Wer ist 02272 402568

			_entry_() {
				WCHAR* _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				int _v24;
				int _v28;
				struct _TOKEN_PRIVILEGES _v40;
				signed char _v42;
				int _v44;
				signed int _v48;
				intOrPtr _v278;
				signed short _v310;
				struct _OSVERSIONINFOW _v324;
				struct _SHFILEINFOW _v1016;
				intOrPtr* _t88;
				WCHAR* _t92;
				char* _t94;
				void _t97;
				void* _t116;
				WCHAR* _t118;
				signed int _t120;
				intOrPtr* _t124;
				void* _t138;
				void* _t144;
				void* _t149;
				void* _t153;
				void* _t158;
				signed int _t168;
				void* _t171;
				void* _t176;
				intOrPtr _t178;
				intOrPtr _t179;
				intOrPtr* _t180;
				int _t189;
				void* _t190;
				void* _t199;
				signed int _t205;
				signed int _t210;
				signed int _t215;
				signed int _t217;
				int* _t219;
				signed int _t227;
				signed int _t230;
				CHAR* _t232;
				char* _t233;
				signed int _t234;
				WCHAR* _t235;
				void* _t251;

				_t217 = 0x20;
				_t189 = 0;
				_v24 = 0;
				_v8 = L"Error writing temporary file. Make sure your temp folder is valid.";
				_v20 = 0;
				SetErrorMode(0x8001); // executed
				_v324.szCSDVersion = 0;
				_v48 = 0;
				_v44 = 0;
				_v324.dwOSVersionInfoSize = 0x11c;
				if(GetVersionExW( &_v324) == 0) {
					_v324.dwOSVersionInfoSize = 0x114;
					GetVersionExW( &_v324);
					asm("sbb eax, eax");
					_v42 = 4;
					_v48 =  !( ~(_v324.szCSDVersion - 0x53)) & _v278 + 0xffffffd0;
				}
				if(_v324.dwMajorVersion < 0xa) {
					_v310 = _v310 & 0x00000000;
				}
				 *0x434fb8 = _v324.dwBuildNumber;
				 *0x434fbc = (_v324.dwMajorVersion & 0x0000ffff | _v324.dwMinorVersion & 0x000000ff) << 0x00000010 | _v48 & 0x0000ffff | _v42 & 0x000000ff;
				if( *0x434fbe != 0x600) {
					_t180 = E0040690A(_t189);
					if(_t180 != _t189) {
						 *_t180(0xc00);
					}
				}
				_t232 = "UXTHEME";
				do {
					E0040689A(_t232); // executed
					_t232 =  &(_t232[lstrlenA(_t232) + 1]);
				} while ( *_t232 != 0);
				E0040690A(0xb);
				 *0x434f04 = E0040690A(9);
				_t88 = E0040690A(7);
				if(_t88 != _t189) {
					_t88 =  *_t88(0x1e);
					if(_t88 != 0) {
						 *0x434fbc =  *0x434fbc | 0x00000080;
					}
				}
				__imp__#17();
				__imp__OleInitialize(_t189); // executed
				 *0x434fc0 = _t88;
				SHGetFileInfoW(0x42b228, _t189,  &_v1016, 0x2b4, _t189); // executed
				E0040653D(0x433f00, L"NSIS Error");
				_t92 = GetCommandLineW();
				_t233 = L"\"C:\\Users\\alfons\\Desktop\\doc.1234567098.pff.exe\" ";
				E0040653D(_t233, _t92);
				_t94 = _t233;
				_t234 = 0x22;
				 *0x434f00 = 0x400000;
				_t251 = L"\"C:\\Users\\alfons\\Desktop\\doc.1234567098.pff.exe\" " - _t234; // 0x22
				if(_t251 == 0) {
					_t217 = _t234;
					_t94 =  &M00440002;
				}
				_t199 = CharNextW(E00405E39(_t94, _t217));
				_v16 = _t199;
				while(1) {
					_t97 =  *_t199;
					_t252 = _t97 - _t189;
					if(_t97 == _t189) {
						break;
					}
					_t210 = 0x20;
					__eflags = _t97 - _t210;
					if(_t97 != _t210) {
						L17:
						__eflags =  *_t199 - _t234;
						_v12 = _t210;
						if( *_t199 == _t234) {
							_v12 = _t234;
							_t199 = _t199 + 2;
							__eflags = _t199;
						}
						__eflags =  *_t199 - 0x2f;
						if( *_t199 != 0x2f) {
							L32:
							_t199 = E00405E39(_t199, _v12);
							__eflags =  *_t199 - _t234;
							if(__eflags == 0) {
								_t199 = _t199 + 2;
								__eflags = _t199;
							}
							continue;
						} else {
							_t199 = _t199 + 2;
							__eflags =  *_t199 - 0x53;
							if( *_t199 != 0x53) {
								L24:
								asm("cdq");
								asm("cdq");
								_t215 = L"NCRC" & 0x0000ffff;
								asm("cdq");
								_t227 = ( *0x40a2c2 & 0x0000ffff) << 0x00000010 |  *0x40a2c0 & 0x0000ffff | _t215;
								__eflags =  *_t199 - (( *0x40a2be & 0x0000ffff) << 0x00000010 | _t215);
								if( *_t199 != (( *0x40a2be & 0x0000ffff) << 0x00000010 | _t215)) {
									L29:
									asm("cdq");
									asm("cdq");
									_t210 = L" /D=" & 0x0000ffff;
									asm("cdq");
									_t230 = ( *0x40a2b6 & 0x0000ffff) << 0x00000010 |  *0x40a2b4 & 0x0000ffff | _t210;
									__eflags =  *(_t199 - 4) - (( *0x40a2b2 & 0x0000ffff) << 0x00000010 | _t210);
									if( *(_t199 - 4) != (( *0x40a2b2 & 0x0000ffff) << 0x00000010 | _t210)) {
										L31:
										_t234 = 0x22;
										goto L32;
									}
									__eflags =  *_t199 - _t230;
									if( *_t199 == _t230) {
										 *(_t199 - 4) = _t189;
										__eflags = _t199;
										E0040653D(L"C:\\Users\\alfons\\AppData\\Local\\Temp", _t199);
										L37:
										_t235 = L"C:\\Users\\alfons\\AppData\\Local\\Temp\\";
										GetTempPathW(0x400, _t235);
										_t116 = E004034FC(_t199, _t252);
										_t253 = _t116;
										if(_t116 != 0) {
											L40:
											DeleteFileW(L"1033"); // executed
											_t118 = E0040307D(_t255, _v20); // executed
											_v8 = _t118;
											if(_t118 != _t189) {
												L68:
												E00403B12();
												__imp__OleUninitialize();
												if(_v8 == _t189) {
													if( *0x434f94 == _t189) {
														L77:
														_t120 =  *0x434fac;
														if(_t120 != 0xffffffff) {
															_v24 = _t120;
														}
														ExitProcess(_v24);
													}
													if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v16) != 0) {
														LookupPrivilegeValueW(_t189, L"SeShutdownPrivilege",  &(_v40.Privileges));
														_v40.PrivilegeCount = 1;
														_v28 = 2;
														AdjustTokenPrivileges(_v16, _t189,  &_v40, _t189, _t189, _t189);
													}
													_t124 = E0040690A(4);
													if(_t124 == _t189) {
														L75:
														if(ExitWindowsEx(2, 0x80040002) != 0) {
															goto L77;
														}
														goto L76;
													} else {
														_push(0x80040002);
														_push(0x25);
														_push(_t189);
														_push(_t189);
														_push(_t189);
														if( *_t124() == 0) {
															L76:
															E0040140B(9);
															goto L77;
														}
														goto L75;
													}
												}
												E00405B9D(_v8, 0x200010);
												ExitProcess(2);
											}
											if( *0x434f1c == _t189) {
												L51:
												 *0x434fac =  *0x434fac | 0xffffffff;
												_v24 = E00403BEC(_t265);
												goto L68;
											}
											_t219 = E00405E39(L"\"C:\\Users\\alfons\\Desktop\\doc.1234567098.pff.exe\" ", _t189);
											if(_t219 < L"\"C:\\Users\\alfons\\Desktop\\doc.1234567098.pff.exe\" ") {
												L48:
												_t264 = _t219 - L"\"C:\\Users\\alfons\\Desktop\\doc.1234567098.pff.exe\" ";
												_v8 = L"Error launching installer";
												if(_t219 < L"\"C:\\Users\\alfons\\Desktop\\doc.1234567098.pff.exe\" ") {
													_t190 = E00405B08(__eflags);
													lstrcatW(_t235, L"~nsu");
													__eflags = _t190;
													if(_t190 != 0) {
														lstrcatW(_t235, "A");
													}
													lstrcatW(_t235, L".tmp");
													_t220 = L"C:\\Users\\alfons\\Desktop";
													_t138 = lstrcmpiW(_t235, L"C:\\Users\\alfons\\Desktop");
													__eflags = _t138;
													if(_t138 == 0) {
														L67:
														_t189 = 0;
														__eflags = 0;
														goto L68;
													} else {
														__eflags = _t190;
														_push(_t235);
														if(_t190 == 0) {
															E00405AEB();
														} else {
															E00405A6E();
														}
														SetCurrentDirectoryW(_t235);
														__eflags = L"C:\\Users\\alfons\\AppData\\Local\\Temp"; // 0x43
														if(__eflags == 0) {
															E0040653D(L"C:\\Users\\alfons\\AppData\\Local\\Temp", _t220);
														}
														E0040653D(0x436000, _v16);
														_t202 = "A" & 0x0000ffff;
														_t144 = ( *0x40a25a & 0x0000ffff) << 0x00000010 | "A" & 0x0000ffff;
														__eflags = _t144;
														_v12 = 0x1a;
														 *0x436800 = _t144;
														do {
															E0040657A(0, 0x42aa28, _t235, 0x42aa28,  *((intOrPtr*)( *0x434f10 + 0x120)));
															DeleteFileW(0x42aa28);
															__eflags = _v8;
															if(_v8 != 0) {
																_t149 = CopyFileW(L"C:\\Users\\alfons\\Desktop\\doc.1234567098.pff.exe", 0x42aa28, 1);
																__eflags = _t149;
																if(_t149 != 0) {
																	E004062FD(_t202, 0x42aa28, 0);
																	E0040657A(0, 0x42aa28, _t235, 0x42aa28,  *((intOrPtr*)( *0x434f10 + 0x124)));
																	_t153 = E00405B20(0x42aa28);
																	__eflags = _t153;
																	if(_t153 != 0) {
																		CloseHandle(_t153);
																		_v8 = 0;
																	}
																}
															}
															 *0x436800 =  *0x436800 + 1;
															_t61 =  &_v12;
															 *_t61 = _v12 - 1;
															__eflags =  *_t61;
														} while ( *_t61 != 0);
														E004062FD(_t202, _t235, 0);
														goto L67;
													}
												}
												 *_t219 = _t189;
												_t222 =  &(_t219[2]);
												_t158 = E00405F14(_t264,  &(_t219[2]));
												_t265 = _t158;
												if(_t158 == 0) {
													goto L68;
												}
												E0040653D(L"C:\\Users\\alfons\\AppData\\Local\\Temp", _t222);
												E0040653D(L"C:\\Users\\alfons\\AppData\\Local\\Temp", _t222);
												_v8 = _t189;
												goto L51;
											}
											asm("cdq");
											asm("cdq");
											asm("cdq");
											_t205 = ( *0x40a27e & 0x0000ffff) << 0x00000010 | L" _?=" & 0x0000ffff;
											_t168 = ( *0x40a282 & 0x0000ffff) << 0x00000010 |  *0x40a280 & 0x0000ffff | (_t210 << 0x00000020 |  *0x40a282 & 0x0000ffff) << 0x10;
											while( *_t219 != _t205 || _t219[1] != _t168) {
												_t219 = _t219;
												if(_t219 >= L"\"C:\\Users\\alfons\\Desktop\\doc.1234567098.pff.exe\" ") {
													continue;
												}
												break;
											}
											_t189 = 0;
											goto L48;
										}
										GetWindowsDirectoryW(_t235, 0x3fb);
										lstrcatW(_t235, L"\\Temp");
										_t171 = E004034FC(_t199, _t253);
										_t254 = _t171;
										if(_t171 != 0) {
											goto L40;
										}
										GetTempPathW(0x3fc, _t235);
										lstrcatW(_t235, L"Low");
										SetEnvironmentVariableW(L"TEMP", _t235);
										SetEnvironmentVariableW(L"TMP", _t235);
										_t176 = E004034FC(_t199, _t254);
										_t255 = _t176;
										if(_t176 == 0) {
											goto L68;
										}
										goto L40;
									}
									goto L31;
								}
								__eflags =  *((intOrPtr*)(_t199 + 4)) - _t227;
								if( *((intOrPtr*)(_t199 + 4)) != _t227) {
									goto L29;
								}
								_t178 =  *((intOrPtr*)(_t199 + 8));
								__eflags = _t178 - 0x20;
								if(_t178 == 0x20) {
									L28:
									_t36 =  &_v20;
									 *_t36 = _v20 | 0x00000004;
									__eflags =  *_t36;
									goto L29;
								}
								__eflags = _t178 - _t189;
								if(_t178 != _t189) {
									goto L29;
								}
								goto L28;
							}
							_t179 =  *((intOrPtr*)(_t199 + 2));
							__eflags = _t179 - _t210;
							if(_t179 == _t210) {
								L23:
								 *0x434fa0 = 1;
								goto L24;
							}
							__eflags = _t179 - _t189;
							if(_t179 != _t189) {
								goto L24;
							}
							goto L23;
						}
					} else {
						goto L16;
					}
					do {
						L16:
						_t199 = _t199 + 2;
						__eflags =  *_t199 - _t210;
					} while ( *_t199 == _t210);
					goto L17;
				}
				goto L37;
			}

0x0040353b
0x0040353c
0x00403543
0x00403546
0x0040354d
0x00403550
0x00403563
0x00403569
0x0040356c
0x0040356f
0x0040357d
0x00403585
0x00403590
0x004035a9
0x004035ab
0x004035b3
0x004035b3
0x004035be
0x004035c0
0x004035c0
0x004035d5
0x004035fa
0x00403608
0x0040360b
0x00403612
0x00403619
0x00403619
0x00403612
0x0040361b
0x00403620
0x00403621
0x0040362d
0x00403631
0x00403638
0x00403646
0x0040364b
0x00403652
0x00403656
0x0040365a
0x0040365c
0x0040365c
0x0040365a
0x00403663
0x0040366a
0x00403670
0x00403688
0x00403698
0x0040369d
0x004036a3
0x004036aa
0x004036b1
0x004036b3
0x004036b4
0x004036be
0x004036c5
0x004036c7
0x004036c9
0x004036c9
0x004036dc
0x004036de
0x004037d8
0x004037d8
0x004037db
0x004037de
0x00000000
0x00000000
0x004036e8
0x004036e9
0x004036ec
0x004036f5
0x004036f5
0x004036f8
0x004036fb
0x004036fe
0x00403701
0x00403701
0x00403701
0x00403702
0x00403706
0x004037c6
0x004037cf
0x004037d1
0x004037d4
0x004037d7
0x004037d7
0x004037d7
0x00000000
0x0040370c
0x0040370d
0x0040370e
0x00403712
0x0040372c
0x00403733
0x00403746
0x00403747
0x0040375c
0x00403761
0x00403763
0x00403765
0x00403781
0x00403788
0x0040379b
0x0040379c
0x004037b1
0x004037b7
0x004037b9
0x004037bb
0x004037c3
0x004037c5
0x00000000
0x004037c5
0x004037bf
0x004037c1
0x004037e6
0x004037ea
0x004037f3
0x004037f8
0x004037fe
0x00403809
0x0040380b
0x00403810
0x00403812
0x0040386a
0x0040386f
0x00403878
0x0040387f
0x00403882
0x00403a59
0x00403a59
0x00403a5e
0x00403a67
0x00403a84
0x00403afc
0x00403afc
0x00403b04
0x00403b06
0x00403b06
0x00403b0c
0x00403b0c
0x00403a9b
0x00403aa7
0x00403ab8
0x00403abf
0x00403ac6
0x00403ac6
0x00403ace
0x00403ada
0x00403ae8
0x00403af3
0x00000000
0x00000000
0x00000000
0x00403adc
0x00403adc
0x00403add
0x00403adf
0x00403ae0
0x00403ae1
0x00403ae6
0x00403af5
0x00403af7
0x00000000
0x00403af7
0x00000000
0x00403ae6
0x00403ada
0x00403a71
0x00403a78
0x00403a78
0x0040388e
0x00403935
0x00403935
0x00403941
0x00000000
0x00403941
0x0040389f
0x004038a7
0x004038f9
0x004038f9
0x004038ff
0x00403906
0x00403954
0x00403956
0x0040395b
0x0040395d
0x00403965
0x00403965
0x00403970
0x00403975
0x0040397c
0x00403982
0x00403984
0x00403a57
0x00403a57
0x00403a57
0x00000000
0x0040398a
0x0040398a
0x0040398c
0x0040398d
0x00403996
0x0040398f
0x0040398f
0x0040398f
0x0040399c
0x004039a4
0x004039ab
0x004039b3
0x004039b3
0x004039c0
0x004039cc
0x004039d6
0x004039d6
0x004039d8
0x004039df
0x004039e9
0x004039f5
0x004039fb
0x00403a01
0x00403a04
0x00403a0e
0x00403a14
0x00403a16
0x00403a1a
0x00403a2b
0x00403a31
0x00403a36
0x00403a38
0x00403a3b
0x00403a41
0x00403a41
0x00403a38
0x00403a16
0x00403a44
0x00403a4b
0x00403a4b
0x00403a4b
0x00403a4b
0x00403a52
0x00000000
0x00403a52
0x00403984
0x00403908
0x0040390b
0x0040390f
0x00403914
0x00403916
0x00000000
0x00000000
0x00403922
0x0040392d
0x00403932
0x00000000
0x00403932
0x004038b0
0x004038c8
0x004038d9
0x004038da
0x004038de
0x004038e0
0x004038ee
0x004038f5
0x00000000
0x00000000
0x00000000
0x004038f5
0x004038f7
0x00000000
0x004038f7
0x0040381a
0x00403826
0x0040382b
0x00403830
0x00403832
0x00000000
0x00000000
0x0040383a
0x00403842
0x00403853
0x0040385b
0x0040385d
0x00403862
0x00403864
0x00000000
0x00000000
0x00000000
0x00403864
0x00000000
0x004037c1
0x0040376a
0x0040376c
0x00000000
0x00000000
0x0040376e
0x00403772
0x00403776
0x0040377d
0x0040377d
0x0040377d
0x0040377d
0x00000000
0x0040377d
0x00403778
0x0040377b
0x00000000
0x00000000
0x00000000
0x0040377b
0x00403714
0x00403718
0x0040371b
0x00403722
0x00403722
0x00000000
0x00403722
0x0040371d
0x00403720
0x00000000
0x00000000
0x00000000
0x00403720
0x00000000
0x00000000
0x00000000
0x004036ee
0x004036ee
0x004036ef
0x004036f0
0x004036f0
0x00000000
0x004036ee
0x00000000

• SetErrorMode.KERNELBASE(00008001), ref: 00403550
• GetVersionExW.KERNEL32(?), ref: 00403579
• GetVersionExW.KERNEL32(0000011C), ref: 00403590
• lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403627
• #17.COMCTL32(00000007,00000009,0000000B), ref: 00403663
• OleInitialize.OLE32(00000000), ref: 0040366A
• SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 00403688
• GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 0040369D
• CharNextW.USER32(00000000,"C:\Users\user\Desktop\doc.1234567098.pff.exe" ,00000020,"C:\Users\user\Desktop\doc.1234567098.pff.exe" ,00000000), ref: 004036D6
• GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 00403809
• GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040381A
• lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403826
• GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040383A
• lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403842
• SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403853
• SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040385B
• DeleteFileW.KERNELBASE(1033), ref: 0040386F
• lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu), ref: 00403956
• lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C), ref: 00403965
• Part of subcall function 00405AEB: CreateDirectoryW.KERNELBASE(?,00000000,00403520,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405AF1
• lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp), ref: 00403970
• lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\doc.1234567098.pff.exe" ,00000000,?), ref: 0040397C
• SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040399C
• DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00436000,?), ref: 004039FB
• CopyFileW.KERNEL32(C:\Users\user\Desktop\doc.1234567098.pff.exe,0042AA28,00000001), ref: 00403A0E
• CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403A3B
• OleUninitialize.OLE32(?), ref: 00403A5E
• ExitProcess.KERNEL32 ref: 00403A78
• GetCurrentProcess.KERNEL32(00000028,?), ref: 00403A8C
• OpenProcessToken.ADVAPI32(00000000), ref: 00403A93
• LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AA7
• AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403AC6
• ExitWindowsEx.USER32(00000002,80040002), ref: 00403AEB
• ExitProcess.KERNEL32 ref: 00403B0C

• 1033, xrefs: 0040386A
• "C:\Users\user\Desktop\doc.1234567098.pff.exe" , xrefs: 004036A3, 004036A9, 004036BE, 00403895, 004038A1, 004038EF, 004038F9
• \Temp, xrefs: 00403820
• NSIS Error, xrefs: 0040368E
• TEMP, xrefs: 0040384E
• C:\Users\user\Desktop\doc.1234567098.pff.exe, xrefs: 00403A09
• TMP, xrefs: 00403856
• Error launching installer, xrefs: 004038FF
• SeShutdownPrivilege, xrefs: 00403AA1
• C:\Users\user\AppData\Local\Temp\, xrefs: 004037FE, 00403803, 00403819, 00403825, 00403834, 00403841, 0040384D, 00403855, 00403953, 00403964, 0040396F, 0040397B, 0040398C, 0040399B, 00403A51
• C:\Users\user\Desktop, xrefs: 00403975, 0040397A, 004039AD
• C:\Users\user\AppData\Local\Temp, xrefs: 004037EE, 0040391D, 004039A4, 004039AE
• .tmp, xrefs: 0040396A
• ~nsu, xrefs: 0040394E
• C:\Users\user\AppData\Local\Temp, xrefs: 00403928
• Low, xrefs: 0040383C
• UXTHEME, xrefs: 0040361B, 00403620, 00403626

• Source File: 00000000.00000002.942332799.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

• Associated: 00000000.00000002.942318478.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942344612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942349438.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942376320.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942382891.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942388876.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942394858.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942403454.000000000045C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942407919.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

