONST $VER_SUITE_WH_SERVER = 32768 GLOBAL CONST $VER_NT_DOMAIN_CONTROLLER = 2 GLOBAL CONST $VER_NT_SERVER = 3 GLOBAL CONST $VER_NT_WORKSTATION = 1 GLOBAL CONST $WDA_MONITOR = 1 GLOBAL CONST $WDA_NONE = 0 GLOBAL CONST $PF_3DNOW_INSTRUCTIONS_AVAILABLE = 7 GLOBAL CONST $PF_CHANNELS_ENABLED = 16 GLOBAL CONST $PF_COMPARE_EXCHANGE_DOUBLE = 2 GLOBAL CONST $PF_COMPARE_EXCHANGE128 = 14 GLOBAL CONST $PF_COMPARE64_EXCHANGE128 = 15 GLOBAL CONST $PF_FLOATING_POINT_EMULATED = 1 GLOBAL CONST $PF_FLOATING_POINT_PRECISION_ERRATA = 0 GLOBAL CONST $PF_MMX_INSTRUCTIONS_AVAILABLE = 3 GLOBAL CONST $PF_NX_ENABLED = 12 GLOBAL CONST $PF_PAE_ENABLED = 9 GLOBAL CONST $PF_RDTSC_INSTRUCTION_AVAILABLE = 8 GLOBAL CONST $PF_SSE3_INSTRUCTIONS_AVAILABLE = 13 GLOBAL CONST $PF_XMMI_INSTRUCTIONS_AVAILABLE = 6 GLOBAL CONST $PF_XMMI64_INSTRUCTIONS_AVAILABLE = 10 GLOBAL CONST $PF_XSAVE_ENABLED = 17 GLOBAL CONST $KEYEVENTF_EXTENDEDKEY = 1 GLOBAL CONST $KEYEVENTF_KEYUP = 2 GLOBAL CONST $LIM_SMALL = 0 GLOBAL CONST $LIM_LARGE = 1 GLOBAL CONST $MAPVK_VK_TO_CHAR = 2 GLOBAL CONST $MAPVK_VK_TO_VSC = 0 GLOBAL CONST $MAPVK_VK_TO_VSC_EX = 4 GLOBAL CONST $MAPVK_VSC_TO_VK = 1 GLOBAL CONST $MAPVK_VSC_TO_VK_EX = 3 GLOBAL CONST $MOD_ALT = 1 GLOBAL CONST $MOD_CONTROL = 2 GLOBAL CONST $MOD_NOREPEAT = 16384 GLOBAL CONST $MOD_SHIFT = 4 GLOBAL CONST $MOD_WIN = 8 GLOBAL CONST $GUID_ACDC_POWER_SOURCE = "{5D3E9A59-E9D5-4B00-A6BD-FF34FF516548}" GLOBAL CONST $GUID_BATTERY_PERCENTAGE_REMAINING = "{A7AD8041-B45A-4CAE-87A3-EECBB468A9E1}" GLOBAL CONST $GUID_IDLE_BACKGROUND_TASK = "{515C31D8-F734-163D-A0FD-11A08C91E8F1}" GLOBAL CONST $GUID_MONITOR_POWER_ON = "{02731015-4510-4526-99E6-E5A17EBD1AEA}" GLOBAL CONST $GUID_POWERSCHEME_PERSONALITY = "{245D8541-3943-4422-B025-13A784F679B7}" GLOBAL CONST $GUID_SYSTEM_AWAYMODE = "{98A7F580-01F7-48AA-9C0F-44352C29E5C0}" GLOBAL CONST $GUID_MIN_POWER_SAVINGS = "{8C5E7FDA-E8BF-4A96-9A85-A6E23A8C635C}" GLOBAL CONST $GUID_MAX_POWER_SAVINGS = "{A1841308-3541-4FAB-BC81-F71556F20B4A}" GLOBAL CONST $GUID_TYPICAL_POWER_SAVINGS = "{381B4222-F694-41F0-9685-FF5BB260DF2E}" GLOBAL CONST $HSHELL_WINDOWCREATED = 1 GLOBAL CONST $HSHELL_WINDOWDESTROYED = 2 GLOBAL CONST $HSHELL_ACTIVATESHELLWINDOW = 3 GLOBAL CONST $HSHELL_WINDOWACTIVATED = 4 GLOBAL CONST $HSHELL_GETMINRECT = 5 GLOBAL CONST $HSHELL_REDRAW = 6 GLOBAL CONST $HSHELL_TASKMAN = 7 GLOBAL CONST $HSHELL_LANGUAGE = 8 GLOBAL CONST $HSHELL_SYSMENU = 9 GLOBAL CONST $HSHELL_ENDTASK = 10 GLOBAL CONST $HSHELL_ACCESSIBILITYSTATE = 11 GLOBAL CONST $HSHELL_APPCOMMAND = 12 GLOBAL CONST $HSHELL_WINDOWREPLACED = 13 GLOBAL CONST $HSHELL_WINDOWREPLACING = 14 GLOBAL CONST $HSHELL_RUDEAPPACTIVATED = 32772 GLOBAL CONST $HSHELL_FLASH = 32774 GLOBAL CONST $HWND_BROADCAST = 65535 GLOBAL CONST $SMTO_BLOCK = 1 GLOBAL CONST $SMTO_NORMAL = 0 GLOBAL CONST $SMTO_ABORTIFHUNG = 2 GLOBAL CONST $SMTO_NOTIMEOUTIFNOTHUNG = 8 GLOBAL CONST $SMTO_ERRORONEXIT = 32 GLOBAL CONST $INPUTLANGCHANGE_BACKWARD = 4 GLOBAL CONST $INPUTLANGCHANGE_FORWARD = 2 GLOBAL CONST $INPUTLANGCHANGE_SYSCHARSET = 1 GLOBAL CONST $EVENT_MIN = 1 GLOBAL CONST $EVENT_SYSTEM_SOUND = 1 GLOBAL CONST $EVENT_SYSTEM_ALERT = 2 GLOBAL CONST $EVENT_SYSTEM_FOREGROUND = 3 GLOBAL CONST $EVENT_SYSTEM_MENUSTART = 4 GLOBAL CONST $EVENT_SYSTEM_MENUEND = 5 GLOBAL CONST $EVENT_SYSTEM_MENUPOPUPSTART = 6 GLOBAL CONST $EVENT_SYSTEM_MENUPOPUPEND = 7 GLOBAL CONST $EVENT_SYSTEM_CAPTURESTART = 8 GLOBAL CONST $EVENT_SYSTEM_CAPTUREEND = 9 GLOBAL CONST $EVENT_SYSTEM_MOVESIZESTART = 10 GLOBAL CONST $EVENT_SYSTEM_MOVESIZEEND = 11 GLOBAL CONST $EVENT_SYSTEM_CONTEXTHELPSTART = 12 GLOBAL CONST $EVENT_SYSTEM_CONTEXTHELPEND = 13 GLOBAL CONST $EVENT_SYSTEM_DRAGDROPSTART = 14 GLOBAL CONST $EVENT_SYSTEM_DRAGDROPEND = 15 GLOBAL CONST $EVENT_SYSTEM_DIALOGSTART = 16 GLOBAL CONST $EVENT_SYSTEM_DIALOGEND = 17 GLOBAL CONST $EVENT_SYSTEM_SCROLLINGSTART = 18 GLOBAL CONST $EVENT_SYSTEM_SCROLLINGEND = 19 GLOBAL CONST $EVENT_SYSTEM_SWITCHSTART = 20 GLOBAL CONST $EVENT_SYSTEM_SWITCHEND = 21 GLOBAL CONST $EVENT_SYSTEM_MINIMIZESTART = 22 GLOBAL CONST $EVENT_SYSTEM_MINIMIZEEND = 23 GLOBAL CONST $EVENT_SYSTEM_DESKTOPSWITCH = 32 GLOBAL CONST $EVENT_OBJECT_CREATE = 32768 GLOBAL CONST $EVENT_OBJECT_DESTROY = 32769 GLOBAL CONST $EVENT_OBJECT_SHOW = 32770 GLOBAL CONST $EVENT_OBJECT_HIDE = 32771 GLOBAL CONST $EVENT_OBJECT_REORDER = 32772 GLOBAL CONST $EVENT_OBJECT_FOCUS = 32773 GLOBAL CONST $EVENT_OBJECT_SELECTION = 32774 GLOBAL CONST $EVENT_OBJECT_SELECTIONADD = 32775 GLOBAL CONST $EVENT_OBJECT_SELECTIONREMOVE = 32776 GLOBAL CONST $EVENT_OBJECT_SELECTIONWITHIN = 32777 GLOBAL CONST $EVENT_OBJECT_STATECHANGE = 32778 GLOBAL CONST $EVENT_OBJECT_LOCATIONCHANGE = 32779 GLOBAL CONST $EVENT_OBJECT_NAMECHANGE = 32780 GLOBAL CONST $EVENT_OBJECT_DESCRIPTIONCHANGE = 32781 GLOBAL CONST $EVENT_OBJECT_VALUECHANGE = 32782 GLOBAL CONST $EVENT_OBJECT_PARENTCHANGE = 32783 GLOBAL CONST $EVENT_OBJECT_HELPCHANGE = 32784 GLOBAL CONST $EVENT_OBJECT_DEFACTIONCHANGE = 32785 GLOBAL CONST $EVENT_OBJECT_ACCELERATORCHANGE = 32786 GLOBAL CONST $EVENT_OBJECT_INVOKED = 32787 GLOBAL CONST $EVENT_OBJECT_TEXTSELECTIONCHANGED = 32788 GLOBAL CONST $EVENT_OBJECT_CONTENTSCROLLED = 32789 GLOBAL CONST $EVENT_MAX = 2147483647 GLOBAL CONST $WINEVENT_INCONTEXT = 4 GLOBAL CONST $WINEVENT_OUTOFCONTEXT = 0 GLOBAL CONST $WINEVENT_SKIPOWNPROCESS = 2 GLOBAL CONST $WINEVENT_SKIPOWNTHREAD = 1 GLOBAL CONST $TME_CANCEL = 2147483648 GLOBAL CONST $TME_HOVER = 1 GLOBAL CONST $TME_LEAVE = 2 GLOBAL CONST $TME_NONCLIENT = 16 GLOBAL CONST $TME_QUERY = 1073741824 GLOBAL CONST $DESKTOP_CREATEMENU = 4 GLOBAL CONST $DESKTOP_CREATEWINDOW = 2 GLOBAL CONST $DESKTOP_ENUMERATE = 64 GLOBAL CONST $DESKTOP_HOOKCONTROL = 8 GLOBAL CONST $DESKTOP_JOURNALPLAYBACK = 32 GLOBAL CONST $DESKTOP_JOURNALRECORD = 16 GLOBAL CONST $DESKTOP_READOBJECTS = 1 GLOBAL CONST $DESKTOP_SWITCHDESKTOP = 256 GLOBAL CONST $DESKTOP_WRITEOBJECTS = 128 GLOBAL CONST $DESKTOP_ALL_ACCESS = BITOR ($DESKTOP_CREATEMENU , $DESKTOP_CREATEWINDOW , $DESKTOP_ENUMERATE , $DESKTOP_HOOKCONTROL , $DESKTOP_JOURNALPLAYBACK , $DESKTOP_JOURNALRECORD , $DESKTOP_READOBJECTS , $DESKTOP_SWITCHDESKTOP , $DESKTOP_WRITEOBJECTS ) GLOBAL CONST $RIDEV_APPKEYS = 1024 GLOBAL CONST $RIDEV_CAPTUREMOUSE = 512 GLOBAL CONST $RIDEV_DEVNOTIFY = 8192 GLOBAL CONST $RIDEV_EXCLUDE = 16 GLOBAL CONST $RIDEV_EXINPUTSINK = 4096 GLOBAL CONST $RIDEV_INPUTSINK = 256 GLOBAL CONST $RIDEV_NOHOTKEYS = 512 GLOBAL CONST $RIDEV_NOLEGACY = 48 GLOBAL CONST $RIDEV_PAGEONLY = 32 GLOBAL CONST $RIDEV_REMOVE = 1 GLOBAL CONST $RID_HEADER = 268435461 GLOBAL CONST $RID_INPUT = 268435459 GLOBAL CONST $RIM_TYPEHID = 2 GLOBAL CONST $RIM_TYPEKEYBOARD = 1 GLOBAL CONST $RIM_TYPEMOUSE = 0 GLOBAL CONST $RIDI_DEVICENAME = 536870919 GLOBAL CONST $RIDI_DEVICEINFO = 536870923 GLOBAL CONST $RIDI_PREPARSEDDATA = 536870917 GLOBAL CONST $MOUSE_ATTRIBUTES_CHANGED = 4 GLOBAL CONST $MOUSE_MOVE_ABSOLUTE = 1 GLOBAL CONST $MOUSE_MOVE_RELATIVE = 0 GLOBAL CONST $MOUSE_VIRTUAL_DESKTOP = 2 GLOBAL CONST $RI_MOUSE_LEFT_BUTTON_DOWN = 1 GLOBAL CONST $RI_MOUSE_LEFT_BUTTON_UP = 2 GLOBAL CONST $RI_MOUSE_MIDDLE_BUTTON_DOWN = 16 GLOBAL CONST $RI_MOUSE_MIDDLE_BUTTON_UP = 32 GLOBAL CONST $RI_MOUSE_RIGHT_BUTTON_DOWN = 4 GLOBAL CONST $RI_MOUSE_RIGHT_BUTTON_UP = 8 GLOBAL CONST $RI_MOUSE_BUTTON_1_DOWN = $RI_MOUSE_LEFT_BUTTON_DOWN GLOBAL CONST $RI_MOUSE_BUTTON_1_UP = $RI_MOUSE_LEFT_BUTTON_UP GLOBAL CONST $RI_MOUSE_BUTTON_2_DOWN = $RI_MOUSE_RIGHT_BUTTON_DOWN GLOBAL CONST $RI_MOUSE_BUTTON_2_UP = $RI_MOUSE_RIGHT_BUTTON_UP GLOBAL CONST $RI_MOUSE_BUTTON_3_DOWN = $RI_MOUSE_MIDDLE_BUTTON_DOWN GLOBAL CONST $RI_MOUSE_BUTTON_3_UP = $RI_MOUSE_MIDDLE_BUTTON_UP GLOBAL CONST $RI_MOUSE_BUTTON_4_DOWN = 64 GLOBAL CONST $RI_MOUSE_BUTTON_4_UP = 128 GLOBAL CONST $RI_MOUSE_BUTTON_5_DOWN = 256 GLOBAL CONST $RI_MOUSE_BUTTON_5_UP = 512 GLOBAL CONST $RI_MOUSE_WHEEL = 1024 GLOBAL CONST $RI_KEY_BREAK = 1 GLOBAL CONST $RI_KEY_E0 = 2 GLOBAL CONST $RI_KEY_E1 = 4 GLOBAL CONST $RI_KEY_MAKE = 0 GLOBAL CONST $FLASHW_CAPTION = 1 GLOBAL CONST $FLASHW_TRAY = 2 GLOBAL CONST $FLASHW_TIMER = 4 GLOBAL CONST $FLASHW_TIMERNOFG = 12 GLOBAL CONST $TAGUPDATELAYEREDWINDOWINFO = "dword Size;hwnd hDstDC;long DstX;long DstY;long cX;long cY;hwnd hSrcDC;long SrcX;long SrcY;dword crKey;byte BlendOp;byte BlendFlags;byte Alpha;byte AlphaFormat;dword Flags;long DirtyLeft;long DirtyTop;long DirtyRight;long DirtyBottom" GLOBAL CONST $TAGWINDOWINFO = "dword Size;struct;long rWindow[4];endstruct;struct;long rClient[4];endstruct;dword Style;dword ExStyle;dword WindowStatus;uint cxWindowBorders;uint cyWindowBorders;word atomWindowType;word CreatorVersion" GLOBAL CONST $TAGWNDCLASS = "uint Style;ptr hWndProc;int ClsExtra;int WndExtra;ptr hInstance;ptr hIcon;ptr hCursor;ptr hBackground;ptr MenuName;ptr ClassName" GLOBAL CONST $TAGWNDCLASSEX = "uint Size;uint Style;ptr hWndProc;int ClsExtra;int WndExtra;ptr hInstance;ptr hIcon;ptr hCursor;ptr hBackground;ptr MenuName;ptr ClassName;ptr hIconSm" GLOBAL CONST $TAGFLASHWINFO = "uint Size;hwnd hWnd;dword Flags;uint Count;dword TimeOut" FUNC _WINAPI_ADJUSTWINDOWRECTEX (BYREF $TRECT , $ISTYLE , $IEXSTYLE = 0 , $BMENU = FALSE ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "AdjustWindowRectEx" , "struct*" , $TRECT , "dword" , $ISTYLE , "bool" , $BMENU , "dword" , $IEXSTYLE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_ANIMATEWINDOW ($HWND , $IFLAGS , $IDURATION = 1000 ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "AnimateWindow" , "hwnd" , $HWND , "dword" , $IDURATION , "dword" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_BEGINDEFERWINDOWPOS ($IAMOUNT = 1 ) LOCAL $ARET = DLLCALL ("user32.dll" , "handle" , "BeginDeferWindowPos" , "int" , $IAMOUNT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_BRINGWINDOWTOTOP ($HWND ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "BringWindowToTop" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_BROADCASTSYSTEMMESSAGE ($IMSG , $WPARAM = 0 , $LPARAM = 0 , $IFLAGS = 0 , $IRECIPIENTS = 0 ) LOCAL $ARET = DLLCALL ("user32.dll" , "long" , "BroadcastSystemMessageW" , "dword" , $IFLAGS , "dword*" , $IRECIPIENTS , "uint" , $IMSG , "wparam" , $WPARAM , "lparam" , $LPARAM ) IF @ERROR OR ($ARET [0 ] = + 4294967295 ) THEN RETURN SETERROR (@ERROR , @EXTENDED , + 4294967295 ) RETURN SETEXTENDED ($ARET [2 ] , $ARET [0 ] ) ENDFUNC FUNC _WINAPI_CALLWINDOWPROC ($PPREVWNDFUNC , $HWND , $IMSG , $WPARAM , $LPARAM ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "lresult" , "CallWindowProc" , "ptr" , $PPREVWNDFUNC , "hwnd" , $HWND , "uint" , $IMSG , "wparam" , $WPARAM , "lparam" , $LPARAM ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , + 4294967295 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_CALLWINDOWPROCW ($PPREVWNDPROC , $HWND , $IMSG , $WPARAM , $LPARAM ) LOCAL $ARET = DLLCALL ("user32.dll" , "lresult" , "CallWindowProcW" , "ptr" , $PPREVWNDPROC , "hwnd" , $HWND , "uint" , $IMSG , "wparam" , $WPARAM , "lparam" , $LPARAM ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_CASCADEWINDOWS ($AWNDS , $TRECT = 0 , $HPARENT = 0 , $IFLAGS = 0 , $ISTART = 0 , $IEND = + 4294967295 ) IF __CHECKERRORARRAYBOUNDS ($AWNDS , $ISTART , $IEND ) THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $ICOUNT = $IEND - $ISTART + 1 LOCAL $TWNDS = DLLSTRUCTCREATE ("hwnd[" & $ICOUNT & "]" ) $ICOUNT = 1 FOR $I = $ISTART TO $IEND DLLSTRUCTSETDATA ($TWNDS , 1 , $AWNDS [$I ] , $ICOUNT ) $ICOUNT += 1 NEXT LOCAL $ARET = DLLCALL ("user32.dll" , "word" , "CascadeWindows" , "hwnd" , $HPARENT , "uint" , $IFLAGS , "struct*" , $TRECT , "uint" , $ICOUNT + 4294967295 , "struct*" , $TWNDS ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_CHANGEWINDOWMESSAGEFILTEREX ($HWND , $IMSG , $IACTION ) LOCAL $TCFS , $ARET IF $HWND AND ($__WINVER > 1536 ) THEN LOCAL CONST $TAGCHANGEFILTERSTRUCT = "dword cbSize; dword ExtStatus" $TCFS = DLLSTRUCTCREATE ($TAGCHANGEFILTERSTRUCT ) DLLSTRUCTSETDATA ($TCFS , 1 , DLLSTRUCTGETSIZE ($TCFS ) ) $ARET = DLLCALL ("user32.dll" , "bool" , "ChangeWindowMessageFilterEx" , "hwnd" , $HWND , "uint" , $IMSG , "dword" , $IACTION , "struct*" , $TCFS ) ELSE $TCFS = 0 $ARET = DLLCALL ("user32.dll" , "bool" , "ChangeWindowMessageFilter" , "uint" , $IMSG , "dword" , $IACTION ) ENDIF IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN SETEXTENDED (DLLSTRUCTGETDATA ($TCFS , 2 ) , 1 ) ENDFUNC FUNC _WINAPI_CHILDWINDOWFROMPOINTEX ($HWND , $TPOINT , $IFLAGS = 0 ) LOCAL $ARET = DLLCALL ("user32.dll" , "hwnd" , "ChildWindowFromPointEx" , "hwnd" , $HWND , "struct" , $TPOINT , "uint" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_CLOSEWINDOW ($HWND ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "CloseWindow" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_DEFERWINDOWPOS ($HINFO , $HWND , $HAFTER , $IX , $IY , $IWIDTH , $IHEIGHT , $IFLAGS ) LOCAL $ARET = DLLCALL ("user32.dll" , "handle" , "DeferWindowPos" , "handle" , $HINFO , "hwnd" , $HWND , "hwnd" , $HAFTER , "int" , $IX , "int" , $IY , "int" , $IWIDTH , "int" , $IHEIGHT , "uint" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_DEFWINDOWPROC ($HWND , $IMSG , $WPARAM , $LPARAM ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "lresult" , "DefWindowProc" , "hwnd" , $HWND , "uint" , $IMSG , "wparam" , $WPARAM , "lparam" , $LPARAM ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_DEFWINDOWPROCW ($HWND , $IMSG , $WPARAM , $LPARAM ) LOCAL $ARET = DLLCALL ("user32.dll" , "lresult" , "DefWindowProcW" , "hwnd" , $HWND , "uint" , $IMSG , "wparam" , $WPARAM , "lparam" , $LPARAM ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_DEREGISTERSHELLHOOKWINDOW ($HWND ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "DeregisterShellHookWindow" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_DRAGACCEPTFILES ($HWND , $BACCEPT = TRUE ) DLLCALL ("shell32.dll" , "none" , "DragAcceptFiles" , "hwnd" , $HWND , "bool" , $BACCEPT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN 1 ENDFUNC FUNC _WINAPI_DRAGFINISH ($HDROP ) DLLCALL ("shell32.dll" , "none" , "DragFinish" , "handle" , $HDROP ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN 1 ENDFUNC FUNC _WINAPI_DRAGQUERYFILEEX ($HDROP , $IFLAG = 0 ) LOCAL $ARET = DLLCALL ("shell32.dll" , "uint" , "DragQueryFileW" , "handle" , $HDROP , "uint" , + 4294967295 , "ptr" , 0 , "uint" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF NOT $ARET [0 ] THEN RETURN SETERROR (10 , 0 , 0 ) LOCAL $ICOUNT = $ARET [0 ] LOCAL $ARESULT [$ICOUNT + 1 ] FOR $I = 0 TO $ICOUNT + 4294967295 $ARET = DLLCALL ("shell32.dll" , "uint" , "DragQueryFileW" , "handle" , $HDROP , "uint" , $I , "wstr" , "" , "uint" , 4096 ) IF NOT $ARET [0 ] THEN RETURN SETERROR (11 , 0 , 0 ) IF $IFLAG THEN LOCAL $BDIR = _WINAPI_PATHISDIRECTORY ($ARET [3 ] ) IF (($IFLAG = 1 ) AND $BDIR ) OR (($IFLAG = 2 ) AND NOT $BDIR ) THEN CONTINUELOOP ENDIF ENDIF $ARESULT [$I + 1 ] = $ARET [3 ] $ARESULT [0 ] += 1 NEXT IF NOT $ARESULT [0 ] THEN RETURN SETERROR (12 , 0 , 0 ) __INC ($ARESULT , + 4294967295 ) RETURN $ARESULT ENDFUNC FUNC _WINAPI_DRAGQUERYPOINT ($HDROP ) LOCAL $TPOINT = DLLSTRUCTCREATE ($TAGPOINT ) LOCAL $ARET = DLLCALL ("shell32.dll" , "bool" , "DragQueryPoint" , "handle" , $HDROP , "struct*" , $TPOINT ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN $TPOINT ENDFUNC FUNC _WINAPI_ENDDEFERWINDOWPOS ($HINFO ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "EndDeferWindowPos" , "handle" , $HINFO ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_ENUMCHILDWINDOWS ($HWND , $BVISIBLE = TRUE ) IF NOT _WINAPI_GETWINDOW ($HWND , 5 ) THEN RETURN SETERROR (2 , 0 , 0 ) LOCAL $HENUMPROC = DLLCALLBACKREGISTER ("__EnumWindowsProc" , "bool" , "hwnd;lparam" ) DIM $__G_VENUM [101 ] [2 ] = [[0 ] ] DLLCALL ("user32.dll" , "bool" , "EnumChildWindows" , "hwnd" , $HWND , "ptr" , DLLCALLBACKGETPTR ($HENUMPROC ) , "lparam" , $BVISIBLE ) IF @ERROR OR NOT $__G_VENUM [0 ] [0 ] THEN $__G_VENUM = @ERROR + 10 ENDIF DLLCALLBACKFREE ($HENUMPROC ) IF $__G_VENUM THEN RETURN SETERROR ($__G_VENUM , 0 , 0 ) __INC ($__G_VENUM , + 4294967295 ) RETURN $__G_VENUM ENDFUNC FUNC _WINAPI_FINDWINDOW ($SCLASSNAME , $SWINDOWNAME ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "hwnd" , "FindWindowW" , "wstr" , $SCLASSNAME , "wstr" , $SWINDOWNAME ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_FLASHWINDOW ($HWND , $BINVERT = TRUE ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "FlashWindow" , "hwnd" , $HWND , "bool" , $BINVERT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_FLASHWINDOWEX ($HWND , $IFLAGS = 3 , $ICOUNT = 3 , $ITIMEOUT = 0 ) LOCAL $TFLASH = DLLSTRUCTCREATE ($TAGFLASHWINFO ) LOCAL $IFLASH = DLLSTRUCTGETSIZE ($TFLASH ) LOCAL $IMODE = 0 IF BITAND ($IFLAGS , 1 ) <> 0 THEN $IMODE = BITOR ($IMODE , $FLASHW_CAPTION ) IF BITAND ($IFLAGS , 2 ) <> 0 THEN $IMODE = BITOR ($IMODE , $FLASHW_TRAY ) IF BITAND ($IFLAGS , 4 ) <> 0 THEN $IMODE = BITOR ($IMODE , $FLASHW_TIMER ) IF BITAND ($IFLAGS , 8 ) <> 0 THEN $IMODE = BITOR ($IMODE , $FLASHW_TIMERNOFG ) DLLSTRUCTSETDATA ($TFLASH , "Size" , $IFLASH ) DLLSTRUCTSETDATA ($TFLASH , "hWnd" , $HWND ) DLLSTRUCTSETDATA ($TFLASH , "Flags" , $IMODE ) DLLSTRUCTSETDATA ($TFLASH , "Count" , $ICOUNT ) DLLSTRUCTSETDATA ($TFLASH , "Timeout" , $ITIMEOUT ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "FlashWindowEx" , "struct*" , $TFLASH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETANCESTOR ($HWND , $IFLAGS = 1 ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "hwnd" , "GetAncestor" , "hwnd" , $HWND , "uint" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETCLASSINFOEX ($SCLASS , $HINSTANCE = 0 ) LOCAL $STYPEOFCLASS = "ptr" IF ISSTRING ($SCLASS ) THEN $STYPEOFCLASS = "wstr" ENDIF LOCAL $TWNDCLASSEX = DLLSTRUCTCREATE ($TAGWNDCLASSEX ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "GetClassInfoExW" , "handle" , $HINSTANCE , $STYPEOFCLASS , $SCLASS , "struct*" , $TWNDCLASSEX ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN $TWNDCLASSEX ENDFUNC FUNC _WINAPI_GETCLASSLONGEX ($HWND , $IINDEX ) LOCAL $ARET IF @AUTOITX64 THEN $ARET = DLLCALL ("user32.dll" , "ulong_ptr" , "GetClassLongPtrW" , "hwnd" , $HWND , "int" , $IINDEX ) ELSE $ARET = DLLCALL ("user32.dll" , "dword" , "GetClassLongW" , "hwnd" , $HWND , "int" , $IINDEX ) ENDIF IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETCLIENTHEIGHT ($HWND ) LOCAL $TRECT = _WINAPI_GETCLIENTRECT ($HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN DLLSTRUCTGETDATA ($TRECT , "Bottom" ) - DLLSTRUCTGETDATA ($TRECT , "Top" ) ENDFUNC FUNC _WINAPI_GETCLIENTWIDTH ($HWND ) LOCAL $TRECT = _WINAPI_GETCLIENTRECT ($HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN DLLSTRUCTGETDATA ($TRECT , "Right" ) - DLLSTRUCTGETDATA ($TRECT , "Left" ) ENDFUNC FUNC _WINAPI_GETDLGITEM ($HWND , $IITEMID ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "hwnd" , "GetDlgItem" , "hwnd" , $HWND , "int" , $IITEMID ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETFOREGROUNDWINDOW () LOCAL $ARESULT = DLLCALL ("user32.dll" , "hwnd" , "GetForegroundWindow" ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETGUITHREADINFO ($ITHREADID ) LOCAL CONST $TAGGUITHREADINFO = "dword Size;dword Flags;hwnd hWndActive;hwnd hWndFocus;hwnd hWndCapture;hwnd hWndMenuOwner;hwnd hWndMoveSize;hwnd hWndCaret;struct rcCaret;long left;long top;long right;long bottom;endstruct" LOCAL $TGTI = DLLSTRUCTCREATE ($TAGGUITHREADINFO ) DLLSTRUCTSETDATA ($TGTI , 1 , DLLSTRUCTGETSIZE ($TGTI ) ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "GetGUIThreadInfo" , "dword" , $ITHREADID , "struct*" , $TGTI ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $ARESULT [11 ] FOR $I = 0 TO 10 $ARESULT [$I ] = DLLSTRUCTGETDATA ($TGTI , $I + 2 ) NEXT FOR $I = 9 TO 10 $ARESULT [$I ] -= $ARESULT [$I + 4294967294 ] NEXT RETURN $ARESULT ENDFUNC FUNC _WINAPI_GETLASTACTIVEPOPUP ($HWND ) LOCAL $ARET = DLLCALL ("user32.dll" , "hwnd" , "GetLastActivePopup" , "hwnd" , $HWND ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) IF $ARET [0 ] = $HWND THEN RETURN SETERROR (1 , 0 , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETLAYEREDWINDOWATTRIBUTES ($HWND , BYREF $ITRANSCOLOR , BYREF $ITRANSGUI , $BCOLORREF = FALSE ) $ITRANSCOLOR = + 4294967295 $ITRANSGUI = + 4294967295 LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "GetLayeredWindowAttributes" , "hwnd" , $HWND , "INT*" , $ITRANSCOLOR , "byte*" , $ITRANSGUI , "dword*" , 0 ) IF @ERROR OR NOT $ARESULT [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF NOT $BCOLORREF THEN $ARESULT [2 ] = INT (BINARYMID ($ARESULT [2 ] , 3 , 1 ) & BINARYMID ($ARESULT [2 ] , 2 , 1 ) & BINARYMID ($ARESULT [2 ] , 1 , 1 ) ) ENDIF $ITRANSCOLOR = $ARESULT [2 ] $ITRANSGUI = $ARESULT [3 ] RETURN $ARESULT [4 ] ENDFUNC FUNC _WINAPI_GETMESSAGEEXTRAINFO () LOCAL $ARET = DLLCALL ("user32.dll" , "lparam" , "GetMessageExtraInfo" ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETSHELLWINDOW () LOCAL $ARET = DLLCALL ("user32.dll" , "hwnd" , "GetShellWindow" ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETTOPWINDOW ($HWND ) LOCAL $ARET = DLLCALL ("user32.dll" , "hwnd" , "GetTopWindow" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETWINDOWDISPLAYAFFINITY ($HWND ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "GetWindowDisplayAffinity" , "hwnd" , $HWND , "dword*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_GETWINDOWINFO ($HWND ) LOCAL $TWINDOWINFO = DLLSTRUCTCREATE ($TAGWINDOWINFO ) DLLSTRUCTSETDATA ($TWINDOWINFO , "Size" , DLLSTRUCTGETSIZE ($TWINDOWINFO ) ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "GetWindowInfo" , "hwnd" , $HWND , "struct*" , $TWINDOWINFO ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN $TWINDOWINFO ENDFUNC FUNC _WINAPI_GETWINDOWPLACEMENT ($HWND ) LOCAL $TWINDOWPLACEMENT = DLLSTRUCTCREATE ($TAGWINDOWPLACEMENT ) DLLSTRUCTSETDATA ($TWINDOWPLACEMENT , "length" , DLLSTRUCTGETSIZE ($TWINDOWPLACEMENT ) ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "GetWindowPlacement" , "hwnd" , $HWND , "struct*" , $TWINDOWPLACEMENT ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN $TWINDOWPLACEMENT ENDFUNC FUNC _WINAPI_ISCHILD ($HWND , $HWNDPARENT ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "IsChild" , "hwnd" , $HWNDPARENT , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_ISHUNGAPPWINDOW ($HWND ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "IsHungAppWindow" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_ISICONIC ($HWND ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "IsIconic" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_ISWINDOWUNICODE ($HWND ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "IsWindowUnicode" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_ISZOOMED ($HWND ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "IsZoomed" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_KILLTIMER ($HWND , $ITIMERID ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "KillTimer" , "hwnd" , $HWND , "uint_ptr" , $ITIMERID ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_OPENICON ($HWND ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "OpenIcon" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_POSTMESSAGE ($HWND , $IMSG , $WPARAM , $LPARAM ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "PostMessage" , "hwnd" , $HWND , "uint" , $IMSG , "wparam" , $WPARAM , "lparam" , $LPARAM ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_REGISTERCLASS ($TWNDCLASS ) LOCAL $ARET = DLLCALL ("user32.dll" , "word" , "RegisterClassW" , "struct*" , $TWNDCLASS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_REGISTERCLASSEX ($TWNDCLASSEX ) LOCAL $ARET = DLLCALL ("user32.dll" , "word" , "RegisterClassExW" , "struct*" , $TWNDCLASSEX ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_REGISTERSHELLHOOKWINDOW ($HWND ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "RegisterShellHookWindow" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_REGISTERWINDOWMESSAGE ($SMESSAGE ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "uint" , "RegisterWindowMessageW" , "wstr" , $SMESSAGE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_SENDMESSAGETIMEOUT ($HWND , $IMSG , $WPARAM = 0 , $LPARAM = 0 , $ITIMEOUT = 1000 , $IFLAGS = 0 ) LOCAL $ARET = DLLCALL ("user32.dll" , "lresult" , "SendMessageTimeoutW" , "hwnd" , $HWND , "uint" , $IMSG , "wparam" , $WPARAM , "lparam" , $LPARAM , "uint" , $IFLAGS , "uint" , $ITIMEOUT , "dword_ptr*" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , + 4294967295 ) IF NOT $ARET [0 ] THEN RETURN SETERROR (10 , _WINAPI_GETLASTERROR () , + 4294967295 ) RETURN $ARET [7 ] ENDFUNC FUNC _WINAPI_SETCLASSLONGEX ($HWND , $IINDEX , $INEWLONG ) LOCAL $ARET IF @AUTOITX64 THEN $ARET = DLLCALL ("user32.dll" , "ulong_ptr" , "SetClassLongPtrW" , "hwnd" , $HWND , "int" , $IINDEX , "long_ptr" , $INEWLONG ) ELSE $ARET = DLLCALL ("user32.dll" , "dword" , "SetClassLongW" , "hwnd" , $HWND , "int" , $IINDEX , "long" , $INEWLONG ) ENDIF IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SETFOREGROUNDWINDOW ($HWND ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "SetForegroundWindow" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SETLAYEREDWINDOWATTRIBUTES ($HWND , $ITRANSCOLOR , $ITRANSGUI = 255 , $IFLAGS = 3 , $BCOLORREF = FALSE ) IF $IFLAGS = DEFAULT OR $IFLAGS = "" OR $IFLAGS < 0 THEN $IFLAGS = 3 IF NOT $BCOLORREF THEN $ITRANSCOLOR = INT (BINARYMID ($ITRANSCOLOR , 3 , 1 ) & BINARYMID ($ITRANSCOLOR , 2 , 1 ) & BINARYMID ($ITRANSCOLOR , 1 , 1 ) ) ENDIF LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "SetLayeredWindowAttributes" , "hwnd" , $HWND , "INT" , $ITRANSCOLOR , "byte" , $ITRANSGUI , "dword" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_SETMESSAGEEXTRAINFO ($LPARAM ) LOCAL $ARET = DLLCALL ("user32.dll" , "lparam" , "SetMessageExtraInfo" , "lparam" , $LPARAM ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SETSYSCOLORS ($VELEMENTS , $VCOLORS ) LOCAL $BISEARRAY = ISARRAY ($VELEMENTS ) , $BISCARRAY = ISARRAY ($VCOLORS ) LOCAL $IELEMENTNUM IF NOT $BISCARRAY AND NOT $BISEARRAY THEN $IELEMENTNUM = 1 ELSEIF $BISCARRAY OR $BISEARRAY THEN IF NOT $BISCARRAY OR NOT $BISEARRAY THEN RETURN SETERROR (+ 4294967295 , + 4294967295 , FALSE ) IF UBOUND ($VELEMENTS ) <> UBOUND ($VCOLORS ) THEN RETURN SETERROR (+ 4294967295 , + 4294967295 , FALSE ) $IELEMENTNUM = UBOUND ($VELEMENTS ) ENDIF LOCAL $TELEMENTS = DLLSTRUCTCREATE ("int Element[" & $IELEMENTNUM & "]" ) LOCAL $TCOLORS = DLLSTRUCTCREATE ("INT NewColor[" & $IELEMENTNUM & "]" ) IF NOT $BISEARRAY THEN DLLSTRUCTSETDATA ($TELEMENTS , "Element" , $VELEMENTS , 1 ) ELSE FOR $X = 0 TO $IELEMENTNUM + 4294967295 DLLSTRUCTSETDATA ($TELEMENTS , "Element" , $VELEMENTS [$X ] , $X + 1 ) NEXT ENDIF IF NOT $BISCARRAY THEN DLLSTRUCTSETDATA ($TCOLORS , "NewColor" , $VCOLORS , 1 ) ELSE FOR $X = 0 TO $IELEMENTNUM + 4294967295 DLLSTRUCTSETDATA ($TCOLORS , "NewColor" , $VCOLORS [$X ] , $X + 1 ) NEXT ENDIF LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "SetSysColors" , "int" , $IELEMENTNUM , "struct*" , $TELEMENTS , "struct*" , $TCOLORS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_SETTIMER ($HWND , $ITIMERID , $IELAPSE , $PTIMERFUNC ) LOCAL $ARET = DLLCALL ("user32.dll" , "uint_ptr" , "SetTimer" , "hwnd" , $HWND , "uint_ptr" , $ITIMERID , "uint" , $IELAPSE , "ptr" , $PTIMERFUNC ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SETWINDOWDISPLAYAFFINITY ($HWND , $IAFFINITY ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "SetWindowDisplayAffinity" , "hwnd" , $HWND , "dword" , $IAFFINITY ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SETWINDOWLONG ($HWND , $IINDEX , $IVALUE ) _WINAPI_SETLASTERROR (0 ) LOCAL $SFUNCNAME = "SetWindowLongW" IF @AUTOITX64 THEN $SFUNCNAME = "SetWindowLongPtrW" LOCAL $ARESULT = DLLCALL ("user32.dll" , "long_ptr" , $SFUNCNAME , "hwnd" , $HWND , "int" , $IINDEX , "long_ptr" , $IVALUE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_SETWINDOWPLACEMENT ($HWND , $TWINDOWPLACEMENT ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "SetWindowPlacement" , "hwnd" , $HWND , "struct*" , $TWINDOWPLACEMENT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_SHOWOWNEDPOPUPS ($HWND , $BSHOW ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "ShowOwnedPopups" , "hwnd" , $HWND , "bool" , $BSHOW ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SWITCHTOTHISWINDOW ($HWND , $BALTTAB = FALSE ) DLLCALL ("user32.dll" , "none" , "SwitchToThisWindow" , "hwnd" , $HWND , "bool" , $BALTTAB ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN 1 ENDFUNC FUNC _WINAPI_TILEWINDOWS ($AWNDS , $TRECT = 0 , $HPARENT = 0 , $IFLAGS = 0 , $ISTART = 0 , $IEND = + 4294967295 ) IF __CHECKERRORARRAYBOUNDS ($AWNDS , $ISTART , $IEND ) THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $ICOUNT = $IEND - $ISTART + 1 LOCAL $TWNDS = DLLSTRUCTCREATE ("hwnd[" & $ICOUNT & "]" ) $ICOUNT = 1 FOR $I = $ISTART TO $IEND DLLSTRUCTSETDATA ($TWNDS , 1 , $AWNDS [$I ] , $ICOUNT ) $ICOUNT += 1 NEXT LOCAL $ARET = DLLCALL ("user32.dll" , "word" , "TileWindows" , "hwnd" , $HPARENT , "uint" , $IFLAGS , "struct*" , $TRECT , "uint" , $ICOUNT + 4294967295 , "struct*" , $TWNDS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_UNREGISTERCLASS ($SCLASS , $HINSTANCE = 0 ) LOCAL $STYPEOFCLASS = "ptr" IF ISSTRING ($SCLASS ) THEN $STYPEOFCLASS = "wstr" ENDIF LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "UnregisterClassW" , $STYPEOFCLASS , $SCLASS , "handle" , $HINSTANCE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_UPDATELAYEREDWINDOW ($HWND , $HDESTDC , $TPTDEST , $TSIZE , $HSRCDC , $TPTSRCE , $IRGB , $TBLEND , $IFLAGS ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "UpdateLayeredWindow" , "hwnd" , $HWND , "handle" , $HDESTDC , "struct*" , $TPTDEST , "struct*" , $TSIZE , "handle" , $HSRCDC , "struct*" , $TPTSRCE , "dword" , $IRGB , "struct*" , $TBLEND , "dword" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_UPDATELAYEREDWINDOWEX ($HWND , $IX , $IY , $HBITMAP , $IOPACITY = 255 , $BDELETE = FALSE ) LOCAL $ARET = DLLCALL ("user32.dll" , "handle" , "GetDC" , "hwnd" , $HWND ) LOCAL $HDC = $ARET [0 ] $ARET = DLLCALL ("gdi32.dll" , "handle" , "CreateCompatibleDC" , "handle" , $HDC ) LOCAL $HDESTDC = $ARET [0 ] $ARET = DLLCALL ("gdi32.dll" , "handle" , "SelectObject" , "handle" , $HDESTDC , "handle" , $HBITMAP ) LOCAL $HDESTSV = $ARET [0 ] LOCAL $TPOINT IF ($IX = + 4294967295 ) AND ($IY = + 4294967295 ) THEN $TPOINT = DLLSTRUCTCREATE ("int;int" ) ELSE $TPOINT = DLLSTRUCTCREATE ("int;int;int;int" ) DLLSTRUCTSETDATA ($TPOINT , 3 , $IX ) DLLSTRUCTSETDATA ($TPOINT , 4 , $IY ) ENDIF DLLSTRUCTSETDATA ($TPOINT , 1 , 0 ) DLLSTRUCTSETDATA ($TPOINT , 2 , 0 ) LOCAL $TBLENDFUNCTION = DLLSTRUCTCREATE ($TAGBLENDFUNCTION ) DLLSTRUCTSETDATA ($TBLENDFUNCTION , 1 , 0 ) DLLSTRUCTSETDATA ($TBLENDFUNCTION , 2 , 0 ) DLLSTRUCTSETDATA ($TBLENDFUNCTION , 3 , $IOPACITY ) DLLSTRUCTSETDATA ($TBLENDFUNCTION , 4 , 1 ) LOCAL CONST $TAGBITMAP = "struct;long bmType;long bmWidth;long bmHeight;long bmWidthBytes;ushort bmPlanes;ushort bmBitsPixel;ptr bmBits;endstruct" LOCAL $TOBJ = DLLSTRUCTCREATE ($TAGBITMAP ) DLLCALL ("gdi32.dll" , "int" , "GetObject" , "handle" , $HBITMAP , "int" , DLLSTRUCTGETSIZE ($TOBJ ) , "struct*" , $TOBJ ) LOCAL $TSIZE = DLLSTRUCTCREATE ($TAGSIZE , DLLSTRUCTGETPTR ($TOBJ , "bmWidth" ) ) $ARET = DLLCALL ("user32.dll" , "bool" , "UpdateLayeredWindow" , "hwnd" , $HWND , "handle" , $HDC , "ptr" , DLLSTRUCTGETPTR ($TPOINT , 3 ) , "struct*" , $TSIZE , "handle" , $HDESTDC , "struct*" , $TPOINT , "dword" , 0 , "struct*" , $TBLENDFUNCTION , "dword" , 2 ) LOCAL $IERROR = @ERROR DLLCALL ("user32.dll" , "bool" , "ReleaseDC" , "hwnd" , $HWND , "handle" , $HDC ) DLLCALL ("gdi32.dll" , "handle" , "SelectObject" , "handle" , $HDESTDC , "handle" , $HDESTSV ) DLLCALL ("gdi32.dll" , "bool" , "DeleteDC" , "handle" , $HDESTDC ) IF $IERROR THEN RETURN SETERROR ($IERROR , 0 , FALSE ) IF $BDELETE THEN DLLCALL ("gdi32.dll" , "bool" , "DeleteObject" , "handle" , $HBITMAP ) ENDIF RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_UPDATELAYEREDWINDOWINDIRECT ($HWND , $TULWINFO ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "UpdateLayeredWindowIndirect" , "hwnd" , $HWND , "struct*" , $TULWINFO ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_WINDOWFROMPOINT (BYREF $TPOINT ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "hwnd" , "WindowFromPoint" , "struct" , $TPOINT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC #EndRegion Public Functions #Region Internal Functions FUNC __ENUMDEFAULTPROC ($PDATA , $LPARAM ) #forceref $lParam LOCAL $ILENGTH = _WINAPI_STRLEN ($PDATA ) __INC ($__G_VENUM ) IF $ILENGTH THEN $__G_VENUM [$__G_VENUM [0 ] ] = DLLSTRUCTGETDATA (DLLSTRUCTCREATE ("wchar[" & ($ILENGTH + 1 ) & "]" , $PDATA ) , 1 ) ELSE $__G_VENUM [$__G_VENUM [0 ] ] = "" ENDIF RETURN 1 ENDFUNC #EndRegion Internal Functions #Region Global Variables and Constants GLOBAL CONST $TAGOSVERSIONINFOEX = $TAGOSVERSIONINFO & ";ushort ServicePackMajor;ushort ServicePackMinor;ushort SuiteMask;byte ProductType;byte Reserved" GLOBAL CONST $TAGRAWINPUTDEVICE = "struct;ushort UsagePage;ushort Usage;dword Flags;hwnd hTarget;endstruct" GLOBAL CONST $TAGRAWINPUTHEADER = "struct;dword Type;dword Size;handle hDevice;wparam wParam;endstruct" GLOBAL CONST $TAGRAWMOUSE = "ushort Flags;ushort Alignment;ushort ButtonFlags;ushort ButtonData;ulong RawButtons;long LastX;long LastY;ulong ExtraInformation;" GLOBAL CONST $TAGRAWKEYBOARD = "ushort MakeCode;ushort Flags;ushort Reserved;ushort VKey;uint Message;ulong ExtraInformation;" GLOBAL CONST $TAGRAWHID = "dword SizeHid;dword Count;" GLOBAL CONST $TAGRAWINPUTMOUSE = $TAGRAWINPUTHEADER & ";" & $TAGRAWMOUSE GLOBAL CONST $TAGRAWINPUTKEYBOARD = $TAGRAWINPUTHEADER & ";" & $TAGRAWKEYBOARD GLOBAL CONST $TAGRAWINPUTHID = $TAGRAWINPUTHEADER & ";" & $TAGRAWHID GLOBAL CONST $TAGRID_DEVICE_INFO_MOUSE = "struct;dword Id;dword NumberOfButtons;dword SampleRate;int HasHorizontalWheel;endstruc" GLOBAL CONST $TAGRID_DEVICE_INFO_KEYBOARD = "struct;dword KbType;dword KbSubType;dword KeyboardMode;dword NumberOfFunctionKeys;dword NumberOfIndicators;dword NumberOfKeysTotal;endstruc" GLOBAL CONST $TAGRID_DEVICE_INFO_HID = "struct;dword VendorId;dword ProductId;dword VersionNumber;ushort UsagePage;ushort Usage;endstruc" GLOBAL CONST $TAGRID_INFO_MOUSE = "dword Size;dword Type;" & $TAGRID_DEVICE_INFO_MOUSE & ";dword Unused[2];" GLOBAL CONST $TAGRID_INFO_KEYBOARD = "dword Size;dword Type;" & $TAGRID_DEVICE_INFO_KEYBOARD GLOBAL CONST $TAGRID_INFO_HID = "dword Size;dword Type;" & $TAGRID_DEVICE_INFO_HID & ";dword Unused[2]" GLOBAL CONST $TAGUSEROBJECTFLAGS = "int Inherit;int Reserved;dword Flags" #EndRegion Global Variables and Constants #Region Functions list #EndRegion Functions list #Region Public Functions FUNC _WINAPI_ACTIVATEKEYBOARDLAYOUT ($HLOCALE , $IFLAG = 0 ) LOCAL $ARET = DLLCALL ("user32.dll" , "handle" , "ActivateKeyboardLayout" , "handle" , $HLOCALE , "uint" , $IFLAG ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_ADDCLIPBOARDFORMATLISTENER ($HWND ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "AddClipboardFormatListener" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_CALLNEXTHOOKEX ($HHOOK , $ICODE , $WPARAM , $LPARAM ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "lresult" , "CallNextHookEx" , "handle" , $HHOOK , "int" , $ICODE , "wparam" , $WPARAM , "lparam" , $LPARAM ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , + 4294967295 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_CLOSEDESKTOP ($HDESKTOP ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "CloseDesktop" , "handle" , $HDESKTOP ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_CLOSEWINDOWSTATION ($HSTATION ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "CloseWindowStation" , "handle" , $HSTATION ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_COMPRESSBUFFER ($PUNCOMPRESSEDBUFFER , $IUNCOMPRESSEDSIZE , $PCOMPRESSEDBUFFER , $ICOMPRESSEDSIZE , $IFORMATANDENGINE = 2 ) LOCAL $ARET , $PWORKSPACE = 0 , $IERROR = 0 DO $ARET = DLLCALL ("ntdll.dll" , "uint" , "RtlGetCompressionWorkSpaceSize" , "ushort" , $IFORMATANDENGINE , "ulong*" , 0 , "ulong*" , 0 ) IF @ERROR OR $ARET [0 ] THEN $IERROR = @ERROR + 20 EXITLOOP ENDIF $PWORKSPACE = __HEAPALLOC ($ARET [2 ] ) IF @ERROR THEN $IERROR = @ERROR + 100 EXITLOOP ENDIF $ARET = DLLCALL ("ntdll.dll" , "uint" , "RtlCompressBuffer" , "ushort" , $IFORMATANDENGINE , "struct*" , $PUNCOMPRESSEDBUFFER , "ulong" , $IUNCOMPRESSEDSIZE , "struct*" , $PCOMPRESSEDBUFFER , "ulong" , $ICOMPRESSEDSIZE , "ulong" , 4096 , "ulong*" , 0 , "ptr" , $PWORKSPACE ) IF @ERROR OR $ARET [0 ] OR NOT $ARET [7 ] THEN $IERROR = @ERROR + 30 EXITLOOP ENDIF UNTIL 1 __HEAPFREE ($PWORKSPACE ) IF $IERROR THEN IF ISARRAY ($ARET ) THEN RETURN SETERROR (10 , $ARET [0 ] , 0 ) ELSE RETURN SETERROR ($IERROR , 0 , 0 ) ENDIF ENDIF RETURN $ARET [7 ] ENDFUNC FUNC _WINAPI_COMPUTECRC32 ($PMEMORY , $ILENGTH ) IF _WINAPI_ISBADREADPTR ($PMEMORY , $ILENGTH ) THEN RETURN SETERROR (1 , @EXTENDED , 0 ) LOCAL $ARET = DLLCALL ("ntdll.dll" , "dword" , "RtlComputeCrc32" , "dword" , 0 , "struct*" , $PMEMORY , "int" , $ILENGTH ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_CREATEDESKTOP ($SNAME , $IACCESS = 2 , $IFLAGS = 0 , $IHEAP = 0 , $TSECURITY = 0 ) LOCAL $ARET IF $IHEAP THEN $ARET = DLLCALL ("user32.dll" , "handle" , "CreateDesktopExW" , "wstr" , $SNAME , "ptr" , 0 , "ptr" , 0 , "dword" , $IFLAGS , "dword" , $IACCESS , "struct*" , $TSECURITY , "ulong" , $IHEAP , "ptr" , 0 ) ELSE $ARET = DLLCALL ("user32.dll" , "handle" , "CreateDesktopW" , "wstr" , $SNAME , "ptr" , 0 , "ptr" , 0 , "dword" , $IFLAGS , "dword" , $IACCESS , "struct*" , $TSECURITY ) ENDIF IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_CREATEWINDOWSTATION ($SNAME = "" , $IACCESS = 0 , $IFLAGS = 0 , $TSECURITY = 0 ) LOCAL $ARET = DLLCALL ("user32.dll" , "handle" , "CreateWindowStationW" , "wstr" , $SNAME , "dword" , $IFLAGS , "dword" , $IACCESS , "struct*" , $TSECURITY ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_DECOMPRESSBUFFER ($PUNCOMPRESSEDBUFFER , $IUNCOMPRESSEDSIZE , $PCOMPRESSEDBUFFER , $ICOMPRESSEDSIZE , $IFORMAT = 2 ) LOCAL $ARET = DLLCALL ("ntdll.dll" , "long" , "RtlDecompressBuffer" , "ushort" , $IFORMAT , "struct*" , $PUNCOMPRESSEDBUFFER , "ulong" , $IUNCOMPRESSEDSIZE , "struct*" , $PCOMPRESSEDBUFFER , "ulong" , $ICOMPRESSEDSIZE , "ulong*" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF $ARET [0 ] THEN RETURN SETERROR (10 , $ARET [0 ] , 0 ) RETURN $ARET [6 ] ENDFUNC FUNC _WINAPI_DEFRAWINPUTPROC ($PARAWINPUT , $IINPUT ) LOCAL $ARET = DLLCALL ("user32.dll" , "lresult" , "DefRawInputProc" , "ptr" , $PARAWINPUT , "int" , $IINPUT , "uint" , DLLSTRUCTGETSIZE (DLLSTRUCTCREATE ($TAGRAWINPUTHEADER ) ) ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF $ARET [0 ] THEN RETURN SETERROR (10 , $ARET [0 ] , 0 ) RETURN 1 ENDFUNC FUNC _WINAPI_ENUMDESKTOPS ($HSTATION ) IF STRINGCOMPARE (_WINAPI_GETUSEROBJECTINFORMATION ($HSTATION , 3 ) , "WindowStation" ) THEN RETURN SETERROR (1 , 0 , 0 ) LOCAL $HENUMPROC = DLLCALLBACKREGISTER ("__EnumDefaultProc" , "bool" , "ptr;lparam" ) DIM $__G_VENUM [101 ] = [0 ] LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "EnumDesktopsW" , "handle" , $HSTATION , "ptr" , DLLCALLBACKGETPTR ($HENUMPROC ) , "lparam" , 0 ) IF @ERROR OR NOT $ARET [0 ] OR NOT $__G_VENUM [0 ] THEN $__G_VENUM = @ERROR + 10 ENDIF DLLCALLBACKFREE ($HENUMPROC ) IF $__G_VENUM THEN RETURN SETERROR ($__G_VENUM , 0 , 0 ) __INC ($__G_VENUM , + 4294967295 ) RETURN $__G_VENUM ENDFUNC FUNC _WINAPI_ENUMDESKTOPWINDOWS ($HDESKTOP , $BVISIBLE = TRUE ) IF STRINGCOMPARE (_WINAPI_GETUSEROBJECTINFORMATION ($HDESKTOP , 3 ) , "Desktop" ) THEN RETURN SETERROR (1 , 0 , 0 ) LOCAL $HENUMPROC = DLLCALLBACKREGISTER ("__EnumWindowsProc" , "bool" , "hwnd;lparam" ) DIM $__G_VENUM [101 ] [2 ] = [[0 ] ] LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "EnumDesktopWindows" , "handle" , $HDESKTOP , "ptr" , DLLCALLBACKGETPTR ($HENUMPROC ) , "lparam" , $BVISIBLE ) IF @ERROR OR NOT $ARET [0 ] OR NOT $__G_VENUM [0 ] [0 ] THEN $__G_VENUM = @ERROR + 10 ENDIF DLLCALLBACKFREE ($HENUMPROC ) IF $__G_VENUM THEN RETURN SETERROR ($__G_VENUM , 0 , 0 ) __INC ($__G_VENUM , + 4294967295 ) RETURN $__G_VENUM ENDFUNC FUNC _WINAPI_ENUMPAGEFILES () LOCAL $AINFO = _WINAPI_GETSYSTEMINFO () LOCAL $HENUMPROC = DLLCALLBACKREGISTER ("__EnumPageFilesProc" , "bool" , "lparam;ptr;ptr" ) DIM $__G_VENUM [101 ] [4 ] = [[0 ] ] LOCAL $ARET = DLLCALL (@SYSTEMDIR & "\psapi.dll" , "bool" , "EnumPageFilesW" , "ptr" , DLLCALLBACKGETPTR ($HENUMPROC ) , "lparam" , $AINFO [1 ] ) IF @ERROR OR NOT $ARET [0 ] OR NOT $__G_VENUM [0 ] [0 ] THEN $__G_VENUM = @ERROR + 10 ENDIF DLLCALLBACKFREE ($HENUMPROC ) IF $__G_VENUM THEN RETURN SETERROR ($__G_VENUM , 0 , 0 ) __INC ($__G_VENUM , + 4294967295 ) RETURN $__G_VENUM ENDFUNC FUNC _WINAPI_ENUMRAWINPUTDEVICES () LOCAL CONST $TAGRAWINPUTDEVICELIST = "struct;handle hDevice;dword Type;endstruct" LOCAL $TRIDL , $ILENGTH = DLLSTRUCTGETSIZE (DLLSTRUCTCREATE ($TAGRAWINPUTDEVICELIST ) ) LOCAL $ARET = DLLCALL ("user32.dll" , "uint" , "GetRawInputDeviceList" , "ptr" , 0 , "uint*" , 0 , "uint" , $ILENGTH ) IF @ERROR THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) IF ($ARET [0 ] = 0xFFFFFFFF ) OR (NOT $ARET [2 ] ) THEN RETURN SETERROR (10 , + 4294967295 , 0 ) LOCAL $TDATA = DLLSTRUCTCREATE ("byte[" & ($ARET [2 ] * $ILENGTH ) & "]" ) LOCAL $PDATA = DLLSTRUCTGETPTR ($TDATA ) IF @ERROR THEN RETURN SETERROR (@ERROR + 20 , 0 , 0 ) $ARET = DLLCALL ("user32.dll" , "uint" , "GetRawInputDeviceList" , "ptr" , $PDATA , "uint*" , $ARET [2 ] , "uint" , $ILENGTH ) IF ($ARET [0 ] = 0xFFFFFFFF ) OR (NOT $ARET [0 ] ) THEN RETURN SETERROR (1 , + 4294967295 , 0 ) LOCAL $ARESULT [$ARET [2 ] + 1 ] [2 ] = [[$ARET [2 ] ] ] FOR $I = 1 TO $ARET [2 ] $TRIDL = DLLSTRUCTCREATE ("ptr;dword" , $PDATA + $ILENGTH * ($I + 4294967295 ) ) FOR $J = 0 TO 1 $ARESULT [$I ] [$J ] = DLLSTRUCTGETDATA ($TRIDL , $J + 1 ) NEXT NEXT RETURN $ARESULT ENDFUNC FUNC _WINAPI_ENUMWINDOWSTATIONS () LOCAL $HENUMPROC = DLLCALLBACKREGISTER ("__EnumDefaultProc" , "bool" , "ptr;lparam" ) DIM $__G_VENUM [101 ] = [0 ] LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "EnumWindowStationsW" , "ptr" , DLLCALLBACKGETPTR ($HENUMPROC ) , "lparam" , 0 ) IF @ERROR OR NOT $ARET [0 ] OR NOT $__G_VENUM [0 ] THEN $__G_VENUM = @ERROR + 10 ENDIF DLLCALLBACKFREE ($HENUMPROC ) IF $__G_VENUM THEN RETURN SETERROR ($__G_VENUM , 0 , 0 ) __INC ($__G_VENUM , + 4294967295 ) RETURN $__G_VENUM ENDFUNC FUNC _WINAPI_EXPANDENVIRONMENTSTRINGS ($SSTRING ) LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "dword" , "ExpandEnvironmentStringsW" , "wstr" , $SSTRING , "wstr" , "" , "dword" , 4096 ) IF @ERROR OR NOT $ARESULT [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , "" ) RETURN $ARESULT [2 ] ENDFUNC FUNC _WINAPI_GETACTIVEWINDOW () LOCAL $ARET = DLLCALL ("user32.dll" , "hwnd" , "GetActiveWindow" ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETASYNCKEYSTATE ($IKEY ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "short" , "GetAsyncKeyState" , "int" , $IKEY ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETCLIPBOARDSEQUENCENUMBER () LOCAL $ARET = DLLCALL ("user32.dll" , "dword" , "GetClipboardSequenceNumber" ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETCURRENTHWPROFILE () LOCAL $TAGHW_PROFILE_INFO = "dword DockInfo;wchar szHwProfileGuid[39];wchar szHwProfileName[80]" LOCAL $THWPI = DLLSTRUCTCREATE ($TAGHW_PROFILE_INFO ) LOCAL $ARET = DLLCALL ("advapi32.dll" , "bool" , "GetCurrentHwProfileW" , "struct*" , $THWPI ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $ARESULT [3 ] FOR $I = 0 TO 2 $ARESULT [$I ] = DLLSTRUCTGETDATA ($THWPI , $I + 1 ) NEXT RETURN $ARESULT ENDFUNC FUNC _WINAPI_GETDEFAULTPRINTER () LOCAL $ARET = DLLCALL ("winspool.drv" , "bool" , "GetDefaultPrinterW" , "wstr" , "" , "dword*" , 2048 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) IF NOT $ARET [0 ] THEN RETURN SETERROR (10 , _WINAPI_GETLASTERROR () , "" ) RETURN $ARET [1 ] ENDFUNC FUNC _WINAPI_GETDLLDIRECTORY () LOCAL $ARET = DLLCALL ("kernel32.dll" , "dword" , "GetDllDirectoryW" , "dword" , 4096 , "wstr" , "" ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_GETEFFECTIVECLIENTRECT ($HWND , $ACTRL , $ISTART = 0 , $IEND = + 4294967295 ) IF NOT ISARRAY ($ACTRL ) THEN LOCAL $ICTRL = $ACTRL DIM $ACTRL [1 ] = [$ICTRL ] $ISTART = 0 $IEND = 0 ENDIF IF __CHECKERRORARRAYBOUNDS ($ACTRL , $ISTART , $IEND ) THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $ICOUNT = $IEND - $ISTART + 1 LOCAL $TCTRL = DLLSTRUCTCREATE ("uint64[" & ($ICOUNT + 2 ) & "]" ) $ICOUNT = 2 FOR $I = $ISTART TO $IEND IF ISHWND ($ACTRL [$I ] ) THEN $ACTRL [$I ] = _WINAPI_GETDLGCTRLID ($ACTRL [$I ] ) ENDIF DLLSTRUCTSETDATA ($TCTRL , 1 , _WINAPI_MAKEQWORD (1 , $ACTRL [$I ] ) , $ICOUNT ) $ICOUNT += 1 NEXT LOCAL $TRECT = DLLSTRUCTCREATE ($TAGRECT ) DLLCALL ("comctl32.dll" , "none" , "GetEffectiveClientRect" , "hwnd" , $HWND , "struct*" , $TRECT , "struct*" , $TCTRL ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $TRECT ENDFUNC FUNC _WINAPI_GETHANDLEINFORMATION ($HOBJECT ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "GetHandleInformation" , "handle" , $HOBJECT , "dword*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_GETIDLETIME () LOCAL $TLASTINPUTINFO = DLLSTRUCTCREATE ("uint;dword" ) DLLSTRUCTSETDATA ($TLASTINPUTINFO , 1 , DLLSTRUCTGETSIZE ($TLASTINPUTINFO ) ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "GetLastInputInfo" , "struct*" , $TLASTINPUTINFO ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN _WINAPI_GETTICKCOUNT () - DLLSTRUCTGETDATA ($TLASTINPUTINFO , 2 ) ENDFUNC FUNC _WINAPI_GETKEYBOARDLAYOUT ($HWND ) LOCAL $ARET = DLLCALL ("user32.dll" , "dword" , "GetWindowThreadProcessId" , "hwnd" , $HWND , "ptr" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) $ARET = DLLCALL ("user32.dll" , "handle" , "GetKeyboardLayout" , "dword" , $ARET [0 ] ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETKEYBOARDLAYOUTLIST () LOCAL $ARET = DLLCALL ("user32.dll" , "uint" , "GetKeyboardLayoutList" , "int" , 0 , "ptr" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , 0 ) LOCAL $TDATA = DLLSTRUCTCREATE ("handle[" & $ARET [0 ] & "]" ) $ARET = DLLCALL ("user32.dll" , "uint" , "GetKeyboardLayoutList" , "int" , $ARET [0 ] , "struct*" , $TDATA ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $ALIST [$ARET [0 ] + 1 ] = [$ARET [0 ] ] FOR $I = 1 TO $ALIST [0 ] $ALIST [$I ] = DLLSTRUCTGETDATA ($TDATA , 1 , $I ) NEXT RETURN $ALIST ENDFUNC FUNC _WINAPI_GETKEYBOARDSTATE () LOCAL $TDATA = DLLSTRUCTCREATE ("byte[256]" ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "GetKeyboardState" , "struct*" , $TDATA ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN $TDATA ENDFUNC FUNC _WINAPI_GETKEYBOARDTYPE ($ITYPE ) LOCAL $ARET = DLLCALL ("user32.dll" , "int" , "GetKeyboardType" , "int" , $ITYPE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETKEYNAMETEXT ($LPARAM ) LOCAL $ARET = DLLCALL ("user32.dll" , "int" , "GetKeyNameTextW" , "long" , $LPARAM , "wstr" , "" , "int" , 128 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , "" ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_GETKEYSTATE ($VKEY ) LOCAL $ARET = DLLCALL ("user32.dll" , "short" , "GetKeyState" , "int" , $VKEY ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETMODULEHANDLEEX ($SMODULE , $IFLAGS = 0 ) LOCAL $STYPEOFMODULE = "ptr" IF ISSTRING ($SMODULE ) THEN IF STRINGSTRIPWS ($SMODULE , $STR_STRIPLEADING + $STR_STRIPTRAILING ) THEN $STYPEOFMODULE = "wstr" ELSE $SMODULE = 0 ENDIF ENDIF LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "GetModuleHandleExW" , "dword" , $IFLAGS , $STYPEOFMODULE , $SMODULE , "ptr*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [3 ] ENDFUNC FUNC _WINAPI_GETMUILANGUAGE () LOCAL $ARET = DLLCALL ("comctl32.dll" , "word" , "GetMUILanguage" ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETPERFORMANCEINFO () LOCAL $TPI = DLLSTRUCTCREATE ("dword;ulong_ptr;ulong_ptr;ulong_ptr;ulong_ptr;ulong_ptr;ulong_ptr;ulong_ptr;ulong_ptr;ulong_ptr;ulong_ptr;dword;dword;dword" ) LOCAL $ARET = DLLCALL (@SYSTEMDIR & "\psapi.dll" , "bool" , "GetPerformanceInfo" , "struct*" , $TPI , "dword" , DLLSTRUCTGETSIZE ($TPI ) ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $ARESULT [13 ] FOR $I = 0 TO 12 $ARESULT [$I ] = DLLSTRUCTGETDATA ($TPI , $I + 2 ) NEXT FOR $I = 0 TO 8 $ARESULT [$I ] *= $ARESULT [9 ] NEXT RETURN $ARESULT ENDFUNC FUNC _WINAPI_GETPROCADDRESS ($HMODULE , $VNAME ) LOCAL $STYPE = "str" IF ISNUMBER ($VNAME ) THEN $STYPE = "word" LOCAL $ARESULT = DLLCALL ("kernel32.dll" , "ptr" , "GetProcAddress" , "handle" , $HMODULE , $STYPE , $VNAME ) IF @ERROR OR NOT $ARESULT [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_GETPHYSICALLYINSTALLEDSYSTEMMEMORY () LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "GetPhysicallyInstalledSystemMemory" , "uint64*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [1 ] ENDFUNC FUNC _WINAPI_GETPROCESSSHUTDOWNPARAMETERS () LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "GetProcessShutdownParameters" , "dword*" , 0 , "dword*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN SETEXTENDED (NUMBER (NOT $ARET [2 ] ) , $ARET [1 ] ) ENDFUNC FUNC _WINAPI_GETPROCESSWINDOWSTATION () LOCAL $ARET = DLLCALL ("user32.dll" , "handle" , "GetProcessWindowStation" ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETPWRCAPABILITIES () IF NOT __DLL ("powrprof.dll" ) THEN RETURN SETERROR (103 , 0 , 0 ) LOCAL $TSPC = DLLSTRUCTCREATE ("byte[18];byte[3];byte;byte[8];byte[2];ulong[6];ulong[5]" ) LOCAL $ARET = DLLCALL ("powrprof.dll" , "boolean" , "GetPwrCapabilities" , "struct*" , $TSPC ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $ARESULT [25 ] FOR $I = 0 TO 17 $ARESULT [$I ] = DLLSTRUCTGETDATA ($TSPC , 1 , $I + 1 ) NEXT $ARESULT [18 ] = DLLSTRUCTGETDATA ($TSPC , 3 ) FOR $I = 19 TO 20 $ARESULT [$I ] = DLLSTRUCTGETDATA ($TSPC , 5 , $I + 4294967278 ) NEXT FOR $I = 21 TO 24 $ARESULT [$I ] = DLLSTRUCTGETDATA ($TSPC , 7 , $I + 4294967276 ) NEXT RETURN $ARESULT ENDFUNC FUNC _WINAPI_GETRAWINPUTBUFFER ($PBUFFER , $ILENGTH ) LOCAL $ARET = DLLCALL ("user32.dll" , "uint" , "GetRawInputBuffer" , "struct*" , $PBUFFER , "uint*" , $ILENGTH , "uint" , DLLSTRUCTGETSIZE (DLLSTRUCTCREATE ($TAGRAWINPUTHEADER ) ) ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF ($ARET [0 ] = 0xFFFFFFFF ) OR (NOT $ARET [1 ] ) THEN RETURN SETERROR (10 , + 4294967295 , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETRAWINPUTBUFFERLENGTH () LOCAL $ARET = DLLCALL ("user32.dll" , "uint" , "GetRawInputBuffer" , "ptr" , 0 , "uint*" , 0 , "uint" , DLLSTRUCTGETSIZE (DLLSTRUCTCREATE ($TAGRAWINPUTHEADER ) ) ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF $ARET [0 ] = 0xFFFFFFFF THEN RETURN SETERROR (10 , + 4294967295 , 0 ) RETURN $ARET [2 ] * 8 ENDFUNC FUNC _WINAPI_GETRAWINPUTDATA ($HRAWINPUT , $PBUFFER , $ILENGTH , $IFLAG ) LOCAL $ARET = DLLCALL ("user32.dll" , "uint" , "GetRawInputData" , "handle" , $HRAWINPUT , "uint" , $IFLAG , "struct*" , $PBUFFER , "uint*" , $ILENGTH , "uint" , DLLSTRUCTGETSIZE (DLLSTRUCTCREATE ($TAGRAWINPUTHEADER ) ) ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF $ARET [0 ] = 0xFFFFFFFF THEN RETURN SETERROR (10 , + 4294967295 , 0 ) RETURN ($ARET [3 ] $ARET [0 ] $ARET [4 ] ) ENDFUNC FUNC _WINAPI_GETRAWINPUTDEVICEINFO ($HDEVICE , $PBUFFER , $ILENGTH , $IFLAG ) LOCAL $ARET = DLLCALL ("user32.dll" , "uint" , "GetRawInputDeviceInfoW" , "handle" , $HDEVICE , "uint" , $IFLAG , "struct*" , $PBUFFER , "uint*" , $ILENGTH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF $ARET [0 ] = 0xFFFFFFFF THEN RETURN SETERROR (10 , + 4294967295 , 0 ) RETURN ($ARET [3 ] $ARET [0 ] $ARET [4 ] ) ENDFUNC FUNC _WINAPI_GETREGISTEREDRAWINPUTDEVICES ($PBUFFER , $ILENGTH ) LOCAL $ILENGTHRAW = DLLSTRUCTGETSIZE (DLLSTRUCTCREATE ($TAGRAWINPUTDEVICE ) ) LOCAL $ARET = DLLCALL ("user32.dll" , "uint" , "GetRegisteredRawInputDevices" , "struct*" , $PBUFFER , "uint*" , FLOOR ($ILENGTH / $ILENGTHRAW ) , "uint" , $ILENGTHRAW ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) IF $ARET [0 ] = 0xFFFFFFFF THEN LOCAL $ILASTERROR = _WINAPI_GETLASTERROR () IF $ILASTERROR = 122 THEN RETURN SETEXTENDED ($ILASTERROR , $ARET [2 ] * $ILENGTHRAW ) RETURN SETERROR (10 , $ILASTERROR , 0 ) ENDIF RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETSTARTUPINFO () LOCAL $TSI = DLLSTRUCTCREATE ($TAGSTARTUPINFO ) DLLCALL ("kernel32.dll" , "none" , "GetStartupInfoW" , "struct*" , $TSI ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $TSI ENDFUNC FUNC _WINAPI_GETSYSTEMDEPPOLICY () LOCAL $ARET = DLLCALL ("kernel32.dll" , "uint" , "GetSystemDEPPolicy" ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , + 4294967295 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETSYSTEMINFO () LOCAL $SPROC IF _WINAPI_ISWOW64PROCESS () THEN $SPROC = "GetNativeSystemInfo" ELSE $SPROC = "GetSystemInfo" ENDIF LOCAL CONST $TAGSYSTEMINFO = "struct;word ProcessorArchitecture;word Reserved; endstruct;dword PageSize;" & "ptr MinimumApplicationAddress;ptr MaximumApplicationAddress;dword_ptr ActiveProcessorMask;dword NumberOfProcessors;" & "dword ProcessorType;dword AllocationGranularity;word ProcessorLevel;word ProcessorRevision" LOCAL $TSYSTEMINFO = DLLSTRUCTCREATE ($TAGSYSTEMINFO ) DLLCALL ("kernel32.dll" , "none" , $SPROC , "struct*" , $TSYSTEMINFO ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) LOCAL $ARESULT [10 ] $ARESULT [0 ] = DLLSTRUCTGETDATA ($TSYSTEMINFO , 1 ) FOR $I = 1 TO 9 $ARESULT [$I ] = DLLSTRUCTGETDATA ($TSYSTEMINFO , $I + 2 ) NEXT RETURN $ARESULT ENDFUNC FUNC _WINAPI_GETSYSTEMPOWERSTATUS () LOCAL $TAGSYSTEM_POWER_STATUS = "byte ACLineStatus;byte BatteryFlag;byte BatteryLifePercent;byte Reserved1;" & "int BatteryLifeTime;int BatteryFullLifeTime" LOCAL $TSYSTEM_POWER_STATUS = DLLSTRUCTCREATE ($TAGSYSTEM_POWER_STATUS ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "GetSystemPowerStatus" , "struct*" , $TSYSTEM_POWER_STATUS ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $ARESULT [5 ] $ARESULT [0 ] = DLLSTRUCTGETDATA ($TSYSTEM_POWER_STATUS , 1 ) $ARESULT [1 ] = DLLSTRUCTGETDATA ($TSYSTEM_POWER_STATUS , 2 ) $ARESULT [2 ] = DLLSTRUCTGETDATA ($TSYSTEM_POWER_STATUS , 3 ) $ARESULT [3 ] = DLLSTRUCTGETDATA ($TSYSTEM_POWER_STATUS , 5 ) $ARESULT [4 ] = DLLSTRUCTGETDATA ($TSYSTEM_POWER_STATUS , 6 ) RETURN $ARESULT ENDFUNC FUNC _WINAPI_GETSYSTEMTIMES () LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "GetSystemTimes" , "uint64*" , 0 , "uint64*" , 0 , "uint64*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $ARESULT [3 ] FOR $I = 0 TO 2 $ARESULT [$I ] = $ARET [$I + 1 ] NEXT RETURN $ARESULT ENDFUNC FUNC _WINAPI_GETSYSTEMWOW64DIRECTORY () LOCAL $ARET = DLLCALL ("kernel32.dll" , "uint" , "GetSystemWow64DirectoryW" , "wstr" , "" , "uint" , 4096 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , _WINAPI_GETLASTERROR () , "" ) RETURN $ARET [1 ] ENDFUNC FUNC _WINAPI_GETTICKCOUNT () LOCAL $ARET = DLLCALL ("kernel32.dll" , "dword" , "GetTickCount" ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETTICKCOUNT64 () LOCAL $ARET = DLLCALL ("kernel32.dll" , "uint64" , "GetTickCount64" ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_GETUSEROBJECTINFORMATION ($HOBJECT , $IINDEX ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "GetUserObjectInformationW" , "handle" , $HOBJECT , "int" , $IINDEX , "ptr" , 0 , "dword" , 0 , "dword*" , 0 ) IF @ERROR OR NOT $ARET [5 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $TDATA SWITCH $IINDEX CASE 1 $TDATA = DLLSTRUCTCREATE ($TAGUSEROBJECTFLAGS ) CASE 5 , 6 $TDATA = DLLSTRUCTCREATE ("uint" ) CASE 2 , 3 $TDATA = DLLSTRUCTCREATE ("wchar[" & $ARET [5 ] & "]" ) CASE 4 $TDATA = DLLSTRUCTCREATE ("byte[" & $ARET [5 ] & "]" ) CASE ELSE RETURN SETERROR (20 , 0 , 0 ) ENDSWITCH $ARET = DLLCALL ("user32.dll" , "bool" , "GetUserObjectInformationW" , "handle" , $HOBJECT , "int" , $IINDEX , "struct*" , $TDATA , "dword" , DLLSTRUCTGETSIZE ($TDATA ) , "dword*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 30 , @EXTENDED , 0 ) SWITCH $IINDEX CASE 1 , 4 RETURN $TDATA CASE ELSE RETURN DLLSTRUCTGETDATA ($TDATA , 1 ) ENDSWITCH ENDFUNC FUNC _WINAPI_GETVERSION () RETURN NUMBER (BITAND (BITSHIFT ($__WINVER , 8 ) , 255 ) & "." & BITAND ($__WINVER , 255 ) , $NUMBER_DOUBLE ) ENDFUNC FUNC _WINAPI_GETVERSIONEX () LOCAL $TOSVERSIONINFOEX = DLLSTRUCTCREATE ($TAGOSVERSIONINFOEX ) DLLSTRUCTSETDATA ($TOSVERSIONINFOEX , "OSVersionInfoSize" , DLLSTRUCTGETSIZE ($TOSVERSIONINFOEX ) ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "GetVersionExW" , "struct*" , $TOSVERSIONINFOEX ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN $TOSVERSIONINFOEX ENDFUNC FUNC _WINAPI_GETWORKAREA () LOCAL $TRECT = DLLSTRUCTCREATE ($TAGRECT ) LOCAL $ARET = DLLCALL ("user32.dll" , "int" , "SystemParametersInfo" , "uint" , 48 , "uint" , 0 , "struct*" , $TRECT , "uint" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN $TRECT ENDFUNC FUNC _WINAPI_INITMUILANGUAGE ($ILANGUAGE ) DLLCALL ("comctl32.dll" , "none" , "InitMUILanguage" , "word" , $ILANGUAGE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN 1 ENDFUNC FUNC _WINAPI_ISLOADKBLAYOUT ($ILANGUAGE ) LOCAL $ALAYOUT = _WINAPI_GETKEYBOARDLAYOUTLIST () IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) FOR $I = 1 TO $ALAYOUT [0 ] IF $ALAYOUT [$I ] = $ILANGUAGE THEN RETURN TRUE NEXT RETURN FALSE ENDFUNC FUNC _WINAPI_ISPROCESSORFEATUREPRESENT ($IFEATURE ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "IsProcessorFeaturePresent" , "dword" , $IFEATURE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_ISWINDOWENABLED ($HWND ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "IsWindowEnabled" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_KEYBD_EVENT ($VKEY , $IFLAGS , $ISCANCODE = 0 , $IEXTRAINFO = 0 ) DLLCALL ("user32.dll" , "none" , "keybd_event" , "byte" , $VKEY , "byte" , $ISCANCODE , "dword" , $IFLAGS , "ulong_ptr" , $IEXTRAINFO ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN 1 ENDFUNC FUNC _WINAPI_LOADKEYBOARDLAYOUT ($ILANGUAGE , $IFLAG = 0 ) LOCAL $ARET = DLLCALL ("user32.dll" , "handle" , "LoadKeyboardLayoutW" , "wstr" , HEX ($ILANGUAGE , 8 ) , "uint" , $IFLAG ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_LOCKWORKSTATION () LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "LockWorkStation" ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_MAPVIRTUALKEY ($ICODE , $ITYPE , $HLOCALE = 0 ) LOCAL $ARET = DLLCALL ("user32.dll" , "INT" , "MapVirtualKeyExW" , "uint" , $ICODE , "uint" , $ITYPE , "uint_ptr" , $HLOCALE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_MOUSE_EVENT ($IFLAGS , $IX = 0 , $IY = 0 , $IDATA = 0 , $IEXTRAINFO = 0 ) DLLCALL ("user32.dll" , "none" , "mouse_event" , "dword" , $IFLAGS , "dword" , $IX , "dword" , $IY , "dword" , $IDATA , "ulong_ptr" , $IEXTRAINFO ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED ) ENDFUNC FUNC _WINAPI_OPENDESKTOP ($SNAME , $IACCESS = 0 , $IFLAGS = 0 , $BINHERIT = FALSE ) LOCAL $ARET = DLLCALL ("user32.dll" , "handle" , "OpenDesktopW" , "wstr" , $SNAME , "dword" , $IFLAGS , "bool" , $BINHERIT , "dword" , $IACCESS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_OPENINPUTDESKTOP ($IACCESS = 0 , $IFLAGS = 0 , $BINHERIT = FALSE ) LOCAL $ARET = DLLCALL ("user32.dll" , "handle" , "OpenInputDesktop" , "dword" , $IFLAGS , "bool" , $BINHERIT , "dword" , $IACCESS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_OPENWINDOWSTATION ($SNAME , $IACCESS = 0 , $BINHERIT = FALSE ) LOCAL $ARET = DLLCALL ("user32.dll" , "handle" , "OpenWindowStationW" , "wstr" , $SNAME , "bool" , $BINHERIT , "dword" , $IACCESS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_QUERYPERFORMANCECOUNTER () LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "QueryPerformanceCounter" , "int64*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [1 ] ENDFUNC FUNC _WINAPI_QUERYPERFORMANCEFREQUENCY () LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "QueryPerformanceFrequency" , "int64*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) RETURN $ARET [1 ] ENDFUNC FUNC _WINAPI_REGISTERHOTKEY ($HWND , $IID , $IMODIFIERS , $VKEY ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "RegisterHotKey" , "hwnd" , $HWND , "int" , $IID , "uint" , $IMODIFIERS , "uint" , $VKEY ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_REGISTERPOWERSETTINGNOTIFICATION ($HWND , $SGUID ) LOCAL $TGUID = DLLSTRUCTCREATE ($TAGGUID ) LOCAL $ARET = DLLCALL ("ole32.dll" , "long" , "CLSIDFromString" , "wstr" , $SGUID , "struct*" , $TGUID ) IF @ERROR OR $ARET [0 ] THEN RETURN SETERROR (@ERROR + 20 , @EXTENDED , 0 ) $ARET = DLLCALL ("user32.dll" , "handle" , "RegisterPowerSettingNotification" , "handle" , $HWND , "struct*" , $TGUID , "dword" , 0 ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_REGISTERRAWINPUTDEVICES ($PADEVICE , $ICOUNT = 1 ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "RegisterRawInputDevices" , "struct*" , $PADEVICE , "uint" , $ICOUNT , "uint" , DLLSTRUCTGETSIZE (DLLSTRUCTCREATE ($TAGRAWINPUTDEVICE ) ) * $ICOUNT ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_RELEASECAPTURE () LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "ReleaseCapture" ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_REMOVECLIPBOARDFORMATLISTENER ($HWND ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "RemoveClipboardFormatListener" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SETACTIVEWINDOW ($HWND ) LOCAL $ARET = DLLCALL ("user32.dll" , "int" , "SetActiveWindow" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SETCAPTURE ($HWND ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "hwnd" , "SetCapture" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_SETDEFAULTPRINTER ($SPRINTER ) LOCAL $ARESULT = DLLCALL ("winspool.drv" , "bool" , "SetDefaultPrinterW" , "wstr" , $SPRINTER ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_SETDLLDIRECTORY ($SDIRPATH = DEFAULT ) LOCAL $STYPEOFPATH = "wstr" IF $SDIRPATH = DEFAULT THEN $STYPEOFPATH = "ptr" $SDIRPATH = 0 ENDIF LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "SetDllDirectoryW" , $STYPEOFPATH , $SDIRPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SETKEYBOARDLAYOUT ($HWND , $ILANGUAGE , $IFLAGS = 0 ) IF NOT _WINAPI_ISWINDOW ($HWND ) THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , 0 ) LOCAL $HLOCALE = 0 IF $ILANGUAGE THEN $HLOCALE = _WINAPI_LOADKEYBOARDLAYOUT ($ILANGUAGE ) IF NOT $HLOCALE THEN RETURN SETERROR (10 , 0 , 0 ) ENDIF LOCAL CONST $WM_INPUTLANGCHANGEREQUEST = 80 DLLCALL ("user32.dll" , "none" , "SendMessage" , "hwnd" , $HWND , "uint" , $WM_INPUTLANGCHANGEREQUEST , "uint" , $IFLAGS , "uint_ptr" , $HLOCALE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN 1 ENDFUNC FUNC _WINAPI_SETKEYBOARDSTATE (BYREF $TSTATE ) LOCAL $ARET = DLLCALL ("user32.dll" , "int" , "SetKeyboardState" , "struct*" , $TSTATE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SETPROCESSSHUTDOWNPARAMETERS ($ILEVEL , $BDIALOG = FALSE ) LOCAL $ARET = DLLCALL ("kernel32.dll" , "bool" , "SetProcessShutdownParameters" , "dword" , $ILEVEL , "dword" , NOT $BDIALOG ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SETPROCESSWINDOWSTATION ($HSTATION ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "SetProcessWindowStation" , "handle" , $HSTATION ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SETUSEROBJECTINFORMATION ($HOBJECT , $IINDEX , BYREF $TDATA ) IF $IINDEX <> 1 THEN RETURN SETERROR (10 , 0 , FALSE ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "SetUserObjectInformationW" , "handle" , $HOBJECT , "int" , 1 , "struct*" , $TDATA , "dword" , DLLSTRUCTGETSIZE ($TDATA ) ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SETWINDOWSHOOKEX ($IHOOK , $PPROC , $HDLL , $ITHREADID = 0 ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "handle" , "SetWindowsHookEx" , "int" , $IHOOK , "ptr" , $PPROC , "handle" , $HDLL , "dword" , $ITHREADID ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_SETWINEVENTHOOK ($IEVENTMIN , $IEVENTMAX , $PEVENTPROC , $IPID = 0 , $ITHREADID = 0 , $IFLAGS = 0 ) LOCAL $ARET = DLLCALL ("user32.dll" , "handle" , "SetWinEventHook" , "uint" , $IEVENTMIN , "uint" , $IEVENTMAX , "ptr" , 0 , "ptr" , $PEVENTPROC , "dword" , $IPID , "dword" , $ITHREADID , "uint" , $IFLAGS ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SHUTDOWNBLOCKREASONCREATE ($HWND , $STEXT ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "ShutdownBlockReasonCreate" , "hwnd" , $HWND , "wstr" , $STEXT ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SHUTDOWNBLOCKREASONDESTROY ($HWND ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "ShutdownBlockReasonDestroy" , "hwnd" , $HWND ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SHUTDOWNBLOCKREASONQUERY ($HWND ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "ShutdownBlockReasonQuery" , "hwnd" , $HWND , "wstr" , "" , "dword*" , 4096 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR + 10 , @EXTENDED , "" ) RETURN $ARET [2 ] ENDFUNC FUNC _WINAPI_SWITCHDESKTOP ($HDESKTOP ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "SwitchDesktop" , "handle" , $HDESKTOP ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_SYSTEMPARAMETERSINFO ($IACTION , $IPARAM = 0 , $VPARAM = 0 , $IWININI = 0 ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "SystemParametersInfoW" , "uint" , $IACTION , "uint" , $IPARAM , "struct*" , $VPARAM , "uint" , $IWININI ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_TRACKMOUSEEVENT ($HWND , $IFLAGS , $ITIME = + 4294967295 ) LOCAL $TTME = DLLSTRUCTCREATE ("dword;dword;hwnd;dword" ) DLLSTRUCTSETDATA ($TTME , 1 , DLLSTRUCTGETSIZE ($TTME ) ) DLLSTRUCTSETDATA ($TTME , 2 , $IFLAGS ) DLLSTRUCTSETDATA ($TTME , 3 , $HWND ) DLLSTRUCTSETDATA ($TTME , 4 , $ITIME ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "TrackMouseEvent" , "struct*" , $TTME ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_UNHOOKWINDOWSHOOKEX ($HHOOK ) LOCAL $ARESULT = DLLCALL ("user32.dll" , "bool" , "UnhookWindowsHookEx" , "handle" , $HHOOK ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARESULT [0 ] ENDFUNC FUNC _WINAPI_UNHOOKWINEVENT ($HEVENTHOOK ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "UnhookWinEvent" , "handle" , $HEVENTHOOK ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , FALSE ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_UNLOADKEYBOARDLAYOUT ($HLOCALE ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "UnloadKeyboardLayout" , "handle" , $HLOCALE ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_UNREGISTERHOTKEY ($HWND , $IID ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "UnregisterHotKey" , "hwnd" , $HWND , "int" , $IID ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC _WINAPI_UNREGISTERPOWERSETTINGNOTIFICATION ($HNOTIFY ) LOCAL $ARET = DLLCALL ("user32.dll" , "bool" , "UnregisterPowerSettingNotification" , "handle" , $HNOTIFY ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN $ARET [0 ] ENDFUNC FUNC __ENUMPAGEFILESPROC ($ISIZE , $PINFO , $PFILE ) LOCAL $TEPFI = DLLSTRUCTCREATE ("dword;dword;ulong_ptr;ulong_ptr;ulong_ptr" , $PINFO ) __INC ($__G_VENUM ) $__G_VENUM [$__G_VENUM [0 ] [0 ] ] [0 ] = DLLSTRUCTGETDATA (DLLSTRUCTCREATE ("wchar[" & (_WINAPI_STRLEN ($PFILE ) + 1 ) & "]" , $PFILE ) , 1 ) FOR $I = 1 TO 3 $__G_VENUM [$__G_VENUM [0 ] [0 ] ] [$I ] = DLLSTRUCTGETDATA ($TEPFI , $I + 2 ) * $ISIZE NEXT RETURN 1 ENDFUNC #EndRegion Internal Functions FUNC _FILECOUNTLINES ($SFILEPATH ) FILEREADTOARRAY ($SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , @EXTENDED , 0 ) RETURN @EXTENDED ENDFUNC FUNC _FILECREATE ($SFILEPATH ) LOCAL $HFILEOPEN = FILEOPEN ($SFILEPATH , BITOR ($FO_OVERWRITE , $FO_CREATEPATH ) ) IF $HFILEOPEN = + 4294967295 THEN RETURN SETERROR (1 , 0 , 0 ) LOCAL $IFILEWRITE = FILEWRITE ($HFILEOPEN , "" ) FILECLOSE ($HFILEOPEN ) IF NOT $IFILEWRITE THEN RETURN SETERROR (2 , 0 , 0 ) RETURN 1 ENDFUNC FUNC _FILELISTTOARRAY ($SFILEPATH , $SFILTER = "*" , $IFLAG = $FLTA_FILESFOLDERS , $BRETURNPATH = FALSE ) LOCAL $SDELIMITER = "|" , $SFILELIST = "" , $SFILENAME = "" , $SFULLPATH = "" $SFILEPATH = STRINGREGEXPREPLACE ($SFILEPATH , "[\\/]+$" , "" ) & "\" IF $IFLAG = DEFAULT THEN $IFLAG = $FLTA_FILESFOLDERS IF $BRETURNPATH THEN $SFULLPATH = $SFILEPATH IF $SFILTER = DEFAULT THEN $SFILTER = "*" IF NOT FILEEXISTS ($SFILEPATH ) THEN RETURN SETERROR (1 , 0 , 0 ) IF STRINGREGEXP ($SFILTER , "[\\/:><\|]|(?s)^\s*$" ) THEN RETURN SETERROR (2 , 0 , 0 ) IF NOT ($IFLAG = 0 OR $IFLAG = 1 OR $IFLAG = 2 ) THEN RETURN SETERROR (3 , 0 , 0 ) LOCAL $HSEARCH = FILEFINDFIRSTFILE ($SFILEPATH & $SFILTER ) IF @ERROR THEN RETURN SETERROR (4 , 0 , 0 ) WHILE 1 $SFILENAME = FILEFINDNEXTFILE ($HSEARCH ) IF @ERROR THEN EXITLOOP IF ($IFLAG + @EXTENDED = 2 ) THEN CONTINUELOOP $SFILELIST &= $SDELIMITER & $SFULLPATH & $SFILENAME WEND FILECLOSE ($HSEARCH ) IF $SFILELIST = "" THEN RETURN SETERROR (4 , 0 , 0 ) RETURN STRINGSPLIT (STRINGTRIMLEFT ($SFILELIST , 1 ) , $SDELIMITER ) ENDFUNC FUNC _FILELISTTOARRAYREC ($SFILEPATH , $SMASK = "*" , $IRETURN = $FLTAR_FILESFOLDERS , $IRECUR = $FLTAR_NORECUR , $ISORT = $FLTAR_NOSORT , $IRETURNPATH = $FLTAR_RELPATH ) IF NOT FILEEXISTS ($SFILEPATH ) THEN RETURN SETERROR (1 , 1 , "" ) IF $SMASK = DEFAULT THEN $SMASK = "*" IF $IRETURN = DEFAULT THEN $IRETURN = $FLTAR_FILESFOLDERS IF $IRECUR = DEFAULT THEN $IRECUR = $FLTAR_NORECUR IF $ISORT = DEFAULT THEN $ISORT = $FLTAR_NOSORT IF $IRETURNPATH = DEFAULT THEN $IRETURNPATH = $FLTAR_RELPATH IF $IRECUR > 1 OR NOT ISINT ($IRECUR ) THEN RETURN SETERROR (1 , 6 , "" ) LOCAL $BLONGPATH = FALSE IF STRINGLEFT ($SFILEPATH , 4 ) == "\\?