Create Interactive Tour

Windows Analysis Report
Viewer.exe

Overview

General Information

Sample Name:Viewer.exe
Analysis ID:597179
MD5:491a87f63ecdb44f6f85b7a1c254f7f4
SHA1:b2770bc069e7fe78a0e829c3c04a0350caa8590a
SHA256:2e739a158762019e4e7454cfa782ff6f039e537c0758d44040eb92e37c935efa
Infos:

Detection

Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Machine Learning detection for sample
PE file contains section with special chars
Creates a DirectInput object (often for capturing keystrokes)
Uses 32bit PE files
Sample file is different than original file name gathered from version info
PE file contains strange resources
Tries to load missing DLLs
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Detected potential crypto function
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Found large amount of non-executed APIs
Program does not show much activity (idle)
Entry point lies outside standard sections

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
  • System is w10x64
  • Viewer.exe (PID: 6676 cmdline: "C:\Users\user\Desktop\Viewer.exe" MD5: 491A87F63ECDB44F6F85B7A1C254F7F4)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: Viewer.exeVirustotal: Detection: 7%Perma Link
Source: Viewer.exeJoe Sandbox ML: detected

Compliance

barindex
Source: C:\Users\user\Desktop\Viewer.exeUnpacked PE file: 0.2.Viewer.exe.10000000.1.unpack
Source: Viewer.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Source: C:\Users\user\Desktop\Viewer.exeFile created: C:\Users\user\Desktop\thinstall.logJump to behavior
Source: Binary string: mfc71.pdb source: Viewer.exe, 00000000.00000003.359439268.000000007FDD0000.00000004.00001000.00020000.00000000.sdmp, Viewer.exe, 00000000.00000002.369081938.000000007C141000.00000020.00001000.00020000.00000000.sdmp
Source: Binary string: c:\Cvs_projects\ShowCasePreNet\Tril\CD Viewer Release\Tril.pdb source: Viewer.exe
Source: Binary string: c:\Cvs_projects\ShowCasePreNet\Tril\CD Viewer Release\Tril.pdb source: Viewer.exe
Source: Binary string: c:\tmp\vregistryd_suzd.pdb source: Viewer.exe, 00000000.00000003.354856033.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, Viewer.exe, 00000000.00000003.354952274.000000007FE29000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: msvcr71.pdb source: Viewer.exe, 00000000.00000002.369382332.000000007C341000.00000020.00001000.00020000.00000000.sdmp
Source: Viewer.exe, 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmp, Viewer.exe, 00000000.00000003.356447815.000000007FE20000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.TrilTech.com
Source: Viewer.exe, 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmp, Viewer.exe, 00000000.00000003.356447815.000000007FE20000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.triltech.com.
Source: Viewer.exeString found in binary or memory: http://www.triltech.com/
Source: Viewer.exe, 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://www.triltech.com/%d:%d%d/%d/%d
Source: Viewer.exeString found in binary or memory: http://www.triltech.com/index.htm
Source: Viewer.exe, 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://www.triltech.com/index.htmReport
Source: Viewer.exe, 00000000.00000002.368144011.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

barindex
Source: Viewer.exeStatic PE information: section name: .text
Source: Viewer.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Source: Viewer.exe, 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameTRIL.EXEJ vs Viewer.exe
Source: Viewer.exe, 00000000.00000003.358200540.000000007FDD0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameXpdfViewer.dll6 vs Viewer.exe
Source: Viewer.exe, 00000000.00000002.369527345.000000007C392000.00000002.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMSVCR71.DLL\ vs Viewer.exe
Source: Viewer.exe, 00000000.00000002.369316106.000000007C227000.00000002.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMFC71.DLL< vs Viewer.exe
Source: Viewer.exe, 00000000.00000002.369741392.000000007FE40000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: \StringFileInfo\040904E4\OriginalFilename vs Viewer.exe
Source: Viewer.exe, 00000000.00000002.369741392.000000007FE40000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: Bad module %s.NET\StringFileInfo\040904E4\ProductNamecore\StringFileInfo\040904E4\OriginalFilenameMicrosoft\StringFileInfo\040904E4\CompanyNameMicrosoft .NET Runtime\StringFileInfo\040904E4\FileDescriptionlookup_imports %x-%x adding module %s (%s) vs Viewer.exe
Source: Viewer.exe, 00000000.00000003.356447815.000000007FE20000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTRIL.EXEJ vs Viewer.exe
Source: Viewer.exe, 00000000.00000003.359164402.000000007FDC0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMSVCR71.DLL\ vs Viewer.exe
Source: Viewer.exe, 00000000.00000000.353378151.0000000000401000.00000080.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameTRIL.EXEJ vs Viewer.exe
Source: Viewer.exe, 00000000.00000002.368564975.0000000002FE0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameIeRtUtil.dllD vs Viewer.exe
Source: Viewer.exeBinary or memory string: OriginalFilenameTRIL.EXEJ vs Viewer.exe
Source: Viewer.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Viewer.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Viewer.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Viewer.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Viewer.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Viewer.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Viewer.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Viewer.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Viewer.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Viewer.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Viewer.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C:\Users\user\Desktop\Viewer.exeSection loaded: mfc71enu.dllJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeSection loaded: mfc71enu.dllJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeSection loaded: mfc71enu.dllJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeSection loaded: mfc71enu.dllJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeSection loaded: mfc71enu.dllJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeSection loaded: mfc71enu.dllJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeSection loaded: mfc71enu.dllJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeSection loaded: mfc71enu.dllJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeSection loaded: mfc71loc.dllJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeSection loaded: mfc71loc.dllJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeCode function: 0_2_0045A0400_2_0045A040
Source: Viewer.exeStatic PE information: Section .text
Source: Viewer.exeVirustotal: Detection: 7%
Source: C:\Users\user\Desktop\Viewer.exeFile read: C:\Users\user\Desktop\Viewer.exeJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeMutant created: \Sessions\1\BaseNamedObjects\ShowCase
Source: C:\Users\user\Desktop\Viewer.exeFile created: C:\Users\user\Desktop\thinstall.logJump to behavior
Source: classification engineClassification label: mal72.evad.winEXE@1/0@0/0
Source: C:\Users\user\Desktop\Viewer.exeCode function: 0_2_00440080 GetVolumeInformationA,GetDiskFreeSpaceA,GetDriveTypeA,GetDriveTypeA,GetDriveTypeA,GetDriveTypeA,0_2_00440080
Source: C:\Users\user\Desktop\Viewer.exeFile opened: C:\Windows\SysWOW64\riched32.dllJump to behavior
Source: Viewer.exeStatic file information: File size 5755131 > 1048576
Source: Viewer.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: mfc71.pdb source: Viewer.exe, 00000000.00000003.359439268.000000007FDD0000.00000004.00001000.00020000.00000000.sdmp, Viewer.exe, 00000000.00000002.369081938.000000007C141000.00000020.00001000.00020000.00000000.sdmp
Source: Binary string: c:\Cvs_projects\ShowCasePreNet\Tril\CD Viewer Release\Tril.pdb source: Viewer.exe
Source: Binary string: c:\Cvs_projects\ShowCasePreNet\Tril\CD Viewer Release\Tril.pdb source: Viewer.exe
Source: Binary string: c:\tmp\vregistryd_suzd.pdb source: Viewer.exe, 00000000.00000003.354856033.000000007FE29000.00000004.00001000.00020000.00000000.sdmp, Viewer.exe, 00000000.00000003.354952274.000000007FE29000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: msvcr71.pdb source: Viewer.exe, 00000000.00000002.369382332.000000007C341000.00000020.00001000.00020000.00000000.sdmp

Data Obfuscation

barindex
Source: C:\Users\user\Desktop\Viewer.exeUnpacked PE file: 0.2.Viewer.exe.400000.0.unpack .text :EW; vs .text:ER;
Source: C:\Users\user\Desktop\Viewer.exeUnpacked PE file: 0.2.Viewer.exe.10000000.1.unpack
Source: C:\Users\user\Desktop\Viewer.exeCode function: 0_2_004762BF push ecx; ret 0_2_004762CF
Source: C:\Users\user\Desktop\Viewer.exeCode function: 0_2_004763A8 push eax; ret 0_2_004763C6
Source: Viewer.exeStatic PE information: section name: .text
Source: initial sampleStatic PE information: section where entry point is pointing to: .text
Source: C:\Users\user\Desktop\Viewer.exeFile created: C:\Users\user\Desktop\thinstall.logJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeCode function: 0_2_00454860 IsIconic,GetWindowPlacement,GetWindowRect,0_2_00454860
Source: C:\Users\user\Desktop\Viewer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Viewer.exeAPI coverage: 1.6 %
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: Viewer.exe, 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: **);99HGFSQPYWV[YX\ZY`^]igfrpptrrigfTRQ;99
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\Viewer.exeCode function: 0_2_004545C0 GetVersionExA,0_2_004545C0
Source: C:\Users\user\Desktop\Viewer.exeCode function: 0_2_004763C7 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,0_2_004763C7
Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management Instrumentation1
DLL Side-Loading
1
DLL Side-Loading
1
Masquerading
1
Input Capture
1
System Time Discovery
Remote Services1
Input Capture
Exfiltration Over Other Network Medium1
Encrypted Channel
Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts2
Software Packing
LSASS Memory1
Security Software Discovery
Remote Desktop Protocol1
Archive Collected Data
Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)1
DLL Side-Loading
Security Account Manager1
Application Window Discovery
SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)1
Obfuscated Files or Information
NTDS5
System Information Discovery
Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 597179 Sample: Viewer.exe Startdate: 25/03/2022 Architecture: WINDOWS Score: 72 8 Multi AV Scanner detection for submitted file 2->8 10 Machine Learning detection for sample 2->10 12 PE file contains section with special chars 2->12 5 Viewer.exe 1 2->5         started        process3 signatures4 14 Detected unpacking (changes PE section rights) 5->14 16 Detected unpacking (creates a PE file in dynamic memory) 5->16

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
Viewer.exe7%VirustotalBrowse
Viewer.exe3%MetadefenderBrowse
Viewer.exe9%ReversingLabs
Viewer.exe100%Joe Sandbox ML
No Antivirus matches
SourceDetectionScannerLabelLinkDownload
0.2.Viewer.exe.7fe985c8.5.unpack100%AviraTR/Crypt.XPACK.GenDownload File
No Antivirus matches
SourceDetectionScannerLabelLink
http://www.triltech.com.0%VirustotalBrowse
http://www.triltech.com.0%Avira URL Cloudsafe
http://www.triltech.com/index.htm0%Avira URL Cloudsafe
http://www.TrilTech.com0%Avira URL Cloudsafe
http://www.triltech.com/0%Avira URL Cloudsafe
http://www.triltech.com/%d:%d%d/%d/%d0%Avira URL Cloudsafe
http://www.triltech.com/index.htmReport0%Avira URL Cloudsafe
No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
http://www.triltech.com.Viewer.exe, 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmp, Viewer.exe, 00000000.00000003.356447815.000000007FE20000.00000004.00001000.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://www.triltech.com/index.htmViewer.exefalse
  • Avira URL Cloud: safe
unknown
http://www.TrilTech.comViewer.exe, 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmp, Viewer.exe, 00000000.00000003.356447815.000000007FE20000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.triltech.com/Viewer.exefalse
  • Avira URL Cloud: safe
unknown
http://www.triltech.com/%d:%d%d/%d/%dViewer.exe, 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.triltech.com/index.htmReportViewer.exe, 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpfalse
  • Avira URL Cloud: safe
unknown
No contacted IP infos
Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:597179
Start date and time:2022-03-25 16:06:08 +01:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 7m 27s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:Viewer.exe
Cookbook file name:default.jbs
Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:18
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • HDC enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Detection:MAL
Classification:mal72.evad.winEXE@1/0@0/0
EGA Information:
  • Successful, ratio: 100%
HDC Information:
  • Successful, ratio: 100% (good quality ratio 64.9%)
  • Quality average: 40.9%
  • Quality standard deviation: 36.5%
HCA Information:
  • Successful, ratio: 80%
  • Number of executed functions: 2
  • Number of non-executed functions: 20
Cookbook Comments:
  • Adjust boot time
  • Enable AMSI
  • Found application associated with file extension: .exe
  • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
  • Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, client.wns.windows.com, fs.microsoft.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
  • Not all processes where analyzed, report is missing behavior information
  • Report size getting too big, too many NtProtectVirtualMemory calls found.
  • Report size getting too big, too many NtSetInformationFile calls found.
No simulations
No context
No context
No context
No context
No context
No created / dropped files found
File type:PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):7.982215559373019
TrID:
  • Win32 Executable (generic) a (10002005/4) 99.96%
  • Generic Win/DOS Executable (2004/3) 0.02%
  • DOS Executable Generic (2002/1) 0.02%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:Viewer.exe
File size:5755131
MD5:491a87f63ecdb44f6f85b7a1c254f7f4
SHA1:b2770bc069e7fe78a0e829c3c04a0350caa8590a
SHA256:2e739a158762019e4e7454cfa782ff6f039e537c0758d44040eb92e37c935efa
SHA512:084b2d609d5fed5caf64de7df926647f62bae5b2a0b3fd0423160dfeda4bdeea2310175e9151e89f57cf245181453f4eccd19a198bdf9a409cc52f78943e007e
SSDEEP:98304:jzdycD+XQJLdrHLhqCr54kEw0B4zDdm4IGCr:pjLdvr54BtGz8G4
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........I...'...'...'...&...'...4...'...)...'...1...'.Rich..'.................PE..L.....AB............................?.............@
Icon Hash:00ecececececec00
Entrypoint:0x401c3f
Entrypoint Section:.text
Digitally signed:false
Imagebase:0x400000
Subsystem:windows gui
Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
DLL Characteristics:
Time Stamp:0x4241F6D2 [Wed Mar 23 23:08:02 2005 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:4
OS Version Minor:0
File Version Major:4
File Version Minor:0
Subsystem Version Major:4
Subsystem Version Minor:0
Import Hash:99533dd5ea92d69d99ab2744e986d191
Instruction
push ebp
mov ebp, esp
mov eax, DD99F6D0h
mov ebx, C825CB57h
push eax
call 00007FF36CECD6D5h
pop eax
sub eax, 00001C52h
mov ecx, 00001C17h
mov edx, 00001CCBh
mov esi, 00001000h
mov edi, 00001CE0h
mov ebp, 00001C98h
add ebp, eax
xor dword ptr [ebp+00h], 90DF7A07h
xor dword ptr [ebp+04h], 3A9803D7h
xor dword ptr [ebp+08h], 7EDE9DA7h
xor dword ptr [ebp+0Ch], 45034777h
xor dword ptr [ebp+10h], 04560147h
add ecx, eax
add al, AAh
fsub qword ptr [eax-2Ch]
sti
lds ebp, fword ptr [edx+2Ch]
pop eax
push ebp
push eax
pop esp
lodsb
push FFFFFF9Eh
inc esi
adc al, 52h
cmp eax, F13BD803h
jl 00007FF36CECD6D6h
cmp esi, edx
jl 00007FF36CECD6D4h
mov dword ptr [esi], ebp
add esi, 04h
cmp esi, edi
jl 00007FF36CECD6B5h
pop eax
push eax
push 00400000h
push 00001F40h
call 00007FF303D2E4FFh
add byte ptr [esi+36B466E1h], FFFFFFBFh
aaa
sbb eax, 9707D624h
call far fword ptr [ebp-3Ah]
adc byte ptr [eax], al
add byte ptr [edx+11h], ah
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax+edx+00h], cl
add byte ptr [esi+10h], bl
add byte ptr [eax], al
outsb
adc byte ptr [eax], al
add byte ptr [esi+10h], bh
add byte ptr [eax], al
nop
adc byte ptr [eax], al
add byte ptr [edx-4DFFFFF0h], ah
adc byte ptr [eax], al
Programming Language:
  • [C++] VC++ 6.0 SP5 build 8804
NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IMPORT0x1ff00x294.text
IMAGE_DIRECTORY_ENTRY_RESOURCE0x22900x42e4.text
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
IMAGE_DIRECTORY_ENTRY_DEBUG0x65740x1c.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x00x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x1ce00x54.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
.text 0x10000x80c0000x55e8unknownunknownunknownunknownIMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
NameRVASizeTypeLanguageCountry
RT_ICON0x27f80x2e8dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4294967295, next used block 4110417919EnglishUnited States
RT_ICON0x2af00x128GLS_BINARY_LSB_FIRSTEnglishUnited States
RT_ICON0x2c280x2e8dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 3486502911, next used block 150994943EnglishUnited States
RT_ICON0x2f200x128GLS_BINARY_LSB_FIRSTEnglishUnited States
RT_ICON0x30580x2e8dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 3486317820, next used block 134205436EnglishUnited States
RT_ICON0x33500x2e8dataEnglishUnited States
RT_ICON0x36480x128GLS_BINARY_LSB_FIRSTEnglishUnited States
RT_ICON0x37800x2e8dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0EnglishUnited States
RT_ICON0x3a780x128GLS_BINARY_LSB_FIRSTEnglishUnited States
RT_ICON0x3bb00x2e8dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0EnglishUnited States
RT_ICON0x3ea80x128GLS_BINARY_LSB_FIRSTEnglishUnited States
RT_ICON0x3fe00x2e8dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0EnglishUnited States
RT_ICON0x42d80x128GLS_BINARY_LSB_FIRSTEnglishUnited States
RT_ICON0x44100x2e8dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0EnglishUnited States
RT_ICON0x47080x128GLS_BINARY_LSB_FIRSTEnglishUnited States
RT_ICON0x48400x2e8dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0EnglishUnited States
RT_ICON0x4b380x128GLS_BINARY_LSB_FIRSTEnglishUnited States
RT_ICON0x4c700x2e8dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 1715732720, next used block 7385326EnglishUnited States
RT_ICON0x4f680x128GLS_BINARY_LSB_FIRSTEnglishUnited States
RT_ICON0x50a00x2e8dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 2290640518, next used block 1717995656EnglishUnited States
RT_ICON0x53980x128GLS_BINARY_LSB_FIRSTEnglishUnited States
RT_ICON0x54d00x2e8dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4042264335, next used block 134156287EnglishUnited States
RT_ICON0x57c80x2e8dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0EnglishUnited States
RT_ICON0x5ac00x2e8dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 2576943104, next used block 2576980377EnglishUnited States
RT_ICON0x5db80x128GLS_BINARY_LSB_FIRSTEnglishUnited States
RT_GROUP_ICON0x5ef00x22dataEnglishUnited States
RT_GROUP_ICON0x5f220x22dataEnglishUnited States
RT_GROUP_ICON0x5f540x14dataEnglishUnited States
RT_GROUP_ICON0x5f780x22dataEnglishUnited States
RT_GROUP_ICON0x5faa0x22dataEnglishUnited States
RT_GROUP_ICON0x5fdc0x22dataEnglishUnited States
RT_GROUP_ICON0x600e0x22dataEnglishUnited States
RT_GROUP_ICON0x60400x22dataEnglishUnited States
RT_GROUP_ICON0x60720x22dataEnglishUnited States
RT_GROUP_ICON0x60a40x22dataEnglishUnited States
RT_GROUP_ICON0x60d60x22dataEnglishUnited States
RT_GROUP_ICON0x61080x14dataEnglishUnited States
RT_GROUP_ICON0x612c0x14dataEnglishUnited States
RT_GROUP_ICON0x61500x22dataEnglishUnited States
RT_VERSION0x61820x3f0SysEx File - OctavePlateauEnglishUnited States
DLLImport
USER32.dllMessageBoxA
KERNEL32.dllMultiByteToWideChar, GetEnvironmentVariableA, ExitProcess, FormatMessageA, GetLastError, SetLastError, GetProcAddress, VirtualProtect, LoadLibraryA, GetModuleHandleA, GetModuleFileNameA, GetModuleFileNameW, GetVersionExA, VirtualAlloc, GlobalAlloc, SetFilePointer, ReadFile, CreateFileA
MSVFW32.dllICOpen
AVIFIL32.dllAVIFileExit
KERNEL32.dllGetCurrentProcessId
USER32.dllRegisterClipboardFormatA
GDI32.dllDeleteDC
ADVAPI32.dllRegReplaceKeyA
SHELL32.dllSHGetSpecialFolderPathA
COMCTL32.dll
ole32.dllStringFromGUID2
urlmon.dllHlinkNavigateString
Language of compilation systemCountry where language is spokenMap
EnglishUnited States
No network behavior found
050100s020406080100

Click to jump to process

050100s0.005101520MB

Click to jump to process

  • File
  • Registry

Click to dive into process behavior distribution

Target ID:0
Start time:17:07:21
Start date:25/03/2022
Path:C:\Users\user\Desktop\Viewer.exe
Wow64 process (32bit):true
Commandline:"C:\Users\user\Desktop\Viewer.exe"
Imagebase:0x400000
File size:5755131 bytes
MD5 hash:491A87F63ECDB44F6F85B7A1C254F7F4
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:low
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:0.7%
Dynamic/Decrypted Code Coverage:0%
Signature Coverage:25.6%
Total number of Nodes:43
Total number of Limit Nodes:1
Show Legend
Hide Nodes/Edges
execution_graph 14038 457fb0 CreateMutexA 14039 458000 GetLastError 14038->14039 14040 458020 14038->14040 14039->14040 14057 45800d 14039->14057 14058 4242c0 14040->14058 14042 458255 14043 45877e 14042->14043 14049 458823 14042->14049 14042->14057 14066 456390 14043->14066 14045 4587ad 14046 456390 GetDriveTypeA 14045->14046 14045->14049 14048 4587e0 14046->14048 14047 456390 GetDriveTypeA 14050 45898e 14047->14050 14048->14047 14048->14049 14049->14048 14051 4589d1 14049->14051 14049->14057 14050->14051 14052 458b81 FindWindowExA 14051->14052 14051->14057 14053 458bb5 UpdateWindow 14052->14053 14054 458b9e CreateSolidBrush SetClassLongA 14052->14054 14055 458bcc 14053->14055 14054->14053 14055->14057 14070 456170 14055->14070 14059 42433e 14058->14059 14060 424405 GetDriveTypeA 14059->14060 14061 42443a 14060->14061 14062 4244d6 StgOpenStorage 14061->14062 14065 424512 14061->14065 14063 424500 14062->14063 14064 424584 GetLastError 14063->14064 14063->14065 14064->14065 14065->14042 14067 4563c3 14066->14067 14068 4564ff GetDriveTypeA 14067->14068 14069 456513 14067->14069 14068->14069 14069->14045 14071 4561ad 14070->14071 14072 456332 14071->14072 14074 440080 14071->14074 14072->14057 14082 4400eb 14074->14082 14075 4403ff 14075->14071 14076 440352 GetVolumeInformationA 14077 440392 GetDiskFreeSpaceA 14076->14077 14078 440383 14076->14078 14079 4403b5 14077->14079 14080 4403c6 GetDriveTypeA 14077->14080 14078->14077 14079->14080 14081 4403d8 GetDriveTypeA 14080->14081 14083 4403e4 14080->14083 14081->14083 14082->14075 14082->14076 14084 4403f0 GetDriveTypeA 14083->14084 14084->14075

Executed Functions

C-Code - Quality: 41%
			E00457FB0(int __ecx, void* __fp0) {
				intOrPtr _v16;
				char _v24;
				intOrPtr _v28;
				intOrPtr _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v104;
				char _v108;
				char _v112;
				char _v132;
				char _v136;
				char _v140;
				char _v144;
				char _v148;
				char _v152;
				char _v156;
				char _v160;
				char _v164;
				char _v168;
				char _v172;
				char _v308;
				char _v564;
				char _v820;
				char _v1052;
				char _v1060;
				char _v1068;
				char _v1080;
				char _v1096;
				void* _v1144;
				char _v1205;
				short _v1207;
				intOrPtr _v1211;
				intOrPtr _v1215;
				intOrPtr _v1219;
				intOrPtr _v1223;
				intOrPtr _v1227;
				intOrPtr _v1231;
				intOrPtr _v1235;
				char _v1236;
				char _v1248;
				void* _v1252;
				char _v1256;
				void* _v1260;
				void* _v1264;
				char _v1272;
				char _v1276;
				char _v1284;
				char _v1288;
				char _v1292;
				void* _v1296;
				char _v1300;
				char _v1304;
				char _v1308;
				intOrPtr _v1312;
				char _v1316;
				char _v1320;
				struct HWND__* _v1324;
				struct HWND__* _v1328;
				char _v1352;
				char _v1356;
				signed int _v1360;
				char _v1364;
				struct HWND__* _v1368;
				struct HWND__* _v1372;
				char _v1376;
				char _v1380;
				void* _v1384;
				char _v1396;
				struct HWND__* _v1400;
				char _v1404;
				struct HWND__* _v1408;
				struct HWND__* _v1412;
				struct HWND__* _v1420;
				struct HWND__* _v1424;
				void* _v1432;
				void* __esi;
				void* __ebp;
				intOrPtr _t292;
				void* _t293;
				void* _t297;
				struct HWND__* _t303;
				void* _t307;
				void* _t308;
				void* _t309;
				void* _t324;
				struct HWND__* _t327;
				struct HWND__* _t328;
				intOrPtr _t329;
				struct HWND__* _t341;
				int _t342;
				struct HWND__* _t343;
				int _t346;
				struct HWND__* _t353;
				intOrPtr _t354;
				struct HWND__* _t355;
				struct HWND__* _t364;
				struct HWND__* _t365;
				long _t383;
				struct HWND__* _t388;
				struct HWND__* _t390;
				struct HWND__* _t394;
				signed int _t396;
				intOrPtr _t398;
				intOrPtr _t399;
				struct HWND__* _t400;
				struct HWND__* _t402;
				signed int _t404;
				struct HWND__* _t409;
				struct HWND__* _t411;
				struct HWND__* _t414;
				struct HWND__* _t416;
				intOrPtr* _t419;
				intOrPtr* _t421;
				struct HWND__* _t422;
				struct HWND__* _t424;
				struct HWND__* _t426;
				void* _t436;
				void* _t437;
				void* _t438;
				void* _t440;
				void* _t445;
				void* _t447;
				void* _t448;
				void* _t449;
				void* _t457;
				char* _t488;
				intOrPtr _t524;
				intOrPtr* _t547;
				intOrPtr _t550;
				intOrPtr _t551;
				intOrPtr _t552;
				intOrPtr _t553;
				intOrPtr _t592;
				intOrPtr _t593;
				intOrPtr _t598;
				intOrPtr _t599;
				intOrPtr _t600;
				intOrPtr _t601;
				struct HWND__* _t608;
				struct HWND__* _t609;
				struct HWND__* _t610;
				struct HWND__* _t611;
				struct HWND__** _t614;
				struct HWND__* _t615;
				signed int* _t616;
				signed int _t617;
				signed int _t618;
				struct HWND__* _t619;
				int _t624;
				struct HWND__* _t630;
				struct HWND__* _t631;
				intOrPtr _t632;
				void* _t633;
				intOrPtr _t636;
				char _t637;
				intOrPtr* _t638;
				void* _t640;
				void* _t641;
				void* _t645;
				void* _t649;