• Snapshot File: hcaresult_0_2_400000_doc.jbxd

• API ID: lstrcat$FileProcess$DirectoryExit$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
• String ID: "C:\Users\user\Desktop\doc.1234567098.pff.exe" $.tmp$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\doc.1234567098.pff.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
• API String ID: 3859024572-1443225782
• Opcode ID: 0e74615daec99f27994232cf99c73b7d459649d5a28d4012cbb259fd556bc3d0
• Instruction ID: 4d4dc0a58e4858e72561def8a0259f0227da8af974c10a5ea2b310ef4b80d7a5
• Opcode Fuzzy Hash: 0e74615daec99f27994232cf99c73b7d459649d5a28d4012cbb259fd556bc3d0
• Instruction Fuzzy Hash: 66E10670A00214AADB10AFB59D45BAF3AB8EF4470AF14847FF545B22D1DB7C8A41CB6D

Uniqueness Score: -1.00%

			E004056DE(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t94;
				long _t95;
				int _t100;
				int _t101;
				long _t104;
				void* _t108;
				intOrPtr _t119;
				void* _t127;
				intOrPtr _t130;
				struct HWND__* _t134;
				int _t156;
				int _t159;
				struct HMENU__* _t164;
				struct HWND__* _t168;
				struct HWND__* _t169;
				int _t171;
				void* _t172;
				short* _t173;
				short* _t175;
				int _t177;

				_t169 =  *0x433ee4; // 0x10392
				_t156 = 0;
				_v8 = _t169;
				if(_a8 != 0x110) {
					__eflags = _a8 - 0x405;
					if(_a8 == 0x405) {
						_t127 = CreateThread(0, 0, E00405672, GetDlgItem(_a4, 0x3ec), 0,  &_v12); // executed
						FindCloseChangeNotification(_t127); // executed
					}
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L17:
						_t171 = 1;
						__eflags = _a8 - 0x404;
						if(_a8 != 0x404) {
							L25:
							__eflags = _a8 - 0x7b;
							if(_a8 != 0x7b) {
								goto L20;
							}
							_t94 = _v8;
							__eflags = _a12 - _t94;
							if(_a12 != _t94) {
								goto L20;
							}
							_t95 = SendMessageW(_t94, 0x1004, _t156, _t156);
							__eflags = _t95 - _t156;
							_a8 = _t95;
							if(_t95 <= _t156) {
								L36:
								return 0;
							}
							_t164 = CreatePopupMenu();
							AppendMenuW(_t164, _t156, _t171, E0040657A(_t156, _t164, _t171, _t156, 0xffffffe1));
							_t100 = _a16;
							__eflags = _a16 - 0xffffffff;
							_t159 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v28);
								_t100 = _v28.left;
								_t159 = _v28.top;
							}
							_t101 = TrackPopupMenu(_t164, 0x180, _t100, _t159, _t156, _a4, _t156);
							__eflags = _t101 - _t171;
							if(_t101 == _t171) {
								_v60 = _t156;
								_v48 = 0x42d268;
								_v44 = 0x1000;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t104 = SendMessageW(_v8, 0x1073, _a4,  &_v68);
									__eflags = _a4 - _t156;
									_t171 = _t171 + _t104 + 2;
								} while (_a4 != _t156);
								OpenClipboard(_t156);
								EmptyClipboard();
								_t108 = GlobalAlloc(0x42, _t171 + _t171);
								_a4 = _t108;
								_t172 = GlobalLock(_t108);
								do {
									_v48 = _t172;
									_t173 = _t172 + SendMessageW(_v8, 0x1073, _t156,  &_v68) * 2;
									 *_t173 = 0xd;
									_t175 = _t173 + 2;
									 *_t175 = 0xa;
									_t172 = _t175 + 2;
									_t156 = _t156 + 1;
									__eflags = _t156 - _a8;
								} while (_t156 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(0xd, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						__eflags =  *0x433ecc - _t156; // 0x0
						if(__eflags == 0) {
							ShowWindow( *0x434f08, 8);
							__eflags =  *0x434f8c - _t156;
							if( *0x434f8c == _t156) {
								_t119 =  *0x42c240; // 0x75a904
								E0040559F( *((intOrPtr*)(_t119 + 0x34)), _t156);
							}
							E00404472(_t171);
							goto L25;
						}
						 *0x42ba38 = 2;
						E00404472(0x78);
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E00404500(_a8, _a12, _a16);
						}
						ShowWindow( *0x433ed0, _t156);
						ShowWindow(_t169, 8);
						E004044CE(_t169);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_t177 = 2;
				_v60 = _t177;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t130 =  *0x434f10;
				_a8 =  *((intOrPtr*)(_t130 + 0x5c));
				_a12 =  *((intOrPtr*)(_t130 + 0x60));
				 *0x433ed0 = GetDlgItem(_a4, 0x403);
				 *0x433ec8 = GetDlgItem(_a4, 0x3ee);
				_t134 = GetDlgItem(_a4, 0x3f8);
				 *0x433ee4 = _t134;
				_v8 = _t134;
				E004044CE( *0x433ed0);
				 *0x433ed4 = E00404E27(4);
				 *0x433eec = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(_t177);
				SendMessageW(_v8, 0x1061, 0,  &_v60); // executed
				SendMessageW(_v8, 0x1036, 0x4000, 0x4000); // executed
				if(_a8 >= 0) {
					SendMessageW(_v8, 0x1001, 0, _a8);
					SendMessageW(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t156) {
					SendMessageW(_v8, 0x1024, _t156, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00404499(_a4);
				if(( *0x434f18 & 0x00000003) != 0) {
					ShowWindow( *0x433ed0, _t156);
					if(( *0x434f18 & 0x00000002) != 0) {
						 *0x433ed0 = _t156;
					} else {
						ShowWindow(_v8, 8);
					}
					E004044CE( *0x433ec8);
				}
				_t168 = GetDlgItem(_a4, 0x3ec);
				SendMessageW(_t168, 0x401, _t156, 0x75300000);
				if(( *0x434f18 & 0x00000004) != 0) {
					SendMessageW(_t168, 0x409, _t156, _a12);
					SendMessageW(_t168, 0x2001, _t156, _a8);
				}
				goto L36;
			}

0x004056e6
0x004056ec
0x004056f6
0x004056f9
0x00405888
0x0040588f
0x004058ac
0x004058b3
0x004058b3
0x004058b9
0x004058c6
0x004058e4
0x004058e6
0x004058e7
0x004058ee
0x00405944
0x00405944
0x00405948
0x00000000
0x00000000
0x0040594a
0x0040594d
0x00405950
0x00000000
0x00000000
0x0040595a
0x00405960
0x00405962
0x00405965
0x00405a67
0x00000000
0x00405a67
0x00405974
0x0040597f
0x00405988
0x0040598f
0x00405993
0x00405996
0x0040599f
0x004059a5
0x004059a8
0x004059a8
0x004059b8
0x004059be
0x004059c0
0x004059c9
0x004059cc
0x004059d3
0x004059da
0x004059e2
0x004059e2
0x004059f0
0x004059f6
0x004059f9
0x004059f9
0x00405a00
0x00405a06
0x00405a12
0x00405a19
0x00405a22
0x00405a24
0x00405a27
0x00405a36
0x00405a39
0x00405a3f
0x00405a40
0x00405a46
0x00405a47
0x00405a48
0x00405a48
0x00405a50
0x00405a5b
0x00405a61
0x00405a61
0x00000000
0x004059c0
0x004058f0
0x004058f6
0x00405926
0x00405928
0x0040592e
0x00405930
0x00405939
0x00405939
0x0040593f
0x00000000
0x0040593f
0x004058fa
0x00405904
0x00000000
0x004058c8
0x004058c8
0x004058ce
0x00405909
0x00000000
0x00405912
0x004058d7
0x004058dc
0x004058df
0x00000000
0x004058df
0x004058c6
0x004056ff
0x00405703
0x0040570b
0x0040570f
0x00405712
0x00405715
0x00405718
0x0040571b
0x0040571c
0x0040571d
0x00405736
0x00405739
0x00405743
0x00405752
0x0040575a
0x00405762
0x00405767
0x0040576a
0x00405776
0x0040577f
0x00405788
0x004057aa
0x004057b0
0x004057c1
0x004057c6
0x004057d4
0x004057e2
0x004057e2
0x004057e7
0x004057f5
0x004057f5
0x004057fa
0x004057fd
0x00405802
0x0040580e
0x00405817
0x00405824
0x00405833
0x00405826
0x0040582b
0x0040582b
0x0040583f
0x0040583f
0x00405853
0x0040585c
0x00405865
0x00405875
0x00405881
0x00405881
0x00000000

• GetDlgItem.USER32 ref: 0040573C
• GetDlgItem.USER32 ref: 0040574B
• GetClientRect.USER32 ref: 00405788
• GetSystemMetrics.USER32 ref: 0040578F
• SendMessageW.USER32(?,00001061,00000000,?), ref: 004057B0
• SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057C1
• SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004057D4
• SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004057E2
• SendMessageW.USER32(?,00001024,00000000,?), ref: 004057F5
• ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405817
• ShowWindow.USER32(?,00000008), ref: 0040582B
• GetDlgItem.USER32 ref: 0040584C
• SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040585C
• SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405875
• SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405881
• GetDlgItem.USER32 ref: 0040575A
• Part of subcall function 004044CE: SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC
• GetDlgItem.USER32 ref: 0040589E
• CreateThread.KERNELBASE ref: 004058AC
• FindCloseChangeNotification.KERNELBASE(00000000), ref: 004058B3
• ShowWindow.USER32(00000000), ref: 004058D7
• ShowWindow.USER32(00010392,00000008), ref: 004058DC
• ShowWindow.USER32(00000008), ref: 00405926
• SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040595A
• CreatePopupMenu.USER32 ref: 0040596B
• AppendMenuW.USER32 ref: 0040597F
• GetWindowRect.USER32 ref: 0040599F
• TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059B8
• SendMessageW.USER32(?,00001073,00000000,?), ref: 004059F0
• OpenClipboard.USER32(00000000), ref: 00405A00
• EmptyClipboard.USER32 ref: 00405A06
• GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A12
• GlobalLock.KERNEL32 ref: 00405A1C
• SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A30
• GlobalUnlock.KERNEL32(00000000), ref: 00405A50
• SetClipboardData.USER32(0000000D,00000000), ref: 00405A5B
• CloseClipboard.USER32 ref: 00405A61

• Source File: 00000000.00000002.942332799.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

• Associated: 00000000.00000002.942318478.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942344612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942349438.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942376320.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942382891.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942388876.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942394858.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942403454.000000000045C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942407919.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

• Snapshot File: hcaresult_0_2_400000_doc.jbxd

• API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendChangeClientDataEmptyFindLockMetricsNotificationOpenSystemThreadTrackUnlock
• String ID: {
• API String ID: 4154960007-366298937
• Opcode ID: f8565664f7b2e804c40d78346ff69871c1535371e8e3cc69fe24884c49ce1a76
• Instruction ID: 6b97441d6f4cfe62a880681573964a63c423f2dd70b2063085686802d9cc5617
• Opcode Fuzzy Hash: f8565664f7b2e804c40d78346ff69871c1535371e8e3cc69fe24884c49ce1a76
• Instruction Fuzzy Hash: C8B169B1900608FFDB119FA0DD85AAE7B79FB44355F00803AFA41BA1A0C7755E51DF58

Uniqueness Score: -1.00%

			E72F01BFF() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				WCHAR* _v24;
				WCHAR* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				WCHAR* _v48;
				signed int _v52;
				void* _v56;
				intOrPtr _v60;
				WCHAR* _t208;
				signed int _t211;
				void* _t213;
				void* _t215;
				WCHAR* _t217;
				void* _t225;
				struct HINSTANCE__* _t226;
				struct HINSTANCE__* _t227;
				struct HINSTANCE__* _t229;
				signed short _t231;
				struct HINSTANCE__* _t234;
				struct HINSTANCE__* _t236;
				void* _t237;
				intOrPtr* _t238;
				void* _t249;
				signed char _t250;
				signed int _t251;
				void* _t255;
				struct HINSTANCE__* _t257;
				void* _t258;
				signed int _t260;
				signed int _t261;
				signed short* _t264;
				signed int _t269;
				signed int _t272;
				signed int _t274;
				void* _t277;
				void* _t281;
				struct HINSTANCE__* _t283;
				signed int _t286;
				void _t287;
				signed int _t288;
				signed int _t300;
				signed int _t301;
				signed short _t304;
				void* _t305;
				signed int _t309;
				signed int _t312;
				signed int _t315;
				signed int _t316;
				signed int _t317;
				signed short* _t321;
				WCHAR* _t322;
				WCHAR* _t324;
				WCHAR* _t325;
				struct HINSTANCE__* _t326;
				void* _t328;
				signed int _t331;
				void* _t332;