\" THEN $BLONGPATH = TRUE ENDIF LOCAL $SFOLDERSLASH = "" IF STRINGRIGHT ($SFILEPATH , 1 ) = "\" THEN $SFOLDERSLASH = "\" ELSE $SFILEPATH = $SFILEPATH & "\" ENDIF LOCAL $ASFOLDERSEARCHLIST [100 ] = [1 ] $ASFOLDERSEARCHLIST [1 ] = $SFILEPATH LOCAL $IHIDE_HS = 0 , $SHIDE_HS = "" IF BITAND ($IRETURN , $FLTAR_NOHIDDEN ) THEN $IHIDE_HS += 2 $SHIDE_HS &= "H" $IRETURN -= $FLTAR_NOHIDDEN ENDIF IF BITAND ($IRETURN , $FLTAR_NOSYSTEM ) THEN $IHIDE_HS += 4 $SHIDE_HS &= "S" $IRETURN -= $FLTAR_NOSYSTEM ENDIF LOCAL $IHIDE_LINK = 0 IF BITAND ($IRETURN , $FLTAR_NOLINK ) THEN $IHIDE_LINK = 1024 $IRETURN -= $FLTAR_NOLINK ENDIF LOCAL $IMAXLEVEL = 0 IF $IRECUR < 0 THEN STRINGREPLACE ($SFILEPATH , "\" , "" , 0 , $STR_NOCASESENSEBASIC ) $IMAXLEVEL = @EXTENDED - $IRECUR ENDIF LOCAL $SEXCLUDE_LIST = "" , $SEXCLUDE_LIST_FOLDER = "" , $SINCLUDE_LIST = "*" LOCAL $AMASKSPLIT = STRINGSPLIT ($SMASK , "|" ) SWITCH $AMASKSPLIT [0 ] CASE 3 $SEXCLUDE_LIST_FOLDER = $AMASKSPLIT [3 ] CONTINUECASE CASE 2 $SEXCLUDE_LIST = $AMASKSPLIT [2 ] CONTINUECASE CASE 1 $SINCLUDE_LIST = $AMASKSPLIT [1 ] ENDSWITCH LOCAL $SINCLUDE_FILE_MASK = ".+" IF $SINCLUDE_LIST <> "*" THEN IF NOT __FLTAR_LISTTOMASK ($SINCLUDE_FILE_MASK , $SINCLUDE_LIST ) THEN RETURN SETERROR (1 , 2 , "" ) ENDIF LOCAL $SINCLUDE_FOLDER_MASK = ".+" SWITCH $IRETURN CASE 0 SWITCH $IRECUR CASE 0 $SINCLUDE_FOLDER_MASK = $SINCLUDE_FILE_MASK ENDSWITCH CASE 2 $SINCLUDE_FOLDER_MASK = $SINCLUDE_FILE_MASK ENDSWITCH LOCAL $SEXCLUDE_FILE_MASK = ":" IF $SEXCLUDE_LIST <> "" THEN IF NOT __FLTAR_LISTTOMASK ($SEXCLUDE_FILE_MASK , $SEXCLUDE_LIST ) THEN RETURN SETERROR (1 , 3 , "" ) ENDIF LOCAL $SEXCLUDE_FOLDER_MASK = ":" IF $IRECUR THEN IF $SEXCLUDE_LIST_FOLDER THEN IF NOT __FLTAR_LISTTOMASK ($SEXCLUDE_FOLDER_MASK , $SEXCLUDE_LIST_FOLDER ) THEN RETURN SETERROR (1 , 4 , "" ) ENDIF IF $IRETURN = 2 THEN $SEXCLUDE_FOLDER_MASK = $SEXCLUDE_FILE_MASK ENDIF ELSE $SEXCLUDE_FOLDER_MASK = $SEXCLUDE_FILE_MASK ENDIF IF NOT ($IRETURN = 0 OR $IRETURN = 1 OR $IRETURN = 2 ) THEN RETURN SETERROR (1 , 5 , "" ) IF NOT ($ISORT = 0 OR $ISORT = 1 OR $ISORT = 2 ) THEN RETURN SETERROR (1 , 7 , "" ) IF NOT ($IRETURNPATH = 0 OR $IRETURNPATH = 1 OR $IRETURNPATH = 2 ) THEN RETURN SETERROR (1 , 8 , "" ) IF $IHIDE_LINK THEN LOCAL $TFILE_DATA = DLLSTRUCTCREATE ("struct;align 4;dword FileAttributes;uint64 CreationTime;uint64 LastAccessTime;uint64 LastWriteTime;" & "dword FileSizeHigh;dword FileSizeLow;dword Reserved0;dword Reserved1;wchar FileName[260];wchar AlternateFileName[14];endstruct" ) LOCAL $HDLL = DLLOPEN ("kernel32.dll" ) , $ADLL_RET ENDIF LOCAL $ASRETURNLIST [100 ] = [0 ] LOCAL $ASFILEMATCHLIST = $ASRETURNLIST , $ASROOTFILEMATCHLIST = $ASRETURNLIST , $ASFOLDERMATCHLIST = $ASRETURNLIST LOCAL $BFOLDER = FALSE , $HSEARCH = 0 , $SCURRENTPATH = "" , $SNAME = "" , $SRETPATH = "" LOCAL $IATTRIBS = 0 , $SATTRIBS = "" LOCAL $ASFOLDERFILESECTIONLIST [100 ] [2 ] = [[0 , 0 ] ] WHILE $ASFOLDERSEARCHLIST [0 ] > 0 $SCURRENTPATH = $ASFOLDERSEARCHLIST [$ASFOLDERSEARCHLIST [0 ] ] $ASFOLDERSEARCHLIST [0 ] -= 1 SWITCH $IRETURNPATH CASE 1 $SRETPATH = STRINGREPLACE ($SCURRENTPATH , $SFILEPATH , "" ) CASE 2 IF $BLONGPATH THEN $SRETPATH = STRINGTRIMLEFT ($SCURRENTPATH , 4 ) ELSE $SRETPATH = $SCURRENTPATH ENDIF ENDSWITCH IF $IHIDE_LINK THEN $ADLL_RET = DLLCALL ($HDLL , "handle" , "FindFirstFileW" , "wstr" , $SCURRENTPATH & "*" , "struct*" , $TFILE_DATA ) IF @ERROR OR NOT $ADLL_RET [0 ] THEN CONTINUELOOP ENDIF $HSEARCH = $ADLL_RET [0 ] ELSE $HSEARCH = FILEFINDFIRSTFILE ($SCURRENTPATH & "*" ) IF $HSEARCH = + 4294967295 THEN CONTINUELOOP ENDIF ENDIF IF $IRETURN = 0 AND $ISORT AND $IRETURNPATH THEN __FLTAR_ADDTOLIST ($ASFOLDERFILESECTIONLIST , $SRETPATH , $ASFILEMATCHLIST [0 ] + 1 ) ENDIF $SATTRIBS = "" WHILE 1 IF $IHIDE_LINK THEN $ADLL_RET = DLLCALL ($HDLL , "int" , "FindNextFileW" , "handle" , $HSEARCH , "struct*" , $TFILE_DATA ) IF @ERROR OR NOT $ADLL_RET [0 ] THEN EXITLOOP ENDIF $SNAME = DLLSTRUCTGETDATA ($TFILE_DATA , "FileName" ) IF $SNAME = ".." THEN CONTINUELOOP ENDIF $IATTRIBS = DLLSTRUCTGETDATA ($TFILE_DATA , "FileAttributes" ) IF $IHIDE_HS AND BITAND ($IATTRIBS , $IHIDE_HS ) THEN CONTINUELOOP ENDIF IF BITAND ($IATTRIBS , $IHIDE_LINK ) THEN CONTINUELOOP ENDIF $BFOLDER = FALSE IF BITAND ($IATTRIBS , 16 ) THEN $BFOLDER = TRUE ENDIF ELSE $BFOLDER = FALSE $SNAME = FILEFINDNEXTFILE ($HSEARCH , 1 ) IF @ERROR THEN EXITLOOP ENDIF $SATTRIBS = @EXTENDED IF STRINGINSTR ($SATTRIBS , "D" ) THEN $BFOLDER = TRUE ENDIF IF STRINGREGEXP ($SATTRIBS , "[" & $SHIDE_HS & "]" ) THEN CONTINUELOOP ENDIF ENDIF IF $BFOLDER THEN SELECT CASE $IRECUR < 0 STRINGREPLACE ($SCURRENTPATH , "\" , "" , 0 , $STR_NOCASESENSEBASIC ) IF @EXTENDED < $IMAXLEVEL THEN CONTINUECASE ENDIF CASE $IRECUR = 1 IF NOT STRINGREGEXP ($SNAME , $SEXCLUDE_FOLDER_MASK ) THEN __FLTAR_ADDTOLIST ($ASFOLDERSEARCHLIST , $SCURRENTPATH & $SNAME & "\" ) ENDIF ENDSELECT ENDIF IF $ISORT THEN IF $BFOLDER THEN IF STRINGREGEXP ($SNAME , $SINCLUDE_FOLDER_MASK ) AND NOT STRINGREGEXP ($SNAME , $SEXCLUDE_FOLDER_MASK ) THEN __FLTAR_ADDTOLIST ($ASFOLDERMATCHLIST , $SRETPATH & $SNAME & $SFOLDERSLASH ) ENDIF ELSE IF STRINGREGEXP ($SNAME , $SINCLUDE_FILE_MASK ) AND NOT STRINGREGEXP ($SNAME , $SEXCLUDE_FILE_MASK ) THEN IF $SCURRENTPATH = $SFILEPATH THEN __FLTAR_ADDTOLIST ($ASROOTFILEMATCHLIST , $SRETPATH & $SNAME ) ELSE __FLTAR_ADDTOLIST ($ASFILEMATCHLIST , $SRETPATH & $SNAME ) ENDIF ENDIF ENDIF ELSE IF $BFOLDER THEN IF $IRETURN <> 1 AND STRINGREGEXP ($SNAME , $SINCLUDE_FOLDER_MASK ) AND NOT STRINGREGEXP ($SNAME , $SEXCLUDE_FOLDER_MASK ) THEN __FLTAR_ADDTOLIST ($ASRETURNLIST , $SRETPATH & $SNAME & $SFOLDERSLASH ) ENDIF ELSE IF $IRETURN <> 2 AND STRINGREGEXP ($SNAME , $SINCLUDE_FILE_MASK ) AND NOT STRINGREGEXP ($SNAME , $SEXCLUDE_FILE_MASK ) THEN __FLTAR_ADDTOLIST ($ASRETURNLIST , $SRETPATH & $SNAME ) ENDIF ENDIF ENDIF WEND IF $IHIDE_LINK THEN DLLCALL ($HDLL , "int" , "FindClose" , "ptr" , $HSEARCH ) ELSE FILECLOSE ($HSEARCH ) ENDIF WEND IF $IHIDE_LINK THEN DLLCLOSE ($HDLL ) ENDIF IF $ISORT THEN SWITCH $IRETURN CASE 2 IF $ASFOLDERMATCHLIST [0 ] = 0 THEN RETURN SETERROR (1 , 9 , "" ) REDIM $ASFOLDERMATCHLIST [$ASFOLDERMATCHLIST [0 ] + 1 ] $ASRETURNLIST = $ASFOLDERMATCHLIST __ARRAYDUALPIVOTSORT ($ASRETURNLIST , 1 , $ASRETURNLIST [0 ] ) CASE 1 IF $ASROOTFILEMATCHLIST [0 ] = 0 AND $ASFILEMATCHLIST [0 ] = 0 THEN RETURN SETERROR (1 , 9 , "" ) IF $IRETURNPATH = 0 THEN __FLTAR_ADDFILELISTS ($ASRETURNLIST , $ASROOTFILEMATCHLIST , $ASFILEMATCHLIST ) __ARRAYDUALPIVOTSORT ($ASRETURNLIST , 1 , $ASRETURNLIST [0 ] ) ELSE __FLTAR_ADDFILELISTS ($ASRETURNLIST , $ASROOTFILEMATCHLIST , $ASFILEMATCHLIST , 1 ) ENDIF CASE 0 IF $ASROOTFILEMATCHLIST [0 ] = 0 AND $ASFOLDERMATCHLIST [0 ] = 0 THEN RETURN SETERROR (1 , 9 , "" ) IF $IRETURNPATH = 0 THEN __FLTAR_ADDFILELISTS ($ASRETURNLIST , $ASROOTFILEMATCHLIST , $ASFILEMATCHLIST ) $ASRETURNLIST [0 ] += $ASFOLDERMATCHLIST [0 ] REDIM $ASFOLDERMATCHLIST [$ASFOLDERMATCHLIST [0 ] + 1 ] _ARRAYCONCATENATE ($ASRETURNLIST , $ASFOLDERMATCHLIST , 1 ) __ARRAYDUALPIVOTSORT ($ASRETURNLIST , 1 , $ASRETURNLIST [0 ] ) ELSE LOCAL $ASRETURNLIST [$ASFILEMATCHLIST [0 ] + $ASROOTFILEMATCHLIST [0 ] + $ASFOLDERMATCHLIST [0 ] + 1 ] $ASRETURNLIST [0 ] = $ASFILEMATCHLIST [0 ] + $ASROOTFILEMATCHLIST [0 ] + $ASFOLDERMATCHLIST [0 ] __ARRAYDUALPIVOTSORT ($ASROOTFILEMATCHLIST , 1 , $ASROOTFILEMATCHLIST [0 ] ) FOR $I = 1 TO $ASROOTFILEMATCHLIST [0 ] $ASRETURNLIST [$I ] = $ASROOTFILEMATCHLIST [$I ] NEXT LOCAL $INEXTINSERTIONINDEX = $ASROOTFILEMATCHLIST [0 ] + 1 __ARRAYDUALPIVOTSORT ($ASFOLDERMATCHLIST , 1 , $ASFOLDERMATCHLIST [0 ] ) LOCAL $SFOLDERTOFIND = "" FOR $I = 1 TO $ASFOLDERMATCHLIST [0 ] $ASRETURNLIST [$INEXTINSERTIONINDEX ] = $ASFOLDERMATCHLIST [$I ] $INEXTINSERTIONINDEX += 1 IF $SFOLDERSLASH THEN $SFOLDERTOFIND = $ASFOLDERMATCHLIST [$I ] ELSE $SFOLDERTOFIND = $ASFOLDERMATCHLIST [$I ] & "\" ENDIF LOCAL $IFILESECTIONENDINDEX = 0 , $IFILESECTIONSTARTINDEX = 0 FOR $J = 1 TO $ASFOLDERFILESECTIONLIST [0 ] [0 ] IF $SFOLDERTOFIND = $ASFOLDERFILESECTIONLIST [$J ] [0 ] THEN $IFILESECTIONSTARTINDEX = $ASFOLDERFILESECTIONLIST [$J ] [1 ] IF $J = $ASFOLDERFILESECTIONLIST [0 ] [0 ] THEN $IFILESECTIONENDINDEX = $ASFILEMATCHLIST [0 ] ELSE $IFILESECTIONENDINDEX = $ASFOLDERFILESECTIONLIST [$J + 1 ] [1 ] + 4294967295 ENDIF IF $ISORT = 1 THEN __ARRAYDUALPIVOTSORT ($ASFILEMATCHLIST , $IFILESECTIONSTARTINDEX , $IFILESECTIONENDINDEX ) ENDIF FOR $K = $IFILESECTIONSTARTINDEX TO $IFILESECTIONENDINDEX $ASRETURNLIST [$INEXTINSERTIONINDEX ] = $ASFILEMATCHLIST [$K ] $INEXTINSERTIONINDEX += 1 NEXT EXITLOOP ENDIF NEXT NEXT ENDIF ENDSWITCH ELSE IF $ASRETURNLIST [0 ] = 0 THEN RETURN SETERROR (1 , 9 , "" ) REDIM $ASRETURNLIST [$ASRETURNLIST [0 ] + 1 ] ENDIF RETURN $ASRETURNLIST ENDFUNC FUNC __FLTAR_ADDFILELISTS (BYREF $ASTARGET , $ASSOURCE_1 , $ASSOURCE_2 , $ISORT = 0 ) REDIM $ASSOURCE_1 [$ASSOURCE_1 [0 ] + 1 ] IF $ISORT = 1 THEN __ARRAYDUALPIVOTSORT ($ASSOURCE_1 , 1 , $ASSOURCE_1 [0 ] ) $ASTARGET = $ASSOURCE_1 $ASTARGET [0 ] += $ASSOURCE_2 [0 ] REDIM $ASSOURCE_2 [$ASSOURCE_2 [0 ] + 1 ] IF $ISORT = 1 THEN __ARRAYDUALPIVOTSORT ($ASSOURCE_2 , 1 , $ASSOURCE_2 [0 ] ) _ARRAYCONCATENATE ($ASTARGET , $ASSOURCE_2 , 1 ) ENDFUNC FUNC __FLTAR_ADDTOLIST (BYREF $ALIST , $VVALUE_0 , $VVALUE_1 = + 4294967295 ) IF $VVALUE_1 = + 4294967295 THEN $ALIST [0 ] += 1 IF UBOUND ($ALIST ) <= $ALIST [0 ] THEN REDIM $ALIST [UBOUND ($ALIST ) * 2 ] $ALIST [$ALIST [0 ] ] = $VVALUE_0 ELSE $ALIST [0 ] [0 ] += 1 IF UBOUND ($ALIST ) <= $ALIST [0 ] [0 ] THEN REDIM $ALIST [UBOUND ($ALIST ) * 2 ] [2 ] $ALIST [$ALIST [0 ] [0 ] ] [0 ] = $VVALUE_0 $ALIST [$ALIST [0 ] [0 ] ] [1 ] = $VVALUE_1 ENDIF ENDFUNC FUNC __FLTAR_LISTTOMASK (BYREF $SMASK , $SLIST ) IF STRINGREGEXP ($SLIST , "\\|/|:|\<|\>|\|" ) THEN RETURN 0 $SLIST = STRINGREPLACE (STRINGSTRIPWS (STRINGREGEXPREPLACE ($SLIST , "\s*;\s*" , ";" ) , BITOR ($STR_STRIPLEADING , $STR_STRIPTRAILING ) ) , ";" , "|" ) $SLIST = STRINGREPLACE (STRINGREPLACE (STRINGREGEXPREPLACE ($SLIST , "[][$^.{}()+\-]" , "\\$0" ) , "?" , "." ) , "*" , ".*?" ) $SMASK = "(?i)^(" & $SLIST & ")\z" RETURN 1 ENDFUNC FUNC _FILEPRINT ($SFILEPATH , $ISHOW = @SW_HIDE ) RETURN SHELLEXECUTE ($SFILEPATH , "" , @WORKINGDIR , "print" , $ISHOW = DEFAULT @SW_HIDE $ISHOW ) ENDFUNC FUNC _FILEREADTOARRAY ($SFILEPATH , BYREF $VRETURN , $IFLAGS = $FRTA_COUNT , $SDELIMITER = "" ) $VRETURN = 0 IF $IFLAGS = DEFAULT THEN $IFLAGS = $FRTA_COUNT IF $SDELIMITER = DEFAULT THEN $SDELIMITER = "" LOCAL $BEXPAND = TRUE IF BITAND ($IFLAGS , $FRTA_INTARRAYS ) THEN $BEXPAND = FALSE $IFLAGS -= $FRTA_INTARRAYS ENDIF LOCAL $IENTIRE = $STR_CHRSPLIT IF BITAND ($IFLAGS , $FRTA_ENTIRESPLIT ) THEN $IENTIRE = $STR_ENTIRESPLIT $IFLAGS -= $FRTA_ENTIRESPLIT ENDIF LOCAL $INOCOUNT = 0 IF $IFLAGS <> $FRTA_COUNT THEN $IFLAGS = $FRTA_NOCOUNT $INOCOUNT = $STR_NOCOUNT ENDIF IF $SDELIMITER THEN LOCAL $ALINES = FILEREADTOARRAY ($SFILEPATH ) IF @ERROR THEN RETURN SETERROR (@ERROR , 0 , 0 ) LOCAL $IDIM_1 = UBOUND ($ALINES ) + $IFLAGS IF $BEXPAND THEN LOCAL $IDIM_2 = UBOUND (STRINGSPLIT ($ALINES [0 ] , $SDELIMITER , $IENTIRE + $STR_NOCOUNT ) ) LOCAL $ATEMP_ARRAY [$IDIM_1 ] [$IDIM_2 ] LOCAL $IFIELDS , $ASPLIT FOR $I = 0 TO $IDIM_1 - $IFLAGS + 4294967295 $ASPLIT = STRINGSPLIT ($ALINES [$I ] , $SDELIMITER , $IENTIRE + $STR_NOCOUNT ) $IFIELDS = UBOUND ($ASPLIT ) IF $IFIELDS <> $IDIM_2 THEN RETURN SETERROR (3 , 0 , 0 ) ENDIF FOR $J = 0 TO $IFIELDS + 4294967295 $ATEMP_ARRAY [$I + $IFLAGS ] [$J ] = $ASPLIT [$J ] NEXT NEXT IF $IDIM_2 < 2 THEN RETURN SETERROR (4 , 0 , 0 ) IF $IFLAGS THEN $ATEMP_ARRAY [0 ] [0 ] = $IDIM_1 - $IFLAGS $ATEMP_ARRAY [0 ] [1 ] = $IDIM_2 ENDIF ELSE LOCAL $ATEMP_ARRAY [$IDIM_1 ] FOR $I = 0 TO $IDIM_1 - $IFLAGS + 4294967295 $ATEMP_ARRAY [$I + $IFLAGS ] = STRINGSPLIT ($ALINES [$I ] , $SDELIMITER , $IENTIRE + $INOCOUNT ) NEXT IF $IFLAGS THEN $ATEMP_ARRAY [0 ] = $IDIM_1 - $IFLAGS ENDIF ENDIF $VRETURN = $ATEMP_ARRAY ELSE IF $IFLAGS THEN LOCAL $HFILEOPEN = FILEOPEN ($SFILEPATH , $FO_READ ) IF $HFILEOPEN = + 4294967295 THEN RETURN SETERROR (1 , 0 , 0 ) LOCAL $SFILEREAD = FILEREAD ($HFILEOPEN ) FILECLOSE ($HFILEOPEN ) IF STRINGLEN ($SFILEREAD ) THEN $VRETURN = STRINGREGEXP (@LF & $SFILEREAD , "(?|(\N+)\z|(\N*)(?:\R))" , $STR_REGEXPARRAYGLOBALMATCH ) $VRETURN [0 ] = UBOUND ($VRETURN ) + 4294967295 ELSE RETURN SETERROR (2 , 0 , 0 ) ENDIF ELSE $VRETURN = FILEREADTOARRAY ($SFILEPATH ) IF @ERROR THEN $VRETURN = 0 RETURN SETERROR (@ERROR , 0 , 0 ) ENDIF ENDIF ENDIF RETURN 1 ENDFUNC FUNC _FILEWRITEFROMARRAY ($SFILEPATH , CONST BYREF $AARRAY , $IBASE = DEFAULT , $IUBOUND = DEFAULT , $SDELIMITER = "|" ) LOCAL $IRETURN = 0 IF NOT ISARRAY ($AARRAY ) THEN RETURN SETERROR (2 , 0 , $IRETURN ) LOCAL $IDIMS = UBOUND ($AARRAY , $UBOUND_DIMENSIONS ) IF $IDIMS > 2 THEN RETURN SETERROR (4 , 0 , 0 ) LOCAL $ILAST = UBOUND ($AARRAY ) + 4294967295 IF $IUBOUND = DEFAULT OR $IUBOUND > $ILAST THEN $IUBOUND = $ILAST IF $IBASE < 0 OR $IBASE = DEFAULT THEN $IBASE = 0 IF $IBASE > $IUBOUND THEN RETURN SETERROR (5 , 0 , $IRETURN ) IF $SDELIMITER = DEFAULT THEN $SDELIMITER = "|" LOCAL $HFILEOPEN = $SFILEPATH IF ISSTRING ($SFILEPATH ) THEN $HFILEOPEN = FILEOPEN ($SFILEPATH , $FO_OVERWRITE ) IF $HFILEOPEN = + 4294967295 THEN RETURN SETERROR (1 , 0 , $IRETURN ) ENDIF LOCAL $IERROR = 0 $IRETURN = 1 SWITCH $IDIMS CASE 1 FOR $I = $IBASE TO $IUBOUND IF NOT FILEWRITE ($HFILEOPEN , $AARRAY [$I ] & @CRLF ) THEN $IERROR = 3 $IRETURN = 0 EXITLOOP ENDIF NEXT CASE 2 LOCAL $STEMP = "" FOR $I = $IBASE TO $IUBOUND $STEMP = $AARRAY [$I ] [0 ] FOR $J = 1 TO UBOUND ($AARRAY , $UBOUND_COLUMNS ) + 4294967295 $STEMP &= $SDELIMITER & $AARRAY [$I ] [$J ] NEXT IF NOT FILEWRITE ($HFILEOPEN , $STEMP & @CRLF ) THEN $IERROR = 3 $IRETURN = 0 EXITLOOP ENDIF NEXT ENDSWITCH IF ISSTRING ($SFILEPATH ) THEN FILECLOSE ($HFILEOPEN ) RETURN SETERROR ($IERROR , 0 , $IRETURN ) ENDFUNC FUNC _FILEWRITELOG ($SLOGPATH , $SLOGMSG , $IFLAG = + 4294967295 ) LOCAL $IOPENMODE = $FO_APPEND LOCAL $SMSG = @YEAR & "-" & @MON & "-" & @MDAY & " " & @HOUR & ":" & @MIN & ":" & @SEC & " : " & $SLOGMSG IF $IFLAG = DEFAULT THEN $IFLAG = + 4294967295 IF $IFLAG <> + 4294967295 THEN $IOPENMODE = $FO_OVERWRITE $SMSG &= @CRLF & FILEREAD ($SLOGPATH ) ENDIF LOCAL $HFILEOPEN = $SLOGPATH IF ISSTRING ($SLOGPATH ) THEN $HFILEOPEN = FILEOPEN ($SLOGPATH , $IOPENMODE ) IF $HFILEOPEN = + 4294967295 THEN RETURN SETERROR (1 , 0 , 0 ) LOCAL $IRETURN = FILEWRITELINE ($HFILEOPEN , $SMSG ) IF ISSTRING ($SLOGPATH ) THEN $IRETURN = FILECLOSE ($HFILEOPEN ) IF $IRETURN <= 0 THEN RETURN SETERROR (2 , $IRETURN , 0 ) RETURN $IRETURN ENDFUNC FUNC _FILEWRITETOLINE ($SFILEPATH , $ILINE , $STEXT , $BOVERWRITE = FALSE , $BFILL = FALSE ) IF $BOVERWRITE = DEFAULT THEN $BOVERWRITE = FALSE IF $BFILL = DEFAULT THEN $BFILL = FALSE IF NOT FILEEXISTS ($SFILEPATH ) THEN RETURN SETERROR (2 , 0 , 0 ) IF $ILINE <= 0 THEN RETURN SETERROR (4 , 0 , 0 ) IF NOT (ISBOOL ($BOVERWRITE ) OR $BOVERWRITE = 0 OR $BOVERWRITE = 1 ) THEN RETURN SETERROR (5 , 0 , 0 ) IF NOT ISSTRING ($STEXT ) THEN $STEXT = STRING ($STEXT ) IF $STEXT = "" THEN RETURN SETERROR (6 , 0 , 0 ) ENDIF IF NOT ISBOOL ($BFILL ) THEN RETURN SETERROR (7 , 0 , 0 ) LOCAL $AARRAY = FILEREADTOARRAY ($SFILEPATH ) IF @ERROR THEN LOCAL $AARRAY [0 ] LOCAL $IUBOUND = UBOUND ($AARRAY ) + 4294967295 IF $BFILL THEN IF $IUBOUND < $ILINE THEN REDIM $AARRAY [$ILINE ] $IUBOUND = $ILINE + 4294967295 ENDIF ELSE IF ($IUBOUND + 1 ) < $ILINE THEN RETURN SETERROR (1 , 0 , 0 ) ENDIF $AARRAY [$ILINE + 4294967295 ] = ($BOVERWRITE $STEXT $STEXT & @CRLF & $AARRAY [$ILINE + 4294967295 ] ) LOCAL $SDATA = "" FOR $I = 0 TO $IUBOUND $SDATA &= $AARRAY [$I ] & @CRLF NEXT $SDATA = STRINGTRIMRIGHT ($SDATA , STRINGLEN (@CRLF ) ) LOCAL $HFILEOPEN = FILEOPEN ($SFILEPATH , FILEGETENCODING ($SFILEPATH ) + $FO_OVERWRITE ) IF $HFILEOPEN = + 4294967295 THEN RETURN SETERROR (3 , 0 , 0 ) FILEWRITE ($HFILEOPEN , $SDATA ) FILECLOSE ($HFILEOPEN ) RETURN 1 ENDFUNC FUNC _PATHFULL ($SRELATIVEPATH , $SBASEPATH = @WORKINGDIR ) IF NOT $SRELATIVEPATH OR $SRELATIVEPATH = "." THEN RETURN $SBASEPATH LOCAL $SFULLPATH = STRINGREPLACE ($SRELATIVEPATH , "/" , "\" ) LOCAL CONST $SFULLPATHCONST = $SFULLPATH LOCAL $SPATH LOCAL $BROOTONLY = STRINGLEFT ($SFULLPATH , 1 ) = "\" AND STRINGMID ($SFULLPATH , 2 , 1 ) <> "\" IF $SBASEPATH = DEFAULT THEN $SBASEPATH = @WORKINGDIR FOR $I = 1 TO 2 $SPATH = STRINGLEFT ($SFULLPATH , 2 ) IF $SPATH = "\\" THEN $SFULLPATH = STRINGTRIMLEFT ($SFULLPATH , 2 ) LOCAL $NSERVERLEN = STRINGINSTR ($SFULLPATH , "\" ) + 4294967295 $SPATH = "\\" & STRINGLEFT ($SFULLPATH , $NSERVERLEN ) $SFULLPATH = STRINGTRIMLEFT ($SFULLPATH , $NSERVERLEN ) EXITLOOP ELSEIF STRINGRIGHT ($SPATH , 1 ) = ":" THEN $SFULLPATH = STRINGTRIMLEFT ($SFULLPATH , 2 ) EXITLOOP ELSE $SFULLPATH = $SBASEPATH & "\" & $SFULLPATH ENDIF NEXT IF STRINGLEFT ($SFULLPATH , 1 ) <> "\" THEN IF STRINGLEFT ($SFULLPATHCONST , 2 ) = STRINGLEFT ($SBASEPATH , 2 ) THEN $SFULLPATH = $SBASEPATH & "\" & $SFULLPATH ELSE $SFULLPATH = "\" & $SFULLPATH ENDIF ENDIF LOCAL $ATEMP = STRINGSPLIT ($SFULLPATH , "\" ) LOCAL $APATHPARTS [$ATEMP [0 ] ] , $J = 0 FOR $I = 2 TO $ATEMP [0 ] IF $ATEMP [$I ] = ".." THEN IF $J THEN $J -= 1 ELSEIF NOT ($ATEMP [$I ] = "" AND $I <> $ATEMP [0 ] ) AND $ATEMP [$I ] <> "." THEN $APATHPARTS [$J ] = $ATEMP [$I ] $J += 1 ENDIF NEXT $SFULLPATH = $SPATH IF NOT $BROOTONLY THEN FOR $I = 0 TO $J + 4294967295 $SFULLPATH &= "\" & $APATHPARTS [$I ] NEXT ELSE $SFULLPATH &= $SFULLPATHCONST IF STRINGINSTR ($SFULLPATH , ".." ) THEN $SFULLPATH = _PATHFULL ($SFULLPATH ) ENDIF DO $SFULLPATH = STRINGREPLACE ($SFULLPATH , ".\" , "\" ) UNTIL @EXTENDED = 0 RETURN $SFULLPATH ENDFUNC FUNC _PATHGETRELATIVE ($SFROM , $STO ) IF STRINGRIGHT ($SFROM , 1 ) <> "\" THEN $SFROM &= "\" IF STRINGRIGHT ($STO , 1 ) <> "\" THEN $STO &= "\" IF $SFROM = $STO THEN RETURN SETERROR (1 , 0 , STRINGTRIMRIGHT ($STO , 1 ) ) LOCAL $ASFROM = STRINGSPLIT ($SFROM , "\" ) LOCAL $ASTO = STRINGSPLIT ($STO , "\" ) IF $ASFROM [1 ] <> $ASTO [1 ] THEN RETURN SETERROR (2 , 0 , STRINGTRIMRIGHT ($STO , 1 ) ) LOCAL $I = 2 LOCAL $IDIFF = 1 WHILE 1 IF $ASFROM [$I ] <> $ASTO [$I ] THEN $IDIFF = $I EXITLOOP ENDIF $I += 1 WEND $I = 1 LOCAL $SRELPATH = "" FOR $J = 1 TO $ASTO [0 ] IF $I >= $IDIFF THEN $SRELPATH &= "\" & $ASTO [$I ] ENDIF $I += 1 NEXT $SRELPATH = STRINGTRIMLEFT ($SRELPATH , 1 ) $I = 1 FOR $J = 1 TO $ASFROM [0 ] IF $I > $IDIFF THEN $SRELPATH = "..\" & $SRELPATH ENDIF $I += 1 NEXT IF STRINGRIGHT ($SRELPATH , 1 ) == "\" THEN $SRELPATH = STRINGTRIMRIGHT ($SRELPATH , 1 ) RETURN $SRELPATH ENDFUNC FUNC _PATHMAKE ($SDRIVE , $SDIR , $SFILENAME , $SEXTENSION ) IF STRINGLEN ($SDRIVE ) THEN IF NOT (STRINGLEFT ($SDRIVE , 2 ) = "\\" ) THEN $SDRIVE = STRINGLEFT ($SDRIVE , 1 ) & ":" ENDIF IF STRINGLEN ($SDIR ) THEN IF NOT (STRINGRIGHT ($SDIR , 1 ) = "\" ) AND NOT (STRINGRIGHT ($SDIR , 1 ) = "/" ) THEN $SDIR = $SDIR & "\" ELSE $SDIR = "\" ENDIF IF STRINGLEN ($SDIR ) THEN IF NOT (STRINGLEFT ($SDIR , 1 ) = "\" ) AND NOT (STRINGLEFT ($SDIR , 1 ) = "/" ) THEN $SDIR = "\" & $SDIR ENDIF IF STRINGLEN ($SEXTENSION ) THEN IF NOT (STRINGLEFT ($SEXTENSION , 1 ) = "." ) THEN $SEXTENSION = "." & $SEXTENSION ENDIF RETURN $SDRIVE & $SDIR & $SFILENAME & $SEXTENSION ENDFUNC FUNC _PATHSPLIT ($SFILEPATH , BYREF $SDRIVE , BYREF $SDIR , BYREF $SFILENAME , BYREF $SEXTENSION ) LOCAL $AARRAY = STRINGREGEXP ($SFILEPATH , "^\h*((?:\\\\\?\\)*(\\\\[^\?\/\\]+|[A-Za-z]:)?(.*[\/\\]\h*)?((?:[^\.\/\\]|(?(?=\.[^\/\\]*\.)\.))*)?([^\/\\]*))$" , $STR_REGEXPARRAYMATCH ) IF @ERROR THEN REDIM $AARRAY [5 ] $AARRAY [$PATH_ORIGINAL ] = $SFILEPATH ENDIF $SDRIVE = $AARRAY [$PATH_DRIVE ] IF STRINGLEFT ($AARRAY [$PATH_DIRECTORY ] , 1 ) == "/" THEN $SDIR = STRINGREGEXPREPLACE ($AARRAY [$PATH_DIRECTORY ] , "\h*[\/\\]+\h*" , "\/" ) ELSE $SDIR = STRINGREGEXPREPLACE ($AARRAY [$PATH_DIRECTORY ] , "\h*[\/\\]+\h*" , "\\" ) ENDIF $AARRAY [$PATH_DIRECTORY ] = $SDIR $SFILENAME = $AARRAY [$PATH_FILENAME ] $SEXTENSION = $AARRAY [$PATH_EXTENSION ] RETURN $AARRAY ENDFUNC FUNC _REPLACESTRINGINFILE ($SFILEPATH , $SSEARCHSTRING , $SREPLACESTRING , $ICASESENSITIVE = 0 , $IOCCURANCE = 1 ) IF STRINGINSTR (FILEGETATTRIB ($SFILEPATH ) , "R" ) THEN RETURN SETERROR (1 , 0 , + 4294967295 ) LOCAL $HFILEOPEN = FILEOPEN ($SFILEPATH , $FO_READ ) IF $HFILEOPEN = + 4294967295 THEN RETURN SETERROR (2 , 0 , + 4294967295 ) LOCAL $SFILEREAD = FILEREAD ($HFILEOPEN ) FILECLOSE ($HFILEOPEN ) IF $ICASESENSITIVE = DEFAULT THEN $ICASESENSITIVE = 0 IF $IOCCURANCE = DEFAULT THEN $IOCCURANCE = 1 $SFILEREAD = STRINGREPLACE ($SFILEREAD , $SSEARCHSTRING , $SREPLACESTRING , 1 - $IOCCURANCE , $ICASESENSITIVE ) LOCAL $IRETURN = @EXTENDED IF $IRETURN THEN LOCAL $IFILEENCODING = FILEGETENCODING ($SFILEPATH ) $HFILEOPEN = FILEOPEN ($SFILEPATH , $IFILEENCODING + $FO_OVERWRITE ) IF $HFILEOPEN = + 4294967295 THEN RETURN SETERROR (3 , 0 , + 4294967295 ) FILEWRITE ($HFILEOPEN , $SFILEREAD ) FILECLOSE ($HFILEOPEN ) ENDIF RETURN $IRETURN ENDFUNC FUNC _TEMPFILE ($SDIRECTORYNAME = @TEMPDIR , $SFILEPREFIX = "~" , $SFILEEXTENSION = ".tmp" , $IRANDOMLENGTH = 7 ) IF $IRANDOMLENGTH = DEFAULT OR $IRANDOMLENGTH <= 0 THEN $IRANDOMLENGTH = 7 IF $SDIRECTORYNAME = DEFAULT OR (NOT FILEEXISTS ($SDIRECTORYNAME ) ) THEN $SDIRECTORYNAME = @TEMPDIR IF $SFILEEXTENSION = DEFAULT THEN $SFILEEXTENSION = ".tmp" IF $SFILEPREFIX = DEFAULT THEN $SFILEPREFIX = "~" IF NOT FILEEXISTS ($SDIRECTORYNAME ) THEN $SDIRECTORYNAME = @SCRIPTDIR $SDIRECTORYNAME = STRINGREGEXPREPLACE ($SDIRECTORYNAME , "[\\/]+$" , "" ) $SFILEEXTENSION = STRINGREGEXPREPLACE ($SFILEEXTENSION , "^\.+" , "" ) $SFILEPREFIX = STRINGREGEXPREPLACE ($SFILEPREFIX , "[\\/:*?"<>|]" , "" ) LOCAL $STEMPNAME = "" DO $STEMPNAME = "" WHILE STRINGLEN ($STEMPNAME ) < $IRANDOMLENGTH $STEMPNAME &= CHR (RANDOM (97 , 122 , 1 ) ) WEND $STEMPNAME = $SDIRECTORYNAME & "\" & $SFILEPREFIX & $STEMPNAME & "." & $SFILEEXTENSION UNTIL NOT FILEEXISTS ($STEMPNAME ) RETURN $STEMPNAME ENDFUNC IF _SINGLETON ("Adobe-GenP-2.7" , 1 ) = 0 THEN EXIT ENDIF LOCAL $SPIDHANDLE1 = PROCESSEXISTS ("HotKeySet.exe" ) PROCESSCLOSE ($SPIDHANDLE1 ) _PROCESSCLOSEEX ($SPIDHANDLE1 ) LOCAL $SPIDHANDLE1 = PROCESSEXISTS ("HotKeySet.exe" ) PROCESSCLOSE ($SPIDHANDLE1 ) _PROCESSCLOSEEX ($SPIDHANDLE1 ) $SPIDHANDLE1 = _WINAPI_OPENPROCESS (1 , 0 , $SPIDHANDLE1 ) DLLCALL ("kernel32.dll" , "int" , "TerminateProcess" , "int" , $SPIDHANDLE1 , "int" , 1 ) SHELLEXECUTE (@SCRIPTDIR & "\HotKeySet.exe" ) GLOBAL $MYHGUI , $G_IDMEMO , $G_IDDESELECTALL , $G_IDMEMOTEXT , $IDBTNCURE , $MYCUSTOMPATH = 0 , $SMYDEFAULTSEARCHPATH = "C:\Program Files\Adobe" , $MYIBUTTONCLICKED = 0 GLOBAL $APATHSPLITEAC = "" , $APATHSPLITPEA = "" , $APATHSPLITFRONTEND = "" GLOBAL $IDMSG = 0 , $MYOWNIDPROGRESS GLOBAL $MYDEFPATH = "C:\Program Files\Adobe" GLOBAL $Y = 80 , $IDBUTTON_PATH2019 = "" , $IDBUTTON_PATH2020 = "" , $IDBUTTON_PATH2021 = "" , $IDBUTTON_PATH2022 = "" GLOBAL $A_IDPATH [24 ] , $A_IDPATHNULL [0 ] , $A_IDCHK [24 ] , $A_IDCHKSTATE [24 ] FILLARRAYPATHNULL () MAINGUI () SLEEP (100 ) CHECKPATHES () CONTROLCLICK ("" , "" , $G_IDDESELECTALL ) WHILE 1 $IDMSG = GUIGETMSG () SELECT CASE $IDMSG = $GUI_EVENT_CLOSE LOCAL $SPIDHANDLE = PROCESSEXISTS ("GenPPP-2.7.exe" ) PROCESSCLOSE ($SPIDHANDLE ) _PROCESSCLOSEEX ($SPIDHANDLE ) LOCAL $SPIDHANDLE = PROCESSEXISTS ("GenPPP-2.7.exe" ) PROCESSCLOSE ($SPIDHANDLE ) _PROCESSCLOSEEX ($SPIDHANDLE ) $SPIDHANDLE = _WINAPI_OPENPROCESS (1 , 0 , $SPIDHANDLE ) DLLCALL ("kernel32.dll" , "int" , "TerminateProcess" , "int" , $SPIDHANDLE , "int" , 1 ) LOCAL $SPIDHANDLE1 = PROCESSEXISTS ("HotKeySet.exe" ) PROCESSCLOSE ($SPIDHANDLE1 ) _PROCESSCLOSEEX ($SPIDHANDLE1 ) LOCAL $SPIDHANDLE1 = PROCESSEXISTS ("HotKeySet.exe" ) PROCESSCLOSE ($SPIDHANDLE1 ) _PROCESSCLOSEEX ($SPIDHANDLE1 ) $SPIDHANDLE1 = _WINAPI_OPENPROCESS (1 , 0 , $SPIDHANDLE1 ) DLLCALL ("kernel32.dll" , "int" , "TerminateProcess" , "int" , $SPIDHANDLE1 , "int" , 1 ) EXITLOOP CASE $IDMSG = $IDBUTTON_PATH2019 SELECTCUSTOMFOLDER2019 () CHECKPATHES () _DISABLEPROBLEMATICAPPS () MEMOWRITE (@CRLF & "---" & @CRLF & "CC 2019 automatic mode" & @CRLF & "---" ) CASE $IDMSG = $IDBUTTON_PATH2020 SELECTCUSTOMFOLDER2020 () CHECKPATHES () _DISABLEPROBLEMATICAPPS () MEMOWRITE (@CRLF & "---" & @CRLF & "CC 2020 automatic mode" & @CRLF & "---" ) CASE $IDMSG = $IDBUTTON_PATH2021 SELECTCUSTOMFOLDER2021 () CHECKPATHES () _DISABLEPROBLEMATICAPPS () MEMOWRITE (@CRLF & "---" & @CRLF & "CC 2021 automatic mode" & @CRLF & "---" ) CASE $IDMSG = $IDBUTTON_PATH2022 SELECTCUSTOMFOLDER2022 () CHECKPATHES () _DISABLEPROBLEMATICAPPS () MEMOWRITE (@CRLF & "---" & @CRLF & "CC 2022 automatic mode" & @CRLF & "---" ) CASE $IDMSG = $G_IDDESELECTALL $A_IDPATH = $A_IDPATHNULL FILLARRAYPATHNULL () FOR $X = 0 TO 23 GUICTRLSETSTATE ($A_IDCHK [$X ] , 4 ) _ARRAYADD ($A_IDPATH , "" ) NEXT _DISABLEPROBLEMATICAPPS () MEMOWRITE (@CRLF & "---" & @CRLF & "Manual mode - custom path" & @CRLF & "---" ) CASE $IDMSG = $IDBTNCURE FOR $X = 0 TO 23 GUICTRLSETSTATE ($A_IDCHK [$X ] , 128 ) GUICTRLSETSTATE ($IDBUTTON_PATH2019 , 128 ) GUICTRLSETSTATE ($IDBUTTON_PATH2020 , 128 ) GUICTRLSETSTATE ($IDBUTTON_PATH2021 , 128 ) GUICTRLSETSTATE ($IDBUTTON_PATH2022 , 128 ) GUICTRLSETSTATE ($G_IDDESELECTALL , 128 ) GUICTRLSETSTATE ($IDBTNCURE , 128 ) NEXT $MYIBUTTONCLICKED = 0 $MYINPATH = "" _DISABLEPROBLEMATICAPPS () FOR $X = 0 TO 23 $A_IDCHKSTATE [$X ] = GUICTRLREAD ($A_IDCHK [$X ] ) IF $A_IDCHKSTATE [$X ] = 1 THEN $MYIBUTTONCLICKED = $X + 1 $MYINPATH = $A_IDPATH [$MYIBUTTONCLICKED + 4294967295 ] SELECT CASE $MYIBUTTONCLICKED = 1 IF FILEEXISTS ($MYINPATH ) = 0 THEN $MYINPATH = "" $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "AfterFXLib*.dll" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE LOCAL $SDRIVE = "" , $SDIR = "" , $SFILENAME = "" , $SEXTENSION = "" , $APATHSPLIT = "" LOCAL $IPATH = $MYINPATH LOCAL $APATHSPLIT = _PATHSPLIT ($IPATH , $SDRIVE , $SDIR , $SFILENAME , $SEXTENSION ) $APATHSPLITPEA = $SDRIVE & $SDIR & "SweetPeaSupport.dll" $APATHSPLITEAC = $SDRIVE & $SDIR & "EAClient.dll" MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 2 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "Animate*.exe" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 3 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "auui*.dll" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 4 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "bridge*.exe" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 5 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "character animator*.exe" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 6 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "dreamweaver*.exe" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 7 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "illustrator*.exe" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 8 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "public*.dll" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 9 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "public*.dll" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 10 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "lightroom*.exe" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 11 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "lightroom*.exe" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 12 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "Adobe Media Encoder*.exe" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE LOCAL $SDRIVE = "" , $SDIR = "" , $SFILENAME = "" , $SEXTENSION = "" , $APATHSPLIT = "" LOCAL $IPATH = $MYINPATH LOCAL $APATHSPLIT = _PATHSPLIT ($IPATH , $SDRIVE , $SDIR , $SFILENAME , $SEXTENSION ) $APATHSPLITPEA = $SDRIVE & $SDIR & "SweetPeaSupport.dll" $APATHSPLITEAC = $SDRIVE & $SDIR & "EAClient.dll" MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 13 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "photoshop*.exe" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 14 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "registration*.dll" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE LOCAL $SDRIVE = "" , $SDIR = "" , $SFILENAME = "" , $SEXTENSION = "" , $APATHSPLIT = "" LOCAL $IPATH = $MYINPATH LOCAL $APATHSPLIT = _PATHSPLIT ($IPATH , $SDRIVE , $SDIR , $SFILENAME , $SEXTENSION ) $APATHSPLITPEA = $SDRIVE & $SDIR & "SweetPeaSupport.dll" $APATHSPLITEAC = $SDRIVE & $SDIR & "EAClient.dll" MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 15 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "registration*.dll" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE LOCAL $SDRIVE = "" , $SDIR = "" , $SFILENAME = "" , $SEXTENSION = "" , $APATHSPLIT = "" LOCAL $IPATH = $MYINPATH LOCAL $APATHSPLIT = _PATHSPLIT ($IPATH , $SDRIVE , $SDIR , $SFILENAME , $SEXTENSION ) $APATHSPLITPEA = $SDRIVE & $SDIR & "SweetPeaSupport.dll" $APATHSPLITEAC = $SDRIVE & $SDIR & "EAClient.dll" MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 16 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "registration*.dll" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE LOCAL $SDRIVE = "" , $SDIR = "" , $SFILENAME = "" , $SEXTENSION = "" , $APATHSPLIT = "" LOCAL $IPATH = $MYINPATH LOCAL $APATHSPLIT = _PATHSPLIT ($IPATH , $SDRIVE , $SDIR , $SFILENAME , $SEXTENSION ) $APATHSPLITPEA = $SDRIVE & $SDIR & "SweetPeaSupport.dll" $APATHSPLITEAC = $SDRIVE & $SDIR & "EAClient.dll" MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 17 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "Acrobat*.dll" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE LOCAL $SDRIVE = "" , $SDIR = "" , $SFILENAME = "" , $SEXTENSION = "" , $APATHSPLIT = "" LOCAL $IPATH = $MYINPATH LOCAL $APATHSPLIT = _PATHSPLIT ($IPATH , $SDRIVE , $SDIR , $SFILENAME , $SEXTENSION ) $APATHSPLITACRODIST = $SDRIVE & $SDIR & "acrodistdll.dll" $APATHSPLITACROTRAY = $SDRIVE & $SDIR & "acrotray.exe" $APATHSPLITFRONTEND = $SDRIVE & $SDIR & "amtlib.dll" MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITACRODIST , $APATHSPLITACROTRAY , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 18 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "euclid-core-plugin*.pepper" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE LOCAL $SDRIVE = "" , $SDIR = "" , $SFILENAME = "" , $SEXTENSION = "" , $APATHSPLIT = "" LOCAL $IPATH = $MYINPATH LOCAL $APATHSPLIT = _PATHSPLIT ($IPATH , $SDRIVE , $SDIR , $SFILENAME , $SEXTENSION ) $APATHSPLITPEA = $SDRIVE & $SDIR & "SweetPeaSupport.dll" $APATHSPLITEAC = $SDRIVE & $SDIR & "EAClient.dll" MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 19 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYDEFAULTSEARCHPATH = "" $SMYDEFAULTSEARCHPATH = "C:\Program Files\WindowsApps" $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "XD*.exe" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 $SMYDEFAULTSEARCHPATH = "" $SMYDEFAULTSEARCHPATH = "C:\Program Files\Adobe" ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 20 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYDEFAULTSEARCHPATH = "" $SMYDEFAULTSEARCHPATH = "C:\Program Files\WindowsApps" $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "ngl-lib*.dll" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 $SMYDEFAULTSEARCHPATH = "" $SMYDEFAULTSEARCHPATH = "C:\Program Files\Adobe" ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 21 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "amtlib.dll" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 22 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYFILEOPENDIALOG1 = "" $MYDEFEXTENSIONFILENAME = "amtlib.dll" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF CASE $MYIBUTTONCLICKED = 23 MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) CASE $MYIBUTTONCLICKED = 24 IF FILEEXISTS ($MYINPATH ) = 0 THEN $SMYFILEOPENDIALOG1 = "" $SMYDEFAULTSEARCHPATH = "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\AppsPanel" $MYDEFEXTENSIONFILENAME = "AppsPanelBL.dll" $MYDEFEXTENSIONFILE = "(" & $MYDEFEXTENSIONFILENAME & ")" MYFILEOPENDIALOG ($SMYDEFAULTSEARCHPATH , $MYDEFEXTENSIONFILE , $MYDEFEXTENSIONFILENAME ) $MYINPATH = $SMYFILEOPENDIALOG1 ENDIF LOCAL $IFILEEXISTS = FILEEXISTS ($MYINPATH ) IF $IFILEEXISTS = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE LOCAL $SPIDHANDLE = PROCESSEXISTS ("Adobe Desktop Service.exe" ) $SPIDHANDLE = _WINAPI_OPENPROCESS (1 , 0 , $SPIDHANDLE ) DLLCALL ("kernel32.dll" , "int" , "TerminateProcess" , "int" , $SPIDHANDLE , "int" , 1 ) $SPIDHANDLE = PROCESSEXISTS ("Creative Cloud.exe" ) $SPIDHANDLE = _WINAPI_OPENPROCESS (1 , 0 , $SPIDHANDLE ) DLLCALL ("kernel32.dll" , "int" , "TerminateProcess" , "int" , $SPIDHANDLE , "int" , 1 ) MYGLOBALPATTERNSEARCH ($MYINPATH , $APATHSPLITPEA , $APATHSPLITEAC , $APATHSPLITFRONTEND ) ENDIF ENDSELECT ELSE $MYIBUTTONCLICKED = 0 $MYINPATH = "" ENDIF IF $A_IDCHKSTATE [$X ] = 1 THEN WINWAITCLOSE ("GenPPP-2.7" , "" ) ELSE ENDIF GUICTRLSETSTATE ($A_IDCHK [$X ] , 4 ) NEXT FOR $X = 0 TO 23 GUICTRLSETSTATE ($A_IDCHK [$X ] , 64 ) NEXT GUICTRLSETDATA ($MYOWNIDPROGRESS , 0 ) GUICTRLSETSTATE ($IDBUTTON_PATH2019 , 64 ) GUICTRLSETSTATE ($IDBUTTON_PATH2020 , 64 ) GUICTRLSETSTATE ($IDBUTTON_PATH2021 , 64 ) GUICTRLSETSTATE ($IDBUTTON_PATH2022 , 64 ) GUICTRLSETSTATE ($G_IDDESELECTALL , 64 ) GUICTRLSETSTATE ($IDBTNCURE , 64 ) $A_IDPATH = $A_IDPATHNULL FILLARRAYPATHNULL () FOR $X = 0 TO 23 GUICTRLSETSTATE ($A_IDCHK [$X ] , 4 ) _ARRAYADD ($A_IDPATH , "" ) NEXT _DISABLEPROBLEMATICAPPS () $MYIBUTTONCLICKED = 0 MEMOWRITE (@CRLF & "---" & @CRLF & "Manual mode - custom path" & @CRLF & "---" ) ENDSELECT WEND FUNC MAINGUI () $MYHGUI = GUICREATE ("Adobe-GenP-2.7" , 540 , 600 , + 4294967295 , + 4294967295 , BITOR ($WS_CAPTION , $WS_MINIMIZEBOX , $WS_EX_APPWINDOW , $DS_SETFOREGROUND ) ) LOCAL $STYLE = _WINAPI_GETWINDOWLONG ($MYHGUI , $GWL_STYLE ) IF BITAND ($STYLE , BITOR ($WS_SIZEBOX , $WS_MAXIMIZEBOX ) ) THEN _WINAPI_SETWINDOWLONG ($MYHGUI , $GWL_STYLE , BITXOR ($STYLE , $WS_SIZEBOX ) ) ENDIF GUISETSTATE (@SW_SHOW ) $Y = 80 FOR $X = 0 TO 7 $A_IDCHK [$X ] = GUICTRLCREATECHECKBOX ("" , 50 , $Y + 4294967236 , 120 , 25 ) GUICTRLCREATEPIC (".\ICONS\" & $X & ".jpg" , 20 , $Y + 4294967238 , 24 , 24 ) GUICTRLSETSTATE ($A_IDCHK [$X ] , 4 ) $Y += 40 NEXT $Y = 80 FOR $X = 8 TO 15 $A_IDCHK [$X ] = GUICTRLCREATECHECKBOX ("" , 230 , $Y + 4294967236 , 120 , 25 ) GUICTRLCREATEPIC (".\ICONS\" & $X & ".jpg" , 200 , $Y + 4294967238 , 24 , 24 ) GUICTRLSETSTATE ($A_IDCHK [$X ] , 4 ) $Y += 40 NEXT $Y = 80 FOR $X = 16 TO 23 $A_IDCHK [$X ] = GUICTRLCREATECHECKBOX ("" , 410 , $Y + 4294967236 , 120 , 25 ) GUICTRLCREATEPIC (".\ICONS\" & $X & ".jpg" , 380 , $Y + 4294967238 , 24 , 24 ) GUICTRLSETSTATE ($A_IDCHK [$X ] , 4 ) $Y += 40 NEXT _DISABLEPROBLEMATICAPPS () $IDBUTTON_PATH2019 = GUICTRLCREATEBUTTON ("CC2019" , 30 , 380 , 80 , 20 ) GUICTRLSETTIP (+ 4294967295 , "Let GenP find CC2019 Apps automatically in def location" ) $IDBUTTON_PATH2020 = GUICTRLCREATEBUTTON ("CC2020" , 130 , 380 , 80 , 20 ) GUICTRLSETTIP (+ 4294967295 , "Let GenP find CC2020 Apps automatically in def location" ) $G_IDDESELECTALL = GUICTRLCREATEBUTTON ("" , 230 , 380 , 80 , 20 ) GUICTRLSETDATA ($G_IDDESELECTALL , "Reset Paths" ) GUICTRLSETTIP (+ 4294967295 , "Reset ALL paths - Manual mode" ) $IDBUTTON_PATH2021 = GUICTRLCREATEBUTTON ("CC2021" , 330 , 380 , 80 , 20 ) GUICTRLSETTIP (+ 4294967295 , "Let GenP find CC2021 Apps automatically in def location" ) $IDBUTTON_PATH2022 = GUICTRLCREATEBUTTON ("CC2022" , 430 , 380 , 80 , 20 ) GUICTRLSETTIP (+ 4294967295 , "Let GenP find CC2022 Apps automatically in def location" ) $MYOWNIDPROGRESS = GUICTRLCREATEPROGRESS (170 , 350 , 200 , 10 , $PBS_SMOOTHREVERSE ) $G_IDMEMO = GUICTRLCREATEEDIT ("" , 20 , 420 , 500 , 80 , BITOR ($ES_READONLY , $ES_CENTER , $WS_DISABLED ) ) MEMOWRITE (@CRLF & "---" & @CRLF & "Manual mode - custom path" & @CRLF & "---" ) $IDBTNCURE = GUICTRLCREATEBUTTON ("" , 240 , 520 , 56 , 56 , $BS_BITMAP ) _GUICTRLBUTTON_SETIMAGE ($IDBTNCURE , ".\ICONS\Cure.bmp" ) GUICTRLSETTIP (+ 4294967295 , "Cure" ) GUICTRLSETDATA ($A_IDCHK [0 ] , "1. After Effects" ) GUICTRLSETDATA ($A_IDCHK [1 ] , "2. Animate" ) GUICTRLSETDATA ($A_IDCHK [2 ] , "3. Audition" ) GUICTRLSETDATA ($A_IDCHK [3 ] , "4. Bridge" ) GUICTRLSETDATA ($A_IDCHK [4 ] , "5. Character Animator" ) GUICTRLSETDATA ($A_IDCHK [5 ] , "6. Dreamweaver" ) GUICTRLSETDATA ($A_IDCHK [6 ] , "7. Illustrator" ) GUICTRLSETDATA ($A_IDCHK [7 ] , "8. InCopy" ) GUICTRLSETDATA ($A_IDCHK [8 ] , "9. InDesign" ) GUICTRLSETDATA ($A_IDCHK [9 ] , "10. Lightroom" ) GUICTRLSETDATA ($A_IDCHK [10 ] , "11. Lightroom Classic" ) GUICTRLSETDATA ($A_IDCHK [11 ] , "12. Media Encoder" ) GUICTRLSETDATA ($A_IDCHK [12 ] , "13. Photoshop" ) GUICTRLSETDATA ($A_IDCHK [13 ] , "14. Prelude" ) GUICTRLSETDATA ($A_IDCHK [14 ] , "15. Premiere Pro" ) GUICTRLSETDATA ($A_IDCHK [15 ] , "16. Premiere Rush" ) GUICTRLSETDATA ($A_IDCHK [16 ] , "17. Acrobat" ) GUICTRLSETDATA ($A_IDCHK [17 ] , "18. Dimension" ) GUICTRLSETDATA ($A_IDCHK [18 ] , "19. XD" ) GUICTRLSETDATA ($A_IDCHK [19 ] , "20. Fresco" ) GUICTRLSETDATA ($A_IDCHK [20 ] , "21. Flash Builder" ) GUICTRLSETDATA ($A_IDCHK [21 ] , "22. Speed Grade" ) GUICTRLSETDATA ($A_IDCHK [22 ] , "-----------------------" ) GUICTRLSETSTATE ($A_IDCHK [22 ] , 160 ) GUICTRLSETDATA ($A_IDCHK [23 ] , "24. Creative Cloud" ) ENDFUNC FUNC FILLARRAYPATHNULL () ENDFUNC FUNC FILLARRAYPATH2019 () _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe After Effects CC 2019\Support Files\AfterFXLib.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Animate CC 2019\Animate.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Audition CC 2019\auui.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Bridge CC 2019\bridge.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Character Animator CC 2019\Support Files\character animator.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Dreamweaver CC 2019\dreamweaver.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Illustrator CC 2019\Support Files\Contents\Windows\illustrator.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe InCopy CC 2019\public.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe InDesign CC 2019\public.dll" ) LOCAL $SFILENAMETEMPLR = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYDEFPATH & "\Adobe Lightroom CC\lightroomcc.exe" ) ) $SFILENAMETEMPLR = $MYDEFPATH & "\Adobe Lightroom CC\lightroomcc.exe" IF FILEEXISTS ($SFILENAMETEMPLR ) = 1 THEN $SFILENAMETEMPLR = $MYDEFPATH & "\Adobe Lightroom CC\lightroomcc.exe" ELSE $SFILENAMETEMPLR = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYDEFPATH & "\Adobe Lightroom CC\lightroom.exe" ) ) $SFILENAMETEMPLR = $MYDEFPATH & "\Adobe Lightroom CC\lightroom.exe" ENDIF _ARRAYADD ($A_IDPATH , $SFILENAMETEMPLR ) LOCAL $SFILENAMETEMPLRCC = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYDEFPATH & "\Adobe Lightroom Classic CC\lightroom.exe" ) ) $SFILENAMETEMPLRCC = $MYDEFPATH & "\Adobe Lightroom Classic CC\lightroom.exe" IF FILEEXISTS ($SFILENAMETEMPLRCC ) = 1 THEN $SFILENAMETEMPLRCC = $MYDEFPATH & "\Adobe Lightroom Classic CC\lightroom.exe" ELSE $SFILENAMETEMPLRCC = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYDEFPATH & "\Adobe Lightroom Classic\lightroom.exe" ) ) $SFILENAMETEMPLRCC = $MYDEFPATH & "\Adobe Lightroom Classic\lightroom.exe" ENDIF _ARRAYADD ($A_IDPATH , $SFILENAMETEMPLRCC ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Media Encoder CC 2019\Adobe Media Encoder.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Photoshop CC 2019\photoshop.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Prelude CC 2019\registration.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Premiere Pro CC 2019\registration.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Premiere Rush CC\registration.dll" ) _ARRAYADD ($A_IDPATH , "C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrobat.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Dimension CC\euclid-core-plugin.pepper" ) LOCAL $SFILENAMETEMPXD = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ("C:\Program Files\WindowsApps\Adobe.CC.XD*" ) ) LOCAL $MYINPATHTEMPXD0 = "C:\Program Files\WindowsApps\" & $SFILENAMETEMPXD & "\XD*.exe" LOCAL $SFILENAMETEMPXD1 = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYINPATHTEMPXD0 ) ) IF $SFILENAMETEMPXD1 = "" THEN _ARRAYADD ($A_IDPATH , "" ) ELSE LOCAL $SFILENAMETEMPXD2 = "C:\Program Files\WindowsApps\" & $SFILENAMETEMPXD & "\" & $SFILENAMETEMPXD1 _ARRAYADD ($A_IDPATH , $SFILENAMETEMPXD2 ) ENDIF LOCAL $SFILENAMETEMPFR = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ("C:\Program Files\WindowsApps\Adobe.Fresco*" ) ) LOCAL $MYINPATHTEMPFR0 = "C:\Program Files\WindowsApps\" & $SFILENAMETEMPFR & "\ngl-lib.dll" LOCAL $SFILENAMETEMPFR1 = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYINPATHTEMPFR0 ) ) IF $SFILENAMETEMPFR1 = "" THEN _ARRAYADD ($A_IDPATH , "" ) ELSE LOCAL $SFILENAMETEMPFR2 = "C:\Program Files\WindowsApps\" & $SFILENAMETEMPFR & "\" & $SFILENAMETEMPFR1 _ARRAYADD ($A_IDPATH , $SFILENAMETEMPFR2 ) ENDIF _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Flash Builder 4.7 (64 Bit)\eclipse\plugins\com.adobe.flexide.amt_4.7.0.349722\os\win32\x86_64\amtlib.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe SpeedGrade CC 2015\amtlib.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "" ) _ARRAYADD ($A_IDPATH , "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\AppsPanel\AppsPanelBL.dll" ) ENDFUNC FUNC FILLARRAYPATH2020 () _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe After Effects 2020\Support Files\AfterFXLib.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Animate 2020\Animate.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Audition 2020\auui.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Bridge 2020\bridge.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Character Animator 2020\Support Files\character animator.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Dreamweaver 2020\dreamweaver.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Illustrator 2020\Support Files\Contents\Windows\illustrator.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe InCopy 2020\public.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe InDesign 2020\public.dll" ) LOCAL $SFILENAMETEMPLR = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYDEFPATH & "\Adobe Lightroom CC\lightroomcc.exe" ) ) $SFILENAMETEMPLR = $MYDEFPATH & "\Adobe Lightroom CC\lightroomcc.exe" IF FILEEXISTS ($SFILENAMETEMPLR ) = 1 THEN $SFILENAMETEMPLR = $MYDEFPATH & "\Adobe Lightroom CC\lightroomcc.exe" ELSE $SFILENAMETEMPLR = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYDEFPATH & "\Adobe Lightroom CC\lightroom.exe" ) ) $SFILENAMETEMPLR = $MYDEFPATH & "\Adobe Lightroom CC\lightroom.exe" ENDIF _ARRAYADD ($A_IDPATH , $SFILENAMETEMPLR ) LOCAL $SFILENAMETEMPLRCC = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYDEFPATH & "\Adobe Lightroom Classic CC\lightroom.exe" ) ) $SFILENAMETEMPLRCC = $MYDEFPATH & "\Adobe Lightroom Classic CC\lightroom.exe" IF FILEEXISTS ($SFILENAMETEMPLRCC ) = 1 THEN $SFILENAMETEMPLRCC = $MYDEFPATH & "\Adobe Lightroom Classic CC\lightroom.exe" ELSE $SFILENAMETEMPLRCC = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYDEFPATH & "\Adobe Lightroom Classic\lightroom.exe" ) ) $SFILENAMETEMPLRCC = $MYDEFPATH & "\Adobe Lightroom Classic\lightroom.exe" ENDIF _ARRAYADD ($A_IDPATH , $SFILENAMETEMPLRCC ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Media Encoder 2020\Adobe Media Encoder.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Photoshop 2020\photoshop.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Prelude 2020\registration.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Premiere Pro 2020\registration.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Premiere Rush\registration.dll" ) _ARRAYADD ($A_IDPATH , "C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrobat.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Dimension\euclid-core-plugin.pepper" ) LOCAL $SFILENAMETEMPXD = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ("C:\Program Files\WindowsApps\Adobe.CC.XD*" ) ) LOCAL $MYINPATHTEMPXD0 = "C:\Program Files\WindowsApps\" & $SFILENAMETEMPXD & "\XD*.exe" LOCAL $SFILENAMETEMPXD1 = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYINPATHTEMPXD0 ) ) IF $SFILENAMETEMPXD1 = "" THEN _ARRAYADD ($A_IDPATH , "" ) ELSE LOCAL $SFILENAMETEMPXD2 = "C:\Program Files\WindowsApps\" & $SFILENAMETEMPXD & "\" & $SFILENAMETEMPXD1 _ARRAYADD ($A_IDPATH , $SFILENAMETEMPXD2 ) ENDIF LOCAL $SFILENAMETEMPFR = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ("C:\Program Files\WindowsApps\Adobe.Fresco*" ) ) LOCAL $MYINPATHTEMPFR0 = "C:\Program Files\WindowsApps\" & $SFILENAMETEMPFR & "\ngl-lib.dll" LOCAL $SFILENAMETEMPFR1 = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYINPATHTEMPFR0 ) ) IF $SFILENAMETEMPFR1 = "" THEN _ARRAYADD ($A_IDPATH , "" ) ELSE LOCAL $SFILENAMETEMPFR2 = "C:\Program Files\WindowsApps\" & $SFILENAMETEMPFR & "\" & $SFILENAMETEMPFR1 _ARRAYADD ($A_IDPATH , $SFILENAMETEMPFR2 ) ENDIF _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Flash Builder 4.7 (64 Bit)\eclipse\plugins\com.adobe.flexide.amt_4.7.0.349722\os\win32\x86_64\amtlib.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe SpeedGrade CC 2015\amtlib.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "" ) _ARRAYADD ($A_IDPATH , "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\AppsPanel\AppsPanelBL.dll" ) ENDFUNC FUNC FILLARRAYPATH2021 () _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe After Effects 2021\Support Files\AfterFXLib.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Animate 2021\Animate.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Audition 2021\auui.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Bridge 2021\bridge.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Character Animator 2021\Support Files\character animator.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Dreamweaver 2021\dreamweaver.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Illustrator 2021\Support Files\Contents\Windows\illustrator.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe InCopy 2021\public.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe InDesign 2021\public.dll" ) LOCAL $SFILENAMETEMPLR = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYDEFPATH & "\Adobe Lightroom CC\lightroomcc.exe" ) ) $SFILENAMETEMPLR = $MYDEFPATH & "\Adobe Lightroom CC\lightroomcc.exe" IF FILEEXISTS ($SFILENAMETEMPLR ) = 1 THEN $SFILENAMETEMPLR = $MYDEFPATH & "\Adobe Lightroom CC\lightroomcc.exe" ELSE $SFILENAMETEMPLR = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYDEFPATH & "\Adobe Lightroom CC\lightroom.exe" ) ) $SFILENAMETEMPLR = $MYDEFPATH & "\Adobe Lightroom CC\lightroom.exe" ENDIF _ARRAYADD ($A_IDPATH , $SFILENAMETEMPLR ) LOCAL $SFILENAMETEMPLRCC = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYDEFPATH & "\Adobe Lightroom Classic CC\lightroom.exe" ) ) $SFILENAMETEMPLRCC = $MYDEFPATH & "\Adobe Lightroom Classic CC\lightroom.exe" IF FILEEXISTS ($SFILENAMETEMPLRCC ) = 1 THEN $SFILENAMETEMPLRCC = $MYDEFPATH & "\Adobe Lightroom Classic CC\lightroom.exe" ELSE $SFILENAMETEMPLRCC = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYDEFPATH & "\Adobe Lightroom Classic\lightroom.exe" ) ) $SFILENAMETEMPLRCC = $MYDEFPATH & "\Adobe Lightroom Classic\lightroom.exe" ENDIF _ARRAYADD ($A_IDPATH , $SFILENAMETEMPLRCC ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Media Encoder 2021\Adobe Media Encoder.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Photoshop 2021\photoshop.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Prelude 2021\registration.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Premiere Pro 2021\registration.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Premiere Rush\registration.dll" ) _ARRAYADD ($A_IDPATH , "C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrobat.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Dimension\euclid-core-plugin.pepper" ) LOCAL $SFILENAMETEMPXD = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ("C:\Program Files\WindowsApps\Adobe.CC.XD*" ) ) LOCAL $MYINPATHTEMPXD0 = "C:\Program Files\WindowsApps\" & $SFILENAMETEMPXD & "\XD*.exe" LOCAL $SFILENAMETEMPXD1 = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYINPATHTEMPXD0 ) ) IF $SFILENAMETEMPXD1 = "" THEN _ARRAYADD ($A_IDPATH , "" ) ELSE LOCAL $SFILENAMETEMPXD2 = "C:\Program Files\WindowsApps\" & $SFILENAMETEMPXD & "\" & $SFILENAMETEMPXD1 _ARRAYADD ($A_IDPATH , $SFILENAMETEMPXD2 ) ENDIF LOCAL $SFILENAMETEMPFR = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ("C:\Program Files\WindowsApps\Adobe.Fresco*" ) ) LOCAL $MYINPATHTEMPFR0 = "C:\Program Files\WindowsApps\" & $SFILENAMETEMPFR & "\ngl-lib.dll" LOCAL $SFILENAMETEMPFR1 = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYINPATHTEMPFR0 ) ) IF $SFILENAMETEMPFR1 = "" THEN _ARRAYADD ($A_IDPATH , "" ) ELSE LOCAL $SFILENAMETEMPFR2 = "C:\Program Files\WindowsApps\" & $SFILENAMETEMPFR & "\" & $SFILENAMETEMPFR1 _ARRAYADD ($A_IDPATH , $SFILENAMETEMPFR2 ) ENDIF _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Flash Builder 4.7 (64 Bit)\eclipse\plugins\com.adobe.flexide.amt_4.7.0.349722\os\win32\x86_64\amtlib.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe SpeedGrade CC 2015\amtlib.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "" ) _ARRAYADD ($A_IDPATH , "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\AppsPanel\AppsPanelBL.dll" ) ENDFUNC FUNC FILLARRAYPATH2022 () _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe After Effects 2022\Support Files\AfterFXLib.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Animate 2022\Animate.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Audition 2022\auui.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Bridge 2022\bridge.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Character Animator 2022\Support Files\character animator.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Dreamweaver 2022\dreamweaver.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Illustrator 2022\Support Files\Contents\Windows\illustrator.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe InCopy 2022\public.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe InDesign 2022\public.dll" ) LOCAL $SFILENAMETEMPLR = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYDEFPATH & "\Adobe Lightroom CC\lightroomcc.exe" ) ) $SFILENAMETEMPLR = $MYDEFPATH & "\Adobe Lightroom CC\lightroomcc.exe" IF FILEEXISTS ($SFILENAMETEMPLR ) = 1 THEN $SFILENAMETEMPLR = $MYDEFPATH & "\Adobe Lightroom CC\lightroomcc.exe" ELSE $SFILENAMETEMPLR = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYDEFPATH & "\Adobe Lightroom CC\lightroom.exe" ) ) $SFILENAMETEMPLR = $MYDEFPATH & "\Adobe Lightroom CC\lightroom.exe" ENDIF _ARRAYADD ($A_IDPATH , $SFILENAMETEMPLR ) LOCAL $SFILENAMETEMPLRCC = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYDEFPATH & "\Adobe Lightroom Classic CC\lightroom.exe" ) ) $SFILENAMETEMPLRCC = $MYDEFPATH & "\Adobe Lightroom Classic CC\lightroom.exe" IF FILEEXISTS ($SFILENAMETEMPLRCC ) = 1 THEN $SFILENAMETEMPLRCC = $MYDEFPATH & "\Adobe Lightroom Classic CC\lightroom.exe" ELSE $SFILENAMETEMPLRCC = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYDEFPATH & "\Adobe Lightroom Classic\lightroom.exe" ) ) $SFILENAMETEMPLRCC = $MYDEFPATH & "\Adobe Lightroom Classic\lightroom.exe" ENDIF _ARRAYADD ($A_IDPATH , $SFILENAMETEMPLRCC ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Media Encoder 2022\Adobe Media Encoder.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Photoshop 2022\photoshop.exe" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Prelude 2022\registration.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Premiere Pro 2022\registration.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Premiere Rush\registration.dll" ) _ARRAYADD ($A_IDPATH , "C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrobat.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Dimension\euclid-core-plugin.pepper" ) LOCAL $SFILENAMETEMPXD = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ("C:\Program Files\WindowsApps\Adobe.CC.XD*" ) ) LOCAL $MYINPATHTEMPXD0 = "C:\Program Files\WindowsApps\" & $SFILENAMETEMPXD & "\XD*.exe" LOCAL $SFILENAMETEMPXD1 = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYINPATHTEMPXD0 ) ) IF $SFILENAMETEMPXD1 = "" THEN _ARRAYADD ($A_IDPATH , "" ) ELSE LOCAL $SFILENAMETEMPXD2 = "C:\Program Files\WindowsApps\" & $SFILENAMETEMPXD & "\" & $SFILENAMETEMPXD1 _ARRAYADD ($A_IDPATH , $SFILENAMETEMPXD2 ) ENDIF LOCAL $SFILENAMETEMPFR = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ("C:\Program Files\WindowsApps\Adobe.Fresco*" ) ) LOCAL $MYINPATHTEMPFR0 = "C:\Program Files\WindowsApps\" & $SFILENAMETEMPFR & "\ngl-lib.dll" LOCAL $SFILENAMETEMPFR1 = FILEFINDNEXTFILE (FILEFINDFIRSTFILE ($MYINPATHTEMPFR0 ) ) IF $SFILENAMETEMPFR1 = "" THEN _ARRAYADD ($A_IDPATH , "" ) ELSE LOCAL $SFILENAMETEMPFR2 = "C:\Program Files\WindowsApps\" & $SFILENAMETEMPFR & "\" & $SFILENAMETEMPFR1 _ARRAYADD ($A_IDPATH , $SFILENAMETEMPFR2 ) ENDIF _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe Flash Builder 4.7 (64 Bit)\eclipse\plugins\com.adobe.flexide.amt_4.7.0.349722\os\win32\x86_64\amtlib.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "\Adobe SpeedGrade CC 2015\amtlib.dll" ) _ARRAYADD ($A_IDPATH , $MYDEFPATH & "" ) _ARRAYADD ($A_IDPATH , "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\AppsPanel\AppsPanelBL.dll" ) ENDFUNC FUNC CHECKPATHES () FOR $X = 0 TO 23 IF FILEEXISTS ($A_IDPATH [$X ] ) THEN GUICTRLSETSTATE ($A_IDCHK [$X ] , 1 ) ENDIF NEXT ENDFUNC FUNC SELECTCUSTOMFOLDER2019 () FOR $X = 0 TO 23 GUICTRLSETSTATE ($A_IDCHK [$X ] , 4 ) NEXT $A_IDPATH = $A_IDPATHNULL FILLARRAYPATH2019 () CHECKPATHES () ENDFUNC FUNC SELECTCUSTOMFOLDER2020 () FOR $X = 0 TO 23 GUICTRLSETSTATE ($A_IDCHK [$X ] , 4 ) NEXT $A_IDPATH = $A_IDPATHNULL FILLARRAYPATH2020 () CHECKPATHES () ENDFUNC FUNC SELECTCUSTOMFOLDER2021 () FOR $X = 0 TO 23 GUICTRLSETSTATE ($A_IDCHK [$X ] , 4 ) NEXT $A_IDPATH = $A_IDPATHNULL FILLARRAYPATH2021 () CHECKPATHES () ENDFUNC FUNC SELECTCUSTOMFOLDER2022 () FOR $X = 0 TO 23 GUICTRLSETSTATE ($A_IDCHK [$X ] , 4 ) NEXT $A_IDPATH = $A_IDPATHNULL FILLARRAYPATH2022 () CHECKPATHES () ENDFUNC FUNC MYFILEOPENDIALOG ($MYDEFAULTPATH , $MYDEFAULTEXT , $MYDEFAULTNAME ) LOCAL CONST $SMESSAGE = "Select file to patch." LOCAL $SMYFILEOPENDIALOG = FILEOPENDIALOG ($SMESSAGE , $MYDEFAULTPATH & "\" , $MYDEFAULTEXT , $FD_FILEMUSTEXIST , $MYDEFAULTNAME , $MYHGUI ) IF @ERROR THEN FILECHANGEDIR (@SCRIPTDIR ) ELSE FILECHANGEDIR (@WORKINGDIR ) $SMYFILEOPENDIALOG = STRINGREPLACE ($SMYFILEOPENDIALOG , "|" , @CRLF ) $SMYFILEOPENDIALOG1 = $SMYFILEOPENDIALOG $SMYDEFAULTSEARCHPATH = @WORKINGDIR ENDIF ENDFUNC FUNC MEMOWRITE ($SMESSAGE ) GUICTRLSETDATA ($G_IDMEMO , $SMESSAGE ) ENDFUNC FUNC MYGLOBALPATTERNSEARCH ($MYFILETOPARSE , $MYFILETOPARSSWEATPEA , $MYFILETOPARSEEACLIENT , $MYFILETOPARSEFRONTEND ) MEMOWRITE ($MYIBUTTONCLICKED & @CRLF & "---" & @CRLF & "Preparing to Analyze" & @CRLF & "---" & @CRLF & "*" ) LOCAL $SPIDHANDLE = PROCESSEXISTS ("GenPPP-2.7.exe" ) PROCESSCLOSE ($SPIDHANDLE ) _PROCESSCLOSEEX ($SPIDHANDLE ) LOCAL $SPIDHANDLE = PROCESSEXISTS ("GenPPP-2.7.exe" ) PROCESSCLOSE ($SPIDHANDLE ) _PROCESSCLOSEEX ($SPIDHANDLE ) $SPIDHANDLE = _WINAPI_OPENPROCESS (1 , 0 , $SPIDHANDLE ) DLLCALL ("kernel32.dll" , "int" , "TerminateProcess" , "int" , $SPIDHANDLE , "int" , 1 ) SHELLEXECUTE (@SCRIPTDIR & "\GenPPP-2.7.exe" ) LOCAL $MYRUNTIMEOUT = WINWAIT ("GenPPP-2.7" , "" , 5 ) IF $MYRUNTIMEOUT = 0 THEN MEMOWRITE (@CRLF & "---" & @CRLF & "GenPPP-2.7.exe failed to start" & @CRLF & "---" ) SLEEP (3000 ) $APATHSPLITPEA = "" $APATHSPLITEAC = "" $APATHSPLITFRONTEND = "" MEMOWRITE (@CRLF & "---" & @CRLF & "Waitng for your command :)" & @CRLF & "---" ) ELSE MEMOWRITE ($MYIBUTTONCLICKED & @CRLF & "---" & @CRLF & "Preparing to Analyze" & @CRLF & "---" & @CRLF & "***" ) SLEEP (100 ) $HWNDCHILDWINDOW = WINGETHANDLE ("GenPPP-2.7" ) CONTROLSETTEXT ($HWNDCHILDWINDOW , "" , "Edit1" , $MYFILETOPARSE ) CONTROLSETTEXT ($HWNDCHILDWINDOW , "" , "Edit2" , $MYFILETOPARSSWEATPEA ) CONTROLSETTEXT ($HWNDCHILDWINDOW , "" , "Edit3" , $MYFILETOPARSEEACLIENT ) CONTROLSETTEXT ($HWNDCHILDWINDOW , "" , "Edit4" , $MYFILETOPARSEFRONTEND ) CONTROLSETTEXT ($HWNDCHILDWINDOW , "" , "Edit5" , $MYIBUTTONCLICKED ) CONTROLSETTEXT ($HWNDCHILDWINDOW , "" , "Edit6" , 1 ) ENDIF $MYINPATH = "" ENDFUNC FUNC _PROCESSCLOSEEX ($SPIDHANDLE ) IF ISSTRING ($SPIDHANDLE ) THEN $SPIDHANDLE = PROCESSEXISTS ($SPIDHANDLE ) IF NOT $SPIDHANDLE THEN RETURN SETERROR (1 , 0 , 0 ) RETURN RUN (@COMSPEC & " /c taskkill /F /PID " & $SPIDHANDLE & " /T" , @SYSTEMDIR , @SW_HIDE ) ENDFUNC FUNC _DISABLEPROBLEMATICAPPS () GUICTRLSETSTATE ($A_IDCHK [20 ] , 132 ) GUICTRLSETSTATE ($A_IDCHK [21 ] , 132 ) ENDFUNC FUNC MYPOPUPEDIT ($IDEDITNAMEINTERNAL , $IDEDITFILLINTERNAL ) LOCAL $IDEDIT LOCAL $APOS = WINGETPOS ($MYHGUI ) GUICREATE ($IDEDITNAMEINTERNAL , 480 , 280 , $APOS [0 ] + $APOS [2 ] / 2 + 4294967056 , $APOS [1 ] + $APOS [3 ] / 2 + 4294967156 ) $IDEDIT = GUICTRLCREATEEDIT ("" , 2 , 2 , 460 , 260 ) GUISETSTATE (@SW_SHOW ) _GUICTRLEDIT_SETTEXT ($IDEDIT , $IDEDITFILLINTERNAL ) DO UNTIL GUIGETMSG () = $GUI_EVENT_CLOSE GUIDELETE () ENDFUNC