				_t649 = __fp0;
				_push(0xffffffff);
				_push(0x4abdca);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t632;
				_t633 = _t632 - 0x4e8;
				_t292 =  *0x4d0070; // 0x4961b978
				_t624 = __ecx;
				_v16 = _t292;
				 *(__ecx + 0x188) = 0;
				_t293 = CreateMutexA(0, 1, "ShowCase"); // executed
				 *(_t624 + 0x188) = _t293;
				if(_t293 == 0 || GetLastError() != 0xb7) {
					 *((intOrPtr*)(_t624 + 0xe4)) = 0;
					 *((intOrPtr*)(_t624 + 0xe8)) = 0;
					 *(_t624 + 0xec) = 0;
					L004752E6();
					 *0x4af2bc(0xf010, "ShowCase");
					 *0x4af17c(0x104,  &_v1052);
					_t297 =  *0x4afb90( &_v1060);
					_v24 = 0;
					_v24 = 1;
					 *0x4afb64(E00402410( &_v1256,  &_v1288, _t297), 0x4b2a78);
					 *0x4afb9c();
					_v28 = 0xffffffff;
					 *0x4afb9c();
					_t303 =  *0x4af180(0,  &_v1068, 0x104);
					_t608 = _t303;
					 *0x4afd58( &_v1080,  &_v1272,  &_v820,  &_v308,  &_v564);
					_t307 =  *0x4afb90( &_v820);
					_v44 = 2;
					_t308 =  *0x4afb90( &_v1276);
					_v48 = 3;
					_t309 = E00402380( &_v1308,  &_v1284, _t308);
					_t636 = _t633 + 0x2c;
					_v48 = 4;
					 *0x4afb64(_t309, _t307);
					 *0x4afb9c();
					 *0x4afb9c();
					_v52 = 0xffffffff;
					 *0x4afb9c();
					__eflags = _t608;
					if(_t608 != 0) {
						__eflags = _t608 - 0x104;
						if(_t608 < 0x104) {
							_t457 = E00402410( &_v1300,  &_v1300, _t624 + 0x208);
							_t636 = _t636 + 0xc;
							_v52 = 5;
							 *0x4afb64(_t457, "MainDictionary");
							 *0x4afb9c();
							 *0x4af184( &_v1096); // executed
						}
					}
					 *(_t624 + 0xc8) = 0;
					 *(_t624 + 0xcc) = 0;
					 *(_t624 + 0xd4) = 0;
					 *(_t624 + 0xd8) = 0;
					 *(_t624 + 0xc4) = 1;
					 *(_t624 + 0xd0) = 1;
					 *0x4af2c0();
					_v1312 = _t636;
					_v52 = 6;
					 *0x4afba4( *((intOrPtr*)(_t624 + 0xe8)), _t624 + 0xec);
					_t609 = E004242C0(_t624 + 0x208,  &_v1308,  &_v1308,  *((intOrPtr*)(_t624 + 0xe4)));
					_t637 = _t636 + 0x14;
					__eflags = _t609 - 5;
					if(_t609 != 5) {
						__eflags = _t609 - 6;
						if(_t609 != 6) {
							__eflags = _t609 - 3;
							if(_t609 == 3) {
								L30:
								 *0x4af2c0();
								__eflags = _t609 - 8;
								_v56 = 7;
								if(_t609 != 8) {
									__eflags = _t609 - 4;
									if(_t609 != 4) {
										__eflags = _t609 - 3;
										if(_t609 != 3) {
											goto L37;
										} else {
											_push(0x76);
											goto L36;
										}
									} else {
										_push(0x72);
										goto L36;
									}
								} else {
									_push(0xf026);
									L36:
									 *0x4af2bc();
									L37:
									_t488 =  &_v1248;
									L004251D0(_t488, 0);
									_v1320 = _t637;
									_v60 = 8;
									 *0x4afba4(_t488);
									_t324 = L00425320( &_v1256,  &_v1324);
									L004749A0();
									__eflags = _t324 - 2;
									_v68 = 7;
									if(_t324 != 2) {
										 *0x4afb9c();
										L004749D6();
										L40:
										L41:
										_v60 = 6;
										 *0x4afb9c();
										L42:
										 *(_t624 + 0x204) = 1;
										_t327 = L00421130(1);
										_t638 = _t637 + 4;
										L004752E0();
										__eflags = _t327;
										if(_t327 != 0) {
											_push(0);
											L004752DA();
											_push(3);
											L004752D4();
											_push(0x90);
											L004746C0();
											_t610 = _t327;
											_t640 = _t638 + 8;
											_v1324 = _t610;
											__eflags = _t610;
											_v64 = 0x11;
											if(_t610 == 0) {
												_t328 = 0;
												__eflags = 0;
											} else {
												_push(L00452C60());
												_push(E004527A0());
												_t328 = L004535A0();
												_push(_t328);
												_push(0xd7);
												L004752CE();
											}
											_push(_t328);
											_v64 = 6;
											 *(_t624 + 0x134) = _t328;
											L004752C8();
											_push(0x90);
											L004746C0();
											_t611 = _t328;
											_t641 = _t640 + 4;
											_v1328 = _t611;
											__eflags = _t611;
											_v68 = 0x12;
											if(_t611 == 0) {
												_t329 = 0;
												__eflags = 0;
											} else {
												_push(L00460CB0());
												_push(E00460760());
												_t329 = L0046B5E0();
												_push(_t329);
												_push(0x86);
												L004752CE();
											}
											_v68 = 6;
											 *((intOrPtr*)(_t624 + 0x130)) = _t329;
											L004752C2();
											L004752C8();
											L004752BC();
											L004752BC();
											L004752B6();
											 *0x4afd34( *(_t624 + 0x64), 0x4b5f14,  *(_t624 + 0x134), 0, 0x4b5f14,  *((intOrPtr*)(_t624 + 0x130)), 0,  *((intOrPtr*)(_t624 + 0x130)), 6);
											 *0x4afba4(_t624 + 0x208);
											_v104 = 0x13;
											_v108 = 0x14;
											_v108 = 0x15;
											 *0x4afb64(E00402380( &_v1360,  &_v1368,  &_v1360),  *0x4afb90("CDViewerHelp.chm"));
											 *0x4afb9c();
											_v112 = 0x13;
											 *0x4afb9c();
											_t341 =  *0x4afdd8(_v1364);
											_push(0x594);
											 *(_t624 + 0x64) = _t341;
											L004746C0();
											_t638 = _t641 + 0x18;
											_v1372 = _t341;
											__eflags = _t341;
											_v112 = 0x16;
											if(_t341 == 0) {
												_t342 = 0;
												__eflags = 0;
											} else {
												_t342 = L00404EE0(_t341);
											}
											 *(_t624 + 0xac) = _t342;
											_v112 = 0x13;
											_t343 =  *((intOrPtr*)( *_t342 + 0x13c))(0x80, 0xcf8000, 0, 0);
											__eflags = _t343;
											if(_t343 == 0) {
												L150:
												goto L151;
											} else {
												_t513 =  *(_t624 + 0xac);
												_push(3);
												 *(_t624 + 0x20) =  *(_t624 + 0xac);
												L00474AF6();
												_t630 = 0;
												__eflags =  *(_t624 + 0xc8);
												_t614 = _t624 + 0x144;
												 *(_t624 + 0x6c) = 1;
												 *_t614 = 0;
												if( *(_t624 + 0xc8) != 0) {
													L66:
													 *_t614 = 0;
													L67:
													__eflags =  *_t614;
													if( *_t614 != 0) {
														L82:
														__eflags = _t630;
														if(_t630 < 0) {
															L142:
															__eflags =  *(_t624 + 0xc8);
															if( *(_t624 + 0xc8) != 0) {
																L148:
																_push(0);
																_push(0);
																_push(0xf034);
																L149:
																L00474C70();
																 *(_t624 + 0x204) = 0;
																goto L150;
															}
															__eflags =  *(_t624 + 0xd0);
															if( *(_t624 + 0xd0) != 0) {
																goto L148;
															}
															__eflags =  *(_t624 + 0xd4);
															if( *(_t624 + 0xd4) != 0) {
																goto L148;
															}
															__eflags =  *(_t624 + 0xcc);
															if( *(_t624 + 0xcc) != 0) {
																goto L148;
															}
															__eflags =  *(_t624 + 0xd8);
															if( *(_t624 + 0xd8) != 0) {
																goto L148;
															}
															_push(0);
															_push(0);
															_push(0x5dce);
															goto L149;
														}
														_t615 =  *_t614;
														__eflags = _t615;
														if(_t615 == 0) {
															goto L142;
														}
														 *((intOrPtr*)(_t615->i + 0x10))(_t615, 1);
														_t616 = _t624 + 0x148;
														_t631 = 0;
														__eflags =  *(_t624 + 0xc8);
														 *_t616 = 0;
														if( *(_t624 + 0xc8) != 0) {
															L95:
															 *_t616 = 0;
															L96:
															__eflags =  *_t616;
															if( *_t616 != 0) {
																L111:
																__eflags = _t631;
																if(_t631 < 0) {
																	L141:
																	_push(0);
																	_push(0);
																	_push(0xf01e);
																	goto L149;
																}
																_t617 =  *_t616;
																__eflags = _t617;
																if(_t617 == 0) {
																	goto L141;
																}
																_t353 =  *((intOrPtr*)( *_t617 + 0x10))(_t617, 1);
																_t618 = _t617 | 0xffffffff;
																_push(0x20);
																 *(_t624 + 0x12c) = _t618;
																L004746C0();
																_t645 = _t638 + 4;
																_v1408 = _t353;
																__eflags = _t353;
																_v148 = 0x19;
																if(_t353 == 0) {
																	_t354 = 0;
																	__eflags = 0;
																} else {
																	_t354 = E00420240(_t353);
																}
																_v148 = 0x13;
																 *((intOrPtr*)(_t624 + 0xf4)) = _t354;
																_t355 =  *0x4aff98(0);
																_t638 = _t645 + 4;
																L004752B0();
																_push( &_v1376);
																_v148 = 0x1a;
																_v1360 = _t618;
																L004752AA();
																__eflags = _v1372;
																if(_v1372 != 0) {
																	L140:
																	_v152 = 0x13;
																	L0047529E();
																	 *0x4afb9c();
																	 *0x4afb9c();
																	_t346 = 1;
																	goto L154;
																} else {
																	__eflags = _v1368;
																	if(_v1368 != 0) {
																		goto L140;
																	}
																	_push( &_v1380);
																	L004752A4();
																	__eflags = _t355;
																	if(_t355 != 0) {
																		 *0x4afb64( &_v1364);
																		_t619 = FindWindowExA( *( *(_t624 + 0xac) + 0x20), 0, "MDIClient", 0);
																		__eflags = _t619;
																		if(_t619 != 0) {
																			_t383 = CreateSolidBrush(0);
																			 *(_t624 + 0x120) = _t383;
																			SetClassLongA(_t619, 0xfffffff6, _t383);
																		}
																		UpdateWindow( *( *(_t624 + 0xac) + 0x20));
																		_t364 = L00454F10(_t624);
																		_t524 =  *((intOrPtr*)(_t624 + 0x15c));
																		__eflags =  *(_t524 - 0xc);
																		if( *(_t524 - 0xc) == 0) {
																			E00402530( &_v1408,  &_v1408);
																			__eflags = 0;
																			_v1235 = 0;
																			_v1231 = 0;
																			_v1227 = 0;
																			_v1223 = 0;
																			_v1219 = 0;
																			_v1215 = 0;
																			_v1211 = 0;
																			_v1207 = 0;
																			_v1236 = 0;
																			_v1205 = 0;
																			 *0x4afd54( &_v1236, "%02d%02d.%02d%02d%02d", L00401F30( &_v1412), L00401F50( &_v1412), L00401F70( &_v1412), L00401F90( &_v1412), L00401FB0( &_v1412));
																			_t638 = _t638 + 0x1c;
																			_v168 = 0x1b;
																			 *0x4afb64( *0x4afb90( &_v1236));
																			_v172 = 0x1a;
																			_t364 =  *0x4afb9c();
																		}
																		_push(0x1c);
																		L004746C0();
																		_t638 = _t638 + 4;
																		_v1420 = _t364;
																		__eflags = _t364;
																		_v160 = 0x1c;
																		if(_t364 == 0) {
																			_t365 = 0;
																			__eflags = 0;
																		} else {
																			_t365 = L0043F920(_t364);
																		}
																		__eflags = _t365;
																		_v160 = 0x1a;
																		 *(_t624 + 0xb0) = _t365;
																		if(_t365 == 0) {
																			L130:
																			 *((intOrPtr*)(_t624 + 0x1a0)) = 0;
																			goto L131;
																		} else {
																			__eflags =  *(_t624 + 0xec);
																			if( *(_t624 + 0xec) == 0) {
																				goto L130;
																			}
																			 *((intOrPtr*)(_t624 + 0x1a0)) = L0043E970(_t365);
																			L131:
																			__eflags =  *(_t624 + 0xc8);
																			if( *(_t624 + 0xc8) == 0) {
																				__eflags =  *(_t624 + 0xd0);
																				if( *(_t624 + 0xd0) == 0) {
																					__eflags =  *(_t624 + 0xd4);
																					if( *(_t624 + 0xd4) == 0) {
																						__eflags =  *(_t624 + 0xcc);
																						if( *(_t624 + 0xcc) == 0) {
																							__eflags =  *(_t624 + 0xd8);
																							if( *(_t624 + 0xd8) == 0) {
																								E00456170(_t624, _t649);
																							}
																						}
																					}
																				}
																			}
																			__eflags =  *(_t624 + 0xdc);
																			if( *(_t624 + 0xdc) != 0) {
																				L004733B0( &_v1352, 0);
																				_v1424 = _t638;
																				_v164 = 0x1d;
																				E00454550(_t638);
																				_t638 = _t638 + 4;
																				E00454570( &_v1356,  &_v1352);
																				L004749A0();
																				_v168 = 0x1a;
																				L00454BB0();
																			}
																			L00457AF0(_t624, _t649);
																			goto L140;
																		}
																	}
																	_v156 = 0x13;
																	L0047529E();
																	goto L150;
																}
															}
															L97:
															E00402410(_t513,  &_v1404, _t624 + 0x208);
															_t638 = _t638 + 0xc;
															_v140 = 0x18;
															_t388 =  *0x4af188(_v1404, "DicomInfo.ocx");
															__eflags = _t388;
															 *(_t624 + 0x184) = _t388;
															if(_t388 == 0) {
																L110:
																_v144 = 0x13;
																 *0x4afb9c();
																goto L111;
															}
															_t390 =  *0x4af1ec(_t388, "DllRegisterServer");
															__eflags = _t390;
															if(_t390 == 0) {
																goto L110;
															}
															_t390->i();
															__eflags =  *(_t624 + 0xc8);
															if( *(_t624 + 0xc8) == 0) {
																L104:
																 *0x4af18c( *(_t624 + 0x184));
																 *(_t624 + 0x184) = 0;
																L105:
																_t631 =  *0x4affdc(0x4b65b4, 1, 0, 0x4b864c, _t616);
																__eflags = _t631;
																if(_t631 >= 0) {
																	_t394 =  *_t616;
																	__eflags = _t394;
																	if(_t394 != 0) {
																		_t631 =  *((intOrPtr*)(_t394->i + 0x14))(_t394,  &_v1424);
																		__eflags = _t631;
																		if(_t631 >= 0) {
																			__eflags = _v1424;
																			if(_v1424 == 0) {
																				_t396 =  *_t616;
																				 *((intOrPtr*)( *_t396 + 8))(_t396);
																				 *_t616 = 0;
																			}
																		}
																	}
																}
																goto L110;
															}
															__eflags =  *(_t624 + 0xcc);
															if( *(_t624 + 0xcc) == 0) {
																goto L104;
															}
															__eflags =  *(_t624 + 0xd0);
															if( *(_t624 + 0xd0) == 0) {
																goto L104;
															}
															__eflags =  *(_t624 + 0xd4);
															if( *(_t624 + 0xd4) == 0) {
																goto L104;
															}
															__eflags =  *(_t624 + 0xd8);
															if( *(_t624 + 0xd8) != 0) {
																goto L105;
															}
															goto L104;
														}
														__eflags =  *(_t624 + 0xcc);
														if( *(_t624 + 0xcc) != 0) {
															goto L95;
														}
														__eflags =  *(_t624 + 0xd0);
														if( *(_t624 + 0xd0) != 0) {
															goto L95;
														}
														__eflags =  *(_t624 + 0xd4);
														if( *(_t624 + 0xd4) != 0) {
															goto L95;
														}
														__eflags =  *(_t624 + 0xd8);
														if(__eflags != 0) {
															goto L95;
														}
														_t592 =  *0x4b65b4; // 0xc059b1a6
														_t398 =  *0x4b65b8; // 0x11d165d8
														_t638 = _t638 - 0x10;
														_t547 = _t638;
														 *_t547 = _t592;
														_t593 =  *0x4b65bc; // 0x8000b395
														 *((intOrPtr*)(_t547 + 4)) = _t398;
														_t399 =  *0x4b65c0; // 0x31a386c8
														 *((intOrPtr*)(_t547 + 8)) = _t593;
														 *((intOrPtr*)(_t547 + 0xc)) = _t399;
														_t513 = _t624;
														_t400 = E00456390(_t624, 0, __eflags);
														__eflags = _t400;
														if(_t400 != 0) {
															goto L95;
														}
														_t631 =  *0x4affdc(0x4b65b4, 1, 0, 0x4b864c, _t616);
														__eflags = _t631;
														if(_t631 < 0) {
															goto L97;
														}
														_t402 =  *_t616;
														__eflags = _t402;
														if(_t402 == 0) {
															goto L96;
														}
														_t513 = _t402->i;
														_t631 =  *((intOrPtr*)(_t402->i + 0x14))(_t402,  &_v1408);
														__eflags = _t631;
														if(_t631 < 0) {
															goto L97;
														}
														__eflags = _v1408;
														if(_v1408 != 0) {
															goto L96;
														}
														_t404 =  *_t616;
														_t513 =  *_t404;
														 *((intOrPtr*)( *_t404 + 8))(_t404);
														goto L95;
													}
													L68:
													E00402410(_t513,  &_v1396, _t624 + 0x208);
													_t638 = _t638 + 0xc;
													_v132 = 0x17;
													_t409 =  *0x4af188(_v1396, "DicomImage.ocx");
													__eflags = _t409;
													 *(_t624 + 0x180) = _t409;
													if(_t409 != 0) {
														_t411 =  *0x4af1ec(_t409, "DllRegisterServer");
														__eflags = _t411;
														if(_t411 != 0) {
															_t411->i();
															__eflags =  *(_t624 + 0xc8);
															if( *(_t624 + 0xc8) == 0) {
																__eflags =  *(_t624 + 0xd0);
																if( *(_t624 + 0xd0) == 0) {
																	__eflags =  *(_t624 + 0xcc);
																	if( *(_t624 + 0xcc) == 0) {
																		__eflags =  *(_t624 + 0xd4);
																		if( *(_t624 + 0xd4) == 0) {
																			__eflags =  *(_t624 + 0xd8);
																			if( *(_t624 + 0xd8) == 0) {
																				 *0x4af18c( *(_t624 + 0x180));
																				 *(_t624 + 0x180) = 0;
																			}
																		}
																	}
																}
															}
															_t630 =  *0x4affdc(0x4b65e8, 1, 0, 0x4b864c, _t614);
															__eflags = _t630;
															if(_t630 >= 0) {
																_t414 =  *_t614;
																__eflags = _t414;
																if(_t414 != 0) {
																	_t630 =  *((intOrPtr*)(_t414->i + 0x14))(_t414,  &_v1412);
																	__eflags = _t630;
																	if(_t630 >= 0) {
																		__eflags = _v1412;
																		if(_v1412 == 0) {
																			_t416 =  *_t614;
																			 *((intOrPtr*)(_t416->i + 8))(_t416);
																			 *_t614 = 0;
																		}
																	}
																}
															}
														}
													}
													_t513 =  &_v1400;
													_v136 = 0x13;
													 *0x4afb9c();
													goto L82;
												}
												__eflags =  *(_t624 + 0xcc);
												if( *(_t624 + 0xcc) != 0) {
													goto L66;
												}
												__eflags =  *(_t624 + 0xd0);
												if( *(_t624 + 0xd0) != 0) {
													goto L66;
												}
												__eflags =  *(_t624 + 0xd4);
												if( *(_t624 + 0xd4) != 0) {
													goto L66;
												}
												__eflags =  *(_t624 + 0xd8);
												if(__eflags != 0) {
													goto L66;
												}
												_t550 =  *0x4b65e8; // 0xdec2dec4
												_t598 =  *0x4b65ec; // 0x11cf5a20
												_t638 = _t638 - 0x10;
												_t419 = _t638;
												 *_t419 = _t550;
												_t551 =  *0x4b65f0; // 0x800061be
												 *((intOrPtr*)(_t419 + 4)) = _t598;
												_t599 =  *0x4b65f4; // 0x2ddd2ec7
												 *((intOrPtr*)(_t419 + 8)) = _t551;
												_t513 = _t624;
												 *((intOrPtr*)(_t419 + 0xc)) = _t599;
												__eflags = E00456390(_t624, 0, __eflags);
												if(__eflags != 0) {
													goto L66;
												}
												_t552 =  *0x4b65e8; // 0xdec2dec4
												_t600 =  *0x4b65ec; // 0x11cf5a20
												_t638 = _t638 - 0x10;
												_t421 = _t638;
												 *_t421 = _t552;
												_t553 =  *0x4b65f0; // 0x800061be
												 *((intOrPtr*)(_t421 + 4)) = _t600;
												_t601 =  *0x4b65f4; // 0x2ddd2ec7
												 *((intOrPtr*)(_t421 + 8)) = _t553;
												_t513 = _t624;
												 *((intOrPtr*)(_t421 + 0xc)) = _t601;
												_t422 = E00456390(_t624, 0, __eflags);
												__eflags = _t422;
												if(_t422 != 0) {
													goto L66;
												}
												_t630 =  *0x4affdc(0x4b65e8, 1, 0, 0x4b864c, _t614);
												__eflags = _t630;
												if(_t630 < 0) {
													goto L68;
												}
												_t424 =  *_t614;
												__eflags = _t424;
												if(_t424 == 0) {
													goto L67;
												}
												_t513 = _t424->i;
												_t630 =  *((intOrPtr*)(_t424->i + 0x14))(_t424,  &_v1400);
												__eflags = _t630;
												if(_t630 < 0) {
													goto L68;
												}
												__eflags = _v1400;
												if(_v1400 != 0) {
													goto L67;
												}
												_t426 =  *_t614;
												_t513 = _t426->i;
												 *((intOrPtr*)(_t426->i + 8))(_t426);
												goto L66;
											}
										} else {
											_push(0xffffffff);
											_push(0);
											_push(0x64);
											L00474C70();
											goto L152;
										}
									} else {
										 *0x4afb9c();
										L004749D6();
										L151:
										 *0x4afb9c();
										goto L152;
									}
								}
							}
							__eflags = _t609 - 4;
							if(_t609 == 4) {
								goto L30;
							}
							__eflags = _t609 - 8;
							if(_t609 == 8) {
								goto L30;
							}
							__eflags = _t609;
							if(_t609 != 0) {
								__eflags = _t609 - 2;
								if(_t609 == 2) {
									 *0x4af2bc(0x77);
									 *(_t624 + 0xc4) = 1;
								}
								goto L42;
							}
							__eflags =  *(_t624 + 0xc4);
							if( *(_t624 + 0xc4) == 0) {
								L21:
								__eflags =  *(_t624 + 0xd0);
								if( *(_t624 + 0xd0) != 0) {
									L27:
									_t436 = E00450810( &_v1320);
									_v56 = 9;
									_t437 = E00450830( &_v1292);
									_v56 = 0xa;
									_t438 = E00402410( &_v1292,  &_v1304, _t437);
									_v56 = 0xb;
									_t440 = E00402380( &_v1292,  &_v1316, _t438);
									_t637 = _t637 + 0x20;
									_v56 = 0xc;
									 *0x4afb64(_t440, _t436, 0x4b1fec);
									 *0x4afb9c();
									 *0x4afb9c();
									 *0x4afb9c();
									goto L40;
								}
								__eflags =  *(_t624 + 0xc8);
								if( *(_t624 + 0xc8) != 0) {
									goto L27;
								}
								__eflags =  *(_t624 + 0xcc);
								if( *(_t624 + 0xcc) != 0) {
									goto L27;
								}
								__eflags =  *(_t624 + 0xd4);
								if( *(_t624 + 0xd4) != 0) {
									goto L27;
								}
								__eflags =  *(_t624 + 0xd8);
								if( *(_t624 + 0xd8) != 0) {
									goto L27;
								} else {
									_t445 = E00450830( &_v1316);
									_v56 = 0xd;
									_t447 = E00450810( &_v1320);
									_v56 = 0xe;
									_t448 = E00402410( &_v1292,  &_v1292, _t447);
									_v56 = 0xf;
									_t449 = E00402380( &_v1292,  &_v1304, _t448);
									_t637 = _t637 + 0x20;
									_v56 = 0x10;
									 *0x4afb64(_t449, _t445, 0x4b1fec);
									 *0x4afb9c();
									 *0x4afb9c();
									 *0x4afb9c();
									goto L41;
								}
							}
							__eflags =  *(_t624 + 0xd0);
							if( *(_t624 + 0xd0) != 0) {
								goto L27;
							}
							__eflags =  *(_t624 + 0xcc);
							if( *(_t624 + 0xcc) != 0) {
								goto L21;
							}
							__eflags =  *(_t624 + 0xc8);
							if( *(_t624 + 0xc8) != 0) {
								goto L21;
							}
							__eflags =  *(_t624 + 0xd4);
							if( *(_t624 + 0xd4) != 0) {
								goto L21;
							}
							__eflags =  *(_t624 + 0xd8);
							if( *(_t624 + 0xd8) != 0) {
								goto L21;
							} else {
								 *0x4af2bc(0xf031);
								goto L42;
							}
						} else {
							_push(0);
							_push(0);
							_push(0xa4);
							L00474C70();
							goto L152;
						}
					} else {
						_push(0);
						_push(0);
						_push(0xa7);
						L00474C70();
						L152:
						 *0x4afb9c();
						goto L153;
					}
				} else {
					_push(0);
					_push(0);
					_push(0xa6);
					L00474C70();
					L153:
					_t346 = 0;
					L154:
					 *[fs:0x0] = _v136;
					return L00475E7E(_t346, _v140);
				}
			}







































































































































































0x00457fb0
0x00457fb0
0x00457fb2
0x00457fbd
0x00457fbe
0x00457fc5
0x00457fcb
0x00457fdb
0x00457fdf
0x00457fe6
0x00457ff0
0x00457ff8
0x00457ffe
0x00458029
0x0045802f
0x00458035
0x0045803b
0x0045804d
0x00458060
0x00458072
0x00458083
0x00458099
0x004580a1
0x004580ab
0x004580b5
0x004580c0
0x004580d4
0x004580ea
0x00458101
0x00458116
0x00458127
0x00458132
0x0045813f
0x00458147
0x0045814c
0x00458156
0x0045815e
0x00458168
0x00458172
0x0045817c
0x00458187
0x0045818d
0x0045818f
0x00458191
0x00458197
0x004581aa
0x004581af
0x004581b9
0x004581c4
0x004581ce
0x004581dc
0x004581dc
0x00458197
0x004581ed
0x004581f3
0x004581f9
0x004581ff
0x00458205
0x0045820b
0x00458211
0x0045823a
0x0045823f
0x0045824a
0x00458255
0x00458257
0x0045825a
0x0045825d
0x00458270
0x00458273
0x00458286
0x00458289
0x00458453
0x00458457
0x0045845d
0x00458462
0x00458469
0x00458472
0x00458475
0x0045847b
0x0045847e
0x00000000
0x00458480
0x00458480
0x00000000
0x00458480
0x00458477
0x00458477
0x00000000
0x00458477
0x0045846b
0x0045846b
0x00458482
0x00458486
0x0045848c
0x0045848d
0x00458491
0x0045849d
0x004584a2
0x004584aa
0x004584b4
0x004584bd
0x004584c2
0x004584cc
0x004584d3
0x004584ed
0x004584f7
0x004584fc
0x00458500
0x00458500
0x00458508
0x0045850e
0x00458510
0x0045851a
0x0045851f
0x00458522
0x00458527
0x00458529
0x0045853a
0x0045853b
0x00458543
0x00458547
0x0045854c
0x00458551
0x00458556
0x00458558
0x0045855b
0x0045855f
0x00458561
0x00458569
0x0045858b
0x0045858b
0x0045856b
0x00458570
0x00458576
0x00458577
0x0045857c
0x0045857d
0x00458584
0x00458584
0x0045858d
0x00458590
0x00458598
0x0045859e
0x004585a3
0x004585a8
0x004585ad
0x004585af
0x004585b2
0x004585b6
0x004585b8
0x004585c0
0x004585e2
0x004585e2
0x004585c2
0x004585c7
0x004585cd
0x004585ce
0x004585d3
0x004585d4
0x004585db
0x004585db
0x004585e8
0x004585f0
0x004585f6
0x00458604
0x0045861e
0x00458632
0x00458637
0x00458640
0x00458654
0x00458663
0x0045867c
0x00458691
0x00458699
0x004586a3
0x004586ad
0x004586b5
0x004586c0
0x004586c6
0x004586cb
0x004586ce
0x004586d3
0x004586d6
0x004586da
0x004586dc
0x004586e4
0x004586ef
0x004586ef
0x004586e6
0x004586e8
0x004586e8
0x004586f8
0x00458707
0x0045870f
0x00458715
0x00458717
0x00458e01
0x00000000
0x0045871d
0x0045871d
0x00458723
0x00458725
0x00458728
0x00458735
0x00458737
0x00458739
0x0045873f
0x00458746
0x00458748
0x00458823
0x00458823
0x00458825
0x00458825
0x00458827
0x00458907
0x00458907
0x00458909
0x00458dbe
0x00458dbe
0x00458dc4
0x00458def
0x00458def
0x00458df0
0x00458df1
0x00458df6
0x00458df6
0x00458dfb
0x00000000
0x00458dfb
0x00458dc6
0x00458dcc
0x00000000
0x00000000
0x00458dce
0x00458dd4
0x00000000
0x00000000
0x00458dd6
0x00458ddc
0x00000000
0x00000000
0x00458dde
0x00458de4
0x00000000
0x00000000
0x00458de6
0x00458de7
0x00458de8
0x00000000
0x00458de8
0x0045890f
0x00458911
0x00458913
0x00000000
0x00000000
0x0045891e
0x00458927
0x0045892d
0x0045892f
0x00458931
0x00458933
0x004589d1
0x004589d1
0x004589d3
0x004589d3
0x004589d5
0x00458ab5
0x00458ab5
0x00458ab7
0x00458db5
0x00458db5
0x00458db6
0x00458db7
0x00000000
0x00458db7
0x00458abd
0x00458abf
0x00458ac1
0x00000000
0x00000000
0x00458acc
0x00458acf
0x00458ad2
0x00458ad4
0x00458ada
0x00458adf
0x00458ae2
0x00458ae6
0x00458ae8
0x00458af0
0x00458afb
0x00458afb
0x00458af2
0x00458af4
0x00458af4
0x00458afe
0x00458b06
0x00458b0c
0x00458b12
0x00458b19
0x00458b22
0x00458b25
0x00458b2d
0x00458b31
0x00458b36
0x00458b3a
0x00458d89
0x00458d8d
0x00458d95
0x00458d9e
0x00458da8
0x00458dae
0x00000000
0x00458b40
0x00458b40
0x00458b44
0x00000000
0x00000000
0x00458b4e
0x00458b51
0x00458b56
0x00458b58
0x00458b7b
0x00458b98
0x00458b9a
0x00458b9c
0x00458b9f
0x00458ba9
0x00458baf
0x00458baf
0x00458bbf
0x00458bc7
0x00458bcc
0x00458bd2
0x00458bdb
0x00458be6
0x00458beb
0x00458bed
0x00458bf4
0x00458bfb
0x00458c02
0x00458c09
0x00458c10
0x00458c17
0x00458c1e
0x00458c2a
0x00458c32
0x00458c74
0x00458c7a
0x00458c92
0x00458c9a
0x00458ca4
0x00458cac
0x00458cac
0x00458cb2
0x00458cb4
0x00458cb9
0x00458cbc
0x00458cc0
0x00458cc2
0x00458cca
0x00458cd5
0x00458cd5
0x00458ccc
0x00458cce
0x00458cce
0x00458cd7
0x00458cd9
0x00458ce1
0x00458ce7
0x00458d00
0x00458d00
0x00000000
0x00458ce9
0x00458ce9
0x00458cef
0x00000000
0x00000000
0x00458cf8
0x00458d06
0x00458d06
0x00458d0c
0x00458d0e
0x00458d14
0x00458d16
0x00458d1c
0x00458d1e
0x00458d24
0x00458d26
0x00458d2c
0x00458d30
0x00458d30
0x00458d2c
0x00458d24
0x00458d1c
0x00458d14
0x00458d35
0x00458d3b
0x00458d42
0x00458d4a
0x00458d4f
0x00458d57
0x00458d5c
0x00458d63
0x00458d6c
0x00458d75
0x00458d7d
0x00458d7d
0x00458d84
0x00000000
0x00458d84
0x00458ce7
0x00458b5e
0x00458b66
0x00000000
0x00458b66
0x00458b3a
0x004589db
0x004589ec
0x004589f1
0x004589f9
0x00458a01
0x00458a07
0x00458a09
0x00458a0f
0x00458aa3
0x00458aa7
0x00458aaf
0x00000000
0x00458aaf
0x00458a1b
0x00458a21
0x00458a23
0x00000000
0x00000000
0x00458a25
0x00458a27
0x00458a2d
0x00458a4f
0x00458a56
0x00458a5c
0x00458a62
0x00458a76
0x00458a78
0x00458a7a
0x00458a7c
0x00458a7e
0x00458a80
0x00458a8d
0x00458a8f
0x00458a91
0x00458a93
0x00458a97
0x00458a99
0x00458a9e
0x00458aa1
0x00458aa1
0x00458a97
0x00458a91
0x00458a80
0x00000000
0x00458a7a
0x00458a2f
0x00458a35
0x00000000
0x00000000
0x00458a37
0x00458a3d
0x00000000
0x00000000
0x00458a3f
0x00458a45
0x00000000
0x00000000
0x00458a47
0x00458a4d
0x00000000
0x00000000
0x00000000
0x00458a4d
0x00458939
0x0045893f
0x00000000
0x00000000
0x00458945
0x0045894b
0x00000000
0x00000000
0x00458951
0x00458957
0x00000000
0x00000000
0x00458959
0x0045895f
0x00000000
0x00000000
0x00458961
0x00458967
0x0045896c
0x0045896f
0x00458971
0x00458973
0x00458979
0x0045897c
0x00458981
0x00458984
0x00458987
0x00458989
0x0045898e
0x00458990
0x00000000
0x00000000
0x004589a6
0x004589a8
0x004589aa
0x00000000
0x00000000
0x004589ac
0x004589ae
0x004589b0
0x00000000
0x00000000
0x004589b2
0x004589bd
0x004589bf
0x004589c1
0x00000000
0x00000000
0x004589c3
0x004589c7
0x00000000
0x00000000
0x004589c9
0x004589cb
0x004589ce
0x00000000
0x004589ce
0x0045882d
0x0045883e
0x00458843
0x0045884b
0x00458853
0x00458859
0x0045885b
0x00458861
0x0045886d
0x00458873
0x00458875
0x00458877
0x00458879
0x0045887f
0x00458881
0x00458887
0x00458889
0x0045888f
0x00458891
0x00458897
0x00458899
0x0045889f
0x004588a8
0x004588ae
0x004588ae
0x0045889f
0x00458897
0x0045888f
0x00458887
0x004588c8
0x004588ca
0x004588cc
0x004588ce
0x004588d0
0x004588d2
0x004588df
0x004588e1
0x004588e3
0x004588e5
0x004588e9
0x004588eb
0x004588f0
0x004588f3
0x004588f3
0x004588e9
0x004588e3
0x004588d2
0x004588cc
0x00458875
0x004588f5
0x004588f9
0x00458901
0x00000000
0x00458901
0x0045874e
0x00458754
0x00000000
0x00000000
0x0045875a
0x00458760
0x00000000
0x00000000
0x00458766
0x0045876c
0x00000000
0x00000000
0x00458772
0x00458778
0x00000000
0x00000000
0x0045877e
0x00458784
0x0045878a
0x0045878d
0x0045878f
0x00458791
0x00458797
0x0045879a
0x004587a0
0x004587a3
0x004587a5
0x004587ad
0x004587af
0x00000000
0x00000000
0x004587b1
0x004587b7
0x004587bd
0x004587c0
0x004587c2
0x004587c4
0x004587ca
0x004587cd
0x004587d3
0x004587d6
0x004587d8
0x004587db
0x004587e0
0x004587e2
0x00000000
0x00000000
0x004587f8
0x004587fa
0x004587fc
0x00000000
0x00000000
0x004587fe
0x00458800
0x00458802
0x00000000
0x00000000
0x00458804
0x0045880f
0x00458811
0x00458813
0x00000000
0x00000000
0x00458815
0x00458819
0x00000000
0x00000000
0x0045881b
0x0045881d
0x00458820
0x00000000
0x00458820
0x0045852b
0x0045852b
0x0045852d
0x0045852e
0x00458530
0x00000000
0x00458530
0x004584d5
0x004584d5
0x004584df
0x00458e05
0x00458e05
0x00000000
0x00458e05
0x004584d3
0x00458469
0x0045828f
0x00458292
0x00000000
0x00000000
0x00458298
0x0045829b
0x00000000
0x00000000
0x004582a1
0x004582a3
0x00458431
0x00458434
0x0045843e
0x00458444
0x00458444
0x00000000
0x00458434
0x004582a9
0x004582af
0x004582ef
0x004582ef
0x004582f5
0x004583b0
0x004583b5
0x004583c1
0x004583c9
0x004583d9
0x004583e1
0x004583ed
0x004583f5
0x004583fa
0x00458400
0x00458408
0x00458412
0x0045841c
0x00458426
0x00000000
0x00458426
0x004582fb
0x00458301
0x00000000
0x00000000
0x00458307
0x0045830d
0x00000000
0x00000000
0x00458313
0x00458319
0x00000000
0x00000000
0x0045831f
0x00458325
0x00000000
0x0045832b
0x00458330
0x0045833c
0x00458344
0x00458354
0x0045835c
0x00458368
0x00458370
0x00458375
0x0045837b
0x00458383
0x0045838d
0x00458397
0x004583a1
0x00000000
0x004583a7
0x00458325
0x004582b1
0x004582b7
0x00000000
0x00000000
0x004582bd
0x004582c3
0x00000000
0x00000000
0x004582c5
0x004582cb
0x00000000
0x00000000
0x004582cd
0x004582d3
0x00000000
0x00000000
0x004582d5
0x004582db
0x00000000
0x004582dd
0x004582e4
0x00000000
0x004582e4
0x00458275
0x00458275
0x00458276
0x00458277
0x0045827c
0x00000000
0x0045827c
0x0045825f
0x0045825f
0x00458260
0x00458261
0x00458266
0x00458e0b
0x00458e0f
0x00000000
0x00458e0f
0x0045800d
0x0045800d
0x0045800f
0x00458011
0x00458016
0x00458e15
0x00458e15
0x00458e17
0x00458e1e
0x00458e3b
0x00458e3b

APIs
  • CreateMutexA.KERNELBASE(00000000,00000001,ShowCase), ref: 00457FF0
  • GetLastError.KERNEL32 ref: 00458000
Strings
Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID: CreateErrorLastMutex
  • String ID: %02d%02d.%02d%02d%02d$CDViewerHelp.chm$DicomImage.ocx$DicomInfo.ocx$DllRegisterServer$MDIClient$MainDictionary$ShowCase
  • API String ID: 1925916568-3363622651
  • Opcode ID: 1afce300de9f9b51dce8274934a02e2e377da3ca6dfe5cdf37941090087796c4
  • Instruction ID: 047af35ba6d8f5df630135383290a6915663bc39eda70135cade3f3f17ac0446
  • Opcode Fuzzy Hash: 1afce300de9f9b51dce8274934a02e2e377da3ca6dfe5cdf37941090087796c4
  • Instruction Fuzzy Hash: 89829671504741DFC720EF64D884BABBBE4BB95305F00493FF58A92292EF786548CB6A
Uniqueness

Uniqueness Score: -1.00%

Control-flow Graph

  • Executed
  • Not Executed
control_flow_graph 372 4242c0-42434c call 4748c2 375 424354-42435a 372->375 376 42434e 372->376 377 424362-424368 375->377 378 42435c 375->378 376->375 379 424370-424376 377->379 380 42436a 377->380 378->377 381 424378 379->381 382 42437e-424384 379->382 380->379 381->382 383 424386 382->383 384 42438c-424392 382->384 383->384 385 424394 384->385 386 42439a-4243a8 384->386 385->386 387 4243ca 386->387 388 4243aa-4243b0 386->388 390 4243d2-424434 GetDriveTypeA 387->390 388->387 389 4243b2-4243b8 388->389 389->387 391 4243ba-4243c0 389->391 395 42443a-42443c 390->395 396 424509-42450c 390->396 391->387 392 4243c2-4243c8 391->392 392->387 392->390 395->396 399 424442-424444 395->399 397 424512-424524 396->397 398 42446a-42446c 396->398 410 4247d0-4247f4 call 475e7e 397->410 400 42448a-4244fe call 402410 StgOpenStorage 398->400 401 42446e-424470 398->401 399->396 402 42444a-42444c 399->402 421 424500-424505 call 423760 400->421 422 424529-42452f 400->422 401->400 403 424472-424474 401->403 402->396 406 424452-42445a 402->406 403->400 409 424476-424478 403->409 407 424460-424464 406->407 408 424507 406->408 407->400 412 424466 407->412 408->396 409->400 413 42447a-42447c 409->413 412->398 413->400 415 42447e-424484 413->415 415->400 418 4247bf-4247cc 415->418 418->410 430 424546-424548 421->430 424 424531-424533 422->424 425 42458c-42458e 422->425 427 424594-42459a 424->427 428 424535-42453b 424->428 425->427 429 4246f9-4246ff 425->429 432 4245a0-4245a6 427->432 433 4246e9 427->433 428->425 431 42453d-424543 call 422000 428->431 434 4247b5 429->434 435 424705-42470b 429->435 430->425 439 42454a-424550 430->439 431->430 432->433 438 4245ac-4245b2 432->438 437 4246f1-4246f3 433->437 434->418 440 424736-424749 call 423900 435->440 441 42470d-424713 435->441 437->429 444 4247a7-4247ad 437->444 438->433 445 4245b8-4245be 438->445 446 424552-424558 439->446 447 42455c-424582 439->447 440->444 457 42474b-424751 440->457 441->440 448 424715-42471b 441->448 444->434 450 4247af-4247b1 444->450 445->433 452 4245c4-4245ca 445->452 446->447 447->427 472 424584-42458a GetLastError 447->472 448->440 449 42471d-424723 448->449 449->440 455 424725-42472b 449->455 450->434 452->433 453 4245d0-4245e2 call 423650 452->453 465 4245f1-42460e 453->465 466 4245e4-4245ec 453->466 455->440 459 42472d-424733 call 422f80 455->459 457->444 460 424753-424759 457->460 459->440 460->444 464 42475b-424761 460->464 464->444 468 424763-424769 464->468 474 4246e3-4246e7 465->474 475 424614-424618 465->475 466->437 468->444 470 42476b-424771 468->470 470->444 473 424773-424787 470->473 472->427 478 424789-42479d 473->478 479 42479f 473->479 474->437 475->474 476 42461e-4246e1 call 4214d0 475->476 476->437 478->444 478->479 479->444
C-Code - Quality: 18%
			E004242C0(void* _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr* _a20) {
				char _v0;
				char _v4;
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr _v40;
				intOrPtr _v44;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v540;
				char _v564;
				char _v799;
				char _v800;
				char _v803;
				char _v807;
				char _v808;
				char _v812;
				char _v844;
				intOrPtr _v848;
				char _v852;
				intOrPtr _v864;
				intOrPtr _v868;
				char _v872;
				char _v876;
				intOrPtr _v880;
				intOrPtr _v892;
				intOrPtr _v896;
				intOrPtr _v920;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t76;
				intOrPtr _t78;
				intOrPtr _t79;
				int _t83;
				char _t91;
				char _t94;
				intOrPtr _t97;
				intOrPtr* _t98;
				void* _t103;
				char _t114;
				void* _t115;
				intOrPtr* _t116;
				intOrPtr _t118;
				char _t124;
				intOrPtr _t126;
				intOrPtr _t131;
				intOrPtr _t139;
				char* _t142;
				intOrPtr _t154;
				intOrPtr _t158;
				intOrPtr _t162;
				void* _t163;
				intOrPtr _t169;
				intOrPtr _t171;
				void* _t172;
				char _t173;
				void* _t181;
				void* _t182;
				void* _t183;
				void* _t184;
				void* _t185;
				void* _t197;
				void* _t202;
				void* _t203;
				void* _t204;
				void* _t205;
				void* _t206;
				void* _t210;
				void* _t211;
				void* _t212;
				void* _t213;
				void* _t214;
				void* _t216;
				void* _t217;
				void* _t218;
				void* _t219;
				void* _t220;