				_t283 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				_v8 = 0;
				_v40 = 0;
				_t332 = 0;
				_v52 = 0;
				_v44 = 0;
				_t208 = E72F012BB();
				_v24 = _t208;
				_v28 = _t208;
				_v48 = E72F012BB();
				_t321 = E72F012E3();
				_v56 = _t321;
				_v12 = _t321;
				while(1) {
					_t211 = _v32;
					_v60 = _t211;
					if(_t211 != _t283 && _t332 == _t283) {
						break;
					}
					_t286 =  *_t321 & 0x0000ffff;
					_t213 = _t286 - _t283;
					if(_t213 == 0) {
						_t37 =  &_v32;
						 *_t37 = _v32 | 0xffffffff;
						__eflags =  *_t37;
						L20:
						_t215 = _v60 - _t283;
						if(_t215 == 0) {
							__eflags = _t332 - _t283;
							 *_v28 = _t283;
							if(_t332 == _t283) {
								_t255 = GlobalAlloc(0x40, 0x1ca4); // executed
								_t332 = _t255;
								 *(_t332 + 0x1010) = _t283;
								 *(_t332 + 0x1014) = _t283;
							}
							_t287 = _v36;
							_t47 = _t332 + 8; // 0x8
							_t217 = _t47;
							_t48 = _t332 + 0x808; // 0x808
							_t322 = _t48;
							 *_t332 = _t287;
							_t288 = _t287 - _t283;
							__eflags = _t288;
							 *_t217 = _t283;
							 *_t322 = _t283;
							 *(_t332 + 0x1008) = _t283;
							 *(_t332 + 0x100c) = _t283;
							 *(_t332 + 4) = _t283;
							if(_t288 == 0) {
								__eflags = _v28 - _v24;
								if(_v28 == _v24) {
									goto L42;
								}
								_t328 = 0;
								GlobalFree(_t332);
								_t332 = E72F013B1(_v24);
								__eflags = _t332 - _t283;
								if(_t332 == _t283) {
									goto L42;
								} else {
									goto L35;
								}
								while(1) {
									L35:
									_t249 =  *(_t332 + 0x1ca0);
									__eflags = _t249 - _t283;
									if(_t249 == _t283) {
										break;
									}
									_t328 = _t332;
									_t332 = _t249;
									__eflags = _t332 - _t283;
									if(_t332 != _t283) {
										continue;
									}
									break;
								}
								__eflags = _t328 - _t283;
								if(_t328 != _t283) {
									 *(_t328 + 0x1ca0) = _t283;
								}
								_t250 =  *(_t332 + 0x1010);
								__eflags = _t250 & 0x00000008;
								if((_t250 & 0x00000008) == 0) {
									_t251 = _t250 | 0x00000002;
									__eflags = _t251;
									 *(_t332 + 0x1010) = _t251;
								} else {
									_t332 = E72F0162F(_t332);
									 *(_t332 + 0x1010) =  *(_t332 + 0x1010) & 0xfffffff5;
								}
								goto L42;
							} else {
								_t300 = _t288 - 1;
								__eflags = _t300;
								if(_t300 == 0) {
									L31:
									lstrcpyW(_t217, _v48);
									L32:
									lstrcpyW(_t322, _v24);
									goto L42;
								}
								_t301 = _t300 - 1;
								__eflags = _t301;
								if(_t301 == 0) {
									goto L32;
								}
								__eflags = _t301 != 1;
								if(_t301 != 1) {
									goto L42;
								}
								goto L31;
							}
						} else {
							if(_t215 == 1) {
								_t257 = _v16;
								if(_v40 == _t283) {
									_t257 = _t257 - 1;
								}
								 *(_t332 + 0x1014) = _t257;
							}
							L42:
							_v12 = _v12 + 2;
							_v28 = _v24;
							L59:
							if(_v32 != 0xffffffff) {
								_t321 = _v12;
								continue;
							}
							break;
						}
					}
					_t258 = _t213 - 0x23;
					if(_t258 == 0) {
						__eflags = _t321 - _v56;
						if(_t321 <= _v56) {
							L17:
							__eflags = _v44 - _t283;
							if(_v44 != _t283) {
								L43:
								_t260 = _v32 - _t283;
								__eflags = _t260;
								if(_t260 == 0) {
									_t261 = _t286;
									while(1) {
										__eflags = _t261 - 0x22;
										if(_t261 != 0x22) {
											break;
										}
										_t321 =  &(_t321[1]);
										__eflags = _v44 - _t283;
										_v12 = _t321;
										if(_v44 == _t283) {
											_v44 = 1;
											L162:
											_v28 =  &(_v28[0]);
											 *_v28 =  *_t321;
											L58:
											_t331 =  &(_t321[1]);
											__eflags = _t331;
											_v12 = _t331;
											goto L59;
										}
										_t261 =  *_t321 & 0x0000ffff;
										_v44 = _t283;
									}
									__eflags = _t261 - 0x2a;
									if(_t261 == 0x2a) {
										_v36 = 2;
										L57:
										_t321 = _v12;
										_v28 = _v24;
										_t283 = 0;
										__eflags = 0;
										goto L58;
									}
									__eflags = _t261 - 0x2d;
									if(_t261 == 0x2d) {
										L151:
										_t304 =  *_t321;
										__eflags = _t304 - 0x2d;
										if(_t304 != 0x2d) {
											L154:
											_t264 =  &(_t321[1]);
											__eflags =  *_t264 - 0x3a;
											if( *_t264 != 0x3a) {
												goto L162;
											}
											__eflags = _t304 - 0x2d;
											if(_t304 == 0x2d) {
												goto L162;
											}
											_v36 = 1;
											L157:
											_v12 = _t264;
											__eflags = _v28 - _v24;
											if(_v28 <= _v24) {
												 *_v48 = _t283;
											} else {
												 *_v28 = _t283;
												lstrcpyW(_v48, _v24);
											}
											goto L57;
										}
										_t264 =  &(_t321[1]);
										__eflags =  *_t264 - 0x3e;
										if( *_t264 != 0x3e) {
											goto L154;
										}
										_v36 = 3;
										goto L157;
									}
									__eflags = _t261 - 0x3a;
									if(_t261 != 0x3a) {
										goto L162;
									}
									goto L151;
								}
								_t269 = _t260 - 1;
								__eflags = _t269;
								if(_t269 == 0) {
									L80:
									_t305 = _t286 + 0xffffffde;
									__eflags = _t305 - 0x55;
									if(_t305 > 0x55) {
										goto L57;
									}
									switch( *((intOrPtr*)(( *(_t305 + 0x72f023e8) & 0x000000ff) * 4 +  &M72F0235C))) {
										case 0:
											__ecx = _v24;
											__edi = _v12;
											while(1) {
												__edi = __edi + 1;
												__edi = __edi + 1;
												_v12 = __edi;
												__ax =  *__edi;
												__eflags = __ax - __dx;
												if(__ax != __dx) {
													goto L132;
												}
												L131:
												__eflags =  *((intOrPtr*)(__edi + 2)) - __dx;
												if( *((intOrPtr*)(__edi + 2)) != __dx) {
													L136:
													 *__ecx =  *__ecx & 0x00000000;
													__eax = E72F012CC(_v24);
													__ebx = __eax;
													goto L97;
												}
												L132:
												__eflags = __ax;
												if(__ax == 0) {
													goto L136;
												}
												__eflags = __ax - __dx;
												if(__ax == __dx) {
													__edi = __edi + 1;
													__edi = __edi + 1;
													__eflags = __edi;
												}
												__ax =  *__edi;
												 *__ecx =  *__edi;
												__ecx = __ecx + 1;
												__ecx = __ecx + 1;
												__edi = __edi + 1;
												__edi = __edi + 1;
												_v12 = __edi;
												__ax =  *__edi;
												__eflags = __ax - __dx;
												if(__ax != __dx) {
													goto L132;
												}
												goto L131;
											}
										case 1:
											_v8 = 1;
											goto L57;
										case 2:
											_v8 = _v8 | 0xffffffff;
											goto L57;
										case 3:
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v16 = _v16 + 1;
											goto L85;
										case 4:
											__eflags = _v20;
											if(_v20 != 0) {
												goto L57;
											}
											_v12 = _v12 - 2;
											__ebx = E72F012BB();
											 &_v12 = E72F01B86( &_v12);
											__eax = E72F01510(__edx, __eax, __edx, __ebx);
											goto L97;
										case 5:
											L105:
											_v20 = _v20 + 1;
											goto L57;
										case 6:
											_push(7);
											goto L123;
										case 7:
											_push(0x19);
											goto L143;
										case 8:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L107;
										case 9:
											_push(0x15);
											goto L143;
										case 0xa:
											_push(0x16);
											goto L143;
										case 0xb:
											_push(0x18);
											goto L143;
										case 0xc:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L118;
										case 0xd:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L109;
										case 0xe:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L111;
										case 0xf:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L122;
										case 0x10:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L113;
										case 0x11:
											_push(3);
											goto L123;
										case 0x12:
											_push(0x17);
											L143:
											_pop(__ebx);
											goto L98;
										case 0x13:
											__eax =  &_v12;
											__eax = E72F01B86( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											__eflags = __ebx - 0xb;
											if(__ebx < 0xb) {
												__ebx = __ebx + 0xa;
											}
											goto L97;
										case 0x14:
											__ebx = 0xffffffff;
											goto L98;
										case 0x15:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L116;
										case 0x16:
											__ecx = 0;
											__eflags = 0;
											goto L91;
										case 0x17:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L120;
										case 0x18:
											_t271 =  *(_t332 + 0x1014);
											__eflags = _t271 - _v16;
											if(_t271 > _v16) {
												_v16 = _t271;
											}
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v36 - 3 = _t271 - (_v36 == 3);
											if(_t271 != _v36 == 3) {
												L85:
												_v40 = 1;
											}
											goto L57;
										case 0x19:
											L107:
											__ecx = 0;
											_v8 = 2;
											__ecx = 1;
											goto L91;
										case 0x1a:
											L118:
											_push(5);
											goto L123;
										case 0x1b:
											L109:
											__ecx = 0;
											_v8 = 3;
											__ecx = 1;
											goto L91;
										case 0x1c:
											L111:
											__ecx = 0;
											__ecx = 1;
											goto L91;
										case 0x1d:
											L122:
											_push(6);
											goto L123;
										case 0x1e:
											L113:
											_push(2);
											goto L123;
										case 0x1f:
											__eax =  &_v12;
											__eax = E72F01B86( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											goto L97;
										case 0x20:
											L116:
											_v52 = _v52 + 1;
											_push(4);
											_pop(__ecx);
											goto L91;
										case 0x21:
											L120:
											_push(4);
											L123:
											_pop(__ecx);
											L91:
											__edi = _v16;
											__edx =  *(0x72f0405c + __ecx * 4);
											__eax =  ~__eax;
											asm("sbb eax, eax");
											_v40 = 1;
											__edi = _v16 << 5;
											__eax = __eax & 0x00008000;
											__edi = (_v16 << 5) + __esi;
											__eax = __eax | __ecx;
											__eflags = _v8;
											 *(__edi + 0x1018) = __eax;
											if(_v8 < 0) {
												L93:
												__edx = 0;
												__edx = 1;
												__eflags = 1;
												L94:
												__eflags = _v8 - 1;
												 *(__edi + 0x1028) = __edx;
												if(_v8 == 1) {
													__eax =  &_v12;
													__eax = E72F01B86( &_v12);
													__eax = __eax + 1;
													__eflags = __eax;
													_v8 = __eax;
												}
												__eax = _v8;
												 *((intOrPtr*)(__edi + 0x101c)) = _v8;
												_t136 = _v16 + 0x81; // 0x81
												_t136 = _t136 << 5;
												__eax = 0;
												__eflags = 0;
												 *((intOrPtr*)((_t136 << 5) + __esi)) = 0;
												 *((intOrPtr*)(__edi + 0x1030)) = 0;
												 *((intOrPtr*)(__edi + 0x102c)) = 0;
												L97:
												__eflags = __ebx;
												if(__ebx == 0) {
													goto L57;
												}
												L98:
												__eflags = _v20;
												_v40 = 1;
												if(_v20 != 0) {
													L103:
													__eflags = _v20 - 1;
													if(_v20 == 1) {
														__eax = _v16;
														__eax = _v16 << 5;
														__eflags = __eax;
														 *(__eax + __esi + 0x102c) = __ebx;
													}
													goto L105;
												}
												_v16 = _v16 << 5;
												_t144 = __esi + 0x1030; // 0x1030
												__edi = (_v16 << 5) + _t144;
												__eax =  *__edi;
												__eflags = __eax - 0xffffffff;
												if(__eax <= 0xffffffff) {
													L101:
													__eax = GlobalFree(__eax);
													L102:
													 *__edi = __ebx;
													goto L103;
												}
												__eflags = __eax - 0x19;
												if(__eax <= 0x19) {
													goto L102;
												}
												goto L101;
											}
											__eflags = __edx;
											if(__edx > 0) {
												goto L94;
											}
											goto L93;
										case 0x22:
											goto L57;
									}
								}
								_t272 = _t269 - 1;
								__eflags = _t272;
								if(_t272 == 0) {
									_v16 = _t283;
									goto L80;
								}
								__eflags = _t272 != 1;
								if(_t272 != 1) {
									goto L162;
								}
								__eflags = _t286 - 0x6e;
								if(__eflags > 0) {
									_t309 = _t286 - 0x72;
									__eflags = _t309;
									if(_t309 == 0) {
										_push(4);
										L74:
										_pop(_t274);
										L75:
										__eflags = _v8 - 1;
										if(_v8 != 1) {
											_t96 = _t332 + 0x1010;
											 *_t96 =  *(_t332 + 0x1010) &  !_t274;
											__eflags =  *_t96;
										} else {
											 *(_t332 + 0x1010) =  *(_t332 + 0x1010) | _t274;
										}
										_v8 = 1;
										goto L57;
									}
									_t312 = _t309 - 1;
									__eflags = _t312;
									if(_t312 == 0) {
										_push(0x10);
										goto L74;
									}
									__eflags = _t312 != 0;
									if(_t312 != 0) {
										goto L57;
									}
									_push(0x40);
									goto L74;
								}
								if(__eflags == 0) {
									_push(8);
									goto L74;
								}
								_t315 = _t286 - 0x21;
								__eflags = _t315;
								if(_t315 == 0) {
									_v8 =  ~_v8;
									goto L57;
								}
								_t316 = _t315 - 0x11;
								__eflags = _t316;
								if(_t316 == 0) {
									_t274 = 0x100;
									goto L75;
								}
								_t317 = _t316 - 0x31;
								__eflags = _t317;
								if(_t317 == 0) {
									_t274 = 1;
									goto L75;
								}
								__eflags = _t317 != 0;
								if(_t317 != 0) {
									goto L57;
								}
								_push(0x20);
								goto L74;
							} else {
								_v32 = _t283;
								_v36 = _t283;
								goto L20;
							}
						}
						__eflags =  *((short*)(_t321 - 2)) - 0x3a;
						if( *((short*)(_t321 - 2)) != 0x3a) {
							goto L17;
						}
						__eflags = _v32 - _t283;
						if(_v32 == _t283) {
							goto L43;
						}
						goto L17;
					}
					_t277 = _t258 - 5;
					if(_t277 == 0) {
						__eflags = _v44 - _t283;
						if(_v44 != _t283) {
							goto L43;
						} else {
							__eflags = _v36 - 3;
							_v32 = 1;
							_v8 = _t283;
							_v20 = _t283;
							_v16 = (0 | _v36 == 0x00000003) + 1;
							_v40 = _t283;
							goto L20;
						}
					}
					_t281 = _t277 - 1;
					if(_t281 == 0) {
						__eflags = _v44 - _t283;
						if(_v44 != _t283) {
							goto L43;
						} else {
							_v32 = 2;
							_v8 = _t283;
							_v20 = _t283;
							goto L20;
						}
					}
					if(_t281 != 0x16) {
						goto L43;
					} else {
						_v32 = 3;
						_v8 = 1;
						goto L20;
					}
				}
				GlobalFree(_v56);
				GlobalFree(_v24);
				GlobalFree(_v48);
				if(_t332 == _t283 ||  *(_t332 + 0x100c) != _t283) {
					L182:
					return _t332;
				} else {
					_t225 =  *_t332 - 1;
					if(_t225 == 0) {
						_t187 = _t332 + 8; // 0x8
						_t324 = _t187;
						__eflags =  *_t324 - _t283;
						if( *_t324 != _t283) {
							_t226 = GetModuleHandleW(_t324);
							__eflags = _t226 - _t283;
							 *(_t332 + 0x1008) = _t226;
							if(_t226 != _t283) {
								L171:
								_t192 = _t332 + 0x808; // 0x808
								_t325 = _t192;
								_t227 = E72F016BD( *(_t332 + 0x1008), _t325);
								__eflags = _t227 - _t283;
								 *(_t332 + 0x100c) = _t227;
								if(_t227 == _t283) {
									__eflags =  *_t325 - 0x23;
									if( *_t325 == 0x23) {
										_t195 = _t332 + 0x80a; // 0x80a
										_t231 = E72F013B1(_t195);
										__eflags = _t231 - _t283;
										if(_t231 != _t283) {
											__eflags = _t231 & 0xffff0000;
											if((_t231 & 0xffff0000) == 0) {
												 *(_t332 + 0x100c) = GetProcAddress( *(_t332 + 0x1008), _t231 & 0x0000ffff);
											}
										}
									}
								}
								__eflags = _v52 - _t283;
								if(_v52 != _t283) {
									L178:
									_t325[lstrlenW(_t325)] = 0x57;
									_t229 = E72F016BD( *(_t332 + 0x1008), _t325);
									__eflags = _t229 - _t283;
									if(_t229 != _t283) {
										L166:
										 *(_t332 + 0x100c) = _t229;
										goto L182;
									}
									__eflags =  *(_t332 + 0x100c) - _t283;
									L180:
									if(__eflags != 0) {
										goto L182;
									}
									L181:
									_t206 = _t332 + 4;
									 *_t206 =  *(_t332 + 4) | 0xffffffff;
									__eflags =  *_t206;
									goto L182;
								} else {
									__eflags =  *(_t332 + 0x100c) - _t283;
									if( *(_t332 + 0x100c) != _t283) {
										goto L182;
									}
									goto L178;
								}
							}
							_t234 = LoadLibraryW(_t324);
							__eflags = _t234 - _t283;
							 *(_t332 + 0x1008) = _t234;
							if(_t234 == _t283) {
								goto L181;
							}
							goto L171;
						}
						_t188 = _t332 + 0x808; // 0x808
						_t236 = E72F013B1(_t188);
						 *(_t332 + 0x100c) = _t236;
						__eflags = _t236 - _t283;
						goto L180;
					}
					_t237 = _t225 - 1;
					if(_t237 == 0) {
						_t185 = _t332 + 0x808; // 0x808
						_t238 = _t185;
						__eflags =  *_t238 - _t283;
						if( *_t238 == _t283) {
							goto L182;
						}
						_t229 = E72F013B1(_t238);
						L165:
						goto L166;
					}
					if(_t237 != 1) {
						goto L182;
					}
					_t81 = _t332 + 8; // 0x8
					_t284 = _t81;
					_t326 = E72F013B1(_t81);
					 *(_t332 + 0x1008) = _t326;
					if(_t326 == 0) {
						goto L181;
					}
					 *(_t332 + 0x104c) =  *(_t332 + 0x104c) & 0x00000000;
					 *((intOrPtr*)(_t332 + 0x1050)) = E72F012CC(_t284);
					 *(_t332 + 0x103c) =  *(_t332 + 0x103c) & 0x00000000;
					 *((intOrPtr*)(_t332 + 0x1048)) = 1;
					 *((intOrPtr*)(_t332 + 0x1038)) = 1;
					_t90 = _t332 + 0x808; // 0x808
					_t229 =  *(_t326->i + E72F013B1(_t90) * 4);
					goto L165;
				}
			}

0x72f01c07
0x72f01c0a
0x72f01c0d
0x72f01c10
0x72f01c13
0x72f01c16
0x72f01c19
0x72f01c1b
0x72f01c1e
0x72f01c21
0x72f01c26
0x72f01c29
0x72f01c31
0x72f01c39
0x72f01c3b
0x72f01c3e
0x72f01c46
0x72f01c46
0x72f01c4b
0x72f01c4e
0x00000000
0x00000000
0x72f01c5b
0x72f01c60
0x72f01c62
0x72f01cf4
0x72f01cf4
0x72f01cf4
0x72f01cf8
0x72f01cfb
0x72f01cfd
0x72f01d1f
0x72f01d21
0x72f01d24
0x72f01d2d
0x72f01d33
0x72f01d35
0x72f01d3b
0x72f01d3b
0x72f01d41
0x72f01d44
0x72f01d44
0x72f01d47
0x72f01d47
0x72f01d4d
0x72f01d4f
0x72f01d4f
0x72f01d51
0x72f01d54
0x72f01d57
0x72f01d5d
0x72f01d63
0x72f01d66
0x72f01d8a
0x72f01d8d
0x00000000
0x00000000
0x72f01d90
0x72f01d92
0x72f01da0
0x72f01da3
0x72f01da5
0x00000000
0x00000000
0x00000000
0x00000000
0x72f01da7
0x72f01da7
0x72f01da7
0x72f01dad
0x72f01daf
0x00000000
0x00000000
0x72f01db1
0x72f01db3
0x72f01db5
0x72f01db7
0x00000000
0x00000000
0x00000000
0x72f01db7
0x72f01db9
0x72f01dbb
0x72f01dbd
0x72f01dbd
0x72f01dc3
0x72f01dc9
0x72f01dcb
0x72f01ddf
0x72f01ddf
0x72f01de1
0x72f01dcd
0x72f01dd3
0x72f01dd6
0x72f01dd6
0x00000000
0x72f01d68
0x72f01d68
0x72f01d68
0x72f01d69
0x72f01d71
0x72f01d75
0x72f01d7b
0x72f01d7f
0x00000000
0x72f01d7f
0x72f01d6b
0x72f01d6b
0x72f01d6c
0x00000000
0x00000000
0x72f01d6e
0x72f01d6f
0x00000000
0x00000000
0x00000000
0x72f01d6f
0x72f01cff
0x72f01d00
0x72f01d09
0x72f01d0c
0x72f01d19
0x72f01d19
0x72f01d0e
0x72f01d0e
0x72f01de7
0x72f01dea
0x72f01dee
0x72f01e61
0x72f01e65
0x72f01c43
0x00000000
0x72f01c43
0x00000000
0x72f01e65
0x72f01cfd
0x72f01c68
0x72f01c6b
0x72f01cce
0x72f01cd1
0x72f01ce3
0x72f01ce3
0x72f01ce6
0x72f01df3
0x72f01df6
0x72f01df6
0x72f01df8
0x72f021ae
0x72f021c6
0x72f021c6
0x72f021c9
0x00000000
0x00000000
0x72f021b3
0x72f021b4
0x72f021b7
0x72f021ba
0x72f02244
0x72f0224b
0x72f02251
0x72f02255
0x72f01e5c
0x72f01e5d
0x72f01e5d
0x72f01e5e
0x00000000
0x72f01e5e
0x72f021c0
0x72f021c3
0x72f021c3
0x72f021cb
0x72f021ce
0x72f02238
0x72f01e51
0x72f01e54
0x72f01e57
0x72f01e5a
0x72f01e5a
0x00000000
0x72f01e5a
0x72f021d0
0x72f021d3
0x72f021da
0x72f021da
0x72f021dd
0x72f021e1
0x72f021f5
0x72f021f5
0x72f021f8
0x72f021fc
0x00000000
0x00000000
0x72f021fe
0x72f02202
0x00000000
0x00000000
0x72f02204
0x72f0220b
0x72f0220b
0x72f02211
0x72f02214
0x72f02230
0x72f02216
0x72f0221f
0x72f02222
0x72f02222
0x00000000
0x72f02214
0x72f021e3
0x72f021e6
0x72f021ea
0x00000000
0x00000000
0x72f021ec
0x00000000
0x72f021ec
0x72f021d5
0x72f021d8
0x00000000
0x00000000
0x00000000
0x72f021d8
0x72f01dfe
0x72f01dfe
0x72f01dff
0x72f01f49
0x72f01f49
0x72f01f50
0x72f01f53
0x00000000
0x00000000
0x72f01f60
0x00000000
0x72f0214b
0x72f0214e
0x72f02151
0x72f02151
0x72f02152
0x72f02153
0x72f02156
0x72f02159
0x72f0215c
0x00000000
0x00000000
0x72f0215e
0x72f0215e
0x72f02162
0x72f0217a
0x72f0217d
0x72f02181
0x72f02187
0x00000000
0x72f02187
0x72f02164
0x72f02164
0x72f02167
0x00000000
0x00000000
0x72f02169
0x72f0216c
0x72f0216e
0x72f0216f
0x72f0216f
0x72f0216f
0x72f02170
0x72f02173
0x72f02176
0x72f02177
0x72f02151
0x72f02152
0x72f02153
0x72f02156
0x72f02159
0x72f0215c
0x00000000
0x00000000
0x00000000
0x72f0215c
0x00000000
0x72f01fa7
0x00000000
0x00000000
0x72f01fb3
0x00000000
0x00000000
0x72f01f9a
0x72f01f9e
0x72f01fa2
0x00000000
0x00000000
0x72f0211c
0x72f02120
0x00000000
0x00000000
0x72f02126
0x72f0212f
0x72f02136
0x72f0213e
0x00000000
0x00000000
0x72f02083
0x72f02083
0x00000000
0x00000000
0x72f01fbc
0x00000000
0x00000000
0x72f021a6
0x00000000
0x00000000
0x72f0208b
0x72f0208d
0x72f0208d
0x00000000
0x00000000
0x72f02196
0x00000000
0x00000000
0x72f0219a
0x00000000
0x00000000
0x72f021a2
0x00000000
0x00000000
0x72f020d3
0x72f020d5
0x72f020d5
0x00000000
0x00000000
0x72f0209d
0x72f0209f
0x72f0209f
0x00000000
0x00000000
0x72f020af
0x72f020b1
0x72f020b1
0x00000000
0x00000000
0x72f020e1
0x72f020e3
0x72f020e3
0x00000000
0x00000000
0x72f020ba
0x72f020bc
0x72f020bc
0x00000000
0x00000000
0x72f020c1
0x00000000
0x00000000
0x72f0219e
0x72f021a8
0x72f021a8
0x00000000
0x00000000
0x72f020ec
0x72f020f0
0x72f020f5
0x72f020f8
0x72f020f9
0x72f020fc
0x72f02102
0x72f02102
0x00000000
0x00000000
0x72f0218e
0x00000000
0x00000000
0x72f020c5
0x72f020c7
0x72f020c7
0x00000000
0x00000000
0x72f01fc3
0x72f01fc3
0x00000000
0x00000000
0x72f020da
0x72f020dc
0x72f020dc
0x00000000
0x00000000
0x72f01f67
0x72f01f6d
0x72f01f70
0x72f01f72
0x72f01f72
0x72f01f75
0x72f01f79
0x72f01f86
0x72f01f88
0x72f01f8e
0x72f01f8e
0x72f01f8e
0x00000000
0x00000000
0x72f0208e
0x72f0208e
0x72f02090
0x72f02097
0x00000000
0x00000000
0x72f020d6
0x72f020d6
0x00000000
0x00000000
0x72f020a0
0x72f020a0
0x72f020a2
0x72f020a9
0x00000000
0x00000000
0x72f020b2
0x72f020b2
0x72f020b4
0x00000000
0x00000000
0x72f020e4
0x72f020e4
0x00000000
0x00000000
0x72f020bd
0x72f020bd
0x00000000
0x00000000
0x72f0210a
0x72f0210e
0x72f02113
0x72f02116
0x00000000
0x00000000
0x72f020c8
0x72f020c8
0x72f020cb
0x72f020cd
0x00000000
0x00000000
0x72f020dd
0x72f020dd
0x72f020e6
0x72f020e6
0x72f01fc5
0x72f01fc5
0x72f01fc8
0x72f01fcf
0x72f01fd1
0x72f01fd3
0x72f01fda
0x72f01fdd
0x72f01fe2
0x72f01fe4
0x72f01fe6
0x72f01fea
0x72f01ff0
0x72f01ff6
0x72f01ff6
0x72f01ff8
0x72f01ff8
0x72f01ff9
0x72f01ff9
0x72f01ffd
0x72f02003
0x72f02005
0x72f02009
0x72f0200e
0x72f0200e
0x72f02010
0x72f02010
0x72f02013
0x72f02016
0x72f0201f
0x72f02025
0x72f02028
0x72f02028
0x72f0202a
0x72f0202d
0x72f02033
0x72f02039
0x72f02039
0x72f0203b
0x00000000
0x00000000
0x72f02041
0x72f02041
0x72f02045
0x72f0204c
0x72f02070
0x72f02070
0x72f02074
0x72f02076
0x72f02079
0x72f02079
0x72f0207c
0x72f0207c
0x00000000
0x72f02074
0x72f02051
0x72f02054
0x72f02054
0x72f0205b
0x72f0205d
0x72f02060
0x72f02067
0x72f02068
0x72f0206e
0x72f0206e
0x00000000
0x72f0206e
0x72f02062
0x72f02065
0x00000000
0x00000000
0x00000000
0x72f02065
0x72f01ff2
0x72f01ff4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x72f01f60
0x72f01e05
0x72f01e05
0x72f01e06
0x72f01f46
0x00000000
0x72f01f46
0x72f01e0c
0x72f01e0d
0x00000000
0x00000000
0x72f01e13
0x72f01e16
0x72f01f0b
0x72f01f0b
0x72f01f0e
0x72f01f23
0x72f01f25
0x72f01f25
0x72f01f26
0x72f01f29
0x72f01f2c
0x72f01f38
0x72f01f38
0x72f01f38
0x72f01f2e
0x72f01f2e
0x72f01f2e
0x72f01f3e
0x00000000
0x72f01f3e
0x72f01f10
0x72f01f10
0x72f01f11
0x72f01f1f
0x00000000
0x72f01f1f
0x72f01f14
0x72f01f15
0x00000000
0x00000000
0x72f01f1b
0x00000000
0x72f01f1b
0x72f01e1c
0x72f01f07
0x00000000
0x72f01f07
0x72f01e22
0x72f01e22
0x72f01e25
0x72f01e4e
0x00000000
0x72f01e4e
0x72f01e27
0x72f01e27
0x72f01e2a
0x72f01e44
0x00000000
0x72f01e44
0x72f01e2c
0x72f01e2c
0x72f01e2f
0x72f01e3e
0x00000000
0x72f01e3e
0x72f01e32
0x72f01e33
0x00000000
0x00000000
0x72f01e35
0x00000000
0x72f01cec
0x72f01cec
0x72f01cef
0x00000000
0x72f01cef
0x72f01ce6
0x72f01cd3
0x72f01cd8
0x00000000
0x00000000
0x72f01cda
0x72f01cdd
0x00000000
0x00000000
0x00000000
0x72f01cdd
0x72f01c6d
0x72f01c70
0x72f01ca6
0x72f01ca9
0x00000000
0x72f01caf
0x72f01cb1
0x72f01cb5
0x72f01cbc
0x72f01cc3
0x72f01cc6
0x72f01cc9
0x00000000
0x72f01cc9
0x72f01ca9
0x72f01c72
0x72f01c73
0x72f01c8e
0x72f01c91
0x00000000
0x72f01c97
0x72f01c97
0x72f01c9e
0x72f01ca1
0x00000000
0x72f01ca1
0x72f01c91
0x72f01c78
0x00000000
0x72f01c7e
0x72f01c7e
0x72f01c85
0x00000000
0x72f01c85
0x72f01c78
0x72f01e74
0x72f01e79
0x72f01e7e
0x72f01e82
0x72f02355
0x72f0235b
0x72f01e94
0x72f01e96
0x72f01e97
0x72f0227e
0x72f0227e
0x72f02281
0x72f02284
0x72f022a1
0x72f022a7
0x72f022a9
0x72f022af
0x72f022c6
0x72f022c6
0x72f022c6
0x72f022d3
0x72f022d9
0x72f022dc
0x72f022e2
0x72f022e4
0x72f022e8
0x72f022ea
0x72f022f1
0x72f022f6
0x72f022f9
0x72f022fb
0x72f02300
0x72f02312
0x72f02312
0x72f02300
0x72f022f9
0x72f022e8
0x72f02318
0x72f0231b
0x72f02325
0x72f0232d
0x72f0233a
0x72f02340
0x72f02343
0x72f02273
0x72f02273
0x00000000
0x72f02273
0x72f02349
0x72f0234f
0x72f0234f
0x00000000
0x00000000
0x72f02351
0x72f02351
0x72f02351
0x72f02351
0x00000000
0x72f0231d
0x72f0231d
0x72f02323
0x00000000
0x00000000
0x00000000
0x72f02323
0x72f0231b
0x72f022b2
0x72f022b8
0x72f022ba
0x72f022c0
0x00000000
0x00000000
0x00000000
0x72f022c0
0x72f02286
0x72f0228d
0x72f02293
0x72f02299
0x00000000
0x72f02299
0x72f01e9d
0x72f01e9e
0x72f0225d
0x72f0225d
0x72f02263
0x72f02266
0x00000000
0x00000000
0x72f0226d
0x72f02272
0x00000000
0x72f02272
0x72f01ea5
0x00000000
0x00000000
0x72f01eab
0x72f01eab
0x72f01eb4
0x72f01eb9
0x72f01ebf
0x00000000
0x00000000
0x72f01ec5
0x72f01ed2
0x72f01ed8
0x72f01ee2
0x72f01ee8
0x72f01ef0
0x72f01f00
0x00000000
0x72f01f00