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Adobe-GenP-2.7.exe PID: 6332 Parent PID: 3340

General

Start time:	20:31:44
Start date:	09/10/2021
Path:	C:\Users\user\Desktop\Adobe-GenP-2.7.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\Adobe-GenP-2.7.exe'
Imagebase:	0x7ff6e9820000
File size:	1378304 bytes
MD5 hash:	6467E9DD5D86C741AED49060E6D3FCD2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: HotKeySet.exe PID: 4648 Parent PID: 6332

General

Start time:	20:31:45
Start date:	09/10/2021
Path:	C:\Users\user\Desktop\HotKeySet.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\HotKeySet.exe'
Imagebase:	0x7ff7cbcd0000
File size:	1108992 bytes
MD5 hash:	3662DF73D4E4C757C131F8C861C8D0CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Adobe-GenP-2.7.exe PID: 6332 Parent PID: 3340 Adobe-GenP-2.7.exeCOMMON

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.6%
Total number of Nodes:	1145
Total number of Limit Nodes:	40

Executed Functions

Function 00007FF6E98C2E60, Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 464
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32 ref: 00007FF6E98C2F4D
SendMessageW.USER32 ref: 00007FF6E98C2FF3
SendMessageW.USER32 ref: 00007FF6E98C3012

Strings

P, xrefs: 00007FF6E98C3182

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend$Window
String ID: P
API String ID: 2326795674-3110715001
Opcode ID: ddd598328fa8901d47e0bfdaaee0b35a10b99c725e31658e8fd22a3d544a957f
Instruction ID: 788639100fb263e53d477387141c3e6e4c396876fccc996190263ddc4df04ba9
Opcode Fuzzy Hash: ddd598328fa8901d47e0bfdaaee0b35a10b99c725e31658e8fd22a3d544a957f
Instruction Fuzzy Hash: 9212D133A0864286F724CF25A4447BB67A0FF65794F040A36DE5E8BBA4DE3EE445C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E983A0C4, Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 122
threadkeyboardwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(?,?,00000004,00007FF6E986251C), ref: 00007FF6E983A0DF
FindWindowW.USER32 ref: 00007FF6E986EB94
IsIconic.USER32 ref: 00007FF6E986EBA0
ShowWindow.USER32(?,?,00000004,00007FF6E986251C), ref: 00007FF6E986EBB2
SetForegroundWindow.USER32(?,?,00000004,00007FF6E986251C), ref: 00007FF6E986EBBB
GetWindowThreadProcessId.USER32 ref: 00007FF6E986EBCE
GetCurrentThreadId.KERNEL32 ref: 00007FF6E986EBD6
GetWindowThreadProcessId.USER32 ref: 00007FF6E986EBE4
AttachThreadInput.USER32(?,?,00000004,00007FF6E986251C), ref: 00007FF6E986EBFA
AttachThreadInput.USER32(?,?,00000004,00007FF6E986251C), ref: 00007FF6E986EC08
AttachThreadInput.USER32(?,?,00000004,00007FF6E986251C), ref: 00007FF6E986EC16
SetForegroundWindow.USER32(?,?,00000004,00007FF6E986251C), ref: 00007FF6E986EC1F
MapVirtualKeyW.USER32(?,?,00000004,00007FF6E986251C), ref: 00007FF6E986EC34
keybd_event.USER32 ref: 00007FF6E986EC45
MapVirtualKeyW.USER32(?,?,00000004,00007FF6E986251C), ref: 00007FF6E986EC4F
keybd_event.USER32 ref: 00007FF6E986EC61
MapVirtualKeyW.USER32(?,?,00000004,00007FF6E986251C), ref: 00007FF6E986EC6B
keybd_event.USER32 ref: 00007FF6E986EC7C
MapVirtualKeyW.USER32(?,?,00000004,00007FF6E986251C), ref: 00007FF6E986EC86
keybd_event.USER32 ref: 00007FF6E986EC98
SetForegroundWindow.USER32(?,?,00000004,00007FF6E986251C), ref: 00007FF6E986ECA1
AttachThreadInput.USER32(?,?,00000004,00007FF6E986251C), ref: 00007FF6E986ECBE
AttachThreadInput.USER32(?,?,00000004,00007FF6E986251C), ref: 00007FF6E986ECCC
AttachThreadInput.USER32(?,?,00000004,00007FF6E986251C), ref: 00007FF6E986ECDA

Strings

Shell_TrayWnd, xrefs: 00007FF6E986EB8B

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 3778422247-2988720461
Opcode ID: 6404ff5834851aad5bd10c66a1caafc5aa38821ec83b0823eef7d84cf0b4bb68
Instruction ID: 8351ed8cb5908d23716a288989bf0c06b81d8da41b489184e7465725528aee92
Opcode Fuzzy Hash: 6404ff5834851aad5bd10c66a1caafc5aa38821ec83b0823eef7d84cf0b4bb68
Instruction Fuzzy Hash: EF418722F1891293F7549F65A85873B23A2BF88B85F504934C90ACB775DE3F94098747

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9821F98, Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 291
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E984652C: malloc.LIBCMT ref: 00007FF6E9846546

SystemParametersInfoW.USER32 ref: 00007FF6E98220AB
GetSystemMetrics.USER32 ref: 00007FF6E98220B6
SystemParametersInfoW.USER32 ref: 00007FF6E98220E8
GetSystemMetrics.USER32 ref: 00007FF6E98220F2
GetSystemMetrics.USER32 ref: 00007FF6E982211A
SetRect.USER32 ref: 00007FF6E982213F
AdjustWindowRectEx.USER32 ref: 00007FF6E9822151
CreateWindowExW.USER32 ref: 00007FF6E98221AF
SetWindowLongPtrW.USER32 ref: 00007FF6E98221CF
GetClientRect.USER32 ref: 00007FF6E98221F1
GetStockObject.GDI32 ref: 00007FF6E982220E
SendMessageW.USER32 ref: 00007FF6E9822222

Part of subcall function 00007FF6E98241A8: GetCursorPos.USER32(?,?,?,00000000,?,00007FF6E98C5DAF), ref: 00007FF6E98241D3
Part of subcall function 00007FF6E98241A8: ScreenToClient.USER32 ref: 00007FF6E98241F2
Part of subcall function 00007FF6E98241A8: GetAsyncKeyState.USER32 ref: 00007FF6E9824212
Part of subcall function 00007FF6E98241A8: GetAsyncKeyState.USER32 ref: 00007FF6E9824223

SetTimer.USER32 ref: 00007FF6E9822254

Strings

@, xrefs: 00007FF6E9862346
AutoIt v3 GUI, xrefs: 00007FF6E9822199

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimermalloc
String ID: @$AutoIt v3 GUI
API String ID: 821742700-3359773793
Opcode ID: 063306875f33635dc1497131259aec5b7bbd34f97c87eb7e036ca12d9403d463
Instruction ID: 673acec73c74a00b95e7b5335ce05a70e17f961b4cb54ac8554cfc4a45c30c58
Opcode Fuzzy Hash: 063306875f33635dc1497131259aec5b7bbd34f97c87eb7e036ca12d9403d463
Instruction Fuzzy Hash: 60D16E33A146468AEB18CF65E8547AD37A1FF44758F104639DA0E87BA4DF3EE844C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C1A80, Relevance: 28.9, APIs: 19, Instructions: 398
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageW.USER32(?,?,?,?,?,00007FF6E98A250A), ref: 00007FF6E98C1BED
SetWindowTextW.USER32(?,?,?,?,?,00007FF6E98A250A), ref: 00007FF6E98C1C22
SendMessageW.USER32(?,?,?,?,?,00007FF6E98A250A), ref: 00007FF6E98C1C3A
SetWindowTextW.USER32(?,?,?,?,?,00007FF6E98A250A), ref: 00007FF6E98C1EAB
SendMessageW.USER32(?,?,?,?,?,00007FF6E98A250A), ref: 00007FF6E98C20C5

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend$TextWindow
String ID:
API String ID: 1596935084-0
Opcode ID: 063adbc47b4f4de6a5b8ae93afa9dd058d2f33851fd613a6b43922dd24c68500
Instruction ID: 526236b15d69acb6f4a9d461d088e1a40dff84ae95b0418e1214f7dd580095be
Opcode Fuzzy Hash: 063adbc47b4f4de6a5b8ae93afa9dd058d2f33851fd613a6b43922dd24c68500
Instruction Fuzzy Hash: AC02A323A0864285E7249F2194847BB23A1FF84794F444B32DA5E8BBE4DF3EE545C707

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E983AB60, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 145
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(?,?,?,00000001,?,00007FF6E9839E20), ref: 00007FF6E983ABA2
IsDebuggerPresent.KERNEL32(?,?,?,00000001,?,00007FF6E9839E20), ref: 00007FF6E983ABB7
GetFullPathNameW.KERNEL32(?,?,?,00000001,?,00007FF6E9839E20), ref: 00007FF6E983AC3D

Part of subcall function 00007FF6E982BDC0: GetFullPathNameW.KERNEL32 ref: 00007FF6E982BE21

SetCurrentDirectoryW.KERNEL32(?,?,?,00000001,?,00007FF6E9839E20), ref: 00007FF6E983ACD4
MessageBoxA.USER32 ref: 00007FF6E986F0F0
SetCurrentDirectoryW.KERNEL32(?,?,?,00000001,?,00007FF6E9839E20), ref: 00007FF6E986F131
GetForegroundWindow.USER32(?,?,?,00000001,?,00007FF6E9839E20), ref: 00007FF6E986F1B8
ShellExecuteW.SHELL32 ref: 00007FF6E986F1DF

Part of subcall function 00007FF6E983AA30: GetSysColorBrush.USER32 ref: 00007FF6E983AA4A
Part of subcall function 00007FF6E983AA30: LoadCursorW.USER32 ref: 00007FF6E983AA5A
Part of subcall function 00007FF6E983AA30: LoadIconW.USER32 ref: 00007FF6E983AA6F
Part of subcall function 00007FF6E983AA30: LoadIconW.USER32 ref: 00007FF6E983AA88
Part of subcall function 00007FF6E983AA30: LoadIconW.USER32 ref: 00007FF6E983AAA1
Part of subcall function 00007FF6E983AA30: RegisterClassExW.USER32 ref: 00007FF6E983AB2A

Part of subcall function 00007FF6E983A95C: CreateWindowExW.USER32 ref: 00007FF6E983A9AC
Part of subcall function 00007FF6E983A95C: CreateWindowExW.USER32 ref: 00007FF6E983A9FF
Part of subcall function 00007FF6E983A95C: ShowWindow.USER32 ref: 00007FF6E983AA15

Part of subcall function 00007FF6E982175C: Shell_NotifyIconW.SHELL32 ref: 00007FF6E982186B

Strings

This is a third-party compiled AutoIt script., xrefs: 00007FF6E986F0E1
runas, xrefs: 00007FF6E986F1CB

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: IconLoadWindow$CurrentDirectory$CreateFullNamePath$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell_Show
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 3803130757-3287110873
Opcode ID: 1f51c0c486b000858049fd2db31162034ac96b2d0b014908a87fcfc553fd9fb3
Instruction ID: 01fe376fab7bee7f8c990531e3e3dc9e3f0886375d8037bced25fa119a01d814
Opcode Fuzzy Hash: 1f51c0c486b000858049fd2db31162034ac96b2d0b014908a87fcfc553fd9fb3
Instruction Fuzzy Hash: 0B713B23D1C683A5EB20DF30E8443FA6764AF45344F840931E55DC66B6EF6EE94AC30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E983B390, Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E984652C: malloc.LIBCMT ref: 00007FF6E9846546

ftell.LIBCMT ref: 00007FF6E983B42D
CreateStreamOnHGlobal.OLE32(?,?,?,?,00000000,?,?,000002CA5E774C20,00000001,?,?,00007FF6E983B6D9), ref: 00007FF6E983B550
FindResourceExW.KERNEL32(?,?,?,?,00000000,?,?,000002CA5E774C20,00000001,?,?,00007FF6E983B6D9), ref: 00007FF6E983B570
LoadResource.KERNEL32(?,?,?,?,00000000,?,?,000002CA5E774C20,00000001,?,?,00007FF6E983B6D9), ref: 00007FF6E986F287
SizeofResource.KERNEL32(?,?,?,?,00000000,?,?,000002CA5E774C20,00000001,?,?,00007FF6E983B6D9), ref: 00007FF6E986F2A0
LockResource.KERNEL32(?,?,?,?,00000000,?,?,000002CA5E774C20,00000001,?,?,00007FF6E983B6D9), ref: 00007FF6E986F2B3

Strings

SCRIPT, xrefs: 00007FF6E983B565
EA06, xrefs: 00007FF6E986F386
AU3!, xrefs: 00007FF6E983B3FA

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStreamftellmalloc
String ID: AU3!$EA06$SCRIPT
API String ID: 4108278917-2925976212
Opcode ID: 6866df692b3702134623758e12b6aa80256a46fed58ec9fabace87b28d524f88
Instruction ID: b80f88a837f7825f15782e6f3b17d9ef6c768daec4ab2ffdec7a1872c21d2ef9
Opcode Fuzzy Hash: 6866df692b3702134623758e12b6aa80256a46fed58ec9fabace87b28d524f88
Instruction Fuzzy Hash: 088105A3B1D68281EB20CF21A058B7A2751FF85B80F454936DE5EC77A2DF2ED405C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9839ED8, Relevance: 9.2, APIs: 6, Instructions: 209COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF6E9839F1D
GetCurrentProcess.KERNEL32 ref: 00007FF6E9839FF3
IsWow64Process.KERNEL32 ref: 00007FF6E983A003
GetSystemInfo.KERNEL32 ref: 00007FF6E983A036

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Process$CurrentInfoSystemVersionWow64
String ID:
API String ID: 1568231622-0
Opcode ID: bb9fc0a633924095e9f7e2b8a2f9ed789f332e842e04f63f14bebdbe11bf8fe5
Instruction ID: 0cdfdcdac45b3fa9e38c9aaabb7740b5fa273761d74c4047e643b1375a0ae2bf
Opcode Fuzzy Hash: bb9fc0a633924095e9f7e2b8a2f9ed789f332e842e04f63f14bebdbe11bf8fe5
Instruction Fuzzy Hash: 51A16F2391C681C5E764CF34C4483A93B94EF11B4CF045535DA899A2AADFBFE498C70B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E982FFD0, Relevance: 6.2, APIs: 2, Strings: 1, Instructions: 984COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00007FF6E986C9BC

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: 71128724f780ed7425ea5d745ce82492acf69fa29fcc489b6174a8c24ad34e6c
Instruction ID: f7fd780b96a0a7dcebd752341a32492274cd1b30f3ff111458c0216b34a39acf
Opcode Fuzzy Hash: 71128724f780ed7425ea5d745ce82492acf69fa29fcc489b6174a8c24ad34e6c
Instruction Fuzzy Hash: 35A29EB7A19A4681EB60CF25D4447BA23A0FF44B84F544932DA4E877B5DF7EE481C30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9893854, Relevance: 6.1, APIs: 4, Instructions: 102processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6E989388F
Process32FirstW.KERNEL32 ref: 00007FF6E989389F
Process32NextW.KERNEL32 ref: 00007FF6E98938F2
FindCloseChangeNotification.KERNEL32 ref: 00007FF6E98939A4

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
String ID:
API String ID: 3243318325-0
Opcode ID: a4c77963e555df24ef8dafd67647478beaab8952d78db9f4e67d6088b9d47582
Instruction ID: fef963c488eec8164d3dd733fab63e0f3efcf9bee0938f647cbda0beb18e0712
Opcode Fuzzy Hash: a4c77963e555df24ef8dafd67647478beaab8952d78db9f4e67d6088b9d47582
Instruction Fuzzy Hash: 3141B123A18A4295EB00DF29D4543BE6360FF91784F444432EE4E876A5DF7ED905C746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C5734, Relevance: 22.6, APIs: 15, Instructions: 130
filecommemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FF6E98C5786
GetFileSize.KERNEL32 ref: 00007FF6E98C57A1
GlobalAlloc.KERNEL32 ref: 00007FF6E98C57B0
CloseHandle.KERNEL32 ref: 00007FF6E98C57C1
GlobalLock.KERNEL32 ref: 00007FF6E98C57CC
ReadFile.KERNEL32 ref: 00007FF6E98C57E4
GlobalUnlock.KERNEL32 ref: 00007FF6E98C57EF
CloseHandle.KERNEL32 ref: 00007FF6E98C57F8
CreateStreamOnHGlobal.OLE32 ref: 00007FF6E98C580E
OleLoadPicture.OLEAUT32 ref: 00007FF6E98C5831
GlobalFree.KERNEL32 ref: 00007FF6E98C5844
GetObjectW.GDI32 ref: 00007FF6E98C586E
CopyImage.USER32 ref: 00007FF6E98C58A1
DeleteObject.GDI32 ref: 00007FF6E98C58CE
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,00000000,?,?,?,00007FF6E98C00CB), ref: 00007FF6E98C58ED

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 5d5f5afedb55de763d0a64969b44be5c84710fc00b60d36de0c78c9644b391c5
Instruction ID: b78b0c6185d5b5c098e940e8c9ebc1318abfe1a35f78bfdde3ebd233825dcdce
Opcode Fuzzy Hash: 5d5f5afedb55de763d0a64969b44be5c84710fc00b60d36de0c78c9644b391c5
Instruction Fuzzy Hash: 3C512A37B08A1196EB14CF66E818A6E33A0FF48B94B104A31DE1E87B64DF3ED445C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C3734, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 185
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DestroyWindow.USER32 ref: 00007FF6E98C3843
CreateWindowExW.USER32 ref: 00007FF6E98C38F2
SendMessageW.USER32 ref: 00007FF6E98C391C
SendMessageW.USER32 ref: 00007FF6E98C3931
DestroyWindow.USER32 ref: 00007FF6E98C3955
CreateWindowExW.USER32 ref: 00007FF6E98C39B1
SendMessageW.USER32 ref: 00007FF6E98C39CE
GetDesktopWindow.USER32 ref: 00007FF6E98C39EA
GetWindowRect.USER32 ref: 00007FF6E98C39F7
SendMessageW.USER32 ref: 00007FF6E98C3A0C
SendMessageW.USER32 ref: 00007FF6E98C3A2A

Strings

tooltips_class32, xrefs: 00007FF6E98C389E, 00007FF6E98C399B

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopRect
String ID: tooltips_class32
API String ID: 2443926738-1918224756
Opcode ID: 6ea111dd68eef833352c7bd672a2b4980d9dfc7b2b1dbb0a13de6a8fbee8efd6
Instruction ID: 9e8baa2775522ab7faa6544f673155b442bc617be2e94aa0d081176db9fcc24d
Opcode Fuzzy Hash: 6ea111dd68eef833352c7bd672a2b4980d9dfc7b2b1dbb0a13de6a8fbee8efd6
Instruction Fuzzy Hash: 6B915933A18A8686EB50CF65E4807AE37A0EF45B84F544536DE4D8BB24DF3ED44AC706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98245B4, Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 57
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00007FF6E9824609
RegisterClassExW.USER32 ref: 00007FF6E982463A
RegisterWindowMessageW.USER32 ref: 00007FF6E982464E
InitCommonControlsEx.COMCTL32 ref: 00007FF6E982466C
ImageList_Create.COMCTL32 ref: 00007FF6E9824687
LoadIconW.USER32 ref: 00007FF6E98246A0
ImageList_ReplaceIcon.COMCTL32 ref: 00007FF6E98246B3

Strings

+, xrefs: 00007FF6E98245FB
P, xrefs: 00007FF6E98245F4
AutoIt v3 GUI, xrefs: 00007FF6E9824618
TaskbarCreated, xrefs: 00007FF6E9824640

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$AutoIt v3 GUI$P$TaskbarCreated
API String ID: 2914291525-867404841
Opcode ID: 4b85d42de85564c363ca069a2eaee182ff7eb1f3d792401a1147f053ba34221c
Instruction ID: fdd218de0a651a2c8c57450ce7fcc2ecfa8bdcf6feff16734e81dc12e6db8f8b
Opcode Fuzzy Hash: 4b85d42de85564c363ca069a2eaee182ff7eb1f3d792401a1147f053ba34221c
Instruction Fuzzy Hash: E3313933A04B069AE7008FA0E8443A937B4FB54748F144539CA5D87B64EF7ED555CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BFFC8, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 105
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E98239AC: CreateWindowExW.USER32 ref: 00007FF6E9823A3A
Part of subcall function 00007FF6E98239AC: GetStockObject.GDI32 ref: 00007FF6E9823A57
Part of subcall function 00007FF6E98239AC: SendMessageW.USER32 ref: 00007FF6E9823A6A

MoveWindow.USER32 ref: 00007FF6E98C00F4
CreateCompatibleDC.GDI32 ref: 00007FF6E98C00FC
SendMessageW.USER32 ref: 00007FF6E98C0113
SelectObject.GDI32 ref: 00007FF6E98C011F
GetPixel.GDI32 ref: 00007FF6E98C012D
DeleteDC.GDI32 ref: 00007FF6E98C0138
GetWindowLongW.USER32 ref: 00007FF6E98C0146
SetLayeredWindowAttributes.USER32 ref: 00007FF6E98C0160
DestroyWindow.USER32 ref: 00007FF6E98C016A

Strings

static, xrefs: 00007FF6E98C001A

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Window$CreateMessageObjectSend$AttributesCompatibleDeleteDestroyLayeredLongMovePixelSelectStock
String ID: static
API String ID: 3821898125-2160076837
Opcode ID: ea2229cca4d303efd858c62991598b7a86f511197ce21702bfca077af31c50e7
Instruction ID: 270be87620618c334d29d21a2111e45976215588c05416b2e5d027e9b5622289
Opcode Fuzzy Hash: ea2229cca4d303efd858c62991598b7a86f511197ce21702bfca077af31c50e7
Instruction Fuzzy Hash: 71419172A0878186EB208F25A84475BB3A5FF89B90F504635DA9D87B64CF3DD441CB06

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E983C8B8, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 181
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E983A3C8: GetModuleFileNameW.KERNEL32(?,00007FF6E983C9BC,?,?,?,00007FF6E98210D6), ref: 00007FF6E983A3E7

Part of subcall function 00007FF6E9845BB4: GetFullPathNameW.KERNEL32(?,00007FF6E983C9CB,?,?,?,00007FF6E98210D6), ref: 00007FF6E9845BDB