				_push(0xffffffff);
				_push(0x4a7dfd);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t171;
				_t172 = _t171 - 0x344;
				_t76 =  *0x4d0070; // 0x4961b978
				_v16 = _t76;
				_t124 = 0;
				 *0x4f22f4 = _a12;
				_t78 = _a16;
				 *0x4f2304 = 0;
				 *0x4f2310 = 0;
				 *0x4f22f8 = 0;
				 *0x4f22f0 = 0;
				 *0x4f22fc = 0;
				 *0x4f230c = 0;
				 *0x4f22ec = _t78;
				_v4 = 0;
				 *_a20 = _t78;
				L004748C2();
				_t79 =  *((intOrPtr*)(_t78 + 4));
				if( *((intOrPtr*)(_t79 + 0xc4)) != 0) {
					 *0x4f2304 = 1;
				}
				if( *((intOrPtr*)(_t79 + 0xc8)) != _t124) {
					 *0x4f2310 = 1;
				}
				if( *((intOrPtr*)(_t79 + 0xcc)) != _t124) {
					 *0x4f22fc = 1;
				}
				if( *((intOrPtr*)(_t79 + 0xd0)) != _t124) {
					 *0x4f22f8 = 1;
				}
				if( *((intOrPtr*)(_t79 + 0xd4)) != _t124) {
					 *0x4f22f0 = 1;
				}
				if( *((intOrPtr*)(_t79 + 0xd8)) != _t124) {
					 *0x4f230c = 1;
				}
				_t181 =  *0x4f2310 - _t124; // 0x0
				_v844 = 4;
				if(_t181 != 0) {
					L17:
					_v844 = 6;
					goto L18;
				} else {
					_t182 =  *0x4f22f8 - _t124; // 0x1
					if(_t182 != 0) {
						goto L17;
					}
					_t183 =  *0x4f22f0 - _t124; // 0x0
					if(_t183 != 0) {
						goto L17;
					}
					_t184 =  *0x4f22fc - _t124; // 0x0
					if(_t184 != 0) {
						goto L17;
					}
					_t185 =  *0x4f230c - _t124; // 0x0
					if(_t185 == 0) {
						L18:
						_v807 = 0;
						_v803 = 0;
						_v808 = _t124;
						_v799 = 0;
						 *0x4afd54( &_v808, "?:\");
						_t173 = _t172 + 8;
						_v812 =  *0x4afb80(_t124);
						_t83 = GetDriveTypeA( &_v812);
						_t131 =  *0x4f2310; // 0x0
						_t154 =  *0x4f2304; // 0x1
						_t166 =  *0x4f22f8; // 0x1
						_t162 =  *0x4f22f0; // 0x0
						_t169 =  *0x4f22fc; // 0x0
						if(_t131 != _t124 || _t169 != _t124 || _t166 != _t124 || _t162 != _t124) {
							L34:
							__eflags = _t83 - 5;
							if(_t83 == 5) {
								goto L25;
							}
							 *0x4afb9c();
							_t94 = 5;
							goto L79;
						} else {
							_t126 =  *0x4f230c; // 0x0
							if(_t126 != 0) {
								_t124 = 0;
								__eflags = 0;
								goto L34;
							}
							_t124 = 0;
							if(_t154 == 0) {
								L31:
								E00402410(_t131,  &_v844,  &_v0);
								_v8 = 1;
								 *0x4afd68( &_v800, _v844, 0x104, "TLF");
								_t133 =  &_v540;
								 *0x4afd64( &_v540,  &_v800, 0x104);
								_t173 = _t173 + 0x24;
								_v852 = _t124;
								_t163 =  *0x4affd8( &_v540, _t124, 0x10, _t124, _t124,  &_v852);
								if(_v12 == _t124) {
									__eflags =  *0x4f2304 - _t124; // 0x1
									if(__eflags != 0) {
										L45:
										__eflags = _t163 - _t124;
										if(_t163 >= _t124) {
											L59:
											_t91 = _v876;
											if(_t91 == _t124) {
												L77:
												 *0x4afb9c();
												L78:
												 *0x4afb9c();
												_t94 = _v872;
												L79:
												 *[fs:0x0] = _v40;
												return L00475E7E(_t94, _v44);
											}
											_t210 =  *0x4f2310 - _t124; // 0x0
											if(_t210 == 0) {
												_t211 =  *0x4f22fc - _t124; // 0x0
												if(_t211 == 0) {
													_t212 =  *0x4f22f8 - _t124; // 0x1
													if(_t212 == 0) {
														_t213 =  *0x4f22f0 - _t124; // 0x0
														if(_t213 == 0) {
															_t214 =  *0x4f230c - _t124; // 0x0
															if(_t214 == 0) {
																_push(_t91);
																L00422F80(_t124, _t163, _t166);
																_t173 = _t173 + 4;
															}
														}
													}
												}
											}
											_t97 = L00423900(_v876);
											_t173 = _t173 + 4;
											_v872 = _t97;
											if(_t97 != _t124) {
												L75:
												_t98 = _v876;
												if(_t98 != _t124) {
													 *((intOrPtr*)( *_t98 + 8))(_t98);
												}
												goto L77;
											} else {
												_t216 =  *0x4f2310 - _t124; // 0x0
												if(_t216 != 0) {
													goto L75;
												}
												_t217 =  *0x4f22fc - _t124; // 0x0
												if(_t217 != 0) {
													goto L75;
												}
												_t218 =  *0x4f22f8 - _t124; // 0x1
												if(_t218 != 0) {
													goto L75;
												}
												_t219 =  *0x4f22f0 - _t124; // 0x0
												if(_t219 != 0) {
													goto L75;
												}
												_t220 =  *0x4f230c - _t124; // 0x0
												if(_t220 != 0) {
													goto L75;
												}
												_t139 =  *0x4f2324; // 0x7c220078
												_push(_t139);
												if( *0x4af4ac() != 0) {
													L74:
													_v876 = 4;
													goto L75;
												}
												_t158 =  *0x4f232c; // 0x7c220078
												_push(_t158);
												if( *0x4af4ac() == 0) {
													goto L75;
												}
												goto L74;
											}
										}
										L46:
										_t202 =  *0x4f2310 - _t124; // 0x0
										if(_t202 != 0) {
											L57:
											_v872 = 6;
											L58:
											if(_t163 < _t124) {
												goto L75;
											}
											goto L59;
										}
										_t203 =  *0x4f22f8 - _t124; // 0x1
										if(_t203 != 0) {
											goto L57;
										}
										_t204 =  *0x4f22f0 - _t124; // 0x0
										if(_t204 != 0) {
											goto L57;
										}
										_t205 =  *0x4f22fc - _t124; // 0x0
										if(_t205 != 0) {
											goto L57;
										}
										_t206 =  *0x4f230c - _t124; // 0x0
										if(_t206 != 0) {
											goto L57;
										}
										_t103 = L00423650(_t133, _v20, _v20);
										_t173 = _t173 + 4;
										if(_t103 == 0) {
											_t142 =  &_v564;
											_t163 =  *0x4affe4(_t142, 0x1012, _t124,  &_v876);
											__eflags = _t163 - _t124;
											if(_t163 < _t124) {
												L56:
												_v892 = _t124;
												goto L58;
											}
											__eflags = _v892 - _t124;
											if(_v892 == _t124) {
												goto L56;
											}
											_v864 = _t173;
											 *0x4afb90("2.0", _t142);
											_v876 = _t173;
											_v52 = 2;
											 *0x4afb90("2.0", _t173);
											_v868 = _t173;
											_v56 = 3;
											 *0x4afba4(0x4f232c, _t173);
											_v892 = _t173;
											_v60 = 4;
											 *0x4afb90(0x4b0384, _t173);
											_v872 = _t173;
											_v64 = 5;
											 *0x4afb90(0x4b0384, _t173);
											_v896 = _t173;
											_v68 = 6;
											 *0x4afb90(0x4b0384, _t173);
											_v892 = _t173;
											_v72 = 7;
											 *0x4afb90(0x4b0384, _t173);
											_push(_v920);
											_v76 = 1;
											L004214D0(_t124, _t163, _t166);
											_t173 = _t173 + 0x20;
											goto L58;
										}
										_v872 = 3;
										goto L58;
									}
									__eflags = _t163 - _t124;
									if(_t163 < _t124) {
										goto L46;
									}
									_t114 = _v876;
									__eflags = _t114 - _t124;
									if(_t114 == _t124) {
										goto L45;
									}
									_push(_t114);
									_t115 = E00422000(_t163, _t166);
									_t173 = _t173 + 4;
									L40:
									if(_t115 == _t124) {
										goto L45;
									}
									_t116 = _v876;
									if(_t116 != _t124) {
										 *((intOrPtr*)( *_t116 + 8))(_t116);
										_v880 = _t124;
									}
									_t118 =  *0x4af204( *0x4afb94(0x80));
									_t133 =  &_v876;
									_t166 = _t118;
									 *0x4afb98(0xffffffff);
									if(_t118 == _t124) {
										GetLastError();
									}
									goto L46;
								}
								_t115 = L00423760();
								goto L40;
							}
							_v848 = 0;
							L25:
							if(_t154 != _t124 && _t131 == _t124 && _t166 == _t124 && _t162 == _t124 && _t169 == _t124) {
								_t197 =  *0x4f230c - _t124; // 0x0
								if(_t197 == 0) {
									goto L78;
								}
							}
							goto L31;
						}
					}
					goto L17;
				}
			}

























































































0x004242c0
0x004242c2
0x004242cd
0x004242ce
0x004242d5
0x004242db
0x004242e3
0x004242f9
0x004242fb
0x00424300
0x00424307
0x0042430d
0x00424313
0x00424319
0x0042431f
0x00424325
0x0042432b
0x00424330
0x00424337
0x00424339
0x0042433e
0x0042434c
0x0042434e
0x0042434e
0x0042435a
0x0042435c
0x0042435c
0x00424368
0x0042436a
0x0042436a
0x00424376
0x00424378
0x00424378
0x00424384
0x00424386
0x00424386
0x00424392
0x00424394
0x00424394
0x0042439a
0x004243a0
0x004243a8
0x004243ca
0x004243ca
0x00000000
0x004243aa
0x004243aa
0x004243b0
0x00000000
0x00000000
0x004243b2
0x004243b8
0x00000000
0x00000000
0x004243ba
0x004243c0
0x00000000
0x00000000
0x004243c2
0x004243c8
0x004243d2
0x004243d4
0x004243dc
0x004243e6
0x004243ea
0x004243ee
0x004243f4
0x0042440a
0x0042440e
0x00424414
0x0042441c
0x00424422
0x00424428
0x0042442e
0x00424434
0x00424509
0x00424509
0x0042450c
0x00000000
0x00000000
0x00424519
0x0042451f
0x00000000
0x00424452
0x00424452
0x0042445a
0x00424507
0x00424507
0x00000000
0x00424507
0x00424460
0x00424464
0x0042448a
0x0042449c
0x004244b0
0x004244b8
0x004244c8
0x004244d0
0x004244d6
0x004244eb
0x004244f5
0x004244fe
0x00424529
0x0042452f
0x0042458c
0x0042458c
0x0042458e
0x004246f9
0x004246f9
0x004246ff
0x004247b5
0x004247b9
0x004247bf
0x004247c6
0x004247cc
0x004247d0
0x004247d7
0x004247f4
0x004247f4
0x00424705
0x0042470b
0x0042470d
0x00424713
0x00424715
0x0042471b
0x0042471d
0x00424723
0x00424725
0x0042472b
0x0042472d
0x0042472e
0x00424733
0x00424733
0x0042472b
0x00424723
0x0042471b
0x00424713
0x0042473b
0x00424740
0x00424745
0x00424749
0x004247a7
0x004247a7
0x004247ad
0x004247b2
0x004247b2
0x00000000
0x0042474b
0x0042474b
0x00424751
0x00000000
0x00000000
0x00424753
0x00424759
0x00000000
0x00000000
0x0042475b
0x00424761
0x00000000
0x00000000
0x00424763
0x00424769
0x00000000
0x00000000
0x0042476b
0x00424771
0x00000000
0x00000000
0x00424773
0x00424779
0x00424787
0x0042479f
0x0042479f
0x00000000
0x0042479f
0x00424789
0x0042478f
0x0042479d
0x00000000
0x00000000
0x00000000
0x0042479d
0x00424749
0x00424594
0x00424594
0x0042459a
0x004246e9
0x004246e9
0x004246f1
0x004246f3
0x00000000
0x00000000
0x00000000
0x004246f3
0x004245a0
0x004245a6
0x00000000
0x00000000
0x004245ac
0x004245b2
0x00000000
0x00000000
0x004245b8
0x004245be
0x00000000
0x00000000
0x004245c4
0x004245ca
0x00000000
0x00000000
0x004245d8
0x004245dd
0x004245e2
0x004245fc
0x0042460a
0x0042460c
0x0042460e
0x004246e3
0x004246e3
0x00000000
0x004246e3
0x00424614
0x00424618
0x00000000
0x00000000
0x00424621
0x0042462a
0x00424633
0x0042463c
0x00424644
0x0042464d
0x00424656
0x0042465e
0x00424667
0x00424670
0x00424678
0x00424681
0x0042468a
0x00424692
0x0042469b
0x004246a4
0x004246ac
0x004246b5
0x004246be
0x004246c6
0x004246d0
0x004246d1
0x004246d9
0x004246de
0x00000000
0x004246de
0x004245e4
0x00000000
0x004245e4
0x00424531
0x00424533
0x00000000
0x00000000
0x00424535
0x00424539
0x0042453b
0x00000000
0x00000000
0x0042453d
0x0042453e
0x00424543
0x00424546
0x00424548
0x00000000
0x00000000
0x0042454a
0x00424550
0x00424555
0x00424558
0x00424558
0x0042456c
0x00424574
0x00424578
0x0042457a
0x00424582
0x00424584
0x00424584
0x00000000
0x00424582
0x00424500
0x00000000
0x00424500
0x00424466
0x0042446a
0x0042446c
0x0042447e
0x00424484
0x00000000
0x00000000
0x00424484
0x00000000
0x0042446c
0x00424434
0x00000000
0x004243c8

APIs
  • GetDriveTypeA.KERNELBASE(?), ref: 0042440E
  • StgOpenStorage.OLE32(?,00000000,00000010,00000000,00000000,?,?,?,?,?,?,00000104,?,?,TLF), ref: 004244EF
  • GetLastError.KERNEL32(?,?,?,?,?,?,00000104,?,?,TLF), ref: 00424584
Strings
Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID: DriveErrorLastOpenStorageType
  • String ID: 0#O$2.0$?:\$TLF
  • API String ID: 2993051088-3634085887
  • Opcode ID: 9bbe65629c1b3becda01e35c1c07eeddc555a5048cb4833b1fdfb98c8f1c3a5b
  • Instruction ID: 72ca49c9c554180a4e5ef6ce621737f41d48d6fe2948a761ab857a4830bfca79
  • Opcode Fuzzy Hash: 9bbe65629c1b3becda01e35c1c07eeddc555a5048cb4833b1fdfb98c8f1c3a5b
  • Instruction Fuzzy Hash: E2D1AFB0704352DFCB20DFA4E994A6A7BE4FBC5308F44493FE65582250D7B89948CF5A
Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

C-Code - Quality: 42%
			E0045A040(intOrPtr __ecx, void* __fp0) {
				char _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v25;
				short _v27;
				intOrPtr _v31;
				intOrPtr _v35;
				intOrPtr _v39;
				char _v40;
				char _v41;
				short _v43;
				intOrPtr _v47;
				intOrPtr _v51;
				intOrPtr _v55;
				char _v56;
				char _v57;
				short _v59;
				intOrPtr _v63;
				intOrPtr _v67;
				intOrPtr _v71;
				char _v72;
				char _v73;
				short _v75;
				intOrPtr _v79;
				char _v83;
				char _v84;
				char _v85;
				short _v87;
				intOrPtr _v91;
				intOrPtr _v95;
				intOrPtr _v99;
				intOrPtr _v103;
				intOrPtr _v107;
				intOrPtr _v111;
				intOrPtr _v115;
				char _v116;
				void _v147;
				char _v148;
				char _v149;
				short _v151;
				intOrPtr _v155;
				intOrPtr _v159;
				intOrPtr _v163;
				intOrPtr _v167;
				intOrPtr _v171;
				intOrPtr _v175;
				intOrPtr _v179;
				char _v180;
				void _v211;
				char _v212;
				void _v279;
				char _v280;
				void _v407;
				char _v408;
				void* _v409;
				char _v416;
				char _v420;
				void* _v424;
				void* _v428;
				intOrPtr _v432;
				char _v436;
				void* _v440;
				void* _v444;
				char _v448;
				intOrPtr* _v452;
				char _v456;
				void* _v457;
				intOrPtr _v464;
				char _v468;
				char _v472;
				intOrPtr* _v476;
				intOrPtr* _v480;
				char _v484;
				char _v488;
				void* _v492;
				intOrPtr _v496;
				void* _v500;
				void* _v504;
				void* _v508;
				void* _v512;
				void* _v516;
				void* _v520;
				intOrPtr* _v524;
				char _v528;
				intOrPtr _v532;
				intOrPtr* _v536;
				char _v540;
				void* _v544;
				char _v548;
				char _v552;
				char _v556;
				char _v560;
				void* _v564;
				char _v568;
				void* _v572;
				char _v576;
				char _v580;
				void* _v584;
				char _v588;
				intOrPtr _v592;
				void* _v596;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t566;
				intOrPtr _t573;
				intOrPtr _t574;
				void* _t579;
				void* _t581;
				intOrPtr _t587;
				intOrPtr* _t589;
				intOrPtr* _t590;
				char _t591;
				intOrPtr* _t592;
				intOrPtr* _t593;
				intOrPtr* _t594;
				intOrPtr* _t595;
				intOrPtr* _t603;
				intOrPtr* _t608;
				intOrPtr* _t615;
				intOrPtr* _t618;
				intOrPtr* _t628;
				void* _t631;
				void* _t643;
				intOrPtr* _t652;
				char _t658;
				char _t662;
				char _t666;
				intOrPtr* _t671;
				intOrPtr* _t672;
				void* _t675;
				char _t692;
				intOrPtr _t696;
				intOrPtr _t697;
				intOrPtr* _t718;
				intOrPtr* _t721;
				void* _t727;
				intOrPtr _t751;
				intOrPtr _t758;
				int _t763;
				intOrPtr* _t767;
				void* _t773;
				void* _t774;
				void* _t781;
				void* _t783;
				void* _t790;
				void* _t791;
				void* _t807;
				char _t812;
				int _t815;
				intOrPtr* _t833;
				void* _t848;
				void* _t877;
				void* _t878;
				void* _t879;
				intOrPtr _t890;
				intOrPtr* _t891;
				intOrPtr _t895;
				intOrPtr* _t896;
				intOrPtr* _t899;
				void* _t901;
				intOrPtr* _t904;
				intOrPtr* _t911;
				void* _t913;
				void* _t915;
				void* _t916;
				intOrPtr* _t919;
				intOrPtr* _t921;
				intOrPtr* _t922;
				intOrPtr* _t923;
				intOrPtr* _t924;
				intOrPtr* _t926;
				intOrPtr _t930;
				intOrPtr _t932;
				intOrPtr* _t974;
				intOrPtr _t1103;
				char _t1181;
				intOrPtr* _t1219;
				intOrPtr* _t1251;
				intOrPtr* _t1255;
				intOrPtr _t1291;
				intOrPtr _t1308;
				void* _t1326;
				void* _t1329;
				intOrPtr* _t1331;
				intOrPtr* _t1332;
				intOrPtr* _t1333;
				intOrPtr* _t1334;
				char _t1336;
				intOrPtr* _t1339;
				intOrPtr* _t1342;
				intOrPtr _t1343;
				intOrPtr* _t1349;
				intOrPtr* _t1351;
				void* _t1352;
				void* _t1355;
				void* _t1358;
				intOrPtr _t1359;
				intOrPtr _t1360;
				intOrPtr* _t1361;
				void* _t1362;
				intOrPtr _t1363;
				void* _t1365;
				intOrPtr _t1366;
				intOrPtr _t1368;
				char _t1369;
				void* _t1370;
				void* _t1373;
				void* _t1375;
				void* _t1376;
				void* _t1377;
				void* _t1379;
				void* _t1381;
				void* _t1384;
				void* _t1396;