• Part of subcall function 72F012BB: GlobalAlloc.KERNEL32(00000040,?,72F012DB,?,72F0137F,00000019,72F011CA,-000000A0), ref: 72F012C5
• GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 72F01D2D
• lstrcpyW.KERNEL32 ref: 72F01D75
• lstrcpyW.KERNEL32 ref: 72F01D7F
• GlobalFree.KERNEL32 ref: 72F01D92
• GlobalFree.KERNEL32 ref: 72F01E74
• GlobalFree.KERNEL32 ref: 72F01E79
• GlobalFree.KERNEL32 ref: 72F01E7E
• GlobalFree.KERNEL32 ref: 72F02068
• lstrcpyW.KERNEL32 ref: 72F02222
• GetModuleHandleW.KERNEL32(00000008), ref: 72F022A1
• LoadLibraryW.KERNEL32(00000008), ref: 72F022B2
• GetProcAddress.KERNEL32(?,?), ref: 72F0230C
• lstrlenW.KERNEL32(00000808), ref: 72F02326

• Source File: 00000000.00000002.942685554.0000000072F01000.00000020.00000001.01000000.00000004.sdmp, Offset: 72F00000, based on PE: true

• Associated: 00000000.00000002.942671236.0000000072F00000.00000002.00000001.01000000.00000004.sdmpDownload File
• Associated: 00000000.00000002.942692891.0000000072F04000.00000002.00000001.01000000.00000004.sdmpDownload File
• Associated: 00000000.00000002.942703977.0000000072F06000.00000002.00000001.01000000.00000004.sdmpDownload File

• Snapshot File: hcaresult_0_2_72f00000_doc.jbxd

• API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
• String ID:
• API String ID: 245916457-0
• Opcode ID: 5ed7f3c9e0db7219c6b08425f7aab6b175087d6518d96d339772536053530ac5
• Instruction ID: 294506759cfb678e5e1c7105aebb70ed7a0e47b7ef5a45f76478b28f847ddcc5
• Opcode Fuzzy Hash: 5ed7f3c9e0db7219c6b08425f7aab6b175087d6518d96d339772536053530ac5
• Instruction Fuzzy Hash: 25227C72E00A05DBDB318FACC9807EEBBF5FB08319F50552ED257A2184E7709981EB60

Uniqueness Score: -1.00%

			E00405C49(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				short _v556;
				short _v558;
				struct _WIN32_FIND_DATAW _v604;
				signed int _t38;
				signed int _t52;
				signed int _t55;
				signed int _t62;
				void* _t64;
				signed char _t65;
				WCHAR* _t66;
				void* _t67;
				WCHAR* _t68;
				void* _t70;

				_t65 = _a8;
				_t68 = _a4;
				_v8 = _t65 & 0x00000004;
				_t38 = E00405F14(__eflags, _t68);
				_v12 = _t38;
				if((_t65 & 0x00000008) != 0) {
					_t62 = DeleteFileW(_t68); // executed
					asm("sbb eax, eax");
					_t64 =  ~_t62 + 1;
					 *0x434f88 =  *0x434f88 + _t64;
					return _t64;
				}
				_a4 = _t65;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E0040653D(0x42f270, _t68);
					__eflags = _a4;
					if(_a4 == 0) {
						E00405E58(_t68);
					} else {
						lstrcatW(0x42f270, L"\\*.*");
					}
					__eflags =  *_t68;
					if( *_t68 != 0) {
						L10:
						lstrcatW(_t68, 0x40a014);
						L11:
						_t66 =  &(_t68[lstrlenW(_t68)]);
						_t38 = FindFirstFileW(0x42f270,  &_v604);
						_t70 = _t38;
						__eflags = _t70 - 0xffffffff;
						if(_t70 == 0xffffffff) {
							L26:
							__eflags = _a4;
							if(_a4 != 0) {
								_t30 = _t66 - 2;
								 *_t30 =  *(_t66 - 2) & 0x00000000;
								__eflags =  *_t30;
							}
							goto L28;
						} else {
							goto L12;
						}
						do {
							L12:
							__eflags = _v604.cFileName - 0x2e;
							if(_v604.cFileName != 0x2e) {
								L16:
								E0040653D(_t66,  &(_v604.cFileName));
								__eflags = _v604.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t52 = E00405C01(__eflags, _t68, _v8);
									__eflags = _t52;
									if(_t52 != 0) {
										E0040559F(0xfffffff2, _t68);
									} else {
										__eflags = _v8 - _t52;
										if(_v8 == _t52) {
											 *0x434f88 =  *0x434f88 + 1;
										} else {
											E0040559F(0xfffffff1, _t68);
											E004062FD(_t67, _t68, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405C49(__eflags, _t68, _a8);
									}
								}
								goto L24;
							}
							__eflags = _v558;
							if(_v558 == 0) {
								goto L24;
							}
							__eflags = _v558 - 0x2e;
							if(_v558 != 0x2e) {
								goto L16;
							}
							__eflags = _v556;
							if(_v556 == 0) {
								goto L24;
							}
							goto L16;
							L24:
							_t55 = FindNextFileW(_t70,  &_v604);
							__eflags = _t55;
						} while (_t55 != 0);
						_t38 = FindClose(_t70);
						goto L26;
					}
					__eflags =  *0x42f270 - 0x5c;
					if( *0x42f270 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t38;
					if(_t38 == 0) {
						L28:
						__eflags = _a4;
						if(_a4 == 0) {
							L36:
							return _t38;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t38 = E00406873(_t68);
							__eflags = _t38;
							if(_t38 == 0) {
								goto L36;
							}
							E00405E0C(_t68);
							_t38 = E00405C01(__eflags, _t68, _v8 | 0x00000001);
							__eflags = _t38;
							if(_t38 != 0) {
								return E0040559F(0xffffffe5, _t68);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L30;
							}
							E0040559F(0xfffffff1, _t68);
							return E004062FD(_t67, _t68, 0);
						}
						L30:
						 *0x434f88 =  *0x434f88 + 1;
						return _t38;
					}
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) == 0) {
						goto L28;
					}
					goto L5;
				}
			}

0x00405c53
0x00405c58
0x00405c61
0x00405c64
0x00405c6c
0x00405c6f
0x00405c72
0x00405c7a
0x00405c7c
0x00405c7d
0x00000000
0x00405c7d
0x00405c88
0x00405c8b
0x00405c8b
0x00405c8b
0x00405c8f
0x00405ca2
0x00405ca9
0x00405cae
0x00405cb2
0x00405cc2
0x00405cb4
0x00405cba
0x00405cba
0x00405cc7
0x00405ccb
0x00405cd7
0x00405cdd
0x00405ce2
0x00405ce8
0x00405cf3
0x00405cf9
0x00405cfb
0x00405cfe
0x00405da8
0x00405da8
0x00405dac
0x00405dae
0x00405dae
0x00405dae
0x00405dae
0x00000000
0x00000000
0x00000000
0x00000000
0x00405d04
0x00405d04
0x00405d04
0x00405d0c
0x00405d2c
0x00405d34
0x00405d39
0x00405d40
0x00405d5b
0x00405d60
0x00405d62
0x00405d86
0x00405d64
0x00405d64
0x00405d67
0x00405d7b
0x00405d69
0x00405d6c
0x00405d74
0x00405d74
0x00405d67
0x00405d42
0x00405d48
0x00405d4a
0x00405d50
0x00405d50
0x00405d4a
0x00000000
0x00405d40
0x00405d0e
0x00405d16
0x00000000
0x00000000
0x00405d18
0x00405d20
0x00000000
0x00000000
0x00405d22
0x00405d2a
0x00000000
0x00000000
0x00000000
0x00405d8b
0x00405d93
0x00405d99
0x00405d99
0x00405da2
0x00000000
0x00405da2
0x00405ccd
0x00405cd5
0x00000000
0x00000000
0x00000000
0x00405c91
0x00405c91
0x00405c93
0x00405db3
0x00405db5
0x00405db8
0x00405e09
0x00405e09
0x00405e09
0x00405dba
0x00405dbd
0x00405dc8
0x00405dcd
0x00405dcf
0x00000000
0x00000000
0x00405dd2
0x00405dde
0x00405de3
0x00405de5
0x00000000
0x00405e00
0x00405de7
0x00405dea
0x00000000
0x00000000
0x00405def
0x00000000
0x00405df6
0x00405dbf
0x00405dbf
0x00000000
0x00405dbf
0x00405c99
0x00405c9c
0x00000000
0x00000000
0x00000000
0x00405c9c

• DeleteFileW.KERNELBASE(?,?,76DDFAA0,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405C72
• lstrcatW.KERNEL32(0042F270,\*.*), ref: 00405CBA
• lstrcatW.KERNEL32(?,0040A014), ref: 00405CDD
• lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,76DDFAA0,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CE3
• FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,76DDFAA0,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CF3
• FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405D93
• FindClose.KERNEL32(00000000), ref: 00405DA2

• C:\Users\user\AppData\Local\Temp\, xrefs: 00405C56
• ., xrefs: 00405D18
• \*.*, xrefs: 00405CB4
• ., xrefs: 00405D04

• Source File: 00000000.00000002.942332799.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

• Associated: 00000000.00000002.942318478.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942344612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942349438.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942376320.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942382891.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942388876.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942394858.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942403454.000000000045C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942407919.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

• Snapshot File: hcaresult_0_2_400000_doc.jbxd

• API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
• String ID: .$.$C:\Users\user\AppData\Local\Temp\$\*.*
• API String ID: 2035342205-1049245928
• Opcode ID: d4824498ca5d4646401654330336f54dc3516ea2401a274e156101c2699109e4
• Instruction ID: 8b2ee76931e9ba666d6dc67a471f1b560bbb00ea1adf29c264b32972d7114dcf
• Opcode Fuzzy Hash: d4824498ca5d4646401654330336f54dc3516ea2401a274e156101c2699109e4
• Instruction Fuzzy Hash: 3D41A130900A14BADB216B65CC8DABF7678DF81714F14817FF841B21D1D77C4A819EAE

Uniqueness Score: -1.00%

			E00406873(WCHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileW(_a4, 0x4302b8); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2); // executed
				return 0x4302b8;
			}

0x0040687e
0x00406887
0x00000000
0x00406894
0x0040688a
0x00000000

• FindFirstFileW.KERNELBASE(76DDFAA0,004302B8,C:\,00405F5D,C:\,C:\,00000000,C:\,C:\,76DDFAA0,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76DDFAA0,C:\Users\user\AppData\Local\Temp\), ref: 0040687E
• FindClose.KERNELBASE(00000000), ref: 0040688A

• Source File: 00000000.00000002.942332799.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

• Associated: 00000000.00000002.942318478.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942344612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942349438.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942376320.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942382891.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942388876.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942394858.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942403454.000000000045C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942407919.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

• Snapshot File: hcaresult_0_2_400000_doc.jbxd

• API ID: Find$CloseFileFirst
• String ID: C:\
• API String ID: 2295610775-3404278061
• Opcode ID: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
• Instruction ID: 67599a3b69382adcf67454a25bfea179debcebd0a6e2e92eb77ede12202c023a
• Opcode Fuzzy Hash: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
• Instruction Fuzzy Hash: C3D012325192205FC3402B386E0C84B7A989F16331726CB76B4AAF51E0D7388C7387BD

Uniqueness Score: -1.00%

			E00403F9A(struct HWND__* _a4, intOrPtr _a8, int _a12, long _a16) {
				struct HWND__* _v28;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				signed int _t36;
				signed int _t38;
				struct HWND__* _t48;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t117;
				int _t118;
				int _t122;
				signed int _t124;
				struct HWND__* _t127;
				struct HWND__* _t128;
				int _t129;
				intOrPtr _t130;
				long _t133;
				int _t135;
				int _t136;
				void* _t137;
				void* _t145;
				void* _t146;

				_t130 = _a8;
				if(_t130 == 0x110 || _t130 == 0x408) {
					_t34 = _a12;
					_t127 = _a4;
					__eflags = _t130 - 0x110;
					 *0x42d250 = _t34;
					if(_t130 == 0x110) {
						 *0x434f08 = _t127;
						 *0x42d264 = GetDlgItem(_t127, 1);
						_t91 = GetDlgItem(_t127, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x42b230 = _t91;
						E00404499(_t127);
						SetClassLongW(_t127, 0xfffffff2,  *0x433ee8); // executed
						 *0x433ecc = E0040140B(4);
						_t34 = 1;
						__eflags = 1;
						 *0x42d250 = 1;
					}
					_t124 =  *0x40a368; // 0x0
					_t136 = 0;
					_t133 = (_t124 << 6) +  *0x434f20;
					__eflags = _t124;
					if(_t124 < 0) {
						L36:
						E004044E5(0x40b);
						while(1) {
							_t36 =  *0x42d250;
							 *0x40a368 =  *0x40a368 + _t36;
							_t133 = _t133 + (_t36 << 6);
							_t38 =  *0x40a368; // 0x0
							__eflags = _t38 -  *0x434f24;
							if(_t38 ==  *0x434f24) {
								E0040140B(1);
							}
							__eflags =  *0x433ecc - _t136; // 0x0
							if(__eflags != 0) {
								break;
							}
							__eflags =  *0x40a368 -  *0x434f24; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t117 =  *(_t133 + 0x14);
							E0040657A(_t117, _t127, _t133, 0x445000,  *((intOrPtr*)(_t133 + 0x24)));
							_push( *((intOrPtr*)(_t133 + 0x20)));
							_push(0xfffffc19);
							E00404499(_t127);
							_push( *((intOrPtr*)(_t133 + 0x1c)));
							_push(0xfffffc1b);
							E00404499(_t127);
							_push( *((intOrPtr*)(_t133 + 0x28)));
							_push(0xfffffc1a);
							E00404499(_t127);
							_t48 = GetDlgItem(_t127, 3);
							__eflags =  *0x434f8c - _t136;
							_v28 = _t48;
							if( *0x434f8c != _t136) {
								_t117 = _t117 & 0x0000fefd | 0x00000004;
								__eflags = _t117;
							}
							ShowWindow(_t48, _t117 & 0x00000008); // executed
							EnableWindow( *(_t137 + 0x34), _t117 & 0x00000100); // executed
							E004044BB(_t117 & 0x00000002);
							_t118 = _t117 & 0x00000004;
							EnableWindow( *0x42b230, _t118);
							__eflags = _t118 - _t136;
							if(_t118 == _t136) {
								_push(1);
							} else {
								_push(_t136);
							}
							EnableMenuItem(GetSystemMenu(_t127, _t136), 0xf060, ??);
							SendMessageW( *(_t137 + 0x3c), 0xf4, _t136, 1);
							__eflags =  *0x434f8c - _t136;
							if( *0x434f8c == _t136) {
								_push( *0x42d264);
							} else {
								SendMessageW(_t127, 0x401, 2, _t136);
								_push( *0x42b230);
							}
							E004044CE();
							E0040653D(0x42d268, E00403F7B());
							E0040657A(0x42d268, _t127, _t133,  &(0x42d268[lstrlenW(0x42d268)]),  *((intOrPtr*)(_t133 + 0x18)));
							SetWindowTextW(_t127, 0x42d268); // executed
							_push(_t136);
							_t67 = E00401389( *((intOrPtr*)(_t133 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t133 - _t136;
								if( *_t133 == _t136) {
									continue;
								}
								__eflags =  *(_t133 + 4) - 5;
								if( *(_t133 + 4) != 5) {
									DestroyWindow( *0x433ed8); // executed
									 *0x42c240 = _t133;
									__eflags =  *_t133 - _t136;
									if( *_t133 <= _t136) {
										goto L60;
									}
									_t73 = CreateDialogParamW( *0x434f00,  *_t133 +  *0x433ee0 & 0x0000ffff, _t127,  *( *(_t133 + 4) * 4 + "XF@"), _t133); // executed
									__eflags = _t73 - _t136;
									 *0x433ed8 = _t73;
									if(_t73 == _t136) {
										goto L60;
									}
									_push( *((intOrPtr*)(_t133 + 0x2c)));
									_push(6);
									E00404499(_t73);
									GetWindowRect(GetDlgItem(_t127, 0x3fa), _t137 + 0x10);
									ScreenToClient(_t127, _t137 + 0x10);
									SetWindowPos( *0x433ed8, _t136,  *(_t137 + 0x20),  *(_t137 + 0x20), _t136, _t136, 0x15);
									_push(_t136);
									E00401389( *((intOrPtr*)(_t133 + 0xc)));
									__eflags =  *0x433ecc - _t136; // 0x0
									if(__eflags != 0) {
										goto L63;
									}
									ShowWindow( *0x433ed8, 8); // executed
									E004044E5(0x405);
									goto L60;
								}
								__eflags =  *0x434f8c - _t136;
								if( *0x434f8c != _t136) {
									goto L63;
								}
								__eflags =  *0x434f80 - _t136;
								if( *0x434f80 != _t136) {
									continue;
								}
								goto L63;
							}
						}
						DestroyWindow( *0x433ed8);
						 *0x434f08 = _t136;
						EndDialog(_t127,  *0x42ba38);
						goto L60;
					} else {
						__eflags = _t34 - 1;
						if(_t34 != 1) {
							L35:
							__eflags =  *_t133 - _t136;
							if( *_t133 == _t136) {
								goto L63;
							}
							goto L36;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t133 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L35;
						}
						SendMessageW( *0x433ed8, 0x40f, 0, 1);
						__eflags =  *0x433ecc - _t136; // 0x0
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t127 = _a4;
					_t136 = 0;
					if(_t130 == 0x47) {
						SetWindowPos( *0x42d248, _t127, 0, 0, 0, 0, 0x13);
					}
					_t122 = _a12;
					if(_t130 != 5) {
						L8:
						if(_t130 != 0x40d) {
							__eflags = _t130 - 0x11;
							if(_t130 != 0x11) {
								__eflags = _t130 - 0x111;
								if(_t130 != 0x111) {
									L28:
									return E00404500(_a8, _t122, _a16);
								}
								_t135 = _t122 & 0x0000ffff;
								_t128 = GetDlgItem(_t127, _t135);
								__eflags = _t128 - _t136;
								if(_t128 == _t136) {
									L15:
									__eflags = _t135 - 1;
									if(_t135 != 1) {
										__eflags = _t135 - 3;
										if(_t135 != 3) {
											_t129 = 2;
											__eflags = _t135 - _t129;
											if(_t135 != _t129) {
												L27:
												SendMessageW( *0x433ed8, 0x111, _t122, _a16);
												goto L28;
											}
											__eflags =  *0x434f8c - _t136;
											if( *0x434f8c == _t136) {
												_t99 = E0040140B(3);
												__eflags = _t99;
												if(_t99 != 0) {
													goto L28;
												}
												 *0x42ba38 = 1;
												L23:
												_push(0x78);
												L24:
												E00404472();
												goto L28;
											}
											E0040140B(_t129);
											 *0x42ba38 = _t129;
											goto L23;
										}
										__eflags =  *0x40a368 - _t136; // 0x0
										if(__eflags <= 0) {
											goto L27;
										}
										_push(0xffffffff);
										goto L24;
									}
									_push(_t135);
									goto L24;
								}
								SendMessageW(_t128, 0xf3, _t136, _t136);
								_t103 = IsWindowEnabled(_t128);
								__eflags = _t103;
								if(_t103 == 0) {
									L63:
									return 0;
								}
								goto L15;
							}
							SetWindowLongW(_t127, _t136, _t136);
							return 1;
						}
						DestroyWindow( *0x433ed8);
						 *0x433ed8 = _t122;
						L60:
						_t145 =  *0x42f268 - _t136; // 0x1
						if(_t145 == 0) {
							_t146 =  *0x433ed8 - _t136; // 0x8007e
							if(_t146 != 0) {
								ShowWindow(_t127, 0xa); // executed
								 *0x42f268 = 1;
							}
						}
						goto L63;
					}
					asm("sbb eax, eax");
					ShowWindow( *0x42d248,  ~(_t122 - 1) & 0x00000005);
					if(_t122 != 2 || (GetWindowLongW(_t127, 0xfffffff0) & 0x21010000) != 0x1000000) {
						goto L28;
					} else {
						ShowWindow(_t127, 4);
						goto L8;
					}
				}
			}