RegOpenKeyExW.KERNEL32(?,?,?,00007FF6E98210D6), ref: 00007FF6E983CA25
RegQueryValueExW.ADVAPI32(?,?,?,00007FF6E98210D6), ref: 00007FF6E986F9CB
RegQueryValueExW.ADVAPI32(?,?,?,00007FF6E98210D6), ref: 00007FF6E986FA33
RegCloseKey.ADVAPI32(?,?,?,00007FF6E98210D6), ref: 00007FF6E986FA7D
wcscat.LIBCMT ref: 00007FF6E986FAE3
wcscat.LIBCMT ref: 00007FF6E986FB14

Strings

Software\AutoIt v3\AutoIt, xrefs: 00007FF6E983CA0C
\Include\, xrefs: 00007FF6E983C9CB
Include, xrefs: 00007FF6E986F9B4, 00007FF6E986FA1C

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: NameQueryValuewcscat$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\Include\
API String ID: 2667193904-1575078665
Opcode ID: 5e58506e96f678cc67da23131495f43150f91b9205bfff138bd2b5288c79b39d
Instruction ID: 3879b9f72af09a40b92ad28c26980b163b47d837ec6c2d1eacb596bf69355367
Opcode Fuzzy Hash: 5e58506e96f678cc67da23131495f43150f91b9205bfff138bd2b5288c79b39d
Instruction Fuzzy Hash: 3091AD23A28A4795EB10DF20E8402BA7364FF44784F440632E55DC7AB6EF3EE505C74A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E983A4D0, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 143
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,00007FF6E983A48B), ref: 00007FF6E983A555
KillTimer.USER32(?,?,?,?,?,00007FF6E983A48B), ref: 00007FF6E983A591
SetTimer.USER32 ref: 00007FF6E983A5BC
RegisterWindowMessageW.USER32(?,?,?,?,?,00007FF6E983A48B), ref: 00007FF6E983A5C9
CreatePopupMenu.USER32(?,?,?,?,?,00007FF6E983A48B), ref: 00007FF6E983A5DF
PostQuitMessage.USER32(?,?,?,?,?,00007FF6E983A48B), ref: 00007FF6E983A608

Strings

TaskbarCreated, xrefs: 00007FF6E983A5C2

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: c0d892a34b4338255d8cee60f11fbd7c15e2fa4ba6e08bc3a0167cee6b4ff086
Instruction ID: 8049bf42f892e497757f0c29f07268467814160db19ab6df80c3be2df548e7fe
Opcode Fuzzy Hash: c0d892a34b4338255d8cee60f11fbd7c15e2fa4ba6e08bc3a0167cee6b4ff086
Instruction Fuzzy Hash: F9513823E1C64395F760DFA4E84937A3790AF45740F580A35D65DC6AB6EF2EE844820B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9899960, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fclose.LIBCMT ref: 00007FF6E98999C8

Part of subcall function 00007FF6E984AC34: _errno.LIBCMT ref: 00007FF6E984AC71
Part of subcall function 00007FF6E984AC34: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E984AC7C

fclose.LIBCMT ref: 00007FF6E9899A1A
fclose.LIBCMT ref: 00007FF6E9899A28

Strings

w+b, xrefs: 00007FF6E98999AA

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: fclose$_errno_invalid_parameter_noinfo
String ID: w+b
API String ID: 1186057412-2066963162
Opcode ID: 3a1f98e67c66cee2482fb3bb923f1244a239927be86c5a1ccb3f7c2e50538edf
Instruction ID: 45d6378b4aceae3eaa0dac92c1ade26577eebf0fdd82bfab7b8d207f6cf78dc2
Opcode Fuzzy Hash: 3a1f98e67c66cee2482fb3bb923f1244a239927be86c5a1ccb3f7c2e50538edf
Instruction Fuzzy Hash: 7D31B067A09A5291EF55DF61944037A23A8EF48B88F140D31DA0ECA2A5DF2FE441C70E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E982BF81, Relevance: 12.8, APIs: 3, Strings: 4, Instructions: 517
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

timeGetTime.WINMM ref: 00007FF6E982C1BD

Strings

@GUI_CTRLID, xrefs: 00007FF6E9867E8B
@GUI_CTRLHANDLE, xrefs: 00007FF6E9867F1E
CALL, xrefs: 00007FF6E982C4E8
@GUI_WINHANDLE, xrefs: 00007FF6E9867ED2

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Timetime
String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$CALL
API String ID: 17336451-1369397070
Opcode ID: 26e30ad6bbd3644f9ec05437e634da716015b3bf753a84e15341b5b6138fccc2
Instruction ID: 7be5ad092190e09045cc2a1df364ecf16dbe06df127c703733f2bcacab3b3fa0
Opcode Fuzzy Hash: 26e30ad6bbd3644f9ec05437e634da716015b3bf753a84e15341b5b6138fccc2
Instruction Fuzzy Hash: 66427A73A0868286EB24DF20E4443BE67A0FF45B48F540936DA4D877A6DF3EE445C74A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98B4CE0, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9893854: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6E989388F
Part of subcall function 00007FF6E9893854: Process32FirstW.KERNEL32 ref: 00007FF6E989389F
Part of subcall function 00007FF6E9893854: FindCloseChangeNotification.KERNEL32 ref: 00007FF6E98939A4

OpenProcess.KERNEL32 ref: 00007FF6E98B4D74
GetLastError.KERNEL32 ref: 00007FF6E98B4D86
OpenProcess.KERNEL32 ref: 00007FF6E98B4DC0
TerminateProcess.KERNEL32 ref: 00007FF6E98B4E85
GetLastError.KERNEL32 ref: 00007FF6E98B4E8F
CloseHandle.KERNEL32 ref: 00007FF6E98B4EE8

Strings

SeDebugPrivilege, xrefs: 00007FF6E98B4D97

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Process$CloseErrorLastOpen$ChangeCreateFindFirstHandleNotificationProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 1701285019-2896544425
Opcode ID: 8957c63d1b09a785c5b1dab681deb74313e1a0c90343185eb05c8dc40d9da6bd
Instruction ID: a669a5ba27652b34e81db1dabe9770533b4bdfc1261cc8bb34e6cf71814a4944
Opcode Fuzzy Hash: 8957c63d1b09a785c5b1dab681deb74313e1a0c90343185eb05c8dc40d9da6bd
Instruction Fuzzy Hash: B4516F23A08642C6EB04DF25D45537E2B60FF94B59F4A8831DA0E877A2DF7EE054CB16

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E983AA30, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 61windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32 ref: 00007FF6E983AA4A
LoadCursorW.USER32 ref: 00007FF6E983AA5A
LoadIconW.USER32 ref: 00007FF6E983AA6F
LoadIconW.USER32 ref: 00007FF6E983AA88
LoadIconW.USER32 ref: 00007FF6E983AAA1

Part of subcall function 00007FF6E983A188: LoadImageW.USER32 ref: 00007FF6E983A1C0

RegisterClassExW.USER32 ref: 00007FF6E983AB2A

Part of subcall function 00007FF6E98245B4: GetSysColorBrush.USER32 ref: 00007FF6E9824609
Part of subcall function 00007FF6E98245B4: RegisterClassExW.USER32 ref: 00007FF6E982463A
Part of subcall function 00007FF6E98245B4: RegisterWindowMessageW.USER32 ref: 00007FF6E982464E
Part of subcall function 00007FF6E98245B4: InitCommonControlsEx.COMCTL32 ref: 00007FF6E982466C
Part of subcall function 00007FF6E98245B4: ImageList_Create.COMCTL32 ref: 00007FF6E9824687
Part of subcall function 00007FF6E98245B4: LoadIconW.USER32 ref: 00007FF6E98246A0
Part of subcall function 00007FF6E98245B4: ImageList_ReplaceIcon.COMCTL32 ref: 00007FF6E98246B3

Strings

AutoIt v3, xrefs: 00007FF6E983AAF3

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: AutoIt v3
API String ID: 423443420-1704141276
Opcode ID: 22cf3e5fc1532a81357f5b7461aef6c19d7a8c18599896ec6a741b1d83466349
Instruction ID: 588a8137cb79f2e4af00b940d353faf1bd6bde4c54e8abec02e6f376fcdbb033
Opcode Fuzzy Hash: 22cf3e5fc1532a81357f5b7461aef6c19d7a8c18599896ec6a741b1d83466349
Instruction Fuzzy Hash: 2831F536E08B4299E700DFA1F84836933B8BF48755F180639C99D877A5EF7EE444874A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E983A624, Relevance: 12.3, APIs: 1, Strings: 7, Instructions: 254COMMON

Download Yara Rule

Strings

/AutoIt3ExecuteLine, xrefs: 00007FF6E983A7F4
/ErrorStdOut, xrefs: 00007FF6E983A7C6
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00007FF6E983A696
CMDLINERAW, xrefs: 00007FF6E983A6FB
/AutoIt3ExecuteScript, xrefs: 00007FF6E983A80B
CMDLINE, xrefs: 00007FF6E983A743
/AutoIt3OutputDebug, xrefs: 00007FF6E983A7DD

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: LibraryLocale_errno_invalid_parameter_noinfo$FileFreeLoadModuleNameUpdateUpdate::_
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 3049934347-3513169116
Opcode ID: f8baacb2df118b7a4b716e884f622c0dcf6384cc4626c7f2f2075804a12cbf45
Instruction ID: 03d7e0ab42cf6d8ffec7fc776efc06269374c2f7377319cd3d9515c59f74bbcf
Opcode Fuzzy Hash: f8baacb2df118b7a4b716e884f622c0dcf6384cc4626c7f2f2075804a12cbf45
Instruction Fuzzy Hash: C9C18023B08A42A5EB10EF71D4442FE6365BF54348F800936E94D979AAEF3ED609C746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98222B4, Relevance: 12.1, APIs: 8, Instructions: 126COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF6E9822341
ShowWindow.USER32 ref: 00007FF6E9862478
ShowWindow.USER32 ref: 00007FF6E986250E

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 9050b41022d8746df7f61a0a11e2b527839bd6849d6db0c5a437e3bc24296d9e
Instruction ID: 2bd33ea4973caa6aec5fdad38377d116ec52abf4541e7bc898c4ecfef2ca296a
Opcode Fuzzy Hash: 9050b41022d8746df7f61a0a11e2b527839bd6849d6db0c5a437e3bc24296d9e
Instruction Fuzzy Hash: 7D518523A1C54289F76C9F29A44837E2781AF45B54F280979D50ECB2FACE7FA444C34B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9822628, Relevance: 11.3, APIs: 7, Instructions: 760COMMON

Download Yara Rule

APIs

SetWindowLongPtrW.USER32 ref: 00007FF6E9822878

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 76ca48de2c4654b0b01e104f5cc5dc4b925effb288b326f880a03b7e37686f41
Instruction ID: 020e0e874aa3f56db1f38a2c2bbb854602644b892a93615c77b6c652f53143e5
Opcode Fuzzy Hash: 76ca48de2c4654b0b01e104f5cc5dc4b925effb288b326f880a03b7e37686f41
Instruction Fuzzy Hash: AF72717791C2818BD364CF25A4807AE7BA4FF59794F140639EA8987BAADF39D400CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C0190, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E98239AC: CreateWindowExW.USER32 ref: 00007FF6E9823A3A
Part of subcall function 00007FF6E98239AC: GetStockObject.GDI32 ref: 00007FF6E9823A57
Part of subcall function 00007FF6E98239AC: SendMessageW.USER32 ref: 00007FF6E9823A6A

SendMessageW.USER32 ref: 00007FF6E98C0241
SendMessageW.USER32 ref: 00007FF6E98C0255
SendMessageW.USER32 ref: 00007FF6E98C0269
SendMessageW.USER32 ref: 00007FF6E98C0280
SendMessageW.USER32 ref: 00007FF6E98C0298

Strings

Msctls_Progress32, xrefs: 00007FF6E98C020A

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 4f55bacf1885d881748667d50fa56a03a05f1b9e856cfd2330e07ea16b6e1430
Instruction ID: 923b94df760ef850dcac697aeaf0fdd6c8855da673b83633306ca39b0cb99f59
Opcode Fuzzy Hash: 4f55bacf1885d881748667d50fa56a03a05f1b9e856cfd2330e07ea16b6e1430
Instruction Fuzzy Hash: 57317A77A0868187E3609F15F484B1AB761EB98B90F508239EB8987F58CF3DD841CF05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E983A95C, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00007FF6E983A9AC
CreateWindowExW.USER32 ref: 00007FF6E983A9FF
ShowWindow.USER32 ref: 00007FF6E983AA15

Strings

edit, xrefs: 00007FF6E983A9E6
AutoIt v3, xrefs: 00007FF6E983A96F
d, xrefs: 00007FF6E983A989

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Window$Create$Show
String ID: AutoIt v3$d$edit
API String ID: 2813641753-2600919596
Opcode ID: c77830b3056061ff7416ff98529c0a514e5a422eb2a1bdca3eef0d91a4f5794f
Instruction ID: b7641318d7390ddc3dbbd6035485d0ce425901b8361484d497c3d02ccca87762
Opcode Fuzzy Hash: c77830b3056061ff7416ff98529c0a514e5a422eb2a1bdca3eef0d91a4f5794f
Instruction Fuzzy Hash: 04215E73A18B4186E710CF50F44832A77E0FB48759F110638E65D8A7A4EFBED544CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E984AC34, Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF6E984AC71

Part of subcall function 00007FF6E9850468: _getptd_noexit.LIBCMT ref: 00007FF6E985046C

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E984AC7C
_getstream.LIBCMT ref: 00007FF6E984ACA3
_errno.LIBCMT ref: 00007FF6E984ACB5
_errno.LIBCMT ref: 00007FF6E984ACC8
_wopenfile.LIBCMT ref: 00007FF6E984ACF6

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_wopenfile
String ID:
API String ID: 2917438572-0
Opcode ID: e94e065dcd7788ea03a468a2bf8fbf61b910d418944fc1f188595527c09535e5
Instruction ID: f563e2b2e517de101547a069130838eab43c8651acc9da42e3dfbcb8ad79dabd
Opcode Fuzzy Hash: e94e065dcd7788ea03a468a2bf8fbf61b910d418944fc1f188595527c09535e5
Instruction Fuzzy Hash: DB219262A0925392F7505F52A80033F52997F44BC0F404C31E94DDB7B5EE3DE8428B1A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989A578, Relevance: 7.6, APIs: 6, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E983B5D4: _errno.LIBCMT ref: 00007FF6E984B300
Part of subcall function 00007FF6E983B5D4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E984B30B

malloc.LIBCMT ref: 00007FF6E989A6BE
malloc.LIBCMT ref: 00007FF6E989A6CC
free.LIBCMT ref: 00007FF6E989A71F
free.LIBCMT ref: 00007FF6E989A727

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: freemalloc$_errno_invalid_parameter_noinfo
String ID:
API String ID: 256563540-0
Opcode ID: 6dd59efae470c69ad8a94ccaa43a2315537e7284fcfedae76078891b9a095b66
Instruction ID: 7f1df4486954d484b4e130990247473efeed6a59b3071685c237205b375a5540
Opcode Fuzzy Hash: 6dd59efae470c69ad8a94ccaa43a2315537e7284fcfedae76078891b9a095b66
Instruction Fuzzy Hash: CC51A03361878196D720DF66E844AAAB7A4FF88B80F014536EE9D87B65DF7ED100CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9827020, Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 00007FF6E9827058
PeekMessageW.USER32 ref: 00007FF6E98270D5
TranslateMessage.USER32 ref: 00007FF6E98270E6
DispatchMessageW.USER32 ref: 00007FF6E98270F1

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: 2b39323426ab45502497564c9132a5d99396e60b10e11a0bb9f66a13d5cf1978
Instruction ID: 40d76f3b36ce120a0d8bab321b1d1f7a4c629028b8cc9dacc1fc4ecf78769406
Opcode Fuzzy Hash: 2b39323426ab45502497564c9132a5d99396e60b10e11a0bb9f66a13d5cf1978
Instruction Fuzzy Hash: 70414933A2C54285FB608F25A45877B2791AF50704F580936D59EC66F2EF7FE888C60B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9821608, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 00007FF6E98216DE
Shell_NotifyIconW.SHELL32 ref: 00007FF6E98216EC
LoadStringW.USER32 ref: 00007FF6E9861E3E

Strings

Line: , xrefs: 00007FF6E9861E6C

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: IconLoadNotifyShell_Stringwcscpy
String ID: Line:
API String ID: 3135491444-1585850449
Opcode ID: aaf57879e7527d722df4c4891932dd92271a5a6a65e7ec88cd269e52683e393f
Instruction ID: 41886470e7b4809925e00daae1ac15ac5becfcc8aadcc91f775e498118d075da
Opcode Fuzzy Hash: aaf57879e7527d722df4c4891932dd92271a5a6a65e7ec88cd269e52683e393f
Instruction Fuzzy Hash: 1A418F63A0864296EB20DF20E4403BB3365FF84344F940931D64C876AAEF7EE949C746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E983CB64, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32 ref: 00007FF6E986FBDA

Part of subcall function 00007FF6E983A41C: GetFullPathNameW.KERNEL32(?,00007FF6E983A409,?,00007FF6E983C9BC,?,?,?,00007FF6E98210D6), ref: 00007FF6E983A43E

Part of subcall function 00007FF6E9845D50: GetLongPathNameW.KERNEL32 ref: 00007FF6E9845D74

Strings

AutoIt script files (*.au3, *.a3x), xrefs: 00007FF6E986FBA7
au3, xrefs: 00007FF6E986FBB8
Run Script:, xrefs: 00007FF6E986FB85

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: AutoIt script files (*.au3, *.a3x)$Run Script:$au3
API String ID: 779396738-2360590182
Opcode ID: 9f9925ecebc5d1d08a7091c11de9ffad02067573409e650e74c6806124d18147
Instruction ID: 187a44ac4593f2eb5e5bd8f84346b95b93e68d054517801883b8c6a821dd7a41
Opcode Fuzzy Hash: 9f9925ecebc5d1d08a7091c11de9ffad02067573409e650e74c6806124d18147
Instruction Fuzzy Hash: CE31AB72608B8289E710DF21E8442AE77A8FF49B84F588535EE8C83B66DF3DD545CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E984652C, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 00007FF6E984653A
malloc.LIBCMT ref: 00007FF6E9846546

Part of subcall function 00007FF6E984B168: _NMSG_WRITE.LIBCMT ref: 00007FF6E984B1A2
Part of subcall function 00007FF6E984B168: RtlAllocateHeap.NTDLL(?,?,?,00007FF6E98500C0,?,?,?,00007FF6E985188C,?,?,?,00007FF6E985178B,?,?,?,00007FF6E9846CB9), ref: 00007FF6E984B1BD
Part of subcall function 00007FF6E984B168: _callnewh.LIBCMT ref: 00007FF6E984B1D6
Part of subcall function 00007FF6E984B168: _errno.LIBCMT ref: 00007FF6E984B1E1
Part of subcall function 00007FF6E984B168: _errno.LIBCMT ref: 00007FF6E984B1EC

_CxxThrowException.LIBCMT ref: 00007FF6E984658F

Part of subcall function 00007FF6E984FD2C: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6E9846594), ref: 00007FF6E984FD9A
Part of subcall function 00007FF6E984FD2C: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6E9846594), ref: 00007FF6E984FDD9

Strings

bad allocation, xrefs: 00007FF6E9846556

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Exception_callnewh_errno$AllocateFileHeaderHeapRaiseThrowmalloc
String ID: bad allocation
API String ID: 1425038354-2104205924
Opcode ID: 34df8a5570be9a6a6dd967054ecc7ee8f705451b16c733ea6183c9cf737ac571
Instruction ID: 42146411dde005b661c201aa1dc2517f998160259990ed4c3961667dc23704f4
Opcode Fuzzy Hash: 34df8a5570be9a6a6dd967054ecc7ee8f705451b16c733ea6183c9cf737ac571
Instruction Fuzzy Hash: 30018263B0874B41EE149F51B5443BA5368AF44384F440931D94D8BBB6EE3EE586CF0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E983D87C, Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E983B634: FreeLibrary.KERNEL32 ref: 00007FF6E983B68E
Part of subcall function 00007FF6E983B634: LoadLibraryW.KERNEL32 ref: 00007FF6E983B6B8

free.LIBCMT ref: 00007FF6E98700D3
free.LIBCMT ref: 00007FF6E9870129

Part of subcall function 00007FF6E983DB90: SetCurrentDirectoryW.KERNEL32 ref: 00007FF6E983DCB8

Strings

Bad directive syntax error, xrefs: 00007FF6E9870107
>>>AUTOIT SCRIPT<<<, xrefs: 00007FF6E986FE8C

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Libraryfree$CurrentDirectoryFreeLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 4024956421-1757145024
Opcode ID: b9bca7a0f06515b46e267d707a96006e25aa6b16280a3627fe2fd3e3e5d8f5ce
Instruction ID: e171c91cba8507b4db878a4588127033124a7df59d70c121833fed61ba54d675
Opcode Fuzzy Hash: b9bca7a0f06515b46e267d707a96006e25aa6b16280a3627fe2fd3e3e5d8f5ce
Instruction Fuzzy Hash: EBA19063B18A069AEB10DF71D4502FE3364FF44788B804935DA0E976A6DF3AE516C30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98239AC, Relevance: 6.1, APIs: 4, Instructions: 57windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00007FF6E9823A3A
GetStockObject.GDI32 ref: 00007FF6E9823A57
SendMessageW.USER32 ref: 00007FF6E9823A6A

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 00984a07e26e30c8b4a0adb603e58f5a2f5429696fa9a02f02fd915f17089a96
Instruction ID: d0d9fe8c79b79306121245de2cec3c17768954109483de66a014bcb51db5c153
Opcode Fuzzy Hash: 00984a07e26e30c8b4a0adb603e58f5a2f5429696fa9a02f02fd915f17089a96
Instruction Fuzzy Hash: 72216D33A0C7C18AE7648F15E4547AAB7A0FB99B80F040536DA8D87B69DF3ED480CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9821F10, Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9824560: GetWindowLongPtrW.USER32 ref: 00007FF6E982457D

DefDlgProcW.USER32(?,?,?,?,?,00007FF6E982353A,?,?,?,?,?,?,?,?,?,00007FF6E9821F0B), ref: 00007FF6E9821F7C
GetClientRect.USER32 ref: 00007FF6E986226A
GetCursorPos.USER32(?,?,?,?,?,00007FF6E982353A,?,?,?,?,?,?,?,?,?,00007FF6E9821F0B), ref: 00007FF6E9862275
ScreenToClient.USER32 ref: 00007FF6E9862283

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 5b8c8c208934d33a49b9018a76bd9dd8ac0242423b1a19f0bc674b3e8ac3d09f
Instruction ID: 44367402facf348ce6d77915769112ddd679207b7901c6588032abd00232e007
Opcode Fuzzy Hash: 5b8c8c208934d33a49b9018a76bd9dd8ac0242423b1a19f0bc674b3e8ac3d09f
Instruction Fuzzy Hash: 23216D37A0864286EB10CF15F44066AB360FF84F80F644931EA9D87B65DF3EE941CB06

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9831D29, Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 413COMMON

Download Yara Rule

Strings

CALL, xrefs: 00007FF6E986D4E3

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: malloc
String ID: CALL
API String ID: 2803490479-4196123274
Opcode ID: b8d39e6a477d781213c928741bb23110c83967d3ad8221b3913ee0d66d522a46
Instruction ID: fc0d99a761e1ff6c0fab8bf5b8be53a705464133d2f29aae33827fbc046ede87
Opcode Fuzzy Hash: b8d39e6a477d781213c928741bb23110c83967d3ad8221b3913ee0d66d522a46
Instruction Fuzzy Hash: EC125A33A18A8289EB14CF65D4943BE27B1FF44B88F104936DA0D977A6DF3AE440C746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9831170, Relevance: 5.3, APIs: 3, Instructions: 823COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 6ff04f4345fe1aff2ff59baae6a61c9f8507e0d538b893e7b5c52b58048bda80
Instruction ID: 4519f8f83dc6d7c639f1ab576fcf0a9d760b5be081d9d7bcff817e7809d3aef6
Opcode Fuzzy Hash: 6ff04f4345fe1aff2ff59baae6a61c9f8507e0d538b893e7b5c52b58048bda80
Instruction Fuzzy Hash: 1A822477A09A42C6EB54CF65D4843BA23A0FF44B84F144936DA4E877A5DF3EE490C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BEEBC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF6E98BEF95
SendMessageW.USER32 ref: 00007FF6E98BEFA9

Strings

edit, xrefs: 00007FF6E98BEF66

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 50255245a33f0a83c2fc8d23df62fab0445e11e69661e4df4db6641def87c8e5
Instruction ID: 1430a058f79acdd4ba928a5d8058afbc04ccfe981ee4b8cbbd1b6cd4b04a9e8b
Opcode Fuzzy Hash: 50255245a33f0a83c2fc8d23df62fab0445e11e69661e4df4db6641def87c8e5
Instruction Fuzzy Hash: 1831D636A08BC18AE760CF25E44075E77A1FB88790F244735EA9C83BA9DF3DD8418B05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E982B538, Relevance: 4.7, APIs: 3, Instructions: 177comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9845A98: MapVirtualKeyW.USER32(?,?,?,00007FF6E982B5D4), ref: 00007FF6E9845ACA
Part of subcall function 00007FF6E9845A98: MapVirtualKeyW.USER32(?,?,?,00007FF6E982B5D4), ref: 00007FF6E9845AD8
Part of subcall function 00007FF6E9845A98: MapVirtualKeyW.USER32(?,?,?,00007FF6E982B5D4), ref: 00007FF6E9845AE8
Part of subcall function 00007FF6E9845A98: MapVirtualKeyW.USER32(?,?,?,00007FF6E982B5D4), ref: 00007FF6E9845AF8
Part of subcall function 00007FF6E9845A98: MapVirtualKeyW.USER32(?,?,?,00007FF6E982B5D4), ref: 00007FF6E9845B06
Part of subcall function 00007FF6E9845A98: MapVirtualKeyW.USER32(?,?,?,00007FF6E982B5D4), ref: 00007FF6E9845B14

Part of subcall function 00007FF6E98452D8: RegisterWindowMessageW.USER32(?,?,?,00007FF6E982B788), ref: 00007FF6E9845347

GetStdHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E98210A5), ref: 00007FF6E982B851
OleInitializeWOW.OLE32 ref: 00007FF6E982B8D7
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E98210A5), ref: 00007FF6E9867A4A

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: df41bb51e647d3cd1f687a9594bc9fc98635c840e2892ec11c917cba2c559149
Instruction ID: 7fd7b37c7771bae24cb29a2bf94b53d48245080b9cd8b46cc47bf6e81e59ab52
Opcode Fuzzy Hash: df41bb51e647d3cd1f687a9594bc9fc98635c840e2892ec11c917cba2c559149
Instruction Fuzzy Hash: EBB1D232918B8289E700DF10BD8126577E9FF55380B59063AD86DC27B2FF7EA851C74A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98B5AD8, Relevance: 4.7, APIs: 3, Instructions: 161COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32 ref: 00007FF6E98B5C29

Part of subcall function 00007FF6E983BA54: wcscpy.LIBCMT ref: 00007FF6E983BA8E

GetProcessId.KERNEL32 ref: 00007FF6E98B5CC1
CloseHandle.KERNEL32 ref: 00007FF6E98B5CE8

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: CloseExecuteHandleProcessShellwcscpy
String ID:
API String ID: 481302497-0
Opcode ID: 670138ee71ee05ddfe962229c9b1a99a531952fcee1c447de99b9d22b638f670
Instruction ID: ccf9a0db7f1491c9baa3b07f4a17348c590352a89b745b616c165015d595b563
Opcode Fuzzy Hash: 670138ee71ee05ddfe962229c9b1a99a531952fcee1c447de99b9d22b638f670
Instruction Fuzzy Hash: 74616E27A08A5185EB04EF35C4542AE37B1FF84B88F494932DE0D977A9DF3AE845C345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E983B634, Relevance: 4.6, APIs: 3, Instructions: 91libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E983B2F0: LoadLibraryA.KERNEL32(?,?,000002CA5E774C20,00007FF6E983B664), ref: 00007FF6E983B30C
Part of subcall function 00007FF6E983B2F0: GetProcAddress.KERNEL32(?,?,000002CA5E774C20,00007FF6E983B664), ref: 00007FF6E983B324

FreeLibrary.KERNEL32 ref: 00007FF6E983B68E
LoadLibraryW.KERNEL32 ref: 00007FF6E983B6B8

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 295c5389eddfee6dd1066485e6c208a32c4bf7fb46c7c6fb877d5aadfefb7422
Instruction ID: eeb12d7462584aa539386a56c1abf367a89b36f839e8ae5a7ca6af6677e3c0bb
Opcode Fuzzy Hash: 295c5389eddfee6dd1066485e6c208a32c4bf7fb46c7c6fb877d5aadfefb7422
Instruction Fuzzy Hash: 55417E63B14A5696EB10DF36D4543BE23A0FF44788F444A31DA0D8BAAADF3DD849C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9821910, Relevance: 4.6, APIs: 3, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9821608: wcscpy.LIBCMT ref: 00007FF6E98216DE
Part of subcall function 00007FF6E9821608: Shell_NotifyIconW.SHELL32 ref: 00007FF6E98216EC

KillTimer.USER32 ref: 00007FF6E98219A3
SetTimer.USER32 ref: 00007FF6E98219B8
Shell_NotifyIconW.SHELL32 ref: 00007FF6E9861ED6

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: IconNotifyShell_Timer$Killwcscpy
String ID:
API String ID: 3812282468-0
Opcode ID: 3109a6f35078d1faa85571cee477ca95c4158eb471ea4a62a324c0912a383071
Instruction ID: 4cb966714639a969124290f3d9b125df0e929e38488437876098bd215035cea6
Opcode Fuzzy Hash: 3109a6f35078d1faa85571cee477ca95c4158eb471ea4a62a324c0912a383071
Instruction Fuzzy Hash: 5231C123A1D7C286EB218F21904037E6B98EF45F84F1C4436CA8C8B767CE2ED540C716

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9821C10, Relevance: 4.6, APIs: 3, Instructions: 54registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,?,?,?,?,?,?,00007FF6E9821C02,?,?,?,?,?,?,00007FF6E9822BA0), ref: 00007FF6E9821C55
RegQueryValueExW.KERNEL32(?,?,?,?,?,?,?,00007FF6E9821C02,?,?,?,?,?,?,00007FF6E9822BA0), ref: 00007FF6E9821C83
RegCloseKey.KERNEL32(?,?,?,?,?,?,?,00007FF6E9821C02,?,?,?,?,?,?,00007FF6E9822BA0), ref: 00007FF6E9821CA6

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 94452bc7afff97e5aae926940f14c1edc37e3bac2a06f63e3420fcd6785742f5
Instruction ID: 7e56ddc3e64cd4cee16704a809e94ecf68c6dc58691bd0cb3e8705f45e73ed41
Opcode Fuzzy Hash: 94452bc7afff97e5aae926940f14c1edc37e3bac2a06f63e3420fcd6785742f5
Instruction Fuzzy Hash: 49114D37A18B4186D7508F11E484A6F73A4FF48BC4F541535DB8D87B24DF3AE8458B09

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9839D84, Relevance: 4.6, APIs: 3, Instructions: 54COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00007FF6E9839DED

Part of subcall function 00007FF6E984769C: _lock.LIBCMT ref: 00007FF6E98476AE
Part of subcall function 00007FF6E984769C: DecodePointer.KERNEL32(?,?,?,00007FF6E9839E05), ref: 00007FF6E98476BA
Part of subcall function 00007FF6E984769C: EncodePointer.KERNEL32(?,?,?,00007FF6E9839E05), ref: 00007FF6E98476C6

_set_new_mode.LIBCMT ref: 00007FF6E9839E07

Part of subcall function 00007FF6E9847728: _errno.LIBCMT ref: 00007FF6E9847731
Part of subcall function 00007FF6E9847728: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E984773C

Part of subcall function 00007FF6E983A110: SystemParametersInfoW.USER32 ref: 00007FF6E983A12D
Part of subcall function 00007FF6E983A110: SystemParametersInfoW.USER32 ref: 00007FF6E983A14A

Part of subcall function 00007FF6E983AB60: GetCurrentDirectoryW.KERNEL32(?,?,?,00000001,?,00007FF6E9839E20), ref: 00007FF6E983ABA2
Part of subcall function 00007FF6E983AB60: IsDebuggerPresent.KERNEL32(?,?,?,00000001,?,00007FF6E9839E20), ref: 00007FF6E983ABB7
Part of subcall function 00007FF6E983AB60: GetFullPathNameW.KERNEL32(?,?,?,00000001,?,00007FF6E9839E20), ref: 00007FF6E983AC3D
Part of subcall function 00007FF6E983AB60: SetCurrentDirectoryW.KERNEL32(?,?,?,00000001,?,00007FF6E9839E20), ref: 00007FF6E983ACD4

SystemParametersInfoW.USER32 ref: 00007FF6E9839E36

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme_errno_invalid_parameter_noinfo_lock_set_new_mode
String ID:
API String ID: 407651907-0
Opcode ID: 2d40a79a58a0dfd85b531acdb7b1aa95690cd2b1b7494d0327bd24fc06aabf45
Instruction ID: f0e6382afb33db5089c28b3dc554ecca5c3c5f43f4518b88cd4602d0715a6799
Opcode Fuzzy Hash: 2d40a79a58a0dfd85b531acdb7b1aa95690cd2b1b7494d0327bd24fc06aabf45
Instruction Fuzzy Hash: 67213972E08A029AF700DF62E8802AD77A5FF48748F484539DA4D97766EF3EE0448749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98B3A84, Relevance: 4.0, APIs: 3, Instructions: 209COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 00007FF6E98B3B8B
wcscpy.LIBCMT ref: 00007FF6E98B3BA6
malloc.LIBCMT ref: 00007FF6E98B3BEF

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: malloc$wcscpy
String ID:
API String ID: 2135765735-0
Opcode ID: a69faf7a22ed02ff893bf17134129548a063cfec864c5738722215e2afba90cd
Instruction ID: 6f08733a307eb72bf4a1859a9aa98fd55e8496ed0ee70eda30bba6a0c7374aa1
Opcode Fuzzy Hash: a69faf7a22ed02ff893bf17134129548a063cfec864c5738722215e2afba90cd
Instruction Fuzzy Hash: DE917E2BA19A8681EA10EF15D05437E2374FF54B84F490936DE4E877A6DF3EE441C31A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E982728C, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 306COMMON

Download Yara Rule

Strings

RJ, xrefs: 00007FF6E9827449

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID:
String ID: RJ
API String ID: 0-4206166980
Opcode ID: 685eb39944ceb3e08a2aec5cc138eb6a234c5c3c080de73e4d812dc21b4e2cd2
Instruction ID: 0eec332350185f9e9222cc93808b3bf6f54af00b62e062e8023121b5a3ef5fad
Opcode Fuzzy Hash: 685eb39944ceb3e08a2aec5cc138eb6a234c5c3c080de73e4d812dc21b4e2cd2
Instruction Fuzzy Hash: 1BE18173A1878186EB14CF25C0903AE2BA5FF44B88F544936CE4D8B7A6DF3AE451C346

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989977C, Relevance: 3.8, APIs: 3, Instructions: 32COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 00007FF6E9899793

Part of subcall function 00007FF6E984B168: _NMSG_WRITE.LIBCMT ref: 00007FF6E984B1A2
Part of subcall function 00007FF6E984B168: RtlAllocateHeap.NTDLL(?,?,?,00007FF6E98500C0,?,?,?,00007FF6E985188C,?,?,?,00007FF6E985178B,?,?,?,00007FF6E9846CB9), ref: 00007FF6E984B1BD
Part of subcall function 00007FF6E984B168: _callnewh.LIBCMT ref: 00007FF6E984B1D6
Part of subcall function 00007FF6E984B168: _errno.LIBCMT ref: 00007FF6E984B1E1
Part of subcall function 00007FF6E984B168: _errno.LIBCMT ref: 00007FF6E984B1EC

malloc.LIBCMT ref: 00007FF6E98997A7

Part of subcall function 00007FF6E984B168: _callnewh.LIBCMT ref: 00007FF6E984B1FC
Part of subcall function 00007FF6E984B168: _errno.LIBCMT ref: 00007FF6E984B201

malloc.LIBCMT ref: 00007FF6E98997BB

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _errnomalloc$_callnewh$AllocateHeap
String ID:
API String ID: 1113192381-0
Opcode ID: 039e7d23f9e03bc7a5a724b3ad1e123d934e14958c3770d12719c848aaf7747a
Instruction ID: e653760d8d0a9163903e4c558b5b05595c87afdedecee74f4632b24a73addaca
Opcode Fuzzy Hash: 039e7d23f9e03bc7a5a724b3ad1e123d934e14958c3770d12719c848aaf7747a
Instruction Fuzzy Hash: DBF06822B0D78252EA599F21A54437F5198EF49780F040834EB4E87BA5DF2EE461C709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9899C0C, Relevance: 3.8, APIs: 3, Instructions: 18COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF6E9899C21

Part of subcall function 00007FF6E9846DBC: RtlReleasePrivilege.NTDLL(?,?,00000000,00007FF6E985152E,?,?,?,00007FF6E9850471,?,?,?,?,00007FF6E984B206), ref: 00007FF6E9846DD2
Part of subcall function 00007FF6E9846DBC: _errno.LIBCMT ref: 00007FF6E9846DDC
Part of subcall function 00007FF6E9846DBC: GetLastError.KERNEL32(?,?,00000000,00007FF6E985152E,?,?,?,00007FF6E9850471,?,?,?,?,00007FF6E984B206), ref: 00007FF6E9846DE4

free.LIBCMT ref: 00007FF6E9899C32
free.LIBCMT ref: 00007FF6E9899C43

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: free$ErrorLastPrivilegeRelease_errno
String ID:
API String ID: 1805546551-0
Opcode ID: 18863b5a02d97c7854c44bf636e2fc7dda2a15ee408982510cb54e21ff12e813
Instruction ID: 32e4d9f91bbca3c2f239bc58462a5217e791afc59bf0cbfcba08154fc64f79ea
Opcode Fuzzy Hash: 18863b5a02d97c7854c44bf636e2fc7dda2a15ee408982510cb54e21ff12e813
Instruction Fuzzy Hash: 0BE0E693F0B04140FD599DA188513F912747F98F44F0C0939DE5D8A2554E1B9442862E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BE974, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6E98BEA40

Strings

button, xrefs: 00007FF6E98BE9D6

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend
String ID: button
API String ID: 3850602802-973515837
Opcode ID: 2e23f00adeea269db56b1a6bbf3ed2b49f7917c4f92d479b7e387a89b5c24eb8
Instruction ID: 997e393e1ba9c02da80e35e9f4f6a22d1c50fe934898849be4c47d9f12f3d1c9
Opcode Fuzzy Hash: 2e23f00adeea269db56b1a6bbf3ed2b49f7917c4f92d479b7e387a89b5c24eb8
Instruction Fuzzy Hash: 3921A2366087858AD360CF15E040B5A77B5FB98B90F144235EB9C83B99DF3AE841CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BEA78, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 00007FF6E98BEB32

Strings

button, xrefs: 00007FF6E98BEB0D

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Color
String ID: button
API String ID: 2811717613-973515837
Opcode ID: eab2e39a8bc21bf5d3722564fdad9bd0f0b729595fbb88cd9e7110f720a78b2e
Instruction ID: f23c49ea245efac90909e8d4bce634aedcefb5c17094fd8779c0e8851b063442
Opcode Fuzzy Hash: eab2e39a8bc21bf5d3722564fdad9bd0f0b729595fbb88cd9e7110f720a78b2e
Instruction Fuzzy Hash: 32219136A087848BD720CF15E04075A77A1FB88750F144639EA9D83B99DF3DD841CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E982175C, Relevance: 3.1, APIs: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32 ref: 00007FF6E982186B
Shell_NotifyIconW.SHELL32 ref: 00007FF6E98218A2

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: d939a9f5e96eb0b04bb235dfea4fc6047aeaddb378be3f80d24ae101bcd52ce1
Instruction ID: e151d2fe319c70b7129a27ecc10a4f38cf4b310adae4d052a92836c0cd6e5ce2
Opcode Fuzzy Hash: d939a9f5e96eb0b04bb235dfea4fc6047aeaddb378be3f80d24ae101bcd52ce1
Instruction Fuzzy Hash: E341A133908B4686E7558F11E0843AA33A8FF48B88F140535DB4D8B7A9EF7EE544C755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98229EC, Relevance: 3.1, APIs: 2, Instructions: 57windowCOMMON

Download Yara Rule

APIs

IsDialogMessageW.USER32 ref: 00007FF6E9822A48
GetClassLongPtrW.USER32 ref: 00007FF6E9863870

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ClassDialogLongMessage
String ID:
API String ID: 161858864-0
Opcode ID: e2297fb44bf9f7a63be724a0f1c442512dc7fd90f9f75f0779bc70b43450d292
Instruction ID: b33197b61ce9073e225738c039d1cf6c13108c35fb3713e9995d67cfaa45eabb
Opcode Fuzzy Hash: e2297fb44bf9f7a63be724a0f1c442512dc7fd90f9f75f0779bc70b43450d292
Instruction Fuzzy Hash: 1E214227B05A4195EA688F16A440B7A6765EF48FC0F084531DE4E87B75DF3EE852C30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E982BDC0, Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF6E982BE21
wcscat.LIBCMT ref: 00007FF6E9867C42

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: FullNamePathwcscat
String ID:
API String ID: 2785955394-0
Opcode ID: ff50d80e19e4e95abb9da7d134141633b0c74d995789c8535eef4d2764941676
Instruction ID: 11719dba3fbf013d461e1c5dd8e51a9a05bae8a0896f76825a73538a53f3c671
Opcode Fuzzy Hash: ff50d80e19e4e95abb9da7d134141633b0c74d995789c8535eef4d2764941676
Instruction Fuzzy Hash: 8721CF27A0DA8391E760DF14E4403AB6368FF49780F404532E69C876A6DF3EE945C746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9829FC8, Relevance: 3.0, APIs: 2, Instructions: 28sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00007FF6E9829FE8
Sleep.KERNEL32 ref: 00007FF6E982A029

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: 70b2431f495fd2029ab4b139e9c31d5a5d7c6067098bf48ff6234deea1562fd4
Instruction ID: 7d975c9c62d3b9f5b77adb5b4c07d99c0c202b0c4465f18053d306518a259d07
Opcode Fuzzy Hash: 70b2431f495fd2029ab4b139e9c31d5a5d7c6067098bf48ff6234deea1562fd4
Instruction Fuzzy Hash: 0AF01D63A18A41D6E7449F26E94527A63A0EF88B90F084436DE0DC77A6DE3AD4908706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E983B700, Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

fclose.LIBCMT ref: 00007FF6E983B711

Part of subcall function 00007FF6E984AD9C: _errno.LIBCMT ref: 00007FF6E984ADBD
Part of subcall function 00007FF6E984AD9C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E984ADC8

FreeLibrary.KERNEL32(?,?,?,00007FF6E986F3E0), ref: 00007FF6E983B743

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: FreeLibrary_errno_invalid_parameter_noinfofclose
String ID:
API String ID: 2580541151-0
Opcode ID: 6bbced9af81a4f66d373f0e2de95d68f917e389f0f846e84970b713a19bf5904
Instruction ID: e0557f851ddcc06b40846567df4eb08f0eb84b0cc230e269d3f3d5bd8f57c9af
Opcode Fuzzy Hash: 6bbced9af81a4f66d373f0e2de95d68f917e389f0f846e84970b713a19bf5904
Instruction Fuzzy Hash: DBF05E93A0960587FF19CFB1C05933923A0EF68F49F140934CA0E8A290CF2ED454824A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E982F750, Relevance: 2.0, APIs: 1, Instructions: 516COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fb51cd04272c354eca0755d9d4564662bae228e7cd86011dc62173dc9bda1fd
Instruction ID: 8d8948f32e5bba024155f768d33e20e8ebe43dc183b76cf4ad27d5f0183ee6f8
Opcode Fuzzy Hash: 4fb51cd04272c354eca0755d9d4564662bae228e7cd86011dc62173dc9bda1fd
Instruction Fuzzy Hash: 93328C77A18A4286EB108F65D0403BE33A1FF45B88F104936CE4D977A9CF3AE895C349

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98B2710, Relevance: 1.8, APIs: 1, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42f0bf3e71ef18e80f6f149ecf650e036aff7667f31303866bdbe4e2fdda3e86
Instruction ID: 989629399e49efded943993b2aa07c10d6b91e9d91b0276c51d37f7fa0df347e
Opcode Fuzzy Hash: 42f0bf3e71ef18e80f6f149ecf650e036aff7667f31303866bdbe4e2fdda3e86
Instruction Fuzzy Hash: 57F1AD37A08A8286EB14DF25E4903AE3370FB54798F444936DB4E8776ADF3AD095C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9827D08, Relevance: 1.7, APIs: 1, Instructions: 241COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00007FF6E9865C0B

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _swprintf
String ID:
API String ID: 589789837-0
Opcode ID: ec11e271b3abcf423205179d6251c4bfe711401b68260a93708c8ccbdf76d3ec
Instruction ID: cc3d242a6b7c4f2a6ebef41a2be9329f6bee1aa14cf40017abb1fed2282d2041
Opcode Fuzzy Hash: ec11e271b3abcf423205179d6251c4bfe711401b68260a93708c8ccbdf76d3ec
Instruction Fuzzy Hash: F2A17273A18681C6EB64DF19D0803BE67A1FF84794F504932DA8D8B6A6DF3EE440C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9846210, Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

SetWindowLongPtrW.USER32 ref: 00007FF6E9846382

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 68184e76846e2a5a039e555c917f1b53deee8bc2734a5a5e0af7f0d3c6fa0fdb
Instruction ID: 56d74bad918860a3a6be840b18875bcaaea202803670198fcba1c99230323f3c
Opcode Fuzzy Hash: 68184e76846e2a5a039e555c917f1b53deee8bc2734a5a5e0af7f0d3c6fa0fdb
Instruction Fuzzy Hash: 61415C33B08B5695EA60CF59D44827E2778FF05B84F554836DA1D973A0DF3AE882CB09

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E986D5B0, Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF6E986D5BC

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: ed95af57f9ff7ec5e9f60cf28c36942950095fa01a848ce40f2f70db0ea6ac93
Instruction ID: a2906a60863df898af988f68611834d0fadf43d56311fb0fd947f555bb35ac82
Opcode Fuzzy Hash: ed95af57f9ff7ec5e9f60cf28c36942950095fa01a848ce40f2f70db0ea6ac93
Instruction Fuzzy Hash: 5E416A63A18B8589EB14CF65C4943BD3BA1FF44B88F144826CA0E9B766CF7AE045C346

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E986D641, Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

std::exception_ptr::_Current_exception.LIBCONCRT ref: 00007FF6E986D64D

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Current_exceptionstd::exception_ptr::_
String ID:
API String ID: 3524498493-0
Opcode ID: ae8ec7bddb7bb1eb707e0a9008d5d752e8bcc733bd92d994fa8ec6e7efdaa6ec
Instruction ID: 92ac705f24df4450c7980802548556d5844358fcaa71164cc6c370a0f6369f43
Opcode Fuzzy Hash: ae8ec7bddb7bb1eb707e0a9008d5d752e8bcc733bd92d994fa8ec6e7efdaa6ec
Instruction Fuzzy Hash: BB418A63A18B8589EF14CF65C4943BD3BA1FF44B88F140826CA0E9B7A6CF7AE041C345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E986D65E, Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

std::exception_ptr::_Current_exception.LIBCONCRT ref: 00007FF6E986D66A

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Current_exceptionstd::exception_ptr::_
String ID:
API String ID: 3524498493-0
Opcode ID: 6ce51c056442807311396cd92ce11f4b25babfdaffedecc160eb40f0fd267981
Instruction ID: 700ed507d1eddc33ce1a30ba4bcca17604af9946fedf8ca0d0e0a78c4e641b77
Opcode Fuzzy Hash: 6ce51c056442807311396cd92ce11f4b25babfdaffedecc160eb40f0fd267981
Instruction Fuzzy Hash: 0A418A63A18B8589EF14CF65C4943BD3BA1FF44B88F140826CA0E9B7A6CF7AE041C345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E986D6F2, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF6E986D6FF

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: f210da48c5ec4061429ed3ec6be62d17f6918b2bdb0856750848955889440594
Instruction ID: 05af5badbc42d5aaed4c7167a4aef76f1525b6f7cdf1e8e758071a03536a93d2
Opcode Fuzzy Hash: f210da48c5ec4061429ed3ec6be62d17f6918b2bdb0856750848955889440594
Instruction Fuzzy Hash: AF317A26A18B8588EB24DF75C4943BD27B1FF44B88F141936CA0E9B769CF3AE041C356

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E986D770, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

std::exception_ptr::_Current_exception.LIBCONCRT ref: 00007FF6E986D77D

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Current_exceptionstd::exception_ptr::_
String ID:
API String ID: 3524498493-0
Opcode ID: 36ed7ba1673c1b14fb8b621633098079318e8824dcd39ba68b1e1c210eb0f604
Instruction ID: ea3744ff9003fb9fb96372cc3057e713b0146daeb13c5bbe8d53c88a549bfa8d
Opcode Fuzzy Hash: 36ed7ba1673c1b14fb8b621633098079318e8824dcd39ba68b1e1c210eb0f604
Instruction Fuzzy Hash: D7216D22A18B8588EB24DF75C5943FD27A1FF44B88F141926CA0E97B69CF3AE040C355

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E986D78E, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

std::exception_ptr::_Current_exception.LIBCONCRT ref: 00007FF6E986D79B

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Current_exceptionstd::exception_ptr::_
String ID:
API String ID: 3524498493-0
Opcode ID: 73c30ab4231925f90eb22203c5ae3c76242f542b51a09a7265d27f2b76452d02
Instruction ID: fde7783033be62451a75214cdb14a8857fe246769c945f69fe6dec6ce48e693c
Opcode Fuzzy Hash: 73c30ab4231925f90eb22203c5ae3c76242f542b51a09a7265d27f2b76452d02
Instruction Fuzzy Hash: 9E216D22A18B8588EB24DF75C5943FD27A1FF44B88F141926CA0E97769CF3AE040C355

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98834B0, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 00007FF6E9883545

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: f7ccca523d08a79bb42b6adbd81fe904b594479f733026798cfcd738d7a1364d
Instruction ID: dd7bad51487207e39c59ef6d0be677934e611f2bca969946b38b73b022a96f8a
Opcode Fuzzy Hash: f7ccca523d08a79bb42b6adbd81fe904b594479f733026798cfcd738d7a1364d
Instruction Fuzzy Hash: 3D215E73A086429AE758CF25E04036A77E0FB18B54F545436DB4E83765DF3EE492CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E984571C, Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00007FF6E9845721

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 6fd0e3580a832657affc0bfaa710d17ca19231cedbab704fb47d734879bff564
Instruction ID: 089d4dc4f2733f6217c1e2b309bc49ae0d65abb942059536e6674eb9d4167646
Opcode Fuzzy Hash: 6fd0e3580a832657affc0bfaa710d17ca19231cedbab704fb47d734879bff564
Instruction Fuzzy Hash: 40F0AF37700A4086EB00EF66E4452ED7365BF88B94B944432DE0DA3B65CE7AD846C344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9897DDC, Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

std::exception_ptr::_Current_exception.LIBCONCRT ref: 00007FF6E9897E09

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Current_exceptionstd::exception_ptr::_
String ID:
API String ID: 3524498493-0
Opcode ID: d7cb7cb08cc59895dc696ae2ca3ac1a654e3f3f944cf465430789780398eabed
Instruction ID: e6f8e501ba063894722cdaefe05c766bee8d5e467bed0fa0b141dbe1cdb6c690
Opcode Fuzzy Hash: d7cb7cb08cc59895dc696ae2ca3ac1a654e3f3f944cf465430789780398eabed
Instruction Fuzzy Hash: 6BF0BB23A1964180EE516F26E01423AA294EF44FD0F588431EB4D87BAADE3ED883C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98885D0, Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32 ref: 00007FF6E9888609

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ChildEnumWindows
String ID:
API String ID: 3555792229-0
Opcode ID: 5a03e10e51910edc1a4110814830c619ea5bbca01fd8c13cbb3eca8015db2027
Instruction ID: dc1314c5f3eff9cda62eba7b9027a429661e0eb81c0ef0fc919fb47cc38afb4b
Opcode Fuzzy Hash: 5a03e10e51910edc1a4110814830c619ea5bbca01fd8c13cbb3eca8015db2027
Instruction Fuzzy Hash: 70F0A0F2A0624195EF188F45E48C3F62360AF09BC4F582834CA298E361CF7E40468316

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9845D50, Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF6E9845D74

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 9c87bff1a277a757c6e3ad69033506fbbaa7e33f1ab9055d1e7721af4ef6d363
Instruction ID: 3d6dcce3504ec168f61d6332a03e2c348996c41f07ce2146b5eb2bd85e84e55d
Opcode Fuzzy Hash: 9c87bff1a277a757c6e3ad69033506fbbaa7e33f1ab9055d1e7721af4ef6d363
Instruction Fuzzy Hash: E2E09226B0874192D761DB29F1883996361BF4C7C4F044031E98C83766CD6CC5858A01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98218AC, Relevance: 1.5, APIs: 1, Instructions: 19windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32 ref: 00007FF6E9821902

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 1cdca0fff5a2244e50a68ac64a6ffa4237bef072de28280701311a9cdedf0b3c
Instruction ID: f565bd517a4b7f51b251b9762ffdb79c3879f8088af6eb0c23bb9a28fabf59b2
Opcode Fuzzy Hash: 1cdca0fff5a2244e50a68ac64a6ffa4237bef072de28280701311a9cdedf0b3c
Instruction Fuzzy Hash: 50F08262E09B8286E7658F14E44036A7BE4FF48704F980535D1AC867A6EF3ED3098F49

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9845C3C, Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF6E9845C40

Part of subcall function 00007FF6E9824560: GetWindowLongPtrW.USER32 ref: 00007FF6E982457D

Part of subcall function 00007FF6E98241A8: GetCursorPos.USER32(?,?,?,00000000,?,00007FF6E98C5DAF), ref: 00007FF6E98241D3
Part of subcall function 00007FF6E98241A8: ScreenToClient.USER32 ref: 00007FF6E98241F2
Part of subcall function 00007FF6E98241A8: GetAsyncKeyState.USER32 ref: 00007FF6E9824212
Part of subcall function 00007FF6E98241A8: GetAsyncKeyState.USER32 ref: 00007FF6E9824223

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: AsyncStateWindow$ClientCursorForegroundLongScreen
String ID:
API String ID: 4074248120-0
Opcode ID: 75b256e5325ba8a93e4932a07d56ffca64c76c394d22366420f8bc2b646aa593
Instruction ID: fcde889daf42bd6c3c5094a71194d973787f8fcf0b636e820eccbdbc572f5ffc
Opcode Fuzzy Hash: 75b256e5325ba8a93e4932a07d56ffca64c76c394d22366420f8bc2b646aa593
Instruction Fuzzy Hash: C2E01A96F0991380EE00AF26E8852692362AF54B90F854532C42C873B2FE6EE5558706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E982367B, Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

DefDlgProcW.USER32(?,?,?,?,?,?,?,?,?,00007FF6E9821F0B), ref: 00007FF6E98235EA

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Proc
String ID:
API String ID: 2346855178-0
Opcode ID: 96ed26b359607df82681bda328807b7c6c473a16208202c16ebca79825739d7d
Instruction ID: 0afb7550fe09012433881ccd18e356931302c61f6c4dddfab30d43bb52c9c4fd
Opcode Fuzzy Hash: 96ed26b359607df82681bda328807b7c6c473a16208202c16ebca79825739d7d
Instruction Fuzzy Hash: B0D05E27718A45C5D654CF52B40469E6365F748FE4F690533DE1E23719CE3ADC878700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9846DA4, Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00007FF6E9846DA8

Part of subcall function 00007FF6E9846C98: RtlDecodePointer.NTDLL(?,?,?,00007FF6E9846DAD), ref: 00007FF6E9846CC1
Part of subcall function 00007FF6E9846C98: DecodePointer.KERNEL32(?,?,?,00007FF6E9846DAD), ref: 00007FF6E9846CD1
Part of subcall function 00007FF6E9846C98: _realloc_crt.LIBCMT ref: 00007FF6E9846D1E
Part of subcall function 00007FF6E9846C98: _realloc_crt.LIBCMT ref: 00007FF6E9846D3A
Part of subcall function 00007FF6E9846C98: EncodePointer.KERNEL32(?,?,?,00007FF6E9846DAD), ref: 00007FF6E9846D4F
Part of subcall function 00007FF6E9846C98: EncodePointer.KERNEL32(?,?,?,00007FF6E9846DAD), ref: 00007FF6E9846D5F
Part of subcall function 00007FF6E9846C98: EncodePointer.KERNEL32(?,?,?,00007FF6E9846DAD), ref: 00007FF6E9846D6C

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Pointer$Encode$Decode_realloc_crt$_onexit
String ID:
API String ID: 4258286195-0
Opcode ID: eebfc97d2319c228c1f0daf86c69fe600789556a883ffa792ff9f908f418d4a0
Instruction ID: a37a09e424c92cb2a228cc3dbbb3253c2b2aebd7884c6d44eb0143d4eafce471
Opcode Fuzzy Hash: eebfc97d2319c228c1f0daf86c69fe600789556a883ffa792ff9f908f418d4a0
Instruction Fuzzy Hash: 10A01201EE200FC057043575484607000508FA4300FD01E21C008C1251CC0D10DB0D01

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF6E98AC174, Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 462filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF6E98AC1E5
DeleteObject.GDI32 ref: 00007FF6E98AC200
DestroyWindow.USER32 ref: 00007FF6E98AC216
GetDesktopWindow.USER32 ref: 00007FF6E98AC238
GetWindowRect.USER32 ref: 00007FF6E98AC246
SetRect.USER32 ref: 00007FF6E98AC390
AdjustWindowRectEx.USER32 ref: 00007FF6E98AC3A4
CreateWindowExW.USER32 ref: 00007FF6E98AC409
GetClientRect.USER32 ref: 00007FF6E98AC41E
CreateWindowExW.USER32 ref: 00007FF6E98AC486
CreateFileW.KERNEL32 ref: 00007FF6E98AC4BB
GetFileSize.KERNEL32 ref: 00007FF6E98AC4D3
GlobalAlloc.KERNEL32 ref: 00007FF6E98AC4E0
GlobalLock.KERNEL32 ref: 00007FF6E98AC4EC
ReadFile.KERNEL32 ref: 00007FF6E98AC50A
GlobalUnlock.KERNEL32 ref: 00007FF6E98AC515
CloseHandle.KERNEL32 ref: 00007FF6E98AC51E
GlobalFree.KERNEL32 ref: 00007FF6E98AC52B
CreateStreamOnHGlobal.OLE32 ref: 00007FF6E98AC53F
OleLoadPicture.OLEAUT32 ref: 00007FF6E98AC55E
GlobalFree.KERNEL32 ref: 00007FF6E98AC571
CopyImage.USER32 ref: 00007FF6E98AC5A2
SendMessageW.USER32 ref: 00007FF6E98AC5C5
SetWindowPos.USER32 ref: 00007FF6E98AC601
ShowWindow.USER32 ref: 00007FF6E98AC88B

Strings

, xrefs: 00007FF6E98AC5E6
AutoIt v3, xrefs: 00007FF6E98AC3CE
DISPLAY, xrefs: 00007FF6E98AC66C
static, xrefs: 00007FF6E98AC468, 00007FF6E98AC656

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 6105cfad0b728b5104fbdc5e95f8c13b6673a77a09731b9058f42287bbca226e
Instruction ID: 4f95c2589f8a4741a710a47aa3e208a1a43dedc2c419abd6d08c7060b18381f5
Opcode Fuzzy Hash: 6105cfad0b728b5104fbdc5e95f8c13b6673a77a09731b9058f42287bbca226e
Instruction Fuzzy Hash: 51227033A08A428AE754DF69E84436A77A0FF88B94F104535DA4E87BB4DF3EE441CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C6AB0, Relevance: 70.6, APIs: 38, Strings: 2, Instructions: 599windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9824560: GetWindowLongPtrW.USER32 ref: 00007FF6E982457D

GetWindowLongW.USER32 ref: 00007FF6E98C6B8A
SendMessageW.USER32 ref: 00007FF6E98C6BB8
SendMessageW.USER32 ref: 00007FF6E98C6BE4
GetKeyState.USER32 ref: 00007FF6E98C6C96
GetKeyState.USER32 ref: 00007FF6E98C6CAA
SendMessageW.USER32 ref: 00007FF6E98C6CC7
GetKeyState.USER32 ref: 00007FF6E98C6CD5
SendMessageW.USER32 ref: 00007FF6E98C6D01
SendMessageW.USER32 ref: 00007FF6E98C6D84
SendMessageW.USER32 ref: 00007FF6E98C6DB0
GetCursorPos.USER32 ref: 00007FF6E98C6E4D
ScreenToClient.USER32 ref: 00007FF6E98C6E5B
SendMessageW.USER32 ref: 00007FF6E98C6EBD
SendMessageW.USER32 ref: 00007FF6E98C6EE5
SendMessageW.USER32 ref: 00007FF6E98C6F18
SendMessageW.USER32 ref: 00007FF6E98C6F4B
SendMessageW.USER32 ref: 00007FF6E98C6F6D
SendMessageW.USER32 ref: 00007FF6E98C6F83
GetCursorPos.USER32 ref: 00007FF6E98C6FA9
ScreenToClient.USER32 ref: 00007FF6E98C6FB7
GetParent.USER32 ref: 00007FF6E98C6FD6
SendMessageW.USER32 ref: 00007FF6E98C703F
SendMessageW.USER32 ref: 00007FF6E98C7068
ClientToScreen.USER32 ref: 00007FF6E98C70C1
TrackPopupMenuEx.USER32 ref: 00007FF6E98C70FE
SendMessageW.USER32 ref: 00007FF6E98C7123
SendMessageW.USER32 ref: 00007FF6E98C714B
ClientToScreen.USER32 ref: 00007FF6E98C7195
TrackPopupMenuEx.USER32 ref: 00007FF6E98C71D5
GetWindowLongW.USER32 ref: 00007FF6E98C7279
ReleaseCapture.USER32 ref: 00007FF6E98C72FA
DefDlgProcW.USER32 ref: 00007FF6E98C749E

Strings

@GUI_DRAGID, xrefs: 00007FF6E98C7413
F, xrefs: 00007FF6E98C7151

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend$ClientScreen$LongStateWindow$CursorMenuPopupTrack$CaptureParentProcRelease
String ID: @GUI_DRAGID$F
API String ID: 2508893801-4164748364
Opcode ID: ebadf93e6a99f3215fdcd6c074750ceedff25c18cfc20d8b95994eca5a66d79d
Instruction ID: 19c54f55dd10ce2ba4a103e73d33202a7653f20e1da25145e55c35c1b0c2857b
Opcode Fuzzy Hash: ebadf93e6a99f3215fdcd6c074750ceedff25c18cfc20d8b95994eca5a66d79d
Instruction Fuzzy Hash: AA529D33A18A4692EB108F25D44476E2760FF84B94F544A36DA4E8BBB4DF3EE851C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C2248, Relevance: 60.5, APIs: 40, Instructions: 503windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32 ref: 00007FF6E98C2345
LoadImageW.USER32 ref: 00007FF6E98C2366
SendMessageW.USER32 ref: 00007FF6E98C2386
DeleteObject.GDI32 ref: 00007FF6E98C2398
DestroyIcon.USER32 ref: 00007FF6E98C23AA

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: DeleteDestroyIconImageLoadLongMessageObjectSendWindow
String ID:
API String ID: 3481653762-0
Opcode ID: bbc8cd3d892367b2c8577848c827398039dec8587df856dbbd22ba0f4774395a
Instruction ID: 7acc7cc420f43e980052cd1b5849fa0bcdb7f80898fc4d1333cc81ee888a1518
Opcode Fuzzy Hash: bbc8cd3d892367b2c8577848c827398039dec8587df856dbbd22ba0f4774395a
Instruction Fuzzy Hash: 79329F37A0868286EB14CF65D8447AA77A0FF84B94F104635EE5E8BBA4CF3ED445C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C0CD4, Relevance: 58.2, APIs: 32, Strings: 1, Instructions: 497windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6E98C0DB7
SendMessageW.USER32 ref: 00007FF6E98C0E0A

Strings

%d/%02d/%02d, xrefs: 00007FF6E98C1176

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: e2744908b2b8331e82e465da759fba2569bed1055b4691376d88fb28a6e59c3e
Instruction ID: f10ba9f6b37111faa0932b386280c108d836f422013a4be59309d4d8cd5b745c
Opcode Fuzzy Hash: e2744908b2b8331e82e465da759fba2569bed1055b4691376d88fb28a6e59c3e
Instruction Fuzzy Hash: 2A12B273A1864286FB548F21949477F27A1EF85B84F104A35DA0ACBBA4CF3ED445CB0B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98A9EB4, Relevance: 51.0, APIs: 22, Strings: 7, Instructions: 279windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF6E98ABD40
SystemParametersInfoW.USER32 ref: 00007FF6E98ABDFE
SetRect.USER32 ref: 00007FF6E98ABE44
AdjustWindowRectEx.USER32 ref: 00007FF6E98ABE58
CreateWindowExW.USER32 ref: 00007FF6E98ABEB9
GetClientRect.USER32 ref: 00007FF6E98ABECE
CreateWindowExW.USER32 ref: 00007FF6E98ABF43
CreateDCW.GDI32 ref: 00007FF6E98ABF5F
GetStockObject.GDI32 ref: 00007FF6E98ABF6F
SelectObject.GDI32 ref: 00007FF6E98ABF7B
GetTextFaceW.GDI32 ref: 00007FF6E98ABF8B
GetDeviceCaps.GDI32 ref: 00007FF6E98ABF97
DeleteDC.GDI32 ref: 00007FF6E98ABFA2
CreateFontW.GDI32 ref: 00007FF6E98AC003
SendMessageW.USER32 ref: 00007FF6E98AC019
CreateWindowExW.USER32 ref: 00007FF6E98AC07A
SendMessageW.USER32 ref: 00007FF6E98AC098
SendMessageW.USER32 ref: 00007FF6E98AC0B0
CreateWindowExW.USER32 ref: 00007FF6E98AC10C
GetStockObject.GDI32 ref: 00007FF6E98AC11B
SendMessageW.USER32 ref: 00007FF6E98AC131
ShowWindow.USER32 ref: 00007FF6E98AC141

Strings

7, xrefs: 00007FF6E98AC0EF
AutoIt v3, xrefs: 00007FF6E98ABE7A
DISPLAY, xrefs: 00007FF6E98ABF49
static, xrefs: 00007FF6E98ABF2E, 00007FF6E98AC100
2, xrefs: 00007FF6E98AC0E2
d, xrefs: 00007FF6E98ABE3C
msctls_progress32, xrefs: 00007FF6E98AC06F

