IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

IMAGE_FILE_RELOCS_STRIPPED

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

ord2729

ord5268

ord5267

ord602

ord3562

ord2281

ord927

ord4273

ord2574

ord4396

ord3365

ord3635

ord693

ord686

ord802

ord384

ord542

ord6896

ord2857

ord6898

ord2088

ord5647

ord3122

ord3611

ord350

ord4690

ord3053

ord3060

ord6332

ord2502

ord2534

ord5239

ord1739

ord5573

ord3167

ord5649

ord4381

ord3449

ord3193

ord6076

ord6171

ord4617

ord4420

ord4414

ord2391

ord4211

ord665

ord1971

ord3178

ord6381

ord5180

ord354

ord941

ord501

ord773

ord5736

ord4947

ord4852

ord6004

ord1817

ord338

ord4817

ord4233

ord652

ord2078

ord2855

ord1560

ord268

ord4078

ord1936

ord1826

ord4224

ord4583

ord4582

ord4893

ord4364

ord4886

ord4527

ord4334

ord4883

ord4525

ord4539

ord4537

ord4520

ord4523

ord4518

ord4957

ord4954

ord4103

ord6050

ord5236

ord3743

ord1718

ord5256

ord4426

ord5906

ord2970

ord4282

ord4279

ord3792

ord1833

ord784

ord5070

ord4341

ord5277

ord2083

ord804

ord4236

ord3701

ord2579

ord4400

ord3389

ord3724

ord364

ord4714

ord5848

ord4502

ord4780

ord6139

ord6874

ord801

ord4988

ord834

ord541

ord3753

ord935

ord939

ord2070

ord5031

ord2236

ord5854

ord6298

ord4163

ord5603

ord6136

ord2754

ord1083

ord5617

ord654

ord341

ord413

ord711

ord2400

ord2858

ord2090

ord539

ord537

ord1808

ord4215

ord2576

ord3649

ord2430

ord1637

ord3084

ord6266

ord5155

ord5156

ord5154

ord4899

ord4736

ord4970

ord4942

ord3093

ord4371

ord4848

ord5283

ord4829

ord3694

ord489

ord4253

ord768

ord4709

ord1683

ord4433

ord2046

ord4425

ord3695

ord496

ord4254

ord5050

ord2520

ord5845

ord2876

ord3470

ord5284

ord5790

ord6168

ord5785

ord4238

ord3288

ord3281

ord4442

ord4665

ord4670

ord4975

ord1851

ord4241

ord3864

ord2119

ord2383

ord5096

ord5099

ord3345

ord975

ord2875

ord4148

ord2375

ord5280

ord4431

ord4422

ord796

ord807

ord4584

ord4407

ord5251

ord4495

ord3865

ord4356

ord4143

ord554

ord529

ord402

ord6063

ord6205

ord5048

ord4901

ord6065

ord3479

ord4462

ord2250

ord5867

ord2486

ord2619

ord2618

ord5996

ord2109

ord5879

ord2112

ord4451

ord4718

ord5677

ord3739

ord3693

ord765

ord4199

ord4269

ord4605

ord4603

ord4479

ord3466

ord1994

ord5725

ord5190

ord5498

ord3441

ord3190

ord985

ord3597

ord648

ord334

ord5727

ord6399

ord2504

ord5124

ord6371

ord692

ord6193

ord5047

ord815

ord4480

ord2546

ord3917

ord2388

ord3341

ord5296

ord5298

ord4074

ord4692

ord5303

ord5285

ord5710

ord4616

ord3733

ord561

ord2717

ord5746

ord4604

ord3282

ord5846

ord4606

ord6191

ord986

ord411

ord1229

ord4154

ord2613

ord6113

ord6024

ord1264

ord1764

ord6362

ord2405

ord2016

ord4214

ord2573

ord4395

ord3634

ord832

ord5446

ord6390

ord5436

ord6379

ord860

ord3728

ord810

ord4266

ord3393

ord3291

ord4118

ord1561

ord1177

ord1127

ord643

ord2443