0x00403fa5
0x00403fac
0x00404113
0x00404117
0x0040411b
0x0040411d
0x00404122
0x0040412d
0x00404138
0x0040413d
0x0040413f
0x00404141
0x00404144
0x00404149
0x00404157
0x00404164
0x0040416b
0x0040416b
0x0040416c
0x0040416c
0x00404171
0x00404177
0x0040417e
0x00404184
0x00404186
0x004041c6
0x004041cb
0x004041d0
0x004041d0
0x004041d5
0x004041de
0x004041e0
0x004041e5
0x004041eb
0x004041ef
0x004041ef
0x004041f4
0x004041fa
0x00000000
0x00000000
0x00404205
0x0040420b
0x00000000
0x00000000
0x00404214
0x0040421c
0x00404221
0x00404224
0x0040422a
0x0040422f
0x00404232
0x00404238
0x0040423d
0x00404240
0x00404246
0x0040424e
0x00404254
0x0040425a
0x0040425e
0x00404265
0x00404265
0x00404265
0x0040426f
0x00404281
0x0040428d
0x00404292
0x0040429c
0x004042a2
0x004042a4
0x004042a9
0x004042a6
0x004042a6
0x004042a6
0x004042b9
0x004042d1
0x004042d3
0x004042d9
0x004042ee
0x004042db
0x004042e4
0x004042e6
0x004042e6
0x004042f4
0x00404305
0x0040431b
0x00404322
0x00404328
0x0040432c
0x00404331
0x00404333
0x00000000
0x00404339
0x00404339
0x0040433b
0x00000000
0x00000000
0x00404341
0x00404345
0x0040436a
0x00404370
0x00404376
0x00404378
0x00000000
0x00000000
0x0040439e
0x004043a4
0x004043a6
0x004043ab
0x00000000
0x00000000
0x004043b1
0x004043b4
0x004043b7
0x004043ce
0x004043da
0x004043f3
0x004043f9
0x004043fd
0x00404402
0x00404408
0x00000000
0x00000000
0x00404412
0x0040441d
0x00000000
0x0040441d
0x00404347
0x0040434d
0x00000000
0x00000000
0x00404353
0x00404359
0x00000000
0x00000000
0x00000000
0x0040435f
0x00404333
0x0040442a
0x00404436
0x0040443d
0x00000000
0x00404188
0x00404188
0x0040418b
0x004041be
0x004041be
0x004041c0
0x00000000
0x00000000
0x00000000
0x004041c0
0x0040418d
0x00404191
0x00404196
0x00404198
0x00000000
0x00000000
0x004041a8
0x004041b0
0x00000000
0x004041b6
0x00403fbe
0x00403fbe
0x00403fc2
0x00403fc7
0x00403fd6
0x00403fd6
0x00403fdc
0x00403fe3
0x00404027
0x0040402d
0x00404046
0x00404049
0x0040405c
0x00404062
0x00404100
0x00000000
0x00404109
0x00404068
0x00404073
0x00404075
0x00404077
0x00404096
0x00404096
0x00404099
0x0040409e
0x004040a1
0x004040b1
0x004040b2
0x004040b4
0x004040ea
0x004040fa
0x00000000
0x004040fa
0x004040b6
0x004040bc
0x004040d5
0x004040da
0x004040dc
0x00000000
0x00000000
0x004040de
0x004040ca
0x004040ca
0x004040cc
0x004040cc
0x00000000
0x004040cc
0x004040bf
0x004040c4
0x00000000
0x004040c4
0x004040a3
0x004040a9
0x00000000
0x00000000
0x004040ab
0x00000000
0x004040ab
0x0040409b
0x00000000
0x0040409b
0x00404081
0x00404088
0x0040408e
0x00404090
0x00404466
0x00000000
0x00404466
0x00000000
0x00404090
0x0040404e
0x00000000
0x00404056
0x00404035
0x0040403b
0x00404443
0x00404443
0x00404449
0x0040444b
0x00404451
0x00404456
0x0040445c
0x0040445c
0x00404451
0x00000000
0x00404449
0x00403fea
0x00403ff6
0x00403fff
0x00000000
0x0040401e
0x00404021
0x00000000
0x00404021
0x00403fff

• SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403FD6
• ShowWindow.USER32(?), ref: 00403FF6
• GetWindowLongW.USER32(?,000000F0), ref: 00404008
• ShowWindow.USER32(?,00000004), ref: 00404021
• DestroyWindow.USER32 ref: 00404035
• SetWindowLongW.USER32 ref: 0040404E
• GetDlgItem.USER32 ref: 0040406D
• SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00404081
• IsWindowEnabled.USER32(00000000), ref: 00404088
• GetDlgItem.USER32 ref: 00404133
• GetDlgItem.USER32 ref: 0040413D
• KiUserCallbackDispatcher.NTDLL(?,000000F2,?), ref: 00404157
• SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041A8
• GetDlgItem.USER32 ref: 0040424E
• ShowWindow.USER32(00000000,?), ref: 0040426F
• KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404281
• EnableWindow.USER32(?,?), ref: 0040429C
• GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042B2
• EnableMenuItem.USER32 ref: 004042B9
• SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004042D1
• SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004042E4
• lstrlenW.KERNEL32(0042D268,?,0042D268,00000000), ref: 0040430E
• SetWindowTextW.USER32(?,0042D268), ref: 00404322
• ShowWindow.USER32(?,0000000A), ref: 00404456

• Source File: 00000000.00000002.942332799.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

• Associated: 00000000.00000002.942318478.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942344612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942349438.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942376320.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942382891.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942388876.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942394858.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942403454.000000000045C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942407919.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

• Snapshot File: hcaresult_0_2_400000_doc.jbxd

• API ID: Window$Item$MessageSendShow$CallbackDispatcherEnableLongMenuUser$DestroyEnabledSystemTextlstrlen
• String ID:
• API String ID: 3618520773-0
• Opcode ID: f65e638bec718107b599af9a82b264fc0764d6b1c1dffbdcb4ef221558e01a13
• Instruction ID: 19e8ffe36521fda3862950d2389d84f1ef0c133ac5ff71005f69e3a94542e2f3
• Opcode Fuzzy Hash: f65e638bec718107b599af9a82b264fc0764d6b1c1dffbdcb4ef221558e01a13
• Instruction Fuzzy Hash: DDC1A1B1A00704ABDB206F61EE49E2B3A68FB84746F15053EF741B61F1CB799841DB2D

Uniqueness Score: -1.00%

			E00403BEC(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t22;
				void* _t30;
				void* _t32;
				int _t33;
				void* _t36;
				int _t39;
				int _t40;
				intOrPtr _t41;
				int _t44;
				short _t63;
				WCHAR* _t65;
				signed char _t69;
				WCHAR* _t76;
				intOrPtr _t82;
				WCHAR* _t87;

				_t82 =  *0x434f10;
				_t22 = E0040690A(2);
				_t90 = _t22;
				if(_t22 == 0) {
					_t76 = 0x42d268;
					L"1033" = 0x30;
					 *0x442002 = 0x78;
					 *0x442004 = 0;
					E0040640B(_t78, __eflags, 0x80000001, L"Control Panel\\Desktop\\ResourceLocale", 0, 0x42d268, 0);
					__eflags =  *0x42d268;
					if(__eflags == 0) {
						E0040640B(_t78, __eflags, 0x80000003, L".DEFAULT\\Control Panel\\International",  &M004083D4, 0x42d268, 0);
					}
					lstrcatW(L"1033", _t76);
				} else {
					E00406484(L"1033",  *_t22() & 0x0000ffff);
				}
				E00403EC2(_t78, _t90);
				_t86 = L"C:\\Users\\alfons\\AppData\\Local\\Temp";
				 *0x434f80 =  *0x434f18 & 0x00000020;
				 *0x434f9c = 0x10000;
				if(E00405F14(_t90, L"C:\\Users\\alfons\\AppData\\Local\\Temp") != 0) {
					L16:
					if(E00405F14(_t98, _t86) == 0) {
						E0040657A(_t76, 0, _t82, _t86,  *((intOrPtr*)(_t82 + 0x118)));
					}
					_t30 = LoadImageW( *0x434f00, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x433ee8 = _t30;
					if( *((intOrPtr*)(_t82 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t32 = E00403EC2(_t78, __eflags);
							__eflags =  *0x434fa0;
							if( *0x434fa0 != 0) {
								_t33 = E00405672(_t32, 0);
								__eflags = _t33;
								if(_t33 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x433ecc; // 0x0
								if(__eflags == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x42d248, 5); // executed
							_t39 = E0040689A("RichEd20"); // executed
							__eflags = _t39;
							if(_t39 == 0) {
								E0040689A("RichEd32");
							}
							_t87 = L"RichEdit20W";
							_t40 = GetClassInfoW(0, _t87, 0x433ea0);
							__eflags = _t40;
							if(_t40 == 0) {
								GetClassInfoW(0, L"RichEdit", 0x433ea0);
								 *0x433ec4 = _t87;
								RegisterClassW(0x433ea0);
							}
							_t41 =  *0x433ee0; // 0x0
							_t44 = DialogBoxParamW( *0x434f00, _t41 + 0x00000069 & 0x0000ffff, 0, E00403F9A, 0); // executed
							E00403B3C(E0040140B(5), 1);
							return _t44;
						}
						L22:
						_t36 = 2;
						return _t36;
					} else {
						_t78 =  *0x434f00;
						 *0x433ea4 = E00401000;
						 *0x433eb0 =  *0x434f00;
						 *0x433eb4 = _t30;
						 *0x433ec4 = 0x40a380;
						if(RegisterClassW(0x433ea0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoW(0x30, 0,  &_v16, 0);
						 *0x42d248 = CreateWindowExW(0x80, 0x40a380, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x434f00, 0);
						goto L21;
					}
				} else {
					_t78 =  *(_t82 + 0x48);
					_t92 = _t78;
					if(_t78 == 0) {
						goto L16;
					}
					_t76 = 0x432ea0;
					E0040640B(_t78, _t92,  *((intOrPtr*)(_t82 + 0x44)),  *0x434f38 + _t78 * 2,  *0x434f38 +  *(_t82 + 0x4c) * 2, 0x432ea0, 0);
					_t63 =  *0x432ea0; // 0x43
					if(_t63 == 0) {
						goto L16;
					}
					if(_t63 == 0x22) {
						_t76 = 0x432ea2;
						 *((short*)(E00405E39(0x432ea2, 0x22))) = 0;
					}
					_t65 = _t76 + lstrlenW(_t76) * 2 - 8;
					if(_t65 <= _t76 || lstrcmpiW(_t65, L".exe") != 0) {
						L15:
						E0040653D(_t86, E00405E0C(_t76));
						goto L16;
					} else {
						_t69 = GetFileAttributesW(_t76);
						if(_t69 == 0xffffffff) {
							L14:
							E00405E58(_t76);
							goto L15;
						}
						_t98 = _t69 & 0x00000010;
						if((_t69 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x00403bf2
0x00403bfb
0x00403c02
0x00403c04
0x00403c18
0x00403c2a
0x00403c33
0x00403c3c
0x00403c43
0x00403c48
0x00403c4f
0x00403c62
0x00403c62
0x00403c6d
0x00403c06
0x00403c11
0x00403c11
0x00403c72
0x00403c7c
0x00403c85
0x00403c8a
0x00403c9b
0x00403d2d
0x00403d35
0x00403d3e
0x00403d3e
0x00403d54
0x00403d5a
0x00403d68
0x00403de9
0x00403df1
0x00403dfb
0x00403e00
0x00403e06
0x00403e90
0x00403e95
0x00403e97
0x00403eb3
0x00000000
0x00403eb3
0x00403e99
0x00403e9f
0x00403ea7
0x00403ea7
0x00000000
0x00403e9f
0x00403e14
0x00403e1f
0x00403e24
0x00403e26
0x00403e2d
0x00403e2d
0x00403e38
0x00403e40
0x00403e42
0x00403e44
0x00403e4d
0x00403e50
0x00403e56
0x00403e56
0x00403e5c
0x00403e75
0x00403e86
0x00000000
0x00403e8b
0x00403df3
0x00403df5
0x00000000
0x00403d6a
0x00403d6a
0x00403d76
0x00403d80
0x00403d86
0x00403d8b
0x00403d9a
0x00403eb8
0x00403eb8
0x00000000
0x00403eb8
0x00403da9
0x00403de4
0x00000000
0x00403de4
0x00403ca1
0x00403ca1
0x00403ca4
0x00403ca6
0x00000000
0x00000000
0x00403cb4
0x00403cc6
0x00403ccb
0x00403cd4
0x00000000
0x00000000
0x00403cda
0x00403cdc
0x00403ce9
0x00403ce9
0x00403cf2
0x00403cf8
0x00403d20
0x00403d28
0x00000000
0x00403d0a
0x00403d0b
0x00403d14
0x00403d1a
0x00403d1b
0x00000000
0x00403d1b
0x00403d16
0x00403d18
0x00000000
0x00000000
0x00000000
0x00403d18
0x00403cf8

• Part of subcall function 0040690A: GetModuleHandleA.KERNEL32(?,00000020,?,0040363D,0000000B), ref: 0040691C
• Part of subcall function 0040690A: GetProcAddress.KERNEL32(00000000,?), ref: 00406937
• lstrcatW.KERNEL32(1033,0042D268), ref: 00403C6D
• lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,76DDFAA0), ref: 00403CED
• lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 00403D00
• GetFileAttributesW.KERNEL32(Call,?,00000000,?), ref: 00403D0B
• LoadImageW.USER32 ref: 00403D54
• Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491
• RegisterClassW.USER32 ref: 00403D91
• SystemParametersInfoW.USER32 ref: 00403DA9
• CreateWindowExW.USER32 ref: 00403DDE
• ShowWindow.USER32(00000005,00000000,?,00000000,?), ref: 00403E14
• GetClassInfoW.USER32 ref: 00403E40
• GetClassInfoW.USER32 ref: 00403E4D
• RegisterClassW.USER32 ref: 00403E56
• DialogBoxParamW.USER32 ref: 00403E75

• .exe, xrefs: 00403CFA
• 1033, xrefs: 00403C0C, 00403C68
• RichEd20, xrefs: 00403E1A
• _Nb, xrefs: 00403D70, 00403DD8
• C:\Users\user\AppData\Local\Temp\, xrefs: 00403BF1
• RichEd32, xrefs: 00403E28
• .DEFAULT\Control Panel\International, xrefs: 00403C58
• RichEdit, xrefs: 00403E47
• Call, xrefs: 00403CB4, 00403CBD, 00403CCB, 00403D1A, 00403D20
• C:\Users\user\AppData\Local\Temp, xrefs: 00403C7C, 00403C84, 00403D27, 00403D2D, 00403D3D
• Control Panel\Desktop\ResourceLocale, xrefs: 00403C20
• RichEdit20W, xrefs: 00403E38, 00403E3E

• Source File: 00000000.00000002.942332799.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

• Associated: 00000000.00000002.942318478.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942344612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942349438.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942376320.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942382891.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942388876.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942394858.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942403454.000000000045C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942407919.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

• Snapshot File: hcaresult_0_2_400000_doc.jbxd

• API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
• String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
• API String ID: 1975747703-125959014
• Opcode ID: 5a24b6ccf2dff8f69514c8993659dfa0179b66eb04d645246d0b4e575a356aee
• Instruction ID: 6cc527b2f10929733706d009ff8c1d9b21e511251dd9cb17fe62514cef47010a
• Opcode Fuzzy Hash: 5a24b6ccf2dff8f69514c8993659dfa0179b66eb04d645246d0b4e575a356aee
• Instruction Fuzzy Hash: F561A670140300BED721AF66ED46F2B3A6CEB84B5AF40453FF945B62E2CB7D59018A6D

Uniqueness Score: -1.00%

			E0040307D(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				long _t50;
				void* _t53;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				long _t70;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				void* _t85;
				signed int _t87;
				void* _t89;
				long _t90;
				long _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = L"C:\\Users\\alfons\\Desktop\\doc.1234567098.pff.exe";
				 *0x434f0c = _t43 + 0x3e8;
				GetModuleFileNameW(0, L"C:\\Users\\alfons\\Desktop\\doc.1234567098.pff.exe", 0x400);
				_t89 = E0040602D(_t91, 0x80000000, 3);
				_v16 = _t89;
				 *0x40a018 = _t89;
				if(_t89 == 0xffffffff) {
					return L"Error launching installer";
				}
				_t92 = L"C:\\Users\\alfons\\Desktop";
				E0040653D(L"C:\\Users\\alfons\\Desktop", _t91);
				E0040653D(0x444000, E00405E58(_t92));
				_t50 = GetFileSize(_t89, 0);
				 *0x42aa24 = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00403019(1);
					if( *0x434f14 == _t82) {
						goto L29;
					}
					if(_v8 == _t82) {
						L28:
						_t34 =  &_v24; // 0x40387d
						_t53 = GlobalAlloc(0x40,  *_t34); // executed
						_t94 = _t53;
						E004034E5( *0x434f14 + 0x1c);
						_t35 =  &_v24; // 0x40387d
						_push( *_t35);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff); // executed
						_t57 = E004032B4(); // executed
						if(_t57 == _v24) {
							 *0x434f10 = _t94;
							 *0x434f18 =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x434f1c =  *0x434f1c + 1;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
							 *(_t94 + 0x3c) = _t60;
							E00405FE8(0x434f20, _t94 + 4, 0x40);
							return 0;
						}
						goto L29;
					}
					E004034E5( *0x41ea18);
					if(E004034CF( &_a4, 4) == 0 || _v12 != _a4) {
						goto L29;
					} else {
						goto L28;
					}
				} else {
					do {
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~( *0x434f14) & 0x00007e00) + 0x200;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						if(E004034CF(0x416a18, _t90) == 0) {
							E00403019(1);
							L29:
							return L"Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						if( *0x434f14 != 0) {
							if((_a4 & 0x00000002) == 0) {
								E00403019(0);
							}
							goto L20;
						}
						E00405FE8( &_v44, 0x416a18, 0x1c);
						_t77 = _v44;
						if((_t77 & 0xfffffff0) == 0 && _v40 == 0xdeadbeef && _v28 == 0x74736e49 && _v32 == 0x74666f73 && _v36 == 0x6c6c754e) {
							_a4 = _a4 | _t77;
							_t87 =  *0x41ea18; // 0x58662
							 *0x434fa0 =  *0x434fa0 | _a4 & 0x00000002;
							_t80 = _v20;
							 *0x434f14 = _t87;
							if(_t80 > _t93) {
								goto L29;
							}
							if((_a4 & 0x00000008) != 0 || (_a4 & 0x00000004) == 0) {
								_v8 = _v8 + 1;
								_t93 = _t80 - 4;
								if(_t90 > _t93) {
									_t90 = _t93;
								}
								goto L20;
							} else {
								break;
							}
						}
						L20:
						if(_t93 <  *0x42aa24) {
							_v12 = E004069F7(_v12, 0x416a18, _t90);
						}
						 *0x41ea18 =  *0x41ea18 + _t90;
						_t93 = _t93 - _t90;
					} while (_t93 != 0);
					_t82 = 0;
					goto L24;
				}
			}

0x00403085
0x00403088
0x0040308b
0x0040308e
0x00403094
0x004030a5
0x004030aa
0x004030bd
0x004030c2
0x004030c5
0x004030cb
0x00000000
0x004030cd
0x004030d8
0x004030de
0x004030ef
0x004030f6
0x004030fe
0x00403103
0x00403105
0x004031f0
0x004031f2
0x004031fe
0x00000000
0x00000000
0x00403203
0x00403227
0x00403227
0x0040322c
0x00403232
0x0040323d
0x00403242
0x00403242
0x00403245
0x00403246
0x00403247
0x00403249
0x00403251
0x00403268
0x00403270
0x00403275
0x00403277
0x00403277
0x0040327f
0x0040327f
0x00403282
0x00403283
0x00403283
0x00403286
0x00403288
0x00403288
0x00403292
0x00403298
0x004032a6
0x00000000
0x004032ab
0x00000000
0x00403251
0x0040320b
0x0040321d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040310b
0x00403110
0x00403115
0x00403119
0x00403120
0x00403127
0x00403129
0x00403129
0x00403134
0x0040325c
0x00403253
0x00000000
0x00403253
0x00403141
0x004031c1
0x004031c5
0x004031ca
0x00000000
0x004031c1
0x0040314a
0x0040314f
0x00403157
0x0040317d
0x00403183
0x0040318c
0x00403192
0x00403197
0x0040319d
0x00000000
0x00000000
0x004031a7
0x004031af
0x004031b2
0x004031b7
0x004031b9
0x004031b9
0x00000000
0x00000000
0x00000000
0x00000000
0x004031a7
0x004031cb
0x004031d1
0x004031dd
0x004031dd
0x004031e0
0x004031e6
0x004031e6
0x004031ee
0x00000000
0x004031ee

• GetTickCount.KERNEL32 ref: 0040308E
• GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\doc.1234567098.pff.exe,00000400,?,?,?,?,?,0040387D,?), ref: 004030AA
• Part of subcall function 0040602D: GetFileAttributesW.KERNELBASE(00000003,004030BD,C:\Users\user\Desktop\doc.1234567098.pff.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
• Part of subcall function 0040602D: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053
• GetFileSize.KERNEL32(00000000,00000000,00444000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\doc.1234567098.pff.exe,C:\Users\user\Desktop\doc.1234567098.pff.exe,80000000,00000003,?,?,?,?,?,0040387D), ref: 004030F6
• GlobalAlloc.KERNELBASE(00000040,}8@,?,?,?,?,?,0040387D,?), ref: 0040322C

• Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403253
• soft, xrefs: 0040316B
• C:\Users\user\AppData\Local\Temp\, xrefs: 00403084
• C:\Users\user\Desktop\doc.1234567098.pff.exe, xrefs: 00403094, 004030A3, 004030B7, 004030D7
• C:\Users\user\Desktop, xrefs: 004030D8, 004030DD, 004030E3
• Inst, xrefs: 00403162
• }8@, xrefs: 00403227, 00403242
• Error launching installer, xrefs: 004030CD
• Null, xrefs: 00403174

• Source File: 00000000.00000002.942332799.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

• Associated: 00000000.00000002.942318478.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942344612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942349438.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942376320.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942382891.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942388876.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942394858.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942403454.000000000045C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942407919.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

• Snapshot File: hcaresult_0_2_400000_doc.jbxd

• API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
• String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\doc.1234567098.pff.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$}8@
• API String ID: 2803837635-1496997632
• Opcode ID: b2925046ebf4ee23c20be954f21b6b8de3b8febbf6f0f410cc7df6a070a5bb34
• Instruction ID: 750c061bb954c4555836cecba7cc54c639b148d890841a972b43b12454d44aa7
• Opcode Fuzzy Hash: b2925046ebf4ee23c20be954f21b6b8de3b8febbf6f0f410cc7df6a070a5bb34
• Instruction Fuzzy Hash: 7951B571904204AFDB10AF65ED42B9E7EACAB48756F14807BF904B62D1C77C9F408B9D