				_t1396 = __fp0;
				 *[fs:0x0] = _t1366;
				_t566 =  *0x4d0070; // 0x4961b978
				_t1363 = __ecx;
				_v24 = _t566;
				_v280 = 0;
				memset( &_v279, 0, 0x10 << 2);
				_t1368 = _t1366 - 0x244 + 0xc;
				_v20 = _t1368;
				_v592 = _t1363;
				 *0x4af2c0(_t1326, _t1362, _t916,  *[fs:0x0], 0x4ac226, 0xffffffff);
				_t1329 = 0;
				_v8 = 0;
				 *0x4af2c0();
				 *0x4af2c0();
				 *0x4af2c0();
				_push(1);
				_v8 = 3;
				_v540 = 0;
				L00474C64();
				_t573 =  *((intOrPtr*)(_t1363 + 0x178));
				if( *((intOrPtr*)(_t573 - 0xc)) == 0) {
					_t573 =  *0x4af45c(0x4b6850);
				}
				if( *((intOrPtr*)( *((intOrPtr*)(_t1363 + 0x1c0)) - 0xc)) == _t1329) {
					L198:
					_push(_t1329);
					_push(_t1329);
					_push(0x69);
					L00474C70();
					L193:
					L004748C2();
					__eflags =  *((intOrPtr*)(_t1363 + 0x174));
					_t574 =  *((intOrPtr*)(_t573 + 4));
					 *((intOrPtr*)(_t1363 + 0x1b4)) = 0;
					if( *((intOrPtr*)(_t1363 + 0x174)) != 0) {
						__eflags =  *((intOrPtr*)(_t1363 + 0x18c));
						 *((intOrPtr*)(_t1363 + 0x1b4)) = 1;
						if( *((intOrPtr*)(_t1363 + 0x18c)) == 0) {
							 *((intOrPtr*)(_t1363 + 0x1b4)) = 2;
						}
					}
					L00455760(_t574,  *((intOrPtr*)(_t1363 + 0x1b4)));
					L197:
					 *0x4afb9c();
					 *0x4afb9c();
					 *0x4afb9c();
					_t579 =  *0x4afb9c();
					 *[fs:0x0] = _v16;
					return L00475E7E(_t579, _v24);
				}
				_t1273 =  *((intOrPtr*)(_t1363 + 0x1b8));
				_t573 =  *((intOrPtr*)( *((intOrPtr*)(_t1363 + 0x1b8)) - 0xc));
				if(_t573 == _t1329) {
					goto L198;
				}
				_t573 =  *((intOrPtr*)(_t1363 + 0x1ac));
				if(_t573 == _t1329 ||  *((intOrPtr*)(_t573 + 0x94)) == _t1329 ||  *((intOrPtr*)(_t1363 + 0x194)) == _t1329 ||  *((intOrPtr*)(_t573 + 0x9c)) == _t1329 ||  *((intOrPtr*)(_t573 + 0xa0)) == _t1329) {
					goto L193;
				} else {
					_t581 = E00402030( &_v448);
					_v8 = 4;
					L00458E60(_t581,  &_v540);
					_v8 = 5;
					_v520 =  *((intOrPtr*)(_t1363 + 0x174));
					_v457 =  *((intOrPtr*)(_t1363 + 0x18c)) == _t1329;
					if(L00463720( *((intOrPtr*)(_t1363 + 0x1ac)), _t1273,  *((intOrPtr*)(_t1363 + 0x194))) != 0) {
						_t957 =  *((intOrPtr*)(_t1363 + 0x1b0));
						__eflags =  *((intOrPtr*)(_t1363 + 0x1b0)) - _t1329;
						_v83 = 0;
						_v79 = 0;
						_v75 = 0;
						_v73 = 0;
						_v84 = 0x53;
						_v83 = 0x43;
						if( *((intOrPtr*)(_t1363 + 0x1b0)) != _t1329) {
							_t915 = L0043BBE0(_t957);
							__eflags = _t915 -  *((intOrPtr*)(_t1363 + 0x194));
							if(_t915 !=  *((intOrPtr*)(_t1363 + 0x194))) {
								 *((char*)(_t1363 + 0x1aa)) = 1;
							}
						}
						_t587 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1363 + 0x1ac)) + 0x94)) + 4));
						__eflags = _t587 - _t1329;
						_v416 = _t1329;
						if(_t587 != _t1329) {
							_v416 =  *((intOrPtr*)(_t587 + 8));
						}
						_t919 = 1;
						__eflags = _v416 - 1;
						if(_v416 < 1) {
							L23:
							_t589 =  *((intOrPtr*)(_t1363 + 0x1a4));
							__eflags = _t589;
							if(_t589 != 0) {
								E004507F0(_t589, _t589 + 4);
							}
							_t590 =  *((intOrPtr*)(_t1363 + 0x1b0));
							__eflags = _t590;
							if(_t590 != 0) {
								E004507F0(_t590, _t590 + 4);
								L0045D9C0(_t919,  *((intOrPtr*)(_t1363 + 0x1b0)), _t1329, _t1363, __eflags,  &_v84, 0xc);
							}
							_t591 = L00433940( *((intOrPtr*)(_t1363 + 0x194)), _t1396);
							_t592 = 1;
							__eflags = _v416 - 1;
							_v420 = _t591;
							_v452 = 1;
							if(_v416 < 1) {
								L38:
								_t593 =  *((intOrPtr*)(_t1363 + 0x1a4));
								__eflags = _t593;
								if(_t593 != 0) {
									E00450800(_t593 + 4);
									_t895 = L004316C0( *((intOrPtr*)(_t1363 + 0x194)), _t1365,  *((intOrPtr*)(_t1363 + 0x1a4)));
									_t1254 =  *((intOrPtr*)(_t1363 + 0x1a4));
									_t1360 = _t895;
									__eflags =  *((intOrPtr*)(_t1363 + 0x1a4)) - _t1360;
									if( *((intOrPtr*)(_t1363 + 0x1a4)) != _t1360) {
										_t896 = L0043BED0(_t1254);
										__eflags = _t896;
										if(_t896 == 0) {
											_t1255 =  *((intOrPtr*)(_t1363 + 0x1a4));
											__eflags = _t1255;
											if(_t1255 != 0) {
												 *((intOrPtr*)( *_t1255))(1);
											}
										}
										 *((intOrPtr*)(_t1363 + 0x1a4)) = _t1360;
									}
								}
								_t594 =  *((intOrPtr*)(_t1363 + 0x1b0));
								__eflags = _t594;
								if(_t594 != 0) {
									E00450800(_t594 + 4);
									_t890 = L004316C0( *((intOrPtr*)(_t1363 + 0x194)), _t1365,  *((intOrPtr*)(_t1363 + 0x1b0)));
									_t1250 =  *((intOrPtr*)(_t1363 + 0x1b0));
									_t1359 = _t890;
									__eflags =  *((intOrPtr*)(_t1363 + 0x1b0)) - _t1359;
									if( *((intOrPtr*)(_t1363 + 0x1b0)) != _t1359) {
										_t891 = L0043BED0(_t1250);
										__eflags = _t891;
										if(_t891 == 0) {
											_t1251 =  *((intOrPtr*)(_t1363 + 0x1b0));
											__eflags = _t1251;
											if(_t1251 != 0) {
												 *((intOrPtr*)( *_t1251))(1);
											}
										}
										 *((intOrPtr*)(_t1363 + 0x1b0)) = _t1359;
									}
								}
								_t595 = _v420;
								__eflags = _t595;
								if(_t595 != 0) {
									_v55 = 0;
									_v39 = 0;
									_v51 = 0;
									_v71 = 0;
									_v35 = 0;
									_v47 = 0;
									_v67 = 0;
									_v43 = 0;
									_v31 = 0;
									_v63 = 0;
									_v27 = 0;
									_v41 = 0;
									_v72 = 0;
									_v59 = 0;
									_v40 = 0;
									_v25 = 0;
									_v56 = 0;
									_v57 = 0;
									 *0x4af2c0();
									__eflags =  *((intOrPtr*)(_t1363 + 0x1a8));
									_v8 = 6;
									if( *((intOrPtr*)(_t1363 + 0x1a8)) != 0) {
										 *0x4afb64(_t1363 + 0x1b8);
									}
									__eflags =  *((intOrPtr*)(_t1363 + 0x1ab));
									if( *((intOrPtr*)(_t1363 + 0x1ab)) != 0) {
										 *0x4af598();
										_t1358 = _t1363 + 0x1bc;
										 *0x4af598();
										_t877 = E00402410(_t1358,  &_v488, _t1363 + 0x1b8);
										_v8 = 7;
										_t878 = E00402380( &_v440,  &_v440, _t877);
										_v8 = 8;
										_t879 = E00402410( &_v440,  &_v420, _t878);
										_t1368 = _t1368 + 0x24;
										_v8 = 9;
										 *0x4afb64(_t879, "^^^", _t1358, 0x4b46d0);
										 *0x4afb9c();
										 *0x4afb9c();
										_v8 = 6;
										 *0x4afb9c();
										 *0x4afb64(_t1363 + 0x1c4);
									}
									 *0x4afba4(_t1363 + 0x19c);
									_v8 = 0xa;
									 *0x4afba4(_t1363 + 0x1a0);
									_t603 =  *((intOrPtr*)(_t1363 + 0x1a8));
									_t1331 = 0;
									__eflags = _t603;
									_v8 = 0xb;
									_v456 = 0;
									_v416 = 0;
									if(_t603 == 0) {
										_push(0x114);
										L004746C0();
										_t1369 = _t1368 + 4;
										_v444 = _t603;
										__eflags = _t603;
										_v8 = 0xd;
										if(_t603 != 0) {
											_t1331 = L0044C990(_t603, 0, 0);
										}
										_v8 = 0xb;
										E0044C070(0xb, _t1331,  *0x4afb94(0));
										E0044C0E0(0xb, _t1331,  *0x4afb94(0));
									} else {
										_push(0x12c);
										L004746C0();
										_t1369 = _t1368 + 4;
										_v444 = _t603;
										__eflags = _t603;
										_v8 = 0xc;
										if(_t603 != 0) {
											_t1331 = L00471050(_t603, 0, 0);
										}
										_v8 = 0xb;
										E004701C0(0xb, _t1331,  *0x4afb94(0));
									}
									_t608 = L004317D0( *((intOrPtr*)(_t1363 + 0x194)), _t1331,  &_v456);
									__eflags = _t1331;
									_t921 = _t608;
									_v440 = _t921;
									if(_t1331 != 0) {
										__eflags = _t1331 - _t921;
										if(_t1331 != _t921) {
											 *((intOrPtr*)( *_t1331))(1);
										}
									}
									L0043BC00(_t921,  &_v40, 0x10);
									__eflags =  *((intOrPtr*)(_t1363 + 0x1a8));
									if( *((intOrPtr*)(_t1363 + 0x1a8)) == 0) {
										L70:
										__eflags = _v40;
										if(_v40 == 0) {
											 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1363 + 0x194)))) + 0x4c))( &_v40, 0x10, _t921);
										}
										goto L72;
									} else {
										__eflags = _v40;
										if(_v40 == 0) {
											 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1363 + 0x194)))) + 0x50))( &_v40, 0x10, _t921);
										}
										__eflags =  *((intOrPtr*)(_t1363 + 0x1a8));
										if( *((intOrPtr*)(_t1363 + 0x1a8)) != 0) {
											L72:
											_t1332 = _t921;
											 *0x4af2c0();
											 *0x4af2c0();
											__eflags =  *((intOrPtr*)(_t1363 + 0x1aa));
											_v8 = 0xf;
											if( *((intOrPtr*)(_t1363 + 0x1aa)) == 0) {
												_t615 =  *((intOrPtr*)(_t1363 + 0x1a4));
												__eflags = _t615;
												if(_t615 != 0) {
													_t1332 = _t615;
												}
												__eflags = _t1332;
												if(_t1332 != 0) {
													L0046DA30(_t1332,  &_v280);
													_v8 = 0x12;
													 *0x4afb64( *0x4afb90( &_v280));
													_v8 = 0xf;
													 *0x4afb9c();
												}
												_t974 =  *((intOrPtr*)(_v432 - 0xc));
												__eflags = _t974;
												if(_t974 == 0) {
													__eflags = _t1332;
													if(_t1332 != 0) {
														_v444 = _t1369;
														 *0x4afb90(_t974);
														_v8 = 0x13;
														 *0x4afb64(E00402570( &_v448,  &_v420, 0x4b0384));
														_v8 = 0xf;
														 *0x4afb9c();
														L0046DA70(_t921, _t1332, _t1332, _t1363, _t1365,  *0x4afb94(0x41));
													}
												}
												__eflags = 0;
												_t618 = L00459CD0(_t1363, _v520, 0,  *((intOrPtr*)(_t1363 + 0x1a4)), _t1332,  *((intOrPtr*)(_t1363 + 0x1ac)));
												L87:
												__eflags = _t1332 - _t921;
												if(_t1332 != _t921) {
													_t618 = L004317D0( *((intOrPtr*)(_t1363 + 0x194)), _t1332,  &_v456);
													_v416 = _t618;
												}
												L89:
												__eflags = _t1332;
												_t922 = _v416;
												if(_t1332 != 0) {
													__eflags = _t1332 - _t922;
													if(_t1332 != _t922) {
														__eflags = _t1332 -  *((intOrPtr*)(_t1363 + 0x1a4));
														if(_t1332 !=  *((intOrPtr*)(_t1363 + 0x1a4))) {
															_t618 =  *((intOrPtr*)( *_t1332))(1);
														}
													}
												}
												__eflags = _t922;
												if(_t922 != 0) {
													L0043BC00(_t922,  &_v56, 0x10);
													_t618 = _v56;
													__eflags = _t618;
													if(_t618 == 0) {
														_t618 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1363 + 0x194)))) + 0x54))( &_v56, 0x10,  &_v40, _t922);
													}
												}
												_push(0x128);
												L004746C0();
												_t1370 = _t1369 + 4;
												_v444 = _t618;
												__eflags = _t618;
												_v8 = 0x14;
												if(_t618 == 0) {
													_t923 = 0;
													__eflags = 0;
												} else {
													_t923 = E00460190(_t618, 0, 0);
												}
												_v8 = 0xf;
												L0045DB80(_t923, _t923,  *0x4afb94(0));
												L0045DBF0(_t923, _t923,  *0x4afb94(0));
												L0045DB10(_t923, _t923,  &_v84);
												_t1333 = _v416;
												__eflags = _t1333;
												if(_t1333 != 0) {
													_t807 = L0043BBB0(_t1333);
													__eflags = _t807 - 1;
													if(_t807 == 1) {
														_v8 = 0x15;
														 *0x4afb64(L00402B30( &_v448),  &_v420, _t1333);
														_v8 = 0xf;
														 *0x4afb9c();
														_v472 =  *((intOrPtr*)(_v464 - 0xc));
														_t812 =  *0x4afb94(0x41);
														_t1181 = _v472;
														__eflags = _t1181 - 0x41;
														_v420 = _t812;
														if(_t1181 < 0x41) {
															_t1308 = _t1181;
															_t1355 = _t812 + _t1308;
															_t815 = memset(_t1355, 0, 0x41 << 2);
															__eflags = 1;
															memset(_t1355 + (0x41 - _t1308 >> 2), _t815, 1 << 0);
															_t1370 = _t1370 + 0x18;
															_t812 = _v420;
															_t1333 = _v416;
														}
														L0045D870(_t923, _t923, _t1333, _t1363, _t1365, _t812);
													}
												}
												 *((intOrPtr*)( *_t1333 + 0x3c))(_t923, 0, 1,  &_v456);
												_t1334 = L004317D0( *((intOrPtr*)(_t1363 + 0x194)), _t923,  &_v456);
												__eflags = _t1334 - _t923;
												_v524 = _t1334;
												if(_t1334 != _t923) {
													__eflags = _t923;
													if(_t923 != 0) {
														 *((intOrPtr*)( *_t923))(1);
													}
												}
												__eflags = _t1334;
												if(_t1334 != 0) {
													L0043BC00(_t1334,  &_v72, 0x10);
													__eflags = _v72;
													if(_v72 == 0) {
														 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1363 + 0x194)))) + 0x58))( &_v72, 0x10,  &_v40,  &_v56, _t1334);
													}
												}
												_t628 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1363 + 0x1ac)) + 0x94)) + 4));
												_t924 = 0;
												__eflags = _t628;
												_v428 = 0;
												_v536 = 0;
												if(_t628 != 0) {
													_t924 =  *((intOrPtr*)(_t628 + 8));
													_v536 = _t924;
												}
												__eflags = _t924;
												_v452 = 1;
												if(_t924 != 0) {
													_push(0x404);
													L00474E42();
													__eflags = _t628;
													if(_t628 != 0) {
														_push(0);
														L004749E2();
													}
													_push(0x403);
													L00474E42();
													__eflags = _t628;
													if(_t628 != 0) {
														_push(0);
														L004749E2();
													}
													_push(0x405);
													L00474E42();
													__eflags = _t628;
													if(_t628 != 0) {
														_push(0);
														L004749E2();
													}
													_push(0x406);
													L00474E42();
													__eflags = _t628;
													if(_t628 != 0) {
														_push(0);
														L004749E2();
													}
													_push(1);
													L00474E42();
													__eflags = _t628;
													if(_t628 != 0) {
														_push(0);
														L004749E2();
													}
													_push(2);
													L00474E42();
													__eflags = _t628;
													if(_t628 != 0) {
														_push(0);
														L004749E2();
													}
													_push(0x409);
													L00474E42();
													__eflags = _t628;
													if(_t628 != 0) {
														_push(0);
														L004749E2();
													}
													_push(0x40b);
													L00474E42();
													__eflags = _t628;
													if(_t628 != 0) {
														_push(0);
														L004749E2();
													}
													_push(0x410);
													L00474E42();
													__eflags = _t628;
													if(_t628 != 0) {
														_push(0);
														L004749E2();
													}
													_push(0x463);
													L00474E42();
													__eflags = _t628;
													if(_t628 != 0) {
														_push(0);
														L004749E2();
													}
													_push(0x40d);
													L00474E42();
													__eflags = _t628;
													if(_t628 != 0) {
														_push(0);
														L004749E2();
													}
													_push(0x40f);
													L00474E42();
													__eflags = _t628;
													if(_t628 != 0) {
														_push(0);
														L004749E2();
													}
													_push(0x411);
													L00474E42();
													__eflags = _t628;
													if(_t628 != 0) {
														_push(0);
														L004749E2();
													}
													_push(0x452);
													L00474E42();
													__eflags = _t628;
													if(_t628 != 0) {
														_push(5);
														L00474AF6();
													}
													_push(0x451);
													L00474E42();
													__eflags = _t628;
													if(_t628 != 0) {
														_push(5);
														L00474AF6();
													}
												}
												__eflags = _t924 - 1;
												if(_t924 < 1) {
													L188:
													L00430EE0();
													L00459F20();
													_t631 = L00461730( *((intOrPtr*)(_t1363 + 0x1ac)), 0);
													L004748C2();
													L00456B30( *((intOrPtr*)(_t631 + 4)), _t1396,  *((intOrPtr*)( *((intOrPtr*)(_t1363 + 0x1ac)) + 0x88)));
													L00457A60( *((intOrPtr*)(_t631 + 4)), _t1334);
													 *((intOrPtr*)( *((intOrPtr*)(_t1363 + 0x1ac)) + 0x88)) = _t1334;
													E0046C4F0(_t1365, _t1334);
													_v8 = 0x29;
													 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1363 + 0x194)))) + 0x40))();
													L0043D6C0( *((intOrPtr*)(_t1363 + 0x194)));
													_v8 = 0xf;
													L004748C2();
													L004752EC();
													 *0x4afb9c();
													 *0x4afb9c();
													 *0x4afb9c();
													 *0x4afb9c();
													_t643 =  *0x4afb9c();
													_v8 = 4;
													L004748C2();
													L00474C5E();
													_v8 = 3;
													_t573 = E00402040(_t643,  &_v448);
													__eflags = 1;
													if(1 != 0) {
														L00474BA4();
													}
													goto L193;
												} else {
													do {
														L00424B90( *((intOrPtr*)( *((intOrPtr*)(_t1363 + 0x1ac)) + 0x94)), _v452,  &_v428);
														_t1336 = _v428;
														_t926 =  *((intOrPtr*)(_t1336 + 0xc8));
														__eflags = _t926;
														_v440 =  *((intOrPtr*)(_t1336 + 0xc4));
														if(_t926 != 0) {
															L147:
															_v212 = 0;
															memset( &_v211, 0, 0xf << 2);
															asm("stosw");
															asm("stosb");
															 *0x4afd54( &_v212, "Image #%i of %i", _v452, _v536);
															 *0x4af45c( &_v212);
															_t652 = E00444750(_t926,  &_v472);
															_push(0x114);
															_v8 = 0x16;
															L004746C0();
															_t1339 = _t652;
															_t1373 = _t1370 + 0x20;
															_v480 = _t1339;
															__eflags = _t1339;
															_v8 = 0x17;
															if(__eflags == 0) {
																_v476 = 0;
															} else {
																_v476 = L004472D0(_t926, _t1339, _t1339, _t1363, _t1365, __eflags,  *((intOrPtr*)( *_v440 + 4))(0), 0);
															}
															_v408 = 0;
															memset( &_v407, 0, 0x1f << 2);
															asm("stosw");
															_v8 = 0x16;
															asm("stosb");
															 *0x4afb90(0x4b0384);
															_v8 = 0x18;
															_t658 = E00422230( *0x4afb90( &_v40), 0x4b0384);
															_t1375 = _t1373 + 0x14;
															_v409 = _t658;
															 *0x4afb9c();
															__eflags = _v409;
															if(_v409 != 0) {
																_v8 = 0x19;
																_t790 = E00402380( &_v568,  &_v560,  &_v436);
																_v8 = 0x1a;
																_t791 = E00402410( &_v576,  &_v576, _t790);
																_t1375 = _t1375 + 0x18;
																_v8 = 0x1b;
																 *0x4afb64(_t791, 0x4b687c,  *0x4afb90( &_v40));
																 *0x4afb9c();
																 *0x4afb9c();
																_v8 = 0x18;
																 *0x4afb9c();
															}
															_t662 = E00422230( *0x4afb90( &_v56), 0x4b0384);
															_t1376 = _t1375 + 8;
															_v409 = _t662;
															 *0x4afb9c();
															__eflags = _v409;
															if(_v409 != 0) {
																_v8 = 0x1c;
																_t781 = E00402380( &_v436,  &_v556,  &_v436);
																_v8 = 0x1d;
																_t783 = E00402410( &_v436,  &_v548, _t781);
																_t1376 = _t1376 + 0x18;
																_v8 = 0x1e;
																 *0x4afb64(_t783, 0x4b687c,  *0x4afb90( &_v56));
																 *0x4afb9c();
																 *0x4afb9c();
																_v8 = 0x18;
																 *0x4afb9c();
															}
															_t666 = E00422230( *0x4afb90( &_v72), 0x4b0384);
															_t1377 = _t1376 + 8;
															_v409 = _t666;
															 *0x4afb9c();
															__eflags = _v409;
															if(_v409 != 0) {
																_v8 = 0x1f;
																_t773 = E00402380( &_v588,  &_v588,  &_v436);
																_v8 = 0x20;
																_t774 = E00402410( &_v588,  &_v580, _t773);
																_t1377 = _t1377 + 0x18;
																_v8 = 0x21;
																 *0x4afb64(_t774, 0x4b687c,  *0x4afb90( &_v72));
																 *0x4afb9c();
																 *0x4afb9c();
																_v8 = 0x18;
																 *0x4afb9c();
															}
															E004447F0(_t926,  &_v416);
															_v8 = 0x22;
															_t671 =  *0x4afb88(0x2f);
															_t1342 = _t671;
															_t672 =  *0x4afb88(0x5c);
															__eflags = _t1342 - _t672;
															if(_t1342 <= _t672) {
																_t1342 = _t672;
															}
															 *0x4afb90(0x4b0384);
															__eflags = _t1342;
															_v8 = 0x23;
															if(__eflags > 0) {
																_t767 =  *((intOrPtr*)(_v416 - 0xc)) - _t1342 - 1;
																__eflags = _t767;
																_v8 = 0x24;
																 *0x4afb64( *0x4afb8c( &_v552, _t767));
																_v8 = 0x23;
																 *0x4afb9c();
															}
															_t675 =  *0x4afb94(0x42,  *0x4afb94(0x10));
															L0042C9E0( *((intOrPtr*)(_t1363 + 0x194)), __eflags,  &_v408,  &_v420,  *0x4afb94(), 0x80, _t675);
															__eflags = _v420;
															if(_v420 == 0) {
																L00474C70();
																 *0x4afb9c(0xf033, 0, 0);
																 *0x4afb9c();
																 *0x4afb9c();
																 *0x4afb9c();
																 *0x4afb9c();
																 *0x4afb9c();
																 *0x4afb9c();
																 *0x4afb9c();
																_t595 =  *0x4afb9c();
																goto L190;
															} else {
																L00444C90(_t926,  &_v408);
																L00402DB0( &_v448);
																_t1343 =  *((intOrPtr*)(_v528 - 0xc));
																_v8 = 0x25;
																_t692 =  *0x4afb94(0x41,  &_v528, _v524);
																__eflags = _t1343 - 0x41;
																_v424 = _t692;
																if(_t1343 < 0x41) {
																	_t1352 = _t692 + _t1343;
																	_t763 = memset(_t1352, 0, 0x41 << 2);
																	__eflags = 1;
																	memset(_t1352 + (0x41 - _t1343 >> 2), _t763, 1 << 0);
																	_t1377 = _t1377 + 0x18;
																}
																 *((intOrPtr*)( *_v476 + 0x18))(_v424);
																E00444730(_t926, _v424);
																_t696 = _v496;
																__eflags =  *((intOrPtr*)(_t696 - 0xc));
																if( *((intOrPtr*)(_t696 - 0xc)) != 0) {
																	L00444A70(_t926, _t696);
																}
																_t697 = _v532;
																__eflags =  *((intOrPtr*)(_t697 - 0xc));
																if( *((intOrPtr*)(_t697 - 0xc)) != 0) {
																	L00444B10(_t926, _t697);
																}
																__eflags = _v520;
																if(_v520 != 0) {
																	__eflags = _v457;
																	_t758 = 1;
																	if(_v457 != 0) {
																		_t758 = 2;
																	}
																	E00446690(_t926, _t758);
																}
																L004454D0(_t926,  *((intOrPtr*)(_t1363 + 0x178)));
																L00445210(_t926,  *((intOrPtr*)(_t1363 + 0x184)));
																L004452B0(_t926,  *((intOrPtr*)(_t1363 + 0x1c0)));
																L00445730(_t926,  *((intOrPtr*)(_t1363 + 0x188)));
																L004455B0(_t926, _v464);
																L00445650(_t926, _v432);
																L00445690(_t926, _v452);
																L00446A40(_t926, _v476, _v452, _t1363, _t1365, _v452);
																L00445FB0(_t926);
																_t1291 = L004452D0();
																_v148 = 0;
																_v440 = 0;
																_v424 = 0;
																memset( &_v147, 0, 0xf << 2);
																asm("stosw");
																asm("stosb");
																_v480 = _t1291;
																_v488 = _t1291;
																 *0x4afd54( &_v148, "Frames to save %i", _t1291);
																_t1379 = _t1377 + 0x18;
																 *0x4af45c( &_v148);
																_push(0);
																L00474C64();
																_t718 = _v480;
																__eflags = _t718;
																if(_t718 == 0) {
																	L180:
																	L004746C0();
																	_t1349 = _t718;
																	_t721 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1363 + 0x194)))) + 0x44))( &_v408, _v420, _t1349, 0x108);
																	_push(0x334);
																	L004746C0();
																	_t1381 = _t1379 + 8;
																	_v480 = _t721;
																	__eflags = _t721;
																	_v8 = 0x26;
																	if(_t721 == 0) {
																		_v424 = 0;
																	} else {
																		_push(0);
																		_push(_t1349);
																		_v424 = L0043D7B0(_t721,  *((intOrPtr*)(_t1363 + 0x194)));
																	}
																	_v8 = 0x25;
																	L004746BA();
																	_t1370 = _t1381 + 4;
																	E004446B0(_t926,  &_v468);
																	_v8 = 0x27;
																	 *((intOrPtr*)( *_v424 + 0x18))( *0x4afb94(0x40, _t1349));
																	_v480 =  *_v476;
																	_t727 =  *0x4afb94(0x40);
																	_t1351 = _v476;
																	 *((intOrPtr*)(_v480 + 0x18))(_t727);
																	_v8 = 0x28;
																	 *0x4afb64(E00444750(_t926,  &_v444));
																	_v8 = 0x27;
																	 *0x4afb9c();
																	 *((intOrPtr*)( *_v424 + 0x14))( *0x4afb94(0x40));
																	 *((intOrPtr*)( *_t1351 + 0x14))( *0x4afb94(0x40));
																	L0043BBD0(_t1351, _v424);
																	L00431B20( *((intOrPtr*)(_t1363 + 0x194)), _v424);
																	 *((intOrPtr*)( *_v524 + 0x3c))(_t1351, 0, 1,  &_v456);
																	_t930 = L004317D0( *((intOrPtr*)(_t1363 + 0x194)), _t1351,  &_v456);
																	__eflags = _t930 - _t1351;
																	if(_t930 != _t1351) {
																		L0043BBD0(_t1351, 0);
																		 *((intOrPtr*)( *_t1351))(1);
																	}
																	 *((intOrPtr*)(_v428 + 0xc4)) = _t930;
																	 *0x4afb9c();
																	 *0x4afb9c();
																	 *0x4afb9c();
																	 *0x4afb9c();
																	 *0x4afb9c();
																	_v8 = 0xf;
																	 *0x4afb9c();
																	goto L186;
																} else {
																	while(1) {
																		_t718 = _v440;
																		__eflags = _t718;
																		if(_t718 != 0) {
																			goto L180;
																		}
																		_t718 = L004452D0();
																		__eflags = _t718;
																		if(_t718 == 0) {
																			goto L180;
																		}
																		__eflags = _v488 - _t718;
																		if(_v488 != _t718) {
																			_v488 = _t718;
																			_v424 = 0;
																		} else {
																			_t1103 = _v424 + 1;
																			__eflags = _t1103 - 0x14;
																			_v424 = _t1103;
																			if(_t1103 > 0x14) {
																				_v440 = 1;
																			}
																		}
																		 *0x4afd54( &_v148, "Frames Remaining %i", _t718);
																		_t1379 = _t1379 + 0xc;
																		 *0x4af45c( &_v148);
																		_push(0);
																		L00474C64();
																		Sleep(0xfa);
																	}
																	goto L180;
																}
															}
														}
														L0045CA70(_t926, _t1336, _t1336, _t1363, _t1365, 1);
														_t926 =  *((intOrPtr*)(_t1336 + 0xc8));
														__eflags = _t926;
														if(_t926 == 0) {
															goto L186;
														}
														goto L147;
														L186:
														_t751 = _v452 + 1;
														__eflags = _t751 - _v536;
														_v452 = _t751;
													} while (_t751 <= _v536);
													_t1334 = _v524;
													goto L188;
												}
											}
											_t833 =  *((intOrPtr*)(_t1363 + 0x1a8));
											__eflags = _t833;
											if(_t833 == 0) {
												L75:
												_push(0x12c);
												L004746C0();
												_t1384 = _t1369 + 4;
												_v444 = _t833;
												__eflags = _t833;
												_v8 = 0x10;
												if(_t833 == 0) {
													_t1332 = 0;
													__eflags = 0;
												} else {
													_t1332 = L0046F510(_t833, 0, 0);
												}
												_v8 = 0xf;
												L0046D730(_t921, _t1332,  *0x4afb94(0));
												E00402530( &_v484,  &_v484);
												_v179 = 0;
												_v175 = 0;
												_v171 = 0;
												_v167 = 0;
												_v163 = 0;
												_v159 = 0;
												_v155 = 0;
												_v151 = 0;
												_v180 = 0;
												_v149 = 0;
												 *0x4afd54( &_v180, "%04d%02d%02d", L00428F20( &_v484), L00401F30( &_v484), L00401F50( &_v484));
												L0046D860(_t921, _t1332,  &_v180);
												_v115 = 0;
												_v111 = 0;
												_v107 = 0;
												_v103 = 0;
												_v99 = 0;
												_v95 = 0;
												_v91 = 0;
												_v87 = 0;
												_v116 = 0;
												_v85 = 0;
												 *0x4afd54( &_v116, "%02d%02d", L00401F70( &_v484), L00401F90( &_v484));
												_t1369 = _t1384 + 0x24;
												L0046D900(_t921, _t1332,  &_v116);
												_t848 =  *0x4afb94(0);
												_t1219 = _t1332;
												L0046D970(_t921, _t1219, _t848);
												_v444 = _t1369;
												 *0x4afb90(_t1219);
												_v8 = 0x11;
												 *0x4afb64(E00402570( &_v448,  &_v420, 0x4b0384));
												_v8 = 0xf;
												 *0x4afb9c();
												L0046DA70(_t921, _t1332, _t1332, _t1363, _t1365,  *0x4afb94(0x41));
												L00459CD0(_t1363, _v520, 0,  *((intOrPtr*)(_t1363 + 0x1a4)), _t1332,  *((intOrPtr*)(_t1363 + 0x1ac)));
												_t921 = _v440;
												_t618 =  *((intOrPtr*)( *_t921 + 0x3c))(_t1332, 0, 1,  &_v456);
												goto L87;
											}
											_t618 =  *((intOrPtr*)( *((intOrPtr*)(_t1363 + 0x1c0)) - 0xc));
											__eflags = _t618;
											if(_t618 == 0) {
												goto L89;
											}
											goto L75;
										} else {
											goto L70;
										}
									}
								} else {
									_push(0);
									_push(0);
									_push(0x5dc7);
									L00474C70();
									goto L190;
								}
							} else {
								do {
									_v428 = 0;
									L00424B90( *((intOrPtr*)( *((intOrPtr*)(_t1363 + 0x1ac)) + 0x94)), _t592,  &_v428);
									_t899 = _v428;
									__eflags = _t899;
									if(_t899 != 0) {
										_t1361 =  *((intOrPtr*)(_t899 + 0xc4));
										__eflags = _t1361;
										if(_t1361 != 0) {
											_t932 =  *((intOrPtr*)(_t1363 + 0x194));
											_t901 = L0043BBE0(_t1361);
											__eflags = _t901 - _t932;
											if(_t901 == _t932) {
												E00450800(_t1361 + 4);
												_t904 = L0043BED0(_t1361);
												__eflags = _t904;
												if(_t904 == 0) {
													 *((intOrPtr*)( *_t1361))(1);
												}
											}
										}
									}
									_t592 = _v452 + 1;
									__eflags = _t592 - _v416;
									_v452 = _t592;
								} while (_t592 <= _v416);
								goto L38;
							}
						} else {
							do {
								_v428 = 0;
								L00424B90( *((intOrPtr*)( *((intOrPtr*)(_t1363 + 0x1ac)) + 0x94)), _t919,  &_v428);
								_t911 = _v428;
								__eflags = _t911;
								if(_t911 != 0) {
									_t1329 =  *((intOrPtr*)(_t911 + 0xc4));
									__eflags = _t1329;
									if(_t1329 != 0) {
										_t913 = L0043BBE0(_t1329);
										__eflags = _t913 -  *((intOrPtr*)(_t1363 + 0x194));
										if(_t913 ==  *((intOrPtr*)(_t1363 + 0x194))) {
											E004507F0(_t913, _t1329 + 4);
										}
									}
								}
								_t919 = _t919 + 1;
								__eflags = _t919 - _v416;
							} while (_t919 <= _v416);
							goto L23;
						}
					} else {
						_push(_t1329);
						_push(_t1329);
						_push(0x6b);
						L00474C70();
						L190:
						_v8 = 4;
						L004748C2();
						L00474C5E();
						_v8 = 3;
						E00402040(_t595,  &_v448);
						goto L197;
					}
				}
			}




























































































































































































































0x0045a040
0x0045a051
0x0045a05e
0x0045a065
0x0045a068
0x0045a06d
0x0045a07f
0x0045a07f
0x0045a087
0x0045a08a
0x0045a090
0x0045a096
0x0045a09e
0x0045a0a1
0x0045a0ad
0x0045a0b9
0x0045a0bf
0x0045a0c3
0x0045a0c7
0x0045a0cd
0x0045a0d2
0x0045a0e1
0x0045a0e8
0x0045a0e8
0x0045a0f7
0x0045b870
0x0045b870
0x0045b871
0x0045b872
0x0045b874
0x0045b7df
0x0045b7df
0x0045b7ea
0x0045b7ec
0x0045b7ef
0x0045b7f9
0x0045b801
0x0045b803
0x0045b80d
0x0045b80f
0x0045b80f
0x0045b80d
0x0045b822
0x0045b827
0x0045b82d
0x0045b839
0x0045b845
0x0045b851
0x0045b85a
0x0045b86f
0x0045b86f
0x0045a0fd
0x0045a103
0x0045a108
0x00000000
0x00000000
0x0045a10e
0x0045a116
0x00000000
0x0045a14c
0x0045a152
0x0045a15d
0x0045a161
0x0045a181
0x0045a185
0x0045a18b
0x0045a199
0x0045a1a9
0x0045a1b1
0x0045a1b3
0x0045a1b6
0x0045a1b9
0x0045a1bd
0x0045a1c0
0x0045a1c4
0x0045a1c8
0x0045a1ca
0x0045a1cf
0x0045a1d5
0x0045a1d7
0x0045a1d7
0x0045a1d5
0x0045a1ea
0x0045a1ed
0x0045a1ef
0x0045a1f5
0x0045a1fa
0x0045a1fa
0x0045a206
0x0045a20b
0x0045a20d
0x0045a269
0x0045a269
0x0045a26f
0x0045a271
0x0045a276
0x0045a276
0x0045a27b
0x0045a281
0x0045a283
0x0045a288
0x0045a299
0x0045a299
0x0045a2a4
0x0045a2b2
0x0045a2b7
0x0045a2b9
0x0045a2bf
0x0045a2c5
0x0045a36a
0x0045a36a
0x0045a370
0x0045a372
0x0045a377
0x0045a389
0x0045a38e
0x0045a394
0x0045a396
0x0045a398
0x0045a39a
0x0045a39f
0x0045a3a1
0x0045a3a3
0x0045a3a9
0x0045a3ab
0x0045a3b1
0x0045a3b1
0x0045a3ab
0x0045a3b3
0x0045a3b3
0x0045a398
0x0045a3b9
0x0045a3bf
0x0045a3c1
0x0045a3c6
0x0045a3d8
0x0045a3dd
0x0045a3e3
0x0045a3e5
0x0045a3e7
0x0045a3e9
0x0045a3ee
0x0045a3f0
0x0045a3f2
0x0045a3f8
0x0045a3fa
0x0045a400
0x0045a400
0x0045a3fa
0x0045a402
0x0045a402
0x0045a3e7
0x0045a408
0x0045a40e
0x0045a410
0x0045a429
0x0045a42e
0x0045a431
0x0045a434
0x0045a437
0x0045a43a
0x0045a43d
0x0045a440
0x0045a444
0x0045a447
0x0045a44a
0x0045a44e
0x0045a451
0x0045a454
0x0045a45e
0x0045a462
0x0045a465
0x0045a468
0x0045a46b
0x0045a477
0x0045a479
0x0045a47d
0x0045a48c
0x0045a48c
0x0045a498
0x0045a49a
0x0045a4a8
0x0045a4ae
0x0045a4b6
0x0045a4c9
0x0045a4d7
0x0045a4db
0x0045a4ed
0x0045a4f1
0x0045a4f6
0x0045a500
0x0045a504
0x0045a510
0x0045a51c
0x0045a528
0x0045a52c
0x0045a53f
0x0045a53f
0x0045a552
0x0045a565
0x0045a569
0x0045a56f
0x0045a575
0x0045a577
0x0045a57b
0x0045a57e
0x0045a584
0x0045a58a
0x0045a5cd
0x0045a5d2
0x0045a5d7
0x0045a5da
0x0045a5e0
0x0045a5e2
0x0045a5e6
0x0045a5f1
0x0045a5f1
0x0045a5fb
0x0045a607
0x0045a61d
0x0045a58c
0x0045a58c
0x0045a591
0x0045a596
0x0045a599
0x0045a59f
0x0045a5a1
0x0045a5a5
0x0045a5b0
0x0045a5b0
0x0045a5ba
0x0045a5c6
0x0045a5c6
0x0045a630
0x0045a635
0x0045a637
0x0045a639
0x0045a63f
0x0045a641
0x0045a643
0x0045a64b
0x0045a64b
0x0045a643
0x0045a655
0x0045a660
0x0045a662
0x0045a687
0x0045a68a
0x0045a68c
0x0045a69d
0x0045a69d
0x00000000
0x0045a664
0x0045a667
0x0045a669
0x0045a67a
0x0045a67a
0x0045a683
0x0045a685
0x0045a6a0
0x0045a6a6
0x0045a6a8
0x0045a6b4
0x0045a6c0
0x0045a6c2
0x0045a6c6
0x0045a8ce
0x0045a8d4
0x0045a8d6
0x0045a8d8
0x0045a8d8
0x0045a8da
0x0045a8dc
0x0045a8e7
0x0045a906
0x0045a90a
0x0045a916
0x0045a91a
0x0045a91a
0x0045a926
0x0045a929
0x0045a92b
0x0045a92d
0x0045a92f
0x0045a934
0x0045a93f
0x0045a95e
0x0045a962
0x0045a96e
0x0045a972
0x0045a989
0x0045a989
0x0045a92f
0x0045a99a
0x0045a9af
0x0045a9b4
0x0045a9b4
0x0045a9b6
0x0045a9c6
0x0045a9cb
0x0045a9cb
0x0045a9d1
0x0045a9d1
0x0045a9d3
0x0045a9d9
0x0045a9db
0x0045a9dd
0x0045a9df
0x0045a9e5
0x0045a9ed
0x0045a9ed
0x0045a9e5
0x0045a9dd
0x0045a9ef
0x0045a9f1
0x0045a9fb
0x0045aa00
0x0045aa03
0x0045aa05
0x0045aa1a
0x0045aa1a
0x0045aa05
0x0045aa1d
0x0045aa22
0x0045aa27
0x0045aa2a
0x0045aa30
0x0045aa32
0x0045aa36
0x0045aa47
0x0045aa47
0x0045aa38
0x0045aa43
0x0045aa43
0x0045aa51
0x0045aa5e
0x0045aa74
0x0045aa7f
0x0045aa84
0x0045aa8a
0x0045aa8c
0x0045aa94
0x0045aa99
0x0045aa9c
0x0045aabc
0x0045aac0
0x0045aacc
0x0045aad0
0x0045aadf
0x0045aaed
0x0045aaf3
0x0045aaf9
0x0045aafc
0x0045ab02
0x0045ab04
0x0045ab06
0x0045ab17
0x0045ab1b
0x0045ab1e
0x0045ab1e
0x0045ab20
0x0045ab26
0x0045ab26
0x0045ab2f
0x0045ab2f
0x0045aa9c
0x0045ab44
0x0045ab5a
0x0045ab5c
0x0045ab5e
0x0045ab64
0x0045ab66
0x0045ab68
0x0045ab70
0x0045ab70
0x0045ab68
0x0045ab72
0x0045ab74
0x0045ab7e
0x0045ab86
0x0045ab88
0x0045aba1
0x0045aba1
0x0045ab88
0x0045abb0
0x0045abb3
0x0045abb5
0x0045abb7
0x0045abc1
0x0045abc7
0x0045abc9
0x0045abcc
0x0045abcc
0x0045abd2
0x0045abd4
0x0045abde
0x0045abe4
0x0045abeb
0x0045abf0
0x0045abf2
0x0045abf4
0x0045abf8
0x0045abf8
0x0045abfd
0x0045ac04
0x0045ac09
0x0045ac0b
0x0045ac0d
0x0045ac11
0x0045ac11
0x0045ac16
0x0045ac1d
0x0045ac22
0x0045ac24
0x0045ac26
0x0045ac2a
0x0045ac2a
0x0045ac2f
0x0045ac36
0x0045ac3b
0x0045ac3d
0x0045ac3f
0x0045ac43
0x0045ac43
0x0045ac48
0x0045ac4c
0x0045ac51
0x0045ac53
0x0045ac55
0x0045ac59
0x0045ac59
0x0045ac5e
0x0045ac62
0x0045ac67
0x0045ac69
0x0045ac6b
0x0045ac6f
0x0045ac6f
0x0045ac74
0x0045ac7b
0x0045ac80
0x0045ac82
0x0045ac84
0x0045ac88
0x0045ac88
0x0045ac8d
0x0045ac94
0x0045ac99
0x0045ac9b
0x0045ac9d
0x0045aca1
0x0045aca1
0x0045aca6
0x0045acad
0x0045acb2
0x0045acb4
0x0045acb6
0x0045acba
0x0045acba
0x0045acbf
0x0045acc6
0x0045accb
0x0045accd
0x0045accf
0x0045acd3
0x0045acd3
0x0045acd8
0x0045acdf
0x0045ace4
0x0045ace6
0x0045ace8
0x0045acec
0x0045acec
0x0045acf1
0x0045acf8
0x0045acfd
0x0045acff
0x0045ad01
0x0045ad05
0x0045ad05
0x0045ad0a
0x0045ad11
0x0045ad16
0x0045ad18
0x0045ad1a
0x0045ad1e
0x0045ad1e
0x0045ad23
0x0045ad2a
0x0045ad2f
0x0045ad31
0x0045ad33
0x0045ad37
0x0045ad37
0x0045ad3c
0x0045ad43
0x0045ad48
0x0045ad4a
0x0045ad4c
0x0045ad50
0x0045ad50
0x0045ad4a
0x0045ad55
0x0045ad58
0x0045b5f7
0x0045b603
0x0045b614
0x0045b621
0x0045b626
0x0045b63d
0x0045b645
0x0045b650
0x0045b660
0x0045b66d
0x0045b671
0x0045b67a
0x0045b764
0x0045b76b
0x0045b773
0x0045b77e
0x0045b78a
0x0045b796
0x0045b7a2
0x0045b7ae
0x0045b7b4
0x0045b7b8
0x0045b7c0
0x0045b7cb
0x0045b7cf
0x0045b7d4
0x0045b7d6
0x0045b7da
0x0045b7da
0x00000000
0x0045ad60
0x0045ad60
0x0045ad7a
0x0045ad7f
0x0045ad85
0x0045ad8b
0x0045ad93
0x0045ad99
0x0045adb2
0x0045adb4
0x0045adc6
0x0045adce
0x0045add0
0x0045ade5
0x0045adfb
0x0045ae0a
0x0045ae0f
0x0045ae14
0x0045ae18
0x0045ae1d
0x0045ae1f
0x0045ae22
0x0045ae28
0x0045ae2a
0x0045ae2e
0x0045ae4f
0x0045ae30
0x0045ae47
0x0045ae47
0x0045ae59
0x0045ae6d
0x0045ae6f
0x0045ae7c
0x0045ae80
0x0045ae81
0x0045ae91
0x0045aea1
0x0045aea6
0x0045aeaf
0x0045aeb5
0x0045aec1
0x0045aec3
0x0045aee8
0x0045aeec
0x0045aefe
0x0045af02
0x0045af07
0x0045af11
0x0045af15
0x0045af21
0x0045af2d
0x0045af39
0x0045af3d
0x0045af3d
0x0045af59
0x0045af5e
0x0045af67
0x0045af6d
0x0045af79
0x0045af7b
0x0045afa0
0x0045afa4
0x0045afb6
0x0045afba
0x0045afbf
0x0045afc9
0x0045afcd
0x0045afd9
0x0045afe5
0x0045aff1
0x0045aff5
0x0045aff5
0x0045b011
0x0045b016
0x0045b01f
0x0045b025
0x0045b031
0x0045b033
0x0045b058
0x0045b05c
0x0045b06e
0x0045b072
0x0045b077
0x0045b081
0x0045b085
0x0045b091
0x0045b09d
0x0045b0a9
0x0045b0ad
0x0045b0ad
0x0045b0bc
0x0045b0c9
0x0045b0cd
0x0045b0db
0x0045b0dd
0x0045b0e3
0x0045b0e5
0x0045b0e7
0x0045b0e7
0x0045b0f4
0x0045b0fa
0x0045b0fc
0x0045b100
0x0045b10d
0x0045b10d
0x0045b129
0x0045b12d
0x0045b139
0x0045b13d
0x0045b13d
0x0045b15a
0x0045b187
0x0045b192
0x0045b194
0x0045b692
0x0045b69d
0x0045b6a9
0x0045b6b5
0x0045b6c1
0x0045b6cd
0x0045b6d9
0x0045b6e5
0x0045b6f1
0x0045b6fd
0x00000000
0x0045b19a
0x0045b1a3
0x0045b1bc
0x0045b1c7
0x0045b1d2
0x0045b1d6
0x0045b1dc
0x0045b1df
0x0045b1e5
0x0045b1f1
0x0045b1fa
0x0045b1fe
0x0045b201
0x0045b201
0x0045b201
0x0045b212
0x0045b218
0x0045b21d
0x0045b226
0x0045b228
0x0045b22d
0x0045b22d
0x0045b232
0x0045b23b
0x0045b23d
0x0045b242
0x0045b242
0x0045b24d
0x0045b24f
0x0045b257
0x0045b259
0x0045b25e
0x0045b260
0x0045b260
0x0045b268
0x0045b268
0x0045b276
0x0045b284
0x0045b292
0x0045b2a0
0x0045b2ae
0x0045b2bc
0x0045b2ca
0x0045b2d6
0x0045b2dd
0x0045b2e9
0x0045b2ed
0x0045b2f3
0x0045b2f9
0x0045b30a
0x0045b30c
0x0045b30f
0x0045b31c
0x0045b322
0x0045b328
0x0045b32e
0x0045b340
0x0045b346
0x0045b34a
0x0045b34f
0x0045b355
0x0045b357
0x0045b3ea
0x0045b3ef
0x0045b3ff
0x0045b410
0x0045b413
0x0045b418
0x0045b41d
0x0045b420
0x0045b426
0x0045b428
0x0045b42c
0x0045b447
0x0045b42e
0x0045b434
0x0045b436
0x0045b43f
0x0045b43f
0x0045b452
0x0045b456
0x0045b45b
0x0045b467
0x0045b47c
0x0045b48d
0x0045b4a0
0x0045b4a6
0x0045b4ac
0x0045b4bb
0x0045b4d3
0x0045b4d7
0x0045b4e3
0x0045b4e7
0x0045b50a
0x0045b520
0x0045b52c
0x0045b538
0x0045b551
0x0045b567
0x0045b569
0x0045b56b
0x0045b571
0x0045b57c
0x0045b57c
0x0045b58a
0x0045b590
0x0045b59c
0x0045b5a8
0x0045b5b4
0x0045b5c0
0x0045b5cc
0x0045b5d0
0x00000000
0x0045b360
0x0045b360
0x0045b360
0x0045b366
0x0045b368
0x00000000
0x00000000
0x0045b370
0x0045b375
0x0045b377
0x00000000
0x00000000
0x0045b379
0x0045b37f
0x0045b3d8
0x0045b3de
0x0045b381
0x0045b387
0x0045b388
0x0045b38b
0x0045b391
0x0045b393
0x0045b393
0x0045b391
0x0045b3aa
0x0045b3b0
0x0045b3bc
0x0045b3c2
0x0045b3c6
0x0045b3d0
0x0045b3d0
0x00000000
0x0045b360
0x0045b357
0x0045b194
0x0045ad9f
0x0045ada4
0x0045adaa
0x0045adac
0x00000000
0x00000000
0x00000000
0x0045b5d6
0x0045b5e2
0x0045b5e3
0x0045b5e5
0x0045b5e5
0x0045b5f1
0x00000000
0x0045b5f1
0x0045ad58
0x0045a6cc
0x0045a6d2
0x0045a6d4
0x0045a6e7
0x0045a6e7
0x0045a6ec
0x0045a6f1
0x0045a6f4
0x0045a6fa
0x0045a6fc
0x0045a700
0x0045a711
0x0045a711
0x0045a702
0x0045a70d
0x0045a70d
0x0045a71b
0x0045a728
0x0045a734
0x0045a73b
0x0045a741
0x0045a747
0x0045a74d
0x0045a753
0x0045a759
0x0045a75f
0x0045a765
0x0045a772
0x0045a779
0x0045a7a9
0x0045a7bb
0x0045a7c2
0x0045a7c5
0x0045a7c8
0x0045a7cb
0x0045a7ce
0x0045a7d1
0x0045a7d4
0x0045a7d7
0x0045a7e1
0x0045a7e5
0x0045a803
0x0045a809
0x0045a812
0x0045a81f
0x0045a826
0x0045a828
0x0045a830
0x0045a83b
0x0045a85a
0x0045a85e
0x0045a86a
0x0045a86e
0x0045a885
0x0045a8ab
0x0045a8b0
0x0045a8c6
0x00000000
0x0045a8c6
0x0045a6dc
0x0045a6df
0x0045a6e1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0045a685
0x0045a412
0x0045a412
0x0045a414
0x0045a416
0x0045a41b
0x00000000
0x0045a41b
0x0045a2cb
0x0045a2d0
0x0045a2e4
0x0045a2ee
0x0045a2f3
0x0045a2f9
0x0045a2fb
0x0045a2fd
0x0045a303
0x0045a305
0x0045a307
0x0045a30f
0x0045a314
0x0045a316
0x0045a337
0x0045a33e
0x0045a343
0x0045a345
0x0045a34d
0x0045a34d
0x0045a345
0x0045a316
0x0045a305
0x0045a35b
0x0045a35c
0x0045a35e
0x0045a35e
0x00000000
0x0045a2d0
0x0045a210
0x0045a210
0x0045a224
0x0045a22e
0x0045a233
0x0045a239
0x0045a23b
0x0045a23d
0x0045a243
0x0045a245
0x0045a249
0x0045a24e
0x0045a254
0x0045a259
0x0045a259
0x0045a254
0x0045a245
0x0045a264
0x0045a265
0x0045a265
0x00000000
0x0045a210
0x0045a19b
0x0045a19b
0x0045a19c
0x0045a19d
0x0045a19f
0x0045b703
0x0045b703
0x0045b707
0x0045b70f
0x0045b71a
0x0045b71e
0x00000000
0x0045b71e
0x0045a199