ord5978

ord329

ord3197

ord1169

ord5856

ord1941

ord772

ord500

ord5274

ord5714

ord2621

ord1134

ord1258

ord5602

ord1761

ord5798

ord3867

ord5605

ord5597

ord6565

ord4272

ord536

ord3312

ord2776

ord6655

ord3092

ord6867

ord2859

ord2756

ord6278

ord6237

ord470

ord6115

ord755

ord472

ord5783

ord5784

ord4292

ord4128

ord836

ord3050

ord323

ord920

ord837

ord6017

ord5869

ord2397

ord640

ord2746

ord5871

ord6166

ord283

ord818

ord3737

ord919

ord929

ord2854

ord5781

ord1633

ord1143

ord3566

ord1634

ord3614

ord3568

ord4270

ord2406

ord3621

ord3658

ord6770

ord922

ord2291

ord6279

ord2755

ord3805

ord933

ord3875

ord3420

ord3049

ord3222

ord3403

ord2910

ord5568

ord5929

ord3605

ord6451

ord656

ord2290

ord2244

ord4280

ord4283

ord6211

ord3476

ord5977

ord3133

ord4294

ord527

ord794

ord5679

ord5706

ord4124

ord2809

ord2371

ord2914

ord942

ord3871

ord940

ord535

ord609

ord3569

ord4390

ord2567

ord3716

ord6195

ord795

ord5279

ord401

ord4494

ord976

ord4461

ord5250

ord4421

ord2437

ord4430

ord1658

ord2641

ord2374

ord5233

ord4072

ord4147

ord2873

ord2874

ord3398

ord5468

ord5006

ord3346

ord4298

ord5098

ord5094

ord3054

ord2382

ord2715

ord2093

ord5095

ord674

ord4240

ord1850

ord1008

ord771

ord2350

ord823

ord1662

ord2644

ord3087

ord2634

ord5949

ord616

ord567

ord3577

ord4418

ord3397

ord5286

ord4392

ord1768

ord6051

ord2570

ord4213

ord2015

ord2403

ord2294

ord2293

ord1172

ord1165

ord2362

ord825

ord2637

ord4847

realloc

malloc

free

wcsncpy

wcscmp

_wcsicmp

swscanf

wcsstr

_wcslwr

_ftol

wcschr

calloc

wcscat

_wcsupr

memmove

_CxxThrowException

wprintf

wcsncat

_snwprintf

wcspbrk

wcsncmp

_except_handler3

_local_unwind2

_wcsnicmp

_purecall

wcscpy

wcsrchr

wcslen

__CxxFrameHandler

swprintf

_wtoi

isalpha

localtime

_tzset

mktime

_putenv

_errno

fseek

_fdopen

_open_osfhandle

_wcsrev

_wcsdup

fflush

fread

_filelength

_getpid

_mbscpy

_mbslen

_wfopen

wcstok

_controlfp

_onexit

__dllonexit

?terminate@@YAXXZ

??1type_info@@UAE@XZ

__set_app_type

__p__fmode

__p__commode

_adjust_fdiv

__setusermatherr

_initterm

__wgetmainargs

_wcmdln

exit

_cexit

_XcptFilter

_exit

_c_exit

_vsnwprintf

isspace

fclose

ftell

time

clearerr

fwrite

RegOpenKeyExA

QueryServiceStatus

OpenServiceW

StartServiceW

GetUserNameW

RegisterEventSourceW

ReportEventW

GetSecurityDescriptorDacl

InitializeSecurityDescriptor

SetEntriesInAclW

SetSecurityDescriptorDacl

RegDeleteValueW

AddAccessAllowedAce

RegQueryValueExA

ReadEncryptedFileRaw

WriteEncryptedFileRaw

EnumDependentServicesW

ControlService

OpenEncryptedFileRawW

CloseEncryptedFileRaw

EncryptFileW

DecryptFileW

RegRestoreKeyW

RegLoadKeyW

RegFlushKey

RegUnLoadKeyW

RegReplaceKeyW

RegConnectRegistryW

InitializeAcl

GetAce

EqualSid

DeleteAce

RegQueryValueExW

RegOpenKeyExW

RegCloseKey

RegEnumValueW

RegCreateKeyExW

RegSetValueExW

CloseServiceHandle