Uniqueness Score: -1.00%

			E0040657A(void* __ebx, void* __edi, void* __esi, signed int _a4, short _a8) {
				struct _ITEMIDLIST* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t44;
				WCHAR* _t45;
				signed char _t47;
				signed int _t48;
				short _t59;
				short _t61;
				short _t63;
				void* _t71;
				signed int _t77;
				signed int _t78;
				short _t81;
				short _t82;
				signed char _t84;
				signed int _t85;
				intOrPtr _t93;
				void* _t98;
				void* _t104;
				intOrPtr* _t105;
				void* _t107;
				WCHAR* _t108;
				void* _t110;

				_t107 = __esi;
				_t104 = __edi;
				_t71 = __ebx;
				_t44 = _a8;
				if(_t44 < 0) {
					_t93 =  *0x433edc; // 0x75fe94
					_t44 =  *(_t93 - 4 + _t44 * 4);
				}
				_push(_t71);
				_push(_t107);
				_push(_t104);
				_t105 =  *0x434f38 + _t44 * 2;
				_t45 = 0x432ea0;
				_t108 = 0x432ea0;
				if(_a4 >= 0x432ea0 && _a4 - 0x432ea0 >> 1 < 0x800) {
					_t108 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				_t81 =  *_t105;
				_a8 = _t81;
				if(_t81 == 0) {
					L43:
					 *_t108 =  *_t108 & 0x00000000;
					if(_a4 == 0) {
						return _t45;
					}
					return E0040653D(_a4, _t45);
				} else {
					while((_t108 - _t45 & 0xfffffffe) < 0x800) {
						_t98 = 2;
						_t105 = _t105 + _t98;
						if(_t81 >= 4) {
							if(__eflags != 0) {
								 *_t108 = _t81;
								_t108 = _t108 + _t98;
								__eflags = _t108;
							} else {
								 *_t108 =  *_t105;
								_t108 = _t108 + _t98;
								_t105 = _t105 + _t98;
							}
							L42:
							_t82 =  *_t105;
							_a8 = _t82;
							if(_t82 != 0) {
								_t81 = _a8;
								continue;
							}
							goto L43;
						}
						_t84 =  *((intOrPtr*)(_t105 + 1));
						_t47 =  *_t105;
						_t48 = _t47 & 0x000000ff;
						_v12 = (_t84 & 0x0000007f) << 0x00000007 | _t47 & 0x0000007f;
						_t85 = _t84 & 0x000000ff;
						_v28 = _t48 | 0x00008000;
						_t77 = 2;
						_v16 = _t85;
						_t105 = _t105 + _t77;
						_v24 = _t48;
						_v20 = _t85 | 0x00008000;
						if(_a8 != _t77) {
							__eflags = _a8 - 3;
							if(_a8 != 3) {
								__eflags = _a8 - 1;
								if(__eflags == 0) {
									__eflags = (_t48 | 0xffffffff) - _v12;
									E0040657A(_t77, _t105, _t108, _t108, (_t48 | 0xffffffff) - _v12);
								}
								L38:
								_t108 =  &(_t108[lstrlenW(_t108)]);
								_t45 = 0x432ea0;
								goto L42;
							}
							_t78 = _v12;
							__eflags = _t78 - 0x1d;
							if(_t78 != 0x1d) {
								__eflags = (_t78 << 0xb) + 0x436000;
								E0040653D(_t108, (_t78 << 0xb) + 0x436000);
							} else {
								E00406484(_t108,  *0x434f08);
							}
							__eflags = _t78 + 0xffffffeb - 7;
							if(__eflags < 0) {
								L29:
								E004067C4(_t108);
							}
							goto L38;
						}
						if( *0x434f84 != 0) {
							_t77 = 4;
						}
						_t121 = _t48;
						if(_t48 >= 0) {
							__eflags = _t48 - 0x25;
							if(_t48 != 0x25) {
								__eflags = _t48 - 0x24;
								if(_t48 == 0x24) {
									GetWindowsDirectoryW(_t108, 0x400);
									_t77 = 0;
								}
								while(1) {
									__eflags = _t77;
									if(_t77 == 0) {
										goto L26;
									}
									_t59 =  *0x434f04;
									_t77 = _t77 - 1;
									__eflags = _t59;
									if(_t59 == 0) {
										L22:
										_t61 = SHGetSpecialFolderLocation( *0x434f08,  *(_t110 + _t77 * 4 - 0x18),  &_v8);
										__eflags = _t61;
										if(_t61 != 0) {
											L24:
											 *_t108 =  *_t108 & 0x00000000;
											__eflags =  *_t108;
											continue;
										}
										__imp__SHGetPathFromIDListW(_v8, _t108);
										_a8 = _t61;
										__imp__CoTaskMemFree(_v8);
										__eflags = _a8;
										if(_a8 != 0) {
											goto L26;
										}
										goto L24;
									}
									_t63 =  *_t59( *0x434f08,  *(_t110 + _t77 * 4 - 0x18), 0, 0, _t108); // executed
									__eflags = _t63;
									if(_t63 == 0) {
										goto L26;
									}
									goto L22;
								}
								goto L26;
							}
							GetSystemDirectoryW(_t108, 0x400);
							goto L26;
						} else {
							E0040640B( *0x434f38, _t121, 0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion",  *0x434f38 + (_t48 & 0x0000003f) * 2, _t108, _t48 & 0x00000040);
							if( *_t108 != 0) {
								L27:
								if(_v16 == 0x1a) {
									lstrcatW(_t108, L"\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L29;
							}
							E0040657A(_t77, _t105, _t108, _t108, _v16);
							L26:
							if( *_t108 == 0) {
								goto L29;
							}
							goto L27;
						}
					}
					goto L43;
				}
			}

0x0040657a
0x0040657a
0x0040657a
0x00406580
0x00406585
0x00406587
0x00406596
0x00406596
0x0040659e
0x0040659f
0x004065a0
0x004065a1
0x004065a4
0x004065ac
0x004065ae
0x004065bf
0x004065c2
0x004065c2
0x004065c6
0x004065cc
0x004065cf
0x004067aa
0x004067aa
0x004067b5
0x004067c1
0x004067c1
0x00000000
0x004065d5
0x004065da
0x004065ef
0x004065f0
0x004065f6
0x00406788
0x00406796
0x00406799
0x00406799
0x0040678a
0x0040678d
0x00406790
0x00406792
0x00406792
0x0040679b
0x0040679b
0x004067a1
0x004067a4
0x004065d7
0x00000000
0x004065d7
0x00000000
0x004067a4
0x004065fc
0x004065ff
0x0040660e
0x00406615
0x00406621
0x00406624
0x00406627
0x00406628
0x0040662d
0x00406633
0x00406636
0x00406639
0x0040672c
0x00406731
0x00406764
0x00406769
0x0040676e
0x00406773
0x00406773
0x00406778
0x0040677e
0x00406781
0x00000000
0x00406781
0x00406733
0x00406736
0x00406739
0x0040674e
0x00406755
0x0040673b
0x00406742
0x00406742
0x0040675d
0x00406760
0x00406724
0x00406725
0x00406725
0x00000000
0x00406760
0x00406646
0x0040664a
0x0040664a
0x0040664b
0x0040664d
0x0040668a
0x0040668d
0x0040669d
0x004066a0
0x004066a8
0x004066ae
0x004066ae
0x00406709
0x00406709
0x0040670b
0x00000000
0x00000000
0x004066b2
0x004066b7
0x004066b8
0x004066ba
0x004066d1
0x004066df
0x004066e5
0x004066e7
0x00406705
0x00406705
0x00406705
0x00000000
0x00406705
0x004066ed
0x004066f6
0x004066f9
0x004066ff
0x00406703
0x00000000
0x00000000
0x00000000
0x00406703
0x004066cb
0x004066cd
0x004066cf
0x00000000
0x00000000
0x00000000
0x004066cf
0x00000000
0x00406709
0x00406695
0x00000000
0x0040664f
0x0040666d
0x00406676
0x00406713
0x00406717
0x0040671f
0x0040671f
0x00000000
0x00406717
0x00406680
0x0040670d
0x00406711
0x00000000
0x00000000
0x00000000
0x00406711
0x0040664d
0x00000000
0x004065da

• GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 00406695
• GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll,?,004055D6,Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll,00000000,00000000,00425A20,76DDEA30), ref: 004066A8
• lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
• lstrlenW.KERNEL32(Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll,?,004055D6,Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll,00000000), ref: 00406779

• Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll, xrefs: 0040659F
• Call, xrefs: 004065A4, 00406657, 0040665E, 00406662, 0040667F, 00406694, 004066A7, 004066BC, 004066E9, 0040671E, 00406724, 00406741, 00406754, 00406772, 00406778, 00406781, 004067B7
• Software\Microsoft\Windows\CurrentVersion, xrefs: 00406663
• \Microsoft\Internet Explorer\Quick Launch, xrefs: 00406719

• Source File: 00000000.00000002.942332799.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

• Associated: 00000000.00000002.942318478.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942344612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942349438.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942376320.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942382891.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942388876.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942394858.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942403454.000000000045C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942407919.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

• Snapshot File: hcaresult_0_2_400000_doc.jbxd

• API ID: Directory$SystemWindowslstrcatlstrlen
• String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
• API String ID: 4260037668-2627123587
• Opcode ID: c06be4e573324e40d3b735838f303e9f3324c9f348604da111048893f4ce4833
• Instruction ID: 685928b229c5d1fd60d609eb920d771e11fa4d776b5b66b0bad6c944a0f90ddf
• Opcode Fuzzy Hash: c06be4e573324e40d3b735838f303e9f3324c9f348604da111048893f4ce4833
• Instruction Fuzzy Hash: 1D61D131900205EADB209F64DD80BAE77A5EF54318F22813BE907B72D0D77D99A1CB5D

Uniqueness Score: -1.00%

			E004032B4(int _a4, intOrPtr _a8, intOrPtr _a12, int _a16, signed char _a19) {
				signed int _v8;
				int _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				short _v152;
				void* _t65;
				long _t70;
				intOrPtr _t75;
				long _t76;
				intOrPtr _t77;
				void* _t78;
				int _t88;
				intOrPtr _t92;
				intOrPtr _t95;
				long _t96;
				signed int _t97;
				int _t98;
				int _t99;
				intOrPtr _t100;
				void* _t101;
				void* _t102;

				_t97 = _a16;
				_t92 = _a12;
				_v12 = _t97;
				if(_t92 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_v16 = _t92;
				if(_t92 == 0) {
					_v16 = 0x422a20;
				}
				_t62 = _a4;
				if(_a4 >= 0) {
					E004034E5( *0x434f58 + _t62);
				}
				if(E004034CF( &_a16, 4) == 0) {
					L41:
					_push(0xfffffffd);
					goto L42;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t92 != 0) {
							if(_a16 < _t97) {
								_t97 = _a16;
							}
							if(E004034CF(_t92, _t97) != 0) {
								_v8 = _t97;
								L44:
								return _v8;
							} else {
								goto L41;
							}
						}
						if(_a16 <= _t92) {
							goto L44;
						}
						_t88 = _v12;
						while(1) {
							_t98 = _a16;
							if(_a16 >= _t88) {
								_t98 = _t88;
							}
							if(E004034CF(0x41ea20, _t98) == 0) {
								goto L41;
							}
							if(E004060DF(_a8, 0x41ea20, _t98) == 0) {
								L28:
								_push(0xfffffffe);
								L42:
								_pop(_t65);
								return _t65;
							}
							_v8 = _v8 + _t98;
							_a16 = _a16 - _t98;
							if(_a16 > 0) {
								continue;
							}
							goto L44;
						}
						goto L41;
					}
					_t70 = GetTickCount();
					 *0x40d384 =  *0x40d384 & 0x00000000;
					 *0x40d380 =  *0x40d380 & 0x00000000;
					_t14 =  &_a16;
					 *_t14 = _a16 & 0x7fffffff;
					_v20 = _t70;
					 *0x40ce68 = 8;
					 *0x416a10 = 0x40ea08;
					 *0x416a0c = 0x40ea08;
					 *0x416a08 = 0x416a08;
					_a4 = _a16;
					if( *_t14 <= 0) {
						goto L44;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t99 = 0x4000;
						if(_a16 < 0x4000) {
							_t99 = _a16;
						}
						if(E004034CF(0x41ea20, _t99) == 0) {
							goto L41;
						}
						_a16 = _a16 - _t99;
						 *0x40ce58 = 0x41ea20;
						 *0x40ce5c = _t99;
						while(1) {
							_t95 = _v16;
							 *0x40ce60 = _t95;
							 *0x40ce64 = _v12;
							_t75 = E00406A65(0x40ce58);
							_v24 = _t75;
							if(_t75 < 0) {
								break;
							}
							_t100 =  *0x40ce60; // 0x425a20
							_t101 = _t100 - _t95;
							_t76 = GetTickCount();
							_t96 = _t76;
							if(( *0x434fb4 & 0x00000001) != 0 && (_t76 - _v20 > 0xc8 || _a16 == 0)) {
								wsprintfW( &_v152, L"... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t102 = _t102 + 0xc;
								E0040559F(0,  &_v152);
								_v20 = _t96;
							}
							if(_t101 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L44;
							} else {
								if(_a12 != 0) {
									_t77 =  *0x40ce60; // 0x425a20
									_v8 = _v8 + _t101;
									_v12 = _v12 - _t101;
									_v16 = _t77;
									L23:
									if(_v24 != 1) {
										continue;
									}
									goto L44;
								}
								_t78 = E004060DF(_a8, _v16, _t101); // executed
								if(_t78 == 0) {
									goto L28;
								}
								_v8 = _v8 + _t101;
								goto L23;
							}
						}
						_push(0xfffffffc);
						goto L42;
					}
					goto L41;
				}
			}

0x004032bf
0x004032c3
0x004032c6
0x004032cb
0x004032cd
0x004032cd
0x004032d4
0x004032d8
0x004032dd
0x004032df
0x004032df
0x004032e6
0x004032eb
0x004032f6
0x004032f6
0x00403308
0x004034bd
0x004034bd
0x00000000
0x0040330e
0x00403312
0x0040346a
0x004034ad
0x004034af
0x004034af
0x004034bb
0x004034c2
0x004034c5
0x00000000
0x00000000
0x00000000
0x00000000
0x004034bb
0x0040346f
0x00000000
0x00000000
0x00403471
0x00403474
0x00403477
0x0040347a
0x0040347c
0x0040347c
0x0040348c
0x00000000
0x00000000
0x0040349a
0x00403464
0x00403464
0x004034bf
0x004034bf
0x00000000
0x004034bf
0x0040349c
0x0040349f
0x004034a6
0x00000000
0x00000000
0x00000000
0x004034a8
0x00000000
0x00403474
0x0040331e
0x00403320
0x00403327
0x0040332e
0x0040332e
0x00403335
0x0040333d
0x00403347
0x0040334c
0x00403354
0x0040335e
0x00403361
0x00000000
0x00000000
0x00000000
0x00000000
0x00403367
0x00403367
0x00403367
0x0040336f
0x00403371
0x00403371
0x00403382
0x00000000
0x00000000
0x00403388
0x0040338b
0x00403391
0x00403397
0x00403397
0x004033a2
0x004033a8
0x004033ad
0x004033b4
0x004033b7
0x00000000
0x00000000
0x004033bd
0x004033c3
0x004033c5
0x004033ce
0x004033d0
0x00403401
0x00403407
0x00403413
0x00403418
0x00403418
0x0040341d
0x00403458
0x00000000
0x00000000
0x00000000
0x0040341f
0x00403423
0x0040343a
0x0040343f
0x00403442
0x00403445
0x00403448
0x0040344c
0x00000000
0x00000000
0x00000000
0x00403452
0x0040342c
0x00403433
0x00000000
0x00000000
0x00403435
0x00000000
0x00403435
0x0040341d
0x00403460
0x00000000
0x00403460
0x00000000
0x00403367

• GetTickCount.KERNEL32 ref: 0040331E
• GetTickCount.KERNEL32 ref: 004033C5
• MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004033EE
• wsprintfW.USER32 ref: 00403401

• ... %d%%, xrefs: 004033FB
• ZB, xrefs: 004033A2, 004033BD, 0040343A
• A, xrefs: 0040347E
• }8@, xrefs: 004032B4
• *B, xrefs: 004032DF
• A, xrefs: 00403374

• Source File: 00000000.00000002.942332799.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

• Associated: 00000000.00000002.942318478.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942344612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942349438.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942376320.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942382891.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942388876.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942394858.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942403454.000000000045C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942407919.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

• Snapshot File: hcaresult_0_2_400000_doc.jbxd

• API ID: CountTick$wsprintf
• String ID: *B$ ZB$ A$ A$... %d%%$}8@
• API String ID: 551687249-3683892814
• Opcode ID: 3bb00b159343602b5baf8216f2e6fd7ccfc314744640e4b330e170589aabe739
• Instruction ID: 54ab186c05730647c672001b6e56d135182c7b51176e178f40f708a1e84a381e
• Opcode Fuzzy Hash: 3bb00b159343602b5baf8216f2e6fd7ccfc314744640e4b330e170589aabe739
• Instruction Fuzzy Hash: E251BD31810219EBCF11DF65DA44B9E7BB8AF05756F10827BE804BB2C1D7789E44CBA9

Uniqueness Score: -1.00%

			E0040176F(FILETIME* __ebx, void* __eflags) {
				void* __esi;
				void* _t35;
				void* _t43;
				void* _t45;
				FILETIME* _t51;
				FILETIME* _t64;
				void* _t66;
				signed int _t72;
				FILETIME* _t73;
				FILETIME* _t77;
				signed int _t79;
				WCHAR* _t81;
				void* _t83;
				void* _t84;
				void* _t86;

				_t77 = __ebx;
				 *(_t86 - 8) = E00402DA6(0x31);
				 *(_t86 + 8) =  *(_t86 - 0x30) & 0x00000007;
				_t35 = E00405E83( *(_t86 - 8));
				_push( *(_t86 - 8));
				_t81 = L"Call";
				if(_t35 == 0) {
					lstrcatW(E00405E0C(E0040653D(_t81, L"C:\\Users\\alfons\\AppData\\Local\\Temp")), ??);
				} else {
					E0040653D();
				}
				E004067C4(_t81);
				while(1) {
					__eflags =  *(_t86 + 8) - 3;
					if( *(_t86 + 8) >= 3) {
						_t66 = E00406873(_t81);
						_t79 = 0;
						__eflags = _t66 - _t77;
						if(_t66 != _t77) {
							_t73 = _t66 + 0x14;
							__eflags = _t73;
							_t79 = CompareFileTime(_t73, _t86 - 0x24);
						}
						asm("sbb eax, eax");
						_t72 =  ~(( *(_t86 + 8) + 0xfffffffd | 0x80000000) & _t79) + 1;
						__eflags = _t72;
						 *(_t86 + 8) = _t72;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) == _t77) {
						E00406008(_t81);
					}
					__eflags =  *(_t86 + 8) - 1;
					_t43 = E0040602D(_t81, 0x40000000, (0 |  *(_t86 + 8) != 0x00000001) + 1);
					__eflags = _t43 - 0xffffffff;
					 *(_t86 - 0x38) = _t43;
					if(_t43 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) != _t77) {
						E0040559F(0xffffffe2,  *(_t86 - 8));
						__eflags =  *(_t86 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t86 - 4)) = 1;
						}
						L31:
						 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t86 - 4));
						__eflags =  *0x434f88;
						goto L32;
					} else {
						E0040653D("C:\Users\alfons\AppData\Local\Temp\nss87EF.tmp", _t83);
						E0040653D(_t83, _t81);
						E0040657A(_t77, _t81, _t83, "C:\Users\alfons\AppData\Local\Temp\nss87EF.tmp\System.dll",  *((intOrPtr*)(_t86 - 0x1c)));
						E0040653D(_t83, "C:\Users\alfons\AppData\Local\Temp\nss87EF.tmp");
						_t64 = E00405B9D("C:\Users\alfons\AppData\Local\Temp\nss87EF.tmp\System.dll",  *(_t86 - 0x30) >> 3) - 4;
						__eflags = _t64;
						if(_t64 == 0) {
							continue;
						} else {
							__eflags = _t64 == 1;
							if(_t64 == 1) {
								 *0x434f88 =  &( *0x434f88->dwLowDateTime);
								L32:
								_t51 = 0;
								__eflags = 0;
							} else {
								_push(_t81);
								_push(0xfffffffa);
								E0040559F();
								L29:
								_t51 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t51;
				}
				E0040559F(0xffffffea,  *(_t86 - 8));
				 *0x434fb4 =  *0x434fb4 + 1;
				_t45 = E004032B4( *((intOrPtr*)(_t86 - 0x28)),  *(_t86 - 0x38), _t77, _t77); // executed
				 *0x434fb4 =  *0x434fb4 - 1;
				__eflags =  *(_t86 - 0x24) - 0xffffffff;
				_t84 = _t45;
				if( *(_t86 - 0x24) != 0xffffffff) {
					L22:
					SetFileTime( *(_t86 - 0x38), _t86 - 0x24, _t77, _t86 - 0x24); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t86 - 0x20)) - 0xffffffff;
					if( *((intOrPtr*)(_t86 - 0x20)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t86 - 0x38)); // executed
				__eflags = _t84 - _t77;
				if(_t84 >= _t77) {
					goto L31;
				} else {
					__eflags = _t84 - 0xfffffffe;
					if(_t84 != 0xfffffffe) {
						E0040657A(_t77, _t81, _t84, _t81, 0xffffffee);
					} else {
						E0040657A(_t77, _t81, _t84, _t81, 0xffffffe9);
						lstrcatW(_t81,  *(_t86 - 8));
					}
					_push(0x200010);
					_push(_t81);
					E00405B9D();
					goto L29;
				}
				goto L33;
			}