Strings
Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID:
  • String ID: %02d%02d$%04d%02d%02d$)$C$Frames Remaining %i$Frames to save %i$Image #%i of %i$S$^^^
  • API String ID: 0-781201150
  • Opcode ID: 60acc7ff7ef39c29220b64d62c3cbc9972d3b983acbb3f88dff8f35417a454ba
  • Instruction ID: 9bf1bc805609a5b77b49cac6ddc2d6b1ebc16aeb1a8e449fb0a8299be5397a8d
  • Opcode Fuzzy Hash: 60acc7ff7ef39c29220b64d62c3cbc9972d3b983acbb3f88dff8f35417a454ba
  • Instruction Fuzzy Hash: 2EE2C770A002099FDB24DBA4CCA5BEEB7B5AF45304F0440EEE54EA7292DB746E48CF55
Uniqueness

Uniqueness Score: -1.00%

Control-flow Graph

  • Executed
  • Not Executed
control_flow_graph 1964 440080-4400e5 1965 4401ba-4401d7 1964->1965 1966 4400eb-4400f0 1964->1966 1972 4401dd-4401df 1965->1972 1973 44040a-44044c call 475e7e 1965->1973 1967 440152-440155 1966->1967 1968 4400f2-440150 call 402380 1966->1968 1967->1965 1970 440157-4401b5 call 402380 1967->1970 1968->1965 1970->1965 1975 4401e1-44020e 1972->1975 1976 44021b-440238 call 4746c0 1972->1976 1975->1976 1986 44025d 1976->1986 1987 44023a-44025b call 443a90 1976->1987 1992 44025f-44026c 1986->1992 1987->1992 1997 440272-440275 1992->1997 1998 4403ff-440403 1992->1998 1997->1998 2000 44027b-440283 1997->2000 1998->1973 2002 440285-44028b call 43f620 2000->2002 2003 440290-4402dd call 429550 2000->2003 2002->2003 2010 4402df-4402e3 2003->2010 2011 440349-44034d 2003->2011 2010->2011 2012 4402e5-44030d call 46fff0 2010->2012 2013 440352-440381 GetVolumeInformationA 2011->2013 2012->2013 2025 44030f-440336 call 46fff0 2012->2025 2015 440392-4403b3 GetDiskFreeSpaceA 2013->2015 2016 440383-44038d call 429510 2013->2016 2017 4403b5-4403bb 2015->2017 2018 4403c6-4403d6 GetDriveTypeA 2015->2018 2016->2015 2021 4403c0 2017->2021 2022 4403bd-4403be 2017->2022 2023 4403e8 2018->2023 2024 4403d8-4403e2 GetDriveTypeA 2018->2024 2026 4403c1 call 429590 2021->2026 2022->2026 2029 4403e9-4403fa call 4295a0 GetDriveTypeA call 429e30 2023->2029 2024->2023 2027 4403e4-4403e6 2024->2027 2025->2013 2033 440338-440347 2025->2033 2026->2018 2027->2029 2029->1998 2033->2013
APIs
  • GetVolumeInformationA.KERNEL32(?,?,000000FF,00000000,?,00000000,?,00000020), ref: 00440379
  • GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 004403AB
  • GetDriveTypeA.KERNEL32(?), ref: 004403D1
  • GetDriveTypeA.KERNEL32(?), ref: 004403DD
  • GetDriveTypeA.KERNEL32(?,00000001), ref: 004403F5
Strings
Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID: DriveType$DiskFreeInformationSpaceVolume
  • String ID: \
  • API String ID: 4245799640-2967466578
  • Opcode ID: 1ffd5a33fb2b0a1a956e09d3aa1686f1b33a2411becc43d2030405a93ac2280d
  • Instruction ID: a897e3f9374a4f19b576eeb1a500686a482661b3f362b1fe6a922382f8a44e32
  • Opcode Fuzzy Hash: 1ffd5a33fb2b0a1a956e09d3aa1686f1b33a2411becc43d2030405a93ac2280d
  • Instruction Fuzzy Hash: 7BB196711083419FD325DF54C894AAFBBE8AFD5704F04492EF6C983251DB749A09CB67
Uniqueness

Uniqueness Score: -1.00%

C-Code - Quality: 100%
			E004763C7() {
				struct _FILETIME _v12;
				signed int _v16;
				union _LARGE_INTEGER _v20;
				signed int _t7;
				signed int _t9;
				signed int _t10;
				signed int _t11;
				signed int _t15;
				signed int _t22;

				_t7 =  *0x4d0070; // 0x4961b978
				if(_t7 == 0 || _t7 == 0xbb40e64e) {
					GetSystemTimeAsFileTime( &_v12);
					_t9 = GetCurrentProcessId();
					_t10 = GetCurrentThreadId();
					_t11 = GetTickCount();
					QueryPerformanceCounter( &_v20);
					_t15 = _v16 ^ _v20.LowPart;
					_t22 = _v12.dwHighDateTime ^ _v12.dwLowDateTime ^ _t9 ^ _t10 ^ _t11 ^ _t15;
					 *0x4d0070 = _t22;
					if(_t22 == 0) {
						 *0x4d0070 = 0xbb40e64e;
					}
					return _t15;
				}
				return _t7;
			}












0x004763cd
0x004763d4
0x004763e2
0x004763ee
0x004763f6
0x004763fe
0x0047640a
0x00476413
0x00476416
0x00476418
0x0047641e
0x00476420
0x00476420
0x00000000
0x0047642a
0x0047642c

APIs
  • GetSystemTimeAsFileTime.KERNEL32(?), ref: 004763E2
  • GetCurrentProcessId.KERNEL32 ref: 004763EE
  • GetCurrentThreadId.KERNEL32 ref: 004763F6
  • GetTickCount.KERNEL32 ref: 004763FE
  • QueryPerformanceCounter.KERNEL32(?), ref: 0047640A
Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
  • String ID:
  • API String ID: 1445889803-0
  • Opcode ID: 788133c8121338d6b816ffd89f67874b4b4c1f338a146e634eede64b0c0282ed
  • Instruction ID: 7d137e42dd971630294f05395278a188cfcb6307b065799f31d1e3f369133b65
  • Opcode Fuzzy Hash: 788133c8121338d6b816ffd89f67874b4b4c1f338a146e634eede64b0c0282ed
  • Instruction Fuzzy Hash: 73F0AF72D00114DBCB219FF4FD486DEBBF8FB49255B864671D801E7110EB3499458B88
Uniqueness

Uniqueness Score: -1.00%

C-Code - Quality: 79%
			E00454860(struct HWND__* _a4, signed int _a8) {
				struct _WINDOWPLACEMENT _v44;
				int _t13;
				struct HWND__* _t28;

				if(E00454620() == 0) {
					_t20 = _a8;
					if((_a8 & 0x00000003) == 0) {
						_t28 = _a4;
						if(IsIconic(_t28) == 0) {
							_t13 = GetWindowRect(_t28,  &(_v44.rcNormalPosition));
						} else {
							_t13 = GetWindowPlacement(_t28,  &_v44);
						}
						if(_t13 == 0) {
							return 0;
						} else {
							return E00454800( &(_v44.rcNormalPosition), _t20);
						}
					} else {
						return 0x12340042;
					}
				} else {
					return  *0x4f236c(_a4, _a8);
				}
			}






0x0045486a
0x00454883
0x0045488a
0x00454899
0x004548a6
0x004548bc
0x004548a8
0x004548ae
0x004548ae
0x004548c5
0x004548df
0x004548c7
0x004548d6
0x004548d6
0x0045488c
0x00454895
0x00454895
0x0045486c
0x0045487f
0x0045487f

Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID:
  • String ID:
  • API String ID:
  • Opcode ID: 4e0f4d70ff044a6bbf3de36d4aebf7476e01411def07970710d30417a3f84c9b
  • Instruction ID: 4d1b9eb17faf8eaa730999d38aa7c44b94de4ac26463144603184e60f852abba
  • Opcode Fuzzy Hash: 4e0f4d70ff044a6bbf3de36d4aebf7476e01411def07970710d30417a3f84c9b
  • Instruction Fuzzy Hash: CA01F7366051406BD214FBA19C84EAF77DCBFD9305F84081AFC4586101E71CEA9C877B
Uniqueness

Uniqueness Score: -1.00%

C-Code - Quality: 100%
			E004545C0() {
				intOrPtr _v8;
				struct _OSVERSIONINFOA _v164;
				void* __ebp;
				intOrPtr _t10;

				_t10 =  *0x4d0070; // 0x4961b978
				_v8 = _t10;
				memset( &(_v164.dwMajorVersion), 0, 0x24 << 2);
				_v164.dwOSVersionInfoSize = 0x94;
				GetVersionExA( &_v164);
				return L00475E7E(0 | _v164.dwPlatformId == 0x00000002, _v8);
			}







0x004545cc
0x004545d1
0x004545e4
0x004545eb
0x004545f3
0x00454615

APIs
Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID: Version
  • String ID:
  • API String ID: 1889659487-0
  • Opcode ID: a6317a158be6b642a7a0d8ecdb36c19519e62047182a66bcc3ae9846b6abb23b
  • Instruction ID: f4e8a4803f0127c72950222eb805482c3919c3506089e1e38af734eee89404fc
  • Opcode Fuzzy Hash: a6317a158be6b642a7a0d8ecdb36c19519e62047182a66bcc3ae9846b6abb23b
  • Instruction Fuzzy Hash: E0E065756143049FC720DB78D90575BB7E8EBC9320F004A2DE999C7290D7749508CB47
Uniqueness

Uniqueness Score: -1.00%

Control-flow Graph

  • Executed
  • Not Executed
control_flow_graph 510 442100-44215f 512 442165-4421f0 510->512 513 4424b2-4424bd 510->513 532 4421f2-442209 512->532 533 44220f-442275 512->533 514 4425e7-442607 call 475e7e 513->514 515 4424c3-442510 SHGetSpecialFolderPathA 513->515 521 442545-4425d3 call 402410 * 2 call 402380 515->521 522 442512-442540 call 422150 515->522 534 4425d7-4425dd 521->534 522->534 532->533 543 44249d-4424a1 533->543 544 44227b-4422a9 533->544 534->514 543->513 550 4422e4-4422e7 544->550 551 4422ab-4422d6 544->551 552 442301-44231a 550->552 553 4422e9 550->553 551->550 558 442354-4423c1 552->558 559 44231c-442346 552->559 555 4422f0-4422f6 553->555 555->552 557 4422f8-4422fa 555->557 557->552 561 4422fc-4422ff 557->561 569 4423c3-4423cb 558->569 570 4423cd-4423f5 558->570 559->558 561->552 561->555 571 4423f9-442493 call 402380 * 2 569->571 570->571 571->543
APIs
  • SHGetSpecialFolderPathA.SHELL32 ref: 00442501
Strings
Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID: FolderPathSpecial
  • String ID: 0123456789$Add Slide$C:\exportimage.$Compressor$File Path$File Type$Quality$SOFTWARE\ShowCase\Export$exportimage$exportimage.
  • API String ID: 994120019-1292201558
  • Opcode ID: 99fc8e7ac02f0a52413788e266182b61376f6baab14e1c38266d81fed01f0075
  • Instruction ID: aca192543fa36c264599c5f884f254c38a9c8eca74a1a21f085d8b7c47c34bdd
  • Opcode Fuzzy Hash: 99fc8e7ac02f0a52413788e266182b61376f6baab14e1c38266d81fed01f0075
  • Instruction Fuzzy Hash: 2BE19371108381AFD314DF64DC98B9BBBF8FF99704F00492DF58A92291DB74A509CB6A
Uniqueness

Uniqueness Score: -1.00%

Control-flow Graph

  • Executed
  • Not Executed
control_flow_graph 586 420310-42033e 588 420340-42035c lstrlenW call 475e10 586->588 589 42037e 586->589 588->589 593 42035e-42037c WideCharToMultiByte 588->593 591 420380-420396 589->591 595 4203d8-4203ed 591->595 596 420398-4203b4 lstrlenW call 475e10 591->596 593->591 602 4203ef-42040b lstrlenW call 475e10 595->602 603 42042d 595->603 600 4203d6 596->600 601 4203b6-4203d4 WideCharToMultiByte 596->601 600->595 601->595 602->603 607 42040d-42042b WideCharToMultiByte 602->607 605 42042f-420444 603->605 609 420446-420462 lstrlenW call 475e10 605->609 610 420484 605->610 607->605 609->610 614 420464-420482 WideCharToMultiByte 609->614 612 420486-42049b 610->612 616 4204db 612->616 617 42049d-4204b9 lstrlenW call 475e10 612->617 614->612 619 4204dd-4204f2 616->619 617->616 621 4204bb-4204d9 WideCharToMultiByte 617->621 623 420532 619->623 624 4204f4-420510 lstrlenW call 475e10 619->624 621->619 626 420534-42054d call 4748c2 623->626 624->623 628 420512-420530 WideCharToMultiByte 624->628 632 42054f-4205c8 call 457100 626->632 633 4205cd-420616 626->633 628->626 632->633
C-Code - Quality: 24%
			E00420310(void* __ecx, char* _a4, char* _a8, char* _a12, char* _a16, char* _a20, char* _a24) {
				char _v8;
				intOrPtr _v16;
				int _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				void* _v56;
				signed int _t68;
				signed int _t70;
				signed int _t72;
				signed int _t75;
				signed int _t77;
				signed int _t79;
				void* _t80;
				void* _t86;
				int _t97;
				signed int _t102;
				int _t104;
				signed int _t110;
				int _t112;
				signed int _t117;
				int _t119;
				signed int _t124;
				int _t126;
				signed int _t132;
				int _t134;
				signed int _t139;
				void* _t141;
				short* _t142;
				short* _t143;
				short* _t144;
				short* _t145;
				int _t148;
				int _t149;
				void* _t150;
				void* _t182;
				short* _t183;
				short* _t184;
				int _t186;
				int _t187;
				int _t188;
				int _t189;
				void* _t190;
				char* _t193;
				char* _t194;
				char* _t195;
				char* _t196;
				char* _t197;
				char* _t198;
				intOrPtr _t199;
				char* _t200;

				_t150 = __ecx;
				 *[fs:0x0] = _t199;
				_t200 = _t199 - 0x1c;
				_v20 =  *0x4ce088(_t182, _t190, _t141,  *[fs:0x0], 0x4a7923, 0xffffffff);
				_t183 =  *_a4;
				if(_t183 == 0) {
					L3:
					_t68 = 0;
					L4:
					 *0x4afb90(_t68);
					_t142 =  *_a8;
					_t70 = 0;
					_v8 = 0;
					if(_t142 != 0) {
						_t126 = lstrlenW(_t142);
						_t10 = _t126 + 2; // 0x2
						_t189 = _t126 + _t10;
						L00475E10(_t189 + 0x00000003 & 0xfffffffc,  &_v44);
						_t197 = _t200;
						if(_t197 == 0) {
							_t70 = 0;
						} else {
							 *_t197 = 0;
							_t132 = WideCharToMultiByte(_v20, 0, _t142, 0xffffffff, _t197, _t189, 0, 0);
							asm("sbb eax, eax");
							_t70 =  ~_t132 & _t197;
						}
					}
					 *0x4afb90(_t70);
					_t153 = _a12;
					_t143 =  *_a12;
					_v8 = 1;
					if(_t143 == 0) {
						L11:
						_t72 = 0;
						goto L12;
					} else {
						_t119 = lstrlenW(_t143);
						_t16 = _t119 + 2; // 0x2
						_t188 = _t119 + _t16;
						L00475E10(_t188 + 0x00000003 & 0xfffffffc, _t153);
						_t196 = _t200;
						if(_t196 == 0) {
							goto L11;
						}
						 *_t196 = 0;
						_t124 = WideCharToMultiByte(_v20, 0, _t143, 0xffffffff, _t196, _t188, 0, 0);
						asm("sbb eax, eax");
						_t72 =  ~_t124 & _t196;
						L12:
						 *0x4afb90(_t72);
						_t144 =  *_a16;
						_v8 = 2;
						if(_t144 == 0) {
							L15:
							_t75 = 0;
							L16:
							 *0x4afb90(_t75);
							_t184 =  *_a20;
							_v8 = 3;
							if(_t184 == 0) {
								L19:
								_t77 = 0;
								L20:
								 *0x4afb90(_t77);
								_t157 = _a24;
								_t145 =  *_a24;
								_v8 = 4;
								if(_t145 == 0) {
									L23:
									_t79 = 0;
									L24:
									_t80 =  *0x4afb90(_t79);
									_v8 = 5;
									L004748C2();
									_t191 =  *((intOrPtr*)(_t80 + 4));
									if( *((intOrPtr*)(_t80 + 4)) != 0) {
										_a4 = _t200;
										 *0x4afba4( &_v24,  &_v24);
										_a8 = _t200;
										_v8 = 6;
										 *0x4afba4( &_v28, _t200);
										_a12 = _t200;
										_v8 = 7;
										 *0x4afba4( &_v32, _t200);
										_a16 = _t200;
										_v8 = 8;
										 *0x4afba4();
										_a20 = _t200;
										_v8 = 9;
										 *0x4afba4();
										_a24 = _t200;
										_v8 = 0xa;
										 *0x4afba4();
										_v8 = 5;
										L00457100(_t191,  &_v44, _t200,  &_v40, _t200,  &_v36, _t200);
									}
									 *0x4afb9c();
									 *0x4afb9c();
									 *0x4afb9c();
									 *0x4afb9c();
									 *0x4afb9c();
									_t86 =  *0x4afb9c();
									 *[fs:0x0] = _v16;
									return _t86;
								}
								_t97 = lstrlenW(_t145);
								_t34 = _t97 + 2; // 0x2
								_t186 = _t97 + _t34;
								L00475E10(_t186 + 0x00000003 & 0xfffffffc, _t157);
								_t193 = _t200;
								if(_t193 == 0) {
									goto L23;
								}
								 *_t193 = 0;
								_t102 = WideCharToMultiByte(_v20, 0, _t145, 0xffffffff, _t193, _t186, 0, 0);
								asm("sbb eax, eax");
								_t79 =  ~_t102 & _t193;
								goto L24;
							}
							_t104 = lstrlenW(_t184);
							_t28 = _t104 + 2; // 0x2
							_t148 = _t104 + _t28;
							L00475E10(_t148 + 0x00000003 & 0xfffffffc,  &_v32);
							_t194 = _t200;
							if(_t194 == 0) {
								goto L19;
							}
							 *_t194 = 0;
							_t110 = WideCharToMultiByte(_v20, 0, _t184, 0xffffffff, _t194, _t148, 0, 0);
							asm("sbb eax, eax");
							_t77 =  ~_t110 & _t194;
							goto L20;
						}
						_t112 = lstrlenW(_t144);
						_t22 = _t112 + 2; // 0x2
						_t187 = _t112 + _t22;
						L00475E10(_t187 + 0x00000003 & 0xfffffffc,  &_v36);
						_t195 = _t200;
						if(_t195 == 0) {
							goto L15;
						}
						 *_t195 = 0;
						_t117 = WideCharToMultiByte(_v20, 0, _t144, 0xffffffff, _t195, _t187, 0, 0);
						asm("sbb eax, eax");
						_t75 =  ~_t117 & _t195;
						goto L16;
					}
				}
				_t134 = lstrlenW(_t183);
				_t4 = _t134 + 2; // 0x2
				_t149 = _t134 + _t4;
				L00475E10(_t149 + 0x00000003 & 0xfffffffc, _t150);
				_t198 = _t200;
				if(_t198 == 0) {
					goto L3;
				}
				 *_t198 = 0;
				_t139 = WideCharToMultiByte(_v20, 0, _t183, 0xffffffff, _t198, _t149, 0, 0);
				asm("sbb eax, eax");
				_t68 =  ~_t139 & _t198;
				goto L4;
			}

























































0x00420310
0x00420321
0x00420328
0x00420334
0x0042033a
0x0042033e
0x0042037e
0x0042037e
0x00420380
0x00420384
0x0042038d
0x0042038f
0x00420393
0x00420396
0x00420399
0x0042039f
0x0042039f
0x004203ab
0x004203b0
0x004203b4
0x004203d6
0x004203b6
0x004203c5
0x004203c8
0x004203d0
0x004203d2
0x004203d2
0x004203b4
0x004203dc
0x004203e2
0x004203e5
0x004203e9
0x004203ed
0x0042042d
0x0042042d
0x00000000
0x004203ef
0x004203f0
0x004203f6
0x004203f6
0x00420402
0x00420407
0x0042040b
0x00000000
0x00000000
0x0042041c
0x0042041f
0x00420427
0x00420429
0x0042042f
0x00420433
0x0042043c
0x00420440
0x00420444
0x00420484
0x00420484
0x00420486
0x0042048a
0x00420493
0x00420497
0x0042049b
0x004204db
0x004204db
0x004204dd
0x004204e1
0x004204e7
0x004204ea
0x004204ee
0x004204f2
0x00420532
0x00420532
0x00420534
0x00420538
0x00420540
0x00420543
0x00420548
0x0042054d
0x00420555
0x00420559
0x00420565
0x00420569
0x0042056d
0x00420579
0x0042057d
0x00420581
0x0042058d
0x00420591
0x00420595
0x004205a1
0x004205a5
0x004205a9
0x004205b5
0x004205b9
0x004205bd
0x004205c5
0x004205c8
0x004205c8
0x004205d0
0x004205d9
0x004205e2
0x004205eb
0x004205f4
0x004205fd
0x00420609
0x00420616
0x00420616
0x004204f5
0x004204fb
0x004204fb
0x00420507
0x0042050c
0x00420510
0x00000000
0x00000000
0x00420521
0x00420524
0x0042052c
0x0042052e
0x00000000
0x0042052e
0x0042049e
0x004204a4
0x004204a4
0x004204b0
0x004204b5
0x004204b9
0x00000000
0x00000000
0x004204ca
0x004204cd
0x004204d5
0x004204d7
0x00000000
0x004204d7
0x00420447
0x0042044d
0x0042044d
0x00420459
0x0042045e
0x00420462
0x00000000
0x00000000
0x00420473
0x00420476
0x0042047e
0x00420480
0x00000000
0x00420480
0x004203ed
0x00420341
0x00420347
0x00420347
0x00420353
0x00420358
0x0042035c
0x00000000
0x00000000
0x0042036d
0x00420370
0x00420378
0x0042037a
0x00000000

APIs
  • lstrlenW.KERNEL32 ref: 00420341
  • WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,?,00000002,00000000,00000000), ref: 00420370
  • lstrlenW.KERNEL32(00000002,?,000000FF,?,00000002,00000000,00000000), ref: 00420399
  • WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,?,00000002,00000000,00000000), ref: 004203C8
  • lstrlenW.KERNEL32 ref: 004203F0
  • WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,?,00000002,00000000,00000000), ref: 0042041F
  • lstrlenW.KERNEL32(?,?,000000FF,?,00000002,00000000,00000000), ref: 00420447
  • WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,?,00000002,00000000,00000000), ref: 00420476
  • lstrlenW.KERNEL32(00000002,?,000000FF,?,00000002,00000000,00000000), ref: 0042049E
  • WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,?,00000002,00000000,00000000), ref: 004204CD
  • lstrlenW.KERNEL32(00000002,?,000000FF,?,00000002,00000000,00000000), ref: 004204F5
  • WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,?,00000002,00000000,00000000), ref: 00420524
Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID: ByteCharMultiWidelstrlen
  • String ID:
  • API String ID: 3109718747-0
  • Opcode ID: 380fd90e0d25925d70712aa063a18afc16c66ccbe44748cbf6a473ae3963fa7c
  • Instruction ID: 69613143e88954124ffed7f6244c1e0149c00c3f24790dd7b2b4f8cd79faf90d
  • Opcode Fuzzy Hash: 380fd90e0d25925d70712aa063a18afc16c66ccbe44748cbf6a473ae3963fa7c
  • Instruction Fuzzy Hash: E9A1F272640215ABC710DFA4DC4ABAF7FB8AF4A710F248269F815E73D1C7786904CBA5
Uniqueness

Uniqueness Score: -1.00%

Control-flow Graph

  • Executed
  • Not Executed
control_flow_graph 1457 4362c0-4362df GetClientRect 1458 4362e5-4362eb 1457->1458 1459 43685e-436865 1457->1459 1458->1459 1460 4362f1-4362f7 1458->1460 1460->1459 1461 4362fd-436303 1460->1461 1461->1459 1462 436309-43630f 1461->1462 1462->1459 1463 436315-436335 1462->1463 1464 436337-43633a 1463->1464 1465 43634a-43643a call 474e42 call 4353f0 call 474e42 call 4353f0 call 474e42 call 4353f0 call 474e42 call 4353f0 call 474e42 1463->1465 1464->1465 1467 43633c-436345 call 434cb0 1464->1467 1486 43649f 1465->1486 1487 43643c-43648d GetWindowRect call 474e3c 1465->1487 1467->1465 1489 4364a3-4364c5 call 474e42 call 4748c2 1486->1489 1487->1489 1492 43648f-43649d call 434cb0 1487->1492 1498 4364c7-436505 call 474af6 call 474a00 1489->1498 1499 43651c-436525 call 474af6 1489->1499 1492->1489 1505 436527-43656d call 435030 call 435090 call 474e42 1498->1505 1508 436507-43650a 1498->1508 1499->1505 1517 4365d1-4365e1 call 474e42 1505->1517 1518 43656f-4365c1 GetWindowRect call 474e3c call 434c20 1505->1518 1508->1505 1510 43650c-43651a call 434cb0 1508->1510 1510->1505 1524 4365e3-436638 GetWindowRect call 474e3c call 434c20 1517->1524 1525 436648-43664d 1517->1525 1518->1517 1531 4365c3-4365cc call 434cb0 1518->1531 1524->1525 1543 43663a-436643 call 434cb0 1524->1543 1526 4366a9 1525->1526 1527 43664f-436654 1525->1527 1532 4366af-4366bf call 474e42 1526->1532 1527->1526 1530 436656-43668f GetWindowRect call 474e3c 1527->1530 1530->1532 1544 436691-436696 1530->1544 1531->1517 1541 4366c1-4366f5 GetWindowRect call 474e3c 1532->1541 1542 436705-436715 call 474e42 1532->1542 1541->1542 1552 4366f7-436700 call 434cb0 1541->1552 1553 436717-43674a GetWindowRect call 474e3c 1542->1553 1554 43675a-43676a call 474e42 1542->1554 1543->1525 1544->1532 1548 436698-4366a7 call 434cb0 1544->1548 1548->1532 1552->1542 1553->1554 1563 43674c-436755 call 434cb0 1553->1563 1561 4367af-4367bf call 474e42 1554->1561 1562 43676c-43679f GetWindowRect call 474e3c 1554->1562 1570 4367c1-4367f4 GetWindowRect call 474e3c 1561->1570 1571 436804-436831 call 434c20 1561->1571 1562->1561 1569 4367a1-4367aa call 434cb0 1562->1569 1563->1554 1569->1561 1570->1571 1579 4367f6-4367ff call 434cb0 1570->1579 1577 436833-436838 1571->1577 1578 436846-436858 call 4354e0 InvalidateRect 1571->1578 1577->1578 1580 43683a-436841 call 434cb0 1577->1580 1578->1459 1579->1571 1580->1578
C-Code - Quality: 88%
			E004362C0(void* __ecx) {
				struct HWND__* _t181;
				struct tagRECT* _t182;
				intOrPtr* _t184;
				intOrPtr* _t186;
				intOrPtr* _t188;
				struct HWND__* _t189;
				struct HWND__* _t192;
				struct HWND__* _t193;
				void* _t220;
				intOrPtr _t240;
				intOrPtr _t248;
				struct tagRECT _t253;
				struct HWND__* _t254;
				struct HWND__* _t260;
				intOrPtr _t263;
				void* _t296;
				intOrPtr _t302;
				intOrPtr _t308;
				intOrPtr _t314;
				intOrPtr _t321;
				intOrPtr _t328;
				long _t357;
				struct HWND__* _t393;
				intOrPtr _t394;
				void* _t398;
				void* _t401;
				void* _t402;
				struct HWND__* _t403;
				struct HWND__* _t404;
				struct HWND__* _t405;
				struct HWND__* _t406;
				struct HWND__* _t407;
				struct HWND__* _t408;
				void* _t409;
				struct tagRECT* _t410;
				intOrPtr* _t411;
				intOrPtr* _t412;
				intOrPtr* _t413;