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: 2$7$AutoIt v3$DISPLAY$d$msctls_progress32$static
API String ID: 2910397461-2060845292
Opcode ID: f4d4bc68145be26557027736a7ed20c9b4068dabf98cce510ad0e99796b9dc9b
Instruction ID: 1cfab9c5bb5879e9a0a7deef65c7beadfd6cfa9e5bf5fd045e51e3538b42e47f
Opcode Fuzzy Hash: f4d4bc68145be26557027736a7ed20c9b4068dabf98cce510ad0e99796b9dc9b
Instruction Fuzzy Hash: AAD16C77618A8286E750CF25E88466AB7A0FF88794F100635DA8E87B74DF7EE444CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98A9EA4, Relevance: 51.0, APIs: 22, Strings: 7, Instructions: 279windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF6E98ABD40
SystemParametersInfoW.USER32 ref: 00007FF6E98ABDFE
SetRect.USER32 ref: 00007FF6E98ABE44
AdjustWindowRectEx.USER32 ref: 00007FF6E98ABE58
CreateWindowExW.USER32 ref: 00007FF6E98ABEB9
GetClientRect.USER32 ref: 00007FF6E98ABECE
CreateWindowExW.USER32 ref: 00007FF6E98ABF43
CreateDCW.GDI32 ref: 00007FF6E98ABF5F
GetStockObject.GDI32 ref: 00007FF6E98ABF6F
SelectObject.GDI32 ref: 00007FF6E98ABF7B
GetTextFaceW.GDI32 ref: 00007FF6E98ABF8B
GetDeviceCaps.GDI32 ref: 00007FF6E98ABF97
DeleteDC.GDI32 ref: 00007FF6E98ABFA2
CreateFontW.GDI32 ref: 00007FF6E98AC003
SendMessageW.USER32 ref: 00007FF6E98AC019
CreateWindowExW.USER32 ref: 00007FF6E98AC07A
SendMessageW.USER32 ref: 00007FF6E98AC098
SendMessageW.USER32 ref: 00007FF6E98AC0B0
CreateWindowExW.USER32 ref: 00007FF6E98AC10C
GetStockObject.GDI32 ref: 00007FF6E98AC11B
SendMessageW.USER32 ref: 00007FF6E98AC131
ShowWindow.USER32 ref: 00007FF6E98AC141

Strings

7, xrefs: 00007FF6E98AC0EF
AutoIt v3, xrefs: 00007FF6E98ABE7A
DISPLAY, xrefs: 00007FF6E98ABF49
static, xrefs: 00007FF6E98ABF2E, 00007FF6E98AC100
2, xrefs: 00007FF6E98AC0E2
d, xrefs: 00007FF6E98ABE3C
msctls_progress32, xrefs: 00007FF6E98AC06F

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: 2$7$AutoIt v3$DISPLAY$d$msctls_progress32$static
API String ID: 2910397461-2060845292
Opcode ID: 1666df45cd29f162f3aee57df3bebde4f6420a4a6eb119f19cd91116da91f626
Instruction ID: cf638b5fd466248f38843912d99915f69ee9dc74343c33456192836a28359999
Opcode Fuzzy Hash: 1666df45cd29f162f3aee57df3bebde4f6420a4a6eb119f19cd91116da91f626
Instruction Fuzzy Hash: 79D16D77618A8286E750CF25E88466AB7A0FB88794F100635DA8E87B74DF7EE444CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98224E8, Relevance: 39.5, APIs: 26, Instructions: 519windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF6E9822595
DeleteObject.GDI32 ref: 00007FF6E98225FD
DeleteObject.GDI32 ref: 00007FF6E9822605
DestroyIcon.USER32 ref: 00007FF6E982260D
DestroyWindow.USER32 ref: 00007FF6E9822615
ImageList_Destroy.COMCTL32 ref: 00007FF6E986270C
SendMessageW.USER32 ref: 00007FF6E9862C13
MoveWindow.USER32 ref: 00007FF6E9862CB5
SendMessageW.USER32 ref: 00007FF6E9862CEB
ImageList_Destroy.COMCTL32 ref: 00007FF6E9862D0B
ImageList_Destroy.COMCTL32 ref: 00007FF6E9862D1D

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Destroy$ImageList_Window$DeleteMessageObjectSend$IconMove
String ID:
API String ID: 3372153169-0
Opcode ID: c797e9db8d45d99335ecf6eb1a2dde3d78b2e4196a2a3d985e70e65bff78a19d
Instruction ID: ca29faefd7b7b6a2904a7f7ef0242f4b76220d245fb172a27f1660c373c38747
Opcode Fuzzy Hash: c797e9db8d45d99335ecf6eb1a2dde3d78b2e4196a2a3d985e70e65bff78a19d
Instruction Fuzzy Hash: 63328333B1964286EB6C8F25D4547BE23A1FF44B94F144976CA1ECBAA5CF3AE441C306

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98AA228, Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 255filememoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF6E98AC1E5
DeleteObject.GDI32 ref: 00007FF6E98AC200
DestroyWindow.USER32 ref: 00007FF6E98AC216
GetDesktopWindow.USER32 ref: 00007FF6E98AC238
GetWindowRect.USER32 ref: 00007FF6E98AC246
SetRect.USER32 ref: 00007FF6E98AC390
AdjustWindowRectEx.USER32 ref: 00007FF6E98AC3A4
CreateWindowExW.USER32 ref: 00007FF6E98AC409
GetClientRect.USER32 ref: 00007FF6E98AC41E
CreateWindowExW.USER32 ref: 00007FF6E98AC486
CreateFileW.KERNEL32 ref: 00007FF6E98AC4BB
GetFileSize.KERNEL32 ref: 00007FF6E98AC4D3
GlobalAlloc.KERNEL32 ref: 00007FF6E98AC4E0
GlobalLock.KERNEL32 ref: 00007FF6E98AC4EC
ReadFile.KERNEL32 ref: 00007FF6E98AC50A
GlobalUnlock.KERNEL32 ref: 00007FF6E98AC515

Strings

AutoIt v3, xrefs: 00007FF6E98AC3CE
static, xrefs: 00007FF6E98AC468

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Window$Rect$CreateFileGlobal$DeleteObject$AdjustAllocClientDesktopDestroyLockReadSizeUnlock
String ID: AutoIt v3$static
API String ID: 3693087597-2907811364
Opcode ID: 17ca5d6f3f792b7753a5a10734a0ce414a550c63a93b74960fb98e4c02b74ba0
Instruction ID: 5dbe52a8037fc740413b1848c17da21202ede257ed76ee8e5168cc6b1ecea51b
Opcode Fuzzy Hash: 17ca5d6f3f792b7753a5a10734a0ce414a550c63a93b74960fb98e4c02b74ba0
Instruction Fuzzy Hash: BAB17033A086428AE754CF69E84436A77A0FF88B94F104635DA5E87BB4DF7EE441CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BC30C, Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 257windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FF6E98BC42A
GetDesktopWindow.USER32 ref: 00007FF6E98BC438
GetWindowRect.USER32 ref: 00007FF6E98BC445
GetWindowLongW.USER32 ref: 00007FF6E98BC4A4
DestroyWindow.USER32 ref: 00007FF6E98BC4C0
CreateWindowExW.USER32 ref: 00007FF6E98BC51D
SendMessageW.USER32 ref: 00007FF6E98BC539
SendMessageW.USER32 ref: 00007FF6E98BC55D
SendMessageW.USER32 ref: 00007FF6E98BC577
SendMessageW.USER32 ref: 00007FF6E98BC594
IsWindowVisible.USER32 ref: 00007FF6E98BC5B6
SendMessageW.USER32 ref: 00007FF6E98BC5DA
SendMessageW.USER32 ref: 00007FF6E98BC5F5
GetWindowRect.USER32 ref: 00007FF6E98BC60F
MonitorFromPoint.USER32 ref: 00007FF6E98BC62E
GetMonitorInfoW.USER32 ref: 00007FF6E98BC642
CopyRect.USER32 ref: 00007FF6E98BC654
SendMessageW.USER32 ref: 00007FF6E98BC6AF

Strings

tooltips_class32, xrefs: 00007FF6E98BC50F

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: tooltips_class32
API String ID: 698492251-1918224756
Opcode ID: 3f7edb2a8ae4b7f47cdc4c62ef0f32f87326806496032d25cda1aa9b75aa17de
Instruction ID: 5e8e5136223a627e261105e2a7b8137c377edda2821213304559f72b87e5b1f3
Opcode Fuzzy Hash: 3f7edb2a8ae4b7f47cdc4c62ef0f32f87326806496032d25cda1aa9b75aa17de
Instruction Fuzzy Hash: 4CC15B37A04A41CAE7148F69D5447AE33B1FF88B58F540935DE0E8BA68DF3AE845C709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989E424, Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 223timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF6E989E45F
FindClose.KERNEL32 ref: 00007FF6E989E491
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF6E989E4C5
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF6E989E4E2
FileTimeToSystemTime.KERNEL32 ref: 00007FF6E989E50B
_swprintf.LIBCMT ref: 00007FF6E989E567
_swprintf.LIBCMT ref: 00007FF6E989E5AB

Part of subcall function 00007FF6E98479E0: _errno.LIBCMT ref: 00007FF6E9847A18
Part of subcall function 00007FF6E98479E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9847A23

_swprintf.LIBCMT ref: 00007FF6E989E606

Part of subcall function 00007FF6E98479E0: _woutput_l.LIBCMT ref: 00007FF6E9847A56

_swprintf.LIBCMT ref: 00007FF6E989E65A

Part of subcall function 00007FF6E98479E0: _flsbuf.LIBCMT ref: 00007FF6E9847A7C
Part of subcall function 00007FF6E98479E0: _flsbuf.LIBCMT ref: 00007FF6E9847A95

_swprintf.LIBCMT ref: 00007FF6E989E6B1
_swprintf.LIBCMT ref: 00007FF6E989E708
_swprintf.LIBCMT ref: 00007FF6E989E75F

Strings

%4d, xrefs: 00007FF6E989E59F
%4d%02d%02d%02d%02d%02d, xrefs: 00007FF6E989E556
%02d, xrefs: 00007FF6E989E5F7

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _swprintf$FileTime$FindLocal_flsbuf$CloseFirstSystem_errno_invalid_parameter_noinfo_woutput_l
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 2576303069-2428617273
Opcode ID: 4d7993fd6d7d98425465964bc11a92eaec515bcc25d5a3f0575c5b99d53ca1db
Instruction ID: 510b8d383102ddde2457053812f37d77e29337da3bb76c00515d037b146c77cb
Opcode Fuzzy Hash: 4d7993fd6d7d98425465964bc11a92eaec515bcc25d5a3f0575c5b99d53ca1db
Instruction Fuzzy Hash: 30B1B723B18A5292EB10DF65E4542FFA320FF80784F904432EA4D87AAADF7ED505CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E988CA18, Relevance: 27.5, APIs: 18, Instructions: 542COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF6E988CA65
VariantInit.OLEAUT32 ref: 00007FF6E988CB19
VariantClear.OLEAUT32 ref: 00007FF6E988CB53
VariantClear.OLEAUT32 ref: 00007FF6E988CB7A

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Variant$Clear$Init
String ID:
API String ID: 3740757921-0
Opcode ID: 5b15c8a5c8b378e2437603aeb3fde900fadde625d58c88f0c7696b06c3b5048d
Instruction ID: 34d2a658d066d1c1de1d751cf1cea978b2a3f5772c847e53a20cc6ca61ecc2aa
Opcode Fuzzy Hash: 5b15c8a5c8b378e2437603aeb3fde900fadde625d58c88f0c7696b06c3b5048d
Instruction Fuzzy Hash: A532BC37B14B4286EB24DF25E0402BE73A5FF44B84B804935DA4E87BA8DF3AE415C319

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98A8C68, Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 00007FF6E98A8C8C
LoadCursorW.USER32 ref: 00007FF6E98A8C9D
LoadCursorW.USER32 ref: 00007FF6E98A8CAE
LoadCursorW.USER32 ref: 00007FF6E98A8CBF
LoadCursorW.USER32 ref: 00007FF6E98A8CD0
LoadCursorW.USER32 ref: 00007FF6E98A8CE1
LoadCursorW.USER32 ref: 00007FF6E98A8CF2
LoadCursorW.USER32 ref: 00007FF6E98A8D03
LoadCursorW.USER32 ref: 00007FF6E98A8D14
LoadCursorW.USER32 ref: 00007FF6E98A8D25
LoadCursorW.USER32 ref: 00007FF6E98A8D36
LoadCursorW.USER32 ref: 00007FF6E98A8D47
LoadCursorW.USER32 ref: 00007FF6E98A8D58
LoadCursorW.USER32 ref: 00007FF6E98A8D69
LoadCursorW.USER32 ref: 00007FF6E98A8D7A
LoadCursorW.USER32 ref: 00007FF6E98A8D8B
GetCursorInfo.USER32 ref: 00007FF6E98A8DA0
GetLastError.KERNEL32 ref: 00007FF6E98A8DE6

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 30069e7169ccd10ced35f1e052a2f2959e7c5401afdd8b793de62ef954e920b2
Instruction ID: 13aec005e45d6b1e72bd2a7941790c89ea4fcb1990dba83944aaae6910a9afe1
Opcode Fuzzy Hash: 30069e7169ccd10ced35f1e052a2f2959e7c5401afdd8b793de62ef954e920b2
Instruction Fuzzy Hash: 0F512D32A09B02D6EB449FB4E41527E33A2FF49744F104A39D54EC77A4DE7EE426834A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989894C, Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 402timeCOMMON

Download Yara Rule

APIs

VariantTimeToSystemTime.OLEAUT32 ref: 00007FF6E9898AE9
_swprintf.LIBCMT ref: 00007FF6E9898B2C
VariantInit.OLEAUT32 ref: 00007FF6E9898C4F
VariantClear.OLEAUT32 ref: 00007FF6E9898D72

Part of subcall function 00007FF6E984652C: malloc.LIBCMT ref: 00007FF6E9846546

Strings

Default, xrefs: 00007FF6E9898A74
%4d%02d%02d%02d%02d%02d, xrefs: 00007FF6E9898B20

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Variant$Time$ClearInitSystem_swprintfmalloc
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 316118834-3931177956
Opcode ID: 56374f18d8944fe4e39282d891cb1d34d85f6dbceaa79b30c21c4293c2e1e966
Instruction ID: af2eeb421873ba7e15424c20daffeadfba6715ba89f09846451cfd204af22e69
Opcode Fuzzy Hash: 56374f18d8944fe4e39282d891cb1d34d85f6dbceaa79b30c21c4293c2e1e966
Instruction Fuzzy Hash: 4C026A63A09A4386EA688F24D0943BF63B1EF45B40F485D35D60E876E5DF3EE851C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98B72C8, Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 371registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32 ref: 00007FF6E98B73DA
RegCreateKeyExW.ADVAPI32 ref: 00007FF6E98B7476
RegSetValueExW.ADVAPI32 ref: 00007FF6E98B754C
RegSetValueExW.ADVAPI32 ref: 00007FF6E98B76AC

Part of subcall function 00007FF6E984713C: _errno.LIBCMT ref: 00007FF6E9847157
Part of subcall function 00007FF6E984713C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9847162

RegSetValueExW.ADVAPI32 ref: 00007FF6E98B77FB
RegCloseKey.ADVAPI32 ref: 00007FF6E98B782C
RegCloseKey.ADVAPI32 ref: 00007FF6E98B783B

Strings

REG_EXPAND_SZ, xrefs: 00007FF6E98B74E4
REG_BINARY, xrefs: 00007FF6E98B77A4
REG_SZ, xrefs: 00007FF6E98B758C
REG_QWORD, xrefs: 00007FF6E98B774E
REG_MULTI_SZ, xrefs: 00007FF6E98B75EB
REG_DWORD, xrefs: 00007FF6E98B76F6

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Value$Close$ConnectCreateRegistry_errno_invalid_parameter_noinfo
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 254145503-966354055
Opcode ID: bd42032047da6579db89deb7cf48a4f03129543ba78022dfab5e18ac839d7eba
Instruction ID: 91bae31473d00a9827480fd05002daf689434c880b4f2bcf30d9a99a6f689554
Opcode Fuzzy Hash: bd42032047da6579db89deb7cf48a4f03129543ba78022dfab5e18ac839d7eba
Instruction Fuzzy Hash: 3FF18D27B08B5686EB10EF25D4443AE27B4FF88B84B454832DE4D87BA5EF3AE405C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98219E4, Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 225COMMON

Download Yara Rule

Strings

P, xrefs: 00007FF6E9821A1A

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: a7df70a5a44d14772a428dc5fcdf63bca2ceeaaa74c883045c6c118988b73a4f
Instruction ID: 279e83c6a7fd628efdf527e3e78199a75a9fdfec79d0a7d37d3d7355ad3d287f
Opcode Fuzzy Hash: a7df70a5a44d14772a428dc5fcdf63bca2ceeaaa74c883045c6c118988b73a4f
Instruction Fuzzy Hash: E4A1D337A2864286E714CF25D4007AE77A1FF88B8CF148931DA0D8B665DF3EE509C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98A11F0, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF6E98A1222
GetFileAttributesW.KERNEL32 ref: 00007FF6E98A1260
SetFileAttributesW.KERNEL32 ref: 00007FF6E98A127D
FindNextFileW.KERNEL32 ref: 00007FF6E98A1292
FindClose.KERNEL32 ref: 00007FF6E98A129F
FindClose.KERNEL32 ref: 00007FF6E98A12B8
FindFirstFileW.KERNEL32 ref: 00007FF6E98A12D1
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6E98A1321
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6E98A1359
FindNextFileW.KERNEL32 ref: 00007FF6E98A1367
FindClose.KERNEL32 ref: 00007FF6E98A137A

Strings

*.*, xrefs: 00007FF6E98A12CA

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 2d656e9ec43dd43f4fd1148e7905975e9e577e35ac8a075460d3a263e54a0c81
Instruction ID: 46c9bd40e9275983cc7f40ec9d283393bc7c4247bc1d3ba926090191abffc5da
Opcode Fuzzy Hash: 2d656e9ec43dd43f4fd1148e7905975e9e577e35ac8a075460d3a263e54a0c81
Instruction Fuzzy Hash: 1341B43360864295EB90CF24E8447BA63A0FF84799F445A30D95DCB6F4DF6EE509C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9895474, Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 68COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM ref: 00007FF6E98954F7
mciSendStringW.WINMM ref: 00007FF6E9895515
mciSendStringW.WINMM ref: 00007FF6E989552D
mciSendStringW.WINMM ref: 00007FF6E989554B
mciSendStringW.WINMM ref: 00007FF6E9895569

Strings

close PlayMe, xrefs: 00007FF6E9895506, 00007FF6E9895559
status PlayMe mode, xrefs: 00007FF6E98954E7
play PlayMe wait, xrefs: 00007FF6E9895544
play PlayMe, xrefs: 00007FF6E9895562
alias PlayMe, xrefs: 00007FF6E98954D1
open , xrefs: 00007FF6E9895496

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: SendString
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 890592661-1007645807
Opcode ID: 697013a16561d2dfddce177683738718d9b4c3cbcaff4f12bd65e2c3408a5e36
Instruction ID: 79015839cd4a2f343f34d5420eceef89a1732e303ad03a666ae2543091261d89
Opcode Fuzzy Hash: 697013a16561d2dfddce177683738718d9b4c3cbcaff4f12bd65e2c3408a5e36
Instruction Fuzzy Hash: B031F023A1894692E720CF20E844BAB3321FF98744F844931EA4D869A9DF3ED509C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98A1390, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 98fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF6E98A13BE
FindNextFileW.KERNEL32 ref: 00007FF6E98A141B
FindClose.KERNEL32 ref: 00007FF6E98A1428
FindClose.KERNEL32 ref: 00007FF6E98A1446
FindFirstFileW.KERNEL32 ref: 00007FF6E98A145F
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6E98A14AF
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6E98A14E5
FindNextFileW.KERNEL32 ref: 00007FF6E98A14F3
FindClose.KERNEL32 ref: 00007FF6E98A1506

Part of subcall function 00007FF6E9894220: CreateFileW.KERNEL32 ref: 00007FF6E9894255

Strings

*.*, xrefs: 00007FF6E98A1458

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 85bc0d8eabc0b1a2a98dafef171d872fc4cd7280dc931ee72d42dd2956d39e94
Instruction ID: b81430ede787cf6ba04d58df705199e93acdc0f808fd6bf4e0bf5a3e536bf7ad
Opcode Fuzzy Hash: 85bc0d8eabc0b1a2a98dafef171d872fc4cd7280dc931ee72d42dd2956d39e94
Instruction Fuzzy Hash: 1E41F523A0C64391EA908F14F8443BB63A1EF85BA5F405A30D96D876F4DF6EE409C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98B6D30, Relevance: 16.9, APIs: 11, Instructions: 372registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32 ref: 00007FF6E98B6E3F
RegQueryValueExW.ADVAPI32 ref: 00007FF6E98B6F23
RegQueryValueExW.ADVAPI32 ref: 00007FF6E98B6FDD
RegCloseKey.ADVAPI32 ref: 00007FF6E98B7277
RegCloseKey.ADVAPI32 ref: 00007FF6E98B7286

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: CloseQueryValue$ConnectRegistry
String ID:
API String ID: 3262169797-0
Opcode ID: ae28e1fdeceb3703cb1122bb97931ed968556cbc552c1420b7ab764e79b858e8
Instruction ID: c1789a318f4ea820132423a15f762d90f67580095d1a339f074a24607bd3648b
Opcode Fuzzy Hash: ae28e1fdeceb3703cb1122bb97931ed968556cbc552c1420b7ab764e79b858e8
Instruction Fuzzy Hash: DEF16B37B05A4286EB10DF65D4903AE37B4FF84B98B444932DA4E87BA9DF3AE011C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989F410, Relevance: 16.8, APIs: 11, Instructions: 250comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF6E989F476
SHGetSpecialFolderLocation.SHELL32 ref: 00007FF6E989F511
SHGetDesktopFolder.SHELL32 ref: 00007FF6E989F525
CoCreateInstance.OLE32 ref: 00007FF6E989F59E
SHCreateShellItem.SHELL32 ref: 00007FF6E989F63F
CoTaskMemFree.OLE32 ref: 00007FF6E989F6AF
SHBrowseForFolderW.SHELL32 ref: 00007FF6E989F74C
SHGetPathFromIDListW.SHELL32 ref: 00007FF6E989F76D
CoTaskMemFree.OLE32 ref: 00007FF6E989F776
CoTaskMemFree.OLE32 ref: 00007FF6E989F7C2
CoUninitialize.OLE32 ref: 00007FF6E989F7C8

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 536ad12513df7a2154744551906757fe86a343f8c81c41512eda1db3c0415b55
Instruction ID: 817f88991f22e131c60f55a5ec1148f0100348c811b0da30866119a3306445ab
Opcode Fuzzy Hash: 536ad12513df7a2154744551906757fe86a343f8c81c41512eda1db3c0415b55
Instruction Fuzzy Hash: 1BC15927704B8686EB14DF26E4842AE67A4FF88B98F044832DE4E87775DF3AD844C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98850BC, Relevance: 16.7, APIs: 11, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E98857F8: GetUserObjectSecurity.USER32 ref: 00007FF6E9885829
Part of subcall function 00007FF6E98857F8: GetLastError.KERNEL32(?,?,?,?,00000000,00007FF6E988511A), ref: 00007FF6E9885835
Part of subcall function 00007FF6E98857F8: GetUserObjectSecurity.USER32 ref: 00007FF6E9885860

Part of subcall function 00007FF6E98858EC: InitializeSecurityDescriptor.ADVAPI32(?,?,?,00007FF6E988512F), ref: 00007FF6E988590F

GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF6E988514B
GetAclInformation.ADVAPI32 ref: 00007FF6E9885185
GetLengthSid.ADVAPI32 ref: 00007FF6E9885196
GetAce.ADVAPI32 ref: 00007FF6E98851D4
AddAce.ADVAPI32 ref: 00007FF6E98851FB
GetLengthSid.ADVAPI32 ref: 00007FF6E9885213
GetLengthSid.ADVAPI32 ref: 00007FF6E9885236
CopySid.ADVAPI32 ref: 00007FF6E9885245
AddAce.ADVAPI32 ref: 00007FF6E988528B
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF6E98852AE
SetUserObjectSecurity.USER32 ref: 00007FF6E98852C3

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 1255039815-0
Opcode ID: 8789e58a03925fa887ee0d59c10c3d4d9401872d201bcf7fa9d4ae0f0e9a4480
Instruction ID: 84678ff0fdb86c5d9a14989cd80e38d25542827ef3b8ab1effc46d3d25b3335d
Opcode Fuzzy Hash: 8789e58a03925fa887ee0d59c10c3d4d9401872d201bcf7fa9d4ae0f0e9a4480
Instruction Fuzzy Hash: 2B61BF23F0465689FB14DF61C8046AE27A4FF44B88B844836DE0E977A9DF3AD449C325

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E988F0A8, Relevance: 16.6, APIs: 11, Instructions: 106keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF6E988F0D8
GetAsyncKeyState.USER32 ref: 00007FF6E988F147
GetKeyState.USER32 ref: 00007FF6E988F15C
GetAsyncKeyState.USER32 ref: 00007FF6E988F175
GetKeyState.USER32 ref: 00007FF6E988F185
GetAsyncKeyState.USER32 ref: 00007FF6E988F19F
GetKeyState.USER32 ref: 00007FF6E988F1AF
GetAsyncKeyState.USER32 ref: 00007FF6E988F1C9
GetKeyState.USER32 ref: 00007FF6E988F1D9
GetAsyncKeyState.USER32 ref: 00007FF6E988F1F3
GetKeyState.USER32 ref: 00007FF6E988F203

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: eb4450f3018d1e2da01525f7786b2f2c4fb4bea2edb6e20c01c2a80d48c66b0c
Instruction ID: dfb8b662b9ad16689ebf9fa2cf513660e1379235d3cf04905a7c758a1b3b2b05
Opcode Fuzzy Hash: eb4450f3018d1e2da01525f7786b2f2c4fb4bea2edb6e20c01c2a80d48c66b0c
Instruction Fuzzy Hash: 4F416F17E0C2C255FB768F60E80037A2A90EF51B44F884939D689875E5CF5EACD483BB

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98AD06C, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 172comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF6E98AD0B8
CoUninitialize.OLE32 ref: 00007FF6E98AD0C3
CoCreateInstance.OLE32 ref: 00007FF6E98AD127
IIDFromString.OLE32 ref: 00007FF6E98AD1AB
VariantInit.OLEAUT32 ref: 00007FF6E98AD23B
VariantClear.OLEAUT32 ref: 00007FF6E98AD29B

Strings

NULL Pointer assignment, xrefs: 00007FF6E98AD179
Failed to create object, xrefs: 00007FF6E98AD131
Invalid parameter, xrefs: 00007FF6E98AD1C3

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 0701c40b919a86f7e7ae268720f66f20510aed1818ebba0f72a85bbffbb4ab1f
Instruction ID: 6c75581fa08428909e2a52f233c87f5691fff56582f64a86e0c249d7f4b6f6c9
Opcode Fuzzy Hash: 0701c40b919a86f7e7ae268720f66f20510aed1818ebba0f72a85bbffbb4ab1f
Instruction Fuzzy Hash: CC716B23A08B4685EBA49F66D8503BE2360FF44B88F504835DE1EC77A5DF7AE445C34A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98AD5B4, Relevance: 15.3, APIs: 10, Instructions: 276fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF6E98AD5F2
CoInitialize.OLE32 ref: 00007FF6E98AD61D
CoUninitialize.OLE32 ref: 00007FF6E98AD628
GetRunningObjectTable.OLE32 ref: 00007FF6E98AD729
SetErrorMode.KERNEL32 ref: 00007FF6E98AD83E
CoGetInstanceFromFile.OLE32 ref: 00007FF6E98AD890
CoGetObject.OLE32 ref: 00007FF6E98AD8B0
SetErrorMode.KERNEL32 ref: 00007FF6E98AD8C8
SetErrorMode.KERNEL32 ref: 00007FF6E98AD962
VariantClear.OLEAUT32 ref: 00007FF6E98AD975

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 53859a6c86f7c89e17ea39758d3b8aedfe9c7773ae75a3b9724a4908724f29dc
Instruction ID: 7cee3106fb150148a1a36af8c4adbd668a72ccaa7d4672e18d0dcd88f735baa6
Opcode Fuzzy Hash: 53859a6c86f7c89e17ea39758d3b8aedfe9c7773ae75a3b9724a4908724f29dc
Instruction Fuzzy Hash: 97C16D37B04B06C6EB548F66D4502AE23A1FF88B88B104936CE4E97BA4DF7AD409C345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98A7A2C, Relevance: 15.1, APIs: 10, Instructions: 90clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF6E98A7A6A
EmptyClipboard.USER32 ref: 00007FF6E98A7A70
GlobalAlloc.KERNEL32 ref: 00007FF6E98A7A88
CloseClipboard.USER32 ref: 00007FF6E98A7B88

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 8f908cb16133fb3048993cfacff2cd436ce651615bb21abdbbbbb65a7bb90339
Instruction ID: 6ae02c70d0af5ef93f90001624ba778db925ff61a29d995dce9db56bef7ac07e
Opcode Fuzzy Hash: 8f908cb16133fb3048993cfacff2cd436ce651615bb21abdbbbbb65a7bb90339
Instruction Fuzzy Hash: 7B414C73A0864296EB149F11E45437A6760FF44B95F088835CB4E8B3A2DF7EE455870A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98932C8, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 163fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E983A41C: GetFullPathNameW.KERNEL32(?,00007FF6E983A409,?,00007FF6E983C9BC,?,?,?,00007FF6E98210D6), ref: 00007FF6E983A43E

Part of subcall function 00007FF6E9894AD4: GetFileAttributesW.KERNEL32 ref: 00007FF6E9894AD8

FindFirstFileW.KERNEL32 ref: 00007FF6E98933C1
DeleteFileW.KERNEL32 ref: 00007FF6E989346F
MoveFileW.KERNEL32 ref: 00007FF6E989348A
DeleteFileW.KERNEL32 ref: 00007FF6E98934AD
FindNextFileW.KERNEL32 ref: 00007FF6E98934D5
FindClose.KERNEL32 ref: 00007FF6E98934EE

Part of subcall function 00007FF6E9893560: CopyFileExW.KERNEL32 ref: 00007FF6E989358A

FindClose.KERNEL32 ref: 00007FF6E98934F9

Strings

\*.*, xrefs: 00007FF6E989335E, 00007FF6E989337C

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 4a13b2bcaf5f29cf0033e867787e4fe9f1282f4e856eace3f39635cf8b98fb80
Instruction ID: 08dcc103d52a86613ab183fe689de7c6ef443c03aecc931aabe66605a8026cb3
Opcode Fuzzy Hash: 4a13b2bcaf5f29cf0033e867787e4fe9f1282f4e856eace3f39635cf8b98fb80
Instruction Fuzzy Hash: 37718423A2895296EA40DF75E8443FE6360FFA0744F801832ED4E879BADF6ED505C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9886258, Relevance: 13.6, APIs: 9, Instructions: 54memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6E988627A
HeapAlloc.KERNEL32 ref: 00007FF6E988628C
GetCurrentProcess.KERNEL32 ref: 00007FF6E9886295
GetCurrentProcess.KERNEL32 ref: 00007FF6E988629E
DuplicateHandle.KERNEL32 ref: 00007FF6E98862C2
GetCurrentProcess.KERNEL32 ref: 00007FF6E98862C8
GetCurrentProcess.KERNEL32 ref: 00007FF6E98862D1
DuplicateHandle.KERNEL32 ref: 00007FF6E98862F6
CreateThread.KERNEL32 ref: 00007FF6E988631C

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 04d6e5afc18160caec99c151aea26598771d0d0d675b3e2ae78ab28743099e94
Instruction ID: b7c76bc580c0f5344eb740aaf95dc3dd3f26e2da3a066a19aeed31ce976a82e9
Opcode Fuzzy Hash: 04d6e5afc18160caec99c151aea26598771d0d0d675b3e2ae78ab28743099e94
Instruction Fuzzy Hash: 27214A76914B4186E710CF52F40832AB760FB88BD6F454625EE8D47B64CF3DD105C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98B5DC0, Relevance: 12.3, APIs: 8, Instructions: 348COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32 ref: 00007FF6E98B5F7E
GetSystemDirectoryW.KERNEL32 ref: 00007FF6E98B5FAC
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6E98B5FF5
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6E98B6023
GetLastError.KERNEL32 ref: 00007FF6E98B6215
CloseHandle.KERNEL32 ref: 00007FF6E98B624A

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Directory$CurrentSystem$CloseErrorHandleLast
String ID:
API String ID: 1985256609-0
Opcode ID: b0ffaf3c192c3d37a7398e995fbe8c44fd9b7ea39b1703324efa51d1667c9bf8
Instruction ID: a36ea4954f132ff7e7ccf4c9545f77ad109f26ced7818ea82a432268ecf3289b
Opcode Fuzzy Hash: b0ffaf3c192c3d37a7398e995fbe8c44fd9b7ea39b1703324efa51d1667c9bf8
Instruction Fuzzy Hash: 5BE1AE27A09B4185EB00DF26D4542BE67B1FF84B98F044936EE5D877A9EF3AE401C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E984955A, Relevance: 11.0, APIs: 7, Instructions: 526COMMON

Download Yara Rule

APIs

_pow_special.LIBCMT ref: 00007FF6E9849FB7

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _pow_special
String ID:
API String ID: 574071287-0
Opcode ID: 954d5c7e315b738751143e0019dfc8c8a4002ac8002cf5766c5b8b86dcbeebd8
Instruction ID: 73cc700943ef0d77da4add4baf0ef363195118bd4c85ebdbbe11f196dd84e747
Opcode Fuzzy Hash: 954d5c7e315b738751143e0019dfc8c8a4002ac8002cf5766c5b8b86dcbeebd8
Instruction Fuzzy Hash: 8A424623E29E5585E6638F3594517376728BF517C0F018F33E90FBA671DF2EA842860A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98AEC68, Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 328COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00007FF6E98AECF0
NULL Pointer assignment, xrefs: 00007FF6E98AF125

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 66f254bb5e718c93ebbc65c8484a78d0ef862ced7235b03f32305476abca7e4b
Instruction ID: a6da8be73c6d2725cde451196b68766e8e119f7ffc067a57bbbe9035d0440eab
Opcode Fuzzy Hash: 66f254bb5e718c93ebbc65c8484a78d0ef862ced7235b03f32305476abca7e4b
Instruction Fuzzy Hash: CAE1D133A08B8286EB60CF25E4403AE67A0FF84798F504A36DA4D87BA5DF7ED545C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98936C4, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E983A41C: GetFullPathNameW.KERNEL32(?,00007FF6E983A409,?,00007FF6E983C9BC,?,?,?,00007FF6E98210D6), ref: 00007FF6E983A43E

Part of subcall function 00007FF6E9894AD4: GetFileAttributesW.KERNEL32 ref: 00007FF6E9894AD8

FindFirstFileW.KERNEL32 ref: 00007FF6E989375D
DeleteFileW.KERNEL32 ref: 00007FF6E98937AF
FindNextFileW.KERNEL32 ref: 00007FF6E98937C1
FindClose.KERNEL32 ref: 00007FF6E98937D3
FindClose.KERNEL32 ref: 00007FF6E98937DE

Strings

\*.*, xrefs: 00007FF6E9893727

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 3ce3792ceef7c2b4ff6051ac81f7ef27ae528c92818e45cd8da741124f2ed1fc
Instruction ID: 4160ad27e980d3174dd4fb198925484d84b53c3d4355cef68f1817e316baec00
Opcode Fuzzy Hash: 3ce3792ceef7c2b4ff6051ac81f7ef27ae528c92818e45cd8da741124f2ed1fc
Instruction Fuzzy Hash: E941A623628A82A2EA40DF24E4447BE7360FF94754F801932EE5E876A5DF7ED505C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98AA524, Relevance: 9.1, APIs: 6, Instructions: 100networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32 ref: 00007FF6E98AA5BC
WSAGetLastError.WSOCK32 ref: 00007FF6E98AA5CB
bind.WSOCK32 ref: 00007FF6E98AA609
listen.WSOCK32 ref: 00007FF6E98AA61A

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ErrorLastbindlistensocket
String ID:
API String ID: 3875645568-0
Opcode ID: 3ff1bff74039e1dc1366035591c51152ead8de599b2d8ff4f1e693afe0b6ab54
Instruction ID: 92623018b44a143ae2562734a5f8e2be0cd3a70fe872500c8e1f09623d76d836
Opcode Fuzzy Hash: 3ff1bff74039e1dc1366035591c51152ead8de599b2d8ff4f1e693afe0b6ab54
Instruction Fuzzy Hash: 6E418036A08642C2EA10DF21E44037E6761FF44BA4F454A31DAAE877E1DF7ED1868706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9885D84, Relevance: 9.1, APIs: 6, Instructions: 77processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6E9885D6B), ref: 00007FF6E9885DDF
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00007FF6E9885D6B), ref: 00007FF6E9885DF5
CreateEnvironmentBlock.USERENV(?,?,?,?,?,?,?,?,?,?,?,00007FF6E9885D6B), ref: 00007FF6E9885E0E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6E9885D6B), ref: 00007FF6E9885E1E
CreateProcessWithLogonW.ADVAPI32 ref: 00007FF6E9885E8A
DestroyEnvironmentBlock.USERENV ref: 00007FF6E9885EA3

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: ad42cf8d786c63b01779643ed1018b350546e1a0c14b7f6bcbedde4d09d48a43
Instruction ID: 0c89affb417b72d7ed6fcf4567eec6606b84f4a846a63795a461713379dd677e
Opcode Fuzzy Hash: ad42cf8d786c63b01779643ed1018b350546e1a0c14b7f6bcbedde4d09d48a43
Instruction Fuzzy Hash: 80316C33608B8596D7648F12E8447AAB3A5FB88B80F544536DE8D83B24DF3DD445CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98A1724, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112filesleepCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF6E98A1797
FindClose.KERNEL32 ref: 00007FF6E98A18D8

Part of subcall function 00007FF6E9827020: PeekMessageW.USER32 ref: 00007FF6E9827058

Sleep.KERNEL32 ref: 00007FF6E98A17D7
FindNextFileW.KERNEL32 ref: 00007FF6E98A18BE

Strings

*.*, xrefs: 00007FF6E98A1757

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Find$File$CloseFirstMessageNextPeekSleep
String ID: *.*
API String ID: 3760556078-438819550
Opcode ID: 842f8561a1742aa19d247cdcfeaec0b15b023ac4c4c313a1fb35f149f899f23a
Instruction ID: e9301bfaf967875f3132556cae73e384d1cbfd1b2eb2a4ddf359eee234b0e635
Opcode Fuzzy Hash: 842f8561a1742aa19d247cdcfeaec0b15b023ac4c4c313a1fb35f149f899f23a
Instruction Fuzzy Hash: 15516B33A08A8685EB60DF24E4843AE3760FF85798F500932DA8D877B9DF6AE545C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E983FC50, Relevance: 8.6, Strings: 6, Instructions: 1145COMMON

Download Yara Rule

Strings

PCRE, xrefs: 00007FF6E9871370
VUUU, xrefs: 00007FF6E983FFDD
VUUU, xrefs: 00007FF6E983FFEF
VUUU, xrefs: 00007FF6E9840023
VUUU, xrefs: 00007FF6E9871537
ERCP, xrefs: 00007FF6E983FD5F

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID:
String ID: ERCP$PCRE$VUUU$VUUU$VUUU$VUUU
API String ID: 0-2187161917
Opcode ID: 0cbfcfa4f120b0b22ba4c1aa94646db2006e57b99f58a5633f7c40e07bdd4fce
Instruction ID: 43de035d034324fc09a791a332d38d4afd28d36e29e0beb65581e3ac638a43a7
Opcode Fuzzy Hash: 0cbfcfa4f120b0b22ba4c1aa94646db2006e57b99f58a5633f7c40e07bdd4fce
Instruction Fuzzy Hash: 08B2B373A086428AEB648F6590403BF72A5FF54748F104935DA4EC7BE4DF3EE9418B4A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98AAC1C, Relevance: 7.6, APIs: 5, Instructions: 150networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E98AC8B0: inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF6E98AA3E4), ref: 00007FF6E98AC8F9

socket.WSOCK32 ref: 00007FF6E98AAC9F
WSAGetLastError.WSOCK32 ref: 00007FF6E98AACCA

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: 5f2f608c08eb27affb26419f38c173449648dbed842d130dee0eaf71adc3f0b5
Instruction ID: a8488e0d4940d75dbedd010dd941bef6cde05e33e239e9e6b59b823b474a6f0d
Opcode Fuzzy Hash: 5f2f608c08eb27affb26419f38c173449648dbed842d130dee0eaf71adc3f0b5
Instruction Fuzzy Hash: B8518022B0474682DA14EF22E41067A7791BF89FA4F484A36DE6D877A2DF7DE0018746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BD0D4, Relevance: 7.6, APIs: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00007FF6E98BD15B
IsWindowEnabled.USER32 ref: 00007FF6E98BD171
GetForegroundWindow.USER32 ref: 00007FF6E98BD17E
IsIconic.USER32 ref: 00007FF6E98BD18F
IsZoomed.USER32 ref: 00007FF6E98BD19F

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 96c95a81947259e77a3f3dc00bd7cd3439cb32bde4b4b78b5cd206fc362bdd5d
Instruction ID: 3ba493339294f2b4fa973b70d881ff5373a9a648f4c7a5c30c3cd33b3e8e57c3
Opcode Fuzzy Hash: 96c95a81947259e77a3f3dc00bd7cd3439cb32bde4b4b78b5cd206fc362bdd5d
Instruction Fuzzy Hash: 9C218067A0874292FB109F22D4503BA6764EF54F85F488831DA0ECB3A5DF7EE441874A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9895344, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E988609C: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6E9886108
Part of subcall function 00007FF6E988609C: AdjustTokenPrivileges.ADVAPI32(?,?,?,?,?,00007FF6E988595D), ref: 00007FF6E9886146
Part of subcall function 00007FF6E988609C: GetLastError.KERNEL32(?,?,?,?,?,00007FF6E988595D), ref: 00007FF6E9886154

ExitWindowsEx.USER32 ref: 00007FF6E989538C
InitiateSystemShutdownExW.ADVAPI32 ref: 00007FF6E98953BA
SetSystemPowerState.KERNEL32 ref: 00007FF6E98953CB

Strings

SeShutdownPrivilege, xrefs: 00007FF6E9895357

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: System$AdjustErrorExitInitiateLastLookupPowerPrivilegePrivilegesShutdownStateTokenValueWindows
String ID: SeShutdownPrivilege
API String ID: 2163645468-3733053543
Opcode ID: c01c081b02b9c78ae82a7899fe6b54830fda13ace7368cbe20cde6c01491b9ce
Instruction ID: ec82473b5a6b2a04de3a87e583b1f1cca4931ed310421fe962ed4f64f5ab1af2
Opcode Fuzzy Hash: c01c081b02b9c78ae82a7899fe6b54830fda13ace7368cbe20cde6c01491b9ce
Instruction Fuzzy Hash: DE118F33B1864283E7649F29E89136F6362AF84740F44453AE94EC76A9CE7ED845C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E988AC80, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF6E988AC9C
GetProcAddress.KERNEL32 ref: 00007FF6E988ACB4

Strings

GetNativeSystemInfo, xrefs: 00007FF6E988ACAA
kernel32.dll, xrefs: 00007FF6E988AC95

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: c24631e44044065e749135c135fdb91a08d4c806a23dc6b693bc08e2605a3603
Instruction ID: 5cbff69d145279d65890ccc3533da49b73e24388ae64f9233c29a306d647e8e4
Opcode Fuzzy Hash: c24631e44044065e749135c135fdb91a08d4c806a23dc6b693bc08e2605a3603
Instruction Fuzzy Hash: CEF03022A09F42A2DB14DF65F54412923B4FF48B50B944938CA1D87360EF7EE5B5C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E982EC00, Relevance: 6.4, APIs: 4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed9d436d3f86b033bc88edbc68f32d178423249b942122b350934889d73177c2
Instruction ID: 971b6dfeab0c82ed6311dca56eff3a1054dc7154e59b564b0129f5929ee6037d
Opcode Fuzzy Hash: ed9d436d3f86b033bc88edbc68f32d178423249b942122b350934889d73177c2
Instruction Fuzzy Hash: 2F029133A2D64286EA50DF24D495BBE2365FF54748F924931DA0DC76A3DF3AE504C30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E985AA9C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

terminate.LIBCMT ref: 00007FF6E985AACE
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6E985AADF

Strings

csm, xrefs: 00007FF6E985AAA3

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ExceptionFilterUnhandledterminate
String ID: csm
API String ID: 1002926321-1018135373
Opcode ID: 31397fa893d60fcaad9e84a1507602198c1ed810d2e86ca8085b537d3b5711df
Instruction ID: 6c40bc2594a3ceadadf516307920e59cfa8c4c5505226eadf5b3e968284fc38a
Opcode Fuzzy Hash: 31397fa893d60fcaad9e84a1507602198c1ed810d2e86ca8085b537d3b5711df
Instruction Fuzzy Hash: 19E0E523E44002DAEB2B7E2184D167A26A1AF44704FA40C30D20FC26B1DE1EE989C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989D650, Relevance: 4.6, APIs: 3, Instructions: 124fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF6E989D67F
FindNextFileW.KERNEL32 ref: 00007FF6E989D6DA
FindClose.KERNEL32 ref: 00007FF6E989D725

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 09d374499ea2b7e8adca321e9558e603963925270b407fb1530a538814a86972
Instruction ID: f92fef9b7abeaf0dd99258162b96ad81af8fc4be62bd3dd3e4ed657632ec5b2b
Opcode Fuzzy Hash: 09d374499ea2b7e8adca321e9558e603963925270b407fb1530a538814a86972
Instruction Fuzzy Hash: 3B517C37608B4685EA10DF25E4943AE67A0FF84B94F454A32DE5E833B1DE3EE441C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989CAF0, Relevance: 4.6, APIs: 3, Instructions: 69COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF6E989CB10
GetDiskFreeSpaceExW.KERNEL32 ref: 00007FF6E989CB86
SetErrorMode.KERNEL32 ref: 00007FF6E989CBED

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 3bff11e97c7c24fdd33a4117791dba73adfda3d3f81684dfbad0444118e45fcd
Instruction ID: 601b1c82e959139e88c9fcb679e4fb66ff365b2380fd7a0be720406e46ba4be1
Opcode Fuzzy Hash: 3bff11e97c7c24fdd33a4117791dba73adfda3d3f81684dfbad0444118e45fcd
Instruction Fuzzy Hash: 95316F37608A8582E710DF25E4403AA7765FF88B98F118532EB8E87765CF3ED046C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E988609C, Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E984652C: malloc.LIBCMT ref: 00007FF6E9846546

Part of subcall function 00007FF6E984652C: _callnewh.LIBCMT ref: 00007FF6E984653A
Part of subcall function 00007FF6E984652C: _CxxThrowException.LIBCMT ref: 00007FF6E984658F

LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6E9886108
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,?,00007FF6E988595D), ref: 00007FF6E9886146
GetLastError.KERNEL32(?,?,?,?,?,00007FF6E988595D), ref: 00007FF6E9886154

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: AdjustErrorExceptionLastLookupPrivilegePrivilegesThrowTokenValue_callnewhmalloc
String ID:
API String ID: 3247884264-0
Opcode ID: e1ec485131c1a4c0e934abdc32366330b8882e9d8dcbcb31643d6b4a5154609b
Instruction ID: ead3196f0e1517e3734de0b7c03c541249239b7521acd86bce149ce7a9d4bbee
Opcode Fuzzy Hash: e1ec485131c1a4c0e934abdc32366330b8882e9d8dcbcb31643d6b4a5154609b
Instruction Fuzzy Hash: A8216077608B81D6D714CF22F54015EBBA5FB88B80B498935DB8D83B25CF39E1A6C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9893AA4, Relevance: 4.6, APIs: 3, Instructions: 51fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6E9893AE6
DeviceIoControl.KERNEL32 ref: 00007FF6E9893B42
CloseHandle.KERNEL32 ref: 00007FF6E9893B4D

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 9ea3ec2d5bead07921bab68affa3cf8f8e7964d131304bef2946448365224d8d
Instruction ID: 1faceaf05f85714bf6e936931fef705662542071de8f28d3c0418e1e81c23af3
Opcode Fuzzy Hash: 9ea3ec2d5bead07921bab68affa3cf8f8e7964d131304bef2946448365224d8d
Instruction Fuzzy Hash: 59214C33608B8196E7608F29F444A1BBBE4FB947A4F140636EA9D43BA8DF3DC5558B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98949B0, Relevance: 4.5, APIs: 3, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,00007FF6E986F148,?,?,?,00000001,?,00007FF6E9839E20), ref: 00007FF6E98949F9
CheckTokenMembership.ADVAPI32(?,?,?,?,?,00007FF6E986F148,?,?,?,00000001,?,00007FF6E9839E20), ref: 00007FF6E9894A10
FreeSid.ADVAPI32(?,?,?,?,?,00007FF6E986F148,?,?,?,00000001,?,00007FF6E9839E20), ref: 00007FF6E9894A21

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 05dfdfb9700f2bb0d96066ded5b5b80a89cb5612d53a61f2e8c334d4469da21c
Instruction ID: ac1b7515fa6d12e92befc57c9d6fa607e59594e467bf91d1a6531f6d31ba463d
Opcode Fuzzy Hash: 05dfdfb9700f2bb0d96066ded5b5b80a89cb5612d53a61f2e8c334d4469da21c
Instruction Fuzzy Hash: 54010573A18781DFD7208F25E88159A77B0F748788B501A2AE68DC7A68DF3DC158CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9894364, Relevance: 4.5, APIs: 3, Instructions: 19fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF6E9894370
FindFirstFileW.KERNEL32 ref: 00007FF6E9894383
FindClose.KERNEL32 ref: 00007FF6E9894397

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 578c744135e5db6f90901ecc251efcb77189f9b2c3a1f5cecb14beacfa865e76
Instruction ID: dc581a66874986c419be5b945f8e935207f51cca51efc30e6f4f525fae18f1c5
Opcode Fuzzy Hash: 578c744135e5db6f90901ecc251efcb77189f9b2c3a1f5cecb14beacfa865e76
Instruction Fuzzy Hash: C1E09A22E18642C2ED204F35BC4833A2210AF45735F100B34E93E893F0CE2ED488960A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98A5690, Relevance: 3.1, APIs: 2, Instructions: 94networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET ref: 00007FF6E98A56C5
InternetReadFile.WININET ref: 00007FF6E98A570E

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 94222d286ba8b6e6437969e9a7fe57eb32169d44c3adb3e2f06135f41337023a
Instruction ID: dba2fb2e6ef88c711740be30f3773aec1d8a556144b347da39b4650f2d2be158
Opcode Fuzzy Hash: 94222d286ba8b6e6437969e9a7fe57eb32169d44c3adb3e2f06135f41337023a
Instruction Fuzzy Hash: 3A319637B05A01C5FB588E25D4507BE2394FF44B98F144836DE0E87BA8DF7AD8818705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989E378, Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF6E989E39F
FindClose.KERNEL32 ref: 00007FF6E989E3E9

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3985a479cc79aa63bef513cc241f1c83ef4b39ab78c0fc202771e60bcb1b6e8d
Instruction ID: 6d3c4bf7a6c889e91fbca4327ec3493e549a410e2b70896b6a1160f47fb2173b
Opcode Fuzzy Hash: 3985a479cc79aa63bef513cc241f1c83ef4b39ab78c0fc202771e60bcb1b6e8d
Instruction Fuzzy Hash: 20115133708641C6DB10DF25E1843AA7760FF84B64F048635DA6D8B7A6CF7DD4588745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989B364, Relevance: 3.0, APIs: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00007FF6E98AE40F), ref: 00007FF6E989B387
FormatMessageW.KERNEL32 ref: 00007FF6E989B3B1

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: f311cceefec5d6ba9f2d764b6cf7e19c927bf9d0953334814c730ffb94e2fc0b
Instruction ID: 07b7f379c9dc16dbefef73eba7bd46237baaaccce94535cfce424a0762c20418
Opcode Fuzzy Hash: f311cceefec5d6ba9f2d764b6cf7e19c927bf9d0953334814c730ffb94e2fc0b
Instruction Fuzzy Hash: FAF06263618B4292E7209F25F40475BB261FF88794F144235EB9D87BB5DF3DC4448B05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E983F6B0, Relevance: 2.2, APIs: 1, Instructions: 734COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0a5bbb2205f39b37cff22e163278cec61ca57024789aac54c93da99ba006de
Instruction ID: 6bdcd0a002726c9fa6b0c94c1326267b4961a9e25145c22e01617fdb9b2126fd
Opcode Fuzzy Hash: 0f0a5bbb2205f39b37cff22e163278cec61ca57024789aac54c93da99ba006de
Instruction Fuzzy Hash: 3762BB63B08A028AFB10EF75D4143BE23A5AF44798F404A35DA1ED7BE5DF3AE4418749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E982A3C0, Relevance: 2.0, APIs: 1, Instructions: 549COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _itow_swprintf
String ID:
API String ID: 479854253-0
Opcode ID: b918634e8c34c18b406508d87c04e4cada4a2b9a415d4c00668d75a3d81779a8
Instruction ID: 642201603fa0dc3bc5869561a9b2eac6dce1a6904028fa648bc0e7504e7ba7e2
Opcode Fuzzy Hash: b918634e8c34c18b406508d87c04e4cada4a2b9a415d4c00668d75a3d81779a8
Instruction Fuzzy Hash: 4A32BF33B1868286EB10DF21D4403AE27A4FF44798F504936DA4E87BE6DF3AE545C749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E982EE80, Relevance: 1.8, Strings: 1, Instructions: 590COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00007FF6E986BC52

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: a43d4a13ade37f74a655b44ba57fbe3838030ab518007f597a313e607930b465
Instruction ID: 55c9cfc08cbfd7191614a8ac1e99928c4b2d18908ec05a853340d719155693f7
Opcode Fuzzy Hash: a43d4a13ade37f74a655b44ba57fbe3838030ab518007f597a313e607930b465
Instruction Fuzzy Hash: E1424E73A186428AEB50DF60C0543FE33A1EF45748F904936DE0D9B6A6DF3AE945C34A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9899638, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_time64.LIBCMT ref: 00007FF6E9899650

Part of subcall function 00007FF6E984ABD4: GetSystemTimeAsFileTime.KERNEL32(?,?,?,00007FF6E9899E34,?,?,00000010,00007FF6E989A051), ref: 00007FF6E984ABE2

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Time$FileSystem_time64
String ID:
API String ID: 4083121002-0
Opcode ID: a10dec2511958714b668aa11c27b3c8a1b99fbdbc43f6d2f6fa9158a53f9a420
Instruction ID: 60d15999be1f430156786adffea3e544033199abb28f5138a253ea4aeee56832
Opcode Fuzzy Hash: a10dec2511958714b668aa11c27b3c8a1b99fbdbc43f6d2f6fa9158a53f9a420
Instruction Fuzzy Hash: 87216633664505C7EB09CF36D840BAA33A2FB94744F48C635D61887298DF3EA509CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9894D60, Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

mouse_event.USER32 ref: 00007FF6E9894D9A

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: b52ef07dc038847b05df94ed8a5b4ccf7e9bdd18ec5a62e6461b3bab64dc45ad
Instruction ID: ce986f7fc15708a3c0191a77b8a76a3fb7782ccdf4ff588461d514296468c907
Opcode Fuzzy Hash: b52ef07dc038847b05df94ed8a5b4ccf7e9bdd18ec5a62e6461b3bab64dc45ad
Instruction Fuzzy Hash: 07E0461FE2C5A78AF7A02F70A4267371255BF90344F946970C64E867F18E2E6405AA2F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98A76F8, Relevance: 1.5, APIs: 1, Instructions: 23keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32 ref: 00007FF6E98A771E

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 3783b014e570f6815370e073df570e4510d0a807033ed3c8754cb321e5f4e0f1
Instruction ID: 6a44b92c26373eb27703ecd91f18a4d5c76081c3df677b67dccddca48dfa823b
Opcode Fuzzy Hash: 3783b014e570f6815370e073df570e4510d0a807033ed3c8754cb321e5f4e0f1
Instruction Fuzzy Hash: 10E06533A04242C2EB445F21E44037A62D0EF88B84F544835DE4AC73A5DE7ED8914705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9869B1D, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00007FF6E9869B32

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 6736ea11b249f80caefdc7d3275b58b76262fba870a22dcc5233b4e6ea6e0529
Instruction ID: be22b1caacdba1eb64a312d2891b6c06dd9627d737df08ed00cf8f24d328037a
Opcode Fuzzy Hash: 6736ea11b249f80caefdc7d3275b58b76262fba870a22dcc5233b4e6ea6e0529
Instruction Fuzzy Hash: FCC0C9A2104BC3DADB608F20CC942E82320FB00749F404821D21D9A468DF78C28CC301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9827EF4, Relevance: .6, Instructions: 550COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc4fec618c929fe7b25ae9c4042112cdc148683744ca6ea44ed3f11a94910016
Instruction ID: ba8b7afb18f4f44f6e732b2ebaad73ef7c8bded3e312f9ece47ee67a59d1067c
Opcode Fuzzy Hash: dc4fec618c929fe7b25ae9c4042112cdc148683744ca6ea44ed3f11a94910016
Instruction Fuzzy Hash: A6327033A2C6558AEB148F65D4503BE77A0FF44784F604835EA4E87AA5CF3AF881CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BAAF8, Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 369windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00007FF6E98BAC0C

Part of subcall function 00007FF6E9886970: SendMessageW.USER32 ref: 00007FF6E9886A17
Part of subcall function 00007FF6E9886970: SendMessageW.USER32 ref: 00007FF6E9886A34
Part of subcall function 00007FF6E9886970: SendMessageW.USER32 ref: 00007FF6E9886A6A

SendMessageW.USER32 ref: 00007FF6E98BAF4C
SendMessageW.USER32 ref: 00007FF6E98BAF7A
SendMessageW.USER32 ref: 00007FF6E98BB08D

Part of subcall function 00007FF6E98865E0: SendMessageW.USER32 ref: 00007FF6E988662F

Strings

EDITPASTE, xrefs: 00007FF6E98BAFCD
DELSTRING, xrefs: 00007FF6E98BAD9A
ISVISIBLE, xrefs: 00007FF6E98BABF5
GETLINE, xrefs: 00007FF6E98BB008
ISCHECKED, xrefs: 00007FF6E98BAE95
SELECTSTRING, xrefs: 00007FF6E98BAE60
UNCHECK, xrefs: 00007FF6E98BAEE2
GETCURRENTSELECTION, xrefs: 00007FF6E98BAE3B
ADDSTRING, xrefs: 00007FF6E98BAD65
TABRIGHT, xrefs: 00007FF6E98BAC66
SETCURRENTSELECTION, xrefs: 00007FF6E98BAE0B
HIDEDROPDOWN, xrefs: 00007FF6E98BAD4A
FINDSTRING, xrefs: 00007FF6E98BADCA
GETCURRENTLINE, xrefs: 00007FF6E98BAF57
CURRENTTAB, xrefs: 00007FF6E98BAC8A
GETLINECOUNT, xrefs: 00007FF6E98BAF2A
ISENABLED, xrefs: 00007FF6E98BAC2E
SHOWDROPDOWN, xrefs: 00007FF6E98BACC2
GETCURRENTCOL, xrefs: 00007FF6E98BAF97
SENDCOMMANDID, xrefs: 00007FF6E98BB050
CHECK, xrefs: 00007FF6E98BAEC9
TABLEFT, xrefs: 00007FF6E98BAC4D
GETSELECTED, xrefs: 00007FF6E98BAF05

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend$VisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 1853625526-45149045
Opcode ID: b5e2c22e6bbd595bb89f24adab3a32680ec75a5f961bab3a151458affe8dc9cd
Instruction ID: ef985f1e01a33968502e3dd1e5e3abb2546d2abdf97c665daac2535aaab95a06
Opcode Fuzzy Hash: b5e2c22e6bbd595bb89f24adab3a32680ec75a5f961bab3a151458affe8dc9cd
Instruction Fuzzy Hash: 56F17067A0860691FA10DF51D4543BE2375BF44788F584932CE0E976BAEF2AE406C34A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C3CA0, Relevance: 49.7, APIs: 33, Instructions: 229windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 00007FF6E98C3D08
SetTextColor.GDI32 ref: 00007FF6E98C3D13
GetSysColorBrush.USER32 ref: 00007FF6E98C3D2C
GetSysColor.USER32 ref: 00007FF6E98C3D3E
SetBkColor.GDI32 ref: 00007FF6E98C3D5F
SelectObject.GDI32(?,?,?,?,?,00000000,?,?,?,?,?,00007FF6E98C64F1,?,?,?,00007FF6E9863CDA), ref: 00007FF6E98C3D6E
InflateRect.USER32 ref: 00007FF6E98C3D93
GetSysColor.USER32 ref: 00007FF6E98C3D9E
CreateSolidBrush.GDI32 ref: 00007FF6E98C3DA6
FrameRect.USER32 ref: 00007FF6E98C3DB9
DeleteObject.GDI32 ref: 00007FF6E98C3DC2
InflateRect.USER32 ref: 00007FF6E98C3E17
FillRect.USER32 ref: 00007FF6E98C3E47
GetWindowLongW.USER32 ref: 00007FF6E98C3E6B
SendMessageW.USER32(?,?,?,?,?,00000000,?,?,?), ref: 00007FF6E98C3EAC

Part of subcall function 00007FF6E98C3FF0: GetSysColor.USER32 ref: 00007FF6E98C4037
Part of subcall function 00007FF6E98C3FF0: SetTextColor.GDI32 ref: 00007FF6E98C4042
Part of subcall function 00007FF6E98C3FF0: GetSysColorBrush.USER32 ref: 00007FF6E98C405D
Part of subcall function 00007FF6E98C3FF0: GetSysColor.USER32 ref: 00007FF6E98C4070
Part of subcall function 00007FF6E98C3FF0: GetSysColor.USER32 ref: 00007FF6E98C409B
Part of subcall function 00007FF6E98C3FF0: CreatePen.GDI32 ref: 00007FF6E98C40B2
Part of subcall function 00007FF6E98C3FF0: SelectObject.GDI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E98C3CD0), ref: 00007FF6E98C40C3
Part of subcall function 00007FF6E98C3FF0: SetBkColor.GDI32 ref: 00007FF6E98C40D3
Part of subcall function 00007FF6E98C3FF0: SelectObject.GDI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E98C3CD0), ref: 00007FF6E98C40E6
Part of subcall function 00007FF6E98C3FF0: InflateRect.USER32 ref: 00007FF6E98C410D
Part of subcall function 00007FF6E98C3FF0: RoundRect.GDI32 ref: 00007FF6E98C4139
Part of subcall function 00007FF6E98C3FF0: GetWindowLongW.USER32 ref: 00007FF6E98C414C
Part of subcall function 00007FF6E98C3FF0: SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E98C3CD0), ref: 00007FF6E98C418D

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongMessageSendTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 644464405-0
Opcode ID: 42fc0dea3af09ae13a238ab56a5bd80ce95a0ff0b4d3a84775bca7de6b5bd2c6
Instruction ID: 208e5f17f8874cb4af11f66d0dc8caa73f5a1db139b949ec48a558659058b535
Opcode Fuzzy Hash: 42fc0dea3af09ae13a238ab56a5bd80ce95a0ff0b4d3a84775bca7de6b5bd2c6
Instruction Fuzzy Hash: 3FA1A023F0860286EB149F71D94467E2361BF58B64F104B35DE2E9BBE4DF3E94458346

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989C334, Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 219COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF6E989C365
GetDriveTypeW.KERNEL32 ref: 00007FF6E989C453
SetErrorMode.KERNEL32 ref: 00007FF6E989C64C

Strings

1394, xrefs: 00007FF6E989C574
SAS, xrefs: 00007FF6E989C5F7
iSCSI, xrefs: 00007FF6E989C600
Fibre, xrefs: 00007FF6E989C55C
MMC, xrefs: 00007FF6E989C5DC
SSA, xrefs: 00007FF6E989C568
USB, xrefs: 00007FF6E989C550
Network, xrefs: 00007FF6E989C49E
Unknown, xrefs: 00007FF6E989C47A, 00007FF6E989C59B
SCSI, xrefs: 00007FF6E989C592
Virtual, xrefs: 00007FF6E989C5D3
Removable, xrefs: 00007FF6E989C4B6
PhysicalDrive, xrefs: 00007FF6E989C3F6
RAMDisk, xrefs: 00007FF6E989C486
SATA, xrefs: 00007FF6E989C5EE
FileBackedVirtual, xrefs: 00007FF6E989C5CA
ATA, xrefs: 00007FF6E989C580
RAID, xrefs: 00007FF6E989C5A4
CDROM, xrefs: 00007FF6E989C492
Fixed, xrefs: 00007FF6E989C4AA
\\.\, xrefs: 00007FF6E989C3B2
ATAPI, xrefs: 00007FF6E989C589
SSD, xrefs: 00007FF6E989C4F3

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 1a9b70c1c7a7056160bba434ee24eced737538e7b2d0e5121fa5bf5473b2db4e
Instruction ID: 63245a19e1f39cab15c165b04168c45f7c0276f890fa503f788f4fc267dd8a97
Opcode Fuzzy Hash: 1a9b70c1c7a7056160bba434ee24eced737538e7b2d0e5121fa5bf5473b2db4e
Instruction Fuzzy Hash: 56A13873A08A0794FA54CF15D8902BA2361BF54784FA0683AD90ED76B5DF2FE945C30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C3FF0, Relevance: 39.2, APIs: 26, Instructions: 177windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 00007FF6E98C4037
SetTextColor.GDI32 ref: 00007FF6E98C4042
GetSysColorBrush.USER32 ref: 00007FF6E98C405D
GetSysColor.USER32 ref: 00007FF6E98C4070
CreateSolidBrush.GDI32 ref: 00007FF6E98C407A
GetSysColor.USER32 ref: 00007FF6E98C409B
CreatePen.GDI32 ref: 00007FF6E98C40B2
SelectObject.GDI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E98C3CD0), ref: 00007FF6E98C40C3
SetBkColor.GDI32 ref: 00007FF6E98C40D3
SelectObject.GDI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E98C3CD0), ref: 00007FF6E98C40E6
InflateRect.USER32 ref: 00007FF6E98C410D
RoundRect.GDI32 ref: 00007FF6E98C4139
GetWindowLongW.USER32 ref: 00007FF6E98C414C
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E98C3CD0), ref: 00007FF6E98C418D
GetWindowTextW.USER32 ref: 00007FF6E98C41C5
InflateRect.USER32 ref: 00007FF6E98C41E8
DrawFocusRect.USER32 ref: 00007FF6E98C41F6
GetSysColor.USER32 ref: 00007FF6E98C4205
SetTextColor.GDI32 ref: 00007FF6E98C4210
DrawTextW.USER32 ref: 00007FF6E98C422E
SelectObject.GDI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E98C3CD0), ref: 00007FF6E98C424C
DeleteObject.GDI32 ref: 00007FF6E98C425A
SelectObject.GDI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E98C3CD0), ref: 00007FF6E98C4268
DeleteObject.GDI32 ref: 00007FF6E98C4273
SetTextColor.GDI32 ref: 00007FF6E98C427F
SetBkColor.GDI32 ref: 00007FF6E98C428F

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 817475938d5e72356ed435eae8f321ed9741810ee6a3434b873b2d338ade9214
Instruction ID: c16b77f4ae50f7b2e44e8045aa672ebe16b9f98b3ba95c8e7f190718f343deed
Opcode Fuzzy Hash: 817475938d5e72356ed435eae8f321ed9741810ee6a3434b873b2d338ade9214
Instruction Fuzzy Hash: F5719037A08A4186EA249F21E94477B7361FF88BA0F104734DE5E8B7A4DF3ED4858706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E988A5E8, Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 153windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32 ref: 00007FF6E988A616
SendMessageW.USER32 ref: 00007FF6E988A62E
SetWindowTextW.USER32 ref: 00007FF6E988A648
GetDlgItem.USER32 ref: 00007FF6E988A660
SetWindowTextW.USER32 ref: 00007FF6E988A66D
GetDlgItem.USER32 ref: 00007FF6E988A687
SetWindowTextW.USER32 ref: 00007FF6E988A694
SendDlgItemMessageW.USER32 ref: 00007FF6E988A6BA
SendDlgItemMessageW.USER32 ref: 00007FF6E988A6DE
GetWindowRect.USER32 ref: 00007FF6E988A6EF
SetWindowTextW.USER32 ref: 00007FF6E988A754
GetDesktopWindow.USER32 ref: 00007FF6E988A75A
GetWindowRect.USER32 ref: 00007FF6E988A767
MoveWindow.USER32 ref: 00007FF6E988A7BC
GetClientRect.USER32 ref: 00007FF6E988A7CD
PostMessageW.USER32 ref: 00007FF6E988A801
SetTimer.USER32 ref: 00007FF6E988A832