OpenSCManagerW

RegOpenKeyW

AllocateAndInitializeSid

FreeSid

CheckTokenMembership

RegEnumKeyExW

AdjustTokenPrivileges

LookupPrivilegeValueW

OpenProcessToken

LookupAccountSidW

GetTokenInformation

OpenThreadToken

RegSaveKeyW

SetFileSecurityW

GetCurrentProcess

GetTickCount

Sleep

GetComputerNameW

EnterCriticalSection

LeaveCriticalSection

InitializeCriticalSection

WaitForSingleObject

TerminateThread

DeleteCriticalSection

GetVolumeInformationW

GetVolumeNameForVolumeMountPointW

GetFileAttributesW

LoadLibraryW

GetProcAddress

FreeLibrary

GetModuleFileNameW

ExpandEnvironmentStringsW

WritePrivateProfileStringW

GetPrivateProfileStringW

SetCurrentDirectoryW

GetLogicalDriveStringsW

GetDriveTypeW

GetDiskFreeSpaceExW

CreateThread

FindFirstFileW

FindClose

GetLocaleInfoW

SetLastError

GetLastError

DeleteFileW

CreateDirectoryW

CreateFileW

GetCurrentThread

GetDateFormatW

GetTimeFormatW

GetTapeParameters

ReleaseMutex

CreateMutexW

GetCurrentThreadId

GetVersionExW

GetSystemDirectoryW

ReleaseSemaphore

CreateSemaphoreW

LocalFree

VerifyVersionInfoW

VerSetConditionMask

FindNextFileW

FormatMessageW

CreateProcessW

GlobalFree

LockResource

LoadResource

FindResourceW

QueryPerformanceCounter

GetCurrentProcessId

GetSystemTimeAsFileTime

TerminateProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetModuleHandleA

GetStartupInfoW

SetFileAttributesW

GetFileInformationByHandle

GetExitCodeThread

GetEnvironmentVariableW

WriteFile

ReadFile

DeviceIoControl

FlushFileBuffers

GetVolumePathNameW

GetUserDefaultLCID

MultiByteToWideChar

SetEvent

CreateEventW

HeapFree

HeapAlloc

GetProcessHeap

SetFilePointer

GetSystemTime

CloseHandle

GetWindowsDirectoryW

FileTimeToSystemTime

FileTimeToLocalFileTime

GetLocalTime

GetCurrentDirectoryA

GetCurrentDirectoryW

CompareStringW

GetNumberFormatW

SetErrorMode

SetEndOfFile

SetTapePosition

GetTapePosition

EraseTape

WriteTapemark

GetTapeStatus

SetTapeParameters

PrepareTape

FindVolumeMountPointClose

FindNextVolumeMountPointW

FindFirstVolumeMountPointW

ExitThread

MoveFileExW

SystemTimeToTzSpecificLocalTime

GetTimeZoneInformation

SystemTimeToFileTime

BackupRead

BackupWrite

CreateHardLinkW

BackupSeek

GetFileSize

LockFile

SetFileShortNameW

SetFileTime

LocalFileTimeToFileTime

GetCompressedFileSizeW

RemoveDirectoryW

WideCharToMultiByte

LoadLibraryA

GetObjectW

Polygon

CombineRgn

CreateRectRgn

DeleteObject

GetTextExtentPoint32W

BitBlt

PatBlt

Rectangle

GetMapMode

SelectObject

CreateCompatibleDC

CreateCompatibleBitmap

CreateBitmap

CreateFontIndirectW

PeekMessageW

EnableWindow

SendMessageW

PostMessageW

GetCapture

SetActiveWindow

GetAsyncKeyState

GetDlgItem

AppendMenuW

wvsprintfW

LoadStringW

GetKeyState

GetWindowRect

ScreenToClient

EnableMenuItem

DeleteMenu

SetClassLongW

IsCharAlphaW

IsCharAlphaNumericW

GetCursorPos

WindowFromPoint

ChildWindowFromPoint

GetSysColor

LoadCursorW

KillTimer

IsWindowVisible

InvalidateRect