				_t401 = __ecx;
				GetClientRect( *(__ecx + 0x20), _t409 + 0x54);
				_t181 =  *(_t401 + 0x20);
				if(_t181 == 0) {
					L45:
					return _t181;
				}
				_t253 =  *(_t409 + 0x54);
				if(_t253 != 0) {
					goto L45;
				}
				_t357 =  *(_t409 + 0x58);
				if(_t357 != 0) {
					goto L45;
				}
				_t263 =  *((intOrPtr*)(_t409 + 0x5c));
				if(_t263 == 0) {
					goto L45;
				}
				_t181 =  *(_t409 + 0x60);
				if(_t181 == 0) {
					goto L45;
				} else {
					_t402 = _t401 + 0x11c;
					 *(_t409 + 0x28) = _t357;
					 *(_t409 + 0x24) = _t253;
					 *((intOrPtr*)(_t409 + 0x2c)) = _t263;
					 *(_t409 + 0x30) = _t181;
					 *(_t409 + 0x28) = 0xc;
					if(_t402 != 0 &&  *((intOrPtr*)(_t402 + 0x20)) != 0) {
						L00434CB0(_t409 + 0x28, 1);
					}
					_t410 = _t409 - 0x10;
					_t182 = _t410;
					 *_t182 =  *(_t409 + 0x24);
					_t182->top =  *(_t409 + 0x28);
					_t182->right =  *(_t410 + 0x3c);
					_t182->bottom =  *(_t410 + 0x40);
					L00474E42();
					L004353F0(_t401, _t182, 0x43a);
					_t411 = _t410 - 0x10;
					_t184 = _t411;
					 *_t184 =  *((intOrPtr*)(_t410 + 0x24));
					 *((intOrPtr*)(_t184 + 4)) =  *((intOrPtr*)(_t410 + 0x28));
					 *((intOrPtr*)(_t184 + 8)) =  *((intOrPtr*)(_t411 + 0x3c));
					 *((intOrPtr*)(_t184 + 0xc)) =  *((intOrPtr*)(_t411 + 0x40));
					L00474E42();
					L004353F0(_t401, _t184, 0x43b);
					_t412 = _t411 - 0x10;
					_t186 = _t412;
					 *_t186 =  *((intOrPtr*)(_t411 + 0x24));
					 *((intOrPtr*)(_t186 + 4)) =  *((intOrPtr*)(_t411 + 0x28));
					 *((intOrPtr*)(_t186 + 8)) =  *((intOrPtr*)(_t412 + 0x3c));
					 *((intOrPtr*)(_t186 + 0xc)) =  *((intOrPtr*)(_t412 + 0x40));
					L00474E42();
					L004353F0(_t401, _t186, 0x43c);
					_t413 = _t412 - 0x10;
					_t188 = _t413;
					 *_t188 =  *((intOrPtr*)(_t412 + 0x24));
					 *((intOrPtr*)(_t188 + 4)) =  *((intOrPtr*)(_t412 + 0x28));
					 *((intOrPtr*)(_t188 + 8)) =  *((intOrPtr*)(_t413 + 0x3c));
					 *((intOrPtr*)(_t188 + 0xc)) =  *((intOrPtr*)(_t413 + 0x40));
					L00474E42();
					_t189 = L004353F0(_t401, _t188, 0x43d);
					_push(0x45e);
					 *((intOrPtr*)(_t413 + 0x38)) = 0;
					 *((intOrPtr*)(_t413 + 0x3c)) = 0;
					 *((intOrPtr*)(_t413 + 0x40)) = 0;
					 *((intOrPtr*)(_t413 + 0x44)) = 0;
					L00474E42();
					_t254 = _t189;
					if(_t254 == 0) {
						_t393 =  *(_t413 + 0x10);
					} else {
						GetWindowRect( *(_t254 + 0x20), _t413 + 0x34);
						_push(_t413 + 0x34);
						L00474E3C();
						_t248 =  *((intOrPtr*)(_t413 + 0x30)) + 0xfffffffa;
						 *((intOrPtr*)(_t413 + 0x40)) = _t248;
						_t393 =  *((intOrPtr*)(_t413 + 0x40)) -  *((intOrPtr*)(_t413 + 0x38));
						 *((intOrPtr*)(_t413 + 0x38)) = _t248 - _t393;
						 *((intOrPtr*)(_t413 + 0x3c)) =  *((intOrPtr*)(_t413 + 0x2c)) + 0xfffffff4;
						 *(_t413 + 0x34) =  *(_t413 + 0x24) + 0xc;
						_t189 =  *(_t254 + 0x20);
						if(_t189 != 0) {
							_t189 = L00434CB0(_t413 + 0x38, 1);
						}
					}
					_push(0x469);
					L00474E42();
					 *(_t413 + 0x10) = _t189;
					L004748C2();
					_push(0);
					if( *((intOrPtr*)( *((intOrPtr*)(_t189 + 4)) + 0xc4)) == 0) {
						L00474AF6();
						_t394 = 0;
					} else {
						L00474AF6();
						_t260 =  *(_t413 + 0x10);
						_push( *((intOrPtr*)(_t401 + 0x364)));
						L00474A00();
						_t240 =  *((intOrPtr*)(_t413 + 0x30));
						 *((intOrPtr*)(_t413 + 0x40)) = _t240;
						_t394 = 0;
						 *((intOrPtr*)(_t413 + 0x38)) = _t240 - _t393 - 8;
						 *((intOrPtr*)(_t413 + 0x3c)) =  *((intOrPtr*)(_t413 + 0x2c));
						 *(_t413 + 0x34) =  *(_t413 + 0x24);
						if(_t260 != 0 &&  *((intOrPtr*)(_t260 + 0x20)) != 0) {
							L00434CB0(_t413 + 0x38, 1);
						}
					}
					 *((intOrPtr*)(_t413 + 0x4c)) = _t394;
					 *((intOrPtr*)(_t413 + 0x50)) = _t394;
					 *((intOrPtr*)(_t413 + 0x54)) = _t394;
					 *((intOrPtr*)(_t413 + 0x58)) = _t394;
					L00435030(_t402, _t394, _t413 + 0x44);
					_t192 = L00435090(_t402);
					_push(0x438);
					_t398 = ( *((intOrPtr*)(_t413 + 0x50)) -  *((intOrPtr*)(_t413 + 0x48))) * _t192 + 0xc;
					_t256 = 0;
					L00474E42();
					_t403 = _t192;
					if(_t403 != 0) {
						GetWindowRect( *(_t403 + 0x20), _t413 + 0x14);
						_push(_t413 + 0x14);
						L00474E3C();
						_t256 =  *((intOrPtr*)(_t413 + 0x1c)) -  *(_t413 + 0x14);
						L00434C20(_t413 + 0x24,  *((intOrPtr*)(_t413 + 0x2c)) -  *((intOrPtr*)(_t413 + 0x1c)) -  *(_t413 + 0x14) - 0xc,  *((intOrPtr*)(_t413 + 0x1c)) -  *(_t413 + 0x28) + _t398 + 0x38,  *((intOrPtr*)(_t413 + 0x2c)) - 0xc, _t398 + 0x38);
						_t192 =  *(_t403 + 0x20);
						if(_t192 != 0) {
							_t192 = L00434CB0(_t413 + 0x18, 1);
						}
					}
					_push(0x472);
					L00474E42();
					_t404 = _t192;
					if(_t404 != 0) {
						GetWindowRect( *(_t404 + 0x20), _t413 + 0x14);
						_push(_t413 + 0x14);
						L00474E3C();
						L00434C20(_t413 + 0x24,  *((intOrPtr*)(_t413 + 0x1c)) -  *(_t413 + 0x28) - _t256 +  *((intOrPtr*)(_t413 + 0x30)) - 0x18,  *((intOrPtr*)(_t413 + 0x18)) -  *(_t413 + 0x28) + _t398 + 0x38,  *((intOrPtr*)(_t413 + 0x30)) - _t256 - 0x18, _t398 + 0x38);
						if( *(_t404 + 0x20) != 0) {
							L00434CB0(_t413 + 0x18, 1);
						}
					}
					_t193 = _t401 + 0x74;
					if(_t193 != 0 &&  *((intOrPtr*)(_t193 + 0x20)) != 0) {
						GetWindowRect( *(_t401 + 0x94), _t413 + 0x14);
						_push(_t413 + 0x14);
						L00474E3C();
						_t193 =  *((intOrPtr*)(_t413 + 0x20)) -  *((intOrPtr*)(_t413 + 0x18));
						_t328 = _t398 + 0x12;
						 *((intOrPtr*)(_t413 + 0x18)) = _t328;
						 *((intOrPtr*)(_t413 + 0x20)) = _t328 + _t193;
						if(_t404 != 0) {
							_t193 =  *(_t404 + 0x20);
							if(_t193 != 0) {
								_t193 = L00434CB0(_t413 + 0x18, 1);
							}
						}
					}
					_push(0x473);
					L00474E42();
					_t405 = _t193;
					if(_t405 != 0) {
						GetWindowRect( *(_t405 + 0x20), _t413 + 0x14);
						_push(_t413 + 0x14);
						L00474E3C();
						_t220 =  *((intOrPtr*)(_t413 + 0x20)) -  *((intOrPtr*)(_t413 + 0x18));
						_t321 = _t220 + _t398 + 0x12;
						 *((intOrPtr*)(_t413 + 0x18)) = _t321;
						 *((intOrPtr*)(_t413 + 0x20)) = _t321 + _t220;
						_t193 =  *(_t405 + 0x20);
						if(_t193 != 0) {
							_t193 = L00434CB0(_t413 + 0x18, 1);
						}
					}
					_push(0x44d);
					L00474E42();
					_t406 = _t193;
					if(_t406 != 0) {
						GetWindowRect( *(_t406 + 0x20), _t413 + 0x14);
						_push(_t413 + 0x14);
						L00474E3C();
						_t314 = _t398 + 0x12;
						 *((intOrPtr*)(_t413 + 0x18)) = _t314;
						 *((intOrPtr*)(_t413 + 0x20)) = _t314 +  *((intOrPtr*)(_t413 + 0x20)) -  *((intOrPtr*)(_t413 + 0x18));
						_t193 =  *(_t406 + 0x20);
						if(_t193 != 0) {
							_t193 = L00434CB0(_t413 + 0x18, 1);
						}
					}
					_push(0x43f);
					L00474E42();
					_t407 = _t193;
					if(_t407 != 0) {
						GetWindowRect( *(_t407 + 0x20), _t413 + 0x14);
						_push(_t413 + 0x14);
						L00474E3C();
						_t308 = _t398 + 0x12;
						 *((intOrPtr*)(_t413 + 0x18)) = _t308;
						 *((intOrPtr*)(_t413 + 0x20)) = _t308 +  *((intOrPtr*)(_t413 + 0x20)) -  *((intOrPtr*)(_t413 + 0x18));
						_t193 =  *(_t407 + 0x20);
						if(_t193 != 0) {
							_t193 = L00434CB0(_t413 + 0x18, 1);
						}
					}
					_push(0x440);
					L00474E42();
					_t408 = _t193;
					if(_t408 != 0) {
						GetWindowRect( *(_t408 + 0x20), _t413 + 0x14);
						_push(_t413 + 0x14);
						L00474E3C();
						_t302 = _t398 + 0x12;
						 *((intOrPtr*)(_t413 + 0x18)) = _t302;
						 *((intOrPtr*)(_t413 + 0x20)) = _t302 +  *((intOrPtr*)(_t413 + 0x20)) -  *((intOrPtr*)(_t413 + 0x18));
						if( *(_t408 + 0x20) != 0) {
							L00434CB0(_t413 + 0x18, 1);
						}
					}
					L00434C20(_t413 + 0x24,  *(_t413 + 0x24) + 0xc, _t398 + 0x44,  *((intOrPtr*)(_t413 + 0x2c)) + 0xfffffff4,  *((intOrPtr*)(_t413 + 0x30)) + 0xffffffbc);
					_t296 = _t401 + 0x310;
					if(_t296 != 0 &&  *((intOrPtr*)(_t296 + 0x20)) != 0) {
						L00434CB0(_t413 + 0x18, 1);
					}
					L004354E0(_t401);
					return InvalidateRect( *(_t401 + 0x20), _t413 + 0x28, 1);
				}
			}









































0x004362c7
0x004362d2
0x004362d8
0x004362df
0x00436865
0x00436865
0x00436865
0x004362e5
0x004362eb
0x00000000
0x00000000
0x004362f1
0x004362f7
0x00000000
0x00000000
0x004362fd
0x00436303
0x00000000
0x00000000
0x00436309
0x0043630f
0x00000000
0x00436315
0x00436315
0x0043631d
0x00436321
0x00436325
0x00436329
0x0043632d
0x00436335
0x00436345
0x00436345
0x00436352
0x00436355
0x00436357
0x0043635d
0x00436364
0x0043636e
0x00436371
0x00436379
0x00436386
0x00436389
0x0043638b
0x00436391
0x00436398
0x004363a2
0x004363a5
0x004363ad
0x004363ba
0x004363bd
0x004363bf
0x004363c5
0x004363cc
0x004363d6
0x004363d9
0x004363e1
0x004363ee
0x004363f1
0x004363f3
0x004363f9
0x00436400
0x0043640a
0x0043640d
0x00436415
0x0043641a
0x00436421
0x00436425
0x00436429
0x0043642d
0x00436431
0x00436436
0x0043643a
0x0043649f
0x0043643c
0x00436445
0x0043644f
0x00436452
0x00436467
0x0043646a
0x0043646e
0x00436472
0x00436480
0x00436484
0x00436488
0x0043648d
0x00436498
0x00436498
0x0043648d
0x004364a3
0x004364aa
0x004364af
0x004364b3
0x004364c3
0x004364c5
0x00436520
0x00436525
0x004364c7
0x004364c9
0x004364d4
0x004364d8
0x004364db
0x004364e0
0x004364ec
0x004364f5
0x004364f9
0x004364fd
0x00436501
0x00436505
0x00436515
0x00436515
0x00436505
0x0043652f
0x00436533
0x00436537
0x0043653b
0x0043653f
0x00436546
0x00436558
0x0043655f
0x00436562
0x00436564
0x00436569
0x0043656d
0x00436578
0x00436582
0x00436585
0x00436596
0x004365b7
0x004365bc
0x004365c1
0x004365cc
0x004365cc
0x004365c1
0x004365d1
0x004365d8
0x004365dd
0x004365e1
0x004365ec
0x004365f6
0x004365f9
0x0043662e
0x00436638
0x00436643
0x00436643
0x00436638
0x00436648
0x0043664d
0x00436668
0x0043666e
0x00436671
0x0043667e
0x00436680
0x00436683
0x0043668b
0x0043668f
0x00436691
0x00436696
0x004366a2
0x004366a2
0x00436696
0x0043668f
0x004366af
0x004366b6
0x004366bb
0x004366bf
0x004366ca
0x004366d0
0x004366d3
0x004366e0
0x004366e2
0x004366e6
0x004366ec
0x004366f0
0x004366f5
0x00436700
0x00436700
0x004366f5
0x00436705
0x0043670c
0x00436711
0x00436715
0x00436720
0x00436726
0x00436729
0x00436738
0x0043673b
0x00436741
0x00436745
0x0043674a
0x00436755
0x00436755
0x0043674a
0x0043675a
0x00436761
0x00436766
0x0043676a
0x00436775
0x0043677b
0x0043677e
0x0043678d
0x00436790
0x00436796
0x0043679a
0x0043679f
0x004367aa
0x004367aa
0x0043679f
0x004367af
0x004367b6
0x004367bb
0x004367bf
0x004367ca
0x004367d0
0x004367d3
0x004367e2
0x004367e5
0x004367eb
0x004367f4
0x004367ff
0x004367ff
0x004367f4
0x00436824
0x00436829
0x00436831
0x00436841
0x00436841
0x00436848
0x00000000
0x00436858

APIs
  • GetClientRect.USER32(000000FF,?), ref: 004362D2
  • GetWindowRect.USER32(?,?), ref: 00436445
  • GetWindowRect.USER32(?,00000000), ref: 00436578
  • GetWindowRect.USER32(?,00000000), ref: 00436775
  • GetWindowRect.USER32(?,00000000), ref: 004367CA
  • GetWindowRect.USER32(?,00000000), ref: 004365EC
    • Part of subcall function 00434C20: SetRect.USER32(00000472,0000045E,0000045E,0000045E,00000469), ref: 00434C35
  • GetWindowRect.USER32(?,00000000), ref: 00436668
  • GetWindowRect.USER32(?,00000000), ref: 004366CA
  • GetWindowRect.USER32(?,00000000), ref: 00436720
  • InvalidateRect.USER32(000000FF,00000473,00000001,00000466,?,00000359,00000383,00000440,0000043F,0000044D,00000473,00000472,00000438,00000000,?,00000000), ref: 00436858
Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID: Rect$Window$ClientInvalidate
  • String ID:
  • API String ID: 526109194-0
  • Opcode ID: d1d0f6cf6c66a8c50c48e61406e9c97456853f1b3d7240e1a8b1fe2a502138f4
  • Instruction ID: 9681620e045ec8a548e5cd6514841d4ebadc1cb9642f90128dd6637512666b68
  • Opcode Fuzzy Hash: d1d0f6cf6c66a8c50c48e61406e9c97456853f1b3d7240e1a8b1fe2a502138f4
  • Instruction Fuzzy Hash: 30025E712083019FC708DF69C8919AFB7E5BFC8704F019A1EF58997391DB78E9058B9A
Uniqueness

Uniqueness Score: -1.00%

Control-flow Graph

  • Executed
  • Not Executed
control_flow_graph 1585 472690-4726b1 GetActiveWindow GetDC 1586 4726b7-4726bd 1585->1586 1587 47276b-47277c ReleaseDC 1585->1587 1588 4726c3-4726c8 1586->1588 1589 47276a 1586->1589 1588->1589 1590 4726ce-4726d0 1588->1590 1589->1587 1590->1589 1591 4726d6-4726d8 1590->1591 1591->1589 1592 4726de-472710 GetSystemPaletteEntries GetPaletteEntries 1591->1592 1593 472712-472714 1592->1593 1594 472716-47272c 1593->1594 1595 47273a-47273c 1593->1595 1596 472733-472736 1594->1596 1597 47272e 1594->1597 1595->1589 1598 47273e-472750 SetSystemPaletteUse * 2 1595->1598 1596->1593 1599 472738 1596->1599 1597->1596 1600 472756 1598->1600 1601 472752-472754 1598->1601 1599->1598 1602 472759-472764 SelectPalette RealizePalette 1600->1602 1601->1602 1602->1589
C-Code - Quality: 100%
			E00472690(void* __ecx) {
				struct tagPALETTEENTRY _v1024;
				struct tagPALETTEENTRY _v2064;
				void* _t22;
				struct HPALETTE__* _t25;
				void* _t29;
				int _t33;
				int _t35;
				struct HDC__* _t36;
				void* _t37;
				signed int _t40;
				struct HWND__* _t42;
				void* _t43;

				_t37 = __ecx;
				_t42 = GetActiveWindow();
				_t36 = GetDC(_t42);
				if( *((intOrPtr*)(_t37 + 0x10)) != 0) {
					_t29 = _t37 + 8;
					if(_t29 != 0 &&  *(_t29 + 4) != 0 && _t42 != 0 && _t36 != 0) {
						GetSystemPaletteEntries(_t36, 0,  *(_t37 + 4),  &_v1024);
						GetPaletteEntries( *(_t37 + 0xc), 0, 0x100,  &_v2064);
						_t33 = 0;
						_t35 = 0x100;
						_t22 = 0;
						while(_t35 != 0) {
							_t40 =  *(_t43 + _t22 + 0x10) ^  *(_t43 + _t22 + 0x410);
							_t22 = _t22 + 4;
							if((_t40 & 0x00ffffff) != 0) {
								_t33 = 1;
							}
							_t35 = _t35 - 1;
							if(_t33 == 0) {
								continue;
							} else {
								L12:
								SetSystemPaletteUse(_t36, 2);
								SetSystemPaletteUse(_t36, 1);
								if(_t29 != 0) {
									_t25 =  *(_t29 + 4);
								} else {
									_t25 = 0;
								}
								SelectPalette(_t36, _t25, 0);
								RealizePalette(_t36);
							}
							goto L16;
						}
						if(_t33 != 0) {
							goto L12;
						}
					}
					L16:
				}
				return ReleaseDC(_t42, _t36);
			}















0x00472699
0x004726a1
0x004726aa
0x004726b1
0x004726b8
0x004726bd
0x004726ed
0x00472703
0x00472709
0x0047270b
0x00472710
0x00472712
0x0047271a
0x00472721
0x0047272c
0x0047272e
0x0047272e
0x00472733
0x00472736
0x00000000
0x00472738
0x0047273e
0x00472747
0x0047274c
0x00472750
0x00472756
0x00472752
0x00472752
0x00472752
0x0047275d
0x00472764
0x00472764
0x00000000
0x00472736
0x0047273c
0x00000000
0x00000000
0x0047273c
0x0047276a
0x0047276a
0x0047277c

APIs
  • GetActiveWindow.USER32 ref: 0047269B
  • GetDC.USER32(00000000), ref: 004726A4
  • GetSystemPaletteEntries.GDI32(00000000,00000000,?,?), ref: 004726ED
  • GetPaletteEntries.GDI32(?,00000000,00000100,?), ref: 00472703
  • SetSystemPaletteUse.GDI32(00000000,00000002), ref: 00472747
  • SetSystemPaletteUse.GDI32(00000000,00000001), ref: 0047274C
  • SelectPalette.GDI32(00000000,?,00000000), ref: 0047275D
  • RealizePalette.GDI32(00000000), ref: 00472764
  • ReleaseDC.USER32(00000000,00000000), ref: 0047276D
Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID: Palette$System$Entries$ActiveRealizeReleaseSelectWindow
  • String ID:
  • API String ID: 3435016601-0
  • Opcode ID: 5a10ec0a4f041f71578089fca4ea187e9e10c4b14931b66d1286b0ad6a86879c
  • Instruction ID: 56f63aca29a220ea254f7b23e5a56e51f34d52ab24ec03ff324056abf2cf0507
  • Opcode Fuzzy Hash: 5a10ec0a4f041f71578089fca4ea187e9e10c4b14931b66d1286b0ad6a86879c
  • Instruction Fuzzy Hash: BB21B6356003059BD7345B65DF44FB77BA8EF85B00F14C43EB90997281D7A8EC054768
Uniqueness

Uniqueness Score: -1.00%

Control-flow Graph

  • Executed
  • Not Executed
control_flow_graph 1603 468090-4680b8 call 4662d0 1606 468684-46869c 1603->1606 1607 4680be-4680cd 1603->1607 1608 468665-46867f call 464e20 call 465f60 1607->1608 1609 4680d3-4680d7 1607->1609 1608->1606 1609->1608 1610 4680dd-4680e8 1609->1610 1610->1606 1612 4680ee-4680f7 1610->1612 1612->1606 1614 4680fd-468121 call 441a10 call 4748c2 1612->1614 1620 468127-46812f 1614->1620 1621 46864f-468663 call 441f00 1614->1621 1623 468131-468139 1620->1623 1624 46813f 1620->1624 1621->1606 1623->1624 1626 46813b-46813d 1623->1626 1627 468144-468157 call 4749a0 1624->1627 1626->1627 1630 46815d-4681b3 call 460c20 call 460c50 1627->1630 1631 46862a-468632 1627->1631 1641 4682de-4682f0 call 474c6a 1630->1641 1642 4681b9-4682d8 call 4612f0 * 2 call 402380 call 402410 call 402380 call 474e4e 1630->1642 1631->1621 1633 468634-46863e 1631->1633 1633->1621 1635 468640-468644 1633->1635 1635->1621 1637 468646-468648 1635->1637 1639 46864a call 466190 1637->1639 1639->1621 1647 468386 1641->1647 1648 4682f6-468384 call 4612f0 call 402410 call 402380 1641->1648 1642->1641 1651 4685fd-46861c call 474c5e 1642->1651 1650 46838c 1647->1650 1647->1651 1648->1647 1654 468390-4683a3 call 424b90 1650->1654 1651->1631 1654->1651 1663 4683a9-4683bc call 45c3d0 call 474d7c 1654->1663 1678 468566-4685f7 call 4612f0 call 402410 call 402380 1663->1678 1679 4683c2-4683cc 1663->1679 1678->1651 1678->1654 1681 4683ce-4683d7 call 45ca70 1679->1681 1682 4683dc-4683ed call 4615e0 1679->1682 1681->1682 1695 4683f3-468404 1682->1695 1696 46849a-4684a6 1682->1696 1707 468406-468412 call 4461a0 1695->1707 1708 468417-468428 1695->1708 1699 4684c0-4684c9 1696->1699 1700 4684a8-4684b0 1696->1700 1699->1678 1705 4684cf-4684d1 1699->1705 1700->1699 1704 4684b2-4684ba 1700->1704 1704->1678 1704->1699 1705->1678 1706 4684d7-4684f3 call 44d200 call 44ec40 1705->1706 1726 468555-468561 call 44ec20 1706->1726 1727 4684f5-468506 1706->1727 1707->1696 1720 46842a-468437 call 446360 1708->1720 1721 468439-46844a 1708->1721 1720->1696 1732 46848e-468495 call 446170 1721->1732 1733 46844c-46845d 1721->1733 1726->1678 1739 468528-46853f call 44dea0 1727->1739 1740 468508-468526 call 44dca0 1727->1740 1732->1696 1733->1732 1742 46845f-468470 1733->1742 1750 468544-46854f call 44ec30 MessageBeep 1739->1750 1740->1750 1751 468472-46847e call 446110 1742->1751 1752 468480-46848c call 446110 1742->1752 1750->1726 1751->1696 1752->1696
C-Code - Quality: 37%
			E00468090(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				int _t130;
				intOrPtr _t131;
				void* _t135;
				int _t136;
				void* _t148;
				void* _t151;
				void* _t152;
				void* _t153;
				int _t158;
				int _t160;
				void* _t165;
				void* _t168;
				void* _t186;
				void* _t187;
				void* _t189;
				void* _t203;
				void* _t204;
				void* _t206;
				int _t210;
				int _t216;
				void* _t230;
				void* _t231;
				void* _t239;
				void* _t253;
				void* _t315;
				int _t317;
				intOrPtr _t319;
				int _t320;
				void* _t322;
				void* _t323;
				void* _t336;

				_push(0xffffffff);
				_push(0x4ace4a);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t319;
				_t320 = _t319 - 0xd4;
				_push(_t317);
				_t315 = __ecx;
				_t130 = L004662D0(__ecx);
				if(_t130 == 0) {
					L51:
					 *[fs:0x0] =  *((intOrPtr*)(_t320 + 0xe4));
					return _t130;
				}
				_t131 =  *((intOrPtr*)(__ecx + 0x90));
				_t216 = 6;
				if(_t131 == 6 || _t131 == 7) {
					L00464E20(_t315,  *((intOrPtr*)(_t315 + 0xa8)));
					 *(_t315 + 0x12c) = 0;
					_t130 = L00465F60(_t315);
					goto L51;
				} else {
					_t130 =  *( *((intOrPtr*)(__ecx + 0x98)) + 4);
					if(_t130 == 0) {
						goto L51;
					}
					_t313 =  *(_t130 + 8);
					 *(_t320 + 0x1c) = _t313;
					if(_t313 <= 0) {
						goto L51;
					}
					_t135 = L00441A10(_t320 + 0x4c, 0);
					 *(_t320 + 0xec) = 0;
					L004748C2();
					_t130 =  *(_t135 + 4);
					 *(_t320 + 0x38) = _t130;
					if(_t130 == 0) {
						L49:
						 *(_t320 + 0xec) = 0xffffffff;
						L00441F00();
						goto L51;
					} else {
						if( *((intOrPtr*)(_t130 + 0xe4)) != 0 ||  *((intOrPtr*)(_t130 + 0xd4)) != 0) {
							_t136 = 1;
						} else {
							_t136 = 0;
						}
						 *((intOrPtr*)(_t320 + 0xdc)) = _t136;
						L004749A0();
						if(_t136 != 1) {
							L45:
							_t130 =  *(_t315 + 0x138);
							if(_t130 != 0) {
								_t130 =  *((intOrPtr*)(_t315 + 0x90));
								if(_t130 > 0 && _t130 < 4) {
									_t130 = E00466190(_t216, _t315, _t313, _t317, 1);
								}
							}
							goto L49;
						}
						L00460C20(_t320 + 0x10);
						 *(_t320 + 0xf0) = 1;
						L00460C50(_t320 + 0x14);
						_t230 = _t320 + 0x18;
						 *((char*)(_t320 + 0xf4)) = 2;
						 *0x4afb60(_t320 + 0x24,  *((intOrPtr*)( *((intOrPtr*)(_t320 + 0x10)) - 0xc)) -  *((intOrPtr*)( *((intOrPtr*)(_t320 + 0x14)) - 0xc)) - 1);
						 *(_t320 + 0xec) = 3;
						if(_t313 <= 1) {
							L13:
							_t231 = _t315;
							L00474C6A();
							_t216 =  *(_t320 + 0x1c);
							_t317 = 1;
							if(_t216 > 1) {
								 *(_t320 + 0x28) = _t320;
								 *0x4afba4(_t320 + 0x2c, _t231, 0x4b03c0, _t320 + 0x14);
								_t186 = L004612F0(_t320 + 0x34, 1);
								 *((char*)(_t320 + 0xfc)) = 0xa;
								_t187 = E00402410(_t315, _t320 + 0x24, _t186);
								_t323 = _t320 + 0xc;
								 *((char*)(_t323 + 0xf8)) = 0xb;
								_t189 = E00402380(_t315, _t323 + 0x24, _t187);
								_t320 = _t323 + 0xc;
								 *(_t320 + 0xf0) = 0xc;
								 *0x4afb64(_t189);
								 *0x4afb9c();
								 *0x4afb9c();
								 *(_t320 + 0xec) = 3;
								 *0x4afb9c();
								_t336 = _t216 - 1;
							}
							if(_t336 < 0) {
								L44:
								L00474C5E();
								 *0x4afb9c();
								 *0x4afb9c();
								 *(_t320 + 0xec) = 0;
								 *0x4afb9c();
								goto L45;
							}
							while(L00424B90( *((intOrPtr*)(_t315 + 0x98)), _t317, _t320 + 0x1c) != 0) {
								_t148 = E0045C3D0();
								_t313 =  *(_t320 + 0x1c);
								_push(_t148);
								L00474D7C();
								if(_t148 == 0) {
									L43:
									_t239 = _t320 + 0x14;
									 *(_t320 + 0x38) = _t320;
									_t317 = _t317 + 1;
									 *0x4afba4(_t320 + 0x2c, _t239, 0x4b03c0, _t239);
									_t151 = L004612F0(_t320 + 0x40, _t317);
									 *((char*)(_t320 + 0xfc)) = 0xe;
									_t152 = E00402410(_t320 + 0x30, _t320 + 0x30, _t151);
									_t322 = _t320 + 0xc;
									 *((char*)(_t322 + 0xf8)) = 0xf;
									_t153 = E00402380(_t320 + 0x30, _t322 + 0x20, _t152);
									_t320 = _t322 + 0xc;
									 *(_t320 + 0xf0) = 0x10;
									 *0x4afb64(_t153);
									 *0x4afb9c();
									 *0x4afb9c();
									 *(_t320 + 0xec) = 3;
									 *0x4afb9c();
									if(_t317 <= _t216) {
										continue;
									}
									goto L44;
								}
								_t158 = 0;
								if( *(_t313 + 0xc8) == 0) {
									L0045CA70(_t216, _t313, _t313, _t315, _t317, 1);
									_t158 = 1;
								}
								_push(_t158);
								L004615E0(_t315, _t313);
								_t313 =  *(_t313 + 0xc8);
								if(_t313 == 0) {
									L32:
									_t160 =  *(_t320 + 0x38);
									if( *((intOrPtr*)(_t160 + 0xe4)) != 0 ||  *((intOrPtr*)(_t160 + 0xd8)) != 0 ||  *((intOrPtr*)(_t160 + 0xd4)) != 0) {
										if( *((intOrPtr*)(_t320 + 0xbc)) != 0 && _t313 != 0) {
											L0044D200(_t320 + 0x3c);
											 *(_t320 + 0xec) = 0xd;
											if(L0044EC40(_t320 + 0x3c) != 0) {
												_t253 = _t320 + 0x18;
												_t165 =  *0x4afb6c("avi");
												if(_t165 != 0) {
													 *(_t320 + 0x30) = _t320;
													 *0x4afba4(_t320 + 0x14, _t253);
													_t168 = L0044DEA0(_t216, _t320 + 0x44, _t313, _t315, _t313);
												} else {
													 *(_t320 + 0x38) = _t320;
													 *0x4afba4(_t165);
													_t168 = L0044DCA0(_t320 + 0x4c, _t313, _t320 + 0x1c, _t253, _t165);
												}
												L0044EC30(_t168, _t320 + 0x3c);
												_t163 = MessageBeep(0);
											}
											 *(_t320 + 0xec) = 3;
											L0044EC20(_t163, _t320 + 0x3c);
										}
									}
									goto L43;
								} else {
									_push("jpg");
									if( *0x4afb6c() != 0) {
										_push("avi");
										if( *0x4afb6c() != 0) {
											_push("tif");
											if( *0x4afb6c() == 0) {
												L31:
												E00446170(_t313,  *((intOrPtr*)(_t320 + 0x10)));
												goto L32;
											}
											_push("tiff");
											if( *0x4afb6c() == 0) {
												goto L31;
											}
											_push("bmp");
											if( *0x4afb6c() != 0) {
												E00446110(_t313,  *((intOrPtr*)(_t320 + 0x10)));
											} else {
												E00446110(_t313,  *((intOrPtr*)(_t320 + 0x10)));
											}
											goto L32;
										}
										E00446360(_t313,  *((intOrPtr*)(_t320 + 0x14)), _t172);
										goto L32;
									}
									E004461A0(_t313,  *((intOrPtr*)(_t320 + 0x10)));
									goto L32;
								}
							}
							goto L44;
						}
						 *(_t320 + 0x1c) = _t320;
						 *0x4afba4(_t320 + 0x24, _t230);
						L004612F0(_t320 + 0x34, 1);
						 *(_t320 + 0x1c) = _t320;
						 *((char*)(_t320 + 0xf4)) = 4;
						 *0x4afba4(_t320 + 0x24, _t315);
						L004612F0(_t320 + 0x3c, _t313);
						 *0x4af2c0();
						 *(_t320 + 0xf0) = _t216;
						 *0x4af2bc(0xf006);
						_t203 = E00402380(_t320 + 0x2c, _t320 + 0x20, _t320 + 0x2c);
						 *((char*)(_t320 + 0x104)) = 7;
						_t204 = E00402410(_t320 + 0x38, _t320 + 0x38, _t203);
						 *((char*)(_t320 + 0x110)) = 8;
						_t206 = E00402380(_t320 + 0x38, _t320 + 0x50, _t204);
						_t320 = _t320 + 0x24;
						 *(_t320 + 0xf0) = 9;
						 *0x4afb64(_t206, _t320 + 0x4c, " - ", _t320 + 0x2c);
						 *0x4afb9c();
						 *0x4afb9c();
						 *(_t320 + 0xec) = _t216;
						_t210 =  *0x4afb9c();
						L00474E4E();
						_t313 = _t210;
						 *0x4afb9c( *(_t320 + 0x28), 1, 0);
						 *0x4afb9c();
						 *(_t320 + 0xec) = 3;
						 *0x4afb9c();
						if(_t210 != 1) {
							goto L44;
						}
						goto L13;
					}
				}
			}






































0x00468090
0x00468098
0x0046809d
0x0046809e
0x004680a5
0x004680ac
0x004680af
0x004680b1
0x004680b8
0x00468684
0x0046868e
0x0046869c
0x0046869c
0x004680be
0x004680c5
0x004680cd
0x0046866e
0x00468675
0x0046867f
0x00000000
0x004680dd
0x004680e3
0x004680e8
0x00000000
0x00000000
0x004680ee
0x004680f3
0x004680f7
0x00000000
0x00000000
0x00468103
0x00468108
0x00468113
0x00468118
0x0046811d
0x00468121
0x0046864f
0x00468653
0x0046865e
0x00000000
0x00468127
0x0046812f
0x0046813f
0x0046813b
0x0046813b
0x0046813b
0x00468148
0x0046814f
0x00468157
0x0046862a
0x0046862a
0x00468632
0x00468634
0x0046863e
0x0046864a
0x0046864a
0x0046863e
0x00000000
0x00468632
0x00468166
0x00468174
0x0046817c
0x00468196
0x0046819a
0x004681a2
0x004681ab
0x004681b3
0x004682de
0x004682de
0x004682e0
0x004682e5
0x004682e9
0x004682f0
0x00468307
0x0046830c
0x0046831a
0x00468325
0x0046832d
0x00468332
0x0046833b
0x00468343
0x00468348
0x00468350
0x00468358
0x00468362
0x0046836c
0x00468376
0x0046837e
0x00468384
0x00468384
0x00468386
0x004685fd
0x004685ff
0x00468608
0x00468612
0x0046861c
0x00468624
0x00000000
0x00468624
0x00468390
0x004683a9
0x004683ae
0x004683b2
0x004683b5
0x004683bc
0x00468566
0x00468566
0x00468577
0x0046857c
0x0046857d
0x0046858b
0x00468596
0x0046859e
0x004685a3
0x004685ac
0x004685b4
0x004685b9
0x004685c1
0x004685c9
0x004685d3
0x004685dd
0x004685e7
0x004685ef
0x004685f7
0x00000000
0x00000000
0x00000000
0x004685f7
0x004683c8
0x004683cc
0x004683d2
0x004683d7
0x004683d7
0x004683dc
0x004683e0
0x004683e5
0x004683ed
0x0046849a
0x0046849a
0x004684a6
0x004684c9
0x004684db
0x004684e4
0x004684f3
0x004684fa
0x004684fe
0x00468506
0x0046852f
0x00468534
0x0046853f
0x00468508
0x00468511
0x00468516
0x00468521
0x00468521
0x00468548
0x0046854f
0x0046854f
0x00468559
0x00468561
0x00468561
0x004684c9
0x00000000
0x004683f3
0x004683f3
0x00468404
0x00468417
0x00468428
0x00468439
0x0046844a
0x0046848e
0x00468495
0x00000000
0x00468495
0x0046844c
0x0046845d
0x00000000
0x00000000
0x0046845f
0x00468470
0x00468487
0x00468472
0x00468479
0x00468479
0x00000000
0x00468470
0x00468432
0x00000000
0x00468432
0x0046840d
0x00000000
0x0046840d
0x004683ed
0x00000000
0x00468390
0x004681c0
0x004681c5
0x004681d4
0x004681e0
0x004681e5
0x004681ed
0x004681fb
0x00468204
0x00468213
0x0046821a
0x0046822f
0x0046823f
0x00468247
0x00468257
0x0046825f
0x00468264
0x0046826c
0x00468274
0x0046827e
0x00468288
0x00468292
0x00468299
0x004682a8
0x004682b1
0x004682b3
0x004682bd
0x004682c7
0x004682cf
0x004682d8
0x00000000
0x00000000
0x00000000
0x004682d8
0x00468121

APIs
  • MessageBeep.USER32(00000000), ref: 0046854F
    • Part of subcall function 00466190: Sleep.KERNEL32(00000064), ref: 00466252
Strings
Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID: BeepMessageSleep
  • String ID: - $avi$bmp$jpg$tif$tiff
  • API String ID: 3757106585-2234846227
  • Opcode ID: da1365f519ccac490a5f487a4e66acbdefbf78f48ee6dfb815946e245cc3c339
  • Instruction ID: 328c70b909ac7b094b482ddc086adb3111dcac5ec404f5fd6f8cf32db6dd9845
  • Opcode Fuzzy Hash: da1365f519ccac490a5f487a4e66acbdefbf78f48ee6dfb815946e245cc3c339
  • Instruction Fuzzy Hash: 13F1CA702083419FD714DF61C855BAFBBE8AF95704F04492EF48A93291EF78A509CB6B
Uniqueness

Uniqueness Score: -1.00%

Control-flow Graph

  • Executed
  • Not Executed
control_flow_graph 1786 4206f0-42071e 1788 420720-42073c lstrlenW call 475e10 1786->1788 1789 42075e 1786->1789 1788->1789 1793 42073e-42075c WideCharToMultiByte 1788->1793 1791 420760-420776 1789->1791 1795 4207b8-4207cd 1791->1795 1796 420778-420794 lstrlenW call 475e10 1791->1796 1793->1791 1800 4207cf-4207eb lstrlenW call 475e10 1795->1800 1801 42080d 1795->1801 1802 4207b6 1796->1802 1803 420796-4207b4 WideCharToMultiByte 1796->1803 1800->1801 1807 4207ed-42080b WideCharToMultiByte 1800->1807 1805 42080f-420824 1801->1805 1802->1795 1803->1795 1809 420826-420842 lstrlenW call 475e10 1805->1809 1810 420864 1805->1810 1807->1805 1809->1810 1814 420844-420862 WideCharToMultiByte 1809->1814 1812 420866-42087e call 4748c2 1810->1812 1818 420880-4208d2 call 456c70 1812->1818 1819 4208d7-42090e 1812->1819 1814->1812 1818->1819
C-Code - Quality: 25%
			E004206F0(void* __ecx, void* __fp0, char* _a4, char* _a8, char* _a12, char* _a16) {
				char _v8;
				intOrPtr _v16;
				int _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				void* _v48;
				signed int _t48;
				signed int _t50;
				signed int _t52;
				signed int _t55;
				void* _t56;
				void* _t60;
				int _t68;
				signed int _t73;
				int _t75;
				signed int _t80;
				int _t82;
				signed int _t88;
				int _t90;
				signed int _t95;
				void* _t97;
				short* _t98;
				short* _t99;
				short* _t100;
				int _t102;
				void* _t103;
				void* _t125;
				short* _t126;
				int _t128;
				int _t129;
				int _t130;
				void* _t131;
				char* _t134;
				char* _t135;
				char* _t136;
				char* _t137;
				intOrPtr _t138;
				char* _t139;
				void* _t150;

				_t150 = __fp0;
				_t103 = __ecx;
				 *[fs:0x0] = _t138;
				_t139 = _t138 - 0x14;
				_v20 =  *0x4ce088(_t125, _t131, _t97,  *[fs:0x0], 0x4a798f, 0xffffffff);
				_t126 =  *_a4;
				if(_t126 == 0) {
					L3:
					_t48 = 0;
					L4:
					 *0x4afb90(_t48);
					_t98 =  *_a8;
					_t50 = 0;
					_v8 = 0;
					if(_t98 != 0) {
						_t82 = lstrlenW(_t98);
						_t10 = _t82 + 2; // 0x2
						_t130 = _t82 + _t10;
						L00475E10(_t130 + 0x00000003 & 0xfffffffc,  &_v36);
						_t136 = _t139;
						if(_t136 == 0) {
							_t50 = 0;
						} else {
							 *_t136 = 0;
							_t88 = WideCharToMultiByte(_v20, 0, _t98, 0xffffffff, _t136, _t130, 0, 0);
							asm("sbb eax, eax");
							_t50 =  ~_t88 & _t136;
						}
					}
					 *0x4afb90(_t50);
					_t106 = _a12;
					_t99 =  *_a12;
					_v8 = 1;
					if(_t99 == 0) {
						L11:
						_t52 = 0;
						goto L12;
					} else {
						_t75 = lstrlenW(_t99);
						_t16 = _t75 + 2; // 0x2
						_t129 = _t75 + _t16;
						L00475E10(_t129 + 0x00000003 & 0xfffffffc, _t106);
						_t135 = _t139;
						if(_t135 == 0) {
							goto L11;
						}
						 *_t135 = 0;
						_t80 = WideCharToMultiByte(_v20, 0, _t99, 0xffffffff, _t135, _t129, 0, 0);
						asm("sbb eax, eax");
						_t52 =  ~_t80 & _t135;
						L12:
						 *0x4afb90(_t52);
						_t100 =  *_a16;
						_v8 = 2;
						if(_t100 == 0) {
							L15:
							_t55 = 0;
							L16:
							_t56 =  *0x4afb90(_t55);
							_v8 = 3;
							L004748C2();
							_t132 =  *((intOrPtr*)(_t56 + 4));
							if( *((intOrPtr*)(_t56 + 4)) != 0) {
								_a4 = _t139;
								 *0x4afba4( &_v24,  &_v24);
								_a8 = _t139;
								_v8 = 4;
								 *0x4afba4( &_v28, _t139);
								_a12 = _t139;
								_v8 = 5;
								 *0x4afba4();
								_a16 = _t139;
								_v8 = 6;
								 *0x4afba4();
								_v8 = 3;
								L00456C70(_t132, _t150,  &_v36, _t139,  &_v32, _t139);
							}
							 *0x4afb9c();
							 *0x4afb9c();
							 *0x4afb9c();
							_t60 =  *0x4afb9c();
							 *[fs:0x0] = _v16;
							return _t60;
						}
						_t68 = lstrlenW(_t100);
						_t22 = _t68 + 2; // 0x2
						_t128 = _t68 + _t22;
						L00475E10(_t128 + 0x00000003 & 0xfffffffc,  &_v28);
						_t134 = _t139;
						if(_t134 == 0) {
							goto L15;
						}
						 *_t134 = 0;
						_t73 = WideCharToMultiByte(_v20, 0, _t100, 0xffffffff, _t134, _t128, 0, 0);
						asm("sbb eax, eax");
						_t55 =  ~_t73 & _t134;
						goto L16;
					}
				}
				_t90 = lstrlenW(_t126);
				_t4 = _t90 + 2; // 0x2
				_t102 = _t90 + _t4;
				L00475E10(_t102 + 0x00000003 & 0xfffffffc, _t103);
				_t137 = _t139;
				if(_t137 == 0) {
					goto L3;
				}
				 *_t137 = 0;
				_t95 = WideCharToMultiByte(_v20, 0, _t126, 0xffffffff, _t137, _t102, 0, 0);
				asm("sbb eax, eax");
				_t48 =  ~_t95 & _t137;
				goto L4;
			}












































0x004206f0
0x004206f0
0x00420701
0x00420708
0x00420714
0x0042071a
0x0042071e
0x0042075e
0x0042075e
0x00420760
0x00420764
0x0042076d
0x0042076f
0x00420773
0x00420776
0x00420779
0x0042077f
0x0042077f
0x0042078b
0x00420790
0x00420794
0x004207b6
0x00420796
0x004207a5
0x004207a8
0x004207b0
0x004207b2
0x004207b2
0x00420794
0x004207bc
0x004207c2
0x004207c5
0x004207c9
0x004207cd
0x0042080d
0x0042080d
0x00000000
0x004207cf
0x004207d0
0x004207d6
0x004207d6
0x004207e2
0x004207e7
0x004207eb
0x00000000
0x00000000
0x004207fc
0x004207ff
0x00420807
0x00420809
0x0042080f
0x00420813
0x0042081c
0x00420820
0x00420824
0x00420864
0x00420864
0x00420866
0x0042086a
0x00420870
0x00420874
0x00420879
0x0042087e
0x00420886
0x0042088a
0x00420896
0x0042089a
0x0042089e
0x004208aa
0x004208ae
0x004208b2
0x004208be
0x004208c2
0x004208c6
0x004208ce
0x004208d2
0x004208d2
0x004208da
0x004208e3
0x004208ec
0x004208f5
0x00420901
0x0042090e
0x0042090e
0x00420827
0x0042082d
0x0042082d
0x00420839
0x0042083e
0x00420842
0x00000000
0x00000000
0x00420853
0x00420856
0x0042085e
0x00420860
0x00000000
0x00420860
0x004207cd
0x00420721
0x00420727
0x00420727
0x00420733
0x00420738
0x0042073c
0x00000000
0x00000000
0x0042074d
0x00420750
0x00420758
0x0042075a
0x00000000

APIs
  • lstrlenW.KERNEL32 ref: 00420721
  • WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,?,00000002,00000000,00000000), ref: 00420750
  • lstrlenW.KERNEL32(00000002,?,000000FF,?,00000002,00000000,00000000), ref: 00420779
  • WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,?,00000002,00000000,00000000), ref: 004207A8
  • lstrlenW.KERNEL32 ref: 004207D0
  • WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,?,00000002,00000000,00000000), ref: 004207FF
  • lstrlenW.KERNEL32(?,?,000000FF,?,00000002,00000000,00000000), ref: 00420827
  • WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,?,00000002,00000000,00000000), ref: 00420856
Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID: ByteCharMultiWidelstrlen
  • String ID:
  • API String ID: 3109718747-0
  • Opcode ID: 5436fd4a88d1c5da842e181e73c3907e5809666aa925e60fe334612a6eda08a1
  • Instruction ID: 3a2e6fd47898cca361f16147a7b4a7dcfd8f557bc3f6f69aea4dcef54166f645
  • Opcode Fuzzy Hash: 5436fd4a88d1c5da842e181e73c3907e5809666aa925e60fe334612a6eda08a1
  • Instruction Fuzzy Hash: F761B272600215ABC710DBA4DC4ABAF7FB8AF46710F244669F815E73D1C7786904CBA5
Uniqueness

Uniqueness Score: -1.00%

Control-flow Graph

C-Code - Quality: 80%
			E00466440(void* __ecx) {
				intOrPtr _v12;
				intOrPtr _v16;
				char _v36;
				intOrPtr _v40;
				long _v44;
				struct tagRECT _v60;
				intOrPtr _v64;
				struct HBRUSH__* _v68;
				long _v72;
				struct tagRECT _v88;
				struct HBRUSH__* _v92;
				long _v96;
				struct tagRECT _v112;
				struct HBRUSH__* _v116;
				intOrPtr _v132;
				int _t62;
				void* _t113;
				int _t116;
				intOrPtr _t118;

				_push(0xffffffff);
				_push(0x4acc18);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t118;
				_t113 = __ecx;
				_t62 = GetDC( *(__ecx + 0x20));
				_push(_t62);
				L0047530A();
				_t116 = _t62;
				if(_t116 != 0) {
					_push(0);
					L004754B4();
					_push( *((intOrPtr*)(_t113 + 0x70)));
					_push( &_v36);
					_v12 = 0;
					L00462AC0(_t113);
					GetClientRect( *(_t113 + 0x20),  &_v60);
					_v88.bottom.left = _v60.left;
					_v72 = _v60.top;
					_v68 = _v60.right;
					_v64 = _v60.bottom;
					_v64 = _v40;
					FillRect( *(_t116 + 4),  &(_v88.bottom), _v88.right);
					_v88.top = _v44;
					_v88.bottom.left = _v60.left;
					FillRect( *(_t116 + 4),  &_v88, _v92);
					_v112.bottom.left = _v88.top;
					_v92 = _v88.bottom.left;
					_v96 = _v88.right;
					_v88.left = _v72;
					_v92 = _v68;
					FillRect( *(_t116 + 4),  &(_v112.bottom), _v112.right);
					_v112.left = _v96;
					_v112.top = _v92;
					_v112.right = _v88.left;
					_v112.bottom.left = _v88.top;
					_v112.left = _v72;
					FillRect( *(_t116 + 4),  &_v112, _v116);
					_t62 = ReleaseDC( *(_t113 + 0x20),  *(_t116 + 4));
					_v68 = 0xffffffff;
					_v132 = 0x4b1d74;
					L00474CB2();
				}
				 *[fs:0x0] = _v16;
				return _t62;
			}






















0x00466446
0x00466448
0x0046644d
0x0046644e
0x0046645a
0x00466460
0x00466466
0x00466467
0x0046646c
0x00466470
0x00466477
0x0046647d
0x00466485
0x0046648a
0x0046648d
0x00466495
0x004664a3
0x004664bb
0x004664c3
0x004664cb
0x004664d3
0x004664dc
0x004664e5
0x004664f3
0x004664fc
0x00466505
0x00466513
0x0046651b
0x00466523
0x0046652b
0x00466534
0x0046653d
0x0046654b
0x00466553
0x0046655b
0x00466563
0x0046656c
0x00466575
0x0046657f
0x00466589
0x00466591
0x00466599
0x0046659e
0x004665a5
0x004665af

APIs
  • GetDC.USER32(?), ref: 00466460
    • Part of subcall function 00462AC0: GetClientRect.USER32(?,?), ref: 00462BA6
  • GetClientRect.USER32(?,?), ref: 004664A3
  • FillRect.USER32(?,?,?), ref: 004664E5
  • FillRect.USER32(?,?,?), ref: 00466505
  • FillRect.USER32(?,?,?), ref: 0046653D
  • FillRect.USER32(?,?,?), ref: 00466575
  • ReleaseDC.USER32(?,?), ref: 0046657F
Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID: Rect$Fill$Client$Release
  • String ID:
  • API String ID: 4057529198-0
  • Opcode ID: 1cf709c128a34238dcef25dbf71cc78b162279c735cef733ce251228db5524b2
  • Instruction ID: 015fa8d671547128e967cc642577a52eb331a8c46b52fad31bfac400981b1e52
  • Opcode Fuzzy Hash: 1cf709c128a34238dcef25dbf71cc78b162279c735cef733ce251228db5524b2
  • Instruction Fuzzy Hash: 4A419FB5608741AFC308CF59C98096BBBE5FBC8714F008A1EF89993750D774E909CBA6
Uniqueness

Uniqueness Score: -1.00%

Control-flow Graph

  • Executed
  • Not Executed
control_flow_graph 2047 4548f0-4548fa call 454620 2050 454912-45491c 2047->2050 2051 4548fc-45490f 2047->2051 2052 4549a5-4549ac 2050->2052 2053 454922-45492a 2050->2053 2053->2052 2055 45492c-45492f 2053->2055 2055->2052 2056 454931-454942 SystemParametersInfoA 2055->2056 2056->2052 2057 454944-454985 GetSystemMetrics * 2 2056->2057 2058 454987-454992 lstrcpyn 2057->2058 2059 454998-4549a2 2057->2059 2058->2059
C-Code - Quality: 58%
			E004548F0(intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				void _v16;
				intOrPtr* _t24;
				intOrPtr* _t42;

				if(E00454620() == 0) {
					if(_a4 != 0x12340042) {
						L9:
						return 0;
					} else {
						_t42 = _a8;
						if(_t42 == 0 ||  *_t42 < 0x28 || SystemParametersInfoA(0x30, 0,  &_v16, 0) == 0) {
							goto L9;
						} else {
							 *((intOrPtr*)(_t42 + 4)) = 0;
							 *((intOrPtr*)(_t42 + 8)) = 0;
							 *((intOrPtr*)(_t42 + 0xc)) = GetSystemMetrics(0);
							 *((intOrPtr*)(_t42 + 0x10)) = GetSystemMetrics(1);
							_t24 = _t42 + 0x14;
							 *_t24 = _v16;
							 *((intOrPtr*)(_t24 + 4)) = _v12;
							 *((intOrPtr*)(_t24 + 8)) = _v8;
							 *((intOrPtr*)(_t24 + 0xc)) = _v4;
							 *(_t42 + 0x24) = 1;
							if( *_t42 >= 0x48) {
								 *0x4af194(_t42 + 0x28, "DISPLAY", 0x20);
							}
							return 1;
						}
					}
				} else {
					return  *0x4f2378(_a4, _a8);
				}
			}









0x004548fa
0x0045491c
0x004549a5
0x004549ac
0x00454922
0x00454922
0x0045492a
0x00000000
0x00454944
0x00454944
0x00454947
0x00454955
0x00454962
0x00454965
0x00454968
0x0045496e
0x00454975
0x00454978
0x0045497e
0x00454985
0x00454992
0x00454992
0x004549a2
0x004549a2
0x0045492a
0x004548fc
0x0045490f
0x0045490f

APIs
  • SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 0045493A
  • GetSystemMetrics.USER32(00000000), ref: 00454951
  • GetSystemMetrics.USER32(00000001), ref: 00454958
  • lstrcpyn.KERNEL32(?,DISPLAY,00000020), ref: 00454992
Strings
Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID: System$Metrics$InfoParameterslstrcpyn
  • String ID: B$DISPLAY
  • API String ID: 2307409384-3316187204
  • Opcode ID: 4ec3b32dd2d588e4dc61943fdf3e62676906c71aeaceac035b9d6429d09ee7ad
  • Instruction ID: 7455ca82d036cf58c8aa8fe0989fe86ec676f711b7ba5a0404a2b43ca99f9c2b
  • Opcode Fuzzy Hash: 4ec3b32dd2d588e4dc61943fdf3e62676906c71aeaceac035b9d6429d09ee7ad
  • Instruction Fuzzy Hash: 8721A1B16043009FD320DF2AD844A57FBE4FFC5715F00882EE8899B251D634D888CB6A
Uniqueness

Uniqueness Score: -1.00%

C-Code - Quality: 94%
			E00498319(void* __ecx, signed char* _a8, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, void* _a36, signed int _a40) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t36;
				void* _t39;
				intOrPtr _t44;
				void* _t48;
				unsigned int _t58;
				signed int _t59;
				signed int _t65;
				signed int _t71;
				void* _t78;
				signed char* _t82;
				unsigned int _t89;
				void* _t90;
				void* _t91;
				void* _t92;
				void* _t93;
				signed int _t103;

				_t91 = __ecx;
				_t36 = L0049D072(__ecx, _a36, 0x4bc794);
				_t90 = _t36;
				_t98 = _t90;
				if(_t90 == 0) {
					return _t36;
				}
				L0049B82B(_t98, __ecx, _t90, 0x100,  *((intOrPtr*)(__ecx + 0x18)));
				L0049B82B(_t98, _t91, _t90, 0x101,  *(_t91 + 0x1c));
				_t39 = L0049B82B(_t98, _t91, _t90, 0x103,  *((intOrPtr*)(_t91 + 0x78)));
				_t93 = _t92 + 0x30;
				if(_a40 != 0) {
					_push(_a40);
					L004A584E();
					_t100 = _t39;
					if(_t39 > 0) {
						L0049B82B(_t100, _t91, _t90, 0x10e, _a40);
						_t93 = _t93 + 0x10;
					}
				}
				_t101 =  *((intOrPtr*)(_t91 + 0x78)) - 3;
				if( *((intOrPtr*)(_t91 + 0x78)) == 3) {
					L0049B82B(_t101, _t91, _t90, 0x124, 5);
					_t93 = _t93 + 0x10;
				}
				L0049B82B(_t101, _t91, _t90, 0x11c, 1);
				L0049B82B(_t101, _t91, _t90, 0x115, 1);
				L0049B82B(_t101, _t91, _t90, 0x112, 1);
				L0049B82B(_t101, _t91, _t90, 0x116,  *(_t91 + 0x1c));
				_t44 =  *((intOrPtr*)(_t91 + 4));
				_t102 = _t44 - 0x18;
				if(_t44 != 0x18) {
					__eflags = _t44 - 1;
					if(__eflags <= 0) {
						L0049B82B(__eflags, _t91, _t90, 0x102, 1);
						L0049B82B(__eflags, _t91, _t90, 0x106, 1);
						_t48 = GlobalAlloc(0x42, E0049C5AE(_t90));
						GlobalFix(_t48);
						_t89 = _t48;
						__eflags = _t89;
						_a36 = _t89;
						if(_t89 == 0) {
							goto L21;
						}
						_a40 = _a40 & 0x00000000;
						__eflags =  *(_t91 + 0x1c);
						_t82 = _a8;
						if(__eflags <= 0) {
							L19:
							L0049CBFD(_t91, __eflags, _t90, 0, _a36, E0049C5AE(_t90));
							GlobalUnWire(GlobalHandle(_a36));
							GlobalFree(GlobalHandle(_a36));
							goto L20;
						}
						_t58 =  *(_t91 + 0x18) >> 3;
						__eflags = _t58;
						do {
							_t78 = 0;
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L18;
							} else {
								goto L15;
							}
							do {
								L15:
								_t59 =  *_t82 & 0x000000ff;
								_t82 =  &(_t82[1]);
								__eflags =  *((short*)(_t91 + 0x8a));
								if( *((short*)(_t91 + 0x8a)) == 0) {
									_t59 =  !_t59;
								}
								 *_t89 = _t59;
								_t89 = _t89 + 1;
								_t78 = _t78 + 1;
								_t58 =  *(_t91 + 0x18) >> 3;
								__eflags = _t78 - _t58;
							} while (_t78 < _t58);
							L18:
							_a40 = _a40 + 1;
							__eflags = _a40 -  *(_t91 + 0x1c);
						} while (__eflags < 0);
						goto L19;
					}
					L0049B82B(__eflags, _t91, _t90, 0x102, 8);
					L0049B82B(__eflags, _t91, _t90, 0x106, 3);
					_push(_a24);
					_push(_a20);
					_push(_a16);
					E00498277(0x115, _t91, _t90, _t91, _t90);
					_t65 =  *(_t91 + 0x18) *  *(_t91 + 0x1c);
					goto L8;
				} else {
					L0049B82B(_t102, _t91, _t90, 0x115, 3);
					L0049B82B(_t102, _t91, _t90, 0x102, 8);
					L0049B82B(_t102, _t91, _t90, 0x106, 2);
					_t71 =  *(_t91 + 0x18) *  *(_t91 + 0x1c);
					_t103 = _t71;
					_t65 = _t71 + _t71 * 2;
					L8:
					L0049CBFD(_t91, _t103, _t90, 0, _a8, _t65);
					L20:
					E0049C42F(_t91, _t90);
					_t48 = 1;
					L21:
					return _t48;
				}
			}






















0x00498326
0x00498328
0x0049832d
0x0049832f
0x00498331
0x00498536
0x00498536
0x00498341
0x00498350
0x0049835f
0x00498364
0x0049836b
0x0049836d
0x00498370
0x00498375
0x00498378
0x00498384
0x00498389
0x00498389
0x00498378
0x0049838c
0x00498390
0x0049839b
0x004983a0
0x004983a0
0x004983ad
0x004983bc
0x004983ca
0x004983d9
0x004983de
0x004983e4
0x004983e7
0x0049842f
0x00498432
0x00498476
0x00498484
0x00498497
0x0049849e
0x004984a4
0x004984a6
0x004984a8
0x004984ab
0x00000000
0x00000000
0x004984b1
0x004984b5
0x004984b9
0x004984bc
0x004984f3
0x00498504
0x00498515
0x00498521
0x00000000
0x00498521
0x004984c1
0x004984c1
0x004984c4
0x004984c4
0x004984c6
0x004984c8
0x00000000
0x00000000
0x00000000
0x00000000
0x004984ca
0x004984ca
0x004984ca
0x004984cd
0x004984ce
0x004984d6
0x004984d8
0x004984d8
0x004984da
0x004984df
0x004984e0
0x004984e1
0x004984e4
0x004984e4
0x004984e8
0x004984e8
0x004984ee
0x004984ee
0x00000000
0x004984c4
0x0049843d
0x0049844b
0x00498453
0x00498458
0x0049845b
0x0049845f
0x00498467
0x00000000
0x004983e9
0x004983ee
0x004983fc
0x0049840a
0x00498415
0x00498415
0x00498419
0x0049841c
0x00498425
0x00498527
0x0049852a
0x00498531
0x00498532
0x00000000
0x00498532

APIs
  • GlobalAlloc.KERNEL32(00000042,00000000,00000000), ref: 00498497
  • GlobalFix.KERNEL32(00000000), ref: 0049849E
  • GlobalHandle.KERNEL32(?), ref: 00498512
  • GlobalUnWire.KERNEL32(00000000), ref: 00498515
  • GlobalHandle.KERNEL32(?), ref: 0049851E
  • GlobalFree.KERNEL32(00000000), ref: 00498521
Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID: Global$Handle$AllocFreeWire
  • String ID:
  • API String ID: 665929058-0
  • Opcode ID: 659622a2081d29ac554b621e03a251c8e736906d035c070abc4e25f645076fce
  • Instruction ID: 478f821276816a891701d0e4f2e6d52de56a6ebc7f53dc21ff12717ec8b0cd28
  • Opcode Fuzzy Hash: 659622a2081d29ac554b621e03a251c8e736906d035c070abc4e25f645076fce
  • Instruction Fuzzy Hash: EB512530241604BAEF31BA269C46FEF3E7DDF8AB58F00402EF54175192CBAD994186ED
Uniqueness

Uniqueness Score: -1.00%

C-Code - Quality: 100%
			E00498817(void* __ecx) {
				signed int _v8;
				signed int _v12;
				void* _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v36;
				intOrPtr _v40;
				void* _v44;
				intOrPtr _v48;
				intOrPtr _t83;
				void* _t86;
				intOrPtr _t87;
				signed int _t93;
				intOrPtr _t99;
				signed int _t100;
				signed int _t105;
				signed int _t109;
				signed int _t118;
				signed int _t119;
				signed int _t127;
				void* _t137;
				intOrPtr _t141;
				intOrPtr _t142;
				signed int _t143;
				signed int _t145;
				void* _t147;
				void* _t148;

				_t148 = __ecx;
				_v40 =  *((intOrPtr*)(__ecx + 0x2c));
				_t83 = E00498253(__ecx,  *((intOrPtr*)(__ecx + 0xa8)));
				 *((intOrPtr*)(__ecx + 0xe8)) = _t83;
				if(_t83 != 0) {
					_t145 = L0049DDDA( *((intOrPtr*)(__ecx + 0x7c)));
					_t86 = GlobalAlloc(0x42, _t145 + _t145 * 2);
					GlobalFix(_t86);
					_v16 = _t86;
					if(_t86 == 0) {
						L26:
						return _t86;
					}
					_t87 = _t86 + _t145;
					_v32 = _t87;
					_v28 = _t87 + _t145;
					L0049BEFF(_t148,  *((intOrPtr*)(_t148 + 0x7c)), 0x142,  &_v20);
					L0049BEFF(_t148,  *((intOrPtr*)(_t148 + 0x7c)), 0x143,  &_v44);
					_t93 = L00496DD2(_t148,  *((intOrPtr*)(_t148 + 0x1c)));
					_t118 =  *(_t148 + 0x18);
					_v24 = _t93;
					if( *((short*)(_t148 + 0x80)) != 1) {
						_t119 = _t118 - _v20;
						__eflags = _t119;
					} else {
						_t119 =  ~(_t118 + _v20);
					}
					_v8 = _v8 & 0x00000000;
					_v36 = _t119;
					if( *((intOrPtr*)(_t148 + 0x1c)) <= 0) {
						L25:
						GlobalUnWire(GlobalHandle(_v16));
						GlobalFree(GlobalHandle(_v16));
						_t86 = 1;
						goto L26;
					} else {
						_t127 = _v44;
						do {
							_t99 =  *((intOrPtr*)(_t148 + 0x1c));
							if(_v8 + _t127 <= _t99) {
								_v12 = _t127;
							} else {
								_v12 = _t99 - _v8;
							}
							_t147 = 0;
							_t157 =  *(_t148 + 0x18);
							if( *(_t148 + 0x18) > 0) {
								do {
									if(L0049DAEC(_t148, _t157,  *((intOrPtr*)(_t148 + 0x7c)), _v16, _t147, _v8, 0, 0) >= 0) {
										L13:
										if(L0049DAEC(_t148, _t159,  *((intOrPtr*)(_t148 + 0x7c)), _v32, _t147, _v8, 0, 1) >= 0) {
											L15:
											if(L0049DAEC(_t148, _t161,  *((intOrPtr*)(_t148 + 0x7c)), _v28, _t147, _v8, 0, 2) >= 0 ||  *((intOrPtr*)(_t148 + 0xac)) == 0) {
												goto L17;
											} else {
												break;
											}
										}
										_t161 =  *((intOrPtr*)(_t148 + 0xac));
										if( *((intOrPtr*)(_t148 + 0xac)) != 0) {
											break;
										}
										goto L15;
									}
									_t159 =  *((intOrPtr*)(_t148 + 0xac));
									if( *((intOrPtr*)(_t148 + 0xac)) != 0) {
										break;
									}
									goto L13;
									L17:
									_t141 = _v20;
									_t105 =  *(_t148 + 0x18);
									if(_t147 + _t141 <= _t105) {
										_t109 = (_t105 * _v24 + _t147) * ( *(_t148 + 0x8c) & 0x0000ffff) + _v40;
										__eflags = _t109;
										 *((intOrPtr*)(_t148 + 0xe8))(_t109, _v16, _v32, _v28,  *((intOrPtr*)(_t148 + 0xa8)), _t141, _v12, 0, ( *(_t148 + 0x8c) & 0x0000ffff) * _t119);
									} else {
										_t137 = _t105 - _t147;
										_t142 = _t141 - _t137;
										_v48 = _t142;
										_t143 =  *(_t148 + 0x8c) & 0x0000ffff;
										 *((intOrPtr*)(_t148 + 0xe8))((_t105 * _v24 + _t147) * _t143 + _v40, _v16, _v32, _v28,  *((intOrPtr*)(_t148 + 0xa8)), _t137, _v12, _v48, (_t119 + _t142) * _t143);
										_t119 = _v36;
									}
									_t147 = _t147 + _v20;
								} while (_t147 <  *(_t148 + 0x18));
								_t127 = _v44;
							}
							_t100 = _v12;
							if( *((short*)(_t148 + 0x80)) == 1) {
								_t100 =  ~_t100;
							}
							_v8 = _v8 + _t127;
							_v24 = _v24 + _t100;
						} while (_v8 <  *((intOrPtr*)(_t148 + 0x1c)));
						goto L25;
					}
				}
				return _t83;
			}
































0x0049881e
0x00498829
0x0049882c
0x00498833
0x00498839
0x0049884a
0x00498852
0x00498859
0x00498861
0x00498864
0x00498a49
0x00000000
0x00498a49
0x0049886a
0x0049886c
0x00498872
0x00498882
0x00498894
0x004988a1
0x004988ae
0x004988b1
0x004988b4
0x004988bd
0x004988bd
0x004988b6
0x004988b9
0x004988b9
0x004988c0
0x004988c8
0x004988cb
0x00498a27
0x00498a33
0x00498a3f
0x00498a47
0x00000000
0x004988d1
0x004988d1
0x004988d4
0x004988d7
0x004988de
0x004988e8
0x004988e0
0x004988e3
0x004988e3
0x004988eb
0x004988ed
0x004988f0
0x004988f6
0x0049890d
0x0049891c
0x00498933
0x00498942
0x00498959
0x00000000
0x00000000
0x00000000
0x00000000
0x00498959
0x00498935
0x0049893c
0x00000000
0x00000000
0x00000000
0x0049893c
0x0049890f
0x00498916
0x00000000
0x00000000
0x00000000
0x00498968
0x00498968
0x0049896b
0x00498973
0x004989e2
0x004989e2
0x004989f1
0x00498975
0x0049897b
0x0049897d
0x0049897f
0x00498984
0x004989b0
0x004989b6
0x004989b6
0x004989f7
0x004989fa
0x00498a03
0x00498a03
0x00498a0e
0x00498a11
0x00498a13
0x00498a13
0x00498a15
0x00498a18
0x00498a1e
0x00000000
0x004988d4
0x004988cb
0x00498a4c

APIs
  • GlobalAlloc.KERNEL32(00000042,00000000,?,?,?), ref: 00498852
  • GlobalFix.KERNEL32(00000000), ref: 00498859
  • GlobalHandle.KERNEL32(?), ref: 00498A30
  • GlobalUnWire.KERNEL32(00000000), ref: 00498A33
  • GlobalHandle.KERNEL32(?), ref: 00498A3C
  • GlobalFree.KERNEL32(00000000), ref: 00498A3F
Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID: Global$Handle$AllocFreeWire
  • String ID:
  • API String ID: 665929058-0
  • Opcode ID: 5fd7899d8cafce1a54c662244cb77f1b17e6a52016b3d18f3a92cc8745e06bb8
  • Instruction ID: cd7a1a2b2f4f9b5ef9007c896087361acce3ce27118b7a6a91d49f915dd38391
  • Opcode Fuzzy Hash: 5fd7899d8cafce1a54c662244cb77f1b17e6a52016b3d18f3a92cc8745e06bb8
  • Instruction Fuzzy Hash: DD617A31A00609EFDF219FA5CC45BAFBFF6EF49304F00842EE156A2250DB38A941DB64
Uniqueness

Uniqueness Score: -1.00%

C-Code - Quality: 87%
			E00498658(void* __ecx) {
				intOrPtr _v8;
				signed int _v12;
				void* _v16;
				char _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				void* _v36;
				intOrPtr _v40;
				intOrPtr _t65;
				void* _t68;
				signed int _t74;
				signed int _t81;
				signed int _t82;
				signed int _t84;
				intOrPtr _t85;
				void* _t89;
				signed int _t92;
				signed int _t93;
				signed int _t100;
				signed int _t102;
				signed int _t104;
				intOrPtr _t110;
				void* _t118;
				void* _t119;

				_t119 = __ecx;
				_v32 =  *((intOrPtr*)(__ecx + 0x2c));
				 *((intOrPtr*)(__ecx + 0xac)) = 0;
				_t65 = E00498198(__ecx,  *((intOrPtr*)(__ecx + 0xa8)));
				 *((intOrPtr*)(__ecx + 0xf0)) = _t65;
				if(_t65 == 0) {
					L2:
					return 0;
				}
				_t68 = GlobalAlloc(0x42, L0049DDDA( *((intOrPtr*)(__ecx + 0x7c))));
				GlobalFix(_t68);
				_v16 = _t68;
				if(_t68 != 0) {
					_v28 = L00479A50( *((intOrPtr*)(_t119 + 4)),  *(_t119 + 0x18));
					L0049BEFF(_t119,  *((intOrPtr*)(_t119 + 0x7c)), 0x142,  &_v20);
					L0049BEFF(_t119,  *((intOrPtr*)(_t119 + 0x7c)), 0x143,  &_v36);
					_t74 = L00496DD2(_t119,  *(_t119 + 0x1c));
					__eflags =  *((short*)(_t119 + 0x80)) - 1;
					_t92 =  *(_t119 + 0x18);
					_v24 = _t74;
					if( *((short*)(_t119 + 0x80)) != 1) {
						_t93 = _t92 - _v20;
						__eflags = _t93;
					} else {
						_t93 =  ~(_t92 + _v20);
					}
					__eflags =  *(_t119 + 0x1c);
					_v8 = 0;
					if( *(_t119 + 0x1c) <= 0) {
						L22:
						GlobalUnWire(GlobalHandle(_v16));
						GlobalFree(GlobalHandle(_v16));
						__eflags = 1;
						return 1;
					} else {
						_t100 = _v36;
						do {
							_t81 =  *(_t119 + 0x1c);
							__eflags = _v8 + _t100 - _t81;
							if(_v8 + _t100 <= _t81) {
								_v12 = _t100;
							} else {
								_v12 = _t81 - _v8;
							}
							_t118 = 0;
							__eflags =  *(_t119 + 0x18);
							if(__eflags > 0) {
								do {
									_t84 = L0049DAEC(_t119, __eflags,  *((intOrPtr*)(_t119 + 0x7c)), _v16, _t118, _v8, 0, 0);
									__eflags = _t84;
									if(_t84 >= 0) {
										goto L14;
									}
									__eflags =  *(_t119 + 0xac);
									if( *(_t119 + 0xac) != 0) {
										break;
									}
									L14:
									_t85 = _v20;
									_t102 =  *(_t119 + 0x18);
									__eflags = _t118 + _t85 - _t102;
									if(_t118 + _t85 <= _t102) {
										_t104 = ( *(_t119 + 0x8c) & 0x0000ffff) * _t93;
										__eflags = _t104;
										_push(_t104);
										_push(0);
										_push(_v12);
										_push(_t85);
									} else {
										_t110 = _t102 - _t118;
										_t89 = _t85 - _t110;
										_v40 = _t110;
										_push((_t89 + _t93) * ( *(_t119 + 0x8c) & 0x0000ffff));
										_push(_t89);
										_push(_v12);
										_push(_v40);
									}
									 *((intOrPtr*)(_t119 + 0xf0))(_v24 * _v28 + L00479A50( *((intOrPtr*)(_t119 + 4)), _t118) + _v32, _v16,  *((intOrPtr*)(_t119 + 0xa8)));
									_t118 = _t118 + _v20;
									__eflags = _t118 -  *(_t119 + 0x18);
								} while (__eflags < 0);
								_t100 = _v36;
							}
							__eflags =  *((short*)(_t119 + 0x80)) - 1;
							_t82 = _v12;
							if( *((short*)(_t119 + 0x80)) == 1) {
								_t82 =  ~_t82;
							}
							_v8 = _v8 + _t100;
							_v24 = _v24 + _t82;
							__eflags = _v8 -  *(_t119 + 0x1c);
						} while (_v8 <  *(_t119 + 0x1c));
						goto L22;
					}
				}
				goto L2;
			}




