Strings

@, xrefs: 00007FF6E988A776

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID: @
API String ID: 3869813825-2766056989
Opcode ID: 85a586dd7fa94f020b18cc40ac63b645ac4c9fd90494598a59b5e0a27132cf2b
Instruction ID: 1d1f8ee10e961d8a2c7b16e23c2d2746bc7e83ff2caae50c1a991386a679a886
Opcode Fuzzy Hash: 85a586dd7fa94f020b18cc40ac63b645ac4c9fd90494598a59b5e0a27132cf2b
Instruction Fuzzy Hash: EE71AA77A04A4196E710CF75D80426E33B5FF84B99F448A31CE4D9B6A8CF3AD885C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9823F4C, Relevance: 28.7, APIs: 19, Instructions: 199COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E982450C: GetWindowLongPtrW.USER32 ref: 00007FF6E9824529

GetSysColor.USER32 ref: 00007FF6E9823F97
GetSysColor.USER32 ref: 00007FF6E982402F
SetTextColor.GDI32 ref: 00007FF6E982403A
SetBkMode.GDI32 ref: 00007FF6E982404F
GetStockObject.GDI32 ref: 00007FF6E982405A
GetSysColor.USER32 ref: 00007FF6E98642CC
SetBkColor.GDI32 ref: 00007FF6E98643BF

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Color$LongModeObjectStockTextWindow
String ID:
API String ID: 1860813098-0
Opcode ID: 23f2814a7cc347a15106ebb1989935e4d8025b7434c88a53f31760518f753b2b
Instruction ID: 627736b69b9e19aee947c014c13692efab8018725abcd8f4d77ddaa2c8e77d3b
Opcode Fuzzy Hash: 23f2814a7cc347a15106ebb1989935e4d8025b7434c88a53f31760518f753b2b
Instruction Fuzzy Hash: 6881A323918553C1EA748F35944833F2291EF85760F255A31CA6ECB7F1DE3EE881821B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BB570, Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 285COMMON

Download Yara Rule

Strings

SELECTINVERT, xrefs: 00007FF6E98BB809
GETITEMCOUNT, xrefs: 00007FF6E98BB663
SELECTALL, xrefs: 00007FF6E98BB78C
SELECTCLEAR, xrefs: 00007FF6E98BB7A9
GETTEXT, xrefs: 00007FF6E98BB6B6
FINDITEM, xrefs: 00007FF6E98BB8BD
GETSUBITEMCOUNT, xrefs: 00007FF6E98BB684
GETSELECTEDCOUNT, xrefs: 00007FF6E98BB6FB
SELECT, xrefs: 00007FF6E98BB7C9
VIEWCHANGE, xrefs: 00007FF6E98BB911
ISSELECTED, xrefs: 00007FF6E98BB72B
DESELECT, xrefs: 00007FF6E98BB82A
GETSELECTED, xrefs: 00007FF6E98BB874

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID:
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 0-719923060
Opcode ID: ec24266bd17e985f83b7b703de8a1dea29a121fa79b6dbd34c993fbe4c2ecfea
Instruction ID: a5e01e0dd9ea7bac29030d36a6c86a101e4b9049d366f83c1ab355800bc022ea
Opcode Fuzzy Hash: ec24266bd17e985f83b7b703de8a1dea29a121fa79b6dbd34c993fbe4c2ecfea
Instruction Fuzzy Hash: FFD13E27B08A0681EA10EF61D4503BE2770EF44794F584931DA4ED77B6EF3AE546C34A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989A08C, Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 284fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E984652C: malloc.LIBCMT ref: 00007FF6E9846546

Part of subcall function 00007FF6E9899E24: _time64.LIBCMT ref: 00007FF6E9899E2F

Part of subcall function 00007FF6E983B5D4: _errno.LIBCMT ref: 00007FF6E984B300
Part of subcall function 00007FF6E983B5D4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E984B30B

_wsplitpath.LIBCMT ref: 00007FF6E989A185

Part of subcall function 00007FF6E98484B8: _wsplitpath_helper.LIBCMT ref: 00007FF6E984852B

wcscpy.LIBCMT ref: 00007FF6E989A196
wcscat.LIBCMT ref: 00007FF6E989A1A9
_wsplitpath.LIBCMT ref: 00007FF6E989A1D4
wcscat.LIBCMT ref: 00007FF6E989A1E7
wcscat.LIBCMT ref: 00007FF6E989A1FA

Part of subcall function 00007FF6E983B5FC: _fread_nolock.LIBCMT ref: 00007FF6E983B629

GetTempPathW.KERNEL32 ref: 00007FF6E989A321
GetTempFileNameW.KERNEL32 ref: 00007FF6E989A33F

Part of subcall function 00007FF6E984AC34: _errno.LIBCMT ref: 00007FF6E984AC71
Part of subcall function 00007FF6E984AC34: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E984AC7C

fwrite.LIBCMT ref: 00007FF6E989A433
fclose.LIBCMT ref: 00007FF6E989A451
DeleteFileW.KERNEL32 ref: 00007FF6E989A463
DeleteFileW.KERNEL32 ref: 00007FF6E989A4F9

Strings

aut, xrefs: 00007FF6E989A32E

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Filewcscat$DeleteTemp_errno_invalid_parameter_noinfo_wsplitpath$NamePath_fread_nolock_time64_wsplitpath_helperfclosefwritemallocwcscpy
String ID: aut
API String ID: 1327335939-3010740371
Opcode ID: e2b7201c4c4e5192c91f775d8093802c57d478b43330059306b09a488d6799dc
Instruction ID: 1fc3b2661ca41a72e0ede65d46438e36c2d24e1a53125d424504b6beb23487e3
Opcode Fuzzy Hash: e2b7201c4c4e5192c91f775d8093802c57d478b43330059306b09a488d6799dc
Instruction Fuzzy Hash: 52D19173614A8295EB20DF65E8402EE7764FF84788F400436EA8D8BBA9DF7AD245C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98943AC, Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 140COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION ref: 00007FF6E98943D1

Part of subcall function 00007FF6E984652C: malloc.LIBCMT ref: 00007FF6E9846546

GetFileVersionInfoW.VERSION ref: 00007FF6E98943F9

Part of subcall function 00007FF6E984652C: _callnewh.LIBCMT ref: 00007FF6E984653A
Part of subcall function 00007FF6E984652C: _CxxThrowException.LIBCMT ref: 00007FF6E984658F

wcscpy.LIBCMT ref: 00007FF6E9894436
wcscat.LIBCMT ref: 00007FF6E9894458
wcsstr.LIBCMT ref: 00007FF6E9894463
VerQueryValueW.VERSION ref: 00007FF6E9894484
wcscat.LIBCMT ref: 00007FF6E98944C4
wcscat.LIBCMT ref: 00007FF6E98944CF
wcscat.LIBCMT ref: 00007FF6E98944DA
VerQueryValueW.VERSION ref: 00007FF6E9894530
_swprintf.LIBCMT ref: 00007FF6E9894575

Strings

04090000, xrefs: 00007FF6E98944BA
\VarFileInfo\Translation, xrefs: 00007FF6E989447A
DefaultLangCodepage, xrefs: 00007FF6E98944DF
%u.%u.%u.%u, xrefs: 00007FF6E989454E
StringFileInfo\, xrefs: 00007FF6E989444E

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: wcscat$FileInfoQueryValueVersion$ExceptionSizeThrow_callnewh_swprintfmallocwcscpywcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 3674950261-1459072770
Opcode ID: 5b8a2d9ca41c68b241709ee1f7cfc858d60766cc4cc9b3304db73ed498b04320
Instruction ID: cfe875251b58fb7a50cd65b365731ee0debc831fad53a9e17d3e17398099acf9
Opcode Fuzzy Hash: 5b8a2d9ca41c68b241709ee1f7cfc858d60766cc4cc9b3304db73ed498b04320
Instruction Fuzzy Hash: 8751916370865245EA14DF6298103BB23A5FF85FD0F405931ED0D8BBA6DF3EE5068B0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C653C, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 161windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9824560: GetWindowLongPtrW.USER32 ref: 00007FF6E982457D

DragQueryPoint.SHELL32 ref: 00007FF6E98C6580

Part of subcall function 00007FF6E98C4348: ClientToScreen.USER32 ref: 00007FF6E98C4389
Part of subcall function 00007FF6E98C4348: GetWindowRect.USER32 ref: 00007FF6E98C4418
Part of subcall function 00007FF6E98C4348: PtInRect.USER32 ref: 00007FF6E98C4428

SendMessageW.USER32 ref: 00007FF6E98C65F7
DragQueryFileW.SHELL32 ref: 00007FF6E98C6609
DragQueryFileW.SHELL32 ref: 00007FF6E98C662F
wcscat.LIBCMT ref: 00007FF6E98C6663
SendMessageW.USER32 ref: 00007FF6E98C667A
SendMessageW.USER32 ref: 00007FF6E98C6694
SendMessageW.USER32 ref: 00007FF6E98C66AC
SendMessageW.USER32 ref: 00007FF6E98C66D1
DragFinish.SHELL32 ref: 00007FF6E98C66DA
DefDlgProcW.USER32 ref: 00007FF6E98C6810

Strings

@GUI_DROPID, xrefs: 00007FF6E98C66FD
@GUI_DRAGID, xrefs: 00007FF6E98C6751
@GUI_DRAGFILE, xrefs: 00007FF6E98C679F

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreenwcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 2091158083-3440237614
Opcode ID: 28df24327ff21d8fd4b9c7f627a236e19b4fd5bea50603afb7479ef006cbd921
Instruction ID: b3e32805da1f01161d9188954cb4b373467527d9988f46733da9ace16dcbf3c0
Opcode Fuzzy Hash: 28df24327ff21d8fd4b9c7f627a236e19b4fd5bea50603afb7479ef006cbd921
Instruction Fuzzy Hash: 7771A133618A8296E710DF65E8447EE7320FF84758F400532EA4D87AA9DFBED549CB06

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BBCA8, Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 271windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6E98BBDBF

Strings

GETITEMCOUNT, xrefs: 00007FF6E98BBEB4
GETTOTALCOUNT, xrefs: 00007FF6E98BBD9D
ISCHECKED, xrefs: 00007FF6E98BBF65
EXPAND, xrefs: 00007FF6E98BBE7C
UNCHECK, xrefs: 00007FF6E98BBFFE
EXISTS, xrefs: 00007FF6E98BBE30
COLLAPSE, xrefs: 00007FF6E98BBE07
GETTEXT, xrefs: 00007FF6E98BBF1D
SELECT, xrefs: 00007FF6E98BBFCC
CHECK, xrefs: 00007FF6E98BBDDB
GETSELECTED, xrefs: 00007FF6E98BBEEB

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3850602802-4258414348
Opcode ID: e096a90a91673f132f09a77a64e0f5407e5c9b1b2a2e0e4eee6a4f53c4277468
Instruction ID: 24f3cb4f53813d18d3c4a319f0549e39b9f1ddfa94845d100287a04752cf845d
Opcode Fuzzy Hash: e096a90a91673f132f09a77a64e0f5407e5c9b1b2a2e0e4eee6a4f53c4277468
Instruction Fuzzy Hash: 7EC18227A0864685EB10DF25D4512BE2770FF48B84B495832CE4E873BADF3AE446C346

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C5454, Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 182windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32 ref: 00007FF6E98C553E
LoadLibraryExW.KERNEL32(?,?,?,?,00000000,00007FF6E98BF20D), ref: 00007FF6E98C55AD
LoadImageW.USER32 ref: 00007FF6E98C55F1
LoadImageW.USER32 ref: 00007FF6E98C564C
LoadImageW.USER32 ref: 00007FF6E98C5691
FreeLibrary.KERNEL32(?,?,00000000,00007FF6E98BF20D), ref: 00007FF6E98C56A5
ExtractIconExW.SHELL32 ref: 00007FF6E98C56B7
DestroyIcon.USER32 ref: 00007FF6E98C56C9
SendMessageW.USER32 ref: 00007FF6E98C56E8
SendMessageW.USER32 ref: 00007FF6E98C5700

Part of subcall function 00007FF6E984713C: _errno.LIBCMT ref: 00007FF6E9847157
Part of subcall function 00007FF6E984713C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9847162

Part of subcall function 00007FF6E984713C: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF6E98471E1
Part of subcall function 00007FF6E984713C: _errno.LIBCMT ref: 00007FF6E98471F2
Part of subcall function 00007FF6E984713C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E98471FD

Strings

.dll, xrefs: 00007FF6E98C54F6
.icl, xrefs: 00007FF6E98C54AC
.exe, xrefs: 00007FF6E98C54D4

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Load$Image$IconLibraryLocaleMessageSend_errno_invalid_parameter_noinfo$DestroyExtractFreeUpdateUpdate::_
String ID: .dll$.exe$.icl
API String ID: 125756438-1154884017
Opcode ID: ebcc2a0d90a9d182943c86725b2107971276a70165ebbce0da1942e596103a0e
Instruction ID: 6f20d368629b2ec62c23492417927eddf5d9b9ab6e0a4bb95e2b9776e96253f5
Opcode Fuzzy Hash: ebcc2a0d90a9d182943c86725b2107971276a70165ebbce0da1942e596103a0e
Instruction Fuzzy Hash: 0B71B363A0965281EB24DF21D444BBE37A4FF44B88F500A36ED4D8BB60DF3EE4858706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989FBE8, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 161timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00007FF6E989FCC8
SystemTimeToFileTime.KERNEL32 ref: 00007FF6E989FCDA
LocalFileTimeToFileTime.KERNEL32 ref: 00007FF6E989FCEE
_wsplitpath.LIBCMT ref: 00007FF6E989FD64
wcscat.LIBCMT ref: 00007FF6E989FD77
wcscat.LIBCMT ref: 00007FF6E989FD88
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6E989FD99
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6E989FDA6
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6E989FDDD
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6E989FDFD
wcscpy.LIBCMT ref: 00007FF6E989FE0F
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6E989FE49

Strings

*.*, xrefs: 00007FF6E989FE03

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Localwcscat$System_wsplitpathwcscpy
String ID: *.*
API String ID: 4258629280-438819550
Opcode ID: 0ed86f64f36395bdb9f48bb58c5bc73453bddbf00b0ccf2042028354f577cbe3
Instruction ID: d4270bd9d510cb7eb0e5acbb92d7a831615a7001fb08f41a9a997ed72e85d215
Opcode Fuzzy Hash: 0ed86f64f36395bdb9f48bb58c5bc73453bddbf00b0ccf2042028354f577cbe3
Instruction Fuzzy Hash: 07713F33608B8696DB54DF21D8406EF6360FF88B88F404832DA4D8B766DF3AE946C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E988EB70, Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 128windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000080,00007FF6E986FE06,?,?,?,?,?,?,?,?,?,00000000,?,00007FF6E98A6FF3), ref: 00007FF6E988EBAA
LoadStringW.USER32 ref: 00007FF6E988EBC5
GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6E98A6FF3), ref: 00007FF6E988EBDA
LoadStringW.USER32 ref: 00007FF6E988EBEC
_swprintf.LIBCMT ref: 00007FF6E988EC46

Part of subcall function 00007FF6E98479E0: _errno.LIBCMT ref: 00007FF6E9847A18
Part of subcall function 00007FF6E98479E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9847A23

_swprintf.LIBCMT ref: 00007FF6E988EC54
wprintf.LIBCMT ref: 00007FF6E988ED2D
MessageBoxW.USER32 ref: 00007FF6E988ED45

Strings

Line %d (File "%s"):, xrefs: 00007FF6E988EC3F
^ ERROR, xrefs: 00007FF6E988ECB2
%s (%d) : ==> %s: %s %s, xrefs: 00007FF6E988ED1E
Error: , xrefs: 00007FF6E988ECE3
Line %d:, xrefs: 00007FF6E988EC4D

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: HandleLoadModuleString_swprintf$Message_errno_invalid_parameter_noinfowprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 2590161900-2268648507
Opcode ID: ef9a786e974d6c5327138460ef6baf3c48b2665fd6b1a3dc00c58a825f1f9acc
Instruction ID: 50e68fad41f4ad0609245600ade700ebe080a0325eeece396a9c00a7e744eaa5
Opcode Fuzzy Hash: ef9a786e974d6c5327138460ef6baf3c48b2665fd6b1a3dc00c58a825f1f9acc
Instruction Fuzzy Hash: 7851B523B18A4292EB00EF74E4452EEA321FF90744F805932E94DD3AAADF7DD509C746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98ABAE4, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 150windowCOMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6E98ABB7A
CreateCompatibleBitmap.GDI32 ref: 00007FF6E98ABB8C
CreateCompatibleDC.GDI32 ref: 00007FF6E98ABB99
SelectObject.GDI32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000001,?,00000000), ref: 00007FF6E98ABBA9
StretchBlt.GDI32 ref: 00007FF6E98ABC0E
GetDIBits.GDI32 ref: 00007FF6E98ABC54
GetDIBits.GDI32 ref: 00007FF6E98ABC8C
SelectObject.GDI32 ref: 00007FF6E98ABC9B
DeleteObject.GDI32 ref: 00007FF6E98ABCA4
DeleteDC.GDI32 ref: 00007FF6E98ABCAD
ReleaseDC.USER32 ref: 00007FF6E98ABCB8

Strings

, xrefs: 00007FF6E98ABBE1

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID:
API String ID: 2598888154-3916222277
Opcode ID: 1bc10f29ab3faedad9989b11113cce1932738474b28c4c669e797753af980522
Instruction ID: a80f5ae5974076d923c6fdb826b7c2a0352b574376680c810654f03c9a43eb64
Opcode Fuzzy Hash: 1bc10f29ab3faedad9989b11113cce1932738474b28c4c669e797753af980522
Instruction Fuzzy Hash: E9516A73A086418BD760CF35E444B6E77A4FB48B98F048535DE0987B68CF3ED8058B05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989AE50, Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 135COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6E989AEAD
LoadStringW.USER32 ref: 00007FF6E989AED3
_swprintf.LIBCMT ref: 00007FF6E989AF47
wprintf.LIBCMT ref: 00007FF6E989B01B
wprintf.LIBCMT ref: 00007FF6E989B037

Part of subcall function 00007FF6E9847F90: _errno.LIBCMT ref: 00007FF6E9847FB5
Part of subcall function 00007FF6E9847F90: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9847FC0

Strings

Line %d (File "%s"):, xrefs: 00007FF6E989AF20
Incorrect parameters to object property !, xrefs: 00007FF6E989AF98
"%s" (%d) : ==> %s:, xrefs: 00007FF6E989B030
^ ERROR , xrefs: 00007FF6E989AF87
"%s" (%d) : ==> %s:%s%s, xrefs: 00007FF6E989B007
Error: , xrefs: 00007FF6E989AFC9

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: LoadStringwprintf$_errno_invalid_parameter_noinfo_swprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 771680204-3080491070
Opcode ID: 2a5bd48e84061ff2b011ea7a9d95903e5ff82b3629fa0316ebddb9ec518a8f86
Instruction ID: d3769bd54aa0cf30f586c10ecb676b3214b7dbf1e407cc50f8c696929d289ce3
Opcode Fuzzy Hash: 2a5bd48e84061ff2b011ea7a9d95903e5ff82b3629fa0316ebddb9ec518a8f86
Instruction Fuzzy Hash: 99616123A28A4292EB00EF65E4447EE7360FF44744F401832EA4DD3AAADF7EE505C746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989B67C, Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E98267E4: _itow.LIBCMT ref: 00007FF6E9826834
Part of subcall function 00007FF6E98267E4: _swprintf.LIBCMT ref: 00007FF6E9826881

GetDriveTypeW.KERNEL32 ref: 00007FF6E989B767
mciSendStringW.WINMM ref: 00007FF6E989B7AF
mciSendStringW.WINMM ref: 00007FF6E989B7F2
mciSendStringW.WINMM ref: 00007FF6E989B829

Strings

wait, xrefs: 00007FF6E989B7D6
closed, xrefs: 00007FF6E989B728, 00007FF6E989B74C
type cdaudio alias cd wait, xrefs: 00007FF6E989B793
set cd door , xrefs: 00007FF6E989B7B9
open, xrefs: 00007FF6E989B738
open , xrefs: 00007FF6E989B776
close cd wait, xrefs: 00007FF6E989B80D
close, xrefs: 00007FF6E989B712

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: SendString$DriveType_itow_swprintf
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1019250336-4113822522
Opcode ID: 26e67528342e507611779cbc9e8873d2b237e7e292fb9498e3d5d6b08ed75224
Instruction ID: 6e3c31bb4e6ce21af32fb462b2098c21bcdf08f9692950aa49e0481a647c4669
Opcode Fuzzy Hash: 26e67528342e507611779cbc9e8873d2b237e7e292fb9498e3d5d6b08ed75224
Instruction Fuzzy Hash: C7515873B14A1A99EB00DF65D8942AE3370FF54B88B504832CA4D9777ADF3AE906C345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9883B18, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32 ref: 00007FF6E9883B5A
SafeArrayAllocData.OLEAUT32 ref: 00007FF6E9883BBC
VariantInit.OLEAUT32 ref: 00007FF6E9883BCE
SafeArrayAccessData.OLEAUT32 ref: 00007FF6E9883BF1
VariantCopy.OLEAUT32 ref: 00007FF6E9883C5D
SafeArrayUnaccessData.OLEAUT32 ref: 00007FF6E9883C71
VariantClear.OLEAUT32 ref: 00007FF6E9883C88
SafeArrayDestroyData.OLEAUT32 ref: 00007FF6E9883C97
SafeArrayDestroyDescriptor.OLEAUT32 ref: 00007FF6E9883CA1
VariantClear.OLEAUT32 ref: 00007FF6E9883CB4
SafeArrayDestroyDescriptor.OLEAUT32 ref: 00007FF6E9883CC0

Strings

NULL Pointer assignment, xrefs: 00007FF6E9883B27

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID: NULL Pointer assignment
API String ID: 2706829360-2785691316
Opcode ID: c084897528c46a5bf7f512ecb802522df8cd84c0913de1b2d7ceb5d3c875ca0a
Instruction ID: 8ee46a7d18a7530ff0a382e869839e8bf175cc3673a460a311e28ee958c8b9d1
Opcode Fuzzy Hash: c084897528c46a5bf7f512ecb802522df8cd84c0913de1b2d7ceb5d3c875ca0a
Instruction Fuzzy Hash: 44518033A14A529AEB04DF21D8447BE3371FF94B88F804832EE0E976A5DF3AD0468315

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E984836C, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 64librarythreadloaderCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6E98483A7
ExitThread.KERNEL32 ref: 00007FF6E98483AF
GetCurrentThreadId.KERNEL32 ref: 00007FF6E98483B6
_freefls.LIBCMT ref: 00007FF6E98483EA
__crtIsPackagedApp.LIBCMT ref: 00007FF6E98483EF
LoadLibraryExW.KERNEL32 ref: 00007FF6E984841C
GetProcAddress.KERNEL32 ref: 00007FF6E984842C
EncodePointer.KERNEL32 ref: 00007FF6E984843A
DecodePointer.KERNEL32 ref: 00007FF6E9848454
_callthreadstartex.LIBCMT ref: 00007FF6E9848469

Strings

combase.dll, xrefs: 00007FF6E984840D
RoInitialize, xrefs: 00007FF6E9848422

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: PointerThread$AddressCurrentDecodeEncodeErrorExitLastLibraryLoadPackagedProc__crt_callthreadstartex_freefls
String ID: RoInitialize$combase.dll
API String ID: 2737202619-340411864
Opcode ID: a6228b358abb2c47f237fe6e223514a14cf4c8f9407bf625496b20c42ca16439
Instruction ID: d0a99dd2dd2247d892ccacba22b25ddaceeb66aa5803bb95ba5eefff4309d116
Opcode Fuzzy Hash: a6228b358abb2c47f237fe6e223514a14cf4c8f9407bf625496b20c42ca16439
Instruction Fuzzy Hash: 13216F32A08B4396FB54AF71A8543AA6295BF04B80F044938D95EC7771EF3EE445870B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E983DB90, Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 435COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E983C10C: CreateFileW.KERNEL32 ref: 00007FF6E983C175

Part of subcall function 00007FF6E9845E98: GetCurrentDirectoryW.KERNEL32(?,00007FF6E983DC23), ref: 00007FF6E9845EB4

Part of subcall function 00007FF6E983A41C: GetFullPathNameW.KERNEL32(?,00007FF6E983A409,?,00007FF6E983C9BC,?,?,?,00007FF6E98210D6), ref: 00007FF6E983A43E

SetCurrentDirectoryW.KERNEL32 ref: 00007FF6E983DCB8

Part of subcall function 00007FF6E984652C: malloc.LIBCMT ref: 00007FF6E9846546

SetCurrentDirectoryW.KERNEL32 ref: 00007FF6E983DDF7

Part of subcall function 00007FF6E983C1E8: wcscpy.LIBCMT ref: 00007FF6E983C239

Strings

Error opening the file, xrefs: 00007FF6E9870324, 00007FF6E98703B6
AU3!, xrefs: 00007FF6E983DC67
EA06, xrefs: 00007FF6E9870341
Unterminated string, xrefs: 00007FF6E9870701
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00007FF6E98702F8
Bad directive syntax error, xrefs: 00007FF6E98706AB
>>>AUTOIT SCRIPT<<<, xrefs: 00007FF6E987038B

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: CurrentDirectory$CreateFileFullNamePathmallocwcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 3375989675-1018226102
Opcode ID: f735d6b03972354b95827954b27240af4e4f53eda53f50dd9d5c8f885cd290c0
Instruction ID: 308ae0ffc4b95bf932d0efb631d835b0a9953cbe7f67b39830092ecb7651a0b3
Opcode Fuzzy Hash: f735d6b03972354b95827954b27240af4e4f53eda53f50dd9d5c8f885cd290c0
Instruction Fuzzy Hash: B9128F63A0864686EA10EF21D4543BF7760FF95784F400931EA4E87ABADF3EE545C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9888630, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 240windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF6E9888695
_swprintf.LIBCMT ref: 00007FF6E988873B
SendMessageTimeoutW.USER32 ref: 00007FF6E98887B0
GetClassNameW.USER32 ref: 00007FF6E9888820
GetDlgCtrlID.USER32 ref: 00007FF6E9888875
GetWindowRect.USER32 ref: 00007FF6E988889F
GetParent.USER32 ref: 00007FF6E98888BC
ScreenToClient.USER32 ref: 00007FF6E98888CC
GetClassNameW.USER32 ref: 00007FF6E9888956
GetWindowTextW.USER32 ref: 00007FF6E9888992

Strings

%s%u, xrefs: 00007FF6E988872D

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_swprintf
String ID: %s%u
API String ID: 1576817560-679674701
Opcode ID: 7a5d57d6e359a8a3b52d4593dc36ff241df55ff12037d41454d7554d21a2cab8
Instruction ID: 7ce979e9ca3a2f96111c00c437fa1b9809bd336b00c83aa4e72fe5d78f45ced9
Opcode Fuzzy Hash: 7a5d57d6e359a8a3b52d4593dc36ff241df55ff12037d41454d7554d21a2cab8
Instruction Fuzzy Hash: AAB1E373A0864296EA28CF25D8447FA67A0FF44B84F800831DB6D872A5EF3EE555C746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989B0CC, Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 146COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6E989B133
LoadStringW.USER32 ref: 00007FF6E989B157
_swprintf.LIBCMT ref: 00007FF6E989B1CB
wprintf.LIBCMT ref: 00007FF6E989B2B1
wprintf.LIBCMT ref: 00007FF6E989B2CD

Part of subcall function 00007FF6E9847F90: _errno.LIBCMT ref: 00007FF6E9847FB5
Part of subcall function 00007FF6E9847F90: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9847FC0

Strings

Line %d (File "%s"):, xrefs: 00007FF6E989B1A4
^ ERROR, xrefs: 00007FF6E989B22E
"%s" (%d) : ==> %s:, xrefs: 00007FF6E989B2C6
"%s" (%d) : ==> %s:%s%s, xrefs: 00007FF6E989B29D
Error: , xrefs: 00007FF6E989B25F

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: LoadStringwprintf$_errno_invalid_parameter_noinfo_swprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 771680204-2391861430
Opcode ID: 65bedb42e55daa9d1f329a5b29dc71e0cbe314659d3a7da00a0f43b9275b9d83
Instruction ID: 217917a17e4afa286feabfb6c03d1c72b4fec36254dba2bdfc6ff23bd2efa8ae
Opcode Fuzzy Hash: 65bedb42e55daa9d1f329a5b29dc71e0cbe314659d3a7da00a0f43b9275b9d83
Instruction Fuzzy Hash: 2B719123A18A4292EB00EF65E4447EE7361FF44744F800932EA1D83AAADF7EE505C746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989B4CC, Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 98fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF6E989B50D
_swprintf.LIBCMT ref: 00007FF6E989B534
CreateDirectoryW.KERNEL32 ref: 00007FF6E989B561
CreateFileW.KERNEL32 ref: 00007FF6E989B593
RemoveDirectoryW.KERNEL32 ref: 00007FF6E989B5A5
DeviceIoControl.KERNEL32 ref: 00007FF6E989B63E
CloseHandle.KERNEL32 ref: 00007FF6E989B64B
CloseHandle.KERNEL32 ref: 00007FF6E989B656

Strings

\??\%s, xrefs: 00007FF6E989B528
:, xrefs: 00007FF6E989B54E
\, xrefs: 00007FF6E989B546

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_swprintf
String ID: :$\$\??\%s
API String ID: 3132536607-3457252023
Opcode ID: a510f6e5440c2f77a10b8ebef75c09c7183a48f51930e09a14826b7b98d7f1f0
Instruction ID: 9c51f175c850024f74a04bf26f30993e88780af9819897164cba2b27ef16631f
Opcode Fuzzy Hash: a510f6e5440c2f77a10b8ebef75c09c7183a48f51930e09a14826b7b98d7f1f0
Instruction Fuzzy Hash: CD41B12261868395E7209F21E8047FE63A4FF84B98F400535DA4D97AB8DF7ED546C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E988EA10, Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 77windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000001,00007FF6E987011E,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00007FF6E983CBDD), ref: 00007FF6E988EA46
LoadStringW.USER32 ref: 00007FF6E988EA60
wprintf.LIBCMT ref: 00007FF6E988EAA3

Part of subcall function 00007FF6E9847F90: _errno.LIBCMT ref: 00007FF6E9847FB5
Part of subcall function 00007FF6E9847F90: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9847FC0

_swprintf.LIBCMT ref: 00007FF6E988EAC0
MessageBoxW.USER32 ref: 00007FF6E988EB37

Strings

Line %d (File "%s"):, xrefs: 00007FF6E988EACA
., xrefs: 00007FF6E988EB14
%s (%d) : ==> %s.: %s %s, xrefs: 00007FF6E988EA88
Error: , xrefs: 00007FF6E988EAF6
Line %d:, xrefs: 00007FF6E988EAB9

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: HandleLoadMessageModuleString_errno_invalid_parameter_noinfo_swprintfwprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 656240923-4153970271
Opcode ID: 986a6d2954c8df3451681f8ad7e4e12a828eff573a47cf9c6dfebccc90a9ba5e
Instruction ID: 9d39d27faa41cdbff4ac7d5f9e8a4c6ede272b6607fb287d2d9b2eb897ae2f2a
Opcode Fuzzy Hash: 986a6d2954c8df3451681f8ad7e4e12a828eff573a47cf9c6dfebccc90a9ba5e
Instruction Fuzzy Hash: F831C073A18A4292DB10DF20E4447AAB364FF90B84F904932EA4D837A9CF7DD505C746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98950A4, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 65sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00007FF6E98950B1
Sleep.KERNEL32 ref: 00007FF6E98950CF
EnumThreadWindows.USER32 ref: 00007FF6E98950F7
FindWindowExW.USER32 ref: 00007FF6E9895120
SetActiveWindow.USER32 ref: 00007FF6E9895143
SendMessageW.USER32 ref: 00007FF6E9895157

Part of subcall function 00007FF6E98930D8: GetWindowThreadProcessId.USER32 ref: 00007FF6E989310C
Part of subcall function 00007FF6E98930D8: GetCurrentThreadId.KERNEL32 ref: 00007FF6E9893114

SendMessageW.USER32 ref: 00007FF6E9895177
Sleep.KERNEL32 ref: 00007FF6E9895182
IsWindow.USER32 ref: 00007FF6E989518F
EndDialog.USER32 ref: 00007FF6E98951A2

Part of subcall function 00007FF6E98930D8: GetWindowThreadProcessId.USER32 ref: 00007FF6E98930F4
Part of subcall function 00007FF6E98930D8: GetCurrentThreadId.KERNEL32 ref: 00007FF6E98930FC
Part of subcall function 00007FF6E98930D8: AttachThreadInput.USER32 ref: 00007FF6E9893121

Strings

BUTTON, xrefs: 00007FF6E989510D

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Thread$Window$CurrentMessageProcessSendSleep$ActiveAttachDialogEnumFindInputTimeWindowstime
String ID: BUTTON
API String ID: 3935177441-3405671355
Opcode ID: c449b4dd81d16472125fe187c6a67d0365e8851cdeba79dc88141ae9b4d1845e
Instruction ID: 3ee0aac089299ce3b53398e7f552b21423e32f85fe7a8e58e1791da685da6296
Opcode Fuzzy Hash: c449b4dd81d16472125fe187c6a67d0365e8851cdeba79dc88141ae9b4d1845e
Instruction Fuzzy Hash: 39313E23E1860396FB109F25E85477B2351AFC9749F885A32C90ECA6B1DF2FA444D70B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9823D3C, Relevance: 18.2, APIs: 12, Instructions: 192timeCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,?,00007FF6E98236D0,?,?,?,?,?,?,?,?,?,00007FF6E9821F0B), ref: 00007FF6E9823E1C
KillTimer.USER32(?,00000000,?,00007FF6E98236D0,?,?,?,?,?,?,?,?,?,00007FF6E9821F0B), ref: 00007FF6E9823EF4
DestroyAcceleratorTable.USER32 ref: 00007FF6E98640BA

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Destroy$AcceleratorKillTableTimerWindow
String ID:
API String ID: 1974058525-0
Opcode ID: 98ab61e988d85d5ebcc431a4f95ec844792f8cb401a7b4fcc62e7d31b55bd32b
Instruction ID: 3f4e68a2ede524064f09a4918b4bfbf9655a0312e6ecdfc775f1b65a7a906b65
Opcode Fuzzy Hash: 98ab61e988d85d5ebcc431a4f95ec844792f8cb401a7b4fcc62e7d31b55bd32b
Instruction Fuzzy Hash: 6E914B27A19A0285EB149F25E86037A2364FF64F44F584936CD1ECB765EF3EE845C30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E988F394, Relevance: 18.2, APIs: 12, Instructions: 170keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF6E988F42C
SetKeyboardState.USER32 ref: 00007FF6E988F483
GetAsyncKeyState.USER32 ref: 00007FF6E988F4A9
GetKeyState.USER32 ref: 00007FF6E988F4BE
GetAsyncKeyState.USER32 ref: 00007FF6E988F4ED
GetKeyState.USER32 ref: 00007FF6E988F4FD
GetAsyncKeyState.USER32 ref: 00007FF6E988F52C
GetKeyState.USER32 ref: 00007FF6E988F53C
GetAsyncKeyState.USER32 ref: 00007FF6E988F56B
GetKeyState.USER32 ref: 00007FF6E988F57B
GetAsyncKeyState.USER32 ref: 00007FF6E988F5AA
GetKeyState.USER32 ref: 00007FF6E988F5BA

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 72911dd262bb4c53a7ad0c5fb4f33019036b0e653dc261d63022d60a2cfdb797
Instruction ID: 6b6e7725604faff43be1426445aa825b99bba5bc95dba1aa1065be4d3b377275
Opcode Fuzzy Hash: 72911dd262bb4c53a7ad0c5fb4f33019036b0e653dc261d63022d60a2cfdb797
Instruction Fuzzy Hash: 8671C657A0C2C256FB398F30D00037B2B61EF45B88F990539D68D476A1CE5ED985C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9889170, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF6E98891DD
GetWindowTextW.USER32 ref: 00007FF6E9889216
CharUpperBuffW.USER32 ref: 00007FF6E9889234
wcsstr.LIBCMT ref: 00007FF6E9889264
GetClassNameW.USER32 ref: 00007FF6E98892A3
GetWindowTextW.USER32 ref: 00007FF6E98892DA
GetClassNameW.USER32 ref: 00007FF6E988932E
GetClassNameW.USER32 ref: 00007FF6E9889363
GetWindowRect.USER32 ref: 00007FF6E98893E3

Strings

ThumbnailClass, xrefs: 00007FF6E98892AE, 00007FF6E9889339

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpperwcsstr
String ID: ThumbnailClass
API String ID: 4010642439-1241985126
Opcode ID: 556250e1f24c635ddd349c4a92f16ba2d5b1dea66751de50abcc95ac094790ee
Instruction ID: 8f38f6f42443764a2938e1b2b00d01142cf1084317c1e159a905c5081bf5ffb2
Opcode Fuzzy Hash: 556250e1f24c635ddd349c4a92f16ba2d5b1dea66751de50abcc95ac094790ee
Instruction Fuzzy Hash: 90A1D463A0864283EA789F11E4043BB67A1FF81758F844835DB8E836A5DF3FE945C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9822400, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 167windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32 ref: 00007FF6E9862593
ExtractIconExW.SHELL32 ref: 00007FF6E98625BD
LoadImageW.USER32 ref: 00007FF6E98625E0
ExtractIconExW.SHELL32 ref: 00007FF6E9862607
SendMessageW.USER32 ref: 00007FF6E986262A
DestroyIcon.USER32 ref: 00007FF6E9862639
SendMessageW.USER32 ref: 00007FF6E986265F
DestroyIcon.USER32 ref: 00007FF6E986266E

Strings

P, xrefs: 00007FF6E98625D3

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID: P
API String ID: 1268354404-3110715001
Opcode ID: 452572b2553fbc5d6f185126dce0a03af4a9e21232eb4beb4b2f703efffd68eb
Instruction ID: 9759ea5de8e14a9bb68bc65eef96920a0a597f94a76dcae56f7826a1a4aa0914
Opcode Fuzzy Hash: 452572b2553fbc5d6f185126dce0a03af4a9e21232eb4beb4b2f703efffd68eb
Instruction Fuzzy Hash: E8618E27A186428AEB18DF25E85477A2791BF48B98F140A35DE0DC77B8DF3EE4408746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9884A7C, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 124registryshareCOMMON

Download Yara Rule

APIs

WNetAddConnection2W.MPR ref: 00007FF6E9884B8B
RegConnectRegistryW.ADVAPI32 ref: 00007FF6E9884BAC
RegOpenKeyExW.ADVAPI32 ref: 00007FF6E9884BDB
RegQueryValueExW.ADVAPI32 ref: 00007FF6E9884C15
CLSIDFromString.OLE32 ref: 00007FF6E9884C3C
RegCloseKey.ADVAPI32 ref: 00007FF6E9884C4B
RegCloseKey.ADVAPI32 ref: 00007FF6E9884C56

Strings

SOFTWARE\Classes\, xrefs: 00007FF6E9884AD0
\CLSID, xrefs: 00007FF6E9884AEE
\IPC$, xrefs: 00007FF6E9884B60

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 3030280669-22481851
Opcode ID: 1a2f393738522df2ea9a5e0eaeafb77edf212baa2e80aca7f8c09c83b66d1819
Instruction ID: 38cba38cfe329968eff9562e3b322ca7e5e264325a117d6a5a58802b95ebdfea
Opcode Fuzzy Hash: 1a2f393738522df2ea9a5e0eaeafb77edf212baa2e80aca7f8c09c83b66d1819
Instruction Fuzzy Hash: 4151C123618A8292EB50DF75E8943EE63A0FF94384F800531EA4D87A79EF3DD589C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9885318, Relevance: 16.7, APIs: 11, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E98857F8: GetUserObjectSecurity.USER32 ref: 00007FF6E9885829
Part of subcall function 00007FF6E98857F8: GetLastError.KERNEL32(?,?,?,?,00000000,00007FF6E988511A), ref: 00007FF6E9885835
Part of subcall function 00007FF6E98857F8: GetUserObjectSecurity.USER32 ref: 00007FF6E9885860

Part of subcall function 00007FF6E98858EC: InitializeSecurityDescriptor.ADVAPI32(?,?,?,00007FF6E988512F), ref: 00007FF6E988590F

GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF6E98853A7
GetAclInformation.ADVAPI32 ref: 00007FF6E98853E1
GetLengthSid.ADVAPI32 ref: 00007FF6E98853F2
GetAce.ADVAPI32 ref: 00007FF6E9885430
AddAce.ADVAPI32 ref: 00007FF6E9885457
GetLengthSid.ADVAPI32 ref: 00007FF6E988546F
GetLengthSid.ADVAPI32 ref: 00007FF6E9885492
CopySid.ADVAPI32 ref: 00007FF6E98854A1
AddAce.ADVAPI32 ref: 00007FF6E98854E7
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF6E988550B
SetUserObjectSecurity.USER32 ref: 00007FF6E9885520

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 1255039815-0
Opcode ID: f5d6f765d410541f53a95e6cc26c1f114c1d6cd5ea2b0b43c7187091ada832e4
Instruction ID: e3bda12ba02dbab8f7c6a54a6f2c4b9b2eb720f74e957dc820959552c2c42004
Opcode Fuzzy Hash: f5d6f765d410541f53a95e6cc26c1f114c1d6cd5ea2b0b43c7187091ada832e4
Instruction Fuzzy Hash: 2961F223B146528AFB14CF61D8046AE37B5FF44B88B844836DE0E97BA5DF3AD409C325

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989BCD0, Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 186COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32 ref: 00007FF6E989BE43
wcscpy.LIBCMT ref: 00007FF6E989BE78

Strings

ramdisk, xrefs: 00007FF6E989BDE4
fixed, xrefs: 00007FF6E989BDAC
removable, xrefs: 00007FF6E989BD90
unknown, xrefs: 00007FF6E989BE00
cdrom, xrefs: 00007FF6E989BD71
all, xrefs: 00007FF6E989BD54
network, xrefs: 00007FF6E989BDC8

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: DriveTypewcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2611937062-1000479233
Opcode ID: f40ac83413f4114ad420aa6efd8c2adcb5791c2838c63543581d23226698586d
Instruction ID: 15d3b602b488ae84f476a664ffb8f4f5a506510580b56bdbe802fefc776f69d0
Opcode Fuzzy Hash: f40ac83413f4114ad420aa6efd8c2adcb5791c2838c63543581d23226698586d
Instruction Fuzzy Hash: 9881C263A08A4695EA20DF10E4803BF6364FF84788F904932DA4DC72B6DF3EE509C746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98A95FC, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 174networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32 ref: 00007FF6E98A9673
inet_addr.WSOCK32 ref: 00007FF6E98A96D8
gethostbyname.WSOCK32 ref: 00007FF6E98A96E5
IcmpCreateFile.IPHLPAPI ref: 00007FF6E98A96F3

Part of subcall function 00007FF6E984652C: malloc.LIBCMT ref: 00007FF6E9846546

IcmpSendEcho.IPHLPAPI ref: 00007FF6E98A979F
IcmpCloseHandle.IPHLPAPI ref: 00007FF6E98A9875
WSACleanup.WSOCK32 ref: 00007FF6E98A987B

Strings

5, xrefs: 00007FF6E98A9765
Ping, xrefs: 00007FF6E98A9731

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Icmp$CleanupCloseCreateEchoFileHandleSendStartupgethostbynameinet_addrmalloc
String ID: 5$Ping
API String ID: 2869090178-1972892582
Opcode ID: 2b26a3c68a5a27b1369e0d4754619c1fc99307baa3231f8fa3b79b8606391d37
Instruction ID: f06fb88e8de8f77c6b4a1346eb140b191653db79166e95ed774645aeb1ed6419
Opcode Fuzzy Hash: 2b26a3c68a5a27b1369e0d4754619c1fc99307baa3231f8fa3b79b8606391d37
Instruction Fuzzy Hash: DA813B33A0864286EB50DF21E4943BA6760FF84B64F058932DA5E877E1CFBEE454C746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989CD20, Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 101COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF6E989CD43
GetDiskFreeSpaceW.KERNEL32 ref: 00007FF6E989CDCE
GetLastError.KERNEL32 ref: 00007FF6E989CDD8
SetErrorMode.KERNEL32 ref: 00007FF6E989CE6E

Strings

UNKNOWN, xrefs: 00007FF6E989CDFD
INVALID, xrefs: 00007FF6E989CE1D
READY, xrefs: 00007FF6E989CE26
READONLY, xrefs: 00007FF6E989CE14
NOTREADY, xrefs: 00007FF6E989CE06

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 87b3d3cf9f65ca67005c7fd071053d5866007ba2800ae76f6c71e2b8b9e710a2
Instruction ID: 37d20cc471100cf497696da984db4276a14e207d9ae9463e1ef95232989a719b
Opcode Fuzzy Hash: 87b3d3cf9f65ca67005c7fd071053d5866007ba2800ae76f6c71e2b8b9e710a2
Instruction Fuzzy Hash: E741A137A08A0695EB10CF25D4403BE2771FF48B98F458932CA0E83765DF3AE495C35A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9886AC0, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9888D6C: GetClassNameW.USER32 ref: 00007FF6E9888D97

SendMessageW.USER32 ref: 00007FF6E9886B59
GetDlgCtrlID.USER32 ref: 00007FF6E9886B6B
GetParent.USER32 ref: 00007FF6E9886B7C
SendMessageW.USER32 ref: 00007FF6E9886B90
GetDlgCtrlID.USER32 ref: 00007FF6E9886B9C
GetParent.USER32 ref: 00007FF6E9886BB3
SendMessageW.USER32 ref: 00007FF6E9886BC7

Strings

ListBox, xrefs: 00007FF6E9886B13
ComboBox, xrefs: 00007FF6E9886ADA

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName
String ID: ComboBox$ListBox
API String ID: 2573188126-1403004172
Opcode ID: 4c289dd2b4d26d42360244b02737d176423f6136cb52bc365c3a24afba520d1f
Instruction ID: 9fcf511abeff72d9ff806ba0c0ec247a3d2948e569cf7d6a38721ce62a3ca155
Opcode Fuzzy Hash: 4c289dd2b4d26d42360244b02737d176423f6136cb52bc365c3a24afba520d1f
Instruction Fuzzy Hash: 7531E433B08A4592EA20DF11E8143BA6360BF89BE0F444731DEAD877E6CF2DD9458356

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9886BE8, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9888D6C: GetClassNameW.USER32 ref: 00007FF6E9888D97

SendMessageW.USER32 ref: 00007FF6E9886C80
GetDlgCtrlID.USER32 ref: 00007FF6E9886C92
GetParent.USER32 ref: 00007FF6E9886CA3
SendMessageW.USER32 ref: 00007FF6E9886CB7
GetDlgCtrlID.USER32 ref: 00007FF6E9886CC3
GetParent.USER32 ref: 00007FF6E9886CDA
SendMessageW.USER32 ref: 00007FF6E9886CEE

Strings

ListBox, xrefs: 00007FF6E9886C3B
ComboBox, xrefs: 00007FF6E9886C02

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName
String ID: ComboBox$ListBox
API String ID: 2573188126-1403004172
Opcode ID: 408101be0a03208c3610a4a42da75ffe71ecf24274818ac4a000200731fe50cd
Instruction ID: c5c1754cfafed6107367f53f51a799ffbc382782dcc97c8e8e776aa2f2c26e4a
Opcode Fuzzy Hash: 408101be0a03208c3610a4a42da75ffe71ecf24274818ac4a000200731fe50cd
Instruction Fuzzy Hash: 3431F532A0864591EA20DF16E8143BE6361FF89BD0F804631DE9D877A5CE2ED9458346

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9894628, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 59networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32 ref: 00007FF6E9894648
gethostname.WSOCK32 ref: 00007FF6E9894660
gethostbyname.WSOCK32 ref: 00007FF6E989466B
wcscpy.LIBCMT ref: 00007FF6E98946A2
inet_ntoa.WSOCK32 ref: 00007FF6E98946C8
wcscpy.LIBCMT ref: 00007FF6E98946F1
WSACleanup.WSOCK32 ref: 00007FF6E98946FE
wcscpy.LIBCMT ref: 00007FF6E9894710

Strings

0.0.0.0, xrefs: 00007FF6E9894698

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: wcscpy$CleanupStartupgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 2479661705-3771769585
Opcode ID: e88d7d812601b46136f0db36542456c021c18969bbe9d357e4b3da5aa5164381
Instruction ID: 5f8e42463b5e03e4b454ce471c07fd1d953ace79bbe982aaa6e681c33e79f084
Opcode Fuzzy Hash: e88d7d812601b46136f0db36542456c021c18969bbe9d357e4b3da5aa5164381
Instruction Fuzzy Hash: 9121C463A0898690EF249F21E4943BF6365FF88B80F541931C54E877B5EE3DD445C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C6048, Relevance: 15.2, APIs: 10, Instructions: 211windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9824560: GetWindowLongPtrW.USER32 ref: 00007FF6E982457D

PostMessageW.USER32 ref: 00007FF6E98C60BA
GetFocus.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6E98C60CB
GetDlgCtrlID.USER32 ref: 00007FF6E98C60D8
GetMenuItemInfoW.USER32 ref: 00007FF6E98C621D
GetMenuItemCount.USER32 ref: 00007FF6E98C623B
GetMenuItemID.USER32 ref: 00007FF6E98C6250
GetMenuItemInfoW.USER32 ref: 00007FF6E98C628A
GetMenuItemInfoW.USER32 ref: 00007FF6E98C62D3
CheckMenuRadioItem.USER32 ref: 00007FF6E98C630A
DefDlgProcW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6E98C6341

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID:
API String ID: 1026556194-0
Opcode ID: d3d395b378ac17e39eb77738bf12f7240b41e646e306b583a727b97535c07d11
Instruction ID: c02a521f596d229727252c9ee51e95ff07095ee778ce6792399e76b374c968bc
Opcode Fuzzy Hash: d3d395b378ac17e39eb77738bf12f7240b41e646e306b583a727b97535c07d11
Instruction Fuzzy Hash: 8B917C37B086178AEB508F61D4447BE27A1BF44B48F144A35DE0D8B6A5DF3EE405C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9891F88, Relevance: 15.2, APIs: 10, Instructions: 193windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF6E9892035
SetMenuItemInfoW.USER32 ref: 00007FF6E989206F
Sleep.KERNEL32 ref: 00007FF6E9892082
GetMenuItemCount.USER32 ref: 00007FF6E98920C5
GetMenuItemID.USER32 ref: 00007FF6E98920E3
GetMenuItemID.USER32 ref: 00007FF6E989210B
GetMenuItemID.USER32 ref: 00007FF6E9892149
CheckMenuRadioItem.USER32 ref: 00007FF6E989218D
GetMenuItemInfoW.USER32 ref: 00007FF6E98921C8
SetMenuItemInfoW.USER32 ref: 00007FF6E98921ED

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID:
API String ID: 1460738036-0
Opcode ID: c5d355f8753d42f329a6e380a508d71f8f35e5166a5d040724e68ac5c7ac705e
Instruction ID: 66f30c07a9cbe3abab58b19c18e8f09f2674d4853904d54491ad8be625fc08fa
Opcode Fuzzy Hash: c5d355f8753d42f329a6e380a508d71f8f35e5166a5d040724e68ac5c7ac705e
Instruction Fuzzy Hash: 6281D523A0868256FB58DF65A8043BE27A2FF44788F544935CE4D8B665DE3FF446C306

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9893CAC, Relevance: 15.1, APIs: 10, Instructions: 101COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00007FF6E9893CDD

Part of subcall function 00007FF6E98479E0: _errno.LIBCMT ref: 00007FF6E9847A18
Part of subcall function 00007FF6E98479E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9847A23

_swprintf.LIBCMT ref: 00007FF6E9893CF1

Part of subcall function 00007FF6E98479E0: _woutput_l.LIBCMT ref: 00007FF6E9847A56

Part of subcall function 00007FF6E984713C: _errno.LIBCMT ref: 00007FF6E9847157
Part of subcall function 00007FF6E984713C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9847162

FindResourceW.KERNEL32 ref: 00007FF6E9893D22
LoadResource.KERNEL32 ref: 00007FF6E9893D33
LockResource.KERNEL32 ref: 00007FF6E9893D41
FindResourceW.KERNEL32 ref: 00007FF6E9893D6C
LoadResource.KERNEL32 ref: 00007FF6E9893D80
SizeofResource.KERNEL32 ref: 00007FF6E9893D98
LockResource.KERNEL32 ref: 00007FF6E9893DA4

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Resource$FindLoadLock_errno_invalid_parameter_noinfo_swprintf$Sizeof_woutput_l
String ID:
API String ID: 2307420658-0
Opcode ID: 622d284c5f767ff4069eca526d6ed2d6982dc5004357456426751c6567425246
Instruction ID: e536fda4f88345e639f045e489d58c2ef28fb943a6994d4b523070af1493790c
Opcode Fuzzy Hash: 622d284c5f767ff4069eca526d6ed2d6982dc5004357456426751c6567425246
Instruction Fuzzy Hash: 6941CF2370865296EB148F12D41823A77A5FF94FC0F144936DD4E8BBA4EE3EE841C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E988737C, Relevance: 15.1, APIs: 10, Instructions: 59keyboardsleepwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9888AB8: GetWindowThreadProcessId.USER32 ref: 00007FF6E9888AD5
Part of subcall function 00007FF6E9888AB8: GetCurrentThreadId.KERNEL32 ref: 00007FF6E9888ADD
Part of subcall function 00007FF6E9888AB8: AttachThreadInput.USER32(?,?,?,00007FF6E9887290), ref: 00007FF6E9888B05

MapVirtualKeyW.USER32 ref: 00007FF6E98873A1
PostMessageW.USER32 ref: 00007FF6E98873BC
Sleep.KERNEL32 ref: 00007FF6E98873C4
MapVirtualKeyW.USER32 ref: 00007FF6E98873CE
MapVirtualKeyW.USER32 ref: 00007FF6E98873D9
PostMessageW.USER32 ref: 00007FF6E98873F7
Sleep.KERNEL32 ref: 00007FF6E98873FF
MapVirtualKeyW.USER32 ref: 00007FF6E9887409
PostMessageW.USER32 ref: 00007FF6E988742B
Sleep.KERNEL32 ref: 00007FF6E9887433

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Virtual$MessagePostSleepThread$AttachCurrentInputProcessWindow
String ID:
API String ID: 685491774-0
Opcode ID: b1474e052e223b0b6897c6c745d05df274d61c65aec864ab01bcbd70e7cdf791
Instruction ID: 7dd1617f7cd1284b4fc7d375f6e99bb1af167c2517652bba796ea882b4642e06
Opcode Fuzzy Hash: b1474e052e223b0b6897c6c745d05df274d61c65aec864ab01bcbd70e7cdf791
Instruction Fuzzy Hash: 2C11A23670591292F7145F66A444A6F2271EF8CB81F405D38CA5ECB765CE3FD0948316

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9898594, Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 262COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32 ref: 00007FF6E9898687
SafeArrayAccessData.OLEAUT32 ref: 00007FF6E98986CB

Strings

NULL Pointer assignment, xrefs: 00007FF6E989859D

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ArraySafe$AccessDataVartype
String ID: NULL Pointer assignment
API String ID: 2857666278-2785691316
Opcode ID: 93a39d7c60f1655d50f2cfb835695ab38f7c869b09b504545263ade9f5941e67
Instruction ID: 20ec1b45db53bac169d3cd97e3ebc2e696e91449165841c98f4048d828daf1de
Opcode Fuzzy Hash: 93a39d7c60f1655d50f2cfb835695ab38f7c869b09b504545263ade9f5941e67
Instruction Fuzzy Hash: 2EB16563A08A4386FB509F65C4843FA23B0EF40B88F454936DA0ED76A5DF3EE445C34A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98881DC, Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 227COMMON

Download Yara Rule

Strings

CLASS, xrefs: 00007FF6E9888298
INSTANCE, xrefs: 00007FF6E988846A
TEXT, xrefs: 00007FF6E9888499
REGEXPCLASS, xrefs: 00007FF6E98882E5
NAME, xrefs: 00007FF6E9888383
CLASSNN, xrefs: 00007FF6E98882BE

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID:
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 0-1603158881
Opcode ID: 2fdd76734adfb71c72aebc8dd6f9718801af186ae7ab75c7a715925b351f6849
Instruction ID: 1e33510fecc4c0eb785d0c751e098a192de60b82156d0eb6508e708ea944d553
Opcode Fuzzy Hash: 2fdd76734adfb71c72aebc8dd6f9718801af186ae7ab75c7a715925b351f6849
Instruction Fuzzy Hash: AAB17D73A08642A6FB18DF60C9413FA6370BF54344F800835CB2ED71A6DF6AE55AC75A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98ADFD4, Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 217COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF6E98AE133
VariantInit.OLEAUT32 ref: 00007FF6E98AE258
VariantClear.OLEAUT32 ref: 00007FF6E98AE263

Strings

_NewEnum, xrefs: 00007FF6E98ADFFA
Incorrect Object type in FOR..IN loop, xrefs: 00007FF6E98AE23C
get__NewEnum, xrefs: 00007FF6E98AE00E
Null Object assignment in FOR..IN loop, xrefs: 00007FF6E98AE2DA

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Variant$Init$Clear
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$_NewEnum$get__NewEnum
API String ID: 3467423407-1765764032
Opcode ID: 7f6cfa2db45d52db800732eeb97c68aaa01e74506843837d1ac3f3cb283b5695
Instruction ID: 366f4d107b88d8301aea08e40f425f5f8d9414d04c0bafaf9bae6e99a886a05b
Opcode Fuzzy Hash: 7f6cfa2db45d52db800732eeb97c68aaa01e74506843837d1ac3f3cb283b5695
Instruction Fuzzy Hash: 8591A233A0874286EB508F61E4407AE67A0FF88B88F444A36DE4D837A5DF7DE045C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BF604, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,?,?,00007FF6E98632CF), ref: 00007FF6E98BF717
SendMessageW.USER32(?,?,00000000,?,?,00007FF6E98632CF), ref: 00007FF6E98BF72B
SetWindowPos.USER32(?,?,00000000,?,?,00007FF6E98632CF), ref: 00007FF6E98BF757
wcscat.LIBCMT ref: 00007FF6E98BF7B9
SendMessageW.USER32(?,?,00000000,?,?,00007FF6E98632CF), ref: 00007FF6E98BF7CD
SendMessageW.USER32(?,?,00000000,?,?,00007FF6E98632CF), ref: 00007FF6E98BF7FE

Strings

-----, xrefs: 00007FF6E98BF7AB
SysListView32, xrefs: 00007FF6E98BF6B4

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend$Windowwcscat
String ID: -----$SysListView32
API String ID: 2228222356-3975388722
Opcode ID: adb29f3a11cd5665f390f9849a3950fd44c6f67156d868d593c2079345bf0261
Instruction ID: 49b39f78c841b115f154085a2f2dedb6588a622fcdb39d9b6f9964d917044929
Opcode Fuzzy Hash: adb29f3a11cd5665f390f9849a3950fd44c6f67156d868d593c2079345bf0261
Instruction Fuzzy Hash: D451EF37A047828AE720CF25E44479E33A1FF88788F500536DA4D87B69DF3AE995CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9886D10, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF6E9886D23
GetClassNameW.USER32 ref: 00007FF6E9886D3A

Part of subcall function 00007FF6E984713C: _errno.LIBCMT ref: 00007FF6E9847157
Part of subcall function 00007FF6E984713C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9847162

SendMessageW.USER32 ref: 00007FF6E9886DCA

Strings

details, xrefs: 00007FF6E9886D73
list, xrefs: 00007FF6E9886DA9
largeicons, xrefs: 00007FF6E9886D58
smallicons, xrefs: 00007FF6E9886D8E
SHELLDLL_DefView, xrefs: 00007FF6E9886D40

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ClassMessageNameParentSend_errno_invalid_parameter_noinfo
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1239874603-3381328864
Opcode ID: 39ca01b54bd7ab18fe4752ccaa694f7210b37a84e2f52736a48f3f1b8c4d307c
Instruction ID: a608998ef1067f246ec81b6923d80ddfe6a89227301be68660d2e513334cc37f
Opcode Fuzzy Hash: 39ca01b54bd7ab18fe4752ccaa694f7210b37a84e2f52736a48f3f1b8c4d307c
Instruction Fuzzy Hash: 37214D23B1C58791FF20AF12E9543BB1350AF81788F404836CA4DC72B6EE2FE555875A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98AD998, Relevance: 13.9, APIs: 9, Instructions: 373COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF6E98ADAA2
FreeLibrary.KERNEL32 ref: 00007FF6E98ADAEA
QueryPathOfRegTypeLib.OLEAUT32 ref: 00007FF6E98ADCF6
SysFreeString.OLEAUT32 ref: 00007FF6E98ADD2B
StringFromGUID2.OLE32 ref: 00007FF6E98ADEC9

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: FreeString$FileFromLibraryModuleNamePathQueryType
String ID:
API String ID: 1903627254-0
Opcode ID: 46586cfba5dc75d80064bfd35b70d43c623829bdc1865b7b8c3ff489cec3b469
Instruction ID: 2d9cfbd7338565a9fddf3b4d8b4e0e57f5edf7d6b3c31f3d1db9bae6483f820f
Opcode Fuzzy Hash: 46586cfba5dc75d80064bfd35b70d43c623829bdc1865b7b8c3ff489cec3b469
Instruction Fuzzy Hash: B3025A27A08B8282DB90DF25D4502AE6760FF84F88F509532EA4E87BB5CF7ED549C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C1690, Relevance: 13.7, APIs: 9, Instructions: 167COMMON

Download Yara Rule

APIs

InvalidateRect.USER32 ref: 00007FF6E98C1777

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: f22642cfb51ecf7389a3b90ba197030d84285f4333a48f343c08417d64cfca8d
Instruction ID: 1c13eda31092e860eddc9e3235e2367231bca008716372fa403cc3fc707eb7e4
Opcode Fuzzy Hash: f22642cfb51ecf7389a3b90ba197030d84285f4333a48f343c08417d64cfca8d
Instruction Fuzzy Hash: 45618D27E0864286F7249E258880B7B2351FF84B94F148A31EA0DCB6B5DF7EE441874B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C5DEC, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 143windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9824560: GetWindowLongPtrW.USER32 ref: 00007FF6E982457D

Part of subcall function 00007FF6E98241A8: GetCursorPos.USER32(?,?,?,00000000,?,00007FF6E98C5DAF), ref: 00007FF6E98241D3
Part of subcall function 00007FF6E98241A8: ScreenToClient.USER32 ref: 00007FF6E98241F2
Part of subcall function 00007FF6E98241A8: GetAsyncKeyState.USER32 ref: 00007FF6E9824212
Part of subcall function 00007FF6E98241A8: GetAsyncKeyState.USER32 ref: 00007FF6E9824223

ImageList_DragLeave.COMCTL32 ref: 00007FF6E98C5E6C
ImageList_EndDrag.COMCTL32 ref: 00007FF6E98C5E72
ReleaseCapture.USER32 ref: 00007FF6E98C5E78
SetWindowTextW.USER32 ref: 00007FF6E98C5F28
SendMessageW.USER32 ref: 00007FF6E98C5F3D

Strings

@GUI_DROPID, xrefs: 00007FF6E98C5F63
@GUI_DRAGFILE, xrefs: 00007FF6E98C5FAD

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 3721556410-2107944366
Opcode ID: 38b520649bbc76ea7ab35d2507e0f9203bb723d0905a176b65f252baca4b9b83
Instruction ID: b90035d4a55b731c51872448ce9ef06aadba3d3bb42816a2e9ebef0cfbed3c34
Opcode Fuzzy Hash: 38b520649bbc76ea7ab35d2507e0f9203bb723d0905a176b65f252baca4b9b83
Instruction Fuzzy Hash: 4E61BE33A04A5299EB00DF61E8406AE3B64FF44B98F400636DE1E97BA5DF3ED445C306

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9891BAC, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 136windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF6E9891C6B
IsMenu.USER32 ref: 00007FF6E9891C8D
CreatePopupMenu.USER32 ref: 00007FF6E9891CBE
GetMenuItemCount.USER32 ref: 00007FF6E9891D23
InsertMenuItemW.USER32 ref: 00007FF6E9891D58

Strings

P, xrefs: 00007FF6E9891C10
2, xrefs: 00007FF6E9891CA3

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 2$P
API String ID: 93392585-1110268094
Opcode ID: 7e7ba81bec7953d43df331fc4a2ed12d35a2946139bf6963f1071809bd9b9cda
Instruction ID: b9519702a48fcbe837fe4c482e4879ca6c534d3fb4e65adaaa6a35838c154f00
Opcode Fuzzy Hash: 7e7ba81bec7953d43df331fc4a2ed12d35a2946139bf6963f1071809bd9b9cda
Instruction Fuzzy Hash: E651B233A0CA4289F764CF65D4803BE77A5BF40B98F144935DA5E97AE4CF3AE4818706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C3568, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongPtrW.USER32 ref: 00007FF6E98C3651
SetWindowLongPtrW.USER32 ref: 00007FF6E98C366B
SendMessageW.USER32 ref: 00007FF6E98C3699
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF6E98A2C3F), ref: 00007FF6E98C36BE
SetWindowPos.USER32 ref: 00007FF6E98C3704

Strings

', xrefs: 00007FF6E98C36EC

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID: '
API String ID: 3688381893-1997036262
Opcode ID: a2676874617a270e9093211442ffe691743949220db2bf546208f3b78ee0c67f
Instruction ID: 6061548e595f6db1a6592cdb85ecafa9e6698f3a986a4fcce16134faf73edc25
Opcode Fuzzy Hash: a2676874617a270e9093211442ffe691743949220db2bf546208f3b78ee0c67f
Instruction Fuzzy Hash: 5951E523A0858285E764CF26A454B7B2790EF95B90F144632DE5E8B7A0DF3EE442970B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C4B90, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9824560: GetWindowLongPtrW.USER32 ref: 00007FF6E982457D

GetWindowLongPtrW.USER32 ref: 00007FF6E98C4BF8
SetWindowLongPtrW.USER32 ref: 00007FF6E98C4C21
SetWindowLongPtrW.USER32 ref: 00007FF6E98C4C3C
GetSystemMetrics.USER32 ref: 00007FF6E98C4C66
GetSystemMetrics.USER32 ref: 00007FF6E98C4C71
SetWindowPos.USER32 ref: 00007FF6E98C4C97

Strings

G, xrefs: 00007FF6E98C4C7A

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID: G
API String ID: 2294984445-985283518
Opcode ID: 945efb62c53ef7f7c3c5bfe372d4e8dcb8c971e29506099a72e93422d6f31698
Instruction ID: 5cd7f9fcb0a0e70486bd5c0768eedea82a0073e4b56e398ec81a375c8ffb563f
Opcode Fuzzy Hash: 945efb62c53ef7f7c3c5bfe372d4e8dcb8c971e29506099a72e93422d6f31698
Instruction Fuzzy Hash: C9318423A0864286FB148F35A54473A3690AF44BA5F185B34D91DCA7F5DF3EE881C70B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989416C, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6E9894180
LoadStringW.USER32 ref: 00007FF6E9894196
GetModuleHandleW.KERNEL32 ref: 00007FF6E989419E
LoadStringW.USER32 ref: 00007FF6E98941BA
wprintf.LIBCMT ref: 00007FF6E98941ED

Part of subcall function 00007FF6E9847F90: _errno.LIBCMT ref: 00007FF6E9847FB5
Part of subcall function 00007FF6E9847F90: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9847FC0

MessageBoxW.USER32 ref: 00007FF6E9894209

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00007FF6E98941DE

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: HandleLoadModuleString$Message_errno_invalid_parameter_noinfowprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3468663279-3128320259
Opcode ID: 4884ac9b31a3201a730f2a56005e07babd549d1bc52a628f9827aedf617c49cc
Instruction ID: 84acdb9a7e54c71b8732542b34653bbe81e3c821b82426bd0a61de3efe99ffac
Opcode Fuzzy Hash: 4884ac9b31a3201a730f2a56005e07babd549d1bc52a628f9827aedf617c49cc
Instruction Fuzzy Hash: 2E116573708A8692DB248F20F4557EB6364FF88748F405536D68E87B68DE3DC149C74A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C7568, Relevance: 12.3, APIs: 8, Instructions: 259windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9824560: GetWindowLongPtrW.USER32 ref: 00007FF6E982457D

GetSystemMetrics.USER32 ref: 00007FF6E98C75D6
GetSystemMetrics.USER32 ref: 00007FF6E98C75F5
MoveWindow.USER32 ref: 00007FF6E98C7837
SendMessageW.USER32 ref: 00007FF6E98C7858
SendMessageW.USER32 ref: 00007FF6E98C787C
ShowWindow.USER32 ref: 00007FF6E98C789C
InvalidateRect.USER32(?,?,?,00000000,?,?,?,00007FF6E9863CBB), ref: 00007FF6E98C78C9
DefDlgProcW.USER32(?,?,?,00000000,?,?,?,00007FF6E9863CBB), ref: 00007FF6E98C78F1

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 8403b0b57a16b19cece042d82788be54185e75bccac802a04753ce534ea1841a
Instruction ID: c0648fa84a01a8a58f66daf2c48ca9eaa5221a2c212f88c76a512468de0fc8a9
Opcode Fuzzy Hash: 8403b0b57a16b19cece042d82788be54185e75bccac802a04753ce534ea1841a
Instruction Fuzzy Hash: AAA11627B1468382E7688F25914473B77A1FF84B44F145635DF8A8BAA0DF3EE851C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BE3A4, Relevance: 12.1, APIs: 8, Instructions: 100windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF6E98BE3D4
GetDC.USER32 ref: 00007FF6E98BE3DC
GetDeviceCaps.GDI32 ref: 00007FF6E98BE3ED
ReleaseDC.USER32 ref: 00007FF6E98BE3FA
CreateFontW.GDI32 ref: 00007FF6E98BE491
SendMessageW.USER32 ref: 00007FF6E98BE4A7
MoveWindow.USER32 ref: 00007FF6E98BE4ED
SendMessageW.USER32 ref: 00007FF6E98BE50E

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 9d879f5cec28b5ba276ad2ef450ec634da713babefa0af22b223247cabe2cd32
Instruction ID: d9b1d8b7e1544b9cfc1cb918399fcde52aa300234e7841d331929a9831660084
Opcode Fuzzy Hash: 9d879f5cec28b5ba276ad2ef450ec634da713babefa0af22b223247cabe2cd32
Instruction Fuzzy Hash: 2A418C736186818BE764CF21A444B6BBBA0FB88BD1F144634EF8A47B64DF3ED4408B45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9845ED0, Relevance: 12.1, APIs: 8, Instructions: 69fileCOMMON

Download Yara Rule

APIs

_fileno.LIBCMT ref: 00007FF6E9845EF6

Part of subcall function 00007FF6E9848BF8: _errno.LIBCMT ref: 00007FF6E9848C01
Part of subcall function 00007FF6E9848BF8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9848C0C

_setmode.LIBCMT ref: 00007FF6E9845F02

Part of subcall function 00007FF6E9848A20: _errno.LIBCMT ref: 00007FF6E9848A64
Part of subcall function 00007FF6E9848A20: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9848AFE

fwrite.LIBCMT ref: 00007FF6E988295F

Part of subcall function 00007FF6E983C400: WideCharToMultiByte.KERNEL32 ref: 00007FF6E983C440
Part of subcall function 00007FF6E983C400: WideCharToMultiByte.KERNEL32 ref: 00007FF6E983C478

fprintf.LIBCMT ref: 00007FF6E9845F42

Part of subcall function 00007FF6E9848E40: _errno.LIBCMT ref: 00007FF6E9848E6D
Part of subcall function 00007FF6E9848E40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9848E78

fflush.LIBCMT ref: 00007FF6E9845F60

Part of subcall function 00007FF6E984903C: flsall.LIBCMT ref: 00007FF6E9849053

_fileno.LIBCMT ref: 00007FF6E9845F68
_setmode.LIBCMT ref: 00007FF6E9845F7B
OutputDebugStringW.KERNEL32(?,?,?,?,?,?,?,00007FF6E9828F0D), ref: 00007FF6E9882977

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$ByteCharMultiWide_fileno_setmode$DebugOutputStringfflushflsallfprintffwrite
String ID:
API String ID: 1882173649-0
Opcode ID: 1a784209b14bf356a895f6530de9817e65c55d05c9a3b2995c7e226fd692b3f7
Instruction ID: f276460da58e424e695a888a177b255765d5f8f63c55dc2b71e6d703d75e501f
Opcode Fuzzy Hash: 1a784209b14bf356a895f6530de9817e65c55d05c9a3b2995c7e226fd692b3f7
Instruction Fuzzy Hash: 6F219413A0C74241E924EF22A4153BF6764AF85BC0F444831EA4E87BB7DE3EE502874A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98B647C, Relevance: 10.8, APIs: 7, Instructions: 250registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32 ref: 00007FF6E98B656F
RegOpenKeyExW.ADVAPI32 ref: 00007FF6E98B65F5
RegDeleteValueW.ADVAPI32 ref: 00007FF6E98B668C
RegCloseKey.ADVAPI32 ref: 00007FF6E98B66FF
RegCloseKey.ADVAPI32 ref: 00007FF6E98B6815

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Close$ConnectDeleteOpenRegistryValue
String ID:
API String ID: 1762992421-0
Opcode ID: 3a5b196da41a6e1e068c93e0d9a3584ae90f31796c4014d56c9e34a3e141ff2d
Instruction ID: 1a6de4d3ff86b265bd0c1da25b80d0666a1ab6836635abf7b3b723ab8e670d3c
Opcode Fuzzy Hash: 3a5b196da41a6e1e068c93e0d9a3584ae90f31796c4014d56c9e34a3e141ff2d
Instruction Fuzzy Hash: 0CC15D37B08A42C6EB10DF65E4503AE2770FF94758F444932DA4E87AA6DF3AD019C746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C4E34, Relevance: 10.7, APIs: 7, Instructions: 218windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF6E98C4F07
IsWindowEnabled.USER32 ref: 00007FF6E98C4F14
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,00007FF6E9863D02), ref: 00007FF6E98C5167

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Window$EnabledMessageSend
String ID:
API String ID: 1954429655-0
Opcode ID: 3d9a786cc96a69305782c8881a0afc8940577d07b3455055d4156cf946e9bafe
Instruction ID: 31eaa3f4ea8739ea525011cad1c294434f70b14e02b28f156a2444af49a47602
Opcode Fuzzy Hash: 3d9a786cc96a69305782c8881a0afc8940577d07b3455055d4156cf946e9bafe
Instruction Fuzzy Hash: 82916027A0C54686EF608F25949437F23A0AF85B94F194A33C94DCB7B5DF3EE480860B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9855040, Relevance: 10.7, APIs: 7, Instructions: 213COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 00007FF6E985506A

Part of subcall function 00007FF6E9851768: _mtinitlocknum.LIBCMT ref: 00007FF6E9851786

_calloc_crt.LIBCMT ref: 00007FF6E985507E

Part of subcall function 00007FF6E9850010: _calloc_impl.LIBCMT ref: 00007FF6E985003E

GetStartupInfoW.KERNEL32 ref: 00007FF6E9855103
_calloc_crt.LIBCMT ref: 00007FF6E9855162
GetFileType.KERNEL32 ref: 00007FF6E98551FC

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _calloc_crt$FileInfoStartupType_calloc_impl_lock_mtinitlocknum
String ID:
API String ID: 3977885682-0
Opcode ID: 894175acc751c9cb18e0054ccbb71218d65152029557fce8c6170c232202e64d
Instruction ID: eae31e6e029e9e2e78bdf6a28d9ef32254e50f84cce9a43cb766162127b3a931
Opcode Fuzzy Hash: 894175acc751c9cb18e0054ccbb71218d65152029557fce8c6170c232202e64d
Instruction Fuzzy Hash: 1591AF33A0868186E7108F24D45032E77A5FF45BA4F584636CAAE877E5DF3ED446C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9822DD8, Relevance: 10.7, APIs: 7, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9822C4C: ExtCreatePen.GDI32(?,?,?,?,?,?,?,00000000,00007FF6E9863BB3), ref: 00007FF6E9822CD9
Part of subcall function 00007FF6E9822C4C: SelectObject.GDI32(?,?,?,?,?,?,?,00000000,00007FF6E9863BB3), ref: 00007FF6E9822CEC
Part of subcall function 00007FF6E9822C4C: BeginPath.GDI32 ref: 00007FF6E9822D05
Part of subcall function 00007FF6E9822C4C: SelectObject.GDI32(?,?,?,?,?,?,?,00000000,00007FF6E9863BB3), ref: 00007FF6E9822D2C

SetPixel.GDI32 ref: 00007FF6E9863956
Ellipse.GDI32 ref: 00007FF6E98639B8
Rectangle.GDI32 ref: 00007FF6E9863A50
MoveToEx.GDI32 ref: 00007FF6E9863A66
AngleArc.GDI32 ref: 00007FF6E9863AAB
LineTo.GDI32 ref: 00007FF6E9863AB9
CloseFigure.GDI32 ref: 00007FF6E9863AC2

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ObjectSelect$AngleBeginCloseCreateEllipseFigureLineMovePathPixelRectangle
String ID:
API String ID: 1452317817-0
Opcode ID: bf1d160f3cfd16a1ca8f338ace0f20f62d6a6a846d84abb9ac240c33c6c754b7
Instruction ID: d08fcedb40e4c91af6b5ed8db791498e8a0859df70f5e9cfad2e5e7d9d0e3c19
Opcode Fuzzy Hash: bf1d160f3cfd16a1ca8f338ace0f20f62d6a6a846d84abb9ac240c33c6c754b7
Instruction Fuzzy Hash: 2181B133A282818BD7788F25E404B6F7B60FB85B88F045525DA8947B66CF3EE445CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E984AE04, Relevance: 10.7, APIs: 7, Instructions: 166COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF6E984AE40

Part of subcall function 00007FF6E9850468: _getptd_noexit.LIBCMT ref: 00007FF6E985046C

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E984AE4B
memcpy_s.LIBCMT ref: 00007FF6E984AF10
_fileno.LIBCMT ref: 00007FF6E984AF7B
_read_nolock.LIBCMT ref: 00007FF6E984AF8D
_filbuf.LIBCMT ref: 00007FF6E984AFA9
_errno.LIBCMT ref: 00007FF6E984AFF9

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfo_read_nolockmemcpy_s
String ID:
API String ID: 1864104905-0
Opcode ID: edae41ae909151b3fcc15fb4fe4c44abcd4289b034606e39b24d7e01373a8e5f
Instruction ID: 22dcfc7a489a982fd130dab4def510c6c11b82c3b49d3e700cb6d96dccb796e2
Opcode Fuzzy Hash: edae41ae909151b3fcc15fb4fe4c44abcd4289b034606e39b24d7e01373a8e5f
Instruction Fuzzy Hash: 59510663B0826252F6544E56550077B6698AF40BF4F144F31EE3DCBBE4DF3EE4428A0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9890590, Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF6E98905E5
GetKeyboardState.USER32 ref: 00007FF6E98905F9
SetKeyboardState.USER32 ref: 00007FF6E9890648
PostMessageW.USER32 ref: 00007FF6E989067F
PostMessageW.USER32 ref: 00007FF6E98906A5
PostMessageW.USER32 ref: 00007FF6E98906F5
PostMessageW.USER32 ref: 00007FF6E989071F

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 3485b07e389e81c90ca7aea9f9d6ff93ee3f61476be64f8c0548977437ec2ca0
Instruction ID: c58c8b0a170adc4e11005326d540705f82ae18e461f3cb918a35f534181e1750
Opcode Fuzzy Hash: 3485b07e389e81c90ca7aea9f9d6ff93ee3f61476be64f8c0548977437ec2ca0
Instruction Fuzzy Hash: 8361D193A0D2D166F7618F31410077F2FA1BF86BC0F488975DA8D9BB52CE2ED4918726

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9890368, Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF6E98903B9
GetKeyboardState.USER32 ref: 00007FF6E98903CD
SetKeyboardState.USER32 ref: 00007FF6E989041C
PostMessageW.USER32 ref: 00007FF6E989044A
PostMessageW.USER32 ref: 00007FF6E9890473
PostMessageW.USER32 ref: 00007FF6E98904C5
PostMessageW.USER32 ref: 00007FF6E98904F2

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 6b7320ddeeab4623aee01692ffed90038a2c5e8c5f2593e396cbb4384d564a39
Instruction ID: 32ce73e1402bf7e1dff6eb76b0e3d35df6bd683689c933ce863e50ffc1b07b0f
Opcode Fuzzy Hash: 6b7320ddeeab4623aee01692ffed90038a2c5e8c5f2593e396cbb4384d564a39
Instruction Fuzzy Hash: 4851EF93A0D2D156F7618F7151007BF2FA0EF86BC4F488875DA8D8BB56CE0EE4908326

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98A4940, Relevance: 10.6, APIs: 7, Instructions: 135networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 00007FF6E98A49AC
HttpOpenRequestW.WININET ref: 00007FF6E98A49F6
InternetQueryOptionW.WININET ref: 00007FF6E98A4A41
InternetSetOptionW.WININET ref: 00007FF6E98A4A58
HttpSendRequestW.WININET ref: 00007FF6E98A4A6E
HttpQueryInfoW.WININET ref: 00007FF6E98A4AAB
InternetCloseHandle.WININET ref: 00007FF6E98A4B0C

Part of subcall function 00007FF6E98A57D8: GetLastError.KERNEL32 ref: 00007FF6E98A57F4
Part of subcall function 00007FF6E98A57D8: SetEvent.KERNEL32 ref: 00007FF6E98A5809

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-0
Opcode ID: f089979dfee964732633bdfcc056d5b8208f3812034a7e39cfaa38dd49b0ee27
Instruction ID: 6bbc1bd531cc0049b19be64dc1b3502635452d9fced700c725c5a0335ed37cdf
Opcode Fuzzy Hash: f089979dfee964732633bdfcc056d5b8208f3812034a7e39cfaa38dd49b0ee27
Instruction Fuzzy Hash: 4A51E363A0868285EB64CF21A940BAF77A0FF44B88F105532DE0E57BA4DF7ED445C74A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9894DF0, Relevance: 10.6, APIs: 7, Instructions: 132filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E98945C4: GetFullPathNameW.KERNEL32 ref: 00007FF6E98945F2

Part of subcall function 00007FF6E98945C4: GetFullPathNameW.KERNEL32 ref: 00007FF6E9894607

Part of subcall function 00007FF6E9894AD4: GetFileAttributesW.KERNEL32 ref: 00007FF6E9894AD8

lstrcmpiW.KERNEL32 ref: 00007FF6E9894E7E
MoveFileW.KERNEL32 ref: 00007FF6E9894EAD

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: FileFullNamePath$AttributesMovelstrcmpi
String ID:
API String ID: 1447183488-0
Opcode ID: 710b23b955a70e1e57572baf6503a41d6a2e1366860a7a127e288f4f35d403fd
Instruction ID: 60f3a1e9de92cc3acb649496aa9373d7b3f3cbd4011cb1cd0b1af798dce1b5e0
Opcode Fuzzy Hash: 710b23b955a70e1e57572baf6503a41d6a2e1366860a7a127e288f4f35d403fd
Instruction Fuzzy Hash: FA519723A186C295EB20DF70D8403EE2368FF90788F805432E64D976A9DFBAD745C746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9847B68, Relevance: 10.6, APIs: 7, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9847B93
_errno.LIBCMT ref: 00007FF6E9847B88

Part of subcall function 00007FF6E9850468: _getptd_noexit.LIBCMT ref: 00007FF6E985046C

_errno.LIBCMT ref: 00007FF6E9847C36
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9847C41

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd_noexit
String ID:
API String ID: 1573762532-0
Opcode ID: 512c4bef48d2b6f6f4611f03a13944ca840ae3818381f16bb3613dcfc41ff550
Instruction ID: 2f32f91cbc4585cd01511a17fd4e60e8ca8a38c9366899f8b40c4c16e368fbc2
Opcode Fuzzy Hash: 512c4bef48d2b6f6f4611f03a13944ca840ae3818381f16bb3613dcfc41ff550
Instruction Fuzzy Hash: 16413873E0829381EB605F2191403BB6298EF40B94F944931DACD876E0DF2EE9428B09

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E988C028, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122comlibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E98841CC: CLSIDFromProgID.OLE32 ref: 00007FF6E98841F5
Part of subcall function 00007FF6E98841CC: ProgIDFromCLSID.OLE32 ref: 00007FF6E9884214
Part of subcall function 00007FF6E98841CC: lstrcmpiW.KERNEL32 ref: 00007FF6E9884226
Part of subcall function 00007FF6E98841CC: CoTaskMemFree.OLE32 ref: 00007FF6E9884238

IIDFromString.OLE32 ref: 00007FF6E988C0B7
CoCreateInstance.OLE32 ref: 00007FF6E988C0F7
SetErrorMode.KERNEL32 ref: 00007FF6E988C133
GetProcAddress.KERNEL32 ref: 00007FF6E988C149
SetErrorMode.KERNEL32 ref: 00007FF6E988C1DB

Strings

DllGetClassObject, xrefs: 00007FF6E988C139

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: From$ErrorModeProg$AddressCreateFreeInstanceProcStringTasklstrcmpi
String ID: DllGetClassObject
API String ID: 668425406-1075368562
Opcode ID: de43be42d85785e9a27385393fb00f277bfeda424ba18a2e44f9240a2beee655
Instruction ID: 5c80126cd3474134984bf32ef24980bfcbbadfdd7df64cb980635f6091cb42d7
Opcode Fuzzy Hash: de43be42d85785e9a27385393fb00f277bfeda424ba18a2e44f9240a2beee655
Instruction Fuzzy Hash: FA51A237A18B4696E7288F12E54037A6360FF44784F408935DF4DC7A69CF7EE054871A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BE544, Relevance: 10.6, APIs: 7, Instructions: 111windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00007FF6E98C3417), ref: 00007FF6E98BE587
GetWindowLongW.USER32 ref: 00007FF6E98BE60F
SendMessageW.USER32(?,?,00000000,00007FF6E98C3417), ref: 00007FF6E98BE656
SendMessageW.USER32(?,?,00000000,00007FF6E98C3417), ref: 00007FF6E98BE685
GetWindowLongW.USER32 ref: 00007FF6E98BE69C
SetWindowLongPtrW.USER32 ref: 00007FF6E98BE6C0

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: LongMessageSendWindow
String ID:
API String ID: 3360111000-0
Opcode ID: 50c53774ad29ac0c1228fafb1e211597f0e545e1353e01056db21b6d807caf5c
Instruction ID: ba967e384b9e152828c47d6f572ded894e6f5da8466832daadd8eec3c551fcc6
Opcode Fuzzy Hash: 50c53774ad29ac0c1228fafb1e211597f0e545e1353e01056db21b6d807caf5c
Instruction Fuzzy Hash: 78413027B18A4585EB208F19E59077A3760EFC4F94F198631CA1E877B5EF2EE841C346

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E984713C, Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9847162
_errno.LIBCMT ref: 00007FF6E9847157

Part of subcall function 00007FF6E9850468: _getptd_noexit.LIBCMT ref: 00007FF6E985046C

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF6E98471E1
_errno.LIBCMT ref: 00007FF6E98471F2
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E98471FD

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 140307f194cd48a613a9325673f76ffbc44c0e0edf2c386658dce6897cf03c81
Instruction ID: 22e486d3508bbee092d2e17bf8603bd34ec3d7d162c56a742794c6864b9fd757
Opcode Fuzzy Hash: 140307f194cd48a613a9325673f76ffbc44c0e0edf2c386658dce6897cf03c81
Instruction Fuzzy Hash: EA410963E0926381EB645F1195403BB33A4EF50BA4F844536E6DD876E4DE2ED853CB09

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98AA394, Relevance: 10.6, APIs: 7, Instructions: 97networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E98AC8B0: inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF6E98AA3E4), ref: 00007FF6E98AC8F9

socket.WSOCK32 ref: 00007FF6E98AA40B
WSAGetLastError.WSOCK32 ref: 00007FF6E98AA41A

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: f827729a18b7b7febc5c57c6f55713ca55900587dc9cfca520b72896f582c59c
Instruction ID: 2d78e5ca4c45070a39416875b522efe88c76b86e0199cb6e1f7fb174d1c0c5d9
Opcode Fuzzy Hash: f827729a18b7b7febc5c57c6f55713ca55900587dc9cfca520b72896f582c59c
Instruction Fuzzy Hash: 5D418373A0868282E660DF11E4443AE6361FF84BA4F144631DA6E877E5CF7EE445C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BFB3C, Relevance: 10.6, APIs: 7, Instructions: 96windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00007FF6E98BFB89
SetMenu.USER32 ref: 00007FF6E98BFB9C
GetMenuItemInfoW.USER32 ref: 00007FF6E98BFC2F
IsMenu.USER32 ref: 00007FF6E98BFC4A
CreatePopupMenu.USER32 ref: 00007FF6E98BFC54
InsertMenuItemW.USER32 ref: 00007FF6E98BFC8A
DrawMenuBar.USER32 ref: 00007FF6E98BFC93

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID:
API String ID: 161812096-0
Opcode ID: 0f8c301c15a64811d09b1a5d3f761e860b2cbd1b3a6922ed11c2a9930f6777a8
Instruction ID: 056b5ed54661b09e31c254a422943e69c15dce015d897842aec423e44307a7e8
Opcode Fuzzy Hash: 0f8c301c15a64811d09b1a5d3f761e860b2cbd1b3a6922ed11c2a9930f6777a8
Instruction Fuzzy Hash: 99415B37A04A4695EB00DF62D4506AD37B4FF44B88F184536DE0D87768EF39E895C742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E988C660, Relevance: 10.6, APIs: 7, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6E988C6B3
MultiByteToWideChar.KERNEL32 ref: 00007FF6E988C6E4
SysAllocString.OLEAUT32 ref: 00007FF6E988C6ED
SysAllocString.OLEAUT32 ref: 00007FF6E988C755

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: AllocByteCharMultiStringWide
String ID:
API String ID: 3603722519-0
Opcode ID: b871e7522228a121be9d82befc7d3ebaa1b172de1ef583c34482b54c07eac7dd
Instruction ID: 629f1c461aea48ae599bc701ae8fbcfd80dcb0c6fc7233e199f9ecd10f652b2e
Opcode Fuzzy Hash: b871e7522228a121be9d82befc7d3ebaa1b172de1ef583c34482b54c07eac7dd
Instruction Fuzzy Hash: 5A31C632A08B4689DB649F12E40427A73A0FF44F90F884636DE5E97764CF3EE4848749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9860060, Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF6E9860094

Part of subcall function 00007FF6E9847094: _getptd.LIBCMT ref: 00007FF6E98470AA
Part of subcall function 00007FF6E9847094: __updatetlocinfo.LIBCMT ref: 00007FF6E98470DF
Part of subcall function 00007FF6E9847094: __updatetmbcinfo.LIBCMT ref: 00007FF6E9847106

_errno.LIBCMT ref: 00007FF6E98600AF
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E98600BA

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: c056accabc845728641d8e87e287f3e16e36309b95b76ef814e32e245dd58c3c
Instruction ID: 924e415a4422c77ea5bf36a8851233c601a523b205514b62f56fc3d3f9cd02d4
Opcode Fuzzy Hash: c056accabc845728641d8e87e287f3e16e36309b95b76ef814e32e245dd58c3c
Instruction Fuzzy Hash: 5031D1B3A28781C5E7208F12844077E66A4FF45BE0F544531EA5C8BBA6CF3AD841C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98480D4, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF6E9848120

Part of subcall function 00007FF6E9850468: _getptd_noexit.LIBCMT ref: 00007FF6E985046C

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E984812B
_woutput_l.LIBCMT ref: 00007FF6E984815D

Strings

B, xrefs: 00007FF6E9848147

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo_woutput_l
String ID: B
API String ID: 43230111-1255198513
Opcode ID: 1578821eba5e5038c03fac8056249b226643ceb6e27289793186e5abc2e34ae2
Instruction ID: c0b6519045df12f4c4b1e37ed9e55bcb9f6d15137acd0bb0c4f9d327cd1930cc
Opcode Fuzzy Hash: 1578821eba5e5038c03fac8056249b226643ceb6e27289793186e5abc2e34ae2
Instruction Fuzzy Hash: 1A217C33B1472089F7008F61D8407AE36B4BF48B98F540536DE5EA7BA9CF3AD0428B05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9897628, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6E989764D
CreatePipe.KERNEL32 ref: 00007FF6E9897699

Strings

nul, xrefs: 00007FF6E98976CD

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 0be7a6a5d37c4644c72bd01e4d5d9ae2443fe1dfa678d522937fee6dd4519c0c
Instruction ID: fb54a10b308549500de967cf67c6a57b0d60f9365d56cda1fa9676e94984912d
Opcode Fuzzy Hash: 0be7a6a5d37c4644c72bd01e4d5d9ae2443fe1dfa678d522937fee6dd4519c0c
Instruction Fuzzy Hash: 14218F23A18B4692EB118F24E41437A23E0EF94BB8F100734DABE867E5DF3ED0048706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9823A8C, Relevance: 9.3, APIs: 6, Instructions: 252COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00007FF6E9823AC9
GetWindowRect.USER32 ref: 00007FF6E9823B0C
ScreenToClient.USER32 ref: 00007FF6E9823B35
GetClientRect.USER32 ref: 00007FF6E9823CC8
GetWindowRect.USER32 ref: 00007FF6E9823CE7
GetSystemMetrics.USER32 ref: 00007FF6E9863FA7

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Rect$Client$Window$MetricsScreenSystem
String ID:
API String ID: 3220332590-0
Opcode ID: dbfe52395987b158cea0d7bfd4dada1d049cd7ab995bac918b3cd05ee5aca4b7
Instruction ID: d0a04159ed7cdf0a208d96c7b38dbcd223276f146718e0b580ee03d9b09bdce6
Opcode Fuzzy Hash: dbfe52395987b158cea0d7bfd4dada1d049cd7ab995bac918b3cd05ee5aca4b7
Instruction Fuzzy Hash: 87A1F757B2428385E7188F7581107BE33A0FF14B58F101837DF5A87AA4EE3EA850D32A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BD650, Relevance: 9.2, APIs: 6, Instructions: 157windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E984652C: malloc.LIBCMT ref: 00007FF6E9846546

GetMenu.USER32 ref: 00007FF6E98BD70B
GetMenuItemCount.USER32 ref: 00007FF6E98BD73C
GetMenuStringW.USER32 ref: 00007FF6E98BD774
GetMenuItemID.USER32 ref: 00007FF6E98BD7DE
GetSubMenu.USER32 ref: 00007FF6E98BD7F0
PostMessageW.USER32 ref: 00007FF6E98BD844

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Menu$Item$CountMessagePostStringmalloc
String ID:
API String ID: 3839234758-0
Opcode ID: f769539218da3e98c57f5bdd4bf55ac88ab51300d069bc2f6a0efa317e9c9424
Instruction ID: 53b85c5bfb6996c399bfbf60cf988b9842c671d188368ec841ff46f12f17011c
Opcode Fuzzy Hash: f769539218da3e98c57f5bdd4bf55ac88ab51300d069bc2f6a0efa317e9c9424
Instruction Fuzzy Hash: 67518067A0874292EA10EF26A4143BF63A4FF85B94F084835DE4E87765DF3EE045870A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9823264, Relevance: 9.1, APIs: 6, Instructions: 107COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9824560: GetWindowLongPtrW.USER32 ref: 00007FF6E982457D

BeginPaint.USER32 ref: 00007FF6E98232AC
GetWindowRect.USER32 ref: 00007FF6E9823317
ScreenToClient.USER32 ref: 00007FF6E982333E
SetViewportOrgEx.GDI32 ref: 00007FF6E9823359
EndPaint.USER32 ref: 00007FF6E98233B6

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 64a6851d6abeeee2663f753eee7ea2db77a19d58d7c1c31f04690a1d0e9de227
Instruction ID: 3ed85a6d31d32ebb4f7a778229de5084a8ce8a78392aa7c83c1ffd729ab1675a
Opcode Fuzzy Hash: 64a6851d6abeeee2663f753eee7ea2db77a19d58d7c1c31f04690a1d0e9de227
Instruction Fuzzy Hash: 97518B33A18A8286E720CF21E44876A2760FF95F94F140636DA5C87BA5DF7EE5018706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9889BE4, Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6E9889C25
GetDeviceCaps.GDI32 ref: 00007FF6E9889C36
GetDeviceCaps.GDI32 ref: 00007FF6E9889C46
ReleaseDC.USER32 ref: 00007FF6E9889C53
MulDiv.KERNEL32(?,?,?,00007FF6E988984B,?,?,?,?,00000000,?,?,?,?,00007FF6E9889BB8), ref: 00007FF6E9889C66
MulDiv.KERNEL32(?,?,?,00007FF6E988984B,?,?,?,?,00000000,?,?,?,?,00007FF6E9889BB8), ref: 00007FF6E9889C78

Part of subcall function 00007FF6E98841A0: RaiseException.KERNEL32(00007FF6E98840E0), ref: 00007FF6E98841C3

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: CapsDevice$ExceptionRaiseRelease
String ID:
API String ID: 603618608-0
Opcode ID: a9507fc69b5c985e5b7c7a74f92a766999604e58637e3276b80c5a8f7ab23587
Instruction ID: edd7e19bcb383d2208a5f276fa237095e1dda3aa96375dae22ee905cd9ea105f
Opcode Fuzzy Hash: a9507fc69b5c985e5b7c7a74f92a766999604e58637e3276b80c5a8f7ab23587
Instruction Fuzzy Hash: E1118F26B04B0187EB18CF61A55822A76A5FF89FC0B008939DE0E877A5DE3ED8018746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C5CC4, Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9822C4C: ExtCreatePen.GDI32(?,?,?,?,?,?,?,00000000,00007FF6E9863BB3), ref: 00007FF6E9822CD9
Part of subcall function 00007FF6E9822C4C: SelectObject.GDI32(?,?,?,?,?,?,?,00000000,00007FF6E9863BB3), ref: 00007FF6E9822CEC
Part of subcall function 00007FF6E9822C4C: BeginPath.GDI32 ref: 00007FF6E9822D05
Part of subcall function 00007FF6E9822C4C: SelectObject.GDI32(?,?,?,?,?,?,?,00000000,00007FF6E9863BB3), ref: 00007FF6E9822D2C

MoveToEx.GDI32 ref: 00007FF6E98C5D07
LineTo.GDI32 ref: 00007FF6E98C5D16
MoveToEx.GDI32 ref: 00007FF6E98C5D28
LineTo.GDI32 ref: 00007FF6E98C5D37
EndPath.GDI32 ref: 00007FF6E98C5D49
StrokePath.GDI32 ref: 00007FF6E98C5D59

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 1dde23449577389909fbf1485ed0c2febd70e63c33caeb8108983dfd2efb9788
Instruction ID: 235ebd8090fc2e744c3245a8bceeab6da0eb51ace82cbe318f29f40ed3d8aa3b
Opcode Fuzzy Hash: 1dde23449577389909fbf1485ed0c2febd70e63c33caeb8108983dfd2efb9788
Instruction Fuzzy Hash: E111A333B1829242E7148F15B908B6A6760EF85B84F485631CF1A47B71DF7EE449CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9845A98, Relevance: 9.0, APIs: 6, Instructions: 39keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(?,?,?,00007FF6E982B5D4), ref: 00007FF6E9845ACA
MapVirtualKeyW.USER32(?,?,?,00007FF6E982B5D4), ref: 00007FF6E9845AD8
MapVirtualKeyW.USER32(?,?,?,00007FF6E982B5D4), ref: 00007FF6E9845AE8
MapVirtualKeyW.USER32(?,?,?,00007FF6E982B5D4), ref: 00007FF6E9845AF8
MapVirtualKeyW.USER32(?,?,?,00007FF6E982B5D4), ref: 00007FF6E9845B06
MapVirtualKeyW.USER32(?,?,?,00007FF6E982B5D4), ref: 00007FF6E9845B14

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: b3738ef25f5b190188eb42d8ace7dbfa9db7288420370113fd151fd774a63119
Instruction ID: 7f451e7346944aad17096cfb93cbf9a77e21e9f6b0ffdbbcab5d9ad9bf06eee5
Opcode Fuzzy Hash: b3738ef25f5b190188eb42d8ace7dbfa9db7288420370113fd151fd774a63119
Instruction Fuzzy Hash: 9B117066916A40DAE349CF39988425A3BF1FF5CB09B188424C3498A265DE3DC08AC706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9887DEC, Relevance: 9.0, APIs: 6, Instructions: 35threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32 ref: 00007FF6E9887E24
GetWindowThreadProcessId.USER32 ref: 00007FF6E9887E34
GetCurrentThreadId.KERNEL32 ref: 00007FF6E9887E3C
GetWindowThreadProcessId.USER32 ref: 00007FF6E9887E4C
GetCurrentThreadId.KERNEL32 ref: 00007FF6E9887E54
AttachThreadInput.USER32 ref: 00007FF6E9887E61

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: 5753c938075c3f55a990d454279e909a78d2aa51add6595aa4258d5ee89991b5
Instruction ID: 01564032e083cf97e11378771b6d8135ae4eb0ffe78e7c53d903719b52a563c5
Opcode Fuzzy Hash: 5753c938075c3f55a990d454279e909a78d2aa51add6595aa4258d5ee89991b5
Instruction Fuzzy Hash: 2501D672F0875243F7249F71A88873B62A5BF88B41F444934D94D86B74DF7ED484870A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9895614, Relevance: 9.0, APIs: 6, Instructions: 34windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 00007FF6E9895627
SendMessageTimeoutW.USER32 ref: 00007FF6E9895654
GetWindowThreadProcessId.USER32 ref: 00007FF6E9895667
OpenProcess.KERNEL32 ref: 00007FF6E9895679
TerminateProcess.KERNEL32 ref: 00007FF6E9895687
CloseHandle.KERNEL32 ref: 00007FF6E9895690

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: e52890707a1aedaabb0301d80acdeb622aa191fdf2676b68294dede2b5977396
Instruction ID: ffea2b7993ebd2ecfb489590fb284ef6d18896e0bc38b3a38e99d1f840434c25
Opcode Fuzzy Hash: e52890707a1aedaabb0301d80acdeb622aa191fdf2676b68294dede2b5977396
Instruction Fuzzy Hash: 1A018F73A1474293EB509F21E858B6A7361FF8DB95F441634CE0E4AB24DF3DD0888B06

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9886340, Relevance: 9.0, APIs: 6, Instructions: 22memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF6E988634F
UnloadUserProfile.USERENV ref: 00007FF6E988635D
CloseHandle.KERNEL32 ref: 00007FF6E9886367
CloseHandle.KERNEL32 ref: 00007FF6E9886370
GetProcessHeap.KERNEL32 ref: 00007FF6E9886376
HeapFree.KERNEL32 ref: 00007FF6E9886384

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: b1250fb823c2ec8ebc9184bc703c44850d024ea664e4989286c6bca4c3a7742f
Instruction ID: 61687e3445c8386cb3eae0d0c311768592b27469a811d4e84db7d9aa91417746
Opcode Fuzzy Hash: b1250fb823c2ec8ebc9184bc703c44850d024ea664e4989286c6bca4c3a7742f
Instruction Fuzzy Hash: FEF0C067A1490192E7049F72DC5817A2361FF88FA5B048A31CE1E8B3B4CE3ED4958356

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E982A034, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 243COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E984652C: malloc.LIBCMT ref: 00007FF6E9846546

Part of subcall function 00007FF6E984652C: _callnewh.LIBCMT ref: 00007FF6E984653A
Part of subcall function 00007FF6E984652C: _CxxThrowException.LIBCMT ref: 00007FF6E984658F

_swprintf.LIBCMT ref: 00007FF6E982A239
_DeleteExceptionPtr.LIBCMT ref: 00007FF6E982A27E

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00007FF6E982A0BE

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Exception$DeleteThrow_callnewh_swprintfmalloc
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1450743214-557222456
Opcode ID: eee96dde1131b29d2a3135270e7c3fbab61fe5339ee6e602a83be96f0adc80c1
Instruction ID: 143f09e2e82c759de22f219656574a61f0855c70b2e3fd975cd794bda44a0a00
Opcode Fuzzy Hash: eee96dde1131b29d2a3135270e7c3fbab61fe5339ee6e602a83be96f0adc80c1
Instruction Fuzzy Hash: F4A1C623B1864291EA10EF65D0542BF6361FF81B84F544932ED0E87AF6DE3EE445C74A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9893130, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 95filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E98945C4: GetFullPathNameW.KERNEL32 ref: 00007FF6E98945F2

Part of subcall function 00007FF6E98945C4: GetFullPathNameW.KERNEL32 ref: 00007FF6E9894607

lstrcmpiW.KERNEL32 ref: 00007FF6E9893186
MoveFileW.KERNEL32 ref: 00007FF6E98931B6
wcscat.LIBCMT ref: 00007FF6E98931FE
SHFileOperationW.SHELL32 ref: 00007FF6E9893263

Strings

\*.*, xrefs: 00007FF6E98931F0

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: FileFullNamePath$MoveOperationlstrcmpiwcscat
String ID: \*.*
API String ID: 3196045410-1173974218
Opcode ID: 88bf8eb3a337bec1919450a82eb644d5eea745314348850dd887525ece524f25
Instruction ID: a19a00828e676f70750c394c991ff3d835c36df89ea209f4df9db38c7a487ff7
Opcode Fuzzy Hash: 88bf8eb3a337bec1919450a82eb644d5eea745314348850dd887525ece524f25
Instruction Fuzzy Hash: 95419623A0865395EB20DF64D8402FE2764FF95788F800432ED4DD7AB9DF2AD609C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9886970, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9888D6C: GetClassNameW.USER32 ref: 00007FF6E9888D97

SendMessageW.USER32 ref: 00007FF6E9886A17
SendMessageW.USER32 ref: 00007FF6E9886A34
SendMessageW.USER32 ref: 00007FF6E9886A6A

Strings

ListBox, xrefs: 00007FF6E98869D0
ComboBox, xrefs: 00007FF6E9886993

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend$ClassName
String ID: ComboBox$ListBox
API String ID: 787153527-1403004172
Opcode ID: 9d4462e86a4a88c45fb80373f65b19444578835cc28f5c11ec4618ddbec76bcf
Instruction ID: de03534a517c97381c14a847c0420a6bb1cd513baecf98bb02417f27baa1084e
Opcode Fuzzy Hash: 9d4462e86a4a88c45fb80373f65b19444578835cc28f5c11ec4618ddbec76bcf
Instruction Fuzzy Hash: 45310723A0864292EA24DF21F4406BB7360FF85B80F944A31DE5D877A6CF3DE945C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98A4668, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET ref: 00007FF6E98A46A8
HttpSendRequestW.WININET ref: 00007FF6E98A46DC
HttpQueryInfoW.WININET ref: 00007FF6E98A4728
InternetCloseHandle.WININET ref: 00007FF6E98A478B

Part of subcall function 00007FF6E98A57D8: GetLastError.KERNEL32 ref: 00007FF6E98A57F4
Part of subcall function 00007FF6E98A57D8: SetEvent.KERNEL32 ref: 00007FF6E98A5809

Strings

, xrefs: 00007FF6E98A471D

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: e5d9fbf70bed508b46255cc0e90c7d46af4fd6e33b1f2cc10590d18e38f9dcfb
Instruction ID: 8848600bb7b63c1471f597983687331702a7868429d40d0736aae2ec8f49f4d1
Opcode Fuzzy Hash: e5d9fbf70bed508b46255cc0e90c7d46af4fd6e33b1f2cc10590d18e38f9dcfb
Instruction Fuzzy Hash: C431F223A08A8685EBA08F21A504BAF6351FF85B80F245531DA4D87FA5DE3ED4428B06

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989C1F4, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF6E989C225
GetVolumeInformationW.KERNEL32 ref: 00007FF6E989C29D
_swprintf.LIBCMT ref: 00007FF6E989C2BA

Part of subcall function 00007FF6E98479E0: _errno.LIBCMT ref: 00007FF6E9847A18
Part of subcall function 00007FF6E98479E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9847A23

SetErrorMode.KERNEL32 ref: 00007FF6E989C313

Strings

%lu, xrefs: 00007FF6E989C2AE

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ErrorMode$InformationVolume_errno_invalid_parameter_noinfo_swprintf
String ID: %lu
API String ID: 219691675-685833217
Opcode ID: a8b7517bc5c0705c073124c94db4aac04ab47c73f62645c35c6cb84311f43291
Instruction ID: 37b54ab26e00f2ae9024666a18a215fd0f023c6d92d3464e4e8cf165aa015d5f
Opcode Fuzzy Hash: a8b7517bc5c0705c073124c94db4aac04ab47c73f62645c35c6cb84311f43291
Instruction Fuzzy Hash: 52318B37608B8696EB10DF11E4803AA6365FB88B84F404436EA8D87B65CF3ED595C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BE6E4, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6E98BE7AD
LoadLibraryW.KERNEL32 ref: 00007FF6E98BE7BA
SendMessageW.USER32 ref: 00007FF6E98BE7D8
DestroyWindow.USER32 ref: 00007FF6E98BE7E6

Strings

SysAnimate32, xrefs: 00007FF6E98BE76D

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 3ac3f2391a3304930a09083efbddf79682bec1009e328739b5c246095a7b9e4e
Instruction ID: 360d2c2215599961eb0f7494457d800e926a302f34f2ebb2b9fa27ae628d9aa5
Opcode Fuzzy Hash: 3ac3f2391a3304930a09083efbddf79682bec1009e328739b5c246095a7b9e4e
Instruction Fuzzy Hash: CC318437A086C18AEB608F25E05476F73A0EF89750F144A35EA5D87BA9EF3DD440CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9888024, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9887DEC: SendMessageTimeoutW.USER32 ref: 00007FF6E9887E24
Part of subcall function 00007FF6E9887DEC: GetWindowThreadProcessId.USER32 ref: 00007FF6E9887E34
Part of subcall function 00007FF6E9887DEC: GetCurrentThreadId.KERNEL32 ref: 00007FF6E9887E3C
Part of subcall function 00007FF6E9887DEC: AttachThreadInput.USER32 ref: 00007FF6E9887E61

GetFocus.USER32 ref: 00007FF6E988805E

Part of subcall function 00007FF6E9887E70: GetParent.USER32 ref: 00007FF6E9887E86

GetClassNameW.USER32 ref: 00007FF6E98880AF
EnumChildWindows.USER32 ref: 00007FF6E98880DD
_swprintf.LIBCMT ref: 00007FF6E98880F9

Part of subcall function 00007FF6E98479E0: _errno.LIBCMT ref: 00007FF6E9847A18
Part of subcall function 00007FF6E98479E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9847A23

Part of subcall function 00007FF6E9887DEC: GetWindowThreadProcessId.USER32 ref: 00007FF6E9887E4C
Part of subcall function 00007FF6E9887DEC: GetCurrentThreadId.KERNEL32 ref: 00007FF6E9887E54

Strings

%s%d, xrefs: 00007FF6E98880ED

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachChildClassEnumFocusInputMessageNameParentSendTimeoutWindows_errno_invalid_parameter_noinfo_swprintf
String ID: %s%d
API String ID: 1410855925-1110647743
Opcode ID: ac0b67dd71240f71fc9bd5792e08b14f0defd6d47382cf0e9b836b458c9962aa
Instruction ID: d45252834a68fe476177d022287f831a037a1aa57748f8d003c64cc9a1681b82
Opcode Fuzzy Hash: ac0b67dd71240f71fc9bd5792e08b14f0defd6d47382cf0e9b836b458c9962aa
Instruction Fuzzy Hash: A2218E2660868292EA249F21E4453FB6365FF05BC0F804531DE9D87B66DF2DE1068716

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98A0CF4, Relevance: 7.8, APIs: 5, Instructions: 312COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E98267E4: _itow.LIBCMT ref: 00007FF6E9826834
Part of subcall function 00007FF6E98267E4: _swprintf.LIBCMT ref: 00007FF6E9826881

Part of subcall function 00007FF6E983BA54: wcscpy.LIBCMT ref: 00007FF6E983BA8E

wcstok.LIBCMT ref: 00007FF6E98A0DFD

Part of subcall function 00007FF6E9848948: _getptd.LIBCMT ref: 00007FF6E9848958

wcstok.LIBCMT ref: 00007FF6E98A0EC0
wcscpy.LIBCMT ref: 00007FF6E98A0F90

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: wcscpywcstok$_getptd_itow_swprintf
String ID:
API String ID: 1257558946-0
Opcode ID: f85301b3a81e5ed226460a027b99d2954a0a6beb847654cf126f2417f3e6e44c
Instruction ID: e423c4ec056ca17fd72eca9daf25e0b4a3c8adaeef628803c9a943b7ab4693c1
Opcode Fuzzy Hash: f85301b3a81e5ed226460a027b99d2954a0a6beb847654cf126f2417f3e6e44c
Instruction Fuzzy Hash: D5E16F23A08A8685EB50EF25D4802BE7360FF94B98F404932DA4D877B6DF7AE545C306

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98AB13C, Relevance: 7.8, APIs: 5, Instructions: 254networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32 ref: 00007FF6E98AB2A1
#17.WSOCK32 ref: 00007FF6E98AB2D6
WSAGetLastError.WSOCK32 ref: 00007FF6E98AB2E5
inet_ntoa.WSOCK32 ref: 00007FF6E98AB37B
htons.WSOCK32 ref: 00007FF6E98AB3CB

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ErrorLasthtonsinet_ntoa
String ID:
API String ID: 2227131780-0
Opcode ID: 3ba755b6a1ab713798b0cfa13c79ea31c01084492438d5643b301e9ef54f40bf
Instruction ID: 9404b55d0775c16bb1cddcb38069472a312427405733ac45c07e07c10fb1a737
Opcode Fuzzy Hash: 3ba755b6a1ab713798b0cfa13c79ea31c01084492438d5643b301e9ef54f40bf
Instruction Fuzzy Hash: DFB19E23A0864281EA50DF26E4547BB67A0BF80BD4F444932DA1D877F6DF7ED0458746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98B4FD4, Relevance: 7.7, APIs: 5, Instructions: 211COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF6E98B5086
OpenProcess.KERNEL32 ref: 00007FF6E98B5096
GetProcessIoCounters.KERNEL32 ref: 00007FF6E98B50CC
CloseHandle.KERNEL32 ref: 00007FF6E98B5290

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 5ad56b37bb1a0b6d8511e9a493dc486a9811e5e9b7d8615e3d38c714d594f57d
Instruction ID: 058e30050d21f9c66a74ae23ec9da95db8cb3f10408f8d216dab80d530e8cc56
Opcode Fuzzy Hash: 5ad56b37bb1a0b6d8511e9a493dc486a9811e5e9b7d8615e3d38c714d594f57d
Instruction Fuzzy Hash: 35819F23B0569286EB04DF22D4147AE27A0BF49BC4F494836DE0D977A6DF3EE401C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98599B4, Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6E98599D8

Part of subcall function 00007FF6E98595E8: _errno.LIBCMT ref: 00007FF6E98595F1
Part of subcall function 00007FF6E98595E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E98595FC

cvtdate.LIBCMT ref: 00007FF6E9859ABD
cvtdate.LIBCMT ref: 00007FF6E9859BC1
_invoke_watson.LIBCMT ref: 00007FF6E9859C5B

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: cvtdate$_errno_get_daylight_invalid_parameter_noinfo_invoke_watson
String ID:
API String ID: 1447642234-0
Opcode ID: 18c274a45b0160fc11a04c9c591cb39bbd2c86ed9a32dce963da8c59c1bf12ac
Instruction ID: 2d6514eede4be0c834813ed223caec2e667105fc767f8cb8c4f17fc7dbc449c3
Opcode Fuzzy Hash: 18c274a45b0160fc11a04c9c591cb39bbd2c86ed9a32dce963da8c59c1bf12ac
Instruction Fuzzy Hash: 73817E7391C2528BE7748F05A44163ABBE1FF84740F54453AE68A82AA5DF7FE444CF0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98B6AB4, Relevance: 7.7, APIs: 5, Instructions: 158registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E984652C: malloc.LIBCMT ref: 00007FF6E9846546

RegConnectRegistryW.ADVAPI32 ref: 00007FF6E98B6BB4
RegOpenKeyExW.ADVAPI32 ref: 00007FF6E98B6C0F
RegEnumValueW.ADVAPI32 ref: 00007FF6E98B6C7C
RegCloseKey.ADVAPI32 ref: 00007FF6E98B6CD1
RegCloseKey.ADVAPI32 ref: 00007FF6E98B6CE0

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Close$ConnectEnumOpenRegistryValuemalloc
String ID:
API String ID: 41126224-0
Opcode ID: bca5bfd05ddf71fd85ca120221bf2d7c85e947b8959b6ece64a46242c10318a7
Instruction ID: 08b4279fd93a7950be62561cd8276944d3f7c667db7c2d5e82c744ca08ad29ee
Opcode Fuzzy Hash: bca5bfd05ddf71fd85ca120221bf2d7c85e947b8959b6ece64a46242c10318a7
Instruction Fuzzy Hash: C9713937B08A4699EB10DF61D4943EE3370EF84B58F444532DA0D9BAAADF39D109C746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E988DEE4, Relevance: 7.6, APIs: 5, Instructions: 133COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF6E988DF15
VariantClear.OLEAUT32 ref: 00007FF6E988DF99
VariantClear.OLEAUT32 ref: 00007FF6E988E006
VariantClear.OLEAUT32 ref: 00007FF6E988E090
VariantChangeType.OLEAUT32 ref: 00007FF6E988E0C9

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 1377f9dea758058a04abba3501e006d4d0d9500ae0062a2c9f0ab9f246e70ea4
Instruction ID: 64544ce53b61d03a42411e1ceeb78bfc3022f2844d4a4f99455e1c2262c7079f
Opcode Fuzzy Hash: 1377f9dea758058a04abba3501e006d4d0d9500ae0062a2c9f0ab9f246e70ea4
Instruction Fuzzy Hash: F1515737628A49D2DB20DF25E4907AE7370FB88B44F814622DB8E83764DF3AD159C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98A064C, Relevance: 7.6, APIs: 5, Instructions: 122COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32 ref: 00007FF6E98A0725
GetPrivateProfileSectionW.KERNEL32 ref: 00007FF6E98A0751
WritePrivateProfileSectionW.KERNEL32 ref: 00007FF6E98A07A4
WritePrivateProfileStringW.KERNEL32 ref: 00007FF6E98A07C2
WritePrivateProfileStringW.KERNEL32 ref: 00007FF6E98A07D2

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 11ff415432176d01dc6d7496e281c688ba66bbe81a6ddaaf701349208cbe404e
Instruction ID: 33c73f8a9a130dfb45c2b53576982f1dbcace1ab3066c5d5c0ff5aa249d48092
Opcode Fuzzy Hash: 11ff415432176d01dc6d7496e281c688ba66bbe81a6ddaaf701349208cbe404e
Instruction Fuzzy Hash: 08514D37608B4682EB54DF26E45066A6760FF88B84F048432DF4E877A6DF3EE545C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98241A8, Relevance: 7.6, APIs: 5, Instructions: 112keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?,?,?,00000000,?,00007FF6E98C5DAF), ref: 00007FF6E98241D3
ScreenToClient.USER32 ref: 00007FF6E98241F2
GetAsyncKeyState.USER32 ref: 00007FF6E9824212
GetAsyncKeyState.USER32 ref: 00007FF6E9824223

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 64f10c7605812be8a38466203bdb00b3afe4b948577fef2cdcb8cec22017fd11
Instruction ID: 10d60901fad63b78280019478940bed462be86b33eb3a4db53bc6b4bb579caa1
Opcode Fuzzy Hash: 64f10c7605812be8a38466203bdb00b3afe4b948577fef2cdcb8cec22017fd11
Instruction Fuzzy Hash: 3041C0376182829BE728CF32844436A77A0FF49758F041735DA6D977E6CF39E4518B06

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C528C, Relevance: 7.6, APIs: 5, Instructions: 111COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000,?,00007FF6E98C511C,?,?,?,?,?,?,?,?,?,00007FF6E9863D02), ref: 00007FF6E98C5326
EnableWindow.USER32 ref: 00007FF6E98C5351
ShowWindow.USER32 ref: 00007FF6E98C53BB
ShowWindow.USER32 ref: 00007FF6E98C53D7
EnableWindow.USER32 ref: 00007FF6E98C5405

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Window$Show$Enable
String ID:
API String ID: 2939132127-0
Opcode ID: c1e902437f708fed2b810a831cce6472f242ca53c5b49537d788692538cc7288
Instruction ID: f5c24a2ea88e1aea80f6a43377b830765ea99bd6318a747d7715dfcdd822e159
Opcode Fuzzy Hash: c1e902437f708fed2b810a831cce6472f242ca53c5b49537d788692538cc7288
Instruction Fuzzy Hash: 05518F2390968685EF15CF25D04877E7760EB84F89F284936CE1D8B660CF7ED446C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98863F8, Relevance: 7.6, APIs: 5, Instructions: 91sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FF6E9886426
PostMessageW.USER32 ref: 00007FF6E98864C5
Sleep.KERNEL32(?,?,?,?,?,00007FF6E98863CA), ref: 00007FF6E98864CD
PostMessageW.USER32 ref: 00007FF6E98864E0
Sleep.KERNEL32(?,?,?,?,?,00007FF6E98863CA), ref: 00007FF6E98864E8

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: a68ed62286e49ce19a21a848dcb8b9f4313b4bed3615c548735caa0206cb064b
Instruction ID: 1a3cf4f92d915186eb48fcab6a6ef321b08bbcd09e20d6cdd5c1a28f2b0abf42
Opcode Fuzzy Hash: a68ed62286e49ce19a21a848dcb8b9f4313b4bed3615c548735caa0206cb064b
Instruction Fuzzy Hash: 7D31B537A0861097E724CF19E44826E73A1FB88B64F954631EE5EC77A4CE3DE845C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98B7A90, Relevance: 7.6, APIs: 5, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32 ref: 00007FF6E98B7AE3
RegOpenKeyExW.ADVAPI32 ref: 00007FF6E98B7B16

Part of subcall function 00007FF6E98B7A90: RegCloseKey.ADVAPI32 ref: 00007FF6E98B7B3B
Part of subcall function 00007FF6E98B7A90: RegEnumKeyExW.ADVAPI32 ref: 00007FF6E98B7BDD

RegDeleteKeyW.ADVAPI32 ref: 00007FF6E98B7B8D

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Enum$CloseDeleteOpen
String ID:
API String ID: 2095303065-0
Opcode ID: 004aeb1785dead42b48b553284c5c9942a9258c9cf753af36435325ae1989457
Instruction ID: 10456433fa324c47505e07eb79d92952bcd03dbb0f02fe18dba72fb040cfe282
Opcode Fuzzy Hash: 004aeb1785dead42b48b553284c5c9942a9258c9cf753af36435325ae1989457
Instruction Fuzzy Hash: 1C418037608B8296E760CF21E8503EB63A0FB88384F444535E68D87A69EF3DD5488B05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9889544, Relevance: 7.6, APIs: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00007FF6E988957A
SendMessageW.USER32 ref: 00007FF6E98895A3
SendMessageW.USER32 ref: 00007FF6E98895E8
CharUpperBuffW.USER32 ref: 00007FF6E988960C
wcsstr.LIBCMT ref: 00007FF6E9889619

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindowwcsstr
String ID:
API String ID: 2655805287-0
Opcode ID: 7a4e423edfa5754fbcaf84868842c841add0b86ff75888709298abbbc1a89df9
Instruction ID: 4eaf37f86a9e0b74c75ae8ec287c1c0c1e68165bd2a70de4ca93494e7ecb96f3
Opcode Fuzzy Hash: 7a4e423edfa5754fbcaf84868842c841add0b86ff75888709298abbbc1a89df9
Instruction Fuzzy Hash: AD21B563B0978242EB14DF62A91437A26A5FF88FE0F444A30EE5D87BA5DE3ED441C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98A9A4C, Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF6E98A9A7E
GetForegroundWindow.USER32 ref: 00007FF6E98A9A97
GetDC.USER32 ref: 00007FF6E98A9ADA
GetPixel.GDI32 ref: 00007FF6E98A9AEB
ReleaseDC.USER32 ref: 00007FF6E98A9B23

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: e75b8b88c28ca4be6e0cd236a652e7b5504568fd22b9b756cf877d9c902e1ac3
Instruction ID: 91a5b5767ef1170f6e9c0dce3ebca6197ecbb8530473266c35db57fd084b8ef3
Opcode Fuzzy Hash: e75b8b88c28ca4be6e0cd236a652e7b5504568fd22b9b756cf877d9c902e1ac3
Instruction Fuzzy Hash: 18215327B09B4182EB04DF66D88426E67A0FF88F94F044836DE4D87765DE7ED441C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9822C4C, Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,?,?,?,?,?,00000000,00007FF6E9863BB3), ref: 00007FF6E9822CD9
SelectObject.GDI32(?,?,?,?,?,?,?,00000000,00007FF6E9863BB3), ref: 00007FF6E9822CEC
BeginPath.GDI32 ref: 00007FF6E9822D05
SelectObject.GDI32(?,?,?,?,?,?,?,00000000,00007FF6E9863BB3), ref: 00007FF6E9822D2C

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: d53bbfad704af05b35703ab9994e595cb38cc7321dba6099b6d813da72d6a47b
Instruction ID: 7f225a651fd982389ea81841e700e77d30ba421969c1d9932044f21dc61bab8e
Opcode Fuzzy Hash: d53bbfad704af05b35703ab9994e595cb38cc7321dba6099b6d813da72d6a47b
Instruction Fuzzy Hash: 21319C33D187528AF7548F10B84433A77A0FF48B90F580536DA59877A5EF7EE8408B4A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9894B68, Relevance: 7.6, APIs: 5, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF6E9894BA7
_beginthreadex.LIBCMT ref: 00007FF6E9894BD6

Part of subcall function 00007FF6E98481C0: _errno.LIBCMT ref: 00007FF6E98481EB
Part of subcall function 00007FF6E98481C0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E98481F6

MessageBoxW.USER32 ref: 00007FF6E9894BEA
WaitForSingleObject.KERNEL32 ref: 00007FF6E9894C04
CloseHandle.KERNEL32 ref: 00007FF6E9894C0D

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait_beginthreadex_errno_invalid_parameter_noinfo
String ID:
API String ID: 235272855-0
Opcode ID: 5056b8a32d2944418895da1bd04039fbbc53c10affa643c564089e30e7beb4bf
Instruction ID: f7acce1174290c2ab588f6a4381e12e01105a6766be61f77e46fd718f12cfbbf
Opcode Fuzzy Hash: 5056b8a32d2944418895da1bd04039fbbc53c10affa643c564089e30e7beb4bf
Instruction Fuzzy Hash: 3921A133A0C7818AE7108F26B84426A7790FF88B94F044636EE9D87BB5DF3DD445874A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E988561C, Relevance: 7.5, APIs: 5, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 00007FF6E988564E
GetLastError.KERNEL32 ref: 00007FF6E988565A
GetProcessHeap.KERNEL32 ref: 00007FF6E9885667
HeapAlloc.KERNEL32 ref: 00007FF6E9885676
GetTokenInformation.ADVAPI32 ref: 00007FF6E9885695

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: e626ad860f76b223a8b7b1dc3b2799941818b96b4301bc63792e0a64dcd86878
Instruction ID: d2c53bdd133c612a198f4653cf1752bc0d2d770e270dfc5b59a6ee6441031f50
Opcode Fuzzy Hash: e626ad860f76b223a8b7b1dc3b2799941818b96b4301bc63792e0a64dcd86878
Instruction Fuzzy Hash: 18115B37A04B8186E720CF12E94066A77A0FF88F84F454935DB8D8B724DF3AE516C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9885574, Relevance: 7.5, APIs: 5, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 00007FF6E98855A6
GetLastError.KERNEL32 ref: 00007FF6E98855B2
GetProcessHeap.KERNEL32 ref: 00007FF6E98855BF
HeapAlloc.KERNEL32 ref: 00007FF6E98855CE
GetTokenInformation.ADVAPI32 ref: 00007FF6E98855ED

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 1d87c24ed2ac6ef50673aec8e958f4d6dd6d5176b35993e69db06ca1bd00595b
Instruction ID: efacad840410592fb6096f5e51a6036ce9de57addfdcc3c9e4c297636481a62a
Opcode Fuzzy Hash: 1d87c24ed2ac6ef50673aec8e958f4d6dd6d5176b35993e69db06ca1bd00595b
Instruction Fuzzy Hash: F0115B33A08B8186E7248F12E44066E77A1FF88F84F454935DB8D87724DF3AE5118B09

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98841CC, Relevance: 7.5, APIs: 5, Instructions: 43stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32 ref: 00007FF6E98841F5
ProgIDFromCLSID.OLE32 ref: 00007FF6E9884214
lstrcmpiW.KERNEL32 ref: 00007FF6E9884226
CoTaskMemFree.OLE32 ref: 00007FF6E9884238
CLSIDFromString.OLE32 ref: 00007FF6E9884246

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 8b12a9664264167f2a2dd2aff306c73f5255853b61b6ed3da092b1a7961bedec
Instruction ID: 320093b76ab62f5ee2a134647b4569801245316408c259e12bed6a0fbc067d12
Opcode Fuzzy Hash: 8b12a9664264167f2a2dd2aff306c73f5255853b61b6ed3da092b1a7961bedec
Instruction Fuzzy Hash: 63110033A0CA5286E7548F26E80036B62A4FF85BD0F585531DE49CB768DF3ED4458716

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E984803C, Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF6E9848061

Part of subcall function 00007FF6E9847094: _getptd.LIBCMT ref: 00007FF6E98470AA
Part of subcall function 00007FF6E9847094: __updatetlocinfo.LIBCMT ref: 00007FF6E98470DF
Part of subcall function 00007FF6E9847094: __updatetmbcinfo.LIBCMT ref: 00007FF6E9847106

_errno.LIBCMT ref: 00007FF6E984806B

Part of subcall function 00007FF6E9850468: _getptd_noexit.LIBCMT ref: 00007FF6E985046C

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9848076
iswctype.LIBCMT ref: 00007FF6E984808C
_fltin2.LIBCMT ref: 00007FF6E98480A2

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_fltin2_getptd_getptd_noexit_invalid_parameter_noinfoiswctype
String ID:
API String ID: 243505584-0
Opcode ID: 4240de394a7b26bdd0a4ef7bbb426eb9300153f21754f1ea29144a9f5e449222
Instruction ID: 621327777f434d133f59676a67e44c55b1dfc6852f63441986b4f1565eb39b26
Opcode Fuzzy Hash: 4240de394a7b26bdd0a4ef7bbb426eb9300153f21754f1ea29144a9f5e449222
Instruction Fuzzy Hash: 2801F953A1864681FB51AF20D4513FB6354EF94B54F540531E68EC62F5EE3DD0858B06

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98953F0, Relevance: 7.5, APIs: 5, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF6E9895409
QueryPerformanceFrequency.KERNEL32 ref: 00007FF6E9895418
Sleep.KERNEL32 ref: 00007FF6E9895420
QueryPerformanceCounter.KERNEL32 ref: 00007FF6E989542B
Sleep.KERNEL32 ref: 00007FF6E9895466

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: eb37bbaf33ea0dc4d261643506fac097fdefd6aefe8844b7dbe6fca84235100b
Instruction ID: e2792830de611f121340ccc27e30c30d6cb80939b5bc8f6e134fed914cba7fa5
Opcode Fuzzy Hash: eb37bbaf33ea0dc4d261643506fac097fdefd6aefe8844b7dbe6fca84235100b
Instruction Fuzzy Hash: EC01B162A1CA0251EA458F30A4A833F9321AF95782F140A36E60FD6571CF2FE4C4860A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9897C4C, Relevance: 7.5, APIs: 5, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,00007FF6E9868E39,?,?,00000000,00007FF6E982C529), ref: 00007FF6E9897C80
TerminateThread.KERNEL32(?,?,00000000,00007FF6E9868E39,?,?,00000000,00007FF6E982C529), ref: 00007FF6E9897C8B
WaitForSingleObject.KERNEL32(?,?,00000000,00007FF6E9868E39,?,?,00000000,00007FF6E982C529), ref: 00007FF6E9897C99
~SyncLockT.VCCORLIB ref: 00007FF6E9897CA2

Part of subcall function 00007FF6E98973F4: CloseHandle.KERNEL32(?,?,?,00007FF6E9897CA7,?,?,00000000,00007FF6E9868E39,?,?,00000000,00007FF6E982C529), ref: 00007FF6E9897405

LeaveCriticalSection.KERNEL32(?,?,00000000,00007FF6E9868E39,?,?,00000000,00007FF6E982C529), ref: 00007FF6E9897CAE

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: CriticalSection$CloseEnterHandleLeaveLockObjectSingleSyncTerminateThreadWait
String ID:
API String ID: 3142591903-0
Opcode ID: 0d05b77108b7a400faa0272b9730c23c364e6db219082172edb3f72409ad2ca3
Instruction ID: 48342f2113fcd2ddfec8d94bf2ab77a6e2e4e7d4f404cec331586d6e90213a69
Opcode Fuzzy Hash: 0d05b77108b7a400faa0272b9730c23c364e6db219082172edb3f72409ad2ca3
Instruction Fuzzy Hash: 27012236A08A51A6E6109F15E44422A7320FB88B80F104930EB8E87B64CF3ED996C746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9822D50, Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

EndPath.GDI32 ref: 00007FF6E9822D6C
StrokeAndFillPath.GDI32 ref: 00007FF6E9822D84
SelectObject.GDI32 ref: 00007FF6E9822D99
DeleteObject.GDI32 ref: 00007FF6E9822DAE
StrokePath.GDI32 ref: 00007FF6E9822DCE