0x0040176f
0x00401776
0x00401782
0x00401785
0x0040178a
0x0040178d
0x00401794
0x004017b0
0x00401796
0x00401797
0x00401797
0x004017b6
0x004017bb
0x004017bb
0x004017bf
0x004017c2
0x004017c7
0x004017c9
0x004017cb
0x004017d0
0x004017d0
0x004017db
0x004017db
0x004017ec
0x004017ee
0x004017ee
0x004017ef
0x004017ef
0x004017f2
0x004017f5
0x004017f8
0x004017f8
0x004017ff
0x0040180e
0x00401813
0x00401816
0x00401819
0x00000000
0x00000000
0x0040181b
0x0040181e
0x00401874
0x00401879
0x004015b6
0x0040292e
0x0040292e
0x00402c2a
0x00402c2d
0x00402c2d
0x00000000
0x00401820
0x00401826
0x0040182d
0x0040183a
0x00401845
0x0040185b
0x0040185b
0x0040185e
0x00000000
0x00401864
0x00401864
0x00401865
0x00401882
0x00402c33
0x00402c33
0x00402c33
0x00401867
0x00401867
0x00401868
0x00401493
0x0040239d
0x0040239d
0x0040239d
0x00401865
0x0040185e
0x00402c35
0x00402c39
0x00402c39
0x00401892
0x00401897
0x004018a5
0x004018aa
0x004018b0
0x004018b4
0x004018b6
0x004018be
0x004018ca
0x004018b8
0x004018b8
0x004018bc
0x00000000
0x00000000
0x004018bc
0x004018d3
0x004018d9
0x004018db
0x00000000
0x004018e1
0x004018e1
0x004018e4
0x004018fc
0x004018e6
0x004018e9
0x004018f2
0x004018f2
0x00401901
0x00401906
0x00402398
0x00000000
0x00402398
0x00000000

• lstrcatW.KERNEL32(00000000,00000000), ref: 004017B0
• CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Temp,?,?,00000031), ref: 004017D5
• Part of subcall function 0040653D: lstrcpynW.KERNEL32(?,?,00000400,0040369D,00433F00,NSIS Error), ref: 0040654A
• Part of subcall function 0040559F: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll,00000000,00425A20,76DDEA30,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
• Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll,00000000,00425A20,76DDEA30,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
• Part of subcall function 0040559F: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll,00403418), ref: 004055FA
• Part of subcall function 0040559F: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll), ref: 0040560C
• Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
• Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
• Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A

• C:\Users\user\AppData\Local\Temp\nss87EF.tmp, xrefs: 00401821, 0040183F
• C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll, xrefs: 00401835, 00401851
• Call, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
• C:\Users\user\AppData\Local\Temp, xrefs: 0040179E

• Source File: 00000000.00000002.942332799.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

• Associated: 00000000.00000002.942318478.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942344612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942349438.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942376320.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942382891.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942388876.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942394858.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942403454.000000000045C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942407919.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

• Snapshot File: hcaresult_0_2_400000_doc.jbxd

• API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
• String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\nss87EF.tmp$C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll$Call
• API String ID: 1941528284-2825754506
• Opcode ID: 340e1442e1db9b0bbd45c79093729705e5d63a2406d9793f1b9f797b5a8be8ee
• Instruction ID: 1e3f5e060805a06bac003644be00ba5f3fef1f2c353f2d3d357c0a6c5ca497fd
• Opcode Fuzzy Hash: 340e1442e1db9b0bbd45c79093729705e5d63a2406d9793f1b9f797b5a8be8ee
• Instruction Fuzzy Hash: F4419371900108BACF11BFB5DD85DAE7A79EF45768B20423FF422B10E2D63C8A91966D

Uniqueness Score: -1.00%

			E0040559F(signed int _a4, WCHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				WCHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				WCHAR* _t27;
				signed int _t28;
				long _t29;
				signed int _t37;
				signed int _t38;

				_t27 =  *0x433ee4; // 0x10392
				_v8 = _t27;
				if(_t27 != 0) {
					_t37 =  *0x434fb4;
					_v12 = _t37;
					_t38 = _t37 & 0x00000001;
					if(_t38 == 0) {
						E0040657A(_t38, 0, 0x42c248, 0x42c248, _a4);
					}
					_t27 = lstrlenW(0x42c248);
					_a4 = _t27;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t27 = SetWindowTextW( *0x433ec8, 0x42c248); // executed
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x42c248;
							_v52 = 1;
							_t29 = SendMessageW(_v8, 0x1004, 0, 0); // executed
							_v44 = 0;
							_v48 = _t29 - _t38;
							SendMessageW(_v8, 0x104d - _t38, 0,  &_v52); // executed
							_t27 = SendMessageW(_v8, 0x1013, _v48, 0); // executed
						}
						if(_t38 != 0) {
							_t28 = _a4;
							0x42c248[_t28] = 0;
							return _t28;
						}
					} else {
						_t27 = lstrlenW(_a8) + _a4;
						if(_t27 < 0x1000) {
							_t27 = lstrcatW(0x42c248, _a8);
							goto L6;
						}
					}
				}
				return _t27;
			}

0x004055a5
0x004055af
0x004055b4
0x004055ba
0x004055c5
0x004055c8
0x004055cb
0x004055d1
0x004055d1
0x004055d7
0x004055df
0x004055e2
0x004055ff
0x00405603
0x0040560c
0x0040560c
0x00405616
0x0040561f
0x0040562b
0x00405632
0x00405636
0x00405639
0x0040564c
0x0040565a
0x0040565a
0x0040565e
0x00405660
0x00405663
0x00000000
0x00405663
0x004055e4
0x004055ec
0x004055f4
0x004055fa
0x00000000
0x004055fa
0x004055f4
0x004055e2
0x0040566f

• lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll,00000000,00425A20,76DDEA30,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
• lstrlenW.KERNEL32(00403418,Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll,00000000,00425A20,76DDEA30,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
• lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll,00403418), ref: 004055FA
• SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll), ref: 0040560C
• SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
• SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
• SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A
• Part of subcall function 0040657A: lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
• Part of subcall function 0040657A: lstrlenW.KERNEL32(Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll,?,004055D6,Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll,00000000), ref: 00406779

• Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll, xrefs: 004055C0, 004055D0, 004055D6, 004055F9, 00405605

• Source File: 00000000.00000002.942332799.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

• Associated: 00000000.00000002.942318478.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942344612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942349438.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942376320.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942382891.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942388876.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942394858.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942403454.000000000045C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942407919.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

• Snapshot File: hcaresult_0_2_400000_doc.jbxd

• API ID: MessageSendlstrlen$lstrcat$TextWindow
• String ID: Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll
• API String ID: 1495540970-1225621185
• Opcode ID: 61fc35634f83d303f4bb0fdf458391b4626c4708e393b35bd1b1a29fdfa46634
• Instruction ID: 138a2a903332092674924c4fce2a37a83712bc812e9b86ab44911e1df8857bb6
• Opcode Fuzzy Hash: 61fc35634f83d303f4bb0fdf458391b4626c4708e393b35bd1b1a29fdfa46634
• Instruction Fuzzy Hash: C1219071900558BACF11AFA9DD84DDFBF75EF45354F14803AF904B22A0C7794A419F68

Uniqueness Score: -1.00%

			E004026EC(intOrPtr __ebx, intOrPtr __edx, void* __edi) {
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t72;
				void* _t76;
				void* _t79;

				_t72 = __edx;
				 *((intOrPtr*)(_t76 - 8)) = __ebx;
				_t65 = 2;
				 *((intOrPtr*)(_t76 - 0x4c)) = _t65;
				_t66 = E00402D84(_t65);
				_t79 = _t66 - 1;
				 *((intOrPtr*)(_t76 - 0x10)) = _t72;
				 *((intOrPtr*)(_t76 - 0x44)) = _t66;
				if(_t79 < 0) {
					L36:
					 *0x434f88 =  *0x434f88 +  *(_t76 - 4);
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *(__ebp - 0x44) = 0x3ff;
					}
					if( *__edi == __bx) {
						L34:
						__ecx =  *(__ebp - 0xc);
						__eax =  *(__ebp - 8);
						 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __bx;
						if(_t79 == 0) {
							 *(_t76 - 4) = 1;
						}
						goto L36;
					} else {
						 *(__ebp - 0x38) = __ebx;
						 *(__ebp - 0x18) = E0040649D(__ecx, __edi);
						if( *(__ebp - 0x44) > __ebx) {
							do {
								if( *((intOrPtr*)(__ebp - 0x34)) != 0x39) {
									if( *((intOrPtr*)(__ebp - 0x24)) != __ebx ||  *(__ebp - 8) != __ebx || E0040610E( *(__ebp - 0x18), __ebx) >= 0) {
										__eax = __ebp - 0x50;
										if(E004060B0( *(__ebp - 0x18), __ebp - 0x50, 2) == 0) {
											goto L34;
										} else {
											goto L21;
										}
									} else {
										goto L34;
									}
								} else {
									__eax = __ebp - 0x40;
									_push(__ebx);
									_push(__ebp - 0x40);
									__eax = 2;
									__ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)) = __ebp + 0xa;
									__eax = ReadFile( *(__ebp - 0x18), __ebp + 0xa, __ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)), ??, ??); // executed
									if(__eax == 0) {
										goto L34;
									} else {
										__ecx =  *(__ebp - 0x40);
										if(__ecx == __ebx) {
											goto L34;
										} else {
											__ax =  *(__ebp + 0xa) & 0x000000ff;
											 *(__ebp - 0x4c) = __ecx;
											 *(__ebp - 0x50) = __eax;
											if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
												L28:
												__ax & 0x0000ffff = E00406484( *(__ebp - 0xc), __ax & 0x0000ffff);
											} else {
												__ebp - 0x50 = __ebp + 0xa;
												if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa, __ecx, __ebp - 0x50, 1) != 0) {
													L21:
													__eax =  *(__ebp - 0x50);
												} else {
													__edi =  *(__ebp - 0x4c);
													__edi =  ~( *(__ebp - 0x4c));
													while(1) {
														_t22 = __ebp - 0x40;
														 *_t22 =  *(__ebp - 0x40) - 1;
														__eax = 0xfffd;
														 *(__ebp - 0x50) = 0xfffd;
														if( *_t22 == 0) {
															goto L22;
														}
														 *(__ebp - 0x4c) =  *(__ebp - 0x4c) - 1;
														__edi = __edi + 1;
														__eax = SetFilePointer( *(__ebp - 0x18), __edi, __ebx, 1); // executed
														__ebp - 0x50 = __ebp + 0xa;
														if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa,  *(__ebp - 0x40), __ebp - 0x50, 1) == 0) {
															continue;
														} else {
															goto L21;
														}
														goto L22;
													}
												}
												L22:
												if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
													goto L28;
												} else {
													if( *(__ebp - 0x38) == 0xd ||  *(__ebp - 0x38) == 0xa) {
														if( *(__ebp - 0x38) == __ax || __ax != 0xd && __ax != 0xa) {
															 *(__ebp - 0x4c) =  ~( *(__ebp - 0x4c));
															__eax = SetFilePointer( *(__ebp - 0x18),  ~( *(__ebp - 0x4c)), __ebx, 1);
														} else {
															__ecx =  *(__ebp - 0xc);
															__edx =  *(__ebp - 8);
															 *(__ebp - 8) =  *(__ebp - 8) + 1;
															 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														}
														goto L34;
													} else {
														__ecx =  *(__ebp - 0xc);
														__edx =  *(__ebp - 8);
														 *(__ebp - 8) =  *(__ebp - 8) + 1;
														 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														 *(__ebp - 0x38) = __eax;
														if(__ax == __bx) {
															goto L34;
														} else {
															goto L26;
														}
													}
												}
											}
										}
									}
								}
								goto L37;
								L26:
								__eax =  *(__ebp - 8);
							} while ( *(__ebp - 8) <  *(__ebp - 0x44));
						}
						goto L34;
					}
				}
				L37:
				return 0;
			}

0x004026ec
0x004026ee
0x004026f1
0x004026f3
0x004026f6
0x004026fb
0x004026ff
0x00402702
0x00402705
0x00402c2a
0x00402c2d
0x0040270b
0x0040270b
0x00402712
0x00402714
0x00402714
0x0040271a
0x0040287e
0x0040287e
0x00402881
0x00402886
0x004015b6
0x0040292e
0x0040292e
0x00000000
0x00402720
0x00402721
0x0040272c
0x0040272f
0x0040273b
0x0040273f
0x004027d7
0x004027ef
0x004027ff
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402745
0x00402745
0x00402748
0x00402749
0x0040274c
0x00402751
0x00402758
0x00402760
0x00000000
0x00402766
0x00402766
0x0040276b
0x00000000
0x00402771
0x00402771
0x00402779
0x0040277c
0x0040277f
0x0040283a
0x00402841
0x00402785
0x0040278b
0x00402797
0x00402801
0x00402801
0x00402799
0x00402799
0x0040279c
0x0040279e
0x0040279e
0x0040279e
0x004027a1
0x004027a6
0x004027a9
0x00000000
0x00000000
0x004027ab
0x004027ae
0x004027b6
0x004027c2
0x004027d0
0x00000000
0x004027d2
0x00000000
0x004027d2
0x00000000
0x004027d0
0x0040279e
0x00402804
0x00402807
0x00000000
0x00402809
0x0040280e
0x0040284f
0x00402871
0x00402878
0x0040285d
0x0040285d
0x00402860
0x00402863
0x00402866
0x00402866
0x00000000
0x00402817
0x00402817
0x0040281a
0x0040281d
0x00402823
0x00402827
0x0040282a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040282a
0x0040280e
0x00402807
0x0040277f
0x0040276b
0x00402760
0x00000000
0x0040282c
0x0040282c
0x0040282f
0x00402838
0x00000000
0x0040272f
0x0040271a
0x00402c33
0x00402c39

• ReadFile.KERNELBASE(?,?,?,?), ref: 00402758
• MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
• SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
• MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC
• Part of subcall function 0040610E: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00406124
• SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878

• Source File: 00000000.00000002.942332799.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

• Associated: 00000000.00000002.942318478.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942344612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942349438.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942376320.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942382891.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942388876.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942394858.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942403454.000000000045C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942407919.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

• Snapshot File: hcaresult_0_2_400000_doc.jbxd

• API ID: File$Pointer$ByteCharMultiWide$Read
• String ID: 9
• API String ID: 163830602-2366072709
• Opcode ID: 05ec9e9945247294569ed32eb70c3e484d87f4f0290394ce4997a83a7f1e58dd
• Instruction ID: 36eba916602f65c1f8b814f2f26102ddc75cc08ed25eda7b441ea0696c55e726
• Opcode Fuzzy Hash: 05ec9e9945247294569ed32eb70c3e484d87f4f0290394ce4997a83a7f1e58dd
• Instruction Fuzzy Hash: C551E975D00219AADF20EF95CA89AAEBB79FF04304F10817BE541B62D4D7B49D82CB58

Uniqueness Score: -1.00%

			E0040689A(intOrPtr _a4) {
				short _v576;
				signed int _t13;
				struct HINSTANCE__* _t17;
				signed int _t19;
				void* _t24;

				_t13 = GetSystemDirectoryW( &_v576, 0x104);
				if(_t13 > 0x104) {
					_t13 = 0;
				}
				if(_t13 == 0 ||  *((short*)(_t24 + _t13 * 2 - 0x23e)) == 0x5c) {
					_t19 = 1;
				} else {
					_t19 = 0;
				}
				wsprintfW(_t24 + _t13 * 2 - 0x23c, L"%s%S.dll", 0x40a014 + _t19 * 2, _a4);
				_t17 = LoadLibraryExW( &_v576, 0, 8); // executed
				return _t17;
			}

0x004068b1
0x004068ba
0x004068bc
0x004068bc
0x004068c0
0x004068d3
0x004068cd
0x004068cd
0x004068cd
0x004068ec
0x00406900
0x00406907

• GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068B1
• wsprintfW.USER32 ref: 004068EC
• LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406900

• \, xrefs: 004068C2
• %s%S.dll, xrefs: 004068E6
• UXTHEME, xrefs: 004068A3

• Source File: 00000000.00000002.942332799.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

• Associated: 00000000.00000002.942318478.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942344612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942349438.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942376320.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942382891.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942388876.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942394858.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942403454.000000000045C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942407919.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

• Snapshot File: hcaresult_0_2_400000_doc.jbxd

• API ID: DirectoryLibraryLoadSystemwsprintf
• String ID: %s%S.dll$UXTHEME$\
• API String ID: 2200240437-1946221925
• Opcode ID: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
• Instruction ID: 21628a1c63ce2f140fdd4d546058f3b0ba52bdb51e88dcb335987c0e659eada7
• Opcode Fuzzy Hash: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
• Instruction Fuzzy Hash: D0F0F671511119ABDB10BB64DD0DF9B376CBF00305F10847AA646F10D0EB7CDA68CBA8

Uniqueness Score: -1.00%

			E00405A6E(WCHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x4083f8;
				_v36.Group = 0x4083f8;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x4083e8;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryW(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityW(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x00405a79
0x00405a7d
0x00405a80
0x00405a86
0x00405a8a
0x00405a8e
0x00405a96
0x00405a9d
0x00405aa3
0x00405aaa
0x00405ab1
0x00405ab9
0x00405abb
0x00000000
0x00405abb
0x00405ac5
0x00405acc
0x00405ae2
0x00000000
0x00000000
0x00000000
0x00405ae4
0x00405ae8

• CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB1
• GetLastError.KERNEL32 ref: 00405AC5
• SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405ADA
• GetLastError.KERNEL32 ref: 00405AE4

• C:\Users\user\AppData\Local\Temp\, xrefs: 00405A94

• Source File: 00000000.00000002.942332799.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

• Associated: 00000000.00000002.942318478.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942344612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942349438.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942376320.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942382891.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942388876.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942394858.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942403454.000000000045C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942407919.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

• Snapshot File: hcaresult_0_2_400000_doc.jbxd

• API ID: ErrorLast$CreateDirectoryFileSecurity
• String ID: C:\Users\user\AppData\Local\Temp\
• API String ID: 3449924974-823278215
• Opcode ID: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
• Instruction ID: 637b0a295f6611997b04f2fb2f8121e2d74ae93851c1d74b8ff7b710bfe1865b
• Opcode Fuzzy Hash: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
• Instruction Fuzzy Hash: 1A010871D04219EAEF019BA0DD84BEFBBB4EB14314F00813AD545B6281E7789648CFE9

Uniqueness Score: -1.00%

			E72F01817(void* __edx, void* __edi, void* __esi, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void _v36;
				char _v136;
				struct HINSTANCE__* _t37;
				void* _t39;
				intOrPtr _t42;
				void* _t48;
				void* _t49;
				void* _t50;
				void* _t54;
				intOrPtr _t57;
				signed int _t61;
				signed int _t63;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t76;

				_t76 = __esi;
				_t68 = __edi;
				_t67 = __edx;
				 *0x72f0506c = _a8;
				 *0x72f05070 = _a16;
				 *0x72f05074 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x72f05048, E72F01651);
				_push(1); // executed
				_t37 = E72F01BFF(); // executed
				_t54 = _t37;
				if(_t54 == 0) {
					L28:
					return _t37;
				} else {
					if( *((intOrPtr*)(_t54 + 4)) != 1) {
						E72F0243E(_t54);
					}
					_push(_t54);
					E72F02480(_t67);
					_t57 =  *((intOrPtr*)(_t54 + 4));
					if(_t57 == 0xffffffff) {
						L14:
						if(( *(_t54 + 0x1010) & 0x00000004) == 0) {
							if( *((intOrPtr*)(_t54 + 4)) == 0) {
								_push(_t54);
								_t37 = E72F02655();
							} else {
								_push(_t76);
								_push(_t68);
								_t61 = 8;
								_t13 = _t54 + 0x1018; // 0x1018
								memcpy( &_v36, _t13, _t61 << 2);
								_t42 = E72F01666(_t54,  &_v136);
								 *(_t54 + 0x1034) =  *(_t54 + 0x1034) & 0x00000000;
								_t18 = _t54 + 0x1018; // 0x1018
								_t72 = _t18;
								_push(_t54);
								 *((intOrPtr*)(_t54 + 0x1020)) = _t42;
								 *_t72 = 4;
								E72F02655();
								_t63 = 8;
								_t37 = memcpy(_t72,  &_v36, _t63 << 2);
							}
						} else {
							_push(_t54);
							E72F02655();
							_t37 = GlobalFree(E72F01312(E72F01654(_t54)));
						}
						if( *((intOrPtr*)(_t54 + 4)) != 1) {
							_t37 = E72F02618(_t54);
							if(( *(_t54 + 0x1010) & 0x00000040) != 0 &&  *_t54 == 1) {
								_t37 =  *(_t54 + 0x1008);
								if(_t37 != 0) {
									_t37 = FreeLibrary(_t37);
								}
							}
							if(( *(_t54 + 0x1010) & 0x00000020) != 0) {
								_t37 = E72F015DD( *0x72f05068);
							}
						}
						if(( *(_t54 + 0x1010) & 0x00000002) != 0) {
							goto L28;
						} else {
							_t39 = GlobalFree(_t54); // executed
							return _t39;
						}
					}
					_t48 =  *_t54;
					if(_t48 == 0) {
						if(_t57 != 1) {
							goto L14;
						}
						E72F02E23(_t54);
						L12:
						_t54 = _t48;
						L13:
						goto L14;
					}
					_t49 = _t48 - 1;
					if(_t49 == 0) {
						L8:
						_t48 = E72F02B98(_t57, _t54); // executed
						goto L12;
					}
					_t50 = _t49 - 1;
					if(_t50 == 0) {
						E72F02810(_t54);
						goto L13;
					}
					if(_t50 != 1) {
						goto L14;
					}
					goto L8;
				}
			}

0x72f01817
0x72f01817
0x72f01817
0x72f01824
0x72f0182c
0x72f01839
0x72f01847
0x72f0184a
0x72f0184c
0x72f01851
0x72f01856
0x72f01978
0x72f01978
0x72f0185c
0x72f01860
0x72f01863
0x72f01868
0x72f01869
0x72f0186a
0x72f01870
0x72f01876
0x72f018a6
0x72f018ad
0x72f018d1
0x72f0191e
0x72f0191f
0x72f018d3
0x72f018d3
0x72f018d4
0x72f018dd
0x72f018de
0x72f018e8
0x72f018eb
0x72f018f0
0x72f018f7
0x72f018f7
0x72f018fd
0x72f018fe
0x72f01904
0x72f0190a
0x72f01917
0x72f01918
0x72f0191b
0x72f018af
0x72f018af
0x72f018b0
0x72f018c5
0x72f018c5
0x72f01929
0x72f0192c
0x72f01939
0x72f01940
0x72f01948
0x72f0194b
0x72f0194b
0x72f01948
0x72f01958
0x72f01960
0x72f01965
0x72f01958
0x72f0196d
0x00000000
0x72f0196f
0x72f01970
0x00000000
0x72f01970
0x72f0196d
0x72f0187a
0x72f0187d
0x72f0189b
0x00000000
0x00000000
0x72f0189e
0x72f018a3
0x72f018a3
0x72f018a5
0x00000000
0x72f018a5
0x72f0187f
0x72f01880
0x72f01888
0x72f01889
0x00000000
0x72f01889
0x72f01882
0x72f01883
0x72f01891
0x00000000
0x72f01891
0x72f01886
0x00000000
0x00000000
0x00000000
0x72f01886