0x0049865f
0x0049866d
0x00498670
0x00498676
0x0049867d
0x00498683
0x004986a6
0x00000000
0x004986a6
0x00498692
0x00498699
0x004986a1
0x004986a4
0x004986bb
0x004986cb
0x004986dd
0x004986ea
0x004986ef
0x004986f7
0x004986fa
0x004986fd
0x00498706
0x00498706
0x004986ff
0x00498702
0x00498702
0x00498709
0x0049870c
0x0049870f
0x004987f1
0x004987fd
0x00498809
0x00498811
0x00000000
0x00498715
0x00498715
0x00498718
0x0049871b
0x00498720
0x00498722
0x0049872c
0x00498724
0x00498727
0x00498727
0x0049872f
0x00498731
0x00498734
0x0049873a
0x0049874a
0x0049874f
0x00498751
0x00000000
0x00000000
0x00498753
0x0049875a
0x00000000
0x00000000
0x0049875c
0x0049875c
0x0049875f
0x00498765
0x00498767
0x0049878e
0x0049878e
0x00498791
0x00498792
0x00498794
0x00498797
0x00498769
0x00498770
0x00498772
0x00498774
0x0049877d
0x0049877e
0x0049877f
0x00498782
0x00498782
0x004987bb
0x004987c1
0x004987c4
0x004987c4
0x004987cd
0x004987cd
0x004987d0
0x004987d8
0x004987db
0x004987dd
0x004987dd
0x004987df
0x004987e2
0x004987e8
0x004987e8
0x00000000
0x00498718
0x0049870f
0x00000000

APIs
  • GlobalAlloc.KERNEL32(00000042,00000000,?,?), ref: 00498692
  • GlobalFix.KERNEL32(00000000), ref: 00498699
  • GlobalHandle.KERNEL32(?), ref: 004987FA
  • GlobalUnWire.KERNEL32(00000000), ref: 004987FD
  • GlobalHandle.KERNEL32(?), ref: 00498806
  • GlobalFree.KERNEL32(00000000), ref: 00498809
Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID: Global$Handle$AllocFreeWire
  • String ID:
  • API String ID: 665929058-0
  • Opcode ID: 4eb5bed9e3383be759aa768e2ffea84e4c54d370a923dad77943e6eeaa66bab7
  • Instruction ID: 13561809172cc4a7a6894856caa979b72b18a6eb19436dfa1217775c2065971a
  • Opcode Fuzzy Hash: 4eb5bed9e3383be759aa768e2ffea84e4c54d370a923dad77943e6eeaa66bab7
  • Instruction Fuzzy Hash: B5518B71A00605EFCF259FA5CC45AAFBFF6FF45300F10856EE056A2250DB39AA41DB68
Uniqueness

Uniqueness Score: -1.00%

C-Code - Quality: 16%
			E00456390(void* __esi, void* __ebp, void* __eflags) {
				char _v4;
				char _v8;
				char _v16;
				char _v36;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v228;
				char _v240;
				char _v251;
				char _v255;
				char _v259;
				char _v260;
				char _v264;
				char _v312;
				void* _v340;
				char _v344;
				char _v348;
				char _v352;
				intOrPtr _v356;
				char _v360;
				void* _v364;
				char _v368;
				char _t46;
				void* _t57;
				void* _t58;
				char _t105;
				intOrPtr _t108;
				void* _t110;

				 *[fs:0x0] = _t108;
				_t46 =  *0x4d0070; // 0x4961b978
				_v16 = _t46;
				_t105 = 0;
				L00499DF2( &_v312);
				_v4 = 0;
				L00499E9B( &_v312, 0x80000000, 0, 1);
				 *0x4af2c0(__esi,  *[fs:0x0], 0x4ab923, 0xffffffff);
				 *0x4af2c0();
				 *0x4af2c0();
				_v16 = 3;
				 *0x4affcc( &_v8,  &_v228, 0x64);
				 *0x4afa60( &_v240);
				 *0x4afb90(0x4b0384);
				_t84 =  &_v348;
				_v36 = 4;
				_t57 = E00422150( &_v348,  &_v348, "CLSID\",  &_v360);
				_v36 = 5;
				_t58 = E00402410(_t84,  &_v352, _t57);
				_t110 = _t108 - 0x144 + 0x18;
				_v36 = 6;
				 *0x4afb64(_t58, "\InprocServer32");
				 *0x4afb9c();
				_v40 = 4;
				 *0x4afb9c();
				_push(0x20019);
				_push(_v368);
				if(E0049A1C1( &_v348) != 0 && L0049976F( &_v344, _v356,  &_v368) != 0) {
					_v259 = 0;
					_v255 = 0;
					_v260 = 0;
					_v251 = 0;
					 *0x4afd54( &_v260, "?:\");
					_t110 = _t110 + 8;
					_v264 =  *0x4afb80(0);
					if(GetDriveTypeA( &_v264) == 5) {
						_t105 = 1;
					}
				}
				 *0x4afb9c();
				 *0x4afb9c();
				 *0x4afb9c();
				 *0x4afb9c();
				_v36 = 0xffffffff;
				L00499E32( &_v344);
				 *[fs:0x0] = _v44;
				return L00475E7E(_t105, _v48);
			}
































0x0045639e
0x004563ab
0x004563b5
0x004563bc
0x004563be
0x004563cf
0x004563d6
0x004563df
0x004563e9
0x004563f3
0x0045640b
0x00456413
0x00456422
0x00456431
0x0045643c
0x00456446
0x0045644e
0x0045645e
0x00456466
0x0045646b
0x00456473
0x0045647b
0x00456485
0x0045648f
0x00456497
0x004564a1
0x004564a6
0x004564b2
0x004564cd
0x004564d5
0x004564df
0x004564e4
0x004564eb
0x004564f1
0x00456504
0x00456511
0x00456513
0x00456513
0x00456511
0x0045651c
0x00456526
0x00456530
0x0045653a
0x00456544
0x0045654f
0x0045655b
0x00456577

APIs
    • Part of subcall function 00499E9B: RegConnectRegistryA.ADVAPI32(?,?,?), ref: 00499EFE
    • Part of subcall function 00499E9B: GetComputerNameA.KERNEL32(00000000,00000104), ref: 00499F64
    • Part of subcall function 0049A1C1: __EH_prolog.LIBCMT ref: 0049A1C6
  • GetDriveTypeA.KERNEL32(?,?,00000000,?,?,?,?,00000064), ref: 00456508
Strings
Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID: ComputerConnectDriveH_prologNameRegistryType
  • String ID: ?:\$CLSID\$\InprocServer32
  • API String ID: 2651721134-2232029702
  • Opcode ID: 0fa87a0dcd8a126f8059186b55cb103ddcf70d2d76871fd2ce8f7df4af6f58ff
  • Instruction ID: 399f6b5059c242dd1e74acca9a3c0d86a335b35d0c2fbbf03cb6425aae8167bf
  • Opcode Fuzzy Hash: 0fa87a0dcd8a126f8059186b55cb103ddcf70d2d76871fd2ce8f7df4af6f58ff
  • Instruction Fuzzy Hash: 38516E75008782DFC320DF64DC59BDFBBE4BB95705F00892DF59A822A1EB349509CB6A
Uniqueness

Uniqueness Score: -1.00%

C-Code - Quality: 97%
			E0047A460(intOrPtr* __ecx) {
				int _t33;
				signed int _t34;
				struct HDC__* _t39;
				intOrPtr* _t44;

				_t44 = __ecx;
				_push(0xa);
				 *__ecx = 0x4b9f50;
				L004A57B4();
				_t39 = GetDC(0);
				 *(_t44 + 0xc) = GetDeviceCaps(_t39, 0xe);
				_t33 = GetDeviceCaps(_t39, 0xc);
				 *(_t44 + 4) = _t33;
				 *(_t44 + 8) = _t33;
				_t34 = _t33 - 1;
				if(_t34 > 7) {
					L6:
					 *((short*)(_t44 + 0x22)) = 0;
					 *(_t44 + 8) = 0;
				} else {
					switch( *((intOrPtr*)(_t34 * 4 +  &M0047A520))) {
						case 0:
							 *((short*)(_t44 + 0x22)) = 1 <<  *(_t44 + 0xc);
							goto L7;
						case 1:
							 *((short*)(__esi + 0x22)) = 4;
							goto L7;
						case 2:
							goto L6;
						case 3:
							 *((short*)(__esi + 0x22)) = 0x10;
							goto L7;
						case 4:
							 *((short*)(__esi + 0x22)) = 0x100;
							goto L7;
					}
				}
				L7:
				ReleaseDC(0, _t39);
				 *((intOrPtr*)(_t44 + 0x24)) = 0;
				 *((intOrPtr*)(_t44 + 0x28)) = 0;
				 *((intOrPtr*)(_t44 + 0x30)) = 0;
				 *((intOrPtr*)(_t44 + 0x74)) = 0;
				 *((intOrPtr*)(_t44 + 0x2c)) = 0;
				 *((intOrPtr*)(_t44 + 0x18)) = 0;
				 *((intOrPtr*)(_t44 + 0x1c)) = 0;
				 *((intOrPtr*)(_t44 + 0x54)) = 0;
				 *((intOrPtr*)(_t44 + 0x50)) = 0;
				 *((intOrPtr*)(_t44 + 0x4c)) = 0;
				 *((intOrPtr*)(_t44 + 0x44)) = 0;
				 *((intOrPtr*)(_t44 + 0x14)) = 0;
				 *(_t44 + 4) = 0;
				 *((short*)(_t44 + 0x20)) = 0;
				 *((intOrPtr*)(_t44 + 0x10)) = 0;
				 *((intOrPtr*)(_t44 + 0x38)) = 0;
				 *((intOrPtr*)(_t44 + 0x48)) = 1;
				return _t44;
			}







0x0047a463
0x0047a466
0x0047a46b
0x0047a471
0x0047a485
0x0047a48f
0x0047a492
0x0047a494
0x0047a497
0x0047a49a
0x0047a49e
0x0047a4cf
0x0047a4cf
0x0047a4d3
0x0047a4a0
0x0047a4a0
0x00000000
0x0047a4b1
0x00000000
0x00000000
0x0047a4b7
0x00000000
0x00000000
0x00000000
0x00000000
0x0047a4bf
0x00000000
0x00000000
0x0047a4c7
0x00000000
0x00000000
0x0047a4a0
0x0047a4d6
0x0047a4d8
0x0047a4de
0x0047a4e1
0x0047a4e4
0x0047a4e7
0x0047a4ea
0x0047a4ed
0x0047a4f0
0x0047a4f3
0x0047a4f6
0x0047a4f9
0x0047a4fc
0x0047a4ff
0x0047a502
0x0047a505
0x0047a509
0x0047a50c
0x0047a510
0x0047a51c

APIs
  • GetDC.USER32(00000000), ref: 0047A479
  • GetDeviceCaps.GDI32(00000000,0000000E), ref: 0047A48A
  • GetDeviceCaps.GDI32(00000000,0000000C), ref: 0047A492
  • ReleaseDC.USER32(00000000,00000000), ref: 0047A4D8
Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID: CapsDevice$Release
  • String ID:
  • API String ID: 1035833867-0
  • Opcode ID: 1c22c2661bfa238f509042b406aace69c15f4bfac68ce01a8709a3d5e88c3e19
  • Instruction ID: 290033e86f5f01b01c4f49215cc9e298a7bb510030fb032e0288d5760e45f1a5
  • Opcode Fuzzy Hash: 1c22c2661bfa238f509042b406aace69c15f4bfac68ce01a8709a3d5e88c3e19
  • Instruction Fuzzy Hash: 2D21E4B0910B44ABD3308F1AC544957FBF8FFA5714B108A1FD58A83A60E3F5A448CB1A
Uniqueness

Uniqueness Score: -1.00%

C-Code - Quality: 25%
			E0043E890(void* __edi, void* __esi, intOrPtr _a4) {
				intOrPtr _v4;
				intOrPtr _v24;
				void _v67;
				char _v68;
				char _v76;
				char _v84;
				intOrPtr _t12;
				void* _t20;

				_t12 =  *0x4d0070; // 0x4961b978
				_v4 = _t12;
				_v68 = 0;
				memset( &_v67, 0, 0xf << 2);
				asm("stosw");
				asm("stosb");
				 *0x4af1a0( &_v68, _a4);
				 *0x4af1a4( &_v76, 0x4b03c0);
				SetErrorMode(1);
				_t20 =  *0x4af208( &_v84);
				SetErrorMode(0);
				return L00475E7E(0 | _t20 != 0xffffffff, _v24);
			}











0x0043e893
0x0043e898
0x0043e8a0
0x0043e8ae
0x0043e8b0
0x0043e8b2
0x0043e8bd
0x0043e8cd
0x0043e8db
0x0043e8e2
0x0043e8ec
0x0043e904

APIs
  • lstrcpy.KERNEL32(?,?), ref: 0043E8BD
  • lstrcat.KERNEL32(004B03C0,004B03C0), ref: 0043E8CD
  • SetErrorMode.KERNEL32(00000001), ref: 0043E8DB
  • SetErrorMode.KERNEL32(00000000), ref: 0043E8EC
Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID: ErrorMode$lstrcatlstrcpy
  • String ID:
  • API String ID: 2048737516-0
  • Opcode ID: 491180ce093faef54c5e190378b30cbc7ce5ff103ce5997afd50d711356fa492
  • Instruction ID: 29792d07997969b119d56728546d3b0c8b331c1f8a03222c5e1f5242329764d6
  • Opcode Fuzzy Hash: 491180ce093faef54c5e190378b30cbc7ce5ff103ce5997afd50d711356fa492
  • Instruction Fuzzy Hash: 52F06D76604300AFD700EBB8D848B9F7BE4AB89360F408A39F6458B290DA75D844CB96
Uniqueness

Uniqueness Score: -1.00%

C-Code - Quality: 66%
			E00440450(intOrPtr __ecx, void* __fp0) {
				intOrPtr _v4;
				signed int _v8;
				char _v12;
				intOrPtr _v16;
				char _v19;
				intOrPtr _v20;
				int _v23;
				intOrPtr _v24;
				int _v27;
				char _v28;
				char _v36;
				int _v40;
				intOrPtr _v44;
				char _v48;
				signed int _v52;
				signed int _v56;
				long _v60;
				intOrPtr _v64;
				char _v67;
				char _v68;
				intOrPtr _v104;
				intOrPtr _v108;
				char _v109;
				short _v111;
				intOrPtr _v115;
				intOrPtr _v119;
				intOrPtr _v123;
				intOrPtr _v127;
				intOrPtr _v131;
				intOrPtr _v135;
				intOrPtr _v139;
				signed int _v140;
				char _v152;
				char _v168;
				char _v360;
				intOrPtr _v396;
				intOrPtr _v400;
				char _v404;
				void _v484;
				signed int _v488;
				void _v660;
				char _v668;
				signed int _v669;
				char _v675;
				char _v676;
				void* _v680;
				signed int _v684;
				intOrPtr _v688;
				signed int _v692;
				signed int _v696;
				char* _v700;
				char* _v704;
				signed int _v708;
				signed int _v712;
				void _v748;
				short _v752;
				signed int _v768;
				char* _v784;
				char* _v788;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t193;
				intOrPtr _t196;
				char _t202;
				signed int _t203;
				int _t205;
				void* _t207;
				signed int _t209;
				intOrPtr _t215;
				signed int _t223;
				signed int _t226;
				char _t227;
				char _t229;
				signed int _t231;
				signed int _t237;
				signed int _t238;
				signed int _t255;
				signed int _t260;
				signed int _t263;
				signed int _t267;
				signed int _t269;
				signed int _t270;
				signed int _t273;
				char _t274;
				void* _t279;
				char _t280;
				signed int _t281;
				signed int _t283;
				signed int _t285;
				signed int _t286;
				signed int _t301;
				signed int _t309;
				char* _t314;
				signed int _t315;
				signed int _t317;
				signed int _t346;
				signed int _t351;
				intOrPtr _t373;
				void* _t376;
				signed int _t377;
				signed int _t383;
				void* _t387;
				signed int _t388;
				signed int _t393;
				intOrPtr* _t394;
				signed int _t395;
				signed int _t397;
				signed int _t398;
				void* _t400;
				void* _t401;
				signed int _t402;
				intOrPtr _t404;
				intOrPtr _t406;
				intOrPtr _t408;
				intOrPtr _t410;
				void* _t413;
				void* _t444;

				_t444 = __fp0;
				 *[fs:0x0] = _t406;
				_t193 =  *0x4d0070; // 0x4961b978
				_v16 = _t193;
				_v44 = __ecx;
				_v27 = 0;
				_v23 = 0;
				_v28 = 0;
				_v19 = 0;
				 *0x4afd54( &_v28, "?:\",  *[fs:0x0], 0x4a9803, 0xffffffff);
				_t408 = _t406 - 0x30 + 8;
				L004748C2();
				_t196 =  *0x00000004;
				if( *((intOrPtr*)(_t196 + 0xc8)) != 0 ||  *((intOrPtr*)(_t196 + 0xd0)) != 0 ||  *((intOrPtr*)(_t196 + 0xd4)) != 0 ||  *((intOrPtr*)(_t196 + 0xd8)) != 0) {
					L5:
					_v56 = 1;
				} else {
					_v56 = 0;
					if( *((intOrPtr*)(_t196 + 0xcc)) != 0) {
						goto L5;
					}
				}
				 *0x4afb90( *((intOrPtr*)(_t196 + 0x208)), _t376, _t387, _t401, _t279);
				_v8 = 0;
				_t280 =  *0x4afb80(0);
				_v60 = GetLogicalDrives();
				L004748C2();
				_v44 = L004557B0( *((intOrPtr*)(_t200 + 4)));
				_t202 = 0x41;
				_v36 = 0x41;
				if(_v64 != 0) {
					_t202 = _t280;
					_v36 = _t202;
				}
				_t402 = _v52;
				do {
					_v48 = _t202;
					if(_t202 != 0x41 || _v44 == 0) {
						_t203 =  *(_v4 + 4);
						_t388 = 0;
						if(_t203 != 0) {
							_t388 =  *(_t203 + 8);
						}
						_t377 = 0;
						_t281 = 0;
						if(_t388 <= 0) {
							L24:
							if(_v64 != 0 || (_v60 & 0x00000001) != 0) {
								_t205 = GetDriveTypeA( &_v36);
								_t389 = _t205;
								if(_t205 == 3) {
									L30:
									if(_t281 == 0) {
										goto L31;
									}
									goto L47;
								} else {
									_t205 = E0043E890(_t377, _t389,  &_v36);
									if(_t205 == 0) {
										goto L37;
									} else {
										if(_t281 == 0) {
											L31:
											_push(0x130);
											L004746C0();
											_t408 = _t408 + 4;
											_v40 = _t205;
											_v12 = 1;
											if(_t205 == 0) {
												_t209 = 0;
												__eflags = 0;
											} else {
												_t209 = L00425070(_t205, _v48, _t389);
											}
											_v12 = 0;
											_t402 = _t209;
											if(_t209 != 0) {
												_t351 =  *(_v4 + 4);
												if(_t351 != 0) {
													_push(1);
													_push(_t209);
													_push( *((intOrPtr*)(_t351 + 8)));
													L0043F7A0(_t281, _t351);
												}
											}
										} else {
											_t205 = L00424F10(_t281, _t402, _t377, _t389, _t402);
											goto L30;
										}
										goto L47;
									}
								}
							} else {
								L37:
								__eflags = _t281;
								if(_t281 == 0) {
									goto L47;
								} else {
									_t393 =  *(_v4 + 4);
									__eflags = _t393;
									if(_t393 == 0) {
										L45:
										__eflags = _t402;
										if(_t402 != 0) {
											 *((intOrPtr*)( *_t402 + 4))(1);
										}
										goto L47;
									} else {
										__eflags = _t377;
										if(_t377 == 0) {
											goto L45;
										} else {
											_t65 = _t377 - 1; // -1
											_t301 = _t65;
											__eflags = _t301;
											if(_t301 < 0) {
												goto L50;
											} else {
												_t267 =  *(_t393 + 8);
												_t67 = _t301 + 1; // 0x0
												__eflags = _t67 - _t267;
												if(_t67 > _t267) {
													goto L50;
												} else {
													_t269 = _t267 - _t301 - 1;
													__eflags = _t269;
													if(_t269 != 0) {
														_t373 =  *((intOrPtr*)(_t393 + 4));
														_t347 = _t373 + _t301 * 4;
														_t270 = _t269 << 2;
														__eflags = _t270;
														_t71 = _t347 + 4; // 0x3
														 *0x4afd74(_t373 + _t301 * 4, _t71, _t270);
														_t408 = _t408 + 0xc;
													}
													_t72 = _t393 + 8;
													 *_t72 =  *(_t393 + 8) - 1;
													__eflags =  *_t72;
													goto L45;
												}
											}
										}
									}
								}
							}
						} else {
							while(_t281 == 0) {
								_t273 =  *(_v4 + 4);
								if(_t273 == 0 || _t388 == 0) {
									L21:
									_v68 = 0;
									_v67 = 0;
									_t274 = L00425040(_t402);
									_v68 = _t274;
									 *0x4afd88( &_v68);
									_t408 = _t408 + 4;
									if(_v68 == _v48) {
										_t281 = 1;
										_t377 = _t388;
									}
									_t388 = _t388 - 1;
									if(_t388 > 0) {
										continue;
									} else {
										goto L24;
									}
								} else {
									_t34 = _t388 - 1; // -1
									_t301 = _t34;
									if(_t301 < 0 || _t301 >=  *((intOrPtr*)(_t273 + 8))) {
										L50:
										L91();
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_t404 = _t408;
										 *[fs:0x0] = _t408;
										_t410 = _t408 - 0x2b8;
										_t215 =  *0x4d0070; // 0x4961b978
										_t394 =  *0x4afd54; // 0x7c36a42b
										_t283 = _t301;
										_v108 = _t215;
										_v488 = 0;
										_v104 = _t410;
										memset( &_v484, 0, 0x4f << 2);
										_v768 = _t283;
										 *_t394( &_v168, "?:\DICOMDIR", _t377, _t393, _t281,  *[fs:0x0], 0x4a981e, 0xffffffff, _t402);
										_v788 =  &_v168;
										 *_t394( &_v152, "?:\");
										_v784 =  &_v152;
										_v752 = 0;
										_t223 = memset( &_v748, 0, 0x41 << 2);
										_v139 = 0;
										_v135 = 0;
										_v131 = 0;
										_v127 = 0;
										_v123 = 0;
										_v119 = 0;
										_v115 = 0;
										_v111 = 0;
										_v109 = 0;
										_v140 = _t223;
										_t309 =  *( *((intOrPtr*)(_t283 + 0x18)) + 4);
										_t413 = _t410 + 0x28;
										__eflags = _t309;
										if(_t309 != 0) {
											_t223 =  *(_t309 + 8);
										}
										_t383 = _v696;
										_t395 = _t223;
										while(1) {
											__eflags = _t395;
											_v692 = _t395;
											if(_t395 <= 0) {
												break;
											}
											_t226 =  *( *((intOrPtr*)(_t283 + 0x18)) + 4);
											__eflags = _t226;
											if(_t226 != 0) {
												_t115 = _t395 - 1; // -1
												_t315 = _t115;
												__eflags = _t315;
												if(_t315 < 0) {
													L89:
													goto ( *0x4afb68);
												}
												__eflags = _t315 -  *((intOrPtr*)(_t226 + 8));
												if(_t315 >=  *((intOrPtr*)(_t226 + 8))) {
													goto L89;
												}
												_v688 =  *((intOrPtr*)( *((intOrPtr*)(_t226 + 4)) + _t315 * 4));
											}
											_v676 = 0;
											_v675 = 0;
											_t227 = L00425040(_v688);
											_v676 = _t227;
											 *0x4afd88( &_v676);
											_t229 = _v676;
											_t314 = _v704;
											_t413 = _t413 + 4;
											 *_t314 = _t229;
											 *_v700 = _t229;
											_t223 =  *0x4af1e0(_t314,  &_v404);
											__eflags = _t223 - 0xffffffff;
											_v708 = _t223;
											if(_t223 != 0xffffffff) {
												while(1) {
													_t317 =  *( *((intOrPtr*)(_t283 + 0x10)) + 4);
													_t231 = 0;
													__eflags = _t317;
													_v669 = 0;
													if(_t317 != 0) {
														_t231 =  *(_t317 + 8);
													}
													__eflags = _t231;
													_t285 = _t231;
													if(_t231 <= 0) {
														goto L78;
													} else {
														goto L65;
													}
													while(1) {
														L65:
														__eflags = _v669;
														if(_v669 != 0) {
															break;
														}
														_t255 =  *( *((intOrPtr*)(_v684 + 0x10)) + 4);
														__eflags = _t255;
														if(_t255 != 0) {
															__eflags = _t285;
															if(_t285 != 0) {
																_t140 = _t285 - 1; // -1
																_t346 = _t140;
																__eflags = _t346;
																if(_t346 < 0) {
																	goto L89;
																}
																__eflags = _t346 -  *((intOrPtr*)(_t255 + 8));
																if(_t346 >=  *((intOrPtr*)(_t255 + 8))) {
																	goto L89;
																}
																_t383 =  *( *((intOrPtr*)(_t255 + 4)) + _t285 * 4 - 4);
															}
														}
														__eflags = _t383;
														if(_t383 != 0) {
															L004294F0(_t383,  &_v56);
															_t400 = L0046FF50( &_v56);
															_t260 = E0043C8A0(_t383);
															__eflags = _t260;
															if(_t260 != 0) {
																__eflags =  *((intOrPtr*)(_t260 + 8)) - _v676;
																if( *((intOrPtr*)(_t260 + 8)) == _v676) {
																	_t263 = L0046FF10( &_v56, L00425020(_v688), _t400);
																	__eflags = _t263;
																	if(_t263 != 0) {
																		_v669 = 1;
																	}
																}
															}
														}
														_t285 = _t285 - 1;
														__eflags = _t285;
														if(_t285 > 0) {
															continue;
														} else {
															__eflags = _v669;
															if(_v669 == 0) {
																goto L78;
															}
														}
														break;
													}
													L86:
													_t397 = _v708;
													_t238 =  *0x4af1d4(_t397,  &_v404);
													__eflags = _t238;
													if(_t238 != 0) {
														_t283 = _v684;
														_t317 =  *( *((intOrPtr*)(_t283 + 0x10)) + 4);
														_t231 = 0;
														__eflags = _t317;
														_v669 = 0;
														if(_t317 != 0) {
															_t231 =  *(_t317 + 8);
														}
														__eflags = _t231;
														_t285 = _t231;
														if(_t231 <= 0) {
															goto L78;
														} else {
															goto L65;
														}
														goto L86;
													}
													_t223 =  *0x4af1e4(_t397);
													_t283 = _v684;
													_t395 = _v692;
													goto L88;
													L78:
													memset( &_v660, 0, 0x40 << 2);
													L0046FF80(_v700,  &_v660, 4);
													_t237 = L0046FEC0( &_v360, L0046FF50( &_v360),  &_v660, 0x100, 3);
													_push(0x3fc);
													_v696 = 0;
													_v8 = 0;
													L004746C0();
													_t413 = _t413 + 0x10;
													_v712 = _t237;
													__eflags = _t237;
													_v8 = 1;
													if(__eflags == 0) {
														_t383 = 0;
													} else {
														_push(0);
														_t383 = E00434080(_t237, _t404, __eflags, _t444,  &_v668);
													}
													__eflags = _t383;
													_v8 = 0xffffffff;
													if(_t383 != 0) {
														_t398 =  *( *((intOrPtr*)(_v684 + 0x10)) + 4);
														__eflags = _t398;
														if(_t398 != 0) {
															_t286 =  *(_t398 + 8);
															__eflags = _t286;
															if(_t286 < 0) {
																goto L89;
															}
															L0043ED40(_t398, _t286 + 1, 0xffffffff);
															 *( *((intOrPtr*)(_t398 + 4)) + _t286 * 4) = _t383;
														}
														_t399 = _v688;
														L00429510(_t383, L00425020(_v688));
														L00429550(_t383, _v400, _v396);
														L00429590(_t383, L00425010(_v688));
														L00429E30(_t383, L00425060(_t399));
														L004295A0(_t383, L00424FF0(_t399));
													}
													goto L86;
												}
											}
											L88:
											_t395 = _t395 - 1;
										}
										 *[fs:0x0] = _v16;
										return L00475E7E(_t223, _v24);
									} else {
										_t402 =  *( *((intOrPtr*)(_t273 + 4)) + _t388 * 4 - 4);
										goto L21;
									}
								}
								goto L92;
							}
							goto L24;
						}
					} else {
						goto L47;
					}
					L92:
					L47:
					_t202 = _v36 + 1;
					_v60 = _v60 >> 1;
					_v36 = _t202;
				} while (_t202 <= 0x5a && _v64 == 0);
				_t207 =  *0x4afb9c();
				 *[fs:0x0] = _v20;
				return L00475E7E(_t207, _v24);
				goto L92;
			}


























































































































0x00440450
0x0044045e
0x00440468
0x0044046d
0x00440473
0x00440477
0x0044047f
0x00440489
0x0044048e
0x00440492
0x00440498
0x0044049b
0x004404a0
0x004404ab
0x004404dd
0x004404dd
0x004404cb
0x004404d3
0x004404db
0x00000000
0x00000000
0x004404db
0x004404f4
0x00440500
0x0044050e
0x00440516
0x0044051a
0x0044052d
0x00440531
0x00440533
0x00440537
0x00440539
0x0044053b
0x0044053b
0x0044053f
0x00440543
0x00440545
0x00440549
0x0044055b
0x0044055e
0x00440562
0x00440564
0x00440564
0x00440567
0x00440569
0x0044056d
0x004405da
0x004405e0
0x004405f2
0x004405f8
0x004405fd
0x0044061c
0x0044061e
0x00000000
0x00000000
0x00000000
0x004405ff
0x00440608
0x0044060f
0x00000000
0x00440611
0x00440613
0x00440624
0x00440624
0x00440629
0x0044062e
0x00440631
0x00440637
0x0044063c
0x0044064d
0x0044064d
0x0044063e
0x00440646
0x00440646
0x00440651
0x00440656
0x00440658
0x0044065e
0x00440663
0x00440665
0x00440667
0x0044066b
0x0044066c
0x0044066c
0x00440663
0x00440615
0x00440617
0x00000000
0x00440617
0x00000000
0x00440613
0x0044060f
0x00440673
0x00440673
0x00440673
0x00440675
0x00000000
0x00440677
0x0044067b
0x0044067e
0x00440680
0x004406bb
0x004406bb
0x004406bd
0x004406c6
0x004406c6
0x00000000
0x00440682
0x00440682
0x00440684
0x00000000
0x00440686
0x00440686
0x00440686
0x00440689
0x0044068b
0x00000000
0x00440691
0x00440691
0x00440694
0x00440697
0x00440699
0x00000000
0x0044069b
0x0044069d
0x0044069d
0x0044069e
0x004406a0
0x004406a3
0x004406a6
0x004406a6
0x004406aa
0x004406af
0x004406b5
0x004406b5
0x004406b8
0x004406b8
0x004406b8
0x00000000
0x004406b8
0x00440699
0x0044068b
0x00440684
0x00440680
0x00440675
0x00440570
0x00440570
0x00440578
0x0044057d
0x004405a2
0x004405a4
0x004405a9
0x004405ae
0x004405b8
0x004405bc
0x004405ca
0x004405cf
0x004405d1
0x004405d3
0x004405d3
0x004405d5
0x004405d8
0x00000000
0x00000000
0x00000000
0x00000000
0x00440583
0x00440583
0x00440583
0x00440588
0x00440715
0x00440715
0x0044071a
0x0044071b
0x0044071c
0x0044071d
0x0044071e
0x0044071f
0x00440721
0x00440731
0x00440738
0x0044073e
0x00440745
0x0044074c
0x0044074e
0x00440753
0x00440768
0x0044076b
0x00440776
0x0044077c
0x0044078a
0x00440790
0x00440795
0x0044079d
0x004407b1
0x004407b5
0x004407b8
0x004407bb
0x004407be
0x004407c1
0x004407c4
0x004407c7
0x004407ca
0x004407ce
0x004407d4
0x004407d7
0x004407da
0x004407dd
0x004407df
0x004407e1
0x004407e1
0x004407e4
0x004407ea
0x004407ec
0x004407ec
0x004407ee
0x004407f4
0x00000000
0x00000000
0x004407fd
0x00440800
0x00440802
0x00440804
0x00440804
0x00440807
0x00440809
0x00440adb
0x00474922
0x00474922
0x0044080f
0x00440812
0x00000000
0x00000000
0x00440820
0x00440820
0x0044082c
0x00440833
0x0044083a
0x00440846
0x0044084c
0x00440852
0x00440858
0x00440864
0x00440867
0x00440869
0x00440873
0x00440879
0x0044087c
0x00440882
0x00440890
0x00440893
0x00440896
0x00440898
0x0044089a
0x004408a1
0x004408a3
0x004408a3
0x004408a6
0x004408a8
0x004408aa
0x00000000
0x00000000
0x00000000
0x00000000
0x004408b0
0x004408b0
0x004408b6
0x004408b8
0x00000000
0x00000000
0x004408c7
0x004408ca
0x004408cc
0x004408ce
0x004408d0
0x004408d2
0x004408d2
0x004408d5
0x004408d7
0x00000000
0x00000000
0x004408dd
0x004408e0
0x00000000
0x00000000
0x004408e9
0x004408ed
0x004408d0
0x004408f1
0x004408f3
0x004408fb
0x00440911
0x00440913
0x00440918
0x0044091a
0x0044091f
0x00440925
0x0044093e
0x00440943
0x00440945
0x00440947
0x00440947
0x00440945
0x00440925
0x0044091a
0x0044094e
0x0044094f
0x00440951
0x00000000
0x00440957
0x0044095d
0x0044095f
0x00000000
0x00000000
0x0044095f
0x00000000
0x00440951
0x00440aa6
0x00440aa6
0x00440ab4
0x00440aba
0x00440abc
0x0044088a
0x00440893
0x00440896
0x00440898
0x0044089a
0x004408a1
0x004408a3
0x004408a3
0x004408a6
0x004408a8
0x004408aa
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004408aa
0x00440ac3
0x00440ac9
0x00440acf
0x00000000
0x00440965
0x00440978
0x0044098a
0x004409bd
0x004409c2
0x004409c7
0x004409d1
0x004409d8
0x004409dd
0x004409e0
0x004409e6
0x004409e8
0x004409ec
0x00440a02
0x004409ee
0x004409ee
0x004409fe
0x004409fe
0x00440a12
0x00440a14
0x00440a1b
0x00440a2a
0x00440a2d
0x00440a2f
0x00440a31
0x00440a34
0x00440a36
0x00000000
0x00000000
0x00440a44
0x00440a4c
0x00440a4c
0x00440a4f
0x00440a5f
0x00440a74
0x00440a83
0x00440a92
0x00440aa1
0x00440aa1
0x00000000
0x00440a1b
0x00440890
0x00440ad5
0x00440ad5
0x00440ad5
0x00440ae3
0x00440af8
0x00440597
0x0044059a
0x00000000
0x0044059e
0x00440588
0x00000000
0x0044057d
0x00000000
0x00440570
0x00000000
0x00000000
0x00000000
0x00000000
0x004406c9
0x004406d3
0x004406d7
0x004406db
0x004406db
0x004406f1
0x004406fe
0x00440712
0x00000000

APIs
  • GetLogicalDrives.KERNEL32 ref: 00440510
  • GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004405F2
Strings
Memory Dump Source
  • Source File: 00000000.00000002.365792021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
  • Associated: 00000000.00000002.365788375.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365930912.00000000004AF000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365944191.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365948402.00000000004CB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365952623.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365968509.00000000004EF000.00000004.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.365973393.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366228410.0000000000675000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366239308.000000000067B000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366264179.00000000006E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366884080.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366894963.00000000007EB000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366900076.00000000007EE000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366910757.00000000007F5000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366934540.0000000000803000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.366939475.0000000000807000.00000002.00000001.01000000.00000003.sdmpDownload File
  • Associated: 00000000.00000002.367079490.0000000000847000.00000002.00000001.01000000.00000003.sdmpDownload File
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_400000_Viewer.jbxd
Similarity
  • API ID: DriveDrivesLogicalType
  • String ID: ?:\
  • API String ID: 4038169723-2533537817
  • Opcode ID: 967176440092786ed810d106c017d96204bd582591fcca2330ba55085dc828a5
  • Instruction ID: faec8ebbeeb90dc9274a78224cd1831890f856776637b81a0203d7858d8de9bb
  • Opcode Fuzzy Hash: 967176440092786ed810d106c017d96204bd582591fcca2330ba55085dc828a5
  • Instruction Fuzzy Hash: 7581E2302093419FE714DF64D454B6BBBE0AF85704F08496EF98A9B352DB38D918CB9A
Uniqueness

Uniqueness Score: -1.00%