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: dc4656a468f86a4ac69955706039954e4c3114e3b9a9ecfe89493bcfdf752d47
Instruction ID: 81047a0dfde4b62905543082d07b0cae267e9b229c6f5bca6c47e3dc285756a9
Opcode Fuzzy Hash: dc4656a468f86a4ac69955706039954e4c3114e3b9a9ecfe89493bcfdf752d47
Instruction Fuzzy Hash: 23012573D0C64795F7185F21B5483392361AF44B95F184631C62E8A6B5EF3FA444874F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9888AB8, Relevance: 7.5, APIs: 5, Instructions: 27threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32 ref: 00007FF6E9888AD5
GetCurrentThreadId.KERNEL32 ref: 00007FF6E9888ADD
GetWindowThreadProcessId.USER32 ref: 00007FF6E9888AF0
GetCurrentThreadId.KERNEL32 ref: 00007FF6E9888AF8
AttachThreadInput.USER32(?,?,?,00007FF6E9887290), ref: 00007FF6E9888B05

Part of subcall function 00007FF6E9845818: SendMessageTimeoutW.USER32 ref: 00007FF6E9845849

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: c2de3753e55d1698e421122be381289cfd11b5750bc2ee5b224350e7adb9f7be
Instruction ID: aec3b5df2516111512798756fd7748a5d16ef674b1878e9999ad49e8ae2b37d8
Opcode Fuzzy Hash: c2de3753e55d1698e421122be381289cfd11b5750bc2ee5b224350e7adb9f7be
Instruction Fuzzy Hash: 8DF0A022F1C61243FB286F76684C77B12456F88742F444830C80AC7271DD2FA4C5470B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98930D8, Relevance: 7.5, APIs: 5, Instructions: 26threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32 ref: 00007FF6E98930F4
GetCurrentThreadId.KERNEL32 ref: 00007FF6E98930FC
GetWindowThreadProcessId.USER32 ref: 00007FF6E989310C
GetCurrentThreadId.KERNEL32 ref: 00007FF6E9893114
AttachThreadInput.USER32 ref: 00007FF6E9893121

Part of subcall function 00007FF6E9894B30: SendMessageTimeoutW.USER32 ref: 00007FF6E9894B56

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: 19035ce24e6a1511ebb176dc486e41a574733088b5f444cb4114494dc82de8b2
Instruction ID: 4c52139c710be71cf79283fd9f7b8ea455d6bf91a331c5091e55c9a77c299d8c
Opcode Fuzzy Hash: 19035ce24e6a1511ebb176dc486e41a574733088b5f444cb4114494dc82de8b2
Instruction Fuzzy Hash: C2F06526F1862243FB542FB6688937B02556F58745F445830CC0EC7275ED3F94C5470B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9867FDB, Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 289COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E988BFEC: std::exception_ptr::_Current_exception.LIBCONCRT ref: 00007FF6E988C009

std::exception_ptr::_Current_exception.LIBCONCRT ref: 00007FF6E98682BC

Strings

@COM_EVENTOBJ, xrefs: 00007FF6E9868429

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Current_exceptionstd::exception_ptr::_
String ID: @COM_EVENTOBJ
API String ID: 3524498493-2228938565
Opcode ID: 0d48cbef5f0e3ed96fbede941a9db62f038f158a52fac9a2c9daa5ceadee9241
Instruction ID: 21141f545dcf937626a7b0233144917527137f0183ff3562977802b9e6e02c73
Opcode Fuzzy Hash: 0d48cbef5f0e3ed96fbede941a9db62f038f158a52fac9a2c9daa5ceadee9241
Instruction Fuzzy Hash: 5FD18B33A2864286EB10DF14D4847BE67A1FF84748F904936DA4D876B6DF3EE845C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989DF60, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 245comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF6E989E047
CoCreateInstance.OLE32 ref: 00007FF6E989E06C
CoUninitialize.OLE32 ref: 00007FF6E989E356

Strings

.lnk, xrefs: 00007FF6E989DFBF, 00007FF6E989DFEC

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: .lnk
API String ID: 948891078-24824748
Opcode ID: 883dd47ad53f72f8ae726027e8921f8eaf69e79bc9c5f4966c41d49c3be858c6
Instruction ID: c589371ba4515fac02d8063c7718f157d3063e2c162d69caf34326129e5fb011
Opcode Fuzzy Hash: 883dd47ad53f72f8ae726027e8921f8eaf69e79bc9c5f4966c41d49c3be858c6
Instruction Fuzzy Hash: FBB15A73B18A8692EB10DF25E4547EE6760FF85B88F804436EA0D87B69DF3AD508C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989D258, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 230comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E983A41C: GetFullPathNameW.KERNEL32(?,00007FF6E983A409,?,00007FF6E983C9BC,?,?,?,00007FF6E98210D6), ref: 00007FF6E983A43E

CoInitialize.OLE32 ref: 00007FF6E989D308
CoCreateInstance.OLE32 ref: 00007FF6E989D32A
CoUninitialize.OLE32 ref: 00007FF6E989D344

Strings

.lnk, xrefs: 00007FF6E989D2DA, 00007FF6E989D2F6

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize
String ID: .lnk
API String ID: 3769357847-24824748
Opcode ID: 60945f8c30dab2e080496538c7f3887ef2e54f5008aea3efeff4e8e1ca67373a
Instruction ID: 2efd1a62c1fd287911493a19f19b496439535100d7450e0b155564655d8b2ff3
Opcode Fuzzy Hash: 60945f8c30dab2e080496538c7f3887ef2e54f5008aea3efeff4e8e1ca67373a
Instruction Fuzzy Hash: 6FA13927B14B4A86EB00EF66D0542AE37B0FF88B88B444932DE4D97769DF3AD405C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98AD2BC, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 198COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF6E98AD300
VariantClear.OLEAUT32 ref: 00007FF6E98AD588

Part of subcall function 00007FF6E9898068: VariantInit.OLEAUT32 ref: 00007FF6E98980B7
Part of subcall function 00007FF6E9898068: VariantCopy.OLEAUT32 ref: 00007FF6E98980C3
Part of subcall function 00007FF6E9898068: VariantClear.OLEAUT32 ref: 00007FF6E98980D0

Strings

Incorrect Parameter format, xrefs: 00007FF6E98AD32F, 00007FF6E98AD4EE
AUTOIT.ERROR, xrefs: 00007FF6E98AD40D

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Variant$ClearInit$Copy
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 2099348436-1221869570
Opcode ID: c7c68849b5b1650aaa2db5d49533493011e209e6044e3e2bb45a6607686d3f15
Instruction ID: b2c1d398de7351d391ac999d03ef5617f602dd174407f56c18bb622013ed3b94
Opcode Fuzzy Hash: c7c68849b5b1650aaa2db5d49533493011e209e6044e3e2bb45a6607686d3f15
Instruction Fuzzy Hash: 57914833A09B4685EB50DF65D4902AE33A4FF48B88F504936DE4E877A5DF7AE406C306

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E984C488, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6E984C52D

Part of subcall function 00007FF6E98547F4: _ctrlfp.LIBCMT ref: 00007FF6E985482F
Part of subcall function 00007FF6E98547F4: _exception_enabled.LIBCMT ref: 00007FF6E9854852
Part of subcall function 00007FF6E98547F4: _raise_exc.LIBCMT ref: 00007FF6E985489B
Part of subcall function 00007FF6E98547F4: _call_matherr.LIBCMT ref: 00007FF6E98548D6

_set_statfp.LIBCMT ref: 00007FF6E984C577

Strings

!, xrefs: 00007FF6E984C5A5
acos, xrefs: 00007FF6E984C521

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _call_matherr_ctrlfp_exception_enabled_handle_error_raise_exc_set_statfp
String ID: !$acos
API String ID: 3424005422-2870037509
Opcode ID: 46dc77e5704d883311eb2c44df5d734859727a026add0e5579fecb2a2e681127
Instruction ID: b7860fc9a87746a8b49e4fbcf611f69b5589de3be5bd8ea3ce523eda64855dd8
Opcode Fuzzy Hash: 46dc77e5704d883311eb2c44df5d734859727a026add0e5579fecb2a2e681127
Instruction Fuzzy Hash: 1571D633D28F4585E2538F345850377926CBF66390F118737E91E76A74DF2EA0838A05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E988753C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9890C10: WriteProcessMemory.KERNEL32 ref: 00007FF6E9890C5B

SendMessageW.USER32 ref: 00007FF6E98875B1

Part of subcall function 00007FF6E9890BC4: ReadProcessMemory.KERNEL32 ref: 00007FF6E9890C02

Part of subcall function 00007FF6E9890AC4: GetWindowThreadProcessId.USER32 ref: 00007FF6E9890B08
Part of subcall function 00007FF6E9890AC4: OpenProcess.KERNEL32(?,?,?,?,00000000,00007FF6E9886E3E), ref: 00007FF6E9890B1A
Part of subcall function 00007FF6E9890AC4: VirtualAllocEx.KERNEL32 ref: 00007FF6E9890B40

SendMessageW.USER32 ref: 00007FF6E9887639
SendMessageW.USER32 ref: 00007FF6E9887693

Strings

@, xrefs: 00007FF6E98876AE

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: d9c7c99bf198afa9150aa15c7387d842fc4fa1d747fe47254c1f94827ac61952
Instruction ID: 9e71a21eaffb8d488ce39835652cf21a9b9aec6bd2f394c5c45f083ed7d2a4d8
Opcode Fuzzy Hash: d9c7c99bf198afa9150aa15c7387d842fc4fa1d747fe47254c1f94827ac61952
Instruction Fuzzy Hash: 2951F17361868292D720CF51E485AAFB720FBC4788F441432EA8E83BA5CF7DD509CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E984C22C, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6E984C2CB
_set_statfp.LIBCMT ref: 00007FF6E984C2F8

Strings

atan, xrefs: 00007FF6E984C2A8
!, xrefs: 00007FF6E984C2BE

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _handle_error_set_statfp
String ID: !$atan
API String ID: 3065776435-1342027943
Opcode ID: 7ae138ff8bf5447cc821be4f1d85c208b982aff8165ec0721ecf66b8dcb94ec8
Instruction ID: cff32758f648bc9fb32d5c2cfb16122a599ef35eba8bd9230b7abefb60854e5f
Opcode Fuzzy Hash: 7ae138ff8bf5447cc821be4f1d85c208b982aff8165ec0721ecf66b8dcb94ec8
Instruction Fuzzy Hash: 4251AE72C19F1685E6938F759441377672CAF663D5F108F37D81EA2A71CF2EA0834A0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C0708, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32 ref: 00007FF6E98C0806
GetWindowLongW.USER32 ref: 00007FF6E98C082C
SetWindowLongPtrW.USER32 ref: 00007FF6E98C083F

Strings

SysTreeView32, xrefs: 00007FF6E98C0797

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 0c738f10df1e9992648cf4153bc19c60ec41a6bbcff3b71ad5baf03ef70039fc
Instruction ID: 07a02c8f36170013ef6e3e696d529c58d04b0fad5ca4aebcab1e2769d3558b37
Opcode Fuzzy Hash: 0c738f10df1e9992648cf4153bc19c60ec41a6bbcff3b71ad5baf03ef70039fc
Instruction Fuzzy Hash: 5F419033A096818AD760CF25E440B5E77A0FB887A0F104735DAA897BA8DF39D451CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9892244, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF6E98922D3
DeleteMenu.USER32 ref: 00007FF6E989232A
DeleteMenu.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6E9892384

Strings

P, xrefs: 00007FF6E98922B0

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: P
API String ID: 135850232-3110715001
Opcode ID: 7417d4dbb0f97ce9fae989628726ac4a0d1eab3561381c8ef620b9ce9315cd99
Instruction ID: 149a674c744d6b3ceb9b55b8b2f251f210435aa51a919af5efa4d192dc146a1f
Opcode Fuzzy Hash: 7417d4dbb0f97ce9fae989628726ac4a0d1eab3561381c8ef620b9ce9315cd99
Instruction Fuzzy Hash: 9E41A423A0868186EB649F25D4403BE6361EF84B64F188635EAAD877F5CF3EE445C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BFE4C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E98239AC: CreateWindowExW.USER32 ref: 00007FF6E9823A3A
Part of subcall function 00007FF6E98239AC: GetStockObject.GDI32 ref: 00007FF6E9823A57
Part of subcall function 00007FF6E98239AC: SendMessageW.USER32 ref: 00007FF6E9823A6A

SendMessageW.USER32 ref: 00007FF6E98BFF29
SetWindowPos.USER32 ref: 00007FF6E98BFF52
SendMessageW.USER32 ref: 00007FF6E98BFF89

Strings

SysMonthCal32, xrefs: 00007FF6E98BFEC7

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectStock
String ID: SysMonthCal32
API String ID: 2671490118-1439706946
Opcode ID: e7c0f63be9a2b57b23e0c24b06d4d14e46af63580d7e844ec2b14d9080f2fcd5
Instruction ID: 1522e048b42320a74a4ae3dc3e60b570e4fa2e9173eb4fdd8296a0178d22fce6
Opcode Fuzzy Hash: e7c0f63be9a2b57b23e0c24b06d4d14e46af63580d7e844ec2b14d9080f2fcd5
Instruction Fuzzy Hash: 81418D376186818AE720CF15E044B5AB7A1FB88790F544625EF9887BA8DF3ED880CF01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BF4B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E98239AC: CreateWindowExW.USER32 ref: 00007FF6E9823A3A
Part of subcall function 00007FF6E98239AC: GetStockObject.GDI32 ref: 00007FF6E9823A57
Part of subcall function 00007FF6E98239AC: SendMessageW.USER32 ref: 00007FF6E9823A6A

SendMessageW.USER32 ref: 00007FF6E98BF59A
SendMessageW.USER32 ref: 00007FF6E98BF5AE
MoveWindow.USER32 ref: 00007FF6E98BF5DB

Strings

Listbox, xrefs: 00007FF6E98BF520

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend$Window$CreateMoveObjectStock
String ID: Listbox
API String ID: 3747482310-2633736733
Opcode ID: c4d1c3d615bb89018e4e3d43cf25f98406812be9783f3bd37b5f1ef0c8a4b9cf
Instruction ID: ea97d42fc8c0a0f4a13def67c19262b1f26bc07918d313aa6ee261eb2296385e
Opcode Fuzzy Hash: c4d1c3d615bb89018e4e3d43cf25f98406812be9783f3bd37b5f1ef0c8a4b9cf
Instruction Fuzzy Hash: 1B319E3760868186E3609F15A440B5BB7A1FB887A0F504636EA9943BA8DF3DD881CF05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C0A50, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6E98C0B68
SendMessageW.USER32 ref: 00007FF6E98C0B80
DestroyWindow.USER32 ref: 00007FF6E98C0B8D

Strings

msctls_updown32, xrefs: 00007FF6E98C0AB5

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 84b0473f34258af386f85c35bb9c4c95aeac8dd1c98619ab0fd88a1e0c3d0452
Instruction ID: 8a8a380e0de45bc565bdf8e0c4348901ea3fa5a5a39cbd6f38801c0cad28fa83
Opcode Fuzzy Hash: 84b0473f34258af386f85c35bb9c4c95aeac8dd1c98619ab0fd88a1e0c3d0452
Instruction Fuzzy Hash: B931BE73A18B8686EB20CF11E4503AA7361FF85B94F144632DA8D87B64DF3ED444CB06

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C03BC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E98239AC: CreateWindowExW.USER32 ref: 00007FF6E9823A3A
Part of subcall function 00007FF6E98239AC: GetStockObject.GDI32 ref: 00007FF6E9823A57
Part of subcall function 00007FF6E98239AC: SendMessageW.USER32 ref: 00007FF6E9823A6A

SendMessageW.USER32 ref: 00007FF6E98C046E
SendMessageW.USER32 ref: 00007FF6E98C048A
SendMessageW.USER32 ref: 00007FF6E98C049F

Strings

msctls_trackbar32, xrefs: 00007FF6E98C0429

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: msctls_trackbar32
API String ID: 1025951953-1010561917
Opcode ID: bc134b4c96ab57a31bc4ea7f2ae475fa40dc48c7a7b61fc8e4275ae1b615d47d
Instruction ID: 05e077272da133274e149a1026edd55f6ff0032757940fedf63fcc5f0760f2b2
Opcode Fuzzy Hash: bc134b4c96ab57a31bc4ea7f2ae475fa40dc48c7a7b61fc8e4275ae1b615d47d
Instruction Fuzzy Hash: CF215C726186818AE760CF15F444B5BB7A1FB88790F504635EB9947B68CF3DD881CF05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9893B78, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6E9893BB7
DeviceIoControl.KERNEL32 ref: 00007FF6E9893C3B
CloseHandle.KERNEL32 ref: 00007FF6E9893C46

Strings

0, xrefs: 00007FF6E9893C1A

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: 0
API String ID: 33631002-4108050209
Opcode ID: 66f94da35e92152fb18de70853b28e9c040311082fe88f61d2a272794d87a7db
Instruction ID: 7329f74ba24be6cd93008fecf579b7c182800a60ac7b9a9acf8ac5200c2fceb4
Opcode Fuzzy Hash: 66f94da35e92152fb18de70853b28e9c040311082fe88f61d2a272794d87a7db
Instruction Fuzzy Hash: BC219133618B8096E3208F25E88479A77B8F788794F54423AEB9D43B94CF3DC655CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98ADF84, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,00007FF6E98ADA5E), ref: 00007FF6E98ADFA0
GetProcAddress.KERNEL32(?,?,?,00007FF6E98ADA5E), ref: 00007FF6E98ADFB8

Strings

GetModuleHandleExW, xrefs: 00007FF6E98ADFAE
kernel32.dll, xrefs: 00007FF6E98ADF99

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: d63fdd9601e88631d9e83c1399e83ef2fbc8342345ed6e8761887cde29508ae7
Instruction ID: c560bd3a6b044395629c938a50f98938da46540253114af28be76410d5d3a3f9
Opcode Fuzzy Hash: d63fdd9601e88631d9e83c1399e83ef2fbc8342345ed6e8761887cde29508ae7
Instruction Fuzzy Hash: E8F08C23A0AB0292DA449F24F55412A23A0FF08750B540A38CB0D82260EF7DE4B2C306

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E983B2F0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,000002CA5E774C20,00007FF6E983B664), ref: 00007FF6E983B30C
GetProcAddress.KERNEL32(?,?,000002CA5E774C20,00007FF6E983B664), ref: 00007FF6E983B324

Strings

Wow64DisableWow64FsRedirection, xrefs: 00007FF6E983B31A
kernel32.dll, xrefs: 00007FF6E983B305

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 840806fa12cc3ef28b8dcd47720bc844512bf2f0a433e11e4d958b9d6167bee7
Instruction ID: 4095ff347c449896bc79088c33da71a0a536c0b66bc9144248dd7196e9bd40a2
Opcode Fuzzy Hash: 840806fa12cc3ef28b8dcd47720bc844512bf2f0a433e11e4d958b9d6167bee7
Instruction Fuzzy Hash: 89F0A032A0AF0692DB04DF64F54513923A0FF08740B840939CA1C8B320EF3DE4B0C306

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E983B340, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF6E983B35C
GetProcAddress.KERNEL32 ref: 00007FF6E983B374

Strings

Wow64RevertWow64FsRedirection, xrefs: 00007FF6E983B36A
kernel32.dll, xrefs: 00007FF6E983B355

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 787c7999791bc0c1db08b3f5cacdbcb2ba448771c68898ca217fa66b215929f3
Instruction ID: 0f5b4b20a9add4ce4a6b6ba7f1a01dcb445f8c7db8042af2dbdbdd223be2c6b8
Opcode Fuzzy Hash: 787c7999791bc0c1db08b3f5cacdbcb2ba448771c68898ca217fa66b215929f3
Instruction Fuzzy Hash: 20F08C22A0AB06A2DA04DF64F54513923A4FF08740B840938CA1C86220EF3DE4A0C306

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9884268, Relevance: 6.3, APIs: 4, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb2674649b5df102b103c9294ec57b034fb34545323df1ff3a05e07f2068ab44
Instruction ID: 8af41b6716e441c7cf68a1003a16e29505960978646de4b2450a4fcda3fa68ce
Opcode Fuzzy Hash: bb2674649b5df102b103c9294ec57b034fb34545323df1ff3a05e07f2068ab44
Instruction Fuzzy Hash: F6D107A7B04B5686EB28CF36C4402AE27A0FB48F88B515926DF4D87B64DF3AD844C355

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98AE314, Relevance: 6.3, APIs: 4, Instructions: 284COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF6E98AE3B2

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 32520bf61607c9d144012009b208c2006d78f307d7ed4f78a96719c4f9018b04
Instruction ID: 8cc7e313e2d31b9c5e9966c3aad4addcc757a4bd22524ad7ee14596050b00597
Opcode Fuzzy Hash: 32520bf61607c9d144012009b208c2006d78f307d7ed4f78a96719c4f9018b04
Instruction Fuzzy Hash: 21D13727B05A419AEB50DF65D4402AE33B5FF44B48B800936DE0D97BAADF3AE41AC345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98ACD24, Relevance: 6.2, APIs: 4, Instructions: 233COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF6E98ACD70
CoUninitialize.OLE32 ref: 00007FF6E98ACD7A

Part of subcall function 00007FF6E984652C: malloc.LIBCMT ref: 00007FF6E9846546

Part of subcall function 00007FF6E988C028: CoCreateInstance.OLE32 ref: 00007FF6E988C0F7

VariantInit.OLEAUT32 ref: 00007FF6E98ACD84
VariantClear.OLEAUT32 ref: 00007FF6E98AD043

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitializemalloc
String ID:
API String ID: 2944866693-0
Opcode ID: ca0e8ddec16bfa62277a7ef33865ba86cde70ce2aa275b5e4ddaa13f5e127e8b
Instruction ID: 32919db8404cd4b856686f686041164eed809fcf0330880e79e38ea7b8a98baa
Opcode Fuzzy Hash: ca0e8ddec16bfa62277a7ef33865ba86cde70ce2aa275b5e4ddaa13f5e127e8b
Instruction Fuzzy Hash: A6915C23B08B5286EB54EF62D4513BE26A0BF44BC4F444835DE4DD7BA6CF7AE451830A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9828534, Relevance: 6.2, APIs: 4, Instructions: 176COMMON

Download Yara Rule

APIs

std::exception_ptr::_Current_exception.LIBCONCRT ref: 00007FF6E98285F5
std::exception_ptr::_Current_exception.LIBCONCRT ref: 00007FF6E9865FE0
VariantClear.OLEAUT32 ref: 00007FF6E986602F

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Current_exceptionstd::exception_ptr::_$ClearVariant
String ID:
API String ID: 332225251-0
Opcode ID: 4f600ea48eb00bdd592d4e7f41bfccd31e9847155f764c75bbe5455adaf48b0d
Instruction ID: 3c92e7b6ff925b396930e57e59c7a67bf23fac7240b923f9f4716acf90fbbd20
Opcode Fuzzy Hash: 4f600ea48eb00bdd592d4e7f41bfccd31e9847155f764c75bbe5455adaf48b0d
Instruction Fuzzy Hash: 6F719333A2864285FE649F65D0407FE2364AF45B84F144D32DE0D9BAAACF3EE441C24B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98B52E0, Relevance: 6.2, APIs: 4, Instructions: 152processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6E98B533E
Process32FirstW.KERNEL32 ref: 00007FF6E98B534E
Process32NextW.KERNEL32 ref: 00007FF6E98B5436
CloseHandle.KERNEL32 ref: 00007FF6E98B5447

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: d3cda5918d1d2c58141701839552cfbb091589482fc2d4ae7763b6e8889d256c
Instruction ID: 83d194ebd2c0eb99f2d762b1e928b95cd876e8eec7984bfd702ef5d932b0173e
Opcode Fuzzy Hash: d3cda5918d1d2c58141701839552cfbb091589482fc2d4ae7763b6e8889d256c
Instruction Fuzzy Hash: A4619F37A18B4686EB00EF25E4447AE73A0FB88B88F444536EA4D87B69DF7DD505CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E982AF04, Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E984515C: std::exception_ptr::_Current_exception.LIBCONCRT ref: 00007FF6E9845186

std::exception_ptr::_Current_exception.LIBCONCRT ref: 00007FF6E98460D4

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Current_exceptionstd::exception_ptr::_
String ID:
API String ID: 3524498493-0
Opcode ID: 7fda04c80306908e3074385096d7e84a40dfd0088b95789782782ecaec161c71
Instruction ID: 28eb0b23514396078f2e4ad772ce4da31e3d26079e3a33223f7a8b739cba9cb4
Opcode Fuzzy Hash: 7fda04c80306908e3074385096d7e84a40dfd0088b95789782782ecaec161c71
Instruction Fuzzy Hash: F0518173A0968292EB58DF24C1903BE73A4FF45B84F144831DA0DC76A6DF3AE851CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C2BC0, Relevance: 6.1, APIs: 4, Instructions: 135windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FF6E98C2C55
ScreenToClient.USER32 ref: 00007FF6E98C2C83
MoveWindow.USER32 ref: 00007FF6E98C2D08
SendMessageW.USER32 ref: 00007FF6E98C2D71

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Window$ClientMessageMoveRectScreenSend
String ID:
API String ID: 1249313431-0
Opcode ID: ddb71fa7326b0f581bbe955ddfc3e758c2b1f3f747b78bee63ed90110e5bd311
Instruction ID: 85f86b820718af31728c69a4ce3c80d0113b69d95dfe21cc27b96d1cf5724b09
Opcode Fuzzy Hash: ddb71fa7326b0f581bbe955ddfc3e758c2b1f3f747b78bee63ed90110e5bd311
Instruction Fuzzy Hash: 0B51E373A049528AEB14CF25D4446BE33A1FF94B98F110A31EE1D87BA4DF39E881C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C4348, Relevance: 6.1, APIs: 4, Instructions: 103windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32 ref: 00007FF6E98C4389
GetWindowRect.USER32 ref: 00007FF6E98C4418
PtInRect.USER32 ref: 00007FF6E98C4428
MessageBeep.USER32(?,?,?,?,00007FF6E98C5E91), ref: 00007FF6E98C4493

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: cf2fa3b6f9762b946ab1dbf7ba4ec4121ffa9942006b53746818842b66bcd6bd
Instruction ID: abafc83791f0384987c5676d784a9f306bb4405d04f7db77822dc6049d59b149
Opcode Fuzzy Hash: cf2fa3b6f9762b946ab1dbf7ba4ec4121ffa9942006b53746818842b66bcd6bd
Instruction Fuzzy Hash: 2E419C33A09A4691EB10CF25D48433A77A4BF80B54F254A35DA5DCA3B0EF3EE485C306

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BFCBC, Relevance: 6.1, APIs: 4, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF6E98BFDA4
IsMenu.USER32 ref: 00007FF6E98BFDC3
InsertMenuItemW.USER32 ref: 00007FF6E98BFE14
DrawMenuBar.USER32 ref: 00007FF6E98BFE29

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID:
API String ID: 3076010158-0
Opcode ID: e253268d091f0f436dab35dc042b9e322c76f5973f5fae89861117d030e9b7b1
Instruction ID: ecdaf62e52453db2d63151e97a3a696d5ff96427b000e6ab581fd64ea093fd1f
Opcode Fuzzy Hash: e253268d091f0f436dab35dc042b9e322c76f5973f5fae89861117d030e9b7b1
Instruction Fuzzy Hash: E4417C37A04A428AEB10CF62D4446AE27B0FF44B88F184436DE0D87B68DF39E896C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9844EAC, Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

std::exception_ptr::_Current_exception.LIBCONCRT ref: 00007FF6E9844F43

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Current_exceptionstd::exception_ptr::_
String ID:
API String ID: 3524498493-0
Opcode ID: 9fa1e6cc27df1e24c46aa13f025f8c71a670e297acdd087bfae3086ef7991035
Instruction ID: 4bb68563d441f584063ea815727adb29b8997d672f794e030fecbeec653c7fb3
Opcode Fuzzy Hash: 9fa1e6cc27df1e24c46aa13f025f8c71a670e297acdd087bfae3086ef7991035
Instruction Fuzzy Hash: A7418333A0C58281FB68DE75814437E62A5EF41B94F685D32D90EC76B5CF2EE441872B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9829F28, Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

std::exception_ptr::_Current_exception.LIBCONCRT ref: 00007FF6E9829FA2
VariantClear.OLEAUT32 ref: 00007FF6E9866F12

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ClearCurrent_exceptionVariantstd::exception_ptr::_
String ID:
API String ID: 1286867592-0
Opcode ID: dddb09a86739dd544d3d91055cbbb3cd19d9a0a265b4a67f41483ccc33235f48
Instruction ID: 35ad09910089f7e078859a2b2ccac6e4e787a91ac79b436fe3a0f731e281a89a
Opcode Fuzzy Hash: dddb09a86739dd544d3d91055cbbb3cd19d9a0a265b4a67f41483ccc33235f48
Instruction Fuzzy Hash: 55415423A1D94281FAA59E25C15037E63A1BF95B84F244D31DA0DCB6B6CF3FE441C24B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9828F30, Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

std::exception_ptr::_Current_exception.LIBCONCRT ref: 00007FF6E9828FAA
VariantClear.OLEAUT32 ref: 00007FF6E98666E2

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ClearCurrent_exceptionVariantstd::exception_ptr::_
String ID:
API String ID: 1286867592-0
Opcode ID: 000b5965a417177c7046d6a7acbafbc198c187501008ed9926157165750f726e
Instruction ID: 901e684ef4981ba6e7482b79d86e1a230c1408898aa629bd5ed7818b1634cc69
Opcode Fuzzy Hash: 000b5965a417177c7046d6a7acbafbc198c187501008ed9926157165750f726e
Instruction Fuzzy Hash: 92417363A1D54281FF259E65D1503BE63A1AF44B84F284D32DA0ECB6B6CF3EE451860B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9890064, Relevance: 6.1, APIs: 4, Instructions: 96keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF6E98900C4
SetKeyboardState.USER32 ref: 00007FF6E98900DC
PostMessageW.USER32 ref: 00007FF6E989014A
SendInput.USER32 ref: 00007FF6E98901A9

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 45346c6c13e3b97187ef36f9684e0e1ae620daa8cc45dc4d766e8942d00132b6
Instruction ID: cc22f4e35bb1cf252d50cc9081f99acc00079b692950cdc4dd17f0feb5770d74
Opcode Fuzzy Hash: 45346c6c13e3b97187ef36f9684e0e1ae620daa8cc45dc4d766e8942d00132b6
Instruction Fuzzy Hash: 4141E7A3A0C58245F7308F25D45077B26A0FF46B98F540A35EA8E876F5DE3ED581C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E988B428, Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

std::exception_ptr::_Current_exception.LIBCONCRT ref: 00007FF6E988B45C
std::exception_ptr::_Current_exception.LIBCONCRT ref: 00007FF6E988B4AB

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Current_exceptionstd::exception_ptr::_
String ID:
API String ID: 3524498493-0
Opcode ID: faca1acbf744d4ba652589b5820f74067182f9016ba504ced5346ea391162f83
Instruction ID: 70036463ac69b541c0b21732582ae7ef533420c2798efe2884544ccdcaafc9b2
Opcode Fuzzy Hash: faca1acbf744d4ba652589b5820f74067182f9016ba504ced5346ea391162f83
Instruction Fuzzy Hash: 75412133A0990285EA79DE65919537E23A4EFC0B85F940831DA1EC76B5CF2EE841C35B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E989D104, Relevance: 6.1, APIs: 4, Instructions: 94fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32 ref: 00007FF6E989D1B7
GetLastError.KERNEL32 ref: 00007FF6E989D1DA
DeleteFileW.KERNEL32 ref: 00007FF6E989D1FC
CreateHardLinkW.KERNEL32 ref: 00007FF6E989D226

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 20786665a4b24944015bb26df3cc70f7b11e7af2e69fb296e898c68d76d0ca20
Instruction ID: bd23b9feb536f0a171298e5671285e51409a570b2ee8ef827dbaf9bfef256239
Opcode Fuzzy Hash: 20786665a4b24944015bb26df3cc70f7b11e7af2e69fb296e898c68d76d0ca20
Instruction Fuzzy Hash: 4E311063A0879581EB04EF62D45527E67A0FF88FD4B444832EE4D87776CE3EE4418349

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E985C584, Relevance: 6.1, APIs: 4, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF6E985C5E6
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6E9853582), ref: 00007FF6E985C655
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6E9853582), ref: 00007FF6E985C6A3
_errno.LIBCMT ref: 00007FF6E985C6AD

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::__errno
String ID:
API String ID: 2949032343-0
Opcode ID: 61db6723181575103e04a78bdce160cbae1df40ff1c4acdfa86fcb76175ee2d2
Instruction ID: cedcc47a1484c40b6ca0d5eaec8c08b10553e80e150e48e970055e88b6c17ed5
Opcode Fuzzy Hash: 61db6723181575103e04a78bdce160cbae1df40ff1c4acdfa86fcb76175ee2d2
Instruction Fuzzy Hash: 3541D17360878286EB608F14954033ABBA0FF94B84F145535EB8E97BE5CE3ED9418B05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98901D4, Relevance: 6.1, APIs: 4, Instructions: 89keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF6E9890232
SetKeyboardState.USER32 ref: 00007FF6E989024A
PostMessageW.USER32 ref: 00007FF6E98902AA
SendInput.USER32 ref: 00007FF6E9890310

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 175c52f3b58f8d7f0fbb222a0e10cd99f7706ddb1fd5fa000ffecd449a2e9e42
Instruction ID: 44ce56dd2761c38e55a0c6169896435ded8bbf775268f8b77044f6a5b4ac195c
Opcode Fuzzy Hash: 175c52f3b58f8d7f0fbb222a0e10cd99f7706ddb1fd5fa000ffecd449a2e9e42
Instruction Fuzzy Hash: 3F4102B3A0864241E7718FA1D4043BB27A0EF49B50F550A35DA9D836A5CF3ED895C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BCA98, Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF6E98BCAB3

Part of subcall function 00007FF6E98930D8: GetWindowThreadProcessId.USER32 ref: 00007FF6E98930F4
Part of subcall function 00007FF6E98930D8: GetCurrentThreadId.KERNEL32 ref: 00007FF6E98930FC
Part of subcall function 00007FF6E98930D8: AttachThreadInput.USER32 ref: 00007FF6E9893121

GetCaretPos.USER32 ref: 00007FF6E98BCAD1
ClientToScreen.USER32 ref: 00007FF6E98BCB1D
GetForegroundWindow.USER32 ref: 00007FF6E98BCB23

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 3fadbd81999b433918a598c0fb4b383dc00f989212922124606ce5f4c23e94d4
Instruction ID: 8aa71db29e04977d0b6aae19aa8aaba9127dc874071ee96bd18f415785172f69
Opcode Fuzzy Hash: 3fadbd81999b433918a598c0fb4b383dc00f989212922124606ce5f4c23e94d4
Instruction Fuzzy Hash: D2313D33B046429AEB00DF66D4413BE2BA0AF44788F444835EE0EABB69DE7ED1458745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98A4530, Relevance: 6.1, APIs: 4, Instructions: 82networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 00007FF6E98A4597

Part of subcall function 00007FF6E98A4668: InternetOpenUrlW.WININET ref: 00007FF6E98A46A8
Part of subcall function 00007FF6E98A4668: InternetCloseHandle.WININET ref: 00007FF6E98A478B

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 186906bb017a8097614446a440824804718937ec64bdb5e62fa5f176da0b08ef
Instruction ID: 8a6d66b9ae62aab08e100a19c0127260760696d05c3e767c1c773691b9181687
Opcode Fuzzy Hash: 186906bb017a8097614446a440824804718937ec64bdb5e62fa5f176da0b08ef
Instruction Fuzzy Hash: 8831D223A0874286FB94DF22E41476E63A0FF44B84F041536DA4D47F94DF7EE0548B46

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BDD08, Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32 ref: 00007FF6E98BDDB3
SetWindowLongW.USER32 ref: 00007FF6E98BDDD2
SetWindowLongW.USER32 ref: 00007FF6E98BDDE4
SetLayeredWindowAttributes.USER32 ref: 00007FF6E98BDDF8

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 09bfe10590f90e00cf1db3c74f91b0c5fa2ff1e13a2827990bfa6e2fbcdb8ec8
Instruction ID: 5a860085d37ce99b0d50b2fc7cfc559293f70481842e569e45518f54478b4566
Opcode Fuzzy Hash: 09bfe10590f90e00cf1db3c74f91b0c5fa2ff1e13a2827990bfa6e2fbcdb8ec8
Instruction Fuzzy Hash: F1316966B08B4282EB149F26D85436A6764FF88F94F098931DE4EC73A5DE3EE4418349

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9886F20, Relevance: 6.1, APIs: 4, Instructions: 74windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6E9886F76
_itow.LIBCMT ref: 00007FF6E9886F98
SendMessageW.USER32 ref: 00007FF6E9886FC5
_itow.LIBCMT ref: 00007FF6E9886FDC

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend_itow
String ID:
API String ID: 3464099026-0
Opcode ID: 3801aff5d7530369895c7fc4e551b4b7a11dcbf942b0a5e06eeb582d02f353c3
Instruction ID: 3b5db05209ae521b95531f0c33e2231427f0d11fa9ba5ae0de2eab63bc63907e
Opcode Fuzzy Hash: 3801aff5d7530369895c7fc4e551b4b7a11dcbf942b0a5e06eeb582d02f353c3
Instruction Fuzzy Hash: 4921C52770874142FA249F25A08437A6351AF84B80F944934CA9DC77A5DE7EE542C71A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C6364, Relevance: 6.1, APIs: 4, Instructions: 72windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9824560: GetWindowLongPtrW.USER32 ref: 00007FF6E982457D

GetCursorPos.USER32 ref: 00007FF6E98C63B9
TrackPopupMenuEx.USER32 ref: 00007FF6E98C63DD
GetCursorPos.USER32(?,?,00000000,?,?,00007FF6E9863D88,?,?,?,?,?,?,?,?,?,00007FF6E9821F0B), ref: 00007FF6E98C642B
DefDlgProcW.USER32(?,?,00000000,?,?,00007FF6E9863D88,?,?,?,?,?,?,?,?,?,00007FF6E9821F0B), ref: 00007FF6E98C6472

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: b867ce9c93f581b9fcd70083ee9f0044a727439ddd5c0280755ae13753601b77
Instruction ID: ce3540124996065e0c7bdc1ad6ae72ae2d6d701a45621c7629e221fc7399516b
Opcode Fuzzy Hash: b867ce9c93f581b9fcd70083ee9f0044a727439ddd5c0280755ae13753601b77
Instruction Fuzzy Hash: D9316837A08A4682EB20CF16E49437A7760FB84B94F140632DA4D87BB5EF7ED445C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9886178, Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9885574: GetTokenInformation.ADVAPI32 ref: 00007FF6E98855A6
Part of subcall function 00007FF6E9885574: GetLastError.KERNEL32 ref: 00007FF6E98855B2
Part of subcall function 00007FF6E9885574: GetProcessHeap.KERNEL32 ref: 00007FF6E98855BF
Part of subcall function 00007FF6E9885574: HeapAlloc.KERNEL32 ref: 00007FF6E98855CE
Part of subcall function 00007FF6E9885574: GetTokenInformation.ADVAPI32 ref: 00007FF6E98855ED

GetLengthSid.ADVAPI32 ref: 00007FF6E98861F2
CopySid.ADVAPI32 ref: 00007FF6E9886217
GetProcessHeap.KERNEL32 ref: 00007FF6E988622C
HeapFree.KERNEL32 ref: 00007FF6E988623A

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocCopyErrorFreeLastLength
String ID:
API String ID: 837644225-0
Opcode ID: 2ced759abe0a80e63c6857023858e9aa34d44625c4ef7c15eade9669bce07eb5
Instruction ID: adeac247b2b029a4f5eee5c7efd25be44d2592b9ee5de08abe1a367108361937
Opcode Fuzzy Hash: 2ced759abe0a80e63c6857023858e9aa34d44625c4ef7c15eade9669bce07eb5
Instruction Fuzzy Hash: 9F21DB73A08B4186EB18CF61E40476AB3A5FF44B91F854939CA1D83760DF3EE841C715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9861558, Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF6E986157C

Part of subcall function 00007FF6E9847094: _getptd.LIBCMT ref: 00007FF6E98470AA
Part of subcall function 00007FF6E9847094: __updatetlocinfo.LIBCMT ref: 00007FF6E98470DF
Part of subcall function 00007FF6E9847094: __updatetmbcinfo.LIBCMT ref: 00007FF6E9847106

_errno.LIBCMT ref: 00007FF6E9861588

Part of subcall function 00007FF6E9850468: _getptd_noexit.LIBCMT ref: 00007FF6E985046C

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9861593
strchr.LIBCMT ref: 00007FF6E98615A9

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 3c2070327863f6375e0f3194eba06374108bd936cec5643e04ad23a0c98c8bd2
Instruction ID: af0adbcc2616c5fc9e20f3eea2d91f5af17414f298804fbb3d50386236586cc5
Opcode Fuzzy Hash: 3c2070327863f6375e0f3194eba06374108bd936cec5643e04ad23a0c98c8bd2
Instruction Fuzzy Hash: 9621D453E3C2E241EB604E15906437FE690EF80BD4F584931EA8F8EAE7CD2DD441CA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E988F070, Relevance: 6.0, APIs: 4, Instructions: 49sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00007FF6E989083E

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: fc7508d0e3ce824d8d5af89cc0649b9b74ba64ef3a9e7f664e9dd51862032666
Instruction ID: b1ce12c76b1cfd0ab1bc751b776b007bfb7d41157c55b39869885256f8400a42
Opcode Fuzzy Hash: fc7508d0e3ce824d8d5af89cc0649b9b74ba64ef3a9e7f664e9dd51862032666
Instruction Fuzzy Hash: BE110622F08B4292E6158F34944427FB3A1FFD8705F148635D54FA5270EF3AE481C64A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C4D84, Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FF6E98C4DB4
ScreenToClient.USER32 ref: 00007FF6E98C4DCD
ScreenToClient.USER32 ref: 00007FF6E98C4DF2
InvalidateRect.USER32 ref: 00007FF6E98C4E0E

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: b020d7a18e0c15f82554fe6943d3acd15c7101b1f8cdb3f05b51954c8ffba793
Instruction ID: 62e44ad34f9d097c94e456228ca2ee42815477c20fc5ef91637582a9d37ff7d8
Opcode Fuzzy Hash: b020d7a18e0c15f82554fe6943d3acd15c7101b1f8cdb3f05b51954c8ffba793
Instruction Fuzzy Hash: C421E5B7A04741EEEB00CF78D48469D77B0F748B48B044C26EA1897B28DB78D965CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E988C2EC, Relevance: 6.0, APIs: 4, Instructions: 43registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF6E988C30B
LoadTypeLib.OLEAUT32 ref: 00007FF6E988C326
RegisterTypeLib.OLEAUT32 ref: 00007FF6E988C33B
RegisterTypeLibForUser.OLEAUT32 ref: 00007FF6E988C359

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 2ba052041129fccc5b2db2e8a52ce6c6830e567c1f59eb50d31784512d118db1
Instruction ID: 6e90ca7b5cf599006231c1f7593753944ad96da2f10de6acac22bf155adcfc6e
Opcode Fuzzy Hash: 2ba052041129fccc5b2db2e8a52ce6c6830e567c1f59eb50d31784512d118db1
Instruction Fuzzy Hash: 1A11827370C54293E7308F25E48532E6360FF49B88F908139D64D8A558CF7ED146CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C5A9C, Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9822C4C: ExtCreatePen.GDI32(?,?,?,?,?,?,?,00000000,00007FF6E9863BB3), ref: 00007FF6E9822CD9
Part of subcall function 00007FF6E9822C4C: SelectObject.GDI32(?,?,?,?,?,?,?,00000000,00007FF6E9863BB3), ref: 00007FF6E9822CEC
Part of subcall function 00007FF6E9822C4C: BeginPath.GDI32 ref: 00007FF6E9822D05
Part of subcall function 00007FF6E9822C4C: SelectObject.GDI32(?,?,?,?,?,?,?,00000000,00007FF6E9863BB3), ref: 00007FF6E9822D2C

MoveToEx.GDI32 ref: 00007FF6E98C5AE1
LineTo.GDI32 ref: 00007FF6E98C5AF3
EndPath.GDI32 ref: 00007FF6E98C5B05
StrokePath.GDI32 ref: 00007FF6E98C5B15

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: dcc4145ab529c37af69d0c379311dfd00b06a660af24d8260b93860f48899b70
Instruction ID: 7c363507fd75d14ed342f0d7a15f9466215c969cfb2bdabbe9a9dff935969705
Opcode Fuzzy Hash: dcc4145ab529c37af69d0c379311dfd00b06a660af24d8260b93860f48899b70
Instruction Fuzzy Hash: 2A019E37B1879142E7448F15B80872AAB60AF85B94F180635CF5A47BB5CF7EE840CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9885FAC, Relevance: 6.0, APIs: 4, Instructions: 27threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00007FF6E9885FBA
OpenThreadToken.ADVAPI32(?,?,?,00007FF6E988575C), ref: 00007FF6E9885FCD
GetCurrentProcess.KERNEL32(?,?,?,00007FF6E988575C), ref: 00007FF6E9885FD9
OpenProcessToken.ADVAPI32(?,?,?,00007FF6E988575C), ref: 00007FF6E9885FE8

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 990c166fb4ff53a76b7148ec208b33d50c6a9c5cf4beb0190187e9d7578a012f
Instruction ID: 31efc936c6a816ffea0561bf8d1b241ed2e528f959304ba256d93f153743e4db
Opcode Fuzzy Hash: 990c166fb4ff53a76b7148ec208b33d50c6a9c5cf4beb0190187e9d7578a012f
Instruction Fuzzy Hash: 77F05E33608743D2E7148F65E98467A33A4FF58BD4B814534DA0DCA624DF3DD899C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E986A240, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF6E986A240
GetDC.USER32 ref: 00007FF6E986A24C
GetDeviceCaps.GDI32 ref: 00007FF6E986A276
ReleaseDC.USER32 ref: 00007FF6E986A297

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 3d6872e1a1a20a3bec6ed26a29d86a8d66011ef31e1f96e54472d3d532082902
Instruction ID: e556776707d75ddf883021c1ce7eb6c4dea0d857a0d3f26932d700069d86c956
Opcode Fuzzy Hash: 3d6872e1a1a20a3bec6ed26a29d86a8d66011ef31e1f96e54472d3d532082902
Instruction Fuzzy Hash: 3EE07D62A0970297EB049F61995C33A2659AF45FC1F004935CD0E8B775DE7EA445D306

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E986A259, Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF6E986A259
GetDC.USER32 ref: 00007FF6E986A265
GetDeviceCaps.GDI32 ref: 00007FF6E986A276
ReleaseDC.USER32 ref: 00007FF6E986A297

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 2b21f45fe1cec08f3e35962190f6014dc8d9ccd74c7e8cceb424e5d360e1b9b1
Instruction ID: 049a0735c9babb6b6ee1bb191602eb4bccf75c670e737dc423f90e13c1b5cc88
Opcode Fuzzy Hash: 2b21f45fe1cec08f3e35962190f6014dc8d9ccd74c7e8cceb424e5d360e1b9b1
Instruction Fuzzy Hash: D6E09A62A097429BEB04DF61985C33A2699AF49FC2F004935CD0E8B775DF7EA405C306

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9851FB4, Relevance: 6.0, APIs: 4, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 00007FF6E9851FBD
_set_error_mode.LIBCMT ref: 00007FF6E9851FCC
_NMSG_WRITE.LIBCMT ref: 00007FF6E9851FE3
_NMSG_WRITE.LIBCMT ref: 00007FF6E9851FED

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _set_error_mode
String ID:
API String ID: 1949149715-0
Opcode ID: 10b8a036955fdef4e8336475498822c38a28524abf5c4da46c2e024772cd0e1e
Instruction ID: 5f110299d0a7deb6e6530e7f83b3fc260aac864b03982bf4b0edd8d5ee25c5ce
Opcode Fuzzy Hash: 10b8a036955fdef4e8336475498822c38a28524abf5c4da46c2e024772cd0e1e
Instruction Fuzzy Hash: 77E0E223E4911742FBA92A91846637A20469F61301F440C39E20FC52E3DE1FF88D832B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9889688, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 205comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E984652C: malloc.LIBCMT ref: 00007FF6E9846546

OleSetContainedObject.OLE32 ref: 00007FF6E98898CE

Part of subcall function 00007FF6E9889CA0: OleSetContainedObject.OLE32 ref: 00007FF6E9889D41
Part of subcall function 00007FF6E9889CA0: IsWindow.USER32 ref: 00007FF6E9889DBB
Part of subcall function 00007FF6E9889CA0: DestroyWindow.USER32 ref: 00007FF6E9889DC9

Strings

AutoIt3GUI, xrefs: 00007FF6E9889809
Container, xrefs: 00007FF6E9889813

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ContainedObjectWindow$Destroymalloc
String ID: AutoIt3GUI$Container
API String ID: 206803535-3941886329
Opcode ID: cdcadf556863f61ca12d65a3cbf739c6df59a1904a9d1d48932e0e5b95b0510a
Instruction ID: 0bebc4a7dd8868d765f275d5216206aad591f498cad2801ed96694ec8c5289ee
Opcode Fuzzy Hash: cdcadf556863f61ca12d65a3cbf739c6df59a1904a9d1d48932e0e5b95b0510a
Instruction Fuzzy Hash: F3A14673608B4682EB24CF29D4503AE33A0FB88B88F558936CA4D877A5DF3ED845C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BF0E0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E98239AC: CreateWindowExW.USER32 ref: 00007FF6E9823A3A
Part of subcall function 00007FF6E98239AC: GetStockObject.GDI32 ref: 00007FF6E9823A57
Part of subcall function 00007FF6E98239AC: SendMessageW.USER32 ref: 00007FF6E9823A6A

DestroyWindow.USER32 ref: 00007FF6E98BF214

Strings

static, xrefs: 00007FF6E98BF153

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Window$CreateDestroyMessageObjectSendStock
String ID: static
API String ID: 3467290483-2160076837
Opcode ID: 0356806ab2abb1cf36a4af384f6e74d3858e622710c42a99152da458726df8c2
Instruction ID: 3ec4d8971ac3fcb630aa52397f2bd6bb16cffb1050f608b6391cf4843ae9f34b
Opcode Fuzzy Hash: 0356806ab2abb1cf36a4af384f6e74d3858e622710c42a99152da458726df8c2
Instruction Fuzzy Hash: 5A418D3750868286D630DF21E0407AFB360FB84790F504635EBA943BA9EF3DD4818B45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98A70D4, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

_snwprintf.LIBCMT ref: 00007FF6E98A716E

Strings

AUTOITCALLVARIABLE%d, xrefs: 00007FF6E98A715B
, $, xrefs: 00007FF6E98A71B4

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _snwprintf
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3988819677-2584243854
Opcode ID: 11348a8159848c106f566dd1bdba921fa4db438a0249d217f4fdadcbed336eef
Instruction ID: 8a270d1721d0b5b1ce21d124813b83c73434bd748fc4757db96f1b0e1b3169ff
Opcode Fuzzy Hash: 11348a8159848c106f566dd1bdba921fa4db438a0249d217f4fdadcbed336eef
Instruction Fuzzy Hash: D631AD77B08A0285E710DF60E4406ED33A5FF54784F950832DA0D93BAADF7AE40AC349

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C04D4, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32 ref: 00007FF6E98C05C9

Strings

, xrefs: 00007FF6E98C05AC
SysTabControl32, xrefs: 00007FF6E98C056C

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Window
String ID: $SysTabControl32
API String ID: 2353593579-3143400907
Opcode ID: f794c97caa83e847d71e42352effe400b85f5f261240ab541418ed458873f246
Instruction ID: 99c447274ccba57534377871305744693b077d1bbdfea85d41f0f0ac62f98962
Opcode Fuzzy Hash: f794c97caa83e847d71e42352effe400b85f5f261240ab541418ed458873f246
Instruction Fuzzy Hash: 6A3169725187C08AEB208F15A44475EB7A4FB88BA4F244739EEA857BE8CF39D451CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BEB6C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E98239AC: CreateWindowExW.USER32 ref: 00007FF6E9823A3A
Part of subcall function 00007FF6E98239AC: GetStockObject.GDI32 ref: 00007FF6E9823A57
Part of subcall function 00007FF6E98239AC: SendMessageW.USER32 ref: 00007FF6E9823A6A

SendMessageW.USER32 ref: 00007FF6E98BEC43
SendMessageW.USER32 ref: 00007FF6E98BEC57

Strings

Combobox, xrefs: 00007FF6E98BEC11

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Combobox
API String ID: 1025951953-2096851135
Opcode ID: 86bdddf91a740fdd4a823a2380b908a452cd2fc91da8caff1f3286bb0686ab23
Instruction ID: 2653f1f0d169d9b9bec3d5480523baf2f4049f67a6a15067d00575ca3c97c9de
Opcode Fuzzy Hash: 86bdddf91a740fdd4a823a2380b908a452cd2fc91da8caff1f3286bb0686ab23
Instruction Fuzzy Hash: 0B318136A087808AD760CF25F490B5E73A1EB89750F544635EAA883B99DF3DD840CF05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98BF38C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E98239AC: CreateWindowExW.USER32 ref: 00007FF6E9823A3A
Part of subcall function 00007FF6E98239AC: GetStockObject.GDI32 ref: 00007FF6E9823A57
Part of subcall function 00007FF6E98239AC: SendMessageW.USER32 ref: 00007FF6E9823A6A

GetWindowRect.USER32 ref: 00007FF6E98BF44B
GetSysColor.USER32 ref: 00007FF6E98BF472

Strings

static, xrefs: 00007FF6E98BF3EA

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 6c20cedda6ebb3fd08672783197ac45a33d539690fa6945ce223171e2defcd1e
Instruction ID: a4c2cdb9106e76899a46aa9125da2150ba34614a1dafa6afb6e9c53a4d1d11ef
Opcode Fuzzy Hash: 6c20cedda6ebb3fd08672783197ac45a33d539690fa6945ce223171e2defcd1e
Instruction Fuzzy Hash: DF3149326086818BD324CF29E440B5AB7A1FB88790F504639EB9983B69DF3DE841CF05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E984E32C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6E984E3BB

Part of subcall function 00007FF6E98547F4: _ctrlfp.LIBCMT ref: 00007FF6E985482F
Part of subcall function 00007FF6E98547F4: _exception_enabled.LIBCMT ref: 00007FF6E9854852
Part of subcall function 00007FF6E98547F4: _raise_exc.LIBCMT ref: 00007FF6E985489B
Part of subcall function 00007FF6E98547F4: _call_matherr.LIBCMT ref: 00007FF6E98548D6

Strings

!, xrefs: 00007FF6E984E3AE
ceil, xrefs: 00007FF6E984E397

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _call_matherr_ctrlfp_exception_enabled_handle_error_raise_exc
String ID: !$ceil
API String ID: 2471965831-3737604687
Opcode ID: e04764c06a69324d6ba90d4e4a9f442d7a40d5999efcd1e9aacad607a86969f1
Instruction ID: 70a5f1e7f61913a3275d9e3ebef7ed40e1f678eb2d81f84e4a5127da7268b691
Opcode Fuzzy Hash: e04764c06a69324d6ba90d4e4a9f442d7a40d5999efcd1e9aacad607a86969f1
Instruction Fuzzy Hash: 17213A73B08F8542EF51CF21940037B9259AF8A790F504B36E54D527E5DF6EF1814E49

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E984E22C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6E984E2BB

Part of subcall function 00007FF6E98547F4: _ctrlfp.LIBCMT ref: 00007FF6E985482F
Part of subcall function 00007FF6E98547F4: _exception_enabled.LIBCMT ref: 00007FF6E9854852
Part of subcall function 00007FF6E98547F4: _raise_exc.LIBCMT ref: 00007FF6E985489B
Part of subcall function 00007FF6E98547F4: _call_matherr.LIBCMT ref: 00007FF6E98548D6

Strings

!, xrefs: 00007FF6E984E2AE
floor, xrefs: 00007FF6E984E297

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _call_matherr_ctrlfp_exception_enabled_handle_error_raise_exc
String ID: !$floor
API String ID: 2471965831-284986181
Opcode ID: 024b3387efd1f1b73dae450c3aaa0d13975cc3e4d4c93810b3608d51bd109a2b
Instruction ID: dc2c887bdbb8578437bcb3f5c0ee3c0ca1826c04d96e45c5eed768af93992b04
Opcode Fuzzy Hash: 024b3387efd1f1b73dae450c3aaa0d13975cc3e4d4c93810b3608d51bd109a2b
Instruction Fuzzy Hash: AD212673A1CB8643DB61CF21A40037B5156AF96380F505F35E95D527E5DF6EF0818E09

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9868311, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF6E986831F
std::exception_ptr::_Current_exception.LIBCONCRT ref: 00007FF6E986848D

Strings

@COM_EVENTOBJ, xrefs: 00007FF6E9868429

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: ClearCurrent_exceptionVariantstd::exception_ptr::_
String ID: @COM_EVENTOBJ
API String ID: 1286867592-2228938565
Opcode ID: 25aeae699dcbd81117fba426e3c56738d261bf3871360e300a15f6b193ae00a6
Instruction ID: b60d06fde690ad38b1c77987f86de28afcc05d3f72a4bb5aaf0229e1820432cf
Opcode Fuzzy Hash: 25aeae699dcbd81117fba426e3c56738d261bf3871360e300a15f6b193ae00a6
Instruction Fuzzy Hash: B6215E73A2854286EB10DF60E459BBA6760FF84344F500935E60EC69B6CF7EE445CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98683B0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

std::exception_ptr::_Current_exception.LIBCONCRT ref: 00007FF6E98683BA
std::exception_ptr::_Current_exception.LIBCONCRT ref: 00007FF6E986848D

Strings

@COM_EVENTOBJ, xrefs: 00007FF6E9868429

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Current_exceptionstd::exception_ptr::_
String ID: @COM_EVENTOBJ
API String ID: 3524498493-2228938565
Opcode ID: 3949c3a36818ff79458b9221b12572f40dda72a8c65d968a7e525c9bdfc177ea
Instruction ID: 8d533965bd39e1156595644e8463e7f1f6ea8e0b2f67f77e6192264c6793655a
Opcode Fuzzy Hash: 3949c3a36818ff79458b9221b12572f40dda72a8c65d968a7e525c9bdfc177ea
Instruction Fuzzy Hash: 8B118163A2C54286EB10DF60E455BBE6720FF44344F500935E60EC69B6CF7EE401CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E986839F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

std::exception_ptr::_Current_exception.LIBCONCRT ref: 00007FF6E98683A9
std::exception_ptr::_Current_exception.LIBCONCRT ref: 00007FF6E986848D

Strings

@COM_EVENTOBJ, xrefs: 00007FF6E9868429

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Current_exceptionstd::exception_ptr::_
String ID: @COM_EVENTOBJ
API String ID: 3524498493-2228938565
Opcode ID: 87ac4f8d938f4c8fba4a22c7f95a3ff82caf5c3fb2917db8bc3d62dd97656ec5
Instruction ID: 0502b491fc44827a6e9ac4a36038d3673f45415989650f69af8994fbe7471581
Opcode Fuzzy Hash: 87ac4f8d938f4c8fba4a22c7f95a3ff82caf5c3fb2917db8bc3d62dd97656ec5
Instruction Fuzzy Hash: BF118163A2C54286EB10DF60E455BBE6720FF54344F500935E60EC69B6CF7EE401CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E984E12E, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6E984E1B9

Strings

sqrt, xrefs: 00007FF6E984E1AD
!, xrefs: 00007FF6E984E1E5

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _handle_error
String ID: !$sqrt
API String ID: 1757819995-799759792
Opcode ID: 39c9d50fec402ea10d0c97c535665ebb7b9f6794884e7ece5011c5391954d6c8
Instruction ID: 76b617c2660c9ead25e206122b1f23336e0e6fe27bf04c41bda1cc8996cbd1c6
Opcode Fuzzy Hash: 39c9d50fec402ea10d0c97c535665ebb7b9f6794884e7ece5011c5391954d6c8
Instruction Fuzzy Hash: D221D172918BC582D710CF60A40036B6665FFD63E8F200725FA695AAD9CF6DE0418F04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9858F48, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6E9858F38

Strings

tan, xrefs: 00007FF6E9858F48
!, xrefs: 00007FF6E9858F26

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _handle_error
String ID: !$tan
API String ID: 1757819995-2428968949
Opcode ID: f4b51154782bcdd4c9d175f9e15a403ae12cdc375bb8be5623633f291db51871
Instruction ID: 2a39ebccc98536f03136916236d2cc62b6520a5708687fb38ff71aff2e093816
Opcode Fuzzy Hash: f4b51154782bcdd4c9d175f9e15a403ae12cdc375bb8be5623633f291db51871
Instruction Fuzzy Hash: 14118173A28BC942DB50CF15A40036B6662FFDA7D4F105326FA8946B99DF7DD0848B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98A5440, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF6E98A54A8
InternetSetOptionW.WININET ref: 00007FF6E98A54DE

Strings

<local>, xrefs: 00007FF6E98A548C

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 6abec7e49ec37df07cc83800f75f9f2cbc75e85523f362f01c48188140ce3ee1
Instruction ID: 1f2d4419efc5ef0b5362fc2a091f72096746c175a485faf5dcdbc49a538579af
Opcode Fuzzy Hash: 6abec7e49ec37df07cc83800f75f9f2cbc75e85523f362f01c48188140ce3ee1
Instruction Fuzzy Hash: 871182B391D68281E7A48F1090143FE23A1EF45B0AF544937CA4D4AAF4DF7E94C5C746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E98C51E0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 00007FF6E98C5265
CloseHandle.KERNEL32 ref: 00007FF6E98C5276

Strings

, xrefs: 00007FF6E98C5242

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-3916222277
Opcode ID: be79d8f0bb9e70db9db7e15041e7e25814283c7f633fe10cc45d83957b0b8aac
Instruction ID: 2034741e2ecb1d9d290f817c7fd0ec346043759a4d3102e3a25312d2601e3230
Opcode Fuzzy Hash: be79d8f0bb9e70db9db7e15041e7e25814283c7f633fe10cc45d83957b0b8aac
Instruction Fuzzy Hash: 0511AC33A087428AE740CF15F94076A73A6FF84B90F084135EA5D87A65CF3EE081CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9858E4C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6E9858F38

Strings

cos, xrefs: 00007FF6E9858E4C
!, xrefs: 00007FF6E9858EE0

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _handle_error
String ID: !$cos
API String ID: 1757819995-1949035351
Opcode ID: d1e564205db0e25be3b97b75c8564d360cc8e15b63512ff191f20ad55ea35d6e
Instruction ID: 4d4625f42254093661d0638a7835b2063236f034b9a1bc9011fae8893da0cfc3
Opcode Fuzzy Hash: d1e564205db0e25be3b97b75c8564d360cc8e15b63512ff191f20ad55ea35d6e
Instruction Fuzzy Hash: EA01D473E18BC942DB508F25A4013676262FF9A7D4F504326F95E46B99DF6DE0848B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9858E60, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6E9858F38

Strings

sin, xrefs: 00007FF6E9858E60
!, xrefs: 00007FF6E9858EE0

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _handle_error
String ID: !$sin
API String ID: 1757819995-1565623160
Opcode ID: 24054af902a593b1f304418c2c4d243b922e38037092b93a960e13a79d152b8f
Instruction ID: a026865b64722651f95dba7afe19bc7f4de3f19b5e2b051b1f664ee024936e1a
Opcode Fuzzy Hash: 24054af902a593b1f304418c2c4d243b922e38037092b93a960e13a79d152b8f
Instruction Fuzzy Hash: 8901D473E18BC942DB508F25A4013676262BF9A7D4F504326F95D46B98DF6DE0848B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E984E12C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6E984E1B9

Strings

sqrt, xrefs: 00007FF6E984E1AD
!, xrefs: 00007FF6E984E19D

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: _handle_error
String ID: !$sqrt
API String ID: 1757819995-799759792
Opcode ID: 1d2d0659d10637c376ce757124eb193ad7cacda0398fb13617a21aabff0366aa
Instruction ID: 15d5042e4265b9b0d1dd255b04d7dc692af37564140d9f0e79e75fade0530110
Opcode Fuzzy Hash: 1d2d0659d10637c376ce757124eb193ad7cacda0398fb13617a21aabff0366aa
Instruction Fuzzy Hash: E2F0D173A18B8982D700CF50E44136B6622EFEA794F200725EA5C5AB94DF2EE0818F44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9885060, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF6E988507A

Strings

AutoIt, xrefs: 00007FF6E9885064
Error allocating memory., xrefs: 00007FF6E988506B

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 730a622df67155aafedf1bd531cb3c12d0a55501e9ee13ece9d0ee3373bd608d
Instruction ID: ba9203e9db85a961f8c85392aa836e07e8d78c3ea18c68b575c3146a2b0c1ec9
Opcode Fuzzy Hash: 730a622df67155aafedf1bd531cb3c12d0a55501e9ee13ece9d0ee3373bd608d
Instruction Fuzzy Hash: 01E0E523B1864641E7185F65B6853BA23119F44780F640832D94D8B7B6CEAEE4C2874A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6E9869AF0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00007FF6E9869AF4
_swprintf.LIBCMT ref: 00007FF6E9869B16

Part of subcall function 00007FF6E98479E0: _errno.LIBCMT ref: 00007FF6E9847A18
Part of subcall function 00007FF6E98479E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9847A23

Strings

%.3d, xrefs: 00007FF6E9869AFF

Memory Dump Source

Source File: 00000001.00000002.553315929.00007FF6E9821000.00000020.00020000.sdmp, Offset: 00007FF6E9820000, based on PE: true

Associated: 00000001.00000002.553305340.00007FF6E9820000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553623843.00007FF6E98CA000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553709753.00007FF6E98EB000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553751396.00007FF6E98FC000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.553775382.00007FF6E9908000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553831763.00007FF6E991C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553866149.00007FF6E992A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.553898610.00007FF6E9934000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e9820000_Adobe-GenP-2.jbxd

Similarity

API ID: LocalTime_errno_invalid_parameter_noinfo_swprintf
String ID: %.3d
API String ID: 2061425251-986655627
Opcode ID: 0fcd50dbc430154678a812db58d7d1015979c9b59fe781e4814027910c58f108
Instruction ID: 698709d615fe85ce37d1daa47405650c0ad56483888f97d9054be1db89fcefb3
Opcode Fuzzy Hash: 0fcd50dbc430154678a812db58d7d1015979c9b59fe781e4814027910c58f108
Instruction Fuzzy Hash: D2D0EC13A2C652E5E7108F20C8512BE2320BF40348BA05C72D10EC54E99F2EE415D70B

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Adobe-GenP-2.7.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Jbx Signature Overview

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Static AutoIT Info

General

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: Adobe-GenP-2.7.exe PID: 6332 Parent PID: 3340

Function 00007FF6E98C2E60, Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 464
windowCOMMON

Function 00007FF6E983A0C4, Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 122
threadkeyboardwindowCOMMON

Function 00007FF6E9821F98, Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 291
windowtimeCOMMON

Function 00007FF6E98C1A80, Relevance: 28.9, APIs: 19, Instructions: 398
windowCOMMON

Function 00007FF6E983AB60, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 145
windowCOMMON

Function 00007FF6E983B390, Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 211
COMMON

Function 00007FF6E98C5734, Relevance: 22.6, APIs: 15, Instructions: 130
filecommemoryCOMMON

Function 00007FF6E98C3734, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 185
windowCOMMON

Function 00007FF6E98245B4, Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 57
windowregistryCOMMON

Function 00007FF6E98BFFC8, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 105
windowCOMMON

Function 00007FF6E983C8B8, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 181
registryCOMMON

Function 00007FF6E983A4D0, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 143
windowtimeregistryCOMMON

Function 00007FF6E9899960, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 86
COMMON

Function 00007FF6E982BF81, Relevance: 12.8, APIs: 3, Strings: 4, Instructions: 517
timeCOMMON