• Part of subcall function 72F01BFF: GlobalFree.KERNEL32 ref: 72F01E74
• Part of subcall function 72F01BFF: GlobalFree.KERNEL32 ref: 72F01E79
• Part of subcall function 72F01BFF: GlobalFree.KERNEL32 ref: 72F01E7E
• GlobalFree.KERNEL32 ref: 72F018C5
• FreeLibrary.KERNEL32(?), ref: 72F0194B
• GlobalFree.KERNEL32 ref: 72F01970
• Part of subcall function 72F0243E: GlobalAlloc.KERNEL32(00000040,?), ref: 72F0246F
• Part of subcall function 72F02810: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,72F01896,00000000), ref: 72F028E0
• Part of subcall function 72F01666: wsprintfW.USER32 ref: 72F01694

• Source File: 00000000.00000002.942685554.0000000072F01000.00000020.00000001.01000000.00000004.sdmp, Offset: 72F00000, based on PE: true

• Associated: 00000000.00000002.942671236.0000000072F00000.00000002.00000001.01000000.00000004.sdmpDownload File
• Associated: 00000000.00000002.942692891.0000000072F04000.00000002.00000001.01000000.00000004.sdmpDownload File
• Associated: 00000000.00000002.942703977.0000000072F06000.00000002.00000001.01000000.00000004.sdmpDownload File

• Snapshot File: hcaresult_0_2_72f00000_doc.jbxd

• API ID: Global$Free$Alloc$Librarywsprintf
• String ID:
• API String ID: 3962662361-3916222277
• Opcode ID: e180cf9160ebff96af03fd0273d86749ccb461010a9af733f452f64cbcb6c64e
• Instruction ID: db4a713f189781719e43fd410f8a5f9bd0b0b7dfc621b47d354d38bf6728587b
• Opcode Fuzzy Hash: e180cf9160ebff96af03fd0273d86749ccb461010a9af733f452f64cbcb6c64e
• Instruction Fuzzy Hash: 5941C272900605DBDB319F6CCD84F9A7BECBB05314F146469EB079A08AEBB48184EB60

Uniqueness Score: -1.00%

			E0040248A(void* __eax, int __ebx, intOrPtr __edx, void* __eflags) {
				void* _t20;
				void* _t21;
				int _t24;
				long _t25;
				int _t30;
				intOrPtr _t33;
				void* _t34;
				intOrPtr _t37;
				void* _t39;
				void* _t42;

				_t42 = __eflags;
				_t33 = __edx;
				_t30 = __ebx;
				_t37 =  *((intOrPtr*)(_t39 - 0x20));
				_t34 = __eax;
				 *(_t39 - 0x10) =  *(_t39 - 0x1c);
				 *(_t39 - 0x44) = E00402DA6(2);
				_t20 = E00402DA6(0x11);
				 *(_t39 - 4) = 1;
				_t21 = E00402E36(_t42, _t34, _t20, 2); // executed
				 *(_t39 + 8) = _t21;
				if(_t21 != __ebx) {
					_t24 = 0;
					if(_t37 == 1) {
						E00402DA6(0x23);
						_t24 = lstrlenW(0x40b5f0) + _t29 + 2;
					}
					if(_t37 == 4) {
						 *0x40b5f0 = E00402D84(3);
						 *((intOrPtr*)(_t39 - 0x38)) = _t33;
						_t24 = _t37;
					}
					if(_t37 == 3) {
						_t24 = E004032B4( *((intOrPtr*)(_t39 - 0x24)), _t30, 0x40b5f0, 0x1800);
					}
					_t25 = RegSetValueExW( *(_t39 + 8),  *(_t39 - 0x44), _t30,  *(_t39 - 0x10), 0x40b5f0, _t24); // executed
					if(_t25 == 0) {
						 *(_t39 - 4) = _t30;
					}
					_push( *(_t39 + 8));
					RegCloseKey(); // executed
				}
				 *0x434f88 =  *0x434f88 +  *(_t39 - 4);
				return 0;
			}

0x0040248a
0x0040248a
0x0040248a
0x0040248a
0x0040248d
0x00402494
0x0040249e
0x004024a1
0x004024aa
0x004024b1
0x004024b8
0x004024bb
0x004024c1
0x004024cb
0x004024cf
0x004024da
0x004024da
0x004024e1
0x004024eb
0x004024f1
0x004024f4
0x004024f4
0x004024f8
0x00402504
0x00402504
0x00402515
0x0040251d
0x0040251f
0x0040251f
0x00402522
0x004025fd
0x004025fd
0x00402c2d
0x00402c39

• lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nss87EF.tmp,00000023,00000011,00000002), ref: 004024D5
• RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nss87EF.tmp,00000000,00000011,00000002), ref: 00402515
• RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nss87EF.tmp,00000000,00000011,00000002), ref: 004025FD

• C:\Users\user\AppData\Local\Temp\nss87EF.tmp, xrefs: 004024C6, 004024D4, 004024EB, 004024FF, 0040250A

• Source File: 00000000.00000002.942332799.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

• Associated: 00000000.00000002.942318478.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942344612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942349438.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942376320.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942382891.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942388876.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942394858.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942403454.000000000045C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942407919.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

• Snapshot File: hcaresult_0_2_400000_doc.jbxd

• API ID: CloseValuelstrlen
• String ID: C:\Users\user\AppData\Local\Temp\nss87EF.tmp
• API String ID: 2655323295-2007392213
• Opcode ID: e1abf43c66d66a2eab4c5912dddbc3fe95e81c2d10ca9088dde855beb5deaf18
• Instruction ID: a32c4fc66ba480c3aafb49ec1434dbeb720bd0d2787204a1d049ba7b64bbfaa1
• Opcode Fuzzy Hash: e1abf43c66d66a2eab4c5912dddbc3fe95e81c2d10ca9088dde855beb5deaf18
• Instruction Fuzzy Hash: 8B118E71E00119BEEF10AFA5DE49EAEBAB8FF44358F15443AF504F61C1D7B88D40AA58

Uniqueness Score: -1.00%

			E00405F14(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				long _t16;
				intOrPtr _t18;
				intOrPtr* _t21;
				signed int _t23;

				E0040653D(0x42fa70, _a4);
				_t21 = E00405EB7(0x42fa70);
				if(_t21 != 0) {
					E004067C4(_t21);
					if(( *0x434f18 & 0x00000080) == 0) {
						L5:
						_t23 = _t21 - 0x42fa70 >> 1;
						while(1) {
							_t11 = lstrlenW(0x42fa70);
							_push(0x42fa70);
							if(_t11 <= _t23) {
								break;
							}
							_t12 = E00406873();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E00405E58(0x42fa70);
								continue;
							} else {
								goto L1;
							}
						}
						E00405E0C();
						_t16 = GetFileAttributesW(??); // executed
						return 0 | _t16 != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x00405f20
0x00405f2b
0x00405f2f
0x00405f36
0x00405f42
0x00405f52
0x00405f54
0x00405f6c
0x00405f6d
0x00405f74
0x00405f75
0x00000000
0x00000000
0x00405f58
0x00405f5f
0x00405f67
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f5f
0x00405f77
0x00405f7d
0x00000000
0x00405f8b
0x00405f44
0x00405f4a
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f4a
0x00405f31
0x00000000

• Part of subcall function 0040653D: lstrcpynW.KERNEL32(?,?,00000400,0040369D,00433F00,NSIS Error), ref: 0040654A
• Part of subcall function 00405EB7: CharNextW.USER32(?,?,C:\,?,00405F2B,C:\,C:\,76DDFAA0,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76DDFAA0,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
• Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405ECA
• Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405EE2
• lstrlenW.KERNEL32(C:\,00000000,C:\,C:\,76DDFAA0,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76DDFAA0,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405F6D
• GetFileAttributesW.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,76DDFAA0,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76DDFAA0,C:\Users\user\AppData\Local\Temp\), ref: 00405F7D

• C:\Users\user\AppData\Local\Temp\, xrefs: 00405F14
• C:\, xrefs: 00405F1A, 00405F1F, 00405F25, 00405F66, 00405F6C, 00405F74, 00405F7C

• Source File: 00000000.00000002.942332799.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

• Associated: 00000000.00000002.942318478.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942344612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942349438.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942376320.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942382891.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942388876.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942394858.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942403454.000000000045C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942407919.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

• Snapshot File: hcaresult_0_2_400000_doc.jbxd

• API ID: CharNext$AttributesFilelstrcpynlstrlen
• String ID: C:\$C:\Users\user\AppData\Local\Temp\
• API String ID: 3248276644-1964270705
• Opcode ID: 442e1b1d96b1c23b6c0207761c3788c7dd97485575ed4e88a223653099446a7a
• Instruction ID: e20fb510edeaf32ba19235dad054e15b0ffac27cf679254cac4fdbc394554759
• Opcode Fuzzy Hash: 442e1b1d96b1c23b6c0207761c3788c7dd97485575ed4e88a223653099446a7a
• Instruction Fuzzy Hash: E3F0F426119D6226DB22333A5C05EAF0554CE9276475A023BF895B12C5DB3C8A43D8AE

Uniqueness Score: -1.00%

			E0040605C(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				intOrPtr _v8;
				short _v12;
				short _t12;
				intOrPtr _t13;
				signed int _t14;
				WCHAR* _t17;
				signed int _t19;
				signed short _t23;
				WCHAR* _t26;

				_t26 = _a4;
				_t23 = 0x64;
				while(1) {
					_t12 =  *L"nsa"; // 0x73006e
					_t23 = _t23 - 1;
					_v12 = _t12;
					_t13 =  *0x40a57c; // 0x61
					_v8 = _t13;
					_t14 = GetTickCount();
					_t19 = 0x1a;
					_v8 = _v8 + _t14 % _t19;
					_t17 = GetTempFileNameW(_a8,  &_v12, 0, _t26); // executed
					if(_t17 != 0) {
						break;
					}
					if(_t23 != 0) {
						continue;
					} else {
						 *_t26 =  *_t26 & _t23;
					}
					L4:
					return _t17;
				}
				_t17 = _t26;
				goto L4;
			}

0x00406062
0x00406068
0x00406069
0x00406069
0x0040606e
0x0040606f
0x00406072
0x00406077
0x0040607a
0x00406084
0x00406091
0x00406095
0x0040609d
0x00000000
0x00000000
0x004060a1
0x00000000
0x004060a3
0x004060a3
0x004060a3
0x004060a6
0x004060a9
0x004060a9
0x004060ac
0x00000000

• GetTickCount.KERNEL32 ref: 0040607A
• GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,?,0040352B,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406095

• C:\Users\user\AppData\Local\Temp\, xrefs: 00406061
• nsa, xrefs: 00406069

• Source File: 00000000.00000002.942332799.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

• Associated: 00000000.00000002.942318478.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942344612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942349438.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942376320.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942382891.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942388876.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942394858.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942403454.000000000045C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942407919.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

• Snapshot File: hcaresult_0_2_400000_doc.jbxd

• API ID: CountFileNameTempTick
• String ID: C:\Users\user\AppData\Local\Temp\$nsa
• API String ID: 1716503409-44229769
• Opcode ID: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
• Instruction ID: cc98cbd97bba9fac9576f26979179aa346a2ab2dc3c85b14509754d74f2b81c3
• Opcode Fuzzy Hash: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
• Instruction Fuzzy Hash: CEF09076B40204FBEB00CF69ED05E9EB7BCEB95750F11803AFA05F7140E6B499648768

Uniqueness Score: -1.00%

			E004015C1(short __ebx, void* __eflags) {
				void* _t17;
				int _t23;
				void* _t25;
				signed char _t26;
				short _t28;
				short _t31;
				short* _t34;
				void* _t36;

				_t28 = __ebx;
				 *(_t36 + 8) = E00402DA6(0xfffffff0);
				_t17 = E00405EB7(_t16);
				_t32 = _t17;
				if(_t17 != __ebx) {
					do {
						_t34 = E00405E39(_t32, 0x5c);
						_t31 =  *_t34;
						 *_t34 = _t28;
						if(_t31 != _t28) {
							L5:
							_t25 = E00405AEB( *(_t36 + 8));
						} else {
							_t42 =  *((intOrPtr*)(_t36 - 0x28)) - _t28;
							if( *((intOrPtr*)(_t36 - 0x28)) == _t28 || E00405B08(_t42) == 0) {
								goto L5;
							} else {
								_t25 = E00405A6E( *(_t36 + 8)); // executed
							}
						}
						if(_t25 != _t28) {
							if(_t25 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
							} else {
								_t26 = GetFileAttributesW( *(_t36 + 8)); // executed
								if((_t26 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						 *_t34 = _t31;
						_t32 = _t34 + 2;
					} while (_t31 != _t28);
				}
				if( *((intOrPtr*)(_t36 - 0x2c)) == _t28) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E0040653D(L"C:\\Users\\alfons\\AppData\\Local\\Temp",  *(_t36 + 8));
					_t23 = SetCurrentDirectoryW( *(_t36 + 8)); // executed
					if(_t23 == 0) {
						 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
					}
				}
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t36 - 4));
				return 0;
			}

0x004015c1
0x004015c9
0x004015cc
0x004015d1
0x004015d5
0x004015d7
0x004015df
0x004015e1
0x004015e4
0x004015ea
0x00401604
0x00401607
0x004015ec
0x004015ec
0x004015ef
0x00000000
0x004015fa
0x004015fd
0x004015fd
0x004015ef
0x0040160e
0x00401615
0x00401624
0x00401624
0x00401617
0x0040161a
0x00401622
0x00000000
0x00000000
0x00401622
0x00401615
0x00401627
0x0040162b
0x0040162c
0x004015d7
0x00401634
0x00401663
0x004022f1
0x00401636
0x00401638
0x00401645
0x0040164d
0x00401655
0x0040165b
0x0040165b
0x00401655
0x00402c2d
0x00402c39

• Part of subcall function 00405EB7: CharNextW.USER32(?,?,C:\,?,00405F2B,C:\,C:\,76DDFAA0,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76DDFAA0,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
• Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405ECA
• Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405EE2
• GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A
• Part of subcall function 00405A6E: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB1
• SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Temp,?,00000000,000000F0), ref: 0040164D

• C:\Users\user\AppData\Local\Temp, xrefs: 00401640

• Source File: 00000000.00000002.942332799.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

• Associated: 00000000.00000002.942318478.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942344612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942349438.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942376320.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942382891.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942388876.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942394858.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942403454.000000000045C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942407919.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

• Snapshot File: hcaresult_0_2_400000_doc.jbxd

• API ID: CharNext$Directory$AttributesCreateCurrentFile
• String ID: C:\Users\user\AppData\Local\Temp
• API String ID: 1892508949-1943935188
• Opcode ID: b33db422fb51fa5ecbdb099e32eb378baf88cce1f79279cf93775203c76b05d0
• Instruction ID: 910f9ca0e916fbda017ea5bccd1daba2d9720f9cae8b5c5670dceb894c5ef12e
• Opcode Fuzzy Hash: b33db422fb51fa5ecbdb099e32eb378baf88cce1f79279cf93775203c76b05d0
• Instruction Fuzzy Hash: 3E11D031504110EBCF216FA5CD4099F36A0EF25369B28493BE945B52F1DA3E4A829A8E

Uniqueness Score: -1.00%

			E004020D8(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t31;
				void* _t32;
				WCHAR* _t35;
				intOrPtr* _t36;
				void* _t37;
				void* _t39;

				_t32 = __ebx;
				asm("sbb eax, 0x434fc0");
				 *(_t39 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x434f88 =  *0x434f88 +  *(_t39 - 4);
					return 0;
				}
				_t35 = E00402DA6(0xfffffff0);
				 *((intOrPtr*)(_t39 - 0x44)) = E00402DA6(1);
				if( *((intOrPtr*)(_t39 - 0x20)) == __ebx) {
					L3:
					_t23 = LoadLibraryExW(_t35, _t32, 8); // executed
					_t47 = _t23 - _t32;
					 *(_t39 + 8) = _t23;
					if(_t23 == _t32) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t36 = E00406979(_t47,  *(_t39 + 8),  *((intOrPtr*)(_t39 - 0x44)));
					if(_t36 == _t32) {
						E0040559F(0xfffffff7,  *((intOrPtr*)(_t39 - 0x44)));
					} else {
						 *(_t39 - 4) = _t32;
						if( *((intOrPtr*)(_t39 - 0x28)) == _t32) {
							 *_t36( *((intOrPtr*)(_t39 - 8)), 0x400, _t37, 0x40ce50, 0x40a000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t39 - 0x28)));
							if( *_t36() != 0) {
								 *(_t39 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t39 - 0x24)) == _t32 && E00403B8C( *(_t39 + 8)) != 0) {
						FreeLibrary( *(_t39 + 8));
					}
					goto L16;
				}
				_t31 = GetModuleHandleW(_t35); // executed
				 *(_t39 + 8) = _t31;
				if(_t31 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x004020d8
0x004020d8
0x004020dd
0x004020e4
0x004021a3
0x004022f1
0x004022f1
0x00402c2a
0x00402c2d
0x00402c39
0x00402c39
0x004020f3
0x004020fd
0x00402100
0x00402110
0x00402114
0x0040211a
0x0040211c
0x0040211f
0x0040219c
0x00000000
0x0040219c
0x00402121
0x0040212c
0x00402130
0x00402170
0x00402132
0x00402135
0x00402138
0x00402164
0x0040213a
0x0040213d
0x00402146
0x00402148
0x00402148
0x00402146
0x00402138
0x00402178
0x00402191
0x00402191
0x00000000
0x00402178
0x00402103
0x0040210b
0x0040210e
0x00000000
0x00000000
0x00000000

• GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00402103
• Part of subcall function 0040559F: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll,00000000,00425A20,76DDEA30,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
• Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll,00000000,00425A20,76DDEA30,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
• Part of subcall function 0040559F: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll,00403418), ref: 004055FA
• Part of subcall function 0040559F: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nss87EF.tmp\System.dll), ref: 0040560C
• Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
• Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
• Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A
• LoadLibraryExW.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00402114
• FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402191

• Source File: 00000000.00000002.942332799.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

• Associated: 00000000.00000002.942318478.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942344612.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942349438.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942376320.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942382891.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942388876.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942394858.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942403454.000000000045C000.00000004.00000001.01000000.00000003.sdmpDownload File
• Associated: 00000000.00000002.942407919.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

• Snapshot File: hcaresult_0_2_400000_doc.jbxd

• API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
• String ID:
• API String ID: 334405425-0
• Opcode ID: e358be4b43dc3f4cab4316b49d88f5956aefe482ddac7a31448b42a5d9f8adf8
• Instruction ID: d1cf9917c249e547a3b1759614bc69e8b445b1996c4dbd71fd6f6dd46acd7470
• Opcode Fuzzy Hash: e358be4b43dc3f4cab4316b49d88f5956aefe482ddac7a31448b42a5d9f8adf8
• Instruction Fuzzy Hash: 2A21C231904104FACF11AFA5CE48A9D7A71BF48358F20413BF605B91E1DBBD8A82965D

Uniqueness Score: -1.00%

			E00401B9B(void* __ebx) {
				intOrPtr _t8;
				void* _t9;
				void _t12;
				void* _t14;
				void* _t22;
				void* _t25;
				void* _t30;
				char* _t32;
				void* _t33;
				void* _t34;
				void* _t37;

				_t28 = __ebx;
				_t8 =  *((intOrPtr*)(_t37 - 0x28));
				_t33 =  *0x40ce50; // 0x0
				if(_t8 == __ebx) {
					if( *((intOrPtr*)(_t37 - 0x2c)) == __ebx) {
						_t9 = GlobalAlloc(0x40, 0x804); // executed
						_t34 = _t9;
						_t5 = _t34 + 4; // 0x4
						E0040657A(__ebx, _t30, _t34, _t5,  *((intOrPtr*)(_t37 - 0x30)));
						_t12 =  *0x40ce50; // 0x0
						 *_t34 = _t12;
						 *0x40ce50 = _t34;
					} else {
						if(_t33 == __ebx) {
							 *((intOrPtr*)(_t37 - 4)) = 1;
						} else {
							_t3 = _t33 + 4; // 0x4
							E0040653D(_t30, _t3);
							_push(_t33);
							 *0x40ce50 =  *_t33;
							GlobalFree();
						}
					}
					goto L15;
				} else {
					while(1) {
						_t8 = _t8 - 1;
						if(_t33 == _t28) {
							break;
						}
						_t33 =  *_t33;
						if(_t8 != _t28) {
							continue;
						} else {
							if(_t33 == _t28) {
								break;
							} else {
								_t36 = _t33 + 4;
								_t32 = L"Call";
								E0040653D(_t32, _t33 + 4);
								_t22 =  *0x40ce50; // 0x0
								E0040653D(_t36, _t22 + 4);
								_t25 =  *0x40ce50; // 0x0
								_push(_t32);
								_push(_t25 + 4);
								E0040653D();
								L15:
								 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t37 - 4));
								_t14 = 0;
							}
						}
						goto L17;
					}
					_push(0x200010);
					_push(E0040657A(_t28, _t30, _t33, _t28, 0xffffffe8));
					E00405B9D();
					_t14 = 0x7fffffff;
				}
				L17:
				return _t14;
			}

0x00401b9b
0x00401b9b
0x00401b9e
0x00401ba6
0x00401bef
0x00401c1d
0x00401c26
0x00401c28
0x00401c2c
0x00401c31
0x00401c36
0x00401c38
0x00401bf1
0x00401bf3
0x0040292e
0x00401bf9
0x00401bf9
0x00401bfe
0x00401c05
0x00401c06
0x00401c0b
0x00401c0b
0x00401bf3
0x00000000
0x00401ba8
0x00401ba8
0x00401ba8
0x00401bab
0x00000000
0x00000000
0x00401bb1
0x00401bb5
0x00000000
0x00401bb7
0x00401bb9
0x00000000
0x00401bbf
0x00401bbf
0x00401bc2
0x00401bc9
0x00401bce
0x00401bd8
0x00401bdd
0x00401be2
0x00401be6
0x00402a94
0x00402c2a
0x00402c2d
0x00402c33
0x00402c33
0x00401bb9
0x00000000
0x00401bb5
0x0040238a
0x00402397
0x00402398
0x0040239d
0x0040239d
0x00402c35
0x00402c39