ReleaseDC

GetDC

GetClientRect

LoadBitmapW

DefWindowProcW

PostQuitMessage

CreateDialogParamW

ShowWindow

DestroyWindow

UnregisterClassW

MonitorFromWindow

GetMonitorInfoW

GetFocus

LoadMenuW

GetWindowThreadProcessId

SetWindowsHookExW

UnhookWindowsHookEx

CallNextHookEx

LoadImageW

GetMenu

RemoveMenu

GetSubMenu

CreateIconFromResource

LoadIconW

DrawFocusRect

InflateRect

CopyRect

GetActiveWindow

InvalidateRgn

MapDialogRect

SetWindowPos

ExitWindowsEx

SendDlgItemMessageW

SetParent

GetIconInfo

CreateIconIndirect

DestroyIcon

LockSetForegroundWindow

UpdateWindow

SetWindowLongW

ClientToScreen

SetCursor

MessageBoxW

BringWindowToTop

SystemParametersInfoW

FlashWindow

GetDesktopWindow

IsIconic

GetMenuItemID

SetTimer

IsWindow

GetWindowTextLengthW

SetWindowTextW

wsprintfW

GetNextDlgGroupItem

GetWindowTextW

GetWindow

GetWindowLongW

GetParent

GetSystemMetrics

GetMenuItemCount

iswctype

_aulldvrm

towupper

NtSetQuotaInformationFile

NtQueryQuotaInformationFile

wcstoul

wcscspn

isdigit

DestroyPropertySheetPage

CreatePropertySheetPageW

ImageList_AddMasked

ImageList_GetIcon

ImageList_GetImageCount

ImageList_ReplaceIcon

InitCommonControlsEx

PropertySheetW

SHGetSpecialFolderLocation

ExtractIconExW

SHGetDesktopFolder

SHGetPathFromIDListW

SHGetMalloc

SHGetFileInfoW

SHGetFolderPathW

WNetEnumResourceW

WNetOpenEnumW

WNetGetConnectionW

WNetAddConnection2W

WNetCancelConnection2W

WNetCloseEnum

GetOpenFileNameW

GetFileTitleW

GetSaveFileNameW

NetServerEnum

NetApiBufferSize

NetShareEnum

NetShareGetInfo

NetWkstaGetInfo

NetApiBufferFree

UuidToStringW

UuidFromStringW

CoInitializeEx

CoCreateGuid

CLSIDFromString

StringFromGUID2

CoCreateInstance

CoTaskMemFree

CoUninitialize

CoInitializeSecurity

SetupCloseInfFile

SetupFindNextLine

SetupFindFirstLineW

SetupOpenInfFileW

SetupGetLineTextW

SetupGetIntField

SetupGetStringFieldW

GetProfilesDirectoryW

CloseNtmsNotification

WaitForNtmsNotification

OpenNtmsNotification

MoveToNtmsMediaPool

CloseNtmsSession

DeleteNtmsMedia

DeallocateNtmsMedia

AllocateNtmsMedia

GetNtmsObjectSecurity

DismountNtmsMedia

SetNtmsObjectSecurity

UpdateNtmsOmidInfo

ImportNtmsDatabase

InjectNtmsMedia

AccessNtmsLibraryDoor

EjectNtmsMedia

GetNtmsObjectInformationW

SetNtmsObjectInformationW

GetNtmsObjectAttributeW

SetNtmsObjectAttributeW

EnumerateNtmsObject

CreateNtmsMediaPoolW

DeleteNtmsMediaPool

EndNtmsDeviceChangeDetection

SetNtmsDeviceChangeDetection

OpenNtmsSessionW

IdentifyNtmsSlot

SetNtmsUIOptionsW

BeginNtmsDeviceChangeDetection

MountNtmsMedia

RestoreClusterDatabase

GetNodeClusterState

SetCatalogState

SfcGetNextProtectedFile

AsrRestorePlugPlayRegistryData

AsrAddSifEntryW

AsrFreeContext

AsrCreateStateFileW

SysFreeString

ord3

ord4

?CreateVssBackupComponents@@YGJPAPAVIVssBackupComponents@@@Z

ord6

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

IMAGE_SCN_CNT_CODE